Merge main into codex/codebase-cleanup-audit

Resolve javascriptSemanticAsyncEffects imports: isUnmodifiedGlobalReference
now lives in javascriptSemanticGlobalReference (this branch), while main's
createGlobalReferenceReader and semanticOpaqueGlobalMayHaveChanged keep
their owners.

.oxlintrc.json

@@ -63,6 +63,18 @@
     "rea/no-shared-module-mock": "error"
   },
   "overrides": [
+    {
+      "files": ["src/domain/**/*.ts"],
+      "rules": { "rea/no-locale-compare": "error" }
+    },
+    {
+      "files": [
+        "src/domain/**/*.test.ts",
+        "src/domain/**/*.spec.ts",
+        "src/domain/**/*.fixture.ts"
+      ],
+      "rules": { "rea/no-locale-compare": "off" }
+    },
     {
       "files": [
         "scripts/electron-active-hook*.cjs",
@@ -76,12 +88,19 @@
     {
       "files": ["src/**/*.ts"],
       "rules": {
+        "rea/no-babel-visitor-keys": "error",
         "typescript/no-misused-promises": "error"
       }
     },
     {
-      "files": ["tests/**/*.ts", "src/**/*.test.ts", "src/**/*.fixture.ts"],
+      "files": [
+        "tests/**/*.ts",
+        "src/**/*.test.ts",
+        "src/**/*.spec.ts",
+        "src/**/*.fixture.ts"
+      ],
       "rules": {
+        "rea/no-babel-visitor-keys": "off",
         "max-lines": "off",
         "max-lines-per-function": [
           "error",
@@ -94,6 +113,10 @@
         "typescript/no-misused-promises": "warn"
       }
     },
+    {
+      "files": ["src/domain/javascript/javascriptSemanticTraversal.ts"],
+      "rules": { "rea/no-babel-visitor-keys": "off" }
+    },
     {
       "files": ["src/application/**/*.test.ts"],
       "rules": {

docs/development/testing.md

@@ -1091,32 +1091,11 @@ existing four-minute timing collection plus the bounded diagnostic stages.
 
 Fast built shards target under ten minutes of uncontended shard-job execution.
 That figure is the `test-shard` job. The job waits for classification and the
-build, and the portable-test merge runs after the slowest shard. On 2026-10-20,
-run `39451548945` measured those surrounding jobs with runner queue excluded:
-classification 15 seconds, build 49 seconds, and the portable-test merge 29
-seconds. Shard 1/5 of that run spent 22 seconds before built Vitest and 3
-seconds after it, including `npm ci` at 9 seconds. `node_modules` is about 674
-MiB, so publishing it as a shared artifact would transfer more data than that
-install saves. The npm download cache stays the setup cache.
-
-File timings from that run put the built suite at 7944 seconds of module time.
-The sequencer keeps each file's full duration on one worker. Extra workers
-overlap other files in the same sequence group, and `process-boundary` runs
-after that group. Scheduling the unsplit inventory onto five shards peaks at
-820 seconds of tests. That run's slowest built shard job lasted 925 seconds
-(shard 4/5), and shard 1/5 spent 874 seconds in built Vitest, so hosted job
-time sits above the file schedule. Six shards of the same inventory peak at
-684 seconds of tests. Eight shards, after the 578-second loader file is split
-by case count (54 cases stay in that file and 46 move into each of three
-files), peak at 513 seconds of tests. With the measured 25-second shard setup,
-that shard job is about 538 seconds. Adding the measured classification, build,
-and merge makes an uncontended portable critical path of about 631 seconds,
-still before the gap between this file schedule and hosted Vitest. Runner queue
-is separate and grows when more shard jobs compete for runners.
+build, and the portable-test merge runs after the slowest shard. Runner queue is
+separate and grows when more shard jobs compete for runners. The npm download
+cache stays the setup cache rather than a shared `node_modules` artifact.
 `process-boundary` stays serial because process-tree sampling shares the host.
-Raising the worker cap from two to four on this four-core host cut a six-file
-acceptance sample from 96–101 seconds to 71 seconds and did not remove the
-single-file floor. Hosted CI jobs use four workers; other hosts stay at two
+Hosted CI jobs use four workers; other hosts stay at two
 because they are shared with other checks. Full qualification keeps six covered
 shards; its longer instrumentation is outside this fast budget.
 

docs/http3-capture-lab.md

@@ -174,7 +174,9 @@ Official references: [mitmproxy protocol support](https://github.com/mitmproxy/m
 
 ## Verifier regressions
 
-After building REA, run these inside the same isolated guest:
+The built process-boundary test suite runs the Node verifier regressions on
+POSIX hosts. To run them directly after building REA, and to run the Python
+laboratory regressions with its pinned dependencies, use the isolated guest:
 
 ```sh
 node --test scripts/lib/http3-verifier-lifecycle.test.mjs scripts/lib/http3-capture-assertions.test.mjs

docs/reverse-engineering-tools.md

@@ -96,6 +96,10 @@ Persistent command Evidence retains the caller-selected and resolved startup pat
 
 Session status retains up to 64 recent protocol frames. Each history entry keeps a complete-character UTF-8 prefix of at most 16 KiB, plus a truncation marker when needed; `recent_output_truncated` reports omitted history. This history budget also accounts for replacement characters from invalid UTF-8. It does not shorten command Evidence, whose output budget defaults to 16 MiB. Rizin debug startup waits 30000 ms with no runtime override. Each command frame defaults to 120000 ms; its deadline, command-output budget, session capacity and pending-command queue use the [shared debugger launch settings](#debugger-launch-settings). The 16777216-byte frame cap and 4096-frame command cap remain fixed. Evidence names the cap that stopped the command. The one-shot `command_timeout_ms` setting does not change a debug session.
 
+### Stopped debugger sessions
+
+A Rizin or GDB session stops accepting commands when REA stops it, for example after an output or frame limit, a command deadline, cancellation or a protocol failure, or when the debugger process exits. REA keeps the stopped session and the first reason it observed until `close_rizin_debug_session` or `close_gdb_session` releases it, including after a retried cleanup succeeds. `rizin_debug_session_status` and `gdb_session_status` then report `state: "closed"` with that reason in `closed_reason`. A later `rizin_debug_command` or `gdb_console` on the session fails with `capability_unavailable`; `details.reason` carries the same reason, and the remediation is to close the session and start a new one. A `session_id` that this server never returned, or that close already released, fails with `invalid_request` instead.
+
 ### Debugger launch settings
 
 GDB and Rizin share these settings in the environment that launches REA:
@@ -136,6 +140,8 @@ rea debug-with-rizin --inferior-tty /dev/pts/7 ./program dr
 rea execute-rizin-command ./program iI
 ```
 
+Rizin exits with status 0 even when its shell refuses a statement, so the exit code does not show whether the command ran. Rizin 0.6 through 0.9.1 log one of four stderr lines for such a refusal: `ERROR: Command '…' does not exist.`, ``ERROR: Wrong number of arguments passed to `…`…``, `ERROR: core: Error while executing command: …` (an invalid statement), or `ERROR: core: Error while parsing command: …`. Rizin then skips the refused statement and every later one in the command. When the completed process's stderr contains one of these lines, REA reports `completion_status: "rejected"` and adds a limitation naming the refusal. stdout then holds only the output of earlier statements, so empty stdout is not an empty result. Other `ERROR:` lines, such as `ERROR: Cannot find function at …`, come from commands that ran; REA keeps them in stderr and reports `complete`. A command that lowers `log.level` or redirects stderr hides refusals from REA.
+
 Captured stdout and stderr use the same `max_output_bytes` (CLI: `--max-output-bytes`) admission and recovery described above, default 16 MiB. One-shot commands independently use `command_timeout_ms`. Raising output admission cannot recover an earlier capture; command effects and cleanup must be checked before another invocation.
 
 ### Decoder and map inputs

docs/testing-lanes.md

@@ -842,14 +842,8 @@ branches are not producers. A tier with no qualifying artifact leaves history
 unset, and Vitest uses its own assignment. A later schedule that reuses
 qualification without uploading timings leaves the previous artifact in place.
 
-On 2026-10-21 the newest full history was run
-`39545047294`, recorded before compiled-CLI session reuse. Fast run
-`39552964873` packed its eight built shards from that history, and those shard
-jobs executed for 319–591 seconds. Replaying that run's file durations through
-the sequencer's two-worker schedule balances every shard at about 404 seconds
-of file time. The same replay with the stale history weights leaves the slowest
-shard near 547 seconds and the fastest near 293. That spread is file-schedule
-time, not runner queue, which is why each tier keeps its own history.
+Each tier keeps its own history because stale weights from another tier, or
+from before a large test change, unbalance the shards.
 CI assigns discovered files by historical duration rather than dividing only
 by file count. A file with no recorded duration, such as a newly added or
 renamed test, is weighted at the median recorded duration until a published

knip.json

@@ -3,6 +3,7 @@
   "entry": [
     "src/main.ts",
     "src/cli.ts",
+    "src/cliOneShot.ts",
     "src/cliOutput.ts",
     "src/cliBuiltinArguments.ts",
     "src/cli/cliResultOutput.ts",

knip.production.json

@@ -3,6 +3,7 @@
   "entry": [
     "src/main.ts!",
     "src/cli.ts!",
+    "src/cliOneShot.ts!",
     "src/cliOutput.ts!",
     "src/cliBuiltinArguments.ts!",
     "src/cli/cliResultOutput.ts!",

scripts/bundle-runtime.mjs

@@ -24,7 +24,7 @@ export const bundleRuntime = async (root) => {
       "cli-runtime",
       {
         cli: "cli.js",
-        cliOutput: "cliOutput.js",
+        cliOneShot: "cliOneShot.js",
         cliBuiltinArguments: "cliBuiltinArguments.js",
         cliResultOutput: "cli/cliResultOutput.js",
         mcpDoctor: "mcpDoctor.js",

scripts/check-dependency-install.mjs

@@ -14,7 +14,7 @@ const directDependencies = (rootPackage) => ({
 const installedPackageKey = (name) => `node_modules/${name}`;
 
 /** Compare root direct dependencies with npm's hidden installed lockfile. */
-export const dependencyInstallProblems = (rootLock, installedLock) => {
+const dependencyInstallProblems = (rootLock, installedLock) => {
   const rootPackage = rootLock.packages?.[""];
   if (rootPackage === undefined)
     return ["package-lock.json does not contain a root package entry"];

scripts/ci/cache-retention.d.mts

@@ -26,8 +26,6 @@ export type CacheRequest = (
   endpoint: string,
 ) => Promise<unknown>;
 
-export function assertRetentionPrefix(prefix: string): void;
-
 export function selectPrefixDeletions(
   caches: readonly unknown[],
   family?: RetentionFamily,

scripts/ci/cache-retention.mjs

@@ -22,7 +22,7 @@ const PREFIX_PATTERNS = [
 ];
 
 /** Reject prefixes that could match npm downloads or another platform. */
-export function assertRetentionPrefix(prefix) {
+function assertRetentionPrefix(prefix) {
   if (
     typeof prefix !== "string" ||
     !PREFIX_PATTERNS.some((pattern) => pattern.test(prefix))

scripts/ci/failure-report.d.mts

@@ -99,9 +99,3 @@ export function createGitHubApi(options?: {
     budget: { requests: number; startedAt: number; limitMs: number },
   ) => Promise<unknown>;
 }): FailureReportApi;
-
-export function writeFailureReport(
-  report: CiFailureReport,
-  outputDirectory?: string,
-  summaryPath?: string,
-): Promise<{ jsonPath: string; markdownPath: string }>;

scripts/ci/failure-report.mjs

@@ -467,7 +467,7 @@ function errorCode(error) {
   return error instanceof Error ? error.message.slice(0, 160) : "unknown_error";
 }
 
-export async function writeFailureReport(
+async function writeFailureReport(
   report,
   outputDirectory = OUTPUT_DIRECTORY,
   summaryPath,

scripts/ci/pr-ci-health.d.mts

@@ -91,5 +91,4 @@ export function writePrCiHealthReport(
   outputDirectory?: string,
 ): Promise<{ jsonPath: string; markdownPath: string }>;
 
-export function renderMarkdownSummary(report: PrCiHealthReport): string;
 import type { GitHubApiRequest } from "./github-api.mjs";

scripts/ci/pr-ci-health.mjs

@@ -656,7 +656,7 @@ export async function writePrCiHealthReport(
   return { jsonPath, markdownPath };
 }
 
-export function renderMarkdownSummary(report) {
+function renderMarkdownSummary(report) {
   const rows = report.pullRequests.map(
     (pull) =>
       `| #${String(pull.number ?? "?")} | ${escapeCell(pull.head.repository ?? "unknown")} | ${escapeCell(pull.head.ref ?? "unknown")} | \`${pull.head.sha ?? "unknown"}\` | ${pull.ci.category} | ${escapeCell(pull.ci.reason)} |`,

scripts/ci/production-reachability-report.d.mts

@@ -28,6 +28,3 @@ export interface ProductionReachabilityReport {
 export function parseProductionReachabilityReport(
   text: string,
 ): ProductionReachabilityReport;
-export function recordProductionReachabilityReport(
-  root?: string,
-): Promise<ProductionReachabilityReport>;

scripts/ci/production-reachability-report.mjs

@@ -34,9 +34,7 @@ export const parseProductionReachabilityReport = (text) =>
   reportSchema.parse(JSON.parse(text));
 
 /** Run production reachability without turning candidates into failures. */
-export const recordProductionReachabilityReport = async (
-  root = process.cwd(),
-) => {
+const recordProductionReachabilityReport = async (root = process.cwd()) => {
   const reportDirectory = join(root, ".cache", "static-checks");
   const reportPath = join(reportDirectory, "production-reachability.json");
 

scripts/fixtures/apple/macos-bundle.mjs

@@ -6,7 +6,7 @@ import { promisify } from "node:util";
 const exec = promisify(execFile);
 
 /** Commands the macOS bundle fixture needs from Command Line Tools. */
-export const MACOS_BUNDLE_FIXTURE_COMMANDS = [
+const MACOS_BUNDLE_FIXTURE_COMMANDS = [
   ["/usr/bin/xcrun", ["--find", "clang"]],
   ["/usr/bin/xcrun", ["--find", "codesign"]],
   ["/usr/bin/ditto", ["-h"]],

scripts/lib/browser-verifier-assertions.mjs

@@ -1,4 +1,4 @@
-export function sourceMapSummary(sourceMaps) {
+function sourceMapSummary(sourceMaps) {
   return {
     status: sourceMaps.status,
     requested: sourceMaps.requested,

scripts/lib/cursor-plugin-bundle.d.mts

@@ -1,11 +1,3 @@
-export const CURSOR_PLUGIN_MANIFEST: ".cursor-plugin/plugin.json";
-export const CURSOR_PLUGIN_MCP: "mcp.json";
-export const AUTHORED_SKILL_DIRECTORY: ".agents/skills/reverse-engineer-anything";
-export const CURSOR_PLUGIN_SKILLS: ".cursor-plugin/skills";
-export const CURSOR_PLUGIN_SKILL: "reverse-engineer-anything";
-export const CURSOR_PLUGIN_LOGO: "assets/rea-plugin.png";
-export const CURSOR_PLUGIN_REPOSITORY: "https://github.com/morluto/rea";
-
 export interface CursorPluginBundleIssue {
   readonly field: string;
 }
@@ -56,11 +48,6 @@ export interface CursorPluginInspection {
   readonly issues: readonly CursorPluginBundleIssue[];
 }
 
-export function cursorPluginSkillPaths(
-  directory: string,
-  prefix?: string,
-): Promise<readonly string[] | null>;
-
 export function cursorPluginBundleIssues(
   input: CursorPluginBundleInput,
 ): readonly CursorPluginBundleIssue[];

scripts/lib/cursor-plugin-bundle.mjs

@@ -7,14 +7,13 @@ import { ensureGeneratedFile } from "./generated-file.mjs";
 // publication (name, release version, repository, skill, and icon). The
 // Marketplace checkout has no dist/, so the server is the pinned npm command
 // instead of the bundled launcher.
-export const CURSOR_PLUGIN_MANIFEST = ".cursor-plugin/plugin.json";
-export const CURSOR_PLUGIN_MCP = "mcp.json";
-export const AUTHORED_SKILL_DIRECTORY =
-  ".agents/skills/reverse-engineer-anything";
-export const CURSOR_PLUGIN_SKILLS = ".cursor-plugin/skills";
-export const CURSOR_PLUGIN_SKILL = "reverse-engineer-anything";
-export const CURSOR_PLUGIN_LOGO = "assets/rea-plugin.png";
-export const CURSOR_PLUGIN_REPOSITORY = "https://github.com/morluto/rea";
+const CURSOR_PLUGIN_MANIFEST = ".cursor-plugin/plugin.json";
+const CURSOR_PLUGIN_MCP = "mcp.json";
+const AUTHORED_SKILL_DIRECTORY = ".agents/skills/reverse-engineer-anything";
+const CURSOR_PLUGIN_SKILLS = ".cursor-plugin/skills";
+const CURSOR_PLUGIN_SKILL = "reverse-engineer-anything";
+const CURSOR_PLUGIN_LOGO = "assets/rea-plugin.png";
+const CURSOR_PLUGIN_REPOSITORY = "https://github.com/morluto/rea";
 const GENERATE_COMMAND = "node scripts/generate-cursor-plugin-skill.mjs";
 const INSTALL_LINK_MARKERS = ["install-mcp", "deeplink/mcp", "mcp-install"];
 
@@ -27,7 +26,7 @@ const failure = (code, detail) => {
 const cursorServerArgs = (version) => ["-y", `rea-agents@${version}`, "mcp"];
 
 /** Relative file inventory for one skill directory, in stable order. */
-export const cursorPluginSkillPaths = async (directory, prefix = "") => {
+const cursorPluginSkillPaths = async (directory, prefix = "") => {
   const paths = [];
   let entries;
   try {

scripts/lib/ghidra-windows-byte-search.mjs

@@ -1,6 +1,6 @@
 import assert from "node:assert/strict";
 
-export const WINDOWS_GHIDRA_BYTE_SEARCH_FIXTURE = Object.freeze({
+const WINDOWS_GHIDRA_BYTE_SEARCH_FIXTURE = Object.freeze({
   pattern: "a0 ?? c0",
   mask: "f0 ff f0",
   startFileOffset: 0x380,

scripts/lib/hopper-deadline-cleanup.d.mts

@@ -0,0 +1,16 @@
+import type { ArtifactResourceScope } from "../../src/artifacts/ArtifactResourceScope.js";
+
+export class HopperDeadlineCleanupFailure extends AggregateError {
+  readonly _tag: "HopperDeadlineCleanupFailure";
+  readonly cleanupOwner: HopperDeadlineCleanup;
+  constructor(owner: HopperDeadlineCleanup, failures: unknown[]);
+}
+
+export class HopperDeadlineCleanup {
+  readonly workspace: string;
+  constructor(workspace: string, profile: ArtifactResourceScope);
+  setClient(client: {
+    close(): Promise<{ ok: true } | { ok: false; error: unknown }>;
+  }): void;
+  close(): Promise<void>;
+}

scripts/lib/hopper-deadline-cleanup.mjs

@@ -0,0 +1,71 @@
+import { rm } from "node:fs/promises";
+
+export class HopperDeadlineCleanupFailure extends AggregateError {
+  constructor(owner, failures) {
+    super(
+      failures,
+      `Hopper cleanup incomplete; workspace may remain at ${owner.workspace}`,
+    );
+    this._tag = "HopperDeadlineCleanupFailure";
+    this.cleanupOwner = owner;
+  }
+}
+
+/** Own the client, profile scope, and workspace until all cleanup completes. */
+export class HopperDeadlineCleanup {
+  #client;
+  #profile;
+  #pending;
+  #removed = false;
+
+  constructor(workspace, profile) {
+    this.workspace = workspace;
+    this.#profile = profile;
+  }
+
+  setClient(client) {
+    this.#client = client;
+  }
+
+  close() {
+    if (this.#pending !== undefined) return this.#pending;
+    const attempt = this.#close();
+    const pending = attempt.finally(() => {
+      if (this.#pending === pending) this.#pending = undefined;
+    });
+    this.#pending = pending;
+    return pending;
+  }
+
+  async #close() {
+    if (this.#removed) return;
+    const failures = [];
+    if (this.#client !== undefined) {
+      try {
+        const result = await this.#client.close();
+        if (!result.ok) throw result.error;
+        this.#client = undefined;
+      } catch (cause) {
+        failures.push(cause);
+      }
+    }
+    if (this.#profile !== undefined) {
+      try {
+        await this.#profile.close();
+        this.#profile = undefined;
+      } catch (cause) {
+        failures.push(cause);
+      }
+    }
+    if (failures.length === 0) {
+      try {
+        await rm(this.workspace, { recursive: true, force: true });
+        this.#removed = true;
+        return;
+      } catch (cause) {
+        failures.push(cause);
+      }
+    }
+    throw new HopperDeadlineCleanupFailure(this, failures);
+  }
+}

scripts/lib/http3-capture-assertions.mjs

@@ -64,7 +64,7 @@ function assertHeaders(record, side, headers) {
   }
 }
 
-export function assertEndpointHeaders(actual, expected) {
+function assertEndpointHeaders(actual, expected) {
   // The proxy rebuilds pseudo fields from its HTTP state. Compare their values
   // by name while retaining the exact order and duplicates of regular headers.
   const partition = (headers) => {

scripts/lib/javascript-application-analysis.mjs

@@ -1,28 +1,10 @@
 import { analyzeJavaScriptApplication } from "../../dist/application/javascript/JavaScriptApplicationService.js";
-import { ArtifactResourceScope } from "../../dist/artifacts/ArtifactResourceScope.js";
+import { withVerifierArtifactScope } from "./verifier-artifact-scope.mjs";
 
 /** Analyze one JavaScript application and close its caller-owned resources. */
-export const analyzeJavaScriptApplicationWithOwnedScope = async (input) => {
-  const scope = new ArtifactResourceScope();
-  let outcome;
-  try {
+export const analyzeJavaScriptApplicationWithOwnedScope = (input) =>
+  withVerifierArtifactScope(async (scope) => {
     const result = await analyzeJavaScriptApplication(input, scope);
-    outcome = result.ok
-      ? { kind: "completed", value: result.value }
-      : { kind: "failed", cause: result.error };
-  } catch (cause) {
-    outcome = { kind: "failed", cause };
-  }
-  try {
-    await scope.close();
-  } catch (cleanupCause) {
-    if (outcome.kind === "failed")
-      throw new AggregateError(
-        [outcome.cause, cleanupCause],
-        "JavaScript analysis and artifact cleanup both failed",
-      );
-    throw cleanupCause;
-  }
-  if (outcome.kind === "failed") throw outcome.cause;
-  return outcome.value;
-};
+    if (!result.ok) throw result.error;
+    return result.value;
+  });

scripts/lib/mcp-verifier-results.mjs

@@ -78,7 +78,7 @@ export const expandMcpSessionStatus = (status) => ({
 });
 
 /** Expand provider capability groups while retaining candidate identity/state. */
-export const expandProviderCandidates = (candidates) =>
+const expandProviderCandidates = (candidates) =>
   candidates.map((candidate) => ({
     ...candidate,
     capabilities: expandProviderCapabilities(

scripts/lib/module-boundaries.test.mjs

@@ -1,176 +0,0 @@
-import assert from "node:assert/strict";
-import { spawnSync } from "node:child_process";
-import { mkdir, mkdtemp, rm, writeFile } from "node:fs/promises";
-import { tmpdir } from "node:os";
-import { join } from "node:path";
-import { fileURLToPath, pathToFileURL } from "node:url";
-import { test } from "node:test";
-
-import { inspectModuleBoundaries } from "./module-boundaries.mjs";
-
-const fixture = async () => {
-  const root = await mkdtemp(join(tmpdir(), "rea-module-boundaries-"));
-  await mkdir(join(root, "src/domain"), { recursive: true });
-  await mkdir(join(root, "src/composition"), { recursive: true });
-  await writeFile(
-    join(root, "src/composition/worker.ts"),
-    "export default 1;\n",
-  );
-  await writeFile(
-    join(root, "package.json"),
-    JSON.stringify({ imports: { "#worker": "./dist/composition/worker.js" } }),
-  );
-  return root;
-};
-
-await test("reports a pure-layer composition import written relatively", async () => {
-  const root = await fixture();
-  try {
-    const violations = inspectModuleBoundaries(
-      "src/domain/probe.ts",
-      'import worker from "../composition/worker.js";\nexport default worker;\n',
-      root,
-    );
-    assert.deepEqual(
-      violations.map(({ boundary, target }) => ({ boundary, target })),
-      [{ boundary: "pure-layer", target: "src/composition/worker.js" }],
-    );
-  } finally {
-    await rm(root, { recursive: true, force: true });
-  }
-});
-
-await test("reports a pure-layer composition import written through the package map", async () => {
-  const root = await fixture();
-  try {
-    const violations = inspectModuleBoundaries(
-      "src/domain/probe.ts",
-      'import worker from "#worker";\nexport default worker;\n',
-      root,
-    );
-    assert.deepEqual(
-      violations.map(({ boundary, target }) => ({ boundary, target })),
-      [{ boundary: "pure-layer", target: "src/composition/worker.ts" }],
-    );
-  } finally {
-    await rm(root, { recursive: true, force: true });
-  }
-});
-
-for (const [name, specifier, imports] of [
-  [
-    "conditional",
-    "#worker",
-    {
-      "#worker": {
-        import: "./dist/composition/worker.js",
-        default: "./dist/composition/other.js",
-      },
-    },
-  ],
-  ["array", "#worker", { "#worker": ["./dist/composition/worker.js"] }],
-  ["pattern", "#workers/worker", { "#workers/*": "./dist/composition/*.js" }],
-]) {
-  await test(`refuses an unsupported valid ${name} package map rather than skipping its edge`, async () => {
-    const root = await fixture();
-    try {
-      await writeFile(join(root, "package.json"), JSON.stringify({ imports }));
-      const file = "src/domain/probe.ts";
-      await writeFile(
-        join(root, file),
-        `import ${JSON.stringify(specifier)};\n`,
-      );
-      // Resolve only: no worker module or authored target source is executed.
-      const resolved = spawnSync(
-        process.execPath,
-        [
-          "--experimental-import-meta-resolve",
-          "--input-type=module",
-          "-e",
-          "console.log(import.meta.resolve(process.argv[1], process.argv[2]))",
-          specifier,
-          pathToFileURL(join(root, file)).href,
-        ],
-        { encoding: "utf8" },
-      );
-      if (resolved.error !== undefined) throw resolved.error;
-      assert.equal(resolved.status, 0, resolved.stderr);
-      assert.equal(
-        resolved.stdout.trim(),
-        pathToFileURL(join(root, "dist/composition/worker.js")).href,
-      );
-      const checked = spawnSync(
-        process.execPath,
-        [
-          fileURLToPath(
-            new URL("../verify-module-boundaries.mjs", import.meta.url),
-          ),
-          file,
-        ],
-        { cwd: root, encoding: "utf8" },
-      );
-      if (checked.error !== undefined) throw checked.error;
-      assert.equal(checked.status, 1, checked.stdout);
-      assert.match(checked.stderr, /Could not inspect src\/domain\/probe.ts/u);
-      assert.match(checked.stderr, /Cannot resolve package import/u);
-      assert.match(checked.stderr, /relative source import/u);
-    } finally {
-      await rm(root, { recursive: true, force: true });
-    }
-  });
-}
-
-for (const target of [
-  "./dist/composition/worker.js",
-  "./dist/%63omposition/worker.js",
-  "./%64ist/composition/worker.js",
-]) {
-  await test(`checks the URL-normalized source owner of ${target}`, async () => {
-    const root = await fixture();
-    try {
-      await writeFile(
-        join(root, "package.json"),
-        JSON.stringify({ imports: { "#worker": target } }),
-      );
-      await mkdir(join(root, "src/application"), { recursive: true });
-      const file = "src/application/probe.ts";
-      await writeFile(join(root, file), 'import "#worker";\n');
-      const resolved = spawnSync(
-        process.execPath,
-        [
-          "--experimental-import-meta-resolve",
-          "--input-type=module",
-          "-e",
-          "console.log(import.meta.resolve(process.argv[1], process.argv[2]))",
-          "#worker",
-          pathToFileURL(join(root, file)).href,
-        ],
-        { encoding: "utf8" },
-      );
-      if (resolved.error !== undefined) throw resolved.error;
-      assert.equal(resolved.status, 0, resolved.stderr);
-      assert.equal(
-        fileURLToPath(resolved.stdout.trim()),
-        join(root, "dist/composition/worker.js"),
-      );
-      const checked = spawnSync(
-        process.execPath,
-        [
-          fileURLToPath(
-            new URL("../verify-module-boundaries.mjs", import.meta.url),
-          ),
-          file,
-        ],
-        { cwd: root, encoding: "utf8" },
-      );
-      if (checked.error !== undefined) throw checked.error;
-      assert.equal(checked.status, 1, checked.stdout);
-      assert.match(
-        checked.stderr,
-        /application-composition: #worker resolves to src\/composition\/worker.ts/u,
-      );
-    } finally {
-      await rm(root, { recursive: true, force: true });
-    }
-  });
-}

scripts/lib/owned-verifier-terminal.d.mts

@@ -1,8 +1,5 @@
 export { runOwnedVerifierTerminal } from "./verifier-terminal-owner.mjs";
 export type {
   VerifierTerminalOptions,
-  VerifierTerminalDependencies,
   VerifierTerminalResult,
-  VerifierTerminalFailure,
-  VerifierTerminalCleanupFailure,
 } from "./verifier-terminal-owner.mjs";

scripts/lib/real-hopper-cleanup.d.mts

@@ -1,6 +1,10 @@
-/** Observe concrete Hopper runtime resources for a before/after cleanup check. */
+/** Observe possible Hopper resources, including entries with unresolved ownership. */
 export function snapshotHopperRuntime(
   parent: string,
   targetLeaseDirectory: string,
-  ownedProcessIds?: ReadonlySet<number>,
-): Promise<Set<string>>;
+  expectedRunId?: string,
+): Promise<{
+  readonly paths: Set<string>;
+  readonly confirmedSessions: Set<string>;
+  readonly unresolvedSessions: Set<string>;
+}>;

scripts/lib/real-hopper-cleanup.mjs

@@ -1,35 +1,38 @@
 import { lstat, readFile, readdir } from "node:fs/promises";
 import { join } from "node:path";
 
-/** Observe session paths and target leases without treating their shared parent as a session. */
+/** Observe possible sessions and target leases without discarding uncertainty. */
 export async function snapshotHopperRuntime(
   parent,
   targetLeaseDirectory,
-  ownedProcessIds,
+  expectedRunId,
 ) {
-  const resources = new Set();
+  const paths = new Set();
+  const confirmedSessions = new Set();
+  const unresolvedSessions = new Set();
   for (const entry of await readdir(parent, { withFileTypes: true })) {
     const path = join(parent, entry.name);
     if (!entry.name.startsWith("rea-") || path === targetLeaseDirectory)
       continue;
-    if (
-      ownedProcessIds !== undefined &&
-      (!entry.isDirectory() ||
-        !(await belongsToOwnedProcess(path, ownedProcessIds)))
-    )
-      continue;
-    resources.add(path);
+    const confirmed =
+      typeof expectedRunId === "string" &&
+      expectedRunId.length > 0 &&
+      entry.isDirectory() &&
+      (await hasRunIdentity(path, expectedRunId));
+    (confirmed ? confirmedSessions : unresolvedSessions).add(path);
+    paths.add(path);
   }
   const leaseRoot = await lstat(targetLeaseDirectory).catch(missingIsAbsent);
-  if (leaseRoot === undefined) return resources;
-  if (!leaseRoot.isDirectory() || leaseRoot.isSymbolicLink()) {
-    resources.add(targetLeaseDirectory);
-    return resources;
+  if (leaseRoot !== undefined) {
+    if (!leaseRoot.isDirectory() || leaseRoot.isSymbolicLink())
+      paths.add(targetLeaseDirectory);
+    else {
+      const leases = await readdir(targetLeaseDirectory).catch(missingIsAbsent);
+      for (const name of leases ?? [])
+        paths.add(join(targetLeaseDirectory, name));
+    }
   }
-  const leases = await readdir(targetLeaseDirectory).catch(missingIsAbsent);
-  for (const name of leases ?? [])
-    resources.add(join(targetLeaseDirectory, name));
-  return resources;
+  return { paths, confirmedSessions, unresolvedSessions };
 }
 
 const missingIsAbsent = (cause) => {
@@ -37,16 +40,21 @@ const missingIsAbsent = (cause) => {
   throw cause;
 };
 
-const belongsToOwnedProcess = async (path, ownedProcessIds) => {
+const hasRunIdentity = async (path, expectedRunId) => {
   const encoded = await readFile(join(path, "ownership.json"), "utf8").catch(
     missingIsAbsent,
   );
   if (encoded === undefined) return false;
-  const ownership = JSON.parse(encoded);
+  let ownership;
+  try {
+    ownership = JSON.parse(encoded);
+  } catch (cause) {
+    if (cause instanceof SyntaxError) return false;
+    throw cause;
+  }
   return (
     ownership !== null &&
     typeof ownership === "object" &&
-    Number.isSafeInteger(ownership.parent_pid) &&
-    ownedProcessIds.has(ownership.parent_pid)
+    ownership.run_id === expectedRunId
   );
 };

scripts/lib/real-hopper-semantic.d.mts

@@ -1,4 +1,4 @@
-export interface FixtureProcedure {
+interface FixtureProcedure {
   readonly address: string;
   readonly name: string;
 }
@@ -26,13 +26,6 @@ export function requireCurrentDocument(
   normalizedResult: (value: unknown, operation: string) => unknown,
 ): Promise<string>;
 
-export function analyzeFixtureProcedure(
-  client: ToolClient,
-  options: unknown,
-  procedure: FixtureProcedure,
-  normalizedResult: (value: unknown, operation: string) => unknown,
-): Promise<unknown>;
-
 export function verifyRealHopperFixture(options: {
   readonly client: ToolClient;
   readonly options: unknown;

scripts/lib/real-hopper-semantic.mjs

@@ -310,7 +310,7 @@ export async function resolveFixtureProcedure(
 }
 
 /** Request the assembly evidence required by the fixture oracle. */
-export const analyzeFixtureProcedure = async (
+const analyzeFixtureProcedure = async (
   client,
   options,
   procedure,

scripts/lib/runtime-admission.d.mts

@@ -6,6 +6,3 @@ export function unsupportedRuntimeMessage(
   range: string,
   version: string,
 ): string | undefined;
-
-/** Human-readable release families for an `engines.node` range. */
-export function supportedReleaseProse(range: string): string;

scripts/lib/runtime-admission.mjs

@@ -21,7 +21,7 @@ export const unsupportedRuntimeMessage = (range, version) => {
 };
 
 /** Human-readable release families for an `engines.node` range. */
-export const supportedReleaseProse = (range) =>
+const supportedReleaseProse = (range) =>
   `Node.js ${range
     .split("||")
     .map((clause) => {

scripts/lib/verifier-artifact-scope.d.mts

@@ -0,0 +1,15 @@
+import type { ArtifactResourceScope } from "../../src/artifacts/ArtifactResourceScope.js";
+
+export class VerifierArtifactCleanupFailure extends AggregateError {
+  readonly _tag: "VerifierArtifactCleanupFailure";
+  readonly cleanupOwner: ArtifactResourceScope;
+  constructor(
+    scope: ArtifactResourceScope,
+    failures: unknown[],
+    cause: unknown,
+  );
+}
+
+export function withVerifierArtifactScope<T>(
+  operation: (scope: ArtifactResourceScope) => Promise<T>,
+): Promise<T>;

scripts/lib/verifier-artifact-scope.mjs

@@ -0,0 +1,32 @@
+import { ArtifactResourceScope } from "../../dist/artifacts/ArtifactResourceScope.js";
+
+/** A failed close retains the scope that can retry all of its owners. */
+export class VerifierArtifactCleanupFailure extends AggregateError {
+  constructor(scope, failures, cause) {
+    super(failures, "Verifier cleanup failed", { cause });
+    this._tag = "VerifierArtifactCleanupFailure";
+    this.cleanupOwner = scope;
+  }
+}
+
+/** Run one verifier operation and retain its exact scope if close fails. */
+export async function withVerifierArtifactScope(operation) {
+  const scope = new ArtifactResourceScope();
+  let outcome;
+  try {
+    outcome = { ok: true, value: await operation(scope) };
+  } catch (cause) {
+    outcome = { ok: false, cause };
+  }
+  try {
+    await scope.close();
+  } catch (cleanupCause) {
+    throw new VerifierArtifactCleanupFailure(
+      scope,
+      outcome.ok ? [cleanupCause] : [outcome.cause, cleanupCause],
+      outcome.ok ? cleanupCause : outcome.cause,
+    );
+  }
+  if (!outcome.ok) throw outcome.cause;
+  return outcome.value;
+}

scripts/lib/verifier-terminal-owner.mts

@@ -40,7 +40,7 @@ export interface VerifierTerminalOptions {
   readonly signal?: AbortSignal;
 }
 
-export interface VerifierTerminalDependencies {
+interface VerifierTerminalDependencies {
   readonly loadPty?: () => Promise<typeof import("@lydell/node-pty")>;
   readonly cleanupProcessGroup?: typeof cleanupOwnedProcessGroup;
 }
@@ -59,7 +59,7 @@ type TerminalFailureReason =
   | "unsupported_platform";
 
 /** Expected terminal failures retain the decoded output observed at failure. */
-export class VerifierTerminalFailure extends Error {
+class VerifierTerminalFailure extends Error {
   readonly _tag = "VerifierTerminalFailure";
 
   constructor(
@@ -74,7 +74,7 @@ export class VerifierTerminalFailure extends Error {
 }
 
 /** The adopted owner remains the exact authority for retrying this release. */
-export class VerifierTerminalCleanupFailure extends Error {
+class VerifierTerminalCleanupFailure extends Error {
   readonly _tag = "VerifierTerminalCleanupFailure";
   readonly reason = "cleanup_incomplete";
 

scripts/lint/index.mjs

@@ -5,6 +5,8 @@ import noEvidenceJsonPreadmission from "./rules/no-evidence-json-preadmission.mj
 import noFixtureRootCleanup from "./rules/no-fixture-root-cleanup.mjs";
 import noPositionalToolContract from "./rules/no-positional-tool-contract.mjs";
 import noSharedModuleMock from "./rules/no-shared-module-mock.mjs";
+import noLocaleCompare from "./rules/no-locale-compare.mjs";
+import noBabelVisitorKeys from "./rules/no-babel-visitor-keys.mjs";
 
 export default {
   meta: { name: "rea" },
@@ -15,5 +17,7 @@ export default {
     "no-fixture-root-cleanup": noFixtureRootCleanup,
     "no-positional-tool-contract": noPositionalToolContract,
     "no-shared-module-mock": noSharedModuleMock,
+    "no-locale-compare": noLocaleCompare,
+    "no-babel-visitor-keys": noBabelVisitorKeys,
   },
 };

scripts/lint/rules/no-babel-visitor-keys.d.mts

@@ -0,0 +1,4 @@
+import type { RuleTester } from "oxlint/plugins-dev";
+
+declare const rule: Parameters<RuleTester["run"]>[1];
+export default rule;

scripts/lint/rules/no-babel-visitor-keys.mjs

@@ -0,0 +1,73 @@
+import { findBinding } from "../bindings.mjs";
+
+const nameOf = (node) =>
+  node.type === "Identifier"
+    ? node.name
+    : node.type === "Literal"
+      ? node.value
+      : node.type === "TemplateLiteral" && node.expressions.length === 0
+        ? node.quasis[0]?.value.cooked
+        : undefined;
+
+export default {
+  meta: {
+    type: "problem",
+    docs: { description: "Keep Babel child expansion in its shared owner." },
+    schema: [],
+    messages: {
+      owner:
+        "Use childNodes or traverseJavaScriptAst instead of Babel VISITOR_KEYS.",
+    },
+  },
+  create(context) {
+    const source = context.sourceCode;
+    const isBabelNamespace = (node) => {
+      if (node?.type !== "Identifier") return false;
+      const definition = findBinding(source, node)?.defs[0];
+      if (
+        definition?.type !== "ImportBinding" ||
+        definition.node.type !== "ImportNamespaceSpecifier"
+      )
+        return false;
+      const declaration = definition.parent ?? definition.node.parent;
+      return declaration?.source?.value === "@babel/types";
+    };
+    return {
+      ImportSpecifier(node) {
+        if (
+          node.parent.source.value === "@babel/types" &&
+          (node.imported.name ?? node.imported.value) === "VISITOR_KEYS"
+        )
+          context.report({ node, messageId: "owner" });
+      },
+      ExportNamedDeclaration(node) {
+        if (node.source?.value !== "@babel/types") return;
+        for (const specifier of node.specifiers)
+          if (
+            specifier.type === "ExportSpecifier" &&
+            nameOf(specifier.local) === "VISITOR_KEYS"
+          )
+            context.report({ node: specifier, messageId: "owner" });
+      },
+      MemberExpression(node) {
+        if (
+          (!node.computed || node.property.type !== "Identifier") &&
+          nameOf(node.property) === "VISITOR_KEYS" &&
+          isBabelNamespace(node.object)
+        )
+          context.report({ node, messageId: "owner" });
+      },
+      VariableDeclarator(node) {
+        if (node.id.type !== "ObjectPattern" || !isBabelNamespace(node.init))
+          return;
+        for (const property of node.id.properties)
+          if (
+            property.type === "Property" &&
+            (!property.computed || property.key.type !== "Identifier") &&
+            nameOf(property.key) === "VISITOR_KEYS"
+          )
+            context.report({ node: property, messageId: "owner" });
+      },
+    };
+  },
+};

scripts/lint/rules/no-locale-compare.d.mts

@@ -0,0 +1,4 @@
+import type { RuleTester } from "oxlint/plugins-dev";
+
+declare const rule: Parameters<RuleTester["run"]>[1];
+export default rule;

scripts/lint/rules/no-locale-compare.mjs

@@ -0,0 +1,34 @@
+export default {
+  meta: {
+    type: "problem",
+    docs: {
+      description: "Keep domain ordering independent of the host locale.",
+    },
+    schema: [],
+    messages: {
+      locale:
+        "Use compareUnicodeCodePoints instead of localeCompare for domain ordering.",
+    },
+  },
+  create(context) {
+    return {
+      CallExpression(node) {
+        const member = node.callee;
+        if (member.type !== "MemberExpression") return;
+        if (
+          (!member.computed &&
+            member.property.type === "Identifier" &&
+            member.property.name === "localeCompare") ||
+          (member.computed &&
+            member.property.type === "Literal" &&
+            member.property.value === "localeCompare") ||
+          (member.computed &&
+            member.property.type === "TemplateLiteral" &&
+            member.property.expressions.length === 0 &&
+            member.property.quasis[0]?.value.cooked === "localeCompare")
+        )
+          context.report({ node, messageId: "locale" });
+      },
+    };
+  },
+};

scripts/prepack.mjs

@@ -54,7 +54,7 @@ if (await pathExists(join(root, "src"))) {
     "dist/main.js",
     "dist/mcp/main.js",
     "dist/cli-runtime/cli.js",
-    "dist/cli-runtime/cliOutput.js",
+    "dist/cli-runtime/cliOneShot.js",
     "dist/cli-runtime/cliBuiltinArguments.js",
     "dist/cli-runtime/cliResultOutput.js",
     "dist/cli-runtime/mcpDoctor.js",

scripts/rea.mjs

@@ -64,7 +64,7 @@ const runtimeFiles = [
       ? ["dist/mcp/main.js", "dist/cli-runtime/mcpDoctor.js"]
       : [
           "dist/cli-runtime/cli.js",
-          "dist/cli-runtime/cliOutput.js",
+          "dist/cli-runtime/cliOneShot.js",
           "dist/cli-runtime/cliResultOutput.js",
         ]),
 ];
@@ -104,154 +104,66 @@ if (!(await compiledRuntimeExists(runtimeFiles))) {
       );
   }
 } else {
-  const {
-    cliConfigurationError,
-    renderCliOutputArgumentError,
-    renderEmptyFilteredCliOutput,
-    renderVersionReport,
-    parseCliOutputArguments,
-  } = await import("../dist/cli-runtime/cliOutput.js");
+  const { runOneShotCli } = await import("../dist/cli-runtime/cliOneShot.js");
   guardClosedStdout();
-  const cliArgs = isShellCompletion
-    ? args
-    : builtinArguments.normalizeCliArguments(args);
-  // Completion words are transport data, including partial output flags.
-  const outputOptions = parseCliOutputArguments(
-    isShellCompletion ? [] : cliArgs,
-  );
-  const outputArguments = outputOptions.validation;
-  // `--version` with an explicit format reports the runtime as a document;
-  // plain `--version` stays Incur's bare version string.
-  const versionOutput = renderVersionReport(
-    outputOptions,
-    {
-      packageName: packageJson.name,
-      packageVersion: packageJson.version,
-      versions: process.versions,
-      platform: process.platform,
-      architecture: process.arch,
-    },
-    process.stdout.isTTY === true,
-  );
-  const configurationError = cliConfigurationError(process.env);
   let dispatchFailure;
   let closeCliResources;
   // Incur can exit from the callback below before this function returns.
   // That callback owns the status, including a closed-pipe exit of 141.
   let exiting = false;
   try {
-    // Doctor is the readiness report for this failure. Other commands still stop
-    // here so they do not run with an unusable log level.
-    if (
-      configurationError !== undefined &&
-      (isShellCompletion ||
-        builtinArguments.splitIncurBuiltinArguments(cliArgs).command[0] !==
-          "doctor")
-    ) {
-      process.stderr.write(`${configurationError}\n`);
-      process.exitCode = 1;
-    } else if (!outputArguments.ok) {
-      writeStdout(renderCliOutputArgumentError(outputArguments));
-      process.exitCode = 1;
-    } else if (versionOutput !== undefined) {
-      writeStdout(versionOutput);
-    } else if (
-      !isShellCompletion &&
-      builtinArguments.isProjectScopedAmpRegistration(cliArgs)
-    ) {
-      // Amp has global settings only. Share the parsed scope fact with the
-      // registration workflow and refuse before loading the command runtime.
-      //
-      // A caller that asked for a structured document gets the refusal in
-      // that document, through the same pre-execution error renderer the
-      // output-argument branch uses; anything else keeps the plain message.
-      const refusalMessage =
-        "Amp does not support project-scoped registration. Run without --no-global to register Amp globally, or select a client with project settings. No client settings were changed.";
-      const refusalFormat = outputOptions.format;
-      if (
-        refusalFormat === "json" ||
-        refusalFormat === "jsonl" ||
-        refusalFormat === "yaml"
-      ) {
-        writeStdout(
-          renderCliOutputArgumentError({
-            ok: false,
-            format: refusalFormat,
-            code: "AMP_PROJECT_SCOPE_UNSUPPORTED",
-            message: refusalMessage,
-          }),
-        );
-      } else {
-        process.stderr.write(`${refusalMessage}\n`);
-      }
-      process.exitCode = 1;
-    } else {
-      const cliRuntime = await import("../dist/cli-runtime/cli.js");
-      closeCliResources = cliRuntime.closeCliResources;
-      const { createCli } = cliRuntime;
-      const { createCliResultOutput } =
-        await import("../dist/cli-runtime/cliResultOutput.js");
-      let wroteOutput = false;
-      const resultOutput = createCliResultOutput(outputOptions, process.stdout);
-      try {
-        await createCli(process.env, resultOutput).serve(cliArgs, {
-          stdout: (output) => {
-            if (resultOutput?.handled) {
-              if (resultOutput.failed && !stdoutClosed)
-                process.stderr.write(output);
-              return;
-            }
-            if (output.length > 0) wroteOutput = true;
-            if (resultOutput?.captureSdkOutput(output)) return;
-            writeStdout(output);
-          },
-          // A command failure caused by the closed pipe keeps the pipe's status.
-          // Worker shutdown is shared with the dispatch finally below. A failed
-          // shutdown is reported here because this callback is what exits.
-          exit: (code) => {
-            exiting = true;
-            void (async () => {
-              let status = typeof code === "number" ? code : 0;
-              try {
-                await closeCliResources();
-              } catch (cleanup) {
-                process.stderr.write(
-                  `Failed to close CLI resources: ${cleanupFailureText(cleanup)}\n`,
-                );
-                if (status === 0) status = 1;
-              }
-              try {
-                await resultOutput?.finishSdkOutput(status);
-              } catch (cause) {
-                if (!stdoutClosed)
-                  process.stderr.write(`${cleanupFailureText(cause)}\n`);
-                if (status === 0) status = 1;
-              }
-              process.exit(stdoutClosed ? SIGPIPE_EXIT_STATUS : status);
-            })();
-          },
-        });
-      } catch (cause) {
-        if (wroteOutput) throw cause;
-        const recovered = await resultOutput
-          ?.recoverFormattingFailure(cause)
-          .catch((writeFailure) => {
-            // Recovery writes outside Incur's command boundary. A reader that
-            // declined this document keeps the same quiet SIGPIPE outcome.
-            if (!stdoutClosed) throw writeFailure;
-            return true;
-          });
-        if (!recovered) throw cause;
-        process.exitCode = stdoutClosed ? SIGPIPE_EXIT_STATUS : 1;
-      }
-      if (!wroteOutput && !resultOutput?.handled)
-        writeStdout(renderEmptyFilteredCliOutput(outputOptions) ?? "");
-      // An SDK failure exits through the callback, which owns its pending write.
-      if (!exiting)
-        await resultOutput?.finishSdkOutput(
-          typeof process.exitCode === "number" ? process.exitCode : 0,
-        );
-    }
+    await runOneShotCli(args, {
+      environment: process.env,
+      runtime: {
+        packageName: packageJson.name,
+        packageVersion: packageJson.version,
+        versions: process.versions,
+        platform: process.platform,
+        architecture: process.arch,
+      },
+      stdoutIsTerminal: process.stdout.isTTY === true,
+      resultDestination: process.stdout,
+      closedStdoutStatus: SIGPIPE_EXIT_STATUS,
+      writeStdout,
+      writeStderr: (text) => {
+        process.stderr.write(text);
+      },
+      stdoutClosed: () => stdoutClosed,
+      exitCode: () =>
+        typeof process.exitCode === "number" ? process.exitCode : 0,
+      setExitCode: (code) => {
+        process.exitCode = code;
+      },
+      ownCliResources: (close) => {
+        closeCliResources = close;
+      },
+      exitRequested: () => exiting,
+      // A command failure caused by the closed pipe keeps the pipe's status.
+      // Worker shutdown is shared with the dispatch finally below. A failed
+      // shutdown is reported here because this callback is what exits.
+      exit: (code, finishOutput) => {
+        exiting = true;
+        void (async () => {
+          let status = code;
+          try {
+            await closeCliResources();
+          } catch (cleanup) {
+            process.stderr.write(
+              `Failed to close CLI resources: ${cleanupFailureText(cleanup)}\n`,
+            );
+            if (status === 0) status = 1;
+          }
+          try {
+            await finishOutput(status);
+          } catch (cause) {
+            if (!stdoutClosed)
+              process.stderr.write(`${cleanupFailureText(cause)}\n`);
+            if (status === 0) status = 1;
+          }
+          process.exit(stdoutClosed ? SIGPIPE_EXIT_STATUS : status);
+        })();
+      },
+    });
   } catch (cause) {
     if (cause?.code === "EPIPE") {
       stdoutClosed = true;

scripts/verify-package-environment.d.mts

@@ -1,13 +1,3 @@
-export interface PackageHopperEnvironment {
-  readonly HOPPER_LAUNCHER_PATH: string;
-  readonly HOPPER_LOADER_ARGS_JSON: string;
-}
-
-export function packageHopperEnvironment(
-  root: string,
-  platform?: string,
-): PackageHopperEnvironment;
-
 export function verifyPackageEnvironment(input: {
   readonly root: string;
   readonly workspace: string;

scripts/verify-package-environment.mjs

@@ -117,7 +117,7 @@ export async function verifyPackageEnvironment({
   };
 }
 
-export const packageHopperEnvironment = (root, platform = process.platform) => {
+const packageHopperEnvironment = (root, platform = process.platform) => {
   const fakeLauncher = join(root, "tests/fixtures/fakeLauncher.mjs");
   if (platform !== "linux")
     return {

scripts/verify-real-ghidra-assertions.mjs

@@ -414,7 +414,7 @@ export function matchesSymbol(value, expected) {
   return tail === expected || tail === `_${expected}`;
 }
 
-export function symbolTail(value) {
+function symbolTail(value) {
   if (typeof value !== "string") return undefined;
   return value.split("::").at(-1);
 }

scripts/verify-real-ghidra-dol.mjs

@@ -9,7 +9,7 @@ import { promisify } from "node:util";
 import { Client } from "@modelcontextprotocol/client";
 import { StdioClientTransport } from "@modelcontextprotocol/client/stdio";
 import { parseBinaryTarget } from "../dist/application/BinaryTargetResolver.js";
-import { ArtifactResourceScope } from "../dist/artifacts/ArtifactResourceScope.js";
+import { withVerifierArtifactScope } from "./lib/verifier-artifact-scope.mjs";
 import { readGhidraLanguageCatalog } from "../dist/ghidra/GhidraLanguageCatalog.js";
 import { parseEvidence } from "../dist/domain/evidence.js";
 import { functionDossierSchema } from "../dist/domain/native/functionDossier.js";
@@ -82,16 +82,13 @@ for (const setting of ["GHIDRA_HEADLESS_MAXMEM", "GHIDRA_MAXMEM"]) {
  * installation catalog reader it uses. User extensions are not in that catalog.
  */
 async function languageInstalled(languageId) {
-  const scope = new ArtifactResourceScope();
-  try {
+  return withVerifierArtifactScope(async (scope) => {
     const catalog = await readGhidraLanguageCatalog(
       installation.installDir,
       scope,
     );
     return catalog.some((definition) => definition.id === languageId);
-  } finally {
-    await scope.close();
-  }
+  });
 }
 
 /** One MCP session plus CLI check. `languageOverride` is set only for the Gekko pass. */

scripts/verify-real-hopper-callers.mjs

@@ -11,6 +11,10 @@ import { fileURLToPath, pathToFileURL } from "node:url";
 import { promisify } from "node:util";
 import { artifactMcpCall } from "./lib/artifact-e2e.mjs";
 import { snapshotHopperRuntime } from "./lib/real-hopper-cleanup.mjs";
+import {
+  closeVerifierResources,
+  withVerifierCleanup,
+} from "./lib/verifier-cleanup.mjs";
 import { HOPPER_TARGET_LEASE_DIRECTORY } from "../dist/process/HopperLease.js";
 
 assert.equal(process.platform, "darwin", "requires macOS");
@@ -48,11 +52,9 @@ const digest = async (path) =>
   createHash("sha256")
     .update(await readFile(path))
     .digest("hex");
-const sessionsBefore = await snapshotHopperRuntime(
-  "/tmp",
-  HOPPER_TARGET_LEASE_DIRECTORY,
-);
-const ownedProcessIds = new Set();
+const sessionsBefore = (
+  await snapshotHopperRuntime("/tmp", HOPPER_TARGET_LEASE_DIRECTORY)
+).paths;
 const client = new Client({ name: "hopper-callers-verifier", version: "1" });
 const transport = new StdioClientTransport({
   command: process.execPath,
@@ -93,7 +95,7 @@ const matchingRef = (ref, site, from, to) =>
   ref.source_procedure?.address === from &&
   ref.target_procedure?.address === to &&
   ref.call?.classification === "direct";
-try {
+await withVerifierCleanup(async () => {
   await run(clang, [
     "-isysroot",
     sdk,
@@ -129,7 +131,6 @@ try {
   await client.connect(transport);
   if (transport.pid === null)
     throw new Error("MCP process identity unavailable");
-  ownedProcessIds.add(transport.pid);
   let notifications = 0;
   const original = transport.onmessage;
   transport.onmessage = (message) => {
@@ -287,23 +288,36 @@ try {
       sha256: beforeLarge,
     }),
   );
-} finally {
-  await client.close();
-  await transport.close();
-  await new Promise((resolve) => setTimeout(resolve, 500));
-  const leaked = [
-    ...(await snapshotHopperRuntime(
-      "/tmp",
-      HOPPER_TARGET_LEASE_DIRECTORY,
-      ownedProcessIds,
-    )),
-  ].filter((path) => !sessionsBefore.has(path));
-  if (leaked.length === 0)
+}, [
+  async () => {
+    try {
+      await closeVerifierResources([
+        () => client.close(),
+        () => transport.close(),
+        async () => {
+          await new Promise((resolve) => setTimeout(resolve, 500));
+          const leaked = [
+            ...(
+              await snapshotHopperRuntime("/tmp", HOPPER_TARGET_LEASE_DIRECTORY)
+            ).paths,
+          ].filter((path) => !sessionsBefore.has(path));
+          assert.deepEqual(
+            leaked,
+            [],
+            `Hopper resources remain: ${leaked.join(", ")}`,
+          );
+        },
+      ]);
+    } catch (cause) {
+      throw new Error(
+        `Hopper cleanup failed; fixture retained at ${directory}`,
+        {
+          cause,
+        },
+      );
+    } finally {
+      if (stderr) process.stderr.write(stderr);
+    }
     await rm(directory, { recursive: true, force: true });
-  if (stderr) process.stderr.write(stderr);
-  assert.deepEqual(
-    leaked,
-    [],
-    `Hopper resources remain: ${leaked.join(", ")}; fixture retained at ${directory}`,
-  );
-}
+  },
+]);

scripts/verify-real-hopper-deadlines.mjs

@@ -1,10 +1,11 @@
 import assert from "node:assert/strict";
-import { copyFile, mkdtemp, realpath, rm } from "node:fs/promises";
+import { copyFile, mkdtemp, realpath } from "node:fs/promises";
 import { tmpdir } from "node:os";
 import { join } from "node:path";
 import { fileURLToPath } from "node:url";
 
 import { firstProcedureAddress } from "./lib/real-hopper-assertions.mjs";
+import { HopperDeadlineCleanup } from "./lib/hopper-deadline-cleanup.mjs";
 import { parseBinaryTarget } from "../dist/application/BinaryTargetResolver.js";
 import { ArtifactResourceScope } from "../dist/artifacts/ArtifactResourceScope.js";
 import { AnalysisCleanupLease } from "../dist/artifacts/AnalysisCleanupLease.js";
@@ -29,6 +30,7 @@ const root = await realpath(
 );
 const target = join(root, "deadline-fixture");
 const profileResources = new ArtifactResourceScope();
+const cleanupOwner = new HopperDeadlineCleanup(root, profileResources);
 const profileResourceScope = {
   retain: (owner, resource) =>
     profileResources.retain({
@@ -40,6 +42,7 @@ const profileResourceScope = {
 };
 let client;
 let primaryFailure;
+let operationFailed = false;
 try {
   await copyFile(fixtures.primary.path, target);
   const parsed = await parseBinaryTarget(target);
@@ -148,31 +151,19 @@ try {
     ),
   );
 } catch (cause) {
+  operationFailed = true;
   primaryFailure = cause;
   throw cause;
 } finally {
-  let cleanupFailure;
-  if (client !== undefined) {
-    const closed = await client.close();
-    if (!closed.ok) cleanupFailure = closed.error;
-  }
   try {
-    await profileResources.close();
-  } catch (cause) {
-    cleanupFailure =
-      cleanupFailure === undefined
-        ? cause
-        : new AggregateError(
-            [cleanupFailure, cause],
-            "Hopper profile and client cleanup failed",
-          );
-  }
-  await rm(root, { recursive: true, force: true });
-  if (cleanupFailure !== undefined)
-    throw primaryFailure === undefined
-      ? cleanupFailure
-      : new AggregateError(
+    if (client !== undefined) cleanupOwner.setClient(client);
+    await cleanupOwner.close();
+  } catch (cleanupFailure) {
+    throw operationFailed
+      ? new AggregateError(
           [primaryFailure, cleanupFailure],
           "Hopper verification and cleanup failed",
-        );
+        )
+      : cleanupFailure;
+  }
 }

scripts/verify-real-hopper-fat.mjs

@@ -23,6 +23,10 @@ import {
   requireMcpOperationResult,
 } from "./lib/mcp-verifier-results.mjs";
 import { snapshotHopperRuntime } from "./lib/real-hopper-cleanup.mjs";
+import {
+  closeVerifierResources,
+  withVerifierCleanup,
+} from "./lib/verifier-cleanup.mjs";
 import { HOPPER_TARGET_LEASE_DIRECTORY } from "../dist/process/HopperLease.js";
 import { parseConfig } from "../dist/config/parseConfig.js";
 import {
@@ -70,14 +74,12 @@ const intel = join(directory, "c-x86_64");
 const fat = join(directory, "c-fat");
 const fat64 = join(directory, "c-fat64");
 const singleFat = join(directory, "c-single-fat");
-const owned = new Set();
 const extraFat64 = [];
 const invalidFat64 = [];
 let preparedImagePath;
-const before = await snapshotHopperRuntime(
-  "/tmp",
-  HOPPER_TARGET_LEASE_DIRECTORY,
-);
+const before = (
+  await snapshotHopperRuntime("/tmp", HOPPER_TARGET_LEASE_DIRECTORY)
+).paths;
 const client = new Client({ name: "hopper-fat-verifier", version: "1" });
 const transport = new StdioClientTransport({
   command: process.execPath,
@@ -94,7 +96,7 @@ const ajv = new Ajv({ strict: false });
 addFormats(ajv);
 const observations = [];
 const sourceBinding = [];
-try {
+await withVerifierCleanup(async () => {
   await run(toolPaths.clang, [
     "-isysroot",
     sdk,
@@ -183,9 +185,17 @@ try {
         "overlap",
         /slices overlap/u,
         (bytes) => {
-          const cpu = process.arch === "arm64" ? 0x100000c : 0x1000007;
-          const base = bytes.readUInt32BE(8) === cpu ? 8 : 40;
-          bytes.copy(bytes, base === 8 ? 40 : 8, base, base + 32);
+          const firstOffset = bytes.readBigUInt64BE(16);
+          const secondOffset = bytes.readBigUInt64BE(48);
+          const earlier = firstOffset < secondOffset ? 8 : 40;
+          const laterOffset =
+            firstOffset < secondOffset ? secondOffset : firstOffset;
+          const earlierOffset =
+            firstOffset < secondOffset ? firstOffset : secondOffset;
+          bytes.writeBigUInt64BE(
+            laterOffset - earlierOffset + 16n,
+            earlier + 16,
+          );
         },
       ],
     ]) {
@@ -211,11 +221,14 @@ try {
     }
     const path = join(directory, "c-fat64-ambiguous");
     await writeFile(path, ambiguous);
-    invalidFat64.push({ path, reason: /selection.*ambiguous/u });
+    invalidFat64.push({
+      path,
+      reason:
+        /FAT binary declares several (?:arm64|x86_64) slices; no slice was selected/u,
+    });
   }
   await client.connect(transport);
   assert.ok(transport.pid !== null);
-  owned.add(transport.pid);
   const catalog = await client.listTools();
   const call = async (name, args = {}) => {
     const reply = await client.callTool(
@@ -359,14 +372,27 @@ try {
   if (verifyFat64) {
     await call("open_binary", { path: fat64 });
     await call("list_procedures");
-    const resources = [
-      ...(await snapshotHopperRuntime(
-        "/tmp",
-        HOPPER_TARGET_LEASE_DIRECTORY,
-        owned,
-      )),
-    ].filter((path) => !before.has(path));
-    for (const root of resources) {
+    const session = await call("binary_session");
+    const runId = session.analysis_run?.run_id;
+    assert.ok(
+      typeof runId === "string" && runId.length > 0,
+      "Missing analysis run identity",
+    );
+    const resources = await snapshotHopperRuntime(
+      "/tmp",
+      HOPPER_TARGET_LEASE_DIRECTORY,
+      runId,
+    );
+    const unresolvedNew = [...resources.unresolvedSessions].filter(
+      (path) => !before.has(path),
+    );
+    assert.deepEqual(
+      unresolvedNew,
+      [],
+      "Cannot identify a prepared image while new Hopper resource ownership is unresolved",
+    );
+    for (const root of resources.confirmedSessions) {
+      if (before.has(root)) continue;
       const image = join(root, "image.macho");
       if (
         await access(image).then(
@@ -403,27 +429,43 @@ try {
       },
     );
     assert.ok(pending.child.pid !== undefined);
-    owned.add(pending.child.pid);
     const cli = JSON.parse((await pending).stdout);
     assert.deepEqual(cli.normalized_result, expected.mapping);
   }
-} finally {
-  await client.close();
-  await transport.close();
-  await rm(directory, { recursive: true, force: true });
-}
-const retained = [
-  ...(await snapshotHopperRuntime(
-    "/tmp",
-    HOPPER_TARGET_LEASE_DIRECTORY,
-    owned,
-  )),
-].filter((path) => !before.has(path));
-assert.deepEqual(
-  retained,
-  [],
-  "FAT verification retained owned Hopper sessions or leases",
-);
+}, [
+  async () => {
+    try {
+      await closeVerifierResources([
+        () => client.close(),
+        () => transport.close(),
+      ]);
+    } catch (cause) {
+      throw new Error(
+        `Hopper cleanup failed; fixture retained at ${directory}`,
+        {
+          cause,
+        },
+      );
+    }
+    try {
+      const retained = [
+        ...(await snapshotHopperRuntime("/tmp", HOPPER_TARGET_LEASE_DIRECTORY))
+          .paths,
+      ].filter((path) => !before.has(path));
+      assert.deepEqual(
+        retained,
+        [],
+        "Hopper resources remain or are unresolved",
+      );
+    } catch (cause) {
+      throw new Error(
+        `Hopper resource verification failed; fixture retained at ${directory}`,
+        { cause },
+      );
+    }
+    await rm(directory, { recursive: true, force: true });
+  },
+]);
 console.log(
   JSON.stringify(
     {

scripts/verify-real-hopper.mjs

@@ -62,10 +62,9 @@ const parseServerArgs = (encoded) => {
 };
 
 const runtimeParent = process.platform === "darwin" ? "/tmp" : tmpdir();
-const sessionsBefore = await snapshotHopperRuntime(
-  runtimeParent,
-  HOPPER_TARGET_LEASE_DIRECTORY,
-);
+const sessionsBefore = (
+  await snapshotHopperRuntime(runtimeParent, HOPPER_TARGET_LEASE_DIRECTORY)
+).paths;
 const ownedProcessIds = new Set();
 const textValue = mcpTextValue;
 
@@ -557,11 +556,8 @@ try {
 
 await new Promise((resolve) => setTimeout(resolve, 500));
 const sessionsAfter = [
-  ...(await snapshotHopperRuntime(
-    runtimeParent,
-    HOPPER_TARGET_LEASE_DIRECTORY,
-    ownedProcessIds,
-  )),
+  ...(await snapshotHopperRuntime(runtimeParent, HOPPER_TARGET_LEASE_DIRECTORY))
+    .paths,
 ]
   .filter((path) => !sessionsBefore.has(path))
   .sort();
@@ -573,7 +569,7 @@ if (sessionsAfter.length > 0) {
     retainedRuntimePaths: sessionsAfter,
   });
   throw new Error(
-    `The MCP runtime retained Hopper resources: ${sessionsAfter.join(", ")}`,
+    `Hopper resources remain or have unresolved ownership: ${sessionsAfter.join(", ")}`,
   );
 }
 if (summary === undefined)

scripts/verify-test-discovery.mjs

@@ -40,7 +40,7 @@ try {
   const expected = [];
   for (const path of files.stdout
     .split("\0")
-    .filter((path) => path.endsWith(".test.ts"))) {
+    .filter((path) => /\.(?:test|spec)\.[cm]?[jt]sx?$/u.test(path))) {
     try {
       if ((await stat(join(root, path))).isFile()) expected.push(path);
     } catch (cause) {
@@ -65,4 +65,6 @@ try {
   await rm(temporary, { recursive: true, force: true });
 }
 if (discovered !== undefined)
-  console.log(`Discovered all ${discovered} test files exactly once.`);
+  console.log(
+    `Discovered all ${discovered} test and spec files in src and tests exactly once.`,
+  );

scripts/verify/apple/dispatch.mjs

@@ -6,7 +6,7 @@ import { join } from "node:path";
 import { fileURLToPath } from "node:url";
 import { promisify } from "node:util";
 import { parseBinaryTarget } from "../../../dist/application/BinaryTargetResolver.js";
-import { ArtifactResourceScope } from "../../../dist/artifacts/ArtifactResourceScope.js";
+import { withVerifierArtifactScope } from "../../lib/verifier-artifact-scope.mjs";
 import { inspectAppleDispatchMetadata } from "../../../dist/native/AppleDispatchMetadata.js";
 import {
   artifactCliEvidence,
@@ -57,8 +57,7 @@ const fixupCoverage = (metadata) =>
 const inspect = async (path) => {
   const target = await parseBinaryTarget(path);
   if (!target.ok) throw target.error;
-  const resources = new ArtifactResourceScope();
-  try {
+  return withVerifierArtifactScope(async (resources) => {
     return {
       target: target.value,
       metadata: (
@@ -67,10 +66,7 @@ const inspect = async (path) => {
         )
       ).result,
     };
-  } finally {
-    // Retry any descriptor whose close failed, surfacing unresolved cleanup.
-    await resources.close();
-  }
+  });
 };
 
 const checkObjc = (metadata, mode) => {

scripts/verify/architecture-guards.mjs

@@ -5,17 +5,12 @@ import { join, relative, sep } from "node:path";
 import { fileURLToPath } from "node:url";
 
 // Architecture guards for the strict-identity / best-effort-inference split.
-// - Evidence ordering must be locale-independent (ICU varies by host), so
-//   src/domain orders with compareUnicodeCodePoints, never localeCompare.
 // - Composite dedup keys must not NUL-join variable-length or free-form
 //   MIDDLE fields: ["a\0b"] collapses with ["a", "b"] and drops a finding.
-//   compositeKey (JSON tuple) is the single owner for composite keys.
+//   The text check below only flags one spelling; it is not a complete audit.
 // - Transparent wrappers unwrap in exactly one place
 //   (javascriptAstValues.unwrapJavaScriptExpression); direct isTS* unwrapping
 //   elsewhere drifts (the `satisfies` class of bug).
-// - AST walks go through traverseJavaScriptAst/childNodes: bespoke
-//   Object.values walkers diverge on loc/comment fields and overflow the
-//   stack on deep generated chains.
 
 const root = fileURLToPath(new URL("../../", import.meta.url));
 
@@ -27,6 +22,7 @@ const listFiles = async (dir) => {
     else if (
       entry.name.endsWith(".ts") &&
       !entry.name.endsWith(".test.ts") &&
+      !entry.name.endsWith(".spec.ts") &&
       !entry.name.endsWith(".fixture.ts")
     )
       output.push(path);
@@ -48,8 +44,6 @@ const files = await Promise.all(
     content: stripComments(await readFile(path, "utf8")),
   })),
 );
-const inDir = (dir) => files.filter((file) => file.path.startsWith(dir));
-
 const failures = [];
 const check = (label, selected, pattern, allow = []) => {
   const offenders = selected.filter(
@@ -68,21 +62,7 @@ check(
   /providers\/ProviderInspectionScope\.js/,
 );
 
-check(
-  "src/domain uses localeCompare (use compareUnicodeCodePoints)",
-  inDir("src/domain/"),
-  /\.localeCompare\(/,
-);
-
-check(
-  "NUL-joined list key (use compositeKey)",
-  files,
-  /\.join\(["']\\0["']\)/,
-  [
-    // Sorted pair of constrained trace IDs; documented in plan.
-    "src/domain/process/processTraceSpecification.ts",
-  ],
-);
+check("NUL-joined list key (use compositeKey)", files, /\.join\(["']\\0["']\)/);
 
 check(
   "direct transparent-wrapper unwrap outside javascriptAstValues (use unwrapJavaScriptExpression)",
@@ -91,13 +71,6 @@ check(
   ["src/domain/javascript/javascriptAstValues.ts"],
 );
 
-check(
-  "bespoke AST child walker (use traverseJavaScriptAst/childNodes)",
-  files,
-  /VISITOR_KEYS/,
-  ["src/domain/javascript/javascriptSemanticTraversal.ts"],
-);
-
 // A producer that pins both the soft and hard ceiling of every resource takes
 // the vector from one owner. prlimitCeilingArguments is the command-less prefix
 // of prlimitArgumentVector; both live in src/process/LinuxResourceLimits.ts.
@@ -163,7 +136,6 @@ check(
     "src/application/GuidanceAccess.ts",
     "src/application/javascript/ElectronBoundaryAnalysis.ts",
     "src/application/javascript/ElectronBoundaryGraphContext.ts",
-    "src/application/javascript/JavaScriptArtifactGraphContext.ts",
     "src/browser/CdpCaptureCompleteness.ts",
     "src/browser/CdpCaptureEventHandlers.ts",
     "src/browser/CdpPageCapture.ts",
@@ -179,7 +151,6 @@ check(
     "src/domain/javascript/javascriptNativeHandoff.ts",
     "src/domain/javascript/javascriptRuntimeReconciliationMatching.ts",
     "src/domain/javascript/javascriptRuntimeReconciliationSchemas.ts",
-    "src/domain/javascript/javascriptSemanticQuery.ts",
     "src/domain/javascript/javascriptStaticAnalysisBundler.ts",
     "src/domain/javascript/javascriptStaticAnalysisCalls.ts",
     "src/domain/javascript/javascriptStaticAnalysisFindings.ts",

scripts/verify/javascript/runtime-observation.mjs

@@ -5,7 +5,6 @@ import { parseArgs } from "node:util";
 
 import { readStableArtifact } from "../../../dist/artifacts/readStableArtifact.js";
 import { ArtifactReaderFailure } from "../../../dist/artifacts/ArtifactReader.js";
-import { ArtifactResourceScope } from "../../../dist/artifacts/ArtifactResourceScope.js";
 import {
   ArtifactFileCleanupFailure,
   artifactFileCompletion,
@@ -14,6 +13,7 @@ import {
 
 import { reconcileJavaScriptRuntimeEvidence } from "../../../dist/application/javascript/JavaScriptRuntimeReconciliationService.js";
 import { analyzeJavaScriptApplicationWithOwnedScope } from "../../lib/javascript-application-analysis.mjs";
+import { withVerifierArtifactScope } from "../../lib/verifier-artifact-scope.mjs";
 import {
   completeVerifierRun,
   createVerifierRun,
@@ -106,33 +106,23 @@ process.stdout.write(
 );
 
 async function readEvidenceFile(path) {
-  const scope = new ArtifactResourceScope();
   let outcome;
   try {
     outcome = {
       ok: true,
-      value: await readStableArtifact(
-        await realpath(path),
-        64 * 1024 * 1024,
-        undefined,
-        undefined,
-        scope,
+      value: await withVerifierArtifactScope(async (scope) =>
+        readStableArtifact(
+          await realpath(path),
+          64 * 1024 * 1024,
+          undefined,
+          undefined,
+          scope,
+        ),
       ),
     };
   } catch (cause) {
     outcome = { ok: false, cause };
   }
-  try {
-    await scope.close();
-  } catch (cleanupCause) {
-    if (!outcome.ok)
-      throw new AggregateError(
-        [outcome.cause, cleanupCause],
-        "Verifier cleanup failed",
-        { cause: outcome.cause },
-      );
-    throw cleanupCause;
-  }
   if (!outcome.ok && outcome.cause instanceof ArtifactFileCleanupFailure) {
     const completion = artifactFileCompletion(outcome.cause);
     outcome =

scripts/verify/managed/manifest.mjs

@@ -1,10 +1,9 @@
 import { basename, dirname, isAbsolute, resolve } from "node:path";
-import { ArtifactResourceScope } from "../../../dist/artifacts/ArtifactResourceScope.js";
 import {
   readManagedSnapshot,
   verifyManagedSourceIdentity,
 } from "../../../dist/dotnet/ManagedSnapshot.js";
-import { withVerifierCleanup } from "../../lib/verifier-cleanup.mjs";
+import { withVerifierArtifactScope } from "../../lib/verifier-artifact-scope.mjs";
 
 import { parseBinaryTarget } from "../../../dist/application/BinaryTargetResolver.js";
 import { inspectManagedArtifactBytes } from "../../../dist/dotnet/ManagedArtifactInspector.js";
@@ -24,13 +23,10 @@ import {
 const READ_FILE_MAX_BYTES = 0x7fff_ffff;
 
 export async function verifyManagedAppManifest(rawManifest, manifestPath) {
-  const resources = new ArtifactResourceScope();
-  return withVerifierCleanup(
-    () =>
-      resources.run(() =>
-        verifyManifestSnapshot(rawManifest, manifestPath, resources),
-      ),
-    [() => resources.close()],
+  return withVerifierArtifactScope((resources) =>
+    resources.run(() =>
+      verifyManifestSnapshot(rawManifest, manifestPath, resources),
+    ),
   );
 }
 

scripts/verify/rea-numeric-limits.d.mts

@@ -1,13 +1,6 @@
 /** Relative path of the registry. Its text is a declaration, not a producer. */
 export const NUMERIC_LIMIT_DECLARATION: "src/domain/numericLimitRegistry.ts";
 
-/** Limits that must become analysis settings and cannot be registry exceptions. */
-export const REQUIRED_RUNTIME_LIMITS: readonly [
-  "REA_NTFS_MFT_MAX_FILE_BYTES",
-  "REA_REGF_HIVE_MAX_FILE_BYTES",
-  "REA_WEB_BUNDLE_ENDPOINT_LITERAL_CANDIDATES",
-];
-
 /** True for a numeric `REA_` limit, including the documented endpoint-candidate count. */
 export function isNumericLimit(name: string): boolean;
 
@@ -55,6 +48,8 @@ export function discoverNumericLimitUses(
   readonly unresolved: readonly {
     readonly path: string;
     readonly offset: number;
+    readonly line: number;
+    readonly column: number;
     readonly reason: string;
   }[];
 };

scripts/verify/rea-numeric-limits.mjs

@@ -25,6 +25,7 @@ const listFiles = async (dir) => {
     } else if (
       entry.name.endsWith(".ts") &&
       !entry.name.endsWith(".test.ts") &&
+      !entry.name.endsWith(".spec.ts") &&
       !entry.name.endsWith(".fixture.ts")
     )
       output.push(path);
@@ -39,7 +40,7 @@ export const NUMERIC_LIMIT_DECLARATION = "src/domain/numericLimitRegistry.ts";
  * These limits are moving onto runtime analysis settings on their own PRs.
  * A producer or a registry entry cannot satisfy that requirement.
  */
-export const REQUIRED_RUNTIME_LIMITS = [
+const REQUIRED_RUNTIME_LIMITS = [
   "REA_NTFS_MFT_MAX_FILE_BYTES",
   "REA_REGF_HIVE_MAX_FILE_BYTES",
   "REA_WEB_BUNDLE_ENDPOINT_LITERAL_CANDIDATES",
@@ -170,8 +171,16 @@ const stringBindings = (sourceFile, symbols, unresolved) => {
           item.offset === offset &&
           item.reason === reason,
       )
-    )
-      unresolved.push({ path, offset, reason });
+    ) {
+      const location = sourceFile.getLineAndCharacterOfPosition(offset);
+      unresolved.push({
+        path,
+        offset,
+        line: location.line + 1,
+        column: location.character + 1,
+        reason,
+      });
+    }
   };
   const initializer = (identifier) => {
     if (!candidates.has(identifier.text)) return undefined;
@@ -949,7 +958,7 @@ if (direct) {
 
   for (const issue of discovered.unresolved)
     console.log(
-      `${issue.path}:${issue.offset}: numeric limit candidate unresolved (${issue.reason})`,
+      `${issue.path}:${issue.line}:${issue.column}: numeric limit candidate unresolved (${issue.reason})`,
     );
 
   for (const [name, file] of [...discovered].sort(([left], [right]) =>

src/android/AndroidNativeInventory.ts

@@ -1,6 +1,8 @@
 import type { JadxToolPort } from "./JadxAnalysis.js";
-import type { AndroidNativeDeclarations } from "../domain/android/androidNativeDeclarations.js";
-import { jadxNativeDeclarationsSchema } from "./JadxProtocol.js";
+import {
+  androidNativeDeclarationsSchema,
+  type AndroidNativeDeclarations,
+} from "../domain/android/androidNativeDeclarations.js";
 import { AnalysisOutputError } from "../domain/analysisErrorCore.js";
 
 /** Validate the native-only batch at its producing boundary, preserving raw facts. */
@@ -9,7 +11,7 @@ export const readAndroidNativeInventory = async (
   snapshot: string,
 ): Promise<AndroidNativeDeclarations> => {
   const raw = await tools.json("rea_native_declarations", { path: snapshot });
-  const parsed = jadxNativeDeclarationsSchema.safeParse(raw);
+  const parsed = androidNativeDeclarationsSchema.safeParse(raw);
   if (!parsed.success)
     throw new AnalysisOutputError(
       "inspect_android_jni_bindings",

src/android/JadxProtocol.ts

@@ -10,11 +10,6 @@ import {
   dexDescriptorSchema,
   dexTypeSchema,
 } from "../domain/android/dexTypes.js";
-import { androidNativeDeclarationsSchema } from "../domain/android/androidNativeDeclarations.js";
-
-/** Native-only raw DEX facts authored before decompiler deduplication. */
-export const jadxNativeDeclarationsSchema = androidNativeDeclarationsSchema;
-
 const count = z.int().nonnegative();
 /** Typed allocation failures authored before upstream erases the JVM exception. */
 const jadxMemoryFailureSchema = z.strictObject({

src/apkSignature/apkSignatureFailures.ts

@@ -1,6 +1,6 @@
 import { fixedAllowanceOptions } from "../domain/fixedAllowanceRemediation.js";
 import { ArtifactReaderFailure } from "../artifacts/ArtifactReader.js";
-import { stableArtifactInputRecovery } from "../artifacts/StableArtifactFailure.js";
+import { stableArtifactInputFailure } from "../artifacts/StableArtifactFailure.js";
 import {
   artifactFilePrimaryFacts,
   type ArtifactFilePrimaryFacts,
@@ -231,11 +231,7 @@ const artifactReaderFailure = (
         },
       );
     case "path":
-      return new AnalysisInputError(
-        OPERATION,
-        { cause, ...stableArtifactInputRecovery(cause) },
-        [{ path: ["path"], reason: "invalid_format", message: cause.message }],
-      );
+      return stableArtifactInputFailure(cause, OPERATION);
     default:
       return adapterFailure(cause, path);
   }

src/application/GooseConfigurationYaml.test.ts

@@ -18,6 +18,123 @@ const extension = {
   timeout: 300,
 };
 
+describe("Goose YAML source key retention", () => {
+  it("updates and removes an extension selected through aliased path keys", () => {
+    const source =
+      "table: &table extensions\nname: &name rea\n? *table\n:\n  ? *name\n  : {cmd: old, type: stdio}\n";
+    const updated = editGooseConfigurationYaml(source, ["extensions", "rea"], {
+      cmd: "rea",
+      type: "stdio",
+    });
+    expect(updated).toContain("*table");
+    expect(updated).toContain("*name");
+    expect(parseGooseConfigurationYaml(updated)).toMatchObject({
+      extensions: { rea: { cmd: "rea", type: "stdio" } },
+    });
+    const removed = editGooseConfigurationYaml(
+      updated,
+      ["extensions", "rea"],
+      undefined,
+    );
+    expect(removed).not.toContain("*name");
+    expect(parseGooseConfigurationYaml(removed)).toMatchObject({
+      extensions: {},
+    });
+    const ambiguous =
+      "name: &name rea\nextensions:\n  ? *name\n  : {cmd: first}\n  rea: {cmd: second}\n";
+    expect(() =>
+      editGooseConfigurationYaml(ambiguous, ["extensions", "rea"], {
+        cmd: "rea",
+      }),
+    ).toThrow(/more than one key resolving to "rea"/);
+  });
+
+  it("retains a collection mapping key when an adjacent field changes", () => {
+    const source =
+      "extensions:\n  rea:\n    cmd: old\n    ? [one, two]\n    : retained\n";
+    const parsed = parseGooseConfigurationYaml(source) as {
+      extensions: { rea: Record<string, unknown> };
+    };
+    const updated = editGooseConfigurationYaml(source, ["extensions", "rea"], {
+      ...parsed.extensions.rea,
+      cmd: "rea",
+    });
+    const document = parseDocument(updated);
+    expect(document.errors).toEqual([]);
+    const native = document.toJS({ mapAsMap: true }) as Map<string, unknown>;
+    const extensions = native.get("extensions") as Map<string, unknown>;
+    const entry = extensions.get("rea") as Map<unknown, unknown>;
+    expect([...entry.entries()]).toContainEqual([["one", "two"], "retained"]);
+    expect(entry.get("cmd")).toBe("rea");
+  });
+
+  it("retains an aliased mapping key when an adjacent launcher field changes", () => {
+    const source =
+      'label: &label 1\nextensions:\n  rea:\n    cmd: old\n    ? *label\n    : numeric\n    "1": string\n';
+    const parsed = parseGooseConfigurationYaml(source) as {
+      extensions: { rea: Record<string, unknown> };
+    };
+    const updated = editGooseConfigurationYaml(source, ["extensions", "rea"], {
+      ...parsed.extensions.rea,
+      cmd: "rea",
+    });
+    expect(updated).toContain("*label");
+    expect(updated).toContain("numeric");
+    expect(updated).toContain('"1": string');
+  });
+
+  it("preserves the order of an anchor and a retained non-string key alias", () => {
+    const source =
+      'extensions:\n  rea:\n    cmd: old\n    shared: &seed value\n    1: *seed\n    "1": string\n';
+    const parsed = parseGooseConfigurationYaml(source) as {
+      extensions: { rea: Record<string, unknown> };
+    };
+    const updated = editGooseConfigurationYaml(source, ["extensions", "rea"], {
+      ...parsed.extensions.rea,
+      cmd: "rea",
+    });
+    expect(updated.indexOf("&seed")).toBeLessThan(updated.indexOf("*seed"));
+    expect(parseGooseConfigurationYaml(updated)).toMatchObject({
+      extensions: { rea: { shared: "value", cmd: "rea" } },
+    });
+  });
+
+  it("retains distinct keys beside an edited field and rejects an ambiguous edit", () => {
+    const source =
+      'extensions:\n  rea:\n    cmd: old\n    1: numeric\n    "1": string\n';
+    const parsed = parseGooseConfigurationYaml(source) as {
+      extensions: { rea: Record<string, unknown> };
+    };
+    const entry = parsed.extensions.rea;
+    const updated = editGooseConfigurationYaml(source, ["extensions", "rea"], {
+      ...entry,
+      cmd: "rea",
+    });
+    expect(updated).toContain('    1: numeric\n    "1": string');
+    expect(updated).toContain("cmd: rea");
+    expect(() =>
+      editGooseConfigurationYaml(source, ["extensions", "rea"], {
+        ...entry,
+        "1": "changed",
+      }),
+    ).toThrow(/source identity is not a plain string key/);
+  });
+
+  it("keeps distinct native mapping keys in unchanged extension settings", () => {
+    const source =
+      'extensions:\n  rea:\n    cmd: old\n    metadata:\n      1: numeric\n      "1": string\n';
+    const parsed = parseGooseConfigurationYaml(source) as {
+      extensions: { rea: Record<string, unknown> };
+    };
+    const updated = editGooseConfigurationYaml(source, ["extensions", "rea"], {
+      ...parsed.extensions.rea,
+      cmd: "rea",
+    });
+    expect(updated).toContain('      1: numeric\n      "1": string');
+    expect(updated).toContain("cmd: rea");
+  });
+});
+
 describe("Goose YAML 1.2 source facts", () => {
   it("keeps native strings and exact large integer facts distinct", () => {
     const source =

src/application/GooseConfigurationYaml.ts

@@ -13,6 +13,7 @@ import { ConfigurationError } from "../domain/configurationErrors.js";
 import {
   copyYamlAliasSource,
   preserveYamlAliasValues,
+  resolveYamlEditPath,
 } from "./YamlConfigurationAliases.js";
 import {
   retainYamlConfigurationSource,
@@ -251,7 +252,7 @@ export const editGooseConfigurationYaml = (
   if (!isMap(document.contents))
     throw new ConfigurationError("Goose configuration root must be a mapping");
   for (let length = 1; length < path.length; length++) {
-    const parent = path.slice(0, length);
+    const parent = resolveYamlEditPath(document, path.slice(0, length));
     let previous = document.getIn(parent, true);
     if (isAlias(previous)) {
       previous = copyYamlAliasSource(previous, document);
@@ -262,28 +263,28 @@ export const editGooseConfigurationYaml = (
       document.setIn(parent, document.createNode({}));
     } else if (!isMap(previous))
       throw new ConfigurationError(
-        `Goose configuration ${parent.join(".")} must be a mapping`,
+        `Goose configuration ${path.slice(0, length).join(".")} must be a mapping`,
       );
   }
-  const previous = document.getIn(path, true);
-  const parent = document.getIn(path.slice(0, -1), true);
+  const sourcePath = resolveYamlEditPath(document, path);
+  const previous = document.getIn(sourcePath, true);
+  const parent = document.getIn(sourcePath.slice(0, -1), true);
   const removedKey =
     value === undefined && isMap(parent)
-      ? parent.items.find(
-          (pair) => isScalar(pair.key) && pair.key.value === path.at(-1),
-        )?.key
+      ? parent.items.find((pair) => pair.key === sourcePath.at(-1))?.key
       : undefined;
   const retained = preserveYamlAliasValues(document, [previous, removedKey]);
   if (value === undefined) {
-    if (!document.deleteIn(path)) return text;
+    if (!document.deleteIn(sourcePath)) return text;
   } else
     document.setIn(
-      path,
+      sourcePath,
       isMap(previous) || isSeq(previous)
         ? retainYamlConfigurationSource(
             previous,
             document.createNode(value),
             retained,
+            document,
           )
         : value,
     );

src/application/HermesConfigurationYaml.test.ts

@@ -12,6 +12,69 @@ import {
   stringifyHermesConfigurationYaml,
 } from "./HermesConfigurationYaml.js";
 
+it("uses the first inherited mapping when creating an override", () => {
+  const source =
+    "first: &first\n  mcp_servers:\n    one: {command: first}\nsecond: &second\n  mcp_servers:\n    two: {command: second}\n<<: [*first, *second]\n";
+  const updated = editHermesConfigurationYaml(source, ["mcp_servers", "rea"], {
+    command: "rea",
+  });
+  const parsed = parseHermesConfigurationYaml(updated) as {
+    mcp_servers: Record<string, unknown>;
+  };
+  expect(parsed.mcp_servers).toEqual({
+    one: { command: "first" },
+    rea: { command: "rea" },
+  });
+  expect(
+    parseHermesConfigurationYaml(
+      updated.replace("command: first", "command: changed"),
+    ),
+  ).toMatchObject({
+    mcp_servers: { one: { command: "changed" } },
+  });
+});
+
+it("refuses an inherited override when an existing anchor name is shadowed", () => {
+  const source =
+    "shared: &shared\n  mcp_servers: &table\n    other: {command: first}\nshadow: &table {other: {command: second}}\n<<: *shared\n";
+  expect(() =>
+    editHermesConfigurationYaml(source, ["mcp_servers", "rea"], {
+      command: "rea",
+    }),
+  ).toThrow(/anchor is shadowed/);
+});
+
+it("retains inherited YAML settings when updating a registration", () => {
+  const source =
+    "defaults: &defaults\n  enabled: false\nmcp_servers:\n  rea:\n    <<: *defaults\n    command: old\n";
+  const parsed = parseHermesConfigurationYaml(source) as {
+    mcp_servers: { rea: Record<string, unknown> };
+  };
+  const updated = editHermesConfigurationYaml(source, ["mcp_servers", "rea"], {
+    ...parsed.mcp_servers.rea,
+    command: "rea",
+  });
+  expect(updated).toContain("<<: *defaults");
+  const changedDefault = updated.replace("enabled: false", "enabled: true");
+  expect(parseHermesConfigurationYaml(changedDefault)).toMatchObject({
+    mcp_servers: { rea: { command: "rea", enabled: true } },
+  });
+  const overridden = editHermesConfigurationYaml(
+    source,
+    ["mcp_servers", "rea"],
+    { ...parsed.mcp_servers.rea, command: "rea", enabled: true },
+  );
+  expect(overridden).toContain("<<: *defaults");
+  expect(parseHermesConfigurationYaml(overridden)).toMatchObject({
+    mcp_servers: { rea: { command: "rea", enabled: true } },
+  });
+  expect(() =>
+    editHermesConfigurationYaml(source, ["mcp_servers", "rea"], {
+      command: "rea",
+    }),
+  ).toThrow(/Cannot remove inherited YAML setting/);
+});
+
 it("preserves annotations on changed registration mappings and scalar fields", () => {
   const source =
     "mcp_servers:\n  rea: # registration note\n    command: old # command note\n    env: # environment note\n      MODE: old # mode note\n    args: # arguments note\n      - old # argument note\n";

src/application/HermesConfigurationYaml.ts

@@ -3,16 +3,21 @@ import {
   isMap,
   isScalar,
   isSeq,
+  Pair,
   parseDocument,
   Document,
   Schema,
+  YAMLMap,
+  type Node,
   type ParsedNode,
   type ScalarTag,
   type Tags,
 } from "yaml";
+import { ConfigurationError } from "../domain/configurationErrors.js";
 import {
   preserveYamlAliasValues,
   copyYamlAliasSource,
+  resolveYamlEditPath,
 } from "./YamlConfigurationAliases.js";
 import {
   retainYamlConfigurationSource,
@@ -268,6 +273,102 @@ const parseHermesDocument = (text: string) => {
   return document;
 };
 
+const projectedYamlPathExists = (
+  document: Document,
+  path: readonly string[],
+): boolean => {
+  let current: unknown = document.toJS();
+  for (const segment of path) {
+    if (
+      typeof current !== "object" ||
+      current === null ||
+      !Object.hasOwn(current, segment)
+    )
+      return false;
+    current = (current as Record<string, unknown>)[segment];
+  }
+  return true;
+};
+
+const inheritedRegistrationRemovalError = () =>
+  new ConfigurationError(
+    "The registration is inherited from a YAML merge. Remove it at the shared source before rerunning uninstall",
+  );
+
+/** Find the source node selected by YAML merge precedence. */
+const inheritedYamlValue = (
+  document: Document,
+  source: unknown,
+  name: string,
+  visiting = new Set<object>(),
+): unknown => {
+  const node = isAlias(source) ? source.resolve(document) : source;
+  if (!isMap(node) || visiting.has(node)) return undefined;
+  visiting.add(node);
+  try {
+    const matches = node.items.filter((pair) => {
+      const key = isAlias(pair.key) ? pair.key.resolve(document) : pair.key;
+      return isScalar(key) && key.value === name;
+    });
+    if (matches.length > 1)
+      throw new ConfigurationError(
+        `YAML mapping contains more than one key resolving to ${JSON.stringify(name)}`,
+      );
+    if (matches[0] !== undefined) return matches[0].value;
+    for (const pair of node.items) {
+      if (
+        !isScalar(pair.key) ||
+        typeof pair.key.value !== "symbol" ||
+        pair.key.source !== "<<"
+      )
+        continue;
+      const merged = isAlias(pair.value)
+        ? pair.value.resolve(document)
+        : pair.value;
+      const sources = isSeq(merged) ? merged.items : [merged];
+      for (const candidate of sources) {
+        const found = inheritedYamlValue(document, candidate, name, visiting);
+        if (found !== undefined) return found;
+      }
+    }
+    return undefined;
+  } finally {
+    visiting.delete(node);
+  }
+};
+
+/** Create a local override that continues to inherit the shared mapping. */
+const inheritedYamlMapOverride = (
+  document: Document,
+  parent: readonly (string | Node)[],
+  name: string,
+): void => {
+  const owner =
+    parent.length === 1
+      ? document.contents
+      : document.getIn(parent.slice(0, -1), true);
+  let inherited = inheritedYamlValue(document, owner, name);
+  if (isAlias(inherited)) inherited = inherited.resolve(document);
+  if (!isMap(inherited))
+    throw new ConfigurationError(
+      `Inherited YAML setting ${JSON.stringify(name)} is not a mapping`,
+    );
+  const mergeDocument = parseHermesDocument("<<: {}\n");
+  if (
+    !isMap(mergeDocument.contents) ||
+    mergeDocument.contents.items[0] === undefined
+  )
+    throw new ConfigurationError("Cannot create a YAML merge key");
+  const alias = document.createAlias(inherited, "rea_inherited");
+  const override = new YAMLMap(document.schema);
+  override.items.push(new Pair(mergeDocument.contents.items[0].key, alias));
+  document.setIn(parent, override);
+  if (alias.resolve(document) !== inherited)
+    throw new ConfigurationError(
+      "The inherited YAML anchor is shadowed; edit its shared source before rerunning setup",
+    );
+};
+
 /** Parse a Hermes `config.yaml`, preserving the distinction between no root and explicit null. */
 export const parseHermesConfigurationYaml = (text: string): unknown => {
   const document = parseHermesDocument(text);
@@ -299,7 +400,7 @@ export const editHermesConfigurationYaml = (
     document.contents = map;
   }
   for (let length = 1; length < path.length; length++) {
-    const parent = path.slice(0, length);
+    const parent = resolveYamlEditPath(document, path.slice(0, length));
     const previous = document.getIn(parent, true);
     if (isAlias(previous)) {
       const copied = copyYamlAliasSource(previous, document);
@@ -308,35 +409,49 @@ export const editHermesConfigurationYaml = (
         document.setIn(parent, copied);
       }
     } else if (value !== undefined && !document.hasIn(parent)) {
+      if (projectedYamlPathExists(document, path.slice(0, length))) {
+        inheritedYamlMapOverride(document, parent, path[length - 1]!);
+        continue;
+      }
       // Implicit JS Map parents serialize as !!omap in YAML 1.1.
       document.setIn(parent, document.createNode({}));
     }
   }
-  const previous = document.getIn(path, true);
+  const sourcePath = resolveYamlEditPath(document, path);
+  const previous = document.getIn(sourcePath, true);
   // Deletion removes the pair's key too; replacement retains that key node.
   const parent =
-    value === undefined ? document.getIn(path.slice(0, -1), true) : undefined;
+    value === undefined
+      ? document.getIn(sourcePath.slice(0, -1), true)
+      : undefined;
+  if (
+    value === undefined &&
+    !document.hasIn(sourcePath) &&
+    projectedYamlPathExists(document, path)
+  )
+    throw inheritedRegistrationRemovalError();
   const removedKey = isMap(parent)
-    ? parent.items.find(
-        (pair) => isScalar(pair.key) && pair.key.value === path.at(-1),
-      )?.key
+    ? parent.items.find((pair) => pair.key === sourcePath.at(-1))?.key
     : undefined;
   const retainedSources = preserveYamlAliasValues(document, [
     previous,
     removedKey,
   ]);
   if (value === undefined) {
-    if (!document.deleteIn(path)) return text;
+    if (!document.deleteIn(sourcePath)) return text;
+    if (projectedYamlPathExists(document, path))
+      throw inheritedRegistrationRemovalError();
   } else {
     // Let YAML's scalar update preserve numeric formats for a direct edit.
     // Replacing containers needs explicit retention of unchanged child nodes.
     document.setIn(
-      path,
+      sourcePath,
       isMap(previous) || isSeq(previous)
         ? retainYamlConfigurationSource(
             previous,
             document.createNode(value),
             retainedSources,
+            document,
           )
         : value,
     );

src/application/Uninstall.ts

@@ -1089,11 +1089,13 @@ const removeClient = async (
       // clientRegistrationRemoval admitted only names whose repeats REA owns.
       { removeShadowedMembersAt: editedPaths },
     );
-  } catch {
+  } catch (cause: unknown) {
     return item(
       client.name,
       "failed",
-      "Configuration could not be updated, so no change was made. Repair the configuration, then rerun uninstall.",
+      cause instanceof ConfigurationError
+        ? `Configuration could not be updated, so no change was made. ${cause.message}.`
+        : "Configuration could not be updated, so no change was made. Repair the configuration, then rerun uninstall.",
     );
   }
   if (!serialized.ok)

src/application/YamlConfigurationAliases.ts

@@ -9,6 +9,36 @@ import {
   type Document,
   type Node,
 } from "yaml";
+import { ConfigurationError } from "../domain/configurationErrors.js";
+
+/** Resolve literal and aliased string keys to their source nodes for editing. */
+export const resolveYamlEditPath = (
+  document: Document,
+  path: readonly string[],
+): (string | Node)[] => {
+  const resolved: (string | Node)[] = [];
+  let current: unknown = document.contents;
+  for (const name of path) {
+    if (isAlias(current)) current = current.resolve(document);
+    if (!isMap(current)) {
+      resolved.push(name);
+      current = undefined;
+      continue;
+    }
+    const matches = current.items.filter((pair) => {
+      const key = isAlias(pair.key) ? pair.key.resolve(document) : pair.key;
+      return isScalar(key) && key.value === name;
+    });
+    if (matches.length > 1)
+      throw new ConfigurationError(
+        `YAML mapping contains more than one key resolving to ${JSON.stringify(name)}.`,
+      );
+    const pair = matches[0];
+    resolved.push(pair !== undefined && isNode(pair.key) ? pair.key : name);
+    current = pair?.value;
+  }
+  return resolved;
+};
 
 interface AliasCopies {
   readonly targets: ReadonlyMap<Alias, Node | undefined>;

src/application/YamlConfigurationSource.ts

@@ -3,10 +3,17 @@ import {
   isNode,
   isScalar,
   isSeq,
+  Pair,
+  visit,
+  YAMLMap,
+  type Document,
   type Node,
   type ScalarTag,
   type Tags,
+  type YAMLSeq,
 } from "yaml";
+import { isDeepStrictEqual } from "node:util";
+import { ConfigurationError } from "../domain/configurationErrors.js";
 import { retainYamlSequenceAnnotations } from "./YamlSequenceAnnotations.js";
 
 export const yamlNumericValuesEqual = (
@@ -26,12 +33,50 @@ export const yamlNumericValuesEqual = (
   );
 };
 
-/** Keep source annotations and unchanged scalars when updating a value. */
+const normalizeYamlInteger = (_key: unknown, value: unknown): unknown =>
+  typeof value === "bigint" && Number.isSafeInteger(Number(value))
+    ? Number(value)
+    : value;
+
+const containsRetainedSource = (
+  roots: readonly unknown[],
+  retainedSources: ReadonlySet<Node>,
+): boolean => {
+  if (retainedSources.size === 0) return false;
+  let found = false;
+  for (const root of roots) {
+    if (!isNode(root)) continue;
+    visit(root, {
+      Value: (_key, node) => {
+        if (retainedSources.has(node)) found = true;
+      },
+    });
+  }
+  return found;
+};
+
+/** Keep source nodes and annotations when updating a value. */
 export const retainYamlConfigurationSource = (
   previous: unknown,
   next: Node,
   retainedSources: ReadonlySet<Node>,
+  document: Document,
 ): Node => {
+  if (
+    (isMap(previous) || isSeq(previous)) &&
+    ((isMap(previous) && isMap(next)) || (isSeq(previous) && isSeq(next)))
+  ) {
+    // Object projection can collapse distinct YAML keys. Reuse an unchanged
+    // collection before reconstructing its children from that projection.
+    if (
+      !containsRetainedSource([previous], retainedSources) &&
+      isDeepStrictEqual(
+        previous.toJS(document, { reviver: normalizeYamlInteger }),
+        next.toJS(document, { reviver: normalizeYamlInteger }),
+      )
+    )
+      return previous;
+  }
   if (
     isScalar(previous) &&
     isScalar(next) &&
@@ -60,53 +105,235 @@ export const retainYamlConfigurationSource = (
       next.spaceBefore = previous.spaceBefore;
   }
   if (isMap(previous) && isMap(next)) {
-    const entries = new Map(
-      previous.items.flatMap((pair) =>
-        isScalar(pair.key) && typeof pair.key.value === "string"
-          ? [[pair.key.value, pair] as const]
-          : [],
-      ),
-    );
-    for (const pair of next.items) {
-      const key = isScalar(pair.key) ? pair.key.value : undefined;
-      const prior = typeof key === "string" ? entries.get(key) : undefined;
-      if (prior === undefined) continue;
-      pair.key = isNode(pair.key)
-        ? retainYamlConfigurationSource(prior.key, pair.key, retainedSources)
-        : prior.key;
-      if (isNode(pair.value))
-        pair.value = retainYamlConfigurationSource(
-          prior.value,
-          pair.value,
-          retainedSources,
-        );
-    }
+    retainYamlMapSource(previous, next, retainedSources, document);
   } else if (isSeq(previous) && isSeq(next)) {
-    const stringItems = (items: readonly unknown[]) =>
-      items.every((item) => isScalar(item) && typeof item.value === "string");
-    if (stringItems(previous.items) && stringItems(next.items))
-      retainYamlSequenceAnnotations(
-        previous,
-        next,
-        (item) => (isScalar(item) ? item.value : undefined),
-        (source, target) =>
-          retainYamlConfigurationSource(source, target, retainedSources),
-        (source) => !retainedSources.has(source),
-      );
-    else
-      next.items = next.items.map((item, index) =>
-        isNode(item)
-          ? retainYamlConfigurationSource(
-              previous.items[index],
-              item,
-              retainedSources,
-            )
-          : item,
-      );
+    retainYamlSequenceSource(previous, next, retainedSources, document);
   }
   return next;
 };
 
+const retainYamlSequenceSource = (
+  previous: YAMLSeq,
+  next: YAMLSeq,
+  retainedSources: ReadonlySet<Node>,
+  document: Document,
+): void => {
+  const stringItems = (items: readonly unknown[]) =>
+    items.every((item) => isScalar(item) && typeof item.value === "string");
+  if (stringItems(previous.items) && stringItems(next.items)) {
+    retainYamlSequenceAnnotations(
+      previous,
+      next,
+      (item) => (isScalar(item) ? item.value : undefined),
+      (source, target) =>
+        retainYamlConfigurationSource(
+          source,
+          target,
+          retainedSources,
+          document,
+        ),
+      (source) => !retainedSources.has(source),
+    );
+    return;
+  }
+  next.items = next.items.map((item, index) =>
+    isNode(item)
+      ? retainYamlConfigurationSource(
+          previous.items[index],
+          item,
+          retainedSources,
+          document,
+        )
+      : item,
+  );
+};
+
+const retainYamlMapSource = (
+  previous: YAMLMap,
+  next: YAMLMap,
+  retainedSources: ReadonlySet<Node>,
+  document: Document,
+): void => {
+  const hasMerges = retainYamlMergeSources(previous, next, document);
+  const hasSourceOnlyKeys = retainProjectedYamlKeys(
+    previous,
+    next,
+    retainedSources,
+    document,
+  );
+  const entries = new Map(
+    previous.items.flatMap((pair) =>
+      isScalar(pair.key) && typeof pair.key.value === "string"
+        ? [[pair.key.value, pair] as const]
+        : [],
+    ),
+  );
+  for (const pair of next.items) {
+    if (previous.items.includes(pair)) continue;
+    const key = isScalar(pair.key) ? pair.key.value : undefined;
+    const prior = typeof key === "string" ? entries.get(key) : undefined;
+    if (prior === undefined) continue;
+    pair.key = isNode(pair.key)
+      ? retainYamlConfigurationSource(
+          prior.key,
+          pair.key,
+          retainedSources,
+          document,
+        )
+      : prior.key;
+    if (isNode(pair.value))
+      pair.value = retainYamlConfigurationSource(
+        prior.value,
+        pair.value,
+        retainedSources,
+        document,
+      );
+  }
+  if (hasSourceOnlyKeys || hasMerges) {
+    // Object property ordering moves integer-like keys ahead of their
+    // source neighbors. Restore source order so aliases stay after anchors.
+    const positions = new Map(
+      previous.items.map((pair, index) => [pair, index] as const),
+    );
+    const position = (pair: (typeof next.items)[number]): number => {
+      const key = isScalar(pair.key) ? pair.key.value : undefined;
+      const original =
+        positions.has(pair) || typeof key !== "string"
+          ? pair
+          : entries.get(key);
+      return original === undefined
+        ? Infinity
+        : (positions.get(original) ?? Infinity);
+    };
+    next.items.sort((left, right) => position(left) - position(right));
+  }
+};
+
+const isYamlMergeKey = (key: unknown): boolean =>
+  isScalar(key) && typeof key.value === "symbol" && key.source === "<<";
+
+/** Retain inheritance while materializing only explicit changes to it. */
+const retainYamlMergeSources = (
+  previous: YAMLMap,
+  next: YAMLMap,
+  document: Document,
+): boolean => {
+  const merges = previous.items.filter((pair) => isYamlMergeKey(pair.key));
+  if (merges.length === 0) return false;
+  const inherited = new YAMLMap(document.schema);
+  inherited.items = merges;
+  const direct = new YAMLMap(document.schema);
+  direct.items = previous.items.filter((pair) => !isYamlMergeKey(pair.key));
+  const project = (map: YAMLMap): Record<string, unknown> =>
+    map.toJS(document, { reviver: normalizeYamlInteger }) as Record<
+      string,
+      unknown
+    >;
+  const inheritedValues = project(inherited);
+  const directValues = project(direct);
+  const desired = project(next);
+  const inheritedUnchanged = new Set<string>();
+  for (const [key, value] of Object.entries(inheritedValues)) {
+    if (Object.hasOwn(directValues, key)) continue;
+    if (!Object.hasOwn(desired, key))
+      throw new ConfigurationError(
+        `Cannot remove inherited YAML setting ${JSON.stringify(key)} while retaining its merge.`,
+      );
+    if (isDeepStrictEqual(value, desired[key])) inheritedUnchanged.add(key);
+  }
+  next.items = [
+    ...merges,
+    ...next.items.filter((pair) => {
+      const key = isScalar(pair.key) ? pair.key.value : undefined;
+      return typeof key !== "string" || !inheritedUnchanged.has(key);
+    }),
+  ];
+  return true;
+};
+
+const retainProjectedYamlKeys = (
+  previous: YAMLMap,
+  next: YAMLMap,
+  retainedSources: ReadonlySet<Node>,
+  document: Document,
+): boolean => {
+  // A JS property can represent several distinct native YAML keys. Keep
+  // those source pairs together when the property was not edited.
+  const groups = new Map<string, typeof previous.items>();
+  const sourceOnlyKeys = new Set<string>();
+  for (const pair of previous.items) {
+    if (isYamlMergeKey(pair.key)) continue;
+    let key: string;
+    if (isScalar(pair.key) && typeof pair.key.value === "string")
+      key = pair.key.value;
+    else {
+      const singleton = new YAMLMap(document.schema);
+      singleton.items.push(new Pair(pair.key, null));
+      const projected: unknown = singleton.toJS(document);
+      if (typeof projected !== "object" || projected === null)
+        throw new ConfigurationError(
+          "YAML mapping key could not be resolved safely",
+        );
+      const [projectedKey] = Object.keys(projected);
+      if (projectedKey === undefined || Object.keys(projected).length !== 1)
+        throw new ConfigurationError(
+          "YAML mapping key could not be resolved safely",
+        );
+      key = projectedKey;
+      sourceOnlyKeys.add(key);
+    }
+    const group = groups.get(key) ?? [];
+    group.push(pair);
+    groups.set(key, group);
+  }
+  if (sourceOnlyKeys.size > 0) {
+    const oldValue: unknown = previous.toJS(document, {
+      reviver: normalizeYamlInteger,
+    });
+    const newValue: unknown = next.toJS(document, {
+      reviver: normalizeYamlInteger,
+    });
+    if (
+      typeof oldValue !== "object" ||
+      oldValue === null ||
+      typeof newValue !== "object" ||
+      newValue === null
+    )
+      throw new ConfigurationError("YAML mapping could not be compared safely");
+    const oldProperties = oldValue as Record<string, unknown>;
+    const newProperties = newValue as Record<string, unknown>;
+    const replacements = new Map<string, typeof previous.items>();
+    for (const key of sourceOnlyKeys) {
+      const group = groups.get(key);
+      if (group === undefined) continue;
+      if (
+        !Object.hasOwn(newProperties, key) ||
+        !isDeepStrictEqual(oldProperties[key], newProperties[key])
+      )
+        throw new ConfigurationError(
+          `Cannot safely change YAML mapping key ${JSON.stringify(key)} because its source identity is not a plain string key.`,
+        );
+      if (
+        containsRetainedSource(
+          group.flatMap((pair) => [pair.key, pair.value]),
+          retainedSources,
+        )
+      )
+        throw new ConfigurationError(
+          `Cannot safely preserve YAML mapping key ${JSON.stringify(key)} while its anchor is moved.`,
+        );
+      replacements.set(key, group);
+    }
+    next.items = next.items.flatMap((pair) => {
+      const key = isScalar(pair.key) ? pair.key.value : undefined;
+      const replacement =
+        typeof key === "string" ? replacements.get(key) : undefined;
+      return replacement ?? [pair];
+    });
+  }
+  return sourceOnlyKeys.size > 0;
+};
+
 /** Keep a source spelling only while the selected schema resolves its value unchanged. */
 const sameResolvedScalarValue = (left: unknown, right: unknown): boolean =>
   Object.is(left, right) ||

src/application/analysisView/AnalysisViewService.test.ts

@@ -21,7 +21,7 @@ import {
   parseEvidence,
   rebindEvidenceToTargetPath,
 } from "../../domain/evidence.js";
-import { inspectAnalysisViewInputSchema } from "../../domain/analysisView/analysisView.js";
+import { inspectAnalysisViewInputSchema } from "../../domain/analysisView/analysisViewRequest.js";
 import { functionDossierSchema } from "../../domain/native/functionDossier.js";
 import { ghidraFunctionDossier } from "../../domain/ghidraValues.fixture.js";
 import {

src/application/analysisView/AnalysisViewService.ts

@@ -28,11 +28,11 @@ import {
 } from "../../domain/evidence.js";
 import {
   inspectAnalysisViewInputSchema,
-  prepareAnalysisViewProjection,
-  type AnalysisViewResult,
   type AnalysisViewRequest,
   type InspectAnalysisViewInput,
-} from "../../domain/analysisView/analysisView.js";
+} from "../../domain/analysisView/analysisViewRequest.js";
+import { prepareAnalysisViewProjection } from "../../domain/analysisView/analysisView.js";
+import type { AnalysisViewResult } from "../../domain/analysisView/analysisViewResult.js";
 import {
   immutableJsonSnapshotMember,
   isImmutableJsonSnapshot,

src/application/analysisView/BrowserScenarioViews.test.ts

@@ -15,7 +15,7 @@ import { inspectAnalysisView } from "./AnalysisViewService.js";
 import { projectAnalysisError } from "../../domain/analysisErrorProjection.js";
 import { sanitizeBrowserUrl } from "../../domain/browserObservation.js";
 import type { BrowserScenarioCapture } from "../../domain/browserScenarioCapture.js";
-import type { AnalysisViewRequest } from "../../domain/analysisView/analysisView.js";
+import type { AnalysisViewRequest } from "../../domain/analysisView/analysisViewRequest.js";
 import { projectBrowserScenarioView } from "../../domain/analysisView/browserScenarioView.js";
 
 const tree = (text: string) => ({

src/application/analysisView/JavaScriptProvenanceViews.test.ts

@@ -6,7 +6,7 @@ import {
   analysisViewJavaScriptEvidence,
 } from "../../../tests/fixtures/analysisView.js";
 import { SOURCE_TO_BUNDLE_COMPARISON_EXAMPLE } from "../../contracts/javascript/javascriptApplicationWorkflowExamples.js";
-import { analysisViewResultSchema } from "../../domain/analysisView/analysisView.js";
+import { analysisViewResultSchema } from "../../domain/analysisView/analysisViewResult.js";
 import type { Evidence } from "../../domain/evidence.js";
 import { jsonValueValidationIssue } from "../../domain/jsonValue.js";
 import { compareSourceToBundle } from "../../domain/javascript/sourceToBundleComparison.js";

src/application/analysisView/NativeLoadImageViews.test.ts

@@ -1,9 +1,7 @@
 import { expect, it } from "vitest";
 import { createEvidence } from "../../domain/evidence.js";
-import {
-  analysisViewResultSchema,
-  inspectAnalysisViewInputSchema,
-} from "../../domain/analysisView/analysisView.js";
+import { inspectAnalysisViewInputSchema } from "../../domain/analysisView/analysisViewRequest.js";
+import { analysisViewResultSchema } from "../../domain/analysisView/analysisViewResult.js";
 import {
   RELOCATION_SYMBOL_UNRECORDED,
   projectNativeLoadImageView,

src/application/analysisView/NativeObservationViews.test.ts

@@ -13,11 +13,11 @@ import {
   nativeCallGraphSchema,
   type NativeCallGraph,
 } from "../../domain/native/nativeCallGraph.js";
+import type { AnalysisViewRequest } from "../../domain/analysisView/analysisViewRequest.js";
 import {
   analysisViewResultSchema,
-  type AnalysisViewRequest,
   type AnalysisViewResult,
-} from "../../domain/analysisView/analysisView.js";
+} from "../../domain/analysisView/analysisViewResult.js";
 import {
   inspectAnalysisView,
   projectRetainedAnalysis,

src/application/artifacts/ArtifactComparisonEvidence.test.ts

@@ -2,10 +2,8 @@ import { expect, it } from "vitest";
 
 import { inspectAnalysisView } from "../analysisView/AnalysisViewService.js";
 import { ARTIFACT_COMPARISON_EXAMPLE } from "../../contracts/artifactComparisonExample.js";
-import {
-  artifactInventorySummaryViewResultSchema,
-  sealAnalysisView,
-} from "../../domain/analysisView/analysisView.js";
+import { sealAnalysisView } from "../../domain/analysisView/analysisView.js";
+import { artifactInventorySummaryViewResultSchema } from "../../domain/analysisView/analysisViewResult.js";
 import {
   createEvidence,
   parseEvidence,

src/application/artifacts/ArtifactComparisonEvidence.ts

@@ -9,7 +9,7 @@ import { inspectAnalysisViewValidated } from "../analysisView/AnalysisViewServic
 import type { EvidenceFileReadOptions } from "../analysisView/evidenceFileSource.js";
 import { artifactComparisonInputSchema } from "../../contracts/artifactComparisonContracts.js";
 import { parseAnalysisInput } from "../AnalysisInput.js";
-import { artifactInventorySummaryViewResultSchema } from "../../domain/analysisView/analysisView.js";
+import { artifactInventorySummaryViewResultSchema } from "../../domain/analysisView/analysisViewResult.js";
 import {
   compareArtifacts,
   type ArtifactComparisonResult,

src/application/binary/BinarySession.ts

@@ -7,7 +7,10 @@ import {
 } from "../EvidenceBundleFiles.js";
 import type { ResetInvestigationReceipt } from "../../domain/investigationLifecycle.js";
 
-import { retainSavedAnalysisSnapshot } from "../../domain/savedAnalysisSnapshot.js";
+import {
+  retainSavedAnalysisSnapshot,
+  type SavedAnalysisSnapshot,
+} from "../../domain/savedAnalysisSnapshot.js";
 
 import type { BinaryTarget } from "../../domain/binaryTargetTypes.js";
 import {
@@ -39,7 +42,6 @@ import type {
   BinarySessionPort,
   BinaryOpenResult,
   OpenSelectionReceipt,
-  SavedAnalysisSnapshot,
 } from "./BinarySessionPort.js";
 import { binaryTargetSummary } from "./BinaryTargetSummary.js";
 import {

src/application/binary/BinarySessionPort.ts

@@ -30,7 +30,6 @@ import type {
 } from "../AnalysisProvider.js";
 
 import type { SavedAnalysisSnapshot } from "../../domain/savedAnalysisSnapshot.js";
-export type { SavedAnalysisSnapshot } from "../../domain/savedAnalysisSnapshot.js";
 
 /** Selection observed at the end of one serialized open attempt. */
 export type OpenSelectionReceipt =

src/application/desktop/DesktopBuildCapture.ts

@@ -28,7 +28,11 @@ import { ProviderAdapterError } from "../../domain/providerAdapterError.js";
 import { err, ok, type Result } from "../../domain/result.js";
 import { AGENTENV_PROVIDER } from "../../desktop/AgentEnvComputerHelper.js";
 import type { AgentEnvComputer } from "../../desktop/AgentEnvComputer.js";
-import type { ControlledComputer } from "../../desktop/BuildComputerController.js";
+import {
+  controller,
+  type Answer,
+  type ControlledComputer,
+} from "../../desktop/BuildComputerController.js";
 import { BuildComputerLongRuns } from "../../desktop/BuildComputerLongRuns.js";
 import {
   endedCapture,
@@ -37,12 +41,10 @@ import {
 } from "./DesktopBuildCaptureFailure.js";
 import {
   adapterError,
-  controller,
   errorText,
   refused,
   runRea,
   WORK,
-  type Answer,
 } from "./DesktopBuildCommands.js";
 import {
   exportBuild,

src/application/desktop/DesktopBuildCaptureFailure.ts

@@ -7,12 +7,14 @@ import {
 } from "../../domain/desktop/desktopCapture.js";
 import { ProviderAdapterError } from "../../domain/providerAdapterError.js";
 import { AGENTENV_PROVIDER } from "../../desktop/AgentEnvComputerHelper.js";
-import type { ControlledComputer } from "../../desktop/BuildComputerController.js";
+import type {
+  Answer,
+  ControlledComputer,
+} from "../../desktop/BuildComputerController.js";
 import {
   adapterError,
   readOutput,
   reportedFailure,
-  type Answer,
 } from "./DesktopBuildCommands.js";
 
 /** The most lines, and characters, a message quotes from the end of the app's stderr. */

src/application/desktop/DesktopBuildCommands.ts

@@ -22,11 +22,6 @@ import {
   type ControlledComputer,
 } from "../../desktop/BuildComputerController.js";
 
-export {
-  controller,
-  type Answer,
-} from "../../desktop/BuildComputerController.js";
-
 /** The work folder REA keeps under the computer user's home; every capture leaves it out. */
 export const WORK = ".rea-build";
 /** The checkpoint options the draft and the export read the seed and the end with. */

src/application/environment/environmentSource.ts

@@ -8,7 +8,7 @@ import {
 import {
   analysisViewResultSchema,
   type AnalysisViewResult,
-} from "../../domain/analysisView/analysisView.js";
+} from "../../domain/analysisView/analysisViewResult.js";
 import { scenarioCaptureRecords } from "../../domain/analysisView/scenarioCaptureRecords.js";
 import {
   readRecordedResponseBody,

src/application/environment/environmentState.ts

@@ -1,4 +1,4 @@
-import type { AnalysisViewResult } from "../../domain/analysisView/analysisView.js";
+import type { AnalysisViewResult } from "../../domain/analysisView/analysisViewResult.js";
 import {
   changesState,
   type StateDocument,

src/application/native/NativeFunctionMatchingViews.test.ts

@@ -1,7 +1,5 @@
-import {
-  projectAnalysisView,
-  analysisViewResultSchema,
-} from "../../domain/analysisView/analysisView.js";
+import { projectAnalysisView } from "../../domain/analysisView/analysisView.js";
+import { analysisViewResultSchema } from "../../domain/analysisView/analysisViewResult.js";
 import { nativeFunctionMatchingSchema } from "../../domain/native/functionMatching.js";
 import { expect, it } from "vitest";
 import { matchNativeFunctions } from "./NativeFunctionMatchingService.js";

src/application/process/ProcessScenarioPreparation.test.ts

@@ -13,29 +13,40 @@ import { prepareProcessScenarioPlan } from "./ProcessScenarioPreparation.js";
 
 afterEach(() => vi.restoreAllMocks());
 
-it("rejects observation roots that capture admission rejects", async () => {
-  const root = await createTestTempDirectory("rea-process-plan-");
-  const file = join(root, "selected");
-  await writeFile(file, "not a directory");
-  const scenario = processScenarioSchema.parse({
-    executable: process.execPath,
-    working_directory: root,
-    filesystem_observation_paths: [join(file, "child")],
-  });
+/**
+ * Windows refuses capture before root admission runs. The cancellation cases
+ * replace admission, so they plan for a platform that reaches it on any host.
+ */
+const capturePlatform = "linux";
 
-  const prepared = await prepareProcessScenarioPlan(
-    scenario,
-    {},
-    process.platform,
-  );
+// A path below a regular file is ENOTDIR on POSIX. Windows reports ENOENT,
+// which admission accepts as a root the scenario may create.
+it.skipIf(process.platform === "win32")(
+  "rejects observation roots that capture admission rejects",
+  async () => {
+    const root = await createTestTempDirectory("rea-process-plan-");
+    const file = join(root, "selected");
+    await writeFile(file, "not a directory");
+    const scenario = processScenarioSchema.parse({
+      executable: process.execPath,
+      working_directory: root,
+      filesystem_observation_paths: [join(file, "child")],
+    });
 
-  expect(prepared.ok).toBe(false);
-  if (prepared.ok) return;
-  expect(prepared.error).toMatchObject({
-    _tag: "ProcessCaptureError",
-    userMessage: "filesystem observation admission failed",
-  });
-});
+    const prepared = await prepareProcessScenarioPlan(
+      scenario,
+      {},
+      process.platform,
+    );
+
+    expect(prepared.ok).toBe(false);
+    if (prepared.ok) return;
+    expect(prepared.error).toMatchObject({
+      _tag: "ProcessCaptureError",
+      userMessage: "filesystem observation admission failed",
+    });
+  },
+);
 
 it("reports cancellation normalized inside admission as planning cancellation", async () => {
   const scenario = processScenarioSchema.parse({
@@ -59,7 +70,7 @@ it("reports cancellation normalized inside admission as planning cancellation",
   const prepared = await prepareProcessScenarioPlan(
     scenario,
     {},
-    process.platform,
+    capturePlatform,
     controller.signal,
   );
 
@@ -100,7 +111,7 @@ it("reports cancellation after the last awaited admission step", async () => {
   const planning = prepareProcessScenarioPlan(
     scenario,
     {},
-    process.platform,
+    capturePlatform,
     controller.signal,
   );
 

src/application/reverse/ReverseEngineeringCommandPort.ts

@@ -11,6 +11,11 @@ export interface ReverseEngineeringProviderCommand {
   readonly identity: EvidenceProvider;
   /** What the provider cannot attest about the arguments it built. */
   readonly limitations?: readonly string[];
+  /**
+   * Explain a provider refusal of the command that a completed process
+   * reported only in its diagnostics, or return undefined.
+   */
+  readonly rejection?: (stderr: string) => string | undefined;
   readonly environmentOverrides?: Readonly<NodeJS.ProcessEnv>;
 }
 

src/application/reverse/ReverseEngineeringService.ts

@@ -599,7 +599,7 @@ export class ReverseEngineeringService {
     let stderrInvalidUtf8 = false;
     let cleanupIncomplete = false;
     let cleanupOnlyFailure = false;
-    let completionStatus: "complete" | "unknown" = "complete";
+    let completionStatus: "complete" | "rejected" | "unknown" = "complete";
     let outputLimitReached = false;
     let failure: AnalysisError | undefined;
     let cleanupOwner: ProviderProcessSupervisor | undefined;
@@ -1076,6 +1076,15 @@ export class ReverseEngineeringService {
           : digestAfter !== digest;
     const outputBudgetSource =
       parameters.max_output_bytes === undefined ? "default" : "request";
+    // Only a completed process's diagnostics can establish a refusal; partial
+    // or failed captures keep their unknown completion.
+    const rejection =
+      completionStatus === "complete" &&
+      (failure === undefined ||
+        (failure instanceof AnalysisOutputError && failure.cleanupOnly))
+        ? profile.rejection?.(stderr)
+        : undefined;
+    if (rejection !== undefined) completionStatus = "rejected";
     const result = {
       stdout,
       stderr,
@@ -1116,6 +1125,7 @@ export class ReverseEngineeringService {
           ]
         : []),
       ...(profile.limitations ?? []),
+      ...(rejection === undefined ? [] : [rejection]),
       ...(stdoutInvalidUtf8 || stderrInvalidUtf8
         ? [
             `Captured ${[

src/artifacts/RegularFileAdmission.test.ts

@@ -44,7 +44,12 @@ it("returns the original validated metadata snapshot with its actual descriptor"
     });
     return handle;
   });
-  const descriptor = await openRegularFile(path, { symlinks: "reject" });
+  // The test just wrote this file. Settling its fresh Windows ChangeTime would
+  // replace the first observation, so admit it as written on every host.
+  const descriptor = await openRegularFile(path, {
+    symlinks: "reject",
+    changeTime: "as-written",
+  });
   try {
     expect(descriptor.handle).toBe(opened);
     expect(descriptor.initial).toBe(validated);

src/artifacts/StableArtifactFailure.ts

@@ -3,14 +3,43 @@ import type { AnalysisError } from "../domain/analysisErrorBase.js";
 import { analysisErrorWithCleanupFailure } from "../domain/analysisErrorCleanup.js";
 import { ProviderCleanupError } from "../domain/providerCleanupError.js";
 import { ArtifactReaderFailure } from "./ArtifactReader.js";
-import { bindArtifactFileCleanup } from "./ArtifactFileOperation.js";
+import {
+  artifactFileCancellationCause,
+  bindArtifactFileCleanup,
+  type ArtifactFilePrimaryFacts,
+} from "./ArtifactFileOperation.js";
 import { completedStableArtifactObservation } from "./StableArtifactObservation.js";
 import { isSelectedRegularFileError } from "../filesystem/RegularFile.js";
 import {
   AnalysisAccessDeniedError,
+  AnalysisArtifactChangedError,
+  AnalysisCancelledError,
   AnalysisInputError,
 } from "../domain/analysisErrorCore.js";
 
+/** Preserve ownership classification for stable-file identity and cancellation. */
+export const projectOwnedArtifactIdentityFailure = (
+  facts: ArtifactFilePrimaryFacts,
+  operation: string,
+  path: string,
+): AnalysisError | undefined => {
+  const { cause, origin } = facts;
+  if (
+    origin !== "owned-or-classified" ||
+    !(cause instanceof ArtifactReaderFailure)
+  )
+    return undefined;
+  if (cause.reason === "integrity")
+    return new AnalysisArtifactChangedError(operation, path, cause.message, {
+      cause,
+    });
+  if (cause.reason === "cancelled")
+    return new AnalysisCancelledError(operation, {
+      cause: artifactFileCancellationCause(cause),
+    });
+  return undefined;
+};
+
 /** Project filesystem errors that identify a refused or unreadable selected file. */
 export const projectSelectedArtifactFileFailure = (
   cause: unknown,
@@ -57,6 +86,18 @@ export const stableArtifactInputRecovery = (cause: ArtifactReaderFailure) =>
       }
     : {};
 
+/** Report a rejected artifact path or format with its source-provided recovery. */
+export const stableArtifactInputFailure = (
+  cause: ArtifactReaderFailure,
+  operation: string,
+  field = "path",
+): AnalysisInputError =>
+  new AnalysisInputError(
+    operation,
+    { cause, ...stableArtifactInputRecovery(cause) },
+    [{ path: [field], reason: "invalid_format", message: cause.message }],
+  );
+
 const artifactCleanupFailure = (
   cause: unknown,
   providerId: string,

src/artifacts/createArtifactReader.ts

@@ -5,8 +5,6 @@ import {
   type ArtifactReaderConstruction,
 } from "./artifactFormats.js";
 
-export type { ArtifactReaderConstruction } from "./artifactFormats.js";
-
 /** Formats with an artifact entry reader; availability policy belongs to the caller. */
 export type ArtifactReaderFormat = {
   [Id in keyof typeof ARTIFACT_FORMATS]: (typeof ARTIFACT_FORMATS)[Id] extends {

src/browser/history/playwrightTrace/TraceFailure.ts

@@ -11,7 +11,7 @@ import { PLAYWRIGHT_TRACE_OPERATION as operation } from "../../../domain/playwri
 import { ArtifactReaderFailure } from "../../../artifacts/ArtifactReader.js";
 import { artifactFileCancellationCause } from "../../../artifacts/ArtifactFileOperation.js";
 import { isSelectedRegularFileError } from "../../../filesystem/RegularFile.js";
-import { stableArtifactInputRecovery } from "../../../artifacts/StableArtifactFailure.js";
+import { stableArtifactInputFailure } from "../../../artifacts/StableArtifactFailure.js";
 
 /** Classify the archive owner's facts without interpreting opaque cancellation reasons. */
 export const traceFailure = (cause: unknown, path: string): AnalysisError => {
@@ -38,11 +38,7 @@ export const traceFailure = (cause: unknown, path: string): AnalysisError => {
         },
       );
     if (cause.reason === "format" || cause.reason === "path")
-      return new AnalysisInputError(
-        operation,
-        { cause, ...stableArtifactInputRecovery(cause) },
-        [{ path: ["path"], reason: "invalid_format", message: cause.message }],
-      );
+      return stableArtifactInputFailure(cause, operation);
     return new ArtifactOperationError(
       operation,
       cause.reason,

src/cli/analysisEvidenceDelivery.ts

@@ -3,7 +3,7 @@ import {
   analysisEvidenceSources,
   undeliveredSourceClosure,
 } from "../application/AnalysisEvidenceSources.js";
-import type { AnalysisViewRequest } from "../domain/analysisView/analysisView.js";
+import type { AnalysisViewRequest } from "../domain/analysisView/analysisViewRequest.js";
 import { z } from "incur";
 import {
   isImmutableEvidence,

src/cli/androidCommands.ts

@@ -22,7 +22,7 @@ import { parseAnalysisInput } from "../application/AnalysisInput.js";
 import { androidJniSelectionSchema } from "../domain/android/androidJniBindings.js";
 import { androidJniDeliverySchema } from "../domain/android/androidJniQuery.js";
 import { androidInputSchemas } from "../domain/android/androidAnalysis.js";
-import { cliIntegerArgument } from "./options.js";
+import { cliDecimalField } from "./options.js";
 
 /** Expose the same explicit APK requests through one-shot CLI commands. */
 export const registerAndroidCommands = (
@@ -223,11 +223,11 @@ export const registerAndroidCommands = (
         ),
     }),
     options: z.object({
-      overloadIndex: cliIntegerArgument(0)
-        .optional()
-        .describe(
+      overloadIndex: cliDecimalField(
+        androidInputSchemas.inspect_android_method.shape.overload_index.describe(
           "Explicit zero-based index among same-name methods; required when ambiguous",
         ),
+      ),
       mappingPath,
       ...analysisEvidenceDeliveryOptions,
     }),
@@ -255,11 +255,11 @@ export const registerAndroidCommands = (
     options: z.object({
       methodName:
         androidInputSchemas.trace_android_references.shape.method_name,
-      overloadIndex: cliIntegerArgument(0)
-        .optional()
-        .describe(
+      overloadIndex: cliDecimalField(
+        androidInputSchemas.trace_android_references.shape.overload_index.describe(
           "Index among defined methods or observed external prototypes listed by an ambiguous query",
         ),
+      ),
     }),
     run: ({ args, options }) =>
       execute(

src/cli/cutterCommands.ts

@@ -8,7 +8,8 @@ import { logCliCommand } from "../cliLogging.js";
 import { finishAnalysisCommand } from "./finishAnalysisCommand.js";
 import { withCommandCancellation } from "./commandCancellation.js";
 import type { CliInstance } from "./types.js";
-import { cliIntegerArgument } from "./options.js";
+import { cliDecimalField } from "./options.js";
+import { cutterCommandInputSchema } from "../contracts/cutterToolContracts.js";
 
 /** Register commands that control an already-running Cutter instance. */
 export const registerCutterCommands = (
@@ -43,8 +44,10 @@ export const registerCutterCommands = (
         .string()
         .uuid()
         .describe("Session ID copied from list-cutter-sessions."),
-      expectedGeneration: cliIntegerArgument(0).describe(
-        "Session generation returned by list-cutter-sessions.",
+      expectedGeneration: cliDecimalField(
+        cutterCommandInputSchema.shape.expected_generation.describe(
+          "Session generation returned by list-cutter-sessions.",
+        ),
       ),
       command: z
         .string()

src/cli/environmentCommands.ts

@@ -38,7 +38,7 @@ import { inspectWebNetworkCaptureInputSchema } from "../domain/webNetworkCapture
 import { withCommandCancellation } from "./commandCancellation.js";
 import { finishAnalysisCommand } from "./finishAnalysisCommand.js";
 import type { CliInstance } from "./types.js";
-import { cliDecimalField } from "./options.js";
+import { cliDecimalField, publishArgvInput } from "./options.js";
 
 /** Same envelope label as the other JSON-input commands and `parseCliJsonInput`. */
 const cliError = (error: AnalysisError): JsonValue => ({
@@ -689,11 +689,13 @@ export const registerEnvironmentCommands = (
       host: mcpHttpHostSchema
         .optional()
         .describe("Listener address; default MCP_HOST, else 127.0.0.1"),
-      port: mcpHttpPortSchema
-        .optional()
-        .describe(
-          "Listener port; default MCP_PORT, else 0 for an ephemeral port",
-        ),
+      port: publishArgvInput(
+        mcpHttpPortSchema
+          .optional()
+          .describe(
+            "Listener port; default MCP_PORT, else 0 for an ephemeral port",
+          ),
+      ),
     }),
     run: ({ args, options }) =>
       withCommandCancellation((signal) =>

src/cli/javascriptApplicationAnalysis.ts

@@ -1,4 +1,4 @@
-import type { AnalysisViewRequest } from "../domain/analysisView/analysisView.js";
+import type { AnalysisViewRequest } from "../domain/analysisView/analysisViewRequest.js";
 import { publishCliAnalysisEvidence } from "./analysisEvidenceDelivery.js";
 import { JAVASCRIPT_APPLICATION_PROVIDER } from "../domain/investigationProviders.js";
 import { createProgressReporter } from "../application/ProgressReporter.js";

src/cli/options.ts

@@ -24,13 +24,6 @@ type DecimalWrapper =
       readonly kind: "optional" | "exactOptional" | "nullable" | "readonly";
     };
 
-/** Parse decimal integer tokens before Number coercion can erase their syntax. */
-export const cliIntegerArgument = (min: number) =>
-  z
-    .string()
-    .regex(DECIMAL_INTEGER_TOKEN, "Expected a decimal integer")
-    .pipe(z.coerce.number<string>().safe().min(min));
-
 const decimalToken = (domain: z.ZodNumber) =>
   z
     .string()
@@ -42,10 +35,12 @@ const unwrapSchema = (field: { unwrap: () => unknown }): z.ZodType =>
   field.unwrap() as z.ZodType;
 
 /**
- * Incur advertises Zod's output view. Publish the input view so the decimal
- * token guard survives `--schema` and other SDK conversions.
+ * Incur advertises Zod's output view. Publish the input view so an argv token
+ * grammar that transforms text survives `--schema` and other SDK conversions.
  */
-const publishDecimalInput = (field: z.ZodType): z.ZodType => {
+export const publishArgvInput = <Field extends z.ZodType>(
+  field: Field,
+): Field => {
   const { $schema: _dialect, ...inputSchema } = z.toJSONSchema(field, {
     io: "input",
   });
@@ -149,7 +144,7 @@ export const cliDecimalField = <Field extends z.ZodType>(
     numeric.description === undefined
       ? admitted
       : admitted.describe(numeric.description);
-  return publishDecimalInput(described) as z.ZodType<z.output<Field>>;
+  return publishArgvInput(described) as z.ZodType<z.output<Field>>;
 };
 
 /** Adapt each numeric property of a shared shape; other properties stay unchanged. */

src/cli/reverseEngineeringCommands.ts

@@ -80,7 +80,7 @@ const cleanupOnlyCompleteEvidence = (
   return typeof normalized === "object" &&
     normalized !== null &&
     !Array.isArray(normalized) &&
-    normalized.completion_status === "complete"
+    normalized.completion_status !== "unknown"
     ? parsed.data
     : undefined;
 };