v4.0.0: codec 2.60.4 security release, --pq-box sealed-box mode, F-16 fix

Major release. Highlights:

- Codec: vendored VaptVupt codec moves to canonical 2.60.4 security
  release. Fixes a high-severity OOB heap write in the AVX2 decode fast
  path (reachable on a valid stream sized to exactly content_size, both
  tail variants). Brings CBMC-formally-verified BCJ filters with
  automatic ELF/PE/Mach-O detection. Compressed output stays
  byte-identical (ratio gate Δ 0.00%); wire format unchanged at v1.6.
- New --pq-box sealed-box recipient mode (vendored libpqvaptvupt 0.6.0):
  ML-KEM-768 + X25519 combined via HKDF-SHA256 with domain separation,
  AES-256-CTR + HMAC-SHA256 EtM. Legacy --pq and --pq-sdk stay readable.
- F-16: discloses and fixes a pre-existing data-loss defect in the
  <= 3.8.0 in-tree BCJ encoder. Full back-compat matrix decodes
  byte-exact under 4.0.0; every readable pre-4.0 archive remains readable.

Repository hygiene:
- Sync full 4.0.0 source tree (codec, crypto, SDK, GUI, packaging, tests).
- Remove internal scratch files (PROMPT.md, FORMAL_AUDIT_PROMPT.md)
  and superseded version-specific docs (INTEGRATION_PROTOCOL_2.60.4.md,
  docs/FINDINGS-2.x.md) and a stray test binary.
- Refresh README download/install section to real 4.0.0 release assets;
  bump version badge to 4.0.0.
- Add .gitignore for build outputs (keeps vendored prebuilt libraries).

completions/_vaptvupt

@@ -0,0 +1,136 @@
+#compdef vaptvupt zupt
+# SPDX-License-Identifier: AGPL-3.0-or-later
+# Copyright (c) 2025-2026 Cristian Cezar Moisés
+#
+# Install:
+#   sudo install -m 644 completions/_zupt /usr/share/zsh/site-functions/_zupt
+# or for a single user (anywhere in $fpath):
+#   cp completions/_zupt ~/.zsh/completion/_zupt
+#   # then in ~/.zshrc:
+#   #   fpath=(~/.zsh/completion $fpath)
+#   #   autoload -U compinit && compinit
+
+_zupt_levels() {
+    _values 'compression level' \
+        '1[fastest, smallest window]' \
+        '2[fast]' \
+        '3[balanced (low)]' \
+        '4[balanced]' \
+        '5[balanced (high)]' \
+        '6[high compression]' \
+        '7[default; high]' \
+        '8[maximum, 1MB window]' \
+        '9[maximum, deep search]'
+}
+
+_zupt_kdf() {
+    _values 'KDF' \
+        'argon2id[memory-hard, default since v2.4.1]' \
+        'pbkdf2[legacy 600k-iter PBKDF2-SHA256]'
+}
+
+_zupt_threads() {
+    _values 'threads' '0[auto]' '1' '2' '4' '8' '16' '32' '64'
+}
+
+_zupt_compress_opts() {
+    _arguments \
+        '(-l --level)'{-l,--level}'[compression level]:level:_zupt_levels' \
+        '(-b --block)'{-b,--block}'[block size in bytes]:size:' \
+        '(-s --store)'{-s,--store}'[store without compression]' \
+        '(-f --fast)'{-f,--fast}'[use fast LZ codec]' \
+        '(--vv --vaptvupt)'{--vv,--vaptvupt}'[use VaptVupt codec]' \
+        '--lzhp[use Zupt-LZHP codec (LZ77+Huffman, no SIMD)]' \
+        '(-p --password)'{-p,--password}'[encrypt with password]:password:' \
+        '--kdf[password KDF]:kdf:_zupt_kdf' \
+        '(-c --comment)'{-c,--comment}'[embed archive comment]:text:' \
+        '--comment-file[read comment from file]:file:_files' \
+        '--pq[legacy PQ encryption]:pubkey:_files' \
+        '--pq-sdk[PQ encryption via libzuptsdk]:pubkey:_files' \
+        '(-D --dedup)'{-D,--dedup}'[block-level deduplication]' \
+        '--solid[solid mode: single stream]' \
+        '(-v --verbose)'{-v,--verbose}'[verbose output]' \
+        '(-q --quiet)'{-q,--quiet}'[suppress non-error output]' \
+        '(-t --threads)'{-t,--threads}'[thread count]:threads:_zupt_threads' \
+        '*:files:_files'
+}
+
+_zupt_extract_opts() {
+    _arguments \
+        '(-o --output)'{-o,--output}'[output directory]:directory:_directories' \
+        '(-p --password)'{-p,--password}'[decryption password]:password:' \
+        '--pq[legacy PQ decryption]:privkey:_files' \
+        '--pq-sdk[PQ decryption via libzuptsdk]:privkey:_files' \
+        '(-v --verbose)'{-v,--verbose}'[verbose output]' \
+        '(-t --threads)'{-t,--threads}'[thread count]:threads:_zupt_threads' \
+        '*:archive:_files -g "*.zupt"'
+}
+
+_zupt() {
+    local context curcontext="$curcontext" state line
+    local -a subcommands
+
+    subcommands=(
+        'compress:create an archive'
+        'c:create an archive (alias)'
+        'extract:extract an archive'
+        'x:extract an archive (alias)'
+        'list:list archive entries'
+        'l:list archive entries (alias)'
+        'test:verify archive integrity'
+        't:verify archive integrity (alias)'
+        'info:archive metadata (no key needed)'
+        'bench:benchmark levels 1-9'
+        'disk:full-disk backup/restore'
+        'keygen:generate a key file'
+        'version:print version info'
+        'help:print help'
+    )
+
+    _arguments -C \
+        '(-): :->command' \
+        '(-)*:: :->args'
+
+    case $state in
+        command)
+            _describe -t commands 'zupt subcommand' subcommands
+            ;;
+        args)
+            case $line[1] in
+                compress|c)
+                    _zupt_compress_opts
+                    ;;
+                extract|x)
+                    _zupt_extract_opts
+                    ;;
+                list|l|test|t)
+                    _arguments \
+                        '(-p --password)'{-p,--password}'[password]:password:' \
+                        '--pq[legacy PQ privkey]:privkey:_files' \
+                        '--pq-sdk[PQ privkey]:privkey:_files' \
+                        '(-v --verbose)'{-v,--verbose}'[verbose]' \
+                        '*:archive:_files -g "*.zupt"'
+                    ;;
+                info)
+                    _arguments '*:archive:_files -g "*.zupt"'
+                    ;;
+                disk)
+                    _values 'disk action' 'backup' 'restore'
+                    ;;
+                keygen)
+                    _arguments \
+                        '--sdk[generate SDK v2 keypair]' \
+                        '--pq-sdk[same as --sdk]' \
+                        '-o[output keyfile]:file:_files' \
+                        '--pub[export public key from -k]' \
+                        '-k[source private key for --pub]:file:_files'
+                    ;;
+                bench)
+                    _arguments '*:files:_files'
+                    ;;
+            esac
+            ;;
+    esac
+}
+
+_zupt "$@"

completions/vaptvupt.bash

@@ -0,0 +1,160 @@
+# bash completion for vaptvupt (with `zupt` legacy alias)
+# SPDX-License-Identifier: AGPL-3.0-or-later
+# Copyright (c) 2025-2026 Cristian Cezar Moisés
+#
+# Install (system-wide):
+#   sudo install -m 644 completions/vaptvupt.bash /usr/share/bash-completion/completions/vaptvupt
+#   sudo ln -sf vaptvupt /usr/share/bash-completion/completions/zupt
+# or for a single user:
+#   cp completions/vaptvupt.bash ~/.local/share/bash-completion/completions/vaptvupt
+#
+# Reload your shell or `source` the file to pick up changes.
+
+_vaptvupt() {
+    local cur prev words cword
+    _init_completion -n = 2>/dev/null || {
+        # _init_completion missing on this host; fall back to manual setup.
+        local IFS=$' \t\n'
+        COMPREPLY=()
+        cur="${COMP_WORDS[COMP_CWORD]}"
+        prev="${COMP_WORDS[COMP_CWORD-1]}"
+        cword=$COMP_CWORD
+        words=("${COMP_WORDS[@]}")
+    }
+
+    local subcommands="compress c extract x list l test t info bench disk keygen version help"
+    local global_opts="-v --verbose -q --quiet -t --threads -h --help"
+
+    # First positional → subcommand
+    if [ "$cword" -eq 1 ]; then
+        COMPREPLY=( $(compgen -W "$subcommands" -- "$cur") )
+        return 0
+    fi
+
+    local subcmd="${words[1]}"
+
+    case "$prev" in
+        -p|--password)
+            # Don't complete passwords from filesystem
+            COMPREPLY=()
+            return 0
+            ;;
+        -l|--level)
+            COMPREPLY=( $(compgen -W "1 2 3 4 5 6 7 8 9" -- "$cur") )
+            return 0
+            ;;
+        --kdf)
+            COMPREPLY=( $(compgen -W "argon2id pbkdf2" -- "$cur") )
+            return 0
+            ;;
+        -t|--threads)
+            COMPREPLY=( $(compgen -W "0 1 2 4 8 16 32" -- "$cur") )
+            return 0
+            ;;
+        -b|--block)
+            COMPREPLY=( $(compgen -W "65536 131072 262144 524288 1048576" -- "$cur") )
+            return 0
+            ;;
+        -o|--output)
+            _filedir -d
+            return 0
+            ;;
+        --pq|--pq-sdk)
+            # Key files (no extension constraint)
+            _filedir
+            return 0
+            ;;
+        --comment-file)
+            _filedir
+            return 0
+            ;;
+        -c|--comment)
+            # Free-form text; no useful completion
+            COMPREPLY=()
+            return 0
+            ;;
+        -k)
+            _filedir
+            return 0
+            ;;
+    esac
+
+    case "$subcmd" in
+        compress|c)
+            if [[ "$cur" == -* ]]; then
+                COMPREPLY=( $(compgen -W "
+                    -l --level -b --block -s --store -f --fast
+                    --vv --vaptvupt --lzhp
+                    -p --password --kdf
+                    -c --comment --comment-file
+                    --pq --pq-sdk
+                    --dedup -D --solid
+                    -v --verbose -q --quiet -t --threads
+                    $global_opts
+                " -- "$cur") )
+            else
+                _filedir
+            fi
+            ;;
+        extract|x)
+            if [[ "$cur" == -* ]]; then
+                COMPREPLY=( $(compgen -W "
+                    -o --output -p --password
+                    --pq --pq-sdk
+                    -v --verbose -t --threads
+                    $global_opts
+                " -- "$cur") )
+            else
+                _filedir 'zupt'
+            fi
+            ;;
+        list|l|test|t)
+            if [[ "$cur" == -* ]]; then
+                COMPREPLY=( $(compgen -W "
+                    -p --password --pq --pq-sdk
+                    -v --verbose
+                    $global_opts
+                " -- "$cur") )
+            else
+                _filedir 'zupt'
+            fi
+            ;;
+        info)
+            _filedir 'zupt'
+            ;;
+        disk)
+            if [ "$cword" -eq 2 ]; then
+                COMPREPLY=( $(compgen -W "backup restore" -- "$cur") )
+            elif [[ "$cur" == -* ]]; then
+                COMPREPLY=( $(compgen -W "
+                    -p --password --pq --pq-sdk
+                    --kdf -c --comment --comment-file
+                    -v --verbose
+                " -- "$cur") )
+            else
+                _filedir
+            fi
+            ;;
+        keygen)
+            if [[ "$cur" == -* ]]; then
+                COMPREPLY=( $(compgen -W "--sdk --pq-sdk -o --pub -k" -- "$cur") )
+            else
+                _filedir
+            fi
+            ;;
+        bench)
+            _filedir
+            ;;
+        version|help)
+            COMPREPLY=()
+            ;;
+        *)
+            _filedir
+            ;;
+    esac
+    return 0
+}
+
+complete -F _vaptvupt vaptvupt
+# v3.0.0: legacy `zupt` name retained as an alias.
+complete -F _vaptvupt zupt

completions/vaptvupt.fish

@@ -0,0 +1,112 @@
+# Fish completions for zupt
+# SPDX-License-Identifier: AGPL-3.0-or-later
+# Copyright (c) 2025-2026 Cristian Cezar Moisés
+#
+# Install:
+#   sudo install -m 644 completions/zupt.fish /usr/share/fish/vendor_completions.d/
+# or for a single user:
+#   cp completions/zupt.fish ~/.config/fish/completions/
+
+# ─── Subcommands ───
+complete -c vaptvupt -f -n '__fish_use_subcommand' -a 'compress c' -d 'Create an archive'
+complete -c zupt -f -n '__fish_use_subcommand' -a 'compress c' -d 'Create an archive'
+complete -c vaptvupt -f -n '__fish_use_subcommand' -a 'extract x'  -d 'Extract an archive'
+complete -c zupt -f -n '__fish_use_subcommand' -a 'extract x'  -d 'Extract an archive'
+complete -c vaptvupt -f -n '__fish_use_subcommand' -a 'list l'     -d 'List archive entries'
+complete -c zupt -f -n '__fish_use_subcommand' -a 'list l'     -d 'List archive entries'
+complete -c vaptvupt -f -n '__fish_use_subcommand' -a 'test t'     -d 'Verify archive integrity'
+complete -c zupt -f -n '__fish_use_subcommand' -a 'test t'     -d 'Verify archive integrity'
+complete -c vaptvupt -f -n '__fish_use_subcommand' -a 'info'       -d 'Archive metadata (no key needed)'
+complete -c zupt -f -n '__fish_use_subcommand' -a 'info'       -d 'Archive metadata (no key needed)'
+complete -c vaptvupt -f -n '__fish_use_subcommand' -a 'bench'      -d 'Benchmark compression levels'
+complete -c zupt -f -n '__fish_use_subcommand' -a 'bench'      -d 'Benchmark compression levels'
+complete -c vaptvupt -f -n '__fish_use_subcommand' -a 'disk'       -d 'Full-disk backup/restore'
+complete -c zupt -f -n '__fish_use_subcommand' -a 'disk'       -d 'Full-disk backup/restore'
+complete -c vaptvupt -f -n '__fish_use_subcommand' -a 'keygen'     -d 'Generate a key file'
+complete -c zupt -f -n '__fish_use_subcommand' -a 'keygen'     -d 'Generate a key file'
+complete -c vaptvupt -f -n '__fish_use_subcommand' -a 'version'    -d 'Print version info'
+complete -c zupt -f -n '__fish_use_subcommand' -a 'version'    -d 'Print version info'
+complete -c vaptvupt -f -n '__fish_use_subcommand' -a 'help'       -d 'Print help'
+complete -c zupt -f -n '__fish_use_subcommand' -a 'help'       -d 'Print help'
+
+# Helper predicates
+function __fish_zupt_using_subcommand
+    set -l cmd (commandline -opc)
+    if test (count $cmd) -gt 1
+        contains -- $cmd[2] $argv
+        return $status
+    end
+    return 1
+end
+
+# ─── Compress options ───
+set -l compress_cmds compress c
+complete -c vaptvupt -n "__fish_zupt_using_subcommand $compress_cmds" -s l -l level    -d 'Compression level (1-9, default 7)' -x -a '1 2 3 4 5 6 7 8 9'
+complete -c zupt -n "__fish_zupt_using_subcommand $compress_cmds" -s l -l level    -d 'Compression level (1-9, default 7)' -x -a '1 2 3 4 5 6 7 8 9'
+complete -c vaptvupt -n "__fish_zupt_using_subcommand $compress_cmds" -s b -l block    -d 'Block size in bytes' -x
+complete -c zupt -n "__fish_zupt_using_subcommand $compress_cmds" -s b -l block    -d 'Block size in bytes' -x
+complete -c vaptvupt -n "__fish_zupt_using_subcommand $compress_cmds" -s s -l store    -d 'Store without compression'
+complete -c zupt -n "__fish_zupt_using_subcommand $compress_cmds" -s s -l store    -d 'Store without compression'
+complete -c vaptvupt -n "__fish_zupt_using_subcommand $compress_cmds" -s f -l fast     -d 'Use fast LZ codec'
+complete -c zupt -n "__fish_zupt_using_subcommand $compress_cmds" -s f -l fast     -d 'Use fast LZ codec'
+complete -c vaptvupt -n "__fish_zupt_using_subcommand $compress_cmds" -l vv -l vaptvupt -d 'Use VaptVupt codec'
+complete -c zupt -n "__fish_zupt_using_subcommand $compress_cmds" -l vv -l vaptvupt -d 'Use VaptVupt codec'
+complete -c vaptvupt -n "__fish_zupt_using_subcommand $compress_cmds" -l lzhp          -d 'Use Zupt-LZHP codec (no SIMD needed)'
+complete -c zupt -n "__fish_zupt_using_subcommand $compress_cmds" -l lzhp          -d 'Use Zupt-LZHP codec (no SIMD needed)'
+complete -c vaptvupt -n "__fish_zupt_using_subcommand $compress_cmds" -s p -l password -d 'Encrypt with password (prompted if empty)' -x
+complete -c zupt -n "__fish_zupt_using_subcommand $compress_cmds" -s p -l password -d 'Encrypt with password (prompted if empty)' -x
+complete -c vaptvupt -n "__fish_zupt_using_subcommand $compress_cmds" -l kdf           -d 'Password KDF' -x -a 'argon2id pbkdf2'
+complete -c zupt -n "__fish_zupt_using_subcommand $compress_cmds" -l kdf           -d 'Password KDF' -x -a 'argon2id pbkdf2'
+complete -c vaptvupt -n "__fish_zupt_using_subcommand $compress_cmds" -s c -l comment  -d 'Embed archive comment (UTF-8, ≤4096 B)' -x
+complete -c zupt -n "__fish_zupt_using_subcommand $compress_cmds" -s c -l comment  -d 'Embed archive comment (UTF-8, ≤4096 B)' -x
+complete -c vaptvupt -n "__fish_zupt_using_subcommand $compress_cmds" -l comment-file  -d 'Read comment from file' -r
+complete -c zupt -n "__fish_zupt_using_subcommand $compress_cmds" -l comment-file  -d 'Read comment from file' -r
+complete -c vaptvupt -n "__fish_zupt_using_subcommand $compress_cmds" -l pq            -d 'Legacy PQ public key' -r
+complete -c zupt -n "__fish_zupt_using_subcommand $compress_cmds" -l pq            -d 'Legacy PQ public key' -r
+complete -c vaptvupt -n "__fish_zupt_using_subcommand $compress_cmds" -l pq-sdk        -d 'PQ public key (libzuptsdk)' -r
+complete -c zupt -n "__fish_zupt_using_subcommand $compress_cmds" -l pq-sdk        -d 'PQ public key (libzuptsdk)' -r
+complete -c vaptvupt -n "__fish_zupt_using_subcommand $compress_cmds" -s D -l dedup    -d 'Block-level deduplication'
+complete -c zupt -n "__fish_zupt_using_subcommand $compress_cmds" -s D -l dedup    -d 'Block-level deduplication'
+complete -c vaptvupt -n "__fish_zupt_using_subcommand $compress_cmds" -l solid         -d 'Solid mode (single stream)'
+complete -c zupt -n "__fish_zupt_using_subcommand $compress_cmds" -l solid         -d 'Solid mode (single stream)'
+complete -c vaptvupt -n "__fish_zupt_using_subcommand $compress_cmds" -s v -l verbose  -d 'Verbose output'
+complete -c zupt -n "__fish_zupt_using_subcommand $compress_cmds" -s v -l verbose  -d 'Verbose output'
+complete -c vaptvupt -n "__fish_zupt_using_subcommand $compress_cmds" -s q -l quiet    -d 'Suppress non-error output'
+complete -c zupt -n "__fish_zupt_using_subcommand $compress_cmds" -s q -l quiet    -d 'Suppress non-error output'
+complete -c vaptvupt -n "__fish_zupt_using_subcommand $compress_cmds" -s t -l threads  -d 'Thread count (0=auto)' -x
+complete -c zupt -n "__fish_zupt_using_subcommand $compress_cmds" -s t -l threads  -d 'Thread count (0=auto)' -x
+
+# ─── Extract / List / Test options ───
+set -l rw_cmds extract x list l test t
+complete -c vaptvupt -n "__fish_zupt_using_subcommand $rw_cmds" -s o -l output   -d 'Output directory' -x -a '(__fish_complete_directories)'
+complete -c zupt -n "__fish_zupt_using_subcommand $rw_cmds" -s o -l output   -d 'Output directory' -x -a '(__fish_complete_directories)'
+complete -c vaptvupt -n "__fish_zupt_using_subcommand $rw_cmds" -s p -l password -d 'Decryption password' -x
+complete -c zupt -n "__fish_zupt_using_subcommand $rw_cmds" -s p -l password -d 'Decryption password' -x
+complete -c vaptvupt -n "__fish_zupt_using_subcommand $rw_cmds" -l pq            -d 'Legacy PQ private key' -r
+complete -c zupt -n "__fish_zupt_using_subcommand $rw_cmds" -l pq            -d 'Legacy PQ private key' -r
+complete -c vaptvupt -n "__fish_zupt_using_subcommand $rw_cmds" -l pq-sdk        -d 'PQ private key (libzuptsdk)' -r
+complete -c zupt -n "__fish_zupt_using_subcommand $rw_cmds" -l pq-sdk        -d 'PQ private key (libzuptsdk)' -r
+complete -c vaptvupt -n "__fish_zupt_using_subcommand $rw_cmds" -s v -l verbose  -d 'Verbose output (surfaces top-MAC/SDK details on failure)'
+complete -c zupt -n "__fish_zupt_using_subcommand $rw_cmds" -s v -l verbose  -d 'Verbose output (surfaces top-MAC/SDK details on failure)'
+complete -c vaptvupt -n "__fish_zupt_using_subcommand $rw_cmds" -s t -l threads  -d 'Thread count' -x
+complete -c zupt -n "__fish_zupt_using_subcommand $rw_cmds" -s t -l threads  -d 'Thread count' -x
+
+# ─── Disk subcommand ───
+complete -c vaptvupt -f -n "__fish_zupt_using_subcommand disk; and not __fish_seen_subcommand_from backup restore" \
+complete -c zupt -f -n "__fish_zupt_using_subcommand disk; and not __fish_seen_subcommand_from backup restore" \
+    -a 'backup' -d 'Read a block device into an archive'
+complete -c vaptvupt -f -n "__fish_zupt_using_subcommand disk; and not __fish_seen_subcommand_from backup restore" \
+complete -c zupt -f -n "__fish_zupt_using_subcommand disk; and not __fish_seen_subcommand_from backup restore" \
+    -a 'restore' -d 'Write an archive to a block device'
+
+# ─── Keygen options ───
+complete -c vaptvupt -n '__fish_zupt_using_subcommand keygen' -l sdk     -d 'Generate SDK v2 keypair'
+complete -c zupt -n '__fish_zupt_using_subcommand keygen' -l sdk     -d 'Generate SDK v2 keypair'
+complete -c vaptvupt -n '__fish_zupt_using_subcommand keygen' -l pq-sdk  -d 'Same as --sdk'
+complete -c zupt -n '__fish_zupt_using_subcommand keygen' -l pq-sdk  -d 'Same as --sdk'
+complete -c vaptvupt -n '__fish_zupt_using_subcommand keygen' -s o       -d 'Output keyfile path' -r
+complete -c zupt -n '__fish_zupt_using_subcommand keygen' -s o       -d 'Output keyfile path' -r
+complete -c vaptvupt -n '__fish_zupt_using_subcommand keygen' -l pub     -d 'Export public key from -k'
+complete -c zupt -n '__fish_zupt_using_subcommand keygen' -l pub     -d 'Export public key from -k'
+complete -c vaptvupt -n '__fish_zupt_using_subcommand keygen' -s k       -d 'Source private keyfile' -r
+complete -c zupt -n '__fish_zupt_using_subcommand keygen' -s k       -d 'Source private keyfile' -r