Preserve ZIP acquisition policy and enforce native bundle validation

[poitee]

Why

ZIP files acquired on macOS can carry decomposed Unicode labels. This change keeps extraction strict by default and offers NFC normalization only when the acquisition caller explicitly selects NfcAtAcquisition.

What changed

pp-source adds the explicit ZIP label policy while preserving raw central/local name checks, CRC and header validation, content bytes, digest computation, limits, and collision checks. Its accepted Stage 1 archive implementation and tests remain byte-identical in this publication.

The native desktop composition adds bundle resource and dependency inventory checks, architecture-specific native addon staging, and captured runtime verification. The verifier checks the packaged Node 24.21.0 / ABI 137 identity, SQLite query, Canvas pixel and PNG output, expected addon paths, and measured Mach-O dependencies. Probe output is bounded to 4 KiB per stream, runs with a 30-second deadline, and must match the expected runtime identity. The compatibility supervisor retains bounded readiness and shutdown behavior.

The locked web dependency graph includes better-sqlite3 13.0.3 and Knip 6.5.0. Fixture commands now take explicit output locations. The unrestricted quality command passed all nine stages: lint, full Knip, typecheck, unit tests, workflow smoke, build, bundle tests, runtime tests, and browser tests.

Verification

Local quality passed with Node 24.21.0; npm audit reported zero vulnerabilities. Plan fixtures validated 30 cases and 44 runtime inputs. Storage comparison found the schema and 16 databases byte-identical; the node-access database differed only in 12 generated imported_at values. The accepted Source packet recorded 27 pp-source tests. For this composed head, unchanged native, Rust, and Source checks are inherited scoped receipts and were not rerun; they cover only their exact unchanged source paths.

The published commit has sole parent b0561b7df2e298dc67ca7f1a2b110ebb587ab938, tree fe27d5cffcaa7e206f4978fb213d79ccbae4bd62, and passed the immutable 18-path publication verifier.

Deferred

Source codec/resolver work, HTTP acquisition, native picker behavior, U17 cutover, and full application acceptance remain open. Fresh hosted ARM and Intel artifacts from this head, installed UI and lifecycle checks, signing, notarization, quarantine, updater behavior, and native loading remain pending. Older Mac evidence was not reused as proof for this head.

[coderabbitai]

Important

Draft PR not reviewed

Draft PRs are not automatically reviewed by default.

• Trigger a manual review

To automatically review draft PRs, update your CodeRabbit configuration:

reviews:
  auto_review:
    drafts: true

• Autopilot · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

---

_{Comment @coderabbitai help to get the list of available commands.}