formats: add safe dat codecs

Cargo.lock

@@ -0,0 +1,7 @@
+# This file is automatically @generated by Cargo.
+# It is not intended for manual editing.
+version = 4
+
+[[package]]
+name = "mb3-dat"
+version = "0.1.0"

Cargo.toml

@@ -0,0 +1,13 @@
+[workspace]
+members = ["crates/mb3-dat"]
+resolver = "3"
+
+[workspace.package]
+edition = "2024"
+rust-version = "1.85"
+
+[workspace.lints.rust]
+unsafe_code = "forbid"
+
+[workspace.lints.clippy]
+all = "warn"

README.md

@@ -64,3 +64,9 @@ See [setup validation](docs/SETUP.md) for the implementation, checks, and remain
 `map-references` verifies the recovered inputs and regenerates the Xet-backed static source map plus the Core/tool Markdown indexes. `check-reference-map` checks that they are reproducible and current. No original compiler or executable runs. Start with [formats](docs/FORMATS.md), [host APIs](docs/HOST_APIS.md), [plugins](docs/PLUGINS.md), [dependencies](docs/DEPENDENCIES.md), and the [coverage ledger](docs/parity.md). The separate [converter investigation](docs/CONVERTER.md) now runs unchanged converters under Mono; native editor behavior remains unverified.
 
 `analyze-converter decompile|probes|check` reproduces the managed converter evidence and 101 controlled probes. `inspect-mb3dat <file>` safely inspects either recovered DAT version. These research tools, including pinned Mono/ILSpy, are in the Nix shell; captures/decompilations remain Xet assets. See [E02](docs/experiments/converter-2026-10-21.md) and the [binary contract](docs/MB3_DAT.md).
+
+## Rust DAT codec
+
+`crates/mb3-dat` provides dependency-free bounded readers/writers for both recovered DAT versions. Run `cargo test --workspace --locked --offline` inside `nix develop` after hydrating and verifying the converter fixtures (`analyze-converter check`). All 58 captured DAT outputs are tested for exact byte round trips. See [API, compatibility and limits](docs/RUST_DAT.md).
+
+The asset-free Nix check `nix build .#checks.aarch64-darwin.rust --no-link` runs formatting, Clippy, unit tests and doctests; full converter integration tests require Xet assets.

crates/mb3-dat/Cargo.toml

@@ -0,0 +1,10 @@
+[package]
+name = "mb3-dat"
+version = "0.1.0"
+description = "Bounded readers and writers for the two recovered Microbrush 3 DAT formats"
+edition.workspace = true
+rust-version.workspace = true
+publish = false
+
+[lints]
+workspace = true

crates/mb3-dat/src/codec.rs

@@ -0,0 +1,767 @@
+use crate::*;
+use std::fmt;
+use std::io::{self, Read, Write};
+use std::mem::size_of;
+
+/// Application policy limits, not maxima inferred from the legacy format.
+#[derive(Clone, Copy, Debug)]
+pub struct Limits {
+    /// Maximum complete input or encoded output, including the header.
+    pub max_bytes: usize,
+    /// Maximum bytes in any individual ASCII name or value, excluding NUL.
+    pub max_string_bytes: usize,
+    /// Aggregate names, brushes, planes, properties, patches and vec3 elements.
+    pub max_items: usize,
+    /// Decoder's aggregate requested owned storage, excluding allocator overhead
+    /// and the input buffer. Includes record slots and string payloads.
+    pub max_owned_bytes: usize,
+}
+
+impl Default for Limits {
+    fn default() -> Self {
+        Self {
+            max_bytes: 64 * 1024 * 1024,
+            max_string_bytes: 1024 * 1024,
+            max_items: 1_000_000,
+            max_owned_bytes: 128 * 1024 * 1024,
+        }
+    }
+}
+
+#[derive(Debug)]
+#[non_exhaustive]
+pub enum ErrorKind {
+    Io(io::Error),
+    UnexpectedEof,
+    InvalidMagic,
+    UnsupportedVersion(u32),
+    InvalidFlags(u8),
+    ReservedWidth,
+    NegativeCount,
+    CountOverflow,
+    LimitExceeded(&'static str),
+    Allocation,
+    NonAscii,
+    EmbeddedNul,
+    UnterminatedString,
+    NonFinite,
+    PropertyIndex(u32),
+    DuplicateProperty(u32),
+    UnsortedProperties,
+    InconsistentComputedData,
+    InvalidPatchLength,
+    LegacyProperties,
+    TrailingData,
+}
+
+#[derive(Debug)]
+pub struct Error {
+    /// Byte offset in the input, encoded output, or completed I/O prefix.
+    pub offset: usize,
+    pub kind: ErrorKind,
+}
+
+impl fmt::Display for Error {
+    fn fmt(&self, f: &mut fmt::Formatter<'_>) -> fmt::Result {
+        write!(f, "MB3 DAT at byte {}: {:?}", self.offset, self.kind)
+    }
+}
+
+impl std::error::Error for Error {
+    fn source(&self) -> Option<&(dyn std::error::Error + 'static)> {
+        match &self.kind {
+            ErrorKind::Io(e) => Some(e),
+            _ => None,
+        }
+    }
+}
+
+type Result<T> = std::result::Result<T, Error>;
+
+fn err(offset: usize, kind: ErrorKind) -> Error {
+    Error { offset, kind }
+}
+
+#[derive(Default)]
+struct Budget {
+    items: usize,
+    owned: usize,
+}
+
+impl Budget {
+    fn items(&mut self, n: usize, limits: &Limits, at: usize) -> Result<()> {
+        self.items = self
+            .items
+            .checked_add(n)
+            .ok_or_else(|| err(at, ErrorKind::CountOverflow))?;
+        if self.items > limits.max_items {
+            return Err(err(at, ErrorKind::LimitExceeded("aggregate items")));
+        }
+        Ok(())
+    }
+
+    fn bytes(&mut self, n: usize, limits: &Limits, at: usize) -> Result<()> {
+        self.owned = self
+            .owned
+            .checked_add(n)
+            .ok_or_else(|| err(at, ErrorKind::CountOverflow))?;
+        if self.owned > limits.max_owned_bytes {
+            return Err(err(at, ErrorKind::LimitExceeded("owned storage")));
+        }
+        Ok(())
+    }
+
+    fn claim<T>(&mut self, n: usize, limits: &Limits, at: usize) -> Result<()> {
+        self.items(n, limits, at)?;
+        self.bytes(
+            n.checked_mul(size_of::<T>())
+                .ok_or_else(|| err(at, ErrorKind::CountOverflow))?,
+            limits,
+            at,
+        )
+    }
+}
+
+#[derive(Clone, Copy)]
+struct Width(u8);
+
+impl Width {
+    fn from_bits(bits: u8, at: usize) -> Result<Self> {
+        if bits == 3 {
+            Err(err(at, ErrorKind::ReservedWidth))
+        } else {
+            Ok(Self(bits))
+        }
+    }
+
+    fn for_max(n: usize, version: Version, at: usize) -> Result<Self> {
+        if n > i32::MAX as usize {
+            return Err(err(at, ErrorKind::CountOverflow));
+        }
+        Ok(Self(if n <= 255 {
+            0
+        } else if n
+            <= if version == Version::V201501280 {
+                32767
+            } else {
+                65535
+            }
+        {
+            1
+        } else {
+            2
+        }))
+    }
+
+    fn bytes(self) -> usize {
+        [1, 2, 4][self.0 as usize]
+    }
+
+    fn sentinel(self) -> u32 {
+        [255, 65535, u32::MAX][self.0 as usize]
+    }
+}
+
+struct Decoder<'a> {
+    data: &'a [u8],
+    pos: usize,
+    limits: &'a Limits,
+    budget: Budget,
+    version: Version,
+}
+
+impl<'a> Decoder<'a> {
+    fn take(&mut self, n: usize) -> Result<&'a [u8]> {
+        if n > self.data.len() - self.pos {
+            return Err(err(self.pos, ErrorKind::UnexpectedEof));
+        }
+        let start = self.pos;
+        self.pos += n;
+        Ok(&self.data[start..self.pos])
+    }
+
+    fn byte(&mut self) -> Result<u8> {
+        Ok(self.take(1)?[0])
+    }
+
+    fn raw(&mut self, width: Width) -> Result<u32> {
+        let mut bytes = [0; 4];
+        bytes[..width.bytes()].copy_from_slice(self.take(width.bytes())?);
+        Ok(u32::from_le_bytes(bytes))
+    }
+
+    fn count(&mut self, width: Width) -> Result<usize> {
+        let at = self.pos;
+        let n = self.raw(width)?;
+        if (width.0 == 2 && n > i32::MAX as u32)
+            || (width.0 == 1 && self.version == Version::V201501280 && n > i16::MAX as u32)
+        {
+            return Err(err(at, ErrorKind::NegativeCount));
+        }
+        Ok(n as usize)
+    }
+
+    fn reserve<T>(&mut self, n: usize, minimum_wire_bytes: usize) -> Result<Vec<T>> {
+        if n > (self.data.len() - self.pos) / minimum_wire_bytes.max(1) {
+            return Err(err(self.pos, ErrorKind::UnexpectedEof));
+        }
+        self.budget.claim::<T>(n, self.limits, self.pos)?;
+        let mut out = Vec::new();
+        out.try_reserve_exact(n)
+            .map_err(|_| err(self.pos, ErrorKind::Allocation))?;
+        Ok(out)
+    }
+
+    fn push<T>(&mut self, out: &mut Vec<T>, item: T, maximum: usize) -> Result<()> {
+        self.budget.items(1, self.limits, self.pos)?;
+        if out.len() == out.capacity() {
+            let capacity = out.capacity().saturating_mul(2).max(1).min(maximum);
+            let bytes = (capacity - out.capacity())
+                .checked_mul(size_of::<T>())
+                .ok_or_else(|| err(self.pos, ErrorKind::CountOverflow))?;
+            self.budget.bytes(bytes, self.limits, self.pos)?;
+            out.try_reserve_exact(capacity - out.len())
+                .map_err(|_| err(self.pos, ErrorKind::Allocation))?;
+        }
+        out.push(item);
+        Ok(())
+    }
+
+    fn string(&mut self) -> Result<String> {
+        let at = self.pos;
+        let remaining = &self.data[at..];
+        let n = remaining
+            .iter()
+            .take(self.limits.max_string_bytes.saturating_add(1))
+            .position(|b| *b == 0)
+            .ok_or_else(|| {
+                err(
+                    at,
+                    if remaining.len() > self.limits.max_string_bytes {
+                        ErrorKind::LimitExceeded("string bytes")
+                    } else {
+                        ErrorKind::UnterminatedString
+                    },
+                )
+            })?;
+        let raw = self.take(n + 1)?;
+        if !raw[..n].is_ascii() {
+            return Err(err(at, ErrorKind::NonAscii));
+        }
+        self.budget.bytes(n, self.limits, at)?;
+        let mut value = String::new();
+        value
+            .try_reserve_exact(n)
+            .map_err(|_| err(at, ErrorKind::Allocation))?;
+        value.push_str(std::str::from_utf8(&raw[..n]).map_err(|_| err(at, ErrorKind::NonAscii))?);
+        Ok(value)
+    }
+
+    fn table(&mut self, width: Width) -> Result<Vec<String>> {
+        let n = self.count(width)?;
+        let mut out = self.reserve(n, 1)?;
+        for _ in 0..n {
+            out.push(self.string()?);
+        }
+        Ok(out)
+    }
+
+    fn float(&mut self) -> Result<f32> {
+        let at = self.pos;
+        let value = f32::from_bits(self.raw(Width(2))?);
+        if !value.is_finite() {
+            return Err(err(at, ErrorKind::NonFinite));
+        }
+        Ok(value)
+    }
+
+    fn vector(&mut self) -> Result<Vec3> {
+        Ok([self.float()?, self.float()?, self.float()?])
+    }
+
+    fn vectors(&mut self, n: usize) -> Result<Vec<Vec3>> {
+        let mut out = self.reserve(n, 12)?;
+        for _ in 0..n {
+            out.push(self.vector()?);
+        }
+        Ok(out)
+    }
+
+    fn uv(&mut self) -> Result<Uv> {
+        Ok(Uv {
+            u: self.vector()?,
+            v: self.vector()?,
+            u_scale: self.float()?,
+            u_shift: self.float()?,
+            v_scale: self.float()?,
+            v_shift: self.float()?,
+        })
+    }
+
+    fn properties<T>(
+        &mut self,
+        names: usize,
+        width: Width,
+        mut value: impl FnMut(&mut Self) -> Result<T>,
+    ) -> Result<Vec<Property<T>>> {
+        let mut out = Vec::new();
+        if names == 0 {
+            return Ok(out);
+        }
+        loop {
+            let at = self.pos;
+            let index = self.raw(width)?;
+            if index == width.sentinel() {
+                break;
+            }
+            if index as usize >= names {
+                return Err(err(at, ErrorKind::PropertyIndex(index)));
+            }
+            if out.len() >= names {
+                return Err(err(at, ErrorKind::DuplicateProperty(index)));
+            }
+            let entry = Property {
+                index,
+                value: value(self)?,
+            };
+            self.push(&mut out, entry, names)?;
+        }
+        out.sort_unstable_by_key(|p| p.index);
+        for pair in out.windows(2) {
+            if pair[0].index == pair[1].index {
+                return Err(err(self.pos, ErrorKind::DuplicateProperty(pair[0].index)));
+            }
+        }
+        Ok(out)
+    }
+
+    fn brush(&mut self, world: &World, sw: Width, uw: Width) -> Result<Brush> {
+        let at = self.pos;
+        let flags = self.byte()?;
+        if flags & 0xf0 != 0 {
+            return Err(err(at, ErrorKind::InvalidFlags(flags)));
+        }
+        let pw = Width::from_bits(flags & 3, at)?;
+        let vw = Width::from_bits((flags >> 2) & 3, at)?;
+        let n = self.count(pw)?;
+        let mut planes = self.reserve(n, 36)?;
+        for _ in 0..n {
+            let strings = self.properties(world.string_properties.len(), sw, Self::string)?;
+            let uv = self.properties(world.uv_properties.len(), uw, Self::uv)?;
+            let p0 = self.vector()?;
+            let u = self.vector()?;
+            let v = self.vector()?;
+            let polygon = if world.computed {
+                let n = self.count(vw)?;
+                Some(self.vectors(n)?)
+            } else {
+                None
+            };
+            planes.push(Plane {
+                p0,
+                u,
+                v,
+                strings,
+                uv,
+                polygon,
+            });
+        }
+        Ok(Brush { planes })
+    }
+
+    fn patch(&mut self, computed: bool) -> Result<Patch9> {
+        let at = self.pos;
+        let flags = self.byte()?;
+        if flags & 0xf0 != 0 {
+            return Err(err(at, ErrorKind::InvalidFlags(flags)));
+        }
+        let aw = Width::from_bits(flags & 3, at)?;
+        let qw = Width::from_bits((flags >> 2) & 3, at)?;
+        let au = self.count(aw)?;
+        let av = self.count(aw)?;
+        let qu = self.count(qw)?;
+        let qv = self.count(qw)?;
+        let n = product(au, av, at)?;
+        let anchors = self.vectors(n)?;
+        let computed = if computed {
+            let n = grid_size(au, av, qu, qv, at)?;
+            Some(PatchComputed {
+                points: self.vectors(n)?,
+                normals: self.vectors(n)?,
+            })
+        } else {
+            None
+        };
+        Ok(Patch9 {
+            anchors_u: au as u32,
+            anchors_v: av as u32,
+            quads_u: qu as u32,
+            quads_v: qv as u32,
+            anchors,
+            computed,
+        })
+    }
+}
+
+fn product(a: usize, b: usize, at: usize) -> Result<usize> {
+    a.checked_mul(b)
+        .ok_or_else(|| err(at, ErrorKind::CountOverflow))
+}
+
+fn grid_size(au: usize, av: usize, qu: usize, qv: usize, at: usize) -> Result<usize> {
+    let u = product(au / 2, qu, at)?
+        .checked_add(1)
+        .ok_or_else(|| err(at, ErrorKind::CountOverflow))?;
+    let v = product(av / 2, qv, at)?
+        .checked_add(1)
+        .ok_or_else(|| err(at, ErrorKind::CountOverflow))?;
+    product(u, v, at)
+}
+
+/// Decode one complete document. Unknown bits, selector 3, non-ASCII strings,
+/// duplicate slots, non-finite floats and trailing bytes are rejected.
+pub fn decode(data: &[u8], limits: &Limits) -> Result<Document> {
+    if data.len() > limits.max_bytes {
+        return Err(err(0, ErrorKind::LimitExceeded("file bytes")));
+    }
+    let mut r = Decoder {
+        data,
+        pos: 0,
+        limits,
+        budget: Budget::default(),
+        version: Version::V201512200,
+    };
+    if r.take(8)? != b"Mb3World" {
+        return Err(err(0, ErrorKind::InvalidMagic));
+    }
+    r.version = match r.raw(Width(2))? {
+        201501280 => Version::V201501280,
+        201512200 => Version::V201512200,
+        n => return Err(err(8, ErrorKind::UnsupportedVersion(n))),
+    };
+    let flags = r.byte()?;
+    let old = r.version == Version::V201501280;
+    if (old && flags > 1) || (!old && flags & 0xe0 != 0) {
+        return Err(err(12, ErrorKind::InvalidFlags(flags)));
+    }
+    let sw = Width::from_bits(if old { 0 } else { (flags >> 1) & 3 }, 12)?;
+    let uw = Width::from_bits(if old { 0 } else { (flags >> 3) & 3 }, 12)?;
+    let mut world = World {
+        computed: flags & 1 != 0,
+        ..World::default()
+    };
+    if !old {
+        world.string_properties = r.table(sw)?;
+        world.uv_properties = r.table(uw)?;
+    }
+    let brushes = r.count(Width(2))?;
+    let patches = if old { Some(r.count(Width(2))?) } else { None };
+    world.brushes = r.reserve(brushes, 2)?;
+    for _ in 0..brushes {
+        let brush = r.brush(&world, sw, uw)?;
+        world.brushes.push(brush);
+    }
+    let patches = match patches {
+        Some(n) => n,
+        None => r.count(Width(2))?,
+    };
+    world.patches = r.reserve(patches, 5)?;
+    for _ in 0..patches {
+        world.patches.push(r.patch(world.computed)?);
+    }
+    if r.pos != data.len() {
+        return Err(err(r.pos, ErrorKind::TrailingData));
+    }
+    Ok(Document {
+        version: r.version,
+        world,
+    })
+}
+
+// Growth stays within the wire-byte limit and uses fallible allocation.
+fn append(out: &mut Vec<u8>, bytes: &[u8], limit: usize) -> Result<()> {
+    let at = out.len();
+    let n = at
+        .checked_add(bytes.len())
+        .ok_or_else(|| err(at, ErrorKind::CountOverflow))?;
+    if n > limit {
+        return Err(err(at, ErrorKind::LimitExceeded("file bytes")));
+    }
+    if n > out.capacity() {
+        let capacity = n.max(out.capacity().saturating_mul(2)).min(limit);
+        out.try_reserve_exact(capacity - at)
+            .map_err(|_| err(at, ErrorKind::Allocation))?;
+    }
+    out.extend_from_slice(bytes);
+    Ok(())
+}
+
+struct Encoder<'a> {
+    data: Vec<u8>,
+    limits: &'a Limits,
+    budget: Budget,
+    version: Version,
+}
+
+impl Encoder<'_> {
+    fn bytes(&mut self, bytes: &[u8]) -> Result<()> {
+        append(&mut self.data, bytes, self.limits.max_bytes)
+    }
+
+    fn byte(&mut self, value: u8) -> Result<()> {
+        self.bytes(&[value])
+    }
+
+    fn raw(&mut self, value: u32, width: Width) -> Result<()> {
+        self.bytes(&value.to_le_bytes()[..width.bytes()])
+    }
+
+    fn count(&mut self, value: usize, width: Width) -> Result<()> {
+        let max = match width.0 {
+            0 => 255,
+            1 if self.version == Version::V201501280 => 32767,
+            1 => 65535,
+            _ => i32::MAX as usize,
+        };
+        if value > max {
+            return Err(err(self.data.len(), ErrorKind::CountOverflow));
+        }
+        self.raw(value as u32, width)
+    }
+
+    fn items(&mut self, n: usize) -> Result<()> {
+        self.budget.items(n, self.limits, self.data.len())
+    }
+
+    fn string(&mut self, s: &str) -> Result<()> {
+        let at = self.data.len();
+        if s.len() > self.limits.max_string_bytes {
+            return Err(err(at, ErrorKind::LimitExceeded("string bytes")));
+        }
+        if !s.is_ascii() {
+            return Err(err(at, ErrorKind::NonAscii));
+        }
+        if s.as_bytes().contains(&0) {
+            return Err(err(at, ErrorKind::EmbeddedNul));
+        }
+        self.bytes(s.as_bytes())?;
+        self.byte(0)
+    }
+
+    fn table(&mut self, names: &[String], width: Width) -> Result<()> {
+        self.items(names.len())?;
+        self.count(names.len(), width)?;
+        for name in names {
+            self.string(name)?;
+        }
+        Ok(())
+    }
+
+    fn float(&mut self, value: f32) -> Result<()> {
+        if !value.is_finite() {
+            return Err(err(self.data.len(), ErrorKind::NonFinite));
+        }
+        self.bytes(&value.to_le_bytes())
+    }
+
+    fn vector(&mut self, value: &Vec3) -> Result<()> {
+        for f in value {
+            self.float(*f)?;
+        }
+        Ok(())
+    }
+
+    fn vectors(&mut self, values: &[Vec3]) -> Result<()> {
+        self.items(values.len())?;
+        for value in values {
+            self.vector(value)?;
+        }
+        Ok(())
+    }
+
+    fn uv(&mut self, value: &Uv) -> Result<()> {
+        self.vector(&value.u)?;
+        self.vector(&value.v)?;
+        for f in [value.u_scale, value.u_shift, value.v_scale, value.v_shift] {
+            self.float(f)?;
+        }
+        Ok(())
+    }
+
+    fn properties<T>(
+        &mut self,
+        values: &[Property<T>],
+        names: usize,
+        width: Width,
+        mut write: impl FnMut(&mut Self, &T) -> Result<()>,
+    ) -> Result<()> {
+        self.items(values.len())?;
+        let mut previous = None;
+        for p in values {
+            if p.index as usize >= names {
+                return Err(err(self.data.len(), ErrorKind::PropertyIndex(p.index)));
+            }
+            if previous == Some(p.index) {
+                return Err(err(self.data.len(), ErrorKind::DuplicateProperty(p.index)));
+            }
+            if previous.is_some_and(|n| n > p.index) {
+                return Err(err(self.data.len(), ErrorKind::UnsortedProperties));
+            }
+            previous = Some(p.index);
+            self.raw(p.index, width)?;
+            write(self, &p.value)?;
+        }
+        if names != 0 {
+            self.raw(width.sentinel(), width)?;
+        }
+        Ok(())
+    }
+
+    fn brush(&mut self, brush: &Brush, world: &World, sw: Width, uw: Width) -> Result<()> {
+        let at = self.data.len();
+        self.items(brush.planes.len())?;
+        let pw = Width::for_max(brush.planes.len(), self.version, at)?;
+        let mut largest = 0;
+        for plane in &brush.planes {
+            if plane.polygon.is_some() != world.computed {
+                return Err(err(at, ErrorKind::InconsistentComputedData));
+            }
+            largest = largest.max(plane.polygon.as_ref().map_or(0, Vec::len));
+        }
+        let vw = Width::for_max(largest, self.version, at)?;
+        self.byte(pw.0 | vw.0 << 2)?;
+        self.count(brush.planes.len(), pw)?;
+        for plane in &brush.planes {
+            if self.version == Version::V201501280
+                && (!plane.strings.is_empty() || !plane.uv.is_empty())
+            {
+                return Err(err(self.data.len(), ErrorKind::LegacyProperties));
+            }
+            self.properties(&plane.strings, world.string_properties.len(), sw, |e, s| {
+                e.string(s)
+            })?;
+            self.properties(&plane.uv, world.uv_properties.len(), uw, Self::uv)?;
+            self.vector(&plane.p0)?;
+            self.vector(&plane.u)?;
+            self.vector(&plane.v)?;
+            if let Some(polygon) = &plane.polygon {
+                self.count(polygon.len(), vw)?;
+                self.vectors(polygon)?;
+            }
+        }
+        Ok(())
+    }
+
+    fn patch(&mut self, patch: &Patch9, computed: bool) -> Result<()> {
+        let at = self.data.len();
+        if patch.computed.is_some() != computed {
+            return Err(err(at, ErrorKind::InconsistentComputedData));
+        }
+        let au = patch.anchors_u as usize;
+        let av = patch.anchors_v as usize;
+        let qu = patch.quads_u as usize;
+        let qv = patch.quads_v as usize;
+        if patch.anchors.len() != product(au, av, at)? {
+            return Err(err(at, ErrorKind::InvalidPatchLength));
+        }
+        if let Some(data) = &patch.computed {
+            let n = grid_size(au, av, qu, qv, at)?;
+            if data.points.len() != n || data.normals.len() != n {
+                return Err(err(at, ErrorKind::InvalidPatchLength));
+            }
+        }
+        let aw = Width::for_max(au.max(av), self.version, at)?;
+        let qw = Width::for_max(qu.max(qv), self.version, at)?;
+        self.byte(aw.0 | qw.0 << 2)?;
+        self.count(au, aw)?;
+        self.count(av, aw)?;
+        self.count(qu, qw)?;
+        self.count(qv, qw)?;
+        self.vectors(&patch.anchors)?;
+        if let Some(data) = &patch.computed {
+            self.vectors(&data.points)?;
+            self.vectors(&data.normals)?;
+        }
+        Ok(())
+    }
+}
+
+/// Encode a document without optimizing properties or dropping data. Legacy
+/// output refuses properties and uses four-byte counts for 32768..=65535.
+/// All validation completes before bytes are returned or any I/O is attempted.
+pub fn encode(document: &Document, limits: &Limits) -> Result<Vec<u8>> {
+    let world = &document.world;
+    let old = document.version == Version::V201501280;
+    if old && (!world.string_properties.is_empty() || !world.uv_properties.is_empty()) {
+        return Err(err(0, ErrorKind::LegacyProperties));
+    }
+    let mut e = Encoder {
+        data: Vec::new(),
+        limits,
+        budget: Budget::default(),
+        version: document.version,
+    };
+    let sw = Width::for_max(world.string_properties.len(), document.version, 12)?;
+    let uw = Width::for_max(world.uv_properties.len(), document.version, 12)?;
+    e.bytes(b"Mb3World")?;
+    e.raw(document.version as u32, Width(2))?;
+    e.byte(u8::from(world.computed) | sw.0 << 1 | uw.0 << 3)?;
+    if !old {
+        e.table(&world.string_properties, sw)?;
+        e.table(&world.uv_properties, uw)?;
+    }
+    e.items(world.brushes.len())?;
+    e.count(world.brushes.len(), Width(2))?;
+    if old {
+        e.count(world.patches.len(), Width(2))?;
+    }
+    for brush in &world.brushes {
+        e.brush(brush, world, sw, uw)?;
+    }
+    e.items(world.patches.len())?;
+    if !old {
+        e.count(world.patches.len(), Width(2))?;
+    }
+    for patch in &world.patches {
+        e.patch(patch, world.computed)?;
+    }
+    Ok(e.data)
+}
+
+/// Read until EOF, bounded to `max_bytes + 1` observed bytes. Short reads and
+/// Interrupted are supported. The buffered input is then strictly decoded.
+pub fn read(mut source: impl Read, limits: &Limits) -> Result<Document> {
+    let mut data = Vec::new();
+    let mut chunk = [0; 8192];
+    loop {
+        let n = limits
+            .max_bytes
+            .saturating_sub(data.len())
+            .saturating_add(1)
+            .min(chunk.len());
+        let n = match source.read(&mut chunk[..n]) {
+            Ok(0) => break,
+            Ok(n) => n,
+            Err(e) if e.kind() == io::ErrorKind::Interrupted => continue,
+            Err(e) => return Err(err(data.len(), ErrorKind::Io(e))),
+        };
+        append(&mut data, &chunk[..n], limits.max_bytes)?;
+    }
+    decode(&data, limits)
+}
+
+/// Validate and encode before touching the destination. I/O failure can still
+/// leave a written prefix; callers needing atomic files must save via a temp file.
+pub fn write(mut destination: impl Write, document: &Document, limits: &Limits) -> Result<()> {
+    let data = encode(document, limits)?;
+    let mut written = 0;
+    while written != data.len() {
+        match destination.write(&data[written..]) {
+            Ok(0) => return Err(err(written, ErrorKind::Io(io::ErrorKind::WriteZero.into()))),
+            Ok(n) => written += n,
+            Err(e) if e.kind() == io::ErrorKind::Interrupted => continue,
+            Err(e) => return Err(err(written, ErrorKind::Io(e))),
+        }
+    }
+    Ok(())
+}

crates/mb3-dat/src/lib.rs

@@ -0,0 +1,93 @@
+//! Safe, strict MB3 DAT serialization, independent of the editor or renderer.
+//!
+//! See `docs/RUST_DAT.md` for compatibility and resource limits. No geometry is
+//! computed or validated. Decoding owns its results and never retains the input.
+//!
+//! ```
+//! use mb3_dat::{Document, Limits, Version, World, decode, encode};
+//! let document = Document { version: Version::V201512200, world: World::default() };
+//! let bytes = encode(&document, &Limits::default())?;
+//! assert_eq!(decode(&bytes, &Limits::default())?, document);
+//! # Ok::<(), mb3_dat::Error>(())
+//! ```
+mod codec;
+pub use codec::{Error, ErrorKind, Limits, decode, encode, read, write};
+
+pub type Vec3 = [f32; 3];
+
+#[derive(Clone, Copy, Debug, PartialEq, Eq)]
+#[repr(u32)]
+pub enum Version {
+    V201501280 = 201501280,
+    V201512200 = 201512200,
+}
+
+#[derive(Clone, Debug, PartialEq)]
+pub struct Document {
+    pub version: Version,
+    pub world: World,
+}
+
+/// Table order and sparse indices are preserved; no converter optimization runs.
+#[derive(Clone, Debug, Default, PartialEq)]
+pub struct World {
+    pub computed: bool,
+    pub string_properties: Vec<String>,
+    pub uv_properties: Vec<String>,
+    pub brushes: Vec<Brush>,
+    pub patches: Vec<Patch9>,
+}
+
+#[derive(Clone, Debug, Default, PartialEq)]
+pub struct Brush {
+    pub planes: Vec<Plane>,
+}
+
+/// Sparse entries must be unique and sorted by index when encoding. Decoding
+/// sorts wire entries by index. An absent entry differs from an empty value.
+#[derive(Clone, Debug, PartialEq)]
+pub struct Property<T> {
+    pub index: u32,
+    pub value: T,
+}
+
+#[derive(Clone, Debug, PartialEq)]
+pub struct Uv {
+    pub u: Vec3,
+    pub v: Vec3,
+    pub u_scale: f32,
+    pub u_shift: f32,
+    pub v_scale: f32,
+    pub v_shift: f32,
+}
+
+#[derive(Clone, Debug, Default, PartialEq)]
+pub struct Plane {
+    pub p0: Vec3,
+    pub u: Vec3,
+    pub v: Vec3,
+    pub strings: Vec<Property<String>>,
+    pub uv: Vec<Property<Uv>>,
+    /// Some (including an empty polygon) iff the world's computed flag is true.
+    pub polygon: Option<Vec<Vec3>>,
+}
+
+#[derive(Clone, Debug, Default, PartialEq)]
+pub struct Patch9 {
+    pub anchors_u: u32,
+    pub anchors_v: u32,
+    pub quads_u: u32,
+    pub quads_v: u32,
+    pub anchors: Vec<Vec3>,
+    /// Some iff the world's computed flag is true.
+    pub computed: Option<PatchComputed>,
+}
+
+#[derive(Clone, Debug, Default, PartialEq)]
+pub struct PatchComputed {
+    pub points: Vec<Vec3>,
+    pub normals: Vec<Vec3>,
+}
+
+#[cfg(test)]
+mod tests;

crates/mb3-dat/src/tests.rs

@@ -0,0 +1,691 @@
+use super::*;
+use std::io::{self, Cursor, Read, Write};
+
+const VERSIONS: [Version; 2] = [Version::V201501280, Version::V201512200];
+
+fn empty(version: Version) -> Document {
+    Document {
+        version,
+        world: World::default(),
+    }
+}
+
+fn rich(version: Version) -> Document {
+    let plane = Plane {
+        p0: [1.0, -0.0, 3.0],
+        u: [4.0, 5.0, 6.0],
+        v: [7.0, 8.0, 9.0],
+        polygon: Some(vec![[0.0, 0.0, 0.0], [1.0, 0.0, 0.0], [0.0, 1.0, 0.0]]),
+        ..Plane::default()
+    };
+    let mut d = Document {
+        version,
+        world: World {
+            computed: true,
+            brushes: vec![Brush {
+                planes: vec![plane],
+            }],
+            patches: vec![Patch9 {
+                anchors_u: 3,
+                anchors_v: 3,
+                quads_u: 2,
+                quads_v: 2,
+                anchors: vec![[1.0, 2.0, 3.0]; 9],
+                computed: Some(PatchComputed {
+                    points: vec![[4.0, 5.0, 6.0]; 9],
+                    normals: vec![[0.0, 1.0, 0.0]; 9],
+                }),
+            }],
+            ..World::default()
+        },
+    };
+    if version == Version::V201512200 {
+        d.world.string_properties = vec!["unused".into(), "name".into()];
+        d.world.uv_properties = vec!["uv".into()];
+        d.world.brushes[0].planes[0].strings = vec![Property {
+            index: 1,
+            value: String::new(),
+        }];
+        d.world.brushes[0].planes[0].uv = vec![Property {
+            index: 0,
+            value: Uv {
+                u: [1.0, 2.0, 3.0],
+                v: [6.0, 7.0, 8.0],
+                u_scale: 4.0,
+                u_shift: 5.0,
+                v_scale: 9.0,
+                v_shift: 10.0,
+            },
+        }];
+    }
+    d
+}
+
+#[test]
+fn exact_empty_headers() {
+    for version in VERSIONS {
+        let mut expected = b"Mb3World".to_vec();
+        expected.extend_from_slice(&(version as u32).to_le_bytes());
+        expected.extend_from_slice(&[0; 9]);
+        if version == Version::V201512200 {
+            expected.extend_from_slice(&[0; 2]);
+        }
+        let d = empty(version);
+        assert_eq!(encode(&d, &Limits::default()).unwrap(), expected);
+        assert_eq!(decode(&expected, &Limits::default()).unwrap(), d);
+    }
+}
+
+#[test]
+fn rich_semantic_and_bit_exact_roundtrips() {
+    for version in VERSIONS {
+        let d = rich(version);
+        let data = encode(&d, &Limits::default()).unwrap();
+        let decoded = decode(&data, &Limits::default()).unwrap();
+        assert_eq!(decoded, d);
+        assert_eq!(
+            decoded.world.brushes[0].planes[0].p0[1].to_bits(),
+            (-0.0f32).to_bits()
+        );
+        assert_eq!(encode(&decoded, &Limits::default()).unwrap(), data);
+    }
+}
+
+#[test]
+fn rejects_every_prefix_truncation() {
+    for version in VERSIONS {
+        let data = encode(&rich(version), &Limits::default()).unwrap();
+        for n in 0..data.len() {
+            assert!(
+                decode(&data[..n], &Limits::default()).is_err(),
+                "version {version:?}, prefix {n}"
+            );
+        }
+    }
+}
+
+#[test]
+fn rejects_header_flags_versions_trailing_and_reserved_widths() {
+    for version in VERSIONS {
+        let data = encode(&empty(version), &Limits::default()).unwrap();
+        for (at, value) in [(0, b'x'), (8, 0), (12, 0xe0), (12, 6)] {
+            let mut bad = data.clone();
+            bad[at] = value;
+            assert!(decode(&bad, &Limits::default()).is_err());
+        }
+        let mut extra = data;
+        extra.push(0);
+        assert!(matches!(
+            decode(&extra, &Limits::default()).unwrap_err().kind,
+            ErrorKind::TrailingData
+        ));
+    }
+    for flags in [3, 12, 0xf0] {
+        let mut data = encode(&empty(Version::V201512200), &Limits::default()).unwrap();
+        data[15..19].copy_from_slice(&1i32.to_le_bytes());
+        data.splice(19..19, [flags, 0]);
+        assert!(decode(&data, &Limits::default()).is_err());
+    }
+}
+
+#[test]
+fn counts_rejected_before_allocation() {
+    for count in [-1i32, i32::MAX] {
+        let mut data = encode(&empty(Version::V201512200), &Limits::default()).unwrap();
+        data[15..19].copy_from_slice(&count.to_le_bytes());
+        assert!(decode(&data, &Limits::default()).is_err());
+    }
+    let mut old = encode(&empty(Version::V201501280), &Limits::default()).unwrap();
+    old[13..17].copy_from_slice(&1i32.to_le_bytes());
+    old.extend_from_slice(&[1, 0, 128]);
+    assert!(matches!(
+        decode(&old, &Limits::default()).unwrap_err().kind,
+        ErrorKind::NegativeCount
+    ));
+}
+
+#[test]
+fn plane_width_boundaries_and_legacy_repair() {
+    for version in VERSIONS {
+        for n in [255, 256, 32767, 32768, 65535, 65536] {
+            let mut d = empty(version);
+            d.world.brushes.push(Brush {
+                planes: vec![Plane::default(); n],
+            });
+            let data = encode(&d, &Limits::default()).unwrap();
+            let flag_at = if version == Version::V201501280 {
+                21
+            } else {
+                19
+            };
+            let expected = if n <= 255 {
+                0
+            } else if n
+                <= if version == Version::V201501280 {
+                    32767
+                } else {
+                    65535
+                }
+            {
+                1
+            } else {
+                2
+            };
+            assert_eq!(data[flag_at], expected);
+            assert_eq!(decode(&data, &Limits::default()).unwrap(), d);
+        }
+    }
+}
+
+#[test]
+fn string_and_uv_table_width_boundaries_preserve_unused_names() {
+    for n in [255, 256, 65535, 65536] {
+        let mut d = empty(Version::V201512200);
+        d.world.string_properties = (0..n).map(|i| format!("s{i}")).collect();
+        d.world.uv_properties = (0..n).map(|i| format!("u{i}")).collect();
+        let data = encode(&d, &Limits::default()).unwrap();
+        let width = if n <= 255 {
+            0
+        } else if n <= 65535 {
+            1
+        } else {
+            2
+        };
+        assert_eq!(data[12], width << 1 | width << 3);
+        assert_eq!(decode(&data, &Limits::default()).unwrap(), d);
+    }
+}
+
+#[test]
+fn sparse_index_and_sentinel_width_boundaries() {
+    for n in [255, 256, 65535, 65536] {
+        let mut d = empty(Version::V201512200);
+        d.world.string_properties = (0..n).map(|i| format!("p{i}")).collect();
+        d.world.uv_properties = d.world.string_properties.clone();
+        d.world.brushes.push(Brush {
+            planes: vec![Plane {
+                strings: vec![Property {
+                    index: n - 1,
+                    value: String::new(),
+                }],
+                uv: vec![Property {
+                    index: n - 1,
+                    value: Uv {
+                        u: [1.0; 3],
+                        v: [2.0; 3],
+                        u_scale: 3.0,
+                        u_shift: 4.0,
+                        v_scale: 5.0,
+                        v_shift: 6.0,
+                    },
+                }],
+                ..Plane::default()
+            }],
+        });
+        let data = encode(&d, &Limits::default()).unwrap();
+        assert_eq!(decode(&data, &Limits::default()).unwrap(), d);
+    }
+}
+
+#[test]
+fn shared_contour_width_and_legacy_repair() {
+    for version in VERSIONS {
+        for n in [256, 32768, 65536] {
+            let mut d = empty(version);
+            d.world.computed = true;
+            d.world.brushes.push(Brush {
+                planes: vec![
+                    Plane {
+                        polygon: Some(vec![[1.0, 2.0, 3.0]; n]),
+                        ..Plane::default()
+                    },
+                    Plane {
+                        polygon: Some(vec![[4.0, 5.0, 6.0]]),
+                        ..Plane::default()
+                    },
+                ],
+            });
+            let data = encode(&d, &Limits::default()).unwrap();
+            assert_eq!(decode(&data, &Limits::default()).unwrap(), d);
+        }
+    }
+}
+
+#[test]
+fn patch_dimensions_and_tessellation_widths() {
+    for version in VERSIONS {
+        for n in [255, 256, 32768, 65536] {
+            let mut d = empty(version);
+            d.world.patches.push(Patch9 {
+                anchors_u: n,
+                anchors_v: 0,
+                quads_u: n,
+                quads_v: 2,
+                ..Patch9::default()
+            });
+            assert_eq!(
+                decode(&encode(&d, &Limits::default()).unwrap(), &Limits::default()).unwrap(),
+                d
+            );
+        }
+    }
+}
+
+#[test]
+fn strict_strings_on_read_and_write() {
+    for text in ["é", "a\0b"] {
+        let mut d = empty(Version::V201512200);
+        d.world.string_properties.push(text.into());
+        assert!(encode(&d, &Limits::default()).is_err());
+    }
+    for tail in [vec![1, b'a'], vec![1, 0xff, 0]] {
+        let mut data = b"Mb3World".to_vec();
+        data.extend_from_slice(&201512200i32.to_le_bytes());
+        data.push(0);
+        data.extend(tail);
+        assert!(decode(&data, &Limits::default()).is_err());
+    }
+    let mut d = empty(Version::V201512200);
+    d.world.string_properties = vec!["same".into(), "same".into()];
+    assert_eq!(
+        decode(&encode(&d, &Limits::default()).unwrap(), &Limits::default()).unwrap(),
+        d
+    );
+}
+
+fn sparse_wire(entries: &[u8]) -> Vec<u8> {
+    let mut data = b"Mb3World".to_vec();
+    data.extend_from_slice(&201512200i32.to_le_bytes());
+    data.extend_from_slice(b"\0\x02a\0b\0\0");
+    data.extend_from_slice(&1i32.to_le_bytes());
+    data.extend_from_slice(&[0, 1]);
+    data.extend_from_slice(entries);
+    data.push(255);
+    data.extend_from_slice(&[0; 36]);
+    data.extend_from_slice(&0i32.to_le_bytes());
+    data
+}
+
+#[test]
+fn binary_properties_sorted_but_duplicates_and_bad_indices_rejected() {
+    let d = decode(&sparse_wire(b"\x01B\0\0A\0"), &Limits::default()).unwrap();
+    assert_eq!(
+        d.world.brushes[0].planes[0].strings,
+        vec![
+            Property {
+                index: 0,
+                value: "A".into()
+            },
+            Property {
+                index: 1,
+                value: "B".into()
+            }
+        ]
+    );
+    for entries in [b"\0a\0\0b\0".as_slice(), b"\x02a\0"] {
+        assert!(decode(&sparse_wire(entries), &Limits::default()).is_err());
+    }
+    let mut d = d;
+    d.world.brushes[0].planes[0].strings.reverse();
+    assert!(matches!(
+        encode(&d, &Limits::default()).unwrap_err().kind,
+        ErrorKind::UnsortedProperties
+    ));
+    d.world.brushes[0].planes[0].strings = vec![
+        Property {
+            index: 0,
+            value: "a".into()
+        };
+        2
+    ];
+    assert!(matches!(
+        encode(&d, &Limits::default()).unwrap_err().kind,
+        ErrorKind::DuplicateProperty(0)
+    ));
+    d.world.brushes[0].planes[0].strings[0].index = 9;
+    assert!(matches!(
+        encode(&d, &Limits::default()).unwrap_err().kind,
+        ErrorKind::PropertyIndex(9)
+    ));
+}
+
+#[test]
+fn legacy_downgrade_refuses_properties() {
+    let mut d = rich(Version::V201512200);
+    d.version = Version::V201501280;
+    assert!(matches!(
+        encode(&d, &Limits::default()).unwrap_err().kind,
+        ErrorKind::LegacyProperties
+    ));
+    d.world.string_properties.clear();
+    d.world.uv_properties.clear();
+    assert!(matches!(
+        encode(&d, &Limits::default()).unwrap_err().kind,
+        ErrorKind::LegacyProperties
+    ));
+}
+
+#[test]
+fn refuses_inconsistent_computed_arrays() {
+    for version in VERSIONS {
+        for mode in 0..5 {
+            let mut d = rich(version);
+            match mode {
+                0 => d.world.computed = false,
+                1 => d.world.brushes[0].planes[0].polygon = None,
+                2 => d.world.patches[0].computed = None,
+                3 => {
+                    d.world.patches[0].anchors.pop();
+                }
+                _ => {
+                    d.world.patches[0].computed.as_mut().unwrap().normals.pop();
+                }
+            }
+            assert!(encode(&d, &Limits::default()).is_err());
+        }
+    }
+}
+
+#[test]
+fn overflow_and_impossible_dimensions_are_errors() {
+    for version in VERSIONS {
+        let mut d = empty(version);
+        d.world.computed = true;
+        d.world.patches.push(Patch9 {
+            anchors_u: 7,
+            anchors_v: 7,
+            quads_u: i32::MAX as u32,
+            quads_v: i32::MAX as u32,
+            anchors: vec![[0.0; 3]; 49],
+            computed: Some(PatchComputed::default()),
+        });
+        assert!(encode(&d, &Limits::default()).is_err());
+        d.world.computed = false;
+        d.world.patches[0].computed = None;
+        d.world.patches[0].quads_u = u32::MAX;
+        assert!(matches!(
+            encode(&d, &Limits::default()).unwrap_err().kind,
+            ErrorKind::CountOverflow
+        ));
+    }
+}
+
+#[test]
+fn nonfinite_and_finite_extremes() {
+    for f in [f32::NAN, f32::INFINITY, f32::NEG_INFINITY] {
+        let mut d = rich(Version::V201512200);
+        d.world.brushes[0].planes[0].p0[0] = f;
+        assert!(matches!(
+            encode(&d, &Limits::default()).unwrap_err().kind,
+            ErrorKind::NonFinite
+        ));
+        let mut data = sparse_wire(&[]);
+        // The final 40 bytes are the plane vectors and the patch count.
+        let pos = data.len() - 40;
+        data[pos..pos + 4].copy_from_slice(&f.to_le_bytes());
+        assert!(matches!(
+            decode(&data, &Limits::default()).unwrap_err().kind,
+            ErrorKind::NonFinite
+        ));
+    }
+    let mut d = rich(Version::V201501280);
+    d.world.brushes[0].planes[0].p0 = [f32::MAX, f32::MIN_POSITIVE, f32::from_bits(1)];
+    assert_eq!(
+        decode(&encode(&d, &Limits::default()).unwrap(), &Limits::default()).unwrap(),
+        d
+    );
+}
+
+#[test]
+fn each_resource_limit_is_enforced() {
+    let d = rich(Version::V201512200);
+    let data = encode(&d, &Limits::default()).unwrap();
+    for limits in [
+        Limits {
+            max_bytes: data.len() - 1,
+            ..Limits::default()
+        },
+        Limits {
+            max_items: 1,
+            ..Limits::default()
+        },
+        Limits {
+            max_string_bytes: 1,
+            ..Limits::default()
+        },
+    ] {
+        assert!(decode(&data, &limits).is_err());
+        assert!(encode(&d, &limits).is_err());
+    }
+    assert!(
+        decode(
+            &data,
+            &Limits {
+                max_owned_bytes: 1,
+                ..Limits::default()
+            }
+        )
+        .is_err()
+    );
+    let mut input = Cursor::new(&data);
+    assert!(
+        read(
+            &mut input,
+            &Limits {
+                max_bytes: 20,
+                ..Limits::default()
+            }
+        )
+        .is_err()
+    );
+    assert_eq!(input.position(), 21);
+}
+
+#[test]
+fn exact_string_and_item_limits() {
+    let mut d = empty(Version::V201512200);
+    d.world.string_properties.push("abcd".into());
+    let limits = Limits {
+        max_items: 1,
+        max_string_bytes: 4,
+        ..Limits::default()
+    };
+    let data = encode(&d, &limits).unwrap();
+    assert_eq!(decode(&data, &limits).unwrap(), d);
+    assert!(
+        decode(
+            &data,
+            &Limits {
+                max_string_bytes: 3,
+                ..limits
+            }
+        )
+        .is_err()
+    );
+}
+
+struct Choppy {
+    bytes: Cursor<Vec<u8>>,
+    interrupt: bool,
+}
+impl Read for Choppy {
+    fn read(&mut self, b: &mut [u8]) -> io::Result<usize> {
+        if self.interrupt {
+            self.interrupt = false;
+            return Err(io::ErrorKind::Interrupted.into());
+        }
+        let n = b.len().min(1);
+        self.bytes.read(&mut b[..n])
+    }
+}
+impl Write for Choppy {
+    fn write(&mut self, b: &[u8]) -> io::Result<usize> {
+        if self.interrupt {
+            self.interrupt = false;
+            return Err(io::ErrorKind::Interrupted.into());
+        }
+        self.bytes.write(&b[..b.len().min(1)])
+    }
+    fn flush(&mut self) -> io::Result<()> {
+        Ok(())
+    }
+}
+
+#[test]
+fn streaming_short_reads_writes_and_interruptions() {
+    let d = rich(Version::V201512200);
+    let data = encode(&d, &Limits::default()).unwrap();
+    assert_eq!(
+        read(
+            Choppy {
+                bytes: Cursor::new(data.clone()),
+                interrupt: true
+            },
+            &Limits::default()
+        )
+        .unwrap(),
+        d
+    );
+    let mut target = Choppy {
+        bytes: Cursor::new(Vec::new()),
+        interrupt: true,
+    };
+    write(&mut target, &d, &Limits::default()).unwrap();
+    assert_eq!(target.bytes.into_inner(), data);
+}
+
+#[test]
+fn invalid_models_do_not_touch_writer() {
+    let mut d = rich(Version::V201501280);
+    d.world.patches[0].anchors.clear();
+    let mut target = vec![1, 2, 3];
+    assert!(write(&mut target, &d, &Limits::default()).is_err());
+    assert_eq!(target, [1, 2, 3]);
+}
+
+struct Broken {
+    written: usize,
+}
+impl Write for Broken {
+    fn write(&mut self, b: &[u8]) -> io::Result<usize> {
+        if self.written >= 7 {
+            return Err(io::ErrorKind::BrokenPipe.into());
+        }
+        let n = b.len().min(7 - self.written);
+        self.written += n;
+        Ok(n)
+    }
+    fn flush(&mut self) -> io::Result<()> {
+        Ok(())
+    }
+}
+impl Read for Broken {
+    fn read(&mut self, _: &mut [u8]) -> io::Result<usize> {
+        Err(io::ErrorKind::BrokenPipe.into())
+    }
+}
+#[test]
+fn io_errors_and_offsets_propagate() {
+    let e = write(
+        Broken { written: 0 },
+        &empty(Version::V201501280),
+        &Limits::default(),
+    )
+    .unwrap_err();
+    assert_eq!(e.offset, 7);
+    assert!(matches!(e.kind, ErrorKind::Io(_)));
+    assert!(matches!(
+        read(Broken { written: 0 }, &Limits::default())
+            .unwrap_err()
+            .kind,
+        ErrorKind::Io(_)
+    ));
+    assert!(matches!(
+        write(
+            [0u8; 0].as_mut_slice(),
+            &empty(Version::V201501280),
+            &Limits::default()
+        )
+        .unwrap_err()
+        .kind,
+        ErrorKind::Io(_)
+    ));
+}
+
+#[test]
+fn deterministic_mutation_smoke_no_panics_or_unbounded_allocations() {
+    let limits = Limits {
+        max_bytes: 2048,
+        max_string_bytes: 64,
+        max_items: 256,
+        max_owned_bytes: 32768,
+    };
+    let seeds: Vec<_> = VERSIONS
+        .iter()
+        .map(|v| encode(&rich(*v), &limits).unwrap())
+        .collect();
+    let mut state = 0x37ab12cdu32;
+    for i in 0..5000 {
+        let mut data = seeds[i % seeds.len()].clone();
+        for _ in 0..1 + i % 8 {
+            state = state.wrapping_mul(1664525).wrapping_add(1013904223);
+            let at = state as usize % data.len();
+            data[at] ^= (state >> 24) as u8;
+        }
+        if let Ok(d) = decode(&data, &limits) {
+            let canonical = encode(&d, &limits).unwrap();
+            assert_eq!(decode(&canonical, &limits).unwrap(), d);
+            assert_eq!(
+                encode(&decode(&canonical, &limits).unwrap(), &limits).unwrap(),
+                canonical
+            );
+        }
+    }
+}
+
+#[test]
+fn valid_nonminimal_widths_are_normalized_and_patch_flags_are_strict() {
+    let canonical = encode(&empty(Version::V201512200), &Limits::default()).unwrap();
+    let mut wide = canonical.clone();
+    wide[12] = 2; // S uses u16 rather than u8, while its count is zero.
+    wide.insert(13, 0);
+    let d = decode(&wide, &Limits::default()).unwrap();
+    assert_eq!(encode(&d, &Limits::default()).unwrap(), canonical);
+    for version in VERSIONS {
+        let mut d = empty(version);
+        d.world.patches.push(Patch9::default());
+        let data = encode(&d, &Limits::default()).unwrap();
+        let flag_at = if version == Version::V201501280 {
+            21
+        } else {
+            23
+        };
+        for flags in [3, 12, 0x80] {
+            let mut bad = data.clone();
+            bad[flag_at] = flags;
+            assert!(decode(&bad, &Limits::default()).is_err());
+        }
+    }
+}
+
+#[test]
+fn reader_rejects_computed_grid_arithmetic_overflow() {
+    for version in VERSIONS {
+        let mut data = b"Mb3World".to_vec();
+        data.extend_from_slice(&(version as u32).to_le_bytes());
+        data.push(1);
+        if version == Version::V201512200 {
+            data.extend_from_slice(&[0, 0]);
+        }
+        data.extend_from_slice(&0i32.to_le_bytes());
+        data.extend_from_slice(&1i32.to_le_bytes());
+        data.extend_from_slice(&[8, 7, 7]);
+        data.extend_from_slice(&i32::MAX.to_le_bytes());
+        data.extend_from_slice(&i32::MAX.to_le_bytes());
+        data.extend_from_slice(&[0; 49 * 12]);
+        assert!(matches!(
+            decode(&data, &Limits::default()).unwrap_err().kind,
+            ErrorKind::CountOverflow
+        ));
+    }
+}

crates/mb3-dat/tests/converter.rs

@@ -0,0 +1,207 @@
+//! Requires hydrated, hash-verified E02 assets. Never silently skips fixtures.
+use mb3_dat::*;
+use std::fs;
+use std::path::PathBuf;
+
+fn corpus() -> PathBuf {
+    std::env::var_os("NANOBRUSH_CONVERTER_FIXTURES")
+        .map(PathBuf::from)
+        .unwrap_or_else(|| {
+            PathBuf::from(env!("CARGO_MANIFEST_DIR")).join("../../assets/analysis/converter/probes")
+        })
+}
+
+fn fixture(build: &str, case: &str, name: &str) -> Vec<u8> {
+    let path = corpus().join(build).join(case).join(name);
+    fs::read(&path).unwrap_or_else(|e| {
+        panic!(
+            "hydrate E02 assets with assets-fetch; {}: {e}",
+            path.display()
+        )
+    })
+}
+
+#[test]
+fn all_58_converter_dat_outputs_are_byte_exact_roundtrips() {
+    for (build, version, expected) in [
+        ("2015-10-03", Version::V201501280, 25),
+        ("2016-03-10-c", Version::V201512200, 33),
+    ] {
+        let paths = fs::read_dir(corpus().join(build)).expect("hydrate E02 fixtures; assets-fetch");
+        let mut count = 0;
+        for case in paths {
+            let path = case.unwrap().path().join("output.mb3dat");
+            if !path.exists() {
+                continue;
+            }
+            let data = fs::read(&path).unwrap();
+            let d = decode(&data, &Limits::default())
+                .unwrap_or_else(|e| panic!("{}: {e}", path.display()));
+            assert_eq!(d.version, version);
+            assert_eq!(
+                encode(&d, &Limits::default()).unwrap(),
+                data,
+                "{}",
+                path.display()
+            );
+            count += 1;
+        }
+        assert_eq!(count, expected, "missing or changed corpus for {build}");
+    }
+}
+
+#[test]
+fn native_semantics_match_asymmetric_basis_sparse_uv_and_computed_patch() {
+    for build in ["2015-10-03", "2016-03-10-c"] {
+        let d = decode(
+            &fixture(build, "plane-to-dat", "output.mb3dat"),
+            &Limits::default(),
+        )
+        .unwrap();
+        let p = &d.world.brushes[0].planes[0];
+        assert_eq!((p.p0, p.u, p.v), ([1., 2., 3.], [4., 5., 6.], [7., 8., 9.]));
+        let d = decode(
+            &fixture(build, "patch-true", "output.mb3dat"),
+            &Limits::default(),
+        )
+        .unwrap();
+        let p = &d.world.patches[0];
+        assert_eq!(
+            (p.anchors_u, p.anchors_v, p.quads_u, p.quads_v),
+            (3, 3, 2, 2)
+        );
+        assert_eq!(p.anchors.len(), 9);
+        assert_eq!(p.computed.as_ref().unwrap().normals, vec![[0., 1., 0.]; 9]);
+    }
+    let d = decode(
+        &fixture("2016-03-10-c", "properties-to-dat", "output.mb3dat"),
+        &Limits::default(),
+    )
+    .unwrap();
+    assert_eq!(d.world.string_properties, ["common", "rare"]);
+    let p = &d.world.brushes[0].planes[0];
+    assert_eq!(
+        p.strings,
+        [
+            Property {
+                index: 0,
+                value: "c".into()
+            },
+            Property {
+                index: 1,
+                value: "r".into()
+            }
+        ]
+    );
+    assert_eq!(
+        p.uv[0].value,
+        Uv {
+            u: [1., 2., 3.],
+            v: [6., 7., 8.],
+            u_scale: 4.,
+            u_shift: 5.,
+            v_scale: 9.,
+            v_shift: 10.
+        }
+    );
+    assert_eq!(
+        d.world.brushes[0].planes[1].strings,
+        [Property {
+            index: 0,
+            value: String::new()
+        }]
+    );
+}
+
+#[test]
+fn rejects_captured_corrupt_and_ambiguous_inputs() {
+    for build in ["2015-10-03", "2016-03-10-c"] {
+        for case in ["dat-trailing", "wrong-version", "truncated-last-float"] {
+            assert!(
+                decode(&fixture(build, case, "input.mb3dat"), &Limits::default()).is_err(),
+                "{build}/{case}"
+            );
+        }
+        // Autodetection intentionally accepts the other version; original converters reject it.
+        assert!(
+            decode(
+                &fixture(build, "cross-version", "input.mb3dat"),
+                &Limits::default()
+            )
+            .is_ok()
+        );
+    }
+    for case in [
+        "reserved-width-3",
+        "reserved-world-bits",
+        "binary-duplicate-slot",
+        "truncated-patch-count",
+    ] {
+        assert!(
+            decode(
+                &fixture("2016-03-10-c", case, "input.mb3dat"),
+                &Limits::default()
+            )
+            .is_err(),
+            "{case}"
+        );
+    }
+    assert!(
+        decode(
+            &fixture("2015-10-03", "signed-16-count", "input.mb3dat"),
+            &Limits::default()
+        )
+        .is_err()
+    );
+}
+
+#[test]
+fn generated_properties_require_explicit_loss_before_legacy_migration() {
+    let mut d = decode(
+        &fixture("2016-03-10-c", "properties-to-dat", "output.mb3dat"),
+        &Limits::default(),
+    )
+    .unwrap();
+    d.version = Version::V201501280;
+    assert!(matches!(
+        encode(&d, &Limits::default()).unwrap_err().kind,
+        ErrorKind::LegacyProperties
+    ));
+}
+
+#[test]
+fn migrate_property_free_computed_document_both_directions() {
+    let old = fixture("2015-10-03", "patch-true", "output.mb3dat");
+    let latest = fixture("2016-03-10-c", "patch-true", "output.mb3dat");
+    let mut d = decode(&old, &Limits::default()).unwrap();
+    d.version = Version::V201512200;
+    assert_eq!(encode(&d, &Limits::default()).unwrap(), latest);
+    d = decode(&latest, &Limits::default()).unwrap();
+    d.version = Version::V201501280;
+    assert_eq!(encode(&d, &Limits::default()).unwrap(), old);
+
+    // Compose independently captured brush/patch record bytes to exercise both
+    // nonzero counts together, including their different positions by version.
+    for (build, version) in [
+        ("2015-10-03", Version::V201501280),
+        ("2016-03-10-c", Version::V201512200),
+    ] {
+        let brush = fixture(build, "computed-plane", "output.mb3dat");
+        let patch = fixture(build, "patch-true", "output.mb3dat");
+        let mut mixed = decode(&brush, &Limits::default()).unwrap();
+        mixed.world.patches = decode(&patch, &Limits::default()).unwrap().world.patches;
+        let mut expected;
+        if version == Version::V201501280 {
+            expected = brush[..21].to_vec();
+            expected[17..21].copy_from_slice(&1i32.to_le_bytes());
+            expected.extend_from_slice(&brush[21..]);
+            expected.extend_from_slice(&patch[21..]);
+        } else {
+            expected = brush[..brush.len() - 4].to_vec();
+            expected.extend_from_slice(&1i32.to_le_bytes());
+            expected.extend_from_slice(&patch[23..]);
+        }
+        assert_eq!(encode(&mixed, &Limits::default()).unwrap(), expected);
+        assert_eq!(decode(&expected, &Limits::default()).unwrap(), mixed);
+    }
+}

docs/FINDINGS.md

@@ -153,3 +153,7 @@ The [plugin map](PLUGINS.md) accounts for 17 top-level plugins, five experimenta
 ## F24–F28 — Executed converter investigation
 
 [MB3 DAT](MB3_DAT.md) specifies the two recovered binary layouts, complete hierarchy/width/string/UV/computed-geometry contracts and method RVAs. [Converter behavior](CONVERTER.md) documents property optimization, encoding loss/drift, point/basis transforms, MAP/VMF/Q3/OBJ preservation/loss, CLI/log/overwrite behavior and malformed-file defects. [E02](experiments/converter-2026-10-21.md) ran 101 controlled probes using unchanged executables under Mono on macOS ARM64, retained raw evidence in Xet and added a bounded independent inspector. The authored network-free suite now has 52 tests. Native editor, Windows/Linux parity and full hostile-file coverage remain unverified.
+
+## F29 — Native DAT serialization and compatibility profile
+
+The [Rust DAT codec](RUST_DAT.md) reads and writes both recovered layouts with checked counts/products, finite f32 and strict ASCII policies, bounded allocation/streaming and explicit rejection of ambiguous or incomplete data. It preserves property table order and absent-versus-empty values, refuses silent property loss on downgrade, and repairs the old signed-16 count range by choosing four bytes. All 58 captured DAT outputs round-trip exactly; intentional departures from legacy corruption, normalization and permissive parsing are documented separately from remaining editor/platform interoperability work.

docs/MB3_DAT.md

@@ -116,4 +116,4 @@ Observed probes establish empty/computed worlds, asymmetric plane vectors, spars
 
 The research [inspector](../scripts/inspect_mb3dat.py) independently reads both layouts and reports offsets and trailing bytes. It deliberately checks every read and bounds allocation: 64 MiB input and 100,000 elements per count/vector array are **research-tool limits**, not recovered format maxima. It neither validates convex geometry nor writes files nor claims Rust compatibility.
 
-The Rust codec must use explicit LE primitives, checked arithmetic, finite-number policy, bounded allocations, checked string termination/indexing and complete reads. Keep a policy for unknown bits and trailing data; do not reproduce the stale-buffer behavior. Native editor compatibility, real user documents, non-finite floats, enormous counts, embedded NUL handling, malformed patch lengths and broader fuzzing remain P6.19/P6.20 work.
+The implemented [Rust codec](RUST_DAT.md) uses explicit LE primitives, checked arithmetic, finite-number policy, bounded allocations, checked string termination/indexing and complete reads. It rejects unknown bits and trailing data and does not reproduce stale-buffer behavior. Both DAT versions pass all 58 converter-output byte round trips. Native editor compatibility, real user documents, non-finite floats, enormous counts, embedded NUL handling, malformed patch lengths and broader fuzzing remain P6.19/P6.20 work.

docs/README.md

@@ -2,7 +2,7 @@
 
 Planning baseline: 2026-10-21. Project name: **Nanobrush**; reference software: **Microbrush 3 / Iteration X / Akula**.
 
-The intended result is a complete native Rust and Bevy reconstruction for macOS and Linux, with Solari lighting on supported hardware. The initial plan is complete, and source and managed-converter reverse engineering are underway. Repository setup and permanent extraction are now implemented; see [setup validation](SETUP.md). A converter oracle and research DAT inspector are implemented; native Rust conversion and application implementation remain future work.
+The intended result is a complete native Rust and Bevy reconstruction for macOS and Linux, with Solari lighting on supported hardware. The initial plan is complete, and source and managed-converter reverse engineering are underway. Repository setup and permanent extraction are now implemented; see [setup validation](SETUP.md). A converter oracle and research DAT inspector are implemented; safe Rust DAT readers/writers are implemented; other native codecs and the application remain future work.
 
 | Document | Purpose |
 | --- | --- |
@@ -18,6 +18,8 @@ The first source investigation is documented in [formats](FORMATS.md), [host API
 
 The executed converter investigation adds [MB3 DAT layouts](MB3_DAT.md), [conversion behavior](CONVERTER.md), and [E02](experiments/converter-2026-10-21.md): 101 probes across both distinct binaries and 52 code-only tests.
 
+The first native format implementation is [the Rust DAT codec](RUST_DAT.md), covering both recovered versions with 58 exact converter-output round trips and an explicit strict compatibility profile; reproduction and limits are in [E03](experiments/rust-dat-2026-10-21.md).
+
 The asset boundary and extraction pipeline are established. Continue with the open P0 decisions and P3–P9 investigation tasks in `TODO.md`, using the source maps to design focused runtime experiments. Run the rendering capability spike early, independently of most editor research. Implement the rewrite in small end-to-end slices after the corresponding behavior is specified.
 
 ## Status vocabulary

docs/RUST_DAT.md

@@ -0,0 +1,84 @@
+# Rust DAT codec and compatibility profile — F29
+
+Implemented in `crates/mb3-dat`, a dependency-free Rust library in the root Cargo workspace. The [binary contract](MB3_DAT.md) remains the format specification. This implementation handles versions **201501280** and **201512200**; it does not require .NET, IXPL, Bevy, a GPU or the original converter at runtime. The package is unpublished pending the project's source-license decision.
+
+## API and data model
+
+```rust
+use mb3_dat::{read, write, Document, Limits, Version};
+
+fn migrate_property_free_file(input: impl std::io::Read,
+                             output: impl std::io::Write)
+    -> Result<(), mb3_dat::Error>
+{
+    let limits = Limits::default();
+    let mut document: Document = read(input, &limits)?;
+    document.version = Version::V201512200;
+    write(output, &document, &limits)
+}
+```
+
+`decode(&[u8], &Limits)` detects the header version; `encode(&Document, &Limits)` writes the selected version. `read` buffers a bounded input and handles short/interrupted reads; `write` completes encoding/validation before touching the caller's writer, handles short/interrupted writes, and reports I/O failures with a completed-prefix byte offset. `write` does not flush the caller's writer. It cannot make filesystem writes atomic: callers must implement temporary-file/rename transactions. The current library does not open or overwrite files itself.
+
+`Document` contains `Version` and `World`. World retains the computed flag, separate ordered string/UV name tables, brushes and patches. Plane triples are P0/U/V, not three absolute points. `Uv` names both axes, scales and shifts; serialization uses the recovered ten-float wire order. `Property<T>` stores an index and value in a sparse vector, retaining **absent versus present-empty** values. Decode sorts entries by index; encode requires unique, increasing indices. Table order, unused names, duplicate table names, object order and finite f32 bits (including negative zero and subnormals) are preserved. Property tables are not optimized or sorted by usage.
+
+Each plane has `polygon: Option<Vec<Vec3>>`; each patch has `computed: Option<PatchComputed>`. These must be present exactly when the world flag is true, even for an empty polygon. Patch anchor lengths must equal `anchors_u * anchors_v`. Computed points and normals must each match the implicit grid-size formula in the specification. Encode rejects inconsistent models rather than dropping arrays or producing an incoherent file. This is structural serialization validation, not convexity, brush validity, normal-length or patch evaluation. Zero/even anchor dimensions and zero tessellation remain representable when their array lengths agree, including the unusual width-isolation converter fixtures.
+
+Errors expose `ErrorKind` and `offset`; I/O causes remain available through `std::error::Error::source`. There is no permissive recovery mode. A version change on a decoded property-free document performs actual hierarchy migration. Selecting the old version with property names or plane property values returns `LegacyProperties`; callers must make and report any loss decision themselves.
+
+## Intentional differences from the converters
+
+| Area | Legacy behavior (E02) | Rust behavior |
+| --- | --- | --- |
+| Version dispatch | Each executable accepts only its own DAT version | Reader automatically handles either; writer uses explicit `Document.version` |
+| Short numeric reads | Reuses stale buffer bytes and can succeed with corrupt values | Every field must be complete; every tested proper prefix is rejected |
+| Unterminated strings | EOF can create an unbounded byte list | Terminator, per-string limit, input limit and allocation budget checked |
+| ASCII | Non-ASCII writes become `?`; high-bit bytes decode lossily | Rejects non-ASCII on read/write; rejects NUL in in-memory strings |
+| Float payloads | No explicit finiteness checks | NaN/infinity rejected; finite binary32 values retained bit-for-bit |
+| Duplicate slots | Binary last-wins | Rejected; duplicate table **names** remain legal and index-distinct |
+| Slot ordering | Accepts arbitrary order | Accepts unique arbitrary wire order, returns sorted sparse entries; requires sorted entries when writing |
+| Reserved flags/selector 3 | Ignored or treated as a four-byte selector | Rejected, including an old boolean byte other than 0/1 |
+| Valid nonminimal widths | Accepted and minimized on save | Accepted and minimized on save; original width bytes are not retained |
+| Trailing bytes | Ignored/dropped | Rejected; reader expects one complete document |
+| Property normalization | Latest CLI removes unused names/reorders used ones | Preserves names/order/indices; no hidden normalization |
+| 2015 counts 32,768–65,535 | Writer chooses signed i16 and produces negative reader counts | Writer chooses i32; reader rejects the malformed signed-i16 representation |
+| Computed data | TXT can emit missing/wrong-sized arrays; no evaluation | Writer requires consistent arrays; no synthesis or geometry evaluation |
+| Count arithmetic/allocation | Unchecked products/counts and allocations | Checked products/sums, wire-length checks, aggregate budgets, fallible reservation |
+| Save behavior | `File.Create` may truncate before a later failure | No I/O until validation/encoding succeeds; later I/O failure can still leave a prefix |
+
+The legacy count repair applies consistently to plane counts, shared contour widths and paired patch dimensions. It intentionally changes bytes where the old writer was broken, while using the four-byte branch already present in the recovered old reader. Rust synthetic boundary tests cover this; direct execution of the legacy converter on the repaired large-count output remains an interoperability follow-up. Existing E02 outputs within the old valid count range are byte-identical after Rust round trips.
+
+## Resource policy
+
+Defaults are application policy, not file-format maxima:
+
+| Limit | Default | Scope |
+| --- | ---: | --- |
+| `max_bytes` | 64 MiB | Complete input and encoded output; streaming input observes at most one excess byte |
+| `max_string_bytes` | 1 MiB | Each ASCII name/value, excluding terminator |
+| `max_items` | 1,000,000 | Aggregate names, brushes, planes, sparse entries, patches and vector-array elements |
+| `max_owned_bytes` | 128 MiB | Decoder's requested owned record/array/sparse-capacity/string storage |
+
+Decoded storage budget excludes caller-owned input, allocator overhead and transient reallocations. Streaming `read` also owns its input buffer, bounded separately by `max_bytes`; encoding owns an output buffer bounded by `max_bytes`. `max_owned_bytes` does not limit an already caller-owned document or the encoded buffer. These are explicit accounting limits, not an exact process-RSS guarantee. All heap reservations in codec parsing/serialization are fallible; `unsafe` is forbidden by workspace lint. Integer fields must fit their version's nonnegative count representation. Sparse vector growth is geometric, capped by the table size, with capacity charged to the decoder budget; duplicate checking sorts once instead of repeatedly scanning prior entries. There is no recursive input traversal.
+
+## Reproduction and evidence
+
+Run inside the pinned Nix shell:
+
+```sh
+cargo fmt --all --check
+cargo clippy --workspace --all-targets --locked --offline -- -D warnings
+analyze-converter check
+cargo test --workspace --locked --offline
+```
+
+The `converter` integration test requires hydrated E02 assets under `assets/analysis/converter/probes`. Missing files, pointer stubs or changed corpus counts fail; no fixture test silently skips. An explicit alternate corpus path can be supplied with `NANOBRUSH_CONVERTER_FIXTURES`. `analyze-converter check` verifies the original SHA-256-indexed captures before Rust tests; the fixtures remain Xet payloads and the test source remains ordinary Git.
+
+Validation:
+
+- All **58** E02 DAT output files (25 old, 33 latest) decode and re-encode byte-for-byte, including computed brush/patch arrays, sparse UV/string data, width transitions and normalized outputs from malformed legacy inputs. A valid normalized output cannot reveal or repair corruption already introduced by the converter; the captured truncated source inputs are separately rejected.
+- Five integration tests cover the entire output corpus, asymmetric vectors/property/UV/patch semantics, **11** captured malformed/ambiguous inputs, automatic cross-version detection, explicit lossy-downgrade refusal and computed property-free migration matching both converters' bytes, and mixed nonempty brush/patch worlds assembled independently from captured record bytes.
+- **24** synthetic unit tests cover headers, every proper prefix of rich documents, binary ordering/duplicates, limits, string policies, computed consistency, all compact count boundaries through 65,536 (planes, names/UV slots, contours and patch dimensions), arithmetic overflow, finite extremes/non-finites, short/interrupted I/O, partial I/O errors, validation before writing, reserved bits and normalization of valid nonminimal widths. A deterministic 5,000-mutation test checks rejection or stable canonical round trips under tight limits; this is a smoke test, not coverage-guided fuzzing.
+- One compiled API doctest exercises an empty latest world.
+
+The `checks.<system>.rust` Nix derivation runs formatting, Clippy, 24 unit tests and the doctest from an asset-free source fileset. Full integration tests run separately against hydrated, verified captures. The setup derivation still runs the 52 Python regressions and code-tree storage checks. Only macOS ARM64 execution is validated in this stage; Linux/Intel execution, native editor interoperability, real user documents, long-running fuzzing, hostile-stream timeouts, atomic saves and the remaining text/MAP/VMF/OBJ codecs stay open. The declared Rust minimum is 1.85; the measured pinned toolchain is 1.99.0, not a separate minimum-version validation.

docs/TECHNICAL_DIRECTION.md

@@ -1,6 +1,6 @@
 # Proposed technical direction
 
-Storage, environment, hydration, and extraction are implemented; see [SETUP.md](SETUP.md). Rust/rendering/conversion boundaries below remain proposed and must be validated through the [TODO phases](TODO.md).
+Storage, environment, hydration, and extraction are implemented; see [SETUP.md](SETUP.md). The dependency-free `mb3-dat` crate now implements the first native format slice ([compatibility profile](RUST_DAT.md)); the broader Rust/rendering/conversion boundaries below remain proposed and must be validated through the [TODO phases](TODO.md).
 
 ## Storage and repository boundaries
 
@@ -15,7 +15,7 @@ nanobrush/                         # remote hf: git@hf.co:nmarshall/nanobrush
   scripts/                        # setup, storage, hydration, extraction, checks
   tests/                          # ordinary Git test source
   docs/                           # ordinary Git authored findings/specifications
-  crates/                         # future Rust and WGSL source
+  crates/mb3-dat/                 # implemented native DAT library and tests
   assets/references/              # every file is Xet-backed, including small text
     archives/                     # unchanged ZIPs
     provenance/collection/        # original reports/manifest/checksum files
@@ -43,7 +43,7 @@ Provide a lightweight preservation/research shell first. Add the Rust workspace,
 
 ## Planned commands and responsibilities
 
-Setup/storage/hydration/reference commands are implemented. Conversion, oracle, replay, and packaging commands remain proposed interfaces.
+Setup/storage/hydration/reference commands and a converter-only Mono oracle are implemented. The first Rust DAT library is tested through Cargo; a production conversion CLI remains future work. Conversion, oracle, replay, and packaging commands remain proposed interfaces.
 
 | Command | Inputs | Output and acceptance contract |
 | --- | --- | --- |

docs/TODO.md

@@ -1,6 +1,6 @@
 # Exhaustive work list
 
-Baseline: 2026-10-21. The setup and extraction implementation is complete; checked items are verified in [SETUP.md](SETUP.md). The single-repository layout supersedes the initial separate-dataset proposal. Findings F01–F28 are in [FINDINGS.md](FINDINGS.md). The [investigation method](REVERSE_ENGINEERING.md) defines evidence requirements; [technical direction](TECHNICAL_DIRECTION.md) describes proposed boundaries.
+Baseline: 2026-10-21. The setup and extraction implementation is complete; checked items are verified in [SETUP.md](SETUP.md). The single-repository layout supersedes the initial separate-dataset proposal. Findings F01–F29 are in [FINDINGS.md](FINDINGS.md). The [investigation method](REVERSE_ENGINEERING.md) defines evidence requirements; [technical direction](TECHNICAL_DIRECTION.md) describes proposed boundaries.
 
 Each task ID is stable. Split tasks into child IDs as evidence grows. Record dependencies, output documents/code, validation evidence, and remaining limitations when checking a task off. New discoveries extend this list. P0–P2 establish preservation; P3–P9 establish behavioral contracts; P10–P16 implement and prove the rewrite. P10's GPU spike should happen early alongside source research, before renderer architecture is locked.
 
@@ -144,14 +144,16 @@ Each task ID is stable. Split tasks into child IDs as evidence grows. Record dep
 - [ ] P6.12 Measure converter failure cases: empty/missing files, invalid syntax/types, malformed geometry, permission failures, long/non-ASCII paths, output overwrite, and interrupted operation.
 - [ ] P6.13 Define a loss-report schema and compatibility profile; preserve originals and unknown data where feasible, and never silently overwrite a source file after lossy conversion.
 - [ ] P6.14 Choose/version the canonical native format, schema migrations, stable IDs, precision, unknown-field policy, and atomic save strategy. Avoid serializing transient Bevy entities as the only durable model.
-- [ ] P6.15 Implement safe Rust parsers/writers and native `inspect/validate/convert` CLI; fuzz parsers, bound allocation/recursion, and test all supported round trips.
+- [ ] P6.15 Implement safe Rust parsers/writers and native `inspect/validate/convert` CLI; fuzz parsers, bound allocation/recursion, and test all supported round trips. Both DAT codecs and focused fixture/boundary tests are implemented in P6.21; other codecs, the CLI and coverage-guided fuzzing remain open.
 - [ ] P6.16 Verify output interoperability with independent consumers where available, alongside reference-compatible results; separate intentional improvements from differences that indicate bugs.
 
 - [x] P6.17 Document the initial grammar/writer format map and source discrepancies, keeping MB3 DAT, IXModel and plugin artifacts distinct (F15–F20).
 
 - [x] P6.18 Establish a focused two-binary conversion matrix: DAT/TXT properties, computed brushes/patches, width transitions, three brush MAP/VMF round trips, Q3 patch losses, OBJ output and CLI/log/corruption probes; document F26–F28 and 101 captures (E02).
-- [ ] P6.19 Validate recovered DAT structures against native-editor saves/loads and real documents; implement bounded Rust readers/writers for both versions and test semantic/byte round trips using E02 fixtures. Preserve absent versus empty property values.
-- [ ] P6.20 Extend converter/codec coverage: 65,535/65,536 plane/property boundaries, UV width transitions, malformed patch lengths/dimensions, overflow/negative counts, non-finite/extreme floats, embedded NUL/escape edges, duplicate DAT names, Unicode/long paths, log-write failure, interrupted/partial output, independent consumers and Windows/Linux comparison. Fuzz bounded native codecs, not the legacy unbounded string reader.
+- [ ] P6.19 Validate recovered DAT structures against native-editor saves/loads and real documents. The bounded Rust readers/writers, E02 byte/semantic round trips and absent-versus-empty preservation are complete in P6.21; editor/real-document evidence remains open.
+- [ ] P6.20 Extend converter/codec coverage: 65,535/65,536 plane/property boundaries, UV width transitions, malformed patch lengths/dimensions, overflow/negative counts, non-finite/extreme floats, embedded NUL/escape edges, duplicate DAT names, Unicode/long paths, log-write failure, interrupted/partial output, independent consumers and Windows/Linux comparison. Rust synthetic tests now cover 65,535/65,536 plane/property/UV widths, slot sentinels, malformed array consistency, overflow, finite extremes, non-finites and decoder rejection of duplicate slots/reserved bits. Remaining legacy measurements, embedded-NUL/escape edges, platform comparisons and coverage-guided fuzzing remain open. Fuzz bounded native codecs, not the legacy unbounded string reader.
+
+- [x] P6.21 Implement dependency-free safe Rust DAT readers/writers for both versions, bounded streaming I/O and allocations, explicit compatibility policy, checked computed arrays and non-lossy version selection. All 58 E02 DAT outputs round-trip byte-for-byte; 24 unit tests, five integration tests and one doctest validate boundaries and rejection cases ([RUST_DAT.md](RUST_DAT.md), E03/F29).
 
 ## P7 — Input, cameras, grids, views, and editing workflows
 
@@ -312,4 +314,4 @@ Each task ID is stable. Split tasks into child IDs as evidence grows. Record dep
 | M6 Full reconstruction | All required P12/P13 modules and workflows pass parity and GPU checks |
 | M7 Distributable release | P14–P16 regeneration, packaging, documentation, clean-machine acceptance |
 
-Next work after E02: validate the recovered DAT layout against native-editor output and implement safe codecs (P6.19/P6.20); establish the editor/compiler runtime oracle (P3.05–P3.10), derive consumer/dynamic config and localization keys (P3.03), extend format semantics and loss reports (P6), and continue P2.11 resource/semantic version analysis. The synthetic P10 rendering spike remains independent. Linux extraction/runtime validation remains open in P2.12. Treat M2 and M3 as separate gates; source investigation can proceed while GPU work is unresolved.
+Next work after E02: validate the Rust DAT codecs against native-editor output, extend fuzzing/platform coverage and implement the remaining codecs (P6.19/P6.20/P6.15); establish the editor/compiler runtime oracle (P3.05–P3.10), derive consumer/dynamic config and localization keys (P3.03), extend format semantics and loss reports (P6), and continue P2.11 resource/semantic version analysis. The synthetic P10 rendering spike remains independent. Linux extraction/runtime validation remains open in P2.12. Treat M2 and M3 as separate gates; source investigation can proceed while GPU work is unresolved.

docs/experiments/rust-dat-2026-10-21.md

@@ -0,0 +1,37 @@
+# E03 — Safe Rust DAT codecs
+
+Date: 2026-10-21. Scope: implement the two E02 converter DAT layouts as an independent Rust reader/writer, validate fixture parity and deliberate rejection policies, and retain broader editor/format work as open tasks. See [F29](../RUST_DAT.md) for the public API, complete compatibility matrix and resource accounting.
+
+## Inputs and identity
+
+No assets were changed or regenerated. The 58 captured converter DAT outputs and selected source inputs come from E02's existing Xet tree. The full E02 `probes.json` SHA-256 is `d69e2a1e1f61af71fa345e2cab3063b35ed4a58979293d89aec0aec5e948c11d`; it pins per-file identities and converter binary hashes. `analyze-converter check` reverified that manifest, original binary identities and semantic assertions before Rust fixture tests.
+
+The implementation is the dependency-free `mb3-dat` crate in the committed Cargo workspace. Original executables/decompiled code are not Rust dependencies. No original executable was executed by E03. Code and tests are ordinary Git; input fixtures stay in their existing Xet locations. No generated binary fixture bytes were embedded in Rust source; synthetic tests construct small fields or boundary records programmatically.
+
+## Commands and observed results
+
+Host: macOS ARM64, pinned Nix Rust/Cargo 1.99.0. Tests run entirely offline after entering the development environment:
+
+```sh
+cargo fmt --all --check
+cargo clippy --workspace --all-targets --locked --offline -- -D warnings
+analyze-converter check
+cargo test --workspace --locked --offline
+cargo test --workspace --release --locked --offline
+test-setup
+nix build .#checks.aarch64-darwin.rust .#checks.aarch64-darwin.setup --no-link
+```
+
+- Debug and release each pass **24 Rust unit tests, five fixture integration tests and one doctest**. All **58** converter output files re-encode byte-for-byte. Eleven malformed/ambiguous captured inputs are rejected; two captured cross-version inputs are accepted through version detection. Property-free computed migration matches the opposite converter's exact output; mixed nonempty brush/patch worlds match independently composed captured record bytes; a downgrade containing properties fails explicitly.
+- Synthetic tests cover compact count/index widths through 65,536, shared contours, patch dimensions, properties/UVs, every prefix truncation of both rich documents, count/grid overflow, ASCII/NUL policies, finite bit preservation/non-finites, resource accounting, short/interrupted I/O, write failures and no destination writes on validation failure. Five thousand deterministic mutations under tight budgets produce either an error or a stable canonical round trip, with no panic in these runs.
+- Clippy and formatting pass. The separate asset-free Rust Nix derivation runs Clippy/formatting, 24 unit tests and one doctest. The setup Nix derivation passes all **52 Python regressions** and source-tree storage checks.
+
+The fixture suite fails when assets are missing; `cargo test --workspace --lib --locked --offline` and `cargo test --workspace --doc --locked --offline` are the intentional asset-free subset. Compile-only Clippy checks all targets without opening fixture files.
+
+## Interpretation and limits
+
+This proves serializer compatibility for the retained converter corpus, including exact scalar/UV ordering and old/new hierarchy differences. It does not validate native-editor save/load, convex geometry, computed patch evaluation, all legacy malformed inputs, every possible float pattern or every document size. In particular, the old signed-16 writer repair is covered by Rust boundary tests and uses the recovered old reader's existing four-byte branch; direct large-count legacy execution remains open.
+
+The reader deliberately rejects rather than reproduces stale-buffer reads, unterminated-string growth, duplicate slots, high-bit string replacement, reserved flags/selector 3, non-finite numbers and trailing data. It preserves unused property names and original index meaning instead of the converter CLI's usage optimization. These are the fixed compatibility policy in F29, not unexplained regressions.
+
+The four declared Nix systems are evaluation targets; execution in this stage is macOS ARM64 only. Real documents, Linux/Intel execution, minimum-toolchain validation, coverage-guided fuzzing, independent consumers, atomic file workflows and the remaining codecs/CLI remain in P6.15/P6.19/P6.20. P6.21 records the completed DAT implementation without closing those broader tasks.

docs/parity.md

@@ -1,6 +1,6 @@
 # Reference coverage ledger
 
-Initial source coverage, 2026-10-21. Owner for this ledger and the external dependencies listed in [DEPENDENCIES.md](DEPENDENCIES.md): **Nanobrush reference research**. E01 establishes source coverage; E02 adds converter-only runtime observations. No Rust or editor parity is claimed.
+Initial source coverage, 2026-10-21. Owner for this ledger and the external dependencies listed in [DEPENDENCIES.md](DEPENDENCIES.md): **Nanobrush reference research**. E01 establishes source coverage; E02 adds converter-only runtime observations. Rust DAT parity is scoped to the F29 fixtures below; no editor parity is claimed.
 
 Every one of the 560 regular-member occurrences has its own path/hash/category/coverage/owner/follow-up entry in [source-map.json](../assets/analysis/source-map.json). Direct include candidates, qualified calls, interrupt wrappers, tool registrations and literal-resource candidates remain attached to their source file. The human documents summarize behavior without copying the raw reference tree into ordinary Git.
 
@@ -37,3 +37,7 @@ Keep the broad parent TODO tasks open until their promised behavioral evidence e
 ## Converter coverage extension (E02)
 
 [static.json](../assets/analysis/converter/static.json) covers the 183/193 managed methods in both distinct converter binaries with RVAs and hashes; the four 2015 members are byte-identical. [probes.json](../assets/analysis/converter/probes.json) indexes 101 controlled cases and every captured payload. DAT hierarchy is experimentally specified on this corpus; format edge cases and editor cross-validation remain P6.19/P6.20, and external consumers remain P6.16. Broad parent tasks stay open.
+
+## Rust DAT implementation (F29)
+
+`mb3-dat` implements both converter DAT layouts. The five Rust integration tests cover all 58 captured DAT outputs with exact bytes, selected semantic fields, captured malformed-input rejections and version migration. Twenty-four unit tests and one doctest add boundary/resource/I/O checks and 5,000 deterministic mutations. See [the compatibility matrix](RUST_DAT.md) for deliberate strictness and the old signed-16 writer repair. Native-editor conformance, real-document coverage, independent consumer testing and remaining codecs stay open.

docs/risks.md

@@ -17,5 +17,6 @@ Opened 2026-10-21. Owner: Nanobrush reference research. This register tracks con
 | R11 | Mono converter oracle available (E02); editor/compiler and Windows/Linux unavailable | Converter observations cannot establish editor/platform parity | P3.05–P3.12, P6.20 |
 | R12 | Solari/backend/platform qualification still open | Platform goal depends on measured hardware support | Synthetic P10 spike independent of these references |
 | R13 | Static index deliberately lacks full IXPL typing/control-flow | Lexical edge/registration counts can overstate live behavior | Preserve uncertainty; refine analysis and compare actual traces |
-| R14 | Legacy DAT short-read reuse and unbounded string EOF loop (F28) | Corruption, hangs/allocation growth on malformed data | Bounded native parser; P6.19/P6.20 |
+| R14 | Legacy DAT short-read reuse and unbounded string EOF loop (F28) | Corruption, hangs/allocation growth on malformed data | Strict bounded Rust DAT parser implemented (F29); extend fuzzing/editor validation in P6.19/P6.20 |
 | R15 | DAT ASCII loss, BOM-less UTF-8 drift, property normalization and silent MAP/Q3/OBJ losses (F26/F27) | Successful conversions can alter meaningful content | Explicit encoding and loss reports, P6.01/P6.13 |
+| R16 | Rust DAT policy deliberately rejects ambiguous/unknown data and avoids lossy table normalization (F29) | Some converter-accepted files need explicit diagnosis/migration | Preserve originals; validate native-editor/real documents, P6.19/P6.20 |

docs/validation.md

@@ -19,3 +19,9 @@ The current results establish static mapping only. No runtime API contract, form
 [Experiment](experiments/converter-2026-10-21.md): both original binary identities and all generated decompilation/metadata/capture hashes verified. Original executables ran unchanged under Mono 6.14.1 on macOS ARM64: 43 cases for 1.4.0, 58 for 1.5.0 (101 total), with expected exits and semantic/log assertions passing. Fifteen authored network-free tests bring the suite to 52, including every prefix truncation of one representative DAT file. Runtime failures intentionally expected by cases are retained as evidence, including successful corrupt reads. Linux/Windows execution, native editor saves/loads, independent consumer interoperability and Rust parity are still open.
 
 E02 final checks: all 52 tests passed on the host and in the Apple Silicon code-only Nix derivation; converter evidence/semantic checks and E01 source-map reproducibility passed; all five original archives and all 560 extracted files passed preservation verification. Staged storage policy and hydrated asset hashes were checked before committing.
+
+## E03 Rust DAT codecs — 2026-10-21
+
+The [Rust compatibility profile](RUST_DAT.md) and [experiment](experiments/rust-dat-2026-10-21.md) document the implementation and its limits. Debug and release each pass 24 unit tests, five integration tests and one doctest. All 58 captured converter DAT outputs round-trip exactly; 11 captured malformed/ambiguous inputs are rejected; cross-version autodetection and property-free migration are covered. Boundary tests include 65,535/65,536 counts/indices and 5,000 bounded deterministic mutations. Formatting and Clippy with warnings denied pass.
+
+Both Apple Silicon Nix derivations built successfully: the asset-free Rust check runs 24 unit tests/one doctest and lint/format checks; the setup check retains all 52 passing Python tests. Full fixture tests ran separately against the SHA-256-verified E02 corpus. Source/asset storage boundaries are preserved; no fixture payloads moved into ordinary Git. Native-editor interoperability, other-platform execution and coverage-guided fuzzing remain open.

flake.nix

@@ -101,6 +101,9 @@
             codeSource = lib.fileset.toSource {
               root = ./.;
               fileset = lib.fileset.unions [
+                ./Cargo.toml
+                ./Cargo.lock
+                ./crates
                 ./scripts
                 ./tests
                 ./config
@@ -131,6 +134,24 @@
                   python3 scripts/storage_policy.py check-tree ${codeSource}
                   touch $out
                 '';
+            rustCheck =
+              pkgs.runCommand "nanobrush-rust-checks"
+                {
+                  nativeBuildInputs = [
+                    config.rust.toolchain
+                    pkgs.stdenv.cc
+                  ];
+                }
+                ''
+                  cp -R ${codeSource}/. .
+                  chmod -R u+w .
+                  export CARGO_HOME="$TMPDIR/nanobrush-cargo"
+                  cargo fmt --all --check
+                  cargo clippy --workspace --all-targets --locked --offline -- -D warnings
+                  cargo test --workspace --lib --locked --offline
+                  cargo test --workspace --doc --locked --offline
+                  touch $out
+                '';
           in
           {
             packages = scripts;
@@ -161,6 +182,7 @@
               '';
             };
             checks.setup = setupCheck;
+            checks.rust = rustCheck;
             formatter = pkgs.nixfmt;
           };
       }