oxideav-opus 0.0.13

//! Top-level Opus packet → PCM orchestration — RFC 6716 §3 / §4.
//!
//! This module is the keystone that turns a raw Opus packet (a TOC byte
//! plus one or more §3.2-packed Opus frames) into interleaved 48 kHz PCM
//! samples. It sits above every per-stage SILK / CELT decoder in the
//! crate and wires the §3.1 TOC parse, the §3.2 frame packing
//! ([`crate::frames::OpusPacket`]), and the §4.2 / §4.3 per-frame mode
//! dispatch ([`crate::framing::OpusFrameRouting`]) into one
//! [`OpusDecoder::decode_packet`] call.
//!
//! ## What this module owns
//!
//! * The packet → frame split (delegated to [`OpusPacket::parse`]).
//! * The §4.5 multi-frame loop: every Opus frame in a code-1 / code-2 /
//!   code-3 packet is decoded in order and its PCM appended to the
//!   output, so a 60 ms code-3 packet of three 20 ms frames yields one
//!   contiguous PCM buffer.
//! * The §3.2.1 DTX / lost-frame marker handling: a zero-length frame
//!   slice contributes one Opus-frame worth of silence (the §4.6 PLC
//!   "fill with silence" floor — a real concealment model is a separate
//!   milestone).
//! * The 48 kHz output sample-count accounting (RFC 7845 §5.1: the Opus
//!   decoder always emits 48 kHz regardless of the internal SILK / CELT
//!   sample rate).
//! * The per-frame routing seam: each Opus frame is dispatched to
//!   [`Self::decode_silk_only_frame`], [`Self::decode_celt_only_frame`],
//!   or [`Self::decode_hybrid_frame`] based on its [`OpusFrameRouting`].
//!
//! ## What this module does not own
//!
//! * The §4.1 range-coder primitive ([`crate::range_decoder`]).
//! * The per-stage SILK / CELT decode (the `silk_*` / `celt_*` modules).
//! * Any container parsing (Ogg / RTP framing live in their own crates;
//!   this module consumes a bare Opus packet).
//!
//! ## Status of the per-frame audio decode
//!
//! The packet-level orchestration (TOC → framing → routing → 48 kHz PCM
//! buffer layout) is complete and total over all 32 §3.1 configs and all
//! four §3.2 frame-count codes. The per-frame audio decode is wired
//! incrementally:
//!
//! * **Mono SILK-only** frames run the full §4.2 decode → PCM path: the
//!   §4.2.3 header bits, the §4.2.5 LBRR / §4.2.6 regular SILK frame loop
//!   (1 / 2 / 3 SILK frames per §4.2.2), each frame decoded in Table-5
//!   order via [`crate::silk_decode::decode_silk_frame`] with the
//!   inter-frame state threaded across them, then the §4.2.7.9 LTP / LPC
//!   synthesis ([`crate::silk_synthesis::synthesize_silk_frame`]) and the
//!   §4.2.9 (non-normative) resample to 48 kHz. The carried §4.2.7.9
//!   synthesis histories persist across the packet's Opus frames; the
//!   emitted PCM is real audio ([`FrameDecodeStatus::SilkParamsDecoded`]).
//! * **Stereo SILK-only** frames run the full §4.2 interleaved decode →
//!   PCM path: the §4.2.3 two-channel header bits, the §4.2.5 / §4.2.6
//!   mid/side interleave (mid frame then side frame per 20 ms interval,
//!   the side frame skipped when the §4.2.7.2 mid-only flag is set), each
//!   channel's §4.2.7.9 synthesis with its own carried history, then the
//!   §4.2.8 mid/side → left/right unmixing
//!   ([`crate::silk_stereo::stereo_ms_to_lr`]) and the §4.2.9 resample,
//!   emitting interleaved L/R PCM
//!   ([`FrameDecodeStatus::SilkStereoDecoded`]). The §4.2.7.1 mono→stereo
//!   weight reset and the §4.5.2 SILK state reset are applied across
//!   packets.
//! * **CELT-only / Hybrid** frames emit silence of the correct length
//!   flagged [`FrameDecodeStatus::LayerNotWired`] (CELT is gated on the
//!   §4.3.2.1 coarse-energy Laplace decode).
//!
//! Either way the multi-frame packet loop and the RFC 7845 §5.1 48 kHz
//! sample-count accounting are exercised end-to-end.

use crate::frames::OpusPacket;
use crate::framing::{OperatingMode, OpusFrameRouting};
use crate::toc::ChannelMapping;
use crate::Error;

/// Output sample rate of the Opus decoder, in Hz. Per RFC 7845 §5.1 the
/// decoder always emits 48 kHz regardless of the internal SILK / CELT
/// sample rate; the per-layer resamplers upsample to this rate.
pub const OUTPUT_SAMPLE_RATE_HZ: u32 = 48_000;

/// Output samples per millisecond per channel at [`OUTPUT_SAMPLE_RATE_HZ`].
pub const OUTPUT_SAMPLES_PER_MS: u32 = OUTPUT_SAMPLE_RATE_HZ / 1000;

/// Number of 48 kHz output samples (per channel) an Opus frame of the
/// given duration produces.
///
/// `frame_size_tenths_ms` is the §3.1 Table 2 duration in tenths of a
/// millisecond (25, 50, 100, 200, 400, 600). The 2.5 ms CELT case
/// (`25` tenths) yields `25 * 48 / 10 = 120` samples per channel, which
/// is exact; all six durations divide evenly.
pub fn output_samples_per_channel(frame_size_tenths_ms: u16) -> usize {
    // tenths-ms * (48 samples / ms) / 10 = tenths-ms * 48 / 10.
    (frame_size_tenths_ms as usize * OUTPUT_SAMPLES_PER_MS as usize) / 10
}

/// Why a given Opus frame produced the samples it did.
///
/// The packet-level orchestration is complete, but the per-frame audio
/// decode lands incrementally. This status lets a caller (and the
/// crate's own tests) distinguish "decoded real audio" from "emitted
/// silence because the layer's range-coded decode is not wired yet" or
/// "emitted silence for a DTX / lost frame".
#[derive(Debug, Clone, Copy, PartialEq, Eq)]
pub enum FrameDecodeStatus {
    /// A §3.2.1 zero-length frame: DTX or a lost/packet-loss marker.
    /// Per §4.6 the floor behaviour is to emit silence; a real PLC model
    /// is a separate milestone.
    DtxOrLost,
    /// The frame's operating mode does not yet have a composed
    /// sample-producing decode path in this crate, so silence of the
    /// correct length was emitted. The variant carries the mode so the
    /// caller knows which layer is pending.
    LayerNotWired(OperatingMode),
    /// A mono SILK-only frame whose full §4.2.7 bitstream (frame type,
    /// gains, LSF chain, LTP, LCG seed, excitation) was decoded in
    /// Table-5 order via [`crate::silk_decode::decode_silk_frame`], then
    /// synthesized through the §4.2.7.9 LTP / LPC filters
    /// ([`crate::silk_synthesis::synthesize_silk_frame`]) and resampled to
    /// 48 kHz (§4.2.9, non-normative). The emitted PCM is real audio.
    SilkParamsDecoded,
    /// A **stereo** SILK-only frame whose §4.2.3 / §4.2.4 header bits and
    /// the §4.2.5 / §4.2.6 interleaved mid/side SILK frames were decoded
    /// in §4.2.2 order (mid frame then side frame per 20 ms interval, the
    /// side frame skipped when the §4.2.7.2 mid-only flag is set), each
    /// channel synthesized through the §4.2.7.9 filters, converted from
    /// mid/side to left/right via §4.2.8 stereo unmixing
    /// ([`crate::silk_stereo::stereo_ms_to_lr`]), then resampled to 48 kHz
    /// (§4.2.9, non-normative). The emitted interleaved L/R PCM is real
    /// audio.
    SilkStereoDecoded,
    /// A SILK-only frame whose §4.2.7 bitstream decode latched an error
    /// (a malformed / truncated frame). Silence of the correct length was
    /// emitted in its place per the §4.6 floor.
    SilkDecodeError,
    /// A CELT-only frame whose §4.3.7.1 silence flag was set: the real
    /// range-coded frame prefix (silence + post-filter group) was decoded
    /// and the §4.3.6→§4.3.7.2 synthesis backend was advanced with
    /// all-zero band shapes / energies, emitting silence PCM while
    /// carrying the MDCT overlap-add and de-emphasis state forward for the
    /// next frame. (Distinct from [`Self::LayerNotWired`]: the bitstream
    /// is actually consumed and the synthesis state is real, not stubbed.)
    CeltSilence,
    /// A CELT-only frame whose §4.3.7.1 prefix decode latched a range-coder
    /// error (a malformed / truncated frame). Silence of the correct length
    /// was emitted in its place per the §4.6 floor.
    CeltDecodeError,
    /// A **non-silent** CELT-only frame whose §4.3.7.1 prefix *and*
    /// §4.3.2.1 coarse-energy were decoded from the real range coder:
    /// the per-band coarse log-energy envelope was reconstructed (the 2-D
    /// predictor recurrence in [`crate::celt_coarse_energy`]) and threaded
    /// into the cross-frame predictor state. The remaining band-data
    /// stages (bit allocation, §4.3.4 PVQ band shapes, §4.3.2.2 fine
    /// energy) are not yet wired, so silence of the correct length is
    /// still emitted and the synthesis backend's overlap-add / de-emphasis
    /// state is advanced — but the coarse-energy *front half* of the
    /// entropy decode is now real. (Distinct from
    /// [`Self::LayerNotWired`]: the frame prefix and coarse energy are
    /// actually consumed.)
    CeltCoarseEnergyDecoded,
    /// A **non-silent** CELT-only frame that additionally decoded the
    /// §4.3.3 allocation *header* from the real range coder, on top of
    /// the §4.3.7.1 prefix and §4.3.2.1 coarse energy: the §4.3.3 band
    /// boosts ([`crate::celt_band_boost::decode_band_boosts`]), the
    /// §4.3.3 allocation trim ([`crate::celt_alloc_trim::decode_alloc_trim`]),
    /// and the §4.3.3 anti-collapse / skip / intensity-stereo /
    /// dual-stereo reservations ([`crate::celt_reservations::reserve_block`])
    /// were consumed in §4.3.3 order, advancing the range-coder position
    /// through the entire signalled part of the allocation. The remaining
    /// §4.3.3 implicit allocation (the `interp_bits2pulses` per-band
    /// pulse / fine-energy split — reference-code-only, absent from the
    /// RFC narrative body) plus the §4.3.4 PVQ band shapes and §4.3.2.2
    /// fine energy are still pending, so silence of the correct length is
    /// emitted and the synthesis backend's overlap-add / de-emphasis state
    /// is advanced with all-zero bands. The *signalled* allocation
    /// header is now real. (Distinct from
    /// [`Self::CeltCoarseEnergyDecoded`]: the boost / trim / reservation
    /// symbols are actually consumed.)
    CeltAllocationDecoded,
}

/// The result of decoding one Opus frame: how many per-channel samples
/// it contributed and why.
#[derive(Debug, Clone, Copy, PartialEq, Eq)]
pub struct FrameOutcome {
    /// Per-channel 48 kHz sample count this frame contributed.
    pub samples_per_channel: usize,
    /// Provenance of the samples (real audio vs silence and why).
    pub status: FrameDecodeStatus,
}

/// Decoded audio for one Opus packet: interleaved 48 kHz PCM plus the
/// per-frame outcomes.
#[derive(Debug, Clone, PartialEq)]
pub struct DecodedAudio {
    /// Interleaved signed 16-bit PCM at 48 kHz. For stereo the layout is
    /// `[L0, R0, L1, R1, …]`; for mono it is `[S0, S1, …]`. Length is
    /// `total_samples_per_channel * channels`.
    pub pcm: Vec<i16>,
    /// Number of audio channels (1 for mono, 2 for stereo).
    pub channels: u8,
    /// Output sample rate in Hz (always [`OUTPUT_SAMPLE_RATE_HZ`]).
    pub sample_rate_hz: u32,
    /// Per-Opus-frame outcomes, in packet order. `outcomes.len()` equals
    /// the packet's §3.2 frame count.
    pub frame_outcomes: Vec<FrameOutcome>,
}

impl DecodedAudio {
    /// Total per-channel 48 kHz sample count across every Opus frame in
    /// the packet.
    pub fn samples_per_channel(&self) -> usize {
        self.pcm.len() / self.channels.max(1) as usize
    }
}

/// Why an in-band FEC ([`OpusDecoder::decode_packet_fec`]) recovery
/// produced the samples it did (RFC 6716 §2.1.7 / §4.2.5).
///
/// In-band FEC works by re-encoding the signal of the frame *prior* to a
/// packet at a lower bitrate and carrying it as one or more §4.2.5 LBRR
/// frames inside that packet. When a packet is lost, the decoder can
/// recover the lost frame's audio from the LBRR frame(s) in the *next*
/// successfully received packet (`decode_packet_fec`), rather than
/// emitting pure silence / running pitch-based concealment.
#[derive(Debug, Clone, Copy, PartialEq, Eq)]
pub enum FecDecodeStatus {
    /// The packet carried §4.2.5 LBRR frame(s) for the lost prior frame,
    /// and they were decoded in Table-5 order and synthesized through the
    /// §4.2.7.9 LTP / LPC filters into real recovered audio at 48 kHz. For
    /// a stereo packet the recovered mid/side LBRR frames were unmixed via
    /// §4.2.8.
    Recovered,
    /// The packet has no LBRR frame for the requested channel(s) (the
    /// §4.2.4 LBRR flags are clear), so no FEC data is available. Silence
    /// of the requested duration was emitted; the caller should fall back
    /// to its own packet-loss concealment.
    NoLbrr,
    /// The packet is not a SILK-bearing mode (CELT-only carries no LBRR),
    /// so FEC recovery is not possible. Silence was emitted.
    NotSilk,
    /// The packet's §4.2 LBRR bitstream was malformed / truncated. Silence
    /// of the requested duration was emitted in its place.
    DecodeError,
}

/// The result of an in-band FEC recovery for one lost packet
/// ([`OpusDecoder::decode_packet_fec`]).
#[derive(Debug, Clone, PartialEq)]
pub struct FecRecovered {
    /// Interleaved signed 16-bit PCM at 48 kHz, same layout as
    /// [`DecodedAudio::pcm`]. Length is `samples_per_channel * channels`.
    pub pcm: Vec<i16>,
    /// Number of audio channels (1 for mono, 2 for stereo).
    pub channels: u8,
    /// Output sample rate in Hz (always [`OUTPUT_SAMPLE_RATE_HZ`]).
    pub sample_rate_hz: u32,
    /// Why the samples were produced (real recovery vs silence and why).
    pub status: FecDecodeStatus,
}

/// Stateful Opus packet → PCM decoder.
///
/// One [`OpusDecoder`] is fed Opus packets in stream order via
/// [`Self::decode_packet`]. The decoder is stateful because the SILK and
/// CELT layers carry inter-frame state (LPC / LTP history, MDCT overlap,
/// stereo unmixing memory, the §4.5.2 reset policy); the state lives here
/// and is threaded into the per-frame decode as those paths land. Today
/// the carried state is minimal (it grows as each layer is wired), but
/// the type is the stable home for it.
#[derive(Debug, Default)]
pub struct OpusDecoder {
    /// Channel count of the most recently decoded packet, if any. Used
    /// only for the §4.5.2 mono↔stereo transition reset bookkeeping the
    /// per-layer decoders will consult once wired.
    last_channels: Option<u8>,
    /// Mono SILK synthesis state (the §4.2.7.9 LTP / LPC histories),
    /// carried across Opus frames in the stream. `None` until the first
    /// mono SILK-only frame is synthesized; re-created (cleared per
    /// §4.5.2) when the SILK bandwidth changes.
    silk_synth_mono: Option<crate::silk_synthesis::SilkSynthState>,
    /// Stereo SILK synthesis state: the §4.2.7.9 LTP / LPC histories for
    /// the **mid** and **side** channels, carried across Opus frames.
    /// `None` until the first stereo SILK-only frame; re-created when the
    /// SILK bandwidth changes (a §4.5.2 reset).
    silk_synth_stereo: Option<(
        crate::silk_synthesis::SilkSynthState,
        crate::silk_synthesis::SilkSynthState,
    )>,
    /// §4.2.8 stereo unmixing history (two prior mid samples, one prior
    /// side sample, and the previous frame's prediction weights), carried
    /// across Opus frames. `None` until the first stereo SILK-only frame;
    /// reset (zeroed) on any §4.2.7.1 mono→stereo transition.
    silk_stereo_unmix: Option<crate::silk_stereo::StereoUnmixState>,
    /// Operating mode of the most recently decoded Opus frame, used to
    /// drive the §4.5.2 SILK state-reset rule ("the SILK state is reset
    /// before every SILK-only or Hybrid frame where the previous frame
    /// was CELT-only"). `None` before the first frame / after a reset.
    prev_mode: Option<OperatingMode>,
    /// CELT synthesis backend state (the §4.3.7 MDCT overlap-add history
    /// and §4.3.7.2 de-emphasis memory, per channel), carried across the
    /// CELT frames of the stream. `None` until the first CELT-layer frame
    /// is synthesized; re-created when the CELT frame size or channel
    /// count changes (a §4.5.2-style reset, since the overlap geometry
    /// depends on the frame size).
    celt_synth: Option<crate::celt_synthesis::CeltSynthState>,
    /// §4.3.2.1 CELT coarse-energy predictor state (the per-band
    /// mean-removed `E[b][l-1]` history the inter-frame predictor reads),
    /// carried across the CELT frames of the stream. Reset on a SILK→CELT
    /// transition (§4.5.2) and whenever an intra frame is decoded (where
    /// `alpha = 0` ignores the prior frame anyway). `None` until the first
    /// CELT-layer frame whose coarse energy is reconstructed.
    celt_coarse: Option<crate::celt_coarse_energy::CoarseEnergyState>,
}

impl OpusDecoder {
    /// Construct a fresh decoder with no carried state (equivalent to the
    /// post-`reset` state of §4.5.2).
    pub fn new() -> Self {
        Self::default()
    }

    /// Discard all inter-frame state, as after a container seek (the
    /// §4.5.2 decoder reset). Leaves the decoder ready to decode a new
    /// bitstream position as if it were the first packet.
    pub fn reset(&mut self) {
        *self = Self::default();
    }

    /// Decode one complete Opus packet into interleaved 48 kHz PCM.
    ///
    /// Performs the §3.1 TOC parse, the §3.2 frame split, and the §4.5
    /// multi-frame loop, dispatching each Opus frame through its
    /// [`OpusFrameRouting`] to the matching per-mode decode. Returns
    /// [`Error::EmptyPacket`] for a zero-length packet (§3.1 R1) and
    /// [`Error::MalformedPacket`] for any §3.2 framing violation.
    pub fn decode_packet(&mut self, packet: &[u8]) -> Result<DecodedAudio, Error> {
        let parsed = OpusPacket::parse(packet)?;
        self.decode_parsed_packet(parsed)
    }

    /// Decode one complete Opus packet that uses RFC 6716 Appendix-B
    /// self-delimited framing (the framing the first `N − 1` streams of
    /// a multistream packet use, RFC 7845 §3). Behaves exactly like
    /// [`Self::decode_packet`] otherwise — the only difference is how the
    /// frame slices are recovered from the packet bytes.
    pub fn decode_self_delimited_packet(&mut self, packet: &[u8]) -> Result<DecodedAudio, Error> {
        let parsed = crate::framing_self_delim::parse_self_delimited(packet)?.packet;
        self.decode_parsed_packet(parsed)
    }

    /// Shared decode body for both the regular ([`Self::decode_packet`])
    /// and self-delimited ([`Self::decode_self_delimited_packet`]) entry
    /// points: applies the §4.5.2 cross-packet state resets, then runs
    /// the §4.5 multi-frame loop over the already-sliced frames.
    fn decode_parsed_packet(&mut self, parsed: OpusPacket<'_>) -> Result<DecodedAudio, Error> {
        let routing = OpusFrameRouting::from_toc(parsed.toc);
        let channels = routing.channel_count();
        let per_frame_samples = output_samples_per_channel(routing.frame_size_tenths_ms);

        // §4.5.2 SILK state reset: the SILK decoder is reset before every
        // SILK-only or Hybrid frame whose predecessor was CELT-only. We
        // apply this at the Opus-packet boundary using the recorded
        // previous operating mode. (Redundancy placement only moves the
        // CELT reset, which doesn't affect the SILK reset, so we pass the
        // safe NotPresent default here.)
        if let Some(prev_mode) = self.prev_mode {
            let reset = crate::mode_transition_reset::decide_state_resets(
                prev_mode,
                routing.operating_mode,
                crate::celt_redundancy::RedundancyDecision::NotPresent,
            );
            if reset.silk {
                if let Some(state) = self.silk_synth_mono.as_mut() {
                    state.reset();
                }
                if let Some((mid, side)) = self.silk_synth_stereo.as_mut() {
                    mid.reset();
                    side.reset();
                }
                if let Some(unmix) = self.silk_stereo_unmix.as_mut() {
                    unmix.reset();
                }
            }
        }

        // §4.2.7.1: "the previous weights are reset to zeros on any
        // transition from mono to stereo." More generally the §4.2.8
        // unmixing history (and the mid/side synthesis state) only makes
        // sense within a contiguous stereo run; a channel-count change
        // clears the carried stereo state so a stale mono / prior-stereo
        // history can never leak across the transition.
        if self.last_channels.is_some_and(|c| c != channels) {
            if let Some(unmix) = self.silk_stereo_unmix.as_mut() {
                unmix.reset();
            }
            if let Some((mid, side)) = self.silk_synth_stereo.as_mut() {
                mid.reset();
                side.reset();
            }
        }

        self.last_channels = Some(channels);
        self.prev_mode = Some(routing.operating_mode);

        let frame_slices = parsed.frames();
        let mut pcm: Vec<i16> =
            Vec::with_capacity(frame_slices.len() * per_frame_samples * channels as usize);
        let mut frame_outcomes = Vec::with_capacity(frame_slices.len());

        for frame in frame_slices {
            let outcome = self.decode_one_frame(frame, &routing, &mut pcm);
            frame_outcomes.push(outcome);
        }

        Ok(DecodedAudio {
            pcm,
            channels,
            sample_rate_hz: OUTPUT_SAMPLE_RATE_HZ,
            frame_outcomes,
        })
    }

    /// Decode one Opus frame, appending its interleaved 48 kHz PCM to
    /// `pcm` and returning the per-frame outcome.
    fn decode_one_frame(
        &mut self,
        frame: &[u8],
        routing: &OpusFrameRouting,
        pcm: &mut Vec<i16>,
    ) -> FrameOutcome {
        let per_channel = output_samples_per_channel(routing.frame_size_tenths_ms);
        let channels = routing.channel_count();

        // §3.2.1 zero-length frame: DTX / lost. §4.6 floor = silence.
        if frame.is_empty() {
            push_silence(pcm, per_channel, channels);
            return FrameOutcome {
                samples_per_channel: per_channel,
                status: FrameDecodeStatus::DtxOrLost,
            };
        }

        match routing.operating_mode {
            OperatingMode::SilkOnly => self.decode_silk_only_frame(frame, routing, pcm),
            OperatingMode::CeltOnly => self.decode_celt_only_frame(frame, routing, pcm),
            OperatingMode::Hybrid => self.decode_hybrid_frame(frame, routing, pcm),
        }
    }

    /// Decode one SILK-only Opus frame (§4.2).
    ///
    /// For a **mono** Opus frame this runs the real §4.2.3 header-bit
    /// decode followed by the §4.2.5 LBRR / §4.2.6 regular SILK frame
    /// loop, calling [`crate::silk_decode::decode_silk_frame`] for each
    /// regular SILK frame in Table-5 order with the inter-frame state
    /// (previous gain / lag / NLSF) threaded across the frames of the
    /// Opus frame. The decoded parameters + excitation are then run
    /// through the §4.2.7.9 LTP / LPC synthesis
    /// ([`crate::silk_synthesis::synthesize_silk_frame`]) and the §4.2.9
    /// (non-normative) resample to 48 kHz, producing real PCM
    /// ([`FrameDecodeStatus::SilkParamsDecoded`]). A truncated / malformed
    /// frame yields [`FrameDecodeStatus::SilkDecodeError`] and silence.
    ///
    /// A **stereo** Opus frame routes to
    /// [`Self::decode_silk_only_stereo`], which runs the §4.2.6 mid/side
    /// interleave with the §4.2.7.1 / §4.2.7.2 symbols enabled and the
    /// §4.2.8 unmixing back half, emitting interleaved L/R PCM
    /// ([`FrameDecodeStatus::SilkStereoDecoded`]).
    fn decode_silk_only_frame(
        &mut self,
        frame: &[u8],
        routing: &OpusFrameRouting,
        pcm: &mut Vec<i16>,
    ) -> FrameOutcome {
        let per_channel = output_samples_per_channel(routing.frame_size_tenths_ms);
        let channels = routing.channel_count();
        let pcm_start = pcm.len();
        push_silence(pcm, per_channel, channels);

        if channels == 2 {
            let status = match self.decode_silk_only_stereo(frame, routing) {
                Ok((left, right, bandwidth)) => {
                    // §4.2.9 (non-normative): resample each channel to the
                    // 48 kHz output rate, then write it interleaved
                    // (`[L0, R0, L1, R1, …]`) over the reserved silence.
                    resample_stereo_to_output_i16(
                        &left,
                        &right,
                        bandwidth,
                        &mut pcm[pcm_start..pcm_start + per_channel * 2],
                    );
                    FrameDecodeStatus::SilkStereoDecoded
                }
                Err(_) => FrameDecodeStatus::SilkDecodeError,
            };
            return FrameOutcome {
                samples_per_channel: per_channel,
                status,
            };
        }

        let status = match self.decode_silk_only_mono(frame, routing) {
            Ok((internal, bandwidth)) => {
                // §4.2.9 (non-normative): resample the internal-rate
                // signal to the 48 kHz decoder output rate and write it
                // over the reserved silence region. The spec says "the
                // resampler itself is non-normative, and a decoder can use
                // any method it wants"; we use linear interpolation.
                resample_internal_to_output_i16(
                    &internal,
                    bandwidth,
                    &mut pcm[pcm_start..pcm_start + per_channel],
                );
                FrameDecodeStatus::SilkParamsDecoded
            }
            Err(_) => FrameDecodeStatus::SilkDecodeError,
        };
        FrameOutcome {
            samples_per_channel: per_channel,
            status,
        }
    }

    /// Decode the full §4.2 bitstream of one mono SILK-only Opus frame:
    /// §4.2.3 header bits, the §4.2.5 LBRR frames, and the §4.2.6 regular
    /// SILK frames, consuming every symbol in order. Returns `Ok(())`
    /// when the whole frame decodes cleanly.
    fn decode_silk_only_mono(
        &mut self,
        frame: &[u8],
        routing: &OpusFrameRouting,
    ) -> Result<(Vec<f32>, crate::toc::Bandwidth), Error> {
        use crate::range_decoder::RangeDecoder;
        use crate::silk_decode::{decode_silk_frame, SilkFrameConfig, SilkFrameDecoded};
        use crate::silk_excitation::SilkFrameSize;
        use crate::silk_frame::FrameKind;
        use crate::silk_header::SilkHeaderBits;
        use crate::silk_synthesis::{synthesize_silk_frame, SilkSynthState};

        let bandwidth = routing
            .silk_bandwidth
            .ok_or(Error::MalformedPacket)?
            .to_bandwidth();
        let num_silk_frames = routing
            .silk_frames_per_channel
            .ok_or(Error::MalformedPacket)?;
        // §4.2.2: each SILK frame is 20 ms, except a 10 ms Opus frame
        // (one SILK frame of 10 ms).
        let frame_size = if routing.frame_size_tenths_ms == 100 {
            SilkFrameSize::TenMs
        } else {
            SilkFrameSize::TwentyMs
        };

        let mut rd = RangeDecoder::new(frame);

        // §4.2.3 / §4.2.4 header bits (mono => stereo = false).
        let header = SilkHeaderBits::decode(&mut rd, num_silk_frames, false)?;

        // §4.2.5 LBRR frames: one per SILK frame whose mid LBRR bit is
        // set, in time-interval order. LBRR frames are independent of the
        // regular-frame inter-frame state (they form their own sequence),
        // but for this mono path we decode them to consume their bits and
        // keep the range coder aligned with the regular frames that
        // follow. Per §4.2.7.3 an LBRR frame is always active-coded.
        let mut lbrr_prev_gain: Option<u8> = None;
        let mut lbrr_prev_lag: Option<i32> = None;
        let mut lbrr_first = true;
        for idx in 0..num_silk_frames {
            if !header.mid_has_lbrr(idx) {
                continue;
            }
            let cfg = SilkFrameConfig {
                bandwidth,
                frame_size,
                voice_active: true, // §4.2.7.3: LBRR uses the active PDF.
                first_subframe_independent: lbrr_first || lbrr_prev_gain.is_none(),
                previous_log_gain: lbrr_prev_gain,
                previous_primary_lag: lbrr_prev_lag,
                ltp_scaling_present: lbrr_first,
                lsf_interp_after_reset: lbrr_first,
                previous_nlsf_q15: None,
                previous_nlsf_len: 0,
                // Mono SILK-only path: no §4.2.7.1 / §4.2.7.2 stereo header.
                stereo: None,
            };
            let decoded = decode_silk_frame(&mut rd, cfg)?;
            lbrr_prev_gain = Some(decoded.gains.last_log_gain());
            lbrr_prev_lag = Some(decoded.ltp.primary_lag());
            lbrr_first = false;
            let _ = FrameKind::Lbrr; // documents the §4.2.7.3 kind.
        }

        // §4.2.6 regular SILK frames: one per time interval, even when
        // the VAD flag is unset. Inter-frame state threads across them.
        let mut prev_gain: Option<u8> = None;
        let mut prev_lag: Option<i32> = None;
        let mut prev_nlsf: Option<[i16; crate::silk_lsf_stage2::D_LPC_MAX]> = None;
        let mut prev_nlsf_len = 0usize;
        let mut first = true;
        let mut decoded_frames: Vec<SilkFrameDecoded> =
            Vec::with_capacity(num_silk_frames as usize);
        for idx in 0..num_silk_frames {
            let cfg = SilkFrameConfig {
                bandwidth,
                frame_size,
                voice_active: header.mid_vad(idx),
                first_subframe_independent: first || prev_gain.is_none(),
                previous_log_gain: prev_gain,
                previous_primary_lag: prev_lag,
                ltp_scaling_present: first,
                lsf_interp_after_reset: first || prev_nlsf.is_none(),
                previous_nlsf_q15: prev_nlsf,
                previous_nlsf_len: prev_nlsf_len,
                // Mono SILK-only path: no §4.2.7.1 / §4.2.7.2 stereo header.
                stereo: None,
            };
            let decoded = decode_silk_frame(&mut rd, cfg)?;
            prev_gain = Some(decoded.gains.last_log_gain());
            prev_lag = Some(decoded.ltp.primary_lag());
            prev_nlsf = Some(decoded.nlsf_q15);
            prev_nlsf_len = decoded.d_lpc;
            first = false;
            decoded_frames.push(decoded);
        }

        if rd.has_error() {
            return Err(Error::MalformedPacket);
        }

        // §4.2.7.9 synthesis: turn the decoded SILK frames into
        // internal-rate (8/12/16 kHz) time-domain samples, threading the
        // cross-Opus-frame §4.2.7.9 histories. The state is (re)created if
        // absent or if the SILK bandwidth changed (a §4.5.2 reset).
        let need_fresh = match &self.silk_synth_mono {
            Some(s) => s.bandwidth() != bandwidth,
            None => true,
        };
        if need_fresh {
            self.silk_synth_mono = Some(SilkSynthState::new(bandwidth)?);
        }
        let state = self
            .silk_synth_mono
            .as_mut()
            .expect("synth state set above");

        let mut internal = Vec::new();
        for decoded in &decoded_frames {
            let frame_out = synthesize_silk_frame(bandwidth, frame_size, decoded, state)?;
            internal.extend_from_slice(&frame_out);
        }
        Ok((internal, bandwidth))
    }

    /// Decode the full §4.2 bitstream of one **stereo** SILK-only Opus
    /// frame and unmix it to left/right.
    ///
    /// The §4.2.2 stereo organisation interleaves the two channels: per
    /// 20 ms interval the mid SILK frame is decoded, then the side SILK
    /// frame (skipped when the §4.2.7.2 mid-only flag on the mid frame is
    /// set). The §4.2.7.1 stereo prediction weights ride on the mid
    /// frame. After both channels finish their §4.2.7.9 synthesis they are
    /// converted from mid/side to left/right via §4.2.8
    /// ([`crate::silk_stereo::stereo_ms_to_lr`]).
    ///
    /// LBRR frames (§4.2.5) precede the regular frames and are also
    /// interleaved (mid then side per interval); they are decoded only to
    /// keep the range coder aligned with the regular frames that follow.
    ///
    /// Returns `(left, right, bandwidth)` at the SILK internal rate.
    #[allow(clippy::type_complexity)]
    fn decode_silk_only_stereo(
        &mut self,
        frame: &[u8],
        routing: &OpusFrameRouting,
    ) -> Result<(Vec<f32>, Vec<f32>, crate::toc::Bandwidth), Error> {
        use crate::range_decoder::RangeDecoder;
        use crate::silk_decode::{decode_silk_frame, SilkFrameDecoded, StereoHeaderContext};
        use crate::silk_excitation::SilkFrameSize;
        use crate::silk_header::SilkHeaderBits;
        use crate::silk_stereo::{stereo_ms_to_lr, StereoUnmixState, StereoWeightsQ13};
        use crate::silk_synthesis::{synthesize_silk_frame, SilkSynthState};

        let bandwidth = routing
            .silk_bandwidth
            .ok_or(Error::MalformedPacket)?
            .to_bandwidth();
        let num_silk_frames = routing
            .silk_frames_per_channel
            .ok_or(Error::MalformedPacket)?;
        let frame_size = if routing.frame_size_tenths_ms == 100 {
            SilkFrameSize::TenMs
        } else {
            SilkFrameSize::TwentyMs
        };

        let mut rd = RangeDecoder::new(frame);

        // §4.2.3 / §4.2.4 header bits (stereo => both channels' VAD + LBRR
        // flags, mid then side).
        let header = SilkHeaderBits::decode(&mut rd, num_silk_frames, true)?;

        // §4.2.5 LBRR frames: per 20 ms interval, the mid LBRR frame (if
        // present) then the side LBRR frame (if present), interleaved per
        // §4.2.2. Decoded only to consume their bits. The §4.2.7.1 stereo
        // weights ride on the mid LBRR frame; the §4.2.7.2 mid-only flag
        // is present on the mid LBRR frame iff the side LBRR is unset for
        // that interval.
        let mut lbrr_mid = ChannelDecodeState::new();
        let mut lbrr_side = ChannelDecodeState::new();
        for idx in 0..num_silk_frames {
            let mid_lbrr = header.mid_has_lbrr(idx);
            let side_lbrr = header.side_has_lbrr(idx);
            if mid_lbrr {
                let stereo_ctx = StereoHeaderContext {
                    // §4.2.7.2: mid-only flag present on the mid frame iff
                    // the corresponding side channel is not coded.
                    has_mid_only_flag: !side_lbrr,
                };
                let decoded = decode_silk_frame(
                    &mut rd,
                    lbrr_mid.config(bandwidth, frame_size, true, Some(stereo_ctx)),
                )?;
                lbrr_mid.advance(&decoded);
                // A set mid-only flag would forbid a coded side LBRR
                // frame; the header LBRR flags already encode that, so we
                // trust `side_lbrr` for the interleave decision.
                if side_lbrr {
                    let decoded = decode_silk_frame(
                        &mut rd,
                        lbrr_side.config(bandwidth, frame_size, true, None),
                    )?;
                    lbrr_side.advance(&decoded);
                }
            } else if side_lbrr {
                // Side-only LBRR (mid not coded): no stereo weights on a
                // side frame per §4.2.7.1.
                let decoded = decode_silk_frame(
                    &mut rd,
                    lbrr_side.config(bandwidth, frame_size, true, None),
                )?;
                lbrr_side.advance(&decoded);
            }
        }

        // §4.2.6 regular SILK frames: per 20 ms interval, the mid frame
        // then (unless the §4.2.7.2 mid-only flag is set) the side frame.
        let mut mid_state = ChannelDecodeState::new();
        let mut side_state = ChannelDecodeState::new();
        let mut mid_frames: Vec<SilkFrameDecoded> = Vec::with_capacity(num_silk_frames as usize);
        // Per-interval side frame: `Some(frame)` when coded, `None` when
        // the side channel is skipped (mid-only flag set or side VAD path
        // produced no frame). The §4.2.8 unmixer treats a `None` side as
        // all-zero.
        let mut side_frames: Vec<Option<SilkFrameDecoded>> =
            Vec::with_capacity(num_silk_frames as usize);
        // The §4.2.7.1 weights carried by the most-recent mid frame; the
        // §4.2.8 unmix consumes the last interval's weights for the whole
        // Opus frame (one set of weights per SILK frame, but the unmix
        // runs once over the concatenated channel signal — we apply the
        // first interval's weights, threading prev across intervals via
        // the unmix state below).
        let mut interval_weights: Vec<StereoWeightsQ13> =
            Vec::with_capacity(num_silk_frames as usize);

        for idx in 0..num_silk_frames {
            let side_active = header.side_vad(idx);
            // §4.2.7.2: the mid-only flag is present iff the side channel
            // for this interval is NOT active (a regular frame with side
            // VAD unset). When side VAD is set the side frame must be
            // coded and the flag is omitted.
            let stereo_ctx = StereoHeaderContext {
                has_mid_only_flag: !side_active,
            };
            let mid_decoded = decode_silk_frame(
                &mut rd,
                mid_state.config(bandwidth, frame_size, header.mid_vad(idx), Some(stereo_ctx)),
            )?;
            // §4.2.7.1 weights ride on the mid frame.
            let w = mid_decoded.stereo_pred.map(|p| StereoWeightsQ13 {
                w0_q13: p.w0_q13,
                w1_q13: p.w1_q13,
            });
            interval_weights.push(w.unwrap_or_default());
            // §4.2.7.2: side coded iff side VAD set OR the mid-only flag is
            // not set (mid-only flag present + cleared ⇒ side is coded).
            let side_coded = side_active || mid_decoded.mid_only_flag == Some(false);
            mid_state.advance(&mid_decoded);
            mid_frames.push(mid_decoded);

            if side_coded {
                let side_decoded = decode_silk_frame(
                    &mut rd,
                    side_state.config(bandwidth, frame_size, header.side_vad(idx), None),
                )?;
                side_state.advance(&side_decoded);
                side_frames.push(Some(side_decoded));
            } else {
                // §4.2.7.2 / §4.5.2: an uncoded side SILK frame clears the
                // side LTP buffer; zeros feed the §4.2.8 unmixer.
                side_frames.push(None);
            }
        }

        if rd.has_error() {
            return Err(Error::MalformedPacket);
        }

        // §4.2.7.9 synthesis for both channels, threading the cross-Opus-
        // frame histories. (Re)create the state on a bandwidth change.
        let need_fresh = match &self.silk_synth_stereo {
            Some((m, _)) => m.bandwidth() != bandwidth,
            None => true,
        };
        if need_fresh {
            self.silk_synth_stereo = Some((
                SilkSynthState::new(bandwidth)?,
                SilkSynthState::new(bandwidth)?,
            ));
        }
        let (mid_synth, side_synth) = self
            .silk_synth_stereo
            .as_mut()
            .expect("stereo synth state set above");

        // §4.2.8 stereo unmixing runs **per SILK frame** (per 20 ms
        // interval), not once over the whole Opus frame: the spec defines
        // the unmix over `j <= i < (j + n2)` where `j` is the SILK frame
        // start and `n2` is "the total number of samples in the frame"
        // (the SILK frame). Each interval carries its own §4.2.7.1 weights
        // and restarts the 8 ms interpolation phase; the previous
        // interval's weights and trailing samples thread through the
        // carried `StereoUnmixState`. We therefore synthesize and unmix
        // each interval in turn and concatenate the L/R outputs.
        let unmix = self
            .silk_stereo_unmix
            .get_or_insert_with(StereoUnmixState::new);

        let mut left = Vec::new();
        let mut right = Vec::new();
        for (idx, mid_frame) in mid_frames.iter().enumerate() {
            let mid_out = synthesize_silk_frame(bandwidth, frame_size, mid_frame, mid_synth)?;
            let n = mid_out.len();
            let weights = interval_weights[idx];
            let stereo = match &side_frames[idx] {
                Some(side_frame) => {
                    let side_out =
                        synthesize_silk_frame(bandwidth, frame_size, side_frame, side_synth)?;
                    stereo_ms_to_lr(bandwidth, &mid_out, Some(&side_out), weights, unmix)?
                }
                None => {
                    // §4.2.7.2 / §4.5.2: an uncoded side SILK frame clears
                    // the side LTP buffer; zeros feed the §4.2.8 unmixer
                    // (`side = None` ⇒ side[i] treated as 0 everywhere).
                    side_synth.reset();
                    stereo_ms_to_lr(bandwidth, &mid_out, None, weights, unmix)?
                }
            };
            debug_assert_eq!(stereo.left.len(), n);
            left.extend_from_slice(&stereo.left);
            right.extend_from_slice(&stereo.right);
        }

        Ok((left, right, bandwidth))
    }

    /// Decode the Table-56 CELT symbols that sit between the §4.3.2.1
    /// coarse energy and the §4.3.4 residual: the §4.3.1 time-frequency
    /// resolution, the §4.3.4.3 spread parameter, and the §4.3.3
    /// signalled allocation header. All are read from the live range
    /// coder in exact Table-56 order:
    ///
    /// 1. **`tf_change` / `tf_select`** (§4.3.1, `celt_tf_decode::decode_tf`):
    ///    the per-band time-frequency resolution flags and the gated
    ///    `tf_select` bit. These come immediately after coarse energy in
    ///    Table 56 and *must* be consumed before the allocation, or every
    ///    subsequent symbol reads from the wrong bitstream position.
    /// 2. **`spread`** (§4.3.4.3, `celt_spreading::decode_spread`): the
    ///    2-bit spread symbol (PDF `{7,2,21,2}/32`), Table-56-ordered
    ///    right before the dynamic allocation.
    /// 3. **Band boosts** (§4.3.3, `celt_band_boost::decode_band_boosts`):
    ///    the per-band dynamic-allocation boost symbols over the coding
    ///    window `start..end`, fed the per-band cap vector `cap[]`
    ///    ([`crate::celt_cache_caps50::cap_for_band_bits`]) and the
    ///    per-band MDCT-bin counts.
    /// 4. **Allocation trim** (§4.3.3, `celt_alloc_trim::decode_alloc_trim`):
    ///    the single trim symbol, gated on whether 6 bits still fit after
    ///    the boosts.
    /// 5. **Reservations** (§4.3.3, `celt_reservations::reserve_block`):
    ///    the §4.3.3 anti-collapse / skip / intensity-stereo / dual-stereo
    ///    bit reservations. (`reserve_block` only *computes* the reserved
    ///    eighth-bit counts; the anti-collapse / skip / intensity / dual
    ///    *bits* themselves are decoded later in Table-56 order, after the
    ///    implicit allocation + residual, so nothing is read from the
    ///    coder here — but the reservation computation reads
    ///    `ec_tell_frac` at exactly this point and must run now to stay
    ///    faithful to the §4.3.3 ordering and to validate the running
    ///    budget.)
    ///
    /// Returns the decoded [`crate::celt_tf_decode::TfDecode`] and the
    /// `spread` value (both needed by the pending §4.3.4 band-shape
    /// decode) on success, or `Err(())` on a caller-side bookkeeping error
    /// from one of the sub-decoders (a band-window / length mismatch,
    /// never a malformed-bitstream signal — that surfaces through the
    /// range coder's sticky error flag, which the caller checks via
    /// `rd.has_error()`).
    ///
    /// The §4.3.3 *implicit* allocation (the reference-only
    /// `interp_bits2pulses` per-band pulse / fine-energy split) is **not**
    /// performed here: it reads nothing further from the range coder, so
    /// stopping after the reservation block leaves the coder positioned
    /// exactly where the §4.3.4 PVQ residual decode will resume once that
    /// (currently docs-gapped) interpolation lands.
    #[allow(clippy::too_many_arguments)]
    fn decode_celt_tf_spread_allocation(
        rd: &mut crate::range_decoder::RangeDecoder<'_>,
        celt_size: crate::celt_band_layout::CeltFrameSize,
        is_transient: bool,
        channels: u8,
        start: usize,
        end: usize,
        frame_size_bytes: u32,
    ) -> Result<(crate::celt_tf_decode::TfDecode, u8), ()> {
        use crate::celt_cache_caps50::CacheCapsStereo;

        let is_stereo = channels == 2;
        let stereo_axis = if is_stereo {
            CacheCapsStereo::Stereo
        } else {
            CacheCapsStereo::Mono
        };
        let lm = celt_size.column_index() as u32;
        let band_count = end - start;

        // §4.3.1 (Table 56): tf_change / tf_select come immediately after
        // coarse energy. Decode them from the live coder so the band
        // boosts below read from the correct bitstream position.
        let tf = crate::celt_tf_decode::decode_tf(rd, celt_size, is_transient, start, end);

        // §4.3.4.3 (Table 56): the spread symbol is next, right before the
        // dynamic allocation.
        let spread = crate::celt_spreading::decode_spread(rd);

        // §4.3.3 per-band cap[] and per-channel MDCT-bin counts over the
        // coding window. Both are indexed by `band - start`.
        let mut caps: Vec<u32> = Vec::with_capacity(band_count);
        let mut n_bins: Vec<u32> = Vec::with_capacity(band_count);
        for band in start..end {
            let bins = crate::celt_band_layout::celt_band_bins_per_channel(band, celt_size)
                .ok_or(())? as u32;
            let cap = crate::celt_cache_caps50::cap_for_band_bits(
                lm,
                stereo_axis,
                band as u32,
                channels as u32,
                bins,
            )
            .map_err(|_| ())?;
            caps.push(cap);
            n_bins.push(bins);
        }

        // Step 1: §4.3.3 band boosts.
        let boosts = crate::celt_band_boost::decode_band_boosts(
            rd,
            start,
            end,
            &caps,
            &n_bins,
            frame_size_bytes,
        )
        .map_err(|_| ())?;

        // Step 2: §4.3.3 allocation trim. The gate uses the running
        // `ec_tell_frac` and the `total_boost` from step 1.
        let _trim = crate::celt_alloc_trim::decode_alloc_trim(
            rd,
            rd.tell_frac(),
            frame_size_bytes,
            boosts.total_boost_eighth_bits,
        )
        .map_err(|_| ())?;

        // Step 3: §4.3.3 reservations. These read the running
        // `ec_tell_frac` *after* the trim symbol and only *compute* the
        // reserved eighth-bit budget; they consume no further range-coder
        // symbols at this point.
        let _reservations = crate::celt_reservations::reserve_block(
            frame_size_bytes,
            rd.tell_frac(),
            boosts.total_boost_eighth_bits,
            celt_size,
            is_transient,
            is_stereo,
            band_count as u32,
        )
        .map_err(|_| ())?;

        Ok((tf, spread))
    }

    /// Decode one CELT-only Opus frame (§4.3).
    ///
    /// Decodes the §4.3.7.1 range-coded frame prefix (silence flag +
    /// post-filter group + transient + intra) from the real range coder.
    /// When the **silence** flag is set, the frame is fully wired
    /// end-to-end: the §4.3.6→§4.3.7.2 synthesis backend
    /// ([`crate::celt_synthesis::CeltSynthState`]) is advanced with
    /// all-zero band shapes and energies, producing silence PCM at the
    /// 48 kHz output rate while carrying the MDCT overlap-add and
    /// de-emphasis state forward for subsequent frames
    /// ([`FrameDecodeStatus::CeltSilence`]). The synthesis state is
    /// (re)built whenever the CELT frame size or channel count changes.
    ///
    /// Non-silent CELT frames still emit silence flagged
    /// [`FrameDecodeStatus::LayerNotWired`]: the §4.3.2.1 coarse-energy
    /// reconstruction recurrence (the 2-D predictor accumulation and its
    /// per-band mean baseline) is not yet available in the clean-room
    /// `docs/` material, so the band-energy envelope cannot be rebuilt.
    /// The Laplace symbol decoder ([`crate::celt_laplace`]) and the prefix
    /// decoder are in place; the missing piece is the reconstruction
    /// arithmetic feeding the per-band `log2_energy`.
    fn decode_celt_only_frame(
        &mut self,
        frame: &[u8],
        routing: &OpusFrameRouting,
        pcm: &mut Vec<i16>,
    ) -> FrameOutcome {
        use crate::celt_band_layout::CeltFrameSize;

        let per_channel = output_samples_per_channel(routing.frame_size_tenths_ms);
        let channels = routing.channel_count();
        let pcm_start = pcm.len();
        push_silence(pcm, per_channel, channels);

        // The CELT layer needs a Table-55 frame size; a 40/60 ms frame
        // can never route here (those are SILK-only), so a `None` is a
        // routing invariant violation — fall back to the unwired floor.
        let Some(celt_size) =
            CeltFrameSize::from_frame_tenths_ms(routing.frame_size_tenths_ms as u32)
        else {
            return FrameOutcome {
                samples_per_channel: per_channel,
                status: FrameDecodeStatus::LayerNotWired(OperatingMode::CeltOnly),
            };
        };

        // §4.3.7.1 frame prefix from the real range coder.
        let mut rd = crate::range_decoder::RangeDecoder::new(frame);
        let prefix = crate::celt_frame_prefix::decode_celt_frame_prefix(&mut rd);
        if rd.has_error() {
            return FrameOutcome {
                samples_per_channel: per_channel,
                status: FrameDecodeStatus::CeltDecodeError,
            };
        }

        // Non-silent frames now decode the §4.3.2.1 coarse energy from the
        // range coder. The downstream band-data stages (bit allocation,
        // §4.3.4 PVQ band shapes, §4.3.2.2 fine energy) are not yet wired,
        // so we still emit the §4.6 floor and advance the synthesis state
        // with all-zero bands — but the coarse-energy front half of the
        // entropy decode is real, and the cross-frame predictor state is
        // threaded forward for the next frame.
        let final_status = if prefix.silence {
            FrameDecodeStatus::CeltSilence
        } else {
            // Reset the coarse-energy predictor on an intra frame (where
            // `alpha = 0` discards the prior frame anyway) or when no
            // state has been carried yet; otherwise reuse the threaded
            // history so the inter-frame predictor sees `E[b][l-1]`.
            if prefix.intra || self.celt_coarse.is_none() {
                self.celt_coarse = Some(crate::celt_coarse_energy::CoarseEnergyState::new());
            }
            let coarse = self.celt_coarse.as_mut().expect("just built");
            let start = crate::celt_band_layout::celt_first_coded_band(false);
            let end = crate::celt_band_layout::celt_end_coded_band();
            match coarse.decode_frame(&mut rd, celt_size, prefix.intra, start, end) {
                Ok(_frame) => {
                    if rd.has_error() {
                        return FrameOutcome {
                            samples_per_channel: per_channel,
                            status: FrameDecodeStatus::CeltDecodeError,
                        };
                    }
                    // §4.3.1 TF + §4.3.4.3 spread + §4.3.3 allocation
                    // header: the Table-56 symbols between coarse energy
                    // and the §4.3.4 residual (tf_change / tf_select,
                    // spread, band boosts, allocation trim, and the
                    // anti-collapse / skip / intensity / dual
                    // reservations), decoded in Table-56 order from the
                    // same range coder. This advances the entropy decode
                    // through everything the bitstream explicitly carries
                    // before the (reference-only) implicit interpolation.
                    match Self::decode_celt_tf_spread_allocation(
                        &mut rd,
                        celt_size,
                        prefix.transient,
                        channels,
                        start,
                        end,
                        frame.len() as u32,
                    ) {
                        Ok((_tf, _spread)) => {
                            if rd.has_error() {
                                return FrameOutcome {
                                    samples_per_channel: per_channel,
                                    status: FrameDecodeStatus::CeltDecodeError,
                                };
                            }
                            FrameDecodeStatus::CeltAllocationDecoded
                        }
                        Err(()) => {
                            return FrameOutcome {
                                samples_per_channel: per_channel,
                                status: FrameDecodeStatus::CeltDecodeError,
                            };
                        }
                    }
                }
                Err(_) => {
                    return FrameOutcome {
                        samples_per_channel: per_channel,
                        status: FrameDecodeStatus::CeltDecodeError,
                    };
                }
            }
        };

        // Drive the synthesis backend with all-zero bands (the band shapes
        // are not yet decoded). For a silence frame this is the §4.5.1
        // behaviour; for a coarse-only frame it advances the overlap-add /
        // de-emphasis state while the band-data stages land.
        // (Re)build the CELT synthesis state if absent or if its geometry
        // no longer matches this frame's size / channel count.
        let needs_rebuild = match &self.celt_synth {
            Some(s) => {
                s.channels() != channels as usize
                    || s.transform_half_len() != (celt_size.to_frame_tenths_ms() as usize * 48) / 10
            }
            None => true,
        };
        if needs_rebuild {
            match crate::celt_synthesis::CeltSynthState::new(celt_size, false, channels as usize) {
                Ok(s) => self.celt_synth = Some(s),
                Err(_) => {
                    return FrameOutcome {
                        samples_per_channel: per_channel,
                        status: FrameDecodeStatus::CeltDecodeError,
                    };
                }
            }
        }
        let synth = self.celt_synth.as_mut().expect("just built");

        // All-zero per-band shapes and energies: one zero shape slice per
        // coded band (each of its Table-55 bin length) and a matching
        // zero-energy vector, for every channel.
        let coded_bands = synth.coded_bands();
        let first = synth.first_coded_band();
        let mut shape_storage: Vec<Vec<f64>> = Vec::with_capacity(coded_bands);
        for band in first..(first + coded_bands) {
            let bins = crate::celt_band_layout::celt_band_bins_per_channel(band, celt_size)
                .unwrap_or(0) as usize;
            shape_storage.push(vec![0.0_f64; bins]);
        }
        let shape_refs: Vec<&[f64]> = shape_storage.iter().map(Vec::as_slice).collect();
        let energies = vec![0.0_f64; coded_bands];
        let per_channel_args: Vec<(&[&[f64]], &[f64])> = (0..channels as usize)
            .map(|_| (shape_refs.as_slice(), energies.as_slice()))
            .collect();

        match synth.synthesize_frame_interleaved_i16(&per_channel_args) {
            Ok(pcm_frame) => {
                let region = &mut pcm[pcm_start..pcm_start + per_channel * channels as usize];
                let n = region.len().min(pcm_frame.len());
                region[..n].copy_from_slice(&pcm_frame[..n]);
                FrameOutcome {
                    samples_per_channel: per_channel,
                    status: final_status,
                }
            }
            Err(_) => FrameOutcome {
                samples_per_channel: per_channel,
                status: FrameDecodeStatus::CeltDecodeError,
            },
        }
    }

    /// Recover the audio of a **lost** Opus frame from the in-band FEC
    /// (§4.2.5 LBRR) data carried in the *next* successfully received
    /// packet (RFC 6716 §2.1.7).
    ///
    /// In-band FEC encodes a low-bitrate redundant copy of the signal
    /// immediately *prior* to a packet as one or more §4.2.5 LBRR frames
    /// inside that packet. When the application detects a packet loss and
    /// has the following packet in hand, it calls this method on that
    /// following packet to reconstruct the lost frame's audio instead of
    /// relying solely on silence / pitch-based concealment.
    ///
    /// The recovered PCM is returned at the 48 kHz output rate. The packet
    /// passed here is the one *after* the loss; only its §4.2.5 LBRR
    /// frames are decoded and synthesized (the packet's own regular frames
    /// are decoded later by an ordinary [`Self::decode_packet`] call).
    ///
    /// On success ([`FecDecodeStatus::Recovered`]) the SILK synthesis
    /// history is advanced to the recovered frame's state, so a subsequent
    /// [`Self::decode_packet`] on the same packet continues smoothly from
    /// the reconstructed signal. When the packet carries no LBRR data
    /// ([`FecDecodeStatus::NoLbrr`]), is CELT-only
    /// ([`FecDecodeStatus::NotSilk`]), or is malformed
    /// ([`FecDecodeStatus::DecodeError`]), silence of the lost frame's
    /// duration is returned and the caller falls back to its own
    /// concealment.
    ///
    /// Returns [`Error::EmptyPacket`] for a zero-length packet and
    /// [`Error::MalformedPacket`] for a §3.2 framing violation in the
    /// carrier packet.
    pub fn decode_packet_fec(&mut self, packet: &[u8]) -> Result<FecRecovered, Error> {
        let parsed = OpusPacket::parse(packet)?;
        let routing = OpusFrameRouting::from_toc(parsed.toc);
        let channels = routing.channel_count();
        // §4.2.5: an LBRR frame has the same frame size / bandwidth /
        // channel count as the carrier packet's regular frames, and covers
        // the equivalent prior interval(s); the recovered duration matches
        // the carrier's per-frame duration.
        let per_channel = output_samples_per_channel(routing.frame_size_tenths_ms);
        let mut pcm = vec![0i16; per_channel * channels as usize];

        // FEC only exists for SILK-bearing modes (§2.1.7 re-encodes the
        // SILK speech layer); a CELT-only packet carries no LBRR.
        if !matches!(
            routing.operating_mode,
            OperatingMode::SilkOnly | OperatingMode::Hybrid
        ) {
            return Ok(FecRecovered {
                pcm,
                channels,
                sample_rate_hz: OUTPUT_SAMPLE_RATE_HZ,
                status: FecDecodeStatus::NotSilk,
            });
        }

        // The first Opus frame of the packet carries the §4.2.5 LBRR
        // frames (LBRR frames precede the regular frames within a single
        // SILK-bearing Opus frame; a code-1/2/3 packet's later frames have
        // their own LBRR, but those cover intervals already adjacent to
        // received audio, so the canonical "previous packet was lost"
        // recovery uses the leading Opus frame's LBRR).
        let Some(&frame) = parsed.frames().first() else {
            return Ok(FecRecovered {
                pcm,
                channels,
                sample_rate_hz: OUTPUT_SAMPLE_RATE_HZ,
                status: FecDecodeStatus::DecodeError,
            });
        };
        if frame.is_empty() {
            return Ok(FecRecovered {
                pcm,
                channels,
                sample_rate_hz: OUTPUT_SAMPLE_RATE_HZ,
                status: FecDecodeStatus::NoLbrr,
            });
        }

        let status = if channels == 2 {
            match self.decode_silk_fec_stereo(frame, &routing) {
                Ok(Some((left, right, bandwidth))) => {
                    resample_stereo_to_output_i16(&left, &right, bandwidth, &mut pcm);
                    FecDecodeStatus::Recovered
                }
                Ok(None) => FecDecodeStatus::NoLbrr,
                Err(_) => FecDecodeStatus::DecodeError,
            }
        } else {
            match self.decode_silk_fec_mono(frame, &routing) {
                Ok(Some((internal, bandwidth))) => {
                    resample_internal_to_output_i16(&internal, bandwidth, &mut pcm);
                    FecDecodeStatus::Recovered
                }
                Ok(None) => FecDecodeStatus::NoLbrr,
                Err(_) => FecDecodeStatus::DecodeError,
            }
        };

        Ok(FecRecovered {
            pcm,
            channels,
            sample_rate_hz: OUTPUT_SAMPLE_RATE_HZ,
            status,
        })
    }

    /// Decode and synthesize the §4.2.5 mono LBRR frame(s) of one
    /// SILK-bearing Opus frame into internal-rate recovered audio.
    ///
    /// Returns `Ok(Some((internal, bandwidth)))` with the recovered
    /// signal when at least one mid LBRR frame is present, `Ok(None)` when
    /// the §4.2.4 LBRR flags are all clear (no FEC data), or `Err` on a
    /// malformed bitstream.
    ///
    /// Unlike [`Self::decode_silk_only_mono`], which only consumed the
    /// LBRR bits to keep the range coder aligned, this path actually runs
    /// the §4.2.7.9 synthesis on the LBRR parameters. Per §4.2.5 the LBRR
    /// frames form their own independent sequence covering the prior
    /// interval(s), so synthesis starts from a **fresh** state (the lost
    /// frame's true history is, by definition, unavailable). On success
    /// the decoder's carried mono synthesis state is replaced with the
    /// recovered-frame history so the next real packet continues smoothly.
    fn decode_silk_fec_mono(
        &mut self,
        frame: &[u8],
        routing: &OpusFrameRouting,
    ) -> Result<Option<(Vec<f32>, crate::toc::Bandwidth)>, Error> {
        use crate::range_decoder::RangeDecoder;
        use crate::silk_decode::{decode_silk_frame, SilkFrameConfig, SilkFrameDecoded};
        use crate::silk_excitation::SilkFrameSize;
        use crate::silk_header::SilkHeaderBits;
        use crate::silk_synthesis::{synthesize_silk_frame, SilkSynthState};

        let bandwidth = routing
            .silk_bandwidth
            .ok_or(Error::MalformedPacket)?
            .to_bandwidth();
        let num_silk_frames = routing
            .silk_frames_per_channel
            .ok_or(Error::MalformedPacket)?;
        let frame_size = if routing.frame_size_tenths_ms == 100 {
            SilkFrameSize::TenMs
        } else {
            SilkFrameSize::TwentyMs
        };

        let mut rd = RangeDecoder::new(frame);
        let header = SilkHeaderBits::decode(&mut rd, num_silk_frames, false)?;

        // No LBRR data → no FEC recovery is possible.
        if !(0..num_silk_frames).any(|i| header.mid_has_lbrr(i)) {
            return Ok(None);
        }

        // §4.2.5 LBRR frames are always active-coded and form their own
        // inter-frame sequence; decode every present LBRR frame in
        // interval order, threading the LBRR-local previous gain / lag /
        // NLSF state (the same Table-5 inter-frame dependencies as regular
        // frames, but over the LBRR sub-sequence).
        let mut prev_gain: Option<u8> = None;
        let mut prev_lag: Option<i32> = None;
        let mut prev_nlsf: Option<[i16; crate::silk_lsf_stage2::D_LPC_MAX]> = None;
        let mut prev_nlsf_len = 0usize;
        let mut first = true;
        let mut lbrr_frames: Vec<SilkFrameDecoded> = Vec::new();
        for idx in 0..num_silk_frames {
            if !header.mid_has_lbrr(idx) {
                continue;
            }
            let cfg = SilkFrameConfig {
                bandwidth,
                frame_size,
                voice_active: true, // §4.2.5: all LBRR frames are active.
                first_subframe_independent: first || prev_gain.is_none(),
                previous_log_gain: prev_gain,
                previous_primary_lag: prev_lag,
                ltp_scaling_present: first,
                lsf_interp_after_reset: first || prev_nlsf.is_none(),
                previous_nlsf_q15: prev_nlsf,
                previous_nlsf_len: prev_nlsf_len,
                stereo: None,
            };
            let decoded = decode_silk_frame(&mut rd, cfg)?;
            prev_gain = Some(decoded.gains.last_log_gain());
            prev_lag = Some(decoded.ltp.primary_lag());
            prev_nlsf = Some(decoded.nlsf_q15);
            prev_nlsf_len = decoded.d_lpc;
            first = false;
            lbrr_frames.push(decoded);
        }

        if rd.has_error() {
            return Err(Error::MalformedPacket);
        }
        if lbrr_frames.is_empty() {
            return Ok(None);
        }

        // §4.2.7.9 synthesis from a fresh state: the lost frame's true
        // history is unavailable, so the recovered signal is reconstructed
        // self-contained. The resulting history then becomes the carried
        // mono synthesis state for the following real packet.
        let mut state = SilkSynthState::new(bandwidth)?;
        let mut internal = Vec::new();
        for decoded in &lbrr_frames {
            let frame_out = synthesize_silk_frame(bandwidth, frame_size, decoded, &mut state)?;
            internal.extend_from_slice(&frame_out);
        }
        self.silk_synth_mono = Some(state);
        Ok(Some((internal, bandwidth)))
    }

    /// Decode and synthesize the §4.2.5 **stereo** LBRR frame(s) of one
    /// SILK-bearing Opus frame into internal-rate recovered L/R audio.
    ///
    /// Mirrors [`Self::decode_silk_fec_mono`] for stereo: the §4.2.5 LBRR
    /// frames are interleaved (mid then side per 20 ms interval), each
    /// channel is synthesized from a fresh state, and the pair is unmixed
    /// to left/right via §4.2.8 with a fresh unmix history. The §4.2.7.1
    /// stereo prediction weights ride on the mid LBRR frame; the §4.2.7.2
    /// mid-only flag governs whether a side LBRR frame is present for the
    /// interval (mirroring the regular stereo path).
    ///
    /// Returns `Ok(Some((left, right, bandwidth)))` on recovery,
    /// `Ok(None)` when neither channel carries LBRR, or `Err` on a
    /// malformed bitstream. On success the carried stereo synthesis +
    /// unmix state is replaced with the recovered-frame state.
    #[allow(clippy::type_complexity)]
    fn decode_silk_fec_stereo(
        &mut self,
        frame: &[u8],
        routing: &OpusFrameRouting,
    ) -> Result<Option<(Vec<f32>, Vec<f32>, crate::toc::Bandwidth)>, Error> {
        use crate::range_decoder::RangeDecoder;
        use crate::silk_decode::{decode_silk_frame, SilkFrameDecoded, StereoHeaderContext};
        use crate::silk_excitation::SilkFrameSize;
        use crate::silk_header::SilkHeaderBits;
        use crate::silk_stereo::{stereo_ms_to_lr, StereoUnmixState, StereoWeightsQ13};
        use crate::silk_synthesis::{synthesize_silk_frame, SilkSynthState};

        let bandwidth = routing
            .silk_bandwidth
            .ok_or(Error::MalformedPacket)?
            .to_bandwidth();
        let num_silk_frames = routing
            .silk_frames_per_channel
            .ok_or(Error::MalformedPacket)?;
        let frame_size = if routing.frame_size_tenths_ms == 100 {
            SilkFrameSize::TenMs
        } else {
            SilkFrameSize::TwentyMs
        };

        let mut rd = RangeDecoder::new(frame);
        let header = SilkHeaderBits::decode(&mut rd, num_silk_frames, true)?;

        let any_lbrr =
            (0..num_silk_frames).any(|i| header.mid_has_lbrr(i) || header.side_has_lbrr(i));
        if !any_lbrr {
            return Ok(None);
        }

        // §4.2.5 interleaved LBRR decode: per 20 ms interval the mid LBRR
        // frame (if present, carrying the §4.2.7.1 weights + §4.2.7.2
        // mid-only flag) then the side LBRR frame (if present). Each
        // channel threads its own LBRR-local inter-frame state.
        let mut mid_state = ChannelDecodeState::new();
        let mut side_state = ChannelDecodeState::new();
        let mut mid_frames: Vec<SilkFrameDecoded> = Vec::new();
        let mut side_frames: Vec<Option<SilkFrameDecoded>> = Vec::new();
        let mut interval_weights: Vec<StereoWeightsQ13> = Vec::new();

        for idx in 0..num_silk_frames {
            let mid_lbrr = header.mid_has_lbrr(idx);
            let side_lbrr = header.side_has_lbrr(idx);
            if !mid_lbrr {
                // §4.2.5 / §4.2.7.1: a side LBRR frame without a mid LBRR
                // frame carries no stereo weights; record a zero-weight
                // interval with the mid channel treated as silent.
                if side_lbrr {
                    let side_decoded = decode_silk_frame(
                        &mut rd,
                        side_state.config(bandwidth, frame_size, true, None),
                    )?;
                    side_state.advance(&side_decoded);
                    // Without a mid LBRR frame there is no mid signal for
                    // this interval; the unmixer treats the missing mid as
                    // a hole (handled by skipping the interval in synthesis
                    // below — we still consume the bits for alignment).
                    let _ = side_decoded;
                }
                continue;
            }
            // §4.2.7.2: the mid-only flag is present on the mid LBRR frame
            // iff the side LBRR frame for this interval is absent.
            let stereo_ctx = StereoHeaderContext {
                has_mid_only_flag: !side_lbrr,
            };
            let mid_decoded = decode_silk_frame(
                &mut rd,
                mid_state.config(bandwidth, frame_size, true, Some(stereo_ctx)),
            )?;
            let w = mid_decoded.stereo_pred.map(|p| StereoWeightsQ13 {
                w0_q13: p.w0_q13,
                w1_q13: p.w1_q13,
            });
            interval_weights.push(w.unwrap_or_default());
            let side_coded = side_lbrr || mid_decoded.mid_only_flag == Some(false);
            mid_state.advance(&mid_decoded);
            mid_frames.push(mid_decoded);

            if side_coded {
                let side_decoded = decode_silk_frame(
                    &mut rd,
                    side_state.config(bandwidth, frame_size, true, None),
                )?;
                side_state.advance(&side_decoded);
                side_frames.push(Some(side_decoded));
            } else {
                side_frames.push(None);
            }
        }

        if rd.has_error() {
            return Err(Error::MalformedPacket);
        }
        if mid_frames.is_empty() {
            return Ok(None);
        }

        // §4.2.7.9 synthesis + §4.2.8 unmix from fresh state.
        let mut mid_synth = SilkSynthState::new(bandwidth)?;
        let mut side_synth = SilkSynthState::new(bandwidth)?;
        let mut unmix = StereoUnmixState::new();
        let mut left = Vec::new();
        let mut right = Vec::new();
        for (idx, mid_frame) in mid_frames.iter().enumerate() {
            let mid_out = synthesize_silk_frame(bandwidth, frame_size, mid_frame, &mut mid_synth)?;
            let weights = interval_weights[idx];
            let stereo = match &side_frames[idx] {
                Some(side_frame) => {
                    let side_out =
                        synthesize_silk_frame(bandwidth, frame_size, side_frame, &mut side_synth)?;
                    stereo_ms_to_lr(bandwidth, &mid_out, Some(&side_out), weights, &mut unmix)?
                }
                None => {
                    side_synth.reset();
                    stereo_ms_to_lr(bandwidth, &mid_out, None, weights, &mut unmix)?
                }
            };
            left.extend_from_slice(&stereo.left);
            right.extend_from_slice(&stereo.right);
        }

        self.silk_synth_stereo = Some((mid_synth, side_synth));
        self.silk_stereo_unmix = Some(unmix);
        Ok(Some((left, right, bandwidth)))
    }

    /// Decode one Hybrid Opus frame (§4.2 SILK + §4.3 CELT). Currently
    /// emits silence; depends on both layer paths landing.
    fn decode_hybrid_frame(
        &mut self,
        _frame: &[u8],
        routing: &OpusFrameRouting,
        pcm: &mut Vec<i16>,
    ) -> FrameOutcome {
        let per_channel = output_samples_per_channel(routing.frame_size_tenths_ms);
        push_silence(pcm, per_channel, routing.channel_count());
        FrameOutcome {
            samples_per_channel: per_channel,
            status: FrameDecodeStatus::LayerNotWired(OperatingMode::Hybrid),
        }
    }
}

/// Append `per_channel * channels` interleaved zero samples to `pcm`.
fn push_silence(pcm: &mut Vec<i16>, per_channel: usize, channels: u8) {
    pcm.resize(pcm.len() + per_channel * channels as usize, 0);
}

/// Per-channel inter-frame decode state threaded across the SILK frames
/// of one Opus frame (§4.2.7.4 previous gain, §4.2.7.6.1 previous lag,
/// §4.2.7.5.5 previous NLSF base, and the "first SILK frame of this type"
/// flag). One instance is used for the mid channel and one for the side
/// channel (each channel's frames form an independent sequence).
pub(crate) struct ChannelDecodeState {
    prev_gain: Option<u8>,
    prev_lag: Option<i32>,
    prev_nlsf: Option<[i16; crate::silk_lsf_stage2::D_LPC_MAX]>,
    prev_nlsf_len: usize,
    first: bool,
}

impl ChannelDecodeState {
    pub(crate) fn new() -> Self {
        Self {
            prev_gain: None,
            prev_lag: None,
            prev_nlsf: None,
            prev_nlsf_len: 0,
            first: true,
        }
    }

    /// Build the [`crate::silk_decode::SilkFrameConfig`] for the next SILK
    /// frame in this channel's sequence, given the §4.2.4 VAD flag and the
    /// optional §4.2.7.1 / §4.2.7.2 stereo header context (present only on
    /// the mid channel).
    pub(crate) fn config(
        &self,
        bandwidth: crate::toc::Bandwidth,
        frame_size: crate::silk_excitation::SilkFrameSize,
        voice_active: bool,
        stereo: Option<crate::silk_decode::StereoHeaderContext>,
    ) -> crate::silk_decode::SilkFrameConfig {
        crate::silk_decode::SilkFrameConfig {
            bandwidth,
            frame_size,
            voice_active,
            first_subframe_independent: self.first || self.prev_gain.is_none(),
            previous_log_gain: self.prev_gain,
            previous_primary_lag: self.prev_lag,
            ltp_scaling_present: self.first,
            lsf_interp_after_reset: self.first || self.prev_nlsf.is_none(),
            previous_nlsf_q15: self.prev_nlsf,
            previous_nlsf_len: self.prev_nlsf_len,
            stereo,
        }
    }

    /// Fold a freshly decoded SILK frame into the carried state, so the
    /// next frame in this channel's sequence predicts against it.
    pub(crate) fn advance(&mut self, decoded: &crate::silk_decode::SilkFrameDecoded) {
        self.prev_gain = Some(decoded.gains.last_log_gain());
        self.prev_lag = Some(decoded.ltp.primary_lag());
        self.prev_nlsf = Some(decoded.nlsf_q15);
        self.prev_nlsf_len = decoded.d_lpc;
        self.first = false;
    }
}

/// Resample one Opus frame's internal-rate SILK samples (`internal`, at
/// the §4.2.1 SILK internal rate for `bandwidth`) to the 48 kHz decoder
/// output rate and write the result, converted to signed 16-bit PCM, into
/// `out` (whose length is the §3.1 48 kHz per-channel sample count).
///
/// Per RFC 6716 §4.2.9 "the resampler itself is non-normative, and a
/// decoder can use any method it wants to perform the resampling." We use
/// linear interpolation between adjacent internal-rate samples — a simple,
/// total method that introduces only the small distortion the §4.2.7.9
/// preamble explicitly permits ("small errors should only introduce
/// proportionally small distortions"). A bit-exact match to a particular
/// reference resampler is **not** attempted; the RFC defers the kernel
/// choice to the implementation.
///
/// The `internal`-to-`out` length ratio is the integer rate ratio (6 for
/// NB 8 kHz, 4 for MB 12 kHz, 3 for WB 16 kHz → 48 kHz), so the linear
/// interpolation positions are exact rationals; no fractional drift
/// accumulates across frames.
fn resample_internal_to_output_i16(
    internal: &[f32],
    bandwidth: crate::toc::Bandwidth,
    out: &mut [i16],
) {
    if out.is_empty() {
        return;
    }
    if internal.is_empty() {
        for o in out.iter_mut() {
            *o = 0;
        }
        return;
    }
    let in_len = internal.len();
    let out_len = out.len();
    // The internal-rate sample position for output sample `i` is
    // `i * in_len / out_len`. Linear-interpolate between the two
    // bracketing internal samples.
    let _ = bandwidth; // the rate ratio is implied by in_len / out_len.
    for (i, o) in out.iter_mut().enumerate() {
        let pos = (i as f64) * (in_len as f64) / (out_len as f64);
        let i0 = pos.floor() as usize;
        let frac = (pos - i0 as f64) as f32;
        let s0 = internal[i0.min(in_len - 1)];
        let s1 = internal[(i0 + 1).min(in_len - 1)];
        let v = s0 + (s1 - s0) * frac;
        *o = f32_to_i16(v);
    }
}

/// Resample a stereo pair of internal-rate SILK channels (`left` /
/// `right`, both at the §4.2.1 SILK internal rate for `bandwidth`) to the
/// 48 kHz output rate and write them **interleaved** (`[L0, R0, L1, R1,
/// …]`) into `out` (length `2 * per_channel`).
///
/// Per RFC 6716 §4.2.9 the resampler is non-normative; we use the same
/// linear interpolation as the mono path on each channel independently.
fn resample_stereo_to_output_i16(
    left: &[f32],
    right: &[f32],
    bandwidth: crate::toc::Bandwidth,
    out: &mut [i16],
) {
    let per_channel = out.len() / 2;
    if per_channel == 0 {
        return;
    }
    // Resample each channel into a scratch buffer, then interleave.
    let mut l = vec![0i16; per_channel];
    let mut r = vec![0i16; per_channel];
    resample_internal_to_output_i16(left, bandwidth, &mut l);
    resample_internal_to_output_i16(right, bandwidth, &mut r);
    for i in 0..per_channel {
        out[2 * i] = l[i];
        out[2 * i + 1] = r[i];
    }
}

/// Convert a nominal `[-1.0, 1.0]` float sample to signed 16-bit PCM,
/// rounding to nearest and clamping into the i16 range. The §4.2.7.9.2
/// output is already clamped to `[-1.0, 1.0]`; the clamp here is a
/// defensive backstop.
fn f32_to_i16(v: f32) -> i16 {
    let scaled = (v.clamp(-1.0, 1.0) * 32767.0).round();
    scaled as i16
}

/// Convenience: the channel count for a [`ChannelMapping`].
pub fn channel_count(mapping: ChannelMapping) -> u8 {
    match mapping {
        ChannelMapping::Mono => 1,
        ChannelMapping::Stereo => 2,
    }
}

#[cfg(test)]
mod tests {
    use super::*;
    use crate::toc::OpusTocByte;

    /// Build a minimal code-0 packet: TOC byte + a non-empty single
    /// frame body. `config` is the 5-bit §3.1 config, `stereo` the s bit.
    fn code0_packet(config: u8, stereo: bool, body: &[u8]) -> Vec<u8> {
        let toc = (config << 3) | (if stereo { 1 << 2 } else { 0 });
        let mut p = vec![toc];
        p.extend_from_slice(body);
        p
    }

    #[test]
    fn output_samples_per_channel_matches_table2_durations() {
        // (tenths-ms, expected 48 kHz samples/channel)
        let cases = [
            (25u16, 120usize), // 2.5 ms CELT
            (50, 240),         // 5 ms
            (100, 480),        // 10 ms
            (200, 960),        // 20 ms
            (400, 1920),       // 40 ms
            (600, 2880),       // 60 ms
        ];
        for (tenths, expected) in cases {
            assert_eq!(
                output_samples_per_channel(tenths),
                expected,
                "tenths={tenths}"
            );
        }
    }

    #[test]
    fn empty_packet_rejected() {
        let mut dec = OpusDecoder::new();
        assert_eq!(dec.decode_packet(&[]), Err(Error::EmptyPacket));
    }

    #[test]
    fn silk_nb_mono_20ms_single_frame_pcm_length() {
        // config 1 = SILK NB 20 ms (200 tenths-ms), mono, code 0.
        let pkt = code0_packet(1, false, &[0x12, 0x34, 0x56]);
        let mut dec = OpusDecoder::new();
        let out = dec.decode_packet(&pkt).expect("decode");
        assert_eq!(out.channels, 1);
        assert_eq!(out.sample_rate_hz, OUTPUT_SAMPLE_RATE_HZ);
        assert_eq!(out.samples_per_channel(), 960);
        assert_eq!(out.pcm.len(), 960);
        assert_eq!(out.frame_outcomes.len(), 1);
        // A mono SILK-only frame now runs the real §4.2 bitstream decode;
        // the status is either a clean params-decoded or a decode-error
        // (a 3-byte arbitrary body may truncate mid-frame), never the
        // not-wired placeholder.
        assert!(
            matches!(
                out.frame_outcomes[0].status,
                FrameDecodeStatus::SilkParamsDecoded | FrameDecodeStatus::SilkDecodeError
            ),
            "got {:?}",
            out.frame_outcomes[0].status
        );
    }

    #[test]
    fn celt_only_stereo_pcm_is_interleaved_length() {
        // config 20 = CELT-only, second size in the NB/WB group; stereo.
        let pkt = code0_packet(20, true, &[0xaa, 0xbb]);
        let mut dec = OpusDecoder::new();
        let out = dec.decode_packet(&pkt).expect("decode");
        assert_eq!(out.channels, 2);
        // 2 channels interleaved => pcm len = 2 * samples_per_channel.
        assert_eq!(out.pcm.len(), 2 * out.samples_per_channel());
        let routing = OpusFrameRouting::from_toc(OpusTocByte::from_byte(pkt[0]));
        // A CELT-only frame now decodes its §4.3.7.1 prefix and, when
        // non-silent, its §4.3.2.1 coarse energy from the real range
        // coder — so the status is one of the real CELT outcomes
        // (silence / coarse-energy-decoded / a decode error on a 2-byte
        // body), never the not-wired placeholder.
        assert!(
            matches!(
                out.frame_outcomes[0].status,
                FrameDecodeStatus::CeltSilence
                    | FrameDecodeStatus::CeltCoarseEnergyDecoded
                    | FrameDecodeStatus::CeltAllocationDecoded
                    | FrameDecodeStatus::CeltDecodeError
            ),
            "got {:?}",
            out.frame_outcomes[0].status
        );
        assert_eq!(routing.operating_mode, OperatingMode::CeltOnly);
    }

    #[test]
    fn code1_two_equal_frames_concatenate_pcm() {
        // config 0 = SILK NB 10 ms (100 tenths => 480 samples/ch), mono.
        // Code 1 = two equal frames; body must be even length.
        // config 0 (<< 3 = 0), mono, code 1 (0b01).
        let toc = 0b01u8;
        let mut pkt = vec![toc];
        pkt.extend_from_slice(&[1, 2, 3, 4]); // two 2-byte frames
        let mut dec = OpusDecoder::new();
        let out = dec.decode_packet(&pkt).expect("decode");
        assert_eq!(out.frame_outcomes.len(), 2);
        // Two 10 ms frames => 2 * 480 = 960 samples/channel.
        assert_eq!(out.samples_per_channel(), 960);
        assert_eq!(out.pcm.len(), 960);
    }

    #[test]
    fn dtx_zero_length_frame_emits_silence_with_status() {
        // Code 3 VBR with a zero-length (DTX) frame. Build a code-3
        // packet by hand: TOC, frame-count byte, then VBR lengths.
        // Simpler: rely on code-2 unequal where the first frame length 0
        // is a valid DTX marker per §3.2.1.
        // config 0 (<< 3 = 0) SILK NB 10 ms mono, code 2 (0b10).
        let toc = 0b10u8;
        // code 2 body: a length prefix for frame 1, then frame1, then
        // frame2 is the remainder. Length 0 => frame1 is DTX.
        let pkt = vec![toc, 0x00, 0x07];
        let mut dec = OpusDecoder::new();
        let out = dec.decode_packet(&pkt).expect("decode");
        assert_eq!(out.frame_outcomes.len(), 2);
        assert_eq!(out.frame_outcomes[0].status, FrameDecodeStatus::DtxOrLost);
        // Both frames are 10 ms => 480 samples/channel each.
        assert_eq!(out.samples_per_channel(), 960);
    }

    #[test]
    fn reset_clears_carried_channel_state() {
        let mut dec = OpusDecoder::new();
        let stereo = code0_packet(20, true, &[1, 2]);
        dec.decode_packet(&stereo).expect("decode");
        assert_eq!(dec.last_channels, Some(2));
        dec.reset();
        assert_eq!(dec.last_channels, None);
    }

    #[test]
    fn celt_to_silk_transition_resets_silk_state() {
        // §4.5.2: the SILK state is reset before a SILK-only frame whose
        // predecessor was CELT-only. With CELT not yet wired (a CELT-only
        // packet emits silence and touches no SILK state), a SILK packet
        // followed by a CELT packet followed by the same SILK packet must
        // produce the *same* PCM as a fresh decoder running that SILK
        // packet once — because the §4.5.2 reset clears the carried
        // §4.2.7.9 history the first SILK packet left behind.
        let silk_body: Vec<u8> = (0..200u16)
            .map(|i| (i.wrapping_mul(149).wrapping_add(11) & 0xff) as u8)
            .collect();
        let silk_pkt = code0_packet(1, false, &silk_body); // config 1 = SILK NB 20 ms mono.
        let celt_pkt = code0_packet(17, false, &[0xaa, 0xbb]); // config 17 = CELT-only mono.

        // Reference: a fresh decoder running the SILK packet once.
        let mut ref_dec = OpusDecoder::new();
        let reference = ref_dec.decode_packet(&silk_pkt).expect("decode");

        // Sequence: SILK, then CELT (resets SILK state on the *next* SILK
        // frame), then SILK again. The third packet must match the
        // reference if and only if the §4.5.2 reset fired.
        let mut seq_dec = OpusDecoder::new();
        seq_dec.decode_packet(&silk_pkt).expect("decode");
        seq_dec.decode_packet(&celt_pkt).expect("decode");
        let after_reset = seq_dec.decode_packet(&silk_pkt).expect("decode");

        // Only compare when the SILK frame actually synthesized audio.
        if reference.frame_outcomes[0].status == FrameDecodeStatus::SilkParamsDecoded {
            assert_eq!(
                after_reset.pcm, reference.pcm,
                "§4.5.2 CELT→SILK transition must reset SILK state"
            );
        }
    }

    #[test]
    fn silk_to_silk_no_reset_threads_state() {
        // The complement of the §4.5.2 test: two consecutive SILK-only
        // packets (no CELT interlude) do NOT reset the SILK state, so the
        // second packet's output generally differs from a fresh-decoder
        // decode of that packet (the carried §4.2.7.9 history changes the
        // LPC/LTP synthesis). This pins that state actually threads when
        // it should.
        let silk_body: Vec<u8> = (0..200u16)
            .map(|i| (i.wrapping_mul(149).wrapping_add(11) & 0xff) as u8)
            .collect();
        let silk_pkt = code0_packet(1, false, &silk_body);

        let mut fresh = OpusDecoder::new();
        let fresh_out = fresh.decode_packet(&silk_pkt).expect("decode");

        let mut threaded = OpusDecoder::new();
        threaded.decode_packet(&silk_pkt).expect("decode");
        let second = threaded.decode_packet(&silk_pkt).expect("decode");

        // Both decode to the same length; the carried state means the
        // second decode is at least a valid, finite PCM buffer.
        assert_eq!(second.pcm.len(), fresh_out.pcm.len());
    }

    #[test]
    fn silk_mono_full_decode_consumes_bitstream_cleanly() {
        // A long pseudo-random SILK NB mono 20 ms body: the range coder
        // does not run out of bits, so the full §4.2 frame decodes and the
        // status is the clean params-decoded outcome (not a decode error).
        let body: Vec<u8> = (0..120u16)
            .map(|i| (i.wrapping_mul(101).wrapping_add(7) & 0xff) as u8)
            .collect();
        let pkt = code0_packet(1, false, &body); // config 1 = SILK NB 20 ms.
        let mut dec = OpusDecoder::new();
        let out = dec.decode_packet(&pkt).expect("decode");
        assert_eq!(out.frame_outcomes.len(), 1);
        assert_eq!(
            out.frame_outcomes[0].status,
            FrameDecodeStatus::SilkParamsDecoded,
            "a long SILK NB mono body should fully decode"
        );
        // PCM length is correct even though the samples are silence
        // (synthesis pending).
        assert_eq!(out.samples_per_channel(), 960);
    }

    #[test]
    fn silk_mono_40ms_two_silk_frames_decode() {
        // config 2 = SILK NB 40 ms => 2 SILK frames per channel; mono.
        let body: Vec<u8> = (0..220u16)
            .map(|i| (i.wrapping_mul(53).wrapping_add(3) & 0xff) as u8)
            .collect();
        let pkt = code0_packet(2, false, &body);
        let mut dec = OpusDecoder::new();
        let out = dec.decode_packet(&pkt).expect("decode");
        let routing = OpusFrameRouting::from_toc(OpusTocByte::from_byte(pkt[0]));
        assert_eq!(routing.silk_frames_per_channel, Some(2));
        // 40 ms => 1920 samples/channel; one Opus frame (code 0).
        assert_eq!(out.frame_outcomes.len(), 1);
        assert_eq!(out.samples_per_channel(), 1920);
        // The two-SILK-frame loop ran; the status reflects a SILK decode
        // (clean or truncated), never the not-wired placeholder.
        assert!(matches!(
            out.frame_outcomes[0].status,
            FrameDecodeStatus::SilkParamsDecoded | FrameDecodeStatus::SilkDecodeError
        ));
    }

    #[test]
    fn stereo_silk_only_decodes_to_interleaved_pcm() {
        // Stereo SILK now runs the full §4.2 interleaved mid/side decode +
        // §4.2.8 unmix. A long pseudo-random body decodes cleanly; the
        // output is interleaved L/R 48 kHz PCM.
        let body: Vec<u8> = (0..220u16)
            .map(|i| (i.wrapping_mul(137).wrapping_add(19) & 0xff) as u8)
            .collect();
        let pkt = code0_packet(1, true, &body); // config 1 = SILK NB 20 ms stereo.
        let mut dec = OpusDecoder::new();
        let out = dec.decode_packet(&pkt).expect("decode");
        assert_eq!(out.channels, 2);
        assert_eq!(out.samples_per_channel(), 960);
        assert_eq!(out.pcm.len(), 2 * 960);
        assert!(matches!(
            out.frame_outcomes[0].status,
            FrameDecodeStatus::SilkStereoDecoded | FrameDecodeStatus::SilkDecodeError
        ));
    }

    #[test]
    fn stereo_silk_clean_body_is_fully_decoded() {
        // A buffer long enough that the range coder never starves: the
        // interleaved mid/side decode + unmix completes, yielding the
        // stereo-decoded status (not a decode error, not not-wired).
        let body: Vec<u8> = (0..400u16)
            .map(|i| (i.wrapping_mul(97).wrapping_add(41) & 0xff) as u8)
            .collect();
        let pkt = code0_packet(1, true, &body);
        let mut dec = OpusDecoder::new();
        let out = dec.decode_packet(&pkt).expect("decode");
        assert_eq!(
            out.frame_outcomes[0].status,
            FrameDecodeStatus::SilkStereoDecoded,
            "a long stereo SILK NB body should fully decode"
        );
        // The output is finite and within i16 range by construction.
        assert_eq!(out.pcm.len(), 2 * 960);
    }

    #[test]
    fn stereo_silk_40ms_two_intervals_decode() {
        // config 2 = SILK NB 40 ms => 2 SILK frames per channel; stereo.
        // The §4.2.2 interleave runs mid/side per 20 ms interval twice.
        let body: Vec<u8> = (0..480u16)
            .map(|i| (i.wrapping_mul(61).wrapping_add(7) & 0xff) as u8)
            .collect();
        let pkt = code0_packet(2, true, &body);
        let mut dec = OpusDecoder::new();
        let out = dec.decode_packet(&pkt).expect("decode");
        let routing = OpusFrameRouting::from_toc(OpusTocByte::from_byte(pkt[0]));
        assert_eq!(routing.silk_frames_per_channel, Some(2));
        assert_eq!(out.channels, 2);
        // 40 ms => 1920 samples/channel interleaved.
        assert_eq!(out.samples_per_channel(), 1920);
        assert_eq!(out.pcm.len(), 2 * 1920);
        assert!(matches!(
            out.frame_outcomes[0].status,
            FrameDecodeStatus::SilkStereoDecoded | FrameDecodeStatus::SilkDecodeError
        ));
    }

    #[test]
    fn stereo_silk_60ms_three_intervals_per_interval_unmix() {
        // config 3 = SILK NB 60 ms => 3 SILK frames per channel; stereo.
        // Each 20 ms interval is unmixed separately (its own §4.2.7.1
        // weights + a fresh §4.2.8 interpolation phase), and the three
        // L/R interval outputs are concatenated. This pins the per-interval
        // unmix path for a multi-interval stereo frame.
        let body: Vec<u8> = (0..640u16)
            .map(|i| (i.wrapping_mul(73).wrapping_add(31) & 0xff) as u8)
            .collect();
        let pkt = code0_packet(3, true, &body);
        let mut dec = OpusDecoder::new();
        let out = dec.decode_packet(&pkt).expect("decode");
        let routing = OpusFrameRouting::from_toc(OpusTocByte::from_byte(pkt[0]));
        assert_eq!(routing.silk_frames_per_channel, Some(3));
        assert_eq!(out.channels, 2);
        // 60 ms => 2880 samples/channel interleaved.
        assert_eq!(out.samples_per_channel(), 2880);
        assert_eq!(out.pcm.len(), 2 * 2880);
        assert!(matches!(
            out.frame_outcomes[0].status,
            FrameDecodeStatus::SilkStereoDecoded | FrameDecodeStatus::SilkDecodeError
        ));
    }

    #[test]
    fn stereo_silk_state_threads_across_packets() {
        // Two consecutive stereo SILK packets thread the §4.2.7.9 + §4.2.8
        // histories: the second packet's output may differ from a fresh
        // decode, but both are valid finite buffers of equal length.
        let body: Vec<u8> = (0..300u16)
            .map(|i| (i.wrapping_mul(113).wrapping_add(23) & 0xff) as u8)
            .collect();
        let pkt = code0_packet(1, true, &body);

        let mut fresh = OpusDecoder::new();
        let fresh_out = fresh.decode_packet(&pkt).expect("decode");

        let mut threaded = OpusDecoder::new();
        threaded.decode_packet(&pkt).expect("decode");
        let second = threaded.decode_packet(&pkt).expect("decode");
        assert_eq!(second.pcm.len(), fresh_out.pcm.len());
    }

    #[test]
    fn mono_to_stereo_transition_resets_stereo_state() {
        // §4.2.7.1: previous stereo weights reset on a mono→stereo
        // transition. A mono packet, then a stereo packet, then the same
        // stereo packet must leave the second stereo decode in a defined
        // state (no panic; correct length). The mono→stereo channel-count
        // change clears the carried stereo history.
        let mono_body: Vec<u8> = (0..200u16)
            .map(|i| (i.wrapping_mul(71).wrapping_add(5) & 0xff) as u8)
            .collect();
        let stereo_body: Vec<u8> = (0..300u16)
            .map(|i| (i.wrapping_mul(89).wrapping_add(11) & 0xff) as u8)
            .collect();
        let mono_pkt = code0_packet(1, false, &mono_body);
        let stereo_pkt = code0_packet(1, true, &stereo_body);

        let mut dec = OpusDecoder::new();
        dec.decode_packet(&mono_pkt).expect("mono");
        let out = dec.decode_packet(&stereo_pkt).expect("stereo");
        assert_eq!(out.channels, 2);
        assert_eq!(out.pcm.len(), 2 * 960);
    }

    #[test]
    fn pcm_length_matches_routing_for_every_config() {
        // Every Table-2 config decodes to a PCM buffer of the routing's
        // 48 kHz length × channels. Mono SILK-only configs now synthesize
        // real audio (§4.2.7.9); the still-unwired layers (CELT-only,
        // Hybrid, and stereo SILK) emit correct-length silence. This sweep
        // pins the length invariant for all 32 configs and the silence
        // invariant for the not-yet-wired ones.
        let mut dec = OpusDecoder::new();
        for config in 0u8..32 {
            for stereo in [false, true] {
                let pkt = code0_packet(config, stereo, &[0x55, 0x66, 0x77]);
                let out = dec.decode_packet(&pkt).expect("decode");
                let routing = OpusFrameRouting::from_toc(OpusTocByte::from_byte(pkt[0]));
                let expected = output_samples_per_channel(routing.frame_size_tenths_ms)
                    * out.channels as usize;
                assert_eq!(out.pcm.len(), expected, "config {config} stereo {stereo}");
                // The unwired layers (everything except a successfully
                // synthesized mono or stereo SILK-only frame) still emit
                // silence.
                let is_wired_silk = matches!(
                    out.frame_outcomes[0].status,
                    FrameDecodeStatus::SilkParamsDecoded | FrameDecodeStatus::SilkStereoDecoded
                );
                if !is_wired_silk {
                    assert!(
                        out.pcm.iter().all(|&s| s == 0),
                        "config {config} stereo {stereo} status {:?} should be silence",
                        out.frame_outcomes[0].status
                    );
                }
                // The decoder must be reset between configs so the carried
                // §4.2.7.9 synthesis history of one bandwidth doesn't leak
                // into the next.
                dec.reset();
            }
        }
    }

    #[test]
    fn mono_silk_frame_can_emit_nonsilent_pcm() {
        // A long pseudo-random mono SILK NB 20 ms body decodes cleanly and
        // is synthesized through the §4.2.7.9 LTP/LPC filters + §4.2.9
        // resample; the emitted PCM is no longer forced to silence. (The
        // exact samples are not pinned — there is no codec-level bit-exact
        // fixture yet — but a clean params-decoded frame produces a
        // correctly-sized 48 kHz buffer.)
        let body: Vec<u8> = (0..200u16)
            .map(|i| (i.wrapping_mul(181).wrapping_add(13) & 0xff) as u8)
            .collect();
        let pkt = code0_packet(1, false, &body); // config 1 = SILK NB 20 ms.
        let mut dec = OpusDecoder::new();
        let out = dec.decode_packet(&pkt).expect("decode");
        assert_eq!(out.channels, 1);
        assert_eq!(out.samples_per_channel(), 960);
        if out.frame_outcomes[0].status == FrameDecodeStatus::SilkParamsDecoded {
            // A successfully synthesized frame produces a full-length
            // buffer; every sample is a valid i16 (no panic / overflow).
            assert_eq!(out.pcm.len(), 960);
        }
    }

    /// Search for a CELT body whose §4.3.7.1 prefix decodes silence = 1
    /// with the post-filter off, so the frame takes the fully-wired
    /// silence synthesis path. Returns the body bytes appended after the
    /// TOC. The search is deterministic (fixed candidate set), so the
    /// chosen body is stable across runs.
    fn find_celt_silence_body() -> Vec<u8> {
        use crate::celt_frame_prefix::decode_celt_frame_prefix;
        use crate::range_decoder::RangeDecoder;
        // The silence flag is the {32767,1}/32768 "1" branch (probability
        // 2^-15), so a silent frame is rare in random bytes; sweep the
        // first two bytes (with a trailing zero run that keeps the
        // post-filter off) to find one deterministically.
        for b0 in 0u16..=255 {
            for b1 in 0u16..=255 {
                let buf = [b0 as u8, b1 as u8, 0, 0, 0, 0];
                let mut rd = RangeDecoder::new(&buf);
                let p = decode_celt_frame_prefix(&mut rd);
                if p.silence && p.post_filter.is_none() && !rd.has_error() {
                    return buf.to_vec();
                }
            }
        }
        panic!("no CELT silence body found in the candidate set");
    }

    #[test]
    fn celt_only_silence_frame_decodes_end_to_end() {
        // config 17 = CELT-only mono, 5 ms (Table-55 second column) →
        // 240 samples/channel at 48 kHz.
        let body = find_celt_silence_body();
        let pkt = code0_packet(17, false, &body);
        let mut dec = OpusDecoder::new();
        let out = dec.decode_packet(&pkt).expect("decode");
        assert_eq!(out.channels, 1);
        assert_eq!(out.samples_per_channel(), 240);
        assert_eq!(
            out.frame_outcomes[0].status,
            FrameDecodeStatus::CeltSilence,
            "silence-flagged CELT frame must take the wired synthesis path"
        );
        // The frame is silent: every emitted sample is zero (a zero-energy
        // band envelope synthesizes to a zero time-domain block, and the
        // overlap-add / de-emphasis of an all-zero history stays zero).
        assert_eq!(out.pcm.len(), 240);
        assert!(
            out.pcm.iter().all(|&s| s == 0),
            "silence frame must be all zero"
        );
    }

    #[test]
    fn celt_silence_advances_synthesis_state() {
        // Two consecutive CELT silence frames both decode through the
        // wired path; the second reuses the carried CeltSynthState (no
        // rebuild), and both emit silence of the correct length.
        let body = find_celt_silence_body();
        let pkt = code0_packet(17, false, &body);
        let mut dec = OpusDecoder::new();
        let first = dec.decode_packet(&pkt).expect("decode");
        let second = dec.decode_packet(&pkt).expect("decode");
        assert_eq!(
            first.frame_outcomes[0].status,
            FrameDecodeStatus::CeltSilence
        );
        assert_eq!(
            second.frame_outcomes[0].status,
            FrameDecodeStatus::CeltSilence
        );
        assert!(second.pcm.iter().all(|&s| s == 0));
    }

    #[test]
    fn celt_non_silent_frame_decodes_coarse_energy() {
        // A CELT body whose silence flag is clear now takes the
        // §4.3.2.1 coarse-energy decode path: the per-band log-energy
        // envelope is reconstructed from the real range coder, the
        // cross-frame predictor state is threaded, and the synthesis
        // backend is advanced with all-zero bands (the band-shape stages
        // are still pending). The frame must report
        // CeltCoarseEnergyDecoded — or CeltDecodeError if the short body
        // truncates mid-decode — never the not-wired placeholder, never
        // a panic, and emit silence of the correct length.
        use crate::celt_frame_prefix::decode_celt_frame_prefix;
        use crate::range_decoder::RangeDecoder;
        // Find a longer body with silence = 0 and no range-coder error in
        // the prefix (the 21-band coarse decode needs enough bytes to not
        // immediately truncate).
        let mut chosen: Option<Vec<u8>> = None;
        for b0 in 0u16..=255 {
            let buf = [
                b0 as u8, 0x5a, 0x5a, 0x5a, 0x5a, 0x5a, 0x5a, 0x5a, 0x5a, 0x5a,
            ];
            let mut rd = RangeDecoder::new(&buf);
            let p = decode_celt_frame_prefix(&mut rd);
            if !p.silence && !rd.has_error() {
                chosen = Some(buf.to_vec());
                break;
            }
        }
        let body = chosen.expect("a non-silent CELT body exists in the candidate set");
        let pkt = code0_packet(17, false, &body);
        let mut dec = OpusDecoder::new();
        let out = dec.decode_packet(&pkt).expect("decode");
        assert!(
            matches!(
                out.frame_outcomes[0].status,
                FrameDecodeStatus::CeltCoarseEnergyDecoded
                    | FrameDecodeStatus::CeltAllocationDecoded
                    | FrameDecodeStatus::CeltDecodeError
            ),
            "got {:?}",
            out.frame_outcomes[0].status
        );
        assert_eq!(out.pcm.len(), 240);
    }

    #[test]
    fn celt_coarse_energy_threads_predictor_across_frames() {
        // Two successive non-silent CELT-only inter frames must thread the
        // coarse-energy predictor state: after the first decodes, the
        // decoder carries a CoarseEnergyState; the second reuses it.
        use crate::celt_frame_prefix::decode_celt_frame_prefix;
        use crate::range_decoder::RangeDecoder;
        let mut chosen: Option<Vec<u8>> = None;
        for b0 in 0u16..=255 {
            let buf = [
                b0 as u8, 0x33, 0xcc, 0x55, 0xaa, 0x0f, 0xf0, 0x12, 0x9a, 0x4e,
            ];
            let mut rd = RangeDecoder::new(&buf);
            let p = decode_celt_frame_prefix(&mut rd);
            if !p.silence && !p.intra && !rd.has_error() {
                chosen = Some(buf.to_vec());
                break;
            }
        }
        // Not every leading byte yields a non-silent, non-intra prefix; if
        // none does, the threading invariant is still exercised by the
        // single-frame test above, so skip silently.
        if let Some(body) = chosen {
            let pkt = code0_packet(19, false, &body); // 20 ms CELT-only mono
            let mut dec = OpusDecoder::new();
            let first = dec.decode_packet(&pkt).expect("decode");
            // After a successful coarse decode the predictor state exists.
            // (A non-silent inter frame now also runs the §4.3.3 allocation
            // header, so the terminal status is `CeltAllocationDecoded`; a
            // truncated allocation header falls back to `CeltDecodeError`,
            // but the coarse predictor state was already threaded before
            // that point regardless.)
            if matches!(
                first.frame_outcomes[0].status,
                FrameDecodeStatus::CeltCoarseEnergyDecoded
                    | FrameDecodeStatus::CeltAllocationDecoded
            ) {
                assert!(dec.celt_coarse.is_some());
            }
            let _second = dec.decode_packet(&pkt).expect("decode");
        }
    }

    #[test]
    fn celt_non_silent_frame_decodes_allocation_header() {
        // On top of the §4.3.2.1 coarse energy, a non-silent CELT-only
        // frame now consumes the §4.3.3 *signalled* allocation header
        // (band boosts + alloc trim + reservations) from the same range
        // coder. With a body long enough to survive the 21-band coarse
        // decode plus the boost/trim symbols, the terminal status is
        // `CeltAllocationDecoded`; a body that truncates mid-header still
        // reports a real CELT outcome (never the not-wired placeholder),
        // never panics, and emits silence of the correct length.
        use crate::celt_frame_prefix::decode_celt_frame_prefix;
        use crate::range_decoder::RangeDecoder;

        // A 20 ms CELT-only frame (config 19) has 21 coded bands; pick a
        // generous body so the allocation header has room to decode.
        let mut chosen: Option<Vec<u8>> = None;
        for b0 in 0u16..=255 {
            let buf = [
                b0 as u8, 0x91, 0x37, 0xc4, 0x6e, 0x2d, 0xa8, 0x5b, 0xf1, 0x0c, 0x93, 0x47, 0xbe,
                0x21,
            ];
            let mut rd = RangeDecoder::new(&buf);
            let p = decode_celt_frame_prefix(&mut rd);
            if !p.silence && !rd.has_error() {
                chosen = Some(buf.to_vec());
                break;
            }
        }
        let body = chosen.expect("a non-silent CELT body exists in the candidate set");
        let pkt = code0_packet(19, false, &body); // 20 ms CELT-only mono
        let mut dec = OpusDecoder::new();
        let out = dec.decode_packet(&pkt).expect("decode");

        // Whatever the body's exact entropy content, the status must be a
        // real CELT outcome that reflects an actually-consumed bitstream,
        // and the per-channel length is the 20 ms 48 kHz count (960).
        assert!(
            matches!(
                out.frame_outcomes[0].status,
                FrameDecodeStatus::CeltAllocationDecoded
                    | FrameDecodeStatus::CeltCoarseEnergyDecoded
                    | FrameDecodeStatus::CeltDecodeError
            ),
            "got {:?}",
            out.frame_outcomes[0].status
        );
        assert_eq!(out.pcm.len(), 960);
    }

    #[test]
    fn celt_tf_spread_allocation_advances_tell_past_coarse_energy() {
        // Direct exercise of the §4.3.1 TF + §4.3.4.3 spread + §4.3.3
        // allocation-header decoder: it must advance the range coder
        // strictly past where the §4.3.2.1 coarse energy left it (the
        // tf_change / spread / boost symbols consume real bits), and it
        // must not panic or report a caller-side bookkeeping error for a
        // well-formed band window.
        use crate::celt_band_layout::{celt_end_coded_band, celt_first_coded_band, CeltFrameSize};
        use crate::celt_coarse_energy::CoarseEnergyState;
        use crate::celt_frame_prefix::decode_celt_frame_prefix;
        use crate::range_decoder::RangeDecoder;

        let body: [u8; 14] = [
            0x40, 0x91, 0x37, 0xc4, 0x6e, 0x2d, 0xa8, 0x5b, 0xf1, 0x0c, 0x93, 0x47, 0xbe, 0x21,
        ];
        let mut rd = RangeDecoder::new(&body);
        let prefix = decode_celt_frame_prefix(&mut rd);
        // The chosen first byte must not select silence for this test to
        // be meaningful; assert it so a table change can't silently void
        // the assertion.
        assert!(!prefix.silence, "test body must be non-silent");

        let celt_size = CeltFrameSize::Ms20;
        let start = celt_first_coded_band(false);
        let end = celt_end_coded_band();

        let mut coarse = CoarseEnergyState::new();
        coarse
            .decode_frame(&mut rd, celt_size, prefix.intra, start, end)
            .expect("coarse energy decodes");
        let tell_after_coarse = rd.tell_frac();

        let (tf, spread) = OpusDecoder::decode_celt_tf_spread_allocation(
            &mut rd,
            celt_size,
            prefix.transient,
            1,
            start,
            end,
            body.len() as u32,
        )
        .expect("tf/spread/allocation header decodes without a bookkeeping error");
        let tell_after_alloc = rd.tell_frac();

        // The TF decode produces one tf_change per coded band; the spread
        // symbol is one of the four §4.3.4.3 values.
        assert_eq!(tf.tf_change.len(), end - start);
        assert!(spread <= crate::celt_spreading::SPREAD_MAX);

        // The TF + spread + band-boost symbols all read real bits, so the
        // tell must strictly advance past where coarse energy left it.
        assert!(
            tell_after_alloc > tell_after_coarse,
            "alloc tell {tell_after_alloc} must advance past coarse tell {tell_after_coarse}"
        );
    }
}