[suguanYang]

Cached ZIP Range failures could leave synchronization waiting indefinitely for decoder cleanup. Abort the archive transport and SDK-owned output before awaiting cleanup, and pass that transport signal to storage writes waiting for capacity. Failed synchronization preserves its contiguous checkpoint and resumes through cache bypass.

The reader covers zip.js byte and streaming reads. It rejects invalid prefetched responses immediately, before a queued decoder or storage sink reads the body. Its controller stays local to the archive transport so failed cached setup can still fall back to the origin. Non-206 responses report HTTP status before cache ETag validation.

Validation on Oracle Linux arm64, Node 24.21.0:

• Four real-ZipReader regressions reproduce the queued-consumer deadlock at baseline 0673119 (4 failures) and pass at 511cf77: cached HTTP/ETag/network errors and origin HTTP failure. They verify rejection, cache bypass where applicable, no commit or post-return writes, and successful retry.
• Existing contracts cover ETag failures at file concurrency 1/2/4, HTTP 503, truncated bodies, caller cancellation, contiguous checkpoints and cached setup fallback.
• Full workspace tests after merging progressive snapshots: 479 passed; separate MCP tests: 18 passed. Typecheck, build, formatting and lint passed, with three existing lint warnings in unchanged SDK tests.
• GitHub CI passed on Node 20 and 22 for 03875d1.
• Independent Standards and Spec reviews of the follow-up: zero actionable findings.

Earlier validation at 0673119 also covered SIGKILL recovery (13 uncheckpointed files retransmitted) and independent 281/562 MiB archive memory cases (maximum 364.89 MiB across six cache/single/dual cases). Full Hipo validation of the new joint candidate is tracked in https://github.com/Ontos-AI/hipo/pull/402; those SDK-only numbers do not establish Hipo's memory ceiling.

Includes a patch Changeset. No public API or snapshot/checkpoint format change. Package publication and production deployment are separate release steps.

Release acceptance update:

• Corrected beta tag provenance to use the checked-out source commit. A child-process CLI contract fails before the fix and passes after it; no real publish commands run inside that test.
• Published 2.6.1-beta.20261027152313; its GitHub tag and notes identify e367de113b2d79ee9a344e174e06bfaa18646833. The earlier mistagged snapshot is marked superseded and preserved for audit.
• Full Hipo on latest main plus this npm beta: ten consecutive documents in one process on both Oracle and Vercel, a 561.95 MiB / 1,844-PNG archive, and two such archives concurrently. All five cases completed with zero retries.
• Vercel peaks: ten-document continuous 553.03 MiB; one large archive 540.81 MiB; co-located two large archives 721.55 MiB. Oracle continuous / dual-large OS peaks: 644.31 / 851.71 MiB.
• All 25 additional test Sources passed read-only snapshot/resource/job-reference verification; no new Parse operations, usage events or reservations. Deployment-specific logs and version-filtered Logfire records contained no warning/error for these runs.

Merged-main acceptance:

• Preserved the progressive snapshot/checksum implementation and added cancellation checks around serialized reader-pointer publication. Seven new legacy/baseline/final contracts fail on the unguarded implementation and pass after the fix.
• Independent Standards and Spec reviews of the resolved merge and publication fix: zero remaining actionable findings.
• Published 2.7.1-beta.20261027164158 from 03875d16e83123e0bde5a4d5d9fa465399bdf2ed; tag provenance verified. Full Hipo acceptance of this later beta is tracked separately before the stable release.