fix(docs): update browser capture guide link after move (#2820 )

Refresh gettext protected-link comments alongside the authored href. Co-authored-by: Codex <noreply@openai.com>
chore(merge): refresh PR #2791 with CI repair checkpoint
2026-10-14 06:55:59 +08:00 · 2026-10-14 03:10:44 +08:00 · 2026-10-14 02:39:03 +08:00 · 2026-10-14 02:30:44 +08:00 · 2026-10-14 02:23:57 +08:00 · 2026-10-14 02:17:57 +08:00
990 changed files with 82833 additions and 7627 deletions
@@ -6,7 +6,7 @@ description: Prepare or rewrite REA release changelogs and GitHub release notes
 # REA changelog update

 Use this for release-note preparation and contributor attribution. Read
-[docs/releasing.md](../../../docs/releasing.md) from the repository root for
+[docs/development/releasing.md](../../../docs/development/releasing.md) from the repository root for
 publication authority and the existing checkpoint checks. This skill prepares
 notes; it does not authorize merging, tagging, or publishing.

@@ -0,0 +1,112 @@
+---
+name: rea-ci-tests-audit
+description: Audit REA CI and test suites for correctness, fixture drift, false passes, and measured performance; use for suite or workflow investigations and efficiency changes, rather than ordinary feature testing or a single test failure.
+---
+
+# REA CI and tests audit
+
+Establish which checks still catch real regressions and which costs can be
+removed without losing that protection. The outcome may be a verified fix,
+an evidence-backed recommendation, or an explicit decision to stop.
+
+Follow the checkout's `AGENTS.md`, [testing guide](../../../docs/development/testing.md),
+and [contribution rules](../../../CONTRIBUTING.md). Use their current commands
+and pinned toolchain, rather than commands remembered from an earlier audit.
+Preserve the requested scope: investigation alone does not authorize edits;
+this skill does not grant permission to publish issues, push, or merge. Existing
+user authorization still applies. Keep audit notes and raw results outside the
+tracked tree, normally in a task-specific `/tmp` directory.
+
+## Establish the executed baseline
+
+Fetch when the user asks for latest main. Pin the baseline SHA and inspected
+workflow revision; use an isolated worktree when changing or comparing code.
+Do not modify another task's checkout. Record dirty changes and the exact
+command, toolchain, host, selected tests, instrumentation, and prerequisites.
+An old run is evidence for its executed revision, even if main advances.
+
+Trace workflow triggers, changed-path selection, job dependencies, reusable
+actions, package scripts, test discovery, artifact producers, and report gates
+through to the commands that actually execute. Include scripts, generated data,
+runtime registration, and subprocess boundaries missing from import graphs.
+Check positive and negative selection paths: required files must be discovered
+once per intended test configuration; deliberate platform/configuration repeats
+are separate coverage. A missing explicit test or missing required report must
+not turn green. Optional lanes may skip; preserve their stated prerequisites.
+
+Use existing timing and failure artifacts to select suspicious families. Run
+relevant checks to establish a baseline; reserve a full local suite for broad
+CI diagnosis or uncertainty that focused checks cannot resolve. Do not rebuild
+or rerun an unchanged complete suite after every documentation edit.
+
+## Prove the failure or protection
+
+For each candidate, state the expected observable behavior and its owner,
+then construct the smallest reproduction against production behavior. Follow
+the producer and affected consumers before deciding where to fix it.
+
+- For drift, compare fixtures with current admission requirements, protocol
+  replies, named contracts, tool versions, and actual public entrypoints. A
+  plausible-looking mock can fail before the behavior its test claims to cover.
+  Search the whole affected fixture family, including other version strings.
+  Preserve intentionally malformed fixtures and test their intended rejection.
+- For a suspicious green test, perturb the relevant behavior in an isolated
+  copy or inject a controlled failure. Verify that the existing assertion or
+  gate detects it. A test may merely repeat its mock, import abandoned code,
+  or hide a subprocess/checker failure. Restore mutations after the experiment.
+- For shared setup or pruning, map distinct assertions to their retained
+  scenarios. Preserve malformed inputs, cancellation, cleanup failure,
+  permissions, capacity, identity, and meaningful concurrency interactions.
+  A faster run that skips a case or weakens its oracle is not an improvement.
+- For provider coverage, separate fake-producer, boundary, and actual-engine
+  evidence. Inspect named skips and prerequisites; fixtures do not establish
+  real Ghidra, LLDB, browser, or other provider behavior.
+
+Classify findings as reproduced defects, supported costs, hypotheses, or
+unavailable evidence. Record the baseline command, observed output/exit status,
+expected result, affected scope, and competing explanation. A failure on main
+may be pre-existing; that does not by itself make it irrelevant to a CI audit.
+Attribute PR failures using the executed revision and a clean baseline, not
+just their resemblance to a previous failure. Retry only to test a specific
+transient explanation; retain the original failure and stop when repetition
+adds no evidence. A passing retry does not establish a root cause or a fix.
+
+## Assess efficiency without losing the gate
+
+Read [measurement and CI checks](references/measurement-and-ci.md) when
+investigating slowness, caching, runner waits, shared artifacts, or log noise.
+Compare equivalent completed work before claiming a speedup. Distinguish
+setup/build time, test execution, coverage instrumentation, dependency waits,
+and runner scheduling; state which costs remain unmeasured.
+
+Prefer removing proven duplicate preparation, reusing immutable setup, and
+reducing repeated subprocess work before shrinking correctness coverage.
+Preserve independent sessions where lifecycle or concurrency is the oracle.
+Keep live tests fresh; a cached previous pass cannot validate current host,
+installed provider contents, permissions, or external state.
+
+## Fix, verify, and hand off within scope
+
+If implementation is authorized, make the smallest structural change at the
+owning boundary and add a regression that fails on the baseline for the right
+reason. Retest affected consumers and meaningful negative paths; verify cache
+invalidation or discovery when those mechanisms change. Read the installed
+Turbo documentation before changing its configuration or commands.
+
+Run the repository's applicable checks and inspect complete current-head CI
+results before an authorized merge. Preserve required coverage and discovery
+gates. Do not suppress a failure, add blanket retries, raise timeouts, or delete
+distinct assertions solely to make CI green. Changes to these controls need
+their own demonstrated reason and retained failure detection.
+
+Report each confirmed issue with exact revision, reproduction, consequence,
+proposed correction, and validation limits. Report performance with workload
+and measurements, not just a percentage. Use English issue/PR records when
+requested; follow the user's assignment, commit identity, review, and merge
+preferences without assuming them for other users. Open ready-for-review PRs
+only when that lifecycle is authorized. Resolve necessary review findings and
+check final main against the tested tree after merging.
+
+Stop when the authorized work is verified, remaining benefits are unproven,
+or further changes would trade correctness for speculative speed. List genuine
+uncertainties without turning them into additional optimization rounds.
@@ -0,0 +1,4 @@
+interface:
+  display_name: "REA CI and tests audit"
+  short_description: "Audit CI/test correctness and measured performance"
+  default_prompt: "Use $rea-ci-tests-audit to investigate CI and test correctness, drift, and performance before proposing changes."
@@ -0,0 +1,65 @@
+# Measurement and CI checks
+
+## Equivalent completed work
+
+Record the source/workflow SHA, command, test identities and counts, skips,
+assertions or output contract, exit status, coverage scope and thresholds,
+toolchain/provider versions, host resources, and prepared artifacts. Inspect
+both the child result and its report: a profiling wrapper may exit successfully
+after the measured command failed. Focused tests can pass while global coverage
+thresholds fail; describe both rather than calling the command green.
+
+Measure wall time, user/system CPU, and peak process-family memory for relevant
+completed tasks. Parent-only RSS misses workers and their children. On Linux,
+summed RSS can double-count shared pages; report RSS/PSS semantics, sampling
+interval, missing samples, and observed cleanup limits. Use equivalent host
+tools elsewhere. State unknown costs, including agent tokens; fewer log bytes
+alone prove neither fewer tokens nor faster tests.
+
+Separate cold execution, warm build/file caches, and warm runtime caches.
+Use repeated or alternating runs when variance affects the decision, with
+enough observations to distinguish the proposed benefit from noise. Keep
+workload, instrumentation, and host conditions comparable; record interference.
+A run with fewer tests, early rejection, lost coverage, or a different runner
+does not prove suite acceleration. CI-wide claims need end-to-end measurements,
+not an extrapolation from one improved family.
+
+## Workflow, caches, and shared artifacts
+
+Trace each reused result from producer to consumers and identify its lifetime.
+Check key/input coverage against the actual file inventory and result-affecting
+configuration, environment, generated data, tool versions, and host state.
+Exercise an affected input change to prove invalidation; exercise an irrelevant
+change to support reuse where useful. Cache deterministic preparation and
+static analysis only when their inputs fully describe the result.
+
+Verify downloaded artifacts match the expected revision, platform, runtime,
+and schema. Check restore misses, failed/partial producers, stale reports,
+removed output files, and consumers after producer failures. Shared writers
+need output ownership or locks; tests need isolated state, not an unnecessary
+global lock. Worker counts do not bound children spawned within each test.
+Preserve intentionally concurrent scenarios while bounding unrelated batches.
+
+Check matrix expansion and all job pages before saying CI passed. Inspect
+required gates after failed, cancelled, and skipped dependencies. `always()`
+alone does not preserve failures; inspect the aggregation logic. Test/report
+uploads should retain available diagnostics after failure, while absent or
+malformed required results must fail closed. Do not demand an optional report
+from a lane intentionally excluded by the selector.
+
+## Runner waits and console noise
+
+Use per-job and per-step timestamps where available. Workflow creation to job
+start includes dependencies and other delays; it is not necessarily runner
+queue time. Identify when the job became eligible before attributing waits to
+runner capacity. If eligibility/queue timestamps are unavailable, report the
+combined delay and unknown split. Compare equivalent lanes and runner types
+across enough runs; a single busy runner is not a workflow regression.
+
+For console reductions, retain checker exit codes, actionable errors, useful
+summary counts, and complete machine-readable artifacts. Verify authored code
+remains in the actual checker inventory when excluding generated outputs.
+Introduce an authored error as a control; it must still fail. An ignore pattern
+can hide real source as well as noise. Show that cached reports are restored,
+stale successful reports cannot mask current failures, and report parse errors
+remain failures. Measure readability or byte reduction separately from runtime.
@@ -5,7 +5,7 @@ description: Design or change REA investigation tools, CLI/MCP contracts, provid

 # REA tool design

-Use the [tool-design guide](../../../docs/tool-design.md) for tool boundaries,
+Use the [tool-design guide](../../../docs/development/tool-design.md) for tool boundaries,
 contract semantics, provider ownership, and discoverability. Inspect the current
 contract and nearest existing tool relevant to the analyst question; source,
 documentation, and live catalogs may describe different versions.
@@ -14,7 +14,7 @@ For a design request, return the proposed boundary, input/result shape, Evidence
 semantics, nearest alternative, and verification approach. Implement when
 requested, preserving the user's scope and existing authorization.

-For implementation or verification, consult [testing](../../../docs/testing.md)
+For implementation or verification, consult [testing](../../../docs/development/testing.md)
 for the affected consumer and provider lanes, and
 [contributing](../../../CONTRIBUTING.md) for generated-file ownership. Read
 provider/workflow guides only as the task requires.
@@ -56,7 +56,7 @@ explicit path or endpoint and do not need it.
 - Firmware image: `inspect_firmware_regions` when advertised. Use
  `extract_firmware` when extraction is requested, with a caller-selected new
  absolute output directory. These tools use caller-supplied Binwalk/Unblob on
-  Linux; see the [firmware guide](https://github.com/morluto/rea/blob/main/docs/firmware-analysis.md).
+  Linux; see the [firmware guide](https://github.com/morluto/rea/blob/main/docs/guides/firmware/firmware-analysis.md).
 - .NET NativeAOT PE/ELF: native Ghidra analysis. Native code can yield pseudocode;
  consult the NativeAOT workflow in `references/native-and-artifacts.md` for
  optional metadata recovery and its supported host/layout boundary.
@@ -68,7 +68,7 @@ explicit path or endpoint and do not need it.
 - Retained HAR/SAZ/native mitmproxy/aioquic qlog capture: `inspect_web_network_capture`. Select
  original record ordinals when useful; inspect producer fields and byte/number
  sidecars without fetching recorded URLs or claiming live attribution. See
-  [historical captures](https://github.com/morluto/rea/blob/main/docs/web-network-captures.md) for the exact upstream
+  [historical captures](https://github.com/morluto/rea/blob/main/docs/guides/web/web-network-captures.md) for the exact upstream
  profile and credential exclusions. Qlog support starts with aioquic 1.5.0
  JSON 0.3; stream coverage and endpoint loss declarations do not recover bodies
  or establish network loss. Prefer detail summary, then kind qlog trace/stream
@@ -76,9 +76,12 @@ explicit path or endpoint and do not need it.
  Facts retain all-recorded-events-before-selection scope. Other qlog layouts
  and PCAP correlation are unsupported.
 - User-owned Electron runtime already open: `list_electron_targets`.
+- Packet-field discovery: `inspect_packet_fields` searches installed protocols
+  and field names/types before choosing fields for `inspect_packet_capture`.
+  Query/page the relevant records; registrations do not establish observed traffic.
 - Recorded packet captures: `inspect_packet_capture` with selected TShark fields,
  display filters and decode-as rules. Requires Linux, util-linux prlimit and `REA_TSHARK_COMMAND`; see
-  [capture guide](https://github.com/morluto/rea/blob/main/docs/packet-captures.md).
+  [capture guide](https://github.com/morluto/rea/blob/main/docs/guides/data/packet-captures.md).
  Packet limits count input packets before filtering. Output defaults to 50 matching
  frames; use `match_offset` / `match_limit` for later pages, or explicit null
  limit for complete matching output. Preserve the source digest across pages.
@@ -86,12 +89,15 @@ explicit path or endpoint and do not need it.
  For address/DNS/SNI/protocol summaries use `inspect_pcap_capture` with MCP
  detail summary, then retained kind pcap pages. Requires Wireshark 4.x tshark
  and capinfos, with Linux prlimit or Windows Job Objects; see
-  [packet summaries](https://github.com/morluto/rea/blob/main/docs/pcap-analysis.md).
+  [packet summaries](https://github.com/morluto/rea/blob/main/docs/guides/data/pcap-analysis.md).
  Select an exact DNS question for address pages; page exhaustion does not prove
  network completeness. This reads recordings and does not acquire traffic.
+- Decoder discovery: `inspect_signal_decoders` searches installed decoder IDs
+  or selected decoder help, including channels and options. Query and page the
+  relevant details before choosing settings; this does not scan hardware.
 - Recorded logic/signal traces: `decode_signal_recording` with explicit decoder,
  channel and protocol settings. On Linux with util-linux prlimit, supply sigrok-cli 0.7.2 through
-  `REA_SIGROK_COMMAND`; see [recording guide](https://github.com/morluto/rea/blob/main/docs/signal-recordings.md).
+  `REA_SIGROK_COMMAND`; see [recording guide](https://github.com/morluto/rea/blob/main/docs/guides/signals/signal-recordings.md).
  Output defaults to 50 literal lines; select annotation classes and page with
  `line_offset` / `line_limit`, or explicit null for all remaining output.
  Window counts are display lines, not annotations or samples. Preserve source digests across pages.
@@ -100,7 +106,7 @@ explicit path or endpoint and do not need it.
  through `REA_WABT_BIN_DIRECTORY`; retain exact byte/tool identity and decoded WAT.
  Select JavaScript glue and candidate paths explicitly and preserve URL/path
  ambiguity. No implicit fetch or target execution; WAT is not original source.
-  See the [WASM guide](https://github.com/morluto/rea/blob/main/docs/wasm-artifacts.md).
+  See the [WASM guide](https://github.com/morluto/rea/blob/main/docs/guides/wasm/wasm-artifacts.md).
 - Explicit local EVM bytecode carrier: `inspect_evm_interface` with caller-selected
  `raw` or `hex` encoding. Preserve carrier/decoded digests and treat selectors,
  argument strings and mutability as inferred candidates; this performs no chain
@@ -109,13 +115,13 @@ explicit path or endpoint and do not need it.
  Evidence stays retained under its original identity. Use the returned
  `parent_evidence_id` for exact function or `bytecode_hex`/stdout/stderr pages.
  Candidate coverage does not establish interface completeness. See the
-  [EVM bytecode guide](https://github.com/morluto/rea/blob/main/docs/evm-bytecode.md).
+  [EVM bytecode guide](https://github.com/morluto/rea/blob/main/docs/guides/evm/evm-bytecode.md).
 - Embedded Go compiler, module or build-setting metadata: `inspect_go_binary`
  with the explicit local file. This built-in target-free inspection requires no
  Go installation or disassembler. Preserve raw module bytes and source ranges;
  absent metadata does not prove a binary is not Go, and unparsed text records
  remain explicit. See the
-  [Go binary guide](https://github.com/morluto/rea/blob/main/docs/go-binaries.md).
+  [Go binary guide](https://github.com/morluto/rea/blob/main/docs/guides/native/go-binaries.md).

 - Explicit local SQLite database snapshot: `inspect_sqlite_database`. Inspect
  with Node.js 24.x >=24.15 or 26+ providing native SQLite limits. Read schema
@@ -124,17 +130,17 @@ explicit path or endpoint and do not need it.
  20 rows; request `schema_scope: "database"` for the complete stored schema. Preserve both database and existing sibling WAL identity; row samples
  report truncation and have unspecified order. Use a quiescent snapshot rather
  than assuming a live database/WAL pair was copied atomically. See the
-  [SQLite guide](https://github.com/morluto/rea/blob/main/docs/sqlite-databases.md).
+  [SQLite guide](https://github.com/morluto/rea/blob/main/docs/guides/data/sqlite-databases.md).
 - Explicit Linux ELF file for offline layout, symbols, relocations or static
  mitigation evidence: `inspect_binary_layout`. This target-free operation uses
  caller-supplied pwntools without opening a disassembler database. Preserve its
  raw locations and inference/coverage limits; see the
-  [offline binary guide](https://github.com/morluto/rea/blob/main/docs/binary-diagnostics.md).
+  [offline binary guide](https://github.com/morluto/rea/blob/main/docs/guides/native/binary-diagnostics.md).
 - Supplied Linux x86-64 ELF core: `inspect_recorded_crash`. Read every recorded
  thread, raw note and source-bound register without opening a live target.
  Historical PIDs do not select live processes. Request `include_debugger_context`
  only when core-only mapping candidates help; see the
-  [recorded crash guide](https://github.com/morluto/rea/blob/main/docs/recorded-crashes.md).
+  [recorded crash guide](https://github.com/morluto/rea/blob/main/docs/guides/native/recorded-crashes.md).
 - PE resource type/name/language trees and static icon group references:
  `inspect_pe_resources` with an explicit path. This portable operation requires
  no active target or engine; opaque payloads retain file ranges and SHA-256.
@@ -148,7 +154,7 @@ The legacy attached profile binds the already-open GUI input by SHA-256 and
 leaves its database open. The modern headless profile creates and closes an
 owned private database without saving. Installation and registration reuse
 [mrexodia/ida-pro-mcp](https://github.com/mrexodia/ida-pro-mcp); see the
-[IDA provider guide](https://github.com/morluto/rea/blob/main/docs/ida-provider.md).
+[IDA provider guide](https://github.com/morluto/rea/blob/main/docs/providers/ida-provider.md).
 Proceed directly to `analyze_function`, pseudocode, or function/string searches
 after opening; IDA does not supply `binary_overview`. Consult session availability
 when composing broader workflows. Modern direct callers and unsupported dossier
@@ -46,7 +46,7 @@ rea setup --client codex --dry-run --json
 Use the current supported client's ID: `claude_code`, `claude_desktop`, `codex`,
 `cursor`, `gemini_cli`, `windsurf`, `devin`, `opencode`, `antigravity`,
 `copilot_cli`, `commandcode`, `qwen_code`, `vscode`, `trae`, `grok_build`, `omp`, `pi`,
-`hermes`, `qoder`, `zcode`, `dsh`, or `grok_bot`. If unknown, inspect `doctor --json` before choosing a
+`hermes`, `qoder`, `droid`, `zcode`, `dsh`, or `grok_bot`. If unknown, inspect `doctor --json` before choosing a
 scope. `grok_bot` uses a chat registration step rather than local `mcp.json`.
 For unsupported clients, use version-pinned manual stdio registration or CLI.

@@ -6,7 +6,7 @@ For captured or bundled JavaScript that needs readable source recovery, use
 `additional_paths` when advertised, then analyze the returned `analysis_input`
 directory together. Each input retains its own snapshot, digest and byte-range
 provenance; inputs and recovered code are never executed. Recovery requires a
-caller-supplied Wakaru on Linux x64; see [the recovery guide](https://github.com/morluto/rea/blob/main/docs/javascript-recovery.md).
+caller-supplied Wakaru on Linux x64; see [the recovery guide](https://github.com/morluto/rea/blob/main/docs/guides/javascript/javascript-recovery.md).

 Use `analyze_javascript_application` directly on the operator-supplied ASAR or
 extracted tree. When the question concerns known source paths and the connected
@@ -24,7 +24,7 @@ Choose `row_limit` when a finite sample is useful and keep truncation and
 unspecified row order explicit. Virtual tables, shadow tables and views are
 schema facts, not row-read targets. REA inspects private copies and leaves
 the source files untouched; obtain a coherent quiescent database/WAL snapshot
-before inspection. See [SQLite snapshots](https://github.com/morluto/rea/blob/main/docs/sqlite-databases.md).
+before inspection. See [SQLite snapshots](https://github.com/morluto/rea/blob/main/docs/guides/data/sqlite-databases.md).

 ## Recorded Linux crashes

@@ -39,7 +39,7 @@ The optional `include_debugger_context` facet adds mapping candidates through
 caller-supplied GDB/pwndbg in an owned core-only session. Display names do not
 establish current file identity; zero reported flags leave permissions unknown.
 Requested unavailable context fails with setup guidance. See
-[recorded crashes](https://github.com/morluto/rea/blob/main/docs/recorded-crashes.md)
+[recorded crashes](https://github.com/morluto/rea/blob/main/docs/guides/native/recorded-crashes.md)
 for exact upstream profiles, bounds and verification coverage.

 ## Offline ELF layout
@@ -83,6 +83,14 @@ names, the native API record, and value-flow summaries. Pseudocode offsets and l
 code units; use the returned `next_offset` for continuation. Provider limitations
 and unavailable facts remain explicit; the complete parent Evidence is retained.

+`inspect_macho` on a large framework returns megabytes of imports and exports.
+Select `detail: "summary"` for slice identity, UUID and per-collection counts,
+then page rows with `view: {kind: "macho", facet: "exports", offset: 0, limit: 64}`
+and `normalized_result.parent_evidence_id`. Facets are entrypoints,
+architectures, build_metadata, load_commands, dependencies, imports, exports,
+segments and provenance. `source_exhaustive: false` means unreturned symbols
+may exist.
+
 To see which functions or Objective-C methods a Mach-O actually calls in one
 run, use `observe_native_calls` with explicit breakpoints and a bounded
 `duration_ms`/`max_events`. It launches a new process under LLDB, so the target
@@ -111,6 +119,8 @@ loaded bytes, file mappings, relocations and the entry against the immutable
 snapshot. Keep `mismatch` and `unsupported` explicit. Verified import covers the
 reported static image, not runtime DOS or PC-98 hardware behavior.

+For Ghidra decompilation, `procedure_pseudo_code` also accepts `procedure: "file-offset:0x..."`; CLI `rea decompile <path> --file-offset=0x... --provider ghidra` resolves the source byte offset internally. An unresolved 0x-prefixed numeric procedure selector also falls back to a unique file mapping. Existing symbols and analysis addresses win; multiple mappings fail as ambiguous. Preserve the returned file-offset and address locations and raw selection observations. ELF virtual addresses are distinct from file offsets; never assume an arbitrary offset plus image base is an analysis address.
+
 Use `read_bytes` for initialized analysis memory and `address_to_file_offset` to
 anchor one observed address to original file bytes. Loader fixups can change a
 word; a source offset does not imply byte equality. Complete function body ranges
@@ -165,8 +175,10 @@ additional evidence only when the provider accepts and matches them.
 REA has a built-in read-only snapshot parser for x64 PE targets with .NET 8 RTR
 9.1 metadata. An optional headless Ghidra adapter adds database annotations and
 broader metadata recovery on Linux; it requires an explicitly configured
-NativeAOT JAR. These are separate routes. See the
-[NativeAOT guide](https://github.com/morluto/rea/blob/main/docs/ghidra-nativeaot.md)
+NativeAOT JAR. These are separate routes. The built-in parser also runs on
+Windows Ghidra P0; read frozen literals from its report, because
+`search_strings` does not include them. See the
+[NativeAOT guide](https://github.com/morluto/rea/blob/main/docs/providers/ghidra-nativeaot.md)
 for setup, supported layouts, and host restrictions. Preserve binary identity
 and distinguish derived metadata from Ghidra database observations. Recovered
 types and native pseudocode are not original C# source. Windows Ghidra P0 has
@@ -195,7 +207,7 @@ every executable in the bundle. It also lists missing or weak loads and earlier
 provides them.

 Use `extract_artifact` when materialized files are needed. It extracts the active
-target and accepts optional `integrity_policy`; see the [MCP contracts](https://github.com/morluto/rea/blob/main/docs/mcp-contracts.md).
+target and accepts optional `integrity_policy`; see the [MCP contracts](https://github.com/morluto/rea/blob/main/docs/reference/mcp-contracts.md).
 It materializes all regular files into a fresh temporary directory chosen by
 REA. Symlinks and encrypted entries are inventory facts, not extractable files.
 The result reports the materialized directory; callers do not choose the
@@ -210,14 +222,17 @@ separate filesystem-writing operation.
 For headerless DOS COM, explicitly open with `format: "dos-com"` (CLI
 `--target-format dos-com`). Inspect the load image before trusting function
 analysis: the entry is `0x10100`, file offset zero, with imposed real-mode segment
-context. PSP/stack/device state remains unmodeled. See [DOS guide](https://github.com/morluto/rea/blob/main/docs/ghidra-dos.md).
+context. PSP/stack/device state remains unmodeled. See [DOS guide](https://github.com/morluto/rea/blob/main/docs/providers/ghidra-dos.md).

 For other headerless images (embedded firmware without ELF/Mach-O/PE/MZ
 headers), open with `format: "raw-binary"`, `architecture` (`x86`, `x86_64`,
-`arm`, or `arm64`), and `entry_point` (`0x` hex). File offset 0 is mapped at
+`arm`, `arm64`, or `6502`), and `entry_point` (`0x` hex). File offset 0 is mapped at
 that address. Hopper and IDA refuse this interpretation; Ghidra uses
 `BinaryLoader` with a little-endian generic language. Big-endian, Thumb-only,
-and Cortex-M variants are unsupported. See [raw binary guide](https://github.com/morluto/rea/blob/main/docs/raw-binary.md).
+and Cortex-M variants are unsupported. `6502` selects NMOS 6502; the entry and
+complete file mapping must fit within `0x0000..0xffff`. 65C02, 65816, cartridge
+containers, bank switching, and mapper semantics are unsupported. Windows
+Ghidra P0 admits raw images only for `6502`. See [raw binary guide](https://github.com/morluto/rea/blob/main/docs/providers/raw-binary.md).

 ### Function annotations in Ghidra

@@ -233,4 +248,10 @@ code pages, payload hashes and static icon-group references. Same-language icon
 resolution is explicit; missing references and size mismatch remain visible.
 Other payloads are opaque, and this operation does not decode images or simulate
 Windows resource loading. Consult the budgets and supported tree profile in
-[offline binary diagnostics](https://github.com/morluto/rea/blob/main/docs/binary-diagnostics.md).
+[offline binary diagnostics](https://github.com/morluto/rea/blob/main/docs/guides/native/binary-diagnostics.md).
+
+For exact core-module import/export differences, use `compare_wasm_interfaces`
+with two complete inspection Evidence records (or current-session retained
+references) and explicit scope. Preserve unknown types/duplicate names; static
+interface equality is not runtime compatibility. CLI accepts complete inline
+Evidence in `rea compare-wasm-interfaces input.json --json`.
@@ -39,5 +39,5 @@ Inspect native `.saz` snapshots with `inspect_web_network_capture` and
 traffic analysis, connect Everywhere's separate MCP server and use its
 advertised session tools with an explicit `sessionsSource` (`LiveTraffic` or
 `AgentCalls`). Preserve existing sessions and filters when inspecting a
-recorded run. See the [capture and MCP guide](https://github.com/morluto/rea/blob/main/docs/web-network-captures.md)
+recorded run. See the [capture and MCP guide](https://github.com/morluto/rea/blob/main/docs/guides/web/web-network-captures.md)
 for the workflow and Telerik's public setup and traffic-debugging skills.
@@ -20,7 +20,7 @@ body:
    attributes:
      label: Documentation location
      description: Link the page, section, command, API, skill, or inline comment.
-      placeholder: README.md#quick-start or docs/mcp-contracts.md
+      placeholder: README.md#quick-start or docs/reference/mcp-contracts.md
    validations:
      required: true

@@ -1,14 +1,24 @@
 name: Portable build cache
-description: Reuse Turbo build outputs without serializing verification jobs.
+description: Restore portable Turbo build outputs from the current run or cross-run cache.
 inputs:
  save:
    description: Save newly built outputs after the job succeeds.
    default: "false"
+  build_cache_artifact:
+    description: Reuse portable Turbo outputs uploaded by the current workflow run.
+    default: ""
 runs:
  using: composite
  steps:
+    - name: Download portable build outputs from this workflow run
+      if: inputs.build_cache_artifact != ''
+      uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v4.3.0
+      with:
+        name: ${{ inputs.build_cache_artifact }}
+        path: .turbo/cache/
    - name: Resolve portable build task hashes
      id: plan
+      if: inputs.build_cache_artifact == ''
      shell: bash
      env:
        BUILD_CACHE_PREFIX: rea-portable-build-v2-${{ runner.os }}-${{ runner.arch }}-${{ hashFiles('.npmrc', '.nvmrc', 'package-lock.json') }}
@@ -28,15 +38,15 @@ runs:
            console.log(`prefix=${process.env.BUILD_CACHE_PREFIX}-`);
          ' >> "$GITHUB_OUTPUT"
    - name: Restore portable build outputs
-      if: inputs.save != 'true'
-      uses: actions/cache/restore@v4
+      if: inputs.build_cache_artifact == '' && inputs.save != 'true'
+      uses: actions/cache/restore@0057852bfaa89a56745cba8c7296529d2fc39830 # v4.3.0
      with:
        path: .turbo/cache/
        key: ${{ steps.plan.outputs.key }}
        restore-keys: ${{ steps.plan.outputs.prefix }}
    - name: Restore and save portable build outputs
-      if: inputs.save == 'true'
-      uses: actions/cache@v4
+      if: inputs.build_cache_artifact == '' && inputs.save == 'true'
+      uses: actions/cache@0057852bfaa89a56745cba8c7296529d2fc39830 # v4.3.0
      with:
        path: .turbo/cache/
        key: ${{ steps.plan.outputs.key }}
@@ -85,7 +85,7 @@ limits, security/privacy/containment implications, and meaningful proof gaps. --
  its new behavior and migration, and why compatibility/deprecation cannot
  preserve it. Every release increments minor, including breaking changes;
  keep breaking markers and migration notes so callers can assess compatibility.
-  See docs/releasing.md. -->
+  See docs/development/releasing.md. -->
 - Real Hopper/Ghidra, browser, or OS coverage:
 - Package or release metadata impact:
 - Security, privacy, process, or containment review:
@@ -0,0 +1,18 @@
+name: Full PR qualification
+
+on:
+  pull_request:
+    branches: [main, "release/*"]
+    types: [labeled]
+
+permissions:
+  contents: read
+  actions: read
+
+jobs:
+  qualification:
+    name: Qualify labeled PR revision
+    if: github.event.label.name == 'ci:full'
+    uses: ./.github/workflows/ci.yml
+    with:
+      source_sha: ${{ github.sha }}
@@ -0,0 +1,46 @@
+name: CI timings
+
+on:
+  schedule:
+    - cron: "17 * * * *"
+  workflow_dispatch:
+
+concurrency:
+  group: ci-timings-${{ github.repository }}
+  cancel-in-progress: false
+
+permissions:
+  contents: read
+  actions: read
+
+jobs:
+  report:
+    name: Collect recent completed workflow attempts
+    runs-on: ubuntu-latest
+    timeout-minutes: 5
+    steps:
+      # Consume only API data and execute batch code from the trusted default branch.
+      - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0
+        with:
+          ref: ${{ github.event.repository.default_branch }}
+          persist-credentials: false
+      - uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4.4.0
+        with:
+          node-version-file: .nvmrc
+      - name: Record queue, execution, and matched step timing
+        continue-on-error: true
+        env:
+          GH_TOKEN: ${{ github.token }}
+          CI_REPOSITORY: ${{ github.repository }}
+        run: node scripts/ci/job-timings-batch.mjs
+      - name: Upload CI timing artifacts
+        if: always() && hashFiles('.cache/ci-job-timings/*') != ''
+        continue-on-error: true
+        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
+        with:
+          name: ci-job-timings-batch
+          path: .cache/ci-job-timings/
+          include-hidden-files: true
+          if-no-files-found: error
+          overwrite: true
+          retention-days: 14
@@ -5,42 +5,44 @@ on:
    branches: [main]
  pull_request:
    branches: [main, "release/*"]
+  schedule:
+    - cron: "23 0-2,4-23 * * *"
+    - cron: "23 3 * * *"
  workflow_dispatch:
+  workflow_call:
+    inputs:
+      source_sha:
+        description: Exact qualification source; must match the caller revision.
+        required: true
+        type: string

 permissions:
  contents: read

 concurrency:
-  group: ci-${{ github.event.pull_request.number || github.ref }}
-  # The latest main push verifies the full tree, including earlier changes.
-  # Publication uses its own release workflow and concurrency group.
-  cancel-in-progress: true
+  # Complete qualification finishes even while main receives more pushes.
+  # Main feedback also finishes, coalescing newer pushes to one pending run.
+  # Scheduled/manual main runs coalesce to one active and the latest pending;
+  # release and label-triggered qualification use exact-revision groups.
+  group: ci-${{ (github.event_name == 'schedule' || github.event_name == 'workflow_dispatch' || inputs.source_sha != '' || contains(github.event.pull_request.labels.*.name, 'ci:full')) && 'qualification' || 'feedback' }}-${{ inputs.source_sha || github.event.pull_request.number || github.ref }}
+  cancel-in-progress: ${{ github.event_name == 'pull_request' && inputs.source_sha == '' && !contains(github.event.pull_request.labels.*.name, 'ci:full') }}

 env:
  HUSKY: "0"

 jobs:
-  pr-title:
-    name: Conventional PR title
-    if: github.event_name == 'pull_request'
-    runs-on: ubuntu-latest
-    steps:
-      - name: Validate title for Release Please
-        env:
-          PR_TITLE: ${{ github.event.pull_request.title }}
-        run: >-
-          node -e 'const title = process.env.PR_TITLE ?? "";
-          const conventional = /^(?:feat|fix|docs|refactor|perf|test|build|ci|chore|revert)(?:\([a-z0-9._/-]+\))?!?: .+/u;
-          if (!conventional.test(title)) {
-            console.error("PR title must use Conventional Commits, for example: feat: add historical source import");
-            process.exit(1);
-          }'
-
  changes:
    name: Classify changes
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-24.04
+    timeout-minutes: 5
+    permissions:
+      contents: read
+      actions: read
    outputs:
+      tier: ${{ steps.plan.outputs.tier }}
+      qualification_run_id: ${{ steps.qualification.outputs.run_id }}
      code: ${{ steps.plan.outputs.code }}
+      sqlite: ${{ steps.plan.outputs.sqlite }}
      runtime: ${{ steps.plan.outputs.runtime }}
      package: ${{ steps.plan.outputs.package }}
      apple: ${{ steps.plan.outputs.apple }}
@@ -59,37 +61,72 @@ jobs:
      nativeaot: ${{ steps.plan.outputs.nativeaot }}
      website: ${{ steps.plan.outputs.website }}
      matrix: ${{ steps.plan.outputs.matrix }}
+      test_selection: ${{ steps.plan.outputs.test_selection }}
    steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0
        with:
+          ref: ${{ inputs.source_sha || github.sha }}
          fetch-depth: 0
-      - uses: actions/setup-node@v4
+      - uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4.4.0
        with:
          node-version-file: .nvmrc
+      - name: Bind qualification to the caller revision
+        if: inputs.source_sha != ''
+        env:
+          SOURCE_SHA: ${{ inputs.source_sha }}
+        run: |
+          test "${SOURCE_SHA}" = "${GITHUB_SHA}"
+          test "${SOURCE_SHA}" = "$(git rev-parse HEAD)"
+      - name: Find a verified ancestor for push selection
+        id: baseline
+        if: github.event_name == 'push' && inputs.source_sha == ''
+        env:
+          GH_TOKEN: ${{ github.token }}
+          HEAD_SHA: ${{ github.sha }}
+          CI_REPOSITORY: ${{ github.repository }}
+          CI_DEFAULT_BRANCH: ${{ github.event.repository.default_branch }}
+        run: node scripts/ci/baseline.mjs
+      - name: Admit scheduled full qualification
+        id: qualification
+        if: github.event_name == 'schedule' && inputs.source_sha == ''
+        env:
+          GH_TOKEN: ${{ github.token }}
+          HEAD_SHA: ${{ github.sha }}
+          CI_REPOSITORY: ${{ github.repository }}
+          CI_REPOSITORY_ID: ${{ github.repository_id }}
+          CI_DEFAULT_BRANCH: ${{ github.event.repository.default_branch }}
+          CI_FORCE_FULL: ${{ github.event.schedule == '23 3 * * *' }}
+        run: node scripts/ci/qualification.mjs
      - name: Select verification lanes
        id: plan
        env:
-          BASE_SHA: ${{ github.event.pull_request.base.sha }}
-          HEAD_SHA: ${{ github.event.pull_request.head.sha }}
-          CI_FULL: ${{ contains(github.event.pull_request.labels.*.name, 'ci:full') }}
+          BASE_SHA: ${{ steps.baseline.outputs.base || github.event.pull_request.base.sha }}
+          BASELINE_REASON: ${{ steps.baseline.outputs.reason }}
+          HEAD_SHA: ${{ inputs.source_sha || github.event.pull_request.head.sha || github.sha }}
+          CI_FULL: ${{ inputs.source_sha != '' || contains(github.event.pull_request.labels.*.name, 'ci:full') }}
+          CI_SKIP_FULL: ${{ steps.qualification.outputs.run_full == 'false' }}
        run: node scripts/ci/plan.mjs

  static:
    name: Static checks
    needs: changes
-    if: ${{ !cancelled() }}
+    if: ${{ !cancelled() && needs.changes.outputs.tier != 'reused' }}
    runs-on: ubuntu-latest
+    timeout-minutes: 10
    steps:
      - name: Require successful change classification
        env:
          CHANGES_RESULT: ${{ needs.changes.result }}
        run: test "${CHANGES_RESULT}" = "success"
-      - uses: actions/checkout@v4
-      - uses: actions/setup-node@v4
+      - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0
+      - uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4.4.0
        with:
          node-version-file: .nvmrc
          cache: npm
      - run: npm ci
+      - name: Validate workflow syntax and expressions
+        if: needs.changes.outputs.workflows == 'true'
+        run: go run github.com/rhysd/actionlint/cmd/actionlint@v1.7.7 -shellcheck= -pyflakes=
      - if: needs.changes.outputs.code == 'true'
        run: npm run check:ci
      - if: needs.changes.outputs.code == 'true'
@@ -101,7 +138,7 @@ jobs:
        run: npm run format:check
      - name: Upload complete static diagnostics
        if: always() && needs.changes.outputs.code == 'true'
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
        with:
          name: static-check-reports
          path: .cache/static-checks/
@@ -114,25 +151,33 @@ jobs:
    needs: [changes, build]
    if: needs.changes.outputs.code == 'true'
    runs-on: ubuntu-latest
+    timeout-minutes: 30
    strategy:
      fail-fast: false
      matrix:
        shard: [1/6, 2/6, 3/6, 4/6, 5/6, 6/6]
    steps:
-      - uses: actions/checkout@v4
-      - uses: actions/setup-node@v4
+      - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0
+      - uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4.4.0
        with:
          node-version-file: .nvmrc
          cache: npm
      - run: npm ci
-      - uses: actions/download-artifact@v4
+      - uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v4.3.0
        with:
          name: rea-test-runtime
          path: .
-      - run: npm run test:ci:shard:run -- --shard=${{ matrix.shard }}
+      - name: Run complete portable suite with coverage
+        if: needs.changes.outputs.tier == 'full'
+        run: npm run test:ci:shard:run -- --shard=${{ matrix.shard }}
        env:
          REA_CI_TEST_HISTORY: .cache/ci-test-history/test-results.json
-      - uses: actions/upload-artifact@v4
+      - name: Run complete portable suite for fast feedback
+        if: needs.changes.outputs.tier == 'fast'
+        run: npm run test:run -- --reporter=default --reporter=blob --shard=${{ matrix.shard }}
+        env:
+          REA_CI_TEST_HISTORY: .cache/ci-test-history/test-results.json
+      - uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
        if: ${{ !cancelled() }}
        with:
          name: vitest-report-${{ strategy.job-index }}
@@ -145,14 +190,26 @@ jobs:
  build:
    name: Build package
    needs: changes
-    if: needs.changes.outputs.code == 'true'
+    # Reusable provider workflows consume this run's portable build artifact,
+    # even when a workflow-only edit selects the lane without portable tests.
+    if: >-
+      needs.changes.outputs.code == 'true' ||
+      needs.changes.outputs.browser == 'true' ||
+      needs.changes.outputs.binary_layout == 'true' ||
+      needs.changes.outputs.evm == 'true' ||
+      needs.changes.outputs.javascript_recovery == 'true' ||
+      needs.changes.outputs.recorded_crash == 'true' ||
+      needs.changes.outputs.web_network == 'true' ||
+      needs.changes.outputs.web_runtime == 'true' ||
+      needs.changes.outputs.web_source_map == 'true'
    runs-on: ubuntu-latest
+    timeout-minutes: 10
    permissions:
      contents: read
      actions: read
    steps:
-      - uses: actions/checkout@v4
-      - uses: actions/setup-node@v4
+      - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0
+      - uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4.4.0
        with:
          node-version-file: .nvmrc
          cache: npm
@@ -160,31 +217,27 @@ jobs:
      - name: Reuse portable build outputs across runs
        uses: ./.github/actions/portable-build-cache
        with:
-          save: "true"
+          save: ${{ github.event_name != 'pull_request' && github.ref == format('refs/heads/{0}', github.event.repository.default_branch) }}
      - run: npm run test:prepare
-      - name: Find successful default-branch timing history
+      - name: Find available trusted full-suite timing history
        id: history
        continue-on-error: true
        env:
          GH_TOKEN: ${{ github.token }}
          CI_REPOSITORY: ${{ github.repository }}
+          CI_REPOSITORY_ID: ${{ github.repository_id }}
          CI_DEFAULT_BRANCH: ${{ github.event.repository.default_branch }}
-        run: |
-          run_id="$(gh api --method GET \
-            "repos/${CI_REPOSITORY}/actions/workflows/ci.yml/runs" \
-            -f branch="${CI_DEFAULT_BRANCH}" -f event=push -f status=success -f per_page=1 \
-            --jq '.workflow_runs[0].id // empty')"
-          echo "run-id=${run_id}" >> "${GITHUB_OUTPUT}"
+        run: node scripts/ci/test-history.mjs
      - name: Download previous timing report
        if: steps.history.outputs.run-id != ''
        continue-on-error: true
-        uses: actions/download-artifact@v4
+        uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v4.3.0
        with:
          name: test-timings
          run-id: ${{ steps.history.outputs.run-id }}
          github-token: ${{ github.token }}
          path: .cache/ci-test-history
-      - uses: actions/upload-artifact@v4
+      - uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
        with:
          name: rea-test-runtime
          path: |
@@ -201,7 +254,7 @@ jobs:
      # test:prepare caches only portable JS, skill, and catalog outputs.
      # Native package jobs still run their build and prepack checks; Turbo
      # restores matching outputs or rebuilds when their inputs differ.
-      - uses: actions/upload-artifact@v4
+      - uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
        with:
          name: rea-build-cache
          path: .turbo/cache/
@@ -210,38 +263,46 @@ jobs:
          retention-days: 7

  sqlite-runtime:
-    needs: [changes, build]
-    if: needs.changes.outputs.code == 'true'
+    # Preserve all selected coverage, but admit expensive host/provider work
+    # only after static validation. Portable tests still provide early feedback.
+    needs: [changes, static, build]
+    if: needs.changes.outputs.sqlite == 'true'
    uses: ./.github/workflows/sqlite-runtime.yml

  test:
-    name: Test (coverage + timing)
+    name: Portable tests
    needs: [changes, test-shard]
-    if: ${{ !cancelled() }}
+    if: ${{ !cancelled() && needs.changes.outputs.tier != 'reused' }}
    runs-on: ubuntu-latest
+    timeout-minutes: 10
    steps:
      - name: Require successful change classification
        env:
          CHANGES_RESULT: ${{ needs.changes.result }}
        run: test "${CHANGES_RESULT}" = "success"
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0
        if: needs.changes.outputs.code == 'true' && success()
-      - uses: actions/setup-node@v4
+      - uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4.4.0
        if: needs.changes.outputs.code == 'true' && success()
        with:
          node-version-file: .nvmrc
          cache: npm
      - if: needs.changes.outputs.code == 'true' && success()
        run: npm ci
-      - uses: actions/download-artifact@v4
-        if: needs.changes.outputs.code == 'true' && success()
+      - uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v4.3.0
+        if: >-
+          !cancelled() && needs.changes.outputs.code == 'true' &&
+          (needs.test-shard.result == 'success' || needs.test-shard.result == 'failure')
        with:
          path: .vitest/blob
          pattern: vitest-report-*
          merge-multiple: true
      - name: Merge coverage, JUnit, and timing reports
        id: merge
-        if: needs.changes.outputs.code == 'true' && success()
+        if: >-
+          !cancelled() && needs.changes.outputs.code == 'true' &&
+          needs.changes.outputs.tier == 'full' &&
+          (needs.test-shard.result == 'success' || needs.test-shard.result == 'failure')
        run: >-
          npm run test:ci:merge --
          --coverage.reportsDirectory=coverage
@@ -251,27 +312,48 @@ jobs:
          --reporter=default
          --reporter=junit
          --reporter=json
+          --reporter=./scripts/ci/test-timing-reporter.mjs
+          --outputFile.junit=test-results.xml
+          --outputFile.json=test-results.json
+      - name: Merge fast-suite JUnit and timing reports
+        id: merge-fast
+        if: >-
+          !cancelled() && needs.changes.outputs.code == 'true' &&
+          needs.changes.outputs.tier == 'fast' &&
+          (needs.test-shard.result == 'success' || needs.test-shard.result == 'failure')
+        run: >-
+          npm exec -- vitest --merge-reports
+          --reporter=default
+          --reporter=junit
+          --reporter=json
+          --reporter=./scripts/ci/test-timing-reporter.mjs
          --outputFile.junit=test-results.xml
          --outputFile.json=test-results.json
      - name: Summarize slowest test files
-        if: needs.changes.outputs.code == 'true' && !cancelled() && hashFiles('test-results.json') != ''
+        if: needs.changes.outputs.code == 'true' && !cancelled() && hashFiles('test-timings.json') != ''
        env:
          SHARD_RESULT: ${{ needs.test-shard.result }}
-          MERGE_RESULT: ${{ steps.merge.outcome }}
+          MERGE_RESULT: ${{ needs.changes.outputs.tier == 'full' && steps.merge.outcome || steps.merge-fast.outcome }}
+          CI_VERIFY_TEST_INVENTORY: "true"
+          CI_TEST_SELECTION: ${{ needs.changes.outputs.test_selection }}
+          CI_PR_HEAD_SHA: ${{ github.event.pull_request.head.sha }}
        run: node scripts/ci/test-report.mjs
-      - uses: actions/upload-artifact@v4
+      - uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
        if: needs.changes.outputs.code == 'true' && !cancelled() && hashFiles('test-results.json') != ''
        with:
          name: test-results
          path: |
            test-results.xml
            test-results.json
+            test-timings.json
            coverage/
+            .cache/ci-test-selection/report.json
+          include-hidden-files: true
          if-no-files-found: error
          retention-days: 30
      - name: Publish successful timing history
-        if: needs.changes.outputs.code == 'true' && success() && needs.test-shard.result == 'success'
-        uses: actions/upload-artifact@v4
+        if: needs.changes.outputs.code == 'true' && needs.changes.outputs.tier == 'full' && success() && needs.test-shard.result == 'success'
+        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
        with:
          name: test-timings
          path: .cache/ci-test-history/test-results.json
@@ -287,24 +369,24 @@ jobs:

  conformance-fixtures:
    name: Source-built conformance fixtures
-    needs: changes
+    needs: [changes, static]
    if: needs.changes.outputs.fixtures == 'true'
    runs-on: ubuntu-latest
    timeout-minutes: 10
    steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0
      - name: Verify fixtures from a clean checkout
        run: npm run verify:fixtures

  windows-native-build:
    name: Build bundled Windows x64 native controls
-    needs: changes
+    needs: [changes, static]
    if: needs.changes.outputs.runtime == 'true'
    runs-on: ubuntu-latest
    timeout-minutes: 10
    steps:
-      - uses: actions/checkout@v4
-      - uses: actions/setup-node@v4
+      - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0
+      - uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4.4.0
        with:
          node-version-file: .nvmrc
      - name: Prepare cross compiler
@@ -321,12 +403,27 @@ jobs:
      - run: npm run build:windows-native
      - run: npm run verify:windows-native:artifact
      - run: node scripts/build-windows-native.mjs --inspection-fixture
-      - uses: actions/upload-artifact@v4
+      - uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
        with:
          name: windows-native-inspection-fixture
          path: .cache/windows-native-inspection-fixture/
          if-no-files-found: error
-      - uses: actions/upload-artifact@v4
+      # The process boundary observations are independent of the addon: they
+      # report the caller's and child's own token, environment and breakaway
+      # results from a separate executable. Cross-build it in the lane that
+      # already has MinGW so the Windows job can observe them too.
+      - name: Build Windows process boundary fixture
+        run: |
+          mkdir -p .cache/windows-process-boundary
+          x86_64-w64-mingw32-g++ -municode -std=c++17 -O2 -static -Wall -Wextra \
+            -o .cache/windows-process-boundary/process-boundary.exe \
+            tests/fixtures/windows/processBoundary.cc -ladvapi32
+      - uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
+        with:
+          name: windows-process-boundary-fixture
+          path: .cache/windows-process-boundary/
+          if-no-files-found: error
+      - uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
        with:
          name: windows-native-controls
          path: native/windows/build/
@@ -334,7 +431,7 @@ jobs:

  package-e2e:
    name: Native package baseline (${{ matrix.platform }} ${{ matrix.architecture }})
-    needs: [changes, build, windows-native-build]
+    needs: [changes, static, build, windows-native-build]
    if: needs.changes.outputs.runtime == 'true'
    strategy:
      fail-fast: false
@@ -349,8 +446,8 @@ jobs:
      NODE_OPTIONS: "--max-old-space-size=1024"
      UV_THREADPOOL_SIZE: "2"
    steps:
-      - uses: actions/checkout@v4
-      - uses: actions/setup-node@v4
+      - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0
+      - uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4.4.0
        with:
          node-version-file: .nvmrc
          cache: npm
@@ -364,15 +461,17 @@ jobs:
          assert.equal(process.arch, process.env.EXPECTED_CI_ARCHITECTURE);
          console.log(JSON.stringify({ platform: process.platform, architecture: process.arch, node: process.version }));"
      - run: npm ci
-      - uses: actions/download-artifact@v4
+      - uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v4.3.0
        with:
          name: rea-build-cache
          path: .turbo/cache/
-      - uses: actions/download-artifact@v4
+      - uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v4.3.0
        with:
          name: windows-native-controls
          path: native/windows/build/
      - run: npm run verify:windows-native:artifact
+      - name: Verify NativeAOT diagnostic applicability on this host
+        run: npm run test:focused -- tests/evaluation/package/nativeAotDiagnostics.test.ts
      - name: Resolve npm cache before verifier HOME isolation
        id: npm-cache
        run: |
@@ -381,24 +480,35 @@ jobs:
      - run: npm run verify:package
        env:
          npm_config_cache: ${{ steps.npm-cache.outputs.path }}
+          REA_VERIFIED_PACKAGE_DIRECTORY: ${{ needs.changes.outputs.tier == 'full' && matrix.platform == 'linux' && matrix.architecture == 'x64' && '.cache/verified-package' || '' }}
      - name: Verify real Node Inspector discovery and observation
        timeout-minutes: 10
        run: npm run verify:inspector
+      - name: Retain the exact qualified release package
+        if: needs.changes.outputs.tier == 'full' && matrix.platform == 'linux' && matrix.architecture == 'x64'
+        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
+        with:
+          name: verified-release-package
+          path: .cache/verified-package/
+          include-hidden-files: true
+          if-no-files-found: error
+          overwrite: true
+          retention-days: 7

  apple-artifacts:
    name: Real Apple artifact CLI/MCP E2E
-    needs: [changes, build]
+    needs: [changes, static, build]
    if: needs.changes.outputs.apple == 'true'
    runs-on: macos-15
    timeout-minutes: 15
    steps:
-      - uses: actions/checkout@v4
-      - uses: actions/setup-node@v4
+      - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0
+      - uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4.4.0
        with:
          node-version-file: .nvmrc
          cache: npm
      - run: npm ci
-      - uses: actions/download-artifact@v4
+      - uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v4.3.0
        with:
          name: rea-build-cache
          path: .turbo/cache/
@@ -435,13 +545,13 @@ jobs:

  reconstruction-readiness:
    name: Reconstruction readiness
-    needs: changes
+    needs: [changes, static]
    if: needs.changes.outputs.readiness == 'true'
    runs-on: ubuntu-latest
    timeout-minutes: 15
    steps:
-      - uses: actions/checkout@v4
-      - uses: actions/setup-node@v4
+      - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0
+      - uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4.4.0
        with:
          node-version-file: .nvmrc
          cache: npm
@@ -452,7 +562,7 @@ jobs:
        run: |
          set -o pipefail
          npm run verify:readiness | tee readiness-summary.json
-      - uses: actions/upload-artifact@v4
+      - uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
        if: ${{ !cancelled() }}
        with:
          name: reconstruction-readiness
@@ -464,23 +574,23 @@ jobs:

  windows-curated:
    name: Windows capability and package lane
-    needs: [changes, build, windows-native-build]
+    needs: [changes, static, build, windows-native-build]
    if: needs.changes.outputs.package == 'true'
    runs-on: windows-latest
    timeout-minutes: 25
    steps:
-      - uses: actions/checkout@v4
-      - uses: actions/setup-node@v4
+      - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0
+      - uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4.4.0
        with:
          node-version-file: .nvmrc
          cache: npm
      - run: npm ci
-      - uses: actions/download-artifact@v4
+      - uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v4.3.0
        with:
          name: rea-build-cache
          path: .turbo/cache/
      - run: npm run build:cached
-      - uses: actions/download-artifact@v4
+      - uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v4.3.0
        with:
          name: windows-native-controls
          path: native/windows/build/
@@ -509,7 +619,9 @@ jobs:
          tests/boundary/providers/native/artifactProvider.extractionCompleteness.test.ts
          tests/boundary/filesystem/setupUnavailableProvider.test.ts
          tests/boundary/filesystem/windowsNpxRegistration.test.ts
+          tests/boundary/android/workspaceGuardianRetry.test.ts
          tests/acceptance/setup/homeDirectoryFallback.test.ts
+          tests/boundary/filesystem/javascriptApplicationWorkflows.test.ts
          tests/boundary/filesystem/webScriptManifestPaths.test.ts
          tests/boundary/process/ProcessEvidence.host.test.ts
          tests/acceptance/webModuleCli.test.ts
@@ -534,8 +646,17 @@ jobs:
          src/application/Update.test.ts
          tests/process-global/updateMaintenance.test.ts
          tests/conformance/providers/ghidra/realGhidraWindowsWorkflow.test.ts
-      - run: npm run verify:windows-native
-      - uses: actions/download-artifact@v4
+      - uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v4.3.0
+        with:
+          name: windows-process-boundary-fixture
+          path: .cache/windows-process-boundary/
+      # Passing the fixture adds the breakaway, caller/child token, environment
+      # semantics and ancestor reparse observations, which the lane skips
+      # entirely when it is absent.
+      - run: >-
+          npm run verify:windows-native -- .
+          "${{ github.workspace }}\.cache\windows-process-boundary\process-boundary.exe"
+      - uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v4.3.0
        with:
          name: windows-native-inspection-fixture
          path: .cache/windows-native-inspection-fixture/
@@ -554,7 +675,7 @@ jobs:
          tests/boundary/filesystem/directoryArtifactReaderOpen.test.ts
          tests/boundary/filesystem/javascriptPackagePrecedence.test.ts
          tests/boundary/filesystem/javascriptArtifactContentIdentity.test.ts
-      - uses: actions/setup-node@v4
+      - uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4.4.0
        with:
          node-version: 22.19.0
      - name: Verify native path boundaries on Node 22
@@ -564,7 +685,7 @@ jobs:
          tests/boundary/filesystem/javascriptPackagePrecedence.test.ts
          tests/boundary/filesystem/javascriptArtifactContentIdentity.test.ts
          tests/boundary/process/sourceMapUncHosts.test.ts
-      - uses: actions/upload-artifact@v4
+      - uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
        if: always()
        with:
          name: windows-capabilities
@@ -576,17 +697,20 @@ jobs:
    needs: changes
    if: needs.changes.outputs.docs == 'true'
    runs-on: ubuntu-latest
+    timeout-minutes: 10
    steps:
-      - uses: actions/checkout@v4
-      - uses: actions/setup-node@v4
+      - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0
+      - uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4.4.0
        with:
          node-version-file: .nvmrc
          cache: npm
      - run: npm ci
      - run: npm run docs:check
+      - name: Verify published routes, source links and local anchors
+        run: npm run verify:docs:routes
      - name: Generation leaves authored files unchanged
        run: git diff --exit-code
-      - uses: actions/upload-artifact@v4
+      - uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
        with:
          name: generated-docs
          path: |
@@ -595,73 +719,79 @@ jobs:
            skills/reverse-engineer-anything
          if-no-files-found: error

-  workflows:
-    name: Validate workflows
-    needs: changes
-    if: needs.changes.outputs.workflows == 'true'
-    runs-on: ubuntu-latest
-    steps:
-      - uses: actions/checkout@v4
-      - name: Validate workflow syntax and expressions
-        run: go run github.com/rhysd/actionlint/cmd/actionlint@v1.7.7 -shellcheck= -pyflakes=
-
  browser:
-    needs: changes
+    needs: [changes, static, build]
    if: needs.changes.outputs.browser == 'true'
    uses: ./.github/workflows/real-browser.yml
+    with:
+      build_cache_artifact: rea-build-cache

  binary_layout:
-    needs: changes
+    needs: [changes, static, build]
    if: needs.changes.outputs.binary_layout == 'true'
    uses: ./.github/workflows/real-binary-layout.yml
+    with:
+      build_cache_artifact: rea-build-cache

  evm:
-    needs: changes
+    needs: [changes, static, build]
    if: needs.changes.outputs.evm == 'true'
    uses: ./.github/workflows/real-evm-interface.yml
+    with:
+      build_cache_artifact: rea-build-cache

  javascript_recovery:
-    needs: changes
+    needs: [changes, static, build]
    if: needs.changes.outputs.javascript_recovery == 'true'
    uses: ./.github/workflows/real-javascript-recovery.yml
+    with:
+      build_cache_artifact: rea-build-cache

  recorded_crash:
-    needs: changes
+    needs: [changes, static, build]
    if: needs.changes.outputs.recorded_crash == 'true'
    uses: ./.github/workflows/real-recorded-crash.yml
+    with:
+      build_cache_artifact: rea-build-cache

  web_network:
-    needs: changes
+    needs: [changes, static, build]
    if: needs.changes.outputs.web_network == 'true'
    uses: ./.github/workflows/real-web-network-captures.yml
+    with:
+      build_cache_artifact: rea-build-cache

  web_runtime:
-    needs: changes
+    needs: [changes, static, build]
    if: needs.changes.outputs.web_runtime == 'true'
    uses: ./.github/workflows/real-web-runtime.yml
+    with:
+      build_cache_artifact: rea-build-cache

  web_source_map:
-    needs: changes
+    needs: [changes, static, build]
    if: needs.changes.outputs.web_source_map == 'true'
    uses: ./.github/workflows/real-web-source-map.yml
+    with:
+      build_cache_artifact: rea-build-cache

  nativeaot:
-    needs: changes
+    needs: [changes, static]
    if: needs.changes.outputs.nativeaot == 'true'
    uses: ./.github/workflows/nativeaot-fixtures.yml

  website:
-    needs: changes
+    needs: [changes, static]
    if: needs.changes.outputs.website == 'true'
    uses: ./.github/workflows/website-check.yml

  required:
    name: CI required
+    # Report failed dependencies, but release superseded PR concurrency slots.
    if: ${{ !cancelled() }}
    needs:
      [
        changes,
-        pr-title,
        static,
        build,
        test-shard,
@@ -674,7 +804,6 @@ jobs:
        reconstruction-readiness,
        windows-curated,
        docs,
-        workflows,
        browser,
        binary_layout,
        evm,
@@ -686,13 +815,25 @@ jobs:
        nativeaot,
        website,
      ]
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-24.04
+    timeout-minutes: 5
    steps:
-      - uses: actions/checkout@v4
-      - uses: actions/setup-node@v4
+      - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0
+      - uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4.4.0
        with:
          node-version-file: .nvmrc
      - name: Require every selected lane to pass
+        id: gate
        env:
          CI_JOBS: ${{ toJSON(needs) }}
+          CI_QUALIFICATION_DIRECTORY: .cache/ci-qualification
        run: node scripts/ci/required.mjs
+      - name: Upload full qualification receipt artifact
+        if: needs.changes.outputs.tier == 'full' && success()
+        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
+        with:
+          name: ${{ steps.gate.outputs.receipt_name }}
+          path: ${{ steps.gate.outputs.receipt_path }}
+          if-no-files-found: error
+          overwrite: true
+          retention-days: 7
@@ -12,22 +12,23 @@ jobs:
    name: Build Windows x64 NativeAOT fixture
    # .NET 8.0.22's bundled linker discovery supports VS 2019/2022.
    runs-on: windows-2022
-    timeout-minutes: 15
+    # Two bounded restore attempts and one compile can each take five minutes.
+    timeout-minutes: 20
    env:
      DOTNET_CLI_TELEMETRY_OPTOUT: "1"
      DOTNET_PROCESSOR_COUNT: "1"
      COMPlus_GCHeapHardLimit: "30000000"
    steps:
-      - uses: actions/checkout@v4
-      - uses: actions/setup-node@v4
+      - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0
+      - uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4.4.0
        with:
          node-version-file: .nvmrc
-      - uses: actions/setup-dotnet@v4
+      - uses: actions/setup-dotnet@67a3573c9a986a3f9c594539f4ab511d57bb3ce9 # v4.3.1
        with:
          dotnet-version: "8.0.416"
      - name: Build benign fixture and independent byte oracle
        run: node scripts/generate-nativeaot-fixtures.mjs
-      - uses: actions/upload-artifact@v4
+      - uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
        with:
          name: nativeaot-win-x64-${{ github.event.pull_request.head.sha || github.sha }}
          path: |
@@ -19,10 +19,10 @@ jobs:
    runs-on: ubuntu-latest
    timeout-minutes: 10
    steps:
-      - uses: actions/checkout@v4
-      - uses: actions/setup-node@v4
+      - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0
+      - uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4.4.0
        with:
          node-version-file: .nvmrc
          cache: npm
      - run: npm ci
-      - run: npm run docs:build
+      - run: npm run verify:docs:routes
@@ -0,0 +1,29 @@
+name: PR title
+
+on:
+  pull_request:
+    branches: [main, "release/*"]
+    types: [opened, synchronize, reopened, edited]
+
+permissions: {}
+
+concurrency:
+  group: pr-title-${{ github.event.pull_request.number }}
+  cancel-in-progress: true
+
+jobs:
+  pr-title:
+    name: Conventional PR title
+    runs-on: ubuntu-24.04
+    timeout-minutes: 2
+    steps:
+      - name: Validate title for Release Please
+        env:
+          PR_TITLE: ${{ github.event.pull_request.title }}
+        run: >-
+          node -e 'const title = process.env.PR_TITLE ?? "";
+          const conventional = /^(?:feat|fix|docs|refactor|perf|test|build|ci|chore|revert)(?:\([a-z0-9._/-]+\))?!?: .+/u;
+          if (!conventional.test(title)) {
+            console.error("PR title must use Conventional Commits, for example: feat: add historical source import");
+            process.exit(1);
+          }'
@@ -8,14 +8,16 @@ on:
        type: boolean
        default: false
  workflow_call:
+    inputs:
+      build_cache_artifact:
+        description: Portable build cache artifact from the calling CI run.
+        required: false
+        type: string
+        default: ""

 permissions:
  contents: read

-concurrency:
-  group: real-binary-layout-${{ github.event.pull_request.number || github.ref }}
-  cancel-in-progress: true
-
 env:
  NODE_OPTIONS: --max-old-space-size=768
  HUSKY: "0"
@@ -26,13 +28,15 @@ jobs:
    runs-on: ubuntu-24.04
    timeout-minutes: 15
    steps:
-      - uses: actions/checkout@v4
-      - uses: actions/setup-node@v4
+      - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0
+      - uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4.4.0
        with:
          node-version-file: .nvmrc
          cache: npm
      - run: npm ci
      - uses: ./.github/actions/portable-build-cache
+        with:
+          build_cache_artifact: ${{ inputs.build_cache_artifact }}
      - name: Acquire exact upstream libraries in an isolated runner environment
        shell: bash
        run: |
@@ -2,12 +2,14 @@ name: Real browser verification

 on:
  workflow_call:
+    inputs:
+      build_cache_artifact:
+        description: Portable build cache artifact from the calling CI run.
+        required: false
+        type: string
+        default: ""
  workflow_dispatch:

-concurrency:
-  group: real-browser-${{ github.event.pull_request.number || github.ref }}
-  cancel-in-progress: ${{ github.event_name == 'pull_request' }}
-
 env:
  HUSKY: "0"

@@ -19,13 +21,15 @@ jobs:
    runs-on: ubuntu-latest
    timeout-minutes: 10
    steps:
-      - uses: actions/checkout@v4
-      - uses: actions/setup-node@v4
+      - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0
+      - uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4.4.0
        with:
          node-version-file: .nvmrc
          cache: npm
      - run: npm ci
      - uses: ./.github/actions/portable-build-cache
+        with:
+          build_cache_artifact: ${{ inputs.build_cache_artifact }}
      - run: npm run verify:browser
        env:
          REA_BROWSER_EXECUTABLE: /usr/bin/google-chrome
@@ -3,14 +3,16 @@ name: Real offline EVM interface
 on:
  workflow_dispatch:
  workflow_call:
+    inputs:
+      build_cache_artifact:
+        description: Portable build cache artifact from the calling CI run.
+        required: false
+        type: string
+        default: ""

 permissions:
  contents: read

-concurrency:
-  group: real-evm-interface-${{ github.event.pull_request.number || github.ref }}
-  cancel-in-progress: true
-
 env:
  NODE_OPTIONS: --max-old-space-size=768
  HUSKY: "0"
@@ -20,13 +22,15 @@ jobs:
    runs-on: ubuntu-24.04
    timeout-minutes: 15
    steps:
-      - uses: actions/checkout@v4
-      - uses: actions/setup-node@v4
+      - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0
+      - uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4.4.0
        with:
          node-version-file: .nvmrc
          cache: npm
      - run: npm ci
      - uses: ./.github/actions/portable-build-cache
+        with:
+          build_cache_artifact: ${{ inputs.build_cache_artifact }}
      - name: Acquire unchanged fixture compiler in isolated runner storage
        shell: bash
        run: |
@@ -39,3 +43,5 @@ jobs:
          echo "REA_VERIFY_SOLC_MODULE=${evm_fixture_root}/node_modules/solc/index.js" >> "${GITHUB_ENV}"
      - name: Verify source-owned compiled bytecode through public CLI and MCP
        run: npm run verify:evm:interface
+      - name: Verify content-hash-free and CBOR-free owned compiler artifacts
+        run: npm run verify:solidity:metadata
@@ -16,8 +16,8 @@ jobs:
    if: github.ref == 'refs/heads/main'
    runs-on: ubuntu-latest
    steps:
-      - uses: actions/checkout@v4
-      - uses: actions/setup-node@v4
+      - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0
+      - uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4.4.0
        with:
          node-version-file: .nvmrc
      - name: Prepare cross compiler
@@ -31,11 +31,25 @@ jobs:
          sudo apt-get install --no-install-recommends -y g++-mingw-w64-x86-64
      - run: npm run build:windows-native
      - run: npm run verify:windows-native:artifact
-      - uses: actions/upload-artifact@v4
+      - uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
        with:
          name: real-ghidra-windows-native
          path: native/windows/build/
          if-no-files-found: error
+      # The boundary observations need a separate Windows executable, which the
+      # native lane skips when it is absent. Cross-build it here, where MinGW is
+      # already installed, so the proof run observes them too.
+      - name: Build Windows process boundary fixture
+        run: |
+          mkdir -p .cache/windows-process-boundary
+          x86_64-w64-mingw32-g++ -municode -std=c++17 -O2 -static -Wall -Wextra \
+            -o .cache/windows-process-boundary/process-boundary.exe \
+            tests/fixtures/windows/processBoundary.cc -ladvapi32
+      - uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
+        with:
+          name: real-ghidra-windows-process-boundary
+          path: .cache/windows-process-boundary/
+          if-no-files-found: error

  verify:
    name: Real Ghidra 12.1.4 Windows x64 PE proof
@@ -45,17 +59,23 @@ jobs:
    runs-on: [self-hosted, Windows, x64, ghidra-12-1-2]
    timeout-minutes: 20
    steps:
-      - uses: actions/checkout@v4
-      - uses: actions/setup-node@v4
+      - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0
+      - uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4.4.0
        with:
          node-version-file: .nvmrc
      - run: npm ci
-      - uses: actions/download-artifact@v4
+      - uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v4.3.0
        with:
          name: real-ghidra-windows-native
          path: native/windows/build/
      - run: npm run verify:windows-native:artifact
-      - run: npm run verify:windows-native
+      - uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v4.3.0
+        with:
+          name: real-ghidra-windows-process-boundary
+          path: .cache/windows-process-boundary/
+      - run: >-
+          npm run verify:windows-native -- .
+          "${{ github.workspace }}\.cache\windows-process-boundary\process-boundary.exe"
      - name: Verify all admitted Windows Ghidra operations
        env:
          REA_ANALYSIS_PROVIDER: ghidra
@@ -88,7 +108,7 @@ jobs:
        env:
          REA_ANALYSIS_PROVIDER: ghidra
        run: npm run verify:ghidra:windows:package -- --x86 --dll | Tee-Object -FilePath windows-ghidra-x86-dll-package-proof.log
-      - uses: actions/upload-artifact@v4
+      - uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
        if: always()
        with:
          name: windows-ghidra-proof
@@ -44,12 +44,12 @@ jobs:
    runs-on: ubuntu-24.04
    timeout-minutes: 20
    steps:
-      - uses: actions/checkout@v4
-      - uses: actions/setup-node@v4
+      - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0
+      - uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4.4.0
        with:
          node-version-file: .nvmrc
          cache: npm
-      - uses: actions/setup-go@v5
+      - uses: actions/setup-go@40f1582b2485089dde7abd97c1529aa768e1baff # v5.6.0
        with:
          go-version: "1.26.1"
          cache: false
@@ -15,8 +15,8 @@ jobs:
    runs-on: ubuntu-24.04
    timeout-minutes: 25
    steps:
-      - uses: actions/checkout@v4
-      - uses: actions/setup-node@v4
+      - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0
+      - uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4.4.0
        with:
          node-version-file: .nvmrc
          cache: npm
@@ -36,8 +36,8 @@ jobs:
    runs-on: [self-hosted, Linux, hopper]
    timeout-minutes: 20
    steps:
-      - uses: actions/checkout@v4
-      - uses: actions/setup-node@v4
+      - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0
+      - uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4.4.0
        with:
          node-version-file: .nvmrc
          cache: npm
@@ -15,8 +15,8 @@ jobs:
    runs-on: [self-hosted, macOS, hopper]
    timeout-minutes: 20
    steps:
-      - uses: actions/checkout@v4
-      - uses: actions/setup-node@v4
+      - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0
+      - uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4.4.0
        with:
          node-version-file: .nvmrc
          cache: npm
@@ -2,15 +2,17 @@ name: Real JavaScript recovery

 on:
  workflow_call:
+    inputs:
+      build_cache_artifact:
+        description: Portable build cache artifact from the calling CI run.
+        required: false
+        type: string
+        default: ""
  workflow_dispatch:

 permissions:
  contents: read

-concurrency:
-  group: javascript-recovery-${{ github.event.pull_request.number || github.ref }}
-  cancel-in-progress: ${{ github.event_name == 'pull_request' }}
-
 env:
  HUSKY: "0"
  NODE_OPTIONS: "--max-old-space-size=768"
@@ -21,13 +23,15 @@ jobs:
    runs-on: ubuntu-latest
    timeout-minutes: 10
    steps:
-      - uses: actions/checkout@v4
-      - uses: actions/setup-node@v4
+      - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0
+      - uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4.4.0
        with:
          node-version-file: .nvmrc
          cache: npm
      - run: npm ci
      - uses: ./.github/actions/portable-build-cache
+        with:
+          build_cache_artifact: ${{ inputs.build_cache_artifact }}
      - name: Fetch pinned Wakaru release into the job workspace
        shell: bash
        run: |
@@ -43,15 +43,15 @@ jobs:
    runs-on: ubuntu-24.04
    timeout-minutes: 15
    steps:
-      - uses: actions/checkout@v4
-      - uses: actions/setup-node@v4
+      - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0
+      - uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4.4.0
        with:
          node-version-file: .nvmrc
          cache: npm
      - run: sudo apt-get update && sudo DEBIAN_FRONTEND=noninteractive apt-get install -y tshark util-linux python3
      - run: npm ci
      - run: npm run build:cached
-      - run: npm run test:focused -- src/process/LinuxResourceLimits.test.ts tests/boundary/captures/captureProvider.test.ts tests/boundary/captures/captureDescriptorCleanup.test.ts tests/boundary/captures/resourceLimits.test.ts tests/boundary/captures/packetOutput.test.ts tests/boundary/mcp/packetCaptureMcp.test.ts tests/boundary/cli/captureCleanup.test.ts
+      - run: npm run test:focused -- tests/boundary/captures/fieldDiscovery.test.ts src/process/LinuxResourceLimits.test.ts tests/boundary/captures/captureProvider.test.ts tests/boundary/captures/captureDescriptorCleanup.test.ts tests/boundary/captures/resourceLimits.test.ts tests/boundary/captures/packetOutput.test.ts tests/boundary/mcp/packetCaptureMcp.test.ts tests/boundary/cli/captureCleanup.test.ts
      - run: node scripts/verify-packet-capture.mjs
        env:
          REA_TSHARK_COMMAND: /usr/bin/tshark
@@ -3,14 +3,16 @@ name: Real recorded crash evidence
 on:
  workflow_dispatch:
  workflow_call:
+    inputs:
+      build_cache_artifact:
+        description: Portable build cache artifact from the calling CI run.
+        required: false
+        type: string
+        default: ""

 permissions:
  contents: read

-concurrency:
-  group: real-recorded-crash-${{ github.event.pull_request.number || github.ref }}
-  cancel-in-progress: true
-
 env:
  NODE_OPTIONS: --max-old-space-size=768
  HUSKY: "0"
@@ -23,13 +25,15 @@ jobs:
    runs-on: ubuntu-24.04
    timeout-minutes: 15
    steps:
-      - uses: actions/checkout@v4
-      - uses: actions/setup-node@v4
+      - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0
+      - uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4.4.0
        with:
          node-version-file: .nvmrc
          cache: npm
      - run: npm ci
      - uses: ./.github/actions/portable-build-cache
+        with:
+          build_cache_artifact: ${{ inputs.build_cache_artifact }}
      - name: Install GDB on the disposable CI runner
        shell: bash
        run: |
@@ -36,15 +36,15 @@ jobs:
    runs-on: ubuntu-24.04
    timeout-minutes: 15
    steps:
-      - uses: actions/checkout@v4
-      - uses: actions/setup-node@v4
+      - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0
+      - uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4.4.0
        with:
          node-version-file: .nvmrc
          cache: npm
      - run: sudo apt-get update && sudo apt-get install -y sigrok-cli util-linux python3
      - run: npm ci
      - run: npm run build:cached
-      - run: npm run test:focused -- src/process/LinuxResourceLimits.test.ts src/domain/signals/annotationTextWindow.test.ts tests/boundary/signals/recordingProvider.test.ts tests/boundary/signals/recordingDescriptorCleanup.test.ts tests/boundary/signals/resourceLimits.test.ts tests/boundary/mcp/signalRecordingMcp.test.ts tests/boundary/cli/signalCleanup.test.ts
+      - run: npm run test:focused -- tests/boundary/signals/decoderDiscovery.test.ts src/process/LinuxResourceLimits.test.ts src/domain/signals/annotationTextWindow.test.ts tests/boundary/signals/recordingProvider.test.ts tests/boundary/signals/recordingDescriptorCleanup.test.ts tests/boundary/signals/resourceLimits.test.ts tests/boundary/mcp/signalRecordingMcp.test.ts tests/boundary/cli/signalCleanup.test.ts
      - run: node scripts/verify-signal-recording.mjs
        env:
          REA_SIGROK_COMMAND: /usr/bin/sigrok-cli
@@ -18,7 +18,7 @@ jobs:
    runs-on: ubuntu-latest
    timeout-minutes: 45
    steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0
      - name: Download the pinned Termux app and verify its release checksum
        shell: bash
        run: |
@@ -38,7 +38,7 @@ jobs:
          sudo udevadm control --reload-rules
          sudo udevadm trigger --name-match=kvm
      - name: Build and capture a page inside Termux
-        uses: reactivecircus/android-emulator-runner@4c44018e59b437e86cdfc41da381398f93ed8808 # v2
+        uses: reactivecircus/android-emulator-runner@a421e43855164a8197daf9d8d40fe71c6996bb0d # v2.38.0
        with:
          api-level: 30
          arch: x86_64
@@ -50,7 +50,7 @@ jobs:
          script: bash scripts/verify/termux/emulator.sh
      - name: Upload Termux and Android diagnostics
        if: always()
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
        with:
          name: termux-browser-diagnostics
          path: ${{ runner.temp }}/rea-termux/diagnostics
@@ -3,14 +3,16 @@ name: Real historical web network captures
 on:
  workflow_dispatch:
  workflow_call:
+    inputs:
+      build_cache_artifact:
+        description: Portable build cache artifact from the calling CI run.
+        required: false
+        type: string
+        default: ""

 permissions:
  contents: read

-concurrency:
-  group: real-web-network-captures-${{ github.event.pull_request.number || github.ref }}
-  cancel-in-progress: true
-
 env:
  HUSKY: "0"
  NODE_OPTIONS: --max-old-space-size=768
@@ -20,8 +22,8 @@ jobs:
    runs-on: ubuntu-24.04
    timeout-minutes: 15
    steps:
-      - uses: actions/checkout@v4
-      - uses: actions/setup-node@v4
+      - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0
+      - uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4.4.0
        with:
          node-version-file: .nvmrc
          cache: npm
@@ -29,6 +31,8 @@ jobs:
        run: npm install --global npm@11.16.0
      - run: npm ci
      - uses: ./.github/actions/portable-build-cache
+        with:
+          build_cache_artifact: ${{ inputs.build_cache_artifact }}
      - name: Acquire fixed upstream native profile in runner temporary storage
        shell: bash
        run: |
@@ -1,12 +1,15 @@
 name: Real website runtime attribution
 on:
  workflow_call:
+    inputs:
+      build_cache_artifact:
+        description: Portable build cache artifact from the calling CI run.
+        required: false
+        type: string
+        default: ""
  workflow_dispatch:
 permissions:
  contents: read
-concurrency:
-  group: real-web-runtime-${{ github.event.pull_request.number || github.ref }}
-  cancel-in-progress: ${{ github.event_name == 'pull_request' }}
 env:
  HUSKY: "0"
 jobs:
@@ -14,13 +17,15 @@ jobs:
    runs-on: ubuntu-latest
    timeout-minutes: 10
    steps:
-      - uses: actions/checkout@v4
-      - uses: actions/setup-node@v4
+      - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0
+      - uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4.4.0
        with:
          node-version-file: .nvmrc
          cache: npm
      - run: npm ci
      - uses: ./.github/actions/portable-build-cache
+        with:
+          build_cache_artifact: ${{ inputs.build_cache_artifact }}
      - run: npm run verify:browser:runtime
        env:
          REA_BROWSER_EXECUTABLE: /usr/bin/google-chrome
@@ -1,12 +1,15 @@
 name: Real website source-map verification
 on:
  workflow_call:
+    inputs:
+      build_cache_artifact:
+        description: Portable build cache artifact from the calling CI run.
+        required: false
+        type: string
+        default: ""
  workflow_dispatch:
 permissions:
  contents: read
-concurrency:
-  group: real-web-source-map-${{ github.event.pull_request.number || github.ref }}
-  cancel-in-progress: ${{ github.event_name == 'pull_request' }}
 env:
  HUSKY: "0"
 jobs:
@@ -14,13 +17,15 @@ jobs:
    runs-on: ubuntu-latest
    timeout-minutes: 10
    steps:
-      - uses: actions/checkout@v4
-      - uses: actions/setup-node@v4
+      - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0
+      - uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4.4.0
        with:
          node-version-file: .nvmrc
          cache: npm
      - run: npm ci
      - uses: ./.github/actions/portable-build-cache
+        with:
+          build_cache_artifact: ${{ inputs.build_cache_artifact }}
      - name: Install the pinned compiler into an isolated fixture directory
        run: npm install --prefix "$RUNNER_TEMP/rea-web-source-map-compiler" --no-audit --no-fund --package-lock=false esbuild@0.25.10
      - run: npm run verify:browser:source-maps
@@ -48,7 +48,7 @@ jobs:
            echo "frozen=true" >> "$GITHUB_OUTPUT"
          fi

-      - uses: googleapis/release-please-action@v4
+      - uses: googleapis/release-please-action@5c625bfb5d1ff62eadeeb3772007f7f66fdcf071 # v4.4.1
        if: steps.editorial.outputs.frozen != 'true'
        with:
          token: ${{ secrets.RELEASE_PLEASE_TOKEN || secrets.GITHUB_TOKEN }}
@@ -70,13 +70,13 @@ jobs:
      sha: ${{ steps.release.outputs.sha }}
    steps:
      - name: Check out reviewed release merge
-        uses: actions/checkout@v6
+        uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0
        with:
          ref: ${{ github.event.pull_request.merge_commit_sha }}
          fetch-depth: 0
          persist-credentials: false

-      - uses: actions/setup-node@v6
+      - uses: actions/setup-node@249970729cb0ef3589644e2896645e5dc5ba9c38 # v6.5.0
        with:
          node-version-file: .nvmrc
          package-manager-cache: false
@@ -104,7 +104,7 @@ jobs:
          node scripts/release-notes.mjs publication --repository "$GH_REPO" \
            --source "$SOURCE_SHA" --pr "$RELEASE_PR"

-      - uses: googleapis/release-please-action@v4
+      - uses: googleapis/release-please-action@5c625bfb5d1ff62eadeeb3772007f7f66fdcf071 # v4.4.1
        id: release
        with:
          token: ${{ secrets.RELEASE_PLEASE_TOKEN || secrets.GITHUB_TOKEN }}
@@ -191,14 +191,14 @@ jobs:
          fi

      - name: Check out release controller and Git history
-        uses: actions/checkout@v6
+        uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0
        with:
          ref: ${{ github.sha }}
          fetch-depth: 0
          persist-credentials: false

      - name: Set up Node.js for checkpoint validation
-        uses: actions/setup-node@v6
+        uses: actions/setup-node@249970729cb0ef3589644e2896645e5dc5ba9c38 # v6.5.0
        with:
          node-version-file: .nvmrc
          package-manager-cache: false
@@ -226,7 +226,7 @@ jobs:
          node scripts/release-notes.mjs publication --repository "$GH_REPO" \
            --source "$SOURCE_SHA"

-      - uses: googleapis/release-please-action@v4
+      - uses: googleapis/release-please-action@5c625bfb5d1ff62eadeeb3772007f7f66fdcf071 # v4.4.1
        id: release
        with:
          # A dedicated credential starts PR CI automatically; the built-in
@@ -255,7 +255,7 @@ jobs:

      - name: Check out release pull request
        if: inputs.phase == 'prepare' && steps.release.outputs.prs_created == 'true'
-        uses: actions/checkout@v6
+        uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0
        with:
          ref: ${{ fromJSON(steps.release.outputs.pr).headBranchName }}
          fetch-depth: 0
@@ -263,7 +263,7 @@ jobs:

      - name: Set up Node.js for generated documentation
        if: inputs.phase == 'prepare' && steps.release.outputs.prs_created == 'true'
-        uses: actions/setup-node@v6
+        uses: actions/setup-node@249970729cb0ef3589644e2896645e5dc5ba9c38 # v6.5.0
        with:
          node-version-file: .nvmrc
          package-manager-cache: false
@@ -290,24 +290,36 @@ jobs:
        if: inputs.phase == 'prepare' && steps.release.outputs.prs_created == 'true'
        run: npm run docs:check && git diff --exit-code

-  publish:
-    name: Publish to npm
+  qualification:
+    name: Qualify exact release revision
    needs: [merged-release, release-please]
    if: >-
      always() && !cancelled() &&
      ((needs.merged-release.result == 'success' && needs.merged-release.outputs.release_created == 'true') ||
      (needs.release-please.result == 'success' && inputs.phase == 'publish' && needs.release-please.outputs.release_created == 'true'))
+    permissions:
+      contents: read
+      actions: read
+    uses: ./.github/workflows/ci.yml
+    with:
+      source_sha: ${{ needs.merged-release.outputs.sha || needs.release-please.outputs.sha }}
+
+  publish:
+    name: Publish to npm
+    needs: [merged-release, release-please, qualification]
+    if: >-
+      always() && !cancelled() && needs.qualification.result == 'success'
    runs-on: ubuntu-latest
    permissions:
      contents: read
      id-token: write
    steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0
        with:
          ref: ${{ needs.merged-release.outputs.sha || needs.release-please.outputs.sha }}
          persist-credentials: false

-      - uses: actions/setup-node@v6
+      - uses: actions/setup-node@249970729cb0ef3589644e2896645e5dc5ba9c38 # v6.5.0
        with:
          node-version-file: .nvmrc
          package-manager-cache: false
@@ -315,17 +327,20 @@ jobs:

      - run: npm ci

-      - name: Prepare Windows native build toolchain
-        run: sudo apt-get update && sudo apt-get install --no-install-recommends -y g++-mingw-w64-x86-64
+      - name: Download the exact qualified package
+        uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v4.3.0
+        with:
+          name: verified-release-package
+          path: .cache/verified-package/

-      - name: Build and verify bundled Windows native controls
-        run: npm run build:windows-native && npm run verify:windows-native:artifact
-
-      - name: Verify packaged release before publishing
-        run: npm run verify:package
+      - name: Verify qualified package provenance and digest
+        id: package
+        run: node scripts/ci/verified-package.mjs validate .cache/verified-package

      - name: Publish
        shell: bash
+        env:
+          VERIFIED_PACKAGE_TARBALL: ${{ steps.package.outputs.tarball }}
        run: |
          version="$(node --input-type=module -e 'import packageJson from "./package.json" with { type: "json" }; process.stdout.write(packageJson.version)')"
          published_version="$(npm view "rea-agents@${version}" version --json 2>/dev/null || true)"
@@ -333,7 +348,7 @@ jobs:
            echo "rea-agents@${version} is already published; verifying the existing package."
          else
            tag="$(node scripts/release-npm-tag.mjs "${version}")"
-            npm publish --access public --tag "${tag}"
+            npm publish "${VERIFIED_PACKAGE_TARBALL}" --access public --tag "${tag}"
          fi

      - name: Verify published CLI from npm
@@ -377,7 +392,7 @@ jobs:
      contents: read
      id-token: write
    steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0
        with:
          ref: ${{ needs.merged-release.outputs.sha || needs.release-please.outputs.sha }}
          persist-credentials: false
@@ -22,14 +22,14 @@ jobs:
        # The repository-pinned Node 24 version also runs the complete test suite.
        node: ["22.x", "24.15.0", "24.x", "26.x"]
    steps:
-      - uses: actions/checkout@v4
-      - uses: actions/setup-node@v4
+      - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0
+      - uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4.4.0
        with:
          node-version: ${{ matrix.node }}
          check-latest: true
          cache: npm
      - run: npm ci
-      - uses: actions/download-artifact@v4
+      - uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v4.3.0
        with:
          name: rea-test-runtime
          path: .
@@ -7,10 +7,6 @@ on:
 permissions:
  contents: read

-concurrency:
-  group: website-check-${{ github.event.pull_request.number || github.ref }}
-  cancel-in-progress: true
-
 jobs:
  check:
    name: Website checks
@@ -18,9 +14,9 @@ jobs:
    timeout-minutes: 10
    steps:
      - name: Check out the repository
-        uses: actions/checkout@v4
+        uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0
      - name: Set up Python for website assets
-        uses: actions/setup-python@v5
+        uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065 # v5.6.0
        with:
          python-version: "3.12"
          cache: pip
@@ -47,9 +47,9 @@ jobs:
            exit 1
          fi
      - name: Check out the repository
-        uses: actions/checkout@v4
+        uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0
      - name: Set up Python for website assets
-        uses: actions/setup-python@v5
+        uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065 # v5.6.0
        with:
          python-version: "3.12"
          cache: pip
@@ -74,9 +74,9 @@ jobs:
          )
          PY
      - name: Configure Pages
-        uses: actions/configure-pages@v5
+        uses: actions/configure-pages@983d7736d9b0ae728b81ab479565c72886d7745b # v5.0.0
      - name: Upload the website
-        uses: actions/upload-pages-artifact@v4
+        uses: actions/upload-pages-artifact@7b1f4a764d45c48632c6b24a0339c27f5614fb0b # v4.0.0
        with:
          path: website/_site

@@ -95,15 +95,15 @@ jobs:
    steps:
      - name: Check out publishing configuration
        if: inputs.target == 'both'
-        uses: actions/checkout@v4
+        uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0
      - name: Set up Node.js for Wrangler
        if: inputs.target == 'both'
-        uses: actions/setup-node@v4
+        uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4.4.0
        with:
          node-version-file: .nvmrc
      - name: Download the verified website
        if: inputs.target == 'both'
-        uses: actions/download-artifact@v4
+        uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v4.3.0
        with:
          name: github-pages
          path: ${{ runner.temp }}/website-archive
@@ -114,7 +114,7 @@ jobs:
          tar -xf "$RUNNER_TEMP/website-archive/artifact.tar" -C "$RUNNER_TEMP/rea-website-public"
      - name: Publish the website to Cloudflare
        if: inputs.target == 'both'
-        uses: cloudflare/wrangler-action@v4
+        uses: cloudflare/wrangler-action@953926a2e2182532811c01a25e53647d93bf07c0 # v4.1.3
        with:
          apiToken: ${{ secrets.CLOUDFLARE_API_TOKEN }}
          accountId: ${{ secrets.CLOUDFLARE_ACCOUNT_ID }}
@@ -123,7 +123,7 @@ jobs:
          command: deploy --cwd website --env production --assets "${{ runner.temp }}/rea-website-public"
      - name: Publish to GitHub Pages
        id: deployment
-        uses: actions/deploy-pages@v4
+        uses: actions/deploy-pages@d6db90164ac5ed86f2b6aed7e0febac5b3c0c03e # v4.0.5
      - name: Verify the selected published revisions
        env:
          PAGES_URL: ${{ steps.deployment.outputs.page_url }}
@@ -36,6 +36,7 @@ coverage/
 .vitest/
 .vitest-reports/
 test-results.xml
+test-timings.json
 .turbo/
 .cache/
 docs/.vitepress/cache/
@@ -72,3 +73,5 @@ Thumbs.db

 # Complete static website output, including generated language editions.
 website/_site/
+# Temporary translation output prepared before replacing the complete site.
+website/.i18n-*/
@@ -1,5 +1,5 @@
 {
-  "threshold": 3.0,
+  "threshold": 3.5,
  "reporters": ["consoleFull"],
  "ignore": [
    "node_modules/**",
@@ -14,7 +14,7 @@ Preserve caller-selected inputs and local evidence, including output, URLs, path

 ## Architecture and Cleanup

-Dependencies flow inward: domain semantics and contracts, provider adapters, shared application workflows, then CLI/MCP adapters. Keep engine protocols and provider-specific code out of domain/application layers. See [docs/architecture.mermaid](docs/architecture.mermaid) when changing composition.
+Dependencies flow inward: domain semantics and contracts, provider adapters, shared application workflows, then CLI/MCP adapters. Keep engine protocols and provider-specific code out of domain/application layers. See [docs/architecture/architecture.mermaid](docs/architecture/architecture.mermaid) when changing composition.

 Give each interpretation and resource a clear owner. Consumers must use that owner's parsed facts rather than reinterpret raw source. Preserve identity, omission, uncertainty, and source evidence across boundaries. Retain ownership of resources whose cleanup failed. Reuse `src/process/` supervision and identity primitives; a PID and executable path alone do not establish ownership after exit or reuse.

@@ -57,6 +57,12 @@ do not establish fewer tokens or faster analysis.

 ## Development

+Documentation ownership and authoring conventions live in
+[docs/development/documentation.md](docs/development/documentation.md). A feature
+uses `docs/specs/<domain>/<feature-slug>/spec.md`, one `plan.md` and `tasks.md`;
+individual architectural decisions use `docs/adr/<domain>/<decision-slug>.md`.
+Consult the [documentation directory](docs/README.md) before adding a guide.
+
 Use [.nvmrc](.nvmrc) and `package.json#packageManager` for the pinned toolchain. Cursor Cloud may place older Node.js first on `PATH`; environment setup installs the pinned toolchain under `/usr/local/bin`.

 - `npm ci`: install locked dependencies.
@@ -72,9 +78,9 @@ Use relevant checks for the change. The complete local gate, `npm run check:pr`,

 ## Tool and Test Changes

-For tool design, follow [docs/tool-design.md](docs/tool-design.md): start from the analyst question, reuse existing contracts, preserve caller choices, and return useful evidence inline. Limits must follow real format, protocol, authority, or resource constraints. Account for representation expansion before allocation; derive completeness from examined coverage.
+For tool design, follow [docs/development/tool-design.md](docs/development/tool-design.md): start from the analyst question, reuse existing contracts, preserve caller choices, and return useful evidence inline. Limits must follow real format, protocol, authority, or resource constraints. Account for representation expansion before allocation; derive completeness from examined coverage.

-For test changes or provider claims, use [docs/testing.md](docs/testing.md). Prefer real public CLI/MCP workflows, then production-boundary integration, then producer goldens. Keep module tests for distinct semantics stronger workflows cannot reliably reproduce. Preserve malformed-input, cancellation, cleanup, permission, capacity, and target-identity coverage when pruning. Report unverified coverage explicitly; simulated providers do not establish real-provider behavior.
+For test changes or provider claims, use [docs/development/testing.md](docs/development/testing.md). Prefer real public CLI/MCP workflows, then production-boundary integration, then producer goldens. Keep module tests for distinct semantics stronger workflows cannot reliably reproduce. Preserve malformed-input, cancellation, cleanup, permission, capacity, and target-identity coverage when pruning. Report unverified coverage explicitly; simulated providers do not establish real-provider behavior.

 Use Conventional Commit subjects and PR titles. Mark breaking changes with `!` or a `BREAKING CHANGE:` footer. Describe behavior changes, relevant validation, and real-provider verification scope.

@@ -69,7 +69,7 @@ Full contribution record: [336 commits and 163 merged PRs](https://github.com/mo

 ### ⚠ BREAKING CHANGES

-* **captures:** Historical captures without current producer accounting or transaction identity, and web diffs missing accessibility or storage dimensions, are rejected. Preserve original captures and recapture with the current producer; update comparison consumers to include every dimension rather than synthesizing missing observations. See the [process capture guide](docs/process-capture.md) and [browser scenario contract](docs/browser-scenario-contract.md). ([3283a45](https://github.com/morluto/rea/commit/3283a45d09457c79e3adadb50a48620926d4bc5b))
+* **captures:** Historical captures without current producer accounting or transaction identity, and web diffs missing accessibility or storage dimensions, are rejected. Preserve original captures and recapture with the current producer; update comparison consumers to include every dimension rather than synthesizing missing observations. See the [process capture guide](docs/guides/runtime/process-capture.md) and [browser scenario contract](docs/guides/web/browser-scenario-contract.md). ([3283a45](https://github.com/morluto/rea/commit/3283a45d09457c79e3adadb50a48620926d4bc5b))
 * **browser:** JSON shape paths now contain typed property and array-element segments. WebMCP input_schema_shape is replaced by input_schema and input_schema_sha256, retaining declared examples and defaults.
 * **process:** Filesystem digest omission entries now require system_code; budget and changed-file omissions use null, and unavailable-file omissions preserve the operating-system error code.
 * **contracts:** Provider analysis outputs must explicitly supply metadata previously repaired with defaults; unsupported nullable facets must be reported as null.
@@ -237,7 +237,7 @@ Full contribution record: [336 commits and 163 merged PRs](https://github.com/mo

 ### ⚠ BREAKING CHANGES

-Read the [6.1 to 6.2 migration guide](docs/migration-6.2.md) before upgrading. REA's `always-bump-minor` policy includes breaking changes; 6.2 is not a backward-compatibility promise. Preserve original saved files and regenerate missing observations rather than fabricating identities or facts.
+Read the [6.1 to 6.2 migration guide](docs/migrations/migration-6.2.md) before upgrading. REA's `always-bump-minor` policy includes breaking changes; 6.2 is not a backward-compatibility promise. Preserve original saved files and regenerate missing observations rather than fabricating identities or facts.

 * **MCP / Evidence / snapshots / artifacts:** Success results are direct canonical Evidence; read `normalized_result` rather than the old `result`/`evidence` wrapper. Evidence requires nullable `analysis_profile`, session provider aliases are removed, snapshots require complete profile-bound query records, and artifact roles/permissions belong to occurrences. Recreate incompatible saved data; adding fields without recomputing their semantic identity is invalid. ([63bf914](https://github.com/morluto/rea/commit/63bf91405cf97b114a84f337fb1272d98a267999))
 * **Process captures:** Legacy v3 conversion is removed. Explicit executable identity and `event_journal` are required; retain old captures and recapture when current comparisons are needed instead of inventing launch identity or event order. ([2a77469](https://github.com/morluto/rea/commit/2a7746998d47446c4db6d4f524e0f183d6803f3f))
@@ -11,7 +11,7 @@ incorrect user instructions warrant standalone corrections. Collect other
 cosmetic-only suggestions in an issue rather than separate PRs.

 For capability organization and provider composition, use the
-[architecture map](docs/architecture.mermaid). Production factories in
+[architecture map](docs/architecture/architecture.mermaid). Production factories in
 `src/composition/` construct fresh providers without starting engines or acquiring
 targets; optional adapter failures must preserve successful peers. Run
 `npm run verify:test-discovery` after adding or moving tests. Resolved import
@@ -22,7 +22,7 @@ For analysis workflows and agent interfaces, follow the
 scope, reuse/cache decisions, and relevant before/after measurements when these
 costs change.

-When adding or changing an MCP tool, follow the [tool design guide](docs/tool-design.md) and preserve the canonical contracts and generated catalog.
+When adding or changing an MCP tool, follow the [tool design guide](docs/development/tool-design.md) and preserve the canonical contracts and generated catalog.

 ## Contribution scope

@@ -124,7 +124,7 @@ guarantee.
 Use the development toolchain pinned in `.nvmrc` and
 `package.json#packageManager`. Run `nvm use` before installing dependencies;
 installed-package runtime support is documented in
-[installation](docs/installation.md#start-setup).
+[installation](docs/getting-started/installation.md#start-setup).

 ```bash
 npm ci
@@ -142,8 +142,27 @@ caches deterministic builds and static checks across Git worktrees. After a pack
 Repository invariants live in [AGENTS.md](AGENTS.md). Keep provider-specific
 protocols in adapters and shared CLI/MCP workflows in the application layer.

+### Windows source checkouts
+
+The published npm package includes the Windows x64 native addon and its
+manifest. A source checkout does not: `native/windows/build/` is ignored by
+Git, and neither `npm ci` nor `npm run build:cached` (or `npm run build`)
+produces `rea-windows-x64.node` or `manifest.json` in that directory.
+Windows workflows and tests that require native controls need these artifacts;
+without them, those controls are unavailable even after a successful runtime build.
+
+Follow the [Windows native build guide](native/windows/README.md#build) before
+running those workflows from source. The artifact build requires Linux,
+MinGW-w64, and `tar`; the build script does not run on Windows. See that guide
+for the build and artifact-verification commands and the separate real Windows
+verification prerequisites. Keep the generated addon and manifest uncommitted.
+
 ## Documentation website

+Use the [documentation directory](docs/README.md) and
+[authoring guide](docs/development/documentation.md) for document ownership,
+domain-based feature specifications and architectural decision records.
+
 The VitePress site uses the Markdown files in `docs/`. Run `npm run docs:dev`
 for live editing, `npm run docs:build` to check the production build and
 links, and `npm run docs:preview` to preview that build at `/rea/`.
@@ -166,6 +185,10 @@ The separate GitHub Pages host uses only the manual

 ## Development feedback and PR verification

+For routine merges, wait for the required checks to pass for the current PR
+revision. Administrators retain an override for deliberate maintainer recovery.
+If `main` is broken, prioritize a focused repair before updating affected PRs.
+
 Select checks for the behavior changed. For a source edit:

 ```bash
@@ -176,7 +199,7 @@ npm run check:fast
 `test:local` runs source tests without building. `check:changed` combines cached
 static checks with source tests affected since the merge base with `origin/main`.
 Import-graph selection can miss runtime registration, bridges, and generated data;
-select relevant boundary tests explicitly. See [testing](docs/testing.md#developer-commands)
+select relevant boundary tests explicitly. See [testing](docs/development/testing.md#developer-commands)
 for commands, test placement, pruning, and real-provider prerequisites.

 Before requesting review, run relevant tests and `npm run check`; add
@@ -187,6 +210,10 @@ CI diagnosis. Packaging/setup/distribution changes additionally require
 `npm run verify:package` and `npm pack --dry-run`; provider changes require the
 matching real-provider lane. State which host/provider workflows ran.

+For CI/test correctness, drift, or performance investigations, use the
+[`rea-ci-tests-audit` contributor skill](.agents/skills/rea-ci-tests-audit/SKILL.md).
+It guides reproduction and comparable measurements before changing checks.
+
 `check:pr` reuses build and static-check outputs while executing the test suite
 fresh, including the fast Python producer checks. `docs:check` also runs the
 onboarding example consistency suite for README-only changes.
@@ -239,8 +266,8 @@ Run `npm run verify:hopper` on a supported macOS host or
 `npm run verify:hopper:linux` on the supported Linux demo runner. These build
 native fixtures and verify the installed engine through CLI/MCP; package or
 simulated-provider checks do not establish engine behavior. See
-[real-toolchain verification](docs/testing.md#end-to-end-integration-and-golden-evidence)
-for prerequisites and scope, and [Hopper setup](docs/installation.md#hopper)
+[real-toolchain verification](docs/development/testing.md#end-to-end-integration-and-golden-evidence)
+for prerequisites and scope, and [Hopper setup](docs/getting-started/installation.md#hopper)
 for supported hosts and unattended startup.

 Use the default `build/conformance/manifest.json` unless explicitly verifying
@@ -249,7 +276,7 @@ Generated fixtures and manifests remain ignored.

 ## Maintainer release checklist

-Use the [release guide](docs/releasing.md). Main pushes automatically refresh a
+Use the [release guide](docs/development/releasing.md). Main pushes automatically refresh a
 Release Please PR with the next version and changelog. Review its migration
 notes, wait for the current CI checks to pass, and merge it into main to publish.

@@ -1,6 +1,6 @@
 <div align="center">

-**English** · [简体中文](README_zh.md) · [繁體中文](README_zh-TW.md) · [日本語](README_ja.md) · [한국어](README_ko.md) · [Türkçe](README_tr.md) · [Русский](README_ru.md) · [Tiếng Việt](README_vi.md) · [ไทย](README_th.md) · [Deutsch](README_de.md) · [Español](README_es.md) · [Français](README_fr.md) · [Українська](README_uk.md) · [Polski](README_pl.md) · [Português (Brasil)](README_pt-BR.md) · [العربية](README_ar.md) · [فارسی](README_fa.md) · [Bahasa Indonesia](README_id.md) · [Italiano](README_it.md)
+**English** · [简体中文](docs/readme/README_zh.md) · [繁體中文](docs/readme/README_zh-TW.md) · [日本語](docs/readme/README_ja.md) · [한국어](docs/readme/README_ko.md) · [Türkçe](docs/readme/README_tr.md) · [Русский](docs/readme/README_ru.md) · [Tiếng Việt](docs/readme/README_vi.md) · [ไทย](docs/readme/README_th.md) · [Deutsch](docs/readme/README_de.md) · [Español](docs/readme/README_es.md) · [Français](docs/readme/README_fr.md) · [Українська](docs/readme/README_uk.md) · [Polski](docs/readme/README_pl.md) · [Português (Brasil)](docs/readme/README_pt-BR.md) · [العربية](docs/readme/README_ar.md) · [فارسی](docs/readme/README_fa.md) · [Bahasa Indonesia](docs/readme/README_id.md) · [Italiano](docs/readme/README_it.md)

 # REA: Reverse Engineer Anything

@@ -9,7 +9,7 @@
 **See a feature you like. Understand how it works, down to the binary level.**

 [![npm version](https://img.shields.io/npm/v/rea-agents?style=flat-square&color=cb3837)](https://www.npmjs.com/package/rea-agents)
-[![MCP tool catalog](https://img.shields.io/badge/MCP-tool_catalog-5c4ee5?style=flat-square)](docs/mcp-contracts.md#generated-catalog)
+[![MCP tool catalog](https://img.shields.io/badge/MCP-tool_catalog-5c4ee5?style=flat-square)](docs/reference/mcp-contracts.md#generated-catalog)
 [![Node.js requirements](https://img.shields.io/badge/Node.js-requirements-339933?style=flat-square&logo=nodedotjs&logoColor=white)](#what-you-can-analyze)
 [![skills.sh](https://skills.sh/b/morluto/rea?style=flat-square)](https://skills.sh/morluto/rea/reverse-engineer-anything)
 [![MIT license](https://img.shields.io/badge/license-MIT-f4c430?style=flat-square)](LICENSE)
@@ -70,8 +70,8 @@ REA's MCP server and matching workflow instructions, with backups of existing
 configuration. Restart your agent afterward.

 Setup supports Claude Code, Codex, Cursor, Gemini CLI, Grok Build and
-[other agents](docs/installation.md#supported-agents). See
-[installation and setup](docs/installation.md) for provider configuration and
+[other agents](docs/getting-started/installation.md#supported-agents). See
+[installation and setup](docs/getting-started/installation.md) for provider configuration and
 manual MCP registration.

 ### Ask your agent
@@ -102,7 +102,7 @@ rea --help
 ```

 For native analysis, configure a provider first. See the
-[CLI and Evidence guide](docs/cli.md) for native commands, provider selection,
+[CLI and Evidence guide](docs/getting-started/cli.md) for native commands, provider selection,
 snapshots and scripting.

 ### Update REA
@@ -150,30 +150,30 @@ CLI commands use the same workflows.
 REA requires Node.js 22.x (>=22.19), 24.x (>=24.11), or 26+, plus npm.
 Additional tools and host support depend on the target:

-| Target                 | What REA returns                                                                     | Requirements and guide                                                                                                                |
-| ---------------------- | ------------------------------------------------------------------------------------ | ------------------------------------------------------------------------------------------------------------------------------------- |
-| Native binaries        | Pseudocode, assembly, strings, symbols, calls and references                         | Hopper, Ghidra or IDA; [native analysis](https://rea.tools/guides/native/)                                                            |
-| Offline ELF layout     | Sections, segments, original symbols/relocations and static mitigation candidates    | Caller-supplied pwntools on Linux x64; [binary diagnostics](docs/binary-diagnostics.md)                                               |
-| Go binaries            | Embedded compiler version, modules, replacements and build settings                  | Built-in static ELF/PE/thin Mach-O inspection; no Go installation required                                                            |
-| WASM artifact          | Validation, sections, exact import/export WAT forms and decoded WAT                  | Caller-supplied WABT 1.0.42; `inspect_wasm_artifact`                                                                                  |
-| EVM bytecode           | Dispatch selectors, byte offsets, inferred arguments and mutability                  | Local raw/hex carrier on Linux x64; [offline EVM guide](docs/evm-bytecode.md)                                                         |
-| SQLite databases       | Tables, columns, indexes, views, triggers and selected ordinary-table rows           | Local database/WAL snapshot; Node.js 24.x >=24.15 or 26+ with native SQLite limits                                                    |
-| Recorded Linux crashes | Raw notes, every recorded thread's registers/signals and optional mapping candidates | Caller-supplied pwntools on Linux x64; optional GDB/pwndbg; [recorded crashes](docs/recorded-crashes.md)                              |
-| JavaScript / Electron  | Modules, imports, source maps, routes, IPC and native add-on relationships           | Node.js and npm; [application analysis](https://rea.tools/guides/javascript/)                                                         |
-| Websites               | Page structure, scripts, network observations and requested screenshots              | A Chrome-family browser; [browser analysis](https://rea.tools/guides/browser/)                                                        |
-| Saved network captures | Requests, responses, exposed payloads and source locations                           | HAR or Fiddler Everywhere SAZ; mitmdump on Linux for native mitmproxy; [capture guide](docs/web-network-captures.md)                  |
-| .NET assemblies        | Metadata, CIL instructions, declared native dependencies and build comparisons       | None (static only); [managed-code guide](docs/managed-code-analysis.md)                                                               |
-| Android APKs           | Manifest declarations, classes, decompiled methods and references                    | Headless JADX and a full JDK on Linux/macOS/Windows x64; [Android guide](docs/android-analysis.md)                                    |
-| Android devices        | Devices, packages, processes, logs, dumps, screen captures, and APK/file transfers   | Caller-supplied adb (emulator or hardware); [ADB guide](docs/adb-device-analysis.md)                                                  |
-| JEB projects           | Engine-backed project units, artifact digests and type/method pseudo-code            | A caller-started JEB client serving MCP, selected with REA_JEB_MCP_URL; [JEB guide](docs/jeb-analysis.md)                             |
-| Android resources      | Decoded manifest, string tables, locales and version facts                           | Caller-supplied Apktool launcher; [resource guide](docs/apktool-resource-analysis.md)                                                 |
-| Flutter apps           | Dart snapshot hash, per-ABI library digests and engine build provenance              | None (static APK parsing); [Flutter guide](docs/flutter-analysis.md)                                                                  |
-| Firmware               | Regions, extraction results and native-analysis handoffs                             | Binwalk / Unblob on Linux; [firmware guide](docs/firmware-analysis.md)                                                                |
-| Recorded packets       | Selected fields, repeated values, filters and decode-as rules                        | Linux: TShark 4.x + prlimit; [capture guide](docs/packet-captures.md)                                                                 |
-| Packet summaries       | Endpoints, DNS, TLS SNI, protocol distribution and HTTP requests                     | Caller-supplied tshark and capinfos (Linux-verified); [pcap guide](docs/pcap-analysis.md)                                             |
-| Recorded logic signals | Decoder annotations, sample ranges and diagnostics                                   | Linux: sigrok-cli 0.7.2 + prlimit; [signal recordings](docs/signal-recordings.md)                                                     |
-| Packages and resources | File inventories, digests, plists, Apple bundle anatomy and extracted resources      | [Artifact and JavaScript guide](docs/javascript-artifact-reconstruction.md), [Apple applications](docs/apple-application-analysis.md) |
-| Process behavior       | Terminal output, interactions, exit and filesystem observations, and run comparisons | Linux/macOS with a native PTY; [process capture](docs/process-capture.md)                                                             |
+| Target                 | What REA returns                                                                     | Requirements and guide                                                                                                                                               |
+| ---------------------- | ------------------------------------------------------------------------------------ | -------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
+| Native binaries        | Pseudocode, assembly, strings, symbols, calls and references                         | Hopper, Ghidra or IDA; [native analysis](https://rea.tools/guides/native/)                                                                                           |
+| Offline ELF layout     | Sections, segments, original symbols/relocations and static mitigation candidates    | Caller-supplied pwntools on Linux x64; [binary diagnostics](docs/guides/native/binary-diagnostics.md)                                                                |
+| Go binaries            | Embedded compiler version, modules, replacements and build settings                  | Built-in static ELF/PE/thin Mach-O inspection; no Go installation required                                                                                           |
+| WASM artifact          | Validation, sections, exact import/export WAT forms and decoded WAT                  | Caller-supplied WABT 1.0.42; `inspect_wasm_artifact`                                                                                                                 |
+| EVM bytecode           | Dispatch selectors, byte offsets, inferred arguments and mutability                  | Local raw/hex carrier on Linux x64; [offline EVM guide](docs/guides/evm/evm-bytecode.md)                                                                             |
+| SQLite databases       | Tables, columns, indexes, views, triggers and selected ordinary-table rows           | Local database/WAL snapshot; Node.js 24.x >=24.15 or 26+ with native SQLite limits                                                                                   |
+| Recorded Linux crashes | Raw notes, every recorded thread's registers/signals and optional mapping candidates | Caller-supplied pwntools on Linux x64; optional GDB/pwndbg; [recorded crashes](docs/guides/native/recorded-crashes.md)                                               |
+| JavaScript / Electron  | Modules, imports, source maps, routes, IPC and native add-on relationships           | Node.js and npm; [application analysis](https://rea.tools/guides/javascript/)                                                                                        |
+| Websites               | Page structure, scripts, network observations and requested screenshots              | A Chrome-family browser; [browser analysis](https://rea.tools/guides/browser/)                                                                                       |
+| Saved network captures | Requests, responses, exposed payloads and source locations                           | HAR or Fiddler Everywhere SAZ; mitmdump on Linux for native mitmproxy; [capture guide](docs/guides/web/web-network-captures.md)                                      |
+| .NET assemblies        | Metadata, CIL instructions, declared native dependencies and build comparisons       | None (static only); [managed-code guide](docs/guides/managed/managed-code-analysis.md)                                                                               |
+| Android APKs           | Manifest declarations, classes, decompiled methods and references                    | Headless JADX and a full JDK on Linux/macOS/Windows x64; [Android guide](docs/guides/android/android-analysis.md)                                                    |
+| Android devices        | Devices, packages, processes, logs, dumps, screen captures, and APK/file transfers   | Caller-supplied adb (emulator or hardware); [ADB guide](docs/guides/android/adb-device-analysis.md)                                                                  |
+| JEB projects           | Engine-backed project units, artifact digests and type/method pseudo-code            | A caller-started JEB client serving MCP, selected with REA_JEB_MCP_URL; [JEB guide](docs/providers/jeb-analysis.md)                                                  |
+| Android resources      | Decoded manifest, string tables, locales and version facts                           | Caller-supplied Apktool launcher; [resource guide](docs/guides/android/apktool-resource-analysis.md)                                                                 |
+| Flutter apps           | Dart snapshot hash, per-ABI library digests and engine build provenance              | None (static APK parsing); [Flutter guide](docs/guides/android/flutter-analysis.md)                                                                                  |
+| Firmware               | Regions, extraction results and native-analysis handoffs                             | Binwalk / Unblob on Linux; [firmware guide](docs/guides/firmware/firmware-analysis.md)                                                                               |
+| Recorded packets       | Selected fields, repeated values, filters and decode-as rules                        | Linux: TShark 4.x + prlimit; [capture guide](docs/guides/data/packet-captures.md)                                                                                    |
+| Packet summaries       | Endpoints, DNS, TLS SNI, protocol distribution and HTTP requests                     | Caller-supplied tshark and capinfos (Linux-verified); [pcap guide](docs/guides/data/pcap-analysis.md)                                                                |
+| Recorded logic signals | Decoder annotations, sample ranges and diagnostics                                   | Linux: sigrok-cli 0.7.2 + prlimit; [signal recordings](docs/guides/signals/signal-recordings.md)                                                                     |
+| Packages and resources | File inventories, digests, plists, Apple bundle anatomy and extracted resources      | [Artifact and JavaScript guide](docs/guides/javascript/javascript-artifact-reconstruction.md), [Apple applications](docs/guides/apple/apple-application-analysis.md) |
+| Process behavior       | Terminal output, interactions, exit and filesystem observations, and run comparisons | Linux/macOS with a native PTY; [process capture](docs/guides/runtime/process-capture.md)                                                                             |

 Static JavaScript and .NET inspection read the supplied files without running
 the application. Runtime capture runs or interacts with the selected target
@@ -182,14 +182,14 @@ using your user permissions; each runtime guide describes its effects.
 <a id="choosing-a-deep-analysis-provider"></a>

 Native formats and host support vary by provider. See
-[Hopper and Ghidra setup](docs/installation.md#hopper), the
-[IDA guide](docs/ida-provider.md) (including an optional native MCP bridge), and
-[experimental Windows Ghidra support](docs/windows-ghidra-p0.md).
-Ghidra also supports [16-bit DOS analysis](docs/ghidra-dos.md).
+[Hopper and Ghidra setup](docs/getting-started/installation.md#hopper), the
+[IDA guide](docs/providers/ida-provider.md) (including an optional native MCP bridge), and
+[experimental Windows Ghidra support](docs/providers/windows-ghidra-p0.md).
+Ghidra also supports [16-bit DOS analysis](docs/providers/ghidra-dos.md).
 For large binaries, raise the provider's startup deadline with
 `REA_GHIDRA_STARTUP_TIMEOUT_MS` or `REA_HOPPER_STARTUP_TIMEOUT_MS`.
-For provider selection, see the [CLI guide](docs/cli.md#choose-a-provider).
-Check [release availability](docs/installation.md#released-package-and-main)
+For provider selection, see the [CLI guide](docs/getting-started/cli.md#choose-a-provider).
+Check [release availability](docs/getting-started/installation.md#released-package-and-main)
 for features added since the latest npm release.

 ## Showcases
@@ -232,8 +232,8 @@ your question, how REA helped, and what you found.
 <summary><strong>Which agents can use REA?</strong></summary>

 Any agent that supports local MCP servers. Setup configures the
-[supported agents](docs/installation.md#supported-agents); other clients can use
-[manual MCP registration](docs/installation.md#mcp-registry).
+[supported agents](docs/getting-started/installation.md#supported-agents); other clients can use
+[manual MCP registration](docs/getting-started/installation.md#mcp-registry).

 </details>

@@ -242,7 +242,7 @@ Any agent that supports local MCP servers. Setup configures the

 Deep native analysis uses one of them. Static JavaScript and .NET inspection
 work without a native analysis engine. Setup can install Hopper after approval;
-Ghidra and IDA use your existing installations. See [provider setup](docs/installation.md#hopper).
+Ghidra and IDA use your existing installations. See [provider setup](docs/getting-started/installation.md#hopper).

 </details>

@@ -253,7 +253,7 @@ REA starts Hopper when an operation needs it. On macOS, a first-run dialog may
 ask you to choose demo mode or activate your license. Complete that prompt in the
 same user session before your first CLI/MCP operation or unattended job. Open
 Hopper manually if needed. See
-[Hopper startup and troubleshooting](docs/installation.md#launcher-paths-and-troubleshooting).
+[Hopper startup and troubleshooting](docs/getting-started/installation.md#launcher-paths-and-troubleshooting).

 </details>

@@ -262,7 +262,7 @@ Hopper manually if needed. See

 The skill supplies investigation instructions for your agent. Use `npx rea-agents setup`
 to register REA's MCP server and install the matching instructions, then restart
-your agent. See [skill-only installation](docs/installation.md#skill-only-installation).
+your agent. See [skill-only installation](docs/getting-started/installation.md#skill-only-installation).

 </details>

@@ -311,18 +311,18 @@ with your REA version, target type, steps to reproduce and error output.
 Start with the website's [worked guides](https://rea.tools/guides/).
 For exact options, prerequisites and result contracts:

- [Installation and setup](docs/installation.md): agent registration, provider configuration, updates and uninstall.
- [Readiness and troubleshooting](docs/installation.md#check-readiness-for-your-task): diagnose one agent or analysis engine.
- [CLI and Evidence](docs/cli.md): commands, provider selection, snapshots, import/export and exit statuses.
- [MCP contracts](docs/mcp-contracts.md) and [agent prompts](docs/mcp-prompts.md): tool results, sessions and guided investigations.
- [Tool catalog](docs/mcp-contracts.md#generated-catalog): generated inventory of tools, providers and CLI commands.
- [Roadmap](docs/roadmap.md): planned work and capability trackers.
+- [Installation and setup](docs/getting-started/installation.md): agent registration, provider configuration, updates and uninstall.
+- [Readiness and troubleshooting](docs/getting-started/installation.md#check-readiness-for-your-task): diagnose one agent or analysis engine.
+- [CLI and Evidence](docs/getting-started/cli.md): commands, provider selection, snapshots, import/export and exit statuses.
+- [MCP contracts](docs/reference/mcp-contracts.md) and [agent prompts](docs/getting-started/mcp-prompts.md): tool results, sessions and guided investigations.
+- [Tool catalog](docs/reference/mcp-contracts.md#generated-catalog): generated inventory of tools, providers and CLI commands.
+- [Roadmap](docs/development/roadmap.md): planned work and capability trackers.

 Report vulnerabilities through [SECURITY.md](SECURITY.md).

 ## Star history

-🎉 **170,000 GitHub stars — thank you!**
+🎉 **180,000 GitHub stars — thank you!**

 Thanks to everyone using REA, reporting bugs, requesting features, testing builds, and contributing fixes.

@@ -351,8 +351,8 @@ report a bug or suggest a feature, or [send a pull request](https://github.com/m
 to improve the code or docs.

 See [CONTRIBUTING.md](CONTRIBUTING.md) for development setup and checks,
-[testing](docs/testing.md) for verification lanes, and the
-[architecture map](docs/architecture.mermaid) for the project structure.
+[testing](docs/development/testing.md) for verification lanes, and the
+[architecture map](docs/architecture/architecture.mermaid) for the project structure.

 ## License

@@ -27,7 +27,7 @@ provider-dependent behavior to be reproduced safely.
 REA authenticates its Hopper and Ghidra bridges with per-session random
 capability tokens. POSIX uses current-user Unix sockets; Windows Ghidra uses
 authenticated loopback TCP with a private NTFS runtime whose DACL admits only
-the current user and SYSTEM. See [Windows Ghidra P0](docs/windows-ghidra-p0.md#private-runtime-transport-and-lifecycle).
+the current user and SYSTEM. See [Windows Ghidra P0](docs/providers/windows-ghidra-p0.md#private-runtime-transport-and-lifecycle).
 Tokens are transferred through private session descriptors rather than process
 arguments or environment variables.
 This is not a sandbox and does not protect against malicious processes already
@@ -3,8 +3,14 @@ import com.google.gson.*;
 import io.modelcontextprotocol.kotlin.sdk.server.*;
 import io.modelcontextprotocol.kotlin.sdk.types.*;
 import jadx.api.*;
+import jadx.api.plugins.input.data.ICodeReader;
+import jadx.api.plugins.input.data.IMethodRef;
+import jadx.api.plugins.input.insns.InsnIndexType;
+import jadx.api.plugins.input.insns.Opcode;
+import jadx.core.dex.info.MethodInfo;
 import jadx.core.dex.nodes.*;
 import java.io.PrintStream;
+import java.nio.charset.StandardCharsets;
 import java.util.*;
 import java.util.concurrent.CountDownLatch;
 import java.util.stream.Collectors;
@@ -79,11 +85,17 @@ class ReaJadxBridge {
          ordered.sort(Comparator.comparing(MethodNode::getAlias));
          List<MethodSnapshot> methods = ordered.stream().map(method -> {
            String name = method.getAlias();
+            String shortId = method.getMethodInfo().getShortId();
+            String rawName = method.getMethodInfo().getName();
+            if (!shortId.startsWith(rawName + "("))
+              throw new IllegalStateException("JADX method ID has no raw-name prefix: " + shortId);
+            String descriptor = shortId.substring(rawName.length());
            String signature = name + "(" + method.getArgTypes().stream()
                .map(Object::toString).collect(Collectors.joining(", "))
                + "): " + method.getReturnType().toString();
-            return new MethodSnapshot(name, method.getMethodInfo().getShortId(), Map.of(
+            return new MethodSnapshot(name, shortId, Map.of(
                "name", name, "signature", signature,
+                "dex_descriptor", descriptor,
                "is_constructor", method.isConstructor(), "def_pos", 0));
          }).toList();
          List<Map<String, Object>> fields = node.getFields().stream()
@@ -140,6 +152,57 @@ class ReaJadxBridge {
        "smali", true, List.of("static_initializer_disassembly"));
  }

+  // The local transport admits 8 MiB frames. Reserve 1 KiB for the fixed
+  // JSON-RPC/CallToolResult envelope and generated numeric request id, and
+  // account for JSON text being escaped again inside TextContent.
+  private static final int MAX_XREF_TEXT_BYTES = 8 * 1024 * 1024 - 1024;
+  private static int escapedJsonBytes(Object value) {
+    return JSON.toJson(JSON.toJson(value)).getBytes(StandardCharsets.UTF_8).length;
+  }
+  private static final class InvokeBudget {
+    long remaining;
+    InvokeBudget(long remaining) { this.remaining = Math.max(0, remaining); }
+    boolean admit(Map<String, Object> site) {
+      // Check a conservative two-layer escape bound before serialization.
+      long bound = 256;
+      for (Object value : site.values())
+        if (value instanceof String text) bound += 12L * text.length();
+      if (bound > remaining) return false;
+      long bytes = escapedJsonBytes(site) - 2L + 1L;
+      if (bytes > remaining) return false;
+      remaining -= bytes;
+      return true;
+    }
+  }
+  private record DirectInvokes(List<Map<String, Object>> sites, boolean exhaustive) {}
+
+  /** Raw DEX invokes within one JADX using method; offsets are code units from its code start. */
+  private static DirectInvokes directInvokes(JavaMethod source, MethodInfo target, InvokeBudget budget) {
+    MethodNode node = source.getMethodNode();
+    ICodeReader code = node.getCodeReader();
+    if (code == null) return null;
+    List<Map<String, Object>> sites = new ArrayList<>();
+    boolean[] exhaustive = {true};
+    code.visitInstructions(insn -> {
+      insn.decode();
+      if (insn.getIndexType() != InsnIndexType.METHOD_REF) return;
+      Opcode opcode = insn.getOpcode();
+      if (!opcode.name().startsWith("INVOKE_")) return;
+      IMethodRef ref = insn.getIndexAsMethod();
+      ref.load();
+      if (!MethodInfo.fromRef(node.root(), ref).getRawFullId().equals(target.getRawFullId())) return;
+      Map<String, Object> site = Map.of(
+          "dex_entry", node.getInputFileName(),
+          "source_raw_method_id", node.getMethodInfo().getRawFullId(),
+          "dex_code_unit_offset", insn.getOffset(),
+          "dex_method_index", insn.getIndex(),
+          "opcode", opcode.name());
+      if (budget.admit(site)) sites.add(site);
+      else exhaustive[0] = false;
+    });
+    return new DirectInvokes(sites, exhaustive[0]);
+  }
+
  private CallToolResult handle(String name, JsonObject args) {
    if (name.equals("rea_jvm_status")) return json(Map.of(
        "engine_reported_version", BuildInfo.VERSION,
@@ -173,17 +236,52 @@ class ReaJadxBridge {
    }
    List<JavaNode> uses;
    String target = string(args, "class_name");
+    MethodSnapshot selectedMethod = null;
+    int overloadIndex = 0;
    if (name.equals("get_xrefs_to_class")) uses = cls.node().getUseIn();
    else {
      List<MethodSnapshot> overloads = methods(cls, args);
-      if (overloads.size() != 1) throw new InputFailure("method_name", "Method references require a unique overload");
-      target += "." + overloads.get(0).name();
-      uses = method(cls, overloads.get(0)).getUseIn();
+      if (overloads.size() != 1 && !args.containsKey("overload_index"))
+        throw new InputFailure("overload_index", "Select one of " + overloads.size() + " method overloads");
+      overloadIndex = integer(args, "overload_index", 0);
+      if (overloadIndex >= overloads.size())
+        throw new InputFailure("overload_index", "overload_index out of range: " + overloadIndex);
+      selectedMethod = overloads.get(overloadIndex);
+      target += "." + selectedMethod.name();
+      uses = method(cls, selectedMethod).getUseIn();
    }
    // REA consumes all references without materializing source line information.
-    List<Map<String, Object>> items = uses.stream().map(node -> current.describeUsage(node, false)).toList();
-    return json(Map.of("target", target, "total", uses.size(), "count", items.size(),
-        "resolve_line", false, "items", items));
+    MethodInfo targetInfo = selectedMethod == null ? null : method(cls, selectedMethod).getMethodNode().getMethodInfo();
+    List<Map<String, Object>> items = uses.stream().map(node -> {
+      Map<String, Object> item = new LinkedHashMap<>(current.describeUsage(node, false));
+      if (targetInfo != null && node instanceof JavaMethod) {
+        item.put("direct_invokes", List.of());
+        item.put("direct_invokes_exhaustive", false);
+      }
+      return item;
+    }).toList();
+    Map<String, Object> result = new LinkedHashMap<>(Map.of("target", target,
+        "total", uses.size(), "count", items.size(), "resolve_line", false, "items", items));
+    if (selectedMethod != null) {
+      result.put("overload_index", overloadIndex);
+      result.put("reported_signature", selectedMethod.summary().get("signature"));
+    }
+    if (targetInfo != null) {
+      InvokeBudget budget = new InvokeBudget(MAX_XREF_TEXT_BYTES - escapedJsonBytes(result));
+      for (int index = 0; index < uses.size(); index++) {
+        if (!(uses.get(index) instanceof JavaMethod source)) continue;
+        DirectInvokes invokes = directInvokes(source, targetInfo, budget);
+        Map<String, Object> item = items.get(index);
+        if (invokes == null) {
+          item.remove("direct_invokes");
+          item.remove("direct_invokes_exhaustive");
+        } else {
+          item.put("direct_invokes", invokes.sites());
+          item.put("direct_invokes_exhaustive", invokes.exhaustive());
+        }
+      }
+    }
+    return json(result);
  }

  public static void main(String[] args) throws Exception {
@@ -217,7 +315,7 @@ class ReaJadxBridge {
      List<String> fields = switch (name) {
        case "list_classes" -> List.of("offset", "limit");
        case "get_method_body" -> List.of("class_name", "method_name", "overload_index");
-        case "get_xrefs_to_method" -> List.of("class_name", "method_name");
+        case "get_xrefs_to_method" -> List.of("class_name", "method_name", "overload_index");
        default -> List.of("class_name");
      };
      Map<String, kotlinx.serialization.json.JsonElement> properties = new LinkedHashMap<>();
@@ -226,7 +324,7 @@ class ReaJadxBridge {
        case "list_classes" -> "Indexed pages of all top-level class names, with offset and limit.";
        case "get_class_summary" -> "Parsed member metadata for one exact class name; no source generation.";
        case "get_method_body" -> "Source for an exact class and stable same-name overload index; static initializers use smali to preserve folded field initialization.";
-        default -> "Complete static references to an exact class or unique method; source lines are unresolved.";
+        default -> "Complete static using-node inventory for an exact class or selected method overload; one node may contain multiple invoke instructions, and source lines are unresolved.";
      };
      Tool narrowed = new Tool(name, new ToolSchema(null, new JsonObject(properties),
          tool.getInputSchema().getRequired(), null), description, null, null, null, null, null, null);
@@ -13,6 +13,8 @@ import java.net.UnixDomainSocketAddress;
 import java.nio.channels.Channels;
 import java.nio.channels.ServerSocketChannel;
 import java.nio.channels.SocketChannel;
+import java.nio.ByteBuffer;
+import java.nio.charset.CharacterCodingException;
 import java.nio.charset.StandardCharsets;
 import java.nio.file.AtomicMoveNotSupportedException;
 import java.nio.file.Files;
@@ -22,8 +24,11 @@ import java.nio.file.StandardCopyOption;
 import java.nio.file.StandardOpenOption;
 import java.nio.file.attribute.PosixFilePermissions;
 import java.security.MessageDigest;
+import java.util.ArrayDeque;
 import java.util.ArrayList;
+import java.util.Arrays;
 import java.util.Comparator;
+import java.util.HashMap;
 import java.util.HashSet;
 import java.util.IdentityHashMap;
 import java.util.Iterator;
@@ -52,6 +57,8 @@ import ghidra.app.decompiler.DecompiledFunction;
 import ghidra.app.decompiler.ClangCaseToken;
 import ghidra.app.decompiler.ClangNode;
 import ghidra.framework.Application;
+import ghidra.app.util.bin.format.pdb.PdbParserConstants;
+import ghidra.framework.options.Options;
 import ghidra.program.model.address.Address;
 import ghidra.program.model.address.AddressIterator;
 import ghidra.program.model.address.AddressSet;
@@ -82,6 +89,7 @@ import ghidra.program.model.address.SegmentedAddress;
 import ghidra.program.model.reloc.Relocation;
 import java.io.ByteArrayOutputStream;
 import ghidra.program.model.symbol.Namespace;
+import ghidra.program.model.symbol.FlowType;
 import ghidra.program.model.symbol.RefType;
 import ghidra.program.model.symbol.Reference;
 import ghidra.program.model.symbol.ReferenceIterator;
@@ -100,12 +108,19 @@ import ghidra.program.model.pcode.PcodeBlock;
 import ghidra.program.model.pcode.PcodeBlockBasic;
 import ghidra.program.model.pcode.Varnode;
 import ghidra.program.model.pcode.VarnodeAST;
+import ghidra.program.util.ContextEvaluatorAdapter;
+import ghidra.program.util.SymbolicPropogator;
+import ghidra.program.util.VarnodeContext;

 public final class ReaGhidraBridge extends HeadlessScript {
+    // At most 24 KiB after worst-case JSON escaping (six bytes per UTF-16 unit).
+    private static final int PDB_ATTRIBUTE_UTF16_BUDGET = 4096;
    private static final int MAX_HIGH_PCODE_OPS = 3000;
    private static final int MAX_HIGH_PCODE_INPUTS_PER_OP = 64;
    private static final int MAX_HIGH_PCODE_DEF_USE_EDGES = 12000;
    private static final Gson GSON = new GsonBuilder().serializeNulls().create();
+    private final Map<FileBytes, Boolean> targetSourceIdentity = new IdentityHashMap<>();
+    private String admittedTargetSha256;
    private static final Set<String> DESCRIPTOR_KEYS = Set.of(
        "transport",
        "endpoint_path",
@@ -127,6 +142,7 @@ public final class ReaGhidraBridge extends HeadlessScript {
        "set_addresses_names",
        "inspect_native_load_image",
        "read_bytes",
+        "search_bytes",
        "address_to_file_offset",
        "ping",
        "shutdown",
@@ -207,6 +223,7 @@ public final class ReaGhidraBridge extends HeadlessScript {
                "Ghidra imported-byte digest does not match the admitted target"
            );
        }
+        admittedTargetSha256 = descriptor.targetSha256;
        // GhidraScript wraps run() in a transaction. End it before serving so
        // each edit owns a real outer transaction and can roll back immediately.
        end(true);
@@ -363,6 +380,7 @@ public final class ReaGhidraBridge extends HeadlessScript {
        return switch (request.method) {
            case "inspect_native_load_image" -> inspectNativeLoadImage(request.params);
            case "read_bytes" -> readMemoryBytes(request.params);
+            case "search_bytes" -> searchMemoryBytes(request.params, descriptor);
            case "address_to_file_offset" -> addressToFileOffset(request.params);
            case "address_name" -> addressName(request.params);
            case "list_documents" -> listDocuments(request.params);
@@ -443,6 +461,7 @@ public final class ReaGhidraBridge extends HeadlessScript {
                .toArray(String[]::new)
        ));
        result.add("target", target);
+        result.add("pdb", pdbObservation());
        JsonArray extensions = analysisExtensions.reports();
        if (extensions.size() > 0) result.add("analysis_extensions", extensions);
        // Written by ReaGhidraApplySeeds before auto-analysis; REA checks it
@@ -458,6 +477,41 @@ public final class ReaGhidraBridge extends HeadlessScript {
        return result;
    }

+    /** Read loader/analyzer-owned facts without searching for or applying companions. */
+    private JsonObject pdbObservation() {
+        Options info = currentProgram.getOptions(ghidra.program.model.listing.Program.PROGRAM_INFO);
+        JsonObject pdb = new JsonObject();
+        String[] names = {"file", "guid", "age", "signature", "version"};
+        String[] attributes = {
+            PdbParserConstants.PDB_FILE, PdbParserConstants.PDB_GUID,
+            PdbParserConstants.PDB_AGE, PdbParserConstants.PDB_SIGNATURE,
+            PdbParserConstants.PDB_VERSION
+        };
+        int remaining = PDB_ATTRIBUTE_UTF16_BUDGET;
+        JsonArray omitted = new JsonArray();
+        for (int index = 0; index < names.length; index++) {
+            String value = info.getString(attributes[index], null);
+            if (value != null && value.length() > remaining) {
+                omitted.add(names[index]);
+                pdb.add(names[index], JsonNull.INSTANCE);
+            } else {
+                pdb.addProperty(names[index], value);
+                if (value != null) remaining -= value.length();
+            }
+        }
+        if (omitted.size() > 0) {
+            JsonObject limit = new JsonObject();
+            limit.addProperty("utf16_budget", PDB_ATTRIBUTE_UTF16_BUDGET);
+            limit.add("omitted_attributes", omitted);
+            pdb.add("resource_limit", limit);
+        }
+        if (info.contains(PdbParserConstants.PDB_LOADED))
+            pdb.addProperty("loaded", info.getBoolean(PdbParserConstants.PDB_LOADED, false));
+        else
+            pdb.add("loaded", JsonNull.INSTANCE);
+        return pdb;
+    }
+
    private static String bytesHex(byte[] bytes) {
        return java.util.HexFormat.of().formatHex(bytes);
    }
@@ -633,24 +687,173 @@ public final class ReaGhidraBridge extends HeadlessScript {
        return result;
    }

-    private JsonObject addressToFileOffset(JsonObject params) {
+    private JsonObject searchMemoryBytes(JsonObject params, SessionDescriptor descriptor) throws Exception {
+        // mask, start, end, and cursor are omitted when absent; JSON encoding drops those keys.
+        Set<String> keys = params.keySet();
+        if (!keys.containsAll(Set.of("document", "pattern", "limit")) ||
+            !Set.of("document", "pattern", "mask", "start", "end", "limit", "cursor").containsAll(keys))
+            throw new RequestFailure("invalid_request", "Bridge request fields are invalid");
+        requireDocument(params);
+        // Public input validation owns the grammar; validate again at the socket boundary.
+        String pattern = requireString(params, "pattern").replaceAll("[\\s\\p{Z}\\uFEFF]", "");
+        String mask = params.has("mask") ? requireString(params, "mask") : null;
+        if (mask != null) mask = mask.replaceAll("[\\s\\p{Z}\\uFEFF]", "");
+        if (pattern.isEmpty() || pattern.length() % 2 != 0 ||
+            (mask != null && mask.length() != pattern.length()))
+            throw new RequestFailure("invalid_request", "Mask length must equal a nonempty byte pattern length");
+        byte[] bytes = new byte[pattern.length() / 2];
+        byte[] masks = new byte[bytes.length];
+        boolean constrained = false;
+        for (int index = 0; index < bytes.length; index++) {
+            monitor.checkCancelled();
+            String pair = pattern.substring(index * 2, index * 2 + 2);
+            if ((!pair.equals("??") && !isHexadecimal(pair, 0, 2)) ||
+                (mask != null && !isHexadecimal(mask, index * 2, index * 2 + 2)))
+                throw new RequestFailure("invalid_request", "Use hexadecimal byte pairs or ?? wildcards");
+            int selected = mask == null ? 255 : Integer.parseInt(mask.substring(index * 2, index * 2 + 2), 16);
+            bytes[index] = (byte) (pair.equals("??") ? 0 : Integer.parseInt(pair, 16));
+            masks[index] = (byte) (pair.equals("??") ? 0 : selected);
+            constrained |= masks[index] != 0;
+        }
+        if (!constrained) throw new RequestFailure("invalid_request", "Pattern must constrain at least one bit");
+        int limit = requireBoundedInteger(params, "limit", 1, 1000);
+        Address start = params.has("start") ? requireAddress(params, "start") : null;
+        Address end = params.has("end") ? requireAddress(params, "end") : null;
+        if (start != null && end != null &&
+            (!start.getAddressSpace().equals(end.getAddressSpace()) || start.compareTo(end) > 0))
+            throw new RequestFailure("invalid_request", "Search bounds must be ordered in one address space");
+        JsonArray identity = new JsonArray();
+        for (String value : new String[] { descriptor.targetSha256, descriptor.profileDigest,
+                bytesHex(bytes), bytesHex(masks), start == null ? "" : canonicalAddress(start),
+                end == null ? "" : canonicalAddress(end), optionalString(params, "document") }) identity.add(value);
+        String binding = bytesHex(MessageDigest.getInstance("SHA-256").digest(identity.toString().getBytes(StandardCharsets.UTF_8)));
+        String cursor = params.has("cursor") ? requireString(params, "cursor") : null;
+        Address resume = null;
+        if (cursor != null) {
+            if (!cursor.startsWith(binding + ":"))
+                throw new RequestFailure("invalid_request", "Byte search cursor does not match the target and query");
+            resume = parseReaAddress(cursor.substring(binding.length() + 1));
+            MemoryBlock resumedBlock = currentProgram.getMemory().getBlock(resume);
+            Address bound = start == null ? end : start;
+            if (resumedBlock == null || !resumedBlock.isInitialized() ||
+                (bound != null && !bound.getAddressSpace().equals(resume.getAddressSpace())) ||
+                (start != null && resume.compareTo(start) < 0) ||
+                (end != null && resume.compareTo(end) > 0))
+                throw new RequestFailure("invalid_request", "Byte search cursor lies outside initialized query memory");
+        }
+        List<MemoryBlock> ordered = new ArrayList<>(List.of(currentProgram.getMemory().getBlocks()));
+        ordered.sort(Comparator.comparing(MemoryBlock::getStart));
+        JsonArray matches = new JsonArray();
+        JsonArray blocks = new JsonArray();
+        JsonArray skipped = new JsonArray();
+        JsonArray notLoaded = new JsonArray();
+        long covered = 0;
+        String next = null;
+        for (MemoryBlock block : ordered) {
+            monitor.checkCancelled();
+            Address low = block.getStart();
+            Address high = block.getEnd();
+            Address bound = start == null ? end : start;
+            if (bound != null && !bound.getAddressSpace().equals(low.getAddressSpace())) continue;
+            // Without bounds, search loaded memory only. Non-loaded file parts
+            // (such as .symtab) and overlays stay reachable through explicit bounds.
+            if (bound == null && (!block.isLoaded() || block.isOverlay())) {
+                notLoaded.add(byteSearchCoverage(block, low, high));
+                continue;
+            }
+            if (start != null && low.compareTo(start) < 0) low = start;
+            if (end != null && high.compareTo(end) > 0) high = end;
+            if (low.compareTo(high) > 0) continue;
+            if (!block.isInitialized()) {
+                skipped.add(byteSearchCoverage(block, low, high));
+                continue;
+            }
+            if (next != null) continue;
+            if (resume != null && low.compareTo(resume) < 0) low = resume;
+            if (low.compareTo(high) > 0 || !low.getAddressSpace().equals(high.getAddressSpace())) continue;
+            Address at = low;
+            Address examinedEnd = high;
+            while (at != null && at.compareTo(high) <= 0 && high.subtract(at) >= bytes.length - 1L) {
+                monitor.checkCancelled();
+                // Ghidra's end address bounds candidate starts, not the final matched byte.
+                Address found = currentProgram.getMemory().findBytes(at, high.subtract(bytes.length - 1L), bytes, masks, true, monitor);
+                monitor.checkCancelled();
+                if (found == null || high.subtract(found) < bytes.length - 1L) break;
+                if (matches.size() == limit) {
+                    next = binding + ":" + canonicalAddress(found);
+                    examinedEnd = found.addNoWrap(bytes.length - 1L);
+                    break;
+                }
+                JsonObject match = new JsonObject();
+                match.addProperty("address", canonicalAddress(found));
+                match.addProperty("segment", block.getName());
+                Long offset = targetFileOffset(block, found).offset();
+                match.add("file_offset", offset == null ? JsonNull.INSTANCE : GSON.toJsonTree(offset));
+                Function function = currentProgram.getFunctionManager().getFunctionContaining(found);
+                JsonObject procedure = new JsonObject();
+                if (function != null) {
+                    procedure.addProperty("address", canonicalAddress(function.getEntryPoint()));
+                    procedure.addProperty("name", function.getName(true));
+                }
+                match.add("procedure", function == null ? JsonNull.INSTANCE : procedure);
+                matches.add(match);
+                at = found.next();
+            }
+            JsonObject coverage = byteSearchCoverage(block, low, examinedEnd);
+            covered = Math.addExact(covered, coverage.get("bytes").getAsLong());
+            blocks.add(coverage);
+        }
+        JsonObject searched = new JsonObject();
+        searched.add("blocks", blocks);
+        searched.addProperty("bytes", covered);
+        searched.add("skipped_uninitialized", skipped);
+        searched.add("skipped_not_loaded", notLoaded);
+        JsonObject result = new JsonObject();
+        result.add("matches", matches);
+        result.add("searched", searched);
+        result.addProperty("complete", next == null);
+        result.add("next_cursor", next == null ? JsonNull.INSTANCE : GSON.toJsonTree(next));
+        return result;
+    }
+
+    private static JsonObject byteSearchCoverage(MemoryBlock block, Address low, Address high) {
+        JsonObject result = new JsonObject();
+        result.addProperty("segment", block.getName());
+        result.addProperty("start", canonicalAddress(low));
+        result.addProperty("end", canonicalAddress(high));
+        result.addProperty("bytes", high.subtract(low) + 1);
+        return result;
+    }
+
+    private record TargetFileOffset(Long offset, int mappings) {}
+
+    private TargetFileOffset targetFileOffset(MemoryBlock block, Address address) throws Exception {
+        Long offset = null;
+        int mappings = 0;
+        for (MemoryBlockSourceInfo source : block.getSourceInfos()) {
+            if (!source.contains(address) || source.getFileBytes().isEmpty() ||
+                !isTargetSource(source.getFileBytes().get())) continue;
+            long candidate = source.getFileBytesOffset(address);
+            if (candidate < 0) continue;
+            offset = candidate;
+            mappings++;
+        }
+        return new TargetFileOffset(mappings == 1 && offset <= 9007199254740991L ? offset : null, mappings);
+    }
+
+    private JsonObject addressToFileOffset(JsonObject params) throws Exception {
        requireKeys(params, Set.of("document", "address"));
        requireDocument(params);
        Address address = requireAddress(params, "address");
        MemoryBlock block = currentProgram.getMemory().getBlock(address);
        if (block == null || !block.isInitialized())
            throw new RequestFailure("invalid_request", "Address has no initialized file-backed memory: " + canonicalAddress(address));
-        Long fileOffset = null;
-        int mappings = 0;
-        for (MemoryBlockSourceInfo source : block.getSourceInfos()) {
-            if (!source.contains(address) || source.getFileBytes().isEmpty()) continue;
-            long offset = source.getFileBytesOffset(address);
-            if (offset < 0) continue;
-            fileOffset = offset;
-            mappings++;
-        }
-        if (mappings != 1)
-            throw new RequestFailure("invalid_request", "Address has " + mappings + " authoritative source mappings: " + canonicalAddress(address));
+        TargetFileOffset mapping = targetFileOffset(block, address);
+        if (mapping.mappings() != 1)
+            throw new RequestFailure("invalid_request", "Address has " + mapping.mappings() + " authoritative target-file mappings: " + canonicalAddress(address));
+        Long fileOffset = mapping.offset();
+        if (fileOffset == null)
+            throw new RequestFailure("invalid_request", "Address lacks a safe file offset: " + canonicalAddress(address));
        JsonObject result = new JsonObject();
        result.addProperty("address", canonicalAddress(address));
        result.addProperty("file_offset", fileOffset);
@@ -673,14 +876,96 @@ public final class ReaGhidraBridge extends HeadlessScript {
    private JsonElement procedurePseudocode(JsonObject params) throws Exception {
        requireKeys(params, Set.of("document", "procedure"));
        requireDocument(params);
-        Function function = resolveProcedure(requireString(params, "procedure"));
-        String value = decompiledText(decompile(function));
-        return functionObservation(
-            value == null ? JsonNull.INSTANCE : GSON.toJsonTree(value),
-            noReturnCallLimitations(
-                currentProgram.getListing().getInstructions(function.getBody(), true)
-            )
-        );
+        String selector = requireString(params, "procedure");
+        JsonObject selection = new JsonObject();
+        Function function = resolveDecompileProcedure(selector, selection);
+        try {
+            String value = decompiledText(decompile(function));
+            JsonObject result = functionObservation(
+                value == null ? JsonNull.INSTANCE : GSON.toJsonTree(value),
+                noReturnCallLimitations(
+                    currentProgram.getListing().getInstructions(function.getBody(), true)
+                )
+            );
+            if (selection.size() > 0) result.add("selection", selection);
+            return result;
+        } catch (RequestFailure failure) {
+            if (selection.size() == 0) throw failure;
+            // Preserve completed resolution facts without changing the backend's
+            // failure code or suggesting that the successful mapping was invalid.
+            throw new RequestFailure(failure.code, "Selector " + selector +
+                " mapped to analysis address " + selection.get("mapped_address").getAsString() +
+                " and procedure " + canonicalAddress(function.getEntryPoint()) +
+                "; " + failure.getMessage());
+        }
+    }
+
+    private Function resolveDecompileProcedure(String selector, JsonObject selection) throws Exception {
+        String prefix = "file-offset:";
+        boolean explicitOffset = selector.startsWith(prefix);
+        if (!explicitOffset) {
+            try {
+                return resolveProcedure(selector);
+            } catch (RequestFailure failure) {
+                // Existing names/addresses win. Only an unresolved numeric input
+                // can fall back to source coordinates; ambiguity never falls back.
+                if (!failure.code.equals("not_found") || !selector.matches("0x[0-9a-fA-F]+"))
+                    throw failure;
+            }
+        }
+        String coordinate = explicitOffset ? selector.substring(prefix.length()) : selector;
+        if (!coordinate.matches("0x[0-9a-fA-F]+"))
+            throw new RequestFailure("invalid_request", "File offsets require hexadecimal file-offset:0x... syntax");
+        BigInteger parsed = new BigInteger(coordinate.substring(2), 16);
+        if (parsed.compareTo(BigInteger.valueOf(9007199254740991L)) > 0)
+            throw new RequestFailure("invalid_request", "File offset exceeds the exact JSON integer range");
+        long offset = parsed.longValueExact();
+        monitor.checkCancelled();
+        // Ghidra's convenience lookup spans every FileBytes and uses coordinates
+        // local to each object. Only a complete, digest-matched target source
+        // establishes that the caller's offset belongs to the admitted file.
+        Set<Address> mappedAddresses = new java.util.LinkedHashSet<>();
+        for (MemoryBlock block : currentProgram.getMemory().getBlocks()) {
+            for (MemoryBlockSourceInfo source : block.getSourceInfos()) {
+                monitor.checkCancelled();
+                FileBytes backing = source.getFileBytes().orElse(null);
+                if (backing == null || !isTargetSource(backing)) continue;
+                Address mapped = source.locateAddressForFileOffset(offset);
+                if (mapped != null) mappedAddresses.add(mapped);
+            }
+        }
+        List<Address> candidates = new ArrayList<>(mappedAddresses);
+        if (candidates.size() > 1)
+            throw new RequestFailure("ambiguous", "File offset " + coordinate +
+                " has multiple loaded mappings: " + candidates.stream().map(ReaGhidraBridge::canonicalAddress).toList() +
+                "; select an explicit analysis address");
+        if (candidates.isEmpty())
+            throw new RequestFailure("not_found", "File offset " + coordinate +
+                " has no loaded source mapping for the admitted target file; Ghidra image base: " + canonicalAddress(currentProgram.getImageBase()) +
+                ". Inspect mappings with rea inspect-native-load-image <path> --provider ghidra --json or MCP inspect_native_load_image.");
+        Address mapped = candidates.get(0);
+        Function function = functionAtOrContaining(mapped);
+        if (function == null)
+            throw new RequestFailure("not_found", "File offset " + coordinate +
+                " maps to analysis address " + canonicalAddress(mapped) +
+                ", but no procedure starts at or contains that address in the current Ghidra analysis. " +
+                "Choose an observed procedure with CLI rea search <path> . --kind procedures --mode regex --provider ghidra --json or MCP list_procedures.");
+        selection.addProperty("file_offset", offset);
+        selection.addProperty("mapped_address", canonicalAddress(mapped));
+        selection.addProperty("procedure_address", canonicalAddress(function.getEntryPoint()));
+        return function;
+    }
+
+    private boolean isTargetSource(FileBytes source) throws Exception {
+        Boolean observed = targetSourceIdentity.get(source);
+        if (observed != null) return observed;
+        // Original FileBytes are immutable even when analysis memory is edited.
+        // Partial/auxiliary sources remain inspectable but cannot establish an
+        // original-target offset from their object-local coordinates alone.
+        boolean matched = source.getFileOffset() == 0 &&
+            constantTimeEquals(hashFileBytes(source, false), admittedTargetSha256);
+        targetSourceIdentity.put(source, matched);
+        return matched;
    }

    private JsonElement procedureAssembly(JsonObject params) throws Exception {
@@ -718,7 +1003,7 @@ public final class ReaGhidraBridge extends HeadlessScript {
        return functionObservation(result, boundaryLimitations);
    }

-    private JsonArray procedureCalls(JsonObject params, boolean callers) throws Exception {
+    private JsonObject procedureCalls(JsonObject params, boolean callers) throws Exception {
        requireKeys(params, Set.of("document", "procedure"));
        requireDocument(params);
        Function function = resolveProcedure(requireString(params, "procedure"));
@@ -731,7 +1016,12 @@ public final class ReaGhidraBridge extends HeadlessScript {
        for (Function item : ordered) {
            result.add(canonicalAddress(item.getEntryPoint()));
        }
-        return result;
+        return functionObservation(
+            result,
+            noReturnCallLimitations(
+                currentProgram.getListing().getInstructions(function.getBody(), true)
+            )
+        );
    }

    private JsonObject procedureInfo(JsonObject params) throws Exception {
@@ -1233,6 +1523,13 @@ public final class ReaGhidraBridge extends HeadlessScript {
        result.add("outgoing_references", outgoing);
        result.add("referenced_strings", referencedStrings);
        result.add("referenced_names", referencedNames);
+        boolean swift = swiftProgram();
+        boolean aarch64 = currentProgram.getLanguageID().getIdAsString().startsWith("AARCH64:");
+        SwiftStringLiteralDecode swiftLiterals = swift && aarch64 ? swiftStringLiterals(function) : null;
+        if (swiftLiterals != null) {
+            result.add("swift_string_literals", swiftLiterals.literals());
+            result.add("swift_string_literal_omissions", swiftLiterals.omissions());
+        }
        result.add("basic_blocks", blocks);
        result.add(
            "native_api",
@@ -1252,6 +1549,20 @@ public final class ReaGhidraBridge extends HeadlessScript {
        limitations.add(
            "Synthetic Ghidra entry-point references without actionable memory sources are omitted."
        );
+        if (swift && aarch64) {
+            limitations.add(
+                "Swift String literals are decoded from constant register pairs at calls, returns and paired stores; literals stored one word at a time, chosen by conditional selects, passed through unresolved jumps, or built at runtime are not reported."
+            );
+            if (swiftLiterals.omissions().size() > 0) {
+                limitations.add(
+                    "Swift String literal records listed in swift_string_literal_omissions could not be retained or decoded within this dossier's remaining heap budget; later symbolic flows remain unexamined."
+                );
+            }
+        } else if (swift) {
+            limitations.add(
+                "Swift String literal decoding is implemented for AArch64 register pairs only; no Swift literals were decoded for this architecture."
+            );
+        }
        List<String> boundaryLimitations = noReturnCallLimitations(scan.instructions);
        for (String limitation : boundaryLimitations) {
            limitations.add(limitation);
@@ -1833,14 +2144,25 @@ public final class ReaGhidraBridge extends HeadlessScript {
        Address address = explicitAddress ? parseReaAddress(value) : tryParseAddress(value);
        if (address == null)
            throw new RequestFailure("not_found", "Unknown Ghidra procedure name or address: " + value);
-        Function function = currentProgram.getFunctionManager().getFunctionAt(address);
-        if (function == null && address.isMemoryAddress())
-            function = currentProgram.getFunctionManager().getFunctionContaining(address);
+        Function function = functionAtOrContaining(address);
        if (function == null)
-            throw new RequestFailure("not_found", "No procedure exists at the requested address: " + value);
+            // Other procedure operations retain their analysis-address semantics.
+            throw new RequestFailure("not_found", "No procedure exists at the requested address: " + value +
+                "; Ghidra image base: " + canonicalAddress(currentProgram.getImageBase()) +
+                ". Choose an observed analysis address. CLI: rea search <path> . --kind procedures --mode regex --provider ghidra --json; " +
+                "MCP: list_procedures. Inspect the loaded base and source mappings with CLI rea analyze <path> --provider ghidra --json " +
+                "and rea inspect-native-load-image <path> --provider ghidra --json, or MCP binary_overview and inspect_native_load_image. " +
+                "Repeat the original target options. For decompile, select source coordinates explicitly with --file-offset=0x... or MCP procedure file-offset:0x....");
        return function;
    }

+    private Function functionAtOrContaining(Address address) {
+        Function function = currentProgram.getFunctionManager().getFunctionAt(address);
+        return function == null && address.isMemoryAddress()
+            ? currentProgram.getFunctionManager().getFunctionContaining(address)
+            : function;
+    }
+
    private JsonObject nativeApiBoundary(
        Function function,
        DecompileResults decompilation
@@ -3294,6 +3616,349 @@ public final class ReaGhidraBridge extends HeadlessScript {
        return result;
    }

+    private boolean swiftProgram() {
+        for (MemoryBlock block : currentProgram.getMemory().getBlocks()) {
+            String name = block.getName();
+            if (name.startsWith("__swift5_") || name.startsWith("swift5_")) return true;
+        }
+        return false;
+    }
+
+    /**
+     * Swift passes a String as two words: small literals carry their bytes in the words and
+     * immortal large literals carry their count and a biased pointer to the bytes. Ghidra keeps
+     * neither as a data reference, so decode constant pairs where Swift consumes them: argument
+     * and return registers at calls, tail calls and returns, and both registers of one STP.
+     * The canonical empty string is a small literal with a zero count.
+     */
+    private SwiftStringLiteralDecode swiftStringLiterals(Function function) throws Exception {
+        Register[] registers = new Register[31];
+        for (int index = 0; index < registers.length; index++) {
+            registers[index] = currentProgram.getRegister("x" + index);
+        }
+        TreeMap<String, JsonObject> observed = new TreeMap<>();
+        TreeMap<String, JsonObject> omitted = new TreeMap<>();
+        SwiftLiteralBudget budget = new SwiftLiteralBudget();
+        Map<String, Boolean> selectedValues = new HashMap<>();
+        SymbolicPropogator propagator = new SymbolicPropogator(currentProgram, false);
+        propagator.flowConstants(function.getEntryPoint(), function.getBody(), new ContextEvaluatorAdapter() {
+            @Override
+            public boolean evaluateContextBefore(VarnodeContext context, Instruction instruction) {
+                // Returning true ends only the current flow, so every queued flow checks the shared stop.
+                if (budget.stopped()) return true;
+                for (Register[] pair : swiftStringPairs(function, instruction, registers)) {
+                    Long word = registerConstant(context, pair[0]);
+                    Long object = registerConstant(context, pair[1]);
+                    if (word == null || object == null) continue;
+                    SwiftLiteralLayout layout = swiftLiteralLayout(word, object);
+                    if (layout == null) continue;
+                    // A selected word can combine with a path-dependent ordinary move. Cache the
+                    // provenance question per site/register, charging retained cache state to the
+                    // same dossier budget before allocating it.
+                    boolean selected = false;
+                    boolean provenanceOverCapacity = false;
+                    for (Register register : pair) {
+                        String provenanceKey = canonicalAddress(instruction.getAddress()) + "\u0000" +
+                            register.getBaseRegister().getName();
+                        Boolean value = selectedValues.get(provenanceKey);
+                        if (value == null) {
+                            if (!budget.takeState()) {
+                                provenanceOverCapacity = true;
+                                break;
+                            }
+                            value = selectedValue(function, instruction, register);
+                            selectedValues.put(provenanceKey, value);
+                        }
+                        if (value) {
+                            selected = true;
+                            break;
+                        }
+                    }
+                    if (selected) continue;
+                    // Forks can reach one site with different constants, so the words are part of the key.
+                    String key = canonicalAddress(instruction.getAddress()) + "\u0000" + pair[0].getName() +
+                        "\u0000" + pair[1].getName() + "\u0000" + Long.toUnsignedString(word, 16) +
+                        "\u0000" + Long.toUnsignedString(object, 16);
+                    if (observed.containsKey(key) || omitted.containsKey(key)) continue;
+                    // Every record draws on the budget; the first one that does not fit is kept as an
+                    // omission and decoding stops, so later sites are never examined.
+                    String value = layout.smallValue();
+                    boolean overCapacity = provenanceOverCapacity || !budget.take(layout.byteLength());
+                    if (!overCapacity && value == null) {
+                        try {
+                            value = swiftLargeLiteralText(layout);
+                        } catch (OutOfMemoryError exhausted) {
+                            overCapacity = true;
+                        }
+                    }
+                    if (value == null && !overCapacity) continue;
+                    JsonObject item = overCapacity
+                        ? swiftStringOmission(layout, word, object)
+                        : swiftStringItem(value, layout, word, object);
+                    item.addProperty("source_address", canonicalAddress(instruction.getAddress()));
+                    JsonArray pairRegisters = new JsonArray();
+                    pairRegisters.add(pair[0].getName());
+                    pairRegisters.add(pair[1].getName());
+                    item.add("registers", pairRegisters);
+                    (overCapacity ? omitted : observed).put(key, item);
+                    if (overCapacity) {
+                        budget.stop();
+                        return true;
+                    }
+                }
+                return false;
+            }
+        }, false, monitor);
+        JsonArray literals = new JsonArray();
+        observed.values().forEach(literals::add);
+        JsonArray omissions = new JsonArray();
+        omitted.values().forEach(omissions::add);
+        return new SwiftStringLiteralDecode(literals, omissions);
+    }
+
+    private static List<Register[]> swiftStringPairs(
+        Function function,
+        Instruction instruction,
+        Register[] registers
+    ) {
+        List<Register[]> pairs = new ArrayList<>();
+        if (instruction.getMnemonicString().equals("stp")) {
+            Register first = instruction.getRegister(0);
+            Register second = instruction.getRegister(1);
+            if (first != null && second != null && first.getBitLength() == 64 && second.getBitLength() == 64) {
+                pairs.add(new Register[] {first, second});
+            }
+            return pairs;
+        }
+        FlowType flow = instruction.getFlowType();
+        boolean returns = false;
+        for (PcodeOp operation : instruction.getPcode()) {
+            if (operation.getOpcode() == PcodeOp.RETURN) returns = true;
+        }
+        // A jump is a proven tail call only when it has resolved targets and all leave the
+        // body. A targetless computed jump can still dispatch inside the function.
+        Address[] targets = instruction.getFlows();
+        boolean tailCall = flow.isJump() && !flow.isConditional() && targets.length > 0 &&
+            Arrays.stream(targets).allMatch(target -> !function.getBody().contains(target));
+        if (!flow.isCall() && !returns && !tailCall) return pairs;
+        // A String occupies two consecutive registers among x0-x7, or x0 and x1 when returned.
+        int lastFirstRegister = returns ? 0 : 6;
+        for (int index = 0; index <= lastFirstRegister; index++) {
+            pairs.add(new Register[] {registers[index], registers[index + 1]});
+        }
+        return pairs;
+    }
+
+    private static Long registerConstant(VarnodeContext context, Register register) {
+        Varnode value = context.getRegisterVarnodeValue(register);
+        return value != null && context.isConstant(value) ? value.getOffset() : null;
+    }
+
+    // Search every predecessor path for the reaching definitions, following register copies,
+    // since a select copied into an argument register or defined before a branch forks just as
+    // independently as one written there directly.
+    private boolean selectedValue(Function function, Instruction use, Register register) {
+        ArrayDeque<Instruction> instructions = new ArrayDeque<>();
+        ArrayDeque<Register> targets = new ArrayDeque<>();
+        Set<String> visited = new HashSet<>();
+        for (Instruction predecessor : predecessors(function, use)) {
+            instructions.push(predecessor);
+            targets.push(register.getBaseRegister());
+        }
+        while (!instructions.isEmpty()) {
+            Instruction instruction = instructions.pop();
+            Register target = targets.pop();
+            if (!visited.add(canonicalAddress(instruction.getAddress()) + "\u0000" + target.getName())) continue;
+            boolean defines = false;
+            for (Object result : instruction.getResultObjects()) {
+                if (result instanceof Register written && written.getBaseRegister().equals(target)) defines = true;
+            }
+            Register next = target;
+            if (defines) {
+                PcodeOp[] operations = instruction.getPcode();
+                for (PcodeOp operation : operations) {
+                    if (operation.getOpcode() == PcodeOp.CBRANCH && operation.getInput(0).isConstant()) return true;
+                }
+                Register source = copiedRegister(operations);
+                if (source == null) continue;
+                next = source.getBaseRegister();
+            }
+            for (Instruction predecessor : predecessors(function, instruction)) {
+                instructions.push(predecessor);
+                targets.push(next);
+            }
+        }
+        return false;
+    }
+
+    private List<Instruction> predecessors(Function function, Instruction instruction) {
+        List<Instruction> result = new ArrayList<>();
+        Address from = instruction.getFallFrom();
+        if (from != null) {
+            Instruction previous = currentProgram.getListing().getInstructionAt(from);
+            if (previous != null) result.add(previous);
+        }
+        for (Reference reference : currentProgram.getReferenceManager().getReferencesTo(instruction.getAddress())) {
+            if (!reference.getReferenceType().isFlow() || reference.getReferenceType().isCall()) continue;
+            if (!function.getBody().contains(reference.getFromAddress())) continue;
+            Instruction source = currentProgram.getListing().getInstructionAt(reference.getFromAddress());
+            if (source != null) result.add(source);
+        }
+        return result;
+    }
+
+    private Register copiedRegister(PcodeOp[] operations) {
+        if (operations.length != 1) return null;
+        int opcode = operations[0].getOpcode();
+        Varnode input = operations[0].getInput(0);
+        if ((opcode != PcodeOp.COPY && opcode != PcodeOp.INT_ZEXT) || input == null || !input.isRegister()) return null;
+        return currentProgram.getRegister(input);
+    }
+
+    /** Validate the ABI layout of a pair; a small literal is decoded here, a large one only located. */
+    private SwiftLiteralLayout swiftLiteralLayout(long word, long object) {
+        int discriminator = (int) (object >>> 60);
+        if (discriminator == 0xE || discriminator == 0xA) {
+            int count = (int) ((object >>> 56) & 0xF);
+            byte[] bytes = new byte[15];
+            for (int index = 0; index < 8; index++) bytes[index] = (byte) (word >>> (8 * index));
+            for (int index = 0; index < 7; index++) bytes[8 + index] = (byte) (object >>> (8 * index));
+            for (int index = count; index < bytes.length; index++) {
+                if (bytes[index] != 0) return null;
+            }
+            // Count zero is the canonical empty string (object 0xE000000000000000, word 0).
+            String value = swiftStringText(bytes, count, discriminator == 0xE);
+            return value == null ? null : new SwiftLiteralLayout("small", null, count, true, value);
+        }
+        int flags = (int) (word >>> 60);
+        long count = word & 0xFFFFFFFFFFFFL;
+        // Immortal literals: ASCII and NFC or neither, tail allocated, with a pointer biased by 32.
+        if ((object >>> 56) != 0x80 || (flags != 0xD && flags != 0x1) || ((word >>> 48) & 0xFFF) != 0) {
+            return null;
+        }
+        try {
+            Address address = currentProgram.getAddressFactory().getDefaultAddressSpace()
+                .getAddress((object & 0x00FFFFFFFFFFFFFFL) + 0x20);
+            MemoryBlock block = currentProgram.getMemory().getBlock(address);
+            // The bytes and their terminator must lie in one initialized, non-executable block,
+            // and Java arrays bound one read.
+            if (block == null || !block.isInitialized() || block.isExecute() ||
+                count >= block.getEnd().subtract(address) + 1 || count >= Integer.MAX_VALUE) {
+                return null;
+            }
+            return new SwiftLiteralLayout("large", address, count, flags == 0xD, null);
+        } catch (Exception unaddressable) {
+            return null;
+        }
+    }
+
+    private String swiftLargeLiteralText(SwiftLiteralLayout layout) {
+        int count = (int) layout.byteLength();
+        byte[] bytes = new byte[count + 1];
+        try {
+            if (currentProgram.getMemory().getBytes(layout.address(), bytes) != bytes.length) return null;
+        } catch (Exception unreadable) {
+            return null;
+        }
+        return bytes[count] == 0 ? swiftStringText(bytes, count, layout.ascii()) : null;
+    }
+
+    /**
+     * Every literal record of one dossier draws on half of the heap that was free when decoding
+     * began. Text is charged at the worst case per UTF-8 byte: two bytes of UTF-16 text, then up
+     * to six escaped JSON characters ("\\u0000") held as UTF-16 in Gson's growing writer buffer
+     * (up to twice its length), again in the returned String, and once more as UTF-8 on the
+     * socket. Each record also pays a fixed cost for its map key, JSON members, addresses, words
+     * and their serialized form, so many empty or small literals are bounded too. Retained
+     * provenance-cache entries draw on that same fixed-state allowance.
+     */
+    private static final class SwiftLiteralBudget {
+        private static final long BYTES_PER_LITERAL_BYTE = 2 + 6 * 2 * 2 + 6 * 2 + 6;
+        private static final long BYTES_PER_RECORD = 4096;
+        private long remaining;
+        private boolean stopped;
+
+        SwiftLiteralBudget() {
+            Runtime runtime = Runtime.getRuntime();
+            remaining = Math.max(0, (runtime.maxMemory() - runtime.totalMemory() + runtime.freeMemory()) / 2);
+        }
+
+        boolean takeState() {
+            if (remaining < BYTES_PER_RECORD) return false;
+            remaining -= BYTES_PER_RECORD;
+            return true;
+        }
+
+        boolean take(long bytes) {
+            if (remaining < BYTES_PER_RECORD ||
+                bytes > (remaining - BYTES_PER_RECORD) / BYTES_PER_LITERAL_BYTE) {
+                return false;
+            }
+            remaining -= BYTES_PER_RECORD + bytes * BYTES_PER_LITERAL_BYTE;
+            return true;
+        }
+
+        void stop() {
+            stopped = true;
+        }
+
+        boolean stopped() {
+            return stopped;
+        }
+    }
+
+    // Swift String values may contain any scalar, including controls; JSON escapes them.
+    private static String swiftStringText(byte[] bytes, int length, boolean ascii) {
+        if (length < 0 || length > bytes.length) return null;
+        for (int index = 0; index < length; index++) {
+            if (ascii && bytes[index] < 0) return null;
+        }
+        try {
+            return StandardCharsets.UTF_8.newDecoder().decode(ByteBuffer.wrap(bytes, 0, length)).toString();
+        } catch (CharacterCodingException invalid) {
+            return null;
+        }
+    }
+
+    private static JsonObject swiftStringOmission(SwiftLiteralLayout layout, long word, long object) {
+        JsonObject item = new JsonObject();
+        item.addProperty("representation", layout.representation());
+        if (layout.address() == null) {
+            item.add("address", JsonNull.INSTANCE);
+        } else {
+            item.addProperty("address", canonicalAddress(layout.address()));
+        }
+        item.addProperty("byte_length", layout.byteLength());
+        item.addProperty("reason", "capacity");
+        item.add("words", swiftStringWords(word, object));
+        return item;
+    }
+
+    private static JsonObject swiftStringItem(
+        String value,
+        SwiftLiteralLayout layout,
+        long word,
+        long object
+    ) {
+        JsonObject item = new JsonObject();
+        item.addProperty("value", value);
+        item.addProperty("representation", layout.representation());
+        if (layout.address() == null) {
+            item.add("address", JsonNull.INSTANCE);
+        } else {
+            item.addProperty("address", canonicalAddress(layout.address()));
+        }
+        item.add("words", swiftStringWords(word, object));
+        return item;
+    }
+
+    private static JsonArray swiftStringWords(long word, long object) {
+        JsonArray words = new JsonArray();
+        words.add("0x" + Long.toUnsignedString(word, 16));
+        words.add("0x" + Long.toUnsignedString(object, 16));
+        return words;
+    }
+
    private static String exclusiveAddress(Address inclusive) {
        Address next = inclusive.next();
        if (next != null && next.getAddressSpace().equals(inclusive.getAddressSpace())) {
@@ -3833,6 +4498,14 @@ public final class ReaGhidraBridge extends HeadlessScript {
    private record AddressNameRequest(String inputAddress, Address address, String name) {}
    private record FunctionEntry(Function function, InventoryItem item) {}
    private record FunctionAnalysisObservation(JsonObject dossier, List<String> limitations) {}
+    private record SwiftStringLiteralDecode(JsonArray literals, JsonArray omissions) {}
+    private record SwiftLiteralLayout(
+        String representation,
+        Address address,
+        long byteLength,
+        boolean ascii,
+        String smallValue
+    ) {}
    private record InstructionScan(List<Instruction> instructions, boolean truncated) {}
    private record SessionDescriptor(
        String transport,
@@ -1,6 +1,8 @@
 import ghidra.app.script.GhidraScript;
 import ghidra.program.model.address.Address;
 import ghidra.program.model.listing.Program;
+import ghidra.program.model.mem.MemoryBlock;
+import ghidra.program.model.mem.MemoryBlockSourceInfo;

 /** Seed the caller-supplied raw-binary entry before default auto-analysis. */
 public final class ReaGhidraPrepareRaw extends GhidraScript {
@@ -21,8 +23,19 @@ public final class ReaGhidraPrepareRaw extends GhidraScript {
            );
        }
        Address entry = currentProgram.getAddressFactory().getDefaultAddressSpace().getAddress(entryHex);
-        Address start = currentProgram.getMinAddress();
-        if (entry == null || !entry.equals(start)) {
+        MemoryBlock block = entry == null ? null : currentProgram.getMemory().getBlock(entry);
+        boolean fileStart = false;
+        if (block != null) {
+            // Processor-defined zero page/stack blocks can precede the imported file.
+            for (MemoryBlockSourceInfo source : block.getSourceInfos()) {
+                if (source.getFileBytes().isPresent() && source.getFileBytesOffset() == 0 &&
+                    entry.equals(source.getMinAddress())) {
+                    fileStart = true;
+                    break;
+                }
+            }
+        }
+        if (!fileStart) {
            throw new IllegalArgumentException(
                "Raw binary import must map file offset 0 at the caller-supplied entry"
            );
@@ -93,7 +93,7 @@ def project_record(state, secrets):
            safe_bytes, credential_url = transport_value(value, path, transport_url)
            content_base64 = base64.b64encode(value).decode("ascii")
            digest = hashlib.sha256(value).hexdigest()
-            hidden = any(secret in value or secret in safe_bytes for secret in byte_secrets) or any(secret in content_base64 or secret in digest for secret in secrets)
+            hidden = any(secret in value or secret in safe_bytes for secret in byte_secrets) or any(secret in content_base64 or secret in digest or secret in str(len(value)) for secret in secrets)
            safe_text = None
            try:
                safe_text = safe_bytes.decode("utf-8", errors="strict")
@@ -11,6 +11,12 @@ import sys

 PROFILE = "pwntools@4.15.0;pyelftools@0.33;unicorn@2.1.2"

+# Linux ET_CORE machine identifiers whose PRSTATUS layout is interpreted with
+# unchanged pwntools 4.15.0 ctypes. Both share pr_cursig@12, pr_pid@32 and
+# pr_reg@112; only the register window differs: amd64 is 27 x 8 bytes for a
+# 336-byte descriptor, AArch64 is 34 x 8 bytes for a 392-byte descriptor.
+CORE_MACHINES = (62, 183)
+

 class CoreFailure(Exception):
    def __init__(self, reason, message):
@@ -51,12 +57,27 @@ def inspect_core(path, cache):
    # Other declared OSABIs must never select Linux note ctypes.
    if content[7] not in (0, 3) or content[8] != 0:
        raise CoreFailure("unsupported-target", "Initial recorded-core profile requires System V or GNU/Linux OSABI with ABI version zero; selected OSABI=" + str(content[7]) + ", ABI version=" + str(content[8]) + ".")
-    if int.from_bytes(content[16:18], "little") != 4 or int.from_bytes(content[18:20], "little") != 62:
-        raise CoreFailure("unsupported-target", "Initial recorded-core profile requires x86-64 ET_CORE.")
+    machine = int.from_bytes(content[18:20], "little")
+    if int.from_bytes(content[16:18], "little") != 4 or machine not in CORE_MACHINES:
+        raise CoreFailure("unsupported-target", "Initial recorded-core profile requires ET_CORE for x86-64 or AArch64; selected ET_TYPE=" + str(int.from_bytes(content[16:18], "little")) + ", e_machine=" + str(machine) + ".")
    from elftools.common.exceptions import ELFError
    from elftools.common.utils import struct_parse
    from elftools.elf.elffile import ELFFile
-    from pwnlib.elf.datatypes import elf_prstatus_amd64, elf_siginfo_64, user_regs_struct_amd64
+    from pwnlib.elf.datatypes import (
+        elf_prstatus_aarch64,
+        elf_prstatus_amd64,
+        elf_siginfo_64,
+        user_regs_struct_aarch64,
+        user_regs_struct_amd64,
+    )
+    if machine == 62:
+        profile_label = "x86-64"
+        architecture = "x86_64-little-endian"
+        prstatus_type, registers_type = elf_prstatus_amd64, user_regs_struct_amd64
+    else:
+        profile_label = "AArch64"
+        architecture = "aarch64-little-endian"
+        prstatus_type, registers_type = elf_prstatus_aarch64, user_regs_struct_aarch64
    try:
        image = ELFFile(io.BytesIO(content))
        header = image.header
@@ -107,17 +128,17 @@ def inspect_core(path, cache):
                if owner != b"CORE\0":
                    continue
                if note.n_type == "NT_PRSTATUS":
-                    if len(descriptor) < ctypes.sizeof(elf_prstatus_amd64):
-                        raise CoreFailure("format", "Linux amd64 NT_PRSTATUS descriptor is truncated.")
-                    status = elf_prstatus_amd64.from_buffer_copy(descriptor)
+                    if len(descriptor) < ctypes.sizeof(prstatus_type):
+                        raise CoreFailure("format", "Linux " + profile_label + " NT_PRSTATUS descriptor is truncated.")
+                    status = prstatus_type.from_buffer_copy(descriptor)
                    registers = []
-                    for name, kind in user_regs_struct_amd64._fields_:
-                        relative = elf_prstatus_amd64.pr_reg.offset + getattr(user_regs_struct_amd64, name).offset
+                    for name, kind in registers_type._fields_:
+                        relative = prstatus_type.pr_reg.offset + getattr(registers_type, name).offset
                        registers.append({"name": name, "value": hex(getattr(status.pr_reg, name)), "location": location(descriptor_start + relative, ctypes.sizeof(kind), end)})
                    threads.append({"note_index": note_index, "historical_pid": ctypes.c_int32(status.pr_pid).value, "recorded_current_signal": status.pr_cursig, "registers": registers})
                elif note.n_type == "NT_SIGINFO":
                    if len(descriptor) < ctypes.sizeof(elf_siginfo_64):
-                        raise CoreFailure("format", "Linux amd64 NT_SIGINFO descriptor is truncated.")
+                        raise CoreFailure("format", "Linux " + profile_label + " NT_SIGINFO descriptor is truncated.")
                    signal = elf_siginfo_64.from_buffer_copy(descriptor)
                    number = ctypes.c_int32(signal.si_signo).value
                    code = ctypes.c_int32(signal.si_code).value
@@ -125,7 +146,7 @@ def inspect_core(path, cache):
                    signals.append({"note_index": note_index, "number": number, "code": code, "errno": ctypes.c_int32(signal.si_errno).value,
                                    "fault_address": hex(signal.sigfault_addr) if known else None,
                                    "fault_address_meaning": "recorded-sigsegv-address" if known else "unknown", "thread_association": "unknown"})
-        return {"format": "elf-core", "architecture": "x86_64-little-endian", "target_execution": "not-performed", "live_process_identity": "unknown",
+        return {"format": "elf-core", "architecture": architecture, "target_execution": "not-performed", "live_process_identity": "unknown",
                "segments": segments, "notes": notes, "note_padding": padding, "threads": threads, "signals": signals,
                "note_interpretation_completeness": "unknown",
                "limitations": ["The initial Linux note profile accepts System V/unspecified or GNU/Linux OSABI with ABI version zero; an unspecified OSABI alone does not prove operating-system origin.",
@@ -1,4 +1,18 @@
 import { defineConfig } from "vitepress";
+import { dirname, relative, resolve, sep } from "node:path";
+import { fileURLToPath } from "node:url";
+import {
+  documentationRewrites,
+  documentationSections,
+} from "./documentation.js";
+
+const documentationRoot = fileURLToPath(new URL("..", import.meta.url));
+const rewrites: Record<string, string> = {
+  ...documentationRewrites,
+  "README.md": "documentation.md",
+  "specs/README.md": "specs/index.md",
+  "adr/README.md": "adr/index.md",
+};

 export default defineConfig({
  title: "REA",
@@ -6,79 +20,92 @@ export default defineConfig({
    "Reverse engineer binaries, applications, and runtime behavior with one CLI and MCP server.",
  lang: "en-US",
  base: "/rea/",
+  rewrites,
+  markdown: {
+    config(md) {
+      // Repository links resolve from their physical source. Render them from
+      // the stable public route instead, including links across categories.
+      md.core.ruler.after("inline", "documentation-source-links", (state) => {
+        const physicalPath =
+          state.env.realPath ??
+          (state.env.relativePath
+            ? resolve(documentationRoot, state.env.relativePath)
+            : null);
+        if (physicalPath === null) return;
+        const renderedPath =
+          state.env.path ??
+          resolve(
+            documentationRoot,
+            rewrites[state.env.relativePath] ?? state.env.relativePath,
+          );
+        for (const block of state.tokens) {
+          for (const token of block.children ?? []) {
+            const attribute =
+              token.type === "link_open"
+                ? "href"
+                : token.type === "image"
+                  ? "src"
+                  : null;
+            if (attribute === null) continue;
+            const destination = token.attrGet(attribute);
+            if (
+              !destination ||
+              /^(?:[a-z][a-z\d+.-]*:|[/#])/iu.test(destination)
+            )
+              continue;
+            const separator = destination.search(/[?#]/u);
+            const path =
+              separator === -1 ? destination : destination.slice(0, separator);
+            const suffix = separator === -1 ? "" : destination.slice(separator);
+            const source = relative(
+              documentationRoot,
+              resolve(dirname(physicalPath), path),
+            )
+              .split(sep)
+              .join("/");
+            const rendered = relative(
+              dirname(renderedPath),
+              resolve(
+                documentationRoot,
+                source.startsWith("public/")
+                  ? source.slice("public/".length)
+                  : (rewrites[source] ?? source),
+              ),
+            )
+              .split(sep)
+              .join("/");
+            token.attrSet(attribute, rendered + suffix);
+          }
+        }
+      });
+    },
+  },
+  srcExclude: ["readme/**"],
  themeConfig: {
    nav: [
      { text: "Get started", link: "/installation" },
+      { text: "Documentation", link: "/documentation" },
      { text: "Reference", link: "/mcp-contracts" },
      { text: "Roadmap", link: "/roadmap" },
    ],
    sidebar: [
      {
-        text: "Getting started",
+        text: "Documentation directory",
        items: [
-          { text: "Installation and setup", link: "/installation" },
-          { text: "Client configuration", link: "/client-configuration" },
-          { text: "CLI and Evidence", link: "/cli" },
-          { text: "Agent prompts", link: "/mcp-prompts" },
-          { text: "Roadmap", link: "/roadmap" },
-        ],
-      },
-      {
-        text: "Investigation guides",
-        items: [
-          { text: "Native binaries", link: "/native-investigation" },
-          { text: "Go build metadata", link: "/go-binaries" },
-          {
-            text: "JavaScript and Electron",
-            link: "/javascript-artifact-reconstruction",
-          },
-          {
-            text: "JavaScript workflows",
-            link: "/javascript-application-workflows",
-          },
-          { text: "Browser observation", link: "/browser-observation" },
-          {
-            text: "Web network captures",
-            link: "/web-network-captures",
-          },
-          { text: "Electron observation", link: "/electron-observation" },
-          { text: "Process capture", link: "/process-capture" },
-          { text: ".NET assemblies", link: "/managed-code-analysis" },
-          { text: "Android applications", link: "/android-analysis" },
-          { text: "Apple applications", link: "/apple-application-analysis" },
-          { text: "Firmware", link: "/firmware-analysis" },
-          { text: "SQLite databases", link: "/sqlite-databases" },
-          { text: "Packet captures", link: "/packet-captures" },
-          { text: "Signal recordings", link: "/signal-recordings" },
-        ],
-      },
-      {
-        text: "Provider guides",
-        collapsed: true,
-        items: [
-          { text: "IDA", link: "/ida-provider" },
-          { text: "Ghidra on Windows", link: "/windows-ghidra-p0" },
-          { text: "Ghidra DOS analysis", link: "/ghidra-dos" },
-          { text: "Ghidra raw binary", link: "/raw-binary" },
-          { text: "Ghidra NativeAOT", link: "/ghidra-nativeaot" },
-          { text: "Ghidra semantics", link: "/ghidra-provider" },
-        ],
-      },
-      {
-        text: "Reference and development",
-        collapsed: true,
-        items: [
-          { text: "MCP contracts", link: "/mcp-contracts" },
-          { text: "Tool design", link: "/tool-design" },
-          { text: "Testing", link: "/testing" },
-          { text: "Client verification", link: "/client-verification" },
-          {
-            text: "Reconstruction readiness",
-            link: "/reconstruction-readiness",
-          },
-          { text: "Releasing", link: "/releasing" },
+          { text: "All guides", link: "/documentation" },
+          { text: "Authoring conventions", link: "/development/documentation" },
+          { text: "Feature specifications", link: "/specs/" },
+          { text: "Architecture decisions", link: "/adr/" },
        ],
      },
+      ...documentationSections.map((section) => ({
+        text: section.text,
+        collapsed: section.text !== "Getting started",
+        items: section.items.map((item) => ({
+          text: item.text,
+          link: item.route,
+        })),
+      })),
    ],
    search: { provider: "local" },
    socialLinks: [
@@ -0,0 +1,384 @@
+// Authored guide ownership: physical sources and stable public routes.
+export const documentationSections = [
+  {
+    text: "Getting started",
+    items: [
+      {
+        text: "Installation and setup",
+        source: "getting-started/installation.md",
+        route: "/installation",
+      },
+      {
+        text: "Client configuration and troubleshooting",
+        source: "getting-started/client-configuration.md",
+        route: "/client-configuration",
+      },
+      {
+        text: "CLI and Evidence",
+        source: "getting-started/cli.md",
+        route: "/cli",
+      },
+      {
+        text: "Guided MCP prompts and completion",
+        source: "getting-started/mcp-prompts.md",
+        route: "/mcp-prompts",
+      },
+    ],
+  },
+  {
+    text: "Native binaries",
+    items: [
+      {
+        text: "Native binary investigation",
+        source: "guides/native/native-investigation.md",
+        route: "/native-investigation",
+      },
+      {
+        text: "Go binary build metadata",
+        source: "guides/native/go-binaries.md",
+        route: "/go-binaries",
+      },
+      {
+        text: "Offline binary diagnostics",
+        source: "guides/native/binary-diagnostics.md",
+        route: "/binary-diagnostics",
+      },
+      {
+        text: "Recorded crash evidence",
+        source: "guides/native/recorded-crashes.md",
+        route: "/recorded-crashes",
+      },
+    ],
+  },
+  {
+    text: "JavaScript and Electron",
+    items: [
+      {
+        text: "JavaScript Application Graph",
+        source: "guides/javascript/javascript-application-graph.md",
+        route: "/javascript-application-graph",
+      },
+      {
+        text: "Cross-layer JavaScript application workflows",
+        source: "guides/javascript/javascript-application-workflows.md",
+        route: "/javascript-application-workflows",
+      },
+      {
+        text: "JavaScript artifact reconstruction",
+        source: "guides/javascript/javascript-artifact-reconstruction.md",
+        route: "/javascript-artifact-reconstruction",
+      },
+      {
+        text: "JavaScript source recovery",
+        source: "guides/javascript/javascript-recovery.md",
+        route: "/javascript-recovery",
+      },
+      {
+        text: "Passive Node and Electron runtime observation",
+        source: "guides/javascript/javascript-runtime-observation.md",
+        route: "/javascript-runtime-observation",
+      },
+      {
+        text: "JavaScript static/runtime reconciliation",
+        source: "guides/javascript/javascript-runtime-reconciliation.md",
+        route: "/javascript-runtime-reconciliation",
+      },
+      {
+        text: "Electron file-page observation",
+        source: "guides/javascript/electron-observation.md",
+        route: "/electron-observation",
+      },
+    ],
+  },
+  {
+    text: "Browser and captured websites",
+    items: [
+      {
+        text: "Website observation with CDP",
+        source: "guides/web/browser-observation.md",
+        route: "/browser-observation",
+      },
+      {
+        text: "Browser scenario contract",
+        source: "guides/web/browser-scenario-contract.md",
+        route: "/browser-scenario-contract",
+      },
+      {
+        text: "Website runtime source attribution",
+        source: "guides/web/web-runtime.md",
+        route: "/web-runtime",
+      },
+      {
+        text: "Historical web network captures",
+        source: "guides/web/web-network-captures.md",
+        route: "/web-network-captures",
+      },
+      {
+        text: "Captured website source locations",
+        source: "guides/web/web-source-location.md",
+        route: "/web-source-location",
+      },
+      {
+        text: "Captured website module relationships",
+        source: "guides/web/website-module-trace.md",
+        route: "/website-module-trace",
+      },
+      {
+        text: "Captured website scripts and static JavaScript analysis",
+        source: "guides/web/website-script-export.md",
+        route: "/website-script-export",
+      },
+    ],
+  },
+  {
+    text: "Android applications",
+    items: [
+      {
+        text: "Static Android APK analysis",
+        source: "guides/android/android-analysis.md",
+        route: "/android-analysis",
+      },
+      {
+        text: "Apktool resource decoding",
+        source: "guides/android/apktool-resource-analysis.md",
+        route: "/apktool-resource-analysis",
+      },
+      {
+        text: "ADB device inspection and acquisition",
+        source: "guides/android/adb-device-analysis.md",
+        route: "/adb-device-analysis",
+      },
+      {
+        text: "Flutter build identification",
+        source: "guides/android/flutter-analysis.md",
+        route: "/flutter-analysis",
+      },
+    ],
+  },
+  {
+    text: "Apple applications",
+    items: [
+      {
+        text: "Apple Application Inventory Projection",
+        source: "guides/apple/apple-application-analysis.md",
+        route: "/apple-application-analysis",
+      },
+    ],
+  },
+  {
+    text: ".NET assemblies",
+    items: [
+      {
+        text: "Managed-code analysis",
+        source: "guides/managed/managed-code-analysis.md",
+        route: "/managed-code-analysis",
+      },
+    ],
+  },
+  {
+    text: "Firmware",
+    items: [
+      {
+        text: "Firmware analysis",
+        source: "guides/firmware/firmware-analysis.md",
+        route: "/firmware-analysis",
+      },
+    ],
+  },
+  {
+    text: "HarmonyOS packages",
+    items: [
+      {
+        text: "Static HarmonyOS package inventory",
+        source: "guides/harmony/harmony-analysis.md",
+        route: "/harmony-analysis",
+      },
+    ],
+  },
+  {
+    text: "WebAssembly",
+    items: [
+      {
+        text: "Offline WebAssembly artifacts",
+        source: "guides/wasm/wasm-artifacts.md",
+        route: "/wasm-artifacts",
+      },
+    ],
+  },
+  {
+    text: "EVM contracts",
+    items: [
+      {
+        text: "Offline EVM bytecode",
+        source: "guides/evm/evm-bytecode.md",
+        route: "/evm-bytecode",
+      },
+    ],
+  },
+  {
+    text: "Databases and recorded packets",
+    items: [
+      {
+        text: "SQLite database snapshots",
+        source: "guides/data/sqlite-databases.md",
+        route: "/sqlite-databases",
+      },
+      {
+        text: "Recorded packet capture inspection",
+        source: "guides/data/packet-captures.md",
+        route: "/packet-captures",
+      },
+      {
+        text: "Packet capture summaries",
+        source: "guides/data/pcap-analysis.md",
+        route: "/pcap-analysis",
+      },
+    ],
+  },
+  {
+    text: "Process capture and instrumentation",
+    items: [
+      {
+        text: "Process capture",
+        source: "guides/runtime/process-capture.md",
+        route: "/process-capture",
+      },
+      {
+        text: "Frida instrumentation",
+        source: "guides/runtime/frida-instrumentation.md",
+        route: "/frida-instrumentation",
+      },
+    ],
+  },
+  {
+    text: "Provider setup and formats",
+    items: [
+      {
+        text: "Ghidra provider semantics",
+        source: "providers/ghidra-provider.md",
+        route: "/ghidra-provider",
+      },
+      {
+        text: "DOS MZ and COM analysis with Ghidra",
+        source: "providers/ghidra-dos.md",
+        route: "/ghidra-dos",
+      },
+      {
+        text: "Optional NativeAOT metadata recovery",
+        source: "providers/ghidra-nativeaot.md",
+        route: "/ghidra-nativeaot",
+      },
+      {
+        text: "MIPS ELF analysis through Ghidra",
+        source: "providers/ghidra-mips.md",
+        route: "/ghidra-mips",
+      },
+      {
+        text: "PSP static ELF analysis through Ghidra",
+        source: "providers/ghidra-psp.md",
+        route: "/ghidra-psp",
+      },
+      {
+        text: "RISC-V ELF analysis through Ghidra",
+        source: "providers/ghidra-riscv.md",
+        route: "/ghidra-riscv",
+      },
+      {
+        text: "Windows Ghidra P0",
+        source: "providers/windows-ghidra-p0.md",
+        route: "/windows-ghidra-p0",
+      },
+      {
+        text: "Headerless raw-binary analysis with Ghidra",
+        source: "providers/raw-binary.md",
+        route: "/raw-binary",
+      },
+      {
+        text: "IDA provider",
+        source: "providers/ida-provider.md",
+        route: "/ida-provider",
+      },
+      {
+        text: "JEB instrumentation and analysis",
+        source: "providers/jeb-analysis.md",
+        route: "/jeb-analysis",
+      },
+    ],
+  },
+  {
+    text: "Contracts and evidence",
+    items: [
+      {
+        text: "MCP runtime contracts",
+        source: "reference/mcp-contracts.md",
+        route: "/mcp-contracts",
+      },
+      {
+        text: "Reconstruction obligation ledgers",
+        source: "reference/reconstruction-obligation-ledgers.md",
+        route: "/reconstruction-obligation-ledgers",
+      },
+    ],
+  },
+  {
+    text: "Development and verification",
+    items: [
+      {
+        text: "MCP tool design",
+        source: "development/tool-design.md",
+        route: "/tool-design",
+      },
+      {
+        text: "Testing REA",
+        source: "development/testing.md",
+        route: "/testing",
+      },
+      {
+        text: "Client and agent verification",
+        source: "development/client-verification.md",
+        route: "/client-verification",
+      },
+      {
+        text: "Reconstruction readiness conformance",
+        source: "development/reconstruction-readiness.md",
+        route: "/reconstruction-readiness",
+      },
+      {
+        text: "Releasing REA",
+        source: "development/releasing.md",
+        route: "/releasing",
+      },
+      {
+        text: "REA roadmap",
+        source: "development/roadmap.md",
+        route: "/roadmap",
+      },
+    ],
+  },
+  {
+    text: "Release migrations",
+    items: [
+      {
+        text: "Upgrading from REA 6.1 to 6.2",
+        source: "migrations/migration-6.2.md",
+        route: "/migration-6.2",
+      },
+    ],
+  },
+  {
+    text: "Signal recordings",
+    items: [
+      {
+        text: "Recorded signal inspection",
+        source: "guides/signals/signal-recordings.md",
+        route: "/signal-recordings",
+      },
+    ],
+  },
+];
+
+export const documentationRewrites = Object.fromEntries(
+  documentationSections.flatMap((section) =>
+    section.items.map((item) => [item.source, `${item.route.slice(1)}.md`]),
+  ),
+);
@@ -0,0 +1,138 @@
+# Documentation directory
+
+REA documentation is organized by reader task and document owner. This directory
+links every authored guide; the [site](https://rea.tools/) also serves separate
+product pages. The VitePress documentation source is this `docs/` tree.
+
+## Getting started
+
+- [Installation and setup](getting-started/installation.md)
+- [Client configuration and troubleshooting](getting-started/client-configuration.md)
+- [CLI and Evidence](getting-started/cli.md)
+- [Guided MCP prompts and completion](getting-started/mcp-prompts.md)
+
+## Native binaries
+
+- [Native binary investigation](guides/native/native-investigation.md)
+- [Go binary build metadata](guides/native/go-binaries.md)
+- [Offline binary diagnostics](guides/native/binary-diagnostics.md)
+- [Recorded crash evidence](guides/native/recorded-crashes.md)
+
+## JavaScript and Electron
+
+- [JavaScript Application Graph](guides/javascript/javascript-application-graph.md)
+- [Cross-layer JavaScript application workflows](guides/javascript/javascript-application-workflows.md)
+- [JavaScript artifact reconstruction](guides/javascript/javascript-artifact-reconstruction.md)
+- [JavaScript source recovery](guides/javascript/javascript-recovery.md)
+- [Passive Node and Electron runtime observation](guides/javascript/javascript-runtime-observation.md)
+- [JavaScript static/runtime reconciliation](guides/javascript/javascript-runtime-reconciliation.md)
+- [Electron file-page observation](guides/javascript/electron-observation.md)
+
+## Browser and captured websites
+
+- [Website observation with CDP](guides/web/browser-observation.md)
+- [Browser scenario contract](guides/web/browser-scenario-contract.md)
+- [Website runtime source attribution](guides/web/web-runtime.md)
+- [Historical web network captures](guides/web/web-network-captures.md)
+- [Captured website source locations](guides/web/web-source-location.md)
+- [Captured website module relationships](guides/web/website-module-trace.md)
+- [Captured website scripts and static JavaScript analysis](guides/web/website-script-export.md)
+
+## Android applications
+
+- [Static Android APK analysis](guides/android/android-analysis.md)
+- [Apktool resource decoding](guides/android/apktool-resource-analysis.md)
+- [ADB device inspection and acquisition](guides/android/adb-device-analysis.md)
+- [Flutter build identification](guides/android/flutter-analysis.md)
+
+## Apple applications
+
+- [Apple Application Inventory Projection](guides/apple/apple-application-analysis.md)
+
+## .NET assemblies
+
+- [Managed-code analysis](guides/managed/managed-code-analysis.md)
+
+## Firmware
+
+- [Firmware analysis](guides/firmware/firmware-analysis.md)
+
+## HarmonyOS packages
+
+- [Static HarmonyOS package inventory](guides/harmony/harmony-analysis.md)
+
+## WebAssembly
+
+- [Offline WebAssembly artifacts](guides/wasm/wasm-artifacts.md)
+
+## EVM contracts
+
+- [Offline EVM bytecode](guides/evm/evm-bytecode.md)
+
+## Databases and recorded packets
+
+- [SQLite database snapshots](guides/data/sqlite-databases.md)
+- [Recorded packet capture inspection](guides/data/packet-captures.md)
+- [Packet capture summaries](guides/data/pcap-analysis.md)
+
+## Process capture and instrumentation
+
+- [Process capture](guides/runtime/process-capture.md)
+- [Frida instrumentation](guides/runtime/frida-instrumentation.md)
+
+## Signal recordings
+
+- [Recorded signal inspection](guides/signals/signal-recordings.md)
+
+## Provider setup and formats
+
+- [Ghidra provider semantics](providers/ghidra-provider.md)
+- [DOS MZ and COM analysis with Ghidra](providers/ghidra-dos.md)
+- [Optional NativeAOT metadata recovery](providers/ghidra-nativeaot.md)
+- [MIPS ELF analysis through Ghidra](providers/ghidra-mips.md)
+- [PSP static ELF analysis through Ghidra](providers/ghidra-psp.md)
+- [RISC-V ELF analysis through Ghidra](providers/ghidra-riscv.md)
+- [Windows Ghidra P0](providers/windows-ghidra-p0.md)
+- [Headerless raw-binary analysis with Ghidra](providers/raw-binary.md)
+- [IDA provider](providers/ida-provider.md)
+- [JEB instrumentation and analysis](providers/jeb-analysis.md)
+
+## Contracts and evidence
+
+- [MCP runtime contracts](reference/mcp-contracts.md)
+- [Reconstruction obligation ledgers](reference/reconstruction-obligation-ledgers.md)
+
+## Development and verification
+
+- [MCP tool design](development/tool-design.md)
+- [Testing REA](development/testing.md)
+- [Client and agent verification](development/client-verification.md)
+- [Reconstruction readiness conformance](development/reconstruction-readiness.md)
+- [Releasing REA](development/releasing.md)
+- [REA roadmap](development/roadmap.md)
+
+## Release migrations
+
+- [Upgrading from REA 6.1 to 6.2](migrations/migration-6.2.md)
+
+## Architecture and authoring
+
+- [Architecture map](https://github.com/morluto/rea/blob/main/docs/architecture/architecture.mermaid)
+- [Documentation ownership and contribution model](development/documentation.md)
+- [Feature specifications](specs/README.md)
+- [Architectural decision records](adr/README.md)
+
+## Machine-owned documentation
+
+| Path                                      | Owner and update command                                                                  |
+| ----------------------------------------- | ----------------------------------------------------------------------------------------- |
+| `public/product-catalog.json`             | Ignored contract projection; `npm run docs:generate`                                      |
+| `verification/managed-conformance-*.json` | Ignored managed conformance projections; `npm run evidence:generate`                      |
+| `error-contract.schema.json`              | Tracked schema from contracts; `npm run docs:error-schema`                                |
+| `user-visible-errors.csv`                 | Authored error classification inventory; preserve its schema                              |
+| `releases/<version>.contributions.json`   | Durable release contribution record; follow the [release guide](development/releasing.md) |
+| `assets/`                                 | Shared authored images referenced by guides                                               |
+
+Do not edit generated catalogs or evidence to change product facts. Change their
+canonical contracts or producer and regenerate. Historical release records retain
+the exact commit messages and references from the release they describe.
@@ -0,0 +1,9 @@
+# Architectural decision records
+
+Store one actual decision per `docs/adr/<domain>/<decision-slug>.md`, without a
+global sequence number. Use meaningful names and the Michael Nygard sections:
+Status, Context, Decision and Consequences. Link each decision from its owning
+feature specification.
+
+See [the authoring guide](../development/documentation.md#feature-lifecycle) for
+the distinction between specifications, roadmaps and isolated decisions.
@@ -18,14 +18,26 @@ pass `-- chat` to check plain chat with REA enabled. Qwen also reads the full
 result that its client offloads, and Pi exercises default codemode execution.
 Use `REA_VERIFY_RUNTIME_ROOT` to select a production-only installed REA package.
 Receipts retain client versions, result digests, host coverage and owned-process
-cleanup. These POSIX lanes use a deterministic loopback model, so they do not
-prove live model-provider or native Windows compatibility. Qwen, Pi and Hermes
+cleanup. These lanes use a deterministic loopback model and do not prove live
+model-provider compatibility. Pi and Hermes remain POSIX-only. Qwen, Pi and Hermes
 bind both `HOME` and `USERPROFILE` to the disposable account. Qwen and Pi discover
 the shared personal skill through their default search paths without an explicit
 skill setting; Hermes discovers it through the selected `HERMES_HOME`.
 Set `REA_VERIFY_HERMES_STICKY_PROFILE=1` to exercise native Hermes selection of
 a named sticky profile with `HERMES_HOME` still pointing to its root.

+The Qwen lane also supports native Windows (verified with Qwen Code 0.25.1 and
+Node 24.19.0 for both `chat` and `call`). With Node 24.18.0, the same `call`
+journey reached full Evidence readback but the client aborted during exit with
+`UV_HANDLE_CLOSING`; that run remains a failure, not a compatibility claim.
+Select the npm install's
+`node_modules/@qwen-code/qwen-code/cli-entry.js` with `REA_VERIFY_QWEN_COMMAND`,
+because `execFile` cannot launch the `qwen.cmd` shim directly. A selected `.js`,
+`.mjs` or `.cjs` entry point runs under the verifier's Node. Windows path checks
+use native separators; persisted output is read through Qwen's real shell tool
+with a shell-independent encoded Node payload. Windows receipts report process
+lineage as unavailable when the verifier has no retained native Job Object lease.
+
 `verify:gemini-client` requires an installed Gemini CLI (verified with
 `@google/gemini-cli@0.63.0` on POSIX and native Windows); select it with
 `REA_VERIFY_GEMINI_COMMAND`. A selected `.js`, `.mjs` or `.cjs` entry point runs
@@ -298,13 +310,42 @@ subsequent wire recovery and clean shutdown. Caller timeout does not interrupt
 Hopper's synchronous native operation. Socket boundary tests deterministically
 cover active and queued expiry, late replies and timer cleanup.

-The Linux demo lane remains a separate `verify:hopper:linux` command. Its
-lifecycle checks attempt competing CLI launches for the active target and a
+The Linux demo lane remains a separate `verify:hopper:linux` command. Hopper
+6.4.2's ELF loader did not recognize the original 4,119-byte literal or three
+non-ASCII byte strings in the measured fixtures. The lane retains complete raw
+byte checks for those literals through source-owned symbols. Recognition of the
+original full-length literal is bound to its exact source address; its decoded
+object coverage remains explicitly unverified on Linux even when recognized.
+Absent non-ASCII recognition also reports decoded-object coverage as unverified.
+Recognized non-ASCII and control-text objects must still match their source
+bytes, encoding, filters and searches.
+A separate 548-byte ASCII literal requires native fragmentation, shortened
+provider display, complete decoded fragments and dossier provenance on Linux;
+the macOS lane retains the original full-length recognition requirement. These
+are observed fixture/build capabilities, not universal Hopper length limits.
+Its lifecycle checks attempt competing CLI launches for the active target and a
 different target, requiring rejection before either can change the owning
 MCP session's documents or procedures. Lease boundary tests also preserve
 unresponsive or malformed live endpoints while allowing confirmed stale
 sockets to recover.

+`verify:setup:linux` exercises installation on a clean supported Linux runner as
+root. Use a disposable VM: this lane installs Hopper and its Linux runtime
+dependencies through the system package manager. Set `REA_VERIFY_SERVER_COMMAND`
+to the CLI entrypoint being verified. The command builds and checks source-owned
+ELF fixtures before testing the read-only Hopper setup plan, approved
+installation, scoped doctor, real CLI/MCP analysis, rejection of a modified
+launcher, idempotent setup without requesting a reinstall, and owned child
+cleanup. Before installation and after teardown, a clean-runner process scan
+also rejects surviving Hopper demo helpers or Xvfb groups, including orphans
+whose launcher exited. This scan observes processes without signaling them.
+Hopper detection compares executable file identity through `/proc`, covering
+alternate or configured launcher paths even after an invoked symlink is removed.
+The dedicated runner must have no unrelated Hopper/Xvfb sessions. It requires
+the repository's pinned development toolchain and an
+existing host C compiler, `file`, `nm`, and `strings`. Use `verify:hopper:linux`
+instead when Hopper is already installed.
+
 `verify:hopper:fat` is a separate macOS lane requiring installed Hopper and the
 existing Xcode clang/lipo toolchain. It compiles arm64/x86-64 thin executables and
 one- and two-slice FAT32 containers, verifies exact/interior address mappings
@@ -365,7 +406,7 @@ existing static JavaScript analysis through CLI and stdio MCP, including
 manifest readback, competing query variants, and resolved relative imports.
 It uses an installed browser and accepts an optional installed REA entrypoint.
 The complete `verify:browser` lane also exercises passive script export through
-both public adapters. See [website script export](website-script-export.md).
+both public adapters. See [website script export](../guides/web/website-script-export.md).

 `verify:browser:modules` compares CLI and stdio MCP traces against an independent
 real Chromium module-loading fixture: import-map scopes, package prefixes,
@@ -373,7 +414,7 @@ null/backtracking rejection, query/fragment identities, repeated module instance
 lazy and computed unknowns, exact source/map identities and no implicit refetch.
 Set `REA_BROWSER_EXECUTABLE`; the optional script argument selects an installed
 package entrypoint. The complete `verify:browser` lane and existing conditional
-Chrome CI include this verifier. See [module relationships](website-module-trace.md).
+Chrome CI include this verifier. See [module relationships](../guides/web/website-module-trace.md).

 ## Agent evaluation and conformance records

@@ -417,7 +458,7 @@ artifact path. Its `expectedFirstTool` is `null`, and
 `targetClarificationPassed` grades that limited routing outcome independently
 of analysis prose heuristics. Analyzing a nearby example cannot pass this case.

-The packaged desktop and parser-comparison scenarios now assess a closed set of
+The packaged desktop, parser-comparison, and managed scenarios assess a closed set of
 known fixture claims. Each final answer must be a strict JSON manifest containing
 exactly the requested claim IDs, values, Evidence IDs, and Evidence authority and
 confidence. Golden values are not included in the prompt. The evaluator checks
@@ -434,15 +475,24 @@ analyses and use the requested module and export selectors. Boundary tests packa
 the same source-owned desktop fixture and compare the same source-owned parser
 files through actual MCP tool results, then verify that fabricated answers fail.

+The managed rubric checks the exact public top-level type set and the CLI entry
+point's declaring type and method name. The exact type-set claim requires an
+unfiltered member inventory: `selection` must be null and the Evidence parameters
+must omit `type_names`. A selected inventory can still ground the entry-point
+claim. Both inspections must describe the freshly built DLL's SHA-256. Entry-point
+resolution additionally requires complete artifact and member metadata, matching
+non-null module MVIDs, and a unique method at the header's metadata token. These are
+static metadata claims, not runtime behavior;
+compiler-generated member counts, token values, and MVIDs are not golden answers.
+
 Per-scenario `factualCorrectness` is `passed`, `failed`, or `not_assessed` within
 the `configured_fixture_claims` scope. A pass establishes only the configured
-claims, not unrestricted factual correctness. Native, managed, browser,
+claims, not unrestricted factual correctness. Native, browser,
 navigation-context, and address-context scenarios have no factual rubric and
-remain `not_assessed`; the managed workflow requires both artifact and member
-inspection to answer its type and entry-point question.
+remain `not_assessed`.

 The closed factual scenarios request complete producer Evidence on the initial
-analysis so their source selectors can authenticate all configured facts.
+inspection or analysis so their source selectors can authenticate all configured facts.
 Summary/page/item workflows are exercised separately by `javascript-module-view`;
 its heuristic gate does not establish full-producer factual correctness.

@@ -0,0 +1,82 @@
+# Documentation ownership and authoring
+
+Use the [documentation directory](../README.md) to find existing material before
+adding another guide. Preserve one canonical owner for each contract or workflow;
+link to that owner instead of copying its claims into several guides.
+
+## Choose a destination
+
+| Document                                                 | Destination                            |
+| -------------------------------------------------------- | -------------------------------------- |
+| Installation, client setup and first CLI/MCP steps       | `docs/getting-started/`                |
+| Analyst workflows and evidence interpretation            | `docs/guides/<domain>/`                |
+| Analysis-engine configuration and format prerequisites   | `docs/providers/`                      |
+| Shared runtime contracts and evidence semantics          | `docs/reference/`                      |
+| Development, testing, release and authoring instructions | `docs/development/`                    |
+| Composition diagrams                                     | `docs/architecture/`                   |
+| Compatibility changes for a released version             | `docs/migrations/`                     |
+| One feature specification, plan and tasks                | `docs/specs/<domain>/<feature-slug>/`  |
+| One architectural decision                               | `docs/adr/<domain>/<decision-slug>.md` |
+
+Use meaningful, lowercase domain and feature slugs. Global numeric prefixes are
+unnecessary: different domains can add features independently, and branches do
+not compete for the next sequence number. Check the existing domain directory
+and linked issues before creating a feature with the same slug.
+
+Guides describe existing behavior and limitations. Specs define one proposed
+feature or domain change; an existing guide does not become a specification by
+moving it into `specs/`.
+
+## Feature lifecycle
+
+Create the specification before implementation. Each feature directory contains:
+
+- `spec.md`: problem, desired behavior, requirements, acceptance and non-goals.
+- `plan.md`: the single implementation plan, contracts and architectural choices.
+- `tasks.md`: incremental, testable steps linked to requirements and verification.
+
+Split independent domains or separately reviewable features before writing their
+specs. A broad `ROADMAP.md`, when useful, only lists child specifications, order
+and dependencies; requirements and implementation tasks belong to each child.
+Cross-repository contracts have one producer-owned specification. Consumers link
+to that contract instead of maintaining competing copies.
+
+Record an isolated architectural decision separately in
+`docs/adr/<domain>/<decision-slug>.md`, with **Status**, **Context**,
+**Decision** and **Consequences**. Link the ADR from affected specifications.
+Do not create decision records for routine file moves or invent past decisions.
+
+Specs do not replace the contribution-scope decision required for a new provider
+or expanded execution authority. Follow
+[contribution scope](https://github.com/morluto/rea/blob/main/CONTRIBUTING.md#contribution-scope).
+
+## Links and public routes
+
+Use relative links to physical Markdown files so GitHub readers can follow them.
+Link repository files outside `docs/` with their full GitHub URLs. Preserve
+existing heading anchors when moving a guide.
+
+[`documentation.ts`](https://github.com/morluto/rea/blob/main/docs/.vitepress/documentation.ts)
+owns categorized site navigation and the existing guides' stable public routes.
+Update it when adding or moving a guide. VitePress rewrites categorized sources
+to the existing public paths; its Markdown hook resolves repository links from
+the physical source and renders them against those public routes. Keep basenames
+and route assignments unique. Edit links use the physical source file.
+
+For a move, search for both the basename and its old full path. Update README
+translations, authored skills, verification instructions, documentation-fact
+readers and release configuration when they consume that path. Preserve
+historical release records and references bound to earlier commits or tags.
+
+## Generated ownership and checks
+
+The [documentation directory](../README.md#machine-owned-documentation) identifies
+the machine-owned outputs and their producers. Their existing paths are retained
+because scripts, package consumers and release history depend on them. Change
+canonical sources and regenerate; do not fix a generated projection by hand.
+
+Run `npm run docs:check` for documentation facts and generated consistency, and
+`npm run verify:docs:routes` to build the complete production site and check local
+links, anchors and physical edit targets.
+When a physical path moves, also run the tests that read it. Follow
+[development checks](testing.md#developer-commands) before requesting review.
@@ -6,7 +6,10 @@ checks to pass. Merging that PR into main starts publication automatically.

 The Release workflow validates the merged release metadata and ancestry before
 creating a tag. npm and MCP Registry publication use the exact reviewed merge
-SHA returned by Release Please. Later main commits cannot change that source.
+SHA returned by Release Please. Before either registry is published, the release
+run calls full CI qualification at that exact revision, including coverage,
+portable providers, and every native package host. Later main commits cannot
+change or cancel that proof.
 Ordinary main pushes and closed, unmerged PRs cannot publish packages. Check
 both publication jobs and the published-package canary; a merged PR or GitHub
 tag alone does not establish that publication finished. Retry failed jobs in
@@ -81,7 +84,7 @@ registry metadata or changelog disagrees with that version before creating a tag

 ### Compatibility and version selection

-For the 6.2 candidate, review the [6.1 to 6.2 migration guide](migration-6.2.md)
+For the 6.2 candidate, review the [6.1 to 6.2 migration guide](../migrations/migration-6.2.md)
 alongside the changelog before publication.

 REA uses Release Please's `always-bump-minor` strategy: every release increments
@@ -196,8 +199,14 @@ both registry publishes.
 See [npm's provenance implementation](https://github.com/npm/cli/blob/v11.16.0/workspaces/libnpmpublish/lib/provenance.js)
 for the use of GitHub's workflow ref and commit SHA.

-The workflow builds the bundled Windows controls and verifies the packaged
-artifact before npm publication. It then verifies the published CLI, the
+Full qualification builds the bundled Windows controls and verifies the packaged
+artifact on its native hosts. The Linux x64 verifier retains the exact tarball
+it installed and tested, after its workspace cleanup completes. The npm job
+downloads that archive from the same workflow run and checks its source SHA,
+run identity/attempt, package and Node versions, host identity, and SHA-256.
+It publishes that archive without rebuilding or repacking it. Re-running failed
+publisher jobs can reuse a prior successful attempt from the same run.
+The workflow then verifies the published CLI, the
 capability-scoped MCP catalog, and the isolated package update path before
 publishing MCP Registry metadata.

@@ -5,8 +5,8 @@ The [platform tracker](https://github.com/morluto/rea/issues/32),
 [browser tracker](https://github.com/morluto/rea/issues/39) track capability and
 verification work. Available tools and setup are documented in the
 [investigation guides](https://rea.tools/guides/),
-[installation guide](installation.md), and
-[generated catalog](mcp-contracts.md#generated-catalog).
+[installation guide](../getting-started/installation.md), and
+[generated catalog](../reference/mcp-contracts.md#generated-catalog).

 ## Priorities

@@ -27,7 +27,7 @@ fixture servers; custom orchestration needs a demonstrated requirement.
 Provider and platform claims require their corresponding
 [real verification lanes](testing.md#real-toolchain-verification-lanes).
 See [tool design](tool-design.md) for choosing a tool boundary and
-[Ghidra semantics](ghidra-provider.md) for the existing deep-provider contract.
+[Ghidra semantics](../providers/ghidra-provider.md) for the existing deep-provider contract.

 Setup remains additive, reuses existing tools, and requires approval for disclosed
 configuration and Hopper installation changes. Additional installer choices need
@@ -237,7 +237,7 @@ logic.
 reconstruction, native-boundary relationships and application graphs without
 executing fixture PE files. Operator-local manifests and actual ILSpy oracles
 remain optional, separately reported checks; the real Ghidra NativeAOT lane has
-its own toolchain prerequisites. See [the managed guide](managed-code-analysis.md)
+its own toolchain prerequisites. See [the managed guide](../guides/managed/managed-code-analysis.md)
 for those configurations. Generated completion-ledger checks use the same owning
 entrypoint and include its verifier/fixture files in their cache inputs.

@@ -263,17 +263,62 @@ CI owns coverage; aggregate and domain/contract thresholds are maintained in
 Coverage does not replace named boundary or real-provider scenarios.

 CI runs six native Vitest shards without retries. Each shard emits a blob
-report; the merge job produces aggregate coverage plus JUnit and JSON timing
+report; the merge job produces JUnit and JSON diagnostics, a module timing
+report, plus aggregate coverage during full qualification. It retains available
 reports even when a shard fails, uploads available diagnostics, and writes the
 slowest files to the workflow summary. Partial reports are marked diagnostic
 only. Failed, cancelled, or missing selected shards still fail the required gate,
-and aggregate coverage thresholds remain enforced by the merge command.
-Only successful complete merges publish the small `test-timings` artifact, with
+and aggregate coverage thresholds remain enforced in full qualification.
+Only successful complete full-tier merges publish the small `test-timings` artifact, with
 checkout-relative paths; the build job downloads that artifact for the sequencer
-instead of the coverage/JUnit bundle. Missing history falls back to native
+instead of the coverage/JUnit bundle. Timing weights come from Vitest module
+diagnostics and include tests and hooks, worker preparation, environment,
+imports, and setup. Import timings already include transform waits, which are
+not added again. The weights describe file costs under the measured worker and
+coverage settings; their sum is not workflow elapsed time. The diagnostic
+artifact retains the phase breakdown, while shard history keeps only each
+file's total. Legacy test-body-only history and missing history fall back to native
 sharding. Static checks, documentation, build, package verification, and
 real-system lanes remain separate jobs so one kind of evidence cannot stand in
-for another.
+for another. Workflow syntax and expression validation runs inside the required
+static-check job when workflow changes select it, avoiding a separate runner.
+Native, provider, fixture, SQLite compatibility, and website lanes wait for
+static checks to succeed before allocating their runners. This avoids spending
+those runner slots on revisions that already fail static validation. Portable
+test shards and documentation checks remain independent of static results, so
+they can still provide diagnostic feedback. The required gate rejects skipped
+selected lanes when static checks fail; passing revisions retain all selected
+coverage. This ordering reduces peak demand on invalid revisions but can add
+static-check waiting to otherwise passing runs; it is not a measured reduction
+in end-to-end latency.
+
+Core jobs have execution limits of five minutes for classification, ten minutes
+for static checks, builds, docs, and report merging, and thirty minutes per
+portable test shard. These limits leave headroom for cold setup and full coverage
+while preventing a hung job from holding the active main run for hours. They do
+not bound runner queue waiting. Timeouts still fail the required gate.
+
+The separate `CI timings` workflow batches recent completed CI and Release runs
+hourly or on manual dispatch. It uploads `ci-job-timings-batch` with raw API pages and
+a normalized point-in-time report for each collected workflow attempt, plus a
+batch manifest describing examined coverage, failures, and limits. Overlapping
+lookback windows may collect an attempt again; identify records by run ID and
+attempt. Each batch examines at most 100 completed runs per workflow created in
+the preceding 24 hours, with a four-minute API collection budget. It collects the
+latest attempt of each selected run and does not claim an exhaustive archive.
+It runs the reporter from the trusted default branch with read-only permissions,
+treating workflow runs as API data. It does not allocate a new reporter job for
+every completed, cancelled, or skipped workflow. Reports separate queue
+waiting (`created_at` to `started_at`) from completed execution and report
+percentiles plus matched `npm ci` and artifact-step durations.
+Queue excludes dependency waiting before job creation and does not establish
+whether account concurrency or runner availability caused the wait. Queued jobs with
+placeholder start times, skipped jobs, and missing or invalid timestamps remain
+unknown. The reporter targets each selected run and attempt explicitly.
+Summed job elapsed time is parallel work, not workflow wall time, CPU time,
+memory usage, or billing. Step names identify samples, not complete transfer
+costs. Its queue, execution, and failures are independent of the required gate
+and publication. CPU time and peak process-family memory are not measured by this API.

 The build job saves portable Turbo outputs across runs. Eight Linux real-system
 lanes restore this cache without waiting for the build job. The shared action
@@ -469,14 +514,14 @@ fixed public ApiDemos v6.0.18 fixture. Obtain both with the explicit
 kept under ignored `_reference/`. No Gradle build, Android SDK, emulator or
 application execution is required. The lane compares real CLI/MCP package,
 class search, class inventory, method decompilation and incoming references.
-See [Android analysis](android-analysis.md) for boundaries and resource budgets.
+See [Android analysis](../guides/android/android-analysis.md) for boundaries and resource budgets.

 `verify:jeb` requires a caller-started JEB client serving MCP at
 `REA_JEB_MCP_URL` (default `http://127.0.0.1:8425/mcp`) with a project
 already open, and verifies real CLI client inspection, unit listing coverage,
 and method decompilation. The script records the engine's exact response to
 `open_jeb_project`; JEB 5.48.0 headless instances do not advertise that tool.
-REA does not install or launch JEB; see [JEB analysis](jeb-analysis.md) for
+REA does not install or launch JEB; see [JEB analysis](../providers/jeb-analysis.md) for
 the bring-your-own boundary. Verified against JEB 5.48.0 serving
 `jeb-mcp-server` 1.3.0 at four scales: a compiled Java class fixture, a
 locally built signed probe APK with a launcher activity (manifest, v1/v2/v3
@@ -490,7 +535,7 @@ CLI and MCP with explicit unit selection, plus the thin Java wrapper and
 decoded manifest. The dedicated Dart snapshot processor and `run_script`
 remain GUI-only surfaces in JEB 5.48.0 headless.
 Authenticated IPA and macOS application inventory projection is documented in
-[Apple application analysis](apple-application-analysis.md).
+[Apple application analysis](../guides/apple/apple-application-analysis.md).

 `npm run verify:harmony` requires no SDK or engine. It projects the pinned
 harmony-next-pipeline 1.0.1 release HAP from an MIT-licensed source repository,
@@ -500,7 +545,7 @@ The lane exercises `inspect_artifact`, projection determinism, Stage-model
 path hints, exact component sets, signing-entry limitations, and CLI/MCP parity.
 The release artifact has no independently established compiler/SDK or
 reproducible source build; the default lane does not verify an installed package.
-See [HarmonyOS package inventory](harmony-analysis.md) for those proof boundaries.
+See [HarmonyOS package inventory](../guides/harmony/harmony-analysis.md) for those proof boundaries.
 HarmonyOS `.har` libraries are deliberately not suffix-classified because
 `.har` also names HTTP Archive JSON.

@@ -521,7 +566,7 @@ with the reported target identity, apktool.yml metadata projection
 (1.2.3, SDK 24–34), manifest package agreement, and both the default and
 `de` string tables projected through the locale option. Parser goldens in
 `src/apktool/ApktoolDecodeOutput.test.ts` come from the same decode. See
-[Apktool resource analysis](apktool-resource-analysis.md) for boundaries and
+[Apktool resource analysis](../guides/android/apktool-resource-analysis.md) for boundaries and
 budgets.

 ## Flutter build identification
@@ -551,7 +596,7 @@ documented Gallery APK to assert its pinned digest, hash, exact engine labels
 and per-ABI URI counts. The verifier requires complete structural snapshot
 coverage, reports bounded pool coverage as partial/unverified, and reports
 exact labels/counts on other APKs unverified without an expectations file.
-See [Flutter build identification](flutter-analysis.md) for boundaries and
+See [Flutter build identification](../guides/android/flutter-analysis.md) for boundaries and
 budgets.

 ## ADB device acquisition
@@ -582,7 +627,7 @@ removal. System-package pulls whose APKs keep non-`base.apk` names report
 the `unknown` role with the file-name basis, verified with
 `com.android.settings` (single 73.9 MB APK). Parser goldens for
 `adb devices -l`, `getprop`, `pm list packages -f`, and `pm path` come from
-the same device. See [ADB device analysis](adb-device-analysis.md) for
+the same device. See [ADB device analysis](../guides/android/adb-device-analysis.md) for
 boundaries and budgets.

 ## Optional NativeAOT Ghidra analysis
@@ -601,6 +646,12 @@ records independent symbol/directory/SHA oracles; it never executes the target.
 Linux also builds stripped, ordinary-native and small malformed/ambiguous/layout
 negative inputs. The optional Windows fixture workflow builds a PE on a Windows
 runner; analyzing that PE on Linux does not verify a Windows Ghidra host.
+On a local Windows host, the .NET 8 ILCompiler finds the linker only through
+Visual Studio 2019 or 2022 (`vswhere -version [16,18)`). With only Visual
+Studio Build Tools 2026 installed, open its x64 Developer Command Prompt.
+In that same `cmd.exe` session, run `set IlcUseEnvironmentalTools=true` and
+then `npm run build:fixtures:nativeaot`. Running `vcvars64.bat` as a child of
+PowerShell does not preserve its environment in the parent PowerShell session.

 Build the clean pinned upstream adapter with `build:ghidra:nativeaot`, then set
 `REA_GHIDRA_NATIVEAOT_JAR`. Run `verify:ghidra:nativeaot -- symbols`, `-- stripped`,
@@ -620,7 +671,7 @@ with `REA_NATIVEAOT_PROOF_CAPTURE_DIR` (absolute paths).
 Keep builds/imports sequential on small hosts; scope `GHIDRA_HEADLESS_MAXMEM`
 (e.g. `768M`) to this command and use CPU affinity if needed. REA does not install
 or upgrade Java, Ghidra, .NET or native toolchains. See
-[the supported layout and provenance](ghidra-nativeaot.md).
+[the supported layout and provenance](../providers/ghidra-nativeaot.md).

 ## IDA MCP adapter

@@ -637,7 +688,9 @@ use `--second-procedure rea_fixture_subtract --second-marker='- 13'`.
 The lane invokes the production CLI dispatcher and connects the pinned MCP
 client SDK to the production REA server. It verifies function Evidence and
 CLI/MCP parity, inventory/search, pseudocode, instructions, xrefs, malformed
-input, original-input preservation, and lifecycle cleanup. For headless
+input, original-input preservation, and lifecycle cleanup. The headless
+profile also checks containing procedures, the admitted program as the
+document, address context, and feature tracing. For headless
 analysis it confirms that the owned database IDs disappear from upstream
 discovery and private workspaces are removed. For attached analysis it confirms
 the existing GUI target remains reachable with the same input identity.
@@ -658,11 +711,11 @@ symbols carry a leading underscore). Before the headless session waited out
 the transient `busy` health a worker can report right after opening, that lane
 failed intermittently on that host. Linux headless, modern attached GUI tools,
 other engine versions and architectures remain unverified; see the
-[provider guide](ida-provider.md).
+[provider guide](../providers/ida-provider.md).

 Native IDA MCP verification uses `"protocol": "native"` with an already-running native plugin and requires `--second-procedure other_function --second-marker unique_second_body_text` to exercise GUI function switching and a return to the first function. These options remain optional for other profiles. The literal marker must appear in the second function's pseudocode and be absent from the first. Native cloud/widget failures are reported without hidden retries.

-The initial Linux x64 IDA Free 9.4 run used native MCP 1.1.2 with a local navigation correction. Windows x64 verification uses **IDA Pro 9.3**, the two-function public fixture, and the shipped Windows `whoami.exe` application. The native plugin was built from upstream `c9d15d98e8a143fc74f6e14037c48f63889b6d6c`, including the merged navigation fix, with a local loopback-listener change. Production CLI/MCP parity, switching, identity and cleanup passed. Correctness and performance measurements are recorded in the [Windows native verification notes](https://github.com/morluto/rea/blob/main/experiments/analysis-efficiency/ida-native-windows.md). Stock 1.1.2 switching, native macOS, and Windows IDA Free remain unverified. See the [native bridge prerequisites](ida-provider.md#optional-native-ida-mcp-bridge).
+The initial Linux x64 IDA Free 9.4 run used native MCP 1.1.2 with a local navigation correction. Windows x64 verification uses **IDA Pro 9.3**, the two-function public fixture, and the shipped Windows `whoami.exe` application. The native plugin was built from upstream `c9d15d98e8a143fc74f6e14037c48f63889b6d6c`, including the merged navigation fix, with a local loopback-listener change. Production CLI/MCP parity, switching, identity and cleanup passed. Correctness and performance measurements are recorded in the [Windows native verification notes](https://github.com/morluto/rea/blob/main/experiments/analysis-efficiency/ida-native-windows.md). Stock 1.1.2 switching, native macOS, and Windows IDA Free remain unverified. See the [native bridge prerequisites](../providers/ida-provider.md#optional-native-ida-mcp-bridge).

 ## DOS Ghidra analysis

@@ -674,7 +727,7 @@ stable CLI/MCP observations, unchanged source bytes, and owned process/project
 cleanup. Raw p-code address-space selector tokens are reported separately from
 the stable observation comparison. Linux x64 and macOS arm64 are verified;
 macOS x64 remains unverified. This lane is separate from host-native and optional cross-format
-verification. See [DOS analysis](ghidra-dos.md).
+verification. See [DOS analysis](../providers/ghidra-dos.md).

 `npm run verify:ghidra:com` uses a generated headerless fixture with no compiler,
 DOS emulator or game data. It exercises explicit admission, BinaryLoader entry
@@ -687,6 +740,16 @@ truncation constraint, while leading-zero coordinates still resolve correctly.
 It has the same Ghidra/JDK prerequisites as the MZ lane. Neither lane claims DOS
 runtime or PC-98 device execution.

+`npm run verify:ghidra:6502` uses `ca65` and `ld65` to build the source-owned
+NMOS 6502 fixture from `tests/conformance/ghidra/6502.s` and `6502.cfg`. Set
+`REA_CA65` and `REA_LD65` for non-PATH installations (tested with cc65 `V2.19`).
+With an installed Ghidra 12.1.4 and full JDK, it verifies real CLI/stdio MCP
+mapping parity, exact source bytes, functions, a direct call reference,
+decompilation, 16-bit overflow rejection without replacing the active session,
+and runtime cleanup. Windows additionally requires the matching native addon;
+its verifier lineage remains explicitly unavailable outside the provider's
+retained Job Object, as in the other Windows lanes.
+
 `npm run verify:ghidra:raw` uses a generated ARM little-endian headerless image
 through the compiled CLI and stdio MCP server. With the same Ghidra/JDK
 prerequisites, it checks preparation and bridge startup, verified load mappings,
@@ -695,7 +758,45 @@ the entry changes without `provider_id`, unchanged source bytes, and owned
 cleanup. Six-byte x86 and x86_64 controls also verify supported compiler
 specifications, independent mappings, unchanged bytes, and decompilation of a
 known return value. AArch64 remains covered by deterministic tests rather than
-this real-provider lane. See [raw binary analysis](raw-binary.md).
+this real-provider lane. See [raw binary analysis](../providers/raw-binary.md).
+
+`npm run verify:ghidra:address-context` runs on Linux with a caller-installed
+Ghidra, full JDK, and an x86-64 ELF GCC toolchain (`CC` selects another compatible
+compiler). It builds
+`tests/conformance/c/pie-address-context.c` as a PIE ELF without executing it.
+The compiled CLI and real stdio MCP workflow must expose the measured image
+base, retain segment address spaces, agree on the overview, resolve explicit and
+numeric file offsets, and reject unmapped analysis addresses with actionable
+guidance. It checks the reverse `address-to-file-offset` mapping, file-coordinate
+Evidence locations, and the suggested CLI search and load-image commands.
+The verifier compares mapped bytes with the source file and checks source
+identity, session preservation after failed lookup, owned runtime cleanup, and
+verified empty process lineage. This lane does not establish Windows or macOS
+real-provider coverage.
+
+For source-identity boundaries that a normal single-file import cannot create,
+`tests/conformance/ghidra/ReaFileOffsetSourceProbe.java` exercises the production
+bridge against real Ghidra `FileBytes`. It rejects auxiliary and partial sources,
+checks the original target's round trip, and retains ambiguity when duplicate
+target bytes have distinct loaded mappings. Injected decompiler failures and
+cancellation verify that completed source/function resolution facts and backend
+failure codes survive; these injections do not establish natural engine failures.
+On Windows, after creating the
+source-owned PE fixture, run from the repository root:
+
+```powershell
+node scripts/create-ghidra-windows-fixture.mjs
+$proofRoot = Join-Path $env:TEMP 'rea-file-offset-source-proof'
+New-Item -ItemType Directory -Path $proofRoot -Force | Out-Null
+Copy-Item bridge/ghidra/ReaGhidraBridge.java, bridge/ghidra/ReaGhidraExtensions.java, tests/conformance/ghidra/ReaFileOffsetSourceProbe.java -Destination $proofRoot
+& "$env:GHIDRA_INSTALL_DIR/support/analyzeHeadless.bat" $proofRoot source-proof -import "$PWD/build/fixtures/rea-ghidra-windows.exe" -scriptPath $proofRoot -postScript ReaFileOffsetSourceProbe.java -deleteProject
+```
+
+Require the `REA_FILE_OFFSET_SOURCE_OK` marker and no script errors; Ghidra may
+exit successfully even when a post-script fails. The probe edits only its
+temporary analysis database and does not execute the fixture. This producer
+regression supplements public CLI/MCP coverage and does not establish Linux
+host behavior or native process-supervision controls.

 ## Apple Interface Builder archives

@@ -717,11 +818,32 @@ or the GitHub issue and pull-request templates run formatting and
 generated-document validation, including the small onboarding example consistency
 suite, without the source-test shards or native package
 lanes. Classification compares the PR head with its merge base, so later
-base-branch changes do not expand that scope. Static and coverage aggregate jobs
+base-branch changes do not expand that scope. Static and portable-test aggregate jobs
 remain present and fail if classification fails. Every code change retains the
 complete six-shard Linux suite; individual test files are not selected by
 imports or filenames.

+Ordinary PRs also produce an **observational** test-selection plan. The candidate
+leaf-adapter ownership table lives in `scripts/ci/test-selection.mjs`, separately
+from provider-job scopes. It proposes keeping affected owners plus every unowned
+test, including all CLI/MCP, acceptance, composition, conformance, and process
+tests. Shared inputs, unknown paths, missing owner tests, and removed tests fall
+back to the complete inventory. Renames account for both paths. Main, scheduled,
+manual, and `ci:full` runs always propose the full suite.
+
+All six shards still execute the complete suite. The existing report merge
+compares the proposal with actual module outcomes and retains
+`.cache/ci-test-selection/report.json` in `test-results`, including selected and
+omitted paths, changed input paths, missed failures, unobserved files, scheduling weights, PR head and
+executed merge SHA. This adds no test reruns or runner jobs. Missing, duplicate,
+skipped, interrupted, or unhandled results cannot establish a complete comparison;
+even a complete passing comparison is not proof of ownership completeness.
+Before enabling omissions, review representative full-run comparisons and
+cross-owner consumers, including failures, and measure completed CI feedback and
+runner demand. There is no automatic promotion or switch to skip tests. The
+initial proposal measures only leaf producer-test omissions; it does not promise
+the savings of a broader affected-test planner.
+
 `scripts/ci/plan.mjs` selects lanes using the ownership table in
 `scripts/ci/scopes.mjs`. Provider implementation changes run their real-provider
 verifiers and the Linux x64 installed-package/Inspector baseline. The `apple`
@@ -736,9 +858,19 @@ lane. Edits to verifier entrypoints run only by manual, licensed or self-hosted
 workflows run static checks and the Linux suite. Website changes run website
 checks. Provider workflow changes validate the workflow and run that provider's
 verifier. Manual-provider/Android workflow changes run workflow validation only.
+The four-version SQLite compatibility matrix has its own `sqlite` scope for
+SQLite implementation, contracts, CLI/MCP registration, fixtures, and shared
+runtime boundaries. SQLite and server-lifecycle test edits and the SQLite npm
+scripts also select it. Unrelated code edits retain the complete portable suite
+on the pinned Node version without starting four additional compatibility jobs.
+Full qualification retains every SQLite version.
 Shared process/contract/CLI boundaries, dependencies, other packaging inputs,
-unknown paths, and changes to the planner select the full baseline. Package
-script-only edits select their owning verifier when its entrypoint is
+unknown paths, and changes to the planner select the full baseline.
+CI timing collection, timing history, and test-report helper edits retain static
+checks and the complete portable suite without selecting unrelated host/provider
+lanes. Classification, qualification, gate, release receipt, and unknown CI
+scripts keep the broad fallback.
+Package script-only edits select their owning verifier when its entrypoint is
 identifiable; unknown or shared script changes select everything. Android
 build-script edits retain the Linux suite and workflow validation; real Android
 verification stays manual. Renames account for both paths.
@@ -746,38 +878,84 @@ verification stays manual. Renames account for both paths.
 This narrower selection trades PR-time coverage for runner capacity. A change to
 unowned shared runtime code that fails only on arm64, macOS, Windows, the Apple
 artifact lane, or a provider lane that does not own the file is not caught on
-the PR; the main-push full baseline reports it after merge. Ownership globs do
+the PR; scheduled full qualification reports it after merge. Ownership globs do
 not follow imports. Use the `ci:full` label when a change may have native-host
 or provider effects outside its owners.

-Main pushes and manual dispatch retain the full baseline, including all portable
-provider lanes and the native matrix below. A `ci:full` PR label selects the full
-baseline on the next PR run; manual dispatch can request it immediately. Each
+Ordinary main pushes use the same owner scopes as PRs. Their diff starts at a
+successful ancestor push run of this CI workflow, rather than the preceding
+push: changes from failed or cancelled intermediate runs remain in scope.
+Missing, untrusted, or non-ancestor history selects every lane. The lookup is
+bounded to the last 100 successful push runs; lookup failures broaden selection.
+Every code change still runs all six portable shards, without coverage
+instrumentation in this fast tier. This deliberately avoids relying on an
+import graph for generated files, filesystem inputs, subprocesses, or bridges.
+
+Scheduled qualification is admitted hourly at minute 23. A forced full run at
+03:23 UTC refreshes runner and dependency drift every day. Other hourly runs
+can reuse a successful full-qualification receipt for the exact source SHA
+from the same repository's trusted CI workflow on its default branch. Both the
+receipt and original workflow run must be less than 24 hours old, so retrying an
+old gate cannot renew stale proof. Missing, expired, failed, foreign, or uncertain proof runs full
+validation; API lookup failure also runs full. Lookups examine at most 100 named
+receipts and three candidate runs within a 20-second budget. Reused runs select
+no validation lanes, identify the original run, and produce no new receipt, so
+reuse cannot indefinitely extend proof freshness. They make no fresh provider
+observation. Manual dispatch, `ci:full`, and exact release qualification always
+run full validation.
+
+Full qualification includes aggregate coverage,
+every portable provider lane, and all native hosts below. Adding `ci:full`
+immediately starts the separate `Full PR qualification` workflow against the
+label event's merge revision; subsequent PR revisions also select the full tier
+in normal CI while that label remains. Unrelated labels do not start validation
+jobs or replace the main CI checks. Manual dispatch also requests full validation.
+Fast-tier broad fallbacks retain all owner lanes and the three-host
+package matrix; Intel macOS and coverage remain full-tier obligations. Each
 classification job records its selection and broad-fallback reasons in the run
 summary. Representative Git-diff cases live in
 `tests/boundary/filesystem/ciChangeScope.test.ts`.

-`CI required` checks classification and every selected lane, rejecting failed,
-cancelled, or unexpectedly skipped work. Existing required check names are
-preserved; changing branch protection to require the new aggregate is a separate
-repository-settings operation. Newer commits cancel superseded CI for the same
-PR or main branch. Release publication has its own concurrency group and retains
-its package verification and public-registry canary. Licensed/self-hosted
+`CI required` always runs and checks classification and every selected lane,
+rejecting failed, cancelled, or unexpectedly skipped work. It rejects missing or
+unknown tiers and requires every canonical scope to be explicitly `true` or
+`false`; incomplete classification cannot silently omit verification lanes.
+Branch protection
+should require this aggregate, `Static checks`, `Portable tests`, and
+`Conventional PR title`. Title validation runs separately on PR opening,
+reopening, commits, and edits; correcting a title refreshes only this lightweight
+check. It reads title text through an environment variable, executes no PR code,
+and has no token permissions. Its separate concurrency group cannot cancel
+test runs. Fast PR runs cancel superseded feedback for the same PR. Main push
+runs keep one active run and the latest pending run for that branch.
+Scheduled/manual qualification has a separate concurrency group: active work
+finishes and only the latest pending run is retained. Release qualification uses
+its exact source SHA and cannot be cancelled by newer main pushes. Provider and
+website lanes inherit their caller's scheduling; reusable
+workflows have no independent cancellation group. Direct manual lane dispatches
+run independently on disposable hosted runners. Publication
+requires that qualification to succeed and consumes its exact verified tarball,
+checking source SHA, workflow run, run attempt, package/Node version and SHA-256
+before npm publication. Earlier attempts from the same workflow run are accepted
+when rerunning failed publisher jobs; future attempts and other runs are rejected.
+The public-registry canary still verifies the published package. Licensed/self-hosted
 provider workflows and the Android smoke test retain their explicit triggers.

 CI exercises the pinned Node.js runtime on native hosted runners:

-| Host                  | Runner             | Baseline checks                                                                          |
-| --------------------- | ------------------ | ---------------------------------------------------------------------------------------- |
-| Linux x64             | `ubuntu-latest`    | Installed package and real Node Inspector CLI/MCP                                        |
-| Linux arm64 (aarch64) | `ubuntu-24.04-arm` | Installed package and real Node Inspector CLI/MCP                                        |
-| macOS 15 arm64        | `macos-15`         | Installed package and real Node Inspector CLI/MCP                                        |
-| macOS 15 x64          | `macos-15-intel`   | Installed package and real Node Inspector CLI/MCP (main, dispatch and `ci:full` only)    |
-| Windows x64           | `windows-latest`   | Curated capabilities, native controls, installed package and real Node Inspector CLI/MCP |
+| Host                  | Runner             | Baseline checks                                                                             |
+| --------------------- | ------------------ | ------------------------------------------------------------------------------------------- |
+| Linux x64             | `ubuntu-latest`    | Installed package and real Node Inspector CLI/MCP                                           |
+| Linux arm64 (aarch64) | `ubuntu-24.04-arm` | Installed package and real Node Inspector CLI/MCP                                           |
+| macOS 15 arm64        | `macos-15`         | Installed package and real Node Inspector CLI/MCP                                           |
+| macOS 15 x64          | `macos-15-intel`   | Installed package and real Node Inspector CLI/MCP (hourly, dispatch, release and `ci:full`) |
+| Windows x64           | `windows-latest`   | Curated capabilities, native controls, installed package and real Node Inspector CLI/MCP    |

-macOS x64 is the slowest package host. Pull requests without the `ci:full` label
-omit it, so darwin x64 installed-package and Inspector regressions surface on
-the main-push full baseline rather than on the PR.
+macOS x64 is the slowest package host. Ordinary PRs and main pushes omit it,
+so darwin x64 installed-package and Inspector regressions surface in full
+qualification. Schedule admission can be delayed by GitHub; the hourly trigger
+does not guarantee an hourly completed result. Release publication waits for
+its own complete result at the exact released revision.

 Package lanes assert the actual Node platform/architecture before verification
 and record those values with the Node version. The package matrix runs up to
@@ -803,17 +981,34 @@ The Linux source-test shards download a shared runtime and generated test
 metadata snapshot produced by the build job with `npm run test:prepare`. The
 snapshot includes `dist/`, generated skills, the MCP tool catalog, product
 catalog, and managed-conformance metadata. Each shard still installs the locked
-dependencies and runs its assigned coverage-enabled tests; it no longer
+dependencies and runs its assigned tests; full qualification enables coverage. It no longer
 regenerates the same metadata independently.

-The build job also retrieves the merged timing report from the last successful
-default-branch push and includes that same report in each shard's snapshot.
+The build job also finds an available `test-timings` artifact from a successful
+trusted default-branch scheduled or manual qualification and includes that same
+report in each shard's snapshot. The bounded lookup verifies the artifact's
+producer; newer schedules that reuse qualification without producing timings do
+not hide the last full run's artifact.
 CI assigns discovered files by historical duration, with a deterministic
 fallback weight for new files, rather than dividing only by file count. Every
-discovered file still belongs to exactly one shard; worker limits, project
-ordering, coverage instrumentation, and aggregate thresholds remain unchanged.
+discovered file still belongs to exactly one shard; worker limits and project
+ordering remain unchanged. The merge job rejects successful reports with missing,
+unexpected, or duplicate portable files. Coverage instrumentation and aggregate
+thresholds remain enforced in full qualification.
 Missing or unusable history falls back to Vitest's default assignment. Only
-timing data is reused; persistent compile caches remain disabled.
+timing data is reused; live provider results are never cached. Turbo outputs are
+restored by task hash, with trusted default-branch runs as cache writers and PRs
+as restore-only consumers. npm caches hold downloads, not `node_modules`.
+
+The eight automatic browser, binary-layout, EVM, JavaScript-recovery,
+recorded-crash, and web provider lanes download `rea-build-cache` from their own
+run after the build and static jobs succeed. Their existing build commands still
+validate task hashes and rebuild mismatched inputs; provider observations always
+run. Provider-workflow-only edits also admit the build without enabling source
+test shards. Direct provider dispatches retain the cross-run restore-only cache.
+This removes repeated compilation on fresh source revisions, but adds the build
+as a prerequisite: a delayed build can delay provider admission. Compare queue
+and execution times before claiming an end-to-end speedup.

 These native baseline checks complement the Linux source-test shards and the
 separate Apple-artifact and real-provider lanes. Actual Hopper, Ghidra, IDA,
@@ -855,7 +1050,7 @@ status, and Android logcat on success or failure. The emulator is disposable.
 capinfos against a saved capture. Linux verification uses Wireshark 4.6.6
 and captures containing DNS, TLS and HTTP traffic. Native Windows and macOS
 engine behavior remains unverified; process fixtures do not establish it.
-See [Packet capture analysis](pcap-analysis.md) for contracts and budgets.
+See [Packet capture analysis](../guides/data/pcap-analysis.md) for contracts and budgets.

 ## Apple native metadata and UI

@@ -875,7 +1070,7 @@ conformance/vtable fixture.
  allows a host-permission-boundary-only result and explicitly reports
  `positive_e2e: false`; it must not be reported as capture/action proof.
  Both commands reject a changed executable digest and clean up the fixture
-  process and helper. These lanes require an interactive macOS desktop. See [native investigation](native-investigation.md)
+  process and helper. These lanes require an interactive macOS desktop. See [native investigation](../guides/native/native-investigation.md)

 `npm run verify:native-calls` needs macOS with Command Line Tools (`clang`,
 `lldb`, `codesign`, `nm`) and actual debugger access to the owned fixtures.
@@ -913,7 +1108,7 @@ unknown chunks, depth limits and extracted child digests. The optional
 `REA_FIRMWARE_VERIFY_EXT4=1` lane requires existing mke2fs/debugfs; the separate
 `REA_FIRMWARE_VERIFY_GHIDRA=1` lane checks a selected host ELF through real Ghidra.
 Neither optional toolchain is a base-lane prerequisite. See
-[firmware analysis](firmware-analysis.md) for limits and unverified formats.
+[firmware analysis](../guides/firmware/firmware-analysis.md) for limits and unverified formats.

 ### JavaScript source recovery

@@ -954,7 +1149,7 @@ npm run verify:browser:source-maps
 checks an installed package after building the verifier dependencies. The separate
 conditional `real-web-source-map` CI job supplies Chrome and an isolated pinned
 fixture compiler; static/unit checks do not acquire a browser. See
-[the source location guide](web-source-location.md) for the verified decoder profile.
+[the source location guide](../guides/web/web-source-location.md) for the verified decoder profile.

 ### JavaScript large-output lane

@@ -981,7 +1176,7 @@ An optional entrypoint argument to `scripts/verify-browser-runtime.mjs` runs the
 same checks through an isolated installed package. The conditional
 `real-web-runtime` CI job runs only for relevant changes and needs no fixture
 compiler. Ordinary unit/static gates acquire no browser. See
-[website runtime attribution](web-runtime.md) for effects, resource bounds and
+[website runtime attribution](../guides/web/web-runtime.md) for effects, resource bounds and
 coverage limits.

 ### Offline binary layout
@@ -90,5 +90,5 @@ consumers. Real-engine claims require the matching provider lane; see
 When discoverability changes, evaluate representative broad, direct, and negative
 tasks on the intended host. Record host/model/catalog, selected tools, arguments,
 errors, retries, and task outcomes. Schema validity and keyword heuristics do not
-establish successful tool selection. See [mcp-contracts.md](mcp-contracts.md) for
+establish successful tool selection. See [mcp-contracts.md](../reference/mcp-contracts.md) for
 shipped runtime behavior.
@@ -17,7 +17,7 @@ Use an extracted application directory or an ASAR as the target. Static
 JavaScript analysis returns the application graph and Evidence directly.
 Generic `rea analyze PATH` selects this workflow for directories and `.asar`
 files when neither `--provider` nor `--snapshot` is supplied. See
-[JavaScript artifact reconstruction](javascript-artifact-reconstruction.md)
+[JavaScript artifact reconstruction](../guides/javascript/javascript-artifact-reconstruction.md)
 for results, integrity checks and coverage.

 The complete application Evidence can be hundreds of megabytes for a real
@@ -34,7 +34,7 @@ For example, a 334 MB Obsidian application Evidence file yields a summary view
 of about 10 KB. Replace the view with
 `{"kind": "page", "collection": "modules", "offset": 0, "limit": 32}` for a
 module page. See
-[JavaScript application workflows](javascript-application-workflows.md) for
+[JavaScript application workflows](../guides/javascript/javascript-application-workflows.md) for
 views, feature traces and comparisons that take the same saved Evidence.

 ## Managed assemblies (.NET)
@@ -59,7 +59,7 @@ assembly-wide inventory, so the output can still be large.
 Choose the workflow from the artifact's contents rather than its `.exe` or
 `.dll` extension. The managed parser requires PE/CLI metadata; it does not
 unpack .NET single-file hosts or decode IL2CPP metadata. NativeAOT method bodies
-require native analysis. See the [managed-code guide](managed-code-analysis.md)
+require native analysis. See the [managed-code guide](../guides/managed/managed-code-analysis.md)
 for supported deployment forms, selection semantics, and coverage limits.

 ## SQLite snapshots
@@ -67,7 +67,7 @@ for supported deployment forms, selection semantics, and coverage limits.
 For a local database snapshot, use `rea inspect-sqlite-database PATH --json`.
 Add `--table NAME --row-limit 20` to read a bounded sample from an ordinary
 table. This command does not require a native analysis provider. See
-[SQLite database snapshots](sqlite-databases.md) for database/WAL identity,
+[SQLite database snapshots](../guides/data/sqlite-databases.md) for database/WAL identity,
 source-file handling and row-value semantics.

 ## Native analysis
@@ -80,11 +80,11 @@ rea inspect-go-binary /absolute/path/to/program --json
 ```

 The shared CLI/MCP workflow reports compiler version, modules, replacements,
-build settings, original bytes and SHA-256. See [Go binaries](go-binaries.md)
+build settings, original bytes and SHA-256. See [Go binaries](../guides/native/go-binaries.md)
 for supported containers and absent or malformed metadata.

 Configure [Hopper or Ghidra](installation.md#hopper), or the
-[IDA adapter](ida-provider.md), before analyzing a native target. Substitute
+[IDA adapter](../providers/ida-provider.md), before analyzing a native target. Substitute
 your target, search text and function name or address in these examples:

 ```bash
@@ -101,11 +101,11 @@ a function dossier; `decompile` returns pseudocode. For assembly instructions
 alone, use `rea instructions`. A macOS `.app` bundle can be supplied directly.

 Run `rea --help` or a command's `--help` for arguments and output options.
-The [generated catalog](mcp-contracts.md#generated-catalog) lists all CLI commands and MCP
+The [generated catalog](../reference/mcp-contracts.md#generated-catalog) lists all CLI commands and MCP
 tools. Provider-specific target support is described in the
-[native guide](native-investigation.md), [DOS guide](ghidra-dos.md),
-[raw binary guide](raw-binary.md), and
-[Windows Ghidra guide](windows-ghidra-p0.md).
+[native guide](../guides/native/native-investigation.md), [DOS guide](../providers/ghidra-dos.md),
+[raw binary guide](../providers/raw-binary.md), and
+[Windows Ghidra guide](../providers/windows-ghidra-p0.md).

 ## Choose a provider

@@ -142,13 +142,13 @@ or close. Provider failures are returned with their original reason. For an
 `ambiguous` selection error, choose from `details.candidate_ids`; for
 `provider_unavailable`, run `rea doctor --provider ID --json` to diagnose the
 selected engine. See [task readiness](installation.md#check-readiness-for-your-task)
-and [provider selection](mcp-contracts.md#identity-and-discovery).
+and [provider selection](../reference/mcp-contracts.md#identity-and-discovery).

 The session reports work still in progress through `analysis_activity`.
 A client timeout can end its wait while the provider continues analyzing.
 `cleanup_incomplete` identifies resources whose shutdown or removal could not
-be verified. See [MCP contracts](mcp-contracts.md) for session lifecycle and
-[Ghidra first-query deadlines](mcp-contracts.md#ghidra-first-query-deadlines-and-recovery)
+be verified. See [MCP contracts](../reference/mcp-contracts.md) for session lifecycle and
+[Ghidra first-query deadlines](../reference/mcp-contracts.md#ghidra-first-query-deadlines-and-recovery)
 for import, client timeouts and recovery.

 ## Save and reuse analysis snapshots
@@ -174,7 +174,9 @@ rea analyze /absolute/path/to/program --provider ghidra --snapshot /absolute/pat
 rea analyze /absolute/path/to/program --provider ghidra --snapshot /absolute/path/to/analysis/program.json
 ```

-An exact CLI cache hit is read before starting a provider process.
+An exact CLI cache hit is normally read before starting a provider process.
+On Windows, Ghidra first admits the selected source through its native snapshot
+owner, so replay can start that provider.
 In MCP, `open_binary` accepts `snapshot_path` to import a snapshot atomically
 for its matching target; an MCP provider may still start before returning a
 cached result. `close_binary` accepts `snapshot_path` and optional
@@ -202,8 +204,8 @@ rea compare /absolute/path/to/evidence/left.json /absolute/path/to/evidence/righ

 Exports preserve an existing destination unless `--overwrite` is explicit.
 For application traces and version comparisons, see
-[JavaScript application workflows](javascript-application-workflows.md).
-MCP [retained Evidence references](mcp-contracts.md#retained-application-evidence-inputs)
+[JavaScript application workflows](../guides/javascript/javascript-application-workflows.md).
+MCP [retained Evidence references](../reference/mcp-contracts.md#retained-application-evidence-inputs)
 belong to one connection. Separate CLI calls consume full saved records.

 ## Import historical source
@@ -212,8 +214,36 @@ Import an older source tree to compare with the current artifact:

 ```bash
 rea import-reference-source /absolute/path/to/source
+rea import-reference-source /absolute/path/to/source --detail summary --outline-depth 2 --json
 ```

+The default (`--detail full`) returns the complete `HistoricalSourceGraph`.
+Choose `--detail summary` for a `HistoricalSourceSummary` of that same committed
+inventory: its `HistoricalSourceManifest` contains the full graph and root
+digests, with provenance, VCS facts, languages, manifest paths, entry and
+relationship counts, parse-failure counts, file/directory states, exclusions
+and limitations. The summary is a presentation view, not a graph accepted by
+source-to-bundle comparison; keep the full output for that workflow.
+
+`--outline-depth` requires `--detail summary` and accepts a nonnegative safe
+integer. Depth 1 shows root children, depth 2 (the default) also shows their
+children, and depth 0 omits all outline entries. Paths retain canonical Unicode
+code-point order. `outline.omitted_entry_count` counts only inventoried entries
+hidden by the chosen depth; it does not count unexamined children of excluded or
+unreadable directories, or change `inventory_state`. Exclusions and source
+limitations remain separate from this presentation omission.
+
+`file_sizes.known_bytes` is the exact sum of known inventoried file sizes as
+decimal text, so large sums cannot lose integer precision. Unknown sizes count
+in `file_sizes.unknown_file_count`; excluded or unexamined paths are not included
+in that total. A zero known-byte sum therefore does not establish an empty source
+tree. Full output retains individual file hashes, relationships and parse-failure
+diagnostics. Summary mode performs the same import and cleanup, then projects
+the committed result without rereading source files. It reduces the selected
+output, not the amount of source examined. A shallow tree or many exclusions can
+still produce a large summary; depth 0 removes the outline but preserves the
+other facts. No fixed output-size or runtime improvement is promised.
+
 The import records hashes and metadata for the supplied files, separately
 from observations of the current app. For a directory inside a Git checkout,
 it records the HEAD of the nearest enclosing repository; whether the working
@@ -235,18 +265,18 @@ does not infer module targets from replacement characters.
 Historical-source import requires safe no-follow file opens on Linux or
 macOS. Native Windows returns `unsupported_host`; use Linux REA inside WSL
 or another supported host. See
-[source-to-bundle comparison](javascript-application-workflows.md#historical-source-to-bundle-comparison)
+[source-to-bundle comparison](../guides/javascript/javascript-application-workflows.md#historical-source-to-bundle-comparison)
 for mapping identities, inferences and unknowns.

 ## Capture runtime behavior

 Choose the guide for the target and intended interaction:

- [Browser observation](browser-observation.md): inspect a selected page through CDP.
- [Browser scenarios](browser-scenario-contract.md): run declared interactions and capture their results.
- [Electron observation](electron-observation.md): inspect an Electron renderer or capture an application scenario.
- [Node/Electron Inspector](javascript-runtime-observation.md): record script locations and execution contexts.
- [Process capture](process-capture.md): run an executable and compare terminal, exit and filesystem observations.
+- [Browser observation](../guides/web/browser-observation.md): inspect a selected page through CDP.
+- [Browser scenarios](../guides/web/browser-scenario-contract.md): run declared interactions and capture their results.
+- [Electron observation](../guides/javascript/electron-observation.md): inspect an Electron renderer or capture an application scenario.
+- [Node/Electron Inspector](../guides/javascript/javascript-runtime-observation.md): record script locations and execution contexts.
+- [Process capture](../guides/runtime/process-capture.md): run an executable and compare terminal, exit and filesystem observations.

 Runtime requests name the target and actions. Launched targets run with your
 user permissions; consult the chosen guide for host requirements and effects.
@@ -10,7 +10,7 @@ acceptance is verified only where explicitly recorded.

 Connect Fiddler Everywhere's MCP server separately for HTTP traffic debugging,
 preserving your REA client entry. See the
-[setup instructions and public skills](web-network-captures.md#fiddler-everywhere-mcp-and-public-skills).
+[setup instructions and public skills](../guides/web/web-network-captures.md#fiddler-everywhere-mcp-and-public-skills).

 ## GitHub Copilot CLI

@@ -31,7 +31,72 @@ tool inventory on Linux using a loopback model fixture. After setup, add
 settings, then restart the client. Compact advertisements can reduce nested
 schema constraints; REA still validates complete canonical inputs. Full-profile
 `gpt-5.4` metadata is also verified locally. Live model API acceptance and
-Windows remain unverified; see [native client verification](testing.md).
+Windows remain unverified; see [native client verification](../development/testing.md).
+
+## Claude Desktop
+
+Setup registers `mcpServers.rea` in `claude_desktop_config.json`: under
+`~/Library/Application Support/Claude` on macOS, under
+`$XDG_CONFIG_HOME/Claude` (default `~/.config/Claude`) on Linux, and on Windows
+in the file the installed app reads:
+
+- Without Claude Desktop's MSIX package storage, setup uses
+  `%APPDATA%\Claude\claude_desktop_config.json`.
+- The MSIX build (package family `Claude_pzs8sxrjxfjjc`, installed under
+  `C:\Program Files\WindowsApps\Claude_<version>_x64__pzs8sxrjxfjjc`)
+  virtualizes AppData writes. Once it has saved its configuration, it reads
+  the package-private copy
+  `%LOCALAPPDATA%\Packages\Claude_pzs8sxrjxfjjc\LocalCache\Roaming\Claude\claude_desktop_config.json`
+  and ignores the `%APPDATA%` file. Setup, doctor and uninstall use that
+  private copy when it exists. Before the package has saved one, they use the
+  `%APPDATA%` file it still reads; with neither file, setup creates the
+  private copy.
+- If `%LOCALAPPDATA%\Packages` holds a `Claude_<publisher ID>` package from
+  another publisher, or cannot be read, REA cannot establish which file Claude
+  Desktop reads. Setup, doctor and uninstall report that instead of falling
+  back to `%APPDATA%`. Doctor then reports `claude_desktop` as invalid, and
+  uninstall stops before removing anything for any client.
+
+Quit Claude Desktop fully before approving setup; closing its window is not
+enough. A running Claude Desktop can rewrite its configuration from memory and
+drop the registration. This was observed with the Windows MSIX build. Start
+Claude Desktop again after setup. If the package saves its private copy after
+setup planned to write the `%APPDATA%` file, setup makes no change and asks you
+to rerun it.
+
+A process that the MSIX app started, such as a terminal in Claude Desktop's
+Code tab, sees the package's private files at their `%APPDATA%` paths even
+though it reports no package identity. Setup compares one of those files at
+both paths. When it finds that redirected view, the app is running, so setup
+and uninstall refuse to change Claude Desktop's configuration; rerun them from
+a terminal that Claude Desktop did not start. If the package has no private
+file to compare, setup and uninstall cannot rule that out and also refuse; open
+Claude Desktop once if it has never run, quit it fully, then rerun. Doctor
+reads the same file from either kind of process.
+
+The same process also writes everything under `%APPDATA%` and
+`%LOCALAPPDATA%` into the package's private storage, where other apps never
+read it. From that redirected view, setup and uninstall refuse to change other
+clients' files there (VS Code, Trae, Devin and Hermes) and skill directories
+there. `npm install -g` run from such a process installs into the package's
+`LocalCache\Roaming\npm`, which other processes cannot see at the `%APPDATA%`
+path. Setup refuses to register a launcher stored in any MSIX package's
+private storage. Install REA from an ordinary terminal and rerun setup there.
+
+Uninstall removes REA's entry from both the private copy and the `%APPDATA%`
+file, including registrations that earlier releases wrote to `%APPDATA%`.
+
+REA recognizes only the MSIX package. A non-MSIX Claude Desktop installed
+beside it, which would read the `%APPDATA%` file, is not detected.
+
+The package identity, both file locations, the redirected view, and these
+setup and doctor results were observed on Windows 11 with the MSIX build
+2.31226.1.0, using read-only `doctor` and `setup --dry-run` runs both inside
+and outside the app. On that host, setup run from an ordinary terminal with
+the app quit wrote the package-private copy; after the app restarted, the
+entry was still present, doctor reported it aligned, and Claude Desktop's MCP
+log showed REA starting and answering `tools/list`. Uninstall against the real
+app is unverified.

 ## Claude Code

@@ -64,6 +129,18 @@ and Claude Code reports that autocompact is thrashing. To avoid this:
 The sizes above come from REA's own `tools/list`. A live Claude Code session
 against DeepSeek's API is unverified.

+## Kimi Code
+
+Setup registers `rea` in `~/.kimi-code/mcp.json`, or
+`$KIMI_CODE_HOME/mcp.json` when set, while preserving unrelated settings and
+creating a `.rea.backup` before updating an existing file. Kimi Code infers
+stdio from the `command` entry, so setup does not add a `type` field. The
+registration includes `startupTimeoutMs = 30000` and `toolTimeoutMs = 120000`.
+Kimi Code also discovers personal skills in `~/.agents/skills` and project-local
+`.agents/skills`, so no separate skill root is required; setup still installs
+and verifies the matching skill files through the normal shared-skill flow.
+Start a new Kimi Code session to pick up MCP and skill changes.
+
 ## Pi

 For [Pi](https://github.com/earendil-works/pi/blob/main/packages/coding-agent/docs/mcp.md),
@@ -165,6 +242,14 @@ For [Qoder](https://docs.qoder.com/cli/mcp-reference), setup writes
 from `~/.qoder/skills` (following `QODER_CONFIG_DIR` when set), so setup
 installs its skill copy there.

+## Factory Droid
+
+For [Factory Droid](https://docs.factory.com/harness/mcp), setup writes
+`mcpServers.rea` into the user-level `~/.factory/mcp.json`. Entries carry
+`command`, `args`, and `env`. Droid discovers personal skills from
+`~/.factory/skills` ([skills](https://docs.factory.com/harness/skills)), so
+setup installs its skill copy there.
+
 ## Trae

 For [Trae](https://docs.trae.ai/ide/add-mcp-servers), setup writes
@@ -209,8 +294,15 @@ replaces) the REA entry in the home patch `$DSH_HOME/cordis.patch.yml`
 patches and comments. `rea doctor --client dsh` checks that same entry id.
 `rea uninstall` removes it by scanning supported clients; uninstall takes no
 `--client` flag. The home patch applies to every Harness profile, so the
-registration is written once and no per-profile edit is needed. The written
-entry is:
+registration is written once and no per-profile edit is needed.
+
+Setup, doctor and uninstall resolve `DSH_HOME` and `DSH_AGENTS_HOME` as Harness
+does: unset, empty or whitespace-only values use `~/.dsh` and `~/.agents`,
+respectively. Bare `~`, `~/` and `~\` expand to the user home; other relative
+values resolve against the command's working directory. Nonblank values retain
+their original spaces, and the agents root is independent of the Harness home.
+Run REA and Harness from the same working directory when using relative overrides.
+The written entry is:

 ```yaml
 - insert:
@@ -236,7 +328,7 @@ in `~/.agents/skills` (`$DSH_AGENTS_HOME/skills` when configured); Harness
 discovers that directory, and its native `skill` tool can load
 `reverse-engineer-anything`.

-REA's optional [native client verification](testing.md#end-to-end-integration-and-golden-evidence)
+REA's optional [native client verification](../development/testing.md#end-to-end-integration-and-golden-evidence)
 checks headless chat, skill loading, all tool input schemas and actual analysis
 using the installed Harness and a local model fixture. This establishes the
 Harness integration, with live DeepSeek API compatibility remaining unverified.
@@ -3,13 +3,13 @@
 Run REA, connect your selected agents, and check the tools needed for your task.
 Setup previews configuration changes and asks for approval before applying them.

-| Task                              | Section                                                                   |
-| --------------------------------- | ------------------------------------------------------------------------- |
-| Connect an agent                  | [Start setup](#start-setup), then [review changes](#review-setup-changes) |
-| Diagnose one task                 | [Scoped readiness checks](#check-readiness-for-your-task)                 |
-| Configure an analysis engine      | [Hopper](#hopper), [Ghidra](#ghidra), or the [IDA guide](ida-provider.md) |
-| Update or remove REA              | [Maintenance](#diagnose-update-and-remove)                                |
-| Resolve a client-specific problem | [Client configuration](client-configuration.md)                           |
+| Task                              | Section                                                                                |
+| --------------------------------- | -------------------------------------------------------------------------------------- |
+| Connect an agent                  | [Start setup](#start-setup), then [review changes](#review-setup-changes)              |
+| Diagnose one task                 | [Scoped readiness checks](#check-readiness-for-your-task)                              |
+| Configure an analysis engine      | [Hopper](#hopper), [Ghidra](#ghidra), or the [IDA guide](../providers/ida-provider.md) |
+| Update or remove REA              | [Maintenance](#diagnose-update-and-remove)                                             |
+| Resolve a client-specific problem | [Client configuration](client-configuration.md)                                        |

 ## Start setup

@@ -20,7 +20,9 @@ npx rea-agents setup
 Choose the agents to configure, review the proposed paths and changes, and
 approve the plan. npm's package-download approval and REA's setup approval are
 separate. Setup asks before changing agent configuration or installing Hopper.
-Restart the agents named in the completion message.
+Restart the agents named in the completion message. Quit Claude Desktop fully
+before approving, because a running app can overwrite the registration; on
+Windows, see [where Claude Desktop reads its configuration](client-configuration.md#claude-desktop).

 For the latest published release, use `npx rea-agents@latest setup`.
 [Package-runner and global-installation options](#package-runners-and-global-installation)
@@ -57,6 +59,10 @@ Hopper installation or any file write. Declining or pressing Ctrl-C makes no
 changes. Agent configuration writes preserve unrelated entries and comments,
 create backups, use atomic replacement, and verify their result. Setup and
 uninstall retain an existing `.rea.backup` rather than replacing the first snapshot.
+If that snapshot differs from the current configuration, setup previews and
+preserves a verified `.rea.backup.<sha256>.recovery` copy of the current bytes.
+Both snapshots remain available; a failed rollback reports the current recovery
+copy's path and the restore failure.
 Setup also retains valid environment overrides in REA's existing server entry,
 such as `REA_MCP_INPUT_SCHEMA_PROFILE` and `REA_MCP_MAX_RESPONSE_BYTES`.
 Detected provider settings replace only matching environment keys.
@@ -273,18 +279,20 @@ hosted connector; see [its configuration](client-configuration.md#other-client-s
 | GitHub Copilot CLI | `copilot_cli`    |
 | Command Code       | `commandcode`    |
 | Qwen Code          | `qwen_code`      |
+| Kimi Code          | `kimi`           |
 | VS Code            | `vscode`         |
 | Grok Build         | `grok_build`     |
 | OMP                | `omp`            |
 | Pi                 | `pi`             |
 | Hermes             | `hermes`         |
 | Qoder              | `qoder`          |
+| Factory Droid      | `droid`          |
 | Trae               | `trae`           |
 | ZCode              | `zcode`          |
 | DeepSeek Harness   | `dsh`            |

-`dsh` is main-only until a release after 6.4.0. The registry check above does
-not cover it.
+`dsh` and `kimi` require a release containing them. The registry check above does
+not cover them.

 See [client configuration and troubleshooting](client-configuration.md) for
 configuration paths, profiles, trust policies, and schema-limit workarounds.
@@ -303,9 +311,12 @@ Hopper is separate commercial software with its own license. Its free demo has
 vendor-defined limits, and a paid license is optional. REA reuses any detected
 installation and preserves Hopper during uninstall.

-The supported native host baseline is macOS 12+, Ubuntu 24.04+, Fedora 41+,
-Nobara 44+, 64-bit Arch Linux, CachyOS, or Omarchy. Ghidra and IDA have their own provider-specific
-host requirements; Windows Ghidra uses the [experimental P0 boundary](windows-ghidra-p0.md).
+The automated Hopper installer supports macOS 12+, Ubuntu 24.04+, Fedora 41+,
+Nobara 44+, 64-bit Arch Linux, CachyOS, or Omarchy. REA itself runs on any
+Linux distribution with a recognized apt, dnf, or pacman package family, where
+an existing Hopper launcher is selected through `HOPPER_LAUNCHER_PATH`. Ghidra
+and IDA have their own provider-specific host requirements; Windows Ghidra uses
+the [experimental P0 boundary](../providers/windows-ghidra-p0.md).

 On macOS, approved setup downloads the official DMG, checks its published size
 and digest, validates the application bundle, and atomically installs it to
@@ -438,7 +449,7 @@ output-stream closure; `output_closed: false` keeps that uncertainty explicit.
 Later requests retain the known exit instead of reducing it to socket loss.
 An external GUI's helper exit does not establish that the GUI itself exited.
 For cursor navigation, string decoding, symbol-name limits, and regex matching,
-see [Hopper analysis behavior](native-investigation.md#hopper-analysis-behavior).
+see [Hopper analysis behavior](../guides/native/native-investigation.md#hopper-analysis-behavior).

 Closing or switching a target closes its bound Hopper document, shuts down REA's
 bridge and removes its temporary socket directory. The macOS Hopper application
@@ -508,10 +519,13 @@ and `set_addresses_names` name a function entry or any other mapped address
 session metadata edits leave executable bytes unchanged and are discarded on close. GUI controls
 require Hopper; Windows P0 remains read-only.

-Windows P0 admits native x86 and x86-64 PE applications and DLLs on fixed local NTFS volumes.
+Windows P0 admits native x86 and x86-64 PE applications and DLLs, plus explicitly
+selected [raw NMOS 6502 images](../providers/raw-binary.md#nmos-6502) with a caller-supplied
+entry at file offset 0, on fixed local NTFS volumes. Other raw CPU families remain
+unsupported on Windows.
 The npm package bundles native Job Object ownership, protected private runtime
 DACLs, and handle-based path admission; no separate addon installation is needed.
-See the [Windows Ghidra P0 guide](windows-ghidra-p0.md) for verified scope and
+See the [Windows Ghidra P0 guide](../providers/windows-ghidra-p0.md) for verified scope and
 limitations.

 Extract Ghidra and install the JDK outside REA, then export absolute paths:
@@ -537,7 +551,7 @@ REA skill after approval. Direct registrations use Node to launch REA's entry
 script; package-runner registrations use the pinned `npx` or `bunx` command. Hopper
 installation remains unavailable on Windows. Setup never installs Ghidra,
 Java, or Python. It preserves valid detected Ghidra/JDK settings in agent
-registrations. See [Windows Ghidra P0](windows-ghidra-p0.md) for provider diagnostics.
+registrations. See [Windows Ghidra P0](../providers/windows-ghidra-p0.md) for provider diagnostics.

 Doctor validates the platform, architecture, Ghidra 12.1.x application version,
 `support/analyzeHeadless` or `support/analyzeHeadless.bat`, the installation's
@@ -578,7 +592,7 @@ passes the deadline to each provider client; a startup failure is returned by th
 without exposing partial analysis. This deadline is separate from MCP transport
 initialization and the client's deadline for that individual tool call. A client
 can time out earlier even when Ghidra would complete within its startup deadline.
-See [Ghidra first-query deadlines and recovery](mcp-contracts.md#ghidra-first-query-deadlines-and-recovery)
+See [Ghidra first-query deadlines and recovery](../reference/mcp-contracts.md#ghidra-first-query-deadlines-and-recovery)
 for client options and the close/reopen recovery flow.

 One session contains exactly one imported Program; use `provider_id: "ghidra"`, `--provider ghidra`, or
@@ -739,7 +753,7 @@ contains the launch arguments and `/proc/<jvm-pid>/status` reports
 session and retain the resource flags needed for the measurement rather than
 copying full command lines or environments into reports. Heap and affinity
 settings affect cost and latency; they are not part of REA's semantic analysis
-profile identity. See [real-provider testing](testing.md) for bounded
+profile identity. See [real-provider testing](../development/testing.md) for bounded
 verification workflows.

 ### Ghidra diagnostics and verification
@@ -181,4 +181,4 @@ Record: verified against adb 34.0.5 on Linux against an Android 14
 (API 34) x86_64 emulator — all operations above, a 224-package inventory,
 287 services, 92 features, a real two-APK split set pulled with byte-exact
 digests, a verified push/pull roundtrip, a 1.3 MB screen capture, and the
-complete package lifecycle; see `docs/testing.md` for the lane summary.
+complete package lifecycle; see `docs/development/testing.md` for the lane summary.
@@ -6,7 +6,7 @@ kept as an unmodified, commit-pinned Git submodule; see
 application workflow and return artifact-bound Evidence inline.

 This family is present on repository main and in npm 4.1.0. Check the
-[released package boundary](installation.md#released-package-and-main) and the
+[released package boundary](../../getting-started/installation.md#released-package-and-main) and the
 connected server's tool list before selecting it.

 ## Optional package delivery
@@ -86,6 +86,7 @@ rea inspect-android-method /path/Example.apk example.MainActivity onCreate
 rea inspect-android-method /path/Example.apk example.MainActivity select --overload-index 1
 rea trace-android-references /path/Example.apk example.MainActivity
 rea trace-android-references /path/Example.apk example.MainActivity --method-name onCreate
+rea trace-android-references /path/Example.apk example.MainActivity --method-name select --overload-index 1
 ```

 Equivalent MCP methods are `inspect_android_package`, `search_android_classes`,
@@ -106,9 +107,10 @@ Every request includes `path`. Class/method operations use `class_name`,
 ```

 Use `inspect_android_class` to choose an overload. REA rejects an ambiguous
-method request rather than silently selecting the first match. The engine's
-method reference operation cannot select overloads, so REA reports that boundary
-as unsupported when multiple same-name methods exist.
+method request rather than silently selecting the first match. Method reference
+queries accept the same `overload_index`; the bridge resolves the selected
+method node and the result reports its index and displayed signature. These
+indices are tied to the current artifact and engine, not stable across builds.

 The engine's smali fallback also joins same-name overloads; REA rejects that
 fallback for an overloaded method instead of attributing all bodies to one
@@ -137,14 +139,28 @@ the same source byte limit and explicit truncation reporting.
  full reported display types, fields and inner class names. Synthetic members
  that code generation hides can appear in the inventory; it stays consistent
  after method decompilation within the retained session.
-  Exact DEX descriptors are unknown. Overload indices are tied to this artifact
-  and engine, not stable identities across different builds.
+  Exact DEX prototypes are reported from frozen JADX method metadata as
+  `dex_descriptor`, for example `(I)V`. Display names can be JADX aliases;
+  the descriptor alone is not a complete raw DEX method ID. Overload indices
+  are tied to this artifact and engine, not stable identities across builds.
 - Method inspection reports Java or smali, fallback markers and complete/partial
  returned text. Decompiled source is a derived representation. A complete text
  result does not establish complete semantics or a byte-identical reconstruction.
 - Reference results are incoming static relationships between provider nodes.
-  Source lines and DEX instruction offsets remain unknown. They are not observed
-  runtime calls.
+  `reference_unit=using_node` means `total` counts containing JADX nodes, not
+  individual invoke instructions; two calls from one method can appear as one
+  entry. `coverage=complete` covers this node inventory only. For a method
+  reference whose using node has raw code, `direct_invokes` lists matching DEX
+  invoke instructions with their DEX entry, raw source method ID, code-unit
+  offset, method index and opcode. An empty array means no direct invoke was
+  matched in that node; `null` means raw code was unavailable or the using node
+  was not a method. This list does not establish complete call-site coverage
+  outside JADX's using-node inventory or through reflection and dynamic loading.
+  A virtual or interface invoke also does not establish its runtime implementation.
+  Source lines and the containing node's own `dex_offset` remain unknown.
+  Method-reference results also carry the selected `dex_descriptor`;
+  class-reference results report `null`.
+  These relationships are not observed runtime calls.
 - Original requests, APK SHA-256, actual engine JAR SHA-256 and raw producer
  responses remain in Evidence. Source revision is populated only for bytes
  matching the audited release JAR.
@@ -210,9 +226,11 @@ REA never writes to the original APK or launches target code.

 On Windows, stdin writes preserve stream backpressure and run outside the Node
 event loop. Cancellation terminates the retained job, including descendants,
-before workspace cleanup. An abrupt CLI/server process termination closes the
-job and stops Java, but cannot run JavaScript workspace cleanup; temporary
-workspace files can remain after that forced exit.
+before workspace cleanup. On Windows, a detached REA helper owns the private
+workspace's native directory handle. An abrupt CLI/server owner termination
+closes the Java job and the helper's input pipe; the helper then removes the
+workspace by handle. The real Windows lane checks both effects. If the helper
+also dies or the host loses power before it finishes, private files can remain.

 If Java cannot start the bridge, REA reports the selected executable and retained
 startup diagnostics. Select a full JDK through `JAVA_HOME` or `PATH`, and use
@@ -275,12 +293,20 @@ The original APK and host Java configuration remain unchanged.

 The same lane runs on Windows x64 with the bundled native controls and a full
 JDK. It checks CLI/MCP results, real MCP cancellation and disconnect, and Java
-exit after abrupt CLI owner termination. Windows forced termination is checked
-separately from the POSIX CLI SIGTERM handler; it does not claim a structured
-cancellation result or workspace removal after the owner is forcibly killed.
+exit and workspace removal after abrupt CLI owner termination. Windows forced
+termination is checked separately from the POSIX CLI SIGTERM handler. A
+synthetic two-owner test confirms that one owner's exit does not remove the
+other owner's workspace. The lane does not claim a structured cancellation
+result or power-loss recovery.

 The download script verifies fixed SHA-256 values, reuses matching files and
 refuses to overwrite a different existing file. APK/JAR files live under ignored
 `_reference/` and are excluded from package contents. The lane exercises actual
 REA CLI and MCP results with the real engine, separately from synthetic protocol
 regressions. It needs no Gradle build, emulator, Android SDK or Ghidra.
+
+Direct invoke sites retain exact DEX code-unit offsets separately from each
+containing node's unknown `dex_offset`. `direct_invokes_exhaustive: false`
+means instruction rows were bounded by the local bridge frame budget; `null`
+means the producer did not establish instruction coverage. Using-node totals
+and coverage do not imply complete instruction evidence.
@@ -91,4 +91,4 @@ OpenJDK 25 against a signed aapt2-built probe APK carrying two resource
 locales — launcher version, on-disk digest agreement, apktool.yml metadata
 (1.2.3, SDK 24–34), manifest package agreement, default and `de` string
 tables projected. Parser goldens in the test suite come from the same
-decode. See `docs/testing.md` for the lane summary.
+decode. See `docs/development/testing.md` for the lane summary.
@@ -60,6 +60,10 @@ server; older servers keep the complete request after schema discovery.
  [Dart 2.14 layout](https://github.com/dart-lang/sdk/blob/2.14.0/runtime/vm/snapshot.h).
  Kind numbers vary across Dart releases; other values are preserved with
  partial coverage, without guessing their interpretation.
+  Address resolution examines every overlapping `PT_LOAD` interpretation,
+  including partial overlaps. Equivalent mappings are coalesced; conflicting
+  mappings leave affected symbols unresolved and qualify coverage. Dynamic
+  hash, symbol and string tables use the same mapping checks.
  A payload without exported snapshot symbols is refused rather
  than guessed at.
 - **The snapshot hash** from the header at the start of each exported data
@@ -133,8 +137,11 @@ server; older servers keep the complete request after schema discovery.
  `resource_constraint`.
 - **Engine notes.** Engine libraries are spooled into the owned root. ELF
  headers, note tables and note payloads share an 8 MiB metadata budget;
-  up to 64 distinct build IDs are retained. Exceeding either bound preserves
-  the candidates already examined and reports partial coverage.
+  up to 64 distinct build IDs and 1024 distinct nonempty note ranges are retained.
+  The range cap bounds bookkeeping and separate positional reads even for tiny
+  overlapping declarations. Exact duplicates share one read and empty ranges
+  consume no inventory slots. Exceeding a bound preserves the candidates examined
+  from retained ranges and reports partial coverage with `build_id: null`.
 - **Metadata and candidate capacity.** Both operations refuse duplicate
  relevant library paths. Inventory is limited to 32 ABIs and 1024 bytes per
  relevant library path, independently of compressed size. Identification
@@ -174,3 +181,9 @@ engine build-ids, no labeled Dart version (as expected for a release
 engine), and the Android clang toolchain line; a plain aapt2-built APK
 reports not-detected with complete coverage. The suite uses self-contained
 synthetic ELF images and scanner payloads; it does not read private local files.
+
+The Gallery workflow and all 147 focused Flutter tests also pass on macOS Sonoma
+14.8.9 x86-64 and Windows 11 x64 build 26300.9457 guests with Node 24.18.0,
+including the conflicting-load and note-range-limit CLI/MCP regressions. Windows
+verification runs under a non-administrator account. Verifiers use a shared
+temporary parent so each CLI/MCP process can own and release its own snapshots.
@@ -174,7 +174,7 @@ Resolution follows dyld:
 - `@rpath` tries each `LC_RPATH` of the loading image first, then those of the
  image that loaded it, up to the process root.
 - Dependencies load dependents-first in load-command order, and each image
-  loads once per process. A later request whose install name matches an
+  loads once per process. A later @rpath request whose install name matches an
  already loaded image reuses it.
 - Symlinks such as `Versions/Current` are followed inside the analyzed root.
  An escape through `..` or an absolute link is `escapes-target`.
@@ -128,3 +128,49 @@ Each provider admits one inspection at a time, including acquisition and cleanup
 An occupied provider returns a retryable capacity error before acquiring another
 file or worker. Closing the provider stops new admission and drains accepted work;
 failed cleanup remains owned and can be retried.
+
+## Discover protocols and field names
+
+`inspect_packet_fields` / `inspect-packet-fields` queries the installed TShark
+registration glossary before selecting fields for capture inspection:
+
+```sh
+rea inspect-packet-fields --query usb
+rea inspect-packet-fields --kind fields --protocol usb --query idVendor
+rea inspect-packet-fields --kind fields --protocol udp --all
+```
+
+`kind` defaults to `protocols`; `fields` selects field definitions. `protocol`
+selects an exact protocol abbreviation (the protocol itself or its child fields).
+`query` is a case-insensitive literal substring in name, abbreviation or field
+description. `offset` skips matching records; `limit` defaults to 50. MCP
+`limit: null` or CLI `--all` requests all remaining matches within the resource
+budget. `--all` and `--limit` conflict. The window reports examined records of
+the selected kind before filters, matching records, returned records and
+`has_more`; it never counts capture packets.
+
+Returned records preserve field type, parent protocol, display base, bitmask,
+description and original glossary line number. Empty producer strings remain
+empty; protocol records have null field-only properties. Repeated abbreviations
+remain separate registrations. A listed field is an installation capability, not
+proof that the field appears in a selected recording.
+
+The adapter uses the documented `tshark -G fields` grammar under its existing
+private empty profile and Linux process limits. TShark 4.6.9's full glossary was
+measured at 22,303,197 bytes; discovery admits at most **32 MiB** combined command
+output (capture inspection remains at **4 MiB**). Parsing walks lines once and
+constructs objects only for the selected page. Returned strings are copied so
+retained pages do not retain the complete glossary string. Before constructing a selected
+record it charges six times the source UTF-8 bytes plus 512 bytes against an
+**8 MiB** representation budget, covering JSON escaping and record bookkeeping.
+If that budget would be exceeded, narrow the query or page size; results are not
+silently truncated. This is a conservative admission budget, not measured heap
+usage. Parent pipe buffers and producer per-process limits remain distinct.
+
+Tool/limiter identity, version, stderr and selected arguments are retained in
+Evidence. No capture, interface or device is opened. Discovery shares capture
+analysis's admission slot and cleanup owner. Each call rereads the glossary;
+installed plugins, libraries and global configuration remain trusted and are not
+fully fingerprinted. There is no cache or snapshot-consistent pagination claim.
+The real Linux lane checks public CLI/MCP queries against the direct glossary,
+including USB vendor-ID typing, negative queries and paging.
@@ -39,6 +39,18 @@ license](https://github.com/morluto/rea/blob/main/third_party/evmole/README.md)
 - Upstream also returns terminal metadata during selector recovery. Its reported
  values remain in `raw_result`; integer precision and non-text-key coverage are
  unknown in the JS binding. Full bytecode retains the original encoded metadata.
+- `bytecode.metadata` independently interprets a plausible terminal CBOR root
+  map from the selected bytes. Integers use decimal strings; byte strings use hex,
+  and scalar keys retain their types. The recorded offset/length addresses the
+  original bytecode, so summary delivery does not copy an opaque CBOR payload.
+  Nested containers have partial scalar coverage; unsupported or malformed
+  candidates report `not-decoded` with a diagnostic. Decoding is bounded to 64
+  container levels and the terminal payload's encoded size.
+- An unavailable trailer does not prove metadata absence or Solidity origin.
+  Compiler-version bytes/text are metadata declarations, not verified compiler,
+  source-file or deployed-contract identity. Historical omission parses as a null
+  unknown facet without changing the original Evidence record. Metadata/source
+  URLs are not fetched.
 - Selectors, argument strings and state mutability are **inferences**. Function
  names/signatures are not looked up. Optimized code may produce different
  mutability candidates; recovered types are not a verified source ABI.
@@ -125,3 +137,15 @@ The real verification lane traces representative raw/hex CLI workflows and check
 that only declared Node/prlimit launchers and process ownership inspection run.
 Socket traces permit local stdio socket pairs and reject attempted network requests.
 These observations verify those fixtures; they are not a general network sandbox.
+
+For the independent metadata parser, `npm run verify:solidity:metadata` uses an
+existing caller-selected solc 0.8.30 module:
+
+```sh
+REA_VERIFY_SOLC_MODULE=/absolute/path/to/solc/index.js npm run verify:solidity:metadata
+```
+
+It compiles the owned fixture with unoptimized, viaIR, content-hash-free and
+CBOR-free settings, verifies the observed trailer facts and reports local decode
+timings. No contract is executed. This lane does not establish the complete
+Linux EVM provider's CLI/MCP, resource-limit or cleanup behavior.
@@ -124,7 +124,7 @@ Select a verified native child for the existing tools:

 Then use `analyze_function`, `inspect_native_api` or the other native primitives.
 Native architecture and executable validation still apply. Generic
-[MIPS ELF](ghidra-mips.md) and [RISC-V ELF](ghidra-riscv.md) lanes are separate
+[MIPS ELF](../../providers/ghidra-mips.md) and [RISC-V ELF](../../providers/ghidra-riscv.md) lanes are separate
 documents with their own admission boundaries. This milestone does
 not add PPC decompilation, raw flash load profiles, bootloader/device
 tree semantics, vulnerability scanning, emulation or hardware runtime capture.
@@ -104,6 +104,15 @@ static inferences. Dynamic or ambiguous IPC is retained without a pairing edge.
 Runtime entities retain passive-CDP authority, while a successful static/runtime
 correspondence is a separately identified cross-layer inference.

+Source module links retain their resolution mode. Static imports in `.ts` and
+`.tsx` are `compiler-dependent` when compiler options have not been retained.
+REA compares Node import and require resolution: a shared outcome remains
+available with a limitation; divergent outcomes remain unavailable with both
+conditional branches and their limitations. This models source relationships,
+not verified emitted code or execution. A declaration file found only through
+an emitted-extension fallback is retained as a candidate, not a runtime target;
+an explicitly selected path keeps its original identity.
+
 ## Evidence and authority

 Every observation and edge carries all of the following:
@@ -23,6 +23,14 @@ artifact digest and structural graph ID. Semantic tracing requires the semantic
 relation graph and reports when it is unavailable rather than treating missing
 data as an empty graph.

+Explicit TypeScript `import type` and `export type` declarations remain source
+facts and do not create runtime import or export relationships. Type export names
+are reported separately from value export names. Inline `type` specifiers can
+leave an empty import or re-export with side effects under
+[`verbatimModuleSyntax`](https://www.typescriptlang.org/tsconfig/verbatimModuleSyntax.html);
+REA retains those dependency candidates and reports the unavailable compiler
+options rather than assuming the dependency is erased.
+
 The semantic graph wire format stores shared non-location provenance once in
 its required `evidence_contexts` table. Each node, relation, fingerprint, and
 unknown retains its exact `evidence.location` and names the owning context with
@@ -200,6 +208,25 @@ arrays, and later explicit data properties and methods replace earlier object
 spread references. A known array prefix does not expose values from a following
 spread. Accessors, custom or uncertain iteration, unknown computed keys, and
 unknown spread lengths retain conservative uncertainty.
+Getter-local aliases of `this`, including direct destructuring and assignments,
+retain their receiver when a returned shared reference is written. These writes
+invalidate the earlier literal instead of claiming the getter executed or the
+new value is known. Straight-line alias reads retain their capture order;
+uncertain control flow remains conservative. A binding outside the getter or
+`this` in a nested ordinary function is not attributed to the getter's receiver.
+Private reads keep receiver projections separate from the private value's path.
+Receiver projections follow known data fields initialized from `this` or earlier
+self-referencing fields; static fields retain their declaring class identity.
+An alias cycle that repeatedly selects deeper children retains escape uncertainty
+at its recovered roots rather than claiming a fixed number of loop iterations.
+
+Writes through an object getter's returned receiver retain that uncertainty
+when the object is an array element, nested inside mixed object/array
+containers, or assigned to a previously declared identifier. Saving the getter
+result in an alias does not make its old field values immutable. Known array
+indices include holes; an element after a spread has only a minimum possible
+index. Unrelated properties and known array prefixes remain precise, and a
+getter read without a write does not invalidate the receiver's fields.
 Nested callable returns are not assigned to their parent callable. Projected
 graph observations carry source ranges but never source text.

@@ -267,7 +294,7 @@ References are scoped to one connection; `close_binary` clears them. Export a
 bundle before closing and import it on another connection, or supply the full
 inline Evidence there. Versions before 4.1.0 accept full inline Evidence only; installing
 newer skill instructions does not change that schema. See
-[MCP Evidence inputs](mcp-contracts.md#retained-application-evidence-inputs).
+[MCP Evidence inputs](../../reference/mcp-contracts.md#retained-application-evidence-inputs).

 For two operator-provided directories or ASARs, run:

@@ -159,7 +159,7 @@ An unpacked entry whose companion bytes were not supplied remains
 `unavailable`. REA continues analyzing embedded JavaScript and records the
 missing native/resource bytes as unknown. The occurrence keeps
 `hash_status: unavailable`; no content-addressed child artifact is created for
-those missing bytes. See [MCP integrity handling](mcp-contracts.md#integrity-record-and-continue)
+those missing bytes. See [MCP integrity handling](../../reference/mcp-contracts.md#integrity-record-and-continue)
 for the tool-result contract.

 ## Large results
@@ -170,7 +170,7 @@ select exact [source paths](#select-sources-before-analysis).

 If a complete response exceeds the transport budget, use its retained Evidence
 ID for a summary, module page, or item, or export the bundle. See
-[MCP tool results](mcp-contracts.md#tool-results) for delivery limits, export, and
+[MCP tool results](../../reference/mcp-contracts.md#tool-results) for delivery limits, export, and
 matching server/client buffer settings. Follow-up results also need to fit that
 budget. [Analyzer limits](#analyzer-and-result-admission) control analysis memory,
 source deadlines, and semantic capacity separately.
@@ -184,7 +184,7 @@ or Evidence sealing. Unexamined relationships remain unknown.

 MCP returns a `partial_observation` retained reference after recording succeeds;
 open it with `inspect_analysis_view` on the same connection. If the SDK stopped
-waiting before receiving the reply, follow [MCP cancellation recovery](mcp-contracts.md#progress-and-cancellation)
+waiting before receiving the reply, follow [MCP cancellation recovery](../../reference/mcp-contracts.md#progress-and-cancellation)
 to find the record. CLI failure output contains the complete partial Evidence.
 Owned analyzer cleanup is verified before private files are released; uncertain
 cleanup retains ownership for retry and is reported separately.
@@ -136,6 +136,6 @@ output, with 8 MiB per diagnostic/report stream. Exceeding a limit is an explici
 failure with rollback. These limits apply per operation and do not claim aggregate
 host containment across concurrent callers.

-See [testing.md](testing.md#javascript-source-recovery) for the focused real
+See [testing.md](../../development/testing.md#javascript-source-recovery) for the focused real
 Wakaru CLI/MCP lane and its source-owned compiler fixtures. Other host platforms
 and Bun/Vue recovery are not claimed by this adapter.
@@ -24,7 +24,7 @@ Native-body bridge mapping and managed runtime execution are outside the
 current tool set.

 The canonical tool inventory is the
-[build-generated catalog](mcp-contracts.md#generated-catalog).
+[build-generated catalog](../../reference/mcp-contracts.md#generated-catalog).

 ## Inspect an assembly

@@ -147,6 +147,28 @@ opposite observation's selection unknown, and application graphs report their
 selected scope as partial. Neither makes an absence claim about the whole
 assembly. Older member Evidence without `selection` remains readable.

+### Edge target declaring types
+
+`member_refs[].parent_name`, `call_edges[].target_declaring_type`, and
+`field_accesses[].field_declaring_type` name the type that declares each
+target. Referenced spec signatures validate encoded type coordinates against
+the metadata tables, including nested type arguments and custom modifiers.
+TypeRef resolution scopes are checked transitively with cycle detection;
+readable names survive malformed scopes as partial evidence.
+TypeDef and TypeRef names use the namespace-qualified `full_name`
+form, and nested types keep bare names. A generic-instantiation TypeSpec
+parent names its generic type, such as ``System.Collections.Generic.List`1``.
+Other well-formed TypeSpec forms and ModuleRef or MethodDef parents stay
+`null`. A `method-spec` call edge reports the name and declaring type of the
+generic method it instantiates. A field access is named only by a field or a
+field-signature MemberRef. TypeSpec and MethodSpec blobs are decoded with the
+member-signature grammar, and a MethodSpec must instantiate a generic method
+with as many type arguments as it declares. Malformed or unsupported rows and
+blobs, and arity mismatches, make coverage partial. A readable MethodSpec
+method column that names a method, or a TypeRef whose resolution scope is
+invalid, keeps its name.
+Older member Evidence without these fields reads them as `null`: unknown.
+
 ## Analysis objective

 Start by identifying the artifact with `inspect_managed_artifact`, then inspect
@@ -206,13 +228,14 @@ describes exported shared-library entry points.
 REA offers a built-in read-only snapshot parser for x64 PE/RTR 9.1 metadata and
 an optional Linux headless Ghidra adapter for annotations and broader recovery.
 The adapter requires a locally built `REA_GHIDRA_NATIVEAOT_JAR`; REA does not
-install it or its toolchain. The [NativeAOT guide](ghidra-nativeaot.md) defines
+install it or its toolchain. The [NativeAOT guide](../../providers/ghidra-nativeaot.md) defines
 these routes, their layout/host restrictions, derived-memory provenance, and
 verification coverage.

 REA's experimental Windows Ghidra boundary admits native x86 and x86-64 PE
-applications and DLLs for static analysis. This does not establish Windows
-NativeAOT metadata-recovery coverage.
+applications and DLLs for static analysis. For x64 PE NativeAOT, the read-only
+parser also runs there; the [NativeAOT guide](../../providers/ghidra-nativeaot.md) lists what a
+Windows host covers.

 For NativeAOT analysis, preserve the selected native artifact's path and digest
 and report recovered type data with its returned provenance. Linking those types
@@ -220,6 +243,7 @@ to native function addresses requires verified
 provider evidence; names or vtable similarity alone do not prove that a native
 function implements a specific managed method.

+<div id="managednative-boundary-rules"></div>
 <div id="managed-native-boundaries"></div>

 ## Managed/native boundary rules
@@ -231,7 +255,7 @@ matches establish declaration links; they do not establish that a call executed.
 Metadata tokens are not native addresses. Native body mapping for C++/CLI,
 ReadyToRun, NativeAOT, and IL2CPP requires separately verified format and provider
 support. The managed static tools do not recover those mappings. The optional
-[Ghidra NativeAOT extension](ghidra-nativeaot.md) has its own supported boundary.
+[Ghidra NativeAOT extension](../../providers/ghidra-nativeaot.md) has its own supported boundary.

 Declared import inventory supports a bounded positive claim. Its absence does
 not exclude dynamic resolution, generated code, protected code, native helpers,
@@ -357,7 +381,7 @@ The current lane uses source-owned byte-built fixtures and malformed-input
 regressions, with optional operator-supplied applications and ILSpy verification.

 Run the deterministic lane with `npm run verify:managed`. See
-[testing](testing.md#real-toolchain-verification-lanes) for prerequisites and
+[testing](../../development/testing.md#real-toolchain-verification-lanes) for prerequisites and
 coverage. Generated outputs belong outside tracked fixture directories and must
 not remain after verification or packaging.

@@ -98,11 +98,13 @@ section, symbol, mitigation or linkage views. The default `complete` detail and
 CLI output are unchanged.

 Complete results have a 32 MiB input, 64 MiB reply, 1 MiB combined diagnostics
-and 30-second owned command deadline. The reply budget applies to the decoder
-record; the CLI/MCP Evidence envelope adds copies and encoding overhead. The
+and 30-second owned command deadline. `REA_PWNTOOLS_MAX_INPUT_BYTES` raises the
+input bound alone, up to 1 GiB; the reply and deadline bounds are unchanged. The
+reply budget applies to the decoder record; the CLI/MCP Evidence envelope adds
+copies and encoding overhead. The
 pinned MCP SDK defaults to a 10 MiB receive buffer. Large complete results need
 a caller-configured `StdioClientTransport({ maxBufferSize: ... })` and a matching
-server `REA_MCP_MAX_RESPONSE_BYTES`. See [MCP delivery budgets](mcp-contracts.md#tool-results).
+server `REA_MCP_MAX_RESPONSE_BYTES`. See [MCP delivery budgets](../../reference/mcp-contracts.md#tool-results).
 These settings affect delivery, not decoder coverage or limits. The large
 extended-index verification uses 256 MiB and an explicit five-minute request
 timeout in its separate opt-in MCP lane. REA does not silently truncate the result. Python lowers resource soft limits to at most 3 GiB virtual address space,
@@ -81,7 +81,7 @@ temporary files, starts no subprocesses and accesses no network endpoint.
 Resource guards bound the selected file to 256 MiB, aggregate embedded strings
 to 1 MiB, structural table decoding to 16 MiB and the complete normalized metadata
 report to 8 MiB. Oversized results fail without partial success. MCP also applies
-its [response transport budget](mcp-contracts.md), which counts both text and
+its [response transport budget](../../reference/mcp-contracts.md), which counts both text and
 structured content; a report within the metadata limit can still require export
 from retained Evidence. These limits are not operating-system memory or CPU
 isolation.
@@ -8,7 +8,7 @@ observation complement that analysis when they answer a specific question.

 ## Start with a function

-Choose an installed provider from [setup](installation.md#hopper). For Ghidra:
+Choose an installed provider from [setup](../../getting-started/installation.md#hopper). For Ghidra:

 ```bash
 rea inspect /absolute/path/to/program --provider ghidra --json
@@ -299,7 +299,7 @@ complete observation.
  It reports each `@rpath`, `@loader_path` and `@executable_path` candidate with
  its outcome. Paths outside the analyzed root, including shared-cache system
  libraries, stay undetermined. See
-  [Apple application analysis](apple-application-analysis.md#dylib-load-resolution).
+  [Apple application analysis](../apple/apple-application-analysis.md#dylib-load-resolution).
 - `inspect_asset_catalog` / `rea inspect-asset-catalog <app>` reads compiled
  `Assets.car` metadata through macOS `assetutil --info`. Catalog digests, raw
  rendition fields, pagination and exact UI resource-name matches are returned.
@@ -476,8 +476,11 @@ the tool fails with a `debugger-attach-denied` reason.
 Install a Ghidra 12.1.x release and the 64-bit full JDK it declares, then configure REA to
 use them. Ghidra analysis supports Linux x64/arm64 and macOS x64/arm64; each installation requires
 the matching native decompiler. Experimental Windows x64 P0 admits native
-x86 and x86-64 PE applications and DLLs on local NTFS using bundled Job Object ownership,
-protected runtime DACLs, and handle-based path admission. See [Windows Ghidra P0](windows-ghidra-p0.md) and
+x86 and x86-64 PE applications and DLLs, plus explicitly selected
+[raw NMOS 6502 images](../../providers/raw-binary.md#nmos-6502) with a caller-supplied load address,
+on fixed local NTFS volumes. Other raw CPU families remain unsupported on Windows.
+The boundary uses bundled Job Object ownership, protected runtime DACLs, and
+handle-based path admission. See [Windows Ghidra P0](../../providers/windows-ghidra-p0.md) and
 [issue #527](https://github.com/morluto/rea/issues/527).
 On Linux and macOS, `annotate_native_function` atomically edits a function name
 and entry comments in the ephemeral database, returning refreshed analysis
@@ -546,3 +549,17 @@ Value projection preserves serialized node kinds, IDs, references and pagination
 Exact and ambiguous value counts describe emitted root/object value instances;
 a root and an object may contain the same value. Archive digests identify the
 original bytes.
+
+## Locate a byte signature
+
+Use `search_bytes` after opening a target with Ghidra to locate a known constant
+or instruction sequence. For example, `{"pattern":"48 8B ?? ?? 89","limit":100}`
+returns ordered addresses with segments, source file offsets and containing
+procedures. The CLI equivalent is
+`rea search-bytes ./program '48 8B ?? ?? 89' --provider ghidra`.
+Use `start`/`end` to constrain the inclusive address window, and continue with
+`next_cursor` until `complete` is true. Inspect `searched` for page coverage and
+skipped uninitialized blocks. A missing match does not establish absence from
+uninitialized memory or across block boundaries. See
+[Ghidra byte search](../../providers/ghidra-provider.md#masked-byte-search) for mask and coverage
+semantics. This query never executes or modifies target bytes.
@@ -1,7 +1,10 @@
 # Recorded crash evidence

 `inspect_recorded_crash` / `rea inspect-recorded-crash` inspect a caller-selected
-Linux ELF64 x86-64 little-endian core independently of an active binary target.
+Linux ELF64 little-endian core independently of an active binary target. Two
+architecture profiles are interpreted, x86-64 and AArch64; each binds registers
+to its own `NT_PRSTATUS` layout, and any other `e_machine` is refused as
+`unsupported_target` before note interpretation.

 ```sh
 export REA_PWNTOOLS_PYTHON=/absolute/existing/venv/bin/python
@@ -10,8 +13,8 @@ rea inspect-recorded-crash ./crash.core --json

 The selected Python needs unchanged pwntools 4.15.0, pyelftools 0.33 and Unicorn 2.1.2.
 REA does not install these dependencies. ELFFile/its original ELF structures and
-pwntools' original Linux amd64 ctypes provide parsing and ABI layout. The adapter
-adds bounds, representation preservation and lifecycle ownership.
+pwntools' original Linux amd64 and aarch64 ctypes provide parsing and ABI layout.
+The adapter adds bounds, representation preservation and lifecycle ownership.
 The initial Linux note profile accepts System V/unspecified and GNU/Linux OSABI
 with ABI version zero. Other declared ABIs return `unsupported_target` before
 note interpretation; an unspecified OSABI alone does not prove OS origin.
@@ -27,7 +30,8 @@ note interpretation; an unspecified OSABI alone does not prove OS origin.
 - Every exact Linux CORE PRSTATUS note as a separate recorded thread, with
  historical PID, signal and lossless uint64 registers bound to source bytes.
  Each supported note has exactly one interpretation; each thread contains the
-  complete 27-register ABI set, with names bound to their original ABI offsets.
+  complete ABI register set for its architecture (27 registers for amd64,
+  34 for AArch64), with names bound to their original ABI offsets.
  Physical note ranges cannot overlap or leave segment gaps. ELF and note headers
  are independently bound to the snapshot, including extended program counts.
 - Signed SIGINFO number/code/errno. Initially only SIGSEGV codes 1/2 establish the
@@ -72,9 +76,13 @@ debugger context is `observed`.

 Initial Linux x64 limits: 32 MiB input, 64 MiB decoder reply, 1 MiB diagnostics per
 stage, 30 seconds owned wall deadline per stage, 3 GiB address-space soft ceiling
-and 30 seconds CPU soft ceiling. Tighter inherited soft/hard limits are retained;
-hard limits are not raised. Complete oversized results fail explicitly. These
-process limits do not constitute a sandbox for caller-supplied engine code.
+and 30 seconds CPU soft ceiling. `REA_PWNTOOLS_MAX_INPUT_BYTES` raises the input
+bound alone, up to 1 GiB, and returns `provider_unavailable` when it is not a
+decimal integer in range; the reply, diagnostic and deadline bounds stay fixed, so a
+large core that outruns them still fails explicitly instead of partially. Tighter
+inherited soft/hard limits are retained; hard limits are not raised. Complete
+oversized results fail explicitly. These process limits do not constitute a sandbox
+for caller-supplied engine code.

 Resource exit statuses need matching private failure-branch markers. Unmarked
 launcher failures retain their actual status/output and unknown resource cause.
@@ -106,3 +106,37 @@ One decode is admitted at a time, including acquisition and cleanup. Excess
 requests receive a retryable capacity error before acquiring another file or
 worker. Shutdown closes admission and drains accepted work; failed cleanup
 remains owned and retryable.
+
+## Discover decoders before choosing settings
+
+`inspect_signal_decoders` / `inspect-signal-decoders` queries the **installed**
+sigrok catalog without opening a recording or scanning devices:
+
+```sh
+rea inspect-signal-decoders --query uart
+rea inspect-signal-decoders --decoder uart --query baud
+rea inspect-signal-decoders --decoder i2c --offset 0 --limit 50
+```
+
+Omit `decoder` to search decoder IDs and names. Supply one exact decoder ID to
+read its literal help, including required/optional channels, options, annotation
+classes and documentation. `query` is a case-insensitive literal substring;
+matching help retains original one-based line numbers. Empty query selects all.
+`offset` skips matches; `limit` defaults to 50. MCP `limit: null` or CLI `--all`
+returns all remaining matches; CLI `--all` and `--limit` conflict.
+The window reports examined, matching and returned records and `has_more`.
+A filtered empty page is not evidence that the installation has no decoders.
+
+Discovery refuses more than 65,535 line separators before constructing record
+objects (65,536-line representation budget), in addition to the 4 MiB output cap.
+Exceeding that budget is a resource failure with captured output. Returned text
+is copied so a retained page does not keep the complete producer output alive.
+
+Discovery shares decoding's owned process, admission slot, resource limits,
+cleanup retries and Evidence delivery. It records the executable and limiter
+identities, version banner and warnings. Failed version checks and malformed
+producer output preserve diagnostics. Help is producer text, not an independently
+validated parameter schema. Each request probes again; it does not cache or claim
+stable pages across installation changes. Libraries/decoder modules remain
+trusted and are not fully fingerprinted. Catalog output includes a SHA-256 of
+its executable, not a digest of the complete installation.
@@ -13,6 +13,11 @@ Check `binary_session` for configured capability availability. A recognized
 header is not validation of the complete module; missing WABT is reported
 separately as an unavailable capability, not as missing native engine support.

+The recognized WASM header is checked before automatic database routing from a
+.hop filename. Renaming a module to .hop therefore keeps the static-inspection
+diagnostic. An explicit database selection or raw/COM format selection retains
+the caller's requested interpretation; ordinary .hop database routing is unchanged.
+
 Set `REA_WABT_BIN_DIRECTORY` to an absolute directory containing executable
 `wasm-validate`, `wasm-objdump` and `wasm2wat` (with `.exe` on Windows). Missing
 executables, unsupported banners and inaccessible tools produce actionable
@@ -78,4 +83,47 @@ Candidates are caller-selected files; their identity does not imply validation.
 Both CLI and MCP use the same typed port and application service. MCP publishes
 SDK-compatible schemas and records Evidence for `get_evidence_bundle` readback.
 See [WABT provenance](https://github.com/morluto/rea/blob/main/third_party/wabt/README.md) and
-[testing](testing.md#offline-wasm-artifacts) for real-tool verification.
+[testing](../../development/testing.md#offline-wasm-artifacts) for real-tool verification.
+
+## Compare core-module interfaces
+
+Inspection adds producer-owned typed `interface` facts while keeping exact WAT
+import/export forms. Function/tag signatures resolve type indices; table/memory
+limits, memory page size and global value type/mutability remain explicit.
+Unadmitted types (including GC reference signatures) retain null signatures and
+issues. Exact decoded names retain escapes, empty names, BOM and punctuation.
+This facet is absent in historical Evidence that did not examine typed interfaces.
+
+`compare_wasm_interfaces` accepts two complete `inspect_wasm_artifact` Evidence
+records, or exact retained references in the current MCP session, and required
+`scope: "imports" | "exports" | "both"`. It reads no files and needs no active
+WABT toolchain. CLI uses portable inline Evidence in one JSON document:
+
+```bash
+rea compare-wasm-interfaces comparison-input.json --json
+```
+
+```json
+{
+  "left": { "kind": "retained-evidence", "evidence_id": "ev_<left-digest>" },
+  "right": { "kind": "retained-evidence", "evidence_id": "ev_<right-digest>" },
+  "scope": "both"
+}
+```
+
+The references above are MCP-only; put complete Evidence objects in the CLI
+input. Resolve summary delivery to its retained complete parent before comparing.
+Results retain both input Evidence IDs, artifact paths/digests/lengths and every
+selected occurrence. Unique names are added, removed, changed or unchanged;
+duplicate names and unsupported signatures are unknown. Incomplete or historical
+inventories never establish absence. Imports group by module/name, exports by
+name, so a change of kind is visible. Output ordering is deterministic.
+
+Static type equality does not establish runtime compatibility, ABI compatibility
+or linking success. Comparison covers core modules; WebAssembly components and
+canonical ABI relationships belong to their separate inspection workflow.
+
+After building, run `REA_WABT_BIN_DIRECTORY=/absolute/wabt/bin node
+scripts/verify-wasm-interface-comparison.mjs` for original-module comparison
+through the compiled CLI and stdio MCP. It uses owned fixtures and WABT 1.0.42;
+no WASM module is instantiated or executed.
@@ -51,7 +51,7 @@ Caller-owned JSON/base64 strings, input parsing and validation, transport
 buffers, garbage-collector behavior, and other runtime memory are outside this
 estimate; the budget does not promise a bound on total process memory.

-Electron `file://` pages use a separate provider and target boundary; see [electron-observation.md](electron-observation.md).
+Electron `file://` pages use a separate provider and target boundary; see [electron-observation.md](../javascript/electron-observation.md).

 ## Provider authorities

@@ -65,7 +65,7 @@ vocabulary (`BrowserExclusionReason`): every denial reason in every stack maps
 onto it, even where a wire schema keeps a narrower historical bucket.
 Existing static application Evidence and passive web/Electron captures can be
 combined later through
-[JavaScript static/runtime reconciliation](javascript-runtime-reconciliation.md).
+[JavaScript static/runtime reconciliation](../javascript/javascript-runtime-reconciliation.md).

 ## Start a browser

@@ -80,12 +80,74 @@ google-chrome \

 REA does not launch, own, or terminate this browser. Use a dedicated profile and stop it yourself when the investigation is complete. Do not expose the debugging port on a non-loopback interface.

+Other Chromium-family browsers, such as Chromium or Brave, work the same way
+with the same two flags. On macOS, run the executable inside the application
+bundle, for example
+`"/Applications/Google Chrome.app/Contents/MacOS/Google Chrome"` or
+`"/Applications/Brave Browser.app/Contents/MacOS/Brave Browser"`. Fedora installs
+Chromium as `chromium-browser`.
+
+REA needs the browser's HTTP discovery endpoint on a loopback port. A browser
+driven over `--remote-debugging-pipe` or a private channel, for example by an
+automation SDK, exposes no such endpoint, so `list_browser_targets` has nothing
+to attach to. Connection failures report `endpoint_unreachable`; a reachable
+HTTP service that returns a non-200 or non-JSON discovery response reports
+`invalid_endpoint_response`.
+Reproduce that flow in a Chromium-family browser started with
+`--remote-debugging-port`.
+
+In a minimal Linux container, headed Chromium under Xvfb can keep running while
+its DevTools port never opens. Install the GLES, EGL, and Mesa DRI libraries
+(on Fedora: `libglvnd-gles`, `mesa-libEGL`, and `mesa-dri-drivers`), then
+restart the browser.
+
 On Linux, a reachable but locked desktop keyring can stall Chrome before its
 first navigation. For a dedicated investigation profile, add
 `--password-store=basic` to bypass that keyring. Empty or placeholder frame URLs
 then describe an unloaded page; REA continues to require an allowed, committed
 URL. See [the startup investigation](https://github.com/morluto/rea/issues/1384#issuecomment-6093781686).

+### Browsers without HTTP discovery
+
+Some browsers expose a loopback browser WebSocket but no `/json/version` or
+`/json/list`. Chrome 144 and later can enable remote debugging on a running
+browser from `chrome://inspect/#remote-debugging`; this mode is reported to
+serve only the browser socket. Since Chrome 136, `--remote-debugging-port` is
+ignored for the default profile, so this is the remaining way to inspect a page
+in an existing profile.
+
+For such a browser, pass the browser socket instead of the HTTP endpoint:
+
+```bash
+rea list-browser-targets ws://127.0.0.1:9222/devtools/browser/<id>
+```
+
+Chrome writes the port and the `/devtools/browser/<id>` path to the
+`DevToolsActivePort` file in its user data directory. REA does not read that
+file for you.
+
+- Only `list_browser_targets`, `inspect_web_page`, `analyze_web_bundle`,
+  `observe_web_session`, `discover_webmcp_tools`, and `capture_web_screenshot`
+  accept a browser socket. Website runtime attribution, Electron inspection,
+  and scenario attach mode still require HTTP discovery.
+- Each call opens one WebSocket and uses it for discovery
+  (`Browser.getVersion`, `Target.getTargets`) and for the selected page.
+  Discovery must finish within the same 10-second deadline as HTTP discovery.
+  Chrome may ask you to approve each connection.
+- The browser identifier controls access to the socket. Evidence records the
+  endpoint as `ws://127.0.0.1:9222/devtools/browser/[REDACTED]`.
+- `browser.revision` is the socket's `Browser.getVersion` value, such as
+  `@e533e98…`. HTTP discovery reports `WebKit-Version`, such as
+  `537.36 (@e533e98…)`.
+- `Target.getTargets` reports whether each target is attached. Chrome's
+  `/json/list` can omit it, so HTTP discovery may report `attached` as `null`.
+- An existing profile can hold many unrelated pages. Target listing returns
+  each eligible page's URL and title, so pass `--allowed-origins` to list only
+  the origins you are investigating.
+
+A browser driven only through `--remote-debugging-pipe` or a vendor's private
+automation channel has neither endpoint, and REA cannot attach to it.
+
 ## Request boundary

 CDP connections enforce the shared 64 MiB limit per WebSocket message. A larger
@@ -95,9 +157,13 @@ decoded strings or JSON objects.

 Discovery supplies a literal loopback CDP endpoint and returns all eligible
 page targets unless an exact HTTP(S) origin filter narrows the result. Follow-up
-inspection requests select one target; their default scope is its current origin. `localhost`, private-LAN
-addresses, HTTPS CDP endpoints, credentials, paths, queries, fragments, and
-implicit ports are not valid CDP endpoints. Origin filters contain only scheme,
+inspection requests select one target; their default scope is its current origin.
+The endpoint is either `http://127.0.0.1:PORT` or a
+[browser socket](#browsers-without-http-discovery),
+`ws://127.0.0.1:PORT/devtools/browser/ID`; `[::1]` may replace `127.0.0.1`.
+`localhost`, private-LAN addresses, HTTPS and `wss:` endpoints, credentials,
+queries, fragments, implicit ports, and any other path are not valid CDP
+endpoints. Origin filters contain only scheme,
 host, and port; paths, credentials, queries, fragments, and wildcards are not
 valid origins.

@@ -207,7 +273,7 @@ commands fail closed. A correlated reply's session ID must match the command's
 selected session. An optional method is unavailable only when the browser
 rejects it as unknown; other command rejections retain their reported failure.

-Network and console coverage starts only after REA attaches and enables the relevant CDP domains. `prior_activity_available` is always `false`; absence from these arrays is not evidence that an event never occurred. If CDP reuses a request ID without supplying redirect metadata, REA retains the predecessor observation and marks network coverage incomplete.
+Network and console coverage starts only after REA attaches and enables the relevant CDP domains. `prior_activity_available` is always `false`; absence from these arrays is not evidence that an event never occurred. Scripts are different: scripts the page parsed before REA attached are still reported under `scripts`. A page that loaded before attach can therefore list its scripts while `network.requests` lacks the requests that fetched them. If CDP reuses a request ID without supplying redirect metadata, REA retains the predecessor observation and marks network coverage incomplete.

 Source maps are not fetched by inspection. Bundle analysis fetches them only when `fetch_source_maps` is selected, with exact-origin redirect checks and no credentials, cookies, or referrer. Each fetch operation has a 30-second deadline and a 64 MiB aggregate streamed-response budget across redirects. A deadline or byte-limit failure remains explicitly unavailable and makes bundle completeness partial. Source-map decoding also bounds raw resolved identities to 64 MiB and aggregate inline evidence to 32 MiB. Failed maps preserve their failure context when it fits; if another context cannot fit, collection stops with the full requested count, the returned processed count, and an explicit unknown-results limitation. Retained mappings and original sources are returned inline. See [source-location limits](web-source-location.md) for the structural decoder bounds. Original source artifacts with `.ts`, `.tsx`, `.mts`, or `.cts` suffixes carry `text/typescript`; other source names retain `text/javascript`.

@@ -82,4 +82,4 @@ closes only the owned browser; cleanup failure cannot return a successful trace.
 `REA_BROWSER_NO_SANDBOX=true` passes Chromium's corresponding launch option when
 the host requires it; it does not enable an REA security boundary.

-See [testing](testing.md) for the native loading oracle and CLI/MCP real lane.
+See [testing](../../development/testing.md) for the native loading oracle and CLI/MCP real lane.
--- a/Show More
+++ b/Show More