A decoder should not collapse every refusal into a generic corruption error. The operator needs to know whether the current host lacks a required decoder, the archive is structurally malformed, a valid request exceeds policy, decoded bytes fail integrity, or the destination blocks an otherwise valid extraction. Those outcomes imply different recovery actions and different levels of trust in the archive.
Named failures also make negative conformance useful. A test vector should prove not only that an archive was rejected, but that it was rejected at the intended boundary before an allocation, child process, or destination write escaped its budget. That turns a defensive check into evidence that future implementations can reproduce.
The central rule is simple: metadata proposes work, policy authorizes resources, and verification decides whether the result is true. No successful parser, available codec, or valid digest may silently stand in for the other decisions.
Denied-operation matrix
Not ready
A required decoder is unavailable. No integrity conclusion has been reached.
Malformed
Container, manifest, size, mode, or reference structure is invalid.
Budget denied
The request is structurally valid but exceeds a named resource ceiling.
Integrity failed
Decoded bytes disagree with required size, digest, stream, or reference evidence.
Extraction denied
Destination, overwrite, symlink, or path policy blocks the write.
Included in this edition
Everything below is part of the article itself unless it says otherwise. No software, repository access, or product license is included.
Independent decoder budget matrix
Table in the article
Eight separately enforced resource boundaries and their required responses.
Child-process supervision pattern
Code or pseudocode in the article
A bounded lifecycle for stdout, stderr, deadline, termination, and reap.
Safe destination walk
Written record in the article
A component-by-component extraction policy that stays inside the approved root.
Failure taxonomy
Table in the article
Distinct not-ready, malformed, budget-denied, integrity-failed, and extraction-denied states.
Staged adoption checklist
Checklist in the article
A practical sequence for adding bounds without rewriting the entire decoder.
Continue reading · Public introduction
The argument in context
Decompression is not merely the inverse of compression. It is resource scheduling performed against declarations supplied by an archive you do not yet trust.
Premium Infrastructure Record
The Archive Is Asking For Resources
Every stored size, raw size, manifest length, path, transform mode, and dependency identifier is a request. A naive decoder accepts those requests as facts. A safe decoder treats them as untrusted proposals that must fit an independent operating budget.
This reframing changes the architecture. Instead of asking only whether a codec can reverse a payload, the system asks how much output may be materialized, how long a child process may live, how much diagnostic text it may emit, where temporary bytes may land, which destination components may be traversed, and what evidence must survive when the operation stops.
Expansion
Declared output is a request to validate, not permission to allocate.
Processes
Codec stdout, stderr, lifetime, and exit behavior each need independent limits.
Storage
Memory and temporary disk are separate budgets with an intentional spill boundary.
Paths
Every destination component must remain inside the approved extraction root.
Three States That Must Not Collapse
Decoder readiness answers whether the current host has the tools required by the archive. Integrity answers whether stored bytes, sizes, hashes, references, and streams verify. Extraction permission answers whether this destination and overwrite plan are allowed now. One green state cannot stand in for the others.
The proposed no-write plan separates these questions before payload writes. Its result describes the checked state; extraction must enforce destination policy again when it runs.
Editorial review · September 5, 2026. This is architecture guidance informed by a dated local checkpoint, not a new experiment or general safety certification. Read the correction and source boundary.
Edition
Infrastructure edition 1.0
Published
Updated
Reading time
7 minutes
Full edition
1,690 words
Article status
Current record
Who this is for
Archive and storage engineers designing bounded decoders.
Builders who need negative conformance evidence, not only happy-path restore tests.
Not for
Readers seeking a format implementation, private test corpus, or proprietary codec-selection recipe.
Detailed contents
01
The decoder threat model
Why parsing an archive does not authorize its resource requests.
02
Independent resource budgets
Output, memory, disk, process, time, and path ceilings.
03
Tighter derived limits
How child operations inherit smaller limits without expanding authority.
04
Child-process supervision
Concurrent draining, deadlines, termination, and reap evidence.
05
Stream and spool boundaries
When file-backed transforms are safer than memory growth.
06
Readiness, integrity, and permission
Three states that must remain independent.
07
Destination safety
Traversal, symlink, overwrite, and extraction-root checks.
08
Failure and conformance
Named denial classes, negative vectors, and retained evidence.
Evidence and method
mixed: Architecture guidance and illustrative pseudocode, informed by official systems documentation and the dated August local source note. No new experiment or general safety certification is reported.
