fix(adb): share host configuration refusals with apktool

The ADB provider, which the apktool provider mirrors, had the same two defects: a relative REA_ADB_PATH escaped as UNKNOWN because selection ran before the try that maps configuration failures, and a missing adb binary projected generic target advice instead of its reason. Move the configuration-failure-to-refusal mapping into one providerConfigurationRefusal helper used by both providers, resolve the ADB selection inside the mapped try, and share the CLI refusal assertion. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
fix(apktool): name host requirements in configuration refusals
2026-10-11 20:05:33 +00:00 · 2026-10-11 19:35:57 +00:00 · 2026-10-12 03:17:49 +08:00 · 2026-10-12 03:16:13 +08:00 · 2026-10-12 02:47:31 +08:00 · 2026-10-12 02:46:32 +08:00
301 changed files with 45022 additions and 34056 deletions
@@ -2,7 +2,7 @@
 name: reverse-engineer-anything
 description: Reverse engineer native, managed, Electron/JavaScript, packaged, firmware, and browser targets with REA. Use shipped-artifact or requested runtime evidence to explain features, compare versions, decompile code, or guide a reconstruction. Skip REA for ordinary source-repository architecture analysis.
 metadata:
-  version: "38"
+  version: "39"
 ---

 # REA
@@ -9,7 +9,10 @@ provenance; inputs and recovered code are never executed. Recovery requires a
 caller-supplied Wakaru on Linux x64; see [the recovery guide](https://github.com/morluto/rea/blob/main/docs/javascript-recovery.md).

 Use `analyze_javascript_application` directly on the operator-supplied ASAR or
-extracted tree. When size is unknown or large and the connected schema advertises
+extracted tree. Exact `#alias` specifiers resolve through the importer's
+enclosing package `imports` map to package-local files; nested `node_modules`
+packages use their own map. Wildcard, recursive, and external-package import
+targets stay unresolved with that limitation. When size is unknown or large and the connected schema advertises
 `detail`, request `detail: "summary"`. This returns an `inspect_analysis_view`
 Evidence record with a distinct ID and a `normalized_result.parent_evidence_id`
 for the complete retained application analysis. Source-map contents are part of
@@ -150,6 +150,13 @@ For headerless DOS COM, explicitly open with `format: "dos-com"` (CLI
 analysis: the entry is `0x10100`, file offset zero, with imposed real-mode segment
 context. PSP/stack/device state remains unmodeled. See [DOS guide](https://github.com/morluto/rea/blob/main/docs/ghidra-dos.md).

+For other headerless images (embedded firmware without ELF/Mach-O/PE/MZ
+headers), open with `format: "raw-binary"`, `architecture` (`x86`, `x86_64`,
+`arm`, or `arm64`), and `entry_point` (`0x` hex). File offset 0 is mapped at
+that address. Hopper and IDA refuse this interpretation; Ghidra uses
+`BinaryLoader` with a little-endian generic language. Big-endian, Thumb-only,
+and Cortex-M variants are unsupported. See [raw binary guide](https://github.com/morluto/rea/blob/main/docs/raw-binary.md).
+
 ### Function annotations in Ghidra

 Use `annotate_native_function` for one function name and/or entry comments, with at least one explicit change. Review its annotation readback and refreshed dossier inline. Changes are atomic and session-scoped; empty comments clear them, omitted fields preserve them. Later MCP calls observe edits until close. CLI `annotate-native-function` returns the updated analysis before discarding the session. Original executable bytes are unchanged; edits invalidate immutable snapshots. Windows P0 does not admit database mutations. For naming only, `set_address_name` / `set_addresses_names` also work with Ghidra: they name function entries or data addresses (primary labels) and return compact per-address success booleans instead of a dossier.
@@ -9,7 +9,6 @@
 **See a feature you like. Understand how it works, down to the binary level.**

 [![npm version](https://img.shields.io/npm/v/rea-agents?style=flat-square&color=cb3837)](https://www.npmjs.com/package/rea-agents)
-[![CI](https://img.shields.io/github/actions/workflow/status/morluto/rea/ci.yml?branch=main&style=flat-square&label=CI)](https://github.com/morluto/rea/actions/workflows/ci.yml)
 [![MCP tool catalog](https://img.shields.io/badge/MCP-tool_catalog-5c4ee5?style=flat-square)](docs/mcp-contracts.md#generated-catalog)
 [![Node.js requirements](https://img.shields.io/badge/Node.js-requirements-339933?style=flat-square&logo=nodedotjs&logoColor=white)](#what-you-can-analyze)
 [![skills.sh](https://skills.sh/b/morluto/rea?style=flat-square)](https://skills.sh/morluto/rea/reverse-engineer-anything)
@@ -245,7 +244,9 @@ Ghidra and IDA use your existing installations. See [provider setup](docs/instal
 <summary><strong>Do I need to start Hopper first?</strong></summary>

 REA starts Hopper when an operation needs it. On macOS, a first-run dialog may
-ask you to choose demo mode or activate your license. See
+ask you to choose demo mode or activate your license. Complete that prompt in the
+same user session before your first CLI/MCP operation or unattended job. Open
+Hopper manually if needed. See
 [Hopper startup and troubleshooting](docs/installation.md#launcher-paths-and-troubleshooting).

 </details>
@@ -9,7 +9,6 @@
 **وجدت ميزة تعجبك؟ افهم طريقة عملها حتى مستوى الشيفرة الثنائية.**

 [![npm version](https://img.shields.io/npm/v/rea-agents?style=flat-square&color=cb3837)](https://www.npmjs.com/package/rea-agents)
-[![CI](https://img.shields.io/github/actions/workflow/status/morluto/rea/ci.yml?branch=main&style=flat-square&label=CI)](https://github.com/morluto/rea/actions/workflows/ci.yml)
 [![MCP tool catalog](https://img.shields.io/badge/MCP-tool_catalog-5c4ee5?style=flat-square)](docs/mcp-contracts.md#generated-catalog)
 [![Node.js requirements](https://img.shields.io/badge/Node.js-requirements-339933?style=flat-square&logo=nodedotjs&logoColor=white)](#current-status)
 [![skills.sh](https://skills.sh/b/morluto/rea?style=flat-square)](https://skills.sh/morluto/rea/reverse-engineer-anything)
@@ -9,7 +9,6 @@
 **Eine Funktion gefällt dir? Verstehe, wie sie funktioniert – bis hinunter auf die Binärebene.**

 [![npm version](https://img.shields.io/npm/v/rea-agents?style=flat-square&color=cb3837)](https://www.npmjs.com/package/rea-agents)
-[![CI](https://img.shields.io/github/actions/workflow/status/morluto/rea/ci.yml?branch=main&style=flat-square&label=CI)](https://github.com/morluto/rea/actions/workflows/ci.yml)
 [![MCP tool catalog](https://img.shields.io/badge/MCP-tool_catalog-5c4ee5?style=flat-square)](docs/mcp-contracts.md#generated-catalog)
 [![Node.js requirements](https://img.shields.io/badge/Node.js-requirements-339933?style=flat-square&logo=nodedotjs&logoColor=white)](#current-status)
 [![skills.sh](https://skills.sh/b/morluto/rea?style=flat-square)](https://skills.sh/morluto/rea/reverse-engineer-anything)
@@ -9,7 +9,6 @@
 **¿Ves una función que te gusta? Entiende cómo funciona, hasta el nivel binario.**

 [![npm version](https://img.shields.io/npm/v/rea-agents?style=flat-square&color=cb3837)](https://www.npmjs.com/package/rea-agents)
-[![CI](https://img.shields.io/github/actions/workflow/status/morluto/rea/ci.yml?branch=main&style=flat-square&label=CI)](https://github.com/morluto/rea/actions/workflows/ci.yml)
 [![MCP tool catalog](https://img.shields.io/badge/MCP-tool_catalog-5c4ee5?style=flat-square)](docs/mcp-contracts.md#generated-catalog)
 [![Node.js requirements](https://img.shields.io/badge/Node.js-requirements-339933?style=flat-square&logo=nodedotjs&logoColor=white)](#current-status)
 [![skills.sh](https://skills.sh/b/morluto/rea?style=flat-square)](https://skills.sh/morluto/rea/reverse-engineer-anything)
@@ -9,7 +9,6 @@
 **قابلیتی دیده‌اید که دوستش دارید؟ سازوکارش را تا سطح باینری درک کنید.**

 [![npm version](https://img.shields.io/npm/v/rea-agents?style=flat-square&color=cb3837)](https://www.npmjs.com/package/rea-agents)
-[![CI](https://img.shields.io/github/actions/workflow/status/morluto/rea/ci.yml?branch=main&style=flat-square&label=CI)](https://github.com/morluto/rea/actions/workflows/ci.yml)
 [![MCP tool catalog](https://img.shields.io/badge/MCP-tool_catalog-5c4ee5?style=flat-square)](docs/mcp-contracts.md#generated-catalog)
 [![Node.js requirements](https://img.shields.io/badge/Node.js-requirements-339933?style=flat-square&logo=nodedotjs&logoColor=white)](#current-status)
 [![skills.sh](https://skills.sh/b/morluto/rea?style=flat-square)](https://skills.sh/morluto/rea/reverse-engineer-anything)
@@ -9,7 +9,6 @@
 **Repérez une fonctionnalité qui vous plaît. Comprenez son fonctionnement, jusqu'au niveau du binaire.**

 [![npm version](https://img.shields.io/npm/v/rea-agents?style=flat-square&color=cb3837)](https://www.npmjs.com/package/rea-agents)
-[![CI](https://img.shields.io/github/actions/workflow/status/morluto/rea/ci.yml?branch=main&style=flat-square&label=CI)](https://github.com/morluto/rea/actions/workflows/ci.yml)
 [![MCP tool catalog](https://img.shields.io/badge/MCP-tool_catalog-5c4ee5?style=flat-square)](docs/mcp-contracts.md#generated-catalog)
 [![Node.js requirements](https://img.shields.io/badge/Node.js-requirements-339933?style=flat-square&logo=nodedotjs&logoColor=white)](#current-status)
 [![skills.sh](https://skills.sh/b/morluto/rea?style=flat-square)](https://skills.sh/morluto/rea/reverse-engineer-anything)
@@ -9,7 +9,6 @@
 **Melihat fitur yang Anda sukai. Pahami cara kerjanya hingga ke tingkat biner.**

 [![npm version](https://img.shields.io/npm/v/rea-agents?style=flat-square&color=cb3837)](https://www.npmjs.com/package/rea-agents)
-[![CI](https://img.shields.io/github/actions/workflow/status/morluto/rea/ci.yml?branch=main&style=flat-square&label=CI)](https://github.com/morluto/rea/actions/workflows/ci.yml)
 [![MCP tool catalog](https://img.shields.io/badge/MCP-tool_catalog-5c4ee5?style=flat-square)](docs/mcp-contracts.md#generated-catalog)
 [![Node.js requirements](https://img.shields.io/badge/Node.js-requirements-339933?style=flat-square&logo=nodedotjs&logoColor=white)](#current-status)
 [![skills.sh](https://skills.sh/b/morluto/rea?style=flat-square)](https://skills.sh/morluto/rea/reverse-engineer-anything)
@@ -9,7 +9,6 @@
 **Vedi una funzionalità che ti piace. Capisci come funziona, fino al livello binario.**

 [![npm version](https://img.shields.io/npm/v/rea-agents?style=flat-square&color=cb3837)](https://www.npmjs.com/package/rea-agents)
-[![CI](https://img.shields.io/github/actions/workflow/status/morluto/rea/ci.yml?branch=main&style=flat-square&label=CI)](https://github.com/morluto/rea/actions/workflows/ci.yml)
 [![MCP tool catalog](https://img.shields.io/badge/MCP-tool_catalog-5c4ee5?style=flat-square)](docs/mcp-contracts.md#generated-catalog)
 [![Node.js requirements](https://img.shields.io/badge/Node.js-requirements-339933?style=flat-square&logo=nodedotjs&logoColor=white)](#cosa-puoi-analizzare)
 [![skills.sh](https://skills.sh/b/morluto/rea?style=flat-square)](https://skills.sh/morluto/rea/reverse-engineer-anything)
@@ -9,7 +9,6 @@
 **気に入った機能を見つけたら、その仕組みをバイナリのレベルまで理解する。**

 [![npm version](https://img.shields.io/npm/v/rea-agents?style=flat-square&color=cb3837)](https://www.npmjs.com/package/rea-agents)
-[![CI](https://img.shields.io/github/actions/workflow/status/morluto/rea/ci.yml?branch=main&style=flat-square&label=CI)](https://github.com/morluto/rea/actions/workflows/ci.yml)
 [![MCP tool catalog](https://img.shields.io/badge/MCP-tool_catalog-5c4ee5?style=flat-square)](docs/mcp-contracts.md#generated-catalog)
 [![Node.js requirements](https://img.shields.io/badge/Node.js-requirements-339933?style=flat-square&logo=nodedotjs&logoColor=white)](#current-status)
 [![skills.sh](https://skills.sh/b/morluto/rea?style=flat-square)](https://skills.sh/morluto/rea/reverse-engineer-anything)
@@ -9,7 +9,6 @@
 **마음에 드는 기능을 발견했다면, 바이너리 수준까지 작동 원리를 이해하세요.**

 [![npm version](https://img.shields.io/npm/v/rea-agents?style=flat-square&color=cb3837)](https://www.npmjs.com/package/rea-agents)
-[![CI](https://img.shields.io/github/actions/workflow/status/morluto/rea/ci.yml?branch=main&style=flat-square&label=CI)](https://github.com/morluto/rea/actions/workflows/ci.yml)
 [![MCP tool catalog](https://img.shields.io/badge/MCP-tool_catalog-5c4ee5?style=flat-square)](docs/mcp-contracts.md#generated-catalog)
 [![Node.js requirements](https://img.shields.io/badge/Node.js-requirements-339933?style=flat-square&logo=nodedotjs&logoColor=white)](#current-status)
 [![skills.sh](https://skills.sh/b/morluto/rea?style=flat-square)](https://skills.sh/morluto/rea/reverse-engineer-anything)
@@ -9,7 +9,6 @@
 **Widzisz funkcję, która Ci się podoba? Dowiedz się, jak działa, aż do poziomu kodu binarnego.**

 [![npm version](https://img.shields.io/npm/v/rea-agents?style=flat-square&color=cb3837)](https://www.npmjs.com/package/rea-agents)
-[![CI](https://img.shields.io/github/actions/workflow/status/morluto/rea/ci.yml?branch=main&style=flat-square&label=CI)](https://github.com/morluto/rea/actions/workflows/ci.yml)
 [![MCP tool catalog](https://img.shields.io/badge/MCP-tool_catalog-5c4ee5?style=flat-square)](docs/mcp-contracts.md#generated-catalog)
 [![Node.js requirements](https://img.shields.io/badge/Node.js-requirements-339933?style=flat-square&logo=nodedotjs&logoColor=white)](#current-status)
 [![skills.sh](https://skills.sh/b/morluto/rea?style=flat-square)](https://skills.sh/morluto/rea/reverse-engineer-anything)
@@ -9,7 +9,6 @@
 **Viu uma funcionalidade de que gostou? Entenda como ela funciona, até o nível binário.**

 [![npm version](https://img.shields.io/npm/v/rea-agents?style=flat-square&color=cb3837)](https://www.npmjs.com/package/rea-agents)
-[![CI](https://img.shields.io/github/actions/workflow/status/morluto/rea/ci.yml?branch=main&style=flat-square&label=CI)](https://github.com/morluto/rea/actions/workflows/ci.yml)
 [![MCP tool catalog](https://img.shields.io/badge/MCP-tool_catalog-5c4ee5?style=flat-square)](docs/mcp-contracts.md#generated-catalog)
 [![Node.js requirements](https://img.shields.io/badge/Node.js-requirements-339933?style=flat-square&logo=nodedotjs&logoColor=white)](#current-status)
 [![skills.sh](https://skills.sh/b/morluto/rea?style=flat-square)](https://skills.sh/morluto/rea/reverse-engineer-anything)
@@ -9,7 +9,6 @@
 **Нашли интересную функцию? Разберитесь, как она работает, вплоть до двоичного кода.**

 [![npm version](https://img.shields.io/npm/v/rea-agents?style=flat-square&color=cb3837)](https://www.npmjs.com/package/rea-agents)
-[![CI](https://img.shields.io/github/actions/workflow/status/morluto/rea/ci.yml?branch=main&style=flat-square&label=CI)](https://github.com/morluto/rea/actions/workflows/ci.yml)
 [![MCP tool catalog](https://img.shields.io/badge/MCP-tool_catalog-5c4ee5?style=flat-square)](docs/mcp-contracts.md#generated-catalog)
 [![Node.js requirements](https://img.shields.io/badge/Node.js-requirements-339933?style=flat-square&logo=nodedotjs&logoColor=white)](#current-status)
 [![skills.sh](https://skills.sh/b/morluto/rea?style=flat-square)](https://skills.sh/morluto/rea/reverse-engineer-anything)
@@ -9,7 +9,6 @@
 **เห็นฟีเจอร์ที่ชอบแล้วอยากรู้ว่าทำงานอย่างไร? เข้าใจได้ลึกถึงระดับไบนารี**

 [![npm version](https://img.shields.io/npm/v/rea-agents?style=flat-square&color=cb3837)](https://www.npmjs.com/package/rea-agents)
-[![CI](https://img.shields.io/github/actions/workflow/status/morluto/rea/ci.yml?branch=main&style=flat-square&label=CI)](https://github.com/morluto/rea/actions/workflows/ci.yml)
 [![MCP tool catalog](https://img.shields.io/badge/MCP-tool_catalog-5c4ee5?style=flat-square)](docs/mcp-contracts.md#generated-catalog)
 [![Node.js requirements](https://img.shields.io/badge/Node.js-requirements-339933?style=flat-square&logo=nodedotjs&logoColor=white)](#current-status)
 [![skills.sh](https://skills.sh/b/morluto/rea?style=flat-square)](https://skills.sh/morluto/rea/reverse-engineer-anything)
@@ -9,7 +9,6 @@
 **Beğendiğiniz bir özellik mi gördünüz? İkili kod düzeyine kadar nasıl çalıştığını anlayın.**

 [![npm version](https://img.shields.io/npm/v/rea-agents?style=flat-square&color=cb3837)](https://www.npmjs.com/package/rea-agents)
-[![CI](https://img.shields.io/github/actions/workflow/status/morluto/rea/ci.yml?branch=main&style=flat-square&label=CI)](https://github.com/morluto/rea/actions/workflows/ci.yml)
 [![MCP tool catalog](https://img.shields.io/badge/MCP-tool_catalog-5c4ee5?style=flat-square)](docs/mcp-contracts.md#generated-catalog)
 [![Node.js requirements](https://img.shields.io/badge/Node.js-requirements-339933?style=flat-square&logo=nodedotjs&logoColor=white)](#current-status)
 [![skills.sh](https://skills.sh/b/morluto/rea?style=flat-square)](https://skills.sh/morluto/rea/reverse-engineer-anything)
@@ -9,7 +9,6 @@
 **Побачили цікаву функцію? Зрозумійте, як вона працює, аж до рівня двійкового коду.**

 [![npm version](https://img.shields.io/npm/v/rea-agents?style=flat-square&color=cb3837)](https://www.npmjs.com/package/rea-agents)
-[![CI](https://img.shields.io/github/actions/workflow/status/morluto/rea/ci.yml?branch=main&style=flat-square&label=CI)](https://github.com/morluto/rea/actions/workflows/ci.yml)
 [![MCP tool catalog](https://img.shields.io/badge/MCP-tool_catalog-5c4ee5?style=flat-square)](docs/mcp-contracts.md#generated-catalog)
 [![Node.js requirements](https://img.shields.io/badge/Node.js-requirements-339933?style=flat-square&logo=nodedotjs&logoColor=white)](#current-status)
 [![skills.sh](https://skills.sh/b/morluto/rea?style=flat-square)](https://skills.sh/morluto/rea/reverse-engineer-anything)
@@ -9,7 +9,6 @@
 **Thấy một tính năng bạn thích? Hiểu cách nó hoạt động, đến tận mức mã nhị phân.**

 [![npm version](https://img.shields.io/npm/v/rea-agents?style=flat-square&color=cb3837)](https://www.npmjs.com/package/rea-agents)
-[![CI](https://img.shields.io/github/actions/workflow/status/morluto/rea/ci.yml?branch=main&style=flat-square&label=CI)](https://github.com/morluto/rea/actions/workflows/ci.yml)
 [![MCP tool catalog](https://img.shields.io/badge/MCP-tool_catalog-5c4ee5?style=flat-square)](docs/mcp-contracts.md#generated-catalog)
 [![Node.js requirements](https://img.shields.io/badge/Node.js-requirements-339933?style=flat-square&logo=nodedotjs&logoColor=white)](#current-status)
 [![skills.sh](https://skills.sh/b/morluto/rea?style=flat-square)](https://skills.sh/morluto/rea/reverse-engineer-anything)
@@ -9,7 +9,6 @@
 **看到喜歡的功能，弄清它的工作原理，深入到二進位層面。**

 [![npm version](https://img.shields.io/npm/v/rea-agents?style=flat-square&color=cb3837)](https://www.npmjs.com/package/rea-agents)
-[![CI](https://img.shields.io/github/actions/workflow/status/morluto/rea/ci.yml?branch=main&style=flat-square&label=CI)](https://github.com/morluto/rea/actions/workflows/ci.yml)
 [![MCP tool catalog](https://img.shields.io/badge/MCP-tool_catalog-5c4ee5?style=flat-square)](docs/mcp-contracts.md#generated-catalog)
 [![Node.js requirements](https://img.shields.io/badge/Node.js-requirements-339933?style=flat-square&logo=nodedotjs&logoColor=white)](#current-status)
 [![skills.sh](https://skills.sh/b/morluto/rea?style=flat-square)](https://skills.sh/morluto/rea/reverse-engineer-anything)
@@ -9,7 +9,6 @@
 **看到喜欢的功能，弄清它的工作原理，深入到二进制层面。**

 [![npm version](https://img.shields.io/npm/v/rea-agents?style=flat-square&color=cb3837)](https://www.npmjs.com/package/rea-agents)
-[![CI](https://img.shields.io/github/actions/workflow/status/morluto/rea/ci.yml?branch=main&style=flat-square&label=CI)](https://github.com/morluto/rea/actions/workflows/ci.yml)
 [![MCP tool catalog](https://img.shields.io/badge/MCP-tool_catalog-5c4ee5?style=flat-square)](docs/mcp-contracts.md#generated-catalog)
 [![Node.js requirements](https://img.shields.io/badge/Node.js-requirements-339933?style=flat-square&logo=nodedotjs&logoColor=white)](#current-status)
 [![skills.sh](https://skills.sh/b/morluto/rea?style=flat-square)](https://skills.sh/morluto/rea/reverse-engineer-anything)
@@ -126,6 +126,20 @@ class ReaJadxBridge {
    return result;
  }

+  private JadxSession.SmartCode methodBody(JadxSession current, ClassSnapshot cls,
+      MethodSnapshot selected, JavaMethod method) {
+    if (!selected.shortId().equals("<clinit>()V"))
+      return current.getMethodBodySmart(method, current.getMaxSourceBytes(), true);
+    // Java code generation can fold all or part of <clinit> into field declarations.
+    // Its method text cannot establish coverage, even when a static block remains.
+    JadxSession.MethodSmali smali = current.getMethodSmali(cls.node(), method.getName());
+    if (!smali.getFound() || smali.getBlocks().size() != 1)
+      throw new IllegalArgumentException("Static initializer disassembly requires one exact method: " + selected.shortId());
+    return new JadxSession.SmartCode(
+        TextUtilKt.truncateToBytes(smali.getBlocks().get(0), current.getMaxSourceBytes()),
+        "smali", true, List.of("static_initializer_disassembly"));
+  }
+
  private CallToolResult handle(String name, JsonObject args) {
    if (name.equals("rea_jvm_status")) return json(Map.of(
        "engine_reported_version", BuildInfo.VERSION,
@@ -150,7 +164,7 @@ class ReaJadxBridge {
      int index = integer(args, "overload_index", 0);
      if (index >= overloads.size()) throw new InputFailure("overload_index", "overload_index out of range: " + index);
      JavaMethod method = method(cls, overloads.get(index));
-      JadxSession.SmartCode code = current.getMethodBodySmart(method, current.getMaxSourceBytes(), true);
+      JadxSession.SmartCode code = methodBody(current, cls, overloads.get(index), method);
      return json(Map.of("class_name", cls.summary().get("full_name"),
          "method_name", overloads.get(index).name(), "full_name", method.getFullName(),
          "overload_index", index, "overload_count", overloads.size(),
@@ -211,7 +225,7 @@ class ReaJadxBridge {
      String description = switch (name) {
        case "list_classes" -> "Indexed pages of all top-level class names, with offset and limit.";
        case "get_class_summary" -> "Parsed member metadata for one exact class name; no source generation.";
-        case "get_method_body" -> "Source for an exact class and stable same-name overload index, with smali fallback.";
+        case "get_method_body" -> "Source for an exact class and stable same-name overload index; static initializers use smali to preserve folded field initialization.";
        default -> "Complete static references to an exact class or unique method; source lines are unresolved.";
      };
      Tool narrowed = new Tool(name, new ToolSchema(null, new JsonObject(properties),
@@ -182,10 +182,17 @@ public final class ReaGhidraBridge extends HeadlessScript {
        }
        sessionDefaultAddressSpace =
            currentProgram.getAddressFactory().getDefaultAddressSpace();
-        if (currentProgram.getExecutableFormat().equals("Raw Binary") &&
-            !currentProgram.getOptions(ghidra.program.model.listing.Program.PROGRAM_INFO)
-                .getBoolean("REA DOS COM prepared", false)) {
-            throw new IllegalStateException("REA DOS COM entry/context preparation failed");
+        if (currentProgram.getExecutableFormat().equals("Raw Binary")) {
+            boolean dosCom = currentProgram.getLanguageID().getIdAsString()
+                .equals("x86:LE:16:Real Mode");
+            String preparation = dosCom ? "REA DOS COM prepared" : "REA raw binary prepared";
+            if (!currentProgram.getOptions(ghidra.program.model.listing.Program.PROGRAM_INFO)
+                .getBoolean(preparation, false)) {
+                throw new IllegalStateException(
+                    dosCom ? "REA DOS COM entry/context preparation failed" :
+                        "REA raw binary entry preparation failed"
+                );
+            }
        }
        if (!Application.getApplicationVersion().equals(descriptor.providerVersion)) {
            throw new IllegalStateException("Ghidra provider version does not match the session");
@@ -0,0 +1,14 @@
+import org.osgi.framework.BundleActivator;
+import org.osgi.framework.BundleContext;
+
+// Compile the no-op activator with REA's scripts. Otherwise Ghidra generates
+// one afterward and opens a second Java compiler and file manager.
+public final class ReaGhidraBundleActivator implements BundleActivator {
+    @Override
+    public void start(BundleContext context) {
+    }
+
+    @Override
+    public void stop(BundleContext context) {
+    }
+}
@@ -0,0 +1,36 @@
+import ghidra.app.script.GhidraScript;
+import ghidra.program.model.address.Address;
+import ghidra.program.model.listing.Program;
+
+/** Seed the caller-supplied raw-binary entry before default auto-analysis. */
+public final class ReaGhidraPrepareRaw extends GhidraScript {
+    @Override
+    public void run() throws Exception {
+        String[] arguments = getScriptArgs();
+        if (arguments.length != 2) {
+            throw new IllegalArgumentException(
+                "Raw binary preparation requires the committed language and entry address"
+            );
+        }
+        String expectedLanguage = arguments[0];
+        String entryHex = arguments[1];
+        if (!currentProgram.getLanguageID().getIdAsString().equals(expectedLanguage) ||
+            !currentProgram.getExecutableFormat().equals("Raw Binary")) {
+            throw new IllegalArgumentException(
+                "Raw binary preparation requires the committed language and BinaryLoader import"
+            );
+        }
+        Address entry = currentProgram.getAddressFactory().getDefaultAddressSpace().getAddress(entryHex);
+        Address start = currentProgram.getMinAddress();
+        if (entry == null || !entry.equals(start)) {
+            throw new IllegalArgumentException(
+                "Raw binary import must map file offset 0 at the caller-supplied entry"
+            );
+        }
+        addEntryPoint(entry);
+        if (!disassemble(entry) || createFunction(entry, "entry") == null) {
+            throw new IllegalStateException("Raw binary entry cannot be decoded as a function");
+        }
+        currentProgram.getOptions(Program.PROGRAM_INFO).setBoolean("REA raw binary prepared", true);
+    }
+}
@@ -54,6 +54,7 @@ export default defineConfig({
          { text: "IDA", link: "/ida-provider" },
          { text: "Ghidra on Windows", link: "/windows-ghidra-p0" },
          { text: "Ghidra DOS analysis", link: "/ghidra-dos" },
+          { text: "Ghidra raw binary", link: "/raw-binary" },
          { text: "Ghidra NativeAOT", link: "/ghidra-nativeaot" },
          { text: "Ghidra semantics", link: "/ghidra-provider" },
        ],
@@ -94,6 +94,12 @@ fallback for an overloaded method instead of attributing all bodies to one
 selected overload. Native/abstract methods with no decompiled body report
 `body_status: "not_available"` without inferring which implementation flag caused it.

+Static initializers (`<clinit>`) return smali with the
+`static_initializer_disassembly` marker. Java decompilation can move their
+instructions into field declarations, leaving an empty or incomplete method
+body. The selected method's disassembly preserves those instructions and retains
+the same source byte limit and explicit truncation reporting.
+
 ## Interpret the result

 - Package inspection retains decoded manifest XML, summary declarations,
@@ -59,7 +59,8 @@ alone, use `rea instructions`. A macOS `.app` bundle can be supplied directly.
 Run `rea --help` or a command's `--help` for arguments and output options.
 The [generated catalog](product-catalog.json) lists all CLI commands and MCP
 tools. Provider-specific target support is described in the
-[native guide](native-investigation.md), [DOS guide](ghidra-dos.md), and
+[native guide](native-investigation.md), [DOS guide](ghidra-dos.md),
+[raw binary guide](raw-binary.md), and
 [Windows Ghidra guide](windows-ghidra-p0.md).

 ## Choose a provider
@@ -352,6 +352,12 @@ Other integrations, including Qwen Code, use `~/.agents/skills`.
 A mixed selection plans each distinct destination. Selecting the skill without a client uses the shared
 directory. Setup leaves existing skill copies in other locations untouched.

+`rea setup --skill-client claude_code --yes --json` refreshes and verifies the
+selected skill destination independently of MCP registration selection. The
+final `doctor.scope.skill_clients` records which skill destinations were
+checked; `doctor.scope.clients` continues to describe required registrations.
+An unselected shared skill does not affect a client-only refresh.
+
 `doctor --skill --json` verifies the selected copies against the bundled
 instructions and references. Consumers should use `identity.skill.state`,
 `installed_version`, and `installed_tool_count` for skill readiness. The
@@ -561,8 +567,13 @@ need Xvfb, Python 3, X11 and XTEST; approved setup installs those dependencies
 on supported distributions. Add the curl installer's reported executable
 directory, commonly `~/.local/bin`, to your shell `PATH` if needed.

-REA starts Hopper when needed. On macOS, its launcher can bring a window or
-first-run dialog forward; choose demo mode or activate your existing license.
+REA starts Hopper when needed. On macOS, complete its demo or license prompt in
+the same user session before the first CLI/MCP operation or unattended job. Open
+Hopper manually if needed; its launcher can also bring the dialog forward.
+If startup reports `Cannot launch Hopper! Connection is invalid.` or waits for
+bridge readiness, check Hopper for a pending demo, license, or loader dialog.
+Complete the dialog and retry. If REA reports `cleanup_incomplete`, follow the
+retained-resource guidance below before reopening the target.
 Hopper serializes analysis requests. Cancelling a wait can leave provider work
 running, which the session reports. Successful decompilation is cached until
 a relevant rename or comment changes it.
@@ -591,6 +602,11 @@ if document closure is unconfirmed, REA retains the backing image and reports
 MCP-exit behavior.
 Startup deadlines report missing bridge readiness and preserve the launcher
 outcome; a successful helper exit does not prove that a loader dialog completed.
+If an owned provider process exits, request failures preserve its observed exit
+code or signal and bounded output in `details.launcher`. An exit can precede
+output-stream closure; `output_closed: false` keeps that uncertainty explicit.
+Later requests retain the known exit instead of reducing it to socket loss.
+An external GUI's helper exit does not establish that the GUI itself exited.
 Cursor navigation returns the observed object start when Hopper snaps an interior
 address; adjacent-object navigation rejects unmapped inputs and document ends.
 Native API text rejects NUL characters and unpaired Unicode surrogates before
@@ -159,9 +159,11 @@ completed partial Evidence. MCP failure details return
 after recording succeeds, so `inspect_analysis_view` can open that analysis
 directly without serializing the entire partial graph into the error response.
 CLI failure output retains the complete partial Evidence.
-Cancellation after source analysis begins likewise
-retains completed facts; an SDK client may reject its cancelled request before
-receiving that reply. On the same MCP connection, inspect the Evidence bundle
+Cancellation after source analysis begins likewise retains completed facts,
+including cancellation during analyzer cleanup, graph construction, or Evidence
+sealing. REA finishes projecting those owned facts cooperatively to return partial
+Evidence. An SDK client may reject its cancelled request before receiving that
+reply. On the same MCP connection, inspect the Evidence bundle
 and use the retained analysis ID with `inspect_analysis_view`. Owned analyzer
 cleanup is verified before its private files are released. Cleanup uncertainty
 is reported separately and retains ownership for retry.
@@ -231,6 +233,11 @@ unknown instead of silently treating them as absent or verified.
 Plain `.ts` artifact sources use TypeScript syntax without JSX, including
 angle-bracket type assertions. `.tsx` and `.jsx` retain JSX parsing.

+Relative TypeScript imports can name their emitted `.js`, `.mjs`, or `.cjs`
+counterparts while resolving to inventoried source files. This substitution
+requires import or require semantics. Literal Electron preload, renderer, and
+utility-process runtime paths retain the runtime filename selected by the caller.
+
 Selected bounded text is then parsed as inert data to recover:

 - `package.json` metadata and declared main or renderer entrypoints;
@@ -323,15 +330,44 @@ substitute version-dependent Electron defaults for omitted `webPreferences`.
 Dynamic option objects, bridge keys, API objects, and IPC channel expressions
 remain unknown and make coverage partial.

-Electron API identity follows proven lexical module aliases. Bundled CommonJS
-namespace imports are also followed through the interop helpers that bundlers
-and compilers emit (`__toESM`, `__importStar`, `_interopRequireWildcard`),
-including the `electron = __toESM(electron)` rewrap that Rolldown emits. This
-step is inferred: a helper is recognized by its emitted name and a single
-program-scope function definition, and its body is not evaluated, so a local
-function that reuses one of these names is trusted to pass the module through.
-Other reassigned bindings, dynamic selections, and visibly overwritten namespace
-members are unresolved.
+Electron API identity follows proven lexical module aliases. Namespace interop
+also preserves identity when the complete Rolldown helper operations, lexical
+roles, live getters, and captured intrinsic origins match, or when a stable
+helper simply returns its module parameter. Harmless single-statement control
+blocks preserve recognition; added operations still require proof. Literal
+member and destructuring projections are retained from proven results.
+Omitted or literal node-mode arguments preserve named exports; a module-valued
+default projection requires a truthy literal node mode. Computed or extra
+arguments remain unresolved.
+Recognition uses structure rather than emitted names; other helper bodies and ambiguous
+runtime fallbacks remain unresolved. Captured function identities survive later global-property
+replacement, including copies through initialized aliases. Reads before an
+alias initializer remain unresolved. Visible intrinsic writes before capture or
+conversion are checked in their owning callable scope, including identifier leaves in nested/default/rest
+destructuring and loop targets. Property keys and shadowed local bindings do not
+overwrite the global intrinsic identity. Cross-call side effects, including
+writes inside directly invoked local functions, are not evaluated. Other
+reassignments, dynamic selections, and visibly overwritten namespace members
+are unresolved.
+Known Object/Reflect mutators remain recognizable through literal destructuring
+of intrinsic objects and stable bound-function aliases. Calls retain bound
+argument prefixes and the original bound receiver through `call`, `apply`, and
+`Reflect.apply`, including generic `Function.prototype` invocation and binding
+creation. Arguments follow each actual callable invocation rather than property
+chain depth; rebinding retains the original bound receiver.
+Visibly replaced invocation intrinsics produce unknown effects instead
+of using their former call semantics; captured function aliases retain their
+earlier identity. Unexamined targets remain unresolved. `Reflect.set` examines
+its explicit receiver as well as its target, retaining unknown receiver effects.
+Creating an unused binding does not itself mutate an intrinsic. Variable
+redeclarations retain a single unconditional initializer
+when they introduce no assignment or second initializer.
+Stable identifier chains to fresh object, array, function,
+undecorated class or RegExp syntax keep those targets separate from intrinsic
+objects when initialized before use; opaque, decorated, reassigned or
+not-yet-initialized targets remain unresolved. Writes during class initialization
+are still retained. Function declarations are available before their textual
+position; variable and class initializers must precede use.
 Direct and destructuring assignment, loop, update, and delete targets are checked
 through namespace aliases; unrelated member writes do not discard observed API
 identity. This static check does
@@ -425,16 +461,40 @@ such as `./web3:app.js` still names a local artifact.
 Package `exports` fallback arrays are supported both at the top level and under
 the root `"."` entry. The resolver selects targets in declared order using the
 same conditional and invalid-entry handling as nested exports arrays.
+Nonempty arrays containing only inactive conditions remain unmatched, allowing
+the enclosing condition object to continue to a later active condition.
+Empty arrays and explicit null targets keep their blocking outcome.
+Refusal evidence distinguishes those source values and retains condition names
+from unmatched nested targets rather than reporting array indices.
 For imports and requires, the active Node conditions include `module-sync`;
 earlier active conditions retain precedence over later ones.

+Exact package-private `#alias` specifiers resolve against the importer's
+enclosing `package.json` `imports` map — the nearest same-container package
+scope, stopping at a `node_modules` directory so a nested package cannot inherit
+an ancestor's aliases. Selected targets are package-local `./` files with no
+extension or index fallback, using the same condition, array, and null selection
+as exports subpaths. A missing key, explicit null, or out-of-scope alias keeps
+an unresolved edge with that reason. Wildcard keys (`#internal/*`), recursive
+`#` targets, and external-package import targets remain unresolved.
+
+Exact keys such as `#/x` are literal lookup identities. `#` and names ending
+in `/` are invalid. Imports arrays skip invalid parent-relative, absolute, and
+URL targets before selecting a later package-local file; an unsupported bare
+package or recursive alias keeps its unresolved outcome rather than selecting
+a later fallback.
+
 ESM relative module paths and selected package exports targets use URL suffix handling
 and one percent-decoding pass. CommonJS relative paths and legacy package main
 fields retain literal filename punctuation. Exports targets must start with
 `./` and exclude `.`, `..`, and `node_modules` path segments, including their
 encoded forms, before URL normalization. Arrays skip invalid exports targets
-in declared order; URL decoding and file lookup failures for a selected target
-do not select a later entry. Rejected references retain the package metadata
+in declared order, including URLs that escape the package root after normalization.
+Selected package targets use the normalized URL path for lookup; tabs and
+newlines in the URL text are removed by the URL parser. CommonJS package targets
+reject encoded separators anywhere in the selected URL; ESM checks its pathname.
+URL decoding and file lookup failures for a selected target do not select a
+later entry. Rejected references retain the package metadata
 path, original target, failed constraint, and importing source location.

 HTML script references resolve to exact inventoried files after applying the
@@ -126,6 +126,24 @@ Member inspection binds build-local tokens, signatures, row offsets, method
 bodies, and decoded relationships to that artifact and MVID. Missing or malformed
 facts remain explicit in coverage and per-member status.

+Metadata table streams may carry the CLR-compatible `ExtraData` extension
+(`HeapSizes` flag `0x40`), which Microsoft readers honor although it is not
+specified by ECMA-335. REA skips its fixed four-byte word after the row counts
+before decoding table rows; the word's value is not a length. An incomplete
+word is reported as a metadata coverage failure at its file offset, without
+reading beyond the declared table stream.
+
+For unoptimized `#-` metadata, nonempty `FieldPtr` and `MethodPtr` tables
+translate TypeDef list positions to physical member definitions. REA resolves
+these indirections for member ownership and local attribute-constructor types;
+field and method tokens still identify the original definition rows.
+`field_list` and `method_list` retain the metadata's list coordinates, which
+refer to the pointer table when present rather than necessarily contiguous
+definition rows. Malformed or ambiguous pointers leave the owner unknown with
+partial coverage while preserving readable member and attribute facts.
+The retained inverse indexes are admitted against the existing representation
+budget before allocation.
+
 `exported_types` reports ExportedType rows as declared. Facade assemblies such
 as .NET `System.Runtime.dll` provide their types this way: `forwarder: true`
 marks a type forwarder, and `implementation_token` names the AssemblyRef, File,
@@ -150,13 +150,15 @@ structured data and matching text projection. Oversized errors are retained
 as Evidence before delivery of a bounded diagnostic with an export reference;
 if retention is unavailable or fails, the diagnostic reports that reason.

-REA accepts ordinary `tools/call` progress tokens. Updates are monotonic,
-rate-bounded to at most one intermediate update per 100 ms, and always allow a
-terminal update. Unknown totals are omitted; REA does not fabricate percentages.
+REA accepts ordinary `tools/call` progress tokens. The numeric `progress` counts
+emitted status observations and strictly increases, including when a waiting
+phase has completed no additional work. Updates are rate-bounded to at most one
+intermediate update per 100 ms and always allow a terminal update. `total` is
+omitted because the number of future status observations is unknown. Read
+`message` for the phase and observed work; REA does not fabricate percentages.
 `capture_process_scenario` uses that boundary only when the client supplies a
-progress token. Notifications set `progress` to the count of collected terminal
-frames, process samples, and interaction events, omit `total`, and put the
-lifecycle phase, elapsed time, and final cleanup status in `message`. A client
+progress token. Notifications put the lifecycle phase, elapsed time, and final
+cleanup status in `message`. A client
 that does not send a progress token receives no progress notifications. The
 tool result is unchanged either way.
 Provider calls receive the request cancellation signal. Artifact traversal,
@@ -230,6 +232,18 @@ engine readiness or a percentage of Ghidra auto-analysis. A longer server
 startup allowance does not extend the client's deadline; progress also does not
 extend it unless the client explicitly implements that policy.

+While Ghidra startup is pending, REA sends a waiting notification every ten
+seconds when the request has a progress token. Its message gives elapsed waiting
+time; import, auto-analysis and bridge readiness may all still be pending.
+Waiting notifications stop when startup settles or the caller cancels. They do
+not measure engine work completed.
+
+The pinned SDK can reset the request's inactivity timeout on progress with
+`resetTimeoutOnProgress: true`. Also set `maxTotalTimeout` to bound the complete
+request; the provider's startup deadline still applies. These options belong in
+the same second argument of `callTool`. Without that explicit client policy, the
+default 60-second request deadline still expires despite waiting notifications.
+
 The 240-second setting is a measured example, not a universal timeout: a
 controlled Linux x64/WSL2 fixture took about 64 seconds for its first overview
 with Ghidra 12.1.4 on a mounted NTFS installation, native JDK 21, two CPUs, and a
@@ -265,9 +279,10 @@ observed process-family member remained after final close. This was a small
 1,024-byte fixture, so the longer request setting remains an example, not a
 guarantee for larger targets. No macOS cold-start recovery was exercised.

-With a supplied progress token, the Windows run received an operation-start
+With a supplied progress token, that earlier Windows run received an operation-start
 notification before timeout and start/completion notifications for the
-successful retry. It received no intermediate import or auto-analysis progress.
+successful retry, before startup waiting notifications were added. It received
+no intermediate import or auto-analysis progress.
 These operation markers do not measure analysis work completed or extend the
 client's deadline. Each new provider session still imports the target into a
 fresh temporary project.
@@ -435,7 +450,13 @@ Tool annotations describe effects and are hints, not authorization controls
 ([MCP ToolAnnotations](https://modelcontextprotocol.io/specification/2025-06-18/schema#toolannotations)).
 `readOnlyHint` includes session state: an analysis call that records additive
 Evidence is marked non-read-only even when it leaves the target unchanged.
-`destructiveHint` describes possible data loss, not ordinary Evidence recording.
+`destructiveHint` is true when a tool may discard data (overwriting or clearing
+analyst metadata, replacing files, dropping session state), runs or drives code
+REA does not own (`executesForeignCode`: process, LLDB, Electron, browser, and
+native UI scenarios), or changes an attached Android device (`mutatesDevice`:
+push, install, uninstall, start, and stop). Ordinary Evidence recording is not
+destructive. The effect record in `binary_session` and the generated catalog
+carries each flag separately.
 Effect metadata covers possible behavior across supported inputs: DMG inventory
 can launch `hdiutil` and create an owned temporary mount directory; extraction
 creates a fresh output directory on every call. Comparing supplied web captures
@@ -0,0 +1,72 @@
+# Headerless raw-binary analysis with Ghidra
+
+REA admits a headerless executable when the caller supplies the CPU family and
+the address where file offset 0 should be mapped. That interpretation is not
+inferred from a `.bin` suffix or from unrecognized bytes.
+
+## Open and inspect
+
+```bash
+rea inspect /absolute/path/to/ecu.bin --target-format raw-binary --architecture arm --entry-point 0x8000000 --provider ghidra --json
+rea function /absolute/path/to/ecu.bin 0x8000000 --target-format raw-binary --architecture arm --entry-point 0x8000000 --provider ghidra --json
+rea inspect-native-load-image /absolute/path/to/ecu.bin --target-format raw-binary --architecture arm --entry-point 0x8000000 --provider ghidra --json
+```
+
+```json
+{
+  "name": "open_binary",
+  "arguments": {
+    "path": "/absolute/path/to/ecu.bin",
+    "format": "raw-binary",
+    "architecture": "arm",
+    "entry_point": "0x8000000",
+    "provider_id": "ghidra"
+  }
+}
+```
+
+`architecture` is one of `x86`, `x86_64`, `arm`, or `arm64`. `entry_point` is a
+hexadecimal address of the form `0x…`. The complete file is mapped starting at
+that address, and Ghidra seeds an `entry` function there before auto-analysis.
+ARM and AArch64 entries must be 4-byte aligned; x86 entries may be byte-aligned.
+`open_binary` and an open `binary_session` return the canonical `entry_point`
+for raw targets so callers can verify the selected mapping directly.
+Omitted `format` keeps header-based detection; architecture and entry without
+`format=raw-binary` are rejected.
+
+Ghidra imports a private snapshot with `BinaryLoader` and these little-endian
+generic languages:
+
+| architecture | language_id         |
+| ------------ | ------------------- |
+| x86          | `x86:LE:32:default` |
+| x86_64       | `x86:LE:64:default` |
+| arm          | `ARM:LE:32:v7`      |
+| arm64        | `AARCH64:LE:64:v8A` |
+
+Those settings, the caller-supplied entry, and `language_selection:
+caller-supplied-v1` are committed in the analysis profile. A different entry
+or architecture is a different profile; snapshots from header-detected targets
+do not replay.
+
+The mapped start is independent of Ghidra's program image base, which remains
+`0x0` for BinaryLoader. Ghidra may report additional language-defined entry
+points, including unmapped ARM vectors. Load-image verification requires the
+caller-supplied entry and preserves those other entries as observations.
+Independent raw verification streams the complete private snapshot digest and
+extent with bounded memory and supports cancellation during the read.
+
+Hopper and IDA refuse raw-binary targets. Windows Ghidra P0 continues to admit
+PE applications only.
+
+## Limitations
+
+- Headers are not discovered from file bytes. This increment does not guess
+  load addresses, vector tables, or memory maps.
+- Big-endian, Thumb-only, Cortex-M, and other Ghidra processor variants are
+  unsupported.
+- Reset vectors, memory-mapped I/O, and firmware boot sequences are not
+  emulated.
+- Independent load-image verification covers source identity, mapped file
+  bytes, the bound language, and the caller-supplied entry. Original bytes
+  stay unchanged.
@@ -139,8 +139,11 @@ directory, so default OS-home discovery remains unverified. Live model APIs and
 native Windows are also unverified.

 `verify:claude-client` requires installed Claude Code (verified with
-`@anthropic-ai/claude-code@2.1.296`); select it with `REA_VERIFY_CLAUDE_COMMAND`.
-The optional POSIX lane uses native `CLAUDE_CONFIG_DIR` discovery, an independent
+`@anthropic-ai/claude-code@2.1.296` on POSIX and native Windows); select it
+with `REA_VERIFY_CLAUDE_COMMAND`. On Windows, select
+`claude.exe`: npm installs put only a `claude.cmd` shim on `PATH`, and the real
+executable is under `node_modules/@anthropic-ai/claude-code/bin`.
+The optional lane uses native `CLAUDE_CONFIG_DIR` discovery, an independent
 Git workspace, user settings and default built-in tools. It preserves caller
 preferences and backups, checks idempotent setup, waits through the native
 `WaitForMcpServers` tool when discovery is pending, and validates the complete
@@ -149,8 +152,8 @@ native `Skill`, checks its full body and verifies named-schema JavaScript Eviden
 for a Unicode path. Use `-- chat` for ordinary chat with REA enabled, or
 `REA_VERIFY_RUNTIME_ROOT` for a production-only installed package. The local
 Anthropic Messages/SSE fixture preserves native resource-hint envelopes in its
-request artifacts. Usage is synthetic; live Anthropic API, native Windows and
-bare-mode personal-skill activation remain unverified by this lane.
+request artifacts. Usage is synthetic; live Anthropic API and bare-mode
+personal-skill activation remain unverified by this lane.

 `verify:copilot-client` requires installed GitHub Copilot CLI (verified with
 `@github/copilot@1.0.95`); select it with `REA_VERIFY_COPILOT_COMMAND`.
@@ -279,10 +282,12 @@ establish live DeepSeek API or native Windows coverage. Receipts include
 request artifacts, result digests and owned-process lineage.

 Full E2E tests invoke the production command dispatcher and real providers,
-without fake launchers, runners or responses. `verify:keyed-archive` writes an
-actual Foundation binary archive, runs the CLI and a separate stdio MCP
-subprocess, checks parity and pagination, rejects an escaping path and checks
-an XML graph golden. `verify:asset-catalog` compiles source-owned colors with
+without fake launchers, runners or responses. `verify:keyed-archive` writes
+Foundation binary, XML, and integer archives using one run-owned Swift module
+cache. It checks CLI and separate stdio MCP parity, pagination, escaping-path
+rejection, an XML graph golden, and numeric meaning for safe controls, unsafe
+integers, boxed numbers, and integral-valued reals. `verify:asset-catalog`
+compiles source-owned colors with
 `actool`, invokes real `assetutil`, then checks CLI/MCP results, exact catalog
 digest, every raw metadata field, pagination and malformed input rejection.
 Neither artifact workflow requires Hopper or launches it. Both run in macOS CI.
@@ -793,6 +798,14 @@ truncation constraint, while leading-zero coordinates still resolve correctly.
 It has the same Ghidra/JDK prerequisites as the MZ lane. Neither lane claims DOS
 runtime or PC-98 device execution.

+`npm run verify:ghidra:raw` uses a generated ARM little-endian headerless image
+through the compiled CLI and stdio MCP server. With the same Ghidra/JDK
+prerequisites, it checks preparation and bridge startup, verified load mappings,
+instruction and byte readback, canonical-entry session reuse, replacement when
+the entry changes without `provider_id`, unchanged source bytes, and owned
+cleanup. Other raw CPU families remain covered by deterministic tests rather
+than this real-provider lane. See [raw binary analysis](raw-binary.md).
+
 ## Apple Interface Builder archives

 `npm run verify:interface-builder` compiles the source-owned AppKit XIB into a
@@ -1,4 +1,12 @@
 #!/bin/bash
+{
+# Truncation guard: this brace group opens on line 2 and closes on the last
+# line, so bash must read the entire file before it runs any command. On the
+# `curl ... | bash` path, a download cut off anywhere before the final `}` is
+# an unterminated compound command, which bash reports as a syntax error at
+# EOF without running anything. Without the guard, a cut right after `set`
+# would run the bare builtin and print every shell variable, and a cut right
+# after `main` would run the installer without the caller's flags.
 set -euo pipefail

 PACKAGE="rea-agents"
@@ -21,104 +29,112 @@ usage() {
  cat <<'EOF'
 Usage: install.sh [--version VERSION] [--dry-run] [--no-setup] [--no-prompt] [--verbose]

-Installs only the REA CLI. Run `rea setup` separately to configure Hopper and agents.
+Installs the REA CLI, then starts `rea setup` interactively to configure Hopper
+and agents when a terminal is available. Pass --no-setup (or --no-prompt) to
+skip setup and run `rea setup` later.
 EOF
 }

-while (($# > 0)); do
-  case "$1" in
-    --version)
-      (($# >= 2)) || fail "--version requires a value."
-      version="$2"
-      shift 2
-      ;;
-    --dry-run)
-      dry_run=true
-      shift
-      ;;
-    --no-setup|--no-prompt)
-      start_setup=false
-      shift
-      ;;
-    --verbose)
-      verbose=true
-      shift
-      ;;
-    --help|-h)
-      usage
-      exit 0
-      ;;
-    *) fail "unknown option: $1" ;;
-  esac
-done
+main() {
+  while (($# > 0)); do
+    case "$1" in
+      --version)
+        (($# >= 2)) || fail "--version requires a value."
+        version="$2"
+        shift 2
+        ;;
+      --dry-run)
+        dry_run=true
+        shift
+        ;;
+      --no-setup|--no-prompt)
+        start_setup=false
+        shift
+        ;;
+      --verbose)
+        verbose=true
+        shift
+        ;;
+      --help|-h)
+        usage
+        exit 0
+        ;;
+      *) fail "unknown option: $1" ;;
+    esac
+  done

-if [[ "$verbose" == true ]]; then
-  set -x
-fi
+  if [[ "$verbose" == true ]]; then
+    set -x
+  fi

-platform="$(uname -s)"
-[[ "$platform" == "Darwin" || "$platform" == "Linux" ]] || fail "REA supports macOS and selected 64-bit Linux distributions."
-command -v curl >/dev/null 2>&1 || fail "curl is required. Install curl, then rerun this installer."
-command -v node >/dev/null 2>&1 || fail "Node.js 22.x (>=22.19), 24.x (>=24.11), or 26+ is required; install it from https://nodejs.org and retry."
-command -v npm >/dev/null 2>&1 || fail "npm is required; install it with Node.js and retry."
+  platform="$(uname -s)"
+  [[ "$platform" == "Darwin" || "$platform" == "Linux" ]] || fail "REA supports macOS and selected 64-bit Linux distributions."
+  command -v curl >/dev/null 2>&1 || fail "curl is required. Install curl, then rerun this installer."
+  command -v node >/dev/null 2>&1 || fail "Node.js 22.x (>=22.19), 24.x (>=24.11), or 26+ is required; install it from https://nodejs.org and retry."
+  command -v npm >/dev/null 2>&1 || fail "npm is required; install it with Node.js and retry."

-node_version="$(node -p 'process.versions.node' 2>/dev/null || true)"
-IFS=. read -r node_major node_minor _node_patch <<<"$node_version"
-[[ "$node_major" =~ ^[0-9]+$ && "$node_minor" =~ ^[0-9]+$ ]] || fail "the active Node.js version could not be read. Check that node works and is on PATH, then retry."
-if ! [[ "$_node_patch" =~ ^[0-9]+(\+[0-9A-Za-z.-]+)?$ ]] ||
-  ! ((node_major == 22 && node_minor >= 19 || node_major == 24 && node_minor >= 11 || node_major >= 26)); then
-  fail "Node.js $node_version is unsupported; use Node.js 22.x (>=22.19), 24.x (>=24.11), or 26+."
-fi
+  node_version="$(node -p 'process.versions.node' 2>/dev/null || true)"
+  IFS=. read -r node_major node_minor _node_patch <<<"$node_version"
+  [[ "$node_major" =~ ^[0-9]+$ && "$node_minor" =~ ^[0-9]+$ ]] || fail "the active Node.js version could not be read. Check that node works and is on PATH, then retry."
+  if ! [[ "$_node_patch" =~ ^[0-9]+(\+[0-9A-Za-z.-]+)?$ ]] ||
+    ! ((node_major == 22 && node_minor >= 19 || node_major == 24 && node_minor >= 11 || node_major >= 26)); then
+    fail "Node.js $node_version is unsupported; use Node.js 22.x (>=22.19), 24.x (>=24.11), or 26+."
+  fi

-if [[ -n "$version" ]]; then
-  [[ "$version" =~ ^${version_pattern}$ ]] || fail "version must be an exact semantic version."
-else
-  release_json="$(curl -fsSL --proto '=https' --tlsv1.2 --retry 3 -H 'Accept: application/vnd.github+json' "https://api.github.com/repos/$REPOSITORY/releases/latest")" || fail "the latest REA release could not be resolved. Check network access or pass --version VERSION, then retry."
-  tag="$(printf '%s' "$release_json" | node -e 'let s="";process.stdin.on("data",c=>s+=c).on("end",()=>{const v=JSON.parse(s).tag_name;if(typeof v!=="string")process.exit(1);process.stdout.write(v)})' 2>/dev/null)" || fail "the release response was invalid. Retry later or pass --version VERSION."
-  [[ "$tag" =~ ^rea-agents-(${version_pattern})$ ]] || fail "the latest release tag was invalid. Retry later or pass --version VERSION."
-  version="${BASH_REMATCH[1]}"
-fi
+  if [[ -n "$version" ]]; then
+    [[ "$version" =~ ^${version_pattern}$ ]] || fail "version must be an exact semantic version."
+  else
+    release_json="$(curl -fsSL --proto '=https' --tlsv1.2 --retry 3 -H 'Accept: application/vnd.github+json' "https://api.github.com/repos/$REPOSITORY/releases/latest")" || fail "the latest REA release could not be resolved. Check network access or pass --version VERSION, then retry."
+    tag="$(printf '%s' "$release_json" | node -e 'let s="";process.stdin.on("data",c=>s+=c).on("end",()=>{const v=JSON.parse(s).tag_name;if(typeof v!=="string")process.exit(1);process.stdout.write(v)})' 2>/dev/null)" || fail "the release response was invalid. Retry later or pass --version VERSION."
+    [[ "$tag" =~ ^rea-agents-(${version_pattern})$ ]] || fail "the latest release tag was invalid. Retry later or pass --version VERSION."
+    version="${BASH_REMATCH[1]}"
+  fi

-# npm's exact-version resolver cleans build metadata from the requested version,
-# so it may install the base release and make the post-install identity check fail.
-if [[ "$version" =~ \+ ]]; then
-  fail "npm cannot install an exact version with build metadata. Pass a version without build metadata, then retry."
-fi
+  # npm's exact-version resolver cleans build metadata from the requested version,
+  # so it may install the base release and make the post-install identity check fail.
+  if [[ "$version" =~ \+ ]]; then
+    fail "npm cannot install an exact version with build metadata. Pass a version without build metadata, then retry."
+  fi

-install_args=(install --global)
-if [[ "$platform" == "Linux" ]]; then
-  install_args+=(--prefix "$HOME/.local")
-  install_bin="$HOME/.local/bin/rea"
-else
-  npm_prefix="$(npm prefix --global)" || fail "the npm global prefix could not be read. Repair the npm configuration, then retry."
-  install_bin="$npm_prefix/bin/rea"
-fi
-install_args+=("$PACKAGE@$version")
+  install_args=(install --global)
+  if [[ "$platform" == "Linux" ]]; then
+    install_args+=(--prefix "$HOME/.local")
+    install_bin="$HOME/.local/bin/rea"
+  else
+    npm_prefix="$(npm prefix --global)" || fail "the npm global prefix could not be read. Repair the npm configuration, then retry."
+    install_bin="$npm_prefix/bin/rea"
+  fi
+  install_args+=("$PACKAGE@$version")

-printf 'REA install plan\n'
-printf '  Version: %s\n' "$version"
-printf '  Runtime: Node.js %s\n' "$node_version"
-printf '  Command:'
-printf ' %q' npm "${install_args[@]}"
-printf '\n'
-printf '  Binary:  %s\n' "$install_bin"
-printf '  Setup:   %s\n' "$([[ "$start_setup" == true ]] && printf 'start when a terminal is available' || printf 'skipped')"
+  printf 'REA install plan\n'
+  printf '  Version: %s\n' "$version"
+  printf '  Runtime: Node.js %s\n' "$node_version"
+  printf '  Command:'
+  printf ' %q' npm "${install_args[@]}"
+  printf '\n'
+  printf '  Binary:  %s\n' "$install_bin"
+  printf '  Setup:   %s\n' "$([[ "$start_setup" == true ]] && printf 'start when a terminal is available' || printf 'skipped')"

-if [[ "$dry_run" == true ]]; then
-  printf 'Dry run complete; no changes made.\n'
-  exit 0
-fi
+  if [[ "$dry_run" == true ]]; then
+    printf 'Dry run complete; no changes made.\n'
+    exit 0
+  fi

-printf 'Installing %s@%s...\n' "$PACKAGE" "$version"
-npm "${install_args[@]}" || fail "npm could not install REA. Check registry access and npm permissions, then retry."
-[[ -x "$install_bin" ]] || fail "npm completed without installing the rea command. Check the npm global bin directory and PATH, then retry."
-installed_version="$("$install_bin" --version 2>/dev/null | tr -d '[:space:]')" || fail "the installed REA version could not be read. Reinstall the requested version, then retry."
-[[ "$installed_version" == "$version" ]] || fail "installed version $installed_version does not match $version. Reinstall the requested version, then retry."
+  printf 'Installing %s@%s...\n' "$PACKAGE" "$version"
+  npm "${install_args[@]}" || fail "npm could not install REA. Check registry access and npm permissions, then retry."
+  [[ -x "$install_bin" ]] || fail "npm completed without installing the rea command. Check the npm global bin directory and PATH, then retry."
+  installed_version="$("$install_bin" --version 2>/dev/null | tr -d '[:space:]')" || fail "the installed REA version could not be read. Reinstall the requested version, then retry."
+  [[ "$installed_version" == "$version" ]] || fail "installed version $installed_version does not match $version. Reinstall the requested version, then retry."

-printf 'REA %s is installed.\n' "$version"
-if [[ "$start_setup" == true && -r /dev/tty && -w /dev/tty && -t 1 ]]; then
-  printf 'Starting REA setup...\n'
-  "$install_bin" setup </dev/tty >/dev/tty
-else
-  printf 'Run %s setup to configure Hopper and agents.\n' "$install_bin"
-fi
+  printf 'REA %s is installed.\n' "$version"
+  if [[ "$start_setup" == true && -r /dev/tty && -w /dev/tty && -t 1 ]]; then
+    printf 'Starting REA setup...\n'
+    "$install_bin" setup </dev/tty >/dev/tty
+  else
+    printf 'Run %s setup to configure Hopper and agents.\n' "$install_bin"
+  fi
+}
+
+main "$@"
+exit $?
+}
@@ -51,10 +51,12 @@
    "bridge/process/ProcessRunTokenReader.swift",
    "bridge/process/ProcessRunTokenReaderMain.swift",
    "bridge/ghidra/ReaGhidraBridge.java",
+    "bridge/ghidra/ReaGhidraBundleActivator.java",
    "bridge/ghidra/ReaGhidraExtensions.java",
    "bridge/ghidra/ReaGhidraPrepareCom.java",
    "bridge/ghidra/ReaGhidraApplySeeds.java",
    "bridge/ghidra/ReaGhidraNoReturnFix.java",
+    "bridge/ghidra/ReaGhidraPrepareRaw.java",
    "bridge/android/ReaJadxBridge.java",
    "bridge/mitmproxy/capture.py",
    "scripts/rea.mjs",
@@ -166,6 +168,7 @@
    "verify:ghidra:switch": "npm run build:cached && node scripts/verify-real-ghidra-switch.mjs",
    "verify:ghidra:dos": "npm run build:cached && node scripts/verify-real-ghidra-dos.mjs",
    "verify:ghidra:com": "npm run build:cached && node scripts/verify-real-ghidra-com.mjs",
+    "verify:ghidra:raw": "npm run build:cached && node scripts/verify-real-ghidra-raw.mjs",
    "verify:ghidra:aarch64-jump-table": "npm run build:cached && node scripts/verify-real-ghidra.mjs --aarch64-jump-table",
    "verify:interface-builder": "npm run build:cached && node scripts/verify/apple/interface-builder.mjs",
    "verify:ghidra:cross-format": "npm run build:cached && node scripts/verify-real-ghidra.mjs --cross-format",
@@ -401,6 +401,22 @@ class WebsiteTranslationChecks(unittest.TestCase):
                server.shutdown()
                worker.join()

+    def test_every_reading_page_offers_light_and_dark_theme_colors(self):
+        site = ROOT / "website/_site"
+        english_pages = reading_pages(ROOT / "website/public")
+        self.assertTrue(english_pages)
+        for language in languages(ROOT):
+            code = language["code"]
+            for original in english_pages:
+                relative = original.relative_to(ROOT / "website/public")
+                for path in {original, site / relative if code == "en" else site / code / relative}:
+                    with self.subTest(language=code, page=str(path.relative_to(ROOT))):
+                        doc = Document(path.read_text())
+                        media = sorted(node.attrs.get("media") for node in doc.nodes if node.tag == "meta" and node.attrs.get("name") == "theme-color")
+                        self.assertEqual(media, ["(prefers-color-scheme: dark)", "(prefers-color-scheme: light)"])
+        styles = (ROOT / "website/public/assets/styles.css").read_text()
+        self.assertTrue("@media (prefers-color-scheme: dark)" in styles, "styles.css has no dark color scheme block")
+

 if __name__ == "__main__":
    unittest.main()
@@ -13,10 +13,6 @@ import { exec } from "./lib/verify-package-core.mjs";
 import { createVerifierRun, completeVerifierRun } from "./lib/verifier-run.mjs";
 import { createAnthropicModelFixture } from "./verify/clients/anthropic-model-fixture.mjs";

-assert(
-  process.platform !== "win32",
-  "Native Claude Code verifier requires POSIX; Windows is unverified",
-);
 const repo = fileURLToPath(new URL("..", import.meta.url));
 const runtimeRoot = process.env.REA_VERIFY_RUNTIME_ROOT ?? repo;
 const command = process.env.REA_VERIFY_CLAUDE_COMMAND ?? "claude";
@@ -46,8 +42,13 @@ try {
    await exec(command, ["--version"], { env: environment, timeout: 30_000 })
  ).stdout.trim();
 } catch (cause) {
+  // npm installs put only a claude.cmd shim on PATH, which Node does not spawn without a shell.
+  const windowsHint =
+    process.platform === "win32"
+      ? " On Windows, select claude.exe; npm installs provide it under node_modules/@anthropic-ai/claude-code/bin."
+      : "";
  throw new Error(
-    `Claude Code preflight failed for ${command}; install Claude Code or set REA_VERIFY_CLAUDE_COMMAND. ${String(cause)}`,
+    `Claude Code preflight failed for ${command}; install Claude Code or set REA_VERIFY_CLAUDE_COMMAND.${windowsHint} ${String(cause)}`,
  );
 }
 const target = join(lab, "fixture α测试");
@@ -14,7 +14,7 @@ import {
  writeFile,
 } from "node:fs/promises";
 import { tmpdir } from "node:os";
-import { dirname, join, resolve } from "node:path";
+import { basename, dirname, join, resolve } from "node:path";
 import { promisify } from "node:util";
 import { fileURLToPath, pathToFileURL } from "node:url";

@@ -177,6 +177,7 @@ const scriptCollisions = [
  "ReaGhidraPrepareCom.java",
  "ReaGhidraApplySeeds.java",
  "ReaGhidraNoReturnFix.java",
+  "ReaGhidraPrepareRaw.java",
 ];
 await mkdir(callerDirectory);
 for (const name of scriptCollisions) await mkdir(join(callerDirectory, name));
@@ -290,6 +291,23 @@ try {
    await client.connect(transport);
    await call("open_binary", { path: target });
    await call("binary_overview", {});
+    const activators = (
+      await readdir(runtimeParent, { recursive: true })
+    ).filter((path) => basename(path) === "ReaGhidraBundleActivator.class");
+    assert.equal(activators.length, 1);
+    const [activator] = activators;
+    assert.ok(activator !== undefined);
+    const bundleDirectory = dirname(join(runtimeParent, activator));
+    const manifest = await readFile(
+      join(bundleDirectory, "META-INF", "MANIFEST.MF"),
+      "utf8",
+    );
+    assert.match(manifest, /^Bundle-Activator: ReaGhidraBundleActivator\r?$/mu);
+    await assert.rejects(
+      readFile(join(bundleDirectory, "GeneratedActivator.class")),
+      { code: "ENOENT" },
+    );
+    report.bundleActivator = "ReaGhidraBundleActivator";
    assert.equal((await call("list_documents", {})).length, 1);
    await call("list_names", {});
    const procedures = await call("list_procedures", {});
@@ -394,15 +412,15 @@ try {
          return evidence.normalized_result;
        },
      );
-    const expected = (
+    const { GHIDRA_MUTATING_OPERATIONS, GHIDRA_SESSION_CAPABILITIES } =
      await import(
        pathToFileURL(join(packageRoot, "dist/ghidra/GhidraSessionValues.js"))
-      )
-    ).GHIDRA_SESSION_CAPABILITIES.filter(
+      );
+    const expected = GHIDRA_SESSION_CAPABILITIES.filter(
      (name) =>
        name !== "ping" &&
        name !== "shutdown" &&
-        name !== "annotate_native_function",
+        !GHIDRA_MUTATING_OPERATIONS.has(name),
    );
    assert.ok(
      expected.every((name) => report.mcpOperations.includes(name)),
@@ -440,7 +458,10 @@ try {
    token,
    "Analysis changed caller token authority.",
  );
-  assert.deepEqual((await readdir(callerDirectory)).sort(), scriptCollisions);
+  assert.deepEqual(
+    (await readdir(callerDirectory)).sort(),
+    [...scriptCollisions].sort(),
+  );
  for (const name of scriptCollisions)
    assert.deepEqual(await readdir(join(callerDirectory, name)), []);
  report.callerScriptCollisionsPreserved = true;
@@ -5,10 +5,16 @@ import { promisify } from "node:util";
 const exec = promisify(execFile);
 const packedHopperBridge = "package/bridge/hopper_bridge.py";
 const packedGhidraBridge = "package/bridge/ghidra/ReaGhidraBridge.java";
+const packedGhidraActivator =
+  "package/bridge/ghidra/ReaGhidraBundleActivator.java";

 /** Check shipped bridge files; real-provider lanes verify runtime behavior. */
 export async function verifyPackedBridge({ workspace, tarball, packedFiles }) {
-  for (const path of [packedHopperBridge, packedGhidraBridge]) {
+  for (const path of [
+    packedHopperBridge,
+    packedGhidraBridge,
+    packedGhidraActivator,
+  ]) {
    if (!packedFiles.includes(path)) throw new Error(`package omitted ${path}`);
  }
  await exec("tar", ["-xf", tarball, "-C", workspace]);
@@ -0,0 +1,219 @@
+import assert from "node:assert/strict";
+import { execFile } from "node:child_process";
+import { createHash } from "node:crypto";
+import { mkdtemp, mkdir, readFile, rm, writeFile } from "node:fs/promises";
+import { tmpdir } from "node:os";
+import { join } from "node:path";
+import { fileURLToPath } from "node:url";
+import { promisify } from "node:util";
+
+import { Client } from "@modelcontextprotocol/client";
+import { StdioClientTransport } from "@modelcontextprotocol/client/stdio";
+
+import { parseEvidence } from "../dist/domain/evidence.js";
+import { inspectGhidraInstallation } from "../dist/ghidra/GhidraInstallation.js";
+import { requireMcpOperationResult } from "./lib/mcp-verifier-results.mjs";
+import { createVerifierRun, completeVerifierRun } from "./lib/verifier-run.mjs";
+
+if (process.argv.length !== 2)
+  throw new Error("Usage: node scripts/verify-real-ghidra-raw.mjs");
+if (!["linux", "darwin"].includes(process.platform))
+  throw new Error(
+    "Raw-binary verification requires a Linux or macOS Ghidra host.",
+  );
+if (process.env.GHIDRA_INSTALL_DIR === undefined)
+  throw new Error(
+    "Set GHIDRA_INSTALL_DIR to a bring-your-own Ghidra installation.",
+  );
+const installation = inspectGhidraInstallation({
+  environment: process.env,
+  installDir: process.env.GHIDRA_INSTALL_DIR,
+  ...(process.env.JAVA_HOME === undefined
+    ? {}
+    : { javaHome: process.env.JAVA_HOME }),
+});
+assert.equal(installation.status, "available", JSON.stringify(installation));
+
+const run = createVerifierRun();
+const workspace = await mkdtemp(join(tmpdir(), "rea-raw-proof-"));
+const runtime = join(workspace, "runtime");
+await mkdir(runtime);
+const bytes = Buffer.from("1eff2fe1", "hex"); // ARM little-endian bx lr.
+const sha256 = createHash("sha256").update(bytes).digest("hex");
+const path = join(workspace, "image.bin");
+await writeFile(path, bytes);
+const entrypoint = fileURLToPath(new URL("./rea.mjs", import.meta.url));
+const env = {
+  PATH: process.env.PATH ?? "/usr/bin:/bin",
+  TMPDIR: runtime,
+  REA_LOG_LEVEL: "silent",
+  REA_ANALYSIS_PROVIDER: "ghidra",
+  REA_PROCESS_RUN_ID: run.run_id,
+  GHIDRA_INSTALL_DIR: process.env.GHIDRA_INSTALL_DIR,
+  ...(process.env.JAVA_HOME === undefined
+    ? {}
+    : { JAVA_HOME: process.env.JAVA_HOME }),
+};
+const transport = new StdioClientTransport({
+  command: process.execPath,
+  args: [entrypoint, "mcp"],
+  env,
+  stderr: "pipe",
+});
+const client = new Client({ name: "rea-real-raw-proof", version: "1" });
+let stderr = "";
+transport.stderr?.on("data", (chunk) => {
+  stderr = (stderr + chunk.toString()).slice(-65536);
+});
+let report;
+try {
+  await client.connect(transport);
+  const profiles = [];
+  const sessions = [];
+  for (const entryPoint of ["0x08000000", "0x8000000", "0x09000000"]) {
+    // Omit provider_id to exercise reuse of the current provider route.
+    const opened = await call("open_binary", {
+      path,
+      format: "raw-binary",
+      architecture: "arm",
+      entry_point: entryPoint,
+    });
+    const entry = `0x${BigInt(entryPoint).toString(16)}`;
+    assert.equal(opened.entry_point, entry);
+    const image = await call("inspect_native_load_image");
+    assert.equal(
+      image.normalized_result.status,
+      "verified",
+      JSON.stringify(image),
+    );
+    assert.equal(image.normalized_result.base_address, entry);
+    assert.equal(image.normalized_result.entry.address, entry);
+    assert.equal(
+      image.normalized_result.observations.language_id,
+      "ARM:LE:32:v7",
+    );
+    assert.ok(
+      image.normalized_result.observations.entry_points.includes(entry),
+    );
+    assert.equal(image.analysis_profile.parameters.entry_point, entry);
+    profiles.push(image.analysis_profile.digest);
+    const status = await call("binary_session");
+    assert.equal(status.entry_point, entry);
+    sessions.push(status.analysis_run.run_id);
+    const memory = await call("read_bytes", {
+      address: entry,
+      length: bytes.length,
+    });
+    assert.equal(memory.normalized_result.bytes_hex, bytes.toString("hex"));
+    const procedures = await call("list_procedures");
+    assert.ok(
+      procedures.normalized_result.some(
+        (procedure) => procedure.address === entry,
+      ),
+    );
+    const instruction = await call("inspect_native_instruction", {
+      address: entry,
+    });
+    assert.equal(instruction.normalized_result.address, entry);
+  }
+  assert.equal(profiles[0], profiles[1]);
+  assert.notEqual(profiles[1], profiles[2]);
+  assert.equal(sessions[0], sessions[1]);
+  assert.notEqual(sessions[1], sessions[2]);
+  const rejected = await client.callTool({
+    name: "open_binary",
+    arguments: {
+      path,
+      format: "raw-binary",
+      architecture: "arm64",
+      entry_point: "0x8000001",
+    },
+  });
+  assert.equal(rejected.isError, true);
+  assert.match(JSON.stringify(rejected.content), /must be 4-byte aligned/);
+  const unchanged = await call("binary_session");
+  assert.equal(unchanged.analysis_run.run_id, sessions[2]);
+  assert.equal(unchanged.entry_point, "0x9000000");
+  await call("close_binary");
+
+  const { stdout } = await promisify(execFile)(
+    process.execPath,
+    [
+      entrypoint,
+      "inspect-native-load-image",
+      path,
+      "--target-format",
+      "raw-binary",
+      "--architecture",
+      "arm",
+      "--entry-point",
+      "0x08000000",
+      "--provider",
+      "ghidra",
+      "--json",
+    ],
+    { env, timeout: 240000, maxBuffer: 16 * 1024 * 1024 },
+  );
+  const cli = parseEvidence(JSON.parse(stdout));
+  assert.equal(cli.subject.digest.sha256, sha256);
+  assert.equal(cli.normalized_result.status, "verified");
+  assert.equal(cli.normalized_result.base_address, "0x8000000");
+  assert.equal(cli.analysis_profile.digest, profiles[0]);
+  assert.deepEqual(await readFile(path), bytes);
+  report = {
+    ok: true,
+    mocked: false,
+    lane: "ghidra-raw",
+    host: process.platform,
+    provider: { id: "ghidra", version: installation.providerVersion },
+    target: {
+      format: "raw-binary",
+      architecture: "arm",
+      sha256,
+      bytes: bytes.length,
+    },
+    transport: { cli: true, stdio_mcp: true },
+    canonical_entry_reuses_session: true,
+    changed_entry_replaces_session: true,
+    lifecycle_entry_preserved: true,
+    invalid_entry_preserves_active_session: true,
+    load_images_verified: true,
+    original_unchanged: true,
+  };
+} catch (error) {
+  if (stderr.trim()) process.stderr.write(stderr);
+  throw error;
+} finally {
+  await client.close();
+  await transport.close();
+  await rm(workspace, { recursive: true, force: true });
+}
+const verifierRun = await completeVerifierRun(run);
+assert.equal(verifierRun.process_lineage.status, "verified");
+assert.deepEqual(verifierRun.process_lineage.descendants, []);
+process.stdout.write(
+  JSON.stringify({
+    verifier_run: verifierRun,
+    ...report,
+    cleanup: "complete",
+  }) + "\n",
+);
+
+async function call(name, args = {}) {
+  const result = await client.callTool(
+    { name, arguments: args },
+    { timeout: 240000 },
+  );
+  assert.notEqual(result.isError, true, JSON.stringify(result));
+  const projected = requireMcpOperationResult(result, name);
+  if (
+    name === "open_binary" ||
+    name === "close_binary" ||
+    name === "binary_session"
+  )
+    return projected;
+  const evidence = parseEvidence(result.structuredContent);
+  assert.equal(evidence.subject.digest.sha256, sha256);
+  assert.equal(evidence.subject.format, "raw-binary");
+  return evidence;
+}
@@ -21,14 +21,17 @@ import { SUPPORTED_GHIDRA_VERSION } from "../dist/ghidra/GhidraInstallationPolic
 import { GhidraHeadlessLauncher } from "../dist/ghidra/GhidraLauncher.js";
 import { GHIDRA_PROVIDER_IDENTITY } from "../dist/ghidra/GhidraProviderCapabilities.js";
 import { windowsP0Capabilities } from "../dist/ghidra/GhidraProviderCapabilities.js";
-import { GHIDRA_SESSION_CAPABILITIES } from "../dist/ghidra/GhidraSessionValues.js";
+import {
+  GHIDRA_MUTATING_OPERATIONS,
+  GHIDRA_SESSION_CAPABILITIES,
+} from "../dist/ghidra/GhidraSessionValues.js";
 import { parseBinaryTarget } from "../dist/application/BinaryTargetResolver.js";
 import { completeVerifierRun, createVerifierRun } from "./lib/verifier-run.mjs";
 import { verifyGhidraCompactReferences } from "./lib/real-ghidra-compact-references.mjs";

 const verifierRun = createVerifierRun();
 const SESSION_CAPABILITIES = GHIDRA_SESSION_CAPABILITIES.filter(
-  (name) => name !== "annotate_native_function",
+  (name) => !GHIDRA_MUTATING_OPERATIONS.has(name),
 );

 if (process.platform !== "win32" || process.arch !== "x64")
@@ -236,10 +239,8 @@ try {

  const expected = [
    ...GHIDRA_INVENTORY_OPERATIONS,
-    ...GHIDRA_FUNCTION_OPERATIONS.filter(
-      (name) => name !== "annotate_native_function",
-    ),
-  ];
+    ...GHIDRA_FUNCTION_OPERATIONS,
+  ].filter((name) => !GHIDRA_MUTATING_OPERATIONS.has(name));
  if (
    observed.size !== expected.length ||
    expected.some((operation) => !observed.has(operation))
@@ -7,13 +7,16 @@ import { promisify } from "node:util";
 import { Client } from "@modelcontextprotocol/client";
 import { StdioClientTransport } from "@modelcontextprotocol/client/stdio";
 import { parseEvidence } from "../../../dist/domain/evidence.js";
-import { hashAndroidFile } from "../../../dist/android/AndroidTargetSnapshot.js";
+import { hashAndroidFile } from "./digest.mjs";
 import { JADX_RELEASE } from "../../../dist/android/JadxRelease.js";
 import fixture from "../../fixtures/android/apidemos.json" with { type: "json" };
 import { verifyAndroidCliCancellation } from "./cli-cancellation.mjs";
 import { verifyAndroidMetadata } from "./metadata.mjs";
 import { verifyAndroidFailureRecovery } from "./failure-recovery.mjs";
-import { resolveJadxConfiguration } from "../../../dist/android/JadxConfiguration.js";
+import {
+  resolveJadxConfigurationInputs,
+  validateJadxConfiguration,
+} from "../../../dist/android/JadxConfiguration.js";
 import { verifyWindowsAndroidLifecycle } from "./windows-lifecycle.mjs";

 const repository = resolve(dirname(fileURLToPath(import.meta.url)), "../../..");
@@ -35,10 +38,16 @@ assert.equal(
  JADX_RELEASE.sha256,
  "Real Android lane requires the audited headless JADX release JAR",
 );
-const { java, jvmArguments } = await resolveJadxConfiguration(
+const configuration = await resolveJadxConfigurationInputs(
  process.env,
  "inspect_android_package",
 );
+await validateJadxConfiguration(
+  configuration,
+  process.env,
+  "inspect_android_package",
+);
+const { java, jvmArguments } = configuration;
 const execute = promisify(execFile);
 await execute(java, ["-version"], { timeout: 10_000 });
 const entrypoint =
@@ -52,6 +61,8 @@ await verifyAndroidMetadata({
  repository,
  execute,
  jvmArguments,
+  entrypoint,
+  environment,
  bridge: resolve(dirname(entrypoint), "../bridge/android/ReaJadxBridge.java"),
 });
 const tasks = [
@@ -0,0 +1,9 @@
+import { createHash } from "node:crypto";
+import { createReadStream } from "node:fs";
+
+/** Verify artifact identity without depending on private runtime snapshot helpers. */
+export const hashAndroidFile = async (path) => {
+  const hash = createHash("sha256");
+  for await (const bytes of createReadStream(path)) hash.update(bytes);
+  return hash.digest("hex");
+};
@@ -0,0 +1,130 @@
+import assert from "node:assert/strict";
+import { Client } from "@modelcontextprotocol/client";
+import { StdioClientTransport } from "@modelcontextprotocol/client/stdio";
+import { parseEvidence } from "../../../dist/domain/evidence.js";
+import { hashAndroidFile } from "./digest.mjs";
+
+/** Verify folded field assignments and remaining static-block calls through both public adapters. */
+export const verifyAndroidInitializers = async ({
+  apk,
+  repository,
+  entrypoint,
+  environment,
+  execute,
+}) => {
+  const digest = await hashAndroidFile(apk);
+  const cases = [
+    {
+      class_name: "fixture.InitializationPolicy",
+      witnesses: [
+        "declared-policy",
+        "->singletonList",
+        "->POLICY:Ljava/util/List;",
+      ],
+    },
+    {
+      class_name: "fixture.MixedInitialization",
+      witnesses: ["field-value", "->LABEL:Ljava/lang/String;", "->touch()V"],
+    },
+  ];
+  const check = (value, scenario) => {
+    const evidence = parseEvidence(value);
+    assert.equal(evidence.subject.digest.sha256, digest);
+    const result = evidence.normalized_result;
+    assert.equal(result.class_name, scenario.class_name);
+    assert.equal(result.method.name, "<clinit>");
+    assert.equal(result.overload_count, 1);
+    assert.equal(result.body_status, "available");
+    assert.equal(result.representation, "smali");
+    assert.equal(result.fell_back, true);
+    assert.ok(result.markers.includes("static_initializer_disassembly"));
+    assert.equal(result.source.status, "complete");
+    for (const witness of scenario.witnesses)
+      assert.ok(
+        result.source.text.includes(witness),
+        `Missing initializer evidence: ${witness}`,
+      );
+    return evidence;
+  };
+  const cli = new Map();
+  for (const scenario of cases) {
+    const response = await execute(
+      process.execPath,
+      [
+        entrypoint,
+        "inspect-android-method",
+        apk,
+        scenario.class_name,
+        "<clinit>",
+        "--format",
+        "json",
+      ],
+      {
+        cwd: repository,
+        env: environment,
+        timeout: 150_000,
+        maxBuffer: 8 * 1024 * 1024,
+      },
+    );
+    cli.set(scenario.class_name, check(JSON.parse(response.stdout), scenario));
+  }
+  const transport = new StdioClientTransport({
+    command: process.execPath,
+    args: [entrypoint, "mcp"],
+    cwd: repository,
+    env: environment,
+    stderr: "pipe",
+  });
+  let stderr = "";
+  transport.stderr?.on("data", (chunk) => {
+    stderr += chunk.toString();
+  });
+  const client = new Client({
+    name: "rea-real-android-initializers",
+    version: "1",
+  });
+  try {
+    await client.connect(transport, { timeout: 30_000 });
+    for (const scenario of cases) {
+      const response = await client.callTool(
+        {
+          name: "inspect_android_method",
+          arguments: {
+            path: apk,
+            class_name: scenario.class_name,
+            method_name: "<clinit>",
+          },
+        },
+        { timeout: 150_000 },
+      );
+      assert.notEqual(response.isError, true, JSON.stringify(response));
+      const evidence = check(response.structuredContent, scenario);
+      assert.deepEqual(
+        evidence.normalized_result,
+        cli.get(scenario.class_name).normalized_result,
+      );
+      assert.deepEqual(
+        evidence.parameters,
+        cli.get(scenario.class_name).parameters,
+      );
+      assert.deepEqual(
+        evidence.provider,
+        cli.get(scenario.class_name).provider,
+      );
+    }
+    await client.ping();
+  } catch (cause) {
+    process.stderr.write(stderr);
+    throw cause;
+  } finally {
+    await client.close();
+  }
+  assert.equal(
+    await hashAndroidFile(apk),
+    digest,
+    "Static inspection changed fixture bytes",
+  );
+  console.log(
+    "PASS real CLI/MCP static initializer evidence, identity, parity and unchanged APK",
+  );
+};
@@ -2,6 +2,7 @@ import assert from "node:assert/strict";
 import { mkdtemp, rm } from "node:fs/promises";
 import { tmpdir } from "node:os";
 import { delimiter, join, resolve } from "node:path";
+import { verifyAndroidInitializers } from "./initializers.mjs";

 /** Prove cold metadata stays unmaterialized and overload identities survive code generation. */
 export const verifyAndroidMetadata = async ({
@@ -11,6 +12,8 @@ export const verifyAndroidMetadata = async ({
  bridge,
  repository,
  execute,
+  entrypoint,
+  environment,
  jvmArguments = [],
 }) => {
  const javac =
@@ -55,6 +58,8 @@ export const verifyAndroidMetadata = async ({
        `${classes}${delimiter}${jar}`,
        "ReaJadxMetadataRegression",
        apk,
+        resolve(repository, "tests/fixtures/android/static-initializers"),
+        classes,
      ],
      { timeout: 120_000, maxBuffer: 8 * 1024 * 1024 },
    );
@@ -62,9 +67,23 @@ export const verifyAndroidMetadata = async ({
      result.stdout,
      /METADATA_REGRESSION_PASS classes=\d+ overloads=3/u,
    );
+    assert.match(
+      result.stdout,
+      /INITIALIZER_REGRESSION_PASS folded=2 bounded=true/u,
+    );
    console.log(
      "PASS real cold metadata, full generic types and stable overloaded method selection",
    );
+    console.log(
+      "PASS real folded and mixed static initializers, absent bodies and bounded smali",
+    );
+    await verifyAndroidInitializers({
+      apk: resolve(classes, "initializers.apk"),
+      repository,
+      entrypoint,
+      environment,
+      execute,
+    });
  } finally {
    await rm(classes, { recursive: true, force: true });
  }
@@ -13,7 +13,10 @@ import { dirname, join } from "node:path";
 import { setTimeout as delay } from "node:timers/promises";
 import { Client } from "@modelcontextprotocol/client";
 import { StdioClientTransport } from "@modelcontextprotocol/client/stdio";
-import { resolveJadxConfiguration } from "../../../dist/android/JadxConfiguration.js";
+import {
+  resolveJadxConfigurationInputs,
+  validateJadxConfiguration,
+} from "../../../dist/android/JadxConfiguration.js";

 /** Verify real Windows cancellation, disconnect and abrupt CLI owner exit. */
 export async function verifyWindowsAndroidLifecycle(options) {
@@ -36,7 +39,12 @@ export async function verifyWindowsAndroidLifecycle(options) {
 }

 async function verifyJavaSelection(environment) {
-  const selected = await resolveJadxConfiguration(
+  const selected = await resolveJadxConfigurationInputs(
+    environment,
+    "inspect_android_package",
+  );
+  await validateJadxConfiguration(
+    selected,
    environment,
    "inspect_android_package",
  );
@@ -51,7 +59,12 @@ async function verifyJavaSelection(environment) {
    // The owned junction borrows the selected JDK directory without copying it.
    await symlink(dirname(selected.java), alias, "junction");
    pathEnvironment.Path = `"${alias}"`;
-    const onPath = await resolveJadxConfiguration(
+    const onPath = await resolveJadxConfigurationInputs(
+      pathEnvironment,
+      "inspect_android_package",
+    );
+    await validateJadxConfiguration(
+      onPath,
      pathEnvironment,
      "inspect_android_package",
    );
@@ -0,0 +1,147 @@
+import assert from "node:assert/strict";
+import { createHash } from "node:crypto";
+import { readFile } from "node:fs/promises";
+import { join } from "node:path";
+import { z } from "zod";
+import { keyedArchiveResultSchema } from "../../../dist/domain/apple/keyedArchive.js";
+
+const rowSchema = z.object({
+  container: z.enum(["roots", "objects"]),
+  root: z.string(),
+  objectId: z.number().int().nonnegative().optional(),
+  path: z.array(z.union([z.string(), z.number().int().nonnegative()])),
+  kind: z.enum(["integer", "real"]),
+  literal: z.string(),
+});
+const archiveSchema = z.object({
+  filename: z.string(),
+  sha256: z.string().regex(/^[a-f0-9]{64}$/u),
+  rows: z.array(rowSchema),
+});
+const oracleSchema = z.object({ xml: archiveSchema, binary: archiveSchema });
+
+const formats = ["xml", "binary"];
+const requiredRows = [
+  { root: "unsafeSigned", kind: "integer", literal: "9007199254740993" },
+  {
+    root: "unsafeNegative",
+    kind: "integer",
+    literal: "-9223372036854775808",
+  },
+  { root: "safeInteger", kind: "integer", literal: "9007199254740991" },
+  { root: "safeNegative", kind: "integer", literal: "-42" },
+  { root: "integralReal", kind: "real", literal: "9007199254740992" },
+  {
+    root: "boxedUnsigned",
+    kind: "integer",
+    literal: "9007199254740993",
+    container: "objects",
+  },
+  {
+    root: "boxedReal",
+    kind: "real",
+    literal: "9007199254740992",
+    container: "objects",
+  },
+];
+
+const valueAt = (value, path) => {
+  for (const key of path) {
+    if (value === null || typeof value !== "object") return undefined;
+    value = value[key];
+  }
+  return value;
+};
+
+const isUnsafeInteger = (row) =>
+  row.kind === "integer" &&
+  (BigInt(row.literal) > BigInt(Number.MAX_SAFE_INTEGER) ||
+    BigInt(row.literal) < BigInt(Number.MIN_SAFE_INTEGER));
+
+/** Verify the actual Foundation output and the production CLI/MCP result. */
+export async function verifyKeyedArchiveIntegerArchives(root) {
+  const oracle = oracleSchema.parse(
+    JSON.parse(await readFile(join(root, "oracle.json"), "utf8")),
+  );
+  const archives = [];
+
+  for (const format of formats) {
+    const archive = oracle[format];
+    for (const required of requiredRows) {
+      assert.ok(
+        archive.rows.some(
+          (row) =>
+            row.root === required.root &&
+            row.kind === required.kind &&
+            row.literal === required.literal &&
+            (required.container === undefined ||
+              row.container === required.container),
+        ),
+        `${format} Foundation oracle omitted ${required.root} ${required.literal}`,
+      );
+    }
+
+    const archivePath = join(root, archive.filename);
+    const digest = createHash("sha256")
+      .update(await readFile(archivePath))
+      .digest("hex");
+    assert.equal(digest, archive.sha256, `${format} archive digest`);
+    archives.push({ format, archive, archivePath, digest });
+  }
+  return archives;
+}
+
+/** Check every oracle numeric slot, preserving object-table identity lookups. */
+export function assertKeyedArchiveIntegerResult(
+  result,
+  format,
+  digest,
+  oracle,
+) {
+  const parsed = keyedArchiveResultSchema.parse(result);
+  assert.equal(parsed.archive_sha256, digest);
+  assert.equal(parsed.target_sha256, digest);
+  assert.equal(
+    parsed.archive_format,
+    format === "xml" ? "xml-plist" : "binary-plist",
+  );
+
+  for (const row of oracle.rows) {
+    const unsafe = isUnsafeInteger(row);
+    const source =
+      row.container === "roots"
+        ? parsed.roots
+        : parsed.objects.find((object) => object.id === row.objectId)?.value;
+    const value = valueAt(source, row.path);
+    assert.notEqual(
+      value,
+      undefined,
+      `${row.root} numeric slot remains present`,
+    );
+
+    if (unsafe) {
+      const exact =
+        typeof value === "object" &&
+        value !== null &&
+        value.$plist_type === "integer" &&
+        value.decimal === BigInt(row.literal).toString();
+      const disclosed = parsed.limitations.some(
+        (reason) =>
+          /integer|number/iu.test(reason) &&
+          /precision|exact range|rounded/iu.test(reason),
+      );
+      assert.ok(
+        exact || disclosed,
+        `${row.root} ${row.literal} must be exact or disclose numeric loss`,
+      );
+    } else {
+      assert.equal(
+        typeof value,
+        "number",
+        `${row.root} retains its numeric type`,
+      );
+      assert.equal(value, Number(row.literal), `${row.root} numeric value`);
+    }
+  }
+  return parsed;
+}
@@ -1,5 +1,5 @@
-import { execFile, spawnSync } from "node:child_process";
-import { mkdtemp, readFile, rm } from "node:fs/promises";
+import { execFile } from "node:child_process";
+import { mkdir, mkdtemp, readFile, rm } from "node:fs/promises";
 import { tmpdir } from "node:os";
 import { join } from "node:path";
 import { fileURLToPath } from "node:url";
@@ -11,6 +11,10 @@ import {
  artifactMcpResult,
  withArtifactMcp,
 } from "../../lib/artifact-e2e.mjs";
+import {
+  assertKeyedArchiveIntegerResult,
+  verifyKeyedArchiveIntegerArchives,
+} from "./keyed-archive-integers.mjs";

 if (process.platform !== "darwin")
  throw new Error(
@@ -170,26 +174,37 @@ try {
      );
    });
  }
-  const numericTests = spawnSync(
-    "npm",
-    [
-      "run",
-      "test:focused",
-      "--",
-      "tests/boundary/filesystem/keyedArchiveNativeIntegers.test.ts",
-    ],
-    {
-      cwd: fileURLToPath(new URL("../../../", import.meta.url)),
-      stdio: "inherit",
-      timeout: 240_000,
-    },
-  );
-  if (numericTests.error) throw numericTests.error;
-  assert.equal(
-    numericTests.status,
-    0,
-    "Native Foundation integer cases failed",
-  );
+  const integers = join(root, "integers");
+  await mkdir(integers);
+  await promisify(execFile)("/usr/bin/xcrun", [
+    "swift",
+    "-module-cache-path",
+    join(root, "modules"),
+    fileURLToPath(
+      new URL(
+        "../../../tests/conformance/native/keyed-archive-integers.swift",
+        import.meta.url,
+      ),
+    ),
+    integers,
+  ]);
+  for (const fixture of await verifyKeyedArchiveIntegerArchives(integers)) {
+    const cliResult = assertKeyedArchiveIntegerResult(
+      await artifactCli("inspect-keyed-archive", fixture.archivePath),
+      fixture.format,
+      fixture.digest,
+      fixture.archive,
+    );
+    await withArtifactMcp(fixture.archivePath, async (client) => {
+      const mcpResult = assertKeyedArchiveIntegerResult(
+        await artifactMcpResult(client, "inspect_keyed_archive"),
+        fixture.format,
+        fixture.digest,
+        fixture.archive,
+      );
+      assert.deepEqual(mcpResult, cliResult);
+    });
+  }
  report = {
    ok: true,
    mocked: false,
@@ -197,6 +212,9 @@ try {
    stdio_mcp: true,
    xml_golden: true,
    uid_named_root: true,
+    numeric_formats: ["xml", "binary"],
+    numeric_cli: true,
+    numeric_stdio_mcp: true,
    format: graph.archive_format,
    objects: graph.total_objects,
    references: graph.total_references,
@@ -10,12 +10,12 @@ import type {
 } from "../application/AnalysisProvider.js";
 import {
  createAnalysisExecution,
+  providerConfigurationRefusal,
  type AnalysisExecution,
 } from "../application/AnalysisProvider.js";
 import type { AdbRequest } from "../domain/adb/adbDeviceAnalysis.js";
 import {
  AnalysisArtifactChangedError,
-  AnalysisCapabilityUnavailableError,
  AnalysisCancelledError,
  AnalysisInputError,
  AnalysisOutputError,
@@ -417,8 +417,8 @@ export class AdbProvider {
  async inspectAvailability(
    signal?: AbortSignal,
  ): Promise<ProviderAvailability> {
-    const selection = this.selection();
    try {
+      const selection = this.selection();
      await inspectAdbClient(selection, signal);
      return {
        status: "available",
@@ -555,21 +555,19 @@ export class AdbProvider {
    const signal = options?.signal;
    if (signal?.aborted === true)
      return err(new AnalysisCancelledError(request.operation));
-    const selection = this.selection();
+    let selection: AdbBinarySelection;
    let identity: AdbClientIdentity;
    try {
+      selection = this.selection();
      identity = await inspectAdbClient(selection, signal);
    } catch (cause) {
      if (cause instanceof AnalysisCancelledError) return err(cause);
      if (cause instanceof AdbConfigurationFailure)
        return err(
-          new AnalysisCapabilityUnavailableError(
+          providerConfigurationRefusal(
            ADB_PROVIDER_IDENTITY.id,
            request.operation,
-            typeof cause.diagnostics.remediation === "string"
-              ? `${cause.message} ${cause.diagnostics.remediation}`
-              : cause.message,
-            { cause },
+            cause,
          ),
        );
      return err(
@@ -22,6 +22,7 @@ import type {
 } from "../application/AnalysisProvider.js";
 import {
  createAnalysisExecution,
+  providerConfigurationRefusal,
  type AnalysisExecution,
 } from "../application/AnalysisProvider.js";
 import type { ApktoolRequest } from "../domain/apktool/apktoolResourceAnalysis.js";
@@ -153,12 +154,13 @@ const runApktool = async (
    invocation = apktoolInvocation(selection, arguments_, hostEnvironment);
  } catch (cause) {
    if (!(cause instanceof WindowsBatchCommandError)) throw cause;
+    const reason = `The apktool batch launcher cannot receive REA's decode paths through cmd.exe: ${cause.message}`;
    return err(
      new AnalysisCapabilityUnavailableError(
        APKTOOL_PROVIDER_IDENTITY.id,
        operation,
-        `The apktool batch launcher cannot receive REA's decode paths through cmd.exe: ${cause.message}`,
-        { cause },
+        reason,
+        { cause, userMessage: reason },
      ),
    );
  }
@@ -345,8 +347,8 @@ export class ApktoolProvider {
  async #inspectAvailability(
    signal: AbortSignal,
  ): Promise<ProviderAvailability> {
-    const selection = this.selection();
    try {
+      const selection = this.selection();
      await inspectApktoolClient(selection, signal, this.environment);
      throwIfCancelled("inspect_apktool_client", signal);
      return {
@@ -397,9 +399,10 @@ export class ApktoolProvider {
  ): Promise<Result<AnalysisExecution, AnalysisError>> {
    if (signal?.aborted === true)
      return err(new AnalysisCancelledError(request.operation));
-    const selection = this.selection();
+    let selection: ApktoolCommandSelection;
    let identity: ApktoolClientIdentity;
    try {
+      selection = this.selection();
      identity = await inspectApktoolClient(
        selection,
        signal,
@@ -409,13 +412,10 @@ export class ApktoolProvider {
      if (cause instanceof AnalysisCancelledError) return err(cause);
      if (cause instanceof ApktoolConfigurationFailure)
        return err(
-          new AnalysisCapabilityUnavailableError(
+          providerConfigurationRefusal(
            APKTOOL_PROVIDER_IDENTITY.id,
            request.operation,
-            typeof cause.diagnostics.remediation === "string"
-              ? `${cause.message} ${cause.diagnostics.remediation}`
-              : cause.message,
-            { cause },
+            cause,
          ),
        );
      return err(
@@ -5,6 +5,7 @@ import type { NativeToolName } from "../contracts/native/nativeToolContracts.js"
 import type { ArtifactAnalysisOperation } from "../contracts/artifactToolContracts.js";
 import type { ManagedToolName } from "../contracts/managed/managedToolContracts.js";
 import type { AnalysisError } from "../domain/analysisErrorBase.js";
+import { AnalysisCapabilityUnavailableError } from "../domain/analysisErrorCore.js";
 import type { AnalysisProfileCommitment } from "../domain/analysisProfile.js";
 import type { JsonValue } from "../domain/jsonValue.js";
 import type { Result } from "../domain/result.js";
@@ -210,6 +211,31 @@ export type ProviderAvailability =
      readonly diagnostics: Readonly<Record<string, JsonValue>>;
    };

+/** A host tool configuration failure observed before any target work. */
+export interface ProviderConfigurationFailure extends Error {
+  readonly diagnostics: Readonly<Record<string, JsonValue>>;
+}
+
+/**
+ * Refuse an operation because the host tool is misconfigured. The reason,
+ * not the generic target advice, tells the caller what to change.
+ */
+export const providerConfigurationRefusal = (
+  providerId: string,
+  operation: string,
+  failure: ProviderConfigurationFailure,
+): AnalysisCapabilityUnavailableError => {
+  const remediation = failure.diagnostics.remediation;
+  const reason =
+    typeof remediation === "string"
+      ? `${failure.message}. ${remediation}.`
+      : `${failure.message}.`;
+  return new AnalysisCapabilityUnavailableError(providerId, operation, reason, {
+    cause: failure,
+    userMessage: reason,
+  });
+};
+
 /** Provider-owned target support observation before profile resolution. */
 export type ProviderTargetSupport =
  | {
@@ -26,6 +26,8 @@ import {
  validateDosComLength,
  type ExecutableFormatHint,
 } from "../domain/dosCom.js";
+import { admitRawBinary } from "../domain/rawBinary.js";
+import type { BinaryArchitecture } from "../domain/binaryTargetTypes.js";
 import { mzWindowsHeaderOffset } from "../domain/dosMz.js";
 import {
  hasZipSignature,
@@ -45,6 +47,8 @@ export interface BinaryTargetResolverOptions {
  readonly hostArchitecture?: NodeJS.Architecture;
  readonly targetKind?: BinaryTarget["kind"];
  readonly formatHint?: ExecutableFormatHint;
+  readonly architecture?: BinaryArchitecture;
+  readonly entryPoint?: string;
  readonly signal?: AbortSignal;
 }

@@ -61,7 +65,7 @@ export const parseBinaryTarget = async (
 > => {
  const cwd = options.cwd ?? process.cwd();
  const hostArchitecture = options.hostArchitecture ?? process.arch;
-  const { targetKind, formatHint, signal } = options;
+  const { targetKind, formatHint, signal, architecture, entryPoint } = options;
  const candidate = isAbsolute(input) ? input : resolve(cwd, input);
  try {
    throwIfTargetResolutionCancelled(signal);
@@ -83,6 +87,40 @@ export const parseBinaryTarget = async (
      throwIfTargetResolutionCancelled(signal);
      const metadata = await handle.stat();
      throwIfTargetResolutionCancelled(signal);
+      if (formatHint === "raw-binary") {
+        if (targetKind !== undefined && targetKind !== "executable")
+          return err(
+            new BinaryTargetError(
+              path,
+              "raw-binary format requires an executable target kind",
+            ),
+          );
+        const admitted = admitRawBinary({
+          architecture,
+          entryPoint,
+          fileBytes: metadata.size,
+        });
+        if (!admitted.ok)
+          return err(new BinaryTargetError(path, admitted.error));
+        return ok({
+          path,
+          sourcePath: canonical,
+          sha256: await sha256Handle(handle, path, metadata, signal),
+          kind: "executable",
+          format: "raw-binary",
+          architecture: admitted.value.architecture,
+          availableArchitectures: [admitted.value.architecture],
+          entryPoint: admitted.value.entryPoint,
+          entryPointSource: admitted.value.entryPointSource,
+        });
+      }
+      if (architecture !== undefined || entryPoint !== undefined)
+        return err(
+          new BinaryTargetError(
+            path,
+            "architecture and entry_point apply only with format=raw-binary",
+          ),
+        );
      if (formatHint === "dos-com") {
        if (targetKind !== undefined && targetKind !== "executable")
          return err(
@@ -194,7 +232,13 @@ const detectArtifactFormat = async (
 ): Promise<
  | Exclude<
      BinaryTarget["format"],
-      "analysis-database" | "mach-o" | "elf" | "pe" | "dos-mz" | "dos-com"
+      | "analysis-database"
+      | "mach-o"
+      | "elf"
+      | "pe"
+      | "dos-mz"
+      | "dos-com"
+      | "raw-binary"
    >
  | undefined
 > => {
@@ -244,7 +288,13 @@ const namedArtifactFormat = (
 const isArchiveFormat = (
  format: Exclude<
    BinaryTarget["format"],
-    "analysis-database" | "mach-o" | "elf" | "pe" | "dos-mz" | "dos-com"
+    | "analysis-database"
+    | "mach-o"
+    | "elf"
+    | "pe"
+    | "dos-mz"
+    | "dos-com"
+    | "raw-binary"
  >,
 ): format is Extract<BinaryTarget, { kind: "archive" }>["format"] =>
  isZipPackageFormat(format) || ["asar", "dmg", "pkg"].includes(format);
@@ -20,6 +20,7 @@ import {
  clientRequirementsFor,
  NO_CLIENT_FEATURES,
 } from "./CapabilityClientRequirements.js";
+import { compareUnicodeCodePoints } from "../domain/unicodeCodePointOrder.js";

 const statusSchema = z.object({
  open: z.boolean(),
@@ -210,7 +211,7 @@ export const buildCapabilityInventory = (
          reason: availability.reason,
          remediation: availability.remediation,
        };
-  }).sort((left, right) => left.name.localeCompare(right.name));
+  }).sort((left, right) => compareUnicodeCodePoints(left.name, right.name));
 };

 const availabilityFor = (context: AvailabilityContext): Availability => {
@@ -18,6 +18,7 @@ import { z } from "zod";

 import { PRODUCT_IDENTITY } from "../identity.js";
 import type { SetupClient } from "./SupportedClients.js";
+import { compareUnicodeCodePoints } from "../domain/unicodeCodePointOrder.js";

 export type ClientConfigurationFormat = NonNullable<SetupClient["format"]>;
 export type ClientServersKey = "mcp_servers" | "mcpServers" | "mcp" | "servers";
@@ -63,7 +64,7 @@ const normalizeConfigurationValue = (value: unknown): unknown => {
    return value;
  return Object.fromEntries(
    Object.entries(value)
-      .sort(([left], [right]) => left.localeCompare(right))
+      .sort(([left], [right]) => compareUnicodeCodePoints(left, right))
      .map(([key, nested]) => [key, normalizeConfigurationValue(nested)]),
  );
 };
@@ -8,6 +8,7 @@ import {
  type ClientConfigurationDocument,
 } from "./ClientConfigurationDocument.js";
 import { PRODUCT_IDENTITY } from "../identity.js";
+import { compareUnicodeCodePoints } from "../domain/unicodeCodePointOrder.js";

 /** Read explicit REA overrides without dropping peers when one value is invalid. */
 export const clientRegistrationEnvironment = (
@@ -47,7 +48,7 @@ export const clientRegistrationEnvironment = (
  return ok(
    Object.fromEntries(
      Object.entries(environment).sort(([left], [right]) =>
-        left.localeCompare(right),
+        compareUnicodeCodePoints(left, right),
      ),
    ),
  );
@@ -25,6 +25,7 @@ import {
  supportedClients,
 } from "./SupportedClients.js";
 import type { SetupClient } from "./SupportedClients.js";
+import { compareUnicodeCodePoints } from "../domain/unicodeCodePointOrder.js";

 interface ClientRegistrationStatusBase {
  readonly client: string;
@@ -184,7 +185,7 @@ export const readClientRegistrationStatuses = async (
    }
  }
  return statuses.sort((left, right) =>
-    left.client.localeCompare(right.client),
+    compareUnicodeCodePoints(left.client, right.client),
  );
 };

@@ -1,4 +1,5 @@
 import type { ExecutableFormatHint } from "../domain/dosCom.js";
+import type { BinaryArchitecture } from "../domain/binaryTargetTypes.js";
 import type { JsonValue } from "../domain/jsonValue.js";
 import type { DirectAnalysisDependencies } from "./DirectAnalysisDependencies.js";
 import type { BinarySession } from "./binary/BinarySession.js";
@@ -91,6 +92,8 @@ export const runDirectAnalysis = async (
    readonly signal?: AbortSignal;
    readonly providerId?: AnalysisProviderSelector;
    readonly formatHint?: ExecutableFormatHint;
+    readonly architecture?: BinaryArchitecture;
+    readonly entryPoint?: string;
  } = {},
 ): Promise<JsonValue> =>
  withProcessCancellation(options.signal, (signal) =>
@@ -101,6 +104,12 @@ export const runDirectAnalysis = async (
      ...(options.formatHint === undefined
        ? {}
        : { formatHint: options.formatHint }),
+      ...(options.architecture === undefined
+        ? {}
+        : { architecture: options.architecture }),
+      ...(options.entryPoint === undefined
+        ? {}
+        : { entryPoint: options.entryPoint }),
      ...(options.providerId === undefined
        ? {}
        : { providerId: options.providerId }),
@@ -187,6 +196,8 @@ const runAnalysis = async (
    readonly signal: AbortSignal;
    readonly providerId?: AnalysisProviderSelector;
    readonly formatHint?: ExecutableFormatHint;
+    readonly architecture?: BinaryArchitecture;
+    readonly entryPoint?: string;
  },
 ): Promise<JsonValue> => {
  const { logger, signal, snapshotPath } = options;
@@ -203,6 +214,12 @@ const runAnalysis = async (
        ...(options.formatHint === undefined
          ? {}
          : { formatHint: options.formatHint }),
+        ...(options.architecture === undefined
+          ? {}
+          : { architecture: options.architecture }),
+        ...(options.entryPoint === undefined
+          ? {}
+          : { entryPoint: options.entryPoint }),
      });
      if (!prepared.ok) return cliError(prepared.error);
      const { snapshot } = prepared.value;
@@ -214,6 +231,12 @@ const runAnalysis = async (
          ...(options.formatHint === undefined
            ? {}
            : { formatHint: options.formatHint }),
+          ...(options.architecture === undefined
+            ? {}
+            : { architecture: options.architecture }),
+          ...(options.entryPoint === undefined
+            ? {}
+            : { entryPoint: options.entryPoint }),
          ...(options.providerId === undefined
            ? {}
            : { providerId: options.providerId }),
@@ -246,6 +269,12 @@ const runAnalysis = async (
        ...(options.formatHint === undefined
          ? {}
          : { formatHint: options.formatHint }),
+        ...(options.architecture === undefined
+          ? {}
+          : { architecture: options.architecture }),
+        ...(options.entryPoint === undefined
+          ? {}
+          : { entryPoint: options.entryPoint }),
        ...(snapshot === undefined ? {} : { snapshot }),
        ...(options.providerId === undefined
          ? {}
@@ -440,6 +469,8 @@ const withProcessCancellation = async <Value>(
 const prepareSnapshot = async (options: {
  readonly path: string;
  readonly formatHint?: ExecutableFormatHint;
+  readonly architecture?: BinaryArchitecture;
+  readonly entryPoint?: string;
  readonly snapshotPath: string | undefined;
  readonly signal: AbortSignal;
 }): Promise<
@@ -458,6 +489,12 @@ const prepareSnapshot = async (options: {
    ...(options.formatHint === undefined
      ? {}
      : { formatHint: options.formatHint }),
+    ...(options.architecture === undefined
+      ? {}
+      : { architecture: options.architecture }),
+    ...(options.entryPoint === undefined
+      ? {}
+      : { entryPoint: options.entryPoint }),
  });
  if (!target.ok) return target;
  if (!snapshotMatchesTarget(loaded.value.target, target.value))
@@ -281,6 +281,42 @@ describe("doctor installation identity", () => {
 });

 describe("doctor scoped readiness", () => {
+  it("checks explicitly selected skill destinations independently of registrations", async () => {
+    const selected: (readonly string[] | undefined)[] = [];
+    const result = await runDoctor(
+      undefined,
+      host({
+        clientRegistrations: () => Promise.resolve([]),
+        installedSkillIdentity: (clients) => {
+          selected.push(clients);
+          return Promise.resolve({
+            version: "stale",
+            toolCount: 0,
+            canonical: false,
+          });
+        },
+      }),
+      {
+        clients: [],
+        skillClients: ["claude_code", "claude_code"],
+        skill: true,
+      },
+    );
+
+    expect(selected).toEqual([["claude_code"]]);
+    expect(result.scope).toMatchObject({
+      mode: "explicit",
+      clients: [],
+      skill_clients: ["claude_code"],
+      skill: true,
+    });
+    expect(result.healthy).toBe(false);
+    expect(result.scope_checks.map(({ name }) => name)).toEqual([
+      "node",
+      "skill:identity",
+    ]);
+  });
+
  it("scopes effective readiness to selected clients without hiding drift", async () => {
    const registrations: readonly ClientRegistrationStatus[] = [
      {
@@ -120,6 +120,7 @@ export interface DoctorReport {
 /** Caller-selected readiness boundary; omitted values retain audit semantics. */
 export interface DoctorScope {
  readonly clients?: readonly string[];
+  readonly skillClients?: readonly string[];
  readonly providers?: readonly string[];
  readonly skill?: boolean;
 }
@@ -206,9 +207,10 @@ const collectDoctorIdentity = async (
  const installationPaths = (await host.installationPaths?.()) ?? [];
  const registrations = (await host.clientRegistrations?.()) ?? [];
  const skillClientIds =
-    scope.mode === "audit-wide"
+    scope.skill_clients ??
+    (scope.mode === "audit-wide"
      ? registrations.map(({ client }) => client)
-      : scope.clients;
+      : scope.clients);
  const installedSkillIdentity =
    await host.installedSkillIdentity?.(skillClientIds);
  const skillAligned = skillIdentityAligned(installedSkillIdentity);
@@ -14,6 +14,7 @@ import type {
 export interface DoctorScopeReport {
  readonly mode: "audit-wide" | "explicit";
  readonly clients: readonly string[];
+  readonly skill_clients?: readonly string[];
  readonly providers: readonly string[];
  readonly skill: boolean;
  readonly target: string | null;
@@ -40,6 +41,9 @@ export const normalizeDoctorScope = (
 ): DoctorScopeReport => ({
  mode: requested === undefined ? "audit-wide" : "explicit",
  clients: uniqueSorted(requested?.clients ?? []),
+  ...(requested?.skillClients === undefined
+    ? {}
+    : { skill_clients: uniqueSorted(requested.skillClients) }),
  providers: uniqueSorted(requested?.providers ?? []),
  skill: requested?.skill === true,
  target: target ?? null,
@@ -18,6 +18,7 @@ import {
  semanticObligationPolicy,
  type ReconstructionObligationCandidatePolicy,
 } from "./ReconstructionObligationPolicies.js";
+import { compareUnicodeCodePoints } from "../domain/unicodeCodePointOrder.js";

 type CandidateFields = Omit<
  ReconstructionObligation,
@@ -54,7 +55,7 @@ export const deriveReconstructionObligationCandidates = (
    addCandidate(candidates, reviewedCandidate(obligation, records));
  return {
    candidates: [...candidates.values()].sort((left, right) =>
-      left.obligation_id.localeCompare(right.obligation_id),
+      compareUnicodeCodePoints(left.obligation_id, right.obligation_id),
    ),
    limitations: [...limitations].sort(),
  };
@@ -430,7 +431,7 @@ const uniqueBy = <Value>(
  key: (value: Value) => string,
 ): Value[] =>
  [...new Map(values.map((value) => [key(value), value])).values()].sort(
-    (left, right) => key(left).localeCompare(key(right)),
+    (left, right) => compareUnicodeCodePoints(key(left), key(right)),
  );

 const obligationId = (key: string): string =>
@@ -3,6 +3,7 @@ import type {
  ReconstructionObligationManifest,
 } from "../domain/reconstructionObligationLedgerSchemas.js";
 import type { Evidence } from "../domain/evidence.js";
+import { compareUnicodeCodePoints } from "../domain/unicodeCodePointOrder.js";

 type Diagnostic = ReconstructionObligation["diagnostics"][number];
 type Binding = NonNullable<ReconstructionObligation["binding"]>;
@@ -50,7 +51,8 @@ export const uniqueObligationDiagnostics = (
      ]),
    ).values(),
  ].sort((left, right) =>
-    `${left.code}:${left.detail}`.localeCompare(
+    compareUnicodeCodePoints(
+      `${left.code}:${left.detail}`,
      `${right.code}:${right.detail}`,
    ),
  );
@@ -36,6 +36,7 @@ import {
  obligationReports,
  summarizeObligations,
 } from "./ReconstructionObligationLedgerProjection.js";
+import { compareUnicodeCodePoints } from "../domain/unicodeCodePointOrder.js";

 type Diagnostic = ReconstructionObligation["diagnostics"][number];
 type Binding = NonNullable<ReconstructionObligation["binding"]>;
@@ -60,7 +61,7 @@ export const evaluateReconstructionObligationLedger = ({
 }): ReconstructionObligationLedger => {
  const bundle = parseEvidenceBundle(bundleInput);
  const allCandidates = [...candidatesInput].sort((left, right) =>
-    left.obligation_id.localeCompare(right.obligation_id),
+    compareUnicodeCodePoints(left.obligation_id, right.obligation_id),
  );
  const orphanManifestIds = findOrphanManifestIds(allCandidates, manifest);
  const candidates = allCandidates;
@@ -2,6 +2,7 @@ import type { Evidence } from "../domain/evidence.js";
 import type { ReconstructionObligation } from "../domain/reconstructionObligationLedgerSchemas.js";
 import { evidenceSupportsOriginalAuthority } from "./ReconstructionObligationAuthority.js";
 import type { ReconstructionObligationCandidate } from "./ReconstructionObligationCandidates.js";
+import { compareUnicodeCodePoints } from "../domain/unicodeCodePointOrder.js";

 type Binding = NonNullable<ReconstructionObligation["binding"]>;
 type Diagnostic = ReconstructionObligation["diagnostics"][number];
@@ -21,7 +22,8 @@ export const originalCasesFor = (
      ),
    ).values(),
  ].sort((left, right) =>
-    `${left.kind}:${left.evidence_id}:${left.location}`.localeCompare(
+    compareUnicodeCodePoints(
+      `${left.kind}:${left.evidence_id}:${left.location}`,
      `${right.kind}:${right.evidence_id}:${right.location}`,
    ),
  );
@@ -18,6 +18,7 @@ import type {
  ReferenceSourceRead,
 } from "../reference/ReferenceSourceReaderTypes.js";
 import { PARSEABLE_REFERENCE_SOURCE_LANGUAGES } from "./ReferenceSourceImportTypes.js";
+import { typescriptEmittedSourceCandidates } from "./TypeScriptEmittedSourceCandidates.js";

 export interface ParsedReferenceSourceEntries {
  readonly entries: HistoricalSourceGraphInput["entries"];
@@ -99,22 +100,9 @@ const resolveInternalSpecifier = (
    `${normalized}${suffix}`,
    `${normalized}/index${suffix}`,
  ]);
-  // TypeScript source commonly names the extension emitted for NodeNext.
  // Retain present runtime files first; substitute only a missing counterpart.
  // Counterparts cover explicit filenames, not directory/index resolution.
-  if (/\.(?:ts|tsx|mts|cts)$/u.test(fromPath)) {
-    const sourceSuffixes = normalized.endsWith(".js")
-      ? [".ts", ".tsx", ".d.ts"]
-      : normalized.endsWith(".mjs")
-        ? [".mts", ".d.mts"]
-        : normalized.endsWith(".cjs")
-          ? [".cts", ".d.cts"]
-          : normalized.endsWith(".jsx")
-            ? [".tsx", ".d.ts"]
-            : [];
-    const stem = normalized.slice(0, -posix.extname(normalized).length);
-    candidates.push(...sourceSuffixes.map((suffix) => `${stem}${suffix}`));
-  }
+  candidates.push(...typescriptEmittedSourceCandidates(fromPath, normalized));
  const match = lookupPath.resolveCandidates(candidates);
  return match === undefined
    ? { to: normalized, resolution: "unresolved" }
@@ -159,6 +159,7 @@ export class FakeSetupHost implements SetupHost {
      scope === undefined
        ? environmentHealthy
        : (scope.clients?.length ?? 0) === 0 &&
+            (scope.skillClients?.length ?? 0) === 0 &&
            (scope.providers?.length ?? 0) === 0 &&
            scope.skill !== true
          ? true
@@ -169,6 +170,9 @@ export class FakeSetupHost implements SetupHost {
      scope: {
        mode: scope === undefined ? "audit-wide" : "explicit",
        clients: scope?.clients ?? [],
+        ...(scope?.skillClients === undefined
+          ? {}
+          : { skill_clients: scope.skillClients }),
        providers: scope?.providers ?? [],
        skill: scope?.skill === true,
        target: null,
@@ -232,6 +232,7 @@ describe("setup scoped readiness", () => {
      clients: ["codex"],
      providers: [],
      skill: true,
+      skillClients: ["codex"],
    });
  });

@@ -125,7 +125,10 @@ const runSetupWorkflow = async (
    : (options.clientIds ??
      options.readinessScope?.clients ??
      discovery.defaultClientIds);
-  let selectedSkillClientIds = options.skillClientIds ?? selectedClientIds;
+  let selectedSkillClientIds =
+    options.skillClientIds ??
+    options.readinessScope?.skillClients ??
+    selectedClientIds;
  let skillNeedsInstall = await host.skillNeedsInstall(selectedSkillClientIds);
  let skillSelected =
    options.installSkill === true ||
@@ -220,6 +223,7 @@ const runSetupWorkflow = async (
    installHopper: planDiscovery.installHopper,
    installSkill,
    skillSelected,
+    selectedSkillClientIds,
    selectedClients: planned.selectedClients,
    clientsToConfigure: planned.clientsToConfigure,
  };
@@ -519,6 +523,7 @@ const resolvedReadinessScope = (
    readonly selectedClients: readonly SetupClient[];
    readonly installHopper: boolean;
    readonly skillSelected?: boolean;
+    readonly selectedSkillClientIds: readonly string[];
  },
 ): DoctorScope => ({
  clients: selection.selectedClients.map(({ name }) => name),
@@ -526,6 +531,9 @@ const resolvedReadinessScope = (
    ? ["hopper"]
    : (requested?.providers ?? []),
  skill: selection.skillSelected === true || requested?.skill === true,
+  ...(selection.skillSelected === true || requested?.skill === true
+    ? { skillClients: selection.selectedSkillClientIds }
+    : {}),
 });

 const summarizeDoctor = (report: DoctorReport): SetupDoctorSummary => ({
@@ -15,6 +15,7 @@ import type {
 } from "./SetupTypes.js";
 import type { SetupClient } from "./SupportedClients.js";
 import type { DoctorReport } from "./Doctor.js";
+import { compareUnicodeCodePoints } from "../domain/unicodeCodePointOrder.js";

 /** Read-only setup facts shared by client selection and preflight. */
 export interface SetupDiscovery {
@@ -308,7 +309,7 @@ const clientConfigurationDetail = (
  installHopper: boolean,
 ): string => {
  const entries = Object.entries(environment)
-    .sort(([left], [right]) => left.localeCompare(right))
+    .sort(([left], [right]) => compareUnicodeCodePoints(left, right))
    .map(([name, value]) => `${name}=${value}`);
  const environmentDetail =
    entries.length === 0
@@ -1,4 +1,5 @@
 import type { DoctorProviderInspection } from "./Doctor.js";
+import { compareUnicodeCodePoints } from "../domain/unicodeCodePointOrder.js";

 /** Preserve adapter-published settings independently of runtime readiness. */
 export const providerRegistrationEnvironment = (
@@ -9,5 +10,5 @@ export const providerRegistrationEnvironment = (
      .flatMap(({ registrationEnvironment }) =>
        Object.entries(registrationEnvironment),
      )
-      .sort(([left], [right]) => left.localeCompare(right)),
+      .sort(([left], [right]) => compareUnicodeCodePoints(left, right)),
  );
@@ -6,6 +6,7 @@ import {
  HermesClientPathError,
  resolveHermesClientHome,
 } from "./HermesClientHome.js";
+import { compareUnicodeCodePoints } from "../domain/unicodeCodePointOrder.js";

 /** One supported client configuration location. */
 export interface SetupClient {
@@ -642,6 +643,6 @@ export const clientSkillDirectories = (
      });
  }
  return [...destinations.values()].sort((left, right) =>
-    left.directory.localeCompare(right.directory),
+    compareUnicodeCodePoints(left.directory, right.directory),
  );
 };
@@ -0,0 +1,29 @@
+/** Emitted NodeNext suffixes and the TypeScript source counterparts they name. */
+const EMITTED_SUFFIXES: ReadonlyArray<
+  readonly [suffix: string, sourceSuffixes: readonly string[]]
+> = [
+  [".js", [".ts", ".tsx", ".d.ts"]],
+  [".mjs", [".mts", ".d.mts"]],
+  [".cjs", [".cts", ".d.cts"]],
+  [".jsx", [".tsx", ".d.ts"]],
+];
+
+/**
+ * Return TypeScript source counterparts for an explicit emitted filename.
+ * Callers retain exact runtime-file precedence and must not use these for
+ * directory/index, URL, HTML, or package target resolution.
+ */
+export const typescriptEmittedSourceCandidates = (
+  sourcePath: string,
+  candidate: string,
+): readonly string[] => {
+  if (!/\.(?:ts|tsx|mts|cts)$/u.test(sourcePath)) return [];
+  const emitted = EMITTED_SUFFIXES.find(([suffix]) =>
+    candidate.endsWith(suffix),
+  );
+  if (emitted === undefined) return [];
+  // Strip the matched suffix by length. posix.extname would miss dotfile
+  // names such as ".js", whose whole basename is the emitted suffix itself.
+  const stem = candidate.slice(0, candidate.length - emitted[0].length);
+  return emitted[1].map((suffix) => `${stem}${suffix}`);
+};
@@ -0,0 +1,120 @@
+import type { EvidenceWriter } from "../investigation/InvestigationRecordPort.js";
+import { createEvidence, type Evidence } from "../../domain/evidence.js";
+import type { AnalysisError } from "../../domain/analysisErrorBase.js";
+import type { JsonValue } from "../../domain/jsonValue.js";
+import { ok, type Result } from "../../domain/result.js";
+
+/**
+ * Complete class-inventory pages dominate raw-call provenance for focused
+ * searches: one traversal embeds every examined class name regardless of the
+ * match count. The summary keeps the pagination audit inline (totals, page
+ * offsets and sizes, elided item counts) and links the retained record that
+ * still carries the complete inventory.
+ */
+const elideInventoryText = (text: string): string | undefined => {
+  let page: JsonValue;
+  try {
+    page = JSON.parse(text) as JsonValue;
+  } catch {
+    return undefined;
+  }
+  if (
+    typeof page !== "object" ||
+    page === null ||
+    Array.isArray(page) ||
+    !Array.isArray(page.items)
+  )
+    return undefined;
+  const { items, ...audited } = page;
+  return JSON.stringify({ ...audited, items_omitted: items.length });
+};
+
+/** Replace inventoried page bodies with their pagination audit. */
+const summarizeInventoryCall = (call: JsonValue): JsonValue => {
+  if (
+    typeof call !== "object" ||
+    call === null ||
+    Array.isArray(call) ||
+    call.operation !== "list_classes"
+  )
+    return call;
+  const response = call.response;
+  if (
+    typeof response !== "object" ||
+    response === null ||
+    Array.isArray(response) ||
+    !Array.isArray(response.content)
+  )
+    return call;
+  let elided = false;
+  const content = response.content.map((entry: JsonValue) => {
+    if (
+      typeof entry !== "object" ||
+      entry === null ||
+      Array.isArray(entry) ||
+      typeof entry.text !== "string"
+    )
+      return entry;
+    const summarized = elideInventoryText(entry.text);
+    if (summarized === undefined) return entry;
+    elided = true;
+    return { ...entry, text: summarized };
+  });
+  return elided
+    ? { ...call, inventory_elided: true, response: { ...response, content } }
+    : call;
+};
+
+/**
+ * Retain the complete search Evidence — full raw provider calls included —
+ * in the session record, then deliver a bounded summary Evidence inline.
+ * Callers without a retaining session keep the complete inline delivery, so
+ * complete CLI JSON output is unchanged. Coverage metadata stays truthful in
+ * both copies: the examined inventory is never rewritten to matched-only.
+ */
+export const summarizeRetainedAndroidSearch = (
+  evidence: Evidence,
+  recordEvidence: EvidenceWriter["recordEvidence"] | undefined,
+): Result<Evidence, AnalysisError> => {
+  if (recordEvidence === undefined) return ok(evidence);
+  const recorded = recordEvidence(evidence);
+  if (!recorded.ok) return recorded;
+  const subject = evidence.subject;
+  const raw = evidence.raw_result;
+  const summarized: JsonValue =
+    raw === null ||
+    typeof raw !== "object" ||
+    Array.isArray(raw) ||
+    !Array.isArray(raw.calls)
+      ? raw
+      : {
+          ...raw,
+          complete_evidence_id: evidence.evidence_id,
+          calls: raw.calls.map(summarizeInventoryCall),
+        };
+  return ok(
+    createEvidence(
+      subject === null
+        ? undefined
+        : {
+            path: subject.local_path,
+            sha256: subject.digest.sha256,
+            format: subject.format,
+            ...(subject.architecture === null
+              ? {}
+              : { architecture: subject.architecture }),
+          },
+      evidence.provider,
+      {
+        operation: evidence.operation,
+        parameters: evidence.parameters,
+        result: evidence.normalized_result,
+        rawResult: summarized,
+        confidence: evidence.confidence,
+        limitations: evidence.limitations,
+        locations: evidence.locations,
+        evidenceLinks: [evidence.evidence_id],
+      },
+    ),
+  );
+};
@@ -25,6 +25,7 @@ import {
  evaluateAnalysisProviderCandidate,
  type AnalysisProviderCandidateEvaluation,
 } from "./AnalysisProviderEvaluation.js";
+import { compareUnicodeCodePoints } from "../../domain/unicodeCodePointOrder.js";

 /** Deterministic discovery truth for one configured deep provider. */
 export interface AnalysisProviderCandidateStatus {
@@ -109,12 +110,14 @@ export class AnalysisProviderRegistry {
    }
    this.#providers = Object.freeze(
      [...providers].sort((left, right) =>
-        left.identity().id.localeCompare(right.identity().id),
+        compareUnicodeCodePoints(left.identity().id, right.identity().id),
      ),
    );
    this.#byId = byId;
    this.#declaredOperations = Object.freeze(
-      [...declaredOperations].sort((left, right) => left.localeCompare(right)),
+      [...declaredOperations].sort((left, right) =>
+        compareUnicodeCodePoints(left, right),
+      ),
    );
  }

@@ -98,6 +98,30 @@ export class BinarySession
    this.#providerRouter = providerRouter;
  }

+  /**
+   * Fast-path liveness gate (#1719): short-circuit only when the retained
+   * client is genuinely alive. The probe reads the child's operation health
+   * rather than the composite's unconditionally-ok `health`, so a dead child
+   * falls through and a real client is started; an aborted caller leaves the
+   * session untouched. Returns the fast-path result, or undefined to fall
+   * through to the slow path.
+   */
+  async #tryRetainedFastPath(
+    retained: SessionBinding,
+    target: BinaryTarget,
+    options: Pick<BinarySessionOpenOptions, "signal" | "snapshot">,
+  ): Promise<Result<BinaryTarget, AnalysisError> | undefined> {
+    const live = await this.#retainedClientLive(retained.client, options);
+    if (isAborted(options.signal))
+      return err(new AnalysisCancelledError("open_binary"));
+    if (!live) return undefined;
+    if (options.snapshot !== undefined) {
+      const imported = this.importAnalysisSnapshot(options.snapshot);
+      if (!imported.ok) return imported;
+    }
+    return ok(target);
+  }
+
  /** Identify the provider producing evidence for this session. */
  providerIdentity(operation?: AnalysisOperation): ProviderIdentity {
    const route = this.#currentRoute();
@@ -247,12 +271,14 @@ export class BinarySession
      if (!pendingClosed.ok) return pendingClosed;
      if (isAborted(options.signal))
        return err(new AnalysisCancelledError("open_binary"));
-      if (sameTarget && sameProfile) {
-        if (options.snapshot !== undefined) {
-          const imported = this.importAnalysisSnapshot(options.snapshot);
-          if (!imported.ok) return imported;
-        }
-        return ok(target);
+      const retained = sameTarget && sameProfile ? this.#active : undefined;
+      if (retained !== undefined) {
+        const fastPath = await this.#tryRetainedFastPath(
+          retained,
+          target,
+          options,
+        );
+        if (fastPath !== undefined) return fastPath;
      }
      const previous = this.#active;
      this.#active = undefined;
@@ -703,6 +729,36 @@ export class BinarySession
    );
  }

+  /**
+   * Probe whether a retained provider client is still live.
+   *
+   * On production routes the client is a CompositeProvider whose `health`
+   * answers unconditionally ok without touching a child, so `health` alone
+   * cannot see a dead child. `operationHealthSnapshot` reaches the
+   * instantiated children instead. Only the known-live states allow the
+   * fast path: `exited`/`unreachable` are dead, `unknown` is never
+   * evidence of health (it is what a recorded but uncharacterized failure
+   * reports), and `not_started` is a startup that never completed — in the
+   * Hopper timeout case the client holds retained resources that block the
+   * next `start()` until `close()` retries cleanup, so treating it as live
+   * would skip the retire path and hand the wedged client to subsequent
+   * analysis. The gate fails closed: without a snapshot signal, fall back
+   * to the `health` admission probe.
+   */
+  async #retainedClientLive(
+    client: AnalysisClient,
+    options: Pick<BinarySessionOpenOptions, "signal">,
+  ): Promise<boolean> {
+    const snapshot = client.operationHealthSnapshot?.();
+    if (snapshot !== undefined)
+      return snapshot.state === "idle" || snapshot.state === "busy";
+    try {
+      return (await client.execute("health", {}, options)).ok;
+    } catch {
+      return false;
+    }
+  }
+
  async #restore(
    previous: SessionBinding | undefined,
  ): Promise<Result<null, AnalysisError>> {
@@ -0,0 +1,338 @@
+import { describe, expect, it } from "vitest";
+
+import {
+  createAnalysisExecution,
+  type AnalysisClient,
+  type AnalysisOperation,
+  type AnalysisProvider,
+  type AnalysisProviderCandidate,
+  type CapabilityDescriptor,
+  type ProviderAvailability,
+  type ProviderIdentity,
+  type ProviderTargetSupport,
+} from "../AnalysisProvider.js";
+import { createAnalysisProfile } from "../../domain/analysisProfile.js";
+import { ProviderAdapterError } from "../../domain/providerAdapterError.js";
+import type { ProviderOperationHealth } from "../../domain/providerOperationHealth.js";
+import { err, ok } from "../../domain/result.js";
+import { InvestigationRecords } from "../investigation/InvestigationRecords.js";
+import { AnalysisProviderRegistry } from "./AnalysisProviderRegistry.js";
+import { BinarySession } from "./BinarySession.js";
+import { SessionProviderRouter } from "./SessionProviderRouter.js";
+
+/**
+ * Regression coverage for https://github.com/morluto/rea/issues/1719:
+ * `BinarySession#open` must not short-circuit on the `sameTarget &&
+ * sameProfile` fast path when the retained provider client is dead. It must
+ * start a fresh client instead.
+ *
+ * The fixtures are production-composed: a deep provider plus an auxiliary
+ * provider, so `SessionProviderRouter` wraps them in a real
+ * `CompositeProvider` exactly like `src/composition/binary.ts` does for the
+ * CLI/MCP runtime. The composite's `health` answers unconditionally ok
+ * without touching a child, so a probe that only calls `health` cannot see a
+ * dead child — the liveness signal must reach the actual child through
+ * `operationHealthSnapshot`, the way `HopperClient.operationHealth` reports a
+ * recorded process exit.
+ */
+describe("BinarySession open liveness", () => {
+  it("reuses the retained client while the child stays live", async () => {
+    const { session, deep } = openSession();
+    expect((await session.open(process.execPath)).ok).toBe(true);
+    // Instantiate the deep child inside the composite, like a real query would.
+    expect((await session.execute("address_name", {})).ok).toBe(true);
+    expect(deep.created).toHaveLength(1);
+
+    const second = await session.open(process.execPath);
+    expect(second.ok).toBe(true);
+    // Still the same composite and child: nothing was retired or recreated.
+    expect(deep.created).toHaveLength(1);
+    expect(deep.created[0]?.closeCalled).toBe(false);
+    expect((await session.execute("address_name", {})).ok).toBe(true);
+    expect(deep.created).toHaveLength(1);
+  });
+
+  it("starts a fresh client when the retained child died", async () => {
+    const { session, deep } = openSession();
+    expect((await session.open(process.execPath)).ok).toBe(true);
+    expect((await session.execute("address_name", {})).ok).toBe(true);
+    expect(deep.created).toHaveLength(1);
+
+    // Kill the provider process out from under the session, then re-open
+    // the same target: the session must not short-circuit on the dead
+    // child — it must retire it and start a real one.
+    const dead = deep.created[0];
+    dead?.kill();
+
+    const second = await session.open(process.execPath);
+    expect(second.ok).toBe(true);
+    // The dead binding was retired, not retained.
+    expect(dead?.closeCalled).toBe(true);
+    // The next query runs against a freshly created child, not the dead one.
+    expect((await session.execute("address_name", {})).ok).toBe(true);
+    expect(deep.created).toHaveLength(2);
+  });
+
+  it("treats an uncharacterized operation failure as dead", async () => {
+    // A recorded failure the provider could not characterize ("unknown",
+    // e.g. a Hopper spawn failure with no observed exit code) is never
+    // evidence of health: the gate fails closed.
+    const { session, deep } = openSession();
+    expect((await session.open(process.execPath)).ok).toBe(true);
+    expect((await session.execute("address_name", {})).ok).toBe(true);
+    expect(deep.created).toHaveLength(1);
+
+    const dead = deep.created[0];
+    dead?.kill("unknown");
+
+    const second = await session.open(process.execPath);
+    expect(second.ok).toBe(true);
+    expect(dead?.closeCalled).toBe(true);
+    expect((await session.execute("address_name", {})).ok).toBe(true);
+    expect(deep.created).toHaveLength(2);
+  });
+
+  it("retires a retained client whose startup never completed", async () => {
+    // A Hopper startup timeout leaves the operation-health snapshot in
+    // "not_started" while the retained resources block the next start()
+    // until close() retries cleanup. Classifying that state as live would return success
+    // without entering the retire path, so subsequent analysis still hits
+    // the wedged client.
+    const { session, deep } = openSession();
+    expect((await session.open(process.execPath)).ok).toBe(true);
+    expect((await session.execute("address_name", {})).ok).toBe(true);
+    expect(deep.created).toHaveLength(1);
+
+    const wedged = deep.created[0];
+    wedged?.kill("not_started");
+
+    const second = await session.open(process.execPath);
+    expect(second.ok).toBe(true);
+    // The wedged binding was retired (close ran, so cleanup is retried),
+    // not reused.
+    expect(wedged?.closeCalled).toBe(true);
+    // The next query runs against a freshly created child, not the wedged one.
+    expect((await session.execute("address_name", {})).ok).toBe(true);
+    expect(deep.created).toHaveLength(2);
+  });
+
+  it("falls back to the health probe when the child reports no operation health", async () => {
+    // Without an operation-health hook there is no child-liveness signal,
+    // so the probe keeps the previous `health` admission behavior.
+    const { session, deep } = openSession({ operationHealth: false });
+    expect((await session.open(process.execPath)).ok).toBe(true);
+    expect((await session.execute("address_name", {})).ok).toBe(true);
+    expect(deep.created).toHaveLength(1);
+
+    const second = await session.open(process.execPath);
+    expect(second.ok).toBe(true);
+    // The composite's `health` answers ok, so the live client is reused.
+    expect(deep.created).toHaveLength(1);
+    expect(deep.created[0]?.closeCalled).toBe(false);
+  });
+
+  it("reports cancellation without touching the session when aborted mid-probe", async () => {
+    const { session, deep, onProbe } = openSession();
+    expect((await session.open(process.execPath)).ok).toBe(true);
+    expect((await session.execute("address_name", {})).ok).toBe(true);
+
+    const controller = new AbortController();
+    // Fire the abort while the fast-path liveness probe is in flight: the
+    // hook runs synchronously inside the snapshot read, so the abort lands
+    // after the probe started but before the fast-path decision completes.
+    let fired = false;
+    onProbe(() => {
+      if (!fired) {
+        fired = true;
+        controller.abort();
+      }
+    });
+
+    const cancelled = await session.open(process.execPath, {
+      signal: controller.signal,
+    });
+    expect(cancelled).toMatchObject({
+      ok: false,
+      error: { _tag: "AnalysisCancelledError" },
+    });
+    // The dead-or-live question is moot: the session must be untouched.
+    expect(deep.created).toHaveLength(1);
+    expect(deep.created[0]?.closeCalled).toBe(false);
+    const reopened = await session.open(process.execPath);
+    expect(reopened.ok).toBe(true);
+    expect(deep.created).toHaveLength(1);
+  });
+});
+
+interface KillableChild extends AnalysisClient {
+  kill(state?: "exited" | "unreachable" | "unknown" | "not_started"): void;
+  closeCalled: boolean;
+}
+
+const deepIdentity: ProviderIdentity = {
+  id: "liveness-deep",
+  name: "Liveness deep provider",
+  version: "1",
+};
+
+const auxIdentity: ProviderIdentity = {
+  id: "liveness-aux",
+  name: "Liveness auxiliary provider",
+  version: "1",
+};
+
+const capability = (
+  identity: ProviderIdentity,
+  operation: Exclude<AnalysisOperation, "health">,
+): CapabilityDescriptor => ({
+  provider: identity,
+  operation,
+  available: true,
+  reason: null,
+  effects: {
+    mutatesArtifact: false,
+    launchesProcess: false,
+    mayShowUi: false,
+    mayAccessNetwork: false,
+    mayWriteFilesystem: false,
+    changesPermissions: false,
+    requiresRoot: false,
+  },
+  limitations: [],
+});
+
+const openSession = (
+  options: { operationHealth?: boolean } = {},
+): {
+  session: BinarySession;
+  deep: { created: KillableChild[] };
+  onProbe: (hook: () => void) => void;
+} => {
+  const { provider, created, onProbe } = killableDeepProvider(options);
+  // Mirror the production composition: a deep provider plus auxiliary
+  // providers, so the route wraps them in a real CompositeProvider (whose
+  // trivially-ok `health` must not mask a dead child).
+  const aux: AnalysisProvider = {
+    identity: () => auxIdentity,
+    capabilities: () => [],
+    createClient: (): AnalysisClient => ({
+      execute: (operation) =>
+        Promise.resolve(
+          ok(createAnalysisExecution(`aux:${operation}`, auxIdentity)),
+        ),
+      close: () => Promise.resolve(ok(null)),
+    }),
+  };
+  const session = new BinarySession(
+    SessionProviderRouter.selectable(new AnalysisProviderRegistry([provider]), [
+      aux,
+    ]),
+    new InvestigationRecords(),
+  );
+  return { session, deep: { created }, onProbe };
+};
+
+const killableDeepProvider = (options: {
+  operationHealth?: boolean;
+}): {
+  provider: AnalysisProviderCandidate;
+  created: KillableChild[];
+  onProbe: (hook: () => void) => void;
+} => {
+  const created: KillableChild[] = [];
+  let probeHook: (() => void) | undefined;
+  const withOperationHealth = options.operationHealth !== false;
+  const provider: AnalysisProviderCandidate = {
+    identity: () => deepIdentity,
+    capabilities: () => [capability(deepIdentity, "address_name")],
+    inspectAvailability: (): ProviderAvailability => ({
+      status: "available",
+      code: null,
+      reason: null,
+      diagnostics: {},
+    }),
+    inspectTargetSupport: (): ProviderTargetSupport => ({
+      status: "supported",
+      code: null,
+      reason: null,
+      diagnostics: {},
+    }),
+    resolveAnalysisProfile: () =>
+      Promise.resolve(
+        ok({
+          profile: createAnalysisProfile(
+            { id: deepIdentity.id, name: deepIdentity.name, version: "1" },
+            { fixture: "liveness" },
+          ),
+        }),
+      ),
+    createClient: (): KillableChild => {
+      let alive = true;
+      let closeCalled = false;
+      let deadState: "exited" | "unreachable" | "unknown" | "not_started" =
+        "exited";
+      const client: KillableChild = {
+        execute: (operation) => {
+          return alive
+            ? Promise.resolve(
+                ok(
+                  createAnalysisExecution(
+                    operation === "health" ? null : `liveness:${operation}`,
+                    deepIdentity,
+                  ),
+                ),
+              )
+            : Promise.resolve(
+                err(
+                  new ProviderAdapterError(deepIdentity.id, operation, {
+                    diagnostics: { reason: "process_killed" },
+                  }),
+                ),
+              );
+        },
+        // Genuine child-liveness signal, like HopperClient.operationHealth:
+        // a recorded process exit stays visible after the kill.
+        ...(withOperationHealth
+          ? {
+              operationHealthSnapshot: (): ProviderOperationHealth => {
+                probeHook?.();
+                return {
+                  state: alive ? "idle" : deadState,
+                  stage: alive ? null : "connection",
+                  retryAction: alive ? null : "restart_provider",
+                  exitCode: alive ? null : 1,
+                  requests: [],
+                };
+              },
+            }
+          : {}),
+        close: () => {
+          closeCalled = true;
+          return Promise.resolve(ok(null));
+        },
+        get closeCalled() {
+          return closeCalled;
+        },
+        kill: (
+          state:
+            | "exited"
+            | "unreachable"
+            | "unknown"
+            | "not_started" = "exited",
+        ) => {
+          alive = false;
+          deadState = state;
+        },
+      };
+      created.push(client);
+      return client;
+    },
+  };
+  return {
+    provider,
+    created,
+    onProbe: (hook: () => void) => {
+      probeHook = hook;
+    },
+  };
+};
@@ -1,4 +1,5 @@
 import type { ExecutableFormatHint } from "../../domain/dosCom.js";
+import type { BinaryArchitecture } from "../../domain/binaryTargetTypes.js";
 import type { AnalysisProviderSelector } from "../../contracts/providerSelection.js";
 import type { AnalysisProfileCommitment } from "../../domain/analysisProfile.js";
 import {
@@ -22,6 +23,8 @@ export interface BinarySessionOpenOptions {
  readonly signal?: AbortSignal;
  readonly targetKind?: BinaryTarget["kind"];
  readonly formatHint?: ExecutableFormatHint;
+  readonly architecture?: BinaryArchitecture;
+  readonly entryPoint?: string;
  readonly snapshot?: AnalysisSnapshot;
  readonly providerId?: AnalysisProviderSelector;
 }
@@ -72,6 +75,12 @@ export const resolveSessionOpen = async (
    ...(options.formatHint === undefined
      ? {}
      : { formatHint: options.formatHint }),
+    ...(options.architecture === undefined
+      ? {}
+      : { architecture: options.architecture }),
+    ...(options.entryPoint === undefined
+      ? {}
+      : { entryPoint: options.entryPoint }),
    ...(options.signal === undefined ? {} : { signal: options.signal }),
  });
  if (!parsed.ok) return parsed;
@@ -1,6 +1,9 @@
 import type { InvestigationRecordPort } from "../investigation/InvestigationRecordPort.js";
 import type { ExecutableFormatHint } from "../../domain/dosCom.js";
-import type { BinaryTarget } from "../../domain/binaryTargetTypes.js";
+import type {
+  BinaryArchitecture,
+  BinaryTarget,
+} from "../../domain/binaryTargetTypes.js";
 import type { JsonValue } from "../../domain/jsonValue.js";
 import type { AnalysisSnapshot } from "../../domain/analysisSnapshot.js";
 import type { AnalysisProfileCommitment } from "../../domain/analysisProfile.js";
@@ -44,6 +47,8 @@ export interface BinarySessionPort
      readonly signal?: AbortSignal;
      readonly targetKind?: BinaryTarget["kind"];
      readonly formatHint?: ExecutableFormatHint;
+      readonly architecture?: BinaryArchitecture;
+      readonly entryPoint?: string;
      readonly snapshot?: AnalysisSnapshot;
      readonly providerId?: AnalysisProviderSelector;
    },
@@ -1,4 +1,5 @@
 import type { BinaryTarget } from "../../domain/binaryTargetTypes.js";
+import { binaryTargetSummary } from "./BinaryTargetSummary.js";
 import type { JsonValue } from "../../domain/jsonValue.js";
 import type { ProviderOperationHealth } from "../../domain/providerOperationHealth.js";
 import type {
@@ -10,6 +11,7 @@ import type {
  SessionProviderRoute,
  SessionProviderRouter,
 } from "./SessionProviderRouter.js";
+import { compareUnicodeCodePoints } from "../../domain/unicodeCodePointOrder.js";

 interface BinarySessionStatusInput {
  readonly target: BinaryTarget | undefined;
@@ -38,7 +40,9 @@ export const binarySessionStatus = ({
 }: BinarySessionStatusInput): JsonValue => {
  const capabilities = [...route.capabilities.values()]
    .filter(({ operation }) => operation !== "inventory_artifact")
-    .sort((left, right) => left.operation.localeCompare(right.operation))
+    .sort((left, right) =>
+      compareUnicodeCodePoints(left.operation, right.operation),
+    )
    .map((descriptor) => {
      const unavailable = runtimeUnavailability.get(descriptor.operation);
      return unavailable === undefined
@@ -68,7 +72,9 @@ export const binarySessionStatus = ({
      capabilities: candidate.capabilities
        .slice()
        .filter(({ operation }) => operation !== "inventory_artifact")
-        .sort((left, right) => left.operation.localeCompare(right.operation))
+        .sort((left, right) =>
+          compareUnicodeCodePoints(left.operation, right.operation),
+        )
        .map(capabilityStatus),
    }));
  const common = {
@@ -92,11 +98,7 @@ export const binarySessionStatus = ({
    : {
        open: true,
        ...common,
-        path: target.path,
-        sha256: target.sha256,
-        format: target.format,
-        kind: target.kind,
-        architecture: target.architecture ?? null,
+        ...binaryTargetSummary(target),
      };
 };

@@ -105,7 +107,9 @@ const requestActivityStatus = (
 ) => {
  const providers = snapshots
    .slice()
-    .sort((left, right) => left.provider.id.localeCompare(right.provider.id))
+    .sort((left, right) =>
+      compareUnicodeCodePoints(left.provider.id, right.provider.id),
+    )
    .map(({ provider, active, queuedRequests }) => ({
      provider: providerSummary(provider),
      active:
@@ -153,7 +157,7 @@ const processLineageStatus = (
        snapshots: snapshots
          .slice()
          .sort((left, right) =>
-            left.provider.id.localeCompare(right.provider.id),
+            compareUnicodeCodePoints(left.provider.id, right.provider.id),
          )
          .map(({ provider, observation }) => ({
            provider: providerSummary(provider),
@@ -0,0 +1,11 @@
+import type { BinaryTarget } from "../../domain/binaryTargetTypes.js";
+
+/** Preserve the admitted target interpretation in public lifecycle results. */
+export const binaryTargetSummary = (target: BinaryTarget) => ({
+  path: target.path,
+  format: target.format,
+  kind: target.kind,
+  sha256: target.sha256,
+  architecture: target.architecture ?? null,
+  ...(target.format === "raw-binary" ? { entry_point: target.entryPoint } : {}),
+});
@@ -10,6 +10,7 @@ import type {
  ProviderIdentity,
 } from "../AnalysisProvider.js";
 import { closeAnalysisClient } from "./AnalysisClientCleanup.js";
+import { compareUnicodeCodePoints } from "../../domain/unicodeCodePointOrder.js";

 /** Synthetic identity for a deterministic provider set. */
 const compositeProviderIdentity = (
@@ -53,8 +54,8 @@ export class CompositeProvider implements AnalysisProvider {
    this.#capabilities = Object.freeze(
      capabilities.sort(
        (left, right) =>
-          left.operation.localeCompare(right.operation) ||
-          left.provider.id.localeCompare(right.provider.id),
+          compareUnicodeCodePoints(left.operation, right.operation) ||
+          compareUnicodeCodePoints(left.provider.id, right.provider.id),
      ),
    );
  }
@@ -122,13 +123,13 @@ export class CompositeProvider implements AnalysisProvider {
        [...clients.values()]
          .flatMap((client) => client.runtimeLineageSnapshots?.() ?? [])
          .sort((left, right) =>
-            left.provider.id.localeCompare(right.provider.id),
+            compareUnicodeCodePoints(left.provider.id, right.provider.id),
          ),
      requestActivitySnapshots: () =>
        [...clients.values()]
          .flatMap((client) => client.requestActivitySnapshots?.() ?? [])
          .sort((left, right) =>
-            left.provider.id.localeCompare(right.provider.id),
+            compareUnicodeCodePoints(left.provider.id, right.provider.id),
          ),
      operationHealthSnapshot: () => {
        for (const client of clients.values()) {
@@ -24,6 +24,7 @@ import {
  type UpdateUnknownInput,
 } from "../../domain/residualUnknown.js";
 import { err, ok, type Result } from "../../domain/result.js";
+import { compareUnicodeCodePoints } from "../../domain/unicodeCodePointOrder.js";

 type EvidenceLedgerFailure = EvidenceIntegrityError;
 type RecordResult = Result<"added" | "duplicate", EvidenceLedgerFailure>;
@@ -321,7 +322,9 @@ export class EvidenceLedger {
            unknown.severity === filters.severity) &&
          (filters.domain === undefined || unknown.domain === filters.domain),
      )
-      .sort((left, right) => left.unknown_id.localeCompare(right.unknown_id))
+      .sort((left, right) =>
+        compareUnicodeCodePoints(left.unknown_id, right.unknown_id),
+      )
      .map((unknown) => structuredClone(unknown));
  }

@@ -4,6 +4,7 @@ import { ArtifactReaderFailure } from "../../artifacts/ArtifactReader.js";
 import type { ArtifactResourceScope } from "../../artifacts/ArtifactResourceScope.js";
 import {
  analyzeJavaScriptApplicationInputSchema,
+  type JavaScriptApplicationAnalysisResult,
  parseOwnedJavaScriptApplicationAnalysisSteps,
 } from "../../domain/javascript/javascriptApplicationAnalysis.js";
 import { AnalysisOutputError } from "../../domain/analysisErrorCore.js";
@@ -20,7 +21,10 @@ import {
  checkpointJavaScriptAnalysis,
  completeJavaScriptAnalysisSteps,
 } from "./JavaScriptAnalysisControl.js";
-import { reconstructJavaScriptArtifact } from "./JavaScriptArtifactReconstruction.js";
+import {
+  reconstructJavaScriptArtifact,
+  type JavaScriptArtifactReconstructionResult,
+} from "./JavaScriptArtifactReconstruction.js";
 import { JAVASCRIPT_APPLICATION_PROVIDER } from "../InvestigationProviders.js";

 const OPERATION = "analyze_javascript_application" as const;
@@ -45,6 +49,9 @@ export const analyzeJavaScriptApplicationValidated = async (
  scope: ArtifactResourceScope,
  options: ExecutionOptions = {},
 ): Promise<Result<Evidence, AnalysisError>> => {
+  let reconstructed: JavaScriptArtifactReconstructionResult | undefined;
+  let result: JavaScriptApplicationAnalysisResult | undefined;
+  let evidence: Evidence | undefined;
  try {
    assertJavaScriptAnalysisActive(options.signal);
    await options.progress?.report({
@@ -54,7 +61,7 @@ export const analyzeJavaScriptApplicationValidated = async (
      message: "Inventorying and parsing application artifacts",
    });
    await checkpointJavaScriptAnalysis(options.signal);
-    const reconstructed = await reconstructJavaScriptArtifact(
+    reconstructed = await reconstructJavaScriptArtifact(
      {
        input_path: input.input_path,
        format: input.format,
@@ -78,7 +85,7 @@ export const analyzeJavaScriptApplicationValidated = async (
      message: "Validating result metadata and cross-graph bindings",
    });
    await checkpointJavaScriptAnalysis(options.signal);
-    const result = await completeJavaScriptAnalysisSteps(
+    result = await completeJavaScriptAnalysisSteps(
      parseOwnedJavaScriptApplicationAnalysisSteps({
        ...application,
        summary,
@@ -93,13 +100,12 @@ export const analyzeJavaScriptApplicationValidated = async (
      message: "Creating and hashing application analysis Evidence",
    });
    await checkpointJavaScriptAnalysis(options.signal);
-    const evidence =
-      await createOwnedJavaScriptApplicationEvidenceCooperatively(
-        input,
-        result,
-        options.signal,
-        options.progress,
-      );
+    evidence = await createOwnedJavaScriptApplicationEvidenceCooperatively(
+      input,
+      result,
+      options.signal,
+      options.progress,
+    );
    await checkpointJavaScriptAnalysis(options.signal);
    await options.progress?.report({
      phase: "analyze_javascript_application",
@@ -111,6 +117,38 @@ export const analyzeJavaScriptApplicationValidated = async (
    assertJavaScriptAnalysisActive(options.signal);
    return ok(evidence);
  } catch (cause: unknown) {
+    if (
+      cause instanceof ArtifactReaderFailure &&
+      cause.reason === "cancelled" &&
+      reconstructed !== undefined
+    ) {
+      try {
+        if (result === undefined) {
+          const { electron_summary: summary, ...application } = reconstructed;
+          result = await completeJavaScriptAnalysisSteps(
+            parseOwnedJavaScriptApplicationAnalysisSteps({
+              ...application,
+              summary,
+              limitations: reconstructed.graph.limitations,
+            }),
+          );
+        }
+        evidence ??=
+          await createOwnedJavaScriptApplicationEvidenceCooperatively(
+            input,
+            result,
+          );
+        return err(
+          artifactFailureToOperationError(cause).retainPartialObservation(
+            evidence,
+          ),
+        );
+      } catch (completionCause: unknown) {
+        // A validation or Evidence failure while finishing the partial result
+        // remains the primary failure instead of being hidden by cancellation.
+        cause = completionCause;
+      }
+    }
    // Preserve execution constraints and their completed partial Evidence.
    if (cause instanceof AnalysisError) return err(cause);
    if (cause instanceof ArtifactReaderFailure)
@@ -868,6 +868,365 @@ describe("package exports exact targets", () => {
  });
 });

+describe("package import alias resolution", () => {
+  it.each(["import", "require"] as const)(
+    "resolves an exact #%s alias from the enclosing package imports map",
+    (moduleKind) => {
+      const files = aliasFiles({
+        "package.json": JSON.stringify({
+          imports: { "#config": "./config.cjs" },
+        }),
+        "main.js": "",
+        "config.cjs": "",
+      });
+      expect(
+        resolve({
+          declaredPath: "#config",
+          sourcePath: "main.js",
+          context: "module-specifier",
+          moduleKind,
+          files,
+        }),
+      ).toMatchObject({
+        resolution_status: "resolved",
+        resolved_path: "config.cjs",
+        declared_path: "#config",
+      });
+    },
+  );
+
+  it("resolves an alias from a nested file through the enclosing package root", () => {
+    const files = aliasFiles({
+      "package.json": JSON.stringify({
+        imports: { "#config": "./config.cjs" },
+      }),
+      "src/main.js": "",
+      "config.cjs": "",
+    });
+    expect(
+      resolve({
+        declaredPath: "#config",
+        sourcePath: "src/main.js",
+        context: "module-specifier",
+        moduleKind: "require",
+        files,
+      }),
+    ).toMatchObject({
+      resolution_status: "resolved",
+      resolved_path: "config.cjs",
+    });
+  });
+
+  it("uses a nested package imports map rather than the application root", () => {
+    const files = aliasFiles({
+      "package.json": JSON.stringify({
+        imports: { "#config": "./root.cjs" },
+      }),
+      "root.cjs": "",
+      "node_modules/fixture/package.json": JSON.stringify({
+        imports: { "#config": "./local.cjs" },
+      }),
+      "node_modules/fixture/index.js": "",
+      "node_modules/fixture/local.cjs": "",
+    });
+    expect(
+      resolve({
+        declaredPath: "#config",
+        sourcePath: "node_modules/fixture/index.js",
+        context: "module-specifier",
+        moduleKind: "require",
+        files,
+      }),
+    ).toMatchObject({
+      resolution_status: "resolved",
+      resolved_path: "node_modules/fixture/local.cjs",
+    });
+  });
+
+  it("does not inherit an ancestor imports map across a nested package.json", () => {
+    const files = aliasFiles({
+      "package.json": JSON.stringify({
+        imports: { "#config": "./root.cjs" },
+      }),
+      "root.cjs": "",
+      "node_modules/fixture/package.json": "{}",
+      "node_modules/fixture/index.js": "",
+    });
+    const outcome = resolve({
+      declaredPath: "#config",
+      sourcePath: "node_modules/fixture/index.js",
+      context: "module-specifier",
+      moduleKind: "require",
+      files,
+    });
+    expect(outcome).toMatchObject({
+      resolution_status: "external",
+      resolved_path: null,
+    });
+    expect(outcome.limitations.join(" ")).toContain(
+      "node_modules/fixture/package.json",
+    );
+    expect(outcome.limitations.join(" ")).not.toContain("root.cjs");
+  });
+
+  it("does not apply a nested package map to the application root importer", () => {
+    const files = aliasFiles({
+      "package.json": JSON.stringify({
+        imports: { "#config": "./root.cjs" },
+      }),
+      "main.js": "",
+      "root.cjs": "",
+      "node_modules/fixture/package.json": JSON.stringify({
+        imports: { "#config": "./local.cjs" },
+      }),
+      "node_modules/fixture/local.cjs": "",
+    });
+    expect(
+      resolve({
+        declaredPath: "#config",
+        sourcePath: "main.js",
+        context: "module-specifier",
+        moduleKind: "require",
+        files,
+      }),
+    ).toMatchObject({
+      resolution_status: "resolved",
+      resolved_path: "root.cjs",
+    });
+  });
+});
+
+describe("package import alias target selection", () => {
+  it("selects import and require conditions from an imports target", () => {
+    const files = aliasFiles({
+      "package.json": JSON.stringify({
+        imports: {
+          "#config": {
+            import: "./config.mjs",
+            require: "./config.cjs",
+            default: "./fallback.js",
+          },
+        },
+      }),
+      "main.js": "",
+      "config.mjs": "",
+      "config.cjs": "",
+      "fallback.js": "",
+    });
+    expect(
+      resolve({
+        declaredPath: "#config",
+        sourcePath: "main.js",
+        context: "module-specifier",
+        moduleKind: "import",
+        files,
+      }).resolved_path,
+    ).toBe("config.mjs");
+    expect(
+      resolve({
+        declaredPath: "#config",
+        sourcePath: "main.js",
+        context: "module-specifier",
+        moduleKind: "require",
+        files,
+      }).resolved_path,
+    ).toBe("config.cjs");
+  });
+
+  it("resolves array import targets at their first string entry", () => {
+    const files = aliasFiles({
+      "package.json": JSON.stringify({
+        imports: { "#config": [{ import: "./missing.mjs" }, "./config.cjs"] },
+      }),
+      "main.js": "",
+      "config.cjs": "",
+    });
+    expect(
+      resolve({
+        declaredPath: "#config",
+        sourcePath: "main.js",
+        context: "module-specifier",
+        moduleKind: "require",
+        files,
+      }),
+    ).toMatchObject({
+      resolution_status: "resolved",
+      resolved_path: "config.cjs",
+    });
+  });
+
+  it("does not add an extension or index to a selected import target", () => {
+    const files = aliasFiles({
+      "package.json": JSON.stringify({
+        imports: { "#config": "./config" },
+      }),
+      "main.js": "",
+      "config.cjs": "",
+      "config/index.js": "",
+    });
+    const outcome = resolve({
+      declaredPath: "#config",
+      sourcePath: "main.js",
+      context: "module-specifier",
+      moduleKind: "require",
+      files,
+    });
+    expect(outcome).toMatchObject({
+      resolution_status: "not-found",
+      resolved_path: null,
+    });
+    expect(outcome.limitations.join(" ")).toContain(
+      "import targets are exact files",
+    );
+  });
+});
+
+describe("package import alias refusals", () => {
+  it("reports a missing exact alias without looking in another package", () => {
+    const files = aliasFiles({
+      "package.json": JSON.stringify({
+        imports: { "#config": "./config.cjs" },
+      }),
+      "main.js": "",
+      "config.cjs": "",
+    });
+    const outcome = resolve({
+      declaredPath: "#other",
+      sourcePath: "main.js",
+      context: "module-specifier",
+      moduleKind: "require",
+      files,
+    });
+    expect(outcome).toMatchObject({
+      resolution_status: "external",
+      resolved_path: null,
+    });
+    expect(outcome.limitations.join(" ")).toContain("#other");
+    expect(outcome.limitations.join(" ")).toContain("#config");
+  });
+
+  it("reports an explicit null import target as blocked", () => {
+    const files = aliasFiles({
+      "package.json": JSON.stringify({
+        imports: { "#config": null },
+      }),
+      "main.js": "",
+      "config.cjs": "",
+    });
+    const outcome = resolve({
+      declaredPath: "#config",
+      sourcePath: "main.js",
+      context: "module-specifier",
+      moduleKind: "require",
+      files,
+    });
+    expect(outcome).toMatchObject({
+      resolution_status: "external",
+      resolved_path: null,
+    });
+    expect(outcome.limitations.join(" ")).toContain("explicit null");
+  });
+
+  it("leaves wildcard import aliases unresolved", () => {
+    const files = aliasFiles({
+      "package.json": JSON.stringify({
+        imports: { "#internal/*": "./src/*.js" },
+      }),
+      "main.js": "",
+      "src/util.js": "",
+    });
+    const outcome = resolve({
+      declaredPath: "#internal/util",
+      sourcePath: "main.js",
+      context: "module-specifier",
+      moduleKind: "import",
+      files,
+    });
+    expect(outcome).toMatchObject({
+      resolution_status: "external",
+      resolved_path: null,
+    });
+    expect(outcome.limitations.join(" ")).toMatch(/wildcard/i);
+  });
+
+  it("leaves recursive and external-package import targets unresolved", () => {
+    const files = aliasFiles({
+      "package.json": JSON.stringify({
+        imports: { "#loop": "#config", "#dep": "fixture" },
+      }),
+      "main.js": "",
+      "node_modules/fixture/index.js": "",
+    });
+    const recursive = resolve({
+      declaredPath: "#loop",
+      sourcePath: "main.js",
+      context: "module-specifier",
+      moduleKind: "require",
+      files,
+    });
+    const external = resolve({
+      declaredPath: "#dep",
+      sourcePath: "main.js",
+      context: "module-specifier",
+      moduleKind: "require",
+      files,
+    });
+    expect(recursive).toMatchObject({
+      resolution_status: "external",
+      resolved_path: null,
+    });
+    expect(recursive.limitations.join(" ")).toMatch(/recursive/i);
+    expect(external).toMatchObject({
+      resolution_status: "external",
+      resolved_path: null,
+    });
+    expect(external.limitations.join(" ")).toMatch(/external-package/i);
+  });
+
+  it("rejects reserved hash specifiers", () => {
+    const files = aliasFiles({
+      "package.json": JSON.stringify({
+        imports: { "#config": "./config.cjs" },
+      }),
+      "main.js": "",
+      "config.cjs": "",
+    });
+    expect(
+      resolve({
+        declaredPath: "#",
+        sourcePath: "main.js",
+        context: "module-specifier",
+        moduleKind: "import",
+        files,
+      }),
+    ).toMatchObject({ resolution_status: "rejected", resolved_path: null });
+  });
+
+  it("does not use a foreign-container enclosing package.json", () => {
+    const files = fileMap([
+      file(
+        "package.json",
+        "other",
+        JSON.stringify({ imports: { "#config": "./config.cjs" } }),
+      ),
+      file("main.js", "root"),
+      file("config.cjs", "root"),
+    ]);
+    const outcome = resolve({
+      declaredPath: "#config",
+      sourcePath: "main.js",
+      context: "module-specifier",
+      moduleKind: "require",
+      files,
+    });
+    expect(outcome).toMatchObject({
+      resolution_status: "external",
+      resolved_path: null,
+    });
+    expect(outcome.limitations.join(" ")).toContain("package scopes");
+  });
+});
+
 describe("directory package entrypoint precedence", () => {
  it.each([
    ["require", '{"main":"actual.cjs"}', "actual.cjs"],
@@ -1105,6 +1464,159 @@ describe("contextual JavaScript module identity", () => {
  });
 });

+describe("TypeScript NodeNext emitted-extension resolution", () => {
+  const container = "container";
+
+  it.each([
+    ["./dep.js", "src/dep.ts"],
+    ["./ui/Button.js", "src/ui/Button.tsx"],
+    ["./cfg.mjs", "src/cfg.mts"],
+    ["./legacy.cjs", "src/legacy.cts"],
+  ] as const)(
+    "resolves %s to its TypeScript source counterpart",
+    (specifier, target) => {
+      const files = fileMap([
+        file("src/main.ts", container),
+        file(target, container, "export const value = 1;"),
+      ]);
+      expect(
+        resolve({
+          declaredPath: specifier,
+          sourcePath: "src/main.ts",
+          context: "module-specifier",
+          moduleKind: "import",
+          files,
+        }),
+      ).toMatchObject({ resolution_status: "resolved", resolved_path: target });
+    },
+  );
+
+  it.each([
+    ["./dep.js", "src/dep.d.ts"],
+    ["./cfg.mjs", "src/cfg.d.mts"],
+    ["./legacy.cjs", "src/legacy.d.cts"],
+  ] as const)(
+    "resolves %s to a declaration counterpart",
+    (specifier, target) => {
+      const files = fileMap([
+        file("src/main.ts", container),
+        file(target, container, "export const value = 1;"),
+      ]);
+      expect(
+        resolve({
+          declaredPath: specifier,
+          sourcePath: "src/main.ts",
+          context: "module-specifier",
+          moduleKind: "import",
+          files,
+        }),
+      ).toMatchObject({ resolution_status: "resolved", resolved_path: target });
+    },
+  );
+
+  it("prefers a present runtime file and keeps the fallback off for JS callers", () => {
+    const files = fileMap([
+      file("src/main.ts", container),
+      file("src/dep.js", container),
+      file("src/dep.ts", container),
+      file("src/js-main.js", container),
+    ]);
+    expect(
+      resolve({
+        declaredPath: "./dep.js",
+        sourcePath: "src/main.ts",
+        context: "module-specifier",
+        moduleKind: "import",
+        files,
+      }),
+    ).toMatchObject({
+      resolution_status: "resolved",
+      resolved_path: "src/dep.js",
+    });
+    expect(
+      resolve({
+        declaredPath: "./dep.js",
+        sourcePath: "src/js-main.js",
+        context: "module-specifier",
+        moduleKind: "import",
+        files: fileMap([
+          file("src/js-main.js", container),
+          file("src/dep.ts", container),
+        ]),
+      }),
+    ).toMatchObject({ resolution_status: "not-found", resolved_path: null });
+  });
+
+  it("does not apply the mapping to URL resources or package export targets", () => {
+    const urlFiles = fileMap([
+      file("src/main.ts", container),
+      file("src/asset.ts", container),
+    ]);
+    expect(
+      resolve({
+        declaredPath: "asset.js",
+        sourcePath: "src/main.ts",
+        context: "url-reference",
+        files: urlFiles,
+      }),
+    ).toMatchObject({ resolution_status: "not-found", resolved_path: null });
+
+    const packageFiles = fileMap([
+      file("src/main.ts", container),
+      file(
+        "src/node_modules/fixture/package.json",
+        container,
+        '{"exports":"./dep.js"}',
+      ),
+      file("src/node_modules/fixture/dep.ts", container),
+    ]);
+    expect(
+      resolve({
+        declaredPath: "fixture",
+        sourcePath: "src/main.ts",
+        context: "module-specifier",
+        moduleKind: "import",
+        files: packageFiles,
+      }),
+    ).toMatchObject({ resolution_status: "not-found", resolved_path: null });
+  });
+
+  it("does not substitute source counterparts for directory or index resolution", () => {
+    const files = fileMap([
+      file("src/main.ts", container),
+      file("src/lib/index.ts", container),
+    ]);
+    expect(
+      resolve({
+        declaredPath: "./lib.js",
+        sourcePath: "src/main.ts",
+        context: "module-specifier",
+        moduleKind: "import",
+        files,
+      }),
+    ).toMatchObject({ resolution_status: "not-found", resolved_path: null });
+  });
+
+  it("resolves an emitted dotfile name within its own directory", () => {
+    const files = fileMap([
+      file("src/main.ts", container),
+      file("src/.ts", container),
+    ]);
+    expect(
+      resolve({
+        declaredPath: "./.js",
+        sourcePath: "src/main.ts",
+        context: "module-specifier",
+        moduleKind: "import",
+        files,
+      }),
+    ).toMatchObject({
+      resolution_status: "resolved",
+      resolved_path: "src/.ts",
+    });
+  });
+});
+
 describe("url-reference JavaScript artifact path resolution", () => {
  it.each([
    "app%00.js.map",
@@ -1211,6 +1723,15 @@ const file = (
      : { included: true, value: text },
 });

+const aliasFiles = (
+  entries: Readonly<Record<string, string | null>>,
+): ReturnType<typeof fileMap> =>
+  fileMap(
+    Object.entries(entries).map(([path, text]) =>
+      file(path, "root", text ?? ""),
+    ),
+  );
+
 describe("exact HTML resource resolution", () => {
  it.each([
    ["extension", ["app.js"]],
@@ -14,6 +14,12 @@ import {
  percentDecodeUrlPath,
  stripQueryAndFragment,
 } from "../../domain/artifactPathSyntax.js";
+import {
+  classifyPackageImportSpecifier,
+  classifyPackageImportTargetString,
+  lookupExactPackageImport,
+} from "../../domain/javascript/javascriptPackageImportAliases.js";
+import { typescriptEmittedSourceCandidates } from "../TypeScriptEmittedSourceCandidates.js";

 type ArtifactPathResolutionContext =
  | "package-entrypoint"
@@ -54,6 +60,7 @@ export interface ResolveArtifactPathInput {
  readonly context: ArtifactPathResolutionContext;
  readonly files: ReadonlyMap<string, JavaScriptArtifactFile>;
  readonly htmlBaseHref?: string | null;
+  /** Import/require semantics; runtime resource paths omit this provenance. */
  readonly moduleKind?: "import" | "require";
 }

@@ -68,6 +75,21 @@ const EXTENSIONS = [
  ".node",
 ];

+// A private URL namespace for logical artifact paths, including root packages.
+// Encode inventory segments so filename punctuation remains literal in the base.
+const PACKAGE_ARTIFACT_ROOT_URL = new URL("file:///rea-artifact/");
+const packageMetadataUrl = (path: string): URL =>
+  new URL(
+    path.split("/").map(encodeURIComponent).join("/"),
+    PACKAGE_ARTIFACT_ROOT_URL,
+  );
+
+interface PackageFileTarget {
+  readonly value: string;
+  /** Normalized URL retained until loader-specific validation and file lookup. */
+  readonly url: URL;
+}
+
 type CandidateResolution =
  | {
      readonly resolvedPath: string;
@@ -103,6 +125,13 @@ export const resolveArtifactPathByContext = (
 };

 const resolvePath = (input: ResolveArtifactPathInput): CandidateResolution => {
+  // Package import keys are literal lookup identities, not artifact paths.
+  // The selected target is admitted separately by resolveExportTarget.
+  if (
+    input.context === "module-specifier" &&
+    input.declaredPath.startsWith("#")
+  )
+    return resolvePackageImportAlias(input, input.declaredPath);
  const rejected = rejectDeclaration(input.declaredPath);
  if (rejected !== null) return rejected;
  const candidate = contextualCandidate(input);
@@ -116,7 +145,16 @@ const resolvePath = (input: ResolveArtifactPathInput): CandidateResolution => {
        `The exact HTML resource ${confined} was not found among the selected application files.`,
      ])
    );
-  return resolveCandidate(input, confined, new Set());
+  return resolveCandidate(
+    input,
+    confined,
+    new Set(),
+    input.context === "module-specifier" &&
+      input.moduleKind !== undefined &&
+      (input.declaredPath.startsWith(".") || input.declaredPath.startsWith("/"))
+      ? typescriptEmittedSourceCandidates(input.sourcePath, confined)
+      : [],
+  );
 };

 const rejectDeclaration = (declared: string): CandidateResolution | null => {
@@ -202,9 +240,9 @@ const bareModuleCandidate = (
  declared: string,
 ): CandidateResolution => {
  const packageName = barePackageName(declared);
-  if (packageName === null || isBuiltin(declared) || declared.startsWith("#"))
+  if (packageName === null || isBuiltin(declared))
    return unresolvedCandidate("external", [
-      "The bare specifier is a Node builtin, package import map, or invalid package name.",
+      "The bare specifier is a Node builtin or invalid package name.",
    ]);
  if (input.moduleKind === "import" && packageName.includes("%"))
    return unresolvedCandidate("rejected", [
@@ -235,6 +273,125 @@ const bareModuleCandidate = (
  ]);
 };

+/**
+ * Nearest same-container package.json, stopping at a `node_modules` directory
+ * so a nested package cannot inherit an ancestor's map.
+ */
+const enclosingPackageMetadata = (
+  input: ResolveArtifactPathInput,
+):
+  | Extract<PackageMetadata, { readonly kind: "available" | "unavailable" }>
+  | { readonly kind: "none" } => {
+  let directory = posix.dirname(input.sourcePath);
+  while (posix.basename(directory) !== "node_modules") {
+    const metadata = readPackageMetadata(input, directory);
+    if (metadata.kind !== "absent") return metadata;
+    if (directory === "." || directory === "") break;
+    directory = posix.dirname(directory);
+  }
+  return { kind: "none" };
+};
+
+/**
+ * Resolve an exact `#alias` against the importer's enclosing `imports` map.
+ * Selected relative targets are exact files; patterns, recursive aliases, and
+ * external-package targets stay unresolved without falling through.
+ */
+const resolvePackageImportAlias = (
+  input: ResolveArtifactPathInput,
+  specifier: string,
+): CandidateResolution => {
+  const classified = classifyPackageImportSpecifier(specifier);
+  if (classified.kind === "invalid")
+    return unresolvedCandidate("rejected", [
+      `The package import specifier ${JSON.stringify(specifier)} is invalid; "#" and specifiers that end with "/" are not valid import aliases.`,
+    ]);
+  if (classified.kind === "pattern")
+    return unresolvedCandidate("external", [
+      `Wildcard and directory package import aliases remain unresolved; ${JSON.stringify(specifier)} is not an exact imports key.`,
+    ]);
+  const metadata = enclosingPackageMetadata(input);
+  if (metadata.kind === "none")
+    return unresolvedCandidate("external", [
+      `No enclosing package.json defines package import alias ${specifier}; package import maps do not cross package scopes.`,
+    ]);
+  if (metadata.kind === "unavailable")
+    return unresolvedCandidate("unavailable", [metadata.limitation]);
+  const lookup = lookupExactPackageImport(metadata.imports, specifier);
+  if (lookup.kind === "undefined-map")
+    return unresolvedCandidate("external", [
+      `Package metadata ${metadata.path} does not define package import alias ${specifier}.`,
+    ]);
+  if (lookup.kind === "missing-key")
+    return unresolvedCandidate("external", [
+      `Package metadata ${metadata.path} does not define package import alias ${specifier}; it declares ${lookup.declared.join(", ") || "no imports keys"}.`,
+    ]);
+  if (lookup.kind === "pattern-unresolved")
+    return unresolvedCandidate("external", [
+      `Wildcard package import aliases remain unresolved; package metadata ${metadata.path} has no exact imports key ${specifier}.`,
+    ]);
+  const selected = selectPackageImportTarget(
+    lookup.target,
+    input.moduleKind,
+    metadata.path,
+  );
+  if (selected.status === "rejected")
+    return unresolvedCandidate("rejected", [
+      `Package metadata ${metadata.path}: ${selected.limitation}`,
+    ]);
+  if (selected.status === "unmatched")
+    return unresolvedCandidate("external", [
+      `Package metadata ${metadata.path} declares no imports target for alias ${specifier} under the active conditions; it declares ${selected.declared.join(", ") || "no conditions"}.`,
+    ]);
+  if (selected.status === "blocked")
+    return unresolvedCandidate("external", [
+      `Package metadata ${metadata.path} blocks import alias ${specifier} with ${selected.cause === "null" ? "an explicit null imports target" : "an empty imports target array"}.`,
+    ]);
+  if (selected.status === "non-relative") {
+    const target = classifyPackageImportTargetString(selected.value);
+    return unresolvedCandidate("external", [
+      target.kind === "recursive"
+        ? `Recursive package import aliases remain unresolved; package metadata ${metadata.path} maps ${specifier} to ${JSON.stringify(target.target)}.`
+        : `External-package import targets remain unresolved; package metadata ${metadata.path} maps ${specifier} to ${JSON.stringify(target.target)}.`,
+    ]);
+  }
+  return resolveExportTarget(input, metadata.path, selected, "imports");
+};
+
+const selectPackageImportTarget = (
+  value: unknown,
+  moduleKind: ResolveArtifactPathInput["moduleKind"],
+  packagePath: string,
+):
+  | ({ readonly status: "value" } & PackageFileTarget)
+  | { readonly status: "non-relative"; readonly value: string }
+  | { readonly status: "blocked"; readonly cause: PackageTargetBlockCause }
+  | { readonly status: "unmatched"; readonly declared: readonly string[] }
+  | { readonly status: "rejected"; readonly limitation: string } => {
+  const selected = selectExportTarget(
+    value,
+    packageExportConditions(moduleKind),
+    packageMetadataUrl(packagePath),
+    "imports",
+  );
+  if (selected.kind === "invalid" || selected.kind === "invalid-config")
+    return { status: "rejected", limitation: selected.limitation };
+  if (selected.kind === "unmatched")
+    return {
+      status: "unmatched",
+      declared: selected.declared,
+    };
+  if (selected.kind === "blocked")
+    return { status: "blocked", cause: selected.cause };
+  if (selected.kind === "non-relative")
+    return { status: "non-relative", value: selected.value };
+  return {
+    status: "value",
+    value: selected.value,
+    url: selected.url,
+  };
+};
+
 /** Self references use the nearest package scope before dependency lookup. */
 const commonJsSelfCandidate = (
  input: ResolveArtifactPathInput,
@@ -242,35 +399,22 @@ const commonJsSelfCandidate = (
 ): CandidateResolution | null => {
  if (input.moduleKind !== "require" || !input.files.has(input.sourcePath))
    return null;
-  let directory = posix.dirname(input.sourcePath);
-  while (posix.basename(directory) !== "node_modules") {
-    const metadata = readPackageMetadata(input, directory);
-    if (metadata.kind === "unavailable")
-      return unresolvedCandidate("unavailable", [metadata.limitation]);
-    if (metadata.kind === "available") {
-      if (
-        metadata.name === undefined ||
-        metadata.exports === undefined ||
-        (declared !== metadata.name &&
-          !declared.startsWith(`${metadata.name}/`))
-      )
-        return null;
-      const subpath =
-        declared === metadata.name
-          ? "."
-          : `.${declared.slice(metadata.name.length)}`;
-      // Self resolution does not apply the CommonJS dependency-name matcher.
-      return resolvePackageExports(
-        input,
-        metadata.path,
-        subpath,
-        metadata.exports,
-      );
-    }
-    if (directory === "." || directory === "") break;
-    directory = posix.dirname(directory);
-  }
-  return null;
+  const metadata = enclosingPackageMetadata(input);
+  if (metadata.kind === "none") return null;
+  if (metadata.kind === "unavailable")
+    return unresolvedCandidate("unavailable", [metadata.limitation]);
+  if (
+    metadata.name === undefined ||
+    metadata.exports === undefined ||
+    (declared !== metadata.name && !declared.startsWith(`${metadata.name}/`))
+  )
+    return null;
+  const subpath =
+    declared === metadata.name
+      ? "."
+      : `.${declared.slice(metadata.name.length)}`;
+  // Self resolution does not apply the CommonJS dependency-name matcher.
+  return resolvePackageExports(input, metadata.path, subpath, metadata.exports);
 };

 /** Package roots and exact subpaths share metadata and exports selection. */
@@ -313,7 +457,12 @@ const resolvePackageExports = (
  subpath: string,
  rawExports: string | object,
 ): CandidateResolution => {
-  const exported = selectPackageExport(rawExports, subpath, input.moduleKind);
+  const exported = selectPackageExport(
+    rawExports,
+    subpath,
+    input.moduleKind,
+    packagePath,
+  );
  if (exported.status === "rejected")
    return unresolvedCandidate("rejected", [
      `Package metadata ${packagePath}: ${exported.limitation}`,
@@ -324,26 +473,47 @@ const resolvePackageExports = (
    ]);
  if (exported.status === "blocked")
    return unresolvedCandidate("external", [
-      `Directory package metadata ${packagePath} blocks subpath ${subpath} with an explicit null exports target.`,
+      `Directory package metadata ${packagePath} blocks subpath ${subpath} with ${exported.cause === "null" ? "an explicit null exports target" : "an empty exports target array"}.`,
    ]);
-  return resolveExportTarget(input, packagePath, exported.value);
+  return resolveExportTarget(input, packagePath, exported);
 };

-/** An exports target is a URL naming one exact file for both Node loaders. */
+/** An exports or import target is a URL naming one exact file for both Node loaders. */
 const resolveExportTarget = (
  input: ResolveArtifactPathInput,
  packagePath: string,
-  target: string,
+  target: PackageFileTarget,
+  mapKind: "exports" | "imports" = "exports",
 ): CandidateResolution => {
-  const rejected = rejectDeclaration(target);
-  if (rejected !== null) return rejected;
-  const decoded = decodeModuleUrlPath(stripQueryAndFragment(target));
-  if (typeof decoded !== "string") return decoded;
-  const candidate = confineCandidate(relativeCandidate(packagePath, decoded));
-  if (typeof candidate !== "string") return candidate;
+  const withTargetSource = (
+    outcome: CandidateResolution,
+  ): CandidateResolution => ({
+    ...outcome,
+    limitations: outcome.limitations.map(
+      (reason) =>
+        `Package metadata ${packagePath}, ${mapKind} target ${JSON.stringify(target.value)}: ${reason}`,
+    ),
+  });
+  // Node's CommonJS finalizer checks the serialized URL, including suffixes;
+  // its ESM finalizer checks only the pathname. Neither error retries arrays.
+  if (input.moduleKind === "require" && /%(?:2f|5c)/iu.test(target.url.href))
+    return withTargetSource(
+      unresolvedCandidate("rejected", [
+        "The selected package URL contains encoded separator bytes.",
+      ]),
+    );
+  const encodedPath = target.url.pathname.slice(
+    PACKAGE_ARTIFACT_ROOT_URL.pathname.length,
+  );
+  const rejected = rejectDeclaration(encodedPath);
+  if (rejected !== null) return withTargetSource(rejected);
+  const decoded = decodeModuleUrlPath(encodedPath);
+  if (typeof decoded !== "string") return withTargetSource(decoded);
+  const candidate = confineCandidate(decoded);
+  if (typeof candidate !== "string") return withTargetSource(candidate);
  return (
    resolveFileCandidates(input, [candidate]) ??
-    exactExportsTargetNotFound(candidate)
+    withTargetSource(exactPackageTargetNotFound(candidate, mapKind))
  );
 };

@@ -492,6 +662,7 @@ type PackageMetadata =
      readonly path: string;
      readonly name: string | undefined;
      readonly exports: string | object | undefined;
+      readonly imports: object | undefined;
      readonly main: unknown;
      readonly module: unknown;
    }
@@ -532,6 +703,7 @@ const readPackageMetadata = (
    };
  const name = Reflect.get(value, "name");
  const exports = Reflect.get(value, "exports");
+  const imports = Reflect.get(value, "imports");
  return {
    kind: "available",
    path,
@@ -543,6 +715,11 @@ const readPackageMetadata = (
      (typeof exports === "object" && exports !== null)
        ? exports
        : undefined,
+    // Import maps must be non-array objects; other shapes are not a map.
+    imports:
+      typeof imports === "object" && imports !== null && !Array.isArray(imports)
+        ? imports
+        : undefined,
    main: Reflect.get(value, "main"),
    module: Reflect.get(value, "module"),
  };
@@ -553,8 +730,12 @@ const resolveCandidate = (
  input: ResolveArtifactPathInput,
  candidate: string,
  packageChain: ReadonlySet<string>,
+  emittedSourceCandidates: readonly string[] = [],
 ): CandidateResolution =>
-  resolveFileCandidates(input, fileCandidates(candidate)) ??
+  resolveFileCandidates(input, [
+    ...fileCandidates(candidate),
+    ...emittedSourceCandidates,
+  ]) ??
  resolveDirectory(
    input,
    candidate,
@@ -644,10 +825,12 @@ const fileCandidates = (candidate: string): readonly string[] => [
 const indexCandidates = (candidate: string): readonly string[] =>
  EXTENSIONS.map((extension) => posix.join(candidate, `index${extension}`));

+type PackageTargetBlockCause = "null" | "empty-array";
+
 type PackageExportOutcome =
-  | { readonly status: "value"; readonly value: string }
+  | ({ readonly status: "value" } & PackageFileTarget)
  | { readonly status: "rejected"; readonly limitation: string }
-  | { readonly status: "blocked" }
+  | { readonly status: "blocked"; readonly cause: PackageTargetBlockCause }
  | { readonly status: "unmatched"; readonly declared: readonly string[] };

 /** Only exact non-directory keys participate; wildcard expansion is unsupported. */
@@ -655,6 +838,7 @@ const selectPackageExport = (
  value: unknown,
  subpath: string,
  moduleKind: ResolveArtifactPathInput["moduleKind"],
+  packagePath: string,
 ): PackageExportOutcome => {
  let target = value;
  let declared: string[] = [];
@@ -681,35 +865,44 @@ const selectPackageExport = (
  const selected = selectExportTarget(
    target,
    packageExportConditions(moduleKind),
+    packageMetadataUrl(packagePath),
  );
  if (selected.kind === "invalid" || selected.kind === "invalid-config")
    return { status: "rejected", limitation: selected.limitation };
  if (selected.kind === "unmatched")
    return {
      status: "unmatched",
-      declared:
-        typeof target === "object" && target !== null
-          ? Object.keys(target)
-          : declared,
+      declared: selected.declared,
    };
-  return selected.kind === "blocked"
-    ? { status: "blocked" }
-    : { status: "value", value: selected.value };
+  if (selected.kind === "blocked")
+    return { status: "blocked", cause: selected.cause };
+  if (selected.kind === "non-relative")
+    return {
+      status: "rejected",
+      limitation: `The package exports target ${JSON.stringify(selected.value)} must start with "./".`,
+    };
+  return {
+    status: "value",
+    value: selected.value,
+    url: selected.url,
+  };
 };

 type ExportTargetOutcome =
-  | { readonly kind: "value"; readonly value: string }
-  | { readonly kind: "blocked" }
-  | { readonly kind: "unmatched" }
+  | ({ readonly kind: "value" } & PackageFileTarget)
+  | { readonly kind: "non-relative"; readonly value: string }
+  | { readonly kind: "blocked"; readonly cause: PackageTargetBlockCause }
+  | { readonly kind: "unmatched"; readonly declared: readonly string[] }
  | { readonly kind: "invalid"; readonly limitation: string }
  | { readonly kind: "invalid-config"; readonly limitation: string };

 const invalidExportTarget = (
  value: unknown,
  reason: string,
+  mapKind: "exports" | "imports" = "exports",
 ): ExportTargetOutcome => ({
  kind: "invalid",
-  limitation: `The package exports target ${JSON.stringify(value) ?? String(value)} ${reason}.`,
+  limitation: `The package ${mapKind === "imports" ? "import" : "exports"} target ${JSON.stringify(value) ?? String(value)} ${reason}.`,
 });

 // Node checks raw target segments before URL normalization. Compare encoded
@@ -729,50 +922,97 @@ const forbiddenExportSegment = (value: string): string | undefined =>
      );
    });

+const selectStringPackageTarget = (
+  value: string,
+  packageUrl: URL,
+  mapKind: "exports" | "imports",
+): ExportTargetOutcome => {
+  if (mapKind === "imports") {
+    const target = classifyPackageImportTargetString(value);
+    if (target.kind === "invalid")
+      return invalidExportTarget(
+        value,
+        "cannot be parent-relative, absolute, or a URL",
+        mapKind,
+      );
+    if (target.kind !== "relative") return { kind: "non-relative", value };
+  } else if (!value.startsWith("./"))
+    return invalidExportTarget(value, 'must start with "./"', mapKind);
+  const forbidden = forbiddenExportSegment(value);
+  if (forbidden !== undefined)
+    return invalidExportTarget(
+      value,
+      `contains forbidden path segment ${JSON.stringify(forbidden)} before URL normalization`,
+      mapKind,
+    );
+  // Node constructs the URL before deciding whether this array entry is an
+  // invalid package target. Tabs/newlines and dot segments normalize here;
+  // percent decoding and existence checks belong after target selection.
+  const url = new URL(value, packageUrl);
+  if (!url.pathname.startsWith(new URL(".", packageUrl).pathname))
+    return invalidExportTarget(
+      value,
+      "escapes the package root after URL normalization",
+      mapKind,
+    );
+  return {
+    kind: "value",
+    value,
+    url,
+  };
+};
+
+const selectArrayPackageTarget = (
+  value: readonly unknown[],
+  conditions: ReadonlySet<string>,
+  packageUrl: URL,
+  mapKind: "exports" | "imports",
+): ExportTargetOutcome => {
+  if (value.length === 0) return { kind: "blocked", cause: "empty-array" };
+  let lastRefusal:
+    | Extract<ExportTargetOutcome, { readonly kind: "invalid" | "blocked" }>
+    | undefined;
+  const declared = new Set<string>();
+  for (const entry of value) {
+    const nested = selectExportTarget(entry, conditions, packageUrl, mapKind);
+    // Node's array fallback catches invalid targets, not invalid configuration.
+    if (nested.kind === "invalid-config") return nested;
+    if (nested.kind === "unmatched") {
+      for (const condition of nested.declared) declared.add(condition);
+      continue;
+    }
+    if (nested.kind === "invalid" || nested.kind === "blocked") {
+      lastRefusal = nested;
+      continue;
+    }
+    return nested;
+  }
+  return lastRefusal ?? { kind: "unmatched", declared: [...declared] };
+};
+
 /**
 * Resolve a target in Node's declared order. Explicit null blocks an active
 * condition, whereas an unmatched nested object permits the next condition.
 * An array skips unmatched and invalid entries, stops at its first string, and
- * preserves the final invalid-versus-null refusal if no string is selected.
+ * preserves the last invalid/null outcome if no string is selected. A nonempty
+ * array of unmatched conditions stays unmatched; an empty array blocks.
 */
 const selectExportTarget = (
  value: unknown,
  conditions: ReadonlySet<string>,
+  packageUrl: URL,
+  mapKind: "exports" | "imports" = "exports",
 ): ExportTargetOutcome => {
-  if (typeof value === "string") {
-    if (!value.startsWith("./"))
-      return invalidExportTarget(value, 'must start with "./"');
-    const forbidden = forbiddenExportSegment(value);
-    return forbidden === undefined
-      ? { kind: "value", value }
-      : invalidExportTarget(
-          value,
-          `contains forbidden path segment ${JSON.stringify(forbidden)} before URL normalization`,
-        );
-  }
-  if (value === null) return { kind: "blocked" };
-  if (Array.isArray(value)) {
-    let invalid: string | null = null;
-    for (const entry of value) {
-      const nested = selectExportTarget(entry, conditions);
-      // Node's array fallback catches invalid targets, not invalid configuration.
-      if (nested.kind === "invalid-config") return nested;
-      if (nested.kind === "invalid") {
-        invalid = nested.limitation;
-        continue;
-      }
-      if (nested.kind === "unmatched") continue;
-      invalid = null;
-      if (nested.kind === "value") return nested;
-    }
-    return invalid === null
-      ? { kind: "blocked" }
-      : { kind: "invalid", limitation: invalid };
-  }
+  if (typeof value === "string")
+    return selectStringPackageTarget(value, packageUrl, mapKind);
+  if (value === null) return { kind: "blocked", cause: "null" };
+  if (Array.isArray(value))
+    return selectArrayPackageTarget(value, conditions, packageUrl, mapKind);
  if (typeof value !== "object")
    return invalidExportTarget(
      value,
      "must be a relative string, object, array, or null",
+      mapKind,
    );
  for (const key of Object.keys(value)) {
    const numeric = Number(key);
@@ -782,12 +1022,15 @@ const selectExportTarget = (
        limitation: `The package exports configuration contains numeric condition key ${JSON.stringify(key)}.`,
      };
  }
+  const declared = new Set<string>();
  for (const [condition, target] of Object.entries(value)) {
+    declared.add(condition);
    if (!conditions.has(condition)) continue;
-    const nested = selectExportTarget(target, conditions);
+    const nested = selectExportTarget(target, conditions, packageUrl, mapKind);
    if (nested.kind !== "unmatched") return nested;
+    for (const name of nested.declared) declared.add(name);
  }
-  return { kind: "unmatched" };
+  return { kind: "unmatched", declared: [...declared] };
 };

 /**
@@ -816,11 +1059,14 @@ const notFoundCandidate = (): CandidateResolution => ({
  ],
 });

-const exactExportsTargetNotFound = (path: string): CandidateResolution => ({
+const exactPackageTargetNotFound = (
+  path: string,
+  mapKind: "exports" | "imports",
+): CandidateResolution => ({
  resolvedPath: null,
  status: "not-found",
  limitations: [
-    `The selected package exports target ${path} does not exist in the inventoried artifact container; exports targets are exact files, so no extension or directory index was tried.`,
+    `The selected package ${mapKind === "imports" ? "import" : "exports"} target ${path} does not exist in the inventoried artifact container; ${mapKind === "imports" ? "import" : "exports"} targets are exact files, so no extension or directory index was tried.`,
  ],
 });

@@ -1,5 +1,6 @@
 import { constants } from "node:fs";
 import { access, lstat, realpath } from "node:fs/promises";
+import { setImmediate } from "node:timers/promises";

 import { ArtifactReaderFailure } from "../../artifacts/ArtifactReader.js";
 import {
@@ -13,6 +14,7 @@ import type { JavaScriptSemanticGraph } from "../../domain/javascript/javascript
 import type { ElectronBoundarySummary } from "../../domain/javascript/javascriptApplicationAnalysis.js";
 import { parseOwnedJavaScriptApplicationAnalysisSteps } from "../../domain/javascript/javascriptApplicationAnalysis.js";
 import { AnalysisError } from "../../domain/analysisErrorBase.js";
+import { ArtifactOperationError } from "../../domain/artifactOperationError.js";
 import type { ArtifactInventorySnapshot } from "../../domain/artifactInventorySnapshot.js";
 import type { ArtifactInventoryPartialObservation } from "../../domain/artifactPartialObservation.js";
 import type { ArtifactResourceScope } from "../../artifacts/ArtifactResourceScope.js";
@@ -68,19 +70,17 @@ export const reconstructJavaScriptArtifact = async (
  progress?: ProgressReporter,
 ): Promise<JavaScriptArtifactReconstructionResult> =>
  scope.run(async () => {
-    let effectiveSignal = signal;
-    let effectiveProgress = progress;
    const reportPhase = async (
      phase: string,
      message: string,
    ): Promise<void> => {
-      await effectiveProgress?.report({
+      await progress?.report({
        phase,
        completed: 0,
        total: 1,
        message,
      });
-      await checkpointJavaScriptAnalysis(effectiveSignal);
+      await checkpointJavaScriptAnalysis(signal);
    };
    const input = javascriptArtifactReconstructionInputSchema.parse(rawInput);
    abortIfNeeded(signal);
@@ -182,14 +182,24 @@ export const reconstructJavaScriptArtifact = async (
        }
      }
      const analysis = outcome.analysis;
-      const interruption = cleanupFailure ?? outcome.interruption;
-      if (interruption !== null && interruption !== undefined) {
-        effectiveSignal = undefined;
-        effectiveProgress = undefined;
-      }
-      await checkpointJavaScriptAnalysis(effectiveSignal);
-      abortIfNeeded(effectiveSignal);
-      await reportPhase(
+      let interruption = cleanupFailure ?? outcome.interruption;
+      // Source facts are owned now. Finish their projection cooperatively so a
+      // later cancellation can retain Evidence instead of discarding those facts.
+      const checkpointCompletedAnalysis = async (): Promise<void> => {
+        await setImmediate();
+        if (interruption == null && signal?.aborted === true)
+          interruption = new ArtifactOperationError(OPERATION, "cancelled");
+      };
+      const reportCompletedPhase = async (
+        phase: string,
+        message: string,
+      ): Promise<void> => {
+        await checkpointCompletedAnalysis();
+        if (interruption == null)
+          await progress?.report({ phase, completed: 0, total: 1, message });
+        await checkpointCompletedAnalysis();
+      };
+      await reportCompletedPhase(
        "build_javascript_application_graph",
        "Constructing application and Electron boundary relationships",
      );
@@ -198,15 +208,14 @@ export const reconstructJavaScriptArtifact = async (
        files,
        analysis,
      );
-      await reportPhase(
+      await reportCompletedPhase(
        "seal_javascript_application_graph",
        "Sealing the validated application graph",
      );
      const graph = await completeJavaScriptAnalysisSteps(
        applicationGraphSteps,
-        effectiveSignal,
      );
-      await reportPhase(
+      await reportCompletedPhase(
        "build_javascript_semantic_graph",
        "Binding and validating static semantic relationships",
      );
@@ -214,15 +223,13 @@ export const reconstructJavaScriptArtifact = async (
        snapshot.manifest.root_sha256,
        graph,
      );
-      await reportPhase(
+      await reportCompletedPhase(
        "seal_javascript_semantic_graph",
        "Validating and sealing the semantic graph",
      );
-      const semanticGraph = await completeJavaScriptAnalysisSteps(
-        semanticGraphSteps,
-        effectiveSignal,
-      );
-      await checkpointJavaScriptAnalysis(effectiveSignal);
+      const semanticGraph =
+        await completeJavaScriptAnalysisSteps(semanticGraphSteps);
+      await checkpointCompletedAnalysis();
      const completed = {
        input_path: path,
        format,
@@ -0,0 +1,25 @@
+import { describe, expect, it } from "vitest";
+
+import { orderAsarListing } from "./AsarArtifactReader.js";
+
+describe("orderAsarListing", () => {
+  it("orders host-spelled listings by their portable archive path", () => {
+    const posix = orderAsarListing(["/a0", "/a", "/a/b"], "/");
+    const windows = orderAsarListing(["\\a0", "\\a", "\\a\\b"], "\\");
+
+    // "/" (0x2F) precedes "0" (0x30); "\" (0x5C) would follow it.
+    expect(posix.map(({ path }) => path)).toEqual(["a", "a/b", "a0"]);
+    expect(windows.map(({ path }) => path)).toEqual(["a", "a/b", "a0"]);
+    expect(windows.map(({ listed }) => listed)).toEqual([
+      "\\a",
+      "\\a\\b",
+      "\\a0",
+    ]);
+  });
+
+  it("keeps POSIX backslashes as literal filename characters", () => {
+    expect(orderAsarListing(["/a\\b"], "/")).toEqual([
+      { listed: "/a\\b", path: "a\\b" },
+    ]);
+  });
+});
@@ -32,6 +32,7 @@ import { closeAsarHandle, readValidatedAsarEntry } from "./AsarEntryStream.js";
 import { admitAsarHeader } from "./AsarHeader.js";
 import { OwnedFileHandle } from "../filesystem/OwnedFileHandle.js";
 import { readFileHandleChunks } from "../filesystem/readFileHandleChunks.js";
+import { compareUnicodeCodePoints } from "../domain/unicodeCodePointOrder.js";

 /**
 * Official Electron ASAR adapter with range-streamed member reads.
@@ -64,7 +65,7 @@ export class AsarArtifactReader implements ArtifactReader {
  ) {}

  async *entries(signal?: AbortSignal): AsyncIterable<ArtifactEntry> {
-    let paths: string[];
+    let paths: readonly AsarListedPath[];
    try {
      await this.prepareContainer(undefined, signal);
      const snapshotPath = this.#snapshotPath();
@@ -82,9 +83,7 @@ export class AsarArtifactReader implements ArtifactReader {
        await headerHandle.close();
      }
      abortIfNeeded(signal);
-      paths = listPackage(snapshotPath, { isPack: false }).sort((left, right) =>
-        left.localeCompare(right, "en"),
-      );
+      paths = orderAsarListing(listPackage(snapshotPath, { isPack: false }));
      const archiveMetadata = await lstat(snapshotPath);
      if (!archiveMetadata.isFile() || archiveMetadata.isSymbolicLink())
        throw new ArtifactReaderFailure(
@@ -95,13 +94,8 @@ export class AsarArtifactReader implements ArtifactReader {
    } catch (cause: unknown) {
      throw asarFailure(this.path, "inventory", cause);
    }
-    for (const listed of paths) {
+    for (const { listed, path } of paths) {
      abortIfNeeded(signal);
-      // @electron/asar returns paths assembled with the host path module.
-      // Keep that spelling for its API calls, but expose archive paths with
-      // portable separators. On POSIX, backslashes can be literal filename
-      // characters and must remain untouched.
-      const path = toArtifactPath(listed);
      if (path.length === 0) continue;
      const providerPath = listed.startsWith(sep)
        ? listed.slice(sep.length)
@@ -577,8 +571,30 @@ const waitForOperation = async (
  });
 };

-const toArtifactPath = (listed: string): string => {
-  const portable = sep === "\\" ? listed.replaceAll("\\", "/") : listed;
+interface AsarListedPath {
+  readonly listed: string;
+  readonly path: string;
+}
+
+/**
+ * Pair each host-spelled listing with its portable archive path, ordered by
+ * the portable path so Windows and POSIX hosts agree.
+ *
+ * @electron/asar returns paths assembled with the host path module. Keep that
+ * spelling for its API calls, but expose archive paths with portable
+ * separators. On POSIX, backslashes can be literal filename characters and
+ * must remain untouched.
+ */
+export const orderAsarListing = (
+  listed: readonly string[],
+  separator: string = sep,
+): AsarListedPath[] =>
+  listed
+    .map((entry) => ({ listed: entry, path: toArtifactPath(entry, separator) }))
+    .sort((left, right) => compareUnicodeCodePoints(left.path, right.path));
+
+const toArtifactPath = (listed: string, separator: string): string => {
+  const portable = separator === "\\" ? listed.replaceAll("\\", "/") : listed;
  return portable.replace(/^\/+|\/+$/gu, "");
 };

@@ -526,12 +526,16 @@ const CPU_TYPE_X86 = 7;
 const CPU_TYPE_ARM = 12;
 const CPU_SUBTYPE_MASK = 0xff000000;
 const CPU_SUBTYPE_ARM64E = 2;
+const CPU_SUBTYPE_ARM64E_X1 = 12;
 const CPU_SUBTYPE_X86_64_H = 8;

 const architectureName = (cpuType: number, cpuSubtype: number): string => {
  const subtype = cpuSubtype & ~CPU_SUBTYPE_MASK;
  if (cpuType === (CPU_TYPE_ARM | CPU_ARCH_ABI64))
-    return subtype === CPU_SUBTYPE_ARM64E ? "arm64e" : "arm64";
+    // Both pointer-authentication subtypes belong to the arm64e family.
+    return subtype === CPU_SUBTYPE_ARM64E || subtype === CPU_SUBTYPE_ARM64E_X1
+      ? "arm64e"
+      : "arm64";
  if (cpuType === (CPU_TYPE_ARM | CPU_ARCH_ABI64_32)) return "arm64_32";
  if (cpuType === (CPU_TYPE_X86 | CPU_ARCH_ABI64))
    return subtype === CPU_SUBTYPE_X86_64_H ? "x86_64h" : "x86_64";
@@ -13,6 +13,16 @@ describe("hostExecutableMarking", () => {
    expect(
      hostExecutableMarking("C:\\scratch\\SETUP.CMD", file(0o444), "win32"),
    ).toBe(true);
+    for (const path of [
+      "tools/SETUP.EXE",
+      "run.Cmd",
+      "build.bat",
+      "legacy.com",
+    ])
+      expect(hostExecutableMarking(path, file(0o666), "win32")).toBe(true);
+    expect(hostExecutableMarking("readonly.exe", file(0o444), "win32")).toBe(
+      true,
+    );
    expect(
      hostExecutableMarking("C:\\scratch\\library.dll", file(0o666), "win32"),
    ).toBe(false);
@@ -25,6 +35,11 @@ describe("hostExecutableMarking", () => {
    ).toBe(false);
  });

+  it("does not treat other Windows filenames as executable even with execute bits", () => {
+    for (const path of ["notes.txt", "README", "archive.exe.bak"])
+      expect(hostExecutableMarking(path, file(0o777), "win32")).toBe(false);
+  });
+
  it("keeps POSIX permission bits authoritative regardless of extension", () => {
    expect(hostExecutableMarking("/scratch/tool", file(0o755), "linux")).toBe(
      true,
@@ -68,6 +68,7 @@ import { captureCdpScreenshot } from "./CdpScreenshot.js";
 import { comparePngScreenshots } from "./PngVisualDiff.js";

 import { CDP_BROWSER_PROVIDER_IDENTITY } from "./providerIdentities.js";
+import { compareUnicodeCodePoints } from "../domain/unicodeCodePointOrder.js";
 const CLEANUP_DOMAINS = ["Network", "Debugger", "Runtime", "Page"] as const;

 /** Passive browser observation through a selected user-owned CDP endpoint. */
@@ -408,7 +409,9 @@ const selectTargets = (
      attached: target.attached,
    });
  }
-  allowed.sort((left, right) => left.target_id.localeCompare(right.target_id));
+  allowed.sort((left, right) =>
+    compareUnicodeCodePoints(left.target_id, right.target_id),
+  );
  return {
    allowed,
    excluded: {
@@ -12,6 +12,7 @@ import {
 import { exclusionReasonForUrl } from "./CdpCaptureEventHelpers.js";
 import type { CdpCaptureCompleteness } from "./CdpCaptureCompleteness.js";
 import { createDocumentSvgAncestry, domSvgLink } from "./CdpCaptureDomSvg.js";
+import { compareUnicodeCodePoints } from "../domain/unicodeCodePointOrder.js";

 export type CapturedResource = Omit<
  WebPageInspection["resources"][number],
@@ -346,7 +347,7 @@ const accessibilityStates = (
    if (state !== undefined) states.set(name, state);
  }
  return [...states]
-    .sort(([left], [right]) => left.localeCompare(right))
+    .sort(([left], [right]) => compareUnicodeCodePoints(left, right))
    .map(([name, state]) => ({ name, value: state }));
 };

@@ -24,6 +24,7 @@ import {
 import { captureElectronScripts } from "./CdpElectronScripts.js";
 import { captureElectronWorkers } from "./CdpElectronWorkers.js";
 import { authorizedElectronFile } from "./ElectronFileScope.js";
+import { compareUnicodeCodePoints } from "../domain/unicodeCodePointOrder.js";

 interface ElectronContext {
  readonly connection: CdpConnection;
@@ -300,7 +301,7 @@ const captureResources = async (
    pending.push(...recordsValue(tree.childFrames));
  }
  return resources.sort((left, right) =>
-    left.resource_key.localeCompare(right.resource_key),
+    compareUnicodeCodePoints(left.resource_key, right.resource_key),
  );
 };

@@ -30,6 +30,7 @@ import { inspectCdpElectronPage } from "./CdpElectronInspection.js";
 import { authorizedElectronFile } from "./ElectronFileScope.js";

 import { CDP_ELECTRON_PROVIDER_IDENTITY } from "./providerIdentities.js";
+import { compareUnicodeCodePoints } from "../domain/unicodeCodePointOrder.js";
 /** Passive Electron provider for local file pages exposed by loopback CDP. */
 export class CdpElectronProvider implements ElectronObservationPort {
  identity(): ProviderIdentity {
@@ -73,7 +74,7 @@ export class CdpElectronProvider implements ElectronObservationPort {
        });
      }
      allowed.sort((left, right) =>
-        left.target_id.localeCompare(right.target_id),
+        compareUnicodeCodePoints(left.target_id, right.target_id),
      );
      return ok(
        electronTargetListSchema.parse({
@@ -9,6 +9,7 @@ import { CdpCaptureCompleteness } from "./CdpCaptureCompleteness.js";
 import { requiredScriptSource } from "./CdpCaptureValues.js";
 import type { ElectronScriptDraft } from "./CdpElectronScriptEvents.js";
 import { authorizedElectronFile } from "./ElectronFileScope.js";
+import { compareUnicodeCodePoints } from "../domain/unicodeCodePointOrder.js";

 interface ElectronScriptCaptureInput {
  readonly connection: CdpConnection;
@@ -65,7 +66,7 @@ export const captureElectronScripts = async (
  return {
    total,
    items: items.sort((left, right) =>
-      left.script_key.localeCompare(right.script_key),
+      compareUnicodeCodePoints(left.script_key, right.script_key),
    ),
  };
 };
@@ -12,6 +12,7 @@ import {
 import type { CdpEndpointTarget } from "./CdpEndpoint.js";
 import { optionalCdpCommand } from "./CdpOptionalCommand.js";
 import { authorizedElectronFile } from "./ElectronFileScope.js";
+import { compareUnicodeCodePoints } from "../domain/unicodeCodePointOrder.js";

 /** Inventory local worker targets without attaching to them. */
 export const captureElectronWorkers = async (input: {
@@ -70,7 +71,7 @@ export const captureElectronWorkers = async (input: {
    });
  }
  return workers.sort((left, right) =>
-    left.target_id.localeCompare(right.target_id),
+    compareUnicodeCodePoints(left.target_id, right.target_id),
  );
 };

@@ -13,6 +13,7 @@ import {
 } from "./CdpCaptureValues.js";
 import type { CaptureContext } from "./CdpPageCapture.js";
 import type { WebSourceMapRequest } from "./WebSourceMapFetcher.js";
+import { compareUnicodeCodePoints } from "../domain/unicodeCodePointOrder.js";

 export interface CapturedScripts {
  readonly inventory: WebPageInspection["scripts"];
@@ -131,11 +132,15 @@ const keyAndBuildInventory = (
  }));
  keyed.sort(
    (left, right) =>
-      left.base.localeCompare(right.base) ||
-      sourceDigest(left.item.source).localeCompare(
+      compareUnicodeCodePoints(left.base, right.base) ||
+      compareUnicodeCodePoints(
+        sourceDigest(left.item.source),
        sourceDigest(right.item.source),
      ) ||
-      (left.item.frame_id ?? "").localeCompare(right.item.frame_id ?? ""),
+      compareUnicodeCodePoints(
+        left.item.frame_id ?? "",
+        right.item.frame_id ?? "",
+      ),
  );
  const totals = new Map<string, number>();
  for (const { base } of keyed) totals.set(base, (totals.get(base) ?? 0) + 1);
@@ -7,7 +7,10 @@ import type {
 } from "../domain/webMcpDiscovery.js";
 import { jsonValueSchema } from "../domain/jsonValue.js";
 import { digestCanonicalValue } from "../domain/canonicalDigest.js";
-import { compositeKey } from "../domain/unicodeCodePointOrder.js";
+import {
+  compareUnicodeCodePoints,
+  compositeKey,
+} from "../domain/unicodeCodePointOrder.js";
 import type { CdpEndpointDiscovery, CdpEndpointTarget } from "./CdpEndpoint.js";
 import type { CdpConnection, CdpEvent } from "./CdpConnection.js";
 import { CdpCaptureCompleteness } from "./CdpCaptureCompleteness.js";
@@ -521,7 +524,7 @@ const buildWebMcpResult = (options: WebMcpResultOptions): WebMcpDiscovery => {
    tools: {
      total: tools.size + completeness.droppedTotal,
      items: [...tools.values()].sort((left, right) =>
-        left.tool_key.localeCompare(right.tool_key),
+        compareUnicodeCodePoints(left.tool_key, right.tool_key),
      ),
    },
    completeness: completeness.snapshot(),
--- a/Show More
+++ b/Show More