test(ghidra): update PDB snapshot profile expectation

Align the public MCP inventory and snapshot-replay regression with program-info-v4. Six socket-backed MCP tests pass. Other v1/v2/v3 literals deliberately exercise rejection of historical projections.

.agents/skills/reverse-engineer-anything/SKILL.md

@@ -2,7 +2,7 @@
 name: reverse-engineer-anything
 description: Reverse engineer native, managed, Electron/JavaScript, packaged, firmware, and browser targets with REA. Use shipped-artifact or requested runtime evidence to explain features, compare versions, decompile code, or guide a reconstruction. Skip REA for ordinary source-repository architecture analysis.
 metadata:
-  version: "42"
+  version: "41"
 ---
 
 # REA
@@ -104,10 +104,6 @@ explicit path or endpoint and do not need it.
   consult the NativeAOT workflow in `references/native-and-artifacts.md` for
   optional metadata recovery and its supported host/layout boundary.
 - User-owned browser page already open: `list_browser_targets`.
-- Browser action the agent must perform (click, type, navigate):
-  `capture_browser_scenario` with declared actions. See
-  [runtime observation](references/runtime-observation.md) for connect/launch
-  and the focused follow-up browser tools.
 - Fiddler Everywhere traffic or a native `.saz` capture: read the
   [Fiddler workflow](references/runtime-observation.md#fiddler-everywhere-traffic-debugging).
   Inspect saved SAZ with `inspect_web_network_capture` and `format: "saz"`;
@@ -327,8 +323,7 @@ as complete while required questions remain open.
   [references/javascript-applications.md](references/javascript-applications.md)
 - Android APK declarations, classes, methods, and static references:
   [references/android-applications.md](references/android-applications.md)
-- Browser/Electron observation (passive and scenario) and static/runtime
-  reconciliation:
+- Passive browser/Electron observation and static/runtime reconciliation:
   [references/runtime-observation.md](references/runtime-observation.md)
 - Evidence paging, comparisons, residual unknowns, and verification:
   [references/evidence-workflows.md](references/evidence-workflows.md)

.agents/skills/reverse-engineer-anything/references/runtime-observation.md

@@ -1,4 +1,4 @@
-# Browser and Electron runtime observation
+# Passive browser and Electron observation
 
 Supply the existing browser or Electron instance's literal-port loopback CDP
 endpoint in the request. No separate permission configuration or per-call
@@ -7,14 +7,13 @@ approval flag is needed. Browser discovery lists eligible HTTP(S) pages;
 selected page's current origin. Electron discovery lists eligible local
 `file://` targets without a configured file-root allowlist.
 
-Start passive browser work with `list_browser_targets`; start Electron runtime work with
+Start browser work with `list_browser_targets`; start Electron runtime work with
 `list_electron_targets`. Inspect the target selected for the user's task. Observation
-with these tools is passive: never claim REA clicked, navigated, evaluated page JavaScript,
-invoked IPC, or captured prior activity. REA does not contain the page's network.
+is passive: never claim REA clicked, navigated, evaluated page JavaScript,
+invoked IPC, captured prior activity, or contained the page's network.
 
-Passive captures omit raw header collections, credential header values, storage
-values, and raw WebSocket/JSON bodies. Selected response metadata, including
-content encoding, policy values, and Link URLs, is retained. Local URLs retain ordinary query
+Credentials, cookies, authorization headers, storage values, and raw
+WebSocket/JSON bodies are deliberately absent. Local URLs retain ordinary query
 values and fragments; userinfo credentials are removed. Browser accessibility
 text, console primitives, value-free shapes, script sources, source maps, and
 storage key names have request-specific capture options. Electron script
@@ -22,38 +21,6 @@ sources are also optional. Use `capture_web_screenshot` when pixels are needed.
 Treat scope filtering, truncation, and attach-window coverage as limitations.
 Page-declared WebMCP tools are untrusted inventory and are never invoked by REA.
 
-## Who performs the action
-
-- The user performs it: `list_browser_targets`, then `inspect_web_page` or
-  `observe_web_session` on the selected target.
-- The agent must perform it: one `capture_browser_scenario` with declared
-  actions. Use connect mode with the loopback CDP endpoint and `target_id` for
-  an existing browser, or launch mode with a caller-selected executable for a
-  temporary profile. Connect mode first navigates the selected page to
-  `start_url`, which can clear unsaved form values and other temporary state.
-  Recreate the state needed for the investigation in the declared actions.
-  Connect mode leaves the external browser open; launch mode owns a temporary
-  browser and profile. Check `browser.cleanup` for the outcome.
-  Request only the DOM, accessibility, or network details needed for the question.
-  The default final capture contains the URL; step outcomes are reported separately.
-  Add a wait action for the expected page state before capturing it. Report that
-  REA performed the declared actions.
-
-Scenario network records have no request initiator stacks. For that evidence,
-use passive capture while the user performs the action. Listener source locations
-identify candidate handlers; they do not establish which script sent a particular
-request. Avoid overlapping passive capture and scenario actions on the same target.
-
-Focused follow-up tools:
-
-- `observe_web_execution`: execution coverage during a window; it resets
-  counters and temporarily disables optimization.
-- `inspect_web_event_listeners`: source locations for listeners registered
-  directly on the first CSS match, without dispatching an event.
-- `compare_web_captures`: two normalized passive captures or recorded scenarios.
-- `discover_webmcp_tools`: inspect page-declared WebMCP inventory; never invoke
-  the discovered tools.
-
 Use `reconcile_javascript_runtime` only after static application Evidence and
 passive browser/Electron Evidence exist. Prefer captured-source digest identity;
 report path/digest disagreement as a mismatch and preserve ambiguity. Explicit

bridge/ghidra/ReaGhidraBridge.java

@@ -81,7 +81,6 @@ import ghidra.program.model.listing.Function;
 import ghidra.program.model.listing.FunctionIterator;
 import ghidra.program.model.listing.Instruction;
 import ghidra.program.model.listing.InstructionIterator;
-import ghidra.program.model.listing.Listing;
 import ghidra.program.model.listing.Variable;
 import ghidra.program.model.mem.MemoryBlock;
 import ghidra.program.model.mem.MemoryBlockSourceInfo;
@@ -406,9 +405,7 @@ public final class ReaGhidraBridge extends HeadlessScript {
             case "xrefs" -> xrefs(request.params);
             case "analyze_function" -> {
                 FunctionAnalysisObservation observation = analyzeFunctionObservation(request.params);
-                JsonObject result = functionObservation(observation.dossier(), observation.limitations());
-                result.add("relationship_coverage", observation.relationshipCoverage());
-                yield result;
+                yield functionObservation(observation.dossier(), observation.limitations());
             }
             case "set_address_name", "set_addresses_names" -> {
                 if (!descriptor.transport.equals("unix-socket"))
@@ -1019,19 +1016,12 @@ public final class ReaGhidraBridge extends HeadlessScript {
         for (Function item : ordered) {
             result.add(canonicalAddress(item.getEntryPoint()));
         }
-        if (callers) {
-            JsonObject observation = functionObservation(result, noReturnCallLimitations(
+        return functionObservation(
+            result,
+            noReturnCallLimitations(
                 currentProgram.getListing().getInstructions(function.getBody(), true)
-            ));
-            observation.add("relationship_coverage", callRelationshipCoverage(null,
-                unrepresentedIncomingCalls(function, observed)));
-            monitor.checkCancelled();
-            return observation;
-        }
-        CallBoundaryObservation calls = callBoundaryObservation(
-            function, currentProgram.getListing().getInstructions(function.getBody(), true), observed, false, null
+            )
         );
-        return callRelationshipObservation(result, calls);
     }
 
     private JsonObject procedureInfo(JsonObject params) throws Exception {
@@ -1081,10 +1071,18 @@ public final class ReaGhidraBridge extends HeadlessScript {
         result.addProperty("direction", direction);
         result.add("references", edges);
         result.addProperty("reference_kinds_available", true);
-        JsonArray unresolvedCalls = direction.equals("outgoing")
-            ? callBoundaryObservation(
-                function, currentProgram.getListing().getInstructions(function.getBody(), true), null, true, references
-            ).unresolvedCalls() : new JsonArray();
+        JsonArray unresolvedCalls = new JsonArray();
+        if (direction.equals("outgoing")) for (Instruction instruction : scanInstructions(function, Integer.MAX_VALUE).instructions) {
+            if (!instruction.getFlowType().isCall()) continue;
+            boolean resolved = false;
+            for (Reference reference : instruction.getReferencesFrom()) if (reference.getReferenceType().isCall()) resolved = true;
+            if (!resolved) {
+                JsonObject site = new JsonObject();
+                site.addProperty("address", canonicalAddress(instruction.getAddress()));
+                site.addProperty("reason", "Instruction decoder identifies a call but ReferenceManager supplies no call destination");
+                unresolvedCalls.add(site);
+            }
+        }
         result.add("unresolved_calls", unresolvedCalls);
         return result;
     }
@@ -1492,28 +1490,16 @@ public final class ReaGhidraBridge extends HeadlessScript {
         InstructionScan scan = scanInstructions(function, Integer.MAX_VALUE);
         DecompileResults decompilation = decompile(function);
         String pseudocode = decompiledText(decompilation);
-        JsonObject availability = new JsonObject();
-        availability.add("pseudocode", facetAvailability(
-            pseudocode != null,
-            function.isExternal() ? "Ghidra does not decompile external functions."
-                : function.getBody().isEmpty() ? "Ghidra has no function body to decompile."
-                : "Ghidra completed decompilation without returning pseudocode."
-        ));
-        if (pseudocode == null) {
-            pseudocode = "";
-        }
-        List<Reference> bodyIncoming = collectReferences(function, "incoming");
-        List<Reference> incomingReferences = bodyIncoming.stream()
+        List<Reference> incomingReferences = collectReferences(function, "incoming")
+            .stream()
             .filter(reference -> !function.getBody().contains(reference.getFromAddress()))
             .toList();
         List<Reference> outgoingReferences = collectReferences(function, "outgoing");
         JsonArray incoming = referenceEdges(incomingReferences);
         JsonArray outgoing = referenceEdges(outgoingReferences);
-        JsonArray comments = comments(function);
-        Set<Function> callerFunctions = function.getCallingFunctions(monitor);
-        JsonArray callers = procedureIdentities(callerFunctions);
-        Set<Function> calleeFunctions = function.getCalledFunctions(monitor);
-        JsonArray callees = procedureIdentities(calleeFunctions);
+        JsonArray comments = comments(scan.instructions);
+        JsonArray callers = procedureIdentities(function.getCallingFunctions(monitor));
+        JsonArray callees = procedureIdentities(function.getCalledFunctions(monitor));
         JsonArray referencedStrings = referencedStrings(outgoingReferences);
         JsonArray referencedNames = referencedNames(outgoingReferences);
         JsonArray blocks = basicBlockValues(function);
@@ -1525,7 +1511,7 @@ public final class ReaGhidraBridge extends HeadlessScript {
         procedure.add("locals", functionLocals(function));
         JsonObject result = new JsonObject();
         result.add("procedure", procedure);
-        result.addProperty("pseudocode", pseudocode);
+        result.addProperty("pseudocode", pseudocode == null ? "" : pseudocode);
         result.add("assembly", assembly);
         result.add("comments", comments);
         result.add("callers", callers);
@@ -1534,6 +1520,20 @@ public final class ReaGhidraBridge extends HeadlessScript {
         result.add("outgoing_references", outgoing);
         result.add("referenced_strings", referencedStrings);
         result.add("referenced_names", referencedNames);
+        JsonObject facets = new JsonObject();
+        JsonObject pseudocodeAvailability = new JsonObject();
+        pseudocodeAvailability.addProperty("available", pseudocode != null);
+        if (pseudocode == null) {
+            pseudocodeAvailability.addProperty("reason", "Ghidra did not supply pseudocode.");
+        }
+        facets.add("pseudocode", pseudocodeAvailability);
+        for (String facet : List.of("assembly", "comments", "callers", "callees",
+                "references", "strings_names", "cfg")) {
+            JsonObject available = new JsonObject();
+            available.addProperty("available", true);
+            facets.add(facet, available);
+        }
+        result.add("facet_availability", facets);
         boolean swift = swiftProgram();
         boolean aarch64 = currentProgram.getLanguageID().getIdAsString().startsWith("AARCH64:");
         SwiftStringLiteralDecode swiftLiterals = swift && aarch64 ? swiftStringLiterals(function) : null;
@@ -1547,15 +1547,6 @@ public final class ReaGhidraBridge extends HeadlessScript {
             nativeApiBoundary(function, decompilation)
         );
         result.add("native_value_flow", nativeValueFlow(decompilation));
-        // Successful full queries distinguish collected empty sets from missing facts.
-        // Availability does not claim that Ghidra resolved every runtime relationship.
-        for (String facet : List.of("comments", "callers", "callees", "references", "strings_names", "cfg")) {
-            availability.add(facet, facetAvailability(true, null));
-        }
-        availability.add("assembly", facetAvailability(
-            !scan.truncated(), "The function instruction scan was truncated."
-        ));
-        result.add("facet_availability", availability);
         JsonArray limitations = new JsonArray();
         limitations.add(
             "Unresolved computed or indirect flows without target addresses are not represented as reference edges."
@@ -1583,10 +1574,8 @@ public final class ReaGhidraBridge extends HeadlessScript {
                 "Swift String literal decoding is implemented for AArch64 register pairs only; no Swift literals were decoded for this architecture."
             );
         }
-        CallBoundaryObservation calls = callBoundaryObservation(
-            function, scan.instructions, calleeFunctions, true, outgoingReferences);
-        result.add("unresolved_calls", calls.unresolvedCalls());
-        for (String limitation : calls.limitations()) {
+        List<String> boundaryLimitations = noReturnCallLimitations(scan.instructions);
+        for (String limitation : boundaryLimitations) {
             limitations.add(limitation);
         }
         if (decompilation != null && decompilation.getErrorMessage() != null &&
@@ -1594,14 +1583,7 @@ public final class ReaGhidraBridge extends HeadlessScript {
             limitations.add("Ghidra decompiler diagnostic: " + decompilation.getErrorMessage());
         }
         result.add("limitations", limitations);
-        monitor.checkCancelled();
-        int missingCallers = 0;
-        for (Reference reference : bodyIncoming) {
-            monitor.checkCancelled();
-            if (unrepresentedCaller(reference, callerFunctions)) missingCallers++;
-        }
-        return new FunctionAnalysisObservation(result, calls.limitations(),
-            callRelationshipCoverage(calls, missingCallers));
+        return new FunctionAnalysisObservation(result, boundaryLimitations);
     }
 
     private JsonObject nativeValueFlow(DecompileResults decompilation) throws Exception {
@@ -3305,200 +3287,52 @@ public final class ReaGhidraBridge extends HeadlessScript {
         return result;
     }
 
-    private static JsonObject facetAvailability(boolean available, String reason) {
-        JsonObject result = new JsonObject();
-        result.addProperty("available", available);
-        if (!available) result.addProperty("reason", reason);
-        return result;
-    }
-
-    private JsonObject callRelationshipObservation(JsonElement value, CallBoundaryObservation calls)
-            throws Exception {
-        monitor.checkCancelled();
-        JsonObject result = functionObservation(value, calls.limitations());
-        result.add("relationship_coverage", callRelationshipCoverage(calls, null));
-        return result;
-    }
-
-    private static JsonObject callRelationshipCoverage(
-            CallBoundaryObservation calls, Integer missingCallers) {
-        JsonObject coverage = completeResolvedCallCoverage();
-        Integer omitted = calls == null ? null : calls.unrepresentedCalleeCalls();
-        JsonArray directions = new JsonArray();
-        if (missingCallers != null && missingCallers > 0) directions.add("callers");
-        String callerLimitation = missingCallers != null && missingCallers > 0
-            ? "Ghidra's caller inventory omits sources of " + missingCallers +
-                " call reference(s) into this function's body." : null;
-        if ((calls != null && omitted == null) || (calls == null && missingCallers == null)) {
-            coverage.addProperty("status", "unknown");
-            String reason = calls == null ? "No call inventory was examined."
-                : "The callee inventory was not examined alongside decoded call targets.";
-            coverage.addProperty("reason", reason + (callerLimitation == null ? "" : " " + callerLimitation));
-            if (calls == null && missingCallers == null) directions.add("callers");
-            directions.add("callees");
-            coverage.add("limited_directions", directions);
-            return coverage;
-        }
-        JsonArray limitations = new JsonArray();
-        if (callerLimitation != null) limitations.add(callerLimitation);
-        if (omitted != null && omitted > 0) {
-            limitations.add("Ghidra's callee inventory omits targets of " + omitted +
-                " call reference(s) or decoded call(s) without destinations.");
-            directions.add("callees");
-        }
-        if (!limitations.isEmpty()) {
-            coverage.addProperty("status", "partial");
-            coverage.add("limitations", limitations);
-            coverage.add("limited_directions", directions);
-        }
-        return coverage;
-    }
-
-    private static JsonObject completeResolvedCallCoverage() {
-        JsonObject coverage = new JsonObject();
-        coverage.addProperty("status", "complete");
-        JsonArray diagnostics = new JsonArray();
-        diagnostics.add(
-            "Only resolved Ghidra call references are returned; unresolved computed or indirect calls remain unknown, while function classifications distinguish thunks and externals."
-        );
-        coverage.add("diagnostics", diagnostics);
-        return coverage;
-    }
-
-    private boolean unrepresentedCaller(Reference reference, Set<Function> callers) {
-        if (!reference.getReferenceType().isCall()) return false;
-        Function caller = containingFunction(reference.getFromAddress());
-        return caller == null || !callers.contains(caller);
-    }
-
-    private int unrepresentedIncomingCalls(Function function, Set<Function> callers)
-            throws Exception {
-        int[] omitted = { 0 };
-        visitReferences(function, "incoming", reference -> {
-            if (unrepresentedCaller(reference, callers)) omitted[0]++;
-        });
-        return omitted[0];
-    }
-
     private List<String> noReturnCallLimitations(Iterable<Instruction> instructions)
             throws Exception {
         List<String> limitations = new ArrayList<>();
         for (Instruction instruction : instructions) {
             monitor.checkCancelled();
-            String limitation = terminalCallLimitation(instruction);
-            if (limitation != null) limitations.add(limitation);
-        }
-        return limitations;
-    }
-
-    private CallBoundaryObservation callBoundaryObservation(
-            Function function, Iterable<Instruction> instructions, Set<Function> returnedCallees,
-            boolean includeUnresolvedSites, List<Reference> observedReferences)
-            throws Exception {
-        List<String> limitations = new ArrayList<>();
-        CallBoundaryReferences calls = new CallBoundaryReferences(returnedCallees, includeUnresolvedSites);
-        if (observedReferences == null) visitReferences(function, "outgoing", calls::observe);
-        else for (Reference reference : observedReferences) {
-            monitor.checkCancelled();
-            calls.observe(reference);
-        }
-        for (Instruction instruction : instructions) {
-            monitor.checkCancelled();
-            String limitation = terminalCallLimitation(instruction);
-            if (limitation != null) limitations.add(limitation);
-            if (!instruction.getFlowType().isCall()) continue;
-            boolean destination = false;
-            for (Reference reference : instruction.getReferencesFrom()) {
-                if (!reference.getReferenceType().isCall()) continue;
-                destination = true;
-                break;
+            if (!instruction.getFlowType().isCall() || !instruction.getFlowType().isTerminal()) {
+                continue;
             }
-            if (!destination) {
-                calls.unrepresented++;
-                calls.unresolved(instruction.getAddress(),
-                    "Instruction decoder identifies a call but ReferenceManager supplies no call destination");
-            }
-        }
-        return new CallBoundaryObservation(List.copyOf(limitations),
-            returnedCallees == null ? null : calls.unrepresented, calls.unresolvedCalls());
-    }
-
-    private final class CallBoundaryReferences {
-        private final Set<Function> returnedCallees;
-        private final TreeMap<Address, String> unresolved;
-        private int unrepresented;
-
-        CallBoundaryReferences(Set<Function> returnedCallees, boolean includeUnresolvedSites) {
-            this.returnedCallees = returnedCallees;
-            unresolved = includeUnresolvedSites ? new TreeMap<>() : null;
-        }
-
-        void observe(Reference reference) {
-            if (!reference.getReferenceType().isCall()) return;
-            // Reference identity follows the same containing-function owner as referenceEdge.
-            Function target = containingFunction(reference.getToAddress());
-            if (returnedCallees != null && (target == null || !returnedCallees.contains(target)))
-                unrepresented++;
-            if (target == null) unresolved(reference.getFromAddress(),
-                "A call destination has no known containing Ghidra procedure");
-        }
-
-        void unresolved(Address address, String reason) {
-            if (unresolved != null) unresolved.put(address, reason);
-        }
-
-        JsonArray unresolvedCalls() {
-            if (unresolved == null) return null;
-            JsonArray result = new JsonArray();
-            for (var item : unresolved.entrySet()) {
-                JsonObject site = new JsonObject();
-                site.addProperty("address", canonicalAddress(item.getKey()));
-                site.addProperty("reason", item.getValue());
-                result.add(site);
-            }
-            return result;
-        }
-    }
-
-    private String terminalCallLimitation(Instruction instruction) {
-        if (!instruction.getFlowType().isCall() || !instruction.getFlowType().isTerminal())
-            return null;
-        Address[] destinations = instruction.getFlows();
-        StringBuilder limitation = new StringBuilder();
-        limitation.append("Ghidra Listing reports a terminal call at ")
-            .append(canonicalAddress(instruction.getAddress()));
-        if (destinations.length == 0) {
-            limitation.append(" with no resolved callee; its no-return basis is unknown.");
-        }
-        else {
-            limitation.append(" to ");
-            for (int index = 0; index < destinations.length; index++) {
-                if (index > 0) limitation.append(", ");
-                Address destination = destinations[index];
-                limitation.append(canonicalAddress(destination));
-                Function target = currentProgram.getFunctionManager().getFunctionAt(destination);
-                if (target == null) {
-                    limitation.append(" (callee identity unknown)");
-                }
-                else {
-                    limitation.append(" ").append(procedureName(target));
-                    limitation.append(" (external=").append(target.isExternal());
-                    limitation.append(", thunk=").append(target.isThunk());
-                    limitation.append(", hasNoReturn=").append(target.hasNoReturn()).append(")");
-                }
-            }
-            limitation.append("; fallthrough is excluded by Ghidra's flow model.");
-            Function target = destinations.length == 1
-                ? currentProgram.getFunctionManager().getFunctionAt(destinations[0])
-                : null;
-            if (target != null && target.hasNoReturn()) {
-                limitation.append(" This records Ghidra's FunctionManager flag, not an independent verification that the callee cannot return.");
+            Address[] destinations = instruction.getFlows();
+            StringBuilder limitation = new StringBuilder();
+            limitation.append("Ghidra Listing reports a terminal call at ")
+                .append(canonicalAddress(instruction.getAddress()));
+            if (destinations.length == 0) {
+                limitation.append(" with no resolved callee; its no-return basis is unknown.");
             }
             else {
-                limitation.append(" The reason for the terminal flow is not established by this observation.");
+                limitation.append(" to ");
+                for (int index = 0; index < destinations.length; index++) {
+                    if (index > 0) limitation.append(", ");
+                    Address destination = destinations[index];
+                    limitation.append(canonicalAddress(destination));
+                    Function target = currentProgram.getFunctionManager().getFunctionAt(destination);
+                    if (target == null) {
+                        limitation.append(" (callee identity unknown)");
+                    }
+                    else {
+                        limitation.append(" ").append(procedureName(target));
+                        limitation.append(" (external=").append(target.isExternal());
+                        limitation.append(", thunk=").append(target.isThunk());
+                        limitation.append(", hasNoReturn=").append(target.hasNoReturn()).append(")");
+                    }
+                }
+                limitation.append("; fallthrough is excluded by Ghidra's flow model.");
+                Function target = destinations.length == 1
+                    ? currentProgram.getFunctionManager().getFunctionAt(destinations[0])
+                    : null;
+                if (target != null && target.hasNoReturn()) {
+                    limitation.append(" This records Ghidra's FunctionManager flag, not an independent verification that the callee cannot return.");
+                }
+                else {
+                    limitation.append(" The reason for the terminal flow is not established by this observation.");
+                }
             }
+            limitations.add(limitation.toString());
         }
-        return limitation.toString();
+        return limitations;
     }
 
     private static String renderAssembly(List<Instruction> instructions) {
@@ -3524,27 +3358,15 @@ public final class ReaGhidraBridge extends HeadlessScript {
     private List<Reference> collectReferences(
             Function function,
             String direction) throws Exception {
-        TreeMap<String, Reference> observed = new TreeMap<>();
-        visitReferences(function, direction, reference -> addReference(observed, reference));
-        List<Reference> result = new ArrayList<>(observed.values());
-        result.sort(REFERENCE_ORDER);
-        return result;
-    }
-
-    @FunctionalInterface
-    private interface ReferenceVisitor {
-        void accept(Reference reference) throws Exception;
-    }
-
-    private void visitReferences(Function function, String direction, ReferenceVisitor visitor)
-            throws Exception {
         // References can target instruction interiors or originate in embedded
         // data. Use actual body ownership, including an external's exact entry.
-        AddressSet scope = functionObservationScope(function);
+        AddressSet scope = new AddressSet(function.getBody());
+        scope.add(function.getEntryPoint());
         boolean outgoing = direction.equals("outgoing");
         AddressIterator addresses = outgoing
             ? currentProgram.getReferenceManager().getReferenceSourceIterator(scope, true)
             : currentProgram.getReferenceManager().getReferenceDestinationIterator(scope, true);
+        TreeMap<String, Reference> observed = new TreeMap<>();
         while (addresses.hasNext()) {
             monitor.checkCancelled();
             Address address = addresses.next();
@@ -3552,7 +3374,7 @@ public final class ReaGhidraBridge extends HeadlessScript {
                 for (Reference reference : currentProgram.getReferenceManager()
                         .getReferencesFrom(address)) {
                     monitor.checkCancelled();
-                    if (!reference.isEntryPointReference()) visitor.accept(reference);
+                    addReference(observed, reference);
                 }
             }
             else {
@@ -3560,14 +3382,19 @@ public final class ReaGhidraBridge extends HeadlessScript {
                     .getReferencesTo(address);
                 while (iterator.hasNext()) {
                     monitor.checkCancelled();
-                    Reference reference = iterator.next();
-                    if (!reference.isEntryPointReference()) visitor.accept(reference);
+                    addReference(observed, iterator.next());
                 }
             }
         }
+        List<Reference> result = new ArrayList<>(observed.values());
+        result.sort(REFERENCE_ORDER);
+        return result;
     }
 
     private static void addReference(TreeMap<String, Reference> observed, Reference reference) {
+        if (reference.isEntryPointReference()) {
+            return;
+        }
         String key = canonicalAddress(reference.getFromAddress()) + "\u0000" +
             canonicalAddress(reference.getToAddress()) + "\u0000" +
             reference.getReferenceType().getName() + "\u0000" +
@@ -3576,12 +3403,6 @@ public final class ReaGhidraBridge extends HeadlessScript {
         observed.putIfAbsent(key, reference);
     }
 
-    private static AddressSet functionObservationScope(Function function) {
-        AddressSet scope = new AddressSet(function.getBody());
-        scope.add(function.getEntryPoint());
-        return scope;
-    }
-
     private JsonArray referenceEdges(List<Reference> references) {
         JsonArray result = new JsonArray();
         for (Reference reference : references) {
@@ -3735,28 +3556,23 @@ public final class ReaGhidraBridge extends HeadlessScript {
         return result;
     }
 
-    private JsonArray comments(Function function) throws Exception {
-        Listing listing = currentProgram.getListing();
-        AddressSet scope = functionObservationScope(function);
-        AddressIterator addresses = listing.getCommentAddressIterator(scope, true);
+    private static JsonArray comments(List<Instruction> instructions) {
         TreeMap<String, JsonObject> observed = new TreeMap<>();
-        while (addresses.hasNext()) {
-            monitor.checkCancelled();
-            Address address = addresses.next();
+        for (Instruction instruction : instructions) {
             for (CommentType type : CommentType.values()) {
-                String text = listing.getComment(type, address);
+                String text = instruction.getComment(type);
                 if (text == null || text.isEmpty()) {
                     continue;
                 }
                 String kind = type == CommentType.EOL ? "inline" : "comment";
                 JsonObject item = new JsonObject();
-                item.addProperty("address", canonicalAddress(address));
+                item.addProperty("address", canonicalAddress(instruction.getAddress()));
                 item.addProperty("kind", kind);
                 item.addProperty("text", text);
-                String key = canonicalAddress(address) + "\u0000" +
+                String key = canonicalAddress(instruction.getAddress()) + "\u0000" +
                     kind + "\u0000" + type.name() + "\u0000" + text;
                 observed.put(key, item);
-            }
+                    }
         }
         JsonArray result = new JsonArray();
         observed.values().forEach(result::add);
@@ -4692,8 +4508,7 @@ public final class ReaGhidraBridge extends HeadlessScript {
     private record InventoryItem(Address address, String value, JsonObject facts) {}
     private record AddressNameRequest(String inputAddress, Address address, String name) {}
     private record FunctionEntry(Function function, InventoryItem item) {}
-    private record FunctionAnalysisObservation(JsonObject dossier, List<String> limitations, JsonObject relationshipCoverage) {}
-    private record CallBoundaryObservation(List<String> limitations, Integer unrepresentedCalleeCalls, JsonArray unresolvedCalls) {}
+    private record FunctionAnalysisObservation(JsonObject dossier, List<String> limitations) {}
     private record SwiftStringLiteralDecode(JsonArray literals, JsonArray omissions) {}
     private record SwiftLiteralLayout(
         String representation,

docs/client-configuration.md

@@ -265,21 +265,6 @@ The user-level MCP paths follow the editor's VS Code layout. Trae's official
 documentation describes the raw JSON editor without specifying those paths;
 loading this registration in Trae remains unverified.
 
-## WorkBuddy
-
-For [WorkBuddy](https://www.workbuddy.cn/docs/workbuddy/From-Beginner-to-Expert-Guide/Function-Description/MCP-Guide), setup writes `mcpServers.rea` into the
-global `~/.workbuddy/mcp.json` (a standard `mcpServers` JSON file at the user
-home root on every platform). Entries carry `command`, `args`, and `env`;
-stdio is the default transport. WorkBuddy discovers personal skills from
-`~/.workbuddy/skills` (`%userprofile%\.workbuddy\skills` on Windows), so
-setup installs its skill copy there.
-
-The global MCP path is a plain JSON file; setup preserves every other server
-and top-level key when it upserts `rea`. WorkBuddy also reads a project-level
-`<project>/.workbuddy/mcp.json`, which setup does not touch: it registers the
-user-level file only. Loading this registration and real REA tool calls
-through WorkBuddy are verified.
-
 ## ZCode
 
 For [ZCode](https://zcode.z.ai/en/docs/mcp-services), setup registers `rea` in the nested `mcp.servers` table of the
@@ -294,11 +279,7 @@ the first native server into an empty table, it copies the fallback's
 `mcpServers` entries into the native table so they keep loading, and leaves
 the fallback file untouched. Existing REA environment overrides are preserved
 when refreshing its command. A malformed or unreadable fallback file fails setup instead of
-being silently suppressed; repair or remove it and rerun. Uninstall removes an
-REA-owned `rea` entry from both the native table and the fallback, backing up
-each changed file, so an emptied native table cannot load a leftover fallback
-registration; other fallback servers, settings and a foreign `rea` entry are
-kept. ZCode disables a
+being silently suppressed; repair or remove it and rerun. ZCode disables a
 server with `enable: false` on its entry; doctor reports such a registration
 as stale, and rerunning setup removes the flag to repair it. Native configuration
 uses strict JSON; setup refuses comments, trailing commas and a BOM rather than

docs/installation.md

@@ -129,150 +129,6 @@ Setup pins package-runner MCP registrations to the exact installed REA version,
 installs the matching skill and on-demand references in the same plan, and adds
 `startup_timeout_sec = 30` for Codex and Grok Build.
 
-## Limit REA to one project or agent profile
-
-Setup registers REA for the whole client. For Claude Code it writes
-`mcpServers.rea` in `~/.claude.json` and installs the bundled skill under
-`~/.claude/skills`, so every project that Claude Code opens can call REA. To
-offer REA's tools only where they're wanted, use one of the routes below.
-
-Both routes control which sessions discover REA's MCP server and skill. They
-leave shell commands, filesystem access and network access available. An agent
-under the same OS account can run `rea` from `PATH` or `npx` and read other
-profiles and REA output. For clean-room separation, use an implementation
-environment with filesystem and network restrictions that prevent reading or
-fetching REA, the target and analysis output, including through shared
-installations and package registries. A separate account or container must
-enforce those restrictions.
-
-For Claude Code, check existing default-profile state before choosing either
-route. Setup is additive: a previous user-level REA registration and personal
-skill remain active in other projects. Back up the default configuration and
-REA skill first, then, with `CLAUDE_CONFIG_DIR` unset, remove the REA user
-registration with `claude mcp remove --scope user rea` and remove the known
-REA-installed `~/.claude/skills/reverse-engineer-anything` directory. Preserve
-unrelated registrations and skills. `rea uninstall` applies to other clients
-as well, so it is broader than this Claude-only migration.
-
-**A separate Claude Code profile.** Claude Code keeps settings, skills and session
-history under `CLAUDE_CONFIG_DIR`. Setup follows the same
-variable: it writes the registration to `$CLAUDE_CONFIG_DIR/.claude.json` and
-the skill to `$CLAUDE_CONFIG_DIR/skills`.
-
-```bash
-CLAUDE_CONFIG_DIR=~/.claude-rea npx rea-agents setup --client claude_code
-CLAUDE_CONFIG_DIR=~/.claude-rea claude
-```
-
-A new profile may need authentication. Console sign-ins without an API key are
-stored outside `CLAUDE_CONFIG_DIR`; see
-[Claude Code authentication](https://code.claude.com/docs/en/authentication#log-in-with-multiple-accounts).
-Sessions started without the variable use the default profile's registration,
-skill and history.
-
-Inline assignments apply only to that command. Keep the same prefix for every
-profile check, setup rerun, update, or removal; bare commands use the current
-environment and can otherwise inspect or recreate default-profile state:
-
-```bash
-CLAUDE_CONFIG_DIR=~/.claude-rea claude mcp list
-CLAUDE_CONFIG_DIR=~/.claude-rea npx rea-agents doctor --client claude_code --skill --json
-CLAUDE_CONFIG_DIR=~/.claude-rea npx -y rea-agents@latest setup --client claude_code --dry-run
-```
-
-After reviewing an update plan, rerun that same prefixed setup command without
-`--dry-run` and approve its exact changes. Profile removal likewise needs the
-prefix on `claude mcp remove --scope user rea` and any `rea uninstall` command;
-keep the broader client scope of uninstall in mind. Restart the selected
-profile after changing its pinned registration.
-
-`claude mcp remove` removes only the registration. To remove REA from this
-profile without running the broader uninstall flow, first back up the profile's
-REA-managed skill directory, then remove
-`$CLAUDE_CONFIG_DIR/skills/reverse-engineer-anything` as well. Keep other skills
-in the profile intact.
-
-The commands above use POSIX shell assignment syntax. In native Windows
-PowerShell, select the profile for the whole setup/launch/check session and
-restore the previous selection afterward:
-
-```powershell
-$previousClaudeConfigDir = $env:CLAUDE_CONFIG_DIR
-try {
-  $env:CLAUDE_CONFIG_DIR = Join-Path $HOME ".claude-rea"
-  npx rea-agents setup --client claude_code
-  claude mcp list
-  npx rea-agents doctor --client claude_code --skill --json
-  npx -y rea-agents@latest setup --client claude_code --dry-run
-  # After reviewing the plan, repeat setup without --dry-run and approve it.
-  claude
-  # Profile removal, when intended, also belongs inside this selected scope:
-  # claude mcp remove --scope user rea
-} finally {
-  if ($null -eq $previousClaudeConfigDir) {
-    Remove-Item Env:CLAUDE_CONFIG_DIR -ErrorAction SilentlyContinue
-  } else {
-    $env:CLAUDE_CONFIG_DIR = $previousClaudeConfigDir
-  }
-}
-```
-
-Use PowerShell for these Windows examples rather than pasting POSIX assignments
-into cmd.exe. Keep profile updates, readiness checks and removal inside the
-same selected environment; the `finally` block restores the previous profile
-or unsets the variable when it was absent.
-
-**One project.** Install without configuring Claude Code: use the curl
-installer's `--no-setup`, or run setup only for other clients. Then register
-REA from the project directory at Claude Code's local scope.
-
-This route uses the default Claude profile. Keep `CLAUDE_CONFIG_DIR` unset for
-the entire local lifecycle: registration, backup, listing, version replacement
-and removal. In POSIX shells run `unset CLAUDE_CONFIG_DIR`; in PowerShell run
-`Remove-Item Env:CLAUDE_CONFIG_DIR -ErrorAction SilentlyContinue` before these
-commands. Record an existing selection first if you intend to restore it after
-finishing. The configuration path below is the default profile's
-`~/.claude.json`; a different active profile uses its own config root instead.
-
-Register with the variable unset:
-
-<!-- x-release-please-start-version -->
-
-```bash
-claude mcp add --scope local rea -- npx -y rea-agents@6.4.0 mcp
-```
-
-On native Windows, use the same project directory and wrap the package-runner
-shim so the stdio client can launch it:
-
-```powershell
-claude mcp add --scope local rea -- cmd.exe /d /c npx -y rea-agents@6.4.0 mcp
-```
-
-<!-- x-release-please-end -->
-
-Local scope stores the entry under that directory's path in `~/.claude.json`,
-so other projects don't load it. This route doesn't install the bundled skill.
-Avoid `--scope project`, which writes `.mcp.json` into the repository where it
-can be committed or copied. `rea doctor` and `rea uninstall` read only the
-user-level entry, so they don't report or remove a local-scope registration;
-remove it with `claude mcp remove --scope local rea` from the same directory.
-`rea update` doesn't refresh it either, so it stays on the version it names.
-To move it to a newer release, first back up the project entry in
-`~/.claude.json` and record its environment and other metadata. In particular,
-preserve caller-selected overrides such as `REA_MCP_INPUT_SCHEMA_PROFILE` and
-`REA_MCP_MAX_RESPONSE_BYTES`. Run `claude mcp remove --scope local rea` from the
-same directory, then recreate it with the platform-appropriate command above
-and the new version. Reapply every recorded environment value with Claude
-Code's `mcp add --env NAME=value` options and restore any other retained entry
-metadata before restarting the project session. Removal and re-addition do not
-preserve these values automatically. Running setup for Claude Code instead
-would add a user-level entry for every project.
-
-Check the separate profile with the prefixed `claude mcp list` above and compare
-with the default profile with `CLAUDE_CONFIG_DIR` unset. For local scope, run
-`claude mcp list` from the selected project and again from another project.
-
 ## Check readiness for your task
 
 Run `rea doctor` when you need diagnosis. It reads host prerequisites and agent
@@ -432,12 +288,11 @@ hosted connector; see [its configuration](client-configuration.md#other-client-s
 | Qoder              | `qoder`          |
 | Factory Droid      | `droid`          |
 | Trae               | `trae`           |
-| WorkBuddy          | `workbuddy`      |
 | ZCode              | `zcode`          |
 | DeepSeek Harness   | `dsh`            |
 
-`dsh`, `kimi`, and `workbuddy` require a release containing them. The registry
-check above does not cover them.
+`dsh` and `kimi` require a release containing them. The registry check above does
+not cover them.
 
 See [client configuration and troubleshooting](client-configuration.md) for
 configuration paths, profiles, trust policies, and schema-limit workarounds.

docs/readme/README_ko.md

@@ -20,7 +20,7 @@
 
 **[웹사이트](https://rea.tools/ko/) · [가이드](https://rea.tools/ko/guides/) · [사례](https://rea.tools/ko/showcase/)**
 
-[빠른 시작](#빠른-시작) · [REA의 작동 방식](#rea의-작동-방식) · [분석할 수 있는 대상](#분석할-수-있는-대상) · [사례](#사례) · [자주 묻는 질문](#자주-묻는-질문) · [문서](#문서)
+[빠른 시작](#빠른-시작) · [REA의 작동 방식](#rea의-작동-방식) · [분석할 수 있는 대상](#분석할-수-있는-대상) · [사례](#사례) · [자주 묻는 질문](#자주-묻는-질문) · [GNU objdump 및 Rizin 도구](../reverse-engineering-tools.md) · [문서](#문서)
 
 <code>npx rea-agents setup</code>
 
@@ -56,7 +56,7 @@
 
 REA는 에이전트를 분석 도구에 연결해 네이티브 바이너리, JavaScript와 Electron 앱, .NET 어셈블리, 웹사이트를 검사할 수 있게 합니다. 터미널에서도 같은 도구를 사용할 수 있습니다. 분석은 로컬에서 실행되며, 결과에는 각 결론의 근거와 한계가 포함됩니다.
 
-설정 과정은 에이전트에 REA를 등록하고 해당 버전에 맞는 워크플로 지침을 설치합니다. 네이티브 분석에는 기존 Hopper, Ghidra 또는 IDA 설치를 사용할 수 있습니다. 승인하면 설정 과정에서 Hopper를 설치할 수도 있습니다. 정적 JavaScript 분석에는 네이티브 분석 엔진이 필요하지 않습니다.
+설정 과정은 에이전트에 REA를 등록하고 해당 버전에 맞는 워크플로 지침을 설치합니다. 네이티브 분석에는 기존 Hopper 또는 Ghidra 설치를 사용할 수 있습니다. 승인하면 설정 과정에서 Hopper를 설치할 수도 있습니다. 정적 JavaScript 분석에는 두 엔진 모두 필요하지 않습니다.
 
 > **[REA 웹사이트](https://rea.tools/ko/)**에서 설정 방법, 그림으로 설명한 가이드, 실제 사례를 확인하세요.
 
@@ -105,14 +105,12 @@ rea --help
 
 REA는 빠르게 바뀌며 새 릴리스에는 버그 수정이 자주 포함됩니다. 설치된 버전을 최신으로 유지하세요.
 
-`npm install --global` 또는 `bun add --global`로 설치한 CLI에서는 다음 명령을 사용합니다.
+npm으로 설치한 CLI에서는 다음 명령을 사용합니다.
 
 ```bash
 rea update
 ```
 
-Bun 전역 업데이트에는 Bun 1.2.17 이상이 필요합니다. 이전 버전의 Bun을 사용한다면 `rea update`를 실행하기 전에 Bun을 직접 업그레이드하세요.
-
 에이전트 등록과 스킬을 갱신하려면 업데이트 과정에서 출력된 설정 명령을 실행하세요.
 
 `npx`를 사용한다면 다음 명령으로 에이전트 설정을 갱신하세요.
@@ -121,7 +119,7 @@ Bun 전역 업데이트에는 Bun 1.2.17 이상이 필요합니다. 이전 버
 npx rea-agents@latest setup
 ```
 
-설정 변경 사항을 검토하고 에이전트를 다시 시작하세요. 일회성 CLI 작업에는 `npx rea-agents@latest` 뒤에 필요한 명령을 붙여 실행하세요. Bun을 사용한다면 위 명령의 `npx rea-agents@latest`를 `bunx rea-agents@latest`로 바꿔 실행하세요.
+설정 변경 사항을 검토하고 에이전트를 다시 시작하세요. 일회성 CLI 작업에는 `npx rea-agents@latest` 뒤에 필요한 명령을 붙여 실행하세요.
 
 ## REA의 작동 방식
 
@@ -141,16 +139,14 @@ REA에는 Node.js 22.x(>=22.19), 24.x(>=24.11) 또는 26+와 npm이 필요합니
 | --------------------- | ----------------------------------------------------------------------------- | --------------------------------------------------------------------------------------------------------------------------------- |
 | 네이티브 바이너리     | 의사 코드, 어셈블리, 문자열, 심볼, 호출, 참조                                 | Hopper, Ghidra 또는 IDA; [네이티브 분석](https://rea.tools/ko/guides/native/)                                                     |
 | 오프라인 ELF 레이아웃 | 섹션, 세그먼트, 원본 심볼/재배치 정보, 정적 분석으로 얻은 보안 완화 기법 후보 | Linux x64에서 호출자가 제공하는 pwntools; [바이너리 진단](../binary-diagnostics.md)                                               |
-| Go 바이너리           | 내장된 컴파일러 버전, 모듈, `replace` 지시어, 빌드 설정                       | REA 내장 ELF/PE/thin Mach-O 정적 검사; Go 설치 불필요                                                                             |
-| Rust 바이너리         | cargo-auditable이 내장한 크레이트 이름, 버전, 소스, 의존성 관계               | REA 내장 ELF/PE/thin Mach-O 정적 검사; [Rust 바이너리](../rust-binaries.md)                                                       |
-| WASM 아티팩트         | 유효성 검사, 섹션, import/export의 정확한 WAT 형식, 디코딩된 WAT              | 호출자 제공 WABT 1.0.42; `inspect_wasm_artifact`                                                                                  |
 | EVM 바이트코드        | 디스패치 선택자, 바이트 오프셋, 추론한 인자와 상태 변경 가능 여부             | Linux x64의 로컬 원시 바이트/16진수 입력 파일; [오프라인 EVM 가이드](../evm-bytecode.md)                                          |
-| SQLite 데이터베이스   | 테이블, 열, 인덱스, 뷰, 트리거, 선택한 일반 테이블의 행                       | 로컬 데이터베이스/WAL 스냅샷; Node.js 24.15 이상의 24.x 또는 26 이상(네이티브 SQLite 한도 적용)                                   |
+| Rust binaries         | Embedded cargo-auditable dependency list                                      | [Rust binaries](../rust-binaries.md)                                                                                              |
 | 기록된 Linux 크래시   | 원시 note 레코드, 기록된 모든 스레드의 레지스터/시그널, 선택적 매핑 후보      | Linux x64에서 호출자가 제공하는 pwntools; GDB/pwndbg는 선택 사항; [기록된 크래시](../recorded-crashes.md)                         |
 | JavaScript / Electron | 모듈, 임포트, 소스 맵, 라우트, IPC, 네이티브 애드온 관계                      | Node.js와 npm; [애플리케이션 분석](https://rea.tools/ko/guides/javascript/)                                                       |
 | 웹사이트              | 페이지 구조, 스크립트, 네트워크 관찰 결과, 요청한 스크린샷                    | Chrome 계열 브라우저; [브라우저 분석](https://rea.tools/ko/guides/browser/)                                                       |
-| 저장된 네트워크 캡처  | 요청, 응답, 접근 가능한 페이로드, 소스 위치                                   | HAR 또는 Fiddler Everywhere SAZ; mitmproxy 네이티브 캡처에는 Linux의 mitmdump; [캡처 가이드](../web-network-captures.md)          |
-| .NET 어셈블리         | 메타데이터, CIL 명령, 선언된 네이티브 의존성, 빌드 비교                       | 별도 도구 불필요(정적 검사만); [관리 코드 가이드](../managed-code-analysis.md)                                                    |
+| 저장된 네트워크 캡처  | 요청, 응답, 접근 가능한 페이로드, 소스 위치                                   | HAR; mitmproxy 네이티브 캡처에는 Linux의 mitmdump; [캡처 가이드](../web-network-captures.md)                                      |
+| 패킷 캡처             | 엔드포인트, DNS, TLS SNI, 프로토콜 분포, HTTP 요청                            | 호출자 제공 tshark 및 capinfos; [pcap 가이드](../pcap-analysis.md)                                                                |
+| .NET 어셈블리         | 메타데이터, CIL 명령, 선언된 네이티브 의존성, 빌드 비교                       | 정적 검사; [관리 코드 가이드](../managed-code-analysis.md)                                                                        |
 | Android APK           | 매니페스트 선언, 클래스, 디컴파일된 메서드, 참조                              | Linux/macOS/Windows x64의 헤드리스 JADX와 전체 JDK; [Android 가이드](../android-analysis.md)                                      |
 | Android 기기          | 기기, 패키지, 프로세스, 로그, 덤프, 화면 캡처, APK/파일 전송                  | 호출자 제공 adb(에뮬레이터 또는 실제 기기); [ADB 가이드](../adb-device-analysis.md)                                               |
 | JEB 프로젝트          | 엔진 기반 프로젝트 유닛, 아티팩트 해시, 타입/메서드 의사코드                  | 호출자가 시작하고 MCP를 제공하는 JEB 클라이언트(REA_JEB_MCP_URL로 선택); [JEB 가이드](../jeb-analysis.md)                         |
@@ -158,18 +154,15 @@ REA에는 Node.js 22.x(>=22.19), 24.x(>=24.11) 또는 26+와 npm이 필요합니
 | Flutter 앱            | Dart 스냅샷 해시, ABI별 라이브러리 해시, 엔진 빌드 출처                       | 없음 (정적 APK 파싱); [Flutter 가이드](../flutter-analysis.md)                                                                    |
 | 펌웨어                | 영역, 추출 결과, 네이티브 분석으로 전달할 정보                                | Linux의 Binwalk / Unblob; [펌웨어 가이드](../firmware-analysis.md)                                                                |
 | 기록된 패킷           | 선택 필드, 반복 값, 필터 및 디코딩 규칙                                       | Linux: TShark 4.x + prlimit; [캡처 가이드](../packet-captures.md)                                                                 |
-| 패킷 요약             | 엔드포인트, DNS, TLS SNI, 프로토콜 분포, HTTP 요청                            | 호출자 제공 tshark 및 capinfos(Linux에서 검증됨); [pcap 가이드](../pcap-analysis.md)                                              |
 | 기록된 논리 신호      | 디코더 주석, 샘플 범위, 진단 정보                                             | Linux: sigrok-cli 0.7.2 + prlimit; [신호 기록 가이드](../signal-recordings.md)                                                    |
 | 패키지 및 리소스      | 파일 목록, 다이제스트, plist, Apple 번들 구조, 추출한 리소스                  | [아티팩트 및 JavaScript 가이드](../javascript-artifact-reconstruction.md), [Apple 애플리케이션](../apple-application-analysis.md) |
 | 프로세스 동작         | 터미널 출력, 상호작용, 종료 및 파일 시스템 관찰 결과, 실행 비교               | 네이티브 PTY를 지원하는 Linux/macOS; [프로세스 캡처](../process-capture.md)                                                       |
 
 정적 JavaScript 및 .NET 검사는 제공된 파일을 읽으며 애플리케이션을 실행하지 않습니다. 런타임 캡처는 사용자의 권한으로 선택한 대상을 실행하거나 대상과 상호작용합니다. 각 런타임 가이드에서 그 영향을 설명합니다.
 
-오프라인 네이티브 바이너리 검사에는 호출자가 제공하는 GNU objdump와 Rizin도 사용할 수 있습니다. 제공자 설정, CLI 명령, Evidence의 한계는 [리버스 엔지니어링 도구 가이드](../reverse-engineering-tools.md)를 참고하세요. REA는 objdump와 Rizin을 설치하거나 업데이트하지 않습니다.
-
 <a id="choosing-a-deep-analysis-provider"></a>
 
-지원하는 네이티브 형식과 호스트는 제공자마다 다릅니다. [Hopper 및 Ghidra 설정](../installation.md#hopper), [IDA 가이드](../ida-provider.md)(선택 사항인 네이티브 MCP 브리지 포함), [실험적 Windows Ghidra 지원](../windows-ghidra-p0.md)을 참고하세요. Ghidra는 [16비트 DOS 분석](../ghidra-dos.md)도 지원합니다. 큰 바이너리를 분석할 때는 `REA_GHIDRA_STARTUP_TIMEOUT_MS` 또는 `REA_HOPPER_STARTUP_TIMEOUT_MS`로 제공자의 시작 제한 시간을 늘리세요. 제공자 선택은 [CLI 가이드](../cli.md#choose-a-provider)를 참고하세요. 최신 npm 릴리스 이후 추가된 기능은 [릴리스에서의 사용 가능 여부](../installation.md#released-package-and-main)를 확인하세요.
+지원하는 네이티브 형식과 호스트는 제공자마다 다릅니다. [Hopper 및 Ghidra 설정](../installation.md#hopper), [IDA 가이드](../ida-provider.md), [실험적 Windows Ghidra 지원](../windows-ghidra-p0.md)을 참고하세요. Ghidra는 [16비트 DOS 분석](../ghidra-dos.md)도 지원합니다. 제공자 선택은 [CLI 가이드](../cli.md#choose-a-provider)를 참고하세요. 최신 npm 릴리스 이후 추가된 기능은 [릴리스에서의 사용 가능 여부](../installation.md#released-package-and-main)를 확인하세요.
 
 ## 사례
 
@@ -216,7 +209,7 @@ REA로 흥미로운 대상을 분석했다면 알려 주세요. [issue](https://
 <details>
 <summary><strong>Hopper를 먼저 실행해야 하나요?</strong></summary>
 
-REA는 작업에 필요할 때 Hopper를 실행합니다. macOS에서는 처음 실행할 때 데모 모드를 선택하거나 라이선스를 활성화하라는 대화 상자가 나타날 수 있습니다. 첫 CLI/MCP 작업이나 무인 작업을 실행하기 전에 같은 사용자 세션에서 이 대화 상자를 완료하세요. 필요하면 Hopper를 직접 여세요. [Hopper 실행 및 문제 해결](../installation.md#launcher-paths-and-troubleshooting)을 참고하세요.
+REA는 작업에 필요할 때 Hopper를 실행합니다. macOS에서는 처음 실행할 때 데모 모드를 선택하거나 라이선스를 활성화하라는 대화 상자가 나타날 수 있습니다. [Hopper 실행 및 문제 해결](../installation.md#launcher-paths-and-troubleshooting)을 참고하세요.
 
 </details>
 
@@ -246,7 +239,7 @@ REA는 대상을 로컬에서 분석합니다. 에이전트는 도구 결과를
 
 먼저 업데이트하세요. 최근 릴리스에서 이미 수정되었을 수 있습니다.
 
-`npm install --global` 또는 `bun add --global`로 설치한 CLI에서는 다음 명령을 사용합니다.
+npm으로 설치한 CLI에서는 다음 명령을 사용합니다.
 
 ```bash
 rea update
@@ -293,10 +286,12 @@ REA를 사용하고, 버그를 보고하고, 기능을 요청하고, 빌드를
 
 책임 있는 사용에 관한 안내는 [DISCLAIMER.md](../../DISCLAIMER.md)를 참고하세요.
 
-불법적이거나 허가되지 않은 사용에 대한 프로젝트의 입장은 모든 REA 버전, 배포 채널, 플랫폼에 적용되며, 각 사본에는 해당 라이선스가 그대로 유지됩니다.
-
 REA는 법을 준수하는 연구, 교육, 상호운용성 확보, 소프트웨어 보존, 그리고 본인이 소유하거나 조사 권한을 가진 소프트웨어의 분석을 위한 도구입니다.
 
+The project's position on illegal or unauthorized use covers all REA
+versions, distribution channels, and platforms; each copy retains its
+applicable licenses.
+
 ## 기여
 
 REA에 도움을 보태 주세요! [issue를 등록](https://github.com/morluto/rea/issues)해 버그나 기능을 제안하거나, [pull request를 보내](https://github.com/morluto/rea/pulls) 코드와 문서를 개선할 수 있습니다.
@@ -307,6 +302,14 @@ REA에 도움을 보태 주세요! [issue를 등록](https://github.com/morluto/
 
 [MIT](../../LICENSE)
 
-REA가 작성한 코드는 MIT 라이선스를 따릅니다. 제3자 자료에는 각자의 라이선스와 저작권 고지가 그대로 유지됩니다. 의존성 목록, 보존된 라이선스 원문, 외부 도구 약관은 [제3자 고지](../../THIRD_PARTY_NOTICES.md)를 참고하세요.
+REA-authored code is licensed under MIT. Third-party material retains its own
+licenses and copyright notices; see [Third-party notices](../../THIRD_PARTY_NOTICES.md)
+for the dependency inventory, preserved license texts, and external-tool terms.
 
-IDA Pro / Hex-Rays 디컴파일러, Hopper, JEB 등 상용 도구는 해당 라이선스에 따라 **합법적으로 취득하고 사용 권한을 갖춰야 합니다.** REA는 어떤 도구의 라이선스, 키, 활성화 권한도 부여하지 않습니다. 체험판과 데모는 사용자, 기능, 자동화, 출력 공유 제한을 포함한 공급업체 약관을 따릅니다. 크랙 버전, 도난 키, 무단 키 공유, 라이선스 제한 우회는 허용되지 않습니다. 이 안내는 MIT 라이선스나 제3자 라이선스를 변경하지 않습니다.
+**You must legally obtain and be authorized to use commercial tools**, including
+IDA Pro / Hex-Rays decompilers, Hopper, and JEB, under their applicable licenses.
+REA grants no tool license, key, or activation entitlement. Trials and demos
+remain subject to vendor terms, including user, feature, automation, and output
+sharing restrictions. Cracked copies, stolen keys, unauthorized key sharing,
+and bypassing license restrictions are not authorized. This guidance does not
+amend MIT or third-party licenses.

scripts/lib/native-value-e2e.mjs

@@ -215,27 +215,6 @@ async function verifyNativeValueAdapters(
     const functionEvidence = parseEvidence(analyzed.structuredContent);
     assert.equal(functionEvidence.operation, "analyze_function");
     assert.equal(functionEvidence.provider.id, "ghidra");
-    assert.deepEqual(
-      functionEvidence.normalized_result.facet_availability,
-      Object.fromEntries(
-        [
-          "pseudocode",
-          "assembly",
-          "comments",
-          "callers",
-          "callees",
-          "references",
-          "strings_names",
-          "cfg",
-        ].map((facet) => [facet, { available: true }]),
-      ),
-    );
-    assert.equal(functionEvidence.relationship_coverage?.status, "complete");
-    assert.ok(
-      functionEvidence.relationship_coverage.diagnostics.some((diagnostic) =>
-        diagnostic.includes("indirect calls remain unknown"),
-      ),
-    );
     const functionProfile = analysisProfileSchema.parse(
       functionEvidence.analysis_profile,
     );
@@ -268,7 +247,6 @@ async function verifyNativeValueAdapters(
     assert.ok(
       comparisonEvidence.evidence_links.includes(functionEvidence.evidence_id),
     );
-    await verifyUnresolvedCallEvidence(client);
     const bundle = await client.callTool({
       name: "get_evidence_bundle",
       arguments: {},
@@ -329,63 +307,3 @@ async function verifyNativeValueAdapters(
     unknowns: cliGraph.unknowns.length,
   };
 }
-
-async function verifyUnresolvedCallEvidence(client) {
-  const inventory = await client.callTool({
-    name: "list_procedures",
-    arguments: {},
-  });
-  assert.notEqual(inventory.isError, true, JSON.stringify(inventory));
-  const procedures = parseEvidence(
-    inventory.structuredContent,
-  ).normalized_result;
-  const indirect = procedures.find((item) =>
-    item.value.endsWith("rea_ghidra_inventory_indirect"),
-  );
-  const leaf = procedures.find((item) =>
-    item.value.endsWith("rea_ghidra_inventory_leaf"),
-  );
-  assert.ok(
-    indirect && leaf,
-    "Source fixture lacks the unresolved callback and its possible target",
-  );
-  const analyzed = await client.callTool(
-    { name: "analyze_function", arguments: { procedure: indirect.address } },
-    { timeout: 180000 },
-  );
-  assert.notEqual(analyzed.isError, true, JSON.stringify(analyzed));
-  const evidence = parseEvidence(analyzed.structuredContent);
-  assert.equal(evidence.relationship_coverage?.status, "partial");
-  assert.ok(evidence.normalized_result.unresolved_calls.length > 0);
-  const traced = await client.callTool(
-    {
-      name: "trace_call_path",
-      arguments: {
-        start: indirect.address,
-        goal: leaf.address,
-        direction: "forward",
-      },
-    },
-    { timeout: 180000 },
-  );
-  assert.notEqual(traced.isError, true, JSON.stringify(traced));
-  const trace = parseEvidence(traced.structuredContent).normalized_result;
-  assert.equal(trace.goal_status, "unknown");
-  assert.equal(trace.truncated, true);
-  assert.ok(trace.residual_unknowns.length > 0);
-  const compared = await client.callTool(
-    {
-      name: "compare_functions",
-      arguments: {
-        left: analyzed.structuredContent,
-        right: analyzed.structuredContent,
-      },
-    },
-    { timeout: 180000 },
-  );
-  assert.notEqual(compared.isError, true, JSON.stringify(compared));
-  assert.equal(
-    parseEvidence(compared.structuredContent).normalized_result.status,
-    "unknown",
-  );
-}

scripts/lib/real-ghidra-boundaries.mjs

@@ -136,7 +136,7 @@ export async function verifyGhidraBoundaries(
   assert.deepEqual(externalDossier.callees, []);
   assert.deepEqual(externalDossier.facet_availability.pseudocode, {
     available: false,
-    reason: "Ghidra does not decompile external functions.",
+    reason: "Ghidra did not supply pseudocode.",
   });
   for (const facet of [
     "assembly",

scripts/verify-windows-native-inspection.mjs

@@ -1,12 +1,11 @@
 import assert from "node:assert/strict";
-import { spawnSync } from "node:child_process";
+import { execFileSync } from "node:child_process";
 import {
-  access,
   copyFile,
   mkdir,
   mkdtemp,
-  readFile,
   readdir,
+  rmdir,
   rm,
   stat,
   symlink,
@@ -55,7 +54,7 @@ try {
     join(workspace, "dist", "windows", "WindowsNativeLoader.js"),
   ).href;
   const source = `import assert from 'node:assert/strict';
-import {existsSync,mkdirSync,readFileSync,readdirSync,renameSync,statSync,writeFileSync} from 'node:fs';
+import {existsSync,mkdirSync,readdirSync,renameSync,statSync} from 'node:fs';
 import {join} from 'node:path';
 import {systemWindowsNativeAuthority} from ${JSON.stringify(loader)};
 const temp=process.env.TEMP;
@@ -65,61 +64,46 @@ assert.equal(first.retryable,true);
 assert.match(first.reason,/Delete owned object by handle failed.*Win32 5/s);
 const [name,...extra]=readdirSync(temp);assert.ok(name);assert.equal(extra.length,0);
 const path=join(temp,name);const identity=statSync(path,{bigint:true});
-// Delete sharing permits rename; ownership follows the retained NTFS handle.
-writeFileSync(join(path,'owned-child.txt'),'owned child');
-const renamed=path+'-renamed';renameSync(path,renamed);
-const moved=statSync(renamed,{bigint:true});
-assert.equal(moved.dev,identity.dev);assert.equal(moved.ino,identity.ino);
+// Ownership follows the retained NTFS handle even when the directory moves.
+// A replacement at its old pathname must remain caller-owned.
+const moved=path+'-renamed';renameSync(path,moved);
+assert.equal(statSync(moved,{bigint:true}).ino,identity.ino);
 mkdirSync(path);const replacement=statSync(path,{bigint:true});
 assert.notEqual(replacement.ino,identity.ino);
-const sentinel=join(path,'unrelated.txt');writeFileSync(sentinel,'unrelated replacement');
 if(process.argv[2]!=='teardown'){
  const second=systemWindowsNativeAuthority();assert.equal(second.available,true);
- assert.equal(existsSync(renamed),false);
+ assert.equal(existsSync(moved),false);
  assert.deepEqual(readdirSync(temp),[name]);
- assert.equal(readFileSync(sentinel,'utf8'),'unrelated replacement');
  assert.equal(statSync(path,{bigint:true}).ino,replacement.ino);
  assert.equal(systemWindowsNativeAuthority(),second);
 }
-console.log(JSON.stringify({mode:process.argv[2],firstFailed:true,retainedOwner:true,name,renamed,device:identity.dev.toString(),inode:identity.ino.toString(),replacementInode:replacement.ino.toString()}));
+console.log(JSON.stringify({mode:process.argv[2],firstFailed:true,retainedOwner:true,inode:identity.ino.toString(),replacementName:name,replacementInode:replacement.ino.toString()}));
 `;
   const fixture = join(workspace, "probe.mjs");
   await writeFile(fixture, source);
   for (const mode of ["retry", "teardown"]) {
     const temp = join(workspace, mode);
     await mkdir(temp);
-    const child = spawnSync(process.execPath, [fixture, mode], {
-      encoding: "utf8",
-      timeout: 20_000,
-      windowsHide: true,
-      env: { ...process.env, TEMP: temp, TMP: temp },
-    });
-    if (child.error !== undefined) throw child.error;
-    assert.equal(child.status, 0, child.stderr);
-    assert.equal(
-      child.stderr,
-      "",
-      "Native environment teardown reported a cleanup failure",
+    const observed = JSON.parse(
+      execFileSync(process.execPath, [fixture, mode], {
+        encoding: "utf8",
+        timeout: 20_000,
+        windowsHide: true,
+        env: { ...process.env, TEMP: temp, TMP: temp },
+      }),
     );
-    const observed = JSON.parse(child.stdout);
-    assert.equal(observed.mode, mode);
-    assert.equal(observed.firstFailed, true);
     assert.equal(observed.retainedOwner, true);
-    await assert.rejects(access(observed.renamed), { code: "ENOENT" });
-    assert.deepEqual(await readdir(temp), [observed.name]);
-    const replacement = join(temp, observed.name);
-    const identity = await stat(replacement, { bigint: true });
-    assert.equal(identity.dev.toString(), observed.device);
-    assert.equal(identity.ino.toString(), observed.replacementInode);
-    assert.notEqual(identity.ino.toString(), observed.inode);
-    assert.deepEqual(await readdir(replacement), ["unrelated.txt"]);
+    assert.deepEqual(await readdir(temp), [observed.replacementName]);
+    const replacement = join(temp, observed.replacementName);
     assert.equal(
-      await readFile(join(replacement, "unrelated.txt"), "utf8"),
-      "unrelated replacement",
+      (await stat(replacement, { bigint: true })).ino.toString(),
+      observed.replacementInode,
     );
+    await rmdir(replacement);
+    assert.deepEqual(await readdir(temp), []);
   }
   process.stdout.write(
-    `${JSON.stringify({ ok: true, controlledDispositionFailure: true, retainedOwner: true, renamedOwnerCleansChildren: true, unrelatedReplacementPreserved: true, retryRecovers: true, successfulAdmissionCached: true, environmentTeardownCleansProbe: true, issue1701HostCauseReproduced: false })}\n`,
+    `${JSON.stringify({ ok: true, controlledDispositionFailure: true, retainedOwner: true, renamedOwnerCleanup: true, replacementPreserved: true, retryRecovers: true, successfulAdmissionCached: true, environmentTeardownCleansProbe: true, issue1701HostCauseReproduced: false })}\n`,
   );
 } finally {
   await rm(workspace, { recursive: true, force: true });

src/application/ClientConfigurationDocument.ts

@@ -167,7 +167,7 @@ export const parseZcodeFallbackConfiguration = (
         ? {}
         : requireObject(document.mcpServers, "ZCode fallback mcpServers"),
     serversPath: ["mcpServers"],
-    dialect: "zcode_fallback",
+    dialect: "json",
     legacyServers: {},
   };
 };
@@ -183,7 +183,6 @@ export const parseClientConfiguration = (
   if (format === undefined || format === "unsupported")
     throw new TypeError("client does not have a supported MCP config format");
   // DeepSeek Harness stores a Cordis patch list, not a server table.
-  if (format === "zcode_fallback") return parseZcodeFallbackConfiguration(text);
   if (format === "dsh") return parseDshCordisDocument(text);
   const document = parseDocument(text, format);
   const serversKey = clientConfigurationServersKey(format);

src/application/DirectAnalysis.ts

@@ -42,6 +42,7 @@ import {
   workflowAnalysisProfile,
 } from "./InvestigationProviders.js";
 import {
+  executeComposedWorkflow,
   createWorkflowEvidence,
   workflowSnapshotRecord,
   recordWorkflowUnknowns,
@@ -401,18 +402,17 @@ const executeAnalysisTool = async (input: {
     tool === "trace_native_ui_action"
   ) {
     const { EnhancedTools } = await import("./EnhancedTools.js");
-    const result = await new EnhancedTools(session).execute(
-      tool,
-      input.arguments,
-      signal,
+    const result = await executeComposedWorkflow(session, (observed) =>
+      new EnhancedTools(observed).execute(tool, input.arguments, signal),
     );
     if (!result.ok) return { output: cliError(result.error) };
     const evidence = createWorkflowEvidence({
       target: input.openedTarget,
       operation: tool,
       parameters: input.arguments,
-      result: result.value,
+      result: result.value.result,
       upstreamProfile: evidenceProfile,
+      upstreamLimitations: result.value.limitations,
     });
     return { output: evidence, evidence };
   }

src/application/InvestigationProviders.ts

@@ -19,12 +19,12 @@ export const workflowAnalysisProfile = (
   createAnalysisProfile(REA_WORKFLOW_PROVIDER, {
     upstream_analysis_profile: upstream,
     ...(operation === "binary_overview"
-      ? { workflow_revision: 3 }
+      ? { workflow_revision: 4 }
       : operation === "batch_decompile" ||
           operation === "get_call_graph" ||
           operation === "trace_feature"
-        ? { workflow_revision: 2 }
-        : {}),
+        ? { workflow_revision: 3 }
+        : { workflow_revision: 1 }),
   });
 
 /** Provider identity for deterministic artifact inventories. */

src/application/ReferenceSourceImport.ts

@@ -12,7 +12,7 @@ import type { ArtifactResourceScope } from "../artifacts/ArtifactResourceScope.j
 import type { AnalysisCleanupObservation } from "../domain/analysisErrorBase.js";
 import { readReferenceSource } from "../reference/ReferenceSourceReader.js";
 import type {
-  ReferenceSourceExclusionKind,
+  ReferenceSourceEntryKind,
   ReferenceSourceRead,
   ReferenceSourceReaderError,
 } from "../reference/ReferenceSourceReaderTypes.js";
@@ -111,8 +111,7 @@ const deriveInventoryState = (
       entry.limitations.length > 0 ||
       (entry.kind === "file" && entry.content_state !== "hashed") ||
       (entry.kind === "directory" && entry.tree_state !== "enumerated") ||
-      (entry.kind === "symlink" && entry.target_state !== "internal") ||
-      entry.kind === "unknown",
+      (entry.kind === "symlink" && entry.target_state !== "internal"),
   );
   if (partialEntry) return "partial";
   const partialRelationship = input.relationships.some(
@@ -143,24 +142,11 @@ const createShouldExclude =
     exclusions: HistoricalSourceGraphInput["exclusions"],
     secrets: PreparedReferenceSourceImport["secrets"],
     ignored: PreparedReferenceSourceImport["ignored"],
-  ): ((path: string, kind: ReferenceSourceExclusionKind) => boolean) =>
+  ): ((path: string, kind: ReferenceSourceEntryKind) => boolean) =>
   (path, kind) => {
-    // An entry of unknown kind may be a directory, so directory-only rules
-    // must still exclude it; this fails closed for caller-marked secrets.
-    const patternPaths =
-      kind === "directory"
-        ? [`${path}/`]
-        : kind === "unknown"
-          ? [path, `${path}/`]
-          : [path];
-    const firstMatch = (matcher: typeof secrets) => {
-      const results = patternPaths.map((patternPath) =>
-        matcher.test(patternPath),
-      );
-      return results.find(({ ignored }) => ignored) ?? results[0];
-    };
-    const secretMatch = firstMatch(secrets);
-    if (secretMatch?.ignored === true) {
+    const patternPath = kind === "directory" ? `${path}/` : path;
+    const secretMatch = secrets.test(patternPath);
+    if (secretMatch.ignored) {
       if (!secretMatch.rule)
         throw new Error(`Ignored secret path has no matching rule: ${path}`);
       exclusions.push({
@@ -170,8 +156,8 @@ const createShouldExclude =
       });
       return true;
     }
-    const match = firstMatch(ignored);
-    if (match?.ignored !== true) return false;
+    const match = ignored.test(patternPath);
+    if (!match.ignored) return false;
     if (!match.rule)
       throw new Error(`Ignored path has no matching rule: ${path}`);
     const reason = match.rule.mark;

src/application/ReferenceSourceImportEntries.ts

@@ -45,8 +45,6 @@ const entryRecoveryGuidance = (
     return "This directory could not be read. Check its permissions, then try again.";
   if (entry.kind === "symlink")
     return "This symbolic link could not be read safely. Check the link and its permissions, then try again.";
-  if (entry.kind === "unknown")
-    return "This entry's type could not be determined. Check the parent directory and try again.";
   return "This file could not be read. Check its permissions, then try again.";
 };
 
@@ -75,13 +73,6 @@ const failedEntry = (
       classifications,
       limitations: [limitation],
     };
-  if (entry.kind === "unknown")
-    return {
-      path: entry.path,
-      kind: "unknown",
-      classifications: ["unknown"],
-      limitations: [limitation],
-    };
   return {
     path: entry.path,
     kind: "file",

src/application/SupportedClients.ts

@@ -47,7 +47,6 @@ export interface SetupClient {
     | "pi"
     | "kimi"
     | "hermes"
-    | "zcode_fallback"
     | "zcode"
     | "dsh"
     | "unsupported";
@@ -607,14 +606,6 @@ export const SUPPORTED_CLIENT_DEFINITIONS = [
     markerPath: traeUserDirectory,
     format: "json",
   },
-  {
-    name: "workbuddy",
-    displayName: "WorkBuddy",
-    skillPath: [".workbuddy", "skills"],
-    configPath: [".workbuddy", "mcp.json"],
-    markerPath: [".workbuddy"],
-    format: "json",
-  },
   {
     name: "grok_build",
     displayName: "Grok Build",

src/application/Uninstall.ts

@@ -231,21 +231,12 @@ export const systemUninstallHost = (
       const clients = supportedClients(home, platform, environment);
       redirection = appDataRedirection(clients);
       return Promise.resolve(
-        clients.flatMap((client) => [
-          ...uninstallConfigPaths(client).map((configPath) => ({
+        clients.flatMap((client) =>
+          uninstallConfigPaths(client).map((configPath) => ({
             ...client,
             configPath,
           })),
-          ...(client.zcodeFallbackPath === undefined
-            ? []
-            : [
-                {
-                  ...client,
-                  configPath: client.zcodeFallbackPath,
-                  format: "zcode_fallback" as const,
-                },
-              ]),
-        ]),
+        ),
       );
     },
     inspectClient: async (client) => {

src/application/WorkflowEvidence.test.ts

@@ -3,15 +3,145 @@ import { describe, expect, it } from "vitest";
 import {
   recordWorkflowUnknowns,
   createWorkflowEvidence,
+  executeComposedWorkflow,
 } from "./WorkflowEvidence.js";
 import { InvestigationRecords } from "./investigation/InvestigationRecords.js";
 import { UnknownRegistryError } from "../domain/unknownRegistryError.js";
-import { err } from "../domain/result.js";
+import { err, ok } from "../domain/result.js";
+import {
+  createAnalysisExecution,
+  type AnalysisOperationPort,
+} from "./AnalysisProvider.js";
+import { AnalysisCancelledError } from "../domain/analysisErrorCore.js";
 import { nativeApiBoundarySchema } from "../domain/native/nativeApiBoundary.js";
 import { projectNativeApiInspection } from "./native/NativeApiInspection.js";
 import { functionDossierSchema } from "../domain/hopperValues.js";
 import { ghidraFunctionDossier } from "../domain/ghidraValues.fixture.js";
 
+const provider = { id: "fixture", name: "Fixture", version: "1" };
+
+it("keeps Evidence identity stable when dependent branches finish in opposite orders", async () => {
+  const run = async (order: readonly number[]) => {
+    const gate = () => {
+      let resolve: () => void = () => {
+        throw new Error("gate not initialized");
+      };
+      const promise = new Promise<void>((release) => {
+        resolve = release;
+      });
+      return { promise, resolve };
+    };
+    const parents = [gate(), gate()];
+    const children = [gate(), gate()];
+    const analysis: AnalysisOperationPort = {
+      execute: async (operation, parameters) => {
+        const index = Number(parameters.index);
+        if (operation === "procedure_address") {
+          await parents[index]!.promise;
+          return ok(createAnalysisExecution(String(index), provider));
+        }
+        children[index]!.resolve();
+        return ok(
+          createAnalysisExecution(String(index), provider, {
+            limitations: [
+              index === 0 ? "first child caveat" : "second child caveat",
+            ],
+          }),
+        );
+      },
+    };
+    const composed = await executeComposedWorkflow(
+      analysis,
+      async (observed) => {
+        const branches = Promise.all(
+          [0, 1].map(async (index) => {
+            await observed.execute("procedure_address", { index });
+            const child = await observed.execute("address_name", { index });
+            if (!child.ok) throw child.error;
+            return child.value.result;
+          }),
+        );
+        for (const index of order) {
+          parents[index]!.resolve();
+          await children[index]!.promise;
+        }
+        return ok(await branches);
+      },
+    );
+    if (!composed.ok) throw composed.error;
+    return createWorkflowEvidence({
+      target: undefined,
+      operation: "batch_decompile",
+      parameters: {},
+      result: composed.value.result,
+      upstreamProfile: undefined,
+      upstreamLimitations: composed.value.limitations,
+    });
+  };
+  const left = await run([0, 1]);
+  const right = await run([1, 0]);
+  expect(left.normalized_result).toEqual(right.normalized_result);
+  expect(left.limitations).toEqual(right.limitations);
+  expect(left.evidence_id).toBe(right.evidence_id);
+});
+
+it("retains unique upstream limits in canonical order across concurrent observations", async () => {
+  let release: () => void = () => {
+    throw new Error("gate not initialized");
+  };
+  const gate = new Promise<void>((resolve) => {
+    release = resolve;
+  });
+  let calls = 0;
+  const options = { signal: new AbortController().signal };
+  const analysis: AnalysisOperationPort = {
+    execute: async (_, parameters, forwarded) => {
+      expect(parameters).toEqual({ marker: true });
+      expect(forwarded).toBe(options);
+      const call = calls++;
+      if (call === 0) await gate;
+      else release();
+      return ok(
+        createAnalysisExecution([], provider, {
+          limitations: call === 0 ? ["first", "shared"] : ["second", "shared"],
+        }),
+      );
+    },
+  };
+  const result = await executeComposedWorkflow(analysis, async (observed) => {
+    await Promise.all([
+      observed.execute("list_strings", { marker: true }, options),
+      observed.execute("list_procedures", { marker: true }, options),
+    ]);
+    return ok({ count: 0 });
+  });
+  expect(calls).toBe(2);
+  expect(result).toEqual(
+    ok({ result: { count: 0 }, limitations: ["first", "second", "shared"] }),
+  );
+});
+
+it("preserves a failed composed operation without an extra provider read", async () => {
+  const failure = err(new AnalysisCancelledError("list_strings"));
+  let calls = 0;
+  const result = await executeComposedWorkflow(
+    {
+      execute: async () => {
+        calls++;
+        return failure;
+      },
+    },
+    async (observed) => {
+      const observedResult = await observed.execute("list_strings", {});
+      return observedResult.ok
+        ? ok(observedResult.value.result)
+        : observedResult;
+    },
+  );
+  expect(result).toBe(failure);
+  expect(calls).toBe(1);
+});
+
 describe("workflow residual question retention", () => {
   it("keeps questions linked to workflow Evidence and records repeats idempotently", () => {
     const records = new InvestigationRecords();
@@ -24,6 +154,7 @@ describe("workflow residual question retention", () => {
       parameters: { procedure: "0x1000" },
       result,
       upstreamProfile: undefined,
+      upstreamLimitations: [],
     });
     expect(records.recordEvidence(evidence).ok).toBe(true);
     const input = {
@@ -61,6 +192,7 @@ describe("workflow residual question retention", () => {
         parameters: {},
         result,
         upstreamProfile: undefined,
+        upstreamLimitations: [],
       });
 
       expect(records.recordEvidence(evidence).ok).toBe(true);
@@ -88,6 +220,7 @@ describe("workflow residual question retention", () => {
       parameters: {},
       result,
       upstreamProfile: undefined,
+      upstreamLimitations: [],
     });
 
     expect(records.recordEvidence(evidence).ok).toBe(true);
@@ -139,6 +272,7 @@ it.each([
       parameters: { procedure: "0x1000" },
       result,
       upstreamProfile: undefined,
+      upstreamLimitations: [],
     });
     const records = new InvestigationRecords();
     expect(records.recordEvidence(evidence).ok).toBe(true);

src/application/WorkflowEvidence.ts

@@ -2,7 +2,12 @@ import {
   REA_WORKFLOW_PROVIDER,
   workflowAnalysisProfile,
 } from "./InvestigationProviders.js";
-import type { AnalysisOperation } from "./AnalysisProvider.js";
+import type {
+  AnalysisOperation,
+  AnalysisOperationPort,
+} from "./AnalysisProvider.js";
+import type { AnalysisError } from "../domain/analysisErrorBase.js";
+import { ok, type Result } from "../domain/result.js";
 import type { AnalysisProfileCommitment } from "../domain/analysisProfile.js";
 import type { WorkflowSnapshotRecordInput } from "./binary/BinarySessionRecords.js";
 import {
@@ -18,6 +23,37 @@ import {
 import type { JsonValue } from "../domain/jsonValue.js";
 import type { UnknownRegistryPort } from "./investigation/InvestigationRecordPort.js";
 import { UnknownRegistryError } from "../domain/unknownRegistryError.js";
+import { compareUnicodeCodePoints } from "../domain/unicodeCodePointOrder.js";
+
+/** Retain the limits of exactly the observations used by one composed call. */
+export const executeComposedWorkflow = async (
+  analysis: AnalysisOperationPort,
+  execute: (
+    observed: AnalysisOperationPort,
+  ) => Promise<Result<JsonValue, AnalysisError>>,
+): Promise<
+  Result<
+    { readonly result: JsonValue; readonly limitations: readonly string[] },
+    AnalysisError
+  >
+> => {
+  const limitations = new Set<string>();
+  const result = await execute({
+    execute: async (operation, parameters, options) => {
+      const execution = await analysis.execute(operation, parameters, options);
+      if (execution.ok)
+        execution.value.limitations.forEach((limitation) =>
+          limitations.add(limitation),
+        );
+      return execution;
+    },
+  });
+  if (!result.ok) return result;
+  return ok({
+    result: result.value,
+    limitations: [...limitations].sort(compareUnicodeCodePoints),
+  });
+};
 
 /** Build the shared Evidence record for a successful composed binary workflow. */
 export const createWorkflowEvidence = (input: {
@@ -26,6 +62,7 @@ export const createWorkflowEvidence = (input: {
   readonly parameters: Readonly<Record<string, JsonValue>>;
   readonly result: JsonValue;
   readonly upstreamProfile: AnalysisProfileCommitment | undefined;
+  readonly upstreamLimitations: readonly string[];
 }): Evidence =>
   createEvidence(input.target, REA_WORKFLOW_PROVIDER, {
     operation: input.operation,
@@ -40,7 +77,10 @@ export const createWorkflowEvidence = (input: {
           ),
         }),
     confidence: "derived",
-    limitations: ["Derived by an REA composed workflow."],
+    limitations: [
+      "Derived by an REA composed workflow.",
+      ...input.upstreamLimitations,
+    ],
     ...(input.operation === "batch_decompile"
       ? { locations: batchProcedureLocations(input.result) }
       : {}),

src/domain/callPath.test.ts

@@ -337,42 +337,6 @@ describe("call path topology and capacity", () => {
   });
 });
 
-describe("directional call relationship coverage", () => {
-  it.each([
-    {
-      directions: ["callers"] as ["callers"],
-      status: "not_found",
-      exhaustive: true,
-    },
-    {
-      directions: ["callees"] as ["callees"],
-      status: "unknown",
-      exhaustive: false,
-    },
-    {
-      directions: ["callers", "callees"] as ["callers", "callees"],
-      status: "unknown",
-      exhaustive: false,
-    },
-  ])(
-    "uses $directions coverage for the forward search",
-    ({ directions, status, exhaustive }) => {
-      const limitation = "The inventory omitted a reference.";
-      const relationshipCoverage: RelationshipCoverage = {
-        status: "partial",
-        limitations: [limitation],
-        limited_directions: directions,
-      };
-      const result = run([
-        observe("0x1000", ["0x2000"], "rea-workflow", { relationshipCoverage }),
-        observe("0x2000", [], "rea-workflow", { relationshipCoverage }),
-      ]);
-      expect(result).toMatchObject({ status, search_scope: { exhaustive } });
-      expect(result.limitations).toContain(limitation);
-    },
-  );
-});
-
 describe("explicit call relationship coverage", () => {
   it("accumulates 150,000 partial reasons without argument-stack exhaustion", () => {
     const result = run([

src/domain/callPath.ts

@@ -1,4 +1,3 @@
-import { relationshipCoverageLimitations } from "./relationshipCoverage.js";
 import {
   callPathInputSchema,
   callPathResultSchema,
@@ -11,7 +10,7 @@ import {
   parseFunctionEvidence,
   type FunctionSnapshot,
 } from "./functionDossierEvidence.js";
-import { isCallerOnlyIncompleteCoverage } from "./functionCallCoverage.js";
+import { isCallerOnlyUnknownCoverage } from "./functionCallCoverage.js";
 import { compareUnicodeCodePoints } from "./unicodeCodePointOrder.js";
 
 /** Minimal directed caller-to-callee adjacency for call-path search. */
@@ -241,12 +240,15 @@ const inspectSearch = ({
       const coverage = snapshot.evidence.relationship_coverage;
       for (const limitation of snapshot.limitations)
         limitations.push(limitation);
-      if (coverage !== null) {
-        for (const limitation of relationshipCoverageLimitations(coverage))
+      if (coverage?.status === "partial")
+        for (const limitation of coverage.limitations)
           limitations.push(limitation);
-        for (const diagnostic of coverage.diagnostics ?? [])
-          limitations.push(diagnostic);
-      }
+      else if (coverage?.status === "unknown")
+        limitations.push(coverage.reason);
+      for (const diagnostic of coverage !== null && "diagnostics" in coverage
+        ? coverage.diagnostics
+        : [])
+        limitations.push(diagnostic);
       // The requested goal is a terminal for this search. Its outgoing edges
       // cannot add a path to the goal, so its dossier limits are contextual
       // but do not make the searched start-to-goal closure incomplete.
@@ -266,7 +268,7 @@ const inspectSearch = ({
         coverage === null
           ? snapshot.limitations.length > 0
           : coverage.status !== "complete" &&
-            !isCallerOnlyIncompleteCoverage(coverage)
+            !isCallerOnlyUnknownCoverage(coverage)
       )
         incompleteExpandedCoverage = true;
     } else if (node === goal) {

src/domain/functionCallCoverage.test.ts

@@ -2,7 +2,7 @@ import { describe, expect, it } from "vitest";
 
 import {
   combineFunctionRelationshipCoverage,
-  isCallerOnlyIncompleteCoverage,
+  isCallerOnlyUnknownCoverage,
 } from "./functionCallCoverage.js";
 import type { RelationshipCoverage } from "./relationshipCoverage.js";
 
@@ -22,14 +22,14 @@ const cappedCallees: RelationshipCoverage = {
 };
 const complete: RelationshipCoverage = { status: "complete" };
 
-describe("isCallerOnlyIncompleteCoverage", () => {
+describe("isCallerOnlyUnknownCoverage", () => {
   it("detects unknown callers beside complete callees", () => {
     const combined = combineFunctionRelationshipCoverage(
       unknownCallers,
       complete,
     );
     expect(combined.status).toBe("unknown");
-    expect(isCallerOnlyIncompleteCoverage(combined)).toBe(true);
+    expect(isCallerOnlyUnknownCoverage(combined)).toBe(true);
   });
 
   it("rejects unknown callees beside complete callers", () => {
@@ -37,7 +37,7 @@ describe("isCallerOnlyIncompleteCoverage", () => {
       complete,
       unknownCallees,
     );
-    expect(isCallerOnlyIncompleteCoverage(combined)).toBe(false);
+    expect(isCallerOnlyUnknownCoverage(combined)).toBe(false);
   });
 
   it("rejects unknown coverage on both sides", () => {
@@ -45,7 +45,7 @@ describe("isCallerOnlyIncompleteCoverage", () => {
       unknownCallers,
       unknownCallees,
     );
-    expect(isCallerOnlyIncompleteCoverage(combined)).toBe(false);
+    expect(isCallerOnlyUnknownCoverage(combined)).toBe(false);
   });
 
   it("rejects unknown callers beside IDA-capped callees", () => {
@@ -54,37 +54,11 @@ describe("isCallerOnlyIncompleteCoverage", () => {
       cappedCallees,
     );
     expect(combined.status).toBe("unknown");
-    expect(isCallerOnlyIncompleteCoverage(combined)).toBe(false);
+    expect(isCallerOnlyUnknownCoverage(combined)).toBe(false);
   });
 
   it("rejects complete coverage", () => {
     const combined = combineFunctionRelationshipCoverage(complete, complete);
-    expect(isCallerOnlyIncompleteCoverage(combined)).toBe(false);
-  });
-
-  it("retains caller-only partial coverage without relying on limitation wording", () => {
-    const combined = combineFunctionRelationshipCoverage(
-      { status: "partial", limitations: ["Missing incoming references."] },
-      complete,
-    );
-    expect(combined).toMatchObject({ limited_directions: ["callers"] });
-    expect(isCallerOnlyIncompleteCoverage(combined)).toBe(true);
-  });
-
-  it("uses explicit directions even when explanation text contains direction labels", () => {
-    expect(
-      isCallerOnlyIncompleteCoverage({
-        status: "unknown",
-        reason: "Callers: unavailable. Callees: diagnostic text.",
-        limited_directions: ["callers"],
-      }),
-    ).toBe(true);
-    expect(
-      isCallerOnlyIncompleteCoverage({
-        status: "unknown",
-        reason: "Callers: unavailable.",
-        limited_directions: ["callees"],
-      }),
-    ).toBe(false);
+    expect(isCallerOnlyUnknownCoverage(combined)).toBe(false);
   });
 });

src/domain/functionCallCoverage.ts

@@ -1,7 +1,4 @@
-import {
-  relationshipCoverageLimitations,
-  type RelationshipCoverage,
-} from "./relationshipCoverage.js";
+import type { RelationshipCoverage } from "./relationshipCoverage.js";
 import type { FunctionDossier } from "./hopperValues.js";
 import { uniqueSorted } from "./canonicalOrdering.js";
 
@@ -18,25 +15,25 @@ export const combineFunctionRelationshipCoverage = (
     { direction: "callees" as const, coverage: callees },
   ];
   const diagnostics = uniqueSorted(
-    reads.flatMap(({ coverage }) => coverage?.diagnostics ?? []),
+    reads.flatMap(({ coverage }) =>
+      coverage !== undefined && "diagnostics" in coverage
+        ? coverage.diagnostics
+        : [],
+    ),
   );
   const details = diagnostics.length > 0 ? { diagnostics } : {};
-  const callersLimited = callers?.status !== "complete";
-  const calleesLimited = callees?.status !== "complete";
-  const limited_directions: Extract<
-    RelationshipCoverage,
-    { status: "partial" }
-  >["limited_directions"] = callersLimited
-    ? calleesLimited
-      ? ["callers", "callees"]
-      : ["callers"]
-    : ["callees"];
   const reasons = reads.flatMap(({ direction, coverage }) => {
     const label =
       direction === "callers" ? callerCoveragePrefix : calleeCoveragePrefix;
-    return relationshipCoverageLimitations(coverage).map(
-      (reason) => `${label}${reason}`,
-    );
+    const limitations =
+      coverage === undefined
+        ? ["Provider did not report relationship coverage."]
+        : coverage.status === "unknown"
+          ? [coverage.reason]
+          : coverage.status === "partial"
+            ? coverage.limitations
+            : [];
+    return limitations.map((reason) => `${label}${reason}`);
   });
   if (
     reads.some(
@@ -46,48 +43,54 @@ export const combineFunctionRelationshipCoverage = (
     return {
       status: "unknown",
       reason: uniqueSorted(reasons).join(" "),
-      limited_directions,
       ...details,
     };
   if (reasons.length > 0)
     return {
       status: "partial",
       limitations: uniqueSorted(reasons),
-      limited_directions,
       ...details,
     };
   return { status: "complete", ...details };
 };
 
 /**
- * Forward searches depend on callee coverage. Preserve the historical
- * unknown-reason encoding when reading observations without explicit directions.
+ * Whether combined relationship coverage is unknown only on the caller side.
+ * The combine helper above prefixes each direction's reasons, so a reason
+ * that carries the caller prefix and no callee prefix records observed
+ * callees with unobservable callers. Forward (callee-edge) searches stay
+ * exhaustive under that caveat; the caller reason remains a limitation.
  */
-export const isCallerOnlyIncompleteCoverage = (
+export const isCallerOnlyUnknownCoverage = (
   coverage: RelationshipCoverage,
-): boolean => {
-  if (coverage.status === "complete") return false;
-  if (coverage.limited_directions !== undefined)
-    return !coverage.limited_directions.some(
-      (direction) => direction === "callees",
-    );
-  return (
-    coverage.status === "unknown" &&
-    coverage.reason.startsWith(callerCoveragePrefix) &&
-    !coverage.reason.includes(calleeCoveragePrefix)
-  );
-};
+): boolean =>
+  coverage.status === "unknown" &&
+  coverage.reason.startsWith(callerCoveragePrefix) &&
+  !coverage.reason.includes(calleeCoveragePrefix);
 
 /** Explain why two resolved call sets cannot establish call-set equality. */
 export const functionCallCoverageLimitations = (
   coverage: RelationshipCoverage | null,
   dossier: Pick<FunctionDossier, "unresolved_calls">,
 ): string[] => {
-  return uniqueSorted([
-    ...relationshipCoverageLimitations(coverage),
-    ...(coverage?.status === "complete" ? [] : (coverage?.diagnostics ?? [])),
+  const limitations =
+    coverage === null
+      ? ["Provider did not report relationship coverage."]
+      : coverage.status === "unknown"
+        ? [
+            coverage.reason,
+            ...("diagnostics" in coverage ? coverage.diagnostics : []),
+          ]
+        : coverage.status === "partial"
+          ? [
+              ...coverage.limitations,
+              ...("diagnostics" in coverage ? coverage.diagnostics : []),
+            ]
+          : [];
+  limitations.push(
     ...(dossier.unresolved_calls ?? []).map(
       ({ address, reason }) => `Unresolved call at ${address}: ${reason}`,
     ),
-  ]);
+  );
+  return uniqueSorted(limitations);
 };

src/domain/javascript/javascriptStaticAnalysis.event_source.test.ts

@@ -1,40 +0,0 @@
-import { describe, expect, it } from "vitest";
-
-import { analyzeJavaScriptStaticSource } from "./javascriptStaticAnalysis.js";
-
-const endpoints = (source: string) =>
-  analyzeJavaScriptStaticSource(source).endpoints.map(
-    ({ kind, value, mechanism }) => ({ kind, value, mechanism }),
-  );
-
-describe("server-sent event endpoints", () => {
-  it("reports EventSource URLs like WebSocket URLs", () => {
-    expect(
-      endpoints(`
-        new WebSocket("wss://chat.example/ws");
-        new EventSource("/api/chat/stream");
-        new window.EventSource("https://chat.example/events", { withCredentials: true });
-      `),
-    ).toEqual([
-      {
-        kind: "network",
-        value: "wss://chat.example/ws",
-        mechanism: "call:WebSocket",
-      },
-      {
-        kind: "network",
-        value: "/api/chat/stream",
-        mechanism: "call:EventSource",
-      },
-      {
-        kind: "network",
-        value: "https://chat.example/events",
-        mechanism: "call:window.EventSource",
-      },
-    ]);
-  });
-
-  it("keeps a dynamic EventSource URL unreported", () => {
-    expect(endpoints("new EventSource(url);")).toEqual([]);
-  });
-});

src/domain/javascript/javascriptStaticAnalysis.send_beacon.test.ts

@@ -1,34 +0,0 @@
-import { describe, expect, it } from "vitest";
-
-import { analyzeJavaScriptStaticSource } from "./javascriptStaticAnalysis.js";
-
-const endpoints = (source: string) =>
-  analyzeJavaScriptStaticSource(source).endpoints.map(
-    ({ kind, value, mechanism }) => ({ kind, value, mechanism }),
-  );
-
-describe("beacon endpoints", () => {
-  it("reports navigator.sendBeacon URLs", () => {
-    expect(
-      endpoints(`
-        navigator.sendBeacon("/api/telemetry", payload);
-        window.navigator.sendBeacon("https://metrics.example/collect");
-      `),
-    ).toEqual([
-      {
-        kind: "network",
-        value: "/api/telemetry",
-        mechanism: "call:navigator.sendBeacon",
-      },
-      {
-        kind: "network",
-        value: "https://metrics.example/collect",
-        mechanism: "call:window.navigator.sendBeacon",
-      },
-    ]);
-  });
-
-  it("keeps a dynamic beacon URL unreported", () => {
-    expect(endpoints("navigator.sendBeacon(url, payload);")).toEqual([]);
-  });
-});

src/domain/javascript/javascriptStaticAnalysisHelpers.ts

@@ -554,13 +554,7 @@ export const endpointArgument = (
   receiverFact?: JavaScriptOpenReceiverFact,
 ): string | undefined => {
   if (receiverFact === "window") return undefined;
-  if (
-    name === "fetch" ||
-    name.endsWith(".fetch") ||
-    name === "WebSocket" ||
-    name === "EventSource" ||
-    name.endsWith(".EventSource")
-  )
+  if (name === "fetch" || name.endsWith(".fetch") || name === "WebSocket")
     return stringValue(args[0]);
   if (name.endsWith(".open"))
     return xhrOpenUrl(name, args[0], args[1], receiverFact);
@@ -580,9 +574,6 @@ export const endpointArgument = (
       ? undefined
       : value;
   }
-  // navigator.sendBeacon(url, data) queues a POST to its first argument.
-  if (name === "sendBeacon" || name.endsWith(".sendBeacon"))
-    return stringValue(args[0]);
   if (name.endsWith("loadURL")) return stringValue(args[0]);
   return undefined;
 };

src/domain/referenceSourceGraph.test.ts

@@ -259,30 +259,6 @@ describe("historical source graph", () => {
 });
 
 describe("partial historical source graphs", () => {
-  it("keeps unknown-entry diagnostics outside the root commitment", () => {
-    const base = graphInput();
-    base.inventory_state = "partial";
-    base.entries[2] = {
-      path: "src/package.json",
-      kind: "unknown",
-      classifications: ["unknown"],
-      limitations: ["Permission denied at /private/first"],
-    };
-    const graph = createHistoricalSourceGraph(base);
-    const changedMessage = structuredClone(base);
-    changedMessage.entries[2] = {
-      path: "src/package.json",
-      kind: "unknown",
-      classifications: ["unknown"],
-      limitations: ["Permission denied at /private/second"],
-    };
-    const revised = createHistoricalSourceGraph(changedMessage);
-    expect(revised.root_sha256).toBe(graph.root_sha256);
-    expect(computeHistoricalSourceGraphSha256(revised)).not.toBe(
-      computeHistoricalSourceGraphSha256(graph),
-    );
-  });
-
   it("keeps an unreadable symlink target unknown and out of root identity", () => {
     const base = graphInput();
     base.inventory_state = "partial";

src/domain/referenceSourceGraph.ts

@@ -111,10 +111,6 @@ const sourceEntrySchema = z.union([
   sourceFileSchema,
   sourceDirectorySchema,
   sourceSymlinkSchema,
-  z.strictObject({
-    ...entryBaseShape,
-    kind: z.literal("unknown"),
-  }),
 ]);
 
 const sourceRelationshipSchema = z.strictObject({
@@ -365,8 +361,7 @@ const checkCompleteInventory = (
       entry.limitations.length > 0 ||
       (entry.kind === "file" && entry.content_state !== "hashed") ||
       (entry.kind === "directory" && entry.tree_state !== "enumerated") ||
-      (entry.kind === "symlink" && entry.target_state !== "internal") ||
-      entry.kind === "unknown",
+      (entry.kind === "symlink" && entry.target_state !== "internal"),
   );
   const partialRelationship = graph.relationships.some(
     ({ parse_state, resolution }) =>
@@ -483,11 +478,6 @@ const rootCommitment = (
           target: entry.target,
           target_state: entry.target_state,
         };
-      case "unknown":
-        return {
-          kind: entry.kind,
-          path: entry.path,
-        };
     }
   }),
   exclusions,

src/domain/referenceSourceSummary.test.ts

@@ -81,26 +81,6 @@ describe("committed historical-source summaries", () => {
     expect(graph).toEqual(original);
   });
 
-  it("counts entries of unknown kind separately from symlinks", () => {
-    const graph = createHistoricalSourceGraph(
-      input([
-        {
-          path: "deep",
-          kind: "unknown",
-          classifications: ["unknown"],
-          limitations: ["lstat: ENAMETOOLONG"],
-        },
-      ]),
-    );
-    expect(createHistoricalSourceSummary(graph, 1).counts).toMatchObject({
-      entries: 1,
-      files: 0,
-      directories: 0,
-      symlinks: 0,
-      unknown: 1,
-    });
-  });
-
   it("sums known bytes losslessly beyond the JSON safe integer range", () => {
     const graph = createHistoricalSourceGraph(
       input(

src/domain/referenceSourceSummary.ts

@@ -29,7 +29,6 @@ export const createHistoricalSourceSummary = (
     files: 0,
     directories: 0,
     symlinks: 0,
-    unknown: 0,
     relationships: graph.relationships.length,
     parse_failures: graph.parse_failures.length,
     exclusions: graph.exclusions.length,
@@ -60,8 +59,7 @@ export const createHistoricalSourceSummary = (
     } else if (entry.kind === "directory") {
       counts.directories += 1;
       treeStates[entry.tree_state] += 1;
-    } else if (entry.kind === "symlink") counts.symlinks += 1;
-    else counts.unknown += 1;
+    } else counts.symlinks += 1;
     // Canonical entries already use Unicode code-point order; filtering preserves it.
     if (entry.path.split("/").length <= outlineDepth)
       outline.push(outlineEntry(entry));

src/domain/relationshipCoverage.ts

@@ -1,51 +1,24 @@
 import { z } from "zod";
 
-const diagnostics = z.array(z.string().min(1)).min(1).exactOptional();
-const completeCoverage = z.strictObject({
-  status: z.literal("complete"),
-  diagnostics,
-});
-const limitedDirections = z.union([
-  z.tuple([z.literal("callers")]).check(z.minLength(1), z.maxLength(1)),
-  z.tuple([z.literal("callees")]).check(z.minLength(1), z.maxLength(1)),
-  z
-    .tuple([z.literal("callers"), z.literal("callees")])
-    .check(z.minLength(2), z.maxLength(2)),
-]);
+const diagnostics = z.array(z.string().min(1)).min(1);
+const completeCoverage = z.strictObject({ status: z.literal("complete") });
 const partialCoverage = z.strictObject({
   status: z.literal("partial"),
   limitations: z.array(z.string().min(1)).min(1),
-  limited_directions: limitedDirections.exactOptional(),
-  diagnostics,
 });
 const unknownCoverage = z.strictObject({
   status: z.literal("unknown"),
   reason: z.string().min(1),
-  limited_directions: limitedDirections.exactOptional(),
-  diagnostics,
 });
 
 /** Explicit coverage state for a provider's observed caller/callee set. */
-export const relationshipCoverageSchema = z.discriminatedUnion("status", [
+export const relationshipCoverageSchema = z.union([
   completeCoverage,
+  completeCoverage.extend({ diagnostics }),
   partialCoverage,
+  partialCoverage.extend({ diagnostics }),
   unknownCoverage,
+  unknownCoverage.extend({ diagnostics }),
 ]);
 
 export type RelationshipCoverage = z.infer<typeof relationshipCoverageSchema>;
-
-/** Reasons the observed relationship inventory cannot establish completeness. */
-export const relationshipCoverageLimitations = (
-  coverage: RelationshipCoverage | null | undefined,
-): readonly string[] => {
-  switch (coverage?.status) {
-    case undefined:
-      return ["Provider did not report relationship coverage."];
-    case "complete":
-      return [];
-    case "partial":
-      return coverage.limitations;
-    case "unknown":
-      return [coverage.reason];
-  }
-};

src/generatedPackageMetadata.ts

@@ -5,5 +5,5 @@ export const PACKAGE_METADATA = {
   serverSdkVersion: "2.3.1",
   clientSdkVersion: "2.3.1",
   coreSdkVersion: "2.3.1",
-  skillVersion: "42",
+  skillVersion: "41",
 } as const;

src/ghidra/GhidraAnalysisProfile.ts

@@ -40,8 +40,6 @@ import {
   NATIVE_AOT_PROFILE_CONTRACT_REVISION,
 } from "../domain/native/nativeAotPe.js";
 
-const callRelationshipCoverage = "function-body-call-coverage-v5";
-
 /**
  * The processor language REA pins for this target, or undefined when Ghidra may
  * select from the header. The committed profile and the session readback both
@@ -127,7 +125,7 @@ export const resolveGhidraAnalysisProfile = async (
           load_image_observations: "source-mappings-entry-context-v2",
           function_body_evidence: "complete-inclusive-ranges-v1",
           function_references: "complete-body-and-entry-reference-manager-v2",
-          call_relationship_coverage: callRelationshipCoverage,
+          call_relationship_coverage: "resolved-call-reference-diagnostics-v1",
           function_dossier_coverage:
             "observed-facets-and-call-relationships-v1",
           string_inventory_evidence: "defined-data-coverage-v1",
@@ -218,13 +216,13 @@ export const resolveGhidraAnalysisProfile = async (
         ].sort(),
         import_mode: "ephemeral-source-immutable",
         ...(target.format === "pe"
-          ? { pdb_observations: "program-info-v1" }
+          ? { pdb_observations: "program-info-v4" }
           : {}),
         annotation_policy: "atomic-function-entry-metadata-v1",
         load_image_observations: "source-mappings-entry-context-v2",
         function_body_evidence: "complete-inclusive-ranges-v1",
         function_references: "complete-body-and-entry-reference-manager-v2",
-        call_relationship_coverage: callRelationshipCoverage,
+        call_relationship_coverage: "resolved-call-reference-diagnostics-v1",
         function_dossier_coverage: "observed-facets-and-call-relationships-v1",
         string_inventory_evidence: "defined-data-coverage-v1",
         location_resolution: "explicit-address-exact-entry-symbol-first-v3",

src/ghidra/GhidraFunctionValues.test.ts

@@ -43,120 +43,7 @@ const parseFunctionValueFixture = (
   return parsed.ok ? { ok: true as const, value: parsed.value.value } : parsed;
 };
 
-describe("Ghidra unresolved call locations", () => {
-  it("rejects a noncanonical unresolved call site rather than retaining unverifiable location evidence", () => {
-    expect(
-      parseGhidraFunctionResult("analyze_function", {
-        value: {
-          ...functionDossierSchema.parse(ghidraFunctionDossier()),
-          unresolved_calls: [
-            { address: "not-an-address", reason: "No call destination." },
-          ],
-        },
-        limitations: [],
-        relationship_coverage: {
-          status: "partial",
-          limitations: ["An unresolved call remains."],
-        },
-      }),
-    ).toMatchObject({ ok: false, error: { _tag: "AnalysisOutputError" } });
-  });
-});
-
 describe("Ghidra function-analysis result values", () => {
-  it("retains unavailable pseudocode instead of treating its empty representation as observed source", () => {
-    const availability = {
-      pseudocode: {
-        available: false,
-        reason: "Ghidra does not decompile external functions.",
-      },
-      comments: { available: true },
-    };
-    const parsed = parseGhidraFunctionResult("analyze_function", {
-      value: {
-        ...functionDossierSchema.parse(ghidraFunctionDossier()),
-        pseudocode: "",
-        facet_availability: availability,
-      },
-      limitations: [],
-    });
-    expect(parsed).toMatchObject({
-      ok: true,
-      value: { value: { pseudocode: "", facet_availability: availability } },
-    });
-  });
-  it.each([
-    { status: "complete", diagnostics: ["Resolved static references only."] },
-    {
-      status: "partial",
-      limitations: ["Only the first instruction range was examined."],
-    },
-    { status: "unknown", reason: "Relationship inventory was unavailable." },
-    {
-      status: "partial",
-      limitations: ["Missing callers."],
-      limited_directions: ["callers"],
-    },
-    {
-      status: "unknown",
-      reason: "Missing callees.",
-      limited_directions: ["callees"],
-    },
-  ])("preserves observed $status relationship coverage", (coverage) => {
-    const parsed = parseGhidraFunctionResult("analyze_function", {
-      value: ghidraFunctionDossier(),
-      limitations: [],
-      relationship_coverage: coverage,
-    });
-    expect(parsed).toMatchObject({
-      ok: true,
-      value: { relationshipCoverage: coverage },
-    });
-  });
-
-  it("preserves omitted relationship coverage for legacy observations", () => {
-    const parsed = parseGhidraFunctionResult("analyze_function", {
-      value: ghidraFunctionDossier(),
-      limitations: [],
-    });
-    if (!parsed.ok) throw parsed.error;
-    expect(parsed.value).not.toHaveProperty("relationshipCoverage");
-  });
-});
-
-describe("Ghidra relationship metadata validation", () => {
-  it.each([
-    { status: "partial", limitations: [] },
-    { status: "unknown", reason: "" },
-    { status: "complete", limitations: ["Truncated."] },
-    { status: "partial", limitations: ["Truncated."], limited_directions: [] },
-    {
-      status: "partial",
-      limitations: ["Truncated."],
-      limited_directions: ["callers", "callers"],
-    },
-    { status: "unknown", reason: "Missing.", limited_directions: ["incoming"] },
-    { status: "complete", limited_directions: ["callers"] },
-  ])("rejects malformed relationship coverage %j", (coverage) => {
-    expect(
-      parseGhidraFunctionResult("analyze_function", {
-        value: ghidraFunctionDossier(),
-        limitations: [],
-        relationship_coverage: coverage,
-      }),
-    ).toMatchObject({ ok: false, error: { _tag: "AnalysisOutputError" } });
-  });
-
-  it("rejects relationship metadata on unrelated function operations", () => {
-    expect(
-      parseGhidraFunctionResult("procedure_assembly", {
-        value: "ret",
-        limitations: [],
-        relationship_coverage: { status: "complete" },
-      }),
-    ).toMatchObject({ ok: false, error: { _tag: "AnalysisOutputError" } });
-  });
-
   it("preserves file-offset resolution in Evidence locations and rejects inexact offsets", () => {
     const selection = {
       file_offset: 0x210,

src/ghidra/GhidraFunctionValues.ts

@@ -27,10 +27,6 @@ import {
 import { nativeApiBoundarySchema } from "../domain/native/nativeApiBoundary.js";
 import { nativeValueFlowSchema } from "../domain/native/nativeValueFlow.js";
 import type { EvidenceLocation } from "../domain/evidence.js";
-import {
-  relationshipCoverageSchema,
-  type RelationshipCoverage,
-} from "../domain/relationshipCoverage.js";
 import { err, ok, type Result } from "../domain/result.js";
 import { analysisInputErrorFromIssues } from "../domain/inputIssueProjection.js";
 import {
@@ -311,7 +307,6 @@ const ghidraFunctionDossier = functionDossierSchema
       ...value.comments.map(({ address }) => address),
       ...value.callers.map(({ address }) => address),
       ...value.callees.map(({ address }) => address),
-      ...(value.unresolved_calls ?? []).map(({ address }) => address),
       ...value.incoming_references.flatMap(referenceAddresses),
       ...value.outgoing_references.flatMap(referenceAddresses),
       ...value.referenced_strings.flatMap(({ address, source_address }) => [
@@ -424,7 +419,6 @@ const functionBoundaryObservationOperations: ReadonlySet<GhidraFunctionOperation
 const functionObservationEnvelope = z.strictObject({
   value: z.unknown(),
   limitations: z.array(z.string()),
-  relationship_coverage: relationshipCoverageSchema.exactOptional(),
   selection: z
     .strictObject({
       file_offset: z.number().int().min(0).max(Number.MAX_SAFE_INTEGER),
@@ -438,7 +432,6 @@ export interface ParsedGhidraFunctionResult {
   readonly value: JsonValue;
   readonly limitations: readonly string[];
   readonly locations?: readonly EvidenceLocation[];
-  readonly relationshipCoverage?: RelationshipCoverage;
 }
 
 /** Require exact, bounded Java-bridge function output before creating Evidence. */
@@ -449,7 +442,6 @@ export const parseGhidraFunctionResult = (
   let observation: {
     readonly value: unknown;
     readonly limitations: readonly string[];
-    readonly relationship_coverage?: RelationshipCoverage;
     readonly selection?: z.infer<
       typeof functionObservationEnvelope
     >["selection"];
@@ -458,17 +450,13 @@ export const parseGhidraFunctionResult = (
     const envelope = functionObservationEnvelope.safeParse(value);
     if (
       !envelope.success ||
-      (operation !== "analyze_function" &&
-        operation !== "procedure_callers" &&
-        operation !== "procedure_callees" &&
-        envelope.data.relationship_coverage !== undefined) ||
       (operation !== "procedure_pseudo_code" &&
         envelope.data.selection !== undefined)
     )
       return err(
         new AnalysisOutputError(
           operation,
-          "Ghidra bridge returned an invalid function observation envelope for this operation",
+          "Ghidra bridge omitted the function observation envelope",
           envelope.success ? undefined : { cause: envelope.error },
         ),
       );
@@ -481,9 +469,6 @@ export const parseGhidraFunctionResult = (
     ? ok({
         value: jsonValueSchema.parse(parsed.data),
         limitations: observation.limitations,
-        ...(observation.relationship_coverage === undefined
-          ? {}
-          : { relationshipCoverage: observation.relationship_coverage }),
         ...(observation.selection === undefined
           ? {}
           : {

src/ghidra/GhidraPeProfile.test.ts

@@ -1,95 +1,236 @@
-import { describe, expect, it } from "vitest";
+import { expect, it } from "vitest";
 import type { BinaryTarget } from "../domain/binaryTargetTypes.js";
-import { ghidraPeCodeViewLimitations } from "./GhidraPeProfile.js";
+import { ghidraPePdbLimitations } from "./GhidraPeProfile.js";
+import {
+  ghidraPdbLimitations,
+  type GhidraSessionInfo,
+} from "./GhidraSessionValues.js";
 
-describe("ghidraPeCodeViewLimitations", () => {
-  it("returns empty limitations for non-PE targets", () => {
-    const elfTarget: BinaryTarget = {
-      path: "/test/file",
-      sha256: "abc",
-      kind: "executable",
-      format: "elf",
-      architecture: "x86_64",
-      availableArchitectures: ["x86_64"],
+const target: BinaryTarget = {
+  path: "/fixture/public.exe",
+  sha256: "a".repeat(64),
+  kind: "executable",
+  format: "pe",
+  architecture: "x86_64",
+  availableArchitectures: ["x86_64"],
+  executableRole: "application",
+  managed: false,
+  codeView: {
+    pdbPath: "public.pdb",
+    pdbFileName: "public.pdb",
+    guid: "01234567-89ab-cdef-0123-456789abcdef",
+    age: 10,
+  },
+};
+const absentAttributes = {
+  file: null,
+  guid: null,
+  age: null,
+  signature: null,
+  version: null,
+  loaded: null,
+};
+
+it.each(["file", "guid", "age"] as const)(
+  "retains declared identity when only reported %s is omitted",
+  (attribute) => {
+    const pdb: GhidraSessionInfo["pdb"] = {
+      file: "program.pdb",
+      guid: "reported-guid",
+      age: "a",
+      signature: null,
+      version: "RSDS",
+      loaded: null,
+      resource_limit: { omitted_attributes: [attribute], utf16_budget: 4096 },
+      [attribute]: null,
     };
-    expect(ghidraPeCodeViewLimitations(elfTarget)).toEqual([]);
-  });
+    const caveats = ghidraPePdbLimitations(target, pdb).join(" ");
+    expect(caveats).toContain("omitted");
+    expect(caveats).toContain('PDB "public.pdb"');
+    expect(caveats).toContain("01234567-89ab-cdef-0123-456789abcdef");
+    expect(caveats).toContain("load state unknown");
+  },
+);
 
-  it("does not claim CodeView symbols were unapplied when the session loaded a PDB", () => {
-    const peTarget: BinaryTarget = {
-      path: "/test/file.exe",
-      sha256: "abc",
-      kind: "executable",
-      architecture: "x86_64",
-      availableArchitectures: ["x86_64"],
-      executableRole: "application",
-      managed: false,
-      format: "pe",
+it.each([undefined, absentAttributes])(
+  "retains declared identity and unknown load state when reported attributes are %j",
+  (pdb) => {
+    const caveats = ghidraPePdbLimitations(target, pdb);
+    expect(caveats).toHaveLength(1);
+    expect(caveats[0]).toContain(
+      'PDB "public.pdb" (GUID 01234567-89ab-cdef-0123-456789abcdef, age (decimal) 10)',
+    );
+    expect(caveats[0]).toContain("load state unknown");
+    expect(caveats[0]).not.toContain("were not applied");
+    expect(caveats[0]).not.toContain("names are analysis-generated");
+  },
+);
+
+it.each([true, false, null])(
+  "uses reported PDB observations once with loaded = %s",
+  (loaded) => {
+    const pdb = {
+      file: "public.pdb",
+      guid: "{01234567-89AB-CDEF-0123-456789ABCDEF}",
+      age: "0X000A",
+      signature: null,
+      version: "RSDS",
+      loaded,
+    };
+    const caveats = ghidraPePdbLimitations(target, pdb);
+    expect(caveats).toEqual(ghidraPdbLimitations(pdb));
+    expect(caveats).toHaveLength(1);
+    expect(caveats.join(" ")).not.toContain('PDB "public.pdb"');
+  },
+);
+
+it.each([
+  { file: "different.pdb", guid: "0123456789abcdef0123456789abcdef", age: "a" },
+  { file: "public.pdb", guid: "1123456789abcdef0123456789abcdef", age: "a" },
+  { file: "public.pdb", guid: "0123456789abcdef0123456789abcdef", age: "10" },
+  { file: "public.pdb", guid: "unrecognized-guid", age: "a" },
+  { file: "public.pdb", guid: "0123456789abcdef0123456789abcdef", age: "ten" },
+])("retains non-equivalent declared PDB identity for %j", (identity) => {
+  for (const loaded of [false, null, true]) {
+    const pdb = { ...absentAttributes, ...identity, version: "RSDS", loaded };
+    const caveats = ghidraPePdbLimitations(target, pdb);
+    expect(caveats[0]).toBe(ghidraPdbLimitations(pdb)[0]);
+    expect(caveats[0]).toContain(identity.file);
+    expect(caveats[0]).toContain(identity.guid);
+    expect(caveats[0]).toContain(`age (hex) ${identity.age}`);
+    expect(caveats).toHaveLength(2);
+    expect(caveats[1]).toContain('PDB "public.pdb"');
+    expect(caveats[1]).toContain("01234567-89ab-cdef-0123-456789abcdef");
+    expect(caveats[1]).toContain("age (decimal) 10");
+    expect(caveats[1]).toContain("equivalence is not established");
+    expect(pdb).toMatchObject({ ...identity, loaded });
+  }
+});
+
+it.each([
+  "0123456789ABCDEF0123456789ABCDEF",
+  "01234567-89ab-cdef-0123-456789abcdef",
+])("avoids duplicate identity for normalized matching GUID %s", (guid) => {
+  const pdb = { ...absentAttributes, file: "public.pdb", guid, age: "a" };
+  expect(ghidraPePdbLimitations(target, pdb)).toEqual(
+    ghidraPdbLimitations(pdb),
+  );
+});
+
+it("retains explicit failure to load without asserting all names are generated", () => {
+  const caveats = ghidraPePdbLimitations(target, {
+    ...absentAttributes,
+    loaded: false,
+  });
+  expect(caveats[0]).toContain("reports not loaded");
+  expect(caveats[0]).not.toContain("names are analysis-generated");
+});
+
+it("retains a loaded-state attestation caveat even when reference attributes are absent", () => {
+  const caveats = ghidraPePdbLimitations(target, {
+    ...absentAttributes,
+    loaded: true,
+  });
+  expect(caveats[0]).toEqual(
+    ghidraPdbLimitations({ ...absentAttributes, loaded: true })[0],
+  );
+  expect(caveats).toHaveLength(2);
+  expect(caveats[1]).toContain('PDB "public.pdb"');
+  expect(caveats[0]).toContain("not an independent PDB identity");
+  expect(caveats[0]).not.toContain("reports not loaded");
+});
+
+it("preserves omitted-attribute resource coverage with declared fallback identity", () => {
+  const pdb: GhidraSessionInfo["pdb"] = {
+    ...absentAttributes,
+    resource_limit: { omitted_attributes: ["file"], utf16_budget: 4096 },
+  };
+  const caveats = ghidraPePdbLimitations(target, pdb);
+  expect(caveats).toHaveLength(2);
+  expect(caveats[0]).toContain("omitted");
+  expect(caveats[1]).toContain("public.pdb");
+});
+
+it("reports NB10 declared age without inventing a GUID", () => {
+  const caveats = ghidraPePdbLimitations(
+    {
+      ...target,
       codeView: {
-        pdbPath: "C:\\symbols.pdb",
-        pdbFileName: "symbols.pdb",
-        guid: "12345678-1234-1234-1234-123456789abc",
-        age: 1,
-      },
-    };
-    expect(ghidraPeCodeViewLimitations(peTarget, true)).toEqual([]);
-  });
-
-  it("returns empty limitations for PE target without codeView", () => {
-    const peTarget: BinaryTarget = {
-      path: "/test/file.exe",
-      sha256: "def",
-      kind: "executable",
-      format: "pe",
-      architecture: "x86_64",
-      availableArchitectures: ["x86_64"],
-      executableRole: "application",
-      managed: false,
-    };
-    expect(ghidraPeCodeViewLimitations(peTarget)).toEqual([]);
-  });
-
-  it("returns limitation with GUID and age for RSDS CodeView records", () => {
-    const peTarget: BinaryTarget = {
-      path: "/test/file.exe",
-      sha256: "def",
-      kind: "executable",
-      format: "pe",
-      architecture: "x86_64",
-      availableArchitectures: ["x86_64"],
-      executableRole: "application",
-      managed: false,
-      codeView: {
-        pdbPath: "C:\\build\\app.pdb",
-        pdbFileName: "app.pdb",
-        guid: "01234567-89ab-cdef-0123-456789abcdef",
-        age: 1,
-      },
-    };
-    expect(ghidraPeCodeViewLimitations(peTarget)).toEqual([
-      'The target references debug symbols "app.pdb" (GUID 01234567-89ab-cdef-0123-456789abcdef, age 1) that were not applied; procedure names are analysis-generated.',
-    ]);
-  });
-
-  it("returns limitation without GUID for NB10 CodeView records", () => {
-    const peTarget: BinaryTarget = {
-      path: "/test/file.exe",
-      sha256: "def",
-      kind: "executable",
-      format: "pe",
-      architecture: "x86",
-      availableArchitectures: ["x86"],
-      executableRole: "application",
-      managed: false,
-      codeView: {
-        pdbPath: "D:\\test\\legacy.pdb",
+        pdbPath: "legacy.pdb",
         pdbFileName: "legacy.pdb",
         guid: null,
         age: 2,
       },
-    };
-    expect(ghidraPeCodeViewLimitations(peTarget)).toEqual([
-      'The target references debug symbols "legacy.pdb" (age 2) that were not applied; procedure names are analysis-generated.',
-    ]);
-  });
+    },
+    undefined,
+  );
+  expect(caveats[0]).toContain('PDB "legacy.pdb" (age (decimal) 2)');
+  expect(caveats[0]).not.toContain("GUID");
+});
+
+it("retains missing-report uncertainty without a declared CodeView record", () => {
+  const { codeView: _, ...withoutReference } = target;
+  expect(ghidraPePdbLimitations(withoutReference, undefined)).toEqual(
+    ghidraPdbLimitations(undefined),
+  );
+});
+
+it("adds no PDB warning for a non-PE target", () => {
+  const elf: BinaryTarget = {
+    path: "/fixture/program",
+    sha256: "a".repeat(64),
+    kind: "executable",
+    format: "elf",
+    architecture: "x86_64",
+    availableArchitectures: ["x86_64"],
+  };
+  expect(ghidraPePdbLimitations(elf, undefined)).toEqual([]);
+});
+
+it("bounds an escaped inline locator while preserving its declared source value", () => {
+  const name = '"'.repeat(5000) + ".pdb";
+  const selected = {
+    ...target,
+    codeView: { ...target.codeView!, pdbFileName: name },
+  };
+  const caveats = ghidraPePdbLimitations(selected, undefined).join(" ");
+  expect(Buffer.byteLength(caveats)).toBeLessThan(1024);
+  expect(caveats).toContain("locator omitted");
+  expect(caveats).toContain("01234567-89ab-cdef-0123-456789abcdef");
+  expect(selected.codeView.pdbFileName).toBe(name);
+});
+
+it.each([
+  ["long ASCII", "a".repeat(171)],
+  ["ASCII at the byte budget", "a".repeat(1022)],
+  ["ASCII beyond the byte budget", "a".repeat(1023)],
+  ["quotes at the byte budget", '"'.repeat(511)],
+  ["quotes beyond the byte budget", '"'.repeat(512)],
+  ["short control escapes", "\n".repeat(511)],
+  ["short control escapes beyond the byte budget", "\n".repeat(512)],
+  ["six-byte control escapes", "\u0001".repeat(170)],
+  ["six-byte control escapes beyond the byte budget", "\u0001".repeat(171)],
+  ["UTF-8 BMP text", "中".repeat(340)],
+  ["UTF-8 BMP text beyond the byte budget", "中".repeat(341)],
+  ["surrogate pairs", "😀".repeat(255)],
+  ["surrogate pairs beyond the byte budget", "😀".repeat(256)],
+  ["unpaired high surrogates", "\ud800".repeat(170)],
+  ["unpaired high surrogates beyond the byte budget", "\ud800".repeat(171)],
+  ["unpaired low surrogates", "\udfff".repeat(170)],
+  ["unpaired low surrogates beyond the byte budget", "\udfff".repeat(171)],
+])("uses actual JSON UTF-8 size for %s", (_, name) => {
+  const selected = {
+    ...target,
+    codeView: { ...target.codeView!, pdbFileName: name },
+  };
+  const caveat = ghidraPePdbLimitations(selected, undefined).join(" ");
+  const encoded = JSON.stringify(name);
+  if (Buffer.byteLength(encoded) <= 1024) {
+    expect(caveat).toContain(`PDB ${encoded} (`);
+    expect(caveat).not.toContain("locator omitted");
+  } else {
+    expect(caveat).toContain("locator omitted");
+    expect(caveat).not.toContain(encoded);
+  }
+  expect(selected.codeView.pdbFileName).toBe(name);
 });

src/ghidra/GhidraPeProfile.ts

@@ -1,24 +1,109 @@
-import type { BinaryTarget } from "../domain/binaryTargetTypes.js";
+import type {
+  BinaryTarget,
+  PeCodeViewRecord,
+} from "../domain/binaryTargetTypes.js";
+import {
+  ghidraPdbLimitations,
+  type GhidraSessionInfo,
+} from "./GhidraSessionValues.js";
 
-/**
- * Report unapplied PE companion PDB symbols when CodeView debug information is present.
- *
- * Ghidra does not automatically locate or apply sidecar PDBs in REA's isolated
- * runtime directories without companion admission. When the PE target header
- * references debug symbols, surface this limitation so callers understand that
- * procedure names remain analysis-generated.
- */
-export const ghidraPeCodeViewLimitations = (
+const PDB_LOCATOR_INLINE_BYTE_BUDGET = 1024;
+
+/** Establish equivalence only for the declared fields and recognized formats. */
+const reportedPdbMatchesDeclaration = (
+  declared: PeCodeViewRecord,
+  reported: NonNullable<GhidraSessionInfo["pdb"]>,
+): boolean => {
+  if (
+    (reported.file !== declared.pdbPath &&
+      reported.file !== declared.pdbFileName) ||
+    reported.age === null ||
+    !/^(?:0x)?[0-9a-f]+$/iu.test(reported.age) ||
+    Number.parseInt(reported.age, 16) !== declared.age
+  )
+    return false;
+  if (declared.guid === null) return reported.guid === null;
+  if (reported.guid === null) return false;
+  let guid = reported.guid;
+  if (guid.startsWith("{") && guid.endsWith("}")) guid = guid.slice(1, -1);
+  if (
+    !/^(?:[0-9a-f]{32}|[0-9a-f]{8}(?:-[0-9a-f]{4}){3}-[0-9a-f]{12})$/iu.test(
+      guid,
+    )
+  )
+    return false;
+  return (
+    guid.replaceAll("-", "").toLowerCase() ===
+    declared.guid.replaceAll("-", "").toLowerCase()
+  );
+};
+
+/** Measure JSON quotes, escapes and UTF-8 without allocating the encoded string. */
+const pdbLocatorFitsInlineBudget = (value: string): boolean => {
+  if (value.length * 6 + 2 <= PDB_LOCATOR_INLINE_BYTE_BUDGET) return true;
+  if (value.length + 2 > PDB_LOCATOR_INLINE_BYTE_BUDGET) return false;
+  let bytes = 2;
+  for (let index = 0; index < value.length; index += 1) {
+    const point = value.codePointAt(index) ?? 0;
+    if (point > 0xffff) {
+      bytes += 4;
+      index += 1;
+    } else if (point >= 0xd800 && point <= 0xdfff) {
+      // JSON.stringify escapes unpaired UTF-16 surrogates as six ASCII bytes.
+      bytes += 6;
+    } else if (point < 0x20) {
+      bytes +=
+        point === 8 ||
+        point === 9 ||
+        point === 10 ||
+        point === 12 ||
+        point === 13
+          ? 2
+          : 6;
+    } else if (point === 0x22 || point === 0x5c) {
+      bytes += 2;
+    } else {
+      bytes += point < 0x80 ? 1 : point < 0x800 ? 2 : 3;
+    }
+    if (bytes > PDB_LOCATOR_INLINE_BYTE_BUDGET) return false;
+  }
+  return true;
+};
+
+/** Use reported Program facts first, retaining declared PE facts as a fallback. */
+export const ghidraPePdbLimitations = (
   target: BinaryTarget,
-  pdbLoaded = false,
+  pdb: GhidraSessionInfo["pdb"],
 ): readonly string[] => {
-  if (target.format !== "pe" || target.codeView === undefined || pdbLoaded) {
-    return [];
-  }
+  if (target.format !== "pe") return [];
+  const reported = ghidraPdbLimitations(pdb);
+  if (
+    target.codeView === undefined ||
+    (pdb !== undefined && reportedPdbMatchesDeclaration(target.codeView, pdb))
+  )
+    return reported;
   const { pdbFileName, guid, age } = target.codeView;
-  return [
-    guid !== null
-      ? `The target references debug symbols "${pdbFileName}" (GUID ${guid}, age ${age}) that were not applied; procedure names are analysis-generated.`
-      : `The target references debug symbols "${pdbFileName}" (age ${age}) that were not applied; procedure names are analysis-generated.`,
-  ];
+  // Include JSON escaping in the inline budget before allocating that representation.
+  const locator = pdbLocatorFitsInlineBudget(pdbFileName)
+    ? JSON.stringify(pdbFileName)
+    : `(declared locator omitted from this inline caveat: ${PDB_LOCATOR_INLINE_BYTE_BUDGET}-byte resource budget)`;
+  const identity =
+    guid === null
+      ? `age (decimal) ${age}`
+      : `GUID ${guid}, age (decimal) ${age}`;
+  const state =
+    pdb === undefined
+      ? "Ghidra did not report PDB attributes; load state unknown"
+      : pdb.loaded === false
+        ? "Ghidra reports not loaded"
+        : pdb.loaded === true
+          ? "Ghidra reports a loaded PDB; this declared identity is not an independent matching-PDB attestation"
+          : "Ghidra reports load state unknown";
+  const comparison =
+    pdb !== undefined &&
+    [pdb.file, pdb.guid, pdb.age].some((value) => value !== null)
+      ? " Reported and declared PDB observations are retained separately; equivalence is not established."
+      : "";
+  const declared = `The PE CodeView record references PDB ${locator} (${identity}); ${state}.${comparison} Original PDB names and types may be missing. Use list_procedures and address-based analysis to inspect recovered functions. REA does not admit a caller-selected PDB companion.`;
+  return pdb === undefined ? [declared] : [...reported, declared];
 };

src/ghidra/GhidraProvider.behavior.test.ts

@@ -35,6 +35,11 @@ import { WINDOWS_NATIVE_AUTHORITY_UNAVAILABLE_REASON } from "../process/WindowsA
 import { ProviderCleanupError } from "../domain/providerCleanupError.js";
 import { projectAnalysisError } from "../domain/analysisErrorProjection.js";
 import { ProviderStartupDeadline } from "../process/ProviderDeadline.js";
+import { createAnalysisProfile } from "../domain/analysisProfile.js";
+import { createAnalysisExecution } from "../application/AnalysisProvider.js";
+import { AnalysisSnapshotCache } from "../application/binary/AnalysisSnapshotCache.js";
+import { createEvidence } from "../domain/evidence.js";
+import { createEvidenceBundle } from "../domain/evidenceBundle.js";
 
 const INSTALL = "/opt/ghidra_12.1.4_PUBLIC";
 const installationHost = (
@@ -80,6 +85,60 @@ const createElfClient = async (ghidra: GhidraProvider) => {
   return ghidra.createClient(target, resolved.value.profile);
 };
 
+it.each(["program-info-v1", "program-info-v2", "program-info-v3"])(
+  "retains historical PE PDB Evidence for %s without replaying its old projection",
+  async (pdbObservations) => {
+    const target = peTarget("x86_64");
+    const resolved = await provider().resolveAnalysisProfile(target);
+    if (!resolved.ok || resolved.value.profile === null)
+      throw new Error("Expected admitted PE profile");
+    const current = resolved.value.profile;
+    const prior = createAnalysisProfile(current.provider, {
+      ...current.parameters,
+      pdb_observations: pdbObservations,
+    });
+    const operation = "search_procedures";
+    const parameters = { pattern: "wmain" };
+    const limitations = ["Legacy projection collapsed unknown PDB load state."];
+    const cache = new AnalysisSnapshotCache();
+    cache.record({
+      target,
+      profile: prior,
+      operation,
+      parameters,
+      execution: createAnalysisExecution([], prior.provider, {
+        subject: target,
+        analysisProfile: prior,
+        limitations,
+      }),
+    });
+    const evidence = createEvidence(target, prior.provider, {
+      operation,
+      parameters,
+      result: [],
+      analysisProfile: prior,
+      limitations,
+    });
+    const exported = cache.export(
+      target,
+      prior,
+      createEvidenceBundle([evidence]),
+    );
+    if (!exported.ok) throw exported.error;
+    const imported = new AnalysisSnapshotCache();
+    expect(imported.import(exported.value, undefined, () => ok(0)).ok).toBe(
+      true,
+    );
+    expect(
+      imported.lookup(target, current, operation, parameters),
+    ).toBeUndefined();
+    expect(
+      imported.lookup(target, prior, operation, parameters)?.limitations,
+    ).toEqual(expect.arrayContaining(limitations));
+    expect(exported.value.evidence_bundle.records).toContainEqual(evidence);
+  },
+);
+
 describe("Ghidra provider", () => {
   it("commits DOS loader and real-mode language while retaining the CPU family", async () => {
     const ghidra = provider();
@@ -633,7 +692,7 @@ describe("Ghidra client projection", () => {
     expect(resolved.value.profile.parameters).toMatchObject({
       language_id: "auto-from-header",
       compiler_spec_id: "auto-default",
-      call_relationship_coverage: "function-body-call-coverage-v5",
+      call_relationship_coverage: "resolved-call-reference-diagnostics-v1",
       function_dossier_coverage: "observed-facets-and-call-relationships-v1",
     });
 
@@ -830,36 +889,60 @@ describe("Ghidra result projection", () => {
 });
 
 describe("Ghidra PE CodeView debug symbol limitations", () => {
-  it("projects unapplied companion PDB limitation for PE target with CodeView record", async () => {
-    const ghidra = provider(installationHost(), () => ({
-      start: () => Promise.resolve(ok(sessionInfo())),
-      callTool: () => Promise.resolve(ok(null)),
-      close: () => Promise.resolve(ok(null)),
-    }));
-    const target = {
-      ...peTarget("x86_64"),
-      codeView: {
-        pdbPath: "C:\\projects\\app\\build\\test.pdb",
-        pdbFileName: "test.pdb",
-        guid: "01234567-89ab-cdef-0123-456789abcdef",
-        age: 1,
-      },
-    };
-    const profile = await ghidra.resolveAnalysisProfile(target);
-    if (!profile.ok || profile.value.profile === null)
-      throw new Error("expected PE profile");
-    const client = ghidra.createClient(target, profile.value.profile);
-    const health = await client.execute("health", {});
-    expect(health).toMatchObject({
-      ok: true,
-      value: {
-        limitations: expect.arrayContaining([
-          'The target references debug symbols "test.pdb" (GUID 01234567-89ab-cdef-0123-456789abcdef, age 1) that were not applied; procedure names are analysis-generated.',
-        ]),
-      },
-    });
-    await client.close();
-  });
+  it.each([
+    ["absent report", undefined, "load state unknown"],
+    ["unknown load", null, "load state unknown"],
+    ["not loaded", false, "reports not loaded"],
+    ["loaded", true, "reports a loaded PDB"],
+  ] as const)(
+    "preserves %s with one PDB caveat for a declared CodeView record",
+    async (_, loaded, expected) => {
+      const ghidra = provider(installationHost(), () => ({
+        start: () =>
+          Promise.resolve(
+            ok({
+              ...sessionInfo(),
+              ...(loaded === undefined
+                ? {}
+                : {
+                    pdb: {
+                      file: "test.pdb",
+                      guid: "01234567-89ab-cdef-0123-456789abcdef",
+                      age: "1",
+                      signature: null,
+                      version: "RSDS",
+                      loaded,
+                    },
+                  }),
+            }),
+          ),
+        callTool: () => Promise.resolve(ok(null)),
+        close: () => Promise.resolve(ok(null)),
+      }));
+      const target = {
+        ...peTarget("x86_64"),
+        codeView: {
+          pdbPath: "C:\\projects\\app\\build\\test.pdb",
+          pdbFileName: "test.pdb",
+          guid: "01234567-89ab-cdef-0123-456789abcdef",
+          age: 1,
+        },
+      };
+      const profile = await ghidra.resolveAnalysisProfile(target);
+      if (!profile.ok || profile.value.profile === null)
+        throw new Error("expected PE profile");
+      const client = ghidra.createClient(target, profile.value.profile);
+      const health = await client.execute("health", {});
+      if (!health.ok) throw health.error;
+      const pdbCaveats = health.value.limitations.filter((limit) =>
+        limit.includes("PDB"),
+      );
+      expect(pdbCaveats).toHaveLength(1);
+      expect(pdbCaveats[0]).toContain(expected);
+      expect(pdbCaveats[0]).not.toContain("names are analysis-generated");
+      await client.close();
+    },
+  );
 });
 
 describe("Ghidra relationship coverage", () => {
@@ -870,16 +953,7 @@ describe("Ghidra relationship coverage", () => {
         Promise.resolve(
           ok(
             operation === "procedure_callees"
-              ? {
-                  value: ["0x2000"],
-                  limitations: [],
-                  relationship_coverage: {
-                    status: "complete",
-                    diagnostics: [
-                      "Only resolved Ghidra call references are returned; unresolved computed or indirect calls remain unknown, while function classifications distinguish thunks and externals.",
-                    ],
-                  },
-                }
+              ? { value: ["0x2000"], limitations: [] }
               : { value: [], limitations: [] },
           ),
         ),

src/ghidra/GhidraProviderCapabilities.ts

@@ -2,6 +2,7 @@ import type {
   CapabilityDescriptor,
   ProviderIdentity,
 } from "../application/AnalysisProvider.js";
+import type { RelationshipCoverage } from "../domain/relationshipCoverage.js";
 import {
   hasWindowsNativeAuthority,
   windowsNativeAuthorityUnavailableReason,
@@ -43,6 +44,22 @@ const stringInventoryLimitation =
 const searchLimitation =
   "Regex mode uses Java Pattern semantics. Matcher or compiler stack exhaustion returns a resource constraint without closing the session; literal mode avoids regex recursion and returns complete matching values.";
 
+const resolvedCallReferenceLimitation =
+  "Only resolved Ghidra call references are returned; unresolved computed or indirect calls remain unknown, while function classifications distinguish thunks and externals.";
+
+/** Relationship-only caveats belong to each observed caller/callee result. */
+export const relationshipCoverageFor = (
+  operation: string,
+): RelationshipCoverage | undefined =>
+  operation === "procedure_callers" ||
+  operation === "procedure_callees" ||
+  operation === "analyze_function"
+    ? {
+        status: "complete",
+        diagnostics: [resolvedCallReferenceLimitation],
+      }
+    : undefined;
+
 /** Limitation text for one admitted operation, including the common base. */
 export const limitationsFor = (operation: string): readonly string[] => {
   const common = [

src/ghidra/GhidraProviderClient.ts

@@ -34,7 +34,6 @@ import {
 } from "../domain/analysisErrorCore.js";
 import type { AnalysisError } from "../domain/analysisErrorBase.js";
 import type { EvidenceLocation } from "../domain/evidence.js";
-import type { RelationshipCoverage } from "../domain/relationshipCoverage.js";
 import { jsonValueSchema, type JsonValue } from "../domain/jsonValue.js";
 import { ProviderAdapterError } from "../domain/providerAdapterError.js";
 import { err, ok, type Result } from "../domain/result.js";
@@ -69,7 +68,7 @@ import {
   isGhidraMipsSoftFloatTarget,
 } from "./GhidraMipsProfile.js";
 import { ghidraRiscvLimitations } from "./GhidraRiscvProfile.js";
-import { ghidraPeCodeViewLimitations } from "./GhidraPeProfile.js";
+import { ghidraPePdbLimitations } from "./GhidraPeProfile.js";
 import { unverifiedGhidraBuildLimitation } from "./GhidraInstallationPolicy.js";
 import { GhidraHeadlessLauncher } from "./GhidraLauncher.js";
 import { attestGhidraNativeLoadImage } from "./GhidraLoadImageAttest.js";
@@ -87,12 +86,10 @@ import {
   healthLimitations,
   windowsP0Limitations,
   limitationsFor,
+  relationshipCoverageFor,
 } from "./GhidraProviderCapabilities.js";
 import type { GhidraSessionError } from "./GhidraSessionError.js";
-import {
-  ghidraPdbLimitations,
-  type GhidraSessionInfo,
-} from "./GhidraSessionValues.js";
+import type { GhidraSessionInfo } from "./GhidraSessionValues.js";
 import { ghidraExtensionFailure } from "./extensions/GhidraExtensionFailures.js";
 import {
   ghidraExtensionSchema,
@@ -531,7 +528,6 @@ export const createGhidraProviderClient = (input: {
   // Replaced by the reported outcome once the session handshake is checked.
   const seedLimitations: string[] = [...ghidraSeedLimitations(seeds)];
   const pdbLimitations: string[] = [];
-  let pdbLoaded = false;
   // Replaced by the reported storage outcome once the handshake is checked.
   const softFloatLimitations: string[] = [
     ...ghidraMipsSoftFloatLimitations(softFloat),
@@ -657,11 +653,10 @@ export const createGhidraProviderClient = (input: {
     info: GhidraSessionInfo,
   ): Promise<AnalysisError | undefined> => {
     if (target.format === "pe") {
-      pdbLoaded = info.pdb?.loaded === true;
       pdbLimitations.splice(
         0,
         pdbLimitations.length,
-        ...ghidraPdbLimitations(info.pdb),
+        ...ghidraPePdbLimitations(target, info.pdb),
       );
     }
     const softFloatReason = ghidraMipsSoftFloatFailure(
@@ -716,7 +711,6 @@ export const createGhidraProviderClient = (input: {
     ...ghidraExtensionLimitations(extensions),
     ...seedLimitations,
     ...pdbLimitations,
-    ...ghidraPeCodeViewLimitations(target, pdbLoaded),
     ...(releaseLimitation === undefined ? [] : [releaseLimitation]),
   ];
   const nativeAotOwner =
@@ -733,8 +727,8 @@ export const createGhidraProviderClient = (input: {
     rawResult: JsonValue,
     observationLimitations: readonly string[] = [],
     locations: readonly EvidenceLocation[] = [],
-    relationshipCoverage?: RelationshipCoverage,
   ) => {
+    const relationshipCoverage = relationshipCoverageFor(operation);
     return createAnalysisExecution(normalized, committedProfile.provider, {
       rawResult,
       locations,
@@ -838,14 +832,12 @@ export const createGhidraProviderClient = (input: {
       let normalized: JsonValue;
       let observationLimitations: readonly string[] = [];
       let observationLocations: readonly EvidenceLocation[] = [];
-      let relationshipCoverage: RelationshipCoverage | undefined;
       if (isGhidraFunctionOperation(operation)) {
         const result = parseGhidraFunctionResult(operation, called.value);
         if (!result.ok) return result;
         normalized = result.value.value;
         observationLimitations = result.value.limitations;
         observationLocations = result.value.locations ?? [];
-        relationshipCoverage = result.value.relationshipCoverage;
       } else {
         const result = parseGhidraInventoryResult(operation, called.value);
         if (!result.ok) return result;
@@ -941,7 +933,6 @@ export const createGhidraProviderClient = (input: {
           called.value,
           observationLimitations,
           observationLocations,
-          relationshipCoverage,
         ),
       );
     },

src/ghidra/GhidraSessionValues.ts

@@ -121,21 +121,26 @@ export const ghidraPdbLimitations = (
     limitations.push(
       `PDB attributes ${pdb.resource_limit.omitted_attributes.join(", ")} were omitted because the handshake's ${pdb.resource_limit.utf16_budget}-UTF-16-unit PDB attribute budget was exhausted. Omitted values remain unknown; they were not truncated or reported as absent.`,
     );
+  const hasReference = [
+    pdb.file,
+    pdb.guid,
+    pdb.age,
+    pdb.signature,
+    pdb.version,
+  ].some((value) => value !== null);
+  const reference = hasReference
+    ? `The Ghidra Program references PDB ${pdb.file ?? "(file unknown)"} (GUID ${pdb.guid ?? "unknown"}, age (hex) ${pdb.age ?? "unknown"}, signature ${pdb.signature ?? "unknown"}, version ${pdb.version ?? "unknown"}); `
+    : "";
   if (pdb.loaded === true)
     return [
       ...limitations,
-      "Ghidra reports a loaded PDB; this is not an independent PDB identity or complete symbol/type-coverage attestation. Original names and types may still be missing; an empty name search does not prove a procedure is absent. Use list_procedures and address-based analysis to inspect recovered functions.",
+      `${reference}Ghidra reports a loaded PDB; this is not an independent PDB identity or complete symbol/type-coverage attestation. Original names and types may still be missing; an empty name search does not prove a procedure is absent. Use list_procedures and address-based analysis to inspect recovered functions.`,
     ];
-  if (
-    [pdb.file, pdb.guid, pdb.age, pdb.signature, pdb.version].every(
-      (value) => value === null,
-    )
-  )
-    return limitations;
+  if (!hasReference) return limitations;
   const state = pdb.loaded === false ? "not loaded" : "load state unknown";
   return [
     ...limitations,
-    `The target references PDB ${pdb.file ?? "(file unknown)"} (GUID ${pdb.guid ?? "unknown"}, age (hex) ${pdb.age ?? "unknown"}, signature ${pdb.signature ?? "unknown"}, version ${pdb.version ?? "unknown"}); Ghidra reports ${state}. Original names and types may be missing; an empty name search does not prove a procedure is absent. Use list_procedures and address-based analysis to inspect recovered functions. REA does not admit a caller-selected PDB companion.`,
+    `${reference}Ghidra reports ${state}. Original names and types may be missing; an empty name search does not prove a procedure is absent. Use list_procedures and address-based analysis to inspect recovered functions. REA does not admit a caller-selected PDB companion.`,
   ];
 };
 

src/ghidra/GhidraSnapshotCache.test.ts

@@ -11,7 +11,6 @@ import { silentLogger } from "../logger.js";
 import { GhidraProvider } from "./GhidraProvider.js";
 import { GhidraSessionError } from "./GhidraSessionError.js";
 import { GHIDRA_SESSION_CAPABILITIES } from "./GhidraSessionValues.js";
-import type { RelationshipCoverage } from "../domain/relationshipCoverage.js";
 
 const TARGET: BinaryTarget = {
   path: "/tmp/ghidra-cache-fixture",
@@ -24,7 +23,7 @@ const TARGET: BinaryTarget = {
 
 // Exercise the real provider descriptors, profile, input/output projection and
 // session cache; only the installed Ghidra process is replaced at its seam.
-const fixture = (version = "12.1.4", coverage?: RelationshipCoverage) => {
+const fixture = (version = "12.1.4") => {
   const config = parseConfig({ GHIDRA_INSTALL_DIR: "/opt/ghidra" });
   if (!config.ok) throw config.error;
   const calls: string[] = [];
@@ -114,13 +113,7 @@ const fixture = (version = "12.1.4", coverage?: RelationshipCoverage) => {
         return ok(
           operation === "procedure_pseudo_code" ||
             operation === "analyze_function"
-            ? {
-                value,
-                limitations: [],
-                ...(operation === "analyze_function" && coverage !== undefined
-                  ? { relationship_coverage: coverage }
-                  : {}),
-              }
+            ? { value, limitations: [] }
             : value,
         );
       },
@@ -140,119 +133,42 @@ const open = async (session: ReturnType<typeof fixture>["session"]) => {
   expect((await session.openResolvedTarget(preview.value)).ok).toBe(true);
 };
 
-describe("Ghidra relationship coverage replay", () => {
-  it.each([
-    undefined,
-    { status: "complete", diagnostics: ["Resolved static references only."] },
-    { status: "partial", limitations: ["Instruction coverage was truncated."] },
-    { status: "unknown", reason: "Relationship inventory was unavailable." },
-    {
-      status: "partial",
-      limitations: ["Missing callers."],
-      limited_directions: ["callers"],
-    },
-  ] satisfies (RelationshipCoverage | undefined)[])(
-    "preserves relationship coverage %j through live execution, cache and snapshot replay",
-    async (coverage) => {
-      const initial = fixture("12.1.4", coverage);
-      await open(initial.session);
-      const parameters = { procedure: "0x1000" };
-      for (let i = 0; i < 2; i++) {
-        const execution = await initial.session.execute(
-          "analyze_function",
-          parameters,
-        );
-        if (!execution.ok) throw execution.error;
-        expect(execution.value.relationshipCoverage).toEqual(coverage);
-      }
-      expect(initial.calls).toEqual(["analyze_function"]);
-      const snapshot = initial.session.exportAnalysisSnapshot();
-      if (!snapshot.ok) throw snapshot.error;
-      await initial.session.close();
-      const replay = fixture();
-      expect(replay.session.importAnalysisSnapshot(snapshot.value).ok).toBe(
-        true,
-      );
-      await open(replay.session);
-      const execution = await replay.session.execute(
-        "analyze_function",
-        parameters,
-      );
-      if (!execution.ok) throw execution.error;
-      expect(execution.value.relationshipCoverage ?? undefined).toEqual(
-        coverage,
-      );
-      expect(replay.calls).toEqual([]);
-      await replay.session.close();
-    },
-  );
-});
-
-describe("Ghidra snapshot profile admission", () => {
-  it.each([
-    {
-      parameter: "instruction_references",
-      current: "exact-address-incoming-v1",
-      legacy: undefined,
-    },
-    {
-      parameter: "call_relationship_coverage",
-      current: "function-body-call-coverage-v5",
-      legacy: "resolved-call-reference-diagnostics-v1",
-    },
-    {
-      parameter: "call_relationship_coverage",
-      current: "function-body-call-coverage-v5",
-      legacy: "decoded-call-target-coverage-v2",
-    },
-    {
-      parameter: "call_relationship_coverage",
-      current: "function-body-call-coverage-v5",
-      legacy: "decoded-call-target-coverage-v3",
-    },
-    {
-      parameter: "call_relationship_coverage",
-      current: "function-body-call-coverage-v5",
-      legacy: "function-body-call-coverage-v4",
-    },
-  ])(
-    "refuses snapshots with outdated $parameter semantics",
-    async ({ parameter, current, legacy: prior }) => {
-      const initial = fixture();
-      await open(initial.session);
-      const snapshot = initial.session.exportAnalysisSnapshot();
-      if (!snapshot.ok) throw snapshot.error;
-      await initial.session.close();
-      const profile = snapshot.value.binding.analysis_profile;
-      expect(profile.parameters[parameter]).toBe(current);
-      const legacy = {
-        ...snapshot.value,
-        binding: {
-          ...snapshot.value.binding,
-          analysis_profile: createAnalysisProfile(profile.provider, {
-            ...Object.fromEntries(
-              Object.entries(profile.parameters).filter(
-                ([key]) => key !== parameter,
-              ),
-            ),
-            ...(prior === undefined ? {} : { [parameter]: prior }),
-          }),
-        },
-      };
-      const replay = fixture();
-      const imported = replay.session.importAnalysisSnapshot(legacy);
-      if (!imported.ok) throw imported.error;
-      expect(await replay.session.previewTarget(TARGET)).toMatchObject({
-        ok: false,
-        error: { _tag: "EvidenceIntegrityError" },
-      });
-      expect(replay.calls).toEqual([]);
-      await replay.session.close();
-    },
-  );
-});
-
 describe("Ghidra snapshot cache", () => {
+  it("refuses snapshots whose profile predates typed incoming references", async () => {
+    const initial = fixture();
+    await open(initial.session);
+    const snapshot = initial.session.exportAnalysisSnapshot();
+    if (!snapshot.ok) throw snapshot.error;
+    await initial.session.close();
+    const profile = snapshot.value.binding.analysis_profile;
+    expect(profile.parameters.instruction_references).toBe(
+      "exact-address-incoming-v1",
+    );
+    const legacy = {
+      ...snapshot.value,
+      binding: {
+        ...snapshot.value.binding,
+        analysis_profile: createAnalysisProfile(
+          profile.provider,
+          Object.fromEntries(
+            Object.entries(profile.parameters).filter(
+              ([key]) => key !== "instruction_references",
+            ),
+          ),
+        ),
+      },
+    };
+    const replay = fixture();
+    const imported = replay.session.importAnalysisSnapshot(legacy);
+    if (!imported.ok) throw imported.error;
+    expect(await replay.session.previewTarget(TARGET)).toMatchObject({
+      ok: false,
+      error: { _tag: "EvidenceIntegrityError" },
+    });
+    expect(replay.calls).toEqual([]);
+    await replay.session.close();
+  });
+
   it.each([
     { operation: "analyze_function", parameters: { procedure: "0x1000" } },
     {

src/reference/ReferenceSourceReaderEntries.ts

@@ -25,7 +25,7 @@ import {
 import type {
   PendingDirectory,
   ReferenceSourceEntry,
-  ReferenceSourceExclusionKind,
+  ReferenceSourceEntryKind,
   ReferenceSourceResult,
   TraversalState,
 } from "./ReferenceSourceReaderTypes.js";
@@ -201,13 +201,6 @@ const processEntry = async (
   const metadata = await readMetadata(absolute);
   if (isAborted(state.signal)) return { ok: false, error: cancelled() };
   if (!metadata.ok) {
-    const excluded = applyExclusion(state.shouldExclude, path, "unknown");
-    if (!excluded.ok)
-      return {
-        ok: false,
-        error: failure("io", "Reference source exclusion check failed"),
-      };
-    if (excluded.value) return { ok: true, value: undefined };
     state.entries.push(entryFailure(path, "unknown", "io", metadata.message));
     return { ok: true, value: undefined };
   }
@@ -378,10 +371,10 @@ const readSymlinkTarget = async (
 
 const applyExclusion = (
   shouldExclude:
-    | ((path: string, kind: ReferenceSourceExclusionKind) => boolean)
+    | ((path: string, kind: ReferenceSourceEntryKind) => boolean)
     | undefined,
   path: string,
-  kind: ReferenceSourceExclusionKind,
+  kind: ReferenceSourceEntryKind,
 ): { readonly ok: true; readonly value: boolean } | { readonly ok: false } => {
   try {
     return { ok: true, value: shouldExclude?.(path, kind) === true };

src/reference/ReferenceSourceReaderErrors.ts

@@ -29,9 +29,6 @@ const FILESYSTEM_ERROR_CODES = new Set([
   "EISDIR",
   "ELOOP",
   "EMFILE",
-  // A traversed child can exceed the platform's absolute path limit even
-  // though the selected root and every component are valid.
-  "ENAMETOOLONG",
   "ENFILE",
   "ENOENT",
   "ENOTDIR",
@@ -47,8 +44,6 @@ export const filesystemFailureDetail = (
 ): string | undefined => {
   if (!(cause instanceof Error)) return undefined;
   const code: unknown = Reflect.get(cause, "code");
-  if (code === "ENAMETOOLONG")
-    return `${operation}: ENAMETOOLONG (entry path exceeds the operating system path limit)`;
   return typeof code === "string" && FILESYSTEM_ERROR_CODES.has(code)
     ? `${operation}: ${cause.message}`
     : undefined;

src/reference/ReferenceSourceReaderTypes.ts

@@ -10,17 +10,11 @@ export type ReferenceSourceEntryKind =
   | "symlink"
   | "other";
 
-/**
- * Kind offered to exclusion predicates. `unknown` marks an entry whose
- * metadata could not be read, so its concrete kind cannot be claimed.
- */
-export type ReferenceSourceExclusionKind = ReferenceSourceEntryKind | "unknown";
-
 export interface ReferenceSourceReaderOptions {
   readonly signal?: AbortSignal;
   readonly shouldExclude?: (
     path: string,
-    kind: ReferenceSourceExclusionKind,
+    kind: ReferenceSourceEntryKind,
   ) => boolean;
 }
 
@@ -90,7 +84,7 @@ export type TraversalState = {
   readonly signal?: AbortSignal;
   readonly shouldExclude?: (
     path: string,
-    kind: ReferenceSourceExclusionKind,
+    kind: ReferenceSourceEntryKind,
   ) => boolean;
   readonly entries: ReferenceSourceEntry[];
   readonly pending: PendingDirectory[];

src/server/registerEnhancedTools.ts

@@ -14,6 +14,7 @@ import type { BinarySessionPort } from "../application/binary/BinarySessionPort.
 import { EnhancedTools } from "../application/EnhancedTools.js";
 import type { ValidatedEnhancedCall } from "../application/EnhancedToolTypes.js";
 import {
+  executeComposedWorkflow,
   createWorkflowEvidence,
   workflowSnapshotRecord,
   recordWorkflowUnknowns,
@@ -231,15 +232,20 @@ const executeEnhancedTool = async (
           context,
           parameters,
         });
-      const services = new EnhancedTools({
+      const analysis: AnalysisOperationPort = {
         execute: (operation, operationParameters, executionOptions) =>
           admittedAnalysis.execute(operation, operationParameters, {
             ...executionOptions,
             progress,
           }),
-      });
+      };
       const result = await logToolExecution(registration.logger, name, () =>
-        services.executeValidated(validatedCall, context.mcpReq.signal),
+        executeComposedWorkflow(analysis, (observed) =>
+          new EnhancedTools(observed).executeValidated(
+            validatedCall,
+            context.mcpReq.signal,
+          ),
+        ),
       );
       await progress.report({
         phase: name,
@@ -253,8 +259,9 @@ const executeEnhancedTool = async (
           target: registration.activeTarget?.(),
           operation: name,
           parameters,
-          result: result.value,
+          result: result.value.result,
           upstreamProfile: registration.analysisProfile?.(),
+          upstreamLimitations: result.value.limitations,
         });
         const recorded = registration.recordEvidence?.(evidence);
         if (recorded !== undefined && !recorded.ok)
@@ -273,7 +280,7 @@ const executeEnhancedTool = async (
         }
         const unknowns = recordWorkflowUnknowns({
           name,
-          result: result.value,
+          result: result.value.result,
           evidenceId: evidence.evidence_id,
           recordUnknown: registration.recordUnknown,
         });

tests/boundary/android/JadxAnalysis.test.ts

@@ -279,44 +279,26 @@ it("preserves bounded instruction coverage separately from using-node coverage",
   });
 });
 
-it.each([
-  "not-a-dex-descriptor",
-  "(Lbad(name;)V",
-  "(Lbad)name;)V",
-  "()Lbad(name;",
-  "()Lbad)name;",
-])(
-  "rejects malformed DEX prototype %s at the adapter boundary",
-  async (descriptor) => {
-    const invalidSummary = {
-      ...summary,
-      methods: summary.methods.map((method) => ({
-        ...method,
-        dex_descriptor: descriptor,
-      })),
-    };
-    await expect(
-      analyzeJadxRequest(
-        {
-          json: () => Promise.resolve(invalidSummary),
-          text: () => Promise.reject(new Error("unexpected text call")),
-        },
-        {
-          operation: "inspect_android_class",
-          input: { path: "/fixture.apk", class_name: "fixture.Target" },
-        },
-        {} as never,
-        engine,
-      ),
-    ).rejects.toMatchObject({
-      _tag: "AnalysisOutputError",
-      cause: {
-        issues: expect.arrayContaining([
-          expect.objectContaining({
-            path: ["methods", 0, "dex_descriptor"],
-          }),
-        ]),
+it("rejects malformed method descriptors at the Android adapter boundary", async () => {
+  const invalidSummary = {
+    ...summary,
+    methods: summary.methods.map((method) => ({
+      ...method,
+      dex_descriptor: "not-a-dex-descriptor",
+    })),
+  };
+  await expect(
+    analyzeJadxRequest(
+      {
+        json: () => Promise.resolve(invalidSummary),
+        text: () => Promise.reject(new Error("unexpected text call")),
       },
-    });
-  },
-);
+      {
+        operation: "inspect_android_class",
+        input: { path: "/fixture.apk", class_name: "fixture.Target" },
+      },
+      {} as never,
+      engine,
+    ),
+  ).rejects.toThrow();
+});

tests/boundary/filesystem/clientLifecycle.test.ts

@@ -67,7 +67,6 @@ describe("client configuration filesystem lifecycle", () => {
       "kimi",
       "vscode",
       "trae",
-      "workbuddy",
       "grok_build",
       "omp",
       "pi",

tests/boundary/filesystem/directAnalysisSnapshotReplay.test.ts

@@ -136,6 +136,7 @@ interface SnapshotProviderOptions {
   readonly profile?: ReturnType<typeof createAnalysisProfile>;
   readonly identity?: ProviderIdentity;
   readonly supportedOperations?: readonly CapabilityDescriptor["operation"][];
+  readonly limitations?: readonly string[];
 }
 
 const makeProvider = (
@@ -209,6 +210,7 @@ const makeProvider = (
             createAnalysisExecution(result, profile.provider, {
               analysisProfile: profile,
               rawResult: result,
+              limitations: options.limitations ?? [],
             }),
           );
         },
@@ -253,11 +255,11 @@ const withAlternateWorkflowProfile = (
   snapshot: AnalysisSnapshot,
   path: string,
   current: Evidence,
-): AnalysisSnapshot => {
-  const alternateProfile = createAnalysisProfile(REA_WORKFLOW_PROVIDER, {
+  alternateProfile = createAnalysisProfile(REA_WORKFLOW_PROVIDER, {
     workflow: "binary_overview",
     fixture: "alternate-profile",
-  });
+  }),
+): AnalysisSnapshot => {
   if (
     typeof current.normalized_result !== "object" ||
     current.normalized_result === null ||
@@ -466,6 +468,78 @@ const verifyWindowsSnapshotAdmission = async (
   ).toHaveLength(1);
 };
 
+it.each([
+  { tool: "binary_overview", arguments: {}, priorRevision: 3 },
+  {
+    tool: "inspect_native_api",
+    arguments: { procedure: "0x1000" },
+    priorRevision: undefined,
+  },
+] as const)(
+  "refreshes pre-coverage $tool Evidence and replays the current revision",
+  async (scenario) => {
+    const fixture = await createSnapshotReplayFixture("rea-prior-coverage-");
+    const limitation = "Original PDB names may be missing.";
+    const provider = fixture.createProvider({
+      supportedOperations: workflowProviderOperations,
+      limitations: [limitation],
+    });
+    const dependencies = fixture.dependencies(provider);
+    const options = { snapshotPath: fixture.snapshotPath };
+    const first = parseEvidence(
+      await runDirectAnalysis(
+        dependencies,
+        fixture.path,
+        scenario.tool,
+        scenario.arguments,
+        options,
+      ),
+    );
+    const saved = await readAnalysisSnapshot(fixture.snapshotPath);
+    if (!saved.ok) throw saved.error;
+    const priorProfile = createAnalysisProfile(REA_WORKFLOW_PROVIDER, {
+      upstream_analysis_profile: saved.value.binding.analysis_profile,
+      ...(scenario.priorRevision === undefined
+        ? {}
+        : { workflow_revision: scenario.priorRevision }),
+    });
+    const prior = withAlternateWorkflowProfile(
+      saved.value,
+      fixture.path,
+      { ...first, limitations: ["Derived by an REA composed workflow."] },
+      priorProfile,
+    );
+    const written = await withArtifactResourceScope((resources) =>
+      writeAnalysisSnapshot(prior, fixture.snapshotPath, true, resources),
+    );
+    if (!written.ok) throw written.error;
+    const refreshed = parseEvidence(
+      await runDirectAnalysis(
+        dependencies,
+        fixture.path,
+        scenario.tool,
+        scenario.arguments,
+        options,
+      ),
+    );
+    expect(refreshed.limitations).toContain(limitation);
+    expect(refreshed.analysis_profile?.digest).not.toBe(priorProfile.digest);
+    expect(refreshed.normalized_result).toEqual(first.normalized_result);
+    const starts = [...fixture.starts];
+    const calls = [...fixture.calls];
+    const replayed = await runDirectAnalysis(
+      dependencies,
+      fixture.path,
+      scenario.tool,
+      scenario.arguments,
+      options,
+    );
+    expect(replayed).toEqual(refreshed);
+    expect(fixture.starts).toEqual(starts);
+    expect(fixture.calls).toEqual(calls);
+  },
+);
+
 describe("direct analysis composed snapshot replay", () => {
   it.skipIf(process.platform !== "win32")(
     "does not replay a CLI snapshot through a Windows junction",

tests/boundary/filesystem/referenceSourceFailureDetails.test.ts

@@ -133,88 +133,3 @@ describe("reference import native entry failure details", () => {
     ).toMatchObject({ kind: "file", content_state: "hashed", limitations: [] });
   });
 });
-
-describe("reference import paths beyond the platform limit", () => {
-  it.skipIf(process.platform === "win32")(
-    "reports an entry beyond the absolute path limit as an I/O failure",
-    async () => {
-      const root = await createTestTempDirectory("rea-import-deep-path-");
-      await writeFile(join(root, "kept.txt"), "k");
-      // Relative creation lets the tree exceed PATH_MAX (1024 on macOS, 4096
-      // on Linux) while each 200-byte component stays below NAME_MAX.
-      const deepTree = (action: "create" | "remove") =>
-        promisify(execFile)(process.execPath, [
-          "-e",
-          `const fs = require("node:fs");
-          const names = Array.from({ length: 24 }, (_, i) => "d" + String(i).padStart(2, "0") + "x".repeat(197));
-          process.chdir(${JSON.stringify(root)});
-          if (${JSON.stringify(action)} === "create") {
-            for (const name of names) { fs.mkdirSync(name); process.chdir(name); }
-            fs.writeFileSync("deep.txt", "d");
-          } else {
-            for (const name of names) process.chdir(name);
-            fs.rmSync("deep.txt");
-            for (const name of [...names].reverse()) { process.chdir(".."); fs.rmdirSync(name); }
-          }`,
-        ]);
-      await deepTree("create");
-      try {
-        const read = await readReferenceSource(root);
-        if (!read.ok) throw new Error(read.error.message);
-        expect(read.value.entries).toContainEqual(
-          expect.objectContaining({ path: "kept.txt", status: "read" }),
-        );
-        const failed = read.value.entries.find(
-          (entry) => entry.status === "failed",
-        );
-        expect(failed).toMatchObject({
-          status: "failed",
-          code: "io",
-          message: expect.stringContaining("ENAMETOOLONG"),
-        });
-        const filteredRead = await readReferenceSource(root, {
-          shouldExclude: (path, kind) =>
-            path === failed?.path && kind === "directory",
-        });
-        if (!filteredRead.ok) throw new Error(filteredRead.error.message);
-        expect(
-          filteredRead.value.entries.find(
-            (entry) => entry.path === failed?.path,
-          ),
-        ).toMatchObject({ status: "failed", kind: "unknown", code: "io" });
-        const imported = await importTree(root);
-        if (!imported.ok) throw new Error(imported.error.message);
-        expect(imported.value.entries).toContainEqual(
-          expect.objectContaining({
-            path: "kept.txt",
-            content_state: "hashed",
-          }),
-        );
-        const deep = imported.value.entries.find(
-          (entry) => entry.path === failed?.path,
-        );
-        expect(deep?.limitations.join(" ")).toContain(
-          failed?.status === "failed" ? failed.message : "missing failure",
-        );
-        // A directory-only secret rule still applies when the kind is unknown.
-        const secretPattern = `${failed?.path ?? "missing"}/`;
-        const secret = await importReferenceSource({
-          root,
-          caller: "native-entry-failure-detail-test",
-          policy: { secretPatterns: [secretPattern] },
-        });
-        if (!secret.ok) throw new Error(secret.error.message);
-        expect(
-          secret.value.entries.some(({ path }) => path === failed?.path),
-        ).toBe(false);
-        expect(secret.value.exclusions).toContainEqual({
-          path: failed?.path,
-          reason: "configured-secret",
-          pattern: secretPattern,
-        });
-      } finally {
-        await deepTree("remove");
-      }
-    },
-  );
-});

tests/boundary/filesystem/workbuddyClientConfiguration.test.ts

@@ -1,159 +0,0 @@
-import { mkdir, readFile, writeFile } from "node:fs/promises";
-import { join } from "node:path";
-
-import { afterEach, beforeEach, describe, expect, it, vi } from "vitest";
-
-import { readClientRegistrationStatuses } from "../../../src/application/ClientRegistrationStatus.js";
-import { npxRegistrationCommand } from "../../../src/application/ClientRegistrationIdentity.js";
-import { configureClientConfiguration } from "../../../src/application/SetupClientConfiguration.js";
-import { skillDestinations } from "../../../src/application/SetupSkill.js";
-import { supportedClients } from "../../../src/application/SupportedClients.js";
-import { systemUninstallHost } from "../../../src/application/Uninstall.js";
-import { createTestTempDirectory } from "../../fixtures/temporaryDirectory.js";
-import { clearClientLocationEnvironment } from "../../fixtures/clientEnvironment.js";
-
-/**
- * The registration command setup writes on the host running the tests. Windows
- * wraps it in `cmd.exe /d /c`, so the expected entry follows the host too.
- */
-const command = npxRegistrationCommand(process.platform);
-
-beforeEach(clearClientLocationEnvironment);
-afterEach(() => vi.unstubAllEnvs());
-
-const workbuddyPath = (
-  home: string,
-  platform: NodeJS.Platform = process.platform,
-  env: Parameters<typeof supportedClients>[2] = {},
-) =>
-  supportedClients(home, platform, env).find(
-    ({ name }) => name === "workbuddy",
-  );
-
-describe("WorkBuddy configuration paths", () => {
-  it("resolves the global mcp.json under the home root", () => {
-    expect(workbuddyPath("/home/a")?.configPath).toBe(
-      join("/home/a", ".workbuddy", "mcp.json"),
-    );
-    expect(workbuddyPath("/Users/a")?.markerPath).toBe(
-      join("/Users/a", ".workbuddy"),
-    );
-    expect(workbuddyPath("C:\\Users\\a", "win32")?.configPath).toBe(
-      join("C:\\Users\\a", ".workbuddy", "mcp.json"),
-    );
-  });
-
-  it("resolves the registration format as the plain mcpServers JSON dialect", () => {
-    expect(workbuddyPath("/home/a")?.format).toBe("json");
-  });
-
-  it("resolves the personal skills directory under the home root", () => {
-    expect(
-      skillDestinations("/home/a", ["workbuddy"]).map(({ path }) => path),
-    ).toEqual([
-      join("/home/a", ".workbuddy", "skills", "reverse-engineer-anything"),
-    ]);
-    expect(
-      skillDestinations("C:\\Users\\a", ["workbuddy"], {}, "win32").map(
-        ({ path }) => path,
-      ),
-    ).toEqual([
-      join("C:\\Users\\a", ".workbuddy", "skills", "reverse-engineer-anything"),
-    ]);
-  });
-});
-
-describe("WorkBuddy JSON registration", () => {
-  const workbuddyClient = async () => {
-    const home = await createTestTempDirectory("rea-workbuddy-");
-    const client = workbuddyPath(home, process.platform);
-    if (client?.markerPath === undefined)
-      throw new Error("missing WorkBuddy client");
-    await mkdir(client.markerPath, { recursive: true });
-    return { home, client };
-  };
-
-  it("upserts rea into mcpServers while preserving unrelated settings", async () => {
-    const { home, client } = await workbuddyClient();
-    await writeFile(
-      client.configPath,
-      `{
-  "mcpServers": {
-    "other": { "command": "other-server" }
-  }
-}`,
-    );
-
-    expect(
-      (await configureClientConfiguration(client, {}, command)).status,
-    ).toBe("configured");
-    const parsed = JSON.parse(await readFile(client.configPath, "utf8"));
-    expect(parsed.mcpServers.other).toEqual({ command: "other-server" });
-    expect(parsed.mcpServers.rea).toEqual({
-      command: command[0],
-      args: command.slice(1),
-    });
-
-    expect(await configureClientConfiguration(client, {}, command)).toEqual({
-      status: "unchanged",
-    });
-    expect(
-      (
-        await readClientRegistrationStatuses(home, undefined, {
-          platform: process.platform,
-          environment: {},
-        })
-      ).find(({ client }) => client === "workbuddy"),
-    ).toMatchObject({ state: "aligned", command });
-  });
-
-  it("creates the mcpServers table in an existing mcp.json without servers", async () => {
-    const { client } = await workbuddyClient();
-    await writeFile(
-      client.configPath,
-      JSON.stringify({ unrelated: { setting: true } }, null, 2),
-    );
-    expect(
-      (await configureClientConfiguration(client, {}, command)).status,
-    ).toBe("configured");
-    const parsed = JSON.parse(await readFile(client.configPath, "utf8"));
-    expect(parsed.unrelated).toEqual({ setting: true });
-    expect(parsed.mcpServers.rea).toEqual({
-      command: command[0],
-      args: command.slice(1),
-    });
-  });
-
-  it("registers into an empty mcp.json", async () => {
-    const { client } = await workbuddyClient();
-    await writeFile(client.configPath, "");
-    expect(
-      (await configureClientConfiguration(client, {}, command)).status,
-    ).toBe("configured");
-    const parsed = JSON.parse(await readFile(client.configPath, "utf8"));
-    expect(parsed.mcpServers.rea).toEqual({
-      command: command[0],
-      args: command.slice(1),
-    });
-  });
-
-  it("removes only the rea entry on uninstall", async () => {
-    const { home, client } = await workbuddyClient();
-    await writeFile(
-      client.configPath,
-      JSON.stringify(
-        { mcpServers: { other: { command: "other-server" } } },
-        null,
-        2,
-      ),
-    );
-    await configureClientConfiguration(client, {}, command);
-
-    expect((await systemUninstallHost(home).removeClient(client)).status).toBe(
-      "removed",
-    );
-    const parsed = JSON.parse(await readFile(client.configPath, "utf8"));
-    expect(parsed.mcpServers.other).toEqual({ command: "other-server" });
-    expect(parsed.mcpServers.rea).toBeUndefined();
-  });
-});

tests/boundary/filesystem/zcodeClientConfiguration.test.ts

@@ -13,10 +13,7 @@ import {
 } from "../../../src/application/SetupClientConfiguration.js";
 import { skillDestinations } from "../../../src/application/SetupSkill.js";
 import { supportedClients } from "../../../src/application/SupportedClients.js";
-import {
-  runUninstall,
-  systemUninstallHost,
-} from "../../../src/application/Uninstall.js";
+import { systemUninstallHost } from "../../../src/application/Uninstall.js";
 import { createTestTempDirectory } from "../../fixtures/temporaryDirectory.js";
 import { clearClientLocationEnvironment } from "../../fixtures/clientEnvironment.js";
 
@@ -260,91 +257,6 @@ describe("ZCode .agents fallback preservation", () => {
   });
 });
 
-describe("ZCode fallback uninstall", () => {
-  const owned = { command: command[0], args: command.slice(1) };
-  const writeFallback = async (home: string, servers: object) => {
-    await mkdir(join(home, ".agents"), { recursive: true });
-    const text = `${JSON.stringify({ ui: { keep: true }, mcpServers: servers }, null, 2)}\n`;
-    await writeFile(fallbackPath(home), text);
-    return text;
-  };
-
-  it.each(["comment", "trailing-comma", "bom"])(
-    "fails closed on strict fallback syntax: %s",
-    async (mode) => {
-      const { home } = await zcodeClient();
-      const valid = await writeFallback(home, {
-        rea: owned,
-        other: { command: "other-server" },
-      });
-      const original =
-        mode === "comment"
-          ? `// unsupported comment\n${valid}`
-          : mode === "bom"
-            ? `\uFEFF${valid}`
-            : valid.replace(/\}\s*$/u, ",}");
-      await writeFile(fallbackPath(home), original);
-      const result = await runUninstall(false, systemUninstallHost(home));
-      expect(result.items).toContainEqual(
-        expect.objectContaining({ name: "zcode", status: "failed" }),
-      );
-      expect(await readFile(fallbackPath(home), "utf8")).toBe(original);
-      await expect(
-        readFile(`${fallbackPath(home)}.rea.backup`),
-      ).rejects.toMatchObject({ code: "ENOENT" });
-    },
-  );
-
-  it("removes the REA-owned fallback entry with the native registration", async () => {
-    const { home, client } = await zcodeClient();
-    await writeFile(
-      client.configPath,
-      JSON.stringify({ mcp: { servers: { rea: owned } } }),
-    );
-    const original = await writeFallback(home, {
-      rea: owned,
-      other: { command: "other-server" },
-    });
-
-    const result = await runUninstall(false, systemUninstallHost(home));
-
-    expect(result.status).toBe("complete");
-    expect(result.items.find(({ name }) => name === "zcode")?.status).toBe(
-      "removed",
-    );
-    const native = JSON.parse(await readFile(client.configPath, "utf8"));
-    expect(native.mcp.servers).toEqual({});
-    const fallback = JSON.parse(await readFile(fallbackPath(home), "utf8"));
-    expect(fallback).toEqual({
-      ui: { keep: true },
-      mcpServers: { other: { command: "other-server" } },
-    });
-    expect(await readFile(`${fallbackPath(home)}.rea.backup`, "utf8")).toBe(
-      original,
-    );
-  });
-
-  it("removes a fallback-only REA entry and keeps a foreign rea entry", async () => {
-    for (const [servers, expected] of [
-      [{ rea: owned }, {}],
-      [
-        { rea: { command: "someone-else" } },
-        { rea: { command: "someone-else" } },
-      ],
-    ] as const) {
-      const { home } = await zcodeClient();
-      await writeFallback(home, servers);
-
-      expect(
-        (await runUninstall(false, systemUninstallHost(home))).status,
-      ).toBe("complete");
-      expect(
-        JSON.parse(await readFile(fallbackPath(home), "utf8")).mcpServers,
-      ).toEqual(expected);
-    }
-  });
-});
-
 describe("ZCode fallback admission", () => {
   it.each([{ PORT: 123 }, { REA_MCP_INPUT_SCHEMA_PROFILE: "unknown" }])(
     "refuses malformed fallback REA environment %j before native writes",

tests/boundary/mcp/enhancedTools.callPathsAndBatches.test.ts

@@ -9,6 +9,7 @@ import {
   AnalysisOutputError,
 } from "../../../src/domain/analysisErrorCore.js";
 import type { RelationshipCoverage } from "../../../src/domain/relationshipCoverage.js";
+import { parseEvidence } from "../../../src/domain/evidence.js";
 import { err, ok as resultOk } from "../../../src/domain/result.js";
 
 import { closeEnhancedToolResources, connect } from "./enhancedToolsHarness.js";
@@ -125,9 +126,13 @@ describe("enhanced MCP tools", () => {
         limitations: [caveat],
       },
     });
-    expect(JSON.stringify(graph.structuredContent)?.split(caveat)).toHaveLength(
-      2,
-    );
+    const evidence = parseEvidence(graph.structuredContent);
+    expect(
+      JSON.stringify(evidence.normalized_result).split(caveat),
+    ).toHaveLength(2);
+    expect(
+      evidence.limitations.filter((limit) => limit === caveat),
+    ).toHaveLength(1);
 
     const trace = await client.callTool({
       name: "trace_call_path",

tests/boundary/mcp/enhancedTools.limitations.test.ts

@@ -0,0 +1,42 @@
+import { afterEach, expect, it } from "vitest";
+import { createAnalysisExecution } from "../../../src/application/AnalysisProvider.js";
+import { ok } from "../../../src/domain/result.js";
+import { parseEvidence } from "../../../src/domain/evidence.js";
+import { connect, closeEnhancedToolResources } from "./enhancedToolsHarness.js";
+
+afterEach(closeEnhancedToolResources);
+
+it("retains provider coverage caveats in a composed MCP overview without repeated reads", async () => {
+  const calls: string[] = [];
+  const limitation = "Companion PDB symbol coverage is unverified.";
+  const client = await connect({
+    execute: async (operation) => {
+      calls.push(operation);
+      const value = operation === "current_document" ? "fixture" : [];
+      return ok(
+        createAnalysisExecution(
+          value,
+          { id: "fixture", name: "Fixture", version: "1" },
+          { limitations: [limitation] },
+        ),
+      );
+    },
+  });
+  const response = await client.callTool({
+    name: "binary_overview",
+    arguments: {},
+  });
+  expect(response.isError).not.toBe(true);
+  const evidence = parseEvidence(response.structuredContent);
+  expect(evidence.limitations).toEqual([
+    "Artifact identity is unavailable for this observation.",
+    "Derived by an REA composed workflow.",
+    limitation,
+  ]);
+  expect(evidence.normalized_result).toMatchObject({
+    document: "fixture",
+    procedure_count: 0,
+    string_count: 0,
+  });
+  expect(calls.length).toBe(new Set(calls).size);
+});

tests/boundary/mcp/functionCallDirectionsMcp.test.ts

@@ -1,138 +0,0 @@
-import { Client, InMemoryTransport } from "@modelcontextprotocol/client";
-import { Ajv2020 } from "ajv/dist/2020.js";
-import { expect, it } from "vitest";
-
-import { FUNCTION_COMPARISON_EXAMPLE } from "../../../src/contracts/functionComparisonExample.js";
-import { createEvidence } from "../../../src/domain/evidence.js";
-import { functionDossierSchema } from "../../../src/domain/hopperValues.js";
-import type { RelationshipCoverage } from "../../../src/domain/relationshipCoverage.js";
-import { createServer } from "../../../src/server/createServer.js";
-import { createTestBinarySession } from "../../fixtures/binarySession.js";
-
-const observe = (relationshipCoverage: RelationshipCoverage) => {
-  const template = FUNCTION_COMPARISON_EXAMPLE.left;
-  if (template.subject === null)
-    throw new Error("Expected artifact-bound fixture");
-  const dossier = functionDossierSchema.parse(template.normalized_result);
-  return createEvidence(
-    {
-      path: template.subject.local_path,
-      sha256: template.subject.digest.sha256,
-      format: template.subject.format,
-    },
-    template.provider,
-    {
-      operation: "analyze_function",
-      parameters: template.parameters,
-      result: { ...dossier, callees: [], unresolved_calls: [] },
-      confidence: template.confidence,
-      authority: template.authority,
-      relationshipCoverage,
-    },
-  );
-};
-
-it("preserves directional gaps through advertised schemas and public path reconstruction", async () => {
-  const session = createTestBinarySession(() => {
-    throw new Error("Offline call paths must not launch a provider");
-  });
-  const server = createServer({ kind: "session", session });
-  const client = new Client({ name: "function-call-directions", version: "1" });
-  const [clientTransport, serverTransport] =
-    InMemoryTransport.createLinkedPair();
-  try {
-    await server.connect(serverTransport);
-    await client.connect(clientTransport);
-    const advertised = (await client.listTools()).tools.find(
-      ({ name }) => name === "build_call_path",
-    );
-    if (advertised === undefined)
-      throw new Error("Missing build_call_path contract");
-    const ajv = new Ajv2020({ strict: false, validateFormats: false });
-    expect(ajv.validateSchema(advertised.inputSchema)).toBe(true);
-    const validate = ajv.compile(advertised.inputSchema);
-    for (const { directions, status, exhaustive } of [
-      {
-        directions: ["callers"] as ["callers"],
-        status: "not_found",
-        exhaustive: true,
-      },
-      {
-        directions: ["callees"] as ["callees"],
-        status: "unknown",
-        exhaustive: false,
-      },
-      {
-        directions: ["callers", "callees"] as ["callers", "callees"],
-        status: "unknown",
-        exhaustive: false,
-      },
-    ]) {
-      const limitation =
-        "An observed call reference is absent from the inventory.";
-      const coverage: RelationshipCoverage = {
-        status: "partial",
-        limitations: [limitation],
-        limited_directions: directions,
-      };
-      const observation = observe(coverage);
-      expect(session.recordEvidence(observation).ok).toBe(true);
-      const input = {
-        functions: [observation],
-        start: { address: "0x1000" },
-        goal: { address: "0x9999" },
-      };
-      expect(validate(input), JSON.stringify(validate.errors)).toBe(true);
-      for (const limited_directions of [
-        [],
-        ["callers", "callers"],
-        ["callees", "callees"],
-        ["callers", "callees", "callers"],
-        ["incoming"],
-      ])
-        expect(
-          validate({
-            ...input,
-            functions: [
-              {
-                ...observation,
-                relationship_coverage: {
-                  ...coverage,
-                  limited_directions,
-                },
-              },
-            ],
-          }),
-        ).toBe(false);
-      const result = await client.callTool({
-        name: "build_call_path",
-        arguments: input,
-      });
-      if (result.isError) throw new Error(JSON.stringify(result));
-      expect(result.structuredContent).toMatchObject({
-        normalized_result: {
-          status,
-          search_scope: { exhaustive },
-          limitations: expect.arrayContaining([limitation]),
-        },
-      });
-      const comparison = await client.callTool({
-        name: "compare_functions",
-        arguments: { left: observation, right: observation },
-      });
-      if (comparison.isError) throw new Error(JSON.stringify(comparison));
-      expect(comparison.structuredContent).toMatchObject({
-        normalized_result: {
-          dimensions: expect.arrayContaining([
-            expect.objectContaining({ dimension: "calls", status: "unknown" }),
-          ]),
-        },
-      });
-      // Each scenario owns its Evidence and residual-unknown ledger.
-      const closed = await session.close();
-      if (!closed.ok) throw closed.error;
-    }
-  } finally {
-    await Promise.allSettled([session.close(), client.close(), server.close()]);
-  }
-});

tests/boundary/mcp/ghidraEvidenceMcp.test.ts

@@ -15,17 +15,9 @@ import {
   type GhidraFunctionOperation,
 } from "../../../src/ghidra/GhidraFunctionValues.js";
 
-it.each([
-  { pseudocodeAvailable: true, reportsCoverage: true },
-  { pseudocodeAvailable: false, reportsCoverage: true },
-  { pseudocodeAvailable: true, reportsCoverage: false },
-  { pseudocodeAvailable: false, reportsCoverage: false },
-])(
-  "compares observed empty Ghidra facets with pseudocode=$pseudocodeAvailable and coverage=$reportsCoverage",
-  async ({ pseudocodeAvailable, reportsCoverage }) => {
-    const coverage = reportsCoverage
-      ? { status: "complete" as const }
-      : undefined;
+it.each([true, false])(
+  "compares observed empty Ghidra facets while preserving pseudocode availability (%s)",
+  async (pseudocodeAvailable) => {
     const dossier = functionDossierSchema.parse(ghidraFunctionDossier());
     Object.assign(dossier, {
       comments: [],
@@ -55,13 +47,7 @@ it.each([
         if (operation !== "analyze_function")
           throw new Error(`Unexpected operation: ${operation}`);
         return Promise.resolve(
-          ok({
-            value: jsonValueSchema.parse(dossier),
-            limitations: [],
-            ...(coverage === undefined
-              ? {}
-              : { relationship_coverage: coverage }),
-          }),
+          ok({ value: jsonValueSchema.parse(dossier), limitations: [] }),
         );
       },
     );
@@ -75,7 +61,9 @@ it.each([
         harness.session,
         analyzed.structuredContent,
       );
-      expect(evidence.relationship_coverage).toEqual(coverage ?? null);
+      expect(evidence.relationship_coverage).toMatchObject({
+        status: "complete",
+      });
       expect(evidence.normalized_result).toEqual(dossier);
       const reply = await harness.mcp.callTool({
         name: "compare_functions",
@@ -98,7 +86,7 @@ it.each([
         pseudocode: pseudocodeAvailable ? "unchanged" : "unknown",
         assembly: "unchanged",
         comments: "unchanged",
-        calls: reportsCoverage ? "unchanged" : "unknown",
+        calls: "unchanged",
         references: "unchanged",
         strings_names: "unchanged",
         cfg: "unchanged",
@@ -108,7 +96,9 @@ it.each([
         evidence.parameters,
       );
       if (!replay.ok) throw replay.error;
-      expect(replay.value.relationshipCoverage).toEqual(coverage);
+      expect(replay.value.relationshipCoverage).toEqual(
+        evidence.relationship_coverage,
+      );
       expect(harness.calls).toEqual(["analyze_function"]);
     } finally {
       await harness.close();

tests/boundary/mcp/ghidraInventoryMcp.test.ts

@@ -315,7 +315,7 @@ it("retains missing PDB coverage in empty PE name-search Evidence and snapshot r
     const evidence = sessionEvidence(harness.session, reply.structuredContent);
     expect(evidence.normalized_result).toEqual([]);
     expect(evidence.analysis_profile?.parameters.pdb_observations).toBe(
-      "program-info-v1",
+      "program-info-v4",
     );
     const limitation = evidence.limitations.find((value) =>
       value.includes(pdb.file),

tests/composition/directAnalysisLimitations.test.ts

@@ -0,0 +1,54 @@
+import { expect, it } from "vitest";
+import { parseConfig } from "../../src/config/parseConfig.js";
+import { runDirectAnalysis } from "../../src/application/DirectAnalysis.js";
+import { createAnalysisExecution } from "../../src/application/AnalysisProvider.js";
+import { ok } from "../../src/domain/result.js";
+import {
+  createBinarySessionTargets,
+  createTestBinarySession,
+} from "../fixtures/binarySession.js";
+
+it("retains provider coverage caveats in a composed CLI result and closes the session", async () => {
+  const [path] = await createBinarySessionTargets();
+  const limitation = "Companion PDB symbol coverage is unverified.";
+  let reads = 0;
+  let closed = 0;
+  const createSession = () =>
+    createTestBinarySession(() => ({
+      execute: async (operation) => {
+        reads++;
+        return ok(
+          createAnalysisExecution(
+            operation === "current_document" ? "fixture" : [],
+            { id: "fixture", name: "Fixture", version: "1" },
+            { limitations: [limitation] },
+          ),
+        );
+      },
+      close: async () => {
+        closed++;
+        return ok(null);
+      },
+    }));
+  const output = await runDirectAnalysis(
+    {
+      readConfiguration: () => parseConfig({}),
+      createBinarySession: createSession,
+      createManagedBinarySession: createSession,
+    },
+    path,
+    "binary_overview",
+    {},
+  );
+  expect(output).toMatchObject({
+    limitations: ["Derived by an REA composed workflow.", limitation],
+    normalized_result: {
+      document: "fixture",
+      segment_count: 0,
+      procedure_count: 0,
+      string_count: 0,
+    },
+  });
+  expect(reads).toBe(5);
+  expect(closed).toBe(1);
+});

tests/conformance/ghidra/ReaNoReturnProbe.java

@@ -12,8 +12,6 @@ import ghidra.program.model.listing.FlowOverride;
 import ghidra.program.model.listing.Function;
 import ghidra.program.model.listing.Instruction;
 import ghidra.program.model.symbol.SourceType;
-import ghidra.program.model.symbol.Reference;
-import ghidra.program.model.symbol.RefType;
 import java.io.File;
 import java.lang.reflect.Method;
 import java.nio.file.Files;
@@ -22,12 +20,9 @@ import java.util.HexFormat;
 import java.util.LinkedHashMap;
 import java.util.List;
 import java.util.Map;
-import java.util.ArrayList;
 
 /** Injects reported analysis flags into imported ELF/Mach-O functions; never executes target code. */
 public class ReaNoReturnProbe extends GhidraScript {
-    private record MemoryCallReference(Address source, Address target, RefType type,
-        SourceType sourceType, int operandIndex, boolean primary) {}
     private final JsonArray checks = new JsonArray();
     private final Map<Function, Address> originalEnds = new LinkedHashMap<>();
     private final Map<Function, String> originalSignatures = new LinkedHashMap<>();
@@ -90,114 +85,6 @@ public class ReaNoReturnProbe extends GhidraScript {
         return instance;
     }
 
-    private void knownInteriorCall(GhidraScript bridge) throws Exception {
-        Function caller = function("rea_tls_chain");
-        Function target = function("rea_tls");
-        Address interior = target.getEntryPoint().add(1);
-        require("interior_target_is_owned", currentProgram.getFunctionManager().getFunctionAt(interior) == null &&
-            target.equals(currentProgram.getFunctionManager().getFunctionContaining(interior)));
-        Instruction call = null;
-        for (Instruction instruction : currentProgram.getListing().getInstructions(caller.getBody(), true)) {
-            if (instruction.getFlowType().isCall()) { call = instruction; break; }
-        }
-        if (call == null) throw new IllegalStateException("Missing real call instruction");
-        var references = currentProgram.getReferenceManager();
-        List<Reference> originals = new ArrayList<>();
-        List<MemoryCallReference> saved = new ArrayList<>();
-        for (Reference reference : call.getReferencesFrom()) {
-            if (!reference.getReferenceType().isCall()) continue;
-            originals.add(reference);
-            saved.add(new MemoryCallReference(reference.getFromAddress(), reference.getToAddress(),
-                reference.getReferenceType(), reference.getSource(), reference.getOperandIndex(), reference.isPrimary()));
-        }
-        require("original_call_reference_present", !originals.isEmpty());
-        Reference changed = null;
-        try {
-            for (Reference reference : originals) references.delete(reference);
-            changed = references.addMemoryReference(call.getAddress(), interior,
-                RefType.UNCONDITIONAL_CALL, SourceType.USER_DEFINED, 0);
-            require("interior_target_omitted_by_callee_getter", !caller.getCalledFunctions(monitor).contains(target));
-            JsonObject query = new JsonObject();
-            query.addProperty("document", currentProgram.getName());
-            query.addProperty("procedure", caller.getName());
-            query.addProperty("direction", "outgoing");
-            Method read = bridge.getClass().getDeclaredMethod("procedureReferences", JsonObject.class);
-            read.setAccessible(true);
-            JsonObject output = (JsonObject) read.invoke(bridge, query);
-            require("interior_reference_keeps_known_procedure", output.getAsJsonArray("references").asList().stream().anyMatch(
-                edge -> !edge.getAsJsonObject().get("target_procedure").isJsonNull() &&
-                    edge.getAsJsonObject().getAsJsonObject("target_procedure").get("name").getAsString().equals(target.getName())));
-            require("known_reference_is_not_also_unresolved", output.getAsJsonArray("unresolved_calls").isEmpty());
-            query.remove("direction");
-            Method callees = bridge.getClass().getDeclaredMethod("procedureCalls", JsonObject.class, boolean.class);
-            callees.setAccessible(true);
-            JsonObject inventory = (JsonObject) callees.invoke(bridge, query, false);
-            require("omitted_callee_inventory_stays_partial", inventory.getAsJsonObject("relationship_coverage").get("status").getAsString().equals("partial"));
-            require("omitted_callee_direction_is_explicit",
-                inventory.getAsJsonObject("relationship_coverage").getAsJsonArray("limited_directions").toString().equals("[\"callees\"]"));
-            require("interior_caller_omitted_by_entry_getter", !target.getCallingFunctions(monitor).contains(caller));
-            query.addProperty("procedure", target.getName());
-            JsonObject incoming = (JsonObject) callees.invoke(bridge, query, true);
-            require("off_entry_caller_inventory_stays_partial",
-                incoming.getAsJsonObject("relationship_coverage").get("status").getAsString().equals("partial"));
-            require("off_entry_caller_direction_is_explicit",
-                incoming.getAsJsonObject("relationship_coverage").getAsJsonArray("limited_directions").toString().equals("[\"callers\"]"));
-            JsonObject dossierQuery = new JsonObject();
-            dossierQuery.addProperty("procedure", target.getName());
-            Method analyze = bridge.getClass().getDeclaredMethod("analyzeFunctionObservation", JsonObject.class);
-            analyze.setAccessible(true);
-            Object observation = analyze.invoke(bridge, dossierQuery);
-            Method coverage = observation.getClass().getDeclaredMethod("relationshipCoverage");
-            coverage.setAccessible(true);
-            require("dossier_preserves_caller_only_gap",
-                ((JsonObject) coverage.invoke(observation)).getAsJsonArray("limited_directions").toString().equals("[\"callers\"]"));
-        } finally {
-            if (changed != null) references.delete(changed);
-            for (MemoryCallReference reference : saved) {
-                Reference restored = references.addMemoryReference(reference.source(), reference.target(),
-                    reference.type(), reference.sourceType(), reference.operandIndex());
-                references.setPrimary(restored, reference.primary());
-            }
-        }
-    }
-
-    private void nonCallInstructionReference(GhidraScript bridge) throws Exception {
-        Function caller = function("rea_tls_chain");
-        Function target = function("rea_memcpy");
-        Instruction source = null;
-        for (Instruction instruction : currentProgram.getListing().getInstructions(caller.getBody(), true)) {
-            if (!instruction.getFlowType().isCall()) { source = instruction; break; }
-        }
-        if (source == null) throw new IllegalStateException("Missing non-call instruction");
-        var references = currentProgram.getReferenceManager();
-        Reference added = references.addMemoryReference(source.getAddress(), target.getEntryPoint().add(1),
-            RefType.UNCONDITIONAL_CALL, SourceType.USER_DEFINED, -1);
-        try {
-            require("non_call_reference_target_omitted", !caller.getCalledFunctions(monitor).contains(target));
-            JsonObject query = new JsonObject();
-            query.addProperty("document", currentProgram.getName());
-            query.addProperty("procedure", caller.getName());
-            Method read = bridge.getClass().getDeclaredMethod("procedureCalls", JsonObject.class, boolean.class);
-            read.setAccessible(true);
-            JsonObject output = (JsonObject) read.invoke(bridge, query, false);
-            require("non_call_instruction_reference_stays_partial",
-                output.getAsJsonObject("relationship_coverage").get("status").getAsString().equals("partial"));
-            query.addProperty("direction", "outgoing");
-            Method edges = bridge.getClass().getDeclaredMethod("procedureReferences", JsonObject.class);
-            edges.setAccessible(true);
-            JsonObject known = (JsonObject) edges.invoke(bridge, query);
-            require("non_call_known_reference_is_not_unresolved", known.getAsJsonArray("unresolved_calls").isEmpty());
-            references.delete(added);
-            Address unknown = currentProgram.getMemory().getMaxAddress().add(0x1000);
-            added = references.addMemoryReference(source.getAddress(), unknown,
-                RefType.UNCONDITIONAL_CALL, SourceType.USER_DEFINED, -1);
-            JsonObject unresolved = (JsonObject) edges.invoke(bridge, query);
-            require("non_call_unknown_reference_keeps_site", unresolved.getAsJsonArray("unresolved_calls").size() == 1);
-        } finally {
-            references.delete(added);
-        }
-    }
-
     @Override
     public void run() throws Exception {
         String[] args = getScriptArgs();
@@ -277,8 +164,6 @@ public class ReaNoReturnProbe extends GhidraScript {
             Object output = pseudocode.invoke(bridge, query);
             require("recovered_pseudocode", output instanceof JsonObject value &&
                 value.get("value").getAsString().contains("rea_after_call"));
-            nonCallInstructionReference(bridge);
-            knownInteriorCall(bridge);
         } finally {
             ((ghidra.app.decompiler.DecompInterface) field.get(bridge)).dispose();
         }