But there are darker corners too. Not every .rap is benign. Mischief-makers have weaponized them, forging tokens or repackaging content in ways that could undermine platform integrity. That’s why, for the archive I was assembling, provenance mattered. Every .rap I cataloged had an origin note: where I’d found it, any hashes to match it to a .pkg, and a timestamp for when it had been validated. The archive’s metadata became a ledger: not only which files I had, but how I had acquired them and whether they were still usable on contemporary hardware.