Timeline

The name bytes were always correct UTF-8 and general-purpose bit 11 was never set, so a conforming reader must decode them as CP437 and a committed 'café.txt' extracted as 'caf├⌐.txt'. Both headers now take the flag from one constant: a reader trusts the central directory for metadata, so setting it on the local header alone would still ship the bug. Set unconditionally, since ASCII is a subset of UTF-8 and one value cannot disagree with itself. Content and the data-descriptor bit are unchanged. check-in: 3caf366005 user: dmestas tags: trunk

The first nightly soak flipped one bit in a valid container and brought the process down inside the standard inflate: an integer underflow in its end-of-input bit peek that a truncated stream can arrange, reachable from any peer through every sync body. The decoder is now the tree's own copy of the standard one (Zig 0.16.0, MIT) with the comparison reordered so the stream ends, and its origin noted. With the crash gone the same bytes decoded to 58 bytes reported as good: the flip made a block final, and the zlib footer's Adler-32 was read but never checked, by the decoder or by us. The codec now requires a finished stream and verifies the footer against the output. The exact bytes are a fixed test. check-in: 46fcd75fc3 user: dmestas tags: trunk