single-file-core 1.5.124 → 1.5.126

package/core/helper.js

@@ -293,6 +293,9 @@ function preProcessDoc(doc, win, options) {
 }
 
 function markInvalidNesting(doc) {
+	if (!doc.body) {
+		return;
+	}
 	addTrackIds(doc.body);
 	const verificationDoc = parseDocContent(serialize(doc));
 	const markedMap = buildTrackIdMap(doc.body);

package/core/index.js

@@ -1361,6 +1361,11 @@ class Processor {
 				}
 			}
 		}));
+		frameElements.forEach(frameElement => {
+			if (!frameElement.getAttribute("src") && !frameElement.getAttribute("srcdoc") && !frameElement.getAttribute("data")) {
+				frameElement.removeAttribute("sandbox");
+			}
+		});
 
 		async function initializeProcessor(frameData, frameElement, frameWindowId, batchRequest, options) {
 			options.insertSingleFileComment = false;

package/core/lib/doctype.js

@@ -38,9 +38,6 @@ function getDoctypeString(doc) {
 		} else if (docType.systemId) {
 			docTypeString += " SYSTEM \"" + docType.systemId + "\"";
 		}
-		if (docType.internalSubset) {
-			docTypeString += " [" + docType.internalSubset + "]";
-		}
 		docTypeString += ">";
 	}
 	return docTypeString;

package/core/lib/processor-helper-common.js

@@ -243,9 +243,16 @@ class ProcessorHelperCommon {
 						return serializeSrcset([Object.assign({}, srcsetValue, { url: resourceURL })]);
 					}
 				}));
-				resourceElement.setAttribute("srcset", srcsetValues.filter(srcsetValue => srcsetValue).join(", "));
+				const newSrcset = srcsetValues.filter(srcsetValue => srcsetValue).join(", ");
+				if (newSrcset) {
+					resourceElement.setAttribute("srcset", newSrcset);
+				} else {
+					resourceElement.removeAttribute("srcset");
+					resourceElement.removeAttribute("sizes");
+				}
 			} else {
-				resourceElement.setAttribute("srcset", "");
+				resourceElement.removeAttribute("srcset");
+				resourceElement.removeAttribute("sizes");
 			}
 		}));
 	}
@@ -267,6 +274,7 @@ class ProcessorHelperCommon {
 		element.style.setProperty("background-size", style && style["background-size"] ? style["background-size"] : "100% 100%", "important");
 		element.style.setProperty("background-origin", "content-box", "important");
 		element.style.setProperty("background-repeat", "no-repeat", "important");
+		element.style.setProperty("background-attachment", "scroll", "important");
 	}
 
 	async getStylesheetContent(resourceURL, options) {
@@ -405,7 +413,7 @@ class ProcessorHelperCommon {
 			}
 			sheetIndex++;
 		});
-		processFontDetails(fontsDetails);
+		processFontDetails(fontsDetails, fonts);
 		await Promise.all([...stylesheets].map(async ([, stylesheetInfo], sheetIndex) => {
 			if (stylesheetInfo.stylesheet) {
 				const cssRules = stylesheetInfo.stylesheet.children;
@@ -443,13 +451,10 @@ class ProcessorHelperCommon {
 			} else if (ruleData.type == "Atrule" && ruleData.name == "font-face") {
 				const key = this.getFontKey(ruleData);
 				const fontInfo = fontsDetails.fonts.get(key);
-				if (fontInfo) {
-					const ruleKey = key + " " + this.getPropertyValue(ruleData, "src");
-					if (fontsDetails.emittedFonts.has(ruleKey)) {
+				if (fontInfo && fontsDetails.lastRules.get(key) == ruleData) {
+					const keptRule = await this.processFontFaceRule(ruleData, fontInfo, fonts, fontTests, stats);
+					if (!keptRule) {
 						removedRules.push(cssRule);
-					} else {
-						fontsDetails.emittedFonts.add(ruleKey);
-						await this.processFontFaceRule(ruleData, fontInfo, fonts, fontTests, stats);
 					}
 				} else {
 					removedRules.push(cssRule);
@@ -487,16 +492,22 @@ class ProcessorHelperCommon {
 					fontInfo = [];
 					mediaFontsDetails.fonts.set(fontKey, fontInfo);
 				}
+				mediaFontsDetails.lastRules.set(fontKey, ruleData);
 				const src = this.getPropertyValue(ruleData, "src");
 				if (src) {
 					const fontSources = src.match(REGEXP_URL_FUNCTION);
 					if (fontSources) {
+						const ruleSources = [];
 						fontSources.forEach(source => {
 							if (fontInfo.includes(source)) {
 								fontInfo.splice(fontInfo.indexOf(source), 1);
 							}
-							fontInfo.unshift(source);
+							if (ruleSources.includes(source)) {
+								ruleSources.splice(ruleSources.indexOf(source), 1);
+							}
+							ruleSources.unshift(source);
 						});
+						ruleSources.forEach(source => fontInfo.push(source));
 					}
 				}
 			}
@@ -509,7 +520,7 @@ class ProcessorHelperCommon {
 			medias: new Map(),
 			supports: new Map(),
 			layers: new Map(),
-			emittedFonts: new Set()
+			lastRules: new Map()
 		};
 	}
 

package/core/lib/processor-helper-inline.js

@@ -648,6 +648,9 @@ function getProcessorHelperClass(utilInstance) {
 					}
 				}
 				stats.fonts.discarded -= fontInfo.length;
+				if (!fontInfo.length) {
+					return false;
+				}
 				fontInfo.reverse();
 				try {
 					srcDeclaration.data.value = cssTree.parse(fontInfo.map(fontSource => fontSource.src).join(","), { context: "value", parseCustomProperty: true });
@@ -656,6 +659,7 @@ function getProcessorHelperClass(utilInstance) {
 					// ignored
 				}
 			}
+			return true;
 		}
 	};
 }

package/core/lib/processor-helper.js

@@ -574,6 +574,9 @@ function getProcessorHelperClass(utilInstance) {
 			removedNodes.forEach(node => ruleData.block.children.remove(node));
 			const srcDeclaration = ruleData.block.children.filter(node => node.property == "src").tail;
 			if (srcDeclaration) {
+				if (!fontInfo.length) {
+					return false;
+				}
 				fontInfo.reverse();
 				try {
 					srcDeclaration.data.value = cssTree.parse(fontInfo.map(fontSource => fontSource.src).join(","), { context: "value", parseCustomProperty: true });
@@ -582,6 +585,7 @@ function getProcessorHelperClass(utilInstance) {
 					// ignored
 				}
 			}
+			return true;
 		}
 	};
 }

package/core/util.js

@@ -69,11 +69,6 @@ const EXPECTED_TYPES_MEDIA = ["font", "image", "video", "audio"];
 const URL = globalThis.URL;
 const DOMParser = globalThis.DOMParser;
 const Blob = globalThis.Blob;
-const fetch = (url, options) => {
-	options.cache = "force-cache";
-	options.referrerPolicy = "strict-origin-when-cross-origin";
-	return globalThis.fetch(url, options);
-};
 const TextDecoder = globalThis.TextDecoder;
 const URLSearchParams = globalThis.URLSearchParams;
 
@@ -83,8 +78,8 @@ export {
 
 function getInstance(utilOptions) {
 	utilOptions = utilOptions || {};
-	utilOptions.fetch = utilOptions.fetch || fetch;
-	utilOptions.frameFetch = utilOptions.frameFetch || utilOptions.fetch || fetch;
+	utilOptions.fetch = utilOptions.fetch || ((url, options) => globalThis.fetch(url, { ...options, cache: "force-cache", referrerPolicy: "strict-origin-when-cross-origin" }));
+	utilOptions.frameFetch = utilOptions.frameFetch || utilOptions.fetch;
 	return {
 		getDoctypeString,
 		getFilenameExtension(resourceURL, replacedCharacters, replacementCharacter, replacementCharacters) {
@@ -240,7 +235,7 @@ function getInstance(utilOptions) {
 			startTime = Date.now();
 			log("  // STARTED download url =", resourceURL, "asBinary =", options.asBinary);
 		}
-		if (options.blockMixedContent && /^https:/i.test(options.baseURI) && !/^https:/i.test(resourceURL)) {
+		if (options.blockMixedContent && /^https:/i.test(options.baseURI) && !/^https:/i.test(resourceURL) && !/^blob:https:/i.test(resourceURL)) {
 			return getFetchResponse(resourceURL, options);
 		}
 		if (options.networkTimeout) {
@@ -264,7 +259,7 @@ function getInstance(utilOptions) {
 					// eslint-disable-next-line no-unused-vars
 				} catch (error) {
 					response = await Promise.race([
-						fetchResource(resourceURL, { headers: { accept } }),
+						fetchResource(resourceURL, { referrer: options.resourceReferrer, headers: { accept } }),
 						networkTimeoutPromise
 					]);
 				}
@@ -390,13 +385,13 @@ function guessMIMEType(expectedType, buffer) {
 		if (compareBytes([255, 255, 255, 255], [0, 0, 2, 0])) {
 			return "image/x-icon";
 		}
-		if (compareBytes([255, 255], [78, 77])) {
+		if (compareBytes([255, 255], [66, 77])) {
 			return "image/bmp";
 		}
 		if (compareBytes([255, 255, 255, 255, 255, 255], [71, 73, 70, 56, 57, 97])) {
 			return "image/gif";
 		}
-		if (compareBytes([255, 255, 255, 255, 255, 255], [71, 73, 70, 56, 59, 97])) {
+		if (compareBytes([255, 255, 255, 255, 255, 255], [71, 73, 70, 56, 55, 97])) {
 			return "image/gif";
 		}
 		if (compareBytes([255, 255, 255, 255, 0, 0, 0, 0, 255, 255, 255, 255, 255, 255], [82, 73, 70, 70, 0, 0, 0, 0, 87, 69, 66, 80, 86, 80])) {
@@ -434,7 +429,7 @@ function guessMIMEType(expectedType, buffer) {
 		if (compareBytes([0, 0, 0, 0, 255, 255, 255, 255, 255, 255, 255, 255], [0, 0, 0, 0, 102, 116, 121, 112, 105, 115, 111, 109])) {
 			return "video/mp4";
 		}
-		if (compareBytes([255, 255, 255, 255, 0, 0, 0, 0, 255, 255, 255, 255], [82, 73, 70, 70, 0, 0, 0, 0, 87, 65, 86, 69])) {
+		if (compareBytes([255, 255, 255, 255, 0, 0, 0, 0, 255, 255, 255, 255], [82, 73, 70, 70, 0, 0, 0, 0, 65, 86, 73, 32])) {
 			return "video/x-msvideo";
 		}
 		if (compareBytes([255, 255, 255, 255], [0, 0, 1, 179]) || compareBytes([255, 255, 255, 255], [0, 0, 1, 186])) {
@@ -443,18 +438,18 @@ function guessMIMEType(expectedType, buffer) {
 		if (compareBytes([255, 255, 255, 255], [79, 103, 103, 83])) {
 			return "video/ogg";
 		}
-		if (compareBytes([255], [71])) {
-			return "video/mp2t";
-		}
 		if (compareBytes([255, 255, 255, 255], [26, 69, 223, 163])) {
 			return "video/webm";
 		}
 		if (compareBytes([0, 0, 0, 0, 255, 255, 255, 255, 255, 255], [0, 0, 0, 0, 102, 116, 121, 112, 51, 103])) {
 			return "video/3gpp";
 		}
+		if (compareBytes([255], [71])) {
+			return "video/mp2t";
+		}
 	}
 	if (expectedType == "audio") {
-		if (compareBytes([255, 255], [255, 249]) || compareBytes([255, 255], [255, 254])) {
+		if (compareBytes([255, 255], [255, 241]) || compareBytes([255, 255], [255, 249]) || compareBytes([255, 255], [255, 254])) {
 			return "audio/aac";
 		}
 		if (compareBytes([255, 255, 255, 255], [77, 84, 104, 100])) {

package/doc/singlefile-archive.md

@@ -136,7 +136,7 @@ Three consequences shape everything below:
 | **region** | A byte range with a single producer, named in §3. Regions are the units the rest of this document reasons about; a region can appear in several pieces — `html-prologue` resumes after the embedded PDF document in the PDF variants, and after the `tEXt "ZIP"` chunk header in the PNG ones, so with all four faces it comes in three. |
 | **universal mode** | The variant whose HTML face can extract the archive from the *parsed page text*, the text and comment nodes the HTML parser produced, and therefore needs no access to its own raw bytes. Named "universal" because it works from any location, including the `file:` protocol. |
 | **wrapper tag** | The HTML construct that hides a binary region from the HTML parser, `<!--`…`-->` by default (§5.1). |
-| **appended data** | Bytes after the ZIP End Of Central Directory record. Readers tolerate them within the window their EOCD scan already covers: 65557 bytes from the end of the file (the 22-byte record plus the 65535-byte maximum comment length); "the 64 KB window" refers to this. It may be left undeclared or declared as the archive comment; both forms are valid ZIP and readers MUST accept both (§4.2). The recovery payload can be computed before that choice is made because it stops two bytes short of the record, excluding its comment-length field (see *recovered range* below). |
+| **appended data** | Bytes after the ZIP End Of Central Directory record. A reader tolerates them as far back as its EOCD scan reaches, and how far that is varies by an order of magnitude: 65557 bytes from the end of the file for Python `zipfile` (the 22-byte record plus the 65535-byte maximum comment length), but 16383 for libarchive and 32768 for perl `Archive::Zip` (§8.1). No reader's window is guaranteed, so a writer keeps its own narrower budget (§5.2). The format's one hard limit is the 65535-byte comment field, and it binds only a run the writer declares (§4.2). It may be left undeclared or declared as the archive comment; both forms are valid ZIP and readers MUST accept both (§4.2). The recovery payload can be computed before that choice is made because it stops two bytes short of the record, excluding its comment-length field (see *recovered range* below). |
 | **ZIP region** | The contiguous byte range holding the archive proper: from the first local file header the ZIP writer emitted through the last byte of the End Of Central Directory record. It spans the `zip-entries`, `pdf-central-record` (when present) and `central-directory · eocd` blocks of §3, and in the HTML variants it is the content of the last wrapper, exactly so on the element rungs and preceded by the `sfz-data` identifier on the comment rung, which the extractor steps over. It does **not** include `pdf-local-header` or the PDF document, which sit earlier in the file. |
 | **archive** | The *logical* ZIP file: the set of entries the central directory describes, wherever their bytes lie. This is distinct from the ZIP region above, which is a contiguous byte range. Every entry but one has its bytes inside the region; `page.pdf` is the deliberate exception, an entry of the archive whose local header and data sit before the region (§4.2). "Archive" in this document always means the logical file, "ZIP region" always the byte range, and the two differ only in the PDF-with-HTML variants. |
 | **recovered range** | What the universal extractor reproduces (§4.5): the ZIP region minus its last two bytes, the comment-length field of the End Of Central Directory record. That field is the one part of the record whose value depends on what follows the region, so leaving it out is what lets a writer decide the appended-data form after the recovery payload is final (§4.2). The extractor supplies the two bytes itself, as zeroes — the recovered range carries no comment. |
@@ -174,8 +174,9 @@ every acquisition path including the ones that read raw bytes and could return i
 HTML face, so the option does not apply. The *Specimen* column names the measured
 reference files this document cites; §8 records how to regenerate them.
 
-Other writer options shape the file without adding a face: `preventAppendedData` and
-`declareAppendedData` (§4.2, §5.2), `includeBOM` (§3.1), `insertTextBody` (§4.6),
+Other writer options shape the file without adding a face: `preventAppendedData`,
+`declareAppendedData` and `maxAppendedDataLength` (§4.2, §5.2), `includeBOM` (§3.1),
+`insertTextBody` (§4.6),
 `password` (§5.6), `createRootDirectory` (§7.1), and the head-element switches
 `insertCanonicalLink`, `insertMetaNoIndex` and `insertMetaCSP` (§3.1).
 
@@ -328,7 +329,8 @@ the same way: only a universal file carries an `<sfz-extra-data>` element.
 
 Unless a row states otherwise, the layouts below are measured from specimen files
 saved from `example.com` (the generation commands are in §8). The relocated row covers
-two cases with one layout, `preventAppendedData` and a payload over 64 KB: the first is
+two cases with one layout, `preventAppendedData` and a payload over the appended-data
+budget (§5.2): the first is
 measured on the relocated specimen, the second derived from the writer rules, because
 such a payload requires an archive too large for a readable specimen. The figure below shows
 the regions and their order; the glossary of §3.1 is the normative list, and it states
@@ -353,7 +355,7 @@ face adds, then the regions the PNG face adds.
 | `<!--` / `-->` | HTML | HTML face | The wrapper tag pair hiding a binary region from the HTML parser — comment tags by default, another pair when the hidden bytes defeat them — which `-->` is only the commonest way to do, the full test being `<!--`, `--!>`, a trailing `<!-` and, for the PNG payload, a leading `>` or `->` (§5.1). Drawn at each opening and closing position. The close tag is absent whenever the recovery payload is relocated (§5.2): under `preventAppendedData`, when the payload outgrows the appended-data budget, or on the `<plaintext>` wrapper which cannot close. No markup then follows the archive and the wrapper runs to end-of-file. That does not mean the file ends at the EOCD — the PNG face's tail still follows, inside the wrapper, where it parses as text (§5.1). |
 | `zip-entries` | ZIP | always | The archive's local file headers and entry data, written by the ZIP writer. The central directory of an archive written by the reference writer lists `index.html` (the page) first, then `manifest.json` (a JSON description of the archive: original URL, title, save time, resource-to-URL map — informative; the page displays without it), then the resources; the *physical* order of the local headers inside the region is not guaranteed to match, and readers MUST NOT rely on either order — entries are addressed by name (§7.1). |
 | `central-directory · eocd` | ZIP | always | The central-directory records followed by the End Of Central Directory record. All offsets are absolute file positions (§5.3). In the HTML+PDF variants the EOCD accounts for the injected `pdf-central-record` (how the writer achieves that is §6). |
-| `extra-data` | extractor | universal | `<sfz-extra-data>` element holding the base64, deflate-compressed recovery payload (§5.5). It always sits outside the wrapper, so it parses as a real element the extractor can address. Normal placement: after the EOCD, between the wrapper close tag and the end tags. Relocated placement, used when the payload exceeds the 64 KB appended-data window or `preventAppendedData` is set: immediately before the wrapper start tag. In the relocated form the element is followed by space padding: its room is reserved before the archive is written, because the region precedes the ZIP data and resizing it would shift every central-directory offset (§6). Neither placement carries positional meaning — the extractor finds the ZIP region by identifier, not relative to this element (§4.5). |
+| `extra-data` | extractor | universal | `<sfz-extra-data>` element holding the base64, deflate-compressed recovery payload (§5.5). It always sits outside the wrapper, so it parses as a real element the extractor can address. Normal placement: after the EOCD, between the wrapper close tag and the end tags. Relocated placement, used when the payload exceeds the appended-data budget (§5.2) or `preventAppendedData` is set: immediately before the wrapper start tag. In the relocated form the element is followed by space padding: its room is reserved before the archive is written, because the region precedes the ZIP data and resizing it would shift every central-directory offset (§6). Neither placement carries positional meaning — the extractor finds the ZIP region by identifier, not relative to this element (§4.5). |
 | `</body></html>` | HTML | HTML face | The end tags closing the document after the wrapper close tag. Omitted whenever the recovery payload is relocated (§5.2), and in the PNG variants so the file can end with the PNG tail. |
 | `pdf-local-header` | ZIP | PDF face with HTML | The hand-built local file header for `page.pdf` (STORE, checksum precomputed, language encoding flag set as on every other entry — §5.8), written immediately before the PDF document so ZIP readers see an ordinary entry whose data is the PDF (§6). |
 | `pdf-document` | PDF | PDF face | The raw PDF bytes. With the HTML face, wrapped together with `pdf-local-header` in a wrapper tag pair inside `html-prologue`, placed so `%PDF-` starts at offset 1024 or lower — the range PDF readers search for the header, which is what lets a PDF document start after other bytes at all (§4.3). Without the HTML face and without the PNG face, the file simply *starts* with the PDF document, as prepended data the ZIP face tolerates; `page.pdf` is then not an archive entry at all — no local header, no central record. |
@@ -366,7 +368,7 @@ face adds, then the regions the PNG face adds.
 | `crc · IEND` | PNG | PNG face | The `tEXt "ZIP"` chunk's CRC, computed once the archive bytes are final (§6), followed by the empty `IEND` chunk — the last bytes of the file (PNG requires `IEND` to end the stream, which is why the PNG variants drop the end tags). |
 
 The reader-by-reader interpretation of these regions is §4; the mechanics that keep
-them from colliding (wrapper-tag selection, checksums, offsets, the 64 KB budget) are
+them from colliding (wrapper-tag selection, checksums, offsets, the appended-data budget) are
 §5.
 
 ## 4. Reader lenses
@@ -447,10 +449,12 @@ path the plain variant's error message describes.
 ### 4.2 The ZIP reader
 
 The ZIP face is read from the end. A reader locates the End Of Central Directory
-record by scanning backward from end-of-file; the format guarantees it lies within
-the window every reader must already scan to support archive comments (§1.3,
-*appended data*), because everything after it — wrapper close tag, extra-data, end
-tags, PNG tail — fits the appended-data budget (§5.2). Accepting *undeclared* bytes
+record by scanning backward from end-of-file, and how far back it scans is the one
+reader property the format cannot assume (§1.3, *appended data*). Everything the
+writer emits after the record — wrapper close tag, extra-data, end tags, PNG tail —
+fits the appended-data budget of §5.2, and the reference writer sizes that budget to
+the narrowest scan measured in §8.1, so the record stays reachable for every reader
+listed there. Accepting *undeclared* bytes
 in that window is itself a customary tolerance (§1.1): the ZIP specification
 documents the comment, not trailing junk. From the EOCD
 the reader jumps to the central directory and reads only what it references;
@@ -510,6 +514,14 @@ readers accept at all: `java.util.zip`, and therefore Android and most JVM tooli
 rejects an archive with undeclared trailing bytes outright (§8.1). A writer SHOULD
 offer both and default to raw.
 
+The declared form carries a ceiling the raw form does not. The comment length is a
+16-bit field, so a run longer than 65535 bytes cannot be declared at all. A writer
+whose appended-data budget (§5.2) is raised past that ceiling MUST leave such a run
+undeclared rather than write its length back modulo 65536, and readers that accept
+only the declared form then reject the file with no diagnostic. The budget and the
+ceiling are two separate limits, and a writer that exposes the first as an option
+SHOULD say so where it documents it.
+
 Neither form constrains the other faces, and universal mode supports both, because
 the recovery payload describes the recovered range rather than the whole region: the
 comment-length field is excluded (§1.3), so its value can be decided after the
@@ -735,6 +747,23 @@ zip64 locator states an absolute offset in the original file, so it needs the sh
 this formula produces and cannot be used to find it. A reader that instead uses the
 sentinels arithmetically gets a shift in the billions, with no diagnostic.
 
+Which leaves the record itself to be located without the offset that normally points at
+it. Scan backward from the locator for the `PK\x06\x06` signature and confirm each
+candidate against the record's own size field, the 8 bytes at `p + 4`, which by
+definition excludes the leading 12:
+
+```
+p + 12 + size == locatorPosition
+```
+
+A well-formed archive puts the record immediately before the locator, where it is 56
+bytes long if it carries no extensible data sector, so `locatorPosition - 56` is worth
+testing before scanning at all. The confirmation matters on the archives that miss:
+past the record the scan walks back through the central directory, whose file names and
+extra fields are arbitrary bytes, and past that through entry data, and a four-byte
+signature turns up in bytes nothing constrains. The test settles each candidate against
+the record's own field, so it needs no offset it does not already have.
+
 ### 4.6 Text tools
 
 The optional text body (`insertTextBody`) addresses one more consumer: software that
@@ -972,36 +1001,54 @@ limit of what the CDATA rung buys here — its value is that real payloads rarel
 above states a MUST rather than a quality-of-implementation preference — exhaustion is
 reachable by construction, not only by a payload built to provoke it.
 
-The check MUST be made against the payload's final bytes, for every payload the
-writer hides and in every variant that hides one. Every rejection restarts the build
-(§6): the wrapper choice changes the bytes preceding the archive, so the archive must
-be rewritten at its new position.
-
-Two fields are patched after that check. The EOCD comment-length field sits at the
-end of the ZIP region and is patched under the declared form (§6.1, step 11); the
-writer tests the bytes around it again with the final value in place and keeps the raw
-form when that value would complete a pattern, since the raw form is always valid. The
-`tEXt "ZIP"` length field sits inside the pixel-data wrapper, with the fixed `tEXt`
-type and `ZIP` keyword after it, and is written last (step 12). The header is tested
-with the rest of the payload, the length as zeros, which cannot join a pattern; the
-real length is big-endian, so a pattern byte in it would have to be the most
-significant byte of the chunk's size, and the smallest byte any pattern contains, `-`
-at 0x2D, puts that size at 0x2D000000 bytes, about 755 MB. The writer refuses to
-build a self-extracting PNG variant whose chunk reaches that size rather than
+The selection test above — both patterns, on every rung the writer considers — MUST
+be applied to the payload's bytes in their final form, for every payload the writer
+hides and in every variant that hides one. *Final* is the whole of the requirement:
+bytes the writer has yet to settle have not been tested. Every rejection restarts the build (§6):
+the wrapper choice changes the bytes preceding the archive, so the archive must be
+rewritten at its new position.
+
+Two fields are patched after that test, and each needs one of its own. The EOCD
+comment-length field sits at the end of the ZIP region and is patched under the
+declared form (§6.1, step 11); the writer tests the bytes around it again with the
+final value in place and keeps the raw form when that value would complete a pattern,
+since the raw form is always valid. The `tEXt "ZIP"` length field sits inside the pixel-data wrapper,
+with the fixed `tEXt` type and `ZIP` keyword after it, and is written last (step 12).
+The header is tested with the rest of the payload, the length as zeros, which cannot
+join a pattern; the real length is big-endian, so a pattern byte in it would have to be
+the most significant byte of the chunk's size, and the smallest byte any pattern
+contains, `-` at 0x2D, puts that size at 0x2D000000 bytes, about 755 MB. The writer
+refuses to build a self-extracting PNG variant whose chunk reaches that size rather than
 re-check the field.
 
 ### 5.2 The appended-data budget
 
-Everything the writer emits after the EOCD record MUST fit in 65535 bytes — the
-maximum length a ZIP archive comment may declare, and therefore the distance beyond
-the record that every reader's backward scan already covers (§1.3). The appended run is:
+The run the writer emits after the EOCD record has two limits, and only one of them
+comes from the format. A run *declared* as the archive comment MUST fit in 65535
+bytes, the largest value a comment-length field can hold (§4.2). A run left *raw* has
+no format limit at all: the bytes are outside the archive, and nothing in ZIP bounds
+them. What bounds both in practice is the reader. Locating the EOCD record means
+scanning backward from end-of-file, and the searches measured in §8.1 stop at 16383
+bytes for libarchive, 32768 for perl `Archive::Zip` and 65557 for Python `zipfile`, so
+a run sized to the comment ceiling is already invisible to the narrowest of them. A
+writer therefore keeps a *budget*, sized to the readers it means to satisfy rather
+than to the format. The appended run is:
 
 ```
 wrapper close tag + extra-data element + end tags + (PNG face: 4-byte chunk CRC + 12-byte IEND)
 ```
 
-and the writer compares its total against 65535 before committing to it. The EOCD
-record's own 22 bytes sit inside the window too, giving the 65557-byte figure of §1.3.
+and the writer compares its total against that budget before committing to it. The
+EOCD record's own 22 bytes sit inside a reader's window as well, which is what turns a
+65535-byte run into the 65557 bytes of §1.3 and the reference writer's budget into
+libarchive's 16383.
+
+The reference writer exposes the budget as `maxAppendedDataLength` and defaults it to
+16361 bytes: libarchive's window less the 22 bytes of the record, which is the largest
+run behind which every reader of §8.1 still finds the record. A writer MAY choose
+another value. Raising it above 65535 leaves the run undeclarable: it is emitted, and
+it is still valid ZIP, but no comment length can cover it, and §4.2 says what that
+costs.
 
 Only the extra-data element can outgrow the budget: it carries one 2-bit code per
 newline sequence in the recovered range — the ZIP region without its comment-length
@@ -1009,9 +1056,9 @@ field (§4.5), CR LF counting once, for two bytes (§5.5) — so it
 grows with the archive. Newline bytes
 occur at their natural density in compressed and STOREd binary data — about two in
 every 256 bytes — and the codes are compressed and base64-encoded, which measures at
-one byte of element per 650 bytes of archive at scale (§8). The budget is therefore
-exhausted at an archive of roughly 40 MB, so the relocated placement is rare in
-practice. That ratio is the large-archive limit and must not be used to size a
+one byte of element per 650 bytes of archive at scale (§8). The default budget is
+therefore exhausted at an archive of roughly 10 MB, and the 65535-byte ceiling at
+roughly 40 MB, so the relocated placement is uncommon in practice. That ratio is the large-archive limit and must not be used to size a
 particular file: deflate's overhead is a fixed cost spread over a growing payload, so
 small archives are far less efficient. Measured on exact byte counts, a 6099-byte region
 needs 69 bytes of element — a ratio of 88 — and a 74057-byte region needs 189, a ratio
@@ -1032,6 +1079,14 @@ trailing bytes open it (§8.1). The parser closes the open
 comment or element at end of file, and `</body></html>` are implied, so the page
 renders the same.
 
+Relocation is not a move at constant size, and it can end either way. Two effects pull
+against each other: the room the writer sets aside, which in the reference writer is
+`Math.ceil(length * 1.01) + 32` bytes — a percentage of the payload plus a constant, so
+the constant dominates a small payload and the percentage a large one — and the 17 bytes
+of wrapper terminator and end tags it stops emitting. Measured on three files the net ran
+from 9 bytes saved to 190 bytes spent, so a writer sizing a file should quote that range
+rather than a single figure.
+
 ### 5.3 Offset bookkeeping
 
 Three coordinate systems coexist in one file, and the format's job is to keep each
@@ -1043,6 +1098,15 @@ self-consistent:
   file positions (§4.2), so a reader of the *whole file* never needs prepended-data
   compensation — the repair by which a reader recomputes offsets that disagree with
   the file size. A reader of the recovered ZIP region alone does need it (§4.5).
+
+  The alternative, offsets relative to the start of the region, is not a compatibility
+  problem in itself: a reader that compensates arrives at the same entries, and 7-Zip
+  opens such a file when told the type. What absolute offsets buy is the step before
+  that. The file is a valid archive read as it stands, so it survives format
+  auto-detection — 7-Zip reports a base of 0 and a physical size covering the whole
+  file — and the compensation is confined to the one path that cannot avoid it,
+  universal-mode recovery. Nothing in the format depends on the choice; a writer using
+  the other form produces files this document's readers still open.
 - **PDF offsets are header-relative.** The document's own cross-reference offsets are
   interpreted from the `%PDF-` header, so embedding it needs no rewriting; the writer
   only MUST keep the header inside the scan window (§4.3).
@@ -1439,7 +1503,7 @@ terminate because each of them advances a monotone quantity:
 There is no converse of the second: a pass that reserved room never discards it,
 even when the relocated payload would have fit the appended window. Relocation moves
 the archive, which changes the offsets, which changes the payload that made the
-relocation necessary, so a payload lying on the 65535-byte boundary can be too large
+relocation necessary, so a payload lying on the budget boundary can be too large
 appended and small enough relocated, and a writer that dropped the reservation could
 rebuild the two placements forever. Relocation is therefore final (§5.2), and the file
 keeps at most the reservation's own margin of dead padding.
@@ -1594,7 +1658,7 @@ only if it affects the bytes the page is built from:
 | An entry's CRC-32 or AES authentication code does not match | **SHOULD** fail for that entry, and MUST NOT present a page rebuilt from it as intact |
 | `page.pdf` was reconstructed from the parsed page and its CRC-32 does not match | **MUST** discard the reconstruction (§4.5). The bytes are a guess about newlines the recovery payload does not describe, and the checksum is the only thing that tests it — unlike the row above, there is no read to have gone wrong, only an inference |
 | Bytes outside the archive proper — before the first local file header, after the EOCD record, or between an entry's data and the next header | **MUST** tolerate: they are the other faces (§7.1). The gap in the middle is not hypothetical: with the PDF face the bootstrap lies between `page.pdf`'s data and the ZIP region |
-| The appended run exceeds the 65535-byte budget (§5.2) | Not a reader's problem: if the EOCD record was found, the archive is readable. Readers MAY warn |
+| The appended run exceeds the 65535-byte ceiling (§5.2) | Not a reader's problem: if the EOCD record was found, the archive is readable. Readers MAY warn |
 | A `tEXt` chunk CRC does not match, or a chunk holds bytes PNG does not permit (§4.4) | Irrelevant to extraction; a reader of the archive MAY ignore both |
 | `page.pdf` is present but its data does not begin with `%PDF-` | Not an error. The entry is data like any other |
 | `index.html` is present without `manifest.json` | **MUST** still extract (§7.1) |
@@ -1634,11 +1698,20 @@ and is class C.
 | Info-ZIP `unzip`, `zipinfo` | ✔ | ✔ | ✔ | Lists and extracts every variant. AES entries are skipped — `need PK compat. v5.1 (can do v4.5)` — a limitation of the tool, not of the file; `page.pdf` still extracts because it is never encrypted |
 | Python `zipfile` | ✔ | ✔ | ✔ | Lists and extracts every variant |
 | 7-Zip (`7zz`) | ✔ | ✔ | ✔ | Lists and extracts every variant, AES included |
-| libarchive `bsdtar`, seekable input | ✔ | ✔ | ✔ | Lists and extracts every variant |
+| libarchive `bsdtar`, seekable input | ✔ | ✔ | ✔ | Lists and extracts every variant. Its EOCD scan is the narrowest measured, so a class-C file whose appended run pushes the record past 16383 bytes from the end is rejected with `Unrecognized archive format`; §5.2's default budget is sized to this window, and the ✔ holds for files that respect it |
 | libarchive `bsdtar`, piped input | ✔ | ✘ | ✘ | `Unrecognized archive format` — the forward-only case of §1.2, measured |
 | Java `java.util.zip` (`jar tf`) | ✔ | ✔ | ✘ | `zip END header not found` whenever bytes follow the EOCD undeclared. Declaring them as the archive comment makes the same file open, measured on every class-C variant (§4.2) |
 | macOS `ditto -x -k` | ✔ | ✘ | ✘ | `Couldn't read PKZip signature` — requires a local file header at offset 0, so prepended data alone defeats it |
 
+The backward scans behind the class-C column differ by an order of magnitude, and they
+are what §5.2's budget is sized against. Measured by padding a working archive until
+the record fell out of reach, the largest distance from end-of-file at which each
+reader still finds the EOCD record is: libarchive 16383, perl `Archive::Zip` 32768,
+Python `zipfile` 65557, zip.js 65536, Info-ZIP `unzip` 68000, and 7-Zip beyond 1 MiB,
+which scans the whole file. libarchive binds, and its window less the 22-byte record
+is the 16361-byte default budget of §5.2. macOS `ditto` is not on this axis at all: it
+requires a local file header at offset 0 whatever the tail looks like.
+
 The cost of the declared form was measured on the same tools: it is a display cost, not
 a compatibility one. An archive whose trailing bytes are declared as the comment has
 them printed back on ordinary listings; `unzip -l` reproduces the whole run — in
@@ -1713,7 +1786,7 @@ specimen without a network.
 | 123006 | `<sfz-extra-data>` … `</sfz-extra-data>` | recovery payload, appended placement (§5.2); 24 base64 characters for this archive |
 | 123063 | `</body></html>` | end tags; end of file at 123077 |
 
-The appended run is 74 bytes, well inside the 65535-byte budget (§5.2). The ZIP region
+The appended run is 74 bytes, well inside the 16361-byte default budget (§5.2). The ZIP region
 is the 998 bytes from 122005 to 123003; the universal extractor reproduces the first 996
 of them and supplies the last two itself (§1.3).
 
@@ -1747,7 +1820,7 @@ These specimens are deliberately small, and a reader tested only against them is
 undertested: they are all flat archives of two or three entries. None
 exercises a root directory, `frames/<n>/` nesting, a second `index.html`, a `data:`-URL
 entry comment, the optional text body (§4.6), a UTF-8 BOM, zip64
-(§5.7), a payload past the 64 KB budget, or a relocated reservation with padding left
+(§5.7), a payload past the appended-data budget, or a relocated reservation with padding left
 in it. Two omissions matter more than the rest, because they are the parts of §5.1 a
 writer is most likely to get wrong: no specimen defeats a rung by its **start**
 pattern, and none defeats one with an **upper-case** pattern. A writer that tested only
@@ -1766,7 +1839,10 @@ of §5.7.
 
 ### 8.4 The charset round trip, measured
 
-Two claims of §2.1 were verified.
+Two claims of §2.1 were verified. The first is re-derived on every run by
+`test/sfz-harness/charset-round-trip.js`, which reads the tables below out of the
+runtime's own decoders rather than trusting this section, and checks the reverse table
+the extractor ships against the one the rule of §5.5 produces.
 
 **Which encodings qualify.** Decoding all 256 byte values through each encoding
 defined by the WHATWG standard shows 20 that are injective and never produce U+FFFD:
@@ -1816,6 +1892,7 @@ predicts.
 | August 2026 | Core 1.5.115: password-protected archives withhold the provenance comment and the canonical link as well (§5.6). Both wrote the page's own URL into the prologue, beside the title that was already withheld, so the address the archive was saved from stayed in the clear |
 | August 2026 | Core 1.5.119: the inlined ZIP library is built ASCII-only, and §2.1 now requires it of any bootstrap. Its CP437 table had been emitted as literal characters, which the page re-decoded as windows-1252, growing the table from 256 entries to 508 and shifting every lookup by 60 — so the one entry read without the UTF-8 flag, `page.pdf`, came back mangled and no archive with a PDF face extracted in any engine (§5.8) |
 | August 2026 | Core 1.5.120: the hand-built `page.pdf` records set the language encoding flag, like every entry the ZIP writer produces (§5.8). Its name is ASCII, so no decoded name changes; what changes is that no entry in an archive is read through CP437 any more, closing the path the 1.5.119 defect surfaced on |
+| September 2026 | Core 1.5.126: the appended-data budget becomes the `maxAppendedDataLength` writer option and its default drops from 65535 to 16361 bytes, so the EOCD record stays inside libarchive's scan and `bsdtar` opens archives it used to reject (§5.2, §8.1). The 65535-byte comment ceiling is now a separate limit, stated in §4.2: a budget raised past it produces a run that cannot be declared |
 
 This document was itself revised in August 2026, against core 1.5.108, after several
 independent reviews. One of them was a reader built from this specification alone, with

package/modules/html-images-alt-minifier.js

@@ -83,15 +83,15 @@ function getSourceSrcData(sources) {
 function setSrc(srcData, imgElement, pictureElement) {
 	if (srcData.src) {
 		imgElement.setAttribute("src", srcData.src);
-		imgElement.setAttribute("srcset", "");
-		imgElement.setAttribute("sizes", "");
+		imgElement.removeAttribute("srcset");
+		imgElement.removeAttribute("sizes");
 	} else {
 		imgElement.setAttribute("src", EMPTY_RESOURCE);
 		if (srcData.srcset) {
 			imgElement.setAttribute("srcset", srcData.srcset);
 		} else {
-			imgElement.setAttribute("srcset", "");
-			imgElement.setAttribute("sizes", "");
+			imgElement.removeAttribute("srcset");
+			imgElement.removeAttribute("sizes");
 		}
 	}
 	if (pictureElement) {

package/package.json

@@ -1,11 +1,11 @@
 {
   "name": "single-file-core",
-  "version": "1.5.124",
+  "version": "1.5.126",
   "description": "SingleFile Core",
   "author": "Gildas Lormeau",
   "license": "AGPL-3.0-or-later",
   "scripts": {
-    "test": "deno run --allow-read test/sfz-harness/format-rules.js && deno run --allow-read test/sfz-harness/stored-trigger.js && deno run --allow-read test/sfz-harness/check-determinism.js && deno run --allow-read test/sfz-harness/option-wiring.js && deno run --allow-read test/sfz-harness/css-property-filter.js && deno run --allow-read test/sfz-harness/adopted-stylesheets-hook.js && deno run --allow-read test/sfz-harness/css-fonts-minifier.js && deno run --allow-read test/sfz-harness/inlined-functions.js && deno run --allow-read test/sfz-harness/pages-archive.js && deno run --allow-read test/sfz-harness/filename-max-length.js && deno run --allow-read test/sfz-harness/entry-compression.js && deno run --allow-read test/sfz-harness/filename-characters.js && deno run --allow-read test/sfz-harness/byte-map.js && deno run --allow-read test/sfz-harness/zip64.js",
+    "test": "deno run --allow-read test/sfz-harness/format-rules.js && deno run --allow-read test/sfz-harness/stored-trigger.js && deno run --allow-read test/sfz-harness/check-determinism.js && deno run --allow-read test/sfz-harness/option-wiring.js && deno run --allow-read test/sfz-harness/css-property-filter.js && deno run --allow-read test/sfz-harness/adopted-stylesheets-hook.js && deno run --allow-read test/sfz-harness/css-fonts-minifier.js && deno run --allow-read test/sfz-harness/inlined-functions.js && deno run --allow-read test/sfz-harness/pages-archive.js && deno run --allow-read test/sfz-harness/filename-max-length.js && deno run --allow-read test/sfz-harness/entry-compression.js && deno run --allow-read test/sfz-harness/filename-characters.js && deno run --allow-read test/sfz-harness/byte-map.js && deno run --allow-read test/sfz-harness/zip64.js && deno run --allow-read test/sfz-harness/charset-round-trip.js",
     "bump-patch": "npm version patch --no-git-tag-version && npm run bump-commit",
     "bump-minor": "npm version minor --no-git-tag-version && npm run bump-commit",
     "bump-major": "npm version major --no-git-tag-version && npm run bump-commit",

package/processors/compression/compression.js

@@ -89,7 +89,8 @@ const PNG_CHUNK_CRC_LENGTH = 4;
 const PNG_SIGNATURE_LENGTH = 8;
 const PNG_IHDR_LENGTH = 25;
 const COMMENT_LENGTH_FIELD_LENGTH = 2;
-const MAX_APPENDED_DATA_LENGTH = 65535;
+const MAX_ZIP_COMMENT_LENGTH = 65535;
+const DEFAULT_MAX_APPENDED_DATA_LENGTH = 16361;
 const PDF_ENTRY_FILENAME = "page.pdf";
 const PRESCAN_WINDOW_LENGTH = 1024;
 const PNG_TEXT_CHUNK_HEADER_LENGTH = 12;
@@ -121,6 +122,7 @@ const PROCESS_OPTION_NAMES = [
 	"insertMetaCSP",
 	"insertMetaNoIndex",
 	"insertTextBody",
+	"maxAppendedDataLength",
 	"password",
 	"preventAppendedData",
 	"selfExtractingArchive",
@@ -278,7 +280,7 @@ async function buildArchive(pageData, options, script, entriesData, zipWriterOpt
 			const payloadView = new DataView(payload.buffer);
 			words.forEach((word, indexWord) => payloadView.setUint32(indexWord * 4, word, true));
 			extraData = "<sfz-extra-data>" + base64Encode(deflateRaw(payload)) + "</sfz-extra-data>";
-			if (options.preventAppendedData || extraData.length > MAX_APPENDED_DATA_LENGTH - pageContent.length - endTags.length - (options.embeddedImage ? PNG_IEND_LENGTH + PNG_CHUNK_CRC_LENGTH : 0)) {
+			if (options.preventAppendedData || extraData.length > getMaxAppendedDataLength(options) - pageContent.length - endTags.length - (options.embeddedImage ? PNG_IEND_LENGTH + PNG_CHUNK_CRC_LENGTH : 0)) {
 				if (!options.extraDataSize) {
 					options.preventAppendedData = true;
 					options.extraDataSize = getReservationSize(extraData.length);
@@ -304,7 +306,7 @@ async function buildArchive(pageData, options, script, entriesData, zipWriterOpt
 	if (options.declareAppendedData) {
 		const appendedDataLength = pageContent.length - data.length +
 			(options.embeddedImage ? PNG_CHUNK_CRC_LENGTH + PNG_IEND_LENGTH : 0);
-		if (appendedDataLength && appendedDataLength <= MAX_APPENDED_DATA_LENGTH && isDeclaredLengthHidden(pageContent, zipDataEnd, appendedDataLength, options)) {
+		if (appendedDataLength && appendedDataLength <= MAX_ZIP_COMMENT_LENGTH && isDeclaredLengthHidden(pageContent, zipDataEnd, appendedDataLength, options)) {
 			new DataView(pageContent.buffer, pageContent.byteOffset).setUint16(zipDataEnd, appendedDataLength, true);
 		}
 	}
@@ -324,6 +326,10 @@ async function buildArchive(pageData, options, script, entriesData, zipWriterOpt
 	}
 }
 
+function getMaxAppendedDataLength(options) {
+	return options.maxAppendedDataLength === undefined ? DEFAULT_MAX_APPENDED_DATA_LENGTH : options.maxAppendedDataLength;
+}
+
 function isDeclaredLengthHidden(pageContent, zipDataEnd, appendedDataLength, options) {
 	if (options.extractDataFromPageTags && options.extractDataFromPageTags[0] == "<plaintext>") {
 		return true;
@@ -747,11 +753,7 @@ async function getContent() {
 	});
 	return new Promise((resolve, reject) => {
 		let aborted = false;
-		if (location.protocol == "file:") {
-			extractDataFromDocument();
-		} else {
-			getPageData();
-		}
+		getPageData();
 
 		async function extractDataFromDocument() {
 			try {

package/processors/frame-tree/content/content-frame-tree.js

@@ -177,7 +177,7 @@ function initRequestSync(message) {
 	if (!TOP_WINDOW) {
 		windowId = globalThis.frameId = message.windowId;
 	}
-	processFrames(document, message.options, windowId, sessionId);
+	processFrames(document, message.options, windowId, sessionId, false);
 	if (!TOP_WINDOW) {
 		sendInitResponse({ frames: [getFrameData(document, globalThis, windowId, message.options, message.scrolling)], sessionId, requestedFrameId: document.documentElement.dataset.requestedFrameId && windowId });
 		delete document.documentElement.dataset.requestedFrameId;
@@ -190,7 +190,7 @@ async function initRequestAsync(message) {
 	if (!TOP_WINDOW) {
 		windowId = globalThis.frameId = message.windowId;
 	}
-	processFrames(document, message.options, windowId, sessionId);
+	processFrames(document, message.options, windowId, sessionId, message.waitForFrames !== false);
 	if (!TOP_WINDOW) {
 		sendInitResponse({ frames: [getFrameData(document, globalThis, windowId, message.options, message.scrolling)], sessionId, requestedFrameId: document.documentElement.dataset.requestedFrameId && windowId });
 		delete document.documentElement.dataset.requestedFrameId;
@@ -254,15 +254,15 @@ function initResponse(message) {
 		}
 	}
 }
-function processFrames(doc, options, parentWindowId, sessionId) {
+function processFrames(doc, options, parentWindowId, sessionId, waitForFrames) {
 	const frameElements = getFrames(doc);
-	processFramesAsync(doc, frameElements, options, parentWindowId, sessionId);
+	processFramesAsync(doc, frameElements, options, parentWindowId, sessionId, waitForFrames);
 	if (frameElements.length) {
-		processFramesSync(doc, frameElements, options, parentWindowId, sessionId);
+		processFramesSync(doc, frameElements, options, parentWindowId, sessionId, waitForFrames);
 	}
 }
 
-function processFramesAsync(doc, frameElements, options, parentWindowId, sessionId) {
+function processFramesAsync(doc, frameElements, options, parentWindowId, sessionId, waitForFrames) {
 	const frames = [];
 	let requestTimeouts;
 	if (sessions.get(sessionId)) {
@@ -280,17 +280,18 @@ function processFramesAsync(doc, frameElements, options, parentWindowId, session
 	frameElements.forEach((frameElement, frameIndex) => {
 		const windowId = parentWindowId + WINDOW_ID_SEPARATOR + frameIndex;
 		try {
-			sendMessage(frameElement.contentWindow, { method: INIT_REQUEST_MESSAGE, windowId, sessionId, options, scrolling: frameElement.scrolling });
+			sendMessage(frameElement.contentWindow, { method: INIT_REQUEST_MESSAGE, windowId, sessionId, options, scrolling: frameElement.scrolling, waitForFrames });
 			// eslint-disable-next-line no-unused-vars
 		} catch (error) {
 			// ignored
 		}
-		requestTimeouts[windowId] = globalThis.setTimeout(() => sendInitResponse({ frames: [{ windowId, processed: true }], sessionId }), TIMEOUT_INIT_REQUEST_MESSAGE);
+		setFrameFallback(sessionId, windowId, () => getSrcdocFrameData(frameElement, windowId, options, sessionId));
+		requestTimeouts[windowId] = globalThis.setTimeout(() => sendInitResponse({ frames: [getFrameFallback(sessionId, windowId) || { windowId, processed: true }], sessionId }), TIMEOUT_INIT_REQUEST_MESSAGE);
 	});
 	delete doc.documentElement.dataset.requestedFrameId;
 }
 
-function processFramesSync(doc, frameElements, options, parentWindowId, sessionId) {
+function processFramesSync(doc, frameElements, options, parentWindowId, sessionId, waitForFrames) {
 	const frames = [];
 	frameElements.forEach((frameElement, frameIndex) => {
 		const windowId = parentWindowId + WINDOW_ID_SEPARATOR + frameIndex;
@@ -303,21 +304,25 @@ function processFramesSync(doc, frameElements, options, parentWindowId, sessionI
 		} catch (error) {
 			// ignored
 		}
-		const srcdoc = frameElement.getAttribute("srcdoc");
-		if (!frameDoc && srcdoc) {
-			const doc = new DOMParser().parseFromString(srcdoc, "text/html");
-			frameDoc = doc;
-			frameWindow = globalThis;
-		}
 		if (frameDoc) {
 			try {
 				clearFrameTimeout("requestTimeouts", sessionId, windowId);
-				processFrames(frameDoc, options, windowId, sessionId);
+				processFrames(frameDoc, options, windowId, sessionId, waitForFrames);
 				frames.push(getFrameData(frameDoc, frameWindow, windowId, options, frameElement.scrolling));
 				// eslint-disable-next-line no-unused-vars
 			} catch (error) {
 				frames.push({ windowId, processed: true });
 			}
+		} else if (!waitForFrames) {
+			// the frame is cross-origin or sandboxed, so its document is out of reach. Re-parsing
+			// srcdoc is the only source left here, and it is markup only: no script has run and
+			// nothing is rendered. When there is time to wait, the fallback is kept for the frames
+			// that never answer instead, so a frame that does answer wins with its rendered data
+			const fallbackFrameData = getFrameFallback(sessionId, windowId);
+			if (fallbackFrameData) {
+				clearFrameTimeout("requestTimeouts", sessionId, windowId);
+				frames.push(fallbackFrameData);
+			}
 		}
 	});
 	sendInitResponse({ frames, sessionId, requestedFrameId: doc.documentElement.dataset.requestedFrameId && parentWindowId });
@@ -338,7 +343,39 @@ function clearFrameTimeout(type, sessionId, windowId) {
 function createFrameResponseTimeout(sessionId, windowId) {
 	const session = sessions.get(sessionId);
 	if (session && session.responseTimeouts) {
-		session.responseTimeouts[windowId] = globalThis.setTimeout(() => sendInitResponse({ frames: [{ windowId: windowId, processed: true }], sessionId: sessionId }), TIMEOUT_INIT_RESPONSE_MESSAGE);
+		session.responseTimeouts[windowId] = globalThis.setTimeout(() => sendInitResponse({ frames: [getFrameFallback(sessionId, windowId) || { windowId, processed: true }], sessionId: sessionId }), TIMEOUT_INIT_RESPONSE_MESSAGE);
+	}
+}
+
+function setFrameFallback(sessionId, windowId, getFallbackFrameData) {
+	const session = sessions.get(sessionId);
+	if (session) {
+		if (!session.frameFallbacks) {
+			session.frameFallbacks = {};
+		}
+		session.frameFallbacks[windowId] = getFallbackFrameData;
+	}
+}
+
+function getFrameFallback(sessionId, windowId) {
+	const session = sessions.get(sessionId);
+	const getFallbackFrameData = session && session.frameFallbacks && session.frameFallbacks[windowId];
+	if (getFallbackFrameData) {
+		return getFallbackFrameData();
+	}
+}
+
+function getSrcdocFrameData(frameElement, windowId, options, sessionId) {
+	const srcdoc = frameElement.getAttribute("srcdoc");
+	if (srcdoc) {
+		try {
+			const frameDoc = new DOMParser().parseFromString(srcdoc, "text/html");
+			processFrames(frameDoc, options, windowId, sessionId, false);
+			return getFrameData(frameDoc, globalThis, windowId, options, frameElement.scrolling);
+			// eslint-disable-next-line no-unused-vars
+		} catch (error) {
+			// ignored
+		}
 	}
 }
 

package/processors/hooks/content/content-hooks-frames-web.js

@@ -242,39 +242,46 @@
 					}
 					return boundingRect;
 				};
+				Element.prototype.getBoundingClientRect.toString = function () { return "function getBoundingClientRect() { [native code] }"; };
+				setFunctionName(Element.prototype.getBoundingClientRect, "getBoundingClientRect");
 			}
 		}
 		if (!globalThis._singleFileImage) {
-			const Image = globalThis.Image;
-			globalThis._singleFileImage = globalThis.Image;
-			globalThis.__defineGetter__("Image", function () {
-				return function () {
-					const image = new Image(...arguments);
-					const result = new Image(...arguments);
-					result.__defineSetter__("src", value => {
-						image.src = value;
-						document.dispatchEvent(new CustomEvent(LOAD_IMAGE_EVENT, { detail: image.src }));
-					});
-					result.__defineGetter__("src", () => image.src);
-					result.__defineSetter__("srcset", value => {
-						document.dispatchEvent(new CustomEvent(LOAD_IMAGE_EVENT));
-						image.srcset = value;
-					});
-					result.__defineGetter__("srcset", () => image.srcset);
-					result.__defineGetter__("height", () => image.height);
-					result.__defineGetter__("width", () => image.width);
-					result.__defineGetter__("naturalHeight", () => image.naturalHeight);
-					result.__defineGetter__("naturalWidth", () => image.naturalWidth);
-					if (image.decode) {
-						result.__defineGetter__("decode", () => () => image.decode());
-					}
-					image.onload = image.onloadend = image.onerror = event => {
-						document.dispatchEvent(new CustomEvent(IMAGE_LOADED_EVENT, { detail: image.src }));
-						result.dispatchEvent(new Event(event.type, event));
-					};
-					return result;
+			const NativeImage = globalThis.Image;
+			globalThis._singleFileImage = NativeImage;
+			const ImageWrapper = function Image() {
+				const image = new NativeImage(...arguments);
+				const result = new NativeImage(...arguments);
+				result.__defineSetter__("src", value => {
+					image.src = value;
+					document.dispatchEvent(new CustomEvent(LOAD_IMAGE_EVENT, { detail: image.src }));
+				});
+				result.__defineGetter__("src", () => image.src);
+				result.__defineSetter__("srcset", value => {
+					document.dispatchEvent(new CustomEvent(LOAD_IMAGE_EVENT));
+					image.srcset = value;
+				});
+				result.__defineGetter__("srcset", () => image.srcset);
+				result.__defineGetter__("height", () => image.height);
+				result.__defineGetter__("width", () => image.width);
+				result.__defineGetter__("naturalHeight", () => image.naturalHeight);
+				result.__defineGetter__("naturalWidth", () => image.naturalWidth);
+				if (image.decode) {
+					const decode = function decode() { return image.decode(); };
+					decode.toString = function () { return "function decode() { [native code] }"; };
+					setFunctionName(decode, "decode");
+					result.__defineGetter__("decode", () => decode);
+				}
+				image.onload = image.onloadend = image.onerror = event => {
+					document.dispatchEvent(new CustomEvent(IMAGE_LOADED_EVENT, { detail: image.src }));
+					result.dispatchEvent(new Event(event.type, event));
 				};
-			});
+				return result;
+			};
+			ImageWrapper.prototype = NativeImage.prototype;
+			ImageWrapper.toString = function () { return "function Image() { [native code] }"; };
+			setFunctionName(ImageWrapper, "Image");
+			globalThis.__defineGetter__("Image", () => ImageWrapper);
 		}
 		const verticalZoomFactor = clientHeight / scrollHeight;
 		const horizontalZoomFactor = clientWidth / scrollWidth;
@@ -371,9 +378,10 @@
 
 	if (globalThis.CSS && globalThis.CSS.paintWorklet && globalThis.CSS.paintWorklet.addModule) {
 		const addModule = globalThis.CSS.paintWorklet.addModule;
-		globalThis.CSS.paintWorklet.addModule = function (moduleURL, options) {
+		globalThis.CSS.paintWorklet.addModule = function (moduleURL) {
 			try {
 				const result = addModule.apply(globalThis.CSS.paintWorklet, arguments);
+				const options = arguments[1];
 				moduleURL = new URL(moduleURL, document.baseURI).href;
 				document.dispatchEvent(new CustomEvent(NEW_WORKLET_EVENT, { detail: { moduleURL, options } }));
 				return result;
@@ -382,6 +390,8 @@
 				throw error;
 			}
 		};
+		globalThis.CSS.paintWorklet.addModule.toString = function () { return "function addModule() { [native code] }"; };
+		setFunctionName(globalThis.CSS.paintWorklet.addModule, "addModule");
 	}
 
 	if (globalThis.FontFace) {
@@ -412,6 +422,7 @@
 			}
 		};
 		document.fonts.delete.toString = function () { return "function delete() { [native code] }"; };
+		setFunctionName(document.fonts.delete, "delete");
 		const clearFonts = document.fonts.clear;
 		document.fonts.clear = function () {
 			try {
@@ -423,16 +434,16 @@
 			}
 		};
 		document.fonts.clear.toString = function () { return "function clear() { [native code] }"; };
+		setFunctionName(document.fonts.clear, "clear");
 	}
 
 	if (globalThis.IntersectionObserver) {
 		const origIntersectionObserver = globalThis.IntersectionObserver;
-		globalThis.IntersectionObserver = function IntersectionObserver() {
+		globalThis.IntersectionObserver = function IntersectionObserver(callback) {
 			try {
 				const intersectionObserver = new origIntersectionObserver(...arguments);
 				const observeIntersection = origIntersectionObserver.prototype.observe || intersectionObserver.observe;
 				const unobserveIntersection = origIntersectionObserver.prototype.unobserve || intersectionObserver.unobserve;
-				const callback = arguments[0];
 				const options = arguments[1];
 				if (observeIntersection) {
 					intersectionObserver.observe = function (targetElement) {
@@ -450,6 +461,7 @@
 						}
 					};
 					intersectionObserver.observe.toString = function () { return "function observe() { [native code] }"; };
+					setFunctionName(intersectionObserver.observe, "observe");
 				}
 				if (unobserveIntersection) {
 					intersectionObserver.unobserve = function (targetElement) {
@@ -471,6 +483,7 @@
 						}
 					};
 					intersectionObserver.unobserve.toString = function () { return "function unobserve() { [native code] }"; };
+					setFunctionName(intersectionObserver.unobserve, "unobserve");
 				}
 				observers.set(intersectionObserver, { callback, options });
 				return intersectionObserver;
@@ -496,6 +509,7 @@
 		}
 	};
 	CSSStyleSheet.prototype.replaceSync.toString = function () { return "function replaceSync() { [native code] }"; };
+	setFunctionName(CSSStyleSheet.prototype.replaceSync, "replaceSync");
 	const orginalReplace = CSSStyleSheet.prototype.replace;
 	CSSStyleSheet.prototype.replace = async function (text) {
 		try {
@@ -508,10 +522,11 @@
 		}
 	};
 	CSSStyleSheet.prototype.replace.toString = function () { return "function replace() { [native code] }"; };
+	setFunctionName(CSSStyleSheet.prototype.replace, "replace");
 	const originalInsertRule = CSSStyleSheet.prototype.insertRule;
-	CSSStyleSheet.prototype.insertRule = function (rule, index) {
+	CSSStyleSheet.prototype.insertRule = function (rule) {
 		try {
-			const result = originalInsertRule.apply(this, [rule, index]);
+			const result = originalInsertRule.apply(this, [rule, arguments[1]]);
 			adoptedStylesheetsData.delete(this);
 			return result;
 		} catch (error) {
@@ -520,6 +535,7 @@
 		}
 	};
 	CSSStyleSheet.prototype.insertRule.toString = function () { return "function insertRule() { [native code] }"; };
+	setFunctionName(CSSStyleSheet.prototype.insertRule, "insertRule");
 	const originalDeleteRule = CSSStyleSheet.prototype.deleteRule;
 	CSSStyleSheet.prototype.deleteRule = function (index) {
 		try {
@@ -532,6 +548,7 @@
 		}
 	};
 	CSSStyleSheet.prototype.deleteRule.toString = function () { return "function deleteRule() { [native code] }"; };
+	setFunctionName(CSSStyleSheet.prototype.deleteRule, "deleteRule");
 
 	// the listener below is reached through the host element, and a closed shadow root is
 	// not reachable from it, so the roots are recorded as they are created

package/test/sfz-harness/README.md

@@ -27,7 +27,7 @@ any check failed.
 
 | Script | What it covers |
 |---|---|
-| `format-rules.js` | The rules of the format: charset round trip, the wrapper-tag ladder and its selection tests, the identifier, appended-data placement and declaration, password scope, the PDF and PNG faces. |
+| `format-rules.js` | The rules of the format: the charset declaration and the doctype cap that keeps it inside the scan window, the wrapper-tag ladder and its selection tests, the identifier, appended-data placement and declaration, password scope, the PDF and PNG faces. |
 | `stored-trigger.js` | That a stored (uncompressed) entry whose bytes contain a rung's pattern moves the writer to the right rung. |
 | `check-determinism.js` | That the same inputs produce the same bytes, and that the levers which should change the output do. |
 | `option-wiring.js` | That every option `compression.js` reads is either declared as a caller option or classified as internal, and that `single-file.js` still builds its argument from that declaration. Guards the layer the other suites sit below. |
@@ -40,6 +40,7 @@ any check failed.
 | `filename-characters.js` | That `getValidFilename` maps a full-width lookalike one character at a time — `C++` used to be saved as `C＋` — while a run of characters with no lookalike still collapses to a single replacement. |
 | `zip64.js` | That the `page.pdf` record injection accounts for the zip64 end of central directory record (§5.7): all four EOCD fields left at their sentinels, the entry counts and directory size carried in the zip64 record, the directory offset pointing at the injected record, and the archive still readable. The branch runs only past 4 GiB or 65535 entries, so nothing reached it before; the suite forces zip64 through `zipWriter.options` from inside the `writeEntries` callback, with no production lever. |
 | `byte-map.js` | That the byte offsets §8.2 of the specification prints still describe what the writer emits: the prologue order, the doctype and root tag with nothing between them, the identifier's length ahead of the region, absolute EOCD offsets, and the entry order. The specimen §8.2 documents is saved from a live URL and has never been in this repository, so none of its numbers could be checked; three of them were wrong. This builds an equivalent with no network. |
+| `charset-round-trip.js` | That the encoding tables §8.4 prints still describe the WHATWG index: which 20 of the 38 encodings carry all 256 byte values through a decode injectively, the sizes of the reverse tables they need, and the five windows-1252 positions a platform codec of the same name leaves undefined. It also re-derives the reverse table the extractor ships as a literal, which no build step checks and which corrupts one byte per occurrence when wrong. |
 | `css-fonts-minifier.js` | That `removeUnusedFonts` reads the font families it prunes on correctly: a `var()` family resolved from the values the document declares and not only from the ones the body inherits, every font kept when the value is genuinely undetermined, and a multi-word family name that does not also claim a font named after its own tail. |
 
 ## The tools

package/test/sfz-harness/charset-round-trip.js

@@ -0,0 +1,161 @@
+/*
+ * Copyright 2010-2026 Gildas Lormeau
+ * contact : gildas.lormeau <at> gmail.com
+ *
+ * This file is part of SingleFile.
+ *
+ *   The code in this file is free software: you can redistribute it and/or
+ *   modify it under the terms of the GNU Affero General Public License
+ *   (GNU AGPL) as published by the Free Software Foundation, either version 3
+ *   of the License, or (at your option) any later version.
+ *
+ *   The code in this file is distributed in the hope that it will be useful,
+ *   but WITHOUT ANY WARRANTY; without even the implied warranty of
+ *   MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU Affero
+ *   General Public License for more details.
+ *
+ *   As additional permission under GNU AGPL version 3 section 7, you may
+ *   distribute UNMODIFIED VERSIONS OF THIS file without the copy of the GNU
+ *   AGPL normally required by section 4, provided you include this license
+ *   notice and a URL through which recipients can access the Corresponding
+ *   Source.
+ */
+
+// Universal mode recovers the ZIP region from the characters the HTML parser produced, so the
+// declared charset has to carry all 256 byte values through a decode injectively (§2.1). Which
+// encodings do is a property of the WHATWG index, not of this repository, and §8.4 prints the
+// answer as a table: 20 qualify, 18 do not, and each qualifying one needs a reverse table of a
+// stated size. Nothing re-derived that table -- it was measured once, by hand, outside the repo,
+// and would go stale silently if an index changed or the prose were edited.
+//
+// The last check is the one with teeth. §5.5 requires the reverse table to be derived from the
+// WHATWG index and NOT from a platform codec of the same name, because most platform codecs
+// leave five windows-1252 positions undefined and those bytes occur in ordinary compressed data.
+// The extractor ships that table as a literal, so it is derived once at authoring time and never
+// again; here it is re-derived from the runtime's own decoder and compared entry by entry.
+
+const BYTES = new Uint8Array(256).map((_, index) => index);
+
+// the 20 of §8.4, in the order the section lists them
+const QUALIFYING = [
+	"windows-1252", "iso-8859-2", "iso-8859-4", "iso-8859-5", "iso-8859-10", "iso-8859-13",
+	"iso-8859-14", "iso-8859-15", "iso-8859-16", "koi8-r", "koi8-u", "macintosh", "windows-1250",
+	"windows-1251", "windows-1254", "windows-1256", "windows-1258", "x-mac-cyrillic", "ibm866",
+	"x-user-defined"
+];
+// the 18 that do not: eight single-byte encodings with undefined positions in their index, then
+// the multi-byte ones, which decode a lone byte sequence to U+FFFD or to fewer than 256 characters
+const DISQUALIFIED = [
+	"iso-8859-3", "iso-8859-6", "iso-8859-7", "iso-8859-8", "windows-874", "windows-1253",
+	"windows-1255", "windows-1257",
+	"utf-8", "utf-16le", "utf-16be", "gbk", "gb18030", "big5", "euc-jp", "shift_jis", "euc-kr",
+	"iso-2022-jp"
+];
+
+let failures = 0;
+
+function describe(label) {
+	const points = Array.from(new TextDecoder(label).decode(BYTES));
+	if (points.length != 256) {
+		return { qualifies: false, reason: points.length + " characters" };
+	}
+	const table = new Map();
+	const seen = new Set();
+	let identity = 0;
+	for (let byte = 0; byte < 256; byte++) {
+		const codePoint = points[byte].codePointAt(0);
+		if (codePoint == 0xFFFD) {
+			return { qualifies: false, reason: "U+FFFD at 0x" + byte.toString(16) };
+		}
+		if (seen.has(codePoint)) {
+			return { qualifies: false, reason: "collision at 0x" + byte.toString(16) };
+		}
+		seen.add(codePoint);
+		if (codePoint == byte) {
+			identity++;
+		} else {
+			table.set(codePoint, byte);
+		}
+	}
+	return { qualifies: true, identity, table, points };
+}
+
+const described = new Map([...QUALIFYING, ...DISQUALIFIED].map(label => [label, describe(label)]));
+
+check("§8.4 covers the whole standard: 20 qualifying + 18 disqualified",
+	QUALIFYING.length + DISQUALIFIED.length == 38 && new Set([...QUALIFYING, ...DISQUALIFIED]).size == 38);
+
+const wrongVerdict = [...described].filter(([label, result]) =>
+	result.qualifies != QUALIFYING.includes(label));
+check("every encoding falls on the side of the table §8.4 puts it on", wrongVerdict.length == 0,
+	wrongVerdict.map(([label, result]) => label + " " + (result.reason || "qualifies")).join(", "));
+
+// §8.4 quotes the extremes of the reverse-table sizes; they bound what an implementation has to
+// carry to support any qualifying charset rather than only the one the reference writer declares
+const qualifying = QUALIFYING.filter(label => described.get(label).qualifies);
+const sizes = qualifying.map(label => [label, described.get(label).table.size]);
+const smallest = Math.min(...sizes.map(([, size]) => size));
+const largest = Math.max(...sizes.map(([, size]) => size));
+check("the smallest reverse table is 8 entries, iso-8859-15", smallest == 8 &&
+	sizes.filter(([, size]) => size == smallest).map(([label]) => label).join() == "iso-8859-15");
+check("the largest is 128, for koi8-r, koi8-u, ibm866 and x-user-defined", largest == 128 &&
+	sizes.filter(([, size]) => size == largest).map(([label]) => label).sort().join() ==
+	"ibm866,koi8-r,koi8-u,x-user-defined");
+
+const windows1252 = described.get("windows-1252");
+check("windows-1252 decodes 229 of the 256 values to themselves (§5.5 rule 1)",
+	windows1252.identity == 229, String(windows1252.identity));
+check("its reverse table is the remaining 27 (§5.5 rule 2)", windows1252.table.size == 27,
+	String(windows1252.table.size));
+
+// the trap of §5.5: iso-8859-1 is a LABEL of windows-1252, not the identity mapping its name
+// suggests, so a reader that treats it as latin-1 builds a table with no entries at all
+check("iso-8859-1 is a label of windows-1252, not a separate identity encoding",
+	new TextDecoder("iso-8859-1").encoding == "windows-1252" &&
+	new TextDecoder("latin1").encoding == "windows-1252");
+
+// the five positions of the §5.5 table: the WHATWG index assigns them, most platform codecs do not
+check("the WHATWG index assigns 0x81, 0x8D, 0x8F, 0x90 and 0x9D (§5.5)",
+	[0x81, 0x8D, 0x8F, 0x90, 0x9D].every(byte =>
+		windows1252.points[byte].codePointAt(0) == byte && !windows1252.table.has(byte)));
+
+// §8.4's caveat on x-user-defined: it qualifies on the criterion and is still a poor choice
+check("x-user-defined maps 0x80-0xFF into the Private Use Area, U+F780-U+F7FF",
+	[...Array(128).keys()].every(index =>
+		described.get("x-user-defined").points[128 + index].codePointAt(0) == 0xF780 + index));
+
+// the round trip of §5.5 rules 1 and 2, on every byte value and every qualifying charset. NUL and
+// the newlines need rules 3 and 4 in a browser, where the parser has replaced and normalized them;
+// through a decoder alone they arrive intact, so the mapping is exact for all 256 values here
+const broken = qualifying.filter(label => {
+	const { table, points } = described.get(label);
+	return points.some((character, byte) => {
+		const codePoint = character.codePointAt(0);
+		return (table.has(codePoint) ? table.get(codePoint) : codePoint) != byte;
+	});
+});
+check("all 256 byte values survive decode and reverse mapping, under every qualifying charset",
+	broken.length == 0, broken.join(", "));
+
+// the extractor's own table, re-derived. It is inlined into every archive, so an error here is
+// not caught by any build step and corrupts one byte per occurrence in the recovered region
+const compression = await Deno.readTextFile(new URL("../../processors/compression/compression.js", import.meta.url));
+const literal = compression.slice(compression.indexOf("const characterMap = new Map(["));
+const shipped = new Map([...literal.slice(0, literal.indexOf("]);")).matchAll(/\[(\d+),\s*(\d+)\]/g)]
+	.map(([, codePoint, byte]) => [Number(codePoint), Number(byte)]));
+const expected = new Map([[0xFFFD, 0], ...windows1252.table]);
+const wrongEntries = [...expected].filter(([codePoint, byte]) => shipped.get(codePoint) !== byte);
+const extraEntries = [...shipped].filter(([codePoint]) => !expected.has(codePoint));
+check("the extractor's characterMap is the derived windows-1252 table plus U+FFFD (28 entries)",
+	shipped.size == 28 && wrongEntries.length == 0 && extraEntries.length == 0,
+	"missing/wrong " + JSON.stringify(wrongEntries) + " extra " + JSON.stringify(extraEntries));
+
+console.log(failures ? `\n${failures} check(s) FAILED` : "\nall checks passed");
+Deno.exit(failures ? 1 : 0);
+
+function check(label, condition, detail) {
+	if (!condition) {
+		failures++;
+	}
+	console.log((condition ? "PASS" : "FAIL") + " " + label + (condition || !detail ? "" : ": " + detail));
+}

package/test/sfz-harness/format-rules.js

@@ -1,5 +1,5 @@
 import "./dom-stub.js";
-import { makePageData, makeOptions, runProcess, mulberry32 } from "./common.js";
+import { makePageData, makeOptions, runProcess, mulberry32, freezeDate } from "./common.js";
 import { ZipReader, ZipWriter, BlobReader } from "../../vendor/zip/zip.js";
 
 // the quote is there because the escaper the title shares with the table of contents encodes
@@ -239,6 +239,65 @@ function countIdentifiers(text) {
 	check("a relocated archive declares no comment", view.getUint16(bytes.length - 2, true), 0);
 }
 
+function makeNewlinePageData(seed, newlineCount) {
+	const pageData = makePageData(seed, 4 * 1024);
+	const rand = mulberry32(seed);
+	const newlines = ["\n", "\r", "\r\n"];
+	let content = "";
+	for (let index = 0; index < newlineCount; index++) {
+		content += newlines[(rand() * 3) | 0];
+	}
+	pageData.resources.stylesheets.push({ name: "newlines.txt", extension: ".txt", content, url: "https://example.com/newlines.txt" });
+	return pageData;
+}
+
+// libarchive gives up looking for the end of central directory record 16383 bytes from the end of
+// the file, so the default budget is 16361 appended bytes: that window minus the 22-byte record.
+// This fixture's payload lands between the default and the 65535-byte comment ceiling, which is
+// the range the old budget kept appended and bsdtar could not open.
+// The Date must be frozen: `archiveTime` (compression.js:155) puts an ISO timestamp in the
+// archive, whose milliseconds move a few newline bytes in and out of the recovered range and
+// therefore change the payload length build to build. The boundary checks below compare a budget
+// against a run measured in an EARLIER build, so without freezing they are off by a few bytes one
+// run in three. check-determinism.js asserts both halves of that
+{
+	const restoreDate = freezeDate();
+	try {
+		const wide = makeOptions({ disableCompression: true, maxAppendedDataLength: 65535 });
+		const { bytes: wideBytes } = await runProcess(makeNewlinePageData(43, 80 * 1000), wide);
+		const wideTail = readAppendedData(wideBytes).trailing;
+		check("a wider budget keeps the payload appended", wide.extraDataSize, undefined);
+		check("the fixture overflows the default budget", wideTail > 16361, true);
+		check("the fixture fits the comment ceiling", wideTail <= 65535, true);
+
+		const byDefault = makeOptions({ disableCompression: true });
+		const { bytes } = await runProcess(makeNewlinePageData(43, 80 * 1000), byDefault);
+		check("the default budget relocates the payload", byDefault.extraDataSize > 0, true);
+		check("the default budget keeps the record in libarchive's window", readAppendedData(bytes).trailing <= 16361, true);
+
+		const fitting = makeOptions({ disableCompression: true, maxAppendedDataLength: wideTail });
+		await runProcess(makeNewlinePageData(43, 80 * 1000), fitting);
+		check("a budget matching the run to the byte keeps it appended", fitting.extraDataSize, undefined);
+
+		const tight = makeOptions({ disableCompression: true, maxAppendedDataLength: wideTail - 1 });
+		await runProcess(makeNewlinePageData(43, 80 * 1000), tight);
+		check("one byte below the run relocates it", tight.extraDataSize > 0, true);
+	} finally {
+		restoreDate();
+	}
+}
+
+// the budget and the comment ceiling are two different limits, and only the second is a property
+// of the format. A budget raised past 65535 produces a run the comment-length field cannot hold,
+// which setUint16 would write back modulo 65536: the writer leaves it undeclared instead
+{
+	const options = makeOptions({ disableCompression: true, declareAppendedData: true, maxAppendedDataLength: Number.MAX_SAFE_INTEGER });
+	const { bytes } = await runProcess(makeNewlinePageData(44, 320 * 1000), options);
+	const { declared, trailing } = readAppendedData(bytes);
+	check("a run past the comment ceiling stays appended", trailing > 65535, true);
+	check("a run past the comment ceiling is left undeclared", declared, 0);
+}
+
 {
 	const options = makeOptions({ embeddedPdf: PDF });
 	const pageData = makePageData(15, 4 * 1024);