Phase 1: V4L2/MJPEG camera path to fullscreen SDL3 output

A small live-video-to-display appliance for the church stream machine,
replacing MPV/GStreamer for two fixed jobs. This lands job 1 end to end and
scaffolds job 2.

Pipeline: V4L2 mmap capture -> TurboJPEG decode to YUV planes -> interleave to
packed YUY2 -> SDL3 streaming texture -> borderless fullscreen on a chosen
Wayland output. The GPU does the colour conversion, so no CPU matrix multiply
and half the upload bandwidth of RGBA.

Latency is managed by dropping, never queueing: the driver queue is drained to
its newest buffer each wakeup, and a one-deep slot between the input thread and
the renderer discards any frame the renderer has not taken.

Dependency tree is two crates (sdl3-sys, libc). V4L2 and TurboJPEG are
hand-written FFI; the V4L2 struct layouts were taken from the target kernel's
headers and are pinned by compile-time assertions.

Three hardware behaviours found while validating against the real ATEM:

* /dev/video1 is a metadata node with no formats, so MJPEG on /dev/video0 is
  the only path on this hardware.
* The ATEM pads frames with a few bytes before the EOI marker. libjpeg warns,
  and TurboJPEG returns -1 for a warning as well as a failure, so the first
  cut rejected ~97% of frames. Warnings are now distinguished from failures
  via tj3GetErrorCode, with a structural SOI/EOI check to still catch
  genuinely truncated frames.
* On KDE Wayland, SDL reports monitor model names, not connector names.

Also fixes sticky libjpeg error state, where one corrupt frame would latch an
error and fail every valid frame after it.

87 tests. Verified on the real ATEM: sustained 30.0 fps, 0 undecodable frames,
0 frames dropped before display, ~33% of one core.

tests/cli.rs

@@ -0,0 +1,350 @@
+//! CLI and profile-file parsing, including the invalid cases a launcher could
+//! hand us at 09:55 on a Sunday.
+
+use std::path::PathBuf;
+use video_output::cli::{
+    parse_args, parse_args_with_loader, parse_fps, parse_size, settings_from_profile, Command,
+    ParseError, Settings, Source,
+};
+use video_output::display::DisplaySelector;
+use video_output::log::Level;
+
+fn args(v: &[&str]) -> Vec<String> {
+    v.iter().map(|s| s.to_string()).collect()
+}
+
+fn run_settings(v: &[&str]) -> Settings {
+    match parse_args(&args(v)) {
+        Ok(Command::Run(s)) => *s,
+        other => panic!("expected Run, got {other:?}"),
+    }
+}
+
+/// A loader that serves one in-memory profile, so tests never touch /etc.
+fn loader(name: &'static str, body: &'static str) -> impl Fn(&str) -> Result<(PathBuf, String), ParseError> {
+    move |asked: &str| {
+        if asked == name {
+            Ok((PathBuf::from(format!("/test/{asked}.toml")), body.to_string()))
+        } else {
+            Err(ParseError(format!("no such profile {asked:?}")))
+        }
+    }
+}
+
+// --- subcommands ------------------------------------------------------------
+
+#[test]
+fn bare_subcommands_are_recognised() {
+    assert_eq!(parse_args(&args(&["displays"])).unwrap(), Command::ListDisplays);
+    assert_eq!(parse_args(&args(&["devices"])).unwrap(), Command::ListDevices);
+    assert_eq!(parse_args(&args(&["--help"])).unwrap(), Command::Help);
+    assert_eq!(parse_args(&args(&["-h"])).unwrap(), Command::Help);
+    assert_eq!(parse_args(&args(&["--version"])).unwrap(), Command::Version);
+    assert_eq!(
+        parse_args(&args(&["ndi-sources"])).unwrap(),
+        Command::ListNdiSources { timeout_secs: 5 }
+    );
+    assert_eq!(
+        parse_args(&args(&["ndi-sources", "--timeout", "20"])).unwrap(),
+        Command::ListNdiSources { timeout_secs: 20 }
+    );
+}
+
+#[test]
+fn no_arguments_is_an_error_with_usage() {
+    let e = parse_args(&[]).unwrap_err();
+    assert!(e.0.contains("USAGE"), "should print usage, got: {}", e.0);
+}
+
+// --- camera -----------------------------------------------------------------
+
+#[test]
+fn camera_defaults_match_the_atem() {
+    let s = run_settings(&["camera"]);
+    match s.source {
+        Source::Camera { device, width, height, fps_num, fps_den } => {
+            assert_eq!(device, "/dev/video0");
+            assert_eq!((width, height), (1920, 1080));
+            assert_eq!((fps_num, fps_den), (30000, 1001), "29.97 must stay exact");
+        }
+        other => panic!("expected Camera, got {other:?}"),
+    }
+    assert_eq!(s.display, DisplaySelector::Primary);
+    assert!(s.vsync);
+    assert!(s.fullscreen);
+}
+
+#[test]
+fn camera_accepts_the_documented_invocation() {
+    let s = run_settings(&["camera", "--device", "/dev/video2", "--display", "HDMI-A-2"]);
+    match s.source {
+        Source::Camera { device, .. } => assert_eq!(device, "/dev/video2"),
+        other => panic!("expected Camera, got {other:?}"),
+    }
+    assert_eq!(s.display, DisplaySelector::Name("HDMI-A-2".into()));
+}
+
+#[test]
+fn camera_options_override_defaults() {
+    let s = run_settings(&[
+        "camera", "--size", "1280x720", "--fps", "60", "--no-vsync", "--windowed",
+        "--log", "debug", "--stats", "0", "--display", "1",
+    ]);
+    match s.source {
+        Source::Camera { width, height, fps_num, fps_den, .. } => {
+            assert_eq!((width, height), (1280, 720));
+            assert_eq!((fps_num, fps_den), (60, 1));
+        }
+        other => panic!("expected Camera, got {other:?}"),
+    }
+    assert!(!s.vsync);
+    assert!(!s.fullscreen);
+    assert_eq!(s.log_level, Some(Level::Debug));
+    assert_eq!(s.stats_interval, 0);
+    assert_eq!(s.display, DisplaySelector::Index(1));
+}
+
+// --- ndi --------------------------------------------------------------------
+
+#[test]
+fn ndi_defaults_to_the_first_source_found() {
+    let s = run_settings(&["ndi"]);
+    match s.source {
+        Source::Ndi { source, extra_ips } => {
+            assert_eq!(source, None);
+            assert!(extra_ips.is_empty());
+        }
+        other => panic!("expected Ndi, got {other:?}"),
+    }
+}
+
+#[test]
+fn ndi_accepts_a_source_name_and_repeated_ip_hints() {
+    let s = run_settings(&[
+        "ndi", "--source", "ProPresenter Lower Thirds",
+        "--extra-ip", "10.0.0.5", "--extra-ip", "10.0.0.6",
+        "--display", "HDMI-A-1",
+    ]);
+    match s.source {
+        Source::Ndi { source, extra_ips } => {
+            assert_eq!(source.as_deref(), Some("ProPresenter Lower Thirds"));
+            assert_eq!(extra_ips, vec!["10.0.0.5", "10.0.0.6"]);
+        }
+        other => panic!("expected Ndi, got {other:?}"),
+    }
+    assert_eq!(s.display, DisplaySelector::Name("HDMI-A-1".into()));
+}
+
+// --- rejected input ---------------------------------------------------------
+
+#[test]
+fn options_are_rejected_for_the_wrong_mode() {
+    assert!(parse_args(&args(&["camera", "--source", "x"])).is_err());
+    assert!(parse_args(&args(&["camera", "--extra-ip", "1.2.3.4"])).is_err());
+    assert!(parse_args(&args(&["ndi", "--device", "/dev/video0"])).is_err());
+    assert!(parse_args(&args(&["ndi", "--size", "1920x1080"])).is_err());
+    assert!(parse_args(&args(&["ndi", "--fps", "30"])).is_err());
+}
+
+#[test]
+fn unknown_options_and_missing_values_are_rejected() {
+    assert!(parse_args(&args(&["camera", "--nonsense"])).is_err());
+    assert!(parse_args(&args(&["camera", "--device"])).is_err());
+    assert!(parse_args(&args(&["camera", "--display"])).is_err());
+    assert!(parse_args(&args(&["--display", "HDMI-1"])).is_err(), "options need a command first");
+}
+
+#[test]
+fn malformed_values_are_rejected() {
+    assert!(parse_args(&args(&["camera", "--size", "1920"])).is_err());
+    assert!(parse_args(&args(&["camera", "--size", "0x1080"])).is_err());
+    assert!(parse_args(&args(&["camera", "--size", "axb"])).is_err());
+    assert!(parse_args(&args(&["camera", "--fps", "0"])).is_err());
+    assert!(parse_args(&args(&["camera", "--fps", "-5"])).is_err());
+    assert!(parse_args(&args(&["camera", "--fps", "abc"])).is_err());
+    assert!(parse_args(&args(&["camera", "--log", "louder"])).is_err());
+    assert!(parse_args(&args(&["camera", "--stats", "soon"])).is_err());
+    assert!(parse_args(&args(&["camera", "--device", ""])).is_err());
+}
+
+#[test]
+fn an_unknown_profile_name_lists_where_it_looked() {
+    let e = parse_args(&args(&["definitely-not-a-profile"])).unwrap_err();
+    assert!(e.0.contains("/etc/video-output/definitely-not-a-profile.toml"), "got: {}", e.0);
+}
+
+#[test]
+fn profile_names_cannot_escape_the_search_path() {
+    assert!(parse_args(&args(&["../../etc/passwd"])).is_err());
+    assert!(parse_args(&args(&["/etc/shadow"])).is_err());
+}
+
+// --- size and fps parsing ---------------------------------------------------
+
+#[test]
+fn size_parsing_accepts_the_forms_people_type() {
+    assert_eq!(parse_size("1920x1080").unwrap(), (1920, 1080));
+    assert_eq!(parse_size("1920X1080").unwrap(), (1920, 1080));
+    assert_eq!(parse_size(" 1280 x 720 ").unwrap(), (1280, 720));
+}
+
+/// Broadcast rates must stay exact rationals. Sending 2997/100 to V4L2 makes a
+/// UVC device round to 30 and free-run against the source.
+#[test]
+fn fps_parsing_snaps_decimals_to_exact_broadcast_rationals() {
+    assert_eq!(parse_fps("29.97").unwrap(), (30000, 1001));
+    assert_eq!(parse_fps("59.94").unwrap(), (60000, 1001));
+    assert_eq!(parse_fps("23.976").unwrap(), (24000, 1001));
+    assert_eq!(parse_fps("30000/1001").unwrap(), (30000, 1001));
+    assert_eq!(parse_fps("30").unwrap(), (30, 1));
+    assert_eq!(parse_fps("25").unwrap(), (25, 1));
+}
+
+#[test]
+fn fps_parsing_rejects_nonsense() {
+    assert!(parse_fps("0").is_err());
+    assert!(parse_fps("0/30").is_err());
+    assert!(parse_fps("30/0").is_err());
+    assert!(parse_fps("-1").is_err());
+    assert!(parse_fps("inf").is_err());
+    assert!(parse_fps("").is_err());
+}
+
+// --- profiles ---------------------------------------------------------------
+
+#[test]
+fn a_camera_profile_produces_the_same_settings_as_flags() {
+    let s = settings_from_profile(
+        r#"
+        # ATEM multiview feed
+        mode    = "camera"
+        device  = "/dev/video0"
+        display = "HXA BMD HDMI"
+        size    = "1920x1080"
+        fps     = "29.97"
+        "#,
+    )
+    .unwrap();
+
+    match s.source {
+        Source::Camera { device, width, height, fps_num, fps_den } => {
+            assert_eq!(device, "/dev/video0");
+            assert_eq!((width, height), (1920, 1080));
+            assert_eq!((fps_num, fps_den), (30000, 1001));
+        }
+        other => panic!("expected Camera, got {other:?}"),
+    }
+    assert_eq!(s.display, DisplaySelector::Name("HXA BMD HDMI".into()));
+}
+
+#[test]
+fn an_ndi_profile_accumulates_repeated_ip_hints() {
+    let s = settings_from_profile(
+        r#"
+        mode     = "ndi"
+        source   = "ProPresenter Lower Thirds"
+        display  = "HDMI-A-1"
+        extra-ip = "10.0.0.5"
+        extra-ip = "10.0.0.6"
+        vsync    = false
+        stats    = 30
+        "#,
+    )
+    .unwrap();
+
+    match s.source {
+        Source::Ndi { source, extra_ips } => {
+            assert_eq!(source.as_deref(), Some("ProPresenter Lower Thirds"));
+            assert_eq!(extra_ips, vec!["10.0.0.5", "10.0.0.6"]);
+        }
+        other => panic!("expected Ndi, got {other:?}"),
+    }
+    assert!(!s.vsync);
+    assert_eq!(s.stats_interval, 30);
+}
+
+#[test]
+fn profile_keys_accept_underscores_and_leading_dashes() {
+    let s = settings_from_profile("mode = \"camera\"\n--log_level = \"warn\"\n").unwrap();
+    assert_eq!(s.log_level, Some(Level::Warn));
+}
+
+#[test]
+fn comments_and_blank_lines_are_ignored_but_hashes_in_values_survive() {
+    let s = settings_from_profile(
+        "\n# leading comment\nmode = \"ndi\"   # trailing comment\n\nsource = \"Rig #2 Lower Thirds\"\n",
+    )
+    .unwrap();
+    match s.source {
+        Source::Ndi { source, .. } => assert_eq!(source.as_deref(), Some("Rig #2 Lower Thirds")),
+        other => panic!("expected Ndi, got {other:?}"),
+    }
+}
+
+/// A typo must fail at startup rather than silently running the wrong config.
+#[test]
+fn unknown_profile_keys_are_rejected() {
+    let e = settings_from_profile("mode = \"camera\"\ndisplya = \"HDMI-1\"\n").unwrap_err();
+    assert!(e.0.contains("displya"), "got: {}", e.0);
+}
+
+#[test]
+fn invalid_profiles_are_rejected() {
+    assert!(settings_from_profile("device = \"/dev/video0\"").is_err(), "missing mode");
+    assert!(settings_from_profile("mode = \"telepathy\"").is_err(), "unknown mode");
+    assert!(settings_from_profile("mode = \"camera\"\nthis line has no equals\n").is_err());
+    assert!(settings_from_profile("mode = \"camera\"\n[section]\nkey = 1\n").is_err(), "no tables");
+    assert!(settings_from_profile("mode = \"camera\"\ndevice = \"a\"\ndevice = \"b\"\n").is_err(), "duplicate key");
+    assert!(settings_from_profile("mode = \"camera\"\nvsync = \"maybe\"\n").is_err());
+    assert!(settings_from_profile("mode = \"camera\"\nfps = \"quick\"\n").is_err());
+    assert!(settings_from_profile("mode = \"ndi\"\nsize = \"1920x1080\"\n").is_err(), "size is camera-only");
+    assert!(settings_from_profile("mode = \"camera\"\nextra-ip = \"1.2.3.4\"\n").is_err(), "extra-ip is ndi-only");
+}
+
+#[test]
+fn booleans_accept_the_usual_spellings() {
+    for (text, want) in [("true", true), ("yes", true), ("on", true), ("1", true),
+                         ("false", false), ("no", false), ("off", false), ("0", false)] {
+        let s = settings_from_profile(&format!("mode = \"camera\"\nvsync = {text}\n")).unwrap();
+        assert_eq!(s.vsync, want, "vsync = {text}");
+    }
+}
+
+// --- profile + flag interaction ---------------------------------------------
+
+#[test]
+fn a_profile_name_resolves_through_the_loader() {
+    let load = loader("multiview", "mode = \"camera\"\ndevice = \"/dev/video0\"\ndisplay = \"BMD\"\n");
+    match parse_args_with_loader(&args(&["multiview"]), &load).unwrap() {
+        Command::Run(s) => {
+            assert_eq!(s.display, DisplaySelector::Name("BMD".into()));
+            match &s.source {
+                Source::Camera { device, .. } => assert_eq!(device, "/dev/video0"),
+                other => panic!("expected Camera, got {other:?}"),
+            }
+        }
+        other => panic!("expected Run, got {other:?}"),
+    }
+}
+
+/// Flags after a profile name win, so an operator can override one setting
+/// without editing the file.
+#[test]
+fn flags_override_profile_values() {
+    let load = loader("multiview", "mode = \"camera\"\ndevice = \"/dev/video0\"\ndisplay = \"BMD\"\n");
+    match parse_args_with_loader(&args(&["multiview", "--display", "Sceptre", "--no-vsync"]), &load).unwrap() {
+        Command::Run(s) => {
+            assert_eq!(s.display, DisplaySelector::Name("Sceptre".into()));
+            assert!(!s.vsync);
+        }
+        other => panic!("expected Run, got {other:?}"),
+    }
+}
+
+#[test]
+fn a_profile_error_names_the_file() {
+    let load = loader("broken", "mode = \"camera\"\nbogus = 1\n");
+    let e = parse_args_with_loader(&args(&["broken"]), &load).unwrap_err();
+    assert!(e.0.contains("/test/broken.toml"), "got: {}", e.0);
+    assert!(e.0.contains("bogus"), "got: {}", e.0);
+}

tests/data/generate.py

@@ -0,0 +1,24 @@
+#!/usr/bin/env python3
+"""Regenerates the JPEG fixtures used by tests/decode.rs.
+
+Run from the repository root:  python3 tests/data/generate.py
+
+Each fixture is a solid colour so the test can assert exact sample values
+after decoding. Green is deliberate: it is the colour the ATEM keys on, and a
+wrong YUV matrix or range shows up here before it shows up on stage.
+"""
+from PIL import Image
+import pathlib
+
+OUT = pathlib.Path(__file__).parent
+W, H = 64, 32
+GREEN = (0, 255, 0)
+
+# PIL subsampling codes: 0 = 4:4:4, 1 = 4:2:2, 2 = 4:2:0
+for name, subs in [("green-444.jpg", 0), ("green-422.jpg", 1), ("green-420.jpg", 2)]:
+    Image.new("RGB", (W, H), GREEN).save(OUT / name, "JPEG", quality=95, subsampling=subs)
+
+Image.new("L", (W, H), 128).save(OUT / "gray.jpg", "JPEG", quality=95)
+
+for p in sorted(OUT.glob("*.jpg")):
+    print(f"{p.name}: {p.stat().st_size} bytes")

tests/decode.rs

@@ -0,0 +1,178 @@
+//! End-to-end MJPEG decode tests against real JPEG files.
+//!
+//! Fixtures are solid green -- the colour the ATEM chroma keys on -- so a wrong
+//! YUV matrix, a swapped Cb/Cr, or a studio-vs-full range mistake fails here
+//! rather than on stage. Regenerate them with `python3 tests/data/generate.py`.
+
+use video_output::frame::{NullPool, PixelFormat};
+use video_output::inputs::mjpeg::MjpegDecoder;
+
+const W: u32 = 64;
+const H: u32 = 32;
+
+/// Full-range BT.601 for pure green (0, 255, 0), which is what JFIF stores.
+const GREEN_Y: u8 = 150;
+const GREEN_CB: u8 = 44;
+const GREEN_CR: u8 = 21;
+
+/// JPEG at quality 95 on a flat colour lands within a couple of levels.
+const TOL: i32 = 4;
+
+fn fixture(name: &str) -> Vec<u8> {
+    let p = concat!(env!("CARGO_MANIFEST_DIR"), "/tests/data/");
+    std::fs::read(format!("{p}{name}")).unwrap_or_else(|e| panic!("reading {name}: {e}"))
+}
+
+fn close(got: u8, want: u8, label: &str) {
+    let d = (got as i32 - want as i32).abs();
+    assert!(d <= TOL, "{label}: got {got}, expected ~{want} (tolerance {TOL})");
+}
+
+#[test]
+fn decodes_422_into_packed_yuy2() {
+    let mut d = MjpegDecoder::new().unwrap();
+    let frame = d.decode(&fixture("green-422.jpg"), &NullPool, 1).unwrap();
+
+    assert_eq!((frame.width, frame.height), (W, H));
+    assert_eq!(frame.format, PixelFormat::Yuy2, "4:2:2 must take the zero-conversion path");
+    assert_eq!(frame.layout.total, (W * H * 2) as usize);
+    assert_eq!(frame.seq, 1);
+
+    // YUY2 byte order is Y0 U Y1 V.
+    let p = frame.plane(0);
+    close(p[0], GREEN_Y, "Y0");
+    close(p[1], GREEN_CB, "U");
+    close(p[2], GREEN_Y, "Y1");
+    close(p[3], GREEN_CR, "V");
+
+    // The whole frame is one colour, so the pattern must hold everywhere --
+    // this catches a stride or interleave bug that only shows on later rows.
+    for (i, quad) in p.chunks_exact(4).enumerate() {
+        close(quad[0], GREEN_Y, &format!("Y0 at quad {i}"));
+        close(quad[1], GREEN_CB, &format!("U at quad {i}"));
+        close(quad[2], GREEN_Y, &format!("Y1 at quad {i}"));
+        close(quad[3], GREEN_CR, &format!("V at quad {i}"));
+    }
+}
+
+#[test]
+fn decodes_420_into_planar_i420() {
+    let mut d = MjpegDecoder::new().unwrap();
+    let frame = d.decode(&fixture("green-420.jpg"), &NullPool, 2).unwrap();
+
+    assert_eq!(frame.format, PixelFormat::I420);
+    assert_eq!(frame.layout.total, (W * H * 3 / 2) as usize);
+
+    let y = frame.plane(0);
+    let u = frame.plane(1);
+    let v = frame.plane(2);
+    assert_eq!(y.len(), (W * H) as usize);
+    assert_eq!(u.len(), (W / 2 * H / 2) as usize);
+    assert_eq!(v.len(), (W / 2 * H / 2) as usize);
+
+    for (i, &s) in y.iter().enumerate() {
+        close(s, GREEN_Y, &format!("Y[{i}]"));
+    }
+    for (i, &s) in u.iter().enumerate() {
+        close(s, GREEN_CB, &format!("U[{i}]"));
+    }
+    for (i, &s) in v.iter().enumerate() {
+        close(s, GREEN_CR, &format!("V[{i}]"));
+    }
+}
+
+#[test]
+fn decodes_444_through_the_bgrx_fallback() {
+    let mut d = MjpegDecoder::new().unwrap();
+    let frame = d.decode(&fixture("green-444.jpg"), &NullPool, 3).unwrap();
+
+    assert_eq!(frame.format, PixelFormat::Bgrx, "4:4:4 has no packed YUV equivalent");
+    assert_eq!(frame.layout.total, (W * H * 4) as usize);
+
+    // Byte order is B, G, R, X.
+    for (i, px) in frame.plane(0).chunks_exact(4).enumerate() {
+        close(px[0], 0, &format!("B at {i}"));
+        close(px[1], 255, &format!("G at {i}"));
+        close(px[2], 0, &format!("R at {i}"));
+    }
+}
+
+#[test]
+fn decodes_grayscale_through_the_bgrx_fallback() {
+    let mut d = MjpegDecoder::new().unwrap();
+    let frame = d.decode(&fixture("gray.jpg"), &NullPool, 4).unwrap();
+
+    assert_eq!(frame.format, PixelFormat::Bgrx);
+    for px in frame.plane(0).chunks_exact(4) {
+        close(px[0], 128, "B");
+        close(px[1], 128, "G");
+        close(px[2], 128, "R");
+    }
+}
+
+#[test]
+fn header_read_reports_dimensions_and_subsampling() {
+    let mut d = MjpegDecoder::new().unwrap();
+    let info = d.read_header(&fixture("green-422.jpg")).unwrap();
+    assert_eq!((info.width, info.height), (W, H));
+    assert_eq!(info.subsamp_name(), "4:2:2");
+    assert_eq!(info.colorspace_name(), "YCbCr");
+    assert_eq!(info.target_format(), PixelFormat::Yuy2);
+}
+
+/// The failure mode that actually happens on USB: a frame that stops early.
+/// Every truncation length must be rejected without panicking or reading out
+/// of bounds.
+#[test]
+fn every_truncation_of_a_real_jpeg_fails_cleanly() {
+    let full = fixture("green-422.jpg");
+    let mut d = MjpegDecoder::new().unwrap();
+
+    for cut in 1..full.len() {
+        let partial = &full[..cut];
+        // Must not panic. Success is acceptable only at the full length.
+        let _ = d.decode(partial, &NullPool, cut as u64);
+    }
+
+    // The decoder must still work afterwards -- no poisoned state.
+    let frame = d.decode(&full, &NullPool, 999).unwrap();
+    assert_eq!(frame.format, PixelFormat::Yuy2);
+    assert_eq!(frame.seq, 999);
+}
+
+/// Bit flips inside the entropy-coded data are the other common USB fault.
+#[test]
+fn corrupted_payloads_never_panic_and_leave_the_decoder_usable() {
+    let full = fixture("green-422.jpg");
+    let mut d = MjpegDecoder::new().unwrap();
+
+    for seed in 0..200u32 {
+        let mut bad = full.clone();
+        let i = (seed as usize * 7 + 100) % bad.len();
+        bad[i] ^= 0xFF;
+        let _ = d.decode(&bad, &NullPool, seed as u64);
+    }
+
+    assert!(d.decode(&full, &NullPool, 1).is_ok(), "decoder must survive a burst of corruption");
+}
+
+#[test]
+fn non_jpeg_input_is_rejected() {
+    let mut d = MjpegDecoder::new().unwrap();
+    assert!(d.decode(b"not a jpeg at all, not even close", &NullPool, 0).is_err());
+    assert!(d.decode(&[], &NullPool, 0).is_err());
+    assert!(d.decode(&[0xFF; 1024], &NullPool, 0).is_err());
+}
+
+/// Decoding many frames through one decoder must not grow memory or drift --
+/// this is the steady state the appliance actually runs in.
+#[test]
+fn repeated_decodes_are_stable() {
+    let data = fixture("green-422.jpg");
+    let mut d = MjpegDecoder::new().unwrap();
+    for seq in 0..100 {
+        let f = d.decode(&data, &NullPool, seq).unwrap();
+        assert_eq!(f.layout.total, (W * H * 2) as usize);
+        close(f.plane(0)[0], GREEN_Y, "Y across repeats");
+    }
+}