fix(python): validate shared pyc header facts

2026-11-10 17:30:32 -10:00 · 2026-11-10 21:41:05 -05:00
62 changed files with 204 additions and 1486 deletions
@@ -1,7 +1,5 @@
 # Changelog

-The next release changes analysis-setting output (#9885). `update_analysis_settings`, `inspect_analysis_settings`, and limit errors no longer include `rea_restart_required`, `restart_required`, `restartRequired`, or `effect`. Read `update_mode` (`runtime`, `restart`, or `parameter`) and `pending_restart`. `runtime` means the setter can change the active value. `restart` means this process keeps the value it started with. `parameter` means this call supplied the value, so `update_analysis_settings` cannot change it; artifact reader limits, web-network capture budgets, and an explicit `analysis_timeout_ms`, `max_heap_mb`, or `command_timeout_ms` use it. There is no compatibility alias. Release Please should copy this migration into that release's breaking-changes section.
-
 ## [6.8.0](https://github.com/morluto/rea/compare/rea-agents-6.7.0...rea-agents-6.8.0) (2026-10-25)

 ### Highlights
@@ -358,11 +358,6 @@ export const documentationSections = [
        source: "design/limits-and-recovery.md",
        route: "/design/limits-and-recovery",
      },
-      {
-        text: "REA limit inventory",
-        source: "design/rea-limit-inventory.md",
-        route: "/design/rea-limit-inventory",
-      },
      {
        text: "MCP tool design",
        source: "development/tool-design.md",
@@ -111,7 +111,6 @@ product pages. The VitePress documentation source is this `docs/` tree.
 ## Development and verification

 - [Settings and recovery](design/limits-and-recovery.md)
- [REA limit inventory](design/rea-limit-inventory.md)
 - [Flutter budget calibration](verification/flutter-budget-calibration.md)
 - [Source-map budget calibration](verification/source-map-budget-calibration.md)
 - [Source-location delivery qualification](verification/source-location-delivery.md)
@@ -5,9 +5,7 @@ who owns each value, when an update takes effect, how providers enforce it, and
 how to extend the system. The public tool contract is in
 [MCP contracts](../reference/mcp-contracts.md#editable-analysis-settings); recorded runtime
 checks and their limitations are in the
-[verification report](../verification/runtime-analysis-settings.md). The
-[limit inventory](rea-limit-inventory.md) lists every numeric `REA_` limit, which
-of them are runtime settings, and which stay restart-only.
+[verification report](../verification/runtime-analysis-settings.md).

 ## Problem and design boundary

@@ -257,8 +255,8 @@ are runtime-wide, not scoped to a target or an individual connection.
 ### Failure and retry

 An ASAR admission error supplies `details.limit` with the exact setting,
-effective value, units, bounds, scope, application point, `update_mode`,
-`pending_restart` and, when known, required bytes and value source. The agent can immediately call:
+effective value, units, bounds, scope, application point, restart requirement
+and, when known, required bytes and value source. The agent can immediately call:

 ```json
 {
@@ -275,27 +273,13 @@ that argument; raising a runtime default cannot override it.

 The resource owner constructs `details.limit` from the registry plus the budget
 it actually enforced. Metadata includes `agent_editable: true`,
-`scope: "rea-runtime"`, `update_mode`, and `pending_restart`. `update_mode`
-is `runtime` when `update_analysis_settings` can change the active value,
-`restart` when this process keeps the value it started with, and `parameter`
-when this call supplied the value. An explicit `analysis_timeout_ms`,
-`max_heap_mb`, or `command_timeout_ms`, plus artifact reader limits and
-web-network capture budgets, use `parameter`. `pending_restart` is false when
-that reported value is the one this process is using. Optional
+`scope: "rea-runtime"`, and `rea_restart_required: false`. Optional
 `required_value`, `source`, and `parameter` fields are supplied only where known
 or applicable. Do not infer a source because a value happens to equal a default.
 Error copying, attribution, redaction, and delivery must preserve these facts.
 Human-readable remediation explains the same failure; clients should not need
 to parse that sentence to identify an editable setting.

-This output is breaking. Results and errors no longer carry the previous
-restart boolean or a single effect field, and there is no compatibility alias.
-Read `update_mode` to see whether the setter can change the active value, and
-`pending_restart` to see whether a configured value is waiting. A configuration
-error for a Windows ChangeTime setting carries those two fields on
-`details.settings`, not only in the constraint sentence. The removed field names
-are listed in the changelog.
-
 `scope` and `applies_at` describe a continuing caller, such as an MCP
 connection. A one-shot invocation, such as a CLI command, has released its
 provider session and exited its runtime before its caller reads the failure,
@@ -304,10 +288,8 @@ so its adapter projects with an explicit `"invocation"` caller lifetime.
 `scope: "rea-invocation"`, `applies_at: "next_invocation"` and the launch
 `environment` seed when one exists. `agent_editable: true` still holds, because
 the caller chooses that environment value or per-call `parameter` for the new
-invocation; `update_mode: "runtime"` and `pending_restart: false` mean the
-reported value is active in this process. `update_mode: "restart"` means
-`update_analysis_settings` does not change it. `update_mode: "parameter"` means
-this call supplied the value. A producer keeps guidance that holds only while its caller retains the
+invocation; `rea_restart_required: false` means no running REA process needs a
+restart. A producer keeps guidance that holds only while its caller retains the
 session, such as "the Ghidra session remains usable" or a same-session runtime
 update, in `continuingCallerGuidance`; the shared presentation adds it only for
 a continuing caller. The producer's own message and remediation must stay true
@@ -517,10 +499,7 @@ own `expanded_bytes` controls its independently enforced bundle expansion.

 Failures preserve `details.reader_limit` with the exact parameter, effective
 value, units, supported range, required value when known, next-call scope and
-`can_increase`. `update_mode` is `parameter`: the caller selects the value on
-the next call, and `update_analysis_settings` does not accept it.
-`pending_restart` is false. Web-network capture budgets use the same mode.
-When `can_increase` is true, raise that field and retry the same
+`can_increase`. When `can_increase` is true, raise that field and retry the same
 complete artifact. At the supported maximum, or when the required representation
 exceeds it, the failure is not retryable by increasing that budget; inspect the
 declared dimensions and input validity, or explicitly choose a suitable reader.
@@ -1,229 +0,0 @@
-# REA limit inventory
-
-Audit for [#9881](https://github.com/morluto/rea/issues/9881). Counts below are
-from this revision of `src`. A numeric `REA_` limit is a name under `src` (tests
-excluded) that carries a byte, time, count, heap, budget, deadline, or maximum.
-`scripts/verify/rea-numeric-limits.mjs` fails the static checks when one of those
-names is neither an environment seed of
-[`ANALYSIS_SETTINGS`](https://github.com/morluto/rea/blob/main/src/domain/analysisSettingDefinitions.ts) nor an
-entry in [`numericLimitRegistry.ts`](https://github.com/morluto/rea/blob/main/src/domain/numericLimitRegistry.ts)
-with a reason.
-
-`update_mode` is `runtime` when `update_analysis_settings` can change the active
-value, `restart` when this process keeps the value it started with, and
-`parameter` when this call supplied the value.
-`pending_restart` is true only when a configured value is not the one this
-process is using. A rejected Windows ChangeTime launch value is not active, so
-that failure reports `pending_restart: true`. Every other value reported here
-is the one in force, so `pending_restart` is false. Prose that only says to
-restart REA is marked `prose`. `mcp_server_restart_required` is a
-server-identity alignment state in `src/serverIdentity.ts`, not a setting field.
-
-Three numeric limits are absent from this tree and are being moved into the
-runtime system on their own PRs. This audit does not change them:
-
-| Name                                         | Tracking |
-| -------------------------------------------- | -------- |
-| `REA_NTFS_MFT_MAX_FILE_BYTES`                | #9868    |
-| `REA_REGF_HIVE_MAX_FILE_BYTES`               | #9865    |
-| `REA_WEB_BUNDLE_ENDPOINT_LITERAL_CANDIDATES` | #9836    |
-
-When those names land in `src`, the static check requires them to be analysis
-settings. They are not on the restart-only list.
-
-## Counts
-
-| Category                                                              |                                                                        Count |
-| --------------------------------------------------------------------- | ---------------------------------------------------------------------------: |
-| Runtime analysis settings                                             |                  17 (14 have an `REA_` seed; 3 are per-call parameters only) |
-| Per-call numeric `REA_` limits still read from the launch environment |                                                                           11 |
-| Restart-only numeric `REA_` limits                                    |                                                                           15 |
-| Numeric `REA_` names discovered in `src`                              |                                                                           40 |
-| Non-numeric `REA_` settings kept restart-only                         | 53 caller settings, plus process-protocol names that are not caller settings |
-| Hardcoded ceilings left for follow-up                                 |                        grouped below; none converted in the inventory change |
-
-## Runtime analysis settings
-
-Already adjustable with `update_analysis_settings`. Each call reads the snapshot
-accepted for that operation. Launch source is `default` or `setting`; a runtime
-override is `source: "runtime"`. The structured field is `update_mode: "runtime"` and `pending_restart: false`.
-`applies_at` is the finer point
-(`next_operation`, `next_worker`, or `next_startup`).
-
-| Setting                                      | Environment seed                                 | Owner                                                         | Default                                   |            Floor |                                Maximum | Read                  |
-| -------------------------------------------- | ------------------------------------------------ | ------------------------------------------------------------- | ----------------------------------------- | ---------------: | -------------------------------------: | --------------------- |
-| `asar.max_header_bytes`                      | `REA_ASAR_MAX_HEADER_BYTES`                      | `src/domain/analysisResourceLimits.ts`                        | 16777216                                  |                1 |                              268435456 | per operation         |
-| `asar.max_listing_bytes`                     | `REA_ASAR_MAX_LISTING_BYTES`                     | `src/domain/analysisResourceLimits.ts`                        | 67108864                                  |                1 |              `Number.MAX_SAFE_INTEGER` | per operation         |
-| `ghidra.value_flow_max_operations`           | `REA_GHIDRA_VALUE_FLOW_MAX_OPERATIONS`           | `src/domain/analysisResourceLimits.ts`                        | 3000                                      |                1 |                             2147483647 | per operation         |
-| `ghidra.value_flow_max_inputs_per_operation` | `REA_GHIDRA_VALUE_FLOW_MAX_INPUTS_PER_OPERATION` | `src/domain/analysisResourceLimits.ts`                        | 64                                        |                1 |                             2147483647 | per operation         |
-| `ghidra.value_flow_max_edges`                | `REA_GHIDRA_VALUE_FLOW_MAX_EDGES`                | `src/domain/analysisResourceLimits.ts`                        | 12000                                     |                1 |                             2147483647 | per operation         |
-| `ghidra.decompile_max_payload_mib`           | `REA_GHIDRA_DECOMPILE_MAX_PAYLOAD_MIB`           | `src/domain/analysisResourceLimits.ts`                        | unset (`null`, unbounded payload policy)  |                1 |                                   2047 | per operation         |
-| `ghidra.startup_timeout_ms`                  | `REA_GHIDRA_STARTUP_TIMEOUT_MS`                  | `src/domain/analysisResourceLimits.ts`                        | 330000                                    |                1 |                             2147483647 | next provider startup |
-| `hopper.startup_timeout_ms`                  | `REA_HOPPER_STARTUP_TIMEOUT_MS`                  | `src/domain/analysisResourceLimits.ts`                        | 120000                                    |                1 |                             2147483647 | next provider startup |
-| `ghidra.decompile_timeout_seconds`           | `REA_GHIDRA_DECOMPILE_TIMEOUT_SECONDS`           | `src/domain/analysisResourceLimits.ts`                        | unset (`null`, decompile stays unbounded) |                1 | `MAX_GHIDRA_DECOMPILE_TIMEOUT_SECONDS` | per operation         |
-| `jadx.operation_timeout_ms`                  | `REA_JADX_OPERATION_TIMEOUT_MS`                  | `src/domain/analysisResourceLimits.ts`                        | 120000                                    |                1 |                             2147483647 | per operation         |
-| `regex.matching_deadline_ms`                 | `REA_REGEX_MATCHING_DEADLINE_MS`                 | `src/domain/analysisResourceLimits.ts`                        | 5000                                      |                1 |                             2147483647 | per operation         |
-| `regex.worker_heap_request_mib`              | `REA_REGEX_WORKER_HEAP_REQUEST_MIB`              | `src/domain/analysisResourceLimits.ts`                        | 128                                       |                7 |                                  16384 | next worker           |
-| `capture.decoder_old_generation_mib`         | `REA_CAPTURE_DECODER_OLD_GENERATION_MIB`         | `src/domain/analysisResourceLimits.ts`                        | 192                                       | semi-space floor |                                  16384 | next worker           |
-| `javascript.analysis_timeout_ms`             | none (`analysis_timeout_ms`)                     | `src/domain/javascript/javascriptAnalysisResourceControls.ts` | owner default                             |                1 |                             2147483647 | per operation         |
-| `javascript.max_heap_mb`                     | none (`max_heap_mb`)                             | `src/domain/javascript/javascriptAnalysisResourceControls.ts` | owner default                             |      owner floor |                          owner maximum | next worker           |
-| `wasm.command_timeout_ms`                    | none (`command_timeout_ms`)                      | `src/domain/wasm/wasmArtifact.ts`                             | owner default                             |                1 |                          owner maximum | per operation         |
-| `native.matching_representation_bytes`       | `REA_NATIVE_MATCHING_REPRESENTATION_BYTES`       | `src/domain/analysisResourceLimits.ts`                        | 100663296                                 |                1 |                             1073741824 | per operation         |
-
-An out-of-range `update_analysis_settings` value is rejected by the setting's
-schema. Invalid launch seeds that the global environment parser accepts as
-provider-local stay inspectable with `source: "invalid"`.
-
-## Per-call limits still outside the runtime system
-
-These are checked when the work runs. They keep the `REA_` variable, default,
-floor, and maximum, and the migration reads the accepted snapshot instead of a
-value copied at process start. Until that lands they are `policy: "per-call"` in
-the registry so the static check still requires a reason.
-
-| Environment                                | Owner                                       |                 Default | Floor |    Maximum | Read today                                                                            | Restart field                                                                   |
-| ------------------------------------------ | ------------------------------------------- | ----------------------: | ----: | ---------: | ------------------------------------------------------------------------------------- | ------------------------------------------------------------------------------- |
-| `REA_BRIDGE_MAX_REQUEST_BYTES`             | `src/config/bridgeMaxRequestBytes.ts`       |                16777216 |  7464 |  536870887 | each bridge request, from the launch value                                            | prose                                                                           |
-| `REA_DEBUGGER_COMMAND_DEADLINE_MS`         | `src/domain/analysisResourceLimits.ts`      |                  120000 |     1 | 2147483647 | copied when the debugger manager is constructed; applied to each command              | `update_mode: "restart"` and `pending_restart: false`                           |
-| `REA_DEBUGGER_MAX_COMMAND_OUTPUT_BYTES`    | `src/domain/analysisResourceLimits.ts`      |                16777216 |     1 |   89303718 | copied when the debugger manager is constructed; applied to each command              | `update_mode: "restart"` and `pending_restart: false`                           |
-| `REA_HOPPER_CALLER_SCAN_BUDGET_MS`         | `src/domain/analysisResourceLimits.ts`      |                    2000 |     1 | 2147483647 | each caller-scan operation, from config resolved at launch                            | prose                                                                           |
-| `REA_JEB_MCP_TIMEOUT_MS`                   | `src/jeb/JebMcpConnection.ts`               | 60000 (MCP SDK default) |     1 | 2147483647 | captured when the JEB connection is created; applied to discovery and each tools/call | prose                                                                           |
-| `REA_KUNA_PROJECT_TIMEOUT_MS`              | `src/kuna/KunaConfiguration.ts`             |                 1800000 |     1 | 2147483647 | project export and whole-program scans, from the launch configuration                 | prose                                                                           |
-| `REA_KUNA_TIMEOUT_MS`                      | `src/kuna/KunaConfiguration.ts`             |                  120000 |     1 | 2147483647 | each function decompile, from the launch configuration                                | prose                                                                           |
-| `REA_PWNTOOLS_MAX_INPUT_BYTES`             | `src/native/pwntools/PwntoolsInputLimit.ts` |                33554432 |     1 | 1073741824 | each pwntools decode, unless the call passes `producer_limits.input_bytes`            | prose                                                                           |
-| `REA_WINDOWS_CHANGE_TIME_DRIFT_MS`         | `src/config/windowsChangeTimeSettle.ts`     |                    2000 |     1 |      60000 | each ChangeTime observation                                                           | `update_mode: "restart"` and `pending_restart: true` on an invalid launch value |
-| `REA_WINDOWS_CHANGE_TIME_SETTLE_POLL_MS`   | `src/config/windowsChangeTimeSettle.ts`     |                      25 |     1 |       1000 | each ChangeTime observation                                                           | `update_mode: "restart"` and `pending_restart: true` on an invalid launch value |
-| `REA_WINDOWS_CHANGE_TIME_SETTLE_MAX_POLLS` | `src/config/windowsChangeTimeSettle.ts`     |                      40 |     1 |       1000 | each ChangeTime observation                                                           | `update_mode: "restart"` and `pending_restart: true` on an invalid launch value |
-
-## Restart-only numeric limits
-
-These stay out of `update_analysis_settings`.
-
-| Environment                         | Owner                                  |             Default |    Floor |                   Maximum | Read                                        | Why restart-only                                                                                            |
-| ----------------------------------- | -------------------------------------- | ------------------: | -------: | ------------------------: | ------------------------------------------- | ----------------------------------------------------------------------------------------------------------- |
-| `REA_DEBUGGER_MAX_PENDING_COMMANDS` | `src/domain/analysisResourceLimits.ts` |                  16 |        1 |                       256 | debugger manager construction               | Queue capacity of the manager created at startup. `update_mode: "restart"` and `pending_restart: false`.    |
-| `REA_DEBUGGER_MAX_SESSIONS`         | `src/domain/analysisResourceLimits.ts` |                   8 |        1 |                        64 | debugger manager construction               | Session-pool size of the manager created at startup. `update_mode: "restart"` and `pending_restart: false`. |
-| `REA_HOPPER_DEMO_DIALOG_TIMEOUT_MS` | `src/domain/hopperStartupFailure.ts`   |               10000 |        1 |                2147483647 | Linux private-display adapter start         | The helper reads the process environment. Prose restart.                                                    |
-| `REA_JADX_ACTIVE_PROCESSOR_COUNT`   | `src/android/JadxConfiguration.ts`     | unset (JVM default) |        1 |                2147483647 | JADX JVM launch                             | `-XX:ActiveProcessorCount` is fixed for that JVM. Prose on invalid values.                                  |
-| `REA_JADX_HEAP_MIB`                 | `src/android/JadxConfiguration.ts`     | unset (JVM default) |        1 | `Number.MAX_SAFE_INTEGER` | JADX JVM launch                             | `-Xmx` is fixed for that JVM. Prose on invalid values.                                                      |
-| `REA_KUNA_CACHE_MAX_BYTES`          | `src/kuna/KunaConfiguration.ts`        |          4294967296 |  1048576 | `Number.MAX_SAFE_INTEGER` | Kuna cache construction                     | The cache is sized once for the provider. Prose restart.                                                    |
-| `REA_KUNA_JOBS`                     | `src/kuna/KunaConfiguration.ts`        |                   1 |        1 |                        32 | Kuna run-slot construction                  | Worker-pool width for the provider. Prose restart.                                                          |
-| `REA_MCP_DOCTOR_DEADLINE_MS`        | `src/config/mcpStartupBudgets.ts`      |               30000 |        1 |                2147483647 | MCP server startup                          | Startup phase of the MCP server itself. Prose.                                                              |
-| `REA_MCP_FIRST_CATALOG_BUDGET_MS`   | `src/config/mcpStartupBudgets.ts`      |               20000 |        1 |                2147483647 | MCP server startup                          | Startup phase of the MCP server itself. Prose.                                                              |
-| `REA_MCP_INITIALIZE_BUDGET_MS`      | `src/config/mcpStartupBudgets.ts`      |               15000 |        1 |                2147483647 | MCP server startup                          | Startup phase of the MCP server itself. Prose.                                                              |
-| `REA_MCP_MAX_INPUT_ELEMENTS`        | `src/config/mcpInputBudget.ts`         |                1024 |        1 | `Number.MAX_SAFE_INTEGER` | MCP server creation                         | Argument admission for the server process. Prose restart.                                                   |
-| `REA_MCP_MAX_RESPONSE_BYTES`        | `src/config/mcpResponseBudget.ts`      | 10485760 when unset | 10485760 | `Number.MAX_SAFE_INTEGER` | MCP server creation                         | Stdio receive buffer and the paired client buffer. Prose restart.                                           |
-| `REA_MCP_TOOLS_LIST_BUDGET_MS`      | `src/config/mcpStartupBudgets.ts`      |                5000 |        1 |                2147483647 | MCP server startup                          | Startup phase of the MCP server itself. Prose.                                                              |
-| `REA_RECONNECT_TIMEOUT_SECONDS`     | `src/hopper/BridgeLauncher.ts`         |                  30 |       30 |                        30 | written into the Hopper bridge helper       | Not a caller setting. It is `HOPPER_SHUTDOWN_TIMEOUT_MS / 1000`.                                            |
-| `REA_SWIFTC_COMPILE_TIMEOUT_MS`     | `src/config/providerStartupTimeout.ts` |              120000 |        1 |                2147483647 | Darwin ownership-helper reader construction | Captured at process start for that helper compile. Prose restart.                                           |
-
-## Restart-only non-numeric settings
-
-No floor or maximum. They are read from the launch environment (startup). None of them set `effect`. Recovery text tells the caller to change the launch
-environment, which takes effect on the next process. They stay
-restart-only because they choose a command, a binary, a filesystem root, the
-browser sandbox, secret patterns, the provider, or the shape of the MCP server
-or logger.
-
-| Name                                 | Owner                                              | Why                                         |
-| ------------------------------------ | -------------------------------------------------- | ------------------------------------------- |
-| `REA_ADB_PATH`                       | `src/adb/AdbConfiguration.ts`                      | Caller-selected executable path.            |
-| `REA_AGENT_ENV_COMMAND`              | `src/application/DesktopBuildDoctor.ts`            | Caller-selected command.                    |
-| `REA_ANALYSIS_PROVIDER`              | `src/config/environment.ts`                        | Provider choice for the process.            |
-| `REA_APKTOOL_COMMAND`                | `src/apktool/ApktoolConfiguration.ts`              | Caller-selected command.                    |
-| `REA_BINWALK_COMMAND`                | `src/application/SetupRegistrationEnvironment.ts`  | Caller-selected command.                    |
-| `REA_BROWSER_EXECUTABLE`             | `src/application/CapabilityInventory.ts`           | Caller-selected browser binary.             |
-| `REA_BROWSER_NO_SANDBOX`             | `src/application/SetupRegistrationEnvironment.ts`  | Browser sandbox policy.                     |
-| `REA_CAPINFOS_COMMAND`               | `src/pcap/PcapConfiguration.ts`                    | Caller-selected command.                    |
-| `REA_CUTTER_BRIDGE_DIR`              | `src/application/SetupRegistrationEnvironment.ts`  | Filesystem root for the Cutter bridge.      |
-| `REA_DARWIN_MODULE_CACHE_PATH`       | `src/application/SetupRegistrationEnvironment.ts`  | Filesystem path for the Swift module cache. |
-| `REA_DARWIN_SWIFTC_PATH`             | `src/application/SetupRegistrationEnvironment.ts`  | Caller-selected compiler path.              |
-| `REA_DCONF_COMMAND`                  | `src/desktop/DconfDatabaseReader.ts`               | Caller-selected command.                    |
-| `REA_DOCKER_COMMAND`                 | `src/application/DesktopBuildDoctor.ts`            | Caller-selected command.                    |
-| `REA_ELECTRON_CAPTURE_ARGV`          | `src/browser/PlaywrightElectronActiveProvider.ts`  | Caller-selected process arguments.          |
-| `REA_EVM_PRLIMIT_COMMAND`            | `src/application/SetupRegistrationEnvironment.ts`  | Caller-selected command.                    |
-| `REA_FIRMWARE_PRLIMIT_COMMAND`       | `src/application/SetupRegistrationEnvironment.ts`  | Caller-selected command.                    |
-| `REA_GDB_COMMAND`                    | `src/application/SetupRegistrationEnvironment.ts`  | Caller-selected debugger binary.            |
-| `REA_GHIDRA_CHECKPOINT_DIR`          | `src/config/environment.ts`                        | Filesystem root.                            |
-| `REA_GHIDRA_COMPILER_SPEC_ID`        | `src/config/environment.ts`                        | Provider analysis choice.                   |
-| `REA_GHIDRA_DISABLED_ANALYZERS`      | `src/config/environment.ts`                        | Provider analysis choice.                   |
-| `REA_GHIDRA_LANGUAGE_ID`             | `src/config/environment.ts`                        | Provider analysis choice.                   |
-| `REA_GHIDRA_NATIVEAOT_JAR`           | `src/config/environment.ts`                        | Caller-selected binary path.                |
-| `REA_GHIDRA_PROGRAM_NAME`            | `src/config/environment.ts`                        | Provider project selection.                 |
-| `REA_GHIDRA_PROJECT_PATH`            | `src/config/environment.ts`                        | Filesystem root.                            |
-| `REA_GHIDRA_SEED_FILE`               | `src/config/environment.ts`                        | Filesystem path.                            |
-| `REA_IDA_MCP_CONFIG`                 | `src/config/environment.ts`                        | Filesystem path of the IDA MCP config.      |
-| `REA_ILSPY_CMD_PATH`                 | `src/config/environment.ts`                        | Caller-selected executable path.            |
-| `REA_JADX_MCP_JAR`                   | `src/android/JadxConfiguration.ts`                 | Caller-selected binary path.                |
-| `REA_JAVASCRIPT_PRLIMIT_COMMAND`     | `src/application/SetupRegistrationEnvironment.ts`  | Caller-selected command.                    |
-| `REA_JEB_MCP_URL`                    | `src/config/environment.ts`                        | Provider endpoint.                          |
-| `REA_KUNA_CACHE_DIR`                 | `src/kuna/KunaConfiguration.ts`                    | Filesystem root.                            |
-| `REA_KUNA_COMMAND`                   | `src/kuna/KunaConfiguration.ts`                    | Caller-selected executable path.            |
-| `REA_LOG_LEVEL`                      | `src/config/environment.ts`                        | Logger configuration for the process.       |
-| `REA_MANAGED_LINUX_HOPPER_LAUNCHER`  | `src/application/HopperLauncherDiscovery.ts`       | Caller-selected launcher path.              |
-| `REA_MCP_INPUT_SCHEMA_PROFILE`       | `src/config/environment.ts`                        | MCP server schema shape.                    |
-| `REA_MCP_OUTPUT_SCHEMA_PROFILE`      | `src/config/environment.ts`                        | MCP server schema shape.                    |
-| `REA_MCP_TOOL_CATALOG_PROFILE`       | `src/config/environment.ts`                        | MCP server catalog shape.                   |
-| `REA_MCP_TOOL_FAMILIES`              | `src/config/environment.ts`                        | Which tools the MCP server registers.       |
-| `REA_MITMDUMP_COMMAND`               | `src/application/SetupRegistrationEnvironment.ts`  | Caller-selected command.                    |
-| `REA_OBJDUMP_COMMAND`                | `src/application/SetupRegistrationEnvironment.ts`  | Caller-selected command.                    |
-| `REA_PWNDBG_GDB`                     | `src/native/pwndbg/PwndbgCoreContext.ts`           | Caller-selected debugger binary.            |
-| `REA_PWNDBG_GDBINIT`                 | `src/native/pwndbg/PwndbgCoreContext.ts`           | Caller-selected file path.                  |
-| `REA_PWNDBG_VENV_PATH`               | `src/native/pwndbg/PwndbgCoreContext.ts`           | Filesystem root.                            |
-| `REA_PWNTOOLS_PYTHON`                | `src/native/pwntools/PwntoolsDecoder.ts`           | Caller-selected interpreter path.           |
-| `REA_REFERENCE_SECRET_PATTERNS_JSON` | `src/config/environment.ts`                        | Secret-pattern policy.                      |
-| `REA_RIZIN_COMMAND`                  | `src/rizin/RizinDebugSessionManager.ts`            | Caller-selected debugger binary.            |
-| `REA_SIGROK_COMMAND`                 | `src/signals/SigrokRecordingProvider.ts`           | Caller-selected command.                    |
-| `REA_SIGROK_PRLIMIT_COMMAND`         | `src/signals/SigrokRecordingProvider.ts`           | Caller-selected command.                    |
-| `REA_TSHARK_COMMAND`                 | `src/pcap/PcapConfiguration.ts`                    | Caller-selected command.                    |
-| `REA_TSHARK_PRLIMIT_COMMAND`         | `src/pcap/PcapNativeBound.ts`                      | Caller-selected command.                    |
-| `REA_UNBLOB_COMMAND`                 | `src/application/SetupRegistrationEnvironment.ts`  | Caller-selected command.                    |
-| `REA_WABT_BIN_DIRECTORY`             | `src/wasm/WabtArtifactProvider.ts`                 | Filesystem root of the WABT tools.          |
-| `REA_WAKARU_COMMAND`                 | `src/application/SetupRegistrationEnvironment.ts`  | Caller-selected command.                    |
-| `REA_WORKFLOW_PROVIDER`              | `src/application/DirectAnalysis.ts`                | Provider choice.                            |
-| `REA_XPROP_COMMAND`                  | `src/application/desktop/DesktopCaptureFailure.ts` | Caller-selected command.                    |
-
-Names that look like `REA_` but are process protocol, not caller settings:
-`REA_BUILD_COMMIT`, `REA_BUILD_COMPUTER_REA_ARCHIVE`, `REA_INSTALL_SCRIPT`,
-`REA_OWNS_PROCESS_LIFETIME`, `REA_PAYLOAD`, `REA_PROCESS_RUN_ID`, `REA_RUN_ID`,
-`REA_SOCKET`, `REA_STATE_FORMAT`, `REA_TARGET_PATH`, `REA_TOKEN`, bridge markers
-such as `REA_COMMAND_COMPLETE_`, and the `ERR_REA_WINDOWS_NATIVE` code.
-`GHIDRA_INSTALL_DIR`, `JAVA_HOME`, `HOPPER_LAUNCHER_PATH`, `HOPPER_TARGET_PATH`,
-`HOPPER_TARGET_KIND`, and `HOPPER_LOADER_ARGS_JSON` are launch configuration
-without the `REA_` prefix. Paths and the provider choice among them stay
-restart-only for the same reason as the table above.
-
-## Hardcoded ceilings left for follow-up
-
-These are checked per call and tell the caller this release has no runtime
-override. They are not `REA_` settings, so the numeric-limit check does not
-list them. Each family has its own owner. Turning one into a setting needs that
-owner's default, floor, maximum, and an error that carries the setting id,
-value, source, and range. Format and protocol ceilings that the
-[limits guide](limits-and-recovery.md) already calls fixed stay fixed. In
-particular, JSON nesting stops at `MAX_JSON_DEPTH` (1000) and the debugger
-control-reply budget stays separate from
-`REA_DEBUGGER_MAX_COMMAND_OUTPUT_BYTES`.
-
-| Family                                           | Examples                                                                                                     | Follow-up                                                                                   |
-| ------------------------------------------------ | ------------------------------------------------------------------------------------------------------------ | ------------------------------------------------------------------------------------------- |
-| Native structural input ceilings                 | PE resources, imports, load config, certificates, exports, initializers, binary hardening, Windows shortcuts | One setting per ceiling, or a shared input budget only where the owners match.              |
-| Native plist                                     | `MAX_NATIVE_PLIST_BYTES`, decode bytes, nesting depth                                                        | Separate from JSON depth.                                                                   |
-| SQLite inspection                                | concurrent inspections, input bytes, diagnostic bytes                                                        | Pool width stays restart-only if it sizes the worker set; byte budgets can become settings. |
-| Producer command allowances                      | fixed command deadline and retained output where the text says there is no runtime override                  | Distinct from per-call `producer_limits`.                                                   |
-| Hopper caller-scan retention and page allowances | `HOPPER_CALLER_SCAN_RETENTION_BYTES`, `HOPPER_CALLER_PAGE_ALLOWANCE_BYTES`                                   | Explicitly not raised by the scan time budget.                                              |
-| Rizin frame protocol                             | `MAX_FRAME_BYTES`, queued frames                                                                             | Protocol bounds, not caller budgets.                                                        |
-| Debugger detach and control replies              | `DETACH_TIMEOUT_MS`, `DEBUGGER_CONTROL_REPLY_BYTES`                                                          | Ownership deadlines, not the shared command deadline.                                       |
-| Web network capture nesting                      | `max_nesting_depth` already has a per-call parameter                                                         | The fixed depth maximum is the follow-up, not the parameter.                                |
-
-## Static check
-
-`npm run lint` runs `scripts/verify/rea-numeric-limits.mjs` after
-dependencies are installed. `scripts/verify/architecture-guards.mjs` runs the
-same check when `typescript6` is already installed; the pre-install CI step
-cannot. The check scans `src` excluding tests,
-keeps names that are numeric limits, and requires each name to be an
-`environment` on an analysis setting or a registry entry with a reason.
-`policy: "per-call"` is temporary. The migration that moves the limit deletes
-the entry and rejects any new `per-call` policy so the durable exceptions are
-only `restart-only`.
@@ -148,7 +148,7 @@
    "build:termux:run": "npm run compile:termux && npm run artifacts:skills",
    "format": "oxfmt .",
    "format:check": "oxfmt --check .",
-    "lint": "node scripts/ci/static-check-report.mjs lint && npm run verify:module-boundaries && node scripts/verify/rea-numeric-limits.mjs",
+    "lint": "node scripts/ci/static-check-report.mjs lint && npm run verify:module-boundaries",
    "lint:details": "oxlint && npm run verify:module-boundaries",
    "lint:fix": "oxlint --fix && npm run verify:module-boundaries",
    "knip": "knip --cache",
@@ -1,5 +1,3 @@
-import { spawnSync } from "node:child_process";
-import { existsSync } from "node:fs";
 import { readFile, readdir } from "node:fs/promises";
 import { join, relative, sep } from "node:path";
 import { fileURLToPath } from "node:url";
@@ -195,23 +193,4 @@ if (failures.length > 0) {
  console.error(`Architecture guards failed:\n\n${failures.join("\n\n")}\n`);
  process.exit(1);
 }
-// CI runs this file before `npm ci`. The numeric-limit parser needs
-// typescript6, so that check waits until dependencies exist. `npm run lint`
-// runs it after install.
-const typescript6 = new URL(
-  "../../node_modules/typescript6/package.json",
-  import.meta.url,
-);
-if (!existsSync(typescript6)) {
-  console.log(
-    "Numeric REA_ limit check waits until dependencies are installed.",
-  );
-} else {
-  const numericLimits = spawnSync(
-    process.execPath,
-    [fileURLToPath(new URL("./rea-numeric-limits.mjs", import.meta.url))],
-    { stdio: "inherit" },
-  );
-  if (numericLimits.status !== 0) process.exit(numericLimits.status ?? 1);
-}
 console.log(`Architecture guards passed across ${files.length} source files.`);
@@ -1,23 +0,0 @@
-/** Relative path of the registry. Its text is a declaration, not a producer. */
-export const NUMERIC_LIMIT_DECLARATION: "src/domain/numericLimitRegistry.ts";
-
-/** Limits that must become analysis settings and cannot be registry exceptions. */
-export const REQUIRED_RUNTIME_LIMITS: readonly [
-  "REA_NTFS_MFT_MAX_FILE_BYTES",
-  "REA_REGF_HIVE_MAX_FILE_BYTES",
-  "REA_WEB_BUNDLE_ENDPOINT_LITERAL_CANDIDATES",
-];
-
-/** True for a numeric `REA_` limit, including the documented endpoint-candidate count. */
-export function isNumericLimit(name: string): boolean;
-
-/** Producer paths for numeric limits. Registry text, comments, and allowlists are omitted. */
-export function discoverNumericLimitUses(
-  files: readonly { readonly path: string; readonly source: string }[],
-): Map<string, string>;
-
-/** Why a tracked limit is not an analysis setting, when it is present. */
-export function requiredRuntimeLimitFailure(
-  name: string,
-  presence: { readonly inRuntime: boolean; readonly inRegistry: boolean },
-): string | undefined;
@@ -1,399 +0,0 @@
-import { readFile, readdir } from "node:fs/promises";
-import { join, relative, resolve, sep } from "node:path";
-import { fileURLToPath, pathToFileURL } from "node:url";
-import ts from "typescript6";
-
-// Every numeric REA_ limit under src must be an analysis setting or a
-// restart-only exception with a reason and an update_mode. A per-call limit
-// belongs in ANALYSIS_SETTINGS. The three limits moving on #9868, #9865, and
-// #9836 are not in this tree; once their names appear here they must join
-// ANALYSIS_SETTINGS. REA_WEB_BUNDLE_ENDPOINT_LITERAL_CANDIDATES is numeric
-// even though its name has no byte or time suffix.
-
-const root = fileURLToPath(new URL("../../", import.meta.url));
-const definitionsPath = join(root, "src/domain/analysisSettingDefinitions.ts");
-const registryPath = join(root, "src/domain/numericLimitRegistry.ts");
-
-const listFiles = async (dir) => {
-  const output = [];
-  for (const entry of await readdir(dir, { withFileTypes: true })) {
-    const path = join(dir, entry.name);
-    if (entry.isDirectory()) {
-      if (entry.name === "node_modules" || entry.name === "dist") continue;
-      output.push(...(await listFiles(path)));
-    } else if (
-      entry.name.endsWith(".ts") &&
-      !entry.name.endsWith(".test.ts") &&
-      !entry.name.endsWith(".fixture.ts")
-    )
-      output.push(path);
-  }
-  return output;
-};
-
-/**
- * Count-shaped limits whose names do not use a byte, time, or maximum suffix.
- * `REA_WEB_BUNDLE_ENDPOINT_LITERAL_CANDIDATES` is the runtime setting on #9836.
- */
-const DOCUMENTED_COUNT_LIMITS = new Set([
-  "REA_WEB_BUNDLE_ENDPOINT_LITERAL_CANDIDATES",
-]);
-
-/** Registry text is a declaration, not a producer that uses the limit. */
-export const NUMERIC_LIMIT_DECLARATION = "src/domain/numericLimitRegistry.ts";
-
-/**
- * These limits are moving onto runtime analysis settings on their own PRs.
- * A producer or a registry entry cannot satisfy that requirement.
- */
-export const REQUIRED_RUNTIME_LIMITS = [
-  "REA_NTFS_MFT_MAX_FILE_BYTES",
-  "REA_REGF_HIVE_MAX_FILE_BYTES",
-  "REA_WEB_BUNDLE_ENDPOINT_LITERAL_CANDIDATES",
-];
-
-const unwrapExpression = (node) => {
-  let current = node;
-  while (
-    ts.isAsExpression(current) ||
-    ts.isSatisfiesExpression(current) ||
-    ts.isParenthesizedExpression(current) ||
-    ts.isTypeAssertionExpression(current) ||
-    ts.isNonNullExpression(current)
-  )
-    current = current.expression;
-  return current;
-};
-
-const literalText = (node) =>
-  ts.isStringLiteral(node) || ts.isNoSubstitutionTemplateLiteral(node)
-    ? node.text
-    : undefined;
-
-/** Same-file const strings and `setting` fields, so `environment[name]` still resolves. */
-const stringBindings = (sourceFile) => {
-  const bindings = new Map();
-  const visit = (node) => {
-    if (
-      ts.isVariableDeclaration(node) &&
-      ts.isIdentifier(node.name) &&
-      node.initializer !== undefined
-    ) {
-      const initializer = unwrapExpression(node.initializer);
-      const literal = literalText(initializer);
-      if (literal !== undefined) bindings.set(node.name.text, literal);
-      if (ts.isObjectLiteralExpression(initializer)) {
-        for (const property of initializer.properties) {
-          if (
-            !ts.isPropertyAssignment(property) ||
-            (!ts.isIdentifier(property.name) &&
-              !ts.isStringLiteral(property.name))
-          )
-            continue;
-          const value = literalText(unwrapExpression(property.initializer));
-          if (value !== undefined)
-            bindings.set(`${node.name.text}.${property.name.text}`, value);
-        }
-      }
-    }
-    ts.forEachChild(node, visit);
-  };
-  visit(sourceFile);
-  return bindings;
-};
-
-const boundLimitName = (node, bindings) => {
-  const expression = unwrapExpression(node);
-  const literal = literalText(expression);
-  if (literal !== undefined) return literal;
-  if (ts.isIdentifier(expression)) return bindings.get(expression.text);
-  if (
-    ts.isPropertyAccessExpression(expression) &&
-    ts.isIdentifier(expression.expression) &&
-    (ts.isIdentifier(expression.name) || ts.isStringLiteral(expression.name))
-  )
-    return bindings.get(
-      `${expression.expression.text}.${expression.name.text}`,
-    );
-  return undefined;
-};
-
-export const isNumericLimit = (name) =>
-  DOCUMENTED_COUNT_LIMITS.has(name) ||
-  /(?:_BYTES|_MS|_MIB|_SECONDS|_POLLS|_JOBS|_ELEMENTS|_COUNT|_SESSIONS|_COMMANDS)$/u.test(
-    name,
-  ) ||
-  /_MAX_/u.test(name) ||
-  /_(?:TIMEOUT|DEADLINE|BUDGET)(?:_|$)/u.test(name) ||
-  /_HEAP(?:_|$)/u.test(name);
-
-const limitName = (text) =>
-  text !== undefined && /^REA_[A-Z0-9_]+$/u.test(text) && isNumericLimit(text)
-    ? text
-    : undefined;
-
-const remember = (discovered, path, name) => {
-  const limit = limitName(name);
-  if (limit === undefined || discovered.has(limit)) return;
-  discovered.set(limit, path);
-};
-
-/**
- * Producers are syntax, not text. A read is a property or element access,
- * including a const string used as the element, a string argument to a call,
- * an object-binding key (rename and default included), an `in` check, or an
- * object key that a spread can copy. Comments and array literals are not reads.
- */
-export const discoverNumericLimitUses = (files) => {
-  const discovered = new Map();
-  for (const file of files) {
-    const relativePath = file.path.split(sep).join("/");
-    if (relativePath === NUMERIC_LIMIT_DECLARATION) continue;
-    const sourceFile = ts.createSourceFile(
-      relativePath,
-      file.source,
-      ts.ScriptTarget.Latest,
-      true,
-      ts.ScriptKind.TS,
-    );
-    const bindings = stringBindings(sourceFile);
-    const visit = (node) => {
-      if (
-        ts.isPropertyAccessExpression(node) ||
-        ts.isPropertyAccessChain?.(node)
-      )
-        remember(discovered, relativePath, node.name.text);
-      if (ts.isElementAccessExpression(node))
-        remember(
-          discovered,
-          relativePath,
-          boundLimitName(node.argumentExpression, bindings),
-        );
-      if (ts.isCallExpression(node) || ts.isNewExpression(node)) {
-        for (const argument of node.arguments ?? [])
-          remember(
-            discovered,
-            relativePath,
-            boundLimitName(argument, bindings),
-          );
-      }
-      if (
-        ts.isBinaryExpression(node) &&
-        node.operatorToken.kind === ts.SyntaxKind.InKeyword
-      )
-        remember(discovered, relativePath, boundLimitName(node.left, bindings));
-      if (
-        ts.isBindingElement(node) &&
-        node.dotDotDotToken === undefined &&
-        ts.isObjectBindingPattern(node.parent)
-      ) {
-        const key = node.propertyName ?? node.name;
-        if (
-          ts.isIdentifier(key) ||
-          ts.isStringLiteral(key) ||
-          ts.isNumericLiteral(key)
-        )
-          remember(discovered, relativePath, key.text);
-      }
-      if (
-        (ts.isPropertyAssignment(node) ||
-          ts.isShorthandPropertyAssignment(node)) &&
-        (ts.isIdentifier(node.name) ||
-          ts.isStringLiteral(node.name) ||
-          ts.isNumericLiteral(node.name))
-      )
-        remember(discovered, relativePath, node.name.text);
-      if (ts.isVariableDeclaration(node) && node.initializer !== undefined)
-        remember(
-          discovered,
-          relativePath,
-          literalText(unwrapExpression(node.initializer)),
-        );
-      if (ts.isPropertyAssignment(node))
-        remember(
-          discovered,
-          relativePath,
-          literalText(unwrapExpression(node.initializer)),
-        );
-      if (
-        ts.isTemplateExpression(node) ||
-        ts.isNoSubstitutionTemplateLiteral(node)
-      ) {
-        const chunks = ts.isNoSubstitutionTemplateLiteral(node)
-          ? [node.text]
-          : [
-              node.head.text,
-              ...node.templateSpans.map((span) => span.literal.text),
-            ];
-        for (const chunk of chunks)
-          for (const token of chunk.match(/REA_[A-Z0-9_]+/gu) ?? [])
-            remember(discovered, relativePath, token);
-      }
-      ts.forEachChild(node, visit);
-    };
-    visit(sourceFile);
-  }
-  return discovered;
-};
-
-/** Tracked limits join ANALYSIS_SETTINGS. The exception registry cannot classify them. */
-export const requiredRuntimeLimitFailure = (
-  name,
-  { inRuntime, inRegistry },
-) => {
-  if (!REQUIRED_RUNTIME_LIMITS.includes(name)) return undefined;
-  if (inRuntime && !inRegistry) return undefined;
-  return `${name} must join ANALYSIS_SETTINGS; numericLimitRegistry cannot classify it`;
-};
-
-const namesIn = (source, pattern) =>
-  new Set([...source.matchAll(pattern)].map((match) => match[1]));
-
-const direct =
-  process.argv[1] !== undefined &&
-  import.meta.url === pathToFileURL(resolve(process.argv[1])).href;
-
-if (direct) {
-  const failures = [];
-  const definitions = await readFile(definitionsPath, "utf8");
-  const registry = await readFile(registryPath, "utf8");
-  const runtime = namesIn(definitions, /environment:\s*"(REA_[A-Z0-9_]+)"/gu);
-  const declaredNames = [
-    ...registry.matchAll(/name:\s*"(REA_[A-Z0-9_]+)"/gu),
-  ].map((match) => match[1]);
-  const entries = [
-    ...registry.matchAll(
-      /name:\s*"(REA_[A-Z0-9_]+)"\s*,\s*update_mode:\s*"(runtime|restart)"\s*,\s*policy:\s*"(restart-only|per-call)"\s*,\s*read:\s*"(startup|per-call)"\s*,\s*reason:\s*"((?:\\.|[^"\\])*)"/gu,
-    ),
-  ];
-  const listed = new Map();
-  for (const match of entries) {
-    const [, name, updateMode, policy, read, reason] = match;
-    if (listed.has(name)) failures.push(`${name} is listed twice`);
-    listed.set(name, { updateMode, policy, read, reason });
-    if (reason.trim().length < 40)
-      failures.push(`${name} needs a reason that states why`);
-    if (updateMode !== "restart")
-      failures.push(
-        `${name} is outside ANALYSIS_SETTINGS, so its update_mode must be restart`,
-      );
-    if (runtime.has(name))
-      failures.push(
-        `${name} is both a runtime setting and on the exception list`,
-      );
-    if (policy === "per-call" && read !== "per-call")
-      failures.push(`${name} is per-call policy but is not read per call`);
-    if (policy === "restart-only" && read !== "startup")
-      failures.push(`${name} is restart-only but is not read at startup`);
-  }
-  for (const name of declaredNames) {
-    if (!listed.has(name))
-      failures.push(`${name} is registered without update_mode`);
-  }
-  const settingBodies = [
-    ...definitions.matchAll(/\n {2}"[^"]+": \{([\s\S]*?)\n {2}\},/gu),
-  ];
-  if (settingBodies.length === 0)
-    failures.push("ANALYSIS_SETTINGS did not parse into setting bodies");
-  for (const [, body] of settingBodies) {
-    if (!/updateMode:\s*"(?:runtime|restart)"/u.test(body))
-      failures.push("an analysis setting is missing updateMode");
-  }
-
-  const discovered = discoverNumericLimitUses(
-    await Promise.all(
-      (await listFiles(join(root, "src"))).map(async (path) => ({
-        path: relative(root, path),
-        source: await readFile(path, "utf8"),
-      })),
-    ),
-  );
-
-  for (const [name, file] of [...discovered].sort(([left], [right]) =>
-    left < right ? -1 : left > right ? 1 : 0,
-  )) {
-    if (!runtime.has(name) && !listed.has(name))
-      failures.push(
-        `${name} in ${file} is neither an analysis setting nor docs/design/rea-limit-inventory.md via src/domain/numericLimitRegistry.ts`,
-      );
-  }
-  for (const name of listed.keys()) {
-    if (!discovered.has(name))
-      failures.push(`${name} is registered but no longer appears in src`);
-  }
-  const present = new Set([...discovered.keys(), ...listed.keys(), ...runtime]);
-  for (const name of REQUIRED_RUNTIME_LIMITS) {
-    if (!present.has(name)) continue;
-    const failure = requiredRuntimeLimitFailure(name, {
-      inRuntime: runtime.has(name),
-      inRegistry: listed.has(name),
-    });
-    if (failure !== undefined) failures.push(failure);
-  }
-
-  const parameterOwners = [
-    "src/artifacts/ArtifactReaderLimits.ts",
-    "src/domain/artifactReaderLimits.ts",
-    "src/domain/webNetworkCapture.ts",
-  ];
-  for (const relativePath of parameterOwners) {
-    const source = await readFile(join(root, relativePath), "utf8");
-    if (/update_mode:\s*"runtime"/u.test(source))
-      failures.push(
-        `${relativePath} is a per-call parameter, so update_mode cannot be runtime`,
-      );
-    if (!/update_mode:\s*"parameter"/u.test(source))
-      failures.push(`${relativePath} must report update_mode parameter`);
-  }
-
-  const forbidden =
-    /(?<![A-Za-z0-9_])(?:rea_restart_required|restartRequired|restart_required)(?![A-Za-z0-9_])|effect:\s*"(?:immediate|next_process)"|SettingChangeEffect/gu;
-  // Docs and verification receipts keep the field names they recorded.
-  // Source, tests, skills, and scripts cannot reintroduce those names.
-  const scanRoots = ["src", "tests", ".agents", "scripts"].map((dir) =>
-    join(root, dir),
-  );
-  const skipDir = new Set([
-    "node_modules",
-    "dist",
-    ".turbo",
-    ".cache",
-    "rea-numeric-limits.mjs",
-  ]);
-  const listText = async (dir) => {
-    const output = [];
-    let entries;
-    try {
-      entries = await readdir(dir, { withFileTypes: true });
-    } catch {
-      return output;
-    }
-    for (const entry of entries) {
-      if (skipDir.has(entry.name)) continue;
-      const path = join(dir, entry.name);
-      if (entry.isDirectory()) output.push(...(await listText(path)));
-      else if (/\.(?:ts|tsx|mjs|js|md|json|py|yml|yaml)$/u.test(entry.name))
-        output.push(path);
-    }
-    return output;
-  };
-  for (const dir of scanRoots) {
-    for (const path of await listText(dir)) {
-      if (path.endsWith(`${sep}rea-numeric-limits.mjs`)) continue;
-      const source = await readFile(path, "utf8");
-      const hit = source.match(forbidden);
-      if (hit)
-        failures.push(
-          `${relative(root, path).split(sep).join("/")} still uses ${[...new Set(hit)].join(", ")}`,
-        );
-    }
-  }
-
-  if (failures.length > 0) {
-    console.error(`Numeric REA_ limit check failed:\n${failures.join("\n")}`);
-    process.exit(1);
-  }
-  console.log(
-    `Numeric REA_ limits: ${runtime.size} runtime, ${[...listed.values()].filter((entry) => entry.policy === "restart-only").length} restart-only, ${[...listed.values()].filter((entry) => entry.policy === "per-call").length} per-call pending migration, ${discovered.size} discovered.`,
-  );
-}
@@ -36,8 +36,7 @@ it("names REA_JADX_OPERATION_TIMEOUT_MS when the operation deadline elapses", ()
      applies_at: "next_operation",
      agent_editable: true,
      scope: "rea-runtime",
-      update_mode: "runtime",
-      pending_restart: false,
+      rea_restart_required: false,
    },
  });
  expect(projected).toMatchObject({
@@ -134,7 +134,7 @@ export class AnalysisSettings {
        };
      }),
      active_work_changed: false as const,
-      pending_restart: false as const,
+      rea_restart_required: false as const,
    });
  }
  #describe(setting: AnalysisSettingId) {
@@ -156,8 +156,6 @@ export class AnalysisSettings {
      minimum: definition.minimum,
      maximum: definition.maximum,
      applies_at: definition.appliesAt,
-      update_mode: definition.updateMode,
-      pending_restart: false as const,
      provider: definition.provider,
      operations: [...definition.operations],
      ...(definition.environment === undefined
@@ -1,7 +1,6 @@
 import { discoverJavaScriptPreloadPaths } from "./JavaScriptPreloadDiscovery.js";
 import { artifactNameForClassification } from "../../domain/artifactNameSelection.js";
 import type { AnalysisSettingValues } from "../../domain/analysisSettings.js";
-import { selectedAnalysisSetting } from "../../domain/analysisSettingDefinitions.js";
 import { absoluteCallerPath } from "../../filesystem/callerPath.js";
 import {
  DEFAULT_ASAR_HEADER_ADMISSION,
@@ -182,24 +181,18 @@ export const reconstructJavaScriptArtifact = async (
          ? {}
          : { fileNodes: input.max_semantic_nodes_per_file }),
      });
-      const heap = selectedAnalysisSetting(
-        input.max_heap_mb,
-        overrides?.["javascript.max_heap_mb"],
-        JAVASCRIPT_ANALYSIS_RESOURCE_DEFAULTS.heapMb,
-      );
-      const timeout = selectedAnalysisSetting(
-        input.analysis_timeout_ms,
-        overrides?.["javascript.analysis_timeout_ms"],
-        JAVASCRIPT_ANALYSIS_RESOURCE_DEFAULTS.timeoutMs,
-      );
      const sourceLimits = {
        ...(input.semantic_precision === undefined
          ? {}
          : { semanticPrecision: input.semantic_precision }),
-        heapMb: heap.value,
-        heapSource: heap.source,
-        timeoutMs: timeout.value,
-        timeoutSource: timeout.source,
+        heapMb:
+          input.max_heap_mb ??
+          overrides?.["javascript.max_heap_mb"] ??
+          JAVASCRIPT_ANALYSIS_RESOURCE_DEFAULTS.heapMb,
+        timeoutMs:
+          input.analysis_timeout_ms ??
+          overrides?.["javascript.analysis_timeout_ms"] ??
+          JAVASCRIPT_ANALYSIS_RESOURCE_DEFAULTS.timeoutMs,
      };
      const preloads = await discoverJavaScriptPreloadPaths(
        files,
@@ -66,6 +66,28 @@ const report: PythonPyc = {
  ],
 };

+it.each([
+  {
+    flags: 1,
+    hash_based: true,
+    source_hash_hex: "",
+    source_mtime: null,
+    source_size: null,
+  },
+  { flags: 1 },
+])("refuses inconsistent provider header facts %j", async (header) => {
+  const result = await new PythonPycService({
+    close: async () => {},
+    identity,
+    inspect: async () =>
+      ok({ ...report, header: { ...report.header, ...header } }),
+  }).inspect({ path: report.artifact.path });
+  expect(result).toMatchObject({
+    ok: false,
+    error: { _tag: "AnalysisOutputError" },
+  });
+});
+
 it("rejects a relative path and extra arguments before reading", async () => {
  let calls = 0;
  const service = new PythonPycService({
@@ -15,8 +15,6 @@ export type WasmArtifactExecution = Omit<AnalysisExecution, "subject"> & {
 /** Effective operation budget, separate from caller-authored Evidence parameters. */
 export interface WasmArtifactExecutionOptions extends ExecutionOptions {
  readonly commandTimeoutMs?: number;
-  /** Selection owner for `commandTimeoutMs`. Absent when the caller did not record it. */
-  readonly commandTimeoutSource?: "default" | "runtime" | "request" | undefined;
 }

 /** Replaceable offline WASM inspection engine, independent of target execution and network clients. */
@@ -240,7 +240,6 @@ it("gives cancellation precedence over malformed raw input", async () => {
 it("uses runtime defaults only for omitted budgets, preserving explicit input and reset", async () => {
  const settings = new AnalysisSettings({});
  const accepted: number[] = [];
-  const sources: (string | undefined)[] = [];
  const authored: (number | undefined)[] = [];
  const service = new WasmArtifactService(
    {
@@ -249,7 +248,6 @@ it("uses runtime defaults only for omitted budgets, preserving explicit input an
        const value = wasmArtifactFixture();
        value.tool_profile.timeout_ms = options!.commandTimeoutMs!;
        accepted.push(options!.commandTimeoutMs!);
-        sources.push(options!.commandTimeoutSource);
        authored.push(input.command_timeout_ms);
        return ok(wasmArtifactExecution(value));
      },
@@ -277,7 +275,6 @@ it("uses runtime defaults only for omitted budgets, preserving explicit input an
  });
  expect((await settings.run(() => service.inspect({ path }))).ok).toBe(true);
  expect(accepted).toEqual([123000, 42000, 30000]);
-  expect(sources).toEqual(["runtime", "request", "default"]);
  expect(authored).toEqual([undefined, 42000, undefined]);
 });

@@ -1,5 +1,4 @@
 import type { AnalysisSettingsReader } from "../../domain/analysisSettings.js";
-import { selectedAnalysisSetting } from "../../domain/analysisSettingDefinitions.js";
 import { constants as bufferConstants } from "node:buffer";
 import type { ExecutionOptions } from "../AnalysisProvider.js";
 import {
@@ -79,15 +78,13 @@ export class WasmArtifactService {
          ),
        );
    }
-    const timeout = selectedAnalysisSetting(
-      input.value.command_timeout_ms,
-      this.settings?.().overrides["wasm.command_timeout_ms"],
-      DEFAULT_WASM_COMMAND_TIMEOUT_MS,
-    );
+    const timeout =
+      input.value.command_timeout_ms ??
+      this.settings?.().overrides["wasm.command_timeout_ms"] ??
+      DEFAULT_WASM_COMMAND_TIMEOUT_MS;
    const inspected = await this.provider.inspect(input.value, {
      ...options,
-      commandTimeoutMs: timeout.value,
-      commandTimeoutSource: timeout.source,
+      commandTimeoutMs: timeout,
    });
    if (!inspected.ok) return inspected;
    const execution = inspected.value;
@@ -111,7 +108,7 @@ export class WasmArtifactService {
      !report.success ||
      report.data.artifact.path !== input.value.path ||
      execution.subject.path !== input.value.path ||
-      report.data.tool_profile.timeout_ms !== timeout.value ||
+      report.data.tool_profile.timeout_ms !== timeout ||
      report.data.tool_profile.output_budget_bytes !==
        wasmResourceLimits(input.value).outputBytes ||
      !wasmArtifactMatchesSubject(report.data.artifact, execution.subject) ||
@@ -54,8 +54,7 @@ it("preserves adjustable reader admission facts and gives cleanup priority", ()
        required_value: 2,
        unit: "count",
        applies_at: "next_operation",
-        update_mode: "parameter",
-        pending_restart: false,
+        rea_restart_required: false,
      },
    },
  });
@@ -40,8 +40,7 @@ export const artifactReaderLimitFailure = (
      applies_at: "next_operation",
      agent_editable: true,
      can_increase: canIncrease,
-      update_mode: "parameter" as const,
-      pending_restart: false as const,
+      rea_restart_required: false,
    },
  });
 };
@@ -89,8 +89,7 @@ it.each(["max_input_bytes", "max_reply_bytes", "max_nesting_depth"] as const)(
          parameter: control,
          effective_value: selected,
          source: "request",
-          update_mode: "parameter",
-          pending_restart: false,
+          rea_restart_required: false,
        },
      },
    });
@@ -103,10 +103,11 @@ it("uses a valid REA_CAPTURE_DECODER_OLD_GENERATION_MIB override", async () => {
    /floor 8 MiB.*maximum 16384 MiB/iu,
  );
  expect(projected.remediation.action).toContain("update_analysis_settings");
-  expect(projected.remediation.action).toContain("launch seed");
+  expect(projected.remediation.action).toMatch(/restart REA/iu);
  expect(projected.remediation.action).toContain(
    "capture.decoder_old_generation_mib",
  );
+  expect(projected.remediation.action).toMatch(/without a REA restart/iu);
  expect(projected.remediation.action).toMatch(
    /removes inherited NODE_OPTIONS/iu,
  );
@@ -124,8 +125,7 @@ it("uses a valid REA_CAPTURE_DECODER_OLD_GENERATION_MIB override", async () => {
        unit: "MiB",
        applies_at: "next_worker",
        agent_editable: true,
-        update_mode: "runtime",
-        pending_restart: false,
+        rea_restart_required: false,
      },
      reported_limits: {
        old_generation_heap_mib: 256,
@@ -71,7 +71,7 @@ export const resolveCaptureDecoderHeap = (
 export const captureDecoderHeapRecovery = (heap: CaptureDecoderHeap): string =>
  [
    `The effective ${CAPTURE_DECODER_OLD_GENERATION_SETTING} value is ${String(heap.oldGenerationMiB)} MiB (source ${heap.source}; default ${String(DEFAULT_CAPTURE_DECODER_OLD_GENERATION_MIB)} MiB, floor ${String(CAPTURE_DECODER_SEMI_SPACE_MIB)} MiB, maximum ${String(MAXIMUM_CAPTURE_DECODER_OLD_GENERATION_MIB)} MiB).`,
-    `capture.decoder_old_generation_mib can be changed at runtime with update_analysis_settings. The launch seed is ${CAPTURE_DECODER_OLD_GENERATION_SETTING}, a decimal integer from ${String(CAPTURE_DECODER_SEMI_SPACE_MIB)} to ${String(MAXIMUM_CAPTURE_DECODER_OLD_GENERATION_MIB)}.`,
+    `Set ${CAPTURE_DECODER_OLD_GENERATION_SETTING} in the environment that starts REA to a decimal integer from ${String(CAPTURE_DECODER_SEMI_SPACE_MIB)} to ${String(MAXIMUM_CAPTURE_DECODER_OLD_GENERATION_MIB)}, then restart REA. In a running MCP server, use update_analysis_settings with setting capture.decoder_old_generation_mib and action set instead; the new value applies to new work without a REA restart.`,
    `On Node.js the decoder passes --max-old-space-size=${String(heap.oldGenerationMiB)} and removes inherited NODE_OPTIONS, so additional host memory and NODE_OPTIONS do not raise this heap. The ${String(CAPTURE_DECODER_SEMI_SPACE_MIB)} MiB semi-space stays fixed.`,
    "On Bun the V8 flags are ignored. Windows limits the decoder's committed memory to this value plus a 512 MiB reserve. Other Bun hosts enforce no decoder heap limit.",
  ].join(" ");
@@ -171,8 +171,7 @@ it("names the session setting on a Rizin capacity refusal", async () => {
        minimum: MINIMUM_DEBUGGER_MAX_SESSIONS,
        maximum: MAXIMUM_DEBUGGER_MAX_SESSIONS,
        unit: "sessions",
-        update_mode: "restart",
-        pending_restart: false,
+        restart_required: true,
        max_sessions: 1,
        active_or_reserved_sessions: 1,
      },
@@ -6,10 +6,7 @@ import { z } from "zod";
 import { mcpInputBudgetSchema } from "./mcpInputBudget.js";
 import { isAbsolute } from "node:path";

-import {
-  ConfigurationError,
-  type ConfigurationSettingIssue,
-} from "../domain/configurationErrors.js";
+import { ConfigurationError } from "../domain/configurationErrors.js";
 import { err, ok, type Result } from "../domain/result.js";
 import { analysisProviderSelectorSchema } from "../domain/providerSelection.js";
 import {
@@ -168,31 +165,6 @@ const environmentSchema = z.object({
  REA_REFERENCE_SECRET_PATTERNS_JSON: z.string().default("[]"),
 });

-/** Copy producer-owned update facts from a Zod issue without inventing them. */
-const configurationSettingFromIssue = (issue: {
-  readonly path: readonly PropertyKey[];
-  readonly message: string;
-  readonly code: string;
-  readonly params?: Readonly<Record<string, unknown>> | undefined;
-}): ConfigurationSettingIssue => {
-  const setting = String(issue.path[0] ?? "environment");
-  const constraint = issue.message;
-  if (issue.code !== "custom" || issue.params === undefined)
-    return { setting, constraint };
-  const updateMode = issue.params.update_mode;
-  const pendingRestart = issue.params.pending_restart;
-  return {
-    setting,
-    constraint,
-    ...(updateMode === "runtime" || updateMode === "restart"
-      ? { update_mode: updateMode }
-      : {}),
-    ...(typeof pendingRestart === "boolean"
-      ? { pending_restart: pendingRestart }
-      : {}),
-  };
-};
-
 /** Parse the JEB-only timeout at its isolated provider-composition boundary. */
 export const parseJebMcpTimeoutMs = (
  value: string | undefined,
@@ -257,10 +229,10 @@ export const parseEnvironmentValues = (
  const parsed = environmentSchema.safeParse(literals);
  if (!parsed.success) {
    // Zod messages name the constraint, never the rejected value.
-    // A producer may attach update_mode and pending_restart on a custom issue.
-    const settings = parsed.error.issues.map((issue) =>
-      configurationSettingFromIssue(issue),
-    );
+    const settings = parsed.error.issues.map((issue) => ({
+      setting: String(issue.path[0] ?? "environment"),
+      constraint: issue.message,
+    }));
    return err(
      new ConfigurationError("Invalid REA environment configuration", {
        cause: parsed.error,
@@ -49,8 +49,7 @@ it("keeps the 5000 ms deadline when the setting is unset", () => {
        applies_at: "next_operation",
        agent_editable: true,
        scope: "rea-runtime",
-        update_mode: "runtime",
-        pending_restart: false,
+        rea_restart_required: false,
      },
      reported_limits: {
        matching_deadline_ms: DEFAULT_REGEX_MATCHING_DEADLINE.deadlineMs,
@@ -66,7 +65,8 @@ it("keeps the 5000 ms deadline when the setting is unset", () => {
  expect(projected.remediation.action).toContain("source default");
  expect(projected.remediation.action).toContain("update_analysis_settings");
  expect(projected.remediation.action).toContain("regex.matching_deadline_ms");
-  expect(projected.remediation.action).toContain("launch seed");
+  expect(projected.remediation.action).toMatch(/restart REA/i);
+  expect(projected.remediation.action).toMatch(/without a REA restart/i);
  expect(projected.remediation.action).toMatch(
    /heap does not raise this deadline/i,
  );
@@ -70,6 +70,6 @@ export const regexMatchingDeadlineRecovery = (
 ): string =>
  [
    `The effective ${REGEX_MATCHING_DEADLINE_SETTING} value is ${String(deadline.deadlineMs)} ms (source ${deadline.source}; default ${String(DEFAULT_REGEX_MATCHING_DEADLINE_MS)} ms, floor 1 ms, maximum ${String(MAXIMUM_REGEX_MATCHING_DEADLINE_MS)} ms).`,
-    `regex.matching_deadline_ms can be changed at runtime with update_analysis_settings. The launch seed is ${REGEX_MATCHING_DEADLINE_SETTING}, a positive decimal integer from 1 to ${String(MAXIMUM_REGEX_MATCHING_DEADLINE_MS)}.`,
+    `Set ${REGEX_MATCHING_DEADLINE_SETTING} in the environment that starts REA to a positive decimal integer from 1 to ${String(MAXIMUM_REGEX_MATCHING_DEADLINE_MS)}, then restart REA. In a running MCP server, use update_analysis_settings with setting regex.matching_deadline_ms and action set instead; the new value applies to new work without a REA restart.`,
    "The worker old-generation heap does not raise this deadline.",
  ].join(" ");
@@ -56,8 +56,7 @@ it("keeps the 128 MiB request when the setting is unset", () => {
        applies_at: "next_worker",
        agent_editable: true,
        scope: "rea-runtime",
-        update_mode: "runtime",
-        pending_restart: false,
+        rea_restart_required: false,
      },
      reported_limits: {
        requested_worker_heap_mib: DEFAULT_REGEX_WORKER_HEAP_REQUEST.heapMiB,
@@ -77,7 +76,8 @@ it("keeps the 128 MiB request when the setting is unset", () => {
  );
  expect(projected.remediation.action).toContain("--max-old-space-size");
  expect(projected.remediation.action).toContain("NODE_OPTIONS");
-  expect(projected.remediation.action).toContain("launch seed");
+  expect(projected.remediation.action).toMatch(/restart REA/i);
+  expect(projected.remediation.action).toMatch(/without a REA restart/i);
  expect(projected.remediation.action).toMatch(/overrides this request/i);
 });

@@ -72,6 +72,6 @@ export const regexWorkerHeapRequestRecovery = (
 ): string =>
  [
    `The effective ${REGEX_WORKER_HEAP_REQUEST_SETTING} value is ${String(request.heapMiB)} MiB (source ${request.source}; default ${String(DEFAULT_REGEX_WORKER_HEAP_REQUEST_MIB)} MiB, floor ${String(MINIMUM_REGEX_WORKER_HEAP_REQUEST_MIB)} MiB, maximum ${String(MAXIMUM_REGEX_WORKER_HEAP_REQUEST_MIB)} MiB).`,
-    `regex.worker_heap_request_mib can be changed at runtime with update_analysis_settings. The launch seed is ${REGEX_WORKER_HEAP_REQUEST_SETTING}, a decimal integer from ${String(MINIMUM_REGEX_WORKER_HEAP_REQUEST_MIB)} to ${String(MAXIMUM_REGEX_WORKER_HEAP_REQUEST_MIB)}.`,
+    `Set ${REGEX_WORKER_HEAP_REQUEST_SETTING} in the environment that starts REA to a decimal integer from ${String(MINIMUM_REGEX_WORKER_HEAP_REQUEST_MIB)} to ${String(MAXIMUM_REGEX_WORKER_HEAP_REQUEST_MIB)}, then restart REA. In a running MCP server, use update_analysis_settings with setting regex.worker_heap_request_mib and action set instead; the new value applies to new work without a REA restart.`,
    "A positive Node --max-old-space-size, including NODE_OPTIONS, overrides this request and sets the effective heap. That flag is not limited by this setting's floor or maximum. Raising host memory alone does not raise the request.",
  ].join(" ");
@@ -27,7 +27,7 @@ const requiredFacts = (
  expect(message).toContain(String(fact.defaultValue));
  expect(message).toContain(String(fact.floor));
  expect(message).toContain(String(fact.maximum));
-  expect(message).toContain("positive decimal integer");
+  expect(message).toContain("restart REA");
 };

 it("keeps today's settle defaults when the settings are unset", () => {
@@ -98,21 +98,17 @@ it.each([
  const message = resolved.error.settings[0]?.constraint;
  if (message === undefined) throw new Error("Missing configuration guidance");
  requiredFacts(message, { ...bound, currentValue: value, source: "setting" });
-  const facts = {
-    setting: bound.setting,
-    constraint: message,
-    update_mode: "restart" as const,
-    pending_restart: true as const,
-  };
-  expect(resolved.error.settings).toEqual([facts]);
+  expect(resolved.error.settings).toEqual([
+    { setting: bound.setting, constraint: message },
+  ]);
  expect(projectAnalysisError(resolved.error)).toMatchObject({
    code: "configuration_invalid",
-    details: { settings: [facts] },
+    details: { settings: [{ setting: bound.setting, constraint: message }] },
  });
  const startup = parseEnvironment({ [bound.setting]: value });
  if (startup.ok) throw new Error(`Startup accepted ${bound.setting}=${value}`);
-  expect(startup.error.settings).toContainEqual(facts);
-  expect(projectAnalysisError(startup.error).details).toMatchObject({
-    settings: [facts],
+  expect(startup.error.settings).toContainEqual({
+    setting: bound.setting,
+    constraint: message,
  });
 });
@@ -55,9 +55,7 @@ export interface WindowsChangeTimeSettingFailure {
  readonly floor: number;
  readonly maximum: number;
  readonly unit: "ms" | "polls";
-  readonly update_mode: "restart";
-  /** The rejected environment value is not the value this process is using. */
-  readonly pending_restart: true;
+  readonly restartRequired: true;
 }

 /** Effective settle budget and whether each part came from the default or a setting. */
@@ -81,11 +79,10 @@ const windowsChangeTimeSettingFailure = (
  floor: bound.floor,
  maximum: bound.maximum,
  unit: bound.unit,
-  update_mode: "restart",
-  pending_restart: true,
+  restartRequired: true,
 });

-/** Name the rejected value, its source, and the allowed range. */
+/** Name the rejected value, its source, the allowed range, and the required restart. */
 const windowsChangeTimeSettingMessage = (
  failure: WindowsChangeTimeSettingFailure,
 ): string =>
@@ -103,14 +100,11 @@ export const windowsChangeTimeSettingSchema = (bound: WindowsChangeTimeBound) =>
    .string()
    .superRefine((value, context) => {
      if (inRange(bound, value)) return;
-      const failure = windowsChangeTimeSettingFailure(bound, value);
      context.addIssue({
        code: "custom",
-        message: windowsChangeTimeSettingMessage(failure),
-        params: {
-          update_mode: failure.update_mode,
-          pending_restart: failure.pending_restart,
-        },
+        message: windowsChangeTimeSettingMessage(
+          windowsChangeTimeSettingFailure(bound, value),
+        ),
      });
    })
    .transform(Number);
@@ -166,8 +160,6 @@ export const resolveWindowsChangeTimeSettle = (
          settings: failures.map((failure) => ({
            setting: failure.setting,
            constraint: windowsChangeTimeSettingMessage(failure),
-            update_mode: failure.update_mode,
-            pending_restart: failure.pending_restart,
          })),
        },
      ),
@@ -48,8 +48,6 @@ const descriptor = z.strictObject({
  minimum: z.number(),
  maximum: z.number(),
  applies_at: z.enum(["next_operation", "next_worker", "next_startup"]),
-  update_mode: z.enum(["runtime", "restart"]),
-  pending_restart: z.boolean(),
  provider: z.string(),
  operations: z.array(z.string()),
  environment: z.string().optional(),
@@ -85,7 +83,7 @@ export const updateAnalysisSettingsResultSchema =
      }),
    ),
    active_work_changed: z.literal(false),
-    pending_restart: z.literal(false),
+    rea_restart_required: z.literal(false),
  });
 export const ANALYSIS_SETTINGS_TOOL_CONTRACTS = [
  {
@@ -1512,8 +1512,7 @@ describe("analysis error projection: caller lifetime", () => {
      minimum: limit.minimum,
      maximum: limit.maximum,
      agent_editable: true,
-      update_mode: "runtime",
-      pending_restart: false,
+      rea_restart_required: false,
      applies_at: "next_invocation",
      scope: "rea-invocation",
      environment: "REA_REGEX_MATCHING_DEADLINE_MS",
@@ -1530,25 +1529,11 @@ describe("analysis error projection: caller lifetime", () => {
      expect.objectContaining({
        setting: "wasm.command_timeout_ms",
        source: "request",
-        update_mode: "parameter",
        parameter: "command_timeout_ms",
        applies_at: "next_invocation",
        scope: "rea-invocation",
      }),
    );
-    expect(
-      analysisSettingLimit("wasm.command_timeout_ms", 100, "runtime"),
-    ).toMatchObject({ source: "runtime", update_mode: "runtime" });
-    expect(
-      analysisSettingLimit("javascript.max_heap_mb", 128, "request"),
-    ).toMatchObject({
-      source: "request",
-      update_mode: "parameter",
-      parameter: "max_heap_mb",
-    });
-    expect(
-      analysisSettingLimit("javascript.analysis_timeout_ms", 1, "default"),
-    ).toMatchObject({ source: "default", update_mode: "runtime" });
    expect(
      projectAnalysisError(error, "invocation").details?.limit,
    ).not.toHaveProperty("environment");
@@ -1044,15 +1044,9 @@ const lifecycleErrorDetails = (
  }
  if (error instanceof ConfigurationError && error.settings.length > 0)
    return {
-      settings: error.settings.map((issue) => ({
-        setting: issue.setting,
-        constraint: issue.constraint,
-        ...(issue.update_mode === undefined
-          ? {}
-          : { update_mode: issue.update_mode }),
-        ...(issue.pending_restart === undefined
-          ? {}
-          : { pending_restart: issue.pending_restart }),
+      settings: error.settings.map(({ setting, constraint }) => ({
+        setting,
+        constraint,
      })),
    };
  if (error instanceof BinaryTargetError)
@@ -46,7 +46,6 @@ interface SettingDefinition {
  readonly maximum: number;
  readonly unit: "bytes" | "ms" | "seconds" | "MiB" | "count";
  readonly appliesAt: "next_operation" | "next_worker" | "next_startup";
-  readonly updateMode: "runtime" | "restart";
  readonly provider: string;
  readonly relatedProviders?: readonly string[];
  readonly operations: readonly string[];
@@ -61,7 +60,6 @@ const timer = {
 /** Metadata aggregates existing owner definitions; no environment mutation or engine discovery. */
 export const ANALYSIS_SETTINGS = {
  "ghidra.decompile_max_payload_mib": {
-    updateMode: "runtime",
    environment: "REA_GHIDRA_DECOMPILE_MAX_PAYLOAD_MIB",
    defaultValue: null,
    minimum: 1,
@@ -79,7 +77,6 @@ export const ANALYSIS_SETTINGS = {
    ],
  },
  "asar.max_listing_bytes": {
-    updateMode: "runtime",
    environment: "REA_ASAR_MAX_LISTING_BYTES",
    defaultValue: DEFAULT_ASAR_MAX_LISTING_BYTES,
    minimum: 1,
@@ -103,7 +100,6 @@ export const ANALYSIS_SETTINGS = {
    ],
  },
  "ghidra.value_flow_max_operations": {
-    updateMode: "runtime",
    environment: "REA_GHIDRA_VALUE_FLOW_MAX_OPERATIONS",
    defaultValue: DEFAULT_GHIDRA_VALUE_FLOW_MAX_OPERATIONS,
    minimum: 1,
@@ -118,7 +114,6 @@ export const ANALYSIS_SETTINGS = {
    ],
  },
  "ghidra.value_flow_max_inputs_per_operation": {
-    updateMode: "runtime",
    environment: "REA_GHIDRA_VALUE_FLOW_MAX_INPUTS_PER_OPERATION",
    defaultValue: DEFAULT_GHIDRA_VALUE_FLOW_MAX_INPUTS_PER_OPERATION,
    minimum: 1,
@@ -133,7 +128,6 @@ export const ANALYSIS_SETTINGS = {
    ],
  },
  "ghidra.value_flow_max_edges": {
-    updateMode: "runtime",
    environment: "REA_GHIDRA_VALUE_FLOW_MAX_EDGES",
    defaultValue: DEFAULT_GHIDRA_VALUE_FLOW_MAX_EDGES,
    minimum: 1,
@@ -148,7 +142,6 @@ export const ANALYSIS_SETTINGS = {
    ],
  },
  "asar.max_header_bytes": {
-    updateMode: "runtime",
    environment: "REA_ASAR_MAX_HEADER_BYTES",
    defaultValue: DEFAULT_ASAR_MAX_HEADER_BYTES,
    minimum: 1,
@@ -172,7 +165,6 @@ export const ANALYSIS_SETTINGS = {
    ],
  },
  "ghidra.startup_timeout_ms": {
-    updateMode: "runtime",
    ...timer,
    environment: "REA_GHIDRA_STARTUP_TIMEOUT_MS",
    defaultValue: DEFAULT_GHIDRA_STARTUP_TIMEOUT_MS,
@@ -193,7 +185,6 @@ export const ANALYSIS_SETTINGS = {
    ],
  },
  "hopper.startup_timeout_ms": {
-    updateMode: "runtime",
    ...timer,
    environment: "REA_HOPPER_STARTUP_TIMEOUT_MS",
    defaultValue: DEFAULT_HOPPER_STARTUP_TIMEOUT_MS,
@@ -214,7 +205,6 @@ export const ANALYSIS_SETTINGS = {
    ],
  },
  "ghidra.decompile_timeout_seconds": {
-    updateMode: "runtime",
    environment: "REA_GHIDRA_DECOMPILE_TIMEOUT_SECONDS",
    defaultValue: null,
    minimum: 1,
@@ -230,7 +220,6 @@ export const ANALYSIS_SETTINGS = {
    ],
  },
  "jadx.operation_timeout_ms": {
-    updateMode: "runtime",
    ...timer,
    environment: "REA_JADX_OPERATION_TIMEOUT_MS",
    defaultValue: DEFAULT_JADX_OPERATION_TIMEOUT_MS,
@@ -244,7 +233,6 @@ export const ANALYSIS_SETTINGS = {
    ],
  },
  "regex.matching_deadline_ms": {
-    updateMode: "runtime",
    ...timer,
    environment: "REA_REGEX_MATCHING_DEADLINE_MS",
    defaultValue: DEFAULT_REGEX_MATCHING_DEADLINE_MS,
@@ -254,7 +242,6 @@ export const ANALYSIS_SETTINGS = {
    operations: ["search_strings", "search_procedures"],
  },
  "regex.worker_heap_request_mib": {
-    updateMode: "runtime",
    environment: "REA_REGEX_WORKER_HEAP_REQUEST_MIB",
    defaultValue: DEFAULT_REGEX_WORKER_HEAP_REQUEST_MIB,
    minimum: MINIMUM_REGEX_WORKER_HEAP_REQUEST_MIB,
@@ -266,7 +253,6 @@ export const ANALYSIS_SETTINGS = {
    operations: ["search_strings", "search_procedures"],
  },
  "capture.decoder_old_generation_mib": {
-    updateMode: "runtime",
    environment: "REA_CAPTURE_DECODER_OLD_GENERATION_MIB",
    defaultValue: DEFAULT_CAPTURE_DECODER_OLD_GENERATION_MIB,
    minimum: CAPTURE_DECODER_SEMI_SPACE_MIB,
@@ -277,7 +263,6 @@ export const ANALYSIS_SETTINGS = {
    operations: ["inspect_web_network_capture"],
  },
  "javascript.analysis_timeout_ms": {
-    updateMode: "runtime",
    ...timer,
    defaultValue: JAVASCRIPT_ANALYSIS_RESOURCE_DEFAULTS.timeoutMs,
    provider: "rea-javascript-application",
@@ -285,7 +270,6 @@ export const ANALYSIS_SETTINGS = {
    parameter: "analysis_timeout_ms",
  },
  "javascript.max_heap_mb": {
-    updateMode: "runtime",
    defaultValue: JAVASCRIPT_ANALYSIS_RESOURCE_DEFAULTS.heapMb,
    minimum: JAVASCRIPT_WORKER_HEAP_MIB_MINIMUM,
    maximum: JAVASCRIPT_WORKER_HEAP_MIB_MAXIMUM,
@@ -296,7 +280,6 @@ export const ANALYSIS_SETTINGS = {
    parameter: "max_heap_mb",
  },
  "wasm.command_timeout_ms": {
-    updateMode: "runtime",
    ...timer,
    defaultValue: DEFAULT_WASM_COMMAND_TIMEOUT_MS,
    maximum: MAX_WASM_COMMAND_TIMEOUT_MS,
@@ -305,7 +288,6 @@ export const ANALYSIS_SETTINGS = {
    parameter: "command_timeout_ms",
  },
  "native.matching_representation_bytes": {
-    updateMode: "runtime",
    environment: "REA_NATIVE_MATCHING_REPRESENTATION_BYTES",
    defaultValue: DEFAULT_NATIVE_MATCHING_REPRESENTATION_BYTES,
    minimum: 1,
@@ -335,23 +317,6 @@ export const analysisSettingValueSchema = (id: AnalysisSettingId) => {
    ? number.nullable()
    : number;
 };
-/**
- * Caller argument, then the accepted runtime override, then the built-in
- * default. The third value is that default, not a launch-environment seed.
- */
-export const selectedAnalysisSetting = (
-  request: number | undefined,
-  override: number | undefined,
-  fallback: number,
-): {
-  readonly value: number;
-  readonly source: "default" | "runtime" | "request";
-} => {
-  if (request !== undefined) return { value: request, source: "request" };
-  if (override !== undefined) return { value: override, source: "runtime" };
-  return { value: fallback, source: "default" };
-};
-
 /** Project one owner's accepted budget, including the explicit per-call precedence. */
 export const analysisSettingLimit = (
  setting: AnalysisSettingId,
@@ -369,8 +334,7 @@ export const analysisSettingLimit = (
    applies_at: definition.appliesAt,
    agent_editable: true,
    scope: "rea-runtime",
-    update_mode: source === "request" ? "parameter" : definition.updateMode,
-    pending_restart: false,
+    rea_restart_required: false,
    ...(definition.parameter === undefined
      ? {}
      : { parameter: definition.parameter }),
@@ -26,14 +26,6 @@ export interface AnalysisSettingsSnapshot {
 /** Injected by the runtime owner; reads the accepted operation's immutable snapshot. */
 export type AnalysisSettingsReader = () => AnalysisSettingsSnapshot;

-/**
- * Whether `update_analysis_settings` can change the active value.
- * `runtime` applies inside this process. `restart` stays at the value this
- * process already started with. A limit fact uses `parameter` when this call
- * supplied the value; the setting definition itself stays `runtime`.
- */
-export type AnalysisSettingUpdateMode = "runtime" | "restart";
-
 /** Limit facts supplied by the failing owner, never inferred from error prose. */
 export interface AnalysisSettingLimit {
  readonly setting: AnalysisSettingId;
@@ -45,12 +37,7 @@ export interface AnalysisSettingLimit {
  readonly applies_at: "next_operation" | "next_worker" | "next_startup";
  readonly agent_editable: true;
  readonly scope: "rea-runtime";
-  readonly update_mode: AnalysisSettingUpdateMode | "parameter";
-  /**
-   * True only when a configured value is not the one this process is using.
-   * The reported effective value is active, so limit errors leave this false.
-   */
-  readonly pending_restart: false;
+  readonly rea_restart_required: false;
  readonly required_value?: number;
  readonly parameter?: string;
 }
@@ -191,8 +191,7 @@ export interface ArtifactReaderLimitFact {
  readonly applies_at: "next_operation";
  readonly agent_editable: true;
  readonly can_increase: boolean;
-  readonly update_mode: "parameter";
-  readonly pending_restart: false;
+  readonly rea_restart_required: false;
 }

 /** Runtime representation ceilings differ from aggregate plaintext-work budgets. */
@@ -7,10 +7,6 @@ import {
 export interface ConfigurationSettingIssue {
  readonly setting: string;
  readonly constraint: string;
-  /** Whether `update_analysis_settings` can change this setting, when the producer owns that fact. */
-  readonly update_mode?: "runtime" | "restart";
-  /** True when the rejected value is configured but not active in this process. */
-  readonly pending_restart?: boolean;
 }

 /** Rejected settings retained for diagnostics; their values are not. */
@@ -28,16 +24,9 @@ export class ConfigurationError extends AnalysisError {
  constructor(message: string, options?: ConfigurationErrorOptions) {
    super(message, options);
    this.remediationAction = options?.remediationAction;
-    this.settings = (options?.settings ?? []).map((issue) => ({
-      setting: issue.setting,
-      constraint: issue.constraint,
-      ...(issue.update_mode === undefined
-        ? {}
-        : { update_mode: issue.update_mode }),
-      ...(issue.pending_restart === undefined
-        ? {}
-        : { pending_restart: issue.pending_restart }),
-    }));
+    this.settings = (options?.settings ?? []).map(
+      ({ setting, constraint }) => ({ setting, constraint }),
+    );
  }
 }

@@ -41,21 +41,7 @@ export interface JavaScriptSourceAnalysisFailure {
 export interface JavaScriptSourceAnalysisLimits {
  readonly semanticPrecision?: JavaScriptSemanticPrecisionInput;
  readonly heapMb: number;
-  /** Where `heapMb` was selected. Absent when the caller did not record it. */
-  readonly heapSource?:
-    | "default"
-    | "setting"
-    | "runtime"
-    | "request"
-    | undefined;
  readonly timeoutMs: number;
-  /** Where `timeoutMs` was selected. Absent when the caller did not record it. */
-  readonly timeoutSource?:
-    | "default"
-    | "setting"
-    | "runtime"
-    | "request"
-    | undefined;
 }

 /** Sequential source-analysis authority with independently verified cleanup. */
@@ -1,37 +0,0 @@
-import { readFileSync } from "node:fs";
-import { join } from "node:path";
-import { expect, it } from "vitest";
-import { ANALYSIS_SETTINGS } from "./analysisSettingDefinitions.js";
-import { NUMERIC_LIMIT_REGISTRY } from "./numericLimitRegistry.js";
-
-const inventory = readFileSync(
-  join(import.meta.dirname, "../../docs/design/rea-limit-inventory.md"),
-  "utf8",
-);
-
-it("gives every numeric exception a reason and a matching inventory row", () => {
-  const names = NUMERIC_LIMIT_REGISTRY.map((entry) => entry.name);
-  expect(new Set(names).size).toBe(names.length);
-  const runtimeEnvironments = new Set<string>(
-    Object.values(ANALYSIS_SETTINGS).flatMap((definition) =>
-      "environment" in definition && definition.environment !== undefined
-        ? [definition.environment]
-        : [],
-    ),
-  );
-  for (const entry of NUMERIC_LIMIT_REGISTRY) {
-    expect(entry.update_mode).toBe("restart");
-    expect(entry.reason.trim().length).toBeGreaterThanOrEqual(40);
-    expect(entry.read).toBe(
-      entry.policy === "per-call" ? "per-call" : "startup",
-    );
-    expect(runtimeEnvironments.has(entry.name)).toBe(false);
-    expect(inventory).toContain(`\`${entry.name}\``);
-  }
-  expect(
-    NUMERIC_LIMIT_REGISTRY.filter((entry) => entry.policy === "restart-only"),
-  ).toHaveLength(15);
-  expect(
-    NUMERIC_LIMIT_REGISTRY.filter((entry) => entry.policy === "per-call"),
-  ).toHaveLength(11);
-});
@@ -1,230 +0,0 @@
-/**
- * Numeric `REA_` limits that are not runtime analysis settings.
- *
- * The static check in `scripts/verify/rea-numeric-limits.mjs` fails when a
- * numeric `REA_` limit in `src` is absent from both this list and
- * `ANALYSIS_SETTINGS`. `restart-only` is the durable exception. `per-call`
- * names a limit still read from the launch environment on each use; the
- * runtime migration deletes that entry instead of leaving it here.
- *
- * Narrative bounds, owners, and the non-numeric settings live in
- * `docs/design/rea-limit-inventory.md`.
- */
-export interface NumericLimitRegistryEntry {
-  readonly name: string;
-  readonly update_mode: "restart";
-  readonly policy: "restart-only" | "per-call";
-  readonly read: "startup" | "per-call";
-  readonly reason: string;
-}
-
-export const NUMERIC_LIMIT_REGISTRY = [
-  {
-    name: "REA_BRIDGE_MAX_REQUEST_BYTES",
-    update_mode: "restart",
-    policy: "per-call",
-    read: "per-call",
-    reason:
-      "The Hopper, Ghidra, and Cutter clients measure each request against this ceiling. The value is still taken from the launch environment, so a running process does not see a new value until the runtime migration removes this entry.",
-  },
-  {
-    name: "REA_DEBUGGER_COMMAND_DEADLINE_MS",
-    update_mode: "restart",
-    policy: "per-call",
-    read: "per-call",
-    reason:
-      "GDB and Rizin apply this deadline to each debugger command. The session manager currently copies it at construction from the launch environment; the runtime migration reads the accepted operation snapshot instead.",
-  },
-  {
-    name: "REA_DEBUGGER_MAX_COMMAND_OUTPUT_BYTES",
-    update_mode: "restart",
-    policy: "per-call",
-    read: "per-call",
-    reason:
-      "Each debugger command retains output up to this ceiling. The session manager currently copies it at construction from the launch environment; the runtime migration reads the accepted operation snapshot instead.",
-  },
-  {
-    name: "REA_DEBUGGER_MAX_PENDING_COMMANDS",
-    update_mode: "restart",
-    policy: "restart-only",
-    read: "startup",
-    reason:
-      "Caps the pending-command queue created with the debugger session manager. It is pool capacity for that manager, not a budget checked independently on each command.",
-  },
-  {
-    name: "REA_DEBUGGER_MAX_SESSIONS",
-    update_mode: "restart",
-    policy: "restart-only",
-    read: "startup",
-    reason:
-      "Caps how many debugger sessions the session manager created at startup will admit. Changing the pool size of a manager that already exists requires a new REA process.",
-  },
-  {
-    name: "REA_HOPPER_CALLER_SCAN_BUDGET_MS",
-    update_mode: "restart",
-    policy: "per-call",
-    read: "per-call",
-    reason:
-      "Forward caller reconciliation reads this budget for each scan. It is still resolved from the launch environment; the runtime migration reads the accepted operation snapshot.",
-  },
-  {
-    name: "REA_HOPPER_DEMO_DIALOG_TIMEOUT_MS",
-    update_mode: "restart",
-    policy: "restart-only",
-    read: "startup",
-    reason:
-      "The Linux private-display adapter reads this watch from the process environment when that helper starts. A running adapter does not observe a value stored only in the REA process.",
-  },
-  {
-    name: "REA_JADX_ACTIVE_PROCESSOR_COUNT",
-    update_mode: "restart",
-    policy: "restart-only",
-    read: "startup",
-    reason:
-      "Passed to the JVM as -XX:ActiveProcessorCount when the JADX worker process starts. A running JVM does not adopt a new processor count.",
-  },
-  {
-    name: "REA_JADX_HEAP_MIB",
-    update_mode: "restart",
-    policy: "restart-only",
-    read: "startup",
-    reason:
-      "Passed to the JVM as -Xmx when the JADX worker process starts. A running JVM does not adopt a new heap size.",
-  },
-  {
-    name: "REA_JEB_MCP_TIMEOUT_MS",
-    update_mode: "restart",
-    policy: "per-call",
-    read: "per-call",
-    reason:
-      "Bounds each JEB tools/call and catalog discovery. The connection currently captures the launch value when it is created; the runtime migration reads the accepted snapshot for each request.",
-  },
-  {
-    name: "REA_KUNA_CACHE_MAX_BYTES",
-    update_mode: "restart",
-    policy: "restart-only",
-    read: "startup",
-    reason:
-      "Sizes the Kuna project cache when that cache is constructed for the provider. An existing cache does not resize from a later value.",
-  },
-  {
-    name: "REA_KUNA_JOBS",
-    update_mode: "restart",
-    policy: "restart-only",
-    read: "startup",
-    reason:
-      "Selects the Kuna worker-pool width when the provider builds its run slots. The pool is not resized for a process that is already running.",
-  },
-  {
-    name: "REA_KUNA_PROJECT_TIMEOUT_MS",
-    update_mode: "restart",
-    policy: "per-call",
-    read: "per-call",
-    reason:
-      "Bounds a Kuna project export and the whole-program scans that use that deadline. The configuration object still comes from the launch environment; the runtime migration reads the accepted snapshot at each use.",
-  },
-  {
-    name: "REA_KUNA_TIMEOUT_MS",
-    update_mode: "restart",
-    policy: "per-call",
-    read: "per-call",
-    reason:
-      "Bounds one Kuna function decompile. The configuration object still comes from the launch environment; the runtime migration reads the accepted snapshot at each use.",
-  },
-  {
-    name: "REA_MCP_DOCTOR_DEADLINE_MS",
-    update_mode: "restart",
-    policy: "restart-only",
-    read: "startup",
-    reason:
-      "Bounds the MCP doctor phase while the server is starting. It shapes server startup, not a later analysis call.",
-  },
-  {
-    name: "REA_MCP_FIRST_CATALOG_BUDGET_MS",
-    update_mode: "restart",
-    policy: "restart-only",
-    read: "startup",
-    reason:
-      "Bounds the first MCP catalog phase while the server is starting. It shapes server startup, not a later analysis call.",
-  },
-  {
-    name: "REA_MCP_INITIALIZE_BUDGET_MS",
-    update_mode: "restart",
-    policy: "restart-only",
-    read: "startup",
-    reason:
-      "Bounds the MCP initialize phase while the server is starting. It shapes server startup, not a later analysis call.",
-  },
-  {
-    name: "REA_MCP_MAX_INPUT_ELEMENTS",
-    update_mode: "restart",
-    policy: "restart-only",
-    read: "startup",
-    reason:
-      "Sizes argument admission for the MCP server created at process start. A running server does not rebuild that parser for a new allowance.",
-  },
-  {
-    name: "REA_MCP_MAX_RESPONSE_BYTES",
-    update_mode: "restart",
-    policy: "restart-only",
-    read: "startup",
-    reason:
-      "Sizes the MCP stdio receive buffer when the server process starts. A running transport and the paired client buffer do not adopt a new ceiling.",
-  },
-  {
-    name: "REA_MCP_TOOLS_LIST_BUDGET_MS",
-    update_mode: "restart",
-    policy: "restart-only",
-    read: "startup",
-    reason:
-      "Bounds the MCP tools/list phase while the server is starting. It shapes server startup, not a later analysis call.",
-  },
-  {
-    name: "REA_PWNTOOLS_MAX_INPUT_BYTES",
-    update_mode: "restart",
-    policy: "per-call",
-    read: "per-call",
-    reason:
-      "Default artifact-size admission for a pwntools decode. A per-call producer_limits.input_bytes override already exists; the launch default is still read from the environment and the runtime migration moves that default into the snapshot.",
-  },
-  {
-    name: "REA_RECONNECT_TIMEOUT_SECONDS",
-    update_mode: "restart",
-    policy: "restart-only",
-    read: "startup",
-    reason:
-      "Fixed 30-second value written into the Hopper bridge helper from HOPPER_SHUTDOWN_TIMEOUT_MS. It is not a caller-selected launch setting.",
-  },
-  {
-    name: "REA_SWIFTC_COMPILE_TIMEOUT_MS",
-    update_mode: "restart",
-    policy: "restart-only",
-    read: "startup",
-    reason:
-      "Captured when the Darwin ownership-helper reader is constructed at process start. That helper compile uses the captured deadline, so a later value needs a new REA process.",
-  },
-  {
-    name: "REA_WINDOWS_CHANGE_TIME_DRIFT_MS",
-    update_mode: "restart",
-    policy: "per-call",
-    read: "per-call",
-    reason:
-      "Each Windows ChangeTime observation compares the file against this drift window. The observation still parses the launch environment; the runtime migration reads the accepted operation snapshot.",
-  },
-  {
-    name: "REA_WINDOWS_CHANGE_TIME_SETTLE_MAX_POLLS",
-    update_mode: "restart",
-    policy: "per-call",
-    read: "per-call",
-    reason:
-      "Each Windows ChangeTime settle loop stops after this many polls. The observation still parses the launch environment; the runtime migration reads the accepted operation snapshot.",
-  },
-  {
-    name: "REA_WINDOWS_CHANGE_TIME_SETTLE_POLL_MS",
-    update_mode: "restart",
-    policy: "per-call",
-    read: "per-call",
-    reason:
-      "Each Windows ChangeTime settle loop waits this long between reads. The observation still parses the launch environment; the runtime migration reads the accepted operation snapshot.",
-  },
-] as const satisfies readonly NumericLimitRegistryEntry[];
@@ -3,9 +3,49 @@ import {
  inspectPythonPycInputSchema,
  pythonPycMarshalProfile,
  PYTHON_PYC_MARSHAL_PROFILES,
+  pythonPycHeaderSchema,
 } from "./pythonPyc.js";
 import { pythonBytecodeIdentity } from "./pythonBytecodeIdentity.js";

+const hashHeader = {
+  magic: 3531,
+  python_version: "3.12",
+  code_layout: "py311",
+  flags: 3,
+  hash_based: true,
+  check_source: true,
+  source_hash_hex: "0123456789abcdef",
+  source_mtime: null,
+  source_size: null,
+};
+
+it.each(["", "ab", "g".repeat(16)])(
+  "rejects an invalid source hash %j",
+  (source_hash_hex) => {
+    expect(
+      pythonPycHeaderSchema.safeParse({ ...hashHeader, source_hash_hex })
+        .success,
+    ).toBe(false);
+  },
+);
+
+it.each([
+  { hash_based: false },
+  { check_source: false },
+  { source_hash_hex: null },
+  { source_mtime: 0 },
+  { source_size: 0 },
+])("keeps header facts consistent with the recorded flags: %j", (changed) => {
+  expect(
+    pythonPycHeaderSchema.safeParse({ ...hashHeader, ...changed }).success,
+  ).toBe(false);
+});
+
+it("preserves unknown raw header flags and valid hash bytes", () => {
+  const header = { ...hashHeader, flags: 0x80000003 };
+  expect(pythonPycHeaderSchema.parse(header)).toEqual(header);
+});
+
 it("keeps pinned CPython identity separate from standalone marshal coverage", () => {
  expect(pythonPycMarshalProfile(3394)).toEqual({
    code_layout: "py37",
@@ -205,17 +205,53 @@ const pythonCodeObjectSchema = z.strictObject({
 });
 export type PythonPycCodeObject = z.infer<typeof pythonCodeObjectSchema>;

-export const pythonPycHeaderSchema = z.strictObject({
-  magic: z.number().int().min(0).max(0xffff),
-  python_version: z.string().min(1),
-  code_layout: z.enum(PYTHON_PYC_CODE_LAYOUTS),
-  flags: uint,
-  hash_based: z.boolean(),
-  check_source: z.boolean(),
-  source_hash_hex: z.string().nullable(),
-  source_mtime: uint.nullable(),
-  source_size: uint.nullable(),
-});
+export const pythonPycHeaderSchema = z
+  .strictObject({
+    magic: z.number().int().min(0).max(0xffff),
+    python_version: z.string().min(1),
+    code_layout: z.enum(PYTHON_PYC_CODE_LAYOUTS),
+    flags: uint,
+    hash_based: z.boolean(),
+    check_source: z.boolean(),
+    source_hash_hex: z
+      .string()
+      .regex(/^[0-9a-f]{16}$/u)
+      .nullable(),
+    source_mtime: uint.nullable(),
+    source_size: uint.nullable(),
+  })
+  .superRefine((header, context) => {
+    for (const [field, flag] of [
+      ["hash_based", PYTHON_PYC_HASH_BASED],
+      ["check_source", PYTHON_PYC_CHECK_SOURCE],
+    ] as const)
+      if (header[field] !== ((header.flags & flag) !== 0))
+        context.addIssue({
+          code: "custom",
+          path: [field],
+          message: `${field} disagrees with its recorded header flag.`,
+        });
+    if (header.hash_based === (header.source_hash_hex === null))
+      context.addIssue({
+        code: "custom",
+        path: ["source_hash_hex"],
+        message:
+          "Hash-based pycs require an 8-byte source hash; others must omit it.",
+      });
+    if (header.hash_based === (header.source_mtime !== null))
+      context.addIssue({
+        code: "custom",
+        path: ["source_mtime"],
+        message: "Timestamp pycs require mtime; hash-based pycs must omit it.",
+      });
+    if (header.hash_based === (header.source_size !== null))
+      context.addIssue({
+        code: "custom",
+        path: ["source_size"],
+        message:
+          "Timestamp pycs require source_size; hash-based pycs must omit it.",
+      });
+  });

 /** Bounded CPython 3.7–3.13 pyc observation; marshal is walked, bytecode is not decompiled. */
 export const pythonPycSchema = z
@@ -253,29 +289,6 @@ export const pythonPycSchema = z
        message: "Marshal byte count disagrees with the header-stripped file.",
      });
    }
-    if (report.header.hash_based === (report.header.source_hash_hex === null)) {
-      context.addIssue({
-        code: "custom",
-        path: ["header", "source_hash_hex"],
-        message:
-          "Hash-based pycs require an 8-byte source hash; others must omit it.",
-      });
-    }
-    if (report.header.hash_based === (report.header.source_mtime !== null)) {
-      context.addIssue({
-        code: "custom",
-        path: ["header", "source_mtime"],
-        message: "Timestamp pycs require mtime; hash-based pycs must omit it.",
-      });
-    }
-    if (report.header.hash_based === (report.header.source_size !== null)) {
-      context.addIssue({
-        code: "custom",
-        path: ["header", "source_size"],
-        message:
-          "Timestamp pycs require source_size; hash-based pycs must omit it.",
-      });
-    }
    if (report.coverage.code_objects !== report.code_objects.length) {
      context.addIssue({
        code: "custom",
@@ -79,8 +79,7 @@ export const webNetworkCaptureBudgetFacts = (
        ? MAX_WEB_NETWORK_CAPTURE_NESTING_DEPTH
        : Number.MAX_SAFE_INTEGER,
    applies_at: "next_operation",
-    update_mode: "parameter" as const,
-    pending_restart: false as const,
+    rea_restart_required: false,
  };
 };

@@ -1,4 +1,3 @@
-import { readFile } from "node:fs/promises";
 import { describe, expect, it } from "vitest";

 import type { JsonValue } from "../domain/jsonValue.js";
@@ -1120,25 +1119,6 @@ describe("Ghidra native instruction decoder context for ARM TMode and MIPS ISA_M
  });
 });

-// Kept on the file rather than in its own suite. The full source run collected
-// that suite with no tests and failed the file before this assertion could run.
-it("binds TMode to ARM and ISA_MODE to MIPS in the Ghidra bridge script", async () => {
-  const bridgePath = new URL(
-    "../../bridge/ghidra/ReaGhidraBridge.java",
-    import.meta.url,
-  );
-  const content = await readFile(bridgePath, "utf8");
-  expect(content).toContain(
-    'currentProgram.getLanguageID().getIdAsString().startsWith("ARM:")',
-  );
-  expect(content).toContain(
-    'currentProgram.getLanguageID().getIdAsString().startsWith("MIPS:")',
-  );
-  expect(content).toContain('"TMode"');
-  expect(content).toContain('"ISA_MODE"');
-  expect(content).toContain('"ghidra-program-context"');
-});
-
 describe("Ghidra dossier nested boundary composition", () => {
  const identityLocations = [
    "caller",
@@ -1868,8 +1868,7 @@ describe("Ghidra decompiler failure projection", () => {
            applies_at: "next_operation",
            agent_editable: true,
            scope: "rea-runtime",
-            update_mode: "runtime",
-            pending_restart: false,
+            rea_restart_required: false,
          },
        },
      });
@@ -1984,8 +1983,7 @@ describe("Ghidra decompile deadline for a finished invocation", () => {
        minimum: 1,
        maximum: 2_147_483,
        agent_editable: true,
-        update_mode: "runtime",
-        pending_restart: false,
+        rea_restart_required: false,
      };
      expect(invocation.details?.limit).toEqual({
        ...enforced,
@@ -4367,8 +4365,7 @@ describe("Ghidra startup deadline for a finished invocation", () => {
    setting: "ghidra.startup_timeout_ms",
    effective_value: 250,
    agent_editable: true,
-    update_mode: "runtime",
-    pending_restart: false,
+    rea_restart_required: false,
  };
  const invocationLimit = {
    ...startupLimit,
@@ -187,8 +187,7 @@ it.each(["initialize", "transport"])(
        applies_at: "next_operation",
        agent_editable: true,
        scope: "rea-runtime",
-        update_mode: "runtime",
-        pending_restart: false,
+        rea_restart_required: false,
      },
      diagnostics: { producer_fact: "retained" },
    });
@@ -948,7 +948,7 @@ export class JavaScriptAnalysisWorker {
        limit: analysisSettingLimit(
          "javascript.max_heap_mb",
          this.limits.heapMb,
-          this.limits.heapSource,
+          undefined,
        ),
        remediationAction: javaScriptWorkerHeapRemediation(this.limits.heapMb),
      },
@@ -1147,7 +1147,7 @@ export class JavaScriptAnalysisWorker {
          limit: analysisSettingLimit(
            "javascript.analysis_timeout_ms",
            this.limits.timeoutMs,
-            this.limits.timeoutSource,
+            undefined,
          ),
          capturedOutput: this.#captured(),
          userMessage: `JavaScript source analysis reached its ${String(this.limits.timeoutMs)}ms per-source server/provider deadline (analysis_timeout_ms), not the MCP client deadline.`,
@@ -1182,7 +1182,7 @@ export class JavaScriptAnalysisWorker {
                limit: analysisSettingLimit(
                  "javascript.max_heap_mb",
                  this.limits.heapMb,
-                  this.limits.heapSource,
+                  undefined,
                ),
              }
            : {}),
@@ -22,8 +22,7 @@ export const debuggerAdmissionDiagnostics = (
  readonly minimum: number;
  readonly maximum: number;
  readonly unit: DebuggerAdmissionLimit["unit"];
-  readonly update_mode: "restart";
-  readonly pending_restart: false;
+  readonly restart_required: true;
 } => ({
  setting: admission.setting,
  effective_value: admission.value,
@@ -32,8 +31,7 @@ export const debuggerAdmissionDiagnostics = (
  minimum: admission.minimum,
  maximum: admission.maximum,
  unit: admission.unit,
-  update_mode: "restart",
-  pending_restart: false,
+  restart_required: true,
 });

 /** Name the setting, the effective value, its source, the range, and a restart. */
@@ -1066,15 +1066,7 @@ it("enforces a selected command deadline and completes a corrected retry after c
  if (timed.ok) throw new Error("Selected 20 ms deadline was not enforced");
  expect(projectAnalysisError(timed.error)).toMatchObject({
    code: "provider_timeout",
-    details: {
-      timeout_ms: 20,
-      limit: {
-        setting: "wasm.command_timeout_ms",
-        effective_value: 20,
-        source: "request",
-        update_mode: "parameter",
-      },
-    },
+    details: { timeout_ms: 20 },
    remediation: { action: expect.stringContaining("command_timeout_ms") },
  });
  expect(timed.error.cleanupIncomplete).toBe(false);
@@ -229,10 +229,6 @@ export class WabtArtifactProvider implements WasmArtifactPort {
      input.command_timeout_ms ??
      options?.commandTimeoutMs ??
      DEFAULT_WASM_COMMAND_TIMEOUT_MS;
-    const commandTimeoutSource =
-      input.command_timeout_ms !== undefined
-        ? "request"
-        : options?.commandTimeoutSource;
    try {
      if (options?.signal?.aborted)
        throw new AnalysisCancelledError(OPERATION, {
@@ -699,9 +695,6 @@ export class WabtArtifactProvider implements WasmArtifactPort {
        phase === "artifact" ? artifactInput.path : input.path,
        {
          commandTimeoutMs,
-          ...(commandTimeoutSource === undefined
-            ? {}
-            : { commandTimeoutSource }),
          limits,
          inputField: artifactInput.field,
          observedOutput: capturedOutput,
@@ -52,8 +52,7 @@ it.each(["configuration", "producer"] as const)(
              limit: {
                setting: "wasm.command_timeout_ms",
                effective_value: 1234,
-                update_mode: "runtime",
-                pending_restart: false,
+                rea_restart_required: false,
              },
            },
            recovery: { kind: "inspect_timeout_state", timeout_ms: 1234 },
@@ -116,30 +115,11 @@ it.each([1234, 2_147_483_647])(
          parameter: "command_timeout_ms",
          applies_at: "next_operation",
          agent_editable: true,
-          update_mode: "runtime",
-          pending_restart: false,
+          rea_restart_required: false,
        },
      },
      recovery: { kind: "inspect_timeout_state", timeout_ms: commandTimeoutMs },
    });
-    expect(
-      projectAnalysisError(
-        wabtFailure(
-          new OwnedCommandFailure("timeout", "deadline"),
-          "producer",
-          "/module.wasm",
-          { commandTimeoutMs, commandTimeoutSource: "request" },
-        ),
-      ),
-    ).toMatchObject({
-      details: {
-        limit: {
-          source: "request",
-          update_mode: "parameter",
-          effective_value: commandTimeoutMs,
-        },
-      },
-    });
  },
 );

@@ -63,12 +63,6 @@ export type WabtVersionProbe = {

 type WabtFailureContext = {
  readonly commandTimeoutMs: number;
-  readonly commandTimeoutSource?:
-    | "default"
-    | "setting"
-    | "runtime"
-    | "request"
-    | undefined;
  readonly limits?: WasmResourceLimits;
  readonly versionProbe?: WabtVersionProbe;
  readonly inputField?: readonly (string | number)[];
@@ -188,17 +182,13 @@ const classifyWabtFailure = (
    // Classify once before cleanup takes precedence, so the primary remains actionable.
    const timeoutMs =
      execution?.commandTimeoutMs ?? DEFAULT_WASM_COMMAND_TIMEOUT_MS;
-    const timeoutSource =
-      execution?.commandTimeoutMs === undefined
-        ? "default"
-        : execution.commandTimeoutSource;
    const timeout =
      cause.reason === "timeout"
        ? new AnalysisTimeoutError("inspect_wasm_artifact", timeoutMs, {
            limit: analysisSettingLimit(
              "wasm.command_timeout_ms",
              timeoutMs,
-              timeoutSource,
+              undefined,
            ),
            ...options,
            // The cleanup wrapper retains output once; its nested primary needs only recovery facts.
@@ -148,7 +148,7 @@ it("advertises exact contracts and recovers a full large-index archive over one
    expect(updated.structuredContent).toMatchObject({
      revision: 1,
      active_work_changed: false,
-      pending_restart: false,
+      rea_restart_required: false,
    });
    const recovered = await invoke("inspect_artifact", {});
    expect(recovered.isError).not.toBe(true);
@@ -186,8 +186,7 @@ for (const reader of readers)
          effective_value: reader.value,
          applies_at: "next_operation",
          agent_editable: true,
-          update_mode: "parameter",
-          pending_restart: false,
+          rea_restart_required: false,
        },
      },
    });
@@ -87,8 +87,7 @@ it.skipIf(process.versions.bun !== undefined && jobLimit === null)(
            setting: "capture.decoder_old_generation_mib",
            effective_value: testHeap.oldGenerationMiB,
            source: testHeap.source,
-            update_mode: "runtime",
-            pending_restart: false,
+            rea_restart_required: false,
          },
          reported_limits:
            jobLimit === null
@@ -148,8 +147,7 @@ it.skipIf(process.versions.bun !== undefined && jobLimit === null)(
          setting: "capture.decoder_old_generation_mib",
          effective_value: testHeap.oldGenerationMiB,
          source: testHeap.source,
-          update_mode: "runtime",
-          pending_restart: false,
+          rea_restart_required: false,
        },
      },
      remediation: {
@@ -216,8 +216,7 @@ it("names the default header admission budget and its setting when source select
        applies_at: "next_operation",
        agent_editable: true,
        scope: "rea-runtime",
-        update_mode: "runtime",
-        pending_restart: false,
+        rea_restart_required: false,
      },
    },
  });
@@ -66,8 +66,7 @@ it.each([
          required_value: needed,
          applies_at: "next_operation",
          agent_editable: true,
-          update_mode: "parameter",
-          pending_restart: false,
+          rea_restart_required: false,
        },
      });
      const recovered = await readDotnetBundle(
@@ -36,9 +36,7 @@ it("preserves full advertised schemas and handler meaning when presentation orde
      REA_MCP_INPUT_SCHEMA_PROFILE: "full",
      REA_MCP_OUTPUT_SCHEMA_PROFILE: "full",
    },
-    // The child advertises the full catalog and calls every browser, Electron,
-    // and JavaScript example. A busy runner exceeded 20s and was killed.
-    timeout: 60_000,
+    timeout: 20_000,
    maxBuffer: 16 * 1024 * 1024,
  });
  const result = resultSchema.parse(JSON.parse(stdout));
@@ -72,8 +72,7 @@ const enforcedLimit = {
  minimum: 1,
  maximum: 2_147_483,
  agent_editable: true,
-  update_mode: "runtime",
-  pending_restart: false,
+  rea_restart_required: false,
 };
 /** A finished invocation can act only through a new invocation's launch value. */
 const invocationLimit = {
@@ -250,15 +250,13 @@ it("returns a directly usable partial analysis reference for an oversized timeou
      limit: {
        setting: "javascript.analysis_timeout_ms",
        effective_value: 1,
-        source: "request",
        parameter: "analysis_timeout_ms",
        unit: "ms",
        minimum: 1,
        maximum: 2_147_483_647,
        applies_at: "next_operation",
        agent_editable: true,
-        update_mode: "parameter",
-        pending_restart: false,
+        rea_restart_required: false,
      },
    });
    expect(error.recovery).toEqual({
@@ -472,8 +472,7 @@ it("stops a slow match at the configured deadline and names the setting", async
    effective_value: 100,
    source: "setting",
    agent_editable: true,
-    update_mode: "runtime",
-    pending_restart: false,
+    rea_restart_required: false,
  });
  expect(projected.remediation.action).toContain(
    regexMatchingDeadlineRecovery({ deadlineMs: 100, source: "setting" }),
@@ -1922,8 +1922,7 @@ it("preserves a timeout while startup waits for the automatic-loading response",
        effective_value: 25,
        source: "setting",
        unit: "ms",
-        update_mode: "restart",
-        pending_restart: false,
+        restart_required: true,
      },
    },
  });
@@ -1,145 +0,0 @@
-import { expect, it } from "vitest";
-import {
-  NUMERIC_LIMIT_DECLARATION,
-  discoverNumericLimitUses,
-  isNumericLimit,
-  requiredRuntimeLimitFailure,
-} from "../../scripts/verify/rea-numeric-limits.mjs";
-
-const ENDPOINT_CANDIDATES = "REA_WEB_BUNDLE_ENDPOINT_LITERAL_CANDIDATES";
-
-it("recognizes the documented endpoint-candidate limit as numeric", () => {
-  expect(isNumericLimit(ENDPOINT_CANDIDATES)).toBe(true);
-  const discovered = discoverNumericLimitUses([
-    {
-      path: "src/domain/webBundleAnalysis.ts",
-      source: `const candidates = process.env.${ENDPOINT_CANDIDATES};`,
-    },
-  ]);
-  expect(discovered.get(ENDPOINT_CANDIDATES)).toBe(
-    "src/domain/webBundleAnalysis.ts",
-  );
-});
-
-it("does not treat a registry declaration as a producer", () => {
-  const name = "REA_REMOVED_MAX_BYTES";
-  const discovered = discoverNumericLimitUses([
-    {
-      path: NUMERIC_LIMIT_DECLARATION,
-      source: `name: "${name}",`,
-    },
-    {
-      path: "src/config/removedLimit.ts",
-      source: `const value = process.env.${name};`,
-    },
-  ]);
-  expect(discovered.get(name)).toBe("src/config/removedLimit.ts");
-  expect(
-    discoverNumericLimitUses([
-      { path: NUMERIC_LIMIT_DECLARATION, source: `name: "${name}",` },
-    ]).has(name),
-  ).toBe(false);
-});
-
-it("keeps a helper-call argument that is not the first argument", () => {
-  const name = "REA_NEW_MAX_BYTES";
-  const discovered = discoverNumericLimitUses([
-    {
-      path: "src/config/newLimit.ts",
-      source: `const setting = "${name}";\nconst value = read(environment, setting);`,
-    },
-    {
-      path: "src/config/literalLimit.ts",
-      source: `const value = read(environment, "${name}");`,
-    },
-  ]);
-  expect(discovered.get(name)).toBe("src/config/newLimit.ts");
-});
-
-it("does not treat prose that mentions a limit name as a producer", () => {
-  const name = "REA_NEW_MAX_BYTES";
-  const discovered = discoverNumericLimitUses([
-    {
-      path: "src/domain/native/nativeDeadlines.ts",
-      source: `const guidance = "input_bytes overrides ${name}; otherwise that launch default applies.";`,
-    },
-  ]);
-  expect(discovered.has(name)).toBe(false);
-});
-
-it("keeps a destructured environment key, including a rename and a default", () => {
-  const name = "REA_NEW_MAX_BYTES";
-  const discovered = discoverNumericLimitUses([
-    {
-      path: "src/config/newLimit.ts",
-      source: `const { ${name}: renamed = 1 } = process.env;\nconst present = "${name}" in environment;\nconst owned = Object.hasOwn(environment, "${name}");\nconst source = { ${name}: renamed };\nconst copy = { ...source };`,
-    },
-  ]);
-  expect(discovered.get(name)).toBe("src/config/newLimit.ts");
-});
-
-it("does not invent a limit from a spread of the environment object", () => {
-  const discovered = discoverNumericLimitUses([
-    {
-      path: "src/config/newLimit.ts",
-      source: "const copy = { ...process.env, ...environment };",
-    },
-  ]);
-  expect(discovered.size).toBe(0);
-});
-
-it("keeps a bracket-access read as a producer", () => {
-  const name = "REA_NEW_MAX_BYTES";
-  const discovered = discoverNumericLimitUses([
-    {
-      path: "src/config/newLimit.ts",
-      source: `const selected = environment["${name}"] ?? environment?.[ "${name}" ];`,
-    },
-  ]);
-  expect(discovered.get(name)).toBe("src/config/newLimit.ts");
-});
-
-it("does not treat a registration allowlist or a comment as a producer", () => {
-  const discovered = discoverNumericLimitUses([
-    {
-      path: NUMERIC_LIMIT_DECLARATION,
-      source: `name: "${ENDPOINT_CANDIDATES}",`,
-    },
-    {
-      path: "src/application/SetupRegistrationEnvironment.ts",
-      source: `const SELECTED_REGISTRATION_SETTINGS = ["${ENDPOINT_CANDIDATES}"] as const;`,
-    },
-    {
-      path: "src/config/removedLimit.ts",
-      source: `// ${ENDPOINT_CANDIDATES} used to be read here\nconst unrelated = 1;\n`,
-    },
-  ]);
-  expect(discovered.has(ENDPOINT_CANDIDATES)).toBe(false);
-});
-
-it("requires the tracked endpoint-candidate limit to be an analysis setting", () => {
-  expect(
-    requiredRuntimeLimitFailure(ENDPOINT_CANDIDATES, {
-      inRuntime: false,
-      inRegistry: true,
-    }),
-  ).toMatch(/ANALYSIS_SETTINGS/);
-  expect(
-    requiredRuntimeLimitFailure(ENDPOINT_CANDIDATES, {
-      inRuntime: true,
-      inRegistry: false,
-    }),
-  ).toBeUndefined();
-  expect(
-    requiredRuntimeLimitFailure("REA_NTFS_MFT_MAX_FILE_BYTES", {
-      inRuntime: false,
-      inRegistry: false,
-    }),
-  ).toMatch(/ANALYSIS_SETTINGS/);
-  expect(
-    requiredRuntimeLimitFailure("REA_REGF_HIVE_MAX_FILE_BYTES", {
-      inRuntime: true,
-      inRegistry: true,
-    }),
-  ).toMatch(/numericLimitRegistry/);
-});