I'll be resolving issues 2 and 3 in the next couple of weeks (adding a safe decoder and doing a lot of fuzzing).

The format, however, might continue to change for some time because I want to push performance even further.

Which is great and please don't take this as me being critical of the approach you are taking. I think it's perfectly reasonable during early development have your compressed stream in flux.

I've been bitten in the past with other libs that weren't as explicit about their stability.

That is a bit too harsh. Not all applications require those guarantees. It’s fine if you can trust the inputs.

The inputs can never be trusted

If inputs are part of the application bundl3, they can be trusted as much as the code itself.