[raiseCatError]

Final ZIP extraction safety review

ZIP extraction now creates a fresh permission-restricted staging directory on the user-selected destination volume and streams the archive into a private regular file using 1 MiB chunks, with a 2 GB archive-size cap and cancellation checks. This avoids the replacement race between ZIP preflight and invoking unzip, including FileManager.copyItem preserving source symlinks.

Tuck validates the private snapshot, comparing every entry's central and local filename/method/flags/bounds before passing the same validated snapshot to the extractor. The extracted tree is checked in a separate nested contents directory, and only the finished extracted folder is published. The copied ZIP and temporary staging are removed afterward. Invalid or missing selections fail closed. README documents disk-space requirements.

Focused regression

• ZIP local-vs-central header filename mismatch rejection.
• Missing requested entry rejection.
• Symlinked archive source snapshots actual bytes into a private regular file.
• Existing selective extraction, traversal and option/glob selector tests still run.

Verification gates

• Exact-head macOS Swift 6 test-model suites — run #38976873370
• Exact-head signed app + Finder extension build — passed in the same run
• Independent source/patch/security review
• Physical Finder QA on the user's Mac remains intentionally outstanding

No release/tag or local machine installation. Merge only after the final head passes both Mac CI stages.