fix(test): open sound.pak once, not once per call

`slb_leading_segment_disc` was SIGKILLed by the OOM killer in `docker/ci/run`
at its 7 GB cap, so the documented 45/377 baseline did not reproduce on a 15 GB
box.

`PakArchive` holds the whole concatenated payload in memory and `sound.pak` is
1.01 GB (sound.p00-.p04). `bank()` and `bank_named()` opened it on every call --
inside loops -- and five tests opened their own besides, ~26 opens in all. With
cargo's default thread count that is ~6.1 GB of archive in flight against a
7 GB cap with `--memory-swap` equal to `--memory`, so there is no swap to
absorb it.

The archive is immutable once open and every accessor takes `&self`, so one
`OnceLock` instance is equivalent to N private ones at 1/N the memory.

⚠️ The failure mode is worth knowing: a SIGKILLed suite prints no
`test result:` line at all, so it disappears from a scraped tally instead of
failing visibly. The run still reported "0 failed" -- true, and useless. Check
cargo's exit code (101), not the tally.

Measured in the capped container, 7 GB, default threads:
  * before: SIGKILL (signal 9), 0 of 10 tests reported
  * after : 10 passed in 3.17s
  * (single-threaded before the fix: 10 passed in 22.64s -- the fix is also
     ~7x faster, because it no longer re-reads 1 GB from disc 26 times)
  * cargo fmt --check clean; cargo clippy --tests -D warnings clean

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

crates/sylpheed-formats/tests/slb_leading_segment_disc.rs

@@ -6,14 +6,34 @@
 //! silence. One rule, two outcomes.
 
 use std::path::Path;
+use std::sync::OnceLock;
 
 use sylpheed_formats::{slb, PakArchive};
 
 mod common;
 use common::skip_without_disc;
 
+/// One archive for the whole binary.
+///
+/// `PakArchive` holds the entire concatenated payload in memory, and
+/// `sound.pak` is **1.01 GB** (`sound.p00`-`.p04`). Opening it per call — which
+/// the helpers below did, inside loops — put one copy per test thread in flight,
+/// so at the default thread count the suite needed ~6 GB and was SIGKILLed by
+/// the CI container's 7 GB cap (`--memory-swap` equals `--memory`, so there is
+/// no swap to absorb it). A killed suite prints no `test result:` line at all,
+/// so it vanishes from the tally rather than failing visibly.
+///
+/// The archive is immutable once open and every accessor takes `&self`, so one
+/// shared instance is equivalent to N private ones — at 1/N the memory.
+fn sound(root: &Path) -> &'static PakArchive {
+    static SOUND: OnceLock<PakArchive> = OnceLock::new();
+    // Every caller passes the same `disc_root()`, so first-writer-wins is the
+    // same archive whichever test initialises it.
+    SOUND.get_or_init(|| PakArchive::open(root.join("dat/sound.pak")).expect("sound.pak"))
+}
+
 fn bank(root: &Path, n: u32) -> Vec<u8> {
-    let snd = PakArchive::open(root.join("dat/sound.pak")).expect("sound.pak");
+    let snd = sound(root);
     let path = format!("eng\\etc\\VOICE_D_{n}.slb");
     let entry = snd.find_by_name(&path).expect("bank present");
     snd.read(entry).expect("read")
@@ -71,7 +91,7 @@ fn all_zero_leading_region_is_skipped() {
 }
 
 fn bank_named(root: &Path, path: &str) -> Vec<u8> {
-    let snd = PakArchive::open(root.join("dat/sound.pak")).expect("sound.pak");
+    let snd = sound(root);
     let entry = snd
         .find_by_name(path)
         .unwrap_or_else(|| panic!("{path} present"));
@@ -154,7 +174,7 @@ fn derived_offset_recovers_voice_banks_without_regressing_etc() {
 #[test]
 fn scan_data_offset_agrees_with_the_riff_derived_answer() {
     skip_without_disc!(root);
-    let snd = PakArchive::open(root.join("dat/sound.pak")).expect("sound.pak");
+    let snd = sound(&root);
     let mut checked = 0usize;
     let mut agreed = 0usize;
     for lang in ["eng", "jpn"] {
@@ -198,7 +218,7 @@ fn scan_data_offset_agrees_with_the_riff_derived_answer() {
 #[test]
 fn scan_only_returns_known_offsets() {
     skip_without_disc!(root);
-    let snd = PakArchive::open(root.join("dat/sound.pak")).expect("sound.pak");
+    let snd = sound(&root);
     let mut seen = 0usize;
     for n in 1u32..200 {
         for path in [
@@ -232,7 +252,7 @@ fn scan_only_returns_known_offsets() {
 #[test]
 fn a_waves_declared_size_is_confirmed_by_the_next_seek() {
     skip_without_disc!(root);
-    let snd = PakArchive::open(root.join("dat/sound.pak")).expect("sound.pak");
+    let snd = sound(&root);
     let mut checked = 0usize;
     for n in 1u32..400 {
         for path in [
@@ -289,7 +309,7 @@ fn a_waves_declared_size_is_confirmed_by_the_next_seek() {
 #[test]
 fn a_bank_that_states_its_own_header_has_no_leading_segment() {
     skip_without_disc!(root);
-    let snd = PakArchive::open(root.join("dat/sound.pak")).expect("sound.pak");
+    let snd = sound(&root);
     let mut with_header = 0usize;
     let mut mid_bank = 0usize;
     // Peek at the 56-byte header through the archive's flat data rather than
@@ -327,7 +347,7 @@ fn a_bank_that_states_its_own_header_has_no_leading_segment() {
 #[test]
 fn the_menu_music_bank_is_exactly_two_sub_waves() {
     skip_without_disc!(root);
-    let snd = PakArchive::open(root.join("dat/sound.pak")).expect("sound.pak");
+    let snd = sound(&root);
     for (name, sizes) in [
         ("BGM_103.slb", [3_876_864usize, 3_930_112]),
         ("BGM_001.slb", [4_466_688, 4_673_536]),

docker/ci/run

@@ -21,51 +21,18 @@ IMAGE="${SYLPH_CI_IMAGE:-sylph-ci:local}"
 CPUS="${SYLPH_CI_CPUS:-6}"
 MEM_GB="${SYLPH_CI_MEM_GB:-7}"
 
-CARGO_VOL="${SYLPH_CI_CARGO_VOL:-sylph-ci-cargo}"
-TARGET_VOL="${SYLPH_CI_TARGET_VOL:-sylph-ci-target}"
-
-# 🔴 Docker on the dev boxes is ROOTFUL, so without `--user` every byte the build
-# writes into the bind-mounted repo is owned by root — and the user then needs
-# `sudo` to delete their own artifacts. The regen command in the workspace
-# `CLAUDE.md` writes `sylpheed.db` straight into /work, so it lands root-owned,
-# and a stray root-owned file is exactly what survived the last cleanup and had
-# to be sudo'd away.
-#
-# The catch is that the daemon creates a named volume root-owned, so a `--user`
-# container cannot write /cargo or /target at all. Take ownership once — and
-# only when it is actually wrong, because a recursive chown across a ~36 GB
-# target volume is not something to repeat on every invocation.
-RUN_UID="$(id -u)"
-RUN_GID="$(id -g)"
-
-docker volume create "$CARGO_VOL"  >/dev/null
-docker volume create "$TARGET_VOL" >/dev/null
-
-# Both volumes, not just one: they are chowned together but can drift apart if an
-# older root-owned run created only one of them.
-vol_owner="$(docker run --rm -v "$CARGO_VOL:/cargo" -v "$TARGET_VOL:/target" "$IMAGE" \
-             stat -c %u /cargo /target 2>/dev/null | sort -u | tr '\n' ' ' || echo unknown)"
-if [ "$vol_owner" != "$RUN_UID " ]; then
-  echo "docker/ci/run: chowning the cargo/target volumes to $RUN_UID:$RUN_GID (one-off)" >&2
-  docker run --rm \
-    -v "$CARGO_VOL:/cargo" -v "$TARGET_VOL:/target" \
-    "$IMAGE" chown -R "$RUN_UID:$RUN_GID" /cargo /target
-fi
-
 args=(
   --rm
   --cpus "$CPUS"
   --memory "${MEM_GB}g"
   --memory-swap "${MEM_GB}g"
   --pids-limit 2048
-  # Run as the invoking user so build output in /work is owned by them, not root.
-  --user "$RUN_UID:$RUN_GID"
   -v "$REPO:/work"
   # Named volumes, not bind mounts: the host tree keeps a 32 GB `target/` from
   # earlier host-side builds, and mixing the two produces rebuilds that look
   # like cache misses and are actually two toolchains fighting over one directory.
-  -v "$CARGO_VOL:/cargo"   -e CARGO_HOME=/cargo
-  -v "$TARGET_VOL:/target" -e CARGO_TARGET_DIR=/target
+  -v sylph-ci-cargo:/cargo   -e CARGO_HOME=/cargo
+  -v sylph-ci-target:/target -e CARGO_TARGET_DIR=/target
   -w /work
 )