fix(browser): preserve external defaults during CDP attachment

Use Playwright’s public noDefaults connection option and keep temporary focus under the selected page’s existing environment owner. Preserve unrelated page media and avoid creating a bootstrap target or retrying a failed handshake. Extend real CLI/MCP environment verification with an independently observed unselected page and stable page inventory. Cover late focus acquisition and cleanup retry; retain verified upstream license notices for the required SDK upgrade. Assisted-by: Kogasa (gensokyo-skills:kogasa-surprise-testing)
Merge branch 'fix/7167-connect-mode-scenario' of https://github.com/akushonkamen/rea into fix/7167-browser-connect
2026-11-07 05:56:19 -10:00 · 2026-10-26 21:36:12 +00:00 · 2026-10-26 21:10:42 +00:00 · 2026-10-27 04:58:43 +08:00 · 2026-10-27 04:56:17 +08:00 · 2026-10-27 03:49:12 +08:00
2364 changed files with 276612 additions and 72343 deletions
@@ -15,6 +15,11 @@ Follow the checkout's [performance priorities](../../../AGENTS.md#performance),
 workflow, not additional permission to execute targets, publish, or merge.
 Use the current contracts, provider prerequisites, and user authorization.

+Reserve performance measurements for changes that target performance or have a
+concrete regression concern. Routine cleanup uses correctness checks and does
+not require this optimization workflow or synthetic benchmarks merely because
+helper calls, imports, or representations change.
+
 Read [the Kuna case study](references/kuna-case-study.md) when selecting a
 reuse strategy or interpreting a benchmark. Its pinned observations illustrate
 tradeoffs; they are not current-provider guarantees or universal speedups.
@@ -68,9 +68,10 @@ closing-issue reporters. Grouping preserves all those credits in one line.
 When Highlights, detailed entries or migrations reference the same work,
 put its thanks in one of those entries, not all of them. Include issue links.
 Direct-commit bullets carry the commit link and known human credit.
-Exclude GitHub bots and known agent accounts. REA's observed Anthropic, Cursor
-and Codex co-author trailers resolve to `@claude`, `@cursoragent` and `@codex`
-with GitHub type `User`; the credit policy excludes them while retaining their metadata.
+Exclude GitHub bots and known agent accounts. REA's observed Anthropic, Cursor,
+Codex, and Copilot co-author trailers resolve to `@claude`, `@cursoragent`,
+`@codex`, and `@Copilot` with GitHub type `User`; the credit policy excludes
+them while retaining their metadata.
 At the REA maintainer's request, omit `@morluto` self-thanks while preserving
 authorship in the inventory. Other human contributors remain eligible.
 Use explicit GitHub links for cross-repository references to avoid ambiguous
@@ -1,8 +1,8 @@
 ---
 name: reverse-engineer-anything
-description: Reverse engineer native, managed, Electron/JavaScript, packaged, firmware, and browser targets with REA. Use shipped-artifact or requested runtime evidence to explain features, compare versions, decompile code, or guide a reconstruction. Skip REA for ordinary source-repository architecture analysis.
+description: Reverse engineer native, managed, Electron/JavaScript, packaged, firmware, and browser targets with REA, and build agent environments (AgentEnv bundles) of web applications from a live instance or a capture. Use shipped-artifact or requested runtime evidence to explain features, compare versions, decompile code, or guide a reconstruction. Skip REA for ordinary source-repository architecture analysis.
 metadata:
-  version: "46"
+  version: "49"
 ---

 # REA
@@ -133,6 +133,9 @@ explicit path or endpoint and do not need it.
  `capture_browser_scenario` with declared actions. See
  [runtime observation](references/runtime-observation.md) for connect/launch
  and the focused follow-up browser tools.
+- Agent environment (AgentEnv bundle) of a web application: read
+  [environments](references/environments.md) before recording; it records with
+  `capture_browser_scenario` and writes the bundle with `export_environment_bundle`.
 - Fiddler Everywhere traffic or a native `.saz` capture: read the
  [Fiddler workflow](references/runtime-observation.md#fiddler-everywhere-traffic-debugging).
  Inspect saved SAZ with `inspect_web_network_capture` and `format: "saz"`;
@@ -259,6 +262,14 @@ explicit path or endpoint and do not need it.
  proof the image never imported APIs through another table. Bound snapshots
  and loaded IAT contents remain unobserved. See the
  [PE import guide](https://github.com/morluto/rea/blob/main/docs/pe-imports.md).
+- PE TLS callbacks and load configuration: `inspect_pe_load_config` with the
+  explicit local PE32/PE32+ file. This built-in target-free inspection requires
+  no Windows SDK. Preserve callback VAs as strings with their RVA, file offset
+  and section, and the size-covered security cookie, SafeSEH, CFG,
+  EH-continuation and XFG fields. Guard-flag mitigation claims are inferred
+  linker declarations, not proof of enforcement. A missing directory is observed
+  absence of that declaration. See the
+  [PE load configuration guide](https://github.com/morluto/rea/blob/main/docs/pe-load-config.md).
 - ELF note tables: `inspect_elf_notes` with the explicit local ELF32/ELF64
  file. This built-in target-free inspection requires no disassembler. Preserve
  PT_NOTE and SHT_NOTE ranges, owners, types, descriptor SHA-256, and GNU
@@ -273,6 +284,16 @@ explicit path or endpoint and do not need it.
  body; other types, including `"288"` stackshots, return no crash result.
  Opened Mach-O and dSYM UUID joins remain unobserved. See the
  [Apple IPS guide](https://github.com/morluto/rea/blob/main/docs/apple-ips.md).
+- Linux kernel module metadata: `inspect_kernel_module` with the explicit local
+  ELF32/ELF64 relocatable file. This built-in target-free inspection requires
+  no Linux host or `modinfo`. Preserve `.modinfo` key order and duplicate keys,
+  `__versions` CRC hex, section file ranges, and the appended signature
+  trailer's PKCS#7 SHA-256. A missing section is observed absence when section
+  names are known, not proof the module never carried that metadata.
+  `struct module` is not decoded. The signature is not validated. gzip, xz, and
+  zstd containers are unsupported; decompress into a separate file with an
+  external codec utility, then inspect the decompressed `ET_REL` image. See the
+  [kernel module guide](https://github.com/morluto/rea/blob/main/docs/kernel-modules.md).
 - CPython 3.7–3.13 `.pyc` header, nested marshal code objects and bytecode
  identity: `inspect_python_pyc` with the explicit local file. This built-in
  target-free inspection requires no Python installation. Preserve magic,
@@ -353,18 +374,23 @@ native target whose analysis tool operates on the active target. Do not call an
 unadvertised tool; inspect `binary_session` with `{}` and its
 `result.tool_availability` for availability reasons and remediation. Expand each
 group's `names` into entries, inheriting the inventory-level client requirements
-unless the group overrides them. In its closed effect and annotation vocabularies,
-listed flags are true and omitted known flags are false. The grouped name union
-is the complete tool inventory; use `tools/list` for canonical tool schemas.
-Provider candidate facts describe possible providers, while top-level session
-capabilities describe the current route and `analysis_provider_binding` names the
-selected provider. Do not treat those scopes as interchangeable.
+unless the group overrides them. The grouped name union is the complete tool
+inventory; use `tools/list` for canonical tool schemas. The default summary keeps
+each provider candidate's availability and target-support status, code and
+reason; `omitted_fields` lists what it leaves out. Request `{"detail": "complete"}`
+only when you need provider diagnostics, candidate capability sets, or tool
+surface, effect and annotation flags; in those closed flag vocabularies, listed
+flags are true and omitted known flags are false. Provider candidate facts
+describe possible providers, while top-level session capabilities describe the
+current route and `analysis_provider_binding` names the selected provider. Do
+not treat those scopes as interchangeable.

 For a Ghidra startup timeout on a large native target, follow
 [deadline recovery](references/native-and-artifacts.md#ghidra-startup-deadline-recovery)
 before abandoning deep analysis or repeating the same cold import. The default
-330 seconds is configurable; changing the server's environment requires a new
-REA process.
+330 seconds can be changed for new startup attempts through
+`update_analysis_settings` using `ghidra.startup_timeout_ms`. Changing the
+server's launch environment instead requires a new REA process.

 ## Work summary-first

@@ -471,6 +497,9 @@ as complete while required questions remain open.
  [references/runtime-observation.md](references/runtime-observation.md)
 - Evidence paging, comparisons, residual unknowns, and verification:
  [references/evidence-workflows.md](references/evidence-workflows.md)
+- Agent environments (AgentEnv bundles) of a web application, recorded from
+  a live instance or a HAR:
+  [references/environments.md](references/environments.md)

 ## Finish the task

@@ -28,8 +28,11 @@ stdio. A full JDK, including `jdk.compiler`, is required on every host; Windows
 verification coverage. Calls use one worker and provider deadlines; optional
 `REA_JADX_HEAP_MIB` selects the JVM heap and `REA_JADX_OPERATION_TIMEOUT_MS`
 the per-operation deadline (integer milliseconds from 1 to 2147483647, default
-120000; a change applies on the next process start; the MCP client's tool
-timeout must also allow it). The APK is never launched,
+120000). To change that deadline on a running MCP server, set
+`jadx.operation_timeout_ms` through `update_analysis_settings`, then retry after
+work and cleanup settle. Newly accepted operations use the override; accepted
+work keeps its budget. Changing the launch environment requires a new process.
+The MCP client's tool timeout must also allow the selected deadline. The APK is never launched,
 and no emulator is required.

 Manifest entries and decompiled text are static observations, not execution or
@@ -22,7 +22,7 @@ does not establish which server an approval wildcard covers. See
 | Aligned registration, but no connected tools                    | Restart/reconnect the client. Doctor checks registration; it cannot establish the current agent's connection. Inspect the client's launch error if reconnection fails.                                                                                                                                                                                                                                                                                                                                                                                                                  |
 | MCP connection dropped or REA could not start                   | If the connection drops, retry that call once only when it is safe to repeat or known not to have started. If it may already have changed the target, or the same failure returns, tell the user REA's connection failed and ask them to restart the MCP client. If REA could not start its connection, retry once, then tell the user and ask them to restart the MCP client. Do not retry a startup failure that returns the same unchanged result. Run `rea doctor` when REA could not start or tools stay missing after restart. Doctor cannot restore a live connection by itself. |
 | `MCP tool call requires approval, but approval policy is never` | Codex rejected the call before REA executed it. Do not install an engine or repeat setup to solve this client-policy decision. See the approval section below.                                                                                                                                                                                                                                                                                                                                                                                                                          |
-| REA returns `provider_unavailable` or an unavailable tool entry | Read that operation's provider diagnostics or `binary_session.result.tool_availability`. Expand each group's tool names and inherit the shared client requirements unless overridden. Use the operation's availability, reason, and remediation; a complete tool catalog does not imply every operation is available.                                                                                                                                                                                                                                                                   |
+| REA returns `provider_unavailable` or an unavailable tool entry | Read that operation's provider diagnostics or `binary_session.result.tool_availability`. Expand each group's tool names and inherit the shared client requirements unless overridden. Use the operation's availability, reason, and remediation; a complete tool catalog does not imply every operation is available. Request `{"detail": "complete"}` only for provider diagnostics.                                                                                                                                                                                                   |
 | `rea` is missing in a child shell, or Node is incompatible      | Inspect the actual shell PATH and launcher/runtime. A prefix installation may be absent from a login shell's PATH; this does not establish a broken MCP registration.                                                                                                                                                                                                                                                                                                                                                                                                                   |

 If the client cannot launch its shell/sandbox helper or read the installed skill,
@@ -128,7 +128,7 @@ rea setup --client codex --dry-run --json
 Use the current supported client's ID: `claude_code`, `claude_desktop`, `codex`,
 `cursor`, `gemini_cli`, `windsurf`, `devin`, `opencode`, `antigravity`,
 `copilot_cli`, `commandcode`, `qwen_code`, `vscode`, `trae`, `grok_build`, `omp`, `pi`,
-`hermes`, `qoder`, `droid`, `zcode`, `dsh`, or `grok_bot`. If unknown, inspect `doctor --json` before choosing a
+`hermes`, `qoder`, `droid`, `zcode`, `dsh`, `freebuff`, or `grok_bot`. If unknown, inspect `doctor --json` before choosing a
 scope. `grok_bot` uses a chat registration step rather than local `mcp.json`.
 For unsupported clients, use version-pinned manual stdio registration or CLI.

@@ -175,6 +175,17 @@ writing. Managed policy can constrain client settings. Consult the
 for the installed client's supported settings. This is an optional recovery
 choice, not a prerequisite for every REA task.

+## Repair an editable REA limit
+
+If `details.limit` names an editable setting and its bounds, call
+`update_analysis_settings` directly with a `changes` entry containing `setting`,
+`action: "set"` and `value`. `inspect_analysis_settings` is optional when those
+facts are already present. Retry the same input after work and cleanup settle.
+Runtime defaults affect new work only; explicit per-call arguments take
+precedence and must be corrected directly when selected. Reset restores launch
+values. Updates survive target close/open but disappear on REA restart. They do
+not edit host deadlines, response buffers, registrations or fixed limits.
+
 ## Continue through an installed CLI

 Check the command environment only if the launcher fails:
@@ -0,0 +1,216 @@
+# Agent environments from a live application
+
+Use this when the user asks for an agent environment (an AgentEnv bundle) of a
+web application: a folder `agent-env` deploys, whose MCP tools answer from what
+one recording of the application observed and serve the writes that recording
+confirmed. The workflow records the application once with
+`capture_browser_scenario`, checks what the environment would serve, records
+again if a hint names a gap, then writes the bundle with
+`export_environment_bundle`. For a HAR the user already has, skip to
+[export](#export-and-hand-off) through `inspect_web_network_capture`, or use
+`rea environment-build <capture.har> <dir>`.
+
+## Before recording
+
+- Record only against an instance the user says is disposable or seeded for
+  this purpose: every write step creates, edits or deletes its data. If the
+  user has not said so, ask before any scenario that writes. REA does not
+  start, seed or reset applications.
+- Credentials come from environment variables the user names. Declare each as a
+  scenario secret, `{secret_id, environment_variable}`; the variable must be set
+  in the environment REA's MCP server started with. Never ask for a password in
+  chat. Declared secrets are redacted as the capture records.
+- Map the application first with `inspect_web_page` (and `capture_web_screenshot`
+  when layout matters): the login form's locators, and the API calls behind the
+  pages that list and edit the entities the user asked about.
+
+## Record a session an environment can learn writes from
+
+One `capture_browser_scenario` records the whole session. Start from this
+shape, with the application's own locators, paths and headers:
+
+```json
+{
+  "browser": { "mode": "launch", "executable_path": "/usr/bin/chromium" },
+  "start_url": { "url": "http://127.0.0.1:3000/login" },
+  "secrets": [
+    { "secret_id": "admin_password", "environment_variable": "APP_PASSWORD" }
+  ],
+  "capture": {
+    "network": {
+      "request_body": true,
+      "response_body": true,
+      "header_values": true
+    }
+  },
+  "actions": [
+    {
+      "step_id": "user",
+      "action": "fill",
+      "timeout_ms": 15000,
+      "locator": { "kind": "css", "selector": "input[name=username]" },
+      "value": { "source": "literal", "value": "admin" }
+    },
+    {
+      "step_id": "password",
+      "action": "fill",
+      "timeout_ms": 15000,
+      "locator": { "kind": "css", "selector": "input[name=password]" },
+      "value": { "source": "secret", "secret_id": "admin_password" }
+    },
+    {
+      "step_id": "sign-in",
+      "action": "press",
+      "timeout_ms": 15000,
+      "locator": { "kind": "css", "selector": "input[name=password]" },
+      "key": "Enter"
+    },
+    {
+      "step_id": "signed-in",
+      "action": "wait_for",
+      "timeout_ms": 15000,
+      "locator": { "kind": "css", "selector": "nav a[href='/settings']" },
+      "state": "visible"
+    },
+    {
+      "step_id": "folders-1",
+      "action": "request",
+      "timeout_ms": 15000,
+      "method": "GET",
+      "path": "/api/folders",
+      "expected_status": [200]
+    },
+    {
+      "step_id": "create-folder-1",
+      "action": "request",
+      "timeout_ms": 15000,
+      "method": "POST",
+      "path": "/api/folders",
+      "json": { "title": "Scratch folder 1" },
+      "headers": [
+        {
+          "name": "X-CSRFToken",
+          "value": { "source": "cookie", "name": "csrftoken" }
+        }
+      ],
+      "expected_status": [200, 201]
+    }
+  ]
+}
+```
+
+Give every step a `timeout_ms`. A step without one waits until the scenario
+is cancelled, so a locator that never matches hangs the capture, and the
+client with it. Match `wait_for` locators to exactly one element.
+
+1. Sign in through the UI: `fill` the user and password fields (the password
+   as a secret reference), submit, then `wait_for` an element only a signed-in
+   user sees.
+2. Read with `request` steps: each collection the environment needs, twice
+   before any write, so fields that change on their own show up; one item of
+   each.
+3. Use `request` steps only when the API lets the caller choose each scratch
+   object's ID or a prior read already established it. Request paths are fixed
+   strings; no action substitutes a value from an earlier response. For
+   server-assigned IDs, create through the UI and open the new object's detail
+   view to record its read, edit and delete through UI actions. If that journey
+   cannot be scripted, leave the write unserved and report the limitation;
+   never guess an ID or create objects with no supported cleanup path.
+   Record two numbered scratch objects per write type,
+   with varied free text. After each write, and before the next one, read the
+   object back by id and then its list: create 1, read 1, list, create 2,
+   read 2, list; never several writes before their reads.
+4. Leave more than a second between a create and its first edit
+   (`wait_for_timeout` with `duration_ms: 1100`).
+5. Update both objects and read each back; delete both and read each back
+   (expect 404) and the list.
+
+About `request` steps:
+
+- `path` is on the start URL's origin; the page must be on that origin.
+- Header values are literals, declared secrets, a cookie the browser holds
+  (`{source: "cookie", name}`), or a local storage entry
+  (`{source: "local_storage", key, json_pointer}`), with an optional
+  `prefix` such as `"Bearer "`. Copy the headers the application's own
+  requests send (a CSRF header, a bearer token). Values read from the page
+  are redacted from records made after they are read, not from the login
+  response that returned them, and values shorter than 8 characters are not
+  redacted at all.
+- Reading a page value makes later bodies costlier to keep: after a CSRF
+  token, bodies over about 47 KiB are kept as `unavailable`. When the API
+  returns larger responses, raise `capture.limits`
+  (`max_network_body_allocation_bytes`, `max_total_event_allocation_bytes`).
+- Request steps follow no redirects: a redirect fails the step, and
+  `expected_status` cannot name a 3xx status. Use the path the redirect names,
+  such as the one with the trailing slash.
+- Set `expected_status` on every step, so a refused call fails its step and
+  the later steps report not having run, instead of recording read-backs of
+  nothing.
+
+Keep it to about 60 to 160 requests. A scenario with no `request` step is
+recorded exactly as before.
+
+The capture returns its whole Evidence, every recorded body included, which is
+often more than a client shows inline. Before checking coverage, confirm that
+every entry of `normalized_result.steps` has `status: "completed"`; if the
+client saved the result to a file, search it for `"status":"failed"` and read
+that step's `error`. A failed sign-in or write cancels every step after it.
+Use the result's `evidence_id` for coverage and export; do not paste the
+Evidence back into another tool.
+
+## Check coverage
+
+`inspect_analysis_view` with `source: {kind: "retained-evidence",
+evidence_id}` (the capture's id) and `view: {kind: "environment-coverage",
+template_rules: ["after-uid-literal", "opaque-token", "sibling-variance",
+"prefix-variance"]}`. It reports read tools
+answered from the state or replayed (`reads.recorded_reasons`), the served write
+tools, and each withheld write with its `reason` and `hint`. It does not apply
+the serve-time catalog and state size checks; the export reports those.
+
+Re-record a withheld write at most twice, and only for a recording gap. Stop at
+once when the reason is application behaviour, and report the write as
+withheld with its hint:
+
+| Reason                | What to do                                                                                    |
+| --------------------- | --------------------------------------------------------------------------------------------- |
+| `no-state-target`     | Re-record: read the collection or item the write changes.                                     |
+| `no-observation`      | Re-record: read the entity back by id after the write; read it first for an update or delete. |
+| `unconfirmed`         | Re-record: read the entity and its list after the write.                                      |
+| `incomplete-entities` | Re-record: read the entity through every view that lists it.                                  |
+| `unexplained-change`  | Re-record once with a second, different call of the same write.                               |
+| `no-call`             | Re-record once with a write that succeeds.                                                    |
+| `side-effect`         | Stop: the application changes other entities.                                                 |
+| `contradicted`        | Stop: a later read disagrees with the modelled effect.                                        |
+| `body-unusable`       | Stop: the body is not a JSON object.                                                          |
+
+Use new scratch names on each attempt; the first attempt's objects may still
+exist.
+New browser scenario captures include request times, so a fully timed capture
+can learn a write clock and serve updates that stamp modification times. Older
+captures or ones missing a request start keep record order and learn no clock.
+When coverage reports that limitation, record again with the current version
+before concluding that the timestamp change cannot be served.
+
+## Export and hand off
+
+`export_environment_bundle` with `source: {kind: "retained-evidence",
+evidence_id}` (or `{kind: "evidence-file", path}`), an absolute
+`output_directory` that does not exist yet and whose parent does, and a `name`
+(required when the application runs on `localhost` or an IP address). It returns
+the coverage again, `tool_count`, the written files and warnings; `dry_run:
+true` reports without writing. The bundle installs `rea-agents` of this REA's
+version from the registry; when the user runs an unreleased REA build, pass the
+`package_tarball` they give you (a packed `rea-agents` tarball) instead.
+
+Tell the user how many tools answer from the state, which writes are served and
+which are withheld and why, and the run command (`agent-env run <folder>`). Say
+that the bundle ships the recorded responses and the capture's local paths
+(for a browser scenario, the browser executable's path), and
+list any `credential-named-members` warning pointers for review. Never publish
+or share the bundle yourself.
+
+See
+[agent environments](https://github.com/morluto/rea/blob/main/docs/agent-environments.md)
+for what the state, replay and the bundle establish, and
+[evidence workflows](evidence-workflows.md) for the manifest and state views.
@@ -106,6 +106,13 @@ each plan states why in its `reason`. It replays the capture instead with
 `--replay-only` or when the state is unavailable (not derivable, or a catalog
 over the discovery budget), and its stopped document's `state` says which
 applied.
+Use `view: {kind: "environment-coverage"}` with the same rules to see what an
+environment built from a capture would serve: read tools answered from the
+state or replayed with their reason, and each write tool served or withheld
+with a hint about what to record next; it does not apply the serve-time
+catalog and state size checks. `rea environment-build <capture.har> <dir>`
+inspects, projects and exports in one step and prints the same coverage, or
+`null` when the bundle serves replay.

 For a PE/ELF export question, `inspect_native_exports` accepts `detail: "summary"`
 and retains the complete table. Query `inspect_analysis_view` with
@@ -24,9 +24,13 @@ not an unfiltered request. `detail: "summary"` reduces delivery
 and does not by itself reduce analysis work.

 ASAR header/index admission defaults to 16 MiB / 16777216 bytes;
-`REA_ASAR_MAX_HEADER_BYTES` (at most 256 MiB, set where REA starts) changes it.
-`source_paths`, `detail`, and `max_heap_mb` do not bypass or raise it. Or
-analyze an extracted directory.
+an admission error names `asar.max_header_bytes` and its bounds (at most
+256 MiB). Call `update_analysis_settings` with that setting, `action: "set"`
+and enough bytes, then retry the same full-archive request. No inspection or
+REA restart is required. `REA_ASAR_MAX_HEADER_BYTES` seeds future REA processes.
+`source_paths`, `detail`, and `max_heap_mb` do not bypass or raise header admission.
+Runtime JavaScript timeout/heap defaults are also editable; explicit per-call
+`analysis_timeout_ms` and `max_heap_mb` take precedence.

 Exact `#alias` specifiers resolve through the importer's
 enclosing package `imports` map to package-local files; nested `node_modules`
@@ -74,6 +78,15 @@ classification, and unavailable sources never establish route reachability or
 the complete application route denominator. See the
 [route inventory guide](https://github.com/morluto/rea/blob/main/docs/javascript-route-inventory.md).

+For captured endpoint observations and inference facts, `analyze_web_bundle`
+also accepts `view: {kind: "web-bundle", collection: "endpoints", limit: 32}`
+with `detail: "summary"`. Read later `endpoints`, `inferences`, or `summary`
+pages from the retained parent. Filter before requesting detail; retain
+`source_index` together with parent ID and collection, and request `location`
+or `basis` when tracing sources. Page exhaustion does not mean producer
+completeness: check `completeness`, structured `source_unknowns`, and limitations.
+Endpoint candidates remain inferences rather than confirmed network behavior.
+
 ## Read a module without repeating analysis

 Use the actual returned parent ID, on the same connection, as `source.evidence_id`.
@@ -13,6 +13,13 @@ Select columns, batch IDs and page individual facts; aliases remain unresolved.
 Unpaired observations do not prove additions/removals. Existing matched dossier
 pairs include inputs for `compare_functions`; otherwise analyze just chosen pairs.

+For a matching representation refusal, inspect `details.limit` and raise
+`native.matching_representation_bytes` with `update_analysis_settings` before
+retrying the unchanged MCP request. CLI launch seed:
+`REA_NATIVE_MATCHING_REPRESENTATION_BYTES`. The default is 96 MiB; the policy
+range is 1 byte to 1 GiB and does not bound process RSS. Keep the complete
+inventories: splitting them changes global name/body uniqueness.
+
 ## Apple app resources

 Use `open_bundle_resources` with the selected app path, then `inspect_plist`,
@@ -125,6 +132,19 @@ table or overlay. Bound snapshots, loaded IAT contents, and export-forward
 resolution remain unobserved. See
 [PE import and delay-load tables](https://github.com/morluto/rea/blob/main/docs/pe-imports.md).

+## PE TLS callbacks and load configuration
+
+Use `inspect_pe_load_config` for an explicit local PE32/PE32+ image when the
+question concerns code that runs before the entry point through TLS callbacks,
+or the security cookie, SafeSEH, CFG, EH-continuation and XFG declarations in
+the load configuration. No `open_binary`, Windows SDK, or target execution is
+required. The CLI equivalent is `inspect-pe-load-config PATH`. Preserve artifact
+SHA-256, directory and callback-array file ranges, and callback VAs as
+hexadecimal strings. Fields outside the declared `Size` are `null`. Guard-flag
+mitigations carry `evidence_kind: "inferred"`; enforcement remains unobserved.
+See
+[PE TLS callbacks and load configuration](https://github.com/morluto/rea/blob/main/docs/pe-load-config.md).
+
 ## ELF note tables

 Use `inspect_elf_notes` for an explicit local ELF32/ELF64 image when the
@@ -148,6 +168,25 @@ uppercase image UUIDs, and integer literals that exceed IEEE-754 range. Only
 no crash result. Opened Mach-O and dSYM UUID joins remain unobserved. See
 [Apple IPS crash reports](https://github.com/morluto/rea/blob/main/docs/apple-ips.md).

+## Linux kernel modules
+
+Use `inspect_kernel_module` for an explicit local ELF32/ELF64 relocatable
+object when the question concerns `.modinfo` license, vermagic, alias,
+depends, or parm strings, the `__versions` symbol CRCs, or an appended module
+signature trailer. No `open_binary`, Linux host, or `modinfo` program is
+required. The CLI equivalent is `inspect-kernel-module PATH`. Preserve
+artifact SHA-256, key order, duplicate keys, CRC hex, and section file ranges.
+A missing section is observed absence when section names are known, not proof
+the module never carried that metadata. `.gnu.linkonce.this_module` is reported
+as present or absent; `struct module` stays unknown because its layout changes
+with the kernel version. `__ksymtab` records are not decoded. The PKCS#7 range
+and its SHA-256 are observed; certificate, signer, and digest coverage remain
+unvalidated. An absent trailer is not proof the module is unsigned in another
+container. gzip, xz, and zstd whole-file containers are unsupported and name
+`external_decompression` as the next probe: use an external codec utility to
+decompress into a separate file, then call `inspect_kernel_module` on that file. See
+[Linux kernel modules](https://github.com/morluto/rea/blob/main/docs/kernel-modules.md).
+
 ## CPython pyc files

 Use `inspect_python_pyc` for an explicit local CPython 3.7–3.13 `.pyc` when the
@@ -284,40 +323,61 @@ run, use `observe_native_calls` with explicit breakpoints and a bounded
 `duration_ms`/`max_events`. It launches a new process under LLDB, so the target
 runs and may change files or use the network. Hardened-runtime targets need the
 `get-task-allow` entitlement.
-Function breakpoints use exact LLDB runtime names: a Darwin C `_main` static symbol
-may be `main` at runtime. REA does not translate names. Set `module` to the image
+Function breakpoints use exact LLDB runtime names: pass an `inspect_macho` export
+or import `runtime_name` (`main`), not its symbol-table `name` (`_main`). REA does
+not translate breakpoint names. Set `module` to the image
 file name when selecting that image only; otherwise loaded system images also
 match. Inspect retained locations and module paths before attributing a call.

 Use `binary_session` with no arguments to check the open target, selected
-provider, and alignment. Its default `result.tool_availability` carries a
-complete inventory grouped by shared facts. Expand each group's `names` and
-inherit the inventory-level client requirements unless a group overrides them;
-availability, reasons, remediation, modes, and flags remain inline. The
-`effects` and `annotations` arrays name true flags from fixed vocabularies, so an
-omitted known flag is false. `tools/list` remains the canonical source for full
-tool schemas when target or provider state changes.
+provider, and alignment. Its default summary `result.tool_availability` carries
+the complete tool inventory grouped by current status. Expand each group's
+`names` and inherit the inventory-level client requirements unless a group
+overrides them; availability, reasons, remediation, and modes remain inline.
+Provider candidates keep availability and target-support status, code, and
+reason. `omitted_fields` names what the summary leaves out; `{"detail":
+"complete"}` adds provider diagnostics, candidate capability sets, and tool
+surface, `effects`, and `annotations`. Those arrays name true flags from fixed
+vocabularies, so an omitted known flag is false. `tools/list` remains the
+canonical source for full tool schemas when target or provider state changes.

 Provider capability groups carry provider identity and ordered limitations.
 Prepend each set's `shared_limitations` to a group's `limitations` to recover the
-operation's full ordered list. Candidate capabilities describe possible
-providers. Top-level session capabilities describe the current route, and
+operation's full ordered list. Candidate capabilities, returned with complete
+detail, describe possible providers. Top-level session capabilities describe the current route, and
 `analysis_provider_binding` identifies the selected provider.

+## Reuse caller-selected Ghidra analysis
+
+When the caller supplies an expanded project, configure `REA_GHIDRA_PROJECT_PATH`
+(the `.gpr` marker) and optionally `REA_GHIDRA_PROGRAM_NAME` (one root program),
+then restart/reconnect before `open_binary`. CLI uses the same configuration.
+REA opens only a fingerprint-bound owned copy with `-process -noanalysis -readOnly`;
+original project files are not opened by the engine or saved. Database edits,
+import overrides and repair scripts are unavailable in this mode. Treat original
+analysis completeness/settings as unknown and prior edits as caller-project state.
+The program's recorded import digest must match the target; changed project content
+requires reopening for a fresh profile. See the
+[setup and preparation guide](https://github.com/morluto/rea/blob/main/docs/installation.md#reuse-an-existing-ghidra-project).
+
 ## Ghidra startup deadline recovery

 `provider_timeout` during the first Ghidra query can cover import, auto-analysis,
 bridge startup, and readiness. The default 330,000 ms is configurable through
 `REA_GHIDRA_STARTUP_TIMEOUT_MS`; a smaller query still needs the same cold import.

-Preserve useful Evidence before closing the session or restarting REA. Check
-`close_binary` and resolve reported cleanup failures. Set a larger startup budget
-in the environment that launches REA, then restart REA and reconnect the MCP
-client before reopening the same target. Closing and reopening a binary in the
-existing server keeps its original configuration and starts import again.
-Environment changes in an agent's shell do not update an already running MCP
-server. If its launch configuration cannot be changed, report that constraint
-and the exact retry setting instead of claiming a fixed technical limit.
+When the error names `ghidra.startup_timeout_ms`, call
+`update_analysis_settings` with `action: "set"` and a larger value within the
+reported bounds. Resolve retained cleanup before the next startup attempt.
+No REA restart is needed; an already accepted startup keeps its original
+budget. A new attempt repeats import. Preserve useful Evidence before closing
+and reopening the target when remediation requires that lifecycle step.
+
+For a per-function timeout, update `ghidra.decompile_timeout_seconds` and retry
+the same function on the existing Program. Explicit `null` removes that
+per-function deadline. Inspection is optional when the error supplies the
+setting and bounds. Runtime updates disappear when REA exits; environment
+changes only seed future REA processes.

 The client's tool-call deadline must allow startup plus the requested query;
 server settings and progress notifications cannot override it. CLI analysis
@@ -363,6 +423,21 @@ encoded in bounded batches.
 The 25000 ms Cutter request deadline and the 256-candidate discovery budget
 still have no runtime override.

+## Selected native facts and call graphs
+
+For a large `get_call_graph`, or repeated `procedure_address`,
+`procedure_callees`, `procedure_callers` and `resolve_containing_procedure`
+queries, select `detail: "summary"` when the first 64 recorded observations
+suffice. Read further `native-observation` pages from the returned parent Evidence
+ID. Graph message IDs index that page's exact-text dictionary; keep level,
+source index, failed nodes, and partial/unknown relationship coverage.
+Read referenced source context through `native-context` facets `overview`,
+`analysis-profile`, `limitations` and `result-limitations`. Reuse inspected
+context/profile values only for the same digest; until caveats are read,
+interpretation beyond the returned facts remains unknown. Complete Evidence
+remains retained and exportable. Small complete replies can cost fewer tokens
+than additional context/page calls; count the completed task and discovery.
+
 ## Static memory and original file bytes

 For Ghidra, `read_bytes` reads initialized analysis memory, including loader
@@ -390,6 +465,14 @@ loaded bytes, file mappings, relocations and the entry against the immutable
 snapshot. Keep `mismatch` and `unsupported` explicit. Verified import covers the
 reported static image, not runtime DOS or PC-98 hardware behavior.

+For a large load-image report, select `detail: "summary"` and query its
+`parent_evidence_id` with `inspect_analysis_view` kind `native-load-image`.
+Choose a collection such as `relocations` or `mappings`, select only needed
+fields, and page with offset/limit. Original indices preserve same-address
+alternatives. Null collections remain unrecorded or inapplicable; paging does
+not upgrade unsupported verification. CLI requires `--evidence_output` for
+summary delivery so complete source Evidence remains accessible.
+
 For Ghidra decompilation, `procedure_pseudo_code` also accepts `procedure: "file-offset:0x..."`; CLI `rea decompile <path> --file-offset=0x... --provider ghidra` resolves the source byte offset internally. An unresolved 0x-prefixed numeric procedure selector also falls back to a unique file mapping. Existing symbols and analysis addresses win; multiple mappings fail as ambiguous. Preserve the returned file-offset and address locations and raw selection observations. ELF virtual addresses are distinct from file offsets; never assume an arbitrary offset plus image base is an analysis address.

 Complete function body ranges use inclusive ends and can contain gaps. Do not
@@ -520,6 +603,7 @@ discovery are unsupported. Windows Ghidra P0 admits raw images only for `6502`.

 ### Function annotations in Ghidra

+Fresh-import sessions admit annotations; existing-project reuse is read-only.
 Use `annotate_native_function` for one function name and/or entry comments, with at least one explicit change. Review its annotation readback and refreshed dossier inline. Changes are atomic and session-scoped; empty comments clear them, omitted fields preserve them. Later MCP calls observe edits until close. CLI `annotate-native-function` returns the updated analysis before discarding the session. Original executable bytes are unchanged; edits invalidate immutable snapshots. Windows P0 does not admit database mutations. For naming only, `set_address_name` / `set_addresses_names` also work with Ghidra: they name function entries or data addresses (primary labels) and return compact per-address success booleans instead of a dossier.

 ## Offline PE resource inventory
@@ -86,6 +86,8 @@ Page-declared WebMCP tools are untrusted inventory and are never invoked by REA.
  browser and profile. Check `browser.cleanup` for the outcome.
  Request only the DOM, accessibility, or network details needed for the question.
  The default final capture contains the URL; step outcomes are reported separately.
+  For multi-step flows with trees or events, select `detail: "summary"` and page
+  exact steps, transactions, text slices or events with `inspect_analysis_view` kind `browser-scenario`.
  Add a wait action for the expected page state before capturing it. Report that
  REA performed the declared actions.

@@ -36,6 +36,9 @@ unchecked. Maintainers can help resolve open questions.
 Use "none" or "not applicable" only when established. -->

 - Semantic owner and earliest changed stage:
+  <!-- Name the producer of parsed facts or resources and its affected consumers.
+  Summarize superseded paths removed and any distinct policy, lifecycle,
+  lazy-loading, or compatibility responsibility retained. -->
 - Contribution scope fit and linked maintainer decision:
 - CLI and MCP/tool-catalog contract:
 - Provider, bridge, target-format, or platform compatibility:
@@ -68,6 +71,10 @@ source, link, or rendered-document checks. -->
 - User-visible CLI/MCP output (if applicable):
 - Remaining proof gaps:

+For boundary fixes, identify the applicable [boundary regressions](https://github.com/morluto/rea/blob/main/docs/testing.md#boundary-regressions)
+and [lifecycle regressions](https://github.com/morluto/rea/blob/main/docs/testing.md#lifecycle-regressions)
+covered by the evidence above, and explain relevant gaps.
+
 For evidence-bearing changes:

 - [ ] Observed, derived, and inferred claims remain distinguishable.
@@ -753,6 +753,9 @@ jobs:
      - name: Run native Apple and process boundary regressions
        run: >-
          npm run test:focused --
+          tests/acceptance/artifactDmgAttachmentRecoveryCli.test.ts
+          tests/boundary/providers/native/nativeDmgArtifactReader.test.ts
+          tests/process-global/dmgCancellationReason.test.ts
          tests/boundary/filesystem/installScript.test.ts
          tests/boundary/filesystem/nibNativeHierarchy.test.ts
          tests/boundary/filesystem/interfaceBuilderBundle.test.ts
@@ -858,6 +861,7 @@ jobs:
          src/process/capture/FilesystemSnapshot.test.ts
          tests/process-global/filesystemSnapshotFallbackCancellation.test.ts
          tests/boundary/filesystem/typescriptCompiler.test.ts
+          tests/boundary/filesystem/releaseProposal.test.ts
          tests/boundary/filesystem/binaryTarget.test.ts
          src/contracts/sessionPathInputs.test.ts
          tests/boundary/filesystem/directAnalysisSnapshotReplay.test.ts
@@ -867,6 +871,7 @@ jobs:
          tests/boundary/providers/native/artifactProvider.extractionCompleteness.test.ts
          tests/boundary/filesystem/setupUnavailableProvider.test.ts
          tests/boundary/filesystem/windowsNpxRegistration.test.ts
+          tests/boundary/filesystem/claudeDesktopSkillUninstallWindows.test.ts
          tests/boundary/filesystem/clientConfigurationEnvironment.test.ts
          tests/boundary/filesystem/clientConfigurationLayeredEnvironment.test.ts
          tests/acceptance/setup/registrationRuntimeEnvironmentCli.test.ts
@@ -0,0 +1,55 @@
+name: Real Android metadata bridge
+
+on:
+  push:
+    branches: ["**"]
+    paths:
+      - .github/workflows/real-android-metadata.yml
+      - bridge/android/**
+      - src/android/JadxRelease.ts
+      - scripts/fixtures/android/**
+      - tests/conformance/android/**
+      - tests/fixtures/android/static-initializers/**
+      - tests/fixtures/android/direct-invokes/**
+      - .nvmrc
+  workflow_dispatch:
+  workflow_call:
+
+permissions:
+  contents: read
+
+concurrency:
+  group: android-metadata-${{ github.ref }}
+  cancel-in-progress: true
+
+jobs:
+  android-metadata:
+    runs-on: ubuntu-24.04
+    timeout-minutes: 10
+    steps:
+      - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0
+      - uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4.4.0
+        with:
+          node-version-file: .nvmrc
+      - name: Fetch checksum-pinned engine and public APK fixture
+        run: node scripts/fixtures/android/fetch.mjs "$RUNNER_TEMP/rea-android"
+      - name: Compile and exercise the real metadata bridge
+        shell: bash
+        run: |
+          export JAVA_HOME="$JAVA_HOME_21_X64"
+          android_root="$RUNNER_TEMP/rea-android"
+          classes="$android_root/classes"
+          jar="$android_root/jadx-headless-mcp-0.7.1-all.jar"
+          mkdir -p "$classes"
+          "$JAVA_HOME/bin/javac" -J-Xmx512m -J-XX:ActiveProcessorCount=2 \
+            -classpath "$jar" -d "$classes" \
+            bridge/android/ReaJadxBridge.java \
+            tests/conformance/android/ReaJadxMetadataRegression.java
+          "$JAVA_HOME/bin/java" -Xmx512m -XX:ActiveProcessorCount=2 \
+            -classpath "$classes:$jar" ReaJadxMetadataRegression \
+            "$android_root/ApiDemos-debug.apk" \
+            "$GITHUB_WORKSPACE/tests/fixtures/android/static-initializers" \
+            "$classes" "$GITHUB_WORKSPACE/tests/fixtures/android/direct-invokes" \
+            | tee "$android_root/metadata.log"
+          grep -F 'RAW_CLASS_SELECTOR_REGRESSION_PASS nested=true metadata=true references=true' \
+            "$android_root/metadata.log"
@@ -55,6 +55,12 @@ jobs:
      - uses: ./.github/actions/portable-build-cache
        with:
          build_cache_artifact: ${{ inputs.build_cache_artifact }}
+      - name: Install ELF32 cross toolchains for source-owned fixtures
+        run: |
+          sudo apt-get update
+          sudo apt-get install --yes --no-install-recommends \
+            gcc-i686-linux-gnu gcc-arm-linux-gnueabi gcc-mips-linux-gnu gcc-mipsel-linux-gnu \
+            libc6-dev-i386-cross libc6-dev-armel-cross libc6-dev-mips-cross libc6-dev-mipsel-cross
      - name: Acquire exact upstream libraries in an isolated runner environment
        shell: bash
        run: |
@@ -48,7 +48,8 @@ jobs:
      - uses: ./.github/actions/portable-build-cache
        with:
          build_cache_artifact: ${{ inputs.build_cache_artifact }}
-      - run: npm run verify:browser
+      # Own a fresh bus so Chromium never depends on an inherited session address.
+      - run: dbus-run-session -- npm run verify:browser
        env:
          REA_BROWSER_EXECUTABLE: /usr/bin/google-chrome
          REA_BROWSER_NO_SANDBOX: "true"
@@ -44,7 +44,8 @@ jobs:
      - uses: ./.github/actions/portable-build-cache
        with:
          build_cache_artifact: ${{ inputs.build_cache_artifact }}
-      - run: env -u DBUS_SESSION_BUS_ADDRESS npm run verify:browser:runtime
+      # Own a fresh bus so Chromium never depends on an inherited session address.
+      - run: dbus-run-session -- npm run verify:browser:runtime
        env:
          REA_BROWSER_EXECUTABLE: /usr/bin/google-chrome
          REA_BROWSER_NO_SANDBOX: "true"
@@ -46,7 +46,8 @@ jobs:
          build_cache_artifact: ${{ inputs.build_cache_artifact }}
      - name: Install the pinned compiler into an isolated fixture directory
        run: npm install --prefix "$RUNNER_TEMP/rea-web-source-map-compiler" --no-audit --no-fund --package-lock=false [email protected]
-      - run: npm run verify:browser:source-maps
+      # Own a fresh bus so Chromium never depends on an inherited session address.
+      - run: dbus-run-session -- npm run verify:browser:source-maps
        env:
          # Retain browser launch argv/PID/stderr in the verifier's captured
          # CLI failure diagnostics without changing its deadline or retrying.
@@ -1,7 +1,13 @@
 {
  "$schema": "./node_modules/oxlint/configuration_schema.json",
-  "plugins": ["typescript", "import", "unicorn", "oxc"],
+  "plugins": ["typescript", "import", "unicorn", "oxc", "vitest"],
  "rules": {
+    "rea/no-buffer-deep-equality": "error",
+    "rea/cancellation-cause": "error",
+    "no-async-promise-executor": "error",
+    "no-unreachable": "error",
+    "no-unsafe-optional-chaining": "error",
+    "no-useless-escape": ["warn", { "allowRegexCharacters": ["-"] }],
    "complexity": ["warn", 20],
    "max-depth": ["warn", 4],
    "max-lines": [
@@ -23,7 +29,38 @@
    "max-params": ["warn", 4],
    "no-var": "warn",
    "no-var-requires": "error",
-    "typescript/no-import-type-side-effects": "error"
+    "typescript/no-import-type-side-effects": "error",
+    "vitest/no-standalone-expect": "off",
+    "vitest/no-conditional-expect": "off",
+    "vitest/expect-expect": "off",
+    "vitest/no-disabled-tests": "off",
+    "vitest/require-mock-type-parameters": "off",
+    "vitest/require-to-throw-message": "off",
+    "import/no-duplicates": [
+      "warn",
+      {
+        "preferInline": false
+      }
+    ],
+    "vitest/valid-expect": [
+      "warn",
+      {
+        "maxArgs": 2
+      }
+    ],
+    "rea/no-evidence-json-preadmission": "error",
+    "rea/no-positional-tool-contract": "error",
+    "rea/no-fixture-root-cleanup": "error",
+    "typescript/no-floating-promises": "error",
+    "typescript/no-misused-promises": "warn",
+    "typescript/return-await": ["error", "error-handling-correctness-only"],
+    "typescript/switch-exhaustiveness-check": [
+      "error",
+      {
+        "considerDefaultExhaustiveForUnions": true
+      }
+    ],
+    "rea/no-shared-module-mock": "error"
  },
  "overrides": [
    {
@@ -36,6 +73,12 @@
        "no-var-requires": "off"
      }
    },
+    {
+      "files": ["src/**/*.ts"],
+      "rules": {
+        "typescript/no-misused-promises": "error"
+      }
+    },
    {
      "files": ["tests/**/*.ts", "src/**/*.test.ts", "src/**/*.fixture.ts"],
      "rules": {
@@ -47,7 +90,8 @@
            "skipBlankLines": true,
            "skipComments": true
          }
-        ]
+        ],
+        "typescript/no-misused-promises": "warn"
      }
    },
    {
@@ -91,6 +135,45 @@
          }
        ]
      }
+    },
+    {
+      "files": ["tests/**/*.test.ts", "src/**/*.test.ts"],
+      "rules": {
+        "vitest/valid-expect": [
+          "warn",
+          {
+            "maxArgs": 2
+          }
+        ],
+        "vitest/valid-expect-in-promise": "error",
+        "vitest/no-focused-tests": "error"
+      }
+    },
+    {
+      "files": [
+        "scripts/lib/http3-capture-assertions.test.mjs",
+        "scripts/lib/http3-verifier-lifecycle.test.mjs"
+      ],
+      "rules": {
+        "typescript/no-floating-promises": [
+          "error",
+          {
+            "allowForKnownSafeCalls": [
+              {
+                "from": "package",
+                "package": "@types/node",
+                "name": "test"
+              }
+            ]
+          }
+        ]
+      }
+    },
+    {
+      "files": ["scripts/fixtures/javascript-recovery/code-split/entry.mjs"],
+      "rules": {
+        "typescript/no-floating-promises": "off"
+      }
    }
  ],
  "env": {
@@ -109,5 +192,14 @@
    ".devin",
    ".factory",
    "third_party"
+  ],
+  "options": {
+    "reportUnusedDisableDirectives": "error"
+  },
+  "jsPlugins": [
+    {
+      "name": "rea",
+      "specifier": "./scripts/lint/index.mjs"
+    }
  ]
 }
@@ -1,3 +1,3 @@
 {
-  ".": "6.7.0"
+  ".": "6.8.0"
 }
@@ -53,9 +53,12 @@ Optimize in this order:
 3. CPU and memory. Avoid unnecessary work and copies; bound concurrency,
   retained state and serialization growth.

-For changes affecting these costs, measure representative completed tasks and
-compare equivalent workflows before and after where available. Report token
-usage, elapsed time, CPU time and peak process-family memory. Separate cold
+Reserve performance measurements for changes that target performance or have a
+concrete regression concern. Routine cleanup uses correctness checks; changes
+to helper calls, imports, or representations alone do not require synthetic
+benchmarks. When measurement is warranted, measure representative completed
+tasks and compare equivalent workflows before and after where available. Report
+token usage, elapsed time, CPU time and peak process-family memory. Separate cold
 and warm runs, label estimates, and state unmeasured costs. Fewer bytes alone
 do not establish fewer tokens or faster analysis.

@@ -80,7 +83,7 @@ Coordinate expensive checks across agents. If a test unexpectedly consumes heavy

 For tool design, follow [docs/tool-design.md](docs/tool-design.md): start from the analyst question, reuse existing contracts, preserve caller choices, and return useful evidence inline. Limits must follow real format, protocol, authority, or resource constraints. Account for representation expansion before allocation; derive completeness from examined coverage.

-For test changes or provider claims, use [docs/testing.md](docs/testing.md). Prefer real public CLI/MCP workflows, then production-boundary integration, then producer goldens. Keep module tests for distinct semantics stronger workflows cannot reliably reproduce. Preserve malformed-input, cancellation, cleanup, permission, capacity, and target-identity coverage when pruning. Report unverified coverage explicitly; simulated providers do not establish real-provider behavior.
+For test changes or provider claims, use [docs/testing.md](docs/testing.md). Select applicable [boundary regressions](docs/testing.md#boundary-regressions) for parser, inventory, snapshot, and projection fixes. Prefer real public CLI/MCP workflows, then production-boundary integration, then producer goldens. Keep module tests for distinct semantics stronger workflows cannot reliably reproduce. Preserve malformed-input, cancellation, cleanup, permission, capacity, and target-identity coverage when pruning. Report unverified coverage explicitly; simulated providers do not establish real-provider behavior.

 Use Conventional Commit subjects and PR titles. Mark breaking changes with `!` or a `BREAKING CHANGE:` footer. Describe behavior changes, relevant validation, and real-provider verification scope.

@@ -108,10 +111,11 @@ distinguish source-derived conclusions, proposed checks, and unavailable coverag
 Address actionable automated review findings and explain disagreements.

 Leave the template's **Author readiness** declarations unchecked for the human
-owner to complete. Never attest to human review on their behalf. Keep the PR in
-draft until the human declares the PR initially ready. Later pushes do not
-invalidate that declaration or require another human sign-off. Keep the PR body
-and affected validation current as work changes. The readiness check validates
+owner to complete. Never attest to human review on their behalf. Draft status
+is optional; preserve the PR's current draft status unless the user asks to change
+it. Later pushes do not invalidate the readiness declaration or require another
+human sign-off. Keep the PR body and affected validation current as work changes.
+The readiness check validates
 the filled declaration; CI and automated review results do not establish that
 human review occurred, maintainer scope approval, or merge permission.

@@ -1,5 +1,107 @@
 # Changelog

+## [6.8.0](https://github.com/morluto/rea/compare/rea-agents-6.7.0...rea-agents-6.8.0) (2026-10-25)
+
+### Highlights
+
+- Build local agent environments from network captures, browser scenarios, or a prompt, then serve derived reads and evidence-gated writes and compare them with fresh application captures.
+- Inspect more shipped formats, including GPU code objects, BEAM, Python bytecode, Unity IL2CPP metadata, Godot PCK, PyInstaller, Node.js SEA, devicetree, and additional PE/ELF tables.
+- Keep large investigations focused with retained summaries, selected fact queries, configurable recovery limits, and row-oriented CLI exports. Complete Evidence remains available.
+
+### ⚠ BREAKING CHANGES
+
+- **Function analysis:** `analyze_function` now defaults to a retained summary. Set `detail: "complete"` for the previous inline dossier; the CLI retains its complete default and requires `--evidence_output` when selecting a summary. [#5660](https://github.com/morluto/rea/pull/5660). Thanks @CryptoJones, @gensokyo-dev, @RishTheFish21.
+- **Accessibility:** Accept JSON numbers and booleans in node `value`, alongside strings and null. Update consumers that previously assumed text-only values. [cc90771](https://github.com/morluto/rea/commit/cc90771af14f045538651615147d8bf86b576549), [#6759](https://github.com/morluto/rea/pull/6759), [#6467](https://github.com/morluto/rea/issues/6467). Thanks @coygeek, @gensokyo-dev, @mvanhorn.
+- **JSON Lines:** `--format jsonl` now emits object-collection rows followed by a `$rea: "jsonl/v1"`, `type: "metadata"` record; scalar selections and unsupported reports are refused. Parse control records separately, select a single supported collection when necessary, and use `--format json` for the previous whole-document output. See [JSON Lines framing](https://github.com/morluto/rea/blob/rea-agents-6.8.0/docs/cli.md#json-lines-record-output). [#5629](https://github.com/morluto/rea/pull/5629), [#5487](https://github.com/morluto/rea/issues/5487). Thanks @gensokyo-dev, @jayykernel, @vijaykiran06.
+- **Interface Builder:** Keyed-archive graph identities use decimal table UIDs instead of authored `objectID`/`object-id`. Treat authored IDs as attributes and update persisted graph lookups; ibtool and native NIBArchive identities keep their source semantics. [6fbe67d](https://github.com/morluto/rea/commit/6fbe67d66e3d716db69929503a3a232a7ada0860).
+- **Frida:** `instrument-with-frida` JSON returns the canonical Evidence directly. Read `normalized_result.cleanup_error` instead of the former top-level wrapper field. [48f700e](https://github.com/morluto/rea/commit/48f700ee35e0988ed973e5486dc9db33f2a5d944).
+- **Reconstruction proof:** ID-array proof records no longer establish verified or ready ledgers. Supply implementation/revision bindings and individual claim outcomes; handle inapplicable, unavailable, and failed proof diagnostics. [f8b65e7](https://github.com/morluto/rea/commit/f8b65e78723b1e2169f94dd1226198ea3139707e).
+- **Mach-O imports:** Handle a null import `name` when identity is ambiguous; use `raw_name` and `name_status` to distinguish observed expressions from exact symbols. [5d0d243](https://github.com/morluto/rea/commit/5d0d243a45c9132e1aff75d454ab53d86a74cc31), [169512a](https://github.com/morluto/rea/commit/169512a35bb015ff209168fb8bc1c9b31a2c678b).
+- **Node.js:** Use a runtime satisfying `^22.23.4 || ^24.22.1 || >=26.12.1`; Node 23 and 25 are unsupported. Upgrade Node before installing or updating REA; the installer does not upgrade it. [#6315](https://github.com/morluto/rea/pull/6315), [#6283](https://github.com/morluto/rea/issues/6283). Thanks @GamerDubz, @gensokyo-dev, @ShikamaruNaaraa.
+- **Browser storage:** Historical hashed storage remains readable, but comparisons stay unknown until both captures are recaptured in the new representation. [#6341](https://github.com/morluto/rea/pull/6341), [#6289](https://github.com/morluto/rea/issues/6289). Thanks @coygeek, @gongfpp.
+- **Environment serving:** `environment-serve` serves derived state by default, including write tools whose effects are confirmed by recorded evidence. Use `--replay-only` for stateless replay of manifest tools. Read stop-summary `state` instead of `state_evidence_id`. [#5351](https://github.com/morluto/rea/pull/5351), [#6158](https://github.com/morluto/rea/pull/6158). Thanks @earakely-scale, @gensokyo-dev, @kaoru0822-kitauji.
+- **MCP schemas:** Input advertisements default to compact. Set `REA_MCP_INPUT_SCHEMA_PROFILE=full` for complete advertised guidance and nested constraints. [#5975](https://github.com/morluto/rea/pull/5975). Thanks @gensokyo-dev.
+- **Browser console arguments:** Accept null `argument_types` and `text_capture.status: "unavailable"` when the protocol argument inventory is omitted or malformed; preserve that uncertainty. [#6016](https://github.com/morluto/rea/pull/6016), [#5934](https://github.com/morluto/rea/issues/5934). Thanks @coygeek, @kaoru0822-kitauji.
+- **Reconstruction summaries:** `summary.by_evidence_authority` is keyed by Evidence authority; read the former source-state counts from required `summary.by_source_state`. Regenerate ledgers whose closure digests depended on the old projection. [#5875](https://github.com/morluto/rea/pull/5875), [#5838](https://github.com/morluto/rea/issues/5838). Thanks @coygeek, @kaoru0822-kitauji.
+- **Swift bindings:** Conformance `type_name` and `protocol_name` may be null; consume typed `type_binding`/`protocol_binding` evidence. Replace the former Objective-C-specific import-binding type/schema with `MachoImportBinding`. [d0067ba](https://github.com/morluto/rea/commit/d0067ba34a39ea47dd7e11bb2e6169bc0938cc3f).
+- **WebSocket frames:** Accept null opcodes and preserve unknown frame facts; numeric opcodes are restricted to the four-bit protocol range. [0bc2b42](https://github.com/morluto/rea/commit/0bc2b42001f684beffcf47b70e507443b1a5d320).
+- **Resource-only inspection:** Evidence subjects and executable digests may be null. Use `resource_root` and each resource's reported provenance instead of requiring an executable target. [6a6adf7](https://github.com/morluto/rea/commit/6a6adf703fa44100643947d20fbc670f86260b1b).
+- **Browser timestamps:** Console and session-timeline timestamps may be null when the protocol supplies no finite/comparable time. Keep unknown time explicit in sorting and comparisons. [690fc51](https://github.com/morluto/rea/commit/690fc518540bae982038a74f47ef7781201785aa), [2a0410f](https://github.com/morluto/rea/commit/2a0410f1717b3126e8a95063d77dea66a597010a).
+- **Reference sources:** Read failed root enumeration from `rootFailure` rather than a synthetic failed child at `"."`; preserve the top-level source-graph limitation. [6296fdf](https://github.com/morluto/rea/commit/6296fdf560f1ac4aa55985558edaa98300aacdbc).
+- **Filesystem capture:** Accept `entry_unavailable` and `identity_changed` enumeration omission reasons in addition to the previous reason literals. [c85b44e](https://github.com/morluto/rea/commit/c85b44e1b14851c54e65327a4807f79ad5cd5a61). Thanks @rudrakshagarwal4200-ai.
+- **APK locales:** Replace numeric legacy selectors such as `es-r419` with `es-419` or `b+es+419`. Two-letter regions remain supported. [29910d1](https://github.com/morluto/rea/commit/29910d16b98fe4b607a7aa15928789a73614b0b9). Thanks @mertkayacs.
+- **XML plist scalars:** Recognize `$plist_type: "unknown"` and read `element`, `literal`, and `reason`; unresolved XML scalars use this wrapper instead of the former real/null unknown marker or malformed scalar prefixes. Supported extended UTC years preserve their timestamp. [3537e58](https://github.com/morluto/rea/commit/3537e58c1ab29309f06eabf50bc52adba9817a0c).
+
+### Changes
+
+- **Binary layouts:** Inspect ELF32 i386, little-endian ARM, and little- or big-endian MIPS `EXEC`/`DYN`/`REL` layouts on Linux x64 using a caller-supplied pwntools environment. [#7052](https://github.com/morluto/rea/pull/7052), [#6934](https://github.com/morluto/rea/issues/6934). Thanks @roblennon, @salmanalmutairi1.
+- **Agent environments:** Project network captures and Evidence files into manifests, preserve template path pairs and positions, export AgentEnv bundles, and serve manifests as replay environments. [#4954](https://github.com/morluto/rea/pull/4954), [#5293](https://github.com/morluto/rea/pull/5293), [#5664](https://github.com/morluto/rea/pull/5664), [#4999](https://github.com/morluto/rea/pull/4999), [#4975](https://github.com/morluto/rea/pull/4975). Thanks @earakely-scale, @gensokyo-dev, @kaoru0822-kitauji.
+- **Capture to environment:** Build environments from browser scenarios or a prompt, extract the initial observed state, and compare the environment with application probe captures. [#5182](https://github.com/morluto/rea/pull/5182), [#6946](https://github.com/morluto/rea/pull/6946), [#5319](https://github.com/morluto/rea/pull/5319), [#5699](https://github.com/morluto/rea/pull/5699). Thanks @earakely-scale, @gensokyo-dev, @kaoru0822-kitauji.
+- **State-backed tools:** Render read filters, search, sorting and paging from state; apply confirmed write effects with broader state targets and recording-based write admission. [#5352](https://github.com/morluto/rea/pull/5352), [293832b](https://github.com/morluto/rea/commit/293832bafc9a054914ec514fe906dd4936c7a372), [#5800](https://github.com/morluto/rea/pull/5800), [#5787](https://github.com/morluto/rea/pull/5787), [#5600](https://github.com/morluto/rea/pull/5600), [5375ff0](https://github.com/morluto/rea/commit/5375ff0f9aadb4fd0d46333815aa0431e3df1010), [#6169](https://github.com/morluto/rea/pull/6169), [#6385](https://github.com/morluto/rea/pull/6385), [#6897](https://github.com/morluto/rea/pull/6897). Thanks @earakely-scale, @gensokyo-dev, @kaoru0822-kitauji.
+- **State learning:** Model application-assigned values, preserve view-specific clock spellings, learn write clocks from scenario timing, derive fields, and learn creates across sorted arrays and referenced entities. [7ec9b6e](https://github.com/morluto/rea/commit/7ec9b6e56e1b3762285dca881db6d900a389ab9c), [#6136](https://github.com/morluto/rea/pull/6136), [957bcfa](https://github.com/morluto/rea/commit/957bcfa149c1a0593bb0aa2466cc56d1d4f62e7d), [#6138](https://github.com/morluto/rea/pull/6138), [#6967](https://github.com/morluto/rea/pull/6967), [#7025](https://github.com/morluto/rea/pull/7025), [#7034](https://github.com/morluto/rea/pull/7034). Thanks @earakely-scale.
+- **Recorded writes:** Serve creates whose compatible read-backs add omitted fields or express timestamps at a different precision, and whole-object updates that regenerate observed slugs or modification times. Conflicting observations still withhold writes. State views and bundles carrying the new read-back data need REA 6.8.0 or later to serve. [#7080](https://github.com/morluto/rea/pull/7080). Thanks @earakely-scale.
+- **Native investigations:** Page native inventory summaries, match functions across builds, export pseudocode to resumable directories, and select objdump disassembly by symbol. [#5378](https://github.com/morluto/rea/pull/5378), [#5390](https://github.com/morluto/rea/pull/5390), [#6170](https://github.com/morluto/rea/pull/6170), [#5171](https://github.com/morluto/rea/pull/5171), [#4249](https://github.com/morluto/rea/issues/4249), [#5343](https://github.com/morluto/rea/issues/5343), [#5159](https://github.com/morluto/rea/issues/5159). Thanks @coygeek, @CryptoJones, @gensokyo-dev, @kaoru0822-kitauji.
+- **Engine workflows:** Bound a single Ghidra decompilation without closing its session, analyze GameCube/Wii DOL executables, and inspect static CUDA/HIP code objects. [#5662](https://github.com/morluto/rea/pull/5662), [#6240](https://github.com/morluto/rea/pull/6240), [#5813](https://github.com/morluto/rea/pull/5813), [#5340](https://github.com/morluto/rea/issues/5340), [#5345](https://github.com/morluto/rea/issues/5345). Thanks @arielfikru, @coygeek, @gensokyo-dev, @RishTheFish21.
+- **PE/ELF:** Inspect export tables without an engine, PE imports/delay-loads, Authenticode certificates, TLS callbacks/load configuration, ELF notes, Linux kernel module metadata, and Zstandard section-name tables. [#6278](https://github.com/morluto/rea/pull/6278), [#6509](https://github.com/morluto/rea/pull/6509), [#4830](https://github.com/morluto/rea/pull/4830), [#7008](https://github.com/morluto/rea/pull/7008), [#4837](https://github.com/morluto/rea/pull/4837), [#7010](https://github.com/morluto/rea/pull/7010), [#6987](https://github.com/morluto/rea/pull/6987), [#4057](https://github.com/morluto/rea/issues/4057). Thanks @gensokyo-dev, @kaoru0822-kitauji, @mvanhorn, @Rinkia, @ShuaixinHuang.
+- **Apple/native metadata:** Inspect IPS crash reports, decode Swift nominal declarations, and select universal Mach-O slices in Go/Rust metadata readers. [#6511](https://github.com/morluto/rea/pull/6511), [#6257](https://github.com/morluto/rea/pull/6257), [#6219](https://github.com/morluto/rea/pull/6219), [#5341](https://github.com/morluto/rea/issues/5341), [#4102](https://github.com/morluto/rea/issues/4102). Thanks @coygeek, @gensokyo-dev, @kaoru0822-kitauji, @mvanhorn, @Rinkia.
+- **Packaged applications:** Triage desktop installation directories and inspect/extract Godot PCK, PyInstaller archives, and Node.js single-executable application blobs. [#5207](https://github.com/morluto/rea/pull/5207), [#3634](https://github.com/morluto/rea/pull/3634), [afa5da7](https://github.com/morluto/rea/commit/afa5da745e0b139e68029a96b776ae30e48ea2b2), [#2433](https://github.com/morluto/rea/pull/2433), [#7000](https://github.com/morluto/rea/pull/7000), [#4399](https://github.com/morluto/rea/issues/4399). Thanks @0xthearchitect, @coygeek, @gensokyo-dev, @mvanhorn.
+- **Unity and managed code:** Inventory IL2CPP images/types/methods and metadata versions 24/27; read member names and literals, link native methods and generic instances, and export Ghidra seeds. Project managed call/field-access edges and page managed member summaries. [#3807](https://github.com/morluto/rea/pull/3807), [#5326](https://github.com/morluto/rea/pull/5326), [52d1a72](https://github.com/morluto/rea/commit/52d1a72af047a73b787b8935b032786a34966036), [#5327](https://github.com/morluto/rea/pull/5327), [#5785](https://github.com/morluto/rea/pull/5785), [#6260](https://github.com/morluto/rea/pull/6260), [#5167](https://github.com/morluto/rea/pull/5167), [#3784](https://github.com/morluto/rea/issues/3784), [#5112](https://github.com/morluto/rea/issues/5112), [#4056](https://github.com/morluto/rea/issues/4056), [#5148](https://github.com/morluto/rea/issues/5148). Thanks @8rulerstar, @alexlanghart, @elricfd, @gensokyo-dev, @jaelliot, @kaoru0822-kitauji, @Rinkia.
+- **Android:** Inspect APK signing declarations and structured manifest components; report static-final DEX field values. [e93e3b1](https://github.com/morluto/rea/commit/e93e3b1e7d6e7e4f49c2de24b92452ec29e853f8), [#4158](https://github.com/morluto/rea/pull/4158), [#5025](https://github.com/morluto/rea/pull/5025), [#6981](https://github.com/morluto/rea/pull/6981), [#4537](https://github.com/morluto/rea/issues/4537), [#6397](https://github.com/morluto/rea/issues/6397). Thanks @Abelo9996, @BaaRai, @FerroLx, @gensokyo-dev, @sserrgo12.
+- **Bytecode and firmware:** Inspect and query CPython pyc and BEAM facts, inspect flattened devicetrees, and attribute MMIO peripheral regions in native disassembly. [#4826](https://github.com/morluto/rea/pull/4826), [#6928](https://github.com/morluto/rea/pull/6928), [#4833](https://github.com/morluto/rea/pull/4833), [#6943](https://github.com/morluto/rea/pull/6943), [#7009](https://github.com/morluto/rea/pull/7009), [#5348](https://github.com/morluto/rea/pull/5348), [#6922](https://github.com/morluto/rea/issues/6922), [#6938](https://github.com/morluto/rea/issues/6938). Thanks @gensokyo-dev, @liziye627-design, @mvanhorn.
+- **JavaScript:** Retain queryable static route inventories, link assignment values to writes, and accept source selections as a JSON array or file. [#6019](https://github.com/morluto/rea/pull/6019), [#6206](https://github.com/morluto/rea/pull/6206), [#5029](https://github.com/morluto/rea/pull/5029), [#4772](https://github.com/morluto/rea/issues/4772), [#6193](https://github.com/morluto/rea/issues/6193). Thanks @gensokyo-dev, @IvenKooLab, @jacobmalibiran, @JoshOsullivan-au, @kaoru0822-kitauji, @KJLavender.
+- **Data inspection:** Decode selected protobuf/gRPC bodies, inspect GGUF/safetensors declarations, and produce byte-entropy profiles. [#5031](https://github.com/morluto/rea/pull/5031), [#5603](https://github.com/morluto/rea/pull/5603), [#2331](https://github.com/morluto/rea/pull/2331), [#4986](https://github.com/morluto/rea/issues/4986), [#3323](https://github.com/morluto/rea/issues/3323). Thanks @AayushJB03, @gensokyo-dev, @kaoru0822-kitauji, @KJLavender, @michaelkillgta, @mvanhorn.
+- **CLI input/output:** Accept structured request documents on stdin and expose version/runtime output formats. Row-oriented JSONL exports use the migration above. [#7040](https://github.com/morluto/rea/pull/7040), [#5486](https://github.com/morluto/rea/issues/5486), [#6530](https://github.com/morluto/rea/pull/6530), [169512a](https://github.com/morluto/rea/commit/169512a35bb015ff209168fb8bc1c9b31a2c678b), [#5483](https://github.com/morluto/rea/issues/5483). Thanks @Abelo9996, @ahmed-husssain, @CassieFox23, @DeryFerd, @eco-null, @ezrabrilliant, @GamerDubz, @gensokyo-dev, @gongfpp, @hifzabuildsai, @jayykernel, @mhamzasakhi, @pablodiazjorge, @Plastic-time, @raidnouredden-ux, @SandstromPL, @ShuaixinHuang, @Sriram-PR, @XiaoBinGan.
+- **MCP and setup:** Add opt-in Streamable HTTP and FreeBuff setup registration. FreeBuff support first appears in 6.8.0; installed native FreeBuff loading and skill discovery remain unverified. [#4955](https://github.com/morluto/rea/pull/4955), [#2736](https://github.com/morluto/rea/pull/2736), [#3243](https://github.com/morluto/rea/issues/3243). Thanks @0xLLVEL, @codebuff-team, @earakely-scale, @gensokyo-dev, @kaoru0822-kitauji.
+- **Recovery controls:** Adjust per-call WASM/SQLite/firmware deadlines, MCP startup budgets, regex matching deadlines/worker heap, capture decoder heap, ASAR header admission, Apple dispatch input, and the bridge request ceiling. MCP runtime limit recovery reports actionable settings. [#5798](https://github.com/morluto/rea/pull/5798), [#5818](https://github.com/morluto/rea/pull/5818), [aa53c06](https://github.com/morluto/rea/commit/aa53c065387c58b4189d82c47f1f3445fc505e30), [#5863](https://github.com/morluto/rea/pull/5863), [#6304](https://github.com/morluto/rea/pull/6304), [#6267](https://github.com/morluto/rea/pull/6267), [#6301](https://github.com/morluto/rea/pull/6301), [#6299](https://github.com/morluto/rea/pull/6299), [#6209](https://github.com/morluto/rea/pull/6209), [#6233](https://github.com/morluto/rea/pull/6233), [#6376](https://github.com/morluto/rea/pull/6376), [#7049](https://github.com/morluto/rea/pull/7049), [#5797](https://github.com/morluto/rea/issues/5797), [#5812](https://github.com/morluto/rea/issues/5812), [#5851](https://github.com/morluto/rea/issues/5851), [#6176](https://github.com/morluto/rea/issues/6176), [#3917](https://github.com/morluto/rea/issues/3917). Thanks @gensokyo-dev, @jaychou813, @kaoru0822-kitauji.
+- **APK output:** Set `string_tables_only` or CLI `--string-tables-only` to omit duplicate primary strings and avoid their output-capacity charge. [7c458f0](https://github.com/morluto/rea/commit/7c458f04b9155707c8ba406f8b455b10016f1b99), [#4990](https://github.com/morluto/rea/pull/4990), [#4982](https://github.com/morluto/rea/issues/4982). Thanks @gensokyo-dev, @kaoru0822-kitauji, @N0zoM1z0.
+- **Retained analysis:** Reuse successful validation of authenticated immutable native/imported-JavaScript parents and captures. Query retained Go build identity, Rust dependencies, JavaScript source-to-bundle mappings, and native export facts without repeating full output. [8f7d12e](https://github.com/morluto/rea/commit/8f7d12e30d63f3d3b4cfe2a90336362841438f56), [#4962](https://github.com/morluto/rea/pull/4962), [#5349](https://github.com/morluto/rea/pull/5349), [#5524](https://github.com/morluto/rea/pull/5524), [#5815](https://github.com/morluto/rea/pull/5815), [#6128](https://github.com/morluto/rea/pull/6128), [#6907](https://github.com/morluto/rea/pull/6907), [#4810](https://github.com/morluto/rea/issues/4810), [#5499](https://github.com/morluto/rea/issues/5499), [#5802](https://github.com/morluto/rea/issues/5802), [#6112](https://github.com/morluto/rea/issues/6112), [#6900](https://github.com/morluto/rea/issues/6900). Thanks @gensokyo-dev, @kaoru0822-kitauji, @N0zoM1z0.
+- **Compact results:** Use retained Frida/GDB/objdump summaries, omit redundant Ghidra raw results, and defer the analysis runtime during MCP catalog discovery. [#5661](https://github.com/morluto/rea/pull/5661), [#5614](https://github.com/morluto/rea/pull/5614), [#5355](https://github.com/morluto/rea/pull/5355), [#4424](https://github.com/morluto/rea/pull/4424), [#5640](https://github.com/morluto/rea/issues/5640), [#5584](https://github.com/morluto/rea/issues/5584), [#5337](https://github.com/morluto/rea/issues/5337). Thanks @coygeek, @gensokyo-dev, @kaoru0822-kitauji, @leeguooooo.
+- **Analysis work:** Reuse Hopper literal-string records, JavaScript workers and captured prefix selections, Interface Builder validation and plist scalar schemas; bound stable reads to one snapshot buffer and avoid decoding omitted GGUF strings. [#5017](https://github.com/morluto/rea/pull/5017), [#5819](https://github.com/morluto/rea/pull/5819), [31de177](https://github.com/morluto/rea/commit/31de177404461d122761d8243abe4fd24564f4da), [#5885](https://github.com/morluto/rea/pull/5885), [85e38ac](https://github.com/morluto/rea/commit/85e38ac199dff15e8c43343d9170db7e0e46d284), [#6966](https://github.com/morluto/rea/pull/6966), [#5781](https://github.com/morluto/rea/pull/5781), [#5010](https://github.com/morluto/rea/issues/5010), [#5855](https://github.com/morluto/rea/issues/5855), [#6954](https://github.com/morluto/rea/issues/6954), [#5774](https://github.com/morluto/rea/issues/5774). Thanks @gensokyo-dev, @kaoru0822-kitauji.
+- **Native scheduling:** Batch modern IDA callee lookups, schedule decompilation reads on demand, index NativeAOT type closure, and retain call-path ancestry once per visited node. [0c6fed9](https://github.com/morluto/rea/commit/0c6fed90b74c75a9fd23d1ec1b510a7274f85887), [06fe7ee](https://github.com/morluto/rea/commit/06fe7eecbc8c387414b4c1aa0d88ad6314f54f0c), [ce61680](https://github.com/morluto/rea/commit/ce61680c04c95a9cdfad5335632a99542af26d37), [5e4ec0f](https://github.com/morluto/rea/commit/5e4ec0fa1b678aa3bf20704ec9110224ba8c1676).
+- **Selected processing:** Prepare CLI positional schemas only for the selected command, separate entropy reads from report resolution, prune typed-array reference escapes, index state-write cutoffs, decode only selected replay query values, and skip payload text during WAT framing. [315b234](https://github.com/morluto/rea/commit/315b23403f0819967878cee418c3f9cb4b1a69d9), [#6950](https://github.com/morluto/rea/pull/6950), [#5139](https://github.com/morluto/rea/pull/5139), [#5350](https://github.com/morluto/rea/pull/5350), [96ea32b](https://github.com/morluto/rea/commit/96ea32b7e4e28d3c9cd79a1de4b8e1ba3b4244e9), [70835d3](https://github.com/morluto/rea/commit/70835d3d5f030deadf606e1c79c70a60883e50c9), [#5766](https://github.com/morluto/rea/pull/5766), [#6947](https://github.com/morluto/rea/issues/6947), [#5760](https://github.com/morluto/rea/issues/5760). Thanks @galleonli, @gensokyo-dev, @kaoru0822-kitauji.
+
+### Fixes
+
+- **IPS report fields:** Preserve the recorded terminating process and PID, termination flags, parent PID, and build/platform metadata. [#7079](https://github.com/morluto/rea/pull/7079), [#7078](https://github.com/morluto/rea/issues/7078). Thanks @rodricksz4h5.
+- **Ghidra language selection:** Accept stock language IDs containing `LEBE` or slash-separated processor names, and report conflicting DOL language overrides as configuration errors naming `REA_GHIDRA_LANGUAGE_ID`. [#7070](https://github.com/morluto/rea/pull/7070), [#7072](https://github.com/morluto/rea/issues/7072), [#7081](https://github.com/morluto/rea/pull/7081), [#7082](https://github.com/morluto/rea/issues/7082). Thanks @Adolanium.
+- **Setup and Hopper:** Preserve the Linux embedding runtime, supported x86_64 host restriction, readiness-based provider choices, orderly demo-helper shutdown, and installed apt dependency versions. Keep cleanup and skill publication ownership through retries. [#5041](https://github.com/morluto/rea/pull/5041), [#3422](https://github.com/morluto/rea/pull/3422), [f5d1012](https://github.com/morluto/rea/commit/f5d1012fabfe99af82523c3078ce9d93eb3780c1), [#4966](https://github.com/morluto/rea/pull/4966), [#6974](https://github.com/morluto/rea/pull/6974), [211e353](https://github.com/morluto/rea/commit/211e3533b34f81ae0910ad4f53f2a3d3c8587d3e), [#6920](https://github.com/morluto/rea/pull/6920), [#5015](https://github.com/morluto/rea/issues/5015), [#3419](https://github.com/morluto/rea/issues/3419), [#4921](https://github.com/morluto/rea/issues/4921), [#6975](https://github.com/morluto/rea/issues/6975). Thanks @Abel-I-Akhigbe, @Adolanium, @DavidFB-creator, @DeryFerd, @gensokyo-dev, @kaoru0822-kitauji, @sx4im.
+- **Client setup:** Treat empty APPDATA as unset, distinguish MSIX Claude Desktop process views, preserve aliased Hermes server tables, reuse client dialect/alias bindings, and materialize the pinned package-runner cache before the first start. [#5126](https://github.com/morluto/rea/pull/5126), [#4903](https://github.com/morluto/rea/pull/4903), [#3785](https://github.com/morluto/rea/pull/3785), [b7eeded](https://github.com/morluto/rea/commit/b7eededf5af5061a834f93f57f2c888acf870344), [#7032](https://github.com/morluto/rea/pull/7032), [#5104](https://github.com/morluto/rea/issues/5104), [#4278](https://github.com/morluto/rea/issues/4278), [#3320](https://github.com/morluto/rea/issues/3320), [#7027](https://github.com/morluto/rea/issues/7027). Thanks @CmsChase, @coygeek, @myso-kr, @pablodiazjorge, @vaidehi-snk, @wxj006007.
+- **Target admission:** Preserve thin arm64_32 Mach-O support, distinguish JVM identity before FAT admission, validate FAT format/CPU identity, preserve original DOS header padding, and reject NULs in local objdump/rizin paths. [#5788](https://github.com/morluto/rea/pull/5788), [6843dbe](https://github.com/morluto/rea/commit/6843dbea9bce4709ee2e8bf46c38f0bbf640716b), [497037e](https://github.com/morluto/rea/commit/497037e6e3975cbb37cfd89ea0ad300faa2a4769), [#7013](https://github.com/morluto/rea/pull/7013), [#3600](https://github.com/morluto/rea/pull/3600), [#5713](https://github.com/morluto/rea/issues/5713), [#6510](https://github.com/morluto/rea/issues/6510). Thanks @coygeek, @dhruvac29, @kaoru0822-kitauji, @Lew1sWong, @qorvr.
+- **Mach-O and dylibs:** Preserve container framing, facts when dyld rejects a missing UUID, verified-signature snapshot identity, unsigned diagnostics, absolute paths inside the selected root, legacy platform rules, lazy-load payloads, and reasons for rejecting present dylibs. [cf3288d](https://github.com/morluto/rea/commit/cf3288d8cf7a09685acf89103b36c32359be56fa), [2b263a7](https://github.com/morluto/rea/commit/2b263a7fe9e9d4c185c7d6af6b4e67b21a73af30), [eb7acc7](https://github.com/morluto/rea/commit/eb7acc70bf06f119e8639e30a78081d5ba82b0bf), [1502cfb](https://github.com/morluto/rea/commit/1502cfbc8ca0d1d1d86eebf334018dfb418bbac0), [90062c0](https://github.com/morluto/rea/commit/90062c092228dea9d33fadc0d7e1b968105b8b2c), [#5650](https://github.com/morluto/rea/pull/5650), [3b67b36](https://github.com/morluto/rea/commit/3b67b362aa2cd79eac5af57d0965e81a7d0b8c2b), [#5551](https://github.com/morluto/rea/issues/5551). Thanks @coygeek.
+- **Native facts:** Admit direct dispatch-metadata providers; preserve record-local Objective-C omissions, snapshot profiles, class-import binding identity, stripped class labels, version-like names, and qualified Swift protocol identities. [50b6975](https://github.com/morluto/rea/commit/50b6975d861069e2c6cfa202780621449f863802), [9eec57b](https://github.com/morluto/rea/commit/9eec57b469087fe9bff3d29dcc02f47074159e91), [0ba4d6f](https://github.com/morluto/rea/commit/0ba4d6f43ad610dacc861a1548be1a5c4712cd61), [4d7de00](https://github.com/morluto/rea/commit/4d7de00d4cc9a95ec2b7a3123b04e01db2daafa0), [22c84ce](https://github.com/morluto/rea/commit/22c84ce64aa6c7601aa81af86d4117b5a4c2feac), [4852c83](https://github.com/morluto/rea/commit/4852c830af1e3b9df437235b7a8fa8970a6d1c59), [aa9043f](https://github.com/morluto/rea/commit/aa9043f6b61c453e4735795cfe6a559bf6b6cc16).
+- **Apple resources:** Preserve independent plist scalars, processing instructions, nonstandard table widths, unsupported NIB connector coverage, and strict IPS JSON surrogate validation; classify Interface Builder objects by their declared superclass chains. [fd728f2](https://github.com/morluto/rea/commit/fd728f271e7de7bcfa63890b573715720d5f948c), [#5806](https://github.com/morluto/rea/pull/5806), [4526862](https://github.com/morluto/rea/commit/4526862728af01f1135714079c0d8a8c754eb364), [14cd78c](https://github.com/morluto/rea/commit/14cd78c3224edcf79fca152915077112f547b9ed), [#6990](https://github.com/morluto/rea/pull/6990), [#5805](https://github.com/morluto/rea/issues/5805), [#5228](https://github.com/morluto/rea/pull/5228), [#5218](https://github.com/morluto/rea/issues/5218). Thanks @coygeek, @DeryFerd, @kaoru0822-kitauji, @Mangolycheematcha, @mhamzasakhi, @Shreyash021104.
+- **Archives and files:** Complete positional ZIP reads, preserve bounded ASAR signatures, report stable symlink loops as resolution failures, retain target applicability, and report unknown traversal coverage. Retain reported integrity contradictions for members present in only one compared artifact. [#4414](https://github.com/morluto/rea/pull/4414), [e8da7e1](https://github.com/morluto/rea/commit/e8da7e1edd075feec0e6beedec93d5645fed8125), [#5571](https://github.com/morluto/rea/pull/5571), [#5763](https://github.com/morluto/rea/pull/5763), [#5867](https://github.com/morluto/rea/pull/5867), [#5521](https://github.com/morluto/rea/issues/5521), [#5731](https://github.com/morluto/rea/issues/5731), [#5837](https://github.com/morluto/rea/issues/5837), [#7076](https://github.com/morluto/rea/pull/7076). Thanks @Afloat16, @coygeek, @jdotc1, @kaoru0822-kitauji, @WenyuChiou.
+- **Extraction and file ownership:** Restrict destination-case recovery to owned collisions, retain physical-read failures through late cancellation/cleanup, preserve cleanup capabilities for retry, and retain independent firmware extraction failures. [932fbb7](https://github.com/morluto/rea/commit/932fbb7d84a9a995b9aee3c1be7da05a8c4d7bbb), [9499667](https://github.com/morluto/rea/commit/949966712e68d8857a50a165ecddf04c2d7e6d3b), [56679dd](https://github.com/morluto/rea/commit/56679dd2ae31dda58e181f8bf99775014f7bb82b), [b3c912a](https://github.com/morluto/rea/commit/b3c912ab79ad147a37b6cfbe1552a1a5eecec629), [7298bd0](https://github.com/morluto/rea/commit/7298bd08d134860b84b4073f6703021916a5a4c5).
+- **Processes and cancellation:** Retain partial samples and shutdown gaps, unresolved descendants and caller abort reasons; bind cleanup errors to their owners, propagate comparison contradictions, and report no normal exit code for signalled targets. [ba866a2](https://github.com/morluto/rea/commit/ba866a26ecbe179a717e746cbc0d1605ae616ad5), [#5270](https://github.com/morluto/rea/pull/5270), [#6144](https://github.com/morluto/rea/pull/6144), [a721c42](https://github.com/morluto/rea/commit/a721c42c07dc674c32ab939627355b8a1bee97a5), [#6298](https://github.com/morluto/rea/pull/6298), [#6486](https://github.com/morluto/rea/pull/6486), [#5935](https://github.com/morluto/rea/issues/5935), [#5944](https://github.com/morluto/rea/issues/5944), [#6100](https://github.com/morluto/rea/issues/6100), [#6101](https://github.com/morluto/rea/issues/6101), [#6110](https://github.com/morluto/rea/issues/6110), [#6113](https://github.com/morluto/rea/issues/6113), [#6121](https://github.com/morluto/rea/issues/6121), [#6131](https://github.com/morluto/rea/issues/6131), [#6132](https://github.com/morluto/rea/issues/6132), [#6218](https://github.com/morluto/rea/issues/6218), [#6445](https://github.com/morluto/rea/issues/6445). Thanks @agorevski, @coygeek, @gongfpp, @kwakhyun, @mhamzasakhi.
+- **Provider cleanup:** Preserve Windows native handles until close is confirmed, native/Inspector/Electron cleanup ownership, Kuna probe identity and cleanup, IDA registration configuration, and Hopper preparation ownership. [#5772](https://github.com/morluto/rea/pull/5772), [87ab054](https://github.com/morluto/rea/commit/87ab054ea384b3fcbae2998b1f94685edcd5f624), [ff78165](https://github.com/morluto/rea/commit/ff78165978de9dbcf9fa16c2acf74bf85a69dc44), [04ae07a](https://github.com/morluto/rea/commit/04ae07ab8c9ae1a6697b6ad15489bbde515da8b5), [dd0015a](https://github.com/morluto/rea/commit/dd0015aaf156c5701ef9598bcc6c885e6b8da803), [b231c28](https://github.com/morluto/rea/commit/b231c28cf64c2f799ada99343f8f21e0e6acb15e), [#4505](https://github.com/morluto/rea/issues/4505), [#5616](https://github.com/morluto/rea/issues/5616).
+- **Provider diagnostics:** Give Ghidra restart recovery, stable Homebrew aliases, unsupported-host results for Linux-only integrations, correct IDA regex/readiness handling, and clear diagnostics when Windows refuses a verified native addon. [#5356](https://github.com/morluto/rea/pull/5356), [7c6142e](https://github.com/morluto/rea/commit/7c6142efdc19a42c148d0e8c96b69d18e63c7f87), [#5793](https://github.com/morluto/rea/pull/5793), [#4862](https://github.com/morluto/rea/pull/4862), [99ccfb6](https://github.com/morluto/rea/commit/99ccfb6e709ac4bc0afe176315280abde9ebcb9f), [#6832](https://github.com/morluto/rea/pull/6832), [#5730](https://github.com/morluto/rea/issues/5730), [#4860](https://github.com/morluto/rea/issues/4860), [#5723](https://github.com/morluto/rea/issues/5723). Thanks @coygeek, @dark13b, @gensokyo-dev, @jgt87, @jpmorris41488, @Lew1sWong.
+- **MCP results:** Preserve protocol envelopes on oversized errors, enforce and advertise absolute Evidence paths, retain typed output-filter errors and selected JSON paths, and give client/provider timeout recovery. Compact advertisements now normalize reported enum and union shapes for strict gateway translation. [562dab0](https://github.com/morluto/rea/commit/562dab00c5cbf76a9b2695bad93792eccdc9a49d), [3cf6206](https://github.com/morluto/rea/commit/3cf6206614e65b5ebb6284a5709090dfb8f9aaee), [0e83d92](https://github.com/morluto/rea/commit/0e83d92c583ae36afe00b2c23dd2a0f1d025cbca), [4714c7e](https://github.com/morluto/rea/commit/4714c7eaa3d1d8b6a5df0aff586e844b9d9ab06d), [1bfa60a](https://github.com/morluto/rea/commit/1bfa60ac20e1a344bcf3132c08d15b6860b05c61), [#5608](https://github.com/morluto/rea/pull/5608), [#3806](https://github.com/morluto/rea/pull/3806), [#5598](https://github.com/morluto/rea/issues/5598), [#3800](https://github.com/morluto/rea/issues/3800). Thanks @gensokyo-dev, @Hahaa909, @wang1xiang.
+- **Browser lifecycles:** Retain historical outcomes through cleanup, stop late navigation before session release, stop expired work, observe aborted fetch settlement, and mark later scenario actions skipped after failure or cancellation. [2e5171e](https://github.com/morluto/rea/commit/2e5171e391b83f8a467d0861fd452c1f78621fd8), [599fdac](https://github.com/morluto/rea/commit/599fdac029912f96c511f859660483405d2de26f), [b2fad36](https://github.com/morluto/rea/commit/b2fad362f2b37f81dc9a6f784f4521e4ca24d41e), [13a8640](https://github.com/morluto/rea/commit/13a864020414577006dce58d7fdaa877ddd0cb52), [#6023](https://github.com/morluto/rea/pull/6023), [#5943](https://github.com/morluto/rea/issues/5943). Thanks @coygeek, @kaoru0822-kitauji.
+- **Browser comparisons:** Preserve frame identity, default origin scope, unknown body/shape coverage, correspondence and uncertainty, and independent retained-observation budgets. [#4040](https://github.com/morluto/rea/pull/4040), [#4413](https://github.com/morluto/rea/pull/4413), [#4476](https://github.com/morluto/rea/pull/4476), [a0c22ff](https://github.com/morluto/rea/commit/a0c22ff0125b8af7612db54d3708413e2bfecb25), [a0fcc60](https://github.com/morluto/rea/commit/a0fcc60d89eb0cc09b08181eb9f961acfd07d8e9), [#3878](https://github.com/morluto/rea/issues/3878), [#3910](https://github.com/morluto/rea/issues/3910), [#3941](https://github.com/morluto/rea/issues/3941), [#4385](https://github.com/morluto/rea/issues/4385), [#4477](https://github.com/morluto/rea/issues/4477). Thanks @Adolanium, @coygeek, @eco-null, @gensokyo-dev, @kaoru0822-kitauji, @XY-code1.
+- **Electron observations:** Preserve listener callback ownership and count registrations by source callsite; block trash calls in the active hook, retain window handles through cancelled selection, and preserve cancellation during finalization. [dfe8378](https://github.com/morluto/rea/commit/dfe8378cf5a727e3d93d47a5986233175c6ef898), [5064007](https://github.com/morluto/rea/commit/506400748eb1d6c674f0cf51330073929c45f939), [816a9dc](https://github.com/morluto/rea/commit/816a9dc98886e6d824cd8ae88b68731b161d5dda), [1707d17](https://github.com/morluto/rea/commit/1707d171d750955bf6387e028e378183b360ffe3), [4e2a566](https://github.com/morluto/rea/commit/4e2a566d6c7e053ecbbee1b684311ed31ea163bf).
+- **JavaScript source maps:** Keep unmapped and missing mappings unknown, preserve partial indexed-map facts and section paths, propagate preparation capability errors, and retain observed worker failures through cancellation. [a4dbb36](https://github.com/morluto/rea/commit/a4dbb36d8ea83e9f94dd289ac1a2d220d2c72c9b), [2b2e362](https://github.com/morluto/rea/commit/2b2e362a00fc5ba2f93fa6c62e2d8780072d1b4b), [498a667](https://github.com/morluto/rea/commit/498a667234b0140c1cfa43c819b35454ab11d14e), [#6149](https://github.com/morluto/rea/pull/6149), [#6214](https://github.com/morluto/rea/pull/6214), [f01dcca](https://github.com/morluto/rea/commit/f01dccab77f712fb4ac936d0a6e92a70d12f0789), [#6082](https://github.com/morluto/rea/issues/6082), [#6061](https://github.com/morluto/rea/issues/6061). Thanks @coygeek, @diyasharma05, @kaoru0822-kitauji.
+- **JavaScript semantics:** Preserve overflowing timer uncertainty, unavailable-scope comparisons, directory-form URL/ESM path intent, and artifact confinement. Replaced globals lose built-in effects; erased imports no longer become runtime bindings. Treat a known truthy `fork()` `silent` option as piped stdio unless a string/array `stdio` override takes precedence; unresolved options stay dynamic. [#3456](https://github.com/morluto/rea/pull/3456), [8d198d6](https://github.com/morluto/rea/commit/8d198d6ec707402d75276f516e0090d71767b7e4), [#4646](https://github.com/morluto/rea/pull/4646), [#2700](https://github.com/morluto/rea/pull/2700), [#4565](https://github.com/morluto/rea/pull/4565), [#6994](https://github.com/morluto/rea/pull/6994), [#3400](https://github.com/morluto/rea/issues/3400), [#3882](https://github.com/morluto/rea/issues/3882), [#3367](https://github.com/morluto/rea/issues/3367), [#7083](https://github.com/morluto/rea/pull/7083), [#7084](https://github.com/morluto/rea/issues/7084). Thanks @Adolanium, @amyanger, @coygeek, @gensokyo-dev, @HawkForge, @rohitg00, @viniciusdsandrade.
+- **JavaScript routes and imports:** Treat path data as route candidates, preserve route flag and lexical RPC identities, package-main trailing-slash selection, catch aliases, and factory parameter ownership. [#6360](https://github.com/morluto/rea/pull/6360), [38ecc02](https://github.com/morluto/rea/commit/38ecc0248e1993d25a2f7dd350024484cce797bb), [#4219](https://github.com/morluto/rea/pull/4219), [21097b1](https://github.com/morluto/rea/commit/21097b192b1ab94647e3446b1a2a4dd00e924d5e), [f774dc4](https://github.com/morluto/rea/commit/f774dc420b3befe2b8e68971b4116da2d62fc800), [#6349](https://github.com/morluto/rea/issues/6349), [#4189](https://github.com/morluto/rea/issues/4189). Thanks @coygeek, @hemv-857, @kaoru0822-kitauji, @Nikhi00718.
+- **Managed/IL2CPP:** Preserve extension-only scope uncertainty and type discovery after member limits, nested names, ReadyToRun/declaration facts, selected type scope, valid shared-suffix strings, and truncated IL2CPP metadata prefixes. [#5674](https://github.com/morluto/rea/pull/5674), [#5312](https://github.com/morluto/rea/pull/5312), [87fa1b6](https://github.com/morluto/rea/commit/87fa1b613d2b6bda1722855a00f1390f27731b64), [bc2d494](https://github.com/morluto/rea/commit/bc2d494030efd1ccabaeaa0bd49226aa87c378a2), [1f0eb22](https://github.com/morluto/rea/commit/1f0eb228e50908ee2a2aaa72d329178ae1a2cdbd), [4c5fae5](https://github.com/morluto/rea/commit/4c5fae5179dd54c4a0d427cd2a115b9c887e3841), [b3aadaf](https://github.com/morluto/rea/commit/b3aadaf474e59b33e5ff465236008a67eccefb87), [#5467](https://github.com/morluto/rea/issues/5467), [#5146](https://github.com/morluto/rea/issues/5146). Thanks @coygeek, @eco-null, @elricfd, @umi008.
+- **Format boundaries:** Preserve independent facts across malformed inputs in model, GPU, WASM, Rust, Android, and SQLite inspection; report optional metadata warnings without discarding core results. [eb41f35](https://github.com/morluto/rea/commit/eb41f358cf83d5626f09de68332f9718f9aa6482), [#5789](https://github.com/morluto/rea/pull/5789), [00a9e95](https://github.com/morluto/rea/commit/00a9e95de91a4bd4d2a41f8aee704a53fa575750), [fc63fe8](https://github.com/morluto/rea/commit/fc63fe8682654086261540dcf3c59afc36c7d58f), [39a91d4](https://github.com/morluto/rea/commit/39a91d4db96ca13224c25936330ea84fe78970e5), [6c6e2ad](https://github.com/morluto/rea/commit/6c6e2ad62b20f810b54f5a567e66fc55241514b2), [929a0a7](https://github.com/morluto/rea/commit/929a0a76c870d9991e015dde58308fd9df0280b8), [d137a4c](https://github.com/morluto/rea/commit/d137a4cdde0049de967f1d5cd429ed9e1f7d0a10), [ef475fc](https://github.com/morluto/rea/commit/ef475fcf8b0601c61052b7091568ba574546417d), [#5749](https://github.com/morluto/rea/issues/5749). Thanks @coygeek, @gensokyo-dev.
+- **Capture decoding:** Preserve malformed protobuf trailer facts and wire/schema identity, HTTP/2 URI and UTF-8 failure facts, WebMCP property coverage, and offline capture availability without a browser provider. Report invalid record ordinals as selection errors with actual bounds where available, and trim surrounding SP/HTAB from gRPC-web trailer values while preserving internal whitespace. [9cf7a7c](https://github.com/morluto/rea/commit/9cf7a7cb0d3c72a1121fde280cb11bf911af8055), [b3c3b21](https://github.com/morluto/rea/commit/b3c3b21e43cab4e71b460d08829d8c6e4e9b9c21), [4cb1f1d](https://github.com/morluto/rea/commit/4cb1f1d820df4498ee464bcf72a5f47d40cf8dab), [51e5938](https://github.com/morluto/rea/commit/51e593877642ab42fb5bf25812f4a4110ee7ac26), [d23be5c](https://github.com/morluto/rea/commit/d23be5c0898c39c9f0c54e2e0b43ee746d92d316), [#6725](https://github.com/morluto/rea/pull/6725), [#3947](https://github.com/morluto/rea/issues/3947), [#7067](https://github.com/morluto/rea/pull/7067), [#7068](https://github.com/morluto/rea/issues/7068), [#7069](https://github.com/morluto/rea/pull/7069), [#7071](https://github.com/morluto/rea/issues/7071). Thanks @Adolanium, @coygeek, @Sriram-PR.
+- **Evidence and errors:** Authenticate ledger Evidence before committing; preserve parent-schema diagnostics, canonical correction details and owned cleanup outcomes; identify the rejected function-Evidence side/kind. Fixed allowances now name their actual limits. [0407bbf](https://github.com/morluto/rea/commit/0407bbfbe65e8fa475e8bb0c78c30170e2c2f55e), [#6361](https://github.com/morluto/rea/pull/6361), [1629266](https://github.com/morluto/rea/commit/1629266e3c08c90fed6bba5383528af7986a12b7), [#6969](https://github.com/morluto/rea/pull/6969), [#5860](https://github.com/morluto/rea/pull/5860), [#6034](https://github.com/morluto/rea/issues/6034), [#5932](https://github.com/morluto/rea/issues/5932), [#5847](https://github.com/morluto/rea/issues/5847). Thanks @AyoubElleuch, @coygeek, @dhruvac29, @kaoru0822-kitauji.
+- **ADB and firmware recovery:** Report an unparsed push checksum as unverified, normalize absent installer-package sentinels, describe extraction-relative Unblob links, and avoid recommending a budget increase at its fixed ceiling. [#6010](https://github.com/morluto/rea/pull/6010), [#4073](https://github.com/morluto/rea/pull/4073), [#4573](https://github.com/morluto/rea/pull/4573), [#6971](https://github.com/morluto/rea/pull/6971), [#5924](https://github.com/morluto/rea/issues/5924), [#4175](https://github.com/morluto/rea/issues/4175). Thanks @coygeek, @Ganesh2325, @kaoru0822-kitauji, @Rinkia, @XiaoBinGan, @yankikucuk.
+- **CLI formatting:** Share Markdown report formatting, exclude inherited row values, and preserve arrays of empty objects as JSON. Render Markdown table headers and cells literally while keeping intraword underscores readable. [b784912](https://github.com/morluto/rea/commit/b784912811fd10ac9dc425696dc0e9af632afa34), [#6984](https://github.com/morluto/rea/pull/6984), [#7058](https://github.com/morluto/rea/pull/7058), [#7057](https://github.com/morluto/rea/issues/7057), [#7073](https://github.com/morluto/rea/pull/7073). Thanks @Plastic-time, @ShuaixinHuang, @viniciusdsandrade.
+- **Format identity:** Preserve Python marshal scalar/decode limits, empty optional BEAM chunks, PE resource branch identities and certificate alignment, unsupported compressed ELF notes, and codec-framed GPU bundle extents. [0603223](https://github.com/morluto/rea/commit/06032237c6755e3dd5f9a8db732c89958b238cc7), [c46064c](https://github.com/morluto/rea/commit/c46064c3f6eaba121c5de7b17390bfdecdd132ef), [66671e8](https://github.com/morluto/rea/commit/66671e874888e98f7e2b27e68a7c6fb320bbb827), [03077d5](https://github.com/morluto/rea/commit/03077d54afc49613db4e38f70c506bc60f5223aa), [#6721](https://github.com/morluto/rea/pull/6721), [9fb8c11](https://github.com/morluto/rea/commit/9fb8c114a03ad60e57c11586967c6df845a3f97e), [f6a1e2c](https://github.com/morluto/rea/commit/f6a1e2c892dc23c7583c3d03af9edb01632ff5a5), [#6694](https://github.com/morluto/rea/issues/6694). Thanks @coygeek, @Deepak-Kambala.
+- **WASM and APK metadata:** Preserve ambiguous WASM identity and partial facts, glue URL query/fragment text across line terminators, APK signer identity, and raw issuer identity when comparison rules are unknown. [af8f0ba](https://github.com/morluto/rea/commit/af8f0badf64fd3546392b6aa4625777904b2f051), [#6802](https://github.com/morluto/rea/pull/6802), [f783f0f](https://github.com/morluto/rea/commit/f783f0f1e82472cdddd4de2156d974f729e332a6), [115a78f](https://github.com/morluto/rea/commit/115a78fe241276c34917b496621954c5f29bfc15), [#6639](https://github.com/morluto/rea/issues/6639). Thanks @coygeek, @gensokyo-dev, @gongfpp.
+- **Source identity:** Preserve Next route spelling, module grammar and loader request identity, directory package-main behavior, accessor effects, exact source targets, and resolver-discovery versus module-loading distinctions. [ddd7ac7](https://github.com/morluto/rea/commit/ddd7ac7b846b48191ead1f7dcd0e3bd735468fa8), [9974512](https://github.com/morluto/rea/commit/99745126009b15060d71c38809418858a07d5afa), [f2e5fd1](https://github.com/morluto/rea/commit/f2e5fd148a85fa737302dd194a33172c4561093e), [baf1678](https://github.com/morluto/rea/commit/baf16784af3592534687052431c145daef55cfd1), [6e324b2](https://github.com/morluto/rea/commit/6e324b224405f2befd953234f6dc210cf72ad50a), [75daf0c](https://github.com/morluto/rea/commit/75daf0c7df108f04ab41f34aec1a31d4a7ceb322), [f91b7f8](https://github.com/morluto/rea/commit/f91b7f8009c9af27a5e0148e3b07d20bfe3b7a2a).
+- **Graphs and selected facts:** Preserve JavaScript graph omissions/version facts, Electron native-loader facts, web JSON identity/coverage, module-path selection, feature-trace qualifications, selected native paths, endpoint context, and mixed Swift demangler outcomes. [30db499](https://github.com/morluto/rea/commit/30db499db310f073d9bf3d3acfd77985e1cb7e2e), [5a7bddb](https://github.com/morluto/rea/commit/5a7bddb3aeb0345854e76b79d529aed1c40e2054), [79805f2](https://github.com/morluto/rea/commit/79805f244a1ec0850f3109929168a9c8ebb1b908), [f719dc4](https://github.com/morluto/rea/commit/f719dc46c51a55b3926eec9659d06e7dfb95132b), [7784fdb](https://github.com/morluto/rea/commit/7784fdbad78f8b384d513f0e7dae8e983cd48ef8), [76500f1](https://github.com/morluto/rea/commit/76500f12b54e07b1ea700a403b2593890d63b42a), [676d29f](https://github.com/morluto/rea/commit/676d29f9eef794cea668f5f09f0ff510c848a513), [edf7b3d](https://github.com/morluto/rea/commit/edf7b3d32c3248f221e27f7ce5a3d34e8590285b), [93de7bc](https://github.com/morluto/rea/commit/93de7bc7e324a761162a31625b838ba0d4e3824d).
+- **Managed boundaries:** Honor native platform symbol lookup, consume resolved IL2CPP ELF declarations, and attribute malformed comparison inputs to the supplied argument. [64fa1db](https://github.com/morluto/rea/commit/64fa1db1309218283df19f3ee4dba61f5fbd2a67), [87745af](https://github.com/morluto/rea/commit/87745af52ab0ccd3a172c2534c516d41b0095035), [96ad94f](https://github.com/morluto/rea/commit/96ad94f69eda5d68c7335ff775b6927b1376fd2b).
+- **Provider and worker recovery:** Preserve output loss after successful command exit, physical refusal diagnostics, bounded worker control framing, JavaScript worker-phase/budget attribution, admitted ambiguity choices, and selected EVM limiter availability. Scope objdump debug-link limitations to DWARF requests and keep process-capture preparation nonexecuting. [e639edf](https://github.com/morluto/rea/commit/e639edf6204c05285d96840478926592daf95876), [171b33b](https://github.com/morluto/rea/commit/171b33b2c4defc6cbea49545bedf4272b72d1ea2), [34563fc](https://github.com/morluto/rea/commit/34563fcc9bd92af30668820dcac5635e27181094), [3f9357b](https://github.com/morluto/rea/commit/3f9357b5990d166a38440f56f439452266650093), [cec8f1e](https://github.com/morluto/rea/commit/cec8f1e8f305d6332272457a6ee419d3c5fb6359), [a74d859](https://github.com/morluto/rea/commit/a74d859a19122fb8f1282b3632d320997b1caae0), [c284168](https://github.com/morluto/rea/commit/c284168c4b1cd214ce7f504d43da28528d82d603), [4fb936f](https://github.com/morluto/rea/commit/4fb936fe86bb7a07f94f819ae8510301f2ef69c9).
+- **Setup and limits:** Retain unknown environment-budget facts, selected-skill/maintenance uncertainty, Hopper URL admission and bookmark verification, and listener failure recovery that matches the system cause. [a718037](https://github.com/morluto/rea/commit/a7180370332350bc0f998fbd643888221759570e), [d1fbebb](https://github.com/morluto/rea/commit/d1fbebb578538dc94fd5e376e6e1959218efa835), [60accad](https://github.com/morluto/rea/commit/60accad2de8f2862fe91901502fe26cc5390fb36), [fd7da77](https://github.com/morluto/rea/commit/fd7da77fc02dcfaf7d1bc9f2fb240d71cdd27c59), [0c440bf](https://github.com/morluto/rea/commit/0c440bfc07f3cb343e2e836d27cccaed539cfe9c).
+- **State and Evidence:** Retain export tarball ownership and SQLite primary outcomes through cleanup retry, count emitted SQLite schema names across encodings, scope display refresh to matching snapshot bindings, and report retained-result validation failures consistently. Reconstruction uses one effective completion scope and kind-based labels when names are blank. [ab58edc](https://github.com/morluto/rea/commit/ab58edcdf50b4bd687900ee2dc362ecc5c3dce15), [1006714](https://github.com/morluto/rea/commit/100671427105791a5c5913a918b63a394f6bc83e), [a47788a](https://github.com/morluto/rea/commit/a47788a6a4abb067273f954275a9d0a269adf1e7), [8aa40e9](https://github.com/morluto/rea/commit/8aa40e9a61155cff8b6f3c138c601bf805b20653), [b8c1b45](https://github.com/morluto/rea/commit/b8c1b45316882beeab4a9de49381d94e131fab0f), [a35b933](https://github.com/morluto/rea/commit/a35b9335a0124674ee5e3abe8c075f1fff6b4fa6), [#6137](https://github.com/morluto/rea/pull/6137), [#6126](https://github.com/morluto/rea/issues/6126). Thanks @carlogiovannineri-rgb, @mohithhhh.
+- **Capture coverage:** Name browser bundle budgets and deadline recovery, separate domain readiness from worker attribution, attribute rendered-frame omissions to their producing stage, share offline-capture host admission with discovery, preserve selected signal-file semantics, and retain short Flutter GNU build IDs. [#6036](https://github.com/morluto/rea/pull/6036), [ba78133](https://github.com/morluto/rea/commit/ba781330d6d28b22d15498e63c144fb40e086156), [5934387](https://github.com/morluto/rea/commit/5934387f4185129efe9dc8b7338d8bc3fa5b25bd), [ad629b2](https://github.com/morluto/rea/commit/ad629b2e31c3a9495b27179360b508fa021fe86a), [928ba76](https://github.com/morluto/rea/commit/928ba76882bfd216dde8ed79118789b2c3aad4f9), [678c4cf](https://github.com/morluto/rea/commit/678c4cfa68e2fee12f620075e12dc87d9b1195b0).
+- **Additional boundary facts:** Retain parser format/query occurrence identity and independent malformed-input facts, unresolved nested Swift identifiers, and completed signing-capture coverage; describe crash documents without assuming a provider. [5f702dd](https://github.com/morluto/rea/commit/5f702dd6ccd9e8e505e224854b91678439c3b41f), [99d2d7a](https://github.com/morluto/rea/commit/99d2d7ad22bcbd780919760008aba6a88e7d1077), [90e433d](https://github.com/morluto/rea/commit/90e433df06b3f83417176b8db1b0a905f9df1d3a), [#5548](https://github.com/morluto/rea/pull/5548), [ee12d51](https://github.com/morluto/rea/commit/ee12d517a25d34853d40e31fc039c7d1576c60e1), [#5538](https://github.com/morluto/rea/issues/5538). Thanks @coygeek, @ShuaixinHuang.
+- **Documentation:** Add the Romanian README. [#7026](https://github.com/morluto/rea/pull/7026). Thanks @An3treiu.
+
+Full contribution record: [1740 commits and 497 merged PRs](https://github.com/morluto/rea/blob/rea-agents-6.8.0/docs/releases/6.8.0.contributions.json).
+
 ## [6.7.0](https://github.com/morluto/rea/compare/rea-agents-6.6.0...rea-agents-6.7.0) (2026-10-18)

 ### Highlights
@@ -25,6 +25,18 @@ acquiring targets; optional adapter failures must preserve successful peers. Run
 `npm run verify:test-discovery` after adding or moving tests. Resolved import
 boundaries are checked by `npm run verify:module-boundaries`, included in lint.

+Before retiring an alias or facade, trace runtime registration, dynamic imports,
+JavaScript verifiers, subprocess scripts, and packaged entrypoints as well as
+TypeScript references. Tests may be the last consumers of a superseded internal
+path; migrate their distinct assertions to the current production path before
+removing it. Preserve validation, lazy loading, caller policy, and resource
+acquisition and cleanup supplied by the old boundary. Published APIs, persisted
+formats, and independently versioned bridges require an explicit compatibility
+decision; an internal representation alone does not establish that obligation.
+See [interpreting boundary facts once](docs/tool-design.md#interpret-boundary-facts-once)
+for admission ownership and the distinction between repeated validation and
+independent checks.
+
 For analysis workflows and agent interfaces, follow the
 [performance priorities](AGENTS.md#performance). Explain the selected output
 scope, reuse/cache decisions, and relevant before/after measurements when these
@@ -35,7 +47,9 @@ compare equivalent real tasks before claiming an improvement.

 When adding or changing an MCP tool, follow the [tool design guide](docs/tool-design.md) and preserve the canonical contracts and generated catalog.
 When adding or changing an admission ceiling, budget, or deadline, follow
-[admission limits and recovery](docs/design/limits-and-recovery.md).
+[analysis settings, limits, and recovery](docs/design/limits-and-recovery.md)
+for ownership, operation snapshots, provider integration, and the steps for
+adding a runtime setting.

 ## Reporting issues

@@ -89,7 +103,11 @@ Human ownership and review remain required when CI or an automated reviewer
 reports success. Readiness requests maintainer review; it does not grant scope
 approval or permission to merge.

-Draft PRs may request early feedback with open questions and incomplete checks.
+Draft status is optional. Draft PRs may request early feedback with open questions
+and incomplete checks. Agents preserve the current draft status unless asked to
+change it; missing readiness declarations or later updates do not require a PR
+to become a draft.
+
 Leave the readiness declaration unchecked until the human owner has completed
 it. The declaration records initial readiness; later pushes do not invalidate
 it or require another human sign-off. Keep the PR description and affected
@@ -368,9 +386,17 @@ Real-provider execution is uncached.
 ### Temporary files and diagnostics

 Tests use `createTestTempDirectory` from `tests/fixtures/temporaryDirectory.ts`
-for exact-path, awaited cleanup, including failures and timeouts.
+for exact-path, awaited cleanup, including failures and timeouts. It registers
+deletion with Vitest's `onTestFinished`; do not also add its result to a roots
+array or an `afterEach` removal. `createTestWorkspace` from
+`tests/support/workspace/workspaceFixture.ts` leaves cleanup with its caller,
+which must await `removeTestWorkspace`. Keep explicit resource teardown before
+directory deletion, using the case's `finally` or `afterEach`; Vitest runs
+`afterEach` before `onTestFinished` and awaits finish hooks in reverse
+registration order.
 `npm run verify:test-temp-hygiene` runs the suite under a fresh `TMPDIR` and
-rejects remaining REA-owned paths. Never glob-clean shared `/tmp/rea-*` content.
+rejects remaining REA-owned paths. It cannot detect duplicate deletion owners or
+prove resource-close ordering. Never glob-clean shared `/tmp/rea-*` content.

 `REA_LOG_LEVEL` selects `trace`, `debug`, `info`, `warn`, `error`, `fatal`, or
 `silent`. Logs go to stderr: MCP defaults to `info`, and one-shot CLI logging
@@ -1,7 +1,7 @@
 <div align="center">

 **English** · [简体中文](docs/readme/README_zh.md) · [繁體中文](docs/readme/README_zh-TW.md) · [日本語](docs/readme/README_ja.md) · [한국어](docs/readme/README_ko.md) · [Türkçe](docs/readme/README_tr.md) · [Русский](docs/readme/README_ru.md) · [Tiếng Việt](docs/readme/README_vi.md) · [ไทย](docs/readme/README_th.md) · [Deutsch](docs/readme/README_de.md) · [Español](docs/readme/README_es.md) · [Français](docs/readme/README_fr.md) · [Українська](docs/readme/README_uk.md) · [Polski](docs/readme/README_pl.md) · [Português (Brasil)](docs/readme/README_pt-BR.md) · [العربية](docs/readme/README_ar.md) · [فارسی](docs/readme/README_fa.md) · [Bahasa Indonesia](docs/readme/README_id.md) · [Italiano](docs/readme/README_it.md)
-· [Ελληνικά](docs/readme/README_el.md) · [മലയാളം](docs/readme/README_ml.md) · [Roman Urdu](docs/readme/README_ur-Latn.md)
+· [Ελληνικά](docs/readme/README_el.md) · [മലയാളം](docs/readme/README_ml.md) · [Roman Urdu](docs/readme/README_ur-Latn.md) · [Română](docs/readme/README_ro.md)

 # REA: Reverse Engineer Anything

@@ -20,7 +20,7 @@

 **[Website](https://rea.tools/) · [Guides](https://rea.tools/guides/) · [Showcases](https://rea.tools/showcase/)**

-[Quick start](#quick-start) · [How REA works](#how-rea-works) · [What you can analyze](#what-you-can-analyze) · [Showcases](#showcases) · [FAQ](#faq) · [Documentation](#documentation)
+[Quick start](#quick-start) · [How REA works](#how-rea-works) · [What you can analyze](#what-you-can-analyze) · [Showcases](#showcases) · [Build RL environments](#build-rl-environments) · [FAQ](#faq) · [Documentation](#documentation)

 <code>npx rea-agents setup</code>

@@ -96,6 +96,12 @@ complete advertised field guidance and nested validation details. Both profiles
 keep the full tool set and canonical server validation. See
 "Compact input schema profile" in the MCP contracts guide.

+Complete output schemas are advertised by default. If your client caps the
+complete `tools/list` frame, set `REA_MCP_OUTPUT_SCHEMA_PROFILE=compact` to
+bound each advertised output schema, or `off` to omit output schemas entirely.
+Both settings keep canonical server-side validation and complete structured
+results. See "Output schemas" in the MCP contracts guide.
+
 ### Ask your agent

 ```text
@@ -195,6 +201,7 @@ Additional tools and host support depend on the target:
 | PE imports              | Import and delay-load DLL names, ordinals, IAT RVAs and pefile import hash                        | Built-in static PE inspection; [PE imports](docs/pe-imports.md)                                                                       |
 | ELF notes               | PT_NOTE/SHT_NOTE owners, types, GNU build-id and ABI-tag fields                                   | Built-in static ELF inspection; [ELF notes](docs/elf-notes.md)                                                                        |
 | Apple IPS crashes       | .ips metadata, threads, images, registers and documented crash classes                            | Built-in static JSON inspection; [Apple IPS](docs/apple-ips.md)                                                                       |
+| Linux kernel modules    | .modinfo keys, __versions CRCs, this_module presence, and signature trailer                       | Built-in static ELF inspection; [kernel modules](docs/kernel-modules.md)                                                              |
 | Erlang BEAM             | IFF chunks, atoms, exports, imports, lambdas and the Code header                                  | Built-in static BEAM inspection; [Erlang BEAM](docs/erlang-beam.md)                                                                   |
 | WASM artifact           | Validation, sections, exact import/export WAT forms and decoded WAT                               | Caller-supplied WABT 1.0.42; `inspect_wasm_artifact`                                                                                  |
 | EVM bytecode            | Dispatch selectors, byte offsets, inferred arguments and mutability                               | Local raw/hex carrier on Linux x64; [offline EVM guide](docs/evm-bytecode.md)                                                         |
@@ -275,11 +282,53 @@ historical compiler output.
 [Read the case study](https://rea.tools/showcase/th04/) ·
 [Reconstruction repository](https://github.com/N0zoM1z0/th04)

+### Build RL environments with REA
+
+Record a web app session, turn its API into tools, and export an environment an AI agent can use. Run it with AgentEnv, then add tasks and reward checks for RL training or evaluation.
+
+[Read the guide](https://rea.tools/guides/rl-environments/) ·
+[Watch the video](https://x.com/reatools/status/2112574822584918075?s=20)
+
 If you've used REA on something interesting, we'd love to see it. Share your
 case in an [issue](https://github.com/morluto/rea/issues) or a
 [pull request](https://github.com/morluto/rea/pulls), including the target,
 your question, how REA helped, and what you found.

+## Build RL environments
+
+Give an AI agent a local environment to practice tasks such as finding an issue or creating a folder, without running the original app. Use it for reinforcement learning (RL) or to test how well an agent completes tasks.
+
+REA turns recorded API requests and responses into tools the agent can call. The environment uses the recorded data and supports changes only when the recording confirms their effects.
+
+With REA set up in your agent, replace the example URL and folder tasks below with your own:
+
+```text
+Use REA to build an RL environment from my test web app at
+http://127.0.0.1:3000.
+Cover listing, creating, renaming, and deleting folders. You may create and
+remove test folders. Leave existing data unchanged.
+Save it in a folder named my-env. Check which operations work and tell me
+how to run it.
+```
+
+<details>
+<summary>Use the command line instead</summary>
+
+Use these commands if you already have a file containing the app’s recorded browser requests and responses. Running the result also requires AgentEnv and Docker.
+
+```sh
+rea environment-build ./session.har ./my-env --name my-env --json
+agent-env run ./my-env
+```
+
+</details>
+
+REA exports a runnable environment with a basic test to check that it starts and responds. Use it with your RL framework to define task goals, add reward checks, and run training.
+
+[Build an environment](https://rea.tools/guides/rl-environments/) ·
+[Environment reference](docs/agent-environments.md) ·
+[Watch the demo on X](https://x.com/reatools/status/2112574822584918075?s=20)
+
 ## FAQ

 <details>
@@ -10,7 +10,7 @@ Do not disclose vulnerabilities, proof-of-concept exploits, credentials,
 private binaries, Hopper documents, or private Ghidra projects in a public
 issue.

-Use **Report a vulnerability** in the repository's **Security** tab to submit the report privately. Do not open a public issue to request a private contact channel.
+Use **Report a vulnerability** in the repository's **Security** tab as the preferred way to submit the report privately. If GitHub private reporting is unavailable to you, email [[email protected]](mailto:[email protected]). Do not open a public issue to request a private contact channel.

 Include the affected REA version, operating system/distribution, selected
 provider and version, impact, reproduction conditions, and any suggested
@@ -3,6 +3,8 @@ import com.google.gson.*;
 import io.modelcontextprotocol.kotlin.sdk.server.*;
 import io.modelcontextprotocol.kotlin.sdk.types.*;
 import jadx.api.*;
+import jadx.api.plugins.input.data.annotations.EncodedValue;
+import jadx.api.plugins.input.data.attributes.JadxAttrType;
 import jadx.api.plugins.input.data.ICodeReader;
 import jadx.api.plugins.input.data.IMethodRef;
 import jadx.api.plugins.input.insns.InsnIndexType;
@@ -40,7 +42,8 @@ class ReaJadxBridge {

  private record MethodSnapshot(String name, String rawName, String shortId, List<String> bodyAbsenceMarkers,
      Map<String, Object> summary) {}
-  private record ClassSnapshot(JavaClass node, List<MethodSnapshot> methods, Map<String, Object> summary) {}
+  private record ClassSnapshot(JavaClass node, List<MethodSnapshot> methods, Map<String, Object> summary,
+      Map<String, Object> summaryWithValues) {}
  private record ManifestSnapshot(String text, Map<String, Object> summary) {}

  private static final class InputFailure extends IllegalArgumentException {
@@ -142,6 +145,14 @@ class ReaJadxBridge {
    return value.getAsString();
  }

+  private static boolean flag(JsonObject args, String name) {
+    JsonElement value = args.get(name);
+    if (value == null) return false;
+    if (!value.isJsonPrimitive() || !value.getAsJsonPrimitive().isBoolean())
+      throw new IllegalArgumentException(name + " must be a boolean");
+    return value.getAsBoolean();
+  }
+
  private static int integer(JsonObject args, String name, int fallback) {
    JsonElement value = args.get(name);
    if (value == null) return fallback;
@@ -263,18 +274,43 @@ class ReaJadxBridge {
                "dex_descriptor", descriptor,
                "is_constructor", method.isConstructor(), "def_pos", 0));
          }).toList();
-          List<Map<String, Object>> fields = node.getFields().stream()
-              .sorted(Comparator.comparing(FieldNode::getAlias))
-              .map(field -> Map.<String, Object>of("name", field.getAlias(),
-                  "type", field.getType().toString(), "def_pos", 0)).toList();
+          List<FieldNode> orderedFields = new ArrayList<>(node.getFields());
+          orderedFields.sort(Comparator.comparing(FieldNode::getAlias));
+          List<Map<String, Object>> fields = new ArrayList<>();
+          List<Map<String, Object>> valuedFields = new ArrayList<>();
+          boolean anyValue = false;
+          for (FieldNode field : orderedFields) {
+            Map<String, Object> entry = Map.of("name", field.getAlias(),
+                "type", field.getType().toString(), "def_pos", 0);
+            fields.add(entry);
+            Map<String, Object> value = dexStaticValue(field);
+            if (value == null) valuedFields.add(entry);
+            else {
+              anyValue = true;
+              Map<String, Object> valued = new LinkedHashMap<>(entry);
+              valued.put("dex_static_value", value);
+              valuedFields.add(Collections.unmodifiableMap(valued));
+            }
+          }
          List<String> inner = node.getInnerClasses().stream().map(ClassNode::getFullName).toList();
          Map<String, Object> summary = Map.of(
-              "full_name", cls.getFullName(), "name", cls.getName(),
+              "full_name", cls.getFullName(), "raw_name", cls.getRawName(), "name", cls.getName(),
              "method_count", methods.size(), "field_count", fields.size(),
              "inner_class_count", inner.size(), "inner_classes", inner,
-              "methods", methods.stream().map(MethodSnapshot::summary).toList(), "fields", fields);
-          index.computeIfAbsent(cls.getFullName(), ignored -> new ArrayList<>())
-              .add(new ClassSnapshot(cls, methods, summary));
+              "methods", methods.stream().map(MethodSnapshot::summary).toList(), "fields", List.copyOf(fields));
+          // DEX static values are opt-in, so method and reference lookups keep the member-only reply.
+          Map<String, Object> summaryWithValues = summary;
+          if (anyValue) {
+            Map<String, Object> copy = new LinkedHashMap<>(summary);
+            copy.put("fields", List.copyOf(valuedFields));
+            summaryWithValues = Collections.unmodifiableMap(copy);
+          }
+          ClassSnapshot snapshot = new ClassSnapshot(cls, methods, summary, summaryWithValues);
+          index.computeIfAbsent(cls.getFullName(), ignored -> new ArrayList<>()).add(snapshot);
+          // Keep the binary identity supplied by JADX; '$' can also be a literal
+          // name character, so replacing separators would invent lookup aliases.
+          if (!cls.getRawName().equals(cls.getFullName()))
+            index.computeIfAbsent(cls.getRawName(), ignored -> new ArrayList<>()).add(snapshot);
        }
      }
      classes = Collections.unmodifiableMap(index);
@@ -289,6 +325,28 @@ class ReaJadxBridge {
    return candidates.get(0);
  }

+  /** A static final field's class-definition static value; a static initializer can still assign it. */
+  private static Map<String, Object> dexStaticValue(FieldNode field) {
+    if (!field.getAccessFlags().isStatic() || !field.getAccessFlags().isFinal()) return null;
+    EncodedValue encoded = field.get(JadxAttrType.CONSTANT_VALUE);
+    if (encoded == null) return null;
+    Object value = encoded.getValue();
+    // JADX also attaches the shared null to static finals without a value, so null is never reported.
+    // Wide and floating values keep their Java text instead of a lossy JSON number.
+    return switch (encoded.getType()) {
+      case ENCODED_BOOLEAN -> Map.of("type", "boolean", "value", value);
+      case ENCODED_BYTE -> Map.of("type", "byte", "value", value);
+      case ENCODED_SHORT -> Map.of("type", "short", "value", value);
+      case ENCODED_CHAR -> Map.of("type", "char", "value", (int) (Character) value);
+      case ENCODED_INT -> Map.of("type", "int", "value", value);
+      case ENCODED_LONG -> Map.of("type", "long", "value", value.toString());
+      case ENCODED_FLOAT -> Map.of("type", "float", "value", value.toString());
+      case ENCODED_DOUBLE -> Map.of("type", "double", "value", value.toString());
+      case ENCODED_STRING -> Map.of("type", "string", "value", value);
+      default -> null;
+    };
+  }
+
  private List<MethodSnapshot> methods(ClassSnapshot cls, JsonObject args) {
    String name = string(args, "method_name");
    List<MethodSnapshot> result = cls.methods().stream().filter(method -> method.name().equals(name)).toList();
@@ -439,7 +497,8 @@ class ReaJadxBridge {
          "items", items));
    }
    ClassSnapshot cls = selected(args);
-    if (name.equals("get_class_summary")) return json(cls.summary());
+    if (name.equals("get_class_summary"))
+      return json(flag(args, "dex_static_values") ? cls.summaryWithValues() : cls.summary());
    if (name.equals("get_method_body")) {
      List<MethodSnapshot> overloads = methods(cls, args);
      int index = integer(args, "overload_index", 0);
@@ -454,7 +513,7 @@ class ReaJadxBridge {
          "markers", code.getMarkers(), "body", code.getText()));
    }
    List<JavaNode> uses;
-    String target = string(args, "class_name");
+    String target = (String) cls.summary().get("full_name");
    MethodSnapshot selectedMethod = null;
    int overloadIndex = 0;
    if (name.equals("get_xrefs_to_class")) uses = cls.node().getUseIn();
@@ -522,7 +581,7 @@ class ReaJadxBridge {
    SessionHolder holder = new SessionHolder(defaults);
    ServerCapabilities capabilities = new ServerCapabilities(
        new ServerCapabilities.Tools(null), null, null, null, null, null, null, Map.of());
-    Server server = new Server(new Implementation("rea-jadx-bridge", "5", null, null, null),
+    Server server = new Server(new Implementation("rea-jadx-bridge", "7", null, null, null),
        new ServerOptions(capabilities), "", ignored -> Unit.INSTANCE);
    SessionToolsKt.registerSessionTools(server, holder);
    ClassToolsKt.registerClassTools(server, holder);
@@ -564,9 +623,12 @@ class ReaJadxBridge {
      if (name.equals("list_classes")) properties.put("query",
          new kotlinx.serialization.json.JsonObject(Map.of(
              "type", kotlinx.serialization.json.JsonElementKt.JsonPrimitive("string"))));
+      if (name.equals("get_class_summary")) properties.put("dex_static_values",
+          new kotlinx.serialization.json.JsonObject(Map.of(
+              "type", kotlinx.serialization.json.JsonElementKt.JsonPrimitive("boolean"))));
      String description = switch (name) {
        case "list_classes" -> "Pages of case-sensitive matching top-level class names; offset and next_offset are inventory positions, limit bounds matching rows. Omitted or empty query inventories all names.";
-        case "get_class_summary" -> "Parsed member metadata for one exact class name; no source generation.";
+        case "get_class_summary" -> "Parsed member metadata for one exact class name; no source generation. Set dex_static_values to include encoded static final field values.";
        case "get_method_body" -> "Source for an exact class and stable same-name overload index; static initializers use smali to preserve folded field initialization.";
        default -> "Complete static using-node inventory for an exact class or selected method overload; one node may contain multiple invoke instructions, and source lines are unresolved.";
      };
@@ -404,6 +404,8 @@ public final class ReaGhidraBridge extends HeadlessScript {
                    writeSuccess(writer, request.id, result);
                    return;
                }
+                decompileTimeoutSeconds = request.decompileTimeoutSeconds() == null
+                    ? descriptor.decompileTimeoutSeconds() : request.decompileTimeoutSeconds();
                writeSuccess(writer, request.id, handleRequest(request, descriptor));
            }
            catch (RequestFailure failure) {
@@ -432,6 +434,8 @@ public final class ReaGhidraBridge extends HeadlessScript {
                "Ghidra auto-analysis did not complete for this Program"
            );
        }
+        if (descriptor.existingProject && isMutatingOperation(request.method))
+            throw new RequestFailure("method_unavailable", "Existing Ghidra project sessions are read-only");
        return switch (request.method) {
            case "read_binary_inventory_summary" -> binaryInventorySummary(request.params);
            case "inspect_native_load_image" -> inspectNativeLoadImage(request.params);
@@ -484,6 +488,10 @@ public final class ReaGhidraBridge extends HeadlessScript {
        };
    }

+    private static boolean isMutatingOperation(String method) {
+        return method.equals("annotate_native_function") || method.equals("set_address_name") || method.equals("set_addresses_names");
+    }
+
    private JsonObject sessionInfo(SessionDescriptor descriptor) throws Exception {
        boolean timedOut = analysisTimeoutOccurred();
        JsonObject provider = new JsonObject();
@@ -509,14 +517,16 @@ public final class ReaGhidraBridge extends HeadlessScript {
        result.addProperty("run_id", descriptor.runId);
        result.addProperty("profile_digest", descriptor.profileDigest);
        result.add("provider", provider);
-        boolean readOnly = !descriptor.transport.equals("unix-socket");
+        boolean readOnly = descriptor.existingProject || !descriptor.transport.equals("unix-socket");
        result.addProperty("read_only", readOnly);
-        result.addProperty("analysis_complete", !timedOut);
+        if (descriptor.existingProject) {
+            result.add("analysis_complete", JsonNull.INSTANCE);
+            result.addProperty("existing_project", true);
+        } else result.addProperty("analysis_complete", !timedOut);
        result.addProperty("analysis_timed_out", timedOut);
        result.add("capabilities", GSON.toJsonTree(
            java.util.Arrays.stream(CAPABILITIES)
-                .filter(value -> !readOnly || !(value.equals("annotate_native_function")
-                    || value.equals("set_address_name") || value.equals("set_addresses_names")))
+                .filter(value -> !readOnly || !isMutatingOperation(value))
                .toArray(String[]::new)
        ));
        result.add("target", target);
@@ -643,6 +653,9 @@ public final class ReaGhidraBridge extends HeadlessScript {
                mapping.addProperty("initialized", block.isInitialized());
                mapping.addProperty("loaded", block.isLoaded());
                mapping.addProperty("overlay", block.isOverlay());
+                mapping.addProperty("readable", block.isRead());
+                mapping.addProperty("writable", block.isWrite());
+                mapping.addProperty("executable", block.isExecute());
                mapping.addProperty("length", source.getLength());
                FileBytes backing = source.getFileBytes().orElse(null);
                int sourceIndex = backing == null ? -1 : files.indexOf(backing);
@@ -3378,7 +3391,7 @@ public final class ReaGhidraBridge extends HeadlessScript {
                "decompile_timed_out",
                "Ghidra decompilation of " + canonicalAddress(function.getEntryPoint()) +
                " exceeded the " + decompileTimeoutSeconds +
-                "-second limit set by REA_GHIDRA_DECOMPILE_TIMEOUT_SECONDS"
+                "-second configured decompilation limit (ghidra.decompile_timeout_seconds; launch seed REA_GHIDRA_DECOMPILE_TIMEOUT_SECONDS)"
            );
        }
        if (!results.decompileCompleted()) {
@@ -4747,6 +4760,8 @@ public final class ReaGhidraBridge extends HeadlessScript {
            keys.add("analysis_extensions");
        if (parsed.isJsonObject() && parsed.getAsJsonObject().has("decompile_timeout_seconds"))
            keys.add("decompile_timeout_seconds");
+        if (parsed.isJsonObject() && parsed.getAsJsonObject().has("existing_project"))
+            keys.add("existing_project");
        JsonObject object = requireObject(parsed, keys);
        int decompileTimeout = 0;
        if (object.has("decompile_timeout_seconds")) {
@@ -4763,12 +4778,24 @@ public final class ReaGhidraBridge extends HeadlessScript {
            requireString(object, "provider_version"),
            requireString(object, "profile_digest"),
            object.has("analysis_extensions") ? object.getAsJsonArray("analysis_extensions") : new JsonArray(),
-            decompileTimeout
+            decompileTimeout,
+            object.has("existing_project") && requireBoolean(object, "existing_project")
        );
    }

    private static Request parseRequest(String line, String expectedToken) {
-        JsonObject object = requireObject(JsonParser.parseString(line), REQUEST_KEYS);
+        JsonElement parsed = JsonParser.parseString(line);
+        Set<String> keys = new HashSet<>(REQUEST_KEYS);
+        if (parsed.isJsonObject() && parsed.getAsJsonObject().has("decompile_timeout_seconds"))
+            keys.add("decompile_timeout_seconds");
+        JsonObject object = requireObject(parsed, keys);
+        Integer timeout = null;
+        if (object.has("decompile_timeout_seconds")) {
+            JsonElement value = object.get("decompile_timeout_seconds");
+            timeout = value.isJsonNull() ? 0 : requireInteger(object, "decompile_timeout_seconds");
+            if (!value.isJsonNull() && (timeout < 1 || timeout > MAX_DECOMPILE_TIMEOUT_SECONDS))
+                throw new IllegalArgumentException("Invalid per-request decompile deadline");
+        }
        int id = requireInteger(object, "id");
        if (id <= 0 || !constantTimeEquals(requireString(object, "token"), expectedToken)) {
            throw new IllegalArgumentException("Bridge request authentication failed");
@@ -4777,7 +4804,7 @@ public final class ReaGhidraBridge extends HeadlessScript {
        if (params == null || !params.isJsonObject()) {
            throw new IllegalArgumentException("Bridge request parameters are invalid");
        }
-        return new Request(id, requireString(object, "method"), params.getAsJsonObject());
+        return new Request(id, requireString(object, "method"), params.getAsJsonObject(), timeout);
    }

    private static JsonObject requireObject(JsonElement element, Set<String> keys) {
@@ -4969,9 +4996,10 @@ public final class ReaGhidraBridge extends HeadlessScript {
        String providerVersion,
        String profileDigest,
        JsonArray analysisExtensions,
-        int decompileTimeoutSeconds
+        int decompileTimeoutSeconds,
+        boolean existingProject
    ) {}
-    private record Request(int id, String method, JsonObject params) {}
+    private record Request(int id, String method, JsonObject params, Integer decompileTimeoutSeconds) {}

    private static final class RequestFailure extends RuntimeException {
        private final String code;
@@ -0,0 +1,193 @@
+import ghidra.app.script.GhidraScript;
+import ghidra.program.database.mem.FileBytes;
+import ghidra.program.model.address.Address;
+import ghidra.program.model.address.AddressSpace;
+import ghidra.program.model.listing.Program;
+import ghidra.program.model.mem.Memory;
+import ghidra.program.model.mem.MemoryBlock;
+import ghidra.program.model.mem.MemoryBlockSourceInfo;
+import java.nio.file.Files;
+import java.nio.file.LinkOption;
+import java.nio.file.Path;
+import java.util.ArrayList;
+import java.util.List;
+
+/**
+ * Rebuild a GameCube/Wii DOL memory map from the validated load ranges REA's TypeScript
+ * admission wrote. BinaryLoader maps the whole file once at address 0; this
+ * script replaces that block with text, data, and BSS blocks at their load addresses.
+ */
+public final class ReaGhidraPrepareDol extends GhidraScript {
+    // Canonical v2 header, 18 section rows, 12 gap rows and entry, using uint32 hex.
+    private static final int MAX_PLAN_BYTES = 13 + 18 * 49 + 12 * 30 + 17;
+    private static final class Section {
+        final String kind;
+        final int index;
+        final long fileOffset;
+        final long address;
+        final long size;
+
+        Section(String kind, int index, long fileOffset, long address, long size) {
+            this.kind = kind;
+            this.index = index;
+            this.fileOffset = fileOffset;
+            this.address = address;
+            this.size = size;
+        }
+    }
+
+    private record BssGap(long address, long size) {}
+
+    @Override
+    public void run() throws Exception {
+        String[] arguments = getScriptArgs();
+        if (arguments.length != 1) {
+            throw new IllegalArgumentException(
+                "GameCube DOL preparation requires exactly one section table path"
+            );
+        }
+        if (!currentProgram.getExecutableFormat().equals("Raw Binary") ||
+            !currentProgram.getLanguageID().getIdAsString().startsWith("PowerPC:BE:32:")) {
+            throw new IllegalArgumentException(
+                "GameCube DOL preparation requires a BinaryLoader import in big-endian 32-bit PowerPC"
+            );
+        }
+        Path tablePath = Path.of(arguments[0]);
+        if (!Files.isRegularFile(tablePath, LinkOption.NOFOLLOW_LINKS)) {
+            throw new IllegalArgumentException("GameCube DOL section table is not a regular file");
+        }
+        if (Files.size(tablePath) > MAX_PLAN_BYTES) {
+            throw new IllegalArgumentException("GameCube DOL plan exceeds the canonical format's byte bound");
+        }
+
+        List<Section> sections = new ArrayList<>();
+        List<BssGap> bssGaps = new ArrayList<>();
+        int expectedSections = -1;
+        int expectedGaps = -1;
+        long entry = -1;
+        for (String line : Files.readAllLines(tablePath)) {
+            String[] fields = line.trim().split("\\s+");
+            switch (fields[0]) {
+                case "plan" -> {
+                    requireFields(fields, 4, line);
+                    if (expectedSections >= 0 || !fields[1].equals("2")) {
+                        throw new IllegalArgumentException("Duplicate or unsupported GameCube DOL plan header");
+                    }
+                    expectedSections = Integer.parseInt(fields[2]);
+                    expectedGaps = Integer.parseInt(fields[3]);
+                    // A DOL has 18 slots, including at most 11 data slots and 12 BSS gaps.
+                    if (expectedSections < 1 || expectedSections > 18 || expectedGaps < 0 || expectedGaps > 12) {
+                        throw new IllegalArgumentException("GameCube DOL plan counts exceed the format's slot bounds");
+                    }
+                }
+                case "section" -> {
+                    requireFields(fields, 6, line);
+                    if (expectedSections < 0 || sections.size() >= expectedSections) {
+                        throw new IllegalArgumentException("GameCube DOL section exceeds its declared count");
+                    }
+                    sections.add(new Section(
+                        fields[1],
+                        Integer.parseInt(fields[2]),
+                        Long.decode(fields[3]),
+                        Long.decode(fields[4]),
+                        Long.decode(fields[5])
+                    ));
+                }
+                case "bss-gap" -> {
+                    requireFields(fields, 3, line);
+                    if (expectedGaps < 0 || bssGaps.size() >= expectedGaps) {
+                        throw new IllegalArgumentException("GameCube DOL BSS gap exceeds its declared count");
+                    }
+                    long address = Long.decode(fields[1]);
+                    long size = Long.decode(fields[2]);
+                    if (address < 0 || size <= 0) {
+                        throw new IllegalArgumentException("GameCube DOL BSS gap is not a positive range");
+                    }
+                    bssGaps.add(new BssGap(address, size));
+                }
+                case "entry" -> {
+                    requireFields(fields, 2, line);
+                    entry = Long.decode(fields[1]);
+                }
+                default -> throw new IllegalArgumentException("Unknown GameCube DOL table line: " + line);
+            }
+        }
+        if (expectedSections != sections.size() || expectedGaps != bssGaps.size() || entry < 0) {
+            throw new IllegalArgumentException("GameCube DOL section table is incomplete");
+        }
+
+        Memory memory = currentProgram.getMemory();
+        List<FileBytes> files = memory.getAllFileBytes();
+        if (files.size() != 1) {
+            throw new IllegalStateException("GameCube DOL preparation requires exactly one imported file image");
+        }
+        FileBytes fileBytes = files.get(0);
+        AddressSpace space = currentProgram.getAddressFactory().getDefaultAddressSpace();
+
+        // Remove the whole-file block before creating section blocks, so no two blocks claim one address.
+        for (MemoryBlock block : memory.getBlocks()) {
+            for (MemoryBlockSourceInfo source : block.getSourceInfos()) {
+                if (source.getFileBytes().isPresent() && source.getFileBytes().get().equals(fileBytes)) {
+                    memory.removeBlock(block, monitor);
+                    break;
+                }
+            }
+        }
+
+        for (Section section : sections) {
+            if (section.fileOffset + section.size > fileBytes.getSize()) {
+                throw new IllegalArgumentException(
+                    "GameCube DOL " + section.kind + " " + section.index + " exceeds the imported file"
+                );
+            }
+            boolean text = section.kind.equals("text");
+            if (!text && !section.kind.equals("data")) {
+                throw new IllegalArgumentException("Unknown GameCube DOL section kind: " + section.kind);
+            }
+            MemoryBlock block = memory.createInitializedBlock(
+                "." + section.kind + section.index,
+                space.getAddress(section.address),
+                fileBytes,
+                section.fileOffset,
+                section.size,
+                false
+            );
+            block.setRead(true);
+            block.setWrite(!text);
+            block.setExecute(text);
+        }
+
+        // Apply the domain owner's exact uninitialized ranges; do not reinterpret BSS here.
+        int gapIndex = 0;
+        for (BssGap gap : bssGaps) {
+            MemoryBlock block = memory.createUninitializedBlock(
+                ".bss" + gapIndex++,
+                space.getAddress(gap.address()),
+                gap.size(),
+                false
+            );
+            block.setRead(true);
+            block.setWrite(true);
+            block.setExecute(false);
+        }
+
+        Address entryAddress = space.getAddress(entry);
+        MemoryBlock entryBlock = memory.getBlock(entryAddress);
+        if (entryBlock == null || !entryBlock.isExecute()) {
+            throw new IllegalArgumentException("GameCube DOL entry must lie in an executable section");
+        }
+        addEntryPoint(entryAddress);
+        if (!disassemble(entryAddress) || createFunction(entryAddress, "__start") == null) {
+            throw new IllegalStateException("GameCube DOL entry cannot be decoded as a function");
+        }
+        currentProgram.getOptions(Program.PROGRAM_INFO).setBoolean("REA raw binary prepared", true);
+        currentProgram.getOptions(Program.PROGRAM_INFO).setBoolean("REA GameCube DOL prepared", true);
+    }
+
+    private static void requireFields(String[] fields, int count, String line) {
+        if (fields.length != count) {
+            throw new IllegalArgumentException("Malformed GameCube DOL table line: " + line);
+        }
+    }
+
+}
@@ -15,6 +15,11 @@ import sys
 PROFILE = "[email protected];[email protected];[email protected]"
 PACKAGES = {"pwntools": "4.15.0", "pyelftools": "0.33", "unicorn": "2.1.2"}
 OUTPUT_BYTES = 64 * 1024 * 1024
+# (e_machine, ELF class bits, byte order) -> architecture pwntools must also report.
+PROFILES = {(62, 64, "little"): "amd64", (3, 32, "little"): "i386", (40, 32, "little"): "arm",
+            (8, 32, "little"): "mips", (8, 32, "big"): "mips"}
+PROFILE_SCOPE = ("Layout profile requires ELF64 x86-64, ELF32 i386, ELF32 ARM little-endian "
+                 "or ELF32 MIPS little- or big-endian objects.")


 class LayoutFailure(Exception):
@@ -116,13 +121,16 @@ def inspect_elf(path, cache):
        raise LayoutFailure("format", "Selected object does not contain an ELF header.")
    if len(content) < 16:
        raise LayoutFailure("format", "Selected ELF identification is truncated.")
-    if content[4] != 2 or content[5] != 1:
-        raise LayoutFailure("unsupported-target", "Initial layout profile requires ELF64 little-endian objects.")
-    if len(content) < 64:
-        raise LayoutFailure("format", "Selected ELF64 header is truncated.")
-    if int.from_bytes(content[18:20], "little") != 62:
-        raise LayoutFailure("unsupported-target", "Initial layout profile requires x86-64 ELF objects.")
-    if int.from_bytes(content[16:18], "little") not in (1, 2, 3):
+    if content[4] not in (1, 2) or content[5] not in (1, 2):
+        raise LayoutFailure("unsupported-target", "Selected ELF declares an unknown class or byte order.")
+    bits, header_size = (32, 52) if content[4] == 1 else (64, 64)
+    order = "little" if content[5] == 1 else "big"
+    if len(content) < header_size:
+        raise LayoutFailure("format", f"Selected ELF{bits} header is truncated.")
+    profile = (int.from_bytes(content[18:20], order), bits, order)
+    if profile not in PROFILES:
+        raise LayoutFailure("unsupported-target", PROFILE_SCOPE)
+    if int.from_bytes(content[16:18], order) not in (1, 2, 3):
        raise LayoutFailure("unsupported-target", "Selected ELF type is outside the EXEC/DYN/REL layout profile; recorded core analysis is separate.")
    from pwnlib.context import context
    with context.local(cache_dir=str(cache), log_level="warning"):
@@ -185,8 +193,8 @@ def inspect_elf(path, cache):
                        if type is None or section.header.sh_type == type)
        try:
            image = LayoutELF(str(path), checksec=False)
-            if image.arch != "amd64" or image.bits != 64 or image.endian != "little":
-                raise LayoutFailure("unsupported-target", "Initial layout profile requires x86-64 ELF64 little-endian objects.")
+            if (image.arch, image.bits, image.endian) != (PROFILES[profile], bits, order):
+                raise LayoutFailure("unsupported-target", PROFILE_SCOPE)
            if image.header.e_type not in ("ET_EXEC", "ET_DYN", "ET_REL"):
                raise LayoutFailure("unsupported-target", "Selected ELF type is outside the EXEC/DYN/REL layout profile; recorded core analysis is separate.")
            length = len(content)
@@ -208,7 +216,7 @@ def inspect_elf(path, cache):
                })
                if h.sh_type in ("SHT_SYMTAB", "SHT_DYNSYM"):
                    if h.sh_entsize < image.structs.Elf_Sym.sizeof():
-                        raise LayoutFailure("format", "ELF symbol entry is smaller than the decoded Elf64_Sym structure.")
+                        raise LayoutFailure("format", f"ELF symbol entry is smaller than the decoded Elf{bits}_Sym structure.")
                    if h.sh_link >= len(all_sections) or all_sections[h.sh_link].header.sh_type != "SHT_STRTAB":
                        raise LayoutFailure("format", f"ELF symbol table {index} links to invalid string table {h.sh_link}.")
                    strings = all_sections[h.sh_link]
@@ -34,8 +34,10 @@ export default defineConfig({
          { text: "Rust dependencies", link: "/rust-binaries" },
          { text: "PE certificates", link: "/pe-certificates" },
          { text: "PE imports", link: "/pe-imports" },
+          { text: "PE TLS/load config", link: "/pe-load-config" },
          { text: "ELF notes", link: "/elf-notes" },
          { text: "Apple IPS crash reports", link: "/apple-ips" },
+          { text: "Linux kernel modules", link: "/kernel-modules" },
          { text: "CPython pyc files", link: "/python-pyc" },
          { text: "Erlang BEAM", link: "/erlang-beam" },
          {
@@ -51,7 +53,11 @@ export default defineConfig({
            text: "Web network captures",
            link: "/web-network-captures",
          },
-          { text: "Agent environments", link: "/agent-environments" },
+          {
+            text: "Build RL environments",
+            link: "/agent-environments-quickstart",
+          },
+          { text: "Environment reference", link: "/agent-environments" },
          { text: "Electron observation", link: "/electron-observation" },
          { text: "Electron fuses", link: "/electron-fuses" },
          { text: "Process capture", link: "/process-capture" },
@@ -80,6 +86,7 @@ export default defineConfig({
          { text: "Ghidra raw binary", link: "/raw-binary" },
          { text: "Ghidra NativeAOT", link: "/ghidra-nativeaot" },
          { text: "Ghidra PowerPC", link: "/ghidra-ppc" },
+          { text: "Ghidra GameCube DOL", link: "/ghidra-dol" },
          { text: "Ghidra semantics", link: "/ghidra-provider" },
        ],
      },
@@ -0,0 +1,204 @@
+# Build RL environments with REA
+
+REA turns a recorded web app session into a runnable environment for training
+and testing AI agents. An agent can practice tasks such as finding an issue,
+creating a folder, or editing a record without running the original app.
+
+REA builds the tools the agent calls, the local data those tools use, and a
+test that checks the environment starts and responds. It supports changes
+when the recording confirms their effects. You can then use the environment
+with your RL framework to set task goals, check rewards, and run training.
+
+## Before you start
+
+Install [REA and its agent integration](installation.md). To record an app,
+you also need a running test instance and a Chrome-family browser. Choose an
+instance where the agent is allowed to create, edit, and delete data. REA
+records the app you provide; you start it and prepare its test data.
+
+To run the exported environment, install the
+[AgentEnv framework](https://github.com/scaleapi/agentenv-framework#install)
+and start Docker. REA's [compatibility check](testing.md#exported-environment-bundles)
+uses AgentEnv version `0.9.1334` with Python 3.12.
+
+There are two ways to build an environment: ask your agent to record the app,
+or start from a recording you already have.
+
+## 1. Record and build with your agent
+
+Give your agent the app URL, the operations you need, your browser's executable
+path, and an output directory. For an app with folders, adapt this prompt:
+
+```text
+Use REA to build an AgentEnv environment from my test web app at
+http://127.0.0.1:3000. Cover listing, creating, renaming, and deleting folders.
+You may create and remove test folders. Leave the existing data unchanged.
+
+Sign in as admin using the password in APP_PASSWORD. Use the browser at
+/absolute/path/to/chromium. Save the environment to
+/absolute/path/to/my-env, which does not exist yet.
+
+Record the session, check which operations the environment supports, and
+export it. Report any unsupported operations and what is missing.
+```
+
+Replace the URL, account, paths, and folder operations with your own. Set
+`APP_PASSWORD` in the environment that starts REA's MCP server so REA can use
+it without putting the password in the prompt.
+
+Your agent inspects the app, records a session, checks the result, and exports
+a folder containing the runnable environment. It reports which operations
+work and which need more evidence. The app is used during recording; the
+exported environment runs from the saved data.
+
+After your agent exports the folder, skip to
+[run the environment](#3-run-the-environment). The next section is an
+alternative for an existing recording.
+
+## 2. Or build from a saved recording
+
+A HAR file records a browser's network requests and responses. Export one
+with API response bodies from your browser's network panel, or use a
+recording you already have. To include create, edit, and delete operations,
+record those actions and the reads that show their results.
+
+Build the environment into a new or empty directory:
+
+```sh
+rea environment-build ./session.har ./my-env --name my-env --json
+```
+
+You can also pass capture Evidence JSON saved by REA's
+`capture-browser-scenario` or `inspect-web-network-capture` commands. Here,
+Evidence means REA's saved recording with its source information. The build
+accepts HAR files and those JSON recordings. It reads local data and writes
+the environment folder without contacting the app.
+
+Add `--dry-run` to review the build report without writing the folder. For an
+unreleased REA checkout, use `--package-tarball` with its packed package so
+the exported environment runs the same implementation.
+
+The build report tells you what the environment supports:
+
+| Report field      | What to check                                                                                                            |
+| ----------------- | ------------------------------------------------------------------------------------------------------------------------ |
+| `state`           | Whether the environment can answer from local state or uses recorded-response replay.                                    |
+| `coverage.reads`  | Which read operations use state and which replay recorded answers.                                                       |
+| `coverage.writes` | Which create, edit, and delete operations are supported. Each withheld operation includes a reason and a recording hint. |
+| `warnings`        | Recorded content or local paths to review before sharing the folder.                                                     |
+
+A successful build means the folder was created. Check the report to confirm
+it supports the operations your tasks need. `coverage: null` means the build
+could not prepare state for this environment and it will use replay.
+
+## 3. Run the environment
+
+Whether your agent exported the folder or you built it from a HAR, run it
+with AgentEnv:
+
+```sh
+agent-env run ./my-env
+```
+
+Use the folder path your agent reported if it differs. The first run builds
+the container image, so it needs access to the image and package sources.
+
+REA includes a basic test, called the smoke task. It checks the expected tool
+count and, when a suitable read tool exists, calls it and checks its response
+status. Passing this test shows the environment starts and responds in the
+tested setup. It does not yet score an agent on an application task.
+
+The folder contains the recording, a tool manifest describing the available
+operations, a Dockerfile, environment configuration, and the test. The
+[export reference](agent-environments.md#export-a-bundle) describes each file.
+
+## 4. Add tasks and reward checks
+
+Start with one task the exported tools support. Give it a clear goal and a
+checkable result. For example, if folder creation is supported, ask your
+agent:
+
+```text
+Use this exported environment to add an AgentEnv task that asks an agent
+to create a folder named Practice. Check the saved environment state to
+confirm the folder exists with that name, and use that check to score the
+result. Reset the environment before each run so attempts start with the
+same data. Use the AgentEnv task and verifier formats.
+```
+
+This asks your agent to help build the task and its grading check around the
+environment REA generated. A retrieval task might check an answer against a
+recorded value. A task that changes data should check the resulting state.
+When state is available, the environment supports reset, load, and read-back
+operations for repeatable runs.
+
+Use the [AgentEnv documentation](https://www.agentenvframework.com/docs) for
+task configuration, agent connections, scoring, and execution. Connect the
+resulting tasks to your chosen RL training workflow.
+
+## Improve an operation that is missing
+
+For REA to support a change, the recording needs to show what happened before
+and after it. When recording against your test app:
+
+1. Read the list and an existing item before making changes. Repeat the
+   initial reads to show which values change independently.
+2. Create a test item, read it back, and read the list before the next change.
+   Repeat with a second item and different text.
+3. Edit each test item, then read the item and list again. Leave more than a
+   second between creation and the first edit to show time-dependent changes.
+4. Delete the test items, then read them back and read the list to confirm
+   their removal.
+
+Also record filters, searches, sorting, and paging if your tasks need them.
+The agent should check that every recording step completed before using it.
+The [recording workflow](https://github.com/morluto/rea/blob/main/.agents/skills/reverse-engineer-anything/references/environments.md)
+has the detailed browser instructions, including timeouts and handling IDs
+assigned by the app.
+
+Use the report's hints to decide what to record next:
+
+| Reason                          | Next step                                                                                |
+| ------------------------------- | ---------------------------------------------------------------------------------------- |
+| `unconfirmed`                   | Read the item and its list after the change.                                             |
+| `no-state-target`               | Record reads of the collection or item the operation changes.                            |
+| `no-observation`                | Read back a created item. For an edit or delete, also read it before changing it.        |
+| `contradicted` or `side-effect` | Inspect the reported disagreement. The operation may need behavior REA cannot model yet. |
+
+See the [full reason table](agent-environments.md#build-a-bundle-in-one-step)
+for the other cases. Rebuild from the new recording and check the report
+again. A new recording replaces the build input; combining separate recording
+sessions is not supported.
+
+## Compare with the original app
+
+For a stronger check, record a separate sequence of calls against the real
+app, starting from the same test data as the original recording. This is a
+probe. Restore that starting data before each probe sequence, then compare
+the saved probe recordings with the environment:
+
+```sh
+rea environment-compare ./my-env/envs/my-env/manifest.json \
+  --evidence ./my-env/envs/my-env/evidence.json \
+  --probe ./probe-create-edit-delete.json --probe ./probe-reads.json --json
+```
+
+Each probe file must be capture Evidence JSON from REA. The comparison runs
+offline and reports differences in responses, unsupported calls, and missing
+observations. It accounts for supported differences in IDs, times, and
+modeled generated values. Agreement applies to the calls those probes check.
+See the [comparison reference](agent-environments.md#measure-fidelity-against-the-application)
+for the exact rules.
+
+## Before sharing the environment
+
+The exported folder includes retained response bodies and local source paths.
+Standard authentication headers are excluded, but custom headers, query
+values, and body tokens can remain. Review the content you plan to share.
+Credential-name warnings point to values worth reviewing; they do not remove
+those values or establish that the recording contains no credentials.
+
+For direct MCP serving, replay behavior, state controls, and resource limits,
+see the [environment reference](agent-environments.md). The
+[implementation index](specs/agent-environments/README.md) links the contributing
+PRs and their verification records.
@@ -1,16 +1,27 @@
 # Agent environments from recorded captures

-Use `rea environment-serve` to serve an environment manifest as an agent
-environment: an MCP server whose tools answer from what one retained web
-network capture observed, plus the environment card the agentenv framework
-reads to discover it. By default the server derives the
-[state the capture observed](#the-state-a-capture-observed) at startup and
-answers read tools from it, and the write tools whose effect the capture
-confirmed by changing it; `--replay-only` replays the capture's records
+For a first environment, start with the
+[quickstart](agent-environments-quickstart.md): record an app or use a saved
+session, build and run the environment, and add tasks and reward checks.
+The [implementation index](specs/agent-environments/README.md) links
+the contributing PRs and their verification records. This page is the detailed
+command and behavior reference.
+
+Use `rea environment-build` to turn one recorded capture into an agent
+environment bundle in one offline step: a folder `agent-env run` builds and
+runs, whose MCP server answers from what the capture observed. See
+[Build a bundle in one step](#build-a-bundle-in-one-step).
+
+The steps it composes are separate commands too. `rea environment-serve` serves
+an environment manifest as an agent environment: an MCP server whose tools
+answer from what one retained web network capture observed, plus the
+environment card the agentenv framework reads to discover it. By default the
+server derives the [state the capture observed](#the-state-a-capture-observed)
+at startup and answers read tools from it, and the write tools whose effect the
+capture confirmed by changing it; `--replay-only` replays the capture's records
 instead. Nothing is fetched from the recorded application; every answer comes
 from retained Evidence. `rea environment-export` writes the same pair as a
-bundle folder `agent-env run` builds and runs; see
-[Export a bundle](#export-a-bundle).
+bundle folder; see [Export a bundle](#export-a-bundle).

 ```sh
 rea inspect-web-network-capture /absolute/session.har har --format json > capture.json
@@ -36,6 +47,186 @@ The third command serves that manifest from the state it derives from the
 capture; see [Serve from the state](#serve-from-the-state). Both served files
 are complete REA Evidence JSON as the commands write it with `--format json`;
 the `evidence` member of `view.json` is the whole of `capture.json`.
+A `view.json` can also name the capture file as
+`{"kind": "evidence-file", "path": "capture.json"}`, which projects it as
+retained Evidence instead of charging the whole capture as inline input.
+
+## Build a bundle in one step
+
+```sh
+rea environment-build grafana.har ./grafana --json
+agent-env run ./grafana
+```
+
+`rea environment-build <capture> [directory]` takes a `.har` file, or capture
+Evidence JSON from `inspect-web-network-capture` (HAR) or
+`capture-browser-scenario`, and writes the bundle
+[Export a bundle](#export-a-bundle) describes. It inspects a HAR as
+`inspect-web-network-capture` does (Evidence input skips this), projects the
+environment manifest from that Evidence as retained Evidence, authenticates
+the pair, prepares the state the bundle's server derives at startup, and
+writes the bundle with the export. For the same capture path, every file it
+writes is byte-identical to what `inspect-web-network-capture`,
+`inspect-analysis-view` and `environment-export` write, Evidence ids included,
+when `view.json` lists the same rules in the views' order and the export is
+given the build's name. It reads one file and writes one folder: it fetches
+nothing and launches no browser (HAR inspection runs REA's own decoder
+process), so record a browser scenario with `capture-browser-scenario` first
+and pass its Evidence. Other capture formats are refused, as the manifest view
+refuses them, and a HAR document saved as `.json` is refused with a hint to
+name it `.har`.
+
+- `--template-rule <rule>`, repeated, replaces the default opt-in rules
+  `after-uid-literal`, `opaque-token`, `sibling-variance` and
+  `prefix-variance`, the rules the published capture-built environments use;
+  `--format-rules-only` applies none, the views' own default. Rules apply in
+  the views' fixed order, the report lists them, and a repeated rule is
+  refused as the views refuse it.
+- `--name` names the env folder and env id. Without it the name is the
+  manifest's, unless the capture's origin is a loopback name or an IP literal:
+  the capture file then names it (`grafana.har` and `grafana.capture.json`
+  become `grafana`) and a `name-from-file` warning says so. A file name that
+  yields no portable label (kebab-case, at most 63 characters for a DNS service
+  label, not a Windows device name or a label interpreted as an IP address) is
+  refused; pass `--name`.
+- `--package-tarball` works as for the export, and `--capture-timeout-ms`
+  as for `inspect-web-network-capture`.
+- `--dry-run` runs every stage and prints the report with `status: "planned"`
+  and the files a build would write, but writes nothing and does not check the
+  directory, which may then be omitted. It reads and hashes a
+  `--package-tarball` as a build does before copying it, so it refuses the
+  tarballs a build refuses, including one whose contents cannot be read.
+
+The directory must be absent or empty, as for the export; the build never
+replaces a folder. A refusal before the write leaves nothing behind. A capture
+Evidence file, an inspected HAR's Evidence and the projected manifest must each
+fit the live heap headroom for parsing and sealing, checked before the file is
+read or the Evidence serialized; one that does not is refused as
+`resource_constraint`. Each
+refusal names its stage: `environment-build` for the build's own checks,
+`inspect_web_network_capture` and `inspect_analysis_view` for inspection and
+projection, `environment-export` for the bundle. SIGINT cancels the build
+(`cancelled`); before the bundle stage nothing is written, and a cancellation
+during the write names the bundle it wrote. Stage progress is logged to stderr
+at info level; the report is the only output on stdout:
+
+```json
+{
+  "status": "built",
+  "directory": "/work/grafana",
+  "name": "grafana",
+  "capture": {
+    "evidence_id": "ev_…",
+    "operation": "inspect_web_network_capture",
+    "records": 105,
+    "input": "har"
+  },
+  "manifest": {
+    "evidence_id": "ev_…",
+    "tools": 48,
+    "excluded_groups": 0,
+    "template_rules": [
+      "after-uid-literal",
+      "opaque-token",
+      "sibling-variance",
+      "prefix-variance"
+    ]
+  },
+  "state": { "served": true, "evidence_id": "ev_…" },
+  "coverage": {
+    "reads": {
+      "state": 36,
+      "recorded": 6,
+      "recorded_reasons": { "query-varies": 3, "…": 1 }
+    },
+    "writes": {
+      "served": [{ "tool": "delete_folders_by_uid", "effect": "delete" }],
+      "withheld": [
+        {
+          "tool": "post_folders",
+          "effect": "create",
+          "reason": "unconfirmed",
+          "hint": "No later read showed the effect. Read the entity and its list after the write.",
+          "exemplar_ordinal": 94,
+          "contradicted_by": null
+        }
+      ]
+    }
+  },
+  "tool_count": 37,
+  "package_source": { "kind": "registry", "specifier": "rea-agents@…" },
+  "files": [{ "path": "README.md", "bytes": 4210 }],
+  "warnings": [{ "code": "name-from-file", "message": "…" }],
+  "next": ["agent-env run /work/grafana"]
+}
+```
+
+`coverage` is the state's read views and write plans summarized, and `null`
+when the state is unavailable and the bundle serves replay. The
+[environment coverage](web-network-captures.md#environment-coverage) view
+reports the same summary for any capture without building, so an agent can
+check it after each recording. The view summarizes the state as derived; it
+does not apply the serve-time admission checks, so for an environment whose
+served catalog exceeds the discovery budget, or whose state exceeds what
+`data/add` loads, it still reports the state while the build reports `coverage:
+null` and the bundle serves replay. Each withheld write carries a hint about
+what to record next; hints never change what is served:
+
+| Reason                | Hint                                                                                                                                                                                                                                             |
+| --------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ |
+| `no-state-target`     | The write's path names no collection or item the capture reads. Read the collection or item it changes.                                                                                                                                          |
+| `no-call`             | No recorded call of this tool was modelled, for example because every call failed. Record a successful call.                                                                                                                                     |
+| `body-unusable`       | The retained request or response cannot be modelled. Record a successful call with a complete supported request and reproducible response.                                                                                                       |
+| `no-observation`      | Nothing showed the entity or document this write changed. Read a created entity back by id right after the write; for an update or delete the state must already hold the entity, so read it before the write or record the create that made it. |
+| `unexplained-change`  | The write changed fields it did not send, in a way no rule explains. A second, different call of the same tool can show the pattern.                                                                                                             |
+| `contradicted`        | A later read disagreed with the modelled effect. Check the read at contradicted_by.                                                                                                                                                              |
+| `side-effect`         | The write changed something besides its own entity, which the environment does not model.                                                                                                                                                        |
+| `unconfirmed`         | No later read showed the effect. Read the entity and its list after the write.                                                                                                                                                                   |
+| `incomplete-entities` | The write is confirmed, but the views that show its entity cannot render it in full. Read the written entity through every view that lists it.                                                                                                   |
+
+The bundle ships `evidence.json`, the whole capture Evidence, response bodies
+included. Inspection excludes the values of the standard authentication headers
+(`Authorization`, `Cookie` and `Set-Cookie` among them) and URL userinfo; a
+custom key header such as `X-Api-Key`, a token in the query string and tokens
+an application returns in bodies remain. The environment views refuse captures
+inspected with `--sensitive-value`, so scrub a capture before building it. The
+report's `credential-named-members` warning counts recorded header names, query
+parameter names and JSON or form body members whose names look like
+credentials (whole name segments such as `token`, `secret`, `password`,
+`api_key`, `authorization` or `session`) and hold a value, and lists the first
+20 by record and pointer, never by value. A body is read as a form or as JSON by
+its recorded media type, or by its shape when it has none or one naming
+neither. A browser scenario is
+scanned by event (`event 4 response /token` names
+`normalized_result.events.items[4]`): every retained request and response
+content event, including a response whose request began before the browser was
+attached and a transaction no record represents, and each transaction URL's
+query once. Bodies larger than 4 MiB of UTF-8 text are not
+scanned; `credential-scan-incomplete` counts them and lists up to 20 record or
+event pointers, including base64 bodies whose decoded scan was cut. An empty name
+warning does not establish that these bodies were checked. Names do not establish sensitivity,
+so the build never refuses on them. Capture
+
+Evidence also records the capture file's absolute path (`subject.local_path`,
+`parameters.capture_path`, `locations`, `artifact.path`), and the bundle
+carries it: build from a neutral folder when that path should not ship.
+
+Over MCP, `export_environment_bundle` builds the same bundle and returns the
+same report. Its `source` is capture Evidence the session retained
+(`{"kind": "retained-evidence", "evidence_id"}`), such as a
+`capture_browser_scenario` or `inspect_web_network_capture` result, or a
+capture Evidence file (`{"kind": "evidence-file", "path"}`); inspect a HAR with
+`inspect_web_network_capture` first. Retained Evidence is written into the
+bundle as `--format json` writes it, so the bundle is the one
+`environment-build` writes from that file. `output_directory` must be an
+absolute path that does not exist yet, whose parent does; the tool creates it
+and refuses an existing directory, empty or not. `name`, `template_rules`,
+`package_tarball` and `dry_run` work as `--name`, `--template-rule`,
+`--package-tarball` and `--dry-run` do, and retained Evidence has no file to
+name the environment after, so a loopback or IP origin needs `name`. Unlike
+`--dry-run`, `dry_run` still checks `output_directory`. Destination refusals
+name `export_environment_bundle`; the others name their stage as
+`environment-build`'s do.

 ## From a browser scenario

@@ -125,6 +316,51 @@ the replayed body is the bytes the browser exposes for each response, with any
 declared secret replaced by its redaction marker (a body that redaction had to
 empty replays no body).

+To record writes, sign in through the UI and then send the application's API
+calls with [request steps](browser-scenario-contract.md#request-steps): each
+sends one request to the start origin through the page's own `fetch`, with the
+session's cookies, and a header can carry the CSRF cookie or stored token the
+application's own requests send. A write is served only when the capture shows
+its effect, so read each collection before writing, read every written entity
+back by id and in its list right after the write, and leave more than a second
+between a create and its first edit. A request step's path is fixed when the
+scenario is written and cannot use a value an earlier response returned, so an
+id must be known before the run: one the caller chooses, such as a `uid` in the
+create body, or one an earlier scenario created. When the server assigns ids,
+read the list after each create (the create's response or the list shows the
+new entity), and record updates and deletes in a second scenario that reads
+the first one's objects by id before editing them, or make them through the
+UI. The environment coverage view names each
+write it withholds and what to record next. A scenario with write requests
+changes the application's data: record against an instance whose data may
+change.
+
+```json
+{
+  "step_id": "create-folder-1",
+  "action": "request",
+  "method": "POST",
+  "path": "/api/folders",
+  "headers": [
+    {
+      "name": "X-CSRFToken",
+      "value": { "source": "cookie", "name": "csrftoken" }
+    }
+  ],
+  "json": { "title": "Scratch folder 1" },
+  "expected_status": [200, 201]
+}
+```
+
+Each record takes its start and duration from the browser's timing (the time
+the scenario observed the request where the browser reported no start), so the
+state orders and overlaps
+records as it does a HAR's and learns a write clock: an update the application
+stamps with a modification time can be served. A scenario captured before
+these times were recorded has none; its records keep request order and the
+state learns no clock, so such updates stay `unexplained-change` until it is
+recorded again.
+
 ## What a manifest is

 An environment manifest is a projection of one application's recorded request
@@ -433,7 +669,7 @@ Each read tool answers according to its view in the state:

 | View       | Answer                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                               |
 | ---------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ |
-| `item`     | The entity the path arguments name, rendered into the recorded envelope of `envelope_ordinal`. Arguments match as replay matches them: each collection segment equals the held collection's segment as written or after percent-decoding, and the identity is the last argument percent-decoded, then as written; values are never re-split on `/`. Any entity the state holds answers, including one `data/add` loaded; query arguments only decide `replay.exact_match`, except that a call matching one of the view's `projected_query_keys`, or on a view with `projected_record_ordinals` asking for some fields only with a value other than `*` no checked line gave or one a replayed read gave, replays its recording. An entity the state does not hold answers the tool's latest recorded 400, 404 or 410 response with `state.view` `missing`, or is a tool error when none was recorded; one lacking a field every recording carried is a tool error, unless a read showed the application leaves that field out; a body is never invented.                                                                                                                                                                                                                                                                                                                             |
+| `item`     | The entity the path arguments name, rendered into the recorded envelope of `envelope_ordinal`, whose `per_response_members` (such as a request id), like a list's or a document's, keep their recorded values. Arguments match as replay matches them: each collection segment equals the held collection's segment as written or after percent-decoding, and the identity is the last argument percent-decoded, then as written; values are never re-split on `/`. Any entity the state holds answers, including one `data/add` loaded; query arguments only decide `replay.exact_match`, except that a call matching one of the view's `projected_query_keys`, or on a view with `projected_record_ordinals` asking for some fields only with a value other than `*` no checked line gave or one a replayed read gave, replays its recording. An entity the state does not hold answers the tool's latest recorded 400, 404 or 410 response with `state.view` `missing`, or is a tool error when none was recorded; one lacking a field every recording carried is a tool error, unless a read showed the application leaves that field out; a body is never invented.                                                                                                                                                                                                             |
 | `list`     | When the arguments name one of the lines the view checked exactly (its latest recordings before the first related write; every path and query value equal to the recording's, and every recorded query parameter supplied), that recorded envelope with its array rendered from the state: every entity of the collection in state order for `membership: "all"` or a line `all_record_ordinals` names, or the recorded members still held. A call with no query argument answers from such a line of the collection its path arguments name that only pages its list, with `replay.exact_match` false. On a line the view's `query` answers, and for a call whose every query argument has a role there (an argument-less call aside), the answer is the query evaluated over the state: filtered, searched, sorted and paged, with counters at the number listed and `query.totals` at the number matched, and `state.membership: "query"`; such a call answers on a query or whole line of its collection with `replay.exact_match` false. A value an `inert` parameter never recorded, a parameter without a role, a call matching one of the view's `projected_query_keys`, or a field selection the checked lines do not show (as for `item`), replays its recording. A member lacking a field every recording carried makes the call a tool error rather than a partial list. |
 | `document` | When the arguments name the document's checked line exactly, the state's value for it; a tool error when the state holds none.                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                       |
 | `recorded` | The recording, as replay answers it.                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                 |
@@ -451,6 +687,21 @@ An item or list view that always spells a clock field otherwise than the
 entity's stored value names that spelling in `clock_formats`, and a value it
 never recorded, such as a created entity's clock, is rendered in it: a list that
 writes `+00:00` where item reads write `Z` lists a new entity the same way.
+A view that names a field in `sorted_arrays` lists that string array sorted, as
+a read-back showed the application does, while the state keeps it in the order
+it was written, so a write's own answer echoes it. If a later counted read
+contradicts that ordering, the view stays recorded and its earlier reads no
+longer confirm served writes. A view that names a field in `nested_fields`
+always showed that field's objects with the same keys, in any order, and fewer
+than an entity stores, such
+as a list showing a parent without the parent's own nested type; a stored
+object it never recorded, such as a created entity's parent, is rendered with
+those keys. Members a view names in
+`per_response_members`, such as a request id each response mints, keep the
+value its recording carried. A list's `counters` and `query.totals` are
+top-level members or members one level down in a paging object
+(`/pageInfo/totalRows`); either is set to the number listed or matched, and
+members beside it such as `isLastPage` stay as recorded.

 A list or document call that names no checked line, including a line recorded
 after a write or with other query values, answers from the recording. Every
@@ -480,20 +731,38 @@ tools are not served, so no call claims a change it does not make; each one's
 plan states why in its `reason`. A served write changes the live state, which
 every MCP session and `data/get` then see:

-| Effect     | Call                                                                                                                                                                                                                                 |
-| ---------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ |
-| `create`   | Adds an entity to the collection the path names, built from the observed entity with each ruled field taken from the call or generated, at the plan's `insert` position. A plan tied to its exemplar's collection writes only there. |
-| `update`   | Sets the sent members on the entity the path names, constants for members accepted only with their recorded value, and the clock, increment, slug, unique and renewed changes the plan models.                                       |
-| `delete`   | Removes the entity the path names.                                                                                                                                                                                                   |
-| `document` | Merges the body into the plan's document object, or replaces it for `PUT`.                                                                                                                                                           |
+| Effect                    | Call                                                                                                                                                                                                                                                                                                                 |
+| ------------------------- | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
+| `create`                  | Adds an entity to the collection the path names, built from the observed entity with each ruled field taken from the call or generated, at the plan's `insert` position. A plan tied to its exemplar's collection writes only there.                                                                                 |
+| `update`                  | Sets the sent members on the entity the path names, constants for members accepted only with their recorded value, and the clock, nested clock, increment, slug, stamp, derived, composed, reference, unique and renewed changes the plan models.                                                                    |
+| `update` (action)         | A `POST`, `PUT` or `PATCH` to an item path plus an action segment (`/{type}/{id}/archive`) sets, on the entity before the segment, each scalar the recorded calls showed the action set (`set`), with any sent members; it is served only when a recorded call found those fields already set, so a toggle never is. |
+| `delete`                  | Removes the entity the path names.                                                                                                                                                                                                                                                                                   |
+| bulk `update` or `delete` | A `DELETE`, `PUT` or `PATCH` at a collection, or a `POST` to it plus `delete`, `remove` or `destroy`, applies its effect to every entity the body names, as recorded: an array of ids or of objects carrying the id field, at the root or as the body's one array member (`{"IDs": […], "Read": true}`).             |
+| `document`                | Merges the body into the plan's document object, or replaces it for `PUT`.                                                                                                                                                                                                                                           |
+
+An update's unsent changes follow the plan's rules. A `held-clock` is a clock
+the client sends back as it read it and the application stamps anew (Ghost's
+`updated_at`): the call must send the entity's value and the field takes the
+write's clock. A `nested-clock` sets the clocks inside an object the entity
+holds, in that object's recorded format. A `stamp` writes the acting user
+the entity already names under its `created…by` counterpart into a
+`modified…by` or `updated…by` field. A `derived` field takes a value showing
+the one sent member's text that the entity stores nowhere (a field Ghost
+derives from `html`), only with that member's recorded value. An action's
+`set` rule sets a scalar to the value the recorded calls left it at.

 Its answer has the status and content type of the plan's recorded response,
 with the written entity or its identity rendered in, no body, or the recorded
 body. A call whose body is not an object, sends a member the capture did not
 show stored, sends a fixed member with another value or a member of another
 JSON type, or lacks a required member is a tool error naming the accepted
-members; so is a rendered answer missing a field the recorded response
-carried, and an update or delete of an entity the state does not hold answers
+members; so is a call sending query parameters other than the exemplar's (they
+may change what the body does), a body not wrapped in the exemplar's envelope
+(Ghost's `{"posts": [{…}]}`), a bulk call naming an id the state does not hold,
+a `held-clock` member sent with another value than the entity holds, a call
+sending a `derived` rule's member to an entity that does not hold the value the
+recorded call found, a nested clock on an entity holding no such object, and a
+rendered answer missing a field the recorded response carried, and an update or delete of an entity the state does not hold answers
 the recorded 400, 404 or 410 of the tool or of an item view of the type, if
 any. A refused call leaves the state unchanged. Values a write generates are
 deterministic: the clock starts at `write_clock` and advances one second per
@@ -502,7 +771,8 @@ largest they generated, and UUIDs and tokens derive from the state Evidence
 id, tool, field and write count, skipping held values. `data/reset` and
 `data/add` restart the clock, counter and sequences, so the same calls after a
 reset give the same state. Answers carry `state: {"source": "state", "view":
-"create" | "update" | "delete", …}` or `"document-write"`.
+"create" | "update" | "delete", …}` or `"document-write"`; a bulk answer adds
+`ids`, every entity it wrote in body order, with `id` naming the first.

 The data plane serves three JSON-RPC methods:

@@ -602,8 +872,9 @@ names a `document` view once, at its initial document's `path`. The `version`,
 and the `state_evidence_id` and `types` that `data/get` reports, must match
 the served state, so a `data/get` result loads back unchanged. A number without
 an exact native value, or whose serialized spelling would not be read as exact
-(an integer from 2^53 below 1e21, such as `1e20`, in any spelling), or a
-`__proto__` member is refused rather than altered.
+(an integer from 2^53 below 1e21, such as `1e20`, in any spelling), is refused
+rather than altered. Caller data preserves all own JSON members, including
+`__proto__`; unknown members of the state document's structure are refused.
 An invalid document is `-32602` naming the first problem by JSON pointer, as in
 `/rea_state/entities/3/collection` (also in `error.data.path`); a problem
 inside caller data (`fields`, `value`, `types`) is located at that member, so
@@ -657,6 +928,25 @@ after an update and referential rules on delete are not modelled. An exported
 bundle carries no state file: its server derives the state at startup, as the
 export does to predict what it serves.

+Known limits of served writes:
+
+- A recorded view answers from its recordings after a served write: Mailpit's
+  `get_messages`, recorded as `list-differs`, still lists a message a served
+  delete removed.
+- Served n8n workflow updates accept any `versionId`, while served Ghost post
+  updates require `updated_at` to match the entity (a `held-clock`).
+- A slug derived from a title can repeat across served creates with the same
+  title, where the application would make it unique.
+- A `composed` string copies sent text as sent: an application that escapes or
+  renders it (HTML entities, Markdown) differs for text that needs it, as
+  BookStack's `description_html` would for a description holding `&`.
+- A served create's sequence id is the state's next value, not the gaps an
+  application's own sequence would leave.
+- Nested clocks are served in the spelling of the write's own response, which
+  can differ from what a later read of the application shows.
+- A served write to an entity that a replayed (unserved) create made answers
+  as for a missing entity, since the state never held it.
+
 ## Export a bundle

 `rea environment-export` writes the same pair as a bundle folder the agentenv
@@ -693,7 +983,8 @@ serves replay. The complete tool catalog the bundle serves must also fit the
 server's advertised catalog budget before any files are written. Privately parsed JSON is sealed once so authentication
 and replay share immutable response trees rather than copying the capture repeatedly.
 `--name` replaces the manifest's portable kebab-case name as the env folder and env id
-(Windows device names such as `con` and `lpt1` are refused);
+(at most 63 characters for its DNS service label; Windows device names and
+labels interpreted as IP addresses are refused);
 `--package-tarball <path>` copies a packed `rea-agents` tarball into the env
 folder and makes the Dockerfile install it instead of the registry package and
 remove it in the same layer, which is how a checkout rather than a release is
@@ -711,7 +1002,12 @@ Windows inherits ACLs and REA does not establish owner-only access there. Choose
 an already private Windows destination when captured content needs it.

 The Dockerfile sets `MCP_HOST=0.0.0.0` and `MCP_PORT=18765`, the port the
-framework maps for an MCP server env; the framework's own deploy supplies
+framework maps for an MCP server env, and `MCP_ALLOWED_HOSTS` naming the loopback
+addresses and the environment name, because the container binds outside loopback
+and the server refuses to serve on such a bind without an operator-declared
+allowlist: the framework's published port is reached over loopback and its
+gateway proxies to the env container by the compose service name (the
+environment name). The framework's own deploy supplies
 `MCP_HOST`, `MCP_PORT` and `ENVIRONMENT_NAME`, so the served card carries the
 env's name. It installs Debian's `python3` because the framework's local
 sandbox probes a container's readiness with `python3` inside it, which the slim
@@ -784,9 +1080,11 @@ Numeric arrays retain that containing field's clock context through nested
 arrays; an object's own fields establish their own context. Numeric values at
 the body root, in root arrays, or under measurement fields remain literal.

-Generated strings normalize only where this confirmed, served write's entity
-response rules identify generation. A `unique` rule or UUID identity rule must
-still compare two UUIDs; a `renewed` rule applies only at its recorded pointers,
+Generated values normalize only where this confirmed, served write's entity
+response rules identify generation. A UUID identity rule must still compare two
+UUIDs, and a `unique` rule two UUIDs or two generated integers (10 to 20
+digits) of one JSON kind and length; a `renewed` rule applies only at its
+recorded pointers,
 with `*` matching actual array items. Token/sequence strings retain the existing
 format check: equal length of at least eight, the same character classes, and
 a digit. Numeric sequences continue to compare literally unless an ID mapping
@@ -798,6 +1096,12 @@ Admitted generated values must also preserve aliases and distinct identities
 within that response. UUID identity uses the generator's case-insensitive
 matching; token and sequence strings retain their literal identity. This
 correspondence ends with the answer and is not inferred across calls.
+A `composed` response field must spell the value its parts build from that
+response's own fields. Its parts then compare by their rendered text or their
+source fields' clock and ID rules. A coherent archive URL can therefore differ
+only in normalized clock digits without reporting a value difference; an
+incoherent URL still differs even when both sides repeat the same stale text.
+Normalized compositions count under `generated`; source fields are counted once.
 The report counts each kind of normalised
 value; the generation rules remain model-derived facts, rather than new
 observations of the application.
@@ -34,6 +34,53 @@ One-shot CLI output remains complete. Older servers require the existing complet
 request after schema discovery. APK authenticity and runtime behavior remain
 unverified.

+## Manifest component projection
+
+`inspect_android_package` also returns a static inventory of declared
+activities, aliases, services, receivers and providers from the decoded
+manifest. `declared_name` preserves the source attribute; `name` resolves a
+relative name only when the manifest package is known and the resolved copy
+fits the UTF-8 byte budget. An unresolved package or exhausted name budget
+retains the declared name and marks the inventory partial. Empty component
+names and names with forbidden DEX characters retain their raw spelling and
+are not treated as identities. Valid DEX spaces, including boundary spaces,
+are preserved when resolving component names and matching alias targets.
+Whitespace in the manifest package is rejected by its separate package grammar.
+Component permissions inherit the application
+permission when no component permission is declared, except an activity alias
+with no permission: Android documents that case as requiring no permission
+through the alias. `permission_source` distinguishes a local declaration,
+inherited value, no requirement (including an explicit empty override), and a
+value omitted because its resource/manifest-placeholder token is unresolved
+or the total permission-byte budget was reached. Resource and placeholder
+references are not expanded at this parser boundary. Repeated inherited
+values share one inventory-wide byte budget.
+Provider `android:readPermission` and `android:writePermission` overrides are
+not projected as separate fields; their presence marks the inventory partial
+and is called out in `limitations`. Relative component names are not resolved
+against a manifest package with surrounding whitespace.
+Class-name segments follow DEX `SimpleName` characters, including a leading
+digit or hyphen, rather than Java source identifier rules. Relative-name
+expansion does not prove class existence, DEX-version compatibility or runtime
+loadability. SDK defaults accept JADX's decimal and hexadecimal integer
+spellings; the original SDK declaration strings remain unchanged.
+
+`exported` is the declared literal `true` or `false`, otherwise null.
+`exported_default` is the documented default only where it can be established;
+it remains null for unknown provider target SDKs, nonliteral declarations, or
+components with filters targeting API 31 or later that omit the now-required
+explicit declaration. A limitation records the latter validation error.
+Provider authorities and all inventory dimensions are bounded. `status:
+"partial"` and `limitations` identify omitted declarations or values; a
+capacity limitation appears only when an actual collection limit was reached.
+The projection does not merge manifests, expand resource references, or
+observe runtime enabled/export state.
+
+The service `foreground_service_type` field preserves the declared attribute,
+including an empty value or surrounding spaces; `null` means the attribute is
+absent or the component is not a service. This field does not validate service
+type tokens or establish runtime eligibility.
+
 ## Supply tools

 Use a **full JDK 17 or newer** (including its compiler module) and
@@ -147,6 +194,21 @@ queries accept the same `overload_index`; the bridge resolves the selected
 method node and the result reports its index and displayed signature. These
 indices are tied to the current artifact and engine, not stable across builds.

+`inspect_android_class` also reports `dex_static_value` for each `static final`
+field whose class definition encodes a value in its DEX static values, so
+compile-time constants are readable even when the class has no `<clinit>`.
+Each value is typed: `boolean`, `byte`, `short`, `char` (UTF-16 code unit) and
+`int` values are JSON booleans or numbers, while `long`, `float` and `double`
+values are strings holding Java's text for the value, so 64-bit values stay
+exact. The field reports `null` when no value is encoded, the encoded value is
+null or of another kind, or the field is not `static final`. The value is read from parsed
+metadata without generating source, and a static initializer can still assign
+the field; use `inspect_android_method` on `<clinit>` for that evidence.
+Only `inspect_android_class` asks the bridge for these values.
+`inspect_android_method` and `trace_android_references` read the member-only
+class summary, so large encoded strings cannot push their member lookup past
+the 8 MiB protocol frame limit.
+
 Smali fallbacks select one complete block using the original method name and DEX
 descriptor, before applying the source byte limit. This preserves the selected
 overload even when Java code generation renames a method. If the selected Java
@@ -193,6 +255,13 @@ the same source byte limit and explicit truncation reporting.
  full reported display types, fields and inner class names. Synthetic members
  that code generation hides can appear in the inventory; it stays consistent
  after method decompilation within the retained session.
+  Class and method inspection and reference tracing accept either the exact
+  reported class name or its original binary name, including `$` in nested and
+  anonymous classes. The bridge keeps both identities from JADX; it does not
+  replace separators or guess suffix matches. Ambiguous selectors are refused.
+  Follow-up calls preserve the selected name, while results report the frozen
+  JADX display name. Quote `$` names in the shell, for example
+  `'com.example.Manager$WorkerThread'`.
  Exact DEX prototypes are reported from frozen JADX method metadata as
  `dex_descriptor`, for example `(I)V`. Display names can be JADX aliases;
  the descriptor alone is not a complete raw DEX method ID. Overload indices
@@ -346,11 +415,17 @@ export REA_JADX_OPERATION_TIMEOUT_MS=600000

 The value must be a decimal millisecond count from 1 to 2147483647; anything
 else is refused before Java starts. REA reads it from the environment captured
-at process start. A change applies on the next process start; an already
-running server keeps the deadline it started with. The same deadline bounds
-each upstream call. A timeout names `REA_JADX_OPERATION_TIMEOUT_MS`, the
-effective milliseconds, and that range. A passing JADX configuration check in
-`rea doctor` reports the effective `operation_timeout_ms`. Explicit
+at process start. Changing that environment requires a new REA process. On a
+running MCP server, set `jadx.operation_timeout_ms` through
+`update_analysis_settings` to change the default for newly accepted operations;
+queued or running operations retain their accepted budget. The same deadline
+bounds each upstream call. Timeout recovery reports the effective milliseconds
+and range, with `details.limit` identifying the runtime setting. An invalid
+provider-local launch value can also be repaired by a runtime override; reset
+exposes that invalid launch value again. See the
+[settings design](design/limits-and-recovery.md#invalid-launch-configuration).
+A passing JADX configuration check in `rea doctor` reports its launch-derived
+`operation_timeout_ms`; it does not inspect another running server's overrides. Explicit
 cancellation still ends the operation immediately, and partial observations
 and owned-process cleanup are unchanged. Raising the deadline does not extend
 the bridge's 30-second startup handshake or the upstream **90-second**
@@ -239,13 +239,19 @@ serialized size of the report together with its limitations (which repeat
 archive names) is then checked against an 8 MiB output budget (the exact check
 is authoritative); an over-budget report is refused, not truncated.

-The whole-file reader retains read chunks and a concatenated buffer; total
-process memory exceeds the selected file's size. It also computes the complete
+The whole-file reader allocates the selected snapshot and bounded read scratch;
+total process memory exceeds the selected file's size. It also computes the complete
 file SHA-256, so inspection is not header-only. Content digests are recomputed
 at most once per SHA-256/SHA-512 algorithm during one inspection. Input,
 inflation, decoded-record and serialized-output bounds keep work finite;
 resource refusals are distinct from malformed format errors.

+If the stable read completes but closing its descriptor fails or is cancelled,
+the error retains `details.partial_observation` with the selected path, complete
+file SHA-256 and byte count. These facts describe the acquired file; they do not
+establish any decoded signing facts. Failed cleanup remains visible until the
+provider releases the descriptor on a cleanup retry.
+
 A file that is not a ZIP is refused as an unsupported target. A damaged ZIP
 (local headers but no end-of-central-directory), a central directory that
 cannot be walked or whose declared record count does not account for all of
@@ -29,7 +29,12 @@ body is parsed only when that string is `"309"`. Other types, including `"288"`
 stackshots, return no crash result.

 `process`, `exception`, `termination`, `faulting_thread`, `threads`, and
-`images` reproduce documented body fields when present. Integers keep their
+`images` reproduce documented body fields when present, including each image's
+`name` and each frame's `symbolLocation` (as `symbol_location`, the byte offset
+from the start of `recorded_symbol`). `termination` keeps the terminating
+process as `by_proc` and `by_pid` and its `flags`; `process.parent_pid` keeps
+`parentPid` next to `parent`; and `metadata` keeps `build_version` and
+`platform`. Integers keep their
 decimal literals and a hexadecimal form, including arm64e registers above
 2^53. Frame roles follow the recorded frame index: row zero of the resolved
 faulting thread is `faulting_instruction`, row zero of other threads is
@@ -38,9 +43,22 @@ address uses that row's own image base and offset. The recorded `inline` flag
 does not supply a missing offset or authorize borrowing another row's address.
 When `faultingThread` is missing or does not resolve to a recorded thread
 object, row-zero roles are `unknown`; the recorded lookup remains available.
+A translated process records Rosetta's registers in a nested
+`threadState.rosetta` object; each one is reported as `rosetta.<name>` and
+counts toward the register budget. A [public ReportCrash `.ips` log](https://github.com/Mortennn/Dozer/issues/189)
+shows `rosetta.tmp2`, `tmp1`, and `tmp0` beside ordinary x86 registers. The
+test fixture quotes that register excerpt inside an authored report body; it
+does not generate a new Rosetta crash during the test.
+Observed JSON strings retain `""`; `null` means the field was missing or JSON
+`null`. This includes image paths, frame symbols, process text, and the older
+string `osVersion` form. Unlisted JSON keys and generic register names also
+retain empty spellings. An empty image architecture remains recorded as `""`
+while `uuid_unknown` stays true, since that spelling does not establish an
+architecture. An empty UUID is malformed, so its exact spelling appears in
+`coverage.type_mismatches` and its canonical UUID remains unknown.
 `process.os_version` keeps the producer's dictionary (`train`, `build`,
 `release_type`, `is_embedded`) or the older string form. Image UUIDs are uppercase 8-4-4-4-12; an all-zero UUID
-or a missing `arch` is `uuid_unknown`. Image `source` letters keep their
+or a missing or empty `arch` is `uuid_unknown`. Image `source` letters keep their
 documented meaning (`P` process, `S` shared cache, `C` shared cache library,
 `K` kernel, `U` kernel cache, `T` kernel text exec, `A` absolute). Keys the
 documentation does not list remain in `unlisted_keys` or `unlisted_body_keys`.
@@ -23,7 +23,7 @@ graph TD
        SESSION["SessionProviderRouter + BinarySession<br/>one immutable deep binding per target<br/>disjoint auxiliary routing"]
        REGISTRY["AnalysisProviderRegistry<br/>sorted deep candidates<br/>deterministic selection, no fallback"]
        RECORDS["src/application/investigation/<br/>composed InvestigationRecords + narrow ports<br/>EvidenceLedger and Unknown ownership"]
-        SNAPSHOT["BinarySessionRecords + AnalysisSnapshotCache<br/>binary target/profile snapshots<br/>compatibility facade and post-commit notifications"]
+        SNAPSHOT["BinarySessionRecords + AnalysisSnapshotCache<br/>binary target/profile snapshots and session file ownership<br/>record coordination and post-commit notifications"]
        JS_RECON["src/application/javascript/ + src/artifacts/javascript/<br/>JavaScript artifact reconstruction<br/>directory/ASAR reads<br/>AST-only bundle projection"]
    end

@@ -75,7 +75,7 @@ graph TD
    end

    subgraph "Domain Layer"
-        DOMAIN["src/domain/<br/>Pure side-effect-free modules<br/>evidence, comparisons, application graphs"]
+        DOMAIN["src/domain/<br/>Pure side-effect-free modules<br/>format declarations, Evidence, comparisons, application graphs"]
    end

    subgraph "Configuration"
@@ -8,9 +8,12 @@ ordinary binary inspection use the same modular capability.

 ## Bring your own engine

-Initial real verification covers **Linux x64, ELF64 x86-64 little-endian
-EXEC/DYN/REL**. Provide an absolute Python executable whose environment already
-contains unchanged pwntools 4.15.0, pyelftools 0.33 and Unicorn 2.1.2:
+Real verification covers **Linux x64** hosts and **EXEC/DYN/REL** objects in
+these profiles: ELF64 x86-64, ELF32 i386, ELF32 little-endian ARM and ELF32
+little- or big-endian MIPS. Other machines, classes and byte orders, including
+AArch64 and big-endian ARM, return `unsupported_target`. Provide an absolute
+Python executable whose environment already contains unchanged pwntools 4.15.0,
+pyelftools 0.33 and Unicorn 2.1.2:

 ```sh
 REA_PWNTOOLS_PYTHON=/absolute/isolated-env/bin/python \
@@ -100,6 +103,8 @@ one section or symbol, or a stable page without re-running the decoder. CLI
 one-shot invocations pass portable inline Evidence JSON; an MCP session uses
 the retained `evidence_id`. Page `limit` is required and bounded by the
 measured MCP stdio budget documented on the tool contract.
+An empty retained section or symbol collection has no valid item index. Its page
+view can still return an empty page.
 Malformed authenticated layout input remains rejected with the owning schema's
 safe field diagnostics under `source.normalized_result`, including the field
 path and type or value reason. Evidence authentication and decoder validation
@@ -94,6 +94,14 @@ content. Actual JSON properties with those names remain content. Reference-only
 objects, unsupported values, and opaque cookie partition identities remain
 incomplete. Previously exported fingerprints are not recomputed; recapture both
 sides when comparing captures produced across this decoder change.
+IndexedDB schema fingerprints with `projection_version: 2` include the observed
+database version and object-store definitions. A missing, malformed, or imprecise
+version leaves the schema fingerprint incomplete while retaining observed store
+facts. Historical fingerprints without this marker covered object stores only:
+matching historical hashes cannot establish unchanged database versions, and a
+historical hash is not compared with a version-bearing hash. Recapture both
+sides for a complete IndexedDB version comparison; other proven storage changes
+remain reportable.

 Script comparison groups observations by reported URL and compares unordered
 content samples. Producer inventory keys include optional metadata, so a changed
@@ -426,6 +434,17 @@ complete Structured Field Item, including parameters such as `report-to`.
 These are declarations, not an assessment of the document's effective policy;
 absent, malformed or non-token items project as `null`.

+Console entries, WebSocket frame summaries, and selected request/response JSON
+shape outputs share one 8 MiB retained-observation allowance per capture. Shape
+inference admits expanded path bytes before allocating those paths, including
+escaped and Unicode property names. Replacing or removing a request's shapes
+refunds their retained charges. A refused body shape preserves network metadata
+and any captured peer shape with `resource_budget_exhausted` coverage; a refused
+WebSocket frame is counted as dropped rather than reclassified as non-JSON text.
+The allowance has no runtime override. Protocol messages and JSON input parsing
+remain subject to their separate transport admission; this output allowance does
+not bound the whole process heap.
+
 REA retains local observation data and removes only URL userinfo credentials, explicitly declared scenario secrets, and values from structured credential/storage fields:

 - URL observations preserve the complete local URL, including query values, fragments, duplicate parameters, and their order. Only username/password userinfo is removed; malformed original URL strings remain available with `origin: null`.
@@ -590,6 +609,22 @@ Network and console coverage starts only after REA attaches and enables the rele

 Source maps are not fetched by inspection. Bundle analysis fetches them only when `fetch_source_maps` is selected, with exact-origin redirect checks and no credentials, cookies, or referrer. Each fetch operation uses `source_map_fetch_timeout_ms` (default 30000) and a 64 MiB aggregate streamed-response budget across redirects. The byte budget has no runtime override. A fetch overrun is an item limitation, not a thrown analysis timeout. A deadline or byte-limit failure remains explicitly unavailable and makes bundle completeness partial. Source-map decoding also bounds raw resolved identities to 64 MiB and aggregate inline evidence to 32 MiB. Failed maps preserve their failure context when it fits; if another context cannot fit, collection stops with the full requested count, the returned processed count, and an explicit unknown-results limitation. Retained mappings and original sources are returned inline. See [source-location limits](web-source-location.md) for the structural decoder bounds. Original source artifacts with `.ts`, `.tsx`, `.mts`, or `.cts` suffixes carry `text/typescript`; other source names retain `text/javascript`.

+A fully read response that fails UTF-8, JSON, mapping, or structural validation
+retains `artifact: null`, empty original-source, module-edge, and mapping
+arrays, and an explicit failure limitation. Invalid content is `invalid`;
+decoder or structural capacity refusal is `fetch_failed`. Its optional
+`response_identity` records the complete body's SHA-256 digest, byte count,
+and `fetch-response-body-bytes` representation without retaining malformed
+text or charging that text to the 32 MiB output budget. These are bytes
+delivered by Fetch after HTTP content decoding and before UTF-8 decoding, not
+HTTP wire bytes. The identity is absent when the body was not fully read, and
+older observations may omit it. A response whose text cannot fit the existing
+output budget is likewise `fetch_failed` with text omitted and completed-body
+identity; JSON parsing and source-map decoding are not attempted. Successful and partial maps keep their
+full text artifacts. Their original text, including an initial BOM or XSSI
+line, remains distinct from the parsing view that removes that framing.
+Collection reads the body once and does not raise its response or output limits.
+
 When fetching is selected, source-map `excluded` facts preserve the capture
 ledger's reasons and counts for declarations rejected before download. No
 disallowed URL details are retained or fetched. `requested` and `processed`
@@ -597,6 +632,17 @@ count the admitted fetch requests; exclusions are counted separately. Excluded
 declarations make the collection unavailable, or partial when maps were retained.
 An empty collection with no declarations remains `not_requested`.

+If the caller cancels while later source maps are being fetched, the failure's
+partial Evidence retains the captured page and every completed map item. Its
+`normalized_result.kind` is `web-bundle-acquisition` and
+`analysis_status` is `not_performed`: no script-analysis result is claimed.
+`source_maps.requested` remains the admitted request count,
+`source_maps.processed` counts completed items, and any unprocessed requests
+have an explicit unknown-results limitation. Capture exclusions remain in the
+same collection. The cancellation error keeps the caller's exact reason;
+an already observed response resource or cleanup failure keeps its own error
+category and cleanup owner.
+
 Source-map items retain the script's `declared_url` separately from the observed
 `effective_url`. Successful maps use the latter as their source-resolution base.
 Failed fetches retain the last response URL observed within the approved origins;
@@ -10,8 +10,10 @@ liveness deadlines. `INPUT_JSON` may be inline JSON or a JSON file path.
 The minimal request contains only browser launch/connect selection, `start_url`,
 and at least one `actions` entry. Launch `headless` defaults to `true` and can
 be set to `false` where the host supports a visible browser. Navigations follow
-the destinations named by the scenario and the page's ordinary browser requests;
-there is no separate origin allowlist or request-interception layer. Environment
+the destinations named by the scenario and the page's ordinary browser requests,
+and [request steps](#request-steps) send only to the start URL's origin;
+there is no separate origin allowlist. Request steps use a temporary dispatch
+gate for cancellation; ordinary page requests retain their browser behavior. Environment
 settings (including service workers blocked by default), empty storage, and a
 final sanitized URL capture are supplied by default. Set
 `environment.service_workers` to `allow` when the application requires them.
@@ -171,6 +173,12 @@ distinction: it closes and deletes provider-owned profiles, but only disconnects
 from an external CDP browser. Real-browser verification checks both outcomes and
 confirms that an attached external browser remains alive.

+CDP connections leave Playwright's default-context overrides disabled. The
+selected page receives the declared scenario environment and temporary focus
+emulation, so actions can complete while that page is in the background.
+Its environment owner clears these overrides before disconnecting; other pages
+keep their media settings. Connecting does not create a bootstrap page.
+
 That cleanup requires REA to remain running. Abrupt termination, including
 Windows process-tree termination or POSIX `SIGKILL`, can leave the launch
 profile and Playwright artifacts behind. A profile can retain cookies, history,
@@ -204,7 +212,8 @@ language environments.
 HTTP(S) URLs may include ordinary query values and fragments directly. Use
 ordered structured query entries when a value needs to reference a declared
 environment-backed secret. Form, storage, and cookie values are either literal
-strings or declared secret references. Raw URL userinfo credentials are rejected.
+strings or declared secret references; request step headers can also read a
+cookie or local storage value from the page. Raw URL userinfo credentials are rejected.
 Captured credential-header
 values are not retained, and declared secret values are redacted automatically.
 A secret may be declared solely to
@@ -315,6 +324,113 @@ external browser without closing it. The request itself defines the operation;
 there is no additional REA grant step. The browser and host still enforce their
 own access and process rules.

+## Request steps
+
+A `request` step sends one HTTP request from the page with the page's own
+`fetch`, so the browser attaches the session's cookies and the request is
+recorded in the step's network events like any request the application makes.
+Use it to record an application's API, including writes, when driving the UI
+for each call would be slower or less exact than calling the endpoint the UI
+calls. It is the only action that changes application state without a user
+gesture, so run scenarios with write requests only against an instance whose
+data you may change. This scenario creates one item:
+
+```json
+{
+  "browser": {
+    "mode": "launch",
+    "executable_path": "/absolute/path/to/chromium"
+  },
+  "start_url": { "url": "http://127.0.0.1:3000" },
+  "actions": [
+    {
+      "step_id": "create-item",
+      "action": "request",
+      "method": "POST",
+      "path": "/api/items",
+      "query": [
+        { "name": "notify", "value": { "source": "literal", "value": "false" } }
+      ],
+      "headers": [
+        {
+          "name": "X-CSRFToken",
+          "value": { "source": "cookie", "name": "csrftoken" }
+        },
+        {
+          "name": "Authorization",
+          "value": {
+            "source": "local_storage",
+            "key": "auth",
+            "json_pointer": "/token"
+          },
+          "prefix": "Bearer "
+        }
+      ],
+      "json": { "title": "Scratch item 1" },
+      "expected_status": [201],
+      "timeout_ms": 10000
+    }
+  ]
+}
+```
+
+- `method` is `GET`, `HEAD`, `POST`, `PUT`, `PATCH` or `DELETE`. `json` is the
+  body, sent with `Content-Type: application/json` unless a header sets one; a
+  `GET` or `HEAD` step cannot carry it.
+- `path` starts with one `/` and must resolve to the start URL's origin, which
+  validation checks before the browser starts. When the step runs, the page must
+  be on that origin, checked again in the page as the request is sent; add a
+  `goto` step first if an earlier action left it. A query in `path` is sent as
+  written (a fragment is not sent), and `query` entries are appended after it
+  in order and may reference declared secrets.
+- Request steps follow no redirects: a redirect answer fails the step, and
+  nothing is sent to the location it names, though a write the redirect
+  answered may already have been applied. `expected_status` cannot name a 3xx
+  status. Give the path the redirect names; with header values selected, the
+  capture records its `Location`.
+- Header values are literals, declared secrets, a cookie the browser holds for
+  the request URL (`{"source": "cookie", "name"}`, HttpOnly cookies included,
+  whose value the page's scripts can then see while the request runs), or a
+  local storage entry on the start origin (`{"source": "local_storage",
+  "key"}`, with an optional `json_pointer` to a string or number in a stored
+  JSON value). `prefix` is sent before the value. A value read from the page is
+  redacted like a declared secret, as `[REDACTED:page:<step_id>.<header>]`,
+  from records made after the step reads it; a response recorded earlier, such
+  as the login response that returned a token, keeps the value. A value read
+  again keeps its first marker, and a value shorter than 8 characters is not
+  redacted, since redacting it would rewrite ids, ports and hosts throughout
+  the capture. A value is redacted as stored and as `fetch` sends it, without
+  surrounding spaces and tabs. A missing cookie, key or pointer fails the step.
+  Reading a page value raises the estimated cost of redacting every later
+  body, so the bodies kept within `max_network_body_allocation_bytes` (1 MiB
+  by default) get smaller: after a 32-character `X-CSRFToken` value, a body over
+  about 47 KiB is kept as `unavailable`. Raise `capture.limits` when the
+  application's responses are larger.
+- Validation refuses a header name given twice in a step, header names a
+  page's `fetch` cannot set, such as `Cookie`, `Origin`, `Host` or `Sec-*`, and
+  `User-Agent`, which Chrome drops; it refuses line breaks and other ASCII
+  control characters in literal values and prefixes, and the step fails before sending
+  when a secret or page value holds them.
+- The step completes when the whole response has been read. With
+  `expected_status`, any other status fails the step and the later actions are
+  recorded as `cancelled`; without it, any response completes the step. A
+  network error fails the step. `timeout_ms` covers reading the header values
+  and the request: a step whose time runs out, or that is cancelled, before
+  its request is sent sends nothing, but a request already sent can still reach
+  the application after the step fails.
+  An absolute deadline also covers browser evaluation queued behind page work.
+  A temporary route checks cancellation again at network dispatch and is removed
+  when the request evaluation settles. A page controlled by a service worker
+  is refused because its fetch can bypass that dispatch gate; use the default
+  blocked service-worker policy for request steps.
+
+The request runs in the page's main world, so an application that wraps
+`fetch` sees it, and it goes through the same network observation as other
+page requests: select network content (bodies or header values) to record it.
+Captures with request steps state in `limitations` that the steps sent their
+declared requests through the page's fetch. A scenario without request steps
+is unchanged.
+
 ## Network evidence

 `capture.events: ["network"]` retains request, response, completion, failure,
@@ -355,6 +471,17 @@ and unfinished-request metadata. Select content independently:
 All three options default to `false`. Any selected network content also enables
 network metadata observation; listing `network` in `events` is then optional.
 Each observed request object receives a capture-scoped `transaction_id`.
+Each `request` event carries `observed_at`, the wall-clock time REA observed the
+request start. Playwright reports the browser's own start only once a request
+ends, so each `request-finished` or `request-failed` event carries `started_at`,
+the browser's wall-clock start, and `elapsed_ms`, its time from that start to
+the end of the response, when the browser reports them. The environment views
+time scenario records from these, as HAR entries are timed: the browser's start
+where it reported one, else `observed_at`, which trails it by up to tens of
+milliseconds while REA reads other responses, and a duration of 0 where the
+browser reported none. Captures made before these fields existed lack them and
+are read in record order. REA versions before them refuse captures that carry
+them. Scenario comparisons ignore all three (`ignore_network_request_timing`).
 Requests sharing a URL remain distinct. Redirects link to the preceding
 transaction only when it was observed; a null predecessor does not establish
 that no earlier hop existed. Request events require both transaction fields;
@@ -452,8 +579,8 @@ and compared as an unordered collection after caller rules apply, because
 concurrent responses arrive in any order and can land in a later step; a
 redirect retains the complete predecessor ancestry, including each hop's own
 request, response outcome, and selected network content. Each transaction's
-capture-local IDs, sequence/index fields, and content source-sequence anchor
-are removed. Caller rules normalize retained strings before hashing. The
+capture-local IDs, sequence/index fields, content source-sequence anchor and
+request times (`observed_at`, `started_at`, `elapsed_ms`) are removed. Caller rules normalize retained strings before hashing. The
 `preserve_redirect_transaction_ancestry` built-in rule fingerprints each hop
 as canonical SHA-256 of `{ events, redirected_from }`: `events` is the sorted
 list of its normalized event SHA-256 digests, and `redirected_from` is its
@@ -474,7 +601,10 @@ scope/flags, value fingerprints, and duplicate entries even when redaction or
 literal rules make names collide. Captured storage arrays retain their original
 order. The `compare_storage_entries_as_unordered_collection` built-in rule
 participates in the normalization commitment; new storage comparison digests
-therefore differ from earlier order-sensitive comparisons.
+therefore differ from earlier order-sensitive comparisons. The
+`ignore_network_request_timing` built-in rule likewise joins the commitment, so
+normalization digests differ from comparisons made before it, though captures
+with and without request times compare alike.

 Each aligned step reports changed, unchanged, or unknown. Changed and unknown
 action, screenshot, DOM, accessibility, URL, history, storage, and event
@@ -497,3 +627,58 @@ rules and preserve the same missing fact.
 Network normalization also commits the removal of capture-local transaction IDs,
 attribution to the requesting step, and unordered transaction comparison. These
 built-in rule identities participate in the normalization digest.
+
+## Summary delivery and retained views
+
+`capture_browser_scenario` accepts `detail: "summary"` to retain the complete
+capture in the MCP session and return its summary. The default remains
+`complete`. Delivery detail does not change scenario parameters or identity.
+
+The summary reports each step's status, error, URL and captured/missing/truncated
+section names. It omits `not_requested` sections and repeated `before_url` values.
+The accessibility tree comes from the first unsuccessful step, or the final
+step on success; when that step captured no tree, its nearest earlier captured
+tree is identified explicitly. Event and network counts cover retained records,
+with capture omissions reported separately.
+
+For the one-shot CLI, save the complete Evidence before selecting a summary:
+
+```bash
+rea capture-browser-scenario scenario.json --detail summary --evidence_output /absolute/path/scenario-evidence.json --json
+```
+
+Use the returned `normalized_result.parent_evidence_id` with
+`inspect_analysis_view` source `{kind: "retained-evidence", evidence_id: "..."}`.
+For a CLI bundle, use an `evidence-file` source with its absolute path and the
+parent Evidence ID. Views read the recorded capture; they never replay actions.
+
+- `{kind: "summary"}` returns the same overview.
+- `{kind: "browser-scenario", collection: "steps", step_indices: [2], artifacts: ["accessibility"], offset: 0, limit: 1}` returns selected recorded steps and artifacts.
+- `{kind: "browser-scenario", collection: "events", event_kinds: ["response"], transaction_ids: ["request-2"], offset: 0, limit: 20}` pages selected events with original item indices.
+
+Omitted filters select all; empty arrays select none. Pagination counts matching
+retained rows. Exhausting a page does not establish capture completeness or
+current application state.
+
+Transaction pages use `{kind: "browser-scenario", collection: "transactions", limit: 20}`.
+Their stable identity is the parent Evidence ID plus `transaction_id`; each row
+keeps original event indices. Metadata events are returned by default. Select
+`event_kinds: ["network-content"]` for recorded bodies and header values, or
+`event_kinds: []` for identity and indices alone. A `step_indices` filter selects
+a whole transaction when any retained event belongs to a selected step; this
+is receipt attribution, not proof that the action caused the request.
+
+For a large retained tree, request `{kind: "browser-scenario", collection: "text",
+step_index: 10, artifact: "accessibility", offset: 0, limit: 2048}`. `dom` is also
+supported. Offsets and limits count UTF-16 code units. The full artifact digest
+and byte size remain attached to each page. Missing, truncated and unrequested
+text stay explicit; source truncation counts are preserved without treating an
+exhausted page as a complete capture.
+
+Network summary counts include every retained transaction identity, including
+those whose request event was dropped. Missing request events, conflicting
+metadata and observed request failures have separate counts. `transactions` is
+`null` when network observation was unrequested or its legacy selection is
+unknown and there are no retained transactions; an observed empty inventory is
+`0`. Full capture omissions remain available and each page carries source
+completeness, dropped-event counts and omitted-transaction accounting.
@@ -73,9 +73,14 @@ arbitrary nested graph array.
 A top-level array emits its elements in source order. An object must have one
 clear `rows`, `items`, `records`, or `occurrences` array, directly or under
 `page`. Evidence uses the same boundaries inside `normalized_result`.
-An arbitrary report or a scalar selection is refused with an actionable error;
-use `--format json` for a complete document. If several collections exist,
-select one with `--filter-output`, for example `normalized_result.rows`.
+Any other selection is refused before a record is written, including an
+arbitrary report, a scalar, a nested array elsewhere, and a columnar object such
+as the `inspect-sqlite-database --table` `normalized_result.rows`
+(`{columns, values}`). The refusal is the caller error `invalid_request`
+(`invalid_input`) and names the selection and its observed shape; the analysis
+itself succeeded, so use `--format json` for the complete document. If several
+collections exist, select one with `--filter-output`, for example
+`normalized_result.rows` for an analysis view.

 Object collections finish with a control record:

@@ -236,6 +241,16 @@ Formats 2, 3 and 4 retain header, directory and integrity facts. Compact deliver
 keeps complete Evidence in the requested bundle. See [Godot PCK](godot-pck.md)
 for embedded packs, batch queries and unknown encrypted coverage.

+Inspect a Node.js SEA carrier without running it:
+
+```sh
+rea inspect-artifact ./application --json
+rea extract-artifact ./application --json
+```
+
+See [Node.js SEA](node-sea.md) for supported layouts, script and asset paths,
+fuse observations, and the real-fixture verification lane.
+
 Inspect local model declarations without loading weights:

 ```bash
@@ -321,6 +336,22 @@ The workflow reports first-line metadata, process/exception/termination facts,
 threads, usedImages, lossless integer registers, and documented crash classes
 when `bug_type` is `"309"`. Other DiagnosticReports types return no crash
 result. See [Apple IPS crash reports](apple-ips.md).
+Inspect Linux kernel module metadata without executing the module or requiring
+`modinfo`:
+
+```bash
+rea inspect-kernel-module /absolute/path/to/module.ko --json
+```
+
+The workflow reports ordered `.modinfo` keys (duplicate `alias` and `parm`
+entries preserved), `__versions` symbol CRCs, presence of
+`.gnu.linkonce.this_module` and `__ksymtab` sections, observed `.init.text`
+and `.exit.text` sizes, and an appended signature trailer. `struct module` is
+not decoded and the signature is not validated. Other ELF types are not
+applicable. gzip, xz, and zstd containers are unsupported and name
+`external_decompression` as the next probe: decompress with an external
+utility, then inspect the decompressed file. See
+[Linux kernel modules](kernel-modules.md).

 Inspect a CPython 3.7–3.13 `.pyc` header and nested marshal code objects
 without executing bytecode or installing Python:
@@ -375,7 +406,7 @@ Run `rea --help` or a command's `--help` for arguments and output options.
 The [generated catalog](mcp-contracts.md#generated-catalog) lists all CLI commands and MCP
 tools. Provider-specific target support is described in the
 [native guide](native-investigation.md), [DOS guide](ghidra-dos.md),
-[raw binary guide](raw-binary.md), and
+[raw binary guide](raw-binary.md), [GameCube DOL guide](ghidra-dol.md), and
 [Windows Ghidra guide](windows-ghidra-p0.md).

 ## Choose a provider
@@ -412,7 +443,13 @@ The selected provider remains bound to the session until an explicit switch
 or close. Provider failures are returned with their original reason. For an
 `ambiguous` selection error, choose from `details.candidate_ids`; for
 `provider_unavailable`, follow `message`, `remediation.action`, and the original
-reasons in `details.rejections`. For Hopper, Ghidra, IDA, JADX, and Kuna, run
+reasons in `details.rejections`. Each rejection names its `origin`: `availability`
+entries describe local readiness failures, including missing configuration or an
+invalid existing registration; they do not establish target support. `target`
+entries record a refused kind, format, architecture, or role. An availability-only
+message describes the recorded rejections without claiming that every provider
+is unconfigured or that target support is known.
+For Hopper, Ghidra, IDA, JADX, and Kuna, run
 `rea doctor --provider ID --json` to diagnose the selected engine. Other adapters,
 such as `pwntools-elf`, report their configuration requirements directly and are
 not accepted by `doctor --provider`. See
@@ -439,7 +476,14 @@ an exact result when the target bytes, operation, parameters, provider and
 settings match. Mutations and cursor-dependent calls are excluded from the
 cache. Snapshot files are local and use owner-only permissions.

-Importing an Evidence bundle refreshes retained subject display names and paths.
+One-shot binary CLI Evidence reports the exact path argument in `caller_input_path`,
+including relative spelling and symlink aliases. Its subject identifies the
+inspected artifact; `caller_input_path` does not change the Evidence ID or
+snapshot query. A replay reports the current invocation's path while leaving
+the saved Evidence unchanged. Provider inspections continue to include the
+established `parameters.input_path` field.
+
+Importing an Evidence bundle refreshes retained request and subject display metadata.
 It preserves cached analysis results, including observations for other targets.
 Snapshot bindings that use a replaced record retain its updated display path.

@@ -700,8 +744,18 @@ rea mcp --http --port 8765
 ```

 `--host` and `--port` default to `MCP_HOST` and `MCP_PORT` from the environment,
-then to `127.0.0.1` and an ephemeral port. The bound URL is written to stderr as
-one JSON log line (`"msg":"MCP transport listening"`) whatever `REA_LOG_LEVEL`
+then to `127.0.0.1` and an ephemeral port. A bind outside loopback requires
+`MCP_ALLOWED_HOSTS` or `--allowed-hosts`, a comma-separated list of client host
+names or IP addresses without URLs or ports. For example:
+
+```sh
+rea mcp --http --host 0.0.0.0 --allowed-hosts 127.0.0.1,rea.lan
+```
+
+Requests with a different `Host` or browser `Origin` receive `403`; a missing
+`Origin` is accepted. The announced client URL uses the bound hostname when
+admitted, otherwise the first declared hostname, with the actual bound port.
+It is written to stderr as one JSON log line (`"msg":"MCP transport listening"`) whatever `REA_LOG_LEVEL`
 is set to; nothing is written to stdout. `rea mcp --http --help` lists the accepted options. The listener serves
 one client at a time: a session ends with the client's `DELETE`, and a client
 that connects while another session is open takes it over, so a client that
@@ -739,13 +793,47 @@ rea environment-serve manifest.json --evidence capture.json --port 8765
 ```

 `--host` and `--port` resolve like `rea mcp --http`: flags, then `MCP_HOST` and
-`MCP_PORT`, then `127.0.0.1` and an ephemeral port. `ENVIRONMENT_NAME` renames
+`MCP_PORT`, then `127.0.0.1` and an ephemeral port. A non-loopback bind requires
+`MCP_ALLOWED_HOSTS` with the same hostname rules and Host/Origin gates as above.
+`environment-serve` uses this environment setting; `--allowed-hosts` belongs to
+`rea mcp --http`. For example:
+
+```sh
+MCP_ALLOWED_HOSTS=127.0.0.1,rea.lan rea environment-serve manifest.json --evidence capture.json --host 0.0.0.0
+```
+
+`ENVIRONMENT_NAME` renames
 the served environment; set but blank, it is refused as `configuration_invalid`
-like a blank `MCP_HOST`. The bound URL is written to stderr as one JSON log line
+like a blank `MCP_HOST`. The admitted client URL is written to stderr as one JSON log line
 (`"msg":"MCP transport listening"`). See
 [agent environments](agent-environments.md) for what the state and replay
 return and do not establish.

+## Build an environment bundle
+
+`rea environment-build <capture> [dir] [--name <name>] [--template-rule <rule> ...]
+[--format-rules-only] [--package-tarball <path>] [--capture-timeout-ms <ms>] [--dry-run]` builds the bundle
+`environment-export` writes from one recorded capture: a `.har` file, which it
+inspects as `inspect-web-network-capture` does, or capture Evidence JSON from
+`inspect-web-network-capture` (HAR) or `capture-browser-scenario`. It projects
+the environment manifest from the in-memory Evidence with the opt-in rules
+`after-uid-literal`, `opaque-token`, `sibling-variance` and `prefix-variance`
+unless `--template-rule` or `--format-rules-only` selects others, prepares the
+state, and writes the bundle; every file is byte-identical to the three-step
+path's when that path lists the same rules in the views' order and exports
+under the build's name. A loopback or IP-literal capture is named after its file unless `--name`
+is given. It prints one JSON report: the capture and manifest identities, the
+state, a `coverage` summary of which tools answer from the state, which replay
+and why each write is withheld with a hint, the files, warnings and the next
+command. `--dry-run` writes nothing and may omit the directory.
+
+```sh
+rea environment-build grafana.har ./grafana --json
+```
+
+See [agent environments](agent-environments.md#build-a-bundle-in-one-step)
+for the report, the hints and what the bundle ships.
+
 ## Export an environment bundle

 `rea environment-export <manifest.json> --evidence <capture.json> <dir>
@@ -866,8 +954,10 @@ redirected, which keeps large results smaller for agents and scripts; pipe
 through `jq .` for indented files. Output selection and formatting do not change
 operation status.

-`--format md` escapes backslashes and pipes in table headers and cells, and
-renders cell line breaks as `<br>`. These are presentation changes; retained
+`--format md` escapes backslashes, pipes, and inline Markdown syntax in table
+headers and cells so source text is displayed literally, and renders cell line
+breaks as `<br>`. Underscores between letters or digits, as in `source_index`,
+cannot form emphasis and stay unescaped. These are presentation changes; retained
 Evidence and JSON output keep the original values. Nested objects and arrays
 use JSON inside their owning Markdown cells, retaining the field names and
 values instead of replacing them with an object label. Table widths are measured
@@ -921,6 +1011,10 @@ server resources. It preserves a primary listener diagnostic, or a
 tool count and Evidence identifiers. The successful `stopped` document is
 returned only after cleanup is confirmed. The same in-process server owner
 retains failed stages for retry; the CLI exposes no separate retry command.
+`rea environment-build` is one-shot too: it prints its report and exits `0`,
+or prints the refusing stage's structured error and exits `1`, writing nothing
+when the refusal comes before the bundle is written. SIGINT cancels it with a
+`cancelled` error; a cancellation before the bundle stage writes nothing.
 `rea environment-export` is one-shot: it prints the written files and exits
 `0`, or prints a structured `invalid_request` error and exits `1` for the same
 pair refusals, a non-empty or file-occupied directory, a missing package
@@ -997,3 +1091,25 @@ Counting retains the existing bounded formatted-string allocation after capacity
 admission; omit the flag to stream large JSON documents without materializing
 the complete formatted text. Exhausted token windows display an empty range at
 the total token count and have no next offset.
+
+### `inspect-devicetree`
+
+Inspect an explicit local FDT v16/v17 blob without execution or an external tool.
+Returns header, reservations, node/property tree, derived standard values and
+selected phandle references. See [devicetree inspection](devicetree.md) for
+limits and retained-view pagination.
+
+```bash
+rea inspect-devicetree /artifacts/board.dtb --json
+rea inspect-devicetree /artifacts/board.dtb --detail summary --evidence_output /artifacts/board-evidence.json --json
+```
+
+### PE TLS and load configuration
+
+```sh
+rea inspect-pe-load-config /absolute/path/to/application.exe --json
+```
+
+Reports TLS callbacks and size-covered load-config fields without execution.
+Use `--max-callbacks` and `--max-file-bytes` to set read budgets. See
+[PE TLS and load configuration](pe-load-config.md).
@@ -6,6 +6,51 @@ for the reviewed setup transaction and [client IDs](installation.md#supported-ag
 The versioned verification notes below describe their stated runs; live service
 acceptance is verified only where explicitly recorded.

+## Launchers and PATH
+
+A client launched from a desktop app, IDE or service can inherit a different
+`PATH` from your terminal. An absolute path to `rea-agents` does not resolve its
+interpreter: the npm launcher's `#!/usr/bin/env node` still searches `PATH` for
+Node. Running that command successfully in a terminal does not establish that
+the client can launch it.
+
+For direct JavaScript installations, setup registers the selected runtime
+executable and REA script by absolute path. On POSIX, it prefers executable
+`node` or `bun` and REA aliases on setup's `PATH` only when they resolve to the
+same selected files. This preserves manager-owned aliases across version updates;
+otherwise setup uses the selected paths directly. Package-runner registrations keep
+their selected runner. Setup does not copy your ambient environment into client
+settings. To refresh an older registration, preview
+`rea setup --client <client-id> --skill=false --dry-run`, then run the same command
+without `--dry-run` and approve the displayed changes. Setup preserves unrelated
+settings, backs up changed configuration and leaves an aligned registration
+unchanged. Restart the client after applying the update.
+
+If a runtime manager removes the registered executable and no surviving alias
+was available, doctor reports its identity as unknown and setup retains the
+registration. REA does not infer that an arbitrary missing executable was Node
+from its script argument. Back up the client's configuration, verify the absolute
+path and supported version of the runtime you intend to use, then update only
+the runtime command, preserving the REA script arguments and other settings.
+Rerun setup to review the registration and restart the client.
+
+`rea mcp doctor --json` tests the production MCP adapter using the runtime
+executable and environment of the terminal running doctor. It does not launch
+the client's configured command or reproduce the client's environment. If doctor
+passes but the client disconnects, inspect the client's startup error and registered
+launcher; see [verification scope](client-verification.md#launch-environment-verification).
+
+## Runtime settings and client deadlines
+
+`update_analysis_settings` changes curated defaults inside the running REA
+server. It does not edit the client registration, extend the client's tool-call
+deadline, or recompute timeout values previously derived by `rea setup`. When
+raising a REA startup or operation deadline, separately ensure the client allows
+enough time for the full request. Use `inspect_analysis_settings` for the running
+server's defaults; `rea doctor` checks launch configuration and cannot observe
+another process's runtime overrides. See the
+[settings design](design/limits-and-recovery.md) for ownership and lifetime.
+
 ## Client tool names and discovery

 REA advertises canonical names such as `binary_session`. The MCP host decides
@@ -159,14 +204,25 @@ and Claude Code reports that autocompact is thrashing. To avoid this:
  `mcpServers.rea` entry in `~/.claude.json` (`$CLAUDE_CONFIG_DIR/.claude.json`
  when that variable is set), then restart Claude Code. Setup keeps this
  override.
+- To remove entire tool families from the upfront catalog, run
+  `rea setup --client claude_code --tool-families <ids>` with the families the
+  workflow needs (see [the advertising scope contract](mcp-contracts.md#tool-family-advertising-scope)).
+  Out-of-scope tools are not advertised and their calls fail with the SDK's
+  disabled-tool error, so widen the selection when a task needs another
+  family. Setup writes the scope into the entry's `env` as
+  `REA_MCP_TOOL_FAMILIES`; rerun setup with a different selection to refresh
+  it, then restart Claude Code.

 The sizes above come from REA's own `tools/list`. A live Claude Code session
 against DeepSeek's API is unverified.

-For a client whose stdio reader rejects the complete catalog frame, add
-`"REA_MCP_OUTPUT_SCHEMA_PROFILE": "off"` to REA's `env` object and restart the
-client. This omits only advertised output schemas; REA still validates complete
-structured results against its canonical contracts. See [MCP output schema
+For a client whose stdio reader rejects the complete catalog frame, set
+`"REA_MCP_OUTPUT_SCHEMA_PROFILE": "compact"` to bound every advertised output
+schema, or `"off"` to omit them, in REA's `env` object, then restart the client.
+Both keep canonical result validation and complete structured results; `compact`
+keeps a widened root shape and `off` advertises nothing. On catalogs large
+enough that full input schemas alone approach the frame limit, also keep the
+input profile at its `compact` default. See [MCP output schema
 profiles](mcp-contracts.md#output-schemas).

 ## Kimi Code
@@ -199,6 +255,20 @@ registration but does not contribute to the derived tool timeout; raise
 `toolTimeoutMs` to cover a longer selected JADX deadline.
 This headroom is a practical default, not a guarantee for every analysis
 duration. Setup preserves positive timeout values already in the `rea` entry.
+
+Setup also forwards explicitly selected input/output schema profiles,
+`REA_MCP_MAX_RESPONSE_BYTES`, provider paths and supported Ghidra, JADX and Kuna
+settings. It also forwards explicit executable and resource selections for ADB,
+apktool, packet capture, GDB/Rizin/objdump, Cutter, WABT, Wakaru, firmware and
+signal tools, browser inspection, and pwntools/pwndbg. This includes their
+supported prlimit overrides, Darwin Swift compiler/SDK/module-cache selections,
+and compile timeout, logging level and explicitly configured reference-secret
+patterns. A provider being unavailable does not discard its selected paths;
+doctor reports its readiness separately. Explicit selections override discovered
+defaults, including when setup runs again with a changed selection. Unrelated
+environment variables, process ownership tokens and one-shot target paths are not
+copied. Existing client environment overrides remain intact unless setup supplies
+the same key.
 You can edit `startupTimeoutMs` and `toolTimeoutMs` there; doctor keeps positive
 caller-selected values aligned and reports a non-blocking advisory when a tool
 timeout is shorter than the known provider allowance.
@@ -256,6 +326,15 @@ Setup and doctor follow Qwen Code's tilde and working-directory-relative home
 overrides. Qwen Code also discovers personal skills in `~/.agents/skills`,
 where setup installs the bundled workflow.

+If an existing direct-script registration fails with `env: node: No such file or
+directory`, refresh it through setup as described under [Launchers and PATH](#launchers-and-path).
+For an immediate Qwen-specific workaround, when Node is installed in
+`/opt/homebrew/bin`, add `"PATH": "/opt/homebrew/bin:${PATH}"` to that server's
+existing `env` object and restart Qwen. Qwen expands `${PATH}` from its parent
+environment; other clients can use different substitution syntax. Qwen's stdio
+launcher inherits the parent `PATH` and applies server overrides; a reduced
+parent environment does not establish that Qwen removed Homebrew from it.
+
 ## Antigravity

 Antigravity 2.0 discovers personal skills in `~/.gemini/config/skills`.
@@ -493,6 +572,28 @@ as stale, and rerunning setup removes the flag to repair it. Native configuratio
 uses strict JSON; setup refuses comments, trailing commas and a BOM rather than
 writing a registration ZCode cannot load.

+## FreeBuff
+
+For FreeBuff, the proposed integration writes `mcpServers.rea` into the user-scope
+`~/.agents/mcp.json` shared-agent file. Entries carry `command`, `args`, and
+`env`; stdio is the default transport. The proposed personal skill location is
+`~/.agents/skills`, so setup installs its skill copy there. Because the same
+file doubles as ZCode's user-scope fallback (see above), a `freebuff`
+registration is also in the file ZCode uses until ZCode defines its own native server.
+Setup and doctor detect FreeBuff from its own profile directory
+(`~/.config/freebuff-desktop`), not from the shared `.agents` folder that
+REA's skill installs create for every client.
+
+The configuration write and personal skill locations are proposed integration
+boundaries. FreeBuff MCP loading and skill discovery have not been verified
+with an installed native FreeBuff client/version; filesystem tests cover REA's
+editing, discovery, and ownership behavior only. Automatic applicability
+requires the FreeBuff profile directory even when the shared MCP file exists.
+
+FreeBuff setup support requires `[email protected]` or later. Older versions
+reject `rea setup --client freebuff` as an unsupported client. See the
+[installation guide](installation.md#supported-agents) for client availability.
+
 ## DeepSeek Harness

 DeepSeek Harness registers MCP clients through a Cordis YAML patch sequence
@@ -558,8 +659,10 @@ become active again. Malformed applicable files block setup before changes.
 Grok Build loads `[mcp_servers.rea]` from `$GROK_HOME/config.toml`, or from
 `~/.grok/config.toml` when `GROK_HOME` is unset or empty. Setup edits that server
 table, `[mcp_servers.rea.env]`, and a root `disabled_mcp_servers` entry that
-names `rea`. It sets `startup_timeout_sec = 30` and leaves every other name
-in that list. The shared skill installed under `~/.agents/skills` is already
+names `rea`. It defaults `startup_timeout_sec` to 30 seconds, preserves an
+existing positive timeout, and leaves every other name in that list.
+[Grok supports longer startup timeouts](https://docs.x.ai/build/features/mcp-servers)
+for cold package-runner launches. The shared skill installed under `~/.agents/skills` is already
 on Grok Build's skill path.

 Grok Bot (`grok_bot`) is detected from `~/.grokbot`, or from `SAND_DATA_ROOT`
@@ -1,11 +1,26 @@
 # Client and agent verification

+FreeBuff MCP loading and personal skill discovery are currently unverified with
+an installed native client/version. Its temporary-filesystem coverage verifies
+REA's configuration and applicability boundaries only; it does not establish
+that FreeBuff consumes the written registration or skill.
+
 Use these optional lanes to verify an installed client or evaluate an agent's
 REA workflow. [Testing REA](testing.md) provides the normal development commands
 and provider lanes. Each record below states its host, client version, model
 fixture, and remaining coverage; a native-client run with a loopback model does
 not establish live model-service acceptance.

+## Launch environment verification
+
+`rea mcp doctor --json` starts the production MCP adapter with the current runtime
+executable and environment. A healthy result establishes that adapter's
+initialization, discovery and target-free request flow; it does not verify a
+client's configured launcher or its inherited environment. Test the generated
+registration through the actual client, including a reduced `PATH` when checking
+desktop or service startup. Record the client version and launch environment
+separately from terminal doctor results. See [launcher troubleshooting](client-configuration.md#launchers-and-path).
+
 ## Published Pi code-mode renderer limit

 A separate probe of the published `@earendil-works/pi-codemode` 1.1.0 and 1.2.0
@@ -48,6 +63,14 @@ skill setting; Hermes discovers it through the selected `HERMES_HOME`.
 Set `REA_VERIFY_HERMES_STICKY_PROFILE=1` to exercise native Hermes selection of
 a named sticky profile with `HERMES_HOME` still pointing to its root.

+For Qwen on POSIX, set `REA_VERIFY_QWEN_REDUCED_PATH=1` and select its JavaScript
+entry point with `REA_VERIFY_QWEN_COMMAND` to test a restricted client environment.
+Setup retains the caller's `PATH`; the native Qwen `chat` or `call` run then uses
+an isolated `PATH` containing only Bash for the shell-tool fixture. The lane
+checks that `node`, `npm` and `npx` cannot be found and uses the generated REA
+registration unchanged. Its receipt records `reducedPath`, `clientPath` and
+`registrationCommand`; the option alone does not establish a passing native run.
+
 The Qwen lane also supports native Windows (verified with Qwen Code 0.25.1 and
 Node 24.19.0 for both `chat` and `call`). With Node 24.18.0, the same `call`
 journey reached full Evidence readback but the client aborted during exit with
@@ -1,35 +1,121 @@
-# Admission limits and recovery
+# Analysis settings, limits, and recovery

-How to add a REA-owned admission ceiling, budget, or deadline, and what a caller
-does when one is hit. This is a design rule, not an inventory. Ceilings that
-should become settings are tracked in
+This guide explains the runtime settings design for maintainers and developers:
+who owns each value, when an update takes effect, how providers enforce it, and
+how to extend the system. The public tool contract is in
+[MCP contracts](../mcp-contracts.md#editable-analysis-settings); recorded runtime
+checks and their limitations are in the
+[verification report](../verification/runtime-analysis-settings.md).
+
+## Problem and design boundary
+
+A valid workload can exceed a conservative default. An oversized ASAR header
+may prevent analysis of the entire archive; a slow Ghidra function may exceed
+its decompile deadline. Requiring a new REA process to change either budget
+interrupts the investigation and can discard reusable provider state.
+
+REA exposes a curated set of analysis defaults through MCP so callers can
+adjust a reported limit and retry the same workload in the running runtime.
+Each setting has a typed value, resource bounds, an enforcement owner, and a
+defined application point. The design applies across archive admission,
+provider startup, operation deadlines, and worker memory requests.
+
+The setter changes in-memory defaults. It does not edit arbitrary environment
+variables, configuration files, MCP registrations, or provider installations.
+Those mechanisms have different owners and lifetimes. It also cannot change a
+client deadline, extend accepted work, release retained resources, or remove a
+fixed representation limit. Exposing a setting requires a working enforcement
+path, not just an entry in the tool schema.
+
+Further ceilings that should become settings are tracked in
 [#6176](https://github.com/morluto/rea/issues/6176). Naming honesty for limit
 errors is [#5910](https://github.com/morluto/rea/issues/5910).

+## Ownership and data flow
+
+| Owner                                                                                                                                                                                                                   | Responsibility                                                                                                                                                                                     |
+| ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
+| [Domain definitions](https://github.com/morluto/rea/blob/main/src/domain/analysisSettingDefinitions.ts) and [types](https://github.com/morluto/rea/blob/main/src/domain/analysisSettings.ts)                            | Exact setting IDs, value types, shared bounds/defaults, units, provider/operation associations, application points, and structured limit metadata. Numeric constants stay with their domain owner. |
+| [Launch parser](https://github.com/morluto/rea/blob/main/src/config/analysisSettings.ts)                                                                                                                                | Parse selected launch values once, preserving an invalid value as a typed configuration failure rather than substituting a default.                                                                |
+| [AnalysisSettings](https://github.com/morluto/rea/blob/main/src/application/AnalysisSettings.ts)                                                                                                                        | Own one runtime's launch baseline, immutable override revisions, atomic updates, inspection, and accepted-operation snapshots. It does not own provider lifecycle or cleanup.                      |
+| [Composition](https://github.com/morluto/rea/blob/main/src/main/eagerRuntime.ts) and [typed configuration views](https://github.com/morluto/rea/blob/main/src/config/runtimeAnalysisSettings.ts)                        | Inject the same settings reader into providers and workflows; translate overrides into the configuration each consumer understands.                                                                |
+| Provider or resource owner                                                                                                                                                                                              | Resolve the effective budget, enforce it at the applicable boundary, and attach the actual value and known source to failures.                                                                     |
+| [MCP registration boundary](https://github.com/morluto/rea/blob/main/src/server/EvidenceMcpServerCore.ts)                                                                                                               | Enter the operation's settings scope before invoking its handler.                                                                                                                                  |
+| [Settings contracts](https://github.com/morluto/rea/blob/main/src/contracts/analysisSettingsContracts.ts) and [tool registration](https://github.com/morluto/rea/blob/main/src/server/registerAnalysisSettingsTools.ts) | Validate named requests and deliver inspection/update results without requiring an open target or healthy analysis provider.                                                                       |
+
+The normal path is: composition creates the store, an MCP handler captures its
+current revision, and providers read that snapshot when resolving budgets.
+If an owner rejects work, it reports the effective limit through the shared
+error projection. A subsequent settings update publishes a new revision for
+later handlers. It does not reach into the failed operation or retry it.
+
+### Accepted-operation snapshots
+
+`AnalysisSettings.run()` installs the current immutable snapshot in
+`AsyncLocalStorage`. Its `read` function returns that snapshot inside the
+operation and the latest revision outside it. Providers depend on the reader
+contract rather than on the mutable store or an ambient environment lookup.
+
+Acceptance here is entry into the registered handler's settings scope, not
+arrival of bytes at the MCP transport. Work queued or awaited within that scope
+keeps its snapshot. Deferred server initialization must still dispatch through
+the canonical scoped handler.
+
+| Event                                                     | Revision used                       |
+| --------------------------------------------------------- | ----------------------------------- |
+| Operation A enters its handler, then waits for a provider | Current revision 0                  |
+| A settings update publishes revision 1                    | Future handlers can read revision 1 |
+| Operation A resumes and starts its worker                 | Its accepted revision 0             |
+| Operation B enters its handler                            | Revision 1                          |
+
+This gives each operation stable budget semantics even if another connection
+updates settings while it waits. `next_worker` and `next_startup` describe where
+an accepted value is applied; they do not cause workers or startups belonging
+to an older operation to adopt a newer revision.
+
+Inspection deliberately reads the store's current defaults, rather than the
+calling operation's snapshot. It reports `active_values.status: "not_observed"`:
+an inspection result cannot establish the budget or remaining time of an
+already-running worker.
+
+### Composition and embedding
+
+The MCP runtime creates one store and supplies its reader to provider factories.
+`createServer` uses a supplied store or creates one, and wires its default
+providers to that store. An embedder supplying a custom binary session or other
+provider must also inject the same reader into that provider's composition and
+pass the store to `createServer`. Merely exposing the settings tools cannot
+make a custom provider consume updates.
+
+Keep default factories, explicitly supplied providers, transport composition,
+and deferred handler dispatch covered separately where their wiring differs.
+Resolve settings at the operation boundary; copying a runtime value into a
+provider constructor would freeze it at launch. For entrypoints outside the
+MCP wrapper, an embedder needing the same snapshot guarantee must establish
+the operation scope with `AnalysisSettings.run()`.
+
 ## Name a default, then a setting when operators need headroom

 Put the number in a named constant with a unit. Do not leave it as a magic
 number at the call site.

 When a workload may need more room, add a setting whose unset value is that
-constant. One module under
-[`src/config/`](https://github.com/morluto/rea/blob/main/src/config) owns the
-default, any floor, the maximum, the schema, the parser, and the recovery
-text. Register that schema on `environmentSchema` in
-[`environment.ts`](https://github.com/morluto/rea/blob/main/src/config/environment.ts).
-`parseConfig` calls `parseEnvironment`. Doctor uses that same parser through
-`nativeAnalysisConfigurationError`, so startup and `rea doctor` accept the
-same values. Add the name to `SELECTED_REGISTRATION_SETTINGS` so `rea setup`
-copies it into the client registration. Unset keeps today's behavior. An
-invalid value is a `ConfigurationError` and projects as `configuration_invalid`.
-Do not fall back to the default.
+constant. Pure numeric contracts live in `src/domain/analysisResourceLimits.ts`
+or their existing domain owner. `analysisSettingDefinitions.ts` binds the
+curated runtime IDs to those same bounds, defaults and application points.
+Environment parsers and recovery text stay under `src/config/`; register launch
+schemas on `environmentSchema` so startup and doctor agree. Add launch settings
+to `SELECTED_REGISTRATION_SETTINGS` when setup should forward them. Unset keeps
+today's behavior. An invalid launch value remains a configuration failure,
+never a silent fallback; its validation boundary determines whether MCP can
+start (see [invalid launch configuration](#invalid-launch-configuration)). An
+invalid runtime write is `invalid_request` and changes nothing.

-[`REA_REGEX_MATCHING_DEADLINE_MS`](https://github.com/morluto/rea/blob/main/src/config/regexMatchingDeadline.ts)
-([#6267](https://github.com/morluto/rea/pull/6267)) is the reference. Default
-5000 ms, floor 1 ms, maximum 2147483647 ms, because Node schedules a longer
-`setTimeout` delay as 1 ms. Setup copies the setting. A hit says:
-
-> The effective REA_REGEX_MATCHING_DEADLINE_MS value is 5000 ms (source default; default 5000 ms, floor 1 ms, maximum 2147483647 ms). Set REA_REGEX_MATCHING_DEADLINE_MS in the environment that starts REA to a positive decimal integer from 1 to 2147483647, then restart REA. The worker old-generation heap does not raise this deadline.
+For example, `regex.matching_deadline_ms` and its launch seed
+`REA_REGEX_MATCHING_DEADLINE_MS` share a 5000 ms default, 1 ms floor and
+2147483647 ms maximum. Node schedules a longer `setTimeout` delay as 1 ms.
+Changing the runtime setting affects the next accepted search; changing the
+launch environment affects the next REA process.

 [`REA_MCP_MAX_RESPONSE_BYTES`](https://github.com/morluto/rea/blob/main/src/config/mcpResponseBudget.ts)
 is the byte-budget shape: a decimal safe integer with a 10 MiB floor
@@ -39,7 +125,8 @@ raise REA's reserved string limit or Node's string ceiling. The setup
 allowlist does not copy this setting. A new headroom setting should, following
 the regex deadline.

-A per-call budget is not an environment setting. JavaScript `max_heap_mb`
+A per-call budget can have a runtime default without having an environment
+setting. JavaScript `max_heap_mb`
 (CLI `--max-heap-mb`) is an integer from 128 to 16384 MiB, default 1024. It
 applies on the next analysis, which starts a new worker, and does not restart
 REA. It does not raise the parent result budget, transfer ceilings, or fixed
@@ -51,8 +138,125 @@ does: its recovery says to set `NODE_OPTIONS` (for example
 `--max-old-space-size=<MiB>`) on the process that starts REA, then restart
 that process. `max_heap_mb` does not raise it.

+## Runtime settings through MCP
+
+`inspect_analysis_settings` lists the curated settings, their current and launch
+values, source, bounds, application point and relevant operation names. Filters
+by exact setting IDs, provider or operation intersect. Active worker values are explicitly `not_observed`; a configured default is
+not a measurement of active work. Inspection also separates known server limits from unknown client deadlines and receive buffers.
+
+`update_analysis_settings` accepts an atomic `changes` array. Each entry names
+an exact `setting` and either `action: "set"` with a schema-validated `value`, or
+`action: "reset"`. Reset restores the launch value. `expected_revision` is an
+optional compare-and-set guard; conflicts and duplicate keys change nothing.
+An unchanged write does not advance the revision.
+
+The revision tracks override state, not only effective numeric values. Setting
+an explicit override equal to the launch value still changes its source to
+`runtime` and advances the revision. Reset removes that override, even if the
+effective number stays the same. Validation, revision checks, and duplicate-key
+checks all happen before publishing the replacement snapshot; a rejected batch
+cannot partially apply. Clients coordinating writes can supply
+`expected_revision`; without it, valid updates apply to the current state.
+
+| Runtime setting                                               | Application point                                                      |
+| ------------------------------------------------------------- | ---------------------------------------------------------------------- |
+| `asar.max_header_bytes`                                       | Next archive operation, including full JavaScript application analysis |
+| `ghidra.startup_timeout_ms`, `hopper.startup_timeout_ms`      | Next provider startup attempt                                          |
+| `ghidra.decompile_timeout_seconds`                            | Next operation on the existing Ghidra Program; `null` means unbounded  |
+| `jadx.operation_timeout_ms`                                   | Next JADX operation                                                    |
+| `regex.matching_deadline_ms`, `regex.worker_heap_request_mib` | Next search / new regex worker                                         |
+| `capture.decoder_old_generation_mib`                          | Next owned capture decoder                                             |
+| `javascript.analysis_timeout_ms`, `javascript.max_heap_mb`    | Next source analysis / new JavaScript worker                           |
+| `wasm.command_timeout_ms`                                     | Next WABT operation                                                    |
+| `native.matching_representation_bytes`                        | Next `match_native_functions` request                                  |
+
+### Precedence and lifetime
+
+Where a setting supports an explicit per-call argument, precedence is:
+
+1. The caller's explicit argument.
+2. The accepted operation's runtime override.
+3. Valid launch configuration, where that setting has an environment seed.
+4. The built-in default when launch configuration is absent.
+
+An invalid launch value does not fall through to the built-in default. Preserve
+omitted caller arguments in Evidence: resolving an internal default must not
+rewrite the request as though the caller supplied it. `null` is the explicit
+unbounded value for `ghidra.decompile_timeout_seconds`; it is not a substitute
+for an unknown or omitted value elsewhere.
+
+A write does not extend active work, relaunch a provider, clear retained
+cleanup, or invalidate successful Evidence.
+
+Overrides belong to one REA runtime, survive target close/open, and disappear
+when REA exits. Connections sharing that runtime share its overrides. No files,
+ambient environment, registrations or upstream software are edited. Overrides
+are runtime-wide, not scoped to a target or an individual connection.
+
+### Failure and retry
+
+An ASAR admission error supplies `details.limit` with the exact setting,
+effective value, units, bounds, scope, application point, restart requirement
+and, when known, required bytes and value source. The agent can immediately call:
+
+```json
+{
+  "changes": [
+    { "setting": "asar.max_header_bytes", "action": "set", "value": 33554432 }
+  ]
+}
+```
+
+Then retry the same full-archive request once work and cleanup have settled.
+No preliminary inspection or source subset is required. The setter does not
+retry automatically. If an explicit per-call value caused the failure, correct
+that argument; raising a runtime default cannot override it.
+
+The resource owner constructs `details.limit` from the registry plus the budget
+it actually enforced. Metadata includes `agent_editable: true`,
+`scope: "rea-runtime"`, and `rea_restart_required: false`. Optional
+`required_value`, `source`, and `parameter` fields are supplied only where known
+or applicable. Do not infer a source because a value happens to equal a default.
+Error copying, attribution, redaction, and delivery must preserve these facts.
+Human-readable remediation explains the same failure; clients should not need
+to parse that sentence to identify an editable setting.
+
+Cache policy is part of enforcement. Successful reusable analysis can survive
+a budget update. Transient Ghidra decompile failures remain uncached so a raised
+deadline can recover on the same Program. Admission checks still apply to reused
+data: lowering an ASAR limit must reject a cached oversized header. Neither
+raising a limit nor clearing a transient analysis failure authorizes skipping
+cleanup or changing the identity of the provider session.
+
+### Invalid launch configuration
+
+Launch validation has two relevant boundaries. Settings validated by global
+configuration parsing can prevent REA from starting; an MCP setter cannot
+repair a server that is not running. Correct the launch environment or
+registration, use `rea doctor` for its configuration checks, and start REA again.
+
+Provider-local validation can leave MCP available. For example, an invalid
+`REA_JADX_OPERATION_TIMEOUT_MS` is inspectable with `source: "invalid"`, a
+`configuration_error`, and omitted `value` and `launch_value`. A valid runtime
+override repairs the effective JADX timeout without editing that launch seed.
+Inspection then reports the runtime value while retaining the launch error.
+Reset exposes the invalid launch state again; it does not repair or replace it
+with the built-in default. Provider availability and execution must resolve the
+same effective setting so readiness changes along with repair and reset.
+`REA_NATIVE_MATCHING_REPRESENTATION_BYTES` is validated the same way, by
+`match_native_functions` alone.
+
 ## Keep a fixed ceiling honest

+Inspection's separate
+[constraints](https://github.com/morluto/rea/blob/main/src/server/analysisSettingsConstraints.ts)
+describe operator-owned, external, and fixed controls. REA can report its
+configured response budget and parent heap limit; client deadlines and receive
+buffers remain explicitly unknown. These are not entries accepted by the
+runtime setter. Raising a worker heap request cannot raise the parent heap,
+and raising a provider deadline cannot make the client wait longer.
+
 If the ceiling must stay fixed, say so in the failure. Name the limit and the
 effective value, say this release has no runtime override, and name what does
 not raise it. Do not invent a setting.
@@ -68,20 +272,22 @@ The string the caller sees includes:

 - the limit or setting name
 - the effective value and unit
- the source (`default` or `setting`)
+- the source when known (`default`, `setting`, `runtime`, or `request`)
 - the default, the maximum, and the floor when the setting has one
 - the next action, including where to set it ("in the environment that starts REA")
 - whether a restart is required
 - what the change does not raise

-Invalid settings never take this path. They are `configuration_invalid`.
-Doctor reports `runtime-configuration:<setting>` and says to correct it in the
-shell or the MCP registration, then rerun.
+Distinguish an invalid configuration from a valid budget exhausted by work.
+Preserve the configuration failure and its setting identity; apply the
+[launch validation boundary](#invalid-launch-configuration) when describing
+whether live repair is possible.

 ## What agents do

-Follow `remediation.action`. Change a request field or a `REA_*` setting only
-when that text recommends the change. Restart only when it says the value is
+Use `details.limit` for a direct runtime update when it names an editable
+setting. Follow `remediation.action` for per-call, fixed and external controls.
+Inspect settings only when bounds or application details are missing. Restart only when it says the value is
 read at startup. A sentence that a control does not raise the limit is not a
 request to change it.

@@ -103,22 +309,72 @@ request to change it.
 - `resource_constraint` for capacity, when `retryable` is true: wait for the
  active admission to finish, then retry within the reported limits. Do not
  restart REA to free the slot.
- `configuration_invalid`: correct the named setting in the environment that
-  starts REA, then start REA again. Run `rea doctor` for the
+- `configuration_invalid`: when MCP remains available and the failure belongs
+  to a curated provider-local setting, inspect and set a valid runtime override.
+  Otherwise correct the named setting in the environment that starts REA, then
+  start REA again. Run `rea doctor` for the
  `runtime-configuration:` check. Re-run `rea setup` for that client when the
  setting is on the registration allowlist, then reconnect so the new process
  sees it.
 - `invalid_request`: correct the reported fields from the current schema or
  CLI help. Do not repeat the unchanged call.

-A restart is required for an environment setting and for a client still
-running the previous registration. It is not the first step for a transient
+A restart is required to adopt a changed launch environment or registration.
+The curated runtime settings above require no REA restart. It is not the first step for a transient
 MCP drop, a capacity wait, or retained cleanup.

-## Tests
+## Adding a runtime setting

-Lock the unset default, one accepted override, rejected floor, maximum, and
-syntax, and the recovery sentence through `parseEnvironment` and `parseConfig`.
+1. Identify the enforcing owner and the real resource constraint. Decide whether
+   callers need a per-call argument, a runtime default, a launch-only control,
+   or a fixed limit. A registry entry must not advertise authority REA lacks.
+2. Define the value type and named numeric bounds with the domain owner. Add the
+   ID and metadata to `analysisSettings.ts` and `analysisSettingDefinitions.ts`.
+   Reuse those bounds in runtime validation, launch parsing, and error metadata.
+   Choose the application point and provider/operation associations from actual
+   consumers; a shared control need not apply to every provider.
+3. If there is a launch seed, add its parser and appropriate configuration/doctor
+   validation. Decide whether an invalid value blocks the runtime or only the
+   provider. Add it to setup's `SELECTED_REGISTRATION_SETTINGS` when it should
+   be forwarded; runtime editability does not automatically propagate it.
+4. Thread the shared reader through every applicable composition path. Resolve
+   the effective value within the accepted operation, honor explicit arguments,
+   and preserve their omission in Evidence. Keep availability checks consistent
+   with execution. A worker heap request must not be described as a measured
+   process memory limit.
+5. Enforce the value at its resource boundary and construct structured limit
+   facts there. Preserve those facts through shared error projection and copies.
+   Check cache reuse, lowered admission, transient failures, and retained cleanup
+   against the same ownership rules.
+6. Update the public contracts and affected guides, then regenerate catalogs
+   and packaged skill metadata using the repository commands. Keep externally
+   owned and fixed controls in the separate inspection constraints, not in the
+   editable registry. Validate both store semantics and a public recovery path.
+
+## Tests and verification
+
+Cover the unset default, accepted overrides, rejected floor/maximum values,
+and invalid syntax through the owning parser and configuration boundary.
 [`regexMatchingDeadline.test.ts`](https://github.com/morluto/rea/blob/main/src/config/regexMatchingDeadline.test.ts)
-is the pattern. Project the failure and assert `configuration_invalid` for a
-bad value and the recovery wording for a hit.
+is one example. Assert error codes, setting IDs, values, units, provenance,
+application points, and resulting behavior. Check that adapters deliver the
+canonical recovery guidance, with independent assertions for its underlying
+facts. Avoid freezing prose or deriving all expected values from the same
+registry used by the implementation; either can hide the wrong failure.
+See [test design](../testing.md#test-design-and-pruning) for the assertion policy.
+
+Runtime checks cover atomic validation, stale writes, reset, runtime isolation,
+accepted-operation snapshots, and explicit argument precedence. Public MCP
+acceptance must reject an oversized ASAR, raise admission, and successfully
+retry the same complete archive on the same connection. Lowering admission must
+also refuse previously cached headers. The real Ghidra timeout verifier checks
+recovery after a live update without replacing its session. Also cover invalid
+provider-local launch configuration, repair/reset availability, default and
+custom composition paths, and preservation of structured limits through error
+copies. Gates used to overlap work and updates need bounded acknowledgements
+and release/join in `finally`.
+
+The [verification report](../verification/runtime-analysis-settings.md) separates
+public MCP checks, simulated provider coverage, real Ghidra execution, and
+measured task costs. It does not establish real-provider behavior for every
+editable setting or active worker telemetry.
@@ -53,7 +53,7 @@ Every collection supports `fields`, `offset` and `limit`; its stable row ID is
 always included. Selection changes delivery, not source inspection. Pages keep
 source coverage and parent Evidence links. Page exhaustion does not establish
 absence in a partial source. Complete Evidence remains accessible through
-`get_evidence` and Evidence bundle export.
+`get_evidence_bundle` and Evidence bundle export.

 The summary's `probe_issues` counts files with reported issues and their retained
 issue entries. It previews at most two such files, including stable `file_id`,
@@ -0,0 +1,105 @@
+# Flattened devicetree inspection
+
+`inspect_devicetree` / `rea inspect-devicetree` reads a local DTB without an
+engine, target execution or external tools. It supports FDT versions 16 and 17;
+other versions return `unsupported_target`. Corrupt recognized blobs return
+`invalid_request`, and exhausted budgets return `resource_constraint` without
+partial success.
+
+```bash
+rea inspect-devicetree /artifacts/board.dtb --json
+rea inspect-devicetree /artifacts/board.dtb --detail summary --evidence_output /artifacts/board-evidence.json --json
+```
+
+The complete Evidence includes the artifact SHA-256, validated header fields,
+64-bit memory reservations as exact hexadecimal strings, and a flat node tree
+with explicit parent paths. Each property retains its file offset, byte length,
+and up to 256 raw bytes as hex. `truncated` qualifies the preview only; parsing
+coverage includes the entire declared tree. Version 16 has no declared structure
+size, so `header.size_dt_struct` is null.
+
+Derived fields carry `confidence: derived`: standard ASCII string lists, scalar
+phandles and cell counts, and `reg` tuples using the parent's `#address-cells`
+and `#size-cells` (defaults 2 and 1). Zero-cell components are null (omitted), distinct from an encoded zero. Cell
+counts above four, invalid counts and incomplete tuples remain undecoded with a
+limitation. Addresses are bus-local; no `ranges` translation is attempted.
+Invalid or ambiguous strings remain raw, rather than being guessed.
+
+The summary is labeled derived and includes root compatible/model, chosen
+bootargs/stdout-path and aliases. An undecodable alias retains its name with a
+null path; it is not silently treated as absent. Single-cell `interrupt-parent`, `remote-endpoint` and `msi-parent`
+references resolve through phandle declarations. Missing or duplicate targets
+have null target paths. A node whose `phandle` and `linux,phandle` disagree
+adds a limitation, and references to either value stay unresolved. A present
+`phandle` that is not one cell also adds a limitation; `linux,phandle` cannot
+resolve that node when the canonical declaration is malformed. Binding-specific
+reference arrays and overlays are not resolved; an empty reference list does not
+prove absence of hardware links.
+
+MCP `detail: summary` retains complete Evidence in the session. Follow its
+`parent_evidence_id` with `inspect_analysis_view`:
+
+```json
+{
+  "source": { "kind": "retained-evidence", "evidence_id": "ev:<digest>" },
+  "view": {
+    "kind": "devicetree",
+    "collection": "properties",
+    "path": "/serial@1000",
+    "offset": 0,
+    "limit": 32
+  }
+}
+```
+
+Collections are `nodes` (identity and property counts), `properties` (requires an
+exact node path), `reservations`, and `references`. Pages use retained parsed
+facts and do not reopen the file. Each page carries fixed-size context
+(artifact, header, coverage and counts) rather than the summary strings, so a
+large `bootargs` value does not repeat on every page. Source indices are scoped to the selected
+collection and parent Evidence; property indices are scoped to their node.
+
+| Input budget     | Default | Ceiling |
+| ---------------- | ------: | ------: |
+| `max_file_bytes` |   4 MiB |  16 MiB |
+| `max_nodes`      |   8,192 |  65,536 |
+| `max_properties` |  32,768 | 262,144 |
+| `max_depth`      |      64 |     256 |
+
+Decoded names, paths, values and row overhead share a fixed 32 MiB representation
+allowance, charged before expansion. It has no runtime override.
+
+The reservation count also uses `max_properties`. CLI flags use kebab case,
+for example `--max-nodes 16384`. View pages contain at most 256 rows.
+
+## Verification
+
+Synthetic tests cover v16/v17, malformed headers/blocks/names/tokens, resource
+limits, derived values, and CLI/MCP delivery including retained pages after
+removing the input. The optional real lane requires **dtc 1.8.1**:
+
+```bash
+npm run build:cached
+node scripts/verify/firmware/devicetree.mjs
+```
+
+It compiles a DTS with reserved-memory, chosen, aliases and phandles, compares
+REA's node paths against `dtc -I dtb -O dts`, and checks the derived report.
+`REA_DTC_PATH` selects the verification executable; it is not runtime setup.
+
+The dtc 1.8.1 lane ran on macOS arm64 with Node 26.5.0. Its seven node paths
+matched the decompiled tree. The report included `model: "REA DTB verification"`,
+`bootargs: "console=ttyS0"`, alias `serial0 -> /serial@1000`, reservation
+`0x80000000 + 0x1000`, and a resolved reference from `/consumer` to
+`/serial@1000`. The deliberately minimal remote-endpoint fixture produces dtc
+graph-binding warnings; this lane verifies FDT structure and selected property
+derivations, not hardware-binding validity.
+
+A repeat run of that complete compile/decompile/CLI verification took 2.13 s
+elapsed, 1.52 s user CPU and 0.27 s system CPU under `/usr/bin/time -l`. This is a
+small fixture with warm filesystem caches, not a cold-start or large-board
+benchmark. Peak process-family memory and whole-workflow token usage were not
+measured; the sandbox denied the memory-reporting system query. No pre-feature
+equivalent REA workflow exists for comparison. The pinned Node 24.22.1/npm
+11.16.0 toolchain was unavailable; dependency installation used the local cache
+with Node 26.5.0/npm 12.2.0 instead.
@@ -305,8 +305,13 @@ capture provides them.

 ASAR observation reads the header through one open file handle and validates its
 declared lengths against the archive size. Header/index admission is the same
-budget used by static ASAR reads: 16 MiB / 16777216 bytes by default, or
-`REA_ASAR_MAX_HEADER_BYTES` (at most 256 MiB) when set. An oversized header is
+budget used by static ASAR reads: 16 MiB / 16777216 bytes by default, seeded by
+`REA_ASAR_MAX_HEADER_BYTES` (at most 256 MiB). In MCP,
+`update_analysis_settings` can override `asar.max_header_bytes` for new
+operations without restarting REA. Cached headers are checked against each
+operation's admission, including after a decrease. See the
+[settings design](design/limits-and-recovery.md#failure-and-retry).
+An oversized header is
 not parsed; selecting a member path does not bypass admission, and the page
 stays unauthorized. The header cache separately retains at most that many bytes
 of already-admitted encoded headers across eight archives. Evicting that cache does not raise admission.
@@ -24,12 +24,17 @@ requires an absolute filesystem path and preserves that exact selection:

 The inline Evidence result contains the artifact path, SHA-256, and byte length.
 `tables` lists each declared note program header or section, including the
-section name when a string table is present. Zlib-compressed section-name
-tables are decompressed within the selected file-size budget. An unsupported
+section name when a string table is present. Zlib- and Zstandard-compressed
+section-name tables are decompressed within the selected file-size budget. An unsupported
 compression type leaves section names unknown and adds a limitation; note bytes
 remain independently examined. Each `entries[]` item reports owner, type,
 descriptor SHA-256, and a hex preview for descriptors of 64 bytes or less.

+A section name also stays null when its offset is outside the declared string
+table or its bytes lack a NUL terminator. A limitation explains that missing
+name. Note coverage remains complete when all declared note tables and entries
+were examined; an unavailable section name does not erase those note facts.
+
 For GNU notes, `gnu.build_id_hex`, `gnu.abi_tag`, or `gnu.gold_version` are
 filled when the descriptor matches that type. Other owners keep `gnu` null.

@@ -58,6 +63,8 @@ numbering (`PN_XNUM`, including a section count stored when `e_shnum` is 0) is
 unsupported and returns an unsupported-target outcome rather than invalid-input
 recovery.

+Zstandard section-name tables also use a 128 MiB decoder window limit.
+
 `SHF_COMPRESSED` note sections return `unsupported_target` before their payload
 is interpreted or decompressed. Their compression header is storage metadata,
 not a note header. The current result requires physical file offsets for each
@@ -91,6 +91,13 @@ nothing, and `fields: []` returns only `source_index`. Offset/limit page matchin
 rows in original order (defaults 0/64). Unfiltered pages slice the retained
 collection; queries do not decode the file again.

+For `chunks`, `names` matches the four-character IFF chunk tag (for example
+`"AtU8"`, `"Code"`, `"ExpT"`); available `fields` are `index`, `name`,
+`location`, and `payload`. For `lambdas`, `names` matches the resolved function
+name from the atom table; `null` names (unresolved atom indices) are never
+selected by a name filter. For `atoms`, `names` matches the decoded atom name
+string.
+
 `beam` keeps the module, form/Code bounds, original source coverage, and table
 counts. A null count means no table was decoded; zero means a decoded empty
 table. Missing tables and unresolved atom names remain explicit, and an empty
@@ -691,12 +691,8 @@
              "type": "object",
              "properties": {
                "logical_path": { "type": "string" },
-                "declared_sha256": {
-                  "anyOf": [{ "type": "string" }, { "type": "null" }]
-                },
-                "calculated_sha256": {
-                  "anyOf": [{ "type": "string" }, { "type": "null" }]
-                },
+                "declared_sha256": { "type": ["string", "null"] },
+                "calculated_sha256": { "type": ["string", "null"] },
                "unpacked": { "type": "boolean" }
              },
              "required": [
@@ -275,7 +275,7 @@ Additional lanes are explicit, so the base lane stays small:
 REA_FIRMWARE_VERIFY_EXT4=1 npm run fixtures:firmware
 REA_FIRMWARE_VERIFY_EXT4=1 npm run verify:firmware

-# Existing Ghidra 12.1.x and its declared JDK required.
+# Existing Ghidra 12.x (>=12.1) and its declared JDK required.
 REA_FIRMWARE_VERIFY_GHIDRA=1 npm run verify:firmware
 ```

@@ -285,3 +285,10 @@ REA_FIRMWARE_VERIFY_GHIDRA=1 npm run verify:firmware
 `scripts/rea.mjs` to verify the packaged CLI/MCP workflow. Real coverage here is
 generated gzip/USTAR/ext4 with a Linux x64 ELF child; SquashFS, UBIFS, proprietary
 firmware, other hosts and architectures remain unverified.
+
+## Inspect extracted devicetrees
+
+Use [`inspect_devicetree`](devicetree.md) / `rea inspect-devicetree` on an
+extracted DTB for its node/property tree, reservations, hardware summary and
+selected phandle relationships. FDT v16/v17 inspection is portable and requires
+no external tool or disassembler.
@@ -0,0 +1,129 @@
+# GameCube DOL analysis through Ghidra
+
+This lane imports 32-bit big-endian PowerPC GameCube/Wii DOL images through
+Ghidra. It does not execute the image. DOL is a headerless format with no magic
+number, so REA never detects it: the caller must select it explicitly.
+
+Only the cached MEM1 window `0x80000000..0x81800000` is admitted. Wii MEM2
+and uncached aliases are outside this lane.
+
+Not covered: small-data anchors (`r2`/`r13`), REL, RPX, and IDA or Hopper
+support. See [Not supported yet](#not-supported-yet).
+
+## Select the format
+
+CLI:
+
+```bash
+rea inspect /absolute/path/to/main.dol --target-format gamecube-dol --provider ghidra --json
+rea function /absolute/path/to/main.dol 0x80003130 --target-format gamecube-dol --provider ghidra --json
+```
+
+MCP, with the existing `open_binary` tool:
+
+```json
+{
+  "path": "/absolute/path/to/main.dol",
+  "provider_id": "ghidra",
+  "format": "gamecube-dol"
+}
+```
+
+The architecture comes from the DOL header (`powerpc`). Do not pass
+`architecture` with `gamecube-dol`; it is rejected. `entry_point` is optional,
+and if given it must equal the header entry.
+
+Omitting `format` never imports a file as a DOL. Detection does not run for DOL.
+
+## What the import does
+
+REA reads the 256-byte DOL header at admission. It checks every section's file
+range and load address. It records BSS/data overlaps and computes the exact
+uninitialized BSS gaps once. Malformed headers are refused before Ghidra starts.
+
+Ghidra then runs in two steps:
+
+1. The standard `BinaryLoader` maps the whole file at base `0x0`, with
+   `-processor` and `-cspec` taken from the language selection below.
+2. The pre-script `bridge/ghidra/ReaGhidraPrepareDol.java` reads a section file
+   that REA wrote from the parsed header, with versioned collection counts. It creates one initialized block per
+   used text and data section at its load address, with file bytes from the
+   section's file offset. The whole-file block is removed before the section
+   blocks are created. Text is read-execute and data is read-write. It sets the
+   entry point and labels the entry
+   `__start`.
+
+Sections that the header marks unused are not mapped. The 256-byte header and
+any bytes between sections are not mapped either.
+
+## BSS
+
+A DOL has one BSS range, and it is not always disjoint from the data sections.
+The domain parser computes the parts of BSS that no data section covers. Both
+the pre-script and load-image attestation consume those parsed ranges. The
+pre-script creates uninitialized read-write blocks only in those gaps. Where BSS overlaps a data slot, that slot
+keeps its file bytes. Overlapping slot indexes are reported by the parser.
+
+## Bound language
+
+The default language is `PowerPC:BE:32:default` with compiler spec `default`,
+which ships with Ghidra. The load-image attestation checks the language Ghidra
+reports, not only the requested one.
+
+### Optional Gekko/Broadway override
+
+`REA_GHIDRA_LANGUAGE_ID=PowerPC:BE:32:Gekko_Broadway` selects the Gekko/Broadway
+variant. The language is not in stock Ghidra. It comes from the GameCubeLoader
+extension, by Cuyler, licensed under Apache-2.0. The extension ships
+`ppc_gekko_broadway.ldefs` under its `data/languages` directory and must be
+installed in the Ghidra installation's `Ghidra/Extensions` directory. The stock
+lane never requires it.
+
+Any other language id must start with `PowerPC:BE:32:`. Other languages are
+refused with a specific constraint.
+
+## Paired-single limitation
+
+The stock `PowerPC:BE:32:default` language does not decode the paired-single
+instructions that Gekko and Broadway add. Those words decode as bad or undefined
+instructions. Use the Gekko override to decode them.
+
+## Verification
+
+The source-owned fixture is built from `tests/conformance/c/ppc.c`,
+`tests/conformance/c/dol.c`, `tests/conformance/ghidra/ppc-probe.S` and the
+linker script `tests/conformance/ghidra/dol-fixture.ld`. It is converted to a DOL
+by `tests/conformance/ghidra/dol-fixture.mjs`. Its text is at `0x80003100`, and
+its single BSS range overlaps data slot 1 and leaves a gap. The fixture is
+never executed. The real GameCube or Wii game images are never used.
+
+```bash
+GHIDRA_INSTALL_DIR=/absolute/path/to/ghidra npm run verify:ghidra:dol
+```
+
+The lane needs the same toolchain as the PowerPC ELF lane: `REA_PPC_CLANG`,
+`REA_PPC_READELF` and LLD. An independent DOL header reader and GNU readelf
+(run on the source ELF) check the section table, file bytes, entry and BSS gap
+before Ghidra starts. The checks never use REA's parser.
+
+After import, the lane checks the load-image attestation (`verified`), the
+bound language, the `__start` entry procedure, a direct call to the leaf
+function, decompilation, and bytes at the data, tail, marker and BSS-gap
+addresses. It also checks CLI identity.
+
+The Gekko pass runs only when `PowerPC:BE:32:Gekko_Broadway` is in the Ghidra
+installation's language catalog, the same catalog REA uses to admit
+`REA_GHIDRA_LANGUAGE_ID`. A language that exists only in a user extension under
+`~/Library/ghidra` is not admitted, so the lane prints
+`skipped: PowerPC:BE:32:Gekko_Broadway (not in the Ghidra installation catalog that REA admits); stock lane still verified`
+and still succeeds on the stock checks.
+
+The ELF lane (`npm run verify:ghidra:ppc`) is separate. See
+[PowerPC ELF analysis through Ghidra](/ghidra-ppc).
+
+## Not supported yet
+
+- Small-data anchors: `r2` and `r13` are not seeded from the DOL header.
+- REL (relocatable modules) and RPX (Wii U) are not admitted.
+- IDA and Hopper refuse `gamecube-dol`. Ghidra is the only provider.
+- Disc images (ISO/GCM) are not supported. Pass an extracted DOL file.
@@ -3,7 +3,7 @@
 REA can analyze DOS MZ executables and explicitly selected COM images through the bring-your-own Ghidra adapter.
 The Linux x64 and macOS arm64 verification lanes exercise actual 16-bit disassembly and
 decompilation through the CLI and stdio MCP. Provider admission accepts Ghidra
-12.1.x and that installation's declared JDK range. The verification lane uses
+12.x (>=12.1) and that installation's declared JDK range. The verification lane uses
 Ghidra 12.1.4 and JDK 21; no DOS emulator or cross-compiler is required.

 ## Open and inspect
@@ -29,13 +29,18 @@ point using the available structural bytes and actual file length. It reports
 those DOS facts separately from Windows-header evidence. A recognized PE
 signature remains PE; recognized NE, LE, and LX headers are explicitly
 unsupported. A nonzero Windows-header pointer without a recognized signature
-remains an unresolved candidate, even when the DOS structure validates:
-automatic target selection fails closed and reports both observations.
-REA does not infer DOS intent from padding or infer a damaged Windows header
-from the pointer alone. Inventory classification is a bounded-prefix format
-hint; it returns `unknown` for that candidate or when its prefix cannot
-establish the format. That result is distinct from complete DOS validation and
-does not decide target admission.
+usually remains an unresolved candidate, even when the DOS structure validates:
+automatic target selection fails closed and reports both observations. When a
+nonempty relocation table ends inside a complete DOS header, the remaining
+header bytes belong to DOS padding; a nonzero dword there is not a Windows
+declaration. An unread signature beyond the current probe is requested before
+that padding rule applies. This avoids manufacturing a Windows header from
+original DOS padding while preserving rejection of damaged Windows
+declarations.
+Inventory classification is a bounded-prefix format hint; it returns `unknown`
+for an unresolved candidate or when its prefix cannot establish the format.
+That result is distinct from complete DOS validation and does not decide target
+admission.

 Ghidra imports a private target snapshot with `MzLoader`, language
 `x86:LE:16:Real Mode`, and compiler specification `default`. These settings,
@@ -24,7 +24,8 @@ specific unsupported constraint rather than guessing a compatible profile.

 A second admission covers recordless legacy firmware images
 ([#1620](https://github.com/morluto/rea/issues/1620)): ELF32 `ET_EXEC` headers
-declaring `EF_MIPS_ARCH_32` or `EF_MIPS_ARCH_32R2` with an unspecified ABI
+declaring `EF_MIPS_ARCH_1` (MIPS-I, a zero ISA field), `EF_MIPS_ARCH_32` or
+`EF_MIPS_ARCH_32R2` with an unspecified ABI
 field, `EF_MIPS_ABI2` clear, and an _inspected_ absence of any ABI flags
 record (a target whose record was merely not observed stays refused). For
 these images o32 is an analysis assumption derived from the ELF32/ET_EXEC
@@ -40,9 +41,17 @@ refusal. A header that declares an ABI field but carries no record is still
 refused. Two further boundaries apply: an inspection that could not examine
 every ABI declaration source (for example a carved ELF whose section table
 extends past the captured bytes without a program-header record) does not
-establish the recordless admission, and an `EF_MIPS_ARCH_32` header that
-_declares_ an ABI is refused rather than relabeled, because the declared-ABI
-lane is verified for `EF_MIPS_ARCH_32R2` headers only.
+establish the recordless admission, and an `EF_MIPS_ARCH_1` or
+`EF_MIPS_ARCH_32` header that _declares_ an ABI is refused rather than
+relabeled, because the declared-ABI lane is verified for
+`EF_MIPS_ARCH_32R2` headers only. The recordless MIPS-I lane pins the same
+generic 32-bit language, which also decodes later MIPS32 instructions; the
+session states that conformance to the MIPS-I subset is not established from
+the header alone, and names the committed language when the caller selected a
+variant instead of the pin. A committed profile is bound to the current
+target's lane and captured ELF metadata before startup; reusing a profile
+resolved for the other recordless lane is refused rather than exporting
+attribution for a target it did not describe.

 Explicit `EF_MIPS_FP64` and `EF_MIPS_NAN2008` declarations are refused. Their
 absence is insufficient: Clang can emit identical `e_flags` for FP32, FP64 and
@@ -3,7 +3,8 @@
 This lane extends native ELF analysis to 32-bit big-endian PowerPC; it does
 not execute PowerPC code. It is the first milestone of
 [#1741](https://github.com/morluto/rea/issues/1741). GameCube/Wii DOL
-executables, PPC64 and other PowerPC variants are separate follow-ups.
+executables are covered by [GameCube DOL analysis](ghidra-dol.md). PPC64 and other
+PowerPC variants remain separate follow-ups.

 ## Admission boundary

@@ -15,7 +15,7 @@ snapshot parser and a separate optional annotation extension. Check the
 [release boundary](installation.md#released-package-and-main) when using npm.

 See [import language and analysis seeds](installation.md#ghidra-import-language-and-analysis-seeds)
-to override the header-detected language or seed analysis. An override that conflicts with a fixed raw, DOS, PSP, MIPS or RISC-V import
+to override the header-detected language or seed analysis. An override that conflicts with a fixed raw, DOS, PSP, MIPS, RISC-V or GameCube DOL import
 is a configuration error naming the conflicting settings. It does not make an
 otherwise admitted target unsupported; REA preserves the requested settings.
 An inaccessible language
@@ -30,12 +30,35 @@ signal. Confirm resource causes from process output or host/container records;
 operation-scoped JVM `OutOfMemoryError` observations retain their separate resource
 classification. Automatic kernel or cgroup OOM attribution is not implemented.

+After the authenticated startup handshake, rejected inputs (`invalid_request`,
+`not_found`, `ambiguous`, or an invalid function name) use
+`diagnostics.diagnostic_scope: "request"` when their active output checkpoint is
+available. They preserve the active request's
+`failure_output`, target/profile identity and runtime/log coordinates, while
+omitting cumulative launcher stdout/stderr and launch-support output. Startup,
+process, protocol and other remote failures retain full session diagnostics.
+The Ghidra client still owns its bounded cumulative output; this projection does
+not clear it or alter session readiness. Log paths refer to the owned ephemeral
+runtime and are removed by normal cleanup.
+
 Provider selection and profile identity follow
 [MCP contracts](mcp-contracts.md#identity-and-discovery). One deep
 provider stays bound to the target; runtime failure never selects another
 provider automatically. The contracts below describe Ghidra observations,
 not equivalence with another engine's pseudocode or analysis database.

+## Request payload ceiling
+
+Ghidra requests use `REA_BRIDGE_MAX_REQUEST_BYTES`: default 16 MiB, with a
+configurable range of 7,464–536,870,887 bytes. REA measures UTF-8 JSON, including
+escaping, before allocating the serialized request or sending it. The framing
+newline is excluded. An oversized request returns `resource_constraint` with
+the effective setting, its source, and the exact payload byte count.
+
+Set the value in the environment that starts REA, then restart REA to apply it.
+This setting is enforced by the REA client; the Java bridge has no corresponding
+request ceiling.
+
 ## Admitted inventory semantics

 | Concern          | Ghidra contract                                                                                                                                                                                                                                                                                 |
@@ -148,6 +171,43 @@ have no file backing. ELF mappings are observed
 without independent format-specific load-image verification, as the result's
 status and limitations state.

+For large relocation inventories, select MCP `inspect_native_load_image` with
+`detail: "summary"`. It returns verification state, observed identity and counts,
+while retaining complete Evidence. Use `normalized_result.parent_evidence_id`
+with `inspect_analysis_view` and a view such as:
+
+```json
+{
+  "kind": "native-load-image",
+  "collection": "relocations",
+  "offset": 0,
+  "limit": 32,
+  "fields": ["address", "status", "type"]
+}
+```
+
+Collections are `source_files`, `mappings`, `relocations`, `entry_points`,
+`entry_context`, `checks` and DOL `sections`. Optional
+`indices` select original row indices before paging; empty indices select none.
+Fields are collection-specific. Relocation defaults omit byte payloads; check defaults omit potentially large `expected`/`observed` inventories. Request those fields explicitly when needed. Other collections default to all fields. Metadata recovery remains counted and retained in complete parent Evidence.
+Parent Evidence, collection and `source_index` identify a row, including same-address
+relocation alternatives. Null counts or rows mean unrecorded or inapplicable;
+they never establish an empty observation. Exhausting a page does not upgrade
+unsupported verification or runtime coverage. Pages query immutable retained
+facts without reopening the target or repeating Ghidra work.
+Each page carries the source's structured `verification_status` independently
+of its page coverage.
+
+CLI summary delivery requires a complete Evidence bundle:
+
+```sh
+rea inspect-native-load-image <path> --provider ghidra --detail summary --evidence_output /new/load-image.json --json
+```
+
+Read selected pages later through `inspect-analysis-view` using the returned
+parent ID and an `evidence-file` source pointing to that bundle. Complete
+delivery remains the default in both adapters.
+
 An unsuccessful numeric procedure lookup reports the current Ghidra image base
 and gives the CLI commands above alongside the corresponding MCP operations.
 Repeat any target-format, architecture, and entry-point options used to open the
@@ -175,7 +235,7 @@ profile stages before retrying their retained descriptors.

 | Concern                 | Ghidra contract                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            |
 | ----------------------- | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
-| Decompiler lifetime     | One persistent `DecompInterface` is opened for the imported Program and disposed during bridge shutdown. Native decompilation has no fixed per-function deadline unless `REA_GHIDRA_DECOMPILE_TIMEOUT_SECONDS` sets one; a decompile that reaches it fails only that request with `remote_code` `decompile_timed_out`, the Program and session stay open, and the next decompile uses a fresh decompiler process. External functions or functions without bodies return `null`; cancellation and native failure remain distinct.                                                                                           |
+| Decompiler lifetime     | One persistent `DecompInterface` is opened for the imported Program and disposed during bridge shutdown. Native decompilation has no fixed per-function deadline unless the launch setting `REA_GHIDRA_DECOMPILE_TIMEOUT_SECONDS` or runtime override `ghidra.decompile_timeout_seconds` sets one; a decompile that reaches it fails only that request with `remote_code` `decompile_timed_out`, the Program and session stay open, and the next decompile uses a fresh decompiler process. External functions or functions without bodies return `null`; cancellation and native failure remain distinct.                 |
 | Serialization           | A FIFO sends one Program request at a time. Caller cancellation removes queued work promptly and is passed to active socket waits. This is an adapter safety commitment, not a claim that every Ghidra API is thread-safe.                                                                                                                                                                                                                                                                                                                                                                                                 |
 | Function identity       | Every function result carries the entry address and Ghidra FunctionManager classification for external, thunk, and resolved thunk target. These are observations, not proof that unresolved targetless calls have been recovered.                                                                                                                                                                                                                                                                                                                                                                                          |
 | Assembly and pseudocode | Assembly is complete Ghidra Listing text; pseudocode is Ghidra decompiler output. Neither is original source, and cross-provider comparison never treats Hopper and Ghidra text as equal or unequal semantic facts.                                                                                                                                                                                                                                                                                                                                                                                                        |
@@ -185,6 +245,13 @@ profile stages before retrying their retained descriptors.
 | P-code value flow       | Function dossiers include up to 3,000 high-p-code operations, at most 64 inputs per operation, and 12,000 def-use edges. Results identify memory reads/writes, branches, and calls by p-code opcode, and mark decompiler-dead operations. Large results report truncation, an omitted-operation lower bound, and known omitted-input/edge counts. The dossier is an intra-function graph; `trace_native_values` composes derived parameter/argument and return/output dependencies across resolved calls. It does not resolve memory aliasing, call side effects, runtime behavior, persistent state, or business meaning. |
 | Result extent           | Function instruction scans and native API boundary observations remain complete. P-code flow is the explicit bounded exception; its count fields distinguish exact retained counts from lower-bound or known-omitted counts. Caller cancellation and provider failures remain distinct.                                                                                                                                                                                                                                                                                                                                    |

+Runtime updates apply to newly accepted operations on the existing Program.
+They preserve accepted budgets and do not clear cleanup blockers or change the
+client deadline. Transient decompile timeout failures remain uncached so the
+same function can be retried after raising the limit. See the
+[settings design](design/limits-and-recovery.md) for snapshots, precedence,
+and provider integration.
+
 Function extents and instruction completeness refer to Ghidra's analyzed body.
 An inferred no-return call can terminate that body before subsequent bytes.
 Pseudocode, assembly, procedure info, instruction windows, incoming and outgoing
@@ -7,6 +7,9 @@ releases have not been verified. Format 1 is unsupported.

 Inspection retains the original header and directory facts, including engine
 version, flags, declared file count, source paths, offsets and declared MD5.
+For a member declared as `res://scenes/main.gd`, the occurrence's
+`source_path` retains that exact declaration while `logical_path` is
+`scenes/main.gd`, the relative path used for lookup and extraction.
 Observed plaintext bytes receive content-addressed SHA-256 identities. MD5 is a
 container integrity claim, separate from the observed SHA-256. A mismatch fails
 by default; `--integrity-policy record-and-continue` retains the observed bytes
@@ -62,10 +62,11 @@ Collections are `sections`, `images`, `types`, `methods`, `fields`,
 `generic_method_instances` and `generic_method_issues`. Every returned row includes
 its source `index`, scoped by artifact SHA-256 and collection. All collections
 accept batch `indices` and `fields`. Exact `names` filtering is supported for
-`sections`, `images`, `types`, `methods`, `fields`, `properties`, `events` and
-`parameters`; native `return_types`, `field_types` and `parameter_types` rows
-are selected by source indices (or `method_indices` for `parameter_types`),
-not rendered names. Types also accept `image_indices`, `namespaces` and
+`sections`, `images`, `types`, `methods`, `fields`, `properties`, `events`,
+`parameters`, `return_types`, `field_types`, `parameter_types` and
+`generic_method_instances`. Native type names match the retained rendered display value exactly; every same-name row
+keeps its source index, and an unavailable (`null`) name never matches a string.
+Types also accept `image_indices`, `namespaces` and
 `declaring_types`; methods, fields, properties and events accept
 `declaring_types`. Parameters accept exact `method_indices`, so a batch of
 method indices retrieves their parameters without reading the entire parameter
@@ -240,7 +241,7 @@ record addresses remain distinct candidates, and conflicting file mappings
 remain malformed.

 Module records establish names through their declared NUL-terminated string pointers. NUL/0xFF padding, spaces, Unicode and suffix-shared storage are supported. A pointer to a longer string does not match just its suffix; a pointer directly into a shared suffix may name it. Exact reversed UTF-8 matching avoids rescanning the file for every name and retains duplicate-name owners until module records resolve them. A contributor investigated a Linux
-`GameAssembly.so` from Unity 2023.2.13f1 whose static registration was not located. When no static pair is resolved on x86-64, the reader searches executable ranges for bytes consistent with RIP-relative LEA/MOV references to module-array candidates. Exactly one referenced array candidate must remain. `code_gen_modules_field` is then `null`, and Evidence is **inferred**: instruction boundaries, the absence of a static registration elsewhere, and runtime use were not verified. The module records and slots themselves remain file observations. Static-table associations are **derived**. Otherwise the result is `code-registration-not-found`.
+`GameAssembly.so` from Unity 2023.2.13f1 whose static registration was not located. When no static pair is resolved on x86-64 or arm64, the reader searches executable ranges for bytes consistent with a reference to a module-array candidate: RIP-relative LEA/MOV on x86-64, an adjacent `adrp`/`add` pair on arm64. Exactly one referenced array candidate must remain. `code_gen_modules_field` is then `null`, and Evidence is **inferred**: instruction boundaries, the absence of a static registration elsewhere, and runtime use were not verified. The module records and slots themselves remain file observations. Static-table associations are **derived**. Otherwise the result is `code-registration-not-found`. Cpp2IL's StrippedCodeRegSupport plugin also recovers the module list of an inlined CodeRegistration from the module names; this fallback additionally requires the exact located module set and a single code reference. A Unity 2022.3.62f3 macOS Master build checked by a contributor keeps neither registration symbol; its type table is then inferred as described below.

 The binary/metadata pair is caller-selected. Name/count/token agreement is structural evidence, not a cryptographic same-build proof. File-offset locations refer to the primary metadata artifact; linked virtual addresses refer to `binary.artifact`. Both SHA-256 identities remain available in compact native pages as `artifact` and `binary_source`.

@@ -298,6 +299,30 @@ The result adds:
 `Il2CppMetadataRegistration.typesCount` and its value. That record is found as
 the single place whose `fieldOffsetsCount` and `typeDefinitionsSizesCount` both
 equal the metadata type-definition count and whose type table is file mapped.
+Linking reads only that table. When no record on x86-64 or arm64 has both of
+those counts, the reader collects maximal runs of pointers to Il2CppType-shaped
+records (an assigned Il2CppTypeEnum kind from 0x01 to 0x1e; class and
+value-type data below the type-definition count) that are long enough for every
+type index the metadata references. Exactly one such run may exist in the
+image, it must start and end inside its mapping (a run touching either end may
+continue in a neighbouring mapping), and its start must be loaded by the same
+instruction forms as the module-array fallback. `types_field` is then `null`,
+`types_count` is that run's length rather than an observed `typesCount`, and
+Evidence is **inferred**. The run length is at least every referenced type
+index but can differ from `typesCount`: a type-shaped pointer after the table
+would lengthen it, and an unreadable slot (such as an unresolved relocation)
+would end it early. Only the type indices the metadata references are read. A
+second long-enough run anywhere, a run that a type-shaped neighbour extends
+before the loaded address, a run touching a mapping end or a slot the loader
+binds or leaves unresolved (its stored word is only a placeholder), and a covered
+128-byte record whose two counts match but whose other fields are unusable all
+leave `metadata-registration-not-found` rather than a guess; the search stops
+at the second run. The length requirement only separates the type table from
+other pointer runs when the metadata references most of it: on the one Master
+build checked, the highest referenced index is 6,031 of 6,576 entries. A
+metadata referencing few type indices usually
+leaves several short runs and fails closed.
+
 Counts use their declared 32-bit width independently of alignment padding.
 The complete 128-byte registration must have unambiguous loader coverage. Its
 used fields through byte 112 must be file-backed; a trailing declared zero-fill
@@ -353,7 +378,8 @@ the result has no rows, and `generic_method_pointers_field`,
 `generic_method_pointers_count` and `generic_method_table_stride` are `null`.
 A table of a few rows can still leave two layouts agreeing, which fails as
 ambiguous rather than picking one. Metadata versions 24 and 39 and builds
-without a static CodeRegistration (`code_gen_modules_field` `null`) fail as
+without a static CodeRegistration (`code_gen_modules_field` `null`) or
+MetadataRegistration (`types_field` `null`) fail as
 `generic-methods-unsupported`: for version 24 the type-definition generic
 container offset and the generic class layout have not been checked against a
 real build, so it is refused rather than guessed.
@@ -418,10 +444,10 @@ The builds checked are listed after the module search rules above.
 | `code-registration-not-found`           | input error | No unique module table or executable-byte array candidate was resolved.                                      |
 | `invalid-method-token`                  | input error | A token is outside its module's method-pointer rows, or a MethodDef row is reused within one image.          |
 | `invalid-method-pointer`                | input error | A slot is unavailable or its nonzero address lacks unambiguous executable file coverage.                     |
-| `metadata-registration-not-found`       | input error | No single MetadataRegistration matches the type-definition count.                                            |
+| `metadata-registration-not-found`       | input error | No single MetadataRegistration or code-loaded type-table candidate was resolved.                             |
 | `invalid-type`                          | input error | A type index or `Il2CppType` record is out of range, unmapped or malformed.                                  |
 | `unsupported-type-kind`                 | unsupported | A valid type kind has no implemented rendering.                                                              |
-| `generic-methods-unsupported`           | unsupported | Generic instances were requested for metadata version 24 or 39 or a build without a static CodeRegistration. |
+| `generic-methods-unsupported`           | unsupported | Generic instances were requested for metadata version 24 or 39, or a build lacks either static registration. |
 | `generic-method-registration-not-found` | input error | No CodeRegistration layout bounds every genericMethodTable row, or the generic tables are unreadable.        |
 | `ambiguous-generic-method-registration` | input error | More than one CodeRegistration layout bounds every genericMethodTable row.                                   |

@@ -47,19 +47,20 @@ For runtime instrumentation, see the [Frida guide](./frida-instrumentation.md).

 ## Choose a guide

-| Task                                                | Guides                                                                                                                                                                                                                                                                                                                                                                                                                                         |
-| --------------------------------------------------- | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
-| Identify a desktop installation                     | [Runtime candidates, evidence and follow-up files](desktop-applications.md)                                                                                                                                                                                                                                                                                                                                                                    |
-| Inspect native functions, references, or types      | [Native binaries](native-investigation.md), [Go metadata](go-binaries.md), [Rust dependencies](rust-binaries.md), [CPython pyc files](python-pyc.md), [PE certificates](pe-certificates.md), [PE imports](pe-imports.md), [ELF notes](elf-notes.md), [Apple IPS](apple-ips.md), [Erlang BEAM](erlang-beam.md), [offline ELF layout](binary-diagnostics.md), [recorded crashes](recorded-crashes.md)                                            |
-| Select a native provider or import format           | [Ghidra semantics](ghidra-provider.md), [Windows](windows-ghidra-p0.md), [DOS](ghidra-dos.md), [raw bytes](raw-binary.md), [MIPS](ghidra-mips.md), [PSP](ghidra-psp.md), [NativeAOT](ghidra-nativeaot.md), [IDA](ida-provider.md), [Kuna](kuna-provider.md), [JEB](jeb-analysis.md)                                                                                                                                                            |
-| Analyze JavaScript or Electron artifacts            | [Static analysis](javascript-artifact-reconstruction.md), [tracing and comparisons](javascript-application-workflows.md), [application graph](javascript-application-graph.md), [source recovery](javascript-recovery.md)                                                                                                                                                                                                                      |
-| Compare static JavaScript with runtime observations | [Runtime attribution](javascript-runtime-observation.md), [reconciliation](javascript-runtime-reconciliation.md), [Electron observation](electron-observation.md), [Electron fuses](electron-fuses.md)                                                                                                                                                                                                                                         |
-| Inspect assemblies, packages, or firmware           | [Godot PCK](godot-pck.md), [.NET](managed-code-analysis.md), [Python packages](python-packaged-applications.md), [Android](android-analysis.md), [APK signatures](apk-signature.md), [Apktool resources](apktool-resource-analysis.md), [ADB acquisition](adb-device-analysis.md), [Apple](apple-application-analysis.md), [Harmony](harmony-analysis.md), [firmware](firmware-analysis.md), [WASM](wasm-artifacts.md), [EVM](evm-bytecode.md) |
-| Observe or compare a browser scenario               | [CDP observation](browser-observation.md), [scenarios](browser-scenario-contract.md), [runtime evidence](web-runtime.md), [historical captures](web-network-captures.md)                                                                                                                                                                                                                                                                       |
-| Serve recorded behavior as an agent environment     | [Agent environments](agent-environments.md)                                                                                                                                                                                                                                                                                                                                                                                                    |
-| Trace captured website source                       | [Source locations](web-source-location.md), [module traces](website-module-trace.md), [script export](website-script-export.md)                                                                                                                                                                                                                                                                                                                |
-| Capture and compare a command                       | [Process capture](process-capture.md)                                                                                                                                                                                                                                                                                                                                                                                                          |
-| Use CLI/MCP and retain evidence                     | [CLI](cli.md), [MCP contracts](mcp-contracts.md), [agent prompts](mcp-prompts.md), [obligation ledgers](reconstruction-obligation-ledgers.md)                                                                                                                                                                                                                                                                                                  |
+| Task                                                | Guides                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  |
+| --------------------------------------------------- | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
+| Identify a desktop installation                     | [Runtime candidates, evidence and follow-up files](desktop-applications.md)                                                                                                                                                                                                                                                                                                                                                                                                             |
+| Inspect native functions, references, or types      | [Native binaries](native-investigation.md), [Go metadata](go-binaries.md), [Rust dependencies](rust-binaries.md), [CPython pyc files](python-pyc.md), [PE certificates](pe-certificates.md), [PE imports](pe-imports.md), [PE TLS/load config](pe-load-config.md), [ELF notes](elf-notes.md), [Linux kernel modules](kernel-modules.md), [Apple IPS](apple-ips.md), [Erlang BEAM](erlang-beam.md), [offline ELF layout](binary-diagnostics.md), [recorded crashes](recorded-crashes.md) |
+| Inspect native functions, references, or types      | [Native binaries](native-investigation.md), [Go metadata](go-binaries.md), [Rust dependencies](rust-binaries.md), [CPython pyc files](python-pyc.md), [PE certificates](pe-certificates.md), [PE imports](pe-imports.md), [PE TLS/load config](pe-load-config.md), [ELF notes](elf-notes.md), [Apple IPS](apple-ips.md), [Erlang BEAM](erlang-beam.md), [offline ELF layout](binary-diagnostics.md), [recorded crashes](recorded-crashes.md)                                            |
+| Select a native provider or import format           | [Ghidra semantics](ghidra-provider.md), [Windows](windows-ghidra-p0.md), [DOS](ghidra-dos.md), [raw bytes](raw-binary.md), [GameCube DOL](ghidra-dol.md), [MIPS](ghidra-mips.md), [PSP](ghidra-psp.md), [NativeAOT](ghidra-nativeaot.md), [IDA](ida-provider.md), [Kuna](kuna-provider.md), [JEB](jeb-analysis.md)                                                                                                                                                                      |
+| Analyze JavaScript or Electron artifacts            | [Static analysis](javascript-artifact-reconstruction.md), [tracing and comparisons](javascript-application-workflows.md), [application graph](javascript-application-graph.md), [source recovery](javascript-recovery.md)                                                                                                                                                                                                                                                               |
+| Compare static JavaScript with runtime observations | [Runtime attribution](javascript-runtime-observation.md), [reconciliation](javascript-runtime-reconciliation.md), [Electron observation](electron-observation.md), [Electron fuses](electron-fuses.md)                                                                                                                                                                                                                                                                                  |
+| Inspect assemblies, packages, or firmware           | [Godot PCK](godot-pck.md), [.NET](managed-code-analysis.md), [Python packages](python-packaged-applications.md), [Android](android-analysis.md), [APK signatures](apk-signature.md), [Apktool resources](apktool-resource-analysis.md), [ADB acquisition](adb-device-analysis.md), [Apple](apple-application-analysis.md), [Harmony](harmony-analysis.md), [firmware](firmware-analysis.md), [WASM](wasm-artifacts.md), [EVM](evm-bytecode.md)                                          |
+| Observe or compare a browser scenario               | [CDP observation](browser-observation.md), [scenarios](browser-scenario-contract.md), [runtime evidence](web-runtime.md), [historical captures](web-network-captures.md)                                                                                                                                                                                                                                                                                                                |
+| Serve recorded behavior as an agent environment     | [Agent environments](agent-environments.md)                                                                                                                                                                                                                                                                                                                                                                                                                                             |
+| Trace captured website source                       | [Source locations](web-source-location.md), [module traces](website-module-trace.md), [script export](website-script-export.md)                                                                                                                                                                                                                                                                                                                                                         |
+| Capture and compare a command                       | [Process capture](process-capture.md)                                                                                                                                                                                                                                                                                                                                                                                                                                                   |
+| Use CLI/MCP and retain evidence                     | [CLI](cli.md), [MCP contracts](mcp-contracts.md), [agent prompts](mcp-prompts.md), [obligation ledgers](reconstruction-obligation-ledgers.md)                                                                                                                                                                                                                                                                                                                                           |

 For development, use [testing](testing.md), [client verification](client-verification.md),
 [tool design](tool-design.md), [admission limits and recovery](design/limits-and-recovery.md),
@@ -86,7 +86,7 @@ these checks do not lock out another writer modifying the same file in place,
 or exclude pathname changes between the final check and publication.
 Setup also retains valid environment overrides in REA's existing server entry,
 such as `REA_MCP_INPUT_SCHEMA_PROFILE`, `REA_MCP_OUTPUT_SCHEMA_PROFILE`, and
-`REA_MCP_MAX_RESPONSE_BYTES`.
+`REA_MCP_MAX_RESPONSE_BYTES`, and `REA_MCP_TOOL_FAMILIES`.
 Detected provider settings replace only matching environment keys.
 Setup manages REA's launcher, selected provider settings, and recommended timeout
 defaults. Codex approval policies, tool selections, and other caller-owned server
@@ -204,7 +204,8 @@ identity remains available at `identity.catalog`.

 Setup pins package-runner MCP registrations to the exact installed REA version,
 installs the matching skill and on-demand references in the same plan, and adds
-`startup_timeout_sec = 30` for Codex and Grok Build. Codex also receives a
+`startup_timeout_sec = 30` for Codex and Grok Build when no positive timeout
+is already configured. Codex also receives a
 `tool_timeout_sec` derived from known provider startup plus operation headroom.

 ## Limit REA to one project or agent profile
@@ -319,14 +320,14 @@ Register with the variable unset:
 <!-- x-release-please-start-version -->

 ```bash
-claude mcp add --scope local rea -- npx -y rea-agents@6.7.0 mcp
+claude mcp add --scope local rea -- npx -y rea-agents@6.8.0 mcp
 ```

 On native Windows, use the same project directory and wrap the package-runner
 shim so the stdio client can launch it:

 ```powershell
-claude mcp add --scope local rea -- cmd.exe /d /c npx -y rea-agents@6.7.0 mcp
+claude mcp add --scope local rea -- cmd.exe /d /c npx -y rea-agents@6.8.0 mcp
 ```

 <!-- x-release-please-end -->
@@ -341,7 +342,7 @@ remove it with `claude mcp remove --scope local rea` from the same directory.
 To move it to a newer release, first back up the project entry in
 `~/.claude.json` and record its environment and other metadata. In particular,
 preserve caller-selected overrides such as `REA_MCP_INPUT_SCHEMA_PROFILE` and
-`REA_MCP_MAX_RESPONSE_BYTES`. Run `claude mcp remove --scope local rea` from the
+`REA_MCP_MAX_RESPONSE_BYTES`, and `REA_MCP_TOOL_FAMILIES`. Run `claude mcp remove --scope local rea` from the
 same directory, then recreate it with the platform-appropriate command above
 and the new version. Reapply every recorded environment value with Claude
 Code's `mcp add --env NAME=value` options and restore any other retained entry
@@ -412,6 +413,13 @@ The public error code varies by caller: `capability_unavailable`,
 only a generic startup error. Check this prerequisite before following
 provider-specific recovery advice.

+`binary_session` still returns status on such a host. Providers whose
+readiness check reaches the owned-child launch, such as Ghidra's Java probe,
+JADX and Apktool, report themselves unavailable with a reason naming the
+missing `ps`. A provider that fails an earlier configuration check, such as
+JADX without `REA_JADX_MCP_JAR`, keeps that reason. The other providers keep
+their own status. `open_binary` keeps the refusal described above.
+
 ## Diagnose, update, and remove

 `rea doctor --json` is strictly read-only. `rea update` updates only the npm or Bun global installation that owns the running CLI. Source checkouts and package-runner copies must be updated through the mechanism that owns them; a fresh package-runner invocation can use `npx rea-agents@latest` or `bunx rea-agents@latest`. `rea uninstall` removes only REA-owned agent registrations and skill files; `--purge-data` additionally removes REA cache and state paths.
@@ -495,6 +503,10 @@ Do not rename `index.cjs` to `index.mjs` or disable protection to make startup p

 ### Update the owning installation

+Read-only metadata and version checks time out after 10 seconds. This does not
+interrupt a package installation already in progress. If a probe cannot be
+stopped, the updater reports a cleanup failure.
+
 `rea update` installs the exact resolved
 release into the npm prefix or Bun global directory that owns the running
 package, then checks the new executable's version before reporting success.
@@ -616,9 +628,12 @@ hosted connector; see [its configuration](client-configuration.md#other-client-s
 | WorkBuddy          | `workbuddy`      |
 | ZCode              | `zcode`          |
 | DeepSeek Harness   | `dsh`            |
+| FreeBuff           | `freebuff`       |

 `droid`, `dsh`, `kimi`, `qoder`, `trae`, `workbuddy`, and `zcode` require
 `[email protected]` or later. The 6.4.0 registry check above does not cover them.
+`freebuff` requires `[email protected]` or later. Older releases reject
+`rea setup --client freebuff` as an unsupported client.

 See [client configuration and troubleshooting](client-configuration.md) for
 configuration paths, profiles, trust policies, and schema-limit workarounds.
@@ -646,6 +661,10 @@ an existing Hopper launcher is selected through `HOPPER_LAUNCHER_PATH`. Ghidra
 and IDA have their own provider-specific host requirements; Windows Ghidra uses
 the [experimental P0 boundary](windows-ghidra-p0.md).

+If the Linux package download receives an HTTP failure, setup includes the
+observed HTTP status in its `download_failed` diagnostic. The status does not
+establish the underlying cause or guarantee that retrying will succeed.
+
 Hopper metadata and package downloads require HTTPS throughout the redirect
 chain; a redirect to HTTP is refused before that destination is requested.

@@ -681,6 +700,12 @@ search permissions (`0700`) on a directory you own before retrying.

 On supported Linux distributions, approved setup verifies Hopper's official
 `.deb`, `.rpm`, or Arch package before invoking the native package manager.
+On apt systems, Hopper's runtime dependencies are installed with
+`--no-upgrade` in their own transaction, so setup no longer names an
+already-installed dependency as an upgrade target. apt can still upgrade a
+package that the Hopper package or the Python library repair requires at a
+newer version. Arch's `pacman -S --needed` still updates an outdated
+dependency.
 The official release feed selects the current public demo without a version
 pin. REA verifies the package's detached PGP signature against Hopper's stable
 primary fingerprint `7C2D73BAFAF5B9A710A69DA1A26DF815099B1BCD`, then checks
@@ -803,7 +828,10 @@ Hopper startup allows 120,000 ms for launch, initial analysis, and authenticated
 bridge readiness. For large targets, set `REA_HOPPER_STARTUP_TIMEOUT_MS` to a
 decimal integer from 1 to 2,147,483,647 milliseconds in the environment that
 starts REA. CLI and MCP use the same setting; invalid values fail configuration
-validation. An MCP client's own request timeout must also allow enough time.
+validation. In MCP, `update_analysis_settings` can set
+`hopper.startup_timeout_ms` for the next startup attempt without restarting REA;
+accepted work keeps its budget and retained cleanup must still complete. An
+MCP client's own request timeout must also allow enough time.
 `open_binary` validates and selects a target without waiting for native provider
 readiness. During Hopper startup, `binary_session.provider_operation_health`
 reports `busy` at stage `launch`; `analysis_activity` describes bridge requests
@@ -954,7 +982,7 @@ copying license secrets into logs, or killing unrelated Hopper processes.

 REA connects to an existing Ghidra installation on Linux x64/arm64, macOS x64/arm64,
 or experimental Windows x64 P0.
-It accepts Ghidra 12.1.x and the 64-bit full JDK declared by that installation's
+It accepts Ghidra 12.x (>=12.1) and the 64-bit full JDK declared by that installation's
 `application.java.min` and `application.java.max`. The JDK's reported platform must also
 map to the same native decompiler directory as the host: a JDK running under
 emulation (for example x86_64 under Rosetta on Apple silicon) or reporting a
@@ -962,7 +990,8 @@ non-host `os.name` fails the doctor
 even when it is an otherwise accepted 64-bit full JDK. Select a matching JDK
 through `JAVA_HOME`; adding another decompiler in the JVM-selected directory
 does not satisfy this host-validated admission rule. Current 12.1 releases require
-JDK 21 or newer and set no maximum. The bridge is verified with Ghidra 12.1.4
+JDK 21 or newer; Ghidra 12.2 declares JDK 25 or newer. Neither sets a maximum.
+The bridge is verified with Ghidra 12.1.4
 and JDK 21. Each installation must include the native decompiler for the host
 architecture in `Ghidra/Features/Decompiler/os/<platform>/` or the corresponding
 `build/os/<platform>/` directory. Linux ARM64 uses `linux_arm_64`; official
@@ -997,9 +1026,13 @@ Target admission preserves recognized PE/NE/LE/LX signatures separately from
 reader layout support. A Windows header overlapping the first 64 DOS-header
 bytes remains an unsupported layout in this release; it is not reported as an
 invalid offset. Tiny PE files with short optional headers have additional
-unverified loader requirements. Unconfirmed nonzero DOS padding remains an
-unresolved Windows-header candidate, with independently validated DOS facts in
-the target error diagnostics; those facts do not prove a Windows header absent.
+unverified loader requirements. A nonzero Windows-header pointer without a
+recognized signature remains an unresolved candidate, with independently
+validated DOS facts in the target error diagnostics; those facts do not prove a
+Windows header absent. When a nonempty relocation table ends inside a complete
+DOS header, the remaining header bytes are DOS padding, so a nonzero dword
+there is not a Windows declaration. An unread signature beyond the current
+probe is requested before that padding rule applies.
 On Linux and macOS, `annotate_native_function` also edits a function name and/or
 entry comments atomically and returns refreshed analysis, and `set_address_name`
 and `set_addresses_names` name a function entry or any other mapped address
@@ -1073,7 +1106,7 @@ the application metadata and headless launcher. An explicitly supplied
 REA reports that error instead of silently selecting another installation.
 This discovery is read-only and does not execute the Ghidra launcher.

-Doctor validates the platform, architecture, Ghidra 12.1.x application version,
+Doctor validates the platform, architecture, Ghidra 12.x (>=12.1) application version,
 `support/analyzeHeadless` or `support/analyzeHeadless.bat`, the installation's
 Java major range, 64-bit JDK bitness, and the presence of `javac`/`javac.exe`.
 It also checks that the reported JVM `os.arch` and `os.name` map to the same native decompiler
@@ -1129,9 +1162,10 @@ This coordinate selects only REA's session-private configuration directory, not
 the installation or an existing user configuration directory.

 Each verified session uses an ephemeral temporary project and isolated
-home/cache/config/temp paths. REA passes `-readOnly`, `-deleteProject`, uses
-Ghidra's default analysis settings, and loads its packaged Java
-bridge via `-scriptPath`; it never opens an existing user project. Linux and
+home/cache/config/temp paths. By default REA passes `-readOnly`, `-deleteProject`,
+uses Ghidra's default analysis settings, and loads its packaged Java
+bridge via `-scriptPath` into a new ephemeral project; opt-in
+[existing-project reuse](#reuse-an-existing-ghidra-project) opens only an owned copy. Linux and
 macOS use a current-user-only local bridge socket and descriptor. The
 project remains under the selected temporary directory. If its Unix socket
 pathname would exceed the host's byte limit, REA allocates a separate owner-only
@@ -1150,7 +1184,7 @@ original process owner for a later cleanup retry.
 The experimental Windows transport uses authenticated IPv4 loopback with a
 private native-owned bearer descriptor and Job Object process ownership.

-Operations begin only after default auto-analysis completes. `open_binary`
+In the default fresh-import mode, operations begin only after default auto-analysis completes. `open_binary`
 selects and validates the target/provider binding; it does not wait for Ghidra
 import and auto-analysis. The first Ghidra-backed query starts that work lazily.
 The provider startup deadline is 330,000 ms by default for import, analysis,
@@ -1169,19 +1203,25 @@ can time out earlier even when Ghidra would complete within its startup deadline
 See [Ghidra first-query deadlines and recovery](mcp-contracts.md#ghidra-first-query-deadlines-and-recovery)
 for client options and the close/reopen recovery flow.

-The 330-second default is configurable. Configuration is read when REA starts:
-changing an environment variable in another shell, or closing and reopening a
-binary in the same MCP server, does not change that server's startup allowance.
+The 330-second default can be changed on a running MCP server by setting
+`ghidra.startup_timeout_ms` through `update_analysis_settings`. The next accepted
+operation that starts a provider uses that value; an accepted startup keeps its
+original budget. Changing an environment variable in another shell, or closing
+and reopening a binary, does not change the launch configuration already read
+by that server.
 For a CLI retry with an example 30-minute allowance:

 ```sh
 REA_GHIDRA_STARTUP_TIMEOUT_MS=1800000 rea analyze /absolute/path/to/app.exe --provider ghidra --json
 ```

-For MCP, export useful Evidence before restarting, close the binary and resolve
-any cleanup failure, update the environment in the client's REA server launch
-configuration, then restart REA and reconnect before reopening the target. Allow
-startup plus the query in the client's own tool-call deadline. Every retry uses
+For MCP, update the runtime setting and resolve any retained cleanup before the
+next startup attempt. Follow the error's close/reopen guidance where needed;
+the settings update does not clear cleanup blockers. To change the launch
+environment instead, export useful Evidence, close the binary and resolve any
+cleanup failure, update the client's REA server launch configuration, then
+restart REA and reconnect. Allow startup plus the query in the client's own
+tool-call deadline; runtime updates do not change that deadline. Each new startup attempt uses
 a fresh ephemeral import; smaller result requests do not reduce the prerequisite
 auto-analysis. A larger time allowance does not raise the JVM heap limit or
 guarantee completion. Keep [heap and host CPU controls](#ghidra-heap-and-cpu-controls)
@@ -1208,9 +1248,14 @@ fails with `provider_timeout` and that message; other Ghidra tools stay
 available. If the caller also cancels while the timeout settles, the session
 still closes and the message says so. Session reuse concerns an active MCP or
 library session; a standalone CLI command still closes its own session when it
-finishes. The limit is read when a Ghidra session
-starts, and Codex/Kimi registrations derived by `rea setup` add it to the tool
-deadline as a single-decompile estimate. A bulk call can need that limit for
+finishes. In MCP, `ghidra.decompile_timeout_seconds` can override the launch
+value for newly accepted operations on the existing Program; explicit `null`
+removes the deadline. A transient timeout remains uncached so the same function
+can be retried after an update. See the
+[settings design](design/limits-and-recovery.md#runtime-settings-through-mcp).
+Codex/Kimi registrations derived by `rea setup` add the selected launch value
+to the tool deadline as a single-decompile estimate; a runtime update does not
+change that registration. A bulk call can need that limit for
 every attempted function plus listing and file work; select the client deadline
 for the workload, split batches, use `decompile_all` limit/resume, or reduce
 `trace_native_values` `max_functions` to select fewer serial decompiles. Ghidra's own interactive default is 30 seconds. Unresolved computed calls
@@ -1270,6 +1315,63 @@ not needed for the make step, only for the Ghidra provider. If your toolchain
 rejects the inherited `-mmacosx-version-min=10.6` flag, retry the make with
 `ADDITIONAL_FLAGS="-w"`.

+### Reuse an existing Ghidra project
+
+For repeated investigations, select an expanded local project marker with
+`REA_GHIDRA_PROJECT_PATH=/absolute/projects/app-analysis.gpr`. Both CLI and MCP
+use this shared selection. `REA_GHIDRA_PROGRAM_NAME` selects one exact program
+in the project root; when omitted it defaults to the selected target's filename.
+Paths, globs and command flags are not program names. The matching `.rep`
+directory must be present; restore `.grez` archives with Ghidra first.
+
+```bash
+export REA_ANALYSIS_PROVIDER=ghidra
+export REA_GHIDRA_PROJECT_PATH=/absolute/projects/app-analysis.gpr
+export REA_GHIDRA_PROGRAM_NAME=app
+rea decompile /absolute/target/app --procedure entry --provider ghidra --json
+```
+
+Set the same variables in the MCP server environment and restart/reconnect;
+`open_binary` still selects the original target file. `rea setup` retains these
+explicit settings in a saved registration. Fresh import remains the default
+when the project setting is absent. This route supports native ELF, PE and
+Mach-O programs on POSIX without provider-pinned import preparation; Windows,
+raw/DOS/DOL and special pinned-language import profiles require fresh import.
+
+REA fingerprints only the selected `.gpr`/`.rep` pair, copies it into its owned
+runtime, verifies the copied content against the committed analysis profile,
+and runs `-process <program> -noanalysis -readOnly`. Ghidra never opens or saves
+the original database; REA reads selected files only for fingerprinting and copying.
+This mode does not copy unrelated sibling projects, rerun repair scripts, or
+admit bridge database edits. Cleanup removes the owned copy.
+The bridge checks the program's recorded import SHA-256 against the admitted
+target digest; mismatches and project changes fail explicitly. Reopen the target
+to resolve a new profile after intentionally changing the source project.
+
+The profile records the caller path, resolved project/name, program and content
+fingerprint. Original analysis settings and completeness remain **unknown**;
+prior annotations or edits are caller-project state, not fresh REA discoveries.
+A matching recorded import digest does not claim that the database is unedited.
+Saved REA seed/analyzer reports remain historical facts in retained source Evidence;
+they are not interpreted as overrides applied by this session.
+Project content participates in snapshot identity, so different project states
+cannot reuse the same profile's cached observations.
+
+To prepare a new project explicitly, use your existing Ghidra installation in a
+new directory you own (this writes that project; REA does not save it for you):
+
+```bash
+mkdir /absolute/new-projects
+GHIDRA_HEADLESS_MAXMEM=1536M JAVA_TOOL_OPTIONS=-XX:ActiveProcessorCount=2 \
+  "$GHIDRA_INSTALL_DIR/support/analyzeHeadless" /absolute/new-projects app-analysis \
+  -import /absolute/target/app -analysisTimeoutPerFile 600 -max-cpu 2
+```
+
+Check that preparation completed successfully before selecting the project.
+Preparation time, disk copy/fingerprinting, engine startup and client deadlines
+are separate costs; reusing a project avoids import/analysis, not all startup.
+Use the [heap/CPU controls](#ghidra-heap-and-cpu-controls) appropriate to the target.
+
 ### Ghidra import language and analysis seeds

 Ghidra detects the language from the executable header. To set it (for example, Borland C++ PE images):
@@ -1444,7 +1546,7 @@ For a client that requires manual configuration, use:
  "mcpServers": {
    "rea": {
      "command": "npx",
-      "args": ["-y", "rea-agents@6.7.0", "mcp"]
+      "args": ["-y", "rea-agents@6.8.0", "mcp"]
    }
  }
 }
@@ -1458,6 +1560,13 @@ setup runs through `bunx`, and pins it to the exact version that performed
 setup. Run current setup to refresh an older registration, then restart the
 client.

+Package runners key their package cache by the requested spec, so the entry
+installed for the `@latest` invocation that ran setup cannot serve the pinned
+registration. Setup therefore materializes the pinned entry once, best-effort
+with a bounded timeout, before finishing. When that step cannot run, for
+example offline, the first client start performs the one-time install inside
+the client's MCP startup deadline and may need one more restart.
+
 ## Package runners and global installation

 A package-runner invocation can use a REA version installed in the current project. To
@@ -448,8 +448,10 @@ uncertainty rather than pretending to execute later writes. References
 handed back by local functions, methods, constructors, async functions, and
 generators also retain escape uncertainty, including when the call is read-only;
 this does not establish that a mutation occurred. Aliases
-and shared children in spread and rest copies retain that uncertainty; copied
-primitive slots and unrelated containing properties remain known. Object rest
+and shared children in spread and rest copies retain that uncertainty. Exposing
+the copy alone does not invalidate copied primitive slots or unrelated containing
+properties. Dynamic child writes such as `copy[key].value = 2` remain conservative
+about which original slot was selected. Object rest
 excludes consumed keys, array rest excludes the consumed prefix for known
 arrays, and later explicit data properties and methods replace earlier object
 spread references. A known array prefix does not expose values from a following
@@ -466,6 +468,11 @@ Receiver projections follow known data fields initialized from `this` or earlier
 self-referencing fields; static fields retain their declaring class identity.
 An alias cycle that repeatedly selects deeper children retains escape uncertainty
 at its recovered roots rather than claiming a fixed number of loop iterations.
+Equivalent member reads in a repeating loop share unknown ordering instead of
+creating a distinct capture for every branch history. Straight-line captures and
+once-only loop inputs retain their own selection sites. When unobserved suffixes
+are widened, their exact observed prefixes stay separate so unrelated siblings
+remain known.

 Writes through an object getter's returned receiver retain that uncertainty
 when the object is an array element, nested inside mixed object/array
@@ -510,8 +517,13 @@ escape uncertainty. External prototype changes and unsupported runtime protocols
 remain unknown rather than supplying exact post-invocation values.
 Identifier references and closure captures share Babel syntax-role facts plus
 explicit binding/write roles; noncomputed declaration keys and import/meta names
-are not lexical reads. Provenance-only expression-depth omissions enter the same typed source coverage
-as value-evaluation bounds and remain visible in retained application Evidence.
+are not lexical reads. TypeScript type positions, including `typeof` type queries
+and computed keys in erased signatures, do not evaluate JavaScript bindings or
+create runtime calls or captures. Decorators on declared class fields can still
+run when the class is defined, and a decorated declared or abstract field can
+evaluate its computed key. Provenance-only expression-depth omissions enter
+the same typed source coverage as value-evaluation bounds and remain visible in
+retained application Evidence.
 Immediate synchronous function results also share the loader reference owner.
 An expression arrow returning the retained CommonJS `require` can preserve that
 loader identity. Possible loader results with opaque alternatives or block
@@ -140,17 +140,24 @@ returns an unavailable error with the retained inventory, rather than claiming
 the selected source does not exist. Observed exact file candidates keep their
 identity; unknown traversal cannot establish a unique application root.

-ASAR header/index admission defaults to 16 MiB / 16777216 bytes. Set
-`REA_ASAR_MAX_HEADER_BYTES` in the environment that starts REA to a decimal
-byte count of at most 268435456 (256 MiB) to raise or lower it; restart REA
-after changing it. Invalid values are configuration errors, never a silent
-fallback. The archive index is read before any member can be selected, so
+ASAR header/index admission defaults to 16 MiB / 16777216 bytes. In MCP, use
+`update_analysis_settings` to set `asar.max_header_bytes` to an integer byte
+count from 1 to 268435456 (256 MiB), then retry the same full-archive request.
+The update applies to new operations without restarting REA; cached headers
+must also satisfy the new admission. For CLI or future MCP processes, set
+`REA_ASAR_MAX_HEADER_BYTES` in the launch environment. Changing that environment
+requires a new REA process. Invalid launch values are configuration errors,
+never a silent fallback. See the
+[settings design](design/limits-and-recovery.md#failure-and-retry) for recovery
+metadata, precedence, and reset behavior.
+
+The archive index is read before any member can be selected, so
 `source_paths`, `--source-path`, `detail: "summary"`, `max_heap_mb`, and
 available host memory do not bypass or raise it. When the header exceeds the
-effective allowance, the failure names it, whether it came from the default or
-the setting, and the setting's limits. Alternatively, analyze an extracted
+effective allowance, the failure reports the value, its known source, and the
+setting's limits. Alternatively, analyze an extracted
 application directory, which does not admit an ASAR header. Repeating the unchanged
-request fails the same way.
+request without changing admission fails the same way.

 ## Read the analysis

@@ -195,6 +202,27 @@ For supplied passive browser or Electron observations, use
 [runtime reconciliation](javascript-runtime-reconciliation.md). It compares
 existing Evidence without rerunning static analysis or contacting CDP.

+Each newly analyzed JavaScript file retains `analysis_coverage` in its graph
+observation. `syntax` distinguishes complete parsing, recovered syntax errors,
+failed parsing and unexamined source. `semantics` records the number of observed
+unknown findings and typed uncertainty, including returned-reference widening
+and unavailable type-only compiler options. `examination` reports static semantic
+resource limits and Electron wrapper expansion limits independently. A completed
+pass does not establish complete runtime semantics. Route examination and result
+capacity remain in the separate route inventory.
+
+Electron applicability is `observed` when a static Electron module reference is
+retained, and otherwise `unknown`: a source without such a reference does not
+prove that the application is inapplicable. Sources excluded by `source_paths`
+retain `not-examined` with a reason and null semantic counts. Historical Evidence
+without this facet remains unmeasured. The existing `parse_status` remains its
+conservative overall summary; finer facts do not relabel earlier partial results.
+
+Summary delivery counts these facts under `summary.coverage.static_sources`.
+Read exact per-file measurements with `inspect_analysis_view`, selecting
+`kind: "javascript-facts"` and `property_keys: ["analysis_coverage"]`, or inspect
+the module item. Both views use retained Evidence and preserve source provenance.
+
 ## ASAR integrity

 ASAR inventory checks Electron integrity metadata for embedded archive entries
@@ -398,8 +426,17 @@ and links whose callee was renamed by a minifier are not recognized.
 Bundler adapters own callback roles: Webpack supplies module, exports, then
 loader; esbuild CommonJS supplies exports, then module. Export extraction uses
 those binding identities for assignments and declarations, so renaming either
-parameter does not change the recovered names. Global property-definition
-intrinsics require lexical and visible-write proof. Factory export declarations
+parameter does not change the recovered names. The convention always supplies
+every role argument, so a role parameter's default never runs: a defaulted
+module or exports parameter keeps its role, and the default expression yields
+no exports, references or chunk keys. `{exports: alias}` in the module position
+binds `alias` to `module.exports`.
+Other role patterns, such as rest, array, nested or computed-key patterns or a
+non-identifier loader, receive no role and count as unknown findings, so the
+file's analysis is partial rather than an exact empty export list. An
+export-shaped write through a role binding whose value at that read cannot be
+ordered against a replacement is also an unknown finding. Global
+property-definition intrinsics require lexical and visible-write proof. Factory export declarations
 also require the loader's `d` member to have no prior or unordered visible
 replacement, including writes through lexical aliases. Unrelated loader members
 do not invalidate declarations. Ordering describes declarations within one factory
@@ -716,6 +753,10 @@ deadline per source, including startup and fact transfer. Select
 `max_heap_mb` and `analysis_timeout_ms` through MCP, or `--max-heap-mb` and
 `--analysis-timeout-ms` on the dedicated CLI command. These choices control the
 analyzer; the caller's `NODE_OPTIONS` still controls the CLI/MCP process heap.
+For defaults across new MCP operations, use `update_analysis_settings` with
+`javascript.max_heap_mb` or `javascript.analysis_timeout_ms`. Explicit per-call
+arguments take precedence, and accepted work keeps its original settings. See
+the [settings design](design/limits-and-recovery.md#precedence-and-lifetime).
 V8 old-space limits do not impose a process RSS limit. When REA runs on Bun,
 the analyzer ignores the V8 heap flags; resource failures then report
 `worker_heap_limit_bytes` as null instead of a requested or V8-reported limit.
@@ -25,18 +25,50 @@ Keep the original analysis inputs in that call. For the CLI, pass the same
 selection as `--view '<JSON>' --detail summary --evidence_output routes.json`.
 The complete Evidence bundle is written without overwriting existing files.
 Unselected delivery retains the existing complete result. A web-bundle summary
-requires an explicit route view; application summaries also support the existing
+requires an explicit route or web-bundle view; application summaries also support the existing
 general summary when `view` is omitted.

 Use the returned `normalized_result.parent_evidence_id` with
 `inspect_analysis_view` on the same connection. The CLI's exported bundle can be
 reopened with `inspect-evidence-bundle`; its `records` contain the complete
-Evidence. To use `inspect_analysis_view`'s `evidence-file` source, extract the
-selected parent record into a separate local Evidence JSON file (that source
-accepts one Evidence record, not a bundle). Views do not reopen source files or
+Evidence. `inspect_analysis_view`'s `evidence-file` source accepts either one
+Evidence record or an exported bundle with the selected `evidence_id`.
+Views do not reopen source files or
 reconnect to a browser. Historical Evidence without `route_inventory` is
 unmeasured, rather than an empty route set.

+## Page captured endpoint observations and inferences
+
+For `analyze_web_bundle`, select `detail: "summary"` and
+`view: {kind: "web-bundle", collection: "endpoints", limit: 32}`. The CLI
+accepts the same JSON through `--view`, with `--detail summary` and
+`--evidence_output bundle.json`. Query the returned parent with
+`inspect_analysis_view` to read `endpoints`, `inferences`, or `summary` without
+recapturing the page or repeating JavaScript analysis.
+
+Both row collections accept exact `indices`, `values`, `script_keys`, `fields`,
+`offset`, and `limit`; endpoints also accept `mechanisms`, and inferences accept
+`kinds`. Filters combine with AND, and an explicit empty selector matches no
+rows. Every row retains its `source_index` in the original collection, including
+when other fields are omitted. This identity is scoped to the parent Evidence
+and collection. Original ordering and separate occurrences of duplicate values
+are preserved; request endpoint `location` or inference `basis` for source details.
+
+Follow `coverage.next_offset` until `coverage.exhausted`; those fields describe
+the selected rows, independently of producer `completeness`. Each response also
+preserves structured `source_unknowns`, including `affected_script_keys`, so a
+filtered or value-only page cannot hide a source gap. The summary's
+`limitation_count` counts distinct parent and report limitations before display
+bounding. An `endpoint_candidate` remains an inference, with its original
+confidence and basis, and does not prove a backend endpoint or reachability.
+
+Pages obey the shared 1 MiB projection budget; MCP transport applies its own
+wire-size guard. A byte-limited page returns a continuation; an indivisible
+oversized record or metadata returns a typed resource error. Select fewer
+fields or retrieve the complete retained parent through `get_evidence_bundle`,
+`export_evidence_bundle`, or the CLI's exported bundle. Full Evidence is never
+silently truncated.
+
 Collections are `summary`, `routes`, `occurrences`, `sources`, and `unknowns`.
 All row collections support exact batch `where.ids`, field selection, `offset`,
 and `limit`. An explicit empty filter array matches nothing. Routes also support
@@ -0,0 +1,174 @@
+# Linux kernel modules
+
+`inspect_kernel_module` / `inspect-kernel-module` reads metadata from one
+selected local ELF32/ELF64 relocatable object (`.ko`) without executing it.
+That metadata is the `.modinfo` key/value strings, the `__versions` symbol
+CRCs, the presence of `.gnu.linkonce.this_module` and `__ksymtab*` sections,
+the observed file sizes of `.init.text` and `.exit.text`, and an optional
+appended signature trailer. It does not require a Linux host or the `modinfo`
+program.
+
+```bash
+rea inspect-kernel-module /absolute/path/to/module.ko --json
+```
+
+The CLI resolves relative paths against the caller's working directory. MCP
+requires an absolute filesystem path and preserves that exact selection:
+
+```json
+{
+  "name": "inspect_kernel_module",
+  "arguments": { "path": "/artifacts/demo.ko" }
+}
+```
+
+## Observations
+
+The inline Evidence result contains the artifact path, SHA-256, and byte
+length. `applicability` is `applicable` only for `ET_REL`. Other ELF types are
+`not_applicable`: header facts are filled and `.modinfo`, `__versions`, and
+the signature trailer are not examined.
+
+`.modinfo` entries stay in file order. Duplicate keys such as `alias` and
+`parm` are preserved. Each entry keeps its key, value, file range, and
+SHA-256. Values are the bytes after the first `=`. NUL padding between
+strings is skipped. Keys and values use a byte-preserving Latin1 projection:
+each source byte becomes the same-numbered Unicode code point. They are not
+decoded as UTF-8. `raw_sha256` hashes the original entry bytes, including its
+terminating NUL when present; `raw_hex` shows those bytes when they fit the
+inline limit.
+
+`__versions` entries are `struct modversion_info`: a 64-byte record whose CRC
+is an `unsigned long` and whose name occupies the remaining bytes. ELF32
+stores a 32-bit CRC and a 60-byte name. ELF64 stores a 64-bit unsigned long
+and a 56-byte name. CRCs are zero-padded lowercase hex, 8 or 16 characters,
+not a JavaScript number. The layout is reported from the ELF class even when
+the section is absent. Names use the same byte-preserving Latin1 projection
+as `.modinfo` keys and values. Only this classic `__versions` layout is
+decoded. `versions.status: "absent"` means no `__versions` section was found
+when section names were complete; it does not establish the absence of version
+metadata in `__version_ext_names` and `__version_ext_crcs`, which Linux uses
+with `CONFIG_EXTENDED_MODVERSIONS` and this workflow does not decode.
+
+`.gnu.linkonce.this_module` is reported as present, absent, or unknown.
+`layout` is always `unknown` because `struct module` changes with the kernel
+version and is not decoded. File-backed `__ksymtab*` sections are listed in
+section-header order by name and file range; their records are not decoded.
+Sections that are `SHT_NOBITS` or leave the file are counted in one limitation
+without their names. `.init.text` and `.exit.text` report the
+observed file-backed size. A compressed payload reports the stored size and a
+limitation that the decoded size is unknown.
+
+The signature trailer is the 27-byte magic `~Module signature appended~\n`
+preceded by a 12-byte `module_signature` (`algo`, `hash`, `id_type`,
+`signer_len`, `key_id_len`, three pad bytes, and big-endian `sig_len`). When
+those parameter fields are zero and `id_type` is PKCS#7 (`2`), the preceding
+`sig_len` bytes are the PKCS#7 range and its SHA-256. The range is not parsed
+and no certificate, signer, or digest-coverage claim is made. An absent
+trailer is observed absence, not proof the module is unsigned.
+
+When section names are incomplete, a missing named section is `unknown`
+rather than `absent`. An empty file-backed section is present and empty.
+
+## Limits and failures
+
+The selected file is limited to 64 MiB by default (512 MiB maximum). At most
+8192 `.modinfo` and `__versions` entries plus listed `__ksymtab*` sections are
+examined by default (65536 maximum); `coverage.examined_entries` counts all
+three. Exceeding that budget fails with no partial success. Keys longer
+than 256 bytes and values longer than 4096 bytes stay malformed per entry;
+the field that fits is still copied. A `__ksymtab*` section name longer than
+256 bytes keeps its range with `name: null` and `ksymtab_name_exceeds_limit`. Inline raw hex stops at 4096 bytes and
+the SHA-256 remains.
+
+A `.modinfo` span with no trailing NUL is `unterminated_modinfo_entry` and
+earlier entries are kept. A string with no `=` is `modinfo_missing_separator`.
+An empty key is `modinfo_empty_key`. A `__versions` name with no NUL is
+`version_name_unterminated`. A `__versions` section whose size is not a
+multiple of 64 bytes is closed with `versions_size_not_multiple` and no
+entries. `SHT_NOBITS` or a declared range that leaves the file is
+`modinfo_section_not_file_backed` or `versions_section_not_file_backed`.
+`SHF_COMPRESSED` payloads are not inflated
+(`modinfo_section_compressed`, `versions_section_compressed`).
+
+An appended magic with fewer than 12 preceding bytes is
+`signature_trailer_truncated`. A `sig_len` that does not leave at least one
+module byte is `signature_length_inconsistent`. Nonzero `algo`, `hash`,
+signer, key-id, or pad fields for PKCS#7 are `signature_parameters_nonzero`.
+A parameter block whose `id_type` is not PKCS#7 is
+`signature_id_type_not_pkcs7` and is unsupported rather than a validated
+signature.
+
+gzip (`1f 8b`), xz (`fd 37 7a 58 5a 00`), and zstd (`28 b5 2f fd`) whole-file
+containers are `unsupported`. The result names `external_decompression` as the
+next probe and does not claim the payload is a kernel module. This is an external
+step, not a REA operation: neither this tool nor `extract_artifact` decodes these
+containers. Use an external gzip, xz, or zstd utility to decompress into a separate
+file, then call `inspect_kernel_module` on that file to inspect the `ET_REL` image.
+
+Malformed ELF headers return no partial kernel-module metadata. This workflow
+does not execute the module or validate an appended signature.
+
+## Format references
+
+The record layout follows Linux v6.12's
+[`modversion_info`](https://github.com/torvalds/linux/blob/v6.12/include/linux/module.h)
+and [`MAX_PARAM_PREFIX_LEN`](https://github.com/torvalds/linux/blob/v6.12/include/linux/moduleparam.h).
+The [Linux kbuild module versioning guide](https://docs.kernel.org/kbuild/modules.html#module-versioning)
+describes the separate extended version sections.
+Trailer fields and acceptance rules follow
+[`module_signature`](https://github.com/torvalds/linux/blob/v6.12/include/linux/module_signature.h)
+and [`mod_check_sig`](https://github.com/torvalds/linux/blob/v6.12/kernel/module_signature.c).
+These references establish the decoded layout, not runtime verification.
+
+## Real-module verification lane
+
+Run from a built checkout with Docker available. This downloads a Debian kernel
+package into a disposable container, extracts a filesystem module, decompresses
+it when necessary, and inspects it with REA. It never installs or loads that
+kernel module. The temporary output is outside the repository; record the
+printed package version and module digest with results.
+
+```bash
+module_lane=$(mktemp -d)
+docker run --rm -i -v "$module_lane:/out" debian:stable bash -se <<'CONTAINER'
+apt-get update -qq
+apt-get install -y --no-install-recommends xz-utils zstd ca-certificates
+cd /tmp
+arch=$(dpkg --print-architecture)
+package=$(apt-cache depends "linux-image-$arch" | awk '/Depends: linux-image-[0-9]/{print $2; exit}')
+test -n "$package"
+apt-get download "$package"
+dpkg-deb -f ./*.deb Package Version > /out/package.txt
+dpkg-deb -x ./*.deb /tmp/kernel
+module=$(find /tmp/kernel -type f -path '*/kernel/fs/*' \( -name '*.ko' -o -name '*.ko.xz' -o -name '*.ko.zst' -o -name '*.ko.gz' \) | sort | head -1)
+test -n "$module"
+case "$module" in
+  *.xz) xz -dc "$module" > /out/module.ko ;;
+  *.zst) zstd -dc "$module" > /out/module.ko ;;
+  *.gz) gzip -dc "$module" > /out/module.ko ;;
+  *) cp "$module" /out/module.ko ;;
+esac
+cat /out/package.txt
+sha256sum /out/module.ko
+CONTAINER
+node scripts/rea.mjs inspect-kernel-module "$module_lane/module.ko" --json > "$module_lane/rea.json"
+python3 - "$module_lane" <<'PY'
+import json, pathlib, sys
+root = pathlib.Path(sys.argv[1])
+report = json.loads((root / 'rea.json').read_text())['normalized_result']
+entries = report['modinfo']['entries']
+assert entries and all(entry['status'] == 'observed' for entry in entries)
+keys = [entry['key'] for entry in entries]
+for key in ('license', 'vermagic', 'name'):
+    assert key in keys, key
+print('Observed .modinfo entries:', len(entries), 'distinct keys:', len(set(keys)))
+print('Artifact:', report['artifact'])
+PY
+```
+
+`parm` and `parmtype` are retained separately by REA. Synthetic tests cover
+their generic key/value representation and all four ELF class/byte-order
+combinations. A successful real lane verifies only the selected module and
+printed fields; it does not validate certificates. This lane has not run in the
+sandbox used for implementation because access to the Docker socket was denied.
@@ -125,7 +125,11 @@ REA writes Kuna's exports only inside `REA_KUNA_CACHE_DIR`:
 - `trash/` holds retired builds and evicted exports awaiting removal.
 - `home/` is Kuna's HOME.

-Builds publish by one rename, so a reader sees a complete export or none. If later staging retirement fails, the typed cleanup error retains the completed export's key, directory and manifest in `published_export`. The session adopts that verified project; later queries reuse its immutable files while `project_export.cleanup_incomplete` reports the retained owner's live state. `close_binary` retries only the remaining cleanup, and a successful retry resolves prior cleanup errors. A failed export followed by failed staging cleanup retains both failures; it does not invent a publication receipt. A session keeps the export it uses from eviction only within its own REA process. If another REA process sharing the cache evicts it, the session rebuilds it; meanwhile pseudocode falls back to single-function runs. A damaged or edited export is removed and rebuilt. Staging moves to `trash/` for removal only after REA proves its Kuna process stopped. Staging of a process it cannot prove stopped is never swept; REA keeps it owned, retries the stop on `close_binary`, and reports it until the stop is proven. Failed file removal also stays bound to its export and is retried by `close_binary`; closing does not report success while that cleanup remains. `rea doctor --provider kuna` reports the cache directory without creating it.
+The cache key includes the selected launcher and resolved executable paths.
+Older exports without that identity are rebuilt automatically and retired through
+normal cache cleanup; no manual migration is needed.
+
+Builds publish by one rename, so a reader sees a complete export or none. If later staging retirement fails, the typed cleanup error retains the completed export's key, directory and manifest in `published_export`. The session adopts that verified project; later queries reuse its immutable files while `project_export.cleanup_incomplete` reports the retained owner's live state. `close_binary` retries only the remaining cleanup, and a successful retry resolves prior cleanup errors. A failed export followed by failed staging cleanup retains both failures; it does not invent a publication receipt. A session keeps the export it uses from eviction only within its own REA process. If another REA process sharing the cache evicts it, the session rebuilds it; meanwhile pseudocode falls back to single-function runs. A damaged or edited export is removed and rebuilt. REA retains the file state verified with each digest, checks it before warm-cache reuse, and checks open descriptors before and after reading text. Assembly indexes are checked against the same state; a changed file makes the whole report retry rather than mixing facets from different exports. Staging moves to `trash/` for removal only after REA proves its Kuna process stopped. Staging of a process it cannot prove stopped is never swept; REA keeps it owned, retries the stop on `close_binary`, and reports it until the stop is proven. Failed file removal also stays bound to its export and is retried by `close_binary`; closing does not report success while that cleanup remains. `rea doctor --provider kuna` reports the cache directory without creating it.

 ## Verify with a real Kuna

@@ -242,6 +242,36 @@ to `/absolute/view-request.json`, then run
 `rea inspect-analysis-view /absolute/view-request.json --json`. This also reads
 pre-summary source records without changing their identity; no live provider is started.

+`procedure_address`, `procedure_callees`, `procedure_callers`,
+`resolve_containing_procedure` and `get_call_graph` also accept `detail: "summary"`
+(complete remains the default). The summary includes the first 64 recorded
+observations, exact source parameters and provider/profile identity, relationship
+coverage where recorded, and the retained complete parent's ID. Continue with
+`view: {"kind":"native-observation","offset":64,"limit":64}`. Array positions
+retain `source_index`; graph rows additionally retain their original `level`.
+Graph pages order levels by Unicode code point and keep original row order within
+each level. A recorded empty level is a `status: "empty-level"` row with
+`source_index: null`; observation counts include these markers. Graph diagnostic,
+limitation and reason IDs index that page's `items.messages` dictionary. Expand
+those references to recover exact text, repeated messages, and absent versus
+empty optional fields. Failed nodes retain their original error.
+
+These views reference complete source context through `source_context.digest`
+and caveat counts. Read it using the same parent with
+`view: {"kind":"native-context","facet":"overview"}`. The other facets are
+`analysis-profile`, `limitations` and `result-limitations`; all accept `offset`
+and `limit`. Overview includes source subject, provider, authority, execution
+environment and profile digest. Full profiles and caveat text remain accessible
+without repeating them in every fact response. Context digests follow Evidence's
+semantic subject identity, so caller-selected path aliases preserve context
+identity while responses retain the selected display path. A null profile means
+unavailable; null result-limitations means not applicable to a primitive and
+is distinct from an observed empty graph limitation list. Until the source
+caveats have been inspected, interpretations beyond the returned facts remain
+unknown. Exhausted pages describe the recorded observations and do not establish
+complete native discovery. The same views work through the CLI with historical
+Evidence files or bundles and require no live provider.
+
 For oversized native function Evidence, `details.reported_limits.continuation`
 contains a ready-to-call `inspect_analysis_view` request for the retained
 pseudocode's first page. Use its `name` and `arguments` directly, then follow
@@ -583,11 +613,22 @@ capabilities. The default result contains the complete inventory in groups that
 share status facts. `tool_availability.client_requirements` is the baseline for
 each group; a group's optional `client_requirements` replaces that baseline for
 the group's tools. Expand each group's `names` into one tool entry, carrying its
-surface, availability, reason, remediation, default-mode status, modes, and
-client requirements. Compare the union of group names with `tools/list` when
-checking that a client received the full catalog. An operation absent from all
-groups is missing from the complete inventory; it is not an implicit
-unavailable entry.
+availability, reason, remediation, default-mode status, modes, and client
+requirements. Compare the union of group names with `tools/list` when checking
+that a client received the full catalog. An operation absent from all groups is
+missing from the complete inventory; it is not an implicit unavailable entry.
+
+`detail` selects the projection and the result echoes it. The default
+`summary` keeps open state, target identity, the binding, current-route
+`capabilities`, run, activity and health status, and each provider candidate's
+identity, selection, and availability and target-support `status`, `code`, and
+`reason`. It lists the fields it leaves out in `omitted_fields`: provider
+`diagnostics`, candidate `capabilities`, and each tool group's static `surface`,
+`effects`, and `annotations`. Omitted fields are not empty or false.
+`detail: "complete"` returns them inline, groups tools by those flags too, and
+has no `omitted_fields`. The output schema keys each result's candidate,
+tool-group and omission fields by its `detail`. CLI `capabilities` and
+`providers` always return complete provider facts.

 `get_call_graph` and `trace_call_path` report `forward` and `backward` modes.
 Each requires `procedure_address` plus `procedure_callees` or `procedure_callers`,
@@ -600,8 +641,8 @@ finish without reading relationships, even when neither traversal mode is
 available. Discovery does not block that direct invocation or replace its typed
 partial/error outcomes.

-The `effects` and `annotations` arrays list the true members of their fixed
-vocabularies. A known member omitted from either array is false. This applies
+With complete detail, the `effects` and `annotations` arrays list the true
+members of their fixed vocabularies. A known member omitted from either array is false. This applies
 only to these closed flag sets; it does not make an omitted tool, provider, mode,
 or limitation false. Keep availability reasons, remediation, client-feature
 requirements, and mode facts inline with the grouped tool names. The optional
@@ -632,7 +673,8 @@ identity, availability, reason, rejection code, effects, and ordered
 limitations.

 `binary_session.analysis_provider_candidates` is authoritative for deep-engine
-discovery. Each candidate's capability sets describe that possible provider;
+discovery. Each candidate's capability sets, returned with complete detail,
+describe that possible provider;
 they do not select it. The top-level `capabilities` describe the current route,
 while `analysis_provider_binding` identifies the concrete selected route. These
 fields are not interchangeable. Target-free discovery is sorted by provider ID,
@@ -775,7 +817,12 @@ the bound address is local; names are added only after classifying the actual IP
 On such a bind, requests whose `Host` header is outside the SDK loopback allowlist plus
 the configured name and the bound address are refused with `403`, and a browser
 `Origin` outside that allowlist is refused the same way (a missing `Origin`
-passes); a non-loopback bind relaxes both checks and logs the relaxation. A reply sent before a request body was read (a refused `Host` or `Origin`, an unknown route, the startup `503`) closes the connection after the reply, so an unread upload cannot keep a socket open. Request targets are taken verbatim as origin-form paths (`//host/path` is a path, not another origin); an absolute-form target, a target containing a raw fragment delimiter (`#`), or one whose path URL parsing would rewrite (dot segments such as `/public/../mcp`), is refused with `400`, and a method Fetch does not support with `405`. Percent-encoded `%23` remains valid query data. Only an `initialize` object can replace an open session. A sessionless array containing initialize, including a one-element array, is refused with HTTP `400` before session creation or handover. Scoped
+passes). A non-loopback bind requires `MCP_ALLOWED_HOSTS`, or
+`--allowed-hosts` for `rea mcp --http`, listing every client host name or IP
+address. Configuration validates and canonicalizes complete tokens once;
+URLs, ports and empty entries are refused. Both Host and Origin checks remain
+active on that declared list. The announced URL uses the bound hostname if
+admitted, otherwise the first declared hostname, with the actual bound port. A reply sent before a request body was read (a refused `Host` or `Origin`, an unknown route, the startup `503`) closes the connection after the reply, so an unread upload cannot keep a socket open. Request targets are taken verbatim as origin-form paths (`//host/path` is a path, not another origin); an absolute-form target, a target containing a raw fragment delimiter (`#`), or one whose path URL parsing would rewrite (dot segments such as `/public/../mcp`), is refused with `400`, and a method Fetch does not support with `405`. Percent-encoded `%23` remains valid query data. Only an `initialize` object can replace an open session. A sessionless array containing initialize, including a one-element array, is refused with HTTP `400` before session creation or handover. Scoped
 IPv6 literals (`fe80::1%eth0`) are refused before binding, because no URL can
 name them. Listener errors reach the runtime's connection-loss handler only
 after a successful bind; a bind failure prints the listen-failure message alone. Request bodies are bounded by the SDK's
@@ -932,6 +979,25 @@ of a later null value. Inspect the slot's `xrefs` and the writer's assembly or
 pseudocode, retaining uncertainty about execution order and runtime values.
 These operations inspect static evidence and do not execute the target.

+## Editable analysis settings
+
+Agents can call `update_analysis_settings` to raise a curated admission,
+timeout or worker heap default on a connected server, then retry the same
+request. Errors carry `details.limit` with the setting and bounds when the
+failing owner supports runtime recovery; `inspect_analysis_settings` is optional
+when those facts are supplied. Updates are atomic, apply to new work, survive
+target close/open, and vanish when REA exits. Explicit per-call arguments take
+precedence. Neither tool changes host deadlines or resolves retained cleanup.
+See [runtime settings and recovery](design/limits-and-recovery.md#runtime-settings-through-mcp)
+for the full setting list, reset/revision semantics and ASAR retry example.
+For implementation ownership, accepted-operation snapshots, provider wiring,
+and extension guidance, see the
+[maintainer design](design/limits-and-recovery.md#ownership-and-data-flow).
+
+Ghidra and Hopper startup updates apply to the next startup attempt without
+restarting REA. Ghidra decompile timeout updates apply on the existing Program.
+An operation already accepted retains its original budgets.
+
 ## Ghidra first-query deadlines and recovery

 A successful MCP initialize handshake establishes the REA connection.
@@ -939,6 +1005,12 @@ A successful MCP initialize handshake establishes the REA connection.
 that Ghidra has finished importing the target. The first Ghidra-backed query,
 such as `binary_overview`, starts the engine and waits for import, default
 auto-analysis, bridge connection, and health readiness before returning analysis.
+With `REA_GHIDRA_PROJECT_PATH`, shared CLI/MCP configuration instead selects an
+[existing project copy](installation.md#reuse-an-existing-ghidra-project), whose
+content fingerprint is committed into the profile. Import, auto-analysis and
+repair scripts are skipped; original analysis completeness/settings stay unknown,
+and bridge database edits are unavailable. The same startup/client deadlines
+still cover copy verification, engine launch and the authenticated handshake.

 These deadlines have different owners:

@@ -1033,11 +1105,13 @@ the current client, so it is not a fresh-start recovery. On the same connection:
   `provider_id: "ghidra"`, then retry the first query with an appropriate client
   deadline. The connection and selected provider do not need to change.

-If REA's provider startup allowance also needs raising, preserve Evidence and
-close as above, then update `REA_GHIDRA_STARTUP_TIMEOUT_MS` in REA's launch
-environment and restart the server. Reconnect the MCP client before reopening
-the target. Configuration is read at process startup; close/reopen on the same
-connection cannot apply a changed environment. See the
+If REA's provider startup allowance also needs raising, set
+`ghidra.startup_timeout_ms` through `update_analysis_settings` before the next
+startup attempt. This needs no REA restart and does not change accepted work,
+clear cleanup blockers, or extend the client's deadline. Alternatively, change
+`REA_GHIDRA_STARTUP_TIMEOUT_MS` in REA's launch environment and restart the
+server, preserving Evidence and closing as above. Close/reopen on the same
+connection cannot apply a changed launch environment. See the
 [CLI retry example](installation.md#ghidra).

 This close/reopen flow was exercised on one real Linux stdio connection after a
@@ -1232,6 +1306,32 @@ Kimi-K3 backend, not the WorkBuddy MCP client. Set the profile on REA's
 registration in the actual MCP host; the host's name alone does not identify
 the downstream model or its schema constraints.

+The compact profile also protects strict Anthropic-compatible gateways from
+known schema-translation failures reported in [#3800](https://github.com/morluto/rea/issues/3800):
+primitive `enum` properties without a sibling `type`, and `oneOf`/`allOf`
+inside a property listed in `required`. Affected schemas use the same reduced
+first-level projection described below, so the gateway receives a plain object
+shape while REA continues to validate the complete canonical contract locally.
+This is a compatibility projection, not a claim that the gateway reproduces
+the full union semantics.
+
+For array items expressed as an untyped `oneOf`/`anyOf`, the compact profile
+adds a type when every branch has the same type. Mixed-type item unions use the
+reduced projection; selecting one branch's type would exclude valid calls.
+This addresses the emitted shape reported through a Gemini-backed gateway in
+[#5201](https://github.com/morluto/rea/issues/5201). Gateway conversion and
+live provider acceptance have not been verified for this projection.
+
+Gemini function declarations accept `items` only beside the single `array`
+type. Reduced array properties therefore advertise the element types their
+canonical item schemas accept, such as `{"type": "object"}` for a union of
+object actions, instead of an any-value type list with nested `items`. An
+element whose type is unknown, a tuple, or an array alongside other types uses
+the empty item schema, and a property that may be an array or another type
+lists typed `anyOf` branches. A boundary test rejects any compact
+advertisement that places `items` beside another type or uses an untyped item
+union.
+
 The compact profile renders the same tool set, output schemas, annotations,
 and canonical server-side validation. It changes only the advertised input
 JSON Schema:
@@ -1263,6 +1363,82 @@ Boundary tests pin every advertised compact schema to the budget, keep them
 valid JSON Schema that still accepts every canonical example. Client verification
 also checks provider-facing sizes and canonical examples after conversion by
 the actual Kimi Code CLI; local captures do not establish Moonshot acceptance.
+The SDK catalog test checks that full-profile schemas retain nested ADB extra,
+managed selection, and WASM timeout and detail restrictions. Path-contract tests
+check full-profile local-path rules. Compact MCP workflow tests verify canonical
+rejection of invalid inputs before provider work, independent of how much detail
+the selected advertisement retains.
+
+### Tool family advertising scope
+
+Agents pay context for every advertised tool schema, and clients that send
+catalog payloads with each request (see the Claude Code measurements above)
+can spend more context on tool definitions than on the investigation. Setting
+the server's `REA_MCP_TOOL_FAMILIES` environment variable to a comma-separated
+subset of the catalog's tool-family ids (the `tools.families` entries in the
+product catalog) restricts the registration to those families. A selection
+outside the published family ids fails server startup with the complete id
+list; the setting is read at startup, so restart the server to apply changes.
+
+Out-of-scope tools stay registered but disabled: `tools/list` omits their
+names and schemas entirely, and a direct call fails with the SDK's
+`Tool ... disabled` invalid-params error rather than disappearing silently.
+`binary_session.tool_availability` and the provider `capabilities` sets on the
+same report, including `analysis_provider_candidates`, list only operations
+whose tools the registration advertises; an operation omitted from those
+projections because of the scope is not callable through this registration,
+and `tools/list` remains the canonical catalog. Availability is derived from
+the complete provider facts before those sets are narrowed, so hiding a direct
+tool does not report an advertised composed tool as unavailable. Guided
+prompts follow the scope too: a workflow is advertised only when every tool in
+its suggested steps belongs to a selected family, so a partially available
+workflow is omitted from `prompts/list` instead of rendering a disabled call;
+`prompts/get` reports it as not found. A scope can omit all guided prompts;
+doctor treats a server without the prompts capability as an empty inventory.
+Recovery instructions recommend runtime settings tools only when `application`
+is advertised; otherwise they explain launch settings and how to widen the scope.
+The server identity digest and
+`rea mcp doctor` tool and prompt inventory derive from the
+same selected scope, so a scoped server reports itself healthy; a scope
+without the `session` family cannot serve `binary_session`, and doctor says
+so explicitly instead of reporting a mismatch. Canonical server-side
+validation and Evidence semantics are unchanged for
+the tools that remain advertised. The default (unset) advertises the complete
+catalog exactly as before. Saved registrations with an invalid selection
+report `invalid` in status instead of starting a server that fails.
+
+`rea setup --client <id> --tool-families <ids>` writes the same selection
+into the `env` object of that client's `rea` entry, so the scope travels with
+the registration; rerunning setup with a different selection refreshes it.
+
+#### Choosing families for common workflows
+
+Every investigation that opens a local binary still needs the `session`
+family: it owns `open_binary`, `binary_session`, the evidence-bundle and
+comparison tools, and the unknown ledger, so include it whenever the workflow
+touches a binary. The `tools.families` entries in the product catalog list
+each family's current inventory; the groupings below describe what a scope
+covers, not a frozen tool count.
+
+Include `application` when a workflow pages retained summaries through
+`inspect_analysis_view` or changes analysis settings. `session` owns Evidence
+bundle import/export; it does not include those view and settings tools.
+
+| Workflow                                          | Scope                                                     | Coverage                                                                                                                                                     |
+| ------------------------------------------------- | --------------------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------ |
+| Firmware extraction and analysis                  | `firmware,session,direct`                                 | extract firmware regions, open the extracted image, inspect it with the proxied disassembly tools                                                            |
+| Web investigation                                 | `browser,pcap,session,javascript-runtime`                 | page, bundle and session inspection, packet captures, JS runtime observation, evidence workflow                                                              |
+| Android application analysis                      | `android,adb,apktool,session`                             | class and method inspection, device bridge, resource decoding; add `frida` for dynamic instrumentation, `jeb` for JEB projects, `flutter` for Flutter builds |
+| Native macOS or iOS binary                        | `native,artifact,session`                                 | Mach-O, signature and property-list inspection plus container extraction                                                                                     |
+| Managed .NET assembly                             | `managed,session`                                         | managed member comparison and reconstruction against the evidence workflow                                                                                   |
+| Electron or browser-hosted JavaScript application | `browser,electron,application,javascript-runtime,session` | runtime targets, live page inspection, bundle and capture tools, feature tracing, JavaScript semantics and reconstruction obligations                        |
+| Evidence bookkeeping only                         | `session`                                                 | open and close binaries, bundles, comparisons, unknown tracking                                                                                              |
+
+Scopes are additive and start narrow: begin with the families the workflow
+names, then add one when a call fails with the SDK's `Tool ... disabled`
+error. The error names the disabled tool; `tools.families` in the product
+catalog maps it back to the family that would re-enable it, and the server
+restarts with the wider scope through the same setup flag.

 ### Output schemas

@@ -1273,21 +1449,37 @@ identity. Explicit schema IDs and relative external reference bases are
 preserved. This keeps every tool and validation rule in discovery and does not
 change the SDK's catalog invalidation or availability checks.

-The server identity's tool-schema digest includes both the canonical output
-contracts and the selected output-schema profile. `full` and `off` therefore
-have distinct identities even though `off` keeps the same canonical output
-validation on the server.
+The server identity's tool-schema digest includes the selected output-schema
+profile and the advertised form that profile produces. `full`, `compact`, and
+`off` therefore have distinct identities. The `compact` digest covers the
+bounded schemas clients receive; `off` keeps the canonical output contracts in
+the digest while advertising nothing.

 Some stdio hosts reject a complete `tools/list` frame before they load any
-tools. The opt-in `REA_MCP_OUTPUT_SCHEMA_PROFILE=off` setting omits `outputSchema`
-from the advertised catalog for hosts with a small frame limit (the measured
-pi-web-ui failure and catalog breakdown are in [#2512](https://github.com/morluto/rea/issues/2512)).
-The default `full` profile is unchanged. With `off`, REA validates successful
-structured results against the same named canonical tool contract before
-delivery; it still returns complete `structuredContent` and text results.
-Only client-side schema discovery and validation are omitted, so hosts using
-this profile should rely on REA's validation and retain their usual response
-size limits.
+tools. The opt-in `REA_MCP_OUTPUT_SCHEMA_PROFILE=compact` setting bounds every
+advertised output schema to 4,096 bytes; `off` omits `outputSchema` entirely
+(the measured pi-web-ui failure and catalog breakdown are in
+[#2512](https://github.com/morluto/rea/issues/2512)). The default `full` profile
+is unchanged. Both settings keep the same named canonical tool contract for
+server-side result validation, and both still return complete
+`structuredContent` and text results.
+
+`compact` keeps the complete validation structure when it fits the budget.
+Otherwise it advertises the root property shape, first-level reference-resolved
+types, first-level guidance, and the root's `required`/`additionalProperties`
+constraints, with nested validation detail elided. Local references are inlined
+within the budget, so the advertised form is self-contained and omits the
+canonical contract's content-bound `$id`. The projection only widens: a valid
+canonical result still satisfies the advertised schema, but a client validating
+against it can accept a result the canonical contract rejects. REA still
+validates every result before delivery. On catalogs large enough that full
+input schemas alone approach the frame limit, keep the input profile at its
+`compact` default as well; with full input schemas the advertisement is
+dominated by the input side.
+
+Only client-side schema discovery and validation are reduced or omitted, so
+hosts using these profiles should rely on REA's validation and retain their
+usual response size limits.

 ### Function comparison limitations

@@ -15,6 +15,13 @@ invoke tools by themselves.
 | `audit_residual_unknowns`         | Audit current residual-unknown heads and evidence-qualified resolution.              |
 | `prepare_bounded_process_capture` | Design a bounded controlled process experiment before execution.                     |

+A `REA_MCP_TOOL_FAMILIES` scope advertises a workflow only when every tool in
+its suggested steps belongs to a selected family. Partially available
+workflows are omitted from `prompts/list` — `prompts/get` reports them as not
+found — so a rendered prompt never directs the agent to a disabled call. The
+server identity digest and `rea mcp doctor` prompt inventory follow the same
+scope.
+
 Every rendered prompt provides optional starting points using current REA tool
 names. Agents can call tools directly, skip irrelevant suggestions, and inspect
 provider or target state only when it helps answer the request or a tool
@@ -117,12 +117,37 @@ in the JSON for all groups inline. Import the bundle into MCP for views, or
 extract its matching Evidence record to a JSON file for the existing CLI
 `inspect-analysis-view` `evidence-file` source. Input bundles are unchanged.

-Representation admission is bounded at 96 MiB before cloning selected observations
-and expanding matching indexes and repeated per-function source links. Work yields to cancellation. No worker/provider
-concurrency is introduced; this budget is not a bound on total process RSS.
+Representation admission is bounded before cloning selected observations
+and expanding matching indexes and repeated per-function source links. Each
+inventory row is charged before parsing for the member it becomes, including the
+report and Evidence copies that member is serialized into, so an oversized side
+is refused before its rows are parsed. Inline Evidence and bundle records are
+charged for the copies their authentication or loading creates. An exact
+session reference to retained Evidence is borrowed without a copy, so only
+what matching derives from it is charged; the inventory's own Evidence ID is
+charged once, not per function. Selected observations are charged in full.
+Measured under the 96 MiB default with Ghidra-shaped rows, about 20-character
+names and no observations, about 22,000 rows per side fit through retained
+`list_procedures` references, and about 10,000 through inline Evidence or CLI
+`source_bundle` inputs. Work yields to
+cancellation. No worker/provider concurrency is introduced; this budget is not
+a bound on total process RSS.
+
+The allowance defaults to 96 MiB and is the runtime setting
+`native.matching_representation_bytes`, from 1 byte to 1 GiB. On MCP, call
+`update_analysis_settings` with that setting and retry; it applies to the next
+operation without restarting REA. For CLI or future REA processes, set
+`REA_NATIVE_MATCHING_REPRESENTATION_BYTES` in the launch environment; `rea
+setup` copies it into client registrations. An invalid launch value is refused
+by matching only, and a runtime value repairs it. A refusal carries
+`details.limit` with the effective value, its source and bounds. Raising the
+allowance lets matching retain more in the REA process. The 1 GiB maximum is
+an REA policy, not a host-capacity claim, and peak heap during a request can
+exceed the allowance.
+
 Summary delivery happens after complete matching Evidence is constructed and
 retained. It reduces the initial reply, but does not avoid that construction or
-raise the allowance. There is no runtime override. Repeated provenance remains
+raise the allowance. Repeated provenance remains
 part of the complete member contract; splitting inventories into separate matches
 would change global name/body uniqueness and is not an equivalent workaround.

@@ -14,6 +14,10 @@ device platform. A chained-import row ending in `+0x...` is ambiguous in
 dyld's text output: it may be an addend or part of a literal symbol name. REA
 keeps the full expression in `raw_name`, sets `name` and `addend` to null, and
 marks `name_status: "ambiguous"`; it does not synthesize a symbol identity.
+Each import and export `name` is the exact symbol-table spelling, such as
+`_main`; `runtime_name` is the derived name LLDB and `dlsym` use, such as `main`,
+and is null when `name` is null. See [native call observation](#native-call-observation) for
+breakpoint names.

 ## Start with a function

@@ -284,17 +288,22 @@ stops matching while leaving the Hopper API available. The deadline is
 2147483647 ms. Unset uses 5000 ms. A larger value is refused because Node
 schedules a delay past that signed 32-bit bound as 1 ms. Invalid values are
 configuration errors and do not fall back to the default. The setting is read
-from the environment that starts REA, so a change needs a restart. A deadline
-failure names the effective milliseconds, whether they came from the default
-or the setting, the default, and the maximum. The worker old-generation heap
-does not raise it. Kuna regex search uses the same deadline. The worker
+from the environment that starts REA; changing that environment needs a restart.
+In MCP, `regex.matching_deadline_ms` overrides the deadline for newly accepted
+searches without restarting REA. A deadline failure names the effective
+milliseconds, known source, default, and maximum. The worker old-generation heap
+does not raise it. IDA and Kuna use these same regex controls; Ghidra's Java
+matcher does not. The worker
 heap request is `REA_REGEX_WORKER_HEAP_REQUEST_MIB`, a decimal integer from
 7 to 16384 MiB. Unset uses 128 MiB. A request below 7 MiB aborts the worker
 during startup, and a larger value is refused. Invalid values are
 configuration errors and do not fall back to 128. The setting is read from
-the environment that starts REA, so a change needs a restart. A heap failure
-names the effective request, whether it came from the default or the setting,
-the default, the floor, and the maximum. A positive Node.js
+the environment that starts REA, while MCP `regex.worker_heap_request_mib`
+can override it for workers belonging to newly accepted searches. Use
+`update_analysis_settings` for either runtime control; accepted work keeps its
+budget. See the [settings design](design/limits-and-recovery.md).
+A heap failure names the effective request, known source, default, floor, and
+maximum. A positive Node.js
 `--max-old-space-size` on the process that starts
 REA, including `NODE_OPTIONS`, overrides that request and sets the effective
 heap. `--max-old-space-size-percentage` takes precedence over that flag in
@@ -511,6 +520,16 @@ to the linked Mach-O. This classification requires both the recognized native
 refusal and an independently parsed dSYM Mach header; other tool failures keep
 their failure outcome.

+Observed `dyld_info` diagnostics include `unknown mh.filetype 4` and
+`unknown filetype 4` for `MH_CORE`, and the corresponding `3` spellings for
+`MH_FVMLIB`. These refusals report `unsupported_target` when the independently
+parsed Mach header confirms the reported file type. The error retains the exact
+native diagnostic and recommends a linked Mach-O executable or relocatable
+object. This classifies the selected target's refusal; it does not establish
+support for core-dump analysis, historical FVMLIB layouts, or unobserved native
+diagnostic spellings. Unknown or contradictory header values and signalled
+commands remain failures.
+
 `inspect_macho.selected_architecture` identifies the exact selected lipo slice
 and its `container_file_offset` in the input file. A thin Mach-O has a known
 offset of zero; an unknown universal-slice offset stays null. The Evidence
@@ -622,11 +641,10 @@ complete observation.
  outcome instead of rounded reference identities.
  UID 0 cannot distinguish conditional nil from ordinary nil. Limits are
  64 MiB of input, 200,000 objects/references and 128 nesting levels.
-  XML dictionary entries decoded as `__proto__` are omitted with an explicit
-  count because REA results cannot represent that key. XML tag whitespace and
-  comments do not change that handling. XML key names combine their text and
-  CDATA segments without trimming or expanding literal CDATA entities. Other
-  values and the original archive digest are preserved.
+  XML, OpenStep and binary dictionary entries retain their source keys,
+  including `__proto__`, through archive projection and CLI/MCP results.
+  XML key names combine their text and CDATA segments without trimming or
+  expanding literal CDATA entities. The original archive digest is preserved.
  Symbol fallback accepts complete Objective-C class/metaclass symbol leaves,
  including qualified names. Pointer/string labels that merely contain a class
  marker do not establish classes. Provider namespace method labels are not
@@ -901,15 +919,22 @@ missing LLDB. `duration_ms` controls the later target observation window.
 rea observe-native-calls /Applications/Example.app '{"breakpoints":[{"kind":"objc-method","class_name":"NSURLSession","selector":"dataTaskWithRequest:completionHandler:"},{"kind":"function","name":"open","module":"libsystem_kernel.dylib"}],"duration_ms":5000,"backtrace_frames":4}' --json
 ```

-Function names select LLDB runtime symbols. On Darwin, a C function reported as
-`_main` by `inspect_macho` or `nm` can resolve as `main` in LLDB. REA preserves the
-exact selected name; it does not remove underscores or translate static names.
-Use `{"kind":"function","name":"main","module":"Example"}` to limit that
-runtime symbol to the executable image named `Example`, then inspect the reported
-locations and image paths. Omitting `module` deliberately matches every loaded
-image, including system libraries. A match outside the executable is valid for
-that request and does not by itself make coverage partial. This C naming example
-does not establish a translation rule for Swift, C++ or other mangled symbols.
+Function names select LLDB runtime symbols. On Darwin, the Mach-O symbol table
+spells language-level symbols with one leading underscore, which LLDB and `dlsym`
+omit: `_main` is `main`, C++ `__ZN3rea3addEii` is `_ZN3rea3addEii`, and Swift
+`_$s…` is `$s…`. Names without that underscore, such as `-[Class selector]`, are
+unchanged. `inspect_macho` keeps each export and import `name` exactly as the
+symbol table spells it and derives its `runtime_name`; pass `runtime_name` as the
+breakpoint `name`. `observe_native_calls` preserves the exact selected name; it
+does not remove underscores or translate static names, so `_main` selects a
+different runtime symbol. Use `{"kind":"function","name":"main","module":"Example"}`
+to limit that runtime symbol to the executable image named `Example`, then inspect
+the reported locations and image paths. Omitting `module` deliberately matches
+every loaded image, including system libraries. A match outside the executable is
+valid for that request and does not by itself make coverage partial. Event and
+location `symbol` values are LLDB display names, which are demangled for C++ and
+Swift; join them to `inspect_macho` through `breakpoint_index` and the request
+`name`, or through `file_address` and the export `address`.

 Each event is an observation: thread, image, symbol, load and file address,
 the raw integer argument registers, optional caller frames and, for an
@@ -980,7 +1005,7 @@ is present. A denied trace reports the `debugger-attach-denied` reason.

 ## Provider and verification boundaries

-Install a Ghidra 12.1.x release and the 64-bit full JDK it declares, then configure REA to
+Install a Ghidra 12.x (>=12.1) release and the 64-bit full JDK it declares, then configure REA to
 use them. Ghidra analysis supports Linux x64/arm64 and macOS x64/arm64; each installation requires
 the matching native decompiler. Experimental Windows x64 P0 admits native
 x86, x86-64, ARMNT (Thumb-2) and ARM64 PE applications and DLLs, plus explicitly selected
@@ -0,0 +1,101 @@
+# Node.js single executable applications
+
+REA inventories injected Node.js SEA blobs through `inspect-artifact` /
+`inspect_artifact` and materializes their contents through `extract-artifact` /
+`extract_artifact`. It never runs the application or deserializes V8 snapshots
+or code cache.
+
+```sh
+rea inspect-artifact ./application --json
+rea inspect-artifact ./application --detail summary --evidence_output evidence.json --json
+rea extract-artifact ./application --json
+```
+
+For MCP, open the carrier with `open_binary`, then call `inspect_artifact`.
+Summary delivery retains the complete Evidence: use `parent_evidence_id` with
+`inspect_analysis_view` to request particular inventory paths and fields.
+Extraction returns a fresh `output_root`; analyze that extracted directory with
+`analyze_javascript_application`. Snapshot-only applications have no recovered
+main script and receive no JavaScript next probe. Neither does a main script
+whose logical path lacks a JavaScript source suffix, such as `main`, because the
+analyzer selects extracted files by suffix.
+
+## Recognition and evidence
+
+The container format is `node-sea`. REA locates Mach-O sections named
+`__NODE_SEA_BLOB` in `NODE_SEA` or `__NODE_SEA`, ELF notes owned by
+`NODE_SEA_BLOB`, and PE RCDATA resources named `NODE_SEA_BLOB`. PE resource
+locations come from the shared PE resource parser. ELF program-header
+`PT_NOTE` segments are authoritative, as at runtime; `SHT_NOTE` sections are
+read only when no program-header table is readable, because injectors can
+leave stale section entries. A PE without a `NODE_SEA_BLOB` resource name is
+left to native classification. Universal Mach-O carriers
+with different slice blobs are rejected as ambiguous; identical blobs are
+inventoried once. Native carrier bytes keep their content hash and native
+classification while the root occurrence represents the SEA container.
+
+Root `format_metadata` preserves raw flags, decoded flags, code path, blob
+location, exec arguments and fuse observations. Main and asset children retain
+their role and exact declared name in `source_path`. Safe, noncolliding names
+become logical paths after the shared NFC path normalization. Names that are
+unsafe as relative paths, have an exact or file-prefix collision with another
+entry, or occupy the reserved `__node_sea__`
+namespace receive deterministic logical paths: `__node_sea__/main.cjs` for the
+main CommonJS source and `__node_sea__/assets/<ordinal>` for assets, using their
+zero-based order in the blob. The original declared name remains
+in `source_path`, including an empty asset key. Snapshots and code caches use
+`__node_sea__/snapshot` and `__node_sea__/code-cache`. Extraction materializes
+the logical paths through the shared path-containment and collision rules and
+never overwrites existing files.
+
+The fuse scan independently records `set`, `unset`, `absent`, or `conflicting`.
+An unset fuse with a present blob is reported as a limitation. These are static
+sentinel observations, not proof of runtime activation: sentinel-like text in
+script or asset bytes also participates in the scan.
+
+## Supported layout and limits
+
+The decoder follows the 64-bit little-endian layout in Node
+[v24.10.0 node_sea.cc](https://github.com/nodejs/node/blob/v24.10.0/src/node_sea.cc)
+and [node_sea.h](https://github.com/nodejs/node/blob/v24.10.0/src/node_sea.h),
+including the exec-argument extension byte. Older layouts without that byte,
+32-bit length fields, big-endian blobs and future flags are not supported.
+Carrier byte order is independent of blob byte order.
+
+Malformed magic, truncation, unknown flags/extensions, invalid UTF-8, duplicate
+raw asset keys and conflicting blob declarations fail closed with named reasons.
+Zero padding after a complete blob is allowed. The blob read ceiling is 256 MiB;
+PE carriers also use the shared 512 MiB input, 65,536 directory-entry and 8 MiB
+resource-metadata ceilings. The decoder admits at most 100,000 assets whose
+names total at most 8 MiB, and 4,096 exec arguments totaling at most 1 MiB of
+text. These are fixed resource bounds, not Node format limits, checked before
+decoding names or creating records; a hit fails as a limit with no runtime
+override. Asset and argument decoding, padding scans, and inventory construction
+yield in bounded batches and honor caller cancellation. Asset count and name
+budgets bound retained metadata independently of stored member body sizes. The PE
+name probe reads headers from the first 64 KiB of the carrier; a PE whose
+headers extend beyond that is left to native classification. Snapshot and
+code-cache bytes remain opaque.
+
+## Verification
+
+Synthetic fixtures cover Mach-O, ELF and PE inventory/extraction, malformed
+blobs, collisions and fuse contradictions. CLI and MCP tests exercise the same
+artifact provider and advertised schemas. A CLI regression also generates a blob
+with the pinned local Node version, an absolute main path and an empty asset
+key, then inventories it inside a synthetic ELF carrier. This verifies the real
+blob producer, not a real injected executable.
+
+The optional real ELF lane uses Docker's official Node v24.10.0 image and pinned
+postject to build a fixture, then verifies inventory and extracted script/asset
+bytes without running the injected application:
+
+```sh
+npm run verify:node-sea
+```
+
+This requires Docker and network access to fetch the producer image and
+postject. It creates and removes its own temporary fixture directory. A real
+macOS Mach-O or Windows PE run is separate coverage; synthetic carriers do not
+establish real-platform verification. No performance improvement is claimed;
+whole-task tokens, CPU, memory, and cold/warm timings have not been measured.
@@ -0,0 +1,55 @@
+# PE TLS callbacks and load configuration
+
+Use `inspect_pe_load_config` to locate declared TLS callbacks and inspect the load
+configuration of an explicit local PE32 or PE32+ image. No disassembler, Windows
+host, or target execution is required.
+
+```sh
+rea inspect-pe-load-config /absolute/path/to/application.exe --json
+rea inspect-pe-load-config /absolute/path/to/application.exe --max-callbacks 256 --json
+```
+
+MCP accepts `{ "path": "/absolute/path/to/application.exe" }`. CLI paths may be
+relative to the current directory; MCP paths must be absolute.
+
+The complete Evidence includes the artifact path, SHA-256, directory file ranges,
+and callback-array file ranges. `tls` reports the raw data range, index address,
+zero-fill size, characteristics and null-terminated callback array. Callback VAs
+are hexadecimal strings to preserve 64-bit precision. RVA, mapped file offset,
+and section are derived locations; unknown mappings are `null`.
+
+`load_config` reports fields only when its declared `Size` covers the entire
+field. MSVC x86 images often declare a 64-byte load-config data directory while
+the structure's own `Size` is larger; like the Windows loader, REA reads `Size`
+bytes when they are file-backed in one run, and reports both
+`directory.size` and `size`. `structure_location` is the file range of the
+`Size` bytes REA checked; Evidence locations include it beside the declared
+directory range when the two differ. Unavailable fields are `null`; a covered zero pointer remains `"0x0"`.
+The report includes the security cookie, PE32 SafeSEH table/count, CFG pointers
+and table/count, address-taken IAT and long-jump tables/counts, EH continuation
+table/count, and XFG check pointer. CHPE and dynamic relocation pointers are raw
+values. The dynamic relocation table offset (DWORD) and section (WORD) are
+reported separately when `Size` covers them, including zero values; REA does
+not infer a VA from that pair or decode the target and mitigation-table entries.
+
+Guard flags retain the raw DWORD, recognized names, unknown bits, and the CFG
+entry stride. Mitigation claims derived from those flags carry
+`evidence_kind: "inferred"`; they do not prove runtime enforcement. The image is
+never executed. Missing directories are observed absence of those declarations,
+not proof that no callback or mitigation exists by another mechanism.
+
+The default read budget is 64 MiB (`max_file_bytes`, ceiling 512 MiB). The default
+callback budget is 64 (`max_callbacks`, ceiling 4096). An exact-budget array is
+accepted if its next slot is null. Truncated, ambiguous or unmapped directory and
+callback-array storage fails closed, as does budget exhaustion; no partial
+success is returned. An unmapped callback **target** retains its VA/RVA with an
+unknown file offset. Load-config versions beyond the supported fields remain
+undecoded.
+
+Layout references: [Microsoft PE format](https://learn.microsoft.com/en-us/windows/win32/debug/pe-format),
+[IMAGE_LOAD_CONFIG_DIRECTORY32](https://learn.microsoft.com/en-us/windows/win32/api/winnt/ns-winnt-image_load_config_directory32),
+and [IMAGE_LOAD_CONFIG_DIRECTORY64](https://learn.microsoft.com/en-us/windows/win32/api/winnt/ns-winnt-image_load_config_directory64).
+
+For a real cross-compiled fixture, run `npm run verify:pe:load-config` with Zig
+on PATH (or `REA_ZIG` set to its path). The script builds PE32 and PE32+ samples
+and inspects them through the public CLI without running them.
@@ -228,6 +228,12 @@ from launch, must be ordered, and must fall within `timeout_ms`. Inputs marked
 Environment overrides are recorded in the scenario commitment; inherited
 values are not copied into Evidence.

+A bare executable name uses the scenario's `PATH` override, then the inherited
+`PATH`. When neither supplies `PATH`, lookup uses `/usr/bin:/bin`, matching
+[Node's Unix default](https://nodejs.org/api/child_process.html#child-process).
+An explicitly empty `PATH` searches only the working directory. Executable,
+working-directory, and observation paths preserve native `symlink/..` traversal.
+
 Terminal dimensions must satisfy `columns × (rows + scrollback) ≤ 1,000,000`.
 Every scheduled resize uses the same selected scrollback and must fit this
 working-buffer budget. REA rejects oversized scenarios before launching the
@@ -25,8 +25,12 @@ metadata retains the original name, table index, type, compression flag,
 relative offset and known directory record extent. Logical paths follow the
 carrier's path dialect: backslashes separate components for PE carriers, while
 they remain literal filename characters for POSIX carriers. The source name
-always retains its stored spelling. If the carrier dialect is unconfirmed, REA
-preserves backslashes verbatim instead of inferring POSIX semantics.
+always retains its stored spelling in occurrence `source_path` and
+`format_metadata.source_name`. For PYZ rows, that source is the exact module or
+data key in the PYZ table, not a reconstructed filesystem name;
+`format_metadata.container_name` identifies the containing PYZ image. If the
+carrier dialect is unconfirmed, REA preserves backslashes verbatim instead of
+inferring POSIX semantics.
 `relative_offset` is relative to the CArchive start for CArchive rows, or to
 the decoded PYZ image for PYZ rows. A CArchive directory record starts at
 `archive_start + toc_offset + directory_record_offset`; its size is
@@ -1,5 +1,8 @@
 # Headerless raw-binary analysis with Ghidra

+Headerless images are covered here. GameCube/Wii DOL images have a header and
+use their own format selection; see [GameCube DOL analysis](ghidra-dol.md).
+
 REA admits a headerless executable when the caller supplies the CPU family and
 the address where file offset 0 should be mapped. That interpretation is not
 inferred from a `.bin` suffix or from unrecognized bytes.
@@ -1,7 +1,7 @@
 <div align="center">

 [English](../../README.md) · [简体中文](README_zh.md) · [繁體中文](README_zh-TW.md) · [日本語](README_ja.md) · [한국어](README_ko.md) · [Türkçe](README_tr.md) · [Русский](README_ru.md) · [Tiếng Việt](README_vi.md) · [ไทย](README_th.md) · [Deutsch](README_de.md) · [Español](README_es.md) · [Français](README_fr.md) · [Українська](README_uk.md) · [Polski](README_pl.md) · [Português (Brasil)](README_pt-BR.md) · **العربية** · [فارسی](README_fa.md) · [Bahasa Indonesia](README_id.md) · [Italiano](README_it.md)
-· [Ελληνικά](README_el.md) · [മലയാളം](README_ml.md) · [Roman Urdu](README_ur-Latn.md)
+· [Ελληνικά](README_el.md) · [മലയാളം](README_ml.md) · [Roman Urdu](README_ur-Latn.md) · [Română](README_ro.md)

 # REA: هندسة عكسية لأي شيء

@@ -20,7 +20,7 @@

 **[الموقع](https://rea.tools/ar/) · [الأدلة](https://rea.tools/ar/guides/) · [دراسات الحالة](https://rea.tools/ar/showcase/)**

-[البدء السريع](#البدء-السريع) · [كيف يعمل REA](#كيف-يعمل-rea) · [ما الذي يمكنك تحليله](#ما-الذي-يمكنك-تحليله) · [دراسات الحالة](#دراسات-الحالة) · [الأسئلة الشائعة](#الأسئلة-الشائعة) · [أدوات GNU objdump وRizin](../reverse-engineering-tools.md) · [التوثيق](#التوثيق)
+[البدء السريع](#البدء-السريع) · [كيف يعمل REA](#كيف-يعمل-rea) · [ما الذي يمكنك تحليله](#ما-الذي-يمكنك-تحليله) · [دراسات الحالة](#دراسات-الحالة) · [إنشاء بيئات التعلم المعزز](#build-rl-environments) · [الأسئلة الشائعة](#الأسئلة-الشائعة) · [أدوات GNU objdump وRizin](../reverse-engineering-tools.md) · [التوثيق](#التوثيق)

 <code>npx rea-agents setup</code>

@@ -158,6 +158,7 @@ npx rea-agents@latest setup
 | شيفرة EVM البايتية              | محددات التوجيه، وإزاحات البايتات، والمعاملات المستنتجة، وقابلية تغيير الحالة                                | مدخل محلي يحمل بايتات خامًا أو تمثيلًا سداسيًا عشريًا على Linux x64؛ [دليل EVM دون تشغيل](../evm-bytecode.md)                             |
 | Rust binaries                   | Embedded cargo-auditable dependency list                                                                   | [Rust binaries](../rust-binaries.md)                                                                                                 |
 | ELF notes                       | PT_NOTE/SHT_NOTE owners, types, GNU build-id and ABI-tag fields                                            | Built-in static ELF inspection; [ELF notes](../elf-notes.md)                                                                         |
+| Linux kernel modules            | .modinfo keys, __versions CRCs, this_module presence, and signature trailer                                | Built-in static ELF inspection; [kernel modules](../kernel-modules.md)                                                               |
 | Erlang BEAM                     | IFF chunks, atoms, exports, and tables                                                                     | Built-in static BEAM inspection; [Erlang BEAM](../erlang-beam.md)                                                                    |
 | Apple IPS crashes               | .ips metadata, threads, images, registers and crash classes                                                | Built-in static JSON inspection; [Apple IPS](../apple-ips.md)                                                                        |
 | أعطال Linux المسجّلة             | سجلات note الخام، ومسجّلات المعالج/الإشارات لكل خيط مسجّل، وترشيحات اختيارية لخرائط الذاكرة                     | pwntools يوفّره المستدعي على Linux x64؛ GDB/pwndbg اختياريان؛ [الأعطال المسجّلة](../recorded-crashes.md)                                |
@@ -224,8 +225,51 @@ npx rea-agents@latest setup
 [اقرأ دراسة الحالة](https://rea.tools/ar/showcase/th04/) ·
 [مستودع إعادة البناء](https://github.com/N0zoM1z0/th04)

+### إنشاء بيئات التعلم المعزز باستخدام REA
+
+سجّل جلسة لتطبيق ويب، وحوّل API إلى أدوات، وصدّر بيئة يستطيع وكيل الذكاء الاصطناعي استخدامها. شغّلها باستخدام AgentEnv، ثم أضف المهام وفحوص المكافآت للتدريب بالتعلم المعزز أو التقييم.
+
+[دليل إنشاء بيئة](https://rea.tools/guides/rl-environments/) ·
+[شاهد العرض على X](https://x.com/reatools/status/2112574822584918075?s=20)
+
 إذا استخدمت REA لفحص هدف مثير للاهتمام، فنود الاطلاع عليه. شارك حالتك في [issue](https://github.com/morluto/rea/issues) أو [pull request](https://github.com/morluto/rea/pulls)، مع ذكر الهدف، وسؤالك، وكيف ساعدك REA، وما توصلت إليه.

+<a id="build-rl-environments"></a>
+
+## إنشاء بيئات التعلم المعزز
+
+أنشئ بيئة محلية يتدرب فيها وكيل الذكاء الاصطناعي على مهام مثل البحث عن مشكلة أو إنشاء مجلد، دون تشغيل التطبيق الأصلي. استخدمها للتعلم المعزز (RL) أو لاختبار قدرة الوكيل على إنجاز المهام.
+
+يحوّل REA طلبات API والردود المسجلة إلى أدوات يمكن للوكيل استدعاؤها. تستخدم البيئة البيانات المسجلة ولا تدعم التغييرات إلا عندما يؤكد التسجيل آثارها.
+
+بعد إعداد REA في وكيلك، استبدل رابط المثال ومهام المجلدات بما يناسب تطبيقك:
+
+```text
+استخدم REA لإنشاء بيئة تعلم معزز من تطبيق الويب الاختباري لدي على
+http://127.0.0.1:3000
+غطّ عرض المجلدات وإنشاءها وإعادة تسميتها وحذفها. يمكنك إنشاء مجلدات اختبار
+وحذفها، لكن لا تغيّر البيانات الموجودة.
+احفظ البيئة في مجلد باسم my-env، وتحقق من العمليات المتاحة وأخبرني كيف أشغّلها.
+```
+
+<details>
+<summary>استخدام سطر الأوامر</summary>
+
+استخدم هذه الأوامر إذا كان لديك ملف يسجل طلبات التطبيق وردوده في المتصفح. يتطلب تشغيل النتيجة أيضًا AgentEnv وDocker.
+
+```sh
+rea environment-build ./session.har ./my-env --name my-env --json
+agent-env run ./my-env
+```
+
+</details>
+
+يصدّر REA بيئة قابلة للتشغيل مع اختبار أساسي يتحقق من بدء تشغيلها واستجابتها. استخدمها مع إطار التعلم المعزز لتحديد أهداف المهام وإضافة فحوص المكافآت وتشغيل التدريب.
+
+[دليل إنشاء بيئة](https://rea.tools/guides/rl-environments/) ·
+[مرجع البيئات](../agent-environments.md) ·
+[شاهد العرض على X](https://x.com/reatools/status/2112574822584918075?s=20)
+
 ## الأسئلة الشائعة

 <details>
@@ -1,7 +1,7 @@
 <div align="center">

 [English](../../README.md) · [简体中文](README_zh.md) · [繁體中文](README_zh-TW.md) · [日本語](README_ja.md) · [한국어](README_ko.md) · [Türkçe](README_tr.md) · [Русский](README_ru.md) · [Tiếng Việt](README_vi.md) · [ไทย](README_th.md) · **Deutsch** · [Español](README_es.md) · [Français](README_fr.md) · [Українська](README_uk.md) · [Polski](README_pl.md) · [Português (Brasil)](README_pt-BR.md) · [العربية](README_ar.md) · [فارسی](README_fa.md) · [Bahasa Indonesia](README_id.md) · [Italiano](README_it.md)
-· [Ελληνικά](README_el.md) · [മലയാളം](README_ml.md) · [Roman Urdu](README_ur-Latn.md)
+· [Ελληνικά](README_el.md) · [മലയാളം](README_ml.md) · [Roman Urdu](README_ur-Latn.md) · [Română](README_ro.md)

 # REA: Alles reverse-engineeren

@@ -20,7 +20,7 @@

 **[Website](https://rea.tools/de/) · [Anleitungen](https://rea.tools/de/guides/) · [Fallstudien](https://rea.tools/de/showcase/)**

-[Schnellstart](#schnellstart) · [So funktioniert REA](#so-funktioniert-rea) · [Was du analysieren kannst](#was-du-analysieren-kannst) · [Fallstudien](#fallstudien) · [Häufige Fragen](#häufige-fragen) · [GNU-objdump- und Rizin-Tools](../reverse-engineering-tools.md) · [Dokumentation](#dokumentation)
+[Schnellstart](#schnellstart) · [So funktioniert REA](#so-funktioniert-rea) · [Was du analysieren kannst](#was-du-analysieren-kannst) · [Fallstudien](#fallstudien) · [RL-Umgebungen erstellen](#build-rl-environments) · [Häufige Fragen](#häufige-fragen) · [GNU-objdump- und Rizin-Tools](../reverse-engineering-tools.md) · [Dokumentation](#dokumentation)

 <code>npx rea-agents setup</code>

@@ -158,6 +158,7 @@ REA benötigt Node.js 22.x (>=22.23.4), 24.x (>=24.22.1) oder 26+ (>=26.12.1) so
 | EVM-Bytecode                        | Dispatch-Selektoren, Byte-Offsets, abgeleitete Argumente und Veränderbarkeit des Zustands                       | Lokale Eingabe mit Rohbytes oder Hexdarstellung unter Linux x64; [Offline-EVM-Leitfaden](../evm-bytecode.md)                                                         |
 | Rust binaries                       | Embedded cargo-auditable dependency list                                                                        | [Rust binaries](../rust-binaries.md)                                                                                                                                 |
 | ELF notes                           | PT_NOTE/SHT_NOTE owners, types, GNU build-id and ABI-tag fields                                                 | Built-in static ELF inspection; [ELF notes](../elf-notes.md)                                                                                                         |
+| Linux kernel modules                | .modinfo keys, __versions CRCs, this_module presence, and signature trailer                                     | Built-in static ELF inspection; [kernel modules](../kernel-modules.md)                                                                                               |
 | Erlang BEAM                         | IFF chunks, atoms, exports, and tables                                                                          | Built-in static BEAM inspection; [Erlang BEAM](../erlang-beam.md)                                                                                                    |
 | Apple IPS crashes                   | .ips metadata, threads, images, registers and crash classes                                                     | Built-in static JSON inspection; [Apple IPS](../apple-ips.md)                                                                                                        |
 | Aufgezeichnete Linux-Abstürze       | Unverarbeitete Note-Einträge, Register/Signale aller aufgezeichneten Threads und optionale Zuordnungskandidaten | Vom Aufrufer bereitgestelltes pwntools unter Linux x64; optional GDB/pwndbg; [aufgezeichnete Abstürze](../recorded-crashes.md)                                       |
@@ -222,8 +223,51 @@ Untersuche die 16-Bit-Anweisungen des ursprünglichen PC-98-Spiels, rekonstruier

 [Fallstudie lesen](https://rea.tools/de/showcase/th04/) · [Rekonstruktionsrepository](https://github.com/N0zoM1z0/th04)

+### RL-Umgebungen mit REA erstellen
+
+Zeichne eine Webanwendungssitzung auf, verwandle ihre API in Werkzeuge und exportiere eine Umgebung für einen KI-Agenten. Starte sie mit AgentEnv und ergänze Aufgaben und Belohnungsprüfungen für RL-Training oder Bewertung.
+
+[Anleitung zum Erstellen einer Umgebung](https://rea.tools/guides/rl-environments/) ·
+[Demo auf X ansehen](https://x.com/reatools/status/2112574822584918075?s=20)
+
 Wenn du mit REA etwas Interessantes untersucht hast, würden wir es gern sehen. Teile deine Fallstudie in einem [Issue](https://github.com/morluto/rea/issues) oder [Pull Request](https://github.com/morluto/rea/pulls) und beschreibe das Ziel, deine Frage, wie REA geholfen hat und was du herausgefunden hast.

+<a id="build-rl-environments"></a>
+
+## RL-Umgebungen erstellen
+
+Erstelle eine lokale Umgebung, in der ein KI-Agent Aufgaben wie das Finden eines Issues oder das Anlegen eines Ordners üben kann, ohne die ursprüngliche App auszuführen. Nutze sie für Reinforcement Learning (RL) oder um zu testen, wie gut ein Agent Aufgaben erledigt.
+
+REA wandelt aufgezeichnete API-Anfragen und Antworten in Werkzeuge um, die der Agent aufrufen kann. Die Umgebung nutzt die aufgezeichneten Daten und unterstützt Änderungen nur, wenn die Aufzeichnung deren Wirkung bestätigt.
+
+Richte REA in deinem Agenten ein und ersetze die Beispiel-URL und die Ordneraufgaben durch deine eigenen:
+
+```text
+Erstelle mit REA eine RL-Umgebung aus meiner Test-Web-App unter
+http://127.0.0.1:3000.
+Decke das Auflisten, Erstellen, Umbenennen und Löschen von Ordnern ab.
+Du darfst Testordner anlegen und entfernen. Lass bestehende Daten unverändert.
+Speichere sie in einem Ordner namens my-env, prüfe die verfügbaren Operationen und erkläre mir den Start.
+```
+
+<details>
+<summary>Stattdessen die Befehlszeile verwenden</summary>
+
+Nutze diese Befehle, wenn du bereits eine Datei mit aufgezeichneten Browseranfragen und Antworten der App hast. Zum Ausführen des Ergebnisses brauchst du außerdem AgentEnv und Docker.
+
+```sh
+rea environment-build ./session.har ./my-env --name my-env --json
+agent-env run ./my-env
+```
+
+</details>
+
+REA exportiert eine lauffähige Umgebung mit einem einfachen Test, der prüft, ob sie startet und antwortet. Nutze sie mit deinem RL-Framework, um Aufgabenziele und Belohnungsprüfungen festzulegen und das Training auszuführen.
+
+[Anleitung zum Erstellen einer Umgebung](https://rea.tools/guides/rl-environments/) ·
+[Umgebungsreferenz](../agent-environments.md) ·
+[Demo auf X ansehen](https://x.com/reatools/status/2112574822584918075?s=20)
+
 ## Häufige Fragen

 <details>
@@ -1,6 +1,6 @@
 <div align="center">

-[English](../../README.md) · [简体中文](README_zh.md) · [繁體中文](README_zh-TW.md) · [日本語](README_ja.md) · [한국어](README_ko.md) · [Türkçe](README_tr.md) · [Русский](README_ru.md) · [Tiếng Việt](README_vi.md) · [ไทย](README_th.md) · [Deutsch](README_de.md) · [Español](README_es.md) · [Français](README_fr.md) · [Українська](README_uk.md) · [Polski](README_pl.md) · [Português (Brasil)](README_pt-BR.md) · [العربية](README_ar.md) · [فارسی](README_fa.md) · [Bahasa Indonesia](README_id.md) · [Italiano](README_it.md) · **Ελληνικά** · [മലയാളം](README_ml.md) · [Roman Urdu](README_ur-Latn.md)
+[English](../../README.md) · [简体中文](README_zh.md) · [繁體中文](README_zh-TW.md) · [日本語](README_ja.md) · [한국어](README_ko.md) · [Türkçe](README_tr.md) · [Русский](README_ru.md) · [Tiếng Việt](README_vi.md) · [ไทย](README_th.md) · [Deutsch](README_de.md) · [Español](README_es.md) · [Français](README_fr.md) · [Українська](README_uk.md) · [Polski](README_pl.md) · [Português (Brasil)](README_pt-BR.md) · [العربية](README_ar.md) · [فارسی](README_fa.md) · [Bahasa Indonesia](README_id.md) · [Italiano](README_it.md) · **Ελληνικά** · [മലയാളം](README_ml.md) · [Roman Urdu](README_ur-Latn.md) · [Română](README_ro.md)

 # REA: Reverse Engineer Anything

@@ -19,7 +19,7 @@

 **[Ιστότοπος](https://rea.tools/) · [Οδηγοί](https://rea.tools/guides/) · [Μελέτες περίπτωσης](https://rea.tools/showcase/)**

-[Γρήγορη εκκίνηση](#γρήγορη-εκκίνηση) · [Πώς λειτουργεί το REA](#πώς-λειτουργεί-το-rea) · [Τι μπορείς να αναλύσεις](#τι-μπορείς-να-αναλύσεις) · [Μελέτες περίπτωσης](#μελέτες-περίπτωσης) · [Συχνές ερωτήσεις](#συχνές-ερωτήσεις) · [Τεκμηρίωση](#τεκμηρίωση)
+[Γρήγορη εκκίνηση](#γρήγορη-εκκίνηση) · [Πώς λειτουργεί το REA](#πώς-λειτουργεί-το-rea) · [Τι μπορείς να αναλύσεις](#τι-μπορείς-να-αναλύσεις) · [Μελέτες περίπτωσης](#μελέτες-περίπτωσης) · [Δημιουργία περιβαλλόντων RL](#build-rl-environments) · [Συχνές ερωτήσεις](#συχνές-ερωτήσεις) · [Τεκμηρίωση](#τεκμηρίωση)

 <code>npx rea-agents setup</code>

@@ -159,6 +159,7 @@ npx rea-agents@latest setup
 | PE imports                             | Import and delay-load DLL names, ordinals, IAT RVAs and pefile import hash                                                  | Built-in static PE inspection; [PE imports](../pe-imports.md)                                                                       |
 | ELF notes                              | PT_NOTE/SHT_NOTE owners, types, GNU build-id and ABI-tag fields                                                             | Built-in static ELF inspection; [ELF notes](../elf-notes.md)                                                                        |
 | Apple IPS crashes                      | .ips metadata, threads, images, registers and crash classes                                                                 | Built-in static JSON inspection; [Apple IPS](../apple-ips.md)                                                                       |
+| Linux kernel modules                   | .modinfo keys, __versions CRCs, this_module presence, and signature trailer                                                 | Built-in static ELF inspection; [kernel modules](../kernel-modules.md)                                                              |
 | Erlang BEAM                            | IFF chunks, atoms, exports, and tables                                                                                      | Built-in static BEAM inspection; [Erlang BEAM](../erlang-beam.md)                                                                   |
 | Αρχείο WASM                            | Έλεγχο εγκυρότητας, ενότητες, ακριβείς μορφές εισαγωγών/εξαγωγών σε WAT και αποκωδικοποιημένο WAT                           | WABT 1.0.42 που παρέχει ο χρήστης· `inspect_wasm_artifact`                                                                          |
 | Bytecode EVM                           | Selectors επιλογής συνάρτησης, μετατοπίσεις σε bytes, εκτιμώμενα ορίσματα και δυνατότητα μεταβολής της κατάστασης           | Τοπική είσοδος σε ακατέργαστα bytes ή δεκαεξαδική μορφή σε Linux x64· [οδηγός EVM χωρίς εκτέλεση](../evm-bytecode.md)               |
@@ -226,8 +227,51 @@ npx rea-agents@latest setup

 [Διάβασε τη μελέτη περίπτωσης](https://rea.tools/showcase/th04/) · [Αποθετήριο ανακατασκευής](https://github.com/N0zoM1z0/th04)

+### Δημιουργία περιβαλλόντων RL με το REA
+
+Καταγράψτε μια συνεδρία εφαρμογής ιστού, μετατρέψτε το API της σε εργαλεία και εξαγάγετε ένα περιβάλλον για πράκτορα AI. Εκτελέστε το με το AgentEnv και προσθέστε εργασίες και ελέγχους ανταμοιβής για εκπαίδευση RL ή αξιολόγηση.
+
+[Οδηγός δημιουργίας περιβάλλοντος](https://rea.tools/guides/rl-environments/) ·
+[Δείτε το demo στο X](https://x.com/reatools/status/2112574822584918075?s=20)
+
 Αν χρησιμοποίησες το REA για κάτι ενδιαφέρον, θα θέλαμε να το δούμε. Μοιράσου τη μελέτη σου σε ένα [issue](https://github.com/morluto/rea/issues) ή [pull request](https://github.com/morluto/rea/pulls), αναφέροντας τον στόχο, το ερώτημά σου, πώς βοήθησε το REA και τι ανακάλυψες.

+<a id="build-rl-environments"></a>
+
+## Δημιουργία περιβαλλόντων RL
+
+Δημιουργήστε ένα τοπικό περιβάλλον όπου ένας πράκτορας AI εξασκείται σε εργασίες όπως η εύρεση ενός issue ή η δημιουργία φακέλου, χωρίς να εκτελείται η αρχική εφαρμογή. Χρησιμοποιήστε το για ενισχυτική μάθηση (RL) ή για να ελέγξετε πόσο καλά ολοκληρώνει εργασίες ο πράκτορας.
+
+Το REA μετατρέπει καταγεγραμμένα αιτήματα και απαντήσεις API σε εργαλεία που μπορεί να καλεί ο πράκτορας. Το περιβάλλον χρησιμοποιεί τα καταγεγραμμένα δεδομένα και υποστηρίζει αλλαγές μόνο όταν η καταγραφή επιβεβαιώνει τα αποτελέσματά τους.
+
+Ρυθμίστε το REA στον πράκτορά σας και προσαρμόστε το URL και τις εργασίες φακέλων του παραδείγματος:
+
+```text
+Χρησιμοποίησε το REA για να δημιουργήσεις περιβάλλον RL από τη δοκιμαστική εφαρμογή μου:
+http://127.0.0.1:3000
+Κάλυψε προβολή, δημιουργία, μετονομασία και διαγραφή φακέλων. Μπορείς να δημιουργείς
+και να αφαιρείς δοκιμαστικούς φακέλους, αλλά μην αλλάξεις τα υπάρχοντα δεδομένα.
+Αποθήκευσέ το σε φάκελο my-env, έλεγξε τις διαθέσιμες λειτουργίες και πες μου πώς εκτελείται.
+```
+
+<details>
+<summary>Χρήση της γραμμής εντολών</summary>
+
+Χρησιμοποιήστε αυτές τις εντολές αν έχετε ήδη αρχείο με τα καταγεγραμμένα αιτήματα και τις απαντήσεις της εφαρμογής στο πρόγραμμα περιήγησης. Η εκτέλεση χρειάζεται επίσης AgentEnv και Docker.
+
+```sh
+rea environment-build ./session.har ./my-env --name my-env --json
+agent-env run ./my-env
+```
+
+</details>
+
+Το REA εξάγει ένα εκτελέσιμο περιβάλλον με μια βασική δοκιμή εκκίνησης και απόκρισης. Συνδέστε το στο πλαίσιο RL για να ορίσετε στόχους, να προσθέσετε ελέγχους ανταμοιβής και να εκτελέσετε εκπαίδευση.
+
+[Οδηγός δημιουργίας περιβάλλοντος](https://rea.tools/guides/rl-environments/) ·
+[Αναφορά περιβαλλόντων](../agent-environments.md) ·
+[Δείτε το demo στο X](https://x.com/reatools/status/2112574822584918075?s=20)
+
 ## Συχνές ερωτήσεις

 <details>
@@ -1,7 +1,7 @@
 <div align="center">

 [English](../../README.md) · [简体中文](README_zh.md) · [繁體中文](README_zh-TW.md) · [日本語](README_ja.md) · [한국어](README_ko.md) · [Türkçe](README_tr.md) · [Русский](README_ru.md) · [Tiếng Việt](README_vi.md) · [ไทย](README_th.md) · [Deutsch](README_de.md) · **Español** · [Français](README_fr.md) · [Українська](README_uk.md) · [Polski](README_pl.md) · [Português (Brasil)](README_pt-BR.md) · [العربية](README_ar.md) · [فارسی](README_fa.md) · [Bahasa Indonesia](README_id.md) · [Italiano](README_it.md)
-· [Ελληνικά](README_el.md) · [മലയാളം](README_ml.md) · [Roman Urdu](README_ur-Latn.md)
+· [Ελληνικά](README_el.md) · [മലയാളം](README_ml.md) · [Roman Urdu](README_ur-Latn.md) · [Română](README_ro.md)

 # REA: Ingeniería inversa de cualquier cosa

@@ -20,7 +20,7 @@

 **[Sitio web](https://rea.tools/es/) · [Guías](https://rea.tools/es/guides/) · [Casos prácticos](https://rea.tools/es/showcase/)**

-[Inicio rápido](#inicio-rápido) · [Cómo funciona REA](#cómo-funciona-rea) · [Qué puedes analizar](#qué-puedes-analizar) · [Casos prácticos](#casos-prácticos) · [Preguntas frecuentes](#preguntas-frecuentes) · [Herramientas GNU objdump y Rizin](../reverse-engineering-tools.md) · [Documentación](#documentación)
+[Inicio rápido](#inicio-rápido) · [Cómo funciona REA](#cómo-funciona-rea) · [Qué puedes analizar](#qué-puedes-analizar) · [Casos prácticos](#casos-prácticos) · [Crear entornos de RL](#build-rl-environments) · [Preguntas frecuentes](#preguntas-frecuentes) · [Herramientas GNU objdump y Rizin](../reverse-engineering-tools.md) · [Documentación](#documentación)

 <code>npx rea-agents setup</code>

@@ -158,6 +158,7 @@ REA requiere Node.js 22.x (>=22.23.4), 24.x (>=24.22.1) o 26+ (>=26.12.1), adem
 | Bytecode EVM                | Selectores de despacho, desplazamientos en bytes, argumentos inferidos y mutabilidad                                           | Entrada local con bytes sin procesar o representación hexadecimal, en Linux x64; [guía de EVM sin ejecutar](../evm-bytecode.md)              |
 | Rust binaries               | Embedded cargo-auditable dependency list                                                                                       | [Rust binaries](../rust-binaries.md)                                                                                                         |
 | ELF notes                   | PT_NOTE/SHT_NOTE owners, types, GNU build-id and ABI-tag fields                                                                | Built-in static ELF inspection; [ELF notes](../elf-notes.md)                                                                                 |
+| Linux kernel modules        | .modinfo keys, __versions CRCs, this_module presence, and signature trailer                                                    | Built-in static ELF inspection; [kernel modules](../kernel-modules.md)                                                                       |
 | Erlang BEAM                 | IFF chunks, atoms, exports, and tables                                                                                         | Built-in static BEAM inspection; [Erlang BEAM](../erlang-beam.md)                                                                            |
 | Apple IPS crashes           | .ips metadata, threads, images, registers and crash classes                                                                    | Built-in static JSON inspection; [Apple IPS](../apple-ips.md)                                                                                |
 | Fallos de Linux registrados | Registros note sin procesar, registros/señales de cada hilo registrado y posibles correspondencias de memoria opcionales       | pwntools proporcionado por quien llama, en Linux x64; GDB/pwndbg opcionales; [fallos registrados](../recorded-crashes.md)                    |
@@ -222,8 +223,51 @@ Inspecciona las instrucciones de 16 bits del juego original para PC-98, recupera

 [Lee el caso práctico](https://rea.tools/es/showcase/th04/) · [Repositorio de reconstrucción](https://github.com/N0zoM1z0/th04)

+### Crear entornos de RL con REA
+
+Graba una sesión de una aplicación web, convierte su API en herramientas y exporta un entorno que un agente de IA pueda usar. Ejecútalo con AgentEnv y añade tareas y comprobaciones de recompensa para entrenamiento RL o evaluación.
+
+[Guía para crear un entorno](https://rea.tools/guides/rl-environments/) ·
+[Ver la demo en X](https://x.com/reatools/status/2112574822584918075?s=20)
+
 Si has usado REA para investigar algo interesante, nos gustaría verlo. Comparte tu caso en una [issue](https://github.com/morluto/rea/issues) o una [pull request](https://github.com/morluto/rea/pulls), incluyendo el objetivo, tu pregunta, cómo te ayudó REA y qué encontraste.

+<a id="build-rl-environments"></a>
+
+## Crear entornos de RL
+
+Crea un entorno local donde un agente de IA pueda practicar tareas como buscar un issue o crear una carpeta, sin ejecutar la aplicación original. Úsalo para aprendizaje por refuerzo (RL) o para comprobar cómo completa las tareas un agente.
+
+REA convierte las solicitudes y respuestas de API grabadas en herramientas que el agente puede llamar. El entorno usa los datos grabados y solo admite cambios cuyos efectos confirma la grabación.
+
+Configura REA en tu agente y sustituye la URL y las tareas de carpetas del ejemplo por las tuyas:
+
+```text
+Usa REA para crear un entorno de RL a partir de mi aplicación web de prueba en
+http://127.0.0.1:3000.
+Incluye listar, crear, renombrar y borrar carpetas. Puedes crear y borrar
+carpetas de prueba, pero no modifiques los datos existentes.
+Guárdalo en una carpeta llamada my-env, comprueba qué operaciones funcionan y dime cómo ejecutarlo.
+```
+
+<details>
+<summary>Usar la línea de comandos</summary>
+
+Usa estos comandos si ya tienes un archivo con las solicitudes y respuestas de la aplicación grabadas en el navegador. Para ejecutar el resultado también necesitas AgentEnv y Docker.
+
+```sh
+rea environment-build ./session.har ./my-env --name my-env --json
+agent-env run ./my-env
+```
+
+</details>
+
+REA exporta un entorno ejecutable con una prueba básica que comprueba que arranca y responde. Úsalo con tu framework de RL para definir objetivos, añadir comprobaciones de recompensa y ejecutar el entrenamiento.
+
+[Guía para crear un entorno](https://rea.tools/guides/rl-environments/) ·
+[Referencia de entornos](../agent-environments.md) ·
+[Ver la demo en X](https://x.com/reatools/status/2112574822584918075?s=20)
+
 ## Preguntas frecuentes

 <details>
@@ -1,7 +1,7 @@
 <div align="center" dir="rtl">

 [English](../../README.md) · [简体中文](README_zh.md) · [繁體中文](README_zh-TW.md) · [日本語](README_ja.md) · [한국어](README_ko.md) · [Türkçe](README_tr.md) · [Русский](README_ru.md) · [Tiếng Việt](README_vi.md) · [ไทย](README_th.md) · [Deutsch](README_de.md) · [Español](README_es.md) · [Français](README_fr.md) · [Українська](README_uk.md) · [Polski](README_pl.md) · [Português (Brasil)](README_pt-BR.md) · [العربية](README_ar.md) · **فارسی** · [Bahasa Indonesia](README_id.md) · [Italiano](README_it.md)
-· [Ελληνικά](README_el.md) · [മലയാളം](README_ml.md) · [Roman Urdu](README_ur-Latn.md)
+· [Ελληνικά](README_el.md) · [മലയാളം](README_ml.md) · [Roman Urdu](README_ur-Latn.md) · [Română](README_ro.md)

 # REA: مهندسی معکوس هر چیزی

@@ -20,7 +20,7 @@

 **[وب‌سایت](https://rea.tools/fa/) · [راهنماها](https://rea.tools/fa/guides/) · [نمونه‌های عملی](https://rea.tools/fa/showcase/)**

-[شروع سریع](#شروع-سریع) · [REA چگونه کار می‌کند؟](#rea-چگونه-کار-می‌کند) · [چه چیزهایی را میتوان تحلیل کرد؟](#چه-چیزهایی-را-می‌توان-تحلیل-کرد) · [نمونه‌های عملی](#نمونه‌های-عملی) · [پرسش‌های متداول](#پرسش‌های-متداول) · [ابزارهای GNU objdump و Rizin](../reverse-engineering-tools.md) · [مستندات](#مستندات)
+[شروع سریع](#شروع-سریع) · [REA چگونه کار می‌کند؟](#rea-چگونه-کار-می‌کند) · [چه چیزهایی را میتوان تحلیل کرد؟](#چه-چیزهایی-را-می‌توان-تحلیل-کرد) · [نمونه‌های عملی](#نمونه‌های-عملی) · [ساخت محیط‌های RL](#build-rl-environments) · [پرسش‌های متداول](#پرسش‌های-متداول) · [ابزارهای GNU objdump و Rizin](../reverse-engineering-tools.md) · [مستندات](#مستندات)

 <code>npx rea-agents setup</code>

@@ -151,6 +151,7 @@ REA به Node.js 22.x (>=22.23.4)، 24.x (>=24.22.1) یا 26+ (>=26.12.1)، به
 | Rust binaries          | Embedded cargo-auditable dependency list                                            | [Rust binaries](../rust-binaries.md)                                                                                              |
 | ELF notes              | PT_NOTE/SHT_NOTE owners, types, GNU build-id and ABI-tag fields                     | Built-in static ELF inspection; [ELF notes](../elf-notes.md)                                                                      |
 | Apple IPS crashes      | .ips metadata, threads, images, registers and crash classes                         | Built-in static JSON inspection; [Apple IPS](../apple-ips.md)                                                                     |
+| Linux kernel modules   | .modinfo keys, __versions CRCs, this_module presence, and signature trailer         | Built-in static ELF inspection; [kernel modules](../kernel-modules.md)                                                            |
 | Erlang BEAM            | IFF chunks, atoms, exports, and tables                                              | Built-in static BEAM inspection; [Erlang BEAM](../erlang-beam.md)                                                                 |
 | کرش‌های ثبت‌شدهٔ لینوکس   | یادداشت‌های خام، رجیسترها/سیگنال‌های تمام threadهای ثبت‌شده و گزینه‌های احتمالی نگاشت   | pwntools تأمین‌شده توسط فراخواننده روی Linux x64؛ GDB/pwndbg اختیاری؛ [کرش‌های ثبت‌شده](../recorded-crashes.md)                      |
 | نصب‌های دسکتاپ          | نامزدهای زمان اجرا، فایل‌های شاهد، نشانه‌های مؤلفه‌ها و مراحل بعدی                     | بررسی محدود پوشه‌ها و سرآیندها；[برنامه‌های دسکتاپ](../desktop-applications.md)                                                     |
@@ -214,8 +215,51 @@ API کلیپ‌بورد در renderer را پیدا کنید، مسیر آن ر

 [مطالعهٔ موردی](https://rea.tools/fa/showcase/th04/) · [مخزن بازسازی](https://github.com/N0zoM1z0/th04)

+### ساخت محیط‌های RL با REA
+
+یک نشست برنامهٔ وب را ضبط کنید، API آن را به ابزار تبدیل کنید و محیطی برای عامل هوش مصنوعی صادر کنید. آن را با AgentEnv اجرا کنید و کارها و بررسی پاداش را برای آموزش RL یا ارزیابی اضافه کنید.
+
+[راهنمای ساخت محیط](https://rea.tools/guides/rl-environments/) ·
+[نمایش را در X ببینید](https://x.com/reatools/status/2112574822584918075?s=20)
+
 اگر از REA برای بررسی موضوع جالبی استفاده کرده‌اید، خوشحال می‌شویم آن را به اشتراک بگذارید. یک [issue](https://github.com/morluto/rea/issues) یا [pull request](https://github.com/morluto/rea/pulls) ثبت کنید و هدف، پرسش خود، نقش REA و یافته‌هایتان را توضیح دهید.

+<a id="build-rl-environments"></a>
+
+## ساخت محیط‌های RL
+
+محیطی محلی بسازید تا عامل هوش مصنوعی بدون اجرای برنامهٔ اصلی، کارهایی مثل پیدا کردن یک مسئله یا ساخت پوشه را تمرین کند. از آن برای یادگیری تقویتی (RL) یا سنجش توانایی عامل در انجام کارها استفاده کنید.
+
+REA درخواست‌ها و پاسخ‌های ضبط‌شدهٔ API را به ابزارهایی تبدیل می‌کند که عامل می‌تواند فراخوانی کند. محیط از داده‌های ضبط‌شده استفاده می‌کند و فقط تغییراتی را پشتیبانی می‌کند که اثرشان در ضبط تأیید شده باشد.
+
+پس از راه‌اندازی REA در عامل، نشانی نمونه و کارهای مربوط به پوشه را با موارد خودتان جایگزین کنید:
+
+```text
+با REA از برنامهٔ وب آزمایشی من در این نشانی یک محیط RL بساز:
+http://127.0.0.1:3000
+فهرست کردن، ساختن، تغییر نام و حذف پوشه‌ها را پوشش بده. می‌توانی پوشه‌های
+آزمایشی بسازی و حذف کنی، اما داده‌های موجود را تغییر نده.
+در پوشه‌ای به نام my-env ذخیره کن، عملیات قابل استفاده را بررسی کن و روش اجرا را بگو.
+```
+
+<details>
+<summary>استفاده از خط فرمان</summary>
+
+اگر فایل ضبط درخواست‌ها و پاسخ‌های برنامه در مرورگر را دارید، از این فرمان‌ها استفاده کنید. اجرای نتیجه به AgentEnv و Docker هم نیاز دارد.
+
+```sh
+rea environment-build ./session.har ./my-env --name my-env --json
+agent-env run ./my-env
+```
+
+</details>
+
+REA محیطی آمادهٔ اجرا همراه با یک آزمون ساده برای بررسی شروع به کار و پاسخ‌گویی آن صادر می‌کند. آن را به چارچوب RL متصل کنید تا اهداف کارها و بررسی پاداش را تعریف و آموزش را اجرا کنید.
+
+[راهنمای ساخت محیط](https://rea.tools/guides/rl-environments/) ·
+[مرجع محیط‌ها](../agent-environments.md) ·
+[نمایش را در X ببینید](https://x.com/reatools/status/2112574822584918075?s=20)
+
 ## پرسش‌های متداول

 <details><summary><strong>کدام ایجنت‌ها می‌توانند از REA استفاده کنند؟</strong></summary>
@@ -1,7 +1,7 @@
 <div align="center">

 [English](../../README.md) · [简体中文](README_zh.md) · [繁體中文](README_zh-TW.md) · [日本語](README_ja.md) · [한국어](README_ko.md) · [Türkçe](README_tr.md) · [Русский](README_ru.md) · [Tiếng Việt](README_vi.md) · [ไทย](README_th.md) · [Deutsch](README_de.md) · [Español](README_es.md) · **Français** · [Українська](README_uk.md) · [Polski](README_pl.md) · [Português (Brasil)](README_pt-BR.md) · [العربية](README_ar.md) · [فارسی](README_fa.md) · [Bahasa Indonesia](README_id.md) · [Italiano](README_it.md)
-· [Ελληνικά](README_el.md) · [മലയാളം](README_ml.md) · [Roman Urdu](README_ur-Latn.md)
+· [Ελληνικά](README_el.md) · [മലയാളം](README_ml.md) · [Roman Urdu](README_ur-Latn.md) · [Română](README_ro.md)

 # REA : rétro-ingénierie de tout

@@ -20,7 +20,7 @@

 **[Site web](https://rea.tools/fr/) · [Guides](https://rea.tools/fr/guides/) · [Études de cas](https://rea.tools/fr/showcase/)**

-[Démarrage rapide](#démarrage-rapide) · [Comment fonctionne REA](#comment-fonctionne-rea) · [Ce que vous pouvez analyser](#ce-que-vous-pouvez-analyser) · [Études de cas](#études-de-cas) · [Questions fréquentes](#questions-fréquentes) · [Outils GNU objdump et Rizin](../reverse-engineering-tools.md) · [Documentation](#documentation)
+[Démarrage rapide](#démarrage-rapide) · [Comment fonctionne REA](#comment-fonctionne-rea) · [Ce que vous pouvez analyser](#ce-que-vous-pouvez-analyser) · [Études de cas](#études-de-cas) · [Créer des environnements RL](#build-rl-environments) · [Questions fréquentes](#questions-fréquentes) · [Outils GNU objdump et Rizin](../reverse-engineering-tools.md) · [Documentation](#documentation)

 <code>npx rea-agents setup</code>

@@ -158,6 +158,7 @@ REA nécessite Node.js 22.x (>=22.23.4), 24.x (>=24.22.1) ou 26+ (>=26.12.1), ai
 | Bytecode EVM                 | Sélecteurs de dispatch, offsets en octets, arguments inférés et mutabilité                                  | Fichier local brut ou hexadécimal sous Linux x64 ; [guide EVM hors ligne](../evm-bytecode.md)                                             |
 | Rust binaries                | Embedded cargo-auditable dependency list                                                                    | [Rust binaries](../rust-binaries.md)                                                                                                      |
 | ELF notes                    | PT_NOTE/SHT_NOTE owners, types, GNU build-id and ABI-tag fields                                             | Built-in static ELF inspection; [ELF notes](../elf-notes.md)                                                                              |
+| Linux kernel modules         | .modinfo keys, __versions CRCs, this_module presence, and signature trailer                                 | Built-in static ELF inspection; [kernel modules](../kernel-modules.md)                                                                    |
 | Erlang BEAM                  | IFF chunks, atoms, exports, and tables                                                                      | Built-in static BEAM inspection; [Erlang BEAM](../erlang-beam.md)                                                                         |
 | Apple IPS crashes            | .ips metadata, threads, images, registers and crash classes                                                 | Built-in static JSON inspection; [Apple IPS](../apple-ips.md)                                                                             |
 | Crashs Linux enregistrés     | Notes brutes, registres et signaux de chaque thread enregistré, et correspondances de mappings facultatives | pwntools fourni par l'utilisateur sous Linux x64 ; GDB/pwndbg en option ; [crashs enregistrés](../recorded-crashes.md)                    |
@@ -219,8 +220,51 @@ Inspectez les instructions 16 bits du jeu PC-98 d'origine, retrouvez les calculs

 [Lire l'étude de cas](https://rea.tools/fr/showcase/th04/) · [Dépôt de la reconstruction](https://github.com/N0zoM1z0/th04)

+### Créer des environnements RL avec REA
+
+Enregistrez une session d’application web, transformez son API en outils et exportez un environnement utilisable par un agent IA. Exécutez-le avec AgentEnv, puis ajoutez des tâches et des vérifications de récompense pour l’entraînement RL ou l’évaluation.
+
+[Guide de création d’un environnement](https://rea.tools/guides/rl-environments/) ·
+[Voir la démo sur X](https://x.com/reatools/status/2112574822584918075?s=20)
+
 Si vous avez utilisé REA sur un projet intéressant, nous serions ravis de le découvrir. Partagez votre cas dans une [issue](https://github.com/morluto/rea/issues) ou une [pull request](https://github.com/morluto/rea/pulls), en précisant la cible, votre question, la manière dont REA vous a aidé et ce que vous avez découvert.

+<a id="build-rl-environments"></a>
+
+## Créer des environnements RL
+
+Créez un environnement local où un agent IA peut s’exercer à des tâches comme trouver un ticket ou créer un dossier, sans exécuter l’application d’origine. Utilisez-le pour l’apprentissage par renforcement (RL) ou pour tester la capacité d’un agent à accomplir des tâches.
+
+REA transforme les requêtes et réponses API enregistrées en outils que l’agent peut appeler. L’environnement utilise les données enregistrées et ne prend en charge des modifications que si l’enregistrement confirme leurs effets.
+
+Configurez REA dans votre agent, puis adaptez l’URL et les tâches sur les dossiers à votre application :
+
+```text
+Utilise REA pour créer un environnement RL à partir de mon application web de test à
+http://127.0.0.1:3000.
+Couvre la liste, la création, le renommage et la suppression de dossiers.
+Tu peux créer et supprimer des dossiers de test. Ne modifie pas les données existantes.
+Enregistre-le dans un dossier nommé my-env, vérifie les opérations disponibles et explique-moi comment le lancer.
+```
+
+<details>
+<summary>Utiliser la ligne de commande</summary>
+
+Utilisez ces commandes si vous disposez déjà d’un fichier contenant les requêtes et réponses de l’application enregistrées dans le navigateur. L’exécution du résultat nécessite aussi AgentEnv et Docker.
+
+```sh
+rea environment-build ./session.har ./my-env --name my-env --json
+agent-env run ./my-env
+```
+
+</details>
+
+REA exporte un environnement exécutable avec un test de base qui vérifie qu’il démarre et répond. Utilisez-le avec votre framework RL pour définir les objectifs, ajouter les vérifications de récompense et lancer l’entraînement.
+
+[Guide de création d’un environnement](https://rea.tools/guides/rl-environments/) ·
+[Référence des environnements](../agent-environments.md) ·
+[Voir la démo sur X](https://x.com/reatools/status/2112574822584918075?s=20)
+
 ## Questions fréquentes

 <details>
@@ -1,7 +1,7 @@
 <div align="center">

 [English](../../README.md) · [简体中文](README_zh.md) · [繁體中文](README_zh-TW.md) · [日本語](README_ja.md) · [한국어](README_ko.md) · [Türkçe](README_tr.md) · [Русский](README_ru.md) · [Tiếng Việt](README_vi.md) · [ไทย](README_th.md) · [Deutsch](README_de.md) · [Español](README_es.md) · [Français](README_fr.md) · [Українська](README_uk.md) · [Polski](README_pl.md) · [Português (Brasil)](README_pt-BR.md) · [العربية](README_ar.md) · [فارسی](README_fa.md) · **Bahasa Indonesia** · [Italiano](README_it.md)
-· [Ελληνικά](README_el.md) · [മലയാളം](README_ml.md) · [Roman Urdu](README_ur-Latn.md)
+· [Ελληνικά](README_el.md) · [മലയാളം](README_ml.md) · [Roman Urdu](README_ur-Latn.md) · [Română](README_ro.md)

 # REA: Rekayasa Balik Apa Pun

@@ -20,7 +20,7 @@

 **[Situs Web](https://rea.tools/id/) · [Panduan](https://rea.tools/id/guides/) · [Contoh Penggunaan](https://rea.tools/id/showcase/)**

-[Mulai Cepat](#mulai-cepat) · [Cara Kerja REA](#cara-kerja-rea) · [Hal yang Dapat Anda Analisis](#hal-yang-dapat-anda-analisis) · [Contoh Penggunaan](#contoh-penggunaan) · [FAQ](#faq) · [Alat GNU objdump dan Rizin](../reverse-engineering-tools.md) · [Dokumentasi](#dokumentasi)
+[Mulai Cepat](#mulai-cepat) · [Cara Kerja REA](#cara-kerja-rea) · [Hal yang Dapat Anda Analisis](#hal-yang-dapat-anda-analisis) · [Contoh Penggunaan](#contoh-penggunaan) · [Membangun lingkungan RL](#build-rl-environments) · [FAQ](#faq) · [Alat GNU objdump dan Rizin](../reverse-engineering-tools.md) · [Dokumentasi](#dokumentasi)

 <code>npx rea-agents setup</code>

@@ -162,6 +162,7 @@ Alat tambahan dan dukungan sistem host bergantung pada target yang dianalisis:
 | Rust binaries              | Embedded cargo-auditable dependency list                                                              | [Rust binaries](../rust-binaries.md)                                                                                           |
 | ELF notes                  | PT_NOTE/SHT_NOTE owners, types, GNU build-id and ABI-tag fields                                       | Built-in static ELF inspection; [ELF notes](../elf-notes.md)                                                                   |
 | Apple IPS crashes          | .ips metadata, threads, images, registers and crash classes                                           | Built-in static JSON inspection; [Apple IPS](../apple-ips.md)                                                                  |
+| Linux kernel modules       | .modinfo keys, __versions CRCs, this_module presence, and signature trailer                           | Built-in static ELF inspection; [kernel modules](../kernel-modules.md)                                                         |
 | Erlang BEAM                | IFF chunks, atoms, exports, and tables                                                                | Built-in static BEAM inspection; [Erlang BEAM](../erlang-beam.md)                                                              |
 | Crash Linux yang direkam   | Catatan mentah, register/sinyal setiap thread yang direkam, dan kandidat pemetaan opsional            | pwntools yang disediakan pemanggil; GDB/pwndbg opsional; [crash yang direkam](../recorded-crashes.md)                          |
 | Instalasi desktop          | Kandidat runtime, berkas pendukung, penanda komponen, dan langkah berikutnya                          | Pemeriksaan direktori dan header terbatas；[Aplikasi desktop](../desktop-applications.md)                                      |
@@ -230,8 +231,51 @@ Periksa instruksi 16-bit dari gim PC-98 asli, pulihkan perhitungan sudut tetap d

 [Baca studi kasus](https://rea.tools/id/showcase/th04/) · [Repositori rekonstruksi](https://github.com/N0zoM1z0/th04)

+### Bangun lingkungan RL dengan REA
+
+Rekam sesi aplikasi web, ubah API menjadi alat, lalu ekspor lingkungan yang dapat digunakan agen AI. Jalankan dengan AgentEnv dan tambahkan tugas serta pemeriksaan reward untuk pelatihan RL atau evaluasi.
+
+[Panduan membangun lingkungan](https://rea.tools/guides/rl-environments/) ·
+[Tonton demo di X](https://x.com/reatools/status/2112574822584918075?s=20)
+
 Jika Anda telah menggunakan REA untuk menganalisis sesuatu yang menarik, kami ingin melihat hasilnya. Bagikan kasus Anda melalui [issue](https://github.com/morluto/rea/issues) atau [pull request](https://github.com/morluto/rea/pulls), sertakan target, pertanyaan Anda, bagaimana REA membantu, dan apa yang Anda temukan.

+<a id="build-rl-environments"></a>
+
+## Membangun lingkungan RL
+
+Buat lingkungan lokal agar agen AI dapat berlatih tugas seperti mencari issue atau membuat folder tanpa menjalankan aplikasi aslinya. Gunakan untuk pembelajaran penguatan (RL) atau menguji kemampuan agen menyelesaikan tugas.
+
+REA mengubah permintaan dan respons API yang direkam menjadi alat yang dapat dipanggil agen. Lingkungan memakai data rekaman dan hanya mendukung perubahan yang dampaknya dikonfirmasi oleh rekaman.
+
+Setelah menyiapkan REA di agen, ganti URL contoh dan tugas folder di bawah sesuai aplikasi Anda:
+
+```text
+Gunakan REA untuk membuat lingkungan RL dari aplikasi web uji saya di
+http://127.0.0.1:3000.
+Cakup daftar, pembuatan, penggantian nama, dan penghapusan folder. Boleh membuat
+dan menghapus folder uji, tetapi jangan ubah data yang sudah ada.
+Simpan dalam folder bernama my-env, periksa operasi yang berfungsi, dan beri tahu cara menjalankannya.
+```
+
+<details>
+<summary>Gunakan baris perintah</summary>
+
+Gunakan perintah ini jika Anda sudah punya file rekaman permintaan dan respons aplikasi di browser. Untuk menjalankan hasilnya, Anda juga perlu AgentEnv dan Docker.
+
+```sh
+rea environment-build ./session.har ./my-env --name my-env --json
+agent-env run ./my-env
+```
+
+</details>
+
+REA mengekspor lingkungan yang dapat dijalankan dengan uji dasar untuk memeriksa bahwa lingkungan mulai dan merespons. Hubungkan ke framework RL untuk menetapkan tujuan tugas, menambahkan pemeriksaan reward, dan menjalankan pelatihan.
+
+[Panduan membangun lingkungan](https://rea.tools/guides/rl-environments/) ·
+[Referensi lingkungan](../agent-environments.md) ·
+[Tonton demo di X](https://x.com/reatools/status/2112574822584918075?s=20)
+
 ## FAQ

 <details>
@@ -1,7 +1,7 @@
 <div align="center">

 [English](../../README.md) · [简体中文](README_zh.md) · [繁體中文](README_zh-TW.md) · [日本語](README_ja.md) · [한국어](README_ko.md) · [Türkçe](README_tr.md) · [Русский](README_ru.md) · [Tiếng Việt](README_vi.md) · [ไทย](README_th.md) · [Deutsch](README_de.md) · [Español](README_es.md) · [Français](README_fr.md) · [Українська](README_uk.md) · [Polski](README_pl.md) · [Português (Brasil)](README_pt-BR.md) · [العربية](README_ar.md) · [فارسی](README_fa.md) · [Bahasa Indonesia](README_id.md) · **Italiano**
-· [Ελληνικά](README_el.md) · [മലയാളം](README_ml.md) · [Roman Urdu](README_ur-Latn.md)
+· [Ελληνικά](README_el.md) · [മലയാളം](README_ml.md) · [Roman Urdu](README_ur-Latn.md) · [Română](README_ro.md)

 # REA: Reverse Engineer Anything

@@ -20,7 +20,7 @@

 **[Sito web](https://rea.tools/it/) · [Guide](https://rea.tools/it/guides/) · [Showcase](https://rea.tools/it/showcase/)**

-[Avvio rapido](#avvio-rapido) · [Come funziona REA](#come-funziona-rea) · [Cosa puoi analizzare](#cosa-puoi-analizzare) · [Showcase](#showcase) · [FAQ](#faq) · [Strumenti GNU objdump e Rizin](../reverse-engineering-tools.md) · [Documentazione](#documentazione)
+[Avvio rapido](#avvio-rapido) · [Come funziona REA](#come-funziona-rea) · [Cosa puoi analizzare](#cosa-puoi-analizzare) · [Showcase](#showcase) · [Creare ambienti RL](#build-rl-environments) · [FAQ](#faq) · [Strumenti GNU objdump e Rizin](../reverse-engineering-tools.md) · [Documentazione](#documentazione)

 <code>npx rea-agents setup</code>

@@ -158,6 +158,7 @@ REA richiede Node.js 22.x (>=22.23.4), 24.x (>=24.22.1) o 26+ (>=26.12.1), oltre
 | Bytecode EVM                 | Selettori di dispatch, offset dei byte, argomenti inferiti e mutabilità                                 | Carrier raw/hex locale; [guida EVM offline](../evm-bytecode.md)                                                                          |
 | Rust binaries                | Embedded cargo-auditable dependency list                                                                | [Rust binaries](../rust-binaries.md)                                                                                                     |
 | ELF notes                    | PT_NOTE/SHT_NOTE owners, types, GNU build-id and ABI-tag fields                                         | Built-in static ELF inspection; [ELF notes](../elf-notes.md)                                                                             |
+| Linux kernel modules         | .modinfo keys, __versions CRCs, this_module presence, and signature trailer                             | Built-in static ELF inspection; [kernel modules](../kernel-modules.md)                                                                   |
 | Erlang BEAM                  | IFF chunks, atoms, exports, and tables                                                                  | Built-in static BEAM inspection; [Erlang BEAM](../erlang-beam.md)                                                                        |
 | Apple IPS crashes            | .ips metadata, threads, images, registers and crash classes                                             | Built-in static JSON inspection; [Apple IPS](../apple-ips.md)                                                                            |
 | Crash Linux registrati       | Note grezze, registri/segnai di ogni thread registrato e candidati mapping opzionali                    | pwntools fornito dal chiamante; GDB/pwndbg opzionale; [crash registrati](../recorded-crashes.md)                                         |
@@ -219,8 +220,51 @@ Ispeziona le istruzioni a 16 bit del gioco PC-98 originale, recupera i calcoli d

 [Leggi il case study](https://rea.tools/it/showcase/th04/) · [Repository di ricostruzione](https://github.com/N0zoM1z0/th04)

+### Creare ambienti RL con REA
+
+Registra una sessione di un’app web, trasforma la sua API in strumenti ed esporta un ambiente utilizzabile da un agente IA. Eseguilo con AgentEnv, poi aggiungi attività e controlli sulle ricompense per l’addestramento RL o la valutazione.
+
+[Guida alla creazione di un ambiente](https://rea.tools/guides/rl-environments/) ·
+[Guarda la demo su X](https://x.com/reatools/status/2112574822584918075?s=20)
+
 Se hai usato REA su qualcosa di interessante, ci piacerebbe vederlo. Condividi il tuo caso in una [issue](https://github.com/morluto/rea/issues) o in una [pull request](https://github.com/morluto/rea/pulls), includendo il bersaglio, la tua domanda, come REA ti ha aiutato e cosa hai scoperto.

+<a id="build-rl-environments"></a>
+
+## Creare ambienti RL
+
+Crea un ambiente locale in cui un agente IA possa esercitarsi in attività come cercare una issue o creare una cartella, senza eseguire l’app originale. Usalo per l’apprendimento per rinforzo (RL) o per verificare come l’agente completa le attività.
+
+REA trasforma le richieste e le risposte API registrate in strumenti che l’agente può chiamare. L’ambiente usa i dati registrati e supporta modifiche solo quando la registrazione ne conferma gli effetti.
+
+Configura REA nel tuo agente, poi sostituisci l’URL e le attività sulle cartelle dell’esempio con i tuoi:
+
+```text
+Usa REA per creare un ambiente RL dalla mia app web di prova su
+http://127.0.0.1:3000.
+Includi elenco, creazione, rinomina ed eliminazione delle cartelle. Puoi creare
+e rimuovere cartelle di prova, ma non modificare i dati esistenti.
+Salvalo in una cartella chiamata my-env, verifica le operazioni disponibili e spiegami come eseguirlo.
+```
+
+<details>
+<summary>Usare la riga di comando</summary>
+
+Usa questi comandi se hai già un file con le richieste e le risposte dell’app registrate nel browser. Per eseguire il risultato servono anche AgentEnv e Docker.
+
+```sh
+rea environment-build ./session.har ./my-env --name my-env --json
+agent-env run ./my-env
+```
+
+</details>
+
+REA esporta un ambiente eseguibile con un test di base che ne verifica l’avvio e le risposte. Usalo con il tuo framework RL per definire gli obiettivi, aggiungere controlli sulle ricompense ed eseguire l’addestramento.
+
+[Guida alla creazione di un ambiente](https://rea.tools/guides/rl-environments/) ·
+[Riferimento degli ambienti](../agent-environments.md) ·
+[Guarda la demo su X](https://x.com/reatools/status/2112574822584918075?s=20)
+
 ## FAQ

 <details>
@@ -1,7 +1,7 @@
 <div align="center">

 [English](../../README.md) · [简体中文](README_zh.md) · [繁體中文](README_zh-TW.md) · **日本語** · [한국어](README_ko.md) · [Türkçe](README_tr.md) · [Русский](README_ru.md) · [Tiếng Việt](README_vi.md) · [ไทย](README_th.md) · [Deutsch](README_de.md) · [Español](README_es.md) · [Français](README_fr.md) · [Українська](README_uk.md) · [Polski](README_pl.md) · [Português (Brasil)](README_pt-BR.md) · [العربية](README_ar.md) · [فارسی](README_fa.md) · [Bahasa Indonesia](README_id.md) · [Italiano](README_it.md)
-· [Ελληνικά](README_el.md) · [മലയാളം](README_ml.md) · [Roman Urdu](README_ur-Latn.md)
+· [Ελληνικά](README_el.md) · [മലയാളം](README_ml.md) · [Roman Urdu](README_ur-Latn.md) · [Română](README_ro.md)

 # REA：あらゆるものをリバースエンジニアリング

@@ -20,7 +20,7 @@

 **[ウェブサイト](https://rea.tools/ja/) · [ガイド](https://rea.tools/ja/guides/) · [事例](https://rea.tools/ja/showcase/)**

-[クイックスタート](#クイックスタート) · [REA の仕組み](#rea-の仕組み) · [分析できる対象](#分析できる対象) · [事例](#事例) · [よくある質問](#よくある質問) · [GNU objdump・Rizin ツール](../reverse-engineering-tools.md) · [ドキュメント](#ドキュメント)
+[クイックスタート](#クイックスタート) · [REA の仕組み](#rea-の仕組み) · [分析できる対象](#分析できる対象) · [事例](#事例) · [RL 環境を構築する](#build-rl-environments) · [よくある質問](#よくある質問) · [GNU objdump・Rizin ツール](../reverse-engineering-tools.md) · [ドキュメント](#ドキュメント)

 <code>npx rea-agents setup</code>

@@ -159,6 +159,7 @@ REA には Node.js 22.x（>=22.23.4）、24.x（>=24.22.1）、または 26+ (>=
 | Rust binaries                    | Embedded cargo-auditable dependency list                                                    | [Rust binaries](../rust-binaries.md)                                                                                                           |
 | ELF notes                        | PT_NOTE/SHT_NOTE owners, types, GNU build-id and ABI-tag fields                             | Built-in static ELF inspection; [ELF notes](../elf-notes.md)                                                                                   |
 | Apple IPS crashes                | .ips metadata, threads, images, registers and crash classes                                 | Built-in static JSON inspection; [Apple IPS](../apple-ips.md)                                                                                  |
+| Linux kernel modules             | .modinfo keys, __versions CRCs, this_module presence, and signature trailer                 | Built-in static ELF inspection; [kernel modules](../kernel-modules.md)                                                                         |
 | Erlang BEAM                      | IFF chunks, atoms, exports, and tables                                                      | Built-in static BEAM inspection; [Erlang BEAM](../erlang-beam.md)                                                                              |
 | 記録済みの Linux クラッシュ      | 生の note レコード、記録された全スレッドのレジスター／シグナル、任意のマッピング候補        | Linux x64 で利用者が用意する pwntools；GDB/pwndbg は任意；[記録済みクラッシュ](../recorded-crashes.md)                                         |
 | デスクトップのインストール先     | ランタイム候補、根拠ファイル、コンポーネントの目印、次の調査手順                            | 上限付きのディレクトリ・ヘッダー検査；[デスクトップアプリ](../desktop-applications.md)                                                         |
@@ -224,8 +225,51 @@ REA には Node.js 22.x（>=22.23.4）、24.x（>=24.22.1）、または 26+ (>=
 [事例を読む](https://rea.tools/ja/showcase/th04/) ·
 [再構築リポジトリ](https://github.com/N0zoM1z0/th04)

+### REA で RL 環境を構築する
+
+Web アプリのセッションを記録し、API をツールに変換して、AI エージェントが使える環境をエクスポートします。AgentEnv で実行し、タスクと報酬のチェックを追加して、RL の学習や評価に使えます。
+
+[環境構築ガイド](https://rea.tools/guides/rl-environments/) ·
+[X でデモを見る](https://x.com/reatools/status/2112574822584918075?s=20)
+
 REA で興味深い対象を調べたら、ぜひ共有してください。[issue](https://github.com/morluto/rea/issues) または [pull request](https://github.com/morluto/rea/pulls) に、対象、調べたかったこと、REA がどう役立ったか、何が分かったかを記載してください。

+<a id="build-rl-environments"></a>
+
+## RL 環境を構築する
+
+元のアプリを動かさずに、AI エージェントが issue の検索やフォルダーの作成などを練習できるローカル環境を構築します。強化学習（RL）や、エージェントのタスク遂行能力のテストに使えます。
+
+REA は記録した API のリクエストと応答を、エージェントが呼び出せるツールに変換します。環境は記録したデータを使い、記録で効果が確認された変更だけをサポートします。
+
+エージェントに REA を設定したら、次の URL とフォルダー操作を自分の環境に合わせて変更してください。
+
+```text
+REA を使い、次のテスト用 Web アプリから RL 環境を構築してください。
+http://127.0.0.1:3000
+フォルダーの一覧表示、作成、名前変更、削除を対象にしてください。
+テスト用フォルダーの作成と削除は許可します。既存のデータは変更しないでください。
+my-env というフォルダーに保存し、使える操作を確認して実行方法を教えてください。
+```
+
+<details>
+<summary>コマンドラインを使う場合</summary>
+
+アプリのブラウザーリクエストと応答を記録したファイルがあれば、このコマンドを使えます。作成した環境の実行には AgentEnv と Docker も必要です。
+
+```sh
+rea environment-build ./session.har ./my-env --name my-env --json
+agent-env run ./my-env
+```
+
+</details>
+
+REA は実行可能な環境と、起動して応答することを確認する基本テストをエクスポートします。RL フレームワークに接続して、タスクの目標や報酬のチェックを定義し、学習を実行できます。
+
+[環境構築ガイド](https://rea.tools/guides/rl-environments/) ·
+[環境リファレンス](../agent-environments.md) ·
+[X でデモを見る](https://x.com/reatools/status/2112574822584918075?s=20)
+
 ## よくある質問

 <details>
@@ -324,9 +368,7 @@ REA の利用、バグ報告、機能の要望、ビルドのテスト、修正

 REA は、法令に従った研究、教育、相互運用性の確保、ソフトウェアの保存、および所有するソフトウェアや調査を許可されたソフトウェアの解析を目的としています。

-The project's position on illegal or unauthorized use covers all REA
-versions, distribution channels, and platforms; each copy retains its
-applicable licenses.
+違法または無許可の利用に関するプロジェクトの立場は、REA のすべてのバージョン、配布チャネル、およびプラットフォームに適用されます。各コピーには、それぞれに適用されるライセンスが引き続き適用されます。

 ## 貢献する

@@ -338,14 +380,6 @@ REA への貢献を歓迎します！[issue を作成](https://github.com/morlut

 [MIT](../../LICENSE)

-REA-authored code is licensed under MIT. Third-party material retains its own
-licenses and copyright notices; see [Third-party notices](../../THIRD_PARTY_NOTICES.md)
-for the dependency inventory, preserved license texts, and external-tool terms.
+REA が作成したコードは MIT ライセンスの下で提供されます。サードパーティの素材には、それぞれのライセンスと著作権表示が引き続き適用されます。依存関係の一覧、保存されたライセンス本文、および外部ツールの利用条件については、[サードパーティ通知](../../THIRD_PARTY_NOTICES.md)を参照してください。

-**You must legally obtain and be authorized to use commercial tools**, including
-IDA Pro / Hex-Rays decompilers, Hopper, and JEB, under their applicable licenses.
-REA grants no tool license, key, or activation entitlement. Trials and demos
-remain subject to vendor terms, including user, feature, automation, and output
-sharing restrictions. Cracked copies, stolen keys, unauthorized key sharing,
-and bypassing license restrictions are not authorized. This guidance does not
-amend MIT or third-party licenses.
+**IDA Pro / Hex-Rays デコンパイラ、Hopper、JEB を含む商用ツールは、適用されるライセンスに従って合法的に入手し、使用する権限を得ている必要があります。** REA はツールのライセンス、キー、またはアクティベーションの権利を一切付与しません。試用版やデモ版も、ユーザー、機能、自動化、および出力の共有に関する制限を含め、ベンダーの利用条件に従います。クラックされたコピー、盗まれたキー、無許可のキー共有、およびライセンス制限の回避は認められていません。このガイダンスは、MIT ライセンスやサードパーティのライセンスを変更するものではありません。
@@ -1,7 +1,7 @@
 <div align="center">

 [English](../../README.md) · [简体中文](README_zh.md) · [繁體中文](README_zh-TW.md) · [日本語](README_ja.md) · **한국어** · [Türkçe](README_tr.md) · [Русский](README_ru.md) · [Tiếng Việt](README_vi.md) · [ไทย](README_th.md) · [Deutsch](README_de.md) · [Español](README_es.md) · [Français](README_fr.md) · [Українська](README_uk.md) · [Polski](README_pl.md) · [Português (Brasil)](README_pt-BR.md) · [العربية](README_ar.md) · [فارسی](README_fa.md) · [Bahasa Indonesia](README_id.md) · [Italiano](README_it.md)
-· [Ελληνικά](README_el.md) · [മലയാളം](README_ml.md) · [Roman Urdu](README_ur-Latn.md)
+· [Ελληνικά](README_el.md) · [മലയാളം](README_ml.md) · [Roman Urdu](README_ur-Latn.md) · [Română](README_ro.md)

 # REA: 무엇이든 리버스 엔지니어링

@@ -20,7 +20,7 @@

 **[웹사이트](https://rea.tools/ko/) · [가이드](https://rea.tools/ko/guides/) · [사례](https://rea.tools/ko/showcase/)**

-[빠른 시작](#빠른-시작) · [REA의 작동 방식](#rea의-작동-방식) · [분석할 수 있는 대상](#분석할-수-있는-대상) · [사례](#사례) · [자주 묻는 질문](#자주-묻는-질문) · [문서](#문서)
+[빠른 시작](#빠른-시작) · [REA의 작동 방식](#rea의-작동-방식) · [분석할 수 있는 대상](#분석할-수-있는-대상) · [사례](#사례) · [RL 환경 만들기](#build-rl-environments) · [자주 묻는 질문](#자주-묻는-질문) · [문서](#문서)

 <code>npx rea-agents setup</code>

@@ -159,6 +159,7 @@ REA에는 Node.js 22.x(>=22.23.4), 24.x(>=24.22.1) 또는 26+ (>=26.12.1)와 npm
 | PE imports             | Import and delay-load DLL names, ordinals, IAT RVAs and pefile import hash    | Built-in static PE inspection; [PE imports](../pe-imports.md)                                                                     |
 | ELF notes              | PT_NOTE/SHT_NOTE owners, types, GNU build-id and ABI-tag fields               | Built-in static ELF inspection; [ELF notes](../elf-notes.md)                                                                      |
 | Apple IPS crashes      | .ips metadata, threads, images, registers and crash classes                   | Built-in static JSON inspection; [Apple IPS](../apple-ips.md)                                                                     |
+| Linux kernel modules   | .modinfo keys, __versions CRCs, this_module presence, and signature trailer   | Built-in static ELF inspection; [kernel modules](../kernel-modules.md)                                                            |
 | Erlang BEAM            | IFF chunks, atoms, exports, and tables                                        | Built-in static BEAM inspection; [Erlang BEAM](../erlang-beam.md)                                                                 |
 | WASM 아티팩트          | 유효성 검사, 섹션, import/export의 정확한 WAT 형식, 디코딩된 WAT              | 호출자 제공 WABT 1.0.42; `inspect_wasm_artifact`                                                                                  |
 | EVM 바이트코드         | 디스패치 선택자, 바이트 오프셋, 추론한 인자와 상태 변경 가능 여부             | Linux x64의 로컬 원시 바이트/16진수 입력 파일; [오프라인 EVM 가이드](../evm-bytecode.md)                                          |
@@ -224,8 +225,51 @@ REA에는 Node.js 22.x(>=22.23.4), 24.x(>=24.22.1) 또는 26+ (>=26.12.1)와 npm
 [사례 읽기](https://rea.tools/ko/showcase/th04/) ·
 [재구현 저장소](https://github.com/N0zoM1z0/th04)

+### REA로 RL 환경 만들기
+
+웹 앱 세션을 기록하고 API를 도구로 바꿔 AI 에이전트가 사용할 수 있는 환경을 내보냅니다. AgentEnv로 실행한 뒤 작업과 보상 검사를 추가해 RL 학습이나 평가에 사용하세요.
+
+[환경 만들기 가이드](https://rea.tools/guides/rl-environments/) ·
+[X에서 데모 보기](https://x.com/reatools/status/2112574822584918075?s=20)
+
 REA로 흥미로운 대상을 분석했다면 알려 주세요. [issue](https://github.com/morluto/rea/issues) 또는 [pull request](https://github.com/morluto/rea/pulls)에 대상, 조사하려던 질문, REA가 어떻게 도움이 되었는지, 무엇을 알아냈는지를 담아 공유하세요.

+<a id="build-rl-environments"></a>
+
+## RL 환경 만들기
+
+원래 앱을 실행하지 않고도 AI 에이전트가 이슈 찾기나 폴더 만들기 같은 작업을 연습할 수 있는 로컬 환경을 만듭니다. 강화 학습(RL)이나 에이전트의 작업 수행 능력 평가에 사용할 수 있습니다.
+
+REA는 기록한 API 요청과 응답을 에이전트가 호출할 수 있는 도구로 바꿉니다. 환경은 기록된 데이터를 사용하며, 기록에서 효과가 확인된 변경만 지원합니다.
+
+에이전트에 REA를 설정한 뒤 아래 예시 URL과 폴더 작업을 자신의 환경에 맞게 바꾸세요.
+
+```text
+REA를 사용해 다음 테스트 웹 앱에서 RL 환경을 만들어 주세요.
+http://127.0.0.1:3000
+폴더 목록 조회, 생성, 이름 변경, 삭제를 포함해 주세요.
+테스트 폴더를 만들고 삭제해도 됩니다. 기존 데이터는 변경하지 마세요.
+my-env라는 폴더에 저장하고, 사용 가능한 작업을 확인한 뒤 실행 방법을 알려 주세요.
+```
+
+<details>
+<summary>명령줄을 사용하는 경우</summary>
+
+앱의 브라우저 요청과 응답을 기록한 파일이 이미 있으면 이 명령을 사용할 수 있습니다. 생성된 환경을 실행하려면 AgentEnv와 Docker도 필요합니다.
+
+```sh
+rea environment-build ./session.har ./my-env --name my-env --json
+agent-env run ./my-env
+```
+
+</details>
+
+REA는 실행 가능한 환경과 시작 및 응답 여부를 확인하는 기본 테스트를 내보냅니다. RL 프레임워크에 연결해 작업 목표와 보상 검사를 정의하고 학습을 실행할 수 있습니다.
+
+[환경 만들기 가이드](https://rea.tools/guides/rl-environments/) ·
+[환경 참조 문서](../agent-environments.md) ·
+[X에서 데모 보기](https://x.com/reatools/status/2112574822584918075?s=20)
+
 ## 자주 묻는 질문

 <details>
@@ -1,7 +1,7 @@
 <div align="center">

 [English](../../README.md) · [简体中文](README_zh.md) · [繁體中文](README_zh-TW.md) · [日本語](README_ja.md) · [한국어](README_ko.md) · [Türkçe](README_tr.md) · [Русский](README_ru.md) · [Tiếng Việt](README_vi.md) · [ไทย](README_th.md) · [Deutsch](README_de.md) · [Español](README_es.md) · [Français](README_fr.md) · [Українська](README_uk.md) · [Polski](README_pl.md) · [Português (Brasil)](README_pt-BR.md) · [العربية](README_ar.md) · [فارسی](README_fa.md) · [Bahasa Indonesia](README_id.md) · [Italiano](README_it.md)
-· [Ελληνικά](README_el.md) · **മലയാളം** · [Roman Urdu](README_ur-Latn.md)
+· [Ελληνικά](README_el.md) · **മലയാളം** · [Roman Urdu](README_ur-Latn.md) · [Română](README_ro.md)

 # REA: എന്തും Reverse Engineer ചെയ്യുക

@@ -20,7 +20,7 @@

 **[വെബ്സൈറ്റ്](https://rea.tools/) · [ഗൈഡുകൾ](https://rea.tools/guides/) · [ഉദാഹരണങ്ങൾ](https://rea.tools/showcase/)**

-[ദ്രുതാരംഭം](#ദ്രുതാരംഭം) · [REA എങ്ങനെ പ്രവർത്തിക്കുന്നു](#rea-എങ്ങനെ-പ്രവർത്തിക്കുന്നു) · [എന്തൊക്കെ വിശകലനം ചെയ്യാം](#എന്തൊക്കെ-വിശകലനം-ചെയ്യാം) · [ഉദാഹരണങ്ങൾ](#ഉദാഹരണങ്ങൾ) · [പതിവുചോദ്യങ്ങൾ](#പതിവുചോദ്യങ്ങൾ) · [ഡോക്യുമെന്റേഷൻ](#ഡോക്യുമെന്റേഷൻ)
+[ദ്രുതാരംഭം](#ദ്രുതാരംഭം) · [REA എങ്ങനെ പ്രവർത്തിക്കുന്നു](#rea-എങ്ങനെ-പ്രവർത്തിക്കുന്നു) · [എന്തൊക്കെ വിശകലനം ചെയ്യാം](#എന്തൊക്കെ-വിശകലനം-ചെയ്യാം) · [ഉദാഹരണങ്ങൾ](#ഉദാഹരണങ്ങൾ) · [RL പരിതസ്ഥിതികൾ നിർമ്മിക്കുക](#build-rl-environments) · [പതിവുചോദ്യങ്ങൾ](#പതിവുചോദ്യങ്ങൾ) · [ഡോക്യുമെന്റേഷൻ](#ഡോക്യുമെന്റേഷൻ)

 <code>npx rea-agents setup</code>

@@ -158,6 +158,7 @@ REA-യ്ക്ക് Node.js 22.x (>=22.23.4), 24.x (>=24.22.1), അല്ല
 | PE certificates        | Authenticode WIN_CERTIFICATE entries and PKCS#7 signer/X.509 identity fields                | Built-in static PE inspection; [PE certificates](../pe-certificates.md)                                                           |
 | PE imports             | Import and delay-load DLL names, ordinals, IAT RVAs and pefile import hash                  | Built-in static PE inspection; [PE imports](../pe-imports.md)                                                                     |
 | ELF notes              | PT_NOTE/SHT_NOTE owners, types, GNU build-id and ABI-tag fields                             | Built-in static ELF inspection; [ELF notes](../elf-notes.md)                                                                      |
+| Linux kernel modules   | .modinfo keys, __versions CRCs, this_module presence, and signature trailer                 | Built-in static ELF inspection; [kernel modules](../kernel-modules.md)                                                            |
 | Erlang BEAM            | IFF chunks, atoms, exports, and tables                                                      | Built-in static BEAM inspection; [Erlang BEAM](../erlang-beam.md)                                                                 |
 | WASM artifact          | Validation, sections, കൃത്യമായ import/export WAT രൂപങ്ങൾ, decoded WAT                            | Caller നൽകുന്ന WABT 1.0.42; `inspect_wasm_artifact`                                                                                 |
 | EVM bytecode           | Dispatch selectors, byte offsets, അനുമാനിച്ച arguments, mutability                             | Linux x64-ൽ local raw/hex carrier; [offline EVM guide](../evm-bytecode.md)                                                        |
@@ -228,8 +229,51 @@ Renderer-ന്റെ clipboard API കണ്ടെത്തി, അതിനെ
 [Case study വായിക്കുക](https://rea.tools/showcase/th04/) ·
 [പുനർനിർമ്മാണ repository](https://github.com/N0zoM1z0/th04)

+### REA ഉപയോഗിച്ച് RL പരിതസ്ഥിതികൾ നിർമ്മിക്കുക
+
+വെബ് ആപ്പ് സെഷൻ റെക്കോർഡ് ചെയ്ത് API ടൂളുകളാക്കി AI ഏജന്റിന് ഉപയോഗിക്കാവുന്ന പരിതസ്ഥിതി എക്‌സ്‌പോർട്ട് ചെയ്യുക. AgentEnv ഉപയോഗിച്ച് പ്രവർത്തിപ്പിച്ച ശേഷം RL പരിശീലനത്തിനോ മൂല്യനിർണയത്തിനോ ടാസ്‌ക്കുകളും റിവാർഡ് പരിശോധനകളും ചേർക്കുക.
+
+[പരിതസ്ഥിതി നിർമ്മാണ മാർഗ്ഗദർശി](https://rea.tools/guides/rl-environments/) ·
+[X-ൽ ഡെമോ കാണുക](https://x.com/reatools/status/2112574822584918075?s=20)
+
 REA ഉപയോഗിച്ച് നിങ്ങൾ രസകരമായ എന്തെങ്കിലും പരിശോധിച്ചിട്ടുണ്ടെങ്കിൽ അത് കാണാൻ ഞങ്ങൾ ആഗ്രഹിക്കുന്നു. പരിശോധിച്ച target, നിങ്ങളുടെ ചോദ്യം, REA എങ്ങനെ സഹായിച്ചു, നിങ്ങൾ കണ്ടെത്തിയത് എന്നിവ ഉൾപ്പെടുത്തി [issue](https://github.com/morluto/rea/issues) അല്ലെങ്കിൽ [pull request](https://github.com/morluto/rea/pulls) വഴി നിങ്ങളുടെ case പങ്കിടുക.

+<a id="build-rl-environments"></a>
+
+## RL പരിതസ്ഥിതികൾ നിർമ്മിക്കുക
+
+യഥാർഥ ആപ്പ് പ്രവർത്തിപ്പിക്കാതെ issue കണ്ടെത്തൽ, ഫോൾഡർ സൃഷ്ടിക്കൽ തുടങ്ങിയ ജോലികൾ AI ഏജന്റിന് പരിശീലിക്കാൻ ഒരു പ്രാദേശിക പരിതസ്ഥിതി നിർമ്മിക്കുക. റീഇൻഫോഴ്‌സ്‌മെന്റ് ലേണിംഗിനോ (RL) ഏജന്റ് ജോലികൾ എത്ര നന്നായി പൂർത്തിയാക്കുന്നു എന്ന് പരിശോധിക്കാനോ ഇത് ഉപയോഗിക്കാം.
+
+REA റെക്കോർഡ് ചെയ്ത API അഭ്യർത്ഥനകളും പ്രതികരണങ്ങളും ഏജന്റിന് വിളിക്കാവുന്ന ടൂളുകളാക്കുന്നു. പരിതസ്ഥിതി റെക്കോർഡ് ചെയ്ത ഡാറ്റ ഉപയോഗിക്കുന്നു. റെക്കോർഡ് ഫലം സ്ഥിരീകരിക്കുന്ന മാറ്റങ്ങൾ മാത്രമാണ് പിന്തുണയ്ക്കുന്നത്.
+
+ഏജന്റിൽ REA സജ്ജീകരിച്ച ശേഷം ഉദാഹരണത്തിലെ URL-ഉം ഫോൾഡർ ജോലികളും നിങ്ങളുടെ ആപ്പിന് അനുസരിച്ച് മാറ്റുക:
+
+```text
+എന്റെ പരീക്ഷണ വെബ് ആപ്പിൽ നിന്ന് REA ഉപയോഗിച്ച് RL പരിതസ്ഥിതി നിർമ്മിക്കുക:
+http://127.0.0.1:3000
+ഫോൾഡറുകൾ പട്ടികപ്പെടുത്തൽ, സൃഷ്ടിക്കൽ, പേരുമാറ്റൽ, ഇല്ലാതാക്കൽ എന്നിവ ഉൾപ്പെടുത്തുക.
+പരീക്ഷണ ഫോൾഡറുകൾ സൃഷ്ടിക്കാനും നീക്കാനും അനുമതിയുണ്ട്. നിലവിലുള്ള ഡാറ്റ മാറ്റരുത്.
+my-env എന്ന ഫോൾഡറിൽ സംരക്ഷിച്ച് ഏതെല്ലാം പ്രവർത്തനങ്ങൾ ലഭ്യമാണെന്നും എങ്ങനെ പ്രവർത്തിപ്പിക്കണമെന്നും പറയുക.
+```
+
+<details>
+<summary>കമാൻഡ് ലൈൻ ഉപയോഗിക്കുക</summary>
+
+ബ്രൗസറിലെ ആപ്പിന്റെ അഭ്യർത്ഥനകളും പ്രതികരണങ്ങളും റെക്കോർഡ് ചെയ്ത ഫയൽ ഉണ്ടെങ്കിൽ ഈ കമാൻഡുകൾ ഉപയോഗിക്കാം. ഫലം പ്രവർത്തിപ്പിക്കാൻ AgentEnv-ഉം Docker-ഉം വേണം.
+
+```sh
+rea environment-build ./session.har ./my-env --name my-env --json
+agent-env run ./my-env
+```
+
+</details>
+
+പ്രവർത്തനം തുടങ്ങുന്നതും പ്രതികരിക്കുന്നതും പരിശോധിക്കുന്ന അടിസ്ഥാന ടെസ്റ്റിനൊപ്പം പ്രവർത്തിപ്പിക്കാവുന്ന പരിതസ്ഥിതി REA എക്‌സ്‌പോർട്ട് ചെയ്യുന്നു. ടാസ്‌ക് ലക്ഷ്യങ്ങളും റിവാർഡ് പരിശോധനകളും നിർവചിക്കാനും പരിശീലനം നടത്താനും RL ഫ്രെയിംവർക്കുമായി ബന്ധിപ്പിക്കുക.
+
+[പരിതസ്ഥിതി നിർമ്മാണ മാർഗ്ഗദർശി](https://rea.tools/guides/rl-environments/) ·
+[പരിതസ്ഥിതി റഫറൻസ്](../agent-environments.md) ·
+[X-ൽ ഡെമോ കാണുക](https://x.com/reatools/status/2112574822584918075?s=20)
+
 ## പതിവുചോദ്യങ്ങൾ

 <details>
@@ -1,7 +1,7 @@
 <div align="center">

 [English](../../README.md) · [简体中文](README_zh.md) · [繁體中文](README_zh-TW.md) · [日本語](README_ja.md) · [한국어](README_ko.md) · [Türkçe](README_tr.md) · [Русский](README_ru.md) · [Tiếng Việt](README_vi.md) · [ไทย](README_th.md) · [Deutsch](README_de.md) · [Español](README_es.md) · [Français](README_fr.md) · [Українська](README_uk.md) · **Polski** · [Português (Brasil)](README_pt-BR.md) · [العربية](README_ar.md) · [فارسی](README_fa.md) · [Bahasa Indonesia](README_id.md) · [Italiano](README_it.md)
-· [Ελληνικά](README_el.md) · [മലയാളം](README_ml.md) · [Roman Urdu](README_ur-Latn.md)
+· [Ελληνικά](README_el.md) · [മലയാളം](README_ml.md) · [Roman Urdu](README_ur-Latn.md) · [Română](README_ro.md)

 # REA: Reverse Engineer Anything

@@ -20,7 +20,7 @@

 **[Strona internetowa](https://rea.tools/pl/) · [Przewodniki](https://rea.tools/pl/guides/) · [Przykłady zastosowań](https://rea.tools/pl/showcase/)**

-[Szybki start](#szybki-start) · [Jak działa REA](#jak-działa-rea) · [Co możesz analizować](#co-możesz-analizować) · [Przykłady zastosowań](#przykłady-zastosowań) · [FAQ](#faq) · [Narzędzia GNU objdump i Rizin](../reverse-engineering-tools.md) · [Dokumentacja](#dokumentacja)
+[Szybki start](#szybki-start) · [Jak działa REA](#jak-działa-rea) · [Co możesz analizować](#co-możesz-analizować) · [Przykłady zastosowań](#przykłady-zastosowań) · [Tworzenie środowisk RL](#build-rl-environments) · [FAQ](#faq) · [Narzędzia GNU objdump i Rizin](../reverse-engineering-tools.md) · [Dokumentacja](#dokumentacja)

 <code>npx rea-agents setup</code>

@@ -158,6 +158,7 @@ REA wymaga Node.js 22.x (>=22.23.4), 24.x (>=24.22.1) lub 26+ (>=26.12.1) oraz n
 | Kod bajtowy EVM                         | Selektory wywołań, przesunięcia bajtowe, wywnioskowane argumenty i mutowalność                                        | Lokalny plik z surowymi bajtami lub zapisem szesnastkowym w systemie Linux x64; [przewodnik EVM offline](../evm-bytecode.md)                          |
 | Rust binaries                           | Embedded cargo-auditable dependency list                                                                              | [Rust binaries](../rust-binaries.md)                                                                                                                  |
 | ELF notes                               | PT_NOTE/SHT_NOTE owners, types, GNU build-id and ABI-tag fields                                                       | Built-in static ELF inspection; [ELF notes](../elf-notes.md)                                                                                          |
+| Linux kernel modules                    | .modinfo keys, __versions CRCs, this_module presence, and signature trailer                                           | Built-in static ELF inspection; [kernel modules](../kernel-modules.md)                                                                                |
 | Erlang BEAM                             | IFF chunks, atoms, exports, and tables                                                                                | Built-in static BEAM inspection; [Erlang BEAM](../erlang-beam.md)                                                                                     |
 | Apple IPS crashes                       | .ips metadata, threads, images, registers and crash classes                                                           | Built-in static JSON inspection; [Apple IPS](../apple-ips.md)                                                                                         |
 | Zarejestrowane awarie systemu Linux     | Surowe rekordy note, rejestry/sygnały każdego zarejestrowanego wątku i opcjonalni kandydaci na mapowania              | pwntools dostarczone przez użytkownika w systemie Linux x64; opcjonalnie GDB/pwndbg; [zarejestrowane awarie](../recorded-crashes.md)                  |
@@ -222,8 +223,51 @@ Sprawdź 16-bitowe instrukcje oryginalnej gry na PC-98, odtwórz obliczenia kąt

 [Przeczytaj studium przypadku](https://rea.tools/pl/showcase/th04/) · [Repozytorium odtworzonej implementacji](https://github.com/N0zoM1z0/th04)

+### Twórz środowiska RL z REA
+
+Nagraj sesję aplikacji internetowej, zamień jej API w narzędzia i wyeksportuj środowisko dla agenta AI. Uruchom je za pomocą AgentEnv, a następnie dodaj zadania i sprawdzanie nagród do treningu RL lub oceny.
+
+[Przewodnik tworzenia środowiska](https://rea.tools/guides/rl-environments/) ·
+[Obejrzyj demo w X](https://x.com/reatools/status/2112574822584918075?s=20)
+
 Jeśli użyłeś REA do czegoś ciekawego, chętnie to zobaczymy. Opisz swój przypadek w [zgłoszeniu](https://github.com/morluto/rea/issues) lub [pull requeście](https://github.com/morluto/rea/pulls), podając cel analizy, pytanie, sposób, w jaki REA pomogło, i swoje ustalenia.

+<a id="build-rl-environments"></a>
+
+## Tworzenie środowisk RL
+
+Stwórz lokalne środowisko, w którym agent AI może ćwiczyć zadania, takie jak wyszukiwanie zgłoszenia lub tworzenie folderu, bez uruchamiania oryginalnej aplikacji. Użyj go do uczenia ze wzmocnieniem (RL) lub sprawdzania, jak agent wykonuje zadania.
+
+REA zamienia nagrane żądania i odpowiedzi API w narzędzia, które agent może wywoływać. Środowisko używa nagranych danych i obsługuje zmiany tylko wtedy, gdy nagranie potwierdza ich efekty.
+
+Skonfiguruj REA w agencie, a następnie zastąp przykładowy URL i zadania dotyczące folderów własnymi:
+
+```text
+Za pomocą REA zbuduj środowisko RL z mojej testowej aplikacji internetowej:
+http://127.0.0.1:3000
+Uwzględnij wyświetlanie listy folderów, tworzenie, zmianę nazwy i usuwanie.
+Możesz tworzyć i usuwać foldery testowe. Nie zmieniaj istniejących danych.
+Zapisz w folderze my-env, sprawdź dostępne operacje i powiedz mi, jak uruchomić środowisko.
+```
+
+<details>
+<summary>Użyj wiersza poleceń</summary>
+
+Użyj tych poleceń, jeśli masz już plik z nagranymi żądaniami i odpowiedziami aplikacji w przeglądarce. Do uruchomienia wyniku potrzebujesz też AgentEnv i Dockera.
+
+```sh
+rea environment-build ./session.har ./my-env --name my-env --json
+agent-env run ./my-env
+```
+
+</details>
+
+REA eksportuje gotowe do uruchomienia środowisko z podstawowym testem uruchamiania i odpowiedzi. Połącz je ze swoim frameworkiem RL, aby określić cele zadań, dodać sprawdzanie nagród i uruchomić trening.
+
+[Przewodnik tworzenia środowiska](https://rea.tools/guides/rl-environments/) ·
+[Dokumentacja środowisk](../agent-environments.md) ·
+[Obejrzyj demo w X](https://x.com/reatools/status/2112574822584918075?s=20)
+
 ## FAQ

 <details>
@@ -1,7 +1,7 @@
 <div align="center">

 [English](../../README.md) · [简体中文](README_zh.md) · [繁體中文](README_zh-TW.md) · [日本語](README_ja.md) · [한국어](README_ko.md) · [Türkçe](README_tr.md) · [Русский](README_ru.md) · [Tiếng Việt](README_vi.md) · [ไทย](README_th.md) · [Deutsch](README_de.md) · [Español](README_es.md) · [Français](README_fr.md) · [Українська](README_uk.md) · [Polski](README_pl.md) · **Português (Brasil)** · [العربية](README_ar.md) · [فارسی](README_fa.md) · [Bahasa Indonesia](README_id.md) · [Italiano](README_it.md)
-· [Ελληνικά](README_el.md) · [മലയാളം](README_ml.md) · [Roman Urdu](README_ur-Latn.md)
+· [Ελληνικά](README_el.md) · [മലയാളം](README_ml.md) · [Roman Urdu](README_ur-Latn.md) · [Română](README_ro.md)

 # REA: Faça engenharia reversa de qualquer coisa

@@ -20,7 +20,7 @@

 **[Site](https://rea.tools/pt-BR/) · [Guias](https://rea.tools/pt-BR/guides/) · [Casos de uso](https://rea.tools/pt-BR/showcase/)**

-[Início rápido](#início-rápido) · [Como o REA funciona](#como-o-rea-funciona) · [O que você pode analisar](#o-que-você-pode-analisar) · [Casos de uso](#casos-de-uso) · [Perguntas frequentes](#perguntas-frequentes) · [Ferramentas GNU objdump e Rizin](../reverse-engineering-tools.md) · [Documentação](#documentação)
+[Início rápido](#início-rápido) · [Como o REA funciona](#como-o-rea-funciona) · [O que você pode analisar](#o-que-você-pode-analisar) · [Casos de uso](#casos-de-uso) · [Criar ambientes de RL](#build-rl-environments) · [Perguntas frequentes](#perguntas-frequentes) · [Ferramentas GNU objdump e Rizin](../reverse-engineering-tools.md) · [Documentação](#documentação)

 <code>npx rea-agents setup</code>

@@ -158,6 +158,7 @@ O REA requer Node.js 22.x (>=22.23.4), 24.x (>=24.22.1) ou 26+ (>=26.12.1), alé
 | Bytecode EVM                | Seletores de despacho, offsets de bytes, argumentos inferidos e mutabilidade                                            | Entrada local com bytes brutos ou representação hexadecimal no Linux x64; [guia de EVM sem execução](../evm-bytecode.md)                     |
 | Rust binaries               | Embedded cargo-auditable dependency list                                                                                | [Rust binaries](../rust-binaries.md)                                                                                                         |
 | ELF notes                   | PT_NOTE/SHT_NOTE owners, types, GNU build-id and ABI-tag fields                                                         | Built-in static ELF inspection; [ELF notes](../elf-notes.md)                                                                                 |
+| Linux kernel modules        | .modinfo keys, __versions CRCs, this_module presence, and signature trailer                                             | Built-in static ELF inspection; [kernel modules](../kernel-modules.md)                                                                       |
 | Erlang BEAM                 | IFF chunks, atoms, exports, and tables                                                                                  | Built-in static BEAM inspection; [Erlang BEAM](../erlang-beam.md)                                                                            |
 | Apple IPS crashes           | .ips metadata, threads, images, registers and crash classes                                                             | Built-in static JSON inspection; [Apple IPS](../apple-ips.md)                                                                                |
 | Falhas do Linux registradas | Registros note brutos, registradores/sinais de cada thread registrada e candidatos opcionais a mapeamentos              | pwntools fornecido pelo chamador no Linux x64; GDB/pwndbg opcionais; [falhas registradas](../recorded-crashes.md)                            |
@@ -222,8 +223,51 @@ Inspecione as instruções de 16 bits do jogo original para PC-98, recupere os c

 [Leia o estudo de caso](https://rea.tools/pt-BR/showcase/th04/) · [Repositório da reconstrução](https://github.com/N0zoM1z0/th04)

+### Criar ambientes de RL com o REA
+
+Grave uma sessão de aplicativo web, transforme sua API em ferramentas e exporte um ambiente que um agente de IA possa usar. Execute com o AgentEnv e adicione tarefas e verificações de recompensa para treinamento RL ou avaliação.
+
+[Guia para criar um ambiente](https://rea.tools/guides/rl-environments/) ·
+[Veja a demonstração no X](https://x.com/reatools/status/2112574822584918075?s=20)
+
 Se você usou o REA em algo interessante, gostaríamos de conhecer. Compartilhe seu caso em uma [issue](https://github.com/morluto/rea/issues) ou um [pull request](https://github.com/morluto/rea/pulls), incluindo o alvo, sua pergunta, como o REA ajudou e o que descobriu.

+<a id="build-rl-environments"></a>
+
+## Criar ambientes de RL
+
+Crie um ambiente local onde um agente de IA possa praticar tarefas como encontrar uma issue ou criar uma pasta, sem executar o aplicativo original. Use para aprendizado por reforço (RL) ou para testar como o agente conclui tarefas.
+
+O REA transforma requisições e respostas de API gravadas em ferramentas que o agente pode chamar. O ambiente usa os dados gravados e só aceita alterações cujos efeitos sejam confirmados pela gravação.
+
+Configure o REA no agente e substitua a URL e as tarefas de pastas do exemplo pelas suas:
+
+```text
+Use o REA para criar um ambiente de RL a partir do meu aplicativo web de teste em
+http://127.0.0.1:3000.
+Inclua listar, criar, renomear e excluir pastas. Pode criar e remover
+pastas de teste, mas não altere os dados existentes.
+Salve em uma pasta chamada my-env, verifique quais operações funcionam e diga como executar.
+```
+
+<details>
+<summary>Usar a linha de comando</summary>
+
+Use estes comandos se já tiver um arquivo com as requisições e respostas do aplicativo gravadas no navegador. Para executar o resultado, você também precisa do AgentEnv e do Docker.
+
+```sh
+rea environment-build ./session.har ./my-env --name my-env --json
+agent-env run ./my-env
+```
+
+</details>
+
+O REA exporta um ambiente executável com um teste básico para verificar se ele inicia e responde. Use com seu framework de RL para definir objetivos, adicionar verificações de recompensa e executar o treinamento.
+
+[Guia para criar um ambiente](https://rea.tools/guides/rl-environments/) ·
+[Referência de ambientes](../agent-environments.md) ·
+[Veja a demonstração no X](https://x.com/reatools/status/2112574822584918075?s=20)
+
 ## Perguntas frequentes

 <details>
@@ -0,0 +1,485 @@
+<div align="center">
+
+[English](../../README.md) · [简体中文](README_zh.md) · [繁體中文](README_zh-TW.md) · [日本語](README_ja.md) · [한국어](README_ko.md) · [Türkçe](README_tr.md) · [Русский](README_ru.md) · [Tiếng Việt](README_vi.md) · [ไทย](README_th.md) · [Deutsch](README_de.md) · [Español](README_es.md) · [Français](README_fr.md) · [Українська](README_uk.md) · [Polski](README_pl.md) · [Português (Brasil)](README_pt-BR.md) · [العربية](README_ar.md) · [فارسی](README_fa.md) · [Bahasa Indonesia](README_id.md) · [Italiano](README_it.md)
+· [Ελληνικά](README_el.md) · [മലയാളം](README_ml.md) · [Roman Urdu](README_ur-Latn.md) · **Română**
+
+# REA: Reverse Engineer Anything
+
+### Un singur server MCP pentru inginerie inversă: fișiere binare, aplicații și comportament în timpul execuției.
+
+**Ai găsit o funcționalitate care îți place? Înțelege cum funcționează, până la nivel de cod binar.**
+
+[![Versiunea npm](https://img.shields.io/npm/v/rea-agents?style=flat-square&color=cb3837)](https://www.npmjs.com/package/rea-agents)
+[![Catalogul uneltelor MCP](https://img.shields.io/badge/MCP-tool_catalog-5c4ee5?style=flat-square)](../mcp-contracts.md#generated-catalog)
+[![Cerințe Node.js](https://img.shields.io/badge/Node.js-requirements-339933?style=flat-square&logo=nodedotjs&logoColor=white)](#ce-poți-analiza)
+[![skills.sh](https://skills.sh/b/morluto/rea?style=flat-square)](https://skills.sh/morluto/rea/reverse-engineer-anything)
+[![Licența MIT](https://img.shields.io/badge/license-MIT-f4c430?style=flat-square)](../../LICENSE)
+[![Discord](https://img.shields.io/discord/1556595354999332884?logo=discord&logoColor=white&label=Discord&color=5865F2)](https://discord.gg/GkcryMnJDM)
+
+<a href="https://trendshift.io/repositories/82054?utm_source=repository-badge&amp;utm_medium=badge&amp;utm_campaign=badge-repository-82054" target="_blank" rel="noopener noreferrer"><img src="https://trendshift.io/api/badge/repositories/82054" alt="morluto%2Frea | Trendshift" width="250" height="55"/></a>
+
+**[Site web](https://rea.tools/) · [Ghiduri](https://rea.tools/guides/) · [Studii de caz](https://rea.tools/showcase/)**
+
+[Pornire rapidă](#pornire-rapidă) · [Cum funcționează REA](#cum-funcționează-rea) · [Ce poți analiza](#ce-poți-analiza) · [Studii de caz](#studii-de-caz) · [Construiește medii RL](#build-rl-environments) · [Întrebări frecvente](#întrebări-frecvente) · [Documentație](#documentație)
+
+<code>npx rea-agents setup</code>
+
+</div>
+
+> [!IMPORTANT]
+> Descarcă REA din [morluto/rea](https://github.com/morluto/rea),
+> de pe [rea.tools](https://rea.tools/) sau prin [pachetul npm rea-agents](https://www.npmjs.com/package/rea-agents).
+> Urmează linkurile de instalare și către versiunile publicate oferite de aceste surse oficiale.
+> Un nume de repository asemănător sau un README copiat nu dovedește că descărcarea provine dintr-o sursă oficială.
+
+<div align="center">
+
+<br />
+
+<img src="../assets/rea-hopper-analysis.png" alt="REA pornește componenta de legătură pentru analiză în Hopper în timp ce inspectează un fișier binar nativ" width="1200" />
+
+<br /><br />
+
+<table aria-label="Comunitatea REA">
+<tr>
+<td align="center" width="360">
+  <a href="https://discord.gg/GkcryMnJDM">
+    <img src="../assets/discord.svg" height="42" alt="Discord" /><br />
+    <strong>Alătură-te comunității de inginerie inversă</strong>
+  </a><br />
+  <sub>Discord · Întrebări și răspunsuri · Prezentări și demonstrații</sub>
+</td>
+</tr>
+</table>
+
+<br />
+
+</div>
+
+---
+
+Ai văzut într-o aplicație o funcționalitate pe care ai vrea să o incluzi în propriul produs? Cere-i agentului tău să o investigheze cu REA. Poate inspecta aplicația fără codul ei sursă, poate explica modul în care funcționează acea funcționalitate, poate prezenta dovezile și poate construi o variantă pentru proiectul tău.
+
+REA conectează agentul tău la unelte pentru inspectarea fișierelor binare native, a aplicațiilor JavaScript și Electron, a ansamblurilor .NET și a site-urilor web. Poți folosi aceleași unelte și din terminal. Analiza rulează local, iar rezultatele includ dovezile și limitările care stau la baza fiecărei concluzii.
+
+Programul de configurare înregistrează REA în agentul tău și instalează instrucțiunile corespunzătoare pentru fluxul de lucru. Analiza nativă poate folosi o instalare existentă de Hopper, Ghidra sau IDA; programul de configurare poate instala opțional Hopper, cu aprobarea ta. Analiza statică JavaScript nu necesită un motor de analiză nativă.
+
+> **[Vizitează site-ul REA](https://rea.tools/)** pentru instrucțiuni de configurare, ghiduri ilustrate și studii de caz reale.
+
+## Pornire rapidă
+
+Pe Linux, pornirea Ghidra, JADX și a uneltelor pentru firmware, precum și analiza
+statică JavaScript/Electron necesită un `ps` compatibil cu procps în `PATH`-ul REA,
+pentru a verifica dacă procesele îi aparțin. Pașii de remediere sunt în
+`docs/installation.md`, la secțiunea „Linux owned-process prerequisite”.
+
+### Configurează agentul
+
+Cu Node.js și npm instalate, rulează:
+
+```bash
+npx rea-agents setup
+```
+
+Alege agenții, verifică modificările propuse și aprobă-le. Configurarea adaugă
+serverul MCP REA și instrucțiunile corespunzătoare pentru fluxul de lucru,
+creând copii de siguranță ale configurației existente. Repornește apoi agentul.
+
+Programul de configurare acceptă Claude Code, Codex, Cursor, Gemini CLI, Grok Build și
+[alți agenți](../installation.md#supported-agents). Consultă
+[instalarea și configurarea](../installation.md) pentru configurarea motoarelor
+de analiză și înregistrarea manuală a serverului MCP.
+
+MCP folosește implicit scheme de intrare compacte, pentru a reduce spațiul ocupat
+în context. Setează `REA_MCP_INPUT_SCHEMA_PROFILE=full` în înregistrarea MCP când
+ai nevoie de îndrumările complete pentru câmpurile expuse și de detaliile
+validării structurilor imbricate. Ambele profiluri păstrează toate uneltele și
+validarea canonică a serverului. Consultă secțiunea „Compact input schema profile”
+din ghidul contractelor MCP.
+
+### Cere-i agentului
+
+```text
+Înțelege cum funcționează căutarea în aplicația Notes, arată-mi dovezile și
+construiește o funcționalitate similară pentru proiectul meu.
+```
+
+Înlocuiește Notes cu aplicația vizată și precizează funcționalitatea pe care vrei să o înțelegi.
+
+### Folosește terminalul
+
+Inspectează directorul extras al unei aplicații JavaScript/Electron sau o arhivă ASAR:
+
+```bash
+npx -y rea-agents@latest analyze-javascript-application /absolute/path/to/app --json
+```
+
+Rezultatul include modulele, importurile, delimitările dintre componentele Electron
+și dovezile aferente. Înlocuiește calea cu cea a aplicației vizate, de exemplu
+`"D:/apps/example"` pe Windows.
+
+Pentru a instala comanda `rea` și a o folosi în mod curent:
+
+```bash
+npm install --global rea-agents
+rea --help
+```
+
+Pentru analiza nativă, configurează mai întâi un motor de analiză. Consultă
+[ghidul CLI și Evidence](../cli.md) pentru comenzile de analiză nativă,
+selectarea motorului, instantanee și utilizarea în scripturi.
+
+### Actualizează REA
+
+REA evoluează rapid, iar versiunile noi includ frecvent corecții de erori.
+Menține instalarea la zi.
+
+Pentru o interfață CLI instalată cu `npm install --global` sau `bun add --global`:
+
+```bash
+rea update
+```
+
+`rea --update` este un alias pentru acest flux de actualizare verificat și acceptă
+aceleași opțiuni globale de ieșire. Folosește `rea update` când îl combini cu alte
+opțiuni de control al comenzii.
+
+Comenzile de actualizare păstrează cel mult 4 MiB în total din stdout și stderr.
+Răspunsurile cu metadate prea mari sunt respinse după încheierea comenzii;
+instalările cu ieșire detaliată continuă cu un volum limitat de date de diagnostic.
+Afișarea progresului în terminal ține cont de ritmul în care acesta poate primi
+date și așteaptă finalizarea operațiilor de scriere deja trimise.
+
+Actualizările instalărilor globale cu Bun necesită Bun 1.2.17 sau o versiune mai nouă.
+Dacă ai o versiune mai veche, actualizează Bun manual înainte de a rula `rea update`.
+
+Pentru a actualiza înregistrările agenților și skill-ul, rulează comanda de
+configurare afișată de programul de actualizare.
+
+Dacă folosești `npx`, actualizează configurarea agentului cu:
+
+```bash
+npx rea-agents@latest setup
+```
+
+Verifică modificările de configurare și repornește agentul. Pentru comenzi CLI
+ocazionale, folosește `npx rea-agents@latest` urmat de comandă. Cu Bun, folosește
+`bunx rea-agents@latest` în loc de `npx rea-agents@latest`.
+
+## Cum funcționează REA
+
+Agentul tău apelează REA prin MCP pentru a inspecta ținta și a urmări codul relevant.
+REA returnează constatările împreună cu dovezile aferente. Agentul le folosește
+pentru a pune întrebări suplimentare, a explica comportamentul sau a scrie și
+testa o implementare. Comenzile CLI folosesc aceleași fluxuri de lucru.
+
+![Fluxul unei investigații REA: agentul întreabă despre o țintă locală, REA o inspectează și îi urmărește comportamentul cu ajutorul uneltelor de analiză, iar agentul folosește codul, referințele și necunoscutele returnate pentru a explica, implementa și testa.](../../website/public/assets/figures/rea-investigation-flow.svg)
+
+[Deschide figura la dimensiunea originală](../../website/public/assets/figures/rea-investigation-flow.svg).
+
+<a id="current-status"></a>
+
+## Ce poți analiza
+
+REA necesită Node.js 22.x (>=22.23.4), 24.x (>=24.22.1) sau 26.12.1+, plus npm.
+Uneltele suplimentare și platformele acceptate depind de ținta analizată:
+
+| Țintă                               | Ce returnează REA                                                                                                             | Cerințe și ghid                                                                                                                        |
+| ----------------------------------- | ----------------------------------------------------------------------------------------------------------------------------- | -------------------------------------------------------------------------------------------------------------------------------------- |
+| Aplicații desktop instalate         | Componente de execuție candidate, fișiere auxiliare, indicii despre componente și următoarele verificări                      | Inspectare integrată a directoarelor și antetelor, cu limite de resurse; [aplicații desktop](../desktop-applications.md)               |
+| Fișiere binare native               | Pseudocod, cod de asamblare, șiruri de caractere, simboluri, apeluri și referințe                                             | Hopper, Ghidra sau IDA; [analiză nativă](../native-investigation.md)                                                                   |
+| Structura ELF, offline              | Secțiuni, segmente, simboluri și relocări originale, precum și indicii statice despre mecanismele de protecție                | pwntools furnizat de utilizator, pe Linux x64; [diagnosticarea binarelor](../binary-diagnostics.md)                                    |
+| Fișiere binare Go                   | Versiunea compilatorului încorporată în fișier, modulele, înlocuirile și setările de compilare                                | Inspectare statică integrată a fișierelor ELF/PE/Mach-O cu o singură arhitectură; nu necesită instalarea Go                            |
+| Obiecte de cod GPU                  | Ținte CUDA/HIP, parametri și resurse selectate ale kernelurilor GPU, textul PTX păstrat                                       | Inspectare statică integrată a fișierelor ELF/PE/fatbin/CUBIN/PTX; [obiecte de cod GPU](../gpu-code-objects.md)                        |
+| Fișiere de model                    | Metadate GGUF / safetensors, declarații de tensori și totaluri calculate din acestea                                          | Inspectare integrată a antetelor; opțional, hash al întregului fișier; [fișiere de model](../model-artifacts.md)                       |
+| Metadate IL2CPP                     | Imagini de ansambluri din global-metadata.dat al Unity, nume de tipuri și metode și intervale de indici                       | Decodare statică integrată a versiunilor 24, 27, 29, 31 și 39; nu necesită Unity                                                       |
+| Godot PCK                           | Inventarul și extragerea arhivei, informații originale din antet și director și identificatori ai conținutului selectat       | Suport static integrat pentru formatele 2, 3 și 4; nu necesită Godot                                                                   |
+| Fișiere binare Rust                 | Nume, versiuni, surse și relații de dependență ale pachetelor crate încorporate prin cargo-auditable                          | Inspectare statică integrată a fișierelor ELF/PE/Mach-O cu o singură arhitectură; [binare Rust](../rust-binaries.md)                   |
+| Certificate PE                      | Intrări Authenticode WIN_CERTIFICATE și câmpuri de identitate ale semnatarilor PKCS#7 și certificatelor X.509                 | Inspectare statică integrată a fișierelor PE; [certificate PE](../pe-certificates.md)                                                  |
+| Importuri PE                        | Numele DLL-urilor importate și încărcate întârziat, ordinale, RVA-uri ale IAT și hash-ul importurilor calculat de pefile      | Inspectare statică integrată a fișierelor PE; [importuri PE](../pe-imports.md)                                                         |
+| Note ELF                            | Proprietari și tipuri PT_NOTE/SHT_NOTE, câmpuri GNU build-id și ABI-tag                                                       | Inspectare statică integrată a fișierelor ELF; [note ELF](../elf-notes.md)                                                             |
+| Rapoarte Apple IPS de eroare fatală | Metadate .ips, fire de execuție, imagini binare, registre și clase documentate de erori fatale                                | Inspectare statică integrată a datelor JSON; [Apple IPS](../apple-ips.md)                                                              |
+| Module de kernel Linux              | Chei .modinfo, CRC-uri din __versions, prezența this_module și structura semnăturii de la sfârșitul fișierului                | Inspectare statică integrată a fișierelor ELF; [module de kernel](../kernel-modules.md)                                                |
+| Erlang BEAM                         | Blocuri IFF, atomi, exporturi, importuri, funcții lambda și antetul Code                                                      | Inspectare statică integrată a fișierelor BEAM; [Erlang BEAM](../erlang-beam.md)                                                       |
+| Fișiere WASM                        | Validare, secțiuni, forme WAT exacte ale importurilor și exporturilor și cod WAT decodat                                      | WABT 1.0.42 furnizat de utilizator; `inspect_wasm_artifact`                                                                            |
+| Bytecode EVM                        | Selectori de apel, poziții în octeți, argumente și mutabilitate deduse                                                        | Fișier local în format brut sau hexazecimal, pe Linux x64; [ghid EVM offline](../evm-bytecode.md)                                      |
+| Baze de date SQLite                 | Tabele, coloane, indecși, vizualizări, declanșatoare și rânduri selectate din tabele obișnuite                                | Instantaneu local al bazei de date/WAL; Node.js 24.x >=24.15 sau 26+, cu limite SQLite native                                          |
+| Erori fatale Linux înregistrate     | Note brute, registrele și semnalele fiecărui fir înregistrat și, opțional, corespondențe candidate pentru mapările de memorie | pwntools furnizat de utilizator, pe Linux x64; opțional GDB/pwndbg; [erori fatale înregistrate](../recorded-crashes.md)                |
+| JavaScript / Electron               | Module, importuri, hărți de cod sursă, rute, IPC și relații cu extensiile native                                              | Node.js și npm; pe Linux: `ps` compatibil cu procps; [analiza aplicațiilor](../javascript-application-workflows.md)                    |
+| Site-uri web                        | Structura paginilor, scripturi, observații de rețea și capturi de ecran solicitate                                            | Un browser din familia Chrome; [analiză în browser](../browser-observation.md)                                                         |
+| Capturi de rețea salvate            | Cereri, răspunsuri, conținuturi expuse ale mesajelor și pozițiile lor în sursă                                                | HAR sau SAZ din Fiddler Everywhere; mitmdump pe Linux pentru formatul nativ mitmproxy; [ghidul capturilor](../web-network-captures.md) |
+| Ansambluri .NET                     | Metadate, instrucțiuni CIL, dependențe native declarate și comparații între compilări                                         | Fără cerințe suplimentare (doar analiză statică); [ghidul codului gestionat](../managed-code-analysis.md)                              |
+| APK-uri Android                     | Declarații din manifest, clase, metode decompilate și referințe                                                               | JADX fără interfață grafică și un JDK complet, pe Linux/macOS/Windows x64; [ghidul Android](../android-analysis.md)                    |
+| Semnături APK                       | Semnatari v1/v2/v3/v3.1, amprente ale certificatelor, rotația cheilor și consistența internă a hash-urilor                    | Fără cerințe suplimentare (doar analiză statică); `inspect_apk_signature`                                                              |
+| Dispozitive Android                 | Dispozitive, pachete, procese, jurnale, dumpuri, capturi de ecran și transferuri de APK-uri și fișiere                        | adb furnizat de utilizator (emulator sau dispozitiv fizic); [ghidul ADB](../adb-device-analysis.md)                                    |
+| Proiecte JEB                        | Unități de proiect analizate prin motor, hash-uri ale artefactelor și pseudocod pentru tipuri și metode                       | Un client JEB pornit de utilizator, care oferă un server MCP și este selectat prin REA_JEB_MCP_URL; [ghidul JEB](../jeb-analysis.md)   |
+| Resurse Android                     | Manifest decodat, tabele de șiruri de caractere, localizări și informații despre versiune                                     | Program de lansare Apktool furnizat de utilizator; [ghidul resurselor](../apktool-resource-analysis.md)                                |
+| Aplicații Flutter                   | Hash-ul instantaneului Dart, hash-uri ale bibliotecilor pentru fiecare ABI și proveniența compilării motorului                | Fără cerințe suplimentare (parsare statică a APK-ului); [ghidul Flutter](../flutter-analysis.md)                                       |
+| Firmware                            | Regiuni, rezultate ale extragerii și transferul către analiza nativă                                                          | Binwalk / Unblob pe Linux; [ghidul firmware](../firmware-analysis.md)                                                                  |
+| Pachete de rețea înregistrate       | Câmpuri selectate, valori repetate, filtre și reguli decode-as                                                                | Linux: TShark 4.x + prlimit; [ghidul capturilor](../packet-captures.md)                                                                |
+| Rezumate ale traficului de rețea    | Puncte terminale, DNS, TLS SNI, distribuția protocoalelor și cereri HTTP                                                      | tshark și capinfos furnizate de utilizator (verificate pe Linux); [ghidul pcap](../pcap-analysis.md)                                   |
+| Semnale logice înregistrate         | Adnotări ale decodorului, intervale de eșantioane și date de diagnostic                                                       | Linux: sigrok-cli 0.7.2 + prlimit; [înregistrări de semnale](../signal-recordings.md)                                                  |
+| Pachete și resurse                  | Inventare de fișiere, hash-uri, fișiere plist, structura pachetelor de aplicație Apple și resurse extrase                     | [Ghidul artefactelor și JavaScript](../javascript-artifact-reconstruction.md), [aplicații Apple](../apple-application-analysis.md)     |
+| Comportamentul proceselor           | Ieșirea în terminal, interacțiuni, observații despre terminarea proceselor și sistemul de fișiere și comparații între rulări  | Linux/macOS cu un PTY nativ; [capturarea proceselor](../process-capture.md)                                                            |
+| Executabile PyInstaller             | Membri CArchive, versiunea Python, scripturi de intrare și bytecode extras                                                    | Fără cerințe suplimentare (doar analiză statică); [aplicații Python împachetate](../python-packaged-applications.md)                   |
+
+Inspectarea statică JavaScript și .NET citește fișierele furnizate fără a rula
+aplicația. Capturarea în timpul execuției rulează ținta selectată sau interacționează
+cu aceasta folosind permisiunile contului tău; fiecare ghid de capturare descrie
+efectele acestor operații.
+
+Pentru inspectarea offline a binarelor native, REA acceptă și GNU objdump și Rizin,
+furnizate de utilizator. Consultă [ghidul uneltelor de inginerie inversă](../reverse-engineering-tools.md)
+pentru configurare, comenzi CLI și limitările obiectelor Evidence. REA nu
+instalează și nu actualizează niciunul dintre aceste două instrumente.
+
+<a id="choosing-a-deep-analysis-provider"></a>
+
+Formatele native și platformele acceptate diferă în funcție de motorul de analiză.
+Consultă [configurarea Hopper și Ghidra](../installation.md#hopper),
+[ghidul IDA](../ida-provider.md) (inclusiv o componentă opțională de legătură MCP nativă),
+[ghidul decompilatorului Kuna](../kuna-provider.md) și
+[suportul experimental Ghidra pe Windows](../windows-ghidra-p0.md).
+Ghidra acceptă și [analiza DOS pe 16 biți](../ghidra-dos.md).
+Pentru binare mari, mărește timpul maxim de pornire al motorului cu
+`REA_GHIDRA_STARTUP_TIMEOUT_MS` sau `REA_HOPPER_STARTUP_TIMEOUT_MS`.
+Pentru selectarea motorului, consultă [ghidul CLI](../cli.md#choose-a-provider).
+Verifică [disponibilitatea în versiunile publicate](../installation.md#released-package-and-main)
+pentru funcționalitățile adăugate după cea mai recentă versiune npm.
+
+## Studii de caz
+
+<a href="https://rea.tools/showcase/">
+  <picture>
+    <source media="(prefers-color-scheme: dark)" srcset="../assets/rea-showcases-dark.svg" />
+    <img alt="Ilustrații pentru studiile de caz despre panoramarea sunetului în DX-Ball, legătura cu clipboardul în Notion și inelele de proiectile din TH04" src="../assets/rea-showcases.svg" />
+  </picture>
+</a>
+
+### DX-Ball: reconstruiește calculul panoramării sunetului
+
+Urmărește un apel audio până la funcția auxiliară care transformă poziția în
+panoramare stereo, inspectează instrucțiunile și transformă pseudocodul incomplet
+în C. Reconstrucția trece 3.205 cazuri de test comparate cu originalul x86 și
+reproduce toți cei 63 de octeți ai funcției compilate.
+
+[Citește studiul de caz](https://rea.tools/showcase/dx-ball/) ·
+[Repository-ul reconstrucției](https://github.com/N0zoM1z0/dx-ball)
+
+### Notion: urmărește legătura Electron cu clipboardul
+
+Găsește API-ul pentru clipboard din procesul de randare, urmărește-l prin preload
+și IPC până în procesul principal și inspectează formatul datelor cu formatare din clipboard.
+
+[Citește studiul de caz](https://rea.tools/showcase/notion/)
+
+### TH04: recuperează calculul unui inel de proiectile DOS
+
+Inspectează instrucțiunile pe 16 biți ale jocului original pentru PC-98,
+recuperează calculele unghiurilor fixe și ale celor orientate spre țintă și
+compară codul C++ reconstruit cu rezultatul compilatorului folosit la acea vreme.
+
+[Citește studiul de caz](https://rea.tools/showcase/th04/) ·
+[Repository-ul reconstrucției](https://github.com/N0zoM1z0/th04)
+
+### Construiește medii RL cu REA
+
+Înregistrează o sesiune de aplicație web, transformă API-ul în instrumente și exportă un mediu pe care un agent AI îl poate folosi. Rulează cu AgentEnv, apoi adaugă sarcini și verificări de recompensă pentru antrenare RL sau evaluare.
+
+[Ghid pentru construirea unui mediu](https://rea.tools/guides/rl-environments/) ·
+[Vezi demonstrația pe X](https://x.com/reatools/status/2112574822584918075?s=20)
+
+Dacă ai folosit REA pentru ceva interesant, ne-ar plăcea să vedem rezultatul.
+Prezintă cazul într-un [issue](https://github.com/morluto/rea/issues) sau într-un
+[pull request](https://github.com/morluto/rea/pulls), menționând ținta analizată,
+întrebarea ta, cum te-a ajutat REA și ce ai descoperit.
+
+<a id="build-rl-environments"></a>
+
+## Construiește medii RL
+
+Creează un mediu local în care un agent AI să exerseze sarcini precum găsirea unui issue sau crearea unui dosar, fără a rula aplicația originală. Folosește-l pentru învățare prin recompensă (RL) sau pentru a testa cât de bine îndeplinește agentul sarcinile.
+
+REA transformă cererile și răspunsurile API înregistrate în instrumente pe care agentul le poate apela. Mediul folosește datele înregistrate și permite modificări doar când înregistrarea le confirmă efectele.
+
+După ce configurezi REA în agent, înlocuiește URL-ul și sarcinile pentru dosare din exemplu cu ale tale:
+
+```text
+Folosește REA pentru a crea un mediu RL din aplicația mea web de test de la
+http://127.0.0.1:3000.
+Include listarea, crearea, redenumirea și ștergerea dosarelor. Poți crea și elimina
+dosare de test, dar nu modifica datele existente.
+Salvează într-un dosar numit my-env, verifică operațiile disponibile și spune-mi cum îl rulez.
+```
+
+<details>
+<summary>Folosește linia de comandă</summary>
+
+Folosește aceste comenzi dacă ai deja un fișier cu cererile și răspunsurile aplicației înregistrate în browser. Pentru a rula rezultatul ai nevoie și de AgentEnv și Docker.
+
+```sh
+rea environment-build ./session.har ./my-env --name my-env --json
+agent-env run ./my-env
+```
+
+</details>
+
+REA exportă un mediu executabil cu un test de bază care verifică pornirea și răspunsurile. Conectează-l la frameworkul RL pentru a defini obiectivele, a adăuga verificări de recompensă și a rula antrenarea.
+
+[Ghid pentru construirea unui mediu](https://rea.tools/guides/rl-environments/) ·
+[Referință pentru medii](../agent-environments.md) ·
+[Vezi demonstrația pe X](https://x.com/reatools/status/2112574822584918075?s=20)
+
+## Întrebări frecvente
+
+<details>
+<summary><strong>Ce agenți pot folosi REA?</strong></summary>
+
+Orice agent care acceptă servere MCP locale. Programul de configurare pregătește
+[agenții acceptați](../installation.md#supported-agents); pentru ceilalți clienți
+poți folosi [înregistrarea manuală MCP](../installation.md#mcp-registry).
+
+</details>
+
+<details>
+<summary><strong>Am nevoie de Hopper, Ghidra sau IDA?</strong></summary>
+
+Analiza nativă aprofundată folosește unul dintre aceste instrumente. Inspectarea
+statică JavaScript și .NET funcționează fără un motor de analiză nativă.
+Programul de configurare poate instala Hopper după aprobare; pentru Ghidra și IDA
+folosește instalările existente. Consultă [configurarea motoarelor de analiză](../installation.md#hopper).
+
+</details>
+
+<details>
+<summary><strong>Trebuie să pornesc mai întâi Hopper?</strong></summary>
+
+REA pornește Hopper când o operație are nevoie de el. Pe macOS, un dialog afișat
+la prima pornire îți poate cere să alegi modul demonstrativ sau să activezi licența.
+Finalizează acel pas în aceeași sesiune de utilizator înainte de prima operație
+CLI/MCP sau de prima sarcină nesupravegheată. Deschide Hopper manual dacă este nevoie.
+Consultă [pornirea Hopper și depanarea](../installation.md#launcher-paths-and-troubleshooting).
+
+</details>
+
+<details>
+<summary><strong>Ce face instalarea skill-ului de pe skills.sh?</strong></summary>
+
+Skill-ul oferă agentului instrucțiuni de investigare. Folosește `npx rea-agents setup`
+pentru a înregistra serverul MCP REA și a instala instrucțiunile corespunzătoare,
+apoi repornește agentul. Consultă [instalarea doar a skill-ului](../installation.md#skill-only-installation).
+
+</details>
+
+<details>
+<summary><strong>Ce cod returnează REA?</strong></summary>
+
+Analiza nativă returnează pseudocod și cod de asamblare. Analiza JavaScript/Electron
+recuperează modulele și relațiile dintre ele. Agentul tău folosește aceste
+constatări pentru a scrie și testa o implementare;
+[studiile de caz](#studii-de-caz) oferă exemple detaliate.
+
+</details>
+
+<details>
+<summary><strong>REA îmi încarcă aplicația pe un server?</strong></summary>
+
+REA analizează țintele local. Agentul tău primește rezultatele uneltelor, iar
+furnizorul modelului său are propria politică privind datele.
+
+</details>
+
+<details>
+<summary><strong>Ce fac dacă întâlnesc o eroare?</strong></summary>
+
+Actualizează mai întâi; o versiune recentă ar putea să o fi remediat deja.
+
+Pentru o interfață CLI instalată cu `npm install --global` sau `bun add --global`:
+
+```bash
+rea update
+```
+
+Pentru configurarea agentului prin `npx`:
+
+```bash
+npx rea-agents@latest setup
+```
+
+Dacă folosești un agent, finalizează [actualizarea configurării](#actualizează-rea)
+și repornește-l. Reîncearcă aceeași sarcină. Dacă problema persistă,
+[deschide un issue](https://github.com/morluto/rea/issues) și include versiunea REA,
+tipul țintei analizate, pașii de reproducere și mesajele de eroare.
+
+</details>
+
+## Documentație
+
+Începe cu [ghidurile practice](https://rea.tools/guides/) de pe site.
+Pentru opțiunile exacte, cerințele preliminare și contractele rezultatelor:
+
+- [Instalare și configurare](../installation.md): înregistrarea agenților, configurarea motoarelor de analiză, actualizări și dezinstalare.
+- [Verificarea pregătirii și depanare](../installation.md#check-readiness-for-your-task): diagnosticarea unui agent sau motor de analiză.
+- [CLI și Evidence](../cli.md): comenzi, selectarea motorului, instantanee, import/export și coduri de ieșire.
+- [Contracte MCP](../mcp-contracts.md) și [prompturi pentru agenți](../mcp-prompts.md): rezultatele uneltelor, sesiuni și investigații ghidate.
+- [Catalogul uneltelor](../mcp-contracts.md#generated-catalog): inventarul generat al uneltelor, motoarelor de analiză și comenzilor CLI.
+- [Plan de dezvoltare](../roadmap.md): lucrări planificate și urmărirea progresului funcționalităților.
+
+Raportează vulnerabilitățile conform [SECURITY.md](../../SECURITY.md).
+
+## Istoricul stelelor
+
+🎉 **300.000 de stele pe GitHub — vă mulțumim!**
+
+Mulțumim tuturor celor care folosesc REA, raportează erori, propun funcționalități,
+testează versiuni și contribuie cu remedieri.
+
+<a href="https://www.star-history.com/?repos=morluto%2Frea&amp;type=date">
+  <picture>
+    <source media="(prefers-color-scheme: dark)" srcset="https://api.star-history.com/chart?repos=morluto/rea&amp;type=date&amp;theme=dark&amp;legend=top-left" />
+    <source media="(prefers-color-scheme: light)" srcset="https://api.star-history.com/chart?repos=morluto/rea&amp;type=date" />
+    <img alt="Istoricul stelelor REA pe GitHub" src="https://api.star-history.com/chart?repos=morluto/rea&amp;type=date" />
+  </picture>
+</a>
+
+## Precizări privind utilizarea
+
+Consultă [DISCLAIMER.md](../../DISCLAIMER.md) pentru îndrumări privind utilizarea responsabilă.
+
+Poziția proiectului față de utilizarea ilegală sau neautorizată se aplică tuturor
+versiunilor REA, canalelor de distribuție și platformelor; fiecare copie își
+păstrează licențele aplicabile.
+
+REA este destinat cercetării legale, educației, interoperabilității, conservării
+software-ului și analizei programelor pe care le deții sau pe care ai autorizarea
+să le examinezi.
+
+## Contribuții
+
+Ne-ar bucura să contribui la REA! [Deschide un issue](https://github.com/morluto/rea/issues)
+pentru a raporta o eroare sau a propune o funcționalitate ori
+[trimite un pull request](https://github.com/morluto/rea/pulls) pentru a îmbunătăți
+codul sau documentația.
+
+Consultă [CONTRIBUTING.md](../../CONTRIBUTING.md) pentru pregătirea mediului de dezvoltare
+și verificări, [ghidul de testare](../testing.md) pentru categoriile de verificări
+și [diagrama arhitecturii](../architecture.mermaid) pentru anumite straturi și
+relații de dependență.
+
+## Licență
+
+[MIT](../../LICENSE)
+
+Codul scris în cadrul REA este licențiat sub MIT. Materialele terților își păstrează
+propriile licențe și mențiuni privind drepturile de autor; consultă
+[mențiunile privind terții](../../THIRD_PARTY_NOTICES.md) pentru inventarul
+dependențelor, textele licențelor păstrate și condițiile aplicabile uneltelor externe.
+
+**Trebuie să obții legal uneltele comerciale și să ai dreptul să le folosești**,
+inclusiv decompilatoarele IDA Pro / Hex-Rays, Hopper și JEB, în condițiile
+licențelor aplicabile. REA nu îți acordă nicio licență, cheie sau drept de activare
+pentru aceste unelte. Versiunile de evaluare și demonstrative rămân supuse
+condițiilor furnizorilor, inclusiv restricțiilor privind utilizatorii,
+funcționalitățile, automatizarea și partajarea rezultatelor. Nu sunt autorizate
+copiile piratate, cheile furate, partajarea neautorizată a cheilor sau ocolirea
+restricțiilor de licențiere. Aceste îndrumări nu modifică licența MIT sau licențele terților.
@@ -1,7 +1,7 @@
 <div align="center">

 [English](../../README.md) · [简体中文](README_zh.md) · [繁體中文](README_zh-TW.md) · [日本語](README_ja.md) · [한국어](README_ko.md) · [Türkçe](README_tr.md) · **Русский** · [Tiếng Việt](README_vi.md) · [ไทย](README_th.md) · [Deutsch](README_de.md) · [Español](README_es.md) · [Français](README_fr.md) · [Українська](README_uk.md) · [Polski](README_pl.md) · [Português (Brasil)](README_pt-BR.md) · [العربية](README_ar.md) · [فارسی](README_fa.md) · [Bahasa Indonesia](README_id.md) · [Italiano](README_it.md)
-· [Ελληνικά](README_el.md) · [മലയാളം](README_ml.md) · [Roman Urdu](README_ur-Latn.md)
+· [Ελληνικά](README_el.md) · [മലയാളം](README_ml.md) · [Roman Urdu](README_ur-Latn.md) · [Română](README_ro.md)

 # REA: Реверс-инжиниринг чего угодно

@@ -20,7 +20,7 @@

 **[Сайт](https://rea.tools/ru/) · [Руководства](https://rea.tools/ru/guides/) · [Примеры](https://rea.tools/ru/showcase/)**

-[Быстрый старт](#быстрый-старт) · [Как работает REA](#как-работает-rea) · [Что можно анализировать](#что-можно-анализировать) · [Примеры](#примеры) · [Частые вопросы](#частые-вопросы) · [Инструменты GNU objdump и Rizin](../reverse-engineering-tools.md) · [Документация](#документация)
+[Быстрый старт](#быстрый-старт) · [Как работает REA](#как-работает-rea) · [Что можно анализировать](#что-можно-анализировать) · [Примеры](#примеры) · [Создание RL-окружений](#build-rl-environments) · [Частые вопросы](#частые-вопросы) · [Инструменты GNU objdump и Rizin](../reverse-engineering-tools.md) · [Документация](#документация)

 <code>npx rea-agents setup</code>

@@ -158,6 +158,7 @@ REA требует Node.js 22.x (>=22.23.4), 24.x (>=24.22.1) или 26+ (>=26.1
 | PE certificates                     | Authenticode WIN_CERTIFICATE entries and PKCS#7 signer/X.509 identity fields                                               | Built-in static PE inspection; [PE certificates](../pe-certificates.md)                                                                                    |
 | PE imports                          | Import and delay-load DLL names, ordinals, IAT RVAs and pefile import hash                                                 | Built-in static PE inspection; [PE imports](../pe-imports.md)                                                                                              |
 | ELF notes                           | PT_NOTE/SHT_NOTE owners, types, GNU build-id and ABI-tag fields                                                            | Built-in static ELF inspection; [ELF notes](../elf-notes.md)                                                                                               |
+| Linux kernel modules                | .modinfo keys, __versions CRCs, this_module presence, and signature trailer                                                | Built-in static ELF inspection; [kernel modules](../kernel-modules.md)                                                                                     |
 | Erlang BEAM                         | IFF chunks, atoms, exports, and tables                                                                                     | Built-in static BEAM inspection; [Erlang BEAM](../erlang-beam.md)                                                                                          |
 | Apple IPS crashes                   | .ips metadata, threads, images, registers and crash classes                                                                | Built-in static JSON inspection; [Apple IPS](../apple-ips.md)                                                                                              |
 | Записанные сбои Linux               | Необработанные записи note, регистры/сигналы каждого записанного потока и необязательные кандидаты сопоставления с памятью | pwntools, предоставленный вызывающей стороной, в Linux x64; необязательные GDB/pwndbg; [записанные сбои](../recorded-crashes.md)                           |
@@ -222,8 +223,51 @@ REA требует Node.js 22.x (>=22.23.4), 24.x (>=24.22.1) или 26+ (>=26.1

 [Прочитать исследование](https://rea.tools/ru/showcase/th04/) · [Репозиторий реконструкции](https://github.com/N0zoM1z0/th04)

+### Создавайте RL-окружения с REA
+
+Запишите сеанс веб-приложения, превратите его API в инструменты и экспортируйте окружение для ИИ-агента. Запустите его с AgentEnv, затем добавьте задания и проверки наград для RL-обучения или оценки.
+
+[Руководство по созданию окружения](https://rea.tools/guides/rl-environments/) ·
+[Смотреть демо в X](https://x.com/reatools/status/2112574822584918075?s=20)
+
 Если вы исследовали с REA что-то интересное, поделитесь результатом. Создайте [issue](https://github.com/morluto/rea/issues) или [pull request](https://github.com/morluto/rea/pulls) и укажите цель, ваш вопрос, как помог REA и что удалось узнать.

+<a id="build-rl-environments"></a>
+
+## Создание RL-окружений
+
+Создайте локальное окружение, где ИИ-агент сможет выполнять пробные задания, например искать задачу в трекере или создавать папку, без запуска исходного приложения. Используйте его для обучения с подкреплением (RL) или проверки того, как агент справляется с заданиями.
+
+REA превращает записанные API-запросы и ответы в инструменты, которые может вызывать агент. Окружение использует записанные данные и поддерживает изменения только тогда, когда запись подтверждает их эффект.
+
+Настройте REA в своём агенте, затем замените пример URL и операции с папками на свои:
+
+```text
+С помощью REA создай RL-окружение из моего тестового веб-приложения:
+http://127.0.0.1:3000
+Включи просмотр списка папок, создание, переименование и удаление.
+Можно создавать и удалять тестовые папки. Существующие данные не меняй.
+Сохрани в папку my-env, проверь доступные операции и расскажи, как запустить окружение.
+```
+
+<details>
+<summary>Использовать командную строку</summary>
+
+Эти команды подходят, если у вас уже есть файл с записанными запросами и ответами приложения в браузере. Для запуска результата также нужны AgentEnv и Docker.
+
+```sh
+rea environment-build ./session.har ./my-env --name my-env --json
+agent-env run ./my-env
+```
+
+</details>
+
+REA экспортирует готовое к запуску окружение с базовым тестом запуска и ответов. Подключите его к своему RL-фреймворку, чтобы задать цели, добавить проверки наград и запустить обучение.
+
+[Руководство по созданию окружения](https://rea.tools/guides/rl-environments/) ·
+[Справочник окружений](../agent-environments.md) ·
+[Смотреть демо в X](https://x.com/reatools/status/2112574822584918075?s=20)
+
 ## Частые вопросы

 <details>
@@ -1,7 +1,7 @@
 <div align="center">

 [English](../../README.md) · [简体中文](README_zh.md) · [繁體中文](README_zh-TW.md) · [日本語](README_ja.md) · [한국어](README_ko.md) · [Türkçe](README_tr.md) · [Русский](README_ru.md) · [Tiếng Việt](README_vi.md) · **ไทย** · [Deutsch](README_de.md) · [Español](README_es.md) · [Français](README_fr.md) · [Українська](README_uk.md) · [Polski](README_pl.md) · [Português (Brasil)](README_pt-BR.md) · [العربية](README_ar.md) · [فارسی](README_fa.md) · [Bahasa Indonesia](README_id.md) · [Italiano](README_it.md)
-· [Ελληνικά](README_el.md) · [മലയാളം](README_ml.md) · [Roman Urdu](README_ur-Latn.md)
+· [Ελληνικά](README_el.md) · [മലയാളം](README_ml.md) · [Roman Urdu](README_ur-Latn.md) · [Română](README_ro.md)

 # REA: Reverse Engineer Anything

@@ -20,7 +20,7 @@

 **[เว็บไซต์](https://rea.tools/th/) · [คู่มือ](https://rea.tools/th/guides/) · [ตัวอย่างการใช้งาน](https://rea.tools/th/showcase/)**

-[เริ่มต้นอย่างรวดเร็ว](#เริ่มต้นอย่างรวดเร็ว) · [REA ทำงานอย่างไร](#rea-ทำงานอย่างไร) · [สิ่งที่วิเคราะห์ได้](#สิ่งที่วิเคราะห์ได้) · [ตัวอย่างการใช้งาน](#ตัวอย่างการใช้งาน) · [คำถามที่พบบ่อย](#คำถามที่พบบ่อย) · [เครื่องมือ GNU objdump และ Rizin](../reverse-engineering-tools.md) · [เอกสาร](#เอกสาร)
+[เริ่มต้นอย่างรวดเร็ว](#เริ่มต้นอย่างรวดเร็ว) · [REA ทำงานอย่างไร](#rea-ทำงานอย่างไร) · [สิ่งที่วิเคราะห์ได้](#สิ่งที่วิเคราะห์ได้) · [ตัวอย่างการใช้งาน](#ตัวอย่างการใช้งาน) · [สร้างสภาพแวดล้อม RL](#build-rl-environments) · [คำถามที่พบบ่อย](#คำถามที่พบบ่อย) · [เครื่องมือ GNU objdump และ Rizin](../reverse-engineering-tools.md) · [เอกสาร](#เอกสาร)

 <code>npx rea-agents setup</code>

@@ -158,6 +158,7 @@ REA ต้องใช้ Node.js 22.x (>=22.23.4), 24.x (>=24.22.1) หรื
 | ไบต์โค้ด EVM                   | ตัวเลือกฟังก์ชันสำหรับการเรียก ออฟเซ็ตไบต์ อาร์กิวเมนต์และความสามารถในการเปลี่ยนสถานะที่อนุมานได้ | ไฟล์บนเครื่องที่มีไบต์ดิบหรือข้อมูลเลขฐานสิบหกบน Linux x64; [คู่มือ EVM แบบออฟไลน์](../evm-bytecode.md)                                              |
 | Rust binaries                | Embedded cargo-auditable dependency list                                        | [Rust binaries](../rust-binaries.md)                                                                                                 |
 | ELF notes                    | PT_NOTE/SHT_NOTE owners, types, GNU build-id and ABI-tag fields                 | Built-in static ELF inspection; [ELF notes](../elf-notes.md)                                                                         |
+| Linux kernel modules         | .modinfo keys, __versions CRCs, this_module presence, and signature trailer     | Built-in static ELF inspection; [kernel modules](../kernel-modules.md)                                                               |
 | Erlang BEAM                  | IFF chunks, atoms, exports, and tables                                          | Built-in static BEAM inspection; [Erlang BEAM](../erlang-beam.md)                                                                    |
 | Apple IPS crashes            | .ips metadata, threads, images, registers and crash classes                     | Built-in static JSON inspection; [Apple IPS](../apple-ips.md)                                                                        |
 | ข้อมูลการแครชของ Linux ที่บันทึกไว้ | ระเบียน note ดิบ รีจิสเตอร์/สัญญาณของทุกเธรดที่บันทึกไว้ และตัวเลือกการแมปเพิ่มเติม              | pwntools ที่ผู้ใช้จัดเตรียมบน Linux x64; เลือกใช้ GDB/pwndbg เพิ่มเติมได้; [การแครชที่บันทึกไว้](../recorded-crashes.md)                               |
@@ -222,8 +223,51 @@ REA ต้องใช้ Node.js 22.x (>=22.23.4), 24.x (>=24.22.1) หรื

 [อ่านกรณีศึกษา](https://rea.tools/th/showcase/th04/) · [รีโพซิทอรีการสร้างขึ้นใหม่](https://github.com/N0zoM1z0/th04)

+### สร้างสภาพแวดล้อม RL ด้วย REA
+
+บันทึกเซสชันเว็บแอป เปลี่ยน API เป็นเครื่องมือ และส่งออกสภาพแวดล้อมที่เอเจนต์ AI ใช้ได้ รันด้วย AgentEnv แล้วเพิ่มงานและการตรวจสอบรางวัลสำหรับการฝึก RL หรือการประเมิน
+
+[คู่มือสร้างสภาพแวดล้อม](https://rea.tools/guides/rl-environments/) ·
+[ชมเดโมบน X](https://x.com/reatools/status/2112574822584918075?s=20)
+
 หากคุณใช้ REA กับสิ่งที่น่าสนใจ เราอยากเห็นผลงานของคุณ แบ่งปันกรณีของคุณผ่าน [issue](https://github.com/morluto/rea/issues) หรือ [pull request](https://github.com/morluto/rea/pulls) พร้อมระบุเป้าหมาย คำถามของคุณ REA ช่วยอย่างไร และสิ่งที่คุณค้นพบ

+<a id="build-rl-environments"></a>
+
+## สร้างสภาพแวดล้อม RL
+
+สร้างสภาพแวดล้อมในเครื่องให้เอเจนต์ AI ฝึกทำงาน เช่น ค้นหา issue หรือสร้างโฟลเดอร์ โดยไม่ต้องรันแอปต้นฉบับ ใช้สำหรับการเรียนรู้แบบเสริมกำลัง (RL) หรือทดสอบว่าเอเจนต์ทำงานได้ดีเพียงใด
+
+REA เปลี่ยนคำขอและคำตอบ API ที่บันทึกไว้เป็นเครื่องมือที่เอเจนต์เรียกใช้ได้ สภาพแวดล้อมใช้ข้อมูลที่บันทึกไว้และรองรับการเปลี่ยนแปลงเฉพาะเมื่อข้อมูลบันทึกยืนยันผลของการเปลี่ยนแปลงนั้น
+
+เมื่อตั้งค่า REA ในเอเจนต์แล้ว ให้เปลี่ยน URL และงานเกี่ยวกับโฟลเดอร์ในตัวอย่างให้ตรงกับแอปของคุณ:
+
+```text
+ใช้ REA สร้างสภาพแวดล้อม RL จากเว็บแอปทดสอบของฉันที่
+http://127.0.0.1:3000
+ครอบคลุมการแสดงรายการ สร้าง เปลี่ยนชื่อ และลบโฟลเดอร์
+อนุญาตให้สร้างและลบโฟลเดอร์ทดสอบ แต่ห้ามเปลี่ยนข้อมูลที่มีอยู่
+บันทึกในโฟลเดอร์ชื่อ my-env ตรวจสอบว่างานใดใช้ได้ และบอกวิธีรันให้ฉันทราบ
+```
+
+<details>
+<summary>ใช้บรรทัดคำสั่งแทน</summary>
+
+ใช้คำสั่งเหล่านี้เมื่อมีไฟล์บันทึกคำขอและคำตอบของแอปในเบราว์เซอร์แล้ว การรันสภาพแวดล้อมที่สร้างขึ้นต้องใช้ AgentEnv และ Docker ด้วย
+
+```sh
+rea environment-build ./session.har ./my-env --name my-env --json
+agent-env run ./my-env
+```
+
+</details>
+
+REA ส่งออกสภาพแวดล้อมที่รันได้พร้อมการทดสอบพื้นฐานว่าเริ่มทำงานและตอบสนองได้ เชื่อมต่อกับเฟรมเวิร์ก RL เพื่อกำหนดเป้าหมายงาน เพิ่มการตรวจสอบรางวัล และฝึกเอเจนต์
+
+[คู่มือสร้างสภาพแวดล้อม](https://rea.tools/guides/rl-environments/) ·
+[เอกสารอ้างอิงสภาพแวดล้อม](../agent-environments.md) ·
+[ชมเดโมบน X](https://x.com/reatools/status/2112574822584918075?s=20)
+
 ## คำถามที่พบบ่อย

 <details>
@@ -1,7 +1,7 @@
 <div align="center">

 [English](../../README.md) · [简体中文](README_zh.md) · [繁體中文](README_zh-TW.md) · [日本語](README_ja.md) · [한국어](README_ko.md) · **Türkçe** · [Русский](README_ru.md) · [Tiếng Việt](README_vi.md) · [ไทย](README_th.md) · [Deutsch](README_de.md) · [Español](README_es.md) · [Français](README_fr.md) · [Українська](README_uk.md) · [Polski](README_pl.md) · [Português (Brasil)](README_pt-BR.md) · [العربية](README_ar.md) · [فارسی](README_fa.md) · [Bahasa Indonesia](README_id.md) · [Italiano](README_it.md)
-· [Ελληνικά](README_el.md) · [മലയാളം](README_ml.md) · [Roman Urdu](README_ur-Latn.md)
+· [Ελληνικά](README_el.md) · [മലയാളം](README_ml.md) · [Roman Urdu](README_ur-Latn.md) · [Română](README_ro.md)

 # REA: Her şeyi tersine mühendislikle inceleyin

@@ -20,7 +20,7 @@

 **[Web sitesi](https://rea.tools/tr/) · [Rehberler](https://rea.tools/tr/guides/) · [Örnek çalışmalar](https://rea.tools/tr/showcase/)**

-[Hızlı başlangıç](#hızlı-başlangıç) · [REA nasıl çalışır](#rea-nasıl-çalışır) · [Neleri analiz edebilirsiniz](#neleri-analiz-edebilirsiniz) · [Örnek çalışmalar](#örnek-çalışmalar) · [Sık sorulan sorular](#sık-sorulan-sorular) · [GNU objdump ve Rizin araçları](../reverse-engineering-tools.md) · [Belgeler](#belgeler)
+[Hızlı başlangıç](#hızlı-başlangıç) · [REA nasıl çalışır](#rea-nasıl-çalışır) · [Neleri analiz edebilirsiniz](#neleri-analiz-edebilirsiniz) · [Örnek çalışmalar](#örnek-çalışmalar) · [RL ortamları oluşturun](#build-rl-environments) · [Sık sorulan sorular](#sık-sorulan-sorular) · [GNU objdump ve Rizin araçları](../reverse-engineering-tools.md) · [Belgeler](#belgeler)

 <code>npx rea-agents setup</code>

@@ -157,6 +157,7 @@ REA; Node.js 22.x (>=22.23.4), 24.x (>=24.22.1) veya 26+ (>=26.12.1) ve npm gere
 | PE imports                              | Import and delay-load DLL names, ordinals, IAT RVAs and pefile import hash                                  | Built-in static PE inspection; [PE imports](../pe-imports.md)                                                                      |
 | ELF notes                               | PT_NOTE/SHT_NOTE owners, types, GNU build-id and ABI-tag fields                                             | Built-in static ELF inspection; [ELF notes](../elf-notes.md)                                                                       |
 | Apple IPS crashes                       | .ips metadata, threads, images, registers and crash classes                                                 | Built-in static JSON inspection; [Apple IPS](../apple-ips.md)                                                                      |
+| Linux kernel modules                    | .modinfo keys, __versions CRCs, this_module presence, and signature trailer                                 | Built-in static ELF inspection; [kernel modules](../kernel-modules.md)                                                             |
 | Erlang BEAM                             | IFF chunks, atoms, exports, and tables                                                                      | Built-in static BEAM inspection; [Erlang BEAM](../erlang-beam.md)                                                                  |
 | WASM artefaktı                          | Doğrulama, bölümler, tam import/export WAT biçimleri ve decode edilmiş WAT                                  | Çağıranın sağladığı WABT 1.0.42; `inspect_wasm_artifact`                                                                           |
 | EVM bayt kodu                           | Yönlendirme seçicileri, bayt ofsetleri, çıkarımla belirlenen argümanlar ve durum değiştirilebilirliği       | Linux x64 üzerinde yerel ham bayt/onaltılık girdi; [çevrimdışı EVM rehberi](../evm-bytecode.md)                                    |
@@ -218,8 +219,51 @@ Bir ses çağrısından konumu stereo konumlandırmaya dönüştüren yardımcı

 [Örnek çalışmayı okuyun](https://rea.tools/tr/showcase/th04/) · [Yeniden oluşturma deposu](https://github.com/N0zoM1z0/th04)

+### REA ile RL ortamları oluşturun
+
+Bir web uygulaması oturumunu kaydedin, API’sini araçlara dönüştürün ve bir yapay zekâ ajanının kullanabileceği ortamı dışa aktarın. AgentEnv ile çalıştırın, ardından RL eğitimi veya değerlendirmesi için görevler ve ödül kontrolleri ekleyin.
+
+[Ortam oluşturma rehberi](https://rea.tools/guides/rl-environments/) ·
+[Demoyu X’te izleyin](https://x.com/reatools/status/2112574822584918075?s=20)
+
 REA'yı ilginç bir konuda kullandıysanız görmek isteriz. Hedefi, sorunuzu, REA'nın nasıl yardımcı olduğunu ve bulgularınızı bir [issue](https://github.com/morluto/rea/issues) veya [pull request](https://github.com/morluto/rea/pulls) ile paylaşın.

+<a id="build-rl-environments"></a>
+
+## RL ortamları oluşturun
+
+Asıl uygulamayı çalıştırmadan, yapay zekâ ajanının sorun bulma veya klasör oluşturma gibi görevleri deneyeceği yerel bir ortam oluşturun. Bunu pekiştirmeli öğrenme (RL) veya ajanın görevleri ne kadar iyi tamamladığını test etmek için kullanın.
+
+REA, kaydedilmiş API isteklerini ve yanıtlarını ajanın çağırabileceği araçlara dönüştürür. Ortam kayıtlı verileri kullanır ve yalnızca etkisi kayıtla doğrulanan değişiklikleri destekler.
+
+Ajanınızda REA’yı kurduktan sonra aşağıdaki örnek URL’yi ve klasör görevlerini kendinize göre değiştirin:
+
+```text
+REA ile şu test web uygulamamdan bir RL ortamı oluştur:
+http://127.0.0.1:3000
+Klasör listeleme, oluşturma, yeniden adlandırma ve silme işlemlerini kapsa.
+Test klasörleri oluşturup silebilirsin. Mevcut verileri değiştirme.
+my-env adlı klasöre kaydet, hangi işlemlerin çalıştığını kontrol et ve nasıl çalıştıracağımı anlat.
+```
+
+<details>
+<summary>Komut satırını kullanın</summary>
+
+Uygulamanın tarayıcı isteklerini ve yanıtlarını kaydettiğiniz bir dosya varsa bu komutları kullanabilirsiniz. Oluşan ortamı çalıştırmak için AgentEnv ve Docker da gerekir.
+
+```sh
+rea environment-build ./session.har ./my-env --name my-env --json
+agent-env run ./my-env
+```
+
+</details>
+
+REA, çalıştırılabilir bir ortamı ve başlayıp yanıt verdiğini kontrol eden temel bir testi dışa aktarır. Görev hedeflerini ve ödül kontrollerini tanımlamak, ardından eğitim çalıştırmak için RL çerçevenizle kullanın.
+
+[Ortam oluşturma rehberi](https://rea.tools/guides/rl-environments/) ·
+[Ortam referansı](../agent-environments.md) ·
+[Demoyu X’te izleyin](https://x.com/reatools/status/2112574822584918075?s=20)
+
 ## Sık sorulan sorular

 <details>
@@ -1,7 +1,7 @@
 <div align="center">

 [English](../../README.md) · [简体中文](README_zh.md) · [繁體中文](README_zh-TW.md) · [日本語](README_ja.md) · [한국어](README_ko.md) · [Türkçe](README_tr.md) · [Русский](README_ru.md) · [Tiếng Việt](README_vi.md) · [ไทย](README_th.md) · [Deutsch](README_de.md) · [Español](README_es.md) · [Français](README_fr.md) · **Українська** · [Polski](README_pl.md) · [Português (Brasil)](README_pt-BR.md) · [العربية](README_ar.md) · [فارسی](README_fa.md) · [Bahasa Indonesia](README_id.md) · [Italiano](README_it.md)
-· [Ελληνικά](README_el.md) · [മലയാളം](README_ml.md) · [Roman Urdu](README_ur-Latn.md)
+· [Ελληνικά](README_el.md) · [മലയാളം](README_ml.md) · [Roman Urdu](README_ur-Latn.md) · [Română](README_ro.md)

 # REA: Реверс-інжиніринг будь-чого

@@ -20,7 +20,7 @@

 **[Сайт](https://rea.tools/uk/) · [Посібники](https://rea.tools/uk/guides/) · [Приклади](https://rea.tools/uk/showcase/)**

-[Швидкий старт](#швидкий-старт) · [Як працює REA](#як-працює-rea) · [Що можна аналізувати](#що-можна-аналізувати) · [Приклади](#приклади) · [Поширені запитання](#поширені-запитання) · [Інструменти GNU objdump і Rizin](../reverse-engineering-tools.md) · [Документація](#документація)
+[Швидкий старт](#швидкий-старт) · [Як працює REA](#як-працює-rea) · [Що можна аналізувати](#що-можна-аналізувати) · [Приклади](#приклади) · [Створення RL-середовищ](#build-rl-environments) · [Поширені запитання](#поширені-запитання) · [Інструменти GNU objdump і Rizin](../reverse-engineering-tools.md) · [Документація](#документація)

 <code>npx rea-agents setup</code>

@@ -158,6 +158,7 @@ REA потребує Node.js 22.x (>=22.23.4), 24.x (>=24.22.1) або 26+ (>=26
 | Байт-код EVM                         | Селектори диспетчеризації, зміщення байтів, виведені припущення про аргументи та змінюваність стану               | Локальні необроблені байти або шістнадцяткове представлення у Linux x64; [посібник EVM без запуску](../evm-bytecode.md)                               |
 | Rust binaries                        | Embedded cargo-auditable dependency list                                                                          | [Rust binaries](../rust-binaries.md)                                                                                                                  |
 | ELF notes                            | PT_NOTE/SHT_NOTE owners, types, GNU build-id and ABI-tag fields                                                   | Built-in static ELF inspection; [ELF notes](../elf-notes.md)                                                                                          |
+| Linux kernel modules                 | .modinfo keys, __versions CRCs, this_module presence, and signature trailer                                       | Built-in static ELF inspection; [kernel modules](../kernel-modules.md)                                                                                |
 | Erlang BEAM                          | IFF chunks, atoms, exports, and tables                                                                            | Built-in static BEAM inspection; [Erlang BEAM](../erlang-beam.md)                                                                                     |
 | Apple IPS crashes                    | .ips metadata, threads, images, registers and crash classes                                                       | Built-in static JSON inspection; [Apple IPS](../apple-ips.md)                                                                                         |
 | Записані аварійні завершення в Linux | Необроблені записи note, регістри/сигнали кожного записаного потоку й необов'язкові кандидати зіставлення пам'яті | pwntools, наданий стороною, що викликає інструмент, у Linux x64; необов'язкові GDB/pwndbg; [записані аварійні завершення](../recorded-crashes.md)     |
@@ -222,8 +223,51 @@ REA потребує Node.js 22.x (>=22.23.4), 24.x (>=24.22.1) або 26+ (>=26

 [Прочитати дослідження](https://rea.tools/uk/showcase/th04/) · [Репозиторій реконструкції](https://github.com/N0zoM1z0/th04)

+### Створюйте RL-середовища з REA
+
+Запишіть сеанс вебзастосунку, перетворіть його API на інструменти й експортуйте середовище для ШІ-агента. Запустіть його з AgentEnv, а потім додайте завдання та перевірки винагород для RL-навчання або оцінювання.
+
+[Посібник зі створення середовища](https://rea.tools/guides/rl-environments/) ·
+[Дивитися демо в X](https://x.com/reatools/status/2112574822584918075?s=20)
+
 Якщо ви дослідили з REA щось цікаве, поділіться результатом. Створіть [issue](https://github.com/morluto/rea/issues) або [pull request](https://github.com/morluto/rea/pulls) і вкажіть ціль, ваше запитання, як допоміг REA та що ви з'ясували.

+<a id="build-rl-environments"></a>
+
+## Створення RL-середовищ
+
+Створіть локальне середовище, де ШІ-агент може тренуватися виконувати завдання, як-от пошук issue або створення папки, без запуску початкового застосунку. Використовуйте його для навчання з підкріпленням (RL) або перевірки того, як агент виконує завдання.
+
+REA перетворює записані API-запити й відповіді на інструменти, які може викликати агент. Середовище використовує записані дані й підтримує зміни лише тоді, коли запис підтверджує їхні ефекти.
+
+Налаштуйте REA у своєму агенті та замініть URL і завдання з папками на власні:
+
+```text
+За допомогою REA створи RL-середовище з мого тестового вебзастосунку:
+http://127.0.0.1:3000
+Охопи перегляд списку папок, створення, перейменування й видалення.
+Можна створювати й видаляти тестові папки. Наявні дані не змінюй.
+Збережи в папку my-env, перевір доступні операції та поясни, як запустити середовище.
+```
+
+<details>
+<summary>Використати командний рядок</summary>
+
+Ці команди підходять, якщо у вас уже є файл із записаними запитами й відповідями застосунку в браузері. Для запуску результату також потрібні AgentEnv і Docker.
+
+```sh
+rea environment-build ./session.har ./my-env --name my-env --json
+agent-env run ./my-env
+```
+
+</details>
+
+REA експортує готове до запуску середовище з базовим тестом запуску й відповідей. Підключіть його до свого RL-фреймворку, щоб задати цілі, додати перевірки винагород і запустити навчання.
+
+[Посібник зі створення середовища](https://rea.tools/guides/rl-environments/) ·
+[Довідник середовищ](../agent-environments.md) ·
+[Дивитися демо в X](https://x.com/reatools/status/2112574822584918075?s=20)
+
 ## Поширені запитання

 <details>
@@ -1,7 +1,7 @@
 <div align="center">

 [English](../../README.md) · [简体中文](README_zh.md) · [繁體中文](README_zh-TW.md) · [日本語](README_ja.md) · [한국어](README_ko.md) · [Türkçe](README_tr.md) · [Русский](README_ru.md) · [Tiếng Việt](README_vi.md) · [ไทย](README_th.md) · [Deutsch](README_de.md) · [Español](README_es.md) · [Français](README_fr.md) · [Українська](README_uk.md) · [Polski](README_pl.md) · [Português (Brasil)](README_pt-BR.md) · [العربية](README_ar.md) · [فارسی](README_fa.md) · [Bahasa Indonesia](README_id.md) · [Italiano](README_it.md)
-· [Ελληνικά](README_el.md) · [മലയാളം](README_ml.md) · **Roman Urdu**
+· [Ελληνικά](README_el.md) · [മലയാളം](README_ml.md) · **Roman Urdu** · [Română](README_ro.md)

 # REA: Reverse Engineer Anything

@@ -20,7 +20,7 @@

 **[Website](https://rea.tools/) · [Guides](https://rea.tools/guides/) · [Showcases](https://rea.tools/showcase/)**

-[Jaldi shuru karein](#jaldi-shuru-karein) · [REA kaise kaam karta hai](#rea-kaise-kaam-karta-hai) · [Kya kuch analyze kar sakte hain](#kya-kuch-analyze-kar-sakte-hain) · [Amli misaalein](#amli-misaalein) · [FAQ](#faq) · [Documentation](#documentation)
+[Jaldi shuru karein](#jaldi-shuru-karein) · [REA kaise kaam karta hai](#rea-kaise-kaam-karta-hai) · [Kya kuch analyze kar sakte hain](#kya-kuch-analyze-kar-sakte-hain) · [Amli misaalein](#amli-misaalein) · [RL environments banayein](#build-rl-environments) · [FAQ](#faq) · [Documentation](#documentation)

 <code>npx rea-agents setup</code>

@@ -198,6 +198,7 @@ Mazeed tools aur host support target par depend karte hain:
 | PE certificates         | Authenticode WIN_CERTIFICATE entries aur PKCS#7 signer/X.509 identity fields                      | Built-in static PE inspection; [PE certificates](../pe-certificates.md)                                                           |
 | PE imports              | Import aur delay-load DLL names, ordinals, IAT RVAs aur pefile import hash                        | Built-in static PE inspection; [PE imports](../pe-imports.md)                                                                     |
 | ELF notes               | PT_NOTE/SHT_NOTE owners, types, GNU build-id aur ABI-tag fields                                   | Built-in static ELF inspection; [ELF notes](../elf-notes.md)                                                                      |
+| Linux kernel modules    | .modinfo keys, __versions CRCs, this_module presence, and signature trailer                       | Built-in static ELF inspection; [kernel modules](../kernel-modules.md)                                                            |
 | Erlang BEAM             | IFF chunks, atoms, exports, imports, lambdas aur Code header                                      | Built-in static BEAM inspection; [Erlang BEAM](../erlang-beam.md)                                                                 |
 | WASM artifact           | Validation, sections, exact import/export WAT forms aur decoded WAT                               | Aapka diya hua WABT 1.0.42; `inspect_wasm_artifact`                                                                               |
 | EVM bytecode            | Dispatch selectors, byte offsets, inferred arguments aur mutability                               | Linux x64 par local raw/hex carrier; [offline EVM guide](../evm-bytecode.md)                                                      |
@@ -280,11 +281,54 @@ output se compare karein.
 [Case study parhein](https://rea.tools/showcase/th04/) ·
 [Reconstruction repository](https://github.com/N0zoM1z0/th04)

+### REA se RL environments banayein
+
+Web app session record karein, us ki API ko tools mein badlein aur AI agent ke liye environment export karein. AgentEnv ke saath chalayein, phir RL training ya evaluation ke liye tasks aur reward checks shamil karein.
+
+[Environment banane ki rehnumai](https://rea.tools/guides/rl-environments/) ·
+[X par demo dekhein](https://x.com/reatools/status/2112574822584918075?s=20)
+
 Agar aapne REA se koi dilchasp kaam kiya hai to hum dekhna chahenge. Apna case
 [issue](https://github.com/morluto/rea/issues) ya
 [pull request](https://github.com/morluto/rea/pulls) mein share karein. Target,
 apna sawal, REA ne kaise madad ki aur kya mila, yeh sab batayein.

+<a id="build-rl-environments"></a>
+
+## RL environments banayein
+
+AI agent ke liye local environment banayein jahan woh asal app chalaye baghair issue dhoondhne ya folder banane jaise kaam ki mashq kar sake. Ise reinforcement learning (RL) ya agent ke kaam poore karne ki salahiyat jaanchne ke liye istemal karein.
+
+REA record kiye hue API requests aur responses ko aise tools mein badalta hai jinhein agent call kar sakta hai. Environment recorded data istemal karta hai aur sirf woh tabdeeliyan support karta hai jin ke asraat recording tasdeeq karti hai.
+
+Agent mein REA setup karne ke baad neeche example URL aur folder tasks ko apne app ke mutabiq badlein:
+
+```text
+Meri test web app se REA ke zariye RL environment banao:
+http://127.0.0.1:3000
+Folders ki list, creation, rename aur deletion cover karo. Test folders bana
+aur hata sakte ho, lekin mojooda data tabdeel na karo.
+my-env naam ke folder mein save karo, kaam karne wale operations check karo aur chalane ka tareeqa batao.
+```
+
+<details>
+<summary>Command line istemal karein</summary>
+
+Yeh commands tab istemal karein jab app ke browser requests aur responses ki recording pehle se file mein ho. Result chalane ke liye AgentEnv aur Docker bhi chahiye.
+
+```sh
+rea environment-build ./session.har ./my-env --name my-env --json
+agent-env run ./my-env
+```
+
+</details>
+
+REA chalne ke liye tayyar environment aur aik bunyadi test export karta hai jo us ka shuru hona aur jawab dena check karta hai. Apne RL framework ke saath task goals aur reward checks tay karein aur training chalayein.
+
+[Environment banane ki rehnumai](https://rea.tools/guides/rl-environments/) ·
+[Environment reference](../agent-environments.md) ·
+[X par demo dekhein](https://x.com/reatools/status/2112574822584918075?s=20)
+
 ## FAQ

 <details>
@@ -1,7 +1,7 @@
 <div align="center">

 [English](../../README.md) · [简体中文](README_zh.md) · [繁體中文](README_zh-TW.md) · [日本語](README_ja.md) · [한국어](README_ko.md) · [Türkçe](README_tr.md) · [Русский](README_ru.md) · **Tiếng Việt** · [ไทย](README_th.md) · [Deutsch](README_de.md) · [Español](README_es.md) · [Français](README_fr.md) · [Українська](README_uk.md) · [Polski](README_pl.md) · [Português (Brasil)](README_pt-BR.md) · [العربية](README_ar.md) · [فارسی](README_fa.md) · [Bahasa Indonesia](README_id.md) · [Italiano](README_it.md)
-· [Ελληνικά](README_el.md) · [മലയാളം](README_ml.md) · [Roman Urdu](README_ur-Latn.md)
+· [Ελληνικά](README_el.md) · [മലയാളം](README_ml.md) · [Roman Urdu](README_ur-Latn.md) · [Română](README_ro.md)

 # REA: Kỹ thuật dịch ngược cho mọi thứ

@@ -20,7 +20,7 @@

 **[Trang web](https://rea.tools/vi/) · [Hướng dẫn](https://rea.tools/vi/guides/) · [Các nghiên cứu điển hình](https://rea.tools/vi/showcase/)**

-[Bắt đầu nhanh](#bắt-đầu-nhanh) · [Cách REA hoạt động](#cách-rea-hoạt-động) · [Những gì bạn có thể phân tích](#những-gì-bạn-có-thể-phân-tích) · [Các nghiên cứu điển hình](#các-nghiên-cứu-điển-hình) · [Câu hỏi thường gặp](#câu-hỏi-thường-gặp) · [Công cụ GNU objdump và Rizin](../reverse-engineering-tools.md) · [Tài liệu](#tài-liệu)
+[Bắt đầu nhanh](#bắt-đầu-nhanh) · [Cách REA hoạt động](#cách-rea-hoạt-động) · [Những gì bạn có thể phân tích](#những-gì-bạn-có-thể-phân-tích) · [Các nghiên cứu điển hình](#các-nghiên-cứu-điển-hình) · [Xây dựng môi trường RL](#build-rl-environments) · [Câu hỏi thường gặp](#câu-hỏi-thường-gặp) · [Công cụ GNU objdump và Rizin](../reverse-engineering-tools.md) · [Tài liệu](#tài-liệu)

 <code>npx rea-agents setup</code>

@@ -158,6 +158,7 @@ REA yêu cầu Node.js 22.x (>=22.23.4), 24.x (>=24.22.1) hoặc 26+ (>=26.12.1)
 | PE certificates                   | Authenticode WIN_CERTIFICATE entries and PKCS#7 signer/X.509 identity fields                                    | Built-in static PE inspection; [PE certificates](../pe-certificates.md)                                                                         |
 | PE imports                        | Import and delay-load DLL names, ordinals, IAT RVAs and pefile import hash                                      | Built-in static PE inspection; [PE imports](../pe-imports.md)                                                                                   |
 | ELF notes                         | PT_NOTE/SHT_NOTE owners, types, GNU build-id and ABI-tag fields                                                 | Built-in static ELF inspection; [ELF notes](../elf-notes.md)                                                                                    |
+| Linux kernel modules              | .modinfo keys, __versions CRCs, this_module presence, and signature trailer                                     | Built-in static ELF inspection; [kernel modules](../kernel-modules.md)                                                                          |
 | Erlang BEAM                       | IFF chunks, atoms, exports, and tables                                                                          | Built-in static BEAM inspection; [Erlang BEAM](../erlang-beam.md)                                                                               |
 | Apple IPS crashes                 | .ips metadata, threads, images, registers and crash classes                                                     | Built-in static JSON inspection; [Apple IPS](../apple-ips.md)                                                                                   |
 | Sự cố Linux đã ghi lại            | Bản ghi note thô, thanh ghi/tín hiệu của mọi luồng được ghi lại và các ứng viên ánh xạ tùy chọn                 | pwntools do bên gọi cung cấp trên Linux x64; GDB/pwndbg tùy chọn; [sự cố đã ghi lại](../recorded-crashes.md)                                    |
@@ -222,8 +223,51 @@ Kiểm tra các lệnh 16 bit của trò chơi PC-98 gốc, khôi phục phép t

 [Đọc nghiên cứu điển hình](https://rea.tools/vi/showcase/th04/) · [Kho mã tái tạo](https://github.com/N0zoM1z0/th04)

+### Xây dựng môi trường RL bằng REA
+
+Ghi phiên ứng dụng web, chuyển API thành công cụ và xuất môi trường mà tác tử AI có thể dùng. Chạy bằng AgentEnv, rồi thêm tác vụ và kiểm tra phần thưởng để huấn luyện RL hoặc đánh giá.
+
+[Hướng dẫn xây dựng môi trường](https://rea.tools/guides/rl-environments/) ·
+[Xem bản demo trên X](https://x.com/reatools/status/2112574822584918075?s=20)
+
 Nếu bạn dùng REA cho một mục tiêu thú vị, chúng tôi muốn biết. Chia sẻ trường hợp của bạn qua [issue](https://github.com/morluto/rea/issues) hoặc [pull request](https://github.com/morluto/rea/pulls), nêu mục tiêu, câu hỏi, cách REA giúp bạn và những gì tìm được.

+<a id="build-rl-environments"></a>
+
+## Xây dựng môi trường RL
+
+Tạo môi trường cục bộ để tác tử AI luyện các tác vụ như tìm issue hoặc tạo thư mục mà không cần chạy ứng dụng gốc. Dùng môi trường này cho học tăng cường (RL) hoặc để kiểm tra khả năng hoàn thành tác vụ của tác tử.
+
+REA biến các yêu cầu và phản hồi API đã ghi thành công cụ mà tác tử có thể gọi. Môi trường dùng dữ liệu đã ghi và chỉ hỗ trợ thay đổi khi bản ghi xác nhận tác động của thay đổi đó.
+
+Sau khi thiết lập REA trong tác tử, thay URL và các tác vụ thư mục bên dưới bằng thông tin của bạn:
+
+```text
+Dùng REA xây dựng môi trường RL từ ứng dụng web thử nghiệm của tôi tại
+http://127.0.0.1:3000.
+Bao gồm liệt kê, tạo, đổi tên và xóa thư mục. Có thể tạo và xóa
+thư mục thử nghiệm nhưng không thay đổi dữ liệu có sẵn.
+Lưu vào thư mục my-env, kiểm tra thao tác nào hoạt động và cho tôi biết cách chạy.
+```
+
+<details>
+<summary>Dùng dòng lệnh</summary>
+
+Dùng các lệnh này nếu đã có tệp ghi lại yêu cầu và phản hồi của ứng dụng trong trình duyệt. Để chạy môi trường tạo ra, bạn cũng cần AgentEnv và Docker.
+
+```sh
+rea environment-build ./session.har ./my-env --name my-env --json
+agent-env run ./my-env
+```
+
+</details>
+
+REA xuất môi trường chạy được cùng bài kiểm tra cơ bản để xác nhận môi trường khởi động và phản hồi. Kết nối với framework RL để đặt mục tiêu tác vụ, thêm kiểm tra phần thưởng và chạy huấn luyện.
+
+[Hướng dẫn xây dựng môi trường](https://rea.tools/guides/rl-environments/) ·
+[Tài liệu tham chiếu môi trường](../agent-environments.md) ·
+[Xem bản demo trên X](https://x.com/reatools/status/2112574822584918075?s=20)
+
 ## Câu hỏi thường gặp

 <details>
@@ -1,7 +1,7 @@
 <div align="center">

 [English](../../README.md) · [简体中文](README_zh.md) · **繁體中文** · [日本語](README_ja.md) · [한국어](README_ko.md) · [Türkçe](README_tr.md) · [Русский](README_ru.md) · [Tiếng Việt](README_vi.md) · [ไทย](README_th.md) · [Deutsch](README_de.md) · [Español](README_es.md) · [Français](README_fr.md) · [Українська](README_uk.md) · [Polski](README_pl.md) · [Português (Brasil)](README_pt-BR.md) · [العربية](README_ar.md) · [فارسی](README_fa.md) · [Bahasa Indonesia](README_id.md) · [Italiano](README_it.md)
-· [Ελληνικά](README_el.md) · [മലയാളം](README_ml.md) · [Roman Urdu](README_ur-Latn.md)
+· [Ελληνικά](README_el.md) · [മലയാളം](README_ml.md) · [Roman Urdu](README_ur-Latn.md) · [Română](README_ro.md)

 # REA：逆向一切

@@ -20,7 +20,7 @@

 **[網站](https://rea.tools/zh-TW/) · [指南](https://rea.tools/zh-TW/guides/) · [案例](https://rea.tools/zh-TW/showcase/)**

-[快速開始](#快速開始) · [REA 的工作原理](#rea-的工作原理) · [可以分析什麼](#可以分析什麼) · [案例](#案例) · [常見問題](#常見問題) · [GNU objdump 與 Rizin 工具](../reverse-engineering-tools.md) · [文件](#文件)
+[快速開始](#快速開始) · [REA 的工作原理](#rea-的工作原理) · [可以分析什麼](#可以分析什麼) · [案例](#案例) · [建立 RL 環境](#build-rl-environments) · [常見問題](#常見問題) · [GNU objdump 與 Rizin 工具](../reverse-engineering-tools.md) · [文件](#文件)

 <code>npx rea-agents setup</code>

@@ -160,6 +160,7 @@ REA 需要 Node.js 22.x（>=22.23.4）、24.x（>=24.22.1）或 26+ (>=26.12.1)
 | PE imports            | Import and delay-load DLL names, ordinals, IAT RVAs and pefile import hash   | Built-in static PE inspection; [PE imports](../pe-imports.md)                                                      |
 | ELF notes             | PT_NOTE/SHT_NOTE owners, types, GNU build-id and ABI-tag fields              | Built-in static ELF inspection; [ELF notes](../elf-notes.md)                                                       |
 | Apple IPS crashes     | .ips metadata, threads, images, registers and crash classes                  | Built-in static JSON inspection; [Apple IPS](../apple-ips.md)                                                      |
+| Linux kernel modules  | .modinfo keys, __versions CRCs, this_module presence, and signature trailer  | Built-in static ELF inspection; [kernel modules](../kernel-modules.md)                                             |
 | 已記錄的 Linux 崩潰   | 原始 note 記錄、每個已記錄執行緒的暫存器/訊號及可選的對映候選項              | Linux x64 上由呼叫方提供的 pwntools；可選的 GDB/pwndbg；[已記錄崩潰](../recorded-crashes.md)                       |
 | 桌面安裝目錄          | 執行階段候選、支持檔案、元件標記與後續操作                                   | 有界的目錄與檔頭檢查；[桌面應用](../desktop-applications.md)                                                       |
 | JavaScript / Electron | 模組、匯入、source map、路由、IPC 和原生附加元件關係                         | Node.js 和 npm；[應用分析](../javascript-application-workflows.md); Linux: procps `ps`                             |
@@ -222,8 +223,51 @@ REA 需要 Node.js 22.x（>=22.23.4）、24.x（>=24.22.1）或 26+ (>=26.12.1)
 [閱讀案例](https://rea.tools/zh-TW/showcase/th04/) ·
 [重建專案儲存庫](https://github.com/N0zoM1z0/th04)

+### 用 REA 建立 RL 環境
+
+錄製 Web 應用程式工作階段，將 API 轉為工具，並匯出 AI 代理可使用的環境。用 AgentEnv 執行，再加入任務與獎勵檢查，用於 RL 訓練或評測。
+
+[建立環境指南](https://rea.tools/guides/rl-environments/) ·
+[在 X 上觀看示範](https://x.com/reatools/status/2112574822584918075?s=20)
+
 如果你用 REA 分析了有趣的目標，我們很想瞭解。歡迎通過 [issue](https://github.com/morluto/rea/issues) 或 [pull request](https://github.com/morluto/rea/pulls) 分享案例，說明目標、你的問題、REA 如何提供幫助，以及你的發現。

+<a id="build-rl-environments"></a>
+
+## 建立 RL 環境
+
+為 AI 代理建立本機練習環境，讓它練習尋找 issue、建立資料夾等任務，無需執行原應用程式。這個環境可用於強化學習（RL），也可用於測試代理完成任務的能力。
+
+REA 將錄製的 API 請求與回應轉為代理可呼叫的工具。環境使用錄製的資料，只有錄製證據確認了某項修改的效果，才會支援該修改。
+
+在代理中設定好 REA 後，將下方範例的網址與資料夾任務替換為你自己的：
+
+```text
+使用 REA 為我的測試 Web 應用程式建立 RL 環境，網址是
+http://127.0.0.1:3000。
+涵蓋列出、建立、重新命名與刪除資料夾。可以建立和刪除測試資料夾，
+但不要修改既有資料。
+將環境儲存到名為 my-env 的資料夾。檢查哪些操作可用，並告訴我如何執行。
+```
+
+<details>
+<summary>改用命令列</summary>
+
+如果你已經將應用程式在瀏覽器中的請求與回應錄製成檔案，可以使用這些命令。執行產生的環境還需要 AgentEnv 與 Docker。
+
+```sh
+rea environment-build ./session.har ./my-env --name my-env --json
+agent-env run ./my-env
+```
+
+</details>
+
+REA 匯出可直接執行的環境，並附帶基本測試，檢查環境能否啟動與回應。將它接入 RL 框架，即可設定任務目標、加入獎勵檢查並執行訓練。
+
+[建立環境指南](https://rea.tools/guides/rl-environments/) ·
+[環境參考文件](../agent-environments.md) ·
+[在 X 上觀看示範](https://x.com/reatools/status/2112574822584918075?s=20)
+
 ## 常見問題

 <details>
@@ -1,7 +1,7 @@
 <div align="center">

 [English](../../README.md) · **简体中文** · [繁體中文](README_zh-TW.md) · [日本語](README_ja.md) · [한국어](README_ko.md) · [Türkçe](README_tr.md) · [Русский](README_ru.md) · [Tiếng Việt](README_vi.md) · [ไทย](README_th.md) · [Deutsch](README_de.md) · [Español](README_es.md) · [Français](README_fr.md) · [Українська](README_uk.md) · [Polski](README_pl.md) · [Português (Brasil)](README_pt-BR.md) · [العربية](README_ar.md) · [فارسی](README_fa.md) · [Bahasa Indonesia](README_id.md) · [Italiano](README_it.md)
-· [Ελληνικά](README_el.md) · [മലയാളം](README_ml.md) · [Roman Urdu](README_ur-Latn.md)
+· [Ελληνικά](README_el.md) · [മലയാളം](README_ml.md) · [Roman Urdu](README_ur-Latn.md) · [Română](README_ro.md)

 # REA：逆向一切

@@ -20,7 +20,7 @@

 **[网站](https://rea.tools/zh-CN/) · [指南](https://rea.tools/zh-CN/guides/) · [案例](https://rea.tools/zh-CN/showcase/)**

-[快速开始](#快速开始) · [REA 的工作原理](#rea-的工作原理) · [可以分析什么](#可以分析什么) · [案例](#案例) · [常见问题](#常见问题) · [GNU objdump 和 Rizin 工具](../reverse-engineering-tools.md) · [文档](#文档)
+[快速开始](#快速开始) · [REA 的工作原理](#rea-的工作原理) · [可以分析什么](#可以分析什么) · [案例](#案例) · [构建 RL 环境](#build-rl-environments) · [常见问题](#常见问题) · [GNU objdump 和 Rizin 工具](../reverse-engineering-tools.md) · [文档](#文档)

 <code>npx rea-agents setup</code>

@@ -160,6 +160,7 @@ REA 需要 Node.js 22.x（>=22.23.4）、24.x（>=24.22.1）或 26+ (>=26.12.1)
 | PE imports            | Import and delay-load DLL names, ordinals, IAT RVAs and pefile import hash   | Built-in static PE inspection; [PE imports](../pe-imports.md)                                                      |
 | ELF notes             | PT_NOTE/SHT_NOTE owners, types, GNU build-id and ABI-tag fields              | Built-in static ELF inspection; [ELF notes](../elf-notes.md)                                                       |
 | Apple IPS crashes     | .ips metadata, threads, images, registers and crash classes                  | Built-in static JSON inspection; [Apple IPS](../apple-ips.md)                                                      |
+| Linux kernel modules  | .modinfo keys, __versions CRCs, this_module presence, and signature trailer  | Built-in static ELF inspection; [kernel modules](../kernel-modules.md)                                             |
 | 已记录的 Linux 崩溃   | 原始 note 记录、每个已记录线程的寄存器/信号及可选的映射候选项                | Linux x64 上由调用方提供的 pwntools；可选的 GDB/pwndbg；[已记录崩溃](../recorded-crashes.md)                       |
 | 桌面安装目录          | 运行时候选、支持文件、组件标记和后续操作                                     | 有界的目录与文件头检查；[桌面应用](../desktop-applications.md)                                                     |
 | JavaScript / Electron | 模块、导入、source map、路由、IPC 和原生扩展关系                             | Node.js 和 npm；[应用分析](../javascript-application-workflows.md); Linux: procps `ps`                             |
@@ -222,8 +223,51 @@ REA 需要 Node.js 22.x（>=22.23.4）、24.x（>=24.22.1）或 26+ (>=26.12.1)
 [阅读案例](https://rea.tools/zh-CN/showcase/th04/) ·
 [重建项目仓库](https://github.com/N0zoM1z0/th04)

+### 用 REA 构建 RL 环境
+
+录制 Web 应用会话，将 API 转为工具，并导出 AI 智能体可使用的环境。用 AgentEnv 运行，再添加任务和奖励检查，用于 RL 训练或评测。
+
+[构建环境指南](https://rea.tools/guides/rl-environments/) ·
+[在 X 上观看演示](https://x.com/reatools/status/2112574822584918075?s=20)
+
 如果你用 REA 分析了有趣的目标，我们很想了解。欢迎通过 [issue](https://github.com/morluto/rea/issues) 或 [pull request](https://github.com/morluto/rea/pulls) 分享案例，说明目标、你的问题、REA 如何提供帮助，以及你的发现。

+<a id="build-rl-environments"></a>
+
+## 构建 RL 环境
+
+为 AI 智能体构建本地练习环境，让它练习查找 issue、创建文件夹等任务，无需运行原应用。这个环境可用于强化学习（RL），也可用于测试智能体完成任务的能力。
+
+REA 将录制的 API 请求和响应转为智能体可调用的工具。环境使用录制的数据，只有录制证据确认了某项修改的效果，才会支持该修改。
+
+在智能体中设置好 REA 后，将下面示例中的网址和文件夹任务替换为你自己的：
+
+```text
+使用 REA 为我的测试 Web 应用构建 RL 环境，网址是
+http://127.0.0.1:3000。
+覆盖列出、创建、重命名和删除文件夹。可以创建和删除测试文件夹，
+但不要修改已有数据。
+将环境保存到名为 my-env 的文件夹。检查哪些操作可用，并告诉我如何运行。
+```
+
+<details>
+<summary>改用命令行</summary>
+
+如果你已经将应用在浏览器中的请求和响应录制成文件，可以使用这些命令。运行生成的环境还需要 AgentEnv 和 Docker。
+
+```sh
+rea environment-build ./session.har ./my-env --name my-env --json
+agent-env run ./my-env
+```
+
+</details>
+
+REA 导出可直接运行的环境，并附带基本测试，检查环境能否启动和响应。将它接入 RL 框架，即可设置任务目标、添加奖励检查并运行训练。
+
+[构建环境指南](https://rea.tools/guides/rl-environments/) ·
+[环境参考文档](../agent-environments.md) ·
+[在 X 上观看演示](https://x.com/reatools/status/2112574822584918075?s=20)
+
 ## 常见问题

 <details>
@@ -112,6 +112,13 @@ creation or retry mutations. An internal GraphQL error does not establish API
 quota exhaustion or prove that query size caused the failure. Publication
 continues through the pinned release-please action.

+A nonzero manifest version must resolve to a GitHub release or tag before
+proposal history is collected. If publication has not created that boundary
+yet, preparation stops before opening or updating a PR; wait for publication
+before retrying. Missing manifest versions and `0.0.0` still allow an initial
+release. This prevents historical `Release-As` directives from being replayed
+as unreleased changes.
+
 When upgrading release-please, review the upstream manifest implementation,
 refresh the versioned patch and run the release proposal and workflow boundary
 tests. Version mismatch or a patch that neither applies cleanly nor matches an
@@ -94,6 +94,14 @@ Captured stdout and stderr are retained up to a 16 MiB combined limit; `output_t
 ## Cutter bridge

 Cutter commands use the local REA Python bridge and authenticated loopback messages.
+Discovery reads the session descriptors that the plugin publishes in the bridge
+directory. Set `REA_CUTTER_BRIDGE_DIR` in both REA's environment and the environment
+that starts Cutter to select a custom directory. Both expand `~` and `~/` paths
+against the current user's home, including `~\` paths on Windows. By default,
+they use `%LOCALAPPDATA%\REA\CutterBridge` on Windows when `LOCALAPPDATA` is set,
+and `~/.cache/rea/cutter-bridge` otherwise. The two processes must resolve the
+same directory for discovery to find the published sessions.
+
 The client and plugin must support the current v2 handshake; older peers are
 rejected before dispatch because they cannot preserve cross-caller recovery proof.
 The client checks the final encoded request against
@@ -83,7 +83,8 @@ empty dependency set. Retained views describe the captured artifact digest;
 they do not assert that the current file or running application is unchanged.

 ELF section names are resolved through the section-header string table.
-Zlib-compressed name tables are decoded within the native structural budget.
+Zlib- and Zstandard-compressed name tables are decoded within the native structural
+budget. Zstandard decoding also uses a 128 MiB window limit.
 If a name table uses unsupported compression, the result reports that
 limitation and leaves `.dep-v0` presence unknown rather than reporting the
 section absent.
@@ -0,0 +1,83 @@
+# Agent environment implementation index
+
+This index covers all 26 PRs authored by
+[earakely-scale](https://github.com/morluto/rea/pulls?q=is%3Apr+author%3Aearakely-scale)
+in `morluto/rea`, checked on 2026-10-25 against main
+`5d428390996498bc4dcca4da934641557f9109bc`. Twenty-five were merged; #5722
+was closed without merging. The table describes the resulting work rather
+than treating each original PR proposal as the current contract.
+
+Start with the [quickstart](../../agent-environments-quickstart.md) for a
+user workflow or the [reference](../../agent-environments.md) for current
+contracts. [Design issue #4933](https://github.com/morluto/rea/issues/4933)
+records the original four-part proposal. Its stateless replay description
+predates state serving and confirmed writes.
+
+## PR map
+
+All entries are merged unless marked otherwise. Verification links point
+to the corresponding slice's recorded checks, with their original versions,
+platforms, failures, and limitations.
+
+| PR                                                                   | Contribution                                                                                                                                                                                  | Verification                                                                                                                     |
+| -------------------------------------------------------------------- | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | -------------------------------------------------------------------------------------------------------------------------------- |
+| [#4954](https://github.com/morluto/rea/pull/4954)                    | Project HAR Evidence into an environment manifest with inferred tool templates and explicit unknowns.                                                                                         | [Manifest view](manifest-view/verification.md)                                                                                   |
+| [#4955](https://github.com/morluto/rea/pull/4955)                    | Add explicit streamable HTTP serving for REA MCP; stdio remains the default.                                                                                                                  | [HTTP transport](http-transport/verification.md)                                                                                 |
+| [#4975](https://github.com/morluto/rea/pull/4975)                    | Serve retained exchanges as MCP tools, with the environment card and replay data-plane stub.                                                                                                  | [Environment serve](environment-serve/verification.md)                                                                           |
+| [#4999](https://github.com/morluto/rea/pull/4999)                    | Export authenticated capture/manifest pairs as pinned AgentEnv bundles with a verifier and smoke task.                                                                                        | [Environment export](environment-export/verification.md)                                                                         |
+| [#5182](https://github.com/morluto/rea/pull/5182)                    | Accept browser-scenario Evidence as a manifest, serve, and export input.                                                                                                                      | [Scenario capture](scenario-capture/verification.md)                                                                             |
+| [#5293](https://github.com/morluto/rea/pull/5293)                    | Accept Evidence-file sources for richer captures and add opt-in sibling-pair path templating.                                                                                                 | [Rich captures](rich-captures/verification.md)                                                                                   |
+| [#5319](https://github.com/morluto/rea/pull/5319)                    | Extract initial entities, documents, and checked read plans with the environment-state view.                                                                                                  | [State view](state-view/verification.md)                                                                                         |
+| [#5351](https://github.com/morluto/rea/pull/5351)                    | Make state serving the default; add reset/load/get operations, replay fallback, and `--replay-only`.                                                                                          | [State serve](state-serve/verification.md)                                                                                       |
+| [#5352](https://github.com/morluto/rea/pull/5352)                    | Back more read shapes with state and describe tool responses and annotations.                                                                                                                 | [State coverage](state-coverage/verification.md)                                                                                 |
+| [#5600](https://github.com/morluto/rea/pull/5600)                    | Apply create, update, delete, and document effects only when later reads confirm them without contradiction.                                                                                  | [State writes](state-writes/verification.md)                                                                                     |
+| [#5664](https://github.com/morluto/rea/pull/5664)                    | Share inferred path positions across tools with opt-in `prefix-variance`, connecting literal writes to templated reads.                                                                       | [Prefix variance](prefix-variance/verification.md)                                                                               |
+| [#5699](https://github.com/morluto/rea/pull/5699)                    | Compare the environment offline against separately recorded probe sequences from the application.                                                                                             | [Fidelity compare](fidelity-compare/verification.md)                                                                             |
+| [#5722 (closed, unmerged)](https://github.com/morluto/rea/pull/5722) | Proposed independently reset recording sessions. The author closed it after six applications showed no held-out agreement gain; identified model gaps took priority.                          | [Closure explanation](https://github.com/morluto/rea/pull/5722#issuecomment-6305512072)                                          |
+| [#5787](https://github.com/morluto/rea/pull/5787)                    | Decide whole-list membership per request line so mixed filtered/unfiltered tools can show new entities.                                                                                       | [List lines](list-lines/verification.md)                                                                                         |
+| [#5800](https://github.com/morluto/rea/pull/5800)                    | Learn supported list filters, substring search, sorting, paging, and counters from recordings.                                                                                                | [List queries](list-queries/verification.md)                                                                                     |
+| [#6136](https://github.com/morluto/rea/pull/6136)                    | Explain copied or renamed values and regenerated scalar or nested UUIDs while withholding unsupported links.                                                                                  | [Assigned values](write-assigned-values/verification.md)                                                                         |
+| [#6138](https://github.com/morluto/rea/pull/6138)                    | Preserve the clock spelling and precision each read view shows after a write.                                                                                                                 | [View clock spelling](view-clock-spelling/verification.md)                                                                       |
+| [#6169](https://github.com/morluto/rea/pull/6169)                    | Handle bodiless write replies, proven omitted fields, projected reads, and digit-group sequences.                                                                                             | [Write coverage](write-coverage/verification.md)                                                                                 |
+| [#6385](https://github.com/morluto/rea/pull/6385)                    | Find more state targets, distinguish read-only POSTs, and handle variant views and differing create/read paths.                                                                               | [State targets](state-targets/verification.md)                                                                                   |
+| [#6897](https://github.com/morluto/rea/pull/6897)                    | Extend evidence-gated rules for bulk writes, item actions, generated values, query constraints, and ordering.                                                                                 | [Write rules](write-rules/verification.md)                                                                                       |
+| [#6929](https://github.com/morluto/rea/pull/6929)                    | Bound create learning and invalidate stale write proofs. The original branch also developed the one-step builder and coverage report, integrated through stacked #6946 before this PR merged. | [Build workflow and verification](environment-build/verification.md), [final PR scope](https://github.com/morluto/rea/pull/6929) |
+| [#6946](https://github.com/morluto/rea/pull/6946)                    | Complete the agent workflow with same-origin scenario request actions, `export_environment_bundle`, and recording instructions; integrate `environment-build` and coverage from its stack.    | [Environment from a prompt](environment-prompt/verification.md)                                                                  |
+| [#6967](https://github.com/morluto/rea/pull/6967)                    | Retain browser request timing so scenario-derived environments can learn write clocks.                                                                                                        | [Scenario timing](scenario-timing/verification.md)                                                                               |
+| [#7025](https://github.com/morluto/rea/pull/7025)                    | Explain composed response strings, trimmed fractional clocks, and generated integer identities.                                                                                               | [Derived values](write-derived-values/verification.md)                                                                           |
+| [#7034](https://github.com/morluto/rea/pull/7034)                    | Learn compatible create variations across calls, sorted echoes, referenced entities, and nested view projections.                                                                             | [Create calls](write-create-calls/verification.md)                                                                               |
+| [#7080](https://github.com/morluto/rea/pull/7080)                    | Reconcile lighter create responses with read-backs and learn re-derived slugs and clocks in whole-object updates.                                                                             | [Write views](write-views/verification.md)                                                                                       |
+
+Multi-session capture fusion from #5722 is not a shipped capability. Repeated
+calls inside one supported capture, as learned by #7034, are a separate feature.
+
+## Evidence to use when describing the feature
+
+The contributor's [example repository](https://github.com/earakely-scale/rea-environments)
+contains the original capture/export/evaluation pipeline and links to published
+bundles. Its Grafana row records 105 exchanges and 48 manifest tools, matching
+the capture count in the demo. The README describes an earlier replay workflow;
+its counts and model scores should remain attributed to that snapshot.
+
+The [prompt workflow verification](environment-prompt/verification.md) records
+five applications built by an agent from individual prompts: every exported
+bundle passed smoke, while three of the five served writes. Later
+[timing](scenario-timing/verification.md),
+[derived-value](write-derived-values/verification.md), and
+[create-call](write-create-calls/verification.md) work addresses specific gaps
+found in those recordings. The earlier write counts are not current limits.
+
+The [write-view verification](write-views/verification.md) records a later
+held-out round where 10 of 20 targeted write tools were served, up from 8.
+Its original census retained 132 served writes across 69 existing captures.
+These are source-reported measurements at the recorded revisions. The
+[merged PR's review follow-up](https://github.com/morluto/rea/pull/7080)
+explicitly says its real-application census and agent tasks were not rerun
+after the final fixes; the local CLI/MCP regressions cover those fixes.
+
+Smoke checks demonstrate bundle/framework compatibility for the tested
+configuration. Retrieval rewards demonstrate particular task outcomes.
+`environment-compare` measures agreement on recorded probes, with explicit
+normalizations and omissions. Keep these claims separate, and retain the
+version and coverage limits when quoting any result. This index is a source
+and PR review; it does not constitute a new real-application or benchmark run.
@@ -0,0 +1,25 @@
+# Plan
+
+1. Add `environmentCoverageView.ts`: the request schema, the result fields, the
+   hint per write reason (`satisfies Record<WriteReason, string>`), a
+   summarizer over state views and write plans, and the projector, which
+   projects the environment-state view and summarizes it. Register the kind in
+   the view unions, the grouping dispatch and the view service (state
+   accumulator, inferred confidence).
+2. Split the export's input read into `readEnvironmentExportFile` and
+   `environmentExportFile` (parse and seal bytes), both naming the calling
+   operation, and let the export take an already prepared state.
+3. Add `environmentBuild.ts`: classify the capture, project the manifest from
+   the in-memory Evidence, serialize it as `--format json` writes it to a file,
+   authenticate the pair from those bytes, name the environment, prepare the
+   state as the export does, summarize coverage, scan credential names, then
+   plan (dry run) or export. `environmentBuildReport.ts` holds the scan and the
+   naming helpers.
+4. Register `environment-build` in the CLI: inspect a HAR through the capture
+   service as `inspect-web-network-capture` does, or read Evidence once as the
+   export does, and log stages at info.
+5. Switch `scripts/verify-agentenv-environment.mjs` to the build command.
+6. Document the command, the report, the hints, what ships, and the view.
+7. Tests: coverage summary and hint completeness, the view against the state
+   view, build equivalence with the three-step path in process and through the
+   CLI, dry run, naming, refusals, the credential scan, and the view over MCP.