fix: keep ZIP downloads flowing through compression (#872)

docs/performance-plan.md

@@ -55,9 +55,11 @@ The ninth review follow-up registers renewable staged-tree leases before inserti
 
 The tenth review follow-up makes conference removal attempt every repository sequentially before reporting all failures. Legacy repository, gist and pull-request lists retain one bulk expiration update and then reload affected documents, preserving owner extensions, current statuses and options, and omitting concurrently deleted artifacts. Four new regressions cover multiple removal failures and concurrent list changes across all three artifact types.
 
+A production rollout of PR #866 on 8 October 2026 exposed a ZIP transport regression: Express compression does not forward response write callbacks, so downloads stalled after the initial ZIP signature. Application containers were rolled back; the additive indexes remain installed. The follow-up uses the write return value and drain events for bounded backpressure, and removes listeners from the actual emitter used by compression. Two real HTTP regressions cover plain and gzip responses with forced backpressure and chunked upstream data. After rollback, the public example ZIP downloaded in 3.0 seconds and all 699 entries passed integrity checks.
+
 ## Reproduce and deploy
 
-Run `npm run build`, `npm run lint`, and `npm test`. On 8 October 2026, a clean committed checkout passed build, lint and the full suite: 948 passing, 51 pending, and no failures, with disposable MongoDB and Redis enabled. The streamer startup, lifecycle and idle-cleanup tests used compiled application code in separate processes. This run used temporary memory-backed database and spool storage after local disk I/O stalls caused integration connection and large-file deadline failures. Lint reports seven existing warnings. The full suite includes the dashboard UI regressions; both focused rename tests and five status-polling UI tests also passed. An earlier working-tree run included unrelated untracked runtime tests with two pre-existing missing-export failures; those files are excluded from this PR. The clean run includes the final generation guards for file counts and readiness.
+Run `npm run build`, `npm run lint`, and `npm test`. On 8 October 2026, a clean committed checkout passed build, lint and the full suite: 950 passing, 51 pending, and no failures, with disposable MongoDB and Redis enabled. The streamer startup, lifecycle and idle-cleanup tests used compiled application code in separate processes. This run used temporary memory-backed database and spool storage after local disk I/O stalls caused integration connection and large-file deadline failures. Lint reports seven existing warnings. The full suite includes the dashboard UI regressions; both focused rename tests and five status-polling UI tests also passed. An earlier working-tree run included unrelated untracked runtime tests with two pre-existing missing-export failures; those files are excluded from this PR. The clean run includes the final generation guards for file counts and readiness.
 
 The full run includes all 122 focused performance tests with disposable MongoDB and Redis. Run them separately with `npm run test:performance`. To include database and cross-process lease checks, set `PERFORMANCE_MONGO_URI` to a disposable MongoDB database named `perf_test_*`, and `PERFORMANCE_REDIS_PORT` to a disposable Redis port. The MongoDB suite drops its test database afterward. The S3 tests use a local HTTP protocol fixture by default; set `PERFORMANCE_S3_ENDPOINT` to test a disposable compatible service instead.