docs(skill): explain CLI summary export envelopes

fix(skill): keep the managed anchor in its owning section
fix(skill): preserve native guide bookmarks across renderers
2026-11-08 17:31:51 -10:00 · 2026-11-08 18:29:44 -08:00 · 2026-11-08 17:53:34 -08:00 · 2026-11-08 17:51:29 -08:00 · 2026-11-08 06:35:20 -08:00 · 2026-11-08 05:24:45 -08:00
18 changed files with 1153 additions and 1010 deletions
@@ -2,551 +2,121 @@
 name: reverse-engineer-anything
 description: Reverse engineer native, managed, Electron/JavaScript, packaged, firmware, and browser targets with REA, and build agent environments (AgentEnv bundles) of web applications from a live instance or a capture. Use shipped-artifact or requested runtime evidence to explain features, compare versions, decompile code, or guide a reconstruction. Skip REA for ordinary source-repository architecture analysis.
 metadata:
-  version: "60"
+  version: "62"
 ---

 # REA

-Use REA when a claim depends on a shipped binary or package, decompilation,
-requested runtime evidence, or comparison with
-behavior not established by available source. For ordinary analysis of a
-complete source repository, use normal repository tools and do not run REA
+Use REA when a claim depends on a shipped artifact, decompilation, requested
+runtime evidence, or behavior not established by available source. For ordinary
+analysis of a complete source repository, use normal repository tools and do not run REA
 readiness or provider commands.

+## Select the target and authority
+
+Use the target selected for this task. If the user says only "my app", ask which
+app before searching artifacts. Resolve a named app to one clear installed
+artifact; ask when ambiguous. Unrelated reports and nearby fixtures do not select
+it. Never substitute an example or broaden the selected target or runtime actions.
+
+Distinguish observations, derivations, inferences, and unknowns. Cite Evidence
+IDs and preserve source identity, coverage, limitations and partial facts.
+Static code, strings and declarations do not establish observed execution.
+Within the requested investigation, call available analysis tools directly;
+REA requires no permission grants or per-call approval flags. The client may
+independently require approval; preserve its actual access requirements.
+
 ## Connect only when needed

-Installing this skill supplies instructions; it does not register the REA MCP
-server, install analysis engines, or add tools to an already-running agent.
-The exception is a Claude Code or Codex plugin install: the plugin bundles
-this skill and registers its own `rea` server, outside the state that
-`rea setup` and `rea doctor` manage.
+If REA tools are available and registration is not known stale, proceed directly.
+Use the connected server's actual tool list and schemas: repository-main guidance
+may describe features absent from an older release. Keep complete inline Evidence
+when retained references are not advertised. Skill installation alone adds no
+MCP server or engines; a Claude Code/Codex plugin bundles its own server.

-If REA tools are available and their registration is not known to be stale,
-proceed directly to the target. Do not run diagnostics or setup before every
-investigation. Use the connected server's actual tool list and input schemas;
-a skill installed from repository main may describe capabilities absent from
-an older npm release. Keep complete inline Evidence when that server does not
-advertise retained references.
+For absent tools, blocked calls, unavailable providers, host timeouts or startup
+failures, read [connection and recovery](references/connection-and-recovery.md)
+before repair. Diagnose the observed blocker, continue useful supported work,
+and resume the original task after repair. Do not repeat unchanged failed calls.
+A host timeout without a REA result does not establish cancellation or cleanup.
+Retry a dropped connection once only if safe to repeat or known not started;
+if it may have changed the target, or fails again, ask for a client restart.
+Retry failed connection startup once; do not retry the same unchanged failure.

-If tools are absent, a call is blocked by the client, or a required provider is
-unavailable, read [connection and recovery](references/connection-and-recovery.md).
-Diagnose the observed blocker, continue useful supported work, and resume the
-original task after repair. Client approval, shell PATH, registration and engine
-availability have different remedies; avoid repeating setup for all of them.
-If the host times out without a REA result, do not repeat the unchanged call or
-assume work stopped. Read the recovery guide's deadline distinction before retrying.
-If the MCP connection drops, retry that call once only when it is safe to
-repeat or known not to have started. If it may already have changed the
-target, or it fails again, tell the user and ask them to restart the MCP
-client. If REA could not start its connection, retry once, then tell the user
-and ask them to restart the MCP client. Do not retry a startup failure that
-returns the same unchanged result. For plugin installs, follow
-[plugin recovery](references/connection-and-recovery.md#rea-installed-as-a-client-plugin).
-For setup-owned registrations, run `rea doctor` when REA could not start
-or tools stay missing after that restart. For `cleanup_incomplete`, a retryable
-capacity limit, or `configuration_invalid`, follow the recovery guide's ladder
-before asking for a restart. Read that guide before a second repair attempt.
-
-Choose the installation owner before repairing registration. Plugin installs use
-[plugin recovery](references/connection-and-recovery.md#rea-installed-as-a-client-plugin);
-only setup-owned registrations use the guide's
-[registration repair plan](references/connection-and-recovery.md#repair-registration-when-needed).
+Choose the registration owner: plugin recovery differs from setup-owned repair.
 A plugin-only doctor result of `missing` does not call for `rea setup`.
+Setup-owned repair starts with a read-only plan showing paths, backups and skill
+replacement before authorized writes. Do not install unrelated software to repair
+registration. REA setup never installs/upgrades Node, npm, Homebrew, Java,
+Ghidra, IDA, JADX, Kuna, Binwalk or Unblob.
+For an unsupported client, use manual stdio with an existing absolute runtime
+and entry script, or the CLI fallback in the recovery guide.

-REA setup never installs or upgrades Node.js, npm, Homebrew, Java, Ghidra, IDA,
-JADX, Kuna, Binwalk, or Unblob. Use existing prerequisites; do not install unrelated
-software to repair MCP registration. For an unsupported client, use manual stdio
-registration with an existing installation’s absolute runtime and entry script, or continue through the CLI.
+## Route before analysis

-A concrete CLI fallback for an operator-supplied JavaScript tree or ASAR is:
+Read the matching guide before its workflow; read only the relevant sections.
+Target-free tools take their explicit paths/endpoints without `open_binary`.
+Active-target native/archive tools require it. Archive members and executable
+code are different questions; follow the selected artifact's application layer.

-```bash
-npx -y rea-agents@latest analyze-javascript-application /absolute/path/to/app --json
-```
+| Supplied target or question                                                                                                      | Guide and first operation                                                                                                                                                                                                                          |
+| -------------------------------------------------------------------------------------------------------------------------------- | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
+| Native executable/library, Ghidra/IDA/Kuna, managed PE/CLI or NativeAOT                                                          | [Native and managed](references/native-and-artifacts.md): `open_binary`; managed CLI metadata: `inspect_managed_artifact`. Read provider/lifecycle sections before reuse or edits.                                                                 |
+| Headerless/raw firmware, Cortex-M, ESP app/bootloader or whole-flash dump, HEX/S-record/UF2/DfuSe                                | [Firmware and raw images](references/firmware-and-raw-images.md): check loader support first; raw: explicit `open_binary` format/mapping; ESP/container: `open_binary` then `inspect_artifact`; region scan/extraction: advertised firmware tools. |
+| Archive/package inventory or extraction, PyInstaller, Bun executable, Godot PCK, UnityFS or wxapkg                               | [Packages and archives](references/packages-and-archives.md): `open_binary`, then `inspect_artifact`; read extraction/mount limits before materializing.                                                                                           |
+| ASAR/extracted JavaScript or Electron tree, feature trace or version comparison                                                  | [JavaScript applications](references/javascript-applications.md): `analyze_javascript_application`.                                                                                                                                                |
+| APK code, manifest, classes, methods or incoming references                                                                      | [Android applications](references/android-applications.md): `inspect_android_package`; signing/inventory use their separate routes.                                                                                                                |
+| PE/ELF/Mach-O tables or hardening, Go/Rust/IL2CPP/GPU/model metadata, pyc/BEAM, SQLite, WASM, EVM, APK signing or recorded crash | [Offline format inspectors](references/format-inspectors.md): select the named target-free inspector in that format's section.                                                                                                                     |
+| Apple plist, Interface Builder, asset catalog or keyed archive resources; unknown desktop installation directory                 | [Resource and directory inspection](references/native-and-artifacts.md#apple-app-resources): `open_bundle_resources` or `inspect_desktop_application`; no executable/provider required for resource sessions.                                      |
+| Native execution, live calls, instrumentation, process effects; browser/Electron runtime or agent-performed actions              | [Runtime observation](references/runtime-observation.md): select the observation and declared lifecycle first. Already-open page: `list_browser_targets`; Electron: `list_electron_targets`; agent actions: `capture_browser_scenario`.            |
+| Recorded HAR/SAZ/mitmproxy/qlog, packet capture, protocol-field discovery or logic/signal recording                              | [Recorded captures](references/recorded-captures.md): `inspect_web_network_capture`, packet/signal inspection or decoder discovery as appropriate; no live acquisition or recorded-URL fetch.                                                      |
+| Web AgentEnv bundle from a live instance or capture; task for an exported desktop environment                                    | [Environments](references/environments.md), including its desktop-task section: read before recording/export; `capture_browser_scenario` then `export_environment_bundle` for a live web bundle.                                                   |
+| Retained Evidence paging/composition, comparisons, unknowns or a broader investigation                                           | [Evidence workflows](references/evidence-workflows.md): use existing source IDs and the smallest view that answers the question.                                                                                                                   |

-No MCP registration or native engine is required. Read the returned Evidence,
-graph, limitations, and unknowns with the same care as an MCP result; the CLI
-returns the Evidence record directly. This fallback does not establish that
-MCP is configured. Native CLI tasks still require their selected engine.
-Prefer an existing `rea` CLI. When none is installed and REA package acquisition
-is within the authorized scope, use `npx -y rea-agents@latest` in its place from a
-trusted directory outside the target project, with absolute target paths. Managed
-setup binds the current installation directly; retain its runtime and package
-cache entry, or restore that installation before repairing its registration.
-For setup-owned registration, configuration repair starts with a read-only setup plan; show paths, backups and
-skill replacement before applying authorized changes. Preserve existing approval
-and target-execution boundaries.
-
-## Route the target first
-
-Choose the first tool from the target the user supplied. Use `open_binary` for
-active-target native or archive workflows; target-free tools take their own
-explicit path or endpoint and do not need it.
-
- ASAR or extracted JavaScript/Electron tree:
-  `analyze_javascript_application`.
- Archive/package member inventory (ZIP/APK/IPA/MSIX/AppX, DMG, or a PyInstaller
-  executable): `open_binary` with the supplied local path; use `inspect_artifact`
-  when its graph and findings help answer the question. A PyInstaller CArchive
-  is the application layer; the bootloader is only the native prefix. Start with
-  `detail: "summary"` for large inventories, then use retained inventory views
-  for selected member fields/pages. A complete small inventory can cost less
-  than extra calls and schemas. Runtime options are metadata, not files.
-  Compact delivery still inventories and hashes members. See the
-  [Python packaged applications guide](https://github.com/morluto/rea/blob/main/docs/python-packaged-applications.md).
- Bun `--compile` executable: `open_binary`, then `inspect_artifact`; the Bun
-  module graph is the application layer. Extract stored modules and analyze the
-  JavaScript. See [Bun standalone executables](https://github.com/morluto/rea/blob/main/docs/bun-standalone.md).
- Apple app plist, Interface Builder, asset catalog, or keyed archive resources:
-  `open_bundle_resources`, then the selected resource tool. This does not
-  require `CFBundleExecutable` or a deep provider. Resource sessions have no
-  executable digest or binary snapshot; use `open_binary` for native code.
- Android APK code, classes, methods, or incoming references:
-  `inspect_android_package`, then focused Android tools when advertised.
-  Archive member inventory still uses the archive route above.
- Managed PE/CLI assembly: `inspect_managed_artifact`.
- Firmware image: `inspect_firmware_regions` when advertised. Use
-  `extract_firmware` when extraction is requested, with a caller-selected new
-  absolute output directory. These tools use caller-supplied Binwalk/Unblob on
-  Linux; see the [firmware guide](https://github.com/morluto/rea/blob/main/docs/guides/firmware/firmware-analysis.md).
- ESP32-family app or bootloader image (`0xE9` magic): `inspect_artifact`
-  without a provider; see the ESP section of `references/native-and-artifacts.md`.
- .NET NativeAOT PE/ELF: native Ghidra analysis. Native code can yield pseudocode;
-  consult the NativeAOT workflow in `references/native-and-artifacts.md` for
-  optional metadata recovery and its supported host/layout boundary.
- Native program behavior, live calls, instrumentation, or command-run effects:
-  choose the matching [native runtime workflow](references/runtime-observation.md#native-runtime-questions).
-  `open_binary` and `trace_native_values` establish static facts; they do not
-  observe execution. Runtime tools have distinct launch, attach, mutation and
-  cleanup effects, and do not require a preliminary static session unless their
-  own contract says so.
- User-owned browser page already open: `list_browser_targets`.
- Passive traffic capture of a SPA: the default scope is the page's own origin,
-  and data APIs usually live on another origin. Discover API origins from
-  absolute URLs in loaded bundles or script text via JavaScript analysis tools
-  (another passive capture without those origins still scopes to the page
-  origin, and `completeness.excluded` counts lack URLs). Pass both the page
-  origin and those API origins in `allowed_origins` — the list replaces the
-  default scope — and read `completeness.excluded` before reporting that an
-  API is absent. For long captures with body shapes, use
-  `export_evidence_bundle` instead of expecting an inline result.
- Browser action the agent must perform (click, type, navigate):
-  `capture_browser_scenario` with declared actions. See
-  [runtime observation](references/runtime-observation.md) for connect/launch
-  and the focused follow-up browser tools.
- Agent environment (AgentEnv bundle) of a web application: read
-  [environments](references/environments.md) before recording; it records with
-  `capture_browser_scenario` and writes the bundle with `export_environment_bundle`.
- Task for a desktop application's exported environment, from a
-  `capture-desktop-application` folder: read
-  [desktop application tasks](references/environments.md#tasks-for-a-desktop-application-environment).
- Fiddler Everywhere traffic or a native `.saz` capture: read the
-  [Fiddler workflow](references/runtime-observation.md#fiddler-everywhere-traffic-debugging).
-  Inspect saved SAZ with `inspect_web_network_capture` and `format: "saz"`;
-  connect Everywhere's separate MCP server for live traffic.
- Retained HAR/SAZ/native mitmproxy/aioquic qlog capture: `inspect_web_network_capture`. Select
-  original record ordinals when useful; inspect producer fields and byte/number
-  sidecars without fetching recorded URLs or claiming live attribution. HAR/SAZ/qlog
-  old-generation heap is `REA_CAPTURE_DECODER_OLD_GENERATION_MIB` (default 192 MiB,
-  floor 8, maximum 16384), set where REA starts. Host memory and `NODE_OPTIONS` do not
-  raise it. See
-  [historical captures](https://github.com/morluto/rea/blob/main/docs/guides/web/web-network-captures.md) for the exact upstream
-  profile and credential exclusions. Qlog support starts with aioquic 1.5.0
-  JSON 0.3; stream coverage and endpoint loss declarations do not recover bodies
-  or establish network loss. Prefer detail summary, then kind qlog trace/stream
-  pages; select one trace, stream ID and direction for contribution/range pages.
-  Facts retain all-recorded-events-before-selection scope. Other qlog layouts
-  and PCAP correlation are unsupported.
- User-owned Electron runtime already open: `list_electron_targets`. Before an electron-main Inspector attempt, check packaged fuses with `inspect_electron_fuses`; disabled `EnableNodeCliInspectArguments` means the app ignores `--inspect`.
- Packet-field discovery: `inspect_packet_fields` searches installed protocols
-  and field names/types before choosing fields for `inspect_packet_capture`.
-  Query/page the relevant records; registrations do not establish observed traffic.
- Recorded packet captures: `inspect_packet_capture` with selected TShark fields,
-  display filters and decode-as rules. Requires Linux, util-linux prlimit and
-  TShark 4.x on an absolute `PATH` entry or via the optional absolute
-  `REA_TSHARK_COMMAND` override; see
-  [capture guide](https://github.com/morluto/rea/blob/main/docs/guides/data/packet-captures.md).
-  Packet limits count input packets before filtering. Output defaults to 50 matching
-  frames; use `match_offset` / `match_limit` for later pages, or explicit null
-  limit for complete matching output. Preserve the source digest across pages.
-  This does not perform live capture.
-  For address/DNS/SNI/protocol summaries use `inspect_pcap_capture` with MCP
-  detail summary, then retained kind pcap pages. Requires Wireshark 4.x tshark
-  and capinfos, with Linux prlimit or Windows Job Objects; see
-  [packet summaries](https://github.com/morluto/rea/blob/main/docs/guides/data/pcap-analysis.md).
-  Select an exact DNS question for address pages; page exhaustion does not prove
-  network completeness. This reads recordings and does not acquire traffic.
- Decoder discovery: `inspect_signal_decoders` searches installed decoder IDs
-  or selected decoder help, including channels and options. Query and page the
-  relevant details before choosing settings; this does not scan hardware.
- Recorded logic/signal traces: `decode_signal_recording` with explicit decoder,
-  channel and protocol settings. On Linux with util-linux prlimit, supply sigrok-cli 0.7.2 through
-  `REA_SIGROK_COMMAND`; see [recording guide](https://github.com/morluto/rea/blob/main/docs/guides/signals/signal-recordings.md).
-  Output defaults to 50 literal lines; select annotation classes and page with
-  `line_offset` / `line_limit`, or explicit null for all remaining output.
-  Window counts are display lines, not annotations or samples. Preserve source digests across pages.
-  This reads existing files; it does not acquire hardware signals.
- Explicit local WebAssembly artifact: `inspect_wasm_artifact`. Supply WABT 1.0.42
-  through `REA_WABT_BIN_DIRECTORY`; retain exact byte/tool identity and decoded WAT.
-  Select JavaScript glue and candidate paths explicitly and preserve URL/path
-  ambiguity. No implicit fetch or target execution; WAT is not original source.
-  See the [WASM guide](https://github.com/morluto/rea/blob/main/docs/guides/wasm/wasm-artifacts.md).
- Explicit local Android APK (or ZIP/AAB) signing: `inspect_apk_signature`.
-  Prefer its summary or selected signer/digest/lineage page; retain complete
-  Evidence and use `inspect_analysis_view` kind `apk-signature` for follow-ups.
-  Reports which schemes are present (v1 JAR, v2, v3, v3.1), each signer's
-  certificate SHA-256 fingerprint (v1 included, from its PKCS#7 block), v3 key-rotation lineage, source stamp, and
-  whether each signed digest still matches the bytes (self-consistency). This
-  is identity and integrity, not a trust or authenticity verdict.
-  See the [APK signature guide](https://github.com/morluto/rea/blob/main/docs/apk-signature.md).
- Explicit local EVM bytecode carrier: `inspect_evm_interface` with caller-selected
-  `raw` or `hex` encoding. The owned worker deadline is `timeout_ms` (default
-  30000 ms, range 1..2147483647, next call). It does not raise the fixed byte,
-  address-space, or CPU allowances. Preserve carrier/decoded digests and treat selectors,
-  argument strings and mutability as inferred candidates; this performs no chain
-  lookup or target execution. For the complete inferred interface without hex or
-  duplicate stdout, discover support and select `detail: "summary"`; complete
-  Evidence stays retained under its original identity. Use the returned
-  `parent_evidence_id` for exact function or `bytecode_hex`/stdout/stderr pages.
-  Candidate coverage does not establish interface completeness. See the
-  [EVM bytecode guide](https://github.com/morluto/rea/blob/main/docs/guides/evm/evm-bytecode.md).
- Embedded Go compiler, module or build-setting metadata: `inspect_go_binary`
-  with the explicit local file. This built-in target-free inspection requires no
-  Go installation or disassembler. Preserve raw module bytes and source ranges;
-  absent metadata does not prove a binary is not Go, and unparsed text records
-  remain explicit. See the
-  [Go binary guide](https://github.com/morluto/rea/blob/main/docs/guides/native/go-binaries.md).
- Embedded CUDA/HIP code objects: `inspect_gpu_code_objects`; inventory targets
-  first, then decode selected payloads and query retained GPU Evidence.
- Bundled GGUF or safetensors model declarations: `inspect_model_artifact`
-  with the explicit local file. Default header hashing leaves full-file identity
-  unknown; `hash: "full"` additionally reads all weights for SHA-256. MCP returns
-  retained summaries; optional `view` selects one page in the initial call. Use
-  `inspect_analysis_view` kind `model-artifact` for
-  batched metadata keys, tensor names or type totals, selected fields and pages.
-  Preserve header-scoped indices and array preview omissions; do not infer model
-  behavior from declared architecture or tensor types. See the
-  [model file guide](https://github.com/morluto/rea/blob/main/docs/model-artifacts.md).
- Unity IL2CPP names, member owners and string literals from `global-metadata.dat`:
-  `inspect_il2cpp_metadata` with the explicit local file; MCP defaults to compact
-  counts. Query sections, images, types, methods, fields, properties, events,
-  parameters or string_literals through `inspect_analysis_view`
-  with the returned `parent_evidence_id`, using exact filters, batch indices and
-  selected fields. Parameters accept `method_indices`, avoiding a scan of all
-  parameter pages. Missing collections in historical Evidence remain unknown.
-  Versions 24, 27, 29, 31 and 39; no Unity, IL2CPP
-  binary or disassembler is run. Unrecognized magic (possibly encrypted) and
-  other versions are unsupported. Optional matching `binary_path` enables static native addresses and type references; query `method_addresses` with indices or addresses/states, preserving every shared-body method and both artifact identities. Without a linked binary native counts remain unknown. Byte-pattern fallback is inferred; no runtime behavior or same-build pairing is proved. See the
-  [IL2CPP metadata guide](https://github.com/morluto/rea/blob/main/docs/il2cpp-metadata.md).
- Embedded cargo-auditable Rust dependency metadata: `inspect_rust_binary`
-  with the explicit local ELF, PE, or thin Mach-O file. This built-in
-  target-free inspection requires no Rust installation or disassembler. Preserve
-  package order, dependency indices, and the section file range. A missing
-  `.dep-v0` section is null metadata, not proof the binary has no dependencies.
-  A rustc commit hash is an inference from a read-only `/rustc/<40-hex>/` path.
-  For selected crates, use `view: {collection: "packages", names: [...],
-  fields: ["name", "version", "source"]}` on the first call; explicitly include
-  `dependencies` for direct index references. Use `detail: "summary"` for counts
-  and ranges, or retained `inspect_analysis_view` Rust package/edge pages for
-  subsequent filters. Keep the complete parent Evidence accessible; CLI compact
-  delivery requires `--evidence_output`.
-  See the
-  [Rust binary guide](https://github.com/morluto/rea/blob/main/docs/rust-binaries.md).
- PE Authenticode certificate table: `inspect_pe_certificates` with the explicit
-  local PE32/PE32+ file. This built-in target-free inspection requires no
-  Windows SDK. Preserve WIN_CERTIFICATE ranges, types, payload SHA-256, and
-  PKCS#7 signer/X.509 identity fields, including `subject_key_identifier_hex`
-  when the signer uses that form. A missing security directory is observed
-  absence of that table, not proof the image is unsigned in every catalog sense.
-  Signatures are not verified. See the
-  [PE certificate guide](https://github.com/morluto/rea/blob/main/docs/pe-certificates.md).
- PE import and delay-load tables: `inspect_pe_imports` with the explicit
-  local PE32/PE32+ file. This built-in target-free inspection requires no
-  Windows SDK. Preserve DLL names, named and ordinal functions, ILT/IAT RVAs,
-  delay-load descriptors, and the pefile import hash of the standard import
-  table. A missing import directory is observed absence of that table, not
-  proof the image never imported APIs through another table. Bound snapshots
-  and loaded IAT contents remain unobserved. See the
-  [PE import guide](https://github.com/morluto/rea/blob/main/docs/pe-imports.md).
- PE TLS callbacks and load configuration: `inspect_pe_load_config` with the
-  explicit local PE32/PE32+ file. This built-in target-free inspection requires
-  no Windows SDK. Preserve callback VAs as strings with their RVA, file offset
-  and section, and the size-covered security cookie, SafeSEH, CFG,
-  EH-continuation and XFG fields. Guard-flag mitigation claims are inferred
-  linker declarations, not proof of enforcement. A missing directory is observed
-  absence of that declaration. See the
-  [PE load configuration guide](https://github.com/morluto/rea/blob/main/docs/pe-load-config.md).
- ELF, PE, and Mach-O hardening: `inspect_binary_hardening` with the explicit
-  local file. This built-in target-free inspection requires no pwntools or other
-  host tool. One image per Mach-O slice. Each property is `enabled`, `disabled`,
-  `partial`, `unknown`, or `not_applicable`, with the header field or import
-  behind it. A missing stack-protector or fortify import is `unknown`, not
-  proof the protection was omitted. Authenticode and Mach-O code signatures
-  report presence, not validity. Hardened runtime stays unknown and names
-  `inspect_signature`. The image is not executed. See the
-  [binary hardening guide](https://github.com/morluto/rea/blob/main/docs/binary-hardening.md).
- ELF note tables: `inspect_elf_notes` with the explicit local ELF32/ELF64
-  file. This built-in target-free inspection requires no disassembler. Preserve
-  PT_NOTE and SHT_NOTE ranges, owners, types, descriptor SHA-256, and GNU
-  build-id or ABI-tag fields. A missing table is observed absence of those
-  declarations, not proof the image never carried notes. See the
-  [ELF notes guide](https://github.com/morluto/rea/blob/main/docs/elf-notes.md).
- Apple `.ips` crash reports: `inspect_apple_ips` with the explicit local
-  file. This built-in target-free inspection requires no Xcode, atos, or
-  pwntools. Preserve first-line metadata, `bug_type` as a string, process and
-  exception facts, lossless integer registers, usedImages UUIDs, and
-  documented classification matches. Only `bug_type` `"309"` yields a crash
-  body; other types, including `"288"` stackshots, return no crash result.
-  Opened Mach-O and dSYM UUID joins remain unobserved. See the
-  [Apple IPS guide](https://github.com/morluto/rea/blob/main/docs/apple-ips.md).
- Linux kernel module metadata: `inspect_kernel_module` with the explicit local
-  ELF32/ELF64 relocatable file. This built-in target-free inspection requires
-  no Linux host or `modinfo`. Preserve `.modinfo` key order and duplicate keys,
-  `__versions` CRC hex, section file ranges, and the appended signature
-  trailer's PKCS#7 SHA-256. A missing section is observed absence when section
-  names are known, not proof the module never carried that metadata.
-  `struct module` is not decoded. The signature is not validated. gzip, xz, and
-  zstd containers are unsupported; decompress into a separate file with an
-  external codec utility, then inspect the decompressed `ET_REL` image. See the
-  [kernel module guide](https://github.com/morluto/rea/blob/main/docs/kernel-modules.md).
- CPython 3.7–3.13 `.pyc` header, nested marshal code objects and bytecode
-  identity: `inspect_python_pyc` with the explicit local file. This built-in
-  target-free inspection requires no Python installation. Preserve magic,
-  PEP 552 hash or mtime/size, nested names, and bytecode SHA-256. Bytecode is
-  not decompiled, and a decoded header does not prove the matching `.py` is
-  present. See the
-  [CPython pyc guide](https://github.com/morluto/rea/blob/main/docs/python-pyc.md).
- Erlang BEAM IFF container: `inspect_erlang_beam` with the explicit local
-  `.beam` file. This built-in target-free inspection requires no Erlang
-  installation. Preserve chunk names, atom order, export/import/lambda tables,
-  and the Code header. For selected facts, prefer `detail: "summary"` plus a
-  `beam` view (collection, names/indices, fields and paging), retaining the full
-  Evidence. CLI summary requires `--evidence_output`. Missing table counts stay
-  null; decoded empty tables count zero. Bytecode is not executed. See the
-  [Erlang BEAM guide](https://github.com/morluto/rea/blob/main/docs/erlang-beam.md).
-
- Explicit local SQLite database snapshot: `inspect_sqlite_database`. Inspect
-  with Node.js 24.x >=24.15 or 26+ providing native SQLite limits. Read schema
-  first (compact inventory by default), or select an exact ordinary table
-  and `columns` when rows are needed. Defaults are selected-table schema and
-  20 rows; request `schema_scope: "database"` for the complete stored schema. Preserve both database and existing sibling WAL identity; row samples
-  report truncation and have unspecified order. Use a quiescent snapshot rather
-  than assuming a live database/WAL pair was copied atomically. See the
-  [SQLite guide](https://github.com/morluto/rea/blob/main/docs/guides/data/sqlite-databases.md).
- Explicit Linux ELF file for offline layout, symbols, relocations or static
-  mitigation evidence: `inspect_binary_layout`. This target-free operation uses
-  caller-supplied pwntools without opening a disassembler database. Preserve its
-  raw locations and inference/coverage limits; see the
-  [offline binary guide](https://github.com/morluto/rea/blob/main/docs/guides/native/binary-diagnostics.md).
- Supplied Linux x86-64 ELF core: `inspect_recorded_crash`. Read every recorded
-  thread, raw note and source-bound register without opening a live target.
-  Historical PIDs do not select live processes. Request `include_debugger_context`
-  only when core-only mapping candidates help; see the
-  [recorded crash guide](https://github.com/morluto/rea/blob/main/docs/guides/native/recorded-crashes.md).
- PE resource type/name/language trees and static icon group references:
-  `inspect_pe_resources` with an explicit path. This portable operation requires
-  no active target or engine; opaque payloads retain file ranges and SHA-256.
- PE export directories and ELF dynamic-symbol exports: `inspect_native_exports`
-  with an explicit path; portable, no active target or engine.
- Native executable, library, or analysis database: `open_binary`, then
-  use focused analysis tools directly; call `binary_overview` when metadata or
-  inventory context is useful and available from the selected provider.
-
-For an existing IDA MCP configuration, use `open_binary` with the original
-input binary and `provider_id: "ida"`; do not pass an `.idb` or `.i64` database.
-The legacy attached profile binds the already-open GUI input by SHA-256 and
-leaves its database open. The modern headless profile creates and closes an
-owned private database without saving. Installation and registration reuse
-[mrexodia/ida-pro-mcp](https://github.com/mrexodia/ida-pro-mcp); see the
-[IDA provider guide](https://github.com/morluto/rea/blob/main/docs/providers/ida-provider.md).
-For migration to the separate native IDA MCP plugin, follow the guide's
-[legacy attached migration](https://github.com/morluto/rea/blob/main/docs/providers/ida-provider.md#migrate-a-legacy-attached-registration).
-Replace the upstream registration explicitly; modern mrexodia tools are not the
-native profile. Native attachment preserves the database but does not provide
-direct callers; check session availability and the guide's verification limits.
-Proceed directly to `analyze_function`, pseudocode, or function/string searches
-after opening; IDA does not supply `binary_overview`. Consult session availability
-when composing broader workflows. Modern direct callers and unsupported dossier
-facets remain unknown; live IDA results are not replayed from snapshots.
-
-With `REA_KUNA_COMMAND` configured, `provider_id: "kuna"` answers procedure
-lists, lookups, pseudocode, assembly and `analyze_function` from Kuna's cached
-whole-program export. Callers/callees use a separate body-free graph shared by
-the session; `xrefs` returns exact-address incoming sites and filters forwarding
-aliases. These queries and inventory lookups do not trigger a C export. Indirect
-targets remain unknown and can make relationship coverage partial. Reference
-caches expire on close; a fresh CLI process repeats the native reference walk.
-Typed references, CFG, raw-memory tools and annotations remain unsupported. A cold first
-answer can come from a single-function run (its limitations say so); assembly
-waits for the export. For pseudocode and assembly, `raw_result.source` names the
-cached `.c`/`.asm` file and byte span, which you may search directly instead of
-calling per function. See the
-[Kuna provider guide](https://github.com/morluto/rea/blob/main/docs/kuna-provider.md).
-
-If the user says only "my app" without a name, path, or target already selected
-for this task, ask which app before searching for artifacts. Paths in unrelated
-saved reports and nearby test fixtures do not select the user's target. Resolve
-an actual human-readable app name to one clear installed artifact when possible;
-ask when matches are ambiguous. Never choose an example app on the user's behalf.
-
-In a target-free session, use `open_binary` to bind any archive/package or
-native target whose analysis tool operates on the active target. Do not call an
-unadvertised tool; inspect `binary_session` with `{}` and its
-`result.tool_availability` for availability reasons and remediation. Expand each
-group's `names` into entries, inheriting the inventory-level client requirements
-unless the group overrides them. The grouped name union is the complete tool
-inventory; use `tools/list` for canonical tool schemas. The default summary keeps
-each provider candidate's availability and target-support status, code and
-reason; `omitted_fields` lists what it leaves out. Request `{"detail": "complete"}`
-only when you need an unavailable candidate's remediation, provider
-diagnostics, candidate capability sets, or tool surface, effect and annotation
-flags; in those closed flag vocabularies, listed
-flags are true and omitted known flags are false. Provider candidate facts
-describe possible providers, while top-level session capabilities describe the
-current route and `analysis_provider_binding` names the selected provider. Do
-not treat those scopes as interchangeable.
-
-For editable Ghidra analysis that must survive a later agent process, select
-the [owned Program checkpoint workflow](references/native-and-artifacts.md#continue-editable-ghidra-analysis-across-processes)
-before making metadata edits. It is separate from Evidence/Unknown persistence.
-
-For a Ghidra startup timeout on a large native target, follow
-[deadline recovery](references/native-and-artifacts.md#ghidra-startup-deadline-recovery)
-before abandoning deep analysis or repeating the same cold import. The default
-330 seconds can be changed for new startup attempts through
-`update_analysis_settings` using `ghidra.startup_timeout_ms`. Changing the
-server's launch environment instead requires a new REA process.
+If a needed tool is unadvertised, inspect `binary_session {}` and
+`result.tool_availability` for availability reasons/remediation; never call an
+unadvertised tool. Expand group `names`, inheriting inventory client requirements
+unless overridden. Their union is the complete in-scope inventory; `tools/list`
+owns canonical schemas. The default summary keeps provider candidate status,
+code and reason; `omitted_fields` names exclusions. Request `detail: "complete"`
+only for remediation/diagnostics, candidate capabilities or tool effect flags.
+Candidate facts describe possible providers; top-level capabilities and
+`analysis_provider_binding` describe the current route. Keep those scopes distinct.

 ## Work summary-first

-Start with the default result and use its inline Evidence and graph context.
-For a JavaScript application or ELF layout whose size is unknown or large,
-call `analyze_javascript_application` or `inspect_binary_layout` with
-`"detail": "summary"`, then inspect the retained `parent_evidence_id` with
-`inspect_analysis_view`. Over MCP, `analyze_function` is summary-first without
-a flag: its default reply is the summary, and the complete dossier stays
-retained under `parent_evidence_id` for facet paging. Pass that ID as a
-`retained-evidence` reference to `compare_functions`, or inside
-`match_native_functions` `left_observations`/`right_observations` or
-`build_call_path.functions`; request `"detail": "complete"` only when the
-dossier must travel inline.
-Use the same exact-reference form in other advertised logical Evidence inputs,
-including optional sources, arrays and nested sources across domains. Each
-source can independently be inline or retained; preserve its source identity,
-coverage, partial facts and unknowns. A summary or inspection page has its own
-Evidence ID: use `normalized_result.parent_evidence_id` when the consumer needs
-the complete source. For portable CLI follow-ups, commands advertising
-`--evidence-bundle` resolve references from that selected exported bundle.
-See [Evidence composition](references/evidence-workflows.md) for scope and
-recovery; file selectors are supported only where explicitly advertised.
-Page module identities and select the returned `node_id` before requesting an
-item; a single file path can represent several graph roles. Do not repeat an
-identical analysis or rejected call without a changed input or resolved blocker.
-Recheck session state when a lifecycle change makes that status useful.
-Make a focused follow-up only when the
-returned result leaves a specific question unanswered.
+Start with inline Evidence and graph context. For unknown/large JavaScript or ELF
+layout, select advertised `detail: "summary"`; MCP `analyze_function` already
+defaults to a summary. Small complete results can cost less than extra pages.
+Make a focused follow-up only for a specific unanswered question. Reuse matching
+session state and Evidence instead of repeating analysis; recheck state when a
+lifecycle change makes it useful.

-If MCP reports `resource_constraint` with `details.resource: "transport"`, call
-`inspect_analysis_view` with its reported same-session Evidence reference for a
-summary, one section/module, or a stable page. Use `trace_application_feature`
-once a seed is known, or call `export_evidence_bundle` to write the complete
-session to a selected path. The analysis remains complete in the ledger; avoid
-repeating it merely to request the same oversized response. Complete CLI JSON
-output also streams without a single MCP frame.
+Complete source Evidence stays accessible through advertised retained references.
+A summary/page has its own Evidence ID; use `normalized_result.parent_evidence_id`
+when a consumer needs the complete source. Pass `{kind: "retained-evidence",
+evidence_id}` in inputs advertising that form; do not resend complete records.
+Sources may independently be inline or retained. Read the Evidence guide for
+exact filters, bundle-based CLI reuse, comparison roles and missing-source recovery.

-When the retained parent ID is unknown, use `get_evidence_bundle` with
-`detail: "summary"` and exact filters for operation, target SHA-256,
-analysis-profile digest or canonical procedure address. Select its returned
-Evidence ID for the next view instead of requesting the complete bundle. When
-that record has no supported view (for example an annotation), read it with
-`detail: "records"` and an `evidence_id` filter; `missing_evidence_links`
-names linked sources this session does not retain.
-`retention: "complete-record"` means the whole record is stored; native
-value-flow truncation and unknown metadata remain separate. For an exported
-portable bundle, use `rea inspect-evidence-bundle` with JSON containing `path`,
-`detail: "summary"` and the same `filters`. Reading that file still requires
-validating its full contents within the local memory budget.
+For REA transport refusal or client-truncated output, inspect a smaller retained
+view or export complete Evidence. Do not parse a preview as canonical JSON or
+repeat the producer. Never invent an Evidence ID; if unknown, find it with
+`get_evidence_bundle` summary filters. Retention is bounded and session-local;
+it does not establish automatic persistence or complete source coverage.

-A client can also truncate a successful tool result without a REA transport
-error. Treat that preview as incomplete; use the retained parent ID for smaller
-views or export when the full record is needed. Do not parse the preview as
-canonical JSON or repeat the producer. For JavaScript, read the
-[module-view and trace recipes](references/javascript-applications.md) before
-drilling into a large graph; a broad bidirectional trace can expand unrelated
-containment relationships even after summary analysis.
-
-Every conclusion must distinguish observations, inferences, and unknowns. Cite
-Evidence IDs, preserve limitations and incomplete coverage, and never imply
-that static analysis observed execution. Runtime requests execute the declared
-target and lifecycle; do not broaden the target or action beyond those fields.
-
-Within the user's requested investigation, call available analysis tools
-directly. REA does not require permission grants or per-call approval flags.
-The agent client can independently require approval. Follow the declared request
-scope and the host's actual access requirements; use the recovery guide for an
-observed client-policy rejection.
-
-## Plan broader investigations
-
-For requests that span multiple features or subsystems, use a staged workflow:
-
-1. Turn the request into a checklist of questions and the evidence each answer
-   needs. Resolve target identity and constraints from the conversation and
-   workspace before asking for information again.
-2. Inspect the current REA session, artifact identity, saved analysis database,
-   bookmarks, and prior evidence. Reuse matching state; do not open duplicate
-   sessions or repeat identical analysis.
-3. Start with the smallest useful overview or inventory. Follow each question
-   from its entry point through relevant data and state changes to its result.
-   Batch related operations around a specific hypothesis, then expand only when
-   the returned evidence leaves a concrete gap.
-4. Inspect relevant packaged resources and configuration alongside code when
-   they affect the question. Use format-aware inventory and parsers; do not
-   infer behavior from filenames, strings, or layout alone.
-5. Corroborate a conclusion with the evidence type it requires. Use runtime
-   observation only when static evidence cannot answer the question and the
-   required host runtime and OS access are available. For JavaScript behavior,
-   run probes against the actual app through the available browser, Electron,
-   or process capture workflow.
-6. Decompose work into independent questions. When parallel workers are
-   available and the questions do not depend on one another, assign distinct
-   scopes, point workers to existing evidence, and ask them to return sources,
-   conclusions, and unresolved gaps. Otherwise, work sequentially.
-7. Keep a concise finding ledger linking each conclusion to Evidence IDs,
-   confidence/evidence type, search boundary, and remaining unknowns. Update
-   the shared index or investigation report so later passes can reuse results.
-
-Before finishing, revisit the original checklist. Mark each question as
-answered, partially answered, or unresolved based on its evidence; keep
-bounded negative searches bounded, and do not describe a broad investigation
-as complete while required questions remain open.
-
-## Read only the relevant guide
-
- Native binaries, managed assemblies, archives, and extraction:
-  [references/native-and-artifacts.md](references/native-and-artifacts.md)
- ASARs, extracted JavaScript, feature tracing, and version comparison:
-  [references/javascript-applications.md](references/javascript-applications.md)
- Android APK declarations, classes, methods, and static references:
-  [references/android-applications.md](references/android-applications.md)
- Native instrumentation, debugger and process capture; browser/Electron
-  observation; static/runtime comparison:
-  [references/runtime-observation.md](references/runtime-observation.md)
- Evidence paging, comparisons, residual unknowns, and verification:
-  [references/evidence-workflows.md](references/evidence-workflows.md)
- Agent environments (AgentEnv bundles) of a web application, recorded from
-  a live instance or a HAR:
-  [references/environments.md](references/environments.md)
- Tasks for a desktop application's exported environment:
-  [references/environments.md](references/environments.md#tasks-for-a-desktop-application-environment)
+For broad investigations, read the Evidence guide's staged workflow. Track the
+questions, source boundaries and unresolved gaps; do not claim completion while
+required questions remain open. Inspect packaged resources alongside code when
+relevant, and use runtime evidence only within the requested scope.

 ## Finish the task

-Explain findings in plain language and tie them to returned evidence. When the
-user asks to build something, use normal coding tools and separate observed
-behavior from design choices. Close an opened native session with
-`close_binary` when its engine is no longer needed. Evidence references and Unknown
-history remain in memory on the same MCP connection. End the investigation with
-`reset_investigation`; supply `save_path` to checkpoint the complete bundle before
-clearing. Import the saved bundle to restore original references and Unknown
-history in a new process. Retention is bounded and is not automatic persistence.
+Explain findings in plain language and tie them to returned Evidence. For builds,
+use normal coding tools and separate observed behavior from design choices.
+Close an opened native/resource session with `close_binary` when no longer needed.
+Evidence references and Unknown history remain on the same MCP connection.
+End with `reset_investigation`; use `save_path` to checkpoint the complete bundle
+before clearing. Import that bundle, including its source closure, to restore
+original references and Unknown history in a new process. Editable Ghidra Program
+checkpoints are separate; read that workflow before edits needing persistence.
@@ -1,11 +1,23 @@
 # Connection and task recovery

+Read only the sections needed for the selected task.
+
+- [Choose the remedy from the observed failure](#choose-the-remedy-from-the-observed-failure)
+- [Distinguish client and server deadlines](#distinguish-client-and-server-deadlines)
+- [Recovery ladder](#recovery-ladder)
+- [REA installed as a client plugin](#rea-installed-as-a-client-plugin)
+- [Repair registration when needed](#repair-registration-when-needed)
+- [Codex tool approval is separate from REA readiness](#codex-tool-approval-is-separate-from-rea-readiness)
+- [Repair an editable REA limit](#repair-an-editable-rea-limit)
+- [Continue through an installed CLI](#continue-through-an-installed-cli)
+
 Read this guide only for an observed connection, command, approval or provider
 blocker. Keep the user's target and question in view. Explain what prevented the
 operation and the next useful step; after repair, continue the investigation.

 Commands below use an installed `rea`. If none is available, use the package
-invocation in `SKILL.md` when acquiring REA is authorized. Follow the connected
+invocation under [Continue through an installed CLI](#continue-through-an-installed-cli)
+when acquiring REA is authorized. Follow the connected
 server's schemas and the installed CLI's help rather than assuming repository
 main and an older release expose the same arguments. Tool-name prefixes belong
 to the client: find the canonical REA operation in its actual tool listing and
@@ -217,6 +229,25 @@ not edit host deadlines, response buffers, registrations or fixed limits.

 ## Continue through an installed CLI

+A concrete CLI fallback for an operator-supplied JavaScript tree or ASAR is:
+
+```bash
+npx -y rea-agents@latest analyze-javascript-application /absolute/path/to/app --json
+```
+
+No MCP registration or native engine is required. Read the returned Evidence,
+graph, limitations, and unknowns with the same care as an MCP result; the CLI
+returns the Evidence record directly. This fallback does not establish that
+MCP is configured. Native CLI tasks still require their selected engine.
+Prefer an existing `rea` CLI. When none is installed and REA package acquisition
+is within the authorized scope, use `npx -y rea-agents@latest` in its place from a
+trusted directory outside the target project, with absolute target paths. Managed
+setup binds the current installation directly; retain its runtime and package
+cache entry, or restore that installation before repairing its registration.
+For setup-owned registration, configuration repair starts with a read-only setup plan; show paths, backups and
+skill replacement before applying authorized changes. Preserve existing approval
+and target-execution boundaries.
+
 Check the command environment only if the launcher fails:

 ```bash
@@ -1,5 +1,13 @@
 # Agent environments from a live application

+Read only the sections needed for the selected task.
+
+- [Before recording](#before-recording)
+- [Record a session an environment can learn writes from](#record-a-session-an-environment-can-learn-writes-from)
+- [Check coverage](#check-coverage)
+- [Export and hand off](#export-and-hand-off)
+- [Tasks for a desktop application environment](#tasks-for-a-desktop-application-environment)
+
 Use this when the user asks for an agent environment (an AgentEnv bundle) of a
 web application: a folder `agent-env` deploys, whose MCP tools answer from what
 one recording of the application observed and serve the writes that recording
@@ -1,7 +1,25 @@
 # Evidence, comparison, and verification workflows

-Evidence-producing tools return the complete Evidence record directly in MCP
-`structuredContent` and CLI JSON. Read `normalized_result` for operation data,
+Read only the sections needed for the selected task.
+
+- [Read and compose source Evidence](#read-and-compose-source-evidence)
+- [Inventory and decompilation views](#inventory-and-decompilation-views)
+- [Unknowns and comparisons](#unknowns-and-comparisons)
+- [Process captures and environment views](#process-captures-and-environment-views)
+- [Native export table pages](#native-export-table-pages)
+- [Recover oversized delivery and find retained Evidence](#recover-oversized-delivery-and-find-retained-evidence)
+- [Plan broader investigations](#plan-broader-investigations)
+
+## Read and compose source Evidence
+
+Evidence-producing MCP tools return Evidence directly in `structuredContent`.
+CLI complete JSON returns Evidence directly. CLI summary delivery through
+`--evidence_output` returns `{summary, evidence_bundle}`: `summary` is the view's
+Evidence, and `evidence_bundle` is the export receipt with its path and byte count.
+Read `summary.normalized_result.parent_evidence_id` for the complete source ID;
+pass the receipt's path to `--evidence-bundle` on a later supported CLI command.
+Advertised summary delivery retains the complete source separately;
+complete inline delivery is available where the connected contract says so. Read `normalized_result` for operation data,
 and cite `evidence_id` when another tool or your explanation needs a stable
 reference. Preserve authority, limitations, coverage, and residual unknowns. If a result
 is incomplete or paginated, continue only when the remaining data matters to
@@ -49,6 +67,8 @@ An input bundle grants no implicit file lookup: `evidence-file` and historical
 graph file selectors are accepted only by contracts advertising them. See the
 [CLI reuse guide](https://github.com/morluto/rea/blob/main/docs/getting-started/cli.md#import-export-and-compare-evidence).

+## Inventory and decompilation views
+
 Completed `inspect_artifact` inventory also supports a summary and
 `view: {kind: "inventory", collection: "occurrences", logical_paths: ["package.json", "main.js"]}`.
 Omit `logical_paths` to page all available occurrences; `[]` selects none.
@@ -81,6 +101,8 @@ exact `where.indices`, `addresses`, `procedure_addresses` or `statuses`. Add
 `collection: "pseudocode"` with one row's `index` to page a large body. Batch
 limitations aggregate every item, so do not attribute them to one successful row.

+## Unknowns and comparisons
+
 Use `record_unknown` to track unresolved questions in the user's investigation
 and name the authority or environment still required. Supply supporting and
 contradicting evidence IDs. It updates the session registry directly.
@@ -111,6 +133,8 @@ or absence:
 - `verify_reconstruction` evaluates a finite typed specification. A pass covers
  only declared comparable claims, not global equivalence.

+## Process captures and environment views
+
 Process captures are opt-in behavioral evidence, not a security sandbox. V3
 captures cannot be upgraded to V4; rerun the original scenario. Distinguish root
 exit from descendant settlement and require freshness when the task needs it.
@@ -164,6 +188,8 @@ catalog and state size checks. `rea environment-build <capture.har> <dir>`
 inspects, projects and exports in one step and prints the same coverage, or
 `null` when the bundle serves replay.

+## Native export table pages
+
 For a PE/ELF export question, `inspect_native_exports` accepts `detail: "summary"`
 and retains the complete table. Query `inspect_analysis_view` with
 `view: {kind: "native-exports", collection: "exports", names: ["selected_name"],
@@ -174,3 +200,69 @@ coverage describes selected retained rows; `summary.coverage` or `exports.covera
 still describes the source table, so an empty partial page does not prove absence.
 CLI `inspect-native-exports --detail summary --evidence_output PATH` saves the
 complete bundle for later `inspect-analysis-view --evidence-bundle PATH` requests.
+
+## Recover oversized delivery and find retained Evidence
+
+If MCP reports `resource_constraint` with `details.resource: "transport"`, call
+`inspect_analysis_view` with its reported same-session Evidence reference for a
+summary, one section/module, or a stable page. Use `trace_application_feature`
+once a seed is known, or call `export_evidence_bundle` to write the complete
+session to a selected path. The analysis remains complete in the ledger; avoid
+repeating it merely to request the same oversized response. Complete CLI JSON
+output also streams without a single MCP frame.
+
+When the retained parent ID is unknown, use `get_evidence_bundle` with
+`detail: "summary"` and exact filters for operation, target SHA-256,
+analysis-profile digest or canonical procedure address. Select its returned
+Evidence ID for the next view instead of requesting the complete bundle. When
+that record has no supported view (for example an annotation), read it with
+`detail: "records"` and an `evidence_id` filter; `missing_evidence_links`
+names linked sources this session does not retain.
+`retention: "complete-record"` means the whole record is stored; native
+value-flow truncation and unknown metadata remain separate. For an exported
+portable bundle, use `rea inspect-evidence-bundle` with JSON containing `path`,
+`detail: "summary"` and the same `filters`. Reading that file still requires
+validating its full contents within the local memory budget.
+
+A client can also truncate a successful tool result without a REA transport
+error. Treat that preview as incomplete; use the retained parent ID for smaller
+views or export when the full record is needed. Do not parse the preview as
+canonical JSON or repeat the producer. For JavaScript, read the
+[module-view and trace recipes](javascript-applications.md) before
+drilling into a large graph; a broad bidirectional trace can expand unrelated
+containment relationships even after summary analysis.
+
+## Plan broader investigations
+
+For requests that span multiple features or subsystems, use a staged workflow:
+
+1. Turn the request into a checklist of questions and the evidence each answer
+   needs. Resolve target identity and constraints from the conversation and
+   workspace before asking for information again.
+2. Inspect the current REA session, artifact identity, saved analysis database,
+   bookmarks, and prior evidence. Reuse matching state; do not open duplicate
+   sessions or repeat identical analysis.
+3. Start with the smallest useful overview or inventory. Follow each question
+   from its entry point through relevant data and state changes to its result.
+   Batch related operations around a specific hypothesis, then expand only when
+   the returned evidence leaves a concrete gap.
+4. Inspect relevant packaged resources and configuration alongside code when
+   they affect the question. Use format-aware inventory and parsers; do not
+   infer behavior from filenames, strings, or layout alone.
+5. Corroborate a conclusion with the evidence type it requires. Use runtime
+   observation only when static evidence cannot answer the question and the
+   required host runtime and OS access are available. For JavaScript behavior,
+   run probes against the actual app through the available browser, Electron,
+   or process capture workflow.
+6. Decompose work into independent questions. When parallel workers are
+   available and the questions do not depend on one another, assign distinct
+   scopes, point workers to existing evidence, and ask them to return sources,
+   conclusions, and unresolved gaps. Otherwise, work sequentially.
+7. Keep a concise finding ledger linking each conclusion to Evidence IDs,
+   confidence/evidence type, search boundary, and remaining unknowns. Update
+   the shared index or investigation report so later passes can reuse results.
+
+Before finishing, revisit the original checklist. Mark each question as
+answered, partially answered, or unresolved based on its evidence; keep
+bounded negative searches bounded, and do not describe a broad investigation
+as complete while required questions remain open.
@@ -0,0 +1,76 @@
+# Firmware and raw images
+
+## Firmware regions and extraction
+
+Use `inspect_firmware_regions` when advertised. Use `extract_firmware` when
+extraction is requested, with a caller-selected new absolute output directory.
+These tools use caller-supplied Binwalk/Unblob on Linux; see the
+[firmware guide](https://github.com/morluto/rea/blob/main/docs/guides/firmware/firmware-analysis.md).
+
+## Headerless raw images and firmware containers
+
+For other headerless images (embedded firmware without ELF/Mach-O/PE/MZ
+headers), open with `format: "raw-binary"`, `architecture` (`x86`, `x86_64`,
+`arm`, `arm64`, `6502`, or `m68k`), and `entry_point` (`0x` hex). File offset 0 is mapped at
+that address. Hopper and IDA refuse this interpretation; Ghidra uses
+`BinaryLoader` with a generic language: big-endian for `m68k`, little-endian
+otherwise. Big-endian ARM, Thumb-only, and Cortex-M variants are unsupported.
+`6502` selects NMOS 6502; the entry and complete file mapping must fit within
+`0x0000..0xffff`. 65C02, 65816, cartridge containers, bank switching, and mapper
+semantics are unsupported. `m68k` requires an even entry and decodes the 68040
+superset of the 68000 family; Amiga/Atari containers and vector-table entry
+discovery are unsupported. Windows Ghidra P0 admits raw images only for `6502`. See [raw binary guide](https://github.com/morluto/rea/blob/main/docs/providers/raw-binary.md).
+
+Intel HEX, S-record, UF2 and DfuSe files are containers, not raw images:
+`inspect_artifact` lists address regions (UF2 per familyID, DfuSe per element
+with its alternate setting), and `extract_artifact` writes each region. Open an
+extracted region as `raw-binary` with its start address as `entry_point`. UF2
+numbering gaps leave coverage unknown; a DfuSe suffix CRC mismatch follows
+`integrity_policy`. See [UF2 and DfuSe](https://github.com/morluto/rea/blob/main/docs/uf2-dfuse.md).
+
+## ESP images
+
+For an ESP32-family app or bootloader image, `open_binary` then
+`inspect_artifact` with `detail: "summary"`. `root_format_metadata` holds the
+observed `header` and `descriptor` (its `kind` is the app or bootloader role)
+and the derived `chip`, `checksum`, `appended_sha256` and
+`undescribed_trailing` ranges. Segment rows (`segment-NN.bin`) carry
+`load_addr`, `classification` (`mapped`, `loaded`, `not-loaded` or `unknown`,
+per ESP-IDF `should_map`/`should_load`; RAM ranges are not checked) and
+`source_location`; select them with `inspect_analysis_view` and
+`logical_paths`. Signature blocks are `unverified`; `public_key_sha256`
+matches eFuse key digests.
+
+Unknown `source_coverage` means truncation or undescribed trailing bytes, such
+as the flash segments of a `--ram-only-header` image; do not infer absence
+from it. Erased flash is described. Integrity mismatches are facts, not
+refusals. ESP8266 images are refused, and flash-encrypted images are not
+recognized. Segments are not disassembled, and RISC-V or Xtensa segments
+cannot be opened as raw-binary. See
+[ESP images](https://github.com/morluto/rea/blob/main/docs/esp-image.md).
+
+## ESP flash images
+
+A whole-flash dump opens as `esp-flash-image`. `root_format_metadata` holds
+`partition_table` (its `method`: `default`, `caller` or a derived
+`scan`), `bootloader` and `apps` ESP image facts, the `otadata` records,
+`partitions_outside_dump` and `boot_selection`. Every table has a
+`boot_selection`: its `basis` names the bootloader's branch (`no-otadata`
+without otadata, `none` when the bootloader rejects the table, `unknown`
+when a record is missing), and it lists its `assumptions`;
+`running_partition` is always `unknown`. Each image names its entry
+`path`. With `detail: "summary"` the root kind is `esp-flash-image-summary`
+and each image is a compact `summary` (chip, entry point, segment count,
+classified load ranges, signature block count, descriptor identity,
+integrity); complete detail keeps every segment. Partition rows
+(`partitions/<label>.bin`) carry the declared `type`, `subtype`, names,
+`flash_address`, `size` and flags; `encrypted` is a storage flag, not
+proof of ciphertext. `written_offset`/`written_end` bound the bytes that
+are not erased: an app slot whose facts say `erased` can still hold an older
+image, and a limitation says so. For a dump read from another flash address, call
+`open_binary` with `format: "esp-flash-image"` and `flash_offset`; an
+`esp-image` whose `flash_dump` is set names that offset in a next probe; a
+relocated table can be named with `partition_table_offset`. No table found
+means unknown, often flash encryption. Extraction writes `nvs_keys` as
+ordinary data. See
+[ESP flash images](https://github.com/morluto/rea/blob/main/docs/esp-flash-image.md).
@@ -0,0 +1,358 @@
+# Offline format and metadata inspection
+
+Read only the sections needed for the selected task.
+
+- [Go build metadata](#go-build-metadata)
+- [Model files](#model-files)
+- [IL2CPP metadata](#il2cpp-metadata)
+- [Rust dependency metadata](#rust-dependency-metadata)
+- [PE Authenticode certificate tables](#pe-authenticode-certificate-tables)
+- [PE import and delay-load tables](#pe-import-and-delay-load-tables)
+- [PE TLS callbacks and load configuration](#pe-tls-callbacks-and-load-configuration)
+- [Binary hardening](#binary-hardening)
+- [ELF note tables](#elf-note-tables)
+- [Apple IPS crash reports](#apple-ips-crash-reports)
+- [Linux kernel modules](#linux-kernel-modules)
+- [CPython pyc files](#cpython-pyc-files)
+- [Erlang BEAM files](#erlang-beam-files)
+- [SQLite snapshots](#sqlite-snapshots)
+- [Recorded Linux crashes](#recorded-linux-crashes)
+- [Offline ELF layout](#offline-elf-layout)
+- [Offline WASM](#offline-wasm)
+- [Offline APK signatures](#offline-apk-signatures)
+- [Offline PE resource inventory](#offline-pe-resource-inventory)
+- [Offline PE and ELF export tables](#offline-pe-and-elf-export-tables)
+- [EVM bytecode](#evm-bytecode)
+- [Embedded GPU code objects](#embedded-gpu-code-objects)
+
+## Go build metadata
+
+Use `inspect_go_binary` for an explicit local ELF, PE or Mach-O (universal
+files need `architecture`) when the
+question concerns the embedded compiler version, module/dependency versions,
+local replacements or build settings. No `open_binary`, Go installation or
+target execution is required. The CLI equivalent is `inspect-go-binary PATH`.
+Preserve artifact SHA-256, original file ranges, framed module bytes and every
+unparsed module-text line. A missing record is an unknown, not proof of a
+non-Go binary; observed metadata does not authenticate its claims. Function,
+source and type recovery remain a separate native-analysis question.
+
+See the [Go binary guide](https://github.com/morluto/rea/blob/main/docs/guides/native/go-binaries.md).
+
+## Model files
+
+Optional `view` selects one page in the initial call. Batch metadata keys or
+tensor names and select only needed fields; do not infer model behavior from
+declared architecture or tensor types.
+
+Use `inspect_model_artifact` (`inspect-model-artifact PATH`) for local GGUF v2/v3
+and safetensors declarations without a model runtime. Header-only mode does not
+read weights or establish full-file identity. `hash: "full"` explicitly streams
+all bytes. Retained `model-artifact` views page `metadata`, `tensors` and derived
+`types`, with exact batch filters and selected fields. Arrays retain typed counts
+and eight-element previews; omitted values, unknown types and runtime behavior
+stay explicit. See [model files](https://github.com/morluto/rea/blob/main/docs/model-artifacts.md).
+
+## IL2CPP metadata
+
+Use `inspect_il2cpp_metadata` for an explicit local Unity `global-metadata.dat`
+(versions 24, 27, 29, 31 and 39) when the question concerns assembly images,
+names, member owners, string literals, namespaces or index ranges. No `open_binary`, Unity installation or target
+execution is required. The CLI equivalent is `inspect-il2cpp-metadata PATH`.
+MCP defaults to counts with complete retained Evidence. Query `sections`,
+`images`, `types`, `methods`, `fields`, `properties`, `events`, `parameters` or
+`string_literals` through `inspect_analysis_view`; use exact names,
+batch indices and selected fields. Row indices are scoped by artifact SHA-256
+and collection; page offsets count filtered matches. Parameters support batch
+`method_indices` to read one method's parameters directly. Historical reports
+without member collections retain unknown counts rather than empty inventories. Preserve
+artifact SHA-256 and index widths. Unrecognized magic may mean encryption and
+is unsupported, not decrypted.
+
+Optional matching `binary_path` enables static native addresses and type
+references. Query `method_addresses` with indices or addresses/states, preserving
+every shared-body method and both artifact identities. Without a linked binary,
+native counts remain unknown. Byte-pattern fallback is inferred; no runtime
+behavior or same-build pairing is proved.
+See [IL2CPP metadata](https://github.com/morluto/rea/blob/main/docs/il2cpp-metadata.md).
+
+## Rust dependency metadata
+
+For selected crates, use `view: {collection: "packages", names: [...],
+fields: ["name", "version", "source"]}` on the first call. Include `dependencies`
+explicitly for direct index references. Select `detail: "summary"` for counts and
+ranges; retained Rust package/edge views support later filters. Keep complete
+parent Evidence accessible; CLI compact delivery requires `--evidence_output`.
+
+Use `inspect_rust_binary` for an explicit local ELF, PE, or Mach-O (universal
+files need `architecture`) when
+the question concerns the cargo-auditable crate list embedded in `.dep-v0`
+(Mach-O: `__DATA,.dep-v0`). No `open_binary`, Rust installation, or target
+execution is required. The CLI equivalent is `inspect-rust-binary PATH`.
+Preserve artifact SHA-256, package order, dependency indices, and the section
+file range. A missing section is null metadata, not proof the binary has no
+dependencies. An omitted package kind stays null. A rustc commit hash is
+inferred from a read-only `/rustc/<40-hex>/` path and does not by itself
+identify the compiler. See [Rust binaries](https://github.com/morluto/rea/blob/main/docs/rust-binaries.md).
+
+## PE Authenticode certificate tables
+
+Use `inspect_pe_certificates` for an explicit local PE32/PE32+ image when the
+question concerns the Authenticode certificate table, WIN_CERTIFICATE types, or
+embedded PKCS#7 signer and X.509 identity fields. No `open_binary`, Windows SDK,
+or target execution is required. The CLI equivalent is
+`inspect-pe-certificates PATH`. Preserve artifact SHA-256, table file ranges,
+payload hashes, original validity-time spellings, and
+`subject_key_identifier_hex` when the signer uses that form. A missing
+`IMAGE_DIRECTORY_ENTRY_SECURITY` directory is observed absence of that table,
+not proof the image is unsigned in every catalog or overlay sense. Signatures,
+chains, timestamps, and Authenticode digest coverage remain unobserved. See
+[PE Authenticode certificate tables](https://github.com/morluto/rea/blob/main/docs/pe-certificates.md).
+
+## PE import and delay-load tables
+
+Use `inspect_pe_imports` for an explicit local PE32/PE32+ image when the
+question concerns imported DLL and function names, ordinals, delay-load
+descriptors, or the pefile import hash. No `open_binary`, Windows SDK, or
+target execution is required. The CLI equivalent is `inspect-pe-imports PATH`.
+Preserve artifact SHA-256, directory file ranges, original DLL spellings, and
+ILT/IAT RVAs. A missing `IMAGE_DIRECTORY_ENTRY_IMPORT` directory is observed
+absence of that table, not proof the image never imported APIs through another
+table or overlay. Bound snapshots, loaded IAT contents, and export-forward
+resolution remain unobserved. See
+[PE import and delay-load tables](https://github.com/morluto/rea/blob/main/docs/pe-imports.md).
+
+## PE TLS callbacks and load configuration
+
+Preserve each callback's RVA, file offset and section alongside its VA and the
+size-covered declaration fields. A missing directory is observed absence of
+that declaration.
+
+Use `inspect_pe_load_config` for an explicit local PE32/PE32+ image when the
+question concerns code that runs before the entry point through TLS callbacks,
+or the security cookie, SafeSEH, CFG, EH-continuation and XFG declarations in
+the load configuration. No `open_binary`, Windows SDK, or target execution is
+required. The CLI equivalent is `inspect-pe-load-config PATH`. Preserve artifact
+SHA-256, directory and callback-array file ranges, and callback VAs as
+hexadecimal strings. Fields outside the declared `Size` are `null`. Guard-flag
+mitigations carry `evidence_kind: "inferred"`; enforcement remains unobserved.
+See
+[PE TLS callbacks and load configuration](https://github.com/morluto/rea/blob/main/docs/pe-load-config.md).
+
+## Binary hardening
+
+Each property reports `enabled`, `disabled`, `partial`, `unknown`, or
+`not_applicable`, with the header field or import behind it.
+
+Use `inspect_binary_hardening` for an explicit local ELF, PE, or Mach-O file
+when the question concerns PIE or ASLR, NX, RELRO, stack-protector or FORTIFY
+signs, control-flow flags, or stripped state. No `open_binary`, pwntools, or
+target execution is required. The CLI equivalent is
+`inspect-binary-hardening PATH`. Universal Mach-O files return one image per
+slice. A missing import is `unknown`, not proof the protection was omitted.
+Authenticode and Mach-O code-signature rows report presence, not validity.
+`hardened_runtime` stays unknown and names `inspect_signature`. See
+[binary hardening](https://github.com/morluto/rea/blob/main/docs/binary-hardening.md).
+
+## ELF note tables
+
+Retain each note's owner, type, descriptor SHA-256, and PT_NOTE/SHT_NOTE ranges.
+
+Use `inspect_elf_notes` for an explicit local ELF32/ELF64 image when the
+question concerns PT_NOTE/SHT_NOTE owners, GNU build-id, or GNU ABI-tag
+fields. No `open_binary` or target execution is required. The CLI equivalent
+is `inspect-elf-notes PATH`. Preserve artifact SHA-256, table file ranges,
+descriptor hashes, and original owner spellings. A missing table is observed
+absence of those declarations, not proof the image never carried notes in
+another container. See
+[ELF note tables](https://github.com/morluto/rea/blob/main/docs/elf-notes.md).
+
+## Apple IPS crash reports
+
+Use `inspect_apple_ips` for an explicit local Apple `.ips` file when the
+question concerns crash metadata, exception and termination facts, threads,
+usedImages, lossless registers, or documented crash classes. No `open_binary`,
+Xcode, atos, or target execution is required. The CLI equivalent is
+`inspect-apple-ips PATH`. Preserve artifact SHA-256, `bug_type` as a string,
+uppercase image UUIDs, and integer literals that exceed IEEE-754 range. Only
+`bug_type` `"309"` yields a crash body; other DiagnosticReports types return
+no crash result. Opened Mach-O and dSYM UUID joins remain unobserved. See
+[Apple IPS crash reports](https://github.com/morluto/rea/blob/main/docs/apple-ips.md).
+
+## Linux kernel modules
+
+Use `inspect_kernel_module` for an explicit local ELF32/ELF64 relocatable
+object when the question concerns `.modinfo` license, vermagic, alias,
+depends, or parm strings, the `__versions` symbol CRCs, or an appended module
+signature trailer. No `open_binary`, Linux host, or `modinfo` program is
+required. The CLI equivalent is `inspect-kernel-module PATH`. Preserve
+artifact SHA-256, key order, duplicate keys, CRC hex, and section file ranges.
+A missing section is observed absence when section names are known, not proof
+the module never carried that metadata. `.gnu.linkonce.this_module` is reported
+as present or absent; `struct module` stays unknown because its layout changes
+with the kernel version. `__ksymtab` records are not decoded. The PKCS#7 range
+and its SHA-256 are observed; certificate, signer, and digest coverage remain
+unvalidated. An absent trailer is not proof the module is unsigned in another
+container. gzip, xz, and zstd whole-file containers are unsupported and name
+`external_decompression` as the next probe: use an external codec utility to
+decompress into a separate file, then call `inspect_kernel_module` on that file. See
+[Linux kernel modules](https://github.com/morluto/rea/blob/main/docs/kernel-modules.md).
+
+## CPython pyc files
+
+Use `inspect_python_pyc` for an explicit local CPython 3.7–3.13 `.pyc` when the
+question concerns the header magic, PEP 552 source hash or timestamp, nested
+code-object names, or bytecode identity. No `open_binary`, Python installation,
+or target execution is required. The CLI equivalent is `inspect-python-pyc PATH`.
+Preserve artifact SHA-256, the 16-byte header fields, nested code names, and
+bytecode SHA-256. Bytecode is not decompiled. A decoded header does not prove
+the matching `.py` is present. See [CPython pyc inspection](https://github.com/morluto/rea/blob/main/docs/python-pyc.md).
+
+## Erlang BEAM files
+
+Use `inspect_erlang_beam` for an explicit local `FOR1`/`BEAM` file when the
+question concerns IFF chunks, atom names, exports, imports, lambdas, or the
+Code header. No `open_binary`, Erlang installation, or bytecode execution is
+required. The CLI equivalent is `inspect-erlang-beam PATH`. Preserve artifact
+SHA-256, chunk file ranges, 1-based atom indices, and original atom spellings.
+Missing optional tables stay null. For a few facts, use `detail: "summary"` with
+a `beam` view selecting a collection, exact names/indices and fields; read later
+pages from `parent_evidence_id` or the complete Evidence bundle. Same-name
+exports retain every arity and original atom index. CLI summary delivery requires
+`--evidence_output`. Null table counts remain distinct from decoded empty tables. See
+[Erlang BEAM files](https://github.com/morluto/rea/blob/main/docs/erlang-beam.md).
+
+## SQLite snapshots
+
+Use `inspect_sqlite_database` with an explicit local database snapshot for its
+schema and optional rows from one exact ordinary table. It requires Node.js
+24.x >=24.15 or 26+ with the native `DatabaseSync.limits` API. It also consumes the
+existing sibling `-wal`; retain both original digests when citing its result.
+Default output is a compact inventory; a selected table expands only its own
+schema and samples 20 rows. Select `columns` to avoid irrelevant or large cells,
+and request `schema_scope: "database"` only for complete schema details.
+Choose `row_limit` when a finite sample is useful and keep truncation and
+unspecified row order explicit. Virtual tables, shadow tables and views are
+schema facts, not row-read targets. REA inspects private copies and leaves
+the source files untouched; obtain a coherent quiescent database/WAL snapshot
+before inspection. See [SQLite snapshots](https://github.com/morluto/rea/blob/main/docs/guides/data/sqlite-databases.md).
+
+## Recorded Linux crashes
+
+Use `inspect_recorded_crash` with an explicit Linux x86-64 ELF core path to
+inspect historical thread registers, signals, raw notes and original file
+ranges. It is independent of the active disassembler target. Source-bound
+register values and note bytes are observations; missing notes, signal-thread
+association and current executable/library identity remain unknown. PIDs are
+historical metadata and never authorize live attach or control.
+
+The optional `include_debugger_context` facet adds mapping candidates through
+caller-supplied GDB/pwndbg in an owned core-only session. Display names do not
+establish current file identity; zero reported flags leave permissions unknown.
+Requested unavailable context fails with setup guidance. See
+[recorded crashes](https://github.com/morluto/rea/blob/main/docs/guides/native/recorded-crashes.md)
+for exact upstream profiles, bounds and verification coverage.
+
+## Offline ELF layout
+
+Use `inspect_binary_layout` with an explicit local ELF path for file-backed
+sections, symbols, relocations, linkage names, and static mitigation inferences
+without opening a disassembler target. When that complete record is already
+retained, call `inspect_analysis_view` for a summary, mitigations or linkage
+facet, one section or symbol, or a stable page. Do not re-run the decoder to
+read a single object.
+
+## Offline WASM
+
+Supply WABT 1.0.42 through `REA_WABT_BIN_DIRECTORY`. Select JavaScript glue and
+candidate paths explicitly, preserving URL/path ambiguity and exact byte/tool
+identity; no implicit fetch is performed.
+
+Use `inspect_wasm_artifact` with caller-supplied WABT for selected local bytes.
+For counts, validation and WAT identity, select `detail: "summary"` on the first
+MCP call. The complete original Evidence stays retained; use
+`normalized_result.parent_evidence_id` for exact exports or text pages. Omitted
+or complete detail keeps the existing complete result.
+For a completed result, use `inspect_analysis_view` with its reported retained
+reference for a summary or `view: {kind: "wasm", facet: "exports", offset: 0, limit: 32}`.
+Facets also include sections, imports, candidates, glue, WAT, headers, details
+and tool profile. Text offsets count UTF-16 code units; follow `next_offset`.
+The complete source remains retained after an oversized MCP reply. No target
+execution or network acquisition is implied, and WAT is decoded representation.
+
+For exact core-module import/export differences, use `compare_wasm_interfaces`
+with two complete inspection Evidence records (or current-session retained
+references) and explicit scope. Preserve unknown types/duplicate names; static
+interface equality is not runtime compatibility. CLI accepts complete inline
+Evidence in `rea compare-wasm-interfaces input.json --json`, or exact references
+with `--evidence-bundle /absolute/path/evidence.json`. Use the complete parent
+ID when the inspection returned a summary.
+
+See the [WASM guide](https://github.com/morluto/rea/blob/main/docs/guides/wasm/wasm-artifacts.md).
+
+## Offline APK signatures
+
+Use `inspect_apk_signature` for a selected local APK/ZIP/AAB. Default MCP summaries
+retain complete Evidence. Select `view.collection: signers/digests/lineage`,
+with scheme or ID batches, fields and paging; use `inspect_analysis_view` kind
+`apk-signature` for retained reads after deletion. IDs retain artifact/scheme
+scope and signer links; `fields: []` keeps identity links. Empty pages preserve
+partial decoding reasons and unknown authenticity. CLI compact delivery needs
+`--evidence_output` to preserve the complete parent.
+It reads the APK
+Signing Block (v2/v3/v3.1) and v1 `META-INF` signing without executing anything,
+and reports each signer's certificate facts (for v1, the certificate the PKCS#7
+block's SignerInfo names), the declared v3 rotation lineage,
+the declared source-stamp certificate and, for SHA-256/SHA-512 digests, whether
+the declared content digest matches the current bytes. That match is not a
+signature verification: anyone who changes the bytes can recompute the digest.
+`posture` summarises v1-only signing (which cannot tell a v1-only APK from one
+whose v2/v3 block was removed), observed signer agreement across schemes,
+whether the v1 signer equals the block-scheme signer (`false` is notable),
+whether every differing signer appears in a declared (unverified) rotation
+lineage, and the strongest scheme.
+It never claims authenticity: no signature or lineage is cryptographically
+verified.
+
+See the [APK signature guide](https://github.com/morluto/rea/blob/main/docs/apk-signature.md).
+
+## Offline PE resource inventory
+
+Use `inspect_pe_resources` with an absolute `path`, or
+`rea inspect-pe-resources ./selected.exe --json`, for portable PE32/PE32+
+resource inspection without opening a native target. Preserve returned Evidence:
+type/name/language IDs and UTF-16 names, original directory/data/payload ranges,
+code pages, payload hashes and static icon-group references. Same-language icon
+resolution is explicit; missing references and size mismatch remain visible.
+Other payloads are opaque, and this operation does not decode images or simulate
+Windows resource loading. Consult the budgets and supported tree profile in
+[offline binary diagnostics](https://github.com/morluto/rea/blob/main/docs/guides/native/binary-diagnostics.md).
+
+## Offline PE and ELF export tables
+
+Use `inspect_native_exports` with an absolute `path`, or
+`rea inspect-native-exports ./libexample.so --json`, to read a PE export
+directory or ELF dynamic symbol table on any host without opening a native
+target. Ordinal-only, forwarded and hidden-version exports stay distinct;
+partial or unsupported coverage means the inventory is incomplete, not that
+exports are absent. Use `inspect_macho` for Mach-O. See
+[offline binary diagnostics](https://github.com/morluto/rea/blob/main/docs/guides/native/binary-diagnostics.md).
+
+## EVM bytecode
+
+Explicit local EVM bytecode carrier: `inspect_evm_interface` with caller-selected
+`raw` or `hex` encoding. The owned worker deadline is `timeout_ms` (default
+30000 ms, range 1..2147483647, next call). It does not raise the fixed byte,
+address-space, or CPU allowances. Preserve carrier/decoded digests and treat selectors,
+argument strings and mutability as inferred candidates; this performs no chain
+lookup or target execution. For the complete inferred interface without hex or
+duplicate stdout, discover support and select `detail: "summary"`; complete
+Evidence stays retained under its original identity. Use the returned
+`parent_evidence_id` for exact function or `bytecode_hex`/stdout/stderr pages.
+Candidate coverage does not establish interface completeness. See the
+[EVM bytecode guide](https://github.com/morluto/rea/blob/main/docs/guides/evm/evm-bytecode.md).
+
+## Embedded GPU code objects
+
+Embedded CUDA/HIP code objects: `inspect_gpu_code_objects`; inventory targets
+first, then decode selected payloads and query retained GPU Evidence.
@@ -1,5 +1,13 @@
 # JavaScript and Electron application artifacts

+Read only the sections needed for the selected task.
+
+- [Inventory route candidates without returning the application graph](#inventory-route-candidates-without-returning-the-application-graph)
+- [Read a module without repeating analysis](#read-a-module-without-repeating-analysis)
+- [Trace only the remaining question](#trace-only-the-remaining-question)
+- [Recover an oversized display](#recover-an-oversized-display)
+- [Reusing application Evidence](#reusing-application-evidence)
+
 For captured or bundled JavaScript that needs readable source recovery, use
 `recover_javascript_sources` with an absolute `path` and absent
 `output_directory`. Supply related runtime/shared/lazy files in
@@ -90,6 +98,9 @@ Endpoint candidates remain inferences rather than confirmed network behavior.
 ## Read a module without repeating analysis

 Use the actual returned parent ID, on the same connection, as `source.evidence_id`.
+For CLI summary exports, take that ID from
+`summary.normalized_result.parent_evidence_id` and pass `--evidence-bundle` with
+the exported bundle's path to each later `inspect-analysis-view` invocation.
 The following IDs are placeholders to replace with returned values. When the
 module's node ID is not already known, page identities before selecting an item.
 Pages return only node IDs, paths and roles; choose a useful page size and follow
@@ -1,4 +1,23 @@
-# Native, managed, and packaged artifacts
+# Native and managed analysis
+
+<a id="native-managed-and-packaged-artifacts"></a>
+
+Read only the sections needed for the selected task.
+
+- [Other artifact guides](#other-artifact-guides)
+- [Apple app resources](#apple-app-resources)
+- [Desktop installation directories](#desktop-installation-directories)
+- [Native targets](#native-targets)
+- [Continue editable Ghidra analysis across processes](#continue-editable-ghidra-analysis-across-processes)
+- [Reuse caller-selected Ghidra analysis](#reuse-caller-selected-ghidra-analysis)
+- [Ghidra startup deadline recovery](#ghidra-startup-deadline-recovery)
+- [Bridge request ceiling](#bridge-request-ceiling)
+- [Selected native facts and call graphs](#selected-native-facts-and-call-graphs)
+- [Static memory and original file bytes](#static-memory-and-original-file-bytes)
+- [DOS MZ with Ghidra](#dos-mz-with-ghidra)
+- [Managed PE/CLI](#managed-pe-cli-guide)
+- [DOS COM loader interpretation](#dos-com-loader-interpretation)
+- [Function annotations in Ghidra](#function-annotations-in-ghidra)

 For release comparisons on one MCP connection, retain `list_procedures` Evidence
 from each target and reuse its exact IDs after target switches or `close_binary`.
@@ -62,257 +81,39 @@ runtime presence. For compact CLI output, use
 `inspect-desktop-application PATH --detail summary --evidence_output BUNDLE`.
 See [desktop installations](https://github.com/morluto/rea/blob/main/docs/desktop-applications.md).

-## Go build metadata
-
-Use `inspect_go_binary` for an explicit local ELF, PE or Mach-O (universal
-files need `architecture`) when the
-question concerns the embedded compiler version, module/dependency versions,
-local replacements or build settings. No `open_binary`, Go installation or
-target execution is required. The CLI equivalent is `inspect-go-binary PATH`.
-Preserve artifact SHA-256, original file ranges, framed module bytes and every
-unparsed module-text line. A missing record is an unknown, not proof of a
-non-Go binary; observed metadata does not authenticate its claims. Function,
-source and type recovery remain a separate native-analysis question.
-
-## Model files
-
-Use `inspect_model_artifact` (`inspect-model-artifact PATH`) for local GGUF v2/v3
-and safetensors declarations without a model runtime. Header-only mode does not
-read weights or establish full-file identity. `hash: "full"` explicitly streams
-all bytes. Retained `model-artifact` views page `metadata`, `tensors` and derived
-`types`, with exact batch filters and selected fields. Arrays retain typed counts
-and eight-element previews; omitted values, unknown types and runtime behavior
-stay explicit. See [model files](https://github.com/morluto/rea/blob/main/docs/model-artifacts.md).
-
-## IL2CPP metadata
-
-Use `inspect_il2cpp_metadata` for an explicit local Unity `global-metadata.dat`
-(versions 24, 27, 29, 31 and 39) when the question concerns assembly images,
-names, member owners, string literals, namespaces or index ranges. No `open_binary`, Unity installation or target
-execution is required. The CLI equivalent is `inspect-il2cpp-metadata PATH`.
-MCP defaults to counts with complete retained Evidence. Query `sections`,
-`images`, `types`, `methods`, `fields`, `properties`, `events`, `parameters` or
-`string_literals` through `inspect_analysis_view`; use exact names,
-batch indices and selected fields. Row indices are scoped by artifact SHA-256
-and collection; page offsets count filtered matches. Parameters support batch
-`method_indices` to read one method's parameters directly. Historical reports
-without member collections retain unknown counts rather than empty inventories. Preserve
-artifact SHA-256 and index widths. Unrecognized magic may mean encryption and
-is unsupported, not decrypted. Linking names to `GameAssembly` or
-`UnityFramework` code addresses remains a separate native-analysis question.
-See [IL2CPP metadata](https://github.com/morluto/rea/blob/main/docs/il2cpp-metadata.md).
-
-## Rust dependency metadata
-
-Use `inspect_rust_binary` for an explicit local ELF, PE, or Mach-O (universal
-files need `architecture`) when
-the question concerns the cargo-auditable crate list embedded in `.dep-v0`
-(Mach-O: `__DATA,.dep-v0`). No `open_binary`, Rust installation, or target
-execution is required. The CLI equivalent is `inspect-rust-binary PATH`.
-Preserve artifact SHA-256, package order, dependency indices, and the section
-file range. A missing section is null metadata, not proof the binary has no
-dependencies. An omitted package kind stays null. A rustc commit hash is
-inferred from a read-only `/rustc/<40-hex>/` path and does not by itself
-identify the compiler. See [Rust binaries](https://github.com/morluto/rea/blob/main/docs/rust-binaries.md).
-
-## PE Authenticode certificate tables
-
-Use `inspect_pe_certificates` for an explicit local PE32/PE32+ image when the
-question concerns the Authenticode certificate table, WIN_CERTIFICATE types, or
-embedded PKCS#7 signer and X.509 identity fields. No `open_binary`, Windows SDK,
-or target execution is required. The CLI equivalent is
-`inspect-pe-certificates PATH`. Preserve artifact SHA-256, table file ranges,
-payload hashes, original validity-time spellings, and
-`subject_key_identifier_hex` when the signer uses that form. A missing
-`IMAGE_DIRECTORY_ENTRY_SECURITY` directory is observed absence of that table,
-not proof the image is unsigned in every catalog or overlay sense. Signatures,
-chains, timestamps, and Authenticode digest coverage remain unobserved. See
-[PE Authenticode certificate tables](https://github.com/morluto/rea/blob/main/docs/pe-certificates.md).
-
-## PE import and delay-load tables
-
-Use `inspect_pe_imports` for an explicit local PE32/PE32+ image when the
-question concerns imported DLL and function names, ordinals, delay-load
-descriptors, or the pefile import hash. No `open_binary`, Windows SDK, or
-target execution is required. The CLI equivalent is `inspect-pe-imports PATH`.
-Preserve artifact SHA-256, directory file ranges, original DLL spellings, and
-ILT/IAT RVAs. A missing `IMAGE_DIRECTORY_ENTRY_IMPORT` directory is observed
-absence of that table, not proof the image never imported APIs through another
-table or overlay. Bound snapshots, loaded IAT contents, and export-forward
-resolution remain unobserved. See
-[PE import and delay-load tables](https://github.com/morluto/rea/blob/main/docs/pe-imports.md).
-
-## PE TLS callbacks and load configuration
-
-Use `inspect_pe_load_config` for an explicit local PE32/PE32+ image when the
-question concerns code that runs before the entry point through TLS callbacks,
-or the security cookie, SafeSEH, CFG, EH-continuation and XFG declarations in
-the load configuration. No `open_binary`, Windows SDK, or target execution is
-required. The CLI equivalent is `inspect-pe-load-config PATH`. Preserve artifact
-SHA-256, directory and callback-array file ranges, and callback VAs as
-hexadecimal strings. Fields outside the declared `Size` are `null`. Guard-flag
-mitigations carry `evidence_kind: "inferred"`; enforcement remains unobserved.
-See
-[PE TLS callbacks and load configuration](https://github.com/morluto/rea/blob/main/docs/pe-load-config.md).
-
-## Binary hardening
-
-Use `inspect_binary_hardening` for an explicit local ELF, PE, or Mach-O file
-when the question concerns PIE or ASLR, NX, RELRO, stack-protector or FORTIFY
-signs, control-flow flags, or stripped state. No `open_binary`, pwntools, or
-target execution is required. The CLI equivalent is
-`inspect-binary-hardening PATH`. Universal Mach-O files return one image per
-slice. A missing import is `unknown`, not proof the protection was omitted.
-Authenticode and Mach-O code-signature rows report presence, not validity.
-`hardened_runtime` stays unknown and names `inspect_signature`. See
-[binary hardening](https://github.com/morluto/rea/blob/main/docs/binary-hardening.md).
-
-## ELF note tables
-
-Use `inspect_elf_notes` for an explicit local ELF32/ELF64 image when the
-question concerns PT_NOTE/SHT_NOTE owners, GNU build-id, or GNU ABI-tag
-fields. No `open_binary` or target execution is required. The CLI equivalent
-is `inspect-elf-notes PATH`. Preserve artifact SHA-256, table file ranges,
-descriptor hashes, and original owner spellings. A missing table is observed
-absence of those declarations, not proof the image never carried notes in
-another container. See
-[ELF note tables](https://github.com/morluto/rea/blob/main/docs/elf-notes.md).
-
-## Apple IPS crash reports
-
-Use `inspect_apple_ips` for an explicit local Apple `.ips` file when the
-question concerns crash metadata, exception and termination facts, threads,
-usedImages, lossless registers, or documented crash classes. No `open_binary`,
-Xcode, atos, or target execution is required. The CLI equivalent is
-`inspect-apple-ips PATH`. Preserve artifact SHA-256, `bug_type` as a string,
-uppercase image UUIDs, and integer literals that exceed IEEE-754 range. Only
-`bug_type` `"309"` yields a crash body; other DiagnosticReports types return
-no crash result. Opened Mach-O and dSYM UUID joins remain unobserved. See
-[Apple IPS crash reports](https://github.com/morluto/rea/blob/main/docs/apple-ips.md).
-
-## Linux kernel modules
-
-Use `inspect_kernel_module` for an explicit local ELF32/ELF64 relocatable
-object when the question concerns `.modinfo` license, vermagic, alias,
-depends, or parm strings, the `__versions` symbol CRCs, or an appended module
-signature trailer. No `open_binary`, Linux host, or `modinfo` program is
-required. The CLI equivalent is `inspect-kernel-module PATH`. Preserve
-artifact SHA-256, key order, duplicate keys, CRC hex, and section file ranges.
-A missing section is observed absence when section names are known, not proof
-the module never carried that metadata. `.gnu.linkonce.this_module` is reported
-as present or absent; `struct module` stays unknown because its layout changes
-with the kernel version. `__ksymtab` records are not decoded. The PKCS#7 range
-and its SHA-256 are observed; certificate, signer, and digest coverage remain
-unvalidated. An absent trailer is not proof the module is unsigned in another
-container. gzip, xz, and zstd whole-file containers are unsupported and name
-`external_decompression` as the next probe: use an external codec utility to
-decompress into a separate file, then call `inspect_kernel_module` on that file. See
-[Linux kernel modules](https://github.com/morluto/rea/blob/main/docs/kernel-modules.md).
-
-## CPython pyc files
-
-Use `inspect_python_pyc` for an explicit local CPython 3.7–3.13 `.pyc` when the
-question concerns the header magic, PEP 552 source hash or timestamp, nested
-code-object names, or bytecode identity. No `open_binary`, Python installation,
-or target execution is required. The CLI equivalent is `inspect-python-pyc PATH`.
-Preserve artifact SHA-256, the 16-byte header fields, nested code names, and
-bytecode SHA-256. Bytecode is not decompiled. A decoded header does not prove
-the matching `.py` is present. See [CPython pyc inspection](https://github.com/morluto/rea/blob/main/docs/python-pyc.md).
-
-## Erlang BEAM files
-
-Use `inspect_erlang_beam` for an explicit local `FOR1`/`BEAM` file when the
-question concerns IFF chunks, atom names, exports, imports, lambdas, or the
-Code header. No `open_binary`, Erlang installation, or bytecode execution is
-required. The CLI equivalent is `inspect-erlang-beam PATH`. Preserve artifact
-SHA-256, chunk file ranges, 1-based atom indices, and original atom spellings.
-Missing optional tables stay null. For a few facts, use `detail: "summary"` with
-a `beam` view selecting a collection, exact names/indices and fields; read later
-pages from `parent_evidence_id` or the complete Evidence bundle. Same-name
-exports retain every arity and original atom index. CLI summary delivery requires
-`--evidence_output`. Null table counts remain distinct from decoded empty tables. See
-[Erlang BEAM files](https://github.com/morluto/rea/blob/main/docs/erlang-beam.md).
-
-## SQLite snapshots
-
-Use `inspect_sqlite_database` with an explicit local database snapshot for its
-schema and optional rows from one exact ordinary table. It requires Node.js
-24.x >=24.15 or 26+ with the native `DatabaseSync.limits` API. It also consumes the
-existing sibling `-wal`; retain both original digests when citing its result.
-Default output is a compact inventory; a selected table expands only its own
-schema and samples 20 rows. Select `columns` to avoid irrelevant or large cells,
-and request `schema_scope: "database"` only for complete schema details.
-Choose `row_limit` when a finite sample is useful and keep truncation and
-unspecified row order explicit. Virtual tables, shadow tables and views are
-schema facts, not row-read targets. REA inspects private copies and leaves
-the source files untouched; obtain a coherent quiescent database/WAL snapshot
-before inspection. See [SQLite snapshots](https://github.com/morluto/rea/blob/main/docs/guides/data/sqlite-databases.md).
-
-## Recorded Linux crashes
-
-Use `inspect_recorded_crash` with an explicit Linux x86-64 ELF core path to
-inspect historical thread registers, signals, raw notes and original file
-ranges. It is independent of the active disassembler target. Source-bound
-register values and note bytes are observations; missing notes, signal-thread
-association and current executable/library identity remain unknown. PIDs are
-historical metadata and never authorize live attach or control.
-
-The optional `include_debugger_context` facet adds mapping candidates through
-caller-supplied GDB/pwndbg in an owned core-only session. Display names do not
-establish current file identity; zero reported flags leave permissions unknown.
-Requested unavailable context fails with setup guidance. See
-[recorded crashes](https://github.com/morluto/rea/blob/main/docs/guides/native/recorded-crashes.md)
-for exact upstream profiles, bounds and verification coverage.
-
-## Offline ELF layout
-
-Use `inspect_binary_layout` with an explicit local ELF path for file-backed
-sections, symbols, relocations, linkage names, and static mitigation inferences
-without opening a disassembler target. When that complete record is already
-retained, call `inspect_analysis_view` for a summary, mitigations or linkage
-facet, one section or symbol, or a stable page. Do not re-run the decoder to
-read a single object.
-
-## Offline WASM
-
-Use `inspect_wasm_artifact` with caller-supplied WABT for selected local bytes.
-For counts, validation and WAT identity, select `detail: "summary"` on the first
-MCP call. The complete original Evidence stays retained; use
-`normalized_result.parent_evidence_id` for exact exports or text pages. Omitted
-or complete detail keeps the existing complete result.
-For a completed result, use `inspect_analysis_view` with its reported retained
-reference for a summary or `view: {kind: "wasm", facet: "exports", offset: 0, limit: 32}`.
-Facets also include sections, imports, candidates, glue, WAT, headers, details
-and tool profile. Text offsets count UTF-16 code units; follow `next_offset`.
-The complete source remains retained after an oversized MCP reply. No target
-execution or network acquisition is implied, and WAT is decoded representation.
-
-## Offline APK signatures
-
-Use `inspect_apk_signature` for a selected local APK/ZIP/AAB. Default MCP summaries
-retain complete Evidence. Select `view.collection: signers/digests/lineage`,
-with scheme or ID batches, fields and paging; use `inspect_analysis_view` kind
-`apk-signature` for retained reads after deletion. IDs retain artifact/scheme
-scope and signer links; `fields: []` keeps identity links. Empty pages preserve
-partial decoding reasons and unknown authenticity. CLI compact delivery needs
-`--evidence_output` to preserve the complete parent.
-It reads the APK
-Signing Block (v2/v3/v3.1) and v1 `META-INF` signing without executing anything,
-and reports each signer's certificate facts (for v1, the certificate the PKCS#7
-block's SignerInfo names), the declared v3 rotation lineage,
-the declared source-stamp certificate and, for SHA-256/SHA-512 digests, whether
-the declared content digest matches the current bytes. That match is not a
-signature verification: anyone who changes the bytes can recompute the digest.
-`posture` summarises v1-only signing (which cannot tell a v1-only APK from one
-whose v2/v3 block was removed), observed signer agreement across schemes,
-whether the v1 signer equals the block-scheme signer (`false` is notable),
-whether every differing signer appears in a declared (unverified) rotation
-lineage, and the strongest scheme.
-It never claims authenticity: no signature or lineage is cryptographically
-verified.
-
 ## Native targets

+For an existing IDA MCP configuration, use `open_binary` with the original
+input binary and `provider_id: "ida"`; do not pass an `.idb` or `.i64` database.
+The legacy attached profile binds the already-open GUI input by SHA-256 and
+leaves its database open. The modern headless profile creates and closes an
+owned private database without saving. Installation and registration reuse
+[mrexodia/ida-pro-mcp](https://github.com/mrexodia/ida-pro-mcp); see the
+[IDA provider guide](https://github.com/morluto/rea/blob/main/docs/providers/ida-provider.md).
+For migration to the separate native IDA MCP plugin, follow the guide's
+[legacy attached migration](https://github.com/morluto/rea/blob/main/docs/providers/ida-provider.md#migrate-a-legacy-attached-registration).
+Replace the upstream registration explicitly; modern mrexodia tools are not the
+native profile. Native attachment preserves the database but does not provide
+direct callers; check session availability and the guide's verification limits.
+Proceed directly to `analyze_function`, pseudocode, or function/string searches
+after opening; IDA does not supply `binary_overview`. Consult session availability
+when composing broader workflows. Modern direct callers and unsupported dossier
+facets remain unknown; live IDA results are not replayed from snapshots.
+
+With `REA_KUNA_COMMAND` configured, `provider_id: "kuna"` answers procedure
+lists, lookups, pseudocode, assembly and `analyze_function` from Kuna's cached
+whole-program export. Callers/callees use a separate body-free graph shared by
+the session; `xrefs` returns exact-address incoming sites and filters forwarding
+aliases. These queries and inventory lookups do not trigger a C export. Indirect
+targets remain unknown and can make relationship coverage partial. Reference
+caches expire on close; a fresh CLI process repeats the native reference walk.
+Typed references, CFG, raw-memory tools and annotations remain unsupported. A cold first
+answer can come from a single-function run (its limitations say so); assembly
+waits for the export. For pseudocode and assembly, `raw_result.source` names the
+cached `.c`/`.asm` file and byte span, which you may search directly instead of
+calling per function. See the
+[Kuna provider guide](https://github.com/morluto/rea/blob/main/docs/kuna-provider.md).
+
 After `open_binary`, use focused search, procedure, or function tools directly.
 Use `binary_overview` when target metadata or inventory context helps answer the
 question. Prefer literal search, names, decompilation, callers, callees, and
@@ -548,6 +349,8 @@ that a class is a root class or has no ivars.

 ## Managed PE/CLI

+<a id="managed-pe-cli-guide"></a>
+
 Start with `inspect_managed_artifact`. REA's canonical managed inspection is
 execution-free: do not claim it loaded, reflected, executed, or resolved the
 assembly. Keep managed/native boundaries and unavailable reconstruction facts
@@ -606,81 +409,17 @@ and distinguish derived metadata from Ghidra database observations. Recovered
 types and native pseudocode are not original C# source. Windows Ghidra P0 has
 no database mutation authority.

-## Packages and extraction
+For headerless firmware and address-bearing containers, read
+[raw images](firmware-and-raw-images.md#headerless-raw-images-and-firmware-containers).

-Use `inspect_artifact` for application bundles, archives, ZIP/APK/IPA/MSIX/AppX,
-ASAR, or DMG inputs when the artifact graph and findings help answer the
-question. It returns the complete artifact graph inline. Cite graph manifest
-IDs when using them.
-
-For an IPA or a macOS `.app`, ZIP, or DMG, pass the inventory Evidence to
-`project_apple_application_graph`. It reports application roots and nested
-bundles by path convention: app extensions, XPC services, frameworks, login
-items, system and driver extensions, and plug-ins. It also lists privileged
-helpers, launchd plists, symlinks, and each bundle's `info_plist_path` and
-executable candidates. Roles are path conventions, not parsed plists; read the
-listed plists with `inspect_plist`.
-
-After `open_binary` on a `.app` or Mach-O, use `trace_dylib_resolution` to see
-which file each `@rpath`, `@loader_path` and `@executable_path` load reaches for
-every executable in the bundle. It also lists missing or weak loads and earlier
-`@rpath` candidates that are absent. Narrow large bundles with `roots` or
-`architecture`. System paths stay undetermined because the dyld shared cache
-provides them.
-
-Use `extract_artifact` when materialized files from a supported format are needed.
-It extracts the active target and accepts optional `integrity_policy`; see the [MCP contracts](https://github.com/morluto/rea/blob/main/docs/reference/mcp-contracts.md).
-It materializes all regular files into a fresh temporary directory chosen by
-REA. Symlinks and encrypted entries are inventory facts, not extractable files.
-The result reports the materialized directory; callers do not choose the
-destination. No separate permission grant is needed.
-
-For classic iNES cartridges, `open_binary` recognizes the byte signature without
-an executable architecture. `inspect_artifact` retains header facts and each
-PRG/CHR file unit's offset, length and SHA-256; its nested inventory's
-`ines.reconstruction` verifies the actual ordered region bytes against the
-whole-file digest. Extraction includes the original header, optional trainer
-and uninterpreted trailing bytes. These file units are not mapper/CPU bank
-maps. NES 2.0, UNIF, dirty legacy headers and truncated payloads are explicitly
-refused. No emulator or 6502 analysis is performed. See the
-[iNES guide](https://github.com/morluto/rea/blob/main/docs/ines-containers.md).
-
-Native DMG traversal automatically uses a read-only mount on supported macOS
-hosts, with an owned temporary mount directory and cleanup. It needs no approval
-flag. Unsupported hosts or mount failures remain explicit limitations; do not
-claim child inventory when only root identity is available. DMG extraction is
-unavailable through `extract_artifact`. To access DMG files on macOS, create a
-read-only mount with your own tools, select files from that mount for analysis,
-and detach the mount you created when finished. REA's inspection mount is
-temporary, not a retained export of the image's contents.
+## DOS COM loader interpretation

 For headerless DOS COM, explicitly open with `format: "dos-com"` (CLI
 `--target-format dos-com`). Inspect the load image before trusting function
 analysis: the entry is `0x10100`, file offset zero, with imposed real-mode segment
 context. PSP/stack/device state remains unmodeled. See [DOS guide](https://github.com/morluto/rea/blob/main/docs/providers/ghidra-dos.md).

-Use `inspect_byte_entropy` to triage high- and low-entropy ranges before extraction.
-
-For other headerless images (embedded firmware without ELF/Mach-O/PE/MZ
-headers), open with `format: "raw-binary"`, `architecture` (`x86`, `x86_64`,
-`arm`, `arm64`, `6502`, or `m68k`), and `entry_point` (`0x` hex). File offset 0 is mapped at
-that address. Hopper and IDA refuse this interpretation; Ghidra uses
-`BinaryLoader` with a generic language: big-endian for `m68k`, little-endian
-otherwise. Big-endian ARM, Thumb-only, and Cortex-M variants are unsupported.
-`6502` selects NMOS 6502; the entry and complete file mapping must fit within
-`0x0000..0xffff`. 65C02, 65816, cartridge containers, bank switching, and mapper
-semantics are unsupported. `m68k` requires an even entry and decodes the 68040
-superset of the 68000 family; Amiga/Atari containers and vector-table entry
-discovery are unsupported. Windows Ghidra P0 admits raw images only for `6502`. See [raw binary guide](https://github.com/morluto/rea/blob/main/docs/providers/raw-binary.md).
-
-Intel HEX, S-record, UF2 and DfuSe files are containers, not raw images:
-`inspect_artifact` lists address regions (UF2 per familyID, DfuSe per element
-with its alternate setting), and `extract_artifact` writes each region. Open an
-extracted region as `raw-binary` with its start address as `entry_point`. UF2
-numbering gaps leave coverage unknown; a DfuSe suffix CRC mismatch follows
-`integrity_policy`. See [UF2 and DfuSe](https://github.com/morluto/rea/blob/main/docs/uf2-dfuse.md).
-
-### Function annotations in Ghidra
+## Function annotations in Ghidra

 Fresh-import sessions admit annotations; existing-project reuse is read-only.
 Use `annotate_native_function` for one function name and/or entry comments, with at least one explicit change. Review its annotation readback and refreshed dossier inline. Changes are atomic; empty comments clear them, omitted fields preserve them. Later MCP calls observe edits. Normal close saves them when owned Program checkpoint mode is enabled; ephemeral mode discards them. CLI `annotate-native-function` follows the same setting when closing after its updated result. Select the [checkpoint workflow](#continue-editable-ghidra-analysis-across-processes) before edits that must survive a later process. Original executable bytes are unchanged; edits invalidate immutable snapshots. Windows P0 does not admit database mutations. For naming only, `set_address_name` / `set_addresses_names` also work with Ghidra: they name function entries or data addresses (primary labels) and return compact per-address success booleans instead of a dossier. Ghidra rejects batch addresses that request the same name or a name another selected address holds; `raw_result.failures` gives each failure's reason.
@@ -700,139 +439,33 @@ architecture, provider-owned mapping and selected-image commitments. Equal
 numeric addresses alone cannot establish correspondence; inspect retained
 source Evidence and coverage when the match remains ambiguous.

-## Offline PE resource inventory
+## Other artifact guides

-Use `inspect_pe_resources` with an absolute `path`, or
-`rea inspect-pe-resources ./selected.exe --json`, for portable PE32/PE32+
-resource inspection without opening a native target. Preserve returned Evidence:
-type/name/language IDs and UTF-16 names, original directory/data/payload ranges,
-code pages, payload hashes and static icon-group references. Same-language icon
-resolution is explicit; missing references and size mismatch remain visible.
-Other payloads are opaque, and this operation does not decode images or simulate
-Windows resource loading. Consult the budgets and supported tree profile in
-[offline binary diagnostics](https://github.com/morluto/rea/blob/main/docs/guides/native/binary-diagnostics.md).
+Read the owning page for offline formats, containers or firmware. These explicit
+anchors preserve older links without creating duplicate searchable sections.

-## Offline PE and ELF export tables
-
-Use `inspect_native_exports` with an absolute `path`, or
-`rea inspect-native-exports ./libexample.so --json`, to read a PE export
-directory or ELF dynamic symbol table on any host without opening a native
-target. Ordinal-only, forwarded and hidden-version exports stay distinct;
-partial or unsupported coverage means the inventory is incomplete, not that
-exports are absent. Use `inspect_macho` for Mach-O. See
-[offline binary diagnostics](https://github.com/morluto/rea/blob/main/docs/guides/native/binary-diagnostics.md).
-
-For exact core-module import/export differences, use `compare_wasm_interfaces`
-with two complete inspection Evidence records (or current-session retained
-references) and explicit scope. Preserve unknown types/duplicate names; static
-interface equality is not runtime compatibility. CLI accepts complete inline
-Evidence in `rea compare-wasm-interfaces input.json --json`, or exact references
-with `--evidence-bundle /absolute/path/evidence.json`. Use the complete parent
-ID when the inspection returned a summary.
-
-## Godot PCK
-
-For a standalone PCK, `open_binary` then `inspect_artifact` with
-`detail: "summary"` retains the complete static inventory. Use the returned
-`parent_evidence_id` with `inspect_analysis_view` inventory occurrences filtered
-by exact `logical_paths` or `occurrence_ids`, and join `artifact_id` to nodes
-filtered by `artifact_ids`. Select only needed fields; identity links remain.
-Prefer `inspect-artifact --detail summary --evidence_output PATH` for CLI tasks;
-the same CLI discovers embedded packs via their EOF trailer without opening a
-native analysis provider. Normal native opening remains unchanged.
-
-Distinguish declared MD5 from observed SHA-256 and graph/page completeness from
-`source_coverage`. Encrypted directories and sparse bundles have unknown entry
-coverage; encrypted members have unknown content identity. An empty filtered
-page cannot prove absence in unknown coverage. Retained views are historical,
-not fresh filesystem checks. No decryption, Godot resource decoding, GDScript
-decompilation or target execution is provided. See
-[Godot PCK](https://github.com/morluto/rea/blob/main/docs/godot-pck.md).
-
-UnityFS AssetBundle containers (`.bundle`, `.ab`, YooAsset packages and other
-byte-identified files) list `CAB-*` SerializedFiles and `.resS` members with
-header and node facts; none/LZ4/LZ4HC member blocks stream on demand. Bundles
-declaring asset-bundle encryption keep header facts with unknown directory
-coverage; LZMA member bytes retain named occurrences with unavailable hashes.
-Virtual member offsets are not physical carrier locations. Format 6–8 readers
-cache one decoded block and support retained filtered/paged views. No
-decryption or SerializedFile object decoding is provided. See
-[UnityFS](https://github.com/morluto/rea/blob/main/docs/unityfs.md).
-
-WeChat mini-program packages (`.wxapkg` files with `0xBE`/`0xED` marks) list
-members with declared names and absolute carrier offsets; member bytes are
-stored verbatim. `V1MMWX` PC-client packages report `encrypted` directory
-status with unknown coverage and are refused on extraction; no decryption is
-attempted. See
-[wxapkg](https://github.com/morluto/rea/blob/main/docs/wxapkg.md).
-
-U-Boot legacy uImages use the same inspection/extraction workflows. Prefer a
-retained summary and selected inventory views for header facts or component
-IDs. Header addresses/CPU/OS are declarations; payloads remain as stored.
-Multi-file components retain their aligned physical ranges; the full payload
-is also materialized. Unknown name text retains its original 32 bytes. See
-[U-Boot uImage](https://github.com/morluto/rea/blob/main/docs/uimage.md).
-
-## ESP images
-
-For an ESP32-family app or bootloader image, `open_binary` then
-`inspect_artifact` with `detail: "summary"`. `root_format_metadata` holds the
-observed `header` and `descriptor` (its `kind` is the app or bootloader role)
-and the derived `chip`, `checksum`, `appended_sha256` and
-`undescribed_trailing` ranges. Segment rows (`segment-NN.bin`) carry
-`load_addr`, `classification` (`mapped`, `loaded`, `not-loaded` or `unknown`,
-per ESP-IDF `should_map`/`should_load`; RAM ranges are not checked) and
-`source_location`; select them with `inspect_analysis_view` and
-`logical_paths`. Signature blocks are `unverified`; `public_key_sha256`
-matches eFuse key digests.
-
-Unknown `source_coverage` means truncation or undescribed trailing bytes, such
-as the flash segments of a `--ram-only-header` image; do not infer absence
-from it. Erased flash is described. Integrity mismatches are facts, not
-refusals. ESP8266 images are refused, and flash-encrypted images are not
-recognized. Segments are not disassembled, and RISC-V or Xtensa segments
-cannot be opened as raw-binary. See
-[ESP images](https://github.com/morluto/rea/blob/main/docs/esp-image.md).
-
-## ESP flash images
-
-A whole-flash dump opens as `esp-flash-image`. `root_format_metadata` holds
-`partition_table` (its `method`: `default`, `caller` or a derived
-`scan`), `bootloader` and `apps` ESP image facts, the `otadata` records,
-`partitions_outside_dump` and `boot_selection`. Every table has a
-`boot_selection`: its `basis` names the bootloader's branch (`no-otadata`
-without otadata, `none` when the bootloader rejects the table, `unknown`
-when a record is missing), and it lists its `assumptions`;
-`running_partition` is always `unknown`. Each image names its entry
-`path`. With `detail: "summary"` the root kind is `esp-flash-image-summary`
-and each image is a compact `summary` (chip, entry point, segment count,
-classified load ranges, signature block count, descriptor identity,
-integrity); complete detail keeps every segment. Partition rows
-(`partitions/<label>.bin`) carry the declared `type`, `subtype`, names,
-`flash_address`, `size` and flags; `encrypted` is a storage flag, not
-proof of ciphertext. `written_offset`/`written_end` bound the bytes that
-are not erased: an app slot whose facts say `erased` can still hold an older
-image, and a limitation says so. For a dump read from another flash address, call
-`open_binary` with `format: "esp-flash-image"` and `flash_offset`; an
-`esp-image` whose `flash_dump` is set names that offset in a next probe; a
-relocated table can be named with `partition_table_offset`. No table found
-means unknown, often flash encryption. Extraction writes `nvs_keys` as
-ordinary data. See
-[ESP flash images](https://github.com/morluto/rea/blob/main/docs/esp-flash-image.md).
-
-## Bun standalone executables
-
-A `bun build --compile` executable stores its module graph in Mach-O
-`__BUN,__bun`, a PE or ELF `.bun` section, or an appended trailer.
-`open_binary` then `inspect_artifact` reports root format `bun-standalone` with
-the carrier, structural layout, module count, entry point, raw flags and
-compile exec-argv; each module keeps its `/$bunfs/...` source name, loader,
-encoding, sizes and SHA-256, with sourcemap, bytecode and module-info regions as
-separate children. Use summary root metadata `entry_point_logical_path` as the
-exact inventory `logical_paths` selector, then read the selected content node by
-its artifact ID; the reader owns virtual-name normalization and indexed fallback. `extract-artifact` writes stored contents through the safe
-output tree; route extracted JavaScript to `analyze_javascript_application`.
-Layout labels describe record shapes, not a detected compiler version; unknown
-or ambiguous layouts are unsupported. Bytecode is retained, not decoded, and the
-executable is never run. See
-[Bun standalone executables](https://github.com/morluto/rea/blob/main/docs/bun-standalone.md).
+- <a id="go-build-metadata"></a>[Go build metadata](format-inspectors.md#go-build-metadata)
+- <a id="model-files"></a>[Model files](format-inspectors.md#model-files)
+- <a id="il2cpp-metadata"></a>[IL2CPP metadata](format-inspectors.md#il2cpp-metadata)
+- <a id="rust-dependency-metadata"></a>[Rust dependency metadata](format-inspectors.md#rust-dependency-metadata)
+- <a id="pe-authenticode-certificate-tables"></a>[PE Authenticode certificate tables](format-inspectors.md#pe-authenticode-certificate-tables)
+- <a id="pe-import-and-delay-load-tables"></a>[PE import and delay-load tables](format-inspectors.md#pe-import-and-delay-load-tables)
+- <a id="pe-tls-callbacks-and-load-configuration"></a>[PE TLS callbacks and load configuration](format-inspectors.md#pe-tls-callbacks-and-load-configuration)
+- <a id="binary-hardening"></a>[Binary hardening](format-inspectors.md#binary-hardening)
+- <a id="elf-note-tables"></a>[ELF note tables](format-inspectors.md#elf-note-tables)
+- <a id="apple-ips-crash-reports"></a>[Apple IPS crash reports](format-inspectors.md#apple-ips-crash-reports)
+- <a id="linux-kernel-modules"></a>[Linux kernel modules](format-inspectors.md#linux-kernel-modules)
+- <a id="cpython-pyc-files"></a>[CPython pyc files](format-inspectors.md#cpython-pyc-files)
+- <a id="erlang-beam-files"></a>[Erlang BEAM files](format-inspectors.md#erlang-beam-files)
+- <a id="sqlite-snapshots"></a>[SQLite snapshots](format-inspectors.md#sqlite-snapshots)
+- <a id="recorded-linux-crashes"></a>[Recorded Linux crashes](format-inspectors.md#recorded-linux-crashes)
+- <a id="offline-elf-layout"></a>[Offline ELF layout](format-inspectors.md#offline-elf-layout)
+- <a id="offline-wasm"></a>[Offline WASM](format-inspectors.md#offline-wasm)
+- <a id="offline-apk-signatures"></a>[Offline APK signatures](format-inspectors.md#offline-apk-signatures)
+- <a id="packages-and-extraction"></a>[Packages and extraction](packages-and-archives.md#packages-and-extraction)
+- <a id="offline-pe-resource-inventory"></a>[Offline PE resource inventory](format-inspectors.md#offline-pe-resource-inventory)
+- <a id="offline-pe-and-elf-export-tables"></a>[Offline PE and ELF export tables](format-inspectors.md#offline-pe-and-elf-export-tables)
+- <a id="godot-pck"></a>[Godot PCK](packages-and-archives.md#godot-pck)
+- <a id="esp-images"></a>[ESP images](firmware-and-raw-images.md#esp-images)
+- <a id="esp-flash-images"></a>[ESP flash images](firmware-and-raw-images.md#esp-flash-images)
+- <a id="bun-standalone-executables"></a>[Bun standalone executables](packages-and-archives.md#bun-standalone-executables)
@@ -0,0 +1,124 @@
+# Packages and archives
+
+Read only the sections needed for the selected task.
+
+- [Packages and extraction](#packages-and-extraction)
+- [Godot PCK](#godot-pck)
+- [Bun standalone executables](#bun-standalone-executables)
+
+## Packages and extraction
+
+For PyInstaller executables, the CArchive is the application layer; the native
+bootloader is only its prefix. Prefer summary delivery for large inventories,
+then retained inventory views with selected member fields/pages. Runtime options
+are metadata, not files. Compact delivery still inventories and hashes members.
+A small complete inventory can cost less than extra calls and schemas. See the
+[Python packaged applications guide](https://github.com/morluto/rea/blob/main/docs/python-packaged-applications.md).
+
+Use `inspect_artifact` for application bundles, archives, ZIP/APK/IPA/MSIX/AppX,
+ASAR, or DMG inputs when the artifact graph and findings help answer the
+question. It returns the complete artifact graph inline. Cite graph manifest
+IDs when using them.
+
+For an IPA or a macOS `.app`, ZIP, or DMG, pass the inventory Evidence to
+`project_apple_application_graph`. It reports application roots and nested
+bundles by path convention: app extensions, XPC services, frameworks, login
+items, system and driver extensions, and plug-ins. It also lists privileged
+helpers, launchd plists, symlinks, and each bundle's `info_plist_path` and
+executable candidates. Roles are path conventions, not parsed plists; read the
+listed plists with `inspect_plist`.
+
+After `open_binary` on a `.app` or Mach-O, use `trace_dylib_resolution` to see
+which file each `@rpath`, `@loader_path` and `@executable_path` load reaches for
+every executable in the bundle. It also lists missing or weak loads and earlier
+`@rpath` candidates that are absent. Narrow large bundles with `roots` or
+`architecture`. System paths stay undetermined because the dyld shared cache
+provides them.
+
+Use `extract_artifact` when materialized files from a supported format are needed.
+It extracts the active target and accepts optional `integrity_policy`; see the [MCP contracts](https://github.com/morluto/rea/blob/main/docs/reference/mcp-contracts.md).
+It materializes all regular files into a fresh temporary directory chosen by
+REA. Symlinks and encrypted entries are inventory facts, not extractable files.
+The result reports the materialized directory; callers do not choose the
+destination. No separate permission grant is needed.
+
+For classic iNES cartridges, `open_binary` recognizes the byte signature without
+an executable architecture. `inspect_artifact` retains header facts and each
+PRG/CHR file unit's offset, length and SHA-256; its nested inventory's
+`ines.reconstruction` verifies the actual ordered region bytes against the
+whole-file digest. Extraction includes the original header, optional trainer
+and uninterpreted trailing bytes. These file units are not mapper/CPU bank
+maps. NES 2.0, UNIF, dirty legacy headers and truncated payloads are explicitly
+refused. No emulator or 6502 analysis is performed. See the
+[iNES guide](https://github.com/morluto/rea/blob/main/docs/ines-containers.md).
+
+Native DMG traversal automatically uses a read-only mount on supported macOS
+hosts, with an owned temporary mount directory and cleanup. It needs no approval
+flag. Unsupported hosts or mount failures remain explicit limitations; do not
+claim child inventory when only root identity is available. DMG extraction is
+unavailable through `extract_artifact`. To access DMG files on macOS, create a
+read-only mount with your own tools, select files from that mount for analysis,
+and detach the mount you created when finished. REA's inspection mount is
+temporary, not a retained export of the image's contents.
+
+Use `inspect_byte_entropy` to triage high- and low-entropy ranges before extraction.
+
+## Godot PCK
+
+For a standalone PCK, `open_binary` then `inspect_artifact` with
+`detail: "summary"` retains the complete static inventory. Use the returned
+`parent_evidence_id` with `inspect_analysis_view` inventory occurrences filtered
+by exact `logical_paths` or `occurrence_ids`, and join `artifact_id` to nodes
+filtered by `artifact_ids`. Select only needed fields; identity links remain.
+Prefer `inspect-artifact --detail summary --evidence_output PATH` for CLI tasks;
+the same CLI discovers embedded packs via their EOF trailer without opening a
+native analysis provider. Normal native opening remains unchanged.
+
+Distinguish declared MD5 from observed SHA-256 and graph/page completeness from
+`source_coverage`. Encrypted directories and sparse bundles have unknown entry
+coverage; encrypted members have unknown content identity. An empty filtered
+page cannot prove absence in unknown coverage. Retained views are historical,
+not fresh filesystem checks. No decryption, Godot resource decoding, GDScript
+decompilation or target execution is provided. See
+[Godot PCK](https://github.com/morluto/rea/blob/main/docs/godot-pck.md).
+
+UnityFS AssetBundle containers (`.bundle`, `.ab`, YooAsset packages and other
+byte-identified files) list `CAB-*` SerializedFiles and `.resS` members with
+header and node facts; none/LZ4/LZ4HC member blocks stream on demand. Bundles
+declaring asset-bundle encryption keep header facts with unknown directory
+coverage; LZMA member bytes retain named occurrences with unavailable hashes.
+Virtual member offsets are not physical carrier locations. Format 6–8 readers
+cache one decoded block and support retained filtered/paged views. No
+decryption or SerializedFile object decoding is provided. See
+[UnityFS](https://github.com/morluto/rea/blob/main/docs/unityfs.md).
+
+WeChat mini-program packages (`.wxapkg` files with `0xBE`/`0xED` marks) list
+members with declared names and absolute carrier offsets; member bytes are
+stored verbatim. `V1MMWX` PC-client packages report `encrypted` directory
+status with unknown coverage and are refused on extraction; no decryption is
+attempted. See
+[wxapkg](https://github.com/morluto/rea/blob/main/docs/wxapkg.md).
+
+U-Boot legacy uImages use the same inspection/extraction workflows. Prefer a
+retained summary and selected inventory views for header facts or component
+IDs. Header addresses/CPU/OS are declarations; payloads remain as stored.
+Multi-file components retain their aligned physical ranges; the full payload
+is also materialized. Unknown name text retains its original 32 bytes. See
+[U-Boot uImage](https://github.com/morluto/rea/blob/main/docs/uimage.md).
+
+## Bun standalone executables
+
+A `bun build --compile` executable stores its module graph in Mach-O
+`__BUN,__bun`, a PE or ELF `.bun` section, or an appended trailer.
+`open_binary` then `inspect_artifact` reports root format `bun-standalone` with
+the carrier, structural layout, module count, entry point, raw flags and
+compile exec-argv; each module keeps its `/$bunfs/...` source name, loader,
+encoding, sizes and SHA-256, with sourcemap, bytecode and module-info regions as
+separate children. Use summary root metadata `entry_point_logical_path` as the
+exact inventory `logical_paths` selector, then read the selected content node by
+its artifact ID; the reader owns virtual-name normalization and indexed fallback. `extract-artifact` writes stored contents through the safe
+output tree; route extracted JavaScript to `analyze_javascript_application`.
+Layout labels describe record shapes, not a detected compiler version; unknown
+or ambiguous layouts are unsupported. Bytecode is retained, not decoded, and the
+executable is never run. See
+[Bun standalone executables](https://github.com/morluto/rea/blob/main/docs/bun-standalone.md).
@@ -0,0 +1,58 @@
+# Recorded captures and decoder discovery
+
+## Historical web captures
+
+Retained HAR/SAZ/native mitmproxy/aioquic qlog capture: `inspect_web_network_capture`. Select
+original record ordinals when useful; inspect producer fields and byte/number
+sidecars without fetching recorded URLs or claiming live attribution. For a decoder heap refusal, follow the reported `capture.decoder_old_generation_mib`
+setting and bounds with `update_analysis_settings` (default 192 MiB, floor 8,
+maximum 16384); the launch seed
+`REA_CAPTURE_DECODER_OLD_GENERATION_MIB` affects future REA processes. Host memory
+and `NODE_OPTIONS` do not raise that decoder allowance. See
+[historical captures](https://github.com/morluto/rea/blob/main/docs/guides/web/web-network-captures.md) for the exact upstream
+profile and credential exclusions. Qlog support starts with aioquic 1.5.0
+JSON 0.3; stream coverage and endpoint loss declarations do not recover bodies
+or establish network loss. Prefer detail summary, then kind qlog trace/stream
+pages; select one trace, stream ID and direction for contribution/range pages.
+Facts retain all-recorded-events-before-selection scope. Other qlog layouts
+and PCAP correlation are unsupported.
+
+## Packet fields and packet captures
+
+Packet-field discovery: `inspect_packet_fields` searches installed protocols
+and field names/types before choosing fields for `inspect_packet_capture`.
+Query/page the relevant records; registrations do not establish observed traffic.
+
+## Packet capture inspection
+
+Recorded packet captures: `inspect_packet_capture` with selected TShark fields,
+display filters and decode-as rules. Requires Linux, util-linux prlimit and
+TShark 4.x on an absolute `PATH` entry or via the optional absolute
+`REA_TSHARK_COMMAND` override; see
+[capture guide](https://github.com/morluto/rea/blob/main/docs/guides/data/packet-captures.md).
+Packet limits count input packets before filtering. Output defaults to 50 matching
+frames; use `match_offset` / `match_limit` for later pages, or explicit null
+limit for complete matching output. Preserve the source digest across pages.
+This does not perform live capture.
+For address/DNS/SNI/protocol summaries use `inspect_pcap_capture` with MCP
+detail summary, then retained kind pcap pages. Requires Wireshark 4.x tshark
+and capinfos, with Linux prlimit or Windows Job Objects; see
+[packet summaries](https://github.com/morluto/rea/blob/main/docs/guides/data/pcap-analysis.md).
+Select an exact DNS question for address pages; page exhaustion does not prove
+network completeness. This reads recordings and does not acquire traffic.
+
+## Signal decoder discovery
+
+Decoder discovery: `inspect_signal_decoders` searches installed decoder IDs
+or selected decoder help, including channels and options. Query and page the
+relevant details before choosing settings; this does not scan hardware.
+
+## Recorded logic and signals
+
+Recorded logic/signal traces: `decode_signal_recording` with explicit decoder,
+channel and protocol settings. On Linux with util-linux prlimit, supply sigrok-cli 0.7.2 through
+`REA_SIGROK_COMMAND`; see [recording guide](https://github.com/morluto/rea/blob/main/docs/guides/signals/signal-recordings.md).
+Output defaults to 50 literal lines; select annotation classes and page with
+`line_offset` / `line_limit`, or explicit null for all remaining output.
+Window counts are display lines, not annotations or samples. Preserve source digests across pages.
+This reads existing files; it does not acquire hardware signals.
@@ -1,5 +1,12 @@
 # Runtime observation

+Read only the sections needed for the selected task.
+
+- [Native runtime questions](#native-runtime-questions)
+- [Browser and Electron](#browser-and-electron)
+- [Who performs the action](#who-performs-the-action)
+- [Fiddler Everywhere traffic debugging](#fiddler-everywhere-traffic-debugging)
+
 ## Native runtime questions

 Start from the requested observation. State the selected target, input, expected
@@ -48,6 +55,18 @@ and [native calls/UI](https://github.com/morluto/rea/blob/main/docs/guides/nativ

 ## Browser and Electron

+Passive traffic capture of a SPA: the default scope is the page's own origin,
+and data APIs usually live on another origin. Discover API origins from
+absolute URLs in loaded bundles or script text via JavaScript analysis tools
+(another passive capture without those origins still scopes to the page
+origin, and `completeness.excluded` counts lack URLs). Pass both the page
+origin and those API origins in `allowed_origins` — the list replaces the
+default scope — and read `completeness.excluded` before reporting that an
+API is absent. For long captures with body shapes, use
+`export_evidence_bundle` instead of expecting an inline result.
+
+User-owned Electron runtime already open: `list_electron_targets`. Before an electron-main Inspector attempt, check packaged fuses with `inspect_electron_fuses`; disabled `EnableNodeCliInspectArguments` means the app ignores `--inspect`.
+
 Supply the existing browser or Electron instance's literal-port loopback CDP
 endpoint in the request. No separate permission configuration or per-call
 approval flag is needed. Browser discovery lists eligible HTTP(S) pages;
@@ -37,22 +37,21 @@ const generated = addSkillManifestToolCount(
  FULL_CATALOG_IDENTITY.counts.mcp_tools,
 );
 if (!generated.ok) throw generated.error;
-const source = generated.value.replaceAll(latestSpecifier, pinnedSpecifier);
 const paths = await filePaths(sourceRoot);
 // Rebuild this owned output directory so removed references cannot survive a build.
 if (!check) await rm(outputRoot, { recursive: true, force: true });
 for (const relativePath of paths) {
  const path = join(outputRoot, relativePath);
  if (!check) await mkdir(dirname(path), { recursive: true });
+  const content =
+    relativePath === "SKILL.md"
+      ? generated.value
+      : await readFile(join(sourceRoot, relativePath), "utf8");
  await ensureGeneratedFile({
    path,
-    source:
-      relativePath === "SKILL.md"
-        ? source
-        : (await readFile(join(sourceRoot, relativePath), "utf8")).replaceAll(
-            "\r\n",
-            "\n",
-          ),
+    source: content
+      .replaceAll("\r\n", "\n")
+      .replaceAll(latestSpecifier, pinnedSpecifier),
    check,
    generateCommand: "npm run docs:generate",
  });
@@ -34,6 +34,10 @@ export const MANAGED_SKILL_FILES = [
  "references/runtime-observation.md",
  "references/evidence-workflows.md",
  "references/environments.md",
+  "references/firmware-and-raw-images.md",
+  "references/packages-and-archives.md",
+  "references/format-inspectors.md",
+  "references/recorded-captures.md",
 ] as const;

 export const isManagedSkillManifest = (content: string): boolean =>
@@ -6,5 +6,5 @@ export const PACKAGE_METADATA = {
  serverSdkVersion: "2.3.1",
  clientSdkVersion: "2.3.1",
  coreSdkVersion: "2.3.1",
-  skillVersion: "60",
+  skillVersion: "62",
 } as const;
@@ -130,7 +130,7 @@ it("rejects missing, stale, and extra packaged references and removes deleted so
  await f.generate("--check");
 });

-it("pins authored `@latest` commands to the packaged version", async () => {
+it("pins authored entrypoint and reference commands to the packaged version", async () => {
  const f = await fixture();
  await writeFile(
    join(f.sourceRoot, "SKILL.md"),
@@ -139,10 +139,19 @@ it("pins authored `@latest` commands to the packaged version", async () => {
      "Run `npx -y rea-agents@latest doctor --json` first.",
    ),
  );
+  const reference =
+    "# Recovery\nRun `npx -y rea-agents@latest doctor --json`.\n";
+  await writeFile(join(f.sourceRoot, "references/guide.md"), reference);
  await f.generate();
  const generated = await readFile(join(f.outputRoot, "SKILL.md"), "utf8");
  expect(generated).toContain("npx -y [email protected] doctor --json");
  expect(generated).not.toContain("rea-agents@latest");
+  expect(
+    await readFile(join(f.outputRoot, "references/guide.md"), "utf8"),
+  ).toBe(reference.replaceAll("rea-agents@latest", "[email protected]"));
+  expect(
+    await readFile(join(f.sourceRoot, "references/guide.md"), "utf8"),
+  ).toBe(reference);
  await f.generate("--check");
 });

@@ -14,11 +14,12 @@ import {
  writeFile,
 } from "node:fs/promises";
 import { constants as fsConstants } from "node:fs";
-import { dirname, join } from "node:path";
+import { dirname, join, sep } from "node:path";
 import { describe, expect, it, vi } from "vitest";
 import { createTestTempDirectory } from "../../fixtures/temporaryDirectory.js";

 import {
+  MANAGED_SKILL_FILES,
  canonicalSkillNeedsInstall,
  existingSkillDestinations,
  installCanonicalSkill,
@@ -595,22 +596,15 @@ describe("canonical skill transaction", () => {
    expect(await readFile(`${nativeGuide}.rea.backup`, "utf8")).toBe(
      "stale filesystem-write permission grant\n",
    );
-    for (const reference of [
-      "connection-and-recovery.md",
-      "native-and-artifacts.md",
-      "javascript-applications.md",
-      "android-applications.md",
-      "runtime-observation.md",
-      "evidence-workflows.md",
-    ]) {
+    for (const relativePath of MANAGED_SKILL_FILES) {
      const installed = await readFile(
-        join(dirname(destination), "references", reference),
+        join(dirname(destination), relativePath),
        "utf8",
      );
      expect(installed).toBe(
        await readFile(
          new URL(
-            `../../../skills/reverse-engineer-anything/references/${reference}`,
+            `../../../skills/reverse-engineer-anything/${relativePath}`,
            import.meta.url,
          ),
          "utf8",
@@ -641,6 +635,15 @@ describe("canonical skill transaction", () => {
      ok: true,
      value: "unchanged",
    });
+    const packagedRoot = new URL(
+      "../../../skills/reverse-engineer-anything/",
+      import.meta.url,
+    );
+    const packagedPaths = (await readdir(packagedRoot, { recursive: true }))
+      .filter((path) => path.endsWith(".md"))
+      .map((path) => path.split(sep).join("/"))
+      .sort();
+    expect(packagedPaths).toEqual([...MANAGED_SKILL_FILES].sort());
    expect(await skillReferenceIssues(dirname(destination))).toEqual([]);
  });

@@ -650,16 +653,7 @@ describe("canonical skill transaction", () => {
      ok: true,
      value: "installed",
    });
-    const paths = [
-      "SKILL.md",
-      "references/android-applications.md",
-      "references/connection-and-recovery.md",
-      "references/environments.md",
-      "references/evidence-workflows.md",
-      "references/javascript-applications.md",
-      "references/native-and-artifacts.md",
-      "references/runtime-observation.md",
-    ];
+    const paths = [...MANAGED_SKILL_FILES].sort();
    const records = await Promise.all(
      paths.map(async (path) => {
        const bytes = await readFile(
@@ -0,0 +1,92 @@
+import { readFile } from "node:fs/promises";
+import { join } from "node:path";
+import { parseFragment, type DefaultTreeAdapterTypes } from "parse5";
+import { createMarkdownRenderer, disposeMdItInstance } from "vitepress";
+import { expect, it } from "vitest";
+import {
+  installCanonicalSkill,
+  skillDestinations,
+} from "../../../src/application/SetupSkill.js";
+import { createTestTempDirectory } from "../../fixtures/temporaryDirectory.js";
+
+// Original guide at main 72d5e72e6, rendered with the repository Markdown stack.
+// Moving a section must retain its old fragment through a heading or HTML anchor.
+const legacyAnchors = [
+  "apple-app-resources",
+  "apple-ips-crash-reports",
+  "binary-hardening",
+  "bridge-request-ceiling",
+  "bun-standalone-executables",
+  "continue-editable-ghidra-analysis-across-processes",
+  "cpython-pyc-files",
+  "desktop-installation-directories",
+  "dos-mz-with-ghidra",
+  "elf-note-tables",
+  "erlang-beam-files",
+  "esp-flash-images",
+  "esp-images",
+  "function-annotations-in-ghidra",
+  "ghidra-startup-deadline-recovery",
+  "go-build-metadata",
+  "godot-pck",
+  "il2cpp-metadata",
+  "linux-kernel-modules",
+  "managed-pe-cli",
+  "model-files",
+  "native-managed-and-packaged-artifacts",
+  "native-targets",
+  "net-nativeaot",
+  "offline-apk-signatures",
+  "offline-elf-layout",
+  "offline-pe-and-elf-export-tables",
+  "offline-pe-resource-inventory",
+  "offline-wasm",
+  "packages-and-extraction",
+  "pe-authenticode-certificate-tables",
+  "pe-import-and-delay-load-tables",
+  "pe-tls-callbacks-and-load-configuration",
+  "recorded-linux-crashes",
+  "reuse-caller-selected-ghidra-analysis",
+  "rust-dependency-metadata",
+  "selected-native-facts-and-call-graphs",
+  "sqlite-snapshots",
+  "static-memory-and-original-file-bytes",
+];
+
+it("preserves pre-refactor native-guide fragments in an installed skill", async () => {
+  const home = await createTestTempDirectory("rea-skill-anchors-");
+  const installed = await installCanonicalSkill(home, []);
+  if (!installed.ok) throw installed.error;
+  const [destination] = skillDestinations(home, []);
+  if (destination === undefined)
+    throw new Error("Missing installed skill root");
+  const content = await readFile(
+    join(destination.path, "references/native-and-artifacts.md"),
+    "utf8",
+  );
+  const renderer = await createMarkdownRenderer(destination.path, {
+    highlight: () => "",
+  });
+  try {
+    const ids = new Set<string>();
+    const fragments: string[] = [];
+    const visit = (node: DefaultTreeAdapterTypes.Node): void => {
+      if ("attrs" in node)
+        for (const attribute of node.attrs) {
+          if (attribute.name === "id") ids.add(attribute.value);
+          if (attribute.name === "href" && attribute.value.startsWith("#"))
+            fragments.push(decodeURIComponent(attribute.value.slice(1)));
+        }
+      if ("childNodes" in node)
+        for (const child of node.childNodes) visit(child);
+    };
+    visit(parseFragment(renderer.render(content)));
+    expect([...ids]).toEqual(expect.arrayContaining(legacyAnchors));
+    for (const fragment of fragments)
+      expect(ids.has(fragment), `Missing rendered fragment: ${fragment}`).toBe(
+        true,
+      );
+  } finally {
+    disposeMdItInstance();
+  }
+});
@@ -1,4 +1,5 @@
 import { expect, it } from "vitest";
+import { PRODUCT_IDENTITY } from "../../src/identity.js";
 import { ArtifactResourceScope } from "../../src/artifacts/ArtifactResourceScope.js";
 import {
  readGuidanceSection,
@@ -101,3 +102,67 @@ it("finds focused installed guidance for switching providers with annotations",
    await resources.close();
  }
 });
+
+it.each([
+  {
+    query: "raw-binary Cortex-M",
+    guide: "references/firmware-and-raw-images.md",
+    fact: "Cortex-M variants are unsupported",
+  },
+  {
+    query: "ESP images",
+    guide: "references/firmware-and-raw-images.md",
+    fact: "ESP8266 images are refused",
+  },
+  {
+    query: "Bun standalone executables",
+    guide: "references/packages-and-archives.md",
+    fact: "executable is never run",
+  },
+  {
+    query: "PE import delay-load tables",
+    guide: "references/format-inspectors.md",
+    fact: "inspect_pe_imports",
+  },
+  {
+    query: "mitmproxy qlog",
+    guide: "references/recorded-captures.md",
+    fact: "without fetching recorded URLs",
+  },
+  {
+    query: "npx rea-agents",
+    guide: "references/connection-and-recovery.md",
+    fact: PRODUCT_IDENTITY.registrationPackageSpecifier,
+  },
+  {
+    query: "CLI summary receipt",
+    guide: "references/evidence-workflows.md",
+    fact: "summary.normalized_result.parent_evidence_id",
+  },
+])(
+  "retrieves moved $query guidance from the installed bundle",
+  async ({ query, guide, fact }) => {
+    const resources = new ArtifactResourceScope();
+    try {
+      const found = await searchGuidance({ query, limit: 20 }, resources);
+      if (!found.ok) throw found.error;
+      if (found.value.status !== "matches")
+        throw new Error("Expected guidance matches");
+      expect(found.value.matches[0]?.guide).toBe(guide);
+      const match = found.value.matches[0];
+      if (match === undefined)
+        throw new Error(`Missing focused guide for ${query}`);
+      const read = await readGuidanceSection(
+        { locator: match.locator },
+        resources,
+      );
+      if (!read.ok) throw read.error;
+      expect(read.value).toMatchObject({ status: "section", guide });
+      if (read.value.status !== "section")
+        throw new Error("Expected readable section");
+      expect(read.value.content.replace(/\s+/gu, " ")).toContain(fact);
+    } finally {
+      await resources.close();
+    }
+  },
+);
Author	SHA1	Message	Date
Kaoru0822	08f9275daf	docs(skill): explain CLI summary export envelopes	2026-11-08 18:29:44 -08:00
Kaoru0822	9ade202dbe	fix(skill): keep the managed anchor in its owning section	2026-11-08 17:53:34 -08:00
Kaoru0822	bed464b7ba	fix(skill): preserve native guide bookmarks across renderers	2026-11-08 17:51:29 -08:00
Kaoru0822	4672d261ee	fix(skill): keep recovery and capture guidance reachable	2026-11-08 06:35:20 -08:00
Kaoru0822	d3d9f6232d	perf(skill): load target guidance through a concise entry point	2026-11-08 05:24:45 -08:00
Kaoru0822	65911d3f6d	fix(skill): consolidate the final legacy Bun anchor	2026-11-08 05:22:43 -08:00
Kaoru0822	fe93175a72	fix(skill): preserve anchors without duplicate search sections	2026-11-08 05:22:12 -08:00
Kaoru0822	0a723689fa	perf(skill): split artifact guidance into focused references	2026-11-08 05:12:38 -08:00