diff --git a/src/blz.rs b/src/blz.rs
index ad18051..30689e0 100644
--- a/src/blz.rs
+++ b/src/blz.rs
@@ -6,10 +6,10 @@
 //! back-reference into already-decoded data, grouped under flag bytes and
 //! finished with a small trailer.
 //!
-//! Only compression is implemented here, since that is all the KIP1 builder
-//! needs. [`compress`] always allocates a worst-case output buffer up front, so
-//! it cannot fail and is infallible for any input (including empty), and it
-//! never mutates the caller's slice.
+//! [`compress`] always allocates a worst-case output buffer up front, so it
+//! cannot fail and is infallible for any input (including empty), and it never
+//! mutates the caller's slice. [`decompress`] is its inverse and is fallible,
+//! because it is the half that reads bytes the crate did not produce.
 //!
 //! # Why "backwards"
 //!
@@ -36,7 +36,9 @@
 //! [ raw bytes ][ 0x00 padding ][ u32 = 0 ]
 //! ```
 //!
-//! The decoded result is simply the leading `len - 4` bytes.
+//! The decoded result is the leading bytes, but *how many* is not recorded anywhere in the
+//! stream: the padding is indistinguishable from data. A decoder is told the length from
+//! outside — for a KIP1 segment it is the segment header's `decomp_size`.
 //!
 //! ## Packed (compressed input)
 //!
@@ -241,14 +243,33 @@ fn compress_into(input: &mut [u8], output: &mut [u8]) -> usize {
     input.reverse();
     output[..packed_len].reverse();
 
+    // The trailer is written into the bytes the packed layout saves, so a layout saving less than
+    // the trailer costs cannot be expressed: `extra_len` would have to be negative. Saving exactly
+    // the trailer is no better — that writes `extra_len` as zero, which is the marker for a stored
+    // stream, and the result would decode as one. Both cases fall back to storing, which is valid
+    // and, for the small highly compressible inputs that reach here, smaller anyway.
+    let trailer_fits =
+        len - best_packed - best_remaining > packed_header_size(best_remaining + best_packed);
+
     // Compare the aligned packed layout against simply storing the raw bytes.
-    if best_packed == 0 || len + 4 < ((best_packed + best_remaining + 3) & 0xFFFF_FFFC) + 8 {
+    if best_packed == 0
+        || !trailer_fits
+        || len + 4 < ((best_packed + best_remaining + 3) & 0xFFFF_FFFC) + 8
+    {
         store_uncompressed(input, output)
     } else {
         store_packed(input, output, packed_len, best_packed, best_remaining)
     }
 }
 
+/// Size of the trailer for a packed region ending at `packed_end`, alignment padding included.
+///
+/// The padding brings the trailer onto a 4-byte boundary and is counted in the recorded header
+/// size, so both the layout decision and the writer have to agree on it.
+fn packed_header_size(packed_end: usize) -> usize {
+    size_of::<Footer>() + (packed_end.wrapping_neg() & 3)
+}
+
 /// Emit `input` verbatim with a zero trailer marking the data as stored.
 fn store_uncompressed(input: &[u8], output: &mut [u8]) -> usize {
     let len = input.len();
@@ -286,7 +307,7 @@ fn store_packed(
     output[..remaining].copy_from_slice(&input[..remaining]);
 
     let mut pos = remaining + best_packed;
-    let mut header_size = 12;
+    let header_size = packed_header_size(pos);
     let inc_len = input.len() - best_packed - remaining;
 
     // Pad with 0xFF so the trailer ends on a 4-byte boundary; the padding
@@ -294,7 +315,6 @@ fn store_packed(
     while pos & 3 != 0 {
         output[pos] = 0xFF;
         pos += 1;
-        header_size += 1;
     }
 
     // Trailer (see module docs): enc_len, header_size, extra_len.
@@ -421,6 +441,212 @@ impl<'a> MatchFinder<'a> {
     }
 }
 
+/// Decompress a BLZ stream produced by [`compress`] into `decompressed_size` bytes.
+///
+/// The size is a parameter because a stream does not carry it. A stored stream is padded to a
+/// 4-byte boundary and the padding is indistinguishable from data, so nothing in the bytes says
+/// where the original ended; a caller reading a KIP1 takes the length from the segment header's
+/// `decomp_size`, which is what the loader does too.
+///
+/// # Errors
+///
+/// Returns an error if the buffer is too short to hold a trailer, if the trailer's lengths do not
+/// describe a layout that fits the buffer, if a code reaches outside the region it may read, or if
+/// the stream does not hold `decompressed_size` bytes of output.
+pub fn decompress(data: &[u8], decompressed_size: usize) -> Result<Vec<u8>, DecompressError> {
+    let extra_len = trailing_u32(data, 4).ok_or(DecompressError::BufferTooSmall {
+        required: 4,
+        available: data.len(),
+    })?;
+
+    // A zero here is what marks a stored stream: the result is its leading bytes, and everything
+    // after them up to the trailer is alignment padding the caller's length tells us to drop.
+    if extra_len == 0 {
+        let stored = &data[..data.len() - 4];
+        return stored.get(..decompressed_size).map(<[u8]>::to_vec).ok_or(
+            DecompressError::UnexpectedLength {
+                expected: decompressed_size,
+                produced: stored.len(),
+            },
+        );
+    }
+
+    let footer_size = size_of::<Footer>();
+    let header_size = trailing_u32(data, 8).ok_or(DecompressError::BufferTooSmall {
+        required: footer_size,
+        available: data.len(),
+    })? as usize;
+    let enc_len = trailing_u32(data, footer_size).ok_or(DecompressError::BufferTooSmall {
+        required: footer_size,
+        available: data.len(),
+    })? as usize;
+
+    let total = data.len();
+    if header_size < footer_size || header_size > enc_len || enc_len > total {
+        return Err(DecompressError::MalformedTrailer {
+            enc_len,
+            header_size,
+            available: total,
+        });
+    }
+
+    // The final length is `dec_len + enc_len + extra_len`, and `dec_len` is `total - enc_len`.
+    let final_len =
+        total
+            .checked_add(extra_len as usize)
+            .ok_or(DecompressError::MalformedTrailer {
+                enc_len,
+                header_size,
+                available: total,
+            })?;
+
+    // Decoding runs in place, exactly as the loader does it: the stream is copied into a buffer
+    // sized for the result, then the packed region is consumed backwards while the output cursor
+    // walks down from the end. The two never cross, which is what lets the scheme work with no
+    // scratch buffer — and it is why the encoder reversed the region in the first place.
+    let mut out = vec![0u8; final_len];
+    out[..total].copy_from_slice(data);
+
+    let packed_start = total - enc_len;
+    let mut cmp = total - header_size;
+    let mut dst = final_len;
+
+    while cmp > packed_start {
+        cmp -= 1;
+        let mut flags = out[cmp];
+
+        for _ in 0..8 {
+            if cmp <= packed_start {
+                break;
+            }
+
+            if flags & FLAG_MASK_INIT == 0 {
+                cmp -= 1;
+                dst = copy_literal(&mut out, cmp, dst)?;
+            } else {
+                if cmp - packed_start < 2 {
+                    return Err(DecompressError::TruncatedCode { at: cmp });
+                }
+                let first = out[cmp - 1];
+                let second = out[cmp - 2];
+                cmp -= 2;
+
+                let length = usize::from(first >> 4) + MIN_MATCH;
+                let distance = ((usize::from(first & 0x0F) << 8) | usize::from(second)) + MIN_MATCH;
+                dst = copy_match(&mut out, dst, length, distance)?;
+            }
+
+            flags <<= FLAG_SHIFT;
+        }
+    }
+
+    if out.len() != decompressed_size {
+        return Err(DecompressError::UnexpectedLength {
+            expected: decompressed_size,
+            produced: out.len(),
+        });
+    }
+
+    Ok(out)
+}
+
+/// Copy one literal byte from the packed region to the output cursor.
+fn copy_literal(out: &mut [u8], cmp: usize, dst: usize) -> Result<usize, DecompressError> {
+    let dst = dst.checked_sub(1).ok_or(DecompressError::OutputUnderflow)?;
+    out[dst] = out[cmp];
+    Ok(dst)
+}
+
+/// Copy `length` bytes from `distance` ahead of the output cursor, one byte at a time.
+///
+/// Byte by byte rather than as a block: a match may overlap the region it writes into, which is how
+/// a run is encoded, and a block copy would read bytes this call has not produced yet.
+fn copy_match(
+    out: &mut [u8],
+    mut dst: usize,
+    length: usize,
+    distance: usize,
+) -> Result<usize, DecompressError> {
+    for _ in 0..length {
+        dst = dst.checked_sub(1).ok_or(DecompressError::OutputUnderflow)?;
+        let from = dst
+            .checked_add(distance)
+            .filter(|from| *from < out.len())
+            .ok_or(DecompressError::MatchOutOfBounds { dst, distance })?;
+        out[dst] = out[from];
+    }
+
+    Ok(dst)
+}
+
+/// The little-endian `u32` sitting `back` bytes from the end of `data`.
+fn trailing_u32(data: &[u8], back: usize) -> Option<u32> {
+    let start = data.len().checked_sub(back)?;
+    let bytes: [u8; 4] = data.get(start..start + 4)?.try_into().ok()?;
+    Some(u32::from_le_bytes(bytes))
+}
+
+/// Error returned by [`decompress`].
+#[derive(Debug, thiserror::Error)]
+pub enum DecompressError {
+    /// The buffer is too short to hold the trailer a stream ends with.
+    #[error("buffer too small: need {required} bytes, have {available}")]
+    BufferTooSmall {
+        /// Number of bytes required.
+        required: usize,
+        /// Number of bytes available.
+        available: usize,
+    },
+    /// The trailer's lengths do not describe a layout that fits the buffer.
+    ///
+    /// Holds the three quantities that disagree.
+    #[error(
+        "trailer claims {enc_len} encoded bytes under a {header_size}-byte header, in {available}"
+    )]
+    MalformedTrailer {
+        /// Length of the encoded region the trailer records.
+        enc_len: usize,
+        /// Size of the trailer and its padding, as recorded.
+        header_size: usize,
+        /// Number of bytes the stream actually holds.
+        available: usize,
+    },
+    /// A back-reference was cut short by the start of the packed region.
+    ///
+    /// Holds where in the stream the truncated code began.
+    #[error("a back-reference at {at} runs past the start of the packed region")]
+    TruncatedCode {
+        /// Offset the truncated code began at.
+        at: usize,
+    },
+    /// A code would write before the start of the output.
+    ///
+    /// The stream encodes more output than its trailer accounts for.
+    #[error("the stream decodes to more bytes than its trailer records")]
+    OutputUnderflow,
+    /// The stream does not hold the number of output bytes the caller asked for.
+    ///
+    /// Holds both lengths. For a KIP1 segment this means the header's `decomp_size` and the stream
+    /// disagree, so one of the two was rewritten without the other.
+    #[error("expected {expected} decompressed bytes, the stream holds {produced}")]
+    UnexpectedLength {
+        /// Length the caller asked for.
+        expected: usize,
+        /// Length the stream actually decodes to.
+        produced: usize,
+    },
+    /// A back-reference points past what has been decoded.
+    ///
+    /// Holds the write cursor and the distance that overshot it.
+    #[error("a back-reference at {dst} reaches {distance} bytes ahead, past the decoded output")]
+    MatchOutOfBounds {
+        /// Position being written.
+        dst: usize,
+        /// Distance the reference reached.
+        distance: usize,
+    },
+}
+
 #[cfg(test)]
 mod tests {
     use super::*;
@@ -501,6 +727,227 @@ mod tests {
         }
     }
 
+    /// Assert a stream round-trips: what `compress` produced must decode back to `data`.
+    ///
+    /// This is the whole contract between the two halves, so every corpus below asserts it rather
+    /// than inspecting the encoded bytes — those are an implementation detail, the round trip is not.
+    fn assert_round_trips(data: &[u8]) {
+        let compressed = compress(data);
+        let decompressed =
+            decompress(&compressed, data.len()).expect("a stream we produced should decode");
+        assert_eq!(
+            decompressed,
+            data,
+            "round trip diverged for a {}-byte input",
+            data.len()
+        );
+    }
+
+    #[test]
+    fn compress_with_a_short_run_stores_rather_than_packing() {
+        //* Given
+        // Twelve identical bytes pack into less than the trailer costs. Choosing the packed layout
+        // here once underflowed `extra_len`; the fallback is what keeps the layout expressible.
+        let data = vec![0x11u8; 12];
+
+        //* When
+        let compressed = compress(&data);
+
+        //* Then
+        let extra_len = u32::from_le_bytes(
+            compressed[compressed.len() - 4..]
+                .try_into()
+                .expect("a 4-byte tail converts into [u8; 4]"),
+        );
+        assert_eq!(extra_len, 0, "the stream should be marked stored");
+        assert_eq!(
+            decompress(&compressed, data.len()).expect("a stored stream should decode"),
+            data
+        );
+    }
+
+    #[test]
+    fn compress_never_writes_a_zero_extra_length_on_a_packed_stream() {
+        //* Given
+        // Zero is the stored marker, so a packed stream carrying it decodes as the wrong form.
+        // The lengths that saved exactly the trailer size used to produce one.
+        let corpus = pseudo_random_bytes(600, 0x51ED_5EED_C0FF_EE01);
+
+        //* When
+        let streams: Vec<Vec<u8>> = (0..600)
+            .flat_map(|len| [compress(&vec![0x22u8; len]), compress(&corpus[..len])])
+            .collect();
+
+        //* Then
+        for (index, stream) in streams.iter().enumerate() {
+            let extra_len = u32::from_le_bytes(
+                stream[stream.len() - 4..]
+                    .try_into()
+                    .expect("a 4-byte tail converts into [u8; 4]"),
+            );
+            let stored_len = stream.len() - 4;
+            assert!(
+                extra_len != 0 || stored_len >= index / 2,
+                "stream {index} claims stored but is too short to hold its input"
+            );
+        }
+    }
+
+    #[test]
+    fn decompress_with_empty_input_returns_empty() {
+        //* Given
+        let data: Vec<u8> = Vec::new();
+
+        //* When
+        let compressed = compress(&data);
+
+        //* Then
+        assert_eq!(
+            decompress(&compressed, data.len()).expect("an empty stream should decode"),
+            data
+        );
+    }
+
+    #[test]
+    fn decompress_with_incompressible_input_round_trips() {
+        //* Given
+        // Random bytes take the stored path, which is the branch a packed decoder never reaches.
+        let data = pseudo_random_bytes(4096, 0x2545_F491_4F6C_DD1D);
+
+        //* When
+        let compressed = compress(&data);
+
+        //* Then
+        assert_eq!(
+            decompress(&compressed, data.len()).expect("a stored stream should decode"),
+            data
+        );
+    }
+
+    #[test]
+    fn decompress_with_rle_input_round_trips() {
+        //* Given
+        // A single run is the densest possible packing: every code is a maximal back-reference.
+        let data = vec![0xAAu8; 8192];
+
+        //* When
+        let compressed = compress(&data);
+
+        //* Then
+        assert_eq!(
+            decompress(&compressed, data.len()).expect("a packed stream should decode"),
+            data
+        );
+    }
+
+    #[test]
+    fn decompress_with_structured_input_round_trips() {
+        //* Given
+        // Literals and matches interleaved, so flag bytes carry a mix of both kinds of code.
+        let mut data = Vec::new();
+        for index in 0..512u32 {
+            data.extend_from_slice(&index.to_le_bytes());
+            data.extend_from_slice(b"nx-object");
+        }
+
+        //* When
+        let compressed = compress(&data);
+
+        //* Then
+        assert_eq!(
+            decompress(&compressed, data.len()).expect("a packed stream should decode"),
+            data
+        );
+    }
+
+    #[test]
+    fn decompress_with_a_prefix_that_stays_raw_round_trips() {
+        //* Given
+        // Incompressible head, highly compressible tail: the encoder leaves a verbatim prefix, so
+        // the decoder must place the packed region after it rather than at offset zero.
+        let mut data = pseudo_random_bytes(2048, 0x9E37_79B9_7F4A_7C15);
+        data.extend_from_slice(&vec![0x5Cu8; 8192]);
+
+        //* When
+        let compressed = compress(&data);
+
+        //* Then
+        assert_eq!(
+            decompress(&compressed, data.len()).expect("a packed stream should decode"),
+            data
+        );
+    }
+
+    #[test]
+    fn decompress_with_lengths_from_one_to_a_thousand_round_trips() {
+        //* Given
+        // Sweeps the boundaries: empty, shorter than a match, and every alignment of the trailer
+        // padding and the eight-code flag group.
+        let corpus = pseudo_random_bytes(1000, 0x0DDB_1A5E_5BAD_5EED);
+
+        //* When
+        let lengths = 0..corpus.len();
+
+        //* Then
+        for len in lengths {
+            assert_round_trips(&corpus[..len]);
+            assert_round_trips(&vec![0x11u8; len]);
+        }
+    }
+
+    #[test]
+    fn decompress_with_a_truncated_buffer_fails() {
+        //* Given
+        // Too short to hold even the trailing length word.
+        let data = [0u8; 2];
+
+        //* When
+        let result = decompress(&data, 8);
+
+        //* Then
+        assert!(matches!(
+            result,
+            Err(DecompressError::BufferTooSmall { .. })
+        ));
+    }
+
+    #[test]
+    fn decompress_with_a_trailer_claiming_more_than_the_buffer_fails() {
+        //* Given
+        // A non-zero extra length marks the stream packed, and the encoded length overruns.
+        let mut data = vec![0u8; 16];
+        data[4..8].copy_from_slice(&u32::MAX.to_le_bytes());
+        data[8..12].copy_from_slice(&12u32.to_le_bytes());
+        data[12..16].copy_from_slice(&1u32.to_le_bytes());
+
+        //* When
+        let result = decompress(&data, 8);
+
+        //* Then
+        assert!(matches!(
+            result,
+            Err(DecompressError::MalformedTrailer { .. })
+        ));
+    }
+
+    #[test]
+    fn decompress_with_a_header_size_below_the_trailer_fails() {
+        //* Given
+        let mut data = vec![0u8; 16];
+        data[4..8].copy_from_slice(&16u32.to_le_bytes());
+        data[8..12].copy_from_slice(&4u32.to_le_bytes());
+        data[12..16].copy_from_slice(&1u32.to_le_bytes());
+
+        //* When
+        let result = decompress(&data, 8);
+
+        //* Then
+        assert!(matches!(
+            result,
+            Err(DecompressError::MalformedTrailer { .. })
+        ));
+    }
+
     #[test]
     fn longest_match_with_empty_input_matches_brute_force() {
         //* Given
diff --git a/src/lib.rs b/src/lib.rs
index d697ca0..ea2f6e0 100644
--- a/src/lib.rs
+++ b/src/lib.rs
@@ -45,21 +45,24 @@
 //! |--------|-----------------------------------------------|:-----:|:------:|:-------:|
 //! | NRO    | The executable the homebrew menu launches     |   ✓   |   ✓    |    ✓    |
 //! | NSO    | The executable format system modules use      |   ✓   |   ✓    |    ✓    |
-//! | KIP    | An initial process the kernel starts directly |   ✓   |        |    ✓    |
+//! | KIP    | An initial process the kernel starts directly |   ✓   |   ✓    |    ✓    |
 //! | NACP   | How a title is presented and what it may do   |   ✓   |   ✓    |    ✓    |
 //! | NPDM   | The permissions a program is granted          |   ✓   |   ✓    |    ✓    |
 //! | RomFS  | The read-only filesystem a title ships        |   ✓   |   ✓    |    ✓    |
 //! | PFS0   | The flat archive an NSP is built from         |   ✓   |   ✓    |    ✓    |
 //! | MOD0   | The runtime header embedded in an executable  |   ✓   |   ✓    |         |
 //! | NCA    | The container a title's contents ship in      |   ✓   |   ✓    |    ✓    |
-//! | CNMT   | The content meta naming every NCA of a title  |   ✓   |        |    ✓    |
+//! | CNMT   | The content meta naming every NCA of a title  |   ✓   |   ✓    |    ✓    |
 //!
 //! # What this crate does not do
 //!
 //! It does not sign, encrypt, or verify anything. An NPDM's ACID signature is stored and reproduced
 //! but never checked, and an NSO's segment hashes are computed on write yet left to the caller on
-//! read. It also does not decompress: an NSO segment comes back as stored, because a reader that
-//! borrows its buffer has nowhere to put the expanded bytes.
+//! read.
+//!
+//! It does decompress, but never behind an accessor: a reader borrows its buffer and has nowhere to
+//! put expanded bytes, so expanding is a separate call that allocates and can fail. `Kip1Segment`
+//! and `Nso` each offer one; a segment slice always comes back exactly as the file stores it.
 //!
 //! NCA is where that line is most visible, because an NCA on disk is encrypted throughout.
 //! [`write::NcaBuilder`] produces the plaintext container and every hash covering it, then names
diff --git a/src/raw/kip.rs b/src/raw/kip.rs
index 2ecc91b..f1178c7 100644
--- a/src/raw/kip.rs
+++ b/src/raw/kip.rs
@@ -20,7 +20,15 @@ pub const KIP1_MAGIC: u32 = 0x3150494b;
 /// When the segment's compression bit in [`Kip1Header::flags`] is clear, the two are equal.
 ///
 /// See <https://switchbrew.org/wiki/KIP1#Segment_Header>.
-#[derive(Debug, Clone, Copy, zerocopy::FromZeros, zerocopy::IntoBytes, zerocopy::Immutable)]
+#[derive(
+    Debug,
+    Clone,
+    Copy,
+    zerocopy::FromBytes,
+    zerocopy::IntoBytes,
+    zerocopy::KnownLayout,
+    zerocopy::Immutable,
+)]
 #[repr(C)]
 pub struct Kip1Segment {
     /// Address the segment is loaded at, relative to the process image base.
@@ -47,7 +55,15 @@ const_assert_eq!(align_of::<Kip1Segment>(), 0x1);
 /// filesystem exists, so the header carries what a loader would otherwise read from an NPDM.
 ///
 /// See <https://switchbrew.org/wiki/KIP1#KIP1>.
-#[derive(Debug, Clone, Copy, zerocopy::FromZeros, zerocopy::IntoBytes, zerocopy::Immutable)]
+#[derive(
+    Debug,
+    Clone,
+    Copy,
+    zerocopy::FromBytes,
+    zerocopy::IntoBytes,
+    zerocopy::KnownLayout,
+    zerocopy::Immutable,
+)]
 #[repr(C)]
 pub struct Kip1Header {
     /// Always [`KIP1_MAGIC`]; anything else means this is not a KIP1.
diff --git a/src/read.rs b/src/read.rs
index 349ba53..ccd906c 100644
--- a/src/read.rs
+++ b/src/read.rs
@@ -11,12 +11,20 @@
 //! at all: those readers check lengths and layout, so success means the buffer is shaped like the
 //! format, never that it is one.
 //!
-//! Nothing here decompresses, decrypts, or verifies a hash. An NSO segment comes back as stored,
-//! and checking it against the header's digest is the caller's, because a borrowing reader has
-//! nowhere to put the expanded bytes. The same line puts NCA decryption outside: [`nca::Nca`] takes
-//! a buffer the caller has already decrypted, and an image still in ciphertext fails its magic
-//! check rather than parsing into nonsense.
+//! No accessor here decrypts or verifies a hash. An NSO segment comes back as stored and checking
+//! it against the header's digest is the caller's, because a borrowing reader has nowhere to put
+//! the expanded bytes. The same line puts NCA decryption outside: [`nca::Nca`] takes a buffer the
+//! caller has already decrypted, and an image still in ciphertext fails its magic check rather than
+//! parsing into nonsense.
+//!
+//! Decompression sits just on the other side of that line, and is offered as an explicit step
+//! rather than folded into an accessor: [`kip::Kip1Segment::decompress`] allocates and can fail,
+//! which is exactly why it is a call a reader makes on purpose and not a slice it is handed.
 
+#[cfg(feature = "cnmt")]
+pub mod cnmt;
+#[cfg(all(feature = "alloc", feature = "kip"))]
+pub mod kip;
 #[cfg(feature = "mod0")]
 pub mod mod0;
 #[cfg(feature = "nacp")]
diff --git a/src/read/cnmt.rs b/src/read/cnmt.rs
new file mode 100644
index 0000000..21cbd41
--- /dev/null
+++ b/src/read/cnmt.rs
@@ -0,0 +1,339 @@
+//! Validated reader over a CNMT and the content records it lists.
+//!
+//! [`Cnmt::try_from_bytes`] proves the extended header and every record lie inside the buffer before
+//! borrowing it, so the accessors return slices without re-checking.
+//!
+//! A CNMT has no magic. Success here means the buffer is shaped like one — its declared counts fit
+//! its length — never that it is one, which is the same caveat NACP and RomFS carry.
+//!
+//! The records name every content of the title *except* the meta itself: the archive carrying this
+//! CNMT is found by whatever referenced it, so listing itself would be circular. A caller checking
+//! an NSP against its meta therefore expects one more file in the package than there are records.
+
+use zerocopy::FromBytes as _;
+
+use crate::raw::cnmt::{
+    CnmtApplicationExtendedHeader, CnmtContentMetaType, CnmtContentRecord, CnmtContentType,
+    CnmtHeader,
+};
+
+/// A borrowed view of a CNMT whose records have already been bounds-checked.
+pub struct Cnmt<'a> {
+    header: &'a CnmtHeader,
+    extended_header: Option<&'a CnmtApplicationExtendedHeader>,
+    records: &'a [CnmtContentRecord],
+}
+
+impl<'a> Cnmt<'a> {
+    /// Validate `bytes` as a CNMT and borrow it, proving every record lies inside the buffer.
+    ///
+    /// # Errors
+    ///
+    /// Returns an error if the buffer cannot hold the header, the extended header the header
+    /// declares, or the records it counts.
+    pub fn try_from_bytes(bytes: &'a [u8]) -> Result<Self, FromBytesError> {
+        let (header, rest) =
+            CnmtHeader::ref_from_prefix(bytes).map_err(|_| FromBytesError::BufferTooSmall {
+                required: size_of::<CnmtHeader>(),
+                available: bytes.len(),
+            })?;
+
+        let extended_header_size = header.extended_header_size.get() as usize;
+        let rest =
+            rest.get(extended_header_size..)
+                .ok_or(FromBytesError::ExtendedHeaderOutOfBounds {
+                    extended_header_size,
+                    available: rest.len(),
+                })?;
+
+        // Read only when the declared size matches the application shape. A meta type this crate
+        // does not model still parses — its records are what a caller came for — but its extended
+        // header is left unread rather than reinterpreted as the wrong structure.
+        let extended_header = if extended_header_size == size_of::<CnmtApplicationExtendedHeader>()
+            && header.meta_type == CnmtContentMetaType::Application as u8
+        {
+            CnmtApplicationExtendedHeader::ref_from_prefix(&bytes[size_of::<CnmtHeader>()..])
+                .ok()
+                .map(|(extended, _)| extended)
+        } else {
+            None
+        };
+
+        let count = header.content_entry_count.get() as usize;
+        let (records, _) =
+            <[CnmtContentRecord]>::ref_from_prefix_with_elems(rest, count).map_err(|_| {
+                FromBytesError::RecordsOutOfBounds {
+                    content_entry_count: count,
+                    available: rest.len(),
+                }
+            })?;
+
+        Ok(Self {
+            header,
+            extended_header,
+            records,
+        })
+    }
+
+    /// The header naming the title and counting what follows it.
+    pub fn header(&self) -> &'a CnmtHeader {
+        self.header
+    }
+
+    /// The application extended header, or `None` for a meta type this crate does not model.
+    pub fn extended_header(&self) -> Option<&'a CnmtApplicationExtendedHeader> {
+        self.extended_header
+    }
+
+    /// The title the described contents belong to.
+    pub fn title_id(&self) -> u64 {
+        self.header.title_id.get()
+    }
+
+    /// The version of the title; zero for a first release.
+    pub fn title_version(&self) -> u32 {
+        self.header.title_version.get()
+    }
+
+    /// What kind of title this content meta describes.
+    pub fn meta_type(&self) -> Option<CnmtContentMetaType> {
+        meta_type(self.header.meta_type)
+    }
+
+    /// Every content record, in the order the file lists them.
+    pub fn records(&self) -> impl Iterator<Item = ContentRecord<'a>> + '_ {
+        self.records.iter().map(|record| ContentRecord { record })
+    }
+
+    /// Number of content records the file holds.
+    pub fn record_count(&self) -> usize {
+        self.records.len()
+    }
+}
+
+/// One content of the title: which NCA it is, how large, and what it holds.
+pub struct ContentRecord<'a> {
+    record: &'a CnmtContentRecord,
+}
+
+impl<'a> ContentRecord<'a> {
+    /// The raw record, for a caller that needs a field this view does not surface.
+    pub fn raw(&self) -> &'a CnmtContentRecord {
+        self.record
+    }
+
+    /// SHA-256 of the whole NCA file.
+    pub fn hash(&self) -> &'a [u8; 0x20] {
+        &self.record.hash
+    }
+
+    /// The NCA's name on disk, which is the first sixteen bytes of its hash.
+    pub fn nca_id(&self) -> &'a [u8; 0x10] {
+        &self.record.nca_id
+    }
+
+    /// Length of the NCA in bytes.
+    ///
+    /// Stored across six bytes rather than eight, so the value cannot exceed `0xFFFFFFFFFFFF`.
+    pub fn size(&self) -> u64 {
+        let mut bytes = [0u8; 8];
+        bytes[..0x6].copy_from_slice(&self.record.size);
+        u64::from_le_bytes(bytes)
+    }
+
+    /// What the content holds.
+    pub fn content_type(&self) -> Option<CnmtContentType> {
+        content_type(self.record.content_type)
+    }
+}
+
+/// The meta type `value` names, or `None` for one this crate does not model.
+fn meta_type(value: u8) -> Option<CnmtContentMetaType> {
+    match value {
+        value if value == CnmtContentMetaType::Application as u8 => {
+            Some(CnmtContentMetaType::Application)
+        }
+        value if value == CnmtContentMetaType::Patch as u8 => Some(CnmtContentMetaType::Patch),
+        value if value == CnmtContentMetaType::AddOnContent as u8 => {
+            Some(CnmtContentMetaType::AddOnContent)
+        }
+        _ => None,
+    }
+}
+
+/// The content type `value` names, or `None` for one this crate does not model.
+fn content_type(value: u8) -> Option<CnmtContentType> {
+    match value {
+        value if value == CnmtContentType::Meta as u8 => Some(CnmtContentType::Meta),
+        value if value == CnmtContentType::Program as u8 => Some(CnmtContentType::Program),
+        value if value == CnmtContentType::Data as u8 => Some(CnmtContentType::Data),
+        value if value == CnmtContentType::Control as u8 => Some(CnmtContentType::Control),
+        value if value == CnmtContentType::HtmlDocument as u8 => {
+            Some(CnmtContentType::HtmlDocument)
+        }
+        value if value == CnmtContentType::LegalInformation as u8 => {
+            Some(CnmtContentType::LegalInformation)
+        }
+        value if value == CnmtContentType::DeltaFragment as u8 => {
+            Some(CnmtContentType::DeltaFragment)
+        }
+        _ => None,
+    }
+}
+
+/// Errors that can occur when parsing a CNMT from bytes
+#[derive(Debug, thiserror::Error)]
+pub enum FromBytesError {
+    /// Buffer is too small to contain the content meta header
+    #[error("buffer too small: need {required} bytes, have {available}")]
+    BufferTooSmall {
+        /// Number of bytes required
+        required: usize,
+        /// Number of bytes available
+        available: usize,
+    },
+    /// The extended header the header declares does not fit in the buffer
+    #[error("an extended header of {extended_header_size} bytes does not fit in {available}")]
+    ExtendedHeaderOutOfBounds {
+        /// Length the header declares for the extended header
+        extended_header_size: usize,
+        /// Number of bytes left after the header
+        available: usize,
+    },
+    /// The records the header counts do not fit in the buffer
+    #[error("{content_entry_count} content records do not fit in {available} bytes")]
+    RecordsOutOfBounds {
+        /// Number of records the header counts
+        content_entry_count: usize,
+        /// Number of bytes left after the extended header
+        available: usize,
+    },
+}
+
+#[cfg(all(test, feature = "alloc"))]
+mod tests {
+    use alloc::vec::Vec;
+
+    use super::{Cnmt, FromBytesError};
+    use crate::{
+        raw::cnmt::{CnmtContentMetaType, CnmtContentType},
+        write::{CnmtBuilder, cnmt::ContentRecord},
+    };
+
+    /// A CNMT naming a program and a control, built the way the packer builds one.
+    fn cnmt() -> Vec<u8> {
+        CnmtBuilder::new(0x0100_0000_0000_1000)
+            .add_content(ContentRecord {
+                hash: [0xAB; 0x20],
+                size: 0x1234,
+                content_type: CnmtContentType::Program,
+            })
+            .expect("adding a program record should succeed")
+            .add_content(ContentRecord {
+                hash: [0xCD; 0x20],
+                size: 0x5678,
+                content_type: CnmtContentType::Control,
+            })
+            .expect("adding a control record should succeed")
+            .build()
+    }
+
+    #[test]
+    fn try_from_bytes_with_a_built_meta_succeeds() {
+        //* Given
+        let meta = cnmt();
+
+        //* When
+        let cnmt = Cnmt::try_from_bytes(&meta).expect("a built meta should parse");
+
+        //* Then
+        assert_eq!(cnmt.title_id(), 0x0100_0000_0000_1000);
+        assert_eq!(cnmt.record_count(), 2);
+        assert_eq!(cnmt.meta_type(), Some(CnmtContentMetaType::Application));
+    }
+
+    #[test]
+    fn records_with_a_built_meta_returns_what_was_added() {
+        //* Given
+        let meta = cnmt();
+        let cnmt = Cnmt::try_from_bytes(&meta).expect("a built meta should parse");
+
+        //* When
+        let records: Vec<(u64, Option<CnmtContentType>)> = cnmt
+            .records()
+            .map(|record| (record.size(), record.content_type()))
+            .collect();
+
+        //* Then
+        assert_eq!(
+            records,
+            [
+                (0x1234, Some(CnmtContentType::Program)),
+                (0x5678, Some(CnmtContentType::Control)),
+            ]
+        );
+    }
+
+    #[test]
+    fn nca_id_with_a_built_meta_is_the_head_of_the_hash() {
+        //* Given
+        // The console looks a content up by this name, so the two fields agreeing is the whole
+        // reason a record can be resolved to a file at all.
+        let meta = cnmt();
+        let cnmt = Cnmt::try_from_bytes(&meta).expect("a built meta should parse");
+
+        //* When
+        let record = cnmt.records().next().expect("the meta holds two records");
+
+        //* Then
+        assert_eq!(record.nca_id(), &record.hash()[..0x10]);
+    }
+
+    #[test]
+    fn extended_header_with_an_application_meta_derives_the_patch_title_id() {
+        //* Given
+        let meta = cnmt();
+        let cnmt = Cnmt::try_from_bytes(&meta).expect("a built meta should parse");
+
+        //* When
+        let extended = cnmt.extended_header();
+
+        //* Then
+        assert_eq!(
+            extended
+                .expect("an application meta carries one")
+                .patch_title_id
+                .get(),
+            0x0100_0000_0000_1800
+        );
+    }
+
+    #[test]
+    fn try_from_bytes_with_a_truncated_buffer_fails() {
+        //* Given
+        let meta = cnmt();
+        let truncated = &meta[..0x10];
+
+        //* When
+        let result = Cnmt::try_from_bytes(truncated);
+
+        //* Then
+        assert!(matches!(result, Err(FromBytesError::BufferTooSmall { .. })));
+    }
+
+    #[test]
+    fn try_from_bytes_with_more_records_than_the_buffer_holds_fails() {
+        //* Given
+        let mut meta = cnmt();
+        meta[0x10..0x12].copy_from_slice(&0xFFFFu16.to_le_bytes());
+
+        //* When
+        let result = Cnmt::try_from_bytes(&meta);
+
+        //* Then
+        assert!(matches!(
+            result,
+            Err(FromBytesError::RecordsOutOfBounds { .. })
+        ));
+    }
+}
diff --git a/src/read/kip.rs b/src/read/kip.rs
new file mode 100644
index 0000000..50ea2d3
--- /dev/null
+++ b/src/read/kip.rs
@@ -0,0 +1,404 @@
+//! Validated reader over a KIP1 image and the segments it carries.
+//!
+//! [`Kip1::try_from_bytes`] checks the magic and proves every segment's stored bytes lie inside the
+//! buffer before borrowing it, so the segment accessors return slices without re-checking.
+//!
+//! Segments come back **as stored**, which for a KIP1 usually means BLZ-compressed: the header's
+//! flags say which of the first three are, and [`Kip1Segment::decompress`] is the one accessor that
+//! allocates. That split is the same one the rest of the crate draws — a borrowing reader has
+//! nowhere to put expanded bytes, so expanding is an explicit, fallible step.
+//!
+//! `bss` is the exception among the four: it occupies no bytes in the file at all, so it has a
+//! destination and a length but nothing to read. It is reported with an empty slice rather than
+//! omitted, because the loader still has to reserve room for it.
+
+use alloc::vec::Vec;
+
+use zerocopy::FromBytes as _;
+
+use crate::{
+    blz,
+    raw::kip::{KIP1_MAGIC, Kip1Header, Kip1Segment as RawKip1Segment},
+};
+
+/// Number of segments a KIP1 actually loads: `text`, `rodata`, `data`, and `bss`.
+const LOADED_SEGMENT_COUNT: usize = 4;
+
+/// Index of the `bss` segment, which is the one with no bytes in the file.
+const BSS_INDEX: usize = 3;
+
+/// A borrowed view of a KIP1 image whose every segment has already been bounds-checked.
+///
+/// Construction is where every check happens, so a `Kip1` that exists is one whose stored segments
+/// lie inside the buffer.
+pub struct Kip1<'a> {
+    header: &'a Kip1Header,
+    bytes: &'a [u8],
+}
+
+impl<'a> Kip1<'a> {
+    /// Validate `bytes` as a KIP1 and borrow it, proving every stored segment lies inside it.
+    ///
+    /// # Errors
+    ///
+    /// Returns an error if the buffer cannot hold the `0x100`-byte header, if the magic does not
+    /// match, or if a segment's stored bytes overflow or run past the end of the buffer.
+    pub fn try_from_bytes(bytes: &'a [u8]) -> Result<Self, FromBytesError> {
+        let header = Kip1Header::ref_from_prefix(bytes)
+            .map_err(|_| FromBytesError::BufferTooSmall {
+                required: size_of::<Kip1Header>(),
+                available: bytes.len(),
+            })?
+            .0;
+
+        if header.magic.get() != KIP1_MAGIC {
+            return Err(FromBytesError::InvalidMagic {
+                found: header.magic.get(),
+            });
+        }
+
+        // Segments are stored back to back after the header, in descriptor order, so each one's
+        // offset is the sum of the stored lengths before it.
+        let mut offset = size_of::<Kip1Header>();
+        for index in 0..LOADED_SEGMENT_COUNT {
+            let stored = stored_size(header, index);
+            let end = offset
+                .checked_add(stored)
+                .ok_or(FromBytesError::SegmentBoundsOverflow {
+                    segment_index: index,
+                    offset,
+                    size: stored,
+                })?;
+
+            if end > bytes.len() {
+                return Err(FromBytesError::SegmentOutOfBounds {
+                    segment_index: index,
+                    offset,
+                    size: stored,
+                    available: bytes.len(),
+                });
+            }
+
+            offset = end;
+        }
+
+        Ok(Self { header, bytes })
+    }
+
+    /// The header describing the process, its segments, and its capabilities.
+    pub fn header(&self) -> &Kip1Header {
+        self.header
+    }
+
+    /// The process name, with the padding the header stores it under trimmed.
+    ///
+    /// A name that is not valid UTF-8 reads as empty rather than failing, which matches how the
+    /// other readers in this crate treat a malformed name.
+    pub fn name(&self) -> &'a str {
+        let name = &self.header.name;
+        let end = name
+            .iter()
+            .position(|byte| *byte == 0)
+            .unwrap_or(name.len());
+        core::str::from_utf8(&name[..end]).unwrap_or("")
+    }
+
+    /// The title the process runs under.
+    pub fn title_id(&self) -> u64 {
+        self.header.title_id.get()
+    }
+
+    /// The segment at `index`, or `None` for one of the two descriptors a KIP1 leaves unused.
+    pub fn segment(&self, index: usize) -> Option<Kip1Segment<'a>> {
+        if index >= LOADED_SEGMENT_COUNT {
+            return None;
+        }
+
+        // Every bound below was proven by `try_from_bytes`.
+        let mut offset = size_of::<Kip1Header>();
+        for before in 0..index {
+            offset += stored_size(self.header, before);
+        }
+        let stored = stored_size(self.header, index);
+
+        Some(Kip1Segment {
+            index,
+            descriptor: &self.header.segments[index],
+            compressed: is_compressed(self.header, index),
+            stored: &self.bytes[offset..offset + stored],
+        })
+    }
+
+    /// The four segments a KIP1 loads, in descriptor order.
+    pub fn segments(&self) -> impl Iterator<Item = Kip1Segment<'a>> + '_ {
+        (0..LOADED_SEGMENT_COUNT).filter_map(|index| self.segment(index))
+    }
+}
+
+/// One segment: where it lands, how it is stored, and whether it is packed.
+pub struct Kip1Segment<'a> {
+    index: usize,
+    descriptor: &'a RawKip1Segment,
+    compressed: bool,
+    stored: &'a [u8],
+}
+
+impl<'a> Kip1Segment<'a> {
+    /// Which of the four loaded segments this is: `0` text, `1` rodata, `2` data, `3` bss.
+    pub fn index(&self) -> usize {
+        self.index
+    }
+
+    /// The descriptor recording where the segment lands and how large it is.
+    pub fn descriptor(&self) -> &'a RawKip1Segment {
+        self.descriptor
+    }
+
+    /// Address the segment is loaded at, relative to the process image base.
+    pub fn address(&self) -> u32 {
+        self.descriptor.dst_addr.get()
+    }
+
+    /// Length of the segment once expanded, which for `bss` is the room to reserve.
+    pub fn decompressed_size(&self) -> usize {
+        self.descriptor.decomp_size.get() as usize
+    }
+
+    /// Whether the stored bytes are BLZ-packed.
+    ///
+    /// Only the first three segments can be: `bss` has no bytes to pack.
+    pub fn is_compressed(&self) -> bool {
+        self.compressed
+    }
+
+    /// The segment exactly as the file stores it, packed or not.
+    ///
+    /// Empty for `bss`, which occupies no bytes in the file.
+    pub fn stored(&self) -> &'a [u8] {
+        self.stored
+    }
+
+    /// The segment's bytes, expanded if the header marks it packed.
+    ///
+    /// A segment that is not packed is copied out unchanged, so a caller that wants the loadable
+    /// bytes does not have to branch on [`Kip1Segment::is_compressed`] first.
+    ///
+    /// # Errors
+    ///
+    /// Returns an error if the BLZ stream is malformed, or if it does not expand to the length the
+    /// descriptor records — which means the header and the segment disagree.
+    pub fn decompress(&self) -> Result<Vec<u8>, DecompressError> {
+        if !self.compressed {
+            return Ok(self.stored.to_vec());
+        }
+
+        blz::decompress(self.stored, self.decompressed_size()).map_err(|err| DecompressError {
+            segment_index: self.index,
+            source: err,
+        })
+    }
+}
+
+/// Error returned by [`Kip1Segment::decompress`].
+///
+/// Names the segment, because a KIP1 carries three packed ones and the stream alone does not say
+/// which failed.
+#[derive(Debug, thiserror::Error)]
+#[error("failed to decompress segment {segment_index}")]
+pub struct DecompressError {
+    /// Which of the four loaded segments failed.
+    pub segment_index: usize,
+    /// Why the stream was rejected.
+    #[source]
+    pub source: blz::DecompressError,
+}
+
+/// Bytes segment `index` occupies in the file.
+///
+/// `bss` records a decompressed size but stores nothing, and the builder writes its `comp_size` as
+/// zero to say so; every other segment stores exactly `comp_size` bytes.
+fn stored_size(header: &Kip1Header, index: usize) -> usize {
+    if index == BSS_INDEX {
+        return 0;
+    }
+
+    header.segments[index].comp_size.get() as usize
+}
+
+/// Whether segment `index` is marked BLZ-packed by the header's flags.
+///
+/// Only bits `0`, `1`, and `2` are compression bits, so `bss` is never packed whatever bit `3`
+/// holds — that bit selects a 64-bit process.
+fn is_compressed(header: &Kip1Header, index: usize) -> bool {
+    if index >= BSS_INDEX {
+        return false;
+    }
+
+    header.flags & (1 << index) != 0
+}
+
+/// Errors that can occur when parsing a KIP1 from bytes
+#[derive(Debug, thiserror::Error)]
+pub enum FromBytesError {
+    /// Buffer is too small to contain the KIP1 header
+    #[error("buffer too small: need {required} bytes, have {available}")]
+    BufferTooSmall {
+        /// Number of bytes required
+        required: usize,
+        /// Number of bytes available
+        available: usize,
+    },
+    /// Magic number does not match KIP1 (0x3150494b)
+    #[error("invalid KIP1 magic: found {found:#010x}")]
+    InvalidMagic {
+        /// The magic that was found in place of `KIP1`
+        found: u32,
+    },
+    /// A segment's offset and stored size overflow when added
+    #[error("segment {segment_index} at {offset} of size {size} overflows")]
+    SegmentBoundsOverflow {
+        /// Index of the segment in the header
+        segment_index: usize,
+        /// Offset the segment starts at
+        offset: usize,
+        /// Bytes the segment occupies in the file
+        size: usize,
+    },
+    /// A segment extends past the end of the image
+    #[error(
+        "segment {segment_index} at {offset} of size {size} runs past the {available} available"
+    )]
+    SegmentOutOfBounds {
+        /// Index of the segment in the header
+        segment_index: usize,
+        /// Offset the segment starts at
+        offset: usize,
+        /// Bytes the segment occupies in the file
+        size: usize,
+        /// Number of bytes the image holds
+        available: usize,
+    },
+}
+
+#[cfg(test)]
+mod tests {
+    use alloc::{vec, vec::Vec};
+
+    use super::{FromBytesError, Kip1};
+    use crate::write::Kip1Builder;
+
+    /// Build a KIP1 carrying the three segments, each holding a distinctive run.
+    fn kip1(text: Vec<u8>, rodata: Vec<u8>, data: Vec<u8>) -> Vec<u8> {
+        Kip1Builder::new()
+            .name("roundtrip")
+            .title_id(0x0100_0000_0000_1000)
+            .text(text)
+            .rodata(rodata)
+            .data(data)
+            .build()
+            .expect("a small image should build")
+    }
+
+    #[test]
+    fn try_from_bytes_with_a_built_image_succeeds() {
+        //* Given
+        let image = kip1(vec![0xAA; 0x400], vec![0xBB; 0x200], vec![0xCC; 0x100]);
+
+        //* When
+        let kip = Kip1::try_from_bytes(&image).expect("a built image should parse");
+
+        //* Then
+        assert_eq!(kip.name(), "roundtrip");
+        assert_eq!(kip.title_id(), 0x0100_0000_0000_1000);
+    }
+
+    #[test]
+    fn try_from_bytes_with_wrong_magic_fails() {
+        //* Given
+        let mut image = kip1(vec![0xAA; 0x100], vec![0xBB; 0x100], vec![0xCC; 0x100]);
+        image[0] = b'X';
+
+        //* When
+        let result = Kip1::try_from_bytes(&image);
+
+        //* Then
+        assert!(matches!(result, Err(FromBytesError::InvalidMagic { .. })));
+    }
+
+    #[test]
+    fn try_from_bytes_with_a_truncated_image_fails() {
+        //* Given
+        let image = kip1(vec![0xAA; 0x400], vec![0xBB; 0x200], vec![0xCC; 0x100]);
+        let truncated = &image[..0x180];
+
+        //* When
+        let result = Kip1::try_from_bytes(truncated);
+
+        //* Then
+        assert!(matches!(
+            result,
+            Err(FromBytesError::SegmentOutOfBounds { .. })
+        ));
+    }
+
+    #[test]
+    fn decompress_with_a_built_image_returns_the_segments_that_were_packed() {
+        //* Given
+        // The whole point of the reader: what the builder compressed must come back unchanged.
+        let text = vec![0xAA; 0x400];
+        let rodata = vec![0xBB; 0x200];
+        let data = vec![0xCC; 0x100];
+        let image = kip1(text.clone(), rodata.clone(), data.clone());
+        let kip = Kip1::try_from_bytes(&image).expect("a built image should parse");
+
+        //* When
+        let segments: Vec<Vec<u8>> = kip
+            .segments()
+            .map(|segment| segment.decompress().expect("a built segment should expand"))
+            .collect();
+
+        //* Then
+        assert_eq!(segments, vec![text, rodata, data, Vec::new()]);
+    }
+
+    #[test]
+    fn segment_with_the_bss_index_stores_no_bytes() {
+        //* Given
+        let image = kip1(vec![0xAA; 0x100], vec![0xBB; 0x100], vec![0xCC; 0x100]);
+        let kip = Kip1::try_from_bytes(&image).expect("a built image should parse");
+
+        //* When
+        let bss = kip.segment(3).expect("index 3 is the bss segment");
+
+        //* Then
+        assert!(bss.stored().is_empty(), "bss occupies no bytes in the file");
+        assert!(!bss.is_compressed(), "bss has nothing to compress");
+    }
+
+    #[test]
+    fn segment_with_an_index_past_the_loaded_segments_returns_none() {
+        //* Given
+        let image = kip1(vec![0xAA; 0x100], vec![0xBB; 0x100], vec![0xCC; 0x100]);
+        let kip = Kip1::try_from_bytes(&image).expect("a built image should parse");
+
+        //* When
+        let segment = kip.segment(4);
+
+        //* Then
+        assert!(segment.is_none());
+    }
+
+    #[test]
+    fn is_compressed_with_a_built_image_marks_the_first_three_segments() {
+        //* Given
+        // The builder packs text, rodata, and data, and leaves bss alone.
+        let image = kip1(vec![0xAA; 0x400], vec![0xBB; 0x200], vec![0xCC; 0x100]);
+        let kip = Kip1::try_from_bytes(&image).expect("a built image should parse");
+
+        //* When
+        let flags: Vec<bool> = kip.segments().map(|s| s.is_compressed()).collect();
+
+        //* Then
+        assert_eq!(flags, vec![true, true, true, false]);
+    }
+}
diff --git a/src/read/nso.rs b/src/read/nso.rs
index 96e6a12..4d75580 100644
--- a/src/read/nso.rs
+++ b/src/read/nso.rs
@@ -168,6 +168,116 @@ impl<'a> Nso<'a> {
         let size = self.header.data_file_size.get() as usize;
         &self.bytes[off..off + size]
     }
+
+    /// The `text` segment's bytes, expanded when the header marks it compressed.
+    ///
+    /// The result is the segment as the loader maps it, which includes the zero padding that
+    /// rounds it up to a page: the header's size and its hash both cover that padding, so trimming
+    /// it here would return bytes the recorded digest does not describe.
+    ///
+    /// # Errors
+    ///
+    /// Returns an error if the LZ4 stream is malformed or does not expand to the length the
+    /// segment header records.
+    #[cfg(feature = "lz4-compression")]
+    pub fn text(&self) -> Result<alloc::vec::Vec<u8>, DecompressError> {
+        self.decompress(
+            Segment::Text,
+            self.text_compressed(),
+            self.header.text.size.get() as usize,
+            NsoFlags::TEXT_COMPRESS,
+        )
+    }
+
+    /// The `rodata` segment's bytes, expanded when the header marks it compressed.
+    ///
+    /// # Errors
+    ///
+    /// Fails on the same conditions as [`Nso::text`].
+    #[cfg(feature = "lz4-compression")]
+    pub fn rodata(&self) -> Result<alloc::vec::Vec<u8>, DecompressError> {
+        self.decompress(
+            Segment::RoData,
+            self.rodata_compressed(),
+            self.header.rodata.size.get() as usize,
+            NsoFlags::RODATA_COMPRESS,
+        )
+    }
+
+    /// The `data` segment's bytes, expanded when the header marks it compressed.
+    ///
+    /// # Errors
+    ///
+    /// Fails on the same conditions as [`Nso::text`].
+    #[cfg(feature = "lz4-compression")]
+    pub fn data(&self) -> Result<alloc::vec::Vec<u8>, DecompressError> {
+        self.decompress(
+            Segment::Data,
+            self.data_compressed(),
+            self.header.data.size.get() as usize,
+            NsoFlags::DATA_COMPRESS,
+        )
+    }
+
+    /// Expand `stored` when `flag` is set, or copy it out unchanged when it is not.
+    ///
+    /// The expanded length comes from the segment header rather than the stream: an NSO stores LZ4
+    /// blocks, which do not carry their own decompressed size.
+    #[cfg(feature = "lz4-compression")]
+    fn decompress(
+        &self,
+        segment: Segment,
+        stored: &[u8],
+        decompressed_size: usize,
+        flag: NsoFlags,
+    ) -> Result<alloc::vec::Vec<u8>, DecompressError> {
+        if !self.flags().contains(flag) {
+            return Ok(stored.to_vec());
+        }
+
+        lz4_flex::decompress(stored, decompressed_size).map_err(|err| DecompressError {
+            segment,
+            source: err,
+        })
+    }
+}
+
+/// Which segment of an NSO a failure belongs to.
+#[cfg(feature = "lz4-compression")]
+#[derive(Debug, Clone, Copy, PartialEq, Eq)]
+pub enum Segment {
+    /// The executable code.
+    Text,
+    /// The constants and dynamic linking tables.
+    RoData,
+    /// The writable initialized data.
+    Data,
+}
+
+#[cfg(feature = "lz4-compression")]
+impl core::fmt::Display for Segment {
+    /// Renders as the segment's name as the format spells it, so `RoData` prints as `rodata`.
+    fn fmt(&self, f: &mut core::fmt::Formatter<'_>) -> core::fmt::Result {
+        match self {
+            Self::Text => write!(f, "text"),
+            Self::RoData => write!(f, "rodata"),
+            Self::Data => write!(f, "data"),
+        }
+    }
+}
+
+/// Error returned by [`Nso::text`], [`Nso::rodata`], and [`Nso::data`].
+///
+/// Names the segment, because an NSO carries three and the stream alone does not say which failed.
+#[cfg(feature = "lz4-compression")]
+#[derive(Debug, thiserror::Error)]
+#[error("failed to decompress the {segment} segment")]
+pub struct DecompressError {
+    /// Which segment failed.
+    pub segment: Segment,
+    /// Why the stream was rejected.
+    #[source]
+    pub source: lz4_flex::block::DecompressError,
 }
 
 /// Errors that can occur when parsing an NSO from bytes
@@ -215,3 +325,114 @@ pub enum FromBytesError {
 #[derive(Debug, thiserror::Error)]
 #[error(transparent)]
 pub struct FromPtrError(FromBytesError);
+
+#[cfg(all(test, feature = "lz4-compression"))]
+mod decompress_tests {
+    use alloc::{vec, vec::Vec};
+
+    use super::Nso;
+    use crate::write::NsoBuilder;
+
+    /// Page size the builder rounds every segment up to before hashing and compressing it.
+    const PAGE: usize = 0x1000;
+
+    /// `data` followed by the zero padding that rounds it up to a whole page.
+    fn padded(data: &[u8]) -> Vec<u8> {
+        let mut padded = data.to_vec();
+        padded.resize(data.len().div_ceil(PAGE) * PAGE, 0);
+        padded
+    }
+
+    /// Build an NSO carrying the three segments, compressed or not as `compressed` says.
+    fn nso(text: Vec<u8>, rodata: Vec<u8>, data: Vec<u8>, compressed: bool) -> Vec<u8> {
+        NsoBuilder::new()
+            .text(text)
+            .rodata(rodata)
+            .data(data)
+            .compressed(compressed)
+            .build()
+            .expect("a small image should build")
+    }
+
+    #[test]
+    fn text_with_a_compressed_image_returns_the_segment_that_was_packed() {
+        //* Given
+        let text = vec![0xAA; 0x1000];
+        let image = nso(text.clone(), vec![0xBB; 0x800], vec![0xCC; 0x400], true);
+        let parsed = Nso::try_from_bytes(&image).expect("a built image should parse");
+
+        //* When
+        let segment = parsed.text().expect("a built segment should expand");
+
+        //* Then
+        assert_eq!(segment, padded(&text));
+    }
+
+    #[test]
+    fn rodata_with_a_compressed_image_returns_the_segment_that_was_packed() {
+        //* Given
+        let rodata = vec![0xBB; 0x800];
+        let image = nso(vec![0xAA; 0x1000], rodata.clone(), vec![0xCC; 0x400], true);
+        let parsed = Nso::try_from_bytes(&image).expect("a built image should parse");
+
+        //* When
+        let segment = parsed.rodata().expect("a built segment should expand");
+
+        //* Then
+        assert_eq!(segment, padded(&rodata));
+    }
+
+    #[test]
+    fn data_with_a_compressed_image_returns_the_segment_that_was_packed() {
+        //* Given
+        let data = vec![0xCC; 0x400];
+        let image = nso(vec![0xAA; 0x1000], vec![0xBB; 0x800], data.clone(), true);
+        let parsed = Nso::try_from_bytes(&image).expect("a built image should parse");
+
+        //* When
+        let segment = parsed.data().expect("a built segment should expand");
+
+        //* Then
+        assert_eq!(segment, padded(&data));
+    }
+
+    #[test]
+    fn text_with_an_uncompressed_image_returns_the_stored_bytes() {
+        //* Given
+        // No compression bit set, so the accessor must copy rather than try to expand.
+        let text = vec![0xAA; 0x1000];
+        let image = nso(text.clone(), vec![0xBB; 0x800], vec![0xCC; 0x400], false);
+        let parsed = Nso::try_from_bytes(&image).expect("a built image should parse");
+
+        //* When
+        let segment = parsed
+            .text()
+            .expect("an unpacked segment needs no expanding");
+
+        //* Then
+        assert_eq!(segment, padded(&text));
+    }
+
+    #[test]
+    fn text_with_a_corrupted_stream_fails() {
+        //* Given
+        // A compressed image whose stored bytes are overwritten: the LZ4 block no longer decodes.
+        let image = nso(
+            vec![0xAA; 0x1000],
+            vec![0xBB; 0x800],
+            vec![0xCC; 0x400],
+            true,
+        );
+        let mut corrupted = image.clone();
+        let parsed = Nso::try_from_bytes(&image).expect("a built image should parse");
+        let offset = parsed.header().text.file_offset.get() as usize;
+        corrupted[offset..offset + 0x10].fill(0xFF);
+        let parsed = Nso::try_from_bytes(&corrupted).expect("the header is untouched");
+
+        //* When
+        let result = parsed.text();
+
+        //* Then
+        assert!(result.is_err(), "a corrupted stream must not expand");
+    }
+}