feat(fleet): land 36 audited worker tags across six formats

[swackhamer]

Harvest of today's local fleet run (2 workers): six formats' worth of worker-produced tag fixes, audited hunk-by-hunk before landing per the standing rule that fleet patches are unvalidated drafts — and the audit earned its keep.

What lands

Format	New matching tags	Worker commit
JPEG	+5 (MakerNoteUnknown*, SubfileType, ThumbnailTIFF)	fix(jpeg)
CRW	+6 (AFInfo block incl. AEBBracketValue)	fix(crw)
DCM	+6	fix(dcm)
MIFF	+6 (incl. Composite:Aperture)	fix(miff)
EIP	+6	fix(eip)
FIT	+8 (audit surfaced 2 the worker mislabeled away)	fix(fit)

An eighth worker patch (WTV) was dropped: its raw whole-file GUID scan bypasses the WTV sector directory, which happens to work on the single corpus sample but risks wrong values on real fragmented recordings — the omit-don't-approximate rule says that format needs a real sector parser, not a patch-up.

The audit

27 agents reviewed the seven patches against pinned ExifTool 13.59; every finding was adversarially verified (refute-first) before being acted on. 16 confirmed defects were hiding in six confident-looking, gate-passing diffs, fixed in the final commit:

• JPEG: the fallback's condition semantics were invented (the patch's comment cites a RawConv that does not exist in MakerNotes.pm) — it failed on the very Samsung corpus files it claimed to wire and fabricated MakerNoteUnknownText on RICOH/JVC/Pentax text makernotes; build_thumbnail_tiff was an invented reconstruction. Now: condition on first-128-bytes exactly, fallback gated behind every preceding @MakerNotes::Main condition, and a faithful RebuildTIFF replication — byte-identical to exiftool -b (sha1-verified). The corpus fallback-emitting file set now matches the oracle's 24 files exactly.
• FIT: fields 118/119 are right power phase but were emitted under AvgLeftPowerPhase names; phantom "255 bpm" sentinels ExifTool suppresses; every-session-last-wins where ExifTool takes the first; an invented compressed-header skip that misframed records; whole-file hard-fail on mid-file malformation.
• DCM: reproduced panic on non-UTF-8 time bytes; undefined-length elements hard-failed the whole file; TM conversion rewrote partial times DICOM.pm leaves alone ("1434" stays "1434", verified by executing both sides); DA/trimming/long-VR aligned to the pinned tables.
• EIP: member read pre-allocated from the attacker-controlled ZIP uncompressed-size field — capacity-overflow panic on a forged ZIP64 size (CWE-789, reproduced). Now bounded take() + read_to_end behind a 1 GiB cap; hostile repro errors cleanly.
• MIFF: Composite:Aperture was suppressed for MIFF citing a fabricated ExifTool claim — removed; oracle emits Aperture 3.5 for the sample and so do we. Profile matching now case-sensitive like MIFF.pm.
• CRW: AFInfo decoded signed where %Canon::AFInfo declares FORMAT => int16u — a latent silent-wrong-value; now unsigned with the table's int16s[] exceptions preserved.

Verification

Rebased onto current main (27be399a) and re-verified post-rebase with the full protocol (before/after tag-comparison snapshots against pinned ExifTool 13.59 on the 4,238-file corpus):

• +36 net matching tags, regressions: 0 in every format, value_differences unchanged by this branch (the one JPEG delta — EXIF:UserComment on OlympusD450Z — reproduces byte-identically on pure main; pre-existing, tracked separately).
• cargo test --workspace: 47 suites, 0 failures (including new regression tests for the panic repro, sentinel suppression, TM/DA semantics, RebuildTIFF byte layout, and fallback gating).
• cargo clippy and cargo fmt --check clean.

Salvaged pre-restart DCM/MIFF worker commits were verified same-tag-list and superseded by the post-restart re-derives; later fleet output (MIE, ICS, VCF, …) rides the next sweep.

🤖 Generated with Claude Code