# feat: open native protected sections through an owned decode view · clo/snowbound

[View on GitCafe](https://git.cafe/clo/snowbound/commit/3a32cbb2aad5a83965908734e6595ea252557f7f)

Repository: [clo/snowbound](https://git.cafe/clo/snowbound)

Visibility: public

Requested revision: 3a32cbb2aad5a83965908734e6595ea252557f7f

Requested commit: 3a32cbb2aad5a83965908734e6595ea252557f7f

Commit: 3a32cbb2aad5a83965908734e6595ea252557f7f

Tree: 75dda3f876940e0faaf92662e16a78f99b12622c

Author: clover caruso

Committer: clover caruso

## Message

```
feat: open native protected sections through an owned decode view

Add optional known-password OneNote 2010 AES-128/CBC and SHA-1 decoding with bounded work, native read-only hash and graph checks, and zeroizing owned buffers. Reuse document traversal and reference-stream parsing; preserve opaque reads and reject protected writes. Extend the diagnostic exporter with exact password-file input and private Unix output directories.

Retain an independent cold native oracle. Correct table comparison to distinguish documented auto-fit from locked widths; fixed-width mismatches remain failures.

Validation: 174 Rust tests, 120 Python tests, eight doctests and Clippy pass; 14 live/private tests remain explicitly ignored in the public lane. Two ASan fuzz passes complete 25,676 cases. Native comparisons cover 12 pages and 1,947 format checks with exact assets; device and simulator executables link. All owned clones removed.

Assisted-by: gpt-6-astra

```

## Parents

- [5bd5adf1ba1afbdc4eb6f3c20c23522d15945e16](https://git.cafe/clo/snowbound/commit/5bd5adf1ba1afbdc4eb6f3c20c23522d15945e16?format=markdown)

[Source at this commit](https://git.cafe/clo/snowbound/tree/3a32cbb2aad5a83965908734e6595ea252557f7f?format=markdown)