test(process): isolate startup failure from shared helper state

* fix(javascript): preserve verified trace evidence subjects

Co-authored-by: Felix <[email protected]>

* fix(evidence): preserve selected subject names in views

* fix(evidence): preserve subjects across related workflows

* fix(evidence): retain inventory projection subjects

* fix(managed): validate projected graph root identity

* style: format evidence and native command code

* fix(javascript): validate static graph root identity

* test(javascript): update feature trace graph expectations

---------

Co-authored-by: Felix <[email protected]>

.agents/skills/reverse-engineer-anything/SKILL.md

@@ -1,122 +1,562 @@
 ---
 name: reverse-engineer-anything
-description: Reverse engineer native, managed, Electron/JavaScript, packaged, firmware, and browser targets with REA, and build agent environments (AgentEnv bundles) of web applications from a live instance or a capture. Use shipped-artifact or requested runtime evidence to explain features, compare versions, decompile code, or guide a reconstruction. Skip REA for ordinary source-repository architecture analysis.
+description: Reverse engineer native, managed, Electron/JavaScript, packaged, firmware, and browser targets with REA, and build agent environments (AgentEnv bundles) of web applications from a live instance or a capture, and of Linux desktop apps with a task from a request. Use shipped-artifact or requested runtime evidence to explain features, compare versions, decompile code, or guide a reconstruction. Skip REA for ordinary source-repository architecture analysis.
 metadata:
-  version: "62"
+  version: "61"
 ---
 
 # REA
 
-Use REA when a claim depends on a shipped artifact, decompilation, requested
-runtime evidence, or behavior not established by available source. For ordinary
-analysis of a complete source repository, use normal repository tools and do not run REA
+Use REA when a claim depends on a shipped binary or package, decompilation,
+requested runtime evidence, or comparison with
+behavior not established by available source. For ordinary analysis of a
+complete source repository, use normal repository tools and do not run REA
 readiness or provider commands.
 
-## Select the target and authority
-
-Use the target selected for this task. If the user says only "my app", ask which
-app before searching artifacts. Resolve a named app to one clear installed
-artifact; ask when ambiguous. Unrelated reports and nearby fixtures do not select
-it. Never substitute an example or broaden the selected target or runtime actions.
-
-Distinguish observations, derivations, inferences, and unknowns. Cite Evidence
-IDs and preserve source identity, coverage, limitations and partial facts.
-Static code, strings and declarations do not establish observed execution.
-Within the requested investigation, call available analysis tools directly;
-REA requires no permission grants or per-call approval flags. The client may
-independently require approval; preserve its actual access requirements.
-
 ## Connect only when needed
 
-If REA tools are available and registration is not known stale, proceed directly.
-Use the connected server's actual tool list and schemas: repository-main guidance
-may describe features absent from an older release. Keep complete inline Evidence
-when retained references are not advertised. Skill installation alone adds no
-MCP server or engines; a Claude Code/Codex plugin bundles its own server.
+Installing this skill supplies instructions; it does not register the REA MCP
+server, install analysis engines, or add tools to an already-running agent.
+The exception is a Claude Code or Codex plugin install: the plugin bundles
+this skill and registers its own `rea` server, outside the state that
+`rea setup` and `rea doctor` manage.
 
-For absent tools, blocked calls, unavailable providers, host timeouts or startup
-failures, read [connection and recovery](references/connection-and-recovery.md)
-before repair. Diagnose the observed blocker, continue useful supported work,
-and resume the original task after repair. Do not repeat unchanged failed calls.
-A host timeout without a REA result does not establish cancellation or cleanup.
-Retry a dropped connection once only if safe to repeat or known not started;
-if it may have changed the target, or fails again, ask for a client restart.
-Retry failed connection startup once; do not retry the same unchanged failure.
+If REA tools are available and their registration is not known to be stale,
+proceed directly to the target. Do not run diagnostics or setup before every
+investigation. Use the connected server's actual tool list and input schemas;
+a skill installed from repository main may describe capabilities absent from
+an older npm release. Keep complete inline Evidence when that server does not
+advertise retained references.
 
-Choose the registration owner: plugin recovery differs from setup-owned repair.
+If tools are absent, a call is blocked by the client, or a required provider is
+unavailable, read [connection and recovery](references/connection-and-recovery.md).
+Diagnose the observed blocker, continue useful supported work, and resume the
+original task after repair. Client approval, shell PATH, registration and engine
+availability have different remedies; avoid repeating setup for all of them.
+If the host times out without a REA result, do not repeat the unchanged call or
+assume work stopped. Read the recovery guide's deadline distinction before retrying.
+If the MCP connection drops, retry that call once only when it is safe to
+repeat or known not to have started. If it may already have changed the
+target, or it fails again, tell the user and ask them to restart the MCP
+client. If REA could not start its connection, retry once, then tell the user
+and ask them to restart the MCP client. Do not retry a startup failure that
+returns the same unchanged result. For plugin installs, follow
+[plugin recovery](references/connection-and-recovery.md#rea-installed-as-a-client-plugin).
+For setup-owned registrations, run `rea doctor` when REA could not start
+or tools stay missing after that restart. For `cleanup_incomplete`, a retryable
+capacity limit, or `configuration_invalid`, follow the recovery guide's ladder
+before asking for a restart. Read that guide before a second repair attempt.
+
+Choose the installation owner before repairing registration. Plugin installs use
+[plugin recovery](references/connection-and-recovery.md#rea-installed-as-a-client-plugin);
+only setup-owned registrations use the guide's
+[registration repair plan](references/connection-and-recovery.md#repair-registration-when-needed).
 A plugin-only doctor result of `missing` does not call for `rea setup`.
-Setup-owned repair starts with a read-only plan showing paths, backups and skill
-replacement before authorized writes. Do not install unrelated software to repair
-registration. REA setup never installs/upgrades Node, npm, Homebrew, Java,
-Ghidra, IDA, JADX, Kuna, Binwalk or Unblob.
-For an unsupported client, use manual stdio with an existing absolute runtime
-and entry script, or the CLI fallback in the recovery guide.
 
-## Route before analysis
+REA setup never installs or upgrades Node.js, npm, Homebrew, Java, Ghidra, IDA,
+JADX, Kuna, Binwalk, or Unblob. Use existing prerequisites; do not install unrelated
+software to repair MCP registration. For an unsupported client, use manual stdio
+registration with an existing installation’s absolute runtime and entry script, or continue through the CLI.
 
-Read the matching guide before its workflow; read only the relevant sections.
-Target-free tools take their explicit paths/endpoints without `open_binary`.
-Active-target native/archive tools require it. Archive members and executable
-code are different questions; follow the selected artifact's application layer.
+A concrete CLI fallback for an operator-supplied JavaScript tree or ASAR is:
 
-| Supplied target or question                                                                                                      | Guide and first operation                                                                                                                                                                                                                          |
-| -------------------------------------------------------------------------------------------------------------------------------- | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
-| Native executable/library, Ghidra/IDA/Kuna, managed PE/CLI or NativeAOT                                                          | [Native and managed](references/native-and-artifacts.md): `open_binary`; managed CLI metadata: `inspect_managed_artifact`. Read provider/lifecycle sections before reuse or edits.                                                                 |
-| Headerless/raw firmware, Cortex-M, ESP app/bootloader or whole-flash dump, HEX/S-record/UF2/DfuSe                                | [Firmware and raw images](references/firmware-and-raw-images.md): check loader support first; raw: explicit `open_binary` format/mapping; ESP/container: `open_binary` then `inspect_artifact`; region scan/extraction: advertised firmware tools. |
-| Archive/package inventory or extraction, PyInstaller, Bun executable, Godot PCK, UnityFS or wxapkg                               | [Packages and archives](references/packages-and-archives.md): `open_binary`, then `inspect_artifact`; read extraction/mount limits before materializing.                                                                                           |
-| ASAR/extracted JavaScript or Electron tree, feature trace or version comparison                                                  | [JavaScript applications](references/javascript-applications.md): `analyze_javascript_application`.                                                                                                                                                |
-| APK code, manifest, classes, methods or incoming references                                                                      | [Android applications](references/android-applications.md): `inspect_android_package`; signing/inventory use their separate routes.                                                                                                                |
-| PE/ELF/Mach-O tables or hardening, Go/Rust/IL2CPP/GPU/model metadata, pyc/BEAM, SQLite, WASM, EVM, APK signing or recorded crash | [Offline format inspectors](references/format-inspectors.md): select the named target-free inspector in that format's section.                                                                                                                     |
-| Apple plist, Interface Builder, asset catalog or keyed archive resources; unknown desktop installation directory                 | [Resource and directory inspection](references/native-and-artifacts.md#apple-app-resources): `open_bundle_resources` or `inspect_desktop_application`; no executable/provider required for resource sessions.                                      |
-| Native execution, live calls, instrumentation, process effects; browser/Electron runtime or agent-performed actions              | [Runtime observation](references/runtime-observation.md): select the observation and declared lifecycle first. Already-open page: `list_browser_targets`; Electron: `list_electron_targets`; agent actions: `capture_browser_scenario`.            |
-| Recorded HAR/SAZ/mitmproxy/qlog, packet capture, protocol-field discovery or logic/signal recording                              | [Recorded captures](references/recorded-captures.md): `inspect_web_network_capture`, packet/signal inspection or decoder discovery as appropriate; no live acquisition or recorded-URL fetch.                                                      |
-| Web AgentEnv bundle from a live instance or capture; task for an exported desktop environment                                    | [Environments](references/environments.md), including its desktop-task section: read before recording/export; `capture_browser_scenario` then `export_environment_bundle` for a live web bundle.                                                   |
-| Retained Evidence paging/composition, comparisons, unknowns or a broader investigation                                           | [Evidence workflows](references/evidence-workflows.md): use existing source IDs and the smallest view that answers the question.                                                                                                                   |
+```bash
+npx -y rea-agents@latest analyze-javascript-application /absolute/path/to/app --json
+```
 
-If a needed tool is unadvertised, inspect `binary_session {}` and
-`result.tool_availability` for availability reasons/remediation; never call an
-unadvertised tool. Expand group `names`, inheriting inventory client requirements
-unless overridden. Their union is the complete in-scope inventory; `tools/list`
-owns canonical schemas. The default summary keeps provider candidate status,
-code and reason; `omitted_fields` names exclusions. Request `detail: "complete"`
-only for remediation/diagnostics, candidate capabilities or tool effect flags.
-Candidate facts describe possible providers; top-level capabilities and
-`analysis_provider_binding` describe the current route. Keep those scopes distinct.
+No MCP registration or native engine is required. Read the returned Evidence,
+graph, limitations, and unknowns with the same care as an MCP result; the CLI
+returns the Evidence record directly. This fallback does not establish that
+MCP is configured. Native CLI tasks still require their selected engine.
+Prefer an existing `rea` CLI. When none is installed and REA package acquisition
+is within the authorized scope, use `npx -y rea-agents@latest` in its place from a
+trusted directory outside the target project, with absolute target paths. Managed
+setup binds the current installation directly; retain its runtime and package
+cache entry, or restore that installation before repairing its registration.
+For setup-owned registration, configuration repair starts with a read-only setup plan; show paths, backups and
+skill replacement before applying authorized changes. Preserve existing approval
+and target-execution boundaries.
+
+## Route the target first
+
+Choose the first tool from the target the user supplied. Use `open_binary` for
+active-target native or archive workflows; target-free tools take their own
+explicit path or endpoint and do not need it.
+
+- ASAR or extracted JavaScript/Electron tree:
+  `analyze_javascript_application`.
+- Archive/package member inventory (ZIP/APK/IPA/MSIX/AppX, DMG, or a PyInstaller
+  executable): `open_binary` with the supplied local path; use `inspect_artifact`
+  when its graph and findings help answer the question. A PyInstaller CArchive
+  is the application layer; the bootloader is only the native prefix. Start with
+  `detail: "summary"` for large inventories, then use retained inventory views
+  for selected member fields/pages. A complete small inventory can cost less
+  than extra calls and schemas. Runtime options are metadata, not files.
+  Compact delivery still inventories and hashes members. See the
+  [Python packaged applications guide](https://github.com/morluto/rea/blob/main/docs/python-packaged-applications.md).
+- Bun `--compile` executable: `open_binary`, then `inspect_artifact`; the Bun
+  module graph is the application layer. Extract stored modules and analyze the
+  JavaScript. See [Bun standalone executables](https://github.com/morluto/rea/blob/main/docs/bun-standalone.md).
+- Apple app plist, Interface Builder, asset catalog, or keyed archive resources:
+  `open_bundle_resources`, then the selected resource tool. This does not
+  require `CFBundleExecutable` or a deep provider. Resource sessions have no
+  executable digest or binary snapshot; use `open_binary` for native code.
+- Android APK code, classes, methods, or incoming references:
+  `inspect_android_package`, then focused Android tools when advertised.
+  Archive member inventory still uses the archive route above.
+- Managed PE/CLI assembly: `inspect_managed_artifact`.
+- Firmware image: `inspect_firmware_regions` when advertised. Use
+  `extract_firmware` when extraction is requested, with a caller-selected new
+  absolute output directory. These tools use caller-supplied Binwalk/Unblob on
+  Linux; see the [firmware guide](https://github.com/morluto/rea/blob/main/docs/guides/firmware/firmware-analysis.md).
+- ESP32-family app or bootloader image (`0xE9` magic): `inspect_artifact`
+  without a provider; see the ESP section of `references/native-and-artifacts.md`.
+- .NET NativeAOT PE/ELF: native Ghidra analysis. Native code can yield pseudocode;
+  consult the NativeAOT workflow in `references/native-and-artifacts.md` for
+  optional metadata recovery and its supported host/layout boundary.
+- Native program behavior, live calls, instrumentation, or command-run effects:
+  choose the matching [native runtime workflow](references/runtime-observation.md#native-runtime-questions).
+  `open_binary` and `trace_native_values` establish static facts; they do not
+  observe execution. Runtime tools have distinct launch, attach, mutation and
+  cleanup effects, and do not require a preliminary static session unless their
+  own contract says so.
+- User-owned browser page already open: `list_browser_targets`.
+- Passive traffic capture of a SPA: the default scope is the page's own origin,
+  and data APIs usually live on another origin. Discover API origins from
+  absolute URLs in loaded bundles or script text via JavaScript analysis tools
+  (another passive capture without those origins still scopes to the page
+  origin, and `completeness.excluded` counts lack URLs). Pass both the page
+  origin and those API origins in `allowed_origins` — the list replaces the
+  default scope — and read `completeness.excluded` before reporting that an
+  API is absent. For long captures with body shapes, use
+  `export_evidence_bundle` instead of expecting an inline result.
+- Browser action the agent must perform (click, type, navigate):
+  `capture_browser_scenario` with declared actions. See
+  [runtime observation](references/runtime-observation.md) for connect/launch
+  and the focused follow-up browser tools.
+- Agent environment (AgentEnv bundle) of a web application: read
+  [environments](references/environments.md) before recording; it records with
+  `capture_browser_scenario` and writes the bundle with `export_environment_bundle`.
+- Task for a desktop application's exported environment, from a
+  `capture-desktop-application` folder: read
+  [desktop application tasks](references/environments.md#tasks-for-a-desktop-application-environment).
+- Environment of a Linux desktop app with a task, from a request such as
+  "build me an Inkscape environment where the agent changes a poster's
+  headline": read [desktop builds](references/desktop-build.md). You drive the
+  app on a build computer from `start_build_computer`, then export and witness.
+- Fiddler Everywhere traffic or a native `.saz` capture: read the
+  [Fiddler workflow](references/runtime-observation.md#fiddler-everywhere-traffic-debugging).
+  Inspect saved SAZ with `inspect_web_network_capture` and `format: "saz"`;
+  connect Everywhere's separate MCP server for live traffic.
+- Retained HAR/SAZ/native mitmproxy/aioquic qlog capture: `inspect_web_network_capture`. Select
+  original record ordinals when useful; inspect producer fields and byte/number
+  sidecars without fetching recorded URLs or claiming live attribution. HAR/SAZ/qlog
+  old-generation heap is `REA_CAPTURE_DECODER_OLD_GENERATION_MIB` (default 192 MiB,
+  floor 8, maximum 16384), set where REA starts. Host memory and `NODE_OPTIONS` do not
+  raise it. See
+  [historical captures](https://github.com/morluto/rea/blob/main/docs/guides/web/web-network-captures.md) for the exact upstream
+  profile and credential exclusions. Qlog support starts with aioquic 1.5.0
+  JSON 0.3; stream coverage and endpoint loss declarations do not recover bodies
+  or establish network loss. Prefer detail summary, then kind qlog trace/stream
+  pages; select one trace, stream ID and direction for contribution/range pages.
+  Facts retain all-recorded-events-before-selection scope. Other qlog layouts
+  and PCAP correlation are unsupported.
+- User-owned Electron runtime already open: `list_electron_targets`. Before an electron-main Inspector attempt, check packaged fuses with `inspect_electron_fuses`; disabled `EnableNodeCliInspectArguments` means the app ignores `--inspect`.
+- Packet-field discovery: `inspect_packet_fields` searches installed protocols
+  and field names/types before choosing fields for `inspect_packet_capture`.
+  Query/page the relevant records; registrations do not establish observed traffic.
+- Recorded packet captures: `inspect_packet_capture` with selected TShark fields,
+  display filters and decode-as rules. Requires Linux, util-linux prlimit and
+  TShark 4.x on an absolute `PATH` entry or via the optional absolute
+  `REA_TSHARK_COMMAND` override; see
+  [capture guide](https://github.com/morluto/rea/blob/main/docs/guides/data/packet-captures.md).
+  Packet limits count input packets before filtering. Output defaults to 50 matching
+  frames; use `match_offset` / `match_limit` for later pages, or explicit null
+  limit for complete matching output. Preserve the source digest across pages.
+  This does not perform live capture.
+  For address/DNS/SNI/protocol summaries use `inspect_pcap_capture` with MCP
+  detail summary, then retained kind pcap pages. Requires Wireshark 4.x tshark
+  and capinfos, with Linux prlimit or Windows Job Objects; see
+  [packet summaries](https://github.com/morluto/rea/blob/main/docs/guides/data/pcap-analysis.md).
+  Select an exact DNS question for address pages; page exhaustion does not prove
+  network completeness. This reads recordings and does not acquire traffic.
+- Decoder discovery: `inspect_signal_decoders` searches installed decoder IDs
+  or selected decoder help, including channels and options. Query and page the
+  relevant details before choosing settings; this does not scan hardware.
+- Recorded logic/signal traces: `decode_signal_recording` with explicit decoder,
+  channel and protocol settings. On Linux with util-linux prlimit, supply sigrok-cli 0.7.2 through
+  `REA_SIGROK_COMMAND`; see [recording guide](https://github.com/morluto/rea/blob/main/docs/guides/signals/signal-recordings.md).
+  Output defaults to 50 literal lines; select annotation classes and page with
+  `line_offset` / `line_limit`, or explicit null for all remaining output.
+  Window counts are display lines, not annotations or samples. Preserve source digests across pages.
+  This reads existing files; it does not acquire hardware signals.
+- Explicit local WebAssembly artifact: `inspect_wasm_artifact`. Supply WABT 1.0.42
+  through `REA_WABT_BIN_DIRECTORY`; retain exact byte/tool identity and decoded WAT.
+  Select JavaScript glue and candidate paths explicitly and preserve URL/path
+  ambiguity. No implicit fetch or target execution; WAT is not original source.
+  See the [WASM guide](https://github.com/morluto/rea/blob/main/docs/guides/wasm/wasm-artifacts.md).
+- Explicit local Android APK (or ZIP/AAB) signing: `inspect_apk_signature`.
+  Prefer its summary or selected signer/digest/lineage page; retain complete
+  Evidence and use `inspect_analysis_view` kind `apk-signature` for follow-ups.
+  Reports which schemes are present (v1 JAR, v2, v3, v3.1), each signer's
+  certificate SHA-256 fingerprint (v1 included, from its PKCS#7 block), v3 key-rotation lineage, source stamp, and
+  whether each signed digest still matches the bytes (self-consistency). This
+  is identity and integrity, not a trust or authenticity verdict.
+  See the [APK signature guide](https://github.com/morluto/rea/blob/main/docs/apk-signature.md).
+- Explicit local EVM bytecode carrier: `inspect_evm_interface` with caller-selected
+  `raw` or `hex` encoding. The owned worker deadline is `timeout_ms` (default
+  30000 ms, range 1..2147483647, next call). It does not raise the fixed byte,
+  address-space, or CPU allowances. Preserve carrier/decoded digests and treat selectors,
+  argument strings and mutability as inferred candidates; this performs no chain
+  lookup or target execution. For the complete inferred interface without hex or
+  duplicate stdout, discover support and select `detail: "summary"`; complete
+  Evidence stays retained under its original identity. Use the returned
+  `parent_evidence_id` for exact function or `bytecode_hex`/stdout/stderr pages.
+  Candidate coverage does not establish interface completeness. See the
+  [EVM bytecode guide](https://github.com/morluto/rea/blob/main/docs/guides/evm/evm-bytecode.md).
+- Embedded Go compiler, module, build-setting metadata, or static `(ptr, len)`
+  string literals: `inspect_go_binary` with the explicit local file (pass
+  `include_string_literals: true` and optional `max_string_literals` for bounded
+  inferred static string-header recovery, and page retained rows with
+  `inspect_analysis_view` kind `go` collection `string_literals`). This built-in
+  target-free inspection requires no Go installation or disassembler. Preserve
+  raw module bytes and source ranges; absent metadata does not prove a binary is
+  not Go, static string recovery excludes compiler-inlined stack or immediate
+  strings, and unparsed text records remain explicit. See the
+  [Go binary guide](https://github.com/morluto/rea/blob/main/docs/guides/native/go-binaries.md).
+- Embedded CUDA/HIP code objects: `inspect_gpu_code_objects`; inventory targets
+  first, then decode selected payloads and query retained GPU Evidence.
+- Bundled GGUF or safetensors model declarations: `inspect_model_artifact`
+  with the explicit local file. Default header hashing leaves full-file identity
+  unknown; `hash: "full"` additionally reads all weights for SHA-256. MCP returns
+  retained summaries; optional `view` selects one page in the initial call. Use
+  `inspect_analysis_view` kind `model-artifact` for
+  batched metadata keys, tensor names or type totals, selected fields and pages.
+  Preserve header-scoped indices and array preview omissions; do not infer model
+  behavior from declared architecture or tensor types. See the
+  [model file guide](https://github.com/morluto/rea/blob/main/docs/model-artifacts.md).
+- Unity IL2CPP names, member owners and string literals from `global-metadata.dat`:
+  `inspect_il2cpp_metadata` with the explicit local file; MCP defaults to compact
+  counts. Query sections, images, types, methods, fields, properties, events,
+  parameters or string_literals through `inspect_analysis_view`
+  with the returned `parent_evidence_id`, using exact filters, batch indices and
+  selected fields. Parameters accept `method_indices`, avoiding a scan of all
+  parameter pages. Missing collections in historical Evidence remain unknown.
+  Versions 24, 27, 29, 31 and 39; no Unity, IL2CPP
+  binary or disassembler is run. Unrecognized magic (possibly encrypted) and
+  other versions are unsupported. Optional matching `binary_path` enables static native addresses and type references; query `method_addresses` with indices or addresses/states, preserving every shared-body method and both artifact identities. Without a linked binary native counts remain unknown. Byte-pattern fallback is inferred; no runtime behavior or same-build pairing is proved. See the
+  [IL2CPP metadata guide](https://github.com/morluto/rea/blob/main/docs/il2cpp-metadata.md).
+- Embedded cargo-auditable Rust dependency metadata: `inspect_rust_binary`
+  with the explicit local ELF, PE, or thin Mach-O file. This built-in
+  target-free inspection requires no Rust installation or disassembler. Preserve
+  package order, dependency indices, and the section file range. A missing
+  `.dep-v0` section is null metadata, not proof the binary has no dependencies.
+  A rustc commit hash is an inference from a read-only `/rustc/<40-hex>/` path.
+  For selected crates, use `view: {collection: "packages", names: [...],
+  fields: ["name", "version", "source"]}` on the first call; explicitly include
+  `dependencies` for direct index references. Use `detail: "summary"` for counts
+  and ranges, or retained `inspect_analysis_view` Rust package/edge pages for
+  subsequent filters. Keep the complete parent Evidence accessible; CLI compact
+  delivery requires `--evidence_output`.
+  See the
+  [Rust binary guide](https://github.com/morluto/rea/blob/main/docs/rust-binaries.md).
+- PE Authenticode certificate table: `inspect_pe_certificates` with the explicit
+  local PE32/PE32+ file. This built-in target-free inspection requires no
+  Windows SDK. Preserve WIN_CERTIFICATE ranges, types, payload SHA-256, and
+  PKCS#7 signer/X.509 identity fields, including `subject_key_identifier_hex`
+  when the signer uses that form. A missing security directory is observed
+  absence of that table, not proof the image is unsigned in every catalog sense.
+  Signatures are not verified. See the
+  [PE certificate guide](https://github.com/morluto/rea/blob/main/docs/pe-certificates.md).
+- PE import and delay-load tables: `inspect_pe_imports` with the explicit
+  local PE32/PE32+ file. This built-in target-free inspection requires no
+  Windows SDK. Preserve DLL names, named and ordinal functions, ILT/IAT RVAs,
+  delay-load descriptors, and the pefile import hash of the standard import
+  table. A missing import directory is observed absence of that table, not
+  proof the image never imported APIs through another table. Bound snapshots
+  and loaded IAT contents remain unobserved. See the
+  [PE import guide](https://github.com/morluto/rea/blob/main/docs/pe-imports.md).
+- PE TLS callbacks and load configuration: `inspect_pe_load_config` with the
+  explicit local PE32/PE32+ file. This built-in target-free inspection requires
+  no Windows SDK. Preserve callback VAs as strings with their RVA, file offset
+  and section, and the size-covered security cookie, SafeSEH, CFG,
+  EH-continuation and XFG fields. Guard-flag mitigation claims are inferred
+  linker declarations, not proof of enforcement. A missing directory is observed
+  absence of that declaration. See the
+  [PE load configuration guide](https://github.com/morluto/rea/blob/main/docs/pe-load-config.md).
+- ELF, PE, and Mach-O hardening: `inspect_binary_hardening` with the explicit
+  local file. This built-in target-free inspection requires no pwntools or other
+  host tool. One image per Mach-O slice. Each property is `enabled`, `disabled`,
+  `partial`, `unknown`, or `not_applicable`, with the header field or import
+  behind it. A missing stack-protector or fortify import is `unknown`, not
+  proof the protection was omitted. Authenticode and Mach-O code signatures
+  report presence, not validity. Hardened runtime stays unknown and names
+  `inspect_signature`. The image is not executed. See the
+  [binary hardening guide](https://github.com/morluto/rea/blob/main/docs/binary-hardening.md).
+- ELF note tables: `inspect_elf_notes` with the explicit local ELF32/ELF64
+  file. This built-in target-free inspection requires no disassembler. Preserve
+  PT_NOTE and SHT_NOTE ranges, owners, types, descriptor SHA-256, and GNU
+  build-id or ABI-tag fields. A missing table is observed absence of those
+  declarations, not proof the image never carried notes. See the
+  [ELF notes guide](https://github.com/morluto/rea/blob/main/docs/elf-notes.md).
+- Apple `.ips` crash reports: `inspect_apple_ips` with the explicit local
+  file. This built-in target-free inspection requires no Xcode, atos, or
+  pwntools. Preserve first-line metadata, `bug_type` as a string, process and
+  exception facts, lossless integer registers, usedImages UUIDs, and
+  documented classification matches. Only `bug_type` `"309"` yields a crash
+  body; other types, including `"288"` stackshots, return no crash result.
+  Opened Mach-O and dSYM UUID joins remain unobserved. See the
+  [Apple IPS guide](https://github.com/morluto/rea/blob/main/docs/apple-ips.md).
+- Linux kernel module metadata: `inspect_kernel_module` with the explicit local
+  ELF32/ELF64 relocatable file. This built-in target-free inspection requires
+  no Linux host or `modinfo`. Preserve `.modinfo` key order and duplicate keys,
+  `__versions` CRC hex, section file ranges, and the appended signature
+  trailer's PKCS#7 SHA-256. A missing section is observed absence when section
+  names are known, not proof the module never carried that metadata.
+  `struct module` is not decoded. The signature is not validated. gzip, xz, and
+  zstd containers are unsupported; decompress into a separate file with an
+  external codec utility, then inspect the decompressed `ET_REL` image. See the
+  [kernel module guide](https://github.com/morluto/rea/blob/main/docs/kernel-modules.md).
+- CPython 3.7–3.13 `.pyc` header, nested marshal code objects and bytecode
+  identity: `inspect_python_pyc` with the explicit local file. This built-in
+  target-free inspection requires no Python installation. Preserve magic,
+  PEP 552 hash or mtime/size, nested names, and bytecode SHA-256. Bytecode is
+  not decompiled, and a decoded header does not prove the matching `.py` is
+  present. See the
+  [CPython pyc guide](https://github.com/morluto/rea/blob/main/docs/python-pyc.md).
+- Erlang BEAM IFF container: `inspect_erlang_beam` with the explicit local
+  `.beam` file. This built-in target-free inspection requires no Erlang
+  installation. Preserve chunk names, atom order, export/import/lambda tables,
+  and the Code header. For selected facts, prefer `detail: "summary"` plus a
+  `beam` view (collection, names/indices, fields and paging), retaining the full
+  Evidence. CLI summary requires `--evidence_output`. Missing table counts stay
+  null; decoded empty tables count zero. Bytecode is not executed. See the
+  [Erlang BEAM guide](https://github.com/morluto/rea/blob/main/docs/erlang-beam.md).
+
+- Explicit local SQLite database snapshot: `inspect_sqlite_database`. Inspect
+  with Node.js 24.x >=24.15 or 26+ providing native SQLite limits. Read schema
+  first (compact inventory by default), or select an exact ordinary table
+  and `columns` when rows are needed. Defaults are selected-table schema and
+  20 rows; request `schema_scope: "database"` for the complete stored schema. Preserve both database and existing sibling WAL identity; row samples
+  report truncation and have unspecified order. Use a quiescent snapshot rather
+  than assuming a live database/WAL pair was copied atomically. See the
+  [SQLite guide](https://github.com/morluto/rea/blob/main/docs/guides/data/sqlite-databases.md).
+- Explicit Linux ELF file for offline layout, symbols, relocations or static
+  mitigation evidence: `inspect_binary_layout`. This target-free operation uses
+  caller-supplied pwntools without opening a disassembler database. Preserve its
+  raw locations and inference/coverage limits; see the
+  [offline binary guide](https://github.com/morluto/rea/blob/main/docs/guides/native/binary-diagnostics.md).
+- Supplied Linux x86-64 ELF core: `inspect_recorded_crash`. Read every recorded
+  thread, raw note and source-bound register without opening a live target.
+  Historical PIDs do not select live processes. Request `include_debugger_context`
+  only when core-only mapping candidates help; see the
+  [recorded crash guide](https://github.com/morluto/rea/blob/main/docs/guides/native/recorded-crashes.md).
+- PE resource type/name/language trees and static icon group references:
+  `inspect_pe_resources` with an explicit path. This portable operation requires
+  no active target or engine; opaque payloads retain file ranges and SHA-256.
+- PE export directories and ELF dynamic-symbol exports: `inspect_native_exports`
+  with an explicit path; portable, no active target or engine.
+- Native executable, library, or analysis database: `open_binary`, then
+  use focused analysis tools directly; call `binary_overview` when metadata or
+  inventory context is useful and available from the selected provider.
+
+For an existing IDA MCP configuration, use `open_binary` with the original
+input binary and `provider_id: "ida"`; do not pass an `.idb` or `.i64` database.
+The legacy attached profile binds the already-open GUI input by SHA-256 and
+leaves its database open. The modern headless profile creates and closes an
+owned private database without saving. Installation and registration reuse
+[mrexodia/ida-pro-mcp](https://github.com/mrexodia/ida-pro-mcp); see the
+[IDA provider guide](https://github.com/morluto/rea/blob/main/docs/providers/ida-provider.md).
+For migration to the separate native IDA MCP plugin, follow the guide's
+[legacy attached migration](https://github.com/morluto/rea/blob/main/docs/providers/ida-provider.md#migrate-a-legacy-attached-registration).
+Replace the upstream registration explicitly; modern mrexodia tools are not the
+native profile. Native attachment preserves the database but does not provide
+direct callers; check session availability and the guide's verification limits.
+Proceed directly to `analyze_function`, pseudocode, or function/string searches
+after opening; IDA does not supply `binary_overview`. Consult session availability
+when composing broader workflows. Modern direct callers and unsupported dossier
+facets remain unknown; live IDA results are not replayed from snapshots.
+
+With `REA_KUNA_COMMAND` configured, `provider_id: "kuna"` answers procedure
+lists, lookups, pseudocode, assembly and `analyze_function` from Kuna's cached
+whole-program export. Callers/callees use a separate body-free graph shared by
+the session; `xrefs` returns exact-address incoming sites and filters forwarding
+aliases. These queries and inventory lookups do not trigger a C export. Indirect
+targets remain unknown and can make relationship coverage partial. Reference
+caches expire on close; a fresh CLI process repeats the native reference walk.
+Typed references, CFG, raw-memory tools and annotations remain unsupported. A cold first
+answer can come from a single-function run (its limitations say so); assembly
+waits for the export. For pseudocode and assembly, `raw_result.source` names the
+cached `.c`/`.asm` file and byte span, which you may search directly instead of
+calling per function. See the
+[Kuna provider guide](https://github.com/morluto/rea/blob/main/docs/kuna-provider.md).
+
+If the user says only "my app" without a name, path, or target already selected
+for this task, ask which app before searching for artifacts. Paths in unrelated
+saved reports and nearby test fixtures do not select the user's target. Resolve
+an actual human-readable app name to one clear installed artifact when possible;
+ask when matches are ambiguous. Never choose an example app on the user's behalf.
+
+In a target-free session, use `open_binary` to bind any archive/package or
+native target whose analysis tool operates on the active target. Do not call an
+unadvertised tool; inspect `binary_session` with `{}` and its
+`result.tool_availability` for availability reasons and remediation. Expand each
+group's `names` into entries, inheriting the inventory-level client requirements
+unless the group overrides them. The grouped name union is the complete tool
+inventory; use `tools/list` for canonical tool schemas. The default summary keeps
+each provider candidate's availability and target-support status, code and
+reason; `omitted_fields` lists what it leaves out. Request `{"detail": "complete"}`
+only when you need an unavailable candidate's remediation, provider
+diagnostics, candidate capability sets, or tool surface, effect and annotation
+flags; in those closed flag vocabularies, listed
+flags are true and omitted known flags are false. Provider candidate facts
+describe possible providers, while top-level session capabilities describe the
+current route and `analysis_provider_binding` names the selected provider. Do
+not treat those scopes as interchangeable.
+
+For editable Ghidra analysis that must survive a later agent process, select
+the [owned Program checkpoint workflow](references/native-and-artifacts.md#continue-editable-ghidra-analysis-across-processes)
+before making metadata edits. It is separate from Evidence/Unknown persistence.
+
+For a Ghidra startup timeout on a large native target, follow
+[deadline recovery](references/native-and-artifacts.md#ghidra-startup-deadline-recovery)
+before abandoning deep analysis or repeating the same cold import. The default
+330 seconds can be changed for new startup attempts through
+`update_analysis_settings` using `ghidra.startup_timeout_ms`. Changing the
+server's launch environment instead requires a new REA process.
 
 ## Work summary-first
 
-Start with inline Evidence and graph context. For unknown/large JavaScript or ELF
-layout, select advertised `detail: "summary"`; MCP `analyze_function` already
-defaults to a summary. Small complete results can cost less than extra pages.
-Make a focused follow-up only for a specific unanswered question. Reuse matching
-session state and Evidence instead of repeating analysis; recheck state when a
-lifecycle change makes it useful.
+Start with the default result and use its inline Evidence and graph context.
+For a JavaScript application or ELF layout whose size is unknown or large,
+call `analyze_javascript_application` or `inspect_binary_layout` with
+`"detail": "summary"`, then inspect the retained `parent_evidence_id` with
+`inspect_analysis_view`. Over MCP, `analyze_function` is summary-first without
+a flag: its default reply is the summary, and the complete dossier stays
+retained under `parent_evidence_id` for facet paging. Pass that ID as a
+`retained-evidence` reference to `compare_functions`, or inside
+`match_native_functions` `left_observations`/`right_observations` or
+`build_call_path.functions`; request `"detail": "complete"` only when the
+dossier must travel inline.
+Use the same exact-reference form in other advertised logical Evidence inputs,
+including optional sources, arrays and nested sources across domains. Each
+source can independently be inline or retained; preserve its source identity,
+coverage, partial facts and unknowns. A summary or inspection page has its own
+Evidence ID: use `normalized_result.parent_evidence_id` when the consumer needs
+the complete source. For portable CLI follow-ups, commands advertising
+`--evidence-bundle` resolve references from that selected exported bundle.
+See [Evidence composition](references/evidence-workflows.md) for scope and
+recovery; file selectors are supported only where explicitly advertised.
+Page module identities and select the returned `node_id` before requesting an
+item; a single file path can represent several graph roles. Do not repeat an
+identical analysis or rejected call without a changed input or resolved blocker.
+Recheck session state when a lifecycle change makes that status useful.
+Make a focused follow-up only when the
+returned result leaves a specific question unanswered.
 
-Complete source Evidence stays accessible through advertised retained references.
-A summary/page has its own Evidence ID; use `normalized_result.parent_evidence_id`
-when a consumer needs the complete source. Pass `{kind: "retained-evidence",
-evidence_id}` in inputs advertising that form; do not resend complete records.
-Sources may independently be inline or retained. Read the Evidence guide for
-exact filters, bundle-based CLI reuse, comparison roles and missing-source recovery.
+If MCP reports `resource_constraint` with `details.resource: "transport"`, call
+`inspect_analysis_view` with its reported same-session Evidence reference for a
+summary, one section/module, or a stable page. Use `trace_application_feature`
+once a seed is known, or call `export_evidence_bundle` to write the complete
+session to a selected path. The analysis remains complete in the ledger; avoid
+repeating it merely to request the same oversized response. Complete CLI JSON
+output also streams without a single MCP frame.
 
-For REA transport refusal or client-truncated output, inspect a smaller retained
-view or export complete Evidence. Do not parse a preview as canonical JSON or
-repeat the producer. Never invent an Evidence ID; if unknown, find it with
-`get_evidence_bundle` summary filters. Retention is bounded and session-local;
-it does not establish automatic persistence or complete source coverage.
+When the retained parent ID is unknown, use `get_evidence_bundle` with
+`detail: "summary"` and exact filters for operation, target SHA-256,
+analysis-profile digest or canonical procedure address. Select its returned
+Evidence ID for the next view instead of requesting the complete bundle. When
+that record has no supported view (for example an annotation), read it with
+`detail: "records"` and an `evidence_id` filter; `missing_evidence_links`
+names linked sources this session does not retain.
+`retention: "complete-record"` means the whole record is stored; native
+value-flow truncation and unknown metadata remain separate. For an exported
+portable bundle, use `rea inspect-evidence-bundle` with JSON containing `path`,
+`detail: "summary"` and the same `filters`. Reading that file still requires
+validating its full contents within the local memory budget.
 
-For broad investigations, read the Evidence guide's staged workflow. Track the
-questions, source boundaries and unresolved gaps; do not claim completion while
-required questions remain open. Inspect packaged resources alongside code when
-relevant, and use runtime evidence only within the requested scope.
+A client can also truncate a successful tool result without a REA transport
+error. Treat that preview as incomplete; use the retained parent ID for smaller
+views or export when the full record is needed. Do not parse the preview as
+canonical JSON or repeat the producer. For JavaScript, read the
+[module-view and trace recipes](references/javascript-applications.md) before
+drilling into a large graph; a broad bidirectional trace can expand unrelated
+containment relationships even after summary analysis.
+
+Every conclusion must distinguish observations, inferences, and unknowns. Cite
+Evidence IDs, preserve limitations and incomplete coverage, and never imply
+that static analysis observed execution. Runtime requests execute the declared
+target and lifecycle; do not broaden the target or action beyond those fields.
+
+Within the user's requested investigation, call available analysis tools
+directly. REA does not require permission grants or per-call approval flags.
+The agent client can independently require approval. Follow the declared request
+scope and the host's actual access requirements; use the recovery guide for an
+observed client-policy rejection.
+
+## Plan broader investigations
+
+For requests that span multiple features or subsystems, use a staged workflow:
+
+1. Turn the request into a checklist of questions and the evidence each answer
+   needs. Resolve target identity and constraints from the conversation and
+   workspace before asking for information again.
+2. Inspect the current REA session, artifact identity, saved analysis database,
+   bookmarks, and prior evidence. Reuse matching state; do not open duplicate
+   sessions or repeat identical analysis.
+3. Start with the smallest useful overview or inventory. Follow each question
+   from its entry point through relevant data and state changes to its result.
+   Batch related operations around a specific hypothesis, then expand only when
+   the returned evidence leaves a concrete gap.
+4. Inspect relevant packaged resources and configuration alongside code when
+   they affect the question. Use format-aware inventory and parsers; do not
+   infer behavior from filenames, strings, or layout alone.
+5. Corroborate a conclusion with the evidence type it requires. Use runtime
+   observation only when static evidence cannot answer the question and the
+   required host runtime and OS access are available. For JavaScript behavior,
+   run probes against the actual app through the available browser, Electron,
+   or process capture workflow.
+6. Decompose work into independent questions. When parallel workers are
+   available and the questions do not depend on one another, assign distinct
+   scopes, point workers to existing evidence, and ask them to return sources,
+   conclusions, and unresolved gaps. Otherwise, work sequentially.
+7. Keep a concise finding ledger linking each conclusion to Evidence IDs,
+   confidence/evidence type, search boundary, and remaining unknowns. Update
+   the shared index or investigation report so later passes can reuse results.
+
+Before finishing, revisit the original checklist. Mark each question as
+answered, partially answered, or unresolved based on its evidence; keep
+bounded negative searches bounded, and do not describe a broad investigation
+as complete while required questions remain open.
+
+## Read only the relevant guide
+
+- Native binaries, managed assemblies, archives, and extraction:
+  [references/native-and-artifacts.md](references/native-and-artifacts.md)
+- ASARs, extracted JavaScript, feature tracing, and version comparison:
+  [references/javascript-applications.md](references/javascript-applications.md)
+- Android APK declarations, classes, methods, and static references:
+  [references/android-applications.md](references/android-applications.md)
+- Native instrumentation, debugger and process capture; browser/Electron
+  observation; static/runtime comparison:
+  [references/runtime-observation.md](references/runtime-observation.md)
+- Evidence paging, comparisons, residual unknowns, and verification:
+  [references/evidence-workflows.md](references/evidence-workflows.md)
+- Agent environments (AgentEnv bundles) of a web application, recorded from
+  a live instance or a HAR:
+  [references/environments.md](references/environments.md)
+- Tasks for a desktop application's exported environment:
+  [references/environments.md](references/environments.md#tasks-for-a-desktop-application-environment)
+- A desktop app environment from a request, built and witnessed on build
+  computers: [references/desktop-build.md](references/desktop-build.md)
 
 ## Finish the task
 
-Explain findings in plain language and tie them to returned Evidence. For builds,
-use normal coding tools and separate observed behavior from design choices.
-Close an opened native/resource session with `close_binary` when no longer needed.
-Evidence references and Unknown history remain on the same MCP connection.
-End with `reset_investigation`; use `save_path` to checkpoint the complete bundle
-before clearing. Import that bundle, including its source closure, to restore
-original references and Unknown history in a new process. Editable Ghidra Program
-checkpoints are separate; read that workflow before edits needing persistence.
+Explain findings in plain language and tie them to returned evidence. When the
+user asks to build something, use normal coding tools and separate observed
+behavior from design choices. Close an opened native session with
+`close_binary` when its engine is no longer needed. Evidence references and Unknown
+history remain in memory on the same MCP connection. End the investigation with
+`reset_investigation`; supply `save_path` to checkpoint the complete bundle before
+clearing. Import the saved bundle to restore original references and Unknown
+history in a new process. Retention is bounded and is not automatic persistence.

.agents/skills/reverse-engineer-anything/references/connection-and-recovery.md

@@ -1,23 +1,11 @@
 # Connection and task recovery
 
-Read only the sections needed for the selected task.
-
-- [Choose the remedy from the observed failure](#choose-the-remedy-from-the-observed-failure)
-- [Distinguish client and server deadlines](#distinguish-client-and-server-deadlines)
-- [Recovery ladder](#recovery-ladder)
-- [REA installed as a client plugin](#rea-installed-as-a-client-plugin)
-- [Repair registration when needed](#repair-registration-when-needed)
-- [Codex tool approval is separate from REA readiness](#codex-tool-approval-is-separate-from-rea-readiness)
-- [Repair an editable REA limit](#repair-an-editable-rea-limit)
-- [Continue through an installed CLI](#continue-through-an-installed-cli)
-
 Read this guide only for an observed connection, command, approval or provider
 blocker. Keep the user's target and question in view. Explain what prevented the
 operation and the next useful step; after repair, continue the investigation.
 
 Commands below use an installed `rea`. If none is available, use the package
-invocation under [Continue through an installed CLI](#continue-through-an-installed-cli)
-when acquiring REA is authorized. Follow the connected
+invocation in `SKILL.md` when acquiring REA is authorized. Follow the connected
 server's schemas and the installed CLI's help rather than assuming repository
 main and an older release expose the same arguments. Tool-name prefixes belong
 to the client: find the canonical REA operation in its actual tool listing and
@@ -229,25 +217,6 @@ not edit host deadlines, response buffers, registrations or fixed limits.
 
 ## Continue through an installed CLI
 
-A concrete CLI fallback for an operator-supplied JavaScript tree or ASAR is:
-
-```bash
-npx -y rea-agents@latest analyze-javascript-application /absolute/path/to/app --json
-```
-
-No MCP registration or native engine is required. Read the returned Evidence,
-graph, limitations, and unknowns with the same care as an MCP result; the CLI
-returns the Evidence record directly. This fallback does not establish that
-MCP is configured. Native CLI tasks still require their selected engine.
-Prefer an existing `rea` CLI. When none is installed and REA package acquisition
-is within the authorized scope, use `npx -y rea-agents@latest` in its place from a
-trusted directory outside the target project, with absolute target paths. Managed
-setup binds the current installation directly; retain its runtime and package
-cache entry, or restore that installation before repairing its registration.
-For setup-owned registration, configuration repair starts with a read-only setup plan; show paths, backups and
-skill replacement before applying authorized changes. Preserve existing approval
-and target-execution boundaries.
-
 Check the command environment only if the launcher fails:
 
 ```bash

.agents/skills/reverse-engineer-anything/references/desktop-build.md

@@ -0,0 +1,294 @@
+# Desktop app environments from a request
+
+Use this when someone asks for an environment of a Linux desktop app with a
+task, such as "Build me an Inkscape environment where the agent changes a
+poster's headline and saves it". You are the building agent: you drive the
+app on a build computer through REA's MCP tools, write the task, export the
+bundle and witness it in a fresh computer. REA runs no model. The tools are
+MCP-only and need Docker, `REA_AGENT_ENV_COMMAND` and
+`REA_BUILD_COMPUTER_REA_ARCHIVE` where the REA server starts; when a start
+reports one missing, tell the person what to set and stop.
+
+For the whole build:
+
+- Drive the app only with `act_on_build_computer`. Never script it, run
+  commands in the computer or write its files another way.
+- Ask the upfront questions once, then work on your own. Pause only when
+  blocked.
+- The seed's content is synthetic. Never put real personal data in it.
+- Close every computer you start, on success and on failure.
+- Note the time you start; the report gives the build time.
+
+## Ask once, upfront
+
+In one message, ask only what the request leaves open, and keep the list for
+the report:
+
+1. The app and the task, if either is unclear: what changes, in which
+   document.
+2. Whether they have a starting file of their own; otherwise you make one.
+3. Whether they want solver runs after the witness: how many (the budget)
+   and with which model.
+4. If so, whether they want to review the task before those runs.
+
+## When you are blocked
+
+Stop, say what you need and wait only for:
+
+- a licence the app or its installer asks someone to accept: never accept it
+  yourself; name it and where to read it, and go on only once the person
+  says they accept it;
+- credentials: they may only be typed as handles you never see, and the
+  build tools have none yet, so say the app needs a sign-in and stop. Never
+  ask for a password in chat;
+- a signed-in state in the seed: ask before seeding one;
+- an install this flow cannot do, below.
+
+Decide everything else yourself and note it in the report.
+
+## Choose the install
+
+The computer is Ubuntu 24.04 (noble) on this host's architecture only. Use
+the first source that has the app:
+
+| Source                       | `install`                                                                         |
+| ---------------------------- | --------------------------------------------------------------------------------- |
+| Ubuntu archive               | `{"kind": "archive", "package": "inkscape"}`                                      |
+| PPA or vendor apt repository | `{"kind": "apt_repository", "package", "uri", "suite", "components", "key_file"}` |
+| `.deb` by URL                | `{"kind": "package_file", "url", "sha256", "architecture", "dependencies"}`       |
+
+- A PPA's `uri` is `https://ppa.launchpadcontent.net/OWNER/NAME/ubuntu`,
+  `suite` `noble`, `components` `["main"]`. `key_file` is the repository's
+  signing key saved on this host; for a PPA, fetch it from
+  keyserver.ubuntu.com by the fingerprint its Launchpad page shows.
+- For a `.deb`, ask the requester for its URL and SHA-256; do not fetch a
+  vendor's download page yourself. List its `Depends` as `dependencies`:
+  it installs with the network off.
+- Flatpak, AppImage and snaps are not supported yet: say so and stop. An
+  archive package that only installs a snap, such as noble's `firefox`,
+  counts as a snap. A package with no build for this host's architecture
+  (some PPAs are amd64 only) cannot be installed either.
+- `desktop_entry` is the package's `.desktop` file name under
+  `/usr/share/applications` without `.desktop`, such as
+  `org.inkscape.Inkscape`. Add `window_class` when you know it; Inkscape's
+  is `Inkscape`. AbiWord's entry is `abiword` and its class `Abiword`.
+
+## Drive the app
+
+- Pass `computer_id` and the action's fields at the top level: click
+  `{x, y, count}`, scroll `{x, y, direction, amount}`, a screenshot region
+  `[x0, y0, x1, y1]`. The rest are in
+  [the build-computer guide](https://github.com/morluto/rea/blob/main/docs/desktop-build-computer.md).
+- Take a `screenshot` before pointing: points are pixels of the latest
+  frame. If a response is too large, ask for a `region`, or `jpeg` with a
+  lower `quality`. A region crops the latest frame and becomes it: take a
+  full screenshot before pointing again.
+- A drawn caret does not prove keyboard focus. After using a toolbar
+  control, click into the document, then type a few characters and look
+  before a long text.
+- Confirm a dialog with `key` Return, not a trailing `\n` in `type`.
+- An action's own screenshot is taken at once. After opening a menu, a
+  dialog or a window, look with
+  `{"action": "wait", "ms": 500, "screenshot": true}`.
+- On a computer started from a request the app is not open at first, and
+  `start_build_capture` opens it: never open it yourself before that. Do not
+  close it while capturing; the capture ends when the app exits. When the
+  app is closed at any other time, open it from Applications → Other → the
+  environment's name.
+- Prefer shortcuts and typing to long pointer paths: `key` takes `keys`, an
+  array holding one chord's keys, such as
+  `{"action": "key", "keys": ["ctrl", "s"]}`, and `type` turns `\n` into
+  Enter.
+- Before `type`, check in a screenshot that a text cursor or a focused
+  field is there. In apps with single-key shortcuts, such as Inkscape, text
+  typed without one runs as commands.
+- Save As opens in the home: click Documents in its sidebar and type only
+  the file name. Answer the app's save questions, such as keeping the
+  format, then check the saved path in the title or status bar, or the
+  dialog's folder when the app shows only the name, and that it shows no
+  unsaved mark, before you mark a checkpoint or check.
+- What the app saved under the home before `seed`, such as a document in
+  `~/Documents` or its settings, is part of the seed. A file you move to the
+  Trash is left out, and the export lists it in `limitations`. Trash a stray
+  file rather than starting over.
+- Dismiss first-run dialogs, such as a welcome screen, before `seed`. A
+  choice the app saves only later, such as Inkscape's "show this every
+  time", may not reach the seed, so expect the dialog in the witness too.
+- Give what the task changes a stable name where the app has one, such as an
+  id in Inkscape's Object Properties, so a check can select it.
+- Expect apps to split text into runs: Writer's revision ids split an
+  edited paragraph into spans and may give it an automatic style such as
+  `P1`, and AbiWord wraps each insertion in `<c>`. Check such text whole
+  with `text_equals` (see Write the task), and find the paragraph by
+  something the edit keeps, such as AbiWord's `xid`.
+
+## Build the seed and the edit
+
+1. `start_build_computer` with
+   `{"source": {"kind": "request", "desktop_entry": ..., "install": ...}}`.
+   The first start of an app builds its image and can take minutes. A
+   failed start returns the build's error: fix the request, or stop when the
+   install cannot work, and close any `computer_id` the error names.
+2. `start_build_capture`. It returns once the app's window is open. A
+   `package_lists_error` may stop the capture finding the package's
+   sources; the export says when that matters.
+3. Make the seed through the app and save it from the app under
+   `~/Documents`: build the document in the app, or write its source where
+   the app edits its format as text, then save it again from the app. Make
+   it look real but synthetic: the thing the task changes, plus a few things
+   the change must leave alone. Keep it to one document: the bundle's app
+   opens the seed's document at launch only when there is exactly one, and
+   otherwise starts on its own screen. For a starting file of the requester's,
+   read it here and rebuild it in the app with synthetic data in place of
+   personal data; REA cannot copy a file into the computer.
+4. Only once the seed is saved, `mark_build_checkpoint` with name `seed`.
+5. Make the change the task asks for, as a user would, and save it.
+6. Only once the change is saved, `mark_build_checkpoint` with name `end`.
+7. `stop_build_capture`. Read `draft.files` (each file that changed, with
+   its net change), `draft.task.checks` (suggested checks) and
+   `limitations`. When `draft` is null, read `draft_refusal` first: a
+   missing `seed` or `end` checkpoint means capturing again on a new build
+   computer, while a failed draft command names its own cause to fix.
+
+## Write the task
+
+Write `{"name", "prompt", "checks"}` from the draft and what you did.
+
+- `name`: lowercase letters, digits and hyphens, not `smoke`.
+- `prompt`: what the requester wants, in their words and the app's terms,
+  naming the document as a user would and ending with saving it: "Change the
+  poster's headline in Documents/poster.svg to Summer Bake Sale and save
+  it." Never say how the file stores it, and never give the checks.
+- Checks are file-based: content checks that prove the edit, never only that
+  a file exists or changed. Start from the suggestions; keep those that say
+  what the user did and drop what follows from how the app saves.
+- Compare exact values, so a typo or a wrong number fails.
+- Select elements by what they hold, never by position: SVG text by id,
+  `/root/children/[name=g][@inkscape:label=Layer 1]/children/[name=text][@id=headline]/children/[name=tspan]/children/0`,
+  or an ODF paragraph by style,
+  `/entries/[name=content.xml]/view/root/children/[name=office:body]/children/[name=office:text]/children/[name=text:p][@text:style-name=Title]/children/0`.
+  A selector must match exactly one element, so give the target a unique id
+  or style in the seed. The draft may suggest positional pointers; rewrite
+  them. Only an element's text is read by position, as `children/0`.
+- When an app may split an element's text into runs, check it whole:
+  `text_equals` (or `text_contains` for a value inside a sentence) on the
+  element compares all its text, however it is split. Add
+  `normalize_whitespace: true` when the app may reflow spaces. Example, an
+  AbiWord paragraph by its stable id:
+  `{"kind": "text_contains", "file": "Documents/memo.abw", "pointer": "/root/children/[name=section]/children/[name=p][@xid=6]", "value": "at 3:30 PM"}`.
+  Point a text check at the paragraph or another element the edit keeps,
+  never at a run such as AbiWord's `[name=c]`: a reopened document splits
+  the text into several runs. The draft lists only what changed; to name an
+  unchanged element, such as another paragraph's `xid`, use the app's usual
+  numbering and let the export confirm it, or read it in the exported
+  bundle's `envs/<env>/seed/`.
+- Where easy, add one check that the rest is untouched, such as another
+  text's value the edit must leave alone. It is the one unchanged value
+  worth checking; it passes on the seed too, which is fine, since the export
+  needs only one check to fail there.
+- Give `value_equals` a `tolerance` for a number the app writes as text.
+- When the draft shows an XML document's changes as `lines`, REA read it
+  as text, for example because its DOCTYPE declares entities. Selectors are
+  impossible there, and `line_count` with `contains` only approximates a
+  value: `3:30` also matches `13:30`. Bound it with neighbouring text and
+  name the check as approximate in the report's limitations.
+- Some apps save a document reloaded from disk differently from one typed
+  in the same session: AbiWord wraps each new insertion in its own markup.
+  Your build's end state hides this, which is why whole-text checks matter;
+  expect the witness to show the real format.
+
+The kinds and pointer rules are in
+[the desktop tasks section](environments.md#pick-the-checks).
+
+## Export
+
+`export_build_environment` with `task` and `directory`, the absolute path of
+a new or empty folder here, such as `<home>/rea-builds/poster/bundle`. The
+export seeds what was saved at `seed`, replaces the computer's host name,
+`user@host` and home path (a bare user name, such as AbiWord's author
+`user`, stays), and checks the task against `seed` and `end`. It refuses a task
+unless at least one check fails on the seed and every check passes at the
+end, and says why, such as a pointer that names nothing at the end. A
+check that the rest is untouched passes on the seed too, which is fine. On
+a refusal, fix the task and export again, into another folder if that one
+is no longer empty. Keep
+`seed_files`, `scrubbed_files`, `unscrubbed_files` and `limitations` for the
+report.
+
+Keep the build computer open until the witness holds: a task fix exports
+again from it.
+
+## Witness
+
+Witness in a fresh computer of the bundle, from the prompt, as a solving
+agent would. Do not replay the build's actions or coordinates, and do not
+check between stages to steer the edit: a solving agent never sees the
+checks. Give every `check_build_task` the task exactly as exported.
+
+1. `start_build_computer` with
+   `{"source": {"kind": "bundle", "path": "<bundle>"}}`. The app starts
+   with the seed's files in place and opens the seed's document when the
+   seed holds exactly one and the app takes a file. When the export's
+   `limitations` say it opens no document, open it from the prompt's path,
+   as a solving agent would. Take a `wait` screenshot first, since the
+   desktop may not have drawn yet.
+2. `check_build_task` with `stage: "seed"` and `directory`, the absolute
+   path of a new or empty folder for the record. A check must fail.
+   Recording starts. Later stages take no `directory`.
+3. Do the task from the prompt with `act_on_build_computer` and save.
+   `check_build_task` with `stage: "after_edit"`: every check must pass.
+4. Make a near miss on top of it: a plausible wrong edit, such as a typo or
+   a wrong number, and save. `check_build_task` with `stage: "near_miss"`:
+   a check must fail.
+5. `act_on_build_computer` with `action: "reset"`, then `check_build_task`
+   with `stage: "after_reset"`: a check must fail again.
+6. The last stage ends the witness: `witness.record` has the verdict, the
+   path of `witness.json` and the recording's segments in `directory`.
+   `close_build_computer` on the witness computer.
+
+A stage that does not hold ends the witness as `failed`. Read each check's
+result and decide:
+
+- `after_edit` failed though the saved file is right: the check is brittle.
+  Fix it, export again and witness in a new computer.
+- `after_edit` failed because your edit was wrong: witness again in a new
+  computer; a computer is witnessed once.
+- `near_miss` passed: the checks are too loose. Tighten them, export again
+  and witness again.
+- `after_reset` passed: the reset did not restore the seed. Report it as a
+  limitation.
+
+Stop after three witnesses and report what still fails.
+
+## Solver runs
+
+Only if the requester asked for them. If they wanted to review the task
+first, show them its prompt and checks and wait for their approval. Then run
+the bundle within the budget, one run at a time, with the runner
+`REA_AGENT_ENV_COMMAND` names:
+`agent-env run <bundle> --task <name> --agent claude-code --model <model>`.
+Count runs reported `passed`. A run `scored below 1` is a miss; one reported
+`failed` did not finish, so run it again if the budget allows instead of
+counting it. Never run past the budget.
+
+## Close and report
+
+`close_build_computer` on every computer still open, also after a failure.
+If a close fails, call it again; if it still fails, tell the requester what
+is left.
+
+Report:
+
+- the bundle path and the environment name;
+- the task's name and prompt;
+- each check, and why it proves the edit and fails the near miss;
+- each witness stage with its result, the verdict, and the paths of
+  `witness.json` and the recording;
+- the seed's contents: `seed_files` and what each holds;
+- `scrubbed_files` and `unscrubbed_files`; an unscrubbed file still names
+  the host or user, so it needs review before sharing;
+- limitations: the capture's, the export's and anything you could not do;
+- solver runs, if any: the model, the runs and the passes;
+- the build time and the questions you asked.
+
+Never publish or share the bundle yourself.

.agents/skills/reverse-engineer-anything/references/environments.md

@@ -1,13 +1,5 @@
 # Agent environments from a live application
 
-Read only the sections needed for the selected task.
-
-- [Before recording](#before-recording)
-- [Record a session an environment can learn writes from](#record-a-session-an-environment-can-learn-writes-from)
-- [Check coverage](#check-coverage)
-- [Export and hand off](#export-and-hand-off)
-- [Tasks for a desktop application environment](#tasks-for-a-desktop-application-environment)
-
 Use this when the user asks for an agent environment (an AgentEnv bundle) of a
 web application: a folder `agent-env` deploys, whose MCP tools answer from what
 one recording of the application observed and serve the writes that recording
@@ -302,7 +294,9 @@ Use this when the user has a folder from `rea capture-desktop-application` and
 wants a task for the environment `rea export-desktop-application` makes from
 it: a prompt for a computer-use agent and checks that grade what the agent
 left in the app's files. You write the prompt and the checks; REA validates
-the task against the capture and exports it. These commands are CLI only.
+the task against the capture and exports it. These commands are CLI only. To
+build the environment and its task from a request instead, follow
+[desktop builds](desktop-build.md).
 
 ### Describe the change
 

.agents/skills/reverse-engineer-anything/references/evidence-workflows.md

@@ -1,25 +1,7 @@
 # Evidence, comparison, and verification workflows
 
-Read only the sections needed for the selected task.
-
-- [Read and compose source Evidence](#read-and-compose-source-evidence)
-- [Inventory and decompilation views](#inventory-and-decompilation-views)
-- [Unknowns and comparisons](#unknowns-and-comparisons)
-- [Process captures and environment views](#process-captures-and-environment-views)
-- [Native export table pages](#native-export-table-pages)
-- [Recover oversized delivery and find retained Evidence](#recover-oversized-delivery-and-find-retained-evidence)
-- [Plan broader investigations](#plan-broader-investigations)
-
-## Read and compose source Evidence
-
-Evidence-producing MCP tools return Evidence directly in `structuredContent`.
-CLI complete JSON returns Evidence directly. CLI summary delivery through
-`--evidence_output` returns `{summary, evidence_bundle}`: `summary` is the view's
-Evidence, and `evidence_bundle` is the export receipt with its path and byte count.
-Read `summary.normalized_result.parent_evidence_id` for the complete source ID;
-pass the receipt's path to `--evidence-bundle` on a later supported CLI command.
-Advertised summary delivery retains the complete source separately;
-complete inline delivery is available where the connected contract says so. Read `normalized_result` for operation data,
+Evidence-producing tools return the complete Evidence record directly in MCP
+`structuredContent` and CLI JSON. Read `normalized_result` for operation data,
 and cite `evidence_id` when another tool or your explanation needs a stable
 reference. Preserve authority, limitations, coverage, and residual unknowns. If a result
 is incomplete or paginated, continue only when the remaining data matters to
@@ -67,8 +49,6 @@ An input bundle grants no implicit file lookup: `evidence-file` and historical
 graph file selectors are accepted only by contracts advertising them. See the
 [CLI reuse guide](https://github.com/morluto/rea/blob/main/docs/getting-started/cli.md#import-export-and-compare-evidence).
 
-## Inventory and decompilation views
-
 Completed `inspect_artifact` inventory also supports a summary and
 `view: {kind: "inventory", collection: "occurrences", logical_paths: ["package.json", "main.js"]}`.
 Omit `logical_paths` to page all available occurrences; `[]` selects none.
@@ -101,8 +81,6 @@ exact `where.indices`, `addresses`, `procedure_addresses` or `statuses`. Add
 `collection: "pseudocode"` with one row's `index` to page a large body. Batch
 limitations aggregate every item, so do not attribute them to one successful row.
 
-## Unknowns and comparisons
-
 Use `record_unknown` to track unresolved questions in the user's investigation
 and name the authority or environment still required. Supply supporting and
 contradicting evidence IDs. It updates the session registry directly.
@@ -133,8 +111,6 @@ or absence:
 - `verify_reconstruction` evaluates a finite typed specification. A pass covers
   only declared comparable claims, not global equivalence.
 
-## Process captures and environment views
-
 Process captures are opt-in behavioral evidence, not a security sandbox. V3
 captures cannot be upgraded to V4; rerun the original scenario. Distinguish root
 exit from descendant settlement and require freshness when the task needs it.
@@ -188,8 +164,6 @@ catalog and state size checks. `rea environment-build <capture.har> <dir>`
 inspects, projects and exports in one step and prints the same coverage, or
 `null` when the bundle serves replay.
 
-## Native export table pages
-
 For a PE/ELF export question, `inspect_native_exports` accepts `detail: "summary"`
 and retains the complete table. Query `inspect_analysis_view` with
 `view: {kind: "native-exports", collection: "exports", names: ["selected_name"],
@@ -200,69 +174,3 @@ coverage describes selected retained rows; `summary.coverage` or `exports.covera
 still describes the source table, so an empty partial page does not prove absence.
 CLI `inspect-native-exports --detail summary --evidence_output PATH` saves the
 complete bundle for later `inspect-analysis-view --evidence-bundle PATH` requests.
-
-## Recover oversized delivery and find retained Evidence
-
-If MCP reports `resource_constraint` with `details.resource: "transport"`, call
-`inspect_analysis_view` with its reported same-session Evidence reference for a
-summary, one section/module, or a stable page. Use `trace_application_feature`
-once a seed is known, or call `export_evidence_bundle` to write the complete
-session to a selected path. The analysis remains complete in the ledger; avoid
-repeating it merely to request the same oversized response. Complete CLI JSON
-output also streams without a single MCP frame.
-
-When the retained parent ID is unknown, use `get_evidence_bundle` with
-`detail: "summary"` and exact filters for operation, target SHA-256,
-analysis-profile digest or canonical procedure address. Select its returned
-Evidence ID for the next view instead of requesting the complete bundle. When
-that record has no supported view (for example an annotation), read it with
-`detail: "records"` and an `evidence_id` filter; `missing_evidence_links`
-names linked sources this session does not retain.
-`retention: "complete-record"` means the whole record is stored; native
-value-flow truncation and unknown metadata remain separate. For an exported
-portable bundle, use `rea inspect-evidence-bundle` with JSON containing `path`,
-`detail: "summary"` and the same `filters`. Reading that file still requires
-validating its full contents within the local memory budget.
-
-A client can also truncate a successful tool result without a REA transport
-error. Treat that preview as incomplete; use the retained parent ID for smaller
-views or export when the full record is needed. Do not parse the preview as
-canonical JSON or repeat the producer. For JavaScript, read the
-[module-view and trace recipes](javascript-applications.md) before
-drilling into a large graph; a broad bidirectional trace can expand unrelated
-containment relationships even after summary analysis.
-
-## Plan broader investigations
-
-For requests that span multiple features or subsystems, use a staged workflow:
-
-1. Turn the request into a checklist of questions and the evidence each answer
-   needs. Resolve target identity and constraints from the conversation and
-   workspace before asking for information again.
-2. Inspect the current REA session, artifact identity, saved analysis database,
-   bookmarks, and prior evidence. Reuse matching state; do not open duplicate
-   sessions or repeat identical analysis.
-3. Start with the smallest useful overview or inventory. Follow each question
-   from its entry point through relevant data and state changes to its result.
-   Batch related operations around a specific hypothesis, then expand only when
-   the returned evidence leaves a concrete gap.
-4. Inspect relevant packaged resources and configuration alongside code when
-   they affect the question. Use format-aware inventory and parsers; do not
-   infer behavior from filenames, strings, or layout alone.
-5. Corroborate a conclusion with the evidence type it requires. Use runtime
-   observation only when static evidence cannot answer the question and the
-   required host runtime and OS access are available. For JavaScript behavior,
-   run probes against the actual app through the available browser, Electron,
-   or process capture workflow.
-6. Decompose work into independent questions. When parallel workers are
-   available and the questions do not depend on one another, assign distinct
-   scopes, point workers to existing evidence, and ask them to return sources,
-   conclusions, and unresolved gaps. Otherwise, work sequentially.
-7. Keep a concise finding ledger linking each conclusion to Evidence IDs,
-   confidence/evidence type, search boundary, and remaining unknowns. Update
-   the shared index or investigation report so later passes can reuse results.
-
-Before finishing, revisit the original checklist. Mark each question as
-answered, partially answered, or unresolved based on its evidence; keep
-bounded negative searches bounded, and do not describe a broad investigation
-as complete while required questions remain open.

.agents/skills/reverse-engineer-anything/references/firmware-and-raw-images.md

@@ -1,76 +0,0 @@
-# Firmware and raw images
-
-## Firmware regions and extraction
-
-Use `inspect_firmware_regions` when advertised. Use `extract_firmware` when
-extraction is requested, with a caller-selected new absolute output directory.
-These tools use caller-supplied Binwalk/Unblob on Linux; see the
-[firmware guide](https://github.com/morluto/rea/blob/main/docs/guides/firmware/firmware-analysis.md).
-
-## Headerless raw images and firmware containers
-
-For other headerless images (embedded firmware without ELF/Mach-O/PE/MZ
-headers), open with `format: "raw-binary"`, `architecture` (`x86`, `x86_64`,
-`arm`, `arm64`, `6502`, or `m68k`), and `entry_point` (`0x` hex). File offset 0 is mapped at
-that address. Hopper and IDA refuse this interpretation; Ghidra uses
-`BinaryLoader` with a generic language: big-endian for `m68k`, little-endian
-otherwise. Big-endian ARM, Thumb-only, and Cortex-M variants are unsupported.
-`6502` selects NMOS 6502; the entry and complete file mapping must fit within
-`0x0000..0xffff`. 65C02, 65816, cartridge containers, bank switching, and mapper
-semantics are unsupported. `m68k` requires an even entry and decodes the 68040
-superset of the 68000 family; Amiga/Atari containers and vector-table entry
-discovery are unsupported. Windows Ghidra P0 admits raw images only for `6502`. See [raw binary guide](https://github.com/morluto/rea/blob/main/docs/providers/raw-binary.md).
-
-Intel HEX, S-record, UF2 and DfuSe files are containers, not raw images:
-`inspect_artifact` lists address regions (UF2 per familyID, DfuSe per element
-with its alternate setting), and `extract_artifact` writes each region. Open an
-extracted region as `raw-binary` with its start address as `entry_point`. UF2
-numbering gaps leave coverage unknown; a DfuSe suffix CRC mismatch follows
-`integrity_policy`. See [UF2 and DfuSe](https://github.com/morluto/rea/blob/main/docs/uf2-dfuse.md).
-
-## ESP images
-
-For an ESP32-family app or bootloader image, `open_binary` then
-`inspect_artifact` with `detail: "summary"`. `root_format_metadata` holds the
-observed `header` and `descriptor` (its `kind` is the app or bootloader role)
-and the derived `chip`, `checksum`, `appended_sha256` and
-`undescribed_trailing` ranges. Segment rows (`segment-NN.bin`) carry
-`load_addr`, `classification` (`mapped`, `loaded`, `not-loaded` or `unknown`,
-per ESP-IDF `should_map`/`should_load`; RAM ranges are not checked) and
-`source_location`; select them with `inspect_analysis_view` and
-`logical_paths`. Signature blocks are `unverified`; `public_key_sha256`
-matches eFuse key digests.
-
-Unknown `source_coverage` means truncation or undescribed trailing bytes, such
-as the flash segments of a `--ram-only-header` image; do not infer absence
-from it. Erased flash is described. Integrity mismatches are facts, not
-refusals. ESP8266 images are refused, and flash-encrypted images are not
-recognized. Segments are not disassembled, and RISC-V or Xtensa segments
-cannot be opened as raw-binary. See
-[ESP images](https://github.com/morluto/rea/blob/main/docs/esp-image.md).
-
-## ESP flash images
-
-A whole-flash dump opens as `esp-flash-image`. `root_format_metadata` holds
-`partition_table` (its `method`: `default`, `caller` or a derived
-`scan`), `bootloader` and `apps` ESP image facts, the `otadata` records,
-`partitions_outside_dump` and `boot_selection`. Every table has a
-`boot_selection`: its `basis` names the bootloader's branch (`no-otadata`
-without otadata, `none` when the bootloader rejects the table, `unknown`
-when a record is missing), and it lists its `assumptions`;
-`running_partition` is always `unknown`. Each image names its entry
-`path`. With `detail: "summary"` the root kind is `esp-flash-image-summary`
-and each image is a compact `summary` (chip, entry point, segment count,
-classified load ranges, signature block count, descriptor identity,
-integrity); complete detail keeps every segment. Partition rows
-(`partitions/<label>.bin`) carry the declared `type`, `subtype`, names,
-`flash_address`, `size` and flags; `encrypted` is a storage flag, not
-proof of ciphertext. `written_offset`/`written_end` bound the bytes that
-are not erased: an app slot whose facts say `erased` can still hold an older
-image, and a limitation says so. For a dump read from another flash address, call
-`open_binary` with `format: "esp-flash-image"` and `flash_offset`; an
-`esp-image` whose `flash_dump` is set names that offset in a next probe; a
-relocated table can be named with `partition_table_offset`. No table found
-means unknown, often flash encryption. Extraction writes `nvs_keys` as
-ordinary data. See
-[ESP flash images](https://github.com/morluto/rea/blob/main/docs/esp-flash-image.md).

.agents/skills/reverse-engineer-anything/references/format-inspectors.md

@@ -1,358 +0,0 @@
-# Offline format and metadata inspection
-
-Read only the sections needed for the selected task.
-
-- [Go build metadata](#go-build-metadata)
-- [Model files](#model-files)
-- [IL2CPP metadata](#il2cpp-metadata)
-- [Rust dependency metadata](#rust-dependency-metadata)
-- [PE Authenticode certificate tables](#pe-authenticode-certificate-tables)
-- [PE import and delay-load tables](#pe-import-and-delay-load-tables)
-- [PE TLS callbacks and load configuration](#pe-tls-callbacks-and-load-configuration)
-- [Binary hardening](#binary-hardening)
-- [ELF note tables](#elf-note-tables)
-- [Apple IPS crash reports](#apple-ips-crash-reports)
-- [Linux kernel modules](#linux-kernel-modules)
-- [CPython pyc files](#cpython-pyc-files)
-- [Erlang BEAM files](#erlang-beam-files)
-- [SQLite snapshots](#sqlite-snapshots)
-- [Recorded Linux crashes](#recorded-linux-crashes)
-- [Offline ELF layout](#offline-elf-layout)
-- [Offline WASM](#offline-wasm)
-- [Offline APK signatures](#offline-apk-signatures)
-- [Offline PE resource inventory](#offline-pe-resource-inventory)
-- [Offline PE and ELF export tables](#offline-pe-and-elf-export-tables)
-- [EVM bytecode](#evm-bytecode)
-- [Embedded GPU code objects](#embedded-gpu-code-objects)
-
-## Go build metadata
-
-Use `inspect_go_binary` for an explicit local ELF, PE or Mach-O (universal
-files need `architecture`) when the
-question concerns the embedded compiler version, module/dependency versions,
-local replacements or build settings. No `open_binary`, Go installation or
-target execution is required. The CLI equivalent is `inspect-go-binary PATH`.
-Preserve artifact SHA-256, original file ranges, framed module bytes and every
-unparsed module-text line. A missing record is an unknown, not proof of a
-non-Go binary; observed metadata does not authenticate its claims. Function,
-source and type recovery remain a separate native-analysis question.
-
-See the [Go binary guide](https://github.com/morluto/rea/blob/main/docs/guides/native/go-binaries.md).
-
-## Model files
-
-Optional `view` selects one page in the initial call. Batch metadata keys or
-tensor names and select only needed fields; do not infer model behavior from
-declared architecture or tensor types.
-
-Use `inspect_model_artifact` (`inspect-model-artifact PATH`) for local GGUF v2/v3
-and safetensors declarations without a model runtime. Header-only mode does not
-read weights or establish full-file identity. `hash: "full"` explicitly streams
-all bytes. Retained `model-artifact` views page `metadata`, `tensors` and derived
-`types`, with exact batch filters and selected fields. Arrays retain typed counts
-and eight-element previews; omitted values, unknown types and runtime behavior
-stay explicit. See [model files](https://github.com/morluto/rea/blob/main/docs/model-artifacts.md).
-
-## IL2CPP metadata
-
-Use `inspect_il2cpp_metadata` for an explicit local Unity `global-metadata.dat`
-(versions 24, 27, 29, 31 and 39) when the question concerns assembly images,
-names, member owners, string literals, namespaces or index ranges. No `open_binary`, Unity installation or target
-execution is required. The CLI equivalent is `inspect-il2cpp-metadata PATH`.
-MCP defaults to counts with complete retained Evidence. Query `sections`,
-`images`, `types`, `methods`, `fields`, `properties`, `events`, `parameters` or
-`string_literals` through `inspect_analysis_view`; use exact names,
-batch indices and selected fields. Row indices are scoped by artifact SHA-256
-and collection; page offsets count filtered matches. Parameters support batch
-`method_indices` to read one method's parameters directly. Historical reports
-without member collections retain unknown counts rather than empty inventories. Preserve
-artifact SHA-256 and index widths. Unrecognized magic may mean encryption and
-is unsupported, not decrypted.
-
-Optional matching `binary_path` enables static native addresses and type
-references. Query `method_addresses` with indices or addresses/states, preserving
-every shared-body method and both artifact identities. Without a linked binary,
-native counts remain unknown. Byte-pattern fallback is inferred; no runtime
-behavior or same-build pairing is proved.
-See [IL2CPP metadata](https://github.com/morluto/rea/blob/main/docs/il2cpp-metadata.md).
-
-## Rust dependency metadata
-
-For selected crates, use `view: {collection: "packages", names: [...],
-fields: ["name", "version", "source"]}` on the first call. Include `dependencies`
-explicitly for direct index references. Select `detail: "summary"` for counts and
-ranges; retained Rust package/edge views support later filters. Keep complete
-parent Evidence accessible; CLI compact delivery requires `--evidence_output`.
-
-Use `inspect_rust_binary` for an explicit local ELF, PE, or Mach-O (universal
-files need `architecture`) when
-the question concerns the cargo-auditable crate list embedded in `.dep-v0`
-(Mach-O: `__DATA,.dep-v0`). No `open_binary`, Rust installation, or target
-execution is required. The CLI equivalent is `inspect-rust-binary PATH`.
-Preserve artifact SHA-256, package order, dependency indices, and the section
-file range. A missing section is null metadata, not proof the binary has no
-dependencies. An omitted package kind stays null. A rustc commit hash is
-inferred from a read-only `/rustc/<40-hex>/` path and does not by itself
-identify the compiler. See [Rust binaries](https://github.com/morluto/rea/blob/main/docs/rust-binaries.md).
-
-## PE Authenticode certificate tables
-
-Use `inspect_pe_certificates` for an explicit local PE32/PE32+ image when the
-question concerns the Authenticode certificate table, WIN_CERTIFICATE types, or
-embedded PKCS#7 signer and X.509 identity fields. No `open_binary`, Windows SDK,
-or target execution is required. The CLI equivalent is
-`inspect-pe-certificates PATH`. Preserve artifact SHA-256, table file ranges,
-payload hashes, original validity-time spellings, and
-`subject_key_identifier_hex` when the signer uses that form. A missing
-`IMAGE_DIRECTORY_ENTRY_SECURITY` directory is observed absence of that table,
-not proof the image is unsigned in every catalog or overlay sense. Signatures,
-chains, timestamps, and Authenticode digest coverage remain unobserved. See
-[PE Authenticode certificate tables](https://github.com/morluto/rea/blob/main/docs/pe-certificates.md).
-
-## PE import and delay-load tables
-
-Use `inspect_pe_imports` for an explicit local PE32/PE32+ image when the
-question concerns imported DLL and function names, ordinals, delay-load
-descriptors, or the pefile import hash. No `open_binary`, Windows SDK, or
-target execution is required. The CLI equivalent is `inspect-pe-imports PATH`.
-Preserve artifact SHA-256, directory file ranges, original DLL spellings, and
-ILT/IAT RVAs. A missing `IMAGE_DIRECTORY_ENTRY_IMPORT` directory is observed
-absence of that table, not proof the image never imported APIs through another
-table or overlay. Bound snapshots, loaded IAT contents, and export-forward
-resolution remain unobserved. See
-[PE import and delay-load tables](https://github.com/morluto/rea/blob/main/docs/pe-imports.md).
-
-## PE TLS callbacks and load configuration
-
-Preserve each callback's RVA, file offset and section alongside its VA and the
-size-covered declaration fields. A missing directory is observed absence of
-that declaration.
-
-Use `inspect_pe_load_config` for an explicit local PE32/PE32+ image when the
-question concerns code that runs before the entry point through TLS callbacks,
-or the security cookie, SafeSEH, CFG, EH-continuation and XFG declarations in
-the load configuration. No `open_binary`, Windows SDK, or target execution is
-required. The CLI equivalent is `inspect-pe-load-config PATH`. Preserve artifact
-SHA-256, directory and callback-array file ranges, and callback VAs as
-hexadecimal strings. Fields outside the declared `Size` are `null`. Guard-flag
-mitigations carry `evidence_kind: "inferred"`; enforcement remains unobserved.
-See
-[PE TLS callbacks and load configuration](https://github.com/morluto/rea/blob/main/docs/pe-load-config.md).
-
-## Binary hardening
-
-Each property reports `enabled`, `disabled`, `partial`, `unknown`, or
-`not_applicable`, with the header field or import behind it.
-
-Use `inspect_binary_hardening` for an explicit local ELF, PE, or Mach-O file
-when the question concerns PIE or ASLR, NX, RELRO, stack-protector or FORTIFY
-signs, control-flow flags, or stripped state. No `open_binary`, pwntools, or
-target execution is required. The CLI equivalent is
-`inspect-binary-hardening PATH`. Universal Mach-O files return one image per
-slice. A missing import is `unknown`, not proof the protection was omitted.
-Authenticode and Mach-O code-signature rows report presence, not validity.
-`hardened_runtime` stays unknown and names `inspect_signature`. See
-[binary hardening](https://github.com/morluto/rea/blob/main/docs/binary-hardening.md).
-
-## ELF note tables
-
-Retain each note's owner, type, descriptor SHA-256, and PT_NOTE/SHT_NOTE ranges.
-
-Use `inspect_elf_notes` for an explicit local ELF32/ELF64 image when the
-question concerns PT_NOTE/SHT_NOTE owners, GNU build-id, or GNU ABI-tag
-fields. No `open_binary` or target execution is required. The CLI equivalent
-is `inspect-elf-notes PATH`. Preserve artifact SHA-256, table file ranges,
-descriptor hashes, and original owner spellings. A missing table is observed
-absence of those declarations, not proof the image never carried notes in
-another container. See
-[ELF note tables](https://github.com/morluto/rea/blob/main/docs/elf-notes.md).
-
-## Apple IPS crash reports
-
-Use `inspect_apple_ips` for an explicit local Apple `.ips` file when the
-question concerns crash metadata, exception and termination facts, threads,
-usedImages, lossless registers, or documented crash classes. No `open_binary`,
-Xcode, atos, or target execution is required. The CLI equivalent is
-`inspect-apple-ips PATH`. Preserve artifact SHA-256, `bug_type` as a string,
-uppercase image UUIDs, and integer literals that exceed IEEE-754 range. Only
-`bug_type` `"309"` yields a crash body; other DiagnosticReports types return
-no crash result. Opened Mach-O and dSYM UUID joins remain unobserved. See
-[Apple IPS crash reports](https://github.com/morluto/rea/blob/main/docs/apple-ips.md).
-
-## Linux kernel modules
-
-Use `inspect_kernel_module` for an explicit local ELF32/ELF64 relocatable
-object when the question concerns `.modinfo` license, vermagic, alias,
-depends, or parm strings, the `__versions` symbol CRCs, or an appended module
-signature trailer. No `open_binary`, Linux host, or `modinfo` program is
-required. The CLI equivalent is `inspect-kernel-module PATH`. Preserve
-artifact SHA-256, key order, duplicate keys, CRC hex, and section file ranges.
-A missing section is observed absence when section names are known, not proof
-the module never carried that metadata. `.gnu.linkonce.this_module` is reported
-as present or absent; `struct module` stays unknown because its layout changes
-with the kernel version. `__ksymtab` records are not decoded. The PKCS#7 range
-and its SHA-256 are observed; certificate, signer, and digest coverage remain
-unvalidated. An absent trailer is not proof the module is unsigned in another
-container. gzip, xz, and zstd whole-file containers are unsupported and name
-`external_decompression` as the next probe: use an external codec utility to
-decompress into a separate file, then call `inspect_kernel_module` on that file. See
-[Linux kernel modules](https://github.com/morluto/rea/blob/main/docs/kernel-modules.md).
-
-## CPython pyc files
-
-Use `inspect_python_pyc` for an explicit local CPython 3.7–3.13 `.pyc` when the
-question concerns the header magic, PEP 552 source hash or timestamp, nested
-code-object names, or bytecode identity. No `open_binary`, Python installation,
-or target execution is required. The CLI equivalent is `inspect-python-pyc PATH`.
-Preserve artifact SHA-256, the 16-byte header fields, nested code names, and
-bytecode SHA-256. Bytecode is not decompiled. A decoded header does not prove
-the matching `.py` is present. See [CPython pyc inspection](https://github.com/morluto/rea/blob/main/docs/python-pyc.md).
-
-## Erlang BEAM files
-
-Use `inspect_erlang_beam` for an explicit local `FOR1`/`BEAM` file when the
-question concerns IFF chunks, atom names, exports, imports, lambdas, or the
-Code header. No `open_binary`, Erlang installation, or bytecode execution is
-required. The CLI equivalent is `inspect-erlang-beam PATH`. Preserve artifact
-SHA-256, chunk file ranges, 1-based atom indices, and original atom spellings.
-Missing optional tables stay null. For a few facts, use `detail: "summary"` with
-a `beam` view selecting a collection, exact names/indices and fields; read later
-pages from `parent_evidence_id` or the complete Evidence bundle. Same-name
-exports retain every arity and original atom index. CLI summary delivery requires
-`--evidence_output`. Null table counts remain distinct from decoded empty tables. See
-[Erlang BEAM files](https://github.com/morluto/rea/blob/main/docs/erlang-beam.md).
-
-## SQLite snapshots
-
-Use `inspect_sqlite_database` with an explicit local database snapshot for its
-schema and optional rows from one exact ordinary table. It requires Node.js
-24.x >=24.15 or 26+ with the native `DatabaseSync.limits` API. It also consumes the
-existing sibling `-wal`; retain both original digests when citing its result.
-Default output is a compact inventory; a selected table expands only its own
-schema and samples 20 rows. Select `columns` to avoid irrelevant or large cells,
-and request `schema_scope: "database"` only for complete schema details.
-Choose `row_limit` when a finite sample is useful and keep truncation and
-unspecified row order explicit. Virtual tables, shadow tables and views are
-schema facts, not row-read targets. REA inspects private copies and leaves
-the source files untouched; obtain a coherent quiescent database/WAL snapshot
-before inspection. See [SQLite snapshots](https://github.com/morluto/rea/blob/main/docs/guides/data/sqlite-databases.md).
-
-## Recorded Linux crashes
-
-Use `inspect_recorded_crash` with an explicit Linux x86-64 ELF core path to
-inspect historical thread registers, signals, raw notes and original file
-ranges. It is independent of the active disassembler target. Source-bound
-register values and note bytes are observations; missing notes, signal-thread
-association and current executable/library identity remain unknown. PIDs are
-historical metadata and never authorize live attach or control.
-
-The optional `include_debugger_context` facet adds mapping candidates through
-caller-supplied GDB/pwndbg in an owned core-only session. Display names do not
-establish current file identity; zero reported flags leave permissions unknown.
-Requested unavailable context fails with setup guidance. See
-[recorded crashes](https://github.com/morluto/rea/blob/main/docs/guides/native/recorded-crashes.md)
-for exact upstream profiles, bounds and verification coverage.
-
-## Offline ELF layout
-
-Use `inspect_binary_layout` with an explicit local ELF path for file-backed
-sections, symbols, relocations, linkage names, and static mitigation inferences
-without opening a disassembler target. When that complete record is already
-retained, call `inspect_analysis_view` for a summary, mitigations or linkage
-facet, one section or symbol, or a stable page. Do not re-run the decoder to
-read a single object.
-
-## Offline WASM
-
-Supply WABT 1.0.42 through `REA_WABT_BIN_DIRECTORY`. Select JavaScript glue and
-candidate paths explicitly, preserving URL/path ambiguity and exact byte/tool
-identity; no implicit fetch is performed.
-
-Use `inspect_wasm_artifact` with caller-supplied WABT for selected local bytes.
-For counts, validation and WAT identity, select `detail: "summary"` on the first
-MCP call. The complete original Evidence stays retained; use
-`normalized_result.parent_evidence_id` for exact exports or text pages. Omitted
-or complete detail keeps the existing complete result.
-For a completed result, use `inspect_analysis_view` with its reported retained
-reference for a summary or `view: {kind: "wasm", facet: "exports", offset: 0, limit: 32}`.
-Facets also include sections, imports, candidates, glue, WAT, headers, details
-and tool profile. Text offsets count UTF-16 code units; follow `next_offset`.
-The complete source remains retained after an oversized MCP reply. No target
-execution or network acquisition is implied, and WAT is decoded representation.
-
-For exact core-module import/export differences, use `compare_wasm_interfaces`
-with two complete inspection Evidence records (or current-session retained
-references) and explicit scope. Preserve unknown types/duplicate names; static
-interface equality is not runtime compatibility. CLI accepts complete inline
-Evidence in `rea compare-wasm-interfaces input.json --json`, or exact references
-with `--evidence-bundle /absolute/path/evidence.json`. Use the complete parent
-ID when the inspection returned a summary.
-
-See the [WASM guide](https://github.com/morluto/rea/blob/main/docs/guides/wasm/wasm-artifacts.md).
-
-## Offline APK signatures
-
-Use `inspect_apk_signature` for a selected local APK/ZIP/AAB. Default MCP summaries
-retain complete Evidence. Select `view.collection: signers/digests/lineage`,
-with scheme or ID batches, fields and paging; use `inspect_analysis_view` kind
-`apk-signature` for retained reads after deletion. IDs retain artifact/scheme
-scope and signer links; `fields: []` keeps identity links. Empty pages preserve
-partial decoding reasons and unknown authenticity. CLI compact delivery needs
-`--evidence_output` to preserve the complete parent.
-It reads the APK
-Signing Block (v2/v3/v3.1) and v1 `META-INF` signing without executing anything,
-and reports each signer's certificate facts (for v1, the certificate the PKCS#7
-block's SignerInfo names), the declared v3 rotation lineage,
-the declared source-stamp certificate and, for SHA-256/SHA-512 digests, whether
-the declared content digest matches the current bytes. That match is not a
-signature verification: anyone who changes the bytes can recompute the digest.
-`posture` summarises v1-only signing (which cannot tell a v1-only APK from one
-whose v2/v3 block was removed), observed signer agreement across schemes,
-whether the v1 signer equals the block-scheme signer (`false` is notable),
-whether every differing signer appears in a declared (unverified) rotation
-lineage, and the strongest scheme.
-It never claims authenticity: no signature or lineage is cryptographically
-verified.
-
-See the [APK signature guide](https://github.com/morluto/rea/blob/main/docs/apk-signature.md).
-
-## Offline PE resource inventory
-
-Use `inspect_pe_resources` with an absolute `path`, or
-`rea inspect-pe-resources ./selected.exe --json`, for portable PE32/PE32+
-resource inspection without opening a native target. Preserve returned Evidence:
-type/name/language IDs and UTF-16 names, original directory/data/payload ranges,
-code pages, payload hashes and static icon-group references. Same-language icon
-resolution is explicit; missing references and size mismatch remain visible.
-Other payloads are opaque, and this operation does not decode images or simulate
-Windows resource loading. Consult the budgets and supported tree profile in
-[offline binary diagnostics](https://github.com/morluto/rea/blob/main/docs/guides/native/binary-diagnostics.md).
-
-## Offline PE and ELF export tables
-
-Use `inspect_native_exports` with an absolute `path`, or
-`rea inspect-native-exports ./libexample.so --json`, to read a PE export
-directory or ELF dynamic symbol table on any host without opening a native
-target. Ordinal-only, forwarded and hidden-version exports stay distinct;
-partial or unsupported coverage means the inventory is incomplete, not that
-exports are absent. Use `inspect_macho` for Mach-O. See
-[offline binary diagnostics](https://github.com/morluto/rea/blob/main/docs/guides/native/binary-diagnostics.md).
-
-## EVM bytecode
-
-Explicit local EVM bytecode carrier: `inspect_evm_interface` with caller-selected
-`raw` or `hex` encoding. The owned worker deadline is `timeout_ms` (default
-30000 ms, range 1..2147483647, next call). It does not raise the fixed byte,
-address-space, or CPU allowances. Preserve carrier/decoded digests and treat selectors,
-argument strings and mutability as inferred candidates; this performs no chain
-lookup or target execution. For the complete inferred interface without hex or
-duplicate stdout, discover support and select `detail: "summary"`; complete
-Evidence stays retained under its original identity. Use the returned
-`parent_evidence_id` for exact function or `bytecode_hex`/stdout/stderr pages.
-Candidate coverage does not establish interface completeness. See the
-[EVM bytecode guide](https://github.com/morluto/rea/blob/main/docs/guides/evm/evm-bytecode.md).
-
-## Embedded GPU code objects
-
-Embedded CUDA/HIP code objects: `inspect_gpu_code_objects`; inventory targets
-first, then decode selected payloads and query retained GPU Evidence.

.agents/skills/reverse-engineer-anything/references/javascript-applications.md

@@ -1,13 +1,5 @@
 # JavaScript and Electron application artifacts
 
-Read only the sections needed for the selected task.
-
-- [Inventory route candidates without returning the application graph](#inventory-route-candidates-without-returning-the-application-graph)
-- [Read a module without repeating analysis](#read-a-module-without-repeating-analysis)
-- [Trace only the remaining question](#trace-only-the-remaining-question)
-- [Recover an oversized display](#recover-an-oversized-display)
-- [Reusing application Evidence](#reusing-application-evidence)
-
 For captured or bundled JavaScript that needs readable source recovery, use
 `recover_javascript_sources` with an absolute `path` and absent
 `output_directory`. Supply related runtime/shared/lazy files in
@@ -98,9 +90,6 @@ Endpoint candidates remain inferences rather than confirmed network behavior.
 ## Read a module without repeating analysis
 
 Use the actual returned parent ID, on the same connection, as `source.evidence_id`.
-For CLI summary exports, take that ID from
-`summary.normalized_result.parent_evidence_id` and pass `--evidence-bundle` with
-the exported bundle's path to each later `inspect-analysis-view` invocation.
 The following IDs are placeholders to replace with returned values. When the
 module's node ID is not already known, page identities before selecting an item.
 Pages return only node IDs, paths and roles; choose a useful page size and follow

.agents/skills/reverse-engineer-anything/references/native-and-artifacts.md

@@ -1,23 +1,4 @@
-# Native and managed analysis
-
-<a id="native-managed-and-packaged-artifacts"></a>
-
-Read only the sections needed for the selected task.
-
-- [Other artifact guides](#other-artifact-guides)
-- [Apple app resources](#apple-app-resources)
-- [Desktop installation directories](#desktop-installation-directories)
-- [Native targets](#native-targets)
-- [Continue editable Ghidra analysis across processes](#continue-editable-ghidra-analysis-across-processes)
-- [Reuse caller-selected Ghidra analysis](#reuse-caller-selected-ghidra-analysis)
-- [Ghidra startup deadline recovery](#ghidra-startup-deadline-recovery)
-- [Bridge request ceiling](#bridge-request-ceiling)
-- [Selected native facts and call graphs](#selected-native-facts-and-call-graphs)
-- [Static memory and original file bytes](#static-memory-and-original-file-bytes)
-- [DOS MZ with Ghidra](#dos-mz-with-ghidra)
-- [Managed PE/CLI](#managed-pe-cli-guide)
-- [DOS COM loader interpretation](#dos-com-loader-interpretation)
-- [Function annotations in Ghidra](#function-annotations-in-ghidra)
+# Native, managed, and packaged artifacts
 
 For release comparisons on one MCP connection, retain `list_procedures` Evidence
 from each target and reuse its exact IDs after target switches or `close_binary`.
@@ -81,39 +62,264 @@ runtime presence. For compact CLI output, use
 `inspect-desktop-application PATH --detail summary --evidence_output BUNDLE`.
 See [desktop installations](https://github.com/morluto/rea/blob/main/docs/desktop-applications.md).
 
+## Go build metadata
+
+Use `inspect_go_binary` for an explicit local ELF, PE or Mach-O (universal
+files need `architecture`) when the
+question concerns the embedded compiler version, module/dependency versions,
+local replacements, build settings, or static Go string literals packed without
+NUL terminators. Pass `include_string_literals: true`
+(`--include-string-literals`, optional `max_string_literals` /
+`--max-string-literals`) to recover bounded inferred word-aligned `(ptr, len)`
+UTF-8 string slices from read-only data and page them through `go`
+`string_literals` views. No `open_binary`, Go installation or
+target execution is required. The CLI equivalent is `inspect-go-binary PATH`.
+Preserve artifact SHA-256, original file ranges, framed module bytes and every
+unparsed module-text line. A missing record is an unknown, not proof of a
+non-Go binary; observed metadata does not authenticate its claims, and static
+`(ptr, len)` string recovery excludes compiler-inlined stack/immediate strings
+without proving runtime reachability. Function,
+source and type recovery remain a separate native-analysis question.
+
+## Model files
+
+Use `inspect_model_artifact` (`inspect-model-artifact PATH`) for local GGUF v2/v3
+and safetensors declarations without a model runtime. Header-only mode does not
+read weights or establish full-file identity. `hash: "full"` explicitly streams
+all bytes. Retained `model-artifact` views page `metadata`, `tensors` and derived
+`types`, with exact batch filters and selected fields. Arrays retain typed counts
+and eight-element previews; omitted values, unknown types and runtime behavior
+stay explicit. See [model files](https://github.com/morluto/rea/blob/main/docs/model-artifacts.md).
+
+## IL2CPP metadata
+
+Use `inspect_il2cpp_metadata` for an explicit local Unity `global-metadata.dat`
+(versions 24, 27, 29, 31 and 39) when the question concerns assembly images,
+names, member owners, string literals, namespaces or index ranges. No `open_binary`, Unity installation or target
+execution is required. The CLI equivalent is `inspect-il2cpp-metadata PATH`.
+MCP defaults to counts with complete retained Evidence. Query `sections`,
+`images`, `types`, `methods`, `fields`, `properties`, `events`, `parameters` or
+`string_literals` through `inspect_analysis_view`; use exact names,
+batch indices and selected fields. Row indices are scoped by artifact SHA-256
+and collection; page offsets count filtered matches. Parameters support batch
+`method_indices` to read one method's parameters directly. Historical reports
+without member collections retain unknown counts rather than empty inventories. Preserve
+artifact SHA-256 and index widths. Unrecognized magic may mean encryption and
+is unsupported, not decrypted. Linking names to `GameAssembly` or
+`UnityFramework` code addresses remains a separate native-analysis question.
+See [IL2CPP metadata](https://github.com/morluto/rea/blob/main/docs/il2cpp-metadata.md).
+
+## Rust dependency metadata
+
+Use `inspect_rust_binary` for an explicit local ELF, PE, or Mach-O (universal
+files need `architecture`) when
+the question concerns the cargo-auditable crate list embedded in `.dep-v0`
+(Mach-O: `__DATA,.dep-v0`). No `open_binary`, Rust installation, or target
+execution is required. The CLI equivalent is `inspect-rust-binary PATH`.
+Preserve artifact SHA-256, package order, dependency indices, and the section
+file range. A missing section is null metadata, not proof the binary has no
+dependencies. An omitted package kind stays null. A rustc commit hash is
+inferred from a read-only `/rustc/<40-hex>/` path and does not by itself
+identify the compiler. See [Rust binaries](https://github.com/morluto/rea/blob/main/docs/rust-binaries.md).
+
+## PE Authenticode certificate tables
+
+Use `inspect_pe_certificates` for an explicit local PE32/PE32+ image when the
+question concerns the Authenticode certificate table, WIN_CERTIFICATE types, or
+embedded PKCS#7 signer and X.509 identity fields. No `open_binary`, Windows SDK,
+or target execution is required. The CLI equivalent is
+`inspect-pe-certificates PATH`. Preserve artifact SHA-256, table file ranges,
+payload hashes, original validity-time spellings, and
+`subject_key_identifier_hex` when the signer uses that form. A missing
+`IMAGE_DIRECTORY_ENTRY_SECURITY` directory is observed absence of that table,
+not proof the image is unsigned in every catalog or overlay sense. Signatures,
+chains, timestamps, and Authenticode digest coverage remain unobserved. See
+[PE Authenticode certificate tables](https://github.com/morluto/rea/blob/main/docs/pe-certificates.md).
+
+## PE import and delay-load tables
+
+Use `inspect_pe_imports` for an explicit local PE32/PE32+ image when the
+question concerns imported DLL and function names, ordinals, delay-load
+descriptors, or the pefile import hash. No `open_binary`, Windows SDK, or
+target execution is required. The CLI equivalent is `inspect-pe-imports PATH`.
+Preserve artifact SHA-256, directory file ranges, original DLL spellings, and
+ILT/IAT RVAs. A missing `IMAGE_DIRECTORY_ENTRY_IMPORT` directory is observed
+absence of that table, not proof the image never imported APIs through another
+table or overlay. Bound snapshots, loaded IAT contents, and export-forward
+resolution remain unobserved. See
+[PE import and delay-load tables](https://github.com/morluto/rea/blob/main/docs/pe-imports.md).
+
+## PE TLS callbacks and load configuration
+
+Use `inspect_pe_load_config` for an explicit local PE32/PE32+ image when the
+question concerns code that runs before the entry point through TLS callbacks,
+or the security cookie, SafeSEH, CFG, EH-continuation and XFG declarations in
+the load configuration. No `open_binary`, Windows SDK, or target execution is
+required. The CLI equivalent is `inspect-pe-load-config PATH`. Preserve artifact
+SHA-256, directory and callback-array file ranges, and callback VAs as
+hexadecimal strings. Fields outside the declared `Size` are `null`. Guard-flag
+mitigations carry `evidence_kind: "inferred"`; enforcement remains unobserved.
+See
+[PE TLS callbacks and load configuration](https://github.com/morluto/rea/blob/main/docs/pe-load-config.md).
+
+## Binary hardening
+
+Use `inspect_binary_hardening` for an explicit local ELF, PE, or Mach-O file
+when the question concerns PIE or ASLR, NX, RELRO, stack-protector or FORTIFY
+signs, control-flow flags, or stripped state. No `open_binary`, pwntools, or
+target execution is required. The CLI equivalent is
+`inspect-binary-hardening PATH`. Universal Mach-O files return one image per
+slice. A missing import is `unknown`, not proof the protection was omitted.
+Authenticode and Mach-O code-signature rows report presence, not validity.
+`hardened_runtime` stays unknown and names `inspect_signature`. See
+[binary hardening](https://github.com/morluto/rea/blob/main/docs/binary-hardening.md).
+
+## ELF note tables
+
+Use `inspect_elf_notes` for an explicit local ELF32/ELF64 image when the
+question concerns PT_NOTE/SHT_NOTE owners, GNU build-id, or GNU ABI-tag
+fields. No `open_binary` or target execution is required. The CLI equivalent
+is `inspect-elf-notes PATH`. Preserve artifact SHA-256, table file ranges,
+descriptor hashes, and original owner spellings. A missing table is observed
+absence of those declarations, not proof the image never carried notes in
+another container. See
+[ELF note tables](https://github.com/morluto/rea/blob/main/docs/elf-notes.md).
+
+## Apple IPS crash reports
+
+Use `inspect_apple_ips` for an explicit local Apple `.ips` file when the
+question concerns crash metadata, exception and termination facts, threads,
+usedImages, lossless registers, or documented crash classes. No `open_binary`,
+Xcode, atos, or target execution is required. The CLI equivalent is
+`inspect-apple-ips PATH`. Preserve artifact SHA-256, `bug_type` as a string,
+uppercase image UUIDs, and integer literals that exceed IEEE-754 range. Only
+`bug_type` `"309"` yields a crash body; other DiagnosticReports types return
+no crash result. Opened Mach-O and dSYM UUID joins remain unobserved. See
+[Apple IPS crash reports](https://github.com/morluto/rea/blob/main/docs/apple-ips.md).
+
+## Linux kernel modules
+
+Use `inspect_kernel_module` for an explicit local ELF32/ELF64 relocatable
+object when the question concerns `.modinfo` license, vermagic, alias,
+depends, or parm strings, the `__versions` symbol CRCs, or an appended module
+signature trailer. No `open_binary`, Linux host, or `modinfo` program is
+required. The CLI equivalent is `inspect-kernel-module PATH`. Preserve
+artifact SHA-256, key order, duplicate keys, CRC hex, and section file ranges.
+A missing section is observed absence when section names are known, not proof
+the module never carried that metadata. `.gnu.linkonce.this_module` is reported
+as present or absent; `struct module` stays unknown because its layout changes
+with the kernel version. `__ksymtab` records are not decoded. The PKCS#7 range
+and its SHA-256 are observed; certificate, signer, and digest coverage remain
+unvalidated. An absent trailer is not proof the module is unsigned in another
+container. gzip, xz, and zstd whole-file containers are unsupported and name
+`external_decompression` as the next probe: use an external codec utility to
+decompress into a separate file, then call `inspect_kernel_module` on that file. See
+[Linux kernel modules](https://github.com/morluto/rea/blob/main/docs/kernel-modules.md).
+
+## CPython pyc files
+
+Use `inspect_python_pyc` for an explicit local CPython 3.7–3.13 `.pyc` when the
+question concerns the header magic, PEP 552 source hash or timestamp, nested
+code-object names, or bytecode identity. No `open_binary`, Python installation,
+or target execution is required. The CLI equivalent is `inspect-python-pyc PATH`.
+Preserve artifact SHA-256, the 16-byte header fields, nested code names, and
+bytecode SHA-256. Bytecode is not decompiled. A decoded header does not prove
+the matching `.py` is present. See [CPython pyc inspection](https://github.com/morluto/rea/blob/main/docs/python-pyc.md).
+
+## Erlang BEAM files
+
+Use `inspect_erlang_beam` for an explicit local `FOR1`/`BEAM` file when the
+question concerns IFF chunks, atom names, exports, imports, lambdas, or the
+Code header. No `open_binary`, Erlang installation, or bytecode execution is
+required. The CLI equivalent is `inspect-erlang-beam PATH`. Preserve artifact
+SHA-256, chunk file ranges, 1-based atom indices, and original atom spellings.
+Missing optional tables stay null. For a few facts, use `detail: "summary"` with
+a `beam` view selecting a collection, exact names/indices and fields; read later
+pages from `parent_evidence_id` or the complete Evidence bundle. Same-name
+exports retain every arity and original atom index. CLI summary delivery requires
+`--evidence_output`. Null table counts remain distinct from decoded empty tables. See
+[Erlang BEAM files](https://github.com/morluto/rea/blob/main/docs/erlang-beam.md).
+
+## SQLite snapshots
+
+Use `inspect_sqlite_database` with an explicit local database snapshot for its
+schema and optional rows from one exact ordinary table. It requires Node.js
+24.x >=24.15 or 26+ with the native `DatabaseSync.limits` API. It also consumes the
+existing sibling `-wal`; retain both original digests when citing its result.
+Default output is a compact inventory; a selected table expands only its own
+schema and samples 20 rows. Select `columns` to avoid irrelevant or large cells,
+and request `schema_scope: "database"` only for complete schema details.
+Choose `row_limit` when a finite sample is useful and keep truncation and
+unspecified row order explicit. Virtual tables, shadow tables and views are
+schema facts, not row-read targets. REA inspects private copies and leaves
+the source files untouched; obtain a coherent quiescent database/WAL snapshot
+before inspection. See [SQLite snapshots](https://github.com/morluto/rea/blob/main/docs/guides/data/sqlite-databases.md).
+
+## Recorded Linux crashes
+
+Use `inspect_recorded_crash` with an explicit Linux x86-64 ELF core path to
+inspect historical thread registers, signals, raw notes and original file
+ranges. It is independent of the active disassembler target. Source-bound
+register values and note bytes are observations; missing notes, signal-thread
+association and current executable/library identity remain unknown. PIDs are
+historical metadata and never authorize live attach or control.
+
+The optional `include_debugger_context` facet adds mapping candidates through
+caller-supplied GDB/pwndbg in an owned core-only session. Display names do not
+establish current file identity; zero reported flags leave permissions unknown.
+Requested unavailable context fails with setup guidance. See
+[recorded crashes](https://github.com/morluto/rea/blob/main/docs/guides/native/recorded-crashes.md)
+for exact upstream profiles, bounds and verification coverage.
+
+## Offline ELF layout
+
+Use `inspect_binary_layout` with an explicit local ELF path for file-backed
+sections, symbols, relocations, linkage names, and static mitigation inferences
+without opening a disassembler target. When that complete record is already
+retained, call `inspect_analysis_view` for a summary, mitigations or linkage
+facet, one section or symbol, or a stable page. Do not re-run the decoder to
+read a single object.
+
+## Offline WASM
+
+Use `inspect_wasm_artifact` with caller-supplied WABT for selected local bytes.
+For counts, validation and WAT identity, select `detail: "summary"` on the first
+MCP call. The complete original Evidence stays retained; use
+`normalized_result.parent_evidence_id` for exact exports or text pages. Omitted
+or complete detail keeps the existing complete result.
+For a completed result, use `inspect_analysis_view` with its reported retained
+reference for a summary or `view: {kind: "wasm", facet: "exports", offset: 0, limit: 32}`.
+Facets also include sections, imports, candidates, glue, WAT, headers, details
+and tool profile. Text offsets count UTF-16 code units; follow `next_offset`.
+The complete source remains retained after an oversized MCP reply. No target
+execution or network acquisition is implied, and WAT is decoded representation.
+
+## Offline APK signatures
+
+Use `inspect_apk_signature` for a selected local APK/ZIP/AAB. Default MCP summaries
+retain complete Evidence. Select `view.collection: signers/digests/lineage`,
+with scheme or ID batches, fields and paging; use `inspect_analysis_view` kind
+`apk-signature` for retained reads after deletion. IDs retain artifact/scheme
+scope and signer links; `fields: []` keeps identity links. Empty pages preserve
+partial decoding reasons and unknown authenticity. CLI compact delivery needs
+`--evidence_output` to preserve the complete parent.
+It reads the APK
+Signing Block (v2/v3/v3.1) and v1 `META-INF` signing without executing anything,
+and reports each signer's certificate facts (for v1, the certificate the PKCS#7
+block's SignerInfo names), the declared v3 rotation lineage,
+the declared source-stamp certificate and, for SHA-256/SHA-512 digests, whether
+the declared content digest matches the current bytes. That match is not a
+signature verification: anyone who changes the bytes can recompute the digest.
+`posture` summarises v1-only signing (which cannot tell a v1-only APK from one
+whose v2/v3 block was removed), observed signer agreement across schemes,
+whether the v1 signer equals the block-scheme signer (`false` is notable),
+whether every differing signer appears in a declared (unverified) rotation
+lineage, and the strongest scheme.
+It never claims authenticity: no signature or lineage is cryptographically
+verified.
+
 ## Native targets
 
-For an existing IDA MCP configuration, use `open_binary` with the original
-input binary and `provider_id: "ida"`; do not pass an `.idb` or `.i64` database.
-The legacy attached profile binds the already-open GUI input by SHA-256 and
-leaves its database open. The modern headless profile creates and closes an
-owned private database without saving. Installation and registration reuse
-[mrexodia/ida-pro-mcp](https://github.com/mrexodia/ida-pro-mcp); see the
-[IDA provider guide](https://github.com/morluto/rea/blob/main/docs/providers/ida-provider.md).
-For migration to the separate native IDA MCP plugin, follow the guide's
-[legacy attached migration](https://github.com/morluto/rea/blob/main/docs/providers/ida-provider.md#migrate-a-legacy-attached-registration).
-Replace the upstream registration explicitly; modern mrexodia tools are not the
-native profile. Native attachment preserves the database but does not provide
-direct callers; check session availability and the guide's verification limits.
-Proceed directly to `analyze_function`, pseudocode, or function/string searches
-after opening; IDA does not supply `binary_overview`. Consult session availability
-when composing broader workflows. Modern direct callers and unsupported dossier
-facets remain unknown; live IDA results are not replayed from snapshots.
-
-With `REA_KUNA_COMMAND` configured, `provider_id: "kuna"` answers procedure
-lists, lookups, pseudocode, assembly and `analyze_function` from Kuna's cached
-whole-program export. Callers/callees use a separate body-free graph shared by
-the session; `xrefs` returns exact-address incoming sites and filters forwarding
-aliases. These queries and inventory lookups do not trigger a C export. Indirect
-targets remain unknown and can make relationship coverage partial. Reference
-caches expire on close; a fresh CLI process repeats the native reference walk.
-Typed references, CFG, raw-memory tools and annotations remain unsupported. A cold first
-answer can come from a single-function run (its limitations say so); assembly
-waits for the export. For pseudocode and assembly, `raw_result.source` names the
-cached `.c`/`.asm` file and byte span, which you may search directly instead of
-calling per function. See the
-[Kuna provider guide](https://github.com/morluto/rea/blob/main/docs/kuna-provider.md).
-
 After `open_binary`, use focused search, procedure, or function tools directly.
 Use `binary_overview` when target metadata or inventory context helps answer the
 question. Prefer literal search, names, decompilation, callers, callees, and
@@ -349,8 +555,6 @@ that a class is a root class or has no ivars.
 
 ## Managed PE/CLI
 
-<a id="managed-pe-cli-guide"></a>
-
 Start with `inspect_managed_artifact`. REA's canonical managed inspection is
 execution-free: do not claim it loaded, reflected, executed, or resolved the
 assembly. Keep managed/native boundaries and unavailable reconstruction facts
@@ -409,17 +613,81 @@ and distinguish derived metadata from Ghidra database observations. Recovered
 types and native pseudocode are not original C# source. Windows Ghidra P0 has
 no database mutation authority.
 
-For headerless firmware and address-bearing containers, read
-[raw images](firmware-and-raw-images.md#headerless-raw-images-and-firmware-containers).
+## Packages and extraction
 
-## DOS COM loader interpretation
+Use `inspect_artifact` for application bundles, archives, ZIP/APK/IPA/MSIX/AppX,
+ASAR, or DMG inputs when the artifact graph and findings help answer the
+question. It returns the complete artifact graph inline. Cite graph manifest
+IDs when using them.
+
+For an IPA or a macOS `.app`, ZIP, or DMG, pass the inventory Evidence to
+`project_apple_application_graph`. It reports application roots and nested
+bundles by path convention: app extensions, XPC services, frameworks, login
+items, system and driver extensions, and plug-ins. It also lists privileged
+helpers, launchd plists, symlinks, and each bundle's `info_plist_path` and
+executable candidates. Roles are path conventions, not parsed plists; read the
+listed plists with `inspect_plist`.
+
+After `open_binary` on a `.app` or Mach-O, use `trace_dylib_resolution` to see
+which file each `@rpath`, `@loader_path` and `@executable_path` load reaches for
+every executable in the bundle. It also lists missing or weak loads and earlier
+`@rpath` candidates that are absent. Narrow large bundles with `roots` or
+`architecture`. System paths stay undetermined because the dyld shared cache
+provides them.
+
+Use `extract_artifact` when materialized files from a supported format are needed.
+It extracts the active target and accepts optional `integrity_policy`; see the [MCP contracts](https://github.com/morluto/rea/blob/main/docs/reference/mcp-contracts.md).
+It materializes all regular files into a fresh temporary directory chosen by
+REA. Symlinks and encrypted entries are inventory facts, not extractable files.
+The result reports the materialized directory; callers do not choose the
+destination. No separate permission grant is needed.
+
+For classic iNES cartridges, `open_binary` recognizes the byte signature without
+an executable architecture. `inspect_artifact` retains header facts and each
+PRG/CHR file unit's offset, length and SHA-256; its nested inventory's
+`ines.reconstruction` verifies the actual ordered region bytes against the
+whole-file digest. Extraction includes the original header, optional trainer
+and uninterpreted trailing bytes. These file units are not mapper/CPU bank
+maps. NES 2.0, UNIF, dirty legacy headers and truncated payloads are explicitly
+refused. No emulator or 6502 analysis is performed. See the
+[iNES guide](https://github.com/morluto/rea/blob/main/docs/ines-containers.md).
+
+Native DMG traversal automatically uses a read-only mount on supported macOS
+hosts, with an owned temporary mount directory and cleanup. It needs no approval
+flag. Unsupported hosts or mount failures remain explicit limitations; do not
+claim child inventory when only root identity is available. DMG extraction is
+unavailable through `extract_artifact`. To access DMG files on macOS, create a
+read-only mount with your own tools, select files from that mount for analysis,
+and detach the mount you created when finished. REA's inspection mount is
+temporary, not a retained export of the image's contents.
 
 For headerless DOS COM, explicitly open with `format: "dos-com"` (CLI
 `--target-format dos-com`). Inspect the load image before trusting function
 analysis: the entry is `0x10100`, file offset zero, with imposed real-mode segment
 context. PSP/stack/device state remains unmodeled. See [DOS guide](https://github.com/morluto/rea/blob/main/docs/providers/ghidra-dos.md).
 
-## Function annotations in Ghidra
+Use `inspect_byte_entropy` to triage high- and low-entropy ranges before extraction.
+
+For other headerless images (embedded firmware without ELF/Mach-O/PE/MZ
+headers), open with `format: "raw-binary"`, `architecture` (`x86`, `x86_64`,
+`arm`, `arm64`, `6502`, or `m68k`), and `entry_point` (`0x` hex). File offset 0 is mapped at
+that address. Hopper and IDA refuse this interpretation; Ghidra uses
+`BinaryLoader` with a generic language: big-endian for `m68k`, little-endian
+otherwise. Big-endian ARM, Thumb-only, and Cortex-M variants are unsupported.
+`6502` selects NMOS 6502; the entry and complete file mapping must fit within
+`0x0000..0xffff`. 65C02, 65816, cartridge containers, bank switching, and mapper
+semantics are unsupported. `m68k` requires an even entry and decodes the 68040
+superset of the 68000 family; Amiga/Atari containers and vector-table entry
+discovery are unsupported. Windows Ghidra P0 admits raw images only for `6502`. See [raw binary guide](https://github.com/morluto/rea/blob/main/docs/providers/raw-binary.md).
+
+Intel HEX, S-record, UF2 and DfuSe files are containers, not raw images:
+`inspect_artifact` lists address regions (UF2 per familyID, DfuSe per element
+with its alternate setting), and `extract_artifact` writes each region. Open an
+extracted region as `raw-binary` with its start address as `entry_point`. UF2
+numbering gaps leave coverage unknown; a DfuSe suffix CRC mismatch follows
+`integrity_policy`. See [UF2 and DfuSe](https://github.com/morluto/rea/blob/main/docs/uf2-dfuse.md).
+
+### Function annotations in Ghidra
 
 Fresh-import sessions admit annotations; existing-project reuse is read-only.
 Use `annotate_native_function` for one function name and/or entry comments, with at least one explicit change. Review its annotation readback and refreshed dossier inline. Changes are atomic; empty comments clear them, omitted fields preserve them. Later MCP calls observe edits. Normal close saves them when owned Program checkpoint mode is enabled; ephemeral mode discards them. CLI `annotate-native-function` follows the same setting when closing after its updated result. Select the [checkpoint workflow](#continue-editable-ghidra-analysis-across-processes) before edits that must survive a later process. Original executable bytes are unchanged; edits invalidate immutable snapshots. Windows P0 does not admit database mutations. For naming only, `set_address_name` / `set_addresses_names` also work with Ghidra: they name function entries or data addresses (primary labels) and return compact per-address success booleans instead of a dossier. Ghidra rejects batch addresses that request the same name or a name another selected address holds; `raw_result.failures` gives each failure's reason.
@@ -439,33 +707,139 @@ architecture, provider-owned mapping and selected-image commitments. Equal
 numeric addresses alone cannot establish correspondence; inspect retained
 source Evidence and coverage when the match remains ambiguous.
 
-## Other artifact guides
+## Offline PE resource inventory
 
-Read the owning page for offline formats, containers or firmware. These explicit
-anchors preserve older links without creating duplicate searchable sections.
+Use `inspect_pe_resources` with an absolute `path`, or
+`rea inspect-pe-resources ./selected.exe --json`, for portable PE32/PE32+
+resource inspection without opening a native target. Preserve returned Evidence:
+type/name/language IDs and UTF-16 names, original directory/data/payload ranges,
+code pages, payload hashes and static icon-group references. Same-language icon
+resolution is explicit; missing references and size mismatch remain visible.
+Other payloads are opaque, and this operation does not decode images or simulate
+Windows resource loading. Consult the budgets and supported tree profile in
+[offline binary diagnostics](https://github.com/morluto/rea/blob/main/docs/guides/native/binary-diagnostics.md).
 
-- <a id="go-build-metadata"></a>[Go build metadata](format-inspectors.md#go-build-metadata)
-- <a id="model-files"></a>[Model files](format-inspectors.md#model-files)
-- <a id="il2cpp-metadata"></a>[IL2CPP metadata](format-inspectors.md#il2cpp-metadata)
-- <a id="rust-dependency-metadata"></a>[Rust dependency metadata](format-inspectors.md#rust-dependency-metadata)
-- <a id="pe-authenticode-certificate-tables"></a>[PE Authenticode certificate tables](format-inspectors.md#pe-authenticode-certificate-tables)
-- <a id="pe-import-and-delay-load-tables"></a>[PE import and delay-load tables](format-inspectors.md#pe-import-and-delay-load-tables)
-- <a id="pe-tls-callbacks-and-load-configuration"></a>[PE TLS callbacks and load configuration](format-inspectors.md#pe-tls-callbacks-and-load-configuration)
-- <a id="binary-hardening"></a>[Binary hardening](format-inspectors.md#binary-hardening)
-- <a id="elf-note-tables"></a>[ELF note tables](format-inspectors.md#elf-note-tables)
-- <a id="apple-ips-crash-reports"></a>[Apple IPS crash reports](format-inspectors.md#apple-ips-crash-reports)
-- <a id="linux-kernel-modules"></a>[Linux kernel modules](format-inspectors.md#linux-kernel-modules)
-- <a id="cpython-pyc-files"></a>[CPython pyc files](format-inspectors.md#cpython-pyc-files)
-- <a id="erlang-beam-files"></a>[Erlang BEAM files](format-inspectors.md#erlang-beam-files)
-- <a id="sqlite-snapshots"></a>[SQLite snapshots](format-inspectors.md#sqlite-snapshots)
-- <a id="recorded-linux-crashes"></a>[Recorded Linux crashes](format-inspectors.md#recorded-linux-crashes)
-- <a id="offline-elf-layout"></a>[Offline ELF layout](format-inspectors.md#offline-elf-layout)
-- <a id="offline-wasm"></a>[Offline WASM](format-inspectors.md#offline-wasm)
-- <a id="offline-apk-signatures"></a>[Offline APK signatures](format-inspectors.md#offline-apk-signatures)
-- <a id="packages-and-extraction"></a>[Packages and extraction](packages-and-archives.md#packages-and-extraction)
-- <a id="offline-pe-resource-inventory"></a>[Offline PE resource inventory](format-inspectors.md#offline-pe-resource-inventory)
-- <a id="offline-pe-and-elf-export-tables"></a>[Offline PE and ELF export tables](format-inspectors.md#offline-pe-and-elf-export-tables)
-- <a id="godot-pck"></a>[Godot PCK](packages-and-archives.md#godot-pck)
-- <a id="esp-images"></a>[ESP images](firmware-and-raw-images.md#esp-images)
-- <a id="esp-flash-images"></a>[ESP flash images](firmware-and-raw-images.md#esp-flash-images)
-- <a id="bun-standalone-executables"></a>[Bun standalone executables](packages-and-archives.md#bun-standalone-executables)
+## Offline PE and ELF export tables
+
+Use `inspect_native_exports` with an absolute `path`, or
+`rea inspect-native-exports ./libexample.so --json`, to read a PE export
+directory or ELF dynamic symbol table on any host without opening a native
+target. Ordinal-only, forwarded and hidden-version exports stay distinct;
+partial or unsupported coverage means the inventory is incomplete, not that
+exports are absent. Use `inspect_macho` for Mach-O. See
+[offline binary diagnostics](https://github.com/morluto/rea/blob/main/docs/guides/native/binary-diagnostics.md).
+
+For exact core-module import/export differences, use `compare_wasm_interfaces`
+with two complete inspection Evidence records (or current-session retained
+references) and explicit scope. Preserve unknown types/duplicate names; static
+interface equality is not runtime compatibility. CLI accepts complete inline
+Evidence in `rea compare-wasm-interfaces input.json --json`, or exact references
+with `--evidence-bundle /absolute/path/evidence.json`. Use the complete parent
+ID when the inspection returned a summary.
+
+## Godot PCK
+
+For a standalone PCK, `open_binary` then `inspect_artifact` with
+`detail: "summary"` retains the complete static inventory. Use the returned
+`parent_evidence_id` with `inspect_analysis_view` inventory occurrences filtered
+by exact `logical_paths` or `occurrence_ids`, and join `artifact_id` to nodes
+filtered by `artifact_ids`. Select only needed fields; identity links remain.
+Prefer `inspect-artifact --detail summary --evidence_output PATH` for CLI tasks;
+the same CLI discovers embedded packs via their EOF trailer without opening a
+native analysis provider. Normal native opening remains unchanged.
+
+Distinguish declared MD5 from observed SHA-256 and graph/page completeness from
+`source_coverage`. Encrypted directories and sparse bundles have unknown entry
+coverage; encrypted members have unknown content identity. An empty filtered
+page cannot prove absence in unknown coverage. Retained views are historical,
+not fresh filesystem checks. No decryption, Godot resource decoding, GDScript
+decompilation or target execution is provided. See
+[Godot PCK](https://github.com/morluto/rea/blob/main/docs/godot-pck.md).
+
+UnityFS AssetBundle containers (`.bundle`, `.ab`, YooAsset packages and other
+byte-identified files) list `CAB-*` SerializedFiles and `.resS` members with
+header and node facts; none/LZ4/LZ4HC member blocks stream on demand. Bundles
+declaring asset-bundle encryption keep header facts with unknown directory
+coverage; LZMA member bytes retain named occurrences with unavailable hashes.
+Virtual member offsets are not physical carrier locations. Format 6–8 readers
+cache one decoded block and support retained filtered/paged views. No
+decryption or SerializedFile object decoding is provided. See
+[UnityFS](https://github.com/morluto/rea/blob/main/docs/unityfs.md).
+
+WeChat mini-program packages (`.wxapkg` files with `0xBE`/`0xED` marks) list
+members with declared names and absolute carrier offsets; member bytes are
+stored verbatim. `V1MMWX` PC-client packages report `encrypted` directory
+status with unknown coverage and are refused on extraction; no decryption is
+attempted. See
+[wxapkg](https://github.com/morluto/rea/blob/main/docs/wxapkg.md).
+
+U-Boot legacy uImages use the same inspection/extraction workflows. Prefer a
+retained summary and selected inventory views for header facts or component
+IDs. Header addresses/CPU/OS are declarations; payloads remain as stored.
+Multi-file components retain their aligned physical ranges; the full payload
+is also materialized. Unknown name text retains its original 32 bytes. See
+[U-Boot uImage](https://github.com/morluto/rea/blob/main/docs/uimage.md).
+
+## ESP images
+
+For an ESP32-family app or bootloader image, `open_binary` then
+`inspect_artifact` with `detail: "summary"`. `root_format_metadata` holds the
+observed `header` and `descriptor` (its `kind` is the app or bootloader role)
+and the derived `chip`, `checksum`, `appended_sha256` and
+`undescribed_trailing` ranges. Segment rows (`segment-NN.bin`) carry
+`load_addr`, `classification` (`mapped`, `loaded`, `not-loaded` or `unknown`,
+per ESP-IDF `should_map`/`should_load`; RAM ranges are not checked) and
+`source_location`; select them with `inspect_analysis_view` and
+`logical_paths`. Signature blocks are `unverified`; `public_key_sha256`
+matches eFuse key digests.
+
+Unknown `source_coverage` means truncation or undescribed trailing bytes, such
+as the flash segments of a `--ram-only-header` image; do not infer absence
+from it. Erased flash is described. Integrity mismatches are facts, not
+refusals. ESP8266 images are refused, and flash-encrypted images are not
+recognized. Segments are not disassembled, and RISC-V or Xtensa segments
+cannot be opened as raw-binary. See
+[ESP images](https://github.com/morluto/rea/blob/main/docs/esp-image.md).
+
+## ESP flash images
+
+A whole-flash dump opens as `esp-flash-image`. `root_format_metadata` holds
+`partition_table` (its `method`: `default`, `caller` or a derived
+`scan`), `bootloader` and `apps` ESP image facts, the `otadata` records,
+`partitions_outside_dump` and `boot_selection`. Every table has a
+`boot_selection`: its `basis` names the bootloader's branch (`no-otadata`
+without otadata, `none` when the bootloader rejects the table, `unknown`
+when a record is missing), and it lists its `assumptions`;
+`running_partition` is always `unknown`. Each image names its entry
+`path`. With `detail: "summary"` the root kind is `esp-flash-image-summary`
+and each image is a compact `summary` (chip, entry point, segment count,
+classified load ranges, signature block count, descriptor identity,
+integrity); complete detail keeps every segment. Partition rows
+(`partitions/<label>.bin`) carry the declared `type`, `subtype`, names,
+`flash_address`, `size` and flags; `encrypted` is a storage flag, not
+proof of ciphertext. `written_offset`/`written_end` bound the bytes that
+are not erased: an app slot whose facts say `erased` can still hold an older
+image, and a limitation says so. For a dump read from another flash address, call
+`open_binary` with `format: "esp-flash-image"` and `flash_offset`; an
+`esp-image` whose `flash_dump` is set names that offset in a next probe; a
+relocated table can be named with `partition_table_offset`. No table found
+means unknown, often flash encryption. Extraction writes `nvs_keys` as
+ordinary data. See
+[ESP flash images](https://github.com/morluto/rea/blob/main/docs/esp-flash-image.md).
+
+## Bun standalone executables
+
+A `bun build --compile` executable stores its module graph in Mach-O
+`__BUN,__bun`, a PE or ELF `.bun` section, or an appended trailer.
+`open_binary` then `inspect_artifact` reports root format `bun-standalone` with
+the carrier, structural layout, module count, entry point, raw flags and
+compile exec-argv; each module keeps its `/$bunfs/...` source name, loader,
+encoding, sizes and SHA-256, with sourcemap, bytecode and module-info regions as
+separate children. Use summary root metadata `entry_point_logical_path` as the
+exact inventory `logical_paths` selector, then read the selected content node by
+its artifact ID; the reader owns virtual-name normalization and indexed fallback. `extract-artifact` writes stored contents through the safe
+output tree; route extracted JavaScript to `analyze_javascript_application`.
+Layout labels describe record shapes, not a detected compiler version; unknown
+or ambiguous layouts are unsupported. Bytecode is retained, not decoded, and the
+executable is never run. See
+[Bun standalone executables](https://github.com/morluto/rea/blob/main/docs/bun-standalone.md).

.agents/skills/reverse-engineer-anything/references/packages-and-archives.md

@@ -1,124 +0,0 @@
-# Packages and archives
-
-Read only the sections needed for the selected task.
-
-- [Packages and extraction](#packages-and-extraction)
-- [Godot PCK](#godot-pck)
-- [Bun standalone executables](#bun-standalone-executables)
-
-## Packages and extraction
-
-For PyInstaller executables, the CArchive is the application layer; the native
-bootloader is only its prefix. Prefer summary delivery for large inventories,
-then retained inventory views with selected member fields/pages. Runtime options
-are metadata, not files. Compact delivery still inventories and hashes members.
-A small complete inventory can cost less than extra calls and schemas. See the
-[Python packaged applications guide](https://github.com/morluto/rea/blob/main/docs/python-packaged-applications.md).
-
-Use `inspect_artifact` for application bundles, archives, ZIP/APK/IPA/MSIX/AppX,
-ASAR, or DMG inputs when the artifact graph and findings help answer the
-question. It returns the complete artifact graph inline. Cite graph manifest
-IDs when using them.
-
-For an IPA or a macOS `.app`, ZIP, or DMG, pass the inventory Evidence to
-`project_apple_application_graph`. It reports application roots and nested
-bundles by path convention: app extensions, XPC services, frameworks, login
-items, system and driver extensions, and plug-ins. It also lists privileged
-helpers, launchd plists, symlinks, and each bundle's `info_plist_path` and
-executable candidates. Roles are path conventions, not parsed plists; read the
-listed plists with `inspect_plist`.
-
-After `open_binary` on a `.app` or Mach-O, use `trace_dylib_resolution` to see
-which file each `@rpath`, `@loader_path` and `@executable_path` load reaches for
-every executable in the bundle. It also lists missing or weak loads and earlier
-`@rpath` candidates that are absent. Narrow large bundles with `roots` or
-`architecture`. System paths stay undetermined because the dyld shared cache
-provides them.
-
-Use `extract_artifact` when materialized files from a supported format are needed.
-It extracts the active target and accepts optional `integrity_policy`; see the [MCP contracts](https://github.com/morluto/rea/blob/main/docs/reference/mcp-contracts.md).
-It materializes all regular files into a fresh temporary directory chosen by
-REA. Symlinks and encrypted entries are inventory facts, not extractable files.
-The result reports the materialized directory; callers do not choose the
-destination. No separate permission grant is needed.
-
-For classic iNES cartridges, `open_binary` recognizes the byte signature without
-an executable architecture. `inspect_artifact` retains header facts and each
-PRG/CHR file unit's offset, length and SHA-256; its nested inventory's
-`ines.reconstruction` verifies the actual ordered region bytes against the
-whole-file digest. Extraction includes the original header, optional trainer
-and uninterpreted trailing bytes. These file units are not mapper/CPU bank
-maps. NES 2.0, UNIF, dirty legacy headers and truncated payloads are explicitly
-refused. No emulator or 6502 analysis is performed. See the
-[iNES guide](https://github.com/morluto/rea/blob/main/docs/ines-containers.md).
-
-Native DMG traversal automatically uses a read-only mount on supported macOS
-hosts, with an owned temporary mount directory and cleanup. It needs no approval
-flag. Unsupported hosts or mount failures remain explicit limitations; do not
-claim child inventory when only root identity is available. DMG extraction is
-unavailable through `extract_artifact`. To access DMG files on macOS, create a
-read-only mount with your own tools, select files from that mount for analysis,
-and detach the mount you created when finished. REA's inspection mount is
-temporary, not a retained export of the image's contents.
-
-Use `inspect_byte_entropy` to triage high- and low-entropy ranges before extraction.
-
-## Godot PCK
-
-For a standalone PCK, `open_binary` then `inspect_artifact` with
-`detail: "summary"` retains the complete static inventory. Use the returned
-`parent_evidence_id` with `inspect_analysis_view` inventory occurrences filtered
-by exact `logical_paths` or `occurrence_ids`, and join `artifact_id` to nodes
-filtered by `artifact_ids`. Select only needed fields; identity links remain.
-Prefer `inspect-artifact --detail summary --evidence_output PATH` for CLI tasks;
-the same CLI discovers embedded packs via their EOF trailer without opening a
-native analysis provider. Normal native opening remains unchanged.
-
-Distinguish declared MD5 from observed SHA-256 and graph/page completeness from
-`source_coverage`. Encrypted directories and sparse bundles have unknown entry
-coverage; encrypted members have unknown content identity. An empty filtered
-page cannot prove absence in unknown coverage. Retained views are historical,
-not fresh filesystem checks. No decryption, Godot resource decoding, GDScript
-decompilation or target execution is provided. See
-[Godot PCK](https://github.com/morluto/rea/blob/main/docs/godot-pck.md).
-
-UnityFS AssetBundle containers (`.bundle`, `.ab`, YooAsset packages and other
-byte-identified files) list `CAB-*` SerializedFiles and `.resS` members with
-header and node facts; none/LZ4/LZ4HC member blocks stream on demand. Bundles
-declaring asset-bundle encryption keep header facts with unknown directory
-coverage; LZMA member bytes retain named occurrences with unavailable hashes.
-Virtual member offsets are not physical carrier locations. Format 6–8 readers
-cache one decoded block and support retained filtered/paged views. No
-decryption or SerializedFile object decoding is provided. See
-[UnityFS](https://github.com/morluto/rea/blob/main/docs/unityfs.md).
-
-WeChat mini-program packages (`.wxapkg` files with `0xBE`/`0xED` marks) list
-members with declared names and absolute carrier offsets; member bytes are
-stored verbatim. `V1MMWX` PC-client packages report `encrypted` directory
-status with unknown coverage and are refused on extraction; no decryption is
-attempted. See
-[wxapkg](https://github.com/morluto/rea/blob/main/docs/wxapkg.md).
-
-U-Boot legacy uImages use the same inspection/extraction workflows. Prefer a
-retained summary and selected inventory views for header facts or component
-IDs. Header addresses/CPU/OS are declarations; payloads remain as stored.
-Multi-file components retain their aligned physical ranges; the full payload
-is also materialized. Unknown name text retains its original 32 bytes. See
-[U-Boot uImage](https://github.com/morluto/rea/blob/main/docs/uimage.md).
-
-## Bun standalone executables
-
-A `bun build --compile` executable stores its module graph in Mach-O
-`__BUN,__bun`, a PE or ELF `.bun` section, or an appended trailer.
-`open_binary` then `inspect_artifact` reports root format `bun-standalone` with
-the carrier, structural layout, module count, entry point, raw flags and
-compile exec-argv; each module keeps its `/$bunfs/...` source name, loader,
-encoding, sizes and SHA-256, with sourcemap, bytecode and module-info regions as
-separate children. Use summary root metadata `entry_point_logical_path` as the
-exact inventory `logical_paths` selector, then read the selected content node by
-its artifact ID; the reader owns virtual-name normalization and indexed fallback. `extract-artifact` writes stored contents through the safe
-output tree; route extracted JavaScript to `analyze_javascript_application`.
-Layout labels describe record shapes, not a detected compiler version; unknown
-or ambiguous layouts are unsupported. Bytecode is retained, not decoded, and the
-executable is never run. See
-[Bun standalone executables](https://github.com/morluto/rea/blob/main/docs/bun-standalone.md).

.agents/skills/reverse-engineer-anything/references/recorded-captures.md

@@ -1,58 +0,0 @@
-# Recorded captures and decoder discovery
-
-## Historical web captures
-
-Retained HAR/SAZ/native mitmproxy/aioquic qlog capture: `inspect_web_network_capture`. Select
-original record ordinals when useful; inspect producer fields and byte/number
-sidecars without fetching recorded URLs or claiming live attribution. For a decoder heap refusal, follow the reported `capture.decoder_old_generation_mib`
-setting and bounds with `update_analysis_settings` (default 192 MiB, floor 8,
-maximum 16384); the launch seed
-`REA_CAPTURE_DECODER_OLD_GENERATION_MIB` affects future REA processes. Host memory
-and `NODE_OPTIONS` do not raise that decoder allowance. See
-[historical captures](https://github.com/morluto/rea/blob/main/docs/guides/web/web-network-captures.md) for the exact upstream
-profile and credential exclusions. Qlog support starts with aioquic 1.5.0
-JSON 0.3; stream coverage and endpoint loss declarations do not recover bodies
-or establish network loss. Prefer detail summary, then kind qlog trace/stream
-pages; select one trace, stream ID and direction for contribution/range pages.
-Facts retain all-recorded-events-before-selection scope. Other qlog layouts
-and PCAP correlation are unsupported.
-
-## Packet fields and packet captures
-
-Packet-field discovery: `inspect_packet_fields` searches installed protocols
-and field names/types before choosing fields for `inspect_packet_capture`.
-Query/page the relevant records; registrations do not establish observed traffic.
-
-## Packet capture inspection
-
-Recorded packet captures: `inspect_packet_capture` with selected TShark fields,
-display filters and decode-as rules. Requires Linux, util-linux prlimit and
-TShark 4.x on an absolute `PATH` entry or via the optional absolute
-`REA_TSHARK_COMMAND` override; see
-[capture guide](https://github.com/morluto/rea/blob/main/docs/guides/data/packet-captures.md).
-Packet limits count input packets before filtering. Output defaults to 50 matching
-frames; use `match_offset` / `match_limit` for later pages, or explicit null
-limit for complete matching output. Preserve the source digest across pages.
-This does not perform live capture.
-For address/DNS/SNI/protocol summaries use `inspect_pcap_capture` with MCP
-detail summary, then retained kind pcap pages. Requires Wireshark 4.x tshark
-and capinfos, with Linux prlimit or Windows Job Objects; see
-[packet summaries](https://github.com/morluto/rea/blob/main/docs/guides/data/pcap-analysis.md).
-Select an exact DNS question for address pages; page exhaustion does not prove
-network completeness. This reads recordings and does not acquire traffic.
-
-## Signal decoder discovery
-
-Decoder discovery: `inspect_signal_decoders` searches installed decoder IDs
-or selected decoder help, including channels and options. Query and page the
-relevant details before choosing settings; this does not scan hardware.
-
-## Recorded logic and signals
-
-Recorded logic/signal traces: `decode_signal_recording` with explicit decoder,
-channel and protocol settings. On Linux with util-linux prlimit, supply sigrok-cli 0.7.2 through
-`REA_SIGROK_COMMAND`; see [recording guide](https://github.com/morluto/rea/blob/main/docs/guides/signals/signal-recordings.md).
-Output defaults to 50 literal lines; select annotation classes and page with
-`line_offset` / `line_limit`, or explicit null for all remaining output.
-Window counts are display lines, not annotations or samples. Preserve source digests across pages.
-This reads existing files; it does not acquire hardware signals.

.agents/skills/reverse-engineer-anything/references/runtime-observation.md

@@ -1,12 +1,5 @@
 # Runtime observation
 
-Read only the sections needed for the selected task.
-
-- [Native runtime questions](#native-runtime-questions)
-- [Browser and Electron](#browser-and-electron)
-- [Who performs the action](#who-performs-the-action)
-- [Fiddler Everywhere traffic debugging](#fiddler-everywhere-traffic-debugging)
-
 ## Native runtime questions
 
 Start from the requested observation. State the selected target, input, expected
@@ -55,18 +48,6 @@ and [native calls/UI](https://github.com/morluto/rea/blob/main/docs/guides/nativ
 
 ## Browser and Electron
 
-Passive traffic capture of a SPA: the default scope is the page's own origin,
-and data APIs usually live on another origin. Discover API origins from
-absolute URLs in loaded bundles or script text via JavaScript analysis tools
-(another passive capture without those origins still scopes to the page
-origin, and `completeness.excluded` counts lack URLs). Pass both the page
-origin and those API origins in `allowed_origins` — the list replaces the
-default scope — and read `completeness.excluded` before reporting that an
-API is absent. For long captures with body shapes, use
-`export_evidence_bundle` instead of expecting an inline result.
-
-User-owned Electron runtime already open: `list_electron_targets`. Before an electron-main Inspector attempt, check packaged fuses with `inspect_electron_fuses`; disabled `EnableNodeCliInspectArguments` means the app ignores `--inspect`.
-
 Supply the existing browser or Electron instance's literal-port loopback CDP
 endpoint in the request. No separate permission configuration or per-call
 approval flag is needed. Browser discovery lists eligible HTTP(S) pages;

SECURITY.md

@@ -4,6 +4,117 @@
 
 Security fixes are provided for the latest published version of REA. Upgrade to the latest release before reporting a problem that may already have been resolved.
 
+## Security boundary
+
+REA is a local reverse-engineering and automation tool. CLI and MCP use the
+same application workflows and run with the host process's permissions.
+REA is not a general-purpose sandbox or a multi-tenant authorization service.
+
+### Threat model
+
+- **Trusted authority:** the operating-system account running REA, the caller
+  or agent host that selects operations, and configured analysis providers,
+  their executables and extensions, and service endpoints. An MCP client can
+  invoke the operations exposed to it; its host must enforce the user's tool
+  permissions and approvals.
+- **Untrusted data:** target binaries, archives, source files, project contents,
+  captures, web pages and returned target content can be malicious. Selecting
+  an input for static inspection does not authorize commands embedded in that
+  input. Agents must treat target text and Evidence as data rather
+  than instructions granting additional authority.
+- **Operation-specific effects:** static inspection parses target data and may
+  launch an analysis engine. Runtime, debugger, instrumentation, browser,
+  desktop and environment workflows can deliberately execute code, attach to
+  processes, make network requests, write files or interact with applications
+  and devices. Review the selected operation's effects and limitations; static
+  inspection does not authorize launching or interacting with the target
+  application. See
+  [runtime and network responsibilities](DISCLAIMER.md#runtime-network-and-device-operations).
+
+Standard client registrations use a dedicated stdio process. Opt-in
+[HTTP MCP](docs/reference/mcp-contracts.md#transports) uses plain HTTP without
+TLS or client authentication and shares provider/active-target state across
+protocol sessions. Its session ID is not a user-authentication or isolation
+boundary. Keep this endpoint within a trusted local or isolated environment.
+
+### Intended security properties
+
+Static JavaScript and .NET inspection do not run the target application.
+Unexpected execution of input code through a data-only analysis path is a
+security concern. Analysis engines themselves are executable software trusted
+with the host account's permissions; parsing an input in an external engine
+does not isolate that engine from the host.
+
+REA authenticates its managed Hopper and Ghidra bridges with per-session random
+capability tokens transferred through private session files, rather than
+process arguments or environment variables. POSIX uses current-user Unix
+sockets. Windows Ghidra uses authenticated loopback TCP and a private NTFS
+runtime whose DACL admits only the current user and SYSTEM. These controls
+protect the managed session boundary, not every external provider or debugger
+endpoint. See [Windows Ghidra transport and lifecycle](docs/providers/windows-ghidra-p0.md#private-runtime-transport-and-lifecycle).
+
+Provider ownership and mutation rules remain specific to each workflow:
+
+- Ghidra's working projects are temporary and owned by REA. Opt-in
+  [checkpoints](docs/getting-started/installation.md#automatically-checkpoint-an-owned-ghidra-program)
+  retain REA-owned Program state. A
+  [caller-selected existing project](docs/getting-started/installation.md#reuse-an-existing-ghidra-project)
+  is fingerprinted and copied into an owned runtime for read-only processing;
+  Ghidra does not open or save the original database through that workflow.
+- [IDA analysis](docs/providers/ida-provider.md) is read-only. An attached GUI
+  database is never saved or closed by REA; owned headless sessions have a
+  separate lifecycle.
+- Cleanup must stay within resources REA owns. Failed or unverified cleanup
+  can retain a workspace or session for retry; closing a session
+  does not imply that every investigation artifact has been erased.
+
+`rea setup` shows planned configuration and installation changes and requires
+approval before applying them. Ghidra, Java and IDA are user-managed. Approved
+Linux Hopper installation authenticates the package's detached PGP signature
+against the pinned publisher identity and checks the signed launcher against
+the selected release's digest. The release feed's display version is separate
+from that authenticated identity. See [installation and publisher verification](docs/getting-started/installation.md#hopper).
+
+### Limits and caller responsibilities
+
+- **Host isolation:** private runtimes and capability tokens do not protect
+  against malicious software already running as the same operating-system
+  user, or a compromised trusted client or provider. Use an appropriately
+  isolated account, VM or restricted environment when handling hostile targets.
+- **Resource bounds:** timeouts, cancellation, streaming and size limits are
+  operation-specific. They are not a universal CPU, memory, disk or wall-time
+  limit on every target and third-party tool. Enforce hard host resource limits
+  externally when needed. Failures of a documented boundary or cancellation
+  control still warrant investigation.
+- **Data and network exposure:** Evidence, caches, checkpoints, exports and
+  captures can retain private target data, paths, URLs and memory contents.
+  Local execution does not make these outputs safe to publish. Requested
+  network operations, agent hosts and provider features such as
+  [IDA Free's cloud decompiler](docs/providers/ida-provider.md) can communicate
+  outside the host. Review their data handling and secure any exposed endpoint.
+- **Interpretation:** analysis, reconstruction and generated environments can
+  be incomplete or incorrect. Identity checks, signatures and successful
+  analysis do not establish that a target, provider or generated program is
+  safe to execute. Review the Evidence and proposed actions before relying on
+  them.
+
+### Vulnerability scope
+
+Please report suspected violations of these boundaries privately. Examples
+include unintended code execution during data-only inspection, escaping a
+documented extraction/output boundary, bypassing bridge authentication or
+target/session identity checks, unauthorized effects on an unrelated resource,
+and disclosure of transport credentials or explicitly marked sensitive values.
+An attacker-triggered bypass of a documented resource or cancellation control
+can also be security-relevant without code execution.
+
+Incorrect analysis, unsupported formats, crashes, hangs and high resource use
+without a security-boundary impact are generally ordinary bug reports. Effects
+explicitly requested through an execution or interaction workflow are not by
+themselves a vulnerability. A dependency advisory needs its actual REA exposure
+assessed; a complete exploit or diagnosis is not required to report a concern.
+If you are unsure whether a boundary is affected, use the private channel below.
+
 ## Reporting a vulnerability
 
 Do not disclose vulnerabilities, proof-of-concept exploits, credentials,
@@ -21,30 +132,3 @@ unrelated local paths from logs or examples.
 The maintainer will acknowledge the report, assess its scope, and coordinate
 remediation and disclosure timing with the reporter. Please allow time for
 provider-dependent behavior to be reproduced safely.
-
-## Security boundary
-
-REA authenticates its Hopper and Ghidra bridges with per-session random
-capability tokens. POSIX uses current-user Unix sockets; Windows Ghidra uses
-authenticated loopback TCP with a private NTFS runtime whose DACL admits only
-the current user and SYSTEM. See [Windows Ghidra P0](docs/providers/windows-ghidra-p0.md#private-runtime-transport-and-lifecycle).
-Tokens are transferred through private session descriptors rather than process
-arguments or environment variables.
-This is not a sandbox and does not protect against malicious processes already
-running as the same operating-system user. Opening an untrusted binary
-delegates parsing and analysis to the selected local provider with that user's
-permissions.
-
-Ghidra sessions use a packaged Java `HeadlessScript`, an isolated temporary
-project, and private home, cache, and runtime directories. REA imports only the
-requested target, bounds startup and protocol messages, requests bounded CPU
-and heap settings, and deletes the temporary project when the session closes.
-These controls limit accidental persistence and resource use; they do not make
-Ghidra a sandbox. REA does not open or modify user-owned Ghidra projects.
-
-`GHIDRA_INSTALL_DIR` and optional `JAVA_HOME` identify user-managed
-installations. Setup can add those values to detected client configuration only
-after showing its plan and receiving approval. REA does not download, install,
-upgrade, or modify Ghidra or Java.
-
-On Linux, REA accepts release metadata only from Hopper's HTTPS endpoint, restricts package URLs to Hopper's public download origin, bounds the package size, and compares the downloaded bytes with Hopper's published checksum before requesting installation. The published SHA-1 value is a corruption check, not a modern package signature; HTTPS origin validation remains part of the trust boundary. Dependency installation is delegated without shell evaluation to `apt-get`, `dnf`, or `pacman`, directly as root or through `pkexec`. REA never invokes `sudo`.

bridge/agentenv/capture.py

@@ -213,6 +213,7 @@ def run(arguments: dict) -> int:
     rea = shutil.which("rea")
     if rea is None:
         return _say({"error": "REA is not installed in this computer"})
+    os.makedirs(os.path.dirname(arguments["stdout"]), exist_ok=True)
     for path, text in arguments.get("files", {}).items():
         os.makedirs(os.path.dirname(path), exist_ok=True)
         with open(path, "w", encoding="utf-8") as handle:
@@ -236,8 +237,18 @@ def listing(arguments: dict) -> int:
     """
     home = os.path.expanduser("~")
     files, skipped = [], []
-    for directory, folders, names in os.walk(os.path.abspath(arguments["root"])):
+
+    def fail_walk(error: OSError) -> None:
+        raise error
+
+    for directory, folders, names in os.walk(os.path.abspath(arguments["root"]), onerror=fail_walk):
         folders.sort()
+        # os.walk does not follow directory symlinks; disclose them to the consumer.
+        for name in folders[:]:
+            path = os.path.join(directory, name)
+            if os.path.islink(path):
+                skipped.append(os.path.relpath(path, home))
+                folders.remove(name)
         for name in sorted(names):
             path = os.path.join(directory, name)
             relative = os.path.relpath(path, home)

bridge/agentenv/test_capture.py

@@ -0,0 +1,64 @@
+"""Exercise the capture controller's filesystem inventory boundary."""
+
+import json
+import os
+from pathlib import Path
+import subprocess
+import sys
+import tempfile
+import unittest
+
+
+CONTROLLER = Path(__file__).with_name("capture.py")
+
+
+class CaptureListingTest(unittest.TestCase):
+    def run_listing(self, root, output):
+        return subprocess.run(
+            [
+                sys.executable,
+                str(CONTROLLER),
+                "list",
+                json.dumps({"root": str(root), "output": str(output)}),
+            ],
+            text=True,
+            capture_output=True,
+            check=False,
+        )
+
+    def test_directory_symlink_is_disclosed_without_following_it(self):
+        with tempfile.TemporaryDirectory() as parent:
+            parent = Path(parent)
+            root = parent / "root"
+            target = parent / "target"
+            output = parent / "listing.json"
+            root.mkdir()
+            target.mkdir()
+            (root / "present.txt").write_text("present")
+            (target / "outside.txt").write_text("outside")
+            try:
+                (root / "linked").symlink_to(target, target_is_directory=True)
+            except OSError as error:
+                self.skipTest(f"directory symlinks unavailable: {error}")
+            result = self.run_listing(root, output)
+            self.assertEqual(result.returncode, 0, result.stderr)
+            listing = json.loads(output.read_text())
+            self.assertEqual(
+                [item["path"] for item in listing["files"]],
+                [os.path.relpath(root / "present.txt", Path.home())],
+            )
+            self.assertEqual(
+                listing["skipped"], [os.path.relpath(root / "linked", Path.home())]
+            )
+
+    def test_missing_root_does_not_produce_an_empty_successful_inventory(self):
+        with tempfile.TemporaryDirectory() as parent:
+            parent = Path(parent)
+            output = parent / "listing.json"
+            result = self.run_listing(parent / "missing", output)
+            self.assertNotEqual(result.returncode, 0)
+            self.assertFalse(output.exists())
+
+
+if __name__ == "__main__":
+    unittest.main()

bridge/ghidra/ReaGhidraBridge.java

@@ -1961,6 +1961,9 @@ public final class ReaGhidraBridge extends HeadlessScript {
         limitations.add(
             "Def-use links do not cross function boundaries and may omit memory aliasing, call side effects, or unresolved indirect flow."
         );
+        limitations.add(
+            "Memory read/write effects cover high-p-code LOAD and STORE operations only; direct memory address varnodes in other operations are not included. An empty effect list does not establish that no memory is accessed. Recorded instruction references may provide complementary evidence."
+        );
         limitations.add(
             "Memory read/write effects include stack and temporary memory operations; they do not identify persistent state or business meaning."
         );

docs/desktop-application-capture.md

@@ -358,6 +358,10 @@ remaining content budget is not read, unless stored content of the same size
 could make it a duplicate. Files that could not be
 retained are listed with the reason: too large, over the content budget,
 changed since the walk, changed during the read, or unreadable.
+The baseline also records the paths and types of non-file entries it observed,
+including symlinks, without following them. This is required to distinguish an
+unreadable SQLite sidecar from an absent one. Captures made before this field
+was added must be made again before state inspection, task drafting or export.
 Directories the application held files open in, but whose starting content was
 not retained, are listed so a second capture can pass them with
 `--state-path`.

docs/desktop-application-export.md

@@ -25,6 +25,9 @@ a `.deb` file; see [Applications from a .deb file](#applications-from-a-deb-file
 `--seed-checkpoint` names the checkpoint whose state seeds the bundle, the
 baseline by default, and `--end-checkpoint` the one a task must pass on, the
 capture's last by default; see [The seed checkpoint](#the-seed-checkpoint).
+`--synthetic-seed` says the seed was made for the task, as a build agent makes
+it in a [build computer](desktop-build-witness.md), rather than taken from the
+user's own data; see [A seed made for the task](#a-seed-made-for-the-task).
 
 The command returns Evidence with operation `export_desktop_application` and
 predicate type `rea.desktop-application-export`, listing the environment name,
@@ -124,6 +127,17 @@ The class declares:
   desktop entry without `Path`), which a relative argument or program path
   such as `./app` also needs, and still starts if that folder is missing. The
   export refuses a capture that saw no application window.
+- The seed's document, opened at launch, so the app shows it rather than its
+  start screen: when the seed holds exactly one file the state view gives the
+  `document` role, and the desktop entry's `Exec` takes files (a `%f`, `%F`,
+  `%u` or `%U` field code), its path under `$HOME` is appended to the command.
+  A command that already names a document, absolute or from its working
+  directory, as one captured with `--argument <file>` does, is kept as it is;
+  a settings path under the home does not count. A seed with no document launches
+  as captured. With several, no desktop entry or an `Exec` that takes no file,
+  the app launches as captured and the README and the result's limitations say
+  why. A reset
+  relaunches the app, so it opens the document again.
 - For an Electron application (the capture found its fuse sentinel or a
   `resources/app.asar`), `--no-sandbox` right after the program unless the
   command already has it: Chromium's sandbox needs user namespaces the
@@ -185,6 +199,16 @@ The export refuses a name the capture does not hold exactly once, and an end
 checkpoint taken before the seed checkpoint; `inspect-desktop-application-state`
 lists the names in `capture.checkpoints`.
 
+## A seed made for the task
+
+By default the seed is the user's real data: the README and the result's
+limitations say to keep the bundle local and not publish it. With
+`--synthetic-seed` they say instead that the seed was made for the task, and
+to read `envs/<name>/seed/` before publishing the bundle; the export cannot
+tell the two apart, so the flag is the caller's word. `export_build_environment`
+passes it, since the building agent makes the seed in the build computer. The
+Evidence records it as `synthetic_seed`.
+
 ## Host name and user
 
 A seed can hold the capture host's name and the user's: Geany saved its mail
@@ -337,6 +361,7 @@ when a DOCTYPE names a DTD. Known differences remain:
   and then gives the file an `error`, and so does a table or column name that
   is not UTF-8.
 
-The seed is the user's real data. Keep the bundle local and do not publish it.
+Unless it was [made for the task](#a-seed-made-for-the-task), the seed is the
+user's real data. Keep the bundle local and do not publish it.
 The class was checked against agentenv-framework 0.9.1431 with
 `python -m agentenv_protocol.computer._declare` and `agent-env run --dry-run`.

docs/desktop-application-state.md

@@ -128,7 +128,15 @@ could misstate its committed rows. The capture records them under its content
 roots, which include both beside a database selected on its own, when its
 baseline walk listed every directory, read every path, entered no other
 device, did not stop early and recorded what it left out, and wherever they change; an excluded log, and any elsewhere, is
-unknown, since an unchanged file and a missing one look alike. A table
+unknown, since an unchanged file and a missing one look alike. After an
+incomplete checkpoint, a database or sidecar without an explicit
+later change remains unconfirmed even if a later walk completes. REA does not
+combine that older file with a newly recorded member of the SQLite set. The
+historical versions remain listed; the affected SQLite view has a `view_error`.
+A baseline non-file at a sidecar path, or a non-directory ancestor, cannot
+establish an absent file. Captures without the required baseline non-file
+inventory must be made again before inspection.
+A table
 that cannot be read keeps its `error` in place of its rows, and changes to that
 database are marked incomplete. dconf
 databases are read with `dconf dump /` against a private file profile, so the

docs/desktop-application-tasks.md

@@ -141,7 +141,10 @@ The rules both evaluators follow:
 - A check decided by what a view leaves out (`lines_absent`, `value_absent`,
   `row_absent`, the counts, `value_equals` of a whole object or array, and
   the text checks of an element) fails when that view is truncated; a check
-  satisfied by what the view holds is decided on it.
+  satisfied by what the view holds is decided on it. An element's text is not:
+  the reader may have dropped text from between the runs it kept, so
+  `text_contains` fails on a truncated view even where the kept runs hold its
+  value. A text node or attribute value is whole, and decided.
 
 The export refuses, naming the check, a file outside the owned paths, a file
 spelled with a leading slash, `.` or `..`, a pointer into a file that is text

docs/desktop-build-computer.md

@@ -14,7 +14,9 @@ agent's computer-use actions to it through three MCP tools:
 The tools are MCP-only, like the debugger sessions: the computer lives as long
 as the REA MCP server that started it, or until it is closed. Capturing the
 app, exporting its bundle and witnessing the task on such a computer are in
-[Building and witnessing an environment](desktop-build-witness.md).
+[Building and witnessing an environment](desktop-build-witness.md), and REA's
+skill for doing all of it from a request is
+[desktop builds](https://github.com/morluto/rea/blob/main/.agents/skills/reverse-engineer-anything/references/desktop-build.md).
 
 ## Requirements
 

docs/desktop-build-witness.md

@@ -18,10 +18,19 @@ grades the witness with the same checks the exported verifier runs.
 Like the computer tools, these are MCP-only and act on a `computer_id` from
 `start_build_computer`.
 
+REA's skill walks an agent from a request such as "build me an Inkscape
+environment where the agent changes a poster's headline" to a witnessed
+bundle with these tools: the questions it asks first, when it stops for the
+person, the install, the seed, the task, the witness and its final report.
+See [desktop builds](https://github.com/morluto/rea/blob/main/.agents/skills/reverse-engineer-anything/references/desktop-build.md).
+
 ## Build
 
 1. `start_build_computer` from a request. REA is installed in the computer.
-2. `start_build_capture`. REA writes an apt configuration under
+2. `start_build_capture`. REA first checks the installed runtime's export
+   schema for synthetic-seed support. If the archive is too old, repack a
+   current REA, update `REA_BUILD_COMPUTER_REA_ARCHIVE`, restart the REA MCP
+   server and start a new build computer. REA then writes an apt configuration under
    `~/.rea-build/apt` and runs `apt-get update` as the computer's user, so the
    capture finds the package's sources (`package_lists` counts the lists,
    and `package_lists_error` gives apt's exit status and last lines when the
@@ -49,8 +58,12 @@ Like the computer tools, these are MCP-only and act on a `computer_id` from
    --end-checkpoint end`, so it seeds what was saved at `seed`, scrubs the
    computer's host name and user from it, and refuses a task whose checks
    all pass on the seed. A task larger than 96 KiB as REA passes it to the
-   computer is refused before anything runs. A file moved to the desktop Trash is not seeded,
-   and the export's limitations name what the Trash held at `seed`. For a
+   computer is refused before anything runs. It also passes `--synthetic-seed`,
+   since the agent made the seed for the task, so the README does not call it
+   the user's real data. When the seed holds exactly one document and the
+   app's desktop entry takes files, the bundle's app opens that document at
+   launch. A file moved to the desktop Trash is not seeded, and the export's
+   limitations name what the Trash held at `seed`. For a
    `.deb` app that no apt source the capture found offers, the export takes
    the request's URL with `--package-url`; one apt offers installs from apt. REA lists the bundle's files with their sizes
    and SHA-256 in the computer, into a file beside the bundle that it reads
@@ -102,7 +115,8 @@ cancels the call in progress on it and refuses the calls still waiting.
 ## Witness
 
 Start a fresh computer from the exported folder with `start_build_computer`
-and `{"kind": "bundle", "path": ...}`; agentenv boots the app with the seed.
+and `{"kind": "bundle", "path": ...}`; agentenv boots the app with the seed,
+on the seed's document when the export opens one.
 Then, with the task exactly as exported:
 
 | `stage`       | Before it                                                         | Its checks must              |
@@ -137,14 +151,17 @@ SQLite file locked past the reader's wait, or because what it looks for may
 lie in what its view cut, is `undecided` in its result: it shows nothing
 about the task. That covers a line `lines_present` misses in a text view cut
 at 5,000 lines, a row `row_present` misses in a table whose view keeps only
-its first rows, a `value_equals` pointer that names nothing in a truncated
-view or past a cut zip listing, and the absence checks and counts on a cut
-view. A check that passes on what the view kept stays decided, and so does a
-value found there that differs from the one expected. The result's `passed`
-and description are the exported verifier's, which has no undecided results.
-A stage that only undecided checks would settle, such as a near miss whose
-one failing check could not read its file, files nothing and is refused;
-check it again once the files read whole.
+its first rows, a `value_equals` or text check pointer that names nothing
+in a truncated view or past a cut zip listing, the absence checks and counts
+on a cut view, and `text_equals` or `text_contains` of an element on one,
+even where the element's kept text holds the value, since the cut may have
+dropped text from between its runs. Any other check that passes on what the
+view kept stays decided, and so does a value found there that differs from
+the one expected.
+The result's `passed` and description are the exported verifier's, which has
+no undecided results. A stage that only undecided checks would settle, such
+as a near miss whose one failing check could not read its file, files nothing
+and is refused; check it again once the files read whole.
 
 A stage whose checks do not show what it must ends the witness, and so does
 `after_reset`. REA then ends the recording, fetches its segments through

docs/guides/javascript/javascript-runtime-observation.md

@@ -114,7 +114,8 @@ caller cancellation still reports cancellation.
 The direct observations are:
 
 - `Debugger.scriptParsed`, establishing that a bounded script location was
-  parsed in the observed execution context;
+  parsed with the reported execution-context ID; association with a particular
+  context lifetime is known only when its creation was observed;
 - `Debugger.scriptFailedToParse`, retained only as a bounded invalid-script
   count in `scripts.parse_failed_total`. A well-formed parse-failure
   event is distinct from malformed protocol data and does not make loaded
@@ -163,8 +164,13 @@ and collection overhead, and projected URL fields. Each CDP message also has a
 16 MiB transport limit. A message over that limit fails with `payload_limit`;
 when the aggregate budget is reached, later metadata events are dropped and
 the partial result reports `events_dropped`, `truncated: true`, and
-`retained_metadata_budget_exceeded`. Repeated context transitions update the
-current context record instead of accumulating duplicate objects. Scripts are
+`retained_metadata_budget_exceeded`. Context records retain each observed lifetime, and scripts refer to the context
+lifetime active when parsed. The reported numeric execution-context ID is
+retained separately on both records; a script with no observed context creation
+has an unknown context key. Repeated transitions within one lifetime update its
+record; the state records the last observed lifecycle event and does not prove
+that the context is still live. This changes context keys and Evidence identities from older captures;
+recapture observations to obtain lifetime associations. Scripts are
 validated after capture, deduplicated by stable metadata, and canonically
 sorted. Wall-clock timestamps and protocol script IDs are excluded from the
 durable result, so identical inputs and captured metadata produce the same

docs/guides/native/go-binaries.md

@@ -49,14 +49,16 @@ selected dependency versions without reopening the file:
 }
 ```
 
-Go views support `dependencies` (exact `paths`) and `settings` (exact `keys`),
-optional original `indices`, field selection, and pagination. Filters intersect;
-empty filter arrays select no rows and `fields: []` returns only row identity.
-Each row keeps its original `index`, scoped to the parent Evidence and collection;
-duplicate module paths and setting keys keep distinct indices. Page offsets
-count matching records. Exhausting retained rows does not establish complete
-runtime dependencies. Original bytes, unknown lines and all complete metadata
-remain in the parent and can be exported as an Evidence bundle.
+Go views support `dependencies` (exact `paths`), `settings` (exact `keys`) and,
+when collected with `include_string_literals: true`, `string_literals` (exact
+`values` and substring `contains`), plus optional original `indices`, field
+selection, and pagination. Filters intersect; empty filter arrays select no rows
+and `fields: []` returns only row identity. Each row keeps its original `index`,
+scoped to the parent Evidence and collection; duplicate module paths and setting
+keys keep distinct indices. Page offsets count matching records. Exhausting
+retained rows does not establish complete runtime dependencies or string
+coverage. Original bytes, unknown lines and all complete metadata remain in the
+parent and can be exported as an Evidence bundle.
 
 One-shot CLI summaries save complete Evidence before returning the projection:
 
@@ -113,6 +115,22 @@ their empty dependency array does not establish the absence of dependencies.
 The result's limitations state this explicitly. A module-mode build with a main
 module record and no dependency records has an observed empty dependency list.
 
+When `include_string_literals: true` (CLI `--include-string-literals`, optional
+`max_string_literals` / `--max-string-literals`, default `2000`, maximum `10000`)
+is selected, `string_literals` reports `evidence_kind: "inferred"` alongside
+deduplicated printable UTF-8 literals referenced by word-aligned two-word
+`(ptr, len)` string headers in non-executable initialized data. Because Go packs
+read-only string data contiguously without NUL terminators, slicing by `(ptr, len)`
+recovers exact literal boundaries instead of concatenated C-string runs. Each
+target slice (`1`–`4096` bytes) must stay within a single read-only mapped
+section or segment, decode as printable UTF-8 (`\t`, `\n`, `\r`, joiners
+`U+200C` / `U+200D` and printable Unicode scalar values, excluding control and
+other format characters), and fit within
+a 64 MiB header-scan budget and 512 KiB aggregate string budget
+(`truncated: true` when capped). Compiler-inlined or
+stack-constructed strings without static headers, unapplied relocation addends
+and Mach-O `LC_DYLD_CHAINED_FIXUPS` pointer encodings are noted in `limitations`.
+
 ## Supported boundary
 
 The built-in TypeScript reader supports ELF, PE and thin Mach-O images, and one

docs/guides/native/native-investigation.md

@@ -574,8 +574,17 @@ The raw Java `is_dead` flag can remain set after Ghidra decodes a live block;
 `block_membership` reports actual syntax-tree membership separately.
 
 The provider dossier itself retains up to 3,000 p-code operations, 64 inputs per
-operation and 12,000 def-use edges, with explicit omitted counts. A `STORE`
-may describe stack memory and does not itself prove persistent state.
+operation and 12,000 def-use edges, with explicit omitted counts. Memory effects
+cover high-p-code `LOAD` and `STORE` operations; direct memory address varnodes
+in other operations are excluded, so an empty effect list does not establish
+that the function accesses no memory. `procedure_references` can supply
+complementary recorded instruction references, with its own coverage limits. A
+`STORE` may describe stack memory and does not itself prove persistent state.
+The Ghidra analysis profile commits to this effect scope. Snapshots from before
+that commitment are rejected; analyze without the snapshot and save a fresh one.
+To keep historical Evidence, copy the old snapshot's `evidence_bundle` object to
+a separate JSON file and import that bundle. Import validates the Evidence; it
+does not replay the old provider analysis.
 
 Jump-table evidence keeps numeric `mappings`, explicit `default_targets`, and
 backing `data_sources` separate. A null case value denotes an unresolved

docs/guides/runtime/frida-instrumentation.md

@@ -4,7 +4,7 @@ REA exposes Frida device and process discovery, attach or spawn sessions, and ca
 
 For remote devices, pass a host with an optional port (`host[:port]`; bracket IPv6 addresses) and any token, certificate, origin, or keepalive options on that operation. The keepalive interval is measured in seconds, matching Frida Core 17.23.2. Authentication values are held only for the active call or session and are excluded from Evidence. Do not embed credentials in the endpoint address.
 
-MCP exposes `list_frida_devices`, `list_frida_processes`, `start_frida_session`, `load_frida_script`, `resume_frida_session`, `unload_frida_script`, `frida_session_status`, and `close_frida_session`. A spawned process starts paused so scripts can load first. Closing unloads session scripts and detaches. If a spawn remains paused, REA resumes it only after script cleanup or session detach confirms the instrumentation is released; if both cleanup paths fail, the target stays paused and the cleanup error is retained. REA never kills the target. MCP sessions end with the server process. The one-shot CLI command `instrument-with-frida` accepts one inline script or script file, observes messages for a bounded duration, and returns Evidence with the source hash and captured messages.
+MCP exposes `list_frida_devices`, `list_frida_processes`, `start_frida_session`, `load_frida_script`, `resume_frida_session`, `unload_frida_script`, `frida_session_status`, and `close_frida_session`. A spawned process starts paused so scripts can load first. Closing unloads session scripts and detaches. If cleanup fails, the session remains available for cleanup retry but refuses new script loads and resume requests. If a spawn remains paused, REA resumes it only after script cleanup or session detach confirms the instrumentation is released; if both cleanup paths fail, the target stays paused and the cleanup error is retained. REA never kills the target. MCP sessions end with the server process. The one-shot CLI command `instrument-with-frida` accepts one inline script or script file, observes messages for a bounded duration, and returns Evidence with the source hash and captured messages.
 
 `instrument-with-frida --json` returns the Evidence record directly, matching MCP. Consumers of the earlier `{evidence, cleanup_error}` CLI wrapper should read the record at the JSON root and the session cleanup observation at `normalized_result.cleanup_error`. If final provider cleanup fails or cancellation arrives during it, the typed error retains completed Evidence in `details.partial_observation`. Discovery commands retain their device or process report in the same field.
 

docs/guides/web/browser-observation.md

@@ -239,10 +239,21 @@ file for you.
   `observe_web_session`, `discover_webmcp_tools`, and `capture_web_screenshot`
   accept a browser socket. Website runtime attribution, Electron inspection,
   and scenario attach mode still require HTTP discovery.
-- Each call opens one WebSocket and uses it for discovery
-  (`Browser.getVersion`, `Target.getTargets`) and for the selected page.
-  Discovery must finish within the same 10-second deadline as HTTP discovery.
-  Chrome may ask you to approve each connection.
+- An admitted browser socket is retained by the active browser provider across
+  calls to the same normalized browser WebSocket URL, and concurrent cold-start
+  calls share one handshake so MCP sessions do not re-open the browser socket on
+  every step. Scheme case, uncompressed IPv6 loopback spellings, and leading
+  port zeros normalize to one reuse key, while `127.0.0.1`, `[::1]`, and
+  distinct `/devtools/browser/<id>` paths remain separate sockets. Each target
+  operation detaches its flattened target session when finished: unconfirmed
+  target attach or detach cleanup closes the shared browser socket for session
+  containment, whereas a caller's own discovery deadline or cancellation
+  releases only its lease when transport state remains clean. Provider shutdown
+  closes the retained browser socket. One-shot CLI invocations close their
+  provider on exit, so Chrome may still ask you to approve each separate CLI
+  connection. Discovery (`Browser.getVersion`, `Target.getTargets`) defaults to
+  a 10-second deadline and can be adjusted per call with `discovery_timeout_ms`
+  (`--discovery-timeout-ms` on the CLI).
 - The browser identifier controls access to the socket. Evidence records the
   endpoint as `ws://127.0.0.1:9222/devtools/browser/[REDACTED]`.
 - `browser.revision` is the socket's `Browser.getVersion` value, such as
@@ -598,13 +609,13 @@ an unknown size, comparison reports unknown rather than treating the observation
 as a resource addition or removal; complete inventory coverage still establishes
 when an entire group is absent.
 
-CDP discovery has a 10-second response deadline. HTTP discovery documents
-use an 8 MiB budget. Browser-socket discovery (`Browser.getVersion`,
-`Target.getTargets`) uses the 64 MiB protocol message budget. Neither budget
-nor the discovery deadline has a runtime override. `list_browser_targets` accepts no
-`command_timeout_ms`: HTTP discovery and browser-socket discovery
-(`Browser.getVersion`, `Target.getTargets`) stay on that fixed deadline, and
-the socket closes without a later command. Other CDP tools use
+CDP discovery defaults to a 10-second response deadline, configurable per call
+on passive browser tools with `discovery_timeout_ms` (default 10000). HTTP
+discovery documents use an 8 MiB budget. Browser-socket discovery
+(`Browser.getVersion`, `Target.getTargets`) uses the 64 MiB protocol message
+budget. Neither byte budget has a runtime override. `list_browser_targets`
+accepts `discovery_timeout_ms` and no `command_timeout_ms`, because it performs
+only discovery without a post-discovery target command. Other CDP tools use
 `command_timeout_ms` (default 20000) for each WebSocket handshake and command
 response, separate from the caller-selected observation window, discovery, and
 the 5000 ms cleanup grace. A browser-level socket's handshake and the following

docs/kernel-modules.md

@@ -70,6 +70,14 @@ trailer is observed absence, not proof the module is unsigned.
 When section names are incomplete, a missing named section is `unknown`
 rather than `absent`. An empty file-backed section is present and empty.
 
+`coverage.status` is `partial` when supported facts cannot all be examined or
+interpreted, including incomplete section names, malformed or unsupported
+metadata, and omitted duplicate named sections. When multiple `.modinfo`,
+`__versions`, `.gnu.linkonce.this_module`, `.init.text`, or `.exit.text`
+sections exist, the first is examined and a limitation identifies the omission.
+`complete` covers the supported inspection described here; it does not claim
+that `struct module`, symbol-table records, or certificate chains were decoded.
+
 ## Limits and failures
 
 The selected file is limited to 64 MiB by default (512 MiB maximum). At most

docs/reference/mcp-contracts.md

@@ -1358,6 +1358,15 @@ Native call tracing and process capture retain available observations in
 `details.partial_observation` on failure, including when cleanup succeeds.
 The observation reports its partial coverage; cleanup details describe host
 state separately from the execution failure.
+When a completed observation cannot be published because recording a source
+failed, the original source failure remains the error. `partial_observation`
+can carry the failed source and `completed_observation` carries the completed
+result, with `source_closure: "not-established"`. A retained reference is
+reported only when its owning ledger confirms it; an inline result with
+`retention: "unknown"` makes no claim about ledger membership. If an
+observation cannot fit the MCP response, its corresponding `_omitted` detail
+reports the delivery limit. Cleanup failure and other completed source failures
+remain visible separately.
 For these tools, cancellation observed during result finalization or owned
 cleanup also returns typed cancellation with the available observations.
 A normal target exit does not establish request completion. Incomplete cleanup
@@ -1672,7 +1681,7 @@ procedure resolution returns typed unreadable output; provider errors never
 become absence from their message text. `inspect_address_context` requires an explicit address and
 returns name, procedure, comment, inline-comment, and bookmark facets;
 unsupported facets are local `unavailable` outcomes. A facet rejected for
-invalid input or a resource constraint includes its canonical `error`
+invalid input, source Evidence integrity or a resource constraint includes its canonical `error`
 projection, including structured issues or reported limits and recovery,
 alongside the other facet outcomes. Use `current_document`,
 `current_address`, and `current_procedure` for direct single-field lookups; use

docs/specs/README.md

@@ -10,3 +10,8 @@ for the specification lifecycle, roadmap granularity and producer-owned contract
 
 - [Organization](documentation/organization/spec.md)
   ([plan](documentation/organization/plan.md), [tasks](documentation/organization/tasks.md))
+
+## Native
+
+- [Go static string-header literal recovery](native/go-string-literals/spec.md)
+  ([plan](native/go-string-literals/plan.md), [tasks](native/go-string-literals/tasks.md))

docs/specs/desktop-app-environments/build-witness/spec.md

@@ -84,6 +84,12 @@ and the recording and writes the record as Evidence.
   and the export's limitations name what the Trash held at the seed; a
   start from a bundle folder writes no bytecode into it; the first
   screenshot waits, briefly and bounded, until the frame is not one colour.
+- Gaps of the blind validation's solve runs: the exported app opens the
+  seed's one document at launch, when its desktop entry takes files, so a
+  solving agent starts in the document rather than on the app's start
+  screen; and `export_build_environment` passes `--synthetic-seed`, so the
+  README says the seed was made for the task instead of calling it the
+  user's real data.
 
 - Gaps of the second review: calls on one computer (actions, capture
   steps, checks and close) run one at a time in arrival order, so a stage's
@@ -94,11 +100,12 @@ and the recording and writes the record as Evidence.
   want of a readable or whole view is `undecided` and proves nothing; a
   stage only such checks would settle files nothing and can be checked
   again. Undecided includes a failure to find a line, row or value that may
-  lie in what a cut view left out; a check that passes on what the view kept
-  stays decided. The export likewise keeps a task only when a check fails on
-  what the seed's view shows. The controller writes a folder's file list to a
-  file that REA reads through `data/get`, so a large bundle's list is not cut
-  at the 1 MiB of a command's output.
+  lie in what a cut view left out, and any text check of an element in a cut
+  view, which may have lost text from between the element's runs; any other
+  check that passes on what the view kept stays decided. The export likewise keeps a task only when a check
+  fails on what the seed's view shows. The controller writes a folder's file
+  list to a file that REA reads through `data/get`, so a large bundle's list
+  is not cut at the 1 MiB of a command's output.
 - The witness reads the build computer's bounded action log: its stage rules
   use the log's count and the last applied action of each kind, and the
   record holds the entries the log keeps, `actions_dropped`, and a

docs/specs/desktop-app-environments/build-witness/tasks.md

@@ -11,3 +11,4 @@
 - [x] Fix the blind validation run's gaps and the export's install source for a `.deb`.
 - [x] Fix the second review's gaps: one call at a time per computer, the recording's request id, undecided checks and the bundle's file list.
 - [x] Leave a failure that a cut view may have caused undecided: a missing line, row or value.
+- [x] Open the seed's one document at launch, and word a seed made for the task as such.

docs/specs/desktop-app-environments/build-witness/verification.md

@@ -245,6 +245,41 @@ tests added, and passes now.
 - `DesktopBuildTurns.test.ts`: a running call that finishes after a close
   keeps its result.
 
+## Opening the seed's document
+
+Run on 2026-11-05: source tests and gates on macOS; the desktop source tests
+again on the Ubuntu 24.04 amd64 VM (40 files, 422 passed, none skipped).
+
+- `seedDocument.test.ts`: the seed's one document is appended when `Exec`
+  holds `%F`, `%U`, `%f` or `%u`, and the launch respells it as
+  `"$HOME"/'Documents/poster.svg'`; two documents, none, an `Exec` without a
+  file field code and a capture without a desktop entry keep the command and
+  give the reason; a command already naming a file under the home is kept.
+- `appExport.test.ts`: the README says what the launch opens, or why it
+  opens nothing; a seed made for the task is worded as such in the README
+  and the class, and a captured one as the user's real data.
+- `DesktopApplicationExport.test.ts`: from a seed-and-end capture launched
+  through `notes %U`, the class launches `notes` with the note; through
+  `notes`, or without a desktop entry, and from a baseline seed with no
+  document, it launches as captured and a limitation says why;
+  `--synthetic-seed` changes the limitation and the README and is recorded
+  as `synthetic_seed`.
+- `buildCaptureMcp.test.ts`: `export_build_environment` runs the export
+  with `--synthetic-seed`, and the real CLI's README for that capture says
+  the seed was made for the task.
+
+The blind Inkscape build's capture was gone with its build computer, so the
+bundle could not be exported again. Instead, a copy of that bundle had only
+its `Launch` command replaced by the one this code renders for its seed (one
+document, `Documents/poster.svg`; the image's `Exec=inkscape %F`). A computer
+of it came up in 47 s with Inkscape showing `poster.svg` and no Welcome
+screen, and `data/reset` relaunched it on the poster again. Three Claude Code
+runs with Sonnet 5.5 all passed, in 11, 9 and 10 turns for $0.70, $0.46 and
+$0.72 ($0.63 on average); the same bundle opening on the Welcome screen had
+taken 18, 23 and 21 turns for $0.70, $1.55 and $0.51 ($0.92). Cache reads
+fell from 585-714K tokens to 181-225K; the cost is mostly cache writes,
+which varied from 17K to 189K tokens whatever the turns.
+
 ## Limits of this verification
 
 - The witness acts were scripted by this agent from the task's prompt; no

docs/specs/desktop-app-environments/capture/spec.md

@@ -13,6 +13,10 @@ folder to build the environment; this step builds nothing.
 
 ## Requirements
 
+- The baseline records each observed non-file path and its type without
+  following symlinks, so a later state reader can distinguish an absent SQLite
+  sidecar from an observed non-file.
+
 - The command is CLI only. A capture is a long interactive session whose
   checkpoints come from stdin lines (empty, `checkpoint [name]` or other
   text) and which ends on `stop` or the end of stdin, when the launched

docs/specs/desktop-app-environments/export/spec.md

@@ -27,7 +27,12 @@ state through `data/add`, `data/get` and `data/reset`.
   class match with a window ready check, `paths` from the state view's roles
   (state directories of application state files, or a folder beside one that
   differs only in letter case in the files' spelling, and folders of
-  documents, nested ones collapsed) and the skill file.
+  documents, nested ones collapsed) and the skill file. When the seed holds
+  exactly one document and the desktop entry's `Exec` takes files, the
+  launch appends its path under `$HOME`; a command that already names a
+  document, absolute or from its working directory, is kept, a seed with no document launches as captured,
+  and otherwise the README and the limitations say why the app opens no
+  document.
 - With paths, it declares all three data hooks and calls agentenv's helpers:
   seed the home once per boot then `keep_initial`, `add`, `reset`, and `get`
   plus a data part holding a typed JSON view of each file. Without paths it
@@ -38,7 +43,8 @@ state through `data/add`, `data/get` and `data/reset`.
   application are compiled into the user's dconf database with `dconf-cli`,
   without D-Bus.
 - The README and the result state the agentenv-framework release the class was
-  checked against (0.9.1431), and that the seed is real user data.
+  checked against (0.9.1431), and that the seed is real user data, unless
+  `--synthetic-seed` says it was made for the task.
 
 ## Non-goals
 

docs/specs/desktop-app-environments/state-view/spec.md

@@ -12,7 +12,9 @@ generation reads the kinds of change.
 
 - CLI only, like the capture. The folder's `capture.json` must be
   `capture_desktop_application` Evidence from provider `rea-desktop` v1 with a
-  valid result; anything else is refused as invalid input.
+  valid result, including its baseline non-file inventory; anything else is
+  refused as invalid input. Captures from before that inventory was recorded
+  must be made again.
 - Retained bytes are read without following links and used only when their
   SHA-256 matches the name they are stored under.
 - A path in a folder beside a state directory whose name differs from it only
@@ -27,7 +29,11 @@ generation reads the kinds of change.
   refused when either existed but was not retained or the capture did not
   record whether it existed (unknown is never read as absent; absence holds
   only under content roots the baseline walked completely, with no truncation,
-  unreadable directory or unchecked path, outside recorded exclusions); dconf through
+  unreadable directory or unchecked path, outside recorded exclusions). A
+  later incomplete walk leaves a database or sidecar unconfirmed until an
+  explicit change records it; a subsequent complete walk alone cannot recover
+  a change the incomplete walk missed. Read SQLite only when the database and
+  both sidecars are confirmed at that version; dconf through
   `dconf dump /` on a private file profile, keeping only
   groups whose path names the application; JSON up to 4 MiB and 500 levels
   with exact numbers; XML through the shared strict parser, a DOCTYPE read

docs/specs/desktop-app-environments/xml-text-checks/spec.md

@@ -55,9 +55,11 @@ verifier's, agree.
   entry of another format; a value that is neither an element, a text node
   (a string among an element's `children`) nor an attribute's value (one among
   its `attributes`), so an element's `name` and the `doctype`'s fields fail;
-  and, as undecided, an element in a view that leaves something out, or a
-  selector searching an array such a view may cut. A text node is whole, so
-  it is decided on a truncated view.
+  and, as undecided, in a view that leaves something out, either check of an
+  element, even one whose kept text holds the value, since the cut may have
+  dropped text from between the runs it kept; a pointer naming nothing; or a
+  selector searching an array such a view may cut. A text node or an
+  attribute's value is whole, so it is decided on a truncated view.
 - Refusals: the task parser refuses the empty pointer, a pointer not starting
   with `/`, an empty `text_contains` value or one that is only whitespace
   with `normalize_whitespace`, and a value that looks like a date and time,

docs/specs/native/go-string-literals/plan.md

@@ -0,0 +1,40 @@
+# Implementation plan
+
+## Boundary and contract
+
+Extend `goBinarySchema` in `src/domain/go/goBinary.ts` with optional
+`string_literals` (`evidence_kind: "inferred"`, `items`, `discovered_count`,
+`aggregate_bytes`, `max_items`, `truncated`), plus `include_string_literals` and
+`max_string_literals` on `src/contracts/go/goToolContracts.ts` and
+`src/cli/goCommands.ts`. Add the `string_literals` view projection to
+`src/domain/analysisView/goBinaryView.ts` so callers can page recovered literals
+from retained Evidence without repeating file parsing.
+
+Implement `recoverGoStringLiterals` in `src/go/GoStringLiterals.ts` on top of
+`BinaryContainer` and `createFileMappingIndex`. Pre-index readable `LoadRegion`
+intervals once in `O(R log R)` so Mach-O section eligibility runs in `O(log R)`
+with periodic `checkActive` cancellation checks. Normalize header-scan spans by
+pointer alignment phase, merge overlaps, and sort by ascending file offset so
+`reference_count` counts each physical header once and `first_header_offset` is
+minimal. Deduplicate target slices in memory with bounded candidate and rejection
+caches before sorting deterministically by `(location.offset, location.bytes)`.
+
+## Incremental work and validation
+
+1. Define domain/MCP/CLI schemas, limitation notes and `string_literals` analysis
+   view behavior while preserving default omission when not requested.
+2. Implement `recoverGoStringLiterals` and wire `GoBinaryImage`,
+   `GoBinaryProvider` and `GoBinaryService` with cooperative cancellation.
+3. Add unit fixtures across ELF/PE/Mach-O, Unicode format-control filtering,
+   budget/cap truncation, overlapping ELF spans, bounded negative caching and
+   25,000-section Mach-O indexing/cancellation.
+4. Extend `scripts/verify-go-binary.mjs` via `artifactMcpCall` so real compiled Go
+   targets verify both CLI and advertised MCP `outputSchema` parity.
+5. Update the [Go binary guide](../../../guides/native/go-binaries.md), skill
+   guidance, generated catalogs and documentation route checks.
+
+## Effects and compatibility
+
+Default `inspect_go_binary` calls omit `string_literals` and preserve historical
+Evidence compatibility. No external tool or target execution is introduced; only
+bounded offline byte slicing over the already read `64 MiB` image buffer runs.

docs/specs/native/go-string-literals/spec.md

@@ -0,0 +1,45 @@
+# Go static string-header literal recovery
+
+## Problem and outcome
+
+Go compilers pack static string contents contiguously in read-only sections
+(`.rodata`, `__TEXT,__rodata` / `__TEXT,__const`, `.rdata`) without NUL
+terminators. Generic C-string scans merge adjacent Go literals into multi-kilobyte
+runs. Extend `inspect_go_binary` / `inspect-go-binary` with opt-in, bounded
+`(ptr, len)` `reflect.StringHeader` recovery across ELF, PE and thin Mach-O
+images so static string slices are recovered at their exact boundaries.
+
+## Requirements
+
+- Keep `include_string_literals` opt-in (`false` by default) so existing
+  build-metadata output and payload size are unchanged unless requested.
+- Scan only pointer-aligned non-executable initialized data spans (with indexed
+  `O(log R)` readable segment checks on Mach-O and sectionless/unnamed-ELF
+  load-region fallbacks) in deduplicated ascending file-offset order.
+- Admit candidate `[ptr, ptr + len)` slices only inside single read-only
+  non-executable mapped spans with `1 <= len <= 4096`, non-overlapping with the
+  header itself, and valid printable UTF-8 (allowing `\t`, `\n`, `\r`, `U+200C`
+  and `U+200D` while rejecting control, surrogate, noncharacter, private-use and
+  invisible/bidi `\p{Cf}` code points).
+- Bound header-scan work (`64 MiB`), tracked candidates (`100,000`), negative
+  slice cache (`4,096`), returned items (`max_string_literals`, `1..10,000`,
+  default `2,000`), and aggregate returned UTF-8 bytes (`512 KiB`), reporting
+  `evidence_kind: "inferred"`, `discovered_count`, `aggregate_bytes` and
+  `truncated` honestly.
+- Record limitation notes when Mach-O `LC_DYLD_CHAINED_FIXUPS` encodes rebases in
+  pointer slots or when truncation occurs, and expose a focused `string_literals`
+  projection in `inspect_analysis_view`.
+
+## Acceptance
+
+Unit, boundary and CLI acceptance tests cover ELF/PE/Mach-O (32/64-bit, little
+and big endian), sectionless and unreadable-`.shstrtab` ELF images, overlapping
+spans, `U+200C`/`U+200D` versus disallowed `\p{Cf}` controls, negative-cache and
+output caps, and 25,000-region Mach-O indexing/cancellation. The real Go binary
+verifier validates CLI and advertised-schema MCP parity across compiled targets.
+
+## Out of scope
+
+Instruction-operand immediate string recovery (stack/register `MOV`/`LEA` pairs
+without static two-word headers), Mach-O chained-fixup rebase decoding, binary
+execution, and non-UTF-8 byte-slice guessing.

docs/specs/native/go-string-literals/tasks.md

@@ -0,0 +1,8 @@
+# Tasks
+
+- [x] Define single-feature scope, contracts and implementation plan (`spec.md`, `plan.md`).
+- [x] Extend `goBinarySchema`, MCP contracts, CLI flags and `inspect_analysis_view` (`string_literals`).
+- [x] Implement bounded `(ptr, len)` recovery in `src/go/GoStringLiterals.ts` with `O(R log R)` Mach-O region indexing and non-overlapping file-order header scanning.
+- [x] Add unit, provider, MCP view and CLI acceptance tests for multi-format recovery, Unicode `\p{Cf}` / ZWNJ / ZWJ filtering, caps, negative-cache bounds and 25,000-section Mach-O scaling.
+- [x] Verify CLI and `artifactMcpCall` advertised-schema MCP parity across compiled targets in `scripts/verify-go-binary.mjs`.
+- [x] Update the Go binary guide, skill reference and generated catalogs; pass documentation route and static checks.

licenses/npm-dependencies.txt

@@ -2,7 +2,7 @@ REA npm dependency inventory
 Prepared from the root package-lock.json; refresh this inventory when locked dependencies change.
 License identifiers are upstream lockfile declarations, not a legal assessment.
 Runtime includes transitive and optional platform packages; development includes build, test and website tooling.
-Locked package entries: 964; runtime: 181.
+Locked package entries: 966; runtime: 175.
 Full runtime copyright/license/NOTICE texts: npm-runtime-notices.txt.
 
 @algolia/[email protected] | development | MIT
@@ -395,12 +395,12 @@ [email protected] | development | MIT
   Package: https://www.npmjs.com/package/@docsearch/react/v/3.8.2
   Archive: https://registry.npmjs.org/@docsearch/react/-/react-3.8.2.tgz
   Integrity: sha512-xCRrJQlTt8N9GU0DG4ptwHRkfnSnD/YpdeaXe02iKfqs97TkZJv60yE+1eq/tjPcVnTW8dP5qLP7itifFVV5eg==
-@electron/[email protected] | runtime | MIT
+@electron/[email protected] | development | MIT
   Lockfile path: node_modules/@electron/asar
   Package: https://www.npmjs.com/package/@electron/asar/v/4.2.0
   Archive: https://registry.npmjs.org/@electron/asar/-/asar-4.2.0.tgz
   Integrity: sha512-npW1NW5yy8EB9XY/vEw9sUdgmq0sJEhmSBb6bqyFOAw1CSkrhvAvO6QWlW8CdIMo8VN1lkdF345l/MeW0LrY0Q==
-[email protected] | runtime | MIT
+[email protected] | development | MIT
   Lockfile path: node_modules/@electron/asar/node_modules/commander
   Package: https://www.npmjs.com/package/commander/v/13.1.0
   Archive: https://registry.npmjs.org/commander/-/commander-13.1.0.tgz
@@ -655,6 +655,11 @@ [email protected] | runtime | MIT
   Package: https://www.npmjs.com/package/@inquirer/type/v/4.2.0
   Archive: https://registry.npmjs.org/@inquirer/type/-/type-4.2.0.tgz
   Integrity: sha512-2rnHX8RPo4glJYqnFc/v3nQeIhDcjyRRyaT7MGcfL/8xv/8K03SXYoA2tX06WVSKywWOE/ncbG3dtuzLjR5TCQ==
+@isaacs/[email protected] | development | BlueOak-1.0.0
+  Lockfile path: node_modules/@isaacs/nonrecursive-glob-match
+  Package: https://www.npmjs.com/package/@isaacs/nonrecursive-glob-match/v/1.1.0
+  Archive: https://registry.npmjs.org/@isaacs/nonrecursive-glob-match/-/nonrecursive-glob-match-1.1.0.tgz
+  Integrity: sha512-GPm/Dbvk5RLmhRnxXIa7nTpK0xtl4E0wj0MslsuNiJ1FIROU+2+9lgUC/dgF7Ey4QCWhfEsgxilMRMCdHPfDfw==
 @jridgewell/[email protected] | development | MIT
   Lockfile path: node_modules/@jridgewell/gen-mapping
   Package: https://www.npmjs.com/package/@jridgewell/gen-mapping/v/0.4.0-beta.0
@@ -2815,11 +2820,16 @@ [email protected] | runtime, optional | MIT
   Package: https://www.npmjs.com/package/github-from-package/v/0.0.0
   Archive: https://registry.npmjs.org/github-from-package/-/github-from-package-0.0.0.tgz
   Integrity: sha512-SyHy3T1v2NUXn29OsWdxmK6RwHD+vkj3v8en8AOBZ1wBQ/hCAQ5bAQTD02kW4W9tUp/3Qh6J8r9EvntiyCmOOw==
-glob@13.0.6 | runtime | BlueOak-1.0.0
+glob@14.0.4 | development | BlueOak-1.0.0
   Lockfile path: node_modules/glob
-  Package: https://www.npmjs.com/package/glob/v/13.0.6
-  Archive: https://registry.npmjs.org/glob/-/glob-13.0.6.tgz
-  Integrity: sha512-Wjlyrolmm8uDpm/ogGyXZXb1Z+Ca2B8NbJwqBVg0axK9GbBeoS7yGV6vjXnYdGm6X53iehEuxxbyiKp8QmN4Vw==
+  Package: https://www.npmjs.com/package/glob/v/14.0.4
+  Archive: https://registry.npmjs.org/glob/-/glob-14.0.4.tgz
+  Integrity: sha512-mMiwNKoJZ4HAIRVJxotO6LsNRReA30gQwP9E2/p94tfLv+jygCNpKDjhhSL6OLY6LE371EZm5EAf7RpYuUqlsw==
+[email protected] | development | BlueOak-1.0.0
+  Lockfile path: node_modules/glob/node_modules/minimatch
+  Package: https://www.npmjs.com/package/minimatch/v/11.0.5
+  Archive: https://registry.npmjs.org/minimatch/-/minimatch-11.0.5.tgz
+  Integrity: sha512-snPlVppFcYWfLLFQGhDxUyBcHNtMlWmn3jtj7pEaO+DP8pqL0IvAzXhMYmn1z9ASNtgmwLBdFxSf4tMUB0OTKA==
 [email protected] | runtime | MIT
   Lockfile path: node_modules/gopd
   Package: https://www.npmjs.com/package/gopd/v/1.2.0
@@ -3275,11 +3285,11 @@ [email protected] | runtime | MIT
   Package: https://www.npmjs.com/package/lossless-json/v/4.3.1
   Archive: https://registry.npmjs.org/lossless-json/-/lossless-json-4.3.1.tgz
   Integrity: sha512-SqD/Bg3ZfltBJ2Z14hJ/BihnvtV553WO4g9/ePtlp4lrnl9jF3AdIJt53A/Wkg/0Li+LMfxaBqgx1MiFZdQlpQ==
-[email protected].2 | runtime | BlueOak-1.0.0
+[email protected].3 | development | BlueOak-1.0.0
   Lockfile path: node_modules/lru-cache
-  Package: https://www.npmjs.com/package/lru-cache/v/11.5.2
-  Archive: https://registry.npmjs.org/lru-cache/-/lru-cache-11.5.2.tgz
-  Integrity: sha512-4pfM1Ff0x50o0tQwb5ucw/RzNyD0/YJME6IVcStalZuMWxdt3sR3huStTtxz4PUmvZfRguvDejasvQ2kifR11g==
+  Package: https://www.npmjs.com/package/lru-cache/v/11.5.3
+  Archive: https://registry.npmjs.org/lru-cache/-/lru-cache-11.5.3.tgz
+  Integrity: sha512-U4N8FgzmWxc8k1VH8Kr6lQg18U7Fjvby6wXHVRX/ZZ7IwWbRMgrRbP0Wrb5q5NVinryp4SQampHKdvtecItxUg==
 [email protected] | development | MIT
   Lockfile path: node_modules/magic-string
   Package: https://www.npmjs.com/package/magic-string/v/1.4.3
@@ -3410,7 +3420,7 @@ [email protected] | runtime | MIT
   Package: https://www.npmjs.com/package/minimisted/v/2.0.1
   Archive: https://registry.npmjs.org/minimisted/-/minimisted-2.0.1.tgz
   Integrity: sha512-1oPjfuLQa2caorJUM8HV8lGgWCc0qqAO1MNv/k05G4qslmsndV/5WdNZrqCiyqiz3wohia2Ij2B7w2Dr7/IyrA==
-[email protected] | runtime | BlueOak-1.0.0
+[email protected] | development | BlueOak-1.0.0
   Lockfile path: node_modules/minipass
   Package: https://www.npmjs.com/package/minipass/v/7.1.3
   Archive: https://registry.npmjs.org/minipass/-/minipass-7.1.3.tgz
@@ -3670,11 +3680,11 @@ [email protected] | development | MIT
   Package: https://www.npmjs.com/package/path-parse/v/1.0.7
   Archive: https://registry.npmjs.org/path-parse/-/path-parse-1.0.7.tgz
   Integrity: sha512-LDJzPVEEEPR+y48z93A0Ed0yXb8pAByGWo/k5YYdYgpY2/2EsOsksJrq7lOHxryrVOn1ejG6oAp8ahvOIQD8sw==
-path-scurry@2.0.2 | runtime | BlueOak-1.0.0
+path-scurry@3.0.0 | development | BlueOak-1.0.0
   Lockfile path: node_modules/path-scurry
-  Package: https://www.npmjs.com/package/path-scurry/v/2.0.2
-  Archive: https://registry.npmjs.org/path-scurry/-/path-scurry-2.0.2.tgz
-  Integrity: sha512-3O/iVVsJAPsOnpwWIeD+d6z/7PmqApyQePUtCndjatj/9I5LylHvt5qluFaBT3I5h3r1ejfR056c+FCv+NnNXg==
+  Package: https://www.npmjs.com/package/path-scurry/v/3.0.0
+  Archive: https://registry.npmjs.org/path-scurry/-/path-scurry-3.0.0.tgz
+  Integrity: sha512-1pTbQqH1wIwMi/eleQ5leFTTCkzFsPcgXNjwOA8YGGW/W4/kHT3dssE7Z6NH+zuqNLOzOB0uaD61yl7cAcVhgg==
 [email protected] | development | MIT
   Lockfile path: node_modules/perfect-debounce
   Package: https://www.npmjs.com/package/perfect-debounce/v/1.0.0
@@ -4670,11 +4680,11 @@ [email protected] | development | MIT
   Package: https://www.npmjs.com/package/esbuild/v/0.25.12
   Archive: https://registry.npmjs.org/esbuild/-/esbuild-0.25.12.tgz
   Integrity: sha512-bbPBYYrtZbkt6Os6FiTLCTFxvq4tt3JKall1vRwshA3fdVztsLAatFaZobhkBC8/BrPetoa0oksYoKXoG4ryJg==
-[email protected].4 | development | MIT
+[email protected].5 | development | MIT
   Lockfile path: node_modules/vitepress/node_modules/vite
-  Package: https://www.npmjs.com/package/vite/v/6.4.4
-  Archive: https://registry.npmjs.org/vite/-/vite-6.4.4.tgz
-  Integrity: sha512-xGjU/SyjeNyb0E4KxXBvYz/1C+3JXuujvf2hXNOtnlcE+58o5ajd9N2/n2VhkiJvpCP2qQasnUpx5PXNeI+p1Q==
+  Package: https://www.npmjs.com/package/vite/v/6.4.5
+  Archive: https://registry.npmjs.org/vite/-/vite-6.4.5.tgz
+  Integrity: sha512-4enwjFfi4IwtEh0w+jPzpLVOFQiPHmmzPxcHXQOyEur47o6u0jE573DmGpjA+7irXoMLYRZD5ZaFUEneS3abPg==
 [email protected] | development | MIT
   Lockfile path: node_modules/vitest
   Package: https://www.npmjs.com/package/vitest/v/5.0.3

licenses/npm-runtime-notices.txt

@@ -1,7 +1,7 @@
 REA third-party npm runtime copyright, license and NOTICE texts
 Collected from integrity-verified locked npm archives. Release-specific supplements and upstream notice gaps are identified in their entries.
 External engines are separately obtained; see THIRD_PARTY_NOTICES.md.
-Runtime dependency fingerprint (SHA-256): 13e2e43ee348b0cc210699dff53278d47e9e94c65934796c82eabc912f7c3938
+Runtime dependency fingerprint (SHA-256): 0119b7e66d63524f25c35f294b3264a901b764282b7d3bd1d0b493a9143498d0
 
 ===== @babel/[email protected] =====
 Declared license: MIT
@@ -443,68 +443,6 @@ The above copyright notice and this permission notice shall be included in all c
 THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
 
 
-===== @electron/[email protected] =====
-Declared license: MIT
-Archive: https://registry.npmjs.org/@electron/asar/-/asar-4.2.0.tgz
-Integrity: sha512-npW1NW5yy8EB9XY/vEw9sUdgmq0sJEhmSBb6bqyFOAw1CSkrhvAvO6QWlW8CdIMo8VN1lkdF345l/MeW0LrY0Q==
-Scope: npm runtime dependency, including optional platform packages.
-
---- package/LICENSE.md ---
-
-Copyright (c) 2014 GitHub Inc.
-
-Permission is hereby granted, free of charge, to any person obtaining
-a copy of this software and associated documentation files (the
-"Software"), to deal in the Software without restriction, including
-without limitation the rights to use, copy, modify, merge, publish,
-distribute, sublicense, and/or sell copies of the Software, and to
-permit persons to whom the Software is furnished to do so, subject to
-the following conditions:
-
-The above copyright notice and this permission notice shall be
-included in all copies or substantial portions of the Software.
-
-THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,
-EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF
-MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND
-NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE
-LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION
-OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION
-WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
-
-
-===== [email protected] =====
-Declared license: MIT
-Archive: https://registry.npmjs.org/commander/-/commander-13.1.0.tgz
-Integrity: sha512-/rFeCpNJQbhSZjGVwO9RFV3xPqbnERS8MmIQzCtD/zl6gpJuV/bMLuN92oG3F7d8oDEHHRrujSXNUr8fpjntKw==
-Scope: npm runtime dependency, including optional platform packages.
-
---- package/LICENSE ---
-
-(The MIT License)
-
-Copyright (c) 2011 TJ Holowaychuk <[email protected]>
-
-Permission is hereby granted, free of charge, to any person obtaining
-a copy of this software and associated documentation files (the
-'Software'), to deal in the Software without restriction, including
-without limitation the rights to use, copy, modify, merge, publish,
-distribute, sublicense, and/or sell copies of the Software, and to
-permit persons to whom the Software is furnished to do so, subject to
-the following conditions:
-
-The above copyright notice and this permission notice shall be
-included in all copies or substantial portions of the Software.
-
-THE SOFTWARE IS PROVIDED 'AS IS', WITHOUT WARRANTY OF ANY KIND,
-EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF
-MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT.
-IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY
-CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT,
-TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE
-SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
-
-
 ===== @jridgewell/[email protected] =====
 Declared license: MIT
 Archive: https://registry.npmjs.org/@jridgewell/resolve-uri/-/resolve-uri-3.1.2.tgz
@@ -4122,79 +4060,6 @@ OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
 SOFTWARE.
 
 
-===== [email protected] =====
-Declared license: BlueOak-1.0.0
-Archive: https://registry.npmjs.org/glob/-/glob-13.0.6.tgz
-Integrity: sha512-Wjlyrolmm8uDpm/ogGyXZXb1Z+Ca2B8NbJwqBVg0axK9GbBeoS7yGV6vjXnYdGm6X53iehEuxxbyiKp8QmN4Vw==
-Scope: npm runtime dependency, including optional platform packages.
-
---- package/LICENSE.md ---
-
-All packages under `src/` are licensed according to the terms in
-their respective `LICENSE` or `LICENSE.md` files.
-
-The remainder of this project is licensed under the Blue Oak
-Model License, as follows:
-
------
-
-# Blue Oak Model License
-
-Version 1.0.0
-
-## Purpose
-
-This license gives everyone as much permission to work with
-this software as possible, while protecting contributors
-from liability.
-
-## Acceptance
-
-In order to receive this license, you must agree to its
-rules.  The rules of this license are both obligations
-under that agreement and conditions to your license.
-You must not do anything with this software that triggers
-a rule that you cannot or will not follow.
-
-## Copyright
-
-Each contributor licenses you to do everything with this
-software that would otherwise infringe that contributor's
-copyright in it.
-
-## Notices
-
-You must ensure that everyone who gets a copy of
-any part of this software from you, with or without
-changes, also gets the text of this license or a link to
-<https://blueoakcouncil.org/license/1.0.0>.
-
-## Excuse
-
-If anyone notifies you in writing that you have not
-complied with [Notices](#notices), you can keep your
-license by taking all practical steps to comply within 30
-days after the notice.  If you do not do so, your license
-ends immediately.
-
-## Patent
-
-Each contributor licenses you to do everything with this
-software that would otherwise infringe any patent claims
-they can license or become able to license.
-
-## Reliability
-
-No contributor can revoke this license.
-
-## No Liability
-
-***As far as the law allows, this software comes as is,
-without any warranty or condition, and no contributor
-will be liable to anyone for any damages related to this
-software or this license, under any kind of legal claim.***
-
-
 ===== [email protected] =====
 Declared license: MIT
 Archive: https://registry.npmjs.org/gopd/-/gopd-1.2.0.tgz
@@ -5100,71 +4965,6 @@ The above copyright notice and this permission notice shall be included in all c
 THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
 
 
-===== [email protected] =====
-Declared license: BlueOak-1.0.0
-Archive: https://registry.npmjs.org/lru-cache/-/lru-cache-11.5.2.tgz
-Integrity: sha512-4pfM1Ff0x50o0tQwb5ucw/RzNyD0/YJME6IVcStalZuMWxdt3sR3huStTtxz4PUmvZfRguvDejasvQ2kifR11g==
-Scope: npm runtime dependency, including optional platform packages.
-
---- package/LICENSE.md ---
-
-# Blue Oak Model License
-
-Version 1.0.0
-
-## Purpose
-
-This license gives everyone as much permission to work with
-this software as possible, while protecting contributors
-from liability.
-
-## Acceptance
-
-In order to receive this license, you must agree to its
-rules.  The rules of this license are both obligations
-under that agreement and conditions to your license.
-You must not do anything with this software that triggers
-a rule that you cannot or will not follow.
-
-## Copyright
-
-Each contributor licenses you to do everything with this
-software that would otherwise infringe that contributor's
-copyright in it.
-
-## Notices
-
-You must ensure that everyone who gets a copy of
-any part of this software from you, with or without
-changes, also gets the text of this license or a link to
-<https://blueoakcouncil.org/license/1.0.0>.
-
-## Excuse
-
-If anyone notifies you in writing that you have not
-complied with [Notices](#notices), you can keep your
-license by taking all practical steps to comply within 30
-days after the notice.  If you do not do so, your license
-ends immediately.
-
-## Patent
-
-Each contributor licenses you to do everything with this
-software that would otherwise infringe any patent claims
-they can license or become able to license.
-
-## Reliability
-
-No contributor can revoke this license.
-
-## No Liability
-
-***As far as the law allows, this software comes as is,
-without any warranty or condition, and no contributor
-will be liable to anyone for any damages related to this
-software or this license, under any kind of legal claim.***
-
-
 ===== [email protected] =====
 Declared license: MIT
 Archive: https://registry.npmjs.org/math-intrinsics/-/math-intrinsics-1.1.0.tgz
@@ -5342,71 +5142,6 @@ IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTI
 USE OR OTHER DEALINGS IN THE SOFTWARE.
 
 
-===== [email protected] =====
-Declared license: BlueOak-1.0.0
-Archive: https://registry.npmjs.org/minipass/-/minipass-7.1.3.tgz
-Integrity: sha512-tEBHqDnIoM/1rXME1zgka9g6Q2lcoCkxHLuc7ODJ5BxbP5d4c2Z5cGgtXAku59200Cx7diuHTOYfSBD8n6mm8A==
-Scope: npm runtime dependency, including optional platform packages.
-
---- package/LICENSE.md ---
-
-# Blue Oak Model License
-
-Version 1.0.0
-
-## Purpose
-
-This license gives everyone as much permission to work with
-this software as possible, while protecting contributors
-from liability.
-
-## Acceptance
-
-In order to receive this license, you must agree to its
-rules.  The rules of this license are both obligations
-under that agreement and conditions to your license.
-You must not do anything with this software that triggers
-a rule that you cannot or will not follow.
-
-## Copyright
-
-Each contributor licenses you to do everything with this
-software that would otherwise infringe that contributor's
-copyright in it.
-
-## Notices
-
-You must ensure that everyone who gets a copy of
-any part of this software from you, with or without
-changes, also gets the text of this license or a link to
-<https://blueoakcouncil.org/license/1.0.0>.
-
-## Excuse
-
-If anyone notifies you in writing that you have not
-complied with [Notices](#notices), you can keep your
-license by taking all practical steps to comply within 30
-days after the notice.  If you do not do so, your license
-ends immediately.
-
-## Patent
-
-Each contributor licenses you to do everything with this
-software that would otherwise infringe any patent claims
-they can license or become able to license.
-
-## Reliability
-
-No contributor can revoke this license.
-
-## No Liability
-
-***As far as the law allows, this software comes as is,
-without any warranty or condition, and no contributor
-will be liable to anyone for any damages related to this
-software or this license, under any kind of legal claim.***
-
-
 ===== [email protected] =====
 Declared license: MIT
 Archive: https://registry.npmjs.org/on-exit-leak-free/-/on-exit-leak-free-2.1.2.tgz
@@ -5737,71 +5472,6 @@ The above copyright notice and this permission notice shall be included in all c
 THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
 
 
-===== [email protected] =====
-Declared license: BlueOak-1.0.0
-Archive: https://registry.npmjs.org/path-scurry/-/path-scurry-2.0.2.tgz
-Integrity: sha512-3O/iVVsJAPsOnpwWIeD+d6z/7PmqApyQePUtCndjatj/9I5LylHvt5qluFaBT3I5h3r1ejfR056c+FCv+NnNXg==
-Scope: npm runtime dependency, including optional platform packages.
-
---- package/LICENSE.md ---
-
-# Blue Oak Model License
-
-Version 1.0.0
-
-## Purpose
-
-This license gives everyone as much permission to work with
-this software as possible, while protecting contributors
-from liability.
-
-## Acceptance
-
-In order to receive this license, you must agree to its
-rules.  The rules of this license are both obligations
-under that agreement and conditions to your license.
-You must not do anything with this software that triggers
-a rule that you cannot or will not follow.
-
-## Copyright
-
-Each contributor licenses you to do everything with this
-software that would otherwise infringe that contributor's
-copyright in it.
-
-## Notices
-
-You must ensure that everyone who gets a copy of
-any part of this software from you, with or without
-changes, also gets the text of this license or a link to
-<https://blueoakcouncil.org/license/1.0.0>.
-
-## Excuse
-
-If anyone notifies you in writing that you have not
-complied with [Notices](#notices), you can keep your
-license by taking all practical steps to comply within 30
-days after the notice.  If you do not do so, your license
-ends immediately.
-
-## Patent
-
-Each contributor licenses you to do everything with this
-software that would otherwise infringe any patent claims
-they can license or become able to license.
-
-## Reliability
-
-No contributor can revoke this license.
-
-## No Liability
-
-***As far as the law allows, this software comes as is,
-without any warranty or condition, and no contributor
-will be liable to anyone for any damages related to this
-software or this license, under any kind of legal claim.***
-
-
 ===== [email protected] =====
 Declared license: MIT
 Archive: https://registry.npmjs.org/pify/-/pify-4.0.1.tgz

package-lock.json

@@ -13,7 +13,6 @@
         "@babel/types": "8.0.4",
         "@bufbuild/protobuf": "2.16.0",
         "@clack/prompts": "1.7.0",
-        "@electron/asar": "4.2.0",
         "@jridgewell/trace-mapping": "0.3.31",
         "@lydell/node-pty": "1.1.0",
         "@modelcontextprotocol/client": "2.3.1",
@@ -58,6 +57,7 @@
         "rea-agents": "scripts/rea.mjs"
       },
       "devDependencies": {
+        "@electron/asar": "4.2.0",
         "@fast-check/vitest": "0.5.0",
         "@stryker-mutator/core": "10.0.0",
         "@stryker-mutator/typescript-checker": "10.0.0",
@@ -1252,6 +1252,7 @@
       "version": "4.2.0",
       "resolved": "https://registry.npmjs.org/@electron/asar/-/asar-4.2.0.tgz",
       "integrity": "sha512-npW1NW5yy8EB9XY/vEw9sUdgmq0sJEhmSBb6bqyFOAw1CSkrhvAvO6QWlW8CdIMo8VN1lkdF345l/MeW0LrY0Q==",
+      "dev": true,
       "license": "MIT",
       "dependencies": {
         "commander": "^13.1.0",
@@ -1269,6 +1270,7 @@
       "version": "13.1.0",
       "resolved": "https://registry.npmjs.org/commander/-/commander-13.1.0.tgz",
       "integrity": "sha512-/rFeCpNJQbhSZjGVwO9RFV3xPqbnERS8MmIQzCtD/zl6gpJuV/bMLuN92oG3F7d8oDEHHRrujSXNUr8fpjntKw==",
+      "dev": true,
       "license": "MIT",
       "engines": {
         "node": ">=18"
@@ -2155,6 +2157,13 @@
         }
       }
     },
+    "node_modules/@isaacs/nonrecursive-glob-match": {
+      "version": "1.1.0",
+      "resolved": "https://registry.npmjs.org/@isaacs/nonrecursive-glob-match/-/nonrecursive-glob-match-1.1.0.tgz",
+      "integrity": "sha512-GPm/Dbvk5RLmhRnxXIa7nTpK0xtl4E0wj0MslsuNiJ1FIROU+2+9lgUC/dgF7Ey4QCWhfEsgxilMRMCdHPfDfw==",
+      "dev": true,
+      "license": "BlueOak-1.0.0"
+    },
     "node_modules/@jridgewell/gen-mapping": {
       "version": "0.4.0-beta.0",
       "resolved": "https://registry.npmjs.org/@jridgewell/gen-mapping/-/gen-mapping-0.4.0-beta.0.tgz",
@@ -6215,6 +6224,7 @@
       "version": "4.0.4",
       "resolved": "https://registry.npmjs.org/balanced-match/-/balanced-match-4.0.4.tgz",
       "integrity": "sha512-BLrgEcRTwX2o6gGxGOCNyMvGSp35YofuYzw9h1IMTRmKqttAZZVU67bdb9Pr2vUHA8+j3i2tJfjO6C6+4myGTA==",
+      "devOptional": true,
       "license": "MIT",
       "engines": {
         "node": "18 || 20 || >=22"
@@ -6343,6 +6353,7 @@
       "version": "5.0.12",
       "resolved": "https://registry.npmjs.org/brace-expansion/-/brace-expansion-5.0.12.tgz",
       "integrity": "sha512-YovQ3rzhaLMIrDjNDMkNS01tea93qhEhG5xy8f6+R0l+dw3Ki+5sCoIoI942iuLZTHWogWktgwVDhU09iNEimQ==",
+      "devOptional": true,
       "license": "MIT",
       "dependencies": {
         "balanced-match": "^4.0.2"
@@ -8081,14 +8092,15 @@
       "optional": true
     },
     "node_modules/glob": {
-      "version": "13.0.6",
-      "resolved": "https://registry.npmjs.org/glob/-/glob-13.0.6.tgz",
-      "integrity": "sha512-Wjlyrolmm8uDpm/ogGyXZXb1Z+Ca2B8NbJwqBVg0axK9GbBeoS7yGV6vjXnYdGm6X53iehEuxxbyiKp8QmN4Vw==",
+      "version": "14.0.4",
+      "resolved": "https://registry.npmjs.org/glob/-/glob-14.0.4.tgz",
+      "integrity": "sha512-mMiwNKoJZ4HAIRVJxotO6LsNRReA30gQwP9E2/p94tfLv+jygCNpKDjhhSL6OLY6LE371EZm5EAf7RpYuUqlsw==",
+      "dev": true,
       "license": "BlueOak-1.0.0",
       "dependencies": {
-        "minimatch": "^10.2.2",
+        "minimatch": "^11.0.5",
         "minipass": "^7.1.3",
-        "path-scurry": "^2.0.2"
+        "path-scurry": "^3.0.0"
       },
       "engines": {
         "node": "18 || 20 || >=22"
@@ -8097,6 +8109,23 @@
         "url": "https://github.com/sponsors/isaacs"
       }
     },
+    "node_modules/glob/node_modules/minimatch": {
+      "version": "11.0.5",
+      "resolved": "https://registry.npmjs.org/minimatch/-/minimatch-11.0.5.tgz",
+      "integrity": "sha512-snPlVppFcYWfLLFQGhDxUyBcHNtMlWmn3jtj7pEaO+DP8pqL0IvAzXhMYmn1z9ASNtgmwLBdFxSf4tMUB0OTKA==",
+      "dev": true,
+      "license": "BlueOak-1.0.0",
+      "dependencies": {
+        "@isaacs/nonrecursive-glob-match": "^1.1.0",
+        "brace-expansion": "^5.0.12"
+      },
+      "engines": {
+        "node": "20 || >=22"
+      },
+      "funding": {
+        "url": "https://github.com/sponsors/isaacs"
+      }
+    },
     "node_modules/gopd": {
       "version": "1.2.0",
       "resolved": "https://registry.npmjs.org/gopd/-/gopd-1.2.0.tgz",
@@ -9379,9 +9408,10 @@
       "license": "MIT"
     },
     "node_modules/lru-cache": {
-      "version": "11.5.2",
-      "resolved": "https://registry.npmjs.org/lru-cache/-/lru-cache-11.5.2.tgz",
-      "integrity": "sha512-4pfM1Ff0x50o0tQwb5ucw/RzNyD0/YJME6IVcStalZuMWxdt3sR3huStTtxz4PUmvZfRguvDejasvQ2kifR11g==",
+      "version": "11.5.3",
+      "resolved": "https://registry.npmjs.org/lru-cache/-/lru-cache-11.5.3.tgz",
+      "integrity": "sha512-U4N8FgzmWxc8k1VH8Kr6lQg18U7Fjvby6wXHVRX/ZZ7IwWbRMgrRbP0Wrb5q5NVinryp4SQampHKdvtecItxUg==",
+      "dev": true,
       "license": "BlueOak-1.0.0",
       "engines": {
         "node": "20 || >=22"
@@ -9689,6 +9719,7 @@
       "version": "10.2.5",
       "resolved": "https://registry.npmjs.org/minimatch/-/minimatch-10.2.5.tgz",
       "integrity": "sha512-MULkVLfKGYDFYejP07QOurDLLQpcjk7Fw+7jXS2R2czRQzR56yHRveU5NDJEOviH+hETZKSkIk5c+T23GjFUMg==",
+      "devOptional": true,
       "license": "BlueOak-1.0.0",
       "dependencies": {
         "brace-expansion": "^5.0.5"
@@ -9747,6 +9778,7 @@
       "version": "7.1.3",
       "resolved": "https://registry.npmjs.org/minipass/-/minipass-7.1.3.tgz",
       "integrity": "sha512-tEBHqDnIoM/1rXME1zgka9g6Q2lcoCkxHLuc7ODJ5BxbP5d4c2Z5cGgtXAku59200Cx7diuHTOYfSBD8n6mm8A==",
+      "dev": true,
       "license": "BlueOak-1.0.0",
       "engines": {
         "node": ">=16 || 14 >=14.17"
@@ -10442,9 +10474,10 @@
       "license": "MIT"
     },
     "node_modules/path-scurry": {
-      "version": "2.0.2",
-      "resolved": "https://registry.npmjs.org/path-scurry/-/path-scurry-2.0.2.tgz",
-      "integrity": "sha512-3O/iVVsJAPsOnpwWIeD+d6z/7PmqApyQePUtCndjatj/9I5LylHvt5qluFaBT3I5h3r1ejfR056c+FCv+NnNXg==",
+      "version": "3.0.0",
+      "resolved": "https://registry.npmjs.org/path-scurry/-/path-scurry-3.0.0.tgz",
+      "integrity": "sha512-1pTbQqH1wIwMi/eleQ5leFTTCkzFsPcgXNjwOA8YGGW/W4/kHT3dssE7Z6NH+zuqNLOzOB0uaD61yl7cAcVhgg==",
+      "dev": true,
       "license": "BlueOak-1.0.0",
       "dependencies": {
         "lru-cache": "^11.0.0",
@@ -13434,9 +13467,9 @@
       }
     },
     "node_modules/vitepress/node_modules/vite": {
-      "version": "6.4.4",
-      "resolved": "https://registry.npmjs.org/vite/-/vite-6.4.4.tgz",
-      "integrity": "sha512-xGjU/SyjeNyb0E4KxXBvYz/1C+3JXuujvf2hXNOtnlcE+58o5ajd9N2/n2VhkiJvpCP2qQasnUpx5PXNeI+p1Q==",
+      "version": "6.4.5",
+      "resolved": "https://registry.npmjs.org/vite/-/vite-6.4.5.tgz",
+      "integrity": "sha512-4enwjFfi4IwtEh0w+jPzpLVOFQiPHmmzPxcHXQOyEur47o6u0jE573DmGpjA+7irXoMLYRZD5ZaFUEneS3abPg==",
       "dev": true,
       "license": "MIT",
       "dependencies": {

package.json

@@ -361,7 +361,6 @@
     "@babel/types": "8.0.4",
     "@bufbuild/protobuf": "2.16.0",
     "@clack/prompts": "1.7.0",
-    "@electron/asar": "4.2.0",
     "@jridgewell/trace-mapping": "0.3.31",
     "@lydell/node-pty": "1.1.0",
     "@modelcontextprotocol/client": "2.3.1",
@@ -402,14 +401,18 @@
     "zod": "4.6.6"
   },
   "overrides": {
+    "@electron/asar": {
+      "glob": "14.0.4"
+    },
     "typed-rest-client": {
       "qs": "6.16.1"
     },
     "vitepress": {
-      "vite": "6.4.4"
+      "vite": "6.4.5"
     }
   },
   "devDependencies": {
+    "@electron/asar": "4.2.0",
     "@fast-check/vitest": "0.5.0",
     "@stryker-mutator/core": "10.0.0",
     "@stryker-mutator/typescript-checker": "10.0.0",

scripts/ci/scopes.mjs

@@ -98,8 +98,6 @@ const PATH_SCOPES = {
     "tests/boundary/providers/GdbCommandQueue.test.ts",
     "tests/boundary/providers/gdbTestHelpers.ts",
     "tests/boundary/providers/RizinDebugSessionCoverage.part*.test.ts",
-    "tests/boundary/providers/RizinCommandTimeout.test.ts",
-    "tests/boundary/providers/RizinTimeoutEvidence.test.ts",
     "tests/boundary/providers/RizinDebugSession*.test.ts",
     "tests/boundary/providers/RizinInferiorTty.test.ts",
     "tests/boundary/providers/RizinDecoderInputs.test.ts",

scripts/generate-skill-metadata.mjs

@@ -37,21 +37,22 @@ const generated = addSkillManifestToolCount(
   FULL_CATALOG_IDENTITY.counts.mcp_tools,
 );
 if (!generated.ok) throw generated.error;
+const source = generated.value.replaceAll(latestSpecifier, pinnedSpecifier);
 const paths = await filePaths(sourceRoot);
 // Rebuild this owned output directory so removed references cannot survive a build.
 if (!check) await rm(outputRoot, { recursive: true, force: true });
 for (const relativePath of paths) {
   const path = join(outputRoot, relativePath);
   if (!check) await mkdir(dirname(path), { recursive: true });
-  const content =
-    relativePath === "SKILL.md"
-      ? generated.value
-      : await readFile(join(sourceRoot, relativePath), "utf8");
   await ensureGeneratedFile({
     path,
-    source: content
-      .replaceAll("\r\n", "\n")
-      .replaceAll(latestSpecifier, pinnedSpecifier),
+    source:
+      relativePath === "SKILL.md"
+        ? source
+        : (await readFile(join(sourceRoot, relativePath), "utf8")).replaceAll(
+            "\r\n",
+            "\n",
+          ),
     check,
     generateCommand: "npm run docs:generate",
   });

scripts/lib/ghidra-value-scope-snapshot-e2e.mjs

@@ -0,0 +1,123 @@
+import assert from "node:assert/strict";
+import { randomUUID } from "node:crypto";
+import { readFile, rm, writeFile } from "node:fs/promises";
+import { join } from "node:path";
+
+import { parseBinaryTarget } from "../../dist/application/BinaryTargetResolver.js";
+import { createAnalysisProfile } from "../../dist/domain/analysisProfile.js";
+import {
+  createAnalysisSnapshotEntry,
+  parseAnalysisSnapshot,
+  serializeAnalysisSnapshot,
+  snapshotBinding,
+  snapshotTarget,
+} from "../../dist/domain/analysisSnapshot.js";
+import { createEvidence } from "../../dist/domain/evidence.js";
+import { createEvidenceBundle } from "../../dist/domain/evidenceBundle.js";
+import {
+  requireMcpLifecycleResult,
+  requireMcpOutput,
+  requireMcpToolError,
+} from "./mcp-verifier-results.mjs";
+
+/** A pre-scope dossier must not be replayed into a newly qualified trace. */
+export async function verifyLegacyValueScopeSnapshot(
+  client,
+  { target, procedure, observed, env },
+) {
+  const { value_flow_effect_scope: scope, ...legacyParameters } =
+    observed.analysis_profile.parameters;
+  const legacyProfile = createAnalysisProfile(
+    observed.provider,
+    legacyParameters,
+  );
+  const parsed = await parseBinaryTarget(target.path, {
+    cwd: process.cwd(),
+    hostArchitecture: process.arch,
+  });
+  if (!parsed.ok) throw parsed.error;
+  const nativeTarget = parsed.value;
+  const result = structuredClone(observed.normalized_result);
+  const flow = result.native_value_flow;
+  assert.equal(flow.available, true);
+  const describesScope = (value) =>
+    value.includes("LOAD and STORE") && value.includes("address varnodes");
+  assert.ok(flow.limitations.some(describesScope));
+  flow.limitations = flow.limitations.filter((value) => !describesScope(value));
+  const evidence = createEvidence(nativeTarget, observed.provider, {
+    operation: observed.operation,
+    parameters: observed.parameters,
+    result,
+    rawResult: result,
+    analysisProfile: legacyProfile,
+    limitations: observed.limitations,
+    locations: observed.locations,
+  });
+  const binding = snapshotBinding(legacyProfile);
+  const identity = snapshotTarget(nativeTarget);
+  const snapshot = parseAnalysisSnapshot({
+    target: identity,
+    binding,
+    entries: [
+      createAnalysisSnapshotEntry({
+        target: identity,
+        binding,
+        operation: observed.operation,
+        parameters: observed.parameters,
+        execution: {
+          result,
+          rawResult: result,
+          provider: observed.provider,
+          analysisProfile: legacyProfile,
+          limitations: observed.limitations,
+          locations: observed.locations,
+          subject: nativeTarget,
+        },
+      }),
+    ],
+    workflow_entries: [],
+    evidence_bundle: createEvidenceBundle([evidence]),
+  });
+  const path = join(env.TMPDIR, `legacy-value-scope-${randomUUID()}.json`);
+  await writeFile(path, serializeAnalysisSnapshot(snapshot), { flag: "wx" });
+  try {
+    const bytes = await readFile(path);
+    const session = requireMcpLifecycleResult(
+      await client.callTool({ name: "binary_session", arguments: {} }),
+      "binary_session",
+    );
+    const reply = await client.callTool({
+      name: "open_binary",
+      arguments: {
+        path: target.path,
+        provider_id: "ghidra",
+        snapshot_path: path,
+      },
+    });
+    assert.equal(reply.isError, true);
+    assert.equal(scope, "pcode-load-store-explicit-v1");
+    const error = requireMcpToolError(reply);
+    assert.equal(error.code, "evidence_integrity_mismatch");
+    assert.deepEqual(error.details.binding_mismatch.profile_digest, {
+      snapshot: legacyProfile.digest,
+      selected: observed.analysis_profile.digest,
+    });
+    assert.deepEqual(
+      requireMcpLifecycleResult(
+        await client.callTool({ name: "binary_session", arguments: {} }),
+        "binary_session",
+      ),
+      session,
+    );
+    const fresh = await client.callTool(
+      { name: "trace_native_values", arguments: { procedure, max_depth: 0 } },
+      { timeout: 180000 },
+    );
+    assert.notEqual(fresh.isError, true, JSON.stringify(fresh));
+    const trace = requireMcpOutput(fresh, "trace_native_values");
+    assert.ok(trace.normalized_result.limitations.some(describesScope));
+    assert.deepEqual(await readFile(path), bytes);
+  } finally {
+    await rm(path);
+  }
+}

scripts/lib/native-value-e2e.mjs

@@ -17,6 +17,7 @@ import {
   requireMcpOutput,
 } from "./mcp-verifier-results.mjs";
 import { verifyGhidraBoundaries } from "./real-ghidra-boundaries.mjs";
+import { verifyLegacyValueScopeSnapshot } from "./ghidra-value-scope-snapshot-e2e.mjs";
 import { verifyGhidraProjectIdentity } from "./real-ghidra-project-identity.mjs";
 import { verifyGhidraSocketBoundary } from "./real-ghidra-socket-boundary.mjs";
 
@@ -214,6 +215,14 @@ async function verifyNativeValueAdapters(
       procedure,
       globalAddress,
     );
+    assert.ok(
+      mcpGraph.limitations.some(
+        (value) =>
+          value.includes("analyze_function") &&
+          value.includes("LOAD and STORE") &&
+          value.includes("address varnodes"),
+      ),
+    );
     assert.deepEqual(mcpEvidence.normalized_result, mcpGraph);
     assert.deepEqual(mcpGraph, cliGraph);
     const warmReply = await client.callTool(
@@ -243,6 +252,26 @@ async function verifyNativeValueAdapters(
     );
     assert.equal(functionEvidence.operation, "analyze_function");
     assert.equal(functionEvidence.provider.id, "ghidra");
+    const flow = functionEvidence.normalized_result.native_value_flow;
+    assert.equal(flow.available, true);
+    const identifiesEffectScope = (value) =>
+      value.includes("LOAD and STORE") && value.includes("address varnodes");
+    assert.ok(flow.limitations.some(identifiesEffectScope));
+    const effectsView = await client.callTool({
+      name: "inspect_analysis_view",
+      arguments: {
+        source: {
+          kind: "retained-evidence",
+          evidence_id: functionEvidence.evidence_id,
+        },
+        view: { kind: "native", facet: "value_flow_effects" },
+      },
+    });
+    assert.notEqual(effectsView.isError, true, JSON.stringify(effectsView));
+    const effectsPage = requireMcpOutput(effectsView, "inspect_analysis_view");
+    assert.ok(
+      effectsPage.normalized_result.limitations.some(identifiesEffectScope),
+    );
     assert.deepEqual(
       functionEvidence.normalized_result.facet_availability,
       Object.fromEntries(
@@ -268,6 +297,12 @@ async function verifyNativeValueAdapters(
       functionEvidence.analysis_profile,
     );
     assert.deepEqual(functionProfile, upstreamProfile);
+    await verifyLegacyValueScopeSnapshot(client, {
+      target,
+      procedure,
+      observed: functionEvidence,
+      env,
+    });
     const comparisonEvidence = await compareRetainedFunctionEvidence(
       client,
       functionEvidence,

scripts/verify-go-binary.mjs

@@ -12,6 +12,7 @@ import { StdioClientTransport } from "@modelcontextprotocol/client/stdio";
 import { parseEvidence } from "../dist/domain/evidence.js";
 import { goBinarySchema } from "../dist/domain/go/goBinary.js";
 import { PrivateRuntimeRoot } from "../dist/process/PrivateRuntimeRoot.js";
+import { artifactMcpCall } from "./lib/artifact-e2e.mjs";
 import { requireMcpOutput } from "./lib/mcp-verifier-results.mjs";
 import { createVerifierRun, completeVerifierRun } from "./lib/verifier-run.mjs";
 
@@ -280,7 +281,7 @@ async function prepareFixture() {
   );
   await writeFile(
     join(sourceRoot, "dependency", "dependency.go"),
-    'package dependency\nfunc Value() string { return "REA fixture" }\n',
+    'package dependency\nvar Endpoints = []string{"ListResourceProviders", "genai", "https://example.invalid/v1"}\nfunc Value() string { return "REA fixture:" + Endpoints[0] + Endpoints[1] + Endpoints[2] }\n',
   );
   await writeFile(
     join(sourceRoot, "main.go"),
@@ -345,18 +346,29 @@ func main() {
   );
 }
 
-async function inspect(mode, path) {
+async function inspect(mode, path, includeStringLiterals = false) {
   let envelope;
   if (mode === "cli") {
-    const { stdout } = await execute(
-      process.execPath,
-      [entrypoint, "inspect-go-binary", path, "--json"],
-      { env: environment, timeout: 30_000, maxBuffer: 8 * 1024 * 1024 },
-    );
+    const args = [
+      entrypoint,
+      "inspect-go-binary",
+      path,
+      ...(includeStringLiterals ? ["--include-string-literals"] : []),
+      "--json",
+    ];
+    const { stdout } = await execute(process.execPath, args, {
+      env: environment,
+      timeout: 30_000,
+      maxBuffer: 16 * 1024 * 1024,
+    });
     envelope = JSON.parse(stdout);
   } else {
-    const response = await client.callTool(
-      { name: "inspect_go_binary", arguments: { path } },
+    const argumentsPayload = includeStringLiterals
+      ? { path, include_string_literals: true }
+      : { path };
+    const response = await artifactMcpCall(
+      client,
+      { name: "inspect_go_binary", arguments: argumentsPayload },
       { timeout: 30_000 },
     );
     envelope = requireMcpOutput(response, "inspect_go_binary");
@@ -368,6 +380,37 @@ async function inspect(mode, path) {
   return { evidence, report };
 }
 
+async function verifyStringLiterals(path, bytes) {
+  const cliResult = await inspect("cli", path, true);
+  const mcpResult = await inspect("mcp", path, true);
+  assert.deepEqual(
+    cliResult.report,
+    mcpResult.report,
+    "CLI and MCP string_literals projections disagree",
+  );
+  const literals = cliResult.report.string_literals;
+  assert.notEqual(literals, undefined);
+  assert.equal(literals.evidence_kind, "inferred");
+  for (const item of literals.items) {
+    const slice = bytes.subarray(
+      item.location.offset,
+      item.location.offset + item.location.bytes,
+    );
+    assert.equal(slice.toString("utf8"), item.value);
+  }
+  const values = new Set(literals.items.map((item) => item.value));
+  for (const expected of [
+    "ListResourceProviders",
+    "genai",
+    "https://example.invalid/v1",
+  ])
+    assert.equal(
+      values.has(expected),
+      true,
+      `Missing expected Go string literal ${expected} in ${path}`,
+    );
+}
+
 async function verify(
   path,
   target,
@@ -406,6 +449,7 @@ async function verify(
       report.artifact.sha256,
       createHash("sha256").update(bytes).digest("hex"),
     );
+    assert.equal(report.string_literals, undefined);
     const info = report.build_info;
     assert.notEqual(info, null);
     assert.equal(info.go_version, expected.GoVersion);
@@ -443,6 +487,7 @@ async function verify(
     reports[1],
     "Public CLI and MCP projections disagree",
   );
+  if (byteExpected === null) await verifyStringLiterals(path, bytes);
   verified.push({
     target: `${target[0]}/${target[1]}`,
     file: byteExpected === null ? fileKind : "byte-valued-strings",

src/adb/AdbConfiguration.ts

@@ -32,9 +32,9 @@ const VERSION_TIMEOUT_MS = 10_000;
 
 const ADB_VERSION_REMEDIATION = `Set ${ADB_BINARY_ENV} to an Android SDK Platform-Tools adb binary whose \`adb version\` reports its version, or put one on PATH.`;
 /** Repair when the selected adb binary does not exist. */
-export const ADB_MISSING_REMEDIATION = `Set ${ADB_BINARY_ENV} to an absolute path to an existing adb binary.`;
+const ADB_MISSING_REMEDIATION = `Set ${ADB_BINARY_ENV} to an absolute path to an existing adb binary.`;
 /** Repair when execution of the adb binary selected by the environment is denied. */
-export const ADB_NOT_EXECUTABLE_REMEDIATION = `Set ${ADB_BINARY_ENV} to an absolute path to the adb executable file, not a directory, and check execute permission on it and search permission on its parent directories.`;
+const ADB_NOT_EXECUTABLE_REMEDIATION = `Set ${ADB_BINARY_ENV} to an absolute path to the adb executable file, not a directory, and check execute permission on it and search permission on its parent directories.`;
 const VERSION_MAX_OUTPUT_BYTES = 64 * 1024;
 
 /** How the adb binary was selected for this provider instance. */

src/adb/AdbProvider.test.ts

@@ -48,6 +48,7 @@ import { PrivateRuntimeRoot } from "../process/PrivateRuntimeRoot.js";
 import { projectAnalysisError } from "../domain/analysisErrorProjection.js";
 import { parseEvidence } from "../domain/evidence.js";
 import type { AdbRequest } from "../domain/adb/adbDeviceAnalysis.js";
+import { awaitAcknowledgement } from "../../tests/fixtures/lifecycleAcknowledgement.js";
 
 const it = test.skipIf(process.platform === "win32");
 
@@ -129,6 +130,46 @@ it("inspects the adb client without contacting the server", async () => {
   expect(result.contacted_adb_server).toBe(false);
 });
 
+it("joins an admitted availability probe before close and refuses later probes", async () => {
+  const { binary, root } = await writeAdbStub(
+    (directory) => `if [ "$1" = "version" ]; then
+  : > '${directory}/started'
+  while [ ! -f '${directory}/release' ]; do /bin/sleep 0.05; done
+  ${VERSION_BLOCK}
+fi`,
+  );
+  const provider = providerOver(binary);
+  const inspection = provider.inspectAvailability();
+  let closing: Promise<void> | undefined;
+  try {
+    await awaitAcknowledgement(
+      vi.waitFor(
+        async () => expect(await lstat(join(root, "started"))).toBeDefined(),
+        { timeout: 10_000 },
+      ),
+      inspection,
+      "ADB version probe",
+      10_000,
+    );
+    let closed = false;
+    closing = provider.close().then(() => {
+      closed = true;
+    });
+    await new Promise<void>((resolve) => setImmediate(resolve));
+    expect(closed).toBe(false);
+    await writeFile(join(root, "release"), "");
+    expect((await inspection).status).toBe("available");
+    await closing;
+    await expect(provider.inspectAvailability()).rejects.toMatchObject({
+      _tag: "AnalysisCancelledError",
+    });
+  } finally {
+    await writeFile(join(root, "release"), "");
+    await Promise.allSettled([inspection, closing]);
+    await provider.close();
+  }
+}, 15_000);
+
 it("fails closed when adb exits successfully without a recognized version", async () => {
   const stdout = `unexpected adb output ${"x".repeat(700)}\n`;
   const stderr = `probe stderr ${"y".repeat(700)}\n`;

src/adb/AdbProvider.ts

@@ -872,6 +872,11 @@ export class AdbProvider {
   async inspectAvailability(
     signal?: AbortSignal,
   ): Promise<ProviderAvailability> {
+    if (this.#closing)
+      throw new AnalysisCancelledError("inspect_adb_client", {
+        cause: signal?.reason,
+      });
+    const release = this.#beginOperation();
     try {
       const selection = await this.selection(signal);
       await inspectAdbClient(selection, signal);
@@ -888,9 +893,24 @@ export class AdbProvider {
       if (cause instanceof AdbConfigurationFailure)
         return adbConfigurationAvailability(cause);
       throw cause;
+    } finally {
+      release();
     }
   }
 
+  /** Keep admitted probes and requests owned until their final cleanup settles. */
+  #beginOperation(): () => void {
+    let release!: () => void;
+    const active = new Promise<void>((resolve) => {
+      release = resolve;
+    });
+    this.#activeOperations.add(active);
+    return () => {
+      this.#activeOperations.delete(active);
+      release();
+    };
+  }
+
   /** Retry removal of owned output directories retained after failed cleanup. */
   close(): Promise<void> {
     this.#closing = true;
@@ -1244,11 +1264,7 @@ export class AdbProvider {
   ): Promise<Result<AnalysisExecution, AnalysisError>> {
     if (this.#closing)
       return err(new AnalysisCancelledError(request.operation));
-    let release!: () => void;
-    const active = new Promise<void>((resolve) => {
-      release = resolve;
-    });
-    this.#activeOperations.add(active);
+    const release = this.#beginOperation();
     try {
       try {
         await this.#resources.retryCleanup();
@@ -1289,7 +1305,6 @@ export class AdbProvider {
       }
       return await this.#executeOperation(request, options);
     } finally {
-      this.#activeOperations.delete(active);
       release();
     }
   }

src/apktool/ApktoolCommandRecovery.test.ts

@@ -31,9 +31,11 @@ const provider = () =>
     environment: { REA_APKTOOL_COMMAND: "/authored/apktool" },
   });
 const version = {
-  stdout: { text: "2.9.3\n" },
-  stderr: { text: "" },
-} as Awaited<ReturnType<typeof runOwnedCommand>>;
+  stdout: { text: "2.9.3\n", bytes: 6, observedBytes: 6 },
+  stderr: { text: "", bytes: 0, observedBytes: 0 },
+  exitCode: 0,
+  signal: null,
+};
 const inspect = (client: ApktoolProvider, signal?: AbortSignal) =>
   client.execute(
     { operation: "inspect_apktool_client", input: {} },
@@ -255,8 +257,8 @@ it("attributes prerequisite cleanup to decode and preserves its live recovery",
   try {
     const result = await client.execute({
       operation: "decode_android_resources",
-      input: {},
-    } as never);
+      input: { path: "/fixture/input.apk", include_strings: false },
+    });
     if (result.ok) throw new Error("Expected prerequisite failure");
     expect(result.error).toMatchObject({
       operation: "decode_android_resources",

src/apktool/ApktoolConfiguration.ts

@@ -48,9 +48,9 @@ const apktoolVersionProbeTimeoutGuidance = (): {
 
 const APKTOOL_VERSION_REMEDIATION = `Set ${APKTOOL_COMMAND_ENV} to an Apktool 2.7.0 or newer launcher whose --version prints its version, or put one on PATH.`;
 /** Repair when the selected apktool launcher does not exist. */
-export const APKTOOL_MISSING_REMEDIATION = `Set ${APKTOOL_COMMAND_ENV} to an absolute apktool launcher (the upstream wrapper or a java -jar script).`;
+const APKTOOL_MISSING_REMEDIATION = `Set ${APKTOOL_COMMAND_ENV} to an absolute apktool launcher (the upstream wrapper or a java -jar script).`;
 /** Repair when execution of the selected apktool launcher is denied. */
-export const APKTOOL_NOT_EXECUTABLE_REMEDIATION = `Check file type and execute permission for ${APKTOOL_COMMAND_ENV} or select an executable apktool launcher.`;
+const APKTOOL_NOT_EXECUTABLE_REMEDIATION = `Check file type and execute permission for ${APKTOOL_COMMAND_ENV} or select an executable apktool launcher.`;
 
 /** How the apktool launcher was selected for this provider instance. */
 export interface ApktoolCommandSelection {

src/apktool/ApktoolDecodeTimeout.test.ts

@@ -49,11 +49,15 @@ afterEach(() => {
   vi.mocked(runOwnedCommand).mockReset();
 });
 
-const completed = (text: string): ProviderProcessSnapshot =>
-  ({
-    stdout: { text },
-    stderr: { text: "" },
-  }) as ProviderProcessSnapshot;
+const completed = (text: string): ProviderProcessSnapshot => {
+  const bytes = Buffer.byteLength(text);
+  return {
+    stdout: { text, bytes, observedBytes: bytes },
+    stderr: { text: "", bytes: 0, observedBytes: 0 },
+    exitCode: 0,
+    signal: null,
+  };
+};
 
 const installLauncher = (): void => {
   vi.mocked(runOwnedCommand).mockImplementation(async (spawn, limits) => {

src/apktool/ApktoolProvider.test.ts

@@ -1555,12 +1555,12 @@ it("discloses qualified and unfamiliar strings tables while preserving exact loc
         locale: locale ?? null,
         coverage: "complete",
       });
-      expect(result.value.limitations).toContain(
-        `Other strings tables are not selected by locale; their resource configuration suffixes are preserved without inferring Android runtime matching: ${tables
-          .map((suffix) => JSON.stringify(`values-${suffix}`))
-          .sort()
-          .join(", ")}`,
+      const otherTables = result.value.limitations.find((line) =>
+        line.includes("values-unknown_CONFIGURATION"),
       );
+      expect(otherTables).toMatch(/without inferring.*runtime matching/iu);
+      for (const suffix of tables)
+        expect(otherTables).toContain(JSON.stringify(`values-${suffix}`));
       if (locale === undefined)
         expect(result.value.result).toMatchObject({
           strings: [
@@ -1570,8 +1570,8 @@ it("discloses qualified and unfamiliar strings tables while preserving exact loc
         });
       else if (locale === "en-rUS") {
         expect(result.value.result).toMatchObject({ strings: [] });
-        expect(result.value.limitations).toContain(
-          "No strings.xml was found for locale en-rUS",
+        expect(result.value.limitations).toContainEqual(
+          expect.stringMatching(/strings\.xml.*locale en-rUS/iu),
         );
       } else
         expect(result.value.result).toMatchObject({
@@ -1691,8 +1691,9 @@ it.each([
       });
       const limitations = result.value.limitations.join("\n");
       if (kind === "unsupported") {
-        expect(limitations).toContain(
-          "String entries omitted due to unsupported markup or missing names: 2",
+        expect(limitations).toMatch(/omitted[^\n]*2/iu);
+        expect(limitations).toMatch(
+          /omitted.*unsupported markup.*missing names/iu,
         );
         expect(limitations).not.toContain("entry counts are unknown");
       } else {

src/apktool/ApktoolVersionProbe.test.ts

@@ -36,9 +36,11 @@ const owner = {
 it("runs the version probe as an owned interpreter-script process group", async () => {
   vi.mocked(runOwnedCommand).mockImplementationOnce(async (_spawn, limits) => {
     const output = {
-      stdout: { text: "2.9.3\n" },
-      stderr: { text: "" },
-    } as Awaited<ReturnType<typeof runOwnedCommand>>;
+      stdout: { text: "2.9.3\n", bytes: 6, observedBytes: 6 },
+      stderr: { text: "", bytes: 0, observedBytes: 0 },
+      exitCode: 0,
+      signal: null,
+    };
     limits.observeCompleted?.(output);
     return output;
   });
@@ -152,8 +154,8 @@ it("keeps unresolved probe cleanup typed when the launcher overflows its output"
   vi.mocked(runOwnedCommand).mockRejectedValueOnce(overflow());
   const result = await provider.execute({
     operation: "decode_android_resources",
-    input: {},
-  } as never);
+    input: { path: "/fixture/input.apk", include_strings: false },
+  });
   expect(result.ok ? null : result.error.cleanupIncomplete).toBe(true);
   expect(result.ok ? null : projectAnalysisError(result.error)).toMatchObject({
     code: "cleanup_incomplete",
@@ -169,9 +171,11 @@ it.each(["linux", "win32"] as const)(
     vi.mocked(runOwnedCommand).mockImplementationOnce(
       async (_spawn, limits) => {
         const output = {
-          stdout: { text: "2.9.2\n" },
-          stderr: { text: "" },
-        } as Awaited<ReturnType<typeof runOwnedCommand>>;
+          stdout: { text: "2.9.2\n", bytes: 6, observedBytes: 6 },
+          stderr: { text: "", bytes: 0, observedBytes: 0 },
+          exitCode: 0,
+          signal: null,
+        };
         limits.observeCompleted?.(output);
         return output;
       },

src/application/AnalysisContextQueries.ts

@@ -14,10 +14,12 @@ import {
 import {
   omitUnretainedEvidenceFromError,
   projectAnalysisError,
+  unretainedEvidenceCandidates,
   type AnalysisErrorProjection,
 } from "../domain/analysisErrorProjection.js";
 import { analysisErrorWithCleanupFailure } from "../domain/analysisErrorCleanup.js";
 import { analysisErrorWithCancellation } from "../domain/analysisErrorCancellation.js";
+import { EvidenceIntegrityError } from "../domain/evidenceErrors.js";
 import type { JsonValue } from "../domain/jsonValue.js";
 import { analysisBookmarkSchema } from "../domain/native/nativeInventory.js";
 import { parseContainingProcedureResolution } from "../domain/native/nativeObservation.js";
@@ -131,18 +133,25 @@ export function* omitContextEvidenceForDelivery(
   const candidates = names.flatMap((name) => {
     const facet = context[name];
     if (facet.state !== "unavailable" || facet.error === undefined) return [];
-    const compact = omitUnretainedEvidenceFromError(facet.error, limit);
-    if (compact === undefined) return [];
-    const partial = facet.error.details?.partial_observation;
-    const size = estimateJsonStorage(partial, {
-      maximumValueBytes: budgetBytes,
-      includeSerialized: false,
-    }).valueBytes;
-    return [{ name, facet, compact, size }];
+    return [...unretainedEvidenceCandidates(facet.error)].map((candidate) => {
+      const size = estimateJsonStorage(candidate.value, {
+        maximumValueBytes: budgetBytes,
+        includeSerialized: false,
+      }).valueBytes;
+      return { name, candidate, size };
+    });
   });
   candidates.sort((left, right) => right.size - left.size);
   let current = context;
-  for (const { name, facet, compact } of candidates) {
+  for (const { name, candidate } of candidates) {
+    const facet = current[name];
+    if (facet.state !== "unavailable" || facet.error === undefined) continue;
+    const compact = omitUnretainedEvidenceFromError(
+      facet.error,
+      limit,
+      candidate,
+    );
+    if (compact === undefined) continue;
     current = {
       ...current,
       [name]: {
@@ -284,12 +293,15 @@ const unavailableFacet = (
   }
   if (
     error instanceof AnalysisInputError ||
-    error instanceof AnalysisResourceConstraintError
+    error instanceof AnalysisResourceConstraintError ||
+    (error instanceof EvidenceIntegrityError &&
+      error.sourcePublicationRecovery !== undefined)
   ) {
     const projected = projectAnalysisError(error);
     if (
       projected.code === "invalid_request" ||
-      projected.code === "resource_constraint"
+      projected.code === "resource_constraint" ||
+      projected.code === "evidence_integrity_mismatch"
     )
       return {
         state: "unavailable",
@@ -308,7 +320,11 @@ const unavailableFacet = (
 const isRequestLevelFailure = (error: AnalysisError): boolean =>
   error._tag === "AnalysisCancelledError" ||
   error._tag === "AnalysisTimeoutError" ||
-  error._tag === "NoBinaryOpenError";
+  error._tag === "NoBinaryOpenError" ||
+  (error.sourcePublicationRecovery !== undefined &&
+    !(error instanceof AnalysisInputError) &&
+    !(error instanceof AnalysisResourceConstraintError) &&
+    !(error instanceof EvidenceIntegrityError));
 
 /** Wait for all facets and retain every unresolved cleanup owner. */
 const contextFailure = (
@@ -355,7 +371,8 @@ const contextFailure = (
       ).bindCleanupDependencies([previous, failure]);
     } else if (
       !(failure instanceof AnalysisCancelledError) &&
-      isRequestLevelFailure(failure)
+      (isRequestLevelFailure(failure) ||
+        failure.sourcePublicationRecovery !== undefined)
     ) {
       combined.retainSecondaryFailure(failure);
     }

src/application/AppBundleOpenStepDepth.test.ts

@@ -3,7 +3,6 @@ import { join } from "node:path";
 
 import { describe, expect, it } from "vitest";
 
-import { plistNestingLimitMessage } from "../domain/apple/plistValue.js";
 import { resolveAppBundleExecutable } from "./AppBundleExecutable.js";
 import { createTestTempDirectory } from "../../tests/fixtures/temporaryDirectory.js";
 
@@ -34,7 +33,7 @@ describe("OpenStep Info.plist nesting during app target resolution", () => {
           error: {
             path: join(app, "Contents", "Info.plist"),
             cause: expect.objectContaining({
-              message: plistNestingLimitMessage(),
+              message: expect.stringMatching(/128 nesting levels/iu),
             }),
           },
         });

src/application/BrowserEvidence.ts

@@ -164,6 +164,10 @@ const browserParameters = (
         : "target_id" in input && observedOrigin !== undefined
           ? [observedOrigin]
           : [],
+    ...("discovery_timeout_ms" in input &&
+    input.discovery_timeout_ms !== undefined
+      ? { discovery_timeout_ms: input.discovery_timeout_ms }
+      : {}),
     ...("command_timeout_ms" in input && input.command_timeout_ms !== undefined
       ? { command_timeout_ms: input.command_timeout_ms }
       : {}),

src/application/BrowserObservationService.test.ts

@@ -18,7 +18,7 @@ import {
   expectKeptPartial,
   expectOutputError,
   expectOwnerError,
-} from "./ownerObservationExpectation.fixture.js";
+} from "../../tests/fixtures/ownerObservationExpectation.js";
 import { BrowserObservationError } from "../domain/browserObservationError.js";
 import { err, ok } from "../domain/result.js";
 import { passiveNetworkCapture } from "../../tests/fixtures/passiveNetworkCapture.js";

src/application/BrowserScenarioCaptureService.test.ts

@@ -20,7 +20,7 @@ import {
   expectDroppedPartial,
   expectKeptPartial,
   expectOwnerError,
-} from "./ownerObservationExpectation.fixture.js";
+} from "../../tests/fixtures/ownerObservationExpectation.js";
 
 const scenario = browserScenarioInputSchema.parse({
   browser: { mode: "launch", executable_path: "/fixture/chrome" },

src/application/CapabilityInventory.test.ts

@@ -698,8 +698,7 @@ describe("partial navigation availability", () => {
 
     expect(availability).toMatchObject({
       reason: "provider_missing",
-      remediation:
-        "Configure a provider for one of: current_document, current_address, resolve_containing_procedure.",
+      remediation: expect.stringMatching(/configure.*provider/i),
       modes: [
         {
           name: "current_selection",
@@ -718,6 +717,13 @@ describe("partial navigation availability", () => {
         },
       ],
     });
+    for (const operation of [
+      "current_document",
+      "current_address",
+      "resolve_containing_procedure",
+    ]) {
+      expect(availability.remediation?.split(operation)).toHaveLength(2);
+    }
   });
 });
 
@@ -820,8 +826,9 @@ describe("binary_overview capability requirements", () => {
     ).toMatchObject({
       available: false,
       reason: "provider_missing",
-      remediation:
-        "Configure a provider for one of: current_document, list_documents.",
+      remediation: expect.stringMatching(
+        /configure.*provider.*current_document.*list_documents/i,
+      ),
     });
   });
 

src/application/ClientConfigurationDocument.shape.test.ts

@@ -1,34 +1,32 @@
 import { describe, expect, it } from "vitest";
 
 import {
+  ClientConfigurationShapeError,
   parseClientConfiguration,
   shadowedClientServers,
 } from "./ClientConfigurationDocument.js";
 
 describe("parseClientConfiguration shape diagnostics", () => {
   it.each([
-    ["null", "null"],
-    ["array", "[]"],
-    ["string", '"x"'],
-  ] as const)("names a non-object JSON root (%s)", (_label, text) => {
-    expect(() => parseClientConfiguration(text, "json")).toThrow(
-      new TypeError("The configuration root must be an object"),
-    );
+    ["null root", "null", "root"],
+    ["array root", "[]", "root"],
+    ["string root", '"x"', "root"],
+    ["null server table", '{"mcpServers":null,"keep":1}', "mcpServers"],
+    ["array server table", '{"mcpServers":[],"keep":1}', "mcpServers"],
+    ["string server table", '{"mcpServers":"x","keep":1}', "mcpServers"],
+  ])("reports a non-object %s", (_label, text, location) => {
+    let error: unknown;
+    try {
+      parseClientConfiguration(text, "json");
+    } catch (cause: unknown) {
+      error = cause;
+    }
+    expect(error).toBeInstanceOf(ClientConfigurationShapeError);
+    if (!(error instanceof Error)) throw new Error("Expected shape error");
+    expect(error.message).toContain(location);
+    expect(error.message).toContain("object");
   });
 
-  it.each([
-    ["null", "null"],
-    ["array", "[]"],
-    ["string", '"x"'],
-  ] as const)(
-    'names a non-object "mcpServers" value (%s)',
-    (_label, servers) => {
-      expect(() =>
-        parseClientConfiguration(`{"mcpServers":${servers},"keep":1}`, "json"),
-      ).toThrow(new TypeError('"mcpServers" must be an object'));
-    },
-  );
-
   it("still rejects unparsable JSON with SyntaxError", () => {
     expect(() => parseClientConfiguration("not-json", "json")).toThrow(
       SyntaxError,

src/application/DirectAnalysis.ts

@@ -1,3 +1,4 @@
+import { admitCompletedAnalysis } from "./investigation/admitCompletedAnalysis.js";
 import type { EspFlashSelection } from "../domain/firmware/espFlashLocation.js";
 import type { ExecutableFormatHint } from "../domain/dosCom.js";
 import { dispatchQueuedInterrupts } from "../process/queuedInterrupts.js";
@@ -20,10 +21,7 @@ import {
   tryParseEvidence,
   withEvidenceCallerInputPath,
 } from "../domain/evidence.js";
-import {
-  createImmutableEvidenceBundle,
-  type EvidenceBundle,
-} from "../domain/evidenceBundle.js";
+import { createImmutableEvidenceBundle } from "../domain/evidenceBundle.js";
 import {
   retainAnalysisResultSources,
   type AnalysisResultWithSources,
@@ -48,6 +46,7 @@ import {
   AnalysisSnapshotMismatchError,
   type PublishedEvidenceFile,
 } from "../domain/evidenceErrors.js";
+import { analysisErrorWithCancellation } from "../domain/analysisErrorCancellation.js";
 import type { AnalysisError } from "../domain/analysisErrorBase.js";
 import { access, stat } from "node:fs/promises";
 import { absoluteCallerPath } from "../filesystem/callerPath.js";
@@ -157,8 +156,6 @@ export const runDirectAnalysis = async (
     readonly entryPoint?: string;
     readonly espFlash?: EspFlashSelection;
     readonly includeEvidenceSources?: boolean;
-    /** Capture the exact session Evidence available to a one-shot CLI adapter. */
-    readonly onEvidenceBundle?: (bundle: EvidenceBundle) => void;
   } = {},
 ): Promise<AnalysisResultWithSources<Evidence, JsonValue>> =>
   withProcessCancellation(options.signal, (signal) =>
@@ -169,9 +166,6 @@ export const runDirectAnalysis = async (
       ...(options.includeEvidenceSources === true
         ? { includeEvidenceSources: true }
         : {}),
-      ...(options.onEvidenceBundle === undefined
-        ? {}
-        : { onEvidenceBundle: options.onEvidenceBundle }),
       ...targetSelection(options),
       ...(options.providerId === undefined
         ? {}
@@ -287,7 +281,13 @@ export const runProviderAnalysis = async (
         operationSignal,
       );
       await dispatchQueuedInterrupts();
-      if (!original.ok) return err(cliError(original.error, path));
+      if (!original.ok)
+        return err(
+          cliError(
+            retainFinalCancellation(original.error, tool, operationSignal),
+            path,
+          ),
+        );
       const evidence = withEvidenceCallerInputPath(original.value, path);
       if (operationSignal.aborted)
         return err(
@@ -331,6 +331,7 @@ export const runManagedProviderExecution = async (
   tool: ManagedToolName,
   signal?: AbortSignal,
   parameters: Readonly<Record<string, JsonValue>> = {},
+  recoveryParameters?: Readonly<Record<string, JsonValue>>,
 ): Promise<Result<AnalysisExecution, AnalysisError>> =>
   withProcessCancellation(signal, async (operationSignal) => {
     const session = await dependencies.createManagedBinarySession();
@@ -339,9 +340,14 @@ export const runManagedProviderExecution = async (
       async () => {
         const opened = await session.open(path, { signal: operationSignal });
         if (!opened.ok) return opened;
-        return await session.execute(tool, parameters, {
-          signal: operationSignal,
-        });
+        return recoveryParameters === undefined
+          ? await session.execute(tool, parameters, { signal: operationSignal })
+          : await session.executeForDirectObservation(
+              tool,
+              parameters,
+              recoveryParameters,
+              { signal: operationSignal },
+            );
       },
       managedAnalysisCleanupFailure,
     );
@@ -362,6 +368,7 @@ const runManagedProviderAnalysis = async (
     tool,
     signal,
     arguments_,
+    evidenceParameters,
   );
   if (!execution.ok) return execution;
   const value = execution.value;
@@ -390,7 +397,6 @@ const runAnalysis = async (
     readonly snapshotPath: string | undefined;
     readonly signal: AbortSignal;
     readonly evidenceParameters?: Readonly<Record<string, JsonValue>>;
-    readonly onEvidenceBundle?: (bundle: EvidenceBundle) => void;
     readonly createSession?: () => BinarySession | Promise<BinarySession>;
     readonly includeEvidenceSources?: boolean;
     readonly providerId?: AnalysisProviderSelector;
@@ -524,7 +530,6 @@ const runAnalysis = async (
             );
             if (!captured.ok)
               return err(captured.error.retainPartialObservation(evidence));
-            options.onEvidenceBundle?.(snapshot.evidence_bundle);
             return ok(evidence);
           }
         }
@@ -634,7 +639,6 @@ const runAnalysis = async (
           return err(written.error.retainPartialObservation(evidence));
       }
     }
-    options.onEvidenceBundle?.(session.exportEvidenceBundle());
     return ok(evidence);
   };
   const outcome = await withSessionCleanup<{
@@ -642,13 +646,35 @@ const runAnalysis = async (
     readonly cleanupError?: AnalysisError;
   }>(
     session,
-    async () => ({ result: await execute() }),
+    async () => {
+      const result = await execute();
+      if (
+        !result.ok &&
+        result.error.sourcePublicationRecovery?.completed.kind ===
+          "retained-evidence"
+      ) {
+        const retained = session.evidenceForAnalysis(
+          result.error.sourcePublicationRecovery.completed.evidence_id,
+        );
+        if (retained !== undefined)
+          result.error.sourcePublicationRecovery = {
+            ...result.error.sourcePublicationRecovery,
+            completed: {
+              kind: "inline-evidence",
+              retention: "one-shot-session",
+              source_closure: "not-established",
+              evidence: retained,
+            },
+          };
+      }
+      return { result };
+    },
     (value, cleanupError) => ({ ...value, cleanupError }),
   );
   await dispatchQueuedInterrupts();
   const result = outcome.result.ok
     ? completeProviderEvidence(outcome.result.value, signal)
-    : outcome.result;
+    : err(retainFinalCancellation(outcome.result.error, tool, signal));
   if (!result.ok && publishedSnapshot !== undefined)
     result.error.retainDiagnostics({
       analysis_snapshot: { ...publishedSnapshot },
@@ -670,6 +696,19 @@ const runAnalysis = async (
   };
 };
 
+/** Preserve an earlier failure and a cancellation observed during final cleanup. */
+const retainFinalCancellation = (
+  failure: AnalysisError,
+  tool: string,
+  signal: AbortSignal,
+): AnalysisError =>
+  signal.aborted
+    ? analysisErrorWithCancellation(
+        failure,
+        new AnalysisCancelledError(tool, { cause: signal.reason }),
+      )
+    : failure;
+
 const executeAnalysisTool = async (input: {
   readonly session: BinarySession;
   readonly openedTarget: BinaryTarget;
@@ -747,12 +786,17 @@ const executeAnalysisTool = async (input: {
         : { cachePolicy: result.value.cachePolicy }),
     });
   }
-  let result = await session.execute(tool, input.arguments, {
-    signal,
-    ...(input.saveSnapshot && tool === "procedure_pseudo_code"
-      ? { snapshotContext: "one-shot-target" as const }
-      : {}),
-  });
+  let result = await session.executeForDirectObservation(
+    tool,
+    input.arguments,
+    input.evidenceParameters,
+    {
+      signal,
+      ...(input.saveSnapshot && tool === "procedure_pseudo_code"
+        ? { snapshotContext: "one-shot-target" as const }
+        : {}),
+    },
+  );
   if (
     tool === "xrefs" &&
     typeof input.arguments.address === "string" &&
@@ -774,23 +818,32 @@ const executeAnalysisTool = async (input: {
     );
     if (!address.ok) return address;
     if (address.value !== input.arguments.address)
-      result = await session.execute(
+      result = await session.executeForDirectObservation(
         tool,
         { ...input.arguments, address: address.value },
+        input.evidenceParameters,
         { signal },
       );
   }
   if (!result.ok) return result;
+  const observation = {
+    ...result.value,
+    subject:
+      result.value.subject === undefined
+        ? input.openedTarget
+        : result.value.subject,
+  };
+  const admitted = admitCompletedAnalysis(
+    tool,
+    input.evidenceParameters,
+    observation,
+    session.admitRecoveryObservation.bind(session),
+  );
+  if (!admitted.ok) return admitted;
   const evidence = createAnalysisExecutionEvidence(
     tool,
     input.evidenceParameters,
-    {
-      ...result.value,
-      subject:
-        result.value.subject === undefined
-          ? input.openedTarget
-          : result.value.subject,
-    },
+    observation,
     "observed",
   );
   return ok({ evidence });

src/application/DirectAnalysisCleanup.ts

@@ -1,4 +1,7 @@
-import type { AnalysisError } from "../domain/analysisErrorBase.js";
+import {
+  sourcePublicationRecoveryOf,
+  type AnalysisError,
+} from "../domain/analysisErrorBase.js";
 import {
   childFailureDiagnostics,
   projectAnalysisError,
@@ -40,15 +43,46 @@ export const projectDirectAnalysisFailure = (
     !Array.isArray(partial) &&
     partial.kind === "unretained-evidence";
   const observation = tryParseEvidence(wrapped ? partial.evidence : partial);
-  if (observation === undefined) return projection;
-  const rebound = withEvidenceCallerInputPath(observation, callerInputPath);
+  const rebound =
+    observation === undefined
+      ? undefined
+      : withEvidenceCallerInputPath(observation, callerInputPath);
+  const completed = sourcePublicationRecoveryOf(error)?.completed;
+  const completedWithPath =
+    completed?.kind === "unretained-evidence" ||
+    completed?.kind === "inline-evidence"
+      ? {
+          ...completed,
+          evidence: withEvidenceCallerInputPath(
+            completed.evidence,
+            callerInputPath,
+          ),
+        }
+      : completed?.kind === "unretained-observation"
+        ? {
+            ...completed,
+            observation: {
+              ...completed.observation,
+              caller_input_path: callerInputPath,
+            },
+          }
+        : undefined;
+  if (rebound === undefined && completedWithPath === undefined)
+    return projection;
   return {
     ...projection,
     details: {
       ...projection.details,
-      partial_observation: wrapped
-        ? { ...partial, evidence: rebound }
-        : rebound,
+      ...(rebound === undefined
+        ? {}
+        : {
+            partial_observation: wrapped
+              ? { ...partial, evidence: rebound }
+              : rebound,
+          }),
+      ...(completedWithPath === undefined
+        ? {}
+        : { completed_observation: completedWithPath }),
     },
   };
 };

src/application/Doctor.test.ts

@@ -255,8 +255,9 @@ describe("doctor native analysis configuration", () => {
       expect.objectContaining({
         name: "hopper-startup-timeout",
         ok: false,
-        detail:
-          "REA_HOPPER_STARTUP_TIMEOUT_MS: must be a positive decimal integer",
+        detail: expect.stringMatching(
+          /REA_HOPPER_STARTUP_TIMEOUT_MS.*positive decimal integer/i,
+        ),
       }),
     );
     expect(result.scope_checks).toContainEqual(
@@ -650,8 +651,9 @@ describe("doctor", () => {
       ok: false,
       classification: "config_drift",
       detail: "/missing/ilspycmd",
-      remediation:
-        "Unset REA_ILSPY_CMD_PATH or point it at a runnable ilspycmd executable.",
+      remediation: expect.stringMatching(
+        /REA_ILSPY_CMD_PATH.*runnable ilspycmd/i,
+      ),
     });
   });
 
@@ -669,8 +671,9 @@ describe("doctor", () => {
       ok: false,
       classification: "config_drift",
       detail: configuredPath,
-      remediation:
-        "Unset or update HOPPER_LAUNCHER_PATH to an executable Hopper launcher.",
+      remediation: expect.stringMatching(
+        /HOPPER_LAUNCHER_PATH.*executable Hopper launcher/i,
+      ),
     });
   });
 });
@@ -738,7 +741,7 @@ describe("doctor installation identity", () => {
       skill: {
         installed_version: "10",
         state: "stale",
-        remediation: "Run rea setup to update the installed REA skill.",
+        remediation: expect.stringMatching(/rea setup.*update.*skill/i),
       },
     });
   });
@@ -751,14 +754,14 @@ describe("doctor installation identity", () => {
     expect(result.healthy).toBe(false);
     expect(result.identity?.skill).toMatchObject({
       state: "missing",
-      remediation: "Run rea setup to update the installed REA skill.",
+      remediation: expect.stringMatching(/rea setup.*update.*skill/i),
     });
     expect(result.checks).toContainEqual({
       name: "skill:identity",
       ok: false,
       classification: "config_drift",
-      detail: "Installed REA skill identity is missing.",
-      remediation: "Run rea setup to update the installed REA skill.",
+      detail: expect.stringMatching(/skill identity.*missing/i),
+      remediation: result.identity?.skill.remediation,
     });
   });
   it("classifies an unreadable installed skill as unknown, not drift", async () => {

src/application/Doctor.ts

@@ -367,6 +367,28 @@ const providerSettingSelections = (
       ]),
 ];
 
+/** Render what the registration comparison established without inferring its effective environment. */
+export const registrationEnvironmentDetail = (
+  client: string,
+  {
+    unrecorded,
+    differing,
+    unresolved,
+  }: NonNullable<ClientRegistrationStatus["provider_settings"]>,
+): string =>
+  [
+    `Provider checks used this terminal's environment; what the server ${client} starts receives is unknown.`,
+    ...(unrecorded.length === 0
+      ? []
+      : [`Its registration does not record ${unrecorded.join(", ")}.`]),
+    ...(differing.length === 0
+      ? []
+      : [`It records other values for ${differing.join(", ")}.`]),
+    ...(unresolved.length === 0
+      ? []
+      : [`REA could not resolve its ${unresolved.join(", ")}.`]),
+  ].join(" ");
+
 /**
  * A healthy provider check describes this terminal, not the server a client
  * starts. Report what the registration's file leaves out without gating health:
@@ -385,18 +407,7 @@ const registrationEnvironmentChecks = (
         name: `registration_environment:${client}`,
         ok: true,
         classification: "unknown" as const,
-        detail: [
-          `Provider checks used this terminal's environment; what the server ${client} starts receives is unknown.`,
-          ...(unrecorded.length === 0
-            ? []
-            : [`Its registration does not record ${unrecorded.join(", ")}.`]),
-          ...(differing.length === 0
-            ? []
-            : [`It records other values for ${differing.join(", ")}.`]),
-          ...(unresolved.length === 0
-            ? []
-            : [`REA could not resolve its ${unresolved.join(", ")}.`]),
-        ].join(" "),
+        detail: registrationEnvironmentDetail(client, settings),
         details: {
           effective_environment: "unknown",
           providers: selections

src/application/DoctorRegistrationEnvironment.test.ts

@@ -4,7 +4,12 @@ import { expect, it } from "vitest";
 
 import { createTestTempDirectory } from "../../tests/fixtures/temporaryDirectory.js";
 import { createDoctorHostFixture as host } from "./Doctor.fixture.js";
-import { runDoctor, systemDoctorHost, type DoctorHost } from "./Doctor.js";
+import {
+  registrationEnvironmentDetail,
+  runDoctor,
+  systemDoctorHost,
+  type DoctorHost,
+} from "./Doctor.js";
 
 const inspection = (
   id: string,
@@ -176,9 +181,16 @@ it("states each comparison result without a claim it did not establish", async (
         ]),
     }),
   );
-  const detail = report.checks.find(({ name }) => name === CHECK)?.detail;
-  expect(detail).toContain("what the server cursor starts receives is unknown");
-  expect(detail).toContain("records other values for JAVA_HOME");
-  expect(detail).toContain("could not resolve its GHIDRA_INSTALL_DIR");
-  expect(detail).not.toContain("does not record");
+  const check = report.checks.find(({ name }) => name === CHECK);
+  expect(check).toMatchObject({
+    classification: "unknown",
+    details: { effective_environment: "unknown" },
+  });
+  expect(check?.detail).toBe(
+    registrationEnvironmentDetail("cursor", {
+      unrecorded: [],
+      differing: ["JAVA_HOME"],
+      unresolved: ["GHIDRA_INSTALL_DIR"],
+    }),
+  );
 });

src/application/InventoryProjectionEvidence.ts

@@ -7,9 +7,9 @@ import type { AnalysisInputError } from "../domain/analysisErrorCore.js";
 import type { AnalysisError } from "../domain/analysisErrorBase.js";
 import {
   createEvidence,
+  evidenceSubjectTarget,
   type Evidence,
   type EvidenceProvider,
-  type EvidenceSubjectTarget,
 } from "../domain/evidence.js";
 import type { JsonValue } from "../domain/jsonValue.js";
 import type { ParsedInventorySet } from "../domain/artifactInventoryEvidence.js";
@@ -42,7 +42,6 @@ interface InventoryProjectionOptions<
   readonly operation: string;
   readonly predicateType: string;
   readonly provider: EvidenceProvider;
-  readonly subjectFormat: (first: Evidence) => EvidenceSubjectTarget["format"];
 }
 
 /** Resolve source inventory once, then wrap its family projection in Evidence. */
@@ -70,13 +69,7 @@ export const projectInventoryEvidence = <
   const first = source.value.evidence[0];
   return ok({
     evidence: createEvidence(
-      first?.subject === null || first?.subject === undefined
-        ? undefined
-        : {
-            path: first.subject.local_path,
-            sha256: result.root_sha256,
-            format: options.subjectFormat(first),
-          },
+      evidenceSubjectTarget(first?.subject ?? null),
       options.provider,
       {
         predicateType: options.predicateType,

src/application/JsonAuthenticationHeadroom.test.ts

@@ -1,6 +1,7 @@
 import { describe, expect, it } from "vitest";
 import {
   estimateJsonStorage,
+  estimateJsonArrayScalarEntry,
   requireAuthenticationHeadroom,
 } from "./JsonAuthenticationHeadroom.js";
 import { AnalysisResourceConstraintError } from "../domain/analysisErrorCore.js";
@@ -19,6 +20,56 @@ it("stops a bounded representation scan before visiting an over-budget tail", ()
   expect(measured.valueBytes).toBeGreaterThan(512);
 });
 describe("JSON authentication headroom", () => {
+  it("measures source IDs without first constructing their array", () => {
+    const values = ["ev_123", null, 'escaped\"\n😀'];
+    const empty = estimateJsonStorage({ evidence_links: [] });
+    const incremental = values.reduce((total, value, index) => {
+      const entry = estimateJsonArrayScalarEntry(value, index > 0);
+      return {
+        valueBytes: total.valueBytes + entry.valueBytes,
+        serializedUtf16Bytes:
+          total.serializedUtf16Bytes + entry.serializedUtf16Bytes,
+      };
+    }, empty);
+    expect(incremental).toEqual(
+      estimateJsonStorage({ evidence_links: values }),
+    );
+  });
+  it("accounts for a measured representation that has not yet been allocated", () => {
+    const value = { result: "small" };
+    const base = estimateJsonStorage(value);
+    const additional = { valueBytes: 8192, serializedUtf16Bytes: 2048 };
+    const total =
+      (base.valueBytes +
+        base.serializedUtf16Bytes +
+        additional.valueBytes +
+        additional.serializedUtf16Bytes) *
+      2;
+    const request = {
+      operation: "address_name",
+      path: "recovery",
+      description: "Cannot authenticate",
+      additional,
+    };
+    expect(
+      requireAuthenticationHeadroom(value, {
+        ...request,
+        availableBytes: total - 1,
+      }),
+    ).toMatchObject({
+      ok: false,
+      error: {
+        resource: "memory",
+        reportedLimits: { authentication_bytes: total },
+      },
+    });
+    expect(
+      requireAuthenticationHeadroom(value, {
+        ...request,
+        availableBytes: total,
+      }),
+    ).toEqual({ ok: true, value: undefined });
+  });
   it("does not queue every row while deciding whether a wide report can fit", () => {
     let pending = 0;
     let peak = 0;

src/application/JsonAuthenticationHeadroom.ts

@@ -6,6 +6,18 @@ import { err, ok, type Result } from "../domain/result.js";
 /** Authentication clones parsed JSON and hashes its canonical commitment. */
 const AUTHENTICATION_COPIES = 2;
 
+/** Incremental storage of a string or null appended to an already measured array. */
+export const estimateJsonArrayScalarEntry = (
+  value: string | null,
+  hasPrevious: boolean,
+): { valueBytes: number; serializedUtf16Bytes: number } => ({
+  valueBytes: 16 + (value === null ? 16 : 64 + value.length * 2),
+  serializedUtf16Bytes:
+    ((value === null ? 4 : jsonStringCodeUnits(value)) +
+      (hasPrevious ? 1 : 0)) *
+    2,
+});
+
 /**
  * Parsed storage and optional UTF-16 serialization work. A bounded value scan
  * returns only a lower bound after exceeding maximumValueBytes.
@@ -77,11 +89,20 @@ export const requireAuthenticationHeadroom = (
     readonly path: string;
     readonly description: string;
     readonly availableBytes?: number;
+    readonly additional?: {
+      readonly valueBytes: number;
+      readonly serializedUtf16Bytes: number;
+    };
   },
 ): Result<void, AnalysisResourceConstraintError> => {
   const availableBytes =
     options.availableBytes ?? getHeapStatistics().total_available_size;
-  const { valueBytes, serializedUtf16Bytes } = estimateJsonStorage(value);
+  const estimate = estimateJsonStorage(value);
+  const valueBytes =
+    estimate.valueBytes + (options.additional?.valueBytes ?? 0);
+  const serializedUtf16Bytes =
+    estimate.serializedUtf16Bytes +
+    (options.additional?.serializedUtf16Bytes ?? 0);
   // Canonical hashing and manifest normalization can still encode scalars or
   // metadata; account for their escaped representations before allocating them.
   const requiredBytes =

src/application/MacHopper.test.ts

@@ -10,8 +10,6 @@ import {
 } from "./HopperDownload.js";
 import {
   installMacHopper,
-  macHopperHostVersionDetail,
-  macHopperIncomparableMinimumDetail,
   type MacHopperBundleVerification,
   type MacHopperBundleInstallResult,
   type MacHopperInstallHost,
@@ -309,17 +307,19 @@ describe("macOS Hopper release host requirements", () => {
       host.feedBytes = macFeed(host, { deployment_target: "12.4" });
 
       const result = await installMacHopper({}, host);
-      expect(result).toEqual({
+      expect(result).toMatchObject({
         status: "failed",
         reason: "incompatible_host_version",
-        diagnostic: macHopperHostVersionDetail({
-          source: "release_feed",
-          packageUrl: PACKAGE_URL,
-          minimumVersion: "12.4",
-          hostVersion,
-        }),
       });
-      expectNamed(result, [PACKAGE_URL, "12.4", hostVersion]);
+      expectNamed(result, [
+        PACKAGE_URL,
+        "12.4",
+        hostVersion,
+        "deployment_target",
+      ]);
+      if (result.status !== "failed")
+        throw new Error("Expected version refusal");
+      expect(result.diagnostic).toMatch(/not downloaded/i);
       expect(host.packageDownloads).toBe(0);
       expect(host.mounts).toBe(0);
       expect(host.installs).toBe(0);
@@ -353,16 +353,14 @@ describe("macOS Hopper release host requirements", () => {
       host.feedBytes = macFeed(host, fields);
 
       const result = await installMacHopper({}, host);
-      expect(result).toEqual({
+      expect(result).toMatchObject({
         status: "failed",
         reason: "incompatible_host_version",
-        diagnostic: macHopperHostVersionDetail({
-          source: "signed_app",
-          minimumVersion: "12.4",
-          hostVersion: "12.0",
-        }),
       });
       expectNamed(result, ["LSMinimumSystemVersion", "12.4", "12.0"]);
+      if (result.status !== "failed")
+        throw new Error("Expected version refusal");
+      expect(result.diagnostic).toMatch(/nothing was copied/i);
       expect(host.packageDownloads).toBe(1);
       expect(host.installs).toBe(0);
       expect(host.opens).toBe(0);
@@ -400,12 +398,13 @@ describe("macOS Hopper release host requirements", () => {
     host.appMinimum = "12.x";
 
     const result = await installMacHopper({}, host);
-    expect(result).toEqual({
-      status: "failed",
-      reason: "bundle",
-      diagnostic: macHopperIncomparableMinimumDetail("12.x", "14.5"),
-    });
-    expectNamed(result, ['"12.x"', "14.5"]);
+    expect(result).toMatchObject({ status: "failed", reason: "bundle" });
+    if (result.status !== "failed") throw new Error("Expected bundle failure");
+    expect(result.diagnostic).toContain("LSMinimumSystemVersion");
+    expect(result.diagnostic).toContain("12.x");
+    expect(result.diagnostic).toContain("14.5");
+    expect(result.diagnostic).toMatch(/cannot compare/i);
+    expect(result.diagnostic).toMatch(/nothing was copied/i);
     expect(host.installs).toBe(0);
     expect(host.unmounts).toBe(1);
     expect(host.cleanups).toBe(1);

src/application/MacHopper.ts

@@ -576,7 +576,7 @@ export const systemMacHopperInstallHost = (
 };
 
 /** Installer detail naming the declared minimum this Mac's version does not meet. */
-export const macHopperHostVersionDetail = (
+const macHopperHostVersionDetail = (
   refusal: (
     | { readonly source: "release_feed"; readonly packageUrl: string }
     | { readonly source: "signed_app" }
@@ -587,7 +587,7 @@ export const macHopperHostVersionDetail = (
     : `The signed Hopper application declares LSMinimumSystemVersion ${refusal.minimumVersion}; this Mac runs macOS ${refusal.hostVersion}. Nothing was copied.`;
 
 /** Installer detail for a signed-app minimum REA cannot compare with this Mac's version. */
-export const macHopperIncomparableMinimumDetail = (
+const macHopperIncomparableMinimumDetail = (
   declared: string,
   hostVersion: string,
 ): string =>

src/application/ReconstructionObligationCandidates.semantic.test.ts

@@ -185,10 +185,20 @@ describe("semantic uncertainty at the obligation candidate boundary", () => {
     expect(ledger.obligations).toHaveLength(1);
     expect(ledger.reports.residual_unknown_ids).toEqual([]);
     expect(ledger.coverage.status).toBe("partial");
-    expect(ledger.limitations).toEqual([
-      `Semantic graph ${source.graph.graph_id} coverage is unknown; omitted candidates remain unknown.`,
-      `Semantic graph ${source.graph.graph_id}: Event source was not fully examined.`,
-    ]);
+    expect(ledger.limitations).toHaveLength(2);
+    expect(ledger.limitations).toContainEqual(
+      expect.stringMatching(
+        /coverage is unknown.*omitted candidates remain unknown/iu,
+      ),
+    );
+    expect(
+      ledger.limitations.every((limitation) =>
+        limitation.includes(source.graph.graph_id),
+      ),
+    ).toBe(true);
+    expect(ledger.limitations).toContainEqual(
+      expect.stringContaining("Event source was not fully examined."),
+    );
   });
 
   it("keeps a complete semantic source complete without fabricating uncertainty", () => {

src/application/ReconstructionObligationCandidates.test.ts

@@ -79,10 +79,32 @@ const applicationWithUnknowns = (
       ],
     }),
   );
+  const root = createJavaScriptApplicationNode({
+    kind: "artifact",
+    identity: {
+      strategy: "content-digest",
+      stability: "global-exact",
+      sha256: APPLICATION_GRAPH_DIGESTS.asar,
+    },
+    observations: [
+      {
+        label: "managed root",
+        properties: {},
+        evidence: artifactEvidence(
+          APPLICATION_GRAPH_DIGESTS.asar,
+          "artifact-root",
+        ),
+      },
+    ],
+  });
   const graph = createJavaScriptApplicationGraph({
     schema: "JavaScriptApplicationGraph",
-    root_node_ids: base.root_node_ids,
-    nodes: [...base.nodes, ...unknownNodes],
+    root_node_ids: [root.node_id],
+    nodes: [
+      ...base.nodes.filter(({ node_id }) => node_id !== root.node_id),
+      ...unknownNodes,
+      root,
+    ],
     edges: base.edges,
     coverage: completeCoverage,
     limitations: base.limitations,
@@ -198,8 +220,11 @@ describe("reconstruction obligation candidates", () => {
     const generated = deriveCandidates(createEvidenceBundle([evidence]), []);
 
     expect(generated.candidates).toEqual([]);
-    expect(generated.limitations).toContain(
-      `Process capture ${evidence.evidence_id} has no validated executable artifact identity; packaged-process lifecycle obligation was not bound to an artifact.`,
+    const warning = generated.limitations.find((value) =>
+      value.includes(evidence.evidence_id),
+    );
+    expect(warning).toMatch(
+      /process capture.*no validated executable artifact identity.*lifecycle obligation.*not bound to an artifact/iu,
     );
   });
 
@@ -229,9 +254,11 @@ describe("reconstruction obligation candidates", () => {
     });
     const generated = deriveCandidates(createEvidenceBundle([evidence]), []);
 
-    expect(generated.limitations).toEqual([
-      `Process Evidence ${evidence.evidence_id} could not generate candidates: at manifest.completed_at: Invalid input: expected string, received undefined (1 more issues)`,
-    ]);
+    expect(generated.limitations).toHaveLength(1);
+    expect(generated.limitations[0]).toContain(evidence.evidence_id);
+    expect(generated.limitations[0]).toMatch(
+      /Process Evidence.*could not generate candidates.*manifest\.completed_at/iu,
+    );
   });
 });
 
@@ -319,10 +346,22 @@ it("keeps each semantic candidate bound to its own file and authority context",
     createEvidenceBundle([...sourceRecords, application]),
     [],
   );
-  expect(generated.limitations).toEqual([
-    `Semantic graph ${semanticGraph.graph_id} coverage is unknown; omitted candidates remain unknown.`,
-    `Semantic graph ${semanticGraph.graph_id}: Semantic relations are unavailable in this minimal example.`,
-  ]);
+  expect(generated.limitations).toHaveLength(2);
+  expect(generated.limitations).toContainEqual(
+    expect.stringMatching(
+      /coverage is unknown.*omitted candidates remain unknown/iu,
+    ),
+  );
+  expect(
+    generated.limitations.every((limitation) =>
+      limitation.includes(semanticGraph.graph_id),
+    ),
+  ).toBe(true);
+  expect(generated.limitations).toContainEqual(
+    expect.stringContaining(
+      "Semantic relations are unavailable in this minimal example.",
+    ),
+  );
   expect(generated.candidates).toHaveLength(requests.length);
   for (const [index, node] of requests.entries()) {
     const source = sourceRecords[Math.floor(index / 2)];

src/application/ReconstructionObligationLedger.closure.test.ts

@@ -304,8 +304,10 @@ describe("reconstruction obligation manifest references", () => {
       expect(result.status).toBe("unknown");
       expect(result.coverage.status).toBe("partial");
       expect(result.evidence_links).toContain(absent);
-      expect(result.limitations).toContain(
-        "The ledger retains 1 Evidence reference(s) absent from the input bundle; closure cannot be claimed.",
+      expect(result.limitations).toContainEqual(
+        expect.stringMatching(
+          /1 Evidence reference.*absent from the input bundle.*closure cannot be claimed/iu,
+        ),
       );
     }
     const contradiction = build({

src/application/ReferenceSourceImportEntries.test.ts

@@ -92,9 +92,10 @@ it("keeps source entries when a module has an empty specifier", () => {
     "other.txt",
   ]);
   expect(parsed.relationships).toEqual([]);
-  expect(parsed.limitations).toEqual([
-    "Empty module specifier in main.mjs was not recorded as a relationship.",
-  ]);
+  expect(parsed.limitations).toHaveLength(1);
+  expect(parsed.limitations[0]).toContain("main.mjs");
+  expect(parsed.limitations[0]).toMatch(/empty.*specifier/iu);
+  expect(parsed.limitations[0]).toMatch(/not recorded.*relationship/iu);
 });
 
 it("retains Kotlin source identity and language across the inventory projection", () => {

src/application/SetupInstallFailure.test.ts

@@ -5,20 +5,27 @@ import { setupInstallFailure } from "./SetupInstallFailure.js";
 
 describe("macOS Hopper setup failure projection", () => {
   it("projects a publisher mismatch onto its own code and recovery", () => {
-    expect(setupInstallFailure("publisher_verification_failed")).toEqual({
+    const result = setupInstallFailure("publisher_verification_failed");
+    expect(result).toMatchObject({
       status: "failed",
       code: "publisher_verification_failed",
-      remediation: `The mounted Hopper application is not signed by the publisher REA pins (${HOPPER_PUBLISHER.bundleIdentifier}, Apple team ${HOPPER_PUBLISHER.teamIdentifier}); nothing was copied or launched. Install Hopper yourself and set HOPPER_LAUNCHER_PATH to its launcher, then rerun rea setup.`,
     });
+    for (const fact of [
+      HOPPER_PUBLISHER.bundleIdentifier,
+      HOPPER_PUBLISHER.teamIdentifier,
+      "HOPPER_LAUNCHER_PATH",
+      "rea setup",
+    ])
+      expect(result.remediation).toContain(fact);
+    expect(result.remediation).toMatch(/nothing was copied or launched/i);
   });
 
   it("keeps a broken bundle distinct from a publisher mismatch", () => {
-    expect(setupInstallFailure("bundle")).toEqual({
-      status: "failed",
-      code: "bundle_invalid",
-      remediation:
-        "The mounted package did not contain the expected Hopper application bundle. Retry setup; if it repeats, update REA before installing.",
-    });
+    const result = setupInstallFailure("bundle");
+    expect(result).toMatchObject({ status: "failed", code: "bundle_invalid" });
+    expect(result.remediation).toMatch(/bundle/i);
+    expect(result.remediation).toMatch(/retry setup/i);
+    expect(result.remediation).toMatch(/update REA/i);
   });
 
   it("keeps a host below the release minimum distinct from an unsupported host", () => {
@@ -59,12 +66,14 @@ describe("Linux package-manager setup failure projection", () => {
   });
 
   it("preserves the established remediation if no package output exists", () => {
-    expect(setupInstallFailure("authorization_or_package_manager")).toEqual({
+    const result = setupInstallFailure("authorization_or_package_manager");
+    expect(result).toMatchObject({
       status: "failed",
       code: "authorization_or_package_manager_failed",
-      remediation:
-        "Allow the system package-manager operation or install the planned Hopper package and Linux runtime dependencies, then rerun rea setup.",
     });
+    expect(result.remediation).toMatch(/package.manager/i);
+    expect(result.remediation).toMatch(/Linux runtime dependencies/i);
+    expect(result.remediation).toContain("rea setup");
   });
 
   it("keeps truncated package output within its excerpt budget", () => {

src/application/SetupSkill.ts

@@ -34,10 +34,7 @@ export const MANAGED_SKILL_FILES = [
   "references/runtime-observation.md",
   "references/evidence-workflows.md",
   "references/environments.md",
-  "references/firmware-and-raw-images.md",
-  "references/packages-and-archives.md",
-  "references/format-inspectors.md",
-  "references/recorded-captures.md",
+  "references/desktop-build.md",
 ] as const;
 
 export const isManagedSkillManifest = (content: string): boolean =>

src/application/Uninstall.ts

@@ -232,8 +232,8 @@ export const runUninstall = async (
 };
 
 /**
- * Each client is reread when it is edited, so a concurrent change is never
- * overwritten. A client that fails then still stops the remaining removals.
+ * Reread each client when editing and refuse detected changes before publication.
+ * A client that fails still stops the remaining removals.
  */
 const removeAll = async (
   clients: readonly UninstallClient[],

src/application/UpdateRuntime.release.test.ts

@@ -1,13 +1,13 @@
-import { describe, expect, it } from "vitest";
+import { describe, expect, it, vi } from "vitest";
 
-import { err, ok } from "../domain/result.js";
+import { err, ok, type Result } from "../domain/result.js";
 import { safeParseJson } from "../domain/safeJson.js";
 import { PRODUCT_IDENTITY } from "../identity.js";
 import {
-  npmLatestVersionCommand,
-  npmReleaseLookup,
-  parseNpmLatestVersion,
-} from "./UpdateRuntime.js";
+  UpdateCommandRunner,
+  type UpdateCommandFailure,
+} from "./UpdateCommandRunner.js";
+import { systemUpdateHost } from "./UpdateRuntime.js";
 
 const installation = {
   manager: "npm",
@@ -15,14 +15,30 @@ const installation = {
   packageRoot: "/opt/rea/lib/node_modules/rea-agents",
 } as const;
 
-describe("npm latest release metadata", () => {
-  it("accepts npm 11's scalar JSON response", () => {
-    expect(parseNpmLatestVersion('"6.0.0"')).toEqual(ok("6.0.0"));
-  });
+const lookup = async (
+  response: Result<string, UpdateCommandFailure>,
+  selected: typeof installation | null = installation,
+) => {
+  const probe = vi
+    .spyOn(UpdateCommandRunner.prototype, "runProbe")
+    .mockResolvedValue(response);
+  const host = systemUpdateHost();
+  try {
+    const result = await host.latestVersion(selected ?? undefined);
+    return { result, command: probe.mock.calls[0]?.[0] };
+  } finally {
+    await host.close?.();
+    probe.mockRestore();
+  }
+};
 
-  it("accepts npm 12's singleton-array JSON response", () => {
-    expect(parseNpmLatestVersion('[\n  "6.0.0"\n]\n')).toEqual(ok("6.0.0"));
-  });
+describe("npm latest release metadata", () => {
+  it.each(['"6.0.0"', '[\n  "6.0.0"\n]\n'])(
+    "accepts a scalar or singleton-array response: %j",
+    async (metadata) => {
+      expect((await lookup(ok(metadata))).result).toEqual(ok("6.0.0"));
+    },
+  );
 
   it.each([
     ["empty array", "[]"],
@@ -31,39 +47,52 @@ describe("npm latest release metadata", () => {
     ["number", "6"],
     ["object", '{"version":"6.0.0"}'],
     ["null", "null"],
-  ])("rejects %s response data", (_description, metadata) => {
-    expect(parseNpmLatestVersion(metadata)).toEqual(
-      err(
-        "Invalid npm release metadata: expected a version string or a single-element version array.",
-      ),
+  ])("rejects %s response data", async (_description, metadata) => {
+    const { result } = await lookup(ok(metadata));
+    expect(result).toMatchObject({
+      ok: false,
+      error: { kind: "invalid-metadata" },
+    });
+    if (result.ok || result.error.kind !== "invalid-metadata")
+      throw new Error("Expected invalid metadata");
+    expect(result.error.detail).toMatch(
+      /version string.*single-element version array/i,
     );
   });
 
-  it("preserves malformed JSON separately from a wrong metadata shape", () => {
+  it("preserves malformed JSON separately from a wrong metadata shape", async () => {
     const metadata = '"6.0.0';
     const decoded = safeParseJson(metadata);
-    expect(decoded.ok).toBe(false);
-    if (decoded.ok) return;
-    expect(parseNpmLatestVersion(metadata)).toEqual(err(decoded.error));
-    expect(decoded.error).not.toContain("single-element version array");
+    if (decoded.ok) throw new Error("Expected malformed JSON");
+    expect((await lookup(ok(metadata))).result).toEqual(
+      err({ kind: "invalid-metadata", detail: decoded.error }),
+    );
   });
 
-  it("keeps command failures distinct from rejected metadata", () => {
-    expect(npmReleaseLookup(err("npm registry returned HTTP 503"))).toEqual(
+  it("keeps command failures distinct from rejected metadata", async () => {
+    expect(
+      (
+        await lookup(
+          err({ kind: "execution", detail: "npm registry returned HTTP 503" }),
+        )
+      ).result,
+    ).toEqual(
       err({ kind: "unavailable", detail: "npm registry returned HTTP 503" }),
     );
-    expect(npmReleaseLookup(ok("[]"))).toEqual(
+    expect(
+      (await lookup(err({ kind: "launch", detail: "npm missing" }))).result,
+    ).toEqual(
       err({
-        kind: "invalid-metadata",
-        detail:
-          "Invalid npm release metadata: expected a version string or a single-element version array.",
+        kind: "package-manager-unavailable",
+        manager: "npm",
+        detail: "npm missing",
       }),
     );
-    expect(npmReleaseLookup(ok('["6.0.0"]'))).toEqual(ok("6.0.0"));
   });
 
-  it("keeps the global registry query and adds the owning prefix", () => {
-    expect(npmLatestVersionCommand(installation)).toEqual([
+  it("keeps the global registry query and adds the owning prefix", async () => {
+    const selected = await lookup(ok('"6.0.0"'));
+    expect(selected.command).toEqual([
       "npm",
       "view",
       "--global",
@@ -75,7 +104,8 @@ describe("npm latest release metadata", () => {
       "--fetch-retries=0",
       "--fetch-timeout=10000",
     ]);
-    expect(npmLatestVersionCommand(undefined)).toEqual([
+    const unspecified = await lookup(ok('"6.0.0"'), null);
+    expect(unspecified.command).toEqual([
       "npm",
       "view",
       "--global",

src/application/UpdateRuntime.ts

@@ -153,7 +153,7 @@ export const BUN_LATEST_VERSION_COMMAND: readonly string[] = [
 ];
 
 /** npm view arguments for dist-tags.latest, scoped to the owning prefix when known. */
-export const npmLatestVersionCommand = (
+const npmLatestVersionCommand = (
   installation: NpmInstallation | undefined,
 ): readonly string[] => [
   "npm",
@@ -171,9 +171,7 @@ export const npmLatestVersionCommand = (
  * Read one latest version from `npm view --json`.
  * npm 11 emits a JSON string. npm 12 emits that string as a one-element array.
  */
-export const parseNpmLatestVersion = (
-  metadata: string,
-): Result<string, string> => {
+const parseNpmLatestVersion = (metadata: string): Result<string, string> => {
   const decoded = safeParseJson(metadata);
   if (!decoded.ok) return err(decoded.error);
   const version = readNpmLatestVersion(decoded.value);
@@ -193,7 +191,7 @@ const nonemptyVersion = (value: string): string | undefined =>
   value.length === 0 ? undefined : value;
 
 /** Classify `npm view` or `bun info` output as a version or a lookup failure. */
-export const npmReleaseLookup = (
+const npmReleaseLookup = (
   response: Result<string, string>,
 ): Result<string, ReleaseLookupFailure> => {
   if (!response.ok) return err({ kind: "unavailable", detail: response.error });

src/application/WebNetworkCaptureService.test.ts

@@ -17,6 +17,7 @@ import {
   AnalysisCleanupLeaseGroup,
 } from "../artifacts/AnalysisCleanupLease.js";
 import { ProviderCleanupError } from "../domain/providerCleanupError.js";
+import { analysisErrorWithCleanupFailure } from "../domain/analysisErrorCleanup.js";
 
 it.each(["REDACTED", "[", "]", "/capture.har"])(
   "excludes sensitive path text even when a replacement marker would collide: %s",
@@ -142,6 +143,9 @@ it("projects the unknown-subject explanation before generating its Evidence ID",
   });
   if (!result.ok) throw result.error;
   expect(result.value.subject).toBeNull();
+  expect(result.value.limitations).toContainEqual(
+    expect.stringMatching(/digest.*unknown.*Evidence/u),
+  );
   expect(result.value.limitations.every((text) => !text.includes("a"))).toBe(
     true,
   );
@@ -246,6 +250,26 @@ it("does not expose a malformed capture-shaped partial observation", async () =>
   if (!result.ok) expect(result.error.partialObservation).toBeUndefined();
 });
 
+it("does not recover a rejected capture from a cleanup primary", async () => {
+  const malformed = fixture();
+  malformed.artifact.sha256 = "invalid";
+  malformed.limitations = ["rejected-capture-only-marker"];
+  const primary = new AnalysisCancelledError("inspect_web_network_capture", {
+    partialObservation: malformed,
+  });
+  const cleanup = new ProviderCleanupError("fixture", ["workspace"], {});
+  const error = analysisErrorWithCleanupFailure(primary, cleanup);
+  const result = await new WebNetworkCaptureService({
+    inspect: async () => err(error),
+  }).inspect({ capture_path: "/capture.har", format: "har" });
+  if (result.ok) throw new Error("expected rejected capture");
+  const projected = projectAnalysisError(result.error);
+  expect(projected.code).toBe("cleanup_incomplete");
+  expect(JSON.stringify(projected)).not.toContain(
+    "rejected-capture-only-marker",
+  );
+});
+
 it("keeps a redacted cleanup error linked to its live owner through service close", async () => {
   const report = fixture();
   const cleanupPath = "/tmp/private-marker-capture-root";

src/application/WebNetworkCaptureService.ts

@@ -98,7 +98,15 @@ export class WebNetworkCaptureService {
         );
       }
       if (partialFailure !== undefined) {
-        loaded.error.partialObservation = undefined;
+        const rejected = loaded.error.partialObservation;
+        for (
+          let owner: AnalysisError | undefined = loaded.error;
+          owner !== undefined;
+          owner = owner.cleanupPrimary
+        ) {
+          if (owner.partialObservation === rejected)
+            owner.partialObservation = undefined;
+        }
         partialFailure.retainSecondaryFailure(loaded.error);
         return failure(
           loaded.error.cleanupIncomplete

src/application/WebRuntimeService.test.ts

@@ -17,7 +17,7 @@ import {
   expectDroppedPartial,
   expectKeptPartial,
   expectOwnerError,
-} from "./ownerObservationExpectation.fixture.js";
+} from "../../tests/fixtures/ownerObservationExpectation.js";
 import type { AnalysisError } from "../domain/analysisErrorBase.js";
 import { parseEvidence } from "../domain/evidence.js";
 

src/application/WebSourceLocationService.test.ts

@@ -106,8 +106,7 @@ it.each([
       path: ["generated_position", "line"],
       minimum: 1,
       maximum: 2,
-      message:
-        "No line 3; the retained script ends at line 2 (one-based lines).",
+      message: expect.stringMatching(/line 3.*line 2.*one-based/i),
     },
   },
   {
@@ -116,8 +115,9 @@ it.each([
       path: ["generated_position", "column"],
       minimum: 0,
       maximum: 3,
-      message:
-        "No column 4 on line 1; it ends at column 3 (zero-based UTF-16 columns).",
+      message: expect.stringMatching(
+        /column 4.*line 1.*column 3.*zero-based UTF-16/i,
+      ),
     },
   },
   {

src/application/WorkflowAnalysisProfile.ts

@@ -10,22 +10,34 @@ export const workflowAnalysisProfile = (
   upstream: AnalysisProfileCommitment,
   operation?: AnalysisOperation,
 ): AnalysisProfileCommitment =>
-  createAnalysisProfile(REA_WORKFLOW_PROVIDER, {
-    upstream_analysis_profile: upstream,
-    source_limitations: "provider-operation-caveats-v1",
-    ...(operation === "trace_native_values"
-      ? { value_flow_absence: "recorded-versus-unavailable-v1" }
-      : {}),
-    ...(operation === "binary_overview"
-      ? { workflow_revision: 5 }
-      : operation === "batch_decompile"
-        ? { workflow_revision: 4 }
-        : operation === "trace_feature"
-          ? { workflow_revision: 9 }
-          : operation === "get_call_graph"
-            ? { workflow_revision: 3 }
-            : operation === "trace_call_path" ||
-                operation === "trace_native_values"
-              ? { workflow_revision: 2 }
-              : { workflow_revision: 1 }),
-  });
+  createAnalysisProfile(
+    REA_WORKFLOW_PROVIDER,
+    workflowAnalysisProfileParameters(upstream, operation),
+  );
+
+/** The owned profile shape, with null allowed when estimating its envelope. */
+export const workflowAnalysisProfileParameters = (
+  upstream: AnalysisProfileCommitment | null,
+  operation?: AnalysisOperation,
+) => ({
+  upstream_analysis_profile: upstream,
+  source_limitations: "provider-operation-caveats-v1",
+  ...(operation === "trace_native_values"
+    ? {
+        value_flow_limitations: "provider-attributed-v1",
+        value_flow_absence: "recorded-versus-unavailable-v1",
+      }
+    : {}),
+  ...(operation === "binary_overview"
+    ? { workflow_revision: 5 }
+    : operation === "batch_decompile"
+      ? { workflow_revision: 4 }
+      : operation === "trace_feature"
+        ? { workflow_revision: 9 }
+        : operation === "get_call_graph"
+          ? { workflow_revision: 3 }
+          : operation === "trace_call_path" ||
+              operation === "trace_native_values"
+            ? { workflow_revision: 2 }
+            : { workflow_revision: 1 }),
+});

src/application/WorkflowEvidence.test.ts

@@ -1,9 +1,12 @@
 import { describe, expect, it } from "vitest";
+import { z } from "zod";
 
 import {
   recordWorkflowUnknowns,
   createWorkflowEvidence,
   executeComposedWorkflow,
+  retainComposedWorkflowSources,
+  retainPartialWorkflowEvidence,
   workflowSnapshotRecord,
 } from "./WorkflowEvidence.js";
 import { InvestigationRecords } from "./investigation/InvestigationRecords.js";
@@ -18,6 +21,7 @@ import {
   AnalysisResourceConstraintError,
 } from "../domain/analysisErrorCore.js";
 import { projectAnalysisError } from "../domain/analysisErrorProjection.js";
+import { estimateJsonStorage } from "./JsonAuthenticationHeadroom.js";
 import { nativeApiBoundarySchema } from "../domain/native/nativeApiBoundary.js";
 import { projectNativeApiInspection } from "./native/NativeApiInspection.js";
 import { functionDossierSchema } from "../domain/native/functionDossier.js";
@@ -25,6 +29,124 @@ import { ghidraFunctionDossier } from "../domain/ghidraValues.fixture.js";
 import { ANALYSIS_SNAPSHOT_PROFILE } from "../domain/analysisSnapshot.fixture.js";
 import { createEvidence } from "../domain/evidence.js";
 
+it("preserves cleanup and reports an omitted partial when authentication headroom is unavailable", () => {
+  const error = new AnalysisCancelledError("get_call_graph", {
+    cleanup: { reason: "close failed", resources: ["session:fixture"] },
+  });
+  const outcome = {
+    ...err(error),
+    partial: { result: { nodes: ["observed"] }, limitations: [] },
+    sourceEvidence: [],
+  };
+  retainPartialWorkflowEvidence(
+    outcome,
+    {
+      target: undefined,
+      operation: "get_call_graph",
+      parameters: {},
+      upstreamProfile: undefined,
+    },
+    () =>
+      err(
+        new AnalysisResourceConstraintError(
+          "get_call_graph",
+          "capacity",
+          "no headroom",
+          null,
+        ),
+      ),
+  );
+  expect(projectAnalysisError(error)).toMatchObject({
+    code: "cleanup_incomplete",
+    details: {
+      cleanup: "incomplete",
+      resources: ["session:fixture"],
+      partial_observation: {
+        kind: "omitted-observation",
+        reason: "insufficient-authentication-headroom",
+      },
+    },
+  });
+});
+
+it.each([0, 1, 100])(
+  "admits enough recovery representation for %i completed batch items",
+  (count) => {
+    const provider = { id: "fixture", name: "Fixture", version: "1" };
+    const source = createEvidence(undefined, provider, {
+      operation: "health",
+      parameters: {},
+      result: "source",
+    });
+    const items = Array.from({ length: count }, (_, index) => ({
+      address: `input-${index}`,
+      procedure: {
+        status: "resolved",
+        address: `0x${(index + 1).toString(16)}`,
+        name: null,
+      },
+      status: "ok",
+      pseudocode: 'escaped " and Unicode α'.repeat((index % 3) + 1),
+    }));
+    const completed = {
+      ...ok({
+        result: { items, total: count, succeeded: count, failed: 0 },
+        limitations: [],
+        evidenceLinks: [source.evidence_id],
+      }),
+      sourceEvidence: [source],
+    };
+    let admitted: ReturnType<typeof estimateJsonStorage> | undefined;
+    const outcome = retainComposedWorkflowSources(
+      () =>
+        err(
+          new AnalysisResourceConstraintError(
+            "record_evidence",
+            "capacity",
+            "full",
+            null,
+          ),
+        ),
+      completed,
+      {
+        target: {
+          path: "/tmp/example",
+          sha256: "a".repeat(64),
+          kind: "executable",
+          format: "mach-o",
+          architecture: "arm64",
+          availableArchitectures: ["arm64"],
+        },
+        operation: "batch_decompile",
+        parameters: { addresses: items.map((item) => item.address) },
+        upstreamProfile: ANALYSIS_SNAPSHOT_PROFILE,
+      },
+      () => undefined,
+      (input, _operation, additional) => {
+        const base = estimateJsonStorage(input);
+        admitted = {
+          valueBytes: base.valueBytes + additional.valueBytes,
+          serializedUtf16Bytes:
+            base.serializedUtf16Bytes + additional.serializedUtf16Bytes,
+        };
+        return ok(undefined);
+      },
+    );
+    expect(outcome.ok).toBe(false);
+    if (outcome.ok || admitted === undefined)
+      throw new Error("Expected admitted recovery");
+    const error = projectAnalysisError(outcome.error);
+    const completedEvidence = z
+      .object({ completed_observation: z.object({ evidence: z.unknown() }) })
+      .parse(error.details).completed_observation.evidence;
+    const actual = estimateJsonStorage(completedEvidence);
+    expect(admitted.valueBytes).toBeGreaterThanOrEqual(actual.valueBytes);
+    expect(admitted.serializedUtf16Bytes).toBeGreaterThanOrEqual(
+      actual.serializedUtf16Bytes,
+    );
+  },
+);
+
 it("links shared provider source Evidence once without copying its payload into the workflow", async () => {
   const source = createEvidence(
     undefined,

src/application/WorkflowEvidence.ts

@@ -3,7 +3,10 @@ import { compareUnicodeCodePoints } from "../domain/unicodeCodePointOrder.js";
 import { jsonStringByteLength } from "../domain/jsonStringByteLength.js";
 import { createAnalysisExecutionEvidence } from "../domain/analysisObservation.js";
 import { REA_WORKFLOW_PROVIDER } from "../domain/investigationProviders.js";
-import { workflowAnalysisProfile } from "./WorkflowAnalysisProfile.js";
+import {
+  workflowAnalysisProfile,
+  workflowAnalysisProfileParameters,
+} from "./WorkflowAnalysisProfile.js";
 import type {
   AnalysisOperation,
   AnalysisOperationPort,
@@ -20,6 +23,8 @@ import {
 import type { BinaryTarget } from "../domain/binaryTargetTypes.js";
 import {
   createEvidence,
+  MISSING_EVIDENCE_SUBJECT_LIMITATION,
+  evidenceEnvelopeForAdmission,
   type Evidence,
   type EvidenceLocation,
 } from "../domain/evidence.js";
@@ -29,9 +34,16 @@ import { UnknownRegistryError } from "../domain/unknownRegistryError.js";
 import { EvidenceLedger } from "./investigation/EvidenceLedger.js";
 import {
   recordEvidenceSources,
+  retainAnalysisResultSources,
   withEvidenceSources,
   type AnalysisResultWithSources,
 } from "./investigation/recordEvidenceSources.js";
+import { preserveCompletedSourceEvidence } from "./investigation/sourcePublicationRecovery.js";
+import {
+  admitInvestigationAuthentication,
+  type RecoveryAdmission,
+} from "./investigation/InvestigationRetention.js";
+import { estimateJsonStorage } from "./JsonAuthenticationHeadroom.js";
 import { workflowUnknownInput } from "./investigation/WorkflowUnknown.js";
 import {
   renderSourceLimitations,
@@ -209,7 +221,7 @@ export const TRACE_FEATURE_REFERENCE_LIMITATION =
   "Reference queries cover only each matched start address, not interior bytes of strings and procedures. Empty references and truncated: false do not establish complete reference coverage.";
 
 /** Build the shared Evidence record for a successful composed binary workflow. */
-export const createWorkflowEvidence = (input: {
+export interface WorkflowEvidenceInput {
   readonly target: BinaryTarget | undefined;
   readonly operation: AnalysisOperation;
   readonly parameters: Readonly<Record<string, JsonValue>>;
@@ -217,7 +229,20 @@ export const createWorkflowEvidence = (input: {
   readonly upstreamProfile: AnalysisProfileCommitment | undefined;
   readonly upstreamLimitations: readonly string[];
   readonly upstreamEvidenceLinks?: readonly string[];
-}): Evidence =>
+}
+
+const WORKFLOW_DERIVATION_LIMITATION = "Derived by an REA composed workflow.";
+
+const workflowLimitations = (
+  operation: AnalysisOperation,
+): readonly string[] =>
+  operation === "trace_feature"
+    ? [WORKFLOW_DERIVATION_LIMITATION, TRACE_FEATURE_REFERENCE_LIMITATION]
+    : [WORKFLOW_DERIVATION_LIMITATION];
+
+export const createWorkflowEvidence = (
+  input: WorkflowEvidenceInput,
+): Evidence =>
   createEvidence(input.target, REA_WORKFLOW_PROVIDER, {
     operation: input.operation,
     parameters: input.parameters,
@@ -235,10 +260,7 @@ export const createWorkflowEvidence = (input: {
       ? {}
       : { evidenceLinks: input.upstreamEvidenceLinks }),
     limitations: [
-      "Derived by an REA composed workflow.",
-      ...(input.operation === "trace_feature"
-        ? [TRACE_FEATURE_REFERENCE_LIMITATION]
-        : []),
+      ...workflowLimitations(input.operation),
       ...input.upstreamLimitations,
     ],
     ...(input.operation === "batch_decompile"
@@ -246,6 +268,128 @@ export const createWorkflowEvidence = (input: {
       : {}),
   });
 
+const admitWorkflowRecovery = (
+  observation: ComposedWorkflowObservation,
+  evidenceInput: Pick<
+    WorkflowEvidenceInput,
+    "target" | "operation" | "parameters" | "upstreamProfile"
+  >,
+  admitRecovery: RecoveryAdmission,
+) => {
+  const admissionInput = {
+    operation: evidenceInput.operation,
+    parameters: evidenceInput.parameters,
+    target:
+      evidenceInput.target === undefined
+        ? null
+        : {
+            path: evidenceInput.target.path,
+            sha256: evidenceInput.target.sha256,
+            format: evidenceInput.target.format,
+            architecture: evidenceInput.target.architecture ?? null,
+          },
+    profile: evidenceInput.upstreamProfile ?? null,
+    result: observation.result,
+    limitations: observation.limitations,
+    links: observation.evidenceLinks ?? [],
+  };
+  // The completed result can also generate a location per batch item and
+  // the workflow profile embeds the upstream profile. Admit these copies
+  // before constructing or hashing the recovery Evidence.
+  const shell = evidenceEnvelopeForAdmission(
+    evidenceInput.target,
+    REA_WORKFLOW_PROVIDER,
+    {
+      operation: evidenceInput.operation,
+      parameters: {},
+      result: null,
+      ...(evidenceInput.upstreamProfile === undefined
+        ? {}
+        : {
+            analysisProfile: {
+              provider: REA_WORKFLOW_PROVIDER,
+              parameters: workflowAnalysisProfileParameters(
+                null,
+                evidenceInput.operation,
+              ),
+              digest: "0".repeat(64),
+            },
+          }),
+      confidence: "derived",
+      limitations: workflowLimitations(evidenceInput.operation),
+      locations: [],
+      evidenceLinks: [],
+    },
+  );
+  const additional = estimateJsonStorage([
+    observation.result,
+    evidenceInput.upstreamProfile ?? null,
+    shell,
+    ...(evidenceInput.target === undefined
+      ? [MISSING_EVIDENCE_SUBJECT_LIMITATION]
+      : []),
+  ]);
+  return admitRecovery(admissionInput, evidenceInput.operation, additional);
+};
+
+/** Experimental shared recovery of a workflow that completed before source admission. */
+export const retainComposedWorkflowSources = (
+  recordEvidence: Parameters<typeof retainAnalysisResultSources>[1],
+  result: Awaited<ReturnType<typeof executeComposedWorkflow>>,
+  evidenceInput: Omit<
+    WorkflowEvidenceInput,
+    "result" | "upstreamLimitations" | "upstreamEvidenceLinks"
+  >,
+  evidenceForAnalysis?: (id: string) => Evidence | undefined,
+  admitRecovery: RecoveryAdmission = (input, operation, additional) =>
+    admitInvestigationAuthentication(input, operation, {}, additional),
+): ReturnType<
+  typeof retainAnalysisResultSources<{
+    readonly result: JsonValue;
+    readonly limitations: readonly string[];
+    readonly cachePolicy?: "live";
+    readonly evidenceLinks?: readonly string[];
+  }>
+> => {
+  const retained = retainAnalysisResultSources(
+    evidenceInput.operation,
+    recordEvidence,
+    result,
+  );
+  if (result.ok && !retained.ok) {
+    const admitted = admitWorkflowRecovery(
+      result.value,
+      evidenceInput,
+      admitRecovery,
+    );
+    if (!admitted.ok) {
+      retained.error.retainSourcePublication({
+        kind: "omitted",
+        reason:
+          admitted.error._tag === "AnalysisResourceConstraintError"
+            ? "insufficient-authentication-headroom"
+            : "recovery-input-invalid",
+        source_closure: "not-established",
+      });
+      return retained;
+    }
+    const evidence = createWorkflowEvidence({
+      ...evidenceInput,
+      result: result.value.result,
+      upstreamLimitations: result.value.limitations,
+      ...(result.value.evidenceLinks === undefined
+        ? {}
+        : { upstreamEvidenceLinks: result.value.evidenceLinks }),
+    });
+    preserveCompletedSourceEvidence(
+      retained.error,
+      evidence,
+      evidenceForAnalysis,
+    );
+  }
+  return retained;
+};
+
 /** Retain a stopped workflow's admitted observation as partial workflow Evidence on its failure. */
 export const retainPartialWorkflowEvidence = (
   outcome: ComposedWorkflowResult,
@@ -253,8 +397,30 @@ export const retainPartialWorkflowEvidence = (
     Parameters<typeof createWorkflowEvidence>[0],
     "target" | "operation" | "parameters" | "upstreamProfile"
   >,
+  admitRecovery: RecoveryAdmission = (input, operation, additional) =>
+    admitInvestigationAuthentication(input, operation, {}, additional),
 ): void => {
-  if (outcome.ok || outcome.partial === undefined) return;
+  if (
+    outcome.ok ||
+    outcome.partial === undefined ||
+    outcome.error.partialObservation !== undefined
+  )
+    return;
+  const admitted = admitWorkflowRecovery(
+    outcome.partial,
+    context,
+    admitRecovery,
+  );
+  if (!admitted.ok) {
+    outcome.error.retainPartialObservation({
+      kind: "omitted-observation",
+      reason:
+        admitted.error._tag === "AnalysisResourceConstraintError"
+          ? "insufficient-authentication-headroom"
+          : "recovery-input-invalid",
+    });
+    return;
+  }
   const evidence = createWorkflowEvidence({
     ...context,
     result: outcome.partial.result,

src/application/analysisView/AnalysisViewService.ts

@@ -21,6 +21,7 @@ import { EvidenceIntegrityError } from "../../domain/evidenceErrors.js";
 import { safeParseEvidence } from "../../domain/evidenceValidation.js";
 import {
   createEvidence,
+  evidenceSubjectTarget,
   rebindEvidenceToTargetPath,
   type Evidence,
   type EvidenceSubjectTarget,
@@ -327,21 +328,11 @@ export const projectRetainedAnalysis = (
   if (!retained.ok) return retained;
   // Duplicate semantic records retain their original ledger metadata. Detail
   // selection changes presentation, not the historical lookup or payload owner.
-  const subject = evidence.subject;
   return projectResolvedAnalysisView(
     { source, view },
     prepareAnalysisViewProjection(view),
     retained.value,
-    subject === null
-      ? undefined
-      : {
-          path: subject.local_path,
-          sha256: subject.digest.sha256,
-          format: subject.format,
-          ...(subject.architecture === null
-            ? {}
-            : { architecture: subject.architecture }),
-        },
+    evidenceSubjectTarget(evidence.subject),
   );
 };
 
@@ -383,17 +374,7 @@ const createAnalysisViewEvidence = (
   parent: Evidence,
   result: AnalysisViewResult,
 ): Evidence => {
-  const target =
-    parent.subject === null
-      ? undefined
-      : {
-          path: parent.subject.local_path,
-          sha256: parent.subject.digest.sha256,
-          format: parent.subject.format,
-          ...(parent.subject.architecture === null
-            ? {}
-            : { architecture: parent.subject.architecture }),
-        };
+  const target = evidenceSubjectTarget(parent.subject);
   const nativeFunctionView =
     result.kind === "native" ||
     (result.kind === "summary" &&

src/application/analysisView/BrowserScenarioViews.test.ts

@@ -262,8 +262,10 @@ describe("browser scenario analysis view pages", () => {
       },
     };
     const summary = await view(dropped, { kind: "summary" });
-    expect(summary.unknowns).toContain(
-      "3 events were dropped by capture budgets; counts and pages cover retained events only.",
+    expect(summary.unknowns).toContainEqual(
+      expect.stringMatching(
+        /3 events.*dropped.*counts and pages.*retained events only/iu,
+      ),
     );
     expect(summary).toMatchObject({
       summary: {

src/application/analysisView/NativeLoadImageViews.test.ts

@@ -4,7 +4,10 @@ import {
   analysisViewResultSchema,
   inspectAnalysisViewInputSchema,
 } from "../../domain/analysisView/analysisView.js";
-import { projectNativeLoadImageView } from "../../domain/analysisView/nativeLoadImageView.js";
+import {
+  RELOCATION_SYMBOL_UNRECORDED,
+  projectNativeLoadImageView,
+} from "../../domain/analysisView/nativeLoadImageView.js";
 import type { NativeLoadImage } from "../../domain/native/nativeLoadImage.js";
 import {
   nativeDosLoadImageFixture,
@@ -80,7 +83,7 @@ it("distinguishes recorded, absent, and historical unrecorded relocation symbols
     { record: { symbol: "external_symbol" } },
     { record: { symbol: null } },
   ]);
-  expect(current.unknowns.join(" ")).not.toContain("symbol was not recorded");
+  expect(current.unknowns).not.toContain(RELOCATION_SYMBOL_UNRECORDED);
 
   report.observations.relocations[1]!.symbol = "";
   const emptyName = await view(report, request);
@@ -88,15 +91,15 @@ it("distinguishes recorded, absent, and historical unrecorded relocation symbols
   if (emptyName.items.collection !== "relocations")
     throw new Error("Expected relocations");
   expect(emptyName.items.rows?.[1]?.record).toMatchObject({ symbol: "" });
-  expect(emptyName.unknowns.join(" ")).not.toContain("symbol was not recorded");
+  expect(emptyName.unknowns).not.toContain(RELOCATION_SYMBOL_UNRECORDED);
 
   delete report.observations.relocations[0]!.symbol;
   const historical = await view(report, request);
   if (historical.kind !== "native-load-image") throw new Error("Expected page");
   expect(historical.items.rows?.[0]?.record).not.toHaveProperty("symbol");
-  expect(historical.unknowns.join(" ")).toContain("symbol was not recorded");
+  expect(historical.unknowns).toContain(RELOCATION_SYMBOL_UNRECORDED);
   const omitted = await view(report, { ...request, fields: ["address"] });
-  expect(omitted.unknowns.join(" ")).not.toContain("symbol was not recorded");
+  expect(omitted.unknowns).not.toContain(RELOCATION_SYMBOL_UNRECORDED);
 });
 
 it("summarizes measured ELF facts without upgrading unsupported verification", async () => {

src/application/android/AndroidAnalysisService.test.ts

@@ -2,6 +2,33 @@ import { expect, it, vi } from "vitest";
 import { AndroidAnalysisService } from "./AndroidAnalysisService.js";
 import type { AndroidAnalysisPort } from "./AndroidAnalysisPort.js";
 import { projectAnalysisError } from "../../domain/analysisErrorProjection.js";
+import { createEvidence } from "../../domain/evidence.js";
+import { ok } from "../../domain/result.js";
+import { summarizeRetainedAndroidSearch } from "./AndroidSearchEvidenceSummary.js";
+
+it("retains the selected subject in bounded search Evidence", () => {
+  const source = createEvidence(
+    {
+      path: "/fixture/app.apk",
+      sha256: "a".repeat(64),
+      format: "apk",
+      name: "Selected app",
+    },
+    { id: "fixture", name: "Fixture", version: "1" },
+    {
+      operation: "search_android_classes",
+      parameters: {},
+      result: { matches: [] },
+      rawResult: { complete: true },
+    },
+  );
+  const result = summarizeRetainedAndroidSearch(source, { pages: 1 }, () =>
+    ok("added"),
+  );
+  if (!result.ok) throw result.error;
+  expect(result.value.subject).toEqual(source.subject);
+  expect(result.value.evidence_links).toContain(source.evidence_id);
+});
 
 it("retains selector correction issues before target acquisition", async () => {
   const execute = vi.fn<AndroidAnalysisPort["execute"]>();

src/application/android/AndroidApplicationService.ts

@@ -25,6 +25,5 @@ export const projectAndroidApplicationEvidence = (
     operation: OPERATION,
     predicateType: "rea.android-application-graph",
     provider: ANDROID_APPLICATION_PROVIDER,
-    subjectFormat: () => "apk",
   });
 };

src/application/android/AndroidSearchEvidenceSummary.ts

@@ -1,5 +1,9 @@
 import type { EvidenceWriter } from "../investigation/InvestigationRecordPort.js";
-import { createEvidence, type Evidence } from "../../domain/evidence.js";
+import {
+  createEvidence,
+  evidenceSubjectTarget,
+  type Evidence,
+} from "../../domain/evidence.js";
 import type { AnalysisError } from "../../domain/analysisErrorBase.js";
 import type { JsonValue } from "../../domain/jsonValue.js";
 import { ok, type Result } from "../../domain/result.js";
@@ -18,30 +22,16 @@ export const summarizeRetainedAndroidSearch = (
   if (recordEvidence === undefined) return ok(evidence);
   const recorded = recordEvidence(evidence);
   if (!recorded.ok) return recorded;
-  const subject = evidence.subject;
   return ok(
-    createEvidence(
-      subject === null
-        ? undefined
-        : {
-            path: subject.local_path,
-            sha256: subject.digest.sha256,
-            format: subject.format,
-            ...(subject.architecture === null
-              ? {}
-              : { architecture: subject.architecture }),
-          },
-      evidence.provider,
-      {
-        operation: evidence.operation,
-        parameters: evidence.parameters,
-        result: evidence.normalized_result,
-        rawResult: { ...summary, complete_evidence_id: evidence.evidence_id },
-        confidence: evidence.confidence,
-        limitations: evidence.limitations,
-        locations: evidence.locations,
-        evidenceLinks: [evidence.evidence_id],
-      },
-    ),
+    createEvidence(evidenceSubjectTarget(evidence.subject), evidence.provider, {
+      operation: evidence.operation,
+      parameters: evidence.parameters,
+      result: evidence.normalized_result,
+      rawResult: { ...summary, complete_evidence_id: evidence.evidence_id },
+      confidence: evidence.confidence,
+      limitations: evidence.limitations,
+      locations: evidence.locations,
+      evidenceLinks: [evidence.evidence_id],
+    }),
   );
 };

src/application/apiContract/ApiContractService.ts

@@ -1,4 +1,3 @@
-import { isAbsolute } from "node:path";
 import { getHeapStatistics } from "node:v8";
 import type { ArtifactResourceScope } from "../../artifacts/ArtifactResourceScope.js";
 import { AnalysisError } from "../../domain/analysisErrorBase.js";
@@ -125,10 +124,6 @@ export const inspectApiContractEvidence = async (
   );
   if (!admitted.ok) return admitted;
   const input = admitted.value;
-  if (!isAbsolute(input.path))
-    return err(
-      inputFailure("Expected an absolute filesystem path on this host."),
-    );
   if (input.format === "graphql-sdl") {
     const { importGraphqlContract } =
       await import("./GraphqlContractImport.js");

src/application/apiContract/GraphqlContractImport.ts

@@ -1,4 +1,3 @@
-import { isAbsolute } from "node:path";
 import { getHeapStatistics } from "node:v8";
 import { version } from "graphql";
 import type { ArtifactResourceScope } from "../../artifacts/ArtifactResourceScope.js";
@@ -153,13 +152,6 @@ export const importGraphqlContract = async (
   resources: ArtifactResourceScope,
   signal?: AbortSignal,
 ) => {
-  if (input.operations_path !== undefined && !isAbsolute(input.operations_path))
-    return err(
-      inputFailure(
-        "operations_path",
-        "Expected an absolute filesystem path on this host.",
-      ),
-    );
   const loaded = await readApiContract(input, resources, signal);
   if (!loaded.ok) return loaded;
   const artifact = {

src/application/apkSignature/ApkSignatureService.ts

@@ -4,15 +4,11 @@ import {
   projectRetainedAnalysis,
   type AnalysisViewRetention,
 } from "../analysisView/AnalysisViewService.js";
-import { isAbsolute } from "node:path";
 
 import type { ExecutionOptions } from "../AnalysisProvider.js";
 import type { ApkSignaturePort } from "./ApkSignaturePort.js";
 import type { AnalysisError } from "../../domain/analysisErrorBase.js";
-import {
-  AnalysisInputError,
-  AnalysisOutputError,
-} from "../../domain/analysisErrorCore.js";
+import { AnalysisOutputError } from "../../domain/analysisErrorCore.js";
 import {
   apkSignatureMatchesSubject,
   apkSignatureResultSchema,
@@ -48,16 +44,6 @@ export class ApkSignatureService {
       options?.signal,
     );
     if (!input.ok) return input;
-    if (!isAbsolute(input.value.path))
-      return err(
-        new AnalysisInputError(OPERATION, undefined, [
-          {
-            path: ["path"],
-            reason: "invalid_format",
-            message: "Expected an absolute filesystem path on this host.",
-          },
-        ]),
-      );
     const { detail, view, ...parameters } = input.value;
     if (detail === "summary") {
       const ready = requireAnalysisViewRetention(OPERATION, retention);

src/application/apple/AppleApplicationService.ts

@@ -25,6 +25,5 @@ export const projectAppleApplicationEvidence = (
     operation: OPERATION,
     predicateType: "rea.apple-application-graph",
     provider: APPLE_APPLICATION_PROVIDER,
-    subjectFormat: (first) => first.subject?.format ?? "unknown",
   });
 };