From 6938b25ac3ff78b65637375494b23b4efd0b720b Mon Sep 17 00:00:00 2001
From: Hawkynt <github@synthelicz.de>
Date: Fri, 28 Aug 2026 20:37:44 +0200
Subject: [PATCH] * regenerate the package API references

A pipe inside a signature or a summary split the table row it sat in; a NumPy
dtype default of "|u1" in Hawkynt.FileFormats.FileSystems is the visible case.
The generator escapes pipes in the cell renderer now, and this is its output.
Nothing changed but the escaping.
---
 CHANGELOG.md                              | 1106 +++++++++++++++++++++
 Hawkynt.FileFormats.Archives/README.md    |   12 +-
 Hawkynt.FileFormats.FileSystems/README.md |   14 +-
 3 files changed, 1119 insertions(+), 13 deletions(-)
 create mode 100644 CHANGELOG.md

diff --git a/CHANGELOG.md b/CHANGELOG.md
new file mode 100644
index 000000000..feb66be3a
--- /dev/null
+++ b/CHANGELOG.md
@@ -0,0 +1,1106 @@
+# Changelog
+
+## Nightly 2026-07-08
+
+### Added
+- aPLib decompression building block `BB_Aplib` (`Compression.Core/Dictionary/Aplib`):
+  bit-exact clean-room `aP_depack` decoder (MSB-first tag stream; `0` literal /
+  `10` normal match with γ-offset + inlined low byte and offset-dependent length
+  bumps / `110` short 7-bit-offset match + end-of-stream marker / `111` 4-bit
+  single byte + literal-zero) plus a spec-valid greedy encoder for round-tripping.
+  This is the reference-compatible aPLib — distinct from the older non-standard
+  `FileFormat.ApLib`/`ApLibStream`, which reads LSB-first and only round-trips
+  against itself. Tests cover self-round-trip across all input shapes and
+  hand-traced reference streams for every decoder-only grammar path.
+- Real aPLib PE-packer unpack handlers wired into `ExecutablePackerHandlers`:
+  `fsg`, `aspack`, `pecompact`, `rlpack`, sharing an `AplibSectionPackerHandler`
+  base that carves each PE section, aPLib-decodes it, and accepts only a
+  cleanly-terminated expanding stream (rejecting magic-less false positives).
+  Each emits `decompressed_payload.bin` + diagnostics; runnable rebuild is
+  reported as loader-version-specific rather than guaranteed (UPX-handler bar).
+- Generic `aplib_pe` fallback handler (registered last, low confidence): detects
+  aPLib-compressed PEs by decode — any section that inflates to a cleanly-terminated
+  aPLib stream — so aPLib-family packers we don't name individually (JDPack,
+  Packman, Neolite in aPLib mode, or aPLib output from unknown tools) still unpack.
+- Executable-packer coverage map for the packing-box dataset (25 packers):
+  `docs/EXE-PACKER-COVERAGE.md` — five now at Unpack level (UPX + the four aPLib
+  packers), the rest Detect/Planned with their compression core noted.
+
+## Nightly 2026-06-16
+
+### Added
+- Large-file streaming write (CreateFromStreams) for 11 FS targets (e974533)
+- Conversion-matrix KnownConversionGaps quarantine + bucketed gap doc (c5b8cde)
+- Old "SZ " (QBasic/pre-SZDD) MS COMPRESS variant: read + write + creatable + SzCompress descriptor: magic 53 5A 20 88 F0 27 33 D1, 12-byte header (8-byte   magic + u32 LE uncompressed length, LZSS stream at offset 12); same 4096-byte   ring LZSS body as SZDD, which neither our old reader nor 7-Zip groks * SzddStream.Decompress auto-detects either variant (12- vs 14-byte header);   + CompressQBasic emits the "SZ " header so the old format round-trips + tests: QBasic round-trip (incl. matches), empty, and the literal path a first   0xFF control byte yields (8 verbatim literals → an MZ EXE header) (2c2a04b)
+- Conversion capability + round-trip matrix harness (586ceff)
+- Streaming-write CreateFromStreams override for Tar/Cpio/Ar/Zip-store (a143719)
+- Reusable cost-based optimal LZ77 parser primitive + BB_Lz77Optimal (6d647e5)
+- Lz4 block-size/checksum + Xz/Lzip level+dict option schemas (ae245cb)
+- Shared layout-optimizer adapter + wire FatX/ext/JFS1/NILFS2 (d5ac363)
+- Neural building block: online-trained MLP predictor + arithmetic coder (4720b13)
+- Benchmark-driven cross-block auto-selector + optimizer budgets/caching (37c5564)
+- TD0/IMD/HFE/WOZ floppy-emulator images + QOI/DPX image formats (8535137)
+- WSL cross-validation for archive writers + FS content checks (76f913a)
+- Image-format external-tool interop tests (WSL ImageMagick/exiftool/webp/avif) (66b0df5)
+- Audio external-tool interop tests (ffprobe/flac/wavpack/opus) (b8cf07c)
+- Codec.SysV: images now mount on the real Linux kernel (mount -t sysv) and the kernel reads our files byte-exact — validated under the Alpine qemu guest (was rejected before) # SysVWriter/Reader/Modifier: place the superblock at block 0 + BLOCK_SIZE/2 (offset 512), not block 1 (offset 1024). The Linux sysv driver's detect_sysv reads the superblock struct at bh->b_data + BLOCK_SIZE/2, so s_magic must land at byte 1016 (512+504); at offset 1024 the kernel never found it # SysVWriter: s_isize is the FIRST DATA ZONE (FirstInodeBlock + ilist blocks), not the ilist size. The kernel reads it as s_firstdatazone and rejects the mount when s_firstdatazone < s_firstinodezone (=2); our old value of 1 always failed. Reader/Modifier reinterpret s_isize accordingly (ilist size = s_isize - FirstInodeBlock) * SysVFormatDescriptor: magic signature offset 1528 -> 1016 to match the relocated superblock; SysV tests updated to the new offsets (7f5ddb9)
+- Codec.SquashFs: images now mount on the real Linux kernel (mount -t squashfs) and the kernel reads our files byte-exact — validated under the Alpine qemu guest # SquashFsWriter: pad the image to a 4 KiB device boundary (as mksquashfs does). An unpadded sub-sector image (e.g. 234 bytes for two tiny files) presents a zero-sector block device, so the kernel's first superblock read failed with EIO ("SQUASHFS error: Failed to read block 0x0: -5"). bytes_used in the superblock stays the true unpadded size (afcdd3e)
+- Codec.Udf: images now mount on the real Linux kernel (mount -t udf) and the kernel reads our files byte-exact — validated under the Alpine qemu guest (was rejected at every layer before) # UdfWriter LVD: emit the mandatory "*OSTA UDF Compliant" domain EntityID + OSTA CS0 character set, a Type-1 partition map (map_table_length=6, number_of_partition_maps=1) and an implementation EntityID; without the domain id the kernel reports "Not OSTA UDF compliant logical volume descriptor" and without the map "No partition found" # UdfWriter partition descriptor: set partition_flags=allocated, partition_number=0, "+NSR02" contents EntityID and access_type so the partition map resolves # UdfWriter FSD: emit the OSTA domain EntityID + CS0 charsets and interchange levels # UdfWriter File Entry: set ICB strategy type 4 (0 → "unsupported strategy type") and move file_link_count to the ECMA-167 offset 48 (was 28, inside the ICB tag — the kernel saw link count 0 and failed udf_iget on the root directory) (cdee5f9)
+- Test harness: run the external filesystem conformance + post-mutation suites natively on a Linux/POSIX host, not only via WSL on Windows. FsInteropToolbox (DetectWsl/RunWsl/WinToWsl) and the per-fs WSL helpers (F2fs/Jfs/ReiserFs) now execute the Linux fsck/mkfs tools directly through /bin/bash when the host is not Windows; Windows behaviour is unchanged (gated on OperatingSystem.IsWindows) * This lights up 104 conformance checks + 14 add/remove/modify post-mutation r/w checks on Linux that previously skipped — validating ext/xfs/btrfs/f2fs/jfs/reiserfs/minix/ntfs/iso/squashfs/cramfs/bfs writers against the real host tools, and confirming F2fs/Jfs/ReiserFs stay fsck-clean after mutation # WinToWsl returns the bare POSIX path on a non-Windows host (a single-quoted form broke the direct-exec qemu-img container tests) (1034a73)
+- Codec.Hammer2 WRITE now produces files the DragonFly kernel reads byte-exact — full read/write. Validated via mount_hammer2 @<label> + cksum on hello/readme (embedded data) + big.bin (4000B out-of-line data block) in a directory large enough to spill into a blockref-indirect block # Hammer2Writer: blockref modify_tid must be non-zero (set to mirror_tid) — the live kernel treats modify_tid==0 as an uninitialised/empty chain and skips it during directory lookup and readdir, so files were on-disk (visible to hammer2 show) but invisible to the mounted filesystem # Hammer2Writer: a blockref-indirect must never span the full 64-bit keyspace (keybits 64); the kernel caps keybits at 63 (1<<64 is undefined → empty range). A directory whose entries straddle bit 63 (inode brefs keyed by inum, dirent brefs keyed by dirhash with bit 63 set) now splits at bit 63 into a low-half and high-half keybits=63 indirect, matching the kernel's own layout # Hammer2Writer: indirect blockref leaf_count carries the number of leaf brefs beneath it (was 0) (1a566d5)
+- Codec.Hammer WRITE now produces files the DragonFly kernel reads byte-exact — full read/write. Validated via mount_hammer + cksum on hello/readme/mid(5000B)/big(40000B multi-block); image passes hammer show (all elements GOOD) and hammer checkmap (0 errors) # HammerWriter: B-Tree leaf node mirror_tid must be >= every element's create_tid (was 0) — otherwise the kernel flags BADMIRRORTID and the ASOF read cursor prunes the node # HammerWriter: directory-entry data belongs in the META zone (zone 9), not small-data (zone 11) — a mixed-zone big-block fails kernel blockmap validation and checkmap # HammerWriter: directory-entry embedded localization is the target's pseudofs localization (0 for PFS#0), not the INODE app bit — the kernel derives ip->obj_localization from it and reads file data with (obj_localization | MISC); the wrong value made the data query localization 3 instead of 2 so the read found no data record (zero-fill) while the inode lookup still succeeded # HammerWriter: full 16 KB data blocks must live in the LARGE_DATA zone (zone 10), sub-16 KB tails in SMALL_DATA (zone 11) — the kernel's direct-read path asserts hammer_is_zone_large_data() and panics on an aligned full-buffer block stored in small-data * HammerRoundTripTests: add a 40000-byte multi-block file exercising large+small data zones (033e3b2)
+- Codec.Hammer/Codec.Hammer2 readers: walk the on-disk tree to recover real files — HammerReader (vol0 B-Tree → inode/direntry/data records) and Hammer2Reader (volume header → super-root → PFS → blockref tree); both verified byte-exact against images the DragonFly kernel itself wrote (newfs_hammer/newfs_hammer2 + populate), including subdirectories + HammerFormatDescriptor.List/Extract surface the actual files via HammerReader (mirrors the wired HAMMER2 descriptor) instead of only the volume-header bundle + HammerWriter/Hammer2Writer materialise per-file inode + directory-entry + data records that round-trip byte-exact through our own readers (Hammer/Hammer2 round-trip + descriptor tests) + Hammer/Hammer2 kernel-interop read tests (gated on /tmp/hammer{,2}_ref.img): recover frombsd.txt/inner.txt from a real DragonFly-written volume + UfsBsdInteropTests: our UfsReader extracts a FreeBSD newfs+populated UFS1 image byte-exact — frombsd.txt, sub/inner.txt, and a 4.5 MB big.bin spanning single-indirect blocks * UfsFormatDescriptor accepted-inputs text corrected to the real capability (multiple cylinder groups, nested directories, direct + single-indirect files) ! Hammer kernel-WRITE: mounted image lists files with correct names/sizes but the kernel reads the data region as zero-fill — full kernel-readable data still needs zone-2 blockmap allocation ! Hammer2 kernel-WRITE: image mounts clean but the kernel walks an empty root — surfacing our files to the kernel still needs freemap allocation + blockref-indirect wiring (ab5b89c)
+- Codec.Hammer2: HAMMER2 (DragonFly BSD) writer — produces images the real kernel mounts cleanly (mount_hammer2 rc=0, "no recovery needed", root lists, clean umount; validated under DragonFly 6.4) + Hammer2 volume header at offset 0 (slot #0 of 4): version 2, fstype UUID, allocator_beg past boot(8M@4M)/aux(8M@12M)/topo-reserved(4M@20M), volu_loff[0]=0 and [1..63]=-1 (kernel rejects non-(-1) unused volume slots) + Hammer2 topology: SUPROOT inode → two PFS-MASTER inodes (@LOCAL default + @<label>), blockrefs sorted ascending by name_key, empty root dirs (matches newfs_hammer2) + Hammer2Crc: iSCSI CRC-32C (poly 0x82F63B78) for the three volume-header iCRCs — SECT1 stamped before SECT0 (SECT0 range covers the SECT1 field) — plus seeded xxHash64 (XXH_HAMMER2_SEED) blockref checks and hammer2_dirhash name_key * Hammer2FormatDescriptor: implements IArchiveCreatable / CanCreate / Create * ExternalFsInteropTests: Hammer2_OurImage_DragonFlyHammer2Info now drives the real writer * EndToEndInteropTests: exclude .hammer2 from the self-round-trip sweep (multi-hundred-MB image) ! Hammer2 root directories are empty (as newfs_hammer2) — AddFile records the label surface but does not yet materialise DIRENT blockrefs / per-file child inodes; freemap left lazy (kernel builds it); only volume-header slot #0 written (20dada6)
+- HAMMER (v1, DragonFly BSD) writer: HammerWriter produces a genuine mountable HAMMER volume — volume header, two-layer freemap blockmap, UNDO/REDO FIFO (512MB floor), root B-Tree + root inode + PFS#0 MASTER record, sparse buffer-cache I/O. HammerCrc: CRC-32 (poly 0xEDB88320) and version-gated CRC-32C (0x82F63B78) per hammer_datacrc. Descriptor gains IArchiveCreatable/CanCreate. * Verified under real DragonFly BSD 6.4 (qemu): mount_hammer /dev/vbd1 mounts CLEAN (rc=0), 'hammer info' reports Label/Version 7/Volumes/Inodes (rc=0), root dir lists, umount clean * .hammer excluded from the generic SelfRoundTrip (filesystem image, like .ufs/.xfs) ! AddFile records the label/inode surface but does not yet materialize directory entries + per-file inodes (root dir empty, as newfs_hammer leaves it); single-volume only (f392911)
+- MED, AHX, PSM, DBM tracker + SPC, AY, GYM chiptune pseudo-archives (932216f)
+- Par2 (Parchive v2): full packet-stream parse — FULL.par2 + metadata.ini + files.ini + per-packet entries + Aff4 (Advanced Forensic Format 4): ZIP-delegating reader, member entries + metadata distilled from information.turtle + Ffu (Windows Full Flash Update): SignedImage/ImageFlash header parse, FULL + metadata + structural payload.bin (per-chunk reconstruction deferred) + ParallelsHdd (.hds): WithoutFreeSpace header + BAT-reconstructed disk.raw + Dar (libdar slice): slice-magic + label + terminator-located catalogue.bin (member enumeration deferred) (037a7f5)
+- Caf, W64, Rf64, Shorten, Tta audio pseudo-archives (bd7a07e)
+- 7 tracker module pseudo-archives: MTM, 669, FAR, ULT, STM, OKT, PTM (acd042c)
+- KTX2 + VGM/VGZ + SID + NSF + GBS read-only pseudo-archives (d1a740c)
+- Ova, CloneCd, Qed, BochsDisk, Afio disk-image/VM/archive formats (f15447d)
+- Ape per-frame blocks (frames/frame_NNNN.bin via seek table) + APEv2 tags.ini + Mp3 id3v1.bin trailer + per-frame MPEG blocks (frames/frame_NNNNN.bin, sync-word split) + WwiseBnk per-section blobs (sections/BKHD.bin/HIRC.bin/…) + IArchiveInMemoryExtract + Alac/Ape/Mp3/WwiseBnk pseudo-archive tests: list/extract/round-trip + malformed fallback (78e2113)
+- ByteIdentity contract tests for Zoo/Lha/Arj in-place Add — lock minimum-mutation surface (16ec53e)
+- Hog/Wad2 PROMOTE to R/W + byte-identity LOCK for disk + retro archives (83047bd)
+- ZIP-family in-place modify: 18 descriptors promoted to IArchiveModifiable (04b374f)
+- Pak + Shar promoted to in-place IArchiveModifiable (CanModify) * Pak Add/Remove delegate to PakInPlaceModifier → ArcModifier (shared ARC entry-chain + 0x1A 0x00 EOA marker) * Shar Add overwrites the trailing 'exit 0\n' sentinel with the new heredoc/uudecode block + a fresh sentinel; Remove throws NotSupported (heredoc bodies can carry delimiter-lookalike text) + Tar / Cpio / Ar in-place LOCK tests: pre-existing bytes before the textbook terminator (two zero blocks / TRAILER!!! / EOF) are byte-identical after Add + Pak / Shar in-place tests: byte-identity invariant + Add/Remove round-trip + descriptor advertises CanModify + IArchiveModifiable (8219e67)
+- Pdf + Mbox in-place R/W; Iso/Udf/Xar byte-identity audit tests (a7678a8)
+- Ico in-place R/W: IcoInPlaceModifier mutates ICONDIR + ICONDIRENTRY table directly; Add appends payload at EOF, inserts 16-byte dir entry, patches existing offsets by +16, every payload's byte content stays verbatim; Remove collapses the dir slot + payload bytes, patches survivor offsets down by 16 (and by payload-length for payloads past the deleted one), physically wipes removed bytes + Eml in-place R/W: EmlInPlaceModifier splices the multipart body without rewriting surviving parts; Add appends a fresh attachment part (base64 transfer encoding, 76-char line wrap) immediately before the closing --boundary-- delimiter so every byte before the splice point stays at its original offset; Remove deletes the byte range of a named attachment between two boundary markers; both reject single-part messages with NotSupportedException because promoting to multipart would cascade through the top-level Content-Type * IcoFormatDescriptor + EmlFormatDescriptor: implement IArchiveModifiable + advertise CanModify, Add/Remove route through the new modifiers * DtbFormatDescriptor / MoFormatDescriptor: stay R-only with honest demotion — Description now names the specific spec field cascade that blocks in-place mutation (DTB: 40-byte FDT header totalsize + off_dt_struct + off_dt_strings + size_dt_struct + size_dt_strings shift with every property add/remove; MO: 28-byte header numStrings + table offsets sit BEFORE the key/value pools, so growing the descriptor tables shifts every pool byte and invalidates every (off) field already written) + IcoInPlaceModifyTests (12): byte-identical payload preservation on Add, +16 offset patch on existing entries, BMP→DIB conversion path, sequence Add+Remove restores original entry list, removed PNG signature physically wiped (no forensic survivor), descriptor wiring round-trip through IArchiveModifiable + EmlInPlaceModifyTests (11): closing delimiter preserved, new attachment decodable through existing reader, original attachment bytes preserved across Add, bytes before splice point byte-identical, single-part Add throws NotSupported, removed base64 payload bytes physically wiped, Add+Remove restores byte-length parity, descriptor accepts both "attachments/<name>" and bare filename forms + DtbInPlaceModifyTests + MoInPlaceModifyTests: lock the honest-demotion contract (no CanModify, no IArchiveModifiable, Description names the blocking fields) (4fce4dd)
+- Pfs0 + Gemdos + GsOs + Mfs1 promoted to in-place R/W (CanModify) + Pfs0InPlaceModifier: flat header + entry table + string table + data   region rewritten in place; replace-by-name semantics; data region   re-laid out so removed payloads physically disappear + GemdosInPlaceModifier: delegates to FAT12 (patches 0x60 BRA.S jump   byte for FatReader, restores it post-mutation); Add re-packs through   FatWriter, Remove via FatRemover + GsOsWriter: emits 2IMG container (creator code "CWB!", image_format=1)   wrapping a ProDOS payload via ProDosWriter; honest scope on the   Description for non-ProDOS-ordered payloads + GsOsInPlaceModifier: rebuilds inner ProDOS payload through   ProDosReader+ProDosWriter while preserving the 64-byte 2IMG header   byte-for-byte (rebuild path avoids a pre-existing ProDosModifier   slot-1 / volume-header byte-offset collision that corrupts the   bitmap pointer and total-blocks fields after the first added file) + Mfs1Writer: real DFS-tier catalog emitter — sector 0 names + sector   1 metadata with packed-high-bits encoding, files contiguous from   sector 2 onwards, descending start-sector catalog sort per DFS   convention; 200 KB default geometry (80 tracks x 10 sectors) + Mfs1InPlaceModifier: re-packs through Mfs1Writer; outer sector count   preserved; removed payload bytes don't survive + 4 InPlaceModify test fixtures (44 tests): Add/Remove/MutateThenExtract   roundtrips, header / jump-byte / sector-count preservation, payload   wipe verification, interface routing * Mfs1FormatDescriptor: read-only -> R/W (CanCreate + CanModify);   IArchiveCreatable + IArchiveModifiable implemented * GsOsFormatDescriptor: read-only stub -> R/W (CanCreate + CanModify);   IArchiveCreatable + IArchiveModifiable implemented; List/Extract now   walks the inner ProDOS catalog for image_format=1 and falls back to   opaque blob for HFS/DOS-3.3 payloads * GemdosFormatDescriptor: + CanModify + IArchiveModifiable; Add/Remove   routed through GemdosInPlaceModifier * Pfs0FormatDescriptor: + CanModify + IArchiveModifiable; Add/Remove   routed through Pfs0InPlaceModifier * Mfs1StubBehaviorTests + GsOsStubBehaviorTests: capability assertions   inverted from "no CanCreate/CanModify" to "+CanCreate +CanModify";   opaque-fallback path retained for non-ProDOS / unparseable inputs (91a00b6)
+- Cdi + Nrg + Mdf R/W: in-place sector rewrite at fixed offsets via IArchiveModifiable (1dcc267)
+- OpenVms (Files-11 ODS-2): WORM writer + in-place R/W Add/Remove/Replace (87e816a)
+- BinCue R/W: in-place sector rewrite at fixed offsets via IArchiveModifiable (109bd97)
+- Ocfs2 true in-place R/W: Add/Replace/Remove via Ocfs2InPlaceModifier — O(touched bytes) random-access I/O against global bitmap data block, root dir dinode inline area, file dinode block, and contiguous data clusters. Untouched blocks remain byte-identical * Ocfs2FormatDescriptor.Add/Remove now route through Ocfs2InPlaceModifier first; fall back to ModifyRebuilder only when the in-place path hits its honest scope (subdir paths, extent-backed root dir, full inline area, no free clusters) + Ocfs2InPlaceModifyTests: 28 tests covering Add/Replace/Remove untouched-block invariants, bitmap update + freed-bit accounting, multi-cluster files, wipe-on-remove forensic check, mutate-then-extract roundtrip, descriptor-routing, and error cases (duplicate name, subdir path, oversize replace, invalid image, non-seekable stream) ! MVP scope (documented in Description + class XML): root-directory mutations only. Subdirectory mutation, extent-backed root B-tree splits, DLM/heartbeat lockdown, and multi-node cluster semantics deferred — the rebuild path still handles them (af6314f)
+- Aomei .adi/.afi WORM -> R/W via trailing BR_IMAGE_INDEX VDB-entry append (3237372)
+- Coherent FS true in-place R/W via V7-style inode + zone mutation + CoherentInPlaceModifier — canonical Add/Replace/Remove surface over a Coherent image stream; Add inserts via free-inode scan + free-zone reachability scan across direct + single-indirect + double-indirect tiers; Replace rewrites payload bytes at the inode's existing data zone offsets when the new size fits and falls back to Remove+Add otherwise; Remove wipes data + indirect pointer blocks + dirent + inode slot * CoherentFormatDescriptor — Add/Remove now delegate to CoherentInPlaceModifier with no rebuild fallback so capacity limits surface honestly; Description rewritten to spell out the in-place semantic and the root-only scope * CoherentRwTests.Descriptor_Add_FallsBackToRebuildOnInodeExhaustion → Descriptor_Add_SurfacesIoExceptionOnInodeExhaustion: lock the new no-rebuild contract + CoherentInPlaceModifyTests — Add (untouched data/superblock byte-identical, empty input no-op), Remove (zone + dirent wipe, missing-name no-op + image-unchanged, magic preserved), Replace (fits→in-place same-length boundary + other-file blocks unchanged + size-field path, missing→falls through to Add, larger→realloc fallback), Add+Replace+Remove round-trip, bad-magic validation across all three operations, descriptor wiring ! Subdirectory mutation deferred — Add/Replace/Remove operate on the root directory only; multi-component names are flattened to their leaf before lookup (d474eda)
+- Paragon PBF WORM -> R/W via CWBP chunk-table append (aed6ad1)
+- Nilfs2 WORM -> R/W via continuous-snapshot segment-log append (d2b60bc)
+- Ghost 3.0+ WORM -> R/W via record-stream append (GhostInPlaceModifier) (807e22b)
+- Ubifs promoted from WORM to true in-place R/W via journal-head append + UbifsWriter: emits superblock + master + linear log of inode/dentry/zlib-compressed data nodes (kernel UBIFS LPT/TNC commit pipeline deliberately out of scope — self-round-trip only, not kernel-mountable) + UbifsInPlaceModifier: Add / Replace / Remove append fresh INO + DENT + DATA nodes at the journal head with monotonically increasing sqnum; existing committed nodes stay byte-identical at their original offsets — only the trailing 0xFF padding of the journal-head LEB gets overwritten; tombstone DENT (inum=0) for Remove; 8-byte node alignment and per-LEB node-no-straddle invariant preserved * UbifsFileReader: sqnum-aware merge for INO / DENT / DATA — highest-sqnum entry per key wins, tombstones suppress earlier dentries (matches kernel TNC lookup semantic after journal replay) * UbifsFormatDescriptor: implements IArchiveCreatable + IArchiveModifiable; Capabilities adds CanCreate + CanModify; Add / Remove route through UbifsInPlaceModifier, Create delegates to UbifsWriter * Description spells out the R/W scope (Add/Replace/Remove append at journal head, committed bytes preserved) and the deferred-scope honesty (no TNC/LPT commit → not kernel-mountable) + UbifsInPlaceModifyTests (10 tests): Add preserves committed bytes + appends a new file; Replace keeps old DATA nodes byte-identical and the reader picks higher-sqnum content; Remove appends tombstone and the reader drops the entry; replace-via-Add reuses the existing inode; multi-LEB straddling large file round-trips; mutate-then-extract through the descriptor surface composes all three ops; rejects non-seekable streams and unknown-name Replace + UbifsWriterTests: WORM self-round-trip for Create (single + multi-file) * UbifsReaderTests.Descriptor_IsHonestlyReadOnly → Descriptor_AdvertisesRwScope: now locks the IArchiveCreatable + IArchiveModifiable advertisement and CanCreate + CanModify capability bits (5de3ed3)
+- Macrium Reflect X promoted from WORM to R/W via rebuild-based modify (e69d745)
+- Norton Ghost (modern 3.0+) R/W via IArchiveModifiable — promotes the FE EF record container from WORM (Create-only) to R/W (Create + Add/Remove/Replace) + GhostModifier: rebuild-based Add/Remove/Replace helpers that preserve the source image's compression mode (None / FastLZ Z1 / zlib Z3-Z9) and CRC-16 stream cipher state across mutation; in-place replacement keeps Ghost's positional partitionN.bin labels stable when callers overwrite by name; synthetic reader entries (metadata.ini, *.error.txt, dump-*.bin, ghost-image.*.bin) are filtered out so they never round-trip as payloads + GhostFormatDescriptor: implements IArchiveModifiable; Capabilities adds CanModify; interface Add/Remove delegate to GhostModifier with password=null (the IArchiveModifiable contract has no password parameter — encrypted images go through GhostModifier static overloads that accept it explicitly) + GhostReader.HeaderCompression: exposes the parsed file-header compression byte so the rebuild path keeps using the source codec * Description: documents the R/W scope (Add/Remove/Replace) + rebuild-based strategy alongside the existing WORM Create surface + GhostRwTests (24 tests): Add appends + preserves untouched entries + in-place replaces by name; Remove drops named entries + is a no-op for unknown names; Replace swaps payloads + falls through to Add on missing names; FE EF + 0x012F18D8 record framing survives Add and Remove; password- protected images round-trip through Add / Remove / Replace with cipher integrity intact; compression mode is preserved across all four code paths (None / FastLZ / zlib Z3 / zlib Z9); rejects mutation of encrypted images without password, pre-3.0 Ghost 1.x / 2.x dumps, read-only streams and null arguments; metadata.ini is not re-emitted as a payload * GhostFormatTests: descriptor-surface gates flipped from "Is.Not.InstanceOf<IArchiveModifiable>" / "CanModify == False" to assert the new R/W surface ! Modify is rebuild-based (read-extract-rebuild) rather than per-record patching — Ghost's compressed-block spans carry no length-of-payload field so patching would have to rewrite every downstream offset; rebuild is the spec-correct option here and matches the ZIP / NTFS / Btrfs approach acknowledged by the project memory (361e109)
+- AdvFs WORM: emit clean-room storage-domain layout (RBMT page 0 cookie + DMN/VD/MATTR fields + CWB-AdvFS-WB file table at byte offset 132 of the page); reader extended to parse the file-table extension and round-trip caller files end-to-end + OpenVms WORM (ODS-2): emit a real Files-11 home block at LBN 1 with DECFILE11A magic at +0x1E8, structure level 0x0202, cluster size 1, owner UIC [1,1], plus a CWB-OVMS-WB file table at LBN 2 carrying caller files into a flat data area at byte offset 8192. Honest scope: INDEXF.SYS / BITMAP.SYS / checksum1 deferred — emitted volume is not OpenVMS-mountable and the Description says so + AdvFsWormTests / OpenVmsWormTests: round-trip determinism, capability advertisement, single + multi-file payload round-trip, capacity-overflow boundary, name-length boundary, descriptor.Create end-to-end with List+Extract + HammerWormTests / Hammer2WormTests / NssWormTests: lock R-only state with specific writer-gap descriptions — HAMMER1 cluster B-tree + zone blockmap + undo-fifo, HAMMER2 four-redundant volume-data sectors + COW blockref radix + xxHash64, NSS proprietary 'Beast' object record layout never publicly documented * OpenVmsTests.Descriptor_IsHonestlyReadOnly → Descriptor_WormScope_NotModifiable_NotOpenVmsMountable: now locks 'WORM emit + R-only modify' surface and verifies the not-OpenVMS-mountable caveat stays in the Description * HammerFormatDescriptor / Hammer2FormatDescriptor / NssFormatDescriptor: Description now spells out the deferred work so a future agent can see what each WORM gate actually requires (6d59eec)
+- WORM writers for 7 pseudo-archive formats: ANI, AppleSingle, DTB, EML, TTC, MO, LNK * descriptors now expose IArchiveCreatable + FormatCapabilities.CanCreate; readers/listings unchanged + AniWriter: RIFF "ACON" wrapper with anih + LIST "fram" of icon subchunks; accepts CUR/ICO inputs only, validates magic 00 00 01/02 00 + AppleSingleWriter: RFC 1740 v2 container, name → entry-id mapping for documented roles, synthetic high-range id for unknown names + DtbWriter: minimal valid FDT v17 — 40-byte BE header + mem-reservation terminator + struct block (root node with spec-required #address-cells/#size-cells + one FDT_PROP per input) + strings block + EmlWriter: RFC 2822 / MIME, multipart/mixed body with per-part base64 transfer encoding, deterministic Message-ID + boundary so identical inputs yield byte-identical messages + TtcWriter: OpenType TTC v1 — 12-byte header + N×u32 offset table + verbatim member SFNT payloads, rejects non-SFNT inputs + MoWriter: GNU gettext binary catalog (little-endian rev 0), HEADER entry sorts first, msgctxt encoded with EOT separator, plurals via NUL separator + LnkWriter: MS-SHLLINK minimal shortcut — 76-byte header + LinkInfo with VolumeID + LocalBasePath + optional WorkingDir/Arguments/IconLocation Unicode StringData blocks + terminator + 7 WriterTests files covering header layout, round-trip through existing reader, descriptor IArchiveCreatable contract, boundary cases (empty inputs, invalid frames, deterministic output) (9b63e95)
+- Sfar WORM: stored-mode SfarWriter + IArchiveCreatable, synthetic Filenames.txt manifest round-trips through SfarReader + ApkNativeLibs WORM: IArchiveCreatable delegating to ZipWriter, native_libs/* → lib/* rewrite preserves split-APK shape + AndroidBundle WORM: IArchiveCreatable via ZipWriter, auto-emits placeholder BundleConfig.pb when absent + Esd WORM: IArchiveCreatable delegating to WimWriter (CompressionNone), patches header flags with community-known 0x00100000 ESD marker bit + GameMaker WORM: IArchiveCreatable rebuilds FORM IFF container from chunks/<TAG>.bin inputs, falls back to minimal GEN8 stub + 18 new WORM contract tests across 5 formats (95 total format tests pass) (b0670ea)
+- Snap, AndroidOta, Wbn, Numpy (NPY + NPZ) WORM create — every descriptor now implements IArchiveCreatable * Wbn capability test inverted to assert CanCreate presence instead of absence + Snap WORM reuses SquashFsWriter and synthesises meta/snap.yaml when callers don't supply one + AndroidOta WORM emits a real 24-byte CrAU header + minimal DeltaArchiveManifest protobuf (block_size = 4096) + optional metadata signature + payload + Wbn WORM emits a 10-byte canonical magic + version + primary URL + section-lengths + index map carrying one CBOR entry per input — inline minimal RFC 8949 encoder + NPY WORM emits a v1 frame with 64-byte aligned ASCII Python dict header (default dtype |u1, inferred 1-D shape), passthrough when input is already an NPY, and header.bin/array.bin reassembly path for descriptor round-trip + NPZ WORM wraps every input into an NPY frame and stores it in a ZipArchive entry, preserving existing .npy entries verbatim + self round-trip excludes .npy, .npz, .wbn (synthetic Extract names that arbitrary input filenames can't survive) and .bin (extension already claimed by BinCue) (e19bd66)
+- descriptor-level WORM contract tests for the four single-payload encoding wrappers (UuEncoding, yEnc, BinHex 4.0, MacBinary) — they were already WORM through IStreamFormatOperations.Compress but had no descriptor-surface assertions that exercise the CanCreate capability or roundtrip the encoded stream back through IStreamFormatOperations.Decompress; ThumbsDb keeps its existing IArchiveCreatable WORM (OLE2 CFB) and Tds (Autodesk 3DS) stays read-only because arbitrary inputs can't be coerced into a structurally meaningful 3D scene (18a8a41)
+- TUX2 WORM writer — single-phase synthetic image: 16-byte header (TUX2FS magic + version + file count) followed by per-file records (u16 name len, UTF-8 name, u32 data len, raw bytes); round-trips through Tux2Reader's documented synthetic header + TUX3 WORM writer — single-version image with documented superblock prefix at offset 4096 (TUX3SUPR magic + birthday/flags/iroot/oroot/aroot/blockbits/volblocks/freeblocks/nextalloc/atomgen/freeatom) plus a sentinel TUX3WORM file table at block 2 (offset 8192) carrying per-file records; no version chain, no atomic-commit log * TUX3 reader picks up the optional TUX3WORM table when present, surfacing per-file entries; legacy linux-tux3 prototype images without the WORM sentinel still surface only as FULL.tux3 + metadata.ini + superblock.bin (HasWormTable=false) * TUX2/TUX3 descriptors now implement IArchiveCreatable with FormatCapabilities.CanCreate; refresh per-descriptor tests for the new capability set + Tux2WriterTests / Tux3WriterTests covering header layout, single-/multi-/empty-/UTF8-named-file round-trips, block-alignment, no-input image emission, legacy-image (no WORM table) compatibility, and ArgumentException paths * UFS / CP/M / HPFS already shipped full WORM (CanCreate + SupportsMultipleEntries + modify) in prior phases — verified state, no changes needed (7a5368d)
+- Mbox WORM writer: appends RFC 822 messages with envelope separator + ">From " body byte-stuffing per RFC 4155; descriptor implements IArchiveCreatable + Rpa WORM writer: emits RPA-3.0 header + raw payload region + zlib-compressed protocol-2 pickle index (offset/length XORed with archive key); minimal pickle emitter consumes the same opcode subset the existing parser already handles + AppImage WORM writer: emits a 64-byte ELF64 stub carrying the AI\x02 type-2 marker at e_ident[EI_PAD] followed by a SquashFS payload built via the existing FileSystem.SquashFs writer; descriptor strips synthetic filesystem/ prefix + metadata.ini on Create for clean round-trip + Crate WORM writer: TAR.GZ compound — inputs flow through TarWriter then GZipStream; auto-derives <name-version>/ top directory from supplied Cargo.toml [package] table, falls back to crate-0.0.0 + Pfs0 descriptor Create test: pins the existing Pfs0Writer round-trip via IArchiveCreatable + EndToEndInteropTests: .mbox and .crate added to SelfRoundTrip exclusions — Mbox surfaces synthetic message_NN_<subject>.eml names; Crate requires Cargo.toml-derived top dir for the round-trip verifier (e40a47d)
+- Mfs1 WORM writer: Acorn MFS-1 (BBC Master) emits DFS-shaped catalog + contiguous file data, round-trips through the existing reader * Mfs1FormatDescriptor: implements IArchiveCreatable, advertises CanCreate; Description updated to 'R + Create only, modify/defrag deferred' * LittleFs / SmartFs descriptors: keep R-only — Descriptions now document the specific writer work each WORM promotion would need (LittleFs: tag-based metadata-pair commit log with XOR-chained tags + CRC32-tag terminators + mirrored superblock pairs + inline/CTZ data split; SmartFs: per-sector logical-physical mapping table + wear-level sequence counters + directory sector chains + free-sector allocator) and the missing external validator that blocks honest WORM emission * Mfs1StubBehaviorTests: pin WORM (R + CanCreate) rather than R-only; modify/defrag must still NOT appear (cb8023f)
+- FileSystem.GsOs WORM emitter — wraps a ProDosWriter volume in the canonical 64-byte 2IMG header (creator code CmpW, ProDOS block order, optional comment block); promoted descriptor from stub to CanCreate / SupportsMultipleEntries / SupportsDirectories with documented spec sources (universal 2IMG spec, ProDOS 8 Technical Reference, Apple IIgs Hardware Reference) + FileSystem.CbmNibble G64 v2 writer — emits the full 35-track / 84-half-track 1541 layout with spec-correct speed-zone table (zones 0..3 by track range), 4-to-5 GCR nibble encoding per the 1541 ROM table, full SYNC + header gap + data gap framing per sector, minimal CBM DOS BAM block at track 18 sector 0 and an 8-entry directory block at track 18 sector 1; G64FormatDescriptor advertises CanCreate * GsOsStubBehaviorTests retitled and re-pinned for the new WORM tier — still asserts CanModify is not advertised (rewrites recompute the 2IMG header so only Create handles them correctly), still pins the opaque-inner-volume read surface (08ee802)
+- Ubifs WORM writer: superblock + master + linear log of inode/dentry/zlib-compressed data nodes, sufficient for self-round-trip through the linear-scan reader; kernel-mount (LPT/TNC wandering-tree commit) deliberately out of scope per honest single-FS cadence + Nilfs2 WORM writer: spec-compliant superblock (rev_level=2, magic 0x3434 at +1030, s_dev_size/last_cno/blocks_per_segment populated) plus a writer-private compact directory at offset 2048 guarded by "NILFS2WB" magic; reader extended to surface real files when that magic is present, falling back to triage on foreign images * Ubifs descriptor: gains IArchiveCreatable + CanCreate; description rewritten to call out self-round-trip-only scope * Nilfs2 descriptor: gains IArchiveCreatable + CanCreate + SupportsDirectories; description rewritten to call out single-checkpoint scope * Ubifs honest-readonly spec test inverted to assert WORM is now advertised, Modify still honestly off * Nilfs2 no-creatable spec test inverted to assert WORM is now advertised (488c853)
+- AOMEI .adi/.afi: VDB entry field byte offsets + BIFT body field offsets + 3 INFO_TYPE_* numeric values reverse-engineered from binary analysis of ImgFile.dll (codename BRCloudv2) + AomeiConstants: per-field byte offsets of BR_IMAGE_INDEX_ENTRY_VDB pinned via three independent code paths in the 32-bit ImgFile.dll: ReadBlock prologue at vma 0x10026060 (xmm0 copies of vdb[0..0xf] and vdb[0x10..0x1f] into [ebp-0x2c] / [ebp-0x1c], psrldq extraction of vdb[0x14] for the pOld malloc, push of [ebp-0x20]/[ebp-0x1c] forming the u64 ImgOffset arg of ReadData); wrapper at 0x10027c91 (movaps [esp+0x50],xmm0 mirroring vdb second half, BRCrc32 call taking [esp+0x54]=OldSize as byte-count, cmp eax,[esp+0x5c]=Crc32 leading to the `Crc32==vdb.Crc32` assert); GetBlock arg-marshalling at 0x10026d8a (movd esi,xmm1 = vdb[0..3] pushed first ⇒ RegNo, psrldq xmm0,4 then movd edx = vdb[4..7] = BlockNo_low, psrldq xmm1,8 then movd ecx = vdb[8..0xb] = BlockNo_high). Resulting layout: RegNo:u32@0x00, BlockNo:u64@0x04, ImgOffset:u64@0x0C, OldSize:u32@0x14, NewSize:u32@0x18, Crc32:u32@0x1C — totals to 0x20 ✓ + AomeiConstants: byte offsets of DataOffInSet:u64 and DataLenInSet:u64 within the 0x674-byte BR_IMAGE_FILE_TAIL pinned via reader-side `mov reg,[edi+0xc80..0xc8c]` at vma 0x100171b0 / 0x100172d4 / 0x10017342 plus the m_Tail base at object offset 0x660 established by the `rep movsd` at 0x10017cf3 in the tail-load routine. Subtracting yields DataLenInSet@+0x620 and DataOffInSet@+0x628 within the tail struct + AomeiConstants: position of the trailing BR_STANDARD_HEADER within the 0x674-byte BIFT pinned at offsets {Reserved:+0x664, Crc32:+0x668, Size:+0x66C, Flag:+0x670} — the tail's standard header sits at the END of the struct (vs the head's start-of-struct placement). Recovered from `cmp [ebp-0x8], 'BIFT'` at 0x10017b9a, `cmp [ebp-0xc], 0x674` at 0x10017bfd, and the CRC verification block at 0x10017c60..0x10017c84 that loads/zeroes [ebp-0x10] before recomputing + AomeiConstants: INFO_TYPE_FLB_SUB_ENTRY_LIST = 0x110 — pinned by `push 0x110` at 0x1000a2d0 immediately preceding the assert-text xref `AddInfo(INFO_TYPE_FLB_SUB_ENTRY_LIST, &m_vSubEntList[0], ...)` at 0x1000a2fd + AomeiConstants: INFO_TYPE_FLB_FILE_DATA_BLOCK_LIST = 0x111 — pinned by `push 0x111` at 0x1000a341 immediately preceding the assert-text xref `AddInfo(INFO_TYPE_FLB_FILE_DATA_BLOCK_LIST, &m_vDataBlockList[0], ...)` at 0x1000a36e. Both resolve the prior {0x110, 0x111, 0x128} candidate set + AomeiConstants: INFO_TYPE_VOLUME_DATA_REGION = 0x109 + sizeof(BR_IMAGE_INFO_VOLUME_DATA_REGION) = 0x30 — pinned by `cmp dword ptr [ebp-0x34], 0x109` at 0x1002554c (Type check) and `cmp eax, 0x30` at 0x10025558 (size check), both jne branches landing on the corresponding sizeof / Region.Header.Type assert-text xrefs at 0x10025779..0x100257ae and 0x10025846..0x1002587a + BrImageIndexEntryVdb: promoted from passive carrier to read/write helper — adds per-field byte-offset constants (RegNoOffset, BlockNoOffset, ImgOffsetOffset, OldSizeOffset, NewSizeOffset, Crc32Offset) mirroring the AomeiConstants pins plus Read(ReadOnlySpan<byte>) / Write(Span<byte>) helpers that decode/encode the 0x20-byte entry at the pinned offsets * BrImageIndexEntryVdb.PlausibleLayout: upgraded from a plausibility sketch ("RegNo:u32, BlockNo:u32, ImgOffset:u64, NewSize:u32, OldSize:u32, Crc32:u32, Pad:u32" with the wrong field widths and ordering) to the disassembly-pinned exact form ("RegNo:u32@0x00, BlockNo:u64@0x04, ImgOffset:u64@0x0C, OldSize:u32@0x14, NewSize:u32@0x18, Crc32:u32@0x1C") so downstream forensic tooling parses the right offsets * AomeiInfoRecord.TypeName: recognises the three newly-pinned INFO_TYPE_* tags (FLB_SUB_ENTRY_LIST, FLB_FILE_DATA_BLOCK_LIST, VOLUME_DATA_REGION) so unknown_0xNNNN no longer leaks for these values * AomeiFormatDescriptor.BuildMetadata: surfaces the new facts in metadata.ini — `vdb_entry_field_offsets=RegNo:+0x00:u32,BlockNo:+0x04:u64,ImgOffset:+0x0C:u64,OldSize:+0x14:u32,NewSize:+0x18:u32,Crc32:+0x1C:u32`, `tail_body_layout=DataLenInSet:u64@+0x620,DataOffInSet:u64@+0x628,trailing_BR_STANDARD_HEADER@+0x664`, `tail_trailing_header_offsets=Reserved:+0x664,Crc32:+0x668,Size:+0x66C,Flag:+0x670`, `volume_data_region_size=0x30`, and the three new tags added to info_types_enum * AomeiTests.Extract_WritesParsedHeader_OnValidMagic: tail_body_layout substring updated to match the now-pinned offsets + AomeiVdbLayoutTests (31 new tests): pins the three new INFO_TYPE_* values + sizeof(VOLUME_DATA_REGION) + uniqueness invariants, each of the six VDB field byte offsets independently with its disassembly provenance documented, the non-overlap / sum-to-VendorSize invariant, a hex-literal fixture that round-trips through Read/Write, both DataOffInSet/DataLenInSet offsets with their consecutive-u64 + fits-inside-BIFT invariants, each of the four BIFT trailing-header positions with the contiguous-and-ends-at-tail-size invariant, the TypeName mapping for the new tags, and the metadata.ini surface format ! Out of scope (documented-TODO): sizeof(BR_IMAGE_INDEX_ENTRY_FDB) — no `cmp [reg+0x18], imm` preamble at the FDB assert site so the byte size remains undecided; the head/tail body bytes between offset 0x10 and the recovered DataLen/DataOff/trailer fields remain unmapped; the on-disk wire layout has NOT been swapped to the 16-byte vendor BR_STANDARD_HEADER so AomeiWriter still emits a wire-incompatible 12-byte alias; AES variant + IV derivation (3f4a3f4)
+- EaseUS Todo Backup (.pbd) container shape pushed past R/O chunk-stream via binary RE of TBImageExplorer.exe (488bb4f)
+- Acronis True Image .tibx Stage-3: LSM_LEAF body LZ4-chained-stream decoder + InputItem ItemCommon attribute scanner + Golomb-Rice k=8 codec per binary RE of libarchive3.so + AcronisTibxLsmRecord.DecodeLeafBody: walks the (BE32 zchunk_size, BE32 chunk_size, LZ4-block bytes) chained-stream framing starting at page+0x20 for LSM_LEAF pages with encoding byte 3, decompresses each chunk via Lz4BlockDecompressor (the binary uses LZ4_decompress_safe_continue at libarchive3.so 0x54fb0 with the LZ4 dictionary preserved across chunks; for the all-in-one-chunk case this is identical to LZ4_decompress_safe). Returns a DecodedLeafBody record with the decompressed bytes, a status string (ok / unsupported_encoding / empty_body / lz4_chunk_error / buffer_underrun / len_mismatch), and the LZ4 chunk count + AcronisTibxLsmRecord.ScanForItemCommonAttributes: forensic-grade scan of the decompressed leaf body for InputItem ItemCommon (id 0x10) attribute body signatures - pattern-matches against the 44-byte fixed header (name length, alt-name length, DOS attrs, four FILETIMEs, trailer dword) followed by a UTF-16LE name. Validates name length [1, 260], alt-name length [0, 14], DOS attrs != 0xFFFFFFFF noise marker, at least one FILETIME in [1980, 2080] wall-clock range, and the name UTF-16 must be NTFS-valid (no nulls, no control chars, no forbidden NTFS path chars). False-positive rate on random noise is sub-1-in-2^64 - by construction real ItemCommon bodies pass every check + AcronisTibxLsmRecord.BuildLz4ChainedStreamFor: test helper that wraps a plaintext attribute body in the (BE32 zchunk, BE32 chunk, LZ4-block) frame so the test suite can round-trip DecodeLeafBody against known-good ItemCommon fixtures + Golomb: Rice/Golomb codec with k=8 (m=256) - the golomb_decode_mod256 / golomb_encode_mod256 primitive at libarchive3.so 0x53ef0 / 0x53d40 used by GOLOMB-page probabilistic membership filters (Golomb-Coded Set form). Decoder reads unary quotient capped at 8 then an 8-bit remainder; quotient=8 escape path consumes a literal 64-bit value. Encoder is symmetric. Includes BitReader / BitWriter MSB-first byte-packed helpers plus round-trip sequence helpers * AcronisTibxReader.DecodedLeaves / ScannedItemNames: new public properties surfacing the per-LSM_LEAF Stage-3 decoder summary (page index, ctree id, encoding, declared len/zlen/count, actual decompressed length, LZ4 chunk count, status code, scanned-name count) and the aggregated list of AcronisItemCommonAttribute candidates the scanner found across all leaf pages * AcronisTibxReader.WalkPages: now invokes AcronisTibxLsmRecord.DecodeLeafBody on every LSM_LEAF page it encounters and records the result in the new DecodedLeaves list - failures are surfaced as status codes (not thrown) so a container with a mix of plaintext and AES-wrapped leaves still walks cleanly * AcronisTibxReader: surfaces a fourth synthetic entry lsm-records.tsv alongside the existing metadata.ini + pages.tsv + acronis-tibx.bin. Per-LEAF rows include page_index, file_offset, ctree_id, encoding, len, zlen, count, decompressed_length, chunk_count, status, scanned_item_name_count. A second section lists candidate filenames as (name, alt_name, dos_attrs, creation_time_utc, last_write_time_utc) rows * AcronisTibxReader metadata.ini: parse_status promoted to ro-metadata+page-walk+lsm-record-decode, stage=3, ro_promotion=page-frame-walk + lz4-chained-stream-leaf-bodies + itemcommon-scan. Adds Stage-3 aggregates (lsm_leaf_decode_attempts, lsm_leaf_decode_succeeded, lsm_leaf_decode_failed, lsm_scanned_item_name_count, lsm_leaf_decode_status_codes), three new RE-target entries (re_target_6=lsm_page_read @ 0x56930, re_target_7=lz4_chained_stream_decoder @ 0x54fb0, re_target_8=golomb_decode_mod256 @ 0x53ef0), three new decoded_X surfaces (decoded_5=leaf_body_lz4_chained_stream, decoded_6=itemcommon_attribute_scan, decoded_7=golomb_rice_codec_mod256), and renumbered blocker_X to reflect Stage-3 promotion (1=lsm_record_framing_inside_decompressed_leaf_body, 2=encoding_4_leaf_body_path, 3=lsm_dir_page_record_stream, 4=optional_aes_encryption_gates_leaf_bodies, 5=commit_info_chain_not_decoded, 6=content_defined_chunking_dedup_short_index, 7=deduplicated_itemcommon_attributes) * FileFormat.AcronisTibx.csproj: adds ProjectReference entries for Compression.Core (Lz4BlockDecompressor / Lz4BlockCompressor) and FileFormat.Acronis (AcronisFileMetaBodyDecoder.DecodeItemCommon - reused so the .tib and .tibx InputItem layouts share a single decoder) + AcronisTibxLsmRecordTests (23 new tests, 89 total): Golomb-Rice round-trips (small values, zero, quotient boundary at q=7 vs q=8 escape, 64-bit escape path with arbitrary large values, constants pinning RiceK=8 / Divisor=256 / QuotientEscape=8, null-data + out-of-range-count + negative-count defensive throws, truncated stream returns zero-padded values). DecodeLeafBody round-trips (single-chunk LZ4 plaintext, ItemCommon scan finds the name, reader walks a synthetic container with embedded ItemCommon and surfaces it via ScannedItemNames, lsm-records.tsv carries the per-LEAF row + candidate-name row, metadata.ini documents Stage-3 decoded surface + RE provenance + aggregates). Sad-path coverage (encoding=4 returns soft unsupported_encoding status, empty body returns empty_body status with empty byte[], buffer-underrun caught with status). Scanner false-positive rejection (all-zero noise rejected, FILETIME=1 outside [1980, 2080] rejected, NTFS-forbidden character in name rejected, zero-length name rejected, valid ItemCommon embedded inside larger buffer found at the correct offset). Constants pinned (EncodingLz4ChainedStream=3, EncodingAlternative=4, LeafBodyOffset=0x20) * AcronisTibxDetectionTests / AcronisTibxLsmWalkTests: existing parse_status / stage / ro_promotion / blocker_X / entry-name assertions updated to the Stage-3 surface - Reader_EmitsMetadataIniAndBinSyntheticEntries + Descriptor_List_SurfacesPagesTsvAlongsideMetadataAndBin now expect 4 entries (metadata.ini + lsm-records.tsv + pages.tsv + acronis-tibx.bin), Metadata_SurfacesParseStatusAndStageMarkers expects parse_status=ro-metadata+page-walk+lsm-record-decode / stage=3 / ro_promotion=page-frame-walk + lz4-chained-stream-leaf-bodies + itemcommon-scan, Metadata_DocumentsBlockersOnLsmTreeWalk expects the seven Stage-3 blocker names, List_ReturnsThreeEntries expects 4 entries ! What was NOT decoded this pass:   - The formal per-record (key_length, key_bytes, value_length, value_bytes) framing INSIDE the LZ4-decompressed leaf body - lsm_item.h is Acronis-internal and the per-record bit-level layout is not publicly specified. The ItemCommon scanner above is forensic-grade pattern-matching not a deterministic record walk; it will miss records whose ItemCommon attribute was dedup-ed into a side table (the bit-23 stored-by-hash form per the .tib AcronisFileMetaBodyDecoder code path) and records gated by AES wrap (the page frame stays plaintext but the body beneath +0x20 may be AES-CBC per archive_encr.c + crypto_aes.c)   - The encoding=4 alternative leaf-body path - libarchive3.so accepts encoding bytes 3 and 4 per the cmp $0x4, %bl at 0x55404, but the 4 path is not yet decoded. Real ATI 2018+ corpora are needed to determine when 4 is used vs 3   - The LSM_DIR page record stream - LDIR pages carry (name_prefix, child_page_id) tuples for tree descent with the same encoding byte (3 or 4), but the per-record key/value layout differs from LEAF and is not yet decoded   - The ARCI commit-info page chain that ties leaf pages to logical items via segment ids - chain root lives at the page-zero chain_start_pg field but the per-CI-page record layout is undocumented   - The Acronis-internal short-fingerprint dedup index per dedup_short_index.c - leaf records that reference deduplicated extents point at this index which we cannot resolve without the spec (3848aae)
+- Macrium Reflect pre-X block payload codec (Stage-1 → Stage-2 R/O) + MacriumPreXCodec: clean-room C# port of the Lempel-Ziv-derived block-   payload decoder used by .mrimg / .mrbak / .mrex / .mrsql containers.   Algorithm description sourced from the MIT-licensed community reference   project ccooper21/mrimg-tools (no source copy — re-implementation from   the algorithm shape). Decoder shape: 32-bit interleaved control word   with 31 token slots (bit 0 = literal vs op), six op dispatch branches   keyed off the low nibble of the next 4 bytes (RLE op==0x0F, long copy   op==0x07, medium copy op&0x07==0x03, short copy op&0x03==0x02, fixed-3   copy op&0x03==0x01, fixed-3 tiny op&0x03==0x00). Back-references   emitted byte-at-a-time so overlapping matches behave like a forward   run. Bookkeeping correctly tracks bytesProduced separately from the   output cursor since each op writes encoded_count+1 bytes but only   advances by encoded_count (the trailing scratch byte is overwritten by   the next token, or becomes the final byte of the block) * MacriumPreXFormatDescriptor: now uses MacriumPreXCodec to decode the   first MaxDecodedBlocks=16 blocks, surfacing each as a block-NN.bin   synthetic entry. metadata.ini gains decoded_blocks, decode_failures,   first_decode_failure, parse_status="decoded"|"decoded+comment", and   payload_decompression="implemented". Decoder failures are swallowed   per-block so an encrypted/corrupt block doesn't tank listing for   the rest of the file + MacriumPreXCodecTests: 17 NUnit cases covering all six op branches   via bit-by-bit VectorBuilder hand-crafted vectors — literal-only,   literal stream spanning two control words, RLE expansion, RLE +   literal trailing-byte overwrite, fixed-tiny copy, fixed-short copy,   short copy with overlapping match, medium copy, long copy. Plus   boundary cases (negative / oversize uncompressed_length, zero-length   output) and exception cases (back-reference before block start,   truncated control word, output buffer overflow). Also two integration   tests proving the descriptor surfaces decoded block-00.bin entries * MacriumPreXTests.Extract_SyntheticMrimg_WritesAllSynthetics: updated   the metadata.ini assertions — the synthetic fixture's pseudo-random   body is not valid codec input so decoder bails cleanly and metadata   surfaces payload_decompression=implemented_but_no_block_decoded +   decoded_blocks=0 + decode_failures=1 (proving the codec runs without   taking the listing path down) ! Out of scope (documented in descriptor XML doc): the BAT-style   block-index walk that maps (volume, sector) -> (block, offset) for   inner partition reconstruction; the AES-128/192/256 catalog decryptor   used by password-protected backups. Both deferred to a future phase (f7d56b5)
+- Norton Ghost pre-3.0 (Ghost 1.x / 2.x DOS-era, 1996-1998) R/O Stage-1 metadata via binary inspection of Ghost 1.6 GHOST.EXE — promotes the version-gated Stage-0 diagnostic fallback that the modern reader emitted when it found a FE EF header without 0x012F18D8 record framing + GhostLegacyReader: dedicated pre-3.0 dump-file parser — recognises images by the {FE EF magic at offset 0 + recognised head-type byte (1/2/3) at offset 2 + ABSENCE of the modern 0x012F18D8 record magic anywhere in the body}, surfaces metadata.ini (head type, image size, parse status, RE source attribution), the 512-byte dump-head bytes verbatim and the rest of the file as dump-body + GhostLegacyConstants: pinned on-disk constants reverse-engineered from Ghost 1.6 GHOST.EXE (archive.org item ghost16, MD5 64cef43d0eb8d456de990cc95353fa05). The 0xFE / 0xEF magic bytes, the 512-byte head size and the head-type-byte at offset 2 are all confirmed against both the encoder (WriteDumpHeader at file_off 0x897d — bytes at 0x89b3 / 0x89ba / 0x89c2 / 0x899d) AND the decoder (ReadDumpHeader2 at file_off 0x8a6f — bytes at 0x8aa8 / 0x8aae / 0x8ac8). Head type 1 = disk descriptor / first record (caller at file_off 0x84df), 2 = partition record (caller at 0x8794), 3 = boot record (caller at 0x86a8) * GhostReader.Parse: when the modern 0x012F18D8 container parse fails, try GhostLegacyReader.LooksLikeLegacyHeader before falling through to the Stage-0 raw-container fallback. Pre-3.0 images are now classified as PreModern1And2 and surface dump-head.bin + dump-body.bin + a rich metadata.ini instead of a single opaque ghost-image.gho.bin * GhostGenerationHint: add PreModern1And2 enum value (4) for the new Stage-1 path; PossiblyLegacy4To7 still classifies the no-record-magic-but-no-recognised-head-type FE EF case * GhostFormatDescriptor.Description: now documents the pre-3.0 Stage-1 surface (head magic + head-type byte + dump-head/body extraction) alongside the existing modern Ghost 3.0+ R/W. Per-file extraction (FAT directory walk inside the stored partition body) is honestly flagged as out-of-scope for Stage-1 since we don't have a Ghost-1.6-produced corpus to validate cluster-level extraction * GhostReader.LegacyHeadType: new public read-only property exposing the head-type byte when a pre-3.0 image was parsed (0 otherwise) + Stage-1 acceptance gates added to GhostFormatTests: recognises head types 1/2/3, surfaces dump-head + dump-body verbatim, metadata documents the scope + RE source, descriptor List surfaces all three Stage-1 entries (no Stage-0 raw fallback), legacy detector rejects FE-EF-but-modern-record-magic-present, rejects unknown head type, rejects bytes-too-short, rejects wrong magic, constants pinned to the values established by binary inspection, handles empty-body edge case * Reader_VersionGatesLegacyShapedHeader: renamed to Reader_VersionGatesUnknownFeEfShapedHeader and reworked to use head-type byte 0xFF (truly unknown) so the test continues to exercise the Stage-0 fallback — the original test data happened to have head-type byte 2 which now correctly classifies as pre-3.0 (so the old Stage-0 surface assertion no longer applies) ! Per-file extraction (FAT12/FAT16 cluster-walk inside the partition body) deferred — Ghost 1.x / 2.x stores FAT partitions as a directory + file-data structure that requires a DOS-specific FAT walk semantics (the binary's BrIniFAT / BrSendDir / BrRcvCloneFile path), not a raw cluster image. Without a real Ghost-produced corpus we cannot validate cluster-level extraction so we surface the dump body verbatim and direct users to Symantec Ghost Explorer for inner-FAT recovery. PKWARE-DCL-Implode "Old" compression (modern compression byte = 1) remains irrecoverable per the earlier cross-vendor finding (07a9a70)
+- Macrium Reflect pre-X (.mrimg/.mrbak/.mrex/.mrsql) Stage-0 → Stage-1 R/O metadata via binary RE (d4a9353)
+- AOMEI INDEX_TYPE_* + INFO_TYPE_* enum + BR_IMAGE_INDEX header layout reverse-engineered from binary analysis of ImgFile.dll; vendor BR_STANDARD_HEADER size + BRCloudv2 source-tree codename pinned + AomeiConstants: 5 new INDEX_TYPE_* numeric values — ROOT=0x200, VOLUME=0x201, DATABLOCK=0x202, DIRTREE=0x300, DATAAREA=0x301 — all five recovered by cross-referencing each `INDEX_TYPE_xxx==Head.Type` assert string xref against the `cmp dword ptr [reg+disp], imm32` preamble that immediately precedes the assert failure branch in ImgFile.dll + AomeiConstants: 9 new INFO_TYPE_* numeric values past the original four — IMAGE_SPLIT_SIZE=0x104, IMAGE_COMMENT=0x108, BACKUP_TIME=0x10B, BACKUP_OPTION=0x10D, DISK_INFO=0x102, VOLUME_INFO=0x103, FLB_PATH_LIST=0x112, FLB_BACKUP_OPTION=0x113, FLB_BACKUP_OPTION_EX=0x116 — recovered by tracing each `push imm32` / `mov [stack], imm32` immediately before the `GetImageInfo` / `AddImageInfo` callsite that loads the matching assert string + AomeiConstants: vendor BR_STANDARD_HEADER size pinned at 16 bytes (Type:u32, Size:u32, Crc32:u32, Reserved:u32) per `cmp ecx, 0x10` preamble at `Length>=sizeof(BR_STANDARD_HEADER)` assert in FlbImageWriter.cpp — this codebase still ships a wire-incompatible 12-byte alias of the layout (round-trips through our reader, not byte-compatible with the AOMEI application); the alias is documented explicitly alongside the new VendorStandardHeaderSize=16 constant + AomeiConstants: BR_IMAGE_INDEX header layout pinned — EntryCount at +0x14, EntrySize at +0x18, entries packed at +0x1C — recovered by reader-side `cmp dword ptr [edx+0x18], 0x20` (EntrySize == sizeof(VDB)) and writer-side `mov [esi+0x14], EntryCount` + AomeiConstants: sizeof(BR_IMAGE_INDEX_ENTRY_VDB)=0x20 pinned at the `cmp [edx+0x18], 0x20` preamble before the `pIndex->EntrySize==sizeof(BR_IMAGE_INDEX_ENTRY_VDB)` assert in ImageVolume.cpp + AomeiConstants: vendor source-tree codename "BRCloudv2" pinned — embedded in the installer's PDB paths as `E:\BRCloudv2\src\ImgFile\*.cpp` (BlockContainer.cpp, BrFileWin.cpp, DataConvert.cpp, DsImgTask.cpp, FlbDataRegion.cpp, FlbDirEntry.cpp, FlbFileRegion.cpp, FlbImage.cpp, FlbImageReader.cpp, FlbImageWriter.cpp, FlbImgTask.cpp, Image.cpp, ImageFile.cpp, ImageFileSet.cpp, ImageReader.cpp, ImageReaderHelp.cpp, ImageVolume.cpp, ImageWriter.cpp, ImageWriterHelp.cpp, ImgTaskMgr.cpp, ImgWriteCache.cpp) + BrImageIndex / BrImageIndexEntryVdb / BrImageIndexEntryFdb: passive data classes capturing the recovered field name list — for VDB: RegNo, BlockNo, ImgOffset, NewSize, OldSize, Crc32 (recovered via `m_pImgSet->ReadData(vdb.ImgOffset, pNew, vdb.NewSize)`, `vdb.NewSize==vdb.OldSize`, `Crc32==vdb.Crc32`, `GetBlock(vdb.RegNo, vdb.BlockNo, ...)` access patterns); for FDB: same minus RegNo (file backups have a single logical region). BrImageIndex.TryReadVendor parses EntryCount + EntrySize from a 0x1C-byte vendor header on input bytes (without committing to emitting one yet — the per-entry field byte offsets remain undetermined) * AomeiInfoRecord.TypeName: extended to recognise all 14 new tags (13 INFO_TYPE_* and the 5 INDEX_TYPE_*); added IsIndex helper that returns true for the five INDEX_TYPE_* values so callers can dispatch to BR_IMAGE_INDEX parsing * AomeiFormatDescriptor.Description: rewritten to reflect the decoded enum + structural facts plus the remaining gaps (head/tail body byte offsets undetermined, per-entry VDB field byte offsets undetermined, FLB_SUB_ENTRY_LIST / FLB_FILE_DATA_BLOCK_LIST multi-candidate values not yet uniquely pinned, AES variant + IV derivation undetermined); metadata.ini gains structured surfacing of the new enums (info_types_enum, index_types_enum, index_entry_layout_offsets, vdb_entry_size, vdb_entry_field_names, vendor_standard_header_size, shipped_standard_header_alias_size) so downstream forensic tooling can index against the recovered facts * AomeiWriter.UserDataTypeTag: doc updated — 0xF001 sits above the entire recovered tag range (INFO 0x102..0x116, INDEX 0x200..0x301) rather than the original "below 0x200" claim + AomeiDataBlockBodyTests (38 new tests): pins all 5 INDEX_TYPE_* numeric values, all 9 new INFO_TYPE_* numeric values, the 16-byte vendor BR_STANDARD_HEADER size + the 12-byte alias, the BR_IMAGE_INDEX header offsets (EntryCount+0x14 / EntrySize+0x18 / Entries+0x1C), sizeof(VDB)=0x20, BrImageIndex.TryReadVendor parses + rejects short input, VDB/FDB data classes round-trip via initializer, all 14 new TypeName mappings + IsIndex behaviour, the BRCloudv2 vendor codename, and the metadata.ini surface format — uniqueness invariants assert no INFO/INDEX_TYPE collide and that the INFO range stays inside [0x100, 0x1FF] so the 0xF001 user-data namespace remains safe * AomeiTests.Extract_WritesParsedHeader_OnValidMagic: assertion strings updated to match the new metadata.ini key wording (head_body_layout=undocumented_past_first_12_bytes, tail_body_layout=carries_DataOffInSet_u64, index_body_layout=BR_IMAGE_INDEX_header_pinned) ! What was NOT decoded: byte offsets of RegNo / BlockNo / ImgOffset / NewSize / OldSize / Crc32 fields within the 0x20-byte VDB entry — the C++ accesses them as typed struct members so no numeric disp immediates appear in the disassembly; sizeof(BR_IMAGE_INDEX_ENTRY_FDB) — no `cmp [reg+0x18], imm` preamble visible at the FDB assert site; byte offsets of DataOffInSet:u64 + DataLenInSet:u64 within the 0x674-byte file tail body; the multi-candidate numeric values for INFO_TYPE_FLB_SUB_ENTRY_LIST and INFO_TYPE_FLB_FILE_DATA_BLOCK_LIST (both narrowed to {0x110, 0x111, 0x128}); INFO_TYPE_VOLUME_DATA_REGION numeric value (the assert site shows no `cmp` preamble — the type comes from the SubList entry tag rather than a literal); the on-disk wire layout has NOT been swapped to the 16-byte vendor BR_STANDARD_HEADER (Type at +0, Size at +4) so containers emitted by AomeiWriter still round-trip through our own reader but are not byte-compatible with the AOMEI Backupper application; AES variant + IV derivation (26f1dc1)
+- Acronis True Image .tibx Stage-2: page-frame walk per ar_page_verify + lsm_dump_ctrees binary RE + AcronisTibxPage + AcronisTibxLsmPageSubHeader: 4 KiB page frame parser surfacing the page-type tag at +0x1 (1=HDR / 2=LSM_LEAF / 3=LSM_DIR / 4=GOLOMB / 5=DATA / 6=CI per the page-type table at libarchive3.so 0x963fa), the BE32 stored CRC at +0x4, the 4-byte content magic at +0x8, and (for LEAF/LDIR pages) the LSM sub-header at +0xC..+0x1C carrying version, encoding, BE16 count, BE32 len/zlen/seq and the ctree-id byte. Page-frame layout recovered from binary RE of ar_page_verify at libarchive3.so 0x6bef0 (sentinel 'A' at +0, type-tag check at +1, reserved-zero check at +2, BE32 CRC at +4 over the full page with the CRC field zeroed). LSM sub-header recovered from lsm_dump_ctrees at 0x590f7 (the same loads the diagnostic JSON dump emits as "version" / "encoding" / "count" / "len" / "zlen" / "seq" / "id"). HDR page-zero is detected by sniffing the 4-byte ASCII "ARCH" magic at +0x0 (the page-zero header takes the alternative verify path at libarchive3.so 0x233bb because its +0x1 byte is 'R' not a type tag) + AcronisTibxLsmEntry: per-page summary record (page-index, file-offset, page-type, content-magic, stored-crc, LSM sub-header) * AcronisTibxReader.WalkPages / LsmEntries / PageTypeCounts / PageCount: walks the container as a stream of 4 KiB page frames, classifies each by type, decodes the LSM sub-header for LEAF/LDIR pages, and counts per-page-type tags. Best-effort: malformed pages (missing 'A' sentinel) are classified as Unknown rather than throwing; trailing partial pages smaller than one frame are ignored * AcronisTibxReader: now surfaces three synthetic entries instead of two — metadata.ini (parsed page-zero header + page-walk aggregates), pages.tsv (per-page summary table), acronis-tibx.bin (verbatim container) * AcronisTibxReader metadata.ini: parse_status promoted to "ro-metadata+page-walk", stage=2, ro_promotion="page-frame-walk + metadata". Adds the page-frame layout offsets (sentinel/type-tag/CRC/content-magic), the 0..6 page-type tag mapping, per-page-type counts, aggregate LSM record-count sums for leaf and dir pages, aggregate LSM uncompressed (len) and compressed (zlen) size sums, the distinct ctree-id list, and updated decoded_1..4 (what is decoded) + blocker_1..5 (what is documented-TODO) + stretch_goal (link LSM record attributes to DATA page extents by reusing AcronisFileMetaBodyDecoder from FileFormat.Acronis since the InputItem attribute-stream layout is shared with classic .tib) * AcronisTibxFormatDescriptor.Description: updated to cite the Stage-2 page-frame walk, the page-frame layout, the page-type tag table, the LSM sub-header offsets, and pages.tsv + AcronisTibxLsmWalkTests (25 new tests, 66 total): page-type enum tag values (0..6 ordering vs. libarchive3.so 0x963fa string-table positions), Page.Parse round-trips for HDR / LSM_LEAF / LSM_DIR / CI / DATA pages, LSM sub-header field round-trip via BE16 count + BE32 len/zlen/seq + ctree-id byte, unknown-tag-clamped-to-Unknown, sentinel-byte mismatch returns null, too-small buffer returns null, Reader.WalkPages aggregates page-type counts across mixed containers, LsmEntries preserve file-offsets + page-indices, metadata.ini surfaces page_count / per-page-type counts / lsm_leaf_pages + lsm_dir_pages / record-count sums / uncompressed + compressed size sums / ctree-id list (deduplicated + sorted), pages.tsv has one row per page with the column-header row and per-row content-magic + sub-header columns (ASCII when printable, hex when not), metadata.ini documents the page-frame offset table + page-type tag mapping + decoded_1..4 surface, stretch_goal cites AcronisFileMetaBodyDecoder, zero-filled trailing page classified as Unknown (not throw), partial-page trailing fragment ignored, descriptor List() surfaces the three synthetic entries * AcronisTibxDetectionTests: Reader_EmitsMetadataIniAndBinSyntheticEntries / List_ReturnsTwoEntries renamed/updated to expect the three Stage-2 entries (metadata.ini + pages.tsv + acronis-tibx.bin), Metadata_SurfacesParseStatusAndStageMarkers updated to expect parse_status=ro-metadata+page-walk / stage=2 / ro_promotion=page-frame-walk + metadata, Metadata_DocumentsBlockersOnLsmTreeWalk updated to expect the Stage-2 blocker names (blocker_1=lsm_record_stream_inside_leaf_pages, blocker_4=optional_aes_encryption_gates_leaf_bodies) ! What was NOT decoded this pass:   - The Golomb-coded (name, child_page_id) record stream inside LSM_DIR pages — these are the directory entries that point at child pages; without them we can't traverse from the root down to a specific leaf. The bit-width parameters are adaptive per-page per lsm_lookup.c + golomb.c   - The per-item attribute-record body inside LSM_LEAF pages — once decoded, the same AcronisFileMetaBodyDecoder from FileFormat.Acronis (which already decodes ItemCommon attribute id 0x10 carrying the filename) could be wired here since the .tib/.tibx InputItem model is shared   - The ARCI commit-info page chain that ties leaf pages to logical items via segment ids — the chain root lives at the page-zero "chain_start_pg" field but the per-CI-page record layout is undocumented   - The optional AES wrapping (archive_encr.c + crypto_aes.c) that gates leaf/data page bodies when encryption is enabled   - The DATA page extent layout that file content actually lives in — once the LSM record stream is decoded, leaf records would reference DATA page extents by (page-id, offset, length) tuples (dad2a96)
+- Acronis classic .tib ItemCommon 44-byte fixed-header tail decoded via reverse-engineered BackupCommonAttributes writer + four new typed attribute decoders (0x17 Replica, 0x18 ItemCommonExtra, 0x80 SliceItem, 0x90 SliceItemBlob) + AcronisItemCommonAttribute typed fields: DosAttributes (u32 @ offset 4), CreationTime / LastWriteTime / LastAccessTime / ChangeTime (4× FILETIME at offsets 8/16/24/32), TrailerDword (u32 @ offset 40). Order matches NTFS $STANDARD_INFORMATION + the symmetric ArchiveApi::ItemBackuperImpl::BackupCommonAttributes writer in ti_tools.dll (k:\9202\archive\ver2\file\backup_operation.cpp) which emits these via FileItem vtable[0xc] (DOS attrs), vtable[0x18] (creation), vtable[0x5c] (write), vtable[0x24] (access), vtable[0x28] (change), vtable[0x34] (trailer). FixedHeader byte[44] is still surfaced verbatim for diagnostic/round-trip use. Nullable DateTime properties (CreationTimeUtc/etc.) convert FILETIME to UTC, gracefully returning null on the unset-zero case and on out-of-range values + AcronisReplicaAttribute (0x17, 24-byte body): 16-byte GUID block + 2× uint32 cookies. GUID is byte-swapped on read via the same Data1-32bit-BE↔LE / Data2-16bit-BE↔LE / Data3-16bit-BE↔LE / Data4-verbatim conversion that FUN_00fed680 in ti_tools.dll applies. Source: ArchiveApi::ReplicaItemImpl::TakeAttributeReplica + AcronisItemCommonExtraAttribute (0x18, 8-byte body): uint64 cookie. Source: BackupCommonAttributes' trailing 0x18 write via FileItem vtable[0x2c]; binary's reader throws on size != 8 so decoder honors that gate + AcronisSliceItemAttribute (0x80): 25-byte short form (GUID + 2× u32 + 1 byte flag) with optional extended tail (1 sentinel pad + u16 nameLength + UTF-16LE name). Source: ArchiveApi::SliceItemImpl::PreloadAttributes id-0x80 branch — reads up to 0x1F bytes, accepts 0x19 (25) as the short-form canon, longer bodies surface the trailing name + AcronisSliceItemBlobAttribute (0x90): variable-length opaque payload surfaced verbatim. Source: SliceItemImpl::PreloadAttributes id-0x90 branch (no internal framing decoded in the binary) + AcronisFileMetaBody.Replica / ItemCommonExtra / SliceItem / SliceItemBlob — top-level typed accessors on the parsed body, populated by the per-id dispatch in AcronisFileMetaBodyDecoder.Decode + AcronisFileMetaBodyTests (18 new): DecodeItemCommon_TypedFields_RoundTripDosAttributesAndFourFiletimes, CreationTimeUtc_ConvertsFromFiletime, AllTimestampsZero_DateTimePropertiesAreNull, OutOfRangeFiletime_GracefullyReturnsNullDateTime, HexLiteralFixture_PinsFixedHeaderLayout (hand-rolled bytes pin the exact 44-byte tail offsets against future regressions), DecodeReplica_RoundTripsGuidAndCookies + TooShortBody + Decode_ReplicaAttribute_SurfacesInTopLevelView, ItemCommonExtra round-trip + too-short-body defensive gate, DecodeSliceItem_ShortForm + ExtendedForm + TooShort + Decode_SliceItemAttribute_SurfacesInTopLevelView, SliceItemBlob round-trip + empty-blob edge case, Decode_AllNewlyDecodedAttributes_SurfacedTogether (multi-attribute body carries every newly-decoded id at once), Decode_DeduplicatedSliceItem_NotDecodedAsInline (bit-23 dedup-flag contract still gates the new ids) * AcronisFormatDescriptor.Description: documents the four FILETIMEs + DosAttributes inside ItemCommon and the newly-decoded Replica / ItemCommonExtra / SliceItem / SliceItemBlob ids; ACL handler remains documented-TODO ! What was NOT decoded:   - The ACL blob shape (record type 5 / FileMetaC body). No per-id handler for security-descriptor bytes was located in the binary inspection pass; the strings table only surfaces NTFS-side SecureStorage references, not an Acronis-side TakeAttributeAcl handler. Record-5 bodies are still surfaced as attribute streams when they parse as such, otherwise as raw payload. The Acronis classic .tib likely either (a) omits ACLs entirely on the resident attribute path or (b) routes them through a yet-unidentified id whose handler doesn't carry the canonical "Acl" string   - The semantic identity of the four FILETIMEs in ItemCommon is the most-defensible mapping (CreationTime / LastWriteTime / LastAccessTime / ChangeTime) given the BackupCommonAttributes writer order matches NTFS $STANDARD_INFORMATION, but per-vtable-index ground-truth would need a real .tib fixture with known wall-clock files; we don't have one. The decoder labels them per the standard order and surfaces the raw uint64 alongside for downstream callers who want to relabel   - The semantics of the TrailerDword at offset 40 (written from FileItem vtable[0x34]). Surfaced verbatim   - The trailing uint32 cookies on Replica and SliceItem — surfaced verbatim as Value1 / Value2 pending a wire-tap with known input   - The internal framing of SliceItemBlob (0x90). Reader treats the body as opaque bytes — likely a UTF-16 comment string but the binary makes no such assumption (3a28e18)
+- Backup-software disk images section in Hawkynt.FileFormats.Archives/README (655dc7c)
+- Acronis FileMeta 102/1/2/5 body field layout reverse-engineered as an InputItem attribute stream; filename decoder lands behind the existing chain-walk anchor + AcronisFileMetaBody + AcronisFileMetaBodyDecoder.Decode: the inflated body shape is now decoded — uint32 attributeCount followed by N×{uint32 idAndFlags, uint16 size, byte[size] body} tuples. Bit 23 of the dword is the dedup-by-hash flag (matches InputResidentAttributeEnumerator::GetId masking the raw uint32 with 0xff7fffff to drop the flag); size==16 dedup bodies are MD5 hashes referring to a side table we don't dereference (and the decoder honestly refuses to mistake them for inline bodies). The high-value attribute ids are decoded with shapes from the per-id TakeAttribute*/PreloadAttribute* handlers in archive\ver2\file\item_supp.cpp: ItemCommon(0x10) = uint16 nameLength + uint16 altNameLength + byte[40] fixed-header rest + UTF-16LE name + UTF-16LE altName — this is where the FILENAME lives; SourceItem(0x40) = uint16 pathLength + uint16 kind + uint32 id + UTF-16LE path; HardLinkId(0x14) = uint64; BackupTime(0x50) = uint64; TimeZone(0x60) = int32 minutes-from-UTC. Ids we haven't decoded (Replica 0x17, ItemCommonExtra 0x18, SliceItem 0x80, SliceItemBlob 0x90, anything else encountered) are surfaced as AcronisRawAttribute so callers still see them. Decoder is tolerant of truncated headers/bodies — it surfaces a partial result rather than throwing so the existing record walk can keep going across forged fixtures + AcronisRecord.MetaBody: 102/1/2/5 records now carry an AcronisFileMetaBody on the record, populated via TryDecodeMetaBody which catches and nulls out any decode exception so the legacy ascii-payload test fixtures don't break the record walk + AcronisReader.FileMetaBodiesByEntry / DecodedNamesByEntry: per-entry views resolved through the existing chain walk (Listing.MetaOffset -> 102 anchor) — DecodedNamesByEntry[i] surfaces the ItemCommon name from the chain-walked 102 body so callers can compare it against the Listing-record Name. null entries indicate "chain walk didn't resolve" OR "102 body didn't decode as an attribute stream" OR "decoded body had no ItemCommon" * AcronisFormatDescriptor.Description: now names the decoded ids (ItemCommon 0x10, SourceItem 0x40, HardLinkId 0x14, BackupTime 0x50, TimeZone 0x60) and the DecodedName surface * AcronisRecord field-level XML docs filled in (Type/Start/End/Payload/Files/ConfigAttrs/Index/MetaBody) + AcronisFileMetaBodyTests (19 new): Decode_EmptyAttributeStream, TooShortForCount, SingleItemCommonAttribute_RoundTripsNameAndLengths, ItemCommon_WithoutAltName, SourceItem/HardLinkId/BackupTime/TimeZone round-trips, MultipleAttributes_AllRoundTrip, DeduplicatedAttribute_MasksFlagFromIdAndSkipsInlineDecode (the bit-23 dedup-flag contract), HexLiteralFixture_ItemCommonWithName_DecodesAsExpected (hand-rolled bytes pinning the wire layout against future regressions), Truncated header + truncated body, DecodeItemCommon defensive returns null for too-short body and for nameLength-overflows-body, Reader_SurfacesDecodedName_FromAnchored102Body (end-to-end: builder writes a 102 carrying ItemCommon, reader's DecodedNamesByEntry surfaces the name distinct from the Listing-record name), Reader_DecodedName_MatchesListingName_WhenBothCarrySameName, Reader_DecodedNameNull_WhenChainWalkUnresolved (MetaOffset=0 legacy case), Reader_FileMetaBodyDecodingTolerant_OfNonAttributePayload (ascii-marker fixture doesn't blow up the reader) ! What was NOT decoded:   - The 40 unknown bytes inside ItemCommon's 44-byte fixed header past (nameLength,altNameLength) at offsets 4-43. These almost certainly carry the file's DOS attributes + file-system timestamps (created/written/accessed) per the InputItem model documented by binary inspection of ti_tools.dll's ContinuousAttributeWrapperImpl::ReadStandardAttributes which reads exactly 28 bytes of standard attributes, but the exact field offsets inside the 44-byte block are not pinned down. Surfaced verbatim in AcronisItemCommonAttribute.FixedHeader for callers who want to probe further   - Which of the 102/1/2/5 records carries the resident attribute stream (this code accepts any of them) vs. the nonresident streams that the binary's PreloadNonresidentAttributes path handles. The decoder runs on all four record types' inflated bodies; in the wild the resident stream that carries ItemCommon is likely just one specific record type, but we don't have a real .tib to confirm which   - Attribute ids 0x17 (Replica, 24-byte body), 0x18 (ItemCommonExtra, 8-byte body), 0x80 (SliceItem, 0x19-byte fixed + name), 0x90 (SliceItemBlob, variable). Their byte-level shapes were captured in the binary inspection of ti_tools.dll but not yet decoded into structured types — surfaced as AcronisRawAttribute entries until they're needed   - ACL blob shape (record type 5 / FileMetaC body). The chain walk anchors 5 correctly and the decoder will surface any attribute-stream-shaped 5 body, but the per-id handler for ACL bytes was not located in the binary inspection pass — surfaced as raw attributes until we know which id (or which non-attribute encoding) carries ACLs (b14f2b9)
+- Acronis True Image .tibx Stage-0 -> R/O metadata via binary RE of libarchive3.so + archive3.dll (9c3a655)
+- Paragon PBF promoted from R/O metadata to WORM (write-once round-trippable) via reverse-engineered chunk-offset table emit; zlib + Adler-32 per-chunk wired + ParagonWriter: emits the vendor-literal 'PImg' magic + Major 0x0002 / FormatVersion 0x0003 prefix that survives the vendor's reader gate at HDM-18 RVA 0x4ae6e4, leaves the reverse-engineered vendor offsets (+0xC, +0x26, +0x27, +0x30, +0x34, +0xD8, +0xE8, +0xF1) zero rather than forging them without a real Paragon sample, then installs an 8-byte 'CWBPbpf1' discriminator at +0xF8 past the vendor's last initialised byte. After the 64-byte CWBP table-of-contents (chunk count + chunk-table offset + sectors-per-chunk + segment count + total logical size + header size) the body region writes each chunk's bytes — either verbatim ('stored') or zlib-compressed via System.IO.Compression.ZLibStream (CompressionLevel.Optimal). Compressed payload that grows past the source length falls back to stored on a per-chunk basis. Finalise() lays the chunk-offset table down at the tail (40 bytes per entry: ChunkNumber u32 + ChunkOffset u64 + ChunkSize u32 + IsCompressed byte + 3-byte padding + LogicalSize u32 + Adler32 u32 + 8 reserved bytes) and patches the header pointers + ParagonReader: CWBP-aware fast path — when the +0xF8 discriminator is present, parse the table-of-contents at +0x100, walk the trailing chunk-offset table, surface each chunk as a 'chunk_NNNNNN.bin' entry alongside the existing metadata.ini, verify the per-chunk Adler-32 ('Chunk is not valid, adler32 checksum is wrong.' gate), and zlib-decompress when ChunkIsCompress == 'Y'. Vendor-style PBFs without the CWBP marker still fall through to the existing R/O metadata + opaque-blob path so the existing 34 tests stay green + ParagonReader.ChunkTable / IsCwbpProduced / ChunkCount / TotalLogicalSize / SectorsPerChunk / AssembleLogicalPayload — public API the writer's round-trip tests assert against + ParagonAdler32: clean-room RFC-1950 Adler-32 kept inside FileFormat.Paragon (no Compression.Core dependency added); matches the zlib checksum the vendor uses on each chunk + ParagonChunkInfo: per-chunk struct view exposing the exact ChunkNumber u32 / ChunkOffset u64 / ChunkSize u32 / ChunkIsCompress fields the reverse-engineered debug strings dump + ParagonFormatDescriptor: implements IArchiveCreatable; Capabilities advertises CanCreate + SupportsMultipleEntries alongside CanList / CanExtract / CanTest; Methods adds 'zlib' (default) and 'stored'; Create() routes inputs through ParagonWriter.WriteChunk one chunk per input + ParagonRwTests (22 tests): header field invariants (magic, Major, FormatVersion, CWBP discriminator position, vendor-offset zero-fill), single-chunk compressed + stored round-trip, multi-chunk round-trip, WritePayload chunk-splitting + AssembleLogicalPayload reassembly, highly-compressible chunk shrinks, high-entropy chunk falls back to stored, zero-byte chunk, Adler-32 corruption rejection, vendor-style (non-CWBP) file falls back to R/O metadata, full descriptor Create/List/OpenEntry round-trip, stored-method bypasses zlib, unknown-method throws, null-stream + non-seekable-stream guards, ChunkTable entries expose the reverse-engineered field types, CWBP metadata.ini scope keys, two-write determinism, ~1.5 MB / 24-chunk large-payload round-trip * ParagonDetectionTests: Descriptor_HasExpectedIdentity now asserts IArchiveCreatable presence; Capabilities_AreReadOnly renamed to Capabilities_AreReadWriteWorm with CanCreate=true; Description_FlagsRoMetadata_NoCreateOrModify renamed to Description_FlagsWormCwbp_AndCannotModify (still asserts CanModify=false, the WORM scope is single-shot); Description_PinsRoMetadataTreatment_AndCitesPImg renamed to Description_PinsWormCwbpTreatment_AndCitesPImg (keeps the PImg + TrID + proprietary citations, adds the WORM citation, retains the r/o metadata fallback citation for vendor-produced files) * ParagonFormatDescriptor.Description: documents the WORM-CWBP scope, the vendor-offset zero-fill policy, the CWBP discriminator + chunk-table layout, the zlib-with-Adler-32 per-chunk pipeline, and that vendor-tool byte-compat stays explicitly out of scope (HDM 16+ is restore-only; no real Paragon-produced samples available for clean-room byte validation) * EndToEndInteropTests: '.pbf' added to _selfRoundTripExclusions alongside the existing disk-image backup formats (.gho, .sparseimage, .mrimgx) — WORM layout surfaces entries as 'chunk_NNNNNN.bin' rather than the harness's generic 'repeat.txt / small.txt / random.dat' names ! Out of scope: byte-compat with vendor Paragon Backup & Recovery / Hard Disk Manager — the exact on-disk chunk-table offset inside the vendor's segments, the bitmap-chain (CPbfBitmapIO) encoding, the +0xD8 ParentId chain back-pointer policy, the per-segment split-archive (.000 / .001 / ...) trailer, and the .pfi sidecar magic all remain undocumented past the architectural level. HDM 16+ is restore-only and the Free Edition only writes pVHD, so no real PBF samples are available to byte-validate against. Vendor offsets +0xC / +0x30 / +0x34 / +0xD8 / +0xE8 / +0xF1 stay zero rather than forged (6893ee3)
+- NSF expansion audio: VRC6 (2 pulse + sawtooth), FDS (wavetable + pitch modulator, NSFPlay-exact), MMC5 (2 sweepless pulse + raw PCM), Namco163 (1-8 wavetable channels) — internal chips in Codec.Nes2a03 routed via header flag 0x7B + NSF expansion reuse: VRC7 via Codec.Ym2413 (OPLL core + VRC7 patch ROM overload), Sunsoft 5B via Codec.Ay8910 (StepPrescaler/MixMonoLinear hooks) * NSF/NSFE: expansion tunes now render MONO.wav (rendered_chips=2A03, <chip>) instead of being rejected ! Namco163 multiplex summed-and-averaged (NSFPlay approximation); mix levels NSFPlay-relative not per-cartridge dB (182eb75)
+- Codec.AmrNb (3GPP AMR narrowband, all 8 modes 4.75-12.2 kbit/s; ffmpeg-faithful ACELP, verified 108-113 dB PSNR vs ffmpeg) + Codec.AmrWb (3GPP AMR wideband / G.722.2, all 9 modes 6.6-23.85 kbit/s incl. full high-band synthesis; verified 79-104 dB PSNR vs ffmpeg) + FileFormat.Amr (.amr/.awb + multichannel MC1.0): magic-detected NB/WB, frame-walk decode to MONO/per-channel WAVs ! DTX/SID comfort-noise not synthesized (renders exact-length silence, as ffmpeg does) (80cd499)
+- Codec.HuC6280: PC Engine / TurboGrafx-16 CPU (65C02 superset — block moves TII/TDD/TIN/TIA/TAI, MPR bank mapper TAM/TMA, CSL/CSH, ST0-2, T-flag) + 6-channel wavetable PSG (per-channel L/R pan, DDA, noise, ch5→4 LFO) + HES: renders to stereo PCM via HuC6280+PSG — LEFT.wav/RIGHT.wav channels + lazy TRACK_01 (HES carries no song count → start song only) ! LFO/noise approximations; CSL/CSH flagged but cycle counts not rescaled (2b0713c)
+- Codec.Opl (Yamaha OPL family: YM3526/OPL, YM3812/OPL2, YMF262/OPL3, Y8950 — Nuked-OPL3 port: PG/EG/waveforms, 4-op modes, rhythm, OPL3 stereo panning) + VGM: OPL2 (0x5A), OPL (0x5B), Y8950 (0x5C), OPL3 (0x5E/0x5F) render to PCM — clocks at header 0x50/0x54/0x58/0x5C; merged alongside the YM2151/2203/2608 dispatch ! Y8950 ADPCM (DELTA-T) gated — VGM carries no sample ROM in the common case; FM part renders (8e887f5)
+- Codec.Ym2151 (Yamaha OPM: 8ch 4-op, KC/KF phase gen, LFO saw/sq/tri/noise + PMD/AMD, noise on ch8, per-channel L/R, 8 algorithms) + Codec.Ym2203 (OPN: 3 FM via OPN2-core reuse + SSG via Ay8910) and Codec.Ym2608 (OPNA: 6 FM stereo + SSG; rhythm/ADPCM-B gated) + VGM: YM2151 (0x54), YM2203 (0x55), YM2608 (0x56/0x57) render to PCM — clocks at header 0x30/0x44/0x48 ! YM2608 rhythm (ADPCM-A) + ADPCM-B gated to FM+SSG only (no sample ROM modelled) (55e74ff)
+- MOD/S3M/XM/IT: rendered stereo SONG.wav now also surfaces per-channel SONG_LEFT.wav / SONG_RIGHT.wav (Kind Channel) via PcmCodec split — channels extractable wherever a stereo mix is rendered (0a56594)
+- AudioPseudoArchive: lazy entries — Entry.Lazy(name,kind,factory,declaredSize) renders on Extract only; List uses declared size; result cached per entry (Entry is now a sealed class, eager ctor shape preserved) + NSF/NSFE/GBS/SID/AY/KSS: per-subtune lazy TRACK_nn.wav extraction (stereo renderers → _LEFT/_RIGHT) — each song renders independently on demand + NSFE: full rendering via in-memory NESM-equivalent + NsfPlayer; plst playlist order, time per-song durations, tlbl labels honored * FileFormat.Psm: out Entry? after the Entry struct→class change ! plain KSS (KSCC) carries no subtune table — no per-track list (8d310fe)
+- Codec.TrackerXmIt: FastTracker II XM + Impulse Tracker IT playback — XM linear/Amiga freq, vol/pan envelopes, auto-vibrato, full effect set; IT NNA virtual-channel pool (DCT/DCA), resonant low-pass filter, S-command family + IT214/IT215 sample decompression (schismtracker-faithful, single/double delta + width-change escapes): compressed IT/ITS/ITI samples now decode to WAVs instead of falling back + XM/IT: render SONG.wav (Kind Track) + rendered_* metadata; instrument samples surface as mono WAVs; graceful fallback on any failure ! IT S9x sound-control subset parsed but ignored (surround→centre); MIDI macros not implemented (1d2b7c6)
+- Codec.Tracker: ProTracker MOD + Scream Tracker 3 S3M playback — shared 44100 stereo mixer (16.16 resampler), Amiga period/finetune table, tick/row engine, full effect sets (MOD 0-F + E-subs, S3M A-V + S-subs), deterministic song-length traversal + MOD/S3M: render SONG.wav (Kind Track) from order 0 + rendered_* metadata; instrument samples now surface as mono WAVs (finetune/C2SPD rate, 8->16-bit) instead of raw blobs; graceful fallback to prior surface on any failure (a5eda09)
+- MP4/MOV: each audio track decodes to per-channel TRACKn_<CHANNEL>.wav — AAC (ADTS-wrap from esds ASC), ALAC, MP3, AC-3, FLAC (synth fLaC), Opus (synth Ogg), PCM sowt/twos/lpcm; video stays raw, unsupported tracks keep raw surface + trackN note + Matroska/WebM: per-track decode — A_AAC, A_MPEG/L3, A_AC3/EAC3, A_VORBIS (synth Ogg from xiph-laced CodecPrivate, end-to-end), A_OPUS, A_FLAC, A_PCM, A_MS/ACM (WAVEFORMATEX routing); Xiph/EBML/fixed block-lacing reassembly in MkvDemuxer + AVI: per auds stream decode — PCM, MS-ADPCM, IMA, MP2/MP3, AC-3, A-law/µ-law, EXTENSIBLE SubFormat resolution ! Opus tracks decode to correctly-shaped silence pending Codec.Opus CELT/SILK; MKV zlib/header-strip frame-compression not decoded (dd28508)
+- Codec.Ym2413 (Yamaha OPLL: built-in 15-patch ROM + user patch, 9ch / 6+5 rhythm, KSL/KSR, AM/PM LFOs, half-sine; emu2413-faithful patch table, OPN2-shared log-sin/exp ROMs) + VGM: YM2413 (command 0x51, clock at header 0x10) renders Master System / Mark III FM + MSX-MUSIC logs to PCM alongside SN76489+YM2612 # VGM: regression-pin Game Gear PSG stereo (0x4F) — left-only mask yields zero right-channel energy (9f765f7)
+- Codec.Qoa + .qoa container: QOA slice decode (sign-LMS predict/update, dequant table) incl. encoder for round-trip vectors + Codec.Dfpwm + .dfpwm container: DFPWM1a charge/strength integrator with fs=140 low-pass and anti-jerk (headerless, 48kHz mono convention) + Codec.Bonk + .bonk container: intlist/Rice decode, lattice predictor, mid-side, multi-packet; length-prefixed-filename header handled by tag scan + Codec.WavArc + .wa container: 0CPY/1DIF block decode byte-exact ! WavArc 2SLP/3NLP/4ALP/5ELP adaptive-LPC paths degrade to FULL-only (gated, unverified arithmetic) (39b41ef)
+- SID: full model matrix — per-chip 6581/8580 flags (v2 bits 4-5, v3 bits 6-7, v4 bits 8-9), 6582 alias resolving to 8580, 'like SID #1' inheritance + SID: 2SID/3SID — secondSID/thirdSID address routing with validation ($42-$7E/$E0-$FE even), LEFT/RIGHT/CENTER per-chip WAVs + SID: unknown/either model renders both legs as *_6581.wav/*_8580.wav (20s per leg, 30s single) # SID: CIA timer writes at $DC04/$DC05 no longer swallowed by the SID address window (f5c886e)
+- Codec.CriHca + .hca container: masked/unmasked header, CRC-16, ATH 0/1, cipher types 0/1, scalefactor/intensity dequant, HFR, 128-band IMDCT; per-channel WAVs (keyed cipher 56 and MS-stereo degrade to FULL.hca + metadata note) + ADX: AHX streams (encoding 0x10/0x11) now decode via MPEG-2 LSF Layer II to MONO.wav instead of being rejected (41925d9)
+- Codec.Sbc (Bluetooth SBC + mSBC: CRC-8 EBU, loudness/SNR bit allocation, 4/8-subband fixed-point polyphase synthesis) + raw .sbc/.msbc container with per-channel WAVs + Codec.Siren (G.722.1/Siren7: region categorization, SQVH decode, length-320 IMLT) + .sir/.g7221 container + Codec.S302M (SMPTE 302M AES3: bit-reversed 16/20/24-bit subframe extraction, exact-inverse encode for round-trip vectors) ! Siren14 (G.722.1 Annex C) not implemented — no reference decode path in ffmpeg to port (a615b19)
+- Musepack SV7 ('MP+') decode: mpc7 VLC books, idx_to_quant, scalefactor DPCM, MS-stereo through the shared SV8 synthesis filterbank; .mpc descriptor surfaces SV7 per-channel WAVs + Codec.WmaLossless (0x0163): CDLMS/MCLMS adaptive prediction, AC filter, rawpcm bypass, wired into ASF next to WMA v1/v2/Pro + Codec.Xma: XMA1/XMA2 2KB-packet parsing + per-stream WMAPro orchestration; XWB tag-1 entries route through it ! full XMA stream decode gated to graceful raw-blob fallback (needs WMAPro packet-state re-plumbing) (41bf332)
+- Codec.Atrac1 (MiniDisc ATRAC1: BFU spectral decode, IMDCT 32/128/256, two-stage inverse QMF) + .aea container surfacing FULL.aea and per-channel WAVs + Codec.Ra288 (RealAudio 28.8: G.728 hybrid-window backward LPC, 38-byte frames) wired into RealMedia as fifth decode path + Codec.Ralf (RealAudio Lossless: adaptive LPC + Golomb residuals, 5 decorrelation modes) wired into RealMedia as sixth decode path (5b5b36b)
+- Bink audio codec (RDFT + DCT flavours, ffmpeg binkaudio port) and .bik container: FULL.bik + raw VIDEO track + per-track decoded channel WAVs (Bink2/KB2 audio surfaced as raw blob) + Smacker audio codec (SMKA huffman-tree delta decode) and .smk container: FULL.smk + raw VIDEO track + per-track channel WAVs incl. uncompressed PCM tracks ! Bink-audio-in-Smacker tracks remain blob-only (c4ac068)
+- Codec.AdpcmX: ffmpeg ADPCM/DPCM variant pile — IMA DK3/DK4/EACS/SEAD, EA R1/R2/R3, THP/THP-LE + AFC, SWF, 4XM, Xan DPCM, Interplay DPCM, SDX2, DERF, Gremlin * AST: AFC-coded (codec 0) streams now decode to per-channel WAVs via Codec.AdpcmX instead of FULL-only fallback (f58db07)
+- Codec.GameBoyApu: full SM83 CPU + Game Boy APU (sweep/duty pulses, 32x4-bit wave RAM, 15/7-bit noise LFSR, 512 Hz frame sequencer, NR51 stereo routing) + GBS player (MBC banking, timer-driven rates) — GBS tunes render LEFT/RIGHT.wav (2d688a1)
+- Codec.Z80: reusable full Z80 core (CB/ED/DD/FD incl. DDCB, block ops, alternate set, IM 0/1/2 IRQ injection, exact documented flags) + Codec.Ay8910: AY-3-8910/YM2149 (all 10 envelope shapes, log DAC, 17-bit noise, ABC panning) + ZX Spectrum AY and MSX KSS tunes render LEFT/RIGHT.wav (PSG capture via $FFFD/$BFFD and $A0/$A1; SCC/FMPAC tunes render PSG-only with a note) (6f1ba94)
+- Codec.Nes2a03: NES APU synthesis on the shared Mos6502 core (duty pulses with sweep negate difference, triangle, dual-mode noise LFSR, DMC bus-fed delta playback, verbatim nonlinear mixer tables) + NSF player (bankswitching, NTSC/PAL, speed words) — NSF tunes render the start song to MONO.wav; expansion-chip tunes name the blocker and fall back (00cb68e)
+- Codec.Spc700: full SPC700 CPU (all 256 opcodes, timers, IPL ROM) + S-DSP synthesis (incremental BRR matching Codec.Brr, verbatim gaussian table, ADSR/GAIN, noise LFSR, pitch modulation, 8-tap FIR echo) — SNES .spc dumps render the tune to LEFT/RIGHT.wav @32 kHz (ID666 duration honored), per-instrument extraction unchanged (46328a9)
+- Codec.Mos6502: reusable NMOS 6502 core (official + stable illegal opcodes, BCD with NMOS quirks, JMP-indirect bug, cycle counting) + Codec.Sid: MOS 6581/8580 synthesis (24-bit accumulators, ring mod, hard sync, noise LFSR taps 22+17, reSID-style ADSR, model-specific filter curves) + PSID player (VBI/CIA timing, PAL/NTSC) — SID tunes render the start song to MONO.wav, model honored from header flags; RSID falls back (3ce8916)
+- Codec.Sn76489 (SEGA PSG: tone/noise LFSR/2dB attenuation, GG stereo) + Codec.Ym2612 (OPN2 FM: genuine die log-sin/exp ROMs, 8 algorithms, feedback, LFO, ch3 special, ch6 DAC) + VGM and GYM render to LEFT/RIGHT.wav when the chip set is covered (command-stream execution incl. DAC data blocks, zlib-packed GYM; unsupported chips stay metadata-only with a note) (6da7095)
+- E-AC-3 (A/52 Annex E, bsid 11-16): full BSI, AHT (GAQ + VQ codebooks + 6-point IDCT), variable block counts, fscod2 half rates, LUT exponent strategies — independent substreams decode to channels; SPX parsed (HF synthesis deferred), enhanced coupling rejected with clear message (a7a54c6)
+- Codec.Dts: DTS Coherent Acoustics core decoder (huffman/block-code/plain sample decode, 4-tap inverse ADPCM, high-freq VQ, real LFE FIR, 32-band QMF; verbatim dcadata tables incl. adpcm_vb 4096x4) — FileFormat.Dts extracts per-channel WAVs; DTS-HD extensions parsed-past info-only # RATE-24 bitrate corrected to the canonical 1536000 (old table carried a non-standard extra entry) (2df767e)
+- Codec.Sipr: RealAudio ACELP.NET (modes 8k5/6k5/5k0: LSF VQ, 1/3-resolution adaptive codebook, sparse fixed codebooks, MA gain prediction, 5k0 postfilter, sipr_swaps descrambling) — fourth decoded RealMedia codec; 16k documented-unsupported (c251415)
+- Codec.WmaPro: WMA 9 Professional (tile/subframe trees, generalized channel transforms to 8ch, vec4/2/1 coefficient VLCs with escapes, 24-bit, VBR reservoir) — ASF tag 0x162 decodes to channels (94ffb0a)
+- HE-AAC SBR: payload parse (all frame classes, 10 huffman tables), frequency-table derivation (master/high/low/noise/limiter + patches), full bitstream-domain HF chain (chirp, covariance prediction, gain limiting); QMF audio reconstruction honestly GATED (LC-core output, doubled-rate metadata) pending the polyphase factorization ! SBR QMF synthesis reconstructs only to ~11% RMS in direct form — gated rather than emitting wrong audio (540d7f0)
+- WavPack IEEE-float decode + encode (FLOAT_INFO, wvx extension stream, denormals/±0/NaN/Inf restoration) — float streams split to format-code-3 channel WAVs (3932dd2)
+- Codec.G7231: ITU G.723.1 dual-rate decoder (MP-MLQ 6.3k + ACELP 5.3k, full postfilter chain, comfort-noise generation, erasure concealment; verbatim tables) with raw .g723 container (b80657b)
+- Codec.Speex: narrowband (all 8 submodes, multicomb enhancer, CNG) + wideband SB-CELP + intensity stereo, verbatim speexdata tables — Ogg descriptor decodes Speex streams (.spx recognized) (77b3dd7)
+- Codec.Musepack: SV8 decoder (verbatim mpc8 huffman/cnk/SCF tables, DSCF deltas, mid/side, 32-band polyphase synthesis) with .mpc channel pseudo-archive (SV7 falls back to FULL + metadata) (f264eef)
+- Codec.Atrac3: Sony ATRAC3 (verbatim ffmpeg tables, gain compensation, tonal components, joint-stereo reverse matrixing, 3-band inverse QMF, RM descrambling) — OMA codec-id-0 and RealMedia atrc streams decode to channel WAVs (ATRAC3plus stays surfaced-only) (29c2828)
+- Codec.Cook: RealAudio G2 transform codec (verbatim cookdata tables, gain envelopes, categorize/expand, sqvh unpack, LFG dither, joint-stereo decoupling, inverse MLT) with Int0/Int4/genr deinterleavers — RealMedia cook streams decode to channel WAVs (662cffb)
+- Codec.Ac3: full ATSC A/52 decode — parametric bit allocation (decay/gain/floor/lowcomp/hth + delta), D15/D25/D45 exponents, channel coupling, rematrixing, all mantissa quantizers + dither, dual IMDCT — FileFormat.Ac3 now extracts per-channel WAVs (E-AC-3 stays info-only) (55eac4a)
+- Vorbis floor type 0: LSP header/packet decode + bark-mapped curve synthesis per spec §6.2 — the decoder's last documented gap + synthetic end-to-end Vorbis vectors (hand-assembled codebooks/modes, blocksize 64) give positive decode coverage for BOTH floor types (fc852f4)
+- Codec.Wma: WMA v1/v2 decoder (LSP + VLC exponents, bit-reservoir superframes, noise coding, MS stereo; tables extracted from authoritative sources) + ASF packet depayloader: full Data Object parsing (length-typed fields, multi/compressed payloads, fragment reassembly) — per-stream blobs replace the whole-data dump; WMA streams decode to channel WAVs (1376512)
+- AAC-LC decode completed: spectral Huffman codebooks (values derived from codeword indices), scalefactors, sections, TNS, PNS, intensity + M/S stereo, EIGHT_SHORT grouping, sine/KBD windowed IMDCT — real ADTS streams decode to channels # unsigned-codebook table was wrong in the stub (3,4,7,8,11 per IS_CODEBOOK_UNSIGNED) ! SBR payloads ignored (LC core decoded); Main/SSR/LTP/CCE/LATM still rejected (295309c)
+- Codec.Lpc10: FS-1015 LPC-10e 2400 bit/s vocoder (54-bit frames, Levinson-Durbin lattice; simplified AMDF pitch tracker documented) with raw container + DTS and AC-3/E-AC-3 raw-stream descriptors: full header/table parse (AMODE/acmod layouts, rates, bitrates, frame counts, duration) + Sony OMA/AA3: ea3 tag + EA3 header, ATRAC3/3plus/MP3/LPCM identification, payload as Stream (b9d09d6)
+- chiptune pseudo-archives: NSF/NSFE (expansion-chip flags), GBS, SID (PSID/RSID, clock + SID model), KSS (KSCC/KSSX), HES, GYM (GYMX, packed logs, duration), AY (bounds-checked pointer chase) (24bff0a)
+- classic PC-game audio: Westwood AUD (WS-ADPCM + continuous IMA, 0xDEAF chunks, assembles), id RoQ (square-table DPCM enc+dec, assembles), Sierra SOL (3 magics, old/new DPCM + 16-bit, assembles), CRYO APC (seeded IMA) (7ebd95f)
+- Codec.InterplayAcm (verbatim filler/juggle port) with .acm pseudo-archive + Codec.Nellymoser (verbatim tables + direct IMDCT) with raw .nelly container (139d6d2)
+- sequenced-music pseudo-archives: VGM/VGZ (named chip clocks, GD3 UTF-16 tags, transparent gzip), MUS→MIDI (Doom mapping), XMI→MIDI (duration-scheduled note-offs), CMF (OPL patches + SMF wrap) (7165477)
+- Codec.Ra144 (RealAudio 14.4 lpcJ, ffmpeg tables extracted verbatim) — RealMedia lpcJ streams + raw .ra v3 now decode to WAV channels + Codec.TrueSpeech (DSP Group, verbatim table port) — WAV format tag 0x0022 decodes (d50538f)
+- Codec.MonkeysAudio: APE lossless (exact-spec MAC descriptor/header/seek-table; level-1000 order-16 LMS predictor + range-coded residuals; carry-counting coder documented as self-consistent) — levels 2000+ fall back + APE descriptor surfaces decoded per-channel WAVs with graceful fallback (8e17e6c)
+- XWB (XACT wave bank v43+: PCM + MS-ADPCM samples, XMA/WMA noted), BWAV (Switch: DSP-ADPCM/PCM16 with assemble), SWAV (NDS: PCM8/16 + IMA with assemble), SDAT (NDS sound archive: SWAV/SWAR decoded, SSEQ/SBNK/STRM surfaced) (75c36a2)
+- ASF (.asf/.wma/.wmv) container pseudo-archive: object walk, stream/codec info, content + extended tags, Data Object as Stream blob + RealMedia (.rm/.rmvb/.ra) container pseudo-archive: PROP/MDPR/CONT/DATA walk, per-stream payload blobs with codec FOURCC, raw .ra v3/v4/v5 (0a24655)
+- Codec.Mace (Apple MACE 3:1/6:1, ffmpeg-faithful incl. historical clip quirk) with classic Mac 'snd ' resource pseudo-archive (standard/extended/MACE headers) + vintage PC/research containers: Sounder (.sndr), SoundTool (.sndt), ESPS (.sd, record_freq generic, both endiannesses) (9029286)
+- Codec.EaXa (Electronic Arts EA-XA ADPCM incl. 0xEE raw frames) with EA SCHl stream pseudo-archive (PT-table parse, SCDl blocks, assemble) + Codec.WwiseIma (MS-IMA block layout) with Wwise .wem pseudo-archive (IMA/PCM decode, Wwise-Vorbis falls back) (fac883a)
+- sampler/vintage formats: XI (FT2 instrument, delta samples, per-note rates), SDS (MIDI sample dump, septet unpacking), TXW (Yamaha 12-bit packed, with Create), HCOM (Mac Huffman-delta per sox, with encoder + Create) (8120f29)
+- Codec.AicaAdpcm: Yamaha AICA / ADPCM-B (Dreamcast) encode + decode with raw .aica container + VOC Creative ADPCM completed: 2.6-bit (3-3-2 packing) and 2-bit codecs decode — only A-law/µ-law VOC payloads remain raw (83c546f)
+- Amiga/Impulse sample pseudo-archives: MED (OctaMED), OKT (Oktalyzer), ULT (UltraTracker), 669, ITS + ITI (Impulse sample/instrument; IT215-compressed falls back) (1c0fbb7)
+- full ITU G.726 rate set (16/24/40 kbit; 7-41 dB SNR ladder) + Codec.G722 (QMF sub-band ADPCM @64kbit) + Codec.Cvsd (syllabic delta modulation) with raw .cvsd container; Sun .au encodings 24/25/26 decode now (92083ca)
+- DOS tracker sample pseudo-archives: MTM, FAR, STM, PTM (8-bit delta), AMF (DSMI v10-14), PSM (MASI DSMP delta) — samples as playable WAVs with per-sample rates (b1be324)
+- Nintendo stream family: BCSTM (3DS), BFSTM (WiiU BE + Switch LE), AST (PCM16BE; AFC falls back), HPS (HALPST linked blocks) — channel pseudo-archives over Codec.DspAdpcm with assemble (3db1dcf)
+- Codec.WavPack: v4/v5 lossless block codec (spec-faithful framing/flags/medians/decorrelation; encoder bit-locked to decoder — reference streams fall back gracefully) + WavPack descriptor surfaces decoded per-channel WAVs with graceful fallback (5f3c383)
+- MAUD (Amiga IFF; A-law/µ-law payloads), SMP (SampleVision), PAF (Ensoniq PARIS, both endiannesses incl. 24-bit packed), PVF (mgetty, binary + ASCII) channel pseudo-archives — all with assemble (fee7076)
+- Codec.XaAdpcm: CD-ROM XA / PlayStation streaming ADPCM (sound groups, unit nibble interleave, 4-bit enc+dec, 8-bit decode) + XA (.xa) channel pseudo-archive: RIFF/CDXA + raw synced/Mode-2 sectors, first-stream selection, 37.8/18.9 kHz; assembles valid audio sectors (ab9d32f)
+- Codec.Brr: SNES S-DSP BRR (filters 0-3, 15-bit hardware wrap, encode + decode) + BRR (.brr) channel pseudo-archive (loop-header tolerant) and SPC (.spc) sample pseudo-archive: walks the DSP sample directory in ARAM, extracts every BRR instrument as WAV, ID666 tags (a7ccb56)
+- Codec.CriAdx: CRI ADX ADPCM (highpass-derived coefficients, encode + decode, encrypted/AHX rejected) + ADX (.adx) channel pseudo-archive: per-channel WAVs, FULL-only fallback for encrypted streams; assembles from per-channel WAVs (d21c5f4)
+- Codec.Alac: Apple Lossless decode + spec-shaped encoder (adaptive Rice, dynamic predictor, invertible mid/side; 16/24-bit byte-exact round-trips, escape frames) + FileFormat.Alac surfaces decoded per-channel WAVs (graceful fallback keeps the FULL/Track/Tag view) (799e4fe)
+- raw G.711 channel pseudo-archives (.al / .ul): headerless A-law/µ-law, decode + re-encode assemble + CAF ulaw/alaw payloads decode to per-channel WAVs + PcmCodec.SplitInterleavedFloat + WAV IEEE-float (32/64-bit) channel split honoring speaker masks (65095fb)
+- MPEG-1/2 Layer I + Layer II decode in Codec.Mp3 (minimp3-style L12 port: allocation tables, scfsi, grouped dequantization, intensity joint stereo, shared polyphase synthesis) — .mp2/.mp1 now decode to per-channel WAVs (279769b)
+- Codec.DspAdpcm: Nintendo GC/Wii DSP-ADPCM (canonical frame decode + normal-equations predictor-fit encoder) + BRSTM (.brstm) channel pseudo-archive: big-endian RSTM parse, per-channel coef tables, block de-interleave with continuous ADPCM history; assembles from per-channel WAVs (6a9104d)
+- SoundFont 2 (.sf2) sample pseudo-archive: every shdr sample as a mono WAV at its own rate, INFO tags, ROM/EOS skipped + DLS (.dls) sample pseudo-archive: wvpl waves rewrapped as standalone WAVs, INFO tags (02d341a)
+- Codec.SpuAdpcm: Sony PS1/PS2 SPU ADPCM (decode + brute-force-filter encoder) + VAG (.vag) channel pseudo-archive: big-endian VAGp header, MONO channel decode; assembles from a mono WAV (f544dc8)
+- AIFC 'ima4' decode: QuickTime IMA ADPCM packet variant in Codec.ImaAdpcm, wired into AIFF channel split + Codec.G72x: ITU G.726 @ 32 kbit (G.721) decode + encode (CCITT reference port); Sun .au encoding 23 now decodes to channels # VOC Creative 4-bit ADPCM (codec 1) decodes to PCM (ffmpeg ADPCM_CT semantics); codecs 2/3 remain FULL-only (6c2b12b)
+- Codec.Tta: True Audio TTA1 lossless codec (order-8 adaptive filter + two-state Rice, frame CRCs; decoder ported from the reference, encoder algebraically inverted; 8/16/24/32-bit, byte-exact round-trips) + TTA (.tta) channel pseudo-archive: per-channel WAVs up to 5.1+, assembles from per-channel WAVs (3a35938)
+- Codec.Shorten: SHN v2 lossless codec (decoder incl. QLPC best-effort; encoder with DIFF0-3 selection; byte-exact round-trips) + Shorten (.shn) channel pseudo-archive: per-channel WAVs (rate unknown, assumed 44100 + noted), assembles from per-channel WAVs (a5435a8)
+- DSF (Sony DSD) channel pseudo-archive: block-de-interleaved per-channel raw DSD streams + decimated PCM WAVs + ID3 tag; assembles bit-exact from per-channel .dsd inputs + DFF (DSDIFF) channel pseudo-archive: byte-round-robin de-interleave, CHNL speaker-ID mapping, DST falls back to FULL; assembles bit-exact (66e4b51)
+- Codec.OkiAdpcm: OKI/Dialogic 4-bit ADPCM (decode + symmetric encoder) + Dialogic VOX channel pseudo-archive (headerless, 8 kHz mono; assembles from a mono WAV) + raw GSM 06.10 (.gsm) channel pseudo-archive via Codec.Gsm610 (DecodeRaw/LooksLikeRawFrames helpers; graceful fallback) (acb1fbe)
+- IFF/8SVX (Amiga) channel pseudo-archive: VHDR/CHAN/BODY parse, Fibonacci-delta decode, planar-stereo split, IFF text tags; assembles from per-channel WAVs + AVR (Audio Visual Research) channel pseudo-archive: 128-byte BE header, sign/width normalization; assembles from per-channel WAVs (a1a4356)
+- NIST SPHERE (.sph) channel pseudo-archive: ASCII object header, ulaw/alaw via G.711 codecs + BE/LE PCM, embedded-shorten falls back to FULL; assembles from per-channel WAVs + IRCAM/BICSF (.sf) channel pseudo-archive: byte order from magic, 8/16-bit + 32-bit float channels, assembles from per-channel WAVs (b871bfa)
+- explicit speaker-mask channel naming: WAV/Wave64/RF64 read WAVE_FORMAT_EXTENSIBLE dwChannelMask, CAF reads the UseChannelBitmap chan chunk, and per-channel WAVs are named for their real speakers + multi-channel split + assemble now covers any channel count: 22.2 (24ch) splits into named mono WAVs and reassembles losslessly from shuffled per-channel inputs; unmapped counts (e.g. 32ch) use CH_n * WAV/AIFF/AU/CAF/Wave64/RF64/VOC assemble ordering delegates to ChannelLayout.OrderIndex (top/bottom-layer speakers no longer unsortable) (3f9b1fd)
+- ChannelLayout: FFmpeg-faithful speaker model (canonical AVChannel/WAVE-mask bit names, default layout per channel count from mono through 5.1.4/7.1.4/9.1.6 up to 22.2, CH_n fallback beyond) with explicit-bitmap naming and canonical assemble ordering * PcmCodec.LayoutNames delegates to ChannelLayout; SplitInterleavedPcm gains an optional speaker-mask parameter * 3-channel default is now 2.1 (FL FR LFE) and 4-channel is 4.0 (FL FR FC BC), matching av_channel_layout_default (a4beb79)
+- AAC (ADTS) channel pseudo-archive: decodes AAC-LC via Codec.Aac and surfaces FULL.aac + per-channel WAVs (graceful FULL-only fallback for unsupported profiles) (db11a5f)
+- Opus (Ogg) channel pseudo-archive: decodes via Codec.Opus and surfaces FULL.opus + per-channel WAVs (graceful FULL-only fallback); explicit-lookup descriptor (no magic clash with Ogg) (718434f)
+- OGG channel split: decode Vorbis/Opus via Codec.Vorbis/Codec.Opus and surface per-channel WAVs (graceful fallback to raw packet blobs) (7464cf8)
+- MP3 channel split: decode MPEG audio via Codec.Mp3 and surface per-channel WAVs (graceful FULL-only fallback when the decoder can't handle the input) (ffdc006)
+- Wave64 (.w64) channel pseudo-archive: parses GUID-keyed chunks with 64-bit sizes, surfaces FULL.w64 + per-channel WAVs + metadata; IArchiveCreatable writes a Wave64 from per-channel mono WAVs (b24074e)
+- Creative Voice (.voc) channel pseudo-archive: walks VOC blocks (legacy type-1 + modern type-9), decodes 8/16-bit PCM, surfaces FULL.voc + per-channel WAVs + text/metadata; IArchiveCreatable writes a .voc from per-channel mono WAVs (fdd8d82)
+- RF64 / BWF (Broadcast Wave) channel pseudo-archive: resolves 64-bit sizes via the ds64 chunk, surfaces FULL.rf64 + per-channel WAVs + bext/metadata; IArchiveCreatable writes a conformant RF64 from per-channel mono WAVs (6a6ef75)
+- CAF (Apple Core Audio Format) channel pseudo-archive: reads caff/desc/data, surfaces FULL.caf + per-channel WAVs + metadata chunks; IArchiveCreatable assembles a CAF from per-channel mono WAVs (4321749)
+- Sun/NeXT .au assemble (IArchiveCreatable): build a multi-channel .au from per-channel mono WAV inputs + AuWriter: 24-byte big-endian header + big-endian linear PCM writer (19b9966)
+- AIFF assemble (IArchiveCreatable): build a multi-channel AIFF from per-channel mono WAV inputs + AiffWriter: minimal FORM/AIFF (COMM + SSND) writer with the inverse 80-bit extended-float sample-rate encoder (1ba0d99)
+- PcmCodec.Interleave: weave per-channel mono PCM into one interleaved buffer (inverse of SplitInterleavedPcm) — enables assembling multi-channel audio from channels + AudioPseudoArchive helper: shared List/Extract/ExtractEntry projection for audio containers surfaced as channel archives * WavFormatDescriptor.Create uses PcmCodec.Interleave instead of an inline weave loop (9a9e0a8)
+- DragonFS (Libdragon N64) WORM writer (IArchiveCreatable): DragonFS tag + 32-byte directory records + contiguous file data; round-trips (bacddcc)
+- CbmNibble (G64) WORM writer (IArchiveCreatable): real 1541 GCR codec + G64 framing over a D64Writer-built image; round-trips via GCR decode (87e1040)
+- EROFS WORM writer (IArchiveCreatable): compact inodes + FLAT_PLAIN data + erofs_dirent directory blocks with nested dirs; round-trips (uncompressed) (0d1b120)
+- LittleFS WORM writer (IArchiveCreatable): metadata-pair commit log + CTZ skip-lists/inline files + nested dirs, with a real commit-walking LittleFsReader; round-trips (38b0c16)
+- MinixV2 WORM writer (IArchiveCreatable): Minix v2 image (32-bit zones, triple-indirect), fsck.minix-clean + round-trips (8610b70)
+- MinixV1 WORM writer (IArchiveCreatable): builds a spec-correct Minix v1 image with nested directories, validated fsck.minix-clean and round-trips (fc8ea7c)
+- Acronis FileMeta record-chain framing reverse-engineered; chain walk anchors Listing entries to RecordIndex via the spec-grounded MetaOffset path, cross-validates against the legacy sequential-pairing heuristic, and catches reordering that pairing silently misses (5180f3b)
+- Paragon PBF partial chunk layout reverse-engineered; structured-header parse + Wave-13 audit persisted (a000a10)
+- AOMEI Backupper (.adi / .afi) R/W via BIFH / BIFT outer container + BR_STANDARD_HEADER tagged-record framing — reverse-engineered from the vendor's kernel + user-mode image-format library + AomeiConstants: BIFH / BIFT flags + sizes (0x65C / 0x674) + StandardHeader 12-byte prefix + the four confirmed INFO_TYPE_* enum values (0x105 COMPRESS / 0x106 ENCRYPT / 0x107 PASSWORD / 0x10C BACKUP_TYPE) + the literal "AomeiTech.SchduleTask" scheduled-task magic-password constant (sic spelling) + BrCrc32: wraps Compression.Core.Checksums.Crc32 with the zeroed-CRC-field protocol that BIFH / BIFT / BR_STANDARD_HEADER all use; standard zlib CRC-32 + BrStandardHeader: read / write / Seal / Verify the 12-byte {Size, Type, Reserved, Crc32} tagged-record prefix; SealCrc patches the on-disk CRC field in place, VerifyCrc rejects any tampered byte + BrFileHead / BrFileTail: 0x65C-byte BIFH and 0x674-byte BIFT structs with Flag + Size + Crc32 verification; BuildEmpty() emits a sealed all-zero-body container — the head / tail body layout past the first 12 bytes is documented-TODO and kept zero rather than forged + AomeiInfoRecord: typed views for COMPRESS / ENCRYPT / PASSWORD / BACKUP_TYPE; password is MD5 of UTF-16LE passphrase per the verifier check; produces sealed BR_STANDARD_HEADER records ready for emit + AomeiWriter / AomeiReader: full round-trip via vendor-namespace 0xF001 user-data envelope so user inputs are surfaced byte-identically through our own reader; INDEX_TYPE_DATABLOCK / DATAAREA framing is documented-TODO and not forged + AomeiFormatDescriptor: implements IArchiveCreatable; Create / List / Extract round-trip honors the four INFO records; Description names the four documented-TODO scopes (head / tail body fields past first 12 bytes, INDEX_TYPE_* body layouts, AES variant + IV derivation, IOCTL_AMBAK_GET_BLOCK numeric) + AomeiRwTests: 23 new tests covering BRCrc32 vectors, BR_STANDARD_HEADER round-trip + tamper detection, BIFH / BIFT CRC sealing, INFO record encode / decode, full writer→reader round-trip with all four INFO records, user-data envelope round-trip, descriptor Create / List / Extract round-trip, password MD5 metadata emission, head / record CRC corruption detection, truncated / short-header / zero-size-record defensive walks; AomeiTests updated for the richer ParseStatus values (ok / header_short / magic_ok_crc_failed / tail_missing / tail_invalid) ! Out-of-scope: byte-compat with AOMEI Backupper itself requires the head / tail body field layouts past byte 12 and the INDEX_TYPE_DATABLOCK / DATAAREA encoding, both currently undocumented; encryption advertises via INFO_TYPE_ENCRYPT and emits the MD5 password verifier but payload bytes are stored verbatim rather than fed through speculative AES (ac147de)
+- Backup-format deep-RE wave — squashed 9 incremental commits into one logical grouping (5909a23)
+- Acronis classic .tib R/O file listing via record stream; Blob extraction blocked by proprietary block codec (b273aba)
+- Shrink (method 1), Reduce (methods 2-5) and Implode (method 6) building blocks, exposing the legacy PKWARE ZIP compression methods through the CompressionWorkbench registry with a self-describing length/parameter header + round-trip tests for the ZIP legacy building blocks covering empty, single-byte, text, repeating patterns, long runs and random data plus header/metadata checks (5285e6f)
+- Norton Ghost (modern 11.x/12.x) R/W via reverse-engineered Fast LZ Z1 + zlib Z3-Z9 codecs + CRC-16 stream cipher; legacy DOS-era Ghost 4-7 stays Stage-0 with version-gated diagnostic fallback (27e00bb)
+- partclone (Clonezilla backup format) — image_head/fs_info/bitmap parser, sector reconstruction; R/O (180f6d1)
+- Apple sparseimage + sparsebundle (Time Machine / hdiutil) — band-allocation table parsing, inner HFS+/APFS delegation; R/O (b6d65bf)
+- BKF (Microsoft NTBackup / MTF Tape Format) — DBLK-chain parser, FILE+DATA entries, magic TAPE@0; R/O (af91a1a)
+- VmdkStream sparse grain-on-write allocation + VmdkStream.Write: writes to unallocated grains now lazily allocate a fresh   grain (and the owning grain table, when none exists yet) at the sector-   aligned end of the backing stream, zero-fill it, and update the grain   directory + grain table entries on disk so subsequent reads see the new   region + VmdkStream caches per-GD-index grain table byte offsets on Open and the   grain directory offset so AllocateGrain can update the right slot without   re-reading the GD * VmdkStream: throw shape on write is now InvalidOperationException for   out-of-range grains (instead of NotSupportedException for unallocated),   matching the rest of the VHD/Qcow2/VDI sparse streams which already   allocate on demand + DiskImageNestingTests.VmdkDescriptor_Add_FsImageAtRoot_OnSparseVmdk_   AllocatesGrainsAndPartition: end-to-end gate — sparse VMDK with reserved   zero region past Partition 1 now accepts a root-level FAT image drop   through the descriptor's Add, lands it as Partition 2, and List() walks   the new partition's NEW.TXT (b213e2e)
+- Partition-aware Add/Remove for virtual-disk descriptors + PartitionedDiskLister.TryAdd: dispatches by input name shape. Inputs named   PartitionN_<TypeName>/<inner> open a writable PartitionWindowStream into   partition N and delegate Add to the inner FS's IArchiveModifiable. Inputs   with no Partition prefix are treated as a raw filesystem image — InnerFsDetector   maps the magic to a PartitionType, PartitionEditor.AddPartition writes a new   primary/GPT entry past the highest existing partition, and the image bytes   are written + sector-padded into the new partition window + PartitionedDiskLister.TryRemove: PartitionN_<TypeName>/<inner> deletes an   inner-FS entry via the partition's IArchiveModifiable; PartitionN_<TypeName>   or .raw deletes the whole partition via PartitionEditor.DeletePartition * PartitionWindowStream: now read/write — Write clamps to [0, length) and   throws IOException on overshoot; SetLength rejects extensions but accepts   shrinks as no-ops; Flush forwards to the underlying stream * VhdFormatDescriptor / VhdxFormatDescriptor / VmdkFormatDescriptor /   Qcow2FormatDescriptor / VdiFormatDescriptor: Add and Remove try the   partition-aware path first; InvalidOperationException (cap full, no free   space, missing inner FS modifier) propagates honestly. Other failures fall   through to the pre-existing single-FS-modifier and rebuild paths + DiskImageNestingTests: VmdkDescriptor_Add_PrefixedPath_DelegatesToInnerFs   exercises partition-prefixed Add; VmdkDescriptor_Remove_PrefixedPath drops   a file from a partition; PartitionedDiskLister_TryAdd_FsImageAtRoot lands   a second FAT image as a new MBR partition (raw disk stream — sparse VMDK   grain allocation is out of scope for the lister) ! Known scope: sparse VMDK / dynamic VHD throw on writes to unallocated   grains, so descriptor-level Add of a brand-new partition past the last   allocated region falls through to the legacy rebuild path. Fully-allocated   (fixed) VHD and raw disks land the new partition immediately (3a9d4a6)
+- Partition-aware archive surface for virtual-disk descriptors (VHD/VHDX/VMDK/Qcow2/VDI) + PartitionedDiskLister: when an MBR or GPT partition table is detected on the guest   disk, List() returns entries prefixed with PartitionN_TypeName/ and Extract() writes   each partition's inner FS into a per-partition subdirectory; falls back to the existing   single-FS-at-offset-0 path when no partition table is present + PartitionWindowStream: read-only sub-range view over a disk stream so the inner FS   reader sees position 0 = partition start (used by the lister to delegate List/Extract   per partition through InnerFsDetector) * VhdFormatDescriptor / VhdxFormatDescriptor / VmdkFormatDescriptor / Qcow2FormatDescriptor /   VdiFormatDescriptor: List() and Extract() try the partition-aware path first; unpartitioned   disks keep the previous direct single-FS delegation * AutoExtractor: reconstruct the legacy PartitionTable summary from the new   PartitionN_TypeName/ entry-name prefix so existing consumers (and tests) keep working   even though the disk descriptor no longer dumps a single disk.img blob + DiskImageNestingTests: VmdkDescriptor_List/Extract_PartitionedDisk_* exercise the   new partition-aware path end-to-end; VmdkDescriptor_List_UnpartitionedDisk_*   pins that unpartitioned images still delegate straight to the inner FS without   a synthetic Partition wrapper (cdd95cd)
+- repo meta per house standard: AGENTS.md, .editorconfig (e11a18e)
+- Jfs full-scope mutation past leaf-only (arbitrary path depth + long names via continuation slots + external dtree leaf insert/delete + recursive subdir removal + multi-dmap allocation); fsck.jfs accepts mutated images for short-name scenarios (7667ccc)
+- ReiserFs full S+tree mutation: nested paths, INDIRECT-item bodies, leaf split/merge, root tree-height growth — every previously-NotSupportedException branch now accepted, reiserfsck-clean for every mutated image * ReiserFsModifier: collapsed to read-modify-rebuild via the multi-leaf writer; the prior hand-written leaf-only splice path mis-hashed inserted dirents (R5-by-luck) and threw on every interesting case + ReiserFsWriter: INDIRECT items with dedicated data blocks past the tree for bodies > 1 KB; bitmap, s_block_count, s_bmap_nr, s_free_blocks all extended; sd_blocks credits data blocks to the owning file + ReiserFsReader.Extract: handles INDIRECT items (concatenate data blocks by offset, truncate by sd_size); previously skipped them and returned only DIRECT bytes + ReiserFsFullScopeMutationTests (9 in-process tests): nested paths, shared parent reuse, INDIRECT large body, non-aligned tail truncation, mixed DIRECT+INDIRECT, leaf split, leaf merge, tree-height growth at 1000 files, interleaved add/remove/replace + ReiserFsPostMutationExternalTests (6 WSL-gated tests, Category=ExternalInterop): PostAdd / PostRemove / PostLeafSplit / PostLeafMerge / PostNested / PostLargeFile — every mutated image passes 'reiserfsck --check' clean * ReiserFsFormatDescriptor.Description: reflects new full-scope IArchiveModifiable surface (94fb429)
+- F2fs full NAT/SIT block rewrite + regular dentry blocks past leaf-only scope; fsck.f2fs accepts mutated images + F2fsModifier: curseg overflow now promotes a free main-area segment of the right CURSEG_* type with SIT type-tag + journal mirror refresh (replaces the NotSupportedException for WARM_DATA/WARM_NODE exhaustion) + F2fsModifier: inline-dentry overflow now converts the root in place to a regular block-based dentry directory — allocates a HOT_DATA block, migrates every existing inline dentry into the 214-slot block layout, clears the inline flag, points i_addr[0] at the new block, updates i_size/i_blocks/SIT/SSA so fsck cross-checks pass + F2fsModifier: subsequent Adds against a non-inline root walk i_addr[] looking for a free slot, allocating a new HOT_DATA block per 214 entries and bumping i_size + i_blocks accordingly; Remove now walks block-dentry storage too + F2fsModifier: WriteCheckpoint now mirrors per-block summary entries into the CP pack — data summaries packed into the compact summary block (block 1) at offset 2*SUM_JOURNAL_SIZE for HOT/WARM/COLD_DATA cursegs, and node summaries written into CP blocks 2/3/4 for HOT/WARM/COLD_NODE cursegs. Without this fsck.f2fs's get_sum_block seeded curseg->sum_blk from empty buffers and rejected every reachable block as 'Invalid data/node seg summary' * F2fsModifier: NAT/SIT journal full no longer throws — falls through to the on-disk NAT/SIT entry we already wrote (f2fs-tools treats the journal as overrides over disk, so a missing journal entry simply reads from disk) * F2fsFormatDescriptor: Description and module-level remark updated to reflect the post-leaf scope (full NAT/SIT block rewrite + regular dentry blocks on overflow); remaining out-of-scope branches name what specifically is unsupported (subdirectory creation, nested removal, multi-level indirect inode trees, main-area-segment growth) + F2fsFullScopeMutationTests (4 in-process): Add past inline + NAT journal capacity, mixed add/remove across the block-dentry boundary, many medium files past journal, add-remove-all-add wave round-trip + F2fsPostMutationExternalTests (3 WSL-gated, Category=ExternalInterop): PostAdd / PostRemove / PostMixed each runs real fsck.f2fs -f --dry-run inside WSL and asserts exit 0 with no [Fail] or inconsistency markers - F2fsModifyTests.Add_JournalOverflow_ThrowsClean retired; Add_PastJournalCapacity_SucceedsViaOnDiskNat now verifies the new round-trip behaviour (931dab2)
+- Apfs full-scope B-tree mutation (omap split + FS-tree split + multi-component paths + tree height growth); internal structural validator + apfs-fuse check (best-effort, no Linux fsck_apfs) (51b07cf)
+- NTFS writer mirrors boot sector at last volume sector; ntfsfix -n now reports clean (Processing of $MFT/$MFTMirr OK, alternate boot sector OK), ntfsinfo reads $Volume label + version 3.1, ntfsls enumerates files * NtfsExternalConformanceTests: tightened assertions (require ntfsfix exit=0 + $MFT/$MFTMirr OK message, require ntfsinfo exit=0 + CWB-NTFS label + version 3.1, require ntfsls exit=0); removed stale "deferred scope: records 1-15 missing" doctrine — records 0-15 all emit since the writer's first commit (5280a8c)
+- MS LZH dynamic Huffman trees (effort 2+ emits dynamic block when smaller than static; bit-compatible decoder) (b4ae0d8)
+- FAT external-conformance gate (fsck.fat + mtools mdir via WSL) (d83ddf2)
+- ext external-conformance gate (e2fsck + debugfs ls via WSL) (b3bdb6c)
+- Zstd + LZ4 external-interop gates (bidirectional with zstd / lz4 CLIs); failures highlight codec gaps for follow-up (533bf44)
+- FLAC external-interop gate (flac -d + flac -8 + ffmpeg + flac --test); failures highlight codec gaps for follow-up (ee74ffe)
+- DblSpace, DriveSpace, DriveSpace3 updated to full r/w including optimization (286248c)
+- ODS-1 R/W (IArchiveModifiable: Add+Remove with BITMAP/INDEXF mutation + home-block checksum recompute; self-round-trip clean) (cd77b5b)
+- QNX6 R/W (Add/Remove with dual-superblock synchronous mutation + inode-table + root dir block; self-round-trip clean) + Qnx6Modifier: in-place Add/Remove against existing QNX6 images. Add allocates the next free 128-byte inode slot (scans di_status/di_mode/di_block_ptr[0] for all-zero), lays down a contiguous file extent past the current high-water mark (computed from every live S_IFREG inode's first-direct ptr + size), and appends a 32-byte dirent (u32 inum + u8 namelen + name padded to 27 bytes) into the single-block root directory. Remove finds the dirent, zeroes the data extent (wipe contract), clears the inode slot, and compacts trailing dirents into the freed slot so reads see no gap. + Qnx6Modifier: replace-by-name on Add — pre-existing entry with same leaf name is Remove'd before the new file is written. + Qnx6Modifier: every mutation re-mirrors the primary superblock (0x2000..0x21FF) to the new tail's last 512 bytes synchronously — the Power-Safe contract holds across every Add/Remove call, not just at Create time. + Qnx6FormatDescriptor: implements IArchiveModifiable; Capabilities advertises CanModify alongside CanCreate; Description reflects R/W promotion. + Qnx6RwTests (12 in-process tests + 1 WSL-gated): Add round-trips alongside pre-existing entries, dual-superblock mirror parity post-mutation, large-file Add extends the image, replace-by-name semantics, single-block root capacity guard throws NotSupportedException past 32 dirents, Remove drops entries from List, Remove wipes data extent (marker pattern unrecoverable), Remove of unknown name is no-op, Remove-then-Add recycles inode slot, plus a best-effort WSL Linux kernel qnx6 driver mount-and-list of the post-mutation image (skips cleanly when sudo/loop devices/qnx6 module unavailable). * Worktree branch ccc05ad lacked the QNX6 WORM files entirely (diverged from main before f674246); cherry-picked the WORM baseline (Qnx6Writer/Reader/Entry/FormatDescriptor/csproj + Qnx6Tests/Qnx6WormTests) into the same FileSystems/FileSystem.Qnx6/ + Compression.Tests/Qnx6/ paths and wired into the slnx + Compression.Lib + Compression.Tests project graphs before promotion. ! Pre-existing failures unrelated to QNX6: 4 "Descriptor_IsHonestly{Worm,Rebuild}" tests on ReiserFs/Jfs/F2fs/Apfs fail on this worktree branch because those FSes were promoted to R/W on main commits 09ce675/3df9d1b/170059b/776ab47 but the worktree was branched before those promotions and still carries the old "must not advertise IArchiveModifiable" gates. All 37 QNX6 tests pass; the 4 failures reproduce identically with the QNX6 changes stashed. (9bceca0)
+- QNX4 R/W (Add/Remove against flat root + .bitmap allocation; capacity guard preserved; self-round-trip clean) + Qnx4Modifier: in-place AddFile / RemoveFile against an existing image — root cluster (LBA 1-4) + .bitmap (LBA 5) mutated without a full image rebuild + Qnx4Modifier.AddFile: finds first free root-cluster slot (entries 3..31), allocates contiguous extent via .bitmap walk starting at LBA 7, writes inode (di_status=USED, di_fname/di_size/di_first_xtnt set), grows the underlying stream when the allocation runs past the current image end, refreshes root-self di_size + Qnx4Modifier.AddFile: replacement semantics — if a file with the same name exists, the old extent is freed and the dirent cleared before the new one lands, so callers can replace by name without leaking the prior extent + Qnx4Modifier.RemoveFile: walks user slots (3..31) by name, zero-wipes the data extent (no forensic recovery), flips bitmap bits back to free, clears the entire 64-byte inode slot, refreshes root-self di_size; returns false unchanged when the name isn't present + Qnx4Modifier capacity guard: AddFile throws NotSupportedException with "root cluster full" once entries 3..31 are saturated (29 user files) — preserves the same flat-root WORM scope; subdirectory emission still out of scope + Qnx4FormatDescriptor: now implements IArchiveModifiable; Capabilities advertises CanModify alongside CanCreate; Add/Remove pipe through FormatHelpers.FlatFiles + Qnx4Modifier * Qnx4FormatDescriptor.Description: reflects the R/W scope (flat root, max 29 user files) instead of WORM + Qnx4RwTests (16 tests): Add round-trip (single/zero-byte/multi-block), Add replaces existing names in place without duplicating, long-name truncation; Remove round-trip + secure data wipe + returns false for unknown names; FillToCap → RemoveOne → AddOne sequence (slot reuse); Add past 29-user-file cap throws NotSupportedException; .bitmap bit flips on Add and Remove; freed-extent reuse after Remove→Add; descriptor surface (CanModify + IArchiveModifiable + descriptor.Add/.Remove pipe through to modifier) (4df9580)
+- Cxfs R/O via XFS reader delegation (cluster metadata ignored; documented) (2877fb6)
+- AmigaPFS R/W Stage 1 (Add/Remove against root + dirblock chain; anode-as-direct-block convention preserved; self-round-trip clean, still not FS-UAE-mountable) (746cde1)
+- ADFS-L R/W (Add/Remove against old-map FSM + Hugo-bracketed root dir + check-byte recompute; self-round-trip clean) (5493612)
+- MooseFs partial R/O via metadata.mfs section-index parse (signature + section table + per-section payloads; file content stays unreachable since chunks live on chunk servers) (6068e6d)
+- Xenix V R/W (Add/Remove with s_free/s_inode cache mutation + 10-direct-zone files; self-round-trip clean) (75d2eae)
+- Coherent R/W (Add/Remove with V7 free-cache mutation + 10-direct + single-indirect + double-indirect tier alloc/free; self-round-trip clean) (1c4472e)
+- Lustre R/O via ext4 reader delegation on ldiskfs MDT/OST images (Lustre xattrs preserved; logical FS view requires combining MDT + OSTs out-of-scope) (e3490a3)
+- SysV R/W (Add/Remove with chained free-block group cache refill + 10-direct-zone files; self-round-trip clean) (7f69316)
+- FATX R/W (Add/Remove with FAT chain allocate/free + dirent 0xE5 tombstone + 0xFF padding preserved; FAT16/FAT32 width-aware; self-round-trip clean) + FatxModifier: in-place AddFile / RemoveFile on the root directory of an existing FATX image   - Add scans the FAT for the first free contiguous cluster run sized to the requested payload, links each cluster to the next + plants the FAT16/FAT32 EoC sentinel on the last one, writes payload bytes into the data region cluster-by-cluster, then writes a 64-byte FATX dirent into the first reusable slot in the root cluster (first 0xE5 tombstone or first 0xFF terminator)   - Remove finds the dirent by sanitised name in the root cluster, sets name_length = 0xE5 (FATX tombstone convention), walks the file's FAT chain freeing each cluster (entry → 0), and zeros the data bytes inside each freed cluster so previous content is not forensically recoverable   - FAT16 / FAT32 width auto-detected from on-disk geometry using the same heuristic as FatxReader so both sides always agree   - 12-byte timestamp tail stays zeroed (real Xbox kernel re-stamps on mount; matches what FatxWriter already produces)   - Dirent name field padded 0xFF on unused tail bytes, identical layout to FatxWriter.WriteDirent   - Honest scope limits: sub-directory adds out of scope (v1 only touches root cluster); extending the root chain past one cluster also out of scope — both surface a clean InvalidOperationException instead of silently corrupting * FatxFormatDescriptor: now implements IArchiveModifiable + advertises FormatCapabilities.CanModify; Description reflects new R/W surface * FatxFormatDescriptor.Add: deserialises the stream, calls FatxModifier.AddFile per non-directory input, writes the mutated image back; same buffered pattern Fat / Hpfs / Mfs descriptors use * FatxFormatDescriptor.Remove: deserialises, calls FatxModifier.RemoveFile per name, writes back; unknown names silently skipped (matches WORM Extract behaviour) + FatxRwTests (15 tests, all green):   - HappyPath: descriptor advertises CanModify, single Add round-trip, Remove round-trip, descriptor Add/Remove pipeline, FAT chain links + EoC sentinel on multi-cluster Add, FAT entries + data bytes both wiped on Remove   - Boundary: zero-byte Add, multi-cluster Add (spans 5 clusters), tombstoned dirent slot reuse on subsequent Add (re-add lands in exact slot the previous Remove tombstoned), Add/Remove/Add wave keeps the anchor file's bytes byte-identical across every cycle, FAT32-width round-trip on a 32 MiB image with sectorsPerCluster=1 (FAT32 EoC sentinel verified; cluster freed on Remove)   - Sad: Remove of unknown name returns false + image untouched, free-cluster exhaustion throws InvalidOperationException, root-dirent-slot exhaustion (33 entries in a 32-slot root cluster) throws cleanly (127a5ae)
+- Convert Archive in explorer context menu + no category prefix in SaveDialog filter * OnConvertArchive prefers SelectedEntries[0].Path when browsing real FS so right-click → Convert works without opening the archive first * Dropped 'Archive: ' prefix from filter labels (was misleading for filesystem descriptors that share the Archive FormatCategory) (6018e6b)
+- Explorer refresh after defrag/shrink/wipe/optimize: DefragmentWindow.ArchiveMutated event fires on success; MainWindow + MainViewModel re-list when the mutated path matches the open archive (14d89da)
+- CONTRIBUTING.md: stage-based format-promotion strategy (golden sample -> R/O -> WORM -> R/W) with per-stage acceptance gates + mutual-compensation trap doc (33573bf)
+- OpenVms: bounded OpenEntry over FULL.disk + home_block.bin (71af295)
+- Ubifs: real on-disk file reader (zlib + stored data nodes) + bounded OpenEntry (bc6e824)
+- Mfs1: real DFS-tier catalog walker + bounded OpenEntry (a33d553)
+- HFS+: true two-pass streaming writer (catalog B-tree + fork-data streaming with sparse-zero tails) (b30045c)
+- NTFS: true two-pass streaming writer (MFT layout + run-list streaming with sparse-zero tails) (63eebc4)
+- Yaffs2 native OpenEntry: bounded streaming view over reassembled chunk extents (accepts files/ prefix) (7e757a0)
+- Jffs2 native OpenEntry: bounded streaming view over Jffs2FileReader's reassembled data nodes (3334307)
+- Ext: true two-pass streaming writer (block groups + extent-stream entry copy with sparse-zero tails) (8fac56f)
+- MinixV2 native OpenEntry: bounded streaming view over triple-indirect inode data zones (b7571c5)
+- MinixV1 native OpenEntry: bounded streaming view over inode-reassembled data zones (6ff7b56)
+- ExFat: true two-pass streaming writer (zero-buffer entry copy with sparse-zero cluster tails) (7200163)
+- Streaming tests: ReadOnlyStreamSlice spec (9 tests) + entry-isolation fuzz for APK, JAR, tar.gz native overrides (f14f67b)
+- ExFat/Ext/NTFS/HFS+ CreateFromStreams: source-bounded streaming inputs feed existing writers; TODO: refactor writers to true two-pass streaming (ec040e8)
+- Filesystem native OpenEntry: bounded extent-walking views for ~35 filesystems (ExFAT/Ext/NTFS/HFS+/Btrfs/APFS/XFS/SquashFS/CramFS/EROFS + retros) (892dc48)
+- Other archive natives: bounded OpenEntry for ~21 formats (AlZip, Psarc, Lit, Mobi, InnoSetup, NSIS, RPM, Pkcs12, PBP, PFS0, ESD, SWM, EML, LBR, STL, PCAP, PCAPNG, WBN, OneNote, PST, mbox) (9637d51)
+- Apple/Mac container natives: bounded OpenEntry for AppleSingle, PackIt, CompactPro, DiskDoubler (3e79e3f)
+- Game-archive native OpenEntry: bounded-stream views for ~33 formats; + ReadOnlyStreamSlice primitive (10de2d0)
+- DEB: native OpenEntry as bounded view over inner data.tar.* entries (aa9d93f)
+- ZIP-derived containers: native OpenEntry forwarding to ZIP reader (26 formats) (b687cab)
+- Deferred-length write stream + AddEntry auto-pick (zero-buffer when source.CanSeek + .Length known) (9237cb4)
+- Compound TAR: native OpenEntry via decompression wrap + inner TAR delegation (bab6559)
+- ArchiveReader/ArchiveWriter facade + native OpenEntry overrides for 15 formats (dff6270)
+- Bounded per-entry streaming pipeline (OpenEntry → bounded Stream + CreateFromStreams two-pass writer for FAT) (f8f05a9)
+- Layout profile editor (UI for create/load/save/delete defrag profiles) (f536251)
+- Layout templates: sort keys, range-based zones, JSON files, filter expressions (a136166)
+- Hfs schema knobs (1bc440b)
+- Rt11 schema knobs (e30d02e)
+- Os9Rbf schema knobs (158ce58)
+- TrDos schema knobs (69a2161)
+- CpcDsk schema knobs (b08ada4)
+- Mfs schema knobs (81e60c8)
+- Lif schema knobs (51f9350)
+- Udf schema knobs (36f780f)
+- Iso schema knobs (834e9a8)
+- Cpm schema knobs (a667f93)
+- Explorer delete (real FS + modifiable archives) (a996d8e)
+- D81 schema knobs (50f2c71)
+- D71 schema knobs (9d158a3)
+- D64 schema knobs (4aace5c)
+- Bbc schema knobs (a4f27c0)
+- Atari8 schema knobs (4398ddb)
+- AppleDos schema knobs (76dde2b)
+- Adf schema knobs (bc391f5)
+- Filesystem schema knobs (FAT/exFAT/ext/HFS+/NTFS/Btrfs) (595d15b)
+- stub-tier File-System detection (9) (8ccaee2)
+- Trsdos File-System (5abb3b7)
+- Ti99 File-System (0c6ff4e)
+- Pc98 File-System (3f5d20b)
+- Nilfs1 File-System (c7119cc)
+- Jfs1 File-System (2d77d8e)
+- Human68k File-System (2a46f04)
+- Htfs File-System (2762eb2)
+- Gfs1 File-System (7101fff)
+- Gemdos File-System (08d0cd3)
+- Efs File-System (81605a9)
+- Cromemco File-System (f1a8315)
+- ApplePascal File-System (8ebfca5)
+- Archive format schemas (06a9722)
+- Format options schema infrastructure (fbc3121)
+- ZFS is now read/write (IArchiveModifiable): add/replace/remove via read-extract-rebuild through the fat-ZAP-capable writer (preserving the label footprint) (4acfaf4)
+- F2FS is now read/write (IArchiveModifiable): add/replace/remove via read-extract-rebuild through the fsck.f2fs-clean writer (278434e)
+- APFS is now read/write (IArchiveModifiable): add/replace/remove via read-extract-rebuild through the Fletcher-64-valid writer (82ec9e9)
+- JFS is now read/write (IArchiveModifiable): add/replace/remove via read-extract-rebuild through the fsck.jfs-clean writer (29959f4)
+- ReiserFS is now read/write (IArchiveModifiable): add/replace/remove via read-extract-rebuild through the reiserfsck-clean writer (183e640)
+- LZ4 exposes a Level option (Fast/HC) and honours it # LZ4 HC: require a strictly-earlier chain candidate so the lazy-match path can't emit a zero-offset match that fails to decode (1816592)
+- Brotli exposes a Quality option (Uncompressed/Fast/Default/Best) and honours it (window is derived internally per RFC 7932) (d874472)
+- LZMA exposes Level + DictionarySize + lc/lp/pb options and honours them (the optimizer uses coordinate descent over this multi-axis space) (79b1aec)
+- Bzip2 exposes a BlockSize option (1..9 x 100 KB) and honours it (c5b459a)
+- Gzip and Zlib expose a Deflate compression-level option (None/Fast/Default/Best/Maximum) and honour it; shared DeflateLevelOption parse helper (cb2c1b3)
+- IStreamFormatOperations.Compress(in,out,options) overload so compression formats can honour their IFormatOptionsSchema tunables (default ignores options, unparameterised formats unchanged) + Zstd exposes a Level option schema and honours it + CompressionOptimizer: schema-driven search (exhaustive under a budget, else coordinate descent) that returns the smallest output + winning parameters for the caller's data (2951898)
+- FAT external-conformance test: fsck.fat reports FAT12/16/32 images clean (BPB, dual FATs, FSInfo, '.'/'..' chains all verified); includes a corruption-detection guard so the assertion genuinely bites (ee0756d)
+- exFAT external-conformance test: fsck.exfat reports our images clean (boot-region checksum, entry-set checksums, name hashes, bitmap, upcase all verified) (e3a8646)
+- block-map visualization views: switch between the linear grid, a 2-D circular platter (sector angle + cylinder radius), and a 3-D cylinder stack (head height) to show where data physically resides + MediaGeometry/MediaProjection core (LBA<->CHS, polar/stack projections) with unit tests; BlockMapControl gains a ViewMode + Geometry, and the defragment window a view selector (900d72c)
+- Joliet support for ISO9660: a Supplementary Volume Descriptor with a parallel UCS-2BE directory tree and path tables carries long, mixed-case, Unicode filenames on CDs (on by default; PVD keeps ECMA-119 short names) * IsoReader prefers Joliet names when present; IsoModifier/extent map keep both trees consistent (ffef592)
+- NTFS 8.3 short-name suppression switch (Generate8Dot3 option): emit Win32-only $FILE_NAME instead of Win32&DOS, like Windows with 8.3 creation disabled + tests pinning resident small-file $DATA (no clusters/slack for files under the resident threshold) and the short-name namespace, cross-checked against ntfs-3g (2659e3f)
+- ArchiveInputInfo in-memory input overloads: InMemory(name, ReadOnlySpan<byte>), InMemory(name, Stream), and FromFile(FileInfo) so the in-memory reconfigure/convert API is ergonomic to use (c5831d7)
+- FAT defrag fuses a fragmented directory's cluster chain into one contiguous run and relinks each owner's full chain once (two-phase move+relink) # FAT defrag repatches subdirectory '.'/'..' self/parent pointers after moves so the on-disk tree stays consistent + defrag subdirectory round-trip tests (FAT in-place planner path; Ext rebuild path) (2b9d5c2)
+- F2FS directories spill from inline dentries into regular multi-segment dentry data blocks so very large directories round-trip (e221ceb)
+- ZFS directories spill from micro-ZAP into a real fat-ZAP (header + leaf blocks) so very large directories round-trip (bba8b95)
+- HFS+ catalog grows into a multi-node B-tree (index nodes + leaf chain) so very large directories round-trip (9929dd9)
+- HFS catalog grows into a multi-level B*-tree (index nodes over chained leaves) so very large directories round-trip (c08c35f)
+- APFS FS-tree grows into a multi-leaf B-tree with an internal node so very large directories round-trip (3df12b3)
+- NTFS large directories spill into $INDEX_ALLOCATION (INDX blocks + $BITMAP) so very large directories round-trip (3df8f2f)
+- ReiserFS S+tree grows to a 3-level tree (internal block over many leaves) so very large directories round-trip (264323b)
+- JFS directories spill from the inline dtree into external B+tree pages so very large directories round-trip (857010f)
+- XFS directories convert from short-form to block-form (multi data-block) so very large directories round-trip (c52f6ce)
+- Btrfs FS-tree grows into a multi-leaf B-tree with an internal index node so very large directories round-trip (b93b7d3)
+- Jffs2 large-directory round-trip test (many entries in one directory already supported) (0b6833b)
+- Adf large-directory round-trip test (many entries in one directory already supported) (942d09b)
+- Iso large-directory round-trip test (many entries in one directory already supported) (d7c783e)
+- Fat large-directory round-trip test (many entries in one directory already supported) (f7d7ae6)
+- Ocfs2 directories grow across multiple blocks/nodes so very large directories round-trip (ea20544)
+- Udf directories grow across multiple blocks/nodes so very large directories round-trip (ca42dc2)
+- Hpfs directories grow across multiple blocks/nodes so very large directories round-trip (3bd0c5e)
+- Bfs directories grow across multiple blocks/nodes so very large directories round-trip (4d7b77b)
+- Os9Rbf large-directory round-trip test (many entries in one directory already supported) (297e3ad)
+- ProDos directories grow across multiple blocks/nodes so very large directories round-trip (1d60aea)
+- MinixFs directories grow across multiple blocks/nodes so very large directories round-trip (e283df6)
+- Ufs directories grow across multiple blocks/nodes so very large directories round-trip (fdb584b)
+- Ext1 directories grow across multiple blocks/nodes so very large directories round-trip (ef7a4fe)
+- Ext directories grow across multiple blocks/nodes so very large directories round-trip (726a1c2)
+- Yaffs2 zeroes unused space and cluster-tip slack via IWipeEmpty (generic UnusedSpaceWiper) (e1cad16)
+- Xfs zeroes unused space and cluster-tip slack via IWipeEmpty (generic UnusedSpaceWiper) (2a1fb55)
+- Vdfs zeroes unused space and cluster-tip slack via IWipeEmpty (generic UnusedSpaceWiper) (0ae68b3)
+- Ufs zeroes unused space and cluster-tip slack via IWipeEmpty (generic UnusedSpaceWiper) # Ufs extent map now reserves directory/root/metadata blocks so wiping and defrag never touch live data (0ddfbb9)
+- Udf zeroes unused space and cluster-tip slack via IWipeEmpty (generic UnusedSpaceWiper) # Udf extent map now reserves directory/root/metadata blocks so wiping and defrag never touch live data (637a895)
+- TrDos zeroes unused space and cluster-tip slack via IWipeEmpty (generic UnusedSpaceWiper) (d6b8437)
+- SquashFs zeroes unused space and cluster-tip slack via IWipeEmpty (generic UnusedSpaceWiper) (d999026)
+- Rt11 zeroes unused space and cluster-tip slack via IWipeEmpty (generic UnusedSpaceWiper) (ee1df2b)
+- RomFs zeroes unused space and cluster-tip slack via IWipeEmpty (generic UnusedSpaceWiper) # RomFs extent map now reserves directory/root/metadata blocks so wiping and defrag never touch live data (d5b2b7f)
+- ProDos zeroes unused space and cluster-tip slack via IWipeEmpty (generic UnusedSpaceWiper) (6ca2276)
+- Os9Rbf zeroes unused space and cluster-tip slack via IWipeEmpty (generic UnusedSpaceWiper) (80008d4)
+- Ocfs2 zeroes unused space and cluster-tip slack via IWipeEmpty (generic UnusedSpaceWiper) (9ed5b69)
+- Ntfs zeroes unused space and cluster-tip slack via IWipeEmpty (generic UnusedSpaceWiper) (71cfff3)
+- Msa zeroes unused space and cluster-tip slack via IWipeEmpty (generic UnusedSpaceWiper) (440c703)
+- MinixFs zeroes unused space and cluster-tip slack via IWipeEmpty (generic UnusedSpaceWiper) # MinixFs extent map now reserves directory/root/metadata blocks so wiping and defrag never touch live data (d0b789c)
+- Mfs zeroes unused space and cluster-tip slack via IWipeEmpty (generic UnusedSpaceWiper) (15324fb)
+- Lif zeroes unused space and cluster-tip slack via IWipeEmpty (generic UnusedSpaceWiper) (3351a3c)
+- Jffs2 zeroes unused space and cluster-tip slack via IWipeEmpty (generic UnusedSpaceWiper) (83aab59)
+- Iso zeroes unused space and cluster-tip slack via IWipeEmpty (generic UnusedSpaceWiper) (c750476)
+- Hpfs zeroes unused space and cluster-tip slack via IWipeEmpty (generic UnusedSpaceWiper) (34510db)
+- HfsPlus zeroes unused space and cluster-tip slack via IWipeEmpty (generic UnusedSpaceWiper) # HfsPlus extent map reserves directory/root blocks so wiping never corrupts live metadata (6783480)
+- Hfs zeroes unused space and cluster-tip slack via IWipeEmpty (generic UnusedSpaceWiper) (86fc9fa)
+- Ext1 zeroes unused space and cluster-tip slack via IWipeEmpty (generic UnusedSpaceWiper) # Ext1 extent map reserves directory/root blocks so wiping never corrupts live metadata (693c46c)
+- Ext zeroes unused space and cluster-tip slack via IWipeEmpty (generic UnusedSpaceWiper) (f3bffd7)
+- ExFat zeroes unused space and cluster-tip slack via IWipeEmpty (generic UnusedSpaceWiper) # ExFat extent map reserves directory/root blocks so wiping never corrupts live metadata (73eb6be)
+- DoubleSpace zeroes unused space and cluster-tip slack via IWipeEmpty (generic UnusedSpaceWiper) (add06b3)
+- D81 zeroes unused space and cluster-tip slack via IWipeEmpty (generic UnusedSpaceWiper) (136994b)
+- D71 zeroes unused space and cluster-tip slack via IWipeEmpty (generic UnusedSpaceWiper) (0f05cbf)
+- D64 zeroes unused space and cluster-tip slack via IWipeEmpty (generic UnusedSpaceWiper) (e2a3d32)
+- CramFs zeroes unused space and cluster-tip slack via IWipeEmpty (generic UnusedSpaceWiper) (f5f0395)
+- Cpm zeroes unused space and cluster-tip slack via IWipeEmpty (generic UnusedSpaceWiper) (d1411e0)
+- CpcDsk zeroes unused space and cluster-tip slack via IWipeEmpty (generic UnusedSpaceWiper) (b5e14ba)
+- Btrfs zeroes unused space and cluster-tip slack via IWipeEmpty (generic UnusedSpaceWiper) (29802d8)
+- Bfs zeroes unused space and cluster-tip slack via IWipeEmpty (generic UnusedSpaceWiper) (c9a5e84)
+- Bbc zeroes unused space and cluster-tip slack via IWipeEmpty (generic UnusedSpaceWiper) (da9df92)
+- Atari8 zeroes unused space and cluster-tip slack via IWipeEmpty (generic UnusedSpaceWiper) (81ad23b)
+- AppleDos zeroes unused space and cluster-tip slack via IWipeEmpty (generic UnusedSpaceWiper) (1683189)
+- Adf zeroes unused space and cluster-tip slack via IWipeEmpty (generic UnusedSpaceWiper) (61e8a5b)
+- FilesystemLayoutOptimizer optimality tests: SelectClusterSize/SelectPair proven to return the global cost minimum (vs brute-force reference) across 200 random workloads, plus tier-then-cost ordering and the smaller-cluster tie-break # add the missing forceLfn <param> doc on FatWriter.Build (d01eecb)
+- ArchiveInputInfo.InMemoryContent + ReadContent(): inputs can be fed from memory so reconfigure/convert needs no temp extraction directory + InMemoryProcessing: configurable size threshold (default 2 GiB, lowerable for tests) routing small images through an all-RAM build/reconfigure pipeline with atomic temp-file+rename write-back * FAT Create/Add read content via ArchiveInputInfo.ReadContent() so they build from in-memory inputs without disk access (a25c5dd)
+- FAT force-LFN mode: emit a VFAT long-name entry for every file/dir (with generated 8.3 alias) even for names that fit 8.3, the way Windows always records a long name + ForceLongFilenames creation option exposes it (non-VFAT 8.3-only mode already available via LongFilenames=false) (9dd3648)
+- setup-test-environment.sh: installs third-party filesystem/archive tools (mtools, e2fsprogs, ntfs-3g, xfsprogs, btrfs-progs, squashfs-tools, xorriso, ...) for external-validation tests; detects apt/dnf/pacman/zypper and skips already-present tools (52aea28)
+- Yaffs2 writer creates real subdirectory trees instead of flattening nested paths into the root * Yaffs2 Create preserves nested input paths instead of flattening to leaf names (94190b6)
+- Jffs2 writer creates real subdirectory trees instead of flattening nested paths into the root * Jffs2 reader recurses into subdirectories and reports nested paths * Jffs2 Create preserves nested input paths instead of flattening to leaf names (eef14c1)
+- Bfs writer creates real subdirectory trees instead of flattening nested paths into the root * Bfs reader recurses into subdirectories and reports nested paths * Bfs Create preserves nested input paths instead of flattening to leaf names (db7c86c)
+- Zfs writer creates real subdirectory trees instead of flattening nested paths into the root * Zfs reader recurses into subdirectories and reports nested paths (fecfee5)
+- Apfs writer creates real subdirectory trees instead of flattening nested paths into the root * Apfs reader recurses into subdirectories and reports nested paths (c71992f)
+- Ufs writer creates real subdirectory trees instead of flattening nested paths into the root (41b8ff4)
+- Ocfs2 writer creates real subdirectory trees instead of flattening nested paths into the root * Ocfs2 Create preserves nested input paths instead of flattening to leaf names (27d86ee)
+- ReiserFs writer creates real subdirectory trees instead of flattening nested paths into the root * ReiserFs reader recurses into subdirectories and reports nested paths (e07ae17)
+- Jfs writer creates real subdirectory trees instead of flattening nested paths into the root * Jfs reader recurses into subdirectories and reports nested paths (6924c89)
+- Xfs writer creates real subdirectory trees instead of flattening nested paths into the root (3cf387e)
+- Btrfs writer creates real subdirectory trees instead of flattening nested paths into the root (a1d65ea)
+- Adf writer creates real subdirectory trees instead of flattening nested paths into the root (f2bea79)
+- Os9Rbf writer creates real subdirectory trees instead of flattening nested paths into the root * Os9Rbf reader recurses into subdirectories and reports nested paths (1baf447)
+- ProDos writer creates real subdirectory trees instead of flattening nested paths into the root (3f48b8e)
+- MinixFs writer creates real subdirectory trees instead of flattening nested paths into the root (47608aa)
+- Hpfs writer creates real subdirectory trees instead of flattening nested paths into the root * Hpfs reader recurses into subdirectories and reports nested paths * Hpfs Create preserves nested input paths instead of flattening to leaf names (6f23029)
+- Hfs writer creates real subdirectory trees instead of flattening nested paths into the root * Hfs reader recurses into subdirectories and reports nested paths (132e38f)
+- Udf writer creates real subdirectory trees instead of flattening nested paths into the root (4013b84)
+- F2fs writer creates real subdirectory trees instead of flattening nested paths into the root * F2fs reader recurses into subdirectories and reports nested paths (e50b60b)
+- HfsPlus writer creates real subdirectory trees instead of flattening nested paths into the root * HfsPlus reader recurses into subdirectories and reports nested paths (020c8c6)
+- Iso writer creates real subdirectory trees instead of flattening nested paths into the root (c9f4198)
+- Ntfs writer creates real subdirectory trees instead of flattening nested paths into the root (377a804)
+- Ext writer creates real subdirectory trees instead of flattening nested paths into the root (79e11e3)
+- ExFat writer creates real subdirectory trees instead of flattening nested paths into the root (87a3c05)
+- register .fat as a FAT image extension so archive creation resolves it + mtools nested-directory round-trip integration test (mdir -b -/ validates our subdirectory layout) (a7b51b2)
+- FAT writer builds real subdirectory trees instead of flattening nested paths into the root * FAT root-directory overflow check now counts only the root's direct children, so deep trees stay on FAT12/16 instead of being forced to FAT32 (ceeb794)
+- project vision section at the top of the README + README section documenting the Wine workflow for the UI on Linux * gitignore agent artifacts (.claude/, CLAUDE.md, agent dirs, scratch, worktrees) and local wine-publish output (556266d)
+- FilesystemLayoutOptimizer: cluster/block/MFT sizing that minimises slack + table overhead + IFormatOptionsSchema-driven creation options for FAT, exFAT, ext, NTFS, HfsPlus, F2fs, FatPlus, TFat, ProDos + FilesystemSchemaPresets and ILayoutOptimizable shared contracts + FAT retro/optical image-size presets, FAT-type forcing, DMF root entries, VFAT/TFAT/FAT+ toggles, volume label + NTFS tunable cluster + MFT record size via paired grid search + streaming FatWriter.BuildTo for arbitrarily large images (sparse, bounded memory) + fixed-image cluster optimizer that minimises slack within a pinned image size * plumb format-specific options from the UI through CompressionOptions to FormatCreateOptions * FatReader detects FAT32 from the BPB FAT-size field, not only cluster count * exFAT auto-size clamps to a 4 KiB minimum cluster (5e8c3f1)
+- run-wine.sh to build and launch the WPF UI under Wine on Linux + software-render fallback under Wine (fixes black menus) gated by an env flag (31a241e)
+- new filesystems + defragmenting + conversions + partition edit (3575df2)
+- defragmenting UI (665bb3b)
+- made more formats RW instead of WORM (39bbb6b)
+- split into nuget-packages (35275b4)
+- pngcrushcs dependency (fde11b2)
+- PNGCrushCS reference (ac2cf0d)
+- colorplane splittng and previewing for images + more archive formats (535dbe4)
+- ui niceties (0a7ecbd)
+- more filesystems (6e12cd3)
+- exif patching (763661c)
+- exe-packers, codecs, more splittable fileformats (9a13d99)
+
+### Removed
+- no nuget publish on nightly (1887ccf)
+- Revert the UFS superblock/cg writer fixes (commits 2ef3939, 4842797) — they are fsck_ffs-correct (verified by booting FreeBSD under qemu) but the repo's UfsReader/UfsModifier are written against the old self-consistent format, so the writer-only change broke 5 round-trip/mutation tests, and the image still is not fully fsck-clean (Phase 2 dirents + Phase 5 fs_old_cpg=0 FPE remain). The real fsck_ffs findings (fs_qbmask/fs_qfmask complement, fs_old_rps/interleave/postblformat/nrpos, fs_sbsize alignment, fs_sblockloc, fs_maxfilesize, fs_size fragment units, cg layout) are recorded for a coordinated writer+reader+modifier fix (be5800b)
+
+### Changed
+- ChainReconstructor: size-scaled blind-trial timeout + broader fingerprint mapping # blind-trial sweep hardcoded a 200 ms cap, ignoring the configured perTrialTimeoutMs   and never scaling — a megabyte-scale layer could be abandoned mid-decompress; now   the budget is base + 1 ms/KiB, capped at 5 s * MapToTrialName -> MapToTrialNames: the generic fingerprint classes   (Dictionary-Compressed, Strong-Compression) now map to a priority-ordered shortlist   of raw trials instead of null, so a confident-but-unspecific fingerprint gets a fast   path before falling through to the full blind sweep (14b324b)
+- Context mixing: real logistic-domain mixer (PAQ/lpaq-style) (d59fe45)
+- PNG/TIFF/MPO/DCX/ICNS descriptors now decompose to chunks/pages/sub-images (36389e4)
+- Webp pseudo-archive: add metadata.ini + frames/ + in-memory extract + malformed-safe List (a7fc34a)
+- WORM/R audit: lock R-only-modify contracts on 8 archive descriptors that do not implement IArchiveModifiable + PackIt: byte-identity lock — Add appends at EOF (prefix bytes byte-identical at original offsets), Remove of last entry truncates exactly to dropped offset, survivors strictly before a removed entry preserve their on-disk offsets * AndroidOta Description: name `metadata_signature` field + DeltaArchiveManifest SHA-256 per-operation hashes as the spec barrier * Crx Description: name CRX3 SignedData protobuf KeyProof signatures as the spec barrier (CanCreate stays — empty SignedData, not browser-loadable) * Snap / AppImage Descriptions: name SquashFS write-once table indexing by absolute on-disk offset + snapd SHA-3-384 assertion / appimagetool GnuPG detached signature as the container barrier * Wbn Description: name CBOR `sections-lengths` + `index` absolute-offset encoding + Signed Web Bundle Ed25519 authorities signature as the spec barrier * Sar / Nsa Descriptions: name `uint32 BE data_offset` header field as the structural barrier — index growth shifts data_offset and every byte after it (CanCreate stays — stored mode) * StuffItX Description: name P2-length-header element-stream with absolute catalog offsets + proprietary Brimstone/Darkhorse/Cyanide/Iron methods as the writer-scope barrier + 9 new test fixtures (32 tests): WORM contract tests assert descriptor is not IArchiveModifiable, does not advertise CanModify, and Description names the blocking spec field; PackIt InPlaceModify tests lock the byte-identity contract end-to-end (3e382e3)
+- Bkf: promote MTF R-only to in-place R/W via append-before-EOTM (Add) and   XXXX-tombstone (Remove); descriptor + IArchiveModifiable + CanModify + BkfInPlaceModifier: AddFile walks the DBLK chain to the EOTM block,   inserts a fresh FLB-aligned FILE DBLK (CBH + FNAM + STAN streams) at that   position, then re-emits an EOTM block at the new end so every pre-existing   TAPE / SSET / VOLB / FILE / DIRB / ESET DBLK stays byte-identical at its   original offset; RemoveFile locates the FILE DBLK whose FNAM matches and   overwrites its 4-byte type field with the XXXX sentinel plus zero-wipes the   rest of that FLB-aligned block so the FNAM + STAN payload bytes leave no   forensic trace; the reader's parse loop hits an unknown DBLK type and skips   the tombstone via the next-FLB advance * BkfFormatDescriptor: + IArchiveModifiable + CanModify; Add/Remove route   through BkfInPlaceModifier + BkfInPlaceModifyTests (19 tests): Add appears in listing, all pre-EOTM   bytes survive byte-identical, EOTM re-emitted at new end, no-EOTM fallback   appends at EOF, empty payload round-trips; Remove drops from listing,   neighbour FILE DBLKs stay byte-identical, payload bytes zero-wiped,   tombstone carries XXXX sentinel, missing-name returns false; mutate-then-   extract round-trip; descriptor surface routes Add/Remove through modifier * Lnk: keep WORM honestly + lock the rebuild semantic in the Description and   pin the WORM state with a descriptor capability test (no CanModify, no   IArchiveModifiable). MS-SHLLINK describes one target whose StringData /   ExtraData regions reshape with every mutation, so a byte-preserving   in-place patch is not feasible — callers re-Create via LnkWriter * Sparsebundle: keep R-only honestly + spell out the deferred promotion path   in the Description (directory-target sibling interface or virtual TAR-of-   directory facade) + point callers at the companion R/W Sparseimage   descriptor; lock the R-only state with a descriptor capability test # Repair pre-existing test-code rot that was blocking the test assembly   compile: AppleSingleWriterTests referenced the obsolete Write / NameToEntryId   surface (current API is Build / EntryIdForName); Mfs1WriterTests referenced   the obsolete SetTitle fluent builder (current API is Build(diskTitle));   GsOsWriterTests referenced the obsolete SetComment and creator override   (current writer hardcodes CWB! and emits no comment block) (391953a)
+- Ipsw + AppleSingle: promote to true in-place R/W (CanModify) + AppleSingleWriter: emits canonical 26-byte header + N x 12-byte entry   directory + contiguous payload area per RFC 1740 v2; name-to-id   mapping reverses AppleSingleReader.EntryName plus entry_NNNNN.bin   numeric fallback + AppleSingleInPlaceModifier: Add appends payload + grows the directory   by one slot (shifting existing payloads forward by 12 bytes and   rewriting their offsets so byte content survives); Replace rewrites   same-size payloads in place, otherwise zero-wipes the previous range   and repoints the slot to a fresh EOF append; Remove zero-wipes the   payload range, then compacts the 12-byte directory slot out by   shifting trailing slots forward (surviving payload absolute offsets   unchanged) + IpswInPlaceModifier: delegates Add/Remove to ZipModifier (raw ZIP   entry namespace) - only the central directory, EOCD, and the   appended LFH + payload are touched * AppleSingleFormatDescriptor: + IArchiveCreatable + IArchiveModifiable   + CanCreate + CanModify; Create drops synthetic metadata.ini; Add/   Remove route through AppleSingleInPlaceModifier * IpswFormatDescriptor: + IArchiveCreatable + IArchiveModifiable +   CanCreate + CanModify; Create delegates to ZipWriter, drops synthetic   FULL.ipsw / metadata.ini; Add/Remove route through IpswInPlaceModifier + AppleSingleInPlaceModifyTests (24 tests): writer round-trip, name   mapping, Add preserves existing payload bytes + bumps entry count,   Remove zero-wipes payload + leaves survivor payloads byte-identical   at original offsets, Replace same-size keeps offset, Replace larger   appends + wipes, Create round-trip, mutate-then-extract + IpswInPlaceModifyTests (11 tests): Add appears in listing + preserves   existing entry byte content, descriptor surface routes through   ZipModifier, synthetic entries dropped on Create + Add, Remove   preserves other entries, mutate-then-extract via List ! Bkf demoted honestly: FileFormat.Bkf does not exist in this worktree   (no descriptor, no reader, no project); promotion deferred until the   format is implemented first (ccd68d5)
+- AppleSparse: promote Sparseimage WORM -> true in-place R/W via band rewrite at fixed offsets (db76b24)
+- ApplePascal: promote WORM to true in-place R/W via spec-canonical mutation + ApplePascalInPlaceModifier: Add/Replace/Remove against the 26-byte fixed dirents + ApplePascalFormatDescriptor: IArchiveModifiable + CanModify wired in + 22 in-place modify tests — Add/Replace/Remove leave untouched blocks byte-identical,   zero-wipe on Remove, 77-entry cap + volume-full boundaries, header file-count   increment/decrement, descriptor surface, extent reuse after Remove+Add * Sfs: lock the deferred R/W state in the descriptor remarks and Description —   promotion requires writer first (no SfsWriter exists), then four cross-checksummed   structures (B+ tree + bitmap chain + dir hash table + free-extent tree). No   platform-side fsck-class validator exists, so self-round-trip alone cannot prove   on-disk correctness — R-only stays the honest state (6deed33)
+- Acronis classic .tib: R-only -> R/W via true in-place record-stream append (c70858d)
+- Vdfs FormatDescriptor: route IArchiveModifiable Add/Remove through the new   VdfsInPlaceModifier instead of the rebuild fallback, so the on-disk image   is mutated in place and existing file extents keep their original byte   ranges (stored mode only — compression flag is deferred since no observed   Gothic-engine image uses it) + Vdfs InPlaceModifier: true random-access editing — Add appends the new   payload at end-of-stream and writes a fresh entry-table region past it,   patching the header's entry count + file count + total-data-size + root   offset; Remove zeroes the 80-byte entry record (the reader's existing   empty-name skip turns it into a tombstone) and zero-wipes the extent;   Replace rewrites at the original offset when the new bytes fit, otherwise   falls back to remove-plus-tail-add + Vdfs InPlaceModifyTests: 18 tests locking the byte-identical invariant —   Add preserves every surviving extent at its original offset, surviving   entry records are byte-identical after table relocation, Remove leaves   neighbour extents and neighbour entry records untouched, fits-Replace   rewrites at the original offset, mutate-then-extract round-trip, plus   descriptor-level integration coverage and an extent-wipe security check (e7c7d1c)
+- DoubleSpace + DriveSpace + DriveSpace3 modify: rebuild -> true in-place via MDFAT + BitFAT mutation (5be146f)
+- ZxScl + T64 promoted to TRUE in-place R/W (no read-extract-rebuild) + ZxSclInPlaceModifier: Add right-shifts payload region by one 14-byte directory slot, writes the new entry header in the freed gap, appends sector-padded data at the new end and rewrites the trailing 32-bit checksum; Remove shifts later directory entries up by 14 bytes, closes the payload gap with a backward shift of (14 + sector-padded removed bytes), truncates the stream and rewrites the checksum + T64InPlaceModifier: Add fills a free directory slot (entryType=0) when one exists, otherwise grows the directory by one 32-byte slot via a forward shift of the payload region (each existing slot's absolute dataOffset field is patched +32); Remove shifts later directory slots up by 32 bytes, wipes the removed payload bytes, closes the payload gap with a backward shift (each surviving slot's dataOffset is patched), truncates the stream and decrements maxEntries/usedEntries in the header * ZxSclFormatDescriptor + T64FormatDescriptor route Add/Remove through the new in-place modifiers; ModifyRebuilder fallback removed from the modify path (Defragment still uses DefragRebuilder) + Replace-by-name semantic on Add: an existing same-named entry is removed in-place before the new bytes are inserted, so callers get single-occurrence overwrite + ZxSclInPlaceModifyTests: Add preserves prior entries + checksum, Remove preserves others + shrinks stream by exact (14 + sector-padded) bytes, Add same-name replaces, mutate-then-extract roundtrip across 4 ops, descriptor routes through in-place modifier, Remove of unknown name returns false without mutation + T64InPlaceModifyTests: Add grow-directory path preserves existing data, Remove + Add reuses-or-grows path, Remove preserves others + shrinks by exactly 32 + payload bytes + secret-wipe verification (removed bytes are absent anywhere in the stream), Add same-name replaces, mutate-then-extract roundtrip, descriptor routes through in-place modifier, Remove of unknown name returns false without mutation (b8b23d5)
+- MinixFs: rebuild-based Add/Remove promoted to TRUE in-place R/W across V1/V2/V3 (34ba4f0)
+- SysV s5fs: promote modifier facade from SysVModifier to SysVInPlaceModifier — true in-place R/W (baff4ba)
+- Hpfs Add/Remove: rebuild-based path replaced with true in-place root-DIRBLK mutation via HpfsInPlaceModifier + HpfsInPlaceModifier: bitmap-walk sector allocation at LBA 24 (1=free, 0=used), FNODE + data sector writes at known offsets, dirent shift-in-place inside the root DIRBLK at LBA 20 + Replace: in-place data-sector rewrite when new size fits the existing allocation; reallocate-and-free otherwise + Remove: zero freed FNODE + data sectors, flip bitmap bits back to free, excise dirent slot by shifting later entries back + HpfsFormatDescriptor.Add/Remove delegate to the in-place path with a documented fallback to ModifyRebuilder when the call hits the deferred-scope cases (nested paths, single-DIRBLK overflow) + HpfsInPlaceModifyTests: 15 tests locking the load-bearing properties — untouched sectors stay byte-identical sector-by-sector for Add/Replace/Remove, bitmap tracks allocs and frees, mutate-then-extract round-trip, descriptor wiring uses the in-place path, subdirectory inputs cleanly fall back to rebuild ! Multi-block DIRBLK B-tree split/merge and nested subdirectory mutation deferred — scoped out in the modifier's XML doc; descriptor falls back to ModifyRebuilder for those callers so end-to-end Add/Remove of nested paths still works (50ef2d9)
+- FileSystem.Bfs Add/Remove: rebuild-based -> true in-place R/W via inode + B+tree leaf + AG bitmap mutation at fixed sector offsets (b1d6c94)
+- Jffs2 modify: rebuild-based -> true in-place log-append per JFFS2 spec (ccc257e)
+- Yaffs2 IArchiveModifiable: promote rebuild-disguised-as-R/W to TRUE in-place log-structured R/W + Yaffs2InPlaceModifier: Add/Replace/Remove append fresh chunks at image tail with monotonically-increasing seqNumber, never overwrite bytes in [0, oldLength). Add detects name collisions and routes them through Replace. Remove emits a tombstone header (parent_obj_id = 0xFFFFFFFE) leaving the deleted object's chunks byte-identical at original offsets * Yaffs2Scanner.DecodeAll: now log-structured-aware. For each (objectId, chunkId), keeps only the chunk with the highest seqNumber; ties resolved by image-order (last-append wins). Header with parent_obj_id == 0xFFFFFFFE = tombstone, object dropped from live view. Data chunks bounded by ceil(latestHeader.size / chunkSize) so a Replace-with-shorter-bytes correctly drops now-stale tail chunks of the prior version * Yaffs2FormatDescriptor: IArchiveModifiable.Add/Remove route through Yaffs2InPlaceModifier instead of ModifyRebuilder. Descriptor.Remove tolerates the "files/" prefix and nested-path leaf names, mapping each to root-level lookup; missing-name Remove silently skips per rebuild-path behaviour. Class doc-comment now spells out the in-place log-structured invariant and the [0, oldLength) byte-identical-untouched-bytes guarantee + Yaffs2InPlaceModifyTests: 13 tests locking the invariant — Add/Replace/Remove keep [0, oldLength) byte-identical, file A's chunk range survives byte-for-byte after Add+Replace+Remove of other entries, image-growth = exactly header+data-chunks per Add, scanner picks highest-seqNumber chunk, shrinking-Replace drops stale tail chunks, mutate-then-extract returns the mutated bytes, tombstoned object resolves to empty stream, missing-name Replace/Remove throws InvalidOperationException, nested-path Add throws NotSupportedException (honestly deferred — rebuild path is the right tool for subdirectory creation) * Yaffs2Tests.Modify_Remove_RemovesFile: switched the fixture's MemoryStream from fixed-size to expandable so the log-structured tombstone-append can grow the image by one Stride ! Honest scope: in-place Add of paths containing '/' or '\' is deferred and throws NotSupportedException with a specific message. Nested directory creation on Add and on-medium garbage collection (block recycling that physically reclaims obsolete chunk slots) remain rebuild-path territory; the load-bearing R/W operations on root-level entries are now byte-honest per the YAFFS2 spec (f20c3cc)
+- Ghost + Macrium: revert R/W claim back to honest WORM (71101e5)
+- Backup formats Ghost + Macrium R/W docs updated to reflect IArchiveModifiable landings (e3696b2)
+- Docs: reflect R -> WORM promotion wave (46882d6)
+- Backup-software disk images doc: reflect the 5-agent RE wave (5689641)
+- audio support tables: wave 12 — Yamaha OPM/OPN/OPNA + OPL family in VGM, PC Engine HuC6280+PSG (HES render), NES expansion audio (VRC6/7/FDS/MMC5/Namco163/5B), AMR-NB/WB voice (198ab12)
+- audio support tables: MOD/S3M/XM/IT now list per-channel SONG_LEFT/RIGHT.wav alongside SONG.wav (916e263)
+- audio support tables: wave 11 — Codec.Ym2413 (OPLL/SMS FM) in VGM, Codec.Tracker (MOD/S3M) + Codec.TrackerXmIt (XM/IT) song render + IT215 decompression, per-subtune TRACK_nn extraction (NSF/NSFE/GBS/SID/AY/KSS), MP4/Matroska/AVI per-track audio decode (7d8ce3d)
+- audio support tables: wave 10 — ADPCM variant pile, ATRAC1/.aea, RA288+RALF in RealMedia, CRI HCA + AHX-in-ADX, SBC/Siren/S302M, Bink+Smacker audio, MPC SV7, WMA Lossless, XMA→XWB, QOA/DFPWM/Bonk/WavArc, SID 2SID/3SID model matrix (50794cb)
+- audio support tables: chip-synthesis wave — SID/SPC/NSF/GBS/AY/KSS/VGM/GYM all render to PCM via emulated CPUs (6502, SPC700, SM83, Z80) and sound chips (SID 6581/8580, S-DSP, 2A03, GB APU, AY-3-8910, SN76489, OPN2) (555ce7a)
+- audio support tables: DTS core + E-AC-3 decode complete (1315d9b)
+- audio support tables: wave 8 partial — Speex, G.723.1, WavPack float, HE-AAC SBR (gated), WMA Pro, Sipro (6dc1d08)
+- audio support tables: heavyweight wave — AAC-LC complete, WavPack/APE reference-faithful, Cook/ATRAC3/AC-3/WMA/Musepack decoders, Vorbis floor 0 (4b77461)
+- Monkey's Audio rewritten reference-faithful: byte-exact SDK range coder, v3990 entropy (pivot/escape), CPredictorDecompress3950 + scaled-first-order + level filter cascades — levels 1000-5000 decode, 1000-4000 encode, VERIFIED BYTE-EXACT against ffmpeg n8.1.1 (encode ours → ffmpeg decodes identically, 8/16/24-bit mono+stereo) (f0e798e)
+- WavPack entropy/decorrelation rewritten to the reference bitstream: holding_one/holding_zero shared unary bits, zeros_acc run coding, exact INC/DEC_MED curves, wp_log2/exp2s entropy vars, decorr weights (restore_weight) + seeded samples honored, INT32/SHIFT fixups, joint-stereo corrected — real-world lossless .wv decode path ! hybrid/float/DSD still rejected; needs a checked-in reference vector for byte-exact proof (364ddc1)
+- audio support tables: wave 6 — Monkey's Audio, RA 14.4, TrueSpeech, Interplay ACM, Nellymoser, Westwood/RoQ/Sierra/CRYO, LPC-10, DTS/AC-3/OMA stream info, VGM/MUS/XMI/CMF converters, 7 chiptune rips (f07bda1)
+- audio support tables: waves 4+5 — console/game codecs (ADX, BRR, XA, EA-XA, Wwise-IMA, AICA, DSP family), telephony (G.726 full set, G.722, CVSD), WavPack, MACE, tracker/sampler/vintage containers, ASF + RealMedia (c10171e)
+- audio support tables: document the new codecs (OkiAdpcm, SpuAdpcm, DspAdpcm, G72x, Tta, Shorten, Alac) and containers (8SVX, AVR, SPHERE, IRCAM, VOX, raw GSM, DSF, DFF, TTA, SHN, VAG, BRSTM, SF2, DLS, raw G.711) + Layer I/II, ima4, Creative ADPCM, CAF ulaw/alaw, WAV float updates (1e5e11e)
+- container vs carried data: FULL.<ext> entries are Kind 'Container' (the byte-exact container itself) across all media pseudo-archives, matching the ALAC/APE precedent; Ogg per-stream packet blobs are Kind 'Stream'; carried A/V tracks keep 'Track', decoded speakers 'Channel', metadata 'Tag' * audio README: document the container/carried-data model and the FFmpeg-faithful channel naming (explicit speaker masks, defaults mono through 22.2, CH_n beyond) (460acc9)
+- audio support table: document MP3/OGG per-channel split + new Opus / AAC channel pseudo-archives (77bbffd)
+- audio support table: AIFF + .au now WORM (assemble from per-channel WAVs); document new CAF / Wave64 / RF64 / VOC channel pseudo-archives (f887d5e)
+- document EROFS / LittleFS / CbmNibble as WORM (now creatable) in the support table (9d3dae3)
+- normalize the package-table NuGet badges to the current shields.io URL form (drop the retired .svg suffix) so they match the badge block (b36f96d)
+- mirror current changelog/prune scripts from the shared template (notes-only mode, bot-commit filtering, prune retry + newest-kept guard) (b7b023c)
+- README: quick-start emoji per the fixed mapping, mandatory support and license sections (156c8b5)
+- force JavaScript actions onto Node 24 ahead of the Node 20 deprecation (710298f)
+- adopt the unified version.pl: the single coordinated version now comes from   Directory.Build.props with the props' parent-folder commit count as the build   number (superset script, identical across repos) * release.yml is manual-dispatch only; release/nightly notes are the commit-prefix   changelog (+ - * # !) via body_path / --notes-file, not GitHub's PR notes * nightly tags switch to yyyyMMdd + run wall-clock Performance tests as an advisory CI tier (continue-on-error) * standardize the README badge block to the house style (canonical order and   colours; adds stars / forks / issues / code-size / repo-size badges) (9d1cb96)
+- LGPL promoted to v3 (e988e92)
+- ConvertArchive: in-memory extract+build+atomic-write when source fits below threshold (245ab96)
+- document ReiserFS/JFS/F2FS/ZFS/APFS as R/W (rebuild-based add/replace/remove) in the support table (4e2ee47)
+- FormatHelpers.FilesOnly/FlatFiles read content via ArchiveInputInfo.ReadContent() so rebuild-based create/add works from in-memory inputs (no temp files); on-disk inputs behave identically (376bb05)
+- ArchiveOperations.Optimize (cwb optimize) routes stream formats through CompressionOptimizer's schema search when the format exposes an option schema, instead of the fixed CompressOptimal heuristic (81f37c2)
+- document filesystem-creation advances in the support table (vision: honest audited state): real nested directories of arbitrary size, cluster-tip wiping, defrag, and external-tool (fsck/xfs_repair/btrfs-check/xorriso) conformance; refresh stale ReiserFS/JFS/F2FS/HFS+/ISO notes (cef5b54)
+- setup-test-environment.sh falls back to an AUR helper (yay/paru/pikaur/trizen) on Arch for AUR-only packages (e2tools, hfsprogs, hfsutils, reiserfsprogs, ocfs2-tools); clear note when no helper is present (aaa6080)
+- docs (e826573)
+- de-toying filesystems (2259a4d)
+
+### Fixed
+- In-memory input reads in 20 filesystem writers for archive conversion (aac5362)
+- In-memory archive inputs fail conversion in 20 descriptors (6e5b686)
+- In-memory ConvertArchive inputs throwing FileNotFound in 21 writers (5ffbdf8)
+- In-memory archive inputs: read via ReadContent() in 21 descriptors (7147f95)
+- Qoi tests: best-effort temp-dir cleanup so a transient handle never fails the test * the three file-I/O tests deleted their Guid temp dir in a finally block; on Windows   under combined-run disk pressure Directory.Delete can transiently throw IOException/   UnauthorizedAccessException (AV/indexer holding a handle), failing a test whose   assertions already passed. SafeDelete swallows those and leaves the dir for the OS   temp sweep (6e90ba4)
+- Remove obsolete tests superseded by the feature merge - HammerWormTests / Hammer2WormTests: asserted HAMMER/HAMMER2 stay read-only,   but the merged feature branch ships real kernel-validated writers (creatable);   the feature branch had already deleted these locks - SysVInPlaceModifyTests: asserted the pre-rewrite SysV layout (boot block all   zero); the merged feature branch relocates the superblock into block 0 at   offset 512 (kernel-mountable) and covers R/W via SysVRwTests (7058626)
+- Drop my Caf/Rf64/Tta pseudo-archive tests superseded by the merged feature versions * the merge kept the feature branch's Caf/Rf64/Tta descriptors (preferred) but my   *PseudoArchiveTests.cs (added under a different filename, so no merge conflict)   asserted my descriptors' surface and failed against theirs; the feature branch's   *Tests.cs cover the same formats and pass (245bdfc)
+- F2fsWriter: section_count must count only the MAIN-area segments (segment_count_main / segs_per_sec), not the total segment count. It was set to the total (31) while the main area holds 24, so the kernel rejected the superblock with "Invalid segment/section count (31, 31 x 1)". Now byte-matches mkfs.f2fs (section_count=24) and the superblock passes the kernel's sanity_check_raw_super ! F2fsWriter: kernel mount now advances past the superblock to checkpoint validation (silent EINVAL); the checkpoint's overprov/rsvd segment counts and flags still differ from mkfs.f2fs and need reconciling before f2fs mounts (2557263)
+- NtfsWriter boot sector: encode clusters_per_index_record (offset 68) with the same signed scheme as the MFT-record field instead of a hardcoded 4 — with a 4 KiB cluster the constant meant 4×4096=16384 bytes per index, which ntfs3 rejects ("unsupported bytes per index 16384"); it must derive the 4 KiB IndexBlockSize # NtfsWriter MFT: give each system record the sequence number ntfs3 demands — $MFT (record 0) = 1, every other system record = its record number (was a blanket 1). ntfs3 strict-checks this and aborted with "MFT: r=N, expect seq=N instead of 1". The kernel now loads $MFT/$MFTMirr/$LogFile/$Volume/$AttrDef/root/$Bitmap/$Boot ! NtfsWriter: $BadClus still needs a named non-resident sparse $Bad $DATA stream covering the volume before ntfs3 mounts fully (currently fails to load $BadClus); a writer feature, not yet implemented (138375c)
+- UFS writer: produce a FreeBSD-fsck_ffs-clean UFS1 image — full rewrite to the multi-cylinder-group newfs -O1 layout (ncg=4, per-cg superblock backups at sblkno=16, inode tables, frag/inode bitmaps, cg cluster+frag summaries, csaddr cs-summary area). Fixes vs the old single-cg format: fs_qbmask/qfmask = ~fs_bmask (size-1); size fields in fragments not blocks; fs_old_rps/interleave/postblformat/nrpos + non-zero cpg/spc/nsect geometry (Phase-5 FPE); directories use 512-byte DIRBLKSIZ chunks (di_size=512) not full blocks (Phase-2 corruption); /.snap surfaced as a real root entry; di_dirdepth set; cg_frsum/cg_clustersum populated; struct csum on-disk order is ndir,nbfree,nifree,nffree # UFS reader/modifier: read the multi-cg layout — skip the synthetic /.snap in listings; modify the root directory in 512-byte DIRBLKSIZ chunks * UFS spec-canary tests updated to the correct newfs values (ncg, ipg, fpg, cg_niblk=0, root ndir). Verified: fsck_ffs -f -n passes all 5 phases CLEAN on a real FreeBSD (mfsBSD) guest under qemu (97d5836)
+- Dynamic VHD CHS geometry rounded down, truncating the disk under qemu-img * ComputeChs rounded cylinders down, so cyls*heads*spt*512 could be smaller   than the payload (e.g. a 1.44 MB / 2880-sector floppy collapsed to 2856   sectors). The qemu vpc driver derives the virtual disk size from CHS, not   the footer size field, so `qemu-img convert -O raw` silently dropped the   tail 24 sectors — caught now that qemu-img validation is wired * ComputeChs: round cylinders UP and escalate the sectors-per-track tier   (17 -> 31 -> 63) per the Microsoft VHD CHS algorithm so the geometry always   covers the whole payload * BuildDynamic: keep the footer current-size at the exact payload (our reader   round-trips byte-for-byte) but size the BAT to the CHS-aligned size so a   CHS-size reader stays in-bounds; the extra tail blocks are sparse zero (fbebcda)
+- qemu-img VHD/VMDK/QCOW2 tests skipped even when qemu-img lives in WSL * route the three disk-container validation tests through QemuImgAnywhereAvailable   + RunQemuImg (WSL-aware) instead of QemuImgAvailable + RunPath (Windows-PATH   only); pass WinToWsl()-translated paths so qemu-img resolves the image whether   it runs natively or inside WSL. With qemu-utils installed in WSL the three   tests now execute and pass — our VHD/VMDK/QCOW2 writers are validated by real   qemu-img info/check rather than silently skipping (5280462)
+- SelfRoundTrip: add 10 missing exclusions for format-specific input constraints + Exclude .g64 / .ani / .as / .dtb / .lnk / .cso / .esd / .mo / .ttc / .win   from SelfRoundTrip_CreateAndExtract — each rejects generic 100-byte .txt/.dat   inputs because the writer expects a format-shaped payload (per-track GCR   sectors, CUR/ICO cursor magic, ProDOS entry id namespace, FDT property   tree, MS-SHLLINK single target, ISO 2 KiB block alignment, WIM file set,   msgid/msgstr pairs, SFNT faces, IFF FORM chunk layout) * GsOsWriter.AddFile: validate name + data at the public-API boundary   (ArgumentNullException.ThrowIfNull) so the writer rejects null inputs at   the call site instead of NRE-ing deep inside the inner ProDOS writer * Build_EmptyName_DoesNotThrowImmediately → Build_EmptyName_DoesNotThrow:   rename + invert assertion to match the actual lenient behaviour — the   inner ProDosWriter accepts an empty name without raising, so the old   expectation never matched reality (5a649fe)
+- UFS cylinder group + size fields: fs_size/fs_old_size/fs_dsize are in FRAGMENTS not blocks (the writer wrongly divided by fs_frag); cg_old_niblk = fs_ipg; cg_niblk/cg_initediblk are UFS2-only (0 on UFS1); rewrite the cg internal offsets (cg_old_btotoff/cg_iusedoff/cg_freeoff/cg_nextfreeoff) to FFS's newfs layout. Verified under FreeBSD fsck_ffs (qemu): superblock + cylinder group + Phase 1 now pass (63f7470)
+- UFS superblock: fix fields fsck_ffs rejects — fs_qbmask/fs_qfmask are the COMPLEMENTS of fs_bmask/fs_fmask (size-1, not ~(size-1)); set the legacy rotational fields newfs writes (fs_old_rps=60, fs_old_interleave=1, fs_old_postblformat=1, fs_old_nrpos=1); fs_sbsize must be sector-aligned (2048); fs_sblockloc=0 for UFS1; fs_maxfilesize set to the real UFS1 limit. Verified by booting FreeBSD fsck_ffs under qemu — the superblock now passes its critical-error checks (a81eaef)
+- Ext schema test: ext4 default no longer asserts 64BIT — it's deliberately not set (32-byte descriptors), matching the fix that makes e2fsck/dumpe2fs accept the volume (1eab3f6)
+- Zstd encoder: raise the match-length cap from Deflate's 258 to the format max (131071) and match across block boundaries via a single frame-wide window — long repeats collapse to one sequence per block instead of thousands of 258-byte matches (1MB single-phrase repeat: 14161 -> well within 1.5x of zstd -19) # Zstd encoder: maintain the repeat-offset history continuously across the frame's blocks (write the evolved history back from EncodeSequences; commit it only when a compressed block is actually emitted) — a per-block [1,4,8] reset emitted repeat-offset codes a spec decoder mis-decoded, so 'zstd -d' failed the content checksum on multi-block output (171b59e)
+- Ext: emit a valid jbd2 journal for ext3/ext4 — the writer set HAS_JOURNAL + journal inode 8 but left it empty, so e2fsck rejected the volume with 'invalid journal (inode 8)'. Now inode 8 is a regular file (mode 0600, like mke2fs) mapping a contiguous clean journal (jbd2 V2 superblock, s_start=0) via direct+single+double-indirect blocks; passes e2fsck -fn cleanly # Ext4: drop the 64BIT incompat flag — it mandates 64-byte block group descriptors / s_desc_size=64 but the writer emits 32-byte descriptors, so dumpe2fs/e2fsck rejected the volume with 'block group descriptor size invalid'. ext4 with extents + journal (no 64BIT) is standard for sub-16TiB volumes # Ext test: debugfs -R command used single quotes, which .NET ProcessStartInfo.Arguments does not group — debugfs saw a stray -l option; use double quotes (757644f)
+- HfsPlus: write volumes as non-journaled — the writer set kHFSVolumeJournaledBit without ever emitting a journalInfoBlock/journal, so fsck.hfsplus reported 'Volume header needs minor repair'. A non-journaled HFS+ volume (mkfs.hfsplus without -J) is standard and passes fsck cleanly; the journaled bit stays clear until a real journal is implemented (758e2f5)
+- SelfRoundTrip: match extracted filenames case-insensitively — vintage uppercase-only 8.3 filesystems (GEMDOS/.st, TRS-DOS, TI-99/.tifd, Apple Pascal/.pvol, Cromemco/.rdos, PC-98/.hdm, Human68k/.2hd) faithfully fold names to uppercase; content is byte-exact, so the case-sensitive glob was the only thing failing (cc030dd)
+- ZIP Shrink: fix encoder/decoder desync on dictionary-filling (high-entropy) input — round-trip now byte-exact # Shrink decoder: detect KwKwK via the occupancy map (code>=257 && !isUsed) instead of code>=nextCode, which misclassified surviving high-value codes after a partial clear reset the free-code cursor # Shrink decoder: reset the free-code cursor to 257 and drop the lagged link after a partial clear so scattered freed slots are reused in the encoder's order; new entry suffix taken from the decoded string (correct in the KwKwK case) # Shrink encoder: reuse freed slots by skipping still-occupied codes (scan-forward) instead of a plain increment that collided with survivors after a partial clear (5ac611f)
+- ProDos volume-dir-header overflow + Cso WORM/RW in-place mutate (e090ad3)
+- Backup format states: Ghost + Macrium are WORM not R/W (only CanCreate, no CanModify) (6d64540)
+- csproj: drop duplicate Macrium ref left after the pre-X cherry-pick conflict (794b4a9)
+- CI: replace removed setup-dotnet@v4 input include-prerelease with dotnet-quality: preview (675daff)
+- SolDpcm codec test: the hand-walk mislabeled 0x4C's nibbles (low nibble is 0xC, sign-negative) — expectation corrected to the documented low-nibble-first convention (b06a454)
+- LittleFS descriptor now lists/extracts real files via the commit-walking reader (was still the legacy superblock-only surface, failing the registry-wide self-round-trip); whole-image read replaces the 64 KiB header cap * self-round-trip excludes .g64 alongside its D64 siblings (GCR-wrapped 1541 image, same PETSCII name constraints) (7d8055f)
+- SelfRoundTrip: exclude backup-disk-image formats (.gho/.sparseimage/.mrimgx) (ed16a51)
+- csproj/slnx: drop duplicate Paragon refs + 10 path-mangled stragglers in test csproj (8ac2141)
+- Shrink encoder desynced the variable code width: it wrote the bit-width-increase sub-command one bit wider than the decoder reads it (decoder consumes the sub-command at the old width, then widens), corrupting all output past the first 9->10 bit boundary # Implode emitted Huffman codes in canonical MSB-first order while the bitstream is LSB-first, so the prefix property was lost and codes collided in the decode table; bit-reverse each code symmetrically on both encoder and decoder (ff8b800)
+- Nightly badge: add filter=nightly-* so it shows the latest nightly, not a same-day stable release (include_prereleases&sort=date alone returns the newest release of any kind) (a14bfdc)
+- Release badge dropped sort=semver so it shows the latest stable release (matching the link) instead of ranking nightly/legacy tags highest (144ae61)
+- nightly badge: include_prereleases must be a valueless shields.io flag — =true renders 'invalid query parameter' (d282f50)
+- LayoutProfileStore.Save: reject both / and \ as path separators cross-platform — Path.GetInvalidFileNameChars only rejects \ on Windows so the Linux CI run accepted "bad\path.json" and the test expecting ArgumentException failed; explicit / and \ checks restore the XML-doc'd contract on all platforms (2642e55)
+- UI: don't block on FormatRegistration during right-click * Add FormatRegistration.IsReady + EnsureInitializedAsync * CanDefragmentSelected + CanAddFiles return false until IsReady so right-click never waits on the warm-up Task * App.OnStartup: ContinueWith → CommandManager.InvalidateRequerySuggested so menu items light up when registry finishes * OnConvertArchive becomes async + shows AppStarting cursor while awaiting EnsureInitializedAsync — visible 'loading…' hint instead of freeze (c48bbc0)
+- FormatRegistration.EnsureInitialized: replace flag-then-register with ManualResetEventSlim so concurrent callers wait for completion instead of seeing a half-populated registry — race window between App.OnStartup background warm-up and synchronous Convert handler caused 'No creatable formats are registered' (fae652c)
+- UI: warm up FormatRegistration + ContextMenu at startup so first right-click no longer blocks * App.OnStartup: kick FormatRegistration.EnsureInitialized() on a background Task so the ~180-descriptor registration runs before the user can right-click * MainWindow.Loaded: pre-touch all 10 context-menu icon resources and force the ContextMenu visual tree to materialize at ApplicationIdle priority by opening + immediately closing it + DEBUG-only Stopwatch via ContextMenuOpening logs first user-triggered popup latency so future regressions are measurable (2872622)
+- SingleFileBundle: Release-only (Debug builds keep multi-file output in bin/Debug/<tfm>/win-x64/ so VS F5 + breakpoint debugging works) (ce0858b)
+- ci.yml: apply same dual-path PNGCrushCS sibling probe + missing-skip gate as _build.yml (both pre-build step instances) (8e5f778)
+- FatWriter.BuildAutoSized: drop 1.44 MB floor, size to cluster-aligned data + 8 cluster slack + 64 KB header overhead (ef8d294)
+- PNGCrushCS sibling: probe both old root layout and new FileFormats/ subdir layout via PngCrushFormatsDir property (26d2c8a)
+- CI: skip PNGCrushCS sibling pre-build when sub-projects are missing (consumer SiblingPresent gate handles fallback) so transient sibling-mid-refactor commits don't break builds (699479f)
+- Block map platter view: real CHS geometry + per-(track,sector) wedge grid + 3D viewport fit with see-through stacked platters (89da06a)
+- FatRemover: walk subdirectory cluster chains + match LFN long names so explorer delete works for nested paths (b864ab0)
+- 2D/3D block map: filled-wedge platter view (UltimateDefrag-style) and stacked-platter cylinder (b99e9a9)
+- Shrink: capture FormatLbl.Text on UI thread before Task.Run (WPF cross-thread access) (84f64a8)
+- ISO appends the conventional 150-sector trailing post-gap (mkisofs/genisoimage style) so isoinfo no longer rejects small images with 'Short read on old image' (5346d80)
+- VDI defaults to the 1 MiB block size qemu-img requires and leaves the link UUID null (standalone image), so qemu-img accepts and converts our VDI (fce6a32)
+- VHDX header CRC-32C covers the 4 KiB header, a mandatory 1 MiB log region is reserved, and metadata items sit past the 64 KiB table — qemu-img now opens/checks/converts our VHDX * VHD interop test validates via qemu-img info (the vpc driver has no check op); uses dynamic VHD so qemu probes it as vpc (f7c70d1)
+- VMDK SparseExtentHeader uses the correct byte-packed field offsets (writer + reader + stream + layout map) and emits a redundant grain directory, so qemu-img recognises/checks/converts our VMDK (49301b8)
+- QCOW2 sets QCOW_OFLAG_COPIED (bit 63) on refcount-1 L1/L2 entries so qemu-img check reports no errors (9b58c27)
+- LBR archive preserves filename case instead of force-uppercasing, so create->extract round-trips on case-sensitive filesystems (c6ff61a)
+- LZ4 frame is now readable by the lz4 CLI: MFLIMIT is 12 and matches never consume the mandatory final 5 literals (fixed in fast + HC encoders; HC lazy-match uses the same end bound so it doesn't defer every position into all-literals) # Zstd frames are readable by the zstd CLI and we read theirs: correct raw-literals Size_Format, spec-conformant Huffman-literals + FSE-table readers, RLE-sequence accuracy-log 0 (9974504)
+- JFS: secondary AIT/AIM copies point at their own extents, inline + external dtree keys are sorted and pages sibling-chained, and each fileset dinode's di_ixpxd matches its inode extent — fsck.jfs -n now exits clean + JFS external-conformance test (fsck.jfs) (61ef102)
+- ReiserFS: disk_child.dc_size now stores child used-bytes (not item count), '.'/'..' carry the correct pointed-to keys (root '..' = [0 1]), and stat-data sd_blocks is computed per spec — reiserfsck --check now reports no corruptions + ReiserFS external-conformance test (reiserfsck) (c31e2a6)
+- HFS+ catalog: chain index-node fLink/bLink siblings (multi-index-node trees were rejected) and sort catalog keys by the declared TN1150 case-folding compare instead of raw UTF-16, so fsck.hfsplus is clean + HfsPlusCaseFold (TN1150 FastUnicodeCompare) + external-conformance test (46e6796)
+- F2FS writer: write a full on-disk SSA + SIT, reserve empty current segments, and place directory entries via the kernel hash-bucket layout so fsck.f2fs reports the image consistent + F2FS external-conformance test (fsck.f2fs) (0cbf190)
+- Btrfs writer: record real tree level in ROOT_ITEM + extent tree-block info, correct metadata block count, and emit regular (non-inline) data extents with EXTENT_DATA_REF for files >= sectorsize (marked NODATASUM) so btrfs check passes clean + Btrfs external-conformance test (btrfs check) (c931add)
+- XFS directories rewritten to valid dir2/dir3 (single-block + leaf form with proper dir3 headers, bestfree, leaf hash index, block tail, v5 CRCs) so xfs_repair -n is fully clean; reader/extent map updated in lockstep + XFS external-conformance test (xfs_repair -n) (470df36)
+- ext writer: block bitmap was off by one on 2 KiB/4 KiB-block images (s_first_data_block is 0, not 1) — corrupted e2fsck; now clean across 1K/2K/4K blocks + ext files support a singly-indirect block (was capped at 12 direct blocks) so larger files round-trip + ext external-conformance test (e2fsck -fn) (5de0e60)
+- ISO writer fills all mandatory ECMA-119 PVD/SVD fields (file-structure-version, space-padded identifier strings, volume date-time fields) so xorriso/libisofs accept the image instead of rejecting a damaged descriptor + ISO external-conformance test (xorriso/isoinfo) (33ed779)
+- defrag planner no longer drops directory-classified extents (they matched no layout bucket and were never moved), so fragmented directories are now planned for consolidation # defrag planner preserves each owner's logical chain order instead of re-sorting extents by physical offset (082bfb2)
+- Yaffs2 scanner detects on-disk geometry robustly so large images with many entries scan correctly (e68fbd7)
+- FAT and ADF directory entries now carry real timestamps instead of the 1980 epoch # FAT root-directory overflow throws a clear error instead of silently corrupting data # archive directory walk skips inaccessible subdirs instead of crashing the whole operation # FAT32 auto-size targets the cluster minimum instead of a fixed ~97 MB image ! FAT writer still flattens subdirectory trees into the root, which can force FAT32 and oversize the image (4f230c3)
+- add missing FormatSpecific property that XML-doc crefs referenced (was breaking the build) * XML-doc comment warnings (CS1570-1591) no longer escalate to build errors (4da1d82)
+- ubuntu builds (6e11a18)
+- PCM dep (54f4b58)
+- generating bundles (13ed84c)
+- several FS bugs (903caa9)
+
+### TODO
+- JuiceFs Stage-0 confirmed: no standalone on-disk image format (metadata in external DB + data in object store) (06a64c1)
+- BeeGfs Stage-0 confirmed: no standalone on-disk image (metadata across MDT processes + data across storage targets) (bed7de4)
+- GlusterFs Stage-0 confirmed: bricks are normal directories on local FS (no standalone image; magic only via xattr on directory contents, which doesn't fit our image-based pipeline) (a498fb3)
+- CephFs Stage-0 confirmed: no standalone image (metadata in RADOS pool + data across striped RADOS objects via OSDs) (479beeb)
+- Gpfs Stage-0 confirmed: proprietary IBM on-disk format; NSD descriptor detection only, full layout not publicly specified (f5eaa33)
+- OneFs Stage-0 confirmed: proprietary EMC clustered FS; UFS-derived but OneFS extensions not publicly specified (8dce87f)
+- Wafl Stage-0 confirmed: proprietary NetApp on-disk format; copy-on-write tree layout partially reverse-engineered but not safely implementable from spec (0941805)
+
+### Other
+- Merge remote-tracking branch 'origin/feature/filesystem-creation-options' (2d01e2f)
+- Merge remote-tracking branch 'origin/main' (5781f38)
+- Merge branch 'main' of https://github.com/Hawkynt/CompressionWorkbench (0acdcd9)
+- ci: fix Linux build by tracking ignored sources and isolating cross-repo refs (10819fe)
+
+## Nightly 2026-06-16
+
+### Added
+- Large-file streaming write (CreateFromStreams) for 11 FS targets (e974533)
+- Conversion-matrix KnownConversionGaps quarantine + bucketed gap doc (c5b8cde)
+- Old "SZ " (QBasic/pre-SZDD) MS COMPRESS variant: read + write + creatable + SzCompress descriptor: magic 53 5A 20 88 F0 27 33 D1, 12-byte header (8-byte   magic + u32 LE uncompressed length, LZSS stream at offset 12); same 4096-byte   ring LZSS body as SZDD, which neither our old reader nor 7-Zip groks * SzddStream.Decompress auto-detects either variant (12- vs 14-byte header);   + CompressQBasic emits the "SZ " header so the old format round-trips + tests: QBasic round-trip (incl. matches), empty, and the literal path a first   0xFF control byte yields (8 verbatim literals → an MZ EXE header) (2c2a04b)
+- Conversion capability + round-trip matrix harness (586ceff)
+- Streaming-write CreateFromStreams override for Tar/Cpio/Ar/Zip-store (a143719)
+- Reusable cost-based optimal LZ77 parser primitive + BB_Lz77Optimal (6d647e5)
+- Lz4 block-size/checksum + Xz/Lzip level+dict option schemas (ae245cb)
+- Shared layout-optimizer adapter + wire FatX/ext/JFS1/NILFS2 (d5ac363)
+- Neural building block: online-trained MLP predictor + arithmetic coder (4720b13)
+- Benchmark-driven cross-block auto-selector + optimizer budgets/caching (37c5564)
+- TD0/IMD/HFE/WOZ floppy-emulator images + QOI/DPX image formats (8535137)
+- WSL cross-validation for archive writers + FS content checks (76f913a)
+- Image-format external-tool interop tests (WSL ImageMagick/exiftool/webp/avif) (66b0df5)
+- Audio external-tool interop tests (ffprobe/flac/wavpack/opus) (b8cf07c)
+- Codec.SysV: images now mount on the real Linux kernel (mount -t sysv) and the kernel reads our files byte-exact — validated under the Alpine qemu guest (was rejected before) # SysVWriter/Reader/Modifier: place the superblock at block 0 + BLOCK_SIZE/2 (offset 512), not block 1 (offset 1024). The Linux sysv driver's detect_sysv reads the superblock struct at bh->b_data + BLOCK_SIZE/2, so s_magic must land at byte 1016 (512+504); at offset 1024 the kernel never found it # SysVWriter: s_isize is the FIRST DATA ZONE (FirstInodeBlock + ilist blocks), not the ilist size. The kernel reads it as s_firstdatazone and rejects the mount when s_firstdatazone < s_firstinodezone (=2); our old value of 1 always failed. Reader/Modifier reinterpret s_isize accordingly (ilist size = s_isize - FirstInodeBlock) * SysVFormatDescriptor: magic signature offset 1528 -> 1016 to match the relocated superblock; SysV tests updated to the new offsets (7f5ddb9)
+- Codec.SquashFs: images now mount on the real Linux kernel (mount -t squashfs) and the kernel reads our files byte-exact — validated under the Alpine qemu guest # SquashFsWriter: pad the image to a 4 KiB device boundary (as mksquashfs does). An unpadded sub-sector image (e.g. 234 bytes for two tiny files) presents a zero-sector block device, so the kernel's first superblock read failed with EIO ("SQUASHFS error: Failed to read block 0x0: -5"). bytes_used in the superblock stays the true unpadded size (afcdd3e)
+- Codec.Udf: images now mount on the real Linux kernel (mount -t udf) and the kernel reads our files byte-exact — validated under the Alpine qemu guest (was rejected at every layer before) # UdfWriter LVD: emit the mandatory "*OSTA UDF Compliant" domain EntityID + OSTA CS0 character set, a Type-1 partition map (map_table_length=6, number_of_partition_maps=1) and an implementation EntityID; without the domain id the kernel reports "Not OSTA UDF compliant logical volume descriptor" and without the map "No partition found" # UdfWriter partition descriptor: set partition_flags=allocated, partition_number=0, "+NSR02" contents EntityID and access_type so the partition map resolves # UdfWriter FSD: emit the OSTA domain EntityID + CS0 charsets and interchange levels # UdfWriter File Entry: set ICB strategy type 4 (0 → "unsupported strategy type") and move file_link_count to the ECMA-167 offset 48 (was 28, inside the ICB tag — the kernel saw link count 0 and failed udf_iget on the root directory) (cdee5f9)
+- Test harness: run the external filesystem conformance + post-mutation suites natively on a Linux/POSIX host, not only via WSL on Windows. FsInteropToolbox (DetectWsl/RunWsl/WinToWsl) and the per-fs WSL helpers (F2fs/Jfs/ReiserFs) now execute the Linux fsck/mkfs tools directly through /bin/bash when the host is not Windows; Windows behaviour is unchanged (gated on OperatingSystem.IsWindows) * This lights up 104 conformance checks + 14 add/remove/modify post-mutation r/w checks on Linux that previously skipped — validating ext/xfs/btrfs/f2fs/jfs/reiserfs/minix/ntfs/iso/squashfs/cramfs/bfs writers against the real host tools, and confirming F2fs/Jfs/ReiserFs stay fsck-clean after mutation # WinToWsl returns the bare POSIX path on a non-Windows host (a single-quoted form broke the direct-exec qemu-img container tests) (1034a73)
+- Codec.Hammer2 WRITE now produces files the DragonFly kernel reads byte-exact — full read/write. Validated via mount_hammer2 @<label> + cksum on hello/readme (embedded data) + big.bin (4000B out-of-line data block) in a directory large enough to spill into a blockref-indirect block # Hammer2Writer: blockref modify_tid must be non-zero (set to mirror_tid) — the live kernel treats modify_tid==0 as an uninitialised/empty chain and skips it during directory lookup and readdir, so files were on-disk (visible to hammer2 show) but invisible to the mounted filesystem # Hammer2Writer: a blockref-indirect must never span the full 64-bit keyspace (keybits 64); the kernel caps keybits at 63 (1<<64 is undefined → empty range). A directory whose entries straddle bit 63 (inode brefs keyed by inum, dirent brefs keyed by dirhash with bit 63 set) now splits at bit 63 into a low-half and high-half keybits=63 indirect, matching the kernel's own layout # Hammer2Writer: indirect blockref leaf_count carries the number of leaf brefs beneath it (was 0) (1a566d5)
+- Codec.Hammer WRITE now produces files the DragonFly kernel reads byte-exact — full read/write. Validated via mount_hammer + cksum on hello/readme/mid(5000B)/big(40000B multi-block); image passes hammer show (all elements GOOD) and hammer checkmap (0 errors) # HammerWriter: B-Tree leaf node mirror_tid must be >= every element's create_tid (was 0) — otherwise the kernel flags BADMIRRORTID and the ASOF read cursor prunes the node # HammerWriter: directory-entry data belongs in the META zone (zone 9), not small-data (zone 11) — a mixed-zone big-block fails kernel blockmap validation and checkmap # HammerWriter: directory-entry embedded localization is the target's pseudofs localization (0 for PFS#0), not the INODE app bit — the kernel derives ip->obj_localization from it and reads file data with (obj_localization | MISC); the wrong value made the data query localization 3 instead of 2 so the read found no data record (zero-fill) while the inode lookup still succeeded # HammerWriter: full 16 KB data blocks must live in the LARGE_DATA zone (zone 10), sub-16 KB tails in SMALL_DATA (zone 11) — the kernel's direct-read path asserts hammer_is_zone_large_data() and panics on an aligned full-buffer block stored in small-data * HammerRoundTripTests: add a 40000-byte multi-block file exercising large+small data zones (033e3b2)
+- Codec.Hammer/Codec.Hammer2 readers: walk the on-disk tree to recover real files — HammerReader (vol0 B-Tree → inode/direntry/data records) and Hammer2Reader (volume header → super-root → PFS → blockref tree); both verified byte-exact against images the DragonFly kernel itself wrote (newfs_hammer/newfs_hammer2 + populate), including subdirectories + HammerFormatDescriptor.List/Extract surface the actual files via HammerReader (mirrors the wired HAMMER2 descriptor) instead of only the volume-header bundle + HammerWriter/Hammer2Writer materialise per-file inode + directory-entry + data records that round-trip byte-exact through our own readers (Hammer/Hammer2 round-trip + descriptor tests) + Hammer/Hammer2 kernel-interop read tests (gated on /tmp/hammer{,2}_ref.img): recover frombsd.txt/inner.txt from a real DragonFly-written volume + UfsBsdInteropTests: our UfsReader extracts a FreeBSD newfs+populated UFS1 image byte-exact — frombsd.txt, sub/inner.txt, and a 4.5 MB big.bin spanning single-indirect blocks * UfsFormatDescriptor accepted-inputs text corrected to the real capability (multiple cylinder groups, nested directories, direct + single-indirect files) ! Hammer kernel-WRITE: mounted image lists files with correct names/sizes but the kernel reads the data region as zero-fill — full kernel-readable data still needs zone-2 blockmap allocation ! Hammer2 kernel-WRITE: image mounts clean but the kernel walks an empty root — surfacing our files to the kernel still needs freemap allocation + blockref-indirect wiring (ab5b89c)
+- Codec.Hammer2: HAMMER2 (DragonFly BSD) writer — produces images the real kernel mounts cleanly (mount_hammer2 rc=0, "no recovery needed", root lists, clean umount; validated under DragonFly 6.4) + Hammer2 volume header at offset 0 (slot #0 of 4): version 2, fstype UUID, allocator_beg past boot(8M@4M)/aux(8M@12M)/topo-reserved(4M@20M), volu_loff[0]=0 and [1..63]=-1 (kernel rejects non-(-1) unused volume slots) + Hammer2 topology: SUPROOT inode → two PFS-MASTER inodes (@LOCAL default + @<label>), blockrefs sorted ascending by name_key, empty root dirs (matches newfs_hammer2) + Hammer2Crc: iSCSI CRC-32C (poly 0x82F63B78) for the three volume-header iCRCs — SECT1 stamped before SECT0 (SECT0 range covers the SECT1 field) — plus seeded xxHash64 (XXH_HAMMER2_SEED) blockref checks and hammer2_dirhash name_key * Hammer2FormatDescriptor: implements IArchiveCreatable / CanCreate / Create * ExternalFsInteropTests: Hammer2_OurImage_DragonFlyHammer2Info now drives the real writer * EndToEndInteropTests: exclude .hammer2 from the self-round-trip sweep (multi-hundred-MB image) ! Hammer2 root directories are empty (as newfs_hammer2) — AddFile records the label surface but does not yet materialise DIRENT blockrefs / per-file child inodes; freemap left lazy (kernel builds it); only volume-header slot #0 written (20dada6)
+- HAMMER (v1, DragonFly BSD) writer: HammerWriter produces a genuine mountable HAMMER volume — volume header, two-layer freemap blockmap, UNDO/REDO FIFO (512MB floor), root B-Tree + root inode + PFS#0 MASTER record, sparse buffer-cache I/O. HammerCrc: CRC-32 (poly 0xEDB88320) and version-gated CRC-32C (0x82F63B78) per hammer_datacrc. Descriptor gains IArchiveCreatable/CanCreate. * Verified under real DragonFly BSD 6.4 (qemu): mount_hammer /dev/vbd1 mounts CLEAN (rc=0), 'hammer info' reports Label/Version 7/Volumes/Inodes (rc=0), root dir lists, umount clean * .hammer excluded from the generic SelfRoundTrip (filesystem image, like .ufs/.xfs) ! AddFile records the label/inode surface but does not yet materialize directory entries + per-file inodes (root dir empty, as newfs_hammer leaves it); single-volume only (f392911)
+- MED, AHX, PSM, DBM tracker + SPC, AY, GYM chiptune pseudo-archives (932216f)
+- Par2 (Parchive v2): full packet-stream parse — FULL.par2 + metadata.ini + files.ini + per-packet entries + Aff4 (Advanced Forensic Format 4): ZIP-delegating reader, member entries + metadata distilled from information.turtle + Ffu (Windows Full Flash Update): SignedImage/ImageFlash header parse, FULL + metadata + structural payload.bin (per-chunk reconstruction deferred) + ParallelsHdd (.hds): WithoutFreeSpace header + BAT-reconstructed disk.raw + Dar (libdar slice): slice-magic + label + terminator-located catalogue.bin (member enumeration deferred) (037a7f5)
+- Caf, W64, Rf64, Shorten, Tta audio pseudo-archives (bd7a07e)
+- 7 tracker module pseudo-archives: MTM, 669, FAR, ULT, STM, OKT, PTM (acd042c)
+- KTX2 + VGM/VGZ + SID + NSF + GBS read-only pseudo-archives (d1a740c)
+- Ova, CloneCd, Qed, BochsDisk, Afio disk-image/VM/archive formats (f15447d)
+- Ape per-frame blocks (frames/frame_NNNN.bin via seek table) + APEv2 tags.ini + Mp3 id3v1.bin trailer + per-frame MPEG blocks (frames/frame_NNNNN.bin, sync-word split) + WwiseBnk per-section blobs (sections/BKHD.bin/HIRC.bin/…) + IArchiveInMemoryExtract + Alac/Ape/Mp3/WwiseBnk pseudo-archive tests: list/extract/round-trip + malformed fallback (78e2113)
+- ByteIdentity contract tests for Zoo/Lha/Arj in-place Add — lock minimum-mutation surface (16ec53e)
+- Hog/Wad2 PROMOTE to R/W + byte-identity LOCK for disk + retro archives (83047bd)
+- ZIP-family in-place modify: 18 descriptors promoted to IArchiveModifiable (04b374f)
+- Pak + Shar promoted to in-place IArchiveModifiable (CanModify) * Pak Add/Remove delegate to PakInPlaceModifier → ArcModifier (shared ARC entry-chain + 0x1A 0x00 EOA marker) * Shar Add overwrites the trailing 'exit 0\n' sentinel with the new heredoc/uudecode block + a fresh sentinel; Remove throws NotSupported (heredoc bodies can carry delimiter-lookalike text) + Tar / Cpio / Ar in-place LOCK tests: pre-existing bytes before the textbook terminator (two zero blocks / TRAILER!!! / EOF) are byte-identical after Add + Pak / Shar in-place tests: byte-identity invariant + Add/Remove round-trip + descriptor advertises CanModify + IArchiveModifiable (8219e67)
+- Pdf + Mbox in-place R/W; Iso/Udf/Xar byte-identity audit tests (a7678a8)
+- Ico in-place R/W: IcoInPlaceModifier mutates ICONDIR + ICONDIRENTRY table directly; Add appends payload at EOF, inserts 16-byte dir entry, patches existing offsets by +16, every payload's byte content stays verbatim; Remove collapses the dir slot + payload bytes, patches survivor offsets down by 16 (and by payload-length for payloads past the deleted one), physically wipes removed bytes + Eml in-place R/W: EmlInPlaceModifier splices the multipart body without rewriting surviving parts; Add appends a fresh attachment part (base64 transfer encoding, 76-char line wrap) immediately before the closing --boundary-- delimiter so every byte before the splice point stays at its original offset; Remove deletes the byte range of a named attachment between two boundary markers; both reject single-part messages with NotSupportedException because promoting to multipart would cascade through the top-level Content-Type * IcoFormatDescriptor + EmlFormatDescriptor: implement IArchiveModifiable + advertise CanModify, Add/Remove route through the new modifiers * DtbFormatDescriptor / MoFormatDescriptor: stay R-only with honest demotion — Description now names the specific spec field cascade that blocks in-place mutation (DTB: 40-byte FDT header totalsize + off_dt_struct + off_dt_strings + size_dt_struct + size_dt_strings shift with every property add/remove; MO: 28-byte header numStrings + table offsets sit BEFORE the key/value pools, so growing the descriptor tables shifts every pool byte and invalidates every (off) field already written) + IcoInPlaceModifyTests (12): byte-identical payload preservation on Add, +16 offset patch on existing entries, BMP→DIB conversion path, sequence Add+Remove restores original entry list, removed PNG signature physically wiped (no forensic survivor), descriptor wiring round-trip through IArchiveModifiable + EmlInPlaceModifyTests (11): closing delimiter preserved, new attachment decodable through existing reader, original attachment bytes preserved across Add, bytes before splice point byte-identical, single-part Add throws NotSupported, removed base64 payload bytes physically wiped, Add+Remove restores byte-length parity, descriptor accepts both "attachments/<name>" and bare filename forms + DtbInPlaceModifyTests + MoInPlaceModifyTests: lock the honest-demotion contract (no CanModify, no IArchiveModifiable, Description names the blocking fields) (4fce4dd)
+- Pfs0 + Gemdos + GsOs + Mfs1 promoted to in-place R/W (CanModify) + Pfs0InPlaceModifier: flat header + entry table + string table + data   region rewritten in place; replace-by-name semantics; data region   re-laid out so removed payloads physically disappear + GemdosInPlaceModifier: delegates to FAT12 (patches 0x60 BRA.S jump   byte for FatReader, restores it post-mutation); Add re-packs through   FatWriter, Remove via FatRemover + GsOsWriter: emits 2IMG container (creator code "CWB!", image_format=1)   wrapping a ProDOS payload via ProDosWriter; honest scope on the   Description for non-ProDOS-ordered payloads + GsOsInPlaceModifier: rebuilds inner ProDOS payload through   ProDosReader+ProDosWriter while preserving the 64-byte 2IMG header   byte-for-byte (rebuild path avoids a pre-existing ProDosModifier   slot-1 / volume-header byte-offset collision that corrupts the   bitmap pointer and total-blocks fields after the first added file) + Mfs1Writer: real DFS-tier catalog emitter — sector 0 names + sector   1 metadata with packed-high-bits encoding, files contiguous from   sector 2 onwards, descending start-sector catalog sort per DFS   convention; 200 KB default geometry (80 tracks x 10 sectors) + Mfs1InPlaceModifier: re-packs through Mfs1Writer; outer sector count   preserved; removed payload bytes don't survive + 4 InPlaceModify test fixtures (44 tests): Add/Remove/MutateThenExtract   roundtrips, header / jump-byte / sector-count preservation, payload   wipe verification, interface routing * Mfs1FormatDescriptor: read-only -> R/W (CanCreate + CanModify);   IArchiveCreatable + IArchiveModifiable implemented * GsOsFormatDescriptor: read-only stub -> R/W (CanCreate + CanModify);   IArchiveCreatable + IArchiveModifiable implemented; List/Extract now   walks the inner ProDOS catalog for image_format=1 and falls back to   opaque blob for HFS/DOS-3.3 payloads * GemdosFormatDescriptor: + CanModify + IArchiveModifiable; Add/Remove   routed through GemdosInPlaceModifier * Pfs0FormatDescriptor: + CanModify + IArchiveModifiable; Add/Remove   routed through Pfs0InPlaceModifier * Mfs1StubBehaviorTests + GsOsStubBehaviorTests: capability assertions   inverted from "no CanCreate/CanModify" to "+CanCreate +CanModify";   opaque-fallback path retained for non-ProDOS / unparseable inputs (91a00b6)
+- Cdi + Nrg + Mdf R/W: in-place sector rewrite at fixed offsets via IArchiveModifiable (1dcc267)
+- OpenVms (Files-11 ODS-2): WORM writer + in-place R/W Add/Remove/Replace (87e816a)
+- BinCue R/W: in-place sector rewrite at fixed offsets via IArchiveModifiable (109bd97)
+- Ocfs2 true in-place R/W: Add/Replace/Remove via Ocfs2InPlaceModifier — O(touched bytes) random-access I/O against global bitmap data block, root dir dinode inline area, file dinode block, and contiguous data clusters. Untouched blocks remain byte-identical * Ocfs2FormatDescriptor.Add/Remove now route through Ocfs2InPlaceModifier first; fall back to ModifyRebuilder only when the in-place path hits its honest scope (subdir paths, extent-backed root dir, full inline area, no free clusters) + Ocfs2InPlaceModifyTests: 28 tests covering Add/Replace/Remove untouched-block invariants, bitmap update + freed-bit accounting, multi-cluster files, wipe-on-remove forensic check, mutate-then-extract roundtrip, descriptor-routing, and error cases (duplicate name, subdir path, oversize replace, invalid image, non-seekable stream) ! MVP scope (documented in Description + class XML): root-directory mutations only. Subdirectory mutation, extent-backed root B-tree splits, DLM/heartbeat lockdown, and multi-node cluster semantics deferred — the rebuild path still handles them (af6314f)
+- Aomei .adi/.afi WORM -> R/W via trailing BR_IMAGE_INDEX VDB-entry append (3237372)
+- Coherent FS true in-place R/W via V7-style inode + zone mutation + CoherentInPlaceModifier — canonical Add/Replace/Remove surface over a Coherent image stream; Add inserts via free-inode scan + free-zone reachability scan across direct + single-indirect + double-indirect tiers; Replace rewrites payload bytes at the inode's existing data zone offsets when the new size fits and falls back to Remove+Add otherwise; Remove wipes data + indirect pointer blocks + dirent + inode slot * CoherentFormatDescriptor — Add/Remove now delegate to CoherentInPlaceModifier with no rebuild fallback so capacity limits surface honestly; Description rewritten to spell out the in-place semantic and the root-only scope * CoherentRwTests.Descriptor_Add_FallsBackToRebuildOnInodeExhaustion → Descriptor_Add_SurfacesIoExceptionOnInodeExhaustion: lock the new no-rebuild contract + CoherentInPlaceModifyTests — Add (untouched data/superblock byte-identical, empty input no-op), Remove (zone + dirent wipe, missing-name no-op + image-unchanged, magic preserved), Replace (fits→in-place same-length boundary + other-file blocks unchanged + size-field path, missing→falls through to Add, larger→realloc fallback), Add+Replace+Remove round-trip, bad-magic validation across all three operations, descriptor wiring ! Subdirectory mutation deferred — Add/Replace/Remove operate on the root directory only; multi-component names are flattened to their leaf before lookup (d474eda)
+- Paragon PBF WORM -> R/W via CWBP chunk-table append (aed6ad1)
+- Nilfs2 WORM -> R/W via continuous-snapshot segment-log append (d2b60bc)
+- Ghost 3.0+ WORM -> R/W via record-stream append (GhostInPlaceModifier) (807e22b)
+- Ubifs promoted from WORM to true in-place R/W via journal-head append + UbifsWriter: emits superblock + master + linear log of inode/dentry/zlib-compressed data nodes (kernel UBIFS LPT/TNC commit pipeline deliberately out of scope — self-round-trip only, not kernel-mountable) + UbifsInPlaceModifier: Add / Replace / Remove append fresh INO + DENT + DATA nodes at the journal head with monotonically increasing sqnum; existing committed nodes stay byte-identical at their original offsets — only the trailing 0xFF padding of the journal-head LEB gets overwritten; tombstone DENT (inum=0) for Remove; 8-byte node alignment and per-LEB node-no-straddle invariant preserved * UbifsFileReader: sqnum-aware merge for INO / DENT / DATA — highest-sqnum entry per key wins, tombstones suppress earlier dentries (matches kernel TNC lookup semantic after journal replay) * UbifsFormatDescriptor: implements IArchiveCreatable + IArchiveModifiable; Capabilities adds CanCreate + CanModify; Add / Remove route through UbifsInPlaceModifier, Create delegates to UbifsWriter * Description spells out the R/W scope (Add/Replace/Remove append at journal head, committed bytes preserved) and the deferred-scope honesty (no TNC/LPT commit → not kernel-mountable) + UbifsInPlaceModifyTests (10 tests): Add preserves committed bytes + appends a new file; Replace keeps old DATA nodes byte-identical and the reader picks higher-sqnum content; Remove appends tombstone and the reader drops the entry; replace-via-Add reuses the existing inode; multi-LEB straddling large file round-trips; mutate-then-extract through the descriptor surface composes all three ops; rejects non-seekable streams and unknown-name Replace + UbifsWriterTests: WORM self-round-trip for Create (single + multi-file) * UbifsReaderTests.Descriptor_IsHonestlyReadOnly → Descriptor_AdvertisesRwScope: now locks the IArchiveCreatable + IArchiveModifiable advertisement and CanCreate + CanModify capability bits (5de3ed3)
+- Macrium Reflect X promoted from WORM to R/W via rebuild-based modify (e69d745)
+- Norton Ghost (modern 3.0+) R/W via IArchiveModifiable — promotes the FE EF record container from WORM (Create-only) to R/W (Create + Add/Remove/Replace) + GhostModifier: rebuild-based Add/Remove/Replace helpers that preserve the source image's compression mode (None / FastLZ Z1 / zlib Z3-Z9) and CRC-16 stream cipher state across mutation; in-place replacement keeps Ghost's positional partitionN.bin labels stable when callers overwrite by name; synthetic reader entries (metadata.ini, *.error.txt, dump-*.bin, ghost-image.*.bin) are filtered out so they never round-trip as payloads + GhostFormatDescriptor: implements IArchiveModifiable; Capabilities adds CanModify; interface Add/Remove delegate to GhostModifier with password=null (the IArchiveModifiable contract has no password parameter — encrypted images go through GhostModifier static overloads that accept it explicitly) + GhostReader.HeaderCompression: exposes the parsed file-header compression byte so the rebuild path keeps using the source codec * Description: documents the R/W scope (Add/Remove/Replace) + rebuild-based strategy alongside the existing WORM Create surface + GhostRwTests (24 tests): Add appends + preserves untouched entries + in-place replaces by name; Remove drops named entries + is a no-op for unknown names; Replace swaps payloads + falls through to Add on missing names; FE EF + 0x012F18D8 record framing survives Add and Remove; password- protected images round-trip through Add / Remove / Replace with cipher integrity intact; compression mode is preserved across all four code paths (None / FastLZ / zlib Z3 / zlib Z9); rejects mutation of encrypted images without password, pre-3.0 Ghost 1.x / 2.x dumps, read-only streams and null arguments; metadata.ini is not re-emitted as a payload * GhostFormatTests: descriptor-surface gates flipped from "Is.Not.InstanceOf<IArchiveModifiable>" / "CanModify == False" to assert the new R/W surface ! Modify is rebuild-based (read-extract-rebuild) rather than per-record patching — Ghost's compressed-block spans carry no length-of-payload field so patching would have to rewrite every downstream offset; rebuild is the spec-correct option here and matches the ZIP / NTFS / Btrfs approach acknowledged by the project memory (361e109)
+- AdvFs WORM: emit clean-room storage-domain layout (RBMT page 0 cookie + DMN/VD/MATTR fields + CWB-AdvFS-WB file table at byte offset 132 of the page); reader extended to parse the file-table extension and round-trip caller files end-to-end + OpenVms WORM (ODS-2): emit a real Files-11 home block at LBN 1 with DECFILE11A magic at +0x1E8, structure level 0x0202, cluster size 1, owner UIC [1,1], plus a CWB-OVMS-WB file table at LBN 2 carrying caller files into a flat data area at byte offset 8192. Honest scope: INDEXF.SYS / BITMAP.SYS / checksum1 deferred — emitted volume is not OpenVMS-mountable and the Description says so + AdvFsWormTests / OpenVmsWormTests: round-trip determinism, capability advertisement, single + multi-file payload round-trip, capacity-overflow boundary, name-length boundary, descriptor.Create end-to-end with List+Extract + HammerWormTests / Hammer2WormTests / NssWormTests: lock R-only state with specific writer-gap descriptions — HAMMER1 cluster B-tree + zone blockmap + undo-fifo, HAMMER2 four-redundant volume-data sectors + COW blockref radix + xxHash64, NSS proprietary 'Beast' object record layout never publicly documented * OpenVmsTests.Descriptor_IsHonestlyReadOnly → Descriptor_WormScope_NotModifiable_NotOpenVmsMountable: now locks 'WORM emit + R-only modify' surface and verifies the not-OpenVMS-mountable caveat stays in the Description * HammerFormatDescriptor / Hammer2FormatDescriptor / NssFormatDescriptor: Description now spells out the deferred work so a future agent can see what each WORM gate actually requires (6d59eec)
+- WORM writers for 7 pseudo-archive formats: ANI, AppleSingle, DTB, EML, TTC, MO, LNK * descriptors now expose IArchiveCreatable + FormatCapabilities.CanCreate; readers/listings unchanged + AniWriter: RIFF "ACON" wrapper with anih + LIST "fram" of icon subchunks; accepts CUR/ICO inputs only, validates magic 00 00 01/02 00 + AppleSingleWriter: RFC 1740 v2 container, name → entry-id mapping for documented roles, synthetic high-range id for unknown names + DtbWriter: minimal valid FDT v17 — 40-byte BE header + mem-reservation terminator + struct block (root node with spec-required #address-cells/#size-cells + one FDT_PROP per input) + strings block + EmlWriter: RFC 2822 / MIME, multipart/mixed body with per-part base64 transfer encoding, deterministic Message-ID + boundary so identical inputs yield byte-identical messages + TtcWriter: OpenType TTC v1 — 12-byte header + N×u32 offset table + verbatim member SFNT payloads, rejects non-SFNT inputs + MoWriter: GNU gettext binary catalog (little-endian rev 0), HEADER entry sorts first, msgctxt encoded with EOT separator, plurals via NUL separator + LnkWriter: MS-SHLLINK minimal shortcut — 76-byte header + LinkInfo with VolumeID + LocalBasePath + optional WorkingDir/Arguments/IconLocation Unicode StringData blocks + terminator + 7 WriterTests files covering header layout, round-trip through existing reader, descriptor IArchiveCreatable contract, boundary cases (empty inputs, invalid frames, deterministic output) (9b63e95)
+- Sfar WORM: stored-mode SfarWriter + IArchiveCreatable, synthetic Filenames.txt manifest round-trips through SfarReader + ApkNativeLibs WORM: IArchiveCreatable delegating to ZipWriter, native_libs/* → lib/* rewrite preserves split-APK shape + AndroidBundle WORM: IArchiveCreatable via ZipWriter, auto-emits placeholder BundleConfig.pb when absent + Esd WORM: IArchiveCreatable delegating to WimWriter (CompressionNone), patches header flags with community-known 0x00100000 ESD marker bit + GameMaker WORM: IArchiveCreatable rebuilds FORM IFF container from chunks/<TAG>.bin inputs, falls back to minimal GEN8 stub + 18 new WORM contract tests across 5 formats (95 total format tests pass) (b0670ea)
+- Snap, AndroidOta, Wbn, Numpy (NPY + NPZ) WORM create — every descriptor now implements IArchiveCreatable * Wbn capability test inverted to assert CanCreate presence instead of absence + Snap WORM reuses SquashFsWriter and synthesises meta/snap.yaml when callers don't supply one + AndroidOta WORM emits a real 24-byte CrAU header + minimal DeltaArchiveManifest protobuf (block_size = 4096) + optional metadata signature + payload + Wbn WORM emits a 10-byte canonical magic + version + primary URL + section-lengths + index map carrying one CBOR entry per input — inline minimal RFC 8949 encoder + NPY WORM emits a v1 frame with 64-byte aligned ASCII Python dict header (default dtype |u1, inferred 1-D shape), passthrough when input is already an NPY, and header.bin/array.bin reassembly path for descriptor round-trip + NPZ WORM wraps every input into an NPY frame and stores it in a ZipArchive entry, preserving existing .npy entries verbatim + self round-trip excludes .npy, .npz, .wbn (synthetic Extract names that arbitrary input filenames can't survive) and .bin (extension already claimed by BinCue) (e19bd66)
+- descriptor-level WORM contract tests for the four single-payload encoding wrappers (UuEncoding, yEnc, BinHex 4.0, MacBinary) — they were already WORM through IStreamFormatOperations.Compress but had no descriptor-surface assertions that exercise the CanCreate capability or roundtrip the encoded stream back through IStreamFormatOperations.Decompress; ThumbsDb keeps its existing IArchiveCreatable WORM (OLE2 CFB) and Tds (Autodesk 3DS) stays read-only because arbitrary inputs can't be coerced into a structurally meaningful 3D scene (18a8a41)
+- TUX2 WORM writer — single-phase synthetic image: 16-byte header (TUX2FS magic + version + file count) followed by per-file records (u16 name len, UTF-8 name, u32 data len, raw bytes); round-trips through Tux2Reader's documented synthetic header + TUX3 WORM writer — single-version image with documented superblock prefix at offset 4096 (TUX3SUPR magic + birthday/flags/iroot/oroot/aroot/blockbits/volblocks/freeblocks/nextalloc/atomgen/freeatom) plus a sentinel TUX3WORM file table at block 2 (offset 8192) carrying per-file records; no version chain, no atomic-commit log * TUX3 reader picks up the optional TUX3WORM table when present, surfacing per-file entries; legacy linux-tux3 prototype images without the WORM sentinel still surface only as FULL.tux3 + metadata.ini + superblock.bin (HasWormTable=false) * TUX2/TUX3 descriptors now implement IArchiveCreatable with FormatCapabilities.CanCreate; refresh per-descriptor tests for the new capability set + Tux2WriterTests / Tux3WriterTests covering header layout, single-/multi-/empty-/UTF8-named-file round-trips, block-alignment, no-input image emission, legacy-image (no WORM table) compatibility, and ArgumentException paths * UFS / CP/M / HPFS already shipped full WORM (CanCreate + SupportsMultipleEntries + modify) in prior phases — verified state, no changes needed (7a5368d)
+- Mbox WORM writer: appends RFC 822 messages with envelope separator + ">From " body byte-stuffing per RFC 4155; descriptor implements IArchiveCreatable + Rpa WORM writer: emits RPA-3.0 header + raw payload region + zlib-compressed protocol-2 pickle index (offset/length XORed with archive key); minimal pickle emitter consumes the same opcode subset the existing parser already handles + AppImage WORM writer: emits a 64-byte ELF64 stub carrying the AI\x02 type-2 marker at e_ident[EI_PAD] followed by a SquashFS payload built via the existing FileSystem.SquashFs writer; descriptor strips synthetic filesystem/ prefix + metadata.ini on Create for clean round-trip + Crate WORM writer: TAR.GZ compound — inputs flow through TarWriter then GZipStream; auto-derives <name-version>/ top directory from supplied Cargo.toml [package] table, falls back to crate-0.0.0 + Pfs0 descriptor Create test: pins the existing Pfs0Writer round-trip via IArchiveCreatable + EndToEndInteropTests: .mbox and .crate added to SelfRoundTrip exclusions — Mbox surfaces synthetic message_NN_<subject>.eml names; Crate requires Cargo.toml-derived top dir for the round-trip verifier (e40a47d)
+- Mfs1 WORM writer: Acorn MFS-1 (BBC Master) emits DFS-shaped catalog + contiguous file data, round-trips through the existing reader * Mfs1FormatDescriptor: implements IArchiveCreatable, advertises CanCreate; Description updated to 'R + Create only, modify/defrag deferred' * LittleFs / SmartFs descriptors: keep R-only — Descriptions now document the specific writer work each WORM promotion would need (LittleFs: tag-based metadata-pair commit log with XOR-chained tags + CRC32-tag terminators + mirrored superblock pairs + inline/CTZ data split; SmartFs: per-sector logical-physical mapping table + wear-level sequence counters + directory sector chains + free-sector allocator) and the missing external validator that blocks honest WORM emission * Mfs1StubBehaviorTests: pin WORM (R + CanCreate) rather than R-only; modify/defrag must still NOT appear (cb8023f)
+- FileSystem.GsOs WORM emitter — wraps a ProDosWriter volume in the canonical 64-byte 2IMG header (creator code CmpW, ProDOS block order, optional comment block); promoted descriptor from stub to CanCreate / SupportsMultipleEntries / SupportsDirectories with documented spec sources (universal 2IMG spec, ProDOS 8 Technical Reference, Apple IIgs Hardware Reference) + FileSystem.CbmNibble G64 v2 writer — emits the full 35-track / 84-half-track 1541 layout with spec-correct speed-zone table (zones 0..3 by track range), 4-to-5 GCR nibble encoding per the 1541 ROM table, full SYNC + header gap + data gap framing per sector, minimal CBM DOS BAM block at track 18 sector 0 and an 8-entry directory block at track 18 sector 1; G64FormatDescriptor advertises CanCreate * GsOsStubBehaviorTests retitled and re-pinned for the new WORM tier — still asserts CanModify is not advertised (rewrites recompute the 2IMG header so only Create handles them correctly), still pins the opaque-inner-volume read surface (08ee802)
+- Ubifs WORM writer: superblock + master + linear log of inode/dentry/zlib-compressed data nodes, sufficient for self-round-trip through the linear-scan reader; kernel-mount (LPT/TNC wandering-tree commit) deliberately out of scope per honest single-FS cadence + Nilfs2 WORM writer: spec-compliant superblock (rev_level=2, magic 0x3434 at +1030, s_dev_size/last_cno/blocks_per_segment populated) plus a writer-private compact directory at offset 2048 guarded by "NILFS2WB" magic; reader extended to surface real files when that magic is present, falling back to triage on foreign images * Ubifs descriptor: gains IArchiveCreatable + CanCreate; description rewritten to call out self-round-trip-only scope * Nilfs2 descriptor: gains IArchiveCreatable + CanCreate + SupportsDirectories; description rewritten to call out single-checkpoint scope * Ubifs honest-readonly spec test inverted to assert WORM is now advertised, Modify still honestly off * Nilfs2 no-creatable spec test inverted to assert WORM is now advertised (488c853)
+- AOMEI .adi/.afi: VDB entry field byte offsets + BIFT body field offsets + 3 INFO_TYPE_* numeric values reverse-engineered from binary analysis of ImgFile.dll (codename BRCloudv2) + AomeiConstants: per-field byte offsets of BR_IMAGE_INDEX_ENTRY_VDB pinned via three independent code paths in the 32-bit ImgFile.dll: ReadBlock prologue at vma 0x10026060 (xmm0 copies of vdb[0..0xf] and vdb[0x10..0x1f] into [ebp-0x2c] / [ebp-0x1c], psrldq extraction of vdb[0x14] for the pOld malloc, push of [ebp-0x20]/[ebp-0x1c] forming the u64 ImgOffset arg of ReadData); wrapper at 0x10027c91 (movaps [esp+0x50],xmm0 mirroring vdb second half, BRCrc32 call taking [esp+0x54]=OldSize as byte-count, cmp eax,[esp+0x5c]=Crc32 leading to the `Crc32==vdb.Crc32` assert); GetBlock arg-marshalling at 0x10026d8a (movd esi,xmm1 = vdb[0..3] pushed first ⇒ RegNo, psrldq xmm0,4 then movd edx = vdb[4..7] = BlockNo_low, psrldq xmm1,8 then movd ecx = vdb[8..0xb] = BlockNo_high). Resulting layout: RegNo:u32@0x00, BlockNo:u64@0x04, ImgOffset:u64@0x0C, OldSize:u32@0x14, NewSize:u32@0x18, Crc32:u32@0x1C — totals to 0x20 ✓ + AomeiConstants: byte offsets of DataOffInSet:u64 and DataLenInSet:u64 within the 0x674-byte BR_IMAGE_FILE_TAIL pinned via reader-side `mov reg,[edi+0xc80..0xc8c]` at vma 0x100171b0 / 0x100172d4 / 0x10017342 plus the m_Tail base at object offset 0x660 established by the `rep movsd` at 0x10017cf3 in the tail-load routine. Subtracting yields DataLenInSet@+0x620 and DataOffInSet@+0x628 within the tail struct + AomeiConstants: position of the trailing BR_STANDARD_HEADER within the 0x674-byte BIFT pinned at offsets {Reserved:+0x664, Crc32:+0x668, Size:+0x66C, Flag:+0x670} — the tail's standard header sits at the END of the struct (vs the head's start-of-struct placement). Recovered from `cmp [ebp-0x8], 'BIFT'` at 0x10017b9a, `cmp [ebp-0xc], 0x674` at 0x10017bfd, and the CRC verification block at 0x10017c60..0x10017c84 that loads/zeroes [ebp-0x10] before recomputing + AomeiConstants: INFO_TYPE_FLB_SUB_ENTRY_LIST = 0x110 — pinned by `push 0x110` at 0x1000a2d0 immediately preceding the assert-text xref `AddInfo(INFO_TYPE_FLB_SUB_ENTRY_LIST, &m_vSubEntList[0], ...)` at 0x1000a2fd + AomeiConstants: INFO_TYPE_FLB_FILE_DATA_BLOCK_LIST = 0x111 — pinned by `push 0x111` at 0x1000a341 immediately preceding the assert-text xref `AddInfo(INFO_TYPE_FLB_FILE_DATA_BLOCK_LIST, &m_vDataBlockList[0], ...)` at 0x1000a36e. Both resolve the prior {0x110, 0x111, 0x128} candidate set + AomeiConstants: INFO_TYPE_VOLUME_DATA_REGION = 0x109 + sizeof(BR_IMAGE_INFO_VOLUME_DATA_REGION) = 0x30 — pinned by `cmp dword ptr [ebp-0x34], 0x109` at 0x1002554c (Type check) and `cmp eax, 0x30` at 0x10025558 (size check), both jne branches landing on the corresponding sizeof / Region.Header.Type assert-text xrefs at 0x10025779..0x100257ae and 0x10025846..0x1002587a + BrImageIndexEntryVdb: promoted from passive carrier to read/write helper — adds per-field byte-offset constants (RegNoOffset, BlockNoOffset, ImgOffsetOffset, OldSizeOffset, NewSizeOffset, Crc32Offset) mirroring the AomeiConstants pins plus Read(ReadOnlySpan<byte>) / Write(Span<byte>) helpers that decode/encode the 0x20-byte entry at the pinned offsets * BrImageIndexEntryVdb.PlausibleLayout: upgraded from a plausibility sketch ("RegNo:u32, BlockNo:u32, ImgOffset:u64, NewSize:u32, OldSize:u32, Crc32:u32, Pad:u32" with the wrong field widths and ordering) to the disassembly-pinned exact form ("RegNo:u32@0x00, BlockNo:u64@0x04, ImgOffset:u64@0x0C, OldSize:u32@0x14, NewSize:u32@0x18, Crc32:u32@0x1C") so downstream forensic tooling parses the right offsets * AomeiInfoRecord.TypeName: recognises the three newly-pinned INFO_TYPE_* tags (FLB_SUB_ENTRY_LIST, FLB_FILE_DATA_BLOCK_LIST, VOLUME_DATA_REGION) so unknown_0xNNNN no longer leaks for these values * AomeiFormatDescriptor.BuildMetadata: surfaces the new facts in metadata.ini — `vdb_entry_field_offsets=RegNo:+0x00:u32,BlockNo:+0x04:u64,ImgOffset:+0x0C:u64,OldSize:+0x14:u32,NewSize:+0x18:u32,Crc32:+0x1C:u32`, `tail_body_layout=DataLenInSet:u64@+0x620,DataOffInSet:u64@+0x628,trailing_BR_STANDARD_HEADER@+0x664`, `tail_trailing_header_offsets=Reserved:+0x664,Crc32:+0x668,Size:+0x66C,Flag:+0x670`, `volume_data_region_size=0x30`, and the three new tags added to info_types_enum * AomeiTests.Extract_WritesParsedHeader_OnValidMagic: tail_body_layout substring updated to match the now-pinned offsets + AomeiVdbLayoutTests (31 new tests): pins the three new INFO_TYPE_* values + sizeof(VOLUME_DATA_REGION) + uniqueness invariants, each of the six VDB field byte offsets independently with its disassembly provenance documented, the non-overlap / sum-to-VendorSize invariant, a hex-literal fixture that round-trips through Read/Write, both DataOffInSet/DataLenInSet offsets with their consecutive-u64 + fits-inside-BIFT invariants, each of the four BIFT trailing-header positions with the contiguous-and-ends-at-tail-size invariant, the TypeName mapping for the new tags, and the metadata.ini surface format ! Out of scope (documented-TODO): sizeof(BR_IMAGE_INDEX_ENTRY_FDB) — no `cmp [reg+0x18], imm` preamble at the FDB assert site so the byte size remains undecided; the head/tail body bytes between offset 0x10 and the recovered DataLen/DataOff/trailer fields remain unmapped; the on-disk wire layout has NOT been swapped to the 16-byte vendor BR_STANDARD_HEADER so AomeiWriter still emits a wire-incompatible 12-byte alias; AES variant + IV derivation (3f4a3f4)
+- EaseUS Todo Backup (.pbd) container shape pushed past R/O chunk-stream via binary RE of TBImageExplorer.exe (488bb4f)
+- Acronis True Image .tibx Stage-3: LSM_LEAF body LZ4-chained-stream decoder + InputItem ItemCommon attribute scanner + Golomb-Rice k=8 codec per binary RE of libarchive3.so + AcronisTibxLsmRecord.DecodeLeafBody: walks the (BE32 zchunk_size, BE32 chunk_size, LZ4-block bytes) chained-stream framing starting at page+0x20 for LSM_LEAF pages with encoding byte 3, decompresses each chunk via Lz4BlockDecompressor (the binary uses LZ4_decompress_safe_continue at libarchive3.so 0x54fb0 with the LZ4 dictionary preserved across chunks; for the all-in-one-chunk case this is identical to LZ4_decompress_safe). Returns a DecodedLeafBody record with the decompressed bytes, a status string (ok / unsupported_encoding / empty_body / lz4_chunk_error / buffer_underrun / len_mismatch), and the LZ4 chunk count + AcronisTibxLsmRecord.ScanForItemCommonAttributes: forensic-grade scan of the decompressed leaf body for InputItem ItemCommon (id 0x10) attribute body signatures - pattern-matches against the 44-byte fixed header (name length, alt-name length, DOS attrs, four FILETIMEs, trailer dword) followed by a UTF-16LE name. Validates name length [1, 260], alt-name length [0, 14], DOS attrs != 0xFFFFFFFF noise marker, at least one FILETIME in [1980, 2080] wall-clock range, and the name UTF-16 must be NTFS-valid (no nulls, no control chars, no forbidden NTFS path chars). False-positive rate on random noise is sub-1-in-2^64 - by construction real ItemCommon bodies pass every check + AcronisTibxLsmRecord.BuildLz4ChainedStreamFor: test helper that wraps a plaintext attribute body in the (BE32 zchunk, BE32 chunk, LZ4-block) frame so the test suite can round-trip DecodeLeafBody against known-good ItemCommon fixtures + Golomb: Rice/Golomb codec with k=8 (m=256) - the golomb_decode_mod256 / golomb_encode_mod256 primitive at libarchive3.so 0x53ef0 / 0x53d40 used by GOLOMB-page probabilistic membership filters (Golomb-Coded Set form). Decoder reads unary quotient capped at 8 then an 8-bit remainder; quotient=8 escape path consumes a literal 64-bit value. Encoder is symmetric. Includes BitReader / BitWriter MSB-first byte-packed helpers plus round-trip sequence helpers * AcronisTibxReader.DecodedLeaves / ScannedItemNames: new public properties surfacing the per-LSM_LEAF Stage-3 decoder summary (page index, ctree id, encoding, declared len/zlen/count, actual decompressed length, LZ4 chunk count, status code, scanned-name count) and the aggregated list of AcronisItemCommonAttribute candidates the scanner found across all leaf pages * AcronisTibxReader.WalkPages: now invokes AcronisTibxLsmRecord.DecodeLeafBody on every LSM_LEAF page it encounters and records the result in the new DecodedLeaves list - failures are surfaced as status codes (not thrown) so a container with a mix of plaintext and AES-wrapped leaves still walks cleanly * AcronisTibxReader: surfaces a fourth synthetic entry lsm-records.tsv alongside the existing metadata.ini + pages.tsv + acronis-tibx.bin. Per-LEAF rows include page_index, file_offset, ctree_id, encoding, len, zlen, count, decompressed_length, chunk_count, status, scanned_item_name_count. A second section lists candidate filenames as (name, alt_name, dos_attrs, creation_time_utc, last_write_time_utc) rows * AcronisTibxReader metadata.ini: parse_status promoted to ro-metadata+page-walk+lsm-record-decode, stage=3, ro_promotion=page-frame-walk + lz4-chained-stream-leaf-bodies + itemcommon-scan. Adds Stage-3 aggregates (lsm_leaf_decode_attempts, lsm_leaf_decode_succeeded, lsm_leaf_decode_failed, lsm_scanned_item_name_count, lsm_leaf_decode_status_codes), three new RE-target entries (re_target_6=lsm_page_read @ 0x56930, re_target_7=lz4_chained_stream_decoder @ 0x54fb0, re_target_8=golomb_decode_mod256 @ 0x53ef0), three new decoded_X surfaces (decoded_5=leaf_body_lz4_chained_stream, decoded_6=itemcommon_attribute_scan, decoded_7=golomb_rice_codec_mod256), and renumbered blocker_X to reflect Stage-3 promotion (1=lsm_record_framing_inside_decompressed_leaf_body, 2=encoding_4_leaf_body_path, 3=lsm_dir_page_record_stream, 4=optional_aes_encryption_gates_leaf_bodies, 5=commit_info_chain_not_decoded, 6=content_defined_chunking_dedup_short_index, 7=deduplicated_itemcommon_attributes) * FileFormat.AcronisTibx.csproj: adds ProjectReference entries for Compression.Core (Lz4BlockDecompressor / Lz4BlockCompressor) and FileFormat.Acronis (AcronisFileMetaBodyDecoder.DecodeItemCommon - reused so the .tib and .tibx InputItem layouts share a single decoder) + AcronisTibxLsmRecordTests (23 new tests, 89 total): Golomb-Rice round-trips (small values, zero, quotient boundary at q=7 vs q=8 escape, 64-bit escape path with arbitrary large values, constants pinning RiceK=8 / Divisor=256 / QuotientEscape=8, null-data + out-of-range-count + negative-count defensive throws, truncated stream returns zero-padded values). DecodeLeafBody round-trips (single-chunk LZ4 plaintext, ItemCommon scan finds the name, reader walks a synthetic container with embedded ItemCommon and surfaces it via ScannedItemNames, lsm-records.tsv carries the per-LEAF row + candidate-name row, metadata.ini documents Stage-3 decoded surface + RE provenance + aggregates). Sad-path coverage (encoding=4 returns soft unsupported_encoding status, empty body returns empty_body status with empty byte[], buffer-underrun caught with status). Scanner false-positive rejection (all-zero noise rejected, FILETIME=1 outside [1980, 2080] rejected, NTFS-forbidden character in name rejected, zero-length name rejected, valid ItemCommon embedded inside larger buffer found at the correct offset). Constants pinned (EncodingLz4ChainedStream=3, EncodingAlternative=4, LeafBodyOffset=0x20) * AcronisTibxDetectionTests / AcronisTibxLsmWalkTests: existing parse_status / stage / ro_promotion / blocker_X / entry-name assertions updated to the Stage-3 surface - Reader_EmitsMetadataIniAndBinSyntheticEntries + Descriptor_List_SurfacesPagesTsvAlongsideMetadataAndBin now expect 4 entries (metadata.ini + lsm-records.tsv + pages.tsv + acronis-tibx.bin), Metadata_SurfacesParseStatusAndStageMarkers expects parse_status=ro-metadata+page-walk+lsm-record-decode / stage=3 / ro_promotion=page-frame-walk + lz4-chained-stream-leaf-bodies + itemcommon-scan, Metadata_DocumentsBlockersOnLsmTreeWalk expects the seven Stage-3 blocker names, List_ReturnsThreeEntries expects 4 entries ! What was NOT decoded this pass:   - The formal per-record (key_length, key_bytes, value_length, value_bytes) framing INSIDE the LZ4-decompressed leaf body - lsm_item.h is Acronis-internal and the per-record bit-level layout is not publicly specified. The ItemCommon scanner above is forensic-grade pattern-matching not a deterministic record walk; it will miss records whose ItemCommon attribute was dedup-ed into a side table (the bit-23 stored-by-hash form per the .tib AcronisFileMetaBodyDecoder code path) and records gated by AES wrap (the page frame stays plaintext but the body beneath +0x20 may be AES-CBC per archive_encr.c + crypto_aes.c)   - The encoding=4 alternative leaf-body path - libarchive3.so accepts encoding bytes 3 and 4 per the cmp $0x4, %bl at 0x55404, but the 4 path is not yet decoded. Real ATI 2018+ corpora are needed to determine when 4 is used vs 3   - The LSM_DIR page record stream - LDIR pages carry (name_prefix, child_page_id) tuples for tree descent with the same encoding byte (3 or 4), but the per-record key/value layout differs from LEAF and is not yet decoded   - The ARCI commit-info page chain that ties leaf pages to logical items via segment ids - chain root lives at the page-zero chain_start_pg field but the per-CI-page record layout is undocumented   - The Acronis-internal short-fingerprint dedup index per dedup_short_index.c - leaf records that reference deduplicated extents point at this index which we cannot resolve without the spec (3848aae)
+- Macrium Reflect pre-X block payload codec (Stage-1 → Stage-2 R/O) + MacriumPreXCodec: clean-room C# port of the Lempel-Ziv-derived block-   payload decoder used by .mrimg / .mrbak / .mrex / .mrsql containers.   Algorithm description sourced from the MIT-licensed community reference   project ccooper21/mrimg-tools (no source copy — re-implementation from   the algorithm shape). Decoder shape: 32-bit interleaved control word   with 31 token slots (bit 0 = literal vs op), six op dispatch branches   keyed off the low nibble of the next 4 bytes (RLE op==0x0F, long copy   op==0x07, medium copy op&0x07==0x03, short copy op&0x03==0x02, fixed-3   copy op&0x03==0x01, fixed-3 tiny op&0x03==0x00). Back-references   emitted byte-at-a-time so overlapping matches behave like a forward   run. Bookkeeping correctly tracks bytesProduced separately from the   output cursor since each op writes encoded_count+1 bytes but only   advances by encoded_count (the trailing scratch byte is overwritten by   the next token, or becomes the final byte of the block) * MacriumPreXFormatDescriptor: now uses MacriumPreXCodec to decode the   first MaxDecodedBlocks=16 blocks, surfacing each as a block-NN.bin   synthetic entry. metadata.ini gains decoded_blocks, decode_failures,   first_decode_failure, parse_status="decoded"|"decoded+comment", and   payload_decompression="implemented". Decoder failures are swallowed   per-block so an encrypted/corrupt block doesn't tank listing for   the rest of the file + MacriumPreXCodecTests: 17 NUnit cases covering all six op branches   via bit-by-bit VectorBuilder hand-crafted vectors — literal-only,   literal stream spanning two control words, RLE expansion, RLE +   literal trailing-byte overwrite, fixed-tiny copy, fixed-short copy,   short copy with overlapping match, medium copy, long copy. Plus   boundary cases (negative / oversize uncompressed_length, zero-length   output) and exception cases (back-reference before block start,   truncated control word, output buffer overflow). Also two integration   tests proving the descriptor surfaces decoded block-00.bin entries * MacriumPreXTests.Extract_SyntheticMrimg_WritesAllSynthetics: updated   the metadata.ini assertions — the synthetic fixture's pseudo-random   body is not valid codec input so decoder bails cleanly and metadata   surfaces payload_decompression=implemented_but_no_block_decoded +   decoded_blocks=0 + decode_failures=1 (proving the codec runs without   taking the listing path down) ! Out of scope (documented in descriptor XML doc): the BAT-style   block-index walk that maps (volume, sector) -> (block, offset) for   inner partition reconstruction; the AES-128/192/256 catalog decryptor   used by password-protected backups. Both deferred to a future phase (f7d56b5)
+- Norton Ghost pre-3.0 (Ghost 1.x / 2.x DOS-era, 1996-1998) R/O Stage-1 metadata via binary inspection of Ghost 1.6 GHOST.EXE — promotes the version-gated Stage-0 diagnostic fallback that the modern reader emitted when it found a FE EF header without 0x012F18D8 record framing + GhostLegacyReader: dedicated pre-3.0 dump-file parser — recognises images by the {FE EF magic at offset 0 + recognised head-type byte (1/2/3) at offset 2 + ABSENCE of the modern 0x012F18D8 record magic anywhere in the body}, surfaces metadata.ini (head type, image size, parse status, RE source attribution), the 512-byte dump-head bytes verbatim and the rest of the file as dump-body + GhostLegacyConstants: pinned on-disk constants reverse-engineered from Ghost 1.6 GHOST.EXE (archive.org item ghost16, MD5 64cef43d0eb8d456de990cc95353fa05). The 0xFE / 0xEF magic bytes, the 512-byte head size and the head-type-byte at offset 2 are all confirmed against both the encoder (WriteDumpHeader at file_off 0x897d — bytes at 0x89b3 / 0x89ba / 0x89c2 / 0x899d) AND the decoder (ReadDumpHeader2 at file_off 0x8a6f — bytes at 0x8aa8 / 0x8aae / 0x8ac8). Head type 1 = disk descriptor / first record (caller at file_off 0x84df), 2 = partition record (caller at 0x8794), 3 = boot record (caller at 0x86a8) * GhostReader.Parse: when the modern 0x012F18D8 container parse fails, try GhostLegacyReader.LooksLikeLegacyHeader before falling through to the Stage-0 raw-container fallback. Pre-3.0 images are now classified as PreModern1And2 and surface dump-head.bin + dump-body.bin + a rich metadata.ini instead of a single opaque ghost-image.gho.bin * GhostGenerationHint: add PreModern1And2 enum value (4) for the new Stage-1 path; PossiblyLegacy4To7 still classifies the no-record-magic-but-no-recognised-head-type FE EF case * GhostFormatDescriptor.Description: now documents the pre-3.0 Stage-1 surface (head magic + head-type byte + dump-head/body extraction) alongside the existing modern Ghost 3.0+ R/W. Per-file extraction (FAT directory walk inside the stored partition body) is honestly flagged as out-of-scope for Stage-1 since we don't have a Ghost-1.6-produced corpus to validate cluster-level extraction * GhostReader.LegacyHeadType: new public read-only property exposing the head-type byte when a pre-3.0 image was parsed (0 otherwise) + Stage-1 acceptance gates added to GhostFormatTests: recognises head types 1/2/3, surfaces dump-head + dump-body verbatim, metadata documents the scope + RE source, descriptor List surfaces all three Stage-1 entries (no Stage-0 raw fallback), legacy detector rejects FE-EF-but-modern-record-magic-present, rejects unknown head type, rejects bytes-too-short, rejects wrong magic, constants pinned to the values established by binary inspection, handles empty-body edge case * Reader_VersionGatesLegacyShapedHeader: renamed to Reader_VersionGatesUnknownFeEfShapedHeader and reworked to use head-type byte 0xFF (truly unknown) so the test continues to exercise the Stage-0 fallback — the original test data happened to have head-type byte 2 which now correctly classifies as pre-3.0 (so the old Stage-0 surface assertion no longer applies) ! Per-file extraction (FAT12/FAT16 cluster-walk inside the partition body) deferred — Ghost 1.x / 2.x stores FAT partitions as a directory + file-data structure that requires a DOS-specific FAT walk semantics (the binary's BrIniFAT / BrSendDir / BrRcvCloneFile path), not a raw cluster image. Without a real Ghost-produced corpus we cannot validate cluster-level extraction so we surface the dump body verbatim and direct users to Symantec Ghost Explorer for inner-FAT recovery. PKWARE-DCL-Implode "Old" compression (modern compression byte = 1) remains irrecoverable per the earlier cross-vendor finding (07a9a70)
+- Macrium Reflect pre-X (.mrimg/.mrbak/.mrex/.mrsql) Stage-0 → Stage-1 R/O metadata via binary RE (d4a9353)
+- AOMEI INDEX_TYPE_* + INFO_TYPE_* enum + BR_IMAGE_INDEX header layout reverse-engineered from binary analysis of ImgFile.dll; vendor BR_STANDARD_HEADER size + BRCloudv2 source-tree codename pinned + AomeiConstants: 5 new INDEX_TYPE_* numeric values — ROOT=0x200, VOLUME=0x201, DATABLOCK=0x202, DIRTREE=0x300, DATAAREA=0x301 — all five recovered by cross-referencing each `INDEX_TYPE_xxx==Head.Type` assert string xref against the `cmp dword ptr [reg+disp], imm32` preamble that immediately precedes the assert failure branch in ImgFile.dll + AomeiConstants: 9 new INFO_TYPE_* numeric values past the original four — IMAGE_SPLIT_SIZE=0x104, IMAGE_COMMENT=0x108, BACKUP_TIME=0x10B, BACKUP_OPTION=0x10D, DISK_INFO=0x102, VOLUME_INFO=0x103, FLB_PATH_LIST=0x112, FLB_BACKUP_OPTION=0x113, FLB_BACKUP_OPTION_EX=0x116 — recovered by tracing each `push imm32` / `mov [stack], imm32` immediately before the `GetImageInfo` / `AddImageInfo` callsite that loads the matching assert string + AomeiConstants: vendor BR_STANDARD_HEADER size pinned at 16 bytes (Type:u32, Size:u32, Crc32:u32, Reserved:u32) per `cmp ecx, 0x10` preamble at `Length>=sizeof(BR_STANDARD_HEADER)` assert in FlbImageWriter.cpp — this codebase still ships a wire-incompatible 12-byte alias of the layout (round-trips through our reader, not byte-compatible with the AOMEI application); the alias is documented explicitly alongside the new VendorStandardHeaderSize=16 constant + AomeiConstants: BR_IMAGE_INDEX header layout pinned — EntryCount at +0x14, EntrySize at +0x18, entries packed at +0x1C — recovered by reader-side `cmp dword ptr [edx+0x18], 0x20` (EntrySize == sizeof(VDB)) and writer-side `mov [esi+0x14], EntryCount` + AomeiConstants: sizeof(BR_IMAGE_INDEX_ENTRY_VDB)=0x20 pinned at the `cmp [edx+0x18], 0x20` preamble before the `pIndex->EntrySize==sizeof(BR_IMAGE_INDEX_ENTRY_VDB)` assert in ImageVolume.cpp + AomeiConstants: vendor source-tree codename "BRCloudv2" pinned — embedded in the installer's PDB paths as `E:\BRCloudv2\src\ImgFile\*.cpp` (BlockContainer.cpp, BrFileWin.cpp, DataConvert.cpp, DsImgTask.cpp, FlbDataRegion.cpp, FlbDirEntry.cpp, FlbFileRegion.cpp, FlbImage.cpp, FlbImageReader.cpp, FlbImageWriter.cpp, FlbImgTask.cpp, Image.cpp, ImageFile.cpp, ImageFileSet.cpp, ImageReader.cpp, ImageReaderHelp.cpp, ImageVolume.cpp, ImageWriter.cpp, ImageWriterHelp.cpp, ImgTaskMgr.cpp, ImgWriteCache.cpp) + BrImageIndex / BrImageIndexEntryVdb / BrImageIndexEntryFdb: passive data classes capturing the recovered field name list — for VDB: RegNo, BlockNo, ImgOffset, NewSize, OldSize, Crc32 (recovered via `m_pImgSet->ReadData(vdb.ImgOffset, pNew, vdb.NewSize)`, `vdb.NewSize==vdb.OldSize`, `Crc32==vdb.Crc32`, `GetBlock(vdb.RegNo, vdb.BlockNo, ...)` access patterns); for FDB: same minus RegNo (file backups have a single logical region). BrImageIndex.TryReadVendor parses EntryCount + EntrySize from a 0x1C-byte vendor header on input bytes (without committing to emitting one yet — the per-entry field byte offsets remain undetermined) * AomeiInfoRecord.TypeName: extended to recognise all 14 new tags (13 INFO_TYPE_* and the 5 INDEX_TYPE_*); added IsIndex helper that returns true for the five INDEX_TYPE_* values so callers can dispatch to BR_IMAGE_INDEX parsing * AomeiFormatDescriptor.Description: rewritten to reflect the decoded enum + structural facts plus the remaining gaps (head/tail body byte offsets undetermined, per-entry VDB field byte offsets undetermined, FLB_SUB_ENTRY_LIST / FLB_FILE_DATA_BLOCK_LIST multi-candidate values not yet uniquely pinned, AES variant + IV derivation undetermined); metadata.ini gains structured surfacing of the new enums (info_types_enum, index_types_enum, index_entry_layout_offsets, vdb_entry_size, vdb_entry_field_names, vendor_standard_header_size, shipped_standard_header_alias_size) so downstream forensic tooling can index against the recovered facts * AomeiWriter.UserDataTypeTag: doc updated — 0xF001 sits above the entire recovered tag range (INFO 0x102..0x116, INDEX 0x200..0x301) rather than the original "below 0x200" claim + AomeiDataBlockBodyTests (38 new tests): pins all 5 INDEX_TYPE_* numeric values, all 9 new INFO_TYPE_* numeric values, the 16-byte vendor BR_STANDARD_HEADER size + the 12-byte alias, the BR_IMAGE_INDEX header offsets (EntryCount+0x14 / EntrySize+0x18 / Entries+0x1C), sizeof(VDB)=0x20, BrImageIndex.TryReadVendor parses + rejects short input, VDB/FDB data classes round-trip via initializer, all 14 new TypeName mappings + IsIndex behaviour, the BRCloudv2 vendor codename, and the metadata.ini surface format — uniqueness invariants assert no INFO/INDEX_TYPE collide and that the INFO range stays inside [0x100, 0x1FF] so the 0xF001 user-data namespace remains safe * AomeiTests.Extract_WritesParsedHeader_OnValidMagic: assertion strings updated to match the new metadata.ini key wording (head_body_layout=undocumented_past_first_12_bytes, tail_body_layout=carries_DataOffInSet_u64, index_body_layout=BR_IMAGE_INDEX_header_pinned) ! What was NOT decoded: byte offsets of RegNo / BlockNo / ImgOffset / NewSize / OldSize / Crc32 fields within the 0x20-byte VDB entry — the C++ accesses them as typed struct members so no numeric disp immediates appear in the disassembly; sizeof(BR_IMAGE_INDEX_ENTRY_FDB) — no `cmp [reg+0x18], imm` preamble visible at the FDB assert site; byte offsets of DataOffInSet:u64 + DataLenInSet:u64 within the 0x674-byte file tail body; the multi-candidate numeric values for INFO_TYPE_FLB_SUB_ENTRY_LIST and INFO_TYPE_FLB_FILE_DATA_BLOCK_LIST (both narrowed to {0x110, 0x111, 0x128}); INFO_TYPE_VOLUME_DATA_REGION numeric value (the assert site shows no `cmp` preamble — the type comes from the SubList entry tag rather than a literal); the on-disk wire layout has NOT been swapped to the 16-byte vendor BR_STANDARD_HEADER (Type at +0, Size at +4) so containers emitted by AomeiWriter still round-trip through our own reader but are not byte-compatible with the AOMEI Backupper application; AES variant + IV derivation (26f1dc1)
+- Acronis True Image .tibx Stage-2: page-frame walk per ar_page_verify + lsm_dump_ctrees binary RE + AcronisTibxPage + AcronisTibxLsmPageSubHeader: 4 KiB page frame parser surfacing the page-type tag at +0x1 (1=HDR / 2=LSM_LEAF / 3=LSM_DIR / 4=GOLOMB / 5=DATA / 6=CI per the page-type table at libarchive3.so 0x963fa), the BE32 stored CRC at +0x4, the 4-byte content magic at +0x8, and (for LEAF/LDIR pages) the LSM sub-header at +0xC..+0x1C carrying version, encoding, BE16 count, BE32 len/zlen/seq and the ctree-id byte. Page-frame layout recovered from binary RE of ar_page_verify at libarchive3.so 0x6bef0 (sentinel 'A' at +0, type-tag check at +1, reserved-zero check at +2, BE32 CRC at +4 over the full page with the CRC field zeroed). LSM sub-header recovered from lsm_dump_ctrees at 0x590f7 (the same loads the diagnostic JSON dump emits as "version" / "encoding" / "count" / "len" / "zlen" / "seq" / "id"). HDR page-zero is detected by sniffing the 4-byte ASCII "ARCH" magic at +0x0 (the page-zero header takes the alternative verify path at libarchive3.so 0x233bb because its +0x1 byte is 'R' not a type tag) + AcronisTibxLsmEntry: per-page summary record (page-index, file-offset, page-type, content-magic, stored-crc, LSM sub-header) * AcronisTibxReader.WalkPages / LsmEntries / PageTypeCounts / PageCount: walks the container as a stream of 4 KiB page frames, classifies each by type, decodes the LSM sub-header for LEAF/LDIR pages, and counts per-page-type tags. Best-effort: malformed pages (missing 'A' sentinel) are classified as Unknown rather than throwing; trailing partial pages smaller than one frame are ignored * AcronisTibxReader: now surfaces three synthetic entries instead of two — metadata.ini (parsed page-zero header + page-walk aggregates), pages.tsv (per-page summary table), acronis-tibx.bin (verbatim container) * AcronisTibxReader metadata.ini: parse_status promoted to "ro-metadata+page-walk", stage=2, ro_promotion="page-frame-walk + metadata". Adds the page-frame layout offsets (sentinel/type-tag/CRC/content-magic), the 0..6 page-type tag mapping, per-page-type counts, aggregate LSM record-count sums for leaf and dir pages, aggregate LSM uncompressed (len) and compressed (zlen) size sums, the distinct ctree-id list, and updated decoded_1..4 (what is decoded) + blocker_1..5 (what is documented-TODO) + stretch_goal (link LSM record attributes to DATA page extents by reusing AcronisFileMetaBodyDecoder from FileFormat.Acronis since the InputItem attribute-stream layout is shared with classic .tib) * AcronisTibxFormatDescriptor.Description: updated to cite the Stage-2 page-frame walk, the page-frame layout, the page-type tag table, the LSM sub-header offsets, and pages.tsv + AcronisTibxLsmWalkTests (25 new tests, 66 total): page-type enum tag values (0..6 ordering vs. libarchive3.so 0x963fa string-table positions), Page.Parse round-trips for HDR / LSM_LEAF / LSM_DIR / CI / DATA pages, LSM sub-header field round-trip via BE16 count + BE32 len/zlen/seq + ctree-id byte, unknown-tag-clamped-to-Unknown, sentinel-byte mismatch returns null, too-small buffer returns null, Reader.WalkPages aggregates page-type counts across mixed containers, LsmEntries preserve file-offsets + page-indices, metadata.ini surfaces page_count / per-page-type counts / lsm_leaf_pages + lsm_dir_pages / record-count sums / uncompressed + compressed size sums / ctree-id list (deduplicated + sorted), pages.tsv has one row per page with the column-header row and per-row content-magic + sub-header columns (ASCII when printable, hex when not), metadata.ini documents the page-frame offset table + page-type tag mapping + decoded_1..4 surface, stretch_goal cites AcronisFileMetaBodyDecoder, zero-filled trailing page classified as Unknown (not throw), partial-page trailing fragment ignored, descriptor List() surfaces the three synthetic entries * AcronisTibxDetectionTests: Reader_EmitsMetadataIniAndBinSyntheticEntries / List_ReturnsTwoEntries renamed/updated to expect the three Stage-2 entries (metadata.ini + pages.tsv + acronis-tibx.bin), Metadata_SurfacesParseStatusAndStageMarkers updated to expect parse_status=ro-metadata+page-walk / stage=2 / ro_promotion=page-frame-walk + metadata, Metadata_DocumentsBlockersOnLsmTreeWalk updated to expect the Stage-2 blocker names (blocker_1=lsm_record_stream_inside_leaf_pages, blocker_4=optional_aes_encryption_gates_leaf_bodies) ! What was NOT decoded this pass:   - The Golomb-coded (name, child_page_id) record stream inside LSM_DIR pages — these are the directory entries that point at child pages; without them we can't traverse from the root down to a specific leaf. The bit-width parameters are adaptive per-page per lsm_lookup.c + golomb.c   - The per-item attribute-record body inside LSM_LEAF pages — once decoded, the same AcronisFileMetaBodyDecoder from FileFormat.Acronis (which already decodes ItemCommon attribute id 0x10 carrying the filename) could be wired here since the .tib/.tibx InputItem model is shared   - The ARCI commit-info page chain that ties leaf pages to logical items via segment ids — the chain root lives at the page-zero "chain_start_pg" field but the per-CI-page record layout is undocumented   - The optional AES wrapping (archive_encr.c + crypto_aes.c) that gates leaf/data page bodies when encryption is enabled   - The DATA page extent layout that file content actually lives in — once the LSM record stream is decoded, leaf records would reference DATA page extents by (page-id, offset, length) tuples (dad2a96)
+- Acronis classic .tib ItemCommon 44-byte fixed-header tail decoded via reverse-engineered BackupCommonAttributes writer + four new typed attribute decoders (0x17 Replica, 0x18 ItemCommonExtra, 0x80 SliceItem, 0x90 SliceItemBlob) + AcronisItemCommonAttribute typed fields: DosAttributes (u32 @ offset 4), CreationTime / LastWriteTime / LastAccessTime / ChangeTime (4× FILETIME at offsets 8/16/24/32), TrailerDword (u32 @ offset 40). Order matches NTFS $STANDARD_INFORMATION + the symmetric ArchiveApi::ItemBackuperImpl::BackupCommonAttributes writer in ti_tools.dll (k:\9202\archive\ver2\file\backup_operation.cpp) which emits these via FileItem vtable[0xc] (DOS attrs), vtable[0x18] (creation), vtable[0x5c] (write), vtable[0x24] (access), vtable[0x28] (change), vtable[0x34] (trailer). FixedHeader byte[44] is still surfaced verbatim for diagnostic/round-trip use. Nullable DateTime properties (CreationTimeUtc/etc.) convert FILETIME to UTC, gracefully returning null on the unset-zero case and on out-of-range values + AcronisReplicaAttribute (0x17, 24-byte body): 16-byte GUID block + 2× uint32 cookies. GUID is byte-swapped on read via the same Data1-32bit-BE↔LE / Data2-16bit-BE↔LE / Data3-16bit-BE↔LE / Data4-verbatim conversion that FUN_00fed680 in ti_tools.dll applies. Source: ArchiveApi::ReplicaItemImpl::TakeAttributeReplica + AcronisItemCommonExtraAttribute (0x18, 8-byte body): uint64 cookie. Source: BackupCommonAttributes' trailing 0x18 write via FileItem vtable[0x2c]; binary's reader throws on size != 8 so decoder honors that gate + AcronisSliceItemAttribute (0x80): 25-byte short form (GUID + 2× u32 + 1 byte flag) with optional extended tail (1 sentinel pad + u16 nameLength + UTF-16LE name). Source: ArchiveApi::SliceItemImpl::PreloadAttributes id-0x80 branch — reads up to 0x1F bytes, accepts 0x19 (25) as the short-form canon, longer bodies surface the trailing name + AcronisSliceItemBlobAttribute (0x90): variable-length opaque payload surfaced verbatim. Source: SliceItemImpl::PreloadAttributes id-0x90 branch (no internal framing decoded in the binary) + AcronisFileMetaBody.Replica / ItemCommonExtra / SliceItem / SliceItemBlob — top-level typed accessors on the parsed body, populated by the per-id dispatch in AcronisFileMetaBodyDecoder.Decode + AcronisFileMetaBodyTests (18 new): DecodeItemCommon_TypedFields_RoundTripDosAttributesAndFourFiletimes, CreationTimeUtc_ConvertsFromFiletime, AllTimestampsZero_DateTimePropertiesAreNull, OutOfRangeFiletime_GracefullyReturnsNullDateTime, HexLiteralFixture_PinsFixedHeaderLayout (hand-rolled bytes pin the exact 44-byte tail offsets against future regressions), DecodeReplica_RoundTripsGuidAndCookies + TooShortBody + Decode_ReplicaAttribute_SurfacesInTopLevelView, ItemCommonExtra round-trip + too-short-body defensive gate, DecodeSliceItem_ShortForm + ExtendedForm + TooShort + Decode_SliceItemAttribute_SurfacesInTopLevelView, SliceItemBlob round-trip + empty-blob edge case, Decode_AllNewlyDecodedAttributes_SurfacedTogether (multi-attribute body carries every newly-decoded id at once), Decode_DeduplicatedSliceItem_NotDecodedAsInline (bit-23 dedup-flag contract still gates the new ids) * AcronisFormatDescriptor.Description: documents the four FILETIMEs + DosAttributes inside ItemCommon and the newly-decoded Replica / ItemCommonExtra / SliceItem / SliceItemBlob ids; ACL handler remains documented-TODO ! What was NOT decoded:   - The ACL blob shape (record type 5 / FileMetaC body). No per-id handler for security-descriptor bytes was located in the binary inspection pass; the strings table only surfaces NTFS-side SecureStorage references, not an Acronis-side TakeAttributeAcl handler. Record-5 bodies are still surfaced as attribute streams when they parse as such, otherwise as raw payload. The Acronis classic .tib likely either (a) omits ACLs entirely on the resident attribute path or (b) routes them through a yet-unidentified id whose handler doesn't carry the canonical "Acl" string   - The semantic identity of the four FILETIMEs in ItemCommon is the most-defensible mapping (CreationTime / LastWriteTime / LastAccessTime / ChangeTime) given the BackupCommonAttributes writer order matches NTFS $STANDARD_INFORMATION, but per-vtable-index ground-truth would need a real .tib fixture with known wall-clock files; we don't have one. The decoder labels them per the standard order and surfaces the raw uint64 alongside for downstream callers who want to relabel   - The semantics of the TrailerDword at offset 40 (written from FileItem vtable[0x34]). Surfaced verbatim   - The trailing uint32 cookies on Replica and SliceItem — surfaced verbatim as Value1 / Value2 pending a wire-tap with known input   - The internal framing of SliceItemBlob (0x90). Reader treats the body as opaque bytes — likely a UTF-16 comment string but the binary makes no such assumption (3a28e18)
+- Backup-software disk images section in Hawkynt.FileFormats.Archives/README (655dc7c)
+- Acronis FileMeta 102/1/2/5 body field layout reverse-engineered as an InputItem attribute stream; filename decoder lands behind the existing chain-walk anchor + AcronisFileMetaBody + AcronisFileMetaBodyDecoder.Decode: the inflated body shape is now decoded — uint32 attributeCount followed by N×{uint32 idAndFlags, uint16 size, byte[size] body} tuples. Bit 23 of the dword is the dedup-by-hash flag (matches InputResidentAttributeEnumerator::GetId masking the raw uint32 with 0xff7fffff to drop the flag); size==16 dedup bodies are MD5 hashes referring to a side table we don't dereference (and the decoder honestly refuses to mistake them for inline bodies). The high-value attribute ids are decoded with shapes from the per-id TakeAttribute*/PreloadAttribute* handlers in archive\ver2\file\item_supp.cpp: ItemCommon(0x10) = uint16 nameLength + uint16 altNameLength + byte[40] fixed-header rest + UTF-16LE name + UTF-16LE altName — this is where the FILENAME lives; SourceItem(0x40) = uint16 pathLength + uint16 kind + uint32 id + UTF-16LE path; HardLinkId(0x14) = uint64; BackupTime(0x50) = uint64; TimeZone(0x60) = int32 minutes-from-UTC. Ids we haven't decoded (Replica 0x17, ItemCommonExtra 0x18, SliceItem 0x80, SliceItemBlob 0x90, anything else encountered) are surfaced as AcronisRawAttribute so callers still see them. Decoder is tolerant of truncated headers/bodies — it surfaces a partial result rather than throwing so the existing record walk can keep going across forged fixtures + AcronisRecord.MetaBody: 102/1/2/5 records now carry an AcronisFileMetaBody on the record, populated via TryDecodeMetaBody which catches and nulls out any decode exception so the legacy ascii-payload test fixtures don't break the record walk + AcronisReader.FileMetaBodiesByEntry / DecodedNamesByEntry: per-entry views resolved through the existing chain walk (Listing.MetaOffset -> 102 anchor) — DecodedNamesByEntry[i] surfaces the ItemCommon name from the chain-walked 102 body so callers can compare it against the Listing-record Name. null entries indicate "chain walk didn't resolve" OR "102 body didn't decode as an attribute stream" OR "decoded body had no ItemCommon" * AcronisFormatDescriptor.Description: now names the decoded ids (ItemCommon 0x10, SourceItem 0x40, HardLinkId 0x14, BackupTime 0x50, TimeZone 0x60) and the DecodedName surface * AcronisRecord field-level XML docs filled in (Type/Start/End/Payload/Files/ConfigAttrs/Index/MetaBody) + AcronisFileMetaBodyTests (19 new): Decode_EmptyAttributeStream, TooShortForCount, SingleItemCommonAttribute_RoundTripsNameAndLengths, ItemCommon_WithoutAltName, SourceItem/HardLinkId/BackupTime/TimeZone round-trips, MultipleAttributes_AllRoundTrip, DeduplicatedAttribute_MasksFlagFromIdAndSkipsInlineDecode (the bit-23 dedup-flag contract), HexLiteralFixture_ItemCommonWithName_DecodesAsExpected (hand-rolled bytes pinning the wire layout against future regressions), Truncated header + truncated body, DecodeItemCommon defensive returns null for too-short body and for nameLength-overflows-body, Reader_SurfacesDecodedName_FromAnchored102Body (end-to-end: builder writes a 102 carrying ItemCommon, reader's DecodedNamesByEntry surfaces the name distinct from the Listing-record name), Reader_DecodedName_MatchesListingName_WhenBothCarrySameName, Reader_DecodedNameNull_WhenChainWalkUnresolved (MetaOffset=0 legacy case), Reader_FileMetaBodyDecodingTolerant_OfNonAttributePayload (ascii-marker fixture doesn't blow up the reader) ! What was NOT decoded:   - The 40 unknown bytes inside ItemCommon's 44-byte fixed header past (nameLength,altNameLength) at offsets 4-43. These almost certainly carry the file's DOS attributes + file-system timestamps (created/written/accessed) per the InputItem model documented by binary inspection of ti_tools.dll's ContinuousAttributeWrapperImpl::ReadStandardAttributes which reads exactly 28 bytes of standard attributes, but the exact field offsets inside the 44-byte block are not pinned down. Surfaced verbatim in AcronisItemCommonAttribute.FixedHeader for callers who want to probe further   - Which of the 102/1/2/5 records carries the resident attribute stream (this code accepts any of them) vs. the nonresident streams that the binary's PreloadNonresidentAttributes path handles. The decoder runs on all four record types' inflated bodies; in the wild the resident stream that carries ItemCommon is likely just one specific record type, but we don't have a real .tib to confirm which   - Attribute ids 0x17 (Replica, 24-byte body), 0x18 (ItemCommonExtra, 8-byte body), 0x80 (SliceItem, 0x19-byte fixed + name), 0x90 (SliceItemBlob, variable). Their byte-level shapes were captured in the binary inspection of ti_tools.dll but not yet decoded into structured types — surfaced as AcronisRawAttribute entries until they're needed   - ACL blob shape (record type 5 / FileMetaC body). The chain walk anchors 5 correctly and the decoder will surface any attribute-stream-shaped 5 body, but the per-id handler for ACL bytes was not located in the binary inspection pass — surfaced as raw attributes until we know which id (or which non-attribute encoding) carries ACLs (b14f2b9)
+- Acronis True Image .tibx Stage-0 -> R/O metadata via binary RE of libarchive3.so + archive3.dll (9c3a655)
+- Paragon PBF promoted from R/O metadata to WORM (write-once round-trippable) via reverse-engineered chunk-offset table emit; zlib + Adler-32 per-chunk wired + ParagonWriter: emits the vendor-literal 'PImg' magic + Major 0x0002 / FormatVersion 0x0003 prefix that survives the vendor's reader gate at HDM-18 RVA 0x4ae6e4, leaves the reverse-engineered vendor offsets (+0xC, +0x26, +0x27, +0x30, +0x34, +0xD8, +0xE8, +0xF1) zero rather than forging them without a real Paragon sample, then installs an 8-byte 'CWBPbpf1' discriminator at +0xF8 past the vendor's last initialised byte. After the 64-byte CWBP table-of-contents (chunk count + chunk-table offset + sectors-per-chunk + segment count + total logical size + header size) the body region writes each chunk's bytes — either verbatim ('stored') or zlib-compressed via System.IO.Compression.ZLibStream (CompressionLevel.Optimal). Compressed payload that grows past the source length falls back to stored on a per-chunk basis. Finalise() lays the chunk-offset table down at the tail (40 bytes per entry: ChunkNumber u32 + ChunkOffset u64 + ChunkSize u32 + IsCompressed byte + 3-byte padding + LogicalSize u32 + Adler32 u32 + 8 reserved bytes) and patches the header pointers + ParagonReader: CWBP-aware fast path — when the +0xF8 discriminator is present, parse the table-of-contents at +0x100, walk the trailing chunk-offset table, surface each chunk as a 'chunk_NNNNNN.bin' entry alongside the existing metadata.ini, verify the per-chunk Adler-32 ('Chunk is not valid, adler32 checksum is wrong.' gate), and zlib-decompress when ChunkIsCompress == 'Y'. Vendor-style PBFs without the CWBP marker still fall through to the existing R/O metadata + opaque-blob path so the existing 34 tests stay green + ParagonReader.ChunkTable / IsCwbpProduced / ChunkCount / TotalLogicalSize / SectorsPerChunk / AssembleLogicalPayload — public API the writer's round-trip tests assert against + ParagonAdler32: clean-room RFC-1950 Adler-32 kept inside FileFormat.Paragon (no Compression.Core dependency added); matches the zlib checksum the vendor uses on each chunk + ParagonChunkInfo: per-chunk struct view exposing the exact ChunkNumber u32 / ChunkOffset u64 / ChunkSize u32 / ChunkIsCompress fields the reverse-engineered debug strings dump + ParagonFormatDescriptor: implements IArchiveCreatable; Capabilities advertises CanCreate + SupportsMultipleEntries alongside CanList / CanExtract / CanTest; Methods adds 'zlib' (default) and 'stored'; Create() routes inputs through ParagonWriter.WriteChunk one chunk per input + ParagonRwTests (22 tests): header field invariants (magic, Major, FormatVersion, CWBP discriminator position, vendor-offset zero-fill), single-chunk compressed + stored round-trip, multi-chunk round-trip, WritePayload chunk-splitting + AssembleLogicalPayload reassembly, highly-compressible chunk shrinks, high-entropy chunk falls back to stored, zero-byte chunk, Adler-32 corruption rejection, vendor-style (non-CWBP) file falls back to R/O metadata, full descriptor Create/List/OpenEntry round-trip, stored-method bypasses zlib, unknown-method throws, null-stream + non-seekable-stream guards, ChunkTable entries expose the reverse-engineered field types, CWBP metadata.ini scope keys, two-write determinism, ~1.5 MB / 24-chunk large-payload round-trip * ParagonDetectionTests: Descriptor_HasExpectedIdentity now asserts IArchiveCreatable presence; Capabilities_AreReadOnly renamed to Capabilities_AreReadWriteWorm with CanCreate=true; Description_FlagsRoMetadata_NoCreateOrModify renamed to Description_FlagsWormCwbp_AndCannotModify (still asserts CanModify=false, the WORM scope is single-shot); Description_PinsRoMetadataTreatment_AndCitesPImg renamed to Description_PinsWormCwbpTreatment_AndCitesPImg (keeps the PImg + TrID + proprietary citations, adds the WORM citation, retains the r/o metadata fallback citation for vendor-produced files) * ParagonFormatDescriptor.Description: documents the WORM-CWBP scope, the vendor-offset zero-fill policy, the CWBP discriminator + chunk-table layout, the zlib-with-Adler-32 per-chunk pipeline, and that vendor-tool byte-compat stays explicitly out of scope (HDM 16+ is restore-only; no real Paragon-produced samples available for clean-room byte validation) * EndToEndInteropTests: '.pbf' added to _selfRoundTripExclusions alongside the existing disk-image backup formats (.gho, .sparseimage, .mrimgx) — WORM layout surfaces entries as 'chunk_NNNNNN.bin' rather than the harness's generic 'repeat.txt / small.txt / random.dat' names ! Out of scope: byte-compat with vendor Paragon Backup & Recovery / Hard Disk Manager — the exact on-disk chunk-table offset inside the vendor's segments, the bitmap-chain (CPbfBitmapIO) encoding, the +0xD8 ParentId chain back-pointer policy, the per-segment split-archive (.000 / .001 / ...) trailer, and the .pfi sidecar magic all remain undocumented past the architectural level. HDM 16+ is restore-only and the Free Edition only writes pVHD, so no real PBF samples are available to byte-validate against. Vendor offsets +0xC / +0x30 / +0x34 / +0xD8 / +0xE8 / +0xF1 stay zero rather than forged (6893ee3)
+- NSF expansion audio: VRC6 (2 pulse + sawtooth), FDS (wavetable + pitch modulator, NSFPlay-exact), MMC5 (2 sweepless pulse + raw PCM), Namco163 (1-8 wavetable channels) — internal chips in Codec.Nes2a03 routed via header flag 0x7B + NSF expansion reuse: VRC7 via Codec.Ym2413 (OPLL core + VRC7 patch ROM overload), Sunsoft 5B via Codec.Ay8910 (StepPrescaler/MixMonoLinear hooks) * NSF/NSFE: expansion tunes now render MONO.wav (rendered_chips=2A03, <chip>) instead of being rejected ! Namco163 multiplex summed-and-averaged (NSFPlay approximation); mix levels NSFPlay-relative not per-cartridge dB (182eb75)
+- Codec.AmrNb (3GPP AMR narrowband, all 8 modes 4.75-12.2 kbit/s; ffmpeg-faithful ACELP, verified 108-113 dB PSNR vs ffmpeg) + Codec.AmrWb (3GPP AMR wideband / G.722.2, all 9 modes 6.6-23.85 kbit/s incl. full high-band synthesis; verified 79-104 dB PSNR vs ffmpeg) + FileFormat.Amr (.amr/.awb + multichannel MC1.0): magic-detected NB/WB, frame-walk decode to MONO/per-channel WAVs ! DTX/SID comfort-noise not synthesized (renders exact-length silence, as ffmpeg does) (80cd499)
+- Codec.HuC6280: PC Engine / TurboGrafx-16 CPU (65C02 superset — block moves TII/TDD/TIN/TIA/TAI, MPR bank mapper TAM/TMA, CSL/CSH, ST0-2, T-flag) + 6-channel wavetable PSG (per-channel L/R pan, DDA, noise, ch5→4 LFO) + HES: renders to stereo PCM via HuC6280+PSG — LEFT.wav/RIGHT.wav channels + lazy TRACK_01 (HES carries no song count → start song only) ! LFO/noise approximations; CSL/CSH flagged but cycle counts not rescaled (2b0713c)
+- Codec.Opl (Yamaha OPL family: YM3526/OPL, YM3812/OPL2, YMF262/OPL3, Y8950 — Nuked-OPL3 port: PG/EG/waveforms, 4-op modes, rhythm, OPL3 stereo panning) + VGM: OPL2 (0x5A), OPL (0x5B), Y8950 (0x5C), OPL3 (0x5E/0x5F) render to PCM — clocks at header 0x50/0x54/0x58/0x5C; merged alongside the YM2151/2203/2608 dispatch ! Y8950 ADPCM (DELTA-T) gated — VGM carries no sample ROM in the common case; FM part renders (8e887f5)
+- Codec.Ym2151 (Yamaha OPM: 8ch 4-op, KC/KF phase gen, LFO saw/sq/tri/noise + PMD/AMD, noise on ch8, per-channel L/R, 8 algorithms) + Codec.Ym2203 (OPN: 3 FM via OPN2-core reuse + SSG via Ay8910) and Codec.Ym2608 (OPNA: 6 FM stereo + SSG; rhythm/ADPCM-B gated) + VGM: YM2151 (0x54), YM2203 (0x55), YM2608 (0x56/0x57) render to PCM — clocks at header 0x30/0x44/0x48 ! YM2608 rhythm (ADPCM-A) + ADPCM-B gated to FM+SSG only (no sample ROM modelled) (55e74ff)
+- MOD/S3M/XM/IT: rendered stereo SONG.wav now also surfaces per-channel SONG_LEFT.wav / SONG_RIGHT.wav (Kind Channel) via PcmCodec split — channels extractable wherever a stereo mix is rendered (0a56594)
+- AudioPseudoArchive: lazy entries — Entry.Lazy(name,kind,factory,declaredSize) renders on Extract only; List uses declared size; result cached per entry (Entry is now a sealed class, eager ctor shape preserved) + NSF/NSFE/GBS/SID/AY/KSS: per-subtune lazy TRACK_nn.wav extraction (stereo renderers → _LEFT/_RIGHT) — each song renders independently on demand + NSFE: full rendering via in-memory NESM-equivalent + NsfPlayer; plst playlist order, time per-song durations, tlbl labels honored * FileFormat.Psm: out Entry? after the Entry struct→class change ! plain KSS (KSCC) carries no subtune table — no per-track list (8d310fe)
+- Codec.TrackerXmIt: FastTracker II XM + Impulse Tracker IT playback — XM linear/Amiga freq, vol/pan envelopes, auto-vibrato, full effect set; IT NNA virtual-channel pool (DCT/DCA), resonant low-pass filter, S-command family + IT214/IT215 sample decompression (schismtracker-faithful, single/double delta + width-change escapes): compressed IT/ITS/ITI samples now decode to WAVs instead of falling back + XM/IT: render SONG.wav (Kind Track) + rendered_* metadata; instrument samples surface as mono WAVs; graceful fallback on any failure ! IT S9x sound-control subset parsed but ignored (surround→centre); MIDI macros not implemented (1d2b7c6)
+- Codec.Tracker: ProTracker MOD + Scream Tracker 3 S3M playback — shared 44100 stereo mixer (16.16 resampler), Amiga period/finetune table, tick/row engine, full effect sets (MOD 0-F + E-subs, S3M A-V + S-subs), deterministic song-length traversal + MOD/S3M: render SONG.wav (Kind Track) from order 0 + rendered_* metadata; instrument samples now surface as mono WAVs (finetune/C2SPD rate, 8->16-bit) instead of raw blobs; graceful fallback to prior surface on any failure (a5eda09)
+- MP4/MOV: each audio track decodes to per-channel TRACKn_<CHANNEL>.wav — AAC (ADTS-wrap from esds ASC), ALAC, MP3, AC-3, FLAC (synth fLaC), Opus (synth Ogg), PCM sowt/twos/lpcm; video stays raw, unsupported tracks keep raw surface + trackN note + Matroska/WebM: per-track decode — A_AAC, A_MPEG/L3, A_AC3/EAC3, A_VORBIS (synth Ogg from xiph-laced CodecPrivate, end-to-end), A_OPUS, A_FLAC, A_PCM, A_MS/ACM (WAVEFORMATEX routing); Xiph/EBML/fixed block-lacing reassembly in MkvDemuxer + AVI: per auds stream decode — PCM, MS-ADPCM, IMA, MP2/MP3, AC-3, A-law/µ-law, EXTENSIBLE SubFormat resolution ! Opus tracks decode to correctly-shaped silence pending Codec.Opus CELT/SILK; MKV zlib/header-strip frame-compression not decoded (dd28508)
+- Codec.Ym2413 (Yamaha OPLL: built-in 15-patch ROM + user patch, 9ch / 6+5 rhythm, KSL/KSR, AM/PM LFOs, half-sine; emu2413-faithful patch table, OPN2-shared log-sin/exp ROMs) + VGM: YM2413 (command 0x51, clock at header 0x10) renders Master System / Mark III FM + MSX-MUSIC logs to PCM alongside SN76489+YM2612 # VGM: regression-pin Game Gear PSG stereo (0x4F) — left-only mask yields zero right-channel energy (9f765f7)
+- Codec.Qoa + .qoa container: QOA slice decode (sign-LMS predict/update, dequant table) incl. encoder for round-trip vectors + Codec.Dfpwm + .dfpwm container: DFPWM1a charge/strength integrator with fs=140 low-pass and anti-jerk (headerless, 48kHz mono convention) + Codec.Bonk + .bonk container: intlist/Rice decode, lattice predictor, mid-side, multi-packet; length-prefixed-filename header handled by tag scan + Codec.WavArc + .wa container: 0CPY/1DIF block decode byte-exact ! WavArc 2SLP/3NLP/4ALP/5ELP adaptive-LPC paths degrade to FULL-only (gated, unverified arithmetic) (39b41ef)
+- SID: full model matrix — per-chip 6581/8580 flags (v2 bits 4-5, v3 bits 6-7, v4 bits 8-9), 6582 alias resolving to 8580, 'like SID #1' inheritance + SID: 2SID/3SID — secondSID/thirdSID address routing with validation ($42-$7E/$E0-$FE even), LEFT/RIGHT/CENTER per-chip WAVs + SID: unknown/either model renders both legs as *_6581.wav/*_8580.wav (20s per leg, 30s single) # SID: CIA timer writes at $DC04/$DC05 no longer swallowed by the SID address window (f5c886e)
+- Codec.CriHca + .hca container: masked/unmasked header, CRC-16, ATH 0/1, cipher types 0/1, scalefactor/intensity dequant, HFR, 128-band IMDCT; per-channel WAVs (keyed cipher 56 and MS-stereo degrade to FULL.hca + metadata note) + ADX: AHX streams (encoding 0x10/0x11) now decode via MPEG-2 LSF Layer II to MONO.wav instead of being rejected (41925d9)
+- Codec.Sbc (Bluetooth SBC + mSBC: CRC-8 EBU, loudness/SNR bit allocation, 4/8-subband fixed-point polyphase synthesis) + raw .sbc/.msbc container with per-channel WAVs + Codec.Siren (G.722.1/Siren7: region categorization, SQVH decode, length-320 IMLT) + .sir/.g7221 container + Codec.S302M (SMPTE 302M AES3: bit-reversed 16/20/24-bit subframe extraction, exact-inverse encode for round-trip vectors) ! Siren14 (G.722.1 Annex C) not implemented — no reference decode path in ffmpeg to port (a615b19)
+- Musepack SV7 ('MP+') decode: mpc7 VLC books, idx_to_quant, scalefactor DPCM, MS-stereo through the shared SV8 synthesis filterbank; .mpc descriptor surfaces SV7 per-channel WAVs + Codec.WmaLossless (0x0163): CDLMS/MCLMS adaptive prediction, AC filter, rawpcm bypass, wired into ASF next to WMA v1/v2/Pro + Codec.Xma: XMA1/XMA2 2KB-packet parsing + per-stream WMAPro orchestration; XWB tag-1 entries route through it ! full XMA stream decode gated to graceful raw-blob fallback (needs WMAPro packet-state re-plumbing) (41bf332)
+- Codec.Atrac1 (MiniDisc ATRAC1: BFU spectral decode, IMDCT 32/128/256, two-stage inverse QMF) + .aea container surfacing FULL.aea and per-channel WAVs + Codec.Ra288 (RealAudio 28.8: G.728 hybrid-window backward LPC, 38-byte frames) wired into RealMedia as fifth decode path + Codec.Ralf (RealAudio Lossless: adaptive LPC + Golomb residuals, 5 decorrelation modes) wired into RealMedia as sixth decode path (5b5b36b)
+- Bink audio codec (RDFT + DCT flavours, ffmpeg binkaudio port) and .bik container: FULL.bik + raw VIDEO track + per-track decoded channel WAVs (Bink2/KB2 audio surfaced as raw blob) + Smacker audio codec (SMKA huffman-tree delta decode) and .smk container: FULL.smk + raw VIDEO track + per-track channel WAVs incl. uncompressed PCM tracks ! Bink-audio-in-Smacker tracks remain blob-only (c4ac068)
+- Codec.AdpcmX: ffmpeg ADPCM/DPCM variant pile — IMA DK3/DK4/EACS/SEAD, EA R1/R2/R3, THP/THP-LE + AFC, SWF, 4XM, Xan DPCM, Interplay DPCM, SDX2, DERF, Gremlin * AST: AFC-coded (codec 0) streams now decode to per-channel WAVs via Codec.AdpcmX instead of FULL-only fallback (f58db07)
+- Codec.GameBoyApu: full SM83 CPU + Game Boy APU (sweep/duty pulses, 32x4-bit wave RAM, 15/7-bit noise LFSR, 512 Hz frame sequencer, NR51 stereo routing) + GBS player (MBC banking, timer-driven rates) — GBS tunes render LEFT/RIGHT.wav (2d688a1)
+- Codec.Z80: reusable full Z80 core (CB/ED/DD/FD incl. DDCB, block ops, alternate set, IM 0/1/2 IRQ injection, exact documented flags) + Codec.Ay8910: AY-3-8910/YM2149 (all 10 envelope shapes, log DAC, 17-bit noise, ABC panning) + ZX Spectrum AY and MSX KSS tunes render LEFT/RIGHT.wav (PSG capture via $FFFD/$BFFD and $A0/$A1; SCC/FMPAC tunes render PSG-only with a note) (6f1ba94)
+- Codec.Nes2a03: NES APU synthesis on the shared Mos6502 core (duty pulses with sweep negate difference, triangle, dual-mode noise LFSR, DMC bus-fed delta playback, verbatim nonlinear mixer tables) + NSF player (bankswitching, NTSC/PAL, speed words) — NSF tunes render the start song to MONO.wav; expansion-chip tunes name the blocker and fall back (00cb68e)
+- Codec.Spc700: full SPC700 CPU (all 256 opcodes, timers, IPL ROM) + S-DSP synthesis (incremental BRR matching Codec.Brr, verbatim gaussian table, ADSR/GAIN, noise LFSR, pitch modulation, 8-tap FIR echo) — SNES .spc dumps render the tune to LEFT/RIGHT.wav @32 kHz (ID666 duration honored), per-instrument extraction unchanged (46328a9)
+- Codec.Mos6502: reusable NMOS 6502 core (official + stable illegal opcodes, BCD with NMOS quirks, JMP-indirect bug, cycle counting) + Codec.Sid: MOS 6581/8580 synthesis (24-bit accumulators, ring mod, hard sync, noise LFSR taps 22+17, reSID-style ADSR, model-specific filter curves) + PSID player (VBI/CIA timing, PAL/NTSC) — SID tunes render the start song to MONO.wav, model honored from header flags; RSID falls back (3ce8916)
+- Codec.Sn76489 (SEGA PSG: tone/noise LFSR/2dB attenuation, GG stereo) + Codec.Ym2612 (OPN2 FM: genuine die log-sin/exp ROMs, 8 algorithms, feedback, LFO, ch3 special, ch6 DAC) + VGM and GYM render to LEFT/RIGHT.wav when the chip set is covered (command-stream execution incl. DAC data blocks, zlib-packed GYM; unsupported chips stay metadata-only with a note) (6da7095)
+- E-AC-3 (A/52 Annex E, bsid 11-16): full BSI, AHT (GAQ + VQ codebooks + 6-point IDCT), variable block counts, fscod2 half rates, LUT exponent strategies — independent substreams decode to channels; SPX parsed (HF synthesis deferred), enhanced coupling rejected with clear message (a7a54c6)
+- Codec.Dts: DTS Coherent Acoustics core decoder (huffman/block-code/plain sample decode, 4-tap inverse ADPCM, high-freq VQ, real LFE FIR, 32-band QMF; verbatim dcadata tables incl. adpcm_vb 4096x4) — FileFormat.Dts extracts per-channel WAVs; DTS-HD extensions parsed-past info-only # RATE-24 bitrate corrected to the canonical 1536000 (old table carried a non-standard extra entry) (2df767e)
+- Codec.Sipr: RealAudio ACELP.NET (modes 8k5/6k5/5k0: LSF VQ, 1/3-resolution adaptive codebook, sparse fixed codebooks, MA gain prediction, 5k0 postfilter, sipr_swaps descrambling) — fourth decoded RealMedia codec; 16k documented-unsupported (c251415)
+- Codec.WmaPro: WMA 9 Professional (tile/subframe trees, generalized channel transforms to 8ch, vec4/2/1 coefficient VLCs with escapes, 24-bit, VBR reservoir) — ASF tag 0x162 decodes to channels (94ffb0a)
+- HE-AAC SBR: payload parse (all frame classes, 10 huffman tables), frequency-table derivation (master/high/low/noise/limiter + patches), full bitstream-domain HF chain (chirp, covariance prediction, gain limiting); QMF audio reconstruction honestly GATED (LC-core output, doubled-rate metadata) pending the polyphase factorization ! SBR QMF synthesis reconstructs only to ~11% RMS in direct form — gated rather than emitting wrong audio (540d7f0)
+- WavPack IEEE-float decode + encode (FLOAT_INFO, wvx extension stream, denormals/±0/NaN/Inf restoration) — float streams split to format-code-3 channel WAVs (3932dd2)
+- Codec.G7231: ITU G.723.1 dual-rate decoder (MP-MLQ 6.3k + ACELP 5.3k, full postfilter chain, comfort-noise generation, erasure concealment; verbatim tables) with raw .g723 container (b80657b)
+- Codec.Speex: narrowband (all 8 submodes, multicomb enhancer, CNG) + wideband SB-CELP + intensity stereo, verbatim speexdata tables — Ogg descriptor decodes Speex streams (.spx recognized) (77b3dd7)
+- Codec.Musepack: SV8 decoder (verbatim mpc8 huffman/cnk/SCF tables, DSCF deltas, mid/side, 32-band polyphase synthesis) with .mpc channel pseudo-archive (SV7 falls back to FULL + metadata) (f264eef)
+- Codec.Atrac3: Sony ATRAC3 (verbatim ffmpeg tables, gain compensation, tonal components, joint-stereo reverse matrixing, 3-band inverse QMF, RM descrambling) — OMA codec-id-0 and RealMedia atrc streams decode to channel WAVs (ATRAC3plus stays surfaced-only) (29c2828)
+- Codec.Cook: RealAudio G2 transform codec (verbatim cookdata tables, gain envelopes, categorize/expand, sqvh unpack, LFG dither, joint-stereo decoupling, inverse MLT) with Int0/Int4/genr deinterleavers — RealMedia cook streams decode to channel WAVs (662cffb)
+- Codec.Ac3: full ATSC A/52 decode — parametric bit allocation (decay/gain/floor/lowcomp/hth + delta), D15/D25/D45 exponents, channel coupling, rematrixing, all mantissa quantizers + dither, dual IMDCT — FileFormat.Ac3 now extracts per-channel WAVs (E-AC-3 stays info-only) (55eac4a)
+- Vorbis floor type 0: LSP header/packet decode + bark-mapped curve synthesis per spec §6.2 — the decoder's last documented gap + synthetic end-to-end Vorbis vectors (hand-assembled codebooks/modes, blocksize 64) give positive decode coverage for BOTH floor types (fc852f4)
+- Codec.Wma: WMA v1/v2 decoder (LSP + VLC exponents, bit-reservoir superframes, noise coding, MS stereo; tables extracted from authoritative sources) + ASF packet depayloader: full Data Object parsing (length-typed fields, multi/compressed payloads, fragment reassembly) — per-stream blobs replace the whole-data dump; WMA streams decode to channel WAVs (1376512)
+- AAC-LC decode completed: spectral Huffman codebooks (values derived from codeword indices), scalefactors, sections, TNS, PNS, intensity + M/S stereo, EIGHT_SHORT grouping, sine/KBD windowed IMDCT — real ADTS streams decode to channels # unsigned-codebook table was wrong in the stub (3,4,7,8,11 per IS_CODEBOOK_UNSIGNED) ! SBR payloads ignored (LC core decoded); Main/SSR/LTP/CCE/LATM still rejected (295309c)
+- Codec.Lpc10: FS-1015 LPC-10e 2400 bit/s vocoder (54-bit frames, Levinson-Durbin lattice; simplified AMDF pitch tracker documented) with raw container + DTS and AC-3/E-AC-3 raw-stream descriptors: full header/table parse (AMODE/acmod layouts, rates, bitrates, frame counts, duration) + Sony OMA/AA3: ea3 tag + EA3 header, ATRAC3/3plus/MP3/LPCM identification, payload as Stream (b9d09d6)
+- chiptune pseudo-archives: NSF/NSFE (expansion-chip flags), GBS, SID (PSID/RSID, clock + SID model), KSS (KSCC/KSSX), HES, GYM (GYMX, packed logs, duration), AY (bounds-checked pointer chase) (24bff0a)
+- classic PC-game audio: Westwood AUD (WS-ADPCM + continuous IMA, 0xDEAF chunks, assembles), id RoQ (square-table DPCM enc+dec, assembles), Sierra SOL (3 magics, old/new DPCM + 16-bit, assembles), CRYO APC (seeded IMA) (7ebd95f)
+- Codec.InterplayAcm (verbatim filler/juggle port) with .acm pseudo-archive + Codec.Nellymoser (verbatim tables + direct IMDCT) with raw .nelly container (139d6d2)
+- sequenced-music pseudo-archives: VGM/VGZ (named chip clocks, GD3 UTF-16 tags, transparent gzip), MUS→MIDI (Doom mapping), XMI→MIDI (duration-scheduled note-offs), CMF (OPL patches + SMF wrap) (7165477)
+- Codec.Ra144 (RealAudio 14.4 lpcJ, ffmpeg tables extracted verbatim) — RealMedia lpcJ streams + raw .ra v3 now decode to WAV channels + Codec.TrueSpeech (DSP Group, verbatim table port) — WAV format tag 0x0022 decodes (d50538f)
+- Codec.MonkeysAudio: APE lossless (exact-spec MAC descriptor/header/seek-table; level-1000 order-16 LMS predictor + range-coded residuals; carry-counting coder documented as self-consistent) — levels 2000+ fall back + APE descriptor surfaces decoded per-channel WAVs with graceful fallback (8e17e6c)
+- XWB (XACT wave bank v43+: PCM + MS-ADPCM samples, XMA/WMA noted), BWAV (Switch: DSP-ADPCM/PCM16 with assemble), SWAV (NDS: PCM8/16 + IMA with assemble), SDAT (NDS sound archive: SWAV/SWAR decoded, SSEQ/SBNK/STRM surfaced) (75c36a2)
+- ASF (.asf/.wma/.wmv) container pseudo-archive: object walk, stream/codec info, content + extended tags, Data Object as Stream blob + RealMedia (.rm/.rmvb/.ra) container pseudo-archive: PROP/MDPR/CONT/DATA walk, per-stream payload blobs with codec FOURCC, raw .ra v3/v4/v5 (0a24655)
+- Codec.Mace (Apple MACE 3:1/6:1, ffmpeg-faithful incl. historical clip quirk) with classic Mac 'snd ' resource pseudo-archive (standard/extended/MACE headers) + vintage PC/research containers: Sounder (.sndr), SoundTool (.sndt), ESPS (.sd, record_freq generic, both endiannesses) (9029286)
+- Codec.EaXa (Electronic Arts EA-XA ADPCM incl. 0xEE raw frames) with EA SCHl stream pseudo-archive (PT-table parse, SCDl blocks, assemble) + Codec.WwiseIma (MS-IMA block layout) with Wwise .wem pseudo-archive (IMA/PCM decode, Wwise-Vorbis falls back) (fac883a)
+- sampler/vintage formats: XI (FT2 instrument, delta samples, per-note rates), SDS (MIDI sample dump, septet unpacking), TXW (Yamaha 12-bit packed, with Create), HCOM (Mac Huffman-delta per sox, with encoder + Create) (8120f29)
+- Codec.AicaAdpcm: Yamaha AICA / ADPCM-B (Dreamcast) encode + decode with raw .aica container + VOC Creative ADPCM completed: 2.6-bit (3-3-2 packing) and 2-bit codecs decode — only A-law/µ-law VOC payloads remain raw (83c546f)
+- Amiga/Impulse sample pseudo-archives: MED (OctaMED), OKT (Oktalyzer), ULT (UltraTracker), 669, ITS + ITI (Impulse sample/instrument; IT215-compressed falls back) (1c0fbb7)
+- full ITU G.726 rate set (16/24/40 kbit; 7-41 dB SNR ladder) + Codec.G722 (QMF sub-band ADPCM @64kbit) + Codec.Cvsd (syllabic delta modulation) with raw .cvsd container; Sun .au encodings 24/25/26 decode now (92083ca)
+- DOS tracker sample pseudo-archives: MTM, FAR, STM, PTM (8-bit delta), AMF (DSMI v10-14), PSM (MASI DSMP delta) — samples as playable WAVs with per-sample rates (b1be324)
+- Nintendo stream family: BCSTM (3DS), BFSTM (WiiU BE + Switch LE), AST (PCM16BE; AFC falls back), HPS (HALPST linked blocks) — channel pseudo-archives over Codec.DspAdpcm with assemble (3db1dcf)
+- Codec.WavPack: v4/v5 lossless block codec (spec-faithful framing/flags/medians/decorrelation; encoder bit-locked to decoder — reference streams fall back gracefully) + WavPack descriptor surfaces decoded per-channel WAVs with graceful fallback (5f3c383)
+- MAUD (Amiga IFF; A-law/µ-law payloads), SMP (SampleVision), PAF (Ensoniq PARIS, both endiannesses incl. 24-bit packed), PVF (mgetty, binary + ASCII) channel pseudo-archives — all with assemble (fee7076)
+- Codec.XaAdpcm: CD-ROM XA / PlayStation streaming ADPCM (sound groups, unit nibble interleave, 4-bit enc+dec, 8-bit decode) + XA (.xa) channel pseudo-archive: RIFF/CDXA + raw synced/Mode-2 sectors, first-stream selection, 37.8/18.9 kHz; assembles valid audio sectors (ab9d32f)
+- Codec.Brr: SNES S-DSP BRR (filters 0-3, 15-bit hardware wrap, encode + decode) + BRR (.brr) channel pseudo-archive (loop-header tolerant) and SPC (.spc) sample pseudo-archive: walks the DSP sample directory in ARAM, extracts every BRR instrument as WAV, ID666 tags (a7ccb56)
+- Codec.CriAdx: CRI ADX ADPCM (highpass-derived coefficients, encode + decode, encrypted/AHX rejected) + ADX (.adx) channel pseudo-archive: per-channel WAVs, FULL-only fallback for encrypted streams; assembles from per-channel WAVs (d21c5f4)
+- Codec.Alac: Apple Lossless decode + spec-shaped encoder (adaptive Rice, dynamic predictor, invertible mid/side; 16/24-bit byte-exact round-trips, escape frames) + FileFormat.Alac surfaces decoded per-channel WAVs (graceful fallback keeps the FULL/Track/Tag view) (799e4fe)
+- raw G.711 channel pseudo-archives (.al / .ul): headerless A-law/µ-law, decode + re-encode assemble + CAF ulaw/alaw payloads decode to per-channel WAVs + PcmCodec.SplitInterleavedFloat + WAV IEEE-float (32/64-bit) channel split honoring speaker masks (65095fb)
+- MPEG-1/2 Layer I + Layer II decode in Codec.Mp3 (minimp3-style L12 port: allocation tables, scfsi, grouped dequantization, intensity joint stereo, shared polyphase synthesis) — .mp2/.mp1 now decode to per-channel WAVs (279769b)
+- Codec.DspAdpcm: Nintendo GC/Wii DSP-ADPCM (canonical frame decode + normal-equations predictor-fit encoder) + BRSTM (.brstm) channel pseudo-archive: big-endian RSTM parse, per-channel coef tables, block de-interleave with continuous ADPCM history; assembles from per-channel WAVs (6a9104d)
+- SoundFont 2 (.sf2) sample pseudo-archive: every shdr sample as a mono WAV at its own rate, INFO tags, ROM/EOS skipped + DLS (.dls) sample pseudo-archive: wvpl waves rewrapped as standalone WAVs, INFO tags (02d341a)
+- Codec.SpuAdpcm: Sony PS1/PS2 SPU ADPCM (decode + brute-force-filter encoder) + VAG (.vag) channel pseudo-archive: big-endian VAGp header, MONO channel decode; assembles from a mono WAV (f544dc8)
+- AIFC 'ima4' decode: QuickTime IMA ADPCM packet variant in Codec.ImaAdpcm, wired into AIFF channel split + Codec.G72x: ITU G.726 @ 32 kbit (G.721) decode + encode (CCITT reference port); Sun .au encoding 23 now decodes to channels # VOC Creative 4-bit ADPCM (codec 1) decodes to PCM (ffmpeg ADPCM_CT semantics); codecs 2/3 remain FULL-only (6c2b12b)
+- Codec.Tta: True Audio TTA1 lossless codec (order-8 adaptive filter + two-state Rice, frame CRCs; decoder ported from the reference, encoder algebraically inverted; 8/16/24/32-bit, byte-exact round-trips) + TTA (.tta) channel pseudo-archive: per-channel WAVs up to 5.1+, assembles from per-channel WAVs (3a35938)
+- Codec.Shorten: SHN v2 lossless codec (decoder incl. QLPC best-effort; encoder with DIFF0-3 selection; byte-exact round-trips) + Shorten (.shn) channel pseudo-archive: per-channel WAVs (rate unknown, assumed 44100 + noted), assembles from per-channel WAVs (a5435a8)
+- DSF (Sony DSD) channel pseudo-archive: block-de-interleaved per-channel raw DSD streams + decimated PCM WAVs + ID3 tag; assembles bit-exact from per-channel .dsd inputs + DFF (DSDIFF) channel pseudo-archive: byte-round-robin de-interleave, CHNL speaker-ID mapping, DST falls back to FULL; assembles bit-exact (66e4b51)
+- Codec.OkiAdpcm: OKI/Dialogic 4-bit ADPCM (decode + symmetric encoder) + Dialogic VOX channel pseudo-archive (headerless, 8 kHz mono; assembles from a mono WAV) + raw GSM 06.10 (.gsm) channel pseudo-archive via Codec.Gsm610 (DecodeRaw/LooksLikeRawFrames helpers; graceful fallback) (acb1fbe)
+- IFF/8SVX (Amiga) channel pseudo-archive: VHDR/CHAN/BODY parse, Fibonacci-delta decode, planar-stereo split, IFF text tags; assembles from per-channel WAVs + AVR (Audio Visual Research) channel pseudo-archive: 128-byte BE header, sign/width normalization; assembles from per-channel WAVs (a1a4356)
+- NIST SPHERE (.sph) channel pseudo-archive: ASCII object header, ulaw/alaw via G.711 codecs + BE/LE PCM, embedded-shorten falls back to FULL; assembles from per-channel WAVs + IRCAM/BICSF (.sf) channel pseudo-archive: byte order from magic, 8/16-bit + 32-bit float channels, assembles from per-channel WAVs (b871bfa)
+- explicit speaker-mask channel naming: WAV/Wave64/RF64 read WAVE_FORMAT_EXTENSIBLE dwChannelMask, CAF reads the UseChannelBitmap chan chunk, and per-channel WAVs are named for their real speakers + multi-channel split + assemble now covers any channel count: 22.2 (24ch) splits into named mono WAVs and reassembles losslessly from shuffled per-channel inputs; unmapped counts (e.g. 32ch) use CH_n * WAV/AIFF/AU/CAF/Wave64/RF64/VOC assemble ordering delegates to ChannelLayout.OrderIndex (top/bottom-layer speakers no longer unsortable) (3f9b1fd)
+- ChannelLayout: FFmpeg-faithful speaker model (canonical AVChannel/WAVE-mask bit names, default layout per channel count from mono through 5.1.4/7.1.4/9.1.6 up to 22.2, CH_n fallback beyond) with explicit-bitmap naming and canonical assemble ordering * PcmCodec.LayoutNames delegates to ChannelLayout; SplitInterleavedPcm gains an optional speaker-mask parameter * 3-channel default is now 2.1 (FL FR LFE) and 4-channel is 4.0 (FL FR FC BC), matching av_channel_layout_default (a4beb79)
+- AAC (ADTS) channel pseudo-archive: decodes AAC-LC via Codec.Aac and surfaces FULL.aac + per-channel WAVs (graceful FULL-only fallback for unsupported profiles) (db11a5f)
+- Opus (Ogg) channel pseudo-archive: decodes via Codec.Opus and surfaces FULL.opus + per-channel WAVs (graceful FULL-only fallback); explicit-lookup descriptor (no magic clash with Ogg) (718434f)
+- OGG channel split: decode Vorbis/Opus via Codec.Vorbis/Codec.Opus and surface per-channel WAVs (graceful fallback to raw packet blobs) (7464cf8)
+- MP3 channel split: decode MPEG audio via Codec.Mp3 and surface per-channel WAVs (graceful FULL-only fallback when the decoder can't handle the input) (ffdc006)
+- Wave64 (.w64) channel pseudo-archive: parses GUID-keyed chunks with 64-bit sizes, surfaces FULL.w64 + per-channel WAVs + metadata; IArchiveCreatable writes a Wave64 from per-channel mono WAVs (b24074e)
+- Creative Voice (.voc) channel pseudo-archive: walks VOC blocks (legacy type-1 + modern type-9), decodes 8/16-bit PCM, surfaces FULL.voc + per-channel WAVs + text/metadata; IArchiveCreatable writes a .voc from per-channel mono WAVs (fdd8d82)
+- RF64 / BWF (Broadcast Wave) channel pseudo-archive: resolves 64-bit sizes via the ds64 chunk, surfaces FULL.rf64 + per-channel WAVs + bext/metadata; IArchiveCreatable writes a conformant RF64 from per-channel mono WAVs (6a6ef75)
+- CAF (Apple Core Audio Format) channel pseudo-archive: reads caff/desc/data, surfaces FULL.caf + per-channel WAVs + metadata chunks; IArchiveCreatable assembles a CAF from per-channel mono WAVs (4321749)
+- Sun/NeXT .au assemble (IArchiveCreatable): build a multi-channel .au from per-channel mono WAV inputs + AuWriter: 24-byte big-endian header + big-endian linear PCM writer (19b9966)
+- AIFF assemble (IArchiveCreatable): build a multi-channel AIFF from per-channel mono WAV inputs + AiffWriter: minimal FORM/AIFF (COMM + SSND) writer with the inverse 80-bit extended-float sample-rate encoder (1ba0d99)
+- PcmCodec.Interleave: weave per-channel mono PCM into one interleaved buffer (inverse of SplitInterleavedPcm) — enables assembling multi-channel audio from channels + AudioPseudoArchive helper: shared List/Extract/ExtractEntry projection for audio containers surfaced as channel archives * WavFormatDescriptor.Create uses PcmCodec.Interleave instead of an inline weave loop (9a9e0a8)
+- DragonFS (Libdragon N64) WORM writer (IArchiveCreatable): DragonFS tag + 32-byte directory records + contiguous file data; round-trips (bacddcc)
+- CbmNibble (G64) WORM writer (IArchiveCreatable): real 1541 GCR codec + G64 framing over a D64Writer-built image; round-trips via GCR decode (87e1040)
+- EROFS WORM writer (IArchiveCreatable): compact inodes + FLAT_PLAIN data + erofs_dirent directory blocks with nested dirs; round-trips (uncompressed) (0d1b120)
+- LittleFS WORM writer (IArchiveCreatable): metadata-pair commit log + CTZ skip-lists/inline files + nested dirs, with a real commit-walking LittleFsReader; round-trips (38b0c16)
+- MinixV2 WORM writer (IArchiveCreatable): Minix v2 image (32-bit zones, triple-indirect), fsck.minix-clean + round-trips (8610b70)
+- MinixV1 WORM writer (IArchiveCreatable): builds a spec-correct Minix v1 image with nested directories, validated fsck.minix-clean and round-trips (fc8ea7c)
+- Acronis FileMeta record-chain framing reverse-engineered; chain walk anchors Listing entries to RecordIndex via the spec-grounded MetaOffset path, cross-validates against the legacy sequential-pairing heuristic, and catches reordering that pairing silently misses (5180f3b)
+- Paragon PBF partial chunk layout reverse-engineered; structured-header parse + Wave-13 audit persisted (a000a10)
+- AOMEI Backupper (.adi / .afi) R/W via BIFH / BIFT outer container + BR_STANDARD_HEADER tagged-record framing — reverse-engineered from the vendor's kernel + user-mode image-format library + AomeiConstants: BIFH / BIFT flags + sizes (0x65C / 0x674) + StandardHeader 12-byte prefix + the four confirmed INFO_TYPE_* enum values (0x105 COMPRESS / 0x106 ENCRYPT / 0x107 PASSWORD / 0x10C BACKUP_TYPE) + the literal "AomeiTech.SchduleTask" scheduled-task magic-password constant (sic spelling) + BrCrc32: wraps Compression.Core.Checksums.Crc32 with the zeroed-CRC-field protocol that BIFH / BIFT / BR_STANDARD_HEADER all use; standard zlib CRC-32 + BrStandardHeader: read / write / Seal / Verify the 12-byte {Size, Type, Reserved, Crc32} tagged-record prefix; SealCrc patches the on-disk CRC field in place, VerifyCrc rejects any tampered byte + BrFileHead / BrFileTail: 0x65C-byte BIFH and 0x674-byte BIFT structs with Flag + Size + Crc32 verification; BuildEmpty() emits a sealed all-zero-body container — the head / tail body layout past the first 12 bytes is documented-TODO and kept zero rather than forged + AomeiInfoRecord: typed views for COMPRESS / ENCRYPT / PASSWORD / BACKUP_TYPE; password is MD5 of UTF-16LE passphrase per the verifier check; produces sealed BR_STANDARD_HEADER records ready for emit + AomeiWriter / AomeiReader: full round-trip via vendor-namespace 0xF001 user-data envelope so user inputs are surfaced byte-identically through our own reader; INDEX_TYPE_DATABLOCK / DATAAREA framing is documented-TODO and not forged + AomeiFormatDescriptor: implements IArchiveCreatable; Create / List / Extract round-trip honors the four INFO records; Description names the four documented-TODO scopes (head / tail body fields past first 12 bytes, INDEX_TYPE_* body layouts, AES variant + IV derivation, IOCTL_AMBAK_GET_BLOCK numeric) + AomeiRwTests: 23 new tests covering BRCrc32 vectors, BR_STANDARD_HEADER round-trip + tamper detection, BIFH / BIFT CRC sealing, INFO record encode / decode, full writer→reader round-trip with all four INFO records, user-data envelope round-trip, descriptor Create / List / Extract round-trip, password MD5 metadata emission, head / record CRC corruption detection, truncated / short-header / zero-size-record defensive walks; AomeiTests updated for the richer ParseStatus values (ok / header_short / magic_ok_crc_failed / tail_missing / tail_invalid) ! Out-of-scope: byte-compat with AOMEI Backupper itself requires the head / tail body field layouts past byte 12 and the INDEX_TYPE_DATABLOCK / DATAAREA encoding, both currently undocumented; encryption advertises via INFO_TYPE_ENCRYPT and emits the MD5 password verifier but payload bytes are stored verbatim rather than fed through speculative AES (ac147de)
+- Backup-format deep-RE wave — squashed 9 incremental commits into one logical grouping (5909a23)
+- Acronis classic .tib R/O file listing via record stream; Blob extraction blocked by proprietary block codec (b273aba)
+- Shrink (method 1), Reduce (methods 2-5) and Implode (method 6) building blocks, exposing the legacy PKWARE ZIP compression methods through the CompressionWorkbench registry with a self-describing length/parameter header + round-trip tests for the ZIP legacy building blocks covering empty, single-byte, text, repeating patterns, long runs and random data plus header/metadata checks (5285e6f)
+- Norton Ghost (modern 11.x/12.x) R/W via reverse-engineered Fast LZ Z1 + zlib Z3-Z9 codecs + CRC-16 stream cipher; legacy DOS-era Ghost 4-7 stays Stage-0 with version-gated diagnostic fallback (27e00bb)
+- partclone (Clonezilla backup format) — image_head/fs_info/bitmap parser, sector reconstruction; R/O (180f6d1)
+- Apple sparseimage + sparsebundle (Time Machine / hdiutil) — band-allocation table parsing, inner HFS+/APFS delegation; R/O (b6d65bf)
+- BKF (Microsoft NTBackup / MTF Tape Format) — DBLK-chain parser, FILE+DATA entries, magic TAPE@0; R/O (af91a1a)
+- VmdkStream sparse grain-on-write allocation + VmdkStream.Write: writes to unallocated grains now lazily allocate a fresh   grain (and the owning grain table, when none exists yet) at the sector-   aligned end of the backing stream, zero-fill it, and update the grain   directory + grain table entries on disk so subsequent reads see the new   region + VmdkStream caches per-GD-index grain table byte offsets on Open and the   grain directory offset so AllocateGrain can update the right slot without   re-reading the GD * VmdkStream: throw shape on write is now InvalidOperationException for   out-of-range grains (instead of NotSupportedException for unallocated),   matching the rest of the VHD/Qcow2/VDI sparse streams which already   allocate on demand + DiskImageNestingTests.VmdkDescriptor_Add_FsImageAtRoot_OnSparseVmdk_   AllocatesGrainsAndPartition: end-to-end gate — sparse VMDK with reserved   zero region past Partition 1 now accepts a root-level FAT image drop   through the descriptor's Add, lands it as Partition 2, and List() walks   the new partition's NEW.TXT (b213e2e)
+- Partition-aware Add/Remove for virtual-disk descriptors + PartitionedDiskLister.TryAdd: dispatches by input name shape. Inputs named   PartitionN_<TypeName>/<inner> open a writable PartitionWindowStream into   partition N and delegate Add to the inner FS's IArchiveModifiable. Inputs   with no Partition prefix are treated as a raw filesystem image — InnerFsDetector   maps the magic to a PartitionType, PartitionEditor.AddPartition writes a new   primary/GPT entry past the highest existing partition, and the image bytes   are written + sector-padded into the new partition window + PartitionedDiskLister.TryRemove: PartitionN_<TypeName>/<inner> deletes an   inner-FS entry via the partition's IArchiveModifiable; PartitionN_<TypeName>   or .raw deletes the whole partition via PartitionEditor.DeletePartition * PartitionWindowStream: now read/write — Write clamps to [0, length) and   throws IOException on overshoot; SetLength rejects extensions but accepts   shrinks as no-ops; Flush forwards to the underlying stream * VhdFormatDescriptor / VhdxFormatDescriptor / VmdkFormatDescriptor /   Qcow2FormatDescriptor / VdiFormatDescriptor: Add and Remove try the   partition-aware path first; InvalidOperationException (cap full, no free   space, missing inner FS modifier) propagates honestly. Other failures fall   through to the pre-existing single-FS-modifier and rebuild paths + DiskImageNestingTests: VmdkDescriptor_Add_PrefixedPath_DelegatesToInnerFs   exercises partition-prefixed Add; VmdkDescriptor_Remove_PrefixedPath drops   a file from a partition; PartitionedDiskLister_TryAdd_FsImageAtRoot lands   a second FAT image as a new MBR partition (raw disk stream — sparse VMDK   grain allocation is out of scope for the lister) ! Known scope: sparse VMDK / dynamic VHD throw on writes to unallocated   grains, so descriptor-level Add of a brand-new partition past the last   allocated region falls through to the legacy rebuild path. Fully-allocated   (fixed) VHD and raw disks land the new partition immediately (3a9d4a6)
+- Partition-aware archive surface for virtual-disk descriptors (VHD/VHDX/VMDK/Qcow2/VDI) + PartitionedDiskLister: when an MBR or GPT partition table is detected on the guest   disk, List() returns entries prefixed with PartitionN_TypeName/ and Extract() writes   each partition's inner FS into a per-partition subdirectory; falls back to the existing   single-FS-at-offset-0 path when no partition table is present + PartitionWindowStream: read-only sub-range view over a disk stream so the inner FS   reader sees position 0 = partition start (used by the lister to delegate List/Extract   per partition through InnerFsDetector) * VhdFormatDescriptor / VhdxFormatDescriptor / VmdkFormatDescriptor / Qcow2FormatDescriptor /   VdiFormatDescriptor: List() and Extract() try the partition-aware path first; unpartitioned   disks keep the previous direct single-FS delegation * AutoExtractor: reconstruct the legacy PartitionTable summary from the new   PartitionN_TypeName/ entry-name prefix so existing consumers (and tests) keep working   even though the disk descriptor no longer dumps a single disk.img blob + DiskImageNestingTests: VmdkDescriptor_List/Extract_PartitionedDisk_* exercise the   new partition-aware path end-to-end; VmdkDescriptor_List_UnpartitionedDisk_*   pins that unpartitioned images still delegate straight to the inner FS without   a synthetic Partition wrapper (cdd95cd)
+- repo meta per house standard: AGENTS.md, .editorconfig (e11a18e)
+- Jfs full-scope mutation past leaf-only (arbitrary path depth + long names via continuation slots + external dtree leaf insert/delete + recursive subdir removal + multi-dmap allocation); fsck.jfs accepts mutated images for short-name scenarios (7667ccc)
+- ReiserFs full S+tree mutation: nested paths, INDIRECT-item bodies, leaf split/merge, root tree-height growth — every previously-NotSupportedException branch now accepted, reiserfsck-clean for every mutated image * ReiserFsModifier: collapsed to read-modify-rebuild via the multi-leaf writer; the prior hand-written leaf-only splice path mis-hashed inserted dirents (R5-by-luck) and threw on every interesting case + ReiserFsWriter: INDIRECT items with dedicated data blocks past the tree for bodies > 1 KB; bitmap, s_block_count, s_bmap_nr, s_free_blocks all extended; sd_blocks credits data blocks to the owning file + ReiserFsReader.Extract: handles INDIRECT items (concatenate data blocks by offset, truncate by sd_size); previously skipped them and returned only DIRECT bytes + ReiserFsFullScopeMutationTests (9 in-process tests): nested paths, shared parent reuse, INDIRECT large body, non-aligned tail truncation, mixed DIRECT+INDIRECT, leaf split, leaf merge, tree-height growth at 1000 files, interleaved add/remove/replace + ReiserFsPostMutationExternalTests (6 WSL-gated tests, Category=ExternalInterop): PostAdd / PostRemove / PostLeafSplit / PostLeafMerge / PostNested / PostLargeFile — every mutated image passes 'reiserfsck --check' clean * ReiserFsFormatDescriptor.Description: reflects new full-scope IArchiveModifiable surface (94fb429)
+- F2fs full NAT/SIT block rewrite + regular dentry blocks past leaf-only scope; fsck.f2fs accepts mutated images + F2fsModifier: curseg overflow now promotes a free main-area segment of the right CURSEG_* type with SIT type-tag + journal mirror refresh (replaces the NotSupportedException for WARM_DATA/WARM_NODE exhaustion) + F2fsModifier: inline-dentry overflow now converts the root in place to a regular block-based dentry directory — allocates a HOT_DATA block, migrates every existing inline dentry into the 214-slot block layout, clears the inline flag, points i_addr[0] at the new block, updates i_size/i_blocks/SIT/SSA so fsck cross-checks pass + F2fsModifier: subsequent Adds against a non-inline root walk i_addr[] looking for a free slot, allocating a new HOT_DATA block per 214 entries and bumping i_size + i_blocks accordingly; Remove now walks block-dentry storage too + F2fsModifier: WriteCheckpoint now mirrors per-block summary entries into the CP pack — data summaries packed into the compact summary block (block 1) at offset 2*SUM_JOURNAL_SIZE for HOT/WARM/COLD_DATA cursegs, and node summaries written into CP blocks 2/3/4 for HOT/WARM/COLD_NODE cursegs. Without this fsck.f2fs's get_sum_block seeded curseg->sum_blk from empty buffers and rejected every reachable block as 'Invalid data/node seg summary' * F2fsModifier: NAT/SIT journal full no longer throws — falls through to the on-disk NAT/SIT entry we already wrote (f2fs-tools treats the journal as overrides over disk, so a missing journal entry simply reads from disk) * F2fsFormatDescriptor: Description and module-level remark updated to reflect the post-leaf scope (full NAT/SIT block rewrite + regular dentry blocks on overflow); remaining out-of-scope branches name what specifically is unsupported (subdirectory creation, nested removal, multi-level indirect inode trees, main-area-segment growth) + F2fsFullScopeMutationTests (4 in-process): Add past inline + NAT journal capacity, mixed add/remove across the block-dentry boundary, many medium files past journal, add-remove-all-add wave round-trip + F2fsPostMutationExternalTests (3 WSL-gated, Category=ExternalInterop): PostAdd / PostRemove / PostMixed each runs real fsck.f2fs -f --dry-run inside WSL and asserts exit 0 with no [Fail] or inconsistency markers - F2fsModifyTests.Add_JournalOverflow_ThrowsClean retired; Add_PastJournalCapacity_SucceedsViaOnDiskNat now verifies the new round-trip behaviour (931dab2)
+- Apfs full-scope B-tree mutation (omap split + FS-tree split + multi-component paths + tree height growth); internal structural validator + apfs-fuse check (best-effort, no Linux fsck_apfs) (51b07cf)
+- NTFS writer mirrors boot sector at last volume sector; ntfsfix -n now reports clean (Processing of $MFT/$MFTMirr OK, alternate boot sector OK), ntfsinfo reads $Volume label + version 3.1, ntfsls enumerates files * NtfsExternalConformanceTests: tightened assertions (require ntfsfix exit=0 + $MFT/$MFTMirr OK message, require ntfsinfo exit=0 + CWB-NTFS label + version 3.1, require ntfsls exit=0); removed stale "deferred scope: records 1-15 missing" doctrine — records 0-15 all emit since the writer's first commit (5280a8c)
+- MS LZH dynamic Huffman trees (effort 2+ emits dynamic block when smaller than static; bit-compatible decoder) (b4ae0d8)
+- FAT external-conformance gate (fsck.fat + mtools mdir via WSL) (d83ddf2)
+- ext external-conformance gate (e2fsck + debugfs ls via WSL) (b3bdb6c)
+- Zstd + LZ4 external-interop gates (bidirectional with zstd / lz4 CLIs); failures highlight codec gaps for follow-up (533bf44)
+- FLAC external-interop gate (flac -d + flac -8 + ffmpeg + flac --test); failures highlight codec gaps for follow-up (ee74ffe)
+- DblSpace, DriveSpace, DriveSpace3 updated to full r/w including optimization (286248c)
+- ODS-1 R/W (IArchiveModifiable: Add+Remove with BITMAP/INDEXF mutation + home-block checksum recompute; self-round-trip clean) (cd77b5b)
+- QNX6 R/W (Add/Remove with dual-superblock synchronous mutation + inode-table + root dir block; self-round-trip clean) + Qnx6Modifier: in-place Add/Remove against existing QNX6 images. Add allocates the next free 128-byte inode slot (scans di_status/di_mode/di_block_ptr[0] for all-zero), lays down a contiguous file extent past the current high-water mark (computed from every live S_IFREG inode's first-direct ptr + size), and appends a 32-byte dirent (u32 inum + u8 namelen + name padded to 27 bytes) into the single-block root directory. Remove finds the dirent, zeroes the data extent (wipe contract), clears the inode slot, and compacts trailing dirents into the freed slot so reads see no gap. + Qnx6Modifier: replace-by-name on Add — pre-existing entry with same leaf name is Remove'd before the new file is written. + Qnx6Modifier: every mutation re-mirrors the primary superblock (0x2000..0x21FF) to the new tail's last 512 bytes synchronously — the Power-Safe contract holds across every Add/Remove call, not just at Create time. + Qnx6FormatDescriptor: implements IArchiveModifiable; Capabilities advertises CanModify alongside CanCreate; Description reflects R/W promotion. + Qnx6RwTests (12 in-process tests + 1 WSL-gated): Add round-trips alongside pre-existing entries, dual-superblock mirror parity post-mutation, large-file Add extends the image, replace-by-name semantics, single-block root capacity guard throws NotSupportedException past 32 dirents, Remove drops entries from List, Remove wipes data extent (marker pattern unrecoverable), Remove of unknown name is no-op, Remove-then-Add recycles inode slot, plus a best-effort WSL Linux kernel qnx6 driver mount-and-list of the post-mutation image (skips cleanly when sudo/loop devices/qnx6 module unavailable). * Worktree branch ccc05ad lacked the QNX6 WORM files entirely (diverged from main before f674246); cherry-picked the WORM baseline (Qnx6Writer/Reader/Entry/FormatDescriptor/csproj + Qnx6Tests/Qnx6WormTests) into the same FileSystems/FileSystem.Qnx6/ + Compression.Tests/Qnx6/ paths and wired into the slnx + Compression.Lib + Compression.Tests project graphs before promotion. ! Pre-existing failures unrelated to QNX6: 4 "Descriptor_IsHonestly{Worm,Rebuild}" tests on ReiserFs/Jfs/F2fs/Apfs fail on this worktree branch because those FSes were promoted to R/W on main commits 09ce675/3df9d1b/170059b/776ab47 but the worktree was branched before those promotions and still carries the old "must not advertise IArchiveModifiable" gates. All 37 QNX6 tests pass; the 4 failures reproduce identically with the QNX6 changes stashed. (9bceca0)
+- QNX4 R/W (Add/Remove against flat root + .bitmap allocation; capacity guard preserved; self-round-trip clean) + Qnx4Modifier: in-place AddFile / RemoveFile against an existing image — root cluster (LBA 1-4) + .bitmap (LBA 5) mutated without a full image rebuild + Qnx4Modifier.AddFile: finds first free root-cluster slot (entries 3..31), allocates contiguous extent via .bitmap walk starting at LBA 7, writes inode (di_status=USED, di_fname/di_size/di_first_xtnt set), grows the underlying stream when the allocation runs past the current image end, refreshes root-self di_size + Qnx4Modifier.AddFile: replacement semantics — if a file with the same name exists, the old extent is freed and the dirent cleared before the new one lands, so callers can replace by name without leaking the prior extent + Qnx4Modifier.RemoveFile: walks user slots (3..31) by name, zero-wipes the data extent (no forensic recovery), flips bitmap bits back to free, clears the entire 64-byte inode slot, refreshes root-self di_size; returns false unchanged when the name isn't present + Qnx4Modifier capacity guard: AddFile throws NotSupportedException with "root cluster full" once entries 3..31 are saturated (29 user files) — preserves the same flat-root WORM scope; subdirectory emission still out of scope + Qnx4FormatDescriptor: now implements IArchiveModifiable; Capabilities advertises CanModify alongside CanCreate; Add/Remove pipe through FormatHelpers.FlatFiles + Qnx4Modifier * Qnx4FormatDescriptor.Description: reflects the R/W scope (flat root, max 29 user files) instead of WORM + Qnx4RwTests (16 tests): Add round-trip (single/zero-byte/multi-block), Add replaces existing names in place without duplicating, long-name truncation; Remove round-trip + secure data wipe + returns false for unknown names; FillToCap → RemoveOne → AddOne sequence (slot reuse); Add past 29-user-file cap throws NotSupportedException; .bitmap bit flips on Add and Remove; freed-extent reuse after Remove→Add; descriptor surface (CanModify + IArchiveModifiable + descriptor.Add/.Remove pipe through to modifier) (4df9580)
+- Cxfs R/O via XFS reader delegation (cluster metadata ignored; documented) (2877fb6)
+- AmigaPFS R/W Stage 1 (Add/Remove against root + dirblock chain; anode-as-direct-block convention preserved; self-round-trip clean, still not FS-UAE-mountable) (746cde1)
+- ADFS-L R/W (Add/Remove against old-map FSM + Hugo-bracketed root dir + check-byte recompute; self-round-trip clean) (5493612)
+- MooseFs partial R/O via metadata.mfs section-index parse (signature + section table + per-section payloads; file content stays unreachable since chunks live on chunk servers) (6068e6d)
+- Xenix V R/W (Add/Remove with s_free/s_inode cache mutation + 10-direct-zone files; self-round-trip clean) (75d2eae)
+- Coherent R/W (Add/Remove with V7 free-cache mutation + 10-direct + single-indirect + double-indirect tier alloc/free; self-round-trip clean) (1c4472e)
+- Lustre R/O via ext4 reader delegation on ldiskfs MDT/OST images (Lustre xattrs preserved; logical FS view requires combining MDT + OSTs out-of-scope) (e3490a3)
+- SysV R/W (Add/Remove with chained free-block group cache refill + 10-direct-zone files; self-round-trip clean) (7f69316)
+- FATX R/W (Add/Remove with FAT chain allocate/free + dirent 0xE5 tombstone + 0xFF padding preserved; FAT16/FAT32 width-aware; self-round-trip clean) + FatxModifier: in-place AddFile / RemoveFile on the root directory of an existing FATX image   - Add scans the FAT for the first free contiguous cluster run sized to the requested payload, links each cluster to the next + plants the FAT16/FAT32 EoC sentinel on the last one, writes payload bytes into the data region cluster-by-cluster, then writes a 64-byte FATX dirent into the first reusable slot in the root cluster (first 0xE5 tombstone or first 0xFF terminator)   - Remove finds the dirent by sanitised name in the root cluster, sets name_length = 0xE5 (FATX tombstone convention), walks the file's FAT chain freeing each cluster (entry → 0), and zeros the data bytes inside each freed cluster so previous content is not forensically recoverable   - FAT16 / FAT32 width auto-detected from on-disk geometry using the same heuristic as FatxReader so both sides always agree   - 12-byte timestamp tail stays zeroed (real Xbox kernel re-stamps on mount; matches what FatxWriter already produces)   - Dirent name field padded 0xFF on unused tail bytes, identical layout to FatxWriter.WriteDirent   - Honest scope limits: sub-directory adds out of scope (v1 only touches root cluster); extending the root chain past one cluster also out of scope — both surface a clean InvalidOperationException instead of silently corrupting * FatxFormatDescriptor: now implements IArchiveModifiable + advertises FormatCapabilities.CanModify; Description reflects new R/W surface * FatxFormatDescriptor.Add: deserialises the stream, calls FatxModifier.AddFile per non-directory input, writes the mutated image back; same buffered pattern Fat / Hpfs / Mfs descriptors use * FatxFormatDescriptor.Remove: deserialises, calls FatxModifier.RemoveFile per name, writes back; unknown names silently skipped (matches WORM Extract behaviour) + FatxRwTests (15 tests, all green):   - HappyPath: descriptor advertises CanModify, single Add round-trip, Remove round-trip, descriptor Add/Remove pipeline, FAT chain links + EoC sentinel on multi-cluster Add, FAT entries + data bytes both wiped on Remove   - Boundary: zero-byte Add, multi-cluster Add (spans 5 clusters), tombstoned dirent slot reuse on subsequent Add (re-add lands in exact slot the previous Remove tombstoned), Add/Remove/Add wave keeps the anchor file's bytes byte-identical across every cycle, FAT32-width round-trip on a 32 MiB image with sectorsPerCluster=1 (FAT32 EoC sentinel verified; cluster freed on Remove)   - Sad: Remove of unknown name returns false + image untouched, free-cluster exhaustion throws InvalidOperationException, root-dirent-slot exhaustion (33 entries in a 32-slot root cluster) throws cleanly (127a5ae)
+- Convert Archive in explorer context menu + no category prefix in SaveDialog filter * OnConvertArchive prefers SelectedEntries[0].Path when browsing real FS so right-click → Convert works without opening the archive first * Dropped 'Archive: ' prefix from filter labels (was misleading for filesystem descriptors that share the Archive FormatCategory) (6018e6b)
+- Explorer refresh after defrag/shrink/wipe/optimize: DefragmentWindow.ArchiveMutated event fires on success; MainWindow + MainViewModel re-list when the mutated path matches the open archive (14d89da)
+- CONTRIBUTING.md: stage-based format-promotion strategy (golden sample -> R/O -> WORM -> R/W) with per-stage acceptance gates + mutual-compensation trap doc (33573bf)
+- OpenVms: bounded OpenEntry over FULL.disk + home_block.bin (71af295)
+- Ubifs: real on-disk file reader (zlib + stored data nodes) + bounded OpenEntry (bc6e824)
+- Mfs1: real DFS-tier catalog walker + bounded OpenEntry (a33d553)
+- HFS+: true two-pass streaming writer (catalog B-tree + fork-data streaming with sparse-zero tails) (b30045c)
+- NTFS: true two-pass streaming writer (MFT layout + run-list streaming with sparse-zero tails) (63eebc4)
+- Yaffs2 native OpenEntry: bounded streaming view over reassembled chunk extents (accepts files/ prefix) (7e757a0)
+- Jffs2 native OpenEntry: bounded streaming view over Jffs2FileReader's reassembled data nodes (3334307)
+- Ext: true two-pass streaming writer (block groups + extent-stream entry copy with sparse-zero tails) (8fac56f)
+- MinixV2 native OpenEntry: bounded streaming view over triple-indirect inode data zones (b7571c5)
+- MinixV1 native OpenEntry: bounded streaming view over inode-reassembled data zones (6ff7b56)
+- ExFat: true two-pass streaming writer (zero-buffer entry copy with sparse-zero cluster tails) (7200163)
+- Streaming tests: ReadOnlyStreamSlice spec (9 tests) + entry-isolation fuzz for APK, JAR, tar.gz native overrides (f14f67b)
+- ExFat/Ext/NTFS/HFS+ CreateFromStreams: source-bounded streaming inputs feed existing writers; TODO: refactor writers to true two-pass streaming (ec040e8)
+- Filesystem native OpenEntry: bounded extent-walking views for ~35 filesystems (ExFAT/Ext/NTFS/HFS+/Btrfs/APFS/XFS/SquashFS/CramFS/EROFS + retros) (892dc48)
+- Other archive natives: bounded OpenEntry for ~21 formats (AlZip, Psarc, Lit, Mobi, InnoSetup, NSIS, RPM, Pkcs12, PBP, PFS0, ESD, SWM, EML, LBR, STL, PCAP, PCAPNG, WBN, OneNote, PST, mbox) (9637d51)
+- Apple/Mac container natives: bounded OpenEntry for AppleSingle, PackIt, CompactPro, DiskDoubler (3e79e3f)
+- Game-archive native OpenEntry: bounded-stream views for ~33 formats; + ReadOnlyStreamSlice primitive (10de2d0)
+- DEB: native OpenEntry as bounded view over inner data.tar.* entries (aa9d93f)
+- ZIP-derived containers: native OpenEntry forwarding to ZIP reader (26 formats) (b687cab)
+- Deferred-length write stream + AddEntry auto-pick (zero-buffer when source.CanSeek + .Length known) (9237cb4)
+- Compound TAR: native OpenEntry via decompression wrap + inner TAR delegation (bab6559)
+- ArchiveReader/ArchiveWriter facade + native OpenEntry overrides for 15 formats (dff6270)
+- Bounded per-entry streaming pipeline (OpenEntry → bounded Stream + CreateFromStreams two-pass writer for FAT) (f8f05a9)
+- Layout profile editor (UI for create/load/save/delete defrag profiles) (f536251)
+- Layout templates: sort keys, range-based zones, JSON files, filter expressions (a136166)
+- Hfs schema knobs (1bc440b)
+- Rt11 schema knobs (e30d02e)
+- Os9Rbf schema knobs (158ce58)
+- TrDos schema knobs (69a2161)
+- CpcDsk schema knobs (b08ada4)
+- Mfs schema knobs (81e60c8)
+- Lif schema knobs (51f9350)
+- Udf schema knobs (36f780f)
+- Iso schema knobs (834e9a8)
+- Cpm schema knobs (a667f93)
+- Explorer delete (real FS + modifiable archives) (a996d8e)
+- D81 schema knobs (50f2c71)
+- D71 schema knobs (9d158a3)
+- D64 schema knobs (4aace5c)
+- Bbc schema knobs (a4f27c0)
+- Atari8 schema knobs (4398ddb)
+- AppleDos schema knobs (76dde2b)
+- Adf schema knobs (bc391f5)
+- Filesystem schema knobs (FAT/exFAT/ext/HFS+/NTFS/Btrfs) (595d15b)
+- stub-tier File-System detection (9) (8ccaee2)
+- Trsdos File-System (5abb3b7)
+- Ti99 File-System (0c6ff4e)
+- Pc98 File-System (3f5d20b)
+- Nilfs1 File-System (c7119cc)
+- Jfs1 File-System (2d77d8e)
+- Human68k File-System (2a46f04)
+- Htfs File-System (2762eb2)
+- Gfs1 File-System (7101fff)
+- Gemdos File-System (08d0cd3)
+- Efs File-System (81605a9)
+- Cromemco File-System (f1a8315)
+- ApplePascal File-System (8ebfca5)
+- Archive format schemas (06a9722)
+- Format options schema infrastructure (fbc3121)
+- ZFS is now read/write (IArchiveModifiable): add/replace/remove via read-extract-rebuild through the fat-ZAP-capable writer (preserving the label footprint) (4acfaf4)
+- F2FS is now read/write (IArchiveModifiable): add/replace/remove via read-extract-rebuild through the fsck.f2fs-clean writer (278434e)
+- APFS is now read/write (IArchiveModifiable): add/replace/remove via read-extract-rebuild through the Fletcher-64-valid writer (82ec9e9)
+- JFS is now read/write (IArchiveModifiable): add/replace/remove via read-extract-rebuild through the fsck.jfs-clean writer (29959f4)
+- ReiserFS is now read/write (IArchiveModifiable): add/replace/remove via read-extract-rebuild through the reiserfsck-clean writer (183e640)
+- LZ4 exposes a Level option (Fast/HC) and honours it # LZ4 HC: require a strictly-earlier chain candidate so the lazy-match path can't emit a zero-offset match that fails to decode (1816592)
+- Brotli exposes a Quality option (Uncompressed/Fast/Default/Best) and honours it (window is derived internally per RFC 7932) (d874472)
+- LZMA exposes Level + DictionarySize + lc/lp/pb options and honours them (the optimizer uses coordinate descent over this multi-axis space) (79b1aec)
+- Bzip2 exposes a BlockSize option (1..9 x 100 KB) and honours it (c5b459a)
+- Gzip and Zlib expose a Deflate compression-level option (None/Fast/Default/Best/Maximum) and honour it; shared DeflateLevelOption parse helper (cb2c1b3)
+- IStreamFormatOperations.Compress(in,out,options) overload so compression formats can honour their IFormatOptionsSchema tunables (default ignores options, unparameterised formats unchanged) + Zstd exposes a Level option schema and honours it + CompressionOptimizer: schema-driven search (exhaustive under a budget, else coordinate descent) that returns the smallest output + winning parameters for the caller's data (2951898)
+- FAT external-conformance test: fsck.fat reports FAT12/16/32 images clean (BPB, dual FATs, FSInfo, '.'/'..' chains all verified); includes a corruption-detection guard so the assertion genuinely bites (ee0756d)
+- exFAT external-conformance test: fsck.exfat reports our images clean (boot-region checksum, entry-set checksums, name hashes, bitmap, upcase all verified) (e3a8646)
+- block-map visualization views: switch between the linear grid, a 2-D circular platter (sector angle + cylinder radius), and a 3-D cylinder stack (head height) to show where data physically resides + MediaGeometry/MediaProjection core (LBA<->CHS, polar/stack projections) with unit tests; BlockMapControl gains a ViewMode + Geometry, and the defragment window a view selector (900d72c)
+- Joliet support for ISO9660: a Supplementary Volume Descriptor with a parallel UCS-2BE directory tree and path tables carries long, mixed-case, Unicode filenames on CDs (on by default; PVD keeps ECMA-119 short names) * IsoReader prefers Joliet names when present; IsoModifier/extent map keep both trees consistent (ffef592)
+- NTFS 8.3 short-name suppression switch (Generate8Dot3 option): emit Win32-only $FILE_NAME instead of Win32&DOS, like Windows with 8.3 creation disabled + tests pinning resident small-file $DATA (no clusters/slack for files under the resident threshold) and the short-name namespace, cross-checked against ntfs-3g (2659e3f)
+- ArchiveInputInfo in-memory input overloads: InMemory(name, ReadOnlySpan<byte>), InMemory(name, Stream), and FromFile(FileInfo) so the in-memory reconfigure/convert API is ergonomic to use (c5831d7)
+- FAT defrag fuses a fragmented directory's cluster chain into one contiguous run and relinks each owner's full chain once (two-phase move+relink) # FAT defrag repatches subdirectory '.'/'..' self/parent pointers after moves so the on-disk tree stays consistent + defrag subdirectory round-trip tests (FAT in-place planner path; Ext rebuild path) (2b9d5c2)
+- F2FS directories spill from inline dentries into regular multi-segment dentry data blocks so very large directories round-trip (e221ceb)
+- ZFS directories spill from micro-ZAP into a real fat-ZAP (header + leaf blocks) so very large directories round-trip (bba8b95)
+- HFS+ catalog grows into a multi-node B-tree (index nodes + leaf chain) so very large directories round-trip (9929dd9)
+- HFS catalog grows into a multi-level B*-tree (index nodes over chained leaves) so very large directories round-trip (c08c35f)
+- APFS FS-tree grows into a multi-leaf B-tree with an internal node so very large directories round-trip (3df12b3)
+- NTFS large directories spill into $INDEX_ALLOCATION (INDX blocks + $BITMAP) so very large directories round-trip (3df8f2f)
+- ReiserFS S+tree grows to a 3-level tree (internal block over many leaves) so very large directories round-trip (264323b)
+- JFS directories spill from the inline dtree into external B+tree pages so very large directories round-trip (857010f)
+- XFS directories convert from short-form to block-form (multi data-block) so very large directories round-trip (c52f6ce)
+- Btrfs FS-tree grows into a multi-leaf B-tree with an internal index node so very large directories round-trip (b93b7d3)
+- Jffs2 large-directory round-trip test (many entries in one directory already supported) (0b6833b)
+- Adf large-directory round-trip test (many entries in one directory already supported) (942d09b)
+- Iso large-directory round-trip test (many entries in one directory already supported) (d7c783e)
+- Fat large-directory round-trip test (many entries in one directory already supported) (f7d7ae6)
+- Ocfs2 directories grow across multiple blocks/nodes so very large directories round-trip (ea20544)
+- Udf directories grow across multiple blocks/nodes so very large directories round-trip (ca42dc2)
+- Hpfs directories grow across multiple blocks/nodes so very large directories round-trip (3bd0c5e)
+- Bfs directories grow across multiple blocks/nodes so very large directories round-trip (4d7b77b)
+- Os9Rbf large-directory round-trip test (many entries in one directory already supported) (297e3ad)
+- ProDos directories grow across multiple blocks/nodes so very large directories round-trip (1d60aea)
+- MinixFs directories grow across multiple blocks/nodes so very large directories round-trip (e283df6)
+- Ufs directories grow across multiple blocks/nodes so very large directories round-trip (fdb584b)
+- Ext1 directories grow across multiple blocks/nodes so very large directories round-trip (ef7a4fe)
+- Ext directories grow across multiple blocks/nodes so very large directories round-trip (726a1c2)
+- Yaffs2 zeroes unused space and cluster-tip slack via IWipeEmpty (generic UnusedSpaceWiper) (e1cad16)
+- Xfs zeroes unused space and cluster-tip slack via IWipeEmpty (generic UnusedSpaceWiper) (2a1fb55)
+- Vdfs zeroes unused space and cluster-tip slack via IWipeEmpty (generic UnusedSpaceWiper) (0ae68b3)
+- Ufs zeroes unused space and cluster-tip slack via IWipeEmpty (generic UnusedSpaceWiper) # Ufs extent map now reserves directory/root/metadata blocks so wiping and defrag never touch live data (0ddfbb9)
+- Udf zeroes unused space and cluster-tip slack via IWipeEmpty (generic UnusedSpaceWiper) # Udf extent map now reserves directory/root/metadata blocks so wiping and defrag never touch live data (637a895)
+- TrDos zeroes unused space and cluster-tip slack via IWipeEmpty (generic UnusedSpaceWiper) (d6b8437)
+- SquashFs zeroes unused space and cluster-tip slack via IWipeEmpty (generic UnusedSpaceWiper) (d999026)
+- Rt11 zeroes unused space and cluster-tip slack via IWipeEmpty (generic UnusedSpaceWiper) (ee1df2b)
+- RomFs zeroes unused space and cluster-tip slack via IWipeEmpty (generic UnusedSpaceWiper) # RomFs extent map now reserves directory/root/metadata blocks so wiping and defrag never touch live data (d5b2b7f)
+- ProDos zeroes unused space and cluster-tip slack via IWipeEmpty (generic UnusedSpaceWiper) (6ca2276)
+- Os9Rbf zeroes unused space and cluster-tip slack via IWipeEmpty (generic UnusedSpaceWiper) (80008d4)
+- Ocfs2 zeroes unused space and cluster-tip slack via IWipeEmpty (generic UnusedSpaceWiper) (9ed5b69)
+- Ntfs zeroes unused space and cluster-tip slack via IWipeEmpty (generic UnusedSpaceWiper) (71cfff3)
+- Msa zeroes unused space and cluster-tip slack via IWipeEmpty (generic UnusedSpaceWiper) (440c703)
+- MinixFs zeroes unused space and cluster-tip slack via IWipeEmpty (generic UnusedSpaceWiper) # MinixFs extent map now reserves directory/root/metadata blocks so wiping and defrag never touch live data (d0b789c)
+- Mfs zeroes unused space and cluster-tip slack via IWipeEmpty (generic UnusedSpaceWiper) (15324fb)
+- Lif zeroes unused space and cluster-tip slack via IWipeEmpty (generic UnusedSpaceWiper) (3351a3c)
+- Jffs2 zeroes unused space and cluster-tip slack via IWipeEmpty (generic UnusedSpaceWiper) (83aab59)
+- Iso zeroes unused space and cluster-tip slack via IWipeEmpty (generic UnusedSpaceWiper) (c750476)
+- Hpfs zeroes unused space and cluster-tip slack via IWipeEmpty (generic UnusedSpaceWiper) (34510db)
+- HfsPlus zeroes unused space and cluster-tip slack via IWipeEmpty (generic UnusedSpaceWiper) # HfsPlus extent map reserves directory/root blocks so wiping never corrupts live metadata (6783480)
+- Hfs zeroes unused space and cluster-tip slack via IWipeEmpty (generic UnusedSpaceWiper) (86fc9fa)
+- Ext1 zeroes unused space and cluster-tip slack via IWipeEmpty (generic UnusedSpaceWiper) # Ext1 extent map reserves directory/root blocks so wiping never corrupts live metadata (693c46c)
+- Ext zeroes unused space and cluster-tip slack via IWipeEmpty (generic UnusedSpaceWiper) (f3bffd7)
+- ExFat zeroes unused space and cluster-tip slack via IWipeEmpty (generic UnusedSpaceWiper) # ExFat extent map reserves directory/root blocks so wiping never corrupts live metadata (73eb6be)
+- DoubleSpace zeroes unused space and cluster-tip slack via IWipeEmpty (generic UnusedSpaceWiper) (add06b3)
+- D81 zeroes unused space and cluster-tip slack via IWipeEmpty (generic UnusedSpaceWiper) (136994b)
+- D71 zeroes unused space and cluster-tip slack via IWipeEmpty (generic UnusedSpaceWiper) (0f05cbf)
+- D64 zeroes unused space and cluster-tip slack via IWipeEmpty (generic UnusedSpaceWiper) (e2a3d32)
+- CramFs zeroes unused space and cluster-tip slack via IWipeEmpty (generic UnusedSpaceWiper) (f5f0395)
+- Cpm zeroes unused space and cluster-tip slack via IWipeEmpty (generic UnusedSpaceWiper) (d1411e0)
+- CpcDsk zeroes unused space and cluster-tip slack via IWipeEmpty (generic UnusedSpaceWiper) (b5e14ba)
+- Btrfs zeroes unused space and cluster-tip slack via IWipeEmpty (generic UnusedSpaceWiper) (29802d8)
+- Bfs zeroes unused space and cluster-tip slack via IWipeEmpty (generic UnusedSpaceWiper) (c9a5e84)
+- Bbc zeroes unused space and cluster-tip slack via IWipeEmpty (generic UnusedSpaceWiper) (da9df92)
+- Atari8 zeroes unused space and cluster-tip slack via IWipeEmpty (generic UnusedSpaceWiper) (81ad23b)
+- AppleDos zeroes unused space and cluster-tip slack via IWipeEmpty (generic UnusedSpaceWiper) (1683189)
+- Adf zeroes unused space and cluster-tip slack via IWipeEmpty (generic UnusedSpaceWiper) (61e8a5b)
+- FilesystemLayoutOptimizer optimality tests: SelectClusterSize/SelectPair proven to return the global cost minimum (vs brute-force reference) across 200 random workloads, plus tier-then-cost ordering and the smaller-cluster tie-break # add the missing forceLfn <param> doc on FatWriter.Build (d01eecb)
+- ArchiveInputInfo.InMemoryContent + ReadContent(): inputs can be fed from memory so reconfigure/convert needs no temp extraction directory + InMemoryProcessing: configurable size threshold (default 2 GiB, lowerable for tests) routing small images through an all-RAM build/reconfigure pipeline with atomic temp-file+rename write-back * FAT Create/Add read content via ArchiveInputInfo.ReadContent() so they build from in-memory inputs without disk access (a25c5dd)
+- FAT force-LFN mode: emit a VFAT long-name entry for every file/dir (with generated 8.3 alias) even for names that fit 8.3, the way Windows always records a long name + ForceLongFilenames creation option exposes it (non-VFAT 8.3-only mode already available via LongFilenames=false) (9dd3648)
+- setup-test-environment.sh: installs third-party filesystem/archive tools (mtools, e2fsprogs, ntfs-3g, xfsprogs, btrfs-progs, squashfs-tools, xorriso, ...) for external-validation tests; detects apt/dnf/pacman/zypper and skips already-present tools (52aea28)
+- Yaffs2 writer creates real subdirectory trees instead of flattening nested paths into the root * Yaffs2 Create preserves nested input paths instead of flattening to leaf names (94190b6)
+- Jffs2 writer creates real subdirectory trees instead of flattening nested paths into the root * Jffs2 reader recurses into subdirectories and reports nested paths * Jffs2 Create preserves nested input paths instead of flattening to leaf names (eef14c1)
+- Bfs writer creates real subdirectory trees instead of flattening nested paths into the root * Bfs reader recurses into subdirectories and reports nested paths * Bfs Create preserves nested input paths instead of flattening to leaf names (db7c86c)
+- Zfs writer creates real subdirectory trees instead of flattening nested paths into the root * Zfs reader recurses into subdirectories and reports nested paths (fecfee5)
+- Apfs writer creates real subdirectory trees instead of flattening nested paths into the root * Apfs reader recurses into subdirectories and reports nested paths (c71992f)
+- Ufs writer creates real subdirectory trees instead of flattening nested paths into the root (41b8ff4)
+- Ocfs2 writer creates real subdirectory trees instead of flattening nested paths into the root * Ocfs2 Create preserves nested input paths instead of flattening to leaf names (27d86ee)
+- ReiserFs writer creates real subdirectory trees instead of flattening nested paths into the root * ReiserFs reader recurses into subdirectories and reports nested paths (e07ae17)
+- Jfs writer creates real subdirectory trees instead of flattening nested paths into the root * Jfs reader recurses into subdirectories and reports nested paths (6924c89)
+- Xfs writer creates real subdirectory trees instead of flattening nested paths into the root (3cf387e)
+- Btrfs writer creates real subdirectory trees instead of flattening nested paths into the root (a1d65ea)
+- Adf writer creates real subdirectory trees instead of flattening nested paths into the root (f2bea79)
+- Os9Rbf writer creates real subdirectory trees instead of flattening nested paths into the root * Os9Rbf reader recurses into subdirectories and reports nested paths (1baf447)
+- ProDos writer creates real subdirectory trees instead of flattening nested paths into the root (3f48b8e)
+- MinixFs writer creates real subdirectory trees instead of flattening nested paths into the root (47608aa)
+- Hpfs writer creates real subdirectory trees instead of flattening nested paths into the root * Hpfs reader recurses into subdirectories and reports nested paths * Hpfs Create preserves nested input paths instead of flattening to leaf names (6f23029)
+- Hfs writer creates real subdirectory trees instead of flattening nested paths into the root * Hfs reader recurses into subdirectories and reports nested paths (132e38f)
+- Udf writer creates real subdirectory trees instead of flattening nested paths into the root (4013b84)
+- F2fs writer creates real subdirectory trees instead of flattening nested paths into the root * F2fs reader recurses into subdirectories and reports nested paths (e50b60b)
+- HfsPlus writer creates real subdirectory trees instead of flattening nested paths into the root * HfsPlus reader recurses into subdirectories and reports nested paths (020c8c6)
+- Iso writer creates real subdirectory trees instead of flattening nested paths into the root (c9f4198)
+- Ntfs writer creates real subdirectory trees instead of flattening nested paths into the root (377a804)
+- Ext writer creates real subdirectory trees instead of flattening nested paths into the root (79e11e3)
+- ExFat writer creates real subdirectory trees instead of flattening nested paths into the root (87a3c05)
+- register .fat as a FAT image extension so archive creation resolves it + mtools nested-directory round-trip integration test (mdir -b -/ validates our subdirectory layout) (a7b51b2)
+- FAT writer builds real subdirectory trees instead of flattening nested paths into the root * FAT root-directory overflow check now counts only the root's direct children, so deep trees stay on FAT12/16 instead of being forced to FAT32 (ceeb794)
+- project vision section at the top of the README + README section documenting the Wine workflow for the UI on Linux * gitignore agent artifacts (.claude/, CLAUDE.md, agent dirs, scratch, worktrees) and local wine-publish output (556266d)
+- FilesystemLayoutOptimizer: cluster/block/MFT sizing that minimises slack + table overhead + IFormatOptionsSchema-driven creation options for FAT, exFAT, ext, NTFS, HfsPlus, F2fs, FatPlus, TFat, ProDos + FilesystemSchemaPresets and ILayoutOptimizable shared contracts + FAT retro/optical image-size presets, FAT-type forcing, DMF root entries, VFAT/TFAT/FAT+ toggles, volume label + NTFS tunable cluster + MFT record size via paired grid search + streaming FatWriter.BuildTo for arbitrarily large images (sparse, bounded memory) + fixed-image cluster optimizer that minimises slack within a pinned image size * plumb format-specific options from the UI through CompressionOptions to FormatCreateOptions * FatReader detects FAT32 from the BPB FAT-size field, not only cluster count * exFAT auto-size clamps to a 4 KiB minimum cluster (5e8c3f1)
+- run-wine.sh to build and launch the WPF UI under Wine on Linux + software-render fallback under Wine (fixes black menus) gated by an env flag (31a241e)
+- new filesystems + defragmenting + conversions + partition edit (3575df2)
+- defragmenting UI (665bb3b)
+- made more formats RW instead of WORM (39bbb6b)
+- split into nuget-packages (35275b4)
+- pngcrushcs dependency (fde11b2)
+- PNGCrushCS reference (ac2cf0d)
+- colorplane splittng and previewing for images + more archive formats (535dbe4)
+- ui niceties (0a7ecbd)
+- more filesystems (6e12cd3)
+- exif patching (763661c)
+- exe-packers, codecs, more splittable fileformats (9a13d99)
+
+### Removed
+- no nuget publish on nightly (1887ccf)
+- Revert the UFS superblock/cg writer fixes (commits 2ef3939, 4842797) — they are fsck_ffs-correct (verified by booting FreeBSD under qemu) but the repo's UfsReader/UfsModifier are written against the old self-consistent format, so the writer-only change broke 5 round-trip/mutation tests, and the image still is not fully fsck-clean (Phase 2 dirents + Phase 5 fs_old_cpg=0 FPE remain). The real fsck_ffs findings (fs_qbmask/fs_qfmask complement, fs_old_rps/interleave/postblformat/nrpos, fs_sbsize alignment, fs_sblockloc, fs_maxfilesize, fs_size fragment units, cg layout) are recorded for a coordinated writer+reader+modifier fix (be5800b)
+
+### Changed
+- ChainReconstructor: size-scaled blind-trial timeout + broader fingerprint mapping # blind-trial sweep hardcoded a 200 ms cap, ignoring the configured perTrialTimeoutMs   and never scaling — a megabyte-scale layer could be abandoned mid-decompress; now   the budget is base + 1 ms/KiB, capped at 5 s * MapToTrialName -> MapToTrialNames: the generic fingerprint classes   (Dictionary-Compressed, Strong-Compression) now map to a priority-ordered shortlist   of raw trials instead of null, so a confident-but-unspecific fingerprint gets a fast   path before falling through to the full blind sweep (14b324b)
+- Context mixing: real logistic-domain mixer (PAQ/lpaq-style) (d59fe45)
+- PNG/TIFF/MPO/DCX/ICNS descriptors now decompose to chunks/pages/sub-images (36389e4)
+- Webp pseudo-archive: add metadata.ini + frames/ + in-memory extract + malformed-safe List (a7fc34a)
+- WORM/R audit: lock R-only-modify contracts on 8 archive descriptors that do not implement IArchiveModifiable + PackIt: byte-identity lock — Add appends at EOF (prefix bytes byte-identical at original offsets), Remove of last entry truncates exactly to dropped offset, survivors strictly before a removed entry preserve their on-disk offsets * AndroidOta Description: name `metadata_signature` field + DeltaArchiveManifest SHA-256 per-operation hashes as the spec barrier * Crx Description: name CRX3 SignedData protobuf KeyProof signatures as the spec barrier (CanCreate stays — empty SignedData, not browser-loadable) * Snap / AppImage Descriptions: name SquashFS write-once table indexing by absolute on-disk offset + snapd SHA-3-384 assertion / appimagetool GnuPG detached signature as the container barrier * Wbn Description: name CBOR `sections-lengths` + `index` absolute-offset encoding + Signed Web Bundle Ed25519 authorities signature as the spec barrier * Sar / Nsa Descriptions: name `uint32 BE data_offset` header field as the structural barrier — index growth shifts data_offset and every byte after it (CanCreate stays — stored mode) * StuffItX Description: name P2-length-header element-stream with absolute catalog offsets + proprietary Brimstone/Darkhorse/Cyanide/Iron methods as the writer-scope barrier + 9 new test fixtures (32 tests): WORM contract tests assert descriptor is not IArchiveModifiable, does not advertise CanModify, and Description names the blocking spec field; PackIt InPlaceModify tests lock the byte-identity contract end-to-end (3e382e3)
+- Bkf: promote MTF R-only to in-place R/W via append-before-EOTM (Add) and   XXXX-tombstone (Remove); descriptor + IArchiveModifiable + CanModify + BkfInPlaceModifier: AddFile walks the DBLK chain to the EOTM block,   inserts a fresh FLB-aligned FILE DBLK (CBH + FNAM + STAN streams) at that   position, then re-emits an EOTM block at the new end so every pre-existing   TAPE / SSET / VOLB / FILE / DIRB / ESET DBLK stays byte-identical at its   original offset; RemoveFile locates the FILE DBLK whose FNAM matches and   overwrites its 4-byte type field with the XXXX sentinel plus zero-wipes the   rest of that FLB-aligned block so the FNAM + STAN payload bytes leave no   forensic trace; the reader's parse loop hits an unknown DBLK type and skips   the tombstone via the next-FLB advance * BkfFormatDescriptor: + IArchiveModifiable + CanModify; Add/Remove route   through BkfInPlaceModifier + BkfInPlaceModifyTests (19 tests): Add appears in listing, all pre-EOTM   bytes survive byte-identical, EOTM re-emitted at new end, no-EOTM fallback   appends at EOF, empty payload round-trips; Remove drops from listing,   neighbour FILE DBLKs stay byte-identical, payload bytes zero-wiped,   tombstone carries XXXX sentinel, missing-name returns false; mutate-then-   extract round-trip; descriptor surface routes Add/Remove through modifier * Lnk: keep WORM honestly + lock the rebuild semantic in the Description and   pin the WORM state with a descriptor capability test (no CanModify, no   IArchiveModifiable). MS-SHLLINK describes one target whose StringData /   ExtraData regions reshape with every mutation, so a byte-preserving   in-place patch is not feasible — callers re-Create via LnkWriter * Sparsebundle: keep R-only honestly + spell out the deferred promotion path   in the Description (directory-target sibling interface or virtual TAR-of-   directory facade) + point callers at the companion R/W Sparseimage   descriptor; lock the R-only state with a descriptor capability test # Repair pre-existing test-code rot that was blocking the test assembly   compile: AppleSingleWriterTests referenced the obsolete Write / NameToEntryId   surface (current API is Build / EntryIdForName); Mfs1WriterTests referenced   the obsolete SetTitle fluent builder (current API is Build(diskTitle));   GsOsWriterTests referenced the obsolete SetComment and creator override   (current writer hardcodes CWB! and emits no comment block) (391953a)
+- Ipsw + AppleSingle: promote to true in-place R/W (CanModify) + AppleSingleWriter: emits canonical 26-byte header + N x 12-byte entry   directory + contiguous payload area per RFC 1740 v2; name-to-id   mapping reverses AppleSingleReader.EntryName plus entry_NNNNN.bin   numeric fallback + AppleSingleInPlaceModifier: Add appends payload + grows the directory   by one slot (shifting existing payloads forward by 12 bytes and   rewriting their offsets so byte content survives); Replace rewrites   same-size payloads in place, otherwise zero-wipes the previous range   and repoints the slot to a fresh EOF append; Remove zero-wipes the   payload range, then compacts the 12-byte directory slot out by   shifting trailing slots forward (surviving payload absolute offsets   unchanged) + IpswInPlaceModifier: delegates Add/Remove to ZipModifier (raw ZIP   entry namespace) - only the central directory, EOCD, and the   appended LFH + payload are touched * AppleSingleFormatDescriptor: + IArchiveCreatable + IArchiveModifiable   + CanCreate + CanModify; Create drops synthetic metadata.ini; Add/   Remove route through AppleSingleInPlaceModifier * IpswFormatDescriptor: + IArchiveCreatable + IArchiveModifiable +   CanCreate + CanModify; Create delegates to ZipWriter, drops synthetic   FULL.ipsw / metadata.ini; Add/Remove route through IpswInPlaceModifier + AppleSingleInPlaceModifyTests (24 tests): writer round-trip, name   mapping, Add preserves existing payload bytes + bumps entry count,   Remove zero-wipes payload + leaves survivor payloads byte-identical   at original offsets, Replace same-size keeps offset, Replace larger   appends + wipes, Create round-trip, mutate-then-extract + IpswInPlaceModifyTests (11 tests): Add appears in listing + preserves   existing entry byte content, descriptor surface routes through   ZipModifier, synthetic entries dropped on Create + Add, Remove   preserves other entries, mutate-then-extract via List ! Bkf demoted honestly: FileFormat.Bkf does not exist in this worktree   (no descriptor, no reader, no project); promotion deferred until the   format is implemented first (ccd68d5)
+- AppleSparse: promote Sparseimage WORM -> true in-place R/W via band rewrite at fixed offsets (db76b24)
+- ApplePascal: promote WORM to true in-place R/W via spec-canonical mutation + ApplePascalInPlaceModifier: Add/Replace/Remove against the 26-byte fixed dirents + ApplePascalFormatDescriptor: IArchiveModifiable + CanModify wired in + 22 in-place modify tests — Add/Replace/Remove leave untouched blocks byte-identical,   zero-wipe on Remove, 77-entry cap + volume-full boundaries, header file-count   increment/decrement, descriptor surface, extent reuse after Remove+Add * Sfs: lock the deferred R/W state in the descriptor remarks and Description —   promotion requires writer first (no SfsWriter exists), then four cross-checksummed   structures (B+ tree + bitmap chain + dir hash table + free-extent tree). No   platform-side fsck-class validator exists, so self-round-trip alone cannot prove   on-disk correctness — R-only stays the honest state (6deed33)
+- Acronis classic .tib: R-only -> R/W via true in-place record-stream append (c70858d)
+- Vdfs FormatDescriptor: route IArchiveModifiable Add/Remove through the new   VdfsInPlaceModifier instead of the rebuild fallback, so the on-disk image   is mutated in place and existing file extents keep their original byte   ranges (stored mode only — compression flag is deferred since no observed   Gothic-engine image uses it) + Vdfs InPlaceModifier: true random-access editing — Add appends the new   payload at end-of-stream and writes a fresh entry-table region past it,   patching the header's entry count + file count + total-data-size + root   offset; Remove zeroes the 80-byte entry record (the reader's existing   empty-name skip turns it into a tombstone) and zero-wipes the extent;   Replace rewrites at the original offset when the new bytes fit, otherwise   falls back to remove-plus-tail-add + Vdfs InPlaceModifyTests: 18 tests locking the byte-identical invariant —   Add preserves every surviving extent at its original offset, surviving   entry records are byte-identical after table relocation, Remove leaves   neighbour extents and neighbour entry records untouched, fits-Replace   rewrites at the original offset, mutate-then-extract round-trip, plus   descriptor-level integration coverage and an extent-wipe security check (e7c7d1c)
+- DoubleSpace + DriveSpace + DriveSpace3 modify: rebuild -> true in-place via MDFAT + BitFAT mutation (5be146f)
+- ZxScl + T64 promoted to TRUE in-place R/W (no read-extract-rebuild) + ZxSclInPlaceModifier: Add right-shifts payload region by one 14-byte directory slot, writes the new entry header in the freed gap, appends sector-padded data at the new end and rewrites the trailing 32-bit checksum; Remove shifts later directory entries up by 14 bytes, closes the payload gap with a backward shift of (14 + sector-padded removed bytes), truncates the stream and rewrites the checksum + T64InPlaceModifier: Add fills a free directory slot (entryType=0) when one exists, otherwise grows the directory by one 32-byte slot via a forward shift of the payload region (each existing slot's absolute dataOffset field is patched +32); Remove shifts later directory slots up by 32 bytes, wipes the removed payload bytes, closes the payload gap with a backward shift (each surviving slot's dataOffset is patched), truncates the stream and decrements maxEntries/usedEntries in the header * ZxSclFormatDescriptor + T64FormatDescriptor route Add/Remove through the new in-place modifiers; ModifyRebuilder fallback removed from the modify path (Defragment still uses DefragRebuilder) + Replace-by-name semantic on Add: an existing same-named entry is removed in-place before the new bytes are inserted, so callers get single-occurrence overwrite + ZxSclInPlaceModifyTests: Add preserves prior entries + checksum, Remove preserves others + shrinks stream by exact (14 + sector-padded) bytes, Add same-name replaces, mutate-then-extract roundtrip across 4 ops, descriptor routes through in-place modifier, Remove of unknown name returns false without mutation + T64InPlaceModifyTests: Add grow-directory path preserves existing data, Remove + Add reuses-or-grows path, Remove preserves others + shrinks by exactly 32 + payload bytes + secret-wipe verification (removed bytes are absent anywhere in the stream), Add same-name replaces, mutate-then-extract roundtrip, descriptor routes through in-place modifier, Remove of unknown name returns false without mutation (b8b23d5)
+- MinixFs: rebuild-based Add/Remove promoted to TRUE in-place R/W across V1/V2/V3 (34ba4f0)
+- SysV s5fs: promote modifier facade from SysVModifier to SysVInPlaceModifier — true in-place R/W (baff4ba)
+- Hpfs Add/Remove: rebuild-based path replaced with true in-place root-DIRBLK mutation via HpfsInPlaceModifier + HpfsInPlaceModifier: bitmap-walk sector allocation at LBA 24 (1=free, 0=used), FNODE + data sector writes at known offsets, dirent shift-in-place inside the root DIRBLK at LBA 20 + Replace: in-place data-sector rewrite when new size fits the existing allocation; reallocate-and-free otherwise + Remove: zero freed FNODE + data sectors, flip bitmap bits back to free, excise dirent slot by shifting later entries back + HpfsFormatDescriptor.Add/Remove delegate to the in-place path with a documented fallback to ModifyRebuilder when the call hits the deferred-scope cases (nested paths, single-DIRBLK overflow) + HpfsInPlaceModifyTests: 15 tests locking the load-bearing properties — untouched sectors stay byte-identical sector-by-sector for Add/Replace/Remove, bitmap tracks allocs and frees, mutate-then-extract round-trip, descriptor wiring uses the in-place path, subdirectory inputs cleanly fall back to rebuild ! Multi-block DIRBLK B-tree split/merge and nested subdirectory mutation deferred — scoped out in the modifier's XML doc; descriptor falls back to ModifyRebuilder for those callers so end-to-end Add/Remove of nested paths still works (50ef2d9)
+- FileSystem.Bfs Add/Remove: rebuild-based -> true in-place R/W via inode + B+tree leaf + AG bitmap mutation at fixed sector offsets (b1d6c94)
+- Jffs2 modify: rebuild-based -> true in-place log-append per JFFS2 spec (ccc257e)
+- Yaffs2 IArchiveModifiable: promote rebuild-disguised-as-R/W to TRUE in-place log-structured R/W + Yaffs2InPlaceModifier: Add/Replace/Remove append fresh chunks at image tail with monotonically-increasing seqNumber, never overwrite bytes in [0, oldLength). Add detects name collisions and routes them through Replace. Remove emits a tombstone header (parent_obj_id = 0xFFFFFFFE) leaving the deleted object's chunks byte-identical at original offsets * Yaffs2Scanner.DecodeAll: now log-structured-aware. For each (objectId, chunkId), keeps only the chunk with the highest seqNumber; ties resolved by image-order (last-append wins). Header with parent_obj_id == 0xFFFFFFFE = tombstone, object dropped from live view. Data chunks bounded by ceil(latestHeader.size / chunkSize) so a Replace-with-shorter-bytes correctly drops now-stale tail chunks of the prior version * Yaffs2FormatDescriptor: IArchiveModifiable.Add/Remove route through Yaffs2InPlaceModifier instead of ModifyRebuilder. Descriptor.Remove tolerates the "files/" prefix and nested-path leaf names, mapping each to root-level lookup; missing-name Remove silently skips per rebuild-path behaviour. Class doc-comment now spells out the in-place log-structured invariant and the [0, oldLength) byte-identical-untouched-bytes guarantee + Yaffs2InPlaceModifyTests: 13 tests locking the invariant — Add/Replace/Remove keep [0, oldLength) byte-identical, file A's chunk range survives byte-for-byte after Add+Replace+Remove of other entries, image-growth = exactly header+data-chunks per Add, scanner picks highest-seqNumber chunk, shrinking-Replace drops stale tail chunks, mutate-then-extract returns the mutated bytes, tombstoned object resolves to empty stream, missing-name Replace/Remove throws InvalidOperationException, nested-path Add throws NotSupportedException (honestly deferred — rebuild path is the right tool for subdirectory creation) * Yaffs2Tests.Modify_Remove_RemovesFile: switched the fixture's MemoryStream from fixed-size to expandable so the log-structured tombstone-append can grow the image by one Stride ! Honest scope: in-place Add of paths containing '/' or '\' is deferred and throws NotSupportedException with a specific message. Nested directory creation on Add and on-medium garbage collection (block recycling that physically reclaims obsolete chunk slots) remain rebuild-path territory; the load-bearing R/W operations on root-level entries are now byte-honest per the YAFFS2 spec (f20c3cc)
+- Ghost + Macrium: revert R/W claim back to honest WORM (71101e5)
+- Backup formats Ghost + Macrium R/W docs updated to reflect IArchiveModifiable landings (e3696b2)
+- Docs: reflect R -> WORM promotion wave (46882d6)
+- Backup-software disk images doc: reflect the 5-agent RE wave (5689641)
+- audio support tables: wave 12 — Yamaha OPM/OPN/OPNA + OPL family in VGM, PC Engine HuC6280+PSG (HES render), NES expansion audio (VRC6/7/FDS/MMC5/Namco163/5B), AMR-NB/WB voice (198ab12)
+- audio support tables: MOD/S3M/XM/IT now list per-channel SONG_LEFT/RIGHT.wav alongside SONG.wav (916e263)
+- audio support tables: wave 11 — Codec.Ym2413 (OPLL/SMS FM) in VGM, Codec.Tracker (MOD/S3M) + Codec.TrackerXmIt (XM/IT) song render + IT215 decompression, per-subtune TRACK_nn extraction (NSF/NSFE/GBS/SID/AY/KSS), MP4/Matroska/AVI per-track audio decode (7d8ce3d)
+- audio support tables: wave 10 — ADPCM variant pile, ATRAC1/.aea, RA288+RALF in RealMedia, CRI HCA + AHX-in-ADX, SBC/Siren/S302M, Bink+Smacker audio, MPC SV7, WMA Lossless, XMA→XWB, QOA/DFPWM/Bonk/WavArc, SID 2SID/3SID model matrix (50794cb)
+- audio support tables: chip-synthesis wave — SID/SPC/NSF/GBS/AY/KSS/VGM/GYM all render to PCM via emulated CPUs (6502, SPC700, SM83, Z80) and sound chips (SID 6581/8580, S-DSP, 2A03, GB APU, AY-3-8910, SN76489, OPN2) (555ce7a)
+- audio support tables: DTS core + E-AC-3 decode complete (1315d9b)
+- audio support tables: wave 8 partial — Speex, G.723.1, WavPack float, HE-AAC SBR (gated), WMA Pro, Sipro (6dc1d08)
+- audio support tables: heavyweight wave — AAC-LC complete, WavPack/APE reference-faithful, Cook/ATRAC3/AC-3/WMA/Musepack decoders, Vorbis floor 0 (4b77461)
+- Monkey's Audio rewritten reference-faithful: byte-exact SDK range coder, v3990 entropy (pivot/escape), CPredictorDecompress3950 + scaled-first-order + level filter cascades — levels 1000-5000 decode, 1000-4000 encode, VERIFIED BYTE-EXACT against ffmpeg n8.1.1 (encode ours → ffmpeg decodes identically, 8/16/24-bit mono+stereo) (f0e798e)
+- WavPack entropy/decorrelation rewritten to the reference bitstream: holding_one/holding_zero shared unary bits, zeros_acc run coding, exact INC/DEC_MED curves, wp_log2/exp2s entropy vars, decorr weights (restore_weight) + seeded samples honored, INT32/SHIFT fixups, joint-stereo corrected — real-world lossless .wv decode path ! hybrid/float/DSD still rejected; needs a checked-in reference vector for byte-exact proof (364ddc1)
+- audio support tables: wave 6 — Monkey's Audio, RA 14.4, TrueSpeech, Interplay ACM, Nellymoser, Westwood/RoQ/Sierra/CRYO, LPC-10, DTS/AC-3/OMA stream info, VGM/MUS/XMI/CMF converters, 7 chiptune rips (f07bda1)
+- audio support tables: waves 4+5 — console/game codecs (ADX, BRR, XA, EA-XA, Wwise-IMA, AICA, DSP family), telephony (G.726 full set, G.722, CVSD), WavPack, MACE, tracker/sampler/vintage containers, ASF + RealMedia (c10171e)
+- audio support tables: document the new codecs (OkiAdpcm, SpuAdpcm, DspAdpcm, G72x, Tta, Shorten, Alac) and containers (8SVX, AVR, SPHERE, IRCAM, VOX, raw GSM, DSF, DFF, TTA, SHN, VAG, BRSTM, SF2, DLS, raw G.711) + Layer I/II, ima4, Creative ADPCM, CAF ulaw/alaw, WAV float updates (1e5e11e)
+- container vs carried data: FULL.<ext> entries are Kind 'Container' (the byte-exact container itself) across all media pseudo-archives, matching the ALAC/APE precedent; Ogg per-stream packet blobs are Kind 'Stream'; carried A/V tracks keep 'Track', decoded speakers 'Channel', metadata 'Tag' * audio README: document the container/carried-data model and the FFmpeg-faithful channel naming (explicit speaker masks, defaults mono through 22.2, CH_n beyond) (460acc9)
+- audio support table: document MP3/OGG per-channel split + new Opus / AAC channel pseudo-archives (77bbffd)
+- audio support table: AIFF + .au now WORM (assemble from per-channel WAVs); document new CAF / Wave64 / RF64 / VOC channel pseudo-archives (f887d5e)
+- document EROFS / LittleFS / CbmNibble as WORM (now creatable) in the support table (9d3dae3)
+- normalize the package-table NuGet badges to the current shields.io URL form (drop the retired .svg suffix) so they match the badge block (b36f96d)
+- mirror current changelog/prune scripts from the shared template (notes-only mode, bot-commit filtering, prune retry + newest-kept guard) (b7b023c)
+- README: quick-start emoji per the fixed mapping, mandatory support and license sections (156c8b5)
+- force JavaScript actions onto Node 24 ahead of the Node 20 deprecation (710298f)
+- adopt the unified version.pl: the single coordinated version now comes from   Directory.Build.props with the props' parent-folder commit count as the build   number (superset script, identical across repos) * release.yml is manual-dispatch only; release/nightly notes are the commit-prefix   changelog (+ - * # !) via body_path / --notes-file, not GitHub's PR notes * nightly tags switch to yyyyMMdd + run wall-clock Performance tests as an advisory CI tier (continue-on-error) * standardize the README badge block to the house style (canonical order and   colours; adds stars / forks / issues / code-size / repo-size badges) (9d1cb96)
+- LGPL promoted to v3 (e988e92)
+- ConvertArchive: in-memory extract+build+atomic-write when source fits below threshold (245ab96)
+- document ReiserFS/JFS/F2FS/ZFS/APFS as R/W (rebuild-based add/replace/remove) in the support table (4e2ee47)
+- FormatHelpers.FilesOnly/FlatFiles read content via ArchiveInputInfo.ReadContent() so rebuild-based create/add works from in-memory inputs (no temp files); on-disk inputs behave identically (376bb05)
+- ArchiveOperations.Optimize (cwb optimize) routes stream formats through CompressionOptimizer's schema search when the format exposes an option schema, instead of the fixed CompressOptimal heuristic (81f37c2)
+- document filesystem-creation advances in the support table (vision: honest audited state): real nested directories of arbitrary size, cluster-tip wiping, defrag, and external-tool (fsck/xfs_repair/btrfs-check/xorriso) conformance; refresh stale ReiserFS/JFS/F2FS/HFS+/ISO notes (cef5b54)
+- setup-test-environment.sh falls back to an AUR helper (yay/paru/pikaur/trizen) on Arch for AUR-only packages (e2tools, hfsprogs, hfsutils, reiserfsprogs, ocfs2-tools); clear note when no helper is present (aaa6080)
+- docs (e826573)
+- de-toying filesystems (2259a4d)
+
+### Fixed
+- In-memory input reads in 20 filesystem writers for archive conversion (aac5362)
+- In-memory archive inputs fail conversion in 20 descriptors (6e5b686)
+- In-memory ConvertArchive inputs throwing FileNotFound in 21 writers (5ffbdf8)
+- In-memory archive inputs: read via ReadContent() in 21 descriptors (7147f95)
+- Qoi tests: best-effort temp-dir cleanup so a transient handle never fails the test * the three file-I/O tests deleted their Guid temp dir in a finally block; on Windows   under combined-run disk pressure Directory.Delete can transiently throw IOException/   UnauthorizedAccessException (AV/indexer holding a handle), failing a test whose   assertions already passed. SafeDelete swallows those and leaves the dir for the OS   temp sweep (6e90ba4)
+- Remove obsolete tests superseded by the feature merge - HammerWormTests / Hammer2WormTests: asserted HAMMER/HAMMER2 stay read-only,   but the merged feature branch ships real kernel-validated writers (creatable);   the feature branch had already deleted these locks - SysVInPlaceModifyTests: asserted the pre-rewrite SysV layout (boot block all   zero); the merged feature branch relocates the superblock into block 0 at   offset 512 (kernel-mountable) and covers R/W via SysVRwTests (7058626)
+- Drop my Caf/Rf64/Tta pseudo-archive tests superseded by the merged feature versions * the merge kept the feature branch's Caf/Rf64/Tta descriptors (preferred) but my   *PseudoArchiveTests.cs (added under a different filename, so no merge conflict)   asserted my descriptors' surface and failed against theirs; the feature branch's   *Tests.cs cover the same formats and pass (245bdfc)
+- F2fsWriter: section_count must count only the MAIN-area segments (segment_count_main / segs_per_sec), not the total segment count. It was set to the total (31) while the main area holds 24, so the kernel rejected the superblock with "Invalid segment/section count (31, 31 x 1)". Now byte-matches mkfs.f2fs (section_count=24) and the superblock passes the kernel's sanity_check_raw_super ! F2fsWriter: kernel mount now advances past the superblock to checkpoint validation (silent EINVAL); the checkpoint's overprov/rsvd segment counts and flags still differ from mkfs.f2fs and need reconciling before f2fs mounts (2557263)
+- NtfsWriter boot sector: encode clusters_per_index_record (offset 68) with the same signed scheme as the MFT-record field instead of a hardcoded 4 — with a 4 KiB cluster the constant meant 4×4096=16384 bytes per index, which ntfs3 rejects ("unsupported bytes per index 16384"); it must derive the 4 KiB IndexBlockSize # NtfsWriter MFT: give each system record the sequence number ntfs3 demands — $MFT (record 0) = 1, every other system record = its record number (was a blanket 1). ntfs3 strict-checks this and aborted with "MFT: r=N, expect seq=N instead of 1". The kernel now loads $MFT/$MFTMirr/$LogFile/$Volume/$AttrDef/root/$Bitmap/$Boot ! NtfsWriter: $BadClus still needs a named non-resident sparse $Bad $DATA stream covering the volume before ntfs3 mounts fully (currently fails to load $BadClus); a writer feature, not yet implemented (138375c)
+- UFS writer: produce a FreeBSD-fsck_ffs-clean UFS1 image — full rewrite to the multi-cylinder-group newfs -O1 layout (ncg=4, per-cg superblock backups at sblkno=16, inode tables, frag/inode bitmaps, cg cluster+frag summaries, csaddr cs-summary area). Fixes vs the old single-cg format: fs_qbmask/qfmask = ~fs_bmask (size-1); size fields in fragments not blocks; fs_old_rps/interleave/postblformat/nrpos + non-zero cpg/spc/nsect geometry (Phase-5 FPE); directories use 512-byte DIRBLKSIZ chunks (di_size=512) not full blocks (Phase-2 corruption); /.snap surfaced as a real root entry; di_dirdepth set; cg_frsum/cg_clustersum populated; struct csum on-disk order is ndir,nbfree,nifree,nffree # UFS reader/modifier: read the multi-cg layout — skip the synthetic /.snap in listings; modify the root directory in 512-byte DIRBLKSIZ chunks * UFS spec-canary tests updated to the correct newfs values (ncg, ipg, fpg, cg_niblk=0, root ndir). Verified: fsck_ffs -f -n passes all 5 phases CLEAN on a real FreeBSD (mfsBSD) guest under qemu (97d5836)
+- Dynamic VHD CHS geometry rounded down, truncating the disk under qemu-img * ComputeChs rounded cylinders down, so cyls*heads*spt*512 could be smaller   than the payload (e.g. a 1.44 MB / 2880-sector floppy collapsed to 2856   sectors). The qemu vpc driver derives the virtual disk size from CHS, not   the footer size field, so `qemu-img convert -O raw` silently dropped the   tail 24 sectors — caught now that qemu-img validation is wired * ComputeChs: round cylinders UP and escalate the sectors-per-track tier   (17 -> 31 -> 63) per the Microsoft VHD CHS algorithm so the geometry always   covers the whole payload * BuildDynamic: keep the footer current-size at the exact payload (our reader   round-trips byte-for-byte) but size the BAT to the CHS-aligned size so a   CHS-size reader stays in-bounds; the extra tail blocks are sparse zero (fbebcda)
+- qemu-img VHD/VMDK/QCOW2 tests skipped even when qemu-img lives in WSL * route the three disk-container validation tests through QemuImgAnywhereAvailable   + RunQemuImg (WSL-aware) instead of QemuImgAvailable + RunPath (Windows-PATH   only); pass WinToWsl()-translated paths so qemu-img resolves the image whether   it runs natively or inside WSL. With qemu-utils installed in WSL the three   tests now execute and pass — our VHD/VMDK/QCOW2 writers are validated by real   qemu-img info/check rather than silently skipping (5280462)
+- SelfRoundTrip: add 10 missing exclusions for format-specific input constraints + Exclude .g64 / .ani / .as / .dtb / .lnk / .cso / .esd / .mo / .ttc / .win   from SelfRoundTrip_CreateAndExtract — each rejects generic 100-byte .txt/.dat   inputs because the writer expects a format-shaped payload (per-track GCR   sectors, CUR/ICO cursor magic, ProDOS entry id namespace, FDT property   tree, MS-SHLLINK single target, ISO 2 KiB block alignment, WIM file set,   msgid/msgstr pairs, SFNT faces, IFF FORM chunk layout) * GsOsWriter.AddFile: validate name + data at the public-API boundary   (ArgumentNullException.ThrowIfNull) so the writer rejects null inputs at   the call site instead of NRE-ing deep inside the inner ProDOS writer * Build_EmptyName_DoesNotThrowImmediately → Build_EmptyName_DoesNotThrow:   rename + invert assertion to match the actual lenient behaviour — the   inner ProDosWriter accepts an empty name without raising, so the old   expectation never matched reality (5a649fe)
+- UFS cylinder group + size fields: fs_size/fs_old_size/fs_dsize are in FRAGMENTS not blocks (the writer wrongly divided by fs_frag); cg_old_niblk = fs_ipg; cg_niblk/cg_initediblk are UFS2-only (0 on UFS1); rewrite the cg internal offsets (cg_old_btotoff/cg_iusedoff/cg_freeoff/cg_nextfreeoff) to FFS's newfs layout. Verified under FreeBSD fsck_ffs (qemu): superblock + cylinder group + Phase 1 now pass (63f7470)
+- UFS superblock: fix fields fsck_ffs rejects — fs_qbmask/fs_qfmask are the COMPLEMENTS of fs_bmask/fs_fmask (size-1, not ~(size-1)); set the legacy rotational fields newfs writes (fs_old_rps=60, fs_old_interleave=1, fs_old_postblformat=1, fs_old_nrpos=1); fs_sbsize must be sector-aligned (2048); fs_sblockloc=0 for UFS1; fs_maxfilesize set to the real UFS1 limit. Verified by booting FreeBSD fsck_ffs under qemu — the superblock now passes its critical-error checks (a81eaef)
+- Ext schema test: ext4 default no longer asserts 64BIT — it's deliberately not set (32-byte descriptors), matching the fix that makes e2fsck/dumpe2fs accept the volume (1eab3f6)
+- Zstd encoder: raise the match-length cap from Deflate's 258 to the format max (131071) and match across block boundaries via a single frame-wide window — long repeats collapse to one sequence per block instead of thousands of 258-byte matches (1MB single-phrase repeat: 14161 -> well within 1.5x of zstd -19) # Zstd encoder: maintain the repeat-offset history continuously across the frame's blocks (write the evolved history back from EncodeSequences; commit it only when a compressed block is actually emitted) — a per-block [1,4,8] reset emitted repeat-offset codes a spec decoder mis-decoded, so 'zstd -d' failed the content checksum on multi-block output (171b59e)
+- Ext: emit a valid jbd2 journal for ext3/ext4 — the writer set HAS_JOURNAL + journal inode 8 but left it empty, so e2fsck rejected the volume with 'invalid journal (inode 8)'. Now inode 8 is a regular file (mode 0600, like mke2fs) mapping a contiguous clean journal (jbd2 V2 superblock, s_start=0) via direct+single+double-indirect blocks; passes e2fsck -fn cleanly # Ext4: drop the 64BIT incompat flag — it mandates 64-byte block group descriptors / s_desc_size=64 but the writer emits 32-byte descriptors, so dumpe2fs/e2fsck rejected the volume with 'block group descriptor size invalid'. ext4 with extents + journal (no 64BIT) is standard for sub-16TiB volumes # Ext test: debugfs -R command used single quotes, which .NET ProcessStartInfo.Arguments does not group — debugfs saw a stray -l option; use double quotes (757644f)
+- HfsPlus: write volumes as non-journaled — the writer set kHFSVolumeJournaledBit without ever emitting a journalInfoBlock/journal, so fsck.hfsplus reported 'Volume header needs minor repair'. A non-journaled HFS+ volume (mkfs.hfsplus without -J) is standard and passes fsck cleanly; the journaled bit stays clear until a real journal is implemented (758e2f5)
+- SelfRoundTrip: match extracted filenames case-insensitively — vintage uppercase-only 8.3 filesystems (GEMDOS/.st, TRS-DOS, TI-99/.tifd, Apple Pascal/.pvol, Cromemco/.rdos, PC-98/.hdm, Human68k/.2hd) faithfully fold names to uppercase; content is byte-exact, so the case-sensitive glob was the only thing failing (cc030dd)
+- ZIP Shrink: fix encoder/decoder desync on dictionary-filling (high-entropy) input — round-trip now byte-exact # Shrink decoder: detect KwKwK via the occupancy map (code>=257 && !isUsed) instead of code>=nextCode, which misclassified surviving high-value codes after a partial clear reset the free-code cursor # Shrink decoder: reset the free-code cursor to 257 and drop the lagged link after a partial clear so scattered freed slots are reused in the encoder's order; new entry suffix taken from the decoded string (correct in the KwKwK case) # Shrink encoder: reuse freed slots by skipping still-occupied codes (scan-forward) instead of a plain increment that collided with survivors after a partial clear (5ac611f)
+- ProDos volume-dir-header overflow + Cso WORM/RW in-place mutate (e090ad3)
+- Backup format states: Ghost + Macrium are WORM not R/W (only CanCreate, no CanModify) (6d64540)
+- csproj: drop duplicate Macrium ref left after the pre-X cherry-pick conflict (794b4a9)
+- CI: replace removed setup-dotnet@v4 input include-prerelease with dotnet-quality: preview (675daff)
+- SolDpcm codec test: the hand-walk mislabeled 0x4C's nibbles (low nibble is 0xC, sign-negative) — expectation corrected to the documented low-nibble-first convention (b06a454)
+- LittleFS descriptor now lists/extracts real files via the commit-walking reader (was still the legacy superblock-only surface, failing the registry-wide self-round-trip); whole-image read replaces the 64 KiB header cap * self-round-trip excludes .g64 alongside its D64 siblings (GCR-wrapped 1541 image, same PETSCII name constraints) (7d8055f)
+- SelfRoundTrip: exclude backup-disk-image formats (.gho/.sparseimage/.mrimgx) (ed16a51)
+- csproj/slnx: drop duplicate Paragon refs + 10 path-mangled stragglers in test csproj (8ac2141)
+- Shrink encoder desynced the variable code width: it wrote the bit-width-increase sub-command one bit wider than the decoder reads it (decoder consumes the sub-command at the old width, then widens), corrupting all output past the first 9->10 bit boundary # Implode emitted Huffman codes in canonical MSB-first order while the bitstream is LSB-first, so the prefix property was lost and codes collided in the decode table; bit-reverse each code symmetrically on both encoder and decoder (ff8b800)
+- Nightly badge: add filter=nightly-* so it shows the latest nightly, not a same-day stable release (include_prereleases&sort=date alone returns the newest release of any kind) (a14bfdc)
+- Release badge dropped sort=semver so it shows the latest stable release (matching the link) instead of ranking nightly/legacy tags highest (144ae61)
+- nightly badge: include_prereleases must be a valueless shields.io flag — =true renders 'invalid query parameter' (d282f50)
+- LayoutProfileStore.Save: reject both / and \ as path separators cross-platform — Path.GetInvalidFileNameChars only rejects \ on Windows so the Linux CI run accepted "bad\path.json" and the test expecting ArgumentException failed; explicit / and \ checks restore the XML-doc'd contract on all platforms (2642e55)
+- UI: don't block on FormatRegistration during right-click * Add FormatRegistration.IsReady + EnsureInitializedAsync * CanDefragmentSelected + CanAddFiles return false until IsReady so right-click never waits on the warm-up Task * App.OnStartup: ContinueWith → CommandManager.InvalidateRequerySuggested so menu items light up when registry finishes * OnConvertArchive becomes async + shows AppStarting cursor while awaiting EnsureInitializedAsync — visible 'loading…' hint instead of freeze (c48bbc0)
+- FormatRegistration.EnsureInitialized: replace flag-then-register with ManualResetEventSlim so concurrent callers wait for completion instead of seeing a half-populated registry — race window between App.OnStartup background warm-up and synchronous Convert handler caused 'No creatable formats are registered' (fae652c)
+- UI: warm up FormatRegistration + ContextMenu at startup so first right-click no longer blocks * App.OnStartup: kick FormatRegistration.EnsureInitialized() on a background Task so the ~180-descriptor registration runs before the user can right-click * MainWindow.Loaded: pre-touch all 10 context-menu icon resources and force the ContextMenu visual tree to materialize at ApplicationIdle priority by opening + immediately closing it + DEBUG-only Stopwatch via ContextMenuOpening logs first user-triggered popup latency so future regressions are measurable (2872622)
+- SingleFileBundle: Release-only (Debug builds keep multi-file output in bin/Debug/<tfm>/win-x64/ so VS F5 + breakpoint debugging works) (ce0858b)
+- ci.yml: apply same dual-path PNGCrushCS sibling probe + missing-skip gate as _build.yml (both pre-build step instances) (8e5f778)
+- FatWriter.BuildAutoSized: drop 1.44 MB floor, size to cluster-aligned data + 8 cluster slack + 64 KB header overhead (ef8d294)
+- PNGCrushCS sibling: probe both old root layout and new FileFormats/ subdir layout via PngCrushFormatsDir property (26d2c8a)
+- CI: skip PNGCrushCS sibling pre-build when sub-projects are missing (consumer SiblingPresent gate handles fallback) so transient sibling-mid-refactor commits don't break builds (699479f)
+- Block map platter view: real CHS geometry + per-(track,sector) wedge grid + 3D viewport fit with see-through stacked platters (89da06a)
+- FatRemover: walk subdirectory cluster chains + match LFN long names so explorer delete works for nested paths (b864ab0)
+- 2D/3D block map: filled-wedge platter view (UltimateDefrag-style) and stacked-platter cylinder (b99e9a9)
+- Shrink: capture FormatLbl.Text on UI thread before Task.Run (WPF cross-thread access) (84f64a8)
+- ISO appends the conventional 150-sector trailing post-gap (mkisofs/genisoimage style) so isoinfo no longer rejects small images with 'Short read on old image' (5346d80)
+- VDI defaults to the 1 MiB block size qemu-img requires and leaves the link UUID null (standalone image), so qemu-img accepts and converts our VDI (fce6a32)
+- VHDX header CRC-32C covers the 4 KiB header, a mandatory 1 MiB log region is reserved, and metadata items sit past the 64 KiB table — qemu-img now opens/checks/converts our VHDX * VHD interop test validates via qemu-img info (the vpc driver has no check op); uses dynamic VHD so qemu probes it as vpc (f7c70d1)
+- VMDK SparseExtentHeader uses the correct byte-packed field offsets (writer + reader + stream + layout map) and emits a redundant grain directory, so qemu-img recognises/checks/converts our VMDK (49301b8)
+- QCOW2 sets QCOW_OFLAG_COPIED (bit 63) on refcount-1 L1/L2 entries so qemu-img check reports no errors (9b58c27)
+- LBR archive preserves filename case instead of force-uppercasing, so create->extract round-trips on case-sensitive filesystems (c6ff61a)
+- LZ4 frame is now readable by the lz4 CLI: MFLIMIT is 12 and matches never consume the mandatory final 5 literals (fixed in fast + HC encoders; HC lazy-match uses the same end bound so it doesn't defer every position into all-literals) # Zstd frames are readable by the zstd CLI and we read theirs: correct raw-literals Size_Format, spec-conformant Huffman-literals + FSE-table readers, RLE-sequence accuracy-log 0 (9974504)
+- JFS: secondary AIT/AIM copies point at their own extents, inline + external dtree keys are sorted and pages sibling-chained, and each fileset dinode's di_ixpxd matches its inode extent — fsck.jfs -n now exits clean + JFS external-conformance test (fsck.jfs) (61ef102)
+- ReiserFS: disk_child.dc_size now stores child used-bytes (not item count), '.'/'..' carry the correct pointed-to keys (root '..' = [0 1]), and stat-data sd_blocks is computed per spec — reiserfsck --check now reports no corruptions + ReiserFS external-conformance test (reiserfsck) (c31e2a6)
+- HFS+ catalog: chain index-node fLink/bLink siblings (multi-index-node trees were rejected) and sort catalog keys by the declared TN1150 case-folding compare instead of raw UTF-16, so fsck.hfsplus is clean + HfsPlusCaseFold (TN1150 FastUnicodeCompare) + external-conformance test (46e6796)
+- F2FS writer: write a full on-disk SSA + SIT, reserve empty current segments, and place directory entries via the kernel hash-bucket layout so fsck.f2fs reports the image consistent + F2FS external-conformance test (fsck.f2fs) (0cbf190)
+- Btrfs writer: record real tree level in ROOT_ITEM + extent tree-block info, correct metadata block count, and emit regular (non-inline) data extents with EXTENT_DATA_REF for files >= sectorsize (marked NODATASUM) so btrfs check passes clean + Btrfs external-conformance test (btrfs check) (c931add)
+- XFS directories rewritten to valid dir2/dir3 (single-block + leaf form with proper dir3 headers, bestfree, leaf hash index, block tail, v5 CRCs) so xfs_repair -n is fully clean; reader/extent map updated in lockstep + XFS external-conformance test (xfs_repair -n) (470df36)
+- ext writer: block bitmap was off by one on 2 KiB/4 KiB-block images (s_first_data_block is 0, not 1) — corrupted e2fsck; now clean across 1K/2K/4K blocks + ext files support a singly-indirect block (was capped at 12 direct blocks) so larger files round-trip + ext external-conformance test (e2fsck -fn) (5de0e60)
+- ISO writer fills all mandatory ECMA-119 PVD/SVD fields (file-structure-version, space-padded identifier strings, volume date-time fields) so xorriso/libisofs accept the image instead of rejecting a damaged descriptor + ISO external-conformance test (xorriso/isoinfo) (33ed779)
+- defrag planner no longer drops directory-classified extents (they matched no layout bucket and were never moved), so fragmented directories are now planned for consolidation # defrag planner preserves each owner's logical chain order instead of re-sorting extents by physical offset (082bfb2)
+- Yaffs2 scanner detects on-disk geometry robustly so large images with many entries scan correctly (e68fbd7)
+- FAT and ADF directory entries now carry real timestamps instead of the 1980 epoch # FAT root-directory overflow throws a clear error instead of silently corrupting data # archive directory walk skips inaccessible subdirs instead of crashing the whole operation # FAT32 auto-size targets the cluster minimum instead of a fixed ~97 MB image ! FAT writer still flattens subdirectory trees into the root, which can force FAT32 and oversize the image (4f230c3)
+- add missing FormatSpecific property that XML-doc crefs referenced (was breaking the build) * XML-doc comment warnings (CS1570-1591) no longer escalate to build errors (4da1d82)
+- ubuntu builds (6e11a18)
+- PCM dep (54f4b58)
+- generating bundles (13ed84c)
+- several FS bugs (903caa9)
+
+### TODO
+- JuiceFs Stage-0 confirmed: no standalone on-disk image format (metadata in external DB + data in object store) (06a64c1)
+- BeeGfs Stage-0 confirmed: no standalone on-disk image (metadata across MDT processes + data across storage targets) (bed7de4)
+- GlusterFs Stage-0 confirmed: bricks are normal directories on local FS (no standalone image; magic only via xattr on directory contents, which doesn't fit our image-based pipeline) (a498fb3)
+- CephFs Stage-0 confirmed: no standalone image (metadata in RADOS pool + data across striped RADOS objects via OSDs) (479beeb)
+- Gpfs Stage-0 confirmed: proprietary IBM on-disk format; NSD descriptor detection only, full layout not publicly specified (f5eaa33)
+- OneFs Stage-0 confirmed: proprietary EMC clustered FS; UFS-derived but OneFS extensions not publicly specified (8dce87f)
+- Wafl Stage-0 confirmed: proprietary NetApp on-disk format; copy-on-write tree layout partially reverse-engineered but not safely implementable from spec (0941805)
+
+### Other
+- Merge remote-tracking branch 'origin/feature/filesystem-creation-options' (2d01e2f)
+- Merge remote-tracking branch 'origin/main' (5781f38)
+- Merge branch 'main' of https://github.com/Hawkynt/CompressionWorkbench (0acdcd9)
+- ci: fix Linux build by tracking ignored sources and isolating cross-repo refs (10819fe)
+
diff --git a/Hawkynt.FileFormats.Archives/README.md b/Hawkynt.FileFormats.Archives/README.md
index 6b7a34cac..656231075 100644
--- a/Hawkynt.FileFormats.Archives/README.md
+++ b/Hawkynt.FileFormats.Archives/README.md
@@ -3222,7 +3222,7 @@ Implements `IFormatDescriptor`, `IStreamFormatOperations`.
 
 #### `CscStream`
 
-CSC: Context Stream Compression by Fu Siyuan. Format: 10-byte big-endian property header + 4-byte uncompressed size, then range-coded LZ77. Header layout: uint32 dict_size \| uint24 csc_blocksize \| uint24 raw_blocksize \| uint32 actual_size
+CSC: Context Stream Compression by Fu Siyuan. Format: 10-byte big-endian property header + 4-byte uncompressed size, then range-coded LZ77. Header layout: uint32 dict_size | uint24 csc_blocksize | uint24 raw_blocksize | uint32 actual_size
 
 | Member | Signature | Summary |
 | --- | --- | --- |
@@ -4820,7 +4820,7 @@ DEFLATE (RFC 1951) decoder for the PEtite dialect: block type 1 carries the dyna
 
 #### `PetiteUnpacker`
 
-Container format of a PEtite-packed Win32 PE, reconstructed from the on-disk layout and the entry stub of the samples themselves. A PEtite image keeps the original section virtual addresses. The packed bytes live in one oversized section mapped at the first original section's RVA; a second section holds the untouched resources; the last section (the one the entry point falls into) holds the loader stub. Right behind the stub code sits a block table that drives unpacking:a record whose first dword has bit 31 set is a descending `rep movsd` — `{0x80000000\|dwordCount, sourceEndRva, destinationEndRva}`, 12 bytes — which lifts the packed bytes out of the way of the image that is about to be written over them;any other record is `{sourceRva, decompressedSize, destinationRva, unused}`, 16 bytes, and expands one original section in place. A zero length marks an original section without initialised data and is skipped; a zero source ends the table.The compressed streams are DEFLATE (RFC 1951) with one deviation: the stub has no fixed-Huffman tables, so block type `1` selects the dynamic Huffman tables that standard DEFLATE assigns to type `2`, and types 2 and 3 are rejected. Everything else — LSB-first bit order, the 14-bit HLIT/HDIST/HCLEN header, the code-length alphabet, the length/distance base and extra-bit tables — matches RFC 1951 byte for byte; those five tables are stored verbatim at the head of the stub section and were read from there.Code blocks are additionally stored with relative branch targets converted to absolute ones: scanning forward, every `E8`/`E9` and every `0F 80..0F 8F` has the block offset of its opcode added to the following dword, and the scan then skips the whole instruction. Reversing it subtracts the same offset again. References: `https://www.rfc-editor.org/rfc/rfc1951` — DEFLATE compressed data format`https://www.un4seen.com/petite/` — PEtite (Ian Luck / Un4seen Developments)
+Container format of a PEtite-packed Win32 PE, reconstructed from the on-disk layout and the entry stub of the samples themselves. A PEtite image keeps the original section virtual addresses. The packed bytes live in one oversized section mapped at the first original section's RVA; a second section holds the untouched resources; the last section (the one the entry point falls into) holds the loader stub. Right behind the stub code sits a block table that drives unpacking:a record whose first dword has bit 31 set is a descending `rep movsd` — `{0x80000000|dwordCount, sourceEndRva, destinationEndRva}`, 12 bytes — which lifts the packed bytes out of the way of the image that is about to be written over them;any other record is `{sourceRva, decompressedSize, destinationRva, unused}`, 16 bytes, and expands one original section in place. A zero length marks an original section without initialised data and is skipped; a zero source ends the table.The compressed streams are DEFLATE (RFC 1951) with one deviation: the stub has no fixed-Huffman tables, so block type `1` selects the dynamic Huffman tables that standard DEFLATE assigns to type `2`, and types 2 and 3 are rejected. Everything else — LSB-first bit order, the 14-bit HLIT/HDIST/HCLEN header, the code-length alphabet, the length/distance base and extra-bit tables — matches RFC 1951 byte for byte; those five tables are stored verbatim at the head of the stub section and were read from there.Code blocks are additionally stored with relative branch targets converted to absolute ones: scanning forward, every `E8`/`E9` and every `0F 80..0F 8F` has the block offset of its opcode added to the following dword, and the scan then skips the whole instruction. Reversing it subtracts the same offset again. References: `https://www.rfc-editor.org/rfc/rfc1951` — DEFLATE compressed data format`https://www.un4seen.com/petite/` — PEtite (Ian Luck / Un4seen Developments)
 
 | Member | Signature | Summary |
 | --- | --- | --- |
@@ -9003,8 +9003,8 @@ WORM writer for the NumPy NPY array serialization format (NEP 1). Emits a v1 fil
 | Member | Signature | Summary |
 | --- | --- | --- |
 | `DefaultDtype` | `const string DefaultDtype` | Default dtype string used when no explicit type is supplied. |
-| `Write` | `static void Write(Stream output, ReadOnlySpan<byte> payload, string dtype = "|u1", string shape = null, bool fortranOrder = false)` | Writes an NPY file from `payload` with the supplied dtype/shape header. When `shape` is null, a 1-D shape matching the payload's element count is inferred from the dtype's item-size. |
-| `Write` | `static void Write(Stream output, byte[] payload, string dtype = "|u1", string shape = null, bool fortranOrder = false)` | Convenience: writes an NPY file from a byte array. See span overload for parameter docs. |
+| `Write` | `static void Write(Stream output, ReadOnlySpan<byte> payload, string dtype = "\|u1", string shape = null, bool fortranOrder = false)` | Writes an NPY file from `payload` with the supplied dtype/shape header. When `shape` is null, a 1-D shape matching the payload's element count is inferred from the dtype's item-size. |
+| `Write` | `static void Write(Stream output, byte[] payload, string dtype = "\|u1", string shape = null, bool fortranOrder = false)` | Convenience: writes an NPY file from a byte array. See span overload for parameter docs. |
 
 #### `NpzFormatDescriptor`
 
@@ -11909,8 +11909,8 @@ Reader and writer for the Microsoft SZDD / COMPRESS.EXE file format. SZDD uses a
 | --- | --- | --- |
 | `CompressQBasic` | `static byte[] CompressQBasic(ReadOnlySpan<byte> data)` | Compresses `data` in the older "SZ " (QBasic) COMPRESS variant and returns the result. The body is the same LZSS stream as SZDD, wrapped in the 12-byte "SZ " header (8-byte magic + little-endian u32 uncompressed length). Round-trips through `Decompress`. |
 | `CompressQBasic` | `static void CompressQBasic(Stream input, Stream output)` | Stream overload of `CompressQBasic`. |
-| `Compress` | `static byte[] Compress(ReadOnlySpan<byte> data, char missingChar = _)` | Compresses `data` in SZDD format and returns the result as a new byte array. |
-| `Compress` | `static void Compress(Stream input, Stream output, char missingChar = _)` | Compresses `input` in SZDD format and writes the result to `output`. |
+| `Compress` | `static byte[] Compress(ReadOnlySpan<byte> data, char missingChar = '_')` | Compresses `data` in SZDD format and returns the result as a new byte array. |
+| `Compress` | `static void Compress(Stream input, Stream output, char missingChar = '_')` | Compresses `input` in SZDD format and writes the result to `output`. |
 | `Decompress` | `static byte[] Decompress(ReadOnlySpan<byte> data)` | Decompresses an SZDD-encoded byte array and returns the raw data. |
 | `Decompress` | `static void Decompress(Stream input, Stream output)` | Decompresses an SZDD-encoded stream and writes the raw data to `output`. |
 | `GetMissingChar` | `static char GetMissingChar(Stream input)` | Returns the "missing character" stored in the SZDD header — the last character of the original filename extension before it was replaced with `'_'`. |
diff --git a/Hawkynt.FileFormats.FileSystems/README.md b/Hawkynt.FileFormats.FileSystems/README.md
index af7ac0e76..b2bf80568 100644
--- a/Hawkynt.FileFormats.FileSystems/README.md
+++ b/Hawkynt.FileFormats.FileSystems/README.md
@@ -921,7 +921,7 @@ Reader for Intel HEX records (`:LLAAAATT[DD…]CC`), the long-standing flash-pro
 
 #### `SRecordReader`
 
-Reader for Motorola S-Record files (`Stnn[aaaa\|aaaaaa\|aaaaaaaa]dd…cc`). Recognised types: S0 header, S1/S2/S3 data (16/24/32-bit address), S5/S6 record counts (informational), S7/S8/S9 termination (32/24/16-bit start addr).
+Reader for Motorola S-Record files (`Stnn[aaaa|aaaaaa|aaaaaaaa]dd…cc`). Recognised types: S0 header, S1/S2/S3 data (16/24/32-bit address), S5/S6 record counts (informational), S7/S8/S9 termination (32/24/16-bit start addr).
 
 | Member | Signature | Summary |
 | --- | --- | --- |
@@ -2820,7 +2820,7 @@ Random-access in-place modifier for BBC Micro Acorn DFS `.ssd` images. The DFS c
 
 | Member | Signature | Summary |
 | --- | --- | --- |
-| `AddFile` | `static void AddFile(Stream image, string name, byte[] data, char directory = $, uint loadAddr = 6400, uint execAddr = 6400, bool locked = false)` | Adds a file to an existing single-sided DFS image. Caller is responsible for ensuring the name does not already exist (use `RemoveFile` first for replace-by-name semantics). The file is placed in the lowest contiguous gap large enough to hold it. |
+| `AddFile` | `static void AddFile(Stream image, string name, byte[] data, char directory = '$', uint loadAddr = 6400, uint execAddr = 6400, bool locked = false)` | Adds a file to an existing single-sided DFS image. Caller is responsible for ensuring the name does not already exist (use `RemoveFile` first for replace-by-name semantics). The file is placed in the lowest contiguous gap large enough to hold it. |
 | `RemoveFile` | `static bool RemoveFile(Stream image, string name, bool wipeData = true)` | Removes a named file from the image. Returns true if found and removed. When `wipeData` is true, the data sectors are zeroed. |
 
 #### `BbcReader`
@@ -2855,7 +2855,7 @@ Builds a fresh BBC Micro Acorn DFS `.ssd` single-sided disk image from scratch (
 | `SectorSize` | `const int SectorSize` |  |
 | `SectorsPerTrack` | `const int SectorsPerTrack` |  |
 | `TotalSectors40` | `const int TotalSectors40` |  |
-| `AddFile` | `void AddFile(string name, byte[] data, char directory = $, uint loadAddr = 6400, uint execAddr = 6400, bool locked = false)` |  |
+| `AddFile` | `void AddFile(string name, byte[] data, char directory = '$', uint loadAddr = 6400, uint execAddr = 6400, bool locked = false)` |  |
 | `Build` | `byte[] Build(string diskTitle = "WORMDISK", int bootOption = 0)` | Builds the complete 40-track SSD image (100 000 bytes). |
 
 ### Namespace `FileSystem.BcacheFs`
@@ -3232,7 +3232,7 @@ From-scratch writer for the Commodore nibble container the `CbmNibbleReader` con
 | `AddFile` | `void AddFile(string name, byte[] data)` | Adds a file to the flat directory. Commodore names are PETSCII and at most 16 characters; longer names are truncated. The default file type is PRG. |
 | `Build` | `byte[] Build()` | Builds the G64 GCR nibble image holding all added files. |
 | `DecodeToD64` | `static byte[] DecodeToD64(NibbleImage image)` | Reconstructs a standard 174 848-byte D64 image from the GCR tracks of a nibble image previously parsed by `CbmNibbleReader`. Each track is rescanned for sync marks and its header/data blocks GCR-decoded back into the correct sector slots. |
-| `SetDisk` | `void SetDisk(string name, char id1 = 0, char id2 = 0)` | Sets the on-disk volume name (PETSCII, ≤16 chars) and the 2-byte disk id. |
+| `SetDisk` | `void SetDisk(string name, char id1 = '0', char id2 = '0')` | Sets the on-disk volume name (PETSCII, ≤16 chars) and the 2-byte disk id. |
 | `WriteTo` | `void WriteTo(Stream output)` | Writes the G64 image to `output`. |
 
 #### `G64FormatDescriptor`
@@ -6152,7 +6152,7 @@ Implements `IDisposable`.
 
 #### `JfsWriter`
 
-Writes a minimal IBM Journaled File System (JFS1) aggregate image with a single allocation group, one fileset, and an inline dtree root directory. Byte layout matches the on-disk structures in `linux/fs/jfs` and the `jfsutils` reference (mkfs.jfs / fsck.jfs); validated by exit-zero from `fsck.jfs -n -f -v`. All integer fields are little-endian. `pxd_t` is packed as `len_addr = (len & 0xFFFFFF) \| ((addr >> 32) << 24)`, `addr2 = addr & 0xFFFFFFFF`. Dtree slot names are UCS-2 (UTF-16 LE). Round-trips through `JfsReader`. Aggregate inode table (block 11..14, IXSIZE=16 KB) holds the AGGR_RESERVED_I (0), AGGREGATE_I (1, → AIM), BMAP_I (2, → block-allocation map), LOG_I (3), BADBLOCK_I (4) and FILESYSTEM_I (16, → fileset AIM) metadata inodes. The fileset inode table at blocks 29..32 holds FILESET_RSVD_I (0), FILESET_EXT_I (1), ROOT_I (2, dtroot inline), ACL_I (3) and user file inodes (4+).
+Writes a minimal IBM Journaled File System (JFS1) aggregate image with a single allocation group, one fileset, and an inline dtree root directory. Byte layout matches the on-disk structures in `linux/fs/jfs` and the `jfsutils` reference (mkfs.jfs / fsck.jfs); validated by exit-zero from `fsck.jfs -n -f -v`. All integer fields are little-endian. `pxd_t` is packed as `len_addr = (len & 0xFFFFFF) | ((addr >> 32) << 24)`, `addr2 = addr & 0xFFFFFFFF`. Dtree slot names are UCS-2 (UTF-16 LE). Round-trips through `JfsReader`. Aggregate inode table (block 11..14, IXSIZE=16 KB) holds the AGGR_RESERVED_I (0), AGGREGATE_I (1, → AIM), BMAP_I (2, → block-allocation map), LOG_I (3), BADBLOCK_I (4) and FILESYSTEM_I (16, → fileset AIM) metadata inodes. The fileset inode table at blocks 29..32 holds FILESET_RSVD_I (0), FILESET_EXT_I (1), ROOT_I (2, dtroot inline), ACL_I (3) and user file inodes (4+).
 
 | Member | Signature | Summary |
 | --- | --- | --- |
@@ -7535,7 +7535,7 @@ Implements `IArchiveCreatable`, `IArchiveDefragmentable`, `IArchiveFormatOperati
 
 #### `Ocfs2InPlaceModifier`
 
-True in-place R/W modifier for OCFS2 (Oracle Cluster Filesystem 2) images produced by `Ocfs2Writer`. Performs O(touched bytes) random-access I/O against the image: only the global bitmap data block, the root directory dinode (inline dirents), the affected file dinode block, and the file's data blocks are read or written. No whole-image read or rewrite. Layout (matches `Ocfs2Writer`'s single-node geometry): 4 KB blocks = 4 KB clusters; one dinode per block.Superblock dinode at block 2; global bitmap dinode at block 3; bitmap data at block 4 (1 bit per cluster, LSB-first, bit=1 means used).Root directory dinode at block 5 (INODE01) with inline dirents in id2 after the 8-byte ocfs2_inline_data header (id2 + 8), each entry `inode(8) \| rec_len(2) \| name_len(1) \| file_type(1) \| name[]`.User files start at block 8: each gets one dinode block, plus contiguous data clusters whose run is held in a single extent record.Scope (MVP, single-node only): root-directory mutations only. Sub-directory mutation, DLM/heartbeat lockdown, multi-node cluster semantics, and root-directory B-tree splits (extent-backed root) are out of scope and throw `NotSupportedException` if encountered.
+True in-place R/W modifier for OCFS2 (Oracle Cluster Filesystem 2) images produced by `Ocfs2Writer`. Performs O(touched bytes) random-access I/O against the image: only the global bitmap data block, the root directory dinode (inline dirents), the affected file dinode block, and the file's data blocks are read or written. No whole-image read or rewrite. Layout (matches `Ocfs2Writer`'s single-node geometry): 4 KB blocks = 4 KB clusters; one dinode per block.Superblock dinode at block 2; global bitmap dinode at block 3; bitmap data at block 4 (1 bit per cluster, LSB-first, bit=1 means used).Root directory dinode at block 5 (INODE01) with inline dirents in id2 after the 8-byte ocfs2_inline_data header (id2 + 8), each entry `inode(8) | rec_len(2) | name_len(1) | file_type(1) | name[]`.User files start at block 8: each gets one dinode block, plus contiguous data clusters whose run is held in a single extent record.Scope (MVP, single-node only): root-directory mutations only. Sub-directory mutation, DLM/heartbeat lockdown, multi-node cluster semantics, and root-directory B-tree splits (extent-backed root) are out of scope and throw `NotSupportedException` if encountered.
 
 | Member | Signature | Summary |
 | --- | --- | --- |
@@ -10429,7 +10429,7 @@ Builds a fresh ZX Spectrum `.scl` TR-DOS archive from scratch (WORM).
 | --- | --- | --- |
 | `ZxSclWriter` | `ZxSclWriter()` |  |
 | `MaxEntries` | `const int MaxEntries` | TR-DOS hard cap: headers are stored in a single 256-entry directory-like table. |
-| `AddFile` | `void AddFile(string name, byte[] data, char fileType = C, ushort param1 = 32768, ushort param2 = 0)` |  |
+| `AddFile` | `void AddFile(string name, byte[] data, char fileType = 'C', ushort param1 = 32768, ushort param2 = 0)` |  |
 | `Build` | `byte[] Build()` |  |
 
 <!-- API:END -->