Q-W1 pt2: core/shell/app relocation + sub-namespaces; one concrete ui::Rect (LTRB fork retired); slot_map split from bank_book; BankIndex→BankModel; 59/59 green
This commit is contained in:
@@ -0,0 +1,233 @@
|
||||
// sample_usage.cpp — see sample_usage.h. Pure: standard library only.
|
||||
|
||||
#include "core/wire/sample_usage.h"
|
||||
|
||||
#include <cctype>
|
||||
|
||||
#include "core/wire/wire.h"
|
||||
|
||||
namespace reasampler::wire {
|
||||
|
||||
namespace {
|
||||
|
||||
constexpr const char* kMagic = "rsusage1";
|
||||
|
||||
// The shared core/wire codec (Q-W1, T2-01b) — one grammar across every
|
||||
// ext-state seam. The former local fieldCount (10-digit cap) is subsumed by the
|
||||
// codec's fieldSizeT (20-digit cap + overflow-guarded accumulate): every count
|
||||
// the old cap accepted decodes identically, and any larger count is rejected by
|
||||
// the count-vs-wire-size sanity bound at the call site below.
|
||||
using wire::putField;
|
||||
using Cursor = wire::Cursor;
|
||||
|
||||
} // namespace
|
||||
|
||||
std::string encodeUsageRecord(const UsageRecord& rec) {
|
||||
std::string out = kMagic;
|
||||
putField(out, rec.trackGuid);
|
||||
putField(out, rec.ownerNonce);
|
||||
putField(out, rec.unioned ? "1" : "0");
|
||||
putField(out, std::to_string(rec.holds.size()));
|
||||
for (const UsageHold& h : rec.holds) {
|
||||
putField(out, h.sampleId);
|
||||
putField(out, h.relativePath);
|
||||
}
|
||||
return out;
|
||||
}
|
||||
|
||||
std::optional<UsageRecord> decodeUsageRecord(const std::string& wire) {
|
||||
Cursor c(wire);
|
||||
if (!c.literal(kMagic)) return std::nullopt;
|
||||
UsageRecord rec;
|
||||
if (!c.field(rec.trackGuid)) return std::nullopt;
|
||||
if (!c.field(rec.ownerNonce)) return std::nullopt;
|
||||
std::string unionedField;
|
||||
if (!c.field(unionedField)) return std::nullopt;
|
||||
if (unionedField == "1") rec.unioned = true;
|
||||
else if (unionedField == "0") rec.unioned = false;
|
||||
else return std::nullopt; // anything else is corruption -> reject whole
|
||||
std::size_t count = 0;
|
||||
if (!c.fieldSizeT(count)) return std::nullopt;
|
||||
// Each hold needs at least 4 wire bytes ("0:0:"), so a count past wire.size()/4 is
|
||||
// provably bogus — reject before looping rather than iterating a crafted huge count.
|
||||
if (count > wire.size() / 4u + 1u) return std::nullopt;
|
||||
rec.holds.reserve(count);
|
||||
for (std::size_t i = 0; i < count; ++i) {
|
||||
UsageHold h;
|
||||
if (!c.field(h.sampleId)) return std::nullopt;
|
||||
if (!c.field(h.relativePath)) return std::nullopt;
|
||||
rec.holds.push_back(std::move(h));
|
||||
}
|
||||
if (!c.ok() || !c.atEnd()) return std::nullopt; // trailing garbage -> reject whole
|
||||
return rec;
|
||||
}
|
||||
|
||||
UsagePublishPlan planUsagePublish(const std::optional<std::string>& existing,
|
||||
const UsageRecord& mine) {
|
||||
UsagePublishPlan plan;
|
||||
// The written form of "just mine": mine's identity + holds, unioned=false (the plan
|
||||
// computes the flag; a sole-writer record is un-poisoned).
|
||||
UsageRecord cleanMine = mine;
|
||||
cleanMine.unioned = false;
|
||||
plan.wire = encodeUsageRecord(cleanMine);
|
||||
|
||||
if (!existing || existing->empty()) {
|
||||
// Fresh key — write mine.
|
||||
return plan;
|
||||
}
|
||||
const std::optional<UsageRecord> theirs = decodeUsageRecord(*existing);
|
||||
if (!theirs) {
|
||||
// Undecodable existing value under MY key: corruption (a sibling sharing
|
||||
// this key via copy always writes decodable records). REMINT rather than
|
||||
// overwrite: writing mine over the corrupt key would clear the prune-side
|
||||
// abort, but a same-key sibling B's holds would then be unprotected until
|
||||
// B publishes again. Leaving the corrupt key in place keeps the prune-side
|
||||
// abort firing (foldUsageRecords.abortPrune) so the window where B's holds
|
||||
// might be unprotected can never resolve toward delete. Mine is published
|
||||
// under the new key that remint produces.
|
||||
// NOTE (>16 MB gap): readReasamplerExtState returning nullopt for a value
|
||||
// larger than 16 MB is indistinguishable from "absent" at the publish site;
|
||||
// that narrow case takes the fresh-write branch above rather than remint.
|
||||
// Both outcomes are safe (fresh write is also correct for a truly absent key);
|
||||
// the gap is documented in the header's fail-safe list.
|
||||
plan.remint = true;
|
||||
return plan;
|
||||
}
|
||||
|
||||
const bool nonceMatch =
|
||||
!mine.ownerNonce.empty() && theirs->ownerNonce == mine.ownerNonce;
|
||||
|
||||
if (nonceMatch && !theirs->unioned) {
|
||||
// Exactly THIS incarnation wrote the key (the per-lifetime nonce is the exact
|
||||
// ownership proof — a same-track sibling's byte-identical hold set can NOT pass
|
||||
// this test, its nonce differs) AND no other writer has ever unioned into it,
|
||||
// so the content is provably all mine. Clean replace: released holds drop.
|
||||
if (plan.wire == *existing) plan.skipWrite = true; // idle reload tick
|
||||
return plan;
|
||||
}
|
||||
|
||||
if (theirs->trackGuid == mine.trackGuid || (nonceMatch && theirs->unioned)) {
|
||||
// A foreign writer on MY OWN track (a same-track copy-sibling, or my own
|
||||
// last-session record — indistinguishable by construction), or a record I
|
||||
// wrote last but that carries unioned holds from an earlier multi-writer
|
||||
// merge. Either way no hold in it may be dropped by me — union, existing-
|
||||
// first, de-duped, and the record is (or stays) POISONED unioned=true so no
|
||||
// future nonce-matching write can clean-replace a sibling's holds away.
|
||||
UsageRecord merged;
|
||||
merged.trackGuid = mine.trackGuid;
|
||||
merged.ownerNonce = mine.ownerNonce;
|
||||
merged.unioned = true;
|
||||
merged.holds = theirs->holds;
|
||||
for (const UsageHold& h : mine.holds) {
|
||||
bool dup = false;
|
||||
for (const UsageHold& e : merged.holds) {
|
||||
if (e == h) { dup = true; break; }
|
||||
}
|
||||
if (!dup) merged.holds.push_back(h);
|
||||
}
|
||||
if (theirs->unioned && merged.holds == theirs->holds) {
|
||||
// Already poisoned and the union adds nothing — the write would flip only
|
||||
// the ownerNonce. Skip the redundant ext-state churn. (A false->true
|
||||
// unioned flip is NEVER skipped: it is the poison that protects the other
|
||||
// writer's holds from the last writer's future clean replace.)
|
||||
plan.skipWrite = true;
|
||||
}
|
||||
plan.wire = encodeUsageRecord(merged);
|
||||
return plan;
|
||||
}
|
||||
|
||||
// Foreign value from ANOTHER track: this instance is a cross-track copy (or was
|
||||
// moved). Take a fresh identity; never overwrite the other's record.
|
||||
plan.remint = true;
|
||||
return plan;
|
||||
}
|
||||
|
||||
std::vector<std::string> usageHeldPaths(
|
||||
const std::vector<UsageRecord>& records,
|
||||
const std::unordered_set<std::string>& liveTrackGuids,
|
||||
bool anyInstanceLive) {
|
||||
std::vector<std::string> out;
|
||||
std::unordered_set<std::string> seen;
|
||||
// FAIL-SAFE NET: records exist but not one instance was identified live anywhere —
|
||||
// indistinguishable from an identity-matcher failure, so protect EVERY record's
|
||||
// paths rather than none (zero-identified must never degrade toward delete).
|
||||
const bool protectAll = !records.empty() && !anyInstanceLive;
|
||||
for (const UsageRecord& rec : records) {
|
||||
const bool live = protectAll ||
|
||||
(rec.trackGuid.empty()
|
||||
? anyInstanceLive
|
||||
: (liveTrackGuids.count(rec.trackGuid) != 0));
|
||||
if (!live) continue;
|
||||
for (const UsageHold& h : rec.holds) {
|
||||
if (h.relativePath.empty()) continue;
|
||||
if (seen.insert(h.relativePath).second) out.push_back(h.relativePath);
|
||||
}
|
||||
}
|
||||
return out;
|
||||
}
|
||||
|
||||
UsageFoldResult foldUsageRecords(
|
||||
const std::vector<std::optional<UsageRecord>>& decoded,
|
||||
const std::unordered_set<std::string>& liveTrackGuids,
|
||||
bool anyInstanceLive) {
|
||||
UsageFoldResult result;
|
||||
std::vector<UsageRecord> records;
|
||||
records.reserve(decoded.size());
|
||||
for (const std::optional<UsageRecord>& rec : decoded) {
|
||||
if (!rec) {
|
||||
// A present-but-unreadable record: it may protect ANYTHING, so the prune
|
||||
// must halt outright. Belt-and-braces: return the PROTECT-ALL set (all
|
||||
// readable records' paths) so the fail-safe holds even under a future
|
||||
// caller that forgets to check abortPrune before using heldPaths. The
|
||||
// abort flag is still the authoritative signal; heldPaths is the
|
||||
// maximum-protection fallback.
|
||||
result.abortPrune = true;
|
||||
// Collect EVERY path from EVERY readable record, bypassing the liveness
|
||||
// filter entirely (on abort the protected set is unknowable, so every
|
||||
// decoded hold must be included regardless of track-guid membership).
|
||||
std::unordered_set<std::string> seen;
|
||||
for (const std::optional<UsageRecord>& r : decoded) {
|
||||
if (!r) continue;
|
||||
for (const UsageHold& h : r->holds) {
|
||||
if (h.relativePath.empty()) continue;
|
||||
if (seen.insert(h.relativePath).second)
|
||||
result.heldPaths.push_back(h.relativePath);
|
||||
}
|
||||
}
|
||||
return result;
|
||||
}
|
||||
records.push_back(*rec);
|
||||
}
|
||||
result.heldPaths = usageHeldPaths(records, liveTrackGuids, anyInstanceLive);
|
||||
return result;
|
||||
}
|
||||
|
||||
std::string toUpperAscii(const std::string& s) {
|
||||
std::string out = s;
|
||||
for (char& c : out)
|
||||
c = static_cast<char>(std::toupper(static_cast<unsigned char>(c)));
|
||||
return out;
|
||||
}
|
||||
|
||||
bool identityMatches(const std::string& identity, const std::string& uidHexUpper,
|
||||
const std::string& nameUpper,
|
||||
const std::string& outputNameUpper) {
|
||||
if (identity.empty()) return false;
|
||||
const std::string up = toUpperAscii(identity);
|
||||
// Primary: the 32-hex class UID embedded in REAPER's fx_ident rendering. Not
|
||||
// guaranteed on every platform/REAPER build (byte-order of the rendered FUID vs
|
||||
// REAPER's hex is unverified on Windows COM layout), hence the two name nets below
|
||||
// — and the protect-all fold above them (see usageHeldPaths).
|
||||
if (!uidHexUpper.empty() && up.find(uidHexUpper) != std::string::npos) return true;
|
||||
// The module filename base ("REASAMPLER_9000") — fx_ident carries the .vst3 module
|
||||
// path, so this is the alternative that works in the common case (the display name
|
||||
// "REASAMPLER 9000", space-separated, can never match the filename form).
|
||||
if (!outputNameUpper.empty() && up.find(outputNameUpper) != std::string::npos)
|
||||
return true;
|
||||
// The factory display name — matches original_name / renamed-instance renderings.
|
||||
// Beta-substring over-protect is deliberate (see the header note): stable needles
|
||||
// are substrings of beta ones, widening protection only — never a delete.
|
||||
return !nameUpper.empty() && up.find(nameUpper) != std::string::npos;
|
||||
}
|
||||
|
||||
} // namespace reasampler::wire
|
||||
Reference in New Issue
Block a user