Zupt is a pure-C11 backup compressor with post-quantum hybrid encryption. Since 4.1.0 it is a source-only build with no vendored binary SDKs: recipient modes are the native ML-KEM-768 + X25519 hybrid (--pq, recommended) and pure ML-KEM-768 with no classical component (--pq-only, for CNSA 2.0-style postures); the SDK-backed --pq-sdk and --pq-box modes are unsupported stubs, and password mode uses PBKDF2-SHA256. 5.0.0 makes the ML-KEM-768 implementation genuinely FIPS 203-conformant (earlier releases shipped round-3 CRYSTALS-Kyber under that label), cross-validated byte-for-byte against OpenSSL 3.5 during this package's build; BREAKING: --pq/--pq-only keys and archives from 4.2.1 or earlier no longer decrypt — regenerate keys and re-encrypt (password mode and plain compression are unaffected). 4.2.0 fixed a critical AES-CTR keystream-reuse flaw in --dedup archives (re-encrypt any written by 4.1.0 or earlier). Payload protection is AES-256-CTR + HMAC-SHA256 Encrypt-then-MAC with measured constant-time tag comparison and runtime AES-NI/SHA-NI dispatch; it embeds the VaptVupt LZ+ANS codec, which is a codec component rather than a compatibility command.