# M12-04G Status

status: done
task: reject archive compression bombs, overlapping ranges, duplicate paths, and prefix conflicts
updated: 2026-08-18 America/New_York
enablingTask: false
parityStateChange: false

## Scope

Archive range validation now checks each compressed range against the declared source length and the
global archive bound, sorts ranges by offset, and rejects overlap before any payload read. It also
rejects duplicate canonical paths, file/directory prefix conflicts, zero-byte compression bombs, and
expansion ratios above 100:1. Valid ranges return deterministic totals and explicit non-overlap/path
invariants.

## Evidence

- `npm --prefix web run test:library-archive-conflicts` passed 4/4 unit tests.
- Non-overlapping ranges produce stable compressed/uncompressed totals.
- Compression-ratio, overlap, duplicate, prefix, source-bound, and undeclared-field negatives all
  return `IO_ARCHIVE_UNSAFE` before payload scheduling.

## Artifact Hashes

- parent manifest: `cda905b1e27b62d9ea3a05170f975015480ce6739c15bdf1f5a1f0b79f93ce06`
- protocol: `3bec372e4f67ec309f28534cebcbaf8b492144adfa82ff6c8603f88c3ba16254`
- unit: `3f2d44dce33b1c17b3a48f58b04fdd821abc88d98ce3d3b5bb724859e0f0ab3c`
- package commands: `cfb232baa494ff59f6c8d65514a08c86332ee9354350b2a0392b6f932a7ee42c`

## Next Task

`M12-04H`: cancellation removes staging and never modifies the committed project.

## Rollback

Remove the archive conflict protocol, unit suite, manifest, package command, and this status entry.
Restore M12-04F to pending and move the machine queue back to `M12-04G`. No parity ledger rollback is
required.