Detect sector layout from Master TOC signatures and strip physical framing while preserving logical addressing, bounds and file mutation checks. Add reader and scanner regressions with synchronized CI presence guards.
Verified full decoding of 53 tracks across five real images, seek and previous-reader comparisons, isolated release UI opening and scanning, and disc, DSD, library and Qt tests.
cx
Correct dead platform declarations, stale rustdoc and test warnings; validate complete gettext headers. Install LLD in the Qt job and explicitly validate committed shader packs without rebaking them. Keep the independent shader bake gate and add three build-policy tests.
The full local gate passed 2398 workspace tests and 715 Qt tests, QML audits, shader baking and the isolated offscreen smoke without compiler, rustdoc or gettext warnings.
cx
Parse resilient SACD images, decode DST, scan ISO releases into the local library, and keep explicit opens ephemeral.
Ship decoder notices across distribution formats and align DSD album filtering and version selection.
cx
Add random access for DSF, DFF, and SACD demuxers, replace live DoP/native sources without releasing ALSA, and expose seek through Qt, MPRIS, and the daemon API.
cx
The scan never treated an .iso as audio; images only entered the library
through Open > disc image. Each root's scan now walks its .iso files,
asks qbz_disc::sacd::is_sacd_image for the SACDMTOC signature (PVD plus
Master TOC sector, four 2 KB reads at most, no directory parsing) so a DVD
or data ISO leaves silently, skips images already imported with the same
size and mtime without any I/O, and adopts the rest through the
generation-based import. The row builder moved from sacd_qt into
qbz_library::sacd_scan and the manual open is now its client, with the
translated fallback labels. Parser and import rejections are scan errors.
cc
rusqlite 0.40 removed ToSql/FromSql for u64 (SQLite integers are i64):
every u64 column now reads/writes through an explicit i64 cast. It also
rejects a multi-statement execute() instead of silently running only the
first statement — which is what catalog.rs's editions/logical_albums
prune had been doing all along; it is an execute_batch now, so the
logical_albums prune finally runs.
cc
A disc is the one medium QBZ can play that leaves nothing behind: no path, no
row, no file. Everything learned about it was thrown away when the tray opened
and re-derived from the network next time.
That is fine for names that came from MusicBrainz and not fine for names that
came from a human. One DiscID can name several pressings — this album answers
with four — so the moment there is a button to pick the right one, or a wizard
that lets a title be fixed before it is written, the choice has to outlive the
eject. Otherwise correcting a disc is a toy: fix it, take it out, put it back,
it is wrong again.
A CACHE, not a second source of truth, with one rule that makes it safe: a row
the user edited is never overwritten by an automatic lookup. put_auto refuses
to touch an edited row and only put_user can replace one, enforced in the store
rather than at the call sites so a future third lookup path cannot forget.
Identity is the TOC fingerprint: pure geometry, no network, available before
anything has been looked up, and identical on both platforms. It names the
GEOMETRY rather than the pressing, which is the point — "for this geometry the
user chose pressing 2" is the fact worth keeping.
Global rather than per-user, because which record is in the drive does not
depend on who is logged in. Seven tests, including the one this exists for.
disc_identity carries WHICH disc is open for the two features that name the
medium rather than the session; nothing there persists.
cc
The disc feature was built entirely on Linux in a day, and the result did not
COMPILE on macOS at all: qbz_disc::cdda was cfg-gated to Linux while qbz-rip,
cdda_qt and audible_qt used its names unconditionally. Any macOS build has been
broken since qbz-disc landed.
ONE SET OF NAMES, two implementations that share no code. Linux talks to the
drive through ioctls and reads raw sectors; macOS does not have to, because the
OS mounts the disc and exposes one AIFF per track plus a .TOC.plist. qbz-rip,
audible_qt and cdda_qt needed no change, which is the test of whether the seam
was in the right place. Every other platform compiles and reports "no drive".
VERIFIED against the owner's Tool — Fear Inoculum, the USB drive moved from the
Linux box to the Mac mini:
- the plist's Start Block includes the 150-sector lead-in that the kernel
omits. Subtracting it reproduces the ioctl's numbers exactly, so both
machines compute DiscID BeNBMsD8Du5NO2W61Yk.B2jwwIs- and fingerprint
38bef21351f7fca3 — which is what lets a disc corrected on one be found on
the other;
- all seven tracks read on macOS md5 to exactly what metaflac reports for the
FLACs the Linux path ripped from the same disc hours earlier.
TWO THINGS ONLY MEASUREMENT CAUGHT.
Byte order. "AIFF is big-endian" is true of the format and wrong here: macOS
writes AIFC with compression sowt, which is twos backwards and means the
samples are already little-endian. An unconditional swap produced audio that
passed every cheap statistic — 97 % non-zero, full-scale peak — and matched the
Linux rip nowhere. The COMM chunk is read and the swap is conditional.
Track resolution. audible_qt rebuilds its TocTrack from a CdRef, which carries
a device and a sector range and no track number, so it passes zero. Matching on
the number meant every CD track on macOS answered "could not read the disc"
while ripping, which passes a real number, worked — two paths disagreeing with
only one of them exercised. Resolution is by start_lsn, the address the seam
actually carries, with a regression test on a synthetic volume that fails with
NoDisc under the old rule.
One transient disagreement is recorded rather than smoothed over: reading all
seven tracks back to back once produced a different digest for the last track,
and three further reads matched. The read is not perfectly reproducible on a
marginal region, which is exactly the caveat this approach already states.
cc
Reported: a SACD image played as white noise with the music distorted behind
it, identically in all three DSD modes. That the three agreed was the clue —
DoP and native never touch the PCM filter, so the damage had to be upstream of
the delivery choice, in how the bits are pulled out of the image.
THE LAYOUT WAS DECIDED BACKWARDS. The first measurement converted twelve
seconds and looked at where the energy landed: block-per-channel put 23 % above
the audible band, byte-interleaved 0.2 %, and the reasoning was that real DSD64
must carry a large ultrasonic component. That argument does not hold for this
pipeline. DsdPcmConverter low-passes and decimates to 88.2 kHz, so it REMOVES
sigma-delta noise shaping by design — a correct decode has nothing above
24 kHz. The 23 % was aliased garbage from bits read out of order: the symptom
was being read as the proof. The ratio does not discriminate either, since
scrambled bits and shaped noise both put energy up high.
Re-measured with a statistic that can come out differently: decode with the
real converter, then ask whether the audible band has the shape of music and
whether the two channels are a stereo pair at all.
layout spectral flatness L/R correlation
BlockPerChannel 0.038 … 0.107 -0.17 … -0.06
ByteInterleaved 0.0036 … 0.0093 +0.24 … +0.48
Tracks 1, 4 and 13 of disc 1 and track 5 of disc 2. A negative correlation
between the channels of an orchestral recording is not a subtle hint, and a
spectrum ten to twenty times flatter is noise.
Two earlier instruments are recorded in the doc as non-discriminating rather
than deleted quietly: the energy ratio, and the variance of the raw stream's
64-bit local mean, which answers the same for clean and scrambled bits because
the local mean of a byte-level mix of two correlated channels is still roughly
the audio.
Also lands a real framing bug found on the way, which was NOT the cause: the
packet descriptors carry a frame_start bit that the reader ignored, and frames
begin 0, 672 or 1344 bytes into a track's payload depending on the track. With
byte interleaving an even offset is harmless, which is why it hid; an odd one
would swap the channels. FrameSync makes the reader hunt for the boundary, and
keeps the unsynced path so a probe can reproduce the broken stream.
cc
Reported: the CD opened with its names but no artwork. The log said why,
because the previous commit taught it to — "no cover art (500 Internal Server
Error)" — which is a better failure than the silent one it replaced, and it
pointed straight at two separate bugs.
WRONG KEY. Cover art was asked for by RELEASE, and a release is one pressing.
The owner's Fear Inoculum answers 500 for its release and 200 for its RELEASE
GROUP, which is the album as a work and where the canonical art lives. The
lookup now asks for `release-groups` too and tries the release first, the
group second.
WRONG PLACE. The fetch was awaited BEFORE the session was published, so a
click produced ten seconds of nothing — measured: the Cover Art Archive took
9.4 s to answer, because it redirects to archive.org. The tracks now land
immediately and the art is patched in when it arrives.
Patching it in needs `replace_tracks_preserving_ids`: re-running `open_tracks`
would renumber every row from the synthetic floor, and the queue may already
hold the old ids — a playing track would lose its source mid-song. A late
cover for a session that has since been closed or replaced is dropped rather
than painted onto whatever is open now.
cc
Adds an ISO 9660 walk (no mounting, no privileges) and a Scarlet Book parser
for the stereo audio area, plus the `DsdDemuxer` adapter that lets every DSD
delivery the player already has — PCM, DoP, native — play a disc image.
The parser exists because the previous account of this format, written in this
repo, was WRONG: it said the per-sector header was a fixed 8 bytes, derived
from looking at one sector. Every structure below was re-derived by a CENSUS —
3 066 893 sectors across both of the owner's Rheingold discs, zero exceptions —
and each claim is falsifiable rather than asserted:
- byte 0 carries packet_count = (b>>5)&7 and frame_info_count = (b>>2)&7,
so the header is 1 + pc*2 + fic*3 and takes the values 5, 8 or 10;
- packet descriptors are BIG-endian, and the length field is ELEVEN bits,
not the twelve every published layout shows. The first descriptor on both
discs is 0x181B, whose low twelve bits are 2075 — larger than the sector
it lives in. With eleven bits it is 27, and 5 + 27 + 2016 = 2048;
- the proof of the whole decoding is the sum rule
`header + SUM(packet lengths) == 2048`, which the parser CHECKS on every
sector rather than trusting;
- the area is uncompressed, proven from the data and not from a flag: the
audio-packet bytes divide by 9408 (one uncompressed DSD64 stereo frame)
exactly — 350 495 frames on Disc 1, 306 696 on Disc 2. DST is
variable-length; those could not be integers.
Track geometry comes from SACDTRL1/TRL2, tied together by an identity that
holds for 44 of 44 tracks: start_lsn == area_start + start_time * 350. The
ISO 9660 extents mirror SACDTRL1 byte for byte, so the one-sector overlap
between consecutive tracks is the disc's own accounting, not a bug to fix.
The channel layout inside a frame was the last unknown, and three statistical
probes could not settle it — they were measuring the DSD noise floor. What
settled it was physics: converted with the real filter, block-per-channel puts
23 % of its energy above the audible band while byte-interleaving puts 0.2 %
there. A correctly decoded 1-bit stream MUST carry that rising noise floor,
and no filter puts it back once scrambling has folded it away.
Also in this commit, from the same measurements: `2C_TAREA.2CH` on Disc 1 is
recorded in FOUR extents, so `IsoImage::find` REFUSES a multi-extent file
rather than returning its first quarter as if it were the whole thing.
cc
New crate `qbz-disc`: table of contents and raw audio sectors through the
kernel's own cdrom ioctls. No libcdio — not because libcdio is worse (it is
better at RIPPING than this will ever be) but because this path PLAYS a clean
disc, and for that the kernel interface is enough while a native library would
have to be built into Flatpak, Snap and AppImage. Both need the same --device
permission in a sandbox; only one needs the library shipped.
Every claim below was measured on the owner's USB drive with Tool — Fear
Inoculum BEFORE a line of this crate existed, so the design answers evidence
rather than the other way round:
- the TOC reads back 7 audio tracks, lead-out at LSN 356568, and the track
lengths match the record exactly (10:21, 11:52, 12:44, 13:37, 10:05, 4:48,
15:44 — 79:11 total);
- CDROMREADAUDIO over 20 frames from LSN 4000 returned 47 040 bytes, 99 %
non-zero samples, peak 14559: real audio, not silence;
- the drive hands back LITTLE-endian samples. Neighbouring-sample deltas
average 73.5 read as LE against 20 971 read as BE, a 285x margin, so the
bytes go straight into a little-endian WAV with no swap. That is one
drive, so `looks_byte_swapped` keeps the test available as a diagnostic
instead of an article of faith;
- the disc's MCN is all zeros, which is why identity is a digest over the
track table and not the catalogue number.
What this is NOT is accurate extraction: no overlap synchronisation, no cache
modelling, no jitter verification. On a clean disc that is fine for playback,
and an unreadable sector surfaces as an ERROR rather than a hole full of
zeros — silence that pretends to be audio is the one outcome a bit-perfect
player must never produce.
`/dev/sr0` is nowhere in the code: drives are enumerated, because a box can
have several and /dev/cdrom is a symlink that may point at any of them. Data
tracks of a mixed-mode disc are skipped by their control bits.
`CdRef` is the typed reference (`cdda:/dev/sr0#285735+70833`) with ONE parser,
not prefix tests copied around — the scattered version is a known failure mode
here and cost a whole session on 2026-08-20.
11 tests, several asserting against that real table of contents.
cc
vicrodh