docs(hopper): clarify realpath fallback scope

Closes #642

.github/ISSUE_TEMPLATE/bug_report.md

@@ -1,39 +0,0 @@
----
-name: Bug Report
-about: Report a bug in REA
-title: "[Bug] "
-labels: ["bug", "triage"]
-assignees: []
----
-
-## Bug Description
-
-A clear and concise description of what the bug is.
-
-## Steps to Reproduce
-
-1.
-2.
-3.
-
-## Expected Behavior
-
-What you expected to happen.
-
-## Actual Behavior
-
-What actually happened, including any error messages or unexpected output.
-
-## Environment
-
-- REA version (`rea --version` or `npm list @morluto/rea`):
-- Node.js version (`node --version`):
-- macOS version:
-- Hopper Disassembler version:
-- Target binary format (Mach-O, ELF, PE, .hop):
-
-## Additional Context
-
-- MCP client and version (if applicable):
-- Any relevant logs or stack traces:
-- Does the issue reproduce with a different target binary?

.github/ISSUE_TEMPLATE/bug_report.yml

@@ -0,0 +1,155 @@
+name: Bug report
+description: Report a reproducible problem in REA
+title: "[Bug] "
+labels:
+  - bug
+  - triage
+body:
+  - type: markdown
+    attributes:
+      value: |
+        Please report one primary behavior per issue. Keep observed behavior
+        separate from suspected causes, and remove credentials and private paths.
+
+  - type: checkboxes
+    id: before-submitting
+    attributes:
+      label: Before submitting
+      options:
+        - label: I searched the open and closed issues for a related report.
+          required: true
+        - label: I removed credentials, tokens, private paths, and sensitive target data.
+          required: true
+
+  - type: dropdown
+    id: area
+    attributes:
+      label: Area
+      options:
+        - Setup, packaging, or upgrade
+        - Provider or capability discovery
+        - Process capture or runtime observation
+        - Native analysis or decompilation
+        - Evidence, artifacts, or reconstruction
+        - CLI
+        - MCP or agent integration
+        - Documentation
+        - Other
+    validations:
+      required: true
+
+  - type: textarea
+    id: observed-behavior
+    attributes:
+      label: Observed behavior
+      description: What happened? Include the command, MCP tool, provider, target type, and conditions that matter.
+    validations:
+      required: true
+
+  - type: textarea
+    id: reproduction
+    attributes:
+      label: Reproduction
+      description: Give the smallest realistic command, configuration, input, or event sequence that demonstrates the problem.
+      placeholder: |
+        1. Configure or start ...
+        2. Run ...
+        3. Observe ...
+    validations:
+      required: true
+
+  - type: textarea
+    id: expected-behavior
+    attributes:
+      label: Expected behavior
+      description: What result, contract, invariant, recovery action, or state transition should have occurred?
+    validations:
+      required: true
+
+  - type: textarea
+    id: impact-scope
+    attributes:
+      label: Impact and scope
+      description: What is affected, what is not affected, and does this affect evidence integrity, process isolation, compatibility, or recovery?
+    validations:
+      required: true
+
+  - type: input
+    id: rea-version
+    attributes:
+      label: REA version
+      description: Use `rea --version` or provide the source revision.
+      placeholder: 3.1.0 or git revision
+    validations:
+      required: true
+
+  - type: input
+    id: runtime
+    attributes:
+      label: Runtime and platform
+      description: Include Node.js, OS, architecture, and Hopper/Ghidra version when relevant.
+      placeholder: Node 24.18; macOS 15 arm64; Hopper 5.15
+    validations:
+      required: true
+
+  - type: input
+    id: target
+    attributes:
+      label: Target and artifact context
+      description: Include binary format, app/container type, artifact kind, or workload details when relevant.
+      placeholder: Mach-O arm64 app; Evidence v2 bundle; not applicable
+
+  - type: dropdown
+    id: interface
+    attributes:
+      label: Interface
+      options:
+        - CLI
+        - MCP
+        - Python bridge
+        - Package or setup
+        - Other
+    validations:
+      required: true
+
+  - type: dropdown
+    id: failure-stage
+    attributes:
+      label: Earliest failure stage
+      description: Select where the incorrect behavior first becomes observable.
+      options:
+        - Request parsing or validation
+        - Setup or provider admission
+        - Capture or observation
+        - Artifact or evidence registration
+        - Native analysis or reconstruction
+        - Transport or result projection
+        - Cleanup, cancellation, or lifecycle
+        - Unknown
+    validations:
+      required: true
+
+  - type: textarea
+    id: relevant-evidence
+    attributes:
+      label: Relevant output or evidence
+      description: Paste the smallest useful CLI output, MCP result, error, trace, or evidence excerpt. Redact sensitive values.
+      render: text
+
+  - type: textarea
+    id: typed-outcome
+    attributes:
+      label: Typed outcome or recovery expected
+      description: Optional. What typed result, error, next tool, cleanup state, or limitation should the caller have received?
+
+  - type: textarea
+    id: analysis
+    attributes:
+      label: Analysis or suspected cause
+      description: Optional. Clearly mark source-derived reasoning or a hypothesis; do not present an unverified cause as fact.
+
+  - type: textarea
+    id: additional-context
+    attributes:
+      label: Additional context
+      description: Add links, reduced fixtures, screenshots, or a proposed regression test.

.github/ISSUE_TEMPLATE/design_discussion.yml

@@ -0,0 +1,69 @@
+name: Design discussion
+description: Resolve an REA architecture, provider, or contract question before implementation
+title: "[Design] "
+labels:
+  - enhancement
+  - triage
+body:
+  - type: markdown
+    attributes:
+      value: |
+        Use this for a substantial provider, public/persisted contract, or
+        authority-boundary decision. Keep one decision per discussion.
+
+  - type: checkboxes
+    id: before-submitting
+    attributes:
+      label: Before submitting
+      options:
+        - label: I searched the open and closed issues and pull requests for a related discussion.
+          required: true
+        - label: I removed credentials, tokens, private paths, and sensitive target data.
+          required: true
+
+  - type: textarea
+    id: decision
+    attributes:
+      label: Decision needed
+      description: State the exact question maintainers need to resolve.
+      placeholder: Should REA ... or ...?
+    validations:
+      required: true
+
+  - type: textarea
+    id: context-evidence
+    attributes:
+      label: Context and evidence
+      description: Explain why the decision is needed now. Separate observed behavior, derived evidence, and inference.
+    validations:
+      required: true
+
+  - type: textarea
+    id: boundary-invariants
+    attributes:
+      label: Boundary and invariants
+      description: Identify the owning layer, provider/bridge boundary, artifact or evidence invariants, and any process or authorization constraints.
+    validations:
+      required: true
+
+  - type: textarea
+    id: options
+    attributes:
+      label: Options and tradeoffs
+      description: Compare a small number of viable approaches, including platform, compatibility, safety, evidence, and maintenance costs.
+    validations:
+      required: true
+
+  - type: textarea
+    id: success-criteria
+    attributes:
+      label: Success criteria and open questions
+      description: State what outcome would settle the decision and list only unresolved questions that could change the choice.
+    validations:
+      required: true
+
+  - type: textarea
+    id: references
+    attributes:
+      label: References
+      description: Link relevant contracts, upstream provider documentation, tests, measurements, or prior discussions.

.github/ISSUE_TEMPLATE/documentation.md

@@ -1,24 +0,0 @@
----
-name: Documentation
-about: Suggest improvements to REA documentation
-title: "[Docs] "
-labels: ["documentation", "triage"]
-assignees: []
----
-
-## Documentation Area
-
-Which documentation needs improvement? (README, AGENTS.md, API docs, inline JSDoc, skill files)
-
-## Problem
-
-What is unclear, missing, or incorrect in the current documentation?
-
-## Suggested Improvement
-
-Describe the change you would like to see.
-
-## Additional Context
-
-- Link to the relevant documentation file or section:
-- Any examples or references that would help:

.github/ISSUE_TEMPLATE/documentation.yml

@@ -0,0 +1,53 @@
+name: Documentation
+description: Report unclear, missing, or incorrect REA documentation
+title: "[Docs] "
+labels:
+  - documentation
+  - triage
+body:
+  - type: checkboxes
+    id: before-submitting
+    attributes:
+      label: Before submitting
+      options:
+        - label: I searched the existing issues for a related documentation report.
+          required: true
+        - label: I removed credentials, tokens, private paths, and sensitive target data.
+          required: true
+
+  - type: input
+    id: location
+    attributes:
+      label: Documentation location
+      description: Link the page, section, command, API, skill, or inline comment.
+      placeholder: README.md#quick-start or docs/mcp-contracts.md
+    validations:
+      required: true
+
+  - type: textarea
+    id: problem
+    attributes:
+      label: Problem
+      description: What is unclear, missing, outdated, or incorrect, and who is affected?
+    validations:
+      required: true
+
+  - type: textarea
+    id: expected-content
+    attributes:
+      label: Expected content
+      description: Describe the accurate behavior or example that should be documented.
+    validations:
+      required: true
+
+  - type: textarea
+    id: evidence
+    attributes:
+      label: Supporting evidence
+      description: Add source, command output, provider documentation, or a link that supports the correction.
+
+  - type: textarea
+    id: additional-context
+    attributes:
+      label: Additional context
+      description: Include screenshots, affected translations, or related issues.

.github/ISSUE_TEMPLATE/feature_request.md

@@ -1,29 +0,0 @@
----
-name: Feature Request
-about: Propose a new feature or enhancement for REA
-title: "[Feature] "
-labels: ["enhancement", "triage"]
-assignees: []
----
-
-## Problem Statement
-
-What problem does this feature solve? Describe the use case and why existing tools are insufficient.
-
-## Proposed Solution
-
-Describe the feature or enhancement you would like to see. Include:
-
-- Which REA tool(s) this affects (direct, enhanced, or session tools)
-- Expected inputs and outputs
-- How it integrates with the existing MCP workflow
-
-## Alternatives Considered
-
-Any alternative approaches or workarounds you have tried.
-
-## Additional Context
-
-- Relevant Hopper API methods or concepts:
-- Links to related issues or discussions:
-- Would this require changes to the bridge (`bridge/hopper_bridge.py`)?

.github/ISSUE_TEMPLATE/feature_request.yml

@@ -0,0 +1,88 @@
+name: Feature request
+description: Propose a focused improvement to REA
+title: "[Feature] "
+labels:
+  - enhancement
+  - triage
+body:
+  - type: markdown
+    attributes:
+      value: |
+        Keep one primary capability or workflow outcome per request. For a
+        substantial provider, public contract, or architecture change, explain
+        the decision maintainers need to make before implementation.
+
+  - type: checkboxes
+    id: before-submitting
+    attributes:
+      label: Before submitting
+      options:
+        - label: I searched the open and closed issues and pull requests for a related proposal.
+          required: true
+        - label: I removed credentials, tokens, private paths, and sensitive target data.
+          required: true
+
+  - type: dropdown
+    id: area
+    attributes:
+      label: Area
+      options:
+        - Setup, packaging, or upgrade
+        - Provider or capability discovery
+        - Process capture or runtime observation
+        - Native analysis or decompilation
+        - Evidence, artifacts, or reconstruction
+        - CLI
+        - MCP or agent integration
+        - Documentation
+        - Other
+    validations:
+      required: true
+
+  - type: textarea
+    id: current-limitation
+    attributes:
+      label: Current limitation
+      description: What user or agent workflow is blocked, ambiguous, or unnecessarily difficult today?
+    validations:
+      required: true
+
+  - type: textarea
+    id: use-cases
+    attributes:
+      label: Use cases
+      description: Give concrete applications, targets, callers, or investigation workflows. Explain why current tools are insufficient.
+    validations:
+      required: true
+
+  - type: textarea
+    id: desired-outcome
+    attributes:
+      label: Desired outcome and success criteria
+      description: Describe observable behavior, inputs, outputs, evidence, and compatibility criteria that would make this useful.
+    validations:
+      required: true
+
+  - type: textarea
+    id: boundaries
+    attributes:
+      label: Authority boundaries and non-goals
+      description: Call out process execution, target mutation, provider licensing, evidence provenance, supported platforms, and work that should remain out of scope.
+
+  - type: textarea
+    id: alternatives
+    attributes:
+      label: Alternatives considered
+      description: Describe existing REA operations, upstream tools, or workarounds considered and why they do not meet the need.
+
+  - type: textarea
+    id: possible-direction
+    attributes:
+      label: Possible direction
+      description: Optional implementation or integration idea. Treat it as a proposal, not a requirement.
+
+  - type: textarea
+    id: references
+    attributes:
+      label: References
+      description: Link relevant provider documentation, source, measurements, artifacts, issues, or discussions.

.github/pull_request_template.md

@@ -1,34 +1,73 @@
-## Description
+<!--
+PR title: type(optional-scope): imperative outcome
+The title becomes the squash-merge commit subject and generated changelog entry.
+-->
 
-<!-- What does this change do? Why is it needed? -->
+## Summary
 
-## Type of Change
+<!-- What user, agent, or maintainer problem does this solve? Link the issue
+with "Fixes #123" when applicable. Keep the prior behavior, expected contract,
+and new behavior understandable without private context. -->
 
-- [ ] Bug fix
-- [ ] New feature
-- [ ] Documentation update
-- [ ] Performance improvement
-- [ ] Refactoring (no functional change)
-- [ ] Tool contract change (MCP schema modification)
+## Problem and expected behavior
 
-## Testing Performed
+<!-- For fixes, give the smallest trigger and violated invariant. For features,
+describe the use case and observable outcome. -->
 
-<!-- Describe the testing you have done to verify this change. -->
+## Change and scope
 
-- [ ] Unit tests added or updated
-- [ ] TypeScript typecheck passes (`npm run typecheck`)
-- [ ] Linting passes (`npm run lint`)
-- [ ] Full test suite passes (`npm test`)
-- [ ] Real Hopper verification performed (`npm run verify:hopper`)
-- [ ] Linux real Hopper verification performed (`npm run verify:hopper:linux`) or unavailability explained
-- [ ] Real browser verification performed (`npm run verify:browser`) or unavailability explained
-- [ ] Package verification performed (`npm run verify:package`)
+<!-- Explain the chosen approach, why it fits REA's architecture, and what is
+intentionally not included. -->
 
-## Tool Contract Impact
+## Contract and boundary impact
 
-<!-- If this PR adds, removes, or modifies MCP tools, list them here. -->
-<!-- Canonical inventory and family counts are generated in docs/product-catalog.json. -->
+<!-- Complete the applicable lines; use "none" or "not applicable" explicitly. -->
 
-## Related Issues
+- Semantic owner and earliest changed stage:
+- CLI and MCP/tool-catalog contract:
+- Provider, bridge, target-format, or platform compatibility:
+- Evidence, artifact, provenance, or reconstruction contract:
+- Process execution, authorization, cleanup, or containment impact:
+- Generated metadata (`docs/product-catalog.json`), package, or installation impact:
 
-<!-- Link issues this PR closes or relates to. Use "Closes #123" syntax. -->
+## Evidence and regression coverage
+
+<!-- State whether evidence is executed, source-derived, or proposed. For fixes,
+explain how the regression would fail on the affected base revision when practical. -->
+
+- Tests added or updated:
+- Base reproduction or other evidence:
+- User-visible CLI/MCP output (if applicable):
+- Remaining proof gaps:
+
+For evidence-bearing changes:
+
+- [ ] Observed, derived, and inferred claims remain distinguishable.
+- [ ] Artifact identity, source provenance, and failed attempts remain preserved.
+- [ ] Unsupported, incomplete, unavailable, or uncertain outcomes remain visible.
+
+## Validation performed
+
+<!-- List only commands that actually ran, with observed results. Include the
+relevant real-provider or platform workflow, or explain why it was unavailable. -->
+
+- `command` — result
+
+## Compatibility, safety, and release
+
+<!-- Call out breaking changes, migrations, package effects, platform/provider
+limits, security/privacy/containment implications, and meaningful proof gaps. -->
+
+- Breaking changes or migration steps:
+- Real Hopper/Ghidra, browser, or OS coverage:
+- Package or release metadata impact:
+- Security, privacy, process, or containment review:
+
+## Review checklist
+
+- [ ] The PR has one focused outcome and the title follows `type(scope): outcome`.
+- [ ] Related issue is linked, or the reason for not linking one is stated above.
+- [ ] Tests cover changed observable behavior and meaningful failure paths.
+- [ ] Owning docs, contracts, and generated metadata are updated where needed.
+- [ ] User-visible CLI/MCP changes include representative output.
+- [ ] I checked the final diff for secrets, unrelated cleanup, and unsupported claims.

.github/workflows/ci.yml

@@ -88,7 +88,7 @@ jobs:
     strategy:
       fail-fast: false
       matrix:
-        shard: [1/2, 2/2]
+        shard: [1/4, 2/4, 3/4, 4/4]
     steps:
       - uses: actions/checkout@v4
       - uses: actions/setup-node@v4
@@ -105,11 +105,11 @@ jobs:
         if: ${{ !cancelled() }}
         with:
           name: vitest-report-${{ strategy.job-index }}
-          path: .vitest-reports/*
+          path: .vitest/blob/*
           include-hidden-files: true
           if-no-files-found: error
           overwrite: true
-          retention-days: 1
+          retention-days: 7
 
   build:
     name: Build package
@@ -129,7 +129,7 @@ jobs:
           name: rea-dist
           path: dist
           if-no-files-found: error
-          retention-days: 1
+          retention-days: 7
 
   test:
     name: Test (coverage + timing)
@@ -157,22 +157,88 @@ jobs:
       - uses: actions/download-artifact@v4
         if: needs.changes.outputs.code == 'true' && success()
         with:
-          path: .vitest-reports
+          path: .vitest/blob
           pattern: vitest-report-*
           merge-multiple: true
-      - if: needs.changes.outputs.code == 'true' && success()
-        run: npm run test:ci:merge
+      - name: Merge coverage, JUnit, and timing reports
+        if: needs.changes.outputs.code == 'true' && success()
+        run: >-
+          npm run test:ci:merge --
+          --coverage.reportsDirectory=coverage
+          --coverage.reporter=text
+          --coverage.reporter=json-summary
+          --coverage.reporter=lcov
+          --reporter=default
+          --reporter=junit
+          --reporter=json
+          --outputFile.junit=test-results.xml
+          --outputFile.json=test-results.json
+      - name: Summarize slowest test files
+        if: needs.changes.outputs.code == 'true' && success()
+        shell: bash
+        run: |
+          node <<'NODE' >> "${GITHUB_STEP_SUMMARY}"
+          const report = JSON.parse(require("node:fs").readFileSync("test-results.json", "utf8"));
+          const files = (report.testResults ?? [])
+            .map((result) => ({
+              name: result.name,
+              duration: Math.max(0, (result.endTime ?? result.startTime) - result.startTime),
+            }))
+            .sort((left, right) => right.duration - left.duration)
+            .slice(0, 20);
+          console.log("## Slowest deterministic test files\n");
+          console.log("| File | Duration (ms) |");
+          console.log("| --- | ---: |");
+          for (const file of files) {
+            console.log(`| \`${file.name}\` | ${file.duration} |`);
+          }
+          NODE
       - uses: actions/upload-artifact@v4
         if: needs.changes.outputs.code == 'true' && always()
         with:
           name: test-results
-          path: test-results.xml
+          path: |
+            test-results.xml
+            test-results.json
+            coverage/
           if-no-files-found: error
           retention-days: 30
 
-  package-e2e:
-    name: Package E2E (${{ matrix.os }})
+  conformance-fixtures:
+    name: Source-built conformance fixtures
     needs: changes
+    if: github.event_name == 'push' || needs.changes.outputs.code == 'true'
+    runs-on: ubuntu-latest
+    timeout-minutes: 10
+    steps:
+      - uses: actions/checkout@v4
+      - name: Verify fixtures from a clean checkout
+        run: npm run verify:fixtures
+
+  windows-native-build:
+    name: Build bundled Windows x64 native controls
+    needs: changes
+    if: github.event_name == 'push' || needs.changes.outputs.package == 'true'
+    runs-on: ubuntu-latest
+    timeout-minutes: 10
+    steps:
+      - uses: actions/checkout@v4
+      - uses: actions/setup-node@v4
+        with:
+          node-version-file: .nvmrc
+      - name: Prepare cross compiler
+        run: sudo apt-get update && sudo apt-get install --no-install-recommends -y g++-mingw-w64-x86-64
+      - run: npm run build:windows-native
+      - run: npm run verify:windows-native:artifact
+      - uses: actions/upload-artifact@v4
+        with:
+          name: windows-native-controls
+          path: native/windows/build/
+          if-no-files-found: error
+
+  package-e2e:
+    name: Package/install integration (${{ matrix.os }})
+    needs: [changes, windows-native-build]
     if: github.event_name == 'push' || needs.changes.outputs.package == 'true'
     strategy:
       fail-fast: false
@@ -186,8 +252,31 @@ jobs:
           node-version-file: .nvmrc
           cache: npm
       - run: npm ci
+      - uses: actions/download-artifact@v4
+        with:
+          name: windows-native-controls
+          path: native/windows/build/
+      - run: npm run verify:windows-native:artifact
       - run: npm run verify:package
 
+  apple-artifacts:
+    name: Real Apple artifact CLI/MCP E2E
+    needs: changes
+    if: github.event_name == 'push' || needs.changes.outputs.code == 'true'
+    runs-on: macos-14
+    timeout-minutes: 15
+    steps:
+      - uses: actions/checkout@v4
+      - uses: actions/setup-node@v4
+        with:
+          node-version-file: .nvmrc
+          cache: npm
+      - run: npm ci
+      - run: npm run verify:keyed-archive
+      - run: npm run verify:asset-catalog
+      - name: Real binary metadata and Interface Builder integration
+        run: npm run verify:apple-dispatch && npm run verify:interface-builder
+
   reconstruction-readiness:
     name: Reconstruction readiness
     needs: changes
@@ -218,10 +307,14 @@ jobs:
           retention-days: 30
 
   javascript-runtime-observation:
-    name: JavaScript runtime observation
+    name: JavaScript runtime observation (${{ matrix.os }})
     needs: changes
     if: github.event_name == 'push' || needs.changes.outputs.code == 'true'
-    runs-on: ubuntu-latest
+    strategy:
+      fail-fast: false
+      matrix:
+        os: [ubuntu-latest, windows-latest]
+    runs-on: ${{ matrix.os }}
     timeout-minutes: 10
     steps:
       - uses: actions/checkout@v4
@@ -234,8 +327,8 @@ jobs:
         run: npm run verify:inspector
 
   windows-curated:
-    name: Windows Ghidra P0 and package lane
-    needs: changes
+    name: Windows capability and package lane
+    needs: [changes, windows-native-build]
     if: github.event_name == 'push' || needs.changes.outputs.package == 'true'
     runs-on: windows-latest
     timeout-minutes: 25
@@ -248,6 +341,11 @@ jobs:
       - run: npm ci
       - run: npm run build:cached
       - run: npm run typecheck
+      - uses: actions/download-artifact@v4
+        with:
+          name: windows-native-controls
+          path: native/windows/build/
+      - run: npm run verify:windows-native:artifact
       - name: Record named Windows host capabilities
         run: node scripts/windows-capabilities.mjs | Out-File -Encoding utf8NoBOM windows-capabilities.json
       - name: Validate Windows host capability report
@@ -255,20 +353,38 @@ jobs:
           node -e "const report = JSON.parse(require('node:fs').readFileSync('windows-capabilities.json', 'utf8'));
           if (report.platform !== 'win32' || report.architecture !== 'x64')
           throw new Error('expected a Windows x64 capability report');"
-      - name: Run curated Windows P0 tests
+      # Keep this list aligned with tests/process-global/curatedWindowsLane.test.ts,
+      # which fails when any path below is renamed or removed. Vitest silently
+      # ignores unmatched paths, so a stale entry would otherwise report green
+      # while skipping coverage.
+      #
+      # The matching native artifact establishes real Job Object and private
+      # runtime boundaries for these fixtures. Ghidra and Java are not needed;
+      # real engine claims remain in the separate controlled-provider workflow.
+      - name: Run curated Windows capability tests
         run: >-
           npx vitest run --coverage.enabled=false
-          tests/binaryTarget.test.ts
-          tests/windowsCapabilities.test.ts
-          tests/ghidraWindowsFixture.test.ts
-          tests/ghidraInstallation.test.ts
-          tests/ghidraProvider.test.ts
-          tests/ghidraTransport.test.ts
-          tests/ghidraTargetSnapshot.test.ts
-          tests/ghidraClient.test.ts
-          tests/ghidraLauncher.test.ts
-          tests/processOwnership.test.ts
-          tests/realGhidraWindowsWorkflow.test.ts
+          tests/boundary/filesystem/binaryTarget.test.ts
+          tests/boundary/filesystem/setupUnavailableProvider.test.ts
+          tests/boundary/filesystem/asarInventoryFreshness.test.ts
+          tests/composition/javascript-applications/javascriptArtifactReconstruction.test.ts
+          tests/conformance/providers/ghidra/windowsCapabilities.test.ts
+          tests/conformance/providers/ghidra/ghidraWindowsFixture.test.ts
+          src/ghidra/GhidraInstallation.test.ts
+          tests/boundary/providers/ghidra/ghidraTransport.test.ts
+          tests/boundary/providers/ghidra/ghidraTargetSnapshot.test.ts
+          tests/boundary/providers/ghidra/ghidraLauncher.test.ts
+          src/windows/WindowsNativeLoader.test.ts
+          src/windows/WindowsOwnedProcess.test.ts
+          src/ghidra/GhidraLauncherEnvironment.test.ts
+          src/process/ProcessOwnership.test.ts
+          src/process/ProcessOwnership.part2.test.ts
+          src/process/ProcessOwnership.part3.test.ts
+          src/process/ProcessOwnership.validation.test.ts
+          src/application/Update.test.ts
+          tests/process-global/updateMaintenance.test.ts
+          tests/conformance/providers/ghidra/realGhidraWindowsWorkflow.test.ts
+      - run: npm run verify:windows-native
       - run: npm run verify:package:windows
       - uses: actions/upload-artifact@v4
         if: always()
@@ -289,8 +405,3 @@ jobs:
           cache: npm
       - run: npm ci
       - run: npm run docs:check
-      - uses: actions/upload-artifact@v4
-        with:
-          name: api-docs
-          path: build/api-docs
-          retention-days: 14

.github/workflows/real-ghidra-windows.yml

@@ -11,9 +11,29 @@ permissions:
   contents: read
 
 jobs:
-  verify:
-    name: Real Ghidra 12.1.2 Windows x64 PE proof
+  native-artifact:
+    name: Build matching Windows native artifact
     if: github.ref == 'refs/heads/main'
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+      - uses: actions/setup-node@v4
+        with:
+          node-version-file: .nvmrc
+      - name: Prepare cross compiler
+        run: sudo apt-get update && sudo apt-get install --no-install-recommends -y g++-mingw-w64-x86-64
+      - run: npm run build:windows-native
+      - run: npm run verify:windows-native:artifact
+      - uses: actions/upload-artifact@v4
+        with:
+          name: real-ghidra-windows-native
+          path: native/windows/build/
+          if-no-files-found: error
+
+  verify:
+    name: Real Ghidra 12.1.4 Windows x64 PE proof
+    if: github.ref == 'refs/heads/main'
+    needs: native-artifact
     environment: real-ghidra-windows
     runs-on: [self-hosted, Windows, x64, ghidra-12-1-2]
     timeout-minutes: 20
@@ -23,13 +43,25 @@ jobs:
         with:
           node-version-file: .nvmrc
       - run: npm ci
+      - uses: actions/download-artifact@v4
+        with:
+          name: real-ghidra-windows-native
+          path: native/windows/build/
+      - run: npm run verify:windows-native:artifact
+      - run: npm run verify:windows-native
       - name: Verify all admitted Windows Ghidra operations
         env:
           REA_ANALYSIS_PROVIDER: ghidra
         run: npm run verify:ghidra:windows | Tee-Object -FilePath windows-ghidra-proof.log
+      - name: Verify ordinary-user CLI and MCP operations
+        env:
+          REA_ANALYSIS_PROVIDER: ghidra
+        run: npm run verify:ghidra:windows:package | Tee-Object -FilePath windows-ghidra-package-proof.log
       - uses: actions/upload-artifact@v4
         if: always()
         with:
           name: windows-ghidra-proof
-          path: windows-ghidra-proof.log
+          path: |
+            windows-ghidra-proof.log
+            windows-ghidra-package-proof.log
           retention-days: 30

.github/workflows/real-javascript-replay.yml

@@ -1,40 +0,0 @@
-name: Real JavaScript replay verification
-
-on:
-  pull_request:
-    paths:
-      - ".github/workflows/real-javascript-replay.yml"
-      - "scripts/verify-real-javascript-replay.mjs"
-      - "src/replay/**"
-      - "src/application/JavaScriptReplay*"
-      - "src/domain/javascriptReplay.ts"
-      - "tests/fixtures/replay/**"
-      - "package.json"
-      - "package-lock.json"
-  workflow_dispatch:
-
-concurrency:
-  group: real-replay-${{ github.event.pull_request.number || github.ref }}
-  cancel-in-progress: ${{ github.event_name == 'pull_request' }}
-
-env:
-  HUSKY: "0"
-
-permissions:
-  contents: read
-
-jobs:
-  real-replay:
-    runs-on: ubuntu-latest
-    timeout-minutes: 10
-    steps:
-      - uses: actions/checkout@v4
-      - uses: actions/setup-node@v4
-        with:
-          node-version-file: .nvmrc
-          cache: npm
-      - run: npm ci
-      - run: sudo apt-get update && sudo apt-get install -y bubblewrap
-      - run: npm run verify:replay
-        env:
-          REA_REPLAY_ALLOW_UNAVAILABLE: "true"

.github/workflows/release.yml

@@ -25,7 +25,9 @@ jobs:
       - uses: googleapis/release-please-action@v4
         id: release
         with:
-          token: ${{ secrets.GITHUB_TOKEN }}
+          # A dedicated credential lets release-PR updates trigger CI. GitHub
+          # requires manual approval for pull_request events from GITHUB_TOKEN.
+          token: ${{ secrets.RELEASE_PLEASE_TOKEN || secrets.GITHUB_TOKEN }}
 
       - name: Check out release pull request
         if: steps.release.outputs.prs_created == 'true'
@@ -53,9 +55,22 @@ jobs:
         if: steps.release.outputs.prs_created == 'true'
         shell: bash
         env:
-          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-          RELEASE_PR_BRANCH: ${{ fromJSON(steps.release.outputs.pr).headBranchName }}
+          # Use the same identity for the follow-up commit so it also triggers CI.
+          GH_TOKEN: ${{ secrets.RELEASE_PLEASE_TOKEN || secrets.GITHUB_TOKEN }}
+          RELEASE_PR_JSON: ${{ steps.release.outputs.pr }}
         run: |
+          release_pr_branch="$(node --input-type=module -e '
+            const value = JSON.parse(process.env.RELEASE_PR_JSON ?? "");
+            if (
+              typeof value !== "object" ||
+              value === null ||
+              typeof value.headBranchName !== "string" ||
+              value.headBranchName.length === 0
+            ) {
+              process.exit(1);
+            }
+            process.stdout.write(value.headBranchName);
+          ')"
           changed_paths="$(git diff --name-only)"
           if [[ -z "${changed_paths}" ]]; then
             echo "Release documentation is already canonical."
@@ -72,7 +87,7 @@ jobs:
           git add -- docs/product-catalog.json
           git commit -m "chore: normalize release product catalog"
           gh auth setup-git
-          git push origin "HEAD:${RELEASE_PR_BRANCH}"
+          git push origin "HEAD:${release_pr_branch}"
 
   publish:
     name: Publish to npm
@@ -93,11 +108,25 @@ jobs:
 
       - run: npm ci
 
+      - name: Prepare Windows native build toolchain
+        run: sudo apt-get update && sudo apt-get install --no-install-recommends -y g++-mingw-w64-x86-64
+
+      - name: Build and verify bundled Windows native controls
+        run: npm run build:windows-native && npm run verify:windows-native:artifact
+
       - name: Verify packaged release before publishing
         run: npm run verify:package
 
       - name: Publish
-        run: npm publish --access public
+        shell: bash
+        run: |
+          version="$(node --input-type=module -e 'import packageJson from "./package.json" with { type: "json" }; process.stdout.write(packageJson.version)')"
+          published_version="$(npm view "rea-agents@${version}" version --json 2>/dev/null || true)"
+          if [ "${published_version}" = "\"${version}\"" ]; then
+            echo "rea-agents@${version} is already published; verifying the existing package."
+          else
+            npm publish --access public
+          fi
 
       - name: Verify published CLI from npm
         shell: bash
@@ -106,17 +135,58 @@ jobs:
           verification_root="$(mktemp -d)"
           trap 'rm -rf -- "${verification_root}"' EXIT
           cd "${verification_root}"
-          for attempt in 1 2 3 4 5 6; do
-            if npm view "rea-agents@${version}" version --json >/dev/null 2>&1 \
-              && npm exec --yes --package="rea-agents@${version}" -- rea --help \
-              && npm exec --yes --package="rea-agents@${version}" -- rea --llms \
-              && node "${GITHUB_WORKSPACE}/scripts/verify-published-package.mjs" "${version}"; then
+          for attempt in $(seq 1 80); do
+            published_version="$(npm view --prefer-online "rea-agents@${version}" version --json 2>/dev/null || true)"
+            if [ "${published_version}" = "\"${version}\"" ]; then
+              echo "rea-agents@${version} is visible on npm after attempt ${attempt}; verifying the published CLI."
+              npm exec --yes --package="rea-agents@${version}" -- rea --help
+              npm exec --yes --package="rea-agents@${version}" -- rea --llms
+              node "${GITHUB_WORKSPACE}/scripts/verify-published-package.mjs" "${version}"
               exit 0
+            else
+              echo "rea-agents@${version} is not visible on npm yet (attempt ${attempt}/80; up to 20 minutes)" >&2
             fi
-            if [ "${attempt}" -lt 6 ]; then
-              echo "Published package verification attempt ${attempt} failed; retrying in 10 seconds" >&2
-              sleep 10
+            if [ "${attempt}" -lt 80 ]; then
+              sleep 15
             fi
           done
-          echo "Published rea-agents@${version} failed registry and CLI verification" >&2
+          echo "rea-agents@${version} did not become visible on npm within 20 minutes" >&2
           exit 1
+
+  publish-mcp:
+    name: Publish to MCP Registry
+    needs: [release-please, publish]
+    if: needs.release-please.outputs.release_created == 'true' && needs.publish.result == 'success'
+    runs-on: ubuntu-latest
+    permissions:
+      contents: read
+      id-token: write
+    steps:
+      - uses: actions/checkout@v6
+        with:
+          ref: ${{ needs.release-please.outputs.tag_name }}
+          persist-credentials: false
+
+      - name: Verify package and registry metadata versions
+        run: npm run mcp-registry:check
+
+      - name: Install MCP Registry publisher
+        env:
+          MCP_PUBLISHER_VERSION: v1.8.0
+          MCP_PUBLISHER_SHA256_LINUX_AMD64: 1370446bbe74d562608e8005a6ccce02d146a661fbd78674e11cc70b9618d6cf
+        run: |
+          archive="mcp-publisher_linux_amd64.tar.gz"
+          curl -fsSLo "${archive}" \
+            "https://github.com/modelcontextprotocol/registry/releases/download/${MCP_PUBLISHER_VERSION}/${archive}"
+          echo "${MCP_PUBLISHER_SHA256_LINUX_AMD64}  ${archive}" | sha256sum --check --strict
+          tar xzf "${archive}" mcp-publisher
+          chmod +x mcp-publisher
+
+      - name: Validate MCP Registry metadata
+        run: ./mcp-publisher validate
+
+      - name: Authenticate to MCP Registry
+        run: ./mcp-publisher login github-oidc
+
+      - name: Publish MCP Registry metadata
+        run: ./mcp-publisher publish

.gitignore

@@ -6,8 +6,7 @@ __pycache__/
 # Distribution
 dist/
 build/
-docs/api/
-node_modules/
+node_modules
 *.egg-info/
 *.egg
 
@@ -42,3 +41,6 @@ test-results.xml
 # OS
 .DS_Store
 Thumbs.db
+
+# Local reference sources and analysis artifacts
+/_reference/

.jscpd.json

@@ -1,5 +1,6 @@
 {
-  "threshold": 3,
+  "_comment": "Test files are intentionally NOT excluded: the gate used to report zero clones because it skipped **/*.test.ts, hiding all test-tree duplication. Current actual is ~2.4% lines across src+ and tests/, down from 3.4% when tests were included. Lower this as duplication is removed.",
+  "threshold": 2.5,
   "reporters": ["consoleFull"],
   "ignore": [
     "node_modules/**",
@@ -7,8 +8,11 @@
     "docs/**",
     ".codex/**",
     ".devin/**",
-    "**/*.test.ts",
-    "tests/fixtures/**"
+    "tests/fixtures/**",
+    "tests/conformance/**/*.c",
+    "tests/conformance/**/*.m",
+    "tests/conformance/**/*.swift",
+    "tests/conformance/**/*.xib"
   ],
   "gitignore": true,
   "minLines": 5,

.oxfmtrc.json

@@ -0,0 +1,15 @@
+{
+  "$schema": "./node_modules/oxfmt/configuration_schema.json",
+  "printWidth": 80,
+  "sortImports": false,
+  "sortPackageJson": false,
+  "ignorePatterns": [
+    "dist/**",
+    "build/**",
+    "docs/api/**",
+    "node_modules/**",
+    "CHANGELOG.md",
+    "package-lock.json",
+    "_reference/**"
+  ]
+}

.oxlintrc.json

@@ -18,10 +18,110 @@
   },
   "overrides": [
     {
-      "files": ["tests/**/*.ts"],
+      "files": [
+        "scripts/electron-active-hook*.cjs",
+        "tests/conformance/readiness/electron/*.js"
+      ],
       "rules": {
-        "max-lines-per-function": "off",
-        "max-lines": "off"
+        "no-var-requires": "off"
+      }
+    },
+    {
+      "files": [
+        "src/{contracts,domain,server}/**/*.ts",
+        "src/application/**/*.ts"
+      ],
+      "excludeFiles": ["src/application/runtime.ts"],
+      "rules": {
+        "no-restricted-imports": [
+          "error",
+          {
+            "patterns": [
+              {
+                "group": ["**/ghidra/**", "**/hopper/**"],
+                "message": "Deep-provider imports belong behind adapters or in the application composition root."
+              }
+            ]
+          }
+        ]
+      }
+    },
+    {
+      "files": ["tests/**/*.ts", "src/**/*.test.ts", "src/**/*.fixture.ts"],
+      "rules": {
+        "max-lines": "off",
+        "max-lines-per-function": [
+          "error",
+          { "max": 150, "skipBlankLines": true, "skipComments": true }
+        ]
+      }
+    },
+    {
+      "files": ["src/domain/**/*.{fixture,test}.ts"],
+      "rules": {
+        "no-restricted-imports": [
+          "error",
+          {
+            "patterns": [
+              {
+                "group": [
+                  "**/application/**",
+                  "**/server/**",
+                  "**/process/**",
+                  "**/browser/**",
+                  "**/ghidra/**",
+                  "**/hopper/**",
+                  "**/replay/**",
+                  "**/cli.*",
+                  "**/main.*"
+                ],
+                "message": "Domain tests may import only their owning domain and inward dependencies."
+              }
+            ]
+          }
+        ]
+      }
+    },
+    {
+      "files": ["src/application/**/*.test.ts"],
+      "rules": {
+        "no-restricted-imports": [
+          "error",
+          {
+            "patterns": [
+              {
+                "group": ["**/server/**", "**/cli.*", "**/main.*"],
+                "message": "Service tests must use application ports rather than CLI or MCP entrypoints."
+              }
+            ]
+          }
+        ]
+      }
+    },
+    {
+      "files": ["tests/composition/**/*.test.ts"],
+      "rules": {
+        "no-restricted-imports": [
+          "error",
+          {
+            "patterns": [
+              {
+                "group": [
+                  "**/server/**",
+                  "**/cli.*",
+                  "**/main.*",
+                  "node:child_process",
+                  "node:net",
+                  "node:http",
+                  "node:https",
+                  "ws",
+                  "playwright"
+                ],
+                "message": "Composition tests may wire provider-neutral sessions but must not invoke CLI, MCP, process, network, or browser boundaries."
+              }
+            ]
+          }
+        ]
       }
     }
   ],
@@ -29,5 +129,16 @@
     "node": true,
     "es2023": true
   },
-  "ignorePatterns": ["dist", "node_modules", "docs/api", ".codex", ".devin"]
+  "ignorePatterns": [
+    "dist",
+    "build",
+    "node_modules",
+    "docs/api",
+    "coverage",
+    ".turbo",
+    ".cache",
+    ".codex",
+    ".devin",
+    ".factory"
+  ]
 }

.prettierignore

@@ -1,5 +0,0 @@
-dist
-docs/api
-node_modules
-CHANGELOG.md
-package-lock.json

.release-please-manifest.json

@@ -1,3 +1,3 @@
 {
-  ".": "2.6.0"
+  ".": "4.0.1"
 }

AGENTS.md

@@ -2,7 +2,7 @@
 
 ## Product Direction
 
-REA exposes reverse-engineering tools through a CLI and MCP server. Hopper and the bring-your-own Ghidra adapter are operation-capable deep binary-analysis providers. Ghidra is supported on Linux x64 and has an experimental Windows x64 P0 boundary for approved native x86-64 PE applications; it supplies admitted read-only inventory and function-analysis operations but no GUI or mutation authority. Keep provider-specific code out of the domain and application layers.
+REA exposes reverse-engineering tools through a CLI and MCP server. Hopper and the bring-your-own Ghidra adapter are operation-capable deep binary-analysis providers. Ghidra is supported on Linux x64 and macOS x64/arm64 with matching native decompiler tools, and has an experimental Windows x64 P0 boundary for approved native x86-64 PE applications; on Linux and macOS it supplies inventory, function analysis, and atomic function annotation edits in an ephemeral database, without modifying executable bytes or controlling a GUI. Windows P0 has no mutation authority. Keep provider-specific code out of the domain and application layers.
 
 Prioritize:
 
@@ -13,126 +13,95 @@ Prioritize:
 
 Installers must not install or upgrade Homebrew, Node.js, npm, Java, Ghidra, or other unrelated software. Ghidra is bring-your-own. `rea setup` must print its planned changes and require approval before writing files or installing Hopper.
 
-REA is a local-only tool; do not sanitize actionable local diagnostics such as artifact paths, digests, mismatch locations, or analysis metadata, while continuing to redact genuine secrets such as credentials and authorization headers.
+REA is a local-only tool. Preserve caller-selected inputs, captured output, URLs, paths, digests, mismatch locations, and analysis metadata. Do not guess that local evidence is secret from environment-variable names, argument names, or text patterns. Redact transport authentication credentials and values the caller explicitly marks sensitive; do not persist the entire ambient environment merely because a child inherits it.
 
 ## Project Structure & Module Organization
 
-REA is a layered ESM TypeScript application. Dependencies flow inward: `domain` underlies `contracts` and the shared `process` primitives; providers depend on those layers, followed by `application`, `server`, and the entry adapters.
+REA is a layered ESM TypeScript application. Dependencies flow inward from pure domain logic through contracts, providers, application workflows, and CLI/MCP adapters. See [docs/architecture.mermaid](docs/architecture.mermaid) for the component map.
 
-See [docs/architecture.mermaid](docs/architecture.mermaid) for a visual architecture diagram.
-
-- `scripts/rea.mjs`: executable dispatcher. Routes only bare `mcp` and `--mcp` to the production stdio server; Incur handles registration utilities and one-shot commands.
-- `src/main.ts`: MCP adapter. Parses config, wires the shared session runtime, starts stdio transport, and owns process-lifetime shutdown.
-- `src/cli.ts`: one-shot CLI adapter for setup, diagnostics, analysis, and decompilation.
-- `src/config.ts`: Zod-validated parsing of environment configuration into `AppConfig`.
-- `src/domain/`: pure, side-effect-free modules. `errors.ts` owns the tagged error algebra; `result.ts` owns `Result`/`ok`/`err`; `hopperValues.ts` owns shared function-dossier values plus Hopper boundary parsers; `symbolAnalysis.ts` parses Swift/ObjC names; `javascriptApplicationGraph.ts` validates and canonically commits the provider-neutral JavaScript Application Graph; `javascriptStaticAnalysis.ts` performs bounded AST-only JavaScript structure recovery.
-- `src/contracts/`: caller-visible tool schemas and catalog metadata; `toolContracts.ts` owns the canonical inventory and `enhancedInputs.ts` owns enhanced input parsing.
-- `src/process/`: provider-neutral process ownership and lifecycle primitives. It owns private runtime roots, session-assigned run identity and token-verified lineage, absolute startup deadlines, correlated request waits, bounded output capture, and TERM-to-KILL cleanup without defining any provider wire protocol.
-- `src/replay/`: Linux x64 controlled-JavaScript-replay adapter. It owns exact runtime closure inspection, Bubblewrap/seccomp/cgroup admission, the disposable worker, strict parent/worker protocol validation, and complete cleanup observation.
-- `src/browser/`: loopback CDP/Inspector discovery, bounded WebSocket transport, exact-origin or canonical-root target authorization, passive browser/Electron and attach-only Node/Electron V8 observation, plus controlled Playwright scenarios with explicit launch/attach ownership and cleanup.
-- `src/hopper/`: Hopper launch and Unix-socket protocol mechanics. `BridgeLauncher.ts` spawns the Hopper app with the in-process bridge, `HopperClient.ts` correlates request/response over the socket with timeouts and cancellation, `protocol.ts` frames bridge messages.
-- `bridge/hopper_bridge.py`: runs inside Hopper and adapts declared operations to Hopper's public Python API. Hopper's bundled MCP server is not used.
-- `src/ghidra/`: exact Ghidra 12.1.2/JDK 21 inspection, analysis-profile commitment, digest-bound target snapshots, isolated `analyzeHeadless` launch, authenticated Unix-socket or Windows loopback transport, bounded serial request queue, and strict inventory/function boundaries.
-- `src/dotnet/`: execution-free managed PE/CLI inspection. It owns bounded PE, CLI metadata, heap, table, and resource parsing for `rea-dotnet-static`; it must never load, reflect, execute, decompile, or resolve target assemblies.
-- `bridge/ghidra/ReaGhidraBridge.java`: packaged read-only `HeadlessScript` loaded through Ghidra's `scriptPath`; it owns the persistent decompiler and adapts admitted inventory, function, reference, and CFG operations to public Ghidra APIs.
-- `src/application/`: shared CLI/MCP session composition, setup and diagnostics, and enhanced workflows. `AnalysisProviderRegistry` discovers overlapping deep candidates without starting them; `SessionProviderRouter` binds one candidate per target and composes it with disjoint auxiliary providers; `JavaScriptArtifactReconstruction.ts` safely projects local directories/ASARs and inert bundle syntax into the application graph without adding a caller-visible tool yet.
-- `src/server/`: MCP request translation. `createServer.ts` assembles the MCP server, `registerOfficialTools.ts`/`registerEnhancedTools.ts` register each tool set, `toolResult.ts` maps `Result` values to MCP content.
-- `docs/product-catalog.json`: generated package, tool-family, provider, setup-client, schema-version, and CLI facts. Regenerate it from source; do not edit it by hand.
-- `tests/`: Vitest suite. `tests/fixtures/` holds reusable provider-process fixtures, source-owned synthetic JavaScript graph and Electron/Webpack/Rspack artifact trees, and the fake launcher, Hopper bridge, and CDP seams.
-- `scripts/verify-real-hopper.mjs`: real-Hopper end-to-end verifier.
-- `scripts/verify-real-ghidra.mjs`: real Linux Ghidra verifier for x86-64 debug/stripped ELF, AArch64 ELF, PE, and Mach-O function semantics plus complete cleanup.
-- `scripts/verify-real-ghidra-windows.mjs`: real Windows x64 Ghidra P0 verifier for the source-owned native PE fixture, all 19 admitted operations, digest linkage, loopback transport, and cleanup.
-- `scripts/verify-real-browser.mjs`: real Chrome end-to-end verifier for the passive CDP provider.
-- `scripts/print-mcp-config.mjs`: prints an MCP server config with absolute paths filled in (`npm run config:print -- /path/to/binary`).
+- `src/domain/` owns pure provider-neutral semantics; `src/contracts/` owns caller-visible schemas and the canonical tool inventory.
+- `src/hopper/`, `src/ghidra/`, `src/browser/`, `src/native/`, `src/artifacts/`, and `src/dotnet/` own provider-specific boundaries. Keep provider protocols out of domain and application code.
+- `src/application/` composes shared CLI/MCP workflows; `src/server/` translates MCP requests; `src/cli.ts` and `src/main.ts` are the CLI and MCP entry points.
+- `src/process/` owns shared process lifecycle primitives, not provider wire protocols. `bridge/` contains provider-side adapters.
+- `tests/` contains unit, composition, boundary, acceptance, and conformance tests. `scripts/verify-*` contains real-toolchain checks.
+- `docs/product-catalog.json` is generated. Update its source contracts and regenerate it; do not edit it directly.
 
 ## Build, Test, and Development Commands
 
-- `npm ci`: install exact lockfile dependencies.
-- `npm run deps:check`: verify that installed direct dependency versions match the root lockfile; on failure, run `npm ci`, then retry.
-- `npm run metadata:generate`: refresh checked-in package metadata after package, lockfile, or skill-version changes.
-- `npm run metadata:check`: verify checked-in package metadata without rewriting it.
-- `npm run build`: compile `src/` into `dist/`.
-- `npm run build:cached`: compile through Turbo and reuse a valid local build cache entry.
-- `npm test`: restore or build `dist/`, then run the Vitest suite once without coverage or retries locally.
-- `npm run test:fast`: run pure and subprocess test projects without the serial integration group.
-- `npm run test:changed`: run changed and related non-serial tests once.
-- `npm run test:integration`: run the serial filesystem, process, and CLI integration group.
-- `npm run test:watch`: watch changed and related non-serial tests, without coverage.
-- `npm run test:coverage`: run the complete suite with coverage; CI shards the suite and owns JUnit reporting.
-- `npm run typecheck`: run strict TypeScript checks without emitting files.
-- `npm run lint`: apply oxlint rules (complexity, max-lines, unused vars, and TypeScript-specific checks).
-- `npm run lint:fix`: auto-fix oxlint violations where possible.
-- `npm run format:check`: verify Prettier formatting.
-- `npm run check`: run cached typecheck, lint, format:check, knip, and package-metadata freshness tasks.
-- `npm run check:fast`: run only cached typecheck and lint for rapid local and pre-push feedback.
-- `npm run check:ci`: run the static gate plus duplicate-code and debt-marker scans.
-- `npm run check:test`: run the cached static tasks plus the uncached complete test suite.
-- `npm run check:pr`: run the test gate plus uncached generated-document validation for PR preparation.
-- `npm run knip`: detect unused files, dependencies, and exports.
-- `npm run jscpd`: detect duplicate code blocks.
-- `npm run scan:todos`: scan for TODO, FIXME, and HACK markers.
-- `npm run verify:hopper`: build and run the real-Hopper verifier with two distinct binaries.
-- `npm run verify:ghidra`: build and run the real-Ghidra verifier against `GHIDRA_INSTALL_DIR` and optional `GHIDRA_TARGET_PATH`.
-- `npm run verify:ghidra:windows`: build and run the real Windows Ghidra verifier against `GHIDRA_INSTALL_DIR` and the source-owned x64 PE fixture.
-- `npm run verify:browser`: build and run the real Chrome verifier against `REA_BROWSER_EXECUTABLE` or a platform-default Chrome-family executable, including browser-scenario CLI parity, attach disconnect-only ownership, launched-process termination, and temporary-profile cleanup.
-- `npm run verify:inspector`: build and run the real attach-only Node Inspector verifier through the public CLI.
-- `npm run verify:managed`: build and run the source-owned managed PE/CLI conformance verifier for artifact triage, member inspection, managed/native boundary declarations, token drift comparison, malformed metadata, non-managed degradation, managed application-graph projection, manifest-verifier self-test, and optional BYO ILSpy oracle checks; set `REA_MANAGED_APP_MANIFEST_PATH` to verify an operator-local managed app manifest, including optional graph/trace assertions, and set `REA_ILSPY_CMD_PATH` to an absolute `ilspycmd` path to run the real ILSpy reconstruction oracle.
-- `npm run evidence:generate`: regenerate the managed conformance manifest and Evidence v2 completion ledger from live verifier output.
-- `npm run evidence:check`: rerun managed conformance and fail on generated manifest, completion ledger, or bundled skill drift.
-- `npm run verify:replay`: build and run the real Linux Bubblewrap/seccomp/cgroup verifier against source-owned replay fixtures; set `REA_REPLAY_INPUT_PATH` to verify an operator-local manifest.
-- `npm run verify:package`: pack and test the CLI, setup transaction, skill, and canonical target-free MCP catalog in an isolated environment.
-- `npm run docs:api`: render uncommitted API documentation from JSDoc comments into `build/api-docs/` using TypeDoc.
-- `npm run docs:api:cached`: render API documentation through Turbo or restore a valid local result.
-- `npm run docs:generate`: refresh committed metadata and render the uncommitted API documentation.
-- `npm run docs:check`: verify generated package metadata, the canonical product catalog, caller-visible documentation facts, TypeDoc rendering, and the error JSON schema.
-- `npm run config:print -- /path/to/binary`: print an MCP server config with absolute paths.
-- `HOPPER_TARGET_PATH=/path/to/binary npm start`: launch Hopper and run the built stdio MCP server.
+- `npm ci`: install the locked dependencies.
+- `npm run build:cached`: build the CLI and MCP server.
+- `npm run test:local`: run changed source tests without building; pass exact source test paths to run them regardless of Git status.
+- `npm run test:focused -- PATH...`: run exact test files; build first for boundary, acceptance, or process-global tests.
+- `npm run check:changed`: run cached static checks and source tests affected since the branch merge base (default `origin/main`).
+- `npm run check:fast`: run cached typecheck and lint checks.
+- `npm run check:pr`: opt into the complete local deterministic gate and generated-document checks for broad changes; CI owns full coverage. Routine iterations need focused tests and relevant checks, not the whole gate each time.
+- `npm run docs:check`: check committed generated documents; `npm run docs:generate` regenerates them.
+- For provider-dependent changes, see [docs/testing.md](docs/testing.md) and run the matching real-provider verification.
+- Keep each verification lane's prerequisites limited to the claim it checks. Use host-native fixtures for host/provider acceptance; put optional cross-target formats and their external toolchains in a separate lane. Preflight required commands and report the missing dependency and lane clearly.
 
-Pre-commit hooks via Husky format then lint staged source files. Pre-push runs `npm run check:fast`; CI owns the broader static and generated-document gates. Use `npm run lint:fix` to auto-correct violations locally.
+See [docs/testing.md](docs/testing.md) for test scopes and verification lanes and [CONTRIBUTING.md](CONTRIBUTING.md) for contribution checks. Pre-commit formats and lints staged source; pre-push runs `npm run check:fast`.
 
 ## Configuration & Environment Variables
 
-- `REA_ANALYSIS_PROVIDER` (optional, default `auto`): require one deep-analysis provider ID for startup and one-shot commands, or use deterministic automatic selection. A request-level `provider_id`/`--provider` takes precedence.
-- `GHIDRA_INSTALL_DIR` (optional): absolute root of an extracted official Ghidra 12.1.2 distribution. The adapter supports Linux x64 and the experimental Windows x64 P0 boundary documented in `docs/windows-ghidra-p0.md`.
-- `JAVA_HOME` (optional): absolute 64-bit full JDK 21 root used by Ghidra. When absent, doctor probes `java`/`javac` from `PATH`.
-- `REA_ILSPY_CMD_PATH` (optional): absolute path to a bring-your-own `ilspycmd`; doctor reports its configured version, and `verify:managed` can use it as a real reconstruction oracle without making ILSpy a setup-installed dependency or canonical parser.
-- `HOPPER_TARGET_PATH` (optional): absolute initial binary or `.hop` target. Target-free MCP sessions use `open_binary` instead.
-- `HOPPER_LAUNCHER_PATH` (optional): override the Hopper executable path (defaults to `/Applications/Hopper Disassembler.app/Contents/MacOS/hopper`).
-- `HOPPER_TARGET_KIND` (optional, default `executable`): startup kind for `HOPPER_TARGET_PATH`; dynamic targets are classified from their paths and headers.
-- `HOPPER_LOADER_ARGS_JSON` (optional): JSON array overriding derived Hopper loader arguments for supported executable targets, e.g. `["-l","Mach-O","--aarch64"]`.
-- `REA_BROWSER_OBSERVE_ENABLED` (optional, default `false`): add browser observation authority to the administrator ceiling.
-- `REA_BROWSER_CDP_ENDPOINTS_JSON` (optional): approved literal loopback CDP HTTP endpoints.
-- `REA_BROWSER_ALLOWED_ORIGINS_JSON` (optional): exact HTTP(S) page origins approved for passive observation.
-- `REA_BROWSER_SCENARIO_ENABLED` (optional, default `false`): add controlled browser automation to the administrator ceiling.
-- `REA_BROWSER_SCENARIO_AUTO_GRANT` (optional, default `false`): issue the exact configured browser-automation ceiling as an administrator grant for trusted unattended use.
-- `REA_BROWSER_SCENARIO_EXECUTABLE_ROOTS_JSON` (optional): canonical executable roots approved for provider-owned browser launch.
-- `REA_BROWSER_SCENARIO_CDP_ENDPOINTS_JSON` (optional): literal-loopback CDP endpoints approved for external-browser attachment.
-- `REA_BROWSER_SCENARIO_ALLOWED_ORIGINS_JSON` (optional): exact HTTP(S) page origins approved for browser scenarios.
-- `REA_BROWSER_SCENARIO_ALLOWED_ENV_JSON` (optional): environment-variable names that scenario secret references may resolve.
-- `REA_ELECTRON_OBSERVE_ENABLED` (optional, default `false`): add passive Electron file-page observation authority to the administrator ceiling.
-- `REA_ELECTRON_CDP_ENDPOINTS_JSON` (optional): approved literal loopback Electron CDP HTTP endpoints.
-- `REA_ELECTRON_FILE_ROOTS_JSON` (optional): canonical filesystem roots approved for passive Electron page observation.
-- `REA_V8_INSPECTOR_OBSERVE_ENABLED` (optional, default `false`): add passive attach-only Node/Electron Inspector observation authority to the administrator ceiling.
-- `REA_V8_INSPECTOR_ENDPOINTS_JSON` (optional): approved literal-loopback Node/Electron Inspector HTTP endpoints.
-- `REA_V8_INSPECTOR_FILE_ROOTS_JSON` (optional): canonical filesystem roots approved for Inspector targets and script locations.
-- `REA_V8_INSPECTOR_ALLOWED_ORIGINS_JSON` (optional): exact HTTP(S) origins approved for Electron renderer Inspector targets and scripts.
-- `REA_INVESTIGATION_INPUT_ROOTS_JSON` (optional): canonical filesystem roots approved for static JavaScript/Electron application analysis and other investigation inputs.
-- `REA_JAVASCRIPT_REPLAY_ENABLED` (optional, default `false`): add controlled extracted-module execution authority to the administrator ceiling.
-- `REA_JAVASCRIPT_REPLAY_ROOTS_JSON` (optional): exact canonical source roots approved for controlled replay.
-- `REA_JAVASCRIPT_REPLAY_NODE_PATH`, `REA_JAVASCRIPT_REPLAY_BWRAP_PATH`, `REA_JAVASCRIPT_REPLAY_SYSTEMD_RUN_PATH`, `REA_JAVASCRIPT_REPLAY_SYSTEMCTL_PATH`, and `REA_JAVASCRIPT_REPLAY_SHELL_PATH` (optional): absolute paths committed by each replay plan; defaults target the current Node runtime and standard Linux system executables.
+Configuration is parsed and validated by `src/config.ts` and `src/config/`. Keep user-facing setup and provider configuration in [README.md](README.md) and the relevant guide under `docs/`; do not maintain a second environment-variable catalogue here.
 
 ## Coding Style & Naming Conventions
 
-Use ESM TypeScript, two-space indentation, and Prettier defaults. Keep compiler strictness intact (`strict`, `exactOptionalPropertyTypes`, `noUncheckedIndexedAccess`, `verbatimModuleSyntax`). Use `camelCase` for values/functions, `PascalCase` for classes/types, and `UPPER_SNAKE_CASE` for constants. Parse unknown values at every MCP, environment, and subprocess boundary. Avoid `any`, unchecked casts, non-null assertions, import-time I/O, and floating promises. Exported APIs require concise JSDoc. Model expected failures with the tagged error algebra and `Result`, not broad exception wrappers.
+Use ESM TypeScript, two-space indentation, and the committed Oxfmt configuration. Keep compiler strictness intact (`strict`, `exactOptionalPropertyTypes`, `noUncheckedIndexedAccess`, `verbatimModuleSyntax`). Use `camelCase` for values/functions, `PascalCase` for classes/types, and `UPPER_SNAKE_CASE` for constants. Parse unknown values at every MCP, environment, and subprocess boundary. Avoid `any`, unchecked casts, non-null assertions, import-time I/O, and floating promises. Exported APIs require concise JSDoc. Model expected failures with the tagged error algebra and `Result`, not broad exception wrappers.
+
+## Boundary Contracts
+
+Treat a boundary as a contract between the producer's actual representation and the consumer's required meaning. When implementing or auditing a boundary, trace the value through parsing, normalization, authorization, serialization, and the CLI/MCP result. Establish affected callers from their code paths; similar tool names or workflows do not prove that they share a schema or failure mode.
+
+Keep portable evidence and scenario validation distinct from host-native execution checks. Absolute filesystem paths, file URLs, and HTTP paths have different semantics; do not substitute one platform's syntax for the domain concept. Interpret provider metadata according to its documented or observed producer behavior. When a transformation loses information, preserve the reported value and an explicit unknown rather than guessing a canonical identity.
+
+Preserve meaningful failure reasons through application and adapter layers. Malformed input is distinct from an unsupported target, unavailable provider, or host operating-system permission denial. Diagnostics should identify the failed constraint and the target or lifecycle request it applies to. Recovery advice must address that reason and point to an available workflow; generic catches must not erase actionable validation details.
+
+Leave meaningful target, action, capture, and output choices to the agent. A selected operation already expresses intent; do not require approval booleans or repeated permission declarations. Trace each setting to its consumer: remove ignored options and single-value confirmations, derive built-in lifecycle behavior, and supply defaults for omitted optional metadata. Report actual effects and limitations where they help interpret results rather than asking callers to restate them.
+
+Verify the representation consumed at the next boundary. Internal validator success does not establish JSON Schema validity or client compatibility: validate advertised input and output schemas against their declared dialect after SDK conversion, and keep generated contracts aligned. Use representative producer data and regressions that exercise the failed behavior. Platform and provider support claims require the corresponding real workflow; package startup, capability probes, and mock transport tests establish only their narrower claims. Report unverified coverage explicitly.
+
+Bind tool handlers to named contracts, preserving their exact input and output types. Catalog ordering is presentation metadata; changing that order must not select a different schema or operation for an existing handler.
+
+## Designing MCP Tools
+
+Start from the analyst question and desired result, not a provider API. Before adding a tool, inspect the existing contract and its nearest alternative.
+
+Let agents compose experiments with ordinary commands, scripts, and local fixture servers. REA tools should perform the requested inspection or capture and return evidence. A custom orchestration language, replay engine, or separate prepare/execute plan needs an observed requirement that those primitives cannot satisfy. A plan-only tool without an executor does not establish runtime behavior; expose the useful inspection directly.
+
+- Prefer reusable, composable primitives: inspect one explicit object or
+  relationship and return evidence that can support different analyst
+  questions. Compose primitives into a workflow only for a recurring outcome
+  that benefits from joining evidence sources; keep one-application or
+  business-domain interpretations out of general tool contracts.
+- Use **inspect/search** tools for facts about a target or candidate set; use **trace** tools for relationships; use **compare** tools for explicitly paired inputs.
+- Add a **workflow** when observed agent use shows a repeated sequence that REA can compose without losing analyst control. Return useful results inline so callers can choose their next action.
+- Use **observe/capture** only when runtime activity is required, and declare authority and lifecycle effects in the contract.
+- Extend an existing tool when intent and result contract are unchanged. Add a tool for a distinct analyst outcome or materially different authority.
+- Keep caller-facing names and results provider-neutral. Put engine-specific behavior in provider adapters and report each provider's exact coverage.
+- Keep results complete by default. Add a limit only when it follows from a real format, protocol, authority, or resource-safety constraint; explain truncation and unsupported facets. Keep observed, derived, inferred, and unknown results distinct.
+- Include artifact identity, source locations, Evidence references, actionable errors, and relevant limitations when they affect conclusions. Return the evidence needed for the next analysis inline rather than requiring a resource or identifier lookup.
+- Implement shared application workflows behind CLI and MCP adapters. Update canonical contracts and generated catalog together.
+
+See [docs/tool-design.md](docs/tool-design.md) for the design checklist. When usability or tool selection changes, evaluate representative CLI/MCP tasks as well as schema and transport behavior.
 
 ## Testing Guidelines
 
-Name tests `*.test.ts`. Use Vitest and production seams (`tests/fixtures/`) rather than module mocks. Domain tests assert pure behavior; adapter tests use fake launcher/socket seams; MCP tests connect with the client SDK version pinned in `package.json`. Preserve the canonical tool inventory defined by `TOOL_CONTRACTS` and verified through `CATALOG_IDENTITY` and generated product metadata. Cover malformed input, cancellation, timeouts, process exit, concurrency, limits, and clean shutdown. Real Hopper, Ghidra, browser, JavaScript replay, managed conformance, and any real managed-tool claims cannot be replaced by mocks; use the corresponding `verify:*` command.
+Name tests `*.test.ts`. Use Vitest and production seams (`tests/fixtures/`) rather than module mocks. Domain tests assert pure behavior; adapter tests use fake launcher/socket seams; MCP tests connect with the client SDK version pinned in `package.json`. Preserve the canonical tool inventory defined by `TOOL_CONTRACTS` and verified through `CATALOG_IDENTITY` and generated product metadata. Cover malformed input, cancellation, lifecycle cleanup, and actual format, protocol, host-permission, and target-identity boundaries. Do not add tests that merely freeze arbitrary caps or prescribed call sequences. Real Hopper, Ghidra, browser, managed conformance, and any real managed-tool claims cannot be replaced by mocks; use the corresponding `verify:*` command.
 
-MCP tools are agent-computer interfaces. Optimize them first for successful agent use: distinct purposes, clear names and parameters, relevant result context, actionable errors, and realistic multi-step workflows. Validate tool-design changes with representative agent tasks and transcripts when possible; schema validity and transport success alone do not prove that a tool is easy for an agent to use.
-
-MCP tool catalogs must remain complete and self-describing. Prefer capability- and session-scoped tool advertisement over schema truncation. Never use serialized byte counts as a proxy for model-context cost, token use, tool usability, or agent performance. Measure bytes only when evaluating a named transport, storage, or protocol constraint. Any model-context or token-efficiency claim must identify the client and its actual model-facing projection and tokenizer, since clients may omit, transform, dereference, or otherwise reproject MCP schemas. Do not weaken names, descriptions, schemas, examples, errors, or result context to improve a byte-based metric.
+Keep tool catalogs complete and self-describing; prefer capability- and session-scoped availability over schema truncation. Serialized bytes alone do not measure agent usability or model context cost.
 
 ## Commit & Pull Request Guidelines
 
 Use Conventional Commit subjects because Release Please derives versions and changelogs from them. Examples: `feat: add historical source import`, `fix(process): stop timers after exit`, and `docs: update architecture`. Use `!` or a `BREAKING CHANGE:` footer for breaking changes. Pull request titles must follow the same format because squash merges use the title as the release commit. Pull requests should describe contract or behavior changes, list verification commands, link issues, and include sanitized MCP examples when schemas change. State whether real Hopper/Ghidra verification was performed. Never commit binaries, Hopper or Ghidra project documents, credentials, `dist/`, `node_modules/`, or local planning artifacts (e.g. `.codex/`).
+
+<!-- BEGIN:turborepo-agent-rules -->
+
+# This is NOT the Turborepo you know
+
+Turborepo configuration, task behavior, and CLI commands can vary between installed versions and may differ from your training data. Resolve the `turbo` package from this file's directory or relevant workspace; in monorepos, it may not be visible from the repository root. For example, run `node -p "require.resolve('turbo/package.json')"` from a workspace that depends on `turbo`.
+
+Read `docs/README.md` inside that installed package first, then read the relevant pages from its `docs/` directory before changing Turborepo configuration or commands. Heed deprecation notices. These bundled docs match the installed package version and are available without network access.
+
+This block is written and re-added by `turbo` before repository-scoped commands when an AI agent is detected. In the Turborepo source repository, its template is defined in `crates/turborepo-cli/src/cli/agent_guidance.rs`. Removing the managed block while updates are enabled means a later qualifying invocation will add it again. Set `"agentGuidance": false` in the root `turbo.json` or `turbo.jsonc` to opt out; this does not remove an existing block. Keep the block committed with your work to avoid an uncommitted change on the next agent invocation.
+<!-- END:turborepo-agent-rules -->

CHANGELOG.md

@@ -1,5 +1,393 @@
 # Changelog
 
+## [4.0.1](https://github.com/morluto/rea/compare/rea-agents-4.0.0...rea-agents-4.0.1) (2026-10-05)
+
+
+### Bug Fixes
+
+* **release:** allow npm propagation time ([2ef02ce](https://github.com/morluto/rea/commit/2ef02ced1603809f0fc6984612de31dce1801dd8))
+
+## [4.0.0](https://github.com/morluto/rea/compare/rea-agents-3.2.1...rea-agents-4.0.0) (2026-10-05)
+
+
+### ⚠ BREAKING CHANGES
+
+* Managed comparison metadata adds exact-signature matching and its count, and name_matching now reports exact-signature-fallback.
+* **setup:** unscoped setup refreshes only existing REA-owned registrations. Use --all-detected to configure every detected client. Setup JSON contains a compact doctor summary; use rea doctor for full diagnostics. Cancellation and successful dry runs now exit successfully.
+* Remove controlled replay, Node characterization, finite replay-machine, managed runtime planning, and redundant string-tracing tools. Retire process replay, shims, reactive scenarios, custom checkpoints, and active browser replay and origin-scope inputs.
+* **tools:** Removed permission configuration and policy commands, approval fields, filesystem scope inputs, and fixed confirmation options. Process capture inherits the host environment and accepts command names; callers must refresh tool schemas and migrate removed fields.
+
+### Features
+
+* **ghidra:** add DOS MZ analysis and complete function extents ([#556](https://github.com/morluto/rea/issues/556)) ([4f099a1](https://github.com/morluto/rea/commit/4f099a10f819125d52bd8baed9a9018496212eab))
+* **native:** add inspection primitives, dispatch traces and approved UI observation ([#500](https://github.com/morluto/rea/issues/500)) ([4fbc501](https://github.com/morluto/rea/commit/4fbc501121e96b33665a76cad2e5c3e8ac2e2c6d))
+* **setup:** expand agent integrations and verify updates ([#577](https://github.com/morluto/rea/issues/577)) ([6256b68](https://github.com/morluto/rea/commit/6256b6866616fa0c3137a77ebd31cf34155a642f))
+
+
+### Bug Fixes
+
+* **artifacts:** break directory child collation ties ([#587](https://github.com/morluto/rea/issues/587)) ([b37e47c](https://github.com/morluto/rea/commit/b37e47c9f729a66008b1dc8b0a1bb266e79c2776))
+* **artifacts:** exclude removed paths from unchanged counts ([#569](https://github.com/morluto/rea/issues/569)) ([52bf709](https://github.com/morluto/rea/commit/52bf709bcefb17ab07e1f9c47c5fadf5eca9bd4e))
+* **artifacts:** expand nested ASARs on Windows ([#582](https://github.com/morluto/rea/issues/582)) ([ebb4c45](https://github.com/morluto/rea/commit/ebb4c45b6892ab60f2c81e05fbb4cb528ffbffc4))
+* **artifacts:** interrupt ZIP extraction under backpressure ([#594](https://github.com/morluto/rea/issues/594)) ([50f7e81](https://github.com/morluto/rea/commit/50f7e81432001239ca8b5de3a9cfe8f5980d2711))
+* **artifacts:** preserve archive entry types and host paths ([#581](https://github.com/morluto/rea/issues/581)) ([28e0f4e](https://github.com/morluto/rea/commit/28e0f4e9ec09ae35b26920e4c6925f48770bf5ed))
+* **artifacts:** refresh cached ASAR headers for each inventory ([#574](https://github.com/morluto/rea/issues/574)) ([f5013c5](https://github.com/morluto/rea/commit/f5013c50ca81795f91fd945fae2fb76f9dbe0f97))
+* **artifacts:** resolve parents after archive enumeration ([#578](https://github.com/morluto/rea/issues/578)) ([8eac290](https://github.com/morluto/rea/commit/8eac290e8d716817526ab7f628e83c75fb33d06b))
+* **artifacts:** respect XML plist byte-order marks ([#514](https://github.com/morluto/rea/issues/514)) ([23c4eba](https://github.com/morluto/rea/commit/23c4eba5b38b8de4f9547d879f2c3e54f741b1e1))
+* **artifacts:** retain expanded ASAR container parents ([#583](https://github.com/morluto/rea/issues/583)) ([00fa974](https://github.com/morluto/rea/commit/00fa97422f585db878ffe5d1613c56608916f972))
+* **artifacts:** retain relative paths in directory identities ([#580](https://github.com/morluto/rea/issues/580)) ([348323d](https://github.com/morluto/rea/commit/348323dd23360bbac3841a9632ffcd08290566d2))
+* **browser:** capture popup network and report early event gaps ([#614](https://github.com/morluto/rea/issues/614)) ([f557207](https://github.com/morluto/rea/commit/f557207887ca9336f3d3c5fc02c76c354c1b2945))
+* **browser:** capture selected events in popup pages ([#600](https://github.com/morluto/rea/issues/600)) ([a3bf4a0](https://github.com/morluto/rea/commit/a3bf4a0944ce5a52e100470273b91fdd48ebce49))
+* **browser:** derive source-map imports from syntax nodes ([#588](https://github.com/morluto/rea/issues/588)) ([bae87b4](https://github.com/morluto/rea/commit/bae87b4ded343b34c4226b5e5d491145db7f85ff))
+* **browser:** distinguish duplicate screenshot frame events ([#612](https://github.com/morluto/rea/issues/612)) ([1bd641d](https://github.com/morluto/rea/commit/1bd641d39f58461566e4a3f07fa00f84f34e87ad))
+* **browser:** ignore duplicate frame navigations and read block-form source map directives ([#546](https://github.com/morluto/rea/issues/546)) ([828395d](https://github.com/morluto/rea/commit/828395d510bd4f29525e5a0807a550a2daad885c))
+* **browser:** keep subresource redirects out of page navigation scope ([#524](https://github.com/morluto/rea/issues/524)) ([9c28f3c](https://github.com/morluto/rea/commit/9c28f3c4c0840fd7424dc669db1fb9baa1dde5d7))
+* **browser:** preserve RGB PNG transparent samples ([#595](https://github.com/morluto/rea/issues/595)) ([9997152](https://github.com/morluto/rea/commit/9997152c2d3127162161a2b945f506f0e834be38))
+* **browser:** release cancelled CDP cleanup without waiting for responses ([#517](https://github.com/morluto/rea/issues/517)) ([488fd5f](https://github.com/morluto/rea/commit/488fd5f60be3b2900c27a915c73322b9cb5eabb5))
+* **browser:** release discarded source-map response bodies ([#611](https://github.com/morluto/rea/issues/611)) ([8642055](https://github.com/morluto/rea/commit/864205570a0a9452f96c11feacd00338d026f17b))
+* **browser:** resolve redirected source map paths from final URL ([#518](https://github.com/morluto/rea/issues/518)) ([056c123](https://github.com/morluto/rea/commit/056c1237591de3710cb96a51ddd71fa94317b906))
+* **cli:** fail commands returning projected analysis errors ([#506](https://github.com/morluto/rea/issues/506)) ([2fd1196](https://github.com/morluto/rea/commit/2fd11961cfba0c2d211a1aa643cbf05fa4e8c20d))
+* **cli:** reject invalid UTF-8 JSON file bytes ([#613](https://github.com/morluto/rea/issues/613)) ([22acb0d](https://github.com/morluto/rea/commit/22acb0d5d730379fbe49e9e491f446e11425190e))
+* **comparison:** account for unpaired records after explicit bundle pairing ([#603](https://github.com/morluto/rea/issues/603)) ([12a2e37](https://github.com/morluto/rea/commit/12a2e3793af63542448124311e17eacbd5235fc0))
+* **comparison:** match generated names without swallowing symbol prefixes ([#596](https://github.com/morluto/rea/issues/596)) ([5f3ba3e](https://github.com/morluto/rea/commit/5f3ba3e6886b6b3186711e025da14875dc3c9684))
+* **comparison:** normalize CFG identity by numeric addresses ([#593](https://github.com/morluto/rea/issues/593)) ([d1e5c0e](https://github.com/morluto/rea/commit/d1e5c0e1fd04d2d5a0d663cbe43787a010e3d783))
+* **comparison:** require decoded signatures for structural method matches ([#604](https://github.com/morluto/rea/issues/604)) ([4a98c3e](https://github.com/morluto/rea/commit/4a98c3ea035480561d138d79288974a860c2aa22))
+* **conformance:** preserve own JSON keys during comparison ([#573](https://github.com/morluto/rea/issues/573)) ([3460eda](https://github.com/morluto/rea/commit/3460eda9ca01ccf41e3b9895f3cbe975c0eaed51))
+* correct native inventories and bridge error classification ([#503](https://github.com/morluto/rea/issues/503)) ([405732a](https://github.com/morluto/rea/commit/405732a7f55e3033c29533b18f7d8313dbd28570))
+* **docs:** allow README installation wording to vary ([92617f9](https://github.com/morluto/rea/commit/92617f965720aaa74ec20ad67291adc5e83677a1))
+* **ghidra:** avoid nested quotes in Windows Java options ([a574b74](https://github.com/morluto/rea/commit/a574b744b8fe95e906524684f6a3b28cdc656499))
+* **ghidra:** recover evidenced switch cases and default targets ([#579](https://github.com/morluto/rea/issues/579)) ([b225b0f](https://github.com/morluto/rea/commit/b225b0f64bfa86586c17f193d30e278d8124b14e))
+* **inspector:** preserve lossy Node discovery locations ([#542](https://github.com/morluto/rea/issues/542)) ([84e4361](https://github.com/morluto/rea/commit/84e4361c0936a4bb30951699fb68970d4d7a2327)), closes [#530](https://github.com/morluto/rea/issues/530)
+* **javascript:** avoid invented computed destructuring properties ([#507](https://github.com/morluto/rea/issues/507)) ([80777d9](https://github.com/morluto/rea/commit/80777d96daf64d0266e5cf3f9aad9338b97be4ff))
+* **javascript:** bind named class expressions in their class scope ([#510](https://github.com/morluto/rea/issues/510)) ([55f0267](https://github.com/morluto/rea/commit/55f0267c409cbf096bcdbd07d7604c44bcde3fbe))
+* **javascript:** classify assignment targets and retain compound-assignment reads ([#537](https://github.com/morluto/rea/issues/537)) ([333d118](https://github.com/morluto/rea/commit/333d118c0fa65c8c418baaa337270c0ad25cd7cc))
+* **javascript:** correct lexical and dynamic scope analysis ([#538](https://github.com/morluto/rea/issues/538)) ([6fa6f1f](https://github.com/morluto/rea/commit/6fa6f1f9b17318220abb2683c327146785dcc5d3))
+* **javascript:** honor computed keys when naming callables, exports, requests and options ([#536](https://github.com/morluto/rea/issues/536)) ([4c8dc39](https://github.com/morluto/rea/commit/4c8dc39f439b5283b077c6aa47f262714d7c4bbd))
+* **javascript:** honor package exports condition order ([#591](https://github.com/morluto/rea/issues/591)) ([8289595](https://github.com/morluto/rea/commit/82895959d1494f16bc59909a2575facf3ab19d79))
+* **javascript:** isolate lexical loop bindings ([#511](https://github.com/morluto/rea/issues/511)) ([c30878f](https://github.com/morluto/rea/commit/c30878f616c4496c6cd1993d677aa019b2412b7e))
+* **javascript:** prefer package entrypoints over directory indexes ([#575](https://github.com/morluto/rea/issues/575)) ([bb91abd](https://github.com/morluto/rea/commit/bb91abd3df52802ec8f9d3d1fb215dce5eb6ea49))
+* **javascript:** preserve literal CommonJS path punctuation ([#576](https://github.com/morluto/rea/issues/576)) ([063cd25](https://github.com/morluto/rea/commit/063cd25a93ee9f16b45635fea196dde0d9309ab9))
+* **javascript:** preserve Node exports fallback stop reasons ([#606](https://github.com/morluto/rea/issues/606)) ([adc07f5](https://github.com/morluto/rea/commit/adc07f5eaab005f013c88617aa09b6f2b4af4111))
+* **javascript:** respect HTML base URL components ([#589](https://github.com/morluto/rea/issues/589)) ([ffbde92](https://github.com/morluto/rea/commit/ffbde92f9ab65a868b660abf17ce9d3c4577d125))
+* **javascript:** respect lexical shadowing of require ([#509](https://github.com/morluto/rea/issues/509)) ([6a431d8](https://github.com/morluto/rea/commit/6a431d806a1574a660b96ba49412b24df9e93b50))
+* **javascript:** retain property reads during updates ([#508](https://github.com/morluto/rea/issues/508)) ([6b7923c](https://github.com/morluto/rea/commit/6b7923cdd2a099d1481783f34970a3d1a71a8206))
+* **managed:** classify truncated signatures as malformed ([#598](https://github.com/morluto/rea/issues/598)) ([1b6f054](https://github.com/morluto/rea/commit/1b6f05470d6fb1903346ef7a25fb5f9d23079cb7))
+* **managed:** distinguish metadata handles from member accesses ([#607](https://github.com/morluto/rea/issues/607)) ([c73742f](https://github.com/morluto/rea/commit/c73742f3003ec6c1469f77ecc9ccb093df636b4a))
+* **managed:** recognize PE Thumb and ARMNT machines ([#605](https://github.com/morluto/rea/issues/605)) ([0ce529a](https://github.com/morluto/rea/commit/0ce529af4e0280fcbd4e647d0fcb0a9ca9f3496e))
+* **mcp:** emit valid schemas for empty arrays ([#535](https://github.com/morluto/rea/issues/535)) ([4007b20](https://github.com/morluto/rea/commit/4007b20fc277b4d20b52cae328dea58ae033be63)), closes [#528](https://github.com/morluto/rea/issues/528)
+* **mcp:** return complete inline Evidence records ([#585](https://github.com/morluto/rea/issues/585)) ([ea9c3da](https://github.com/morluto/rea/commit/ea9c3dab6b2ff4fa943c8ca4fec7ae8b304dbd93)), closes [#551](https://github.com/morluto/rea/issues/551)
+* **native:** capture Mach-O header metadata alongside load commands ([#525](https://github.com/morluto/rea/issues/525)) ([a8195ba](https://github.com/morluto/rea/commit/a8195ba2cc34a37f68d7bb8a8087d73ace40984b))
+* **native:** decode little-endian fat headers ([bede3e3](https://github.com/morluto/rea/commit/bede3e3c60e53d445209096b360a81eaa0c446cc)), closes [#592](https://github.com/morluto/rea/issues/592)
+* **native:** decode Mach protection bits in their proper positions ([#586](https://github.com/morluto/rea/issues/586)) ([6aba6ae](https://github.com/morluto/rea/commit/6aba6ae2316fe6299c855a3db52b221fff63c00c))
+* **native:** inspect Apple dispatch metadata in FAT64 binaries ([#590](https://github.com/morluto/rea/issues/590)) ([f3e6582](https://github.com/morluto/rea/commit/f3e6582e9ed327c5accb8f9068ea0eb9bac49b1f))
+* **native:** inspect the selected universal Mach-O architecture ([#601](https://github.com/morluto/rea/issues/601)) ([2b7bb3b](https://github.com/morluto/rea/commit/2b7bb3bb6a87704c18469768bc82d87e97b5c99c))
+* **native:** match compound otool keys exactly and badge unknown thread entrypoints ([#534](https://github.com/morluto/rea/issues/534)) ([d40502a](https://github.com/morluto/rea/commit/d40502aa3b9a8c87fde49e5887547066128f19ba))
+* **native:** normalize otool line endings and strip plist JSON BOM ([#533](https://github.com/morluto/rea/issues/533)) ([3e4d4d9](https://github.com/morluto/rea/commit/3e4d4d93fdc3eb5fdffda3a8dc8bec43201cdd98))
+* **native:** preserve text-valued load command metadata ([#520](https://github.com/morluto/rea/issues/520)) ([bcfb407](https://github.com/morluto/rea/commit/bcfb4072f2ff665e93477206e14ce4b0581f97b9))
+* **native:** reject signal-terminated command captures ([#608](https://github.com/morluto/rea/issues/608)) ([b81d18e](https://github.com/morluto/rea/commit/b81d18eeee9d93dafcb15e3d723de951509c2612))
+* **native:** reject trailing text in lipo integers and keep multi-word otool keys ([#531](https://github.com/morluto/rea/issues/531)) ([9e30d93](https://github.com/morluto/rea/commit/9e30d93af3d2c0cc1a7536a10e3141f9f2fb499c))
+* **native:** retain lazy dylibs, normalize version-min builds, limit thread entrypoints ([#532](https://github.com/morluto/rea/issues/532)) ([0f77ada](https://github.com/morluto/rea/commit/0f77ada55e6d1d01cb925993d871bf4a94f94bb2))
+* **native:** retain re-exported Mach-O library dependencies ([#516](https://github.com/morluto/rea/issues/516)) ([4a5673e](https://github.com/morluto/rea/commit/4a5673e1dc6f2213cf94121384cff405e390677a))
+* **package:** separate agent and Hopper setup support ([#584](https://github.com/morluto/rea/issues/584)) ([205a977](https://github.com/morluto/rea/commit/205a9777776476b4f361e38f25d1c75baaccd420))
+* **platform:** accept absolute paths for any host and stop blaming the ceiling for a missing grant ([#552](https://github.com/morluto/rea/issues/552)) ([e793e12](https://github.com/morluto/rea/commit/e793e124a27b8087057f58f39028144ea6f6e173))
+* **process:** align provider detach with configured platform ([3fff74f](https://github.com/morluto/rea/commit/3fff74fb5bb9725be2456e8c39bc0b98181d0687))
+* repair boundary contracts across CLI and MCP ([#597](https://github.com/morluto/rea/issues/597)) ([9c25dc4](https://github.com/morluto/rea/commit/9c25dc4ed2915a81fc83a1d4dc22e7ba814b8dff))
+* **replay:** keep __proto__ own properties and reject symbol-keyed results ([#540](https://github.com/morluto/rea/issues/540)) ([05bb630](https://github.com/morluto/rea/commit/05bb630a00aa521229cde53ded9a5345b8bd1a2b))
+* **replay:** link the complete ESM graph before evaluating ([#515](https://github.com/morluto/rea/issues/515)) ([4200a42](https://github.com/morluto/rea/commit/4200a425d50eab80847edf3baa9ea4c5244e8be8))
+* **replay:** preserve CommonJS object as ESM default export ([#519](https://github.com/morluto/rea/issues/519)) ([2df6b51](https://github.com/morluto/rea/commit/2df6b51ebb87e8d406d6201d8f3158aefefa7cc5))
+* **replay:** preserve Date call and explicit constructor semantics ([#512](https://github.com/morluto/rea/issues/512)) ([9975bd2](https://github.com/morluto/rea/commit/9975bd23cdba7e196ca97c3fcec41a6eee925e57))
+* **replay:** preserve sparse array positions in result projection ([#522](https://github.com/morluto/rea/issues/522)) ([9d1c363](https://github.com/morluto/rea/commit/9d1c3631b8deccb5fb91906130f38e3f24aa254e))
+* **replay:** share one seeded generator and present builtins with real identity ([#539](https://github.com/morluto/rea/issues/539)) ([5b51fa0](https://github.com/morluto/rea/commit/5b51fa01e2391cd4b6d5e9ba7b6aa7615de891b1))
+* **repo:** keep dependency links out of version control ([#617](https://github.com/morluto/rea/issues/617)) ([b3223e3](https://github.com/morluto/rea/commit/b3223e3f61a23b79152939ef755aca95e7640f09))
+* **skill:** remove obsolete grants and audit tool effects ([2919def](https://github.com/morluto/rea/commit/2919def828b3c8fc7947989f1de3f4f4ac4cdd36))
+* **test:** improve capture reliability and runner cleanup ([#609](https://github.com/morluto/rea/issues/609)) ([d19686a](https://github.com/morluto/rea/commit/d19686a2a5122c691f7885997906ecb31dd9827d))
+* **tools:** simplify direct invocation and harden boundary contracts ([#555](https://github.com/morluto/rea/issues/555)) ([b5e9891](https://github.com/morluto/rea/commit/b5e98915c60968213141f33839e0c5c4b34df4db))
+* **web:** retain uncertainty for incomplete capture inventories ([#513](https://github.com/morluto/rea/issues/513)) ([d8c18f6](https://github.com/morluto/rea/commit/d8c18f604f292c95b6b0b185d23517cb6881c5fb))
+* **win32:** probe .cmd/.bat runtime shims via cmd.exe to avoid spawn EINVAL ([#505](https://github.com/morluto/rea/issues/505)) ([31ed005](https://github.com/morluto/rea/commit/31ed005183c315f1bc72f6e10730a47be73d7f1c))
+* **workflows:** preserve punctuation in filesystem source paths ([#521](https://github.com/morluto/rea/issues/521)) ([5b28a8b](https://github.com/morluto/rea/commit/5b28a8b331259e026678e681210e9c3c4f48f2fa))
+* **workflows:** retain container presence in export shape comparisons ([#523](https://github.com/morluto/rea/issues/523)) ([3854458](https://github.com/morluto/rea/commit/385445804ab45605a47edcb996ebbc026e2f0a43))
+
+
+### Code Refactoring
+
+* **config:** take the environment as an input at every configuration read ([#554](https://github.com/morluto/rea/issues/554)) ([53fe7d6](https://github.com/morluto/rea/commit/53fe7d6d3b3630472124563ccafdad3f4964b4bc))
+* **domain:** consolidate duplicated semantic member and literal helpers ([#550](https://github.com/morluto/rea/issues/550)) ([09830da](https://github.com/morluto/rea/commit/09830dad053f2b1440e0b1cde63747606684be4b))
+* **domain:** own digest and prefixed identifier shapes in one module ([#547](https://github.com/morluto/rea/issues/547)) ([ea58834](https://github.com/morluto/rea/commit/ea5883494036ddb30d138fdb381d54b2d9808b49))
+* **host:** inject platform and environment instead of reading them ambiently ([#549](https://github.com/morluto/rea/issues/549)) ([5b59b87](https://github.com/morluto/rea/commit/5b59b87726b459cf9887dd4edc176981ef4e6afc))
+* simplify runtime tools and remove replay engines ([#572](https://github.com/morluto/rea/issues/572)) ([e07b816](https://github.com/morluto/rea/commit/e07b81649e96668e5ce166cfc6db3b59a7777697))
+
+
+### Documentation
+
+* add boundary contract guidance ([42e6a8a](https://github.com/morluto/rea/commit/42e6a8a6f6da4c3aebb10235a27d471dc2590954))
+* add Discord community links to README ([79bf26f](https://github.com/morluto/rea/commit/79bf26f33f980c20367986080a16d4a9f7952048))
+* align roadmap with direct tool use ([eba709e](https://github.com/morluto/rea/commit/eba709e5c096796b0afe3ce9203659df9eaf0a7d))
+* align translated READMEs and clarify support guides ([5b383b2](https://github.com/morluto/rea/commit/5b383b2ddd4195cb15e412b81853955b38419721))
+* clarify README wording and analysis tool support ([97822f2](https://github.com/morluto/rea/commit/97822f233be49a8b582b4c2aa982af3854ca0bb2))
+* move README image above Discord community ([ad86d39](https://github.com/morluto/rea/commit/ad86d39d2cb4f2d1ce0da08a17d5f7948c0797ec))
+* place community invitation below README navigation ([69a45e0](https://github.com/morluto/rea/commit/69a45e0bbc03d87624de866a821b976e4aaca069))
+* place Discord community below setup command ([778e464](https://github.com/morluto/rea/commit/778e464c206ba75a2f94edaad3c05e8bf63bed10))
+* place setup command above README image ([c6d3bdf](https://github.com/morluto/rea/commit/c6d3bdf597d9cd75a6f7396236e1a47f5ee4288d))
+
+
+### Tests
+
+* **setup:** isolate client fixtures across host platforms ([f73bb0f](https://github.com/morluto/rea/commit/f73bb0fe116678543a73d13f58eaa3b48133afc5))
+
+## [3.2.1](https://github.com/morluto/rea/compare/rea-agents-3.2.0...rea-agents-3.2.1) (2026-10-03)
+
+
+### Bug Fixes
+
+* **release:** tolerate npm registry propagation delay ([726b730](https://github.com/morluto/rea/commit/726b730b84830b208725df50fa0251ece1fa199f))
+
+
+### Tests
+
+* **release:** accept guarded npm publishing ([b7bc855](https://github.com/morluto/rea/commit/b7bc8554928c8eca9c29842c77e4021c1e42e054))
+
+## [3.2.0](https://github.com/morluto/rea/compare/rea-agents-3.1.0...rea-agents-3.2.0) (2026-10-03)
+
+
+### Features
+
+* **native:** add investigation features ([#486](https://github.com/morluto/rea/issues/486)) ([ed933d1](https://github.com/morluto/rea/commit/ed933d18933814e3957a920972ccf91117d4ed87))
+
+
+### Bug Fixes
+
+* **artifacts:** stabilize extraction approval ([7eb1a95](https://github.com/morluto/rea/commit/7eb1a9500c62b66716878c18ee442c324a715a88))
+* **browser:** reject unknown Electron input fields ([1860d4f](https://github.com/morluto/rea/commit/1860d4f0e531919ee9b10bec7ad8db43e18a291b))
+* **ci:** retain artifacts for delayed reruns ([07888ec](https://github.com/morluto/rea/commit/07888ec096f69753a1535703fb7b3c3070e786b7))
+* **cli:** remove ignored result limits ([f3645aa](https://github.com/morluto/rea/commit/f3645aa51e55c5207f7b9b1f0156ffaef7aaed42))
+* consolidate boundary ownership and cleanup failure paths ([#477](https://github.com/morluto/rea/issues/477)) ([2160d4f](https://github.com/morluto/rea/commit/2160d4fae581243990e539a9c401d1b8824e1763))
+* **contracts:** align byte read schema with provider ([f580d9d](https://github.com/morluto/rea/commit/f580d9d07382bc9642bce896d431c827955339e4))
+* **ghidra:** return complete native analysis results ([a66e43a](https://github.com/morluto/rea/commit/a66e43a99dda1604c8250c9eb73aa8ef000371c9))
+* **managed:** retain every source location ([33b2099](https://github.com/morluto/rea/commit/33b20991c455306d66f8687a9f80ea22073d4207))
+* **process:** capture complete host probe output ([6c68ff5](https://github.com/morluto/rea/commit/6c68ff565fe1196fd8c7a63598e8bd94098abc3c))
+* **runtime:** make observed target role optional ([593a8e1](https://github.com/morluto/rea/commit/593a8e12ceac1cfe350493cfe6b0d1360eb85f7c))
+* **runtime:** retain complete reconciled graph content ([bedd55a](https://github.com/morluto/rea/commit/bedd55a4b4ccc9a0c1441d3836138b323de6d126))
+
+
+### Code Refactoring
+
+* **analysis:** remove caller-selected result caps ([a8c58c6](https://github.com/morluto/rea/commit/a8c58c6605ac37a8b504167732affc5ce4fc772f))
+* **analysis:** remove fixed result quotas ([20152a9](https://github.com/morluto/rea/commit/20152a9872dd035714beb5ef5b8898a9b4d1d6c4))
+* **artifacts:** consolidate inventory into inspection ([0fe96d9](https://github.com/morluto/rea/commit/0fe96d92dfefbaf28d2abfd5e237f6d0e82eee7b))
+* **artifact:** simplify extraction and inventory results ([07ff8b3](https://github.com/morluto/rea/commit/07ff8b30ee497d9f4477a0a9ae97f3f5addbb45a))
+* **artifacts:** remove duplicate inventory wrapper ([aa6eee1](https://github.com/morluto/rea/commit/aa6eee1a712d1a319bbaed5387aa5f4429755a1f))
+* **artifacts:** remove selectors and traversal quotas ([8c24272](https://github.com/morluto/rea/commit/8c24272ee7e6d30b1493ee7ccd63e45734fe2f95))
+* **artifacts:** select extraction by logical path ([7ba3580](https://github.com/morluto/rea/commit/7ba3580c860463adcd5edc73b7a80f34b92480cf))
+* **browser:** remove arbitrary capture ceilings ([5dd3b46](https://github.com/morluto/rea/commit/5dd3b4655e21222a6598bf8cbc0be90f3cbf5e0f))
+* **browser:** return complete observation evidence ([0e2738f](https://github.com/morluto/rea/commit/0e2738ffb6aa35bb06fe01d0af864aec968570cf))
+* **browser:** return complete scenario observations ([e80fe41](https://github.com/morluto/rea/commit/e80fe414b13294446f959b382cb240c806cfe000))
+* **browser:** share authorized main-frame polling ([eec75ce](https://github.com/morluto/rea/commit/eec75ce918cbac576fd217847911793331aa32a0))
+* **browser:** share canonical identity digest ([a6d9e49](https://github.com/morluto/rea/commit/a6d9e49ab46150c8b757f5bdd5f80d3a8ff52f26))
+* **contracts:** remove duplicate schema aliases ([4593c29](https://github.com/morluto/rea/commit/4593c29b64d3f6c43ddb19228da6231f1055eba4))
+* **contracts:** simplify workflows and drop readiness tool ([7acac61](https://github.com/morluto/rea/commit/7acac615ca2b8e3f4edd65fd8a08b237f85b5ac7))
+* **coverage:** evaluate inline without workspaces ([9e76054](https://github.com/morluto/rea/commit/9e7605482acf2de77ad04c5c5e03ac4280a11d7f))
+* **domain:** encode comparison and lifecycle states exactly ([#473](https://github.com/morluto/rea/issues/473)) ([d65730c](https://github.com/morluto/rea/commit/d65730c4c24ab6183426516d4564e6c25294b35d))
+* **domain:** share AST property name reader ([4f4cc59](https://github.com/morluto/rea/commit/4f4cc59873ec704811649aeca8a49e3bcdbdf324))
+* **electron:** retain complete active observations ([e8c56e0](https://github.com/morluto/rea/commit/e8c56e0c0aeb114e09636ad1841d8fd73720b5cc))
+* **errors:** remove stale workspace failures ([f570d40](https://github.com/morluto/rea/commit/f570d40f50bc8621b32ba4e255660ed1b1398356))
+* **evidence:** remove obsolete ID resolvers ([a3920e2](https://github.com/morluto/rea/commit/a3920e2abd915eba31b59413710315a85caf1afa))
+* **evidence:** remove session ledger quotas ([dca293a](https://github.com/morluto/rea/commit/dca293a446fa86767fb4bed6fe734f09b6cfafde))
+* **files:** use caller paths for local evidence files ([c34efca](https://github.com/morluto/rea/commit/c34efca4cd322d4816ab4cd526a7475489edc814))
+* **ghidra:** remove redundant schema markers ([c2a6f4b](https://github.com/morluto/rea/commit/c2a6f4bc437671c25ba318d21b82818c8e6bf2ce))
+* **javascript:** remove analysis ceilings ([9aec690](https://github.com/morluto/rea/commit/9aec6908b5c7ad50da6882415700cbe53c3f62ed))
+* **managed:** derive inspection from PE CLI extents ([dfad09e](https://github.com/morluto/rea/commit/dfad09e3b5769b079bf2d07382aee310d682724f))
+* **mcp:** simplify evidence and workflows ([6740ed5](https://github.com/morluto/rea/commit/6740ed5215578eaaf33c785d6245649d76a0411c))
+* **mcp:** simplify tool inputs and inline results ([f55c2b9](https://github.com/morluto/rea/commit/f55c2b92676e4a7eb06efbc8d9a908a7de62541a))
+* **mcp:** simplify workflow and observation scope ([34d00fd](https://github.com/morluto/rea/commit/34d00fd323c793278c6ed126308c58e2fc7efd54))
+* **observation:** internalize capture budgets ([7b3c797](https://github.com/morluto/rea/commit/7b3c7972377c7f77b1328e7d1de3f54835bc1397))
+* **observation:** retain complete tool results ([fa2b6c5](https://github.com/morluto/rea/commit/fa2b6c5a61adcb75c4c2773ed1c9f7dba83fc1d3))
+* **observation:** return complete inventories ([c523c38](https://github.com/morluto/rea/commit/c523c38027f536e8319eb2acc1840274c5bc5986))
+* **permission:** remove unused authorization helpers ([1b0ab75](https://github.com/morluto/rea/commit/1b0ab75a84ccdcf036ccfc019d1890b2d626699a))
+* **process:** remove fixed scenario ceilings ([abf7c11](https://github.com/morluto/rea/commit/abf7c1142e759a291d2267fedf15b0dd444a5684))
+* **process:** remove redundant schema version markers ([b3aca52](https://github.com/morluto/rea/commit/b3aca5289bf973ffb4072253eebe86e0acced347))
+* **process:** remove request count ceilings ([f2dc749](https://github.com/morluto/rea/commit/f2dc749c862a16d056de53e95914a9a411592583))
+* **process:** remove unused paired experiment ([e1d755f](https://github.com/morluto/rea/commit/e1d755f7cd574860f59965a6244dbd43f5032f2c))
+* **prompts:** make tool workflows optional ([3fd9650](https://github.com/morluto/rea/commit/3fd96506f223889a2d327cc7c97a95bf48ccb594))
+* **reference:** share graph index projections ([6ee87fb](https://github.com/morluto/rea/commit/6ee87fbf2defcb10a17352b36ebeed67c6ce6dc5))
+* remove cross-version investigation workflow ([81996df](https://github.com/morluto/rea/commit/81996df7a59ae6efb0f7be6687af89e66c64cdcb))
+* **replay:** share sandbox probe arguments ([9fca6c0](https://github.com/morluto/rea/commit/9fca6c0296ac360f9d2c838440b24d2ea79234b5))
+* **replay:** simplify runtime value checks ([60cb68a](https://github.com/morluto/rea/commit/60cb68a276b012964b08c18e9d60af22e64c468f))
+* return complete analysis results inline ([a2a3243](https://github.com/morluto/rea/commit/a2a3243ea874ee1662c62a83ced63be218e0218e))
+* return complete tool results inline ([0d96275](https://github.com/morluto/rea/commit/0d96275b6887b72519d2bc54f72012db6a8e482c))
+* **runtime:** retain complete reconciliation outputs ([79ea571](https://github.com/morluto/rea/commit/79ea571512a1f55200eb5520d6c56104dba54e5b))
+* **schema:** remove data-only version markers ([5457f4a](https://github.com/morluto/rea/commit/5457f4a2bceccb9c40e19a9986964025f279fc91))
+* **server:** remove registration alias ([8097ec4](https://github.com/morluto/rea/commit/8097ec456a14992b578057438be8a6e89a076cdf))
+* **server:** use canonical elicitation type ([bb6a58c](https://github.com/morluto/rea/commit/bb6a58c2a7eec15fb5f224376230398b51d1b952))
+* **test:** colocate pure-domain tests and reduce test debt ([#471](https://github.com/morluto/rea/issues/471)) ([e91c8c3](https://github.com/morluto/rea/commit/e91c8c39c2acddc4389ed0d01950d1954c472e47))
+* **test:** keep coverage at behavioral boundaries ([#474](https://github.com/morluto/rea/issues/474)) ([d4dc940](https://github.com/morluto/rea/commit/d4dc940bd871089ffa1b42d3475798b2f4f9c992))
+* **tools:** remove arbitrary workflow ceilings ([5f73cb0](https://github.com/morluto/rea/commit/5f73cb061b6fec532d1cccf5a8bce59855823fa4))
+* **tools:** remove artificial analysis ceilings ([2f08c7c](https://github.com/morluto/rea/commit/2f08c7c932d3619a481709935f07da59de3d3b27))
+* **tools:** remove redundant limits and acknowledgements ([bd0e341](https://github.com/morluto/rea/commit/bd0e34157239613aed7aa9315df0e97d03d8636c))
+* **tools:** remove remaining arbitrary workflow caps ([ecf3ed8](https://github.com/morluto/rea/commit/ecf3ed8bdb9ef7a83e7a2fb23443eced6c3824b0))
+* **tools:** return complete analysis results inline ([2a6eb41](https://github.com/morluto/rea/commit/2a6eb41147e496b9e044011fa3b755ef74388c51))
+* **workflows:** simplify evidence reference inputs ([24e1fa9](https://github.com/morluto/rea/commit/24e1fa9a76e447cff318da9f48c7adb659a1f8ab))
+
+
+### Documentation
+
+* add REA tool design guidance ([#485](https://github.com/morluto/rea/issues/485)) ([36aeec9](https://github.com/morluto/rea/commit/36aeec95863ca28d3e3aa5bec75a45d3824e17f5))
+* clarify aggregate context tools ([c7e207c](https://github.com/morluto/rea/commit/c7e207c290e376db5c2f210f9ac08fe170ef3ec4))
+* clarify MCP tool design guidance ([36aeec9](https://github.com/morluto/rea/commit/36aeec95863ca28d3e3aa5bec75a45d3824e17f5))
+* correct inline evidence and Hopper behavior ([bf9cce1](https://github.com/morluto/rea/commit/bf9cce1aef89a769320d217e82b895b086880e69))
+* describe complete application analysis outputs ([271b162](https://github.com/morluto/rea/commit/271b1620e68f3a6bbc69f28aa4c4d18d5c453baf))
+* generalize reverse-engineering workflow ([#488](https://github.com/morluto/rea/issues/488)) ([4ecc7a7](https://github.com/morluto/rea/commit/4ecc7a72f2d6d78b8d9c59a146e532fe552c40bb))
+* improve GitHub issue and pull request templates ([c490d85](https://github.com/morluto/rea/commit/c490d85045de07488e01747db9c9f77d264b2e36))
+* prioritize reusable analysis primitives ([#493](https://github.com/morluto/rea/issues/493)) ([9dd72c4](https://github.com/morluto/rea/commit/9dd72c4911841671594570677f5ba6e3992d076d))
+* refresh managed conformance manifest ([23e56c5](https://github.com/morluto/rea/commit/23e56c517c08abcafe3a81919215433458aef27e))
+* refresh tool catalog and cleanup audit fixtures ([53db3a4](https://github.com/morluto/rea/commit/53db3a476b2881f498a5d6c87195e783268c1988))
+* regenerate tool and evidence catalogs ([2f604a3](https://github.com/morluto/rea/commit/2f604a3c3ad037a68da4c33a30cb5316983b070f))
+* regenerate tool and evidence catalogs ([f2bbd59](https://github.com/morluto/rea/commit/f2bbd5957eccac6164b3f12db87921ffb09bdcf2))
+* **tools:** clarify complete inline results ([3b64c81](https://github.com/morluto/rea/commit/3b64c813cf8bcd0cdd262d0a3d5950819f320a12))
+* **tools:** clarify complete inline workflows ([4168174](https://github.com/morluto/rea/commit/41681742ccea83a7956e7bc303da4aa223ed4877))
+* **tools:** describe uncapped tool behavior accurately ([4cea84d](https://github.com/morluto/rea/commit/4cea84d7cbb0508e6c0dde36a2a0542855681f95))
+* **tools:** update inline workflow guidance ([4ad937c](https://github.com/morluto/rea/commit/4ad937c6caeec89ded592ea82dec4fa13ea17d8c))
+
+
+### Tests
+
+* **artifacts:** exercise argument-free extraction preflight ([a6d5b3e](https://github.com/morluto/rea/commit/a6d5b3ea9d1f53afeda33ef53fe50f42feac2343))
+* **browser:** assert strict inputs without legacy fields ([9ddf22e](https://github.com/morluto/rea/commit/9ddf22e1962803bf06d54b2e577a0c03a3f3ad48))
+* **browser:** cover complete screenshot output ([3f547ea](https://github.com/morluto/rea/commit/3f547eafa4c6f27b8264025c754392161687908e))
+* **browser:** remove stale input field assertion ([60c110d](https://github.com/morluto/rea/commit/60c110d97b1b22c010b8597965b3ad09f4f51480))
+* **cli:** consolidate duplicate setup journey ([9bd7e2c](https://github.com/morluto/rea/commit/9bd7e2cb459d0354ee2c406555de9e427c549086))
+* **cli:** remove duplicate browser discovery case ([dcb0362](https://github.com/morluto/rea/commit/dcb036292e975c81780dbf7a711fd1a565a13a10))
+* **conformance:** remove fixture generator test option ([ea853ce](https://github.com/morluto/rea/commit/ea853cebde5641dc9c12ef59005de84197463467))
+* **contracts:** remove duplicate tool inventories ([0ae3c08](https://github.com/morluto/rea/commit/0ae3c0837b387e53686bcd6e8aa03cb29f80458a))
+* **hopper:** name regex search assertion accurately ([9240bd8](https://github.com/morluto/rea/commit/9240bd8d166ffee93a90fd55c5de4b58d8ff6ad4))
+* **hopper:** remove dossier identity assertion ([b5c0b5b](https://github.com/morluto/rea/commit/b5c0b5b53e2d15dd6da9d4e8b1d3c3c21a16c409))
+* **mcp:** align workflow assertions with current guidance ([f8bb113](https://github.com/morluto/rea/commit/f8bb113c22cf23916a8cd8a5d77734ccaf63fd08))
+* **mcp:** consolidate catalog inventory checks ([3afcd64](https://github.com/morluto/rea/commit/3afcd641462bbd99ebdc3bf2fc8264e2c3344c09))
+* **mcp:** validate defaults at tool boundary ([21241d2](https://github.com/morluto/rea/commit/21241d2323d323f405b3cff4692e01364b6ddbde))
+* remove duplicate export schema acceptance ([b783e7f](https://github.com/morluto/rea/commit/b783e7febef8c22b41817a61a7f8293393ac6425))
+* remove obsolete schema version assertions ([fe342fa](https://github.com/morluto/rea/commit/fe342faa832ec9b17a6fb1dd85b1cf269b33cf1b))
+* remove stale limits and handoff expectations ([acf33d6](https://github.com/morluto/rea/commit/acf33d6df272873728aaa7527c5d43fa2a13132b))
+* remove vacuous and duplicate assertions ([56e2bf7](https://github.com/morluto/rea/commit/56e2bf7696e6ccbc3e4b5baf9249c6d4152f4a43))
+* remove Vitest config test exports ([d6e545c](https://github.com/morluto/rea/commit/d6e545cc4832ed47cc98d974aa8e4aa9453afb98))
+* replace brittle workflow and readme checks ([b3529aa](https://github.com/morluto/rea/commit/b3529aa327026472798a5f0971dcb325d221ddc6))
+* replace implementation lock-in with behavioural assertions ([#498](https://github.com/morluto/rea/issues/498)) ([7ee3f23](https://github.com/morluto/rea/commit/7ee3f236a9f753dfc90d84f95f20598e4e45fd0d))
+* **replay:** remove duplicate schema coverage ([4ec2343](https://github.com/morluto/rea/commit/4ec2343d91925e583b15d5404af2eabaf6ffed0f))
+
+## [3.1.0](https://github.com/morluto/rea/compare/rea-agents-3.0.0...rea-agents-3.1.0) (2026-08-09)
+
+
+### Features
+
+* **electron:** add autonomous Electron runtime analysis ([#464](https://github.com/morluto/rea/issues/464)) ([8f229ed](https://github.com/morluto/rea/commit/8f229ede70c0a4e224c1cf71d61487e17b779d6a))
+
+
+### Bug Fixes
+
+* **ci:** guard Release Please PR branch parsing ([84cc819](https://github.com/morluto/rea/commit/84cc819284b9ce7ee648850c85d5daf3a33e5a24))
+* **ci:** guard release PR branch parsing ([6838b6b](https://github.com/morluto/rea/commit/6838b6bff9ab5c400432caefd8c8737b86c41f07))
+* harden evidence lifecycle and MCP contracts ([5155924](https://github.com/morluto/rea/commit/51559245d2e1c2d7550cfe489716950fe6154bd0))
+* harden structured configuration comparisons ([#467](https://github.com/morluto/rea/issues/467)) ([6901edc](https://github.com/morluto/rea/commit/6901edc05d56063bdbe8be96511b1b21863630b5))
+* **npm:** preserve explicit setup versions ([#465](https://github.com/morluto/rea/issues/465)) ([1783bf6](https://github.com/morluto/rea/commit/1783bf6dfdd4ec11e824870ce5b1a2f5a321450e))
+
+
+### Code Refactoring
+
+* **mcp:** make analysis states unrepresentable ([#468](https://github.com/morluto/rea/issues/468)) ([b8a9da0](https://github.com/morluto/rea/commit/b8a9da0c0f9f0b2b022a350d2c7c671d1fa3f886))
+
+
+### Documentation
+
+* clarify agent reverse-engineering promise ([ed4a628](https://github.com/morluto/rea/commit/ed4a62871f7924948e3774ae6cf880514a560ff4))
+* clarify the agent reverse-engineering promise ([#466](https://github.com/morluto/rea/issues/466)) ([ed4a628](https://github.com/morluto/rea/commit/ed4a62871f7924948e3774ae6cf880514a560ff4))
+* **npm:** simplify current setup command ([#469](https://github.com/morluto/rea/issues/469)) ([8b62b1a](https://github.com/morluto/rea/commit/8b62b1a71586e9409e4dd645f3d4947ef61e59b1))
+
+## [3.0.0](https://github.com/morluto/rea/compare/rea-agents-2.7.0...rea-agents-3.0.0) (2026-08-01)
+
+
+### ⚠ BREAKING CHANGES
+
+* export_evidence_bundle now requires a filesystem path and no longer returns an inline bundle.
+
+### Features
+
+* make evidence bundles canonical MCP resources ([1712e6d](https://github.com/morluto/rea/commit/1712e6d821965ce5edc3880fe4ebab2e3cc02fd4))
+
+
+### Bug Fixes
+
+* address MCP resource review feedback ([f3b3fb0](https://github.com/morluto/rea/commit/f3b3fb07ded3d1ad72c0a4f24ca3147ef9722c5d))
+* align aggregate tools with session capabilities ([ede91ff](https://github.com/morluto/rea/commit/ede91ff1f04563001f695ec3869daeb3c826154a))
+* **ci:** align Vitest project worker budgets ([f47ee1a](https://github.com/morluto/rea/commit/f47ee1abb4fc8dbd5da3fa13c5870d6580b28bfa))
+* **ci:** allow documented public type aliases ([97f6a0f](https://github.com/morluto/rea/commit/97f6a0f3fd2ebf8fa884d7f7ba6e1c66ecfe80e0))
+* **ci:** make coverage report merging composable ([788f405](https://github.com/morluto/rea/commit/788f4057aee65dfae441249d2c9789bb996912a7))
+* **ci:** stabilize Vitest project routing and shards ([f07acde](https://github.com/morluto/rea/commit/f07acde513d4c74d027b66e143cf5072246b412b))
+* **errors:** preserve actionable analysis diagnostics ([0f96bf3](https://github.com/morluto/rea/commit/0f96bf365c330a7eb121a173bfa140cc2b652764))
+* **mcp:** clarify routing and advertise input examples ([969519c](https://github.com/morluto/rea/commit/969519c00f31b5bc0f23dcffe8867e091461fda6))
+* **mcp:** clarify target routing and caller diagnostics ([3e1e8cd](https://github.com/morluto/rea/commit/3e1e8cd3f829e6d3ac8b3c63d979f9db84dec826))
+* **test:** bound boundary worker pressure ([935721d](https://github.com/morluto/rea/commit/935721df10d25d23621dbc2be90d334644e0858c))
+* **test:** honor boundary ownership and public aliases ([92a1c33](https://github.com/morluto/rea/commit/92a1c33625ff88d81581554687e7708dd3c91e2d))
+* **test:** retain subprocess coverage and cleanup ([7f46bb1](https://github.com/morluto/rea/commit/7f46bb18241bf3815e5e01816277d0cafe8f923b))
+* **test:** retain subprocess coverage and cleanup ([dae2b9c](https://github.com/morluto/rea/commit/dae2b9cc4e8753827702ada6e51f2ee01811cfed))
+* **test:** stabilize boundary timing ([f0d8cda](https://github.com/morluto/rea/commit/f0d8cdafa86bafdc6ad5d8c2d23a97ef583b53d5))
+* **verify:** follow dynamic Hopper tool availability ([281e41f](https://github.com/morluto/rea/commit/281e41f7660066addcc7a204128fb1f49bf7a674))
+
+
+### Code Refactoring
+
+* preserve provider-neutral runtime seams ([a8161f0](https://github.com/morluto/rea/commit/a8161f0e5540f3261a08015dfe56a4254980c064))
+
+
+### Documentation
+
+* document resource snapshot workflow ([2a45d8d](https://github.com/morluto/rea/commit/2a45d8de7d52d0a234672d03c7dae794859f8ced))
+* refresh generated SDK metadata ([c824db1](https://github.com/morluto/rea/commit/c824db1ab7aed2886e9050c1b7fe2136b77e3698))
+* refresh managed completion manifest ([59d4659](https://github.com/morluto/rea/commit/59d465971ea86f933e9037fa32ac2787d935d076))
+
+
+### Tests
+
+* **contracts:** cover validation branches ([8ccdb33](https://github.com/morluto/rea/commit/8ccdb33dd25922e039140bcd1e3cbf3d5acee837))
+* derive MCP SDK identity expectations ([ab4193c](https://github.com/morluto/rea/commit/ab4193c1f48020ff6baa42cb75e033110ee72b36))
+* **eval:** cover navigation and address tool routing ([ba098f2](https://github.com/morluto/rea/commit/ba098f24e59efbd567ae8438f65e31af0f0b8050))
+* overhaul deterministic suite architecture ([48053d1](https://github.com/morluto/rea/commit/48053d1032324cce6e2fe782ecba43d1b91a1bba))
+* overhaul deterministic suite architecture ([513d9b1](https://github.com/morluto/rea/commit/513d9b15558f9174a8e2c0ab00e31cbc05dbaba7))
+* **package:** verify npx upgrade on published releases ([7b6f7be](https://github.com/morluto/rea/commit/7b6f7becd257170cebf80f4f9f9c385b0000f074))
+* **package:** verify npx upgrade on published releases ([1f8ad7b](https://github.com/morluto/rea/commit/1f8ad7bc68f50d396715116467f19524da7e05e6))
+
+
+### Continuous Integration
+
+* document deterministic suite ownership ([3c42403](https://github.com/morluto/rea/commit/3c42403b78b53e7b5358c2bca9bc156ef2c32efd))
+
+## [2.7.0](https://github.com/morluto/rea/compare/rea-agents-2.6.0...rea-agents-2.7.0) (2026-07-28)
+
+
+### Features
+
+* **bytecode:** add JVM and Python bytecode providers ([1a75f8d](https://github.com/morluto/rea/commit/1a75f8dc236d8269a5fa07e042471ac79e79d728))
+* **bytecode:** add JVM and Python bytecode providers ([4e0127d](https://github.com/morluto/rea/commit/4e0127d620377e5dc7e09444f9db0977e3d47ed1)), closes [#367](https://github.com/morluto/rea/issues/367)
+* **conformance:** add portable conformance export package format ([91fb87d](https://github.com/morluto/rea/commit/91fb87d17e7885439762667c96167af79a2e044e))
+* **conformance:** add portable conformance export package format ([4ee30e4](https://github.com/morluto/rea/commit/4ee30e4145db9b496158cd980af05e22010856a7))
+* **metadata:** add deeper ObjC/Swift metadata and database save/licensing ([4602efd](https://github.com/morluto/rea/commit/4602efd27cbf8701c2dc15542042bc9d9ef76e7f))
+* **metadata:** add deeper ObjC/Swift metadata and database save/licensing ([d7a0753](https://github.com/morluto/rea/commit/d7a07535b0fb61ee8f9ae648bb673dda23290653)), closes [#353](https://github.com/morluto/rea/issues/353)
+* **mobile:** add Android APK/AAB/DEX and iOS IPA static investigation providers ([18624df](https://github.com/morluto/rea/commit/18624df5724a2c4d14a4e8e178660456424b2344))
+* **mobile:** add Android APK/AAB/DEX and iOS IPA static investigation providers ([fdeeb27](https://github.com/morluto/rea/commit/fdeeb27f23041c19b5857fe7873106f0cd9c6244)), closes [#366](https://github.com/morluto/rea/issues/366)
+* **package:** add MSIX/MSI/AppX package, resource, and signature analysis ([0ef1b91](https://github.com/morluto/rea/commit/0ef1b91cf31f6ca53991ee5ca60b4a22f430c01e))
+* **package:** add MSIX/MSI/AppX package, resource, and signature analysis ([6c03f83](https://github.com/morluto/rea/commit/6c03f83b1bd55095d136aeb3700733383365ecc4)), closes [#363](https://github.com/morluto/rea/issues/363)
+* **pe:** add broader PE/COFF/PDB static inspection ([f942558](https://github.com/morluto/rea/commit/f9425585736a89165390178f245b0f0f5d6cdacf))
+* **pe:** add broader PE/COFF/PDB static inspection ([94e6600](https://github.com/morluto/rea/commit/94e6600faf89436e4e2689fda8050792307b268d)), closes [#362](https://github.com/morluto/rea/issues/362)
+* **process:** replace procfs sampling with event-backed process-tree capture ([a5e355a](https://github.com/morluto/rea/commit/a5e355a3d52b19e89535449cd923c35e56ccc60d))
+* **process:** replace procfs sampling with event-backed process-tree capture ([d5d2e56](https://github.com/morluto/rea/commit/d5d2e56d0461cb0debba540bc658a9938ac30599)), closes [#332](https://github.com/morluto/rea/issues/332)
+* **protocol:** add custom TCP/UDP/IPC/XPC and auth-flow capture ([1fb22b4](https://github.com/morluto/rea/commit/1fb22b4c21e3a5581f3928003cc32ddc1cc9530b))
+* **protocol:** add custom TCP/UDP/IPC/XPC and auth-flow capture ([6fa6f9b](https://github.com/morluto/rea/commit/6fa6f9b6d9595a480a590766dadcfebb8e7111b5)), closes [#365](https://github.com/morluto/rea/issues/365)
+* **protocol:** add gRPC/Protobuf and JSON-RPC/MessagePack capture ([54153ed](https://github.com/morluto/rea/commit/54153ed62cb4f55d1efd4794490c2481ab34e212))
+* **protocol:** add gRPC/Protobuf and JSON-RPC/MessagePack capture ([3f336fe](https://github.com/morluto/rea/commit/3f336fefb132971bc6bb37b2b59aa01a5e3be5ca)), closes [#364](https://github.com/morluto/rea/issues/364)
+
+
+### Bug Fixes
+
+* **catalog:** digest provider projections ([645668b](https://github.com/morluto/rea/commit/645668b70dfdff74582d4ac26cda417947231764))
+* **catalog:** digest provider projections ([c4cd033](https://github.com/morluto/rea/commit/c4cd0330e00eeb8e272abbf6ecc6ce961e72f317))
+
 ## [2.6.0](https://github.com/morluto/rea/compare/rea-agents-2.5.1...rea-agents-2.6.0) (2026-07-26)
 
 

CONTRIBUTING.md

@@ -2,13 +2,15 @@
 
 REA welcomes focused bug fixes, documentation improvements, tests, and reverse-engineering workflow enhancements. Open an issue before a large contract or architecture change so its scope can be agreed before implementation.
 
+When adding or changing an MCP tool, follow the [tool design guide](docs/tool-design.md) and preserve the canonical contracts and generated catalog.
+
 ## Development setup
 
 REA development requires Node.js 24.18.x and npm 11.16.x. Real-Hopper verification additionally requires either macOS 12+ or an officially supported Linux host (Ubuntu 24.04+, Fedora 41+, or 64-bit Arch) and an installed Hopper application. Linux demo verification uses its own private Xvfb display and does not require a desktop session. Run `nvm use` before installing dependencies.
 
 ```bash
 npm ci
-npm test
+npm run check:fast
 ```
 
 `npm ci` installs the exact dependencies and prepares the Husky hooks without
@@ -18,40 +20,46 @@ Turbo. Turbo caches deterministic builds and static checks across Git
 worktrees. After a package, lockfile, or managed-skill version change, run
 `npm run metadata:generate` before building.
 
-Keep dependencies flowing inward through the existing domain, contracts, provider, application, server, and adapter layers. Parse unknown values at process and protocol boundaries, model expected failures with `Result`, and preserve the canonical tool inventory defined by `TOOL_CONTRACTS` unless a deliberate contract change updates every verifier, generated catalog artifact, and snapshot. Prefer capability- and session-scoped tool advertisement over schema truncation.
+Keep dependencies flowing inward through the existing domain, contracts, provider, application, server, and adapter layers. Parse unknown values at process and protocol boundaries, model expected failures with `Result`, and preserve the canonical tool inventory defined by `TOOL_CONTRACTS` unless a deliberate contract change updates every verifier, generated catalog artifact, and snapshot. Keep tool discovery complete and report capability- and session-scoped availability through `binary_session`.
 
-Before submitting a pull request, run:
+## Development feedback and PR verification
+
+For an ordinary edit, run the relevant regression and cached static checks:
 
 ```bash
-npm run check:pr
-npm run verify:package
-npm pack --dry-run
+npm run test:focused -- src/config.test.ts
+npm run check:fast
 ```
 
-`npm run check:fast` runs cached typecheck and lint for rapid local feedback.
-`npm run check` adds formatting, dead-code, and package-metadata freshness
-checks; use `npm run check:test` when the complete test suite is relevant.
-Pre-commit formats then lints staged source files, and pre-push runs
-`check:fast`. `check:pr` additionally renders API documentation and checks all
-committed generated metadata. Real
-provider and replay execution remains uncached, but their deterministic build
-prerequisite uses Turbo. CI uploads the rendered TypeDoc site as an `api-docs`
-artifact; the generated HTML is not committed.
+`test:local` selects dirty source tests without building; explicit source test
+paths run even on a clean tree. `check:changed` adds source tests affected since
+the branch merge base with `origin/main`. Use `npm run test:changed -- --base
+REVISION` to choose another base. Changed-test selection follows the import
+graph and is feedback, not complete correctness evidence. Inspect relevant
+boundary and provider behavior explicitly; see [docs/testing.md](docs/testing.md).
 
-Local `npm test` runs without coverage, retries, or verbose output. Use `npm run
-test:fast` for pure and subprocess groups, `npm run test:integration` for serial
-filesystem/process/CLI cases. `npm run test:changed` runs changed and related
-non-serial tests once; `npm run test:watch` keeps that selection live. Pure tests
-use Vitest threads, while subprocess tests stay in isolated forks. CI splits the
-complete suite across two native Vitest
-shards, then merges their coverage and JUnit reports. `npm run test:ci` runs the
-equivalent unsharded gate locally. Coverage thresholds remain in
-`vitest.config.ts`.
+Before handing off a PR, run the relevant tests, `npm run check`, and
+`npm run docs:check` when contracts or generated metadata change. Record which
+checks ran. CI owns complete deterministic tests and aggregate coverage. Use
+`npm run check:pr` for a deliberate full local gate on broad changes or when
+investigating CI failures; it is not required after each edit, rebase, or push.
+Packaging, setup, installation, or distribution changes also require
+`npm run verify:package` and `npm pack --dry-run`. Provider behavior changes
+require the matching real-provider `verify:*` lane.
 
-CI installs dependencies once for all static checks, cancels superseded PR
-runs, and skips package, Windows, and full test lanes for documentation-only
-pull requests. TypeDoc renders only in pull-request CI; it does not run in local
-commit or pre-push hooks, or in post-merge `main` CI.
+`check:fast` runs cached typecheck and lint, reporting diagnostics on failure.
+`check` adds formatting, dead-code, and package-metadata freshness checks.
+Formatting uses Oxfmt and the committed `.oxfmtrc.json`; generated sources use
+the same configuration. Pre-commit formats and lints staged files; pre-push runs
+`check:fast`.
+`docs:check` checks committed generated metadata. `docs:generate` regenerates
+those files, and the docs CI lane checks them.
+Real-provider execution remains uncached; deterministic builds use Turbo.
+
+Local `npm test` runs every deterministic Vitest project without coverage or
+retries. CI runs four coverage shards and merges JUnit and timing reports.
+CI cancels superseded PR runs and skips package, Windows, and full test lanes
+for documentation-only PRs. Coverage thresholds remain in `vitest.config.ts`.
 
 Tests that need a temporary directory must use
 `createTestTempDirectory` from `tests/fixtures/temporaryDirectory.ts`. The
@@ -92,13 +100,21 @@ Describe the behavior change and verification performed in the pull request. Nev
 
 ## Maintainer release checklist
 
-Run the full checks, isolated package verifier, package dry run, and two-target real-Hopper verifier described above. Build a local tarball and exercise the executable through the package boundary:
+Run `npm run check:pr`, the isolated package verifier, package dry run, and two-target real-Hopper verifier described above. Build a local tarball and exercise the executable through the package boundary:
 
 ```bash
 npm pack
-npm exec --yes --package ./morluto-rea-0.1.0.tgz -- rea --help
 ```
 
+Use the exact filename printed by `npm pack` to run the packaged executable:
+
+```bash
+npm exec --yes --package ./rea-agents-VERSION.tgz -- rea --help
+```
+
+Replace `VERSION` with the packed version; do not use a tarball from an earlier
+build.
+
 Publish the public package:
 
 ```bash
@@ -110,6 +126,6 @@ After npm registry propagation, verify the published CLI and connect the client
 ```bash
 npx -y rea-agents@latest --help
 npx -y rea-agents@latest doctor
-npx -y rea-agents@latest setup --yes
+npx -y rea-agents@latest setup --yes --all-detected
 npx -y rea-agents@latest mcp
 ```

README.md

@@ -4,7 +4,7 @@
 
 # REA: Reverse Engineer Anything
 
-### One CLI and MCP server for agents to reverse engineer anything
+### Reverse engineer anything with agents, from app behavior down to native binaries.
 
 **See a feature you like. Understand how it works, down to the binary level.**
 
@@ -13,44 +13,54 @@
 [![MCP tool catalog](https://img.shields.io/badge/MCP-tool_catalog-5c4ee5?style=flat-square)](#tool-catalog-for-investigation)
 [![Node.js 22+](https://img.shields.io/badge/Node.js-22.19%2B-339933?style=flat-square&logo=nodedotjs&logoColor=white)](https://nodejs.org/)
 [![MIT license](https://img.shields.io/badge/license-MIT-f4c430?style=flat-square)](LICENSE)
+[![Discord](https://img.shields.io/discord/1556595354999332884?logo=discord&logoColor=white&label=Discord&color=5865F2)](https://discord.gg/GkcryMnJDM)
+
+<a href="https://trendshift.io/repositories/82054?utm_source=trendshift-badge&amp;utm_medium=badge&amp;utm_campaign=badge-trendshift-82054" target="_blank" rel="noopener noreferrer"><img src="https://trendshift.io/api/badge/trendshift/repositories/82054/weekly?language=TypeScript" alt="morluto/rea | Trendshift" width="250" height="55" /></a>
 
 [Quick start](#quick-start) · [Current status](#current-status) · [Investigation model](#the-investigation-model) · [Tool catalog](#tool-catalog-for-investigation) · [Roadmap](#roadmap) · [How it works](#how-it-works)
 
-<br />
-
-<code>npm install --global rea-agents && rea setup</code>
+<code>npx rea-agents setup</code>
 
 <br />
 
 <img src="docs/assets/rea-hopper-analysis.png" alt="REA launching its analysis bridge inside Hopper while inspecting a native binary" width="1200" />
 
+<br />
+
+<table aria-label="REA community">
+<tr>
+<td align="center" width="360">
+  <a href="https://discord.gg/GkcryMnJDM">
+    <img src="docs/assets/discord.svg" height="42" alt="Discord" /><br />
+    <strong>Join the Reverse Engineering Community</strong>
+  </a><br />
+  <sub>Discord · Q&amp;A · Show and Tell</sub>
+</td>
+</tr>
+</table>
+
+<br />
+
 </div>
 
 ---
 
-See a feature in an app that you want in your own product? Give the app to your agent—even without its source code. With REA, the agent can investigate the feature, explain how it works, show its evidence, and build a version adapted to your stack and requirements.
+See a feature in an app that you want in your own product? Ask your agent to investigate it with REA. It can inspect the app without its source code, explain how the feature works, show the evidence, and build a version for your project.
 
-REA gives agents one consistent way to investigate software. Today that includes deep native analysis and function dossiers through Hopper or bring-your-own Ghidra on Linux, plus an experimental Windows x64 Ghidra P0 for approved native PE applications; execution-free managed PE/CLI triage; reproducible Evidence v2 records; controlled process capture; passive website, Electron page, and Node/Electron V8 Inspector observation; bounded JavaScript/source-map reconstruction; and a versioned domain graph for connecting JavaScript application layers without confusing static inference with runtime observation. The longer-term toolkit extends the same agent workflow to APIs, protocols, mobile artifacts, firmware, richer runtime behavior, and differences between versions.
+REA connects your agent to tools for inspecting native binaries, JavaScript and Electron apps, .NET assemblies, and websites. You can also use the same tools from your terminal. Analysis runs locally, and results include the evidence and limitations behind each conclusion.
 
-Reverse engineering normally makes the operator choose a tool, learn its API, move evidence between programs, and decide what to inspect next. REA gives that work to the agent through commands, skills, structured results, and repeatable investigation workflows.
+Setup configures your agent and connects it to Hopper or Ghidra. If you need an analysis tool, setup can install Hopper for you.
 
 ## Just ask your agent
 
-Run setup once. Agent integration installs an aligned MCP registration and the
-bundled routing skill together:
-
-```bash
-npx rea-agents setup
-```
-
-Then ask:
+After [setup](#quick-start), restart your agent and ask:
 
 ```text
 Understand how search works in the Notes app, show me the evidence, and build a
 similar feature for my project.
 ```
 
-Notes is only an example. Name any app you want to understand, or ask the agent to start with an overview.
+Replace Notes with the app you want to understand, or ask for an overview first.
 
 ## The investigation model
 
@@ -79,121 +89,69 @@ REA shows how it reached its conclusions. It does not claim to recover original
 | ------------------------ | ----------------------------------------------------------------------------------------------------- |
 | **Built for agents**     | Ask what an app does and let your agent inspect it instead of guessing.                               |
 | **CLI and MCP**          | Run the same reverse-engineering capabilities from your terminal or agent.                            |
-| **Complexity handled**   | REA installs and manages the reverse-engineering tools behind the scenes.                             |
+| **Guided setup**         | Configure your agent, connect an existing analysis tool, or install Hopper with your approval.        |
 | **From insight to code** | Understand a feature, then build your own version in the same coding session.                         |
 | **Local by design**      | Analysis runs on your supported local host. REA does not upload the app to a hosted analysis service. |
 | **Keeps context**        | Investigate several apps without starting over for every question.                                    |
 
 ## Quick start
 
-### Run setup — recommended
+### Run setup (recommended)
+
+Set up REA with your agent:
 
 ```bash
 npx rea-agents setup
 ```
 
-The npm package-runner prompt, when shown, approves downloading REA for this
-invocation; it does not approve any setup changes. The REA wizard separately
-shows its complete plan and asks before applying it. Setup does not update
-Homebrew, Node.js, or npm. `npx rea-agents setup` opens with the work it
-enables: investigate local apps from an agent, recover evidence through a
-deep-analysis provider, and reuse REA's guided workflow. It summarizes the
-detected agents, then asks which capabilities to set up: agent integration
-(MCP plus the matching guided workflow) and—when needed—the Hopper provider.
-Nothing is preselected. Choosing agent integration opens a second empty
-checklist for the specific detected agents that should receive a registration.
+Choose which supported agents should use REA, then review the exact paths and changes before approving. Existing REA registrations are selected by default; newly detected agents are available to select, but detection alone does not select them. Setup adds MCP access and REA's guided workflow for selected agents. Hopper is a separate optional choice with its own consent. Setup can also record an existing Ghidra installation.
 
-If bare `npx` finds a project-local REA package, its dispatcher restarts setup
-through `rea-agents@latest` before planning any changes. This prevents an older
-local dependency from silently writing stale integration state. An already
-published older release cannot contain that dispatcher protection; run
-`npx -y rea-agents@latest setup` once to repair registrations created by one.
-Intentional rollbacks remain available through an exact package request.
+Setup shows its changes before applying them and backs up existing configuration. See [Installation and setup](docs/installation.md) for requirements and setup options.
 
-REA keeps the journey inline so its history remains in the terminal. Selecting
-a capability does not select every detected target or authorize a change.
-Before anything changes, REA validates existing configuration, prints exact
-paths and external effects, and asks for final approval with **No** as the
-default. The screen keeps the available keys visible while you choose; Ctrl-C
-and declining leave the system unchanged.
+### With an agent (recommended)
 
-REA detects Claude Code, Claude Desktop, Codex, Cursor, Gemini CLI, Windsurf, and Devin. It configures the first six when detected; Devin is reported but left unchanged because it has no documented local MCP configuration boundary. Registrations are additive, backup-first, and read back after writing. You can safely rerun setup.
+After setup, restart your agent and [describe the app or feature](#just-ask-your-agent) you want to understand. Hopper can run in demo mode; if it shows a first-run prompt, choose the demo or enter an existing license.
 
-Use `rea setup --dry-run` to inspect the plan, repeat `--client` to select exact
-agents, and `--accessible` for sequential vertical prompts. Machine output
-remains available through `--json`; prompt UI and progress go to stderr.
+REA supports Claude Code, Claude Desktop, Codex, Cursor, Gemini CLI, Windsurf, Devin, OpenCode, Antigravity, GitHub Copilot CLI, Command Code, and VS Code. Existing REA registrations are selected by default during setup; other detected agents remain unselected until chosen. Other agents can use the [manual MCP configuration](#manual-mcp-configuration).
 
-After a successful setup, REA reports the capabilities now ready to use and a
-concrete next step, such as restarting a configured agent before asking it to
-investigate an application. It does not claim an integration or provider is
-ready unless setup and its final diagnostic check verified it.
+### From the terminal with npx
 
-An optional curl wrapper installs the same CLI package and starts setup only when a terminal is available:
+After setup, run:
+
+```bash
+npx -y rea-agents@latest doctor
+npx -y rea-agents@latest analyze /Applications/Notes.app
+```
+
+### Install the rea command
+
+Install the command-line interface:
 
 ```bash
 curl -fsSL https://raw.githubusercontent.com/morluto/rea/main/install.sh | bash
 ```
 
-Pass installer options after `bash -s --`, for example `--dry-run`, `--no-setup`, or `--version 1.0.0`. The curl wrapper never installs prerequisites or configures integrations itself. See [Installation and setup](docs/installation.md) for its exact mutation boundary.
+The installer adds `rea` to your system and starts setup when run in a terminal. It requires Node.js and npm to be installed already.
 
-### With an agent — recommended
-
-```bash
-npx rea-agents setup
-```
-
-Choose Agent Integration in the reviewed setup plan. REA installs the pinned MCP
-registration and its matching routing skill as one transaction. After setup,
-restart the configured agent so it loads the aligned integration.
-
-Review the setup plan, approve it if appropriate, then describe the app or feature you want to understand. Hopper can run in its free demo mode; if it shows a first-run prompt, choose the demo or enter an existing license.
-
-### From Terminal — no installation
-
-```bash
-npx rea-agents setup
-npx -y rea-agents@latest doctor
-npx -y rea-agents@latest analyze /Applications/Notes.app
-```
-
-Review the setup plan before confirming it. Restart a configured agent so it loads REA.
-
-### From Terminal — install the `rea` command
+Alternatively, install with npm, then run setup:
 
 ```bash
 npm install --global rea-agents
 rea setup
-rea doctor
-rea analyze /Applications/Notes.app
 ```
 
-Update that global installation in place:
-
-```bash
-rea upgrade
-```
-
-REA checks npm for the latest release and verifies that the running package is
-the global installation it will replace. Source, local, and `npx` copies report
-the manual `npm install --global rea-agents@latest` command instead of updating
-an unrelated global package.
-
-Choose either the no-install commands or the global installation. You do not need both.
-
-`npm install rea-agents` without `--global` installs `rea` only into the
-current project's `node_modules/.bin`; it does not add `rea` to your shell
-`PATH`. Use the `npx` commands above for one-off runs or `--global` when you
-want a shell-visible `rea` command.
+Update either installation with `rea update`.
 
 ### Requirements
 
 - macOS 12 or newer
 - Ubuntu 24.04+, Fedora 41+, or 64-bit Arch Linux
-- Windows x64 for the experimental, Ghidra-only native PE P0 boundary
-- Node.js 22.19+ or 24.11+ (including newer releases)
+- Node.js 22.x (>=22.19), 24.x (>=24.11), or 26+
 - npm; REA does not require or install a particular npm version
 
-Deep binary operations use [Hopper](https://www.hopperapp.com/), a separate desktop application with its own license, or a caller-selected Ghidra provider. Ghidra supplies read-only inventory, function metadata, decompilation, assembly, resolved calls, typed references, xrefs, CFG, and function dossiers; GUI state and mutations remain unavailable through that provider. Setup reuses an existing Hopper installation or an operator-supplied Ghidra installation. It never downloads Ghidra or installs Java. If neither provider is ready, interactive setup proposes Hopper; unattended Hopper installation requires `rea setup --yes --install-hopper`.
+Native binary analysis requires [Hopper](https://www.hopperapp.com/) or [Ghidra](#ghidra-analysis-provider). Hopper is separate software with its own license; its demo supports analysis with vendor-defined limits. REA can use Ghidra that you have already installed.
+
+Windows Ghidra support is experimental for native x86-64 PE applications on local NTFS. The package bundles native Job Object, private-DACL, and path-admission controls. See [Windows Ghidra P0](docs/windows-ghidra-p0.md) for prerequisites and verified scope.
 
 If something is not working, run:
 
@@ -201,13 +159,13 @@ If something is not working, run:
 npx -y rea-agents@latest doctor
 ```
 
-`rea doctor --json` is read-only and distinguishes unsupported hosts, missing dependencies, a missing local analysis engine, configuration drift, and healthy checks. Paid-license activation is optional: on Linux, REA runs the supported Hopper demo build on a private Xvfb display and selects Hopper's offered demo mode for each analysis session.
+`doctor` checks your host, dependencies, analysis tools, and agent configuration without changing them. Use `--json` for structured diagnostics.
 
 ### Linux installation and troubleshooting
 
-On macOS, approved setup downloads Hopper's official DMG, verifies it, and installs the app into `~/Applications` without Homebrew or administrator privileges. Hopper may show its demo or license prompt when first opened; no manual drag-and-drop is required.
+On macOS, setup can install Hopper in `~/Applications` after approval. It verifies the official download and does not need Homebrew or administrator privileges.
 
-On Ubuntu 24.04+, Fedora 41+, and 64-bit Arch Linux, approved setup downloads the pinned official Hopper 6.4.2 package, restricts downloads to Hopper's public origin, verifies the published size and checksum, and invokes `apt-get`, `dnf`, or `pacman` to install Hopper and the Xvfb, Python, X11, and XTEST packages used by demo sessions. When REA is not already running as root, `pkexec` presents the system authorization prompt. REA never invokes `sudo`. Demo sessions run on an isolated 1280×1024 Xvfb display. REA verifies the exact supported Hopper binary, its owned process ancestry, the expected dialog geometry, and bridge state before selecting `Try the Demo`; any mismatch fails closed.
+On supported Linux distributions, setup can install Hopper and its demo-session dependencies through your system package manager. You may see a system authorization prompt. Demo sessions use a private virtual display, leaving your desktop alone. See [Hopper installation](docs/installation.md#hopper) for download verification and platform details.
 
 The normal Linux launcher is `/opt/hopper/bin/Hopper`. If Hopper was installed elsewhere:
 
@@ -222,35 +180,33 @@ If doctor reports a missing analysis engine even though the file exists, inspect
 ldd /opt/hopper/bin/Hopper | grep 'not found'
 ```
 
-Install the missing distribution packages and rerun `rea setup`. Linux demo automation requires `Xvfb`, Python 3, `libX11.so.6`, and `libXtst.so.6`; approved setup installs those direct runtime dependencies and does not interact with the user's desktop display. Hopper's free demo supports analysis with vendor-defined limits, and a paid license is optional. The curl installer places the `rea` command in `~/.local/bin` on Linux; add that directory to future shell `PATH` values if it is not already present.
+Install the missing packages and rerun `rea setup`. The Linux demo needs Xvfb, Python 3, X11, and XTEST; approved setup installs these dependencies. If you use the curl installer, add `~/.local/bin` to your shell `PATH` when needed.
 
 REA defaults `HOPPER_LAUNCHER_PATH` to `/Applications/Hopper Disassembler.app/Contents/MacOS/hopper` on macOS and `/opt/hopper/bin/Hopper` on Linux. Explicit configuration always takes precedence.
 
-### Ghidra read-only analysis provider
+### Ghidra analysis provider
 
-The Ghidra adapter supports the exact official Ghidra 12.1.2 release with a 64-bit full JDK 21 on Linux x64. It also provides an experimental Windows x64 P0 limited to approved native x86-64 PE applications. Download and extract those projects yourself, then configure absolute paths:
+Already use Ghidra? REA can connect it to your agent on Linux x64 or macOS x64/arm64. It requires **Ghidra 12.1.4** and a **64-bit JDK 21**. On macOS, your Ghidra installation must also include the native decompiler for your architecture.
+
+Set the installation paths, then run setup:
 
 ```bash
-export GHIDRA_INSTALL_DIR=/absolute/path/to/ghidra_12.1.2_PUBLIC
+export GHIDRA_INSTALL_DIR=/absolute/path/to/ghidra_12.1.4_PUBLIC
 export JAVA_HOME=/absolute/path/to/jdk-21 # optional when java and javac resolve from PATH
 rea doctor --json
 rea setup
 rea providers --json
 ```
 
-Doctor distinguishes missing configuration, a bad installation root, the wrong Ghidra or Java version, a JRE without `javac`, a missing `support/analyzeHeadless`, and an unsupported platform or architecture. Approved setup only copies the verified non-secret paths into detected MCP registrations; it does not modify the Ghidra installation or install/download Ghidra or Java.
+Setup checks the installations and saves their paths in your selected agents' configuration after approval. Ghidra and Java must already be installed; REA does not download or change them.
 
-On Windows, set the same variables in PowerShell and run `rea doctor --json`; automated `rea setup` and Hopper installation remain unavailable. The P0 target boundary rejects DLLs, managed PE files, non-x86-64 images, mutable/hostile inputs, and non-PE formats. See the [Windows Ghidra P0 operations guide](docs/windows-ghidra-p0.md) for registration, exact limitations, CI evidence, and acceptance gates.
+The adapter exposes inventory, function, memory and load-image inspection, plus atomic function annotation edits on Linux and macOS. `annotate_native_function` edits names and entry comments in the session database and returns a refreshed function dossier; executable bytes stay unchanged. Ghidra does not provide GUI controls through REA.
 
-REA loads its packaged Java `HeadlessScript` with `-scriptPath`, copies and digest-verifies the target in an ephemeral runtime, enables `-readOnly` and `-deleteProject`, caps auto-analysis at 300 seconds with two CPUs and a 2 GiB Java heap, and authenticates every request. Linux uses a mode-0600 Unix socket. Windows P0 uses token-authenticated IPv4 loopback and a token-free endpoint record because Node path-based IPC does not connect to Java AF_UNIX sockets on Windows. The bridge verifies Ghidra's imported-byte SHA-256 before serving any operation.
+REA analyzes a temporary copy of the target and removes the temporary project when the session closes. Results identify what Ghidra observed and what it could not resolve. Decompilation produces pseudocode rather than the original source.
 
-The Ghidra adapter declares 19 direct and enhanced operations. Its ten inventory operations are `list_documents`, `list_procedures`, `list_strings`, `list_names`, `list_segments`, `address_name`, `procedure_address`, `resolve_containing_procedure`, `search_procedures`, and `search_strings`. It also admits `procedure_info`, `procedure_pseudo_code`, `procedure_assembly`, `read_function_instructions`, `procedure_callers`, `procedure_callees`, `procedure_references`, `xrefs`, and `analyze_function`. `read_function_instructions` is the offset-paginated fast path for raw instruction windows: it does not invoke the decompiler or whole-program name/string inventories, and is also exposed as `rea instructions`. These capabilities enable the shared Swift/Objective-C inventory workflows, `binary_overview`, `batch_decompile`, `get_call_graph`, `find_xrefs_to_name`, `trace_feature`, and complete function dossiers. Default-space addresses are lowercase `0x` hexadecimal. Other spaces, including `EXTERNAL`, use `<percent-encoded-space>:0x<hex>`. Symbol results identify primary, dynamic, external, type, and source facts; procedures distinguish external functions and thunks; strings identify charset, missing-terminator state, byte length, and value truncation; memory-block ends are exclusive and permissions come directly from Ghidra.
+Ghidra also imports DOS MZ executables with an explicit 16-bit x86 real-mode profile. Function results include complete observed body ranges, distinguishing owned bytes from the enclosing span. See the [DOS analysis guide](docs/ghidra-dos.md) for addresses, packing, and verification boundaries.
 
-The bridge serves operations only after auto-analysis completes. Each Program owns one persistent `DecompInterface`; a bounded 32-request FIFO serializes Ghidra API access, and every decompile has a 30-second native deadline. Reference results preserve Ghidra's call/jump/data/read/write/indirect/computed/external facts, while unresolved targetless flows remain explicitly unknown. Synthetic entry-point references without actionable memory sources are omitted. Pseudocode and assembly are provider-specific observations, not original source or Hopper-equivalent text. An analysis timeout, scan or inventory safety limit, request timeout, or oversized response fails explicitly instead of returning a partial result labeled complete.
-
-`npm run verify:ghidra` compiles source-owned x86-64 debug and stripped ELF, AArch64 ELF, x86-64 PE, and x86-64 Mach-O fixtures. Against real Ghidra 12.1.2 it validates every admitted operation, direct and indirect calls, imports/exports/thunks, typed references, strings/xrefs, multi-block CFG, cancellation, deadlines, concurrency, malformed inputs, and complete process/project cleanup. Set `REA_CC`, `REA_CLANG`, or `REA_LLD_LINK` only when the corresponding compiler command is not on `PATH`.
-
-`npm run verify:ghidra:windows` uses a deterministic source-owned native x86-64 PE application and requires all 19 operations, target/snapshot/import digest linkage, authenticated loopback transport, and cleanup on a controlled Windows x64 Ghidra 12.1.2 runner. This proof does not establish Job Object ownership, private DACLs, or reparse-point-safe authority.
+Windows Ghidra P0 uses bundled native controls for its read-only native x86-64 PE boundary on local NTFS; see the [Windows Ghidra P0 guide](docs/windows-ghidra-p0.md). See [Ghidra installation](docs/installation.md#ghidra), [provider evaluation](docs/provider-evaluation.md), and [testing](docs/testing.md) for configuration details, coverage, and real-provider verification.
 
 To remove only REA-owned MCP registrations and the managed skill:
 
@@ -259,88 +215,58 @@ rea uninstall
 rea uninstall --purge-data # also removes only ~/.rea/cache and ~/.rea/state
 ```
 
-Uninstall preserves Hopper, Node.js, evidence, captures, external evidence roots, unrelated skills, and other MCP servers. It refuses malformed client configuration and never follows purge-data symlinks.
+Uninstall preserves Hopper, Node.js, Evidence files, captures, unrelated skills, and other MCP servers. It refuses malformed client configuration and never follows purge-data symlinks.
 
 ### CLI or agent?
 
-| If you want to…                                                  | Use                                                                       |
-| ---------------------------------------------------------------- | ------------------------------------------------------------------------- |
-| Ask an agent to investigate an app and build a feature           | Install the skill, then talk to your agent                                |
-| Inspect or decompile one part of an app from the Terminal        | `rea analyze` or `rea decompile`                                          |
-| Validate, canonicalize, or compare Evidence v2 bundles           | `rea evidence-import`, `rea evidence-export`, or `rea compare`            |
-| Run or resume a persistent two-version artifact analysis         | `rea investigate-versions`                                                |
-| Map a local JavaScript/Electron application without executing it | `rea analyze PATH --approved` or `rea analyze-javascript-application`     |
-| Reuse immutable analysis results without relaunching a provider  | Pass `--snapshot /approved/path/analysis.json` to a deep-analysis command |
-| Import source as historical reference                            | `rea import-reference-source`                                             |
-| Capture or compare controlled process behavior                   | `rea capture-process` or `rea compare-process-captures`                   |
-
-Filesystem evidence commands and MCP file tools are disabled until the operator approves absolute roots:
+| If you want to…                                                  | Use                                                                 |
+| ---------------------------------------------------------------- | ------------------------------------------------------------------- |
+| Ask an agent to investigate an app and build a feature           | Run setup, restart your agent, then describe the task               |
+| Inspect or decompile one part of an app from the Terminal        | `rea analyze` or `rea decompile`                                    |
+| Validate, canonicalize, or compare Evidence bundles              | `rea evidence-import`, `rea evidence-export`, or `rea compare`      |
+| Map a local JavaScript/Electron application without executing it | `rea analyze PATH` or `rea analyze-javascript-application`          |
+| Reuse immutable analysis results without relaunching a provider  | Pass `--snapshot /path/to/analysis.json` to a deep-analysis command |
+| Import source as historical reference                            | `rea import-reference-source`                                       |
+| Capture or compare controlled process behavior                   | `rea capture-process` or `rea compare-process-captures`             |
 
 ```bash
-export REA_EVIDENCE_ROOTS_JSON='["/absolute/path/to/evidence"]'
-export REA_INVESTIGATION_INPUT_ROOTS_JSON='["/absolute/path/to/releases"]'
 rea evidence-import /absolute/path/to/evidence/bundle.json
 rea evidence-export /absolute/path/to/evidence/bundle.json /absolute/path/to/evidence/canonical.json
 rea compare /absolute/path/to/evidence/left.json /absolute/path/to/evidence/right.json
-rea investigate-versions /absolute/path/to/releases/v1 /absolute/path/to/releases/v2 /absolute/path/to/evidence/releases.json --yes --workspace-name releases
-rea analyze /absolute/path/to/releases/app.asar --approved --json
-rea analyze-javascript-application /absolute/path/to/releases/app.asar --approved --json
+```
+
+Analyze a JavaScript application directory or ASAR without executing it:
+
+```bash
+rea analyze /absolute/path/to/releases/app.asar --json
+rea analyze-javascript-application /absolute/path/to/releases/app.asar --json
 ```
 
 For a directory or `.asar`, generic `rea analyze` automatically selects the
 static JavaScript application provider when neither `--provider` nor
-`--snapshot` is supplied. The dedicated command remains available for explicit
-format and resource-limit controls. Both routes require `--approved` and an
-administrator-approved investigation input root.
+`--snapshot` is supplied. Both routes return the analysis and its Evidence
+context inline.
 
-If REA is registered with an MCP client, run approved `rea setup` while the
-explicit investigation-root variable is set, then restart that client. Setup
-copies this non-secret policy into the managed registration; changing the shell
-environment alone cannot update an already-running MCP process.
-
-`investigate-versions` inventories both versions, checkpoints their observed
-Evidence, derives an artifact comparison, and records a changed-behavior report.
-Both input paths must resolve beneath `REA_INVESTIGATION_INPUT_ROOTS_JSON`;
-workspace files remain independently restricted by `REA_EVIDENCE_ROOTS_JSON`.
-The workspace uses deterministic content identities and monotonic CAS-linked
-revisions, so the same request resumes an interrupted run or reuses a completed
-run without replacing earlier investigations. It currently compares static
-artifact structure only; it does not execute either version, and its report
-keeps every difference labeled as a behavior candidate. See
-[Persistent investigation workspaces](docs/investigation-workspaces.md).
-
-Historical source import requires a separate allowlist and never treats source as current behavioral authority:
+Import an older source tree as a reference. REA keeps it separate from observations of the current app:
 
 ```bash
-export REA_REFERENCE_ROOTS_JSON='["/absolute/path/to/source"]'
 rea import-reference-source /absolute/path/to/source
 ```
 
-Exports never replace an existing file unless `--overwrite` is explicit. Imports are size/depth bounded, validate every Evidence v2 ID and manifest, and never execute bundle content.
+Imports read the path supplied to the command. File names do not cause automatic omissions; files are represented by hashes and metadata. To exclude selected paths, set `REA_REFERENCE_SECRET_PATTERNS_JSON` to a JSON string array of ignore patterns. Exports never replace an existing file unless `--overwrite` is explicit.
 
-Provider-neutral analysis snapshots persist successful, immutable REA calls and
-their Evidence v2 records. They are exact caches rather than Hopper databases:
-REA reuses a v2 entry only when the binary digest, kind, format, architecture,
-operation parameters, concrete provider build, and canonical analysis-profile
-digest match. Hopper loader defaults and configured overrides are normalized by
-the Hopper adapter and committed to that profile, so overrides occupy a distinct
-safe cache partition instead of disabling snapshots. Snapshot v1 cannot prove
-those semantics and is rejected with recapture guidance. Cursor-dependent and
-mutating calls are never cached. Snapshot files can contain proprietary analysis
-results and local paths, so REA keeps them local, writes them with owner-only
-permissions, and requires a separate approved root:
+Use a snapshot to save successful analysis results and reuse them on later runs. REA reuses a result only when the target bytes, operation, parameters, analysis tool, and settings match. It does not cache changes or cursor-dependent calls. Snapshot files stay local and use owner-only permissions.
 
 ```bash
-export REA_ANALYSIS_SNAPSHOT_ROOTS_JSON='["/absolute/path/to/analysis"]'
 rea analyze /absolute/path/to/app --snapshot /absolute/path/to/analysis/app.json
-# The same exact query can now be answered from the snapshot.
+# The same exact query can be answered from that snapshot.
 rea analyze /absolute/path/to/app --snapshot /absolute/path/to/analysis/app.json
 ```
 
-Exact CLI evidence replays happen before any provider process starts. In MCP sessions,
+Exact CLI cached-evidence reads happen before any provider process starts. In MCP sessions,
 pass `snapshot_path` to `open_binary` to import a snapshot atomically while
 opening its matching target; MCP providers may still start before a cached call
-is replayed. Pass `snapshot_path` and, when required, `overwrite: true` to
+result is returned. Pass `snapshot_path` and, when required, `overwrite: true` to
 `close_binary` to save atomically before Hopper resources are released. If the
 save fails, REA deliberately leaves the session open.
 
@@ -362,7 +288,7 @@ REA gives the agent a clear path from that request to working code:
 |    5 | Decompiles the relevant routines        | `procedure_pseudo_code`, `procedure_assembly`, `batch_decompile` |
 |    6 | Builds the feature in your project      | code adapted to your stack, product, and requirements            |
 
-REA handles the app analysis in steps 1–5. The agent performs step 6 with its normal file-editing and test tools, using what it learned about the app.
+REA handles the app analysis in steps 1 through 5. The agent performs step 6 with its normal file-editing and test tools, using what it learned about the app.
 
 ## What agents can do
 
@@ -371,162 +297,123 @@ REA handles the app analysis in steps 1–5. The agent performs step 6 with its
 - Reconstruct an app's authentication, storage, update, or networking flow.
 - Recover enough structure to document an undocumented format or interface.
 - Trace a suspicious behavior from a string or symbol to the code that implements it.
-- Run, checkpoint, resume, and reuse a content-addressed artifact investigation across two versions.
 - Turn recovered behavior into product features, tests, migration notes, ports, or interoperable replacements.
 - Analyze Swift and Objective-C metadata without manually untangling every mangled symbol.
 - Leave names, comments, and bookmarks in Hopper so human and agent analysis reinforce each other.
 
+See [native investigation](docs/native-investigation.md) for keyed archives, instruction/call/type primitives, typed dispatch metadata, value traces and native desktop observation.
+
 ## Tool catalog for investigation
 
-| Tool family               | Count | Examples                                                                                                                                                                                                                                                                                                                         |
-| ------------------------- | ----: | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
-| Native inspection         |    36 | procedures, pseudocode, assembly, strings, names, segments, callers, callees, xrefs, annotations, bounded byte reads, file-offset translation                                                                                                                                                                                    |
-| Investigation workflows   |    13 | `binary_overview`, `analyze_function`, `inspect_native_api`, `batch_decompile`, `trace_feature`, exact string-to-code lookup, bounded call paths, call graphs, Swift and Objective-C discovery                                                                                                                                   |
-| Native macOS utilities    |     5 | Mach-O metadata, code signatures, plists, architectures, Swift demangling; Hopper-free and provenance-bearing                                                                                                                                                                                                                    |
-| Artifact graph            |     3 | bounded provider-neutral inspection, deterministic directory/ZIP/APK/IPA/MSIX/AppX/ASAR inventory, and explicitly selected extraction into an absent owned tree                                                                                                                                                                  |
-| Managed PE/CLI            |     8 | PE/CLI identity, metadata members, CIL hashes, P/Invoke/native-boundary declarations and verification, application-graph projection, decompiler reconstruction import, token remapping, runtime-correlation plans, and version comparison                                                                                        |
-| Browser observation       |     9 | exact-origin passive CDP capture, bundle and source-map analysis, WebMCP discovery, session timelines, capture diff, visual evidence, and bounded Playwright scenarios                                                                                                                                                           |
-| Electron analysis         |     4 | passive root-confined observation, bounded static application mapping, and evidence-backed static/runtime reconciliation                                                                                                                                                                                                         |
-| JavaScript runtime        |     2 | approved attach-only Node/Electron Inspector target discovery plus bounded script and execution-context observation without evaluation or instrumentation                                                                                                                                                                        |
-| Application workflows     |    12 | bounded cross-layer traces, unique-only version matching, historical-source to bundle mapping, static export return-shape comparison, approved Linux-isolated extracted-module replay, managed-runtime characterization, reconstruction coverage closure, deterministic obligation ledgers, and end-to-end readiness conformance |
-| Workspace and observation |    19 | target lifecycle, Evidence v2 bundles, direct finite replay-machine evaluation, process/artifact/function comparison, evidence-linked residual-unknown lifecycle                                                                                                                                                                 |
+| Tool family               | Count | Examples                                                                                                                                                  |
+| ------------------------- | ----: | --------------------------------------------------------------------------------------------------------------------------------------------------------- |
+| Native inspection         |    41 | functions, pseudocode, assembly, strings, symbols, calls, references, annotations, byte reads, and file offsets                                           |
+| Investigation workflows   |    14 | app overviews, function dossiers, native APIs and dispatch, batch decompilation, feature traces, call paths, call graphs, Swift and Objective-C discovery |
+| Native macOS utilities    |     7 | Mach-O metadata, code signatures, plists, architectures, and Swift demangling without launching Hopper                                                    |
+| Artifact graph            |     5 | directory and package inventories, compiled Interface Builder files, Apple asset catalogs, and extraction                                                 |
+| Managed PE/CLI            |     7 | .NET identity, metadata, CIL instructions, native dependencies, reconstruction imports, and build comparisons                                             |
+| Browser observation       |     9 | page structure, network metadata, scripts, source maps, WebMCP discovery, screenshots, and capture comparisons                                            |
+| Electron analysis         |     5 | renderer observation, static app mapping, and static/runtime reconciliation                                                                               |
+| JavaScript runtime        |     2 | Node/Electron Inspector target discovery, script locations, and execution-context events                                                                  |
+| Application workflows     |     7 | cross-layer feature traces, build comparisons, historical source mapping, static return-shape comparison, and reconstruction checks                       |
+| Workspace and observation |    21 | sessions, evidence bundles, navigation context, process/artifact/function comparisons, and open-question tracking                                         |
 
-The public interface describes what the agent is trying to learn. Providers decide how to answer. macOS utilities handle common semantic inspection without launching Hopper; Hopper handles deeper native analysis; the process harness implements controlled behavioral capture.
+The public interface describes what the agent is trying to learn. Providers decide how to answer. macOS utilities handle common semantic inspection without launching Hopper; Hopper handles deeper native analysis; the process harness records direct behavioral captures.
 
 ## Current status
 
-REA is already useful for native application, browser, and Electron investigation on supported macOS and Linux hosts, plus the bounded Windows Ghidra P0 described above:
+REA supports native application, JavaScript, Electron, .NET, and browser investigation on macOS and Linux. Individual tools have platform and runtime prerequisites; use `rea capabilities` to check what is available on your host.
 
-- Open Mach-O, ELF, PE, `.app`, ZIP, APK, IPA, ASAR, plist, JavaScript, source-map, and generic analysis-database targets; Hopper remains the only adapter that accepts legacy `.hop` databases.
-- Discover deep-analysis candidates without starting them, choose deterministically, and retain one immutable provider/profile binding until an explicit switch or close; provider failures never trigger transparent fallback.
-- Attach to a user-owned Chrome-family browser over a configured loopback CDP endpoint; capture exact-origin web structure, safe metadata, approved value-free payload shapes, bundle/source-map evidence, WebMCP declarations, user-action timelines, capture diffs, and explicitly approved screenshots without navigation or JavaScript evaluation.
-- Inspect Electron `file://` renderer pages through a separate canonical-root permission boundary without invoking Electron APIs; script contents remain separately approved and byte bounded.
-- Attach to one exact approved Node or Electron V8 Inspector target and retain bounded `scriptParsed` plus execution-context lifecycle metadata without evaluation, breakpoints, resume, source reads, or instrumentation. require/import edges, EventEmitter activity, Electron IPC, PID identity, and role identity remain unknown. See [passive Node and Electron runtime observation](docs/javascript-runtime-observation.md).
-- Validate and canonically serialize a provider-neutral [JavaScript Application Graph v1](docs/javascript-application-graph.md) spanning packages, ASAR entries, Electron roles, JavaScript/source-map entities, browser/runtime instances, IPC, endpoints, storage, and native add-ons. This shipped domain contract performs no extraction or I/O by itself.
-- Reconstruct bounded static package, entrypoint, Webpack/Rspack module, import, worker, endpoint, storage, source-map, BrowserWindow, preload, contextBridge, IPC, utility-process, and native-add-on structure from an approved local directory or ASAR through `analyze_javascript_application` or `rea analyze-javascript-application`. The AST-only [application service](docs/javascript-artifact-reconstruction.md) never executes bootstrap code, pairs only unique exact literal IPC channels, and reports dynamic or ambiguous channels as unresolved.
-- Reconcile that static graph with existing passive web or Electron Evidence through `reconcile_javascript_runtime` or `rea reconcile-javascript-runtime`. Exact captured bytes outrank caller-declared file/URL mappings; target, frame, script, worker, cache, and asset ambiguity stays explicit, source-map authority stays separate, and a module resident in an observed bundle is never reported as executed. See [JavaScript static/runtime reconciliation](docs/javascript-runtime-reconciliation.md).
-- Trace a literal route, string, API, IPC channel, module, or native export through authenticated application Evidence with explicit traversal bounds, then hand exact native artifact digests and requested exports to retained Ghidra or Hopper Evidence without automatic provider switching. Compare application versions using unique-only digest, source-map, structural, and semantic tiers; map a committed historical source inventory to bundle nodes with explicit digest and path scores; compare one exact JavaScript export's static return shapes through unique literal discriminants and bounded JSON Pointer changes. Duplicate, dynamic, incomplete, ambiguous, and truncated facts stay unknown. See [cross-layer JavaScript application workflows](docs/javascript-application-workflows.md).
-- Classify PE/CLI managed artifacts with `inspect_managed_artifact` / `rea inspect-managed-artifact`, inspect bounded metadata members, signatures, raw CIL hashes, limited decoded-instruction-tuple v1 hashes, separately reported exception regions, call edges, and field-access anchors with `inspect_managed_members` / `rea inspect-managed-members`, inventory declared ModuleRef/ImplMap/PInvoke and non-IL method boundary indicators with `inspect_managed_native_boundaries` / `rea inspect-managed-native-boundaries`, then compare two authenticated member observations with `compare_managed_members` / `rea compare-managed-members`. `verify_managed_native_boundaries` / `rea verify-managed-native-boundaries` checks managed P/Invoke declarations against authenticated native export or function Evidence while keeping verified, inferred, contradicted, and unresolved states distinct. The comparison treats build-local tokens as build-local and uses unique decoded-CIL/signature and structural method-shape tiers, never names alone; the v1 tuple hash does not itself resolve tokens or fully commit control flow. `project_managed_application_graph` / `rea project-managed-application-graph` projects authenticated managed artifact/member/native-boundary Evidence into the existing application graph for cross-layer feature tracing. `import_managed_reconstruction` / `rea import-managed-reconstruction` admits user-supplied decompiler C#/IL/pseudocode as analyst inference only after exact artifact SHA-256, MVID, signature, and the shipped v1 decoded-IL commitment match. Separately, `plan_managed_runtime_correlation` / `rea plan-managed-runtime-correlation` can admit a default-disabled, permission-gated runtime-correlation plan locked to the same build evidence. These paths never load the assembly, resolve CLR dependencies, execute target code, run a decompiler, or translate managed tokens into native addresses; full normalized-CIL v2 semantics, native-body bridge mapping, and an actual runtime executor remain future managed-code contracts.
-- Configure `REA_ILSPY_CMD_PATH=/absolute/path/to/ilspycmd` only when you want
-  doctor and `verify:managed` to inspect a bring-your-own ILSpy command as a
-  real reconstruction oracle. REA does not install ILSpy and does not treat
-  decompiler text as canonical metadata or CIL observation.
-- Traverse content-addressed artifact graphs without extraction; on macOS, read-only DMG traversal additionally requires `native_mount_approved: true` and `REA_ARTIFACT_NATIVE_MOUNT_ENABLED=true`. Materialize only approved occurrences into absent output roots.
-- Build bounded function dossiers with pseudocode, assembly, CFG edges, comments, calls, references, strings, and names.
-- Search and trace features across symbols, strings, metadata, references, and call paths.
-- Record every successful result as deterministic Evidence v2 with artifact and provider identity, confidence, authority, limitations, and locations.
-- Export and import evidence bundles across sessions.
-- Persist automatic cross-version artifact runs as canonical, lock-protected workspaces with tamper-evident revision commitments.
-- Capture approved PTY scenarios as Process Capture v4 Evidence, including committed run manifests, raw and rendered terminal frames, scripted interactions, descendant settlement, named filesystem checkpoints, deterministic command shims, and loopback HTTP/WebSocket exchanges.
-- Validate finite replay machines without launching a target through `run_replay_machine` or `rea run-replay-machine`; ordered events return typed decisions, actions, captured aliases, transition journals, final state, and exact limit use without echoing request or captured values.
-- Compare complete artifact inventories by stable path, content, metadata, and relations; incomplete evidence never implies equivalence.
-- Compare explicit function dossiers across text, calls, references, strings, and address-normalized CFG topology with per-facet unknowns.
-- Compare canonical Evidence bundles by exact membership, explicit observation pairs, and residual-unknown histories without turning omissions into behavioral absence.
-- Aggregate runtime comparisons into observed behavior changes while keeping static artifact/function differences labeled as candidates.
-- Build bounded, Evidence-cited direct call paths by exact address without treating missing dossiers as graph leaves.
-- Correlate exact static/runtime findings through explicit hypotheses without claiming causality from cochange.
-- Verify finite behavioral and structural reconstruction specifications with pass, fail, and unknown kept distinct.
-- Track residual unknowns through immutable CAS revisions, evidence-qualified resolution, contradictions, probes, and validated dependency relationships.
-- With explicit `unknown_registry_approved: true`, record bounded trace/capture residuals, typed provider unavailability, and capture disagreements automatically.
-- Start six [guided MCP workflows](docs/mcp-prompts.md) with live, session-aware completion for documents, procedures, providers, evidence, captures, artifact IDs, and active unknowns.
+- **Native binaries:** Open Mach-O, ELF, PE, and Mac `.app` targets through Hopper or Ghidra. Inspect functions, strings, assembly, decompilation, calls, and references. Hopper also accepts `.hop` databases and supports annotations.
+- **Packages and resources:** Inspect directories, ZIP, APK, IPA, ASAR, plists, compiled Interface Builder files, and Apple asset catalogs. Artifact requests name the input and requested extraction or traversal directly; macOS DMG traversal also requires the host's native mounting support.
+- **JavaScript and Electron:** Map modules, imports, source maps, routes, IPC channels, storage, and native add-ons without running the app. Compare builds and trace a feature across the recovered graph. Dynamic and ambiguous relationships remain unresolved. See [JavaScript application workflows](docs/javascript-application-workflows.md).
+- **Websites:** Inspect a selected page in an existing Chrome-family browser. Capture page structure, network metadata, script evidence, and screenshots requested by the call. Passive observation does not navigate or execute page JavaScript. See [browser observation](docs/browser-observation.md).
+- **Electron and Node runtime observation:** Inspect selected Electron pages or attach to a Node/Electron V8 Inspector target. Inspector observation records script locations and execution-context events; it does not infer imports, IPC activity, or which modules executed. See [runtime observation](docs/javascript-runtime-observation.md).
+- **.NET assemblies:** Inspect metadata and CIL instructions, compare builds, and check declared native dependencies without loading or running the assembly. Imported decompiler output is labeled as analyst inference. See [managed-code analysis](docs/managed-code-analysis.md).
+- **Controlled behavior capture:** Run process, browser, or Electron scenarios with the target, actions, and lifecycle declared in each request, then compare the resulting evidence. Missing observations cannot establish that two runs behaved the same way.
+- **Evidence and comparison:** Save results with artifact identity, provider, locations, confidence, and limitations. Export or import bundles, compare artifacts and functions, and connect static findings to runtime observations without claiming causality from correlation.
+- **Open questions:** Track unresolved findings, contradictions, and follow-up probes. Reconstruction checks report pass, fail, or unknown rather than treating missing evidence as a pass.
+- **Guided workflows:** Start six [MCP investigation workflows](docs/mcp-prompts.md) with suggestions based on your current session.
 
-Hopper is the first provider, not the boundary of the project. Some current workflows still require Hopper and macOS; every evidence record identifies the provider and limitations behind its result.
+Windows Ghidra P0 supports the read-only native x86-64 PE boundary on local NTFS. Hopper-only features, such as GUI controls and annotations, are not available through Ghidra.
 
 ### Website observation with CDP
 
-REA can inspect an already-running Chrome-family browser that you own. Browser observation is disabled by default and requires a literal loopback CDP endpoint plus exact approved page origins:
+REA can inspect an already-running Chrome-family browser through a literal loopback CDP endpoint. Each request names the endpoint and target; an optional origin filter can narrow discovery:
 
 ```bash
-export REA_BROWSER_OBSERVE_ENABLED=true
-export REA_BROWSER_CDP_ENDPOINTS_JSON='["http://127.0.0.1:9222"]'
-export REA_BROWSER_ALLOWED_ORIGINS_JSON='["http://127.0.0.1:3000"]'
-
-rea list-browser-targets http://127.0.0.1:9222 --approved --json
-rea inspect-web-page http://127.0.0.1:9222 TARGET_ID --approved --json
+rea list-browser-targets http://127.0.0.1:9222 --json
+rea inspect-web-page http://127.0.0.1:9222 TARGET_ID --json
 ```
 
-All eight browser tools expose the same Evidence v2 contracts over CLI and MCP. Inspection is passive: REA does not evaluate page JavaScript, navigate, click, close the page, or close the browser. Query values, credentials, cookies, authorization headers, storage values, and raw JSON or WebSocket values are never retained. Separately approved captures can retain bounded redacted console primitives, value-free JSON/WebSocket shapes, script sources, accessibility text, or screenshot pixels. Existing activity before attach is explicitly unavailable. See [Website observation with CDP](docs/browser-observation.md) for browser startup, schemas, limits, and the threat model.
+The eight passive browser tools work through both CLI and MCP. They inspect the selected page without navigating, clicking, or evaluating its JavaScript. Credentials, cookies, authorization headers, and raw payload values are not retained. A request selects whether to include script sources, accessibility text, screenshots, or console and payload summaries. REA cannot observe activity that happened before it attached. See [browser observation](docs/browser-observation.md) for browser startup, capture options, and limits.
 
 ### Controlled browser scenarios
 
-`capture_browser_scenario` is a separate, explicitly mutating browser boundary.
-It runs only the fixed, versioned scenario vocabulary through Playwright and
-returns step-indexed Evidence for screenshots, DOM, accessibility, URL/history,
-storage, console/errors, network, WebSockets, frames, workers, popups, and
-cancelled downloads. Missing or truncated sections can never support equality
-claims.
+`capture_browser_scenario` runs a caller-declared sequence of browser actions through
+Playwright. Unlike passive observation, it can interact with the page. Each
+step records evidence such as screenshots, page structure, navigation, and
+network activity. Missing or truncated observations cannot establish that two
+runs behaved the same way.
 
 ```bash
-export REA_BROWSER_SCENARIO_ENABLED=true
-export REA_BROWSER_SCENARIO_EXECUTABLE_ROOTS_JSON='["/usr/bin"]'
-export REA_BROWSER_SCENARIO_CDP_ENDPOINTS_JSON='["http://127.0.0.1:9222"]'
-export REA_BROWSER_SCENARIO_ALLOWED_ORIGINS_JSON='["http://127.0.0.1:3000"]'
-export REA_BROWSER_SCENARIO_ALLOWED_ENV_JSON='["REA_TEST_PASSWORD"]'
-
 rea capture-browser-scenario ./scenario.json --json
 ```
 
 Launch mode owns a temporary browser profile and removes it after terminating
 the launched browser. Connect mode accepts one exact loopback CDP target and
-disconnects without closing the external browser. Automation has no default
-grant: use the shared project/session policy, or set
-`REA_BROWSER_SCENARIO_AUTO_GRANT=true` only for a trusted unattended
-environment. Scenario JSON contains secret references and environment-variable
-names, never secret values. See the
+disconnects without closing the external browser. The request supplies the
+selected executable or endpoint, actions, and any origin or environment
+selections needed by the scenario. Scenario JSON contains secret references and
+environment-variable names, never secret values. See the
 [browser scenario contract](docs/browser-scenario-contract.md).
 
 ### Node and Electron V8 Inspector observation
 
-Attach-only JavaScript runtime observation is separately disabled by default:
+Node and Electron runtime observation attaches to an existing Inspector target named in the request:
 
 ```bash
-export REA_V8_INSPECTOR_OBSERVE_ENABLED=true
-export REA_V8_INSPECTOR_ENDPOINTS_JSON='["http://127.0.0.1:9229"]'
-export REA_V8_INSPECTOR_FILE_ROOTS_JSON='["/absolute/path/to/app"]'
-export REA_V8_INSPECTOR_ALLOWED_ORIGINS_JSON='[]'
-
-rea list-javascript-runtime-targets http://127.0.0.1:9229 --approved --json
+rea list-javascript-runtime-targets http://127.0.0.1:9229 --json
 rea observe-javascript-runtime http://127.0.0.1:9229 TARGET_ID \
-  --runtime-kind node --approved --json
+  --runtime-kind node --json
 ```
 
-REA sends only `Runtime.enable` and `Debugger.enable`. It retains bounded,
-scope-authorized script locations and execution-context lifecycle events;
-require/import edges, EventEmitter activity, Electron IPC, PID identity, and
-Electron role identity stay explicit unknowns. See
-[passive Node and Electron runtime observation](docs/javascript-runtime-observation.md).
+REA records script locations and execution-context events without evaluating
+code or setting breakpoints. These observations do not establish import
+relationships, event activity, IPC, process identity, or Electron roles. See
+[Node and Electron runtime observation](docs/javascript-runtime-observation.md)
+for the exact coverage.
 
-Exact package, tool-family, provider, setup-client, public schema-version, and CLI facts are generated from source in [`docs/product-catalog.json`](docs/product-catalog.json). PR CI verifies this catalog, narrative documentation, generated schemas, and a clean TypeDoc render.
+Exact package, tool-family, provider, setup-client, schema, and CLI facts are generated from source in [`docs/product-catalog.json`](docs/product-catalog.json). PR CI verifies this catalog, narrative documentation, and generated schemas.
 
 ## Roadmap
 
-REA is growing into a toolkit for understanding software across static artifacts and observed behavior. The [current status](#current-status) above is the shipped baseline; the items below are planned work.
+The [current status](#current-status) section describes shipped capabilities. These are the next areas of work.
 
 ### Now
 
-1. **Maintain truthful product metadata** — extend the shipped canonical catalog and drift checks whenever versions, tools, providers, schemas, setup clients, or CLI capabilities change.
-2. **Cross-provider conformance growth** — add source-owned architectures and difficult indirect/thunk cases while preserving semantic comparison and provider-specific text boundaries.
+1. **Keep documentation accurate:** update the generated catalog and documentation checks when tools, providers, setup options, or versions change.
+2. **Test more native binaries:** expand architecture and indirect-call coverage across Hopper and Ghidra.
 
 ### Next
 
-1. **Controlled replay conformance growth** — extend the shipped Linux extracted-module sandbox with more source-owned hostile fixtures and cross-kernel conformance; browser or Electron interaction remains a different future authority.
-2. **Broader application graph evidence** — extend authenticated cross-layer traces with additional static extractors and separately approved runtime authorities.
-3. **Professional managed-code analysis** — extend shipped PE/CLI triage, CIL evidence, managed/native declaration inventory, source-owned conformance, and obfuscation-resistant comparisons toward verified native-provider composition under the accepted [managed-code boundary](docs/managed-code-analysis.md).
-4. **Deterministic behavior harnesses** — extend process ownership, protocol fixtures, filesystem observation, reconnects, and cross-version behavioral comparison.
+1. **Connect more application layers:** add static extractors and runtime observations to feature traces.
+2. **Extend .NET analysis:** improve comparisons of obfuscated assemblies and connect managed findings to verified native analysis. See the [managed-code guide](docs/managed-code-analysis.md).
+3. **Compare more runtime behavior:** expand process, protocol, filesystem, reconnect, and version-comparison coverage.
 
 ### Later
 
-1. **Controlled application interaction** — evaluate separately authorized full-application driving without widening passive browser, Electron, or extracted-module replay authority.
-2. **Native runtime observation** — approval-gated LLDB, Frida, system logs, process/filesystem observers, and native API tracing.
-3. **Additional providers and targets** — evaluate IDA/Hex-Rays, Binary Ninja, Rizin, LIEF, Windows-native providers, mobile artifacts, firmware, document formats, and other software-defined systems.
+1. **Expand browser and Electron interaction:** add scenario actions beyond the current click and wait operations.
+2. **Observe native apps at runtime:** explore LLDB, Frida, system logs, and native API tracing.
+3. **Evaluate more tools and targets:** assess IDA/Hex-Rays, Binary Ninja, Rizin, LIEF, Windows-native tools, mobile apps, and firmware.
 
-New providers must produce the same evidence and safety metadata as existing capabilities before they become part of the public workflow. Once REA has multiple optional toolchains, setup can become capability-selective; the consent rules for that future work are recorded in the [installation roadmap](docs/roadmap.md).
+Setup already lets you choose agent integration and Hopper installation. Support for installing additional analysis tools is future work, described in the [installation roadmap](docs/roadmap.md).
 
-See the [static-analysis provider evaluation](docs/provider-evaluation.md) for the shipped Ghidra function-analysis boundary, remaining admission gates, and provider comparison matrix; [ADR-0001](docs/adr/0001-provider-selection-and-analysis-profiles.md) for binding, selection, profile, snapshot, and compatibility decisions; the [controlled replay guide](docs/controlled-javascript-replay.md) plus [ADR-0002](docs/adr/0002-controlled-replay-authority-and-sandbox.md) for the shipped JavaScript replay boundary; and [ADR-0003](docs/adr/0003-managed-code-evidence-and-provider-boundary.md) for the managed-code evidence and provider design.
+See [provider evaluation](docs/provider-evaluation.md) for coverage and remaining requirements, and the [native investigation guide](docs/native-investigation.md) for UI, dispatch, and value-flow analysis.
 
 ## Using REA with other agents
 
-Setup detects Claude Code, Claude Desktop, Codex, Cursor, Gemini CLI, Windsurf, and Devin. It automatically configures the first six when present; detected Devin installations are reported but left unchanged. Any agent that supports local MCP servers can use REA with the configuration below.
+Setup offers supported agent integrations for selection. Existing REA registrations are selected by default; newly detected agents remain unselected until chosen. Any agent that supports local MCP servers can use the configuration below.
 
 ### Manual MCP configuration
 
@@ -537,7 +424,7 @@ Setup detects Claude Code, Claude Desktop, Codex, Cursor, Gemini CLI, Windsurf,
   "mcpServers": {
     "rea": {
       "command": "npx",
-      "args": ["-y", "rea-agents@2.6.0", "mcp"]
+      "args": ["-y", "rea-agents@4.0.1", "mcp"]
     }
   }
 }
@@ -546,11 +433,11 @@ Setup detects Claude Code, Claude Desktop, Codex, Cursor, Gemini CLI, Windsurf,
 <!-- x-release-please-end -->
 
 Persistent registrations should use one exact package version. `rea setup`
-maintains that pin, upgrades the bundled skill at the same time, and gives Codex
-a 30-second startup allowance for a cold package-runner start. An interactive
-`rea upgrade` opens the updated setup plan after installing the new executable;
-structured or non-interactive upgrades tell you to run that sync explicitly.
-Restart clients whose approved registration changed.
+maintains that pin, updates the bundled skill at the same time, and gives Codex
+a 30-second startup allowance for a cold package-runner start. `rea update`
+installs an exact release and verifies the new executable. It returns an
+unapplied maintenance plan for existing REA integrations, with a scoped setup
+command to review and approve their changes. Restart affected agents afterward.
 
 MCP clients that support prompts can also discover six ordered investigation
 workflows through `prompts/list`. Their optional identifier arguments use the
@@ -563,11 +450,10 @@ current session for bounded `completion/complete` suggestions; see
 flowchart LR
     Agent["Agent"] --> REA["REA<br/>CLI + MCP"]
     Terminal --> REA
-    REA --> Workspace["Investigation workspace<br/>evidence + artifacts + captures"]
     REA --> Session["Target-bound session router"]
     Session --> Registry["Deep-provider registry<br/>deterministic selection"]
     Registry --> Hopper["Hopper provider"]
-    Registry --> Ghidra["Ghidra provider<br/>read-only inventory + function analysis"]
+    Registry --> Ghidra["Ghidra provider<br/>inventory + function analysis + annotations"]
     Hopper --> Runtime["Owned provider runtime<br/>deadline + bounded diagnostics + cleanup"]
     Ghidra --> Runtime
     Session --> Native["Native macOS provider"]
@@ -580,7 +466,7 @@ flowchart LR
     Artifact --> Target
 ```
 
-The CLI and MCP server use the same application workflows and evidence contracts. A provider declares which capabilities it supports and the side effects those capabilities may have. Terminal commands are short-lived; an MCP session can retain an active target and evidence ledger across an investigation. Approved persistent workspaces keep canonical Evidence and resumable run checkpoints across both process and session lifetimes.
+The CLI and MCP server use the same application workflows and evidence contracts. A provider declares which capabilities it supports and the side effects those capabilities may have. Terminal commands are short-lived; an MCP session can retain an active target and evidence ledger for the session.
 
 ## CLI
 
@@ -589,27 +475,25 @@ The agent workflow above is the easiest way to use REA. For a one-off overview f
 ```bash
 npx -y rea-agents@latest analyze /Applications/Notes.app
 npx -y rea-agents@latest inspect /Applications/Notes.app
-npx -y rea-agents@latest inspect /Applications/Notes.app --detail detailed --limit 20
 npx -y rea-agents@latest search /Applications/Notes.app "offline"
 npx -y rea-agents@latest function /Applications/Notes.app 0x1000
 npx -y rea-agents@latest xrefs /Applications/Notes.app 0x1000
 npx -y rea-agents@latest trace /Applications/Notes.app "offline"
 npx -y rea-agents@latest compare /absolute/path/to/left-evidence.json /absolute/path/to/right-evidence.json
-npx -y rea-agents@latest investigate-versions /path/to/v1 /path/to/v2 /absolute/path/to/evidence/releases.json --yes
 npx -y rea-agents@latest capabilities
 npx -y rea-agents@latest providers
 ```
 
 Run `npx -y rea-agents@latest --help` for direct decompilation, bounded search and
 other options. `analyze` and `inspect` share the same overview workflow;
-`function`, `xrefs`, and `trace` return the same Evidence v2 envelopes as MCP.
+`function`, `xrefs`, and `trace` return the same Evidence envelopes as MCP.
 
 Or install the `rea` command globally:
 
 ```bash
 npm install --global rea-agents
 rea --help
-rea upgrade
+rea update
 rea mcp
 ```
 
@@ -617,8 +501,7 @@ REA accepts a Mac `.app` folder directly. If an agent cannot find an app by name
 
 ### Choosing a deep-analysis provider
 
-Every deep-analysis open resolves a provider before creating its client. The
-same selector and precedence apply to the CLI, MCP, and startup configuration:
+Choose which analysis tool to use from the CLI:
 
 ```bash
 rea providers --json
@@ -635,47 +518,29 @@ For MCP, pass the optional selector on `open_binary`:
 }
 ```
 
-The request-level `provider_id` or `--provider` wins over
-`REA_ANALYSIS_PROVIDER`; all accept a provider ID or `auto`. Automatic selection
-binds the sole usable deep candidate, reports `ambiguous` when several are
-usable, and can leave an artifact-only target unbound so its disjoint artifact
-operations still work. An explicit unknown, unavailable, or unsupported
-provider fails with candidate IDs, stable rejection codes, and actionable local
-diagnostics. `binary_session`, `rea providers`, and `rea capabilities` expose
-the authoritative `analysis_provider_candidates` and
-`analysis_provider_binding` fields. Each open target also has an
-`analysis_run.run_id` allocated before provider startup. When dynamic providers
-start, `analysis_run.process_lineage` changes from `not_observed` to `snapshots`
-and retains one provider-attributed, token-verified observation per started
-provider. Each observation carries `observed_at` and remains `unavailable` or
-`verified`; a verified empty descendant list is distinct from both. Snapshots
-describe bounded observations, not current live state or historical absence.
-For providers with serial work, `analysis_activity` distinguishes `idle`,
-`busy`, and `timed_out_busy`, and reports the active operation, elapsed time,
-caller state, timeout, and queued-request count. A caller timeout therefore
-does not falsely imply that Hopper's Python thread is available. `close_binary`
-clears the REA session but returns `cleanup_incomplete` when authenticated
-document shutdown, owned process cleanup, or private runtime removal cannot be
-verified.
-Reopening same target without a selector keeps its binding; runtime failure
-never selects another provider silently.
-Ghidra can appear as an available, target-compatible candidate after doctor
-validates its exact installation. Its capability list contains the 19 admitted
-read-only inventory and function-analysis operations; selecting it still does
-not make Hopper-only GUI or mutation operations available and never triggers a
-silent fallback.
+Use `--provider`, or `provider_id` in MCP, to choose Hopper or Ghidra for a target. This choice overrides `REA_ANALYSIS_PROVIDER`.
+
+With `auto`, REA selects the only available tool that supports the target. If both are available, specify one before opening the target. The session keeps that choice until you explicitly switch or close it; a failure never silently switches tools. Artifact-only analysis can work without a native analysis tool.
+
+Run `rea providers` and `rea capabilities` to check availability and supported operations. Ghidra supports inspection and atomic function annotation edits on Linux and macOS. Its database edits are discarded on close; GUI controls require Hopper. Windows Ghidra P0 supports read-only analysis of native x86-64 PE applications on local NTFS with bundled native controls.
+
+The session also reports active work and cleanup status. If a caller times out, the analysis tool may still be busy; `analysis_activity` reports that state. A `cleanup_incomplete` result identifies resources whose shutdown or removal could not be verified. See [provider selection and analysis profiles](docs/adr/0001-provider-selection-and-analysis-profiles.md) for session, cache, and process-tracking details.
 
 ### CLI exit status
 
-| Status    | Meaning                                                                                                                                                                                                                                                                  |
-| --------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ |
-| `0`       | The requested operation completed. Truthful unknowns, warnings, and bounded or truncated evidence remain successful results.                                                                                                                                             |
-| `1`       | Arguments, policy, permission, provider analysis, integrity checking, cancellation, timeout, setup, diagnostics, update, uninstall, output encoding, or output writing prevented completion. Structured output identifies the failure category when REA could encode it. |
-| `128 + N` | The process ended from signal `N`, where the shell or runtime preserves the conventional signal-derived status.                                                                                                                                                          |
+| Status    | Meaning                                                                                                                                                                        |
+| --------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ |
+| `0`       | The operation completed. Results may still include warnings, partial evidence, or unresolved questions.                                                                        |
+| `1`       | The operation could not complete, for example because of invalid input, host permission denial, cancellation, or timeout. Structured output reports the reason when available. |
+| `128 + N` | The process ended from signal `N`, where the shell or runtime preserves the conventional signal-derived status.                                                                |
 
-`setup` returns `1` for `planned`, `needs_confirmation`, or `needs_human`
+`setup --dry-run` returns status `planned` and exits `0`. A setup result with
+status `cancelled` also exits `0`.
+`setup` returns `1` for `needs_confirmation` or `needs_human`
 because configuration is not ready; rerun it after approval or remediation.
-`doctor` returns `1` when any check is unhealthy. Output format, full envelopes,
+`doctor` returns `1` when required checks for its readiness scope are unhealthy.
+Unavailable optional provider prerequisites remain visible as informational
+diagnostics and do not block setup or unrelated providers. Output format, full envelopes,
 filters, and token controls never change the operation status.
 
 When REA feeds a shell pipeline, enable `pipefail` so a downstream formatter
@@ -683,35 +548,27 @@ cannot hide its failure:
 
 ```bash
 set -o pipefail
-rea inventory-artifact ./app.asar --json | jq . > inventory.json
+rea inspect-artifact ./app.asar --json | jq . > inspection.json
 ```
 
 ## Current Hopper provider
 
-REA starts Hopper when needed; Hopper does not need to be running first. Hopper's launcher internally activates the application, so opening a target may bring Hopper to the foreground. REA asks macOS to start Hopper hidden and in the background when possible, but cannot guarantee that it will remain behind the current application.
+REA starts Hopper when an operation needs it. On macOS, Hopper may bring its window or a dialog to the foreground even though REA requests background startup. Demo or license prompts may need your attention.
 
-REA derives explicit format and architecture arguments to prevent common FAT and ARM selection dialogs. Other Hopper or macOS dialogs may still require a person. REA reports timeouts and remediation through CLI or MCP results instead of attempting to answer UI prompts.
+Hopper handles one analysis request at a time. Cancelling your wait does not stop work already running inside Hopper; the session reports whether it is still busy. Successful decompilation results are cached until a relevant rename or comment change.
 
-Hopper bridge calls pass through a bounded serial FIFO because Hopper's Python API runs on one dedicated thread. Queue wait counts against the caller deadline; a timeout settles the caller but does not release the wire slot until Hopper actually replies. `binary_session.analysis_activity` exposes that detached work and MCP progress reports elapsed time. Successful decompilation text is cached per document and procedure, shared by pseudocode and dossier requests, and invalidated after rename or comment mutation.
+Use `rea instructions` when you only need assembly instructions for a function. It avoids decompilation and a whole-program inventory.
 
-Hopper's synchronous public Python calls cannot stream a partial response after the caller deadline. Use `read_function_instructions` or `rea instructions` when raw instruction orientation is enough: this path does not decompile or scan whole-program name/string inventories. If a dossier has already timed out, inspect `analysis_activity`; do not assume a raw request can enter the serial bridge until that detached Hopper call actually returns.
+Closing a session shuts down REA's bridge and removes its temporary socket directory while preserving a Hopper application you may be using. If cleanup cannot be verified, `close_binary` reports `cleanup_incomplete` and the affected resources.
 
-Closing a REA session shuts down its bridge and removes its private socket directory. It does not quit a Hopper application the user may be using. If shutdown or cleanup cannot be verified, `close_binary` returns `cleanup_incomplete` with the affected local resources.
+## Process capture
 
-## Advanced process-capture setup
+Process capture runs the exact executable and scenario declared in the request,
+with the requested working directory and environment. Filesystem observation
+paths select what to snapshot. The process runs with your user permissions;
+Process Capture records behavior and is not a security sandbox.
 
-Process capture is disabled by default. Enabling it requires
-`REA_PROCESS_CAPTURE_ENABLED=true`, approved executable and working roots in
-`REA_PROCESS_EXECUTABLE_ROOTS_JSON` and `REA_PROCESS_WORKING_ROOTS_JSON`, and an
-environment allowlist in `REA_PROCESS_ALLOWED_ENV_JSON`. Because the current PTY
-adapter uses host networking, it also requires
-`REA_PROCESS_ALLOW_EXTERNAL_NETWORK=true`.
-
-Set `REA_PROCESS_CAPTURE_AUTO_GRANT=false` to configure those process-capture
-limits as a ceiling without implicitly granting them. This mode remains
-fail-closed until a narrower grant is established.
-
-Capture a scenario or compare two saved Process Capture v4 Evidence records:
+Capture a scenario or compare two saved Process Capture Evidence records:
 
 ```bash
 rea capture-process ./scenario.json > authority.json
@@ -720,9 +577,9 @@ rea compare-process-captures authority.json reconstruction.json
 ```
 
 The comparison reports each observed dimension separately and identifies the
-first terminal, interaction, exit, filesystem, protocol, process, or shim
-divergence. See [Process Capture v4](docs/process-capture.md) for scenario
-fields, command-shim replay, checkpoint triggers, limits, and safety behavior.
+first terminal, interaction, exit, filesystem, or process divergence.
+See [Process Capture](docs/process-capture.md) for scenario fields, limits, and
+evidence boundaries.
 
 REA installs a prebuilt PTY backend for supported macOS, Linux, and Windows
 architectures. If the capability check reports that the backend is unavailable,
@@ -739,7 +596,11 @@ verified or absent.
 
 ## Security model
 
-REA does not provide a hosted analysis service. Hopper and Linux Ghidra bridge communication uses authenticated private local sockets. Windows Ghidra P0 uses authenticated IPv4 loopback but does not claim named-pipe DACL or hostile-local-user isolation. Dynamic capabilities are disabled by default and require both operator policy and explicit per-call approval. Shipped providers, passive observers, and Process Capture are not security sandboxes: providers and launched targets run with the current user's permissions. Extracted JavaScript replay is a distinct Linux-only capability that fails closed unless Bubblewrap namespaces, architecture-checked seccomp, private runtime mounts, and delegated cgroup limits are available; it never inherits browser, Electron, or Process Capture authority. See [ADR-0002](docs/adr/0002-controlled-replay-authority-and-sandbox.md). Report vulnerabilities through the private process in [SECURITY.md](SECURITY.md).
+Analysis runs locally. REA communicates with Hopper and Ghidra through authenticated private local sockets. Your agent or model provider has its own data policy.
+
+Runtime requests act on the declared target and lifecycle. Analysis tools and launched targets run with your user permissions, and native UI capture still depends on macOS Accessibility and Screen Recording access. Static JavaScript analysis does not execute extracted modules; use direct browser, Electron, or process capture when runtime behavior is needed.
+
+Windows Ghidra P0 automatically uses native Job Objects, protected private-runtime DACLs, and handle-based admission. Its experimental scope is native x86-64 PE applications on local NTFS. Report vulnerabilities through the private process in [SECURITY.md](SECURITY.md).
 
 ## FAQ
 
@@ -753,7 +614,7 @@ No. REA starts Hopper when an operation needs it. An already-running Hopper appl
 <details>
 <summary><strong>Why did Hopper appear in front of my other windows?</strong></summary>
 
-Hopper's launcher internally activates the application. REA requests background startup, but macOS and Hopper may still bring a window or dialog forward. See [Hopper application behavior](#hopper-application-behavior).
+Hopper's launcher internally activates the application. REA requests background startup, but macOS and Hopper may still bring a window or dialog forward. See [Current Hopper provider](#current-hopper-provider).
 
 </details>
 
@@ -767,7 +628,7 @@ No. Setup can install Hopper for you, but Hopper remains separate software with
 <details>
 <summary><strong>Does REA install or include Ghidra or Java?</strong></summary>
 
-No. Ghidra support is bring-your-own. REA packages only its Java bridge source, validates the exact supported Ghidra 12.1.2 and 64-bit JDK 21 installation, and loads that bridge through Ghidra's external script path after setup approval records the paths.
+No. REA connects to an existing Ghidra installation. Run setup after providing the Ghidra and Java paths shown in the [Ghidra section](#ghidra-analysis-provider).
 
 </details>
 
@@ -788,45 +649,17 @@ No decompiler can guarantee the original source. REA gives an agent pseudocode,
 <details>
 <summary><strong>Which agents can use REA?</strong></summary>
 
-Any agent that can run a local MCP server can use the manual configuration. Setup detects Claude Code, Claude Desktop, Codex, Cursor, Gemini CLI, Windsurf, and Devin; it automatically configures the first six when present and reports Devin without modifying it.
+Any agent that can run a local MCP server can use the manual configuration. Setup offers the supported integrations listed in [Installation and setup](docs/installation.md#supported-agents); existing REA registrations are selected by default, and other detected agents require selection.
 
 </details>
 
 ## Development
 
-See [CONTRIBUTING.md](CONTRIBUTING.md) for setup, architecture, tests, and release instructions. PR CI publishes generated API documentation as the `api-docs` workflow artifact.
+See [CONTRIBUTING.md](CONTRIBUTING.md) for development setup and contribution checks, and [docs/testing.md](docs/testing.md) for test scopes and real-tool verification. `npm run docs:check` checks committed generated documents; `npm run docs:generate` regenerates them.
 
-`npm run verify:agent` runs brandless native, JavaScript-application, managed,
-and browser prompts through a real local Codex CLI. Its JSON report measures
-natural MCP use, first-tool routing, repeated calls, actual Codex token usage,
-completion quality, and explicit treatment of authority and unknowns.
+`npm run verify:agent` evaluates native, JavaScript, managed, and browser investigation tasks through a real local Codex CLI. Its report covers tool selection, repeated calls, token use, completion quality, and handling of permissions and unknowns.
 
-`npm run evidence:generate` regenerates the managed conformance manifest and
-Evidence v2 completion ledger from live verifier output. `npm run
-evidence:check` reruns the verifier and fails when artifacts, scenarios,
-providers, schemas, claim counts, Evidence IDs, or the bundled skill have
-drifted. Unsupported claims remain explicit and never count as passes.
-Verifier JSON reports include an ephemeral `verifier_run` UUID allocated before
-the verifier performs work and inherited by its child processes through
-`REA_PROCESS_RUN_ID`. The final report includes the verifier and parent PIDs
-plus `process_lineage` and its ISO `observed_at` timestamp: POSIX verifiers
-report a token-verified, point-in-time launcher process group and live
-descendants, while platforms without an owned
-lineage primitive report `status: "unavailable"` and a reason. An empty verified
-descendant list means no child was live during the final observation; it does
-not claim the verifier launched no children earlier. Nested verifier entrypoints
-in the same process reuse its UUID; each new verifier process replaces any
-inherited parent token with a fresh run identity.
-Generated completion commitments deliberately exclude this per-execution
-identity, so check mode remains deterministic while live reports remain
-attributable.
-
-Owned Hopper shutdown logs retain the launcher PID, process-group ID, cleanup
-status, and whether a verified group signal was required. They omit the run
-token and unexpected exception text. The real-Hopper verifier also starts an
-unrelated `Hopper`-named sentinel in a distinct process group and fails unless
-that process survives every session close; the sentinel is removed only by the
-verifier after the survival check.
+`npm run evidence:generate` regenerates the managed conformance manifest and Evidence completion ledger from live verification results. `npm run evidence:check` reruns verification and checks for drift. Unsupported claims remain explicit and do not count as passes. See [testing](docs/testing.md) for verification commands and process-cleanup checks.
 
 ## Project links
 

README_ar.md

@@ -4,7 +4,7 @@
 
 # REA: هندسة أي شيء عكسيًا
 
-### واجهة CLI وخادم MCP واحدان يمكّنان وكلاء البرمجة من إجراء هندسة عكسية لأي شيء
+### استقصِ سلوك التطبيقات والملفات التنفيذية الأصلية باستخدام وكيلك.
 
 **اعثر على ميزة تعجبك. افهم آلية عملها. ابنها بالطريقة التي تريدها.**
 
@@ -13,109 +13,152 @@
 [![MCP tool catalog](https://img.shields.io/badge/MCP-tool_catalog-5c4ee5?style=flat-square)](#منصة-أدوات-التحقيق)
 [![Node.js 22+](https://img.shields.io/badge/Node.js-22.19%2B-339933?style=flat-square&logo=nodedotjs&logoColor=white)](https://nodejs.org/)
 [![MIT license](https://img.shields.io/badge/license-MIT-f4c430?style=flat-square)](LICENSE)
+[![Discord](https://img.shields.io/discord/1556595354999332884?logo=discord&logoColor=white&label=Discord&color=5865F2)](https://discord.gg/GkcryMnJDM)
 
-[البدء السريع](#البدء-السريع) · [من الملف التنفيذي إلى السلوك](#من-الملف-التنفيذي-إلى-السلوك) · [دليل الأدوات](#منصة-أدوات-التحقيق) · [كيف يعمل](#كيف-يعمل) · [الأسئلة الشائعة](#الأسئلة-الشائعة)
+<a href="https://trendshift.io/repositories/82054?utm_source=trendshift-badge&amp;utm_medium=badge&amp;utm_campaign=badge-trendshift-82054" target="_blank" rel="noopener noreferrer"><img src="https://trendshift.io/api/badge/trendshift/repositories/82054/weekly?language=TypeScript" alt="morluto/rea | Trendshift" width="250" height="55" /></a>
+
+[البدء السريع](#البدء-السريع) · [حالة الدعم](#حالة-الدعم) · [من الملف التنفيذي إلى السلوك](#من-الملف-التنفيذي-إلى-السلوك) · [منصة أدوات التحقيق](#منصة-أدوات-التحقيق) · [خطة العمل](#خطة-العمل) · [كيف يعمل؟](#كيف-يعمل)
+
+<table aria-label="REA community">
+<tr>
+<td align="center" width="360">
+  <a href="https://discord.gg/GkcryMnJDM">
+    <img src="docs/assets/discord.svg" height="42" alt="Discord" /><br />
+    <strong>انضم إلى مجتمع الهندسة العكسية</strong>
+  </a><br />
+  <sub>Discord · أسئلة وأجوبة · شارك أعمالك</sub>
+</td>
+</tr>
+</table>
 
 <br />
 
-<code>curl -fsSL https://raw.githubusercontent.com/morluto/rea/main/install.sh | bash</code>
+<code>npx rea-agents setup</code>
+
+<br />
+
+<img src="docs/assets/rea-hopper-analysis.png" alt="REA يشغّل جسر التحليل داخل Hopper لفحص ملف تنفيذي أصلي" width="1200" />
 
 </div>
 
-هل وجدت في تطبيق ما ميزة تريدها في منتجك؟ أعط التطبيق إلى وكيل البرمجة حتى من دون شيفرته المصدرية. باستخدام REA، يستطيع الوكيل استقصاء الميزة وفهم آلية عملها ثم بناء نسخة ملائمة لتقنياتك وتصميمك ومتطلباتك.
+---
 
-يوفر REA هذه العملية عبر CLI وخادم MCP واحدين. يستطيع الوكيل قراءة شيفرة التطبيق وتتبع طريقة عمل الميزات ثم استخدام الأدلة مباشرة في عمله البرمجي المعتاد. ويتولى REA أدوات الهندسة العكسية المعقدة خلف واجهة واحدة.
+هل وجدت في تطبيق ميزة تريدها في منتجك؟ اطلب من وكيلك استقصاءها باستخدام REA. يستطيع فحص التطبيق من دون شيفرته المصدرية، وشرح طريقة عمل الميزة وعرض الأدلة، ثم بناء نسخة تناسب مشروعك.
+
+يوفر REA أدوات لتحليل الملفات التنفيذية الأصلية وتطبيقات JavaScript وElectron وتجميعات .NET والمواقع. يمكنك استخدامها من وكيلك أو من الطرفية. يعمل التحليل محليًا، وتتضمن النتائج الأدلة والقيود.
+
+يضبط Setup إعدادات الوكيل ويربطه بتثبيت موجود من Hopper أو Ghidra. ويمكنه تثبيت Hopper بعد موافقتك.
 
 ## اطلب من وكيلك مباشرة
 
-```bash
-npx rea-agents setup
-```
-
-ثم اطلب:
+بعد [الإعداد](#البدء-السريع)، أعد تشغيل الوكيل ثم اطلب:
 
 ```text
-أعد REA وأجر هندسة عكسية لتطبيق Notes. اشرح طريقة عمل البحث وكيف توصلت إلى ذلك،
-ثم ابنِ ميزة مشابهة لمشروعي.
+استقصِ طريقة عمل البحث في تطبيق Notes، واعرض الأدلة، ثم ابنِ ميزة مشابهة لمشروعي.
 ```
 
-تطبيق Notes مجرد مثال. يمكنك تسمية أي تطبيق تريد فهمه أو طلب البدء بنظرة عامة.
+استبدل Notes بالتطبيق الذي تريد فهمه، أو اطلب نظرة عامة أولًا.
 
 ## من الملف التنفيذي إلى السلوك
 
-| فك الترجمة                                                        | الفهم                                                     | إعادة الإنشاء                                                 |
-| ----------------------------------------------------------------- | --------------------------------------------------------- | ------------------------------------------------------------- |
+| فك الترجمة                                                       | الفهم                                                   | إعادة الإنشاء                                                 |
+| ---------------------------------------------------------------- | ------------------------------------------------------- | ------------------------------------------------------------ |
 | استخرج الشيفرة شبه المصدرية، والتعليمات، والسلاسل النصية، والرموز | تتبع تدفق التحكم والمراجع المتبادلة والاستدعاءات والأنواع | حوّل ما تعلمه الوكيل إلى ميزة تناسب تقنياتك وواجهتك ومتطلباتك |
 
 يوضح REA كيف وصل إلى نتائجه. وهو لا يدّعي استعادة الشيفرة المصدرية الأصلية أو استنساخ التطبيق تلقائيًا.
 
 ## لماذا REA؟
 
-|                      |                                                                                           |
-| -------------------- | ----------------------------------------------------------------------------------------- |
-| **مصمم للوكلاء**     | اسأل عما يفعله تطبيق مترجم ودع الوكيل يجمع الأدلة بدلًا من التخمين.                       |
-| **CLI وMCP**         | استخدم قدرات الهندسة العكسية نفسها من الطرفية أو وكيل البرمجة.                            |
-| **يتولى التعقيد**    | يدير REA إعداد الأدوات وفتح التطبيق واستمرار الاستقصاء والتنظيف بعد الانتهاء.             |
+|                      |                                                                                       |
+| -------------------- | ------------------------------------------------------------------------------------- |
+| **مصمم للوكلاء**      | اسأل عما يفعله تطبيق مترجم ودع الوكيل يجمع الأدلة بدلًا من التخمين.                      |
+| **CLI وMCP**         | استخدم قدرات الهندسة العكسية نفسها من الطرفية أو وكيل البرمجة.                        |
+| **يتولى التعقيد**    | يدير REA إعداد الأدوات وفتح التطبيق واستمرار الاستقصاء والتنظيف بعد الانتهاء.            |
 | **سير عمل كامل**     | انتقل من النظرة الأولى إلى الشيفرة شبه المصدرية وعلاقات الاستدعاء والأنواع وأدلة التنفيذ. |
-| **محلي حسب التصميم** | يجري التحليل على جهاز Mac ولا يرفع REA الملف التنفيذي إلى خدمة تحليل مستضافة.             |
-| **يحافظ على السياق** | استقصِ عدة ملفات تنفيذية من دون بدء التحليل من جديد عند كل سؤال.                          |
+| **محلي حسب التصميم** | يجري التحليل على جهازك المدعوم ولا يرفع REA الملف التنفيذي إلى خدمة تحليل مستضافة.     |
+| **يحافظ على السياق** | استقصِ عدة ملفات تنفيذية من دون بدء التحليل من جديد عند كل سؤال.                       |
 
 ## البدء السريع
 
-### باستخدام وكيل برمجة — موصى به
+### تشغيل الإعداد (موصى به)
+
+اربط REA بوكيلك:
 
 ```bash
 npx rea-agents setup
 ```
 
-اطلب من الوكيل إعداد REA. سيفحص جهاز Mac ويشرح ما يحتاج إلى تثبيته ويطلب الموافقة ويرشدك خلال رسائل النظام. أعد تشغيل الوكيل بعد الإعداد إذا طلب ذلك لتحميل مجموعة الأدوات الكاملة.
+يعرض Setup أولاً قائمة متعددة الاختيار للوكلاء الذين تريد ربطهم. تكون تسجيلات REA الموجودة محددة افتراضياً، ولا يؤدي اكتشاف عميل جديد وحده إلى تحديده؛ ويمكنك اختيار عميل غير مهيأ. راجع المسارات والتغييرات المحددة قبل الموافقة. يثبت Setup سير عمل REA للوكلاء المحددين افتراضياً. Hopper خيار منفصل يتطلب موافقة مستقلة، ويمكن أيضاً حفظ مسارات تثبيت Ghidra الموجودة.
 
-### قبل البدء
+يعرض التغييرات قبل تطبيقها وينشئ نسخة احتياطية من الإعدادات الموجودة. راجع [دليل التثبيت والإعداد](docs/installation.md) للمتطلبات والخيارات الإضافية.
 
-- macOS 12 أو أحدث
-- Ubuntu 24.04+ أو Fedora 41+ أو Arch Linux ‏64 بت
-- Node.js 22.19+ أو 24.11+ وnpm المرفق مع Node
+### الاستخدام مع وكيل
 
-يعرض `rea setup` خطة التغييرات كاملة ويطلب التأكيد قبل تطبيقها. لا يثبت أو يحدّث Homebrew أو Node.js أو npm. إذا كان [Hopper](https://www.hopperapp.com/) مفقودًا، يقترح Setup الحزمة الرسمية. Hopper برنامج منفصل يحتاج إلى ترخيص خاص به.
+بعد الإعداد، أعد تشغيل الوكيل واشرح التطبيق أو الميزة التي تريد استقصاءها. يدعم REA Claude Code وClaude Desktop وCodex وCursor وGemini CLI وWindsurf وDevin وOpenCode وAntigravity وGitHub Copilot CLI وCommand Code وVS Code. تكون تسجيلات REA الموجودة محددة افتراضياً، ويجب اختيار العملاء المكتشفين الآخرين يدوياً. يمكن للوكلاء الآخرين استخدام إعداد MCP أدناه.
 
-إذا كان Ghidra 12.1.2 PUBLIC وJDK 21 الكامل بنواة 64 بت مثبتين مسبقًا على Linux ‏64 بت، فيمكن لـ Setup أيضًا تسجيل `GHIDRA_INSTALL_DIR` و`JAVA_HOME` الاختياري بعد الموافقة. لا ينزّل REA أو يثبت أو يعدّل Ghidra أو Java. يوفّر مزوّد Ghidra ضمن جلسة headless معزولة وللقراءة فقط الجرد، وفك الترجمة، والتجميع، وعلاقات الاستدعاء، والمراجع ذات الأنواع، وxref، وCFG، وملفات تحليل الدوال؛ وتبقى حالة الواجهة الرسومية وعمليات التعديل غير متاحة.
+يمكن تشغيل Hopper في الوضع التجريبي. إذا ظهرت رسالة عند التشغيل الأول، فاختر التجربة أو أدخل ترخيصًا موجودًا.
 
-#### التثبيت على Linux واستكشاف الأخطاء
+### الاستخدام من الطرفية
 
-على Ubuntu 24.04+ وFedora 41+ وArch Linux ‏64 بت، ينزّل REA حزمة DEB أو RPM أو Arch الرسمية، ويتحقق من الحجم وقيمة التحقق المنشورين، ثم يستخدم `apt-get` أو `dnf` أو `pacman` لحل الاعتماديات. عند التشغيل دون root يعرض `pkexec` طلب تفويض النظام. لا يستدعي REA الأمر `sudo`.
-
-مسار المشغّل الافتراضي هو `/opt/hopper/bin/Hopper`. استخدم `HOPPER_LAUNCHER_PATH` للمسارات الأخرى. إذا أبلغ Doctor عن غياب محرك التحليل، شغّل `ldd /opt/hopper/bin/Hopper | grep 'not found'`، وثبّت المكتبات الناقصة ثم أعد `rea setup`. يشغّل REA إصدار Hopper التجريبي المدعوم على شاشة Xvfb خاصة ويختار وضع التجربة الذي يقدمه Hopper لكل جلسة تحليل؛ لا يلزم `DISPLAY` لسطح المكتب ولا ترخيص مدفوع، مع بقاء حدود الإصدار التجريبي التي يحددها المورّد. أضف `~/.local/bin` إلى `PATH` أيضًا.
-
-### 1. إعداد REA
-
-```bash
-curl -fsSL https://raw.githubusercontent.com/morluto/rea/main/install.sh | bash
-npx rea-agents setup
-```
-
-إذا طلب macOS أو برنامج التثبيت تأكيدًا، فأكمل الخطوة ثم شغّل الأمر نفسه مرة أخرى.
-
-### 2. إعادة تشغيل وكيل البرمجة
-
-يكتشف Setup كلاً من Claude Code وClaude Desktop وCodex وCursor وGemini CLI وWindsurf وDevin. ويهيئ تلقائيًا أول ستة عملاء عند اكتشافهم؛ أما Devin فيُبلّغ عن اكتشافه فقط ولا يُعدّله لعدم وجود حد موثق لإعداد MCP المحلي. أعد تشغيل العملاء الذين جرى إعدادهم كي يحمّلوا REA.
-
-### 3. اطلب من الوكيل
-
-يمكنك ذكر التطبيق باسمه. سيعثر وكيل البرمجة عليه ويمرر ملف البرنامج الذي يحتاجه REA.
-
-```text
-استخدم REA لإجراء هندسة عكسية لتطبيق Notes. اشرح طريقة عمل البحث واعرض الأدلة،
-ثم ابنِ ميزة مشابهة لمشروعي باستخدام SQLite.
-```
-
-إذا واجهت مشكلة، فشغّل:
+بعد الإعداد، شغّل:
 
 ```bash
 npx -y rea-agents@latest doctor
-rea uninstall
-rea uninstall --purge-data
+npx -y rea-agents@latest analyze /Applications/Notes.app
 ```
 
+### تثبيت أمر rea
+
+ثبت واجهة سطر الأوامر:
+
+```bash
+curl -fsSL https://raw.githubusercontent.com/morluto/rea/main/install.sh | bash
+```
+
+يجب تثبيت Node.js وnpm مسبقًا. عند تشغيله من طرفية، يثبت البرنامج `rea` ويبدأ الإعداد.
+
+يمكنك بدلًا من ذلك التثبيت باستخدام npm ثم تشغيل الإعداد:
+
+```bash
+npm install --global rea-agents
+rea setup
+```
+
+### المتطلبات
+
+- macOS 12 أو أحدث
+- Ubuntu 24.04+ أو Fedora 41+ أو Arch Linux بنواة 64 بت
+- Node.js 22.x (>=22.19) أو 24.x (>=24.11) أو 26+ وnpm
+
+يتطلب تحليل الملفات التنفيذية الأصلية Hopper أو Ghidra. Hopper برنامج منفصل، وللوضع التجريبي قيود يحددها المورّد، لكن الترخيص المدفوع ليس إلزاميًا.
+
+يدعم Ghidra نظامي Linux x64 وmacOS x64/arm64. ثبت Ghidra 12.1.4 وJDK 21 الكامل بنواة 64 بت بصورة منفصلة، ثم اضبط REA لاستخدامهما. يحتاج macOS أيضًا إلى أداة فك الترجمة الأصلية المطابقة لمعمارية الجهاز.
+
+يستطيع Setup التحقق من التثبيت وحفظ المسارات؛ ولا يثبت أو يحدّث Ghidra أو Java أو Node.js أو npm أو Homebrew.
+
+تحليل Ghidra على Windows غير متاح. لم تُنفذ بعد ضوابط ملكية العمليات وأذونات المجلدات الخاصة والتحقق الآمن من المسارات. حتى التثبيت الصحيح لـ Ghidra وJava لا يفعّل التحليل. راجع [Windows Ghidra P0](docs/windows-ghidra-p0.md).
+
+### تشخيص المشكلات
+
+يشخّص `npx -y rea-agents@latest doctor` الجهاز والاعتماديات وأدوات التحليل وإعدادات الوكيل من دون تغييرها. أضف `--json` للحصول على تشخيص منظم.
+
+مسار Hopper الافتراضي على Linux هو `/opt/hopper/bin/Hopper`. استخدم `HOPPER_LAUNCHER_PATH` للمسارات الأخرى. إذا كان الملف موجودًا لكن محرك التحليل لا يظهر، فشغّل `ldd /opt/hopper/bin/Hopper | grep 'not found'` للتحقق من المكتبات الناقصة. راجع [دليل Hopper](docs/installation.md#hopper).
+
+### التحديث والإزالة
+
+- يحدّث `rea update` تثبيت REA الحالي.
+- يزيل `rea uninstall` تسجيلات الوكلاء وملفات سير العمل التي يديرها REA، ويترك Hopper مثبتًا.
+- يزيل `rea uninstall --purge-data` أيضًا ذاكرة REA المؤقتة وحالته. استخدمه فقط إذا أردت حذف هذه البيانات.
+
+## حالة الدعم
+
+يوفر REA عبر CLI وMCP تحليل الملفات التنفيذية الأصلية وتطبيقات JavaScript وElectron وتجميعات .NET والمواقع. تعتمد العمليات المتاحة على الجهاز والهدف وأداة التحليل المختارة.
+
+- يدعم Hopper التحليل الأصلي والتعليقات؛ ويختلف سلوك واجهته الرسومية حسب المنصة.
+- يقدم Ghidra على Linux x64 وmacOS x64/arm64 عددًا قدره 22 عملية للقراءة فقط: الجرد والبحث وفك الترجمة والتعليمات والاستدعاءات والمراجع والأنواع. لا يقدم عمليات واجهة رسومية أو تعديل.
+- لسير عمل المتصفح وElectron وتشغيل العمليات متطلبات مستقلة للإعداد والموافقة وإدارة دورة الحياة. راجع [English README](README.md#current-status) للتفاصيل الكاملة.
+- تحليل Ghidra على Windows غير مفعّل. تابع التقدم في [#527](https://github.com/morluto/rea/issues/527).
+
 ## استقصاء كامل بطلب واحد
 
 بعد الإعداد، يمكنك أن تطلب من وكيلك:
@@ -159,22 +202,26 @@ rea uninstall --purge-data
 
 ## منصة أدوات التحقيق
 
-| عائلة الأدوات         | العدد | أمثلة                                                                                                                                                                                                                                 |
-| --------------------- | ----: | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
-| فحص الملفات التنفيذية |    36 | الدوال، والشيفرة شبه المصدرية، والتعليمات، والسلاسل، والأسماء، والمراجع، والتعليقات                                                                                                                                                   |
-| التحليل المركب        |    13 | النظرة العامة، و`inspect_native_api`، وفك الترجمة الدفعي، ومخططات الاستدعاء، والمراجع، واكتشاف الأنواع                                                                                                                                |
-| أدوات macOS الأصلية   |     5 | بيانات Mach-O والتوقيعات وملفات plist والمعماريات وفك رموز Swift دون تشغيل Hopper                                                                                                                                                     |
-| رسم القطع الأثرية     |     3 | جرد حتمي للدلائل وZIP/APK/IPA وASAR واستخراج معاملاتي محدد صراحة                                                                                                                                                                      |
-| Managed PE/CLI        |     8 | هوية PE/CLI، أعضاء البيانات الوصفية، بصمات CIL، تصريحات P/Invoke/الحدود الأصلية والتحقق منها، إسقاط رسم التطبيق، استيراد إعادة البناء من فك الترجمة، إعادة ربط الرموز، خطط ترابط وقت التشغيل ومقارنة الإصدارات                        |
-| مراقبة المتصفح        |     9 | التقاط CDP محدود الأصل وتحليل الحزم وخرائط المصدر واكتشاف WebMCP والفروق والأدلة المرئية                                                                                                                                              |
-| تحليل Electron        |     4 | مراقبة سلبية ضمن جذور canonical، ورسم ثابت ومحدود للتطبيق، ومطابقة ثابتة/وقت تشغيل قائمة على Evidence                                                                                                                                 |
-| وقت تشغيل JavaScript  |     2 | اكتشاف أهداف Node/Electron Inspector المعتمدة للاتصال فقط، ومراقبة محدودة للبرامج النصية وسياقات التنفيذ دون تقييم أو تجهيز                                                                                                           |
-| سير عمل التطبيقات     |    12 | تتبع محدود ومقارنة إصدارات فريدة ومقارنة ثابتة لأشكال قيم إرجاع الصادرات وإعادة تشغيل وحدات معزولة ومعتمدة على Linux وتوصيف وقت التشغيل المُدار وإغلاق تغطية إعادة البناء ودفاتر التزامات حتمية والتحقق الشامل من جاهزية إعادة البناء |
-| جلسة الملف التنفيذي   |    19 | فتح الأهداف وحزم الأدلة وتشغيل آلة إعادة محدودة ومقارنة العمليات والقطع والدوال وسجل المجهولات المتبقية                                                                                                                               |
+| عائلة الأدوات          | العدد | الاستخدام                                                                               |
+| --------------------- | ----: | -------------------------------------------------------------------------------------- |
+| فحص الملفات التنفيذية |    41 | الدوال والشيفرة شبه المصدرية والتعليمات والسلاسل والرموز والمراجع والتعليقات            |
+| التحليل المركب        |    14 | النظرة العامة وتحليل الدوال وفك الترجمة الدفعي ومخطط الاستدعاء وفحص Swift وObjC         |
+| أدوات macOS الأصلية    |     7 | بيانات Mach-O والتوقيعات وplist والمعماريات واستعادة أسماء Swift                       |
+| الملفات والحزم        |     5 | فحص الدلائل والحزم وInterface Builder وموارد Apple والاستخراج                            |
+| .NET PE/CLI           |     7 | هوية التجميع والبيانات الوصفية وCIL والاستدعاءات الأصلية والمقارنة واستيراد إعادة البناء |
+| مراقبة المتصفح        |     9 | الصفحات والبرامج النصية وخرائط المصدر وWebMCP والصور ومقارنة الالتقاط                   |
+| تحليل Electron        |     5 | مراقبة الصفحات وبنية التطبيق وربط النتائج الثابتة بنتائج التشغيل                       |
+| وقت تشغيل JavaScript  |     2 | الاتصال بهدف Node/Electron Inspector موجود لمراقبة البرامج وسياقات التنفيذ              |
+| سير عمل التطبيقات     |     7 | تتبع الميزات ومقارنة الإصدارات وبنية قيم الإرجاع والتحقق من إعادة الإنشاء                 |
+| جلسة الملف التنفيذي   |    21 | تبديل الأهداف وحفظ الأدلة ومقارنة العمليات والدوال وتسجيل الأسئلة غير المحسومة            |
+
+## خطة العمل
+
+يشمل العمل التالي توسيع التحقق من الأهداف الأصلية، ومقارنة إصدارات JavaScript و.NET، ومراقبة وقت التشغيل والتحقق من إعادة الإنشاء. يتيح Setup بالفعل اختيار تكامل الوكيل وتثبيت Hopper. تثبيت أدوات تحليل أخرى ما زال عملًا لاحقًا. راجع [خطة التثبيت](docs/roadmap.md) و[تقييم أدوات التحليل](docs/provider-evaluation.md).
 
 ## استخدام REA مع وكلاء برمجة آخرين
 
-يكتشف Setup كلاً من Claude Code وClaude Desktop وCodex وCursor وGemini CLI وWindsurf وDevin، ويهيئ تلقائيًا أول ستة عملاء. أما Devin فيُبلّغ عن اكتشافه فقط ولا يُعدّله. يمكن لأي وكيل برمجة يدعم خوادم MCP المحلية استخدام REA بالإعداد التالي:
+يدعم Setup Claude Code وClaude Desktop وCodex وCursor وGemini CLI وWindsurf وDevin وOpenCode وAntigravity وGitHub Copilot CLI وCommand Code وVS Code. تكون تسجيلات REA الموجودة محددة افتراضياً، ويجب اختيار العملاء المكتشفين الآخرين يدوياً. يمكن لأي وكيل يدعم خوادم MCP المحلية الاتصال باستخدام الإعداد التالي:
 
 <!-- x-release-please-start-version -->
 
@@ -183,7 +230,7 @@ rea uninstall --purge-data
   "mcpServers": {
     "rea": {
       "command": "npx",
-      "args": ["-y", "rea-agents@2.6.0", "mcp"]
+      "args": ["-y", "rea-agents@4.0.1", "mcp"]
     }
   }
 }
@@ -204,7 +251,7 @@ flowchart LR
     Ghidra --> App
 ```
 
-يستخدم CLI وخادم MCP محرك التحليل نفسه. تغلق أوامر الطرفية التطبيق عند انتهائها، بينما تبقيه جلسة الوكيل مفتوحًا أثناء الاستقصاء.
+يستخدم CLI وخادم MCP سير عمل التحليل نفسه. تحرر أوامر الطرفية جلسة الجسر الخاصة بها عند انتهائها، بينما يمكن لجلسة الوكيل الحفاظ على الاتصال أثناء الاستقصاء. إغلاق جلسة REA لا يغلق تطبيق Hopper الذي يستخدمه المستخدم.
 
 ## أوامر CLI
 
@@ -221,15 +268,9 @@ npx -y rea-agents@latest compare /absolute/path/to/left-evidence.json /absolute/
 
 ## سلوك Hopper
 
-يستطيع REA تشغيل Hopper تلقائيًا؛ لا حاجة إلى افتراض أنه يعمل مسبقًا. لكنه تطبيق macOS رسومي، لذلك قد يطلب التركيز أو يعرض حوارًا عندما يفرض Hopper قرارًا تفاعليًا. لا يمكن لـ REA ضمان تشغيل غير مرئي تمامًا لأن هذه الواجهة يملكها Hopper وmacOS.
+يشغّل REA برنامج Hopper عند الحاجة. على macOS قد تظهر نافذته في المقدمة أو يحتاج أحد الحوارات إلى استجابة منك. لا يمكن ضمان بقاء النافذة في الخلفية.
 
-لتجنب مربع اختيار معمارية ملف شامل، حدد معطيات المحمل مسبقًا:
-
-```bash
-export HOPPER_LOADER_ARGS_JSON='["-l", "Mach-O", "--aarch64"]'
-```
-
-يدير REA دورة حياة Hopper ويحاول إغلاق العمليات التي بدأها عند انتهاء الأمر أو جلسة MCP.
+يحدد REA تنسيق الهدف ومعماريته لتجنب حوارات الاختيار المعتادة. عند إغلاق الجلسة، يوقف الجسر وينظف موارده الخاصة، لكنه لا يغلق تطبيق Hopper الذي تستخدمه.
 
 ## الأمان والخصوصية
 
@@ -258,7 +299,7 @@ export HOPPER_LOADER_ARGS_JSON='["-l", "Mach-O", "--aarch64"]'
 <details>
 <summary><strong>هل يعمل REA على Linux أو Windows؟</strong></summary>
 
-نعم، يعمل REA على macOS 12+ وUbuntu 24.04+ وFedora 41+ وArch Linux ‏64 بت؛ Windows غير مدعوم حاليًا. يستخدم التحليل العميق Hopper أو مزوّد Ghidra للقراءة فقط الذي يختاره المستدعي؛ ويتطلب Ghidra على Linux الإصدار 12.1.2 وJDK 21 الكامل.
+يدعم REA نظام macOS 12+ وUbuntu 24.04+ وFedora 41+ وArch Linux بنواة 64 بت. يعمل تحليل Ghidra للقراءة فقط على Linux x64 وmacOS x64/arm64 مع Ghidra 12.1.4 وJDK 21 الكامل. تحليل Ghidra على Windows غير متاح بسبب الضوابط الأصلية غير المنفذة؛ راجع [Windows Ghidra P0](docs/windows-ghidra-p0.md).
 
 </details>
 

README_ja.md

@@ -4,7 +4,7 @@
 
 # REA：あらゆるものをリバースエンジニアリング
 
-### コーディングエージェントがあらゆるものをリバースエンジニアリングするための、ひとつの CLI / MCP サーバー
+### エージェントでアプリの動作からネイティブバイナリまで調べる。
 
 **気になる機能を見つけ、仕組みを理解し、自分の形で実装する。**
 
@@ -13,35 +13,51 @@
 [![MCP tool catalog](https://img.shields.io/badge/MCP-tool_catalog-5c4ee5?style=flat-square)](#調査ツールカタログ)
 [![Node.js 22+](https://img.shields.io/badge/Node.js-22.19%2B-339933?style=flat-square&logo=nodedotjs&logoColor=white)](https://nodejs.org/)
 [![MIT license](https://img.shields.io/badge/license-MIT-f4c430?style=flat-square)](LICENSE)
+[![Discord](https://img.shields.io/discord/1556595354999332884?logo=discord&logoColor=white&label=Discord&color=5865F2)](https://discord.gg/GkcryMnJDM)
 
-[クイックスタート](#クイックスタート) · [バイナリから動作へ](#バイナリから動作へ) · [ツールカタログ](#調査ツールカタログ) · [仕組み](#仕組み) · [FAQ](#faq)
+<a href="https://trendshift.io/repositories/82054?utm_source=trendshift-badge&amp;utm_medium=badge&amp;utm_campaign=badge-trendshift-82054" target="_blank" rel="noopener noreferrer"><img src="https://trendshift.io/api/badge/trendshift/repositories/82054/weekly?language=TypeScript" alt="morluto/rea | Trendshift" width="250" height="55" /></a>
+
+[クイックスタート](#クイックスタート) · [現在の対応状況](#現在の対応状況) · [バイナリから動作へ](#バイナリから動作へ) · [調査ツールカタログ](#調査ツールカタログ) · [ロードマップ](#ロードマップ) · [仕組み](#仕組み)
+
+<table aria-label="REA community">
+<tr>
+<td align="center" width="360">
+  <a href="https://discord.gg/GkcryMnJDM">
+    <img src="docs/assets/discord.svg" height="42" alt="Discord" /><br />
+    <strong>リバースエンジニアリングのコミュニティに参加</strong>
+  </a><br />
+  <sub>Discord · 質問と回答 · 成果の共有</sub>
+</td>
+</tr>
+</table>
 
 <br />
 
-<code>curl -fsSL https://raw.githubusercontent.com/morluto/rea/main/install.sh | bash</code>
+<code>npx rea-agents setup</code>
+
+<br />
+
+<img src="docs/assets/rea-hopper-analysis.png" alt="Hopper 内で解析ブリッジを起動し、ネイティブバイナリを調べる REA" width="1200" />
 
 </div>
 
 ---
 
-アプリの気になる機能を自分のプロダクトにも取り入れたいと思ったことはありませんか。ソースコードがなくても、そのアプリをコーディングエージェントに渡せます。REA を使えば、エージェントが機能を調査して仕組みを理解し、あなたの技術スタック、デザイン、要件に合わせた形で実装できます。
+アプリの機能を自分のプロダクトにも取り入れたいときは、REA を使ってエージェントに調査を依頼できます。ソースコードがなくても、アプリを調べ、仕組みと根拠を示し、あなたのプロジェクト向けに同様の機能を実装できます。
 
-REA はこの流れをひとつの CLI / MCP サーバーで実現します。エージェントはコンパイル済みのアプリを調べ、機能の流れを追い、分かったことを通常のコーディング作業に活用できます。複雑なリバースエンジニアリングツールは REA がひとつのインターフェースの裏側で扱います。
+REA はネイティブバイナリ、JavaScript/Electron アプリ、.NET アセンブリ、Web サイトの解析ツールを提供します。エージェントからもターミナルからも使えます。解析はローカルで実行され、結果には根拠と制限が含まれます。
+
+Setup はエージェントを設定し、既存の Hopper または Ghidra に接続します。承認後に Hopper をインストールすることもできます。
 
 ## エージェントに頼むだけ
 
-```bash
-npx rea-agents setup
-```
-
-次のように依頼します：
+[セットアップ](#クイックスタート)後にエージェントを再起動し、次のように依頼します：
 
 ```text
-メモアプリをリバースエンジニアリングしてください。
-検索の仕組みと判断の理由を示し、私のプロジェクト向けに同様の機能を実装してください。
+メモアプリの検索機能を調べて根拠を示し、私のプロジェクト向けに同様の機能を実装してください。
 ```
 
-メモアプリは例にすぎません。調べたいアプリを指定するか、まず概要から始めるよう依頼できます。
+メモアプリを調べたいアプリに置き換えるか、まず概要を依頼してください。
 
 ## バイナリから動作へ
 
@@ -53,70 +69,96 @@ REA は調査をバイナリ上の根拠に結び付けます。元のソース
 
 ## REA を選ぶ理由
 
-|                        |                                                                                       |
-| ---------------------- | ------------------------------------------------------------------------------------- |
-| **エージェント向け**   | コンパイル済みアプリについて質問し、推測ではなく根拠を集めさせることができます。      |
-| **CLI と MCP**         | ターミナルとコーディングエージェントから同じリバースエンジニアリング機能を使えます。  |
-| **複雑さを処理**       | ツール設定、アプリの読み込み、調査の維持、終了後のクリーンアップを REA が担います。   |
-| **一連の調査に対応**   | 最初の概要から疑似コード、呼び出し関係、型、実装の手掛かりまで掘り下げられます。      |
-| **ローカルで解析**     | 解析は Mac 上で実行され、REA がバイナリをホスト型解析サービスへ送ることはありません。 |
-| **コンテキストを維持** | 質問ごとに解析を最初からやり直さず、複数のバイナリを続けて調査できます。              |
+|                        |                                                                                                      |
+| ---------------------- | ---------------------------------------------------------------------------------------------------- |
+| **エージェント向け**   | コンパイル済みアプリについて質問し、推測ではなく根拠を集めさせることができます。                     |
+| **CLI と MCP**         | ターミナルとコーディングエージェントから同じリバースエンジニアリング機能を使えます。                 |
+| **複雑さを処理**       | ツール設定、アプリの読み込み、調査の維持、終了後のクリーンアップを REA が担います。                  |
+| **一連の調査に対応**   | 最初の概要から疑似コード、呼び出し関係、型、実装の手掛かりまで掘り下げられます。                     |
+| **ローカルで解析**     | 解析は対応するローカルホストで実行され、REA がバイナリをホスト型解析サービスへ送ることはありません。 |
+| **コンテキストを維持** | 質問ごとに解析を最初からやり直さず、複数のバイナリを続けて調査できます。                             |
 
 ## クイックスタート
 
-### コーディングエージェントから（推奨）
+### セットアップを実行（推奨）
+
+REA をエージェントで使うための設定を行います：
 
 ```bash
 npx rea-agents setup
 ```
 
-エージェントに REA のセットアップを依頼してください。Mac を確認し、必要なインストールを説明して承認を求め、システムプロンプトを案内します。完全なツールを読み込むため再起動を求められた場合は、セットアップ後に再起動してください。
+Setup は最初に連携するエージェントを複数選択できるようにします。既存の REA 登録は初期選択されますが、検出されただけのクライアントは自動選択されず、未設定のクライアントも選べます。具体的なパスと変更内容を確認してから承認してください。選択したエージェントには通常 REA のワークフローをインストールします。Hopper は別の任意操作で、個別の承認が必要です。既存の Ghidra のパスも登録できます。
 
-### 始める前に
+変更は事前に表示され、既存の設定はバックアップされます。要件と追加オプションは[インストールガイド](docs/installation.md)を参照してください。
 
-- macOS 12 以降
-- Ubuntu 24.04+、Fedora 41+、または 64 ビット Arch Linux
-- Node.js 22.19+ または 24.11+ と、Node に付属する npm
+### エージェントで使う
 
-`rea setup` は変更計画を表示し、確認後に適用します。Homebrew、Node.js、npm をインストールまたは更新しません。[Hopper](https://www.hopperapp.com/) がない場合は公式パッケージを提案します。Hopper は別製品で、ライセンスは別途必要です。
+設定後にエージェントを再起動し、調べたいアプリや機能を説明します。REA は Claude Code、Claude Desktop、Codex、Cursor、Gemini CLI、Windsurf、Devin、OpenCode、Antigravity、GitHub Copilot CLI、Command Code、VS Code に対応します。既存の REA 登録は初期選択され、それ以外の検出済みクライアントは選択が必要です。その他のエージェントは下記の MCP 設定を使えます。
 
-64 ビット Linux に Ghidra 12.1.2 PUBLIC と完全な 64 ビット JDK 21 がすでにある場合、Setup は承認後に `GHIDRA_INSTALL_DIR` と任意の `JAVA_HOME` も登録できます。REA は Ghidra や Java をダウンロード、インストール、変更しません。Ghidra プロバイダーは隔離された読み取り専用 headless セッションで、インベントリ、逆コンパイル、アセンブリ、呼び出し関係、型付き参照、xref、CFG、関数 dossier を提供します。GUI 状態と変更操作は引き続き利用できません。
+Hopper はデモモードで使えます。初回起動の画面ではデモを選択するか、既存のライセンスを入力してください。
 
-#### Linux のインストールとトラブルシューティング
+### ターミナルで使う
 
-Ubuntu 24.04+、Fedora 41+、64 ビット Arch Linux では、REA が公式の DEB、RPM、または Arch パッケージを取得し、公開されたサイズとチェックサムを検証してから `apt-get`、`dnf`、または `pacman` で依存関係を解決します。root 以外では `pkexec` がシステム承認を表示します。REA は `sudo` を呼び出しません。
-
-既定のランチャーは `/opt/hopper/bin/Hopper` です。別の場所では `HOPPER_LAUNCHER_PATH` を設定してください。Doctor が解析エンジン不足を報告した場合は `ldd /opt/hopper/bin/Hopper | grep 'not found'` を実行し、不足ライブラリを入れて `rea setup` を再実行します。REA は対応する Hopper デモ版を専用 Xvfb ディスプレイで起動し、解析セッションごとに Hopper が提示するデモモードを選択します。デスクトップの `DISPLAY` や有料ライセンスは不要ですが、デモ版にはベンダー所定の制限があります。`~/.local/bin` も `PATH` に追加してください。
-
-```bash
-# 1. REA をセットアップ
-curl -fsSL https://raw.githubusercontent.com/morluto/rea/main/install.sh | bash
-npx rea-agents setup
-```
-
-macOS やインストーラーから確認を求められた場合は、その操作を完了してから同じコマンドをもう一度実行してください。
-
-### 2. コーディングエージェントを再起動
-
-Setup は Claude Code、Claude Desktop、Codex、Cursor、Gemini CLI、Windsurf、Devin を検出します。検出した最初の 6 クライアントは自動設定しますが、Devin はローカル MCP 設定境界が文書化されていないため、検出結果を報告するだけで変更しません。設定されたクライアントを再起動して REA を読み込んでください。
-
-### 3. エージェントに依頼
-
-アプリは名前で指定できます。コーディングエージェントがアプリを探し、REA に必要なプログラムファイルを渡します。
-
-```text
-REA でメモアプリをリバースエンジニアリングしてください。検索機能の仕組みと
-根拠を示し、SQLite を使って私のプロジェクト向けに同様の機能を実装してください。
-```
-
-問題がある場合は次を実行します：
+設定後に実行します：
 
 ```bash
 npx -y rea-agents@latest doctor
-rea uninstall
-rea uninstall --purge-data
+npx -y rea-agents@latest analyze /Applications/Notes.app
 ```
 
+### rea コマンドをインストール
+
+コマンドラインツールをインストールします：
+
+```bash
+curl -fsSL https://raw.githubusercontent.com/morluto/rea/main/install.sh | bash
+```
+
+Node.js と npm を先にインストールしてください。ターミナルで実行すると、インストーラーは `rea` を追加してセットアップを開始します。
+
+npm でインストールし、セットアップを実行することもできます：
+
+```bash
+npm install --global rea-agents
+rea setup
+```
+
+### 要件
+
+- macOS 12 以降
+- Ubuntu 24.04+、Fedora 41+、または 64 ビット Arch Linux
+- Node.js 22.x (>=22.19)、24.x (>=24.11)、または 26+ と npm
+
+ネイティブバイナリ解析には Hopper または Ghidra が必要です。Hopper は別製品です。デモにはベンダー所定の制限がありますが、有料ライセンスは必須ではありません。
+
+Ghidra は Linux x64 と macOS x64/arm64 に対応します。Ghidra 12.1.4 と完全な 64 ビット JDK 21 を別途インストールし、REA で使うように設定してください。macOS ではホストのアーキテクチャに合うネイティブデコンパイラーも必要です。
+
+Setup はインストールを確認し、パスを保存できます。Ghidra、Java、Node.js、npm、Homebrew のインストールや更新は行いません。
+
+Windows の Ghidra 解析は利用できません。プロセスの所有権、プライベートディレクトリの権限、安全なパス検証が未実装のため、Ghidra と Java を正しくインストールしても有効になりません。[Windows Ghidra P0](docs/windows-ghidra-p0.md)を参照してください。
+
+### トラブルシューティング
+
+`npx -y rea-agents@latest doctor` はホスト、依存関係、解析ツール、エージェント設定を変更せずに確認します。構造化された診断には `--json` を追加してください。
+
+Linux の既定ランチャーは `/opt/hopper/bin/Hopper` です。別の場所には `HOPPER_LAUNCHER_PATH` を設定します。ファイルがあるのに解析エンジンが見つからない場合は、`ldd /opt/hopper/bin/Hopper | grep 'not found'` で不足ライブラリを確認してください。詳しくは [Hopper ガイド](docs/installation.md#hopper)を参照してください。
+
+### 更新とアンインストール
+
+- `rea update` は現在の REA インストールを更新します。
+- `rea uninstall` は REA が管理するエージェント登録とワークフローファイルを削除します。Hopper は残ります。
+- `rea uninstall --purge-data` は REA のキャッシュと状態も削除します。それらを削除したい場合にだけ使ってください。
+
+## 現在の対応状況
+
+REA は CLI と MCP からネイティブバイナリ、JavaScript/Electron アプリ、.NET アセンブリ、Web サイトを解析できます。使える操作はホスト、対象、選択した解析ツールによって異なります。
+
+- Hopper はネイティブ解析と注釈操作に対応します。GUI の動作はプラットフォームによって異なります。
+- Ghidra は Linux x64 と macOS x64/arm64 で、一覧、検索、逆コンパイル、アセンブリ、呼び出し、参照、命令、型の検査など 22 の読み取り専用操作を提供します。GUI 操作や変更操作はありません。
+- ブラウザー、Electron、プロセスの実行時ワークフローには、それぞれ設定、承認、終了処理の要件があります。詳細は [English README](README.md#current-status) を参照してください。
+- Windows の Ghidra 解析は未対応です。進捗は [#527](https://github.com/morluto/rea/issues/527) で確認できます。
+
 ## ひとつのプロンプトで調査を完結
 
 ```text
@@ -149,22 +191,26 @@ REA は手順 1〜5 のバイナリ解析を処理し、手順 6 はエージェ
 
 ## 調査ツールカタログ
 
-| ツール群               |  数 | 例                                                                                                                                                                                                                                          |
-| ---------------------- | --: | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
-| バイナリ調査           |  36 | プロシージャ、疑似コード、アセンブリ、文字列、名前、セグメント、callers、callees、xrefs、注釈                                                                                                                                               |
-| 合成解析               |  13 | `binary_overview`, `analyze_function`, `inspect_native_api`, `batch_decompile`, `get_call_graph`, `find_xrefs_to_name`, Swift / ObjC 検出                                                                                                   |
-| macOS ネイティブ       |   5 | Mach-O メタデータ、署名、plist、アーキテクチャ、Swift デマングル。Hopper 起動不要                                                                                                                                                           |
-| アーティファクトグラフ |   3 | ディレクトリ、ZIP/APK/IPA、ASAR の決定的一覧と明示選択されたトランザクション抽出                                                                                                                                                            |
-| Managed PE/CLI         |   8 | PE/CLI 識別、メタデータメンバー、CIL ハッシュ、P/Invoke/ネイティブ境界宣言と検証、アプリケーショングラフ投影、逆コンパイル再構成インポート、構造的 token 再マッピング、ランタイム相関計画、バージョン比較                                   |
-| ブラウザ観察           |   9 | origin 限定 CDP 取得、bundle/source map 解析、WebMCP 検出、セッション、capture diff、視覚証拠                                                                                                                                               |
-| Electron 解析          |   4 | canonical ファイルルート内の受動観察、有界な静的アプリマッピング、Evidence に基づく静的/実行時の照合                                                                                                                                        |
-| JavaScript ランタイム  |   2 | 承認済みのアタッチ専用 Node/Electron Inspector ターゲット検出と、評価や計装を行わない有界なスクリプト／実行コンテキスト観察                                                                                                                 |
-| アプリケーション       |  12 | 有界なクロスレイヤー追跡、一意限定のバージョン比較、静的なエクスポート戻り値形状比較、承認済み Linux 隔離 extracted-module replay、マネージドランタイム特性評価、再構築カバレッジ閉包、決定論的な義務台帳、エンドツーエンドの準備適合性検証 |
-| バイナリセッション     |  19 | `open_binary`、`binary_session`、証拠バンドル、有限リプレイ状態機械、プロセス／成果物／関数比較、残余未知レジストリ                                                                                                                         |
+| ツール分類           |  数 | 用途                                                                        |
+| -------------------- | --: | --------------------------------------------------------------------------- |
+| バイナリ検査         |  41 | 関数、疑似コード、アセンブリ、文字列、シンボル、参照、注釈                  |
+| 組み合わせた解析     |  14 | 概要、関数解析、一括逆コンパイル、呼び出しグラフ、Swift と ObjC             |
+| macOS ネイティブ     |   7 | Mach-O メタデータ、署名、plist、アーキテクチャ、Swift 名の復元              |
+| ファイルとパッケージ |   5 | ディレクトリとパッケージ、Interface Builder、Apple リソース、抽出           |
+| .NET PE/CLI          |   7 | アセンブリ識別、メタデータ、CIL、ネイティブ呼び出し、比較、再構築の取り込み |
+| ブラウザー観察       |   9 | ページ、スクリプト、ソースマップ、WebMCP、スクリーンショット、比較          |
+| Electron 解析        |   5 | ページ観察、アプリ構造、静的・実行時結果の対応付け                          |
+| JavaScript 実行時    |   2 | 既存の Node/Electron Inspector に接続し、スクリプトと実行コンテキストを観察 |
+| アプリのワークフロー |   7 | 機能追跡、バージョン比較、戻り値構造の比較、再実装の検証                    |
+| バイナリセッション   |  21 | 対象切り替え、根拠の保存、プロセス・関数比較、未解決事項の記録              |
+
+## ロードマップ
+
+次の作業はネイティブ対象の検証拡大、JavaScript と .NET のバージョン比較、実行時の観察と再実装の検証です。Setup はエージェント連携と Hopper のインストールを選択できます。他の解析ツールのインストールは今後の作業です。[インストールのロードマップ](docs/roadmap.md)と[解析ツールの評価](docs/provider-evaluation.md)を参照してください。
 
 ## 他のコーディングエージェントで使う
 
-Setup は Claude Code、Claude Desktop、Codex、Cursor、Gemini CLI、Windsurf、Devin を検出し、最初の 6 クライアントを自動設定します。Devin は検出結果を報告するだけで変更しません。ローカル MCP サーバーに対応するコーディングエージェントなら、次の設定で REA を利用できます。
+Setup は Claude Code、Claude Desktop、Codex、Cursor、Gemini CLI、Windsurf、Devin、OpenCode、Antigravity、GitHub Copilot CLI、Command Code、VS Code に対応します。既存の REA 登録は初期選択され、それ以外の検出済みクライアントは選択が必要です。ローカル MCP サーバーに対応するエージェントは、次の設定でも接続できます。
 
 <!-- x-release-please-start-version -->
 
@@ -173,7 +219,7 @@ Setup は Claude Code、Claude Desktop、Codex、Cursor、Gemini CLI、Windsurf
   "mcpServers": {
     "rea": {
       "command": "npx",
-      "args": ["-y", "rea-agents@2.6.0", "mcp"]
+      "args": ["-y", "rea-agents@4.0.1", "mcp"]
     }
   }
 }
@@ -193,7 +239,7 @@ flowchart LR
     Ghidra --> App
 ```
 
-CLI と MCP サーバーは同じ解析エンジンを使います。ターミナルのコマンドは終了時にアプリを閉じ、エージェントのセッションは調査中アプリを開いたままにします。
+CLI と MCP サーバーは同じ解析処理を使います。ターミナルコマンドは完了後に自分のブリッジセッションを解放し、エージェントセッションは調査中の接続を維持できます。REA セッションを閉じても、ユーザーが利用中の Hopper は終了しません。
 
 ## CLI
 
@@ -229,7 +275,7 @@ REA は必要なときに Hopper を起動します。Hopper のランチャー
 
 <details><summary><strong>Hopper を先に起動する必要がありますか？</strong></summary>
 
-いいえ。REA が必要時に起動します。すでに起動している Hopper にも対応します。
+いいえ。REA が必要時に起動します。Hopper が起動済みでも使えますが、既存の GUI ドキュメントには接続せず、新しい解析ドキュメントを開きます。
 
 </details>
 

README_ko.md

@@ -4,7 +4,7 @@
 
 # REA: 무엇이든 리버스 엔지니어링
 
-### 코딩 에이전트가 무엇이든 리버스 엔지니어링할 수 있게 하는 하나의 CLI 및 MCP 서버
+### 에이전트로 앱의 동작부터 네이티브 바이너리까지 조사하세요.
 
 **마음에 드는 기능을 찾고, 작동 방식을 이해하고, 원하는 방식으로 구현하세요.**
 
@@ -13,35 +13,52 @@
 [![MCP tool catalog](https://img.shields.io/badge/MCP-tool_catalog-5c4ee5?style=flat-square)](#조사-도구-카탈로그)
 [![Node.js 22+](https://img.shields.io/badge/Node.js-22.19%2B-339933?style=flat-square&logo=nodedotjs&logoColor=white)](https://nodejs.org/)
 [![MIT license](https://img.shields.io/badge/license-MIT-f4c430?style=flat-square)](LICENSE)
+[![Discord](https://img.shields.io/discord/1556595354999332884?logo=discord&logoColor=white&label=Discord&color=5865F2)](https://discord.gg/GkcryMnJDM)
 
-[빠른 시작](#빠른-시작) · [바이너리에서 동작까지](#바이너리에서-동작까지) · [도구 카탈로그](#조사-도구-카탈로그) · [작동 방식](#작동-방식) · [FAQ](#faq)
+<a href="https://trendshift.io/repositories/82054?utm_source=trendshift-badge&amp;utm_medium=badge&amp;utm_campaign=badge-trendshift-82054" target="_blank" rel="noopener noreferrer"><img src="https://trendshift.io/api/badge/trendshift/repositories/82054/weekly?language=TypeScript" alt="morluto/rea | Trendshift" width="250" height="55" /></a>
+
+[빠른 시작](#빠른-시작) · [현재 지원 범위](#현재-지원-범위) · [바이너리에서 동작까지](#바이너리에서-동작까지) · [조사 도구 카탈로그](#조사-도구-카탈로그) · [로드맵](#로드맵) · [작동 방식](#작동-방식)
+
+<table aria-label="REA community">
+<tr>
+<td align="center" width="360">
+  <a href="https://discord.gg/GkcryMnJDM">
+    <img src="docs/assets/discord.svg" height="42" alt="Discord" /><br />
+    <strong>리버스 엔지니어링 커뮤니티에 참여하세요</strong>
+  </a><br />
+  <sub>Discord · 질문과 답변 · 작업 공유</sub>
+</td>
+</tr>
+</table>
 
 <br />
 
-<code>curl -fsSL https://raw.githubusercontent.com/morluto/rea/main/install.sh | bash</code>
+<code>npx rea-agents setup</code>
+
+<br />
+
+<img src="docs/assets/rea-hopper-analysis.png" alt="Hopper에서 분석 브리지를 시작하고 네이티브 바이너리를 조사하는 REA" width="1200" />
 
 </div>
 
 ---
 
-어떤 앱에서 마음에 드는 기능을 자신의 제품에도 넣고 싶나요? 소스 코드가 없어도 앱을 코딩 에이전트에 전달할 수 있습니다. REA를 사용하면 에이전트가 기능을 조사하고 작동 방식을 이해한 뒤, 사용자의 기술 스택, 디자인, 요구 사항에 맞는 버전을 구현할 수 있습니다.
+앱에서 마음에 드는 기능을 찾았다면 에이전트에게 REA로 조사해 달라고 요청하세요. 소스 코드가 없어도 앱을 분석하고, 기능의 동작과 근거를 설명한 뒤, 프로젝트에 맞는 기능을 구현할 수 있습니다.
 
-REA는 이 과정을 하나의 CLI 및 MCP 서버로 제공합니다. 에이전트는 컴파일된 앱을 조사하고 기능의 작동 방식을 추적한 뒤 알아낸 내용을 일반 코딩 작업에 활용할 수 있습니다. 복잡한 리버스 엔지니어링 도구는 REA가 하나의 인터페이스 뒤에서 처리합니다.
+REA는 네이티브 바이너리, JavaScript/Electron 앱, .NET 어셈블리, 웹사이트 분석 도구를 제공합니다. 에이전트와 터미널에서 같은 도구를 사용할 수 있습니다. 분석은 로컬에서 실행되며 결과에는 근거와 제한 사항이 포함됩니다.
+
+Setup은 에이전트를 설정하고 기존 Hopper 또는 Ghidra 설치에 연결합니다. 승인 후 Hopper를 설치할 수도 있습니다.
 
 ## 에이전트에게 바로 요청하기
 
-```bash
-npx rea-agents setup
-```
-
-그런 다음 요청하세요.
+[설정](#빠른-시작)을 마친 뒤 에이전트를 다시 시작하고 요청하세요.
 
 ```text
-REA를 설정하고 메모 앱을 리버스 엔지니어링해 주세요. 검색 기능의 작동 방식과
-그렇게 판단한 이유를 보여 주고, 제 프로젝트에 비슷한 기능을 구현해 주세요.
+메모 앱의 검색 기능이 어떻게 동작하는지 조사하고 근거를 보여 주세요.
+그다음 제 프로젝트에 비슷한 기능을 구현해 주세요.
 ```
 
-메모 앱은 예시일 뿐입니다. 이해하고 싶은 앱을 지정하거나 먼저 개요부터 살펴보라고 요청할 수 있습니다.
+메모 앱 대신 조사할 앱을 지정하거나 먼저 개요를 요청할 수 있습니다.
 
 ## 바이너리에서 동작까지
 
@@ -53,70 +70,96 @@ REA는 분석을 바이너리 증거에 근거하게 합니다. 원본 소스
 
 ## REA를 사용하는 이유
 
-|                    |                                                                                    |
-| ------------------ | ---------------------------------------------------------------------------------- |
-| **에이전트용**     | 컴파일된 앱에 관해 질문하고 추측 대신 증거를 수집하게 합니다.                      |
-| **CLI와 MCP**      | 터미널과 코딩 에이전트에서 동일한 리버스 엔지니어링 기능을 사용합니다.             |
-| **복잡성 처리**    | 도구 설정, 앱 열기, 조사 유지, 작업 후 정리를 REA가 처리합니다.                    |
-| **전체 조사 과정** | 첫 개요에서 의사 코드, 호출 관계, 타입, 구현 단서까지 이어서 조사합니다.           |
-| **로컬 분석**      | 분석은 Mac에서 실행되며 REA는 바이너리를 호스팅 분석 서비스에 업로드하지 않습니다. |
-| **컨텍스트 유지**  | 질문마다 분석을 처음부터 시작하지 않고 여러 바이너리를 연속으로 조사합니다.        |
+|                    |                                                                                                     |
+| ------------------ | --------------------------------------------------------------------------------------------------- |
+| **에이전트용**     | 컴파일된 앱에 관해 질문하고 추측 대신 증거를 수집하게 합니다.                                       |
+| **CLI와 MCP**      | 터미널과 코딩 에이전트에서 동일한 리버스 엔지니어링 기능을 사용합니다.                              |
+| **복잡성 처리**    | 도구 설정, 앱 열기, 조사 유지, 작업 후 정리를 REA가 처리합니다.                                     |
+| **전체 조사 과정** | 첫 개요에서 의사 코드, 호출 관계, 타입, 구현 단서까지 이어서 조사합니다.                            |
+| **로컬 분석**      | 분석은 지원되는 로컬 호스트에서 실행되며 REA는 바이너리를 호스팅 분석 서비스에 업로드하지 않습니다. |
+| **컨텍스트 유지**  | 질문마다 분석을 처음부터 시작하지 않고 여러 바이너리를 연속으로 조사합니다.                         |
 
 ## 빠른 시작
 
-### 코딩 에이전트에서 시작하기(권장)
+### 설정 실행하기(권장)
+
+REA를 에이전트에 연결하세요.
 
 ```bash
 npx rea-agents setup
 ```
 
-에이전트에게 REA 설정을 요청하세요. Mac을 확인하고 필요한 설치 내용을 설명한 뒤 승인을 요청하며 시스템 프롬프트를 안내합니다. 전체 도구를 불러오기 위해 재시작하라고 하면 설정 후 에이전트를 재시작하세요.
+Setup은 먼저 연결할 에이전트를 여러 개 선택하도록 안내합니다. 기존 REA 등록은 기본 선택되며, 감지만 된 클라이언트는 자동 선택되지 않습니다. 아직 설정되지 않은 클라이언트도 직접 선택할 수 있습니다. 정확한 경로와 변경 사항을 검토한 뒤 승인하세요. 선택한 에이전트에는 기본적으로 REA 워크플로가 설치됩니다. Hopper는 별도의 선택 사항이며 따로 승인해야 합니다. 기존 Ghidra 경로도 등록할 수 있습니다.
 
-### 시작하기 전에
+변경 전에 계획을 표시하고 기존 설정을 백업합니다. 요구 사항과 추가 옵션은 [설치 안내](docs/installation.md)를 참고하세요.
 
-- macOS 12 이상
-- Ubuntu 24.04+, Fedora 41+ 또는 64비트 Arch Linux
-- Node.js 22.19+ 또는 24.11+ 및 Node와 함께 제공되는 npm
+### 에이전트에서 사용하기
 
-`rea setup`은 전체 변경 계획을 표시하고 확인 후 적용합니다. Homebrew, Node.js 또는 npm을 설치하거나 업데이트하지 않습니다. [Hopper](https://www.hopperapp.com/)가 없으면 공식 패키지 설치를 제안합니다. Hopper는 별도 라이선스가 필요한 독립 소프트웨어입니다.
+설정 후 에이전트를 다시 시작하고 조사할 앱이나 기능을 설명하세요. REA는 Claude Code, Claude Desktop, Codex, Cursor, Gemini CLI, Windsurf, Devin, OpenCode, Antigravity, GitHub Copilot CLI, Command Code, VS Code를 지원합니다. 기존 REA 등록은 기본 선택되고, 그 밖의 감지된 클라이언트는 직접 선택해야 합니다. 다른 에이전트는 아래 MCP 설정을 사용할 수 있습니다.
 
-64비트 Linux에 Ghidra 12.1.2 PUBLIC과 완전한 64비트 JDK 21이 이미 설치되어 있다면 Setup은 승인 후 `GHIDRA_INSTALL_DIR`과 선택 사항인 `JAVA_HOME`도 등록할 수 있습니다. REA는 Ghidra나 Java를 다운로드, 설치 또는 수정하지 않습니다. Ghidra 공급자는 격리된 읽기 전용 headless 세션에서 인벤토리, 디컴파일, 어셈블리, 호출 관계, 형식이 지정된 참조, xref, CFG 및 함수 dossier를 제공합니다. GUI 상태와 변경 작업은 계속 사용할 수 없습니다.
+Hopper는 데모 모드로 사용할 수 있습니다. 첫 실행 안내가 나오면 데모를 선택하거나 기존 라이선스를 입력하세요.
 
-#### Linux 설치 및 문제 해결
+### 터미널에서 실행하기
 
-Ubuntu 24.04+, Fedora 41+, 64비트 Arch Linux에서 REA는 공식 DEB, RPM 또는 Arch 패키지를 내려받아 게시된 크기와 체크섬을 검증한 뒤 `apt-get`, `dnf` 또는 `pacman`으로 의존성을 설치합니다. root가 아니면 `pkexec`가 시스템 승인 창을 표시합니다. REA는 `sudo`를 호출하지 않습니다.
-
-기본 실행 파일은 `/opt/hopper/bin/Hopper`입니다. 다른 위치에 설치했다면 `HOPPER_LAUNCHER_PATH`를 설정하세요. Doctor가 분석 엔진 누락을 보고하면 `ldd /opt/hopper/bin/Hopper | grep 'not found'`를 실행하고 누락된 라이브러리를 설치한 다음 `rea setup`을 다시 실행하세요. REA는 지원되는 Hopper 데모 빌드를 전용 Xvfb 디스플레이에서 실행하고 분석 세션마다 Hopper가 제공하는 데모 모드를 선택합니다. 데스크톱 `DISPLAY`나 유료 라이선스는 필요하지 않지만 데모에는 공급업체가 정한 제한이 있습니다. `~/.local/bin`도 `PATH`에 추가해야 합니다.
-
-```bash
-# 1. REA 설정
-curl -fsSL https://raw.githubusercontent.com/morluto/rea/main/install.sh | bash
-npx rea-agents setup
-```
-
-macOS나 설치 프로그램이 확인을 요청하면 해당 절차를 완료하고 같은 명령을 다시 실행하세요.
-
-### 2. 코딩 에이전트 재시작
-
-Setup은 Claude Code, Claude Desktop, Codex, Cursor, Gemini CLI, Windsurf, Devin을 감지합니다. 감지된 앞의 여섯 클라이언트는 자동으로 구성하지만, Devin은 문서화된 로컬 MCP 구성 경계가 없어 감지만 보고하고 변경하지 않습니다. 구성된 클라이언트를 다시 시작해 REA를 불러오세요.
-
-### 3. 에이전트에게 요청
-
-앱 이름만 말해도 됩니다. 코딩 에이전트가 앱을 찾아 REA에 필요한 프로그램 파일을 전달합니다.
-
-```text
-REA로 메모 앱을 리버스 엔지니어링해 주세요. 검색 기능의 작동 방식과 증거를 보여 주고,
-SQLite를 사용해 제 프로젝트에 비슷한 기능을 구현해 주세요.
-```
-
-문제가 있으면 다음을 실행하세요.
+설정 후 실행하세요.
 
 ```bash
 npx -y rea-agents@latest doctor
-rea uninstall
-rea uninstall --purge-data
+npx -y rea-agents@latest analyze /Applications/Notes.app
 ```
 
+### rea 명령 설치하기
+
+명령줄 도구를 설치하세요.
+
+```bash
+curl -fsSL https://raw.githubusercontent.com/morluto/rea/main/install.sh | bash
+```
+
+Node.js와 npm이 먼저 설치되어 있어야 합니다. 터미널에서 실행하면 설치 프로그램이 `rea`를 설치하고 설정을 시작합니다.
+
+npm으로 설치한 뒤 설정을 실행할 수도 있습니다.
+
+```bash
+npm install --global rea-agents
+rea setup
+```
+
+### 요구 사항
+
+- macOS 12 이상
+- Ubuntu 24.04+, Fedora 41+ 또는 64비트 Arch Linux
+- Node.js 22.x (>=22.19), 24.x (>=24.11) 또는 26+와 npm
+
+네이티브 바이너리 분석에는 Hopper 또는 Ghidra가 필요합니다. Hopper는 별도 소프트웨어입니다. 데모에는 공급업체의 제한이 있지만 유료 라이선스가 필수는 아닙니다.
+
+Ghidra는 Linux x64와 macOS x64/arm64를 지원합니다. Ghidra 12.1.4와 완전한 64비트 JDK 21을 별도로 설치한 뒤 REA가 사용하도록 설정하세요. macOS에서는 호스트 아키텍처에 맞는 네이티브 디컴파일러도 필요합니다.
+
+Setup은 설치를 확인하고 경로를 저장할 수 있습니다. Ghidra, Java, Node.js, npm, Homebrew를 설치하거나 업데이트하지 않습니다.
+
+Windows Ghidra 분석은 사용할 수 없습니다. 프로세스 소유권, 비공개 디렉터리 권한, 안전한 경로 검사가 구현되지 않았으므로 Ghidra와 Java를 올바르게 설치해도 분석을 활성화할 수 없습니다. [Windows Ghidra P0](docs/windows-ghidra-p0.md)를 참고하세요.
+
+### 문제 해결
+
+`npx -y rea-agents@latest doctor`는 호스트, 의존성, 분석 도구, 에이전트 설정을 변경 없이 확인합니다. 구조화된 진단에는 `--json`을 추가하세요.
+
+Linux의 기본 Hopper 실행 파일은 `/opt/hopper/bin/Hopper`입니다. 다른 위치에는 `HOPPER_LAUNCHER_PATH`를 설정하세요. 파일이 있는데도 분석 엔진이 없다고 하면 `ldd /opt/hopper/bin/Hopper | grep 'not found'`로 누락된 라이브러리를 확인하세요. 자세한 내용은 [Hopper 안내](docs/installation.md#hopper)를 참고하세요.
+
+### 업데이트와 제거
+
+- `rea update`는 현재 REA 설치를 업데이트합니다.
+- `rea uninstall`은 REA가 관리하는 에이전트 등록과 워크플로 파일을 제거합니다. Hopper는 유지합니다.
+- `rea uninstall --purge-data`는 REA 캐시와 상태도 삭제합니다. 해당 데이터를 지우려는 경우에만 사용하세요.
+
+## 현재 지원 범위
+
+REA는 CLI와 MCP로 네이티브 바이너리, JavaScript/Electron 앱, .NET 어셈블리, 웹사이트를 분석합니다. 사용할 수 있는 작업은 호스트, 대상, 선택한 분석 도구에 따라 다릅니다.
+
+- Hopper는 네이티브 분석과 주석 작업을 지원합니다. GUI 동작은 플랫폼에 따라 다릅니다.
+- Ghidra는 Linux x64와 macOS x64/arm64에서 목록, 검색, 디컴파일, 어셈블리, 호출, 참조, 명령어, 타입 검사 등 읽기 전용 작업 22개를 제공합니다. GUI나 변경 작업은 제공하지 않습니다.
+- 브라우저, Electron, 프로세스 런타임 워크플로에는 각각 설정, 승인, 종료 처리 요구 사항이 있습니다. 자세한 내용은 [English README](README.md#current-status)를 참고하세요.
+- Windows Ghidra 분석은 아직 사용할 수 없습니다. 진행 상황은 [#527](https://github.com/morluto/rea/issues/527)에서 확인하세요.
+
 ## 하나의 프롬프트로 전체 조사
 
 ```text
@@ -149,22 +192,26 @@ REA는 1–5단계의 바이너리 분석을 처리합니다. 6단계는 에이
 
 ## 조사 도구 카탈로그
 
-| 도구 그룹           |  수 | 예시                                                                                                                                                                                                           |
-| ------------------- | --: | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
-| 바이너리 검사       |  36 | 프로시저, 의사 코드, 어셈블리, 문자열, 이름, 세그먼트, callers, callees, xrefs, 주석                                                                                                                           |
-| 합성 분석           |  13 | `binary_overview`, `analyze_function`, `inspect_native_api`, `batch_decompile`, `get_call_graph`, `find_xrefs_to_name`, Swift 및 ObjC 탐색                                                                     |
-| macOS 네이티브 도구 |   5 | Mach-O 메타데이터, 코드 서명, plist, 아키텍처, Swift 디맹글링. Hopper 실행 불필요                                                                                                                              |
-| 아티팩트 그래프     |   3 | 디렉터리, ZIP/APK/IPA, ASAR 결정적 인벤토리와 명시적으로 선택한 트랜잭션 추출                                                                                                                                  |
-| Managed PE/CLI      |   8 | PE/CLI ID, 메타데이터 멤버, CIL 해시, P/Invoke/네이티브 경계 선언 및 검증, 애플리케이션 그래프 투영, 디컴파일 재구성 가져오기, 구조적 token 재매핑, 런타임 상관 계획, 버전 비교                                |
-| 브라우저 관찰       |   9 | origin 제한 CDP 캡처, bundle/source map 분석, WebMCP 검색, 세션 타임라인, capture diff 및 시각 증거                                                                                                            |
-| Electron 분석       |   4 | canonical 파일 루트 내 수동 관찰, 제한된 정적 앱 매핑, Evidence 기반 정적/런타임 조정                                                                                                                          |
-| JavaScript 런타임   |   2 | 승인된 연결 전용 Node/Electron Inspector 대상 탐색과 평가·계측 없는 제한된 스크립트 및 실행 컨텍스트 관찰                                                                                                      |
-| 애플리케이션        |  12 | 제한된 교차 계층 추적, 고유 일치 버전 비교, 정적 export 반환 형태 비교, 승인된 Linux 격리 extracted-module replay, 관리형 런타임 특성화, 재구성 커버리지 폐쇄, 결정론적 의무 원장, 엔드투엔드 준비 적합성 검증 |
-| 바이너리 세션       |  19 | `open_binary`, `binary_session`, 증거 번들, 유한 replay 상태 머신, 프로세스·아티팩트·함수 비교, 잔여 미지수 레지스트리                                                                                         |
+| 도구 분류         |  수 | 용도                                                                 |
+| ----------------- | --: | -------------------------------------------------------------------- |
+| 바이너리 검사     |  41 | 함수, 의사 코드, 어셈블리, 문자열, 심볼, 참조, 주석                  |
+| 결합 분석         |  14 | 개요, 함수 분석, 일괄 디컴파일, 호출 그래프, Swift와 ObjC 검사       |
+| macOS 네이티브    |   7 | Mach-O 메타데이터, 서명, plist, 아키텍처, Swift 이름 복원            |
+| 파일과 패키지     |   5 | 디렉터리와 패키지 검사, Interface Builder, Apple 리소스, 추출        |
+| .NET PE/CLI       |   7 | 어셈블리 식별, 메타데이터, CIL, 네이티브 호출, 비교, 재구성 가져오기 |
+| 브라우저 관찰     |   9 | 페이지, 스크립트, 소스 맵, WebMCP, 스크린샷, 캡처 비교               |
+| Electron 분석     |   5 | 페이지 관찰, 앱 구조, 정적·런타임 결과 연결                          |
+| JavaScript 런타임 |   2 | 기존 Node/Electron Inspector에 연결해 스크립트와 실행 컨텍스트 관찰  |
+| 앱 워크플로       |   7 | 기능 추적, 버전 비교, 반환 구조 비교, 재구현 검증                    |
+| 바이너리 세션     |  21 | 대상 전환, 근거 저장, 프로세스·함수 비교, 미해결 항목 기록           |
+
+## 로드맵
+
+다음 작업은 네이티브 대상 검증 확대, JavaScript와 .NET의 버전 비교, 런타임 관찰과 재구현 검증입니다. Setup은 에이전트 연결과 Hopper 설치 선택을 이미 지원합니다. 다른 분석 도구 설치는 향후 작업입니다. [설치 로드맵](docs/roadmap.md)과 [분석 도구 평가](docs/provider-evaluation.md)를 참고하세요.
 
 ## 다른 코딩 에이전트에서 사용하기
 
-Setup은 Claude Code, Claude Desktop, Codex, Cursor, Gemini CLI, Windsurf, Devin을 감지하고 앞의 여섯 클라이언트를 자동으로 구성합니다. Devin은 감지만 보고하고 변경하지 않습니다. 로컬 MCP 서버를 지원하는 코딩 에이전트라면 다음 설정으로 REA를 사용할 수 있습니다.
+Setup은 Claude Code, Claude Desktop, Codex, Cursor, Gemini CLI, Windsurf, Devin, OpenCode, Antigravity, GitHub Copilot CLI, Command Code, VS Code를 지원합니다. 기존 REA 등록은 기본 선택되고, 그 밖의 감지된 클라이언트는 직접 선택해야 합니다. 로컬 MCP 서버를 지원하는 에이전트는 다음 설정으로 연결할 수 있습니다.
 
 <!-- x-release-please-start-version -->
 
@@ -173,7 +220,7 @@ Setup은 Claude Code, Claude Desktop, Codex, Cursor, Gemini CLI, Windsurf, Devin
   "mcpServers": {
     "rea": {
       "command": "npx",
-      "args": ["-y", "rea-agents@2.6.0", "mcp"]
+      "args": ["-y", "rea-agents@4.0.1", "mcp"]
     }
   }
 }
@@ -193,7 +240,7 @@ flowchart LR
     Ghidra --> App
 ```
 
-CLI와 MCP 서버는 같은 분석 엔진을 사용합니다. 터미널 명령은 끝날 때 앱을 닫고, 에이전트 세션은 조사하는 동안 앱을 열어 둡니다.
+CLI와 MCP 서버는 같은 분석 워크플로를 사용합니다. 터미널 명령은 완료 후 자신의 브리지 세션을 해제하고, 에이전트 세션은 조사 중 연결을 유지할 수 있습니다. REA 세션을 닫아도 사용자가 이용 중인 Hopper 앱은 종료하지 않습니다.
 
 ## CLI
 
@@ -229,7 +276,7 @@ REA는 필요할 때 Hopper를 시작합니다. Hopper 런처는 내부적으로
 
 <details><summary><strong>Hopper를 미리 실행해야 하나요?</strong></summary>
 
-아니요. REA가 필요할 때 시작하며 이미 실행 중인 Hopper도 지원합니다.
+아니요. REA가 필요할 때 시작합니다. Hopper가 실행 중이어도 사용할 수 있지만 기존 GUI 문서에 연결하는 대신 새 분석 문서를 엽니다.
 
 </details>
 

README_zh.md

@@ -4,7 +4,7 @@
 
 # REA：逆向工程一切
 
-### 一个 CLI 与 MCP 服务器，让编程智能体逆向工程任何程序
+### 使用智能体逆向工程任何程序，从应用行为到原生二进制文件。
 
 **看到喜欢的功能。理解它的原理。按照你的方式实现。**
 
@@ -13,35 +13,51 @@
 [![MCP tool catalog](https://img.shields.io/badge/MCP-tool_catalog-5c4ee5?style=flat-square)](#调查工具目录)
 [![Node.js 22+](https://img.shields.io/badge/Node.js-22.19%2B-339933?style=flat-square&logo=nodedotjs&logoColor=white)](https://nodejs.org/)
 [![MIT license](https://img.shields.io/badge/license-MIT-f4c430?style=flat-square)](LICENSE)
+[![Discord](https://img.shields.io/discord/1556595354999332884?logo=discord&logoColor=white&label=Discord&color=5865F2)](https://discord.gg/GkcryMnJDM)
 
-[快速开始](#快速开始) · [从二进制到行为](#从二进制到行为) · [工具目录](#调查工具目录) · [工作原理](#工作原理) · [常见问题](#常见问题)
+<a href="https://trendshift.io/repositories/82054?utm_source=trendshift-badge&amp;utm_medium=badge&amp;utm_campaign=badge-trendshift-82054" target="_blank" rel="noopener noreferrer"><img src="https://trendshift.io/api/badge/trendshift/repositories/82054/weekly?language=TypeScript" alt="morluto/rea | Trendshift" width="250" height="55" /></a>
+
+[快速开始](#快速开始) · [当前状态](#当前状态) · [从二进制到行为](#从二进制到行为) · [调查工具目录](#调查工具目录) · [路线图](#路线图) · [工作原理](#工作原理)
+
+<table aria-label="REA community">
+<tr>
+<td align="center" width="360">
+  <a href="https://discord.gg/GkcryMnJDM">
+    <img src="docs/assets/discord.svg" height="42" alt="Discord" /><br />
+    <strong>加入逆向工程社区</strong>
+  </a><br />
+  <sub>Discord · 问答 · 成果分享</sub>
+</td>
+</tr>
+</table>
 
 <br />
 
-<code>curl -fsSL https://raw.githubusercontent.com/morluto/rea/main/install.sh | bash</code>
+<code>npx rea-agents setup</code>
+
+<br />
+
+<img src="docs/assets/rea-hopper-analysis.png" alt="REA 在 Hopper 中启动分析桥并检查原生二进制文件" width="1200" />
 
 </div>
 
 ---
 
-看到某个应用中想加入自己产品的功能？即使没有源代码，也可以把应用交给编程智能体。借助 REA，智能体能够调查该功能、理解其工作原理，并按照你的技术栈、设计和需求构建适合你产品的版本。
+看到某个应用中想加入自己产品的功能？让智能体用 REA 调查它。即使没有源代码，智能体也可以检查应用、解释功能的工作方式、展示证据，并为你的项目实现类似功能。
 
-REA 通过一个 CLI 与 MCP 服务器实现这套流程。智能体可以检查编译后的应用、追踪功能的工作方式，并把了解到的内容用于日常编码。REA 在一个接口背后处理复杂的逆向工程工具。
+REA 提供原生二进制、JavaScript 与 Electron 应用、.NET 程序集和网站的分析工具。你可以从智能体或终端使用它们。分析在本机运行，结果会说明证据和限制。
+
+Setup 可以配置智能体、连接已安装的 Hopper 或 Ghidra，也可以在你批准后安装 Hopper。
 
 ## 直接询问智能体
 
-```bash
-npx rea-agents setup
-```
-
-然后说：
+完成[设置](#快速开始)后，重启智能体并提出问题：
 
 ```text
-逆向工程“备忘录”应用。解释搜索功能的工作方式，
-说明你是如何得出结论的，然后为我的项目构建类似功能。
+解释“备忘录”应用的搜索功能，展示证据，然后为我的项目实现类似功能。
 ```
 
-“备忘录”只是示例。你可以说出任何想了解的应用，也可以让智能体先从概览开始。
+把“备忘录”替换成你想了解的应用，也可以先请求概览。
 
 ## 从二进制到行为
 
@@ -53,70 +69,96 @@ REA 让调查始终以二进制证据为依据。它不会声称能恢复原始
 
 ## 为什么选择 REA
 
-|                  |                                                                |
-| ---------------- | -------------------------------------------------------------- |
-| **为智能体设计** | 直接询问编译后应用的行为，让智能体搜集证据，而不是猜测。       |
-| **CLI 与 MCP**   | 在终端或编程智能体中使用同一套逆向工程能力。                   |
-| **处理复杂流程** | REA 负责工具设置、打开应用、维持调查过程，并在完成后清理资源。 |
-| **完整工作流**   | 从初步概览推进到伪代码、调用关系、类型和实现线索。             |
-| **本地运行**     | 分析在你的 Mac 上运行；REA 不会把二进制上传到托管式分析服务。  |
-| **保留上下文**   | 连续调查多个二进制文件，无需为每个问题重新开始整个分析过程。   |
+|                  |                                                                      |
+| ---------------- | -------------------------------------------------------------------- |
+| **为智能体设计** | 直接询问编译后应用的行为，让智能体搜集证据，而不是猜测。             |
+| **CLI 与 MCP**   | 在终端或编程智能体中使用同一套逆向工程能力。                         |
+| **处理复杂流程** | REA 负责工具设置、打开应用、维持调查过程，并在完成后清理资源。       |
+| **完整工作流**   | 从初步概览推进到伪代码、调用关系、类型和实现线索。                   |
+| **本地运行**     | 分析在受支持的本机系统上运行；REA 不会把二进制上传到托管式分析服务。 |
+| **保留上下文**   | 连续调查多个二进制文件，无需为每个问题重新开始整个分析过程。         |
 
 ## 快速开始
 
-### 使用编程智能体（推荐）
+### 运行设置（推荐）
+
+配置 REA 与智能体的连接：
 
 ```bash
 npx rea-agents setup
 ```
 
-让智能体设置 REA。它会检查你的 Mac，说明需要安装的内容，先征得同意，并引导你处理系统提示。如果智能体要求重启以加载完整工具，请在设置后重启。
+Setup 首先让你多选要连接的智能体。已有 REA 注册默认选中；仅被检测到的客户端不会自动选中，也可以手动选择尚未配置的客户端。查看具体路径和变更后再批准。所选智能体默认安装 REA 工作流；Hopper 是单独的可选操作，需要单独批准。Setup 也可以记录现有 Ghidra 的路径。
 
-### 开始之前
+Setup 会先展示变更并备份已有配置。要求与更多选项见[安装与设置](docs/installation.md)。
 
-- macOS 12 或更高版本
-- Ubuntu 24.04+、Fedora 41+ 或 64 位 Arch Linux
-- Node.js 22.19+ 或 24.11+，以及随 Node 安装的 npm
+### 使用智能体
 
-`rea setup` 会先显示完整变更计划并请求确认。它不会安装或更新 Homebrew、Node.js 或 npm。缺少 [Hopper](https://www.hopperapp.com/) 时，Setup 会提议安装官方软件包；Hopper 是需要单独许可证的独立软件。
+设置完成后，重启智能体并描述你想了解的应用或功能。REA 支持 Claude Code、Claude Desktop、Codex、Cursor、Gemini CLI、Windsurf、Devin、OpenCode、Antigravity、GitHub Copilot CLI、Command Code 和 VS Code。已有 REA 注册默认选中；其他检测到的客户端需手动选择。其他智能体可以使用下方的 MCP 配置。
 
-如果你已在 64 位 Linux 上安装 Ghidra 12.1.2 PUBLIC 和完整的 64 位 JDK 21，Setup 也可以在批准后登记 `GHIDRA_INSTALL_DIR` 和可选的 `JAVA_HOME`。REA 不会下载、安装或修改 Ghidra 或 Java。Ghidra provider 在隔离的只读 headless 会话中提供清单、反编译、汇编、调用关系、带类型的引用、xref、CFG 与函数 dossier；GUI 状态和修改操作仍不可用。
+Hopper 支持演示模式。如果首次启动时出现提示，选择演示模式或输入已有许可证。
 
-#### Linux 安装与故障排除
+### 从终端运行
 
-在 Ubuntu 24.04+、Fedora 41+ 和 64 位 Arch Linux 上，REA 会下载 Hopper 官方的 DEB、RPM 或 Arch 软件包，验证发布方提供的大小和校验和，然后通过 `apt-get`、`dnf` 或 `pacman` 安装依赖。非 root 运行时，`pkexec` 会显示系统授权提示；REA 不调用 `sudo`。
-
-默认启动器是 `/opt/hopper/bin/Hopper`。自定义安装可设置 `HOPPER_LAUNCHER_PATH`。如果 Doctor 报告缺少分析引擎，请运行 `ldd /opt/hopper/bin/Hopper | grep 'not found'`，安装缺少的系统库后重新运行 `rea setup`。REA 会在私有 Xvfb 显示器上运行受支持的 Hopper 演示版，并为每个分析会话选择 Hopper 提供的演示模式；无需桌面 `DISPLAY` 或付费许可证，但演示版受厂商限制。Linux 上还应确保 `~/.local/bin` 位于 `PATH` 中。
-
-```bash
-# 1. 安装和配置 REA
-curl -fsSL https://raw.githubusercontent.com/morluto/rea/main/install.sh | bash
-npx rea-agents setup
-```
-
-如果 macOS 或安装程序要求确认，请完成提示，然后再次运行同一命令。
-
-### 2. 重启编程智能体
-
-Setup 会检测 Claude Code、Claude Desktop、Codex、Cursor、Gemini CLI、Windsurf 和 Devin。它会自动配置检测到的前六种客户端；由于目前没有明确的本地 MCP 配置边界，检测到 Devin 时只会报告而不会修改。重启已配置的客户端，让它加载 REA。
-
-### 3. 直接询问智能体
-
-你可以直接说出应用名称。编程智能体会找到应用，并把 REA 所需的程序文件交给它。
-
-```text
-使用 REA 逆向工程“备忘录”应用。解释搜索功能的工作方式，展示证据，
-然后使用 SQLite 为我的项目构建一个类似功能。
-```
-
-如果遇到问题，请运行：
+设置完成后：
 
 ```bash
 npx -y rea-agents@latest doctor
-rea uninstall
-rea uninstall --purge-data
+npx -y rea-agents@latest analyze /Applications/Notes.app
 ```
 
+### 安装 rea 命令
+
+安装命令行工具：
+
+```bash
+curl -fsSL https://raw.githubusercontent.com/morluto/rea/main/install.sh | bash
+```
+
+需要预先安装 Node.js 和 npm。在终端中运行时，安装程序会安装 `rea` 并启动设置。
+
+也可以用 npm 安装，再运行设置：
+
+```bash
+npm install --global rea-agents
+rea setup
+```
+
+### 运行要求
+
+- macOS 12 或更高版本
+- Ubuntu 24.04+、Fedora 41+ 或 64 位 Arch Linux
+- Node.js 22.x (>=22.19)、24.x (>=24.11) 或 26+，以及 npm
+
+原生二进制分析需要 Hopper 或 Ghidra。Hopper 是独立软件；演示模式有厂商规定的限制，不要求购买许可证。
+
+Ghidra 支持 Linux x64 和 macOS x64/arm64。单独安装 Ghidra 12.1.4 和完整的 64 位 JDK 21，然后配置 REA 使用它们。macOS 还需要对应架构的原生反编译器。
+
+Setup 可以验证安装并保存路径，不会安装或升级 Ghidra、Java、Node.js、npm 或 Homebrew。
+
+Windows Ghidra 分析目前不可用。进程归属、私有目录权限和安全路径检查尚未实现，正确安装 Ghidra 和 Java 也不能启用分析。详见 [Windows Ghidra P0](docs/windows-ghidra-p0.md)。
+
+### 故障排查
+
+运行 `npx -y rea-agents@latest doctor`，检查主机、依赖、分析工具和智能体配置。该命令不会修改文件。添加 `--json` 可获取结构化诊断。
+
+Linux 上的默认 Hopper 启动器为 `/opt/hopper/bin/Hopper`。其他路径可通过 `HOPPER_LAUNCHER_PATH` 指定。如果文件存在但仍报告缺少分析引擎，运行 `ldd /opt/hopper/bin/Hopper | grep 'not found'` 检查缺少的系统库。安装详情见 [Hopper 指南](docs/installation.md#hopper)。
+
+### 更新与卸载
+
+- `rea update` 更新当前 REA 安装。
+- `rea uninstall` 移除 REA 管理的智能体配置项和工作流文件，保留 Hopper。
+- `rea uninstall --purge-data` 还会删除 REA 的缓存和状态。仅在需要移除这些数据时使用。
+
+## 当前状态
+
+REA 可以通过 CLI 和 MCP 分析原生二进制、JavaScript/Electron 应用、.NET 程序集和网站。具体操作取决于主机、目标和所选分析工具。
+
+- Hopper 支持原生分析和注释操作；GUI 行为取决于平台。
+- Ghidra 在 Linux x64 和 macOS x64/arm64 上提供 22 项只读操作，包括清单、搜索、反编译、汇编、调用关系、引用、指令与类型检查。它不提供 GUI 或修改操作。
+- 浏览器、Electron 和进程运行时工作流有独立的配置、批准和生命周期要求。详见 [English README](README.md#current-status) 中的完整状态说明。
+- Windows Ghidra 分析尚未启用，跟踪进展见 [#527](https://github.com/morluto/rea/issues/527)。
+
 ## 一个提示词，完成一次完整调查
 
 ```text
@@ -149,22 +191,26 @@ REA 负责第 1–5 步中的二进制分析。第 6 步由智能体使用其常
 
 ## 调查工具目录
 
-| 工具类别          | 数量 | 示例                                                                                                                                                                        |
-| ----------------- | ---: | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
-| 二进制检查        |   36 | 过程、伪代码、汇编、字符串、名称、段、调用者、被调用者、交叉引用、注释                                                                                                      |
-| 组合分析          |   13 | `binary_overview`, `analyze_function`, `inspect_native_api`, `batch_decompile`, `get_call_graph`, `find_xrefs_to_name`、Swift 与 ObjC 发现                                  |
-| macOS 原生工具    |    5 | Mach-O 元数据、代码签名、plist、架构与 Swift 符号还原，无需启动 Hopper                                                                                                      |
-| 制品图谱          |    3 | 确定性目录、ZIP/APK/IPA 与 ASAR 清单，以及显式选择的事务式提取                                                                                                              |
-| Managed PE/CLI    |    8 | PE/CLI 身份、元数据成员、CIL 哈希、P/Invoke/原生边界声明与验证、应用图谱投影、反编译重建导入、结构化 token 重映射、运行时关联计划与跨版本比较                               |
-| 浏览器观察        |    9 | 精确来源 CDP 抓取、bundle/source map 分析、WebMCP 发现、会话时间线、capture diff 与视觉证据                                                                                 |
-| Electron 分析     |    4 | 限定 canonical 文件根的被动观察、有界静态应用映射，以及基于 Evidence 的静态/运行时对账                                                                                      |
-| JavaScript 运行时 |    2 | 经批准的只附加 Node/Electron Inspector 目标发现，以及不执行求值或插桩的有界脚本和执行上下文观察                                                                             |
-| 应用工作流        |   12 | 有界跨层追踪、唯一匹配跨版本图比较、静态导出返回形状比较、经批准的 Linux 隔离 extracted-module replay、托管运行时表征、重建覆盖闭合、确定性义务账本和端到端就绪性一致性验证 |
-| 二进制会话        |   19 | `open_binary`、`binary_session`、证据包、有限重放状态机、进程、制品与函数比较、残余未知项注册表                                                                             |
+| 工具类别          | 数量 | 用途                                                      |
+| ----------------- | ---: | --------------------------------------------------------- |
+| 二进制检查        |   41 | 函数、伪代码、汇编、字符串、符号、段、引用与注释          |
+| 组合分析          |   14 | 概览、函数分析、批量反编译、调用图、Swift 与 ObjC 检查    |
+| macOS 原生工具    |    7 | Mach-O 元数据、代码签名、plist、架构与 Swift 符号还原     |
+| 制品检查          |    5 | 目录与软件包检查、Interface Builder、Apple 资源目录与提取 |
+| .NET PE/CLI       |    7 | 程序集身份、元数据、CIL、原生调用声明、成员比较与重建导入 |
+| 浏览器观察        |    9 | 页面、脚本、来源映射、WebMCP 工具、截图与捕获比较         |
+| Electron 分析     |    5 | 页面观察、应用结构与静态/运行时结果关联                   |
+| JavaScript 运行时 |    2 | 连接现有 Node/Electron Inspector，观察脚本与执行上下文    |
+| 应用工作流        |    7 | 功能追踪、版本比较、返回结构比较与重建验证                |
+| 二进制会话        |   21 | 目标切换、证据包、进程与函数比较、待解决问题记录          |
+
+## 路线图
+
+接下来的工作包括更多原生目标验证、JavaScript 与 .NET 跨版本比较，以及运行时观察和重建验证。当前设置已支持选择智能体集成和 Hopper 安装；安装其他分析工具仍是后续工作。详见[安装路线图](docs/roadmap.md)和[分析工具评估](docs/provider-evaluation.md)。
 
 ## 与其他编程智能体一起使用
 
-Setup 会检测 Claude Code、Claude Desktop、Codex、Cursor、Gemini CLI、Windsurf 和 Devin，并自动配置检测到的前六种客户端；检测到 Devin 时只会报告而不会修改。任何支持本地 MCP 服务器的编程智能体都可以使用以下配置连接 REA。
+Setup 支持 Claude Code、Claude Desktop、Codex、Cursor、Gemini CLI、Windsurf、Devin、OpenCode、Antigravity、GitHub Copilot CLI、Command Code 和 VS Code。已有 REA 注册默认选中；其他检测到的客户端需手动选择。任何支持本地 MCP 服务器的智能体都可以使用以下配置连接 REA。
 
 <!-- x-release-please-start-version -->
 
@@ -173,7 +219,7 @@ Setup 会检测 Claude Code、Claude Desktop、Codex、Cursor、Gemini CLI、Win
   "mcpServers": {
     "rea": {
       "command": "npx",
-      "args": ["-y", "rea-agents@2.6.0", "mcp"]
+      "args": ["-y", "rea-agents@4.0.1", "mcp"]
     }
   }
 }
@@ -193,7 +239,7 @@ flowchart LR
     Ghidra --> App
 ```
 
-CLI 与 MCP 服务器使用相同的分析引擎。终端命令完成后会关闭应用；智能体会话则会在调查期间保持应用打开。
+CLI 与 MCP 服务器使用相同的分析流程。终端命令完成后释放自己创建的桥接会话；智能体会话可以在调查期间保持连接。关闭 REA 会话不会退出用户正在使用的 Hopper 应用。
 
 ## CLI
 
@@ -223,7 +269,7 @@ REA 会推导明确的格式和架构参数，以避免常见的 FAT 与 ARM 选
 
 ## 安全模型
 
-每个桥会话都使用随机能力令牌和仅限当前用户的 Unix 套接字。协议消息有大小限制，面向调用者的错误不会暴露启动器 stderr 或内部异常原因。Ghidra 会话还使用隔离的临时项目，不会打开或修改用户自己的 Ghidra 项目。
+每个桥会话都使用随机能力令牌和仅限当前用户的 Unix 套接字。诊断保留本机路径、摘要和错误位置等排查信息，同时移除凭据和认证令牌。Ghidra 会话还使用隔离的临时项目，不会打开或修改用户自己的 Ghidra 项目。
 
 这不是沙箱，也无法防御以同一操作系统用户身份运行的恶意进程。打开不可信二进制文件会让所选本地提供商以当前用户权限进行解析和分析。请按照 [SECURITY.md](SECURITY.md) 中的私密流程报告漏洞。
 
@@ -231,7 +277,7 @@ REA 会推导明确的格式和架构参数，以避免常见的 FAT 与 ARM 选
 
 <details><summary><strong>Hopper 是否需要提前运行？</strong></summary>
 
-不需要。REA 会在操作需要时启动 Hopper，也支持已经运行的 Hopper。
+不需要。REA 会在操作需要时启动 Hopper。Hopper 已经运行时也可以使用，但 REA 会打开新的分析文档，不会连接并复用现有 GUI 文档。
 
 </details>
 

bridge/ghidra/ReaGhidraPrepareCom.java

@@ -0,0 +1,32 @@
+import ghidra.app.script.GhidraScript;
+import ghidra.program.model.address.Address;
+import ghidra.program.model.listing.Program;
+import java.math.BigInteger;
+
+/** Seed the declared DOS COM analysis context before default auto-analysis. */
+public final class ReaGhidraPrepareCom extends GhidraScript {
+    @Override
+    public void run() throws Exception {
+        if (!currentProgram.getLanguageID().getIdAsString().equals("x86:LE:16:Real Mode") ||
+            !currentProgram.getExecutableFormat().equals("Raw Binary")) {
+            throw new IllegalArgumentException("DOS COM preparation requires raw x86 real-mode import");
+        }
+        Address entry = currentProgram.getAddressFactory().getDefaultAddressSpace().getAddress("1000:0100");
+        Address start = currentProgram.getMinAddress();
+        Address end = currentProgram.getMaxAddress();
+        if (!entry.equals(start) || end.subtract(start) + 1 > 0xff00) {
+            throw new IllegalArgumentException("DOS COM import must map 1..65280 bytes at 1000:0100");
+        }
+        for (String name : new String[] { "CS", "DS", "ES", "SS" }) {
+            monitor.checkCancelled();
+            currentProgram.getProgramContext().setValue(
+                currentProgram.getRegister(name), start, end, BigInteger.valueOf(0x1000)
+            );
+        }
+        addEntryPoint(entry);
+        if (!disassemble(entry) || createFunction(entry, "entry") == null) {
+            throw new IllegalStateException("DOS COM entry cannot be decoded as a function");
+        }
+        currentProgram.getOptions(Program.PROGRAM_INFO).setBoolean("REA DOS COM prepared", true);
+    }
+}

bridge/hopper_bridge.py

@@ -9,19 +9,15 @@ import json
 import hmac
 import os
 import re
-import sre_parse
 import socket
 from typing import Any, Optional, Protocol, Sequence
 
-MAX_LINE_BYTES = 10 * 1024 * 1024
-MAX_READ_BYTES = 4096
 BAD_ADDRESSES = (-1, 0xFFFFFFFFFFFFFFFF, None)
 _selected_document = None
+_rea_session_document = None
 _search_inventory_cache = {}
 _pseudocode_cache = {}
 _hopper_api = None
-MAX_SEARCH_PATTERN_LENGTH = 256
-MAX_SEARCH_VALUE_LENGTH = 4096
 
 
 class HopperDocument(Protocol):
@@ -69,8 +65,9 @@ class HopperApiFacade:
 
 def _configure_hopper_api(document_provider):
     """Inject Hopper's document provider or a standalone test facade."""
-    global _hopper_api
+    global _hopper_api, _rea_session_document
     _hopper_api = HopperApiFacade(document_provider)
+    _rea_session_document = None
 
 
 def _api():
@@ -88,25 +85,53 @@ def _api():
 
 
 def _session_document():
-    """Find only the document opened for this authenticated REA session."""
+    """Return the exact document bound to this authenticated REA session."""
+    global _rea_session_document
+    documents = _api().documents()
+    if _rea_session_document is not None:
+        return (
+            _rea_session_document
+            if any(document is _rea_session_document for document in documents)
+            else None
+        )
+    return _bind_session_document(documents)
+
+
+def _bind_session_document(documents=None):
+    """Bind this bridge to Hopper's current document for its target."""
+    global _rea_session_document
+    api = _api()
+    if documents is None:
+        documents = api.documents()
     target = os.path.realpath(REA_TARGET_PATH)
-    for document in _api().documents():
+
+    def matches_target(document):
         paths = (document.getExecutableFilePath(), document.getDatabaseFilePath())
-        for path in paths:
-            if path and os.path.realpath(path) == target:
-                return document
+        return any(path and os.path.realpath(path) == target for path in paths)
+
+    current = api.current_document()
+    if current is not None and matches_target(current):
+        _rea_session_document = current
+        return current
+    matching = [document for document in documents if matches_target(document)]
+    if len(matching) == 1:
+        _rea_session_document = matching[0]
+        return matching[0]
+    if len(matching) > 1:
+        raise CapabilityUnavailableError(
+            "The REA session document is ambiguous; Hopper did not identify the launched document"
+        )
     return None
 
 
-MAX_REGEX_BACKTRACKING_PATHS = 10000
-MAX_REGEX_CANDIDATE_LENGTH = 4096
-MAX_REGEX_SEARCH_WORK_UNITS = 1000000
-
-
 class CapabilityUnavailableError(Exception):
     """The active Hopper build lacks one admitted public API operation."""
 
 
+class InvalidRequestError(Exception):
+    """Caller input failed bridge request or operation validation."""
+
+
 EXHAUSTIVE_ANALYSIS_METHODS = frozenset(
     (
         "analyze_function",
@@ -129,6 +154,11 @@ EXHAUSTIVE_ANALYSIS_METHODS = frozenset(
 
 
 def _hex(value):
+    if not isinstance(value, int) or isinstance(value, bool):
+        try:
+            value = int(str(value), 16)
+        except ValueError as error:
+            raise ValueError("Hopper returned a non-hexadecimal address") from error
     return "0x%x" % value
 
 
@@ -149,17 +179,25 @@ def _document(name=None):
     api = _api()
     documents = api.documents()
     if name is not None:
-        for candidate in documents:
-            if candidate.getDocumentName() == name:
-                return candidate
-        raise ValueError("Unknown Hopper document")
+        matches = [candidate for candidate in documents if candidate.getDocumentName() == name]
+        if len(matches) == 1:
+            return matches[0]
+        if len(matches) > 1:
+            current = api.current_document()
+            if current is not None and current.getDocumentName() == name:
+                return current
+            raise InvalidRequestError("Hopper document name is ambiguous")
+        raise InvalidRequestError("Unknown Hopper document")
     if _selected_document is not None:
         for candidate in documents:
             if candidate.getDocumentName() == _selected_document:
                 return candidate
+    session_document = _session_document()
+    if session_document is not None:
+        return session_document
     current = api.current_document()
     if current is None:
-        raise ValueError("No Hopper document is loaded")
+        raise CapabilityUnavailableError("No Hopper document is loaded")
     return current
 
 
@@ -168,20 +206,20 @@ def _address(document, value=None):
     if value is None:
         return document.getCurrentAddress()
     if not isinstance(value, str):
-        raise ValueError("Address must be a string")
+        raise InvalidRequestError("Address must be a string")
     try:
         return int(value, 16)
     except ValueError:
         result = document.getAddressForName(value)
         if result in BAD_ADDRESSES:
-            raise ValueError("Unknown Hopper address or name")
+            raise InvalidRequestError("Unknown Hopper address or name")
         return result
 
 
 def _segment(document, address):
     result = document.getSegmentAtAddress(address)
     if result is None:
-        raise ValueError("Address is outside every segment")
+        raise InvalidRequestError("Address is outside every segment")
     return result
 
 
@@ -189,7 +227,7 @@ def _procedure(document, value=None):
     address = document.getCurrentAddress() if value is None else _address(document, value)
     result = _segment(document, address).getProcedureAtAddress(address)
     if result is None:
-        raise ValueError("No procedure exists at the requested address")
+        raise InvalidRequestError("No procedure exists at the requested address")
     return result
 
 
@@ -203,6 +241,10 @@ def _procedure_identity(procedure):
         "address": _hex(procedure.getEntryPoint()),
         "name": _procedure_name(procedure),
         "classification": None,
+        "body": {
+            "available": False,
+            "reason": "Hopper's public Python API does not expose complete function body ranges",
+        },
     }
 
 
@@ -225,18 +267,14 @@ def _containing_procedure(document, address):
     return (procedure, None) if procedure is not None else (None, "not_in_procedure")
 
 
-def _instruction_addresses(procedure, limit):
+def _instruction_addresses(procedure):
     result = []
     seen = set()
     segment = procedure.getSegment()
-    truncated = False
     for block in procedure.basicBlockIterator():
         address = block.getStartingAddress()
         end = block.getEndingAddress()
         while address < end and address not in seen:
-            if len(result) >= limit:
-                truncated = True
-                return result, truncated
             seen.add(address)
             instruction = segment.getInstructionAtAddress(address)
             if instruction is None:
@@ -246,24 +284,15 @@ def _instruction_addresses(procedure, limit):
             if length <= 0:
                 break
             address += length
-    return result, truncated
+    return result
 
 
 def _procedure_references(document, params):
     procedure = _procedure(document, params.get("procedure"))
     direction = params.get("direction", "outgoing")
-    offset = params.get("offset", 0)
-    limit = params.get("limit", 100)
-    max_instructions = params.get("max_instructions", 500)
     if direction not in ("incoming", "outgoing"):
-        raise ValueError("direction must be incoming or outgoing")
-    if not isinstance(offset, int) or isinstance(offset, bool) or offset < 0:
-        raise ValueError("offset must be a non-negative integer")
-    if not isinstance(limit, int) or isinstance(limit, bool) or limit < 1 or limit > 500:
-        raise ValueError("limit must be an integer between 1 and 500")
-    if not isinstance(max_instructions, int) or isinstance(max_instructions, bool) or max_instructions < 1 or max_instructions > 5000:
-        raise ValueError("max_instructions must be an integer between 1 and 5000")
-    addresses, scan_truncated = _instruction_addresses(procedure, max_instructions)
+        raise InvalidRequestError("direction must be incoming or outgoing")
+    addresses = _instruction_addresses(procedure)
     edges = set()
     for address in addresses:
         segment = _segment(document, address)
@@ -272,8 +301,7 @@ def _procedure_references(document, params):
             edges.add((address, reference) if direction == "outgoing" else (reference, address))
     ordered = sorted(edges)
     items = []
-    selected = ordered[offset:offset + limit]
-    for source, target in selected:
+    for source, target in ordered:
         source_procedure, _ = _containing_procedure(document, source)
         target_procedure, _ = _containing_procedure(document, target)
         items.append({
@@ -283,13 +311,15 @@ def _procedure_references(document, params):
             "target_procedure": _procedure_identity(target_procedure) if target_procedure is not None else None,
             "kind": _unavailable("Hopper's public Python API does not classify reference kinds"),
         })
-    next_offset = offset + len(selected)
-    has_more = next_offset < len(ordered)
-    truncated = scan_truncated or has_more
     return {
         "procedure": _procedure_identity(procedure), "direction": direction,
-        "references": {"items": items, "total": None if scan_truncated else len(ordered), "returned": len(items), "truncated": truncated, "next_offset": next_offset if has_more and not scan_truncated else None},
-        "instructions_scanned": len(addresses), "instruction_scan_truncated": scan_truncated,
+        "reference_kinds_available": False,
+        # The public Hopper API returns observed references but does not expose
+        # enough flow metadata to enumerate calls with no resolved target.
+        # Keep the required list field explicit; the provider records this as
+        # unknown coverage rather than claiming the list is exhaustive.
+        "unresolved_calls": [],
+        "references": items,
     }
 
 
@@ -352,230 +382,39 @@ def _search_inventory(document, kind):
     return inventory
 
 
-def _checked_regex_paths(left, right, operation):
-    """Apply one path-count operation without crossing the static work budget."""
-    if operation == "add":
-        exceeded = left > MAX_REGEX_BACKTRACKING_PATHS - right
-        result = left + right
-    else:
-        exceeded = right != 0 and left > MAX_REGEX_BACKTRACKING_PATHS // right
-        result = left * right
-    if exceeded or result > MAX_REGEX_BACKTRACKING_PATHS:
-        raise ValueError(
-            "Regex exceeds the %d-path backtracking budget"
-            % MAX_REGEX_BACKTRACKING_PATHS
-        )
-    return result
-
-
-def _repeat_regex_paths(child_paths, minimum, maximum):
-    """Count every bounded repetition path, including alternative child paths."""
-    paths = 0
-    repeated_paths = 1
-    for count in range(maximum + 1):
-        if count >= minimum:
-            paths = _checked_regex_paths(paths, repeated_paths, "add")
-        if count < maximum:
-            repeated_paths = _checked_regex_paths(
-                repeated_paths, child_paths, "multiply"
-            )
-    return paths
-
-
-def _validate_regex_class(items):
-    """Accept only constant-time character-class operations."""
-    allowed = {
-        sre_parse.CATEGORY,
-        sre_parse.LITERAL,
-        sre_parse.NEGATE,
-        sre_parse.RANGE,
-    }
-    if any(operation not in allowed for operation, _ in items):
-        raise ValueError("Regex operation is not supported by the bounded matcher")
-
-
-def _validate_regex_node(node, inside_repeat=False):
-    """Return capped path and step bounds for Python regex evaluation."""
-    leaf_operations = {
-        sre_parse.ANY,
-        sre_parse.AT,
-        sre_parse.CATEGORY,
-        sre_parse.LITERAL,
-        sre_parse.NOT_LITERAL,
-    }
-    forbidden = {
-        sre_parse.ASSERT,
-        sre_parse.ASSERT_NOT,
-        sre_parse.GROUPREF,
-        sre_parse.GROUPREF_EXISTS,
-    }
-    for name in ("GROUPREF_IGNORE", "GROUPREF_LOC_IGNORE", "GROUPREF_UNI_IGNORE"):
-        operation = getattr(sre_parse, name, None)
-        if operation is not None:
-            forbidden.add(operation)
-    repeat_tokens = {sre_parse.MAX_REPEAT, sre_parse.MIN_REPEAT}
-    possessive = getattr(sre_parse, "POSSESSIVE_REPEAT", None)
-    if possessive is not None:
-        repeat_tokens.add(possessive)
-    atomic = getattr(sre_parse, "ATOMIC_GROUP", None)
-
-    paths = 1
-    steps = 0
-    for operation, argument in node:
-        if operation in forbidden:
-            raise ValueError("Regex lookarounds and backreferences are not supported")
-        if operation in leaf_operations:
-            operation_paths = 1
-            operation_steps = 1
-        elif operation == sre_parse.IN:
-            _validate_regex_class(argument)
-            operation_paths = 1
-            operation_steps = 1
-        elif operation in repeat_tokens:
-            if inside_repeat:
-                raise ValueError("Nested regex repetitions are not supported")
-            minimum, maximum, child = argument
-            if maximum == sre_parse.MAXREPEAT or maximum > 1000:
-                raise ValueError(
-                    "Unbounded or excessive regex repetitions are not supported"
-                )
-            child_paths, child_steps = _validate_regex_node(child, True)
-            operation_paths = _repeat_regex_paths(
-                child_paths, minimum, maximum
-            )
-            operation_steps = maximum * child_steps
-        elif operation == sre_parse.SUBPATTERN:
-            operation_paths, operation_steps = _validate_regex_node(
-                argument[-1], inside_repeat
-            )
-        elif operation == sre_parse.BRANCH:
-            operation_paths = 0
-            operation_steps = 0
-            for branch in argument[1]:
-                branch_paths, branch_steps = _validate_regex_node(
-                    branch, inside_repeat
-                )
-                operation_paths = _checked_regex_paths(
-                    operation_paths,
-                    branch_paths,
-                    "add",
-                )
-                operation_steps = max(operation_steps, branch_steps)
-        elif atomic is not None and operation == atomic:
-            operation_paths, operation_steps = _validate_regex_node(
-                argument, inside_repeat
-            )
-        else:
-            raise ValueError("Regex operation is not supported by the bounded matcher")
-        paths = _checked_regex_paths(paths, operation_paths, "multiply")
-        steps += operation_steps
-    return paths, steps
-
-
-def _bounded_regex_matcher(expression, backtracking_paths, steps_per_path):
-    """Create a matcher with per-candidate and cumulative work bounds."""
-    remaining_work = MAX_REGEX_SEARCH_WORK_UNITS
-    work_per_character = backtracking_paths * max(steps_per_path, 1)
-
-    def matches(value):
-        nonlocal remaining_work
-        if not isinstance(value, str):
-            raise ValueError("Regex candidates must be strings")
-        if len(value) > MAX_REGEX_CANDIDATE_LENGTH:
-            raise ValueError(
-                "Regex candidate exceeds the %d-character safety limit"
-                % MAX_REGEX_CANDIDATE_LENGTH
-            )
-        required_work = work_per_character * max(len(value), 1)
-        if required_work > remaining_work:
-            raise ValueError(
-                "Regex search exceeds the %d-unit work budget"
-                % MAX_REGEX_SEARCH_WORK_UNITS
-            )
-        remaining_work -= required_work
-        return expression.search(value) is not None
-
-    return matches
-
-
-def _search_page(document, kind, params):
+def _search_results(document, kind, params):
     pattern = params.get("pattern")
-    if not isinstance(pattern, str) or not pattern or len(pattern) > MAX_SEARCH_PATTERN_LENGTH:
-        raise ValueError("pattern must contain between 1 and 256 characters")
+    if not isinstance(pattern, str) or not pattern:
+        raise InvalidRequestError("pattern must be a non-empty string")
     mode = params.get("mode", "literal")
     if mode not in ("literal", "regex"):
-        raise ValueError("mode must be literal or regex")
+        raise InvalidRequestError("mode must be literal or regex")
     case_sensitive = params.get("case_sensitive", False)
     if not isinstance(case_sensitive, bool):
-        raise ValueError("case_sensitive must be a boolean")
-    offset = params.get("offset", 0)
-    limit = params.get("limit", 100)
-    if not isinstance(offset, int) or isinstance(offset, bool) or offset < 0:
-        raise ValueError("offset must be a non-negative integer")
-    if not isinstance(limit, int) or isinstance(limit, bool) or limit < 1 or limit > 100:
-        raise ValueError("limit must be an integer between 1 and 100")
+        raise InvalidRequestError("case_sensitive must be a boolean")
 
     if mode == "literal":
         needle = pattern if case_sensitive else pattern.casefold()
         matches = lambda value: needle in (value if case_sensitive else value.casefold())
     else:
         try:
-            parsed = sre_parse.parse(pattern)
-            backtracking_paths, steps_per_path = _validate_regex_node(parsed)
             expression = re.compile(pattern, 0 if case_sensitive else re.IGNORECASE)
         except (re.error, OverflowError) as error:
-            raise ValueError("Invalid regex pattern") from error
-        matches = _bounded_regex_matcher(
-            expression, backtracking_paths, steps_per_path
-        )
+            raise InvalidRequestError("Invalid regex pattern") from error
+        matches = lambda value: expression.search(value) is not None
 
     selected = []
-    total = 0
-    page_end = offset + limit
     for item in _search_inventory(document, kind):
         if not matches(item[1]):
             continue
-        if offset <= total < page_end:
-            selected.append(item)
-        total += 1
-    next_offset = offset + len(selected)
-    has_more = next_offset < total
-    return {
-        "items": [
+        selected.append(item)
+    return [
             {
                 "address": address,
-                "value": value[:MAX_SEARCH_VALUE_LENGTH],
-                "value_truncated": len(value) > MAX_SEARCH_VALUE_LENGTH,
+                "value": value,
             }
             for address, value in selected
-        ],
-        "offset": offset,
-        "limit": limit,
-        "total": total,
-        "next_offset": next_offset if has_more else None,
-        "has_more": has_more,
-    }
-
-
-def _page(values, offset, limit):
-    """Return one deterministically address-sorted page without crossing an unbounded map."""
-    if not isinstance(offset, int) or isinstance(offset, bool) or offset < 0:
-        raise ValueError("offset must be a non-negative integer")
-    if not isinstance(limit, int) or isinstance(limit, bool) or limit < 1 or limit > 500:
-        raise ValueError("limit must be an integer between 1 and 500")
-    ordered = sorted(values.items(), key=lambda item: int(item[0], 16))
-    selected = ordered[offset:offset + limit]
-    total = len(ordered)
-    next_offset = offset + len(selected)
-    has_more = next_offset < total
-    return {
-        "items": [{"address": address, "value": value} for address, value in selected],
-        "offset": offset,
-        "limit": limit,
-        "total": total,
-        "next_offset": next_offset if has_more else None,
-        "has_more": has_more,
-    }
+        ]
 
 
 def _unavailable(reason):
@@ -583,36 +422,6 @@ def _unavailable(reason):
     return {"available": False, "reason": reason}
 
 
-def _offset(params, name):
-    value = params.get(name, 0)
-    if not isinstance(value, int) or isinstance(value, bool) or value < 0:
-        raise ValueError("%s must be a non-negative integer" % name)
-    return value
-
-
-def _collection_offset(params, name):
-    values = params.get("collection_offset", {})
-    if not isinstance(values, dict):
-        raise ValueError("collection_offset must be an object")
-    value = values.get(name, 0)
-    if not isinstance(value, int) or isinstance(value, bool) or value < 0:
-        raise ValueError("collection_offset.%s must be a non-negative integer" % name)
-    return value
-
-
-def _bounded(items, offset, limit, total=None, scan_truncated=False):
-    selected = items[offset:offset + limit]
-    known_total = len(items) if total is None and not scan_truncated else total
-    has_more = offset + len(selected) < len(items)
-    return {
-        "items": selected,
-        "total": known_total,
-        "returned": len(selected),
-        "truncated": scan_truncated or has_more,
-        "next_offset": offset + len(selected) if has_more else None,
-    }
-
-
 def _name_map(document):
     result = {}
     for segment in document.getSegmentsList():
@@ -639,8 +448,8 @@ def _render_instruction(segment, address):
     )
 
 
-def _assembly(procedure, limit=None):
-    """Render bounded assembly while guarding against malformed instruction cycles."""
+def _assembly(procedure):
+    """Render assembly while guarding against malformed instruction cycles."""
     lines = []
     segment = procedure.getSegment()
     seen = set()
@@ -655,8 +464,6 @@ def _assembly(procedure, limit=None):
             line = _render_instruction(segment, address)
             if line is not None:
                 lines.append(line)
-            if limit is not None and len(lines) >= limit:
-                return "\n".join(lines)
             length = instruction.getInstructionLength()
             if length <= 0:
                 break
@@ -665,37 +472,18 @@ def _assembly(procedure, limit=None):
 
 
 def _read_function_instructions(document, params):
-    """Read one bounded raw-instruction window without invoking decompilation."""
+    """Read all raw instructions without invoking decompilation."""
     procedure = _procedure(document, params.get("procedure"))
-    offset = _offset(params, "offset")
-    limit = params.get("limit", 64)
-    if offset > 100000:
-        raise ValueError("offset must not exceed 100000")
-    if not isinstance(limit, int) or isinstance(limit, bool) or limit < 1 or limit > 500:
-        raise ValueError("limit must be an integer between 1 and 500")
-    addresses, scan_truncated = _instruction_addresses(
-        procedure, offset + limit + 1
-    )
-    start = min(offset, len(addresses))
-    end = min(len(addresses), start + limit)
+    addresses = _instruction_addresses(procedure)
     segment = procedure.getSegment()
     items = []
-    for address in addresses[start:end]:
+    for address in addresses:
         line = _render_instruction(segment, address)
         if line is not None:
             items.append(line)
-    has_more = scan_truncated or end < len(addresses)
     return {
         "procedure": _procedure_identity(procedure),
-        "instructions": {
-            "items": items,
-            "total": None if scan_truncated else len(addresses),
-            "returned": len(items),
-            "truncated": has_more,
-            "next_offset": end if has_more else None,
-        },
-        "instructions_scanned": len(addresses),
-        "instruction_scan_truncated": scan_truncated,
+        "instructions": items,
         "limitations": [
             "Instruction text and ordering are Hopper-specific representations.",
             "The fast path does not decompile the procedure or scan whole-program names and strings.",
@@ -704,20 +492,9 @@ def _read_function_instructions(document, params):
 
 
 def _analyze_function(document, params):
-    """Collect a bounded, single-pass function dossier for agent callers."""
+    """Collect the complete function dossier for agent callers."""
     procedure = _procedure(document, params.get("procedure"))
-    limit = params.get("limit", 100)
-    max_chars = params.get("max_pseudocode_chars", 20000)
-    max_instructions = params.get("max_instructions", 500)
-    pseudocode_offset = _offset(params, "pseudocode_offset")
-    assembly_offset = _offset(params, "assembly_offset")
-    if not isinstance(limit, int) or isinstance(limit, bool) or limit < 1 or limit > 500:
-        raise ValueError("limit must be an integer between 1 and 500")
-    if not isinstance(max_chars, int) or isinstance(max_chars, bool) or max_chars < 1 or max_chars > 100000:
-        raise ValueError("max_pseudocode_chars must be between 1 and 100000")
-    if not isinstance(max_instructions, int) or isinstance(max_instructions, bool) or max_instructions < 1 or max_instructions > 5000:
-        raise ValueError("max_instructions must be between 1 and 5000")
-    addresses, instruction_scan_truncated = _instruction_addresses(procedure, max_instructions)
+    addresses = _instruction_addresses(procedure)
     blocks = []
     all_blocks = list(procedure.basicBlockIterator())
     for block in all_blocks:
@@ -732,7 +509,7 @@ def _analyze_function(document, params):
             "successors": sorted(set(successors), key=lambda value: int(value, 16)),
         })
     pseudo = _pseudocode(document, procedure) or ""
-    assembly_lines = _assembly(procedure, max_instructions).splitlines() if params.get("include_assembly", False) else []
+    assembly_lines = _assembly(procedure).splitlines()
     callers = sorted((_procedure_identity(item) for item in procedure.getAllCallerProcedures()), key=lambda item: int(item["address"], 16))
     callees = sorted((_procedure_identity(item) for item in procedure.getAllCalleeProcedures()), key=lambda item: int(item["address"], 16))
     comments = []
@@ -785,28 +562,21 @@ def _analyze_function(document, params):
     comments.sort(key=lambda item: (int(item["address"], 16), item["kind"]))
     referenced_strings.sort(key=lambda item: (int(item["address"], 16), int(item["source_address"], 16)))
     referenced_names.sort(key=lambda item: (int(item["address"], 16), int(item["source_address"], 16)))
-    pseudo_text = pseudo[pseudocode_offset:pseudocode_offset + max_chars]
-    pseudo_next = pseudocode_offset + len(pseudo_text)
-    def collection(name, items, scan_limited=False):
-        return _bounded(items, _collection_offset(params, name), limit, None, scan_limited)
     return {
-        "procedure": {"address": _hex(procedure.getEntryPoint()), "name": _procedure_name(procedure), "classification": None, "signature": procedure.signatureString(), "locals": _procedure_locals(procedure)},
-        "pseudocode": {"text": pseudo_text, "total_chars": len(pseudo), "returned_chars": len(pseudo_text), "truncated": pseudo_next < len(pseudo), "next_offset": pseudo_next if pseudo_next < len(pseudo) else None},
-        "assembly": _bounded(
-            assembly_lines,
-            assembly_offset,
-            max_instructions,
-            None,
-            instruction_scan_truncated if params.get("include_assembly", False) else False,
-        ),
-        "comments": collection("comments", comments, instruction_scan_truncated),
-        "callers": collection("callers", callers), "callees": collection("callees", callees),
-        "incoming_references": collection("incoming_references", incoming, instruction_scan_truncated),
-        "outgoing_references": collection("outgoing_references", outgoing, instruction_scan_truncated),
-        "referenced_strings": collection("referenced_strings", referenced_strings, instruction_scan_truncated),
-        "referenced_names": collection("referenced_names", referenced_names, instruction_scan_truncated),
-        "basic_blocks": collection("basic_blocks", blocks),
-        "instruction_scan": {"scanned": len(addresses), "truncated": instruction_scan_truncated},
+        "procedure": {
+            **_procedure_identity(procedure),
+            "signature": procedure.signatureString(),
+            "locals": _procedure_locals(procedure),
+        },
+        "pseudocode": pseudo,
+        "assembly": assembly_lines,
+        "comments": comments,
+        "callers": callers, "callees": callees,
+        "incoming_references": incoming,
+        "outgoing_references": outgoing,
+        "referenced_strings": referenced_strings,
+        "referenced_names": referenced_names,
+        "basic_blocks": blocks,
         "limitations": [
             "Hopper's public Python API does not classify reference kinds.",
             "Hopper's public Python API does not expose equivalent external or thunk classification in this dossier.",
@@ -825,6 +595,13 @@ def _dispatch(method, params):
         document = _session_document()
         if document is None:
             return {"shutdown": True, "analysis_stopped": True, "document_closed": True}
+        if method == "shutdown" and not REA_OWNS_PROCESS_LIFETIME:
+            return {
+                "shutdown": True,
+                "analysis_stopped": not document.backgroundProcessActive(),
+                "document_closed": False,
+                "document_retained": True,
+            }
         if document.backgroundProcessActive():
             document.requestBackgroundProcessStop()
         if method == "shutdown" and REA_OWNS_PROCESS_LIFETIME:
@@ -864,9 +641,9 @@ def _dispatch(method, params):
     if method == "read_bytes":
         length = params.get("length", 256)
         if isinstance(length, bool) or not isinstance(length, int):
-            raise ValueError("Byte-read length must be an integer")
-        if length < 1 or length > MAX_READ_BYTES:
-            raise ValueError("Byte-read length must be between 1 and 4096")
+            raise InvalidRequestError("Byte-read length must be an integer")
+        if length < 1:
+            raise InvalidRequestError("Byte-read length must be at least 1")
         reader = getattr(document, "readBytes", None)
         if not callable(reader):
             raise CapabilityUnavailableError(
@@ -900,7 +677,7 @@ def _dispatch(method, params):
             or offset in BAD_ADDRESSES
             or offset < 0
         ):
-            raise ValueError("Address has no authoritative file-offset mapping")
+            raise InvalidRequestError("Address has no authoritative file-offset mapping")
         return {"address": _hex(address), "file_offset": offset}
     if method == "resolve_containing_procedure":
         address = _address(document, params.get("address"))
@@ -936,7 +713,7 @@ def _dispatch(method, params):
         else:
             result = document.getInstructionStart(max(0, target - 1))
         if result in BAD_ADDRESSES:
-            raise ValueError("No adjacent address")
+            raise InvalidRequestError("No adjacent address")
         return _hex(result)
     if method == "list_segments":
         result = []
@@ -968,24 +745,24 @@ def _dispatch(method, params):
             })
         return result
     if method == "list_procedures":
-        return _page(dict(_search_inventory(document, "procedure")), params.get("offset", 0), params.get("limit", 100))
+        return [{"address": address, "value": value} for address, value in _search_inventory(document, "procedure")]
     if method == "list_strings":
         values = dict(_search_inventory(document, "string"))
         requested = params.get("address")
         if requested is not None:
             key = _hex(_address(document, requested))
             values = {key: values[key]} if key in values else {}
-        return _page(values, params.get("offset", 0), params.get("limit", 100))
+        return [{"address": address, "value": value} for address, value in values.items()]
     if method == "list_names":
         result = dict(_search_inventory(document, "name"))
         requested = params.get("address")
         if requested is not None:
             key = _hex(_address(document, requested))
             result = {key: result[key]} if key in result else {}
-        return _page(result, params.get("offset", 0), params.get("limit", 100))
+        return [{"address": address, "value": value} for address, value in result.items()]
     if method in ("search_procedures", "search_strings"):
         kind = "procedure" if method == "search_procedures" else "string"
-        return _search_page(document, kind, params)
+        return _search_results(document, kind, params)
     if method.startswith("procedure_"):
         procedure = _procedure(document, params.get("procedure"))
         if method == "procedure_address":
@@ -1001,7 +778,16 @@ def _dispatch(method, params):
         if method == "procedure_info":
             blocks = list(procedure.basicBlockIterator())
             length = sum(max(0, block.getEndingAddress() - block.getStartingAddress()) for block in blocks)
-            return {"name": _procedure_name(procedure), "entrypoint": _hex(procedure.getEntryPoint()), "basicblock_count": procedure.getBasicBlockCount(), "length": length, "signature": procedure.signatureString(), "locals": _procedure_locals(procedure), "classification": None}
+            return {
+                "name": _procedure_name(procedure),
+                "entrypoint": _hex(procedure.getEntryPoint()),
+                "basicblock_count": procedure.getBasicBlockCount(),
+                "length": length,
+                "signature": procedure.signatureString(),
+                "locals": _procedure_locals(procedure),
+                "classification": None,
+                "body": _procedure_identity(procedure)["body"],
+            }
     if method == "set_address_name":
         address = _address(document, params.get("address"))
         try:
@@ -1035,27 +821,38 @@ def _dispatch(method, params):
         address = _address(document, params.get("address"))
         document.removeBookmarkAtAddress(address)
         return not document.hasBookmarkAtAddress(address)
-    raise ValueError("Unknown bridge method")
+    raise InvalidRequestError("Unknown bridge method")
 
 
 def _serve_connection(connection):
-    """Serve one size-bounded, capability-authenticated NDJSON connection."""
+    """Serve one capability-authenticated NDJSON connection."""
     file = connection.makefile("rwb")
     while True:
-        line = file.readline(MAX_LINE_BYTES + 1)
-        if not line or len(line) > MAX_LINE_BYTES:
+        line = file.readline()
+        if not line:
             break
         request_id = None
         authenticated = False
         should_stop = False
         try:
-            request = json.loads(line.decode("utf-8"))
-            if set(request) != {"id", "token", "method", "params"}:
-                raise ValueError("Invalid bridge request shape")
+            try:
+                request = json.loads(line.decode("utf-8"))
+            except (UnicodeDecodeError, json.JSONDecodeError) as error:
+                raise InvalidRequestError("Invalid bridge request JSON") from error
+            if not isinstance(request, dict) or set(request) != {"id", "token", "method", "params"}:
+                raise InvalidRequestError("Invalid bridge request shape")
             request_id = request["id"]
             if isinstance(request_id, bool) or not isinstance(request_id, int) or request_id < 0:
-                raise ValueError("Invalid bridge request id")
-            if not isinstance(request["token"], str) or not hmac.compare_digest(request["token"], REA_TOKEN):
+                raise InvalidRequestError("Invalid bridge request id")
+            if (
+                not isinstance(request["method"], str) or not request["method"]
+                or not isinstance(request["params"], dict)
+            ):
+                raise InvalidRequestError("Invalid bridge method or parameters")
+            if (
+                not isinstance(request["token"], str) or not request["token"].isascii()
+                or not hmac.compare_digest(request["token"], REA_TOKEN)
+            ):
                 raise PermissionError("Invalid bridge capability")
             authenticated = True
             _write_message(file, {"id": request_id, "event": {
@@ -1110,7 +907,7 @@ def _diagnostic_type(error):
         return "capability_unavailable"
     if isinstance(error, PermissionError):
         return "authorization"
-    if isinstance(error, (ValueError, TypeError, KeyError)):
+    if isinstance(error, InvalidRequestError):
         return "invalid_request"
     return "bridge_exception"
 
@@ -1119,13 +916,13 @@ def _safe_diagnostic(error):
     """Project one exception without retaining provider or credential text."""
     diagnostic_type = _diagnostic_type(error)
     if diagnostic_type == "capability_unavailable":
-        message = str(error)[:512]
+        message = str(error)
     elif diagnostic_type == "authorization":
         message = "Invalid bridge capability"
     elif diagnostic_type == "invalid_request":
         message = "Invalid Hopper bridge request"
     else:
-        message = "%s: Hopper bridge operation failed" % type(error).__name__[:128]
+        message = "%s: Hopper bridge operation failed" % type(error).__name__
     return {"code": -32000, "message": message, "type": diagnostic_type}
 
 
@@ -1147,6 +944,7 @@ def _run():
 
 
 # Hopper's public objects are bound to its dedicated Python execution thread.
-# Keep dispatch on that thread; moving calls to an arbitrary worker can deadlock.
+# Keep dispatch on that thread; moving calls to a worker can deadlock.
 if __name__ == "__main__":
+    _bind_session_document()
     _run()

bridge/native/ReaNativeUI.swift

@@ -0,0 +1,157 @@
+import AppKit
+import ApplicationServices
+import CryptoKit
+import ScreenCaptureKit
+import Darwin
+
+struct Request: Decodable {
+  var pid: Int32
+  var window_id: UInt32
+  var executable: String
+  var sha256: String
+  var launch_time: Double?
+  var screenshot: Bool
+  var accessibility: Bool
+  var max_nodes: Int
+  var action: Action?
+}
+struct Action: Decodable { var kind: String; var path: [Int]?; var direction: String?; var text: String? }
+struct BoundaryFailure: Error { var code: String; var message: String }
+func fail(_ code: String, _ message: String) throws -> Never { throw BoundaryFailure(code: code, message: message) }
+func attribute(_ element: AXUIElement, _ key: String) -> CFTypeRef? {
+  var value: CFTypeRef?
+  return AXUIElementCopyAttributeValue(element, key as CFString, &value) == .success ? value : nil
+}
+func childCount(_ element: AXUIElement) -> Int {
+  var count = 0
+  return AXUIElementGetAttributeValueCount(element, kAXChildrenAttribute as CFString, &count) == .success ? count : 0
+}
+func children(_ element: AXUIElement, limit: Int) -> [AXUIElement] {
+  var value: CFArray?
+  let count = min(limit, childCount(element))
+  if count == 0 { return [] }
+  return AXUIElementCopyAttributeValues(element, kAXChildrenAttribute as CFString, 0, count, &value) == .success ? value as? [AXUIElement] ?? [] : []
+}
+func text(_ element: AXUIElement, _ key: String) -> Any { (attribute(element, key) as? String) ?? NSNull() as Any }
+func windowBounds(_ element: AXUIElement) -> CGRect? {
+  guard let p = attribute(element, kAXPositionAttribute), let s = attribute(element, kAXSizeAttribute),
+    CFGetTypeID(p) == AXValueGetTypeID(), CFGetTypeID(s) == AXValueGetTypeID() else { return nil }
+  var point = CGPoint.zero; var size = CGSize.zero
+  guard AXValueGetValue(p as! AXValue, .cgPoint, &point), AXValueGetValue(s as! AXValue, .cgSize, &size) else { return nil }
+  return CGRect(origin: point, size: size)
+}
+func observe(_ request: Request) async throws -> [String: Any] {
+  guard let app = NSRunningApplication(processIdentifier: request.pid), let url = app.executableURL else {
+    try fail("target-mismatch", "Selected PID does not expose an application executable URL")
+  }
+  guard let canonicalPointer = realpath(url.path, nil) else { try fail("target-mismatch", "Running executable path cannot be resolved") }
+  defer { free(canonicalPointer) }
+  let canonicalExecutable = String(cString: canonicalPointer)
+  guard canonicalExecutable == request.executable else {
+    try fail("target-mismatch", "Selected PID executable \(canonicalExecutable) differs from active target \(request.executable)")
+  }
+  guard let launch = app.launchDate?.timeIntervalSince1970 else {
+    try fail("process-identity-unavailable", "Selected application does not expose a launch time; stable PID reuse checks are unavailable")
+  }
+  if let expected = request.launch_time, expected != launch { try fail("process-replaced", "Selected process was replaced") }
+  let executableSize = (try FileManager.default.attributesOfItem(atPath: url.path)[.size] as? NSNumber)?.int64Value ?? -1
+  guard executableSize >= 0 && executableSize <= 256 * 1024 * 1024 else { try fail("target-limit", "Running executable exceeds the 256 MiB identity-check budget") }
+  let executableBytes = try Data(contentsOf: url, options: .mappedIfSafe)
+  guard SHA256.hash(data: executableBytes).map({ String(format: "%02x", $0) }).joined() == request.sha256 else {
+    try fail("target-mismatch", "Running executable bytes differ from the active target digest")
+  }
+  guard let windows = CGWindowListCopyWindowInfo([.optionIncludingWindow], request.window_id) as? [[String: Any]],
+    windows.count == 1, let window = windows.first,
+    (window[kCGWindowOwnerPID as String] as? NSNumber)?.int32Value == request.pid,
+    (window[kCGWindowLayer as String] as? NSNumber)?.intValue == 0,
+    let boundsDictionary = window[kCGWindowBounds as String] as? [String: Any],
+    let bounds = CGRect(dictionaryRepresentation: boundsDictionary as CFDictionary) else {
+    try fail("window-mismatch", "Selected window is absent or belongs to another process")
+  }
+  if request.screenshot && !CGPreflightScreenCaptureAccess() {
+    try fail("screen-recording-denied", "Grant Screen Recording to the REA host in System Settings > Privacy & Security, then retry; no broad capture fallback is used")
+  }
+  var selected: AXUIElement?
+  if request.accessibility || request.action != nil {
+    guard AXIsProcessTrusted() else { try fail("accessibility-denied", "Grant Accessibility to the REA host in System Settings > Privacy & Security, then retry") }
+    let application = AXUIElementCreateApplication(request.pid)
+    AXUIElementSetMessagingTimeout(application, 2)
+    guard let axWindows = attribute(application, kAXWindowsAttribute) as? [AXUIElement] else {
+      try fail("accessibility-unavailable", "Selected application does not expose accessibility windows")
+    }
+    let matches = axWindows.filter { windowBounds($0) == bounds }
+    guard matches.count == 1 else { try fail("ambiguous-window", "Accessibility window geometry does not identify exactly one selected window; selected CG bounds \(bounds), AX candidates \(axWindows.map { String(describing: windowBounds($0)) })") }
+    selected = matches[0]
+  }
+  if let action = request.action, let root = selected {
+    var element = root
+    for index in action.path ?? [] {
+      var selectedChild: CFArray?
+      guard index >= 0 && index < childCount(element),
+        AXUIElementCopyAttributeValues(element, kAXChildrenAttribute as CFString, index, 1, &selectedChild) == .success,
+        let item = (selectedChild as? [AXUIElement])?.first else { try fail("element-missing", "Selected accessibility path no longer exists") }
+      element = item
+    }
+    var owner: pid_t = 0
+    guard AXUIElementGetPid(element, &owner) == .success && owner == request.pid else { try fail("element-owner-mismatch", "Selected element belongs to another process") }
+    let outcome: AXError
+    switch action.kind {
+    case "click": outcome = AXUIElementPerformAction(element, kAXPressAction as CFString)
+    case "scroll": outcome = AXUIElementPerformAction(element, (action.direction == "increment" ? kAXIncrementAction : kAXDecrementAction) as CFString)
+    case "key-entry": outcome = AXUIElementSetAttributeValue(element, kAXValueAttribute as CFString, (action.text ?? "") as CFString)
+    default: try fail("unsupported-action", "Only selected-element press, increment/decrement and text-value entry are admitted")
+    }
+    guard outcome == .success else { try fail("action-failed", "Accessibility action failed with AXError \(outcome.rawValue)") }
+  }
+  var nodes: [[String: Any]] = []; var truncated = false
+  if request.accessibility, let root = selected {
+    var pending: [(AXUIElement, [Int])] = [(root, [])]
+    while let (element, path) = pending.popLast() {
+      if nodes.count >= request.max_nodes { truncated = true; break }
+      let totalChildren = childCount(element)
+      var actions: CFArray?
+      AXUIElementCopyActionNames(element, &actions)
+      nodes.append(["path": path, "role": text(element, kAXRoleAttribute), "title": text(element, kAXTitleAttribute), "value": text(element, kAXValueAttribute), "actions": actions as? [String] ?? [], "children_count": totalChildren])
+      if path.count >= 32 { if totalChildren > 0 { truncated = true }; continue }
+      let available = max(0, request.max_nodes - nodes.count - pending.count)
+      let count = min(available, totalChildren)
+      let items = children(element, limit: count)
+      if totalChildren > count { truncated = true }
+      for index in (0..<count).reversed() { pending.append((items[index], path + [index])) }
+    }
+  }
+  var screenshot: Any = NSNull()
+  if request.screenshot {
+    guard #available(macOS 14, *) else { try fail("unsupported-host", "Selected-window screenshots require macOS 14 or later") }
+    let content = try await SCShareableContent.excludingDesktopWindows(true, onScreenWindowsOnly: false)
+    guard let scWindow = content.windows.first(where: { $0.windowID == request.window_id && $0.owningApplication?.processID == request.pid }) else {
+      try fail("capture-window-missing", "Selected window disappeared before capture")
+    }
+    guard bounds.width > 0 && bounds.height > 0 && bounds.width <= 100000 && bounds.height <= 100000 else { try fail("window-bounds", "Selected window has invalid or oversized geometry") }
+    let filter = SCContentFilter(desktopIndependentWindow: scWindow)
+    let configuration = SCStreamConfiguration()
+    let scale = min(1, 2048 / max(bounds.width, bounds.height))
+    configuration.width = max(1, Int(bounds.width * scale)); configuration.height = max(1, Int(bounds.height * scale))
+    configuration.showsCursor = false
+    let image = try await SCScreenshotManager.captureImage(contentFilter: filter, configuration: configuration)
+    guard let png = NSBitmapImageRep(cgImage: image).representation(using: .png, properties: [:]) else {
+      try fail("capture-failed", "Selected-window PNG encoding failed")
+    }
+    screenshot = ["mime_type": "image/png", "base64": png.base64EncodedString(), "sha256": SHA256.hash(data: png).map({ String(format: "%02x", $0) }).joined(), "width": image.width, "height": image.height]
+  }
+  return ["window": ["pid": request.pid, "window_id": request.window_id, "executable": request.executable, "launch_time": launch, "title": window[kCGWindowName as String] as? String ?? ""], "nodes": nodes, "truncated": truncated, "screenshot": screenshot, "gaps": request.accessibility ? [] : ["Accessibility capture was disabled"]]
+}
+Task { @MainActor in
+  do {
+    let request = try JSONDecoder().decode(Request.self, from: Data(CommandLine.arguments[1].utf8))
+    let result = try await observe(request)
+    let output = try JSONSerialization.data(withJSONObject: ["ok": true, "result": result], options: [.sortedKeys])
+    FileHandle.standardOutput.write(output)
+  } catch {
+    let failure = error as? BoundaryFailure
+    let output: [String: Any] = ["ok": false, "code": failure?.code ?? "capture-failed", "message": failure?.message ?? error.localizedDescription]
+    if let data = try? JSONSerialization.data(withJSONObject: output, options: [.sortedKeys]) { FileHandle.standardOutput.write(data) }
+  }
+  exit(0)
+}
+RunLoop.main.run()

docs/adr/0001-provider-selection-and-analysis-profiles.md

@@ -6,7 +6,7 @@
   target binding, analysis-profile commitment, and snapshot/Evidence migration
   are implemented. Ghidra discovery, target/profile resolution, doctor checks,
   the private headless-session foundation, ten read-only inventory capabilities,
-  and nine function-analysis capabilities are implemented with real
+  and twelve function-analysis capabilities are implemented with real
   cross-format conformance.
 
 ## Context
@@ -278,9 +278,7 @@ The adapter returns this provider-neutral envelope:
 
 ```json
 {
-  "schema_version": 1,
   "provider": { "id": "ghidra", "version": "<concrete version>" },
-  "provider_profile_schema_version": 1,
   "parameters": {},
   "digest": "<sha256 of RFC 8785 canonical JSON excluding digest>"
 }
@@ -295,8 +293,8 @@ parameters as opaque data.
 A selected deep binding requires a concrete provider version. If the adapter
 cannot determine it, the candidate is unavailable with `version_unresolved`;
 REA does not persist a cache that merely commits `null` or "whatever is
-installed". Provider identity, provider-profile schema version, normalized
-parameters, or provider version changes produce a different digest.
+installed". Provider identity, normalized parameters, or provider version
+changes produce a different digest.
 
 The same target, configuration, and provider must resolve the same profile over
 CLI and MCP. Profile resolution must be side-effect-free and complete before
@@ -304,11 +302,10 @@ the provider imports the target.
 
 ### 7. Make snapshots provider- and profile-exact
 
-Analysis snapshot v2 replaces Hopper loader arguments with an explicit binding
+Analysis snapshots replace Hopper loader arguments with an explicit binding
 commitment:
 
 ```text
-snapshot_version: 2
 target: digest + generic format/kind + selected architecture
 binding: provider identity + analysis profile commitment
 entries: exact immutable queries
@@ -321,7 +318,7 @@ A cached entry is reusable only when all of the following match exactly:
 
 - target digest, generic format and kind, and selected architecture;
 - provider ID and provider version;
-- profile schema versions and profile digest;
+- profile digest;
 - operation and canonical parameters; and
 - the existing cacheability and immutability rules.
 
@@ -330,20 +327,20 @@ entries from the previous binding. Auxiliary operations are cacheable only if
 their provider defines an equivalent explicit profile commitment; otherwise
 they remain Evidence but not snapshot entries.
 
-Snapshot v1 is not silently upgraded. Its `loader_args` cannot prove which
-engine version, defaults, or analyzer settings produced the entries. Importing
-v1 returns a typed incompatibility with a recapture instruction. Its embedded
-Evidence bundle may still be imported separately through the existing explicit
-Evidence import flow; it is never promoted into a v2 analysis cache.
+Snapshot v1 cannot be parsed as the current snapshot format. Its `loader_args`
+cannot prove which engine version, defaults, or analyzer settings produced the
+entries, so snapshots must be recaptured before they can be used as a cache.
+An embedded Evidence bundle can still be imported separately through the
+Evidence import flow; it is never promoted into an analysis cache.
 
-### 8. Add profile commitments to new deep Evidence without rejecting legacy Evidence v2
+### 8. Add profile commitments to new deep Evidence while preserving legacy records
 
-Evidence remains schema version 2. A backward-compatible optional
-`analysis_profile` field uses the canonical envelope above. Every newly created
-deep-analysis observation must include it, and its provider ID and version must
-match the record's provider. The field participates in the Evidence semantic ID.
+The optional `analysis_profile` field uses the canonical envelope above. Every
+newly created deep-analysis observation must include it, and its provider ID
+and version must match the record's provider. The field participates in the
+Evidence semantic ID.
 
-Existing Evidence v2 records without `analysis_profile` remain valid and keep
+Existing Evidence records without `analysis_profile` remain valid and keep
 their existing IDs. Absence on a legacy deep record means the analysis profile
 is unknown; REA does not infer or enrich it during import. Such evidence can be
 displayed and cited but cannot establish profile compatibility, seed snapshot
@@ -459,9 +456,9 @@ snapshot's provider.
 | `open_binary` and CLI structured `loaderArgs` output | Retained as a deprecated Hopper-only compatibility projection for 1.x; the analysis profile is authoritative   |
 | `BinaryTarget.loaderArgs`                            | Removed; Hopper derives them inside its adapter and commits normalized semantics in the profile                |
 | Legacy `.hop` input                                  | Classified generically as an analysis database and accepted only by Hopper                                     |
-| Snapshot v1                                          | Rejected for cache replay with explicit recapture guidance; embedded Evidence may be imported separately       |
-| Existing Evidence v2 without a profile               | Accepted unchanged; profile compatibility is unknown                                                           |
-| New deep-analysis Evidence v2                        | Must include `analysis_profile`; its semantic ID commits the field                                             |
+| Snapshot v1                                          | Not accepted as the current snapshot format; recapture before cache replay                                     |
+| Existing Evidence without a profile                  | Accepted unchanged; profile compatibility is unknown                                                           |
+| New deep-analysis Evidence                           | Must include `analysis_profile`; its semantic ID commits the field                                             |
 | Existing status fields                               | Retained for 1.x with additive binding and candidate fields                                                    |
 | Provider failure after selection                     | Returned from the selected provider; no transparent retry through another engine                               |
 
@@ -485,7 +482,6 @@ with a separately documented major contract change.
 | Same target is reopened without a selector                 | Existing binding remains unchanged                                          |
 | Same bytes are opened with a different profile             | Real provider switch and a separate snapshot partition                      |
 | Snapshot provider or profile differs from the binding      | Typed `EvidenceIntegrityError` with `profile_mismatch`; nothing is imported |
-| Snapshot v1 is supplied                                    | Typed incompatibility with recapture or explicit Evidence-import guidance   |
 | Artifact-only target has no deep candidate                 | Target opens unbound; disjoint artifact capabilities remain usable          |
 | Environment prefers Ghidra for an artifact-only target     | Deep selection is `not_applicable`; auxiliary operations remain usable      |
 | Concrete deep provider is requested for artifact-only data | Typed `target_unsupported`; the request is not silently ignored             |
@@ -504,7 +500,7 @@ Positive consequences:
 Costs and tradeoffs:
 
 - Multi-provider hosts must choose when more than one candidate is usable.
-- Snapshot v1 cannot safely serve as a cache after this migration.
+- Snapshots must be recaptured when their provider or profile binding changes.
 - Providers must expose deterministic availability, support, version, and
   profile resolution before they can be admitted.
 - Status and error contracts gain additive structured metadata.
@@ -561,16 +557,19 @@ The first six implementation stages are shipped:
 4. Ghidra availability, target/profile resolution, doctor checks, and a private
    read-only headless session were admitted without declaring operations.
 5. Program identity, procedures, strings, symbols, memory blocks,
-   address/name resolution, containing-procedure resolution, and bounded search
+   address/name resolution, containing-procedure resolution, and search
    were admitted with exact wire schemas and real debug/stripped ELF
    conformance.
-6. Function metadata, persistent bounded decompilation, assembly, resolved
+6. Function metadata, persistent decompilation, assembly, resolved
    callers/callees, typed references, xrefs, CFG, and complete function dossiers
-   were admitted. A bounded per-Program queue serializes API access, and real
-   conformance covers x86-64 and AArch64 ELF, PE, Mach-O, stripped symbols,
-   targetless indirect calls, cancellation, deadlines, and cleanup.
+   were admitted. A serial per-Program queue keeps API access ordered without a
+   fixed queue length or per-operation deadline. Real conformance covers
+   x86-64 and AArch64 ELF, PE, Mach-O, stripped symbols, targetless indirect
+   calls, cancellation, and cleanup.
 
 Future stages may deepen format and indirect-flow coverage, but must continue
 to compare normalized semantics rather than provider-specific pseudocode or
-assembly text. Ghidra continues to omit GUI and mutation operations, so
-unsupported requests cannot route to an unverified implementation.
+assembly text. Linux and macOS now admit atomic function-name and entry-comment
+edits in the ephemeral database, with readback, rollback, and cache invalidation.
+Executable bytes remain unchanged. Windows P0 retains its read-only boundary;
+GUI and other unimplemented mutations remain unavailable.

docs/adr/0002-controlled-replay-authority-and-sandbox.md

@@ -1,10 +1,14 @@
 # ADR-0002: Controlled JavaScript replay authority and sandbox policy
 
-- Status: Accepted
+- Status: Superseded; the controlled JavaScript replay tool was removed
 - Date: 2026-07-16
-- Implementation status: Implemented by `run_controlled_replay` with a
-  Linux-x86_64 Bubblewrap, seccomp, and delegated systemd user-cgroup backend.
-  Hosts that cannot establish every required boundary fail closed.
+- Implementation status: The implementation was removed. The design below is
+  retained as historical context and does not describe a supported REA tool.
+
+> Historical design note: The tool, sandbox backend, and plan/execute workflow
+> described here are no longer part of REA. For runtime behavior, run probes
+> directly against the application and use the available browser, Electron, or
+> process capture workflows.
 
 ## Context
 
@@ -168,9 +172,10 @@ requires an active permission grant and literal per-call approval bound to the
 exact replay plan. Project, session, and administrator grants may satisfy the
 permission-policy layer, but none replace that per-run approval.
 
-Reproducer export is a separate host write after the sandbox has stopped. It
-uses the existing bounded `evidence_write` authority and a separate export
-approval; `javascript_replay` alone never writes a host file.
+Reproducer export is a separate host write after the sandbox has stopped. This
+ADR's root-scoped `evidence_write` authority was removed; current exports use
+the path supplied by the caller, while replay still waits for complete sandbox
+cleanup before writing.
 
 ### 2. Admit extracted modules only
 
@@ -226,7 +231,7 @@ The plan must disclose at least:
   projection; and
 - expected Evidence and cleanup behavior.
 
-Execution requires both `approved: true` and the exact `plan_digest`. REA
+Execution requires the exact `plan_digest`. REA
 rebuilds the plan immediately before admission. Any changed file, runtime,
 sandbox executable, policy, stub, input, limit, or environment commitment
 returns `plan_stale` before application code starts. Approval is not transferable
@@ -321,7 +326,8 @@ Every limit has a conservative product default. The v1 plan and result commit:
 - cgroup memory, swap, task, and CPU ceilings;
 - Node/V8 heap ceiling as defense in depth;
 - private tmpfs bytes;
-- module count and aggregate bytes, case count, and input bytes;
+- serialized worker-protocol bytes, aggregate module bytes, and case-input
+  bytes; preset-generated cases also have a fixed preflight count ceiling;
 - stdout, stderr, exception, stack, and aggregate retained-output bytes; and
 - structured-result depth and node count.
 
@@ -332,7 +338,7 @@ partial successful return.
 
 ### 7. Preserve exact provenance and the right Evidence authority
 
-A run that reaches worker admission produces Evidence v2 with:
+A run that reaches worker admission produces Evidence with:
 
 - provider `rea-javascript-replay` and a concrete implementation version;
 - operation `run_controlled_replay`;
@@ -406,7 +412,7 @@ Failure at one cleanup step does not skip the remaining steps.
 The canonical replay manifest commits:
 
 ```text
-schema and policy versions
+plan structure and policy identity
 REA/provider/runtime/sandbox executable identities and digests
 module aliases, dependency graph, bytes digests, and source references
 stub IDs, versions, source digests, and caller-provided stub digests

docs/adr/0003-managed-code-evidence-and-provider-boundary.md

@@ -1,13 +1,17 @@
 # ADR-0003: Managed-code evidence and provider boundary
 
-- Status: Accepted
+> Historical design record: The non-executing runtime-correlation planning
+> tool described in earlier revisions was removed. This ADR's current
+> implementation status below covers only the static managed tools that ship.
+
+- Status: Superseded for runtime planning; static evidence boundary remains in force
 - Date: 2026-07-16
 - Implementation status: Read-only PE/CLI triage and exact identity are shipped
   through `inspect_managed_artifact` / `rea inspect-managed-artifact`. Bounded
   metadata, signatures, method bodies, raw CIL hashes, limited
   decoded-instruction-tuple v1 hashes, exception regions, call edges, and
   field-access anchors are shipped through `inspect_managed_members`; `rea
-inspect-managed-members` provides CLI parity. Static member comparison and build-local
+  inspect-managed-members` provides CLI parity. Static member comparison and build-local
   token remapping are shipped through `compare_managed_members` /
   `rea compare-managed-members`. Declaration-only managed/native boundary
   inventory for ModuleRef, ImplMap/PInvoke, ReadyToRun indicators, and non-IL
@@ -19,11 +23,9 @@ inspect-managed-members` provides CLI parity. Static member comparison and build
   addresses. Decompiler reconstruction import is
   shipped through `import_managed_reconstruction` /
   `rea import-managed-reconstruction`; it records user-supplied C#/IL/pseudocode
-  as analyst inference only after exact static member locks match. Default-disabled
-  runtime-correlation admission planning is shipped through
-  `plan_managed_runtime_correlation` / `rea plan-managed-runtime-correlation`;
-  it does not attach, load, debug, reflect, instrument, invoke, or execute
-  target code. Managed static graph projection is shipped through
+  as analyst inference only after exact static member locks match. Managed
+  inspection does not execute assemblies or observe CLR internals. Managed static graph
+  projection is shipped through
   `project_managed_application_graph` /
   `rea project-managed-application-graph`; it projects authenticated managed
   Evidence into the application graph without changing managed tokens into
@@ -50,7 +52,7 @@ makes names especially weak while tokens remain coordinates in only one build.
 REA already separates one selected deep native provider from disjoint auxiliary
 providers under [ADR-0001](0001-provider-selection-and-analysis-profiles.md).
 It also separates static evidence, passive observation, process capture, and
-controlled replay authorities. Managed analysis must fit those boundaries
+interactive observation authorities. Managed analysis must fit those boundaries
 without requiring a CLR to inspect an artifact, loading target code into the
 REA process, or treating a managed token as a native address.
 
@@ -189,7 +191,7 @@ or a CLR load. Complete-coverage claims require every applicable bounded region
 to have been admitted; otherwise coverage is partial, unknown, or unavailable
 with exact offsets and reasons.
 
-The input path remains under REA's approved investigation roots. Local artifact
+The caller selects the local input path directly. Local artifact
 paths, digests, MVIDs, tokens, malformed offsets, and analysis metadata are
 actionable diagnostics and are not secrets. Credentials, authorization data,
 and genuine secrets remain redacted.
@@ -203,7 +205,7 @@ artifact: canonical path + byte length + SHA-256
 component: container identity + component path/name + component SHA-256, when applicable
 classification: container + runtime family + implementation form + architecture
 assembly/module: simple name + version + culture + public-key identity + module name + MVID
-producer: provider ID + exact version + parser/profile schema + profile digest
+producer: provider ID + exact version + analysis-affecting parameters + profile digest
 ```
 
 An assembly-qualified name does not replace the artifact digest or MVID.
@@ -218,7 +220,7 @@ declaring type + normalized CLI signature
 build-local metadata token
 RVA/file extent when present
 raw CIL byte length + SHA-256 when the body is admitted
-member-result schema version + decoded-instruction-tuple SHA-256 when CIL is valid
+decoded-instruction-tuple SHA-256 when CIL is valid
 separate max-stack, locals-token, and exception-region observations
 ```
 
@@ -232,9 +234,9 @@ The caller-visible field remains named `normalized_il_sha256`, but its shipped
 v1 meaning is deliberately narrower than a canonical semantic CIL identity.
 For a completely decoded method, REA serializes the instruction-order array of
 `[opcode, operand_kind, operand]` tuples with JavaScript `JSON.stringify`,
-encodes that text as UTF-8, and reports its lowercase SHA-256. The member
-result's `schema_version: 1` scopes this convention; there is no independent
-normalized-CIL algorithm-version field in v1.
+encodes that text as UTF-8, and reports its lowercase SHA-256. The tuple
+projection is defined here; the member result carries only the described
+normalized digest.
 
 Operands retain the current decoder projection: metadata and user-string
 operands are build-local lowercase hexadecimal tokens, scalar branch operands
@@ -257,10 +259,13 @@ exception/local commitments, and an explicit algorithm version require a new
 normalized-CIL schema.
 
 Metadata tokens are reported because they are precise coordinates inside one
-module. Cross-version identity never consists of a token alone. A structural
-match cites both build commitments, both local tokens, the v1 tuple inputs, the
-member-result schema version, and all competing candidates. V1 cannot cite a
-separate matching-algorithm version because none is exposed.
+module. Cross-version identity never consists of a token alone. Matching tries
+exact CIL/signature identity, then an exact declared-type/name/signature tuple,
+then structural shape; a name by itself never selects a pair. Partial or
+malformed bodies leave body facets unknown after a signature tuple pairs the
+methods. Matches cite both build commitments, both local tokens, and all
+competing candidates. V1 cannot cite a separate matching-algorithm version
+because none is exposed.
 
 ### 5. Separate five evidence layers
 
@@ -356,24 +361,13 @@ emit full IL, decompiled source, runtime logs, user data, credentials, or
 service/account material. No proprietary binary, hash-locked application
 manifest, or derived dump is committed to REA.
 
-### 8. Keep runtime correlation a different, default-disabled authority
+### 8. Keep runtime behavior separate from static managed analysis
 
-Static managed support grants no permission to attach, load, debug, reflect,
-instrument, invoke, or execute. The shipped runtime-correlation planning
-capability distinguishes those effects, remains disabled by default, requires
-explicit administrator and per-call approval, and binds to the exact artifact
-SHA-256, MVID, method signature, and CIL/body shape observed by the static
-path. It records an admission plan only; a future executor must pass a separate
-threat model before any effect can occur.
-
-Runtime admission must additionally validate host OS, CLR family, architecture,
-and supported build/tool versions; bound time, threads, outputs, UI and network
-effects; avoid real services and accounts; and own all created processes and
-artifacts through complete cleanup. Reflection-only loading is still a CLR load
-and is not a substitute for the static byte parser.
-
-Runtime execution is intentionally outside the current managed-code track and
-requires its own threat model and admission decision.
+No managed runtime planning or execution tool ships. Managed inspection does
+not execute assemblies or establish which methods ran. Where supported, direct
+process capture can record target-level inputs and outputs, but it does not
+prove CLR method execution or resolution. Internal managed behavior remains
+unknown until independently observed with suitable runtime evidence.
 
 ## Public contract consequences
 
@@ -386,7 +380,7 @@ requires its own threat model and admission decision.
 - Managed addresses distinguish file offsets, RVAs, native virtual addresses,
   metadata tokens, and CIL offsets. They are not interchangeable.
 - Cache compatibility is exact on artifact/component commitment, member-result
-  schema, parser profile, and producer version. For shipped v1,
+  fields, parser profile, and producer version. For shipped v1,
   `normalized_il_sha256` has no independent algorithm-version field.
 - Provider-neutral workflows may compose canonical managed findings with the
   one native binding, but every source operation retains its actual producer.
@@ -440,9 +434,7 @@ or development-only oracles.
 5. Add source-built, pinned real-tool, package, CLI, and MCP conformance.
    Source-owned conformance is shipped; pinned external real-tool checks remain
    planned.
-6. Add separately authorized runtime-correlation admission planning. Shipped;
-   runtime execution remains planned.
-7. Project authenticated managed static Evidence into the application graph.
+6. Project authenticated managed static Evidence into the application graph.
    Shipped.
 
 Every gate must keep unsupported ReadyToRun, NativeAOT, IL2CPP, mixed-mode, or

docs/adr/README.md

@@ -4,8 +4,8 @@ Accepted decisions describe the architecture that implementation PRs must
 follow. Acceptance does not by itself mean the behavior is shipped; each record
 states its implementation status separately.
 
-| ADR                                                                                                                | Status   | Implementation                                  |
-| ------------------------------------------------------------------------------------------------------------------ | -------- | ----------------------------------------------- |
-| [0001: Provider selection and analysis profiles](0001-provider-selection-and-analysis-profiles.md)                 | Accepted | Foundation shipped; capability work continues   |
-| [0002: Controlled JavaScript replay authority and sandbox policy](0002-controlled-replay-authority-and-sandbox.md) | Accepted | Linux x86_64 extracted-module replay shipped    |
-| [0003: Managed-code evidence and provider boundary](0003-managed-code-evidence-and-provider-boundary.md)           | Accepted | PE/CLI triage shipped; deeper contracts planned |
+| ADR                                                                                                                | Status               | Implementation                                                                                                               |
+| ------------------------------------------------------------------------------------------------------------------ | -------------------- | ---------------------------------------------------------------------------------------------------------------------------- |
+| [0001: Provider selection and analysis profiles](0001-provider-selection-and-analysis-profiles.md)                 | Accepted             | Provider selection and 22 Ghidra operations shipped on Linux/macOS; experimental Windows x64 P0 with bundled native controls |
+| [0002: Controlled JavaScript replay authority and sandbox policy](0002-controlled-replay-authority-and-sandbox.md) | Superseded           | Historical design; the controlled JavaScript replay tool was removed                                                         |
+| [0003: Managed-code evidence and provider boundary](0003-managed-code-evidence-and-provider-boundary.md)           | Partially superseded | Seven static managed tools remain; runtime planning removed                                                                  |

docs/apple-application-analysis.md

@@ -0,0 +1,18 @@
+# Apple Application Inventory Projection
+
+REA can project one or more authenticated `inventory_artifact` Evidence records
+for the same IPA into an Apple application inventory. The projection is
+execution-free: it reports exact paths, content hashes, detected formats,
+runtime-family hints, and path-based bridge hypotheses. It does not parse plist
+or CMS semantics or claim observed runtime calls.
+
+The result includes every component in each inventory category and every
+JavaScript-to-native bridge candidate pair. It has no caller-selected component
+budget, prefix truncation, or omitted-count fields. Duplicate inventory pages
+are merged by artifact identity and occurrence path; their Evidence IDs remain
+attached as source Evidence.
+
+Coverage is `complete-within-inventory` when the supplied pages reconstruct the
+complete authenticated inventory, and `partial` otherwise. A partial result
+states that absence is unknown. Component and bridge-candidate arrays are still
+the complete projection of the inventory that was supplied.

docs/architecture.mermaid

@@ -16,8 +16,7 @@ graph TD
         APP["src/application/<br/>Shared CLI/MCP workflows<br/>enhanced analysis and investigations"]
         SESSION["SessionProviderRouter + BinarySession<br/>one immutable deep binding per target<br/>disjoint auxiliary routing"]
         REGISTRY["AnalysisProviderRegistry<br/>sorted deep candidates<br/>deterministic selection, no fallback"]
-        WORKSPACE["Investigation workspace store<br/>approved roots, canonical JSON<br/>atomic CAS revisions and locks"]
-        JS_RECON["JavaScript artifact reconstruction<br/>bounded directory/ASAR reads<br/>AST-only bundle projection"]
+        JS_RECON["JavaScript artifact reconstruction<br/>directory/ASAR reads<br/>AST-only bundle projection"]
     end
 
     subgraph "Provider Layers"
@@ -25,65 +24,79 @@ graph TD
         GHIDRA["src/ghidra/<br/>Ghidra discovery, profile & function analysis<br/>snapshot, Unix/Windows transport, bounded lifecycle"]
         AUX["src/artifacts/ + src/native/<br/>disjoint artifact and native capabilities"]
         BROWSER["src/browser/<br/>Loopback CDP transport<br/>exact-origin passive observation"]
-        REPLAY["src/replay/<br/>Disposable JavaScript worker<br/>Bubblewrap, seccomp, cgroup limits"]
+        DOTNET["src/dotnet/<br/>Managed static metadata provider<br/>PE/CLI metadata inventory, members, IL"]
+        REFERENCE["src/reference/<br/>Filesystem reference-source reader<br/>bounded traversal, validation, errors"]
     end
 
     subgraph "Provider Process Foundation"
-        PROCESS["src/process/<br/>owned process groups, private roots<br/>deadlines, bounded diagnostics, cleanup"]
+        PROCESS["src/process/<br/>owned process groups, private roots<br/>deadlines, bounded file reads and diagnostics, cleanup"]
+        WINDOWS["src/windows/<br/>Windows host boundary adapters<br/>package loader, opaque handles, owned jobs and private runtimes"]
+        WINDOWS_NATIVE["native/windows/src/<br/>Node-API implementation<br/>NTFS admission, protected DACLs and atomic Job Object assignment"]
     end
 
     subgraph "Contracts Layer"
         CONTRACTS["src/contracts/<br/>Caller-visible schemas for analysis, managed, browser, Electron, application, and session tools"]
+        ERRORS["src/contracts/errorSchemas.ts<br/>Shared analysis error schemas<br/>CLI diagnostics, generated error catalog"]
     end
 
     subgraph "Domain Layer"
-        DOMAIN["src/domain/<br/>Pure side-effect-free modules<br/>evidence, comparisons, application graphs, workspace commitments"]
+        DOMAIN["src/domain/<br/>Pure side-effect-free modules<br/>evidence, comparisons, application graphs"]
     end
 
     subgraph "Configuration"
-        CONFIG["src/config.ts<br/>Zod-validated env parsing<br/>provider settings, origins, and approved roots"]
+        CONFIG["src/config.ts<br/>Zod-validated env parsing<br/>provider settings and origins"]
     end
 
     subgraph "Tests"
         TESTS["tests/<br/>Vitest suite<br/>fixtures/ holds fake launcher, bridge, and CDP seams"]
     end
 
+    subgraph "Evaluation"
+        EVALUATION["src/evaluation/<br/>Agent release evaluation<br/>session transcript scoring"]
+    end
+
     DISPATCH --> CLI
     DISPATCH --> MAIN
     MAIN --> CONFIG
     MAIN --> SERVER
     MAIN --> APP
     CLI --> APP
+    CLI --> ERRORS
     APP --> SESSION
     SESSION --> REGISTRY
     REGISTRY --> HOPPER
     REGISTRY --> GHIDRA
     SESSION --> AUX
-    APP --> WORKSPACE
     APP --> JS_RECON
     APP --> INSTALL
     SERVER --> CONTRACTS
     SERVER --> APP
     APP --> BROWSER
-    APP --> REPLAY
+    APP --> DOTNET
+    DOTNET --> DOMAIN
     HOPPER --> HOPPER_BRIDGE
     GHIDRA --> GHIDRA_BRIDGE
     HOPPER --> PROCESS
     GHIDRA --> PROCESS
+    GHIDRA --> WINDOWS
+    PROCESS --> WINDOWS
+    WINDOWS --> WINDOWS_NATIVE
     APP --> PROCESS
     APP --> DOMAIN
     JS_RECON --> AUX
     JS_RECON --> DOMAIN
+    APP --> REFERENCE
+    REFERENCE --> DOMAIN
     CONTRACTS --> DOMAIN
     HOPPER --> DOMAIN
     GHIDRA --> DOMAIN
     AUX --> DOMAIN
     BROWSER --> DOMAIN
-    REPLAY --> DOMAIN
     PROCESS --> DOMAIN
     TESTS -.-> MAIN
     TESTS -.-> HOPPER
     TESTS -.-> GHIDRA
     TESTS -.-> PROCESS
     TESTS -.-> BROWSER
-    TESTS -.-> REPLAY
+    TESTS -.-> EVALUATION
+    TESTS -.-> ERRORS

docs/assets/discord.svg

@@ -0,0 +1,4 @@
+<svg role="img" viewBox="0 0 24 24" xmlns="http://www.w3.org/2000/svg">
+  <title>Discord</title>
+  <path fill="#5865F2" d="M20.317 4.3698a19.7913 19.7913 0 0 0-4.8851-1.5152.0741.0741 0 0 0-.0785.0371c-.211.3753-.4447.8648-.6083 1.2495-1.8447-.2762-3.68-.2762-5.4868 0-.1636-.3933-.4058-.8742-.6177-1.2495a.077.077 0 0 0-.0785-.037 19.7363 19.7363 0 0 0-4.8852 1.515.0699.0699 0 0 0-.0321.0277C.5334 9.0458-.319 13.5799.0992 18.0578a.0824.0824 0 0 0 .0312.0561c2.0528 1.5076 4.0413 2.4228 5.9929 3.0294a.0777.0777 0 0 0 .0842-.0276c.4616-.6304.8731-1.2952 1.226-1.9942a.076.076 0 0 0-.0416-.1057c-.6528-.2476-1.2743-.5495-1.8722-.8923a.077.077 0 0 1-.0076-.1277c.1258-.0943.2517-.1923.3718-.2914a.0743.0743 0 0 1 .0776-.0105c3.9278 1.7933 8.18 1.7933 12.0614 0a.0739.0739 0 0 1 .0785.0095c.1202.099.246.1981.3728.2924a.077.077 0 0 1-.0066.1276 12.2986 12.2986 0 0 1-1.873.8914.0766.0766 0 0 0-.0407.1067c.3604.698.7719 1.3628 1.225 1.9932a.076.076 0 0 0 .0842.0286c1.961-.6067 3.9495-1.5219 6.0023-3.0294a.077.077 0 0 0 .0313-.0552c.5004-5.177-.8382-9.6739-3.5485-13.6604a.061.061 0 0 0-.0312-.0286ZM8.02 15.3312c-1.1825 0-2.1569-1.0857-2.1569-2.419 0-1.3332.9555-2.4189 2.157-2.4189 1.2108 0 2.1757 1.0952 2.1568 2.419 0 1.3332-.9555 2.4189-2.1569 2.4189Zm7.9748 0c-1.1825 0-2.1569-1.0857-2.1569-2.419 0-1.3332.9554-2.4189 2.1569-2.4189 1.2108 0 2.1757 1.0952 2.1568 2.419 0 1.3332-.946 2.4189-2.1568 2.4189Z"/>
+</svg>

docs/browser-observation.md

@@ -1,21 +1,23 @@
 # Website observation with CDP
 
-REA can attach to a user-owned Chrome-family browser through the Chrome DevTools Protocol (CDP) and produce bounded Evidence v2 about an existing page. This is a passive reverse-engineering capability, not a general browser automation or remote-control surface.
+REA can attach to a user-owned Chrome-family browser through the Chrome DevTools Protocol (CDP) and produce bounded Evidence about an existing page. This is a passive reverse-engineering capability, not a general browser automation or remote-control surface.
 
 ## Shipped surfaces
 
-- `list_browser_targets` / `rea list-browser-targets` discovers page targets whose current URL matches an approved exact origin.
-- `inspect_web_page` / `rea inspect-web-page` captures bounded DOM structure, accessibility nodes, scripts, resources, safe response/DOM metadata, attach-window network and console metadata, WebSocket frame sizes, workers, quota, and optionally storage key names, redacted storage-content fingerprints, or script sources.
-- `analyze_web_bundle` / `rea analyze-web-bundle` parses approved script artifacts without execution and derives chunk edges, route and endpoint candidates, vendor fingerprints, static WebMCP declarations, and optionally approved source-map/original-source evidence.
-- `observe_web_session` / `rea observe-web-session` arms a bounded window for an external user action and records ordered reload, SPA navigation, redirect, failure, lifecycle, and target-termination metadata.
-- `discover_webmcp_tools` / `rea discover-webmcp-tools` uses the experimental CDP WebMCP domain to inventory page registrations. REA never exposes `WebMCP.invokeTool`.
+- `list_browser_targets` / `rea list-browser-targets` discovers page targets at the selected target's current origin by default, with an optional exact-origin filter.
+- `inspect_web_page` / `rea inspect-web-page` captures DOM structure, accessibility nodes, scripts, resources, safe response/DOM metadata, attach-window network and console metadata, WebSocket frame sizes, workers, quota, and optionally selected storage key names, redacted storage-content fingerprints, or script sources.
+- `analyze_web_bundle` / `rea analyze-web-bundle` parses selected script artifacts without execution and derives chunk edges, route and endpoint candidates, vendor fingerprints, static WebMCP declarations, and optionally source-map/original-source evidence.
+- `observe_web_session` / `rea observe-web-session` arms an observation window of the requested duration for an external user action and records ordered reload, SPA navigation, redirect, failure, lifecycle, and target-termination metadata.
+- `discover_webmcp_tools` / `rea discover-webmcp-tools` uses the experimental CDP WebMCP domain to return every in-scope registration and its complete structural input-schema summary inline. REA never exposes `WebMCP.invokeTool`; malformed protocol payloads fail explicitly instead of returning incomplete tool metadata.
 - `compare_web_captures` / `rea compare-web-captures` compares passive captures or exact-step-aligned browser scenarios. Scenario results commit reproducible literal normalization and expose alignment failures plus artifact-level action, screenshot, DOM, accessibility, URL, history, storage, and event differences. Missing or truncated evidence is never treated as equivalence.
-- `capture_web_screenshot` / `rea capture-web-screenshot` returns an explicitly approved, bounded, content-addressed visible-viewport PNG.
+- `capture_web_screenshot` / `rea capture-web-screenshot` returns a content-addressed visible-viewport PNG.
 - `compare_web_screenshots` / `rea compare-web-screenshots` performs bounded local PNG pixel comparison without OCR or external services.
-- Every surface has equivalent CLI and MCP contracts and returns Evidence v2 provenance.
-- MCP session results are retained as `rea://evidence/{evidenceId}` resources. One-shot CLI output is not retained by a long-lived REA session.
+- Every surface has equivalent CLI and MCP contracts and returns Evidence provenance.
+- MCP tools return complete results inline and include the Evidence ID. Session evidence can be exported with `export_evidence_bundle`.
 
-Electron `file://` pages use a separate provider, permission capability, and root model; see [electron-observation.md](electron-observation.md).
+Target discovery returns the complete in-scope target array in one result.
+
+Electron `file://` pages use a separate provider and target boundary; see [electron-observation.md](electron-observation.md).
 Existing static application Evidence and passive web/Electron captures can be
 combined later through
 [JavaScript static/runtime reconciliation](javascript-runtime-reconciliation.md).
@@ -33,40 +35,24 @@ google-chrome \
 
 REA does not launch, own, or terminate this browser. Use a dedicated profile and stop it yourself when the investigation is complete. Do not expose the debugging port on a non-loopback interface.
 
-## Configure authority
+## Request boundary
 
-Browser observation is fail-closed by default. Configure the administrator ceiling before starting REA:
-
-```bash
-export REA_BROWSER_OBSERVE_ENABLED=true
-export REA_BROWSER_CDP_ENDPOINTS_JSON='["http://127.0.0.1:9222"]'
-export REA_BROWSER_ALLOWED_ORIGINS_JSON='["http://127.0.0.1:3000"]'
-```
-
-`REA_BROWSER_CDP_ENDPOINTS_JSON` accepts at most 16 literal `http://127.0.0.1:PORT` or `http://[::1]:PORT` endpoints. `localhost`, private-LAN addresses, HTTPS endpoints, credentials, paths, queries, fragments, and implicit ports are rejected.
-
-`REA_BROWSER_ALLOWED_ORIGINS_JSON` accepts at most 32 exact HTTP(S) origins. Paths, credentials, queries, fragments, and wildcards are rejected. An input must stay within both this administrator ceiling and any active project/session/once grant.
-
-Configuration is reloadable through the existing `SIGHUP` permission-policy path. A request still requires `approved: true`; configuration alone does not make a tool call implicit.
-
-Inspect the exact effective scope without contacting the browser:
-
-```bash
-rea policy explain browser_observe \
-  --origins http://127.0.0.1:9222 \
-  --origins http://127.0.0.1:3000 \
-  --network loopback \
-  --json
-```
+Each request supplies a literal loopback CDP endpoint and target. Target
+discovery uses the selected target's current origin by default; an optional
+exact HTTP(S) origin filter can narrow the result. `localhost`, private-LAN
+addresses, HTTPS CDP endpoints, credentials, paths, queries, fragments, and
+implicit ports are not valid CDP endpoints. Origin filters contain only scheme,
+host, and port; paths, credentials, queries, fragments, and wildcards are not
+valid origins.
 
 ## CLI workflow
 
-Configured origins are used by default. `--allowed-origins` can request a narrower set that still fits the configured ceiling.
+Pass the endpoint and selected target for each call. An origin filter is
+optional and narrows the target set.
 
 ```bash
-rea list-browser-targets http://127.0.0.1:9222 --approved --json
+rea list-browser-targets http://127.0.0.1:9222 --json
 rea inspect-web-page http://127.0.0.1:9222 TARGET_ID \
-  --approved \
   --observation-ms 1000 \
   --json
 ```
@@ -75,34 +61,33 @@ Static bundle analysis and a user-driven observation window are separate operati
 
 ```bash
 rea analyze-web-bundle http://127.0.0.1:9222 TARGET_ID \
-  --approved --source-capture-approved --json
+  --json
 rea observe-web-session http://127.0.0.1:9222 TARGET_ID \
-  --approved --observation-ms 10000 --json
+  --observation-ms 10000 --json
 rea discover-webmcp-tools http://127.0.0.1:9222 TARGET_ID \
-  --approved --json
+  --json
 ```
 
-Accessibility names/descriptions, console primitive text, JSON body shapes, WebSocket shapes, script content, and storage key names require separate opt-ins. Console/body/WebSocket capture additionally requires its matching approval flag:
+Accessibility names/descriptions, console primitive text, JSON body shapes, WebSocket shapes, script content, and storage key names are selected independently:
 
 ```bash
 rea inspect-web-page http://127.0.0.1:9222 TARGET_ID \
-  --approved \
   --include-accessibility-text \
-  --include-console-text --console-text-approved \
-  --include-json-body-shapes --json-body-schema-approved \
-  --include-websocket-shapes --websocket-shape-approved \
+  --include-console-text \
+  --include-json-body-shapes \
+  --include-websocket-shapes \
   --include-script-sources \
   --include-storage-keys --include-storage-fingerprints \
   --json
 ```
 
-Accessibility text and script content may contain application secrets and become part of the returned Evidence. Accessibility and console text have independent per-field and aggregate UTF-8 byte limits; credential-shaped console substrings are redacted. JSON and WebSocket captures retain paths, types, counts, and truncation only, never values or examples. Storage values remain redacted even when key-name capture is approved. `--include-storage-fingerprints` separately approves SHA-256 identity/value fingerprints, which support comparison only when cookies, DOM storage, IndexedDB, and Cache Storage were all captured completely.
+Accessibility text, script content, query values, and explicitly requested primitive console text may contain application secrets and become part of the returned Evidence. URL username/password credentials are removed; ordinary query values, fragments, and parameter order remain intact. JSON and WebSocket captures retain complete paths, types, and counts, never values or examples. Storage values remain redacted even when key-name capture is requested. `--include-storage-fingerprints` requests SHA-256 identity/value fingerprints, which support comparison only when cookies, DOM storage, IndexedDB, and Cache Storage were all captured completely.
 
-Screenshot pixels require both `--approved` and `--screenshot-approved`:
+Screenshot capture returns the complete visible viewport as an inline image artifact:
 
 ```bash
 rea capture-web-screenshot http://127.0.0.1:9222 TARGET_ID \
-  --approved --screenshot-approved --json
+  --json
 ```
 
 ## MCP input
@@ -110,58 +95,57 @@ rea capture-web-screenshot http://127.0.0.1:9222 TARGET_ID \
 ```json
 {
   "cdp_endpoint": "http://127.0.0.1:9222",
-  "allowed_origins": ["http://127.0.0.1:3000"],
-  "target_id": "TARGET_ID_FROM_LIST_BROWSER_TARGETS",
-  "approved": true,
-  "observation_ms": 500,
-  "include_accessibility_text": false,
-  "include_console_text": false,
-  "console_text_approved": false,
-  "include_json_body_shapes": false,
-  "json_body_schema_approved": false,
-  "include_websocket_shapes": false,
-  "websocket_shape_approved": false,
-  "include_script_sources": false,
-  "include_storage_keys": false,
-  "include_storage_fingerprints": false
+  "target_id": "TARGET_ID_FROM_LIST_BROWSER_TARGETS"
 }
 ```
 
-Call `list_browser_targets` first because target IDs are browser-instance-specific. REA rechecks the selected target's current type and origin immediately before attaching.
+The omitted observation window and capture options use conservative defaults.
+Set an option only when the investigation needs that additional content.
+Collection counts are not capped. Per-value validation, the selected observation
+window, and CDP protocol limits still apply; any incomplete or truncated values
+are reported in the result.
 
-REA establishes an authorized main-frame boundary before enabling Runtime, Debugger, or Network observation, rechecks it before document capture, and validates it again afterward. If the main frame navigates during final capture, REA discards the mixed result and returns `target_changed`.
+Call `list_browser_targets` first because target IDs are browser-instance-specific. REA rechecks the selected target's current type and origin immediately before attaching. Without an origin filter, discovery lists all eligible pages; an individual capture defaults to the selected page's current origin.
+
+REA establishes a main-frame origin boundary before enabling Runtime, Debugger, or Network observation, rechecks it before document capture, and validates it again afterward. If the main frame navigates during final capture, REA discards the mixed result and returns `target_changed`.
 
 ## Data minimization
 
-REA removes sensitive values before normalized event data is retained:
+REA retains local observation data and removes only URL userinfo credentials, explicitly declared scenario secrets, and values from structured credential/storage fields:
 
-- URLs retain a bounded path and at most 256 bounded query parameter names, replace every retained query value with `[REDACTED]`, and remove credentials and fragments.
+- URL observations preserve the complete local URL, including query values, fragments, duplicate parameters, and their order. Only username/password userinfo is removed; malformed original URL strings remain available with `origin: null`.
 - DOM snapshots retain node types, node names, value lengths, and attribute names, but not text or attribute values.
-- Accessibility structure and roles are retained by default, but names and descriptions require `include_accessibility_text: true` and remain byte-bounded.
-- Network observations retain method, status, MIME type, size, type, initiator stack location, and redacted URLs. Headers are discarded after an allowlisted projection of length/encoding, structured CSP/Link/policy fields, and untrusted agent hints. Cookies and authorization headers are never retained.
-- Request/response bodies are not requested or parsed by default. With independent approval, only allowed-origin JSON media types are read within per-body and aggregate budgets, converted immediately to value-free property paths/types, and discarded. `Network.getResponseBody` is never sent without that approval.
-- Console observations with an approved stack source retain call type, argument types, timestamp, and redacted source location. With independent approval, only already-delivered primitive values are retained after credential redaction and byte bounds; objects, getters, and remote properties are never expanded.
-- WebSocket observations retain direction, opcode, and payload byte length. With independent approval, bounded text frames are classified as text or value-free JSON shape; binary bytes, hashes, prefixes, and raw frames are never retained.
-- Storage observations always redact values. Key names, IndexedDB names, and cache names require `include_storage_keys`; stable content fingerprints require the additional `include_storage_fingerprints` approval. Cache bodies above 64 KiB and partial IndexedDB remote objects make fingerprint coverage incomplete, so identical observations remain `unknown`.
-- Script metadata is included only when CDP supplies a URL on an allowed origin. Stable keys exclude transient CDP script IDs, and exact transient raw URLs are used only during script/resource reconciliation. URL-less scripts are excluded because their origin cannot be established. When CDP supplies an execution-context association, the accepted script retains its authorized frame ID for later attribution. Source content is omitted unless explicitly requested and becomes a self-verifying `rea://web-content/sha256/...` artifact subject to per-script and aggregate byte limits.
+- Accessibility structure and roles are retained by default, while names and descriptions require `include_accessibility_text: true`.
+- Network observations retain method, status, MIME type, size, type, initiator stack location, and complete URLs with userinfo credentials removed. Headers are discarded after an allowlisted projection of length/encoding, structured CSP/Link/policy fields, and untrusted agent hints. Cookies and authorization headers are never retained.
+- Request/response bodies are not requested or parsed by default. When selected, only allowed-origin JSON media types are read, converted immediately to complete value-free property paths/types, and discarded. `Network.getResponseBody` is never sent unless JSON body shape capture is selected.
+- Console observations with a stack source retain call type, argument types, timestamp, and source location. When console text capture is selected, already-delivered primitive values are retained verbatim; objects, getters, and remote properties are never expanded.
+- WebSocket observations retain direction, opcode, and payload byte length. When shape capture is selected, text frames are classified as text or complete value-free JSON shape; binary bytes, hashes, prefixes, and raw frames are never retained.
+- Storage observations always redact values. Key names, IndexedDB names, and cache names require `include_storage_keys`; stable content fingerprints require the additional `include_storage_fingerprints` selection. Cache bodies above 64 KiB and partial IndexedDB remote objects make fingerprint coverage incomplete, so identical observations remain `unknown`.
+- Script metadata is included only when CDP supplies a URL on an allowed origin. Stable keys exclude transient CDP script IDs, and exact transient raw URLs are used only during script/resource reconciliation. URL-less scripts are excluded because their origin cannot be established. When CDP supplies an execution-context association, the accepted script retains its authorized frame ID for later attribution. Source content is omitted unless explicitly requested and is returned inline as a self-verifying artifact with its SHA-256 digest.
 
-Cross-origin frames, resources, scripts, events, and workers are excluded unless their exact origins are also approved. Excluded target details are counted without being exposed.
-Retained workers include bounded opener-target and parent-frame IDs when CDP
+Frames, resources, scripts, events, and workers outside the selected origin scope are excluded. An explicit `allowed_origins` list can include additional origins; excluded target details are counted without being exposed.
+Retained workers include validated opener-target and parent-frame IDs when CDP
 provides them; these relationships do not expand the exact-origin boundary or
 prove static module ownership.
 
 ## Completeness and limits
 
-The default observation window is 500 ms and the maximum is 10 seconds. Frames (200), DOM nodes (2,000), accessibility nodes (2,000), scripts (200), resources (2,000), workers (500), and each storage key/name inventory (1,000) have conservative defaults and caller-visible hard bounds. Script source bytes, network events, console events, and WebSocket events are bounded separately. The CLI exposes the same limits as kebab-case options such as `--max-frames` and `--max-storage-keys`.
+The default inspection window is 500 ms; callers choose its duration. The
+capture returns all in-scope frames, DOM and accessibility nodes, scripts,
+resources, workers, storage names, and observed network, console, and WebSocket
+events. Full selected text, script sources, and JSON shapes are returned inline.
+The result distinguishes
+`complete_within_window`, `policy_filtered`, `attach_limited`, and `truncated`
+coverage. It reports excluded items and any values omitted or truncated by
+validation; it does not drop records to meet an internal collection quota.
+Disallowed-origin entries are filtered before retention.
 
-Every result distinguishes `complete_within_window`, `policy_filtered`, `attach_limited`, and `truncated` coverage. It names affected sections and reports sparse excluded-item and per-event-type dropped counts rather than implying exhaustive capture. Disallowed-origin entries are filtered before collection-limit accounting, so they cannot consume an approved origin's output budget.
+CDP discovery, WebSocket connection, and commands continue until the peer responds or the caller cancels the operation; REA has no internal byte, message-count, or pending-command quota for these exchanges. Without caller cancellation, a stalled peer can leave an operation waiting. On cancellation, REA closes only its own WebSocket, waiting up to one second before terminating it. Malformed unsolicited protocol events poison the connection so later commands fail closed.
 
-CDP discovery, WebSocket connection, and each command have a 5-second timeout. Version discovery is capped at 64 KiB, target discovery at 2 MiB and 1,000 targets, each WebSocket message at 16 MiB, and correlated pending commands at 128. Malformed unsolicited protocol events poison the connection so later commands fail closed.
-
-Network and console coverage starts only after REA attaches and enables the relevant CDP domains. `prior_activity_available` is always `false`; absence from these arrays is not evidence that an event never occurred. Source maps are not fetched by inspection. Bundle analysis can fetch them only after separate approval, with exact-origin redirect checks, no credentials/cookies/referrer, per-map and aggregate byte limits, a total map-count limit, v3 validation, and bounded generated/original mappings. Source-map results report requested, processed, and dropped counts rather than hiding budget truncation.
+Network and console coverage starts only after REA attaches and enables the relevant CDP domains. `prior_activity_available` is always `false`; absence from these arrays is not evidence that an event never occurred. Source maps are not fetched by inspection. Bundle analysis fetches them only when `fetch_source_maps` is selected, with exact-origin redirect checks and no credentials, cookies, or referrer. Every requested map, mapping, original source, AST node, and finding from parsed content is returned inline; failed maps remain explicitly unavailable and make bundle completeness partial.
 
 ## Non-goals and threat model
 
-The browser provider deliberately does not expose generic CDP commands, `Runtime.evaluate`, WebMCP invocation, navigation, input, downloads, page closure, or browser closure. Screenshot capture is the sole pixel surface and requires separate literal approval. REA disables the domains it enabled, detaches the target session, and closes only its own WebSocket.
+The browser provider deliberately does not expose generic CDP commands, `Runtime.evaluate`, WebMCP invocation, navigation, input, downloads, page closure, or browser closure. Screenshot capture is the sole pixel surface and returns an image only when requested. REA disables the domains it enabled, detaches the target session, and closes only its own WebSocket.
 
-This feature is not a browser sandbox or network containment mechanism. The attached page and browser continue running with their existing privileges and may make external requests independently of REA. CDP gives deep access to the selected browser profile, so use a dedicated profile, approve only origins you intend to inspect, and treat other same-user processes as outside this boundary.
+This feature is not a browser sandbox or network containment mechanism. The attached page and browser continue running with their existing privileges and may make external requests independently of REA. CDP gives deep access to the selected browser profile, so use a dedicated profile, include only origins you intend to inspect, and treat other same-user processes as outside this boundary.

docs/browser-scenario-contract.md

@@ -1,59 +1,89 @@
 # Browser scenario contract
 
-`capture_browser_scenario` accepts the versioned provider-neutral
+`capture_browser_scenario` accepts the provider-neutral
 `browserScenarioSchema` through both MCP and the
-`capture-browser-scenario INPUT_JSON` CLI command. Version 1 is declarative and
-bounded: it admits a fixed action vocabulary, exact HTTP(S) origins,
-deterministic browser settings, explicit storage and request replay, and finite
-capture limits. `INPUT_JSON` may be inline JSON or a JSON file path.
+`capture-browser-scenario INPUT_JSON` CLI command. The request is declarative:
+it admits a fixed action vocabulary, explicit HTTP(S) targets, deterministic
+browser settings, explicit storage seeds, and provider-owned
+liveness deadlines. `INPUT_JSON` may be inline JSON or a JSON file path.
+
+The minimal request contains only browser launch/connect selection, `start_url`,
+and at least one `actions` entry. Launch `headless` defaults to `true` and can
+be set to `false` where the host supports a visible browser. Navigations follow
+the destinations named by the scenario and the page's ordinary browser requests;
+there is no separate origin allowlist or request-interception layer. Environment
+settings (including service workers blocked by default), empty storage, and a
+final sanitized URL capture are supplied by default. Set
+`environment.service_workers` to `allow` when the application requires them.
+Add secret declarations, storage seeds, and additional artifact or event
+capture only when needed. Action, secret, and storage counts are not capped.
+Duration, action, and navigation
+timeouts remain fixed provider-owned liveness limits; the request does not
+accept a caller-controlled `limits` object.
 
 The browser boundary is part of the contract. Launch mode requires a
-caller-selected absolute executable, a provider-owned temporary profile,
-headless operation, and close-plus-delete cleanup. Connect mode accepts only an
-explicit-port loopback CDP endpoint, declares the browser externally owned, and
-permits disconnect-only cleanup. The Playwright driver preserves this
+caller-selected executable and always uses a provider-owned temporary profile
+that is closed and deleted during cleanup. Connect mode accepts only an
+explicit-port loopback CDP endpoint. The Playwright driver preserves this
 distinction: it closes and deletes provider-owned profiles, but only disconnects
 from an external CDP browser. Real-browser verification checks both outcomes and
 confirms that an attached external browser remains alive.
 
-URLs contain a query-free HTTP(S) base plus ordered query entries. Every query,
-form, storage, cookie, and replay value is either an explicitly public literal
-or a reference to a declared environment-backed secret. Raw credentials in
-URLs and literal credential headers are rejected. Secret query names must also
-appear in the redaction policy, and the required credential headers cannot be
-removed from that policy. Durable results must replace resolved secret values
+HTTP(S) URLs may include ordinary query values and fragments directly. Use
+ordered structured query entries when a value needs to reference a declared
+environment-backed secret. Form, storage, and cookie values are either literal
+strings or declared secret references. Raw URL userinfo credentials are rejected.
+Captured credential-header
+values are not retained, and declared secret values are redacted automatically.
+A secret may be declared solely to
+redact matching observed content; every secret reference in an action, URL,
+storage value still needs a declaration. Ordinary query values
+and fragments remain intact. Durable results replace resolved secret values
 with their secret references.
 
-Every start, navigation, storage, replay, and redirect origin must be listed in
-`allowed_origins`. Unsupported action tags, unknown fields, duplicate step or
-route IDs, undeclared or unused secrets, and provider-owned replay headers fail
-validation. HTTP and WebSocket routing enforces the same declared scope. Exact
-replay may abort unmatched requests or pass through only approved origins.
+The exact `start_url`, navigation destinations, and storage-seed origins define
+the inputs to a scenario; ordinary page requests are handled by the browser.
+Storage cookies are scoped to the page URL at each capture. Unsupported action
+tags, unknown fields, duplicate step IDs, and undeclared secret references fail
+validation.
 
-The result is Evidence v2 with an initial state followed by one record per
+The result is Evidence with an initial state followed by one record per
 declared action. Each step reports action status, elapsed time, sanitized URLs,
 event bounds, and independently typed capture states for screenshot, DOM,
 accessibility, URL, history, and storage. Console, page-error, network,
 WebSocket, frame, worker, popup, and cancelled-download events are attributed to
-steps and bounded by the scenario limits. Missing and truncated sections remain
-explicit and make the capture ineligible for equality claims. Attach-mode
-captures also declare the unavoidable pre-attach event gap.
+steps and all observed events and requested artifacts are returned inline.
+There are no event, frame, worker, popup, WebSocket, DOM-node,
+accessibility-node, storage-entry, screenshot-count, or cumulative
+metadata-byte caps. Requested artifacts and observed events are returned
+inline without application-defined size ceilings. Other missing sections
+remain explicit and make the capture ineligible for equality claims.
+Attach-mode captures also declare the unavoidable pre-attach event gap.
 
-Browser automation is disabled by default. The administrator ceiling is
-configured with:
+Selected event families are observed on the root page and discovered descendant
+popups, including nested popups. Popup lifecycle records are emitted only when
+`popups` is selected. Launch-mode network observation starts at the owned
+context before navigation, so popup document requests, redirects, and responses
+are included once. Connected contexts can contain unrelated tabs: only network
+events with a frame belonging to the root or a discovered popup are retained.
+Initial popup requests without a frame cannot be attributed in shared contexts
+and are omitted; attach coverage remains incomplete.
 
-- `REA_BROWSER_SCENARIO_ENABLED`
-- `REA_BROWSER_SCENARIO_EXECUTABLE_ROOTS_JSON`
-- `REA_BROWSER_SCENARIO_CDP_ENDPOINTS_JSON`
-- `REA_BROWSER_SCENARIO_ALLOWED_ORIGINS_JSON`
-- `REA_BROWSER_SCENARIO_ALLOWED_ENV_JSON`
+Playwright reports new popup Pages after their first navigation has committed.
+It buffers early console messages and page errors, but the pinned API cannot
+recover every earlier frame, worker, WebSocket, or download event. If one of
+those families is selected and a popup is discovered, REA reports the family gap
+in `limitations`, marks `events` missing, and disables equality eligibility.
+Later events remain available; no initial navigation is synthesized from the
+popup's current URL.
 
-Unlike passive observation, browser automation is not granted automatically.
-Use an explicit project/session grant, or opt into the administrator grant with
-`REA_BROWSER_SCENARIO_AUTO_GRANT=true` for a trusted unattended environment.
-Authorization commits the exact executable or CDP endpoint, origins, environment
-variable names, network class, and scenario digest before any browser side
-effect.
+Each request names the exact launch executable or loopback CDP endpoint, target,
+actions, and capture behavior. Origin filters and environment-variable names
+are included when the scenario needs them.
+Launch owns a temporary profile; connect mode disconnects from the selected
+external browser without closing it. The request itself defines the operation;
+there is no additional REA grant step. The browser and host still enforce their
+own access and process rules.
 
 ## Scenario comparison
 
@@ -75,6 +105,6 @@ capture fields and are preserved in the result.
 Each aligned step reports changed, unchanged, or unknown. Changed and unknown
 action, screenshot, DOM, accessibility, URL, history, storage, and event
 artifacts carry their normalized before/after digests and capture states.
-`max_changes` bounds retained artifact records while total and omitted counts
-remain visible. Missing, truncated, or mismatched capture coverage remains
-unknown instead of being treated as equality.
+Every changed or unknown artifact record is returned inline for each aligned
+step. Missing, truncated, or mismatched capture coverage remains unknown
+instead of being treated as equality.

docs/controlled-javascript-replay.md

@@ -1,101 +0,0 @@
-# Controlled JavaScript replay
-
-`run_controlled_replay` executes only operator-selected extracted modules. It
-does not launch or drive the original application. Static inference, passive
-browser/Electron observation, isolated replay, and real application behavior
-remain different authorities.
-
-## Enable the ceiling
-
-Replay is disabled by default. Configure exact source roots before REA starts:
-
-```sh
-export REA_JAVASCRIPT_REPLAY_ENABLED=true
-export REA_JAVASCRIPT_REPLAY_ROOTS_JSON='["/absolute/extracted/modules"]'
-```
-
-The default trusted executables are the current Node.js runtime,
-`/usr/bin/bwrap`, `/usr/bin/systemd-run`, `/usr/bin/systemctl`, and
-`/usr/bin/bash`. Override them only with the corresponding
-`REA_JAVASCRIPT_REPLAY_*_PATH` variable. Configuration creates the
-administrator ceiling; it does not replace per-call approval. `rea doctor`
-reports disabled, available, and exact sandbox-probe failures without running
-module code. REA setup never installs these host components.
-
-## Plan, review, execute
-
-Call the same CLI command or MCP tool twice. The first request uses
-`mode: "plan"`. Its response commits module paths and digests, closed dependency
-aliases, cases, deterministic providers, runtime/backend identities, resource
-limits, no-network policy, private filesystems, and a `plan_digest`.
-Runtime commitments include the exact worker, seccomp filter, Node executable,
-ELF loader, and shared-library source/destination paths and SHA-256 digests.
-
-The execute request must repeat the same manifest and include:
-
-```json
-{
-  "mode": "execute",
-  "approved": true,
-  "plan_digest": "<exact digest returned by plan>"
-}
-```
-
-REA rebuilds the plan. Any changed module, stub, case, runtime, backend, limit,
-or export commitment returns `plan_stale` before worker admission.
-
-Modules use `esm` or `commonjs-factory`. The latter accepts extracted Rspack
-factory syntax such as `123(module, exports, require) { ... }` and implements
-the bounded `require.d`, `require.r`, `require.n`, and `require.nmd` helpers.
-Every import or require must map to a declared alias. There is no ambient
-package resolution.
-
-Explicit cases can be combined with deterministic `parser-boundaries`,
-`sanitizer-boundaries`, or `clipboard-boundaries` generation. Supplying a
-`right` manifest runs both sides with fresh realms per case and reports
-`equal`, `changed`, or `unknown` comparisons.
-
-## Boundary and Evidence
-
-The worker receives module bytes over bounded stdin and runs under a fresh
-Bubblewrap user/PID/network/IPC/UTS namespace, an architecture-checked seccomp
-filter, an empty mount root with a descriptor-backed read-only Node closure,
-private tmpfs, and a transient systemd user cgroup. Host and external network,
-host writes, process spawning, workers, native addons, inspector access, and
-ambient environment are unavailable. Wall time, memory, swap, tasks, CPU,
-case input, worker-protocol input, output, stderr, depth, and node counts are
-independently bounded. The parent also requires an exact worker response shape
-and authenticates every returned case ID, order, and input digest. Values are
-projected through own data descriptors only; Proxy values and accessors are
-rejected without invoking their traps or getters.
-
-Returns, exceptions, serialization failures, denials, timeouts, OOMs, crashes,
-protocol failures, and cleanup state are observations with provider
-`rea-javascript-replay` and authority `controlled-replay`. An observation does
-not prove that the original renderer, preload, main process, browser, or remote
-service behaved identically.
-
-Each left/right run is retained as its own `observed` source Evidence. A
-differential envelope is `derived` and links those source Evidence IDs, so the
-comparison never erases the underlying observations.
-
-Optional `reproducer_export` is committed by the plan and requires both
-`approved: true` inside that object and separate `evidence_write` authority.
-The owner-only manifest is written only after complete sandbox cleanup. Source
-bytes are excluded unless `include_sources: true` was explicitly approved.
-An export failure is retained in the result and does not erase a completed
-replay observation.
-
-## Local real-artifact verification
-
-`npm run verify:replay` uses source-owned parser and hostile fixtures. An
-operator can additionally supply a local ESM or Rspack/CommonJS-factory
-manifest without copying module source into the repository:
-
-```sh
-REA_REPLAY_INPUT_PATH=/absolute/replay-manifest.json npm run verify:replay
-```
-
-The verifier canonicalizes the manifest's module paths and prints only plan,
-module, and Evidence digests, case/comparison summaries, and cleanup state.
-This is the intended seam for local Notion-like parser/sanitizer benchmarks.

docs/electron-observation.md

@@ -1,59 +1,105 @@
 # Electron file-page observation
 
-REA can attach to a user-owned Electron/Chromium CDP endpoint and inspect existing `file://` renderer pages without evaluating JavaScript or invoking Electron APIs. Electron observation is separate from website observation because filesystem roots, not HTTP origins, define its authority.
+REA can attach to an Electron/Chromium CDP endpoint and inspect existing `file://` renderer pages without evaluating JavaScript or invoking Electron APIs. The request supplies the endpoint directly; REA accepts only literal-port loopback HTTP endpoints. Selecting an endpoint exposes every Electron target it serves, including local file paths and page metadata.
 
 This passive runtime surface is distinct from the target-free static
 [`analyze_javascript_application`](javascript-artifact-reconstruction.md)
-workflow. Static analysis reads an approved ASAR or extracted directory under
-`REA_INVESTIGATION_INPUT_ROOTS_JSON`; it does not attach to CDP. Runtime
-observations and static inferences are never silently treated as the same fact.
+workflow. Static analysis reads a local ASAR or extracted directory without
+executing application code. Passive observation inspects an existing Electron
+page. The results keep static inferences and runtime observations distinct.
 Use the separate
 [`reconcile_javascript_runtime`](javascript-runtime-reconciliation.md) workflow
 when both Evidence sets already exist.
 
-## Configure authority
+## Target boundary
 
-The capability is disabled by default:
-
-```bash
-export REA_ELECTRON_OBSERVE_ENABLED=true
-export REA_ELECTRON_CDP_ENDPOINTS_JSON='["http://127.0.0.1:9223"]'
-export REA_ELECTRON_FILE_ROOTS_JSON='["/Applications/Example.app/Contents/Resources"]'
-```
-
-Endpoints accept only explicit-port loopback HTTP URLs. Roots are canonicalized by the shared permission authority. Each target, frame, script, and resource is independently converted from a hostless `file://` URL to a real path and checked after symlink resolution. UNC hosts, percent-encoded path separators, nonexistent paths, and root escapes are rejected.
+The request supplies a literal-port loopback endpoint and, for inspection, a
+target ID. REA accepts local hostless `file://` URLs that resolve to regular
+files; remote hosts, encoded path separators, and nonexistent paths are
+rejected. The endpoint exposes every eligible target and its local path
+metadata.
 
 ## Workflow
 
+`list_electron_targets` returns every eligible target served by the supplied endpoint in one inline array.
+
+For the MCP follow-up call, pass the same literal-loopback endpoint and the selected target ID to `inspect_electron_page`. REA rediscovers targets and validates the ID against the live endpoint before inspection.
+
 ```bash
-rea list-electron-targets http://127.0.0.1:9223 --approved --json
+rea list-electron-targets http://127.0.0.1:9223 --json
 rea inspect-electron-page http://127.0.0.1:9223 TARGET_ID \
-  --approved --observation-ms 100 --json
+  --observation-ms 100 --json
 ```
 
-Script content is excluded by default. Capturing it requires both flags and remains subject to per-script and aggregate byte budgets:
+Script content is excluded by default. Setting `include_script_sources` in the
+request returns the selected target's script sources:
 
 ```bash
 rea inspect-electron-page http://127.0.0.1:9223 TARGET_ID \
-  --approved \
   --include-script-sources \
-  --source-capture-approved \
   --json
 ```
 
-The normalized result contains canonical local paths, bounded frame and DOM
+The normalized result contains canonical local paths, frame and DOM
 structure, resource metadata, stable script/resource identities, explicit
-completeness, and content-addressed approved source artifacts. Script metadata
+completeness, and content-addressed script artifacts. Script metadata
 retains its execution-context frame ID when CDP supplies one. The capture also
-inventories authorized worker, service-worker, and shared-worker targets with
-bounded opener-target and parent-frame IDs. Worker discovery uses passive
+inventories worker, service-worker, and shared-worker targets with
+validated opener-target and parent-frame IDs. Worker discovery uses passive
 target metadata; REA does not attach to or execute code in those targets.
-
-The default worker limit is 500 and the caller-visible maximum is 5,000. Like
-every target, frame, script, and resource, a worker URL must resolve beneath an
-approved canonical root before it is retained. Relationship IDs improve
+Collection counts and aggregate script-source bytes are not capped. Like every
+target, frame, script, and resource, a worker URL must resolve to a local
+file before it is retained. Relationship IDs improve
 attribution but do not prove which static module started a worker or that its
 work completed.
 
 Inspection does not retain DOM values, execute renderer code, navigate, click,
 invoke Electron IPC, close a target, or terminate the application.
+
+## Active Electron scenarios
+
+The scenario request supplies the Electron executable and application entry
+point, plus any arguments and actions. The application root defaults to the
+entry point's parent directory and can be supplied when the app uses a different
+root. REA launches that executable through
+the official Playwright Electron API and owns its lifetime. It accepts click/wait actions,
+window-targeted renderer reload/crash actions, and synthetic `open-url` or
+`second-instance` deep-link delivery. It records capture-scoped window and
+WebContents identities, process metrics, and IPC channel and value-shape metadata.
+Payload values are not retained.
+
+Run the real fixture verifier with an operator-provided Electron runtime:
+
+```bash
+REA_ELECTRON_EXECUTABLE=/absolute/path/to/electron npm run verify:electron
+```
+
+This operation actively launches and interacts with the selected target. It is
+not a passive CDP observation. The owned process keeps normal host filesystem
+and network privileges, so lifecycle ownership does not make it a sandbox.
+
+The CLI and MCP surfaces accept the same schema. For a JSON request file:
+
+```bash
+rea capture-electron-scenario scenario.json --json
+```
+
+The result records action status and targets, correlated app/window/WebContents,
+preload, session, navigation, shell, permission, popup, download, protocol,
+native-addon, process, and IPC timeline events. IPC channels are capped at
+1,024 characters and argument-shape metadata at 32 entries; values are never
+retained. Renderer crash/restart and deep-link actions are synthetic
+scenario controls; their attempted and observed outcomes remain in the
+timeline. The active hook blocks and records external shell/navigation,
+permission, download, popup, updater, and OS-integration effects. The timeline
+is explicitly partial when attachment starts after application activity. The
+owned experiment has an internal 60-second deadline and a 5-second per-action
+timeout so hung work reaches process cleanup; these are lifecycle timeouts, not
+caller-selected capture limits.
+
+Active Electron Evidence can also be supplied to
+[`reconcile_javascript_runtime`](javascript-runtime-reconciliation.md). That
+projection is intentionally target-only and partial: it binds the selected
+application path and capture outcome to the static graph, while frames, scripts,
+workers, and execution claims remain unavailable until a separate passive runtime
+capture provides them.

docs/error-contract.schema.json

@@ -9,7 +9,6 @@
           "type": "string",
           "enum": [
             "invalid_input",
-            "permission_required",
             "unsupported_provider",
             "integrity_mismatch",
             "truncated",
@@ -23,12 +22,8 @@
         "retryable": { "type": "boolean" },
         "remediation": {
           "type": "object",
-          "properties": {
-            "action": { "type": "string", "minLength": 1 },
-            "restart_required": { "type": "boolean" },
-            "elicitation_supported": { "type": "boolean" }
-          },
-          "required": ["action", "restart_required"],
+          "properties": { "action": { "type": "string", "minLength": 1 } },
+          "required": ["action"],
           "additionalProperties": false
         },
         "details": {
@@ -48,7 +43,6 @@
           "type": "string",
           "enum": [
             "invalid_input",
-            "permission_required",
             "unsupported_provider",
             "integrity_mismatch",
             "truncated",
@@ -62,12 +56,8 @@
         "retryable": { "type": "boolean" },
         "remediation": {
           "type": "object",
-          "properties": {
-            "action": { "type": "string", "minLength": 1 },
-            "restart_required": { "type": "boolean" },
-            "elicitation_supported": { "type": "boolean" }
-          },
-          "required": ["action", "restart_required"],
+          "properties": { "action": { "type": "string", "minLength": 1 } },
+          "required": ["action"],
           "additionalProperties": false
         },
         "details": {
@@ -87,7 +77,6 @@
           "type": "string",
           "enum": [
             "invalid_input",
-            "permission_required",
             "unsupported_provider",
             "integrity_mismatch",
             "truncated",
@@ -101,12 +90,8 @@
         "retryable": { "type": "boolean" },
         "remediation": {
           "type": "object",
-          "properties": {
-            "action": { "type": "string", "minLength": 1 },
-            "restart_required": { "type": "boolean" },
-            "elicitation_supported": { "type": "boolean" }
-          },
-          "required": ["action", "restart_required"],
+          "properties": { "action": { "type": "string", "minLength": 1 } },
+          "required": ["action"],
           "additionalProperties": false
         },
         "details": {
@@ -126,7 +111,6 @@
           "type": "string",
           "enum": [
             "invalid_input",
-            "permission_required",
             "unsupported_provider",
             "integrity_mismatch",
             "truncated",
@@ -140,12 +124,8 @@
         "retryable": { "type": "boolean" },
         "remediation": {
           "type": "object",
-          "properties": {
-            "action": { "type": "string", "minLength": 1 },
-            "restart_required": { "type": "boolean" },
-            "elicitation_supported": { "type": "boolean" }
-          },
-          "required": ["action", "restart_required"],
+          "properties": { "action": { "type": "string", "minLength": 1 } },
+          "required": ["action"],
           "additionalProperties": false
         },
         "details": {
@@ -165,7 +145,6 @@
           "type": "string",
           "enum": [
             "invalid_input",
-            "permission_required",
             "unsupported_provider",
             "integrity_mismatch",
             "truncated",
@@ -179,12 +158,8 @@
         "retryable": { "type": "boolean" },
         "remediation": {
           "type": "object",
-          "properties": {
-            "action": { "type": "string", "minLength": 1 },
-            "restart_required": { "type": "boolean" },
-            "elicitation_supported": { "type": "boolean" }
-          },
-          "required": ["action", "restart_required"],
+          "properties": { "action": { "type": "string", "minLength": 1 } },
+          "required": ["action"],
           "additionalProperties": false
         },
         "details": {
@@ -204,7 +179,6 @@
           "type": "string",
           "enum": [
             "invalid_input",
-            "permission_required",
             "unsupported_provider",
             "integrity_mismatch",
             "truncated",
@@ -218,12 +192,8 @@
         "retryable": { "type": "boolean" },
         "remediation": {
           "type": "object",
-          "properties": {
-            "action": { "type": "string", "minLength": 1 },
-            "restart_required": { "type": "boolean" },
-            "elicitation_supported": { "type": "boolean" }
-          },
-          "required": ["action", "restart_required"],
+          "properties": { "action": { "type": "string", "minLength": 1 } },
+          "required": ["action"],
           "additionalProperties": false
         },
         "details": {
@@ -243,7 +213,6 @@
           "type": "string",
           "enum": [
             "invalid_input",
-            "permission_required",
             "unsupported_provider",
             "integrity_mismatch",
             "truncated",
@@ -257,12 +226,8 @@
         "retryable": { "type": "boolean" },
         "remediation": {
           "type": "object",
-          "properties": {
-            "action": { "type": "string", "minLength": 1 },
-            "restart_required": { "type": "boolean" },
-            "elicitation_supported": { "type": "boolean" }
-          },
-          "required": ["action", "restart_required"],
+          "properties": { "action": { "type": "string", "minLength": 1 } },
+          "required": ["action"],
           "additionalProperties": false
         },
         "details": {
@@ -304,7 +269,6 @@
           "type": "string",
           "enum": [
             "invalid_input",
-            "permission_required",
             "unsupported_provider",
             "integrity_mismatch",
             "truncated",
@@ -318,12 +282,8 @@
         "retryable": { "type": "boolean" },
         "remediation": {
           "type": "object",
-          "properties": {
-            "action": { "type": "string", "minLength": 1 },
-            "restart_required": { "type": "boolean" },
-            "elicitation_supported": { "type": "boolean" }
-          },
-          "required": ["action", "restart_required"],
+          "properties": { "action": { "type": "string", "minLength": 1 } },
+          "required": ["action"],
           "additionalProperties": false
         },
         "details": {
@@ -343,7 +303,6 @@
           "type": "string",
           "enum": [
             "invalid_input",
-            "permission_required",
             "unsupported_provider",
             "integrity_mismatch",
             "truncated",
@@ -357,12 +316,8 @@
         "retryable": { "type": "boolean" },
         "remediation": {
           "type": "object",
-          "properties": {
-            "action": { "type": "string", "minLength": 1 },
-            "restart_required": { "type": "boolean" },
-            "elicitation_supported": { "type": "boolean" }
-          },
-          "required": ["action", "restart_required"],
+          "properties": { "action": { "type": "string", "minLength": 1 } },
+          "required": ["action"],
           "additionalProperties": false
         },
         "details": {
@@ -382,7 +337,6 @@
           "type": "string",
           "enum": [
             "invalid_input",
-            "permission_required",
             "unsupported_provider",
             "integrity_mismatch",
             "truncated",
@@ -396,12 +350,8 @@
         "retryable": { "type": "boolean" },
         "remediation": {
           "type": "object",
-          "properties": {
-            "action": { "type": "string", "minLength": 1 },
-            "restart_required": { "type": "boolean" },
-            "elicitation_supported": { "type": "boolean" }
-          },
-          "required": ["action", "restart_required"],
+          "properties": { "action": { "type": "string", "minLength": 1 } },
+          "required": ["action"],
           "additionalProperties": false
         },
         "details": {
@@ -413,137 +363,6 @@
       "required": ["code", "category", "message", "retryable", "remediation"],
       "additionalProperties": false
     },
-    {
-      "type": "object",
-      "properties": {
-        "code": { "type": "string", "const": "permission_required" },
-        "category": {
-          "type": "string",
-          "enum": [
-            "invalid_input",
-            "permission_required",
-            "unsupported_provider",
-            "integrity_mismatch",
-            "truncated",
-            "cancelled",
-            "timeout",
-            "unavailable",
-            "execution_failure"
-          ]
-        },
-        "message": { "type": "string", "minLength": 1 },
-        "retryable": { "type": "boolean" },
-        "remediation": {
-          "type": "object",
-          "properties": {
-            "action": { "type": "string", "minLength": 1 },
-            "restart_required": { "type": "boolean" },
-            "elicitation_supported": { "type": "boolean" }
-          },
-          "required": ["action", "restart_required"],
-          "additionalProperties": false
-        },
-        "details": {
-          "type": "object",
-          "properties": {
-            "capability": { "type": "string" },
-            "requested": {
-              "type": "object",
-              "properties": {
-                "capability": { "type": "string" },
-                "roots": { "type": "array", "items": { "type": "string" } },
-                "executables": {
-                  "type": "array",
-                  "items": { "type": "string" }
-                },
-                "environment_names": {
-                  "type": "array",
-                  "items": { "type": "string" }
-                },
-                "origins": { "type": "array", "items": { "type": "string" } },
-                "network": {
-                  "type": "string",
-                  "enum": ["none", "loopback", "external"]
-                },
-                "mount": { "type": "boolean" }
-              },
-              "required": [
-                "capability",
-                "roots",
-                "executables",
-                "environment_names",
-                "network",
-                "mount"
-              ],
-              "additionalProperties": false
-            },
-            "missing": {
-              "type": "object",
-              "properties": {
-                "roots": { "type": "array", "items": { "type": "string" } },
-                "executables": {
-                  "type": "array",
-                  "items": { "type": "string" }
-                },
-                "environment_names": {
-                  "type": "array",
-                  "items": { "type": "string" }
-                },
-                "origins": { "type": "array", "items": { "type": "string" } },
-                "network": {
-                  "type": "string",
-                  "enum": ["none", "loopback", "external"]
-                },
-                "mount": { "type": "boolean", "const": true }
-              },
-              "additionalProperties": false
-            },
-            "ceiling": {
-              "anyOf": [
-                {
-                  "type": "object",
-                  "properties": {
-                    "capability": { "type": "string" },
-                    "roots": { "type": "array", "items": { "type": "string" } },
-                    "executables": {
-                      "type": "array",
-                      "items": { "type": "string" }
-                    },
-                    "environment_names": {
-                      "type": "array",
-                      "items": { "type": "string" }
-                    },
-                    "origins": {
-                      "type": "array",
-                      "items": { "type": "string" }
-                    },
-                    "network": {
-                      "type": "string",
-                      "enum": ["none", "loopback", "external"]
-                    },
-                    "mount": { "type": "boolean" }
-                  },
-                  "required": [
-                    "capability",
-                    "roots",
-                    "executables",
-                    "environment_names",
-                    "network",
-                    "mount"
-                  ],
-                  "additionalProperties": false
-                },
-                { "type": "null" }
-              ]
-            }
-          },
-          "required": ["capability", "requested", "missing", "ceiling"],
-          "additionalProperties": false
-        }
-      },
-      "required": ["code", "category", "message", "retryable", "remediation"],
-      "additionalProperties": false
-    },
     {
       "type": "object",
       "properties": {
@@ -552,7 +371,6 @@
           "type": "string",
           "enum": [
             "invalid_input",
-            "permission_required",
             "unsupported_provider",
             "integrity_mismatch",
             "truncated",
@@ -566,12 +384,8 @@
         "retryable": { "type": "boolean" },
         "remediation": {
           "type": "object",
-          "properties": {
-            "action": { "type": "string", "minLength": 1 },
-            "restart_required": { "type": "boolean" },
-            "elicitation_supported": { "type": "boolean" }
-          },
-          "required": ["action", "restart_required"],
+          "properties": { "action": { "type": "string", "minLength": 1 } },
+          "required": ["action"],
           "additionalProperties": false
         },
         "details": {
@@ -591,7 +405,6 @@
           "type": "string",
           "enum": [
             "invalid_input",
-            "permission_required",
             "unsupported_provider",
             "integrity_mismatch",
             "truncated",
@@ -605,12 +418,8 @@
         "retryable": { "type": "boolean" },
         "remediation": {
           "type": "object",
-          "properties": {
-            "action": { "type": "string", "minLength": 1 },
-            "restart_required": { "type": "boolean" },
-            "elicitation_supported": { "type": "boolean" }
-          },
-          "required": ["action", "restart_required"],
+          "properties": { "action": { "type": "string", "minLength": 1 } },
+          "required": ["action"],
           "additionalProperties": false
         },
         "details": {
@@ -630,7 +439,6 @@
           "type": "string",
           "enum": [
             "invalid_input",
-            "permission_required",
             "unsupported_provider",
             "integrity_mismatch",
             "truncated",
@@ -644,51 +452,8 @@
         "retryable": { "type": "boolean" },
         "remediation": {
           "type": "object",
-          "properties": {
-            "action": { "type": "string", "minLength": 1 },
-            "restart_required": { "type": "boolean" },
-            "elicitation_supported": { "type": "boolean" }
-          },
-          "required": ["action", "restart_required"],
-          "additionalProperties": false
-        },
-        "details": {
-          "type": "object",
-          "propertyNames": { "type": "string" },
-          "additionalProperties": { "$ref": "#/$defs/__schema0" }
-        }
-      },
-      "required": ["code", "category", "message", "retryable", "remediation"],
-      "additionalProperties": false
-    },
-    {
-      "type": "object",
-      "properties": {
-        "code": { "type": "string", "const": "outside_approved_root" },
-        "category": {
-          "type": "string",
-          "enum": [
-            "invalid_input",
-            "permission_required",
-            "unsupported_provider",
-            "integrity_mismatch",
-            "truncated",
-            "cancelled",
-            "timeout",
-            "unavailable",
-            "execution_failure"
-          ]
-        },
-        "message": { "type": "string", "minLength": 1 },
-        "retryable": { "type": "boolean" },
-        "remediation": {
-          "type": "object",
-          "properties": {
-            "action": { "type": "string", "minLength": 1 },
-            "restart_required": { "type": "boolean" },
-            "elicitation_supported": { "type": "boolean" }
-          },
-          "required": ["action", "restart_required"],
+          "properties": { "action": { "type": "string", "minLength": 1 } },
+          "required": ["action"],
           "additionalProperties": false
         },
         "details": {
@@ -708,7 +473,6 @@
           "type": "string",
           "enum": [
             "invalid_input",
-            "permission_required",
             "unsupported_provider",
             "integrity_mismatch",
             "truncated",
@@ -722,12 +486,8 @@
         "retryable": { "type": "boolean" },
         "remediation": {
           "type": "object",
-          "properties": {
-            "action": { "type": "string", "minLength": 1 },
-            "restart_required": { "type": "boolean" },
-            "elicitation_supported": { "type": "boolean" }
-          },
-          "required": ["action", "restart_required"],
+          "properties": { "action": { "type": "string", "minLength": 1 } },
+          "required": ["action"],
           "additionalProperties": false
         },
         "details": {
@@ -747,7 +507,6 @@
           "type": "string",
           "enum": [
             "invalid_input",
-            "permission_required",
             "unsupported_provider",
             "integrity_mismatch",
             "truncated",
@@ -761,12 +520,8 @@
         "retryable": { "type": "boolean" },
         "remediation": {
           "type": "object",
-          "properties": {
-            "action": { "type": "string", "minLength": 1 },
-            "restart_required": { "type": "boolean" },
-            "elicitation_supported": { "type": "boolean" }
-          },
-          "required": ["action", "restart_required"],
+          "properties": { "action": { "type": "string", "minLength": 1 } },
+          "required": ["action"],
           "additionalProperties": false
         },
         "details": {
@@ -786,7 +541,6 @@
           "type": "string",
           "enum": [
             "invalid_input",
-            "permission_required",
             "unsupported_provider",
             "integrity_mismatch",
             "truncated",
@@ -800,51 +554,8 @@
         "retryable": { "type": "boolean" },
         "remediation": {
           "type": "object",
-          "properties": {
-            "action": { "type": "string", "minLength": 1 },
-            "restart_required": { "type": "boolean" },
-            "elicitation_supported": { "type": "boolean" }
-          },
-          "required": ["action", "restart_required"],
-          "additionalProperties": false
-        },
-        "details": {
-          "type": "object",
-          "propertyNames": { "type": "string" },
-          "additionalProperties": { "$ref": "#/$defs/__schema0" }
-        }
-      },
-      "required": ["code", "category", "message", "retryable", "remediation"],
-      "additionalProperties": false
-    },
-    {
-      "type": "object",
-      "properties": {
-        "code": { "type": "string", "const": "plan_stale" },
-        "category": {
-          "type": "string",
-          "enum": [
-            "invalid_input",
-            "permission_required",
-            "unsupported_provider",
-            "integrity_mismatch",
-            "truncated",
-            "cancelled",
-            "timeout",
-            "unavailable",
-            "execution_failure"
-          ]
-        },
-        "message": { "type": "string", "minLength": 1 },
-        "retryable": { "type": "boolean" },
-        "remediation": {
-          "type": "object",
-          "properties": {
-            "action": { "type": "string", "minLength": 1 },
-            "restart_required": { "type": "boolean" },
-            "elicitation_supported": { "type": "boolean" }
-          },
-          "required": ["action", "restart_required"],
+          "properties": { "action": { "type": "string", "minLength": 1 } },
+          "required": ["action"],
           "additionalProperties": false
         },
         "details": {

docs/ghidra-dos.md

@@ -0,0 +1,188 @@
+# DOS MZ and COM analysis with Ghidra
+
+REA can analyze DOS MZ executables and explicitly selected COM images through the bring-your-own Ghidra adapter.
+The Linux x64 verification lane exercises actual 16-bit disassembly and
+decompilation through the CLI and stdio MCP. It requires the same Ghidra
+12.1.4 and 64-bit JDK 21 installation as other Ghidra sessions; no DOS emulator
+or cross-compiler is required.
+
+## Open and inspect
+
+```bash
+rea inspect /absolute/path/to/legacy.exe --provider ghidra --json
+rea search /absolute/path/to/legacy.exe entry --kind procedures --provider ghidra --json
+rea instructions /absolute/path/to/legacy.exe entry --provider ghidra --json
+rea function /absolute/path/to/legacy.exe entry --provider ghidra --json
+rea inspect-native-load-image /absolute/path/to/legacy.exe --provider ghidra --json
+rea read-bytes /absolute/path/to/legacy.exe 0x10000 --length 16 --provider ghidra --json
+rea address-to-file-offset /absolute/path/to/legacy.exe 0x10000 --provider ghidra --json
+```
+
+Use an observed procedure name or address from discovery when the target does
+not name its entry function `entry`. MCP uses `open_binary`, `list_procedures`,
+`procedure_info`, `read_function_instructions`, and `analyze_function` with the
+same admitted target and provider semantics.
+
+The classifier validates MZ page counts, initialized module length, header and
+relocation-table bounds, relocation destinations, and the initialized entry
+point. It distinguishes DOS load-module and relocation bytes from the Windows
+new-header field. PE remains PE; NE, LE, and LX declarations are explicitly
+unsupported. A damaged declared Windows header does not silently become DOS.
+Inventory classification returns `unknown` when its bounded prefix cannot
+establish the format; this is distinct from the complete target admission check.
+
+Ghidra imports a private target snapshot with `MzLoader`, language
+`x86:LE:16:Real Mode`, and compiler specification `default`. These settings,
+the fixed Ghidra load segment `0x1000`, and the linear address convention are
+committed in the analysis profile. The handshake rejects language or compiler
+drift. Closing the session deletes the temporary project and snapshot.
+
+The profile also commits `function_body_evidence: complete-inclusive-ranges-v1`,
+so snapshots from older length-only Ghidra results do not satisfy the current
+profile.
+
+## Headerless COM images
+
+COM has no identifying header. Select its interpretation explicitly; neither the
+`.com` suffix nor arbitrary unrecognized bytes are enough to admit it.
+
+```bash
+rea inspect /absolute/path/to/legacy.com --target-format dos-com --provider ghidra --json
+rea function /absolute/path/to/legacy.com 0x10100 --target-format dos-com --provider ghidra --json
+rea inspect-native-load-image /absolute/path/to/legacy.com --target-format dos-com --provider ghidra --json
+```
+
+```json
+{
+  "name": "open_binary",
+  "arguments": {
+    "path": "/absolute/path/to/legacy.com",
+    "format": "dos-com",
+    "provider_id": "ghidra"
+  }
+}
+```
+
+The caller's interpretation applies to the complete file, even if its filename
+suggests another format. Files must contain 1..65280 bytes: the 64 KiB COM segment
+minus the 256-byte PSP prefix. Ghidra uses `BinaryLoader` with real-mode language
+and maps file offset zero at `1000:0100` (linear `0x10100`). A packaged pre-analysis
+script seeds the entry function and CS/DS/ES/SS context `0x1000`. These settings
+and the preparation policy are committed in the analysis profile; a failed
+preparation prevents the resident bridge from serving results.
+
+Load-image verification checks all original and modified file bytes, complete
+source mapping/memory digests, absence of relocations, entry and measured register
+context. The context is imposed for analysis, not observed from execution. PSP
+memory, initial stack contents/SP, DOS interrupts and PC-98 devices are not
+modeled. COM has no MZ header, relocation table or appended-overlay model; all
+selected bytes belong to its analysis module. The original file stays unchanged.
+
+## Addresses and function extent
+
+Returned default-space addresses are linear byte coordinates. A Ghidra
+segment:offset address has linear value `segment * 16 + offset`; multiple
+segment aliases can identify the same byte. REA accepts the returned linear
+address for subsequent lookups and leaves instruction decoding context with
+Ghidra. These coordinates are analysis load addresses, not file offsets or
+observations of a running DOS system.
+
+`procedure_info` and function dossiers include `body` evidence:
+
+```json
+{
+  "available": true,
+  "provenance": "ghidra-function-body-address-set",
+  "ranges": [
+    { "start": "0x10000", "end": "0x1000d" },
+    { "start": "0x10060", "end": "0x10065" }
+  ],
+  "total_bytes": 20,
+  "span_bytes": 102,
+  "non_contiguous": true,
+  "contains_entry": true
+}
+```
+
+Each end is **inclusive**. `total_bytes` counts the complete observed
+AddressSet; `span_bytes` measures its enclosing span and is null across address
+spaces. Gaps and shared tails must not be treated as owned bytes. This is
+Ghidra's database observation, not a proof of original source ownership or
+exhaustive code discovery. Providers that do not report complete ranges return
+`available: false` and an explicit reason.
+
+## Loaded-image evidence
+
+`inspect_native_load_image` independently checks the immutable session snapshot
+against the loaded Ghidra Program. It measures complete original and modified
+FileBytes digests, every source mapping and its memory digest, relocation records
+(including multiplicity), and external entry points. It verifies MZ header and
+module partitions, relocation fixups and linear coordinates rather than relying
+on the imported executable SHA alone.
+
+The result is `verified`, `mismatch`, or `unsupported`. Every check retains its
+expected and observed values. A memory-digest mismatch identifies the source
+range's file offset and analysis address; it does not locate the first differing
+byte inside that range. Mapping ends are **inclusive**, unlike the exclusive ends
+from `list_segments`. Appended overlays remain in source-file identity and are
+excluded from initialized module coverage. Uninitialized allocations are reported;
+their contents and DOS runtime semantics are not verified. Formats other than MZ and explicit COM return
+`unsupported` with measured observations, not a successful MZ verification.
+
+`read_bytes` returns initialized provider memory, including loader fixups; an
+unmapped or uninitialized byte ends the read with an explicit returned length and
+`complete: false`. `address_to_file_offset` uses the provider's source mapping;
+unmapped, uninitialized and ambiguous mappings fail explicitly. A relocated word
+can differ from the original file word even when its source offset is known.
+
+## Coverage boundaries
+
+Static decompilation does not execute the target or emulate BIOS, DOS
+interrupts, device ports, or self-modifying code. PC-98 hardware behavior and
+recovered calling conventions can remain uncertain; provider pseudocode and
+diagnostics are retained for analyst review.
+
+For a packed executable, importing the original can analyze its unpacking
+stub. Analyze a separately prepared unpacked copy to inspect the original
+program's recovered code. Retain both artifact digests and the transformation
+evidence; REA never silently replaces the admitted target. Appended overlays
+are separate from the initialized MZ module. Raw COM files and DOS extenders
+without an admitted MZ real-mode entry are outside this import boundary.
+
+DOS MZ is available through Ghidra, with no Hopper support claim. It is outside
+the Windows native PE P0 boundary. macOS DOS verification remains unverified.
+
+## Real verification
+
+```bash
+npm run verify:ghidra:dos
+```
+
+The lane generates a small public fixture from source at runtime. It verifies
+16-bit instruction bytes, a near call, a segment-relocated far call, actual
+decompilation, disjoint function ranges, stable CLI/MCP observations, unchanged
+input bytes, and session/process cleanup. It does not require external
+executable fixtures, an emulator, or an existing analysis database.
+
+Provider p-code representations can contain process-specific address-space selector
+tokens. The lane preserves those reported values and compares stable dossier
+observations rather than asserting cross-process identity of raw p-code.
+
+## Function annotations
+
+`annotate_native_function` changes the name and/or comments at one exact local function entry, verifies readback, and returns a refreshed dossier. This is useful when recording recovered DOS function roles; it does not claim original-source names. Name writes preserve the existing namespace; readback returns the fully qualified name used by function inventories. Regular comments map to Ghidra PRE comments and inline comments to EOL comments. Empty text clears a comment; omitted fields preserve it. The whole edit rolls back if a setter, readback or analysis fails.
+
+```json
+{
+  "procedure": "0x10100",
+  "name": "entry",
+  "comment": "Recovered startup role",
+  "inline_comment": "Inspect segment setup"
+}
+```
+
+```bash
+rea annotate-native-function /local/program.com 0x10100 --target-format dos-com --provider ghidra --name entry --comment 'Recovered startup role' --json
+```
+
+The CLI returns the updated analysis before closing its isolated session. MCP edits remain visible to later reads until `close_binary`. Original bytes remain unchanged, database edits are discarded on close, and immutable analysis snapshots are invalidated after edits. This operation does not save a Ghidra project, change ABI/types/body ranges, patch instructions, or emulate a DOS runtime. Windows P0 does not admit it.

docs/installation.md

@@ -4,24 +4,27 @@ REA separates installing its CLI from configuring external software and agents.
 
 ## Start setup
 
-The recommended setup entrypoint is:
+Start setup with:
 
 ```bash
 npx rea-agents setup
 ```
 
-If npm asks to download and run the package, that approval applies only to the
-current package-runner invocation. REA still prints its own setup plan and asks
-for separate approval before changing agent configuration or installing a
-product-owned component.
+If npm asks to download and run REA, that approval applies only to downloading
+the package. REA shows its own plan and asks before changing agent configuration
+or installing Hopper.
 
-When bare `npx` resolves `rea-agents` from the current project's
-`node_modules`, the selected dispatcher restarts setup through
-`rea-agents@latest` before REA plans or writes configuration. This protects
-current and future releases from silently persisting stale integration state.
-Code in an already-published older release cannot acquire that check
-retroactively; invoke `npx -y rea-agents@latest setup` once to repair any
-registration it created.
+The short command can use a REA version installed in the current project. To
+request the latest release explicitly, use:
+
+```bash
+npx rea-agents@latest setup
+```
+
+REA runs the version npm selects. To update older agent registrations, run the
+latest-version command and review its setup plan. For unattended package
+downloads, add `--yes` before the package name; this does not approve REA's
+setup changes.
 
 For an intentional rollback, make the package request explicit:
 
@@ -33,12 +36,12 @@ Setup continues to pin persistent MCP registrations to the exact version that
 performed setup. Running current setup later migrates unversioned or older
 managed registrations through the normal reviewed setup transaction.
 
-REA supports Node.js 22.19+ and 24.11+ (including newer releases). It uses the npm already paired with that runtime and never upgrades Node.js, npm, or Homebrew.
+REA supports Node.js 22.x (>=22.19), 24.x (>=24.11), and 26+. Node.js 23, 25, and prereleases are unsupported. It uses the npm already paired with that runtime and never upgrades Node.js, npm, or Homebrew.
 
 Running `npm install rea-agents` without `--global` installs the executable only
 in the current project's `node_modules/.bin`; it does not make `rea` available
-on the shell `PATH`. Use `npx rea-agents setup` for the guided setup journey,
-`npx -y rea-agents@latest` for unattended one-off commands, or install globally
+on the shell `PATH`. Use the setup command above for the guided setup
+journey, `npx -y rea-agents@latest` for unattended one-off commands, or install globally
 with `npm install --global rea-agents` for a shell-visible `rea` command.
 
 The optional curl wrapper installs only the global npm package:
@@ -58,60 +61,65 @@ curl -fsSL https://raw.githubusercontent.com/morluto/rea/main/install.sh |
 
 Supported options are `--version <semver>`, `--dry-run`, `--no-setup`, `--no-prompt`, and `--verbose`. Neither `--no-prompt` nor a non-interactive shell grants permission to install external dependencies.
 
+## Supported agents
+
+Setup can configure these clients for REA's local MCP server:
+
+| Client             | `--client` value |
+| ------------------ | ---------------- |
+| Claude Code        | `claude_code`    |
+| Claude Desktop     | `claude_desktop` |
+| Codex              | `codex`          |
+| Cursor             | `cursor`         |
+| Gemini CLI         | `gemini_cli`     |
+| Windsurf           | `windsurf`       |
+| Devin              | `devin`          |
+| OpenCode           | `opencode`       |
+| Antigravity        | `antigravity`    |
+| GitHub Copilot CLI | `copilot_cli`    |
+| Command Code       | `commandcode`    |
+| VS Code            | `vscode`         |
+
 ## Review setup changes
 
-`rea setup` uses an inline, scroll-preserving journey inspired by the clarity of
-PostHog's CLI wizard. It begins with the outcome instead of the installer
-mechanics:
+`rea setup` first offers the supported agents in a multi-select. Existing REA
+registrations are selected by default. Newly detected clients remain available
+but unselected: detection gives setup context, not permission to add a new
+registration. Clients without a detected configuration can still be selected.
+Explicit `--client` flags skip this question.
 
-- investigate local applications from a supported agent;
-- recover evidence through an available deep-analysis provider;
-- use the bundled skill for a repeatable investigation workflow.
+Setup adds MCP access for selected clients. It installs REA's bundled workflow
+with those integrations by default; use `--skill=false` to omit it. If no agent
+is selected, setup offers the workflow separately for CLI use, with No as the
+default. Hopper is a separate optional choice: setup shows its proposed
+installation or connection and requires its own explicit approval. It can also
+save verified paths for an existing Ghidra installation.
 
-REA then summarizes the detected clients and asks which capabilities to set up.
-The capability picker pre-selects `Agent integration` (the MCP registration and
-matching guided workflow together) when detected agents exist, and presents the
-optional Hopper provider alongside it. Selecting agent integration opens a second
-checklist for the exact detected agents that should receive a registration; all
-detected agents are pre-selected. Detection provides context and pre-selection;
-it does not authorize a configuration write until the user confirms.
+After selection, review the plan's exact paths and changes and approve before
+REA writes files or installs Hopper. You can cancel at any prompt.
 
-Because the user has explicitly invoked `rea setup`, the wizard biases toward the
-happy path: capabilities and agents are pre-selected, and the final approval
-defaults to **Yes**. The user can still deselect any item or cancel at any prompt.
-Choosing no capabilities exits without changes. Selecting agent integration
-always includes the bundled skill, even if all agents are deselected. The picker
-keeps its navigation, selection, confirmation, and cancellation keys visible
-instead of relying on a transient hint.
+Before applying changes, REA checks your current configuration. The plan lists:
 
-Every selected path converges on the same exact preflight. REA validates the
-current state, prints the proposed effects, and asks for final approval with
-**Yes** as the default. Selection alone never authorizes a mutation. The plan
-identifies:
-
-- an existing Hopper installation, a validated bring-your-own Ghidra environment, or the official Hopper package it proposes to install;
+- an existing Hopper installation, a verified existing Ghidra installation, or the official Hopper package it proposes to install;
 - each detected agent configuration path;
 - the REA skill destination;
 - external software, network origins, integrity evidence, and package-manager
   commands.
 
 Malformed or unsafe existing configuration blocks the whole transaction before
-Hopper installation or any file write. Declining, pressing Ctrl-C, or selecting
-nothing makes no changes. Agent configuration writes preserve unrelated
+Hopper installation or any file write. Declining or pressing Ctrl-C makes no
+changes. Agent configuration writes preserve unrelated
 entries, create backups, use atomic replacement, and verify their result.
 
-Progress remains append-only so completed and failed operations stay visible in
-terminal history. After a successful run, the completion message names the
-verified capabilities now available—for example configured MCP clients, the
-selected analysis provider, and the installed skill—and gives the corresponding
-next action. When an agent must restart to load its registration, REA says so;
-otherwise it suggests beginning an investigation. It does not advertise a
-capability that the final diagnostic check did not verify.
+After setup, REA reports which agents, analysis tools, and workflow files passed
+its final checks. Restart any agent named in the completion message, then begin
+your investigation. Failed steps and diagnostics remain in terminal history.
 
-Select exact clients in scripts with repeatable `--client` flags, or retain
-automatic discovery explicitly with `--all-detected`. Use `--skill=false` to
-override the normal bundled-skill installation and `--dry-run` for a read-only
-plan:
+Select exact clients in scripts with repeatable `--client` flags. Each explicit
+client skips interactive selection. Use `--all-detected` only when you intend
+to configure every detected supported client. `--skill=false` omits the
+workflow, and `--dry-run` returns a read-only plan with status `planned` and
+exit code 0:
 
 ```bash
 rea setup --client codex --client cursor --skill=false --dry-run
@@ -119,13 +127,20 @@ rea setup --client codex --client cursor --skill=false --dry-run
 
 Prompt UI and progress are written to stderr so stdout remains available for
 structured results and pipelines. `NO_COLOR=1` disables color. Use
-`--accessible` for sequential, vertically rendered yes/no prompts.
+`--accessible` for sequential, vertically rendered yes/no prompts. Implicit
+interactive setup requires stdin, stdout, and stderr to all be terminals; when
+any stream is redirected, setup stays non-interactive. Declining or cancelling
+returns status `cancelled` with exit code 0.
 
-For automation, `rea setup --json` reports the plan without applying it.
-Prefer pairing `--yes` with explicit scope such as `--client codex`,
-or `--all-detected`. Legacy unscoped `--yes` remains compatible for
-this release but emits a deprecation warning. Installing missing Hopper
-non-interactively additionally requires `--install-hopper`:
+For automation, `rea setup --json` reports the plan and a compact `.doctor`
+readiness projection without applying it. Use `rea doctor --json` for full
+health diagnostics and canonical tool catalog details. Pair
+`--yes` with explicit scope such as `--client codex`, or use
+`--all-detected` when the broad scope is intended. Without a scope flag,
+`--yes` is limited to existing REA-owned registrations; it does not select all
+detected clients. An unapproved actual apply reports `needs_confirmation` and
+exits 1. Installing missing Hopper non-interactively additionally requires
+`--install-hopper`:
 
 ```bash
 rea setup --yes --all-detected --install-hopper --json
@@ -133,11 +148,14 @@ rea setup --yes --all-detected --install-hopper --json
 
 Setup pins package-runner MCP registrations to the exact installed REA version,
 installs the matching skill and on-demand references in the same plan, and adds
-`startup_timeout_sec = 30` for Codex. Interactive `rea upgrade` installs the new
-executable and then opens the updated `rea setup --all-detected` plan for
-separate approval. Structured or non-TTY upgrades defer that integration sync.
-Use the same setup command to migrate floating, unversioned, or stale
-registrations, then restart changed clients.
+`startup_timeout_sec = 30` for Codex. `rea update` installs the exact resolved
+release into the npm prefix that owns the running package, then checks the new
+executable's version before reporting success. It does not reopen onboarding.
+Release lookup and installation both use npm's configured registry.
+Its maintenance plan selects only existing REA registrations and an already
+installed REA skill. Run the returned scoped setup command to review and approve
+those changes, then restart affected agents. The plan is returned in terminal,
+non-TTY, and JSON modes without applying configuration changes.
 
 ## Hopper
 
@@ -151,6 +169,16 @@ and digest, validates the application bundle, and atomically installs it to
 operator can choose its demo mode or activate an existing license. Homebrew and
 administrator access are not used.
 
+The Hopper launcher action used by REA creates a document from an executable;
+its supported command-line interface does not attach to an already-open
+document. While another live REA session owns the same target and loader
+profile, a second session reports the owning run ID instead of opening a
+duplicate document. Closing the owning REA session releases this guard; Hopper
+keeps its document open. A later REA session can therefore open another
+document for the same target. REA does not currently identify, focus, or reuse
+that existing GUI document, and the supported launcher exposes no attach or
+reuse action for it.
+
 On supported Linux distributions, approved setup verifies Hopper's official
 `.deb`, `.rpm`, or Arch package before invoking the native package manager.
 REA runs the supported demo build on a private Xvfb display and selects Hopper's
@@ -160,7 +188,7 @@ desktop display. Unattended package-manager access requires
 mount, REA first verifies the conflict and then uses an unprivileged user and
 mount namespace with a private mode-1777 tmpfs over that directory only. The
 host mount and the rest of `/tmp` remain unchanged; this fallback never invokes
-`sudo`. `rea doctor --provider hopper --detail full --json` reports the selected
+`sudo`. `rea doctor --provider hopper --json` reports the selected
 strategy and both host and effective mount facts.
 
 ### Hopper in CI
@@ -177,7 +205,7 @@ starting an unattended job. Ephemeral macOS runners therefore need a
 pre-provisioned user session or a deliberate interactive bootstrap step.
 
 When Hopper cannot start in CI, run
-`rea doctor --provider hopper --detail full --json` in the failing runner.
+`rea doctor --provider hopper --json` in the failing runner.
 Structured failures distinguish private-display dependencies, an unsupported
 demo dialog or build, process-ownership conflicts, and an early lifecycle exit.
 Apply the reported remediation rather than exposing the runner's desktop,
@@ -185,37 +213,53 @@ copying license secrets into logs, or killing unrelated Hopper processes.
 
 ## Ghidra
 
-REA's Ghidra provider is bring-your-own and supports Linux x64 with the exact
-official Ghidra 12.1.2 release and a 64-bit full JDK 21. An experimental
-Windows x64 P0 supports approved native x86-64 PE applications. It supplies
-discovery, analysis-profile commitment, an isolated read-only headless session,
-ten bounded inventory/name/search operations, and nine function-analysis
-operations covering metadata, decompilation, assembly, resolved calls, typed
-references, xrefs, CFG, and dossiers. GUI state and analysis mutations remain
-unavailable through Ghidra.
+REA connects to an existing Ghidra installation on Linux x64, macOS x64/arm64,
+or experimental Windows x64 P0.
+It requires Ghidra 12.1.4 and a 64-bit full JDK 21. On macOS, the installation
+must include the native decompiler for the host architecture; REA does not
+build it or change Gatekeeper quarantine settings.
+
+The adapter exposes 25 read-only operations: thirteen inventory/name/search
+operations and twelve function-analysis operations. These cover metadata,
+decompilation, assembly, resolved calls, typed references, xrefs, function
+dossiers, instructions, recovered data types, measured load mappings, loaded
+memory bytes, and observed file offsets. Independent load-image attestation
+supports DOS MZ and explicitly selected COM; PE returns its measurements with that limitation.
+On Linux and macOS, `annotate_native_function` also edits a function name and/or
+entry comments atomically and returns refreshed analysis. These session metadata
+edits leave executable bytes unchanged and are discarded on close. GUI controls
+require Hopper; Windows P0 remains read-only.
+
+Windows P0 admits native x86-64 PE applications on fixed local NTFS volumes.
+The npm package bundles native Job Object ownership, protected private runtime
+DACLs, and handle-based path admission; no separate addon installation is needed.
+See the [Windows Ghidra P0 guide](windows-ghidra-p0.md) for verified scope and
+limitations.
 
 Extract Ghidra and install the JDK outside REA, then export absolute paths:
 
 ```bash
-export GHIDRA_INSTALL_DIR=/absolute/path/to/ghidra_12.1.2_PUBLIC
+export GHIDRA_INSTALL_DIR=/absolute/path/to/ghidra_12.1.4_PUBLIC
 export JAVA_HOME=/absolute/path/to/jdk-21 # optional if java/javac are on PATH
 rea doctor --json
 rea setup
 ```
 
-PowerShell configuration for Windows uses the same non-secret paths:
+On Windows, configure the existing installation in PowerShell:
 
 ```powershell
-$env:GHIDRA_INSTALL_DIR = "C:\tools\ghidra_12.1.2_PUBLIC"
+$env:GHIDRA_INSTALL_DIR = "C:\tools\ghidra_12.1.4_PUBLIC"
 $env:JAVA_HOME = "C:\Program Files\Java\jdk-21"
 rea doctor --json
 rea providers --json
 ```
 
-`rea setup` does not mutate Windows client configuration or install Hopper,
-Ghidra, Java, Python, or another package. Register the built `rea mcp` command
-manually in the intended client and preserve the two environment variables.
-See [Windows Ghidra P0](windows-ghidra-p0.md) for a complete example.
+`rea setup` can configure supported Windows agents and install the bundled
+REA skill after approval. Direct registrations use Node to launch REA's entry
+script; package-runner registrations use the pinned `npx` command. Hopper
+installation remains unavailable on Windows. Setup never installs Ghidra,
+Java, or Python. It preserves valid detected Ghidra/JDK settings in agent
+registrations. See [Windows Ghidra P0](windows-ghidra-p0.md) for provider diagnostics.
 
 Doctor validates the platform, architecture, application version,
 `support/analyzeHeadless` or `support/analyzeHeadless.bat`, Java
@@ -226,36 +270,82 @@ environment entry in its plan, writes only after approval, and never downloads,
 installs, upgrades, or modifies Ghidra or Java.
 
 Each verified session uses an ephemeral temporary project and isolated
-home/cache/config/temp paths. REA passes `-readOnly`, `-deleteProject`, a
-per-file analysis timeout, CPU and heap bounds, and its packaged Java bridge via
-`-scriptPath`; it never opens an existing user project. Linux uses a
-current-user-only local bridge socket and descriptor. Windows P0 uses
-token-authenticated IPv4 loopback, a token-free endpoint record, and bounded
-process-tree termination. It does not yet prove private DACL,
-reparse-point-safe, or Job Object semantics; use only approved non-sensitive
-fixtures.
+home/cache/config/temp paths. REA passes `-readOnly`, `-deleteProject`, uses
+Ghidra's default analysis and resource settings, and loads its packaged Java
+bridge via `-scriptPath`; it never opens an existing user project. Linux and
+macOS use a current-user-only local bridge socket and descriptor. The
+experimental Windows transport uses authenticated IPv4 loopback with a
+private native-owned bearer descriptor and Job Object process ownership.
 
-Operations begin only after default auto-analysis completes. A timeout fails
-the open rather than exposing partial analysis. One session contains exactly
-one imported Program; use `provider_id: "ghidra"`, `--provider ghidra`, or
+Operations begin only after default auto-analysis completes. The provider
+startup deadline fails the open rather than exposing partial analysis. One
+session contains exactly one imported Program; use `provider_id: "ghidra"`, `--provider ghidra`, or
 `REA_ANALYSIS_PROVIDER=ghidra` when both Hopper and Ghidra support the target.
-One persistent decompiler is owned by the Program, Ghidra API calls cross a
-bounded 32-request serial queue, and each native decompile is limited to 30
-seconds. Unresolved computed calls remain unknown, reference-kind provenance is
-preserved, and provider-specific pseudocode is never treated as original source
-or Hopper-equivalent text.
+One persistent decompiler is owned by the Program, and a serial queue keeps
+Ghidra API calls on the owning Program thread without a fixed queue length.
+Operations run until a result, caller cancellation, or provider shutdown; there
+is no fixed per-operation or response-size ceiling. Unresolved computed calls
+remain unknown, reference-kind provenance is preserved, and provider-specific
+pseudocode is never treated as original source or Hopper-equivalent text.
+
+Unexpected request failures retain their original internal cause. CLI and MCP
+errors expose Error names, messages, and available codes under
+`details.diagnostics.failure_cause`; other rejection values retain their
+primitive value or an explicit type. Shutdown warnings include the failure
+kind, message, and diagnostics, while process and temporary-project cleanup
+continues. These messages redact known bridge authentication tokens and
+preserve local paths and other analysis context.
 
 Run `GHIDRA_INSTALL_DIR=... npm run verify:ghidra` from a source checkout to
-compile and analyze source-owned x86-64 debug/stripped ELF, AArch64 ELF,
-x86-64 PE, and x86-64 Mach-O conformance fixtures. The verifier expects `cc`,
-`clang`, and `lld-link` on `PATH`; `REA_CC`, `REA_CLANG`, and `REA_LLD_LINK` can
-select alternate command paths.
+compile and analyze debug and stripped host-native fixtures (ELF on Linux x64
+or Mach-O on macOS), plus a native DWARF 4 type-layout object. This lane needs a
+host C compiler in addition to Ghidra and its JDK.
+
+Run `GHIDRA_INSTALL_DIR=... npm run verify:ghidra:cross-format` to add AArch64
+ELF, x86-64 PE, and x86-64 Mach-O fixture coverage. This separate lane needs
+`clang`, LLD, and `lld-link` on `PATH`; `REA_CLANG` and `REA_LLD_LINK` select
+alternate command paths. Missing cross-target tooling does not block the
+host-native Ghidra acceptance lane.
 
 On a controlled Windows x64 runner, use
 `npm run verify:ghidra:windows`. The verifier generates a deterministic native
-PE fixture from source bytes, exercises every admitted Ghidra operation, checks
-target/snapshot/import digest identity, and requires complete runtime cleanup.
+PE fixture from source bytes and requires the Windows native authority before
+opening the provider. This lane remains blocked until those controls are
+implemented; its intended checks include operation coverage, digest identity,
+and complete runtime cleanup.
 
 ## Diagnose, update, and remove
 
-`rea doctor --json` is strictly read-only. `rea upgrade` updates only the npm installation that owns the running CLI. `rea uninstall` removes only REA-owned agent registrations and skill files; `--purge-data` additionally removes REA cache and state paths.
+`rea doctor --json` is strictly read-only. `rea update` updates only the npm installation that owns the running CLI. Source checkouts and package-runner copies must be updated through the mechanism that owns them; a fresh package-runner invocation can use `npx rea-agents@latest`. `rea uninstall` removes only REA-owned agent registrations and skill files; `--purge-data` additionally removes REA cache and state paths.
+
+## MCP Registry
+
+REA is published in the official MCP Registry as `io.github.morluto/rea`. Registry
+clients can discover the server and install the existing public `rea-agents` npm
+package; the Registry entry does not introduce a second distribution artifact.
+
+For a client that supports Registry discovery, search for `io.github.morluto/rea`
+and select the npm package. The published metadata launches the existing stdio
+server through `npx` with the `mcp` command.
+
+For a client that requires manual configuration, use:
+
+<!-- x-release-please-start-version -->
+
+```json
+{
+  "mcpServers": {
+    "rea": {
+      "command": "npx",
+      "args": ["-y", "rea-agents@4.0.1", "mcp"]
+    }
+  }
+}
+```
+
+<!-- x-release-please-end -->
+
+Persistent registrations should use one exact package version. `rea setup`
+writes the same package-runner shape and pins it to the exact version that
+performed setup. Run current setup to refresh an older registration, then
+restart the client.

docs/investigation-workspaces.md

@@ -1,124 +0,0 @@
-# Persistent investigation workspaces
-
-REA can run a deterministic artifact investigation across two versions and
-persist its Evidence beyond a CLI process or MCP session. The CLI and MCP use
-the same application workflow.
-
-## CLI
-
-First allow the directory that will own the workspace, then explicitly approve
-the write:
-
-```bash
-export REA_EVIDENCE_ROOTS_JSON='["/absolute/path/to/evidence"]'
-export REA_INVESTIGATION_INPUT_ROOTS_JSON='["/absolute/path/to/releases"]'
-
-rea investigate-versions \
-  /absolute/path/to/version-1 \
-  /absolute/path/to/version-2 \
-  /absolute/path/to/evidence/releases.json \
-  --workspace-name releases \
-  --yes
-```
-
-The two versions may be regular artifacts or directories supported by the
-artifact graph provider. Both must resolve beneath an explicitly configured
-`REA_INVESTIGATION_INPUT_ROOTS_JSON` root. The workspace parent must already
-exist beneath `REA_EVIDENCE_ROOTS_JSON`. REA never creates an allowlisted root
-implicitly.
-
-Use `--expected-revision N` when an external coordinator needs an explicit
-compare-and-swap guard. Traversal, byte, page, and comparison limits are also
-available as CLI options.
-
-After a completed run returns its stable run ID, `--replay-run-id RUN_ID`
-selects that exact result without reading or rescanning either version input.
-The workspace still requires read authority. REA rejects a selector that is
-missing, incomplete, or inconsistent with the requested paths and controls.
-
-## MCP
-
-`find_changed_behavior` retains its existing aggregation mode. Its additive
-`investigation_run` mode starts or resumes the same persistent workflow:
-
-```json
-{
-  "investigation_run": {
-    "approved": true,
-    "workspace_path": "/absolute/path/to/evidence/releases.json",
-    "workspace_name": "releases",
-    "left_path": "/absolute/path/to/version-1",
-    "right_path": "/absolute/path/to/version-2",
-    "options": {
-      "max_entries": 10000,
-      "max_total_bytes": 1073741824,
-      "max_entry_bytes": 268435456,
-      "max_compression_ratio": 1000,
-      "max_depth": 20,
-      "max_path_bytes": 4096,
-      "page_size": 500,
-      "change_limit": 500
-    }
-  }
-}
-```
-
-Exactly one of `comparisons` or `investigation_run` is accepted. The MCP tool
-inventory remains unchanged.
-
-## Checkpoints and reuse
-
-One run has four ordered stages:
-
-1. Inventory the left version.
-2. Inventory the right version.
-3. Compare the complete artifact Evidence page sets.
-4. Derive the changed-behavior report.
-
-The inventory checkpoint is written first, followed by the comparison and final
-report checkpoints. A process interrupted after a checkpoint can resume from
-the last complete stage. A completed run is reused when both graph commitments
-and every bounded option are identical.
-
-By default, REA rescans the version inputs so changed content creates a new
-run. For an explicit cache-only replay, add the returned `run_id` as
-`investigation_run.replay_run_id`. REA validates the workspace revision and
-name, the complete run, its exact paths and controls, and every linked Evidence
-record before it skips input-read authorization.
-
-The run ID is a SHA-256 commitment to both root and graph digests plus the
-normalized options. Local paths and timestamps do not affect that identity.
-Changing either artifact or a budget creates a new run in the same workspace;
-it does not overwrite the earlier run.
-
-## Integrity and concurrency
-
-A workspace contains a canonical Evidence v2 bundle plus run manifests. Each
-workspace revision has a deterministic digest and points to the prior revision
-digest. Parsing verifies:
-
-- the workspace, run, Evidence, graph, and revision identities;
-- canonical ordering and unique run IDs;
-- every run-to-Evidence reference;
-- stage and completion-state consistency.
-
-Writes are canonical JSON, atomic, fsynced, and mode `0600`. REA rejects
-workspace paths outside `REA_EVIDENCE_ROOTS_JSON`, symlink destinations,
-artifact inputs outside `REA_INVESTIGATION_INPUT_ROOTS_JSON`,
-oversized or deeply nested JSON, stale expected revisions, and concurrent lock
-holders. Lock or CAS conflicts fail without mutating the workspace; callers may
-retry the same idempotent request.
-
-## Truth boundary
-
-The automatic run currently observes shipped artifact structure. Artifact
-changes are static behavior candidates, not runtime observations or causal
-claims. Without controlled process comparison Evidence, `behavior_status`
-remains `unknown` even when static differences are present. Provider
-limitations, incomplete comparison pages, and unsupported container expansion
-remain explicit in the final Evidence.
-
-Automatic Hopper function matching, process replay, protocols, UI comparison,
-and reconstruction verification are not yet stages of this run. Existing
-manual comparison Evidence can still be aggregated through the original
-`find_changed_behavior` mode.

docs/javascript-application-graph.md

@@ -1,6 +1,6 @@
 # JavaScript Application Graph
 
-JavaScript Application Graph v1 is REA's provider-neutral domain model for
+JavaScript Application Graph is REA's provider-neutral domain model for
 connecting shipped application bytes, JavaScript structure, Electron process
 boundaries, passive browser observations, and native add-ons. It is a durable,
 canonical data contract; it is not an extractor or a new CLI/MCP tool.
@@ -32,13 +32,12 @@ adds capture-scoped targets, frames, scripts, workers, and inferred
 verification remains a separate later layer. The domain graph itself never
 reaches outward to obtain any of those facts.
 
-## Versioned record
+## Stored record
 
 A stored graph has this top-level shape:
 
 ```text
 schema: "JavaScriptApplicationGraph"
-schema_version: 1
 graph_id: jag_<sha256 of normalized graph semantics>
 root_node_ids: jag_node_<sha256>[]
 nodes: application entities with one or more observations
@@ -47,14 +46,14 @@ coverage: complete, partial, unknown, or unavailable
 limitations: explicit graph-wide constraints
 ```
 
-Parsing rejects unknown fields, unsupported versions, non-canonical ordering,
-duplicate IDs, stale semantic commitments, missing roots, dangling endpoints,
-self-edges, and `changed_from` edges between unlike node kinds. Constructors
-normalize set-like arrays before deriving their IDs.
+Parsing rejects unknown fields, non-canonical ordering, duplicate IDs, stale
+semantic commitments, missing roots, dangling endpoints, self-edges, and
+`changed_from` edges between unlike node kinds. Constructors normalize set-like
+arrays before deriving their IDs.
 
 ## Entities and relationships
 
-The v1 node vocabulary covers:
+The node vocabulary covers:
 
 - package, installer, and artifact;
 - ASAR entry;
@@ -98,7 +97,7 @@ correspondence is a separately identified cross-layer inference.
 Every observation and edge carries all of the following:
 
 - an authority, such as artifact bytes, AST analysis, static relationship
-  inference, passive CDP runtime, cross-layer reconciliation, controlled replay,
+  inference, passive CDP runtime, and cross-layer reconciliation,
   native analysis, historical reference, or user assertion;
 - an epistemic state: `observed`, `inferred`, `unknown`, or `unavailable`;
 - confidence independently bounded as exact, high, medium, low, or unknown;
@@ -107,7 +106,7 @@ Every observation and edge carries all of the following:
   location, or an unavailable reason;
 - extractor name, version, operation, and optional executable digest;
 - coverage status, truncation, omitted count, and named limits;
-- limitations and links to existing Evidence v2 records;
+- limitations and links to existing Evidence records;
 - a content-derived identifier and its declared stability strategy.
 
 Authority and epistemic state are separate fields. An AST observation does not
@@ -158,16 +157,12 @@ stability. Edge IDs use the same derivation with `relationship-exact`
 stability. Node, observation, edge, and graph IDs are recomputed during parsing,
 so callers cannot preserve a stale ID after changing semantic content.
 
-## Bounds
+## Structure
 
-The v1 boundary admits at most 1,000 roots, 100,000 nodes, 200,000 edges, and 64
-observations per node. Each properties object is valid bounded JSON with at most
-64 keys, depth 6, 512 structural nodes, and 4,096 characters per string. Arrays
-of evidence links, limits, and limitations have independent caps.
-
-These are admission limits, not completeness claims. When an extractor reaches
-a limit, it must record partial coverage and the exact named limit. It must not
-return a bounded prefix labeled complete.
+The graph does not impose aggregate caps on roots, nodes, edges, observations,
+or JSON properties. Properties must be valid JSON; field-specific validation
+still applies to paths, identifiers, and evidence values. Extractors report
+actual omissions in coverage instead of silently dropping a prefix.
 
 ## Domain API
 
@@ -184,7 +179,3 @@ The public domain functions are:
 - `serializeJavaScriptApplicationGraph` for canonical JSON;
 - `computeJavaScriptApplicationGraphSha256` for a byte-stable verified graph
   digest.
-
-Schema evolution is explicit. A future incompatible shape receives a new
-`schema_version`; v1 parsing fails with an unsupported-version diagnostic rather
-than guessing how to reinterpret it.

docs/javascript-application-workflows.md

@@ -1,35 +1,34 @@
 # Cross-layer JavaScript application workflows
 
-REA derives a bounded feature trace from one authenticated JavaScript
+REA derives a complete reachable feature trace from one authenticated JavaScript
 Application Graph and compares two authenticated graph versions. The MCP tools
 are `trace_application_feature`, `trace_javascript_semantics`,
 `compare_application_versions`, `compare_source_to_bundle`, and
 `compare_javascript_export_shapes`; their CLI equivalents use the same names
 with hyphens.
 
-Both workflows consume Evidence v2 produced by
+These workflows consume Evidence produced by
 `analyze_javascript_application` or `reconcile_javascript_runtime`. They do not
 read an artifact, execute application code, attach to a process, or open a
 native-analysis provider. Static artifact observations, passive runtime
 observations, relationship inferences, and unknown or unavailable facts retain
 their original graph authority.
 
-Current `analyze_javascript_application` Evidence uses result schema v2. It
-retains the structural JavaScript Application Graph and a separate semantic
-relation graph bound to the same root artifact digest and structural graph ID.
-Legacy v1 Evidence remains valid for structural workflows, but semantic tracing
-returns an actionable request to reanalyze it rather than treating missing
-semantic data as an empty graph.
+`analyze_javascript_application` Evidence retains the structural JavaScript
+Application Graph and a separate semantic relation graph bound to the same root
+artifact digest and structural graph ID. Semantic tracing requires the semantic
+relation graph and reports when it is unavailable rather than treating missing
+data as an empty graph.
 
 ## Feature tracing
 
 Select one literal seed kind: node ID, route, string, API, IPC channel, module,
 or native export. Matching is exact or literal substring matching; regular
-expressions and executable predicates are not accepted. Direction, depth,
-nodes, edges, paths, and seed matches all have caller-visible limits.
+expressions and executable predicates are not accepted. The trace includes all
+matching seeds and the complete graph reachable in the selected direction.
 
-The result contains the matching basis, a bounded subgraph, terminal paths,
-authority summaries, truncation frontier, and native handoffs. A handoff binds
+The result contains the matching basis, complete reachable subgraph, terminal
+paths, authority summaries, and native handoffs. A handoff binds
 the exact native artifact digest and requested exports from the application
 graph. Existing Hopper or Ghidra Evidence is linked only when its subject digest
 matches exactly. Otherwise the result recommends provider-neutral follow-up
@@ -42,16 +41,15 @@ provider implicitly.
 rereading mutable files. A seed may identify a semantic or application node,
 literal, function fingerprint, property, endpoint, event, or boundary field.
 The query declares backward provenance, forward influence, callers, or
-ownership and can restrict admitted relation kinds. Node, relation, depth,
-function, module, seed-match, and page limits are validated against exact
-published ranges. A committed cursor returns the next deterministic relation
-page only for the same graph, query, and limits.
+ownership and can restrict admitted relation kinds. REA returns every matching
+seed and the complete reachable subgraph; callers do not choose node, relation,
+depth, function, module, seed-match, or page budgets.
 
 The extractor covers lexical definitions and reads, literal seeds, static
 property slots, object reads/writes/spreads/destructuring, closure captures,
 uniquely resolved local calls, argument/return flow, and explicit Promise
 construction, chaining, aggregation, await, return, assignment, and
-detachment. It also recovers bounded static candidates for EventEmitter
+detachment. It also recovers static candidates for EventEmitter
 registrations/removals and dispatch, Node timers and cancellation handles, asynchronous
 `node:child_process` creation and ownership, configuration sources and direct
 defaults, request construction and response consumers, parse/coercion/
@@ -60,9 +58,9 @@ validation boundaries, and built-in resource acquisition/release.
 Function fingerprints commit normalized syntax, control-flow shape, relation
 shape, literal sets, arity, and detected effects without using local names or
 source offsets. Equal duplicate fingerprints remain ambiguous. Dynamic
-calls/properties/names, parser recovery, unresolved handles, unsupported API
-shapes, and every reached bound stay explicit unknowns; a missing relation is
-never reported as proven behavioral absence.
+calls/properties/names, parser recovery, unresolved handles, and unsupported API
+shapes stay explicit unknowns; a missing relation is never reported as proven
+behavioral absence.
 
 Semantic relations use static-inference authority. `resolved` means the static
 target identity was unique within admitted analysis; it does not mean the path
@@ -83,19 +81,21 @@ persistent identities. Duplicate candidates remain ambiguous. Source-map and
 structural matches are high/medium-confidence inferences rather than exact
 facts. Each item is `unchanged`, `added`, `removed`, `changed`, or `unknown`,
 and the result includes its basis, candidates, changed dimensions, Evidence
-links, limitations, and a bounded `changed_from` graph.
+links, limitations, and a `changed_from` graph containing all compared nodes,
+their observations, and relationships.
 
 One-sided absence is `added` or `removed` only when the opposite input graph has
 complete coverage. With partial, unavailable, or truncated input, the same
-condition is `unknown`. Output truncation separately reports omitted comparison
-items, candidate references, graph nodes, edges, and observations. With
-`unknown_registry_approved: true`, unresolved comparison items can be retained
-as a residual unknown in a live session.
+condition is `unknown`. The comparison retains every classified item and
+ambiguity candidate. Coverage carries omitted counts and limits from each input
+graph; comparison adds no caller-selected item, candidate, graph node, or edge
+budget. Unresolved comparison items are recorded as a residual unknown linked
+to the comparison Evidence in a live session.
 
 ## Historical source-to-bundle comparison
 
 `compare_source_to_bundle` compares one cryptographically committed
-`HistoricalSourceGraph/v1` with authenticated application-graph Evidence. The
+`HistoricalSourceGraph` with authenticated application-graph Evidence. The
 stable scoring model reports every admitted signal and weight: exact source
 digest, source-map original path, exact current path, path suffix, basename, and
 language extension. Exact digest wins over location inference; weak basename
@@ -103,12 +103,13 @@ or extension evidence never forces a mapping.
 
 Each historical source file is classified as `unchanged`, `modified`,
 `removed`, `split`, `merged`, `duplicated`, or `unknown`. Multiple equally
-scored path mappings form a bounded static split inference. Multiple current
+scored path mappings form a static split inference. Multiple current
 nodes with the exact historical digest are duplicated; multiple historical
 paths with exact identity to one current node are merged. `removed` requires
-complete historical and application inventories with no relevant comparison
-truncation. Ambiguous candidates, partial inventories, and exhausted limits
-remain unknown. These static mappings do not claim runtime loading or semantic
+complete historical and application inventories. The comparison analyzes and
+returns all source files, candidate nodes, and matching signals represented in
+the supplied graphs. Partial inventories remain unknown where absence cannot
+be established. These static mappings do not claim runtime loading or semantic
 equivalence.
 
 ## Export return-shape comparison
@@ -120,9 +121,9 @@ match. An export is linked to a callable only through exact lexical/module
 relationships recovered by the AST analysis.
 
 Direct return expressions, including expression-bodied arrows, are evaluated
-through a bounded execution-free value lattice. Literal object fields are
-static observations. Calls, dynamic spreads, computed keys, parser recovery,
-and exhausted value, property, or return-site limits remain partial or unknown.
+through an execution-free value lattice. Literal object fields and direct
+return sites are represented in the result. Calls, dynamic spreads, computed
+keys, and parser recovery remain partial or unknown.
 Nested callable returns are not assigned to their parent callable. Projected
 graph observations carry source ranges but never source text.
 
@@ -131,21 +132,23 @@ unique occurrence on each side and pairing is reciprocal. Changes use JSON
 Pointer paths with `added`, `removed`, `changed`, or `unknown` status. A missing
 field is added or removed only when the relevant parent-property coverage is
 complete on both shapes. The output includes exact selector candidates,
-omissions, Evidence links, coverage, limitations, and a separate controlled
-replay recommendation; it does not execute JavaScript.
+omissions, Evidence links, coverage, and limitations; it does not execute
+JavaScript. When runtime semantics matter, run behavioral probes directly
+against the relevant application versions and capture them through the
+available browser, Electron, or process workflows.
 
 ## CLI and verification
 
-All five CLI commands accept inline JSON or a JSON file up to 64 MiB. The input
-is the same object used by the corresponding MCP tool.
+All five CLI commands accept inline JSON or a path to a JSON file. Put the full
+Evidence records in the workflow input, as in the corresponding MCP tool; the
+CLI does not resolve Evidence IDs from a separate bundle.
 
 For two operator-provided directories or ASARs, run:
 
 ```bash
 npm run verify:application-workflows -- \
   --left /absolute/path/to/version-a \
-  --right /absolute/path/to/version-b \
-  --source-map-read-approved
+  --right /absolute/path/to/version-b
 ```
 
 The verifier reconstructs both versions independently, compares them, runs one
@@ -158,20 +161,13 @@ all four `--left-module-path`, `--left-export-name`, `--right-module-path`, and
 `--right-export-name` options to verify an explicit export pair.
 
 Because source Evidence and derived Evidence are retained by the normal session
-ledger, evidence bundles, analysis snapshots, and investigation workspaces can
-carry these records without another persistence format.
+ledger, evidence bundles and analysis snapshots can carry these records without
+another persistence format.
 
-## Controlled replay boundary
+## Runtime evidence
 
-Static graph workflows never execute a graph node or recovered module.
-`run_controlled_replay` is the separate extracted-module boundary: it requires
-the `javascript_replay` authority, a plan call followed by exact content-bound
-approval, and the mandatory Linux OS sandbox fixed by
-[ADR-0002](adr/0002-controlled-replay-authority-and-sandbox.md). Browser,
-Electron, Process Capture, artifact-read, and static-analysis approvals do not
-authorize that execution.
-
-Replay observations retain `controlled-replay` authority. They cannot
-promote static inference into passive runtime observation or prove that the
-original application, renderer, preload, main process, or remote service
-behaved identically.
+Static graph workflows do not execute recovered code. When runtime semantics
+matter, run behavioral probes directly against the relevant application
+versions and capture them through the available browser, Electron, or process
+workflows. Those observations do not prove behavior in an unobserved app
+version or environment.

docs/javascript-artifact-reconstruction.md

@@ -1,12 +1,12 @@
 # JavaScript artifact reconstruction
 
 REA can project an operator-supplied Electron/JavaScript application directory
-or ASAR into [JavaScript Application Graph v1](javascript-application-graph.md)
+or ASAR into [JavaScript Application Graph](javascript-application-graph.md)
 without executing application code. The target-free
 `analyze_javascript_application` MCP tool, dedicated
 `rea analyze-javascript-application` CLI command, and generic
-`rea analyze PATH --approved` directory/ASAR route expose the same application
-service and return an Evidence v2 envelope containing the graph and an Electron
+`rea analyze PATH` directory/ASAR route expose the same application
+service and return an Evidence envelope containing the graph and an Electron
 boundary summary.
 
 The resulting Evidence can be combined with passive web or Electron capture
@@ -17,53 +17,58 @@ separate static, runtime, and cross-layer inference authorities.
 
 ## Public workflow
 
-The administrator first grants a canonical input root. Every request still
-requires explicit per-call approval, and the requested ASAR or directory must
-remain beneath that root after canonicalization:
+The tool reads the caller-selected local directory or ASAR path directly:
 
 ```bash
-export REA_INVESTIGATION_INPUT_ROOTS_JSON='["/absolute/path/to/apps"]'
-rea analyze /absolute/path/to/apps/app.asar --approved --json
+rea analyze /absolute/path/to/apps/app.asar --json
 rea analyze-javascript-application /absolute/path/to/apps/app.asar \
-  --approved \
   --json
 ```
 
 Generic `rea analyze` selects this static provider for directories and `.asar`
-paths when neither `--provider` nor `--snapshot` is supplied. Use the dedicated
-command when setting explicit format or reconstruction limits. Native targets,
-single JavaScript files, `.app` bundles, and explicit deep-provider or snapshot
-requests retain the native deep-analysis route.
+paths when neither `--provider` nor `--snapshot` is supplied. The dedicated
+command and the generic route return their complete results inline. Native
+targets, single JavaScript files, `.app` bundles, and explicit deep-provider or
+snapshot requests retain the native deep-analysis route.
 
-When configuring an MCP client, set the variable before approved setup so REA
-copies the explicit non-secret root policy into the managed registration:
+Configure an MCP client with the ordinary REA setup command:
 
 ```bash
-export REA_INVESTIGATION_INPUT_ROOTS_JSON='["/absolute/path/to/apps"]'
 rea setup
 ```
 
-Restart the configured MCP client after changing this administrator ceiling.
-An already-running server cannot acquire a new process environment through
-MCP elicitation or `SIGHUP`.
-
 The equivalent MCP input is:
 
 ```json
 {
   "input_path": "/absolute/path/to/apps/app.asar",
-  "format": "auto",
-  "approved": true,
-  "source_map_read_approved": false
+  "format": "auto"
 }
 ```
 
 `input_path` must be absolute. `format` accepts `auto`, `asar`, or `directory`.
 The result retains the canonical local path, root artifact digest, artifact
-manifest and graph commitments, JavaScript Application Graph v1, static
+manifest and graph commitments, JavaScript Application Graph, static
 Electron summary, reconstruction statistics, and explicit limitations. It does
 not require a live Hopper, Ghidra, browser, or Electron process.
 
+## Large results
+
+Graph and Evidence identifiers hash canonical JSON incrementally, without
+assembling a single string for the whole graph. The canonical bytes and existing
+identifiers remain unchanged. The opt-in regression check is
+`npm run verify:javascript:digests`;
+it hashes a value larger than the running Node engine's single-string limit.
+
+Output formatters and MCP transport serialization still assemble whole strings.
+For a large CLI result, select the needed fields
+before formatting, for example `--format json --filter-output
+evidence_id,normalized_result.statistics`. Complete serialization of a result
+beyond the engine's string limit is not established by this digest check.
+Client framing limits also apply: the pinned Node MCP SDK's stdio transport
+defaults to a 10 MiB buffer. Its caller-selected `maxBufferSize` must accommodate
+the complete response, including text and structured Evidence projections.
+
 ## What is reconstructed
 
 The projector reuses the content-addressed artifact inventory and safe artifact
@@ -90,7 +95,7 @@ Selected bounded text is then parsed as inert data to recover:
 - static imports, dynamic imports, CommonJS `require` calls, workers, and
   service workers;
 - route, network endpoint, storage, and vendor-marker observations;
-- local source-map declarations and, when separately approved, bounded original
+- local source-map declarations and original
   source names and content digests;
 - explicit BrowserWindow options and `webPreferences`, including statically
   resolvable preload entrypoints;
@@ -119,11 +124,7 @@ JavaScript file, package record, or source map produces an `unknown` graph scope
 with `state: unavailable`; it is not treated as evidence that modules or source
 are absent.
 
-Source-map content has a separate `source_map_read_approved` input. Without that
-approval, REA inventories the map, links a static declaration when present, and
-records partial non-truncated coverage plus an unavailable parse scope. With
-approval, the graph stores original source names and optional content digests,
-not the raw `sourcesContent` text.
+Source-map contents are parsed as local input. The graph stores original source names and optional content digests, not raw `sourcesContent` text.
 
 Only explicitly present BrowserWindow values are observations. REA does not
 substitute version-dependent Electron defaults for omitted `webPreferences`.
@@ -141,9 +142,10 @@ For `.node` bindings, member names mean “requested by JavaScript syntax.” A
 resolved add-on path does not convert them into verified native exports. Native
 symbol verification remains a separate deep-analysis claim.
 
-Endpoint observations preserve useful local diagnostics while removing URL
-credentials, fragments, and query values. Artifact paths, digests, parse
-locations, and analysis metadata remain actionable because REA is local-only.
+Endpoint observations preserve useful local diagnostics, including query values
+and fragments, while removing only URL username/password credentials. Artifact
+paths, digests, parse locations, and analysis metadata remain actionable
+because REA is local-only.
 
 ## Safety boundary
 
@@ -160,30 +162,29 @@ represented by metadata only.
 
 ## Bounds and coverage
 
-The input schema bounds artifact entries, cumulative artifact bytes, bytes per
-entry, compression ratio, path depth and length, selected text files, text bytes,
-AST nodes, static findings, bundle modules, source-map originals, and cooperative
-parse time. Source-map original limits are shared across all maps in one
-reconstruction. Combined input limits are rejected if their conservative graph
-projection could exceed the v1 contract's 100,000 nodes or 200,000 edges.
+The reconstruction keeps internal resource safeguards for artifact entries,
+cumulative artifact bytes, bytes per entry, compression ratio, path depth and
+length, selected text files, text bytes, AST nodes, and cooperative parse time.
+These safeguards are not caller-selectable output budgets. Source-map parsing
+reports truncation when its format or parser safety boundary is reached. The
+application graph has no aggregate node, edge, root, or observation prefix cap.
 
 Byte, entry, path, and graph-shape bounds are hard limits. The parse deadline is
 checked before and between bounded parsing and traversal phases; the synchronous
 Babel and JSON parser calls cannot be preempted mid-call, so their input byte
 bounds remain the hard protection for an individual call.
 
-Byte-identical assets share a content-digest node. At most 64 distinct
-observations are retained on that node, as required by the graph contract; every
-inventoried containment edge remains present, and any omitted observations make
-top-level coverage partial and truncated. When an exact omission count is not
-knowable, `omitted_count` is `null` rather than a guessed value.
+Byte-identical assets share a content-digest node. Every distinct observation
+and inventoried containment edge is retained. If parsing or artifact safety
+boundaries omit input, coverage reports that omission; when an exact omission
+count is not knowable, `omitted_count` is `null` rather than a guessed value.
 
 ## Verification boundary
 
 The source-owned fixture covers an extracted directory, a direct ASAR with an
 unpacked native add-on, a direct ASAR whose unpacked native companion is
 missing, and an ASAR nested beneath a directory. Tests also cover deterministic
-reruns, parse-not-execute behavior, source-map approval, global source-map
+reruns, parse-not-execute behavior, source-map parsing, global source-map
 limits, malformed structured data, invalid containers, traversal, symlink
 escape, oversized text, cancellation, AST truncation, and repeated content
 identities. A separate synthetic Electron fixture covers explicit safe and

docs/javascript-runtime-observation.md

@@ -1,35 +1,61 @@
 # Passive Node and Electron runtime observation
 
 REA can attach to an already-running Node.js or Electron V8 Inspector target
-and retain bounded script-load and execution-context metadata. The
+and retain script-load and execution-context metadata. The
 `list_javascript_runtime_targets` and `observe_javascript_runtime` MCP tools
 have equivalent `rea list-javascript-runtime-targets` and
 `rea observe-javascript-runtime` commands. Successful calls return
-deterministic Evidence v2.
+deterministic Evidence.
 
-This authority is disabled by default and is separate from browser CDP,
-Electron file-page inspection, Process Capture, and controlled JavaScript
-replay:
+Each request supplies the loopback Inspector endpoint and, for observation, the
+target ID. This surface is separate from browser CDP, Electron file-page
+inspection, and Process Capture:
 
 ```bash
-export REA_V8_INSPECTOR_OBSERVE_ENABLED=true
-export REA_V8_INSPECTOR_ENDPOINTS_JSON='["http://127.0.0.1:9229"]'
-export REA_V8_INSPECTOR_FILE_ROOTS_JSON='["/absolute/path/to/app"]'
-export REA_V8_INSPECTOR_ALLOWED_ORIGINS_JSON='[]'
-
 rea list-javascript-runtime-targets http://127.0.0.1:9229 \
-  --approved --json
+  --json
 rea observe-javascript-runtime http://127.0.0.1:9229 TARGET_ID \
-  --runtime-kind node --approved --json
+  --runtime-kind node --json
 ```
 
-At least one canonical file root or exact HTTP(S) origin is required.
-Discovery is restricted to a literal-loopback HTTP endpoint. A target must
-match the exact requested target ID, expose a same-port WebSocket reported by
-the approved discovery endpoint, and remain inside the requested file or
-origin scope. Targets already marked attached are rejected rather than
-displacing another debugger. Canonical file paths are checked after symlink resolution.
-Excluded locations are counted but never retained.
+The caller supplies the literal-loopback HTTP endpoint directly. Selecting an endpoint exposes all targets it serves and their local script locations or renderer origins. A target must match the exact requested target ID and expose a same-port WebSocket reported by that endpoint. Targets already marked attached are rejected rather than displacing another debugger. Local paths are canonicalized after symlink resolution.
+
+`list_javascript_runtime_targets` returns every available target in one inline
+array.
+
+For the MCP follow-up call, pass the same literal-loopback endpoint and the selected target ID to `observe_javascript_runtime`. REA rediscovers targets and validates the ID against the live endpoint before observation.
+
+### Discovery file locations
+
+Node's `/json/list` reports a best-effort pathname prefixed with `file://`,
+without URI encoding. On POSIX, REA interprets unambiguous paths literally,
+including `#` and `%` in filenames. Node also replaces backslashes and double
+quotes with underscores. That transformation cannot be reversed reliably:
+an underscore may already be part of the original filename.
+
+Windows paths, ambiguous underscore paths, and local discovery paths that
+cannot be verified remain eligible by their endpoint and exact target ID.
+Their target location preserves the reported value:
+
+```json
+{
+  "kind": "unresolved",
+  "reported_url": "file://C:_tools_entry.js",
+  "reason": "unverifiable-file-location"
+}
+```
+
+This location does not claim that a file exists or authorize reading its
+contents. Listing remains HTTP-only. Observation resolves loaded script
+locations independently from `Debugger.scriptParsed` file URLs, preserving
+the existing checks for local files and encoded separators. Unsupported
+schemes, remote file hosts, and a bare `file://` remain excluded. These Node
+discovery rules do not apply to page targets or other runtime products.
+
+Reconciliation retains an unresolved `target_location` object and reports
+`runtime-location-unresolved` with unknown confidence for that target. It
+does not derive a static match from the reported pathname; verified loaded
+script locations remain available for independent matching.
 
 ## Passive protocol boundary
 
@@ -70,31 +96,30 @@ Electron role, so Evidence records the role authority as
 `caller-declared-unverified`.
 
 Electron main, preload, and renderer behavior can therefore be observed only
-as separate approved Inspector targets. The provider does not infer that two
+as separate Inspector targets. The provider does not infer that two
 targets belong to the same Electron application.
 
-## Bounds and determinism
+## Capture and determinism
 
-Every observation commits the window and exact limits for events, scripts,
-execution contexts, per-location bytes, and total retained metadata bytes.
-Limit hits increment dropped-event counts and set `capture.truncated`; they
-never become completeness claims. Scripts are authorized after capture,
-deduplicated by stable metadata, and canonically sorted. Wall-clock timestamps
-and protocol script IDs are excluded from the durable result, so identical
-inputs and captured metadata produce the same Evidence ID.
+Every observation records its time window and returns all valid script and
+execution-context events received during it. Per-location protocol validation
+remains in force. Scripts are validated after capture, deduplicated by stable
+metadata, and canonically sorted. Wall-clock timestamps and protocol script IDs
+are excluded from the durable result, so identical inputs and captured metadata
+produce the same Evidence ID.
 
 Inspector attach is inherently incomplete. Enabling `Debugger` reports known
 and uncollected scripts, but scripts collected before attachment may be
-missing. Absence from a bounded capture never proves that a script or behavior
-does not occur.
+missing. Absence from the observation window never proves that a script or
+behavior does not occur.
 
 ## Static correlation
 
 Pass the resulting observation Evidence and an
 `analyze_javascript_application` Evidence record to
 `reconcile_javascript_runtime`. The reconciliation accepts this provider
-alongside passive web and Electron page captures. Exact approved file or URL
-mappings can correlate script presence with JavaScript Application Graph
+alongside passive web and Electron page captures. Exact file or URL mappings
+supplied with the request can correlate script presence with JavaScript Application Graph
 assets. Because this provider never reads source bytes, matches normally use a
 unique authorized location and remain weaker than captured-byte identity.
 Builtin `node:` scripts remain runtime-only nodes unless a future explicit

docs/javascript-runtime-reconciliation.md

@@ -3,15 +3,15 @@
 REA can combine an existing static JavaScript Application Graph with one or
 more passive browser, Electron page, or Node/Electron V8 Inspector captures without collapsing their different
 authorities. The `reconcile_javascript_runtime` MCP tool and
-`rea reconcile-javascript-runtime` CLI command accept Evidence v2 records and
-return derived Evidence v2 containing a combined JavaScript Application Graph
+`rea reconcile-javascript-runtime` CLI command accept Evidence records and
+return derived Evidence containing a combined JavaScript Application Graph
 and explicit match, ambiguity, mismatch, and unknown classifications.
 
 The operation performs no filesystem, browser, or Electron I/O. It accepts only
 semantically verified Evidence produced by `analyze_javascript_application`,
 `inspect_web_page`, `inspect_electron_page`, or
 `observe_javascript_runtime`; matching operation names alone
-is insufficient. Provider identity, predicate version, subject digest, target
+is insufficient. Provider identity, predicate type, subject digest, target
 parameters, and normalized-result schemas are checked before reconciliation.
 
 ## Workflow
@@ -21,7 +21,7 @@ parameters, and normalized-result schemas are checked before reconciliation.
    supplied as additional layers.
 2. Run `inspect_web_page`, `inspect_electron_page`, or the attach-only
    `observe_javascript_runtime`. Capturing script sources
-   is optional, but an approved source capture provides the strongest byte
+   is optional, but a source capture provides the strongest byte
    identity.
 3. Pass the resulting Evidence records to `reconcile_javascript_runtime`.
    Browser URLs normally need an explicit URL-prefix mapping. Extracted
@@ -30,7 +30,7 @@ parameters, and normalized-result schemas are checked before reconciliation.
    and asset roots need explicit mappings.
 
 The MCP input has this shape; the `analysis` and `runtime_observations` values
-are complete Evidence v2 objects, not only evidence IDs:
+are complete Evidence objects, not only evidence IDs:
 
 ```json
 {
@@ -47,12 +47,7 @@ are complete Evidence v2 objects, not only evidence IDs:
       ]
     }
   ],
-  "runtime_observations": ["INSPECT_WEB_PAGE_EVIDENCE"],
-  "limits": {
-    "max_runtime_entities": 10000,
-    "max_reconciliation_items": 20000,
-    "max_static_load_states": 20000
-  }
+  "runtime_observations": ["INSPECT_WEB_PAGE_EVIDENCE"]
 }
 ```
 
@@ -82,18 +77,16 @@ npm run verify:javascript-runtime -- \
   --mapping '{"layer":1,"kind":"file-root","root":"/runtime/cache","artifact_prefix":""}'
 ```
 
-The verifier analyzes the supplied static paths under a temporary in-process
-permission policy, reads bounded Evidence JSON files, and prints graph IDs,
-evidence IDs, paths, digests, counts, reasons, and coverage. It does not print
-captured source text. `--source-map-read-approved` remains a distinct explicit
-approval.
+The verifier analyzes the supplied static paths, reads bounded Evidence JSON
+files, and prints graph IDs, evidence IDs, paths, digests, counts, reasons, and
+coverage. It does not print captured source text.
 
 ## Matching rules
 
 Runtime targets, frames, scripts, and workers become capture-scoped graph
 nodes. REA evaluates compatible static candidates conservatively:
 
-1. An approved captured-source SHA-256 plus one matching mapped location yields
+1. A captured-source SHA-256 plus one matching mapped location yields
    a content-and-location match.
 2. One unique exact content digest can match even when no location mapping is
    available. Whole-asset digests and reconstructed module-factory source
@@ -101,13 +94,13 @@ nodes. REA evaluates compatible static candidates conservatively:
 3. Without captured bytes, one unique mapped artifact path can produce a
    medium-confidence location match.
 4. Multiple candidates remain `ambiguous`; no `observed_as` edge is emitted.
-   `candidate_static_count` reports the full qualified layer/node count while
-   `candidate_static_nodes` retains a deterministic bounded prefix.
+   `candidate_static_count` reports the full qualified layer/node count, and
+   `candidate_static_nodes` includes every unique candidate reference.
 5. If captured bytes disagree with the static candidate at the mapped path,
    the result is an explicit mismatch. A path never overrides a digest
    disagreement.
-6. Missing authorization mappings, incomplete input coverage, and output
-   limits remain unknown or truncated rather than becoming absence claims.
+6. Missing authorization mappings and incomplete or truncated input coverage
+   remain unknown or truncated rather than becoming absence claims.
 
 Every successful cross-layer `observed_as` edge has
 `authority: cross-layer-reconciliation` and `state: inferred`. The underlying
@@ -124,7 +117,7 @@ classification:
 - `resident-in-loaded-asset` means a containing asset was observed, but the
   embedded module was not independently observed or shown to execute;
 - `not-observed-in-capture` means the entity did not appear in the complete
-  bounded captures supplied to this call and its artifact path falls beneath
+  authorized captures supplied to this call and its artifact path falls beneath
   an exercised automatic or operator-declared mapping prefix;
 - `unknown` covers incomplete captures, layers outside runtime scope, and
   unresolved correspondence. Nodes outside a mapped artifact prefix stay
@@ -149,25 +142,25 @@ EventEmitter activity, Electron IPC, or script-unload evidence. A unique
 authorized file or URL location can still correlate script presence with a
 static asset, but it does not prove module initialization or feature execution.
 
-Source-map declarations and approved original-source reads stay under static
-source-map authority. They are reported in `source_map_authority` but never used
+Source-map declarations and original-source reads remain static evidence. They
+are reported in `source_map_authority` but never used
 as primary runtime byte matches. A source name or `sourcesContent` digest is not
 silently equated with the generated bytes observed by CDP.
 
 ## Bounds and determinism
 
-Inputs allow up to eight static layers and 32 passive captures. Default output
-bounds retain 10,000 runtime entities, 20,000 reconciliation records, and
-20,000 static load states; each caller-visible maximum is 50,000. At least one
-target node per capture must fit. The combined graph also preserves the JAG v1
-caps of 1,000 roots, 100,000 nodes, 200,000 edges, and 64 observations per
-node. Reaching a limit reports exact omitted counts for runtime entities,
-reconciliation items, static load states, and merged graph items, plus
-`coverage.status: truncated`.
+The workflow does not impose aggregate count caps on static layers, passive
+captures, runtime entities, reconciliation items, static load states, runtime
+mapping declarations, or candidate references. These collections remain
+subject to the structural validation applied to each Evidence record and
+application graph; passive observation returns all in-window collection items
+that pass per-value validation. Reconciliation reports zero
+omitted items when it projects the complete supplied inputs. Static JavaScript
+analysis can still report its own bounded AST coverage as partial or truncated.
 
 Layers, captures, nodes, edges, matches, and evidence links are canonically
-ordered. Repeating the same verified Evidence, mappings, and limits produces
-the same reconciliation, graph, and Evidence identifiers.
+ordered. Repeating the same verified Evidence and mappings produces the same
+reconciliation, graph, and Evidence identifiers.
 
 ## Non-goals
 

docs/managed-code-analysis.md

@@ -1,26 +1,31 @@
 # Managed-code analysis plan
 
-This document turns
-[ADR-0003](adr/0003-managed-code-evidence-and-provider-boundary.md) into an
-implementation and verification plan. REA currently ships read-only PE/CLI
-triage and exact identity through `inspect_managed_artifact` and
-`rea inspect-managed-artifact`, plus bounded metadata, signature, method-body
-CIL, exception-region, call-edge, and field-access inspection through
-`inspect_managed_members` and `rea inspect-managed-members`, and
-declared ModuleRef/ImplMap/PInvoke and native implementation boundary inventory
-through `inspect_managed_native_boundaries` and
-`rea inspect-managed-native-boundaries`, plus obfuscation-resistant member
-comparison through `compare_managed_members` and `rea compare-managed-members`,
-managed/native export or function Evidence matching through
-`verify_managed_native_boundaries` and `rea verify-managed-native-boundaries`,
-decompiler reconstruction import through `import_managed_reconstruction` and
-`rea import-managed-reconstruction`, and default-disabled runtime-correlation
-admission planning through `plan_managed_runtime_correlation` and
-`rea plan-managed-runtime-correlation`, plus static managed graph projection
-through `project_managed_application_graph` and
-`rea project-managed-application-graph`. Native-body bridge mapping and runtime
-execution remain planned behavior. The current product inventory remains the
-one in [`product-catalog.json`](product-catalog.json).
+REA inspects .NET PE/CLI artifacts without loading or executing their code.
+It can identify an assembly, inspect metadata and CIL, compare members across
+builds, and connect declared native calls to supplied native-analysis evidence.
+CIL is Common Intermediate Language, the instruction format used by managed
+assemblies.
+
+The seven shipped tools are:
+
+| Task                                                                        | MCP tool                            |
+| --------------------------------------------------------------------------- | ----------------------------------- |
+| Identify an artifact and its managed deployment form                        | `inspect_managed_artifact`          |
+| Inspect types, signatures, method bodies, calls, and field access           | `inspect_managed_members`           |
+| List declared native calls and native implementation indicators             | `inspect_managed_native_boundaries` |
+| Compare members across builds and map build-local tokens                    | `compare_managed_members`           |
+| Check native call declarations against supplied export or function evidence | `verify_managed_native_boundaries`  |
+| Import decompiled code against verified static member identities            | `import_managed_reconstruction`     |
+| Add managed findings to an application graph                                | `project_managed_application_graph` |
+
+Each has a matching CLI command: replace underscores with hyphens and prefix
+the name with `rea`, for example `rea inspect-managed-artifact`.
+Native-body bridge mapping remains planned; managed runtime execution is not
+part of the current tool set.
+
+This guide describes the implementation and verification of
+[ADR-0003](adr/0003-managed-code-evidence-and-provider-boundary.md). The canonical
+tool inventory is [`product-catalog.json`](product-catalog.json).
 
 ## Analysis objective
 
@@ -32,8 +37,8 @@ collapsing them:
 3. What source-like or behavioral structure can be reconstructed or inferred?
 4. Which findings survive an exact-build check or a cross-build structural
    comparison?
-5. Which remaining questions require native analysis or a separately
-   authorized runtime experiment?
+5. Which remaining questions require native analysis or runtime evidence that
+   static inspection cannot supply?
 
 The ordinary workflow ends at question four. Static analysis never loads or
 executes the target.
@@ -91,7 +96,7 @@ commitment groups:
 - module name, generation, and MVID;
 - target framework and runtime/version strings with their exact metadata
   locations;
-- parser/provider version, profile schema, limits, and profile digest.
+- provider identity, analysis-affecting parameters, and their profile digest.
 
 CLI `#GUID` heap values are committed as their exact 16-byte GUID text. REA
 does not impose RFC 4122 UUID version or variant bits on MVID, EncId, or
@@ -106,23 +111,22 @@ EncBaseId because ECMA-335 metadata does not require those bit patterns.
 - exact raw bytes or bounded value digest;
 - raw CIL digest plus separately reported method-header, locals-token, and
   exception-region observations where available;
-- a deterministic v1 decoded-instruction-tuple digest for completely decoded
+- a deterministic decoded-instruction-tuple digest for completely decoded
   CIL, with the limitations below.
 
-### Shipped decoded-CIL fingerprint v1
+### Shipped decoded-CIL fingerprint
 
 `inspect_managed_members` exposes two method CIL hashes with different byte
 boundaries:
 
-| Field                  | Shipped v1 input                                                                                          | Excluded from the digest                                                                                                                                      |
+| Field                  | Input                                                                                                     | Excluded from the digest                                                                                                                                      |
 | ---------------------- | --------------------------------------------------------------------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------- |
 | `il_sha256`            | The exact `il_size` raw CIL bytes after the tiny or fat method header                                     | Method header, locals signature blob, alignment, and extra sections including exception clauses                                                               |
 | `normalized_il_sha256` | UTF-8 `JSON.stringify` output for the instruction-order array of `[opcode, operand_kind, operand]` tuples | Instruction offsets except projected scalar branch targets, switch targets, resolved metadata/string identities, method header, locals, and exception regions |
 
 The normalized field is available only when the entire CIL stream decodes with
-status `present`. A partial, malformed, absent, or over-limit body reports
-`null`. The containing member result's `schema_version: 1` scopes the tuple
-format; v1 does not expose a separate algorithm-version field.
+status `present`. A malformed or absent body reports `null`. The tuple format
+is defined here.
 
 Tuple operands use these exact projections:
 
@@ -134,17 +138,17 @@ Tuple operands use these exact projections:
 - signed integer and variable operands: decimal strings; floating-point
   operands: JavaScript's `String` representation of the decoded IEEE value.
 
-Opcode names retain short/long forms and prefix opcodes. This makes v1 a
+Opcode names retain short/long forms and prefix opcodes. This makes the value a
 reproducible decoded-tuple fingerprint, not a canonical semantic CIL identity:
 it does not resolve tokens across MVIDs, does not commit full control flow or
 exception semantics, and does not replace the raw CIL digest. Cross-build
 comparison uses the value only as one unique-only structural tier and reports
-ambiguity when that evidence is insufficient. A future normalized-CIL v2 must
-have an explicit algorithm version, canonical token/literal identities,
+ambiguity when that evidence is insufficient. A future normalized-CIL
+commitment would need canonical token/literal identities,
 complete branch and switch targets, and explicit locals/exception semantics.
 
 For example, a decoded `nop; ret` body serializes exactly as
-`[["nop","none",null],["ret","none",null]]` and has v1 digest
+`[["nop","none",null],["ret","none",null]]` and has digest
 `5e5fad7741cb44bca3a4f045546b7449990da343f612f5f34c0ca30e9eee0636`.
 This vector specifies the tuple order, `null` handling, absence of whitespace,
 UTF-8 encoding, and lowercase hexadecimal output.
@@ -152,7 +156,7 @@ UTF-8 encoding, and lowercase hexadecimal output.
 ### Epistemic commitment
 
 - authority: static bytes, reconstruction, structural inference, independent
-  validation, native provider, or separately authorized runtime;
+  validation, native provider, or future runtime observation;
 - state: observed, inferred, unknown, or unavailable;
 - confidence independent of authority;
 - coverage and admitted/dropped counts;
@@ -170,7 +174,7 @@ that implement them. The underlying capability slices are:
 1. **Triage and inventory**: container/component classification, assembly and
    module identity, references, files, exported types, resources, attributes,
    and runtime markers.
-2. **Member inventory**: bounded types, methods, fields, properties, events,
+2. **Member inventory**: file-backed types, methods, fields, properties, events,
    interfaces, nesting, generics, and normalized signatures.
 3. **Method inspection**: headers, max stack, locals, CIL instructions,
    constants, metadata operands, exception regions, and implementation flags.
@@ -191,9 +195,11 @@ that implement them. The underlying capability slices are:
    Evidence-backed application graph vocabulary as JavaScript/Electron
    findings while preserving managed static-analysis authority.
 
-Every list has a deterministic order and hard limits. Search exposes scanned,
-matched, returned, and dropped counts. An unresolved indirect call or a failed
-signature decode is not silently omitted from a completeness claim.
+Inventory lists preserve deterministic order and include every fact available
+from the admitted PE/CLI streams. Malformed ranges and unsupported metadata are
+reported as coverage issues instead of being silently omitted. Search exposes
+scanned, matched, returned, and dropped counts. An unresolved indirect call or
+a failed signature decode is not silently omitted from a completeness claim.
 
 ## Obfuscation-resistant method slices
 
@@ -205,7 +211,7 @@ bounded set of observations needed to investigate a proposition:
 - exact strings, numeric constants, enum-like values, and serialization keys;
 - branch, switch, exception, loop, call, and field-flow shape;
 - construction and generic-instantiation sites;
-- raw CIL and decoded-tuple-v1 commitments, plus separate header, locals, and
+- raw CIL and decoded-tuple commitments, plus separate header, locals, and
   exception observations;
 - callers, callees, shared fields, and competing candidates; and
 - limitations from reflection, dynamic dispatch, generated code, protection,
@@ -215,32 +221,34 @@ The workflow produces separate observation, inference, validation, and unknown
 tables. It may say that a method is a strong candidate for a role; it cannot
 turn that role into the method's durable identity.
 
-Cross-version matching is two-stage:
+Cross-version matching first prefers exact CIL/signature identity. When that
+does not match, it pairs an exact declared type, method name, and raw signature
+before trying structural body shape. The exact-signature key uses names only
+as part of that full tuple; names alone never select a pair. Duplicate tuples
+remain ambiguous rather than being paired by token order.
 
-1. Exact identity requires compatible artifact/module commitments and exact
-   raw CIL identity; v1 does not expose a standalone complete-method-body
-   digest.
-2. Structural identity compares schema-versioned signatures, the limited v1
-   decoded-CIL tuple fingerprint, constants, and bounded shape context. It
-   reports all candidates at the winning score and remains ambiguous when the
-   evidence does not distinguish them. The v1 digest does not itself remap
-   metadata tokens.
+For a matched method, an unavailable or partial body makes body-shape facets
+unknown while preserving observed signature differences. Structural identity
+compares normalized signatures, the limited decoded-CIL tuple fingerprint,
+constants, and bounded shape context. It reports all candidates at the winning
+score and remains ambiguous when the evidence does not distinguish them. The
+digest does not itself remap metadata tokens.
 
 Tokens are always remapped through observed structure. A caller cannot carry
 `0x06001234` into a new MVID and assume it names the same method.
 
 ## Managed/native boundary rules
 
-| Boundary                | Managed observation                                                     | Native observation                                                               | Permitted link                                                       |
-| ----------------------- | ----------------------------------------------------------------------- | -------------------------------------------------------------------------------- | -------------------------------------------------------------------- |
-| P/Invoke                | Module, entry point, charset/calling-convention flags, declaring method | Import/export/symbol/function evidence from the selected deep provider           | Exact declared-name/module link or qualified resolution inference    |
-| COM                     | Interop attributes, GUIDs, imported interfaces, method signatures       | Native registration/vtable evidence when independently available                 | Identifier/signature inference with explicit environment limitations |
-| C++/CLI                 | Managed declaration and implementation flags                            | Native body/function evidence                                                    | Only a provider-supported bridge observation; never token-as-address |
-| ReadyToRun              | Component/header and per-method CIL/native availability                 | Native section/function evidence                                                 | Authenticated image mapping with format/profile version              |
-| Unmanaged export        | Export metadata/attribute when present                                  | PE export and native thunk/function                                              | Exact export identity plus provider-qualified address                |
-| Single-file host        | Bundle entry/component identity                                         | Host and native component evidence                                               | Outer bundle plus component digest/extent commitment                 |
-| Unity IL2CPP            | Supported metadata entity with authenticated pairing                    | Generated native function/type evidence                                          | Versioned IL2CPP mapping only; no invented CIL                       |
-| Runtime-resolved native | API/constant/data-flow candidate                                        | Loaded-module/symbol observation only under separate runtime execution authority | Static candidate remains inference until separately observed         |
+| Boundary                | Managed observation                                                     | Native observation                                                              | Permitted link                                                       |
+| ----------------------- | ----------------------------------------------------------------------- | ------------------------------------------------------------------------------- | -------------------------------------------------------------------- |
+| P/Invoke                | Module, entry point, charset/calling-convention flags, declaring method | Import/export/symbol/function evidence from the selected deep provider          | Exact declared-name/module link or qualified resolution inference    |
+| COM                     | Interop attributes, GUIDs, imported interfaces, method signatures       | Native registration/vtable evidence when independently available                | Identifier/signature inference with explicit environment limitations |
+| C++/CLI                 | Managed declaration and implementation flags                            | Native body/function evidence                                                   | Only a provider-supported bridge observation; never token-as-address |
+| ReadyToRun              | Component/header and per-method CIL/native availability                 | Native section/function evidence                                                | Authenticated image mapping with format/profile version              |
+| Unmanaged export        | Export metadata/attribute when present                                  | PE export and native thunk/function                                             | Exact export identity plus provider-qualified address                |
+| Single-file host        | Bundle entry/component identity                                         | Host and native component evidence                                              | Outer bundle plus component digest/extent commitment                 |
+| Unity IL2CPP            | Supported metadata entity with authenticated pairing                    | Generated native function/type evidence                                         | Versioned IL2CPP mapping only; no invented CIL                       |
+| Runtime-resolved native | API/constant/data-flow candidate                                        | Loaded-module/symbol observation from an independently collected runtime source | Static candidate remains inference until separately observed         |
 
 Declared import inventory supports a bounded positive claim. Its absence does
 not exclude dynamic resolution, generated code, protected code, native helpers,
@@ -327,7 +335,6 @@ absolute or relative to the manifest file. A compact manifest contains:
 
 ```json
 {
-  "schema_version": 1,
   "label": "operator-local osu!stable semantic slice",
   "target": {
     "path": "./osu!.exe",
@@ -373,10 +380,10 @@ Before evaluating methods, the verifier fails closed on target SHA-256, MVID,
 assembly name, runtime-family, and managed-architecture mismatches whenever the
 manifest supplies those fields. It then pages each declared MethodDef token
 directly by row, so selected methods do not need to appear in the first member
-page of a large application. `il_length` remains accepted as a legacy alias for
-`il_size`; optional `il_sha256` locks the exact raw CIL bytes in addition to
-REA's member-result-v1 decoded-instruction-tuple digest. That normalized field
-has the v1 limits documented above and is not a complete semantic CIL identity.
+page of a large application. Optional `il_sha256` locks the exact raw CIL bytes
+in addition to REA's decoded-instruction-tuple digest. That normalized field
+has the byte boundaries documented above and is not a complete semantic CIL
+identity.
 
 The optional `application_graph` block reuses those exact-build method
 commitments. For each referenced MethodDef token, the verifier builds a bounded
@@ -398,25 +405,13 @@ The benchmark may prove that REA reproduces selected facts for that exact local
 build. It cannot establish general support on its own; source-built conformance
 remains the admission requirement.
 
-## Runtime admission boundary
+## Runtime behavior boundary
 
-The later runtime track is not an extension flag on a static operation. Its
-design must expose whether it attaches to an existing process, launches a new
-process, loads an assembly, uses reflection, installs a debugger/profiler, or
-instruments code. Each effect needs separate approval and exact-build checks.
-
-At minimum, admission requires target SHA-256, MVID, normalized signature and
-body/CIL commitment, CLR family, OS, architecture, tool version, scenario
-limits, output policy, and cleanup ownership to match. Any mismatch fails before
-the experiment. It must not contact real services/accounts or claim that an
-instrumented path represents an ordinary launch unless that proposition is
-independently tested.
-
-The shipped `plan_managed_runtime_correlation` path admits only a
-default-disabled, permission-gated experiment plan and records that no target
-code was executed. Until a separate executor is designed and shipped, runtime
-behavior questions remain explicit unknowns with suggested probes; static
-support does not perform them.
+Managed inspection does not execute assemblies or observe CLR internals.
+Questions about actual behavior remain unknown until supported runtime
+evidence is collected. A direct process capture can retain declared inputs,
+outputs, filesystem and protocol activity for a target run; it does not prove
+which managed methods executed or how the CLR resolved them.
 
 ## Delivery sequence
 
@@ -424,8 +419,8 @@ The managed-code track advances as reviewable pull requests:
 
 1. accepted evidence/provider boundary (this document and ADR);
 2. read-only artifact triage and exact identity (shipped);
-3. bounded metadata, signatures, method bodies, raw CIL hashes, and the limited
-   decoded-instruction-tuple fingerprint v1 (shipped; normalized-CIL v2
+3. file-backed metadata, signatures, method bodies, raw CIL hashes, and the
+   decoded-instruction-tuple fingerprint (shipped; complete normalized-CIL
    semantics remain planned);
 4. obfuscation-resistant slices and cross-version comparison (shipped for
    static member observations);
@@ -438,9 +433,15 @@ The managed-code track advances as reviewable pull requests:
    PE/CLI corpus shipped through `npm run verify:managed`; optional BYO
    `ilspycmd` real-tool oracle shipped through `REA_ILSPY_CMD_PATH`; dnSpy and
    pinned Windows checks remain planned); and
-8. separately authorized runtime-correlation admission planning (shipped; no
-   runtime execution);
-9. managed static Evidence projection into the application graph (shipped).
+8. managed static Evidence projection into the application graph (shipped).
 
 Each implementation PR updates generated product facts only for behavior it
 actually ships and states which real-tool checks were performed.
+
+### Method metadata during build comparison
+
+Managed member comparisons report a `metadata` dimension when an observed
+MethodDef flags or implementation flags value differs, including accessibility
+or synchronization changes. This is separate from the CIL/signature matching
+tiers: identical instructions do not establish unchanged method metadata. The
+reported difference is static metadata evidence, not proof of runtime behavior.

docs/mcp-contracts.md

@@ -2,25 +2,24 @@
 
 ## Identity and discovery
 
-`rea://server/identity` and `binary_session` report the package, server, SDK,
-negotiated protocol, skill, and schema-sensitive catalog identities separately.
-An absent live comparison is `unknown`, never aligned. Callers can supply the
-expected package version, catalog digest, or registered server path to
-`binary_session`; a mismatch means the registered MCP process must be restarted.
-`rea doctor` separately inspects supported JSON/TOML client registrations,
-reports their command vectors as aligned, stale, missing, or invalid, and keeps
-live-server state `unknown` unless the active connection supplies identity.
+`binary_session` reports the active package, server, SDK, and negotiated
+protocol details. `rea doctor` separately inspects supported JSON/TOML client
+registrations, reports their command vectors as aligned, stale, missing, or
+invalid, and keeps live-server state `unknown` unless the active connection
+supplies identity.
 
-Canonical tool names remain stable, while `tools/list` advertises only the
-operations callable for the current target, provider, policy, host, and
-negotiated client capabilities. `binary_session.tool_availability` remains the
-complete inventory: it explains advertised and hidden operations with stable
-availability reasons and remediation. Each entry also reports required and
-optional negotiated client features plus the currently missing features. Form elicitation is optional for
-`capture_process_scenario`: an existing grant remains usable without it, while
-a missing grant cannot be elicited by a client that does not advertise it.
-Opening or closing a target, reloading policy, or observing a provider health
-transition emits `notifications/tools/list_changed`.
+`tools/list` returns the complete canonical tool inventory, including tools that
+are currently unavailable. Opening or closing a target or observing a provider
+health transition leaves that catalog unchanged and does not emit
+`notifications/tools/list_changed`.
+
+Call `binary_session` with `{}` and read `result.tool_availability` to choose a
+callable operation for the current target, provider, host, and negotiated client
+capabilities. The default result includes the complete inventory with each
+tool's availability, reason, and remediation. Each entry also reports required
+and optional negotiated client features plus the currently missing features.
+The optional inputs `expected_package_version`, `expected_catalog_digest`, and
+`expected_server_path` compare the live session with the caller's expectations.
 
 `binary_session.analysis_provider_candidates` is authoritative for deep-engine
 discovery. Target-free discovery is sorted by provider ID, reports host
@@ -48,7 +47,7 @@ REA accepts ordinary `tools/call` progress tokens. Updates are monotonic,
 rate-bounded to at most one intermediate update per 100 ms, and always allow a
 terminal update. Unknown totals are omitted; REA does not fabricate percentages.
 Provider calls receive the request cancellation signal. Artifact traversal,
-hashing, cross-version scanning/checkpoints, Hopper requests, and process capture
+hashing, version comparisons, Hopper requests, and process capture
 check the same signal. Cancellation is distinct from timeout. A cleanup failure
 uses `cleanup_incomplete` and lists only the owned resource kinds that remain.
 Derived comparisons and reconstruction verification yield before computation
@@ -58,106 +57,73 @@ CLI calls work without a progress token and translate SIGINT into the same
 AbortSignal used by providers. Existing controlled-process cleanup and provider
 shutdown rules still apply; REA never kills a process it cannot prove it owns.
 
-## Evidence resources
+## Tool results
 
-Evidence remains inline for compatibility and successful Evidence-producing
-tools also return `resource_link` content. Session resources are connection-local:
+Evidence-producing tools return `{ result, evidence_id, evidence }` in both
+text and structured content. `evidence` is the complete canonical Evidence
+record, including `normalized_result`, which equals `result`. The same record
+is retained in the session bundle. Read `result` directly, or pass `evidence`
+to a compatible comparison tool: `analyze_function` Evidence can be passed
+directly to `compare_functions`, and `inspect_artifact` Evidence to
+`compare_artifacts`. Use `get_evidence_bundle` when the task needs broader
+retained session history or an explicit bundle for transfer.
 
-- `rea://evidence/{evidenceId}` returns the complete immutable Evidence v2 record.
-- `rea://evidence/{evidenceId}/section/{section}` returns a bounded result section.
-  Stable sections include `result`, `terminal`, `filesystem`, `process`,
-  `protocol`, `nodes`, `occurrences`, and `edges` when present.
-- `rea://unknown/{unknownId}` returns the current residual-unknown head and its
-  immutable revision history.
-- `rea://unknowns/active` returns current unresolved heads.
-- `rea://snapshot/{snapshotDigest}` returns the current immutable analysis
-  snapshot when its canonical content digest matches.
-- `rea://artifact/{manifestId}/{collection}` returns a canonical artifact
-  `nodes`, `occurrences`, or `edges` page with Evidence provenance.
-- `rea://function/{targetSha256}/{address}` returns a retained function dossier
-  for the exact target and address.
-- `rea://workspace/{workspaceId}/revision/{revision}` returns an immutable,
-  CAS-linked investigation workspace revision retained by this session.
+## Aggregate native context
 
-Successful automatic cross-version investigations include both Evidence and
-workspace `resource_link` blocks. Workspace resources preserve revision and
-`previous_revision_digest` commitments; persistent workspace files remain
-subject to configured read/write roots.
+`get_navigation_context` composes the selected document, current address, and
+current/containing procedure. Its capability inventory exposes a
+`current_selection` mode and an `explicit_document` mode; the latter works when
+the caller supplies `document` and the provider lacks `current_document`. A
+cursor outside a procedure is represented as
+`procedure: null`. `inspect_address_context` requires an explicit address and
+returns name, procedure, comment, inline-comment, and bookmark facets;
+unsupported facets are local `unavailable` outcomes. Use `current_document`,
+`current_address`, and `current_procedure` for direct single-field lookups; use
+the aggregate tools when you need related context together.
 
-An Evidence URI is discoverability, not authorization. It cannot authorize file
-access, extraction, mounting, execution, or networking. IDs disappear when the
-session ends unless the existing Evidence bundle or workspace persistence flow
-explicitly retains them.
+## Request scope and local effects
 
-## Permission policy
+Each tool request names the target and lifecycle it will use. Browser calls
+carry a loopback CDP endpoint and target ID, with optional origin filters;
+process and Electron scenarios carry the executable, arguments, actions, and
+cleanup behavior; artifact tools carry the input path and requested operation.
+REA runs the declared request directly and does not infer a broader target or
+action from it.
 
-All local side effects use one scope vocabulary: capability, canonical roots,
-executables, environment variable names, network mode, mount permission, exact
-operation identity, and grant lifetime. Environment values and captured content
-are never part of a grant or denial.
+REA does not require permission grants or per-call approval flags. Setup still
+prints its plan and requires confirmation before changing configuration or
+installing Hopper. MCP clients control their own confirmation UI.
 
-Existing environment settings map to administrator ceilings. They remain the
-maximum authority:
+Tool annotations describe effects and are hints, not authorization controls
+([MCP ToolAnnotations](https://modelcontextprotocol.io/specification/2025-06-18/schema#toolannotations)).
+`readOnlyHint` includes session state: an analysis call that records additive
+Evidence is marked non-read-only even when it leaves the target unchanged.
+`destructiveHint` describes possible data loss, not ordinary Evidence recording.
+Effect metadata covers possible behavior across supported inputs: DMG inventory
+can launch `hdiutil` and create an owned temporary mount directory; extraction
+creates a fresh output directory on every call. Comparing supplied web captures
+or PNG artifacts uses local data without contacting the browser.
 
-- process roots, executables, environment names, and external networking;
-- Evidence read/write roots;
-- investigation input and workspace roots;
-- snapshot read/write roots;
-- reference-source roots;
-- native mount enablement.
+Host requirements remain in force. macOS may deny Accessibility,
+Screen Recording, or native mounting; provider tools require their selected
+analysis runtime. These failures are reported at the operation that needs
+them. A configured provider or an endpoint alone does not establish that a
+target is supported.
 
-Artifact extraction retains its existing explicit per-call approval and maps to
-an administrator root ceiling of `/` for compatibility.
+Evidence bundles, snapshots, and extraction use the paths and output behavior
+declared by their tools. Artifact extraction materializes the selected regular
+files into a fresh REA-chosen temporary directory and reports its path.
 
-`rea policy status`, `list`, `explain`, and `revoke` inspect the same evaluator
-used by MCP. Optional project grants require both
-`REA_PERMISSION_PROJECT_ROOT` and `REA_PERMISSION_PROJECT_STORE`. The store is
-atomically written with mode `0600`, bound to the canonical project root, and is
-never enabled by default. Send `SIGHUP` to the REA MCP process after a trusted
-project-store change; project grants reload without restarting. Environment
-settings belong to the process environment, so changing an administrator
-ceiling in an MCP registration requires restarting that registered server or
-its owning client.
-Revocation affects future operations; an already-running operation retains the
-decision made at its preflight boundary.
-Once and session grants are connection-local overlays. They cannot authorize a
-second MCP connection, be consumed by another connection, or be cleared when a
-different connection closes. Live connections evaluate those overlays against
-the current process-wide ceilings and persisted grants, including successful
-SIGHUP reloads.
-`rea policy revoke <grant-id>` displays the exact grant and requires interactive
-confirmation; automation must pass `--yes` (or `-y`) explicitly.
-
-Denials use the shared `permission_required` schema with requested scope, missing
-scope, administrator ceiling, elicitation support, and exact restart status.
-Client-provided roots are context only and never grants.
-
-Elicitation can add a once or session grant only inside an existing
-administrator ceiling. A request outside that ceiling reports
-`elicitation_supported: false` and `restart_required: true`; interactive consent
-cannot silently widen administrator policy.
-
-`analyze_javascript_application` uses the `investigation_input` capability. Its
-absolute `input_path` must be inside `REA_INVESTIGATION_INPUT_ROOTS_JSON` and the
-request must set `approved: true` before any artifact read. Reading source-map
-contents additionally requires `source_map_read_approved: true`; ordinary input
-approval does not imply that separate authority.
+`analyze_javascript_application` reads the supplied local directory or ASAR path
+and returns its result and Evidence inline.
 
 ## Integrity record-and-continue
 
-Artifact integrity remains fail-closed by default. Record-and-continue requires
-all three conditions:
+Artifact integrity fails closed by default. A request can explicitly select
+`integrity_policy=record-and-continue` when the investigation needs verified
+siblings to continue after a mismatch.
 
-1. operator policy `REA_ARTIFACT_INTEGRITY_CONTINUE_ENABLED=true`;
-2. `integrity_policy=record-and-continue`;
-3. explicit per-call `integrity_continue_approved=true`.
-
-Contradictory bytes are quarantined from nested expansion, recorded with declared
-and observed hashes, trust, provenance, path, and unpacked state, and bounded by
-`max_integrity_mismatches`. Verified siblings continue. Comparisons classify the
-result as a contradiction and reconstruction cannot treat it as unchanged.
-`investigate-versions` accepts the same policy through
-`--integrity-policy record-and-continue --integrity-continue-approved` and
-`--max-integrity-mismatches`. Its Evidence pages and CAS-linked workspace retain
-contradictions, so a completed run can resume without rescanning or weakening
-trust labels.
+Contradictory bytes are quarantined from nested expansion and recorded with
+declared and observed hashes, trust, provenance, path, and unpacked state.
+Verified siblings continue. Comparisons classify the result as a contradiction
+and reconstruction cannot treat it as unchanged.

docs/mcp-prompts.md

@@ -6,19 +6,28 @@ invoke tools by themselves.
 
 ## Prompt inventory
 
-| Prompt                            | Purpose                                                                               |
-| --------------------------------- | ------------------------------------------------------------------------------------- |
-| `investigate_feature`             | Trace a feature from discovery into bounded function evidence.                        |
-| `compare_application_versions`    | Compare two shipped artifacts, with optional static and runtime follow-up.            |
-| `verify_reconstruction`           | Evaluate a finite reconstruction specification against retained comparison Evidence.  |
-| `trace_crash`                     | Correlate a crash symptom with static paths and optional Process Capture v4 evidence. |
-| `audit_residual_unknowns`         | Audit current residual-unknown heads and evidence-qualified resolution.               |
-| `prepare_bounded_process_capture` | Design an approval-gated, bounded process experiment before execution.                |
+| Prompt                            | Purpose                                                                              |
+| --------------------------------- | ------------------------------------------------------------------------------------ |
+| `investigate_feature`             | Trace a feature from discovery into relevant function evidence.                      |
+| `compare_application_versions`    | Compare two shipped artifacts, with optional static and runtime follow-up.           |
+| `verify_reconstruction`           | Evaluate a finite reconstruction specification against retained comparison Evidence. |
+| `trace_crash`                     | Correlate a crash symptom with static paths and optional process capture evidence.   |
+| `audit_residual_unknowns`         | Audit current residual-unknown heads and evidence-qualified resolution.              |
+| `prepare_bounded_process_capture` | Design a bounded controlled process experiment before execution.                     |
 
-Every rendered prompt provides an ordered list of current REA tool names. It
-also requires the agent to keep observations, inferences, and unknowns
-distinct. Requested prompt arguments and completion choices are rendered as
-untrusted selection data, not instructions or authorization.
+Every rendered prompt provides optional starting points using current REA tool
+names. Agents can call tools directly, skip irrelevant suggestions, and inspect
+provider or target state only when it helps answer the request or a tool
+requires it. The prompts also ask agents to keep observations, inferences, and
+unknowns distinct. Requested prompt arguments and completion choices are
+rendered as untrusted selection data, not instructions or authorization.
+Tool results include their Evidence inline. Prompts do not require a bundle or
+resource fetch to read a result; an Evidence ID is only a reference when a
+prompt argument or tool explicitly accepts one.
+
+For target paths in `compare_application_versions`, the prompt suggests
+opening each target before calling `inspect_artifact`; inspection operates on
+the active target and returns the graph and findings together inline.
 
 Use standard MCP discovery and retrieval:
 
@@ -45,11 +54,10 @@ cached prompt catalog.
 
 ## Session-aware completion
 
-MCP `completion/complete` currently completes prompt arguments and resource
-template variables. It does not define completion for arbitrary tool-call
-arguments. REA therefore attaches completion to optional guided-prompt
-arguments that feed later tool selection; it does not claim protocol-level
-completion for every REA tool.
+MCP `completion/complete` completes guided-prompt arguments; it does not define
+completion for arbitrary tool-call arguments. REA attaches completion to
+optional prompt arguments that accept a session value. Suggestions provide
+identifiers only; they do not retrieve or replace the inline Evidence result.
 
 ```json
 {
@@ -74,28 +82,22 @@ completion for every REA tool.
 
 Completion sources are live projections of the current session:
 
-| Argument family     | Source and filtering                                                                                                                                                                                   |
-| ------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ |
-| Document            | Current provider `list_documents` result.                                                                                                                                                              |
-| Procedure           | Bounded pagination over `list_procedures`; observed addresses are offered from partial results, while names require exhaustive discovery and a unique address. Optional document context is forwarded. |
-| Provider            | `auto` plus sorted deep candidates from the current binary session; target-free completion does not start them.                                                                                        |
-| Evidence            | Evidence IDs retained in the current session ledger.                                                                                                                                                   |
-| Process capture     | Evidence IDs whose operation and validated result identify Process Capture v4.                                                                                                                         |
-| Artifact manifest   | Manifest IDs from schema-valid retained artifact inventories.                                                                                                                                          |
-| Artifact occurrence | Occurrence IDs present in schema-valid retained artifact inventory pages.                                                                                                                              |
-| Residual unknown    | Current non-resolved unknown heads only.                                                                                                                                                               |
+| Argument family     | Source and filtering                                                                                                                                 |
+| ------------------- | ---------------------------------------------------------------------------------------------------------------------------------------------------- |
+| Document            | Current provider `list_documents` result.                                                                                                            |
+| Procedure           | The complete `list_procedures` inventory; all procedure addresses and uniquely named procedures are offered. Optional document context is forwarded. |
+| Provider            | `auto` plus sorted deep candidates from the current binary session; target-free completion does not start them.                                      |
+| Evidence            | Evidence IDs retained in the current session ledger, offered only for prompt arguments that accept Evidence references.                              |
+| Process capture     | IDs for retained Evidence whose operation and validated result identify process capture.                                                             |
+| Artifact manifest   | Manifest IDs from schema-valid retained artifact inventories.                                                                                        |
+| Artifact occurrence | Occurrence IDs present in schema-valid retained artifact inventory pages.                                                                            |
+| Residual unknown    | Current non-resolved unknown heads only.                                                                                                             |
 
 Suggestions are Unicode-normalized, case-insensitive prefix matches. The server
-deduplicates them, rejects values longer than 4,096 characters, and sorts by
-code point for deterministic results. It scans at most 10,000 candidates;
-procedure discovery is further bounded to 5,000 unique addresses in pages of 500. If that bound is reached before exhaustive procedure discovery, only
-observed addresses are suggested because global name uniqueness is unknown.
-
-The MCP result carries at most 100 `values`. `total` is the number of matching
-candidates found within REA's scan bound, and `hasMore` reports whether more
-than 100 were found. The MCP completion response has no offset or cursor, so a
-client narrows a large result by sending a longer prefix rather than requesting
-another page.
+deduplicates them and sorts by code point for deterministic results. Procedure
+completion derives candidates from the complete inventory, so a name is offered
+only when it identifies one address in that inventory. Completion returns all
+matching values; it does not expose paging controls.
 
 ## Lifecycle and safety
 
@@ -106,8 +108,6 @@ session are no longer suggested. Provider errors, unsupported operations, and
 malformed provider output produce an empty completion list rather than an
 unverified identifier.
 
-Suggestions never grant permission. In particular, selecting an artifact
-occurrence does not authorize extraction, selecting an unknown does not
-authorize mutation, and selecting a prior capture does not authorize process
-execution. The corresponding tools retain their existing approval, policy,
-effect, and validation boundaries.
+Suggestions are starting points, not tool calls. A tool acts on the target,
+operation, and lifecycle fields in its own request; selecting a suggestion does
+not execute it or broaden those fields.

docs/native-investigation.md

@@ -0,0 +1,173 @@
+# Native UI and dispatch investigation
+
+REA joins static resources, native metadata and code facts while keeping runtime
+observations separate. Every result reports its evidence, target identity,
+coverage and unknowns. The CLI and MCP use the same application workflows.
+
+## Static inspection
+
+- `inspect_asset_catalog` / `rea inspect-asset-catalog <app>` reads compiled
+  `Assets.car` metadata through macOS `assetutil --info`. Catalog digests, raw
+  rendition fields, pagination and exact UI resource-name matches are returned.
+  Image extraction and undocumented rendition interpretation are unsupported.
+- `inspect_keyed_archive` / `rea inspect-keyed-archive <plist>` reads XML or
+  binary Foundation keyed archives without instantiating classes. For an active
+  app, provide its relative archive path as the second CLI argument or MCP
+  `path`. Results retain original `$objects` indices, named `$top` roots,
+  shared/cyclic references, class descriptors, raw serialized fields and
+  malformed/unresolved/nil references. Missing fields stay absent; unknown
+  classes are preserved. Select `root`, `offset` and `limit` explicitly.
+  UID 0 cannot distinguish conditional nil from ordinary nil. Limits are
+  64 MiB of input, 200,000 objects/references and 128 nesting levels.
+- `decode_interface_builder` / `rea decode-interface-builder <app>` reads
+  compiled storyboard and nib resources into objects, outlets, actions,
+  connections and controller/class names. `verify:interface-builder` compiles
+  a source-owned AppKit XIB with `ibtool`. Storyboards require an installed
+  iOS platform; unsupported archive forms remain explicit.
+- `inspect_native_dispatch_metadata` / `rea inspect-native-dispatch-metadata
+  <app-or-binary>` prefers a validated macOS Mach-O byte reader. It decodes
+  64-bit little-endian Objective-C class/metaclass records, superclass pointers,
+  absolute/relative method entries, ivar offsets/sizes/alignment and protocol
+  declarations. It also decodes simple Swift conformances, static synchronous
+  witness slots, signed-relative pointers and non-generic, non-resilient class
+  vtable descriptors. Records include exact virtual addresses/file offsets and
+  artifact evidence. Vtable indexes are metadata word offsets; witness indexes
+  start after the conformance header. Names unavailable in metadata remain null.
+  Chained fixups, external bindings, authenticated pointers, categories,
+  properties, generic/resilient/async/coroutine tables and inherited overrides
+  have explicit unsupported or partial coverage. Other providers retain the
+  existing symbol-based inventory with its narrower coverage.
+
+## Native instruction, call and type primitives
+
+Ghidra supplies three exact-object operations:
+
+```bash
+rea inspect-native-instruction <binary> <address> --provider ghidra
+rea resolve-native-call-targets <binary> <call-site> --provider ghidra
+rea inspect-native-data-type <binary> --type /MyStruct --provider ghidra
+rea inspect-native-data-type <binary> --address <typed-data-address> --provider ghidra
+```
+
+Instruction facts include bytes, length, decoder text, ordered register/scalar/
+address tokens, typed references and flow destinations. Mid-instruction, data,
+outside-memory and undecodable addresses have separate outcomes. Effective
+memory base/index/displacement roles and per-instruction context mode remain
+unavailable; `mode` is the program language variant.
+
+Call resolution reports direct, resolved indirect, ambiguous, unresolved and
+non-call outcomes from static call references. It does not establish runtime
+execution or classify Objective-C/Swift/vtable/closure mechanisms from names.
+
+Type inspection selects one exact database pathname or typed data address.
+Struct/union fields, enums, pointers, arrays, typedefs, size, alignment, packing
+and bitfields retain database authority. Child types use exact IDs for further
+inspection, including recursive layouts. Source/debug authority and flexible
+array semantics are not inferred. The real lane uses a native DWARF 4 object
+with a struct containing a union, enum and recursive pointer; a stripped linked
+binary may have no corresponding recovered layout.
+
+## Bounded static traces
+
+`trace_native_ui_action` / `rea trace-native-ui-action <target> <seed>` accepts
+one authored selector/object ID, native symbol or exact function address. It
+joins UI wiring to uniquely matched class/selector implementations and follows
+bounded typed call references. Direct references, resolved indirect references,
+ambiguous candidates, inferred untyped provider callees and targetless call
+sites remain distinct. A static route does not establish runtime reachability.
+Swift/closure dispatch requires resolved static references; unavailable ABI
+forms remain unknown.
+
+`trace_native_values` / `rea trace-native-values <binary> <procedure> --provider
+ ghidra` composes high-p-code def-use graphs across statically resolved calls.
+Logical CALL arguments bind to recovered parameter ordinals; recovered RETURN
+values bind to CALL outputs. These edges are decompiler-derived. Constants,
+operators, LOAD/STORE and branch operands are included inline. Alias effects,
+persistent state, RNG roles, missing/variadic bindings and ambiguous destinations
+remain unknown. Budgets control depth, decompilations, call-site resolutions,
+nodes and edges. Node payloads are bounded to 8 MiB and serialized results to
+32 MiB. Pagination returns edges whose source is on the node page and preserves
+stable IDs for endpoints outside that page.
+
+The raw Java `is_dead` flag can remain set after Ghidra decodes a live block;
+`block_membership` reports actual syntax-tree membership separately.
+
+The provider dossier itself retains up to 3,000 p-code operations, 64 inputs per
+operation and 12,000 def-use edges, with explicit omitted counts. A `STORE`
+may describe stack memory and does not itself prove persistent state.
+
+Jump-table evidence keeps numeric `mappings`, explicit `default_targets`, and
+backing `data_sources` separate. A null case value denotes an unresolved
+case, never a known default. Ghidra pairs typed case/default tokens with the
+recovered block entry and its unique indirect dispatch predecessor; it does
+not zip unequal label and destination arrays. Shared case bodies retain each
+label. Negative numeric tokens are checked against their encoded magnitude;
+nonliteral, ambiguous, or nonexact JSON integer labels remain unknown.
+Unknown-label diagnostics retain the token text, encoded unsigned magnitude,
+target and dispatch so callers can inspect the original observations.
+Decompiler load-table metadata supplies observed entry sizes and counts
+without assigning every backing table to each mapping. These observations
+describe the decompiler's recovered switch, not guaranteed original source.
+Legacy records without `default_targets` normalize to an empty array and
+retain their existing unresolved mappings.
+
+AArch64 jump-table recovery additionally verifies byte and halfword relative
+forms from unsigned bounds, register definitions, table loads, branch bases,
+scaled ADD/BR instructions and the recovered target set. It reads exactly the
+proven count and preserves unknowns for other forms. Real ELF and host ARM64
+Mach-O fixtures check each case against source-owned return values.
+
+## Native desktop observation
+
+`observe_native_ui` captures one explicitly selected existing PID/window ID.
+Screenshots use a selected-window ScreenCaptureKit
+filter on macOS 14+; accessibility reads stay within that window. Missing Screen
+Recording/Accessibility permissions produce actionable errors without broad
+capture or automatic permission prompts. Executable bytes and process launch
+time guard against a different target or PID reuse. AX selection requires one
+unique geometry match; ambiguity fails closed.
+
+`capture_native_ui_scenario` takes AX child-index paths for press, increment/
+decrement scrolling and text-value entry, or bounded waits. No global event
+injection is used. Unsupported AX actions fail explicitly. The result preserves
+ordered before/after captures and gaps; an action may have occurred before a
+post-action capture fails. Application state is left as-is; REA does not attempt
+to restore it.
+
+Scenarios accept caller-selected action lists and accessibility node counts.
+Individual waits cannot exceed the operation's 180-second deadline, and the
+complete scenario result has a 64 MiB output budget. Screenshots are scaled to
+at most 2,048 pixels and captured only for the selected window. REA compiles one
+owned helper per scenario, removes its temporary compiler cache and stops its
+helper on cancellation. It does not launch or own the selected application. UI
+actions may change application data or trigger network activity.
+
+## Provider and verification boundaries
+
+Install Ghidra 12.1.4 and a full 64-bit JDK 21 separately, then configure REA to
+use them. Ghidra analysis supports Linux x64 and macOS x64/arm64; macOS requires
+the matching native decompiler. Experimental Windows x64 P0 admits native
+x86-64 PE applications on local NTFS using bundled Job Object ownership,
+protected runtime DACLs, and handle-based path admission. See [Windows Ghidra P0](windows-ghidra-p0.md) and
+[issue #527](https://github.com/morluto/rea/issues/527).
+On Linux and macOS, `annotate_native_function` atomically edits a function name
+and entry comments in the ephemeral database, returning refreshed analysis
+without changing executable bytes. Windows P0 remains read-only. Ghidra has no
+GUI authority, and REA never falls back automatically to Hopper.
+
+- `npm run verify:ghidra`: host-native debug/stripped targets, native type layout,
+  instruction/call facts, value dependencies and process/project cleanup.
+- `npm run verify:ghidra:aarch64-jump-table`: optimized ELF and byte/halfword
+  relative tables, plus ARM64 Mach-O on an ARM64 macOS host.
+- `npm run verify:apple-dispatch`: source-built Objective-C protocols/classes and
+  Swift conformances/vtables, repeated after stripping local symbols.
+- `npm run verify:native-ui`: one source-owned fixture window, successful
+  selected-window capture and actions, changed-target rejection, and cleanup.
+  Missing OS permissions fail this lane.
+- `npm run verify:native-ui:permissions`: permits a permission-denial result and
+  reports `positive_e2e: false` when capture is denied. That result verifies the
+  OS permission boundary, not successful UI capture or actions.
+
+macOS ARM64 is the real host verified during this implementation. Admission of
+macOS Intel does not claim an Intel verification run. Unsupported metadata and
+unresolved runtime/value semantics remain visible in results.

docs/process-capture.md

@@ -1,79 +1,34 @@
-# Process Capture v4
+# Process capture
 
-Process Capture records one approved command as deterministic Evidence. It is
-intended for authority-versus-reconstruction checks where terminal behavior,
-child lifetime, filesystem state, or dependency timing matters.
+Process Capture runs one caller-selected command and records bounded evidence
+about its terminal behavior, scheduled interactions, process lifetime, and
+selected filesystem state. Use it to compare two direct runs of the same
+scenario, such as an authority build and a reconstruction. It does not replay a
+previous execution or emulate dependencies.
 
-The harness records both raw PTY chunks and terminal states rendered by xterm.
-It also records scripted input, resize and signal delivery, sampled process
-metadata, named filesystem checkpoints, command-shim invocations, loopback
-HTTP/WebSocket exchanges, and process exit ownership. Missing or bounded
-observations remain explicit; a truncated capture is never treated as
-equivalent to another capture.
+The command runs with the current user's permissions and inherits the host
+environment before applying the scenario's explicit overrides. This is not a
+sandbox. Filesystem observation paths select what REA snapshots; they do not
+restrict what the process can read or write. The inherited environment is not
+recorded, so its influence may remain unknown.
 
-Every v4 capture includes a run manifest with canonical SHA-256 commitments for
-the secret-safe full scenario projection, comparison contract, executable,
-normalization rules, command-shim plan, and replay plan. The manifest also
-records the REA/provider versions, platform, architecture, PTY backend, and UTC
-start/completion timestamps. Capture creation, Evidence import, and comparison
-recompute the self-contained commitments and reject invalid lifecycle data.
+## Capture a command
 
-## Enable the capability
+Write a JSON scenario and pass its path to the CLI:
 
-Process execution is disabled until the operator supplies policy roots and
-approves host networking:
-
-```bash
-export REA_PROCESS_CAPTURE_ENABLED=true
-export REA_PROCESS_EXECUTABLE_ROOTS_JSON='["/usr/bin","/absolute/project/bin"]'
-export REA_PROCESS_WORKING_ROOTS_JSON='["/absolute/project"]'
-export REA_PROCESS_ALLOWED_ENV_JSON='["PATH"]'
-export REA_PROCESS_ALLOW_EXTERNAL_NETWORK=true
-```
-
-By default, enabling process capture also installs an administrator-lifetime
-grant for the configured boundary. Set
-`REA_PROCESS_CAPTURE_AUTO_GRANT=false` to install the same boundary only as an
-administrator ceiling. Captures then fail with a structured permission-required
-result until a narrower grant is established; this is the prerequisite mode for
-connection-scoped MCP elicitation. It does not itself authorize a capture.
-Each MCP connection owns its elicited once and session grants. A grant accepted
-on one connection is not visible to another connection, and disconnect cleanup
-removes only the grants owned by the connection that closed. Reloaded
-administrator ceilings and persisted grants still apply immediately to every
-live connection.
-
-REA offers the once-or-session grant form only after the connection negotiates
-an MCP revision with multi-round tool results and advertises form elicitation.
-Older connections keep returning the structured
-permission-required result and never wait for an unsupported elicitation
-response. The MCP SDK runtime currently pinned by REA negotiates the older
-protocol path, so the interactive flow remains fail-closed until its runtime
-protocol support is available.
-
-Every scenario must also contain `"approved": true`. Executables, working
-directories, filesystem roots, and requested environment variables are checked
-against operator policy before launch. Process Capture is an observation tool,
-not a security sandbox: the target runs with the current user's permissions.
-
-## Capture a scenario
-
-`rea capture-process` reads a JSON scenario and writes Process Capture v4
-Evidence to stdout:
-
-```bash
+```sh
 rea capture-process ./scenario.json > capture.json
 ```
 
-A representative scenario is:
+For example:
 
 ```json
 {
-  "approved": true,
-  "executable": "/absolute/path/to/node",
+  "executable": "node",
   "arguments": ["./signup.mjs"],
-  "working_directory": "/absolute/project",
-  "filesystem_roots": ["/absolute/project/state"],
+  "working_directory": ".",
+  "environment": { "APP_MODE": "test" },
+  "filesystem_observation_paths": ["./state"],
   "terminal": { "columns": 80, "rows": 24, "scrollback": 1000 },
   "events": [
     {
@@ -82,182 +37,63 @@ A representative scenario is:
       "data": "user@example.test\r",
       "sensitive": true
     },
-    { "type": "resize", "at_ms": 500, "columns": 100, "rows": 30 }
+    { "type": "resize", "at_ms": 500, "columns": 100, "rows": 30 },
+    { "type": "signal", "at_ms": 1000, "signal": "SIGINT" }
   ],
-  "checkpoints": [
-    {
-      "name": "signup_ready",
-      "trigger": { "type": "terminal_literal", "value": "All set!" }
-    },
-    { "name": "root_exited", "trigger": { "type": "root_exit" } }
-  ],
-  "command_shims": [
-    {
-      "name": "codex",
-      "routes": [
-        {
-          "arguments": ["--version"],
-          "outputs": [
-            { "at_ms": 0, "stream": "stdout", "data": "codex 1.2.3\n" }
-          ],
-          "termination": { "type": "exit", "code": 0 },
-          "max_calls": 1
-        }
-      ]
-    }
-  ]
+  "timeout_ms": 30000,
+  "idle_timeout_ms": 30000,
+  "settle_ms": 100
 }
 ```
 
-Input events marked `sensitive` are dispatched to the PTY but stored only as a
-byte-count placeholder. Environment values listed in `secret_aliases` are also
-redacted from recorded text. The command-shim directory is placed first in the
-captured process `PATH`; any remaining `PATH` must be explicitly supplied or
-inherited under operator policy.
+`executable` is required. `arguments`, `working_directory`, `environment`,
+`filesystem_observation_paths`, terminal settings, timed `events`, timeouts,
+resource limits, and normalization settings have defaults; see
+`processScenarioSchema` for the exact contract. Event times are milliseconds
+from launch, must be ordered, and must fall within `timeout_ms`. Inputs marked
+`sensitive` are sent to the process but persisted as a byte-count placeholder.
+Environment overrides are recorded in the scenario commitment; inherited
+values are not copied into Evidence.
 
-## Reactive process scenarios
+The capture contains raw PTY output chunks and rendered terminal states,
+interaction dispatch outcomes, exit reason, sampled process-tree observations,
+and settlement status. When filesystem paths are selected, REA records
+`files_before` and `files_after`, then classifies observed entries as created,
+deleted, modified, or unchanged. These are bounded snapshots, not a syscall
+trace; short-lived changes between snapshots may be missed. With no selected
+paths, filesystem effects remain unknown.
 
-Set `reactive` to a Process Reactive Scenario v1 declaration when interaction
-must follow observed output instead of guessed delays. The graph declares an
-initial state, absolute scenario and state deadlines, explicitly prioritized
-transitions, bounded uses and visits, trigger predicates, ordered actions, and
-either a next state or `passed` outcome.
+Output, file count, file size, process sampling, filesystem depth, total
+runtime, idle time, and post-exit settlement are bounded by the scenario's
+limits. The result marks truncated observations and residual unknowns rather
+than treating missing data as proof of equivalence. Cancellation and timeout
+run the same owned-process cleanup path. Settlement reports whether the
+sampled process group quiesced or whether cleanup was needed or unverifiable;
+sampling cannot prove that every short-lived or detached descendant was seen.
 
-The admitted runtime slice matches decoded UTF-8 terminal literals and exact
-`terminal_raw`, `interaction`, `process`, `filesystem`, `http`, `websocket`, or
-`shim` journal events. Process events are sampled observations, not an
-event-complete lifecycle. Filesystem events identify named checkpoints; shim
-events identify a command and route. Live predicates receive the same normalized
-and redacted payload later persisted in Evidence. Predicates may compose with
-bounded `all`, `any`, `sequence`, and `repeat` nodes and may select a frontier at
-scenario start, state entry, a prior checkpoint, or an exact event ID. Actions
-can write PTY input, resize it, signal the root process, or capture a named
-filesystem checkpoint. `terminal_rendered`, `lifecycle`, and `replay_transition`
-event triggers and non-root signal selectors fail during preflight before the
-target launches.
+## Compare two captures
 
-Reactive results are recorded in `reactive_run`, including the terminal outcome,
-active state, matched event IDs, action evidence IDs, and deterministic
-transition journal. Terminal controls also commit the last admitted observation
-order, so later output cannot be moved ahead of a timeout, cancellation, or
-target loss during validation. If the process exits before the graph finishes,
-the outcome is `target_lost`; state/scenario deadlines remain distinct
-`predicate_timeout`/`scenario_deadline` outcomes. Timed `events` remain
-available for fixed schedules, but they are not silently translated into the
-reactive graph.
+Compare saved capture Evidence with:
 
-## Checkpoints and deterministic shims
-
-Checkpoint triggers may use an elapsed time, a terminal literal and occurrence
-count, root exit, or settlement. REA always includes `before` and
-`after_settlement` snapshots. Snapshot effects are relative to the preceding
-checkpoint, so transient files remain visible even when the final tree matches
-the initial tree.
-
-Each command shim matches an exact argument array. Routes can emit timed stdout
-or stderr chunks and then exit or receive `SIGINT`, `SIGTERM`, or `SIGKILL`.
-Unmatched and exhausted calls are recorded. Shim observations are bounded by
-the scenario protocol-event limit; exceeding it marks the whole capture
-truncated while replay continues.
-
-## Run a replay machine directly
-
-Use `rea run-replay-machine ./run.json` to validate a finite replay machine
-against an ordered `events` array without launching a process or opening a
-socket. MCP clients use `run_replay_machine` with the same `{ machine, events }`
-input. The result retains one decision per offered event, a transition journal
-with capture alias metadata, and one redacted action-table entry per used
-transition. It never returns request bodies, request headers, or captured
-values. It also reports the initial and final states, whether the final state is
-terminal, configured limits, and committed usage.
-
-The direct boundary accepts at most 10,000 events, 4 MiB of declared action
-JSON, 1,024 action text fields, and 1,024 possible sensitive-capture operations.
-These caps bound both returned content and secret-redaction work.
-
-Refused events remain data rather than aborting the run. Outcomes distinguish
-unmatched events, invalid states, failed guards, exhausted transitions, invalid
-captures, unexpected reconnects, and exhausted limits. This direct runner
-evaluates the same domain runtime used by loopback Process Capture, but performs
-no network or target execution.
-
-## Compare captures
-
-Compare two saved Evidence records with:
-
-```bash
+```sh
 rea compare-process-captures authority.json reconstruction.json
 ```
 
-Pass an optional third path, `rea compare-process-captures authority.json
-reconstruction.json trace.json`, when valid executions may differ in declared
-concurrent ordering. MCP callers pass the same object as `trace_spec` to
-`compare_process_captures`. A trace specification declares exact named events
-and chooses one language:
+The comparison checks terminal, interaction, exit, filesystem, and
+process observations under a shared comparison contract. It reports observed
+differences with their locations, while residual unknowns or truncated
+observations prevent a complete-equivalence claim. Matching scenario
+commitments do not reveal whether redacted sensitive inputs were equal.
 
-- `partial_order` requires every event pair to be related by a
-  `happens_before` edge (including transitive edges) or an explicit
-  `unordered_groups` declaration. `not_before` expresses negative ordering
-  constraints without inferring causality. Optional `prefix` and `suffix`
-  arrays remain exact.
-- `finite_traces` lists the complete accepted variants. An `unordered` token
-  accepts permutations of exactly its declared event multiset; it does not
-  drop or broadly sort events.
+For scenarios where independent scheduling can change event order, the CLI
+also accepts an optional trace-specification JSON file as the third argument.
+That specification must state the exact events and ordering constraints to
+accept; it does not discard unmatched observations or make timestamps into
+causal evidence. Trace comparison returns `unknown` when a capture lacks the
+required complete event journal or contains relevant residual unknowns.
 
-Each event uses one source family (`terminal_raw`, `terminal_rendered`,
-`interaction`, `lifecycle`, `process`, `filesystem`, `http`, `websocket`,
-`shim`, or `replay_transition`), an exact JSON payload, and a discriminated
-cardinality: `required`, `optional`, `exact`, or `range`. Specifications with
-duplicate or overlapping predicates, unknown references, cycles, implicit
-ordering gaps, ordered/unordered conflicts, or finite variants that violate
-cardinality are rejected before comparison.
-
-Event payloads are exact by default. To compare schedules whose recorder
-metadata necessarily changes, an event may explicitly list top-level
-`ignore_fields` from the bounded set `sequence`, `at_ms`, `scheduled_at_ms`,
-`dispatched_at_ms`, and `elapsed_ms`; its `exact` object must omit those fields.
-All predicates for one source use the same ignore set, so relaxed metadata
-cannot create declaration-order matching ambiguity. Other payload fields are
-never dropped or normalized by trace comparison.
-
-Process Capture records a monotonic `event_journal` at observation time. Trace
-comparison uses only this capture order for cross-source causality; timestamps
-are retained as event data but never promoted into happens-before evidence.
-Older captures without a complete journal, truncated captures, and relevant
-residual unknowns return a trace verdict of `unknown`. A passing result retains
-each side's raw journal locations and identifies either the matched finite
-variant or the complete satisfied constraint set. A failure returns the first
-declaration-ordered predicate, cardinality, edge, prefix, suffix, or language
-violation with its relevant event locations.
-If both captures have the same invalid declared trace, the nested verdict is
-`nonconforming` while the top-level capture comparison remains unchanged. Side
-statuses and the diagnostic distinguish conformance from pairwise difference.
-
-The result classifies terminal, interaction, exit, filesystem, protocol,
-process, and shim behavior. `first_divergence` points to the earliest observed
-difference. Residual unknowns prevent a claim of complete equivalence, but they
-do not hide an observed difference in another dimension.
-
-Captures must have equal comparison-contract commitments, but may identify
-different scenarios and executables. MCP callers may set `max_capture_age_ms`;
-the application clock then rejects stale captures before comparison.
-
-## Limits and lifecycle behavior
-
-Scenarios bound output bytes, frames, files, file bytes, process observations,
-protocol/shim events, connections, filesystem depth, total runtime, idle time,
-and settlement time. Process trees are sampled rather than syscall-traced, and
-short-lived descendants may be missed. Filesystem observations are snapshots,
-not filesystem event streams.
-
-REA tags launched processes with a private run identifier. During cleanup it
-revalidates that identifier before signaling sampled process groups, including
-groups detached from the original parent. Temporary HOME, replay, shim,
-terminal, checkpoint, and sampling resources are released on success, failure,
-timeout, and cancellation.
-
-After root exit, REA checks token-owned process groups every 50 ms. Two
-consecutive empty observations establish `quiesced`; the settlement deadline
-otherwise produces `alive_at_deadline`, while inspection or identity failures
-produce `unverifiable`. Sampling can still miss short-lived or early-detached
-descendants, which remains a residual unknown.
+Each capture carries commitments for the selected scenario, executable,
+comparison contract, and normalization rules. Comparison rejects captures
+whose comparison contracts differ. Captures are local Evidence files; keep
+their source artifacts and invocation context available when interpreting a
+difference.

docs/product-catalog.json

@@ -1,31 +1,34 @@
 {
-  "catalog_schema_version": 1,
   "package": {
     "name": "rea-agents",
-    "version": "2.6.0",
+    "version": "4.0.1",
     "sdk": {
-      "server": "2.0.0-beta.4",
-      "client": "2.0.0-beta.4",
-      "core": "2.0.0-beta.4"
+      "server": "2.3.1",
+      "client": "2.3.1",
+      "core": "2.3.1"
     },
-    "skill_version": "23"
+    "skill_version": "24"
   },
   "tools": {
-    "total": 111,
+    "total": 118,
     "families": [
       {
         "id": "direct",
         "surface": "official-proxy",
-        "count": 36,
+        "count": 41,
         "tools": [
           "address_name",
           "address_to_file_offset",
+          "annotate_native_function",
           "comment",
           "current_address",
           "current_document",
           "current_procedure",
           "goto_address",
           "inline_comment",
+          "inspect_native_data_type",
+          "inspect_native_instruction",
+          "inspect_native_load_image",
           "list_bookmarks",
           "list_documents",
           "list_names",
@@ -44,6 +47,7 @@
           "read_bytes",
           "read_function_instructions",
           "resolve_containing_procedure",
+          "resolve_native_call_targets",
           "search_procedures",
           "search_strings",
           "set_address_name",
@@ -59,52 +63,60 @@
       {
         "id": "enhanced",
         "surface": "enhanced",
-        "count": 13,
+        "count": 14,
         "tools": [
           "analyze_function",
           "analyze_swift_types",
           "batch_decompile",
           "binary_overview",
-          "find_code_for_string",
           "find_xrefs_to_name",
           "get_call_graph",
           "get_objc_classes",
           "get_objc_protocols",
           "inspect_native_api",
-          "swift_classes",
+          "inspect_native_dispatch_metadata",
           "trace_call_path",
-          "trace_feature"
+          "trace_feature",
+          "trace_native_ui_action",
+          "trace_native_values"
         ]
       },
       {
         "id": "native",
         "surface": "native-provider",
-        "count": 5,
+        "count": 7,
         "tools": [
+          "capture_native_ui_scenario",
           "demangle_swift",
           "inspect_macho",
           "inspect_plist",
           "inspect_signature",
-          "list_architectures"
+          "list_architectures",
+          "observe_native_ui"
         ]
       },
       {
         "id": "artifact",
         "surface": "artifact-provider",
-        "count": 3,
-        "tools": ["extract_artifact", "inspect_artifact", "inventory_artifact"]
+        "count": 5,
+        "tools": [
+          "decode_interface_builder",
+          "extract_artifact",
+          "inspect_artifact",
+          "inspect_asset_catalog",
+          "inspect_keyed_archive"
+        ]
       },
       {
         "id": "managed",
         "surface": "managed",
-        "count": 8,
+        "count": 7,
         "tools": [
           "compare_managed_members",
           "import_managed_reconstruction",
           "inspect_managed_artifact",
           "inspect_managed_members",
           "inspect_managed_native_boundaries",
-          "plan_managed_runtime_correlation",
           "project_managed_application_graph",
           "verify_managed_native_boundaries"
         ]
@@ -128,9 +140,10 @@
       {
         "id": "electron",
         "surface": "electron-provider",
-        "count": 4,
+        "count": 5,
         "tools": [
           "analyze_javascript_application",
+          "capture_electron_scenario",
           "inspect_electron_page",
           "list_electron_targets",
           "reconcile_javascript_runtime"
@@ -148,18 +161,13 @@
       {
         "id": "application",
         "surface": "application-workflow",
-        "count": 12,
+        "count": 7,
         "tools": [
           "build_reconstruction_obligation_ledger",
-          "commit_reconstruction_coverage",
           "compare_application_versions",
           "compare_javascript_export_shapes",
           "compare_source_to_bundle",
-          "evaluate_reconstruction_readiness",
-          "execute_node_characterization",
-          "prepare_node_characterization",
-          "query_reconstruction_coverage",
-          "run_controlled_replay",
+          "evaluate_reconstruction_coverage",
           "trace_application_feature",
           "trace_javascript_semantics"
         ]
@@ -167,7 +175,7 @@
       {
         "id": "session",
         "surface": "session",
-        "count": 19,
+        "count": 21,
         "tools": [
           "binary_session",
           "build_call_path",
@@ -180,11 +188,13 @@
           "correlate_static_and_runtime",
           "export_evidence_bundle",
           "find_changed_behavior",
+          "get_evidence_bundle",
+          "get_navigation_context",
           "import_evidence_bundle",
+          "inspect_address_context",
           "list_unknowns",
           "open_binary",
           "record_unknown",
-          "run_replay_machine",
           "update_unknown",
           "verify_reconstruction",
           "verify_unknown_resolution"
@@ -199,7 +209,12 @@
       "version": null,
       "capabilities": [
         "address_name",
+        "address_to_file_offset",
         "analyze_function",
+        "annotate_native_function",
+        "inspect_native_data_type",
+        "inspect_native_instruction",
+        "inspect_native_load_image",
         "list_documents",
         "list_names",
         "list_procedures",
@@ -212,8 +227,10 @@
         "procedure_info",
         "procedure_pseudo_code",
         "procedure_references",
+        "read_bytes",
         "read_function_instructions",
         "resolve_containing_procedure",
+        "resolve_native_call_targets",
         "search_procedures",
         "search_strings",
         "xrefs"
@@ -268,11 +285,13 @@
       "name": "macOS native inspection utilities",
       "version": null,
       "capabilities": [
+        "capture_native_ui_scenario",
         "demangle_swift",
         "inspect_macho",
         "inspect_plist",
         "inspect_signature",
-        "list_architectures"
+        "list_architectures",
+        "observe_native_ui"
       ]
     },
     {
@@ -280,9 +299,11 @@
       "name": "REA safe artifact graph provider",
       "version": "1",
       "capabilities": [
+        "decode_interface_builder",
         "extract_artifact",
         "inspect_artifact",
-        "inventory_artifact"
+        "inspect_asset_catalog",
+        "inspect_keyed_archive"
       ]
     },
     {
@@ -323,7 +344,6 @@
       "capabilities": [
         "compare_managed_members",
         "import_managed_reconstruction",
-        "plan_managed_runtime_correlation",
         "project_managed_application_graph",
         "verify_managed_native_boundaries"
       ]
@@ -340,15 +360,10 @@
       "version": "1",
       "capabilities": [
         "build_reconstruction_obligation_ledger",
-        "commit_reconstruction_coverage",
         "compare_application_versions",
         "compare_javascript_export_shapes",
         "compare_source_to_bundle",
-        "evaluate_reconstruction_readiness",
-        "execute_node_characterization",
-        "prepare_node_characterization",
-        "query_reconstruction_coverage",
-        "run_controlled_replay",
+        "evaluate_reconstruction_coverage",
         "trace_application_feature",
         "trace_javascript_semantics"
       ]
@@ -365,6 +380,12 @@
       "version": "1",
       "capabilities": ["capture_browser_scenario"]
     },
+    {
+      "id": "rea-playwright-electron-active",
+      "name": "REA Playwright active Electron observation provider",
+      "version": "1",
+      "capabilities": ["capture_electron_scenario"]
+    },
     {
       "id": "rea-v8-inspector",
       "name": "REA passive Node/Electron V8 Inspector provider",
@@ -415,184 +436,55 @@
     {
       "id": "devin",
       "display_name": "Devin",
-      "format": "unsupported",
-      "configuration": "detect-only"
-    }
-  ],
-  "schemas": [
-    {
-      "id": "analysis_snapshot",
-      "version": 2
+      "format": "json",
+      "configuration": "managed"
     },
     {
-      "id": "artifact_extraction",
-      "version": 1
+      "id": "opencode",
+      "display_name": "OpenCode",
+      "format": "opencode",
+      "configuration": "managed"
     },
     {
-      "id": "artifact_graph",
-      "version": 1
+      "id": "antigravity",
+      "display_name": "Antigravity",
+      "format": "json",
+      "configuration": "managed"
     },
     {
-      "id": "browser_scenario",
-      "version": 1
+      "id": "copilot_cli",
+      "display_name": "GitHub Copilot CLI",
+      "format": "copilot_cli",
+      "configuration": "managed"
     },
     {
-      "id": "browser_scenario_capture",
-      "version": 1
+      "id": "commandcode",
+      "display_name": "Command Code",
+      "format": "commandcode",
+      "configuration": "managed"
     },
     {
-      "id": "browser_scenario_diff",
-      "version": 1
-    },
-    {
-      "id": "browser_target_list",
-      "version": 1
-    },
-    {
-      "id": "electron_page_inspection",
-      "version": 1
-    },
-    {
-      "id": "electron_target_list",
-      "version": 1
-    },
-    {
-      "id": "evidence",
-      "version": 2
-    },
-    {
-      "id": "evidence_bundle",
-      "version": 2
-    },
-    {
-      "id": "evidence_completion_ledger",
-      "version": 1
-    },
-    {
-      "id": "evidence_completion_manifest",
-      "version": 1
-    },
-    {
-      "id": "investigation_run",
-      "version": 1
-    },
-    {
-      "id": "investigation_run_summary",
-      "version": 1
-    },
-    {
-      "id": "investigation_workspace",
-      "version": 1
-    },
-    {
-      "id": "javascript_application_analysis",
-      "version": 2
-    },
-    {
-      "id": "javascript_application_graph",
-      "version": 1
-    },
-    {
-      "id": "javascript_application_version_comparison",
-      "version": 1
-    },
-    {
-      "id": "javascript_feature_trace",
-      "version": 1
-    },
-    {
-      "id": "javascript_runtime_observation",
-      "version": 1
-    },
-    {
-      "id": "javascript_runtime_target_list",
-      "version": 1
-    },
-    {
-      "id": "javascript_semantic_graph",
-      "version": 1
-    },
-    {
-      "id": "javascript_semantic_query",
-      "version": 1
-    },
-    {
-      "id": "javascript_semantic_trace",
-      "version": 1
-    },
-    {
-      "id": "managed_artifact_inspection",
-      "version": 1
-    },
-    {
-      "id": "managed_member_comparison",
-      "version": 1
-    },
-    {
-      "id": "managed_member_inspection",
-      "version": 1
-    },
-    {
-      "id": "managed_native_boundary_inspection",
-      "version": 1
-    },
-    {
-      "id": "managed_native_verification",
-      "version": 1
-    },
-    {
-      "id": "process_capture",
-      "version": 4
-    },
-    {
-      "id": "reconstruction_verification",
-      "version": 1
-    },
-    {
-      "id": "residual_unknown",
-      "version": 1
-    },
-    {
-      "id": "web_bundle_analysis",
-      "version": 1
-    },
-    {
-      "id": "web_capture_diff",
-      "version": 1
-    },
-    {
-      "id": "web_mcp_discovery",
-      "version": 1
-    },
-    {
-      "id": "web_observation_session",
-      "version": 1
-    },
-    {
-      "id": "web_page_inspection",
-      "version": 2
-    },
-    {
-      "id": "web_screenshot",
-      "version": 1
-    },
-    {
-      "id": "web_screenshot_diff",
-      "version": 1
+      "id": "vscode",
+      "display_name": "VS Code",
+      "format": "vscode",
+      "configuration": "managed"
     }
   ],
   "cli": {
-    "primary_count": 67,
+    "primary_count": 73,
     "commands": [
+      "address-to-file-offset",
       "analyze",
       "analyze-javascript-application",
       "analyze-web-bundle",
+      "annotate-native-function",
       "build-reconstruction-obligation-ledger",
       "capabilities",
       "capture-browser-scenario",
+      "capture-electron-scenario",
+      "capture-native-ui-scenario",
       "capture-process",
       "capture-web-screenshot",
-      "commit-reconstruction-coverage",
       "compare",
       "compare-application-versions",
       "compare-javascript-export-shapes",
@@ -601,54 +493,57 @@
       "compare-source-to-bundle",
       "compare-web-captures",
       "compare-web-screenshots",
+      "decode-interface-builder",
       "decompile",
       "demangle-swift",
       "discover-webmcp-tools",
       "doctor",
-      "evaluate-reconstruction-readiness",
+      "evaluate-reconstruction-coverage",
       "evidence-export",
       "evidence-import",
-      "execute-node-characterization",
       "extract-artifact",
       "function",
       "import-managed-reconstruction",
       "import-reference-source",
       "inspect",
       "inspect-artifact",
+      "inspect-asset-catalog",
       "inspect-electron-page",
+      "inspect-keyed-archive",
       "inspect-macho",
       "inspect-managed-artifact",
       "inspect-managed-members",
       "inspect-managed-native-boundaries",
       "inspect-native-api",
+      "inspect-native-data-type",
+      "inspect-native-dispatch-metadata",
+      "inspect-native-instruction",
+      "inspect-native-load-image",
       "inspect-plist",
       "inspect-signature",
       "inspect-web-page",
       "instructions",
-      "inventory-artifact",
-      "investigate-versions",
       "list-architectures",
       "list-browser-targets",
       "list-electron-targets",
       "list-javascript-runtime-targets",
       "observe-javascript-runtime",
+      "observe-native-ui",
       "observe-web-session",
-      "plan-managed-runtime-correlation",
-      "policy",
-      "prepare-node-characterization",
       "project-managed-application-graph",
       "providers",
-      "query-reconstruction-coverage",
+      "read-bytes",
       "reconcile-javascript-runtime",
-      "run-controlled-replay",
-      "run-replay-machine",
+      "resolve-native-call-targets",
       "search",
       "setup",
       "trace",
       "trace-application-feature",
       "trace-javascript-semantics",
+      "trace-native-ui-action",
+      "trace-native-values",
       "uninstall",
-      "upgrade",
+      "update",
       "verify-managed-native-boundaries",
       "xrefs"
     ],
@@ -661,17 +556,15 @@
   },
   "runtime_catalog": {
     "counts": {
-      "cli_commands": 67,
-      "mcp_tools": 111,
-      "mcp_prompts": 6,
-      "mcp_resources": 2,
-      "mcp_resource_templates": 11
+      "cli_commands": 73,
+      "mcp_tools": 118,
+      "mcp_prompts": 6
     },
     "digests": {
-      "tools_sha256": "5a88bf598a1e0fe705761db6af92f1ceabaf026cb6efa425e87b9633f1d7a3de",
-      "prompts_sha256": "f6da3ad38a1000c11364d1710f122ac4990551f04efd8c53ffb2e819b5cf5707",
-      "resources_sha256": "339a984ea8cd8be5f234adf24395bf0295258d990492005cf6fe1f293d12cd46",
-      "combined_sha256": "861cd8618e793342daa8b149bc2944360d84b077fd19cf22f6e0a57b6b249c73"
+      "tools_sha256": "bbd9aacf7bb0bc54a8f8743491583482e1176252513d99780a309d0fddeb3df0",
+      "prompts_sha256": "4762db348821fec787a5b8c6423f2c48a71f6f0ec2afee97b16ad69030ec504b",
+      "combined_sha256": "b4f7e5860d90b029876b58fe7cd4a8041fef1f2add23440e37e90827d808e503",
+      "providers_sha256": "e094c361b60ec930a6062a1a90ee05536ce411541dba5b51ace7e2da2ba25af0"
     }
   }
 }

docs/provider-evaluation.md

@@ -1,25 +1,25 @@
 # Static-analysis provider evaluation
 
-Status: the Ghidra read-only analysis provider is shipped on Linux x64 and has
-an experimental Windows x64 P0 for approved native PE applications. It
-validates an exact bring-your-own Ghidra 12.1.2/JDK 21 environment, resolves a
-provider/version/profile commitment, runs one isolated read-only headless
-import, and publishes 19 operation-level capabilities after the authenticated
-post-analysis handshake.
+Ghidra read-only analysis is available on Linux x64 and macOS x64/arm64.
+Install Ghidra 12.1.4 and a full 64-bit JDK 21 separately, then configure REA to
+use them. macOS installations need the matching native decompiler.
 
-The provider-neutral target, provider registry, deterministic target binding,
-analysis-profile commitment, Evidence provenance, snapshot v2, and bounded
-provider-process lifecycle foundations are implemented. The Ghidra launcher,
-packaged Java bridge, doctor/setup projection, bounded client lifecycle, and
-multi-target real Linux verifier, curated Windows CI, and controlled real
-Windows verifier are also implemented. Program identity,
-procedure/string/symbol inventory, memory blocks, address/name and
-containing-procedure resolution, bounded search, function metadata,
-decompilation, assembly, resolved calls, typed references, xrefs, CFG, and
-function dossiers are admitted. A provider is not a drop-in replacement for
-Hopper: every capability is mapped explicitly, with truthful `unavailable`,
-unknown, or degraded results where the engine cannot provide equivalent
-semantics.
+REA imports one target into a temporary project and exposes 25 read-only
+operations after analysis completes. They cover inventories, search,
+decompilation, assembly, function metadata, resolved calls, references, control
+flow, instructions, and recovered types. Results identify the provider version,
+analysis settings, target digest, and any unavailable or incomplete facts.
+On Linux and macOS, `annotate_native_function` additionally edits names and entry
+comments atomically, verifies readback, and returns refreshed function analysis.
+Changes live only in the session database and leave executable bytes unchanged.
+Ghidra does not expose GUI controls; Windows P0 remains read-only.
+
+Windows x64 P0 supports native x86-64 PE applications on local NTFS with
+bundled Job Object ownership, protected runtime DACLs, and handle-based path
+admission. Real ordinary-user verification covers all 25 read-only operations
+through the packaged CLI and MCP, target integrity, and cleanup. This remains
+an experimental boundary; see [Windows Ghidra P0](windows-ghidra-p0.md) and
+[issue #527](https://github.com/morluto/rea/issues/527).
 
 [ADR-0001](adr/0001-provider-selection-and-analysis-profiles.md) fixes the
 provider registry, deterministic selection, target binding, analysis profile,
@@ -31,17 +31,17 @@ follow.
 - Keep the existing provider-neutral CLI and MCP tool names.
 - Bind one deep-analysis provider to a target for the target's lifetime; never
   fail over silently between Hopper and Ghidra.
-- Start with bring-your-own Ghidra and a compatible Java runtime. Setup must not
-  install or upgrade Java.
+- Use an existing Ghidra installation and a compatible Java runtime. Setup must
+  not install or upgrade Ghidra or Java.
 - Run Ghidra headlessly in an owned process with a private temporary project,
-  bounded startup/analysis/request deadlines, cancellation, and cleanup.
+  startup and cleanup deadlines, caller cancellation, and complete replies.
 - Prefer a packaged Java bridge loaded through Ghidra's script path. PyGhidra
   remains useful for prototypes but is not a mandatory production dependency.
 - Treat authenticated `ping` and `shutdown` as lifecycle proof only. Inventory,
   xref, CFG, and decompilation claims require separately admitted operation
   contracts and real-provider conformance.
 - Implement read-only inventories, assembly, decompilation, function metadata,
-  calls, references, containment, and bounded search first.
+  calls, references, containment, and complete inventory search first.
 - Report GUI cursor/navigation and persistent mutation operations as unavailable
   until their semantics and project ownership are explicitly designed.
 - Verify real claims on Linux with at least two distinct source-owned binaries.
@@ -51,91 +51,101 @@ follow.
 
 ## Shipped foundation boundary
 
-`GHIDRA_INSTALL_DIR` must identify an extracted official 12.1.2 release;
+`GHIDRA_INSTALL_DIR` must identify an extracted official 12.1.4 release;
 optional `JAVA_HOME` must identify a 64-bit full JDK 21, otherwise doctor probes
-`java`/`javac` or `java.exe`/`javac.exe` from `PATH`. Linux accepts x86, x86-64,
-ARM, and ARM64 ELF, PE, and Mach-O executable targets. Windows P0 accepts only
-native x86-64 PE applications and rejects DLLs, managed images, unknown roles,
-other formats, and other architectures before launch.
+`java`/`javac` or `java.exe`/`javac.exe` from `PATH`. Supported Linux and macOS
+hosts accept compatible ELF, PE, and Mach-O executable targets. Host admission
+and target compatibility are separate checks. The intended Windows P0 accepts
+only native x86-64 PE applications; it remains blocked before launch.
 
 The launcher creates one ephemeral runtime root with project,
 home/cache/config/data/temp, logs, descriptor, endpoint, target snapshot, and
 ownership manifest.
-It passes `-readOnly`, `-deleteProject`, a 300-second per-file analysis limit,
-two CPUs, and a 2 GiB heap; inherited Java option injection variables are
-cleared. On Linux, the mode-0600 descriptor carries the random token without
+It passes `-readOnly` and `-deleteProject`, and uses Ghidra's default analysis
+and resource settings; inherited Java option injection variables are cleared.
+On Linux, the mode-0600 descriptor carries the random token without
 exposing it in argv or environment and the Java bridge binds a mode-restricted
-Unix socket. Windows uses authenticated IPv4 loopback with a strict token-free
-endpoint record. Both transports report actual
-Ghidra/language/compiler/analysis/import-digest metadata, accept only the exact
-authenticated `ping`, `shutdown`, and ten
-inventory plus nine function-analysis methods, and deletes the socket. Close,
-cancellation, timeout,
-malformed protocol, or process exit stops the owned process resources and
-removes the entire runtime root. Windows P0 uses bounded `taskkill` tree
-termination and explicitly does not claim Job Object, private-DACL, or
-reparse-point authority; see [Windows Ghidra P0](windows-ghidra-p0.md).
+Unix socket. macOS uses the same local transport. The bridge reports actual
+Ghidra/language/compiler/analysis/import-digest metadata and accepts only
+authenticated `ping`, `shutdown`, ten inventory methods, and twelve
+function-analysis methods. Close, cancellation, timeout, malformed protocol,
+or process exit stops the owned process resources, closes the socket, and
+removes the runtime root.
 
-The provider catalog lists only the 19 proved Ghidra operations. GUI cursor,
+The experimental Windows transport uses authenticated IPv4 loopback with a
+token-free endpoint record, but cannot start while the native authority is
+unavailable. Its `taskkill` cleanup code does not establish Job Object ownership,
+private DACLs, or reparse-safe paths.
+
+The provider catalog lists the 25 Ghidra operations. GUI cursor,
 navigation, and mutation operations remain absent; the router therefore
 reports them unavailable instead of borrowing Hopper semantics or inferring
 capability from a successful import.
 
 ## Admitted inventory semantics
 
-| Concern          | Ghidra contract                                                                                                                                                                                                                                                                                                          |
-| ---------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ |
-| Program identity | One `analyzeHeadless` import produces exactly one Program; `list_documents` therefore returns exactly one name.                                                                                                                                                                                                          |
-| Addresses        | Default memory uses lowercase `0x` hexadecimal. Non-default and external spaces use `<percent-encoded-space>:0x<hex>` and remain round-trippable. The handshake commits image base and default address-space name.                                                                                                       |
-| Symbols          | `list_names` includes address-bearing memory and external symbols, including dynamic symbols, while excluding variable and no-address namespace records. Each item reports primary, dynamic, external, symbol type, and source facts.                                                                                    |
-| Procedures       | Both non-external and external functions are listed. A local thunk remains distinct from its resolved target; exact and qualified name lookup fails on ambiguity rather than guessing.                                                                                                                                   |
-| Strings          | Only Ghidra-defined string `Data` is observed. Items report charset, byte length, and whether a required null terminator is missing. The API cannot distinguish a present terminator from fixed/Pascal layouts when no terminator is missing, so that state is named `present_or_not_required`.                          |
-| Memory           | Memory-block end addresses are exclusive. Read/write/execute, initialization, overlay, address space, and image base are direct Ghidra observations.                                                                                                                                                                     |
-| Pagination       | List limits are 500 and search limits are 100. Pages commit exact totals and advancing offsets; an inventory above one million items fails rather than returning a partial result labeled exhaustive.                                                                                                                    |
-| Search           | Literal search scans the immutable inventory with a 1,000,000-unit cumulative work budget. Regex uses a conservative finite Java-regex subset with 10,000 static paths, 4,096 UTF-16 code units per candidate, and the same cumulative budget. Exceeding a budget fails explicitly; returned values identify truncation. |
-| Analysis state   | The socket is exposed only after default auto-analysis. A 300-second analysis timeout fails target opening; ordinary established requests have a 10-second client deadline and every response has a 1 MiB ceiling.                                                                                                       |
+| Concern          | Ghidra contract                                                                                                                                                                                                                                                                                 |
+| ---------------- | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
+| Program identity | One `analyzeHeadless` import produces exactly one Program; `list_documents` therefore returns exactly one name.                                                                                                                                                                                 |
+| Addresses        | Default memory uses lowercase `0x` hexadecimal. Non-default and external spaces use `<percent-encoded-space>:0x<hex>` and remain round-trippable. The handshake commits image base and default address-space name.                                                                              |
+| Symbols          | `list_names` includes address-bearing memory and external symbols, including dynamic symbols, while excluding variable and no-address namespace records. Each item reports primary, dynamic, external, symbol type, and source facts.                                                           |
+| Procedures       | Both non-external and external functions are listed. A local thunk remains distinct from its resolved target; exact and qualified name lookup fails on ambiguity rather than guessing.                                                                                                          |
+| Strings          | Only Ghidra-defined string `Data` is observed. Items report charset, byte length, and whether a required null terminator is missing. The API cannot distinguish a present terminator from fixed/Pascal layouts when no terminator is missing, so that state is named `present_or_not_required`. |
+| Memory           | Memory-block end addresses are exclusive. Read/write/execute, initialization, overlay, address space, and image base are direct Ghidra observations.                                                                                                                                            |
+| Inventory        | Procedure, symbol, and string listings plus searches return the complete matching collection in one response; callers do not provide offsets or result-count limits.                                                                                                                            |
+| Search           | Literal and Java-regex searches scan the complete immutable inventory and return all matching entries inline. Search waits for a reply or caller cancellation; there are no caller-supplied offsets or result-count limits.                                                                     |
+| Analysis state   | The socket is exposed only after default auto-analysis completes. Established operations wait for their reply or caller cancellation; there is no fixed response-size ceiling.                                                                                                                  |
 
 ## Admitted function-analysis semantics
 
-| Concern                 | Ghidra contract                                                                                                                                                                                                                                                                                                                            |
-| ----------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ |
-| Decompiler lifetime     | One persistent `DecompInterface` is opened for the imported Program and disposed during bridge shutdown. Each native decompile has a 30-second deadline; the socket leaves a bounded 35-second projection window. External functions or functions without bodies return `null`; timeout, cancellation, and native failure remain distinct. |
-| Serialization           | A bounded FIFO admits at most 32 active-plus-queued requests and sends one Program request at a time. Queue wait counts against the caller's deadline, and queued cancellation is prompt. This is an adapter safety commitment, not a claim that every Ghidra API is thread-safe.                                                          |
-| Function identity       | Every function result carries the entry address and Ghidra FunctionManager classification for external, thunk, and resolved thunk target. These are observations, not proof that unresolved targetless calls have been recovered.                                                                                                          |
-| Assembly and pseudocode | Assembly is bounded Ghidra Listing text; pseudocode is bounded Ghidra decompiler output. Neither is original source, and cross-provider comparison never treats Hopper and Ghidra text as equal or unequal semantic facts.                                                                                                                 |
-| Instruction fast path   | `read_function_instructions` returns one offset-paginated raw Listing window without invoking the decompiler or whole-program name/string inventories. It reports scan work, exact-or-unknown totals, truncation, and continuation metadata.                                                                                               |
-| Calls and references    | Callers/callees contain only resolved functions. Reference edges preserve exact ReferenceManager type and call/jump/data/read/write/indirect/computed/conditional/terminal/external facts. Targetless computed flow remains unknown. Synthetic entry-point references without actionable memory sources are omitted explicitly.            |
-| CFG                     | Dossiers use `BasicBlockModel` and retain only non-call successors inside the function body. CFG topology is address-normalized for comparison; provider-specific block construction remains a declared difference.                                                                                                                        |
-| Bounds                  | Direct assembly fails above 100,000 instructions or the wire ceiling. Dossiers scan at most 5,000 requested instructions, return bounded independent pages, mark unknown totals after an incomplete scan, and paginate pseudocode by Unicode code points.                                                                                  |
+| Concern                 | Ghidra contract                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            |
+| ----------------------- | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
+| Decompiler lifetime     | One persistent `DecompInterface` is opened for the imported Program and disposed during bridge shutdown. Native decompilation has no fixed per-function deadline. External functions or functions without bodies return `null`; cancellation and native failure remain distinct.                                                                                                                                                                                                                                                                                                                                           |
+| Serialization           | A FIFO sends one Program request at a time. Caller cancellation removes queued work promptly and is passed to active socket waits. This is an adapter safety commitment, not a claim that every Ghidra API is thread-safe.                                                                                                                                                                                                                                                                                                                                                                                                 |
+| Function identity       | Every function result carries the entry address and Ghidra FunctionManager classification for external, thunk, and resolved thunk target. These are observations, not proof that unresolved targetless calls have been recovered.                                                                                                                                                                                                                                                                                                                                                                                          |
+| Assembly and pseudocode | Assembly is complete Ghidra Listing text; pseudocode is Ghidra decompiler output. Neither is original source, and cross-provider comparison never treats Hopper and Ghidra text as equal or unequal semantic facts.                                                                                                                                                                                                                                                                                                                                                                                                        |
+| Instruction fast path   | `read_function_instructions` returns every raw Listing instruction for the requested function without invoking the decompiler or whole-program name/string inventories.                                                                                                                                                                                                                                                                                                                                                                                                                                                    |
+| Calls and references    | Callers/callees contain only resolved functions. Reference edges preserve exact ReferenceManager type and call/jump/data/read/write/indirect/computed/conditional/terminal/external facts. Targetless computed flow remains unknown. Synthetic entry-point references without actionable memory sources are omitted explicitly.                                                                                                                                                                                                                                                                                            |
+| CFG                     | Dossiers use `BasicBlockModel` and retain only non-call successors inside the function body. CFG topology is address-normalized for comparison; provider-specific block construction remains a declared difference.                                                                                                                                                                                                                                                                                                                                                                                                        |
+| P-code value flow       | Function dossiers include up to 3,000 high-p-code operations, at most 64 inputs per operation, and 12,000 def-use edges. Results identify memory reads/writes, branches, and calls by p-code opcode, and mark decompiler-dead operations. Large results report truncation, an omitted-operation lower bound, and known omitted-input/edge counts. The dossier is an intra-function graph; `trace_native_values` composes derived parameter/argument and return/output dependencies across resolved calls. It does not resolve memory aliasing, call side effects, runtime behavior, persistent state, or business meaning. |
+| Result extent           | Function instruction scans and native API boundary observations remain complete. P-code flow is the explicit bounded exception; its count fields distinguish exact retained counts from lower-bound or known-omitted counts. Caller cancellation and provider failures remain distinct.                                                                                                                                                                                                                                                                                                                                    |
 
-`npm run verify:ghidra` compiles the versioned C oracles into x86-64 debug and
-stripped ELF, AArch64 ELF, x86-64 PE, and x86-64 Mach-O targets. It proves all
-19 operations, external functions, resolved thunks, exports, stripped-name
+`npm run verify:ghidra` compiles the versioned C oracle into debug and stripped
+host-native targets (x86-64 ELF on Linux x64 or Mach-O on macOS), plus a native
+DWARF 4 type-layout object. It proves the admitted operations, external functions, resolved thunks, exports, stripped-name
 behavior, direct and targetless indirect calls, typed references, strings/xrefs,
-multi-block CFG, semantic enhanced workflows, cancellation, deadlines,
+multi-block CFG, bounded p-code def-use/effect links, semantic enhanced workflows, cancellation, startup deadlines,
 serialized concurrency, malformed-target rejection, profile identity, and
-process/project cleanup against real Ghidra 12.1.2. Unit fixtures separately
-cover analysis/decompile timeouts, process exit, queue saturation, and malformed
-wire output.
+process/project cleanup against real Ghidra 12.1.4. Unit fixtures separately
+cover startup deadlines, process exit, queued cancellation, and malformed wire
+output.
 
-`npm run verify:ghidra:windows` generates a deterministic source-owned native
-x86-64 PE application, proves all 19 operations through the production Windows
-launcher and loopback transport, checks target/snapshot/import SHA-256 linkage,
-and requires project, endpoint, process, and runtime cleanup. Passing that lane
-proves only the documented P0 boundary, not the remaining Windows security
-gates.
+`npm run verify:ghidra:cross-format` adds AArch64 ELF, x86-64 PE, and x86-64
+Mach-O target coverage. It requires `clang`, LLD, and `lld-link`; set
+`REA_CLANG`, `REA_LLD`, or `REA_LLD_LINK` to select them. The verifier checks
+these tools before compilation. Keeping this matrix separate lets Linux
+host/provider acceptance run with only the host compiler.
+
+`npm run verify:ghidra:windows` checks the source-owned native x86-64 PE
+fixture, all 25 read-only operations, target/snapshot/import SHA-256 linkage,
+and project, endpoint, process, and runtime cleanup. The independent native
+lane checks DACLs, handle admission, cancellation, and Job Object lifecycle.
+`npm run verify:ghidra:windows:package` packs and installs REA into an isolated
+prefix, then checks ordinary-user CLI/MCP operations against canonical contracts.
+All lanes require matching native controls; package startup alone establishes
+only package compatibility.
 
 ## Shared provider-process foundation
 
 `src/process/` now provides the mechanisms that a long-lived Hopper or Ghidra
-adapter genuinely shares: POSIX run-token-authenticated process-group ownership,
+adapter shares: POSIX run-token-authenticated process-group ownership,
 ephemeral temporary runtime roots, one absolute startup deadline, correlated
-request timeout/cancellation cleanup, bounded stdout and stderr retention with
+request cancellation and lifecycle-deadline cleanup, bounded stdout and stderr retention with
 exact byte counts, process-exit diagnostics, and bounded TERM-to-KILL shutdown.
 Reusable fixtures exercise exit, timeout, cancellation, graceful termination,
 forced termination, double-close, spawn failure, and resource release. Windows
-P0 adds bounded process-tree termination as an explicitly weaker host backend;
-Job Object ownership remains unimplemented.
+process-tree termination code exists, but the missing Job Object and private
+runtime controls prevent it from establishing an available Ghidra session.
 
 The foundation does not define a bridge schema, socket framing, health payload,
 analysis model, or shutdown acknowledgement. Hopper keeps its authenticated
@@ -145,12 +155,12 @@ only the generic process mechanisms.
 
 ## Shortlist
 
-| Provider                                                                                    | License / automation surface                                                                                                                                           | What it brings                                                                                                                                          | REA fit and blockers                                                                                                                                                                                                                                                      |
-| ------------------------------------------------------------------------------------------- | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
-| [Ghidra](https://github.com/NationalSecurityAgency/ghidra)                                  | Apache-2.0 source license; `analyzeHeadless`, Java APIs, and PyGhidra                                                                                                  | Broad static analysis, many processors and formats, scripting, and project/database workflows                                                           | Read-only analysis shipped: exact BYO checks, isolated state, bounded process and queue, packaged bridge, 19 admitted inventory/function operations, and real ELF/PE/Mach-O x86-64 plus AArch64 conformance. GUI and mutation semantics remain intentionally unavailable. |
-| [Rizin](https://github.com/rizinorg/rizin) / [rz-pipe](https://github.com/rizinorg/rz-pipe) | Rizin repository contains LGPL-3.0 and GPL-3.0 components; `rizin`, `rz-bin`, and language bridges through `rzpipe`                                                    | Portable CLI analysis, disassembly/debugging, many architectures and file formats, JSON command output                                                  | Good candidate for a process-backed Linux provider and fast metadata fallback. License/component inventory must be preserved; command output needs version-pinned parsers and semantic conformance before evidence is trusted.                                            |
-| [LIEF](https://github.com/lief-project/LIEF)                                                | Apache-2.0; C++, Python, and other bindings                                                                                                                            | Deterministic parsing and modification of ELF, PE, Mach-O, COFF, and related executable formats; headers, sections, symbols, relocations, and functions | Best near-term complement, not a decompiler replacement. It can cover format metadata and artifact evidence without a long-lived analysis process; function semantics, pseudocode, CFG, and cross-reference parity remain out of scope unless separately demonstrated.    |
-| [Binary Ninja](https://docs.binary.ninja/dev/index.html)                                    | API/documentation components are MIT, while the analysis product is licensed by edition; commercial, Ultimate, or Headless license is required for headless automation | Python/Core/C++/Rust APIs, headless loading, IL layers, function analysis, plugins, and configurable analysis                                           | Strong technical fit for a native provider, especially function dossiers. Commercial licensing, license-secret handling, native runtime packaging, and multithreaded lifecycle rules are material deployment blockers.                                                    |
+| Provider                                                                                    | License / automation surface                                                                                                                                           | What it brings                                                                                                                                          | REA fit and blockers                                                                                                                                                                                                                                                                                                                                                                                                                |
+| ------------------------------------------------------------------------------------------- | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------- | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
+| [Ghidra](https://github.com/NationalSecurityAgency/ghidra)                                  | Apache-2.0 source license; `analyzeHeadless`, Java APIs, and PyGhidra                                                                                                  | Static analysis, multiple processors and formats, scripting, and project/database workflows                                                             | 25 read-only operations shipped on Linux/macOS with installation checks, temporary projects, a serial API queue, and real ELF/PE/Mach-O conformance. Experimental Windows x64 P0 supports native x86-64 PE on local NTFS with bundled native controls and ordinary-user CLI/MCP verification; Linux/macOS additionally support atomic session function annotations; Windows mutation and all Ghidra GUI operations are unavailable. |
+| [Rizin](https://github.com/rizinorg/rizin) / [rz-pipe](https://github.com/rizinorg/rz-pipe) | Rizin repository contains LGPL-3.0 and GPL-3.0 components; `rizin`, `rz-bin`, and language bridges through `rzpipe`                                                    | Portable CLI analysis, disassembly/debugging, many architectures and file formats, JSON command output                                                  | Good candidate for a process-backed Linux provider and fast metadata fallback. License/component inventory must be preserved; command output needs version-pinned parsers and semantic conformance before evidence is trusted.                                                                                                                                                                                                      |
+| [LIEF](https://github.com/lief-project/LIEF)                                                | Apache-2.0; C++, Python, and other bindings                                                                                                                            | Deterministic parsing and modification of ELF, PE, Mach-O, COFF, and related executable formats; headers, sections, symbols, relocations, and functions | Best near-term complement, not a decompiler replacement. It can cover format metadata and artifact evidence without a long-lived analysis process; function semantics, pseudocode, CFG, and cross-reference parity remain out of scope unless separately demonstrated.                                                                                                                                                              |
+| [Binary Ninja](https://docs.binary.ninja/dev/index.html)                                    | API/documentation components are MIT, while the analysis product is licensed by edition; commercial, Ultimate, or Headless license is required for headless automation | Python/Core/C++/Rust APIs, headless loading, IL layers, function analysis, plugins, and configurable analysis                                           | Strong technical fit for a native provider, especially function dossiers. Commercial licensing, license-secret handling, native runtime packaging, and multithreaded lifecycle rules are material deployment blockers.                                                                                                                                                                                                              |
 
 ## Recommended order
 
@@ -170,7 +180,7 @@ Before implementation, an adapter proposal must provide:
 
 - a capability matrix covering supported, unsupported, and degraded results;
 - provider identity, version, analysis profile, target digest, authority,
-  limitations, and deterministic locations in every Evidence v2 record;
+  limitations, and deterministic locations in every Evidence record;
 - bounded subprocess or library lifetime, cancellation, timeouts, and cleanup;
 - actionable local diagnostics that retain paths, digests, mismatch locations,
   and provider metadata while redacting credentials, authorization headers,
@@ -184,9 +194,9 @@ prematurely claiming equivalence or redistribution support.
 
 ## Primary-source notes
 
-- Ghidra 12.1.2 documents headless batch mode and its Java runtime requirements
-  in its [release-specific Getting Started guide](https://github.com/NationalSecurityAgency/ghidra/blob/Ghidra_12.1.2_build/GhidraDocs/GettingStarted.md);
-  the [official release](https://github.com/NationalSecurityAgency/ghidra/releases/tag/Ghidra_12.1.2_build)
+- Ghidra 12.1.4 documents headless batch mode and its Java runtime requirements
+  in its [release-specific Getting Started guide](https://github.com/NationalSecurityAgency/ghidra/blob/Ghidra_12.1.4_build/GhidraDocs/GettingStarted.md);
+  the [official release](https://github.com/NationalSecurityAgency/ghidra/releases/tag/Ghidra_12.1.4_build)
   supplies the corresponding distribution and checksums.
 - Rizin lists supported formats, architectures, tools, and `rzpipe` bridges in
   its [repository README](https://github.com/rizinorg/rizin); `rz-pipe` documents

docs/reconstruction-obligation-ledgers.md

@@ -1,13 +1,11 @@
 # Reconstruction obligation ledgers
 
-`build_reconstruction_obligation_ledger` turns authenticated Evidence v2 records
-into a versioned, deterministic list of reconstruction claims. The same workflow
+`build_reconstruction_obligation_ledger` turns authenticated Evidence records
+into a deterministic list of reconstruction claims. The same workflow
 is available as:
 
 - MCP tool: `build_reconstruction_obligation_ledger`
 - CLI command: `rea build-reconstruction-obligation-ledger`
-- MCP resource:
-  `rea://evidence/{evidenceId}/reconstruction-obligation-ledger`
 
 The ledger is conservative by design. Static Application Graph facts create
 candidate obligations; they do not prove runtime or process behavior. A required
@@ -29,7 +27,6 @@ never claims closure:
 rea build-reconstruction-obligation-ledger \
   '{
     "evidence_bundle": {
-      "bundle_version": 2,
       "artifacts": [],
       "providers": [],
       "environments": [],
@@ -40,18 +37,15 @@ rea build-reconstruction-obligation-ledger \
     },
     "reviewed_obligations": [],
     "manifest": {
-      "schema_version": 1,
       "bindings": [],
       "contradictions": []
-    },
-    "limits": { "max_obligations": 100 },
-    "page": { "offset": 0, "limit": 50 }
+    }
   }' \
   --json
 ```
 
 For a real investigation, export an Evidence bundle from the session and replace
-the empty bundle. Application Graph and Process Capture v4 records generate
+the empty bundle. Application Graph and process capture records generate
 conservative candidates automatically. Add reviewed obligations when a required
 claim is not represented by those sources.
 
@@ -326,8 +320,6 @@ close a `packaged-process` obligation. A static-only source cannot close a
 runtime or process claim. Marking a claim `blocked` or `out-of-scope` records the
 disposition but does not silently count it as verified.
 
-Pagination changes only `page` and the returned `obligations` slice. Every page
-retains the same `ledger_id`, `closure_digest`, full-ledger summaries, reports,
-ownership graph, dependency graph, Evidence links, and limitations. Consumers
-should follow `next_offset` until it is `null`, and should reject pages whose
-identity or closure digest changes mid-read.
+The tool returns every obligation inline. Its `ledger_id` and `closure_digest`
+identify the complete result, including summaries, reports, ownership and
+dependency graphs, Evidence links, and limitations.

docs/reconstruction-readiness.md

@@ -1,7 +1,7 @@
 # Reconstruction readiness conformance
 
-Run the complete source-owned native, JavaScript CLI, Electron, Evidence,
-comparison, obligation, replay, CLI, and MCP journey from a clean checkout:
+Run the source-owned native, JavaScript CLI, Electron, Evidence, comparison,
+obligation, replay, and cleanup conformance verifier from a clean checkout:
 
 ```sh
 npm ci
@@ -10,10 +10,10 @@ npm run verify:readiness
 
 The command builds the redistributable native conformance fixtures, inventories
 the native executable through the public CLI, analyzes the generated JavaScript
-CLI and Electron fixture through both CLI and MCP, verifies exact advertised
-limits, evaluates the same nine-stage report through both surfaces, reads the
-full MCP report resource, and proves stale/tampered replay rejection. It prints
-one compact JSON summary.
+CLI and Electron fixtures through both CLI and MCP, evaluates an internal
+nine-stage conformance report, and proves stale/tampered replay rejection. The
+report evaluator is part of the repository verifier, not a public REA tool. It
+prints one compact JSON summary.
 
 Set `REA_READINESS_REPORT_PATH` to retain the complete machine-readable report:
 
@@ -24,17 +24,11 @@ REA_READINESS_REPORT_PATH=readiness-report.json npm run verify:readiness
 CI runs this command on Linux, publishes the compact summary, and retains the
 full report as the `reconstruction-readiness` artifact.
 
-## Public contracts
+## Project conformance contract
 
-- CLI: `rea evaluate-reconstruction-readiness <json-or-file> --json`
-- MCP tool: `evaluate_reconstruction_readiness`
-- Full MCP resource:
-  `rea://evidence/{evidenceId}/reconstruction-readiness-report`
-
-The MCP tool result contains only report identity, status, summary, metrics, and
-the resource URI. The full Evidence bundle, stage records, comparisons,
-contradictions, obligation ledger, and replay inputs stay in the retained
-resource instead of consuming the tool-response context.
+The verifier runs as `npm run verify:readiness`; it is not exposed as a public
+CLI command or MCP tool. The synthetic report input and evaluator exist to
+check project-owned conformance fixtures and fail-closed report behavior.
 
 ## Required stages
 
@@ -42,7 +36,7 @@ resource instead of consuming the tool-response context.
 | ------------------------------- | --------------------------------------------------------------------------------------------------------------------- |
 | `discover-classify`             | target-free startup, artifact inventory, compatible workflow selection, and exact visible limits                      |
 | `diagnose-environment`          | broken runtime separated from analysis failure, version skew detected, and revision changed after recovery            |
-| `acquire-authority`             | exact missing scope, narrow grant, expansion re-prompt, and no launch after denial/cancellation                       |
+| `declare-request`               | exact target, operation, and lifecycle are carried by the request before launch                                       |
 | `static-analysis`               | native and JavaScript routing plus preserved ambiguity, truncation, unsupported syntax, and residual unknowns         |
 | `reactive-scenarios`            | predicate-driven interaction, descendant settlement, Electron correlation, and cancellation cleanup Evidence          |
 | `compare-authority-candidate`   | explicit partial-order/finite-trace semantics, primary divergence localization, and unknown for incomplete comparison |
@@ -51,7 +45,7 @@ resource instead of consuming the tool-response context.
 | `export-replay`                 | CLI/MCP parity, process/structured failure parity, deterministic replay, tamper rejection, and stale-input rejection  |
 
 Every stage and required check must occur exactly once and link to Evidence in
-the embedded Evidence v2 bundle. `fail`, `unknown`, `unsupported`, `truncated`,
+the embedded Evidence bundle. `fail`, `unknown`, `unsupported`, `truncated`,
 and `skipped` never aggregate to `pass`.
 
 ## Fail-closed rules
@@ -69,7 +63,7 @@ The evaluator rejects or withholds readiness when:
 - contradiction Evidence or its affected comparison is missing;
 - the reconstruction obligation ledger is not `ready`, has no required
   obligation, or retains an unowned/unverified required obligation;
-- denied authority launches a process, cancellation loses diagnostics, or owned
+- a process exceeds its declared target/lifecycle, cancellation loses diagnostics, or owned
   resources remain;
 - replay is nondeterministic, tampering/staleness is not detected, or the
   expected source digest differs.

docs/roadmap.md

@@ -1,27 +1,69 @@
-# Installation roadmap
+# REA roadmap
+
+## Tool direction
+
+REA provides inspection, capture, and comparison tools that return evidence
+directly. Agents choose commands, paths, browser actions, scripts, and local
+fixture servers, then compose experiments from those results. CLI and MCP must
+expose equivalent behavior and preserve observations, inferences, and unknowns.
+
+[#555](https://github.com/morluto/rea/pull/555) removed REA permission grants,
+scope ceilings, elicitation, and repeated approval fields.
+[#572](https://github.com/morluto/rea/pull/572) removed the replay engines,
+Node characterization prepare/execute flow, and plan-only managed runtime
+correlation tool. Those systems are retired roadmap items. Existing evidence
+authority labels remain readable as provenance; they do not imply a current
+replay executor.
+
+Local operations use the current user's OS permissions. Input and protocol
+validation, provider prerequisites, target identity, cancellation, and owned
+resource cleanup remain part of each tool's contract. Setup still discloses
+installation changes and requires approval before writing or installing.
+
+## Remaining evidence and provider work
+
+The [platform roadmap](https://github.com/morluto/rea/issues/32),
+[process and Hopper fidelity tracker](https://github.com/morluto/rea/issues/48),
+and [browser tracker](https://github.com/morluto/rea/issues/39) track remaining
+capabilities and proof. Their scope follows direct tools and agent-composed
+experiments; custom replay languages and grant systems are not completion gates.
+
+[Inline Evidence composition](https://github.com/morluto/rea/pull/585) now returns
+the complete record accepted by comparison tools. Managed inspection uses an
+explicit PE/CLI target independently of the native provider selection. Comparisons
+preserve unknowns when observation is incomplete, and PTY diagnostics retain the
+actual loader or startup failure. Browser cleanup reports incomplete teardown
+alongside the primary failure; transient documents invalidate only the affected
+frame's WebMCP registrations. Real-provider and platform claims still require
+their corresponding verification lanes.
 
 ## Shipped behavior
 
-REA setup currently configures the capabilities that exist today: its bundled
-skill, detected agent integrations, optional Hopper provider, and validated
-bring-your-own Ghidra paths. It detects
-Claude Code, Claude Desktop, Codex, Cursor, Gemini CLI, Windsurf, and Devin. The
-first six have documented local MCP configuration boundaries and can be updated
-additively; Devin is reported but left unchanged.
+REA setup lets you select agent integration and optional Hopper installation.
+It installs the bundled workflow, configures detected agents, and can save
+verified paths for an existing Ghidra installation. It configures Claude Code,
+Claude Desktop, Codex, Cursor, Gemini CLI, Windsurf, Devin, OpenCode, Antigravity,
+GitHub Copilot CLI, Command Code, and VS Code using each client's configuration format.
 
-The Ghidra foundation supports Linux x64 with exact Ghidra 12.1.2 and a 64-bit
-full JDK 21. An experimental Windows x64 P0 admits approved native x86-64 PE
-applications through the same 19-operation Java bridge. Doctor validates those coordinates; approved Linux/macOS setup propagates them
-to MCP registrations without installing or modifying either dependency. REA's
-packaged Java bridge then proves an isolated read-only headless import,
-post-analysis handshake, complete cleanup, ten admitted read-only inventory
-operations, and nine function-analysis operations. Real source-owned x86-64
-debug/stripped ELF, AArch64 ELF, PE, and Mach-O fixtures cover program,
-procedure, string, symbol, external/thunk, memory, resolution, search,
-decompilation, assembly, calls, typed references, xrefs, and CFG semantics.
-Hosted Windows CI covers build, package, target admission, transport, and
-lifecycle seams; a controlled self-hosted workflow covers the real Ghidra P0
-claim.
+Ghidra analysis supports Linux x64 and macOS x64/arm64 with Ghidra 12.1.4 and a
+64-bit full JDK 21. macOS also requires the matching native decompiler. The
+adapter exposes thirteen inventory operations and twelve function-analysis
+operations, for 25 read-only operations total. Linux and macOS additionally support
+atomic function-name and entry-comment edits with refreshed analysis; metadata
+is discarded on close and executable bytes stay unchanged. Approved setup saves verified
+installation paths in agent configurations without installing or changing
+Ghidra or Java.
+
+Real-provider verification uses host-native debug and stripped fixtures plus
+a native type-layout object. A separate lane covers AArch64 ELF, PE, and
+Mach-O cross-target fixtures. See [testing](testing.md) for the prerequisites
+and exact commands.
+
+Experimental Windows x64 P0 now supplies bundled Job Object ownership,
+protected runtime DACLs, and handle-based admission for native x86-64 PE
+applications on local NTFS. Real ordinary-user CLI/MCP verification covers
+all 25 read-only operations and cleanup. The [Windows P0 guide](windows-ghidra-p0.md)
+describes this boundary and unverified broader coverage.
 
 ## Ghidra maintenance boundary
 
@@ -31,16 +73,16 @@ not expected to match; unresolved targetless flow remains unknown. Automatic
 Ghidra acquisition, if ever added, remains a separately planned and approved
 related-tool change; setup must never install Java.
 
-Before Windows advances beyond P0, add current-user-only DACL creation and
-readback, handle-based reparse-point-safe path authority, a DACL-protected IPC
-backend, and Job Object assignment before provider execution. Process capture,
-controlled replay, Hopper, and broad filesystem-sensitive workflows remain
-separate Windows projects rather than implied parity.
+Maintain Windows P0 with independent DACL readback, handle-based admission,
+private authenticated IPC, and Job Object assignment before provider execution.
+Process capture, Hopper, and broad filesystem-sensitive workflows remain
+separate Windows projects; P0 does not imply their parity.
 
 ## Capability-selective setup
 
-After REA ships at least two real optional toolchains, setup can evolve into a
-capability-oriented wizard. It may ask whether the operator wants to investigate
+Setup already lets users select agent integration and Hopper installation.
+Once REA supports installing additional analysis tools, it can expand these
+choices to match the work a user wants to do. It may ask whether the operator wants to investigate
 native binaries, websites, mobile applications, firmware, or runtime protocols,
 then propose only the tools needed for the selected work.
 

docs/test-suite-audit.md

@@ -0,0 +1,169 @@
+# Test suite audit
+
+## Scope and priority
+
+The expanded audit on 2026-10-04 reviewed every one of the 355 Vitest files
+present at its start: 82 domain/contracts, 56 application/composition, 147
+adapter/configuration/process/filesystem/CLI files, and 70 MCP/acceptance/
+conformance/evaluation files. Three review passes checked the proposed removals
+against existing stronger coverage and checked the final changes for lost
+assertions. The remaining suite has 351 files.
+
+Prefer full real-provider E2E, then integration across schemas and transports,
+then real-data goldens. Remove lower-level duplication once the replacement
+asserts the same behavior. Keep distinct failure regressions that a successful
+E2E cannot exercise. Do not lower coverage thresholds to accommodate pruning.
+
+## Changes made
+
+| Previous test or assertion                                                                      | Decision                              | Replacement or retained claim                                                                                                        |
+| ----------------------------------------------------------------------------------------------- | ------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------ |
+| Asset application tests using fabricated `.car` bytes and injected utility JSON                 | Remove two plumbing cases             | `verify:asset-catalog`: real actool → assetutil → CLI and stdio MCP, including digest, full metadata, pagination and invalid input   |
+| Keyed archive positive binary/XML objects assembled with the same plist library as the reader   | Remove two synthetic success cases    | Captured Foundation XML plus reviewed complete object/reference graph golden; real Foundation binary/XML → CLI and stdio MCP         |
+| Generic contract schema/annotation/example loops and output-map inventory comparisons           | Consolidate into one SDK wire test    | Assert exported schemas, guidance, effect annotations and valid examples on the actual advertised MCP catalog                        |
+| Ghidra function operation enum membership                                                       | Remove                                | Canonical catalog, provider handshake and actual operation roundtrips establish admission; malformed provider results remain covered |
+| Asset page assertion pinning `10_001`                                                           | Remove                                | Invalid-page rejection through real MCP; malformed utility data still covered                                                        |
+| Suggested prompt tool positions                                                                 | Remove incidental ordering assertions | Keep authority, evidence, untrusted input and preparation constraints                                                                |
+| Package “acceptance” assertions pinning CI matrix/shard values and fake launcher command arrays | Remove configuration-shaped cases     | Actual package/install verifier remains; retain a compact release verification-before-publish and registry-canary static guard       |
+| Package failure classifier under acceptance                                                     | Move to package evaluation            | Preserve all malformed/unrelated-failure rejection cases; do not call them E2E                                                       |
+| Native value graph checks conditional on success                                                | Strengthen                            | Require success before pagination/ambiguity assertions; unexpected errors can no longer pass                                         |
+| Native UI verifier treating permission denial as a positive pass                                | Separate outcomes                     | Default lane requires real capture/action success; opt-in permissions lane explicitly reports no positive E2E proof                  |
+
+Ten previous test cases were removed or consolidated; three replacement
+Vitest cases cover the captured goldens and release guard. The two real artifact
+E2E scripts add product-level evidence outside the deterministic Vitest count.
+
+## Exhaustive follow-up
+
+The follow-up removes or consolidates another 31 test declarations, including
+three redundant test files. Parameterized declarations and executed cases have
+different counts; the figures above count source declarations. It also repairs
+assertions that could pass without exercising their stated behavior.
+
+| Area                         | Cleanup                                                                                                                       | Stronger retained evidence                                                                                        |
+| ---------------------------- | ----------------------------------------------------------------------------------------------------------------------------- | ----------------------------------------------------------------------------------------------------------------- |
+| Configuration                | Merge duplicate target/loader tests and preserve custom launcher, explicit provider and actionable error diagnostics          | Independent malformed inputs; each capability flag is rejected separately                                         |
+| Browser scenarios            | Remove fake launch success and expression-selected artifact success                                                           | Real Chromium scenarios, actual artifacts, CLI capture and owned/external cleanup in `verify:browser`             |
+| CLI policy                   | Remove duplicate confirmation helper cases                                                                                    | Compiled CLI proves project files stay unchanged until `--yes`; distinct interactive choices remain               |
+| Provider capabilities        | Remove numerical catalog freezes; consolidate Hopper byte-read discovery                                                      | Exact canonical capability identities, admission, mutation effects and detached descriptors                       |
+| Evidence ledger              | Merge reordered-key checks into serialized bundle import; remove one-record quota claims                                      | Atomic import, conflicts, residual revisions, actual large collections and byte regressions                       |
+| MCP batching and concurrency | Replace maximum concurrency and empty indistinguishable responses                                                             | Every distinct ordered batch result; concurrently gated requests complete in reverse order with matching payloads |
+| MCP inventories and graphs   | Remove traversal/inventory call order and redundant catalog/prose checks                                                      | Exact complete cyclic graph, full inline inventories, canonical SDK catalog and all-handler roundtrips            |
+| Authority and lifecycle      | Attempt the refused Ghidra mutation; require successful setup, call and switch; close twice                                   | Typed refusal with zero mutation dispatch, restored target calls and exact owned-resource cleanup                 |
+| Process and provider output  | Remove incidental environment read and command option order/defaults                                                          | PID/ownership validation, exact disabled-policy failure and complete decoded response above 10 MiB                |
+| Conformance and CI guards    | Merge identical replay runs; remove duplicate missing-row fault, trivial hash/self equality and incidental worker/step counts | Distinct faulty evidence, digest order, actual test discovery, file existence and release/runner authority        |
+| Pure schemas                 | Remove fabricated comparison-dimension injection and impossible long boundary success                                         | Real artifact comparison and SDK coverage evaluation with returned boundary identity                              |
+
+The removed long boundary selector test only parsed a 1,000-character request;
+workspace boundary identities admit at most 200 characters, so that positive
+could never represent a successful evaluation. The actual MCP evaluation stays
+covered. One unused ledger serialization helper was also retired after removing
+its only test consumer; no CLI or MCP contract changed.
+
+No further immediately safe pruning was identified in the final review. Retained
+replacement candidates below are coverage gaps, rather than permission to delete
+unique tests. Test-only domain scaffolding also stays pending a separate decision
+about the corresponding source behavior; deleting those tests alone would leave
+unverified code and fail unused-export checks.
+
+## Stronger replacements from the closing pass
+
+Three more synthetic success cases were removed. Native value composition now
+runs through the production CLI and a separate stdio MCP subprocess with real
+Ghidra, using a source-built native fixture. It checks argument/parameter/return
+relationships, the fixture's global operand, authenticated Evidence, upstream
+and workflow analysis profiles, identical CLI/MCP graphs, discovery availability
+and successful MCP session closure. Ambiguity, cancellation, target changes,
+missing flow and bounded-work regressions remain in the focused suite.
+
+That replacement found missing CLI workflow routing for `trace_native_values`
+and missing workflow profile classification. The routing and discovery now use
+the composed operation's actual provider prerequisites; workflow Evidence commits
+to the upstream Ghidra profile.
+
+The lone hand-built client-document equality test is replaced by a real TOML
+filesystem transaction: reversed environment keys leave the original bytes
+unchanged and create no backup. A real ZIP entry with an application root longer
+than 5,000 characters replaces injected schema-only positive data. Inventory
+completeness tests partition actual scans into authenticated partial observations
+and require exact assembled results and every source citation, including more
+than 100 citations. These are consumer merge tests, not provider pagination
+claims. Replay aggregation now covers all four statuses and retains actual runner
+diagnostics; it does not claim to execute a real sandbox. Retained pixel-metric
+fixtures now write correct PNG chunk checksums.
+
+The all-zero screenshot buffer is replaced by a real Chromium PNG of 9,467,940
+bytes, transported intact through CLI and stdio MCP and decoded by the production
+pixel comparator. The verifier configures the SDK client's receive buffer because
+its 10 MiB default is smaller than the inline JSON response. This does not claim
+large comparison-request transport coverage. A real SDK initialize request,
+captured during a successful production stdio handshake, replaces the JSON-RPC
+decoder's field-count-only oracle with exact field/value expectations.
+
+The closing pass also removed assertions tied to internal call order, defaults,
+private cache sizes, duplicated polling and fabricated schema extensions. Unique
+malformed-input, security-capacity and cleanup regressions remain.
+
+## Real process regression found
+
+The full suite exposed a renderer ordering race. Publishing a terminal output
+journal entry could synchronously trigger a reactive resize before the preceding
+output was queued for rendering. Queue that output first. The existing real
+source-owned interactive PTY test now also requires the first resized frame to
+contain the output that triggered the resize, preserving the original event
+order rather than sorting or changing timestamps to conceal it.
+
+## Coverage kept
+
+Malformed archives, broken and cyclic references, unsupported metadata pointers,
+relative Objective-C method layouts, ambiguous call candidates, digest mismatch,
+cancellation, host permission denial, bounded output and owned-resource cleanup
+remain covered. These cases provide evidence beyond a successful real-tool run.
+The hand-assembled relative method fixture stays until compiler-produced
+relative-list fixtures establish equivalent assertions.
+
+## Remaining priorities
+
+1. Extend the real Ghidra CLI/stdio MCP journey from value tracing to dispatch
+   and UI handlers before pruning their hand-authored composition success cases.
+   Native value tracing now establishes full transport parity.
+2. Real binary dispatch and nib → full product transports, with normalized
+   semantic goldens. The compiler-backed readers already run in the new Apple
+   CI lane; synthetic pointer/layout rejection tests remain useful.
+3. An approved interactive macOS runner for native UI capture/actions, including
+   stdio MCP scenarios. Hosted runners without permissions cannot supply this
+   proof. No arbitrary application's windows should be opened for this lane.
+4. Real macOS/Linux Ghidra CI runners with bring-your-own installations. This
+   change adds Apple artifact CI without installing Java or Ghidra.
+5. Classify fake-runner replay/application acceptance accurately and replace
+   repeated happy paths only after real sandbox journeys assert the same claims.
+   The replay workflow's allow-unavailable mode must not imply executed replay.
+6. Replace repeated-array schema ceiling tests with real producer/transport
+   regressions before deleting them. Existing integration tests do not yet
+   establish their large-input guarantees.
+
+Some static guards protect irreversible release authority rather than product
+behavior. Keep these few guards explicit and separate from E2E evidence.
+
+## Verification after the expanded audit
+
+- `npm run check:pr`: 351 files passed; 1,794 tests passed and two skipped.
+  Typecheck, lint, formatting, unused-code and generated-document gates passed.
+- `npm run check:fast`: passed; 70 lint warnings and zero errors.
+- `npm run verify:browser`: actual Chromium observation and scenario CLI routes,
+  retained artifacts, owned/external lifecycle checks and large CLI/stdio MCP PNG
+  capture passed.
+- `npm run verify:ghidra`: macOS ARM64 with Ghidra 12.1.4/JDK 21 passed, including
+  real native value tracing through CLI and stdio MCP: 171 nodes, 298 edges and
+  six decompilations.
+- `npm run verify:asset-catalog`: real actool/assetutil → CLI and stdio MCP,
+  complete records, pagination and malformed input checks passed.
+- `npm run verify:keyed-archive`: real Foundation binary/XML → CLI and stdio MCP,
+  full graph golden, shared/cyclic identity and malformed scope checks passed.
+
+- `npm run verify:fixtures`: seven source-built host fixtures, source/artifact
+  digests and exhaustive inventory checks passed.
+
+No Hopper windows were opened for this audit. The closing pass runs real Ghidra
+on macOS ARM64; earlier Hopper evidence remains separate. No new hosted CI success
+is claimed.

docs/testing.md

@@ -0,0 +1,296 @@
+# Testing REA
+
+Prefer evidence in this order: full end-to-end workflows with real production
+providers, integration tests across data/API boundaries, then golden regressions
+from real captured inputs. Keep focused module tests for distinct failure or
+semantic cases that these workflows cannot reliably reproduce. A test's path
+or suite name does not establish its behavioral depth.
+
+Tests are grouped into Vitest projects so ownership, allowed dependencies and
+runtime cost are visible from their paths. Before pruning a test, identify the
+replacement scenario and its assertions; passing success journeys do not
+replace malformed input, cancellation, permission or cleanup coverage.
+
+## Behavioral depths
+
+| Depth        | Location                | What it proves                                                                                        |
+| ------------ | ----------------------- | ----------------------------------------------------------------------------------------------------- |
+| Module       | `src/**/*.test.ts`      | One domain, service, or adapter through its narrow public surface                                     |
+| Composition  | `tests/composition/**`  | Provider-neutral session and registry wiring; filesystem access is limited to fixture materialization |
+| Boundary     | `tests/boundary/**`     | Exactly one production filesystem, process, network, browser, CLI, or provider boundary               |
+| MCP boundary | `tests/boundary/mcp/**` | MCP transport and tool-contract boundaries with isolated sessions and explicit cleanup                |
+| Acceptance   | `tests/acceptance/**`   | A compiled CLI or MCP journey; injected providers still make it integration                           |
+| Conformance  | `tests/conformance/**`  | Shared provider contracts, parameterized by declared capabilities and explicit opt-outs               |
+| Evaluation   | `tests/evaluation/**`   | Deterministic evaluator parsing, scoring, and report generation                                       |
+
+Colocated domain tests may import only their owning domain and inward
+dependencies. They do not construct sessions or servers and do not start
+subprocesses or network listeners. Colocated application tests exercise one
+service through explicit ports and recording adapters, never a CLI or MCP
+entrypoint. Composition tests may assemble provider-neutral sessions and
+registries but do not cross production filesystem, process, socket, or browser boundaries.
+Boundary tests cross one production boundary. Only acceptance tests assemble
+the complete runtime or invoke the compiled product surface.
+
+Focused immutable builders and recording ports shared by one test family live
+beside their production owner as `src/**/*.fixture.ts`. They are typechecked
+with the suite and excluded from package builds; broader runtime and provider
+fixtures remain under `tests/fixtures/**`.
+
+`tests/process-global/**` is reserved for cases with a demonstrated dependency
+on process-global state. Those tests use isolated forks so environment and
+exit-status changes cannot leak between files. Serialize a case only when it
+demonstrably shares an external resource that cannot be isolated. Reusable,
+test-scoped fixtures live under `tests/support/**`; immutable source artifacts
+remain under `tests/fixtures/**`.
+The process-global Vitest configuration contract rejects new direct temporary-root
+creation outside the workspace seam and its narrowly documented boundary/package
+exceptions.
+
+Real Hopper, Ghidra, browser, package, and managed-code claims belong to their
+explicit `npm run verify:*` lanes. The reconstruction-readiness lane also
+checks deterministic rerun, tamper, and stale-input handling; those checks do
+not execute extracted JavaScript modules. When application runtime behavior is
+needed, exercise the actual target through browser, Electron, or process
+capture. Real model trials are manual; Vitest covers deterministic evaluator
+logic.
+
+## End-to-end, integration and golden evidence
+
+Full E2E tests invoke the production command dispatcher and real providers,
+without fake launchers, runners or responses. `verify:keyed-archive` writes an
+actual Foundation binary archive, runs the CLI and a separate stdio MCP
+subprocess, checks parity and pagination, rejects an escaping path and checks
+an XML graph golden. `verify:asset-catalog` compiles source-owned colors with
+`actool`, invokes real `assetutil`, then checks CLI/MCP results, exact catalog
+digest, every raw metadata field, pagination and malformed input rejection.
+Neither artifact workflow requires Hopper or launches it. Both run in macOS CI.
+
+MCP SDK transport tests with recording providers remain integration tests.
+They are useful for schema drift and failure projection but do not prove that
+Hopper, Ghidra or another substituted engine works. `verify:package` proves
+packaging/install behavior and fake-provider integration; use the corresponding
+real-provider lanes for engine claims. Real Apple dispatch and Interface
+Builder verifiers currently prove format integration through production readers.
+
+Golden tests use immutable captured text inputs with producer/source provenance
+under `tests/fixtures/golden/`. Expected results are reviewed for the semantic
+claim; capture commands do not automatically approve new expected outputs.
+Do not call handcrafted utility output or synthetic binary builders real-data
+goldens. Keep unsupported binary layouts and malformed boundaries as targeted
+regressions until a real fixture establishes equivalent coverage.
+
+`verify:browser` also captures a source-owned noise canvas as a real PNG above
+8 MiB through the CLI and stdio MCP, with complete byte/digest parity and real PNG
+decoding. Its SDK client explicitly permits the larger inline JSON response;
+this lane does not establish large image-comparison request transport coverage.
+
+The [test suite audit](test-suite-audit.md) records the pruning decisions,
+replacement evidence and remaining priorities.
+
+## Real-toolchain verification lanes
+
+Each real-toolchain command must require only the host tools needed to prove
+its stated claim. Use a host-native fixture for host/provider acceptance, and
+place optional cross-target formats or platform-specific runners in separate
+commands. Check prerequisites before starting expensive work and name the
+missing command, target, and lane in any failure message. A lane must not imply
+that a host or target is covered when it was skipped.
+
+| Ghidra lane                                | Supported runner/target                                                            | Additional local tools                                              |
+| ------------------------------------------ | ---------------------------------------------------------------------------------- | ------------------------------------------------------------------- |
+| `npm run verify:ghidra`                    | Linux x64 ELF or macOS x64/arm64 Mach-O                                            | Host C compiler, Ghidra 12.1.4, and full JDK 21                     |
+| `npm run verify:ghidra:switch`             | Linux x64 ELF; GCC/Clang optimized and stripped switch fixtures                    | GCC, Clang, GNU nm/objdump/strip, Ghidra 12.1.4, and full JDK 21    |
+| `npm run verify:ghidra:aarch64-jump-table` | Any supported Ghidra host; AArch64 ELF; byte/halfword tables; host ARM64 Mach-O    | Clang with AArch64 target support, Ghidra 12.1.4, and full JDK 21   |
+| `npm run verify:ghidra:cross-format`       | Any supported Ghidra host; also analyzes AArch64 ELF, x86-64 PE, and x86-64 Mach-O | `clang`, LLD, and `lld-link` in addition to host-lane prerequisites |
+| `npm run verify:ghidra:windows`            | Controlled Windows x64 with native x86-64 PE                                       | Ghidra 12.1.4, full JDK 21, and the matching native artifact        |
+
+Windows native conformance runs with `npm run verify:windows-native` and does
+not require Ghidra or Java. An optional independently compiled Windows fixture
+adds in-place reparse, breakaway, environment, and token observations.
+`npm run verify:ghidra:windows:package` additionally packs and installs REA into
+an isolated prefix and runs ordinary-user CLI/MCP operations against their
+canonical schemas. Run the controlled fixture generator before that lane, or
+supply an installed package root and an explicit fixture as arguments.
+The host-native Ghidra lane also verifies native value tracing through the
+production CLI and a separate stdio MCP process. It compares complete dependency
+graphs, validates Evidence and upstream/workflow profiles, checks capability
+discovery, and closes the MCP session. No provider or transport is mocked.
+
+The Linux switch lane checks dense, sparse-with-holes, shared-body, nonzero,
+negative, and nonexact JSON integer labels plus a comparison-only control.
+Independent source labels, ELF file bytes, table slots, and bounds branches
+define expected case/default destinations. Production CLI and MCP must agree;
+debug labels must retain their signed values. For stripped negative fixtures,
+the independently checked 32-bit dispatch permits equivalent unsigned labels
+only alongside the reported low-confidence `undefined4` parameter; original
+source signedness remains unknown and the ABI residual must remain visible.
+unsafe labels remain unresolved and every recovered destination is retained.
+The compiler oracle also injects malformed records to check that its assertions
+reject missing/default-confused labels, wrong destinations, and numeric guesses.
+It also invokes the actual bridge methods on detached Ghidra model objects to
+check ambiguous dispatches, signed literals, precision bounds, shared targets,
+and conflicting labels. This reflection fixture depends on the pinned Ghidra
+model and does not claim a compiler produced those synthetic graph shapes.
+Pass `--entrypoint /path/to/installed/rea-agents/scripts/rea.mjs` directly to
+`scripts/verify-real-ghidra-switch.mjs` to verify an installed package through
+the same compiler oracles and CLI/MCP checks.
+
+The cross-format Ghidra lane also analyzes an optimized AArch64 ELF switch
+fixture. It checks the recovered case values against the source cases and
+requires unresolved table bounds or case mappings to remain visible as
+residual unknowns.
+
+`npm run verify:inspector` requires the supported Node.js runtime and installed
+REA dependencies. CI runs it on Linux and Windows. It starts owned loopback
+Node Inspector fixtures and verifies discovery and passive observation through
+the CLI and stdio MCP, including special filenames, unresolved discovery
+locations, and independently resolved loaded scripts. Double-quote filenames
+are tested on POSIX only because Windows does not support them.
+
+## DOS Ghidra analysis
+
+`npm run verify:ghidra:dos` requires the supported Ghidra and JDK installation
+on Linux x64 or macOS x64/arm64. It generates a source-owned MZ fixture without
+a DOS emulator or compiler, then checks real 16-bit decoding, segment
+relocation, near/far calls, decompilation, disjoint function body ranges,
+stable CLI/MCP observations, unchanged source bytes, and owned process/project
+cleanup. Raw p-code address-space selector tokens are reported separately from
+the stable observation comparison. Linux x64 is verified; macOS DOS remains
+unverified. This lane is separate from host-native and optional cross-format
+verification. See [DOS analysis](ghidra-dos.md).
+
+`npm run verify:ghidra:com` uses a generated headerless fixture with no compiler,
+DOS emulator or game data. It exercises explicit admission, BinaryLoader entry
+preparation, measured register context, whole-file byte readback, source offsets,
+unmapped PSP/partial reads, actual decompilation, CLI/MCP parity and owned cleanup.
+It has the same Ghidra/JDK prerequisites as the MZ lane. Neither lane claims DOS
+runtime or PC-98 device execution.
+
+## Apple Interface Builder archives
+
+`npm run verify:interface-builder` compiles the source-owned AppKit XIB into a
+real `.nib` with Xcode `ibtool`, wraps it in a temporary app bundle, and checks
+the decoded view hierarchy, outlet, action, evidence coverage, and truncation
+status. Storyboard compilation additionally requires an installed iOS platform.
+
+Keep the provider-specific acceptance path independent from optional
+cross-compilers. Cross-format failures belong to the cross-format lane and must
+not make native host acceptance unavailable.
+
+## Developer commands
+
+Use source feedback while editing, explicit boundary checks for the changed
+behavior, and complete CI evidence before merging.
+
+| Command                           | Scope                                                                                                                   |
+| --------------------------------- | ----------------------------------------------------------------------------------------------------------------------- |
+| `npm run test:local`              | Dirty source tests via the import graph, without build; explicit source paths run regardless of Git status              |
+| `npm run test:focused -- PATH...` | Exact existing test files; compiled boundaries build first, and unmatched paths fail                                    |
+| `npm run test:changed`            | Source tests affected since the merge base with `origin/main`, including committed and dirty changes                    |
+| `npm run test:fast`               | All domain, service, adapter, composition, conformance, and evaluation tests without build                              |
+| `npm run test:boundary`           | Boundary, MCP boundary, process boundary, and process-global projects                                                   |
+| `npm run test:mcp`                | MCP boundary project                                                                                                    |
+| `npm run test:acceptance`         | Complete compiled CLI and MCP acceptance workflows                                                                      |
+| `npm run test:watch`              | Dirty source tests in watch mode, without build                                                                         |
+| `npm run test:watch:all`          | Changed tests from every project; builds at startup, so rebuild after production edits before relying on compiled tests |
+| `npm run check:changed`           | Cached typecheck/lint and branch-related source feedback                                                                |
+| `npm run check:pr`                | Opt-in complete local deterministic gate and generated-file checks                                                      |
+| `npm run docs:check`              | Committed generated-document freshness                                                                                  |
+
+For example:
+
+```bash
+npm run test:local -- src/config.test.ts
+npm run test:focused -- tests/acceptance/applications/runtime.test.ts
+npm run test:changed -- --base origin/main
+npm run test:changed -- --dry-run
+```
+
+`test:focused` accepts exact repository-relative test file paths. Source-only
+paths do not build; boundary, acceptance, process-global, or unfamiliar `tests/`
+paths build conservatively. Tests use Vitest concurrency and isolated
+workspaces; commands do not hold a broad test lock. Build and documentation
+writers retain checkout-local locks for their shared output files. Explicit
+selections do not use `--changed` or permit zero-test success.
+The dry-run option reports the chosen merge base, scope and build prerequisite
+without executing tests or building. A missing Git base reports how to fetch
+it or select another revision.
+
+Changed selection can miss runtime registration, generated data, shell
+entrypoints, bridges, or other relationships absent from the import graph.
+An empty changed selection means no tests were selected, not verified
+correctness. Select relevant boundary files and real-provider lanes explicitly.
+Source projects also contain large capacity regressions; `test:fast` promises
+no compiled-runtime prerequisite, not a fixed time budget.
+
+Routine iterations and rebases need focused regressions and relevant checks.
+Before handing off a PR, run `npm run check` and generated-document checks when
+applicable; CI owns the full suite and coverage. Use the full local gate for
+broad changes or diagnosing CI, rather than after every edit. Package/install
+changes additionally need package verification; provider changes need actual
+provider evidence.
+
+Local full-suite Vitest runs use up to two workers and schedule projects one
+at a time. Process, acceptance and process-global projects serialize their
+files to prevent competing lifecycle observations. CI retains its two-worker
+budget.
+The pure domain/contracts and recording-port service projects share one worker
+module context because their tests own no mutable runtime resources. MCP
+boundary files also share the immutable server module graph while creating and
+closing independent in-memory sessions. Adapter, composition, acceptance,
+process-global, and other boundary projects retain per-file isolation.
+`npm test`, `npm run docs:check`, and `npm run docs:generate` share
+repository-local locks and fail fast when the same class of command is already
+running. The `npm test` build is inside that lock. `check:pr` runs its test task
+before starting generated-document validation.
+
+Vitest and Node persistent compile caches are deliberately not enabled by
+default. To evaluate repeated local runs, opt in for both cold and warm
+measurements with an isolated cache:
+
+```bash
+NODE_COMPILE_CACHE=.cache/node-compile npm test
+```
+
+Do not report the warm result as a cold-suite improvement, and do not enable
+the cache in coverage or benchmark CI without first showing that its
+instrumentation remains equivalent.
+
+## Coverage and timing
+
+CI owns coverage. The aggregate floors are 65% statements, 60% branches, 60%
+functions, and 68% lines. `src/domain/**` must reach 80% statements, 75%
+branches, 75% functions, and 80% lines. `src/contracts/**` must reach 85%
+statements, 80% branches, 80% functions, and 85% lines. Thresholds are
+glob-specific rather than per-file and are never updated automatically.
+Coverage does not replace named boundary, acceptance, or real-provider scenario
+matrices.
+
+CI runs four native Vitest shards without retries. Each shard emits a blob
+report; the merge job produces aggregate coverage plus JUnit and JSON timing
+reports, uploads them together, and writes the slowest files to the workflow
+summary. Static checks, documentation, build, package verification, and
+real-system lanes remain separate jobs so one kind of evidence cannot stand in
+for another.
+
+The PR acceptance target is a median `npm run check:pr` wall time below three
+minutes across three warm-build runs on the benchmark host. Keep Vitest caches
+cold unless separately identified. A PR that touches packaging or real-system
+behavior requires the applicable `verify:*` lanes; packaging and installation
+changes also require `npm run verify:package`. The full-gate benchmark measures
+that explicit lane, not the routine iteration requirement.
+
+## Apple native metadata and UI
+
+`npm run verify:apple-dispatch` compiles Objective-C class/protocol and Swift
+conformance/vtable fixtures, inspects their bytes and repeats after stripping
+local symbols. It requires macOS and the host Xcode toolchain; targets are not
+executed. `npm run verify:native-ui` launches exactly one source-owned fixture
+window and requires successful selected-window capture and selected actions.
+An OS permission denial fails the positive lane. `npm run verify:native-ui:permissions`
+allows a host-permission-boundary-only result and explicitly reports
+`positive_e2e: false`; it must not be reported as capture/action proof.
+Both commands reject a changed executable digest and clean up the fixture
+process and helper. These lanes require an interactive macOS desktop. See [native investigation](native-investigation.md)
+for the exact ABI, authority, graph and observation boundaries.

docs/tool-design.md

@@ -0,0 +1,95 @@
+# MCP tool design
+
+Design tools around analyst tasks. A provider API is an implementation detail;
+expose it directly when it gives agents a useful, reusable capability that
+cannot be expressed through an existing contract. Do not impose caller-facing
+limits merely to make work fit an assumed agent budget. Keep real input-format,
+protocol, authority, and resource-safety constraints, and report their effects.
+
+## Choose the tool shape
+
+| Shape                 | Use it for                                                           | Contract should return                                                                                         |
+| --------------------- | -------------------------------------------------------------------- | -------------------------------------------------------------------------------------------------------------- |
+| `inspect`             | Facts about one explicit target, address, object, or resource        | Relevant fields, source locations, and facet-level availability                                                |
+| `search` / `list`     | Finding candidate targets or entities                                | Stable ordering and useful result context; expose pagination when the result format or caller's query needs it |
+| `trace`               | Relationships across code, metadata, UI resources, or observations   | Typed edges, supporting evidence, and unresolved paths; identify any genuine traversal boundary                |
+| `compare`             | Two explicitly identified artifacts, versions, or evidence sets      | Paired identity, comparable coverage, and deltas with evidence                                                 |
+| `workflow`            | A distinct analyst outcome that benefits from composition inside REA | A useful inline result, contributing evidence, and partial/unavailable facets                                  |
+| `observe` / `capture` | A question that requires runtime behavior                            | Required authority, launch/attach behavior, real operational constraints, lifecycle, and cleanup status        |
+
+These are task shapes, not required prefixes. Name a tool for the action and
+object agents reason about; keep the name distinct from nearby alternatives.
+
+## Prefer primitives; compose workflows
+
+Start with a primitive when one call can report a reusable fact about one
+identified object or relationship, such as an instruction decode, a type
+layout, a reference, a dispatch target, or a resource graph. The same primitive
+should be useful across different applications or analyst questions. A
+format-specific decoder can still be a primitive when it describes a reusable
+format rather than one application's product behavior.
+
+Add a workflow when repeated analysis shows that callers need the same
+multi-source result and REA can join the evidence without hiding important
+choices or uncertainty. A useful check is whether the workflow remains
+meaningful for different applications that share the relevant evidence types.
+If its purpose depends on one application's business rules or product concepts,
+keep that interpretation outside the general tool contract and expose the
+underlying evidence through reusable primitives.
+
+## Decide whether to add a tool
+
+1. State the user intent and the smallest result that answers it.
+2. Inspect the canonical tool contracts, current provider capabilities, and
+   representative CLI/MCP traces. Record the nearest competing tool.
+3. Extend an existing contract when the intent and result are the same. Add a
+   batch or composed workflow when it materially improves a demonstrated task;
+   do not force agents through extra calls or collapse distinct tasks into one
+   tool. Add a tool when it answers a distinct analyst question or has a
+   materially different authority or result contract.
+4. Keep public tool names and result semantics provider-neutral. Put engine-
+   specific parsing and protocol handling in adapters. Advertise exact support
+   per provider; do not create parallel tools just because engines differ.
+5. Keep prompts optional and concise. They may point out useful tools, but must
+   not prescribe a call sequence when the task can be answered directly.
+
+Avoid opaque mode flags and mega-tools that combine unrelated discovery,
+execution, and mutation. Prefer a useful direct tool call over a tool sequence
+or model-authored loop when one call can answer the question.
+
+## Define the contract
+
+- Use strict object inputs with explicit required fields and enums. Add numeric
+  bounds only when the format, protocol, authority, or a measured resource
+  constraint requires them.
+- Return complete results by default. Make real pagination, truncation, partial
+  failure, cancellation, and unavailable states explicit. Missing evidence is
+  unknown, not empty or false.
+- Return task-oriented results inline with artifact identity, provider/version,
+  addresses or resource paths, Evidence references, confidence, and relevant
+  limitations. Do not require agents to fetch a resource or dereference an
+  opaque Evidence link to understand a tool result.
+- Separate observed facts from derived and inferred edges. Cite the evidence
+  supporting every important relationship; preserve unresolved edges.
+- Declare read-only, mutation, process, filesystem, network, and UI effects
+  truthfully in the contract and enforce the target and lifecycle named in the
+  request.
+- Keep provider-specific types out of provider-neutral domain and application
+  layers. Normalize supported provider results without implying equal coverage.
+
+## Implement and evaluate
+
+- Put shared user workflows in the application layer; keep MCP translation in
+  the server adapter and CLI behavior aligned with the same workflow.
+- Update the canonical contract inventory, output schemas, examples, generated
+  catalog, and relevant docs together.
+- Verify valid, malformed, boundary, unavailable, cancellation, and partial
+  results at the owning boundaries. Use real-provider checks for claims that
+  depend on external analysis engines.
+- Evaluate representative broad and direct task prompts on the intended MCP
+  host when tool selection is the question. Record the host, model-facing tool
+  catalog, selected tool, arguments, errors, retries, and task outcome.
+  Schema validity or word-overlap heuristics do not prove discoverability.
+
+See [mcp-contracts.md](mcp-contracts.md) for shipped runtime behavior and
+[testing.md](testing.md) for test boundaries and verification lanes.

docs/user-visible-errors.csv

@@ -12,12 +12,11 @@ harm_rank,location,trigger,current_copy,user_risk,proposed_replacement,implement
 11,src/domain/errors.ts:ArtifactOperationError,Artifact inventory or extraction fails,"Artifact {operation} failed: {reason} at {logicalPath} (declared_sha256=...)",Exposes paths hashes and internal reason,"Reason-specific plain message with safe recovery step.",implemented,focused assertions passed; full `npm run check` passed
 12,src/domain/errors.ts:EvidenceFileError,Evidence file operation fails,"Evidence bundle {operation} failed: {reason}",Internal reason token gives weak recovery,"Reason-specific plain message with safe recovery step.",implemented,focused assertions passed; full `npm run check` passed
 13,src/domain/errors.ts:EvidenceIntegrityError,Evidence validation fails,Raw constructor message,May expose validation internals and lacks recovery,"Evidence is invalid or has changed. Recreate or re-import it, then try again.",implemented,focused assertions passed; full `npm run check` passed
-14,src/domain/errors.ts:UnknownRegistryError,Evidence-state mutation fails,"Residual unknown registry mutation failed: {reason}",Exposes internal subsystem and state token,"Evidence state changed before the update completed. Refresh the current state and try again.",implemented,focused assertions passed; full `npm run check` passed
+14,src/domain/errors.ts:UnknownRegistryError,Evidence-state mutation fails,"Residual unknown registry mutation failed: {reason}",Exposes internal subsystem and state token,"Missing IDs identify the session and retry; concurrent revision conflicts refresh current state.",implemented,focused assertions passed; full `npm run check` passed
 15,src/domain/errors.ts:ProcessCaptureError,Process capture fails,Raw constructor message,May expose process and cleanup internals,"Process capture could not complete. Check command access and limits, then try again.",implemented,focused assertions passed; full `npm run check` passed
 16,src/domain/errors.ts:AnalysisTimeoutError,Analysis deadline expires,"Analysis operation timed out after {timeoutMs}ms: {operation}",Exposes internal deadline and operation; weak recovery,"Analysis took too long. Try a smaller request, then run `rea doctor` if it continues.",implemented,focused assertions passed; full `npm run check` passed
 17,src/domain/errors.ts:HopperTimeoutError,Provider deadline expires,"Hopper did not respond within {timeoutMs}ms",Exposes provider and internal deadline,"Analysis took too long. Try a smaller request, then run `rea doctor` if it continues.",implemented,focused assertions passed; full `npm run check` passed
 18,src/domain/errors.ts:ProviderSelectionError,Deep-provider selection fails,"Analysis provider selection failed ({reason}) for {requestedProviderId}; candidates: {candidateIds}",Retains non-secret local selection context that needs a safe structured projection,Reason-specific guidance with stable candidate IDs and actionable rejection diagnostics,implemented,focused registry/CLI/MCP assertions passed; full `npm run check` passed
-19,src/domain/errors.ts:EvidenceLimitError,Evidence ledger limit reached,"Evidence ledger {limit} limit exceeded ({maximum})",Exposes internal storage model,"Evidence is too large for this session. Reduce the evidence set and try again.",implemented,focused assertions passed; full `npm run check` passed
 20,src/domain/errors.ts:AnalysisInputError,Parsed analysis input invalid,"Invalid analysis input for {operation}",Exposes operation identifier and lacks correction,"Analysis input is invalid. Check the arguments and try again.",implemented,focused assertions passed; full `npm run check` passed
 21,src/domain/errors.ts:AnalysisCancelledError,Caller cancels analysis,"Analysis operation was cancelled: {operation}",Exposes operation identifier,"Analysis was cancelled. Start it again when ready.",implemented,focused assertions passed; full `npm run check` passed
 22,src/domain/errors.ts:HopperCancelledError,Caller cancels provider request,Hopper operation was cancelled,Exposes provider name,"Analysis was cancelled. Start it again when ready.",implemented,focused assertions passed; full `npm run check` passed
@@ -25,7 +24,7 @@ harm_rank,location,trigger,current_copy,user_risk,proposed_replacement,implement
 24,src/server/toolResult.ts:successResult,Successful value violates public output schema,AnalysisOutputError: Analysis output does not match the tool contract,Exposes internal error tag and contract implementation,"Analysis returned an unreadable result. Retry once; if it continues, run `rea doctor`.",implemented,focused assertions passed; full `npm run check` passed
 24.5,src/server/registerOfficialTools.ts:capability unknown,Approved unknown tracking records an unavailable analysis,"TOOL_NAME is unavailable: PROVIDER_REASON",Exposes an internal tool identifier and provider diagnostic in persistent user-visible evidence,"The requested analysis is unavailable for the current target.",implemented,verified by focused MCP integration test
 24.6,src/application/ReferenceSourceImportEntries.ts:failed entry,A partial reference import contains an unreadable entry,Low-level reader diagnostic stored in entry limitations,Can persist filesystem or reader implementation details,"Code- and entry-specific safe guidance with a retry, limit, exclusion, or platform recovery step.",implemented,verified by exhaustive focused projection test
-24.7,src/server/registerSessionTools.ts:process residual,Capture records an approved residual unknown,SCOPE: RAW_REASON,Persists adapter diagnostic and implementation wording,"Was SCOPE behavior fully observed during capture?",implemented,verified by focused session MCP test
+24.7,src/server/registerSessionTools.ts:process residual,Capture records a residual unknown linked to capture Evidence,SCOPE: RAW_REASON,Persists adapter diagnostic and implementation wording,"Was SCOPE behavior fully observed during capture?",implemented,verified by focused session MCP test
 24.8,src/server/registerInvestigationTools.ts:changed behavior unknown,Changed-behavior workflow remains incomplete,"Changed behavior result EVIDENCE_ID remains STATUS",Persists internal evidence identifier,"Did both versions behave the same under a complete controlled replay?",implemented,verified by focused investigation MCP test
 24.9,src/server/registerInvestigationTools.ts:call path unknown,Call-path workflow remains incomplete,Call path START_ADDRESS → GOAL_ADDRESS is STATUS,Persists binary addresses and internal status wording,Can the requested call path be established from complete analysis?,implemented,verified by focused unresolved call-path MCP test
 24.91,src/server/registerInvestigationTools.ts:static runtime unknown,Static/runtime correlation remains incomplete,Static/runtime correlation result EVIDENCE_ID is STATUS,Persists internal evidence identifier,Does runtime behavior match the available static analysis?,implemented,verified by focused unresolved static/runtime MCP test
@@ -33,10 +32,10 @@ harm_rank,location,trigger,current_copy,user_risk,proposed_replacement,implement
 24.93,src/server/registerFunctionComparisonTool.ts:probe rationale,Function comparison is incomplete,Capture complete dossiers with equal providers and analysis limits.,Exposes provider architecture and gives ambiguous equality guidance,"Capture complete dossiers for both functions under the same target context and analysis limits.",implemented,verified by focused function-comparison MCP test
 24.95,incur:CLI argument validation,Caller omits or mistypes a command argument,VALIDATION_ERROR with raw Zod Details and fieldErrors including code/path/expected/received,Exposes validator representation and buries the useful correction,"REA could not read the command arguments. Check the named argument and its expected type, then try again.",implemented,verified by sanitizer unit tests and real dispatcher missing-argument test
 25,src/application/ReferenceSourceImport.ts:cancelled,Reference-source import is cancelled,Reference source import cancelled,No recovery timing guidance,"Reference source import was cancelled. Start it again when ready.",implemented,focused assertions passed
-26,src/application/ReferenceSourceImportPolicy.ts:invalid-limits,Configured import limits are not positive integers,Import limits must be positive integers,Does not tell user where recovery lies,"Reference source limits are invalid. Use positive integer limits, then try again.",implemented,focused assertions passed
+26,src/application/ReferenceSourceImportPolicy.ts:invalid-limits,Configured import limits are not positive integers,Import limits must be positive integers,Fixed importer ceilings prevented full source imports,Removed fixed byte, entry, depth, and path limits.,removed,verified by greater-than-10000 entry and greater-than-16-MiB regressions
 27,src/application/ReferenceSourceImportPolicy.ts:invalid-root,Source path cannot resolve or is not a directory,Reference source root could not be resolved / Reference source root is not a directory,Multiple low-level copies and no complete path check,"Reference source directory could not be opened. Check that the path exists, is readable, and points to a directory.",implemented,focused assertions passed
-28,src/application/ReferenceSourceImportPolicy.ts:policy,No approved root exists or requested root is outside policy,No approved reference source roots / Reference source root is outside approved roots,Does not identify safe configuration recovery,"Reference source directory is not approved. Add its directory to `REA_REFERENCE_ROOTS_JSON`, restart REA, then try again.",implemented,focused assertions passed
-29,src/application/ReferenceSourceImport.ts:io,Reader fails during bounded traversal,Raw reader error message,May expose filesystem details and inconsistent recovery,"Reference source files could not be read. Check directory permissions and try again.",implemented,focused assertions passed
+28,src/application/ReferenceSourceImportPolicy.ts:policy,No approved root exists or requested root is outside policy,No approved reference source roots / Reference source root is outside approved roots,Approval friction duplicates direct caller path selection,Removed the configured root allowlist and permission gate; caller-selected directories are validated and traversed directly.,removed,verified by source search and focused import tests
+29,src/application/ReferenceSourceImport.ts:io,Reader fails during traversal,Raw reader error message,May expose filesystem details and inconsistent recovery,"Reference source files could not be read. Check directory permissions and try again.",implemented,focused assertions passed
 30,src/application/ReferenceSourceImport.ts:parse,Historical graph validation fails,Raw thrown graph validation message,Can expose internal graph invariants,"Reference source could not be indexed. Check that the source tree is readable, then try again.",implemented,focused assertions passed
 31,src/application/ReferenceSourceImportTypes.ts:limit,Import reports terminal limit failure,No reachable constructor found,Declared state may be unreachable; false verification risk,Remove unreachable top-level limit variant; per-entry limit guidance remains caller-visible.,removed,"verified by typecheck, exhaustive projection test, and source search"
 32,src/application/Setup.ts:configureDetectedClients(backup),Agent configuration backup fails,"{clientName} configuration backup verification failed; no successful configuration was reported.",Exposes machine client key and obscures no-write guarantee,"Agent configuration could not be backed up, so no change was made. Check file permissions, then rerun setup.",implemented,focused assertions passed
@@ -56,7 +55,7 @@ harm_rank,location,trigger,current_copy,user_risk,proposed_replacement,implement
 45.5,src/application/Uninstall.ts:removeClient restore,Configuration update fails and restoring the original also fails,"Configuration could not be updated or restored. Restore its `.rea.backup` manually, then rerun uninstall.","High risk; persistent configuration may be damaged, but retained backup is authoritative",Keep new recovery copy,implemented,verified by injected restoration failure test
 46,src/application/Uninstall.ts:removeManagedPath symlink,Managed cache/state/skill path is a symbolic link,Refused to follow symlink {path}.,Exposes local path and does not explain manual safety check,"REA did not remove this item because its managed path is a symbolic link. Verify the link target before removing it manually.",implemented,focused assertion passed
 47,src/application/Uninstall.ts:removeManagedPath failure,Managed item removal fails,{path} could not be removed.,Exposes local path and gives no recovery,"This item could not be removed. Check file permissions, then rerun uninstall.",implemented,verified by injected managed-path removal failure test
-48,src/application/Doctor.ts:node,Runtime version is outside supported ranges,Install Node.js 22.19+ or 24.11+.,Low risk; exact dependency recovery,Keep current copy,unchanged,verified by doctor unit test
+48,src/application/DoctorDiagnostics.ts:node,Runtime version is outside supported ranges,"Install Node.js 22.x (>=22.19), 24.x (>=24.11), or 26+.",Low risk; exact dependency recovery,Keep current copy,unchanged,verified by doctor unit test
 49,src/application/Doctor.ts:host,Host OS/distribution is unsupported,"REA supports macOS 12+, Ubuntu 24.04+, Fedora 41+, and 64-bit Arch Linux.",Low risk; clearly states supported choices,Keep current copy,unchanged,verified by doctor unit tests
 50,src/application/Doctor.ts:analysis engine,Optional deep-analysis executable cannot be found,"Run rea setup to install Hopper, or set HOPPER_LAUNCHER_PATH.",Low risk in setup-specific diagnostic; exact recovery paths,Keep current copy,unchanged,verified by doctor unit tests
 51,src/application/Doctor.ts:target,Optional target path fails shared validation,Supply a readable local app or program path.,Low risk; tells caller valid target class,Keep current copy,unchanged,verified by doctor unit test
@@ -66,15 +65,14 @@ harm_rank,location,trigger,current_copy,user_risk,proposed_replacement,implement
 55,src/application/Setup.ts:optional engine,Setup completes without optional deep-analysis engine,Hopper is optional for non-Hopper providers. Rerun with --yes --install-hopper for deep native analysis.,Exposes provider terminology but this is an explanatory setup status rather than an error; recovery command is exact,Keep current copy,unchanged,verified by setup unit test
 56,src/application/Setup.ts:doctor fallback,Post-setup diagnostics remain unhealthy,Run rea doctor and apply each reported remediation.,Low risk; delegates to structured per-check recovery,Keep current copy,unchanged,verified by exact setup unit test
 57,src/application/Setup.ts:unsupported platform,Platform is neither macOS nor Linux,REA supports Hopper on macOS and selected 64-bit Linux distributions.,Low risk; states support boundary,Keep current copy,unchanged,verified by setup unit test
-58,src/application/Setup.ts:unsupported Node,Runtime version cannot run setup,Install Node.js 22.19+ or 24.11+ and rerun setup.,Low risk; exact dependency and retry,Keep current copy,unchanged,verified by setup host tests
+58,src/application/SetupHost.ts:unsupported Node,Runtime version cannot run setup,"Install Node.js 22.x (>=22.19), 24.x (>=24.11), or 26+ and rerun setup.",Low risk; exact dependency and retry,Keep current copy,unchanged,verified by setup host tests
 59,src/application/Setup.ts:unsupported macOS,macOS version is missing or older than 12,Upgrade to macOS 12 or newer.,Low risk; exact support floor,Keep current copy,unchanged,verified by setup host tests
 60,src/application/Setup.ts:unsupported Linux,Linux distribution is outside supported set,"REA supports Hopper on Ubuntu 24.04+, Fedora 41+, and 64-bit Arch Linux.",Low risk; exact supported alternatives,Keep current copy,unchanged,verified by setup unit test
 61,src/application/ProcessCli.ts:readJson read,Process scenario or evidence file cannot be read,Raw filesystem exception through CLI framework,Can expose local paths/codes and no recovery,"Process input file could not be read. Check that the path exists and is readable.",implemented,verified by focused CLI test
 62,src/application/ProcessCli.ts:readJson size,Process scenario or evidence file exceeds 64 MiB,Process JSON input exceeds byte limit,Does not state limit or recovery,"Process input file is too large. Reduce it below 64 MiB, then try again.",implemented,verified by focused sparse-file CLI test
 63,src/application/ProcessCli.ts:readJson parse,Process scenario or evidence file is malformed JSON,Raw JSON parser exception through CLI framework,Can expose parser implementation and lacks recovery,"Process input file is not valid JSON. Repair the file, then try again.",implemented,verified by focused CLI test
 64,src/application/ProcessCli.ts:capture scenario parse,Scenario fails Process Capture schema,Raw Zod validation exception through CLI framework,Exposes schema internals and field paths without stable recovery,"Process scenario is invalid. Check its required fields and limits, then try again.",implemented,verified by focused CLI test
-65,src/application/ProcessCli.ts:legacy evidence,Comparison receives Process Capture v3 Evidence,"Process Capture v3 is unsupported. Re-run the scenario with this REA version using capture_process_scenario to produce Process Capture v4; captures cannot be upgraded because v4 requires new manifest and settlement evidence.",Long but accurately explains why recapture is required and gives exact tool recovery,Keep current copy,unchanged,verified by focused CLI test
-66,src/application/ProcessCli.ts:wrong evidence,Comparison receives valid Evidence from another workflow,Expected REA Process Capture v4 Evidence,Uses internal schema name and does not explain recovery,"Capture evidence is not from the current process-capture workflow. Create new capture evidence, then try again.",implemented,verified by focused CLI test
+66,src/application/ProcessCli.ts:wrong evidence,Comparison receives valid Evidence from another workflow,Expected REA process capture Evidence,Uses internal schema name and does not explain recovery,"Capture evidence is not from the current process-capture workflow. Create new capture evidence, then try again.",implemented,verified by focused CLI test
 67,src/application/ProcessCli.ts:unexpected,Unexpected parser/comparison/canonicalization failure escapes expected classifications,Raw thrown exception through CLI framework,Can expose stack or internal invariant,"Process command could not complete. Check the input files and run `rea doctor`, then try again.",implemented,verified by direct unexpected-cause projection test
 68,src/server/registerEvidenceTools.ts:object guard,Validated provider-tool input is unexpectedly not an object,Provider tool input was not an object,Exposes provider architecture and implies caller can fix impossible state,Remove the impossible duplicate guard and parse through the declared JSON-object schema.,removed,verified by typecheck and MCP integration tests
 69,src/server/registerEnhancedTools.ts:object guard,Validated enhanced-tool input is unexpectedly not an object,Validated enhanced input was not a JSON object,Exposes validation/JSON implementation detail,Remove the impossible duplicate guard and parse through the declared JSON-object schema.,removed,verified by typecheck and enhanced MCP integration tests
@@ -85,11 +83,11 @@ harm_rank,location,trigger,current_copy,user_risk,proposed_replacement,implement
 74,install.sh:unknown option,Installer receives an unsupported flag,unknown option with caller-provided flag,Low risk; identifies offending input,Keep current copy,unchanged,verified by shell branch inspection
 75,install.sh:platform,Installer runs outside macOS or supported Linux,REA supports macOS and selected 64-bit Linux distributions.,Low risk; states support boundary,Keep current copy,unchanged,verified by shell branch inspection
 76,install.sh:curl missing,curl is absent,curl is required.,No recovery instruction,"curl is required. Install curl, then rerun this installer.",implemented,verified by exact missing-curl installer test
-77,install.sh:node missing,node is absent,Node.js 22.19+ or 24.11+ is required; install it from nodejs.org and retry.,Low risk; exact versions and recovery,Keep current copy,unchanged,verified by shell branch inspection
+77,install.sh:node missing,node is absent,"Node.js 22.x (>=22.19), 24.x (>=24.11), or 26+ is required; install it from nodejs.org and retry.",Low risk; exact versions and recovery,Keep current copy,unchanged,verified by shell branch inspection
 78,install.sh:npm missing,npm is absent,npm is required; install it with Node.js and retry.,Low risk; exact recovery,Keep current copy,unchanged,verified by shell branch inspection
 79,install.sh:node unreadable,node exists but does not report a parseable version,could not determine the active Node.js version.,No cause-local recovery,"The active Node.js version could not be read. Check that node works and is on PATH, then retry.",implemented,verified by exact unreadable-Node-version installer test
-80,install.sh:Node 22 floor,Node 22 minor version is below 19,Node.js VERSION is unsupported; use Node.js 22.19+ or 24.11+.,Low risk; exact detected version and supported alternatives,Keep current copy,unchanged,verified by exact installer test using Node 20 and branch inspection
-81,install.sh:Node 24 floor,Node 24 minor version is below 11,Node.js VERSION is unsupported; use Node.js 24.11 or newer.,Low risk; exact detected version and floor,Keep current copy,unchanged,verified by shell branch inspection
+80,install.sh:Node 22 floor,Node 22 minor version is below 19,"Node.js VERSION is unsupported; use Node.js 22.x (>=22.19), 24.x (>=24.11), or 26+.",Low risk; exact detected version and supported alternatives,Keep current copy,unchanged,verified by exact installer test using Node 20 and branch inspection
+81,install.sh:Node 24 floor,Node 24 minor version is below 11,"Node.js VERSION is unsupported; use Node.js 22.x (>=22.19), 24.x (>=24.11), or 26+.",Low risk; exact detected version and floor,Keep current copy,unchanged,verified by shell branch inspection
 82,install.sh:version syntax,Explicit version is not exact semantic version,version must be an exact semantic version.,Low risk; exact correction,Keep current copy,unchanged,verified by shell branch inspection
 83,install.sh:release lookup,Latest GitHub release request fails,could not resolve the latest GitHub release.,No fallback despite supporting pinned versions,"The latest REA release could not be resolved. Check network access or pass --version VERSION, then retry.",implemented,verified by exact release-lookup installer test
 84,install.sh:release response,Latest release response is not valid expected JSON,Node JSON parser stack followed by the safe release-response message,Leaks a parser stack and buries recovery guidance,The release response was invalid. Retry later or pass --version VERSION.,implemented,verified by exact malformed-release test with parser stderr suppressed

docs/verification/managed-conformance-ledger.json

@@ -1,109 +1,101 @@
 {
-  "schema_version": 1,
-  "ledger_id": "ecl_a56a75b91375c9c9501d1545fee9977e74f57dbd1bf413a370f9cd1ed26987bd",
+  "ledger_id": "ecl_132e857a8a93f0b366cd72f9cfa1c338ffd4100460a7834ef69abff936c84472",
   "records": [
     {
       "claim_id": "managed.application-graph-projection",
       "status": "pass",
       "evidence_ids": [
-        "ev_4d6821cdd212a77507dfbdf995fc8b086cd63b3f1d39dee4a2e12f62a6f0609d"
+        "ev_b061a5a559acb3748cb9784c637f6693f74faeb564ba2b11d6fc32619e757459"
       ]
     },
     {
       "claim_id": "managed.decompiler-reconstruction-import",
       "status": "pass",
       "evidence_ids": [
-        "ev_cd9015f39a60251bee1b01baf5189de7427e5810f130aed39770f17ae69cee44"
+        "ev_13f3401a3aaddc3f6d087ad160fa928374e142cdb9861254359b46865b8c992e"
       ]
     },
     {
       "claim_id": "managed.dotnet-framework-x86-pinvoke",
       "status": "pass",
       "evidence_ids": [
-        "ev_af02c0218a01138bd1f0f5ca052f95d348dfacb540040ab72d6ddc9889e3a7e4"
+        "ev_6f026216826ca06e080b77ff608f02634fa945fbd2e151b4cd261c1444f8bbb1"
       ]
     },
     {
       "claim_id": "managed.ilspy-reconstruction-oracle",
       "status": "unsupported",
       "evidence_ids": [
-        "ev_5df12074aeb26d67bc954fd9230076bd0c3ce9969600e19c59ba02090a9988f2"
+        "ev_65a94c4de03f9c6ebdaff3f381cca377821f349d3ca6dfad47a31cc586fae939"
       ]
     },
     {
       "claim_id": "managed.malformed-metadata",
       "status": "pass",
       "evidence_ids": [
-        "ev_5d6aadf199ae090e0ddebc10a51aab8a410fa778a6ae8454fedfb10d240cdac2"
+        "ev_deae4259ea4395623176de40d06c2abcbc2b3a77f0bfb068d76e568d801f45a8"
       ]
     },
     {
       "claim_id": "managed.managed-native-verification",
       "status": "pass",
       "evidence_ids": [
-        "ev_9f1862276fe8869b86105eb91154603922eeb95fec33a10c354b2d6c9c3fe077"
+        "ev_0edcbbcaa1191a4e5324a437f739957b77f9ac45e7897724337f2d6d06b3f9d1"
       ]
     },
     {
       "claim_id": "managed.modern-dotnet-anycpu",
       "status": "pass",
       "evidence_ids": [
-        "ev_c9aef74724cf555bcedce8a9dbf46327b2f92b95b03eb363f966885d429e6882"
+        "ev_d1af50e8dc04cd589385769efd8758e82095425f6e9c1cc4bf2f530c6b434c93"
       ]
     },
     {
       "claim_id": "managed.mvid-and-token-drift",
       "status": "pass",
       "evidence_ids": [
-        "ev_55808bf3ee5ec9d87cee751462077a6bce88701c4fcf66822ba1d7d33706706b"
+        "ev_5493f40bc875535488d789a490361abcc1f76bfbdf52536d09ff127442a8e854"
       ]
     },
     {
       "claim_id": "managed.not-managed",
       "status": "pass",
       "evidence_ids": [
-        "ev_a8166506ca91a4595b825f355836bb4becf35852c8547c55408c09698f4953a6"
+        "ev_03ce0cc0183ee0710f8120e837565129559ab3bc41927df326066370c2341699"
       ]
     },
     {
       "claim_id": "managed.operator-local-manifest",
       "status": "unsupported",
       "evidence_ids": [
-        "ev_03d1a151446834fbee7c093e82121b714a0cc1e6167ad84f47a79ffb9e2602ce"
+        "ev_9d3e50da1d372c55f46649e69eae702cbe8f0ba6a81d1e46afc3e1a284c81757"
       ]
     },
     {
       "claim_id": "managed.operator-manifest-self-test",
       "status": "pass",
       "evidence_ids": [
-        "ev_74d7f9c75a4476196664542d790e2532435f2a1c54349b481967e51e2ccc9453"
-      ]
-    },
-    {
-      "claim_id": "managed.runtime-correlation-admission-plan",
-      "status": "pass",
-      "evidence_ids": [
-        "ev_5a80df0b92dc2280361e900ce590bc88ea52eba3dc8e216a0ce282f503e3cb05"
+        "ev_f974f4b9d039cda841894c6173cae86427ecef48f4e7a4d6c73edf7b23af2b2a"
       ]
     },
     {
       "claim_id": "managed.unicode-obfuscated-identifiers",
       "status": "pass",
       "evidence_ids": [
-        "ev_3b61c79ec152c70693278a70ad2ca6528ce0a9c9ab389d3ec9e4520de79082a7"
+        "ev_c4f38ce76d8359d92ee8e9442503e47b7913550442349a0df688bd274a3def67"
       ]
     },
     {
       "claim_id": "managed.x64-ready-to-run-native-body",
       "status": "pass",
       "evidence_ids": [
-        "ev_81f41b1b3809c2fe1964f7abbcbd2faeb14c723938639c2e0bb16cd58746aa1a"
+        "ev_3e05ef1d6a796d3d4cb3372fe8e549efec759c59bf09d8ff660059a2e448cbc0"
       ]
     }
   ],
   "summary": {
-    "total": 14,
-    "pass": 12,
+    "total": 13,
+    "pass": 11,
     "fail": 0,
     "unsupported": 2,
     "truncated": 0,

docs/verification/managed-conformance-manifest.json

@@ -1,20 +1,19 @@
 {
-  "schema_version": 1,
-  "manifest_id": "ecm_24026e05aeb579814a3d44d04eb8914b1d4ce301d916536bc68a745418c5d892",
+  "manifest_id": "ecm_125743de92b0cbb08a3cb11ee0d9305f60e5c4fb81152b8b748d348f91f99ee8",
   "verifier": {
     "id": "rea-managed-conformance",
     "version": "1"
   },
   "environment": {
-    "platform": "linux",
-    "architecture": "x64",
+    "platform": "portable",
+    "architecture": "portable",
     "runtime": "node",
-    "runtime_version": "24"
+    "runtime_version": "portable"
   },
   "skill_digests": [
     {
       "skill_id": "reverse-engineer-anything",
-      "sha256": "9bb090837e251fc7ff1c1e621b77230f54c88650efb6520aff74d33877b023d8"
+      "sha256": "26338313efd5c941e1f3e1f1d35e2605d47749f674c359458e76d5a470b0cbb1"
     }
   ],
   "claims": [
@@ -30,8 +29,7 @@
       "provider": {
         "id": "rea-managed-conformance",
         "version": "1"
-      },
-      "result_schema_version": 1
+      }
     },
     {
       "claim_id": "managed.decompiler-reconstruction-import",
@@ -45,8 +43,7 @@
       "provider": {
         "id": "rea-managed-conformance",
         "version": "1"
-      },
-      "result_schema_version": 1
+      }
     },
     {
       "claim_id": "managed.dotnet-framework-x86-pinvoke",
@@ -60,8 +57,7 @@
       "provider": {
         "id": "rea-managed-conformance",
         "version": "1"
-      },
-      "result_schema_version": 1
+      }
     },
     {
       "claim_id": "managed.ilspy-reconstruction-oracle",
@@ -73,8 +69,7 @@
       "provider": {
         "id": "rea-managed-conformance",
         "version": "1"
-      },
-      "result_schema_version": 1
+      }
     },
     {
       "claim_id": "managed.malformed-metadata",
@@ -88,8 +83,7 @@
       "provider": {
         "id": "rea-managed-conformance",
         "version": "1"
-      },
-      "result_schema_version": 1
+      }
     },
     {
       "claim_id": "managed.managed-native-verification",
@@ -104,8 +98,7 @@
       "provider": {
         "id": "rea-managed-conformance",
         "version": "1"
-      },
-      "result_schema_version": 1
+      }
     },
     {
       "claim_id": "managed.modern-dotnet-anycpu",
@@ -119,8 +112,7 @@
       "provider": {
         "id": "rea-managed-conformance",
         "version": "1"
-      },
-      "result_schema_version": 1
+      }
     },
     {
       "claim_id": "managed.mvid-and-token-drift",
@@ -135,8 +127,7 @@
       "provider": {
         "id": "rea-managed-conformance",
         "version": "1"
-      },
-      "result_schema_version": 1
+      }
     },
     {
       "claim_id": "managed.not-managed",
@@ -150,8 +141,7 @@
       "provider": {
         "id": "rea-managed-conformance",
         "version": "1"
-      },
-      "result_schema_version": 1
+      }
     },
     {
       "claim_id": "managed.operator-local-manifest",
@@ -163,8 +153,7 @@
       "provider": {
         "id": "rea-managed-conformance",
         "version": "1"
-      },
-      "result_schema_version": 1
+      }
     },
     {
       "claim_id": "managed.operator-manifest-self-test",
@@ -178,23 +167,7 @@
       "provider": {
         "id": "rea-managed-conformance",
         "version": "1"
-      },
-      "result_schema_version": 1
-    },
-    {
-      "claim_id": "managed.runtime-correlation-admission-plan",
-      "scenario": {
-        "id": "runtime-correlation-admission-plan",
-        "version": 1
-      },
-      "artifact_sha256s": [
-        "cead4cc99733e4e56a5fd0cec8a0813bbc24e249aa72a10eca4c47ee3b0e129d"
-      ],
-      "provider": {
-        "id": "rea-managed-conformance",
-        "version": "1"
-      },
-      "result_schema_version": 1
+      }
     },
     {
       "claim_id": "managed.unicode-obfuscated-identifiers",
@@ -208,8 +181,7 @@
       "provider": {
         "id": "rea-managed-conformance",
         "version": "1"
-      },
-      "result_schema_version": 1
+      }
     },
     {
       "claim_id": "managed.x64-ready-to-run-native-body",
@@ -223,8 +195,7 @@
       "provider": {
         "id": "rea-managed-conformance",
         "version": "1"
-      },
-      "result_schema_version": 1
+      }
     }
   ]
 }

docs/windows-ghidra-p0.md

@@ -1,156 +1,165 @@
 # Windows Ghidra P0
 
-Status: experimental. This boundary is useful for approved local fixtures, but
-it is not general Windows REA support and must not be used for hostile,
-sensitive, security-decision, or concurrently mutable targets.
+Status: experimental Windows x64 support for the read-only P0 boundary. The
+published package bundles native process, filesystem, and DACL controls. REA
+uses them automatically when the analyst selects a Ghidra operation; no
+additional permission flag or degraded mode is required.
 
 ## Supported boundary
 
-The P0 accepts exactly:
-
-- a Windows x64 host;
-- Node.js 22.19+ or 24.11+;
-- an operator-installed official Ghidra 12.1.2 distribution;
+- Windows 10+ x64 with fixed local NTFS target and temporary volumes;
+- Node.js 22.x (>=22.19), 24.x (>=24.11), or 26+;
+- an operator-installed official Ghidra 12.1.4 distribution;
 - a 64-bit full JDK 21;
 - an explicit native, non-managed, non-DLL x86-64 PE application; and
-- the existing 19 read-only Ghidra inventory and function-analysis operations.
+- the 25 read-only Ghidra inventory, memory, and function-analysis operations.
 
-Hopper, Ghidra GUI state, mutation, controlled JavaScript replay, process
-capture, browser/Electron observation, artifact extraction, and general
-Windows feature parity are not implied by this boundary. Managed PE/CLI
-inspection remains a separate execution-free provider and is not routed
-through Windows Ghidra P0.
+Loaded memory reads and file offsets preserve Ghidra's observed source mappings.
+PE load-image inspection returns measurements with an explicit unsupported
+attestation status; independent format-specific verification currently supports
+DOS MZ only.
 
-REA does not install or upgrade Ghidra, Java, Python, npm, Node.js, Hopper, or
-another package on Windows. The production adapter uses the packaged Java
-`HeadlessScript`; Python and PyGhidra are not prerequisites.
+This boundary does not establish general Windows feature parity. Ghidra GUI
+state, annotations, other target architectures and formats, and Hopper-only
+operations remain unavailable through this provider. Managed PE/CLI inspection
+uses its separate execution-free provider.
+
+REA does not install or upgrade Ghidra, Java, Python, npm, Node.js, Hopper, or a
+compiler. The adapter uses the packaged Java `HeadlessScript`; Python and
+PyGhidra are not prerequisites. Users do not build the native addon.
 
 ## Configuration
 
-Install REA, Ghidra, and JDK 21 separately. In PowerShell:
-
 ```powershell
 npm install --global rea-agents
-$env:GHIDRA_INSTALL_DIR = "C:\tools\ghidra_12.1.2_PUBLIC"
-$env:JAVA_HOME = "C:\Program Files\Java\jdk-21"
+$env:GHIDRA_INSTALL_DIR = "C:\tools\ghidra_12.1.4_PUBLIC"
+$env:JAVA_HOME = "C:\tools\jdk-21"
 $env:REA_ANALYSIS_PROVIDER = "ghidra"
 
 rea doctor --json
 rea providers --json
-rea inspect "C:\approved-fixtures\sample.exe" --provider ghidra --format json
+rea inspect "C:\fixtures\sample.exe" --provider ghidra --format json
 ```
 
-`rea doctor` checks the x64 host, exact Ghidra release,
-`support\analyzeHeadless.bat`, `java.exe`, `javac.exe`, JDK bitness, and JDK
-major version. `rea setup` remains unavailable on Windows and makes no changes.
+`rea doctor` distinguishes installation prerequisites from native artifact or
+OS failures. It checks the Ghidra release, headless launcher, full JDK, x64
+host, and native controls. A missing or mismatched addon requires the matching
+Windows x64 package; changing MCP registration cannot supply that artifact.
+A filesystem or access failure identifies the failed native constraint.
+Other doctor checks, including unconfigured agent integrations, can remain
+unready while Ghidra itself is available.
 
-For an MCP client, register the resolved Node entry point and preserve the
-three environment variables above. A representative configuration is:
+`rea setup` can register supported agent integrations and the bundled skill.
+Its existing preview and approval apply to configuration writes. Setup
+preserves valid Ghidra and Java settings even when a separate runtime
+prerequisite is unavailable.
+
+For MCP, register the resolved Node entry point and the same provider settings:
 
 ```json
 {
   "mcpServers": {
-    "rea-windows-ghidra-p0": {
-      "command": "C:\\Program Files\\nodejs\\node.exe",
-      "args": [
-        "C:\\Users\\analyst\\AppData\\Roaming\\npm\\node_modules\\rea-agents\\scripts\\rea.mjs",
-        "mcp"
-      ],
+    "rea": {
+      "command": "C:\\tools\\node\\node.exe",
+      "args": ["C:\\tools\\rea\\scripts\\rea.mjs", "mcp"],
       "env": {
         "REA_ANALYSIS_PROVIDER": "ghidra",
-        "GHIDRA_INSTALL_DIR": "C:\\tools\\ghidra_12.1.2_PUBLIC",
-        "JAVA_HOME": "C:\\Program Files\\Java\\jdk-21"
+        "GHIDRA_INSTALL_DIR": "C:\\tools\\ghidra_12.1.4_PUBLIC",
+        "JAVA_HOME": "C:\\tools\\jdk-21"
       }
     }
   }
 }
 ```
 
-Resolve the actual global package path on the intended machine; do not copy the
-example path blindly. Restart the MCP client after changing its registration.
+These paths are examples. Use the actual package location and restart the MCP
+client after registration changes. Cold Ghidra import can exceed a client's
+short default request timeout; the real verification lane allows the existing
+330-second provider startup deadline to complete.
 
-## Target and import identity
+## Native authority and target identity
 
-PE parsing records architecture, COFF executable role, and whether the CLI
-header data-directory entry is non-empty. Header classification and SHA-256
-are read from the same open file handle. Windows admission then rejects:
+The verified boundary excludes SUBST aliases and changing drive-letter/DOS-device
+namespaces. REA does not claim a separate SUBST detector. Mounted-folder entries
+that expose reparse tags fail component admission; broader namespace variants
+have not been established by this lane. Requested paths, final handle paths,
+volume serials, and file IDs remain separate observations.
 
-- non-PE formats;
-- x86, ARM, ARM64, or unknown architectures;
-- DLL/shared-library and non-executable image roles;
-- managed or incompletely classified PE targets; and
-- malformed optional headers or data-directory declarations.
+The loader validates package version, ABI, Node-API compatibility, PE machine,
+and artifact SHA-256 before loading the package-owned addon. Native failure
+reasons remain distinct from a valid installation and an unsupported target.
 
-After admission, REA copies the target into the ephemeral Ghidra runtime and
-requires the snapshot digest to match the admitted SHA-256. Ghidra imports only
-that snapshot. Before serving a request, the Java bridge requires Ghidra's
-`Program.getExecutableSHA256()` observation to match the same digest. A path
-replacement that changes bytes therefore fails before Evidence is created.
+PE header classification and SHA-256 come from the same open file. The Windows
+provider admits native x86-64 PE applications and rejects unsupported roles,
+architectures, managed images, and malformed headers. The original selected
+source coordinate is preserved for native admission.
 
-This linkage does not establish Windows reparse-point or hostile-path safety.
-The current implementation has no handle-based `CreateFileW` authority backend
-and no verified no-follow equivalent for every path component.
+Admission opens and checks every path component without following a reparse
+point. It retains handles, verifies local NTFS semantics, and observes volume
+serial, 128-bit file ID, final handle path, requested path, and size. Reparse
+paths, alternate streams, ambiguous coordinates, UNC paths, and other
+filesystems are rejected with the actual constraint.
 
-## Local transport and lifecycle
+The snapshot streams from the admitted source handle on a background worker.
+Its digest must match the parsed target digest. Ghidra imports that private,
+immutable snapshot, and the bridge requires the imported program SHA-256 to
+match before serving operations. Source and snapshot identities remain
+separate diagnostic observations. Snapshot cancellation is checked between
+64 KiB reads and cleanup waits for worker settlement.
 
-Linux continues to use a mode-restricted Unix socket. Windows uses a Java
-listener bound to `127.0.0.1` on an ephemeral port. The bridge atomically
-publishes a bounded endpoint record containing only schema version, literal
-loopback host, and port. The random 256-bit request token remains only in the
-ephemeral session descriptor and every request is authenticated.
+## Private runtime, transport, and lifecycle
 
-`analyzeHeadless.bat` is invoked through an absolute `cmd.exe` with a fixed
-argument sequence, command extensions enabled for the Ghidra script, delayed
-expansion disabled, and Node shell execution disabled. Every batch token is
-quoted. Paths containing command-interpreter metacharacters are rejected
-instead of escaped heuristically.
+Runtime creation installs a protected DACL permitting exactly the current user
+and SYSTEM. Readback checks the actual owner and ACEs by handle. Descriptors
+and snapshots remain locked until owner cleanup. Child files inherit the
+private boundary. Analysis runs with the caller's authority; these controls
+are not a sandbox for the Ghidra engine or other processes using the same user.
 
-Close, cancellation, timeout, protocol failure, or provider exit removes the
-project and runtime root. Windows P0 uses bounded `taskkill /T /F` process-tree
-termination. It does not assign Ghidra to a Job Object and cannot make the same
-PID-reuse and descendant-ownership claim as the POSIX process-group backend.
+Windows uses an authenticated listener bound to `127.0.0.1` on an ephemeral
+port. The endpoint record contains only the literal loopback host and port.
+The bridge writes a new record and closes its writer before the native reader
+can admit it. The reader refuses concurrent writers and verifies its opened
+object's private DACL. The random 256-bit bearer token stays in the private,
+immutable session descriptor and is redacted from diagnostic output.
 
-## Known security gates
+The batch launcher uses an absolute `cmd.exe`, fixed switches, delayed
+expansion disabled, and quoted tokens. Command-interpreter metacharacters in
+launch paths are unsupported. JVM home and temporary properties use quoted
+`JDK_JAVA_OPTIONS`, preserving spaces. `APPDATA` and `LOCALAPPDATA` point into
+the private runtime, isolating Ghidra preferences, logs, and caches.
 
-The following remain explicitly unavailable:
-
-- verified current-user-only DACLs for runtime directories, descriptors, logs,
-  snapshots, and endpoint records;
-- a DACL-protected Windows named pipe or equivalent OS-identity-restricted IPC;
-- reparse-point-safe, handle-based input and output authority;
-- Job Object assignment before child execution and kill-on-close proof;
-- general extraction containment and filesystem-sensitive workflows; and
-- independent security acceptance for hostile or mutable targets.
-
-Successful symlink creation or ConPTY availability does not satisfy any of
-these gates. Inspect the machine-readable report with:
-
-```powershell
-npm run probe:windows-capabilities
-```
+Process creation assigns a suspended child atomically to an owned Job Object.
+Membership and kill-on-owner-close policy are verified before resume.
+Breakaway is disabled. Only the child's default file owner is normalized;
+the caller token stays unchanged. Caller CPU affinity and priority are
+preserved. Close, cancellation, timeout, startup failure, and provider failure
+terminate the job and verify all members have settled before runtime cleanup.
+Cleanup removes admitted objects by handle and unlinks reparse entries without
+following their targets. Abrupt owner death kills the job but can leave
+private runtime files; crash-time transactional deletion is not claimed.
 
 ## Verification
 
-Hosted CI builds, type-checks, runs the curated Windows tests, records the named
-host capability report, packs the real npm artifact, installs it in isolation,
-and compares the packaged MCP catalog with `TOOL_CONTRACTS`.
-
-The controlled real-engine lane is intentionally separate:
+See [native controls](../native/windows/README.md) for the separate artifact
+build lane and native boundary checks. Development tarballs without the built
+artifact report native controls unavailable; publishing requires the verified
+artifact and manifest.
 
 ```powershell
-$env:GHIDRA_INSTALL_DIR = "C:\tools\ghidra_12.1.2_PUBLIC"
-$env:JAVA_HOME = "C:\Program Files\Java\jdk-21"
-npm ci
+npm run verify:windows-native
 npm run verify:ghidra:windows
+npm run verify:ghidra:windows:package -- C:\fixtures\installed-rea C:\fixtures\sample.exe
 ```
 
-The verifier creates an ignored deterministic x86-64 PE fixture, checks its
-fixed SHA-256, opens Ghidra 12.1.2 through the production Java bridge, exercises
-all 19 admitted operations, verifies the target/snapshot/import digest chain,
-and checks endpoint, project, process, and runtime cleanup. The GitHub workflow
-accepts only the fixed `real-ghidra-windows` repository-dispatch event against
-default-branch `main`, a protected `real-ghidra-windows` environment, and a
-self-hosted runner labelled `Windows`, `x64`, and `ghidra-12-1-2`.
+The package lane must run with an ordinary, non-elevated user token. It exercises
+CLI inspection and every admitted MCP operation, validates named canonical
+input/output contracts, checks the source digest stays unchanged, and verifies
+runtime cleanup. Use a source-owned fixture, one analysis process at a time,
+and a bounded heap for real-provider verification.
 
-Passing this verifier proves the bounded P0 operation claim. It does not close
-the DACL, reparse-point, named-pipe, or Job Object gates above.
+The controlled GitHub workflow runs only default-branch code on its protected
+self-hosted Windows environment. A separate Linux job builds the matching
+native artifact. Hosted Windows CI verifies native controls and packaged
+startup separately from real Ghidra acceptance. Broader hostile-target,
+concurrently mutable-path, extraction, and IPC-security claims require their
+own acceptance and are not implied by this P0 result.

eslint.config.js

@@ -1,28 +0,0 @@
-import eslint from "@eslint/js";
-import tseslint from "typescript-eslint";
-
-export default tseslint.config(
-  { ignores: ["dist/**", "node_modules/**"] },
-  eslint.configs.recommended,
-  ...tseslint.configs.strictTypeChecked,
-  {
-    files: ["**/*.ts"],
-    languageOptions: {
-      parserOptions: {
-        projectService: true,
-        tsconfigRootDir: import.meta.dirname,
-      },
-    },
-    rules: {
-      "@typescript-eslint/consistent-type-imports": "error",
-      "@typescript-eslint/no-confusing-void-expression": "error",
-      "@typescript-eslint/no-floating-promises": "error",
-      "@typescript-eslint/no-non-null-assertion": "error",
-      "@typescript-eslint/no-unnecessary-condition": "error",
-      "@typescript-eslint/no-unsafe-type-assertion": "error",
-      "@typescript-eslint/only-throw-error": "error",
-      "@typescript-eslint/require-await": "error",
-      "@typescript-eslint/switch-exhaustiveness-check": "error",
-    },
-  },
-);

install.sh

@@ -55,17 +55,15 @@ fi
 platform="$(uname -s)"
 [[ "$platform" == "Darwin" || "$platform" == "Linux" ]] || fail "REA supports macOS and selected 64-bit Linux distributions."
 command -v curl >/dev/null 2>&1 || fail "curl is required. Install curl, then rerun this installer."
-command -v node >/dev/null 2>&1 || fail "Node.js 22.19+ or 24.11+ is required; install it from https://nodejs.org and retry."
+command -v node >/dev/null 2>&1 || fail "Node.js 22.x (>=22.19), 24.x (>=24.11), or 26+ is required; install it from https://nodejs.org and retry."
 command -v npm >/dev/null 2>&1 || fail "npm is required; install it with Node.js and retry."
 
 node_version="$(node -p 'process.versions.node' 2>/dev/null || true)"
 IFS=. read -r node_major node_minor _node_patch <<<"$node_version"
 [[ "$node_major" =~ ^[0-9]+$ && "$node_minor" =~ ^[0-9]+$ ]] || fail "the active Node.js version could not be read. Check that node works and is on PATH, then retry."
-if ! ((node_major == 22 && node_minor >= 19 || node_major >= 24)); then
-  fail "Node.js $node_version is unsupported; use Node.js 22.19+ or 24.11+."
-fi
-if ((node_major == 24 && node_minor < 11)); then
-  fail "Node.js $node_version is unsupported; use Node.js 24.11 or newer."
+if ! [[ "$_node_patch" =~ ^[0-9]+(\+[0-9A-Za-z.-]+)?$ ]] ||
+  ! ((node_major == 22 && node_minor >= 19 || node_major == 24 && node_minor >= 11 || node_major >= 26)); then
+  fail "Node.js $node_version is unsupported; use Node.js 22.x (>=22.19), 24.x (>=24.11), or 26+."
 fi
 
 if [[ -n "$version" ]]; then
@@ -102,7 +100,7 @@ printf 'Installing %s@%s...\n' "$PACKAGE" "$version"
 npm install --global "${prefix_args[@]}" "$PACKAGE@$version" || fail "npm could not install REA. Check registry access and npm permissions, then retry."
 [[ -x "$install_bin" ]] || fail "npm completed without installing the rea command. Check the npm global bin directory and PATH, then retry."
 installed_version="$("$install_bin" --version 2>/dev/null | tr -d '[:space:]')" || fail "the installed REA version could not be read. Reinstall the requested version, then retry."
-[[ "$installed_version" == "$version" ]] || fail "installed version $installed_version does not match $version."
+[[ "$installed_version" == "$version" ]] || fail "installed version $installed_version does not match $version. Reinstall the requested version, then retry."
 
 printf 'REA %s is installed.\n' "$version"
 if [[ "$start_setup" == true && -r /dev/tty && -w /dev/tty && -t 1 ]]; then

knip.json

@@ -1,9 +1,8 @@
 {
   "$schema": "./node_modules/knip/schema.json",
-  "entry": ["src/main.ts", "src/cli.ts"],
+  "entry": ["src/main.ts", "src/cli.ts", "src/contracts/errorSchemas.ts"],
   "project": ["src/**/*.ts", "tests/**/*.ts", "scripts/**/*.mjs"],
-  "ignoreDependencies": [],
-  "ignoreBinaries": ["ps"],
+  "ignoreDependencies": ["electron"],
   "ignoreExportsUsedInFile": true,
   "rules": {
     "files": "error",

native/windows/README.md

@@ -0,0 +1,102 @@
+# Windows native controls
+
+REA ships one Windows x64 Node-API 8 addon. Users do not compile it or install
+another runtime. Ghidra and a full JDK remain bring-your-own prerequisites.
+The addon uses Windows 10+ APIs and admits fixed local NTFS volumes only.
+
+The package owns the artifact path. The loader checks the package version,
+ABI, Node-API compatibility, PE architecture, and SHA-256 before loading it.
+There is no environment override for loading an arbitrary native module.
+
+## Build
+
+The artifact lane requires Linux, MinGW-w64 `x86_64-w64-mingw32-g++`,
+`x86_64-w64-mingw32-dlltool`, and `tar`. It never installs these commands.
+Node-API headers are reused from the build cache or downloaded from the
+pinned official Node release with its published SHA-256 checked.
+
+```sh
+npm run build:windows-native
+npm run verify:windows-native:artifact
+npm pack
+```
+
+`build/` is ignored by Git. The npm file inventory includes only the addon and
+its manifest. Release CI builds both, and `prepublishOnly` rejects a missing,
+stale, mismatched, or wrong-architecture artifact. A development tarball built
+without this lane reports Windows native controls as unavailable.
+
+## Boundaries
+
+- Opaque Node objects carry a native type tag, resource kind, and closed state.
+  A pathname, serialized object, or forged handle cannot grant authority.
+- Input admission opens every component with `OPEN_REPARSE_POINT`, verifies
+  the actual NTFS object, and retains handles that deny replacement and source
+  writing. An admitted child keeps each ancestor nonempty; ancestor handles
+  permit unrelated writes while NTFS rejects in-place reparse conversion. Volume serial, 128-bit file ID, final handle path,
+  requested path, size, and digest observations are preserved separately.
+- New runtime roots and private child objects are created relative to admitted
+  parent handles with `NtCreateFile`. A protected DACL and current-user owner
+  are installed at creation. Readback permits exactly the current user and SYSTEM. Child
+  files inherit this boundary; private files are also checked by handle.
+- Snapshots stream through a 64 KiB buffer on a Node async worker. Cancellation
+  is checked between reads, cleanup waits for settlement, and the digest
+  commits to the bytes written. Descriptor and snapshot handles remain held
+  until runtime cleanup.
+  Snapshot ownership is single-flight per runtime: an overlapping request fails
+  with `ERROR_BUSY` before acquiring cancellation ownership. The TypeScript owner
+  records only the accepted promise and abort listener; aborting a rejected copy
+  must not cancel the active copy.
+- `PROC_THREAD_ATTRIBUTE_JOB_LIST` assigns a suspended child atomically to an
+  unnamed, non-inherited Job Object. Membership and kill-on-close policy are
+  checked before resume. Breakaway is disabled, and cleanup waits for all
+  job members and captured output, including detached descendants.
+- Only the suspended child's default file owner is normalized. Caller token
+  privileges and ownership remain unchanged. Caller CPU affinity and process
+  priority are preserved in the child. Environment names are sorted and
+  deduplicated using Windows ordinal comparison, preserving their native Unicode
+  semantics and caller-selected values.
+- Cleanup walks locked directory objects, removes files by handle, and unlinks
+  reparse entries without traversing their targets. Normal close, cancellation,
+  startup failure, and timeout release provider resources. Abrupt owner death
+  kills the owned job; it can leave private runtime files for later operator
+  cleanup and does not claim transactional deletion after a crash.
+
+Windows failures retain their constraint, requested coordinate, Win32 code,
+and system message. Unsupported filesystems and reparse paths are distinct
+from OS access denial and missing packaged controls.
+
+The bearer-token descriptor remains under its immutable private lease until
+`runtime_close` on Windows; POSIX removes the descriptor after the bridge reads
+it. Job ownership guarantees process termination on owner death, not deletion
+of private files after a crash. SUBST drive aliases and changing DOS-device
+namespaces are outside the verified P0 scope and are not detected as a separate
+alias policy. Mounted-folder paths that report a reparse tag are rejected by
+component admission; broader namespace variants remain unverified. Preserve
+requested and final handle coordinates rather than treating them as one identity.
+
+## Real verification
+
+```powershell
+npm run verify:windows-native
+npm run verify:ghidra:windows
+```
+
+The native lane checks DACL readback independently, source write/replacement
+rejection, unrelated sibling renames, reparse rejection, immutable snapshots,
+asynchronous cancellation, cleanup containment,
+descendant termination, unrelated-process preservation, normal exit, owner
+close, and forced owner exit. An optional independently built
+`tests/fixtures/windows/processBoundary.cc` executable adds breakaway and
+caller/child token observations and an in-place ancestor reparse attempt:
+
+```powershell
+node scripts/verify-windows-native.mjs . C:\fixtures\process-boundary.exe
+```
+
+`nonAdminRunner.cc` is a test-only launcher for an elevated development shell.
+It duplicates an existing non-elevated Explorer token belonging to the same
+user, creates private temporary window-station objects, and launches the test
+inside a kill-on-close fixture job. It does not create accounts, modify host
+policy, or change the caller's token. A real-provider claim must additionally
+verify the packaged CLI and MCP on that ordinary-user token.

native/windows/src/addon.cc

@@ -0,0 +1,123 @@
+#include "authority.hpp"
+
+namespace rea {
+
+static const napi_type_tag RESOURCE_TAG = {0x45fcbf0b49e84fe3ULL, 0x9e3e5074130de843ULL};
+
+void check(napi_status status) {
+  if (status != napi_ok) throw Failure("Invalid native boundary value", L"", ERROR_INVALID_PARAMETER);
+}
+napi_value object(napi_env env) { napi_value value; check(napi_create_object(env, &value)); return value; }
+napi_value null(napi_env env) { napi_value value; check(napi_get_null(env, &value)); return value; }
+napi_value string(napi_env env, const std::string& text) {
+  napi_value value; check(napi_create_string_utf8(env, text.data(), text.size(), &value)); return value;
+}
+napi_value string(napi_env env, const std::wstring& text) {
+  static_assert(sizeof(wchar_t) == sizeof(char16_t));
+  napi_value value;
+  check(napi_create_string_utf16(env, reinterpret_cast<const char16_t*>(text.data()), text.size(), &value));
+  return value;
+}
+napi_value number(napi_env env, double numeric) {
+  napi_value value; check(napi_create_double(env, numeric, &value)); return value;
+}
+napi_value boolean(napi_env env, bool flag) {
+  napi_value value; check(napi_get_boolean(env, flag, &value)); return value;
+}
+void set(napi_env env, napi_value target, const char* key, napi_value value) {
+  check(napi_set_named_property(env, target, key, value));
+}
+std::wstring wide(napi_env env, napi_value value) {
+  size_t size = 0;
+  check(napi_get_value_string_utf16(env, value, nullptr, 0, &size));
+  require(size <= 32767, "Windows value exceeds the native string limit", L"", ERROR_INVALID_PARAMETER);
+  std::vector<char16_t> buffer(size + 1);
+  check(napi_get_value_string_utf16(env, value, buffer.data(), buffer.size(), &size));
+  std::wstring result(reinterpret_cast<const wchar_t*>(buffer.data()), size);
+  require(result.find(L'\0') == std::wstring::npos, "Windows value contains NUL", L"", ERROR_INVALID_PARAMETER);
+  return result;
+}
+double numeric(napi_env env, napi_value value) {
+  double result; check(napi_get_value_double(env, value, &result)); return result;
+}
+std::vector<napi_value> array(napi_env env, napi_value value) {
+  bool valid; check(napi_is_array(env, value, &valid));
+  require(valid, "Native arguments must be an array", L"", ERROR_INVALID_PARAMETER);
+  uint32_t length; check(napi_get_array_length(env, value, &length));
+  std::vector<napi_value> result(length);
+  for (uint32_t index = 0; index < length; ++index)
+    check(napi_get_element(env, value, index, &result[index]));
+  return result;
+}
+static void finalize(napi_env, void* data, void*) { delete static_cast<Resource*>(data); }
+napi_value wrap(napi_env env, std::unique_ptr<Resource> value) {
+  auto result = object(env);
+  check(napi_type_tag_object(env, result, &RESOURCE_TAG));
+  check(napi_wrap(env, result, value.get(), finalize, nullptr, nullptr));
+  value.release();
+  return result;
+}
+Resource& resource(napi_env env, napi_value value, Kind kind) {
+  bool tagged = false;
+  check(napi_check_object_type_tag(env, value, &RESOURCE_TAG, &tagged));
+  require(tagged, "Native handle does not belong to REA", L"", ERROR_INVALID_HANDLE);
+  void* pointer = nullptr; check(napi_unwrap(env, value, &pointer));
+  auto& result = *static_cast<Resource*>(pointer);
+  require(result.kind == kind && !result.closed, "Native handle is closed or has the wrong kind", L"", ERROR_INVALID_HANDLE);
+  return result;
+}
+
+napi_value failureValue(napi_env env, const Failure& failure) {
+    wchar_t* message = nullptr;
+    FormatMessageW(FORMAT_MESSAGE_ALLOCATE_BUFFER | FORMAT_MESSAGE_FROM_SYSTEM | FORMAT_MESSAGE_IGNORE_INSERTS,
+                   nullptr, failure.win32, 0, reinterpret_cast<wchar_t*>(&message), 0, nullptr);
+    std::wstring detail = message == nullptr ? L"" : message;
+    if (message != nullptr) LocalFree(message);
+    const std::wstring constraint(failure.constraint.begin(), failure.constraint.end());
+    auto text = string(env, constraint + (failure.path.empty() ? L"" : L" [" + failure.path + L"]") +
+                           L" (Win32 " + std::to_wstring(failure.win32) + L"): " + detail);
+    napi_value error; napi_create_error(env, nullptr, text, &error);
+    const char* code = failure.win32 == ERROR_FILE_NOT_FOUND || failure.win32 == ERROR_PATH_NOT_FOUND ? "ENOENT"
+                     : failure.win32 == ERROR_ACCESS_DENIED ? "EACCES" : "ERR_REA_WINDOWS_NATIVE";
+    set(env, error, "code", string(env, std::string(code)));
+    set(env, error, "constraint", string(env, failure.constraint));
+    set(env, error, "requestedPath", string(env, failure.path));
+    set(env, error, "win32Code", number(env, failure.win32));
+    set(env, error, "win32Message", string(env, detail));
+    return error;
+}
+
+static napi_value call(napi_env env, napi_callback_info info) {
+  try {
+    std::array<napi_value, 2> args;
+    size_t count = args.size();
+    check(napi_get_cb_info(env, info, &count, args.data(), nullptr, nullptr));
+    require(count == 2, "Native call requires operation and arguments", L"", ERROR_INVALID_PARAMETER);
+    const auto operation = wide(env, args[0]);
+    const auto values = array(env, args[1]);
+    if (operation == L"inspect") {
+      require(values.empty(), "Inspect takes no arguments", L"", ERROR_INVALID_PARAMETER);
+      return inspect(env);
+    }
+    if (operation.rfind(L"process_", 0) == 0) return processCall(env, operation, values);
+    return filesystemCall(env, operation, values);
+  } catch (const Failure& failure) {
+    auto error = failureValue(env, failure);
+    napi_throw(env, error);
+    return nullptr;
+  } catch (const std::exception& failure) {
+    napi_throw_error(env, "ERR_REA_WINDOWS_NATIVE", failure.what());
+    return nullptr;
+  }
+}
+
+static napi_value initialize(napi_env env, napi_value exports) {
+  napi_value function;
+  if (napi_create_function(env, "call", NAPI_AUTO_LENGTH, call, nullptr, &function) != napi_ok) return nullptr;
+  if (napi_set_named_property(env, exports, "call", function) != napi_ok) return nullptr;
+  return exports;
+}
+
+} // namespace rea
+
+NAPI_MODULE(NODE_GYP_MODULE_NAME, rea::initialize)

native/windows/src/authority.hpp

@@ -0,0 +1,120 @@
+#pragma once
+
+#define WIN32_LEAN_AND_MEAN
+#define NOMINMAX
+#include <windows.h>
+#include <aclapi.h>
+#include <bcrypt.h>
+#include <node_api.h>
+
+#include <algorithm>
+#include <array>
+#include <atomic>
+#include <cstdint>
+#include <memory>
+#include <stdexcept>
+#include <string>
+#include <utility>
+#include <vector>
+
+namespace rea {
+
+struct Failure : std::runtime_error {
+  DWORD win32;
+  std::wstring path;
+  std::string constraint;
+  Failure(std::string constraint, std::wstring path = L"", DWORD code = GetLastError())
+      : std::runtime_error(constraint), win32(code), path(std::move(path)),
+        constraint(std::move(constraint)) {}
+};
+
+inline void require(bool condition, const char* constraint, const std::wstring& path = L"") {
+  if (!condition) {
+    const auto code = GetLastError();
+    throw Failure(constraint, path, code);
+  }
+}
+inline void require(bool condition, const char* constraint, const std::wstring& path, DWORD code) {
+  if (!condition) throw Failure(constraint, path, code);
+}
+
+class Handle {
+  HANDLE value_ = INVALID_HANDLE_VALUE;
+public:
+  Handle() = default;
+  explicit Handle(HANDLE value) : value_(value) {}
+  ~Handle() { reset(); }
+  Handle(const Handle&) = delete;
+  Handle& operator=(const Handle&) = delete;
+  Handle(Handle&& other) noexcept : value_(other.release()) {}
+  Handle& operator=(Handle&& other) noexcept { reset(other.release()); return *this; }
+  HANDLE get() const { return value_; }
+  bool valid() const { return value_ != INVALID_HANDLE_VALUE && value_ != nullptr; }
+  HANDLE release() { return std::exchange(value_, INVALID_HANDLE_VALUE); }
+  void reset(HANDLE next = INVALID_HANDLE_VALUE) {
+    if (valid()) CloseHandle(value_);
+    value_ = next;
+  }
+};
+
+enum class Kind { File, Runtime, Process };
+struct Resource {
+  const Kind kind;
+  bool closed = false;
+  explicit Resource(Kind value) : kind(value) {}
+  virtual ~Resource() = default;
+};
+struct File : Resource {
+  std::wstring requestedPath;
+  std::wstring path;
+  std::vector<Handle> handles;
+  explicit File(std::wstring path) : Resource(Kind::File), requestedPath(path), path(std::move(path)) {}
+  HANDLE get() const { return handles.back().get(); }
+};
+struct Runtime : Resource {
+  std::wstring path;
+  std::vector<Handle> parents;
+  Handle directory;
+  std::vector<Handle> immutableFiles;
+  // Main-thread admission is single-flight; only the accepted copy owns the
+  // atomic cancellation flag consumed by its async worker. ERROR_BUSY rejects
+  // another copy before it can reset that flag or replace pending ownership.
+  bool snapshotPending = false;
+  std::atomic_bool snapshotCancelled{false};
+  Runtime() : Resource(Kind::Runtime) {}
+};
+struct Process : Resource {
+  Handle job, process, stdoutRead, stderrRead;
+  DWORD pid = 0;
+  Process() : Resource(Kind::Process) {}
+};
+
+void check(napi_status status);
+napi_value failureValue(napi_env env, const Failure& failure);
+napi_value object(napi_env env);
+napi_value string(napi_env env, const std::string& value);
+napi_value string(napi_env env, const std::wstring& value);
+napi_value number(napi_env env, double value);
+napi_value boolean(napi_env env, bool value);
+napi_value null(napi_env env);
+void set(napi_env env, napi_value object, const char* key, napi_value value);
+std::wstring wide(napi_env env, napi_value value);
+double numeric(napi_env env, napi_value value);
+std::vector<napi_value> array(napi_env env, napi_value value);
+napi_value wrap(napi_env env, std::unique_ptr<Resource> resource);
+Resource& resource(napi_env env, napi_value value, Kind kind);
+
+std::unique_ptr<File> openFile(const std::wstring& path, DWORD access = GENERIC_READ,
+                             bool directory = false);
+napi_value identity(napi_env env, HANDLE handle, const std::wstring& path);
+std::unique_ptr<Runtime> createRuntime(const std::wstring& parent, const std::wstring& prefix);
+void closeRuntime(Runtime& runtime);
+napi_value filesystemCall(napi_env env, const std::wstring& operation,
+                          const std::vector<napi_value>& args);
+std::unique_ptr<Process> spawnProcess(const std::wstring& command, const std::wstring& commandLine,
+                                    const std::wstring& cwd, const std::vector<std::wstring>& environment);
+napi_value processCall(napi_env env, const std::wstring& operation,
+                       const std::vector<napi_value>& args);
+napi_value inspect(napi_env env);
+
+} // namespace rea

native/windows/src/filesystem.cc

@@ -0,0 +1,531 @@
+#include "authority.hpp"
+#include <sddl.h>
+#include <winternl.h>
+
+namespace rea {
+
+static std::wstring hex(const unsigned char* bytes, size_t count) {
+  constexpr wchar_t digits[] = L"0123456789abcdef";
+  std::wstring result;
+  for (size_t index = 0; index < count; ++index) {
+    result += digits[bytes[index] >> 4]; result += digits[bytes[index] & 15];
+  }
+  return result;
+}
+
+static std::wstring localPath(std::wstring path) {
+  if (path.rfind(L"\\\\?\\", 0) == 0) path.erase(0, 4);
+  require(path.size() >= 3 && path[1] == L':' && path[2] == L'\\' &&
+          ((path[0] >= L'A' && path[0] <= L'Z') || (path[0] >= L'a' && path[0] <= L'z')),
+          "Only absolute local NTFS drive paths are supported", path, ERROR_NOT_SUPPORTED);
+  require(path.find(L'/', 0) == std::wstring::npos && path.find(L':', 2) == std::wstring::npos,
+          "Alternate streams and non-local path syntax are unsupported", path, ERROR_NOT_SUPPORTED);
+  require(GetDriveTypeW(path.substr(0, 3).c_str()) == DRIVE_FIXED,
+          "Only fixed local NTFS volumes are supported", path, ERROR_NOT_SUPPORTED);
+  if (path.size() > 3 && path.back() == L'\\') path.pop_back();
+  require(path.size() == 3 || path.back() != L'\\', "Repeated path separators are unsupported", path, ERROR_NOT_SUPPORTED);
+  size_t begin = 3;
+  while (begin < path.size()) {
+    const auto end = path.find(L'\\', begin);
+    const auto component = path.substr(begin, end == std::wstring::npos ? end : end - begin);
+    require(!component.empty() && component != L"." && component != L".." &&
+            component.back() != L'.' && component.back() != L' ',
+            "Ambiguous Windows path component is unsupported", path, ERROR_NOT_SUPPORTED);
+    if (end == std::wstring::npos) break;
+    begin = end + 1;
+  }
+  return path;
+}
+
+static Handle openComponent(const std::wstring& path, DWORD access, bool directory, DWORD sharing = FILE_SHARE_READ) {
+  // Attribute-only opens do not participate in Windows share-access checks.
+  // Directory guards need FILE_LIST_DIRECTORY to prevent replacement and
+  // in-place reparse conversion while descendant paths are being consumed.
+  Handle handle(CreateFileW((L"\\\\?\\" + path).c_str(), access | FILE_READ_ATTRIBUTES | READ_CONTROL |
+                           (directory ? FILE_LIST_DIRECTORY : 0),
+                           sharing, nullptr, OPEN_EXISTING,
+                           FILE_FLAG_OPEN_REPARSE_POINT | FILE_FLAG_BACKUP_SEMANTICS, nullptr));
+  require(handle.valid(), "Open Windows path component failed", path);
+  FILE_ATTRIBUTE_TAG_INFO info{};
+  require(GetFileInformationByHandleEx(handle.get(), FileAttributeTagInfo, &info, sizeof(info)),
+          "Read Windows path attributes failed", path);
+  if ((info.FileAttributes & FILE_ATTRIBUTE_REPARSE_POINT) != 0)
+    throw Failure("Reparse path component is unsupported (tag " + std::to_string(info.ReparseTag) + ")",
+                  path, ERROR_NOT_SUPPORTED);
+  require(((info.FileAttributes & FILE_ATTRIBUTE_DIRECTORY) != 0) == directory,
+          directory ? "Expected a directory path component" : "Target is not a regular file", path,
+          directory ? ERROR_PATH_NOT_FOUND : ERROR_DIRECTORY);
+  require(GetFileType(handle.get()) == FILE_TYPE_DISK, "Windows object is not a disk file", path, ERROR_NOT_SUPPORTED);
+  return handle;
+}
+
+std::unique_ptr<File> openFile(const std::wstring& requested, DWORD access, bool directory) {
+  auto result = std::make_unique<File>(localPath(requested));
+  result->requestedPath = requested;
+  const auto& path = result->path;
+  require(directory || path.size() > 3, "Target is not a regular file", requested, ERROR_DIRECTORY);
+  result->handles.push_back(openComponent(path.substr(0, 3), 0, true));
+  wchar_t filesystem[64]{};
+  DWORD flags = 0;
+  require(GetVolumeInformationByHandleW(result->handles.front().get(), nullptr, 0, nullptr, nullptr,
+                                       &flags, filesystem, 64), "Read volume semantics failed", path);
+  require(std::wstring(filesystem) == L"NTFS" && (flags & FILE_PERSISTENT_ACLS) != 0,
+          "Backing volume must be NTFS with persistent ACLs", path, ERROR_NOT_SUPPORTED);
+  size_t offset = 3;
+  while (offset < path.size()) {
+    auto end = path.find(L'\\', offset);
+    const bool final = end == std::wstring::npos;
+    auto child = openComponent(path.substr(0, end), final ? access : 0, !final || directory);
+    // Once the next component is pinned against deletion, its parent cannot
+    // become empty and NTFS cannot convert that parent into a reparse point.
+    // Relax only ancestor write sharing so unrelated child renames can proceed.
+    // Independent evidence: tests/fixtures/windows/processBoundary.cc attempts
+    // FSCTL_SET_REPARSE_POINT on the nonempty pinned ancestor and observes denial.
+    // SUBST aliases and mounted-folder/reparse namespace variants are outside
+    // the admitted P0 evidence; requested and final handle paths remain distinct.
+    const auto parentPath = offset == 3 ? path.substr(0, 3) : path.substr(0, offset - 1);
+    result->handles.back() = openComponent(parentPath, 0, true, FILE_SHARE_READ | FILE_SHARE_WRITE);
+    result->handles.push_back(std::move(child));
+    if (final) break;
+    offset = end + 1;
+  }
+  return result;
+}
+
+napi_value identity(napi_env env, HANDLE handle, const std::wstring& path) {
+  FILE_ID_INFO info{};
+  require(GetFileInformationByHandleEx(handle, FileIdInfo, &info, sizeof(info)),
+          "Stable 128-bit Windows file identity is unavailable", path);
+  std::array<wchar_t, 32768> finalPath;
+  const auto length = GetFinalPathNameByHandleW(handle, finalPath.data(), finalPath.size(), FILE_NAME_NORMALIZED);
+  require(length > 0 && length < finalPath.size(), "Read final handle path failed", path);
+  LARGE_INTEGER size{};
+  FILE_STANDARD_INFO standard{};
+  require(GetFileInformationByHandleEx(handle, FileStandardInfo, &standard, sizeof(standard)),
+          "Read handle metadata failed", path);
+  size = standard.EndOfFile;
+  require(size.QuadPart >= 0 && size.QuadPart <= 9007199254740991LL, "File size exceeds exact numeric representation", path,
+          ERROR_NOT_SUPPORTED);
+  auto result = object(env);
+  set(env, result, "requestedPath", string(env, path));
+  set(env, result, "finalPath", string(env, std::wstring(finalPath.data(), length)));
+  set(env, result, "filesystem", string(env, std::string("NTFS")));
+  std::array<unsigned char, 8> serial;
+  for (size_t index = 0; index < serial.size(); ++index)
+    serial[index] = static_cast<unsigned char>(info.VolumeSerialNumber >> ((7 - index) * 8));
+  set(env, result, "volumeSerial", string(env, hex(serial.data(), serial.size())));
+  set(env, result, "fileId", string(env, hex(info.FileId.Identifier, 16)));
+  set(env, result, "size", number(env, static_cast<double>(size.QuadPart)));
+  set(env, result, "directory", boolean(env, standard.Directory != FALSE));
+  return result;
+}
+
+struct Security {
+  std::vector<unsigned char> user;
+  std::array<unsigned char, SECURITY_MAX_SID_SIZE> system{};
+  std::vector<unsigned char> acl;
+  SECURITY_DESCRIPTOR descriptor{};
+  PSID userSid() const { return reinterpret_cast<const TOKEN_USER*>(user.data())->User.Sid; }
+  Security() {
+    Handle token;
+    HANDLE raw;
+    require(OpenProcessToken(GetCurrentProcess(), TOKEN_QUERY, &raw), "Read current user token failed");
+    token.reset(raw);
+    DWORD size = 0;
+    GetTokenInformation(token.get(), TokenUser, nullptr, 0, &size);
+    user.resize(size);
+    require(GetTokenInformation(token.get(), TokenUser, user.data(), size, &size), "Read current user SID failed");
+    DWORD systemSize = system.size();
+    require(CreateWellKnownSid(WinLocalSystemSid, nullptr, system.data(), &systemSize), "Create SYSTEM SID failed");
+    acl.resize(sizeof(ACL) + 2 * (sizeof(ACCESS_ALLOWED_ACE) - sizeof(DWORD)) + GetLengthSid(userSid()) + systemSize);
+    auto access = reinterpret_cast<PACL>(acl.data());
+    require(InitializeAcl(access, acl.size(), ACL_REVISION), "Initialize private DACL failed");
+    for (PSID sid : {userSid(), static_cast<PSID>(system.data())})
+      require(AddAccessAllowedAceEx(access, ACL_REVISION, OBJECT_INHERIT_ACE | CONTAINER_INHERIT_ACE,
+                                   FILE_ALL_ACCESS, sid), "Populate private DACL failed");
+    require(InitializeSecurityDescriptor(&descriptor, SECURITY_DESCRIPTOR_REVISION) &&
+            SetSecurityDescriptorOwner(&descriptor, userSid(), FALSE) &&
+            SetSecurityDescriptorDacl(&descriptor, TRUE, access, FALSE) &&
+            SetSecurityDescriptorControl(&descriptor, SE_DACL_PROTECTED, SE_DACL_PROTECTED),
+            "Create protected security descriptor failed");
+  }
+};
+
+static Handle createRelative(HANDLE parent, const std::wstring& name, DWORD access, bool directory,
+                             Security& security, const std::wstring& path) {
+  require(!name.empty() && name.find_first_of(L"\\/:\"<>|?*") == std::wstring::npos && name.size() < 32768,
+          "Private object requires one filename component", path, ERROR_INVALID_PARAMETER);
+  UNICODE_STRING coordinate{};
+  coordinate.Buffer = const_cast<wchar_t*>(name.data());
+  coordinate.Length = static_cast<USHORT>(name.size() * sizeof(wchar_t));
+  coordinate.MaximumLength = coordinate.Length;
+  OBJECT_ATTRIBUTES attributes;
+  InitializeObjectAttributes(&attributes, &coordinate, OBJ_CASE_INSENSITIVE, parent, &security.descriptor);
+  IO_STATUS_BLOCK observation{};
+  HANDLE raw = INVALID_HANDLE_VALUE;
+  const auto status = NtCreateFile(&raw, access | SYNCHRONIZE, &attributes, &observation, nullptr,
+                                   FILE_ATTRIBUTE_NORMAL, FILE_SHARE_READ, FILE_CREATE,
+                                   FILE_SYNCHRONOUS_IO_NONALERT | FILE_OPEN_REPARSE_POINT |
+                                   (directory ? FILE_DIRECTORY_FILE : FILE_NON_DIRECTORY_FILE), nullptr, 0);
+  if (status < 0) throw Failure("Create private object relative to its admitted parent failed", path,
+                                RtlNtStatusToDosError(status));
+  Handle result(raw);
+  require(result.valid() && observation.Information == FILE_CREATED,
+          "Private creation did not return a new object handle", path, ERROR_ACCESS_DENIED);
+  return result;
+}
+
+static void verifyPrivate(HANDLE handle, const std::wstring& path, bool root) {
+  Security expected;
+  PSID owner = nullptr;
+  PACL acl = nullptr;
+  PSECURITY_DESCRIPTOR raw = nullptr;
+  const DWORD code = GetSecurityInfo(handle, SE_FILE_OBJECT, OWNER_SECURITY_INFORMATION | DACL_SECURITY_INFORMATION,
+                                     &owner, nullptr, &acl, nullptr, &raw);
+  if (code != ERROR_SUCCESS) throw Failure("Read private DACL by handle failed", path, code);
+  const auto descriptor = std::unique_ptr<void, decltype(&LocalFree)>(raw, LocalFree);
+  require(owner != nullptr && EqualSid(owner, expected.userSid()), "Private object owner is not the current user", path,
+          ERROR_ACCESS_DENIED);
+  SECURITY_DESCRIPTOR_CONTROL control;
+  DWORD revision;
+  require(GetSecurityDescriptorControl(raw, &control, &revision), "Read DACL control flags failed", path);
+  require(acl != nullptr && (control & SE_DACL_PRESENT) != 0 && (!root || (control & SE_DACL_PROTECTED) != 0),
+          "Private object requires a present protected DACL", path, ERROR_ACCESS_DENIED);
+  require(acl->AceCount == 2, "Private DACL contains unexpected trustees", path, ERROR_ACCESS_DENIED);
+  bool user = false, system = false;
+  for (DWORD index = 0; index < acl->AceCount; ++index) {
+    void* rawAce;
+    require(GetAce(acl, index, &rawAce), "Read private DACL entry failed", path);
+    const auto ace = static_cast<ACCESS_ALLOWED_ACE*>(rawAce);
+    require(ace->Header.AceType == ACCESS_ALLOWED_ACE_TYPE && ace->Mask == FILE_ALL_ACCESS &&
+            (ace->Header.AceFlags & INHERIT_ONLY_ACE) == 0 &&
+            (!root || (ace->Header.AceFlags & (OBJECT_INHERIT_ACE | CONTAINER_INHERIT_ACE)) ==
+                      (OBJECT_INHERIT_ACE | CONTAINER_INHERIT_ACE)),
+            "Private DACL contains unsupported rights or ACE type", path, ERROR_ACCESS_DENIED);
+    PSID sid = const_cast<DWORD*>(&ace->SidStart);
+    if (EqualSid(sid, expected.userSid())) user = true;
+    else if (EqualSid(sid, expected.system.data())) system = true;
+    else throw Failure("Private DACL permits an unrelated principal", path, ERROR_ACCESS_DENIED);
+  }
+  require(user && system, "Private DACL must allow only current user and SYSTEM", path, ERROR_ACCESS_DENIED);
+}
+
+std::unique_ptr<Runtime> createRuntime(const std::wstring& parentPath, const std::wstring& prefix) {
+  auto parent = openFile(parentPath, 0, true);
+  require(!prefix.empty() && prefix.find_first_of(L"\\/:\"<>|?*") == std::wstring::npos,
+          "Runtime prefix must be one filename component", parentPath, ERROR_INVALID_PARAMETER);
+  std::array<unsigned char, 16> random;
+  require(BCryptGenRandom(nullptr, random.data(), random.size(), BCRYPT_USE_SYSTEM_PREFERRED_RNG) == 0,
+          "Generate runtime identity failed", parentPath, ERROR_GEN_FAILURE);
+  auto result = std::make_unique<Runtime>();
+  result->path = parent->path + L"\\" + prefix + hex(random.data(), random.size());
+  Security security;
+  result->directory = createRelative(parent->get(), prefix + hex(random.data(), random.size()),
+                                     DELETE | FILE_LIST_DIRECTORY | FILE_READ_ATTRIBUTES | READ_CONTROL,
+                                     true, security, result->path);
+  try {
+    verifyPrivate(result->directory.get(), result->path, true);
+    // The owned child pins the parent nonempty before write sharing is relaxed.
+    parent->handles.back() = openComponent(parent->path, 0, true, FILE_SHARE_READ | FILE_SHARE_WRITE);
+    result->parents = std::move(parent->handles);
+  } catch (...) {
+    FILE_DISPOSITION_INFO deletion{TRUE};
+    SetFileInformationByHandle(result->directory.get(), FileDispositionInfo, &deletion, sizeof(deletion));
+    throw;
+  }
+  return result;
+}
+
+static std::wstring relativePath(Runtime& root, const std::wstring& relative) {
+  require(!relative.empty() && relative[0] != L'\\' && relative.find(L':') == std::wstring::npos,
+          "Runtime coordinate must be a relative path", relative, ERROR_INVALID_PARAMETER);
+  return localPath(root.path + L"\\" + relative);
+}
+
+static std::unique_ptr<File> runtimeDirectory(Runtime& root, const std::wstring& path) {
+  auto result = std::make_unique<File>(path);
+  HANDLE duplicate;
+  require(DuplicateHandle(GetCurrentProcess(), root.directory.get(), GetCurrentProcess(), &duplicate, 0, FALSE,
+                          DUPLICATE_SAME_ACCESS), "Duplicate private directory handle failed", path);
+  result->handles.emplace_back(duplicate);
+  size_t offset = root.path.size() + 1;
+  while (offset < path.size()) {
+    const auto end = path.find(L'\\', offset);
+    result->handles.push_back(openComponent(path.substr(0, end), 0, true));
+    if (end == std::wstring::npos) break;
+    offset = end + 1;
+  }
+  return result;
+}
+
+static void directory(Runtime& root, const std::wstring& relative) {
+  const auto path = relativePath(root, relative);
+  const auto parentPath = path.substr(0, path.find_last_of(L'\\'));
+  auto parent = runtimeDirectory(root, parentPath);
+  verifyPrivate(parent->get(), parentPath, parentPath == root.path);
+  Security security;
+  try {
+    auto created = createRelative(parent->get(), path.substr(path.find_last_of(L'\\') + 1),
+                                  FILE_LIST_DIRECTORY | FILE_READ_ATTRIBUTES | READ_CONTROL,
+                                  true, security, path);
+    verifyPrivate(created.get(), path, false);
+  } catch (const Failure& failure) {
+    if (failure.win32 != ERROR_ALREADY_EXISTS && failure.win32 != ERROR_FILE_EXISTS) throw;
+    auto existing = runtimeDirectory(root, path);
+    verifyPrivate(existing->get(), path, false);
+  }
+}
+
+static Handle createPrivateFile(Runtime& root, const std::wstring& relative) {
+  const auto path = relativePath(root, relative);
+  const auto parentPath = path.substr(0, path.find_last_of(L'\\'));
+  auto parent = runtimeDirectory(root, parentPath);
+  verifyPrivate(parent->get(), parentPath, parentPath == root.path);
+  Security security;
+  auto file = createRelative(parent->get(), path.substr(path.find_last_of(L'\\') + 1),
+                             GENERIC_WRITE | GENERIC_READ | READ_CONTROL, false, security, path);
+  verifyPrivate(file.get(), path, false);
+  return file;
+}
+
+static void writeBytes(HANDLE file, const void* bytes, DWORD count, const std::wstring& path) {
+  DWORD written;
+  require(WriteFile(file, bytes, count, &written, nullptr) && written == count, "Write private file failed", path);
+}
+
+static void dispose(HANDLE handle, const std::wstring& path) {
+  FILE_BASIC_INFO info{};
+  require(GetFileInformationByHandleEx(handle, FileBasicInfo, &info, sizeof(info)), "Read cleanup attributes failed", path);
+  if ((info.FileAttributes & FILE_ATTRIBUTE_READONLY) != 0) {
+    info.FileAttributes &= ~FILE_ATTRIBUTE_READONLY;
+    require(SetFileInformationByHandle(handle, FileBasicInfo, &info, sizeof(info)), "Clear owned readonly attribute failed", path);
+  }
+  FILE_DISPOSITION_INFO deletion{TRUE};
+  require(SetFileInformationByHandle(handle, FileDispositionInfo, &deletion, sizeof(deletion)), "Delete owned object by handle failed", path);
+}
+
+void closeRuntime(Runtime& root) {
+  if (root.closed) return;
+  // Windows keeps the bearer descriptor and snapshot leases until this owner
+  // cleanup. POSIX removes its consumed descriptor earlier. Abrupt owner death
+  // closes process jobs but cannot run this walk, so private files can remain.
+  root.immutableFiles.clear();
+  struct ReleaseRuntime {
+    Runtime& root;
+    ~ReleaseRuntime() { root.directory.reset(); root.parents.clear(); root.closed = true; }
+  } release{root};
+  // Each traversed directory stays locked against replacement. Reparse entries
+  // are unlinked as objects; their targets are never enumerated or deleted.
+  struct Frame {
+    Handle directory;
+    HANDLE search = INVALID_HANDLE_VALUE;
+    std::wstring path;
+    WIN32_FIND_DATAW next{};
+    bool pending = false;
+    Frame(Handle handle, std::wstring path) : directory(std::move(handle)), path(std::move(path)) {
+      search = FindFirstFileExW((L"\\\\?\\" + this->path + L"\\*").c_str(), FindExInfoBasic, &next,
+                               FindExSearchNameMatch, nullptr, 0);
+      pending = search != INVALID_HANDLE_VALUE;
+      require(pending || GetLastError() == ERROR_FILE_NOT_FOUND, "Enumerate runtime cleanup failed", this->path);
+    }
+    ~Frame() { if (search != INVALID_HANDLE_VALUE) FindClose(search); }
+  };
+  std::vector<std::unique_ptr<Frame>> frames;
+  HANDLE duplicate;
+  require(DuplicateHandle(GetCurrentProcess(), root.directory.get(), GetCurrentProcess(), &duplicate, 0, FALSE,
+                          DUPLICATE_SAME_ACCESS), "Duplicate runtime cleanup handle failed", root.path);
+  frames.push_back(std::make_unique<Frame>(Handle(duplicate), root.path));
+  while (!frames.empty()) {
+    auto& frame = *frames.back();
+    if (!frame.pending) {
+      if (frame.search != INVALID_HANDLE_VALUE) { FindClose(frame.search); frame.search = INVALID_HANDLE_VALUE; }
+      dispose(frame.directory.get(), frame.path);
+      frames.pop_back();
+      continue;
+    }
+    const auto name = std::wstring(frame.next.cFileName);
+    frame.pending = FindNextFileW(frame.search, &frame.next) != FALSE;
+    require(frame.pending || GetLastError() == ERROR_NO_MORE_FILES, "Continue runtime cleanup enumeration failed", frame.path);
+    if (name == L"." || name == L"..") continue;
+    const auto path = frame.path + L"\\" + name;
+    Handle child(CreateFileW((L"\\\\?\\" + path).c_str(), DELETE | GENERIC_READ | FILE_WRITE_ATTRIBUTES,
+                            FILE_SHARE_READ, nullptr, OPEN_EXISTING,
+                            FILE_FLAG_OPEN_REPARSE_POINT | FILE_FLAG_BACKUP_SEMANTICS, nullptr));
+    require(child.valid(), "Open owned cleanup object failed", path);
+    FILE_ATTRIBUTE_TAG_INFO info{};
+    require(GetFileInformationByHandleEx(child.get(), FileAttributeTagInfo, &info, sizeof(info)), "Read cleanup object tag failed", path);
+    if ((info.FileAttributes & FILE_ATTRIBUTE_DIRECTORY) != 0 && (info.FileAttributes & FILE_ATTRIBUTE_REPARSE_POINT) == 0)
+      frames.push_back(std::make_unique<Frame>(std::move(child), path));
+    else dispose(child.get(), path);
+  }
+}
+
+struct SnapshotWork {
+  napi_env env;
+  napi_async_work work = nullptr;
+  napi_deferred deferred = nullptr;
+  napi_ref rootReference = nullptr;
+  Runtime* root;
+  std::unique_ptr<File> source;
+  Handle destination;
+  std::wstring path;
+  std::wstring digest;
+  std::unique_ptr<Failure> failure;
+  SnapshotWork(napi_env env, Runtime& root) : env(env), root(&root) {}
+};
+
+static void copySnapshot(napi_env, void* pointer) {
+  auto& work = *static_cast<SnapshotWork*>(pointer);
+  try {
+    BCRYPT_ALG_HANDLE algorithm = nullptr;
+    require(BCryptOpenAlgorithmProvider(&algorithm, BCRYPT_SHA256_ALGORITHM, nullptr, 0) == 0,
+            "Initialize snapshot SHA-256 failed", work.source->path, ERROR_GEN_FAILURE);
+    struct Algorithm { BCRYPT_ALG_HANDLE handle; ~Algorithm() { BCryptCloseAlgorithmProvider(handle, 0); } } owner{algorithm};
+    BCRYPT_HASH_HANDLE hash = nullptr;
+    require(BCryptCreateHash(algorithm, &hash, nullptr, 0, nullptr, 0, 0) == 0,
+            "Create snapshot SHA-256 state failed", work.source->path, ERROR_GEN_FAILURE);
+    struct Hash { BCRYPT_HASH_HANDLE handle; ~Hash() { BCryptDestroyHash(handle); } } hashOwner{hash};
+    std::array<unsigned char, 65536> buffer;
+    while (true) {
+      require(!work.root->snapshotCancelled.load(), "Admitted snapshot was cancelled", work.path, ERROR_OPERATION_ABORTED);
+      DWORD count;
+      require(ReadFile(work.source->get(), buffer.data(), buffer.size(), &count, nullptr),
+              "Read admitted source handle failed", work.source->path);
+      if (count == 0) break;
+      writeBytes(work.destination.get(), buffer.data(), count, work.path);
+      require(BCryptHashData(hash, buffer.data(), count, 0) == 0,
+              "Hash admitted snapshot bytes failed", work.source->path, ERROR_GEN_FAILURE);
+    }
+    std::array<unsigned char, 32> digest;
+    require(BCryptFinishHash(hash, digest.data(), digest.size(), 0) == 0,
+            "Finish snapshot SHA-256 failed", work.source->path, ERROR_GEN_FAILURE);
+    require(FlushFileBuffers(work.destination.get()), "Flush private snapshot failed", work.path);
+    work.digest = hex(digest.data(), digest.size());
+  } catch (const Failure& failure) {
+    work.failure = std::make_unique<Failure>(failure);
+  } catch (const std::exception& failure) {
+    work.failure = std::make_unique<Failure>(failure.what(), work.path, ERROR_GEN_FAILURE);
+  }
+}
+
+static void completeSnapshot(napi_env env, napi_status status, void* pointer) {
+  std::unique_ptr<SnapshotWork> work(static_cast<SnapshotWork*>(pointer));
+  work->root->snapshotPending = false;
+  try {
+    if (work->failure) throw *work->failure;
+    require(status == napi_ok && !work->root->snapshotCancelled.load(), "Native snapshot worker was cancelled", work->path, ERROR_OPERATION_ABORTED);
+    auto result = object(env);
+    set(env, result, "sha256", string(env, work->digest));
+    set(env, result, "source", identity(env, work->source->get(), work->source->requestedPath));
+    set(env, result, "snapshot", identity(env, work->destination.get(), work->path));
+    work->root->immutableFiles.push_back(std::move(work->destination));
+    check(napi_resolve_deferred(env, work->deferred, result));
+  } catch (const Failure& failure) {
+    napi_reject_deferred(env, work->deferred, failureValue(env, failure));
+  } catch (const std::exception& failure) {
+    napi_reject_deferred(env, work->deferred,
+                         failureValue(env, Failure(failure.what(), work->path, ERROR_GEN_FAILURE)));
+  }
+  napi_delete_reference(env, work->rootReference);
+  napi_delete_async_work(env, work->work);
+}
+
+static napi_value snapshot(napi_env env, napi_value rootValue, Runtime& root,
+                           const std::wstring& sourcePath, const std::wstring& relative) {
+  auto work = std::make_unique<SnapshotWork>(env, root);
+  work->source = openFile(sourcePath);
+  work->path = relativePath(root, relative);
+  work->destination = createPrivateFile(root, relative);
+  napi_value promise;
+  check(napi_create_promise(env, &work->deferred, &promise));
+  check(napi_create_reference(env, rootValue, 1, &work->rootReference));
+  const auto label = string(env, std::string("REA admitted Windows snapshot"));
+  root.snapshotCancelled.store(false);
+  try {
+    check(napi_create_async_work(env, nullptr, label, copySnapshot, completeSnapshot, work.get(), &work->work));
+    check(napi_queue_async_work(env, work->work));
+  } catch (...) {
+    if (work->work) napi_delete_async_work(env, work->work);
+    napi_delete_reference(env, work->rootReference);
+    throw;
+  }
+  root.snapshotPending = true;
+  work.release();
+  return promise;
+}
+
+napi_value filesystemCall(napi_env env, const std::wstring& operation, const std::vector<napi_value>& args) {
+  const auto expected = operation == L"open" || operation == L"close" || operation == L"runtime_close" || operation == L"runtime_snapshot_cancel" ? 1
+                      : operation == L"runtime_create" || operation == L"runtime_mkdir" || operation == L"runtime_open" ? 2 : 3;
+  require(args.size() == static_cast<size_t>(expected), "Wrong native filesystem argument count", L"", ERROR_INVALID_PARAMETER);
+  if (operation == L"open") {
+    auto file = openFile(wide(env, args[0]));
+    auto result = identity(env, file->get(), file->requestedPath);
+    set(env, result, "handle", wrap(env, std::move(file)));
+    return result;
+  }
+  if (operation == L"close") {
+    auto& file = static_cast<File&>(resource(env, args[0], Kind::File));
+    file.handles.clear(); file.closed = true;
+    return null(env);
+  }
+  if (operation == L"read") {
+    auto& file = static_cast<File&>(resource(env, args[0], Kind::File));
+    const auto position = numeric(env, args[1]);
+    const auto length = numeric(env, args[2]);
+    require(position >= 0 && position <= 9007199254740991.0 && position == static_cast<int64_t>(position) &&
+            length >= 0 && length <= 65536 && length == static_cast<DWORD>(length),
+            "Read coordinates exceed the native chunk boundary", file.path, ERROR_INVALID_PARAMETER);
+    LARGE_INTEGER offset; offset.QuadPart = static_cast<int64_t>(position);
+    require(SetFilePointerEx(file.get(), offset, nullptr, FILE_BEGIN), "Seek admitted file handle failed", file.path);
+    std::array<unsigned char, 65536> buffer;
+    DWORD count;
+    require(ReadFile(file.get(), buffer.data(), static_cast<DWORD>(length), &count, nullptr), "Read admitted file handle failed", file.path);
+    napi_value result;
+    check(napi_create_buffer_copy(env, count, buffer.data(), nullptr, &result));
+    return result;
+  }
+  if (operation == L"runtime_create") {
+    auto root = createRuntime(wide(env, args[0]), wide(env, args[1]));
+    auto result = identity(env, root->directory.get(), root->path);
+    set(env, result, "path", string(env, root->path));
+    set(env, result, "privateDacl", boolean(env, true));
+    set(env, result, "handle", wrap(env, std::move(root)));
+    return result;
+  }
+  auto& root = static_cast<Runtime&>(resource(env, args[0], Kind::Runtime));
+  if (operation == L"runtime_snapshot_cancel") { root.snapshotCancelled.store(true); return null(env); }
+  require(!root.snapshotPending, "Runtime snapshot is still pending", root.path, ERROR_BUSY);
+  // Reject overlapping operations before snapshot() resets cancellation. The
+  // one accepted worker and WindowsPrivateRuntime retain the same root lease.
+  if (operation == L"runtime_close") { closeRuntime(root); return null(env); }
+  if (operation == L"runtime_mkdir") { directory(root, wide(env, args[1])); return null(env); }
+  if (operation == L"runtime_open") {
+    const auto path = relativePath(root, wide(env, args[1]));
+    auto file = runtimeDirectory(root, path.substr(0, path.find_last_of(L'\\')));
+    file->path = path;
+    file->requestedPath = path;
+    file->handles.push_back(openComponent(path, GENERIC_READ, false));
+    verifyPrivate(file->get(), path, false);
+    auto result = identity(env, file->get(), path);
+    set(env, result, "handle", wrap(env, std::move(file)));
+    return result;
+  }
+  if (operation == L"runtime_write") {
+    bool isBuffer; check(napi_is_buffer(env, args[2], &isBuffer));
+    require(isBuffer, "Private write requires a byte buffer", root.path, ERROR_INVALID_PARAMETER);
+    void* bytes; size_t length; check(napi_get_buffer_info(env, args[2], &bytes, &length));
+    require(length <= MAXDWORD, "Private write exceeds Win32 byte representation", root.path, ERROR_INVALID_PARAMETER);
+    auto file = createPrivateFile(root, wide(env, args[1]));
+    writeBytes(file.get(), bytes, static_cast<DWORD>(length), root.path);
+    require(FlushFileBuffers(file.get()), "Flush private runtime file failed", root.path);
+    root.immutableFiles.push_back(std::move(file));
+    return null(env);
+  }
+  if (operation == L"runtime_snapshot") {
+    return snapshot(env, args[0], root, wide(env, args[1]), wide(env, args[2]));
+  }
+  throw Failure("Unknown native filesystem operation", L"", ERROR_INVALID_PARAMETER);
+}
+
+} // namespace rea

native/windows/src/process.cc

@@ -0,0 +1,271 @@
+#include "authority.hpp"
+
+namespace rea {
+
+class Attributes {
+  std::vector<unsigned char> storage_;
+public:
+  explicit Attributes(DWORD count) {
+    SIZE_T size = 0;
+    InitializeProcThreadAttributeList(nullptr, count, 0, &size);
+    storage_.resize(size);
+    require(InitializeProcThreadAttributeList(get(), count, 0, &size), "Initialize process attributes failed");
+  }
+  ~Attributes() { DeleteProcThreadAttributeList(get()); }
+  LPPROC_THREAD_ATTRIBUTE_LIST get() { return reinterpret_cast<LPPROC_THREAD_ATTRIBUTE_LIST>(storage_.data()); }
+  void add(DWORD_PTR key, void* value, SIZE_T size) {
+    require(UpdateProcThreadAttribute(get(), 0, key, value, size, nullptr, nullptr),
+            "Windows atomic process attribute is unavailable");
+  }
+};
+
+static Handle createJob() {
+  Handle job(CreateJobObjectW(nullptr, nullptr));
+  require(job.valid(), "Create owned Job Object failed");
+  JOBOBJECT_EXTENDED_LIMIT_INFORMATION policy{};
+  policy.BasicLimitInformation.LimitFlags = JOB_OBJECT_LIMIT_KILL_ON_JOB_CLOSE;
+  require(SetInformationJobObject(job.get(), JobObjectExtendedLimitInformation, &policy, sizeof(policy)),
+          "Apply kill-on-owner-close Job Object policy failed");
+  JOBOBJECT_EXTENDED_LIMIT_INFORMATION actual{};
+  require(QueryInformationJobObject(job.get(), JobObjectExtendedLimitInformation, &actual, sizeof(actual), nullptr),
+          "Read Job Object policy failed");
+  require(actual.BasicLimitInformation.LimitFlags == JOB_OBJECT_LIMIT_KILL_ON_JOB_CLOSE,
+          "Job Object policy permits unexpected breakaway", L"", ERROR_ACCESS_DENIED);
+  return job;
+}
+
+static void pipe(Handle& read, Handle& write) {
+  SECURITY_ATTRIBUTES attributes{sizeof(SECURITY_ATTRIBUTES), nullptr, TRUE};
+  HANDLE rawRead, rawWrite;
+  require(CreatePipe(&rawRead, &rawWrite, &attributes, 0), "Create owned process output pipe failed");
+  read.reset(rawRead); write.reset(rawWrite);
+  require(SetHandleInformation(read.get(), HANDLE_FLAG_INHERIT, 0), "Protect process output handle inheritance failed");
+}
+
+std::unique_ptr<Process> spawnProcess(const std::wstring& command, const std::wstring& commandLine,
+                                    const std::wstring& cwd, const std::vector<std::wstring>& environment) {
+  require(command.size() >= 3 && command[1] == L':' && command[2] == L'\\',
+          "Owned Windows process requires an absolute executable path", command, ERROR_INVALID_PARAMETER);
+  auto result = std::make_unique<Process>();
+  result->job = createJob();
+  Handle stdoutWrite, stderrWrite;
+  pipe(result->stdoutRead, stdoutWrite); pipe(result->stderrRead, stderrWrite);
+  SECURITY_ATTRIBUTES security{sizeof(SECURITY_ATTRIBUTES), nullptr, TRUE};
+  Handle input(CreateFileW(L"NUL", GENERIC_READ, FILE_SHARE_READ | FILE_SHARE_WRITE,
+                          &security, OPEN_EXISTING, FILE_ATTRIBUTE_NORMAL, nullptr));
+  require(input.valid(), "Open owned process null input failed");
+  Attributes attributes(2);
+  HANDLE job = result->job.get();
+  attributes.add(PROC_THREAD_ATTRIBUTE_JOB_LIST, &job, sizeof(job));
+  std::array<HANDLE, 3> inherited{input.get(), stdoutWrite.get(), stderrWrite.get()};
+  attributes.add(PROC_THREAD_ATTRIBUTE_HANDLE_LIST, inherited.data(), sizeof(inherited));
+  STARTUPINFOEXW startup{};
+  startup.StartupInfo.cb = sizeof(startup);
+  startup.StartupInfo.dwFlags = STARTF_USESTDHANDLES;
+  startup.StartupInfo.hStdInput = input.get();
+  startup.StartupInfo.hStdOutput = stdoutWrite.get();
+  startup.StartupInfo.hStdError = stderrWrite.get();
+  startup.lpAttributeList = attributes.get();
+  // Windows environment names use ordinal case-insensitive comparison, not
+  // locale collation or JavaScript's expanding Unicode uppercase conversion.
+  auto orderedEnvironment = environment;
+  auto keyLength = [&](const std::wstring& entry) {
+    const auto end = entry.find(L'=', entry.front() == L'=' ? 1 : 0);
+    require(end != std::wstring::npos && end > 0, "Invalid child environment name", command,
+            ERROR_INVALID_PARAMETER);
+    return static_cast<int>(end);
+  };
+  for (const auto& entry : orderedEnvironment) {
+    require(!entry.empty(), "Empty child environment entry", command, ERROR_INVALID_PARAMETER);
+    keyLength(entry);
+  }
+  auto compareNames = [&](const std::wstring& left, const std::wstring& right) {
+    const auto result = CompareStringOrdinal(left.data(), keyLength(left), right.data(), keyLength(right), TRUE);
+    require(result != 0, "Compare Windows environment names failed", command);
+    return result;
+  };
+  std::stable_sort(orderedEnvironment.begin(), orderedEnvironment.end(),
+                   [&](const std::wstring& left, const std::wstring& right) {
+                     return compareNames(left, right) == CSTR_LESS_THAN;
+                   });
+  std::vector<std::wstring> uniqueEnvironment;
+  for (auto& entry : orderedEnvironment) {
+    if (!uniqueEnvironment.empty() && compareNames(uniqueEnvironment.back(), entry) == CSTR_EQUAL)
+      uniqueEnvironment.back() = std::move(entry);
+    else uniqueEnvironment.push_back(std::move(entry));
+  }
+  std::vector<wchar_t> variables;
+  for (const auto& entry : uniqueEnvironment) {
+    variables.insert(variables.end(), entry.begin(), entry.end()); variables.push_back(L'\0');
+  }
+  variables.push_back(L'\0');
+  if (uniqueEnvironment.empty()) variables.push_back(L'\0');
+  std::vector<wchar_t> line(commandLine.begin(), commandLine.end()); line.push_back(L'\0');
+  PROCESS_INFORMATION process{};
+  require(CreateProcessW(command.c_str(), line.data(), nullptr, nullptr, TRUE,
+                         CREATE_UNICODE_ENVIRONMENT | EXTENDED_STARTUPINFO_PRESENT | CREATE_SUSPENDED | CREATE_NO_WINDOW,
+                         variables.data(), cwd.empty() ? nullptr : cwd.c_str(), &startup.StartupInfo, &process),
+          "Create process atomically inside owned Job Object failed", command);
+  result->process.reset(process.hProcess);
+  Handle thread(process.hThread);
+  result->pid = process.dwProcessId;
+  // An elevated token may default file ownership to Administrators. Normalize
+  // only the suspended child's default owner so its runtime files belong to the
+  // current user; the caller's token and privileges are not modified.
+  HANDLE rawToken;
+  require(OpenProcessToken(result->process.get(), TOKEN_QUERY | TOKEN_ADJUST_DEFAULT, &rawToken),
+          "Open suspended process default-owner token failed", command);
+  Handle token(rawToken);
+  DWORD tokenSize = 0;
+  GetTokenInformation(token.get(), TokenUser, nullptr, 0, &tokenSize);
+  std::vector<unsigned char> tokenUser(tokenSize);
+  require(GetTokenInformation(token.get(), TokenUser, tokenUser.data(), tokenSize, &tokenSize),
+          "Read suspended process user identity failed", command);
+  TOKEN_OWNER owner{reinterpret_cast<TOKEN_USER*>(tokenUser.data())->User.Sid};
+  require(SetTokenInformation(token.get(), TokenOwner, &owner, sizeof(owner)),
+          "Set suspended process file owner failed", command);
+  DWORD_PTR affinity = 0, systemAffinity = 0;
+  require(GetProcessAffinityMask(GetCurrentProcess(), &affinity, &systemAffinity),
+          "Read caller process affinity failed", command);
+  if (affinity != 0)
+    require(SetProcessAffinityMask(result->process.get(), affinity), "Preserve caller process affinity failed", command);
+  const DWORD priority = GetPriorityClass(GetCurrentProcess());
+  require(priority != 0 && SetPriorityClass(result->process.get(), priority),
+          "Preserve caller process priority failed", command);
+  BOOL assigned = FALSE;
+  if (!IsProcessInJob(result->process.get(), result->job.get(), &assigned) || !assigned) {
+    TerminateJobObject(result->job.get(), 1);
+    throw Failure("Suspended process has no owned Job Object membership", command, ERROR_ACCESS_DENIED);
+  }
+  require(ResumeThread(thread.get()) != MAXDWORD, "Resume job-owned process failed", command);
+  return result;
+}
+
+static napi_value readOutput(napi_env env, Handle& read, bool& ended) {
+  std::array<unsigned char, 65536> bytes;
+  DWORD available = 0, count = 0;
+  if (!read.valid()) ended = true;
+  else if (!PeekNamedPipe(read.get(), nullptr, 0, nullptr, &available, nullptr)) {
+    require(GetLastError() == ERROR_BROKEN_PIPE, "Observe owned process output failed");
+    read.reset(); ended = true;
+  } else if (available > 0) {
+    require(ReadFile(read.get(), bytes.data(), std::min<DWORD>(available, bytes.size()), &count, nullptr),
+            "Read owned process output failed");
+  }
+  napi_value result;
+  check(napi_create_buffer_copy(env, count, bytes.data(), nullptr, &result));
+  return result;
+}
+
+static DWORD activeProcesses(Process& process) {
+  JOBOBJECT_BASIC_ACCOUNTING_INFORMATION state{};
+  require(QueryInformationJobObject(process.job.get(), JobObjectBasicAccountingInformation, &state, sizeof(state), nullptr),
+          "Observe owned Job Object settlement failed");
+  return state.ActiveProcesses;
+}
+
+static napi_value callerToken(napi_env env) {
+  HANDLE raw;
+  require(OpenProcessToken(GetCurrentProcess(), TOKEN_QUERY | TOKEN_DUPLICATE, &raw), "Read caller token failed");
+  Handle token(raw);
+  DWORD size;
+  TOKEN_ELEVATION elevation{};
+  require(GetTokenInformation(token.get(), TokenElevation, &elevation, sizeof(elevation), &size), "Read caller elevation failed");
+  std::vector<unsigned char> user(4096), owner(4096), integrity(4096);
+  require(GetTokenInformation(token.get(), TokenUser, user.data(), user.size(), &size) &&
+          GetTokenInformation(token.get(), TokenOwner, owner.data(), owner.size(), &size) &&
+          GetTokenInformation(token.get(), TokenIntegrityLevel, integrity.data(), integrity.size(), &size),
+          "Read caller token observations failed");
+  HANDLE rawImpersonation;
+  require(DuplicateToken(token.get(), SecurityIdentification, &rawImpersonation), "Observe caller group membership failed");
+  Handle impersonation(rawImpersonation);
+  std::array<unsigned char, SECURITY_MAX_SID_SIZE> administrators;
+  DWORD administratorSize = administrators.size();
+  require(CreateWellKnownSid(WinBuiltinAdministratorsSid, nullptr, administrators.data(), &administratorSize),
+          "Create administrator group identity failed");
+  BOOL administrator = FALSE, assigned = FALSE;
+  require(CheckTokenMembership(impersonation.get(), administrators.data(), &administrator), "Read caller administrator membership failed");
+  require(IsProcessInJob(GetCurrentProcess(), nullptr, &assigned), "Read caller job membership failed");
+  const auto sid = reinterpret_cast<TOKEN_MANDATORY_LABEL*>(integrity.data())->Label.Sid;
+  auto result = object(env);
+  set(env, result, "elevated", boolean(env, elevation.TokenIsElevated != 0));
+  set(env, result, "administrator", boolean(env, administrator != FALSE));
+  set(env, result, "integrityLevel", number(env, *GetSidSubAuthority(sid, *GetSidSubAuthorityCount(sid) - 1)));
+  set(env, result, "defaultOwnerIsUser", boolean(env, EqualSid(reinterpret_cast<TOKEN_USER*>(user.data())->User.Sid,
+                                                              reinterpret_cast<TOKEN_OWNER*>(owner.data())->Owner)));
+  set(env, result, "inJob", boolean(env, assigned != FALSE));
+  return result;
+}
+
+napi_value processCall(napi_env env, const std::wstring& operation, const std::vector<napi_value>& args) {
+  if (operation == L"process_caller_token") {
+    require(args.empty(), "Caller token observation takes no arguments", L"", ERROR_INVALID_PARAMETER);
+    return callerToken(env);
+  }
+  if (operation == L"process_spawn") {
+    require(args.size() == 4, "Wrong native process launch argument count", L"", ERROR_INVALID_PARAMETER);
+    std::vector<std::wstring> environment;
+    for (const auto& entry : array(env, args[3])) environment.push_back(wide(env, entry));
+    auto process = spawnProcess(wide(env, args[0]), wide(env, args[1]), wide(env, args[2]), environment);
+    auto result = object(env);
+    set(env, result, "pid", number(env, process->pid));
+    set(env, result, "jobAssigned", boolean(env, true));
+    set(env, result, "killOnOwnerClose", boolean(env, true));
+    set(env, result, "handle", wrap(env, std::move(process)));
+    return result;
+  }
+  require(args.size() == 1, "Wrong native process handle argument count", L"", ERROR_INVALID_PARAMETER);
+  auto& process = static_cast<Process&>(resource(env, args[0], Kind::Process));
+  if (operation == L"process_poll") {
+    auto result = object(env);
+    bool stdoutEnded = false, stderrEnded = false;
+    set(env, result, "stdout", readOutput(env, process.stdoutRead, stdoutEnded));
+    set(env, result, "stderr", readOutput(env, process.stderrRead, stderrEnded));
+    set(env, result, "stdoutEnded", boolean(env, stdoutEnded));
+    set(env, result, "stderrEnded", boolean(env, stderrEnded));
+    const auto exited = WaitForSingleObject(process.process.get(), 0);
+    require(exited == WAIT_OBJECT_0 || exited == WAIT_TIMEOUT, "Observe owned process exit failed");
+    DWORD code = 0;
+    if (exited == WAIT_OBJECT_0) require(GetExitCodeProcess(process.process.get(), &code), "Read owned process exit code failed");
+    set(env, result, "exitCode", exited == WAIT_OBJECT_0 ? number(env, code) : null(env));
+    set(env, result, "activeProcesses", number(env, activeProcesses(process)));
+    return result;
+  }
+  if (operation == L"process_alive") return number(env, activeProcesses(process));
+  if (operation == L"process_terminate") {
+    const auto active = activeProcesses(process);
+    if (active > 0) require(TerminateJobObject(process.job.get(), 1), "Terminate owned Job Object failed");
+    return boolean(env, active > 0);
+  }
+  if (operation == L"process_close") {
+    // Closing the job is the crash-safe authority; no PID enumeration is used.
+    process.job.reset(); process.process.reset(); process.stdoutRead.reset(); process.stderrRead.reset();
+    process.closed = true;
+    return null(env);
+  }
+  throw Failure("Unknown native process operation", L"", ERROR_INVALID_PARAMETER);
+}
+
+napi_value inspect(napi_env env) {
+  wchar_t temp[32768];
+  const auto length = GetTempPathW(32768, temp);
+  require(length > 0 && length < 32768, "Read temporary directory coordinate failed");
+  auto root = createRuntime(std::wstring(temp, length), L"rea-native-probe-");
+  auto filesystem = identity(env, root->directory.get(), root->path);
+  closeRuntime(*root);
+  auto job = createJob();
+  Attributes attributes(1);
+  HANDLE raw = job.get();
+  attributes.add(PROC_THREAD_ATTRIBUTE_JOB_LIST, &raw, sizeof(raw));
+  auto result = object(env);
+  set(env, result, "abiVersion", number(env, 1));
+  set(env, result, "nodeApiVersion", number(env, 8));
+  set(env, result, "architecture", string(env, std::string("x64")));
+  set(env, result, "filesystem", filesystem);
+  set(env, result, "privateDacl", boolean(env, true));
+  set(env, result, "atomicJobAssignment", boolean(env, true));
+  set(env, result, "killOnOwnerClose", boolean(env, true));
+  return result;
+}
+
+} // namespace rea

package.json

@@ -1,6 +1,7 @@
 {
   "name": "rea-agents",
-  "version": "2.6.0",
+  "mcpName": "io.github.morluto/rea",
+  "version": "4.0.1",
   "description": "Reverse engineer anything from your terminal or agent with one CLI and MCP server.",
   "license": "MIT",
   "repository": {
@@ -34,82 +35,107 @@
     "rea-agents": "scripts/rea.mjs"
   },
   "engines": {
-    "node": "^22.19.0 || >=24.11.0"
+    "node": "^22.19.0 || ^24.11.0 || >=26.0.0"
   },
   "packageManager": "npm@11.16.0",
   "files": [
     "dist",
     "install.sh",
     "bridge/hopper_bridge.py",
+    "bridge/native/ReaNativeUI.swift",
     "bridge/ghidra/ReaGhidraBridge.java",
+    "bridge/ghidra/ReaGhidraPrepareCom.java",
     "scripts/rea.mjs",
-    "scripts/package-runner-bootstrap.mjs",
+    "scripts/electron-active-hook.cjs",
+    "scripts/electron-active-hook-boundaries.cjs",
     "scripts/hopper-demo-x11.py",
     "scripts/prepack.mjs",
     "scripts/prepare.mjs",
     "skills",
     "README.md",
-    "LICENSE"
+    "LICENSE",
+    "native/windows/build/manifest.json",
+    "native/windows/build/rea-windows-x64.node",
+    "scripts/verify-windows-native-artifact.mjs"
   ],
   "scripts": {
     "deps:check": "node scripts/check-dependency-install.mjs",
     "metadata:generate": "node scripts/generate-package-metadata.mjs",
     "metadata:check": "node scripts/generate-package-metadata.mjs --check",
+    "mcp-registry:check": "node scripts/verify-mcp-registry-metadata.mjs",
     "mcp-catalog:generate": "npm run build:cached && node scripts/generate-mcp-tool-catalog.mjs",
     "mcp-catalog:check": "node scripts/generate-mcp-tool-catalog.mjs --check",
     "prebuild": "npm run deps:check && npm run metadata:check",
-    "build": "tsc -p tsconfig.build.json",
+    "build": "node scripts/run-exclusive.mjs build npm run build:unlocked",
+    "build:unlocked": "node scripts/clean-build-output.mjs && tsc -p tsconfig.build.json",
     "precheck": "npm run deps:check",
     "check": "turbo run typecheck lint format:check knip metadata:check",
     "precheck:fast": "npm run deps:check",
-    "check:fast": "turbo run typecheck lint",
+    "check:fast": "turbo run typecheck lint --output-logs=errors-only",
+    "precheck:changed": "npm run deps:check",
+    "check:changed": "npm run check:fast && npm run test:changed",
     "precheck:test": "npm run deps:check",
     "check:test": "turbo run typecheck lint format:check knip metadata:check test:run",
     "precheck:pr": "npm run deps:check",
-    "check:pr": "turbo run typecheck lint format:check knip metadata:check test:run docs:check:built",
+    "check:pr": "turbo run typecheck lint format:check knip metadata:check test:run && npm run docs:check && npm run jscpd && npm run scan:todos",
     "precheck:ci": "npm run deps:check",
     "check:ci": "turbo run typecheck lint format:check knip metadata:check jscpd scan:todos",
     "build:cached": "turbo run build",
-    "format": "prettier --write .",
-    "format:check": "prettier --check .",
+    "format": "oxfmt .",
+    "format:check": "oxfmt --check .",
     "lint": "oxlint",
     "lint:fix": "oxlint --fix",
     "knip": "knip",
-    "lint:dead": "knip",
     "jscpd": "jscpd src/ tests/",
     "scan:todos": "node scripts/scan-todos.mjs",
     "start": "node scripts/rea.mjs mcp",
-    "pretest": "npm run build:cached",
-    "test": "vitest run",
+    "test": "npm run test:with-build",
+    "test:with-build": "npm run build:cached && vitest run",
     "test:run": "vitest run",
-    "pretest:fast": "npm run build:cached",
-    "test:fast": "vitest run --project parallel --project subprocess",
-    "pretest:changed": "npm run build:cached",
-    "test:changed": "vitest run --project parallel --project subprocess --changed",
+    "test:local": "node scripts/run-development-tests.mjs local",
+    "test:fast": "vitest run --project domain --project services --project adapters --project composition --project conformance --project evaluation",
+    "pretest:boundary": "npm run build:cached",
+    "test:boundary": "vitest run --project boundary --project process-boundary --project mcp-boundary --project process-global",
+    "pretest:mcp": "npm run build:cached",
+    "test:mcp": "vitest run --project mcp-boundary",
+    "pretest:acceptance": "npm run build:cached",
+    "test:acceptance": "vitest run --project acceptance",
+    "test:changed": "node scripts/run-development-tests.mjs changed",
     "pretest:integration": "npm run build:cached",
-    "test:integration": "vitest run --project serial-integration",
+    "test:integration": "vitest run --project boundary --project process-boundary --project mcp-boundary --project process-global --project acceptance",
     "pretest:coverage": "npm run build:cached",
     "test:coverage": "vitest run --coverage.enabled --coverage.provider=v8",
     "test:ci": "npm run test:coverage -- --reporter=default --reporter=junit --outputFile.junit=test-results.xml",
     "pretest:ci:shard": "npm run build:cached",
     "test:ci:shard": "npm run test:ci:shard:run",
     "test:ci:shard:run": "vitest run --coverage.enabled --coverage.provider=v8 --coverage.thresholds.lines=0 --coverage.thresholds.functions=0 --coverage.thresholds.branches=0 --coverage.thresholds.statements=0 --reporter=default --reporter=blob",
-    "test:ci:merge": "vitest --merge-reports --coverage.enabled --coverage.provider=v8 --reporter=default --reporter=junit --outputFile.junit=test-results.xml",
+    "test:ci:merge": "vitest --merge-reports --coverage.enabled --coverage.provider=v8",
     "pretest:verbose": "npm run build:cached",
     "test:verbose": "vitest run --reporter=verbose",
-    "pretest:watch": "npm run build:cached",
-    "test:watch": "vitest --project parallel --project subprocess --changed",
+    "test:watch": "vitest --project domain --project services --project adapters --project composition --project conformance --project evaluation --changed",
+    "pretest:watch:all": "npm run build:cached",
+    "test:watch:all": "vitest --changed",
     "typecheck": "tsc --noEmit",
     "verify:test-temp-hygiene": "npm run build:cached && node scripts/verify-test-temp-hygiene.mjs",
     "verify:hopper": "npm run verify:fixtures && npm run build:cached && node scripts/verify-real-hopper.mjs",
+    "verify:apple-dispatch": "npm run build:cached && node scripts/verify-apple-dispatch.mjs",
+    "verify:native-ui": "npm run build:cached && node scripts/verify-native-ui.mjs",
+    "verify:keyed-archive": "npm run build:cached && node scripts/verify-keyed-archive.mjs",
     "verify:ghidra": "npm run build:cached && node scripts/verify-real-ghidra.mjs",
+    "verify:ghidra:switch": "npm run build:cached && node scripts/verify-real-ghidra-switch.mjs",
+    "verify:ghidra:dos": "npm run build:cached && node scripts/verify-real-ghidra-dos.mjs",
+    "verify:ghidra:com": "npm run build:cached && node scripts/verify-real-ghidra-com.mjs",
+    "verify:ghidra:aarch64-jump-table": "npm run build:cached && node scripts/verify-real-ghidra.mjs --aarch64-jump-table",
+    "verify:interface-builder": "npm run build:cached && node scripts/verify-interface-builder.mjs",
+    "verify:ghidra:cross-format": "npm run build:cached && node scripts/verify-real-ghidra.mjs --cross-format",
     "verify:ghidra:windows": "npm run build:cached && npm run build:ghidra-windows-fixture && node scripts/verify-real-ghidra-windows.mjs",
     "verify:browser": "npm run build:cached && node scripts/verify-real-browser.mjs",
+    "verify:electron": "npm run build:cached && node scripts/verify-real-electron.mjs",
     "verify:inspector": "npm run build:cached && node scripts/verify-real-javascript-runtime-observation.mjs",
     "verify:javascript-runtime": "npm run build:cached && node scripts/verify-local-javascript-runtime.mjs",
+    "verify:javascript:digests": "npm run build:cached && node scripts/verify-large-javascript-digests.mjs",
     "verify:application-workflows": "npm run build:cached && node scripts/verify-local-application-workflows.mjs",
     "verify:managed": "npm run build:cached && node scripts/verify-managed-conformance.mjs",
-    "verify:replay": "npm run build:cached && node scripts/verify-real-javascript-replay.mjs",
     "verify:agent": "npm run build:cached && node scripts/verify-agent-experience.mjs",
     "verify:hopper:linux": "npm run verify:fixtures && npm run build:cached && node scripts/verify-real-hopper-linux.mjs",
     "verify:setup:linux": "npm run build:cached && node scripts/verify-linux-setup-e2e.mjs",
@@ -124,21 +150,28 @@
     "config:print": "node scripts/print-mcp-config.mjs",
     "evidence:generate": "npm run build:cached && node scripts/generate-completion-ledger.mjs",
     "evidence:check": "npm run build:cached && node scripts/generate-completion-ledger.mjs --check",
-    "docs:api": "typedoc",
-    "docs:api:cached": "turbo run docs:api",
-    "docs:generate": "npm run metadata:generate && npm run build:cached && node scripts/generate-mcp-tool-catalog.mjs && node scripts/generate-skill-metadata.mjs && node scripts/generate-product-catalog.mjs && node scripts/generate-completion-ledger.mjs && npm run docs:api:cached && node scripts/generate-error-schema.mjs",
-    "docs:check": "turbo run docs:check:built",
+    "docs:generate": "node scripts/run-exclusive.mjs docs npm run docs:generate:unlocked",
+    "docs:generate:unlocked": "npm run metadata:generate && npm run build:cached && node scripts/generate-mcp-tool-catalog.mjs && node scripts/generate-skill-metadata.mjs && node scripts/generate-product-catalog.mjs && node scripts/generate-completion-ledger.mjs && node scripts/generate-error-schema.mjs",
+    "docs:check": "node scripts/run-exclusive.mjs docs turbo run docs:check:built",
     "docs:check:built": "node scripts/generate-package-metadata.mjs --check && node scripts/generate-mcp-tool-catalog.mjs --check && node scripts/generate-skill-metadata.mjs --check && node scripts/generate-product-catalog.mjs --check && node scripts/generate-completion-ledger.mjs --check && node scripts/check-doc-facts.mjs && node scripts/generate-error-schema.mjs --check",
     "docs:error-schema": "npm run build:cached && node scripts/generate-error-schema.mjs",
     "prepack": "node scripts/prepack.mjs",
-    "prepare": "node scripts/prepare.mjs"
+    "prepare": "node scripts/prepare.mjs",
+    "verify:asset-catalog": "npm run build:cached && node scripts/verify-asset-catalog.mjs",
+    "verify:native-ui:permissions": "npm run build:cached && node scripts/verify-native-ui.mjs --allow-permission-denial",
+    "test:focused": "node scripts/run-development-tests.mjs focused",
+    "build:windows-native": "node scripts/build-windows-native.mjs",
+    "verify:windows-native:artifact": "node scripts/verify-windows-native-artifact.mjs",
+    "prepublishOnly": "npm run verify:windows-native:artifact",
+    "verify:windows-native": "node scripts/verify-windows-native.mjs",
+    "verify:ghidra:windows:package": "node scripts/verify-packaged-ghidra-windows.mjs"
   },
   "lint-staged": {
     "*.{cjs,cts,js,jsx,mjs,mts,ts,tsx}": [
-      "prettier --write",
+      "oxfmt",
       "oxlint --fix"
     ],
-    "*.{json,md,yml,yaml}": "prettier --write"
+    "*.{json,md,yml,yaml}": "oxfmt"
   },
   "dependencies": {
     "@babel/parser": "8.0.4",
@@ -147,43 +180,45 @@
     "@electron/asar": "4.2.0",
     "@jridgewell/trace-mapping": "0.3.31",
     "@lydell/node-pty": "1.1.0",
-    "@modelcontextprotocol/client": "2.0.0-beta.4",
-    "@modelcontextprotocol/server": "2.0.0-beta.4",
+    "@modelcontextprotocol/client": "2.3.1",
+    "@modelcontextprotocol/server": "2.3.1",
     "@xterm/addon-serialize": "0.14.0",
     "@xterm/headless": "6.0.0",
     "@zip.js/zip.js": "2.8.26",
     "canonicalize": "3.0.0",
+    "cross-spawn": "7.0.6",
     "diff": "9.0.0",
-    "graphology": "0.26.0",
-    "graphology-shortest-path": "2.1.0",
     "ignore": "7.0.6",
-    "incur": "0.4.13",
+    "incur": "0.6.1",
     "isomorphic-git": "1.38.7",
-    "pino": "9.14.0",
+    "jsonc-parser": "3.3.1",
+    "pino": "10.4.0",
     "playwright-core": "1.58.2",
     "plist": "5.0.0",
     "semver": "7.8.5",
-    "smol-toml": "^1.7.0",
+    "smol-toml": "1.7.0",
     "write-file-atomic": "7.0.0",
     "ws": "8.21.0",
     "zod": "4.4.3"
   },
   "devDependencies": {
-    "@fast-check/vitest": "0.4.1",
-    "@types/node": "24.10.1",
+    "@fast-check/vitest": "0.5.0",
+    "@types/cross-spawn": "6.0.6",
+    "@types/node": "26.6.4",
     "@types/semver": "7.7.1",
     "@types/write-file-atomic": "4.0.3",
     "@types/ws": "8.18.1",
-    "@vitest/coverage-v8": "4.1.10",
+    "@vitest/coverage-v8": "5.0.3",
+    "ajv": "8.20.0",
     "husky": "9.1.7",
     "jscpd": "5.0.12",
-    "knip": "6.26.0",
+    "knip": "6.39.0",
     "lint-staged": "16.4.0",
-    "oxlint": "1.73.0",
-    "prettier": "3.6.2",
-    "turbo": "2.10.5",
-    "typedoc": "0.28.20",
-    "typescript": "5.9.3",
-    "vitest": "4.1.10"
+    "oxfmt": "0.72.0",
+    "oxlint": "1.87.0",
+    "turbo": "2.11.7",
+    "typescript": "7.0.2",
+    "vitest": "5.0.3",
+    "yaml": "2.9.0"
   }
 }

release-please-config.json

@@ -21,10 +21,21 @@
         { "type": "generic", "path": "README_ja.md" },
         { "type": "generic", "path": "README_ko.md" },
         { "type": "generic", "path": "README_ar.md" },
+        { "type": "generic", "path": "docs/installation.md" },
         {
           "type": "generic",
           "path": "src/generatedPackageMetadata.ts"
         },
+        {
+          "type": "json",
+          "path": "server.json",
+          "jsonpath": "$.version"
+        },
+        {
+          "type": "json",
+          "path": "server.json",
+          "jsonpath": "$.packages[0].version"
+        },
         {
           "type": "json",
           "path": "docs/product-catalog.json",

scripts/build-conformance-fixtures.mjs

@@ -37,7 +37,6 @@ await buildPortableFixtures();
 if (hostPlatform === "darwin") await buildDarwinFixtures();
 
 const manifest = {
-  schemaVersion: 1,
   platform: hostPlatform,
   architecture,
   generatedAt: new Date(0).toISOString(),
@@ -103,9 +102,9 @@ async function buildPortableFixtures() {
       join(outputRoot, "large"),
     ],
     expectations: {
-      symbolPrefix: `${symbolPrefix}rea_page_`,
+      symbolPrefix: `${symbolPrefix}rea_inventory_`,
       symbolCount: LARGE_FIXTURE_COUNT,
-      stringPrefix: "REA_PAGE_",
+      stringPrefix: "REA_INVENTORY_",
       stringCount: LARGE_FIXTURE_COUNT,
     },
   });

scripts/build-windows-native.mjs

@@ -0,0 +1,150 @@
+#!/usr/bin/env node
+
+import { createHash } from "node:crypto";
+import { spawnSync } from "node:child_process";
+import { access, mkdir, readFile, writeFile } from "node:fs/promises";
+import { homedir } from "node:os";
+import { dirname, join } from "node:path";
+import { fileURLToPath } from "node:url";
+
+const root = join(dirname(fileURLToPath(import.meta.url)), "..");
+const nodeVersion = "22.19.0";
+const compiler = "x86_64-w64-mingw32-g++";
+const cache = join(homedir(), ".cache", "rea-windows-native");
+const output = join(root, "native", "windows", "build");
+const run = (command, args) => {
+  const result = spawnSync(command, args, {
+    cwd: root,
+    encoding: "utf8",
+    maxBuffer: 4 * 1_024 * 1_024,
+    timeout: 120_000,
+  });
+  if (result.error !== undefined)
+    throw new Error(
+      `Windows native build lane requires ${command}: ${result.error.message}`,
+    );
+  if (result.status !== 0)
+    throw new Error(
+      `Windows native build failed: ${result.stdout}${result.stderr}`,
+    );
+  return result.stdout;
+};
+if (process.platform !== "linux")
+  throw new Error(
+    "The Windows x64 artifact build lane currently requires Linux and MinGW-w64.",
+  );
+run(compiler, ["--version"]);
+await mkdir(cache, { recursive: true });
+await mkdir(output, { recursive: true });
+const exists = async (path) =>
+  access(path).then(
+    () => true,
+    () => false,
+  );
+const fetchBytes = async (name) => {
+  const response = await fetch(
+    `https://nodejs.org/dist/v${nodeVersion}/${name}`,
+    {
+      signal: AbortSignal.timeout(60_000),
+    },
+  );
+  if (!response.ok)
+    throw new Error(
+      `Node build prerequisite download failed: ${name}: HTTP ${response.status}`,
+    );
+  return Buffer.from(await response.arrayBuffer());
+};
+const checksums = (await fetchBytes("SHASUMS256.txt")).toString("utf8");
+const verifiedDownload = async (name, path) => {
+  if (!(await exists(path))) await writeFile(path, await fetchBytes(name));
+  const digest = createHash("sha256")
+    .update(await readFile(path))
+    .digest("hex");
+  const expected = checksums
+    .split("\n")
+    .find((line) => line.slice(66) === name)
+    ?.slice(0, 64);
+  if (expected === undefined || digest !== expected)
+    throw new Error(`Node build prerequisite SHA-256 mismatch: ${name}`);
+};
+const cachedHeaders = join(
+  homedir(),
+  ".cache",
+  "node-gyp",
+  nodeVersion,
+  "include",
+  "node",
+);
+let headers = cachedHeaders;
+if (!(await exists(join(headers, "node_api.h")))) {
+  const archive = join(cache, `node-v${nodeVersion}-headers.tar.gz`);
+  await verifiedDownload(`node-v${nodeVersion}-headers.tar.gz`, archive);
+  run("tar", ["xzf", archive, "-C", cache]);
+  headers = join(cache, `node-v${nodeVersion}`, "include", "node");
+}
+const artifact = "rea-windows-x64.node";
+// MSVC short-import libraries do not produce a correct Node import table with
+// GNU ld. Generate a GNU import library for the exact stable Node-API symbols.
+const sources = ["addon.cc", "filesystem.cc", "process.cc"];
+const sourceText = (
+  await Promise.all(
+    sources.map((path) =>
+      readFile(join(root, "native", "windows", "src", path), "utf8"),
+    ),
+  )
+).join("\n");
+const symbols = [
+  ...new Set(
+    [...sourceText.matchAll(/\b(napi_[a-z0-9_]+)\s*\(/gu)].map(
+      (match) => match[1],
+    ),
+  ),
+].sort();
+const definition = join(cache, "node-api.def");
+const library = join(cache, "libnode-api.a");
+await writeFile(
+  definition,
+  `LIBRARY node.exe\nEXPORTS\n${symbols.join("\n")}\n`,
+);
+run("x86_64-w64-mingw32-dlltool", ["-d", definition, "-l", library]);
+run(compiler, [
+  "-std=c++17",
+  "-O2",
+  "-DNAPI_VERSION=8",
+  "-D_WIN32_WINNT=0x0A00",
+  "-shared",
+  "-static",
+  "-static-libgcc",
+  "-static-libstdc++",
+  "-Wl,--no-insert-timestamp",
+  `-I${headers}`,
+  "native/windows/src/addon.cc",
+  "native/windows/src/filesystem.cc",
+  "native/windows/src/process.cc",
+  library,
+  "-ladvapi32",
+  "-lbcrypt",
+  "-lntdll",
+  "-o",
+  join(output, artifact),
+]);
+const packageJson = JSON.parse(
+  await readFile(join(root, "package.json"), "utf8"),
+);
+const bytes = await readFile(join(output, artifact));
+const metadata = {
+  packageVersion: packageJson.version,
+  platform: "win32",
+  architecture: "x64",
+  abiVersion: 1,
+  nodeApiVersion: 8,
+  artifact,
+  artifactSha256: createHash("sha256").update(bytes).digest("hex"),
+};
+await writeFile(
+  join(output, "manifest.json"),
+  `${JSON.stringify(metadata, null, 2)}\n`,
+);
+process.stdout.write(
+  `${JSON.stringify({ ...metadata, artifactBytes: bytes.length })}\n`,
+);

scripts/clean-build-output.mjs

@@ -0,0 +1,10 @@
+import { rm } from "node:fs/promises";
+import { dirname, join } from "node:path";
+import { fileURLToPath } from "node:url";
+
+const root = join(dirname(fileURLToPath(import.meta.url)), "..");
+
+await Promise.all([
+  rm(join(root, "dist"), { recursive: true, force: true }),
+  rm(join(root, ".cache", "tsconfig.build.tsbuildinfo"), { force: true }),
+]);

scripts/electron-active-hook-boundaries.cjs

@@ -0,0 +1,394 @@
+"use strict";
+
+// oxlint-disable-next-line max-lines-per-function -- all adapters must close over one bounded capture context.
+const createElectronActiveBoundaryPatches = ({
+  identity,
+  patchEmitter,
+  processType,
+  recordIpc,
+  recordRuntime,
+  shape,
+}) => {
+  const patchedSessions = new WeakSet();
+  const patchIpcRenderer = (ipcRenderer) => {
+    if (ipcRenderer === null || ipcRenderer === undefined) return;
+    for (const [method, kind] of [
+      ["send", "ipc-renderer-send"],
+      ["sendSync", "ipc-renderer-send"],
+      ["invoke", "ipc-renderer-invoke"],
+      ["postMessage", "ipc-renderer-post-message"],
+    ]) {
+      const original = ipcRenderer[method];
+      if (typeof original !== "function") continue;
+      ipcRenderer[method] = function patchedRendererIpc(channel, ...args) {
+        const recorded = recordIpc(kind, channel, args, {
+          direction: "renderer-to-main",
+          sender: processType(),
+          receiver: "main",
+          frame: null,
+          process_type: processType(),
+          error: false,
+        });
+        try {
+          const result = original.call(this, channel, ...args);
+          if (result !== null && typeof result?.then === "function")
+            return result.then(
+              (value) => {
+                if (recorded !== null) recorded.result_shape = shape(value);
+                return value;
+              },
+              (cause) => {
+                if (recorded !== null) recorded.error = true;
+                throw cause;
+              },
+            );
+          if (recorded !== null) recorded.result_shape = shape(result);
+          return result;
+        } catch (cause) {
+          if (recorded !== null) recorded.error = true;
+          throw cause;
+        }
+      };
+    }
+  };
+
+  const patchContextBridge = (contextBridge) => {
+    if (contextBridge === null || contextBridge === undefined) return;
+    for (const method of ["exposeInMainWorld", "exposeInIsolatedWorld"]) {
+      const original = contextBridge[method];
+      if (typeof original !== "function") continue;
+      contextBridge[method] = function patchedContextBridge(...args) {
+        const target = typeof args[0] === "string" ? args[0] : null;
+        recordRuntime("preload", "context-bridge-exposure", "attempted", {
+          target,
+          argument_shapes: args.map((value) => shape(value)),
+          process_type: processType(),
+        });
+        try {
+          const result = original.apply(this, args);
+          recordRuntime("preload", "context-bridge-exposure", "completed", {
+            target,
+            process_type: processType(),
+          });
+          return result;
+        } catch (cause) {
+          recordRuntime("preload", "context-bridge-exposure", "failed", {
+            target,
+            error: true,
+            process_type: processType(),
+          });
+          throw cause;
+        }
+      };
+    }
+  };
+
+  const patchSession = (session) => {
+    if (session === null || session === undefined) return;
+    if (
+      (typeof session !== "object" && typeof session !== "function") ||
+      patchedSessions.has(session)
+    )
+      return;
+    patchedSessions.add(session);
+    patchEmitter(session, (event, args) => {
+      const kind =
+        event === "will-download"
+          ? "download"
+          : event.includes("certificate") || event.includes("permission")
+            ? "permission"
+            : event.includes("window") || event.includes("popup")
+              ? "popup-attempt"
+              : "web-contents-lifecycle";
+      if (event === "will-download") {
+        const cancel = args[1]?.cancel;
+        if (typeof cancel === "function") cancel.call(args[1]);
+      }
+      recordRuntime(
+        kind,
+        event,
+        event === "will-download" ? "blocked" : "observed",
+        {
+          target: identity(args[0], "webContents"),
+          argument_shapes: args.map((value) => shape(value)),
+          error: event === "will-download",
+        },
+      );
+    });
+    const originalPermissionRequest = session.setPermissionRequestHandler;
+    if (typeof originalPermissionRequest === "function")
+      session.setPermissionRequestHandler =
+        function blockedPermissionRequest() {
+          return originalPermissionRequest.call(
+            this,
+            (webContents, permission, callback) => {
+              recordRuntime("permission", "permission-request", "blocked", {
+                target: identity(webContents, "webContents"),
+                argument_shapes: [shape(permission)],
+                error: true,
+              });
+              if (typeof callback === "function") callback(false);
+            },
+          );
+        };
+    const originalPermissionCheck = session.setPermissionCheckHandler;
+    if (typeof originalPermissionCheck === "function")
+      session.setPermissionCheckHandler = function blockedPermissionCheck() {
+        return originalPermissionCheck.call(this, (webContents, permission) => {
+          recordRuntime("permission", "permission-check", "blocked", {
+            target: identity(webContents, "webContents"),
+            argument_shapes: [shape(permission)],
+            error: true,
+          });
+          return false;
+        });
+      };
+    const originalCertificate = session.setCertificateVerifyProc;
+    if (typeof originalCertificate === "function")
+      session.setCertificateVerifyProc = function blockedCertificate() {
+        return originalCertificate.call(this, (request, callback) => {
+          recordRuntime("permission", "certificate-error", "blocked", {
+            argument_shapes: [shape(request)],
+            error: true,
+          });
+          if (typeof callback === "function") callback(-2);
+        });
+      };
+  };
+
+  const patchWindowOpenHandler = (webContents, contentsId) => {
+    if (webContents === null || webContents === undefined) return;
+    const original = webContents.setWindowOpenHandler;
+    if (typeof original !== "function") return;
+    const createGuardedHandler =
+      (handler) =>
+      (...args) => {
+        try {
+          if (typeof handler === "function") handler(...args);
+        } catch {
+          recordRuntime("popup-attempt", "window-open-handler", "failed", {
+            target: contentsId,
+            argument_shapes: args.map((value) => shape(value)),
+            error: true,
+          });
+          return { action: "deny" };
+        }
+        recordRuntime("popup-attempt", "window-open-handler", "blocked", {
+          target: contentsId,
+          argument_shapes: args.map((value) => shape(value)),
+          error: true,
+        });
+        return { action: "deny" };
+      };
+    try {
+      original.call(webContents, createGuardedHandler(undefined));
+    } catch {
+      recordRuntime("popup-attempt", "window-open-handler-install", "failed", {
+        target: contentsId,
+        error: true,
+      });
+    }
+    webContents.setWindowOpenHandler = function blockedWindowOpenHandler(
+      handler,
+    ) {
+      return original.call(this, createGuardedHandler(handler));
+    };
+  };
+
+  const patchSessionManager = (sessionModule) => {
+    if (sessionModule === null || sessionModule === undefined) return;
+    patchSession(sessionModule.defaultSession);
+    for (const method of ["fromPartition", "fromPath"]) {
+      const original = sessionModule[method];
+      if (typeof original !== "function") continue;
+      sessionModule[method] = function patchedSessionFactory(...args) {
+        const session = original.apply(this, args);
+        patchSession(session);
+        return session;
+      };
+    }
+  };
+
+  const patchApplicationEffects = (app) => {
+    if (app === null || app === undefined) return;
+    for (const method of [
+      "relaunch",
+      "setAsDefaultProtocolClient",
+      "setLoginItemSettings",
+    ]) {
+      const original = app[method];
+      if (typeof original !== "function") continue;
+      app[method] = function blockedApplicationEffect(...args) {
+        recordRuntime(
+          method === "relaunch" ? "updater" : "protocol",
+          method,
+          "blocked",
+          { argument_shapes: args.map((value) => shape(value)), error: true },
+        );
+        return method === "setAsDefaultProtocolClient" ? false : undefined;
+      };
+    }
+  };
+
+  const patchNativeAddonLoading = () => {
+    const original = process.dlopen;
+    if (typeof original !== "function") return;
+    process.dlopen = function patchedDlopen(module, filename, ...args) {
+      let digest = null;
+      try {
+        const fs = require("node:fs");
+        const crypto = require("node:crypto");
+        const stat = fs.statSync(filename);
+        if (stat.isFile() && stat.size <= 16 * 1024 * 1024)
+          digest = crypto
+            .createHash("sha256")
+            .update(fs.readFileSync(filename))
+            .digest("hex");
+      } catch {
+        digest = null;
+      }
+      recordRuntime("native-addon", "dlopen", "attempted", {
+        artifact_path: typeof filename === "string" ? filename : null,
+        artifact_sha256: digest,
+        argument_shapes: [
+          shape(module),
+          shape(filename),
+          ...args.map((value) => shape(value)),
+        ],
+      });
+      try {
+        const result = original.call(this, module, filename, ...args);
+        recordRuntime("native-addon", "dlopen", "completed", {
+          artifact_path: typeof filename === "string" ? filename : null,
+          artifact_sha256: digest,
+        });
+        return result;
+      } catch (cause) {
+        recordRuntime("native-addon", "dlopen", "failed", {
+          artifact_path: typeof filename === "string" ? filename : null,
+          artifact_sha256: digest,
+          error: true,
+        });
+        throw cause;
+      }
+    };
+  };
+
+  const patchUtilityProcess = (utilityProcess) => {
+    if (utilityProcess === null || utilityProcess === undefined) return;
+    const original = utilityProcess.fork;
+    if (typeof original !== "function") return;
+    utilityProcess.fork = function patchedFork(...args) {
+      recordRuntime("process-lifecycle", "utility-process-fork", "attempted", {
+        argument_shapes: args.map((value) => shape(value)),
+        process_type: "main",
+      });
+      const child = original.apply(this, args);
+      const childId = identity(child, "utility");
+      recordRuntime("process-lifecycle", "utility-process-fork", "completed", {
+        target: childId,
+        process_type: "main",
+      });
+      patchEmitter(child, (event, eventArgs) => {
+        if (event === "message") {
+          recordIpc("ipc-utility-to-main", null, eventArgs, {
+            direction: "utility-to-main",
+            sender: childId,
+            receiver: "main",
+            target: childId,
+            process_type: "main",
+            error: false,
+          });
+          return;
+        }
+        recordRuntime("process-lifecycle", `utility.${event}`, "observed", {
+          target: childId,
+          process_type: "utility",
+          argument_shapes: eventArgs.map((value) => shape(value)),
+        });
+      });
+      if (child && typeof child.postMessage === "function") {
+        const postMessage = child.postMessage.bind(child);
+        child.postMessage = (...messageArgs) => {
+          const recorded = recordIpc(
+            "utility-process-message",
+            null,
+            messageArgs,
+            {
+              direction: "main-to-utility",
+              sender: "main",
+              receiver: childId,
+              target: childId,
+              process_type: "main",
+              error: false,
+            },
+          );
+          try {
+            const result = postMessage(...messageArgs);
+            if (recorded !== null) recorded.result_shape = shape(result);
+            return result;
+          } catch (cause) {
+            if (recorded !== null) recorded.error = true;
+            throw cause;
+          }
+        };
+      }
+      return child;
+    };
+  };
+
+  const patchShell = (shell) => {
+    if (shell === null || shell === undefined) return;
+    for (const method of ["openExternal", "openPath"]) {
+      const original = shell[method];
+      if (typeof original !== "function") continue;
+      shell[method] = function blockedShellCall(...args) {
+        recordRuntime("shell-attempt", method, "blocked", {
+          argument_shapes: args.map((value) => shape(value)),
+          error: true,
+        });
+        return Promise.reject(new Error("External shell effects are blocked"));
+      };
+    }
+  };
+
+  const patchChildProcess = () => {
+    const childProcess = require("node:child_process");
+    for (const method of ["spawn", "fork", "exec", "execFile"]) {
+      const original = childProcess[method];
+      if (typeof original !== "function") continue;
+      childProcess[method] = function patchedChildProcess(...args) {
+        recordRuntime("process-lifecycle", `child.${method}`, "attempted", {
+          argument_shapes: args.map((value) => shape(value)),
+        });
+        const child = original.apply(this, args);
+        const childId = identity(child, "child");
+        recordRuntime("process-lifecycle", `child.${method}`, "completed", {
+          target: childId,
+        });
+        patchEmitter(child, (event, eventArgs) =>
+          recordRuntime("process-lifecycle", `child.${event}`, "observed", {
+            target: childId,
+            argument_shapes: eventArgs.map((value) => shape(value)),
+          }),
+        );
+        return child;
+      };
+    }
+  };
+
+  return {
+    patchApplicationEffects,
+    patchChildProcess,
+    patchContextBridge,
+    patchIpcRenderer,
+    patchNativeAddonLoading,
+    patchSession,
+    patchSessionManager,
+    patchShell,
+    patchWindowOpenHandler,
+    patchUtilityProcess,
+  };
+};
+
+module.exports = { createElectronActiveBoundaryPatches };

scripts/electron-active-hook.cjs

@@ -0,0 +1,469 @@
+"use strict";
+
+const {
+  createElectronActiveBoundaryPatches,
+} = require("./electron-active-hook-boundaries.cjs");
+
+const ipcEventKinds = new Set([
+  "main-handler-invocation",
+  "main-event-invocation",
+  "utility-process-fork",
+  "utility-process-message",
+  "ipc-main-to-renderer",
+  "ipc-utility-to-main",
+  "ipc-renderer-send",
+  "ipc-renderer-invoke",
+  "ipc-renderer-post-message",
+]);
+const events = [];
+let observed = 0;
+let observedIpc = 0;
+let observedRuntime = 0;
+let sequence = 0;
+let correlationSequence = 0;
+
+const shape = (value, depth = 0) => {
+  if (depth > 2 || value === null) return value === null ? "null" : "nested";
+  if (Array.isArray(value)) return "array";
+  switch (typeof value) {
+    case "string":
+      return "string";
+    case "number":
+      return "number";
+    case "boolean":
+      return "boolean";
+    case "undefined":
+      return "undefined";
+    case "function":
+      return "function";
+    case "object":
+      return "object";
+    default:
+      return "unknown";
+  }
+};
+
+const isAllowedNavigation = (value) => {
+  if (typeof value !== "string") return true;
+  try {
+    const parsed = new URL(value);
+    if (["file:", "data:", "about:"].includes(parsed.protocol)) return true;
+    return (
+      ["http:", "https:"].includes(parsed.protocol) &&
+      ["127.0.0.1", "localhost", "[::1]", "::1"].includes(parsed.hostname)
+    );
+  } catch {
+    return false;
+  }
+};
+
+const processType = () =>
+  typeof process.type === "string" && process.type.length > 0
+    ? process.type
+    : "main";
+
+const identity = (value, prefix) => {
+  if (value === null || value === undefined) return null;
+  const id = value.id;
+  const processId = value.pid;
+  return typeof id === "string" || typeof id === "number"
+    ? `${prefix}:${String(id)}`
+    : typeof processId === "number"
+      ? `${prefix}:pid:${String(processId)}`
+      : null;
+};
+
+const frameIdentity = (event) => {
+  const frame = event?.senderFrame ?? event?.frame;
+  const id = frame?.frameTreeNodeId ?? frame?.routingId ?? frame?.id;
+  return typeof id === "string" || typeof id === "number"
+    ? `frame:${String(id)}`
+    : null;
+};
+
+const record = (event) => {
+  observed += 1;
+  if (ipcEventKinds.has(event.kind)) observedIpc += 1;
+  else observedRuntime += 1;
+  const raw = {
+    sequence: ++sequence,
+    correlation_id:
+      typeof event.correlation_id === "string"
+        ? event.correlation_id
+        : `capture:${process.pid}:${++correlationSequence}`,
+    event: null,
+    phase: "observed",
+    channel: null,
+    direction: null,
+    sender: null,
+    receiver: null,
+    frame: null,
+    target: null,
+    argument_shapes: [],
+    result_shape: null,
+    process_type: processType(),
+    source: "electron-active-hook",
+    capture_method: "api-wrapper",
+    artifact_path: null,
+    artifact_sha256: null,
+    error: false,
+    ...event,
+  };
+  const argumentShapes = Array.isArray(raw.argument_shapes)
+    ? raw.argument_shapes
+    : [];
+  events.push({
+    ...raw,
+    correlation_id: raw.correlation_id,
+    event: typeof raw.event === "string" ? raw.event : null,
+    channel: typeof raw.channel === "string" ? raw.channel : null,
+    sender: typeof raw.sender === "string" ? raw.sender : null,
+    receiver: typeof raw.receiver === "string" ? raw.receiver : null,
+    frame: typeof raw.frame === "string" ? raw.frame : null,
+    target: typeof raw.target === "string" ? raw.target : null,
+    argument_shapes: argumentShapes.map((value) =>
+      typeof value === "string" ? value : "unknown",
+    ),
+    result_shape:
+      typeof raw.result_shape === "string" ? raw.result_shape : null,
+    process_type:
+      typeof raw.process_type === "string" ? raw.process_type : null,
+    artifact_path:
+      typeof raw.artifact_path === "string" ? raw.artifact_path : null,
+    artifact_sha256:
+      typeof raw.artifact_sha256 === "string" ? raw.artifact_sha256 : null,
+  });
+  return events.at(-1);
+};
+
+const recordRuntime = (kind, event, phase, details = {}) =>
+  record({ kind, event, phase, ...details });
+
+const recordIpc = (kind, channel, args, details = {}) =>
+  (() => {
+    const values = Array.isArray(args) ? args : [];
+    return record({
+      kind,
+      channel: typeof channel === "string" ? channel : null,
+      argument_shapes: values.map((value) => shape(value)),
+      ...details,
+    });
+  })();
+
+const patchEmitter = (emitter, observeEvent) => {
+  if (emitter === null || emitter === undefined) return;
+  const original = emitter.emit;
+  if (typeof original !== "function") return;
+  if (emitter.__reaElectronActiveEmitPatched === true) return;
+  try {
+    emitter.__reaElectronActiveEmitPatched = true;
+    emitter.emit = function patchedEmit(event, ...args) {
+      if (typeof event === "string") observeEvent.call(this, event, args);
+      return original.call(this, event, ...args);
+    };
+  } catch {
+    globalThis.__reaElectronActiveHookError = true;
+  }
+};
+
+const recordInvocation = (kind, channel, event, args) =>
+  recordIpc(kind, channel, args, {
+    direction: "renderer-to-main",
+    sender: identity(event?.sender, "webContents"),
+    receiver: "main",
+    frame: frameIdentity(event),
+    process_type: "main",
+    error: false,
+  });
+
+const patchIpcMain = (ipcMain) => {
+  if (ipcMain === null || ipcMain === undefined) return;
+  for (const [method, kind] of [
+    ["handle", "main-handler-invocation"],
+    ["on", "main-event-invocation"],
+    ["once", "main-event-invocation"],
+  ]) {
+    const original = ipcMain[method];
+    if (typeof original !== "function") continue;
+    ipcMain[method] = function patchedIpcMain(channel, listener) {
+      if (typeof listener !== "function")
+        return original.call(this, channel, listener);
+      const wrapped =
+        kind === "main-handler-invocation"
+          ? async function wrappedHandler(event, ...args) {
+              const recorded = recordInvocation(kind, channel, event, args);
+              try {
+                const result = await listener.call(this, event, ...args);
+                if (recorded !== null) recorded.result_shape = shape(result);
+                return result;
+              } catch (cause) {
+                if (recorded !== null) recorded.error = true;
+                throw cause;
+              }
+            }
+          : function wrappedEventListener(event, ...args) {
+              const recorded = recordInvocation(kind, channel, event, args);
+              try {
+                return listener.call(this, event, ...args);
+              } catch (cause) {
+                if (recorded !== null) recorded.error = true;
+                throw cause;
+              }
+            };
+      return original.call(this, channel, wrapped);
+    };
+  }
+};
+
+const patchNavigationMethods = (webContents, contentsId) => {
+  for (const method of ["loadURL", "loadFile", "loadDataURL"]) {
+    const original = webContents[method];
+    if (typeof original !== "function") continue;
+    webContents[method] = function patchedNavigation(...args) {
+      recordRuntime("navigation", method, "attempted", {
+        target: contentsId,
+        argument_shapes: args.map((value) => shape(value)),
+      });
+      if (method === "loadURL" && !isAllowedNavigation(args[0])) {
+        recordRuntime("navigation", method, "blocked", {
+          target: contentsId,
+          error: true,
+        });
+        return Promise.reject(new Error("External navigation is blocked"));
+      }
+      try {
+        const result = original.apply(this, args);
+        if (result !== null && typeof result?.then === "function")
+          return result.then(
+            (value) => {
+              recordRuntime("navigation", method, "completed", {
+                target: contentsId,
+              });
+              return value;
+            },
+            (cause) => {
+              recordRuntime("navigation", method, "failed", {
+                target: contentsId,
+                error: true,
+              });
+              throw cause;
+            },
+          );
+        recordRuntime("navigation", method, "completed", {
+          target: contentsId,
+        });
+        return result;
+      } catch (cause) {
+        recordRuntime("navigation", method, "failed", {
+          target: contentsId,
+          error: true,
+        });
+        throw cause;
+      }
+    };
+  }
+};
+
+const patchWebContentsIpc = (webContents, contentsId) => {
+  const originalSend = webContents.send;
+  if (typeof originalSend === "function")
+    webContents.send = function patchedSend(channel, ...args) {
+      const recorded = recordIpc("ipc-main-to-renderer", channel, args, {
+        direction: "main-to-renderer",
+        sender: "main",
+        receiver: contentsId,
+        target: contentsId,
+        process_type: "main",
+        error: false,
+      });
+      try {
+        const result = originalSend.call(this, channel, ...args);
+        if (recorded !== null) recorded.result_shape = shape(result);
+        return result;
+      } catch (cause) {
+        if (recorded !== null) recorded.error = true;
+        throw cause;
+      }
+    };
+  const originalPostMessage = webContents.postMessage;
+  if (typeof originalPostMessage === "function")
+    webContents.postMessage = function patchedPostMessage(
+      channel,
+      message,
+      transfer,
+    ) {
+      const recorded = recordIpc(
+        "ipc-main-to-renderer",
+        channel,
+        [message, transfer],
+        {
+          direction: "main-to-renderer",
+          sender: "main",
+          receiver: contentsId,
+          target: contentsId,
+          process_type: "main",
+          error: false,
+        },
+      );
+      try {
+        const result = originalPostMessage.call(
+          this,
+          channel,
+          message,
+          transfer,
+        );
+        if (recorded !== null) recorded.result_shape = shape(result);
+        return result;
+      } catch (cause) {
+        if (recorded !== null) recorded.error = true;
+        throw cause;
+      }
+    };
+};
+
+const patchWebContents = (webContents, windowId) => {
+  if (webContents === null || webContents === undefined) return;
+  const contentsId = identity(webContents, "webContents");
+  patchEmitter(webContents, (event, args) => {
+    const navigation = [
+      "did-start-loading",
+      "did-stop-loading",
+      "did-finish-load",
+      "did-fail-load",
+      "did-frame-finish-load",
+      "will-navigate",
+      "will-redirect",
+    ].includes(event);
+    const kind = navigation
+      ? "navigation"
+      : [
+            "console-message",
+            "render-process-gone",
+            "crashed",
+            "unresponsive",
+            "responsive",
+          ].includes(event)
+        ? "error"
+        : event === "did-create-window"
+          ? "popup-attempt"
+          : "web-contents-lifecycle";
+    if (event === "will-navigate" || event === "will-redirect") {
+      if (!isAllowedNavigation(args[1])) {
+        const preventDefault = args[0]?.preventDefault;
+        if (typeof preventDefault === "function") preventDefault.call(args[0]);
+        recordRuntime("navigation", event, "blocked", {
+          target: contentsId,
+          sender: windowId,
+          argument_shapes: args.map((value) => shape(value)),
+          error: true,
+        });
+        return;
+      }
+    }
+    recordRuntime(kind, event, "observed", {
+      target: contentsId,
+      sender: windowId,
+      argument_shapes: args.map((value) => shape(value)),
+      error: kind === "error",
+    });
+    if (event === "did-create-window") {
+      const childWindow = args[0];
+      patchWebContents(
+        childWindow?.webContents,
+        identity(childWindow, "window"),
+      );
+    }
+  });
+  patchNavigationMethods(webContents, contentsId);
+  patchWebContentsIpc(webContents, contentsId);
+  boundaries.patchWindowOpenHandler(webContents, contentsId);
+};
+
+const patchBrowserWindow = (electron) => {
+  const original = electron.BrowserWindow;
+  if (typeof original !== "function") return;
+  electron.BrowserWindow = new Proxy(original, {
+    construct(target, args, newTarget) {
+      const window = Reflect.construct(target, args, newTarget);
+      const targetId = identity(window, "window");
+      recordRuntime("window-lifecycle", "created", "completed", {
+        target: targetId,
+        argument_shapes: args.map((value) => shape(value)),
+      });
+      const preload = args[0]?.webPreferences?.preload;
+      if (typeof preload === "string")
+        recordRuntime("preload", "configured", "completed", {
+          target: targetId,
+          artifact_path: preload,
+        });
+      patchEmitter(window, (event) =>
+        recordRuntime("window-lifecycle", event, "observed", {
+          target: targetId,
+        }),
+      );
+      patchWebContents(window.webContents, targetId);
+      return window;
+    },
+  });
+};
+
+const boundaries = createElectronActiveBoundaryPatches({
+  identity,
+  patchEmitter,
+  processType,
+  recordIpc,
+  recordRuntime,
+  shape,
+});
+
+try {
+  const electron = require("electron");
+  patchEmitter(electron.app, (event, args) =>
+    recordRuntime(
+      event === "open-url" || event === "second-instance"
+        ? "protocol"
+        : "app-lifecycle",
+      event,
+      "observed",
+      {
+        target: "app",
+        argument_shapes: args.map((value) => shape(value)),
+        process_type: "main",
+      },
+    ),
+  );
+  patchIpcMain(electron.ipcMain);
+  boundaries.patchIpcRenderer(electron.ipcRenderer);
+  boundaries.patchContextBridge(electron.contextBridge);
+  patchBrowserWindow(electron);
+  boundaries.patchUtilityProcess(electron.utilityProcess);
+  boundaries.patchShell(electron.shell);
+  boundaries.patchSessionManager(electron.session);
+  boundaries.patchApplicationEffects(electron.app);
+  boundaries.patchNativeAddonLoading();
+  boundaries.patchChildProcess();
+  process.once("uncaughtException", (cause, origin) => {
+    recordRuntime("process-lifecycle", "uncaught-exception", "observed", {
+      argument_shapes: [shape(cause), shape(origin)],
+      error: true,
+    });
+    throw cause;
+  });
+  process.once("unhandledRejection", (reason, promise) => {
+    recordRuntime("process-lifecycle", "unhandled-rejection", "observed", {
+      argument_shapes: [shape(reason), shape(promise)],
+      error: true,
+    });
+    throw reason;
+  });
+} catch {
+  globalThis.__reaElectronActiveHookError = true;
+}
+
+globalThis.__reaElectronActiveSnapshot = () => ({
+  events: events.slice(),
+  observed,
+  observed_ipc: observedIpc,
+  observed_runtime: observedRuntime,
+  hook_error: globalThis.__reaElectronActiveHookError === true,
+});

scripts/fixtures/browser-verifier-site.mjs

@@ -7,6 +7,21 @@ export async function startBrowserVerifierSite() {
   let port = 0;
   let sessionGeneration = 0;
   const server = createServer((request, response) => {
+    if (request.url === "/screenshot-noise") {
+      response.setHeader("content-type", "text/html");
+      response.end(`<!doctype html><html><body style="margin:0"><canvas width="2048" height="1536"></canvas><script>
+        const context = document.querySelector('canvas').getContext('2d');
+        const image = context.createImageData(2048, 1536);
+        let state = 0x6d2b79f5;
+        for (let index = 0; index < image.data.length; index++) {
+          state ^= state << 13; state ^= state >>> 17; state ^= state << 5;
+          image.data[index] = index % 4 === 3 ? 255 : state & 255;
+        }
+        context.putImageData(image, 0, 0);
+        document.body.dataset.ready = 'true';
+      </script></body></html>`);
+      return;
+    }
     if (request.url === "/app.js.map") {
       response.setHeader("content-type", "application/source-map+json");
       response.end(sourceMap());
@@ -102,7 +117,9 @@ const browserScript = (port) => `
     const { generation } = await response.json();
     if (generation <= observedGeneration) return;
     observedGeneration = generation;
-    history.pushState({}, "", "/app/session-" + String(generation));
+    const sessionUrl = new URL(window.location.href);
+    sessionUrl.pathname = "/app/session-" + String(generation);
+    history.pushState({}, "", sessionUrl);
   }, 100);
   //# sourceMappingURL=/app.js.map
 `;

scripts/generate-completion-ledger.mjs

@@ -30,16 +30,27 @@ const { stdout } = await exec(
   },
 );
 const verifierOutput = JSON.parse(stdout);
+// Managed conformance claims are host-independent. Keep the checked-in
+// commitment reproducible across macOS, Linux, and Windows rather than
+// embedding the machine that happened to generate it.
+const portableCompletionReport = {
+  ...verifierOutput.completionReport,
+  environment: {
+    platform: "portable",
+    architecture: "portable",
+    runtime: "node",
+    runtime_version: "portable",
+  },
+};
 const { createCompletionLedgerArtifacts } = await import(
   `../dist/domain/completionLedgerGeneration.js?${String(Date.now())}`
 );
 const skillDigest = await directoryDigest(
   join(root, "skills/reverse-engineer-anything"),
 );
-const generated = createCompletionLedgerArtifacts(
-  verifierOutput.completionReport,
-  [{ skill_id: "reverse-engineer-anything", sha256: skillDigest }],
-);
+const generated = createCompletionLedgerArtifacts(portableCompletionReport, [
+  { skill_id: "reverse-engineer-anything", sha256: skillDigest },
+]);
 
 if (!check) await mkdir(outputRoot, { recursive: true });
 await Promise.all([

scripts/generate-error-schema.mjs

@@ -2,7 +2,7 @@ import { dirname, join } from "node:path";
 import { fileURLToPath } from "node:url";
 
 import { analysisErrorJsonSchema } from "../dist/contracts/errorSchemas.js";
-import { format } from "prettier";
+import { formatGeneratedFile } from "./lib/format-generated-file.mjs";
 import { ensureGeneratedFile } from "./lib/generated-file.mjs";
 
 const arguments_ = new Set(process.argv.slice(2));
@@ -13,9 +13,10 @@ for (const argument of arguments_)
 const root = join(dirname(fileURLToPath(import.meta.url)), "..");
 await ensureGeneratedFile({
   path: join(root, "docs/error-contract.schema.json"),
-  source: await format(JSON.stringify(analysisErrorJsonSchema), {
-    parser: "json",
-  }),
+  source: await formatGeneratedFile(
+    "docs/error-contract.schema.json",
+    JSON.stringify(analysisErrorJsonSchema),
+  ),
   check: arguments_.has("--check"),
   generateCommand: "npm run docs:generate",
 });

scripts/generate-mcp-tool-catalog.mjs

@@ -1,6 +1,9 @@
 import { dirname, join } from "node:path";
 import { fileURLToPath } from "node:url";
-import { format } from "prettier";
+import { formatGeneratedFile } from "./lib/format-generated-file.mjs";
+import { Client, InMemoryTransport } from "@modelcontextprotocol/client";
+import { Ajv2020 } from "ajv/dist/2020.js";
+import { McpServer } from "@modelcontextprotocol/server";
 
 import { TOOL_CONTRACTS } from "../dist/contracts/toolContracts.js";
 import { MANAGED_WORKFLOW_TOOL_CONTRACTS } from "../dist/contracts/managedWorkflowToolContracts.js";
@@ -16,14 +19,30 @@ for (const argument of arguments_)
     throw new Error(`Unknown MCP tool catalog option: ${argument}`);
 
 const root = join(dirname(fileURLToPath(import.meta.url)), "..");
+// The checked-in catalog is a portable package artifact. Keep its canonical
+// provider metadata independent of the machine running the generator.
+const CATALOG_PLATFORM = "darwin";
 const sessionToolNames = new Set([
   ...TOOL_CONTRACTS.filter(({ kind }) => kind === "session").map(
     ({ name }) => name,
   ),
   ...MANAGED_WORKFLOW_TOOL_CONTRACTS.map(({ name }) => name),
 ]);
+const advertisedTools = await sdkToolCatalog();
+const ajv = new Ajv2020({ strict: false, validateFormats: false });
+for (const tool of advertisedTools.values()) {
+  for (const kind of ["inputSchema", "outputSchema"]) {
+    const schema = tool[kind];
+    if (schema !== undefined && !ajv.validateSchema(schema))
+      throw new Error(
+        `Invalid JSON Schema for ${tool.name}.${kind}: ${ajv.errorsText(ajv.errors)}`,
+      );
+  }
+}
 const catalog = TOOL_CONTRACTS.map((contract) => {
-  const options = toolRegistrationOptions(contract);
+  const advertised = advertisedTools.get(contract.name);
+  if (advertised === undefined)
+    throw new Error(`MCP SDK omitted registered tool ${contract.name}`);
   return {
     name: contract.name,
     analysisOperation: [
@@ -35,30 +54,66 @@ const catalog = TOOL_CONTRACTS.map((contract) => {
     ].includes(contract.kind)
       ? contract.name
       : null,
-    title: options.title,
-    description: options.description,
+    title: advertised.title,
+    description: advertised.description,
     kind: contract.kind,
     requiresSession: sessionToolNames.has(contract.name),
-    inputSchema: options.inputSchema["~standard"].jsonSchema.input({
-      target: "draft-2020-12",
-    }),
-    outputSchema: options.outputSchema["~standard"].jsonSchema.output({
-      target: "draft-2020-12",
-    }),
-    annotations: options.annotations,
+    inputSchema: advertised.inputSchema,
+    outputSchema: advertised.outputSchema,
+    annotations: advertised.annotations,
     effects: contract.effects,
   };
 });
+
+async function sdkToolCatalog() {
+  const server = new McpServer({ name: "rea-catalog-generator", version: "0" });
+  for (const contract of TOOL_CONTRACTS)
+    server.registerTool(
+      contract.name,
+      toolRegistrationOptions(contract),
+      async () => ({
+        content: [{ type: "text", text: "Catalog-only handler" }],
+        isError: true,
+      }),
+    );
+  const client = new Client({ name: "rea-catalog-generator", version: "0" });
+  const [clientTransport, serverTransport] =
+    InMemoryTransport.createLinkedPair();
+  try {
+    await server.connect(serverTransport);
+    await client.connect(clientTransport);
+    const { tools } = await client.listTools();
+    return new Map(tools.map((tool) => [tool.name, tool]));
+  } finally {
+    await Promise.allSettled([client.close(), server.close()]);
+  }
+}
 const auxiliaryProviders = [
-  new ArtifactProvider(false, false),
-  new NativeMacOSProvider(),
+  new ArtifactProvider(CATALOG_PLATFORM),
+  new NativeMacOSProvider(undefined, CATALOG_PLATFORM),
   new ManagedStaticProvider(),
 ].map((provider) => ({
   identity: provider.identity(),
   capabilities: provider.capabilities(),
 }));
-const payloadJson = JSON.stringify({ catalog, auxiliaryProviders });
-const source = await format(
+
+const canonicalizeJson = (value) => {
+  if (Array.isArray(value)) return value.map(canonicalizeJson);
+  if (value === null || typeof value !== "object") return value;
+  return Object.fromEntries(
+    Object.entries(value)
+      .sort(([left], [right]) => (left < right ? -1 : left > right ? 1 : 0))
+      .map(([key, entry]) => [key, canonicalizeJson(entry)]),
+  );
+};
+
+const payloadJson = JSON.stringify(
+  canonicalizeJson({ catalog, auxiliaryProviders }),
+  null,
+  2,
+);
+const source = await formatGeneratedFile(
+  "src/generatedMcpToolCatalog.ts",
   `import type { ToolAnnotations } from "@modelcontextprotocol/server";
 import type {
   CapabilityDescriptor,
@@ -142,7 +197,6 @@ function isRecord(
   return typeof value === "object" && value !== null && !Array.isArray(value);
 }
 `,
-  { parser: "typescript" },
 );
 
 await ensureGeneratedFile({

scripts/hopper-demo-x11.py

@@ -36,11 +36,8 @@ UNEXPECTED_DISPLAY_GEOMETRY = 77
 X11_INPUT_FAILED = 78
 RUNTIME_DEPENDENCY_UNAVAILABLE = 79
 X11_SOCKET_DIRECTORY_UNUSABLE = 80
-DIAGNOSTIC_PREFIX = "REA_X11_DIAGNOSTIC_V1="
+DIAGNOSTIC_PREFIX = "REA_X11_DIAGNOSTIC="
 X11_SOCKET_DIRECTORY = Path("/tmp/.X11-unix")
-XVFB_STDERR_LIMIT = 16 * 1024
-
-
 class AdapterFailure(Exception):
     def __init__(
         self,
@@ -48,20 +45,18 @@ class AdapterFailure(Exception):
         reason: str,
         message: str,
         stderr_bytes: int = 0,
-        stderr_truncated: bool = False,
     ) -> None:
         super().__init__(message)
         self.code = code
         self.reason = reason
         self.stderr_bytes = stderr_bytes
-        self.stderr_truncated = stderr_truncated
 
-    def with_stderr(self, capture: BoundedStderr) -> AdapterFailure:
-        self.stderr_bytes, self.stderr_truncated, _ = capture.snapshot()
+    def with_stderr(self, capture: CapturedStderr) -> AdapterFailure:
+        self.stderr_bytes, _ = capture.snapshot()
         return self
 
 
-class BoundedStderr:
+class CapturedStderr:
     def __init__(self, stream: object) -> None:
         self._stream = stream
         self._retained = bytearray()
@@ -77,15 +72,13 @@ class BoundedStderr:
                 return
             with self._lock:
                 self._bytes += len(chunk)
-                remaining = XVFB_STDERR_LIMIT - len(self._retained)
-                if remaining > 0:
-                    self._retained.extend(chunk[:remaining])
+                self._retained.extend(chunk)
 
-    def snapshot(self) -> tuple[int, bool, str]:
+    def snapshot(self) -> tuple[int, str]:
         with self._lock:
             retained = bytes(self._retained)
             total = self._bytes
-        return total, total > len(retained), retained.decode("utf-8", "replace")
+        return total, retained.decode("utf-8", "replace")
 
     def close(self) -> None:
         self._thread.join(timeout=0.5)
@@ -284,14 +277,11 @@ def diagnostic(
     operation: str,
     status: str,
     failure: AdapterFailure | None = None,
-    capture: BoundedStderr | None = None,
+    capture: CapturedStderr | None = None,
 ) -> dict[str, object]:
     mode, read_only, _ = socket_directory_state()
-    captured_bytes, captured_truncated, _ = (
-        (0, False, "") if capture is None else capture.snapshot()
-    )
+    captured_bytes, _ = (0, "") if capture is None else capture.snapshot()
     return {
-        "schema_version": 1,
         "component": "hopper_private_display",
         "operation": operation,
         "status": status,
@@ -308,9 +298,6 @@ def diagnostic(
         "xvfb_stderr_bytes": captured_bytes
         if failure is None
         else failure.stderr_bytes,
-        "xvfb_stderr_truncated": captured_truncated
-        if failure is None
-        else failure.stderr_truncated,
     }
 
 
@@ -441,8 +428,8 @@ def authorize_display(
         ) from error
 
 
-def classify_xvfb_failure(capture: BoundedStderr) -> AdapterFailure:
-    stderr_bytes, stderr_truncated, text = capture.snapshot()
+def classify_xvfb_failure(capture: CapturedStderr) -> AdapterFailure:
+    stderr_bytes, text = capture.snapshot()
     mode, read_only, directory = socket_directory_state()
     if read_only is True:
         return AdapterFailure(
@@ -450,7 +437,6 @@ def classify_xvfb_failure(capture: BoundedStderr) -> AdapterFailure:
             "socket_directory_read_only",
             "X11 socket directory is read-only",
             stderr_bytes,
-            stderr_truncated,
         )
     if directory and mode != "1777":
         return AdapterFailure(
@@ -458,7 +444,6 @@ def classify_xvfb_failure(capture: BoundedStderr) -> AdapterFailure:
             "socket_directory_mode",
             "X11 socket directory mode is not 1777",
             stderr_bytes,
-            stderr_truncated,
         )
     if mode is not None and not directory:
         return AdapterFailure(
@@ -466,7 +451,6 @@ def classify_xvfb_failure(capture: BoundedStderr) -> AdapterFailure:
             "socket_directory_type",
             "X11 socket path is not a directory",
             stderr_bytes,
-            stderr_truncated,
         )
     lowered = text.lower()
     if "error while loading shared libraries" in lowered:
@@ -475,7 +459,6 @@ def classify_xvfb_failure(capture: BoundedStderr) -> AdapterFailure:
             "missing_library",
             "Xvfb shared library unavailable",
             stderr_bytes,
-            stderr_truncated,
         )
     if any(
         marker in lowered
@@ -490,21 +473,19 @@ def classify_xvfb_failure(capture: BoundedStderr) -> AdapterFailure:
             "address_collision",
             "private display address collision",
             stderr_bytes,
-            stderr_truncated,
         )
     return AdapterFailure(
         PRIVATE_DISPLAY_UNAVAILABLE,
         "xvfb_startup_failed",
         "private X display unavailable",
         stderr_bytes,
-        stderr_truncated,
     )
 
 
 def start_xvfb(
     session: Path,
     args: argparse.Namespace,
-) -> tuple[subprocess.Popen[bytes], str, Path, BoundedStderr]:
+) -> tuple[subprocess.Popen[bytes], str, Path, CapturedStderr]:
     authority = session / "Xauthority"
     collision: AdapterFailure | None = None
     for _ in range(3):
@@ -551,7 +532,7 @@ def start_xvfb(
                 "xvfb_startup_failed",
                 "Xvfb stderr unavailable",
             )
-        capture = BoundedStderr(process.stderr)
+        capture = CapturedStderr(process.stderr)
         deadline = time.monotonic() + 2
         socket = Path(f"/tmp/.X11-unix/X{display_number}")
         while time.monotonic() < deadline and process.poll() is None:

scripts/lib/artifact-e2e.mjs

@@ -0,0 +1,64 @@
+import assert from "node:assert/strict";
+import { execFile } from "node:child_process";
+import { promisify } from "node:util";
+import { fileURLToPath } from "node:url";
+import { Client } from "@modelcontextprotocol/client";
+import { StdioClientTransport } from "@modelcontextprotocol/client/stdio";
+
+const environment = () => ({
+  PATH: process.env.PATH ?? "/usr/bin:/bin",
+  REA_LOG_LEVEL: "silent",
+  REA_ANALYSIS_PROVIDER: "auto",
+  // Artifact workflows have no deep-provider prerequisite or GUI authority.
+  HOPPER_LAUNCHER_PATH: "/rea-unconfigured-deep-provider/hopper",
+});
+
+/** Execute the compiled CLI with production providers and no test adapters. */
+export async function artifactCli(command, target, arguments_ = []) {
+  const { stdout } = await promisify(execFile)(
+    process.execPath,
+    [
+      fileURLToPath(new URL("../rea.mjs", import.meta.url)),
+      command,
+      target,
+      ...arguments_,
+      "--json",
+    ],
+    { env: environment(), timeout: 60000, maxBuffer: 16 * 1024 * 1024 },
+  );
+  const evidence = JSON.parse(stdout);
+  assert.equal(evidence.error, undefined, stdout);
+  assert.ok(evidence.normalized_result, "CLI omitted normalized result");
+  return evidence.normalized_result;
+}
+
+/** Run a real stdio MCP subprocess, owning and closing its transport. */
+export async function withArtifactMcp(target, verify) {
+  const transport = new StdioClientTransport({
+    command: process.execPath,
+    args: [fileURLToPath(new URL("../rea.mjs", import.meta.url)), "mcp"],
+    env: environment(),
+    stderr: "pipe",
+  });
+  const client = new Client({ name: "artifact-real-e2e", version: "1" });
+  try {
+    await client.connect(transport);
+    const opened = await client.callTool({
+      name: "open_binary",
+      arguments: { path: target },
+    });
+    assert.notEqual(opened.isError, true, JSON.stringify(opened));
+    await verify(client);
+  } finally {
+    await client.close();
+    await transport.close();
+  }
+}
+
+/** Require a successful structured MCP tool result rather than its text rendering. */
+export async function artifactMcpResult(client, name, arguments_ = {}) {
+  const result = await client.callTool({ name, arguments: arguments_ });
+  assert.notEqual(result.isError, true, JSON.stringify(result));
+  assert.ok(result.structuredContent?.result, "MCP omitted structured result");
+  return result.structuredContent.result;
+}

scripts/lib/browser-popup-e2e.mjs

@@ -0,0 +1,252 @@
+import assert from "node:assert/strict";
+import { execFile } from "node:child_process";
+import { once } from "node:events";
+import { createServer } from "node:http";
+import { fileURLToPath } from "node:url";
+import { promisify } from "node:util";
+import { chromium } from "playwright-core";
+import { Client } from "@modelcontextprotocol/client";
+import { StdioClientTransport } from "@modelcontextprotocol/client/stdio";
+
+import { PlaywrightBrowserScenarioProvider } from "../../dist/browser/PlaywrightBrowserScenarioProvider.js";
+import { PlaywrightScenarioEvents } from "../../dist/browser/PlaywrightScenarioEvents.js";
+import { BrowserScenarioSecrets } from "../../dist/browser/BrowserScenarioSecrets.js";
+import { browserScenarioSchema } from "../../dist/domain/browserScenario.js";
+import { compareBrowserScenarios } from "../../dist/domain/browserScenarioDiff.js";
+import { browserScenarioCaptureSchema } from "../../dist/domain/browserScenarioCapture.js";
+import { parseEvidence } from "../../dist/domain/evidence.js";
+
+const document = (path) => {
+  if (path.startsWith("/nested"))
+    return `<script>throw new Error("nested popup failure")</script>
+      <script>opener.postMessage("nested-ready", "*")</script>`;
+  if (path.startsWith("/popup"))
+    return `<script>throw new Error("popup failure")</script>
+      <script>onmessage = e => {
+        if (e.data === "nested-ready") opener.postMessage("popup-ready", "*");
+      }; window.open("/nested");</script><iframe src="/child"></iframe>`;
+  if (path.startsWith("/child")) return "child frame";
+  return `<script>onmessage = e => {
+    if (e.data === "popup-ready") document.body.dataset.ready = "true";
+  }</script><button onclick="window.open('/redirect')">Open popup</button>`;
+};
+
+const scenarioFor = (executable, origin, events) =>
+  browserScenarioSchema.parse({
+    browser: { mode: "launch", executable_path: executable },
+    start_url: { url: origin },
+    actions: [
+      {
+        step_id: "open",
+        action: "click",
+        locator: { kind: "role", role: "button", name: "Open popup" },
+      },
+      {
+        step_id: "ready",
+        action: "wait_for",
+        locator: { kind: "css", selector: "body[data-ready=true]" },
+        state: "attached",
+        timeout_ms: 10_000,
+      },
+    ],
+    capture: { events, after_each_step: [], at_end: [] },
+  });
+
+const capture = async (scenario) => {
+  const result = await new PlaywrightBrowserScenarioProvider().captureScenario(
+    scenario,
+  );
+  if (!result.ok) throw result.error;
+  assert.ok(
+    result.value.steps.every((step) => step.status === "completed"),
+    JSON.stringify(result.value.steps),
+  );
+  return result.value;
+};
+
+const assertNetwork = (result, origin) => {
+  for (const path of ["/redirect", "/popup", "/nested"])
+    for (const kind of ["request", "response"])
+      assert.equal(
+        result.events.items.filter(
+          (event) => event.kind === kind && event.url?.url === origin + path,
+        ).length,
+        1,
+        `${kind} ${path} must be captured exactly once`,
+      );
+  assert.equal(result.completeness.equality_eligible, true);
+  assert.equal(compareWithSelf(result).overall_status, "unchanged");
+};
+
+const compareWithSelf = (capture) =>
+  compareBrowserScenarios({
+    before_scenario: capture,
+    after_scenario: capture,
+    normalization: { rules: [] },
+  });
+
+const verifySharedContext = async (executable, origin) => {
+  const browser = await chromium.launch({
+    executablePath: executable,
+    headless: true,
+  });
+  try {
+    const context = await browser.newContext();
+    const page = await context.newPage();
+    const foreign = await context.newPage();
+    const secrets = BrowserScenarioSecrets.resolve(
+      scenarioFor(executable, origin, ["network"]),
+      {},
+    );
+    assert.ok(secrets);
+    const events = new PlaywrightScenarioEvents({
+      page,
+      context,
+      ownsContext: false,
+      enabled: new Set(["network"]),
+      secrets,
+    });
+    await Promise.all([
+      page.goto(origin),
+      foreign.goto(origin + "/popup?unrelated-tab"),
+    ]);
+    await page.getByRole("button", { name: "Open popup", exact: true }).click();
+    await page.locator("body[data-ready=true]").waitFor({ timeout: 10_000 });
+    const retained = events.result().items;
+    assert.ok(
+      events
+        .limitations()
+        .some((value) => value.includes("Shared-context network")),
+    );
+    assert.ok(retained.some((event) => event.url?.url === origin + "/"));
+    assert.ok(!JSON.stringify(retained).includes("unrelated-tab"));
+  } finally {
+    await browser.close();
+  }
+};
+
+const verifyTransports = async (executable, origin) => {
+  const scenario = scenarioFor(executable, origin, ["network"]);
+  const entrypoint = fileURLToPath(new URL("../rea.mjs", import.meta.url));
+  const env = {
+    PATH: process.env.PATH ?? "/usr/bin:/bin",
+    REA_LOG_LEVEL: "silent",
+    HOPPER_LAUNCHER_PATH: "/rea-unconfigured-deep-provider/hopper",
+  };
+  const { stdout } = await promisify(execFile)(
+    process.execPath,
+    [
+      entrypoint,
+      "capture-browser-scenario",
+      JSON.stringify(scenario),
+      "--json",
+    ],
+    { env, timeout: 60_000, maxBuffer: 16 * 1024 * 1024 },
+  );
+  assertNetwork(
+    browserScenarioCaptureSchema.parse(
+      parseEvidence(JSON.parse(stdout)).normalized_result,
+    ),
+    origin,
+  );
+  const transport = new StdioClientTransport({
+    command: process.execPath,
+    args: [entrypoint, "mcp"],
+    env,
+    stderr: "pipe",
+  });
+  const client = new Client({ name: "popup-real-e2e", version: "1" });
+  try {
+    await client.connect(transport);
+    const captured = await client.callTool(
+      { name: "capture_browser_scenario", arguments: scenario },
+      { timeout: 60_000 },
+    );
+    assert.notEqual(captured.isError, true, JSON.stringify(captured));
+    const evidence = parseEvidence({
+      ...captured.structuredContent?.evidence,
+      normalized_result: captured.structuredContent?.result,
+    });
+    assertNetwork(
+      browserScenarioCaptureSchema.parse(evidence.normalized_result),
+      origin,
+    );
+  } finally {
+    try {
+      await client.close();
+    } finally {
+      await transport.close();
+    }
+  }
+};
+
+/** Verify popup timing, selection, coverage, and shared-context isolation on Chromium. */
+export async function verifyPopupEventCoverage(executable) {
+  const server = createServer((request, response) => {
+    if (request.url === "/redirect") {
+      response.writeHead(302, { Location: "/popup" });
+      response.end();
+    } else {
+      response.setHeader("Content-Type", "text/html");
+      response.end(document(request.url ?? "/"));
+    }
+  });
+  server.listen(0, "127.0.0.1");
+  await once(server, "listening");
+  try {
+    const address = server.address();
+    assert.ok(address !== null && typeof address === "object");
+    const origin = `http://127.0.0.1:${address.port}`;
+    assertNetwork(
+      await capture(scenarioFor(executable, origin, ["network"])),
+      origin,
+    );
+    const errors = await capture(
+      scenarioFor(executable, origin, ["page-errors"]),
+    );
+    assert.deepEqual(
+      errors.events.items.map((event) => event.kind),
+      ["page-error", "page-error"],
+    );
+    assert.ok(
+      errors.events.items.some((event) => event.message === "popup failure"),
+    );
+    assert.ok(
+      errors.events.items.some(
+        (event) => event.message === "nested popup failure",
+      ),
+    );
+    for (const family of ["frames", "workers", "websockets", "downloads"]) {
+      const result = await capture(scenarioFor(executable, origin, [family]));
+      assert.equal(result.completeness.equality_eligible, false);
+      assert.ok(result.completeness.missing_sections.includes("events"));
+      assert.equal(compareWithSelf(result).overall_status, "unknown");
+      assert.ok(
+        result.limitations.some((limitation) =>
+          limitation.includes(`Popup ${family}`),
+        ),
+      );
+    }
+    await verifySharedContext(executable, origin);
+    await verifyTransports(executable, origin);
+    return {
+      mocked: false,
+      initial_network: true,
+      redirects: true,
+      nested_popups: true,
+      unselected_lifecycle_absent: true,
+      popup_event_gaps_explicit: true,
+      incomplete_comparison_unknown: true,
+      shared_context_isolation: true,
+      cli: true,
+      stdio_mcp: true,
+    };
+  } finally {
+    server.closeAllConnections();
+    await new Promise((resolve, reject) =>
+      server.close((error) =>
+        error === undefined ? resolve() : reject(error),
+      ),
+    );
+  }
+}

scripts/lib/browser-scenario-verifier.mjs

@@ -1,7 +1,6 @@
 import { execFile } from "node:child_process";
 import { readdir } from "node:fs/promises";
 import { tmpdir } from "node:os";
-import { dirname } from "node:path";
 import { promisify } from "node:util";
 
 import { browserScenarioSchema } from "../../dist/domain/browserScenario.js";
@@ -18,7 +17,6 @@ const duplicateOriginStorage = (origin) => ({
           value: {
             source: "literal",
             value: "first",
-            classification: "public",
           },
         },
       ],
@@ -31,9 +29,12 @@ const duplicateOriginStorage = (origin) => ({
           value: {
             source: "literal",
             value: "second",
-            classification: "public",
           },
         },
+        {
+          name: "rea-secret-seed",
+          value: { source: "secret", secret_id: "verifier_storage" },
+        },
       ],
     },
   ],
@@ -42,17 +43,22 @@ const duplicateOriginStorage = (origin) => ({
 /** Build the source-owned full-capture browser scenario. */
 export function browserScenario(browser, origin) {
   return browserScenarioSchema.parse({
-    schema_version: 1,
     browser,
-    start_url: { url: `${origin}/app`, query: [] },
-    allowed_origins: [origin],
+    start_url: {
+      url: `${origin}/app`,
+      query: [
+        {
+          name: "scenario_token",
+          value: { source: "secret", secret_id: "verifier_url" },
+        },
+      ],
+    },
     environment: {
       viewport: { width: 1_280, height: 720, device_scale_factor: 1.25 },
       locale: "en-US",
       timezone: "UTC",
       color_scheme: "light",
       reduced_motion: "reduce",
-      service_workers: "block",
     },
     actions: [
       {
@@ -62,7 +68,6 @@ export function browserScenario(browser, origin) {
           kind: "role",
           role: "button",
           name: "ax-private-label-value",
-          exact: true,
         },
         state: "visible",
       },
@@ -73,17 +78,20 @@ export function browserScenario(browser, origin) {
           kind: "role",
           role: "button",
           name: "ax-private-label-value",
-          exact: true,
         },
       },
     ],
     storage: duplicateOriginStorage(origin),
-    request_replay: { mode: "disabled" },
-    secrets: [],
-    redaction: {
-      secret_values: "replace-with-secret-reference",
-      query_parameter_names: ["token"],
-    },
+    secrets: [
+      {
+        secret_id: "verifier_url",
+        environment_variable: "REA_BROWSER_VERIFIER_URL",
+      },
+      {
+        secret_id: "verifier_storage",
+        environment_variable: "REA_BROWSER_VERIFIER_SECRET",
+      },
+    ],
     capture: {
       after_each_step: [
         "screenshot",
@@ -112,28 +120,11 @@ export function browserScenario(browser, origin) {
         "downloads",
       ],
     },
-    limits: {
-      max_duration_ms: 30_000,
-      action_timeout_ms: 5_000,
-      navigation_timeout_ms: 10_000,
-      max_events: 10_000,
-      max_frames: 100,
-      max_workers: 20,
-      max_popups: 10,
-      max_websockets: 100,
-      max_dom_nodes: 10_000,
-      max_accessibility_nodes: 10_000,
-      max_screenshots: 8,
-      max_screenshot_bytes: 4 * 1_024 * 1_024,
-      max_storage_entries: 256,
-      max_total_metadata_bytes: 8 * 1_024 * 1_024,
-    },
-    approved: true,
   });
 }
 
 /** Run scenario capture through the public one-shot CLI. */
-export async function runScenarioCli(scenario, configuration) {
+export async function runScenarioCli(scenario) {
   const { stdout } = await execute(
     process.execPath,
     [
@@ -144,16 +135,7 @@ export async function runScenarioCli(scenario, configuration) {
     ],
     {
       cwd: process.cwd(),
-      env: {
-        ...process.env,
-        REA_BROWSER_SCENARIO_ENABLED: "true",
-        REA_BROWSER_SCENARIO_AUTO_GRANT: "true",
-        REA_BROWSER_SCENARIO_EXECUTABLE_ROOTS_JSON: JSON.stringify([
-          dirname(scenario.browser.executable_path ?? process.execPath),
-        ]),
-        REA_BROWSER_SCENARIO_ALLOWED_ENV_JSON: "[]",
-        ...configuration,
-      },
+      env: process.env,
       maxBuffer: 64 * 1_024 * 1_024,
     },
   );
@@ -193,6 +175,35 @@ export function assertScenarioCapture(capture) {
     !storageNames.includes("rea-second-seed")
   )
     throw new Error("Scenario launch did not retain duplicate-origin seeds");
+  const secretSeed =
+    final.artifacts.storage.state === "captured"
+      ? final.artifacts.storage.value.local_storage.find(
+          ({ name }) => name === "rea-secret-seed",
+        )
+      : undefined;
+  if (secretSeed?.value_state !== "redacted-secret")
+    throw new Error("Scenario launch did not redact its declared secret seed");
+  const finalUrl =
+    final.artifacts.url.state === "captured"
+      ? final.artifacts.url.value.url
+      : "";
+  if (!finalUrl.includes("[REDACTED:verifier_url]"))
+    throw new Error("Scenario launch did not redact its declared URL secret");
+  const stepUrl = capture.steps
+    .map(({ after_url }) => after_url)
+    .find(({ url }) => url.includes("[REDACTED:verifier_url]"));
+  if (stepUrl?.redacted !== true)
+    throw new Error(
+      "Scenario step URL did not report declared-secret redaction",
+    );
+  const eventUrl = capture.events.items
+    .filter((event) => "url" in event && event.url !== null)
+    .map((event) => event.url)
+    .find(({ url }) => url.includes("[REDACTED:verifier_url]"));
+  if (eventUrl?.redacted !== true)
+    throw new Error(
+      "Scenario event URL did not report declared-secret redaction",
+    );
   if (
     capture.events.items.length === 0 ||
     capture.completeness.equality_eligible !== true

scripts/lib/browser-screenshot-e2e.mjs

@@ -0,0 +1,119 @@
+import assert from "node:assert/strict";
+import { execFile } from "node:child_process";
+import { promisify } from "node:util";
+import { fileURLToPath } from "node:url";
+import { chromium } from "playwright-core";
+import { Client } from "@modelcontextprotocol/client";
+import { StdioClientTransport } from "@modelcontextprotocol/client/stdio";
+import { parseEvidence } from "../../dist/domain/evidence.js";
+import { webScreenshotSchema } from "../../dist/domain/webScreenshot.js";
+import { comparePngScreenshots } from "../../dist/browser/PngVisualDiff.js";
+
+/** Verify a real, large PNG through production CLI and stdio MCP boundaries. */
+export async function verifyLargeScreenshotE2e(endpoint, origin) {
+  const browser = await chromium.connectOverCDP(endpoint);
+  const context = await browser.newContext({
+    viewport: { width: 2048, height: 1536 },
+    deviceScaleFactor: 1,
+  });
+  const entrypoint = fileURLToPath(new URL("../rea.mjs", import.meta.url));
+  const env = {
+    PATH: process.env.PATH ?? "/usr/bin:/bin",
+    REA_LOG_LEVEL: "silent",
+    HOPPER_LAUNCHER_PATH: "/rea-unconfigured-deep-provider/hopper",
+  };
+  let client;
+  let transport;
+  try {
+    const page = await context.newPage();
+    await page.goto(`${origin}/screenshot-noise`);
+    await page.waitForFunction(() => document.body.dataset.ready === "true");
+    const targets = await (await fetch(`${endpoint}/json/list`)).json();
+    const target = targets.find((value) => value.url === page.url());
+    assert.ok(
+      target,
+      "Owned screenshot page is absent from actual CDP discovery",
+    );
+    const { stdout } = await promisify(execFile)(
+      process.execPath,
+      [
+        entrypoint,
+        "capture-web-screenshot",
+        endpoint,
+        target.id,
+        "--allowed-origins",
+        origin,
+        "--json",
+      ],
+      { env, timeout: 60000, maxBuffer: 72 * 1024 * 1024 },
+    );
+    const cliEvidence = parseEvidence(JSON.parse(stdout));
+    assert.equal(cliEvidence.operation, "capture_web_screenshot");
+    const screenshot = webScreenshotSchema.parse(cliEvidence.normalized_result);
+    assert.ok(
+      screenshot.artifact.bytes > 8 * 1024 * 1024,
+      "Real PNG did not cross the former screenshot byte ceiling",
+    );
+    const bytes = Buffer.from(screenshot.artifact.data_base64, "base64");
+    assert.equal(bytes.byteLength, screenshot.artifact.bytes);
+    assert.deepEqual(
+      bytes.subarray(0, 8),
+      Buffer.from([137, 80, 78, 71, 13, 10, 26, 10]),
+    );
+    assert.equal(bytes.readUInt32BE(16), 2048);
+    assert.equal(bytes.readUInt32BE(20), 1536);
+    transport = new StdioClientTransport({
+      command: process.execPath,
+      args: [entrypoint, "mcp"],
+      env,
+      stderr: "pipe",
+      // The SDK defaults to a 10 MiB receive buffer; inline PNG output is larger.
+      maxBufferSize: 64 * 1024 * 1024,
+    });
+    client = new Client({ name: "browser-screenshot-real-e2e", version: "1" });
+    await client.connect(transport);
+    const captured = await client.callTool(
+      {
+        name: "capture_web_screenshot",
+        arguments: {
+          cdp_endpoint: endpoint,
+          target_id: target.id,
+        },
+      },
+      { timeout: 60000 },
+    );
+    assert.notEqual(captured.isError, true, JSON.stringify(captured));
+    const mcpEvidence = parseEvidence({
+      ...captured.structuredContent?.evidence,
+      normalized_result: captured.structuredContent?.result,
+    });
+    const mcpScreenshot = webScreenshotSchema.parse(
+      mcpEvidence.normalized_result,
+    );
+    assert.deepEqual(mcpScreenshot.artifact, screenshot.artifact);
+    const compared = comparePngScreenshots({
+      before: screenshot.artifact,
+      after: mcpScreenshot.artifact,
+      channel_threshold: 0,
+    });
+    assert.equal(compared.status, "identical");
+    assert.equal(compared.changed_pixels, 0);
+    return {
+      mocked: false,
+      cli: true,
+      stdio_mcp: true,
+      png_bytes: bytes.byteLength,
+    };
+  } finally {
+    try {
+      if (client !== undefined) await client.close();
+    } finally {
+      try {
+        if (transport !== undefined) await transport.close();
+      } finally {
+        await context.close();
+        await browser.close();
+      }
+    }
+  }
+}

scripts/lib/browser-verifier-assertions.mjs

@@ -133,7 +133,7 @@ export function assertBundleAnalysis(result) {
     );
 }
 
-/** Assert explicitly approved console, JSON, and WebSocket shape capture. */
+/** Assert explicitly selected console text and JSON/WebSocket shape capture. */
 export function assertSensitiveShapes(result) {
   const request = result.network.requests.find(
     (item) =>
@@ -151,12 +151,11 @@ export function assertSensitiveShapes(result) {
     (event) => event.text_capture.values,
   );
   if (
-    !consoleText.some(({ text }) => text.includes("[REDACTED]")) ||
-    consoleText.some(({ text }) => text.includes("console-secret-value"))
+    !consoleText.some(({ text }) =>
+      text.includes("authorization=Bearer console-secret-value"),
+    )
   )
-    throw new Error(
-      "Real Chrome approved console text was not safely redacted",
-    );
+    throw new Error("Real Chrome selected console text was not preserved");
   if (
     !result.network.websocket_events.some(
       (event) =>
@@ -174,8 +173,8 @@ export function assertSensitiveShapes(result) {
   for (const secret of [
     "request-body-secret-value",
     "response-secret-value",
+    "request-secret-value",
     "websocket-secret-value",
-    "console-secret-value",
   ])
     if (serialized.includes(secret))
       throw new Error(`Approved shape capture retained raw value: ${secret}`);

scripts/lib/catalog-builders.mjs

@@ -6,12 +6,12 @@ export const toolFamilyCatalog = (sources) => {
     {
       id: "direct",
       surface: "official-proxy",
-      contracts: sources.toolContracts.OFFICIAL_TOOL_CONTRACTS,
+      contracts: sources.officialContracts.OFFICIAL_TOOL_CONTRACTS,
     },
     {
       id: "enhanced",
       surface: "enhanced",
-      contracts: sources.toolContracts.ENHANCED_TOOL_CONTRACTS,
+      contracts: sources.enhancedContracts.ENHANCED_TOOL_CONTRACTS,
     },
     {
       id: "native",
@@ -59,7 +59,7 @@ export const toolFamilyCatalog = (sources) => {
     {
       id: "session",
       surface: "session",
-      contracts: sources.toolContracts.SESSION_TOOL_CONTRACTS,
+      contracts: sources.sessionContracts.SESSION_TOOL_CONTRACTS,
     },
   ].map(({ id, surface, contracts }) => ({
     id,
@@ -81,26 +81,12 @@ export const toolFamilyCatalog = (sources) => {
 
 /** Build provider identities with their sorted capability names. */
 export const providerCatalog = (sources) => {
-  const applicationContracts =
-    sources.electronContracts.ELECTRON_TOOL_CONTRACTS.filter(
-      ({ name }) => name === "analyze_javascript_application",
-    );
-  const reconciliationContracts =
-    sources.electronContracts.ELECTRON_TOOL_CONTRACTS.filter(
-      ({ name }) => name === "reconcile_javascript_runtime",
-    );
-  const observationContracts =
-    sources.electronContracts.ELECTRON_TOOL_CONTRACTS.filter(
-      ({ name }) =>
-        name !== "analyze_javascript_application" &&
-        name !== "reconcile_javascript_runtime",
-    );
-  if (
-    applicationContracts.length !== 1 ||
-    reconciliationContracts.length !== 1 ||
-    observationContracts.length !== 2
-  )
-    throw new Error("Electron provider capability ownership drifted");
+  const {
+    applicationContracts,
+    reconciliationContracts,
+    observationContracts,
+    activeContracts,
+  } = electronContractSlices(sources);
   return [
     {
       identity: sources.hopperProvider.HOPPER_PROVIDER_IDENTITY,
@@ -142,6 +128,12 @@ export const providerCatalog = (sources) => {
       identity: sources.electronProvider.CDP_ELECTRON_PROVIDER_IDENTITY,
       contracts: observationContracts,
     },
+    {
+      identity:
+        sources.electronActiveProvider
+          .PLAYWRIGHT_ELECTRON_ACTIVE_PROVIDER_IDENTITY,
+      contracts: activeContracts,
+    },
     {
       identity: sources.v8InspectorProvider.V8_INSPECTOR_PROVIDER_IDENTITY,
       contracts:
@@ -171,3 +163,38 @@ export const providerCatalog = (sources) => {
     }))
     .sort((left, right) => left.id.localeCompare(right.id));
 };
+
+const electronContractSlices = (sources) => {
+  const applicationContracts =
+    sources.electronContracts.ELECTRON_TOOL_CONTRACTS.filter(
+      ({ name }) => name === "analyze_javascript_application",
+    );
+  const reconciliationContracts =
+    sources.electronContracts.ELECTRON_TOOL_CONTRACTS.filter(
+      ({ name }) => name === "reconcile_javascript_runtime",
+    );
+  const observationContracts =
+    sources.electronContracts.ELECTRON_TOOL_CONTRACTS.filter(
+      ({ name }) =>
+        name !== "analyze_javascript_application" &&
+        name !== "reconcile_javascript_runtime" &&
+        name !== "capture_electron_scenario",
+    );
+  const activeContracts =
+    sources.electronContracts.ELECTRON_TOOL_CONTRACTS.filter(
+      ({ name }) => name === "capture_electron_scenario",
+    );
+  if (
+    applicationContracts.length !== 1 ||
+    reconciliationContracts.length !== 1 ||
+    observationContracts.length !== 2 ||
+    activeContracts.length !== 1
+  )
+    throw new Error("Electron provider capability ownership drifted");
+  return {
+    applicationContracts,
+    reconciliationContracts,
+    observationContracts,
+    activeContracts,
+  };
+};

scripts/lib/catalog-core.mjs

@@ -1,6 +1,9 @@
+import { createHash } from "node:crypto";
 import { join } from "node:path";
 import { pathToFileURL } from "node:url";
 
+import canonicalize from "canonicalize";
+
 const load = (root, path) => import(pathToFileURL(join(root, path)).href);
 
 /** Sort tool/provider names alphabetically. */
@@ -9,6 +12,14 @@ export const names = (contracts) =>
     .map(({ name }) => name)
     .sort((left, right) => left.localeCompare(right));
 
+/** Return the stable digest for a generated catalog projection. */
+export const digest = (value) => {
+  const encoded = canonicalize(value);
+  if (encoded === undefined)
+    throw new TypeError("Catalog projection is not canonical JSON");
+  return createHash("sha256").update(encoded).digest("hex");
+};
+
 /** Throw when two name lists diverge. */
 export const assertSameNames = (label, actual, expected) => {
   const actualSet = new Set(actual);
@@ -26,6 +37,9 @@ const SOURCE_PATHS = {
   catalogIdentity: "dist/catalogIdentity.js",
   cli: "dist/cli.js",
   toolContracts: "dist/contracts/toolContracts.js",
+  officialContracts: "dist/contracts/officialToolContracts.js",
+  enhancedContracts: "dist/contracts/enhancedToolContracts.js",
+  sessionContracts: "dist/contracts/sessionToolContracts.js",
   nativeContracts: "dist/contracts/nativeToolContracts.js",
   artifactContracts: "dist/contracts/artifactToolContracts.js",
   managedContracts: "dist/contracts/managedToolContracts.js",
@@ -44,6 +58,7 @@ const SOURCE_PATHS = {
   browserProvider: "dist/browser/CdpBrowserProvider.js",
   browserScenarioProvider: "dist/browser/PlaywrightBrowserScenarioProvider.js",
   electronProvider: "dist/browser/CdpElectronProvider.js",
+  electronActiveProvider: "dist/browser/PlaywrightElectronActiveProvider.js",
   v8InspectorProvider: "dist/browser/V8InspectorProvider.js",
   evidence: "dist/domain/evidence.js",
   evidenceBundle: "dist/domain/evidenceBundle.js",
@@ -52,13 +67,13 @@ const SOURCE_PATHS = {
   processCapture: "dist/domain/processCapture.js",
   analysisSnapshot: "dist/domain/analysisSnapshot.js",
   artifactGraph: "dist/domain/artifactGraph.js",
-  investigationWorkspace: "dist/domain/investigationWorkspace.js",
   browserObservation: "dist/domain/browserObservation.js",
   browserScenario: "dist/domain/browserScenario.js",
   browserScenarioCapture: "dist/domain/browserScenarioCapture.js",
   browserScenarioDiff: "dist/domain/browserScenarioDiff.js",
   browserSession: "dist/domain/browserSession.js",
   electronObservation: "dist/domain/electronObservation.js",
+  electronActiveObservation: "dist/domain/electronActiveObservation.js",
   javascriptRuntimeObservation: "dist/domain/javascriptRuntimeObservation.js",
   webBundleAnalysis: "dist/domain/webBundleAnalysis.js",
   webCaptureDiff: "dist/domain/webCaptureDiff.js",

scripts/lib/catalog-schemas.mjs

@@ -1,262 +0,0 @@
-import { z } from "zod";
-
-const valuesAt = (node, path) => {
-  if (typeof node !== "object" || node === null) return [];
-  if ("anyOf" in node && Array.isArray(node.anyOf))
-    return node.anyOf.flatMap((alternative) => valuesAt(alternative, path));
-  if (path.length === 0)
-    return "const" in node &&
-      (typeof node.const === "number" || typeof node.const === "string")
-      ? [node.const]
-      : [];
-  if (
-    !("properties" in node) ||
-    typeof node.properties !== "object" ||
-    node.properties === null
-  )
-    return [];
-  const [segment, ...remaining] = path;
-  return segment !== undefined && segment in node.properties
-    ? valuesAt(node.properties[segment], remaining)
-    : [];
-};
-
-const versionAt = (schema, path) => {
-  const versions = [
-    ...new Set(
-      valuesAt(z.toJSONSchema(schema, { unrepresentable: "any" }), path).map(
-        String,
-      ),
-    ),
-  ];
-  if (versions.length !== 1)
-    throw new Error(
-      `Schema version path ${path.join(".")} has ${String(versions.length)} constant values`,
-    );
-  const version = versions[0];
-  if (version === undefined) throw new Error("Schema version disappeared");
-  return /^\d+$/u.test(version) ? Number(version) : version;
-};
-
-const durableSchemaDefinitions = (sources) => [
-  [
-    "analysis_snapshot",
-    sources.analysisSnapshot.analysisSnapshotSchema,
-    ["snapshot_version"],
-  ],
-  [
-    "artifact_graph",
-    sources.artifactGraph.artifactInventoryResultSchema,
-    ["manifest", "schema_version"],
-  ],
-  [
-    "artifact_extraction",
-    sources.artifactGraph.artifactExtractionResultSchema,
-    ["extraction_manifest", "schema_version"],
-  ],
-  [
-    "browser_scenario",
-    sources.browserScenario.browserScenarioSchema,
-    ["schema_version"],
-  ],
-  ["evidence", sources.evidence.evidenceSchema, ["schema_version"]],
-  [
-    "evidence_bundle",
-    sources.evidenceBundle.evidenceBundleSchema,
-    ["bundle_version"],
-  ],
-  [
-    "evidence_completion_ledger",
-    sources.evidenceCompletion.evidenceCompletionLedgerSchema,
-    ["schema_version"],
-  ],
-  [
-    "evidence_completion_manifest",
-    sources.completionGeneration.completionManifestSchema,
-    ["schema_version"],
-  ],
-  [
-    "investigation_run",
-    sources.investigationWorkspace.investigationRunSchema,
-    ["schema_version"],
-  ],
-  [
-    "investigation_run_summary",
-    sources.investigationWorkspace.investigationRunSummarySchema,
-    ["schema_version"],
-  ],
-  [
-    "investigation_workspace",
-    sources.investigationWorkspace.investigationWorkspaceSchema,
-    ["workspace_version"],
-  ],
-  [
-    "javascript_application_graph",
-    sources.javascriptApplicationGraph.javascriptApplicationGraphSchema,
-    ["schema_version"],
-  ],
-  [
-    "javascript_application_version_comparison",
-    sources.javascriptVersionComparison
-      .applicationVersionComparisonResultSchema,
-    ["schema_version"],
-  ],
-  [
-    "javascript_semantic_graph",
-    sources.javascriptSemanticGraph.javaScriptSemanticGraphSchema,
-    ["schema_version"],
-  ],
-  [
-    "javascript_semantic_query",
-    sources.javascriptSemanticQuery.javaScriptSemanticQueryResultSchema,
-    ["schema_version"],
-  ],
-  [
-    "javascript_semantic_trace",
-    sources.javascriptSemanticTrace.javaScriptSemanticTraceResultSchema,
-    ["schema_version"],
-  ],
-  [
-    "javascript_feature_trace",
-    sources.javascriptFeatureTrace.applicationFeatureTraceResultSchema,
-    ["schema_version"],
-  ],
-  [
-    "process_capture",
-    sources.processCapture.processCaptureSchema,
-    ["schema_version"],
-  ],
-  [
-    "reconstruction_verification",
-    sources.reconstructionVerification.reconstructionSpecificationSchema,
-    ["schema_version"],
-  ],
-  [
-    "residual_unknown",
-    sources.residualUnknown.residualUnknownSchema,
-    ["registry_version"],
-  ],
-];
-
-const browserScenarioObservationSchemaDefinitions = (sources) => [
-  [
-    "browser_scenario_capture",
-    sources.browserScenarioCapture.browserScenarioCaptureSchema,
-    ["schema_version"],
-  ],
-  [
-    "browser_scenario_diff",
-    sources.browserScenarioDiff.browserScenarioDiffSchema,
-    ["schema_version"],
-  ],
-];
-
-const observationSchemaDefinitions = (sources) => [
-  [
-    "managed_artifact_inspection",
-    sources.managedArtifact.managedArtifactInspectionSchema,
-    ["schema_version"],
-  ],
-  [
-    "managed_member_inspection",
-    sources.managedArtifact.managedMemberInspectionSchema,
-    ["schema_version"],
-  ],
-  [
-    "managed_native_boundary_inspection",
-    sources.managedArtifact.managedNativeBoundaryInspectionSchema,
-    ["schema_version"],
-  ],
-  [
-    "managed_member_comparison",
-    sources.managedComparison.managedMemberComparisonResultSchema,
-    ["schema_version"],
-  ],
-  [
-    "managed_native_verification",
-    sources.managedNativeVerification.managedNativeVerificationResultSchema,
-    ["schema_version"],
-  ],
-  [
-    "browser_target_list",
-    sources.browserObservation.browserTargetListSchema,
-    ["schema_version"],
-  ],
-  ...browserScenarioObservationSchemaDefinitions(sources),
-  [
-    "electron_page_inspection",
-    sources.electronObservation.electronPageInspectionSchema,
-    ["schema_version"],
-  ],
-  [
-    "electron_target_list",
-    sources.electronObservation.electronTargetListSchema,
-    ["schema_version"],
-  ],
-  [
-    "javascript_application_analysis",
-    sources.javascriptApplicationAnalysis
-      .javaScriptApplicationAnalysisResultV2Schema,
-    ["schema_version"],
-  ],
-  [
-    "javascript_runtime_observation",
-    sources.javascriptRuntimeObservation.javascriptRuntimeObservationSchema,
-    ["schema_version"],
-  ],
-  [
-    "javascript_runtime_target_list",
-    sources.javascriptRuntimeObservation.javascriptRuntimeTargetListSchema,
-    ["schema_version"],
-  ],
-  [
-    "web_bundle_analysis",
-    sources.webBundleAnalysis.webBundleAnalysisSchema,
-    ["schema_version"],
-  ],
-  [
-    "web_capture_diff",
-    sources.webCaptureDiff.webCaptureDiffSchema,
-    ["schema_version"],
-  ],
-  [
-    "web_mcp_discovery",
-    sources.webMcpDiscovery.webMcpDiscoverySchema,
-    ["schema_version"],
-  ],
-  [
-    "web_observation_session",
-    sources.browserSession.webObservationSessionSchema,
-    ["schema_version"],
-  ],
-  [
-    "web_page_inspection",
-    sources.browserObservation.webPageInspectionSchema,
-    ["schema_version"],
-  ],
-  [
-    "web_screenshot",
-    sources.webScreenshot.webScreenshotSchema,
-    ["schema_version"],
-  ],
-  [
-    "web_screenshot_diff",
-    sources.webScreenshot.webScreenshotDiffSchema,
-    ["schema_version"],
-  ],
-];
-
-/** Derive the catalog of durable and observation schema versions. */
-export const schemaCatalog = (sources) =>
-  [
-    ...durableSchemaDefinitions(sources),
-    ...observationSchemaDefinitions(sources),
-  ]
-    .map(([id, schema, path]) => {
-      try {
-        return { id, version: versionAt(schema, path) };
-      } catch (cause) {
-        throw new Error(`Could not derive ${id} schema version`, { cause });
-      }
-    })
-    .sort((left, right) => left.id.localeCompare(right.id));

scripts/lib/conformance-fixtures.d.mts

@@ -9,7 +9,7 @@ export const HOPPER_C_ORACLE: Readonly<{
   globalName: "rea_c_global";
 }>;
 export function sha256(value: string | Uint8Array): string;
-export function generateLargeFixture(count?: number): string;
+export function generateLargeFixture(): string;
 export function sourceDigest(
   sources: readonly { readonly path: string; readonly content: string }[],
 ): string;

scripts/lib/conformance-fixtures.mjs

@@ -15,18 +15,16 @@ export const HOPPER_C_ORACLE = Object.freeze({
 export const sha256 = (value) =>
   createHash("sha256").update(value).digest("hex");
 
-export const generateLargeFixture = (count = LARGE_FIXTURE_COUNT) => {
-  if (!Number.isInteger(count) || count < 1)
-    throw new Error("Fixture count must be a positive integer");
+export const generateLargeFixture = () => {
   const declarations = Array.from(
-    { length: count },
+    { length: LARGE_FIXTURE_COUNT },
     (_, index) =>
-      `__attribute__((noinline, used)) int rea_page_${String(index).padStart(4, "0")}(void) { puts("REA_PAGE_${String(index).padStart(4, "0")}"); return ${index}; }`,
+      `__attribute__((noinline, used)) int rea_inventory_${String(index).padStart(4, "0")}(void) { puts("REA_INVENTORY_${String(index).padStart(4, "0")}"); return ${index}; }`,
   );
   return [
     "#include <stdio.h>",
     ...declarations,
-    "int main(void) { return rea_page_0000(); }",
+    "int main(void) { return rea_inventory_0000(); }",
     "",
   ].join("\n");
 };

scripts/lib/development-tests.d.mts

@@ -0,0 +1,21 @@
+export interface DevelopmentTestRequest {
+  readonly mode: "local" | "changed" | "focused";
+  readonly paths: readonly string[];
+  readonly base: string;
+  readonly dryRun: boolean;
+}
+
+/** Parse explicit test paths and an optional branch-comparison base. */
+export function parseDevelopmentTestRequest(
+  mode: string,
+  arguments_: readonly string[],
+): DevelopmentTestRequest;
+
+/** Plan source feedback or a strict explicit run with its build prerequisite. */
+export function developmentTestPlan(
+  request: DevelopmentTestRequest,
+  baseCommit?: string,
+): {
+  readonly needsBuild: boolean;
+  readonly vitestArguments: readonly string[];
+};

scripts/lib/development-tests.mjs

@@ -0,0 +1,76 @@
+const sourceProjects = [
+  "domain",
+  "services",
+  "adapters",
+  "composition",
+  "conformance",
+  "evaluation",
+];
+
+const sourceTest = (path) =>
+  path.startsWith("src/") ||
+  ["composition", "conformance", "evaluation"].some((project) =>
+    path.startsWith(`tests/${project}/`),
+  );
+
+/** Parse explicit test paths and an optional branch-comparison base. */
+export const parseDevelopmentTestRequest = (mode, arguments_) => {
+  if (!["local", "changed", "focused"].includes(mode))
+    throw new Error("Expected local, changed, or focused test mode");
+  const paths = [];
+  let base = "origin/main";
+  let dryRun = false;
+  for (let index = 0; index < arguments_.length; index += 1) {
+    const argument = arguments_[index];
+    if (argument === "--dry-run") dryRun = true;
+    else if (argument === "--base" || argument.startsWith("--base=")) {
+      if (mode !== "changed") throw new Error("--base requires changed mode");
+      base = argument === "--base" ? arguments_[++index] : argument.slice(7);
+      if (!base || base.startsWith("-") || base.includes("\0"))
+        throw new Error("--base requires a Git revision");
+    } else {
+      const path = argument.replaceAll("\\", "/").replace(/^\.\//u, "");
+      if (
+        !/^(?:src|tests)\/.+\.test\.ts$/u.test(path) ||
+        path.split("/").some((part) => part === ".." || part === ".")
+      )
+        throw new Error(`Expected an exact repository test path: ${argument}`);
+      if (mode !== "focused" && !sourceTest(path))
+        throw new Error(
+          `Use test:focused for compiled boundary tests: ${path}`,
+        );
+      paths.push(path);
+    }
+  }
+  if (mode === "focused" && paths.length === 0)
+    throw new Error("test:focused requires at least one exact test path");
+  if (mode === "changed" && paths.length > 0)
+    throw new Error("Use test:focused for explicit test paths");
+  return { mode, paths: [...new Set(paths)], base, dryRun };
+};
+
+/** Plan source feedback or a strict explicit run with its build prerequisite. */
+export const developmentTestPlan = (request, baseCommit) => {
+  const explicit = request.paths.length > 0;
+  if (
+    request.mode === "changed" &&
+    !/^[a-f0-9]{40,64}$/u.test(baseCommit ?? "")
+  )
+    throw new Error("Changed tests require a resolved Git merge base");
+  const projects = request.mode === "focused" ? [] : sourceProjects;
+  return {
+    needsBuild: request.paths.some((path) => !sourceTest(path)),
+    vitestArguments: [
+      "run",
+      ...projects.flatMap((project) => ["--project", project]),
+      ...(explicit
+        ? request.paths
+        : [
+            request.mode === "changed"
+              ? `--changed=${baseCommit}`
+              : "--changed",
+            "--passWithNoTests",
+          ]),
+    ],
+  };
+};