A real published Zig package cannot be consumed with the dependency entry returned by the registry.
Reproduction uses Craft 0.0.301, published by Pantry Action 0.11.119 in this successful job, and the declared compiler 0.18.0-dev.146+35accc06e.
The registry returns archive SHA-256 039b0838e927d8f766f4cc9a1aa1241b317fee353479fa0d985b2698f1f2789b as the Zig dependency hash, with a 1220 prefix. Downloading the public tarball matches that exact original byte identity. Putting the advertised dependency into a clean consumer produces error: invalid hash: incomplete before compilation.
The same compiler's ordinary zig fetch https://pantry.dev/zig/packages/craft/0.0.301/tarball returns craft-0.0.301-HIz1i26FpwB5p2UfBnczFbQAKnsNdBZDtjreAS7l9UL-, not the advertised hash. packages/registry/src/zig.ts currently computes raw tarball SHA-256 plus 1220 and treats it as a Zig package hash. Those are different identities.
Fix the owning registry/publishing contract using the supported compiler's actual package-hash semantics. Preserve the original artifact digest separately, validate modern hash lookup/metadata, retain compatibility deliberately, and add a clean native Zig consumer to qualification. Do not replace published archives or patch consumer caches. Craft's separate relative-dependency problem is tracked in https://github.com/craft-native/craft/issues/391.