refactor: prune internal seams and preserve configuration ownership

2026-11-13 17:47:56 -10:00 · 2026-11-13 17:57:02 -05:00
347 changed files with 2679 additions and 4762 deletions
@@ -63,6 +63,18 @@
    "rea/no-shared-module-mock": "error"
  },
  "overrides": [
+    {
+      "files": ["src/domain/**/*.ts"],
+      "rules": { "rea/no-locale-compare": "error" }
+    },
+    {
+      "files": [
+        "src/domain/**/*.test.ts",
+        "src/domain/**/*.spec.ts",
+        "src/domain/**/*.fixture.ts"
+      ],
+      "rules": { "rea/no-locale-compare": "off" }
+    },
    {
      "files": [
        "scripts/electron-active-hook*.cjs",
@@ -76,12 +88,19 @@
    {
      "files": ["src/**/*.ts"],
      "rules": {
+        "rea/no-babel-visitor-keys": "error",
        "typescript/no-misused-promises": "error"
      }
    },
    {
-      "files": ["tests/**/*.ts", "src/**/*.test.ts", "src/**/*.fixture.ts"],
+      "files": [
+        "tests/**/*.ts",
+        "src/**/*.test.ts",
+        "src/**/*.spec.ts",
+        "src/**/*.fixture.ts"
+      ],
      "rules": {
+        "rea/no-babel-visitor-keys": "off",
        "max-lines": "off",
        "max-lines-per-function": [
          "error",
@@ -94,6 +113,10 @@
        "typescript/no-misused-promises": "warn"
      }
    },
+    {
+      "files": ["src/domain/javascript/javascriptSemanticTraversal.ts"],
+      "rules": { "rea/no-babel-visitor-keys": "off" }
+    },
    {
      "files": ["src/application/**/*.test.ts"],
      "rules": {
@@ -1091,11 +1091,32 @@ existing four-minute timing collection plus the bounded diagnostic stages.

 Fast built shards target under ten minutes of uncontended shard-job execution.
 That figure is the `test-shard` job. The job waits for classification and the
-build, and the portable-test merge runs after the slowest shard. Runner queue is
-separate and grows when more shard jobs compete for runners. The npm download
-cache stays the setup cache rather than a shared `node_modules` artifact.
+build, and the portable-test merge runs after the slowest shard. On 2026-10-20,
+run `39451548945` measured those surrounding jobs with runner queue excluded:
+classification 15 seconds, build 49 seconds, and the portable-test merge 29
+seconds. Shard 1/5 of that run spent 22 seconds before built Vitest and 3
+seconds after it, including `npm ci` at 9 seconds. `node_modules` is about 674
+MiB, so publishing it as a shared artifact would transfer more data than that
+install saves. The npm download cache stays the setup cache.
+
+File timings from that run put the built suite at 7944 seconds of module time.
+The sequencer keeps each file's full duration on one worker. Extra workers
+overlap other files in the same sequence group, and `process-boundary` runs
+after that group. Scheduling the unsplit inventory onto five shards peaks at
+820 seconds of tests. That run's slowest built shard job lasted 925 seconds
+(shard 4/5), and shard 1/5 spent 874 seconds in built Vitest, so hosted job
+time sits above the file schedule. Six shards of the same inventory peak at
+684 seconds of tests. Eight shards, after the 578-second loader file is split
+by case count (54 cases stay in that file and 46 move into each of three
+files), peak at 513 seconds of tests. With the measured 25-second shard setup,
+that shard job is about 538 seconds. Adding the measured classification, build,
+and merge makes an uncontended portable critical path of about 631 seconds,
+still before the gap between this file schedule and hosted Vitest. Runner queue
+is separate and grows when more shard jobs compete for runners.
 `process-boundary` stays serial because process-tree sampling shares the host.
-Hosted CI jobs use four workers; other hosts stay at two
+Raising the worker cap from two to four on this four-core host cut a six-file
+acceptance sample from 96–101 seconds to 71 seconds and did not remove the
+single-file floor. Hosted CI jobs use four workers; other hosts stay at two
 because they are shared with other checks. Full qualification keeps six covered
 shards; its longer instrumentation is outside this fast budget.

@@ -174,7 +174,9 @@ Official references: [mitmproxy protocol support](https://github.com/mitmproxy/m

 ## Verifier regressions

-After building REA, run these inside the same isolated guest:
+The built process-boundary test suite runs the Node verifier regressions on
+POSIX hosts. To run them directly after building REA, and to run the Python
+laboratory regressions with its pinned dependencies, use the isolated guest:

 ```sh
 node --test scripts/lib/http3-verifier-lifecycle.test.mjs scripts/lib/http3-capture-assertions.test.mjs
@@ -96,10 +96,6 @@ Persistent command Evidence retains the caller-selected and resolved startup pat

 Session status retains up to 64 recent protocol frames. Each history entry keeps a complete-character UTF-8 prefix of at most 16 KiB, plus a truncation marker when needed; `recent_output_truncated` reports omitted history. This history budget also accounts for replacement characters from invalid UTF-8. It does not shorten command Evidence, whose output budget defaults to 16 MiB. Rizin debug startup waits 30000 ms with no runtime override. Each command frame defaults to 120000 ms; its deadline, command-output budget, session capacity and pending-command queue use the [shared debugger launch settings](#debugger-launch-settings). The 16777216-byte frame cap and 4096-frame command cap remain fixed. Evidence names the cap that stopped the command. The one-shot `command_timeout_ms` setting does not change a debug session.

-### Stopped debugger sessions
-
-A Rizin or GDB session stops accepting commands when REA stops it, for example after an output or frame limit, a command deadline, cancellation or a protocol failure, or when the debugger process exits. REA keeps the stopped session and the first reason it observed until `close_rizin_debug_session` or `close_gdb_session` releases it, including after a retried cleanup succeeds. `rizin_debug_session_status` and `gdb_session_status` then report `state: "closed"` with that reason in `closed_reason`. A later `rizin_debug_command` or `gdb_console` on the session fails with `capability_unavailable`; `details.reason` carries the same reason, and the remediation is to close the session and start a new one. A `session_id` that this server never returned, or that close already released, fails with `invalid_request` instead.
-
 ### Debugger launch settings

 GDB and Rizin share these settings in the environment that launches REA:
@@ -140,8 +136,6 @@ rea debug-with-rizin --inferior-tty /dev/pts/7 ./program dr
 rea execute-rizin-command ./program iI
 ```

-Rizin exits with status 0 even when its shell refuses a statement, so the exit code does not show whether the command ran. Rizin 0.6 through 0.9.1 log one of four stderr lines for such a refusal: `ERROR: Command '…' does not exist.`, ``ERROR: Wrong number of arguments passed to `…`…``, `ERROR: core: Error while executing command: …` (an invalid statement), or `ERROR: core: Error while parsing command: …`. Rizin then skips the refused statement and every later one in the command. When the completed process's stderr contains one of these lines, REA reports `completion_status: "rejected"` and adds a limitation naming the refusal. stdout then holds only the output of earlier statements, so empty stdout is not an empty result. Other `ERROR:` lines, such as `ERROR: Cannot find function at …`, come from commands that ran; REA keeps them in stderr and reports `complete`. A command that lowers `log.level` or redirects stderr hides refusals from REA.
-
 Captured stdout and stderr use the same `max_output_bytes` (CLI: `--max-output-bytes`) admission and recovery described above, default 16 MiB. One-shot commands independently use `command_timeout_ms`. Raising output admission cannot recover an earlier capture; command effects and cleanup must be checked before another invocation.

 ### Decoder and map inputs
@@ -842,8 +842,14 @@ branches are not producers. A tier with no qualifying artifact leaves history
 unset, and Vitest uses its own assignment. A later schedule that reuses
 qualification without uploading timings leaves the previous artifact in place.

-Each tier keeps its own history because stale weights from another tier, or
-from before a large test change, unbalance the shards.
+On 2026-10-21 the newest full history was run
+`39545047294`, recorded before compiled-CLI session reuse. Fast run
+`39552964873` packed its eight built shards from that history, and those shard
+jobs executed for 319–591 seconds. Replaying that run's file durations through
+the sequencer's two-worker schedule balances every shard at about 404 seconds
+of file time. The same replay with the stale history weights leaves the slowest
+shard near 547 seconds and the fastest near 293. That spread is file-schedule
+time, not runner queue, which is why each tier keeps its own history.
 CI assigns discovered files by historical duration rather than dividing only
 by file count. A file with no recorded duration, such as a newly added or
 renamed test, is weighted at the median recorded duration until a published
@@ -14,7 +14,7 @@ const directDependencies = (rootPackage) => ({
 const installedPackageKey = (name) => `node_modules/${name}`;

 /** Compare root direct dependencies with npm's hidden installed lockfile. */
-export const dependencyInstallProblems = (rootLock, installedLock) => {
+const dependencyInstallProblems = (rootLock, installedLock) => {
  const rootPackage = rootLock.packages?.[""];
  if (rootPackage === undefined)
    return ["package-lock.json does not contain a root package entry"];
@@ -26,8 +26,6 @@ export type CacheRequest = (
  endpoint: string,
 ) => Promise<unknown>;

-export function assertRetentionPrefix(prefix: string): void;
-
 export function selectPrefixDeletions(
  caches: readonly unknown[],
  family?: RetentionFamily,
@@ -22,7 +22,7 @@ const PREFIX_PATTERNS = [
 ];

 /** Reject prefixes that could match npm downloads or another platform. */
-export function assertRetentionPrefix(prefix) {
+function assertRetentionPrefix(prefix) {
  if (
    typeof prefix !== "string" ||
    !PREFIX_PATTERNS.some((pattern) => pattern.test(prefix))
@@ -99,9 +99,3 @@ export function createGitHubApi(options?: {
    budget: { requests: number; startedAt: number; limitMs: number },
  ) => Promise<unknown>;
 }): FailureReportApi;
-
-export function writeFailureReport(
-  report: CiFailureReport,
-  outputDirectory?: string,
-  summaryPath?: string,
-): Promise<{ jsonPath: string; markdownPath: string }>;
@@ -467,7 +467,7 @@ function errorCode(error) {
  return error instanceof Error ? error.message.slice(0, 160) : "unknown_error";
 }

-export async function writeFailureReport(
+async function writeFailureReport(
  report,
  outputDirectory = OUTPUT_DIRECTORY,
  summaryPath,
@@ -91,5 +91,4 @@ export function writePrCiHealthReport(
  outputDirectory?: string,
 ): Promise<{ jsonPath: string; markdownPath: string }>;

-export function renderMarkdownSummary(report: PrCiHealthReport): string;
 import type { GitHubApiRequest } from "./github-api.mjs";
@@ -656,7 +656,7 @@ export async function writePrCiHealthReport(
  return { jsonPath, markdownPath };
 }

-export function renderMarkdownSummary(report) {
+function renderMarkdownSummary(report) {
  const rows = report.pullRequests.map(
    (pull) =>
      `| #${String(pull.number ?? "?")} | ${escapeCell(pull.head.repository ?? "unknown")} | ${escapeCell(pull.head.ref ?? "unknown")} | \`${pull.head.sha ?? "unknown"}\` | ${pull.ci.category} | ${escapeCell(pull.ci.reason)} |`,
@@ -28,6 +28,3 @@ export interface ProductionReachabilityReport {
 export function parseProductionReachabilityReport(
  text: string,
 ): ProductionReachabilityReport;
-export function recordProductionReachabilityReport(
-  root?: string,
-): Promise<ProductionReachabilityReport>;
@@ -34,9 +34,7 @@ export const parseProductionReachabilityReport = (text) =>
  reportSchema.parse(JSON.parse(text));

 /** Run production reachability without turning candidates into failures. */
-export const recordProductionReachabilityReport = async (
-  root = process.cwd(),
-) => {
+const recordProductionReachabilityReport = async (root = process.cwd()) => {
  const reportDirectory = join(root, ".cache", "static-checks");
  const reportPath = join(reportDirectory, "production-reachability.json");

@@ -6,7 +6,7 @@ import { promisify } from "node:util";
 const exec = promisify(execFile);

 /** Commands the macOS bundle fixture needs from Command Line Tools. */
-export const MACOS_BUNDLE_FIXTURE_COMMANDS = [
+const MACOS_BUNDLE_FIXTURE_COMMANDS = [
  ["/usr/bin/xcrun", ["--find", "clang"]],
  ["/usr/bin/xcrun", ["--find", "codesign"]],
  ["/usr/bin/ditto", ["-h"]],
@@ -1,4 +1,4 @@
-export function sourceMapSummary(sourceMaps) {
+function sourceMapSummary(sourceMaps) {
  return {
    status: sourceMaps.status,
    requested: sourceMaps.requested,
@@ -1,11 +1,3 @@
-export const CURSOR_PLUGIN_MANIFEST: ".cursor-plugin/plugin.json";
-export const CURSOR_PLUGIN_MCP: "mcp.json";
-export const AUTHORED_SKILL_DIRECTORY: ".agents/skills/reverse-engineer-anything";
-export const CURSOR_PLUGIN_SKILLS: ".cursor-plugin/skills";
-export const CURSOR_PLUGIN_SKILL: "reverse-engineer-anything";
-export const CURSOR_PLUGIN_LOGO: "assets/rea-plugin.png";
-export const CURSOR_PLUGIN_REPOSITORY: "https://github.com/morluto/rea";
-
 export interface CursorPluginBundleIssue {
  readonly field: string;
 }
@@ -56,11 +48,6 @@ export interface CursorPluginInspection {
  readonly issues: readonly CursorPluginBundleIssue[];
 }

-export function cursorPluginSkillPaths(
-  directory: string,
-  prefix?: string,
-): Promise<readonly string[] | null>;
-
 export function cursorPluginBundleIssues(
  input: CursorPluginBundleInput,
 ): readonly CursorPluginBundleIssue[];
@@ -7,14 +7,13 @@ import { ensureGeneratedFile } from "./generated-file.mjs";
 // publication (name, release version, repository, skill, and icon). The
 // Marketplace checkout has no dist/, so the server is the pinned npm command
 // instead of the bundled launcher.
-export const CURSOR_PLUGIN_MANIFEST = ".cursor-plugin/plugin.json";
-export const CURSOR_PLUGIN_MCP = "mcp.json";
-export const AUTHORED_SKILL_DIRECTORY =
-  ".agents/skills/reverse-engineer-anything";
-export const CURSOR_PLUGIN_SKILLS = ".cursor-plugin/skills";
-export const CURSOR_PLUGIN_SKILL = "reverse-engineer-anything";
-export const CURSOR_PLUGIN_LOGO = "assets/rea-plugin.png";
-export const CURSOR_PLUGIN_REPOSITORY = "https://github.com/morluto/rea";
+const CURSOR_PLUGIN_MANIFEST = ".cursor-plugin/plugin.json";
+const CURSOR_PLUGIN_MCP = "mcp.json";
+const AUTHORED_SKILL_DIRECTORY = ".agents/skills/reverse-engineer-anything";
+const CURSOR_PLUGIN_SKILLS = ".cursor-plugin/skills";
+const CURSOR_PLUGIN_SKILL = "reverse-engineer-anything";
+const CURSOR_PLUGIN_LOGO = "assets/rea-plugin.png";
+const CURSOR_PLUGIN_REPOSITORY = "https://github.com/morluto/rea";
 const GENERATE_COMMAND = "node scripts/generate-cursor-plugin-skill.mjs";
 const INSTALL_LINK_MARKERS = ["install-mcp", "deeplink/mcp", "mcp-install"];

@@ -27,7 +26,7 @@ const failure = (code, detail) => {
 const cursorServerArgs = (version) => ["-y", `rea-agents@${version}`, "mcp"];

 /** Relative file inventory for one skill directory, in stable order. */
-export const cursorPluginSkillPaths = async (directory, prefix = "") => {
+const cursorPluginSkillPaths = async (directory, prefix = "") => {
  const paths = [];
  let entries;
  try {
@@ -1,6 +1,6 @@
 import assert from "node:assert/strict";

-export const WINDOWS_GHIDRA_BYTE_SEARCH_FIXTURE = Object.freeze({
+const WINDOWS_GHIDRA_BYTE_SEARCH_FIXTURE = Object.freeze({
  pattern: "a0 ?? c0",
  mask: "f0 ff f0",
  startFileOffset: 0x380,
@@ -0,0 +1,16 @@
+import type { ArtifactResourceScope } from "../../src/artifacts/ArtifactResourceScope.js";
+
+export class HopperDeadlineCleanupFailure extends AggregateError {
+  readonly _tag: "HopperDeadlineCleanupFailure";
+  readonly cleanupOwner: HopperDeadlineCleanup;
+  constructor(owner: HopperDeadlineCleanup, failures: unknown[]);
+}
+
+export class HopperDeadlineCleanup {
+  readonly workspace: string;
+  constructor(workspace: string, profile: ArtifactResourceScope);
+  setClient(client: {
+    close(): Promise<{ ok: true } | { ok: false; error: unknown }>;
+  }): void;
+  close(): Promise<void>;
+}
@@ -0,0 +1,71 @@
+import { rm } from "node:fs/promises";
+
+export class HopperDeadlineCleanupFailure extends AggregateError {
+  constructor(owner, failures) {
+    super(
+      failures,
+      `Hopper cleanup incomplete; workspace may remain at ${owner.workspace}`,
+    );
+    this._tag = "HopperDeadlineCleanupFailure";
+    this.cleanupOwner = owner;
+  }
+}
+
+/** Own the client, profile scope, and workspace until all cleanup completes. */
+export class HopperDeadlineCleanup {
+  #client;
+  #profile;
+  #pending;
+  #removed = false;
+
+  constructor(workspace, profile) {
+    this.workspace = workspace;
+    this.#profile = profile;
+  }
+
+  setClient(client) {
+    this.#client = client;
+  }
+
+  close() {
+    if (this.#pending !== undefined) return this.#pending;
+    const attempt = this.#close();
+    const pending = attempt.finally(() => {
+      if (this.#pending === pending) this.#pending = undefined;
+    });
+    this.#pending = pending;
+    return pending;
+  }
+
+  async #close() {
+    if (this.#removed) return;
+    const failures = [];
+    if (this.#client !== undefined) {
+      try {
+        const result = await this.#client.close();
+        if (!result.ok) throw result.error;
+        this.#client = undefined;
+      } catch (cause) {
+        failures.push(cause);
+      }
+    }
+    if (this.#profile !== undefined) {
+      try {
+        await this.#profile.close();
+        this.#profile = undefined;
+      } catch (cause) {
+        failures.push(cause);
+      }
+    }
+    if (failures.length === 0) {
+      try {
+        await rm(this.workspace, { recursive: true, force: true });
+        this.#removed = true;
+        return;
+      } catch (cause) {
+        failures.push(cause);
+      }
+    }
+    throw new HopperDeadlineCleanupFailure(this, failures);
+  }
+}
@@ -64,7 +64,7 @@ function assertHeaders(record, side, headers) {
  }
 }

-export function assertEndpointHeaders(actual, expected) {
+function assertEndpointHeaders(actual, expected) {
  // The proxy rebuilds pseudo fields from its HTTP state. Compare their values
  // by name while retaining the exact order and duplicates of regular headers.
  const partition = (headers) => {
@@ -1,28 +1,10 @@
 import { analyzeJavaScriptApplication } from "../../dist/application/javascript/JavaScriptApplicationService.js";
-import { ArtifactResourceScope } from "../../dist/artifacts/ArtifactResourceScope.js";
+import { withVerifierArtifactScope } from "./verifier-artifact-scope.mjs";

 /** Analyze one JavaScript application and close its caller-owned resources. */
-export const analyzeJavaScriptApplicationWithOwnedScope = async (input) => {
-  const scope = new ArtifactResourceScope();
-  let outcome;
-  try {
+export const analyzeJavaScriptApplicationWithOwnedScope = (input) =>
+  withVerifierArtifactScope(async (scope) => {
    const result = await analyzeJavaScriptApplication(input, scope);
-    outcome = result.ok
-      ? { kind: "completed", value: result.value }
-      : { kind: "failed", cause: result.error };
-  } catch (cause) {
-    outcome = { kind: "failed", cause };
-  }
-  try {
-    await scope.close();
-  } catch (cleanupCause) {
-    if (outcome.kind === "failed")
-      throw new AggregateError(
-        [outcome.cause, cleanupCause],
-        "JavaScript analysis and artifact cleanup both failed",
-      );
-    throw cleanupCause;
-  }
-  if (outcome.kind === "failed") throw outcome.cause;
-  return outcome.value;
-};
+    if (!result.ok) throw result.error;
+    return result.value;
+  });
@@ -78,7 +78,7 @@ export const expandMcpSessionStatus = (status) => ({
 });

 /** Expand provider capability groups while retaining candidate identity/state. */
-export const expandProviderCandidates = (candidates) =>
+const expandProviderCandidates = (candidates) =>
  candidates.map((candidate) => ({
    ...candidate,
    capabilities: expandProviderCapabilities(
@@ -1,176 +0,0 @@
-import assert from "node:assert/strict";
-import { spawnSync } from "node:child_process";
-import { mkdir, mkdtemp, rm, writeFile } from "node:fs/promises";
-import { tmpdir } from "node:os";
-import { join } from "node:path";
-import { fileURLToPath, pathToFileURL } from "node:url";
-import { test } from "node:test";
-
-import { inspectModuleBoundaries } from "./module-boundaries.mjs";
-
-const fixture = async () => {
-  const root = await mkdtemp(join(tmpdir(), "rea-module-boundaries-"));
-  await mkdir(join(root, "src/domain"), { recursive: true });
-  await mkdir(join(root, "src/composition"), { recursive: true });
-  await writeFile(
-    join(root, "src/composition/worker.ts"),
-    "export default 1;\n",
-  );
-  await writeFile(
-    join(root, "package.json"),
-    JSON.stringify({ imports: { "#worker": "./dist/composition/worker.js" } }),
-  );
-  return root;
-};
-
-await test("reports a pure-layer composition import written relatively", async () => {
-  const root = await fixture();
-  try {
-    const violations = inspectModuleBoundaries(
-      "src/domain/probe.ts",
-      'import worker from "../composition/worker.js";\nexport default worker;\n',
-      root,
-    );
-    assert.deepEqual(
-      violations.map(({ boundary, target }) => ({ boundary, target })),
-      [{ boundary: "pure-layer", target: "src/composition/worker.js" }],
-    );
-  } finally {
-    await rm(root, { recursive: true, force: true });
-  }
-});
-
-await test("reports a pure-layer composition import written through the package map", async () => {
-  const root = await fixture();
-  try {
-    const violations = inspectModuleBoundaries(
-      "src/domain/probe.ts",
-      'import worker from "#worker";\nexport default worker;\n',
-      root,
-    );
-    assert.deepEqual(
-      violations.map(({ boundary, target }) => ({ boundary, target })),
-      [{ boundary: "pure-layer", target: "src/composition/worker.ts" }],
-    );
-  } finally {
-    await rm(root, { recursive: true, force: true });
-  }
-});
-
-for (const [name, specifier, imports] of [
-  [
-    "conditional",
-    "#worker",
-    {
-      "#worker": {
-        import: "./dist/composition/worker.js",
-        default: "./dist/composition/other.js",
-      },
-    },
-  ],
-  ["array", "#worker", { "#worker": ["./dist/composition/worker.js"] }],
-  ["pattern", "#workers/worker", { "#workers/*": "./dist/composition/*.js" }],
-]) {
-  await test(`refuses an unsupported valid ${name} package map rather than skipping its edge`, async () => {
-    const root = await fixture();
-    try {
-      await writeFile(join(root, "package.json"), JSON.stringify({ imports }));
-      const file = "src/domain/probe.ts";
-      await writeFile(
-        join(root, file),
-        `import ${JSON.stringify(specifier)};\n`,
-      );
-      // Resolve only: no worker module or authored target source is executed.
-      const resolved = spawnSync(
-        process.execPath,
-        [
-          "--experimental-import-meta-resolve",
-          "--input-type=module",
-          "-e",
-          "console.log(import.meta.resolve(process.argv[1], process.argv[2]))",
-          specifier,
-          pathToFileURL(join(root, file)).href,
-        ],
-        { encoding: "utf8" },
-      );
-      if (resolved.error !== undefined) throw resolved.error;
-      assert.equal(resolved.status, 0, resolved.stderr);
-      assert.equal(
-        resolved.stdout.trim(),
-        pathToFileURL(join(root, "dist/composition/worker.js")).href,
-      );
-      const checked = spawnSync(
-        process.execPath,
-        [
-          fileURLToPath(
-            new URL("../verify-module-boundaries.mjs", import.meta.url),
-          ),
-          file,
-        ],
-        { cwd: root, encoding: "utf8" },
-      );
-      if (checked.error !== undefined) throw checked.error;
-      assert.equal(checked.status, 1, checked.stdout);
-      assert.match(checked.stderr, /Could not inspect src\/domain\/probe.ts/u);
-      assert.match(checked.stderr, /Cannot resolve package import/u);
-      assert.match(checked.stderr, /relative source import/u);
-    } finally {
-      await rm(root, { recursive: true, force: true });
-    }
-  });
-}
-
-for (const target of [
-  "./dist/composition/worker.js",
-  "./dist/%63omposition/worker.js",
-  "./%64ist/composition/worker.js",
-]) {
-  await test(`checks the URL-normalized source owner of ${target}`, async () => {
-    const root = await fixture();
-    try {
-      await writeFile(
-        join(root, "package.json"),
-        JSON.stringify({ imports: { "#worker": target } }),
-      );
-      await mkdir(join(root, "src/application"), { recursive: true });
-      const file = "src/application/probe.ts";
-      await writeFile(join(root, file), 'import "#worker";\n');
-      const resolved = spawnSync(
-        process.execPath,
-        [
-          "--experimental-import-meta-resolve",
-          "--input-type=module",
-          "-e",
-          "console.log(import.meta.resolve(process.argv[1], process.argv[2]))",
-          "#worker",
-          pathToFileURL(join(root, file)).href,
-        ],
-        { encoding: "utf8" },
-      );
-      if (resolved.error !== undefined) throw resolved.error;
-      assert.equal(resolved.status, 0, resolved.stderr);
-      assert.equal(
-        fileURLToPath(resolved.stdout.trim()),
-        join(root, "dist/composition/worker.js"),
-      );
-      const checked = spawnSync(
-        process.execPath,
-        [
-          fileURLToPath(
-            new URL("../verify-module-boundaries.mjs", import.meta.url),
-          ),
-          file,
-        ],
-        { cwd: root, encoding: "utf8" },
-      );
-      if (checked.error !== undefined) throw checked.error;
-      assert.equal(checked.status, 1, checked.stdout);
-      assert.match(
-        checked.stderr,
-        /application-composition: #worker resolves to src\/composition\/worker.ts/u,
-      );
-    } finally {
-      await rm(root, { recursive: true, force: true });
-    }
-  });
-}
@@ -1,8 +1,5 @@
 export { runOwnedVerifierTerminal } from "./verifier-terminal-owner.mjs";
 export type {
  VerifierTerminalOptions,
-  VerifierTerminalDependencies,
  VerifierTerminalResult,
-  VerifierTerminalFailure,
-  VerifierTerminalCleanupFailure,
 } from "./verifier-terminal-owner.mjs";
@@ -1,6 +1,10 @@
-/** Observe concrete Hopper runtime resources for a before/after cleanup check. */
+/** Observe possible Hopper resources, including entries with unresolved ownership. */
 export function snapshotHopperRuntime(
  parent: string,
  targetLeaseDirectory: string,
-  ownedProcessIds?: ReadonlySet<number>,
-): Promise<Set<string>>;
+  expectedRunId?: string,
+): Promise<{
+  readonly paths: Set<string>;
+  readonly confirmedSessions: Set<string>;
+  readonly unresolvedSessions: Set<string>;
+}>;
@@ -1,35 +1,38 @@
 import { lstat, readFile, readdir } from "node:fs/promises";
 import { join } from "node:path";

-/** Observe session paths and target leases without treating their shared parent as a session. */
+/** Observe possible sessions and target leases without discarding uncertainty. */
 export async function snapshotHopperRuntime(
  parent,
  targetLeaseDirectory,
-  ownedProcessIds,
+  expectedRunId,
 ) {
-  const resources = new Set();
+  const paths = new Set();
+  const confirmedSessions = new Set();
+  const unresolvedSessions = new Set();
  for (const entry of await readdir(parent, { withFileTypes: true })) {
    const path = join(parent, entry.name);
    if (!entry.name.startsWith("rea-") || path === targetLeaseDirectory)
      continue;
-    if (
-      ownedProcessIds !== undefined &&
-      (!entry.isDirectory() ||
-        !(await belongsToOwnedProcess(path, ownedProcessIds)))
-    )
-      continue;
-    resources.add(path);
+    const confirmed =
+      typeof expectedRunId === "string" &&
+      expectedRunId.length > 0 &&
+      entry.isDirectory() &&
+      (await hasRunIdentity(path, expectedRunId));
+    (confirmed ? confirmedSessions : unresolvedSessions).add(path);
+    paths.add(path);
  }
  const leaseRoot = await lstat(targetLeaseDirectory).catch(missingIsAbsent);
-  if (leaseRoot === undefined) return resources;
-  if (!leaseRoot.isDirectory() || leaseRoot.isSymbolicLink()) {
-    resources.add(targetLeaseDirectory);
-    return resources;
+  if (leaseRoot !== undefined) {
+    if (!leaseRoot.isDirectory() || leaseRoot.isSymbolicLink())
+      paths.add(targetLeaseDirectory);
+    else {
+      const leases = await readdir(targetLeaseDirectory).catch(missingIsAbsent);
+      for (const name of leases ?? [])
+        paths.add(join(targetLeaseDirectory, name));
+    }
  }
-  const leases = await readdir(targetLeaseDirectory).catch(missingIsAbsent);
-  for (const name of leases ?? [])
-    resources.add(join(targetLeaseDirectory, name));
-  return resources;
+  return { paths, confirmedSessions, unresolvedSessions };
 }

 const missingIsAbsent = (cause) => {
@@ -37,16 +40,21 @@ const missingIsAbsent = (cause) => {
  throw cause;
 };

-const belongsToOwnedProcess = async (path, ownedProcessIds) => {
+const hasRunIdentity = async (path, expectedRunId) => {
  const encoded = await readFile(join(path, "ownership.json"), "utf8").catch(
    missingIsAbsent,
  );
  if (encoded === undefined) return false;
-  const ownership = JSON.parse(encoded);
+  let ownership;
+  try {
+    ownership = JSON.parse(encoded);
+  } catch (cause) {
+    if (cause instanceof SyntaxError) return false;
+    throw cause;
+  }
  return (
    ownership !== null &&
    typeof ownership === "object" &&
-    Number.isSafeInteger(ownership.parent_pid) &&
-    ownedProcessIds.has(ownership.parent_pid)
+    ownership.run_id === expectedRunId
  );
 };
@@ -1,4 +1,4 @@
-export interface FixtureProcedure {
+interface FixtureProcedure {
  readonly address: string;
  readonly name: string;
 }
@@ -26,13 +26,6 @@ export function requireCurrentDocument(
  normalizedResult: (value: unknown, operation: string) => unknown,
 ): Promise<string>;

-export function analyzeFixtureProcedure(
-  client: ToolClient,
-  options: unknown,
-  procedure: FixtureProcedure,
-  normalizedResult: (value: unknown, operation: string) => unknown,
-): Promise<unknown>;
-
 export function verifyRealHopperFixture(options: {
  readonly client: ToolClient;
  readonly options: unknown;
@@ -310,7 +310,7 @@ export async function resolveFixtureProcedure(
 }

 /** Request the assembly evidence required by the fixture oracle. */
-export const analyzeFixtureProcedure = async (
+const analyzeFixtureProcedure = async (
  client,
  options,
  procedure,
@@ -6,6 +6,3 @@ export function unsupportedRuntimeMessage(
  range: string,
  version: string,
 ): string | undefined;
-
-/** Human-readable release families for an `engines.node` range. */
-export function supportedReleaseProse(range: string): string;
@@ -21,7 +21,7 @@ export const unsupportedRuntimeMessage = (range, version) => {
 };

 /** Human-readable release families for an `engines.node` range. */
-export const supportedReleaseProse = (range) =>
+const supportedReleaseProse = (range) =>
  `Node.js ${range
    .split("||")
    .map((clause) => {
@@ -0,0 +1,15 @@
+import type { ArtifactResourceScope } from "../../src/artifacts/ArtifactResourceScope.js";
+
+export class VerifierArtifactCleanupFailure extends AggregateError {
+  readonly _tag: "VerifierArtifactCleanupFailure";
+  readonly cleanupOwner: ArtifactResourceScope;
+  constructor(
+    scope: ArtifactResourceScope,
+    failures: unknown[],
+    cause: unknown,
+  );
+}
+
+export function withVerifierArtifactScope<T>(
+  operation: (scope: ArtifactResourceScope) => Promise<T>,
+): Promise<T>;
@@ -0,0 +1,32 @@
+import { ArtifactResourceScope } from "../../dist/artifacts/ArtifactResourceScope.js";
+
+/** A failed close retains the scope that can retry all of its owners. */
+export class VerifierArtifactCleanupFailure extends AggregateError {
+  constructor(scope, failures, cause) {
+    super(failures, "Verifier cleanup failed", { cause });
+    this._tag = "VerifierArtifactCleanupFailure";
+    this.cleanupOwner = scope;
+  }
+}
+
+/** Run one verifier operation and retain its exact scope if close fails. */
+export async function withVerifierArtifactScope(operation) {
+  const scope = new ArtifactResourceScope();
+  let outcome;
+  try {
+    outcome = { ok: true, value: await operation(scope) };
+  } catch (cause) {
+    outcome = { ok: false, cause };
+  }
+  try {
+    await scope.close();
+  } catch (cleanupCause) {
+    throw new VerifierArtifactCleanupFailure(
+      scope,
+      outcome.ok ? [cleanupCause] : [outcome.cause, cleanupCause],
+      outcome.ok ? cleanupCause : outcome.cause,
+    );
+  }
+  if (!outcome.ok) throw outcome.cause;
+  return outcome.value;
+}
@@ -40,7 +40,7 @@ export interface VerifierTerminalOptions {
  readonly signal?: AbortSignal;
 }

-export interface VerifierTerminalDependencies {
+interface VerifierTerminalDependencies {
  readonly loadPty?: () => Promise<typeof import("@lydell/node-pty")>;
  readonly cleanupProcessGroup?: typeof cleanupOwnedProcessGroup;
 }
@@ -59,7 +59,7 @@ type TerminalFailureReason =
  | "unsupported_platform";

 /** Expected terminal failures retain the decoded output observed at failure. */
-export class VerifierTerminalFailure extends Error {
+class VerifierTerminalFailure extends Error {
  readonly _tag = "VerifierTerminalFailure";

  constructor(
@@ -74,7 +74,7 @@ export class VerifierTerminalFailure extends Error {
 }

 /** The adopted owner remains the exact authority for retrying this release. */
-export class VerifierTerminalCleanupFailure extends Error {
+class VerifierTerminalCleanupFailure extends Error {
  readonly _tag = "VerifierTerminalCleanupFailure";
  readonly reason = "cleanup_incomplete";

@@ -5,6 +5,8 @@ import noEvidenceJsonPreadmission from "./rules/no-evidence-json-preadmission.mj
 import noFixtureRootCleanup from "./rules/no-fixture-root-cleanup.mjs";
 import noPositionalToolContract from "./rules/no-positional-tool-contract.mjs";
 import noSharedModuleMock from "./rules/no-shared-module-mock.mjs";
+import noLocaleCompare from "./rules/no-locale-compare.mjs";
+import noBabelVisitorKeys from "./rules/no-babel-visitor-keys.mjs";

 export default {
  meta: { name: "rea" },
@@ -15,5 +17,7 @@ export default {
    "no-fixture-root-cleanup": noFixtureRootCleanup,
    "no-positional-tool-contract": noPositionalToolContract,
    "no-shared-module-mock": noSharedModuleMock,
+    "no-locale-compare": noLocaleCompare,
+    "no-babel-visitor-keys": noBabelVisitorKeys,
  },
 };
@@ -0,0 +1,4 @@
+import type { RuleTester } from "oxlint/plugins-dev";
+
+declare const rule: Parameters<RuleTester["run"]>[1];
+export default rule;
@@ -0,0 +1,73 @@
+import { findBinding } from "../bindings.mjs";
+
+const nameOf = (node) =>
+  node.type === "Identifier"
+    ? node.name
+    : node.type === "Literal"
+      ? node.value
+      : node.type === "TemplateLiteral" && node.expressions.length === 0
+        ? node.quasis[0]?.value.cooked
+        : undefined;
+
+export default {
+  meta: {
+    type: "problem",
+    docs: { description: "Keep Babel child expansion in its shared owner." },
+    schema: [],
+    messages: {
+      owner:
+        "Use childNodes or traverseJavaScriptAst instead of Babel VISITOR_KEYS.",
+    },
+  },
+  create(context) {
+    const source = context.sourceCode;
+    const isBabelNamespace = (node) => {
+      if (node?.type !== "Identifier") return false;
+      const definition = findBinding(source, node)?.defs[0];
+      if (
+        definition?.type !== "ImportBinding" ||
+        definition.node.type !== "ImportNamespaceSpecifier"
+      )
+        return false;
+      const declaration = definition.parent ?? definition.node.parent;
+      return declaration?.source?.value === "@babel/types";
+    };
+    return {
+      ImportSpecifier(node) {
+        if (
+          node.parent.source.value === "@babel/types" &&
+          (node.imported.name ?? node.imported.value) === "VISITOR_KEYS"
+        )
+          context.report({ node, messageId: "owner" });
+      },
+      ExportNamedDeclaration(node) {
+        if (node.source?.value !== "@babel/types") return;
+        for (const specifier of node.specifiers)
+          if (
+            specifier.type === "ExportSpecifier" &&
+            nameOf(specifier.local) === "VISITOR_KEYS"
+          )
+            context.report({ node: specifier, messageId: "owner" });
+      },
+      MemberExpression(node) {
+        if (
+          (!node.computed || node.property.type !== "Identifier") &&
+          nameOf(node.property) === "VISITOR_KEYS" &&
+          isBabelNamespace(node.object)
+        )
+          context.report({ node, messageId: "owner" });
+      },
+      VariableDeclarator(node) {
+        if (node.id.type !== "ObjectPattern" || !isBabelNamespace(node.init))
+          return;
+        for (const property of node.id.properties)
+          if (
+            property.type === "Property" &&
+            (!property.computed || property.key.type !== "Identifier") &&
+            nameOf(property.key) === "VISITOR_KEYS"
+          )
+            context.report({ node: property, messageId: "owner" });
+      },
+    };
+  },
+};
@@ -0,0 +1,4 @@
+import type { RuleTester } from "oxlint/plugins-dev";
+
+declare const rule: Parameters<RuleTester["run"]>[1];
+export default rule;
@@ -0,0 +1,34 @@
+export default {
+  meta: {
+    type: "problem",
+    docs: {
+      description: "Keep domain ordering independent of the host locale.",
+    },
+    schema: [],
+    messages: {
+      locale:
+        "Use compareUnicodeCodePoints instead of localeCompare for domain ordering.",
+    },
+  },
+  create(context) {
+    return {
+      CallExpression(node) {
+        const member = node.callee;
+        if (member.type !== "MemberExpression") return;
+        if (
+          (!member.computed &&
+            member.property.type === "Identifier" &&
+            member.property.name === "localeCompare") ||
+          (member.computed &&
+            member.property.type === "Literal" &&
+            member.property.value === "localeCompare") ||
+          (member.computed &&
+            member.property.type === "TemplateLiteral" &&
+            member.property.expressions.length === 0 &&
+            member.property.quasis[0]?.value.cooked === "localeCompare")
+        )
+          context.report({ node, messageId: "locale" });
+      },
+    };
+  },
+};
@@ -1,13 +1,3 @@
-export interface PackageHopperEnvironment {
-  readonly HOPPER_LAUNCHER_PATH: string;
-  readonly HOPPER_LOADER_ARGS_JSON: string;
-}
-
-export function packageHopperEnvironment(
-  root: string,
-  platform?: string,
-): PackageHopperEnvironment;
-
 export function verifyPackageEnvironment(input: {
  readonly root: string;
  readonly workspace: string;
@@ -117,7 +117,7 @@ export async function verifyPackageEnvironment({
  };
 }

-export const packageHopperEnvironment = (root, platform = process.platform) => {
+const packageHopperEnvironment = (root, platform = process.platform) => {
  const fakeLauncher = join(root, "tests/fixtures/fakeLauncher.mjs");
  if (platform !== "linux")
    return {
@@ -414,7 +414,7 @@ export function matchesSymbol(value, expected) {
  return tail === expected || tail === `_${expected}`;
 }

-export function symbolTail(value) {
+function symbolTail(value) {
  if (typeof value !== "string") return undefined;
  return value.split("::").at(-1);
 }
@@ -9,7 +9,7 @@ import { promisify } from "node:util";
 import { Client } from "@modelcontextprotocol/client";
 import { StdioClientTransport } from "@modelcontextprotocol/client/stdio";
 import { parseBinaryTarget } from "../dist/application/BinaryTargetResolver.js";
-import { ArtifactResourceScope } from "../dist/artifacts/ArtifactResourceScope.js";
+import { withVerifierArtifactScope } from "./lib/verifier-artifact-scope.mjs";
 import { readGhidraLanguageCatalog } from "../dist/ghidra/GhidraLanguageCatalog.js";
 import { parseEvidence } from "../dist/domain/evidence.js";
 import { functionDossierSchema } from "../dist/domain/native/functionDossier.js";
@@ -82,16 +82,13 @@ for (const setting of ["GHIDRA_HEADLESS_MAXMEM", "GHIDRA_MAXMEM"]) {
 * installation catalog reader it uses. User extensions are not in that catalog.
 */
 async function languageInstalled(languageId) {
-  const scope = new ArtifactResourceScope();
-  try {
+  return withVerifierArtifactScope(async (scope) => {
    const catalog = await readGhidraLanguageCatalog(
      installation.installDir,
      scope,
    );
    return catalog.some((definition) => definition.id === languageId);
-  } finally {
-    await scope.close();
-  }
+  });
 }

 /** One MCP session plus CLI check. `languageOverride` is set only for the Gekko pass. */
@@ -11,6 +11,10 @@ import { fileURLToPath, pathToFileURL } from "node:url";
 import { promisify } from "node:util";
 import { artifactMcpCall } from "./lib/artifact-e2e.mjs";
 import { snapshotHopperRuntime } from "./lib/real-hopper-cleanup.mjs";
+import {
+  closeVerifierResources,
+  withVerifierCleanup,
+} from "./lib/verifier-cleanup.mjs";
 import { HOPPER_TARGET_LEASE_DIRECTORY } from "../dist/process/HopperLease.js";

 assert.equal(process.platform, "darwin", "requires macOS");
@@ -48,11 +52,9 @@ const digest = async (path) =>
  createHash("sha256")
    .update(await readFile(path))
    .digest("hex");
-const sessionsBefore = await snapshotHopperRuntime(
-  "/tmp",
-  HOPPER_TARGET_LEASE_DIRECTORY,
-);
-const ownedProcessIds = new Set();
+const sessionsBefore = (
+  await snapshotHopperRuntime("/tmp", HOPPER_TARGET_LEASE_DIRECTORY)
+).paths;
 const client = new Client({ name: "hopper-callers-verifier", version: "1" });
 const transport = new StdioClientTransport({
  command: process.execPath,
@@ -93,7 +95,7 @@ const matchingRef = (ref, site, from, to) =>
  ref.source_procedure?.address === from &&
  ref.target_procedure?.address === to &&
  ref.call?.classification === "direct";
-try {
+await withVerifierCleanup(async () => {
  await run(clang, [
    "-isysroot",
    sdk,
@@ -129,7 +131,6 @@ try {
  await client.connect(transport);
  if (transport.pid === null)
    throw new Error("MCP process identity unavailable");
-  ownedProcessIds.add(transport.pid);
  let notifications = 0;
  const original = transport.onmessage;
  transport.onmessage = (message) => {
@@ -287,23 +288,36 @@ try {
      sha256: beforeLarge,
    }),
  );
-} finally {
-  await client.close();
-  await transport.close();
-  await new Promise((resolve) => setTimeout(resolve, 500));
-  const leaked = [
-    ...(await snapshotHopperRuntime(
-      "/tmp",
-      HOPPER_TARGET_LEASE_DIRECTORY,
-      ownedProcessIds,
-    )),
-  ].filter((path) => !sessionsBefore.has(path));
-  if (leaked.length === 0)
+}, [
+  async () => {
+    try {
+      await closeVerifierResources([
+        () => client.close(),
+        () => transport.close(),
+        async () => {
+          await new Promise((resolve) => setTimeout(resolve, 500));
+          const leaked = [
+            ...(
+              await snapshotHopperRuntime("/tmp", HOPPER_TARGET_LEASE_DIRECTORY)
+            ).paths,
+          ].filter((path) => !sessionsBefore.has(path));
+          assert.deepEqual(
+            leaked,
+            [],
+            `Hopper resources remain: ${leaked.join(", ")}`,
+          );
+        },
+      ]);
+    } catch (cause) {
+      throw new Error(
+        `Hopper cleanup failed; fixture retained at ${directory}`,
+        {
+          cause,
+        },
+      );
+    } finally {
+      if (stderr) process.stderr.write(stderr);
+    }
    await rm(directory, { recursive: true, force: true });
-  if (stderr) process.stderr.write(stderr);
-  assert.deepEqual(
-    leaked,
-    [],
-    `Hopper resources remain: ${leaked.join(", ")}; fixture retained at ${directory}`,
-  );
-}
+  },
+]);
@@ -1,10 +1,11 @@
 import assert from "node:assert/strict";
-import { copyFile, mkdtemp, realpath, rm } from "node:fs/promises";
+import { copyFile, mkdtemp, realpath } from "node:fs/promises";
 import { tmpdir } from "node:os";
 import { join } from "node:path";
 import { fileURLToPath } from "node:url";

 import { firstProcedureAddress } from "./lib/real-hopper-assertions.mjs";
+import { HopperDeadlineCleanup } from "./lib/hopper-deadline-cleanup.mjs";
 import { parseBinaryTarget } from "../dist/application/BinaryTargetResolver.js";
 import { ArtifactResourceScope } from "../dist/artifacts/ArtifactResourceScope.js";
 import { AnalysisCleanupLease } from "../dist/artifacts/AnalysisCleanupLease.js";
@@ -29,6 +30,7 @@ const root = await realpath(
 );
 const target = join(root, "deadline-fixture");
 const profileResources = new ArtifactResourceScope();
+const cleanupOwner = new HopperDeadlineCleanup(root, profileResources);
 const profileResourceScope = {
  retain: (owner, resource) =>
    profileResources.retain({
@@ -40,6 +42,7 @@ const profileResourceScope = {
 };
 let client;
 let primaryFailure;
+let operationFailed = false;
 try {
  await copyFile(fixtures.primary.path, target);
  const parsed = await parseBinaryTarget(target);
@@ -148,31 +151,19 @@ try {
    ),
  );
 } catch (cause) {
+  operationFailed = true;
  primaryFailure = cause;
  throw cause;
 } finally {
-  let cleanupFailure;
-  if (client !== undefined) {
-    const closed = await client.close();
-    if (!closed.ok) cleanupFailure = closed.error;
-  }
  try {
-    await profileResources.close();
-  } catch (cause) {
-    cleanupFailure =
-      cleanupFailure === undefined
-        ? cause
-        : new AggregateError(
-            [cleanupFailure, cause],
-            "Hopper profile and client cleanup failed",
-          );
-  }
-  await rm(root, { recursive: true, force: true });
-  if (cleanupFailure !== undefined)
-    throw primaryFailure === undefined
-      ? cleanupFailure
-      : new AggregateError(
+    if (client !== undefined) cleanupOwner.setClient(client);
+    await cleanupOwner.close();
+  } catch (cleanupFailure) {
+    throw operationFailed
+      ? new AggregateError(
          [primaryFailure, cleanupFailure],
          "Hopper verification and cleanup failed",
-        );
+        )
+      : cleanupFailure;
+  }
 }
@@ -23,6 +23,10 @@ import {
  requireMcpOperationResult,
 } from "./lib/mcp-verifier-results.mjs";
 import { snapshotHopperRuntime } from "./lib/real-hopper-cleanup.mjs";
+import {
+  closeVerifierResources,
+  withVerifierCleanup,
+} from "./lib/verifier-cleanup.mjs";
 import { HOPPER_TARGET_LEASE_DIRECTORY } from "../dist/process/HopperLease.js";
 import { parseConfig } from "../dist/config/parseConfig.js";
 import {
@@ -70,14 +74,12 @@ const intel = join(directory, "c-x86_64");
 const fat = join(directory, "c-fat");
 const fat64 = join(directory, "c-fat64");
 const singleFat = join(directory, "c-single-fat");
-const owned = new Set();
 const extraFat64 = [];
 const invalidFat64 = [];
 let preparedImagePath;
-const before = await snapshotHopperRuntime(
-  "/tmp",
-  HOPPER_TARGET_LEASE_DIRECTORY,
-);
+const before = (
+  await snapshotHopperRuntime("/tmp", HOPPER_TARGET_LEASE_DIRECTORY)
+).paths;
 const client = new Client({ name: "hopper-fat-verifier", version: "1" });
 const transport = new StdioClientTransport({
  command: process.execPath,
@@ -94,7 +96,7 @@ const ajv = new Ajv({ strict: false });
 addFormats(ajv);
 const observations = [];
 const sourceBinding = [];
-try {
+await withVerifierCleanup(async () => {
  await run(toolPaths.clang, [
    "-isysroot",
    sdk,
@@ -183,9 +185,17 @@ try {
        "overlap",
        /slices overlap/u,
        (bytes) => {
-          const cpu = process.arch === "arm64" ? 0x100000c : 0x1000007;
-          const base = bytes.readUInt32BE(8) === cpu ? 8 : 40;
-          bytes.copy(bytes, base === 8 ? 40 : 8, base, base + 32);
+          const firstOffset = bytes.readBigUInt64BE(16);
+          const secondOffset = bytes.readBigUInt64BE(48);
+          const earlier = firstOffset < secondOffset ? 8 : 40;
+          const laterOffset =
+            firstOffset < secondOffset ? secondOffset : firstOffset;
+          const earlierOffset =
+            firstOffset < secondOffset ? firstOffset : secondOffset;
+          bytes.writeBigUInt64BE(
+            laterOffset - earlierOffset + 16n,
+            earlier + 16,
+          );
        },
      ],
    ]) {
@@ -211,11 +221,14 @@ try {
    }
    const path = join(directory, "c-fat64-ambiguous");
    await writeFile(path, ambiguous);
-    invalidFat64.push({ path, reason: /selection.*ambiguous/u });
+    invalidFat64.push({
+      path,
+      reason:
+        /FAT binary declares several (?:arm64|x86_64) slices; no slice was selected/u,
+    });
  }
  await client.connect(transport);
  assert.ok(transport.pid !== null);
-  owned.add(transport.pid);
  const catalog = await client.listTools();
  const call = async (name, args = {}) => {
    const reply = await client.callTool(
@@ -359,14 +372,27 @@ try {
  if (verifyFat64) {
    await call("open_binary", { path: fat64 });
    await call("list_procedures");
-    const resources = [
-      ...(await snapshotHopperRuntime(
-        "/tmp",
-        HOPPER_TARGET_LEASE_DIRECTORY,
-        owned,
-      )),
-    ].filter((path) => !before.has(path));
-    for (const root of resources) {
+    const session = await call("binary_session");
+    const runId = session.analysis_run?.run_id;
+    assert.ok(
+      typeof runId === "string" && runId.length > 0,
+      "Missing analysis run identity",
+    );
+    const resources = await snapshotHopperRuntime(
+      "/tmp",
+      HOPPER_TARGET_LEASE_DIRECTORY,
+      runId,
+    );
+    const unresolvedNew = [...resources.unresolvedSessions].filter(
+      (path) => !before.has(path),
+    );
+    assert.deepEqual(
+      unresolvedNew,
+      [],
+      "Cannot identify a prepared image while new Hopper resource ownership is unresolved",
+    );
+    for (const root of resources.confirmedSessions) {
+      if (before.has(root)) continue;
      const image = join(root, "image.macho");
      if (
        await access(image).then(
@@ -403,27 +429,43 @@ try {
      },
    );
    assert.ok(pending.child.pid !== undefined);
-    owned.add(pending.child.pid);
    const cli = JSON.parse((await pending).stdout);
    assert.deepEqual(cli.normalized_result, expected.mapping);
  }
-} finally {
-  await client.close();
-  await transport.close();
-  await rm(directory, { recursive: true, force: true });
-}
-const retained = [
-  ...(await snapshotHopperRuntime(
-    "/tmp",
-    HOPPER_TARGET_LEASE_DIRECTORY,
-    owned,
-  )),
-].filter((path) => !before.has(path));
-assert.deepEqual(
-  retained,
-  [],
-  "FAT verification retained owned Hopper sessions or leases",
-);
+}, [
+  async () => {
+    try {
+      await closeVerifierResources([
+        () => client.close(),
+        () => transport.close(),
+      ]);
+    } catch (cause) {
+      throw new Error(
+        `Hopper cleanup failed; fixture retained at ${directory}`,
+        {
+          cause,
+        },
+      );
+    }
+    try {
+      const retained = [
+        ...(await snapshotHopperRuntime("/tmp", HOPPER_TARGET_LEASE_DIRECTORY))
+          .paths,
+      ].filter((path) => !before.has(path));
+      assert.deepEqual(
+        retained,
+        [],
+        "Hopper resources remain or are unresolved",
+      );
+    } catch (cause) {
+      throw new Error(
+        `Hopper resource verification failed; fixture retained at ${directory}`,
+        { cause },
+      );
+    }
+    await rm(directory, { recursive: true, force: true });
+  },
+]);
 console.log(
  JSON.stringify(
    {
@@ -62,10 +62,9 @@ const parseServerArgs = (encoded) => {
 };

 const runtimeParent = process.platform === "darwin" ? "/tmp" : tmpdir();
-const sessionsBefore = await snapshotHopperRuntime(
-  runtimeParent,
-  HOPPER_TARGET_LEASE_DIRECTORY,
-);
+const sessionsBefore = (
+  await snapshotHopperRuntime(runtimeParent, HOPPER_TARGET_LEASE_DIRECTORY)
+).paths;
 const ownedProcessIds = new Set();
 const textValue = mcpTextValue;

@@ -557,11 +556,8 @@ try {

 await new Promise((resolve) => setTimeout(resolve, 500));
 const sessionsAfter = [
-  ...(await snapshotHopperRuntime(
-    runtimeParent,
-    HOPPER_TARGET_LEASE_DIRECTORY,
-    ownedProcessIds,
-  )),
+  ...(await snapshotHopperRuntime(runtimeParent, HOPPER_TARGET_LEASE_DIRECTORY))
+    .paths,
 ]
  .filter((path) => !sessionsBefore.has(path))
  .sort();
@@ -573,7 +569,7 @@ if (sessionsAfter.length > 0) {
    retainedRuntimePaths: sessionsAfter,
  });
  throw new Error(
-    `The MCP runtime retained Hopper resources: ${sessionsAfter.join(", ")}`,
+    `Hopper resources remain or have unresolved ownership: ${sessionsAfter.join(", ")}`,
  );
 }
 if (summary === undefined)
@@ -40,7 +40,7 @@ try {
  const expected = [];
  for (const path of files.stdout
    .split("\0")
-    .filter((path) => path.endsWith(".test.ts"))) {
+    .filter((path) => /\.(?:test|spec)\.[cm]?[jt]sx?$/u.test(path))) {
    try {
      if ((await stat(join(root, path))).isFile()) expected.push(path);
    } catch (cause) {
@@ -65,4 +65,6 @@ try {
  await rm(temporary, { recursive: true, force: true });
 }
 if (discovered !== undefined)
-  console.log(`Discovered all ${discovered} test files exactly once.`);
+  console.log(
+    `Discovered all ${discovered} test and spec files in src and tests exactly once.`,
+  );
@@ -6,7 +6,7 @@ import { join } from "node:path";
 import { fileURLToPath } from "node:url";
 import { promisify } from "node:util";
 import { parseBinaryTarget } from "../../../dist/application/BinaryTargetResolver.js";
-import { ArtifactResourceScope } from "../../../dist/artifacts/ArtifactResourceScope.js";
+import { withVerifierArtifactScope } from "../../lib/verifier-artifact-scope.mjs";
 import { inspectAppleDispatchMetadata } from "../../../dist/native/AppleDispatchMetadata.js";
 import {
  artifactCliEvidence,
@@ -57,8 +57,7 @@ const fixupCoverage = (metadata) =>
 const inspect = async (path) => {
  const target = await parseBinaryTarget(path);
  if (!target.ok) throw target.error;
-  const resources = new ArtifactResourceScope();
-  try {
+  return withVerifierArtifactScope(async (resources) => {
    return {
      target: target.value,
      metadata: (
@@ -67,10 +66,7 @@ const inspect = async (path) => {
        )
      ).result,
    };
-  } finally {
-    // Retry any descriptor whose close failed, surfacing unresolved cleanup.
-    await resources.close();
-  }
+  });
 };

 const checkObjc = (metadata, mode) => {
@@ -5,17 +5,12 @@ import { join, relative, sep } from "node:path";
 import { fileURLToPath } from "node:url";

 // Architecture guards for the strict-identity / best-effort-inference split.
-// - Evidence ordering must be locale-independent (ICU varies by host), so
-//   src/domain orders with compareUnicodeCodePoints, never localeCompare.
 // - Composite dedup keys must not NUL-join variable-length or free-form
 //   MIDDLE fields: ["a\0b"] collapses with ["a", "b"] and drops a finding.
-//   compositeKey (JSON tuple) is the single owner for composite keys.
+//   The text check below only flags one spelling; it is not a complete audit.
 // - Transparent wrappers unwrap in exactly one place
 //   (javascriptAstValues.unwrapJavaScriptExpression); direct isTS* unwrapping
 //   elsewhere drifts (the `satisfies` class of bug).
-// - AST walks go through traverseJavaScriptAst/childNodes: bespoke
-//   Object.values walkers diverge on loc/comment fields and overflow the
-//   stack on deep generated chains.

 const root = fileURLToPath(new URL("../../", import.meta.url));

@@ -27,6 +22,7 @@ const listFiles = async (dir) => {
    else if (
      entry.name.endsWith(".ts") &&
      !entry.name.endsWith(".test.ts") &&
+      !entry.name.endsWith(".spec.ts") &&
      !entry.name.endsWith(".fixture.ts")
    )
      output.push(path);
@@ -48,8 +44,6 @@ const files = await Promise.all(
    content: stripComments(await readFile(path, "utf8")),
  })),
 );
-const inDir = (dir) => files.filter((file) => file.path.startsWith(dir));
-
 const failures = [];
 const check = (label, selected, pattern, allow = []) => {
  const offenders = selected.filter(
@@ -68,21 +62,7 @@ check(
  /providers\/ProviderInspectionScope\.js/,
 );

-check(
-  "src/domain uses localeCompare (use compareUnicodeCodePoints)",
-  inDir("src/domain/"),
-  /\.localeCompare\(/,
-);
-
-check(
-  "NUL-joined list key (use compositeKey)",
-  files,
-  /\.join\(["']\\0["']\)/,
-  [
-    // Sorted pair of constrained trace IDs; documented in plan.
-    "src/domain/process/processTraceSpecification.ts",
-  ],
-);
+check("NUL-joined list key (use compositeKey)", files, /\.join\(["']\\0["']\)/);

 check(
  "direct transparent-wrapper unwrap outside javascriptAstValues (use unwrapJavaScriptExpression)",
@@ -91,13 +71,6 @@ check(
  ["src/domain/javascript/javascriptAstValues.ts"],
 );

-check(
-  "bespoke AST child walker (use traverseJavaScriptAst/childNodes)",
-  files,
-  /VISITOR_KEYS/,
-  ["src/domain/javascript/javascriptSemanticTraversal.ts"],
-);
-
 // A producer that pins both the soft and hard ceiling of every resource takes
 // the vector from one owner. prlimitCeilingArguments is the command-less prefix
 // of prlimitArgumentVector; both live in src/process/LinuxResourceLimits.ts.
@@ -163,7 +136,6 @@ check(
    "src/application/GuidanceAccess.ts",
    "src/application/javascript/ElectronBoundaryAnalysis.ts",
    "src/application/javascript/ElectronBoundaryGraphContext.ts",
-    "src/application/javascript/JavaScriptArtifactGraphContext.ts",
    "src/browser/CdpCaptureCompleteness.ts",
    "src/browser/CdpCaptureEventHandlers.ts",
    "src/browser/CdpPageCapture.ts",
@@ -179,7 +151,6 @@ check(
    "src/domain/javascript/javascriptNativeHandoff.ts",
    "src/domain/javascript/javascriptRuntimeReconciliationMatching.ts",
    "src/domain/javascript/javascriptRuntimeReconciliationSchemas.ts",
-    "src/domain/javascript/javascriptSemanticQuery.ts",
    "src/domain/javascript/javascriptStaticAnalysisBundler.ts",
    "src/domain/javascript/javascriptStaticAnalysisCalls.ts",
    "src/domain/javascript/javascriptStaticAnalysisFindings.ts",
@@ -5,7 +5,6 @@ import { parseArgs } from "node:util";

 import { readStableArtifact } from "../../../dist/artifacts/readStableArtifact.js";
 import { ArtifactReaderFailure } from "../../../dist/artifacts/ArtifactReader.js";
-import { ArtifactResourceScope } from "../../../dist/artifacts/ArtifactResourceScope.js";
 import {
  ArtifactFileCleanupFailure,
  artifactFileCompletion,
@@ -14,6 +13,7 @@ import {

 import { reconcileJavaScriptRuntimeEvidence } from "../../../dist/application/javascript/JavaScriptRuntimeReconciliationService.js";
 import { analyzeJavaScriptApplicationWithOwnedScope } from "../../lib/javascript-application-analysis.mjs";
+import { withVerifierArtifactScope } from "../../lib/verifier-artifact-scope.mjs";
 import {
  completeVerifierRun,
  createVerifierRun,
@@ -106,33 +106,23 @@ process.stdout.write(
 );

 async function readEvidenceFile(path) {
-  const scope = new ArtifactResourceScope();
  let outcome;
  try {
    outcome = {
      ok: true,
-      value: await readStableArtifact(
-        await realpath(path),
-        64 * 1024 * 1024,
-        undefined,
-        undefined,
-        scope,
+      value: await withVerifierArtifactScope(async (scope) =>
+        readStableArtifact(
+          await realpath(path),
+          64 * 1024 * 1024,
+          undefined,
+          undefined,
+          scope,
+        ),
      ),
    };
  } catch (cause) {
    outcome = { ok: false, cause };
  }
-  try {
-    await scope.close();
-  } catch (cleanupCause) {
-    if (!outcome.ok)
-      throw new AggregateError(
-        [outcome.cause, cleanupCause],
-        "Verifier cleanup failed",
-        { cause: outcome.cause },
-      );
-    throw cleanupCause;
-  }
  if (!outcome.ok && outcome.cause instanceof ArtifactFileCleanupFailure) {
    const completion = artifactFileCompletion(outcome.cause);
    outcome =
@@ -1,10 +1,9 @@
 import { basename, dirname, isAbsolute, resolve } from "node:path";
-import { ArtifactResourceScope } from "../../../dist/artifacts/ArtifactResourceScope.js";
 import {
  readManagedSnapshot,
  verifyManagedSourceIdentity,
 } from "../../../dist/dotnet/ManagedSnapshot.js";
-import { withVerifierCleanup } from "../../lib/verifier-cleanup.mjs";
+import { withVerifierArtifactScope } from "../../lib/verifier-artifact-scope.mjs";

 import { parseBinaryTarget } from "../../../dist/application/BinaryTargetResolver.js";
 import { inspectManagedArtifactBytes } from "../../../dist/dotnet/ManagedArtifactInspector.js";
@@ -24,13 +23,10 @@ import {
 const READ_FILE_MAX_BYTES = 0x7fff_ffff;

 export async function verifyManagedAppManifest(rawManifest, manifestPath) {
-  const resources = new ArtifactResourceScope();
-  return withVerifierCleanup(
-    () =>
-      resources.run(() =>
-        verifyManifestSnapshot(rawManifest, manifestPath, resources),
-      ),
-    [() => resources.close()],
+  return withVerifierArtifactScope((resources) =>
+    resources.run(() =>
+      verifyManifestSnapshot(rawManifest, manifestPath, resources),
+    ),
  );
 }

@@ -1,13 +1,6 @@
 /** Relative path of the registry. Its text is a declaration, not a producer. */
 export const NUMERIC_LIMIT_DECLARATION: "src/domain/numericLimitRegistry.ts";

-/** Limits that must become analysis settings and cannot be registry exceptions. */
-export const REQUIRED_RUNTIME_LIMITS: readonly [
-  "REA_NTFS_MFT_MAX_FILE_BYTES",
-  "REA_REGF_HIVE_MAX_FILE_BYTES",
-  "REA_WEB_BUNDLE_ENDPOINT_LITERAL_CANDIDATES",
-];
-
 /** True for a numeric `REA_` limit, including the documented endpoint-candidate count. */
 export function isNumericLimit(name: string): boolean;

@@ -55,6 +48,8 @@ export function discoverNumericLimitUses(
  readonly unresolved: readonly {
    readonly path: string;
    readonly offset: number;
+    readonly line: number;
+    readonly column: number;
    readonly reason: string;
  }[];
 };
@@ -25,6 +25,7 @@ const listFiles = async (dir) => {
    } else if (
      entry.name.endsWith(".ts") &&
      !entry.name.endsWith(".test.ts") &&
+      !entry.name.endsWith(".spec.ts") &&
      !entry.name.endsWith(".fixture.ts")
    )
      output.push(path);
@@ -39,7 +40,7 @@ export const NUMERIC_LIMIT_DECLARATION = "src/domain/numericLimitRegistry.ts";
 * These limits are moving onto runtime analysis settings on their own PRs.
 * A producer or a registry entry cannot satisfy that requirement.
 */
-export const REQUIRED_RUNTIME_LIMITS = [
+const REQUIRED_RUNTIME_LIMITS = [
  "REA_NTFS_MFT_MAX_FILE_BYTES",
  "REA_REGF_HIVE_MAX_FILE_BYTES",
  "REA_WEB_BUNDLE_ENDPOINT_LITERAL_CANDIDATES",
@@ -170,8 +171,16 @@ const stringBindings = (sourceFile, symbols, unresolved) => {
          item.offset === offset &&
          item.reason === reason,
      )
-    )
-      unresolved.push({ path, offset, reason });
+    ) {
+      const location = sourceFile.getLineAndCharacterOfPosition(offset);
+      unresolved.push({
+        path,
+        offset,
+        line: location.line + 1,
+        column: location.character + 1,
+        reason,
+      });
+    }
  };
  const initializer = (identifier) => {
    if (!candidates.has(identifier.text)) return undefined;
@@ -949,7 +958,7 @@ if (direct) {

  for (const issue of discovered.unresolved)
    console.log(
-      `${issue.path}:${issue.offset}: numeric limit candidate unresolved (${issue.reason})`,
+      `${issue.path}:${issue.line}:${issue.column}: numeric limit candidate unresolved (${issue.reason})`,
    );

  for (const [name, file] of [...discovered].sort(([left], [right]) =>
@@ -1,6 +1,8 @@
 import type { JadxToolPort } from "./JadxAnalysis.js";
-import type { AndroidNativeDeclarations } from "../domain/android/androidNativeDeclarations.js";
-import { jadxNativeDeclarationsSchema } from "./JadxProtocol.js";
+import {
+  androidNativeDeclarationsSchema,
+  type AndroidNativeDeclarations,
+} from "../domain/android/androidNativeDeclarations.js";
 import { AnalysisOutputError } from "../domain/analysisErrorCore.js";

 /** Validate the native-only batch at its producing boundary, preserving raw facts. */
@@ -9,7 +11,7 @@ export const readAndroidNativeInventory = async (
  snapshot: string,
 ): Promise<AndroidNativeDeclarations> => {
  const raw = await tools.json("rea_native_declarations", { path: snapshot });
-  const parsed = jadxNativeDeclarationsSchema.safeParse(raw);
+  const parsed = androidNativeDeclarationsSchema.safeParse(raw);
  if (!parsed.success)
    throw new AnalysisOutputError(
      "inspect_android_jni_bindings",
@@ -10,11 +10,6 @@ import {
  dexDescriptorSchema,
  dexTypeSchema,
 } from "../domain/android/dexTypes.js";
-import { androidNativeDeclarationsSchema } from "../domain/android/androidNativeDeclarations.js";
-
-/** Native-only raw DEX facts authored before decompiler deduplication. */
-export const jadxNativeDeclarationsSchema = androidNativeDeclarationsSchema;
-
 const count = z.int().nonnegative();
 /** Typed allocation failures authored before upstream erases the JVM exception. */
 const jadxMemoryFailureSchema = z.strictObject({
@@ -1,6 +1,6 @@
 import { fixedAllowanceOptions } from "../domain/fixedAllowanceRemediation.js";
 import { ArtifactReaderFailure } from "../artifacts/ArtifactReader.js";
-import { stableArtifactInputRecovery } from "../artifacts/StableArtifactFailure.js";
+import { stableArtifactInputFailure } from "../artifacts/StableArtifactFailure.js";
 import {
  artifactFilePrimaryFacts,
  type ArtifactFilePrimaryFacts,
@@ -231,11 +231,7 @@ const artifactReaderFailure = (
        },
      );
    case "path":
-      return new AnalysisInputError(
-        OPERATION,
-        { cause, ...stableArtifactInputRecovery(cause) },
-        [{ path: ["path"], reason: "invalid_format", message: cause.message }],
-      );
+      return stableArtifactInputFailure(cause, OPERATION);
    default:
      return adapterFailure(cause, path);
  }
@@ -18,6 +18,123 @@ const extension = {
  timeout: 300,
 };

+describe("Goose YAML source key retention", () => {
+  it("updates and removes an extension selected through aliased path keys", () => {
+    const source =
+      "table: &table extensions\nname: &name rea\n? *table\n:\n  ? *name\n  : {cmd: old, type: stdio}\n";
+    const updated = editGooseConfigurationYaml(source, ["extensions", "rea"], {
+      cmd: "rea",
+      type: "stdio",
+    });
+    expect(updated).toContain("*table");
+    expect(updated).toContain("*name");
+    expect(parseGooseConfigurationYaml(updated)).toMatchObject({
+      extensions: { rea: { cmd: "rea", type: "stdio" } },
+    });
+    const removed = editGooseConfigurationYaml(
+      updated,
+      ["extensions", "rea"],
+      undefined,
+    );
+    expect(removed).not.toContain("*name");
+    expect(parseGooseConfigurationYaml(removed)).toMatchObject({
+      extensions: {},
+    });
+    const ambiguous =
+      "name: &name rea\nextensions:\n  ? *name\n  : {cmd: first}\n  rea: {cmd: second}\n";
+    expect(() =>
+      editGooseConfigurationYaml(ambiguous, ["extensions", "rea"], {
+        cmd: "rea",
+      }),
+    ).toThrow(/more than one key resolving to "rea"/);
+  });
+
+  it("retains a collection mapping key when an adjacent field changes", () => {
+    const source =
+      "extensions:\n  rea:\n    cmd: old\n    ? [one, two]\n    : retained\n";
+    const parsed = parseGooseConfigurationYaml(source) as {
+      extensions: { rea: Record<string, unknown> };
+    };
+    const updated = editGooseConfigurationYaml(source, ["extensions", "rea"], {
+      ...parsed.extensions.rea,
+      cmd: "rea",
+    });
+    const document = parseDocument(updated);
+    expect(document.errors).toEqual([]);
+    const native = document.toJS({ mapAsMap: true }) as Map<string, unknown>;
+    const extensions = native.get("extensions") as Map<string, unknown>;
+    const entry = extensions.get("rea") as Map<unknown, unknown>;
+    expect([...entry.entries()]).toContainEqual([["one", "two"], "retained"]);
+    expect(entry.get("cmd")).toBe("rea");
+  });
+
+  it("retains an aliased mapping key when an adjacent launcher field changes", () => {
+    const source =
+      'label: &label 1\nextensions:\n  rea:\n    cmd: old\n    ? *label\n    : numeric\n    "1": string\n';
+    const parsed = parseGooseConfigurationYaml(source) as {
+      extensions: { rea: Record<string, unknown> };
+    };
+    const updated = editGooseConfigurationYaml(source, ["extensions", "rea"], {
+      ...parsed.extensions.rea,
+      cmd: "rea",
+    });
+    expect(updated).toContain("*label");
+    expect(updated).toContain("numeric");
+    expect(updated).toContain('"1": string');
+  });
+
+  it("preserves the order of an anchor and a retained non-string key alias", () => {
+    const source =
+      'extensions:\n  rea:\n    cmd: old\n    shared: &seed value\n    1: *seed\n    "1": string\n';
+    const parsed = parseGooseConfigurationYaml(source) as {
+      extensions: { rea: Record<string, unknown> };
+    };
+    const updated = editGooseConfigurationYaml(source, ["extensions", "rea"], {
+      ...parsed.extensions.rea,
+      cmd: "rea",
+    });
+    expect(updated.indexOf("&seed")).toBeLessThan(updated.indexOf("*seed"));
+    expect(parseGooseConfigurationYaml(updated)).toMatchObject({
+      extensions: { rea: { shared: "value", cmd: "rea" } },
+    });
+  });
+
+  it("retains distinct keys beside an edited field and rejects an ambiguous edit", () => {
+    const source =
+      'extensions:\n  rea:\n    cmd: old\n    1: numeric\n    "1": string\n';
+    const parsed = parseGooseConfigurationYaml(source) as {
+      extensions: { rea: Record<string, unknown> };
+    };
+    const entry = parsed.extensions.rea;
+    const updated = editGooseConfigurationYaml(source, ["extensions", "rea"], {
+      ...entry,
+      cmd: "rea",
+    });
+    expect(updated).toContain('    1: numeric\n    "1": string');
+    expect(updated).toContain("cmd: rea");
+    expect(() =>
+      editGooseConfigurationYaml(source, ["extensions", "rea"], {
+        ...entry,
+        "1": "changed",
+      }),
+    ).toThrow(/source identity is not a plain string key/);
+  });
+
+  it("keeps distinct native mapping keys in unchanged extension settings", () => {
+    const source =
+      'extensions:\n  rea:\n    cmd: old\n    metadata:\n      1: numeric\n      "1": string\n';
+    const parsed = parseGooseConfigurationYaml(source) as {
+      extensions: { rea: Record<string, unknown> };
+    };
+    const updated = editGooseConfigurationYaml(source, ["extensions", "rea"], {
+      ...parsed.extensions.rea,
+      cmd: "rea",
+    });
+    expect(updated).toContain('      1: numeric\n      "1": string');
+    expect(updated).toContain("cmd: rea");
+  });
+});
+
 describe("Goose YAML 1.2 source facts", () => {
  it("keeps native strings and exact large integer facts distinct", () => {
    const source =
@@ -13,6 +13,7 @@ import { ConfigurationError } from "../domain/configurationErrors.js";
 import {
  copyYamlAliasSource,
  preserveYamlAliasValues,
+  resolveYamlEditPath,
 } from "./YamlConfigurationAliases.js";
 import {
  retainYamlConfigurationSource,
@@ -251,7 +252,7 @@ export const editGooseConfigurationYaml = (
  if (!isMap(document.contents))
    throw new ConfigurationError("Goose configuration root must be a mapping");
  for (let length = 1; length < path.length; length++) {
-    const parent = path.slice(0, length);
+    const parent = resolveYamlEditPath(document, path.slice(0, length));
    let previous = document.getIn(parent, true);
    if (isAlias(previous)) {
      previous = copyYamlAliasSource(previous, document);
@@ -262,28 +263,28 @@ export const editGooseConfigurationYaml = (
      document.setIn(parent, document.createNode({}));
    } else if (!isMap(previous))
      throw new ConfigurationError(
-        `Goose configuration ${parent.join(".")} must be a mapping`,
+        `Goose configuration ${path.slice(0, length).join(".")} must be a mapping`,
      );
  }
-  const previous = document.getIn(path, true);
-  const parent = document.getIn(path.slice(0, -1), true);
+  const sourcePath = resolveYamlEditPath(document, path);
+  const previous = document.getIn(sourcePath, true);
+  const parent = document.getIn(sourcePath.slice(0, -1), true);
  const removedKey =
    value === undefined && isMap(parent)
-      ? parent.items.find(
-          (pair) => isScalar(pair.key) && pair.key.value === path.at(-1),
-        )?.key
+      ? parent.items.find((pair) => pair.key === sourcePath.at(-1))?.key
      : undefined;
  const retained = preserveYamlAliasValues(document, [previous, removedKey]);
  if (value === undefined) {
-    if (!document.deleteIn(path)) return text;
+    if (!document.deleteIn(sourcePath)) return text;
  } else
    document.setIn(
-      path,
+      sourcePath,
      isMap(previous) || isSeq(previous)
        ? retainYamlConfigurationSource(
            previous,
            document.createNode(value),
            retained,
+            document,
          )
        : value,
    );
@@ -12,6 +12,69 @@ import {
  stringifyHermesConfigurationYaml,
 } from "./HermesConfigurationYaml.js";

+it("uses the first inherited mapping when creating an override", () => {
+  const source =
+    "first: &first\n  mcp_servers:\n    one: {command: first}\nsecond: &second\n  mcp_servers:\n    two: {command: second}\n<<: [*first, *second]\n";
+  const updated = editHermesConfigurationYaml(source, ["mcp_servers", "rea"], {
+    command: "rea",
+  });
+  const parsed = parseHermesConfigurationYaml(updated) as {
+    mcp_servers: Record<string, unknown>;
+  };
+  expect(parsed.mcp_servers).toEqual({
+    one: { command: "first" },
+    rea: { command: "rea" },
+  });
+  expect(
+    parseHermesConfigurationYaml(
+      updated.replace("command: first", "command: changed"),
+    ),
+  ).toMatchObject({
+    mcp_servers: { one: { command: "changed" } },
+  });
+});
+
+it("refuses an inherited override when an existing anchor name is shadowed", () => {
+  const source =
+    "shared: &shared\n  mcp_servers: &table\n    other: {command: first}\nshadow: &table {other: {command: second}}\n<<: *shared\n";
+  expect(() =>
+    editHermesConfigurationYaml(source, ["mcp_servers", "rea"], {
+      command: "rea",
+    }),
+  ).toThrow(/anchor is shadowed/);
+});
+
+it("retains inherited YAML settings when updating a registration", () => {
+  const source =
+    "defaults: &defaults\n  enabled: false\nmcp_servers:\n  rea:\n    <<: *defaults\n    command: old\n";
+  const parsed = parseHermesConfigurationYaml(source) as {
+    mcp_servers: { rea: Record<string, unknown> };
+  };
+  const updated = editHermesConfigurationYaml(source, ["mcp_servers", "rea"], {
+    ...parsed.mcp_servers.rea,
+    command: "rea",
+  });
+  expect(updated).toContain("<<: *defaults");
+  const changedDefault = updated.replace("enabled: false", "enabled: true");
+  expect(parseHermesConfigurationYaml(changedDefault)).toMatchObject({
+    mcp_servers: { rea: { command: "rea", enabled: true } },
+  });
+  const overridden = editHermesConfigurationYaml(
+    source,
+    ["mcp_servers", "rea"],
+    { ...parsed.mcp_servers.rea, command: "rea", enabled: true },
+  );
+  expect(overridden).toContain("<<: *defaults");
+  expect(parseHermesConfigurationYaml(overridden)).toMatchObject({
+    mcp_servers: { rea: { command: "rea", enabled: true } },
+  });
+  expect(() =>
+    editHermesConfigurationYaml(source, ["mcp_servers", "rea"], {
+      command: "rea",
+    }),
+  ).toThrow(/Cannot remove inherited YAML setting/);
+});
+
 it("preserves annotations on changed registration mappings and scalar fields", () => {
  const source =
    "mcp_servers:\n  rea: # registration note\n    command: old # command note\n    env: # environment note\n      MODE: old # mode note\n    args: # arguments note\n      - old # argument note\n";
@@ -3,16 +3,21 @@ import {
  isMap,
  isScalar,
  isSeq,
+  Pair,
  parseDocument,
  Document,
  Schema,
+  YAMLMap,
+  type Node,
  type ParsedNode,
  type ScalarTag,
  type Tags,
 } from "yaml";
+import { ConfigurationError } from "../domain/configurationErrors.js";
 import {
  preserveYamlAliasValues,
  copyYamlAliasSource,
+  resolveYamlEditPath,
 } from "./YamlConfigurationAliases.js";
 import {
  retainYamlConfigurationSource,
@@ -268,6 +273,102 @@ const parseHermesDocument = (text: string) => {
  return document;
 };

+const projectedYamlPathExists = (
+  document: Document,
+  path: readonly string[],
+): boolean => {
+  let current: unknown = document.toJS();
+  for (const segment of path) {
+    if (
+      typeof current !== "object" ||
+      current === null ||
+      !Object.hasOwn(current, segment)
+    )
+      return false;
+    current = (current as Record<string, unknown>)[segment];
+  }
+  return true;
+};
+
+const inheritedRegistrationRemovalError = () =>
+  new ConfigurationError(
+    "The registration is inherited from a YAML merge. Remove it at the shared source before rerunning uninstall",
+  );
+
+/** Find the source node selected by YAML merge precedence. */
+const inheritedYamlValue = (
+  document: Document,
+  source: unknown,
+  name: string,
+  visiting = new Set<object>(),
+): unknown => {
+  const node = isAlias(source) ? source.resolve(document) : source;
+  if (!isMap(node) || visiting.has(node)) return undefined;
+  visiting.add(node);
+  try {
+    const matches = node.items.filter((pair) => {
+      const key = isAlias(pair.key) ? pair.key.resolve(document) : pair.key;
+      return isScalar(key) && key.value === name;
+    });
+    if (matches.length > 1)
+      throw new ConfigurationError(
+        `YAML mapping contains more than one key resolving to ${JSON.stringify(name)}`,
+      );
+    if (matches[0] !== undefined) return matches[0].value;
+    for (const pair of node.items) {
+      if (
+        !isScalar(pair.key) ||
+        typeof pair.key.value !== "symbol" ||
+        pair.key.source !== "<<"
+      )
+        continue;
+      const merged = isAlias(pair.value)
+        ? pair.value.resolve(document)
+        : pair.value;
+      const sources = isSeq(merged) ? merged.items : [merged];
+      for (const candidate of sources) {
+        const found = inheritedYamlValue(document, candidate, name, visiting);
+        if (found !== undefined) return found;
+      }
+    }
+    return undefined;
+  } finally {
+    visiting.delete(node);
+  }
+};
+
+/** Create a local override that continues to inherit the shared mapping. */
+const inheritedYamlMapOverride = (
+  document: Document,
+  parent: readonly (string | Node)[],
+  name: string,
+): void => {
+  const owner =
+    parent.length === 1
+      ? document.contents
+      : document.getIn(parent.slice(0, -1), true);
+  let inherited = inheritedYamlValue(document, owner, name);
+  if (isAlias(inherited)) inherited = inherited.resolve(document);
+  if (!isMap(inherited))
+    throw new ConfigurationError(
+      `Inherited YAML setting ${JSON.stringify(name)} is not a mapping`,
+    );
+  const mergeDocument = parseHermesDocument("<<: {}\n");
+  if (
+    !isMap(mergeDocument.contents) ||
+    mergeDocument.contents.items[0] === undefined
+  )
+    throw new ConfigurationError("Cannot create a YAML merge key");
+  const alias = document.createAlias(inherited, "rea_inherited");
+  const override = new YAMLMap(document.schema);
+  override.items.push(new Pair(mergeDocument.contents.items[0].key, alias));
+  document.setIn(parent, override);
+  if (alias.resolve(document) !== inherited)
+    throw new ConfigurationError(
+      "The inherited YAML anchor is shadowed; edit its shared source before rerunning setup",
+    );
+};
+
 /** Parse a Hermes `config.yaml`, preserving the distinction between no root and explicit null. */
 export const parseHermesConfigurationYaml = (text: string): unknown => {
  const document = parseHermesDocument(text);
@@ -299,7 +400,7 @@ export const editHermesConfigurationYaml = (
    document.contents = map;
  }
  for (let length = 1; length < path.length; length++) {
-    const parent = path.slice(0, length);
+    const parent = resolveYamlEditPath(document, path.slice(0, length));
    const previous = document.getIn(parent, true);
    if (isAlias(previous)) {
      const copied = copyYamlAliasSource(previous, document);
@@ -308,35 +409,49 @@ export const editHermesConfigurationYaml = (
        document.setIn(parent, copied);
      }
    } else if (value !== undefined && !document.hasIn(parent)) {
+      if (projectedYamlPathExists(document, path.slice(0, length))) {
+        inheritedYamlMapOverride(document, parent, path[length - 1]!);
+        continue;
+      }
      // Implicit JS Map parents serialize as !!omap in YAML 1.1.
      document.setIn(parent, document.createNode({}));
    }
  }
-  const previous = document.getIn(path, true);
+  const sourcePath = resolveYamlEditPath(document, path);
+  const previous = document.getIn(sourcePath, true);
  // Deletion removes the pair's key too; replacement retains that key node.
  const parent =
-    value === undefined ? document.getIn(path.slice(0, -1), true) : undefined;
+    value === undefined
+      ? document.getIn(sourcePath.slice(0, -1), true)
+      : undefined;
+  if (
+    value === undefined &&
+    !document.hasIn(sourcePath) &&
+    projectedYamlPathExists(document, path)
+  )
+    throw inheritedRegistrationRemovalError();
  const removedKey = isMap(parent)
-    ? parent.items.find(
-        (pair) => isScalar(pair.key) && pair.key.value === path.at(-1),
-      )?.key
+    ? parent.items.find((pair) => pair.key === sourcePath.at(-1))?.key
    : undefined;
  const retainedSources = preserveYamlAliasValues(document, [
    previous,
    removedKey,
  ]);
  if (value === undefined) {
-    if (!document.deleteIn(path)) return text;
+    if (!document.deleteIn(sourcePath)) return text;
+    if (projectedYamlPathExists(document, path))
+      throw inheritedRegistrationRemovalError();
  } else {
    // Let YAML's scalar update preserve numeric formats for a direct edit.
    // Replacing containers needs explicit retention of unchanged child nodes.
    document.setIn(
-      path,
+      sourcePath,
      isMap(previous) || isSeq(previous)
        ? retainYamlConfigurationSource(
            previous,
            document.createNode(value),
            retainedSources,
+            document,
          )
        : value,
    );
@@ -1089,11 +1089,13 @@ const removeClient = async (
      // clientRegistrationRemoval admitted only names whose repeats REA owns.
      { removeShadowedMembersAt: editedPaths },
    );
-  } catch {
+  } catch (cause: unknown) {
    return item(
      client.name,
      "failed",
-      "Configuration could not be updated, so no change was made. Repair the configuration, then rerun uninstall.",
+      cause instanceof ConfigurationError
+        ? `Configuration could not be updated, so no change was made. ${cause.message}.`
+        : "Configuration could not be updated, so no change was made. Repair the configuration, then rerun uninstall.",
    );
  }
  if (!serialized.ok)
@@ -9,6 +9,36 @@ import {
  type Document,
  type Node,
 } from "yaml";
+import { ConfigurationError } from "../domain/configurationErrors.js";
+
+/** Resolve literal and aliased string keys to their source nodes for editing. */
+export const resolveYamlEditPath = (
+  document: Document,
+  path: readonly string[],
+): (string | Node)[] => {
+  const resolved: (string | Node)[] = [];
+  let current: unknown = document.contents;
+  for (const name of path) {
+    if (isAlias(current)) current = current.resolve(document);
+    if (!isMap(current)) {
+      resolved.push(name);
+      current = undefined;
+      continue;
+    }
+    const matches = current.items.filter((pair) => {
+      const key = isAlias(pair.key) ? pair.key.resolve(document) : pair.key;
+      return isScalar(key) && key.value === name;
+    });
+    if (matches.length > 1)
+      throw new ConfigurationError(
+        `YAML mapping contains more than one key resolving to ${JSON.stringify(name)}.`,
+      );
+    const pair = matches[0];
+    resolved.push(pair !== undefined && isNode(pair.key) ? pair.key : name);
+    current = pair?.value;
+  }
+  return resolved;
+};

 interface AliasCopies {
  readonly targets: ReadonlyMap<Alias, Node | undefined>;
@@ -3,10 +3,17 @@ import {
  isNode,
  isScalar,
  isSeq,
+  Pair,
+  visit,
+  YAMLMap,
+  type Document,
  type Node,
  type ScalarTag,
  type Tags,
+  type YAMLSeq,
 } from "yaml";
+import { isDeepStrictEqual } from "node:util";
+import { ConfigurationError } from "../domain/configurationErrors.js";
 import { retainYamlSequenceAnnotations } from "./YamlSequenceAnnotations.js";

 export const yamlNumericValuesEqual = (
@@ -26,12 +33,50 @@ export const yamlNumericValuesEqual = (
  );
 };

-/** Keep source annotations and unchanged scalars when updating a value. */
+const normalizeYamlInteger = (_key: unknown, value: unknown): unknown =>
+  typeof value === "bigint" && Number.isSafeInteger(Number(value))
+    ? Number(value)
+    : value;
+
+const containsRetainedSource = (
+  roots: readonly unknown[],
+  retainedSources: ReadonlySet<Node>,
+): boolean => {
+  if (retainedSources.size === 0) return false;
+  let found = false;
+  for (const root of roots) {
+    if (!isNode(root)) continue;
+    visit(root, {
+      Value: (_key, node) => {
+        if (retainedSources.has(node)) found = true;
+      },
+    });
+  }
+  return found;
+};
+
+/** Keep source nodes and annotations when updating a value. */
 export const retainYamlConfigurationSource = (
  previous: unknown,
  next: Node,
  retainedSources: ReadonlySet<Node>,
+  document: Document,
 ): Node => {
+  if (
+    (isMap(previous) || isSeq(previous)) &&
+    ((isMap(previous) && isMap(next)) || (isSeq(previous) && isSeq(next)))
+  ) {
+    // Object projection can collapse distinct YAML keys. Reuse an unchanged
+    // collection before reconstructing its children from that projection.
+    if (
+      !containsRetainedSource([previous], retainedSources) &&
+      isDeepStrictEqual(
+        previous.toJS(document, { reviver: normalizeYamlInteger }),
+        next.toJS(document, { reviver: normalizeYamlInteger }),
+      )
+    )
+      return previous;
+  }
  if (
    isScalar(previous) &&
    isScalar(next) &&
@@ -60,53 +105,235 @@ export const retainYamlConfigurationSource = (
      next.spaceBefore = previous.spaceBefore;
  }
  if (isMap(previous) && isMap(next)) {
-    const entries = new Map(
-      previous.items.flatMap((pair) =>
-        isScalar(pair.key) && typeof pair.key.value === "string"
-          ? [[pair.key.value, pair] as const]
-          : [],
-      ),
-    );
-    for (const pair of next.items) {
-      const key = isScalar(pair.key) ? pair.key.value : undefined;
-      const prior = typeof key === "string" ? entries.get(key) : undefined;
-      if (prior === undefined) continue;
-      pair.key = isNode(pair.key)
-        ? retainYamlConfigurationSource(prior.key, pair.key, retainedSources)
-        : prior.key;
-      if (isNode(pair.value))
-        pair.value = retainYamlConfigurationSource(
-          prior.value,
-          pair.value,
-          retainedSources,
-        );
-    }
+    retainYamlMapSource(previous, next, retainedSources, document);
  } else if (isSeq(previous) && isSeq(next)) {
-    const stringItems = (items: readonly unknown[]) =>
-      items.every((item) => isScalar(item) && typeof item.value === "string");
-    if (stringItems(previous.items) && stringItems(next.items))
-      retainYamlSequenceAnnotations(
-        previous,
-        next,
-        (item) => (isScalar(item) ? item.value : undefined),
-        (source, target) =>
-          retainYamlConfigurationSource(source, target, retainedSources),
-        (source) => !retainedSources.has(source),
-      );
-    else
-      next.items = next.items.map((item, index) =>
-        isNode(item)
-          ? retainYamlConfigurationSource(
-              previous.items[index],
-              item,
-              retainedSources,
-            )
-          : item,
-      );
+    retainYamlSequenceSource(previous, next, retainedSources, document);
  }
  return next;
 };

+const retainYamlSequenceSource = (
+  previous: YAMLSeq,
+  next: YAMLSeq,
+  retainedSources: ReadonlySet<Node>,
+  document: Document,
+): void => {
+  const stringItems = (items: readonly unknown[]) =>
+    items.every((item) => isScalar(item) && typeof item.value === "string");
+  if (stringItems(previous.items) && stringItems(next.items)) {
+    retainYamlSequenceAnnotations(
+      previous,
+      next,
+      (item) => (isScalar(item) ? item.value : undefined),
+      (source, target) =>
+        retainYamlConfigurationSource(
+          source,
+          target,
+          retainedSources,
+          document,
+        ),
+      (source) => !retainedSources.has(source),
+    );
+    return;
+  }
+  next.items = next.items.map((item, index) =>
+    isNode(item)
+      ? retainYamlConfigurationSource(
+          previous.items[index],
+          item,
+          retainedSources,
+          document,
+        )
+      : item,
+  );
+};
+
+const retainYamlMapSource = (
+  previous: YAMLMap,
+  next: YAMLMap,
+  retainedSources: ReadonlySet<Node>,
+  document: Document,
+): void => {
+  const hasMerges = retainYamlMergeSources(previous, next, document);
+  const hasSourceOnlyKeys = retainProjectedYamlKeys(
+    previous,
+    next,
+    retainedSources,
+    document,
+  );
+  const entries = new Map(
+    previous.items.flatMap((pair) =>
+      isScalar(pair.key) && typeof pair.key.value === "string"
+        ? [[pair.key.value, pair] as const]
+        : [],
+    ),
+  );
+  for (const pair of next.items) {
+    if (previous.items.includes(pair)) continue;
+    const key = isScalar(pair.key) ? pair.key.value : undefined;
+    const prior = typeof key === "string" ? entries.get(key) : undefined;
+    if (prior === undefined) continue;
+    pair.key = isNode(pair.key)
+      ? retainYamlConfigurationSource(
+          prior.key,
+          pair.key,
+          retainedSources,
+          document,
+        )
+      : prior.key;
+    if (isNode(pair.value))
+      pair.value = retainYamlConfigurationSource(
+        prior.value,
+        pair.value,
+        retainedSources,
+        document,
+      );
+  }
+  if (hasSourceOnlyKeys || hasMerges) {
+    // Object property ordering moves integer-like keys ahead of their
+    // source neighbors. Restore source order so aliases stay after anchors.
+    const positions = new Map(
+      previous.items.map((pair, index) => [pair, index] as const),
+    );
+    const position = (pair: (typeof next.items)[number]): number => {
+      const key = isScalar(pair.key) ? pair.key.value : undefined;
+      const original =
+        positions.has(pair) || typeof key !== "string"
+          ? pair
+          : entries.get(key);
+      return original === undefined
+        ? Infinity
+        : (positions.get(original) ?? Infinity);
+    };
+    next.items.sort((left, right) => position(left) - position(right));
+  }
+};
+
+const isYamlMergeKey = (key: unknown): boolean =>
+  isScalar(key) && typeof key.value === "symbol" && key.source === "<<";
+
+/** Retain inheritance while materializing only explicit changes to it. */
+const retainYamlMergeSources = (
+  previous: YAMLMap,
+  next: YAMLMap,
+  document: Document,
+): boolean => {
+  const merges = previous.items.filter((pair) => isYamlMergeKey(pair.key));
+  if (merges.length === 0) return false;
+  const inherited = new YAMLMap(document.schema);
+  inherited.items = merges;
+  const direct = new YAMLMap(document.schema);
+  direct.items = previous.items.filter((pair) => !isYamlMergeKey(pair.key));
+  const project = (map: YAMLMap): Record<string, unknown> =>
+    map.toJS(document, { reviver: normalizeYamlInteger }) as Record<
+      string,
+      unknown
+    >;
+  const inheritedValues = project(inherited);
+  const directValues = project(direct);
+  const desired = project(next);
+  const inheritedUnchanged = new Set<string>();
+  for (const [key, value] of Object.entries(inheritedValues)) {
+    if (Object.hasOwn(directValues, key)) continue;
+    if (!Object.hasOwn(desired, key))
+      throw new ConfigurationError(
+        `Cannot remove inherited YAML setting ${JSON.stringify(key)} while retaining its merge.`,
+      );
+    if (isDeepStrictEqual(value, desired[key])) inheritedUnchanged.add(key);
+  }
+  next.items = [
+    ...merges,
+    ...next.items.filter((pair) => {
+      const key = isScalar(pair.key) ? pair.key.value : undefined;
+      return typeof key !== "string" || !inheritedUnchanged.has(key);
+    }),
+  ];
+  return true;
+};
+
+const retainProjectedYamlKeys = (
+  previous: YAMLMap,
+  next: YAMLMap,
+  retainedSources: ReadonlySet<Node>,
+  document: Document,
+): boolean => {
+  // A JS property can represent several distinct native YAML keys. Keep
+  // those source pairs together when the property was not edited.
+  const groups = new Map<string, typeof previous.items>();
+  const sourceOnlyKeys = new Set<string>();
+  for (const pair of previous.items) {
+    if (isYamlMergeKey(pair.key)) continue;
+    let key: string;
+    if (isScalar(pair.key) && typeof pair.key.value === "string")
+      key = pair.key.value;
+    else {
+      const singleton = new YAMLMap(document.schema);
+      singleton.items.push(new Pair(pair.key, null));
+      const projected: unknown = singleton.toJS(document);
+      if (typeof projected !== "object" || projected === null)
+        throw new ConfigurationError(
+          "YAML mapping key could not be resolved safely",
+        );
+      const [projectedKey] = Object.keys(projected);
+      if (projectedKey === undefined || Object.keys(projected).length !== 1)
+        throw new ConfigurationError(
+          "YAML mapping key could not be resolved safely",
+        );
+      key = projectedKey;
+      sourceOnlyKeys.add(key);
+    }
+    const group = groups.get(key) ?? [];
+    group.push(pair);
+    groups.set(key, group);
+  }
+  if (sourceOnlyKeys.size > 0) {
+    const oldValue: unknown = previous.toJS(document, {
+      reviver: normalizeYamlInteger,
+    });
+    const newValue: unknown = next.toJS(document, {
+      reviver: normalizeYamlInteger,
+    });
+    if (
+      typeof oldValue !== "object" ||
+      oldValue === null ||
+      typeof newValue !== "object" ||
+      newValue === null
+    )
+      throw new ConfigurationError("YAML mapping could not be compared safely");
+    const oldProperties = oldValue as Record<string, unknown>;
+    const newProperties = newValue as Record<string, unknown>;
+    const replacements = new Map<string, typeof previous.items>();
+    for (const key of sourceOnlyKeys) {
+      const group = groups.get(key);
+      if (group === undefined) continue;
+      if (
+        !Object.hasOwn(newProperties, key) ||
+        !isDeepStrictEqual(oldProperties[key], newProperties[key])
+      )
+        throw new ConfigurationError(
+          `Cannot safely change YAML mapping key ${JSON.stringify(key)} because its source identity is not a plain string key.`,
+        );
+      if (
+        containsRetainedSource(
+          group.flatMap((pair) => [pair.key, pair.value]),
+          retainedSources,
+        )
+      )
+        throw new ConfigurationError(
+          `Cannot safely preserve YAML mapping key ${JSON.stringify(key)} while its anchor is moved.`,
+        );
+      replacements.set(key, group);
+    }
+    next.items = next.items.flatMap((pair) => {
+      const key = isScalar(pair.key) ? pair.key.value : undefined;
+      const replacement =
+        typeof key === "string" ? replacements.get(key) : undefined;
+      return replacement ?? [pair];
+    });
+  }
+  return sourceOnlyKeys.size > 0;
+};
+
 /** Keep a source spelling only while the selected schema resolves its value unchanged. */
 const sameResolvedScalarValue = (left: unknown, right: unknown): boolean =>
  Object.is(left, right) ||
@@ -21,7 +21,7 @@ import {
  parseEvidence,
  rebindEvidenceToTargetPath,
 } from "../../domain/evidence.js";
-import { inspectAnalysisViewInputSchema } from "../../domain/analysisView/analysisView.js";
+import { inspectAnalysisViewInputSchema } from "../../domain/analysisView/analysisViewRequest.js";
 import { functionDossierSchema } from "../../domain/native/functionDossier.js";
 import { ghidraFunctionDossier } from "../../domain/ghidraValues.fixture.js";
 import {
@@ -28,11 +28,11 @@ import {
 } from "../../domain/evidence.js";
 import {
  inspectAnalysisViewInputSchema,
-  prepareAnalysisViewProjection,
-  type AnalysisViewResult,
  type AnalysisViewRequest,
  type InspectAnalysisViewInput,
-} from "../../domain/analysisView/analysisView.js";
+} from "../../domain/analysisView/analysisViewRequest.js";
+import { prepareAnalysisViewProjection } from "../../domain/analysisView/analysisView.js";
+import type { AnalysisViewResult } from "../../domain/analysisView/analysisViewResult.js";
 import {
  immutableJsonSnapshotMember,
  isImmutableJsonSnapshot,
@@ -15,7 +15,7 @@ import { inspectAnalysisView } from "./AnalysisViewService.js";
 import { projectAnalysisError } from "../../domain/analysisErrorProjection.js";
 import { sanitizeBrowserUrl } from "../../domain/browserObservation.js";
 import type { BrowserScenarioCapture } from "../../domain/browserScenarioCapture.js";
-import type { AnalysisViewRequest } from "../../domain/analysisView/analysisView.js";
+import type { AnalysisViewRequest } from "../../domain/analysisView/analysisViewRequest.js";
 import { projectBrowserScenarioView } from "../../domain/analysisView/browserScenarioView.js";

 const tree = (text: string) => ({
@@ -6,7 +6,7 @@ import {
  analysisViewJavaScriptEvidence,
 } from "../../../tests/fixtures/analysisView.js";
 import { SOURCE_TO_BUNDLE_COMPARISON_EXAMPLE } from "../../contracts/javascript/javascriptApplicationWorkflowExamples.js";
-import { analysisViewResultSchema } from "../../domain/analysisView/analysisView.js";
+import { analysisViewResultSchema } from "../../domain/analysisView/analysisViewResult.js";
 import type { Evidence } from "../../domain/evidence.js";
 import { jsonValueValidationIssue } from "../../domain/jsonValue.js";
 import { compareSourceToBundle } from "../../domain/javascript/sourceToBundleComparison.js";
@@ -1,9 +1,7 @@
 import { expect, it } from "vitest";
 import { createEvidence } from "../../domain/evidence.js";
-import {
-  analysisViewResultSchema,
-  inspectAnalysisViewInputSchema,
-} from "../../domain/analysisView/analysisView.js";
+import { inspectAnalysisViewInputSchema } from "../../domain/analysisView/analysisViewRequest.js";
+import { analysisViewResultSchema } from "../../domain/analysisView/analysisViewResult.js";
 import {
  RELOCATION_SYMBOL_UNRECORDED,
  projectNativeLoadImageView,
@@ -13,11 +13,11 @@ import {
  nativeCallGraphSchema,
  type NativeCallGraph,
 } from "../../domain/native/nativeCallGraph.js";
+import type { AnalysisViewRequest } from "../../domain/analysisView/analysisViewRequest.js";
 import {
  analysisViewResultSchema,
-  type AnalysisViewRequest,
  type AnalysisViewResult,
-} from "../../domain/analysisView/analysisView.js";
+} from "../../domain/analysisView/analysisViewResult.js";
 import {
  inspectAnalysisView,
  projectRetainedAnalysis,
@@ -2,10 +2,8 @@ import { expect, it } from "vitest";

 import { inspectAnalysisView } from "../analysisView/AnalysisViewService.js";
 import { ARTIFACT_COMPARISON_EXAMPLE } from "../../contracts/artifactComparisonExample.js";
-import {
-  artifactInventorySummaryViewResultSchema,
-  sealAnalysisView,
-} from "../../domain/analysisView/analysisView.js";
+import { sealAnalysisView } from "../../domain/analysisView/analysisView.js";
+import { artifactInventorySummaryViewResultSchema } from "../../domain/analysisView/analysisViewResult.js";
 import {
  createEvidence,
  parseEvidence,
@@ -9,7 +9,7 @@ import { inspectAnalysisViewValidated } from "../analysisView/AnalysisViewServic
 import type { EvidenceFileReadOptions } from "../analysisView/evidenceFileSource.js";
 import { artifactComparisonInputSchema } from "../../contracts/artifactComparisonContracts.js";
 import { parseAnalysisInput } from "../AnalysisInput.js";
-import { artifactInventorySummaryViewResultSchema } from "../../domain/analysisView/analysisView.js";
+import { artifactInventorySummaryViewResultSchema } from "../../domain/analysisView/analysisViewResult.js";
 import {
  compareArtifacts,
  type ArtifactComparisonResult,
@@ -7,7 +7,10 @@ import {
 } from "../EvidenceBundleFiles.js";
 import type { ResetInvestigationReceipt } from "../../domain/investigationLifecycle.js";

-import { retainSavedAnalysisSnapshot } from "../../domain/savedAnalysisSnapshot.js";
+import {
+  retainSavedAnalysisSnapshot,
+  type SavedAnalysisSnapshot,
+} from "../../domain/savedAnalysisSnapshot.js";

 import type { BinaryTarget } from "../../domain/binaryTargetTypes.js";
 import {
@@ -39,7 +42,6 @@ import type {
  BinarySessionPort,
  BinaryOpenResult,
  OpenSelectionReceipt,
-  SavedAnalysisSnapshot,
 } from "./BinarySessionPort.js";
 import { binaryTargetSummary } from "./BinaryTargetSummary.js";
 import {
@@ -30,7 +30,6 @@ import type {
 } from "../AnalysisProvider.js";

 import type { SavedAnalysisSnapshot } from "../../domain/savedAnalysisSnapshot.js";
-export type { SavedAnalysisSnapshot } from "../../domain/savedAnalysisSnapshot.js";

 /** Selection observed at the end of one serialized open attempt. */
 export type OpenSelectionReceipt =
@@ -28,7 +28,11 @@ import { ProviderAdapterError } from "../../domain/providerAdapterError.js";
 import { err, ok, type Result } from "../../domain/result.js";
 import { AGENTENV_PROVIDER } from "../../desktop/AgentEnvComputerHelper.js";
 import type { AgentEnvComputer } from "../../desktop/AgentEnvComputer.js";
-import type { ControlledComputer } from "../../desktop/BuildComputerController.js";
+import {
+  controller,
+  type Answer,
+  type ControlledComputer,
+} from "../../desktop/BuildComputerController.js";
 import { BuildComputerLongRuns } from "../../desktop/BuildComputerLongRuns.js";
 import {
  endedCapture,
@@ -37,12 +41,10 @@ import {
 } from "./DesktopBuildCaptureFailure.js";
 import {
  adapterError,
-  controller,
  errorText,
  refused,
  runRea,
  WORK,
-  type Answer,
 } from "./DesktopBuildCommands.js";
 import {
  exportBuild,
@@ -7,12 +7,14 @@ import {
 } from "../../domain/desktop/desktopCapture.js";
 import { ProviderAdapterError } from "../../domain/providerAdapterError.js";
 import { AGENTENV_PROVIDER } from "../../desktop/AgentEnvComputerHelper.js";
-import type { ControlledComputer } from "../../desktop/BuildComputerController.js";
+import type {
+  Answer,
+  ControlledComputer,
+} from "../../desktop/BuildComputerController.js";
 import {
  adapterError,
  readOutput,
  reportedFailure,
-  type Answer,
 } from "./DesktopBuildCommands.js";

 /** The most lines, and characters, a message quotes from the end of the app's stderr. */
@@ -22,11 +22,6 @@ import {
  type ControlledComputer,
 } from "../../desktop/BuildComputerController.js";

-export {
-  controller,
-  type Answer,
-} from "../../desktop/BuildComputerController.js";
-
 /** The work folder REA keeps under the computer user's home; every capture leaves it out. */
 export const WORK = ".rea-build";
 /** The checkpoint options the draft and the export read the seed and the end with. */
@@ -8,7 +8,7 @@ import {
 import {
  analysisViewResultSchema,
  type AnalysisViewResult,
-} from "../../domain/analysisView/analysisView.js";
+} from "../../domain/analysisView/analysisViewResult.js";
 import { scenarioCaptureRecords } from "../../domain/analysisView/scenarioCaptureRecords.js";
 import {
  readRecordedResponseBody,
@@ -1,4 +1,4 @@
-import type { AnalysisViewResult } from "../../domain/analysisView/analysisView.js";
+import type { AnalysisViewResult } from "../../domain/analysisView/analysisViewResult.js";
 import {
  changesState,
  type StateDocument,
@@ -1,7 +1,5 @@
-import {
-  projectAnalysisView,
-  analysisViewResultSchema,
-} from "../../domain/analysisView/analysisView.js";
+import { projectAnalysisView } from "../../domain/analysisView/analysisView.js";
+import { analysisViewResultSchema } from "../../domain/analysisView/analysisViewResult.js";
 import { nativeFunctionMatchingSchema } from "../../domain/native/functionMatching.js";
 import { expect, it } from "vitest";
 import { matchNativeFunctions } from "./NativeFunctionMatchingService.js";
@@ -11,11 +11,6 @@ export interface ReverseEngineeringProviderCommand {
  readonly identity: EvidenceProvider;
  /** What the provider cannot attest about the arguments it built. */
  readonly limitations?: readonly string[];
-  /**
-   * Explain a provider refusal of the command that a completed process
-   * reported only in its diagnostics, or return undefined.
-   */
-  readonly rejection?: (stderr: string) => string | undefined;
  readonly environmentOverrides?: Readonly<NodeJS.ProcessEnv>;
 }

@@ -599,7 +599,7 @@ export class ReverseEngineeringService {
    let stderrInvalidUtf8 = false;
    let cleanupIncomplete = false;
    let cleanupOnlyFailure = false;
-    let completionStatus: "complete" | "rejected" | "unknown" = "complete";
+    let completionStatus: "complete" | "unknown" = "complete";
    let outputLimitReached = false;
    let failure: AnalysisError | undefined;
    let cleanupOwner: ProviderProcessSupervisor | undefined;
@@ -1076,15 +1076,6 @@ export class ReverseEngineeringService {
          : digestAfter !== digest;
    const outputBudgetSource =
      parameters.max_output_bytes === undefined ? "default" : "request";
-    // Only a completed process's diagnostics can establish a refusal; partial
-    // or failed captures keep their unknown completion.
-    const rejection =
-      completionStatus === "complete" &&
-      (failure === undefined ||
-        (failure instanceof AnalysisOutputError && failure.cleanupOnly))
-        ? profile.rejection?.(stderr)
-        : undefined;
-    if (rejection !== undefined) completionStatus = "rejected";
    const result = {
      stdout,
      stderr,
@@ -1125,7 +1116,6 @@ export class ReverseEngineeringService {
          ]
        : []),
      ...(profile.limitations ?? []),
-      ...(rejection === undefined ? [] : [rejection]),
      ...(stdoutInvalidUtf8 || stderrInvalidUtf8
        ? [
            `Captured ${[
@@ -3,14 +3,43 @@ import type { AnalysisError } from "../domain/analysisErrorBase.js";
 import { analysisErrorWithCleanupFailure } from "../domain/analysisErrorCleanup.js";
 import { ProviderCleanupError } from "../domain/providerCleanupError.js";
 import { ArtifactReaderFailure } from "./ArtifactReader.js";
-import { bindArtifactFileCleanup } from "./ArtifactFileOperation.js";
+import {
+  artifactFileCancellationCause,
+  bindArtifactFileCleanup,
+  type ArtifactFilePrimaryFacts,
+} from "./ArtifactFileOperation.js";
 import { completedStableArtifactObservation } from "./StableArtifactObservation.js";
 import { isSelectedRegularFileError } from "../filesystem/RegularFile.js";
 import {
  AnalysisAccessDeniedError,
+  AnalysisArtifactChangedError,
+  AnalysisCancelledError,
  AnalysisInputError,
 } from "../domain/analysisErrorCore.js";

+/** Preserve ownership classification for stable-file identity and cancellation. */
+export const projectOwnedArtifactIdentityFailure = (
+  facts: ArtifactFilePrimaryFacts,
+  operation: string,
+  path: string,
+): AnalysisError | undefined => {
+  const { cause, origin } = facts;
+  if (
+    origin !== "owned-or-classified" ||
+    !(cause instanceof ArtifactReaderFailure)
+  )
+    return undefined;
+  if (cause.reason === "integrity")
+    return new AnalysisArtifactChangedError(operation, path, cause.message, {
+      cause,
+    });
+  if (cause.reason === "cancelled")
+    return new AnalysisCancelledError(operation, {
+      cause: artifactFileCancellationCause(cause),
+    });
+  return undefined;
+};
+
 /** Project filesystem errors that identify a refused or unreadable selected file. */
 export const projectSelectedArtifactFileFailure = (
  cause: unknown,
@@ -57,6 +86,18 @@ export const stableArtifactInputRecovery = (cause: ArtifactReaderFailure) =>
      }
    : {};

+/** Report a rejected artifact path or format with its source-provided recovery. */
+export const stableArtifactInputFailure = (
+  cause: ArtifactReaderFailure,
+  operation: string,
+  field = "path",
+): AnalysisInputError =>
+  new AnalysisInputError(
+    operation,
+    { cause, ...stableArtifactInputRecovery(cause) },
+    [{ path: [field], reason: "invalid_format", message: cause.message }],
+  );
+
 const artifactCleanupFailure = (
  cause: unknown,
  providerId: string,
@@ -5,8 +5,6 @@ import {
  type ArtifactReaderConstruction,
 } from "./artifactFormats.js";

-export type { ArtifactReaderConstruction } from "./artifactFormats.js";
-
 /** Formats with an artifact entry reader; availability policy belongs to the caller. */
 export type ArtifactReaderFormat = {
  [Id in keyof typeof ARTIFACT_FORMATS]: (typeof ARTIFACT_FORMATS)[Id] extends {
@@ -11,7 +11,7 @@ import { PLAYWRIGHT_TRACE_OPERATION as operation } from "../../../domain/playwri
 import { ArtifactReaderFailure } from "../../../artifacts/ArtifactReader.js";
 import { artifactFileCancellationCause } from "../../../artifacts/ArtifactFileOperation.js";
 import { isSelectedRegularFileError } from "../../../filesystem/RegularFile.js";
-import { stableArtifactInputRecovery } from "../../../artifacts/StableArtifactFailure.js";
+import { stableArtifactInputFailure } from "../../../artifacts/StableArtifactFailure.js";

 /** Classify the archive owner's facts without interpreting opaque cancellation reasons. */
 export const traceFailure = (cause: unknown, path: string): AnalysisError => {
@@ -38,11 +38,7 @@ export const traceFailure = (cause: unknown, path: string): AnalysisError => {
        },
      );
    if (cause.reason === "format" || cause.reason === "path")
-      return new AnalysisInputError(
-        operation,
-        { cause, ...stableArtifactInputRecovery(cause) },
-        [{ path: ["path"], reason: "invalid_format", message: cause.message }],
-      );
+      return stableArtifactInputFailure(cause, operation);
    return new ArtifactOperationError(
      operation,
      cause.reason,
@@ -3,7 +3,7 @@ import {
  analysisEvidenceSources,
  undeliveredSourceClosure,
 } from "../application/AnalysisEvidenceSources.js";
-import type { AnalysisViewRequest } from "../domain/analysisView/analysisView.js";
+import type { AnalysisViewRequest } from "../domain/analysisView/analysisViewRequest.js";
 import { z } from "incur";
 import {
  isImmutableEvidence,
@@ -22,7 +22,7 @@ import { parseAnalysisInput } from "../application/AnalysisInput.js";
 import { androidJniSelectionSchema } from "../domain/android/androidJniBindings.js";
 import { androidJniDeliverySchema } from "../domain/android/androidJniQuery.js";
 import { androidInputSchemas } from "../domain/android/androidAnalysis.js";
-import { cliDecimalField } from "./options.js";
+import { cliIntegerArgument } from "./options.js";

 /** Expose the same explicit APK requests through one-shot CLI commands. */
 export const registerAndroidCommands = (
@@ -223,11 +223,11 @@ export const registerAndroidCommands = (
        ),
    }),
    options: z.object({
-      overloadIndex: cliDecimalField(
-        androidInputSchemas.inspect_android_method.shape.overload_index.describe(
+      overloadIndex: cliIntegerArgument(0)
+        .optional()
+        .describe(
          "Explicit zero-based index among same-name methods; required when ambiguous",
        ),
-      ),
      mappingPath,
      ...analysisEvidenceDeliveryOptions,
    }),
@@ -255,11 +255,11 @@ export const registerAndroidCommands = (
    options: z.object({
      methodName:
        androidInputSchemas.trace_android_references.shape.method_name,
-      overloadIndex: cliDecimalField(
-        androidInputSchemas.trace_android_references.shape.overload_index.describe(
+      overloadIndex: cliIntegerArgument(0)
+        .optional()
+        .describe(
          "Index among defined methods or observed external prototypes listed by an ambiguous query",
        ),
-      ),
    }),
    run: ({ args, options }) =>
      execute(
@@ -8,8 +8,7 @@ import { logCliCommand } from "../cliLogging.js";
 import { finishAnalysisCommand } from "./finishAnalysisCommand.js";
 import { withCommandCancellation } from "./commandCancellation.js";
 import type { CliInstance } from "./types.js";
-import { cliDecimalField } from "./options.js";
-import { cutterCommandInputSchema } from "../contracts/cutterToolContracts.js";
+import { cliIntegerArgument } from "./options.js";

 /** Register commands that control an already-running Cutter instance. */
 export const registerCutterCommands = (
@@ -44,10 +43,8 @@ export const registerCutterCommands = (
        .string()
        .uuid()
        .describe("Session ID copied from list-cutter-sessions."),
-      expectedGeneration: cliDecimalField(
-        cutterCommandInputSchema.shape.expected_generation.describe(
-          "Session generation returned by list-cutter-sessions.",
-        ),
+      expectedGeneration: cliIntegerArgument(0).describe(
+        "Session generation returned by list-cutter-sessions.",
      ),
      command: z
        .string()
@@ -38,7 +38,7 @@ import { inspectWebNetworkCaptureInputSchema } from "../domain/webNetworkCapture
 import { withCommandCancellation } from "./commandCancellation.js";
 import { finishAnalysisCommand } from "./finishAnalysisCommand.js";
 import type { CliInstance } from "./types.js";
-import { cliDecimalField, publishArgvInput } from "./options.js";
+import { cliDecimalField } from "./options.js";

 /** Same envelope label as the other JSON-input commands and `parseCliJsonInput`. */
 const cliError = (error: AnalysisError): JsonValue => ({
@@ -689,13 +689,11 @@ export const registerEnvironmentCommands = (
      host: mcpHttpHostSchema
        .optional()
        .describe("Listener address; default MCP_HOST, else 127.0.0.1"),
-      port: publishArgvInput(
-        mcpHttpPortSchema
-          .optional()
-          .describe(
-            "Listener port; default MCP_PORT, else 0 for an ephemeral port",
-          ),
-      ),
+      port: mcpHttpPortSchema
+        .optional()
+        .describe(
+          "Listener port; default MCP_PORT, else 0 for an ephemeral port",
+        ),
    }),
    run: ({ args, options }) =>
      withCommandCancellation((signal) =>
@@ -1,4 +1,4 @@
-import type { AnalysisViewRequest } from "../domain/analysisView/analysisView.js";
+import type { AnalysisViewRequest } from "../domain/analysisView/analysisViewRequest.js";
 import { publishCliAnalysisEvidence } from "./analysisEvidenceDelivery.js";
 import { JAVASCRIPT_APPLICATION_PROVIDER } from "../domain/investigationProviders.js";
 import { createProgressReporter } from "../application/ProgressReporter.js";
@@ -24,6 +24,13 @@ type DecimalWrapper =
      readonly kind: "optional" | "exactOptional" | "nullable" | "readonly";
    };

+/** Parse decimal integer tokens before Number coercion can erase their syntax. */
+export const cliIntegerArgument = (min: number) =>
+  z
+    .string()
+    .regex(DECIMAL_INTEGER_TOKEN, "Expected a decimal integer")
+    .pipe(z.coerce.number<string>().safe().min(min));
+
 const decimalToken = (domain: z.ZodNumber) =>
  z
    .string()
@@ -35,12 +42,10 @@ const unwrapSchema = (field: { unwrap: () => unknown }): z.ZodType =>
  field.unwrap() as z.ZodType;

 /**
- * Incur advertises Zod's output view. Publish the input view so an argv token
- * grammar that transforms text survives `--schema` and other SDK conversions.
+ * Incur advertises Zod's output view. Publish the input view so the decimal
+ * token guard survives `--schema` and other SDK conversions.
 */
-export const publishArgvInput = <Field extends z.ZodType>(
-  field: Field,
-): Field => {
+const publishDecimalInput = (field: z.ZodType): z.ZodType => {
  const { $schema: _dialect, ...inputSchema } = z.toJSONSchema(field, {
    io: "input",
  });
@@ -144,7 +149,7 @@ export const cliDecimalField = <Field extends z.ZodType>(
    numeric.description === undefined
      ? admitted
      : admitted.describe(numeric.description);
-  return publishArgvInput(described) as z.ZodType<z.output<Field>>;
+  return publishDecimalInput(described) as z.ZodType<z.output<Field>>;
 };

 /** Adapt each numeric property of a shared shape; other properties stay unchanged. */
@@ -80,7 +80,7 @@ const cleanupOnlyCompleteEvidence = (
  return typeof normalized === "object" &&
    normalized !== null &&
    !Array.isArray(normalized) &&
-    normalized.completion_status !== "unknown"
+    normalized.completion_status === "complete"
    ? parsed.data
    : undefined;
 };
@@ -1,6 +1,6 @@
 import { projectCliAnalysisResult } from "./projectCliAnalysisResult.js";
 import { z } from "incur";
-import { cliDecimalField } from "./options.js";
+import { cliDecimalField, cliIntegerArgument } from "./options.js";

 import type { DirectAnalysis } from "../composition/directAnalysis.js";
 import { createHistoricalSourceSummary } from "../domain/referenceSourceSummary.js";
@@ -21,10 +21,7 @@ import {
 } from "../domain/analysisErrorCore.js";
 import { projectInputIssues } from "../domain/inputIssueProjection.js";
 import { safeParseJson } from "../domain/safeJson.js";
-import {
-  nativeUiObservationInputSchema,
-  nativeUiScenarioInputSchema,
-} from "../domain/native/nativeUiObservation.js";
+import { nativeUiScenarioInputSchema } from "../domain/native/nativeUiObservation.js";
 import {
  nativeCommandTimeoutField,
  nativeUiDeadlineField,
@@ -52,16 +49,11 @@ export const registerUtilityCommands = (
  registerReferenceSourceCommand(cli, logger, environment);
 };

-// Decimal tokens only; shared fields own their bounds and defaults.
-const nativeUiScopeFields = nativeUiObservationInputSchema.shape;
+// Decimal tokens only; shared fields own their bounds and help.
 const nativeUiScopeOptions = {
-  pid: cliDecimalField(
-    nativeUiScopeFields.pid.describe("Existing application PID"),
-  ),
-  windowId: cliDecimalField(
-    nativeUiScopeFields.window_id.describe(
-      "Exact selected application window ID",
-    ),
+  pid: cliIntegerArgument(1).describe("Existing application PID"),
+  windowId: cliIntegerArgument(1).describe(
+    "Exact selected application window ID",
  ),
  screenshot: z
    .boolean()
@@ -71,11 +63,9 @@ const nativeUiScopeOptions = {
    .boolean()
    .default(true)
    .describe("Read the selected window accessibility tree"),
-  maxNodes: cliDecimalField(
-    nativeUiScopeFields.max_nodes.describe(
-      "Maximum accessibility nodes per capture",
-    ),
-  ),
+  maxNodes: cliIntegerArgument(1)
+    .default(500)
+    .describe("Maximum accessibility nodes per capture"),
  nativeUiDeadlineMs: cliDecimalField(nativeUiDeadlineField),
 };

@@ -374,15 +364,11 @@ const registerReferenceSourceCommand = (
          .describe(
            "Complete committed graph or compact historical-source summary",
          ),
-        outlineDepth: cliDecimalField(
-          z
-            .int()
-            .min(0)
-            .optional()
-            .describe(
-              "Summary outline path depth (default: 2; 0 omits entries); requires --detail summary",
-            ),
-        ),
+        outlineDepth: cliIntegerArgument(0)
+          .optional()
+          .describe(
+            "Summary outline path depth (default: 2; 0 omits entries); requires --detail summary",
+          ),
      })
      .superRefine((options, context) => {
        if (options.outlineDepth !== undefined && options.detail !== "summary")
@@ -6,7 +6,7 @@ import { logCliCommand } from "../cliLogging.js";
 import { webModuleTraceInputSchema } from "../domain/webModuleTrace.js";
 import type { Logger } from "pino";
 import type { CliInstance } from "./types.js";
-import { cliDecimalField } from "./options.js";
+import { cliIntegerArgument } from "./options.js";
 import { withCommandCancellation } from "./commandCancellation.js";
 import { finishAnalysisCommand } from "./finishAnalysisCommand.js";

@@ -25,10 +25,8 @@ export const registerWebModuleCommands = (
      "Trace one captured script's native imports to URLs and captured source candidates",
    args: z.object({
      manifestPath: webModuleTraceInputSchema.shape.manifest_path,
-      scriptIndex: cliDecimalField(
-        webModuleTraceInputSchema.shape.script_index.describe(
-          "Zero-based manifest script index",
-        ),
+      scriptIndex: cliIntegerArgument(0).describe(
+        "Zero-based manifest script index",
      ),
    }),
    options: z.object({
@@ -8,7 +8,7 @@ import { CLI_COMMANDS } from "../cliCommandNames.js";
 import { logCliCommand } from "../cliLogging.js";
 import type { Logger } from "pino";
 import type { CliInstance } from "./types.js";
-import { cliDecimalField } from "./options.js";
+import { cliDecimalField, cliIntegerArgument } from "./options.js";
 import { withCommandCancellation } from "./commandCancellation.js";
 import {
  analysisEvidenceDeliveryOptions,
@@ -18,9 +18,6 @@ import { localPathStringSchema } from "../domain/localPath.js";
 import { absoluteCallerPath } from "../filesystem/callerPath.js";
 import { explicitSensitiveValueOptions } from "./explicitSensitiveArguments.js";

-const recordOrdinal =
-  inspectWebNetworkCaptureInputSchema.shape.record_ordinals.unwrap().element;
-
 /** Expose offline historical capture inspection with the same selection contract as MCP. */
 export const registerWebNetworkCaptureCommands = (
  cli: CliInstance,
@@ -54,7 +51,7 @@ export const registerWebNetworkCaptureCommands = (
        .optional()
        .describe("Fully qualified message type in the descriptor set"),
      record: z
-        .array(cliDecimalField(recordOrdinal))
+        .array(cliIntegerArgument(0))
        .optional()
        .describe("Zero-based producer ordinals; repeat to select several"),
      ...explicitSensitiveValueOptions,
@@ -16,11 +16,10 @@ import { CLI_COMMANDS } from "../cliCommandNames.js";
 import { logCliCommand } from "../cliLogging.js";
 import type { Logger } from "pino";
 import type { CliInstance } from "./types.js";
-import { cliDecimalField } from "./options.js";
+import { cliDecimalField, cliIntegerArgument } from "./options.js";
 import { withCommandCancellation } from "./commandCancellation.js";

 const sourceMapSelection = webSourceLocationInputSchema.shape.source_map;
-const generatedPosition = webSourceLocationInputSchema.shape.generated_position;

 /** Expose the same explicit selected map/point contract through the CLI. */
 export const registerWebSourceLocationCommands = (
@@ -34,20 +33,14 @@ export const registerWebSourceLocationCommands = (
      "Trace one retained script position through an explicitly selected local source map",
    args: z.object({
      manifestPath: webSourceLocationInputSchema.shape.manifest_path,
-      scriptIndex: cliDecimalField(
-        webSourceLocationInputSchema.shape.script_index.describe(
-          "Zero-based manifest script index",
-        ),
+      scriptIndex: cliIntegerArgument(0).describe(
+        "Zero-based manifest script index",
      ),
      sourceMapPath: sourceMapSelection.shape.path,
      sourceMapUrl: sourceMapSelection.shape.url,
-      line: cliDecimalField(
-        generatedPosition.shape.line.describe("One-based generated line"),
-      ),
-      column: cliDecimalField(
-        generatedPosition.shape.column.describe(
-          "Zero-based UTF-16 generated column",
-        ),
+      line: cliIntegerArgument(1).describe("One-based generated line"),
+      column: cliIntegerArgument(0).describe(
+        "Zero-based UTF-16 generated column",
      ),
    }),
    options: z.object({
@@ -7,7 +7,6 @@ import { RecordedCrashService } from "../application/binaryDiagnostics/RecordedC
 import { PwntoolsRecordedCrashProvider } from "../native/pwntools/PwntoolsRecordedCrashProvider.js";
 import { BinaryLayoutService } from "../application/binaryDiagnostics/BinaryLayoutService.js";
 import { PwntoolsLayoutProvider } from "../native/pwntools/PwntoolsLayoutProvider.js";
-import { pwntoolsHostSupported } from "../native/pwntools/PwntoolsDecoder.js";
 import { PeResourcesService } from "../application/binaryDiagnostics/PeResourcesService.js";
 import { PeResourcesProvider } from "../native/pe/PeResourcesProvider.js";
 import { PeCertificatesService } from "../application/binaryDiagnostics/PeCertificatesService.js";
@@ -37,8 +36,6 @@ import { DevicetreeProvider } from "../firmware/devicetree/DevicetreeProvider.js
 export const createDevicetreeService = (): DevicetreeService =>
  new DevicetreeService(new DevicetreeProvider());

-export { pwntoolsHostSupported };
-
 /** Portable PE inspection with no engine, installation or target acquisition. */
 export const createPeResourcesService = (): PeResourcesService =>
  new PeResourcesService(new PeResourcesProvider());
@@ -12,18 +12,17 @@ import {
 } from "./capabilityDeclarations.js";
 import { isAbsolute } from "node:path";
 import { createGpuCodeObjectsService } from "./gpu.js";
-import { createPacketCaptureService, tsharkHostSupported } from "./captures.js";
-import {
-  createSignalRecordingService,
-  sigrokHostSupported,
-} from "./signals.js";
+import { createPacketCaptureService } from "./captures.js";
+import { tsharkHostSupported } from "../captures/TsharkCaptureProvider.js";
+import { createSignalRecordingService } from "./signals.js";
+import { sigrokHostSupported } from "../signals/SigrokRecordingProvider.js";
 import { wasmArtifactModule } from "./wasm.js";
 import { apkSignatureModule } from "./apkSignature.js";
+import { evmInterfaceModule } from "./evm.js";
 import {
-  evmInterfaceModule,
  evmHostSupported,
  evmLimiterAvailability,
-} from "./evm.js";
+} from "../evm/EvmoleInterfaceProvider.js";
 import { createSqliteDatabaseService } from "./sqlite.js";
 import { createDesktopApplicationService } from "./desktop.js";
 import { DesktopBuildComputers } from "../application/desktop/DesktopBuildComputers.js";
@@ -40,10 +39,8 @@ import { createWebNetworkCaptureService } from "./webNetworkCaptures.js";
 import { createWebSourceLocationService } from "./webSourceLocations.js";
 import { createWebModuleTraceService } from "./webModules.js";
 import { createWebRuntimeService } from "./webRuntime.js";
-import {
-  createJavaScriptRecoveryProvider,
-  wakaruHostSupported,
-} from "./javascriptRecovery.js";
+import { createJavaScriptRecoveryProvider } from "./javascriptRecovery.js";
+import { wakaruHostSupported } from "../javascript/recovery/WakaruCommand.js";
 import { ArtifactResourceScope } from "../artifacts/ArtifactResourceScope.js";
 import { createReverseEngineeringService } from "./reverseEngineering.js";
 import type {
@@ -51,10 +48,8 @@ import type {
  CommandProviderLaunchFailures,
 } from "../application/reverse/ReverseEngineeringService.js";
 import { FirmwareAnalysisService } from "../application/firmware/FirmwareAnalysisService.js";
-import {
-  createFirmwareAnalysisProvider,
-  firmwareHostSupported,
-} from "./firmware.js";
+import { createFirmwareAnalysisProvider } from "./firmware.js";
+import { firmwareHostSupported } from "../firmware/FirmwareCommand.js";
 import { createAndroidAnalysisProvider } from "./android.js";
 import { createPcapAnalysisProvider } from "./pcap.js";
 import { createFlutterBuildAnalysisProvider } from "./flutter.js";
@@ -79,7 +74,6 @@ import {
  createWindowsShortcutService,
  createRecordedCrashService,
  createBinaryLayoutService,
-  pwntoolsHostSupported,
  createDevicetreeService,
  createElfNotesService,
  createNativeInitializersService,
@@ -88,6 +82,7 @@ import {
  createKernelModuleService,
  createKernelBuildConfigService,
 } from "./binaryDiagnostics.js";
+import { pwntoolsHostSupported } from "../native/pwntools/PwntoolsDecoder.js";

 import type { PacketCaptureService } from "../application/captures/PacketCaptureService.js";
 import type { SignalRecordingService } from "../application/signals/SignalRecordingService.js";
@@ -1,10 +1,5 @@
 import { PacketCaptureService } from "../application/captures/PacketCaptureService.js";
-import {
-  TsharkCaptureProvider,
-  tsharkHostSupported,
-} from "../captures/TsharkCaptureProvider.js";
-
-export { tsharkHostSupported };
+import { TsharkCaptureProvider } from "../captures/TsharkCaptureProvider.js";

 export const createPacketCaptureService = (
  environment: Readonly<NodeJS.ProcessEnv> = process.env,