chore: add Cloud Agent environment install

Save the tested Node 24.18.0 install so Cloud Agents read it from the repository.
docs: note Cloud Agent Node.js toolchain
2026-10-07 09:07:46 +00:00 · 2026-10-07 03:36:23 +00:00 · 2026-10-07 11:28:28 +08:00 · 2026-10-07 11:23:37 +08:00 · 2026-10-07 11:22:03 +08:00 · 2026-10-07 11:20:26 +08:00
851 changed files with 46332 additions and 6471 deletions
@@ -0,0 +1,28 @@
+#!/usr/bin/env bash
+set -euo pipefail
+
+NODE_VERSION="24.18.0"
+NODE_SHA256="55aa7153f9d88f28d765fcdad5ae6945b5c0f98a36881703817e4c450fa76742"
+export PATH="/usr/local/bin:${PATH}"
+
+if [[ "$(/usr/local/bin/node -v 2>/dev/null || true)" != "v${NODE_VERSION}" ]]; then
+  tmp="$(mktemp -d)"
+  curl -fsSL -o "${tmp}/node.tar.xz" "https://nodejs.org/dist/v${NODE_VERSION}/node-v${NODE_VERSION}-linux-x64.tar.xz"
+  echo "${NODE_SHA256}  ${tmp}/node.tar.xz" | sha256sum -c -
+  sudo tar -xJf "${tmp}/node.tar.xz" -C /usr/local --strip-components=1
+  rm -rf "${tmp}"
+fi
+
+hash -r
+
+for cmd in node npm npx corepack; do
+  if [[ -x "/usr/local/bin/${cmd}" ]]; then
+    sudo ln -sfn "/usr/local/bin/${cmd}" "/usr/local/cargo/bin/${cmd}"
+  fi
+done
+
+if [[ -f "${HOME}/.bashrc" ]] && ! grep -qF '# rea-dev-node' "${HOME}/.bashrc"; then
+  printf '\n# rea-dev-node\nexport PATH="/usr/local/bin:$PATH"\n' >> "${HOME}/.bashrc"
+fi
+
+npm ci
@@ -0,0 +1,4 @@
+{
+  "name": "REA",
+  "install": "bash .cursor/cloud-agent-install.sh"
+}
@@ -77,6 +77,8 @@ jobs:
      - run: npm ci
      - if: github.event_name == 'push' || needs.changes.outputs.code == 'true'
        run: npm run check:ci
+      - if: github.event_name == 'push' || needs.changes.outputs.code == 'true'
+        run: npm run verify:test-discovery
      - if: github.event_name == 'pull_request' && needs.changes.outputs.code != 'true'
        run: npm run format:check

@@ -105,7 +107,7 @@ jobs:
        if: ${{ !cancelled() }}
        with:
          name: vitest-report-${{ strategy.job-index }}
-          path: .vitest-reports/*
+          path: .vitest/blob/*
          include-hidden-files: true
          if-no-files-found: error
          overwrite: true
@@ -157,7 +159,7 @@ jobs:
      - uses: actions/download-artifact@v4
        if: needs.changes.outputs.code == 'true' && success()
        with:
-          path: .vitest-reports
+          path: .vitest/blob
          pattern: vitest-report-*
          merge-multiple: true
      - name: Merge coverage, JUnit, and timing reports
@@ -215,9 +217,30 @@ jobs:
      - name: Verify fixtures from a clean checkout
        run: npm run verify:fixtures

+  windows-native-build:
+    name: Build bundled Windows x64 native controls
+    needs: changes
+    if: github.event_name == 'push' || needs.changes.outputs.package == 'true'
+    runs-on: ubuntu-latest
+    timeout-minutes: 10
+    steps:
+      - uses: actions/checkout@v4
+      - uses: actions/setup-node@v4
+        with:
+          node-version-file: .nvmrc
+      - name: Prepare cross compiler
+        run: sudo apt-get update && sudo apt-get install --no-install-recommends -y g++-mingw-w64-x86-64
+      - run: npm run build:windows-native
+      - run: npm run verify:windows-native:artifact
+      - uses: actions/upload-artifact@v4
+        with:
+          name: windows-native-controls
+          path: native/windows/build/
+          if-no-files-found: error
+
  package-e2e:
    name: Package/install integration (${{ matrix.os }})
-    needs: changes
+    needs: [changes, windows-native-build]
    if: github.event_name == 'push' || needs.changes.outputs.package == 'true'
    strategy:
      fail-fast: false
@@ -231,6 +254,11 @@ jobs:
          node-version-file: .nvmrc
          cache: npm
      - run: npm ci
+      - uses: actions/download-artifact@v4
+        with:
+          name: windows-native-controls
+          path: native/windows/build/
+      - run: npm run verify:windows-native:artifact
      - run: npm run verify:package

  apple-artifacts:
@@ -248,8 +276,12 @@ jobs:
      - run: npm ci
      - run: npm run verify:keyed-archive
      - run: npm run verify:asset-catalog
+      - name: Native compiled NIB hierarchy regressions
+        run: npm run test:focused -- src/application/NibNativeHierarchy.test.ts
      - name: Real binary metadata and Interface Builder integration
        run: npm run verify:apple-dispatch && npm run verify:interface-builder
+      - name: Native plist CLI selection regressions
+        run: npm run test:focused -- tests/boundary/cli/nativePlistCli.test.ts

  reconstruction-readiness:
    name: Reconstruction readiness
@@ -302,7 +334,7 @@ jobs:

  windows-curated:
    name: Windows capability and package lane
-    needs: changes
+    needs: [changes, windows-native-build]
    if: github.event_name == 'push' || needs.changes.outputs.package == 'true'
    runs-on: windows-latest
    timeout-minutes: 25
@@ -315,6 +347,11 @@ jobs:
      - run: npm ci
      - run: npm run build:cached
      - run: npm run typecheck
+      - uses: actions/download-artifact@v4
+        with:
+          name: windows-native-controls
+          path: native/windows/build/
+      - run: npm run verify:windows-native:artifact
      - name: Record named Windows host capabilities
        run: node scripts/windows-capabilities.mjs | Out-File -Encoding utf8NoBOM windows-capabilities.json
      - name: Validate Windows host capability report
@@ -327,18 +364,18 @@ jobs:
      # ignores unmatched paths, so a stale entry would otherwise report green
      # while skipping coverage.
      #
-      # Every path here must pass on windows-latest WITHOUT verified Windows
-      # native authority. src/ghidra/GhidraProvider.test.ts,
-      # src/ghidra/GhidraProvider.behavior.test.ts successors, and
-      # tests/boundary/process/providerProcess.test.ts are deliberately absent:
-      # they require Job Object process ownership and private-runtime DACL
-      # enforcement, which this runner does not provide by design. Those claims
-      # belong behind the same approval boundary as the real Ghidra Windows
-      # workflow, not in the default lane.
+      # The matching native artifact establishes real Job Object and private
+      # runtime boundaries for these fixtures. Ghidra and Java are not needed;
+      # real engine claims remain in the separate controlled-provider workflow.
      - name: Run curated Windows capability tests
        run: >-
          npx vitest run --coverage.enabled=false
          tests/boundary/filesystem/binaryTarget.test.ts
+          tests/boundary/filesystem/safeOutputTree.test.ts
+          tests/boundary/providers/native/artifactProvider.archiveSafety.test.ts
+          tests/boundary/filesystem/setupUnavailableProvider.test.ts
+          tests/boundary/cli/referenceSourceImportStatus.test.ts
+          src/cliReferenceSourceImportStatus.test.ts
          tests/boundary/filesystem/asarInventoryFreshness.test.ts
          tests/composition/javascript-applications/javascriptArtifactReconstruction.test.ts
          tests/conformance/providers/ghidra/windowsCapabilities.test.ts
@@ -347,6 +384,9 @@ jobs:
          tests/boundary/providers/ghidra/ghidraTransport.test.ts
          tests/boundary/providers/ghidra/ghidraTargetSnapshot.test.ts
          tests/boundary/providers/ghidra/ghidraLauncher.test.ts
+          src/windows/WindowsNativeLoader.test.ts
+          src/windows/WindowsOwnedProcess.test.ts
+          src/ghidra/GhidraLauncherEnvironment.test.ts
          src/process/ProcessOwnership.test.ts
          src/process/ProcessOwnership.part2.test.ts
          src/process/ProcessOwnership.part3.test.ts
@@ -354,6 +394,7 @@ jobs:
          src/application/Update.test.ts
          tests/process-global/updateMaintenance.test.ts
          tests/conformance/providers/ghidra/realGhidraWindowsWorkflow.test.ts
+      - run: npm run verify:windows-native
      - run: npm run verify:package:windows
      - uses: actions/upload-artifact@v4
        if: always()
@@ -374,9 +415,3 @@ jobs:
          cache: npm
      - run: npm ci
      - run: npm run docs:check
-      - run: npm run docs:api:cached
-      - uses: actions/upload-artifact@v4
-        with:
-          name: api-docs
-          path: build/api-docs
-          retention-days: 14
@@ -0,0 +1,44 @@
+name: Source-built NativeAOT fixtures
+
+on:
+  workflow_dispatch:
+  pull_request:
+    paths:
+      - "bridge/ghidra/extensions/nativeaot/**"
+      - "scripts/generate-nativeaot-fixtures.mjs"
+      - "tests/fixtures/nativeaot/**"
+      - ".github/workflows/nativeaot-fixtures.yml"
+
+permissions:
+  contents: read
+
+jobs:
+  windows-fixture:
+    name: Build Windows x64 NativeAOT fixture
+    # .NET 8.0.22's bundled linker discovery supports VS 2019/2022.
+    runs-on: windows-2022
+    timeout-minutes: 15
+    env:
+      DOTNET_CLI_TELEMETRY_OPTOUT: "1"
+      DOTNET_PROCESSOR_COUNT: "1"
+      COMPlus_GCHeapHardLimit: "30000000"
+    steps:
+      - uses: actions/checkout@v4
+      - uses: actions/setup-node@v4
+        with:
+          node-version-file: .nvmrc
+      - uses: actions/setup-dotnet@v4
+        with:
+          dotnet-version: "8.0.416"
+      - name: Build benign fixture and independent byte oracle
+        run: node scripts/generate-nativeaot-fixtures.mjs
+      - uses: actions/upload-artifact@v4
+        with:
+          name: nativeaot-win-x64-${{ github.event.pull_request.head.sha || github.sha }}
+          path: |
+            _reference/nativeaot-integration/generated/win-x64/symbols/NativeAotFixture.exe
+            _reference/nativeaot-integration/generated/win-x64/NativeAotFixture.map
+            _reference/nativeaot-integration/generated/win-x64/symbols.txt
+            _reference/nativeaot-integration/generated/win-x64/oracle.json
+          if-no-files-found: error
+          retention-days: 7
@@ -5,10 +5,20 @@ on:
    paths:
      - ".github/workflows/real-browser.yml"
      - "scripts/verify-real-browser.mjs"
+      - "scripts/verify-browser-network.mjs"
+      - "scripts/verify-browser-scripts.mjs"
+      - "scripts/lib/browser-*.mjs"
+      - "scripts/fixtures/browser-network-site.mjs"
+      - "scripts/fixtures/browser-script-site.mjs"
      - "scripts/fixtures/browser-verifier-site.mjs"
      - "scripts/fixtures/page-cdp-proxy.mjs"
      - "src/browser/**"
      - "src/domain/browser*.ts"
+      - "src/domain/webScript*.ts"
+      - "src/application/WebScriptExportService.ts"
+      - "src/contracts/webScriptToolContracts.ts"
+      - "src/server/registerWebScriptTool.ts"
+      - "src/cli/webScriptCommands.ts"
      - "package.json"
      - "package-lock.json"
  workflow_dispatch:
@@ -11,9 +11,29 @@ permissions:
  contents: read

 jobs:
+  native-artifact:
+    name: Build matching Windows native artifact
+    if: github.ref == 'refs/heads/main'
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+      - uses: actions/setup-node@v4
+        with:
+          node-version-file: .nvmrc
+      - name: Prepare cross compiler
+        run: sudo apt-get update && sudo apt-get install --no-install-recommends -y g++-mingw-w64-x86-64
+      - run: npm run build:windows-native
+      - run: npm run verify:windows-native:artifact
+      - uses: actions/upload-artifact@v4
+        with:
+          name: real-ghidra-windows-native
+          path: native/windows/build/
+          if-no-files-found: error
+
  verify:
    name: Real Ghidra 12.1.4 Windows x64 PE proof
    if: github.ref == 'refs/heads/main'
+    needs: native-artifact
    environment: real-ghidra-windows
    runs-on: [self-hosted, Windows, x64, ghidra-12-1-2]
    timeout-minutes: 20
@@ -23,13 +43,25 @@ jobs:
        with:
          node-version-file: .nvmrc
      - run: npm ci
+      - uses: actions/download-artifact@v4
+        with:
+          name: real-ghidra-windows-native
+          path: native/windows/build/
+      - run: npm run verify:windows-native:artifact
+      - run: npm run verify:windows-native
      - name: Verify all admitted Windows Ghidra operations
        env:
          REA_ANALYSIS_PROVIDER: ghidra
        run: npm run verify:ghidra:windows | Tee-Object -FilePath windows-ghidra-proof.log
+      - name: Verify ordinary-user CLI and MCP operations
+        env:
+          REA_ANALYSIS_PROVIDER: ghidra
+        run: npm run verify:ghidra:windows:package | Tee-Object -FilePath windows-ghidra-package-proof.log
      - uses: actions/upload-artifact@v4
        if: always()
        with:
          name: windows-ghidra-proof
-          path: windows-ghidra-proof.log
+          path: |
+            windows-ghidra-proof.log
+            windows-ghidra-package-proof.log
          retention-days: 30
@@ -108,6 +108,12 @@ jobs:

      - run: npm ci

+      - name: Prepare Windows native build toolchain
+        run: sudo apt-get update && sudo apt-get install --no-install-recommends -y g++-mingw-w64-x86-64
+
+      - name: Build and verify bundled Windows native controls
+        run: npm run build:windows-native && npm run verify:windows-native:artifact
+
      - name: Verify packaged release before publishing
        run: npm run verify:package

@@ -6,7 +6,6 @@ __pycache__/
 # Distribution
 dist/
 build/
-docs/api/
 node_modules
 *.egg-info/
 *.egg
@@ -0,0 +1,12 @@
+[submodule "third_party/jadx-headless-mcp"]
+	path = third_party/jadx-headless-mcp
+	url = https://github.com/1013503897/jadx-headless-mcp.git
+[submodule "third_party/binwalk"]
+	path = third_party/binwalk
+	url = https://github.com/ReFirmLabs/binwalk.git
+[submodule "third_party/unblob"]
+	path = third_party/unblob
+	url = https://github.com/onekey-sec/unblob.git
+[submodule "third_party/ghidra-nativeaot"]
+	path = third_party/ghidra-nativeaot
+	url = https://github.com/Washi1337/ghidra-nativeaot.git
@@ -1,6 +1,6 @@
 {
-  "_comment": "Test files are intentionally NOT excluded: the gate used to report zero clones because it skipped **/*.test.ts, hiding all test-tree duplication. Current actual is ~2.6% lines across src+ and tests/, down from 3.4% when tests were included. Lower this as duplication is removed.",
-  "threshold": 2.7,
+  "_comment": "Test files are intentionally NOT excluded: the gate used to report zero clones because it skipped **/*.test.ts, hiding all test-tree duplication. Current actual is ~2.4% lines across src+ and tests/, down from 3.4% when tests were included. Lower this as duplication is removed.",
+  "threshold": 2.5,
  "reporters": ["consoleFull"],
  "ignore": [
    "node_modules/**",
@@ -9,6 +9,7 @@
    ".codex/**",
    ".devin/**",
    "tests/fixtures/**",
+    "third_party/**",
    "tests/conformance/**/*.c",
    "tests/conformance/**/*.m",
    "tests/conformance/**/*.swift",
@@ -10,6 +10,7 @@
    "node_modules/**",
    "CHANGELOG.md",
    "package-lock.json",
-    "_reference/**"
+    "_reference/**",
+    "third_party/**"
  ]
 }
@@ -6,17 +6,34 @@
    "max-depth": ["warn", 4],
    "max-lines": [
      "warn",
-      { "max": 500, "skipBlankLines": true, "skipComments": true }
+      {
+        "max": 500,
+        "skipBlankLines": true,
+        "skipComments": true
+      }
    ],
    "max-lines-per-function": [
      "warn",
-      { "max": 100, "skipBlankLines": true, "skipComments": true }
+      {
+        "max": 100,
+        "skipBlankLines": true,
+        "skipComments": true
+      }
    ],
    "max-params": ["warn", 4],
    "no-var": "warn",
    "no-var-requires": "error"
  },
  "overrides": [
+    {
+      "files": [
+        "scripts/electron-active-hook*.cjs",
+        "tests/conformance/readiness/electron/*.js"
+      ],
+      "rules": {
+        "no-var-requires": "off"
+      }
+    },
    {
      "files": [
        "src/{contracts,domain,server}/**/*.ts",
@@ -29,8 +46,74 @@
          {
            "patterns": [
              {
-                "group": ["**/ghidra/**", "**/hopper/**"],
-                "message": "Deep-provider imports belong behind adapters or in the application composition root."
+                "group": [
+                  "**/ghidra/**",
+                  "**/hopper/**",
+                  "**/ida/**",
+                  "**/android/**",
+                  "**/firmware/**"
+                ],
+                "message": "Provider imports belong behind typed ports or in production composition."
+              }
+            ]
+          }
+        ]
+      }
+    },
+    {
+      "files": ["src/{contracts,domain}/**/*.ts"],
+      "rules": {
+        "no-restricted-imports": [
+          "error",
+          {
+            "patterns": [
+              {
+                "group": [
+                  "**/application/**",
+                  "**/server/**",
+                  "**/cli/**",
+                  "**/main/**",
+                  "**/cli.*",
+                  "**/main.*",
+                  "**/android/**",
+                  "**/artifacts/**",
+                  "**/browser/**",
+                  "**/dotnet/**",
+                  "**/firmware/**",
+                  "**/ghidra/**",
+                  "**/hopper/**",
+                  "**/ida/**",
+                  "**/native/**",
+                  "**/process/**",
+                  "**/reference/**",
+                  "**/windows/**",
+                  "**/composition/**"
+                ],
+                "message": "Domain and contracts depend inward; use typed ports for application, caller and provider boundaries."
+              }
+            ]
+          }
+        ]
+      }
+    },
+    {
+      "files": ["src/application/**/*.ts"],
+      "excludeFiles": ["src/application/runtime.ts"],
+      "rules": {
+        "no-restricted-imports": [
+          "error",
+          {
+            "patterns": [
+              {
+                "group": [
+                  "**/ghidra/**",
+                  "**/hopper/**",
+                  "**/ida/**",
+                  "**/android/**",
+                  "**/firmware/**",
+                  "**/composition/**"
+                ],
+                "message": "Application workflows use typed ports; production construction belongs in composition."
              }
            ]
          }
@@ -43,7 +126,11 @@
        "max-lines": "off",
        "max-lines-per-function": [
          "error",
-          { "max": 150, "skipBlankLines": true, "skipComments": true }
+          {
+            "max": 150,
+            "skipBlankLines": true,
+            "skipComments": true
+          }
        ]
      }
    },
@@ -62,9 +149,13 @@
                  "**/browser/**",
                  "**/ghidra/**",
                  "**/hopper/**",
+                  "**/ida/**",
                  "**/replay/**",
                  "**/cli.*",
-                  "**/main.*"
+                  "**/main.*",
+                  "**/composition/**",
+                  "**/android/**",
+                  "**/firmware/**"
                ],
                "message": "Domain tests may import only their owning domain and inward dependencies."
              }
@@ -120,5 +211,17 @@
    "node": true,
    "es2023": true
  },
-  "ignorePatterns": ["dist", "node_modules", "docs/api", ".codex", ".devin"]
+  "ignorePatterns": [
+    "dist",
+    "build",
+    "node_modules",
+    "docs/api",
+    "coverage",
+    ".turbo",
+    ".cache",
+    ".codex",
+    ".devin",
+    ".factory",
+    "third_party"
+  ]
 }
@@ -1,3 +1,3 @@
 {
-  ".": "4.0.1"
+  ".": "4.1.0"
 }
@@ -2,7 +2,7 @@

 ## Product Direction

-REA exposes reverse-engineering tools through a CLI and MCP server. Hopper and the bring-your-own Ghidra adapter are operation-capable deep binary-analysis providers. Ghidra is supported on Linux x64 and macOS x64/arm64 with matching native decompiler tools, and has an experimental Windows x64 P0 boundary for approved native x86-64 PE applications; it supplies admitted read-only inventory and function-analysis operations but no GUI or mutation authority. Keep provider-specific code out of the domain and application layers.
+REA exposes reverse-engineering tools through a CLI and MCP server. Hopper, the bring-your-own Ghidra adapter, and the bring-your-own IDA MCP adapter are operation-capable deep binary-analysis providers. Ghidra is supported on Linux x64 and macOS x64/arm64 with matching native decompiler tools, and has an experimental Windows x64 P0 boundary for approved native x86-64 PE applications; on Linux and macOS it supplies inventory, function analysis, and atomic function annotation edits in an ephemeral database, without modifying executable bytes or controlling a GUI. Windows P0 has no mutation authority. IDA adapts upstream legacy attached GUI and modern headless database-supervisor profiles for live read-only analysis; initial real verification covers Windows, and an attached GUI database is never saved or closed. Keep provider-specific code out of the domain and application layers.

 Prioritize:

@@ -20,7 +20,7 @@ REA is a local-only tool. Preserve caller-selected inputs, captured output, URLs
 REA is a layered ESM TypeScript application. Dependencies flow inward from pure domain logic through contracts, providers, application workflows, and CLI/MCP adapters. See [docs/architecture.mermaid](docs/architecture.mermaid) for the component map.

 - `src/domain/` owns pure provider-neutral semantics; `src/contracts/` owns caller-visible schemas and the canonical tool inventory.
- `src/hopper/`, `src/ghidra/`, `src/browser/`, `src/native/`, `src/artifacts/`, and `src/dotnet/` own provider-specific boundaries. Keep provider protocols out of domain and application code.
+- `src/hopper/`, `src/ghidra/`, `src/ida/`, `src/browser/`, `src/native/`, `src/artifacts/`, and `src/dotnet/` own provider-specific boundaries. Keep provider protocols out of domain and application code.
 - `src/application/` composes shared CLI/MCP workflows; `src/server/` translates MCP requests; `src/cli.ts` and `src/main.ts` are the CLI and MCP entry points.
 - `src/process/` owns shared process lifecycle primitives, not provider wire protocols. `bridge/` contains provider-side adapters.
 - `tests/` contains unit, composition, boundary, acceptance, and conformance tests. `scripts/verify-*` contains real-toolchain checks.
@@ -35,7 +35,7 @@ REA is a layered ESM TypeScript application. Dependencies flow inward from pure
 - `npm run check:changed`: run cached static checks and source tests affected since the branch merge base (default `origin/main`).
 - `npm run check:fast`: run cached typecheck and lint checks.
 - `npm run check:pr`: opt into the complete local deterministic gate and generated-document checks for broad changes; CI owns full coverage. Routine iterations need focused tests and relevant checks, not the whole gate each time.
- `npm run docs:check`: check committed generated documents; `npm run docs:api:cached` separately renders API HTML when needed.
+- `npm run docs:check`: check committed generated documents; `npm run docs:generate` regenerates them.
 - For provider-dependent changes, see [docs/testing.md](docs/testing.md) and run the matching real-provider verification.
 - Keep each verification lane's prerequisites limited to the claim it checks. Use host-native fixtures for host/provider acceptance; put optional cross-target formats and their external toolchains in a separate lane. Preflight required commands and report the missing dependency and lane clearly.

@@ -91,6 +91,23 @@ Name tests `*.test.ts`. Use Vitest and production seams (`tests/fixtures/`) rath

 Keep tool catalogs complete and self-describing; prefer capability- and session-scoped availability over schema truncation. Serialized bytes alone do not measure agent usability or model context cost.

+## Cursor Cloud specific instructions
+
+Development requires Node.js 24.18.0 and npm 11.16.0 (`.nvmrc` and `packageManager`). The Cloud Agent image places an older `node` on `PATH` ahead of a normal install. `.cursor/cloud-agent-install.sh` installs that toolchain under `/usr/local` and prepends `/usr/local/bin` for login shells. Confirm `node -v` is `v24.18.0` before installing dependencies.
+
+`npm ci` installs locked dependencies. `npm run build:cached` produces the CLI and MCP server. `npm run check:fast` is the pre-push typecheck and lint. Hopper, Ghidra, and IDA are optional bring-your-own providers. JavaScript analysis and the deterministic Vitest suites do not need them. `rea doctor` reports those engines as missing until they are configured.
+
 ## Commit & Pull Request Guidelines

 Use Conventional Commit subjects because Release Please derives versions and changelogs from them. Examples: `feat: add historical source import`, `fix(process): stop timers after exit`, and `docs: update architecture`. Use `!` or a `BREAKING CHANGE:` footer for breaking changes. Pull request titles must follow the same format because squash merges use the title as the release commit. Pull requests should describe contract or behavior changes, list verification commands, link issues, and include sanitized MCP examples when schemas change. State whether real Hopper/Ghidra verification was performed. Never commit binaries, Hopper or Ghidra project documents, credentials, `dist/`, `node_modules/`, or local planning artifacts (e.g. `.codex/`).
+
+<!-- BEGIN:turborepo-agent-rules -->
+
+# This is NOT the Turborepo you know
+
+Turborepo configuration, task behavior, and CLI commands can vary between installed versions and may differ from your training data. Resolve the `turbo` package from this file's directory or relevant workspace; in monorepos, it may not be visible from the repository root. For example, run `node -p "require.resolve('turbo/package.json')"` from a workspace that depends on `turbo`.
+
+Read `docs/README.md` inside that installed package first, then read the relevant pages from its `docs/` directory before changing Turborepo configuration or commands. Heed deprecation notices. These bundled docs match the installed package version and are available without network access.
+
+This block is written and re-added by `turbo` before repository-scoped commands when an AI agent is detected. In the Turborepo source repository, its template is defined in `crates/turborepo-cli/src/cli/agent_guidance.rs`. Removing the managed block while updates are enabled means a later qualifying invocation will add it again. Set `"agentGuidance": false` in the root `turbo.json` or `turbo.jsonc` to opt out; this does not remove an existing block. Keep the block committed with your work to avoid an uncommitted change on the next agent invocation.
+<!-- END:turborepo-agent-rules -->
@@ -1,5 +1,134 @@
 # Changelog

+## [4.1.0](https://github.com/morluto/rea/compare/rea-agents-4.0.1...rea-agents-4.1.0) (2026-10-06)
+
+
+### Features
+
+* **android:** integrate static APK analysis with headless JADX ([#738](https://github.com/morluto/rea/issues/738)) ([904d03e](https://github.com/morluto/rea/commit/904d03e987a6c498561b314a266202dee84b13ab))
+* **evidence:** accept exact retained application references ([#734](https://github.com/morluto/rea/issues/734)) ([d0f3480](https://github.com/morluto/rea/commit/d0f3480a3cb9887499c2b188c783dd1c4db09787))
+* **firmware:** integrate Binwalk and Unblob analysis ([5a7c769](https://github.com/morluto/rea/commit/5a7c769692c21efc4cc0e5ebf06a9f2534dc75ed))
+* **ghidra:** add atomic function annotation edits ([#709](https://github.com/morluto/rea/issues/709)) ([9bab553](https://github.com/morluto/rea/commit/9bab55337ab10616be6929afddb08fb19fbb8ab7))
+* **ghidra:** admit explicit DOS COM analysis ([#702](https://github.com/morluto/rea/issues/702)) ([5bcb664](https://github.com/morluto/rea/commit/5bcb6645b561e666b7e07dd8f38d2296fa7cbba8))
+* **ghidra:** enable Windows x64 read-only analysis ([#699](https://github.com/morluto/rea/issues/699)) ([26881da](https://github.com/morluto/rea/commit/26881da76aa320c8529fcc741df0fc9898d97bdc))
+* **ghidra:** integrate optional NativeAOT metadata recovery ([#748](https://github.com/morluto/rea/issues/748)) ([fb679b6](https://github.com/morluto/rea/commit/fb679b63c27e6c5f137532953cfa24a2ffb1aaf2))
+* **ghidra:** verify DOS load images and expose memory evidence ([#697](https://github.com/morluto/rea/issues/697)) ([a6a8f67](https://github.com/morluto/rea/commit/a6a8f67649cab558b0de11601e65425f280c7170))
+* **ida:** add read-only GUI and headless MCP providers ([#754](https://github.com/morluto/rea/issues/754)) ([8238232](https://github.com/morluto/rea/commit/82382324855a3a4ed51d2cdc3b2b455c9e8419e2))
+* **setup:** support Command Code MCP registration ([#645](https://github.com/morluto/rea/issues/645)) ([7f1ae42](https://github.com/morluto/rea/commit/7f1ae42f71ce85547d317eed5e62fa330d9876bb))
+
+
+### Bug Fixes
+
+* **android:** validate explicit Java runtime ([#742](https://github.com/morluto/rea/issues/742)) ([7390390](https://github.com/morluto/rea/commit/739039092f98c67e8e6ccfb1f8445e8f13ac8f15))
+* **artifacts:** make extraction output tree work on Windows ([#753](https://github.com/morluto/rea/issues/753)) ([c8e66c7](https://github.com/morluto/rea/commit/c8e66c704a70f5133922aa1bd1a3ba42959093ba))
+* **browser:** classify CSP host sources by their own origin ([#707](https://github.com/morluto/rea/issues/707)) ([1d15bcb](https://github.com/morluto/rea/commit/1d15bcb9ecd7efa487a8fd3f0d9755bd60051722))
+* **browser:** keep bare module locations unresolved ([#676](https://github.com/morluto/rea/issues/676)) ([8189081](https://github.com/morluto/rea/commit/8189081511441f0e3909b21b80c21c658ec9a453))
+* **ci:** upload Vitest blob reports from current path ([77799e6](https://github.com/morluto/rea/commit/77799e6c90ce36cd52e45b62c9cba2d46641c4cf))
+* **cli:** disable unmanaged skill synchronization ([433ebda](https://github.com/morluto/rea/commit/433ebda8b492f388faf6e6cac63ccc6f9c2d8d7e))
+* **cli:** disable unmanaged skill synchronization ([2c1bf92](https://github.com/morluto/rea/commit/2c1bf9201040ed3d60f475af9129b7bf85a508fa))
+* **cli:** fail when JSON input files cannot be parsed ([18c1829](https://github.com/morluto/rea/commit/18c18290d048b78a435f6864dfc778a9fea0af2e))
+* **cli:** fail when JSON input files cannot be parsed ([3201f05](https://github.com/morluto/rea/commit/3201f0538dc88e54bce00decf689bf9b5603bfd3))
+* **cli:** include build step in missing-runtime recovery ([6a37346](https://github.com/morluto/rea/commit/6a37346acb9829acaab0e2042624e6ea0d03e2a9))
+* **cli:** include build step in missing-runtime recovery ([ae72abd](https://github.com/morluto/rea/commit/ae72abd019b25347bfc7593b5dcadc5a2cbc3786))
+* **cli:** report reference-source import failures ([00eb03d](https://github.com/morluto/rea/commit/00eb03d0f2247da95dfa7bda0f41a0f366a25dd9))
+* **cli:** report reference-source import failures ([431e8eb](https://github.com/morluto/rea/commit/431e8ebfcfba2925904c0deb4888bbd3755b17bf))
+* **comparison:** break function collection collation ties ([c3d013b](https://github.com/morluto/rea/commit/c3d013b2fd5c3a32dfa73ef40dafdaeaf935f37e))
+* **comparison:** break function collection collation ties ([3aaf7e2](https://github.com/morluto/rea/commit/3aaf7e2c54029a456145d6e3287fd9122f3abbe3))
+* **comparison:** break JSON shape collation ties ([217e8cf](https://github.com/morluto/rea/commit/217e8cf59f49e2f68b394fbcbc87f914dbee97ee))
+* **comparison:** break JSON shape collation ties ([805c338](https://github.com/morluto/rea/commit/805c338f360184d73ae335a723fca656830d6328))
+* **comparison:** retain container-only export shape paths ([a55b5bb](https://github.com/morluto/rea/commit/a55b5bb8ee400ef5565954d57916e8aae7dac760))
+* **comparison:** retain container-only export shape paths ([7864d66](https://github.com/morluto/rea/commit/7864d665e15edec29ade0f3fb7ac374b8579c2c0))
+* **dotnet:** preserve leading Unicode content in metadata strings ([#667](https://github.com/morluto/rea/issues/667)) ([ddea063](https://github.com/morluto/rea/commit/ddea06360a09508a0ff695ab6e141eff19534619))
+* **electron:** respect computed option keys and overrides ([af48fe8](https://github.com/morluto/rea/commit/af48fe879161ee749692751b3e29ba06b63b7409))
+* **electron:** respect computed option keys and overrides ([98de338](https://github.com/morluto/rea/commit/98de3380e3062cb25778263bfea07b215a09b39c))
+* **evidence:** admit current process provider identity ([ab5a1c6](https://github.com/morluto/rea/commit/ab5a1c61b12475c554a5e4d60b48b642b2464bbb))
+* **evidence:** admit current process provider identity ([d311940](https://github.com/morluto/rea/commit/d311940f2414fe5cceb750de4464b681bb44ae1e))
+* **firmware:** validate configured executables ([#751](https://github.com/morluto/rea/issues/751)) ([9a4e6da](https://github.com/morluto/rea/commit/9a4e6da5a96ed2708a0f628b436dcd7415999327))
+* **ghidra:** preserve request and shutdown failure diagnostics ([#647](https://github.com/morluto/rea/issues/647)) ([19f8cdd](https://github.com/morluto/rea/commit/19f8cddfd6f283188567b8ff1e49b810d79952ee))
+* **ghidra:** refuse ambiguous universal Mach-O imports ([b1b687f](https://github.com/morluto/rea/commit/b1b687fb75325c0275a0cf161843fc5969ba1d47))
+* **ghidra:** refuse ambiguous universal Mach-O imports ([6582b24](https://github.com/morluto/rea/commit/6582b2433a955167e33246ad07de1a40bcb20144))
+* **hopper:** retain shutdown request diagnostics ([8d7071d](https://github.com/morluto/rea/commit/8d7071da4c61c5cfb4894be6536405affd90f276))
+* **hopper:** retain shutdown request diagnostics ([7254871](https://github.com/morluto/rea/commit/72548712fea972b920834663a5e2ceea4738ce1e))
+* integrate 14 approved fix PRs (668,671,673,675,678-681,685-690) ([#705](https://github.com/morluto/rea/issues/705)) ([cf06115](https://github.com/morluto/rea/commit/cf061159ab69a746675e48896fa953d6990c05f9))
+* **javascript:** count all source line terminators ([e60aa11](https://github.com/morluto/rea/commit/e60aa1110800e1309b482e7a44ecd1762bade992))
+* **javascript:** count all source line terminators ([03bc6d3](https://github.com/morluto/rea/commit/03bc6d36db94e70c709557cb7302d40af9e99e6b))
+* **javascript:** expose result schema failures ([6d1f39b](https://github.com/morluto/rea/commit/6d1f39b250f8a1c6f924b1a6b9d26d56dff4beee))
+* **javascript:** expose result schema failures ([99263a7](https://github.com/morluto/rea/commit/99263a720d7106aff059ad7fa43849151a94c963))
+* **javascript:** hash graph and evidence JSON incrementally ([#646](https://github.com/morluto/rea/issues/646)) ([9f42495](https://github.com/morluto/rea/commit/9f42495d11100adc8646de5c8b62762ab9715ae6))
+* **javascript:** preserve path.resolve reset semantics ([863ed47](https://github.com/morluto/rea/commit/863ed47de2e35ef9b734e45e3bb44ea9e9dc8ff6))
+* **javascript:** preserve path.resolve reset semantics ([4177377](https://github.com/morluto/rea/commit/417737748aa96ba38ced7b0b22dbb972187f2ee0))
+* **javascript:** preserve primitive addition coercion ([#666](https://github.com/morluto/rea/issues/666)) ([94cc847](https://github.com/morluto/rea/commit/94cc8475e0e9e24cd2e8345bd36a743a979e3620))
+* **javascript:** preserve unknown branches in primitive unions ([75a75cb](https://github.com/morluto/rea/commit/75a75cbb20aa9b2148f9fd0547f613eadda68edd))
+* **javascript:** preserve unknown branches in primitive unions ([9a2f395](https://github.com/morluto/rea/commit/9a2f3950286a01922be0b07b29c4aefee466ec1e))
+* **javascript:** read source-map directives only from comments ([#672](https://github.com/morluto/rea/issues/672)) ([7f1fa64](https://github.com/morluto/rea/commit/7f1fa64019e01a654ad0eb80b47d268a58f04e57))
+* **javascript:** scope candidate ambiguity to query traversal ([6ad62ce](https://github.com/morluto/rea/commit/6ad62cec6abf182a52cf9844145e147fb6399c8e))
+* **javascript:** scope candidate ambiguity to query traversal ([f94fc79](https://github.com/morluto/rea/commit/f94fc7967b2e5604c144d3638515caad6273a0c6))
+* **mcp:** retain shutdown failure diagnostics ([09c249d](https://github.com/morluto/rea/commit/09c249deb86068503611fc474e76018d5c2a4d0b))
+* **mcp:** retain shutdown failure diagnostics ([fd008cd](https://github.com/morluto/rea/commit/fd008cd8e0b8277e691efd8e69dc96ac8e188d9e))
+* **native:** inspect mixed-signature Mach-O slices ([1dccd0d](https://github.com/morluto/rea/commit/1dccd0dee04abfdc80e8b48e3f05fa39cccf0feb))
+* **native:** inspect mixed-signature Mach-O slices ([66f3cfa](https://github.com/morluto/rea/commit/66f3cfa594a86cbf1f21fc6d2eca1a82e236c896))
+* **native:** retain spaced symbols in dyld inventory ([#669](https://github.com/morluto/rea/issues/669)) ([fa02df9](https://github.com/morluto/rea/commit/fa02df9ad3bc3139ef10422dedffac88c4d51d36))
+* **native:** select concrete arm64e Mach-O slices ([f04445c](https://github.com/morluto/rea/commit/f04445c57c597a8312211139b75da706cb0c2a96))
+* **native:** select concrete arm64e Mach-O slices ([fd3282a](https://github.com/morluto/rea/commit/fd3282a87e40417cf3d7d6211743809f9bad2dc8))
+* **process:** honor disabled PID normalization in samples ([44b3627](https://github.com/morluto/rea/commit/44b3627ab0b32c42e545dd2fd095006d249a77f6))
+* **process:** honor disabled PID normalization in samples ([a4e5736](https://github.com/morluto/rea/commit/a4e57366dd75077bde07f25c7966204cedad929e))
+* **process:** scope comparison unknowns to their evidence ([#732](https://github.com/morluto/rea/issues/732)) ([9dd6cef](https://github.com/morluto/rea/commit/9dd6cef90abf89f9191bce942e31900870231968))
+* **reconstruction:** accept function comparison source parameters ([c3bc38b](https://github.com/morluto/rea/commit/c3bc38bf6c74d2175a4680530dcadd6cab0e7791))
+* **reconstruction:** accept function comparison source parameters ([7a96391](https://github.com/morluto/rea/commit/7a96391001780012f704f4ef5cb6597baa590b7d))
+* **reference:** bound Dockerfile language detection ([132a3a4](https://github.com/morluto/rea/commit/132a3a46be648b036ed36372a50d6e32a9e7f2e5))
+* **reference:** bound Dockerfile language detection ([53fa559](https://github.com/morluto/rea/commit/53fa55937f241fc9ef3091eb22314cc370c749b9))
+* **reference:** classify test suffixes before extensions ([e828acc](https://github.com/morluto/rea/commit/e828acce0e0bf3808773590cf2dbb0bc8227df7b))
+* **reference:** classify test suffixes before extensions ([8b228ae](https://github.com/morluto/rea/commit/8b228ae7010144b69a243c9682aeb0a1dc4249a3))
+* **reference:** distinguish computed require member names ([ba35b55](https://github.com/morluto/rea/commit/ba35b5509db60c18dd43e350e0dd4a0b5f229c69))
+* **reference:** distinguish computed require member names ([df6e476](https://github.com/morluto/rea/commit/df6e476d67b2719c4b998daa3e9ad8a4b157ace2))
+* **reference:** preserve unresolved absolute module specifiers ([#670](https://github.com/morluto/rea/issues/670)) ([c8aed47](https://github.com/morluto/rea/commit/c8aed4740d52b1eecaa93b3a527e8b3814dc88a4))
+* **reference:** read linked worktree commit provenance ([#677](https://github.com/morluto/rea/issues/677)) ([d565ecd](https://github.com/morluto/rea/commit/d565ecdc257514f5d0c5a412081e322fc66d4215))
+* **reference:** recognize CMake build manifests ([#665](https://github.com/morluto/rea/issues/665)) ([1a24be5](https://github.com/morluto/rea/commit/1a24be574d1860931ff8d4c8ec07f3968fff9fd5))
+* **reference:** retain dynamic import relationships ([a5d2986](https://github.com/morluto/rea/commit/a5d2986b1e517b71a1ed51be433c95e975eafe32))
+* **reference:** retain dynamic import relationships ([b89de8f](https://github.com/morluto/rea/commit/b89de8feab389477a468f0b89b8dfa35d7ddc102))
+* **reference:** retain recovered parser diagnostics ([11d0ef2](https://github.com/morluto/rea/commit/11d0ef2e09308ac06889865b3fcf356b8ffa647f))
+* **reference:** retain recovered parser diagnostics ([ed3a7f0](https://github.com/morluto/rea/commit/ed3a7f070cf0793e22b9a0bbfd1f2ebe9dabcfd0))
+* **setup:** accept leading BOM in JSON client configs ([a5b970c](https://github.com/morluto/rea/commit/a5b970c6bf6848145a82de51c001410aa4d50f6f))
+* **setup:** accept leading BOM in JSON client configs ([fe843ec](https://github.com/morluto/rea/commit/fe843ec0b101544e22d7599d93b36377d3e3bc34))
+* **setup:** align Node runtime checks with package engines ([5802ef8](https://github.com/morluto/rea/commit/5802ef8746412649bb641332f2fa7e69bb1a86a3))
+* **setup:** align Node runtime checks with package engines ([ea0b733](https://github.com/morluto/rea/commit/ea0b733687582d6cc28b42beaf2fc7a48be07b6a))
+* **target:** explain the JavaScript directory analysis route ([#733](https://github.com/morluto/rea/issues/733)) ([8d44b3e](https://github.com/morluto/rea/commit/8d44b3edd36b528c308e32328552ca386dc43e91))
+* **trace:** match typed seeds against member arrays ([65c8797](https://github.com/morluto/rea/commit/65c879757ea09fabc5fc036d6e3395fd2939995c))
+* **trace:** match typed seeds against member arrays ([38ebd54](https://github.com/morluto/rea/commit/38ebd54776d661ced2e6cc2c5e4b260653a086d9))
+
+
+### Code Refactoring
+
+* **app:** split Setup and ProcessOwnership modules ([#628](https://github.com/morluto/rea/issues/628)) ([3c84080](https://github.com/morluto/rea/commit/3c84080aab5e5aa6c9fc14bafa07c635b537b64d))
+* **cli:** collapse duplicate CLI layer into src/cli ([#630](https://github.com/morluto/rea/issues/630)) ([494d4db](https://github.com/morluto/rea/commit/494d4db6d9d519f9258a25504cf29b07d61fbb9f))
+* **contracts:** split tool contracts by family ([#634](https://github.com/morluto/rea/issues/634)) ([5295d56](https://github.com/morluto/rea/commit/5295d56b105074b290e0d881df43cd13e34a2f8b))
+* **domain:** consolidate canonical ordering and digest helpers ([#624](https://github.com/morluto/rea/issues/624)) ([ba3869c](https://github.com/morluto/rea/commit/ba3869c597133b63fdcc0077c558923ae2e17a3f))
+* **domain:** split error taxonomy into thematic modules ([#636](https://github.com/morluto/rea/issues/636)) ([735c100](https://github.com/morluto/rea/commit/735c10059ca161967d71ccf8fa3f62011d2a22ca))
+* **native:** extract FAT header format switch in Mach-O slice selection ([#632](https://github.com/morluto/rea/issues/632)) ([38b2933](https://github.com/morluto/rea/commit/38b293329ca06c424a58bb59a28728f19015ce22))
+* **runtime:** centralize safe JSON parsing and preserve error causes ([#629](https://github.com/morluto/rea/issues/629)) ([e7f54b3](https://github.com/morluto/rea/commit/e7f54b3310b7f45af11c1754e468d4d3804191db))
+* **runtime:** name all silent catch causes without changing diagnostics ([#637](https://github.com/morluto/rea/issues/637)) ([5f27e02](https://github.com/morluto/rea/commit/5f27e02fae670774667de3618c88ba2ab0e7b661))
+
+
+### Documentation
+
+* add the official Trendshift badge to README headers ([b6c21b1](https://github.com/morluto/rea/commit/b6c21b1db5d4ff4be0968aa26693916537622a06))
+* add the official Trendshift badge to README headers ([7d4ed59](https://github.com/morluto/rea/commit/7d4ed59816388409885310f40c12dfdcdd2d9246))
+* align MCP discovery and skill guidance with the stable catalog ([#664](https://github.com/morluto/rea/issues/664)) ([39db9fe](https://github.com/morluto/rea/commit/39db9fe4245cc8142f57f4feeadaff64cb894e31))
+* **browser:** add an interaction example that captures the visible result ([#750](https://github.com/morluto/rea/issues/750)) ([91daaa6](https://github.com/morluto/rea/commit/91daaa68aea3bbee02b837ac64d3ad13127d601e))
+* clarify onboarding and align provider guidance ([#745](https://github.com/morluto/rea/issues/745)) ([5af1699](https://github.com/morluto/rea/commit/5af169910391f6b95492865247fabf3c4735a9d6))
+* correct CLI examples and documentation checks ([#655](https://github.com/morluto/rea/issues/655)) ([fc80ea8](https://github.com/morluto/rea/commit/fc80ea88dfb7bde43e89db0f341c99d7b53c1a7c))
+* fix architecture diagram and pretty-print tool catalog ([#626](https://github.com/morluto/rea/issues/626)) ([5e7f35c](https://github.com/morluto/rea/commit/5e7f35c7c3ea8d504421a2623eafd1d73fea08a0))
+* **ghidra:** explain first-query deadlines and recovery ([#736](https://github.com/morluto/rea/issues/736)) ([e2c23f3](https://github.com/morluto/rea/commit/e2c23f3640f83c13587603c763dbd7b5ef1bbbb0))
+* **hopper:** document HopperTargetLease realpath fallback ([#711](https://github.com/morluto/rea/issues/711)) ([d3f498c](https://github.com/morluto/rea/commit/d3f498ceec65e4f61f39036ab943ace7ef1b9de5))
+* **installation:** pin manual MCP registration to the release version ([#658](https://github.com/morluto/rea/issues/658)) ([8dd1d84](https://github.com/morluto/rea/commit/8dd1d8447146b9962ec7ab2f245b0fe47d3ddf44))
+* update Trendshift repository badge ([3f6d6dc](https://github.com/morluto/rea/commit/3f6d6dc756d99ca6e7cdc1737522842fcbaee839))
+
+
+### Tests
+
+* extract shared fixtures, drop knip carve-outs ([#627](https://github.com/morluto/rea/issues/627)) ([55e5eb0](https://github.com/morluto/rea/commit/55e5eb090bb3d6cf347d7cc2f8f028b35b7461ba))
+* **hopper:** synchronize startup cancellation with launcher readiness ([#662](https://github.com/morluto/rea/issues/662)) ([88a3c3f](https://github.com/morluto/rea/commit/88a3c3f8a4bf5cb31f60bca4696431c4e4512b30))
+
 ## [4.0.1](https://github.com/morluto/rea/compare/rea-agents-4.0.0...rea-agents-4.0.1) (2026-10-05)


@@ -2,11 +2,15 @@

 REA welcomes focused bug fixes, documentation improvements, tests, and reverse-engineering workflow enhancements. Open an issue before a large contract or architecture change so its scope can be agreed before implementation.

+For capability organization and provider composition, follow the incremental
+[migration guide](docs/capability-migration.md). Run `npm run verify:test-discovery`
+after adding or moving tests.
+
 When adding or changing an MCP tool, follow the [tool design guide](docs/tool-design.md) and preserve the canonical contracts and generated catalog.

 ## Development setup

-REA development requires Node.js 24.18.x and npm 11.16.x. Real-Hopper verification additionally requires either macOS 12+ or an officially supported Linux host (Ubuntu 24.04+, Fedora 41+, or 64-bit Arch) and an installed Hopper application. Linux demo verification uses its own private Xvfb display and does not require a desktop session. Run `nvm use` before installing dependencies.
+REA development requires Node.js 24.18.x and npm 11.16.x (pinned toolchain via `nvm use`; the supported runtime range is Node.js ^22.19 || ^24.11 || >=26, as the README badge states). Real-Hopper verification additionally requires either macOS 12+ or an officially supported Linux host (Ubuntu 24.04+, Fedora 41+, or 64-bit Arch) and an installed Hopper application. Linux demo verification uses its own private Xvfb display and does not require a desktop session. Run `nvm use` before installing dependencies.

 ```bash
 npm ci
@@ -20,7 +24,7 @@ Turbo. Turbo caches deterministic builds and static checks across Git
 worktrees. After a package, lockfile, or managed-skill version change, run
 `npm run metadata:generate` before building.

-Keep dependencies flowing inward through the existing domain, contracts, provider, application, server, and adapter layers. Parse unknown values at process and protocol boundaries, model expected failures with `Result`, and preserve the canonical tool inventory defined by `TOOL_CONTRACTS` unless a deliberate contract change updates every verifier, generated catalog artifact, and snapshot. Prefer capability- and session-scoped tool advertisement over schema truncation.
+Keep dependencies flowing inward through the existing domain, contracts, provider, application, server, and adapter layers. Parse unknown values at process and protocol boundaries, model expected failures with `Result`, and preserve the canonical tool inventory defined by `TOOL_CONTRACTS` unless a deliberate contract change updates every verifier, generated catalog artifact, and snapshot. Keep tool discovery complete and report capability- and session-scoped availability through `binary_session`.

 ## Development feedback and PR verification

@@ -52,9 +56,8 @@ require the matching real-provider `verify:*` lane.
 Formatting uses Oxfmt and the committed `.oxfmtrc.json`; generated sources use
 the same configuration. Pre-commit formats and lints staged files; pre-push runs
 `check:fast`.
-`docs:check` checks committed generated metadata without rendering API HTML.
-`docs:generate` regenerates those files; render API HTML separately with
-`npm run docs:api:cached`. PR CI renders and uploads the `api-docs` artifact.
+`docs:check` checks committed generated metadata. `docs:generate` regenerates
+those files, and the docs CI lane checks them.
 Real-provider execution remains uncached; deterministic builds use Turbo.

 Local `npm test` runs every deterministic Vitest project without coverage or
@@ -101,7 +104,7 @@ Describe the behavior change and verification performed in the pull request. Nev

 ## Maintainer release checklist

-Run `npm run check:pr`, `npm run docs:api:cached`, the isolated package verifier, package dry run, and two-target real-Hopper verifier described above. Build a local tarball and exercise the executable through the package boundary:
+Run `npm run check:pr`, the isolated package verifier, package dry run, and two-target real-Hopper verifier described above. Build a local tarball and exercise the executable through the package boundary:

 ```bash
 npm pack
@@ -4,7 +4,7 @@

 # REA: Reverse Engineer Anything

-### Reverse engineer anything with agents, from app behavior down to native binaries.
+### One MCP for reverse engineering across binaries, applications, and runtime behavior.

 **See a feature you like. Understand how it works, down to the binary level.**

@@ -15,6 +15,8 @@
 [![MIT license](https://img.shields.io/badge/license-MIT-f4c430?style=flat-square)](LICENSE)
 [![Discord](https://img.shields.io/discord/1556595354999332884?logo=discord&logoColor=white&label=Discord&color=5865F2)](https://discord.gg/GkcryMnJDM)

+<a href="https://trendshift.io/repositories/82054?utm_source=repository-badge&amp;utm_medium=badge&amp;utm_campaign=badge-repository-82054" target="_blank" rel="noopener noreferrer"><img src="https://trendshift.io/api/badge/repositories/82054" alt="morluto%2Frea | Trendshift" width="250" height="55"/></a>
+
 [Quick start](#quick-start) · [Current status](#current-status) · [Investigation model](#the-investigation-model) · [Tool catalog](#tool-catalog-for-investigation) · [Roadmap](#roadmap) · [How it works](#how-it-works)

 <code>npx rea-agents setup</code>
@@ -47,7 +49,228 @@ See a feature in an app that you want in your own product? Ask your agent to inv

 REA connects your agent to tools for inspecting native binaries, JavaScript and Electron apps, .NET assemblies, and websites. You can also use the same tools from your terminal. Analysis runs locally, and results include the evidence and limitations behind each conclusion.

-Setup configures your agent and connects it to Hopper or Ghidra. If you need an analysis tool, setup can install Hopper for you.
+Setup registers REA with your agent and installs matching workflow instructions. Native analysis can use an existing Hopper or Ghidra installation; setup can optionally install Hopper with approval. Static JavaScript analysis needs neither engine.
+
+## Quick start
+
+### Run setup (recommended)
+
+Set up REA with your agent:
+
+```bash
+npx rea-agents setup
+```
+
+Choose which supported agents should use REA, then review the exact paths and changes before approving. Existing REA registrations are selected by default; newly detected agents are available to select, but detection alone does not select them. Setup adds MCP access and REA's guided workflow for selected agents. Hopper is a separate optional choice with its own consent. Setup can also record an existing Ghidra installation.
+
+Setup shows its changes before applying them and backs up existing configuration. See [Installation and setup](docs/installation.md) for requirements and setup options.
+
+### AI Coding Assistants (optional)
+
+Add the skill to your AI coding assistant for richer context:
+
+```bash
+npx skills add morluto/rea --skill reverse-engineer-anything
+```
+
+The skill provides REA's investigation workflow. Run setup above to connect REA to your agent and configure analysis tools. Setup already installs a version-matched skill by default; this command installs the repository version.
+
+### With an agent (recommended)
+
+After setup, restart your agent and [describe the app or feature](#just-ask-your-agent) you want to understand. Hopper can run in demo mode; if it shows a first-run prompt, choose the demo or enter an existing license.
+
+REA supports Claude Code, Claude Desktop, Codex, Cursor, Gemini CLI, Windsurf, Devin, OpenCode, Antigravity, GitHub Copilot CLI, Command Code, and VS Code. Existing REA registrations are selected by default during setup; other detected agents remain unselected until chosen. Other agents can use the [manual MCP configuration](#manual-mcp-configuration).
+
+### First result from the terminal
+
+For your extracted JavaScript/Electron application tree or ASAR, run:
+
+```bash
+npx -y rea-agents@latest analyze-javascript-application /absolute/path/to/app --json
+```
+
+Replace the path with your target (for example, `"D:/apps/example"` on Windows).
+This returns inline Evidence, recovered graph, limitations, and unknowns without
+MCP setup, Hopper, Ghidra, or executing the application. For a native app, configure
+its engine first, then use `analyze` with that app's path. Run `doctor` when you
+need diagnosis; it is not a prerequisite for each analysis.
+
+### Install the rea command
+
+Install the command-line interface:
+
+```bash
+curl -fsSL https://raw.githubusercontent.com/morluto/rea/main/install.sh | bash
+```
+
+The installer adds `rea` to your system and starts setup when run in a terminal. It requires Node.js and npm to be installed already.
+
+Alternatively, install with npm, then run setup:
+
+```bash
+npm install --global rea-agents
+rea setup
+```
+
+Update either installation with `rea update`.
+
+### Requirements
+
+Static JavaScript inspection requires the Node/npm runtime only. Host and
+external-tool prerequisites depend on the selected workflow; the native
+provider guides describe their supported platforms.
+
+- macOS 12 or newer
+- Ubuntu 24.04+, Fedora 41+, or 64-bit Arch Linux
+- Node.js 22.x (>=22.19), 24.x (>=24.11), or 26+
+- npm; REA does not require or install a particular npm version
+
+Deep native binary analysis requires [Hopper](https://www.hopperapp.com/), [Ghidra](#ghidra-analysis-provider), or [IDA Pro](#ida-pro-analysis-provider). Hopper is separate software with its own license; its demo supports analysis with vendor-defined limits. Ghidra and IDA are bring-your-own providers.
+
+Firmware region inspection and explicit extraction use caller-supplied Binwalk and Unblob on Linux. See [Firmware analysis](docs/firmware-analysis.md) for setup, provenance, resource limits and native handoff.
+
+Static APK analysis uses a separately supplied headless JADX JAR and Java, with no emulator or APK execution. See [Android analysis](docs/android-analysis.md) for setup, CLI/MCP operations, coverage and public test fixtures.
+
+Repository main and npm 4.1.0 include experimental Windows x64 Ghidra support for native x86-64 PE applications on local NTFS, with bundled Job Object, private-DACL, and path-admission controls. Check the [release boundary](docs/installation.md#released-package-and-main) before expecting this from an older npm package. See [Windows Ghidra P0](docs/windows-ghidra-p0.md) for prerequisites and verified scope.
+
+If something is not working, run:
+
+```bash
+npx -y rea-agents@latest doctor
+```
+
+`doctor` checks your host, dependencies, analysis tools, and agent configuration without changing them. Use `--json` for structured diagnostics.
+
+### Linux installation and troubleshooting
+
+On macOS, setup can install Hopper in `~/Applications` after approval. It verifies the official download and does not need Homebrew or administrator privileges.
+
+On supported Linux distributions, setup can install Hopper and its demo-session dependencies through your system package manager. You may see a system authorization prompt. Demo sessions use a private virtual display, leaving your desktop alone. See [Hopper installation](docs/installation.md#hopper) for download verification and platform details.
+
+The normal Linux launcher is `/opt/hopper/bin/Hopper`. If Hopper was installed elsewhere:
+
+```bash
+export HOPPER_LAUNCHER_PATH=/absolute/path/to/Hopper
+rea doctor --json
+```
+
+If doctor reports a missing analysis engine even though the file exists, inspect shared-library resolution with:
+
+```bash
+ldd /opt/hopper/bin/Hopper | grep 'not found'
+```
+
+Install the missing packages and rerun `rea setup`. The Linux demo needs Xvfb, Python 3, X11, and XTEST; approved setup installs these dependencies. If you use the curl installer, add `~/.local/bin` to your shell `PATH` when needed.
+
+REA defaults `HOPPER_LAUNCHER_PATH` to `/Applications/Hopper Disassembler.app/Contents/MacOS/hopper` on macOS and `/opt/hopper/bin/Hopper` on Linux. Explicit configuration always takes precedence.
+
+### Ghidra analysis provider
+
+Already use Ghidra? REA can connect it to your agent on Linux x64 or macOS x64/arm64. It requires **Ghidra 12.1.4** and a **64-bit JDK 21**. On macOS, your Ghidra installation must also include the native decompiler for your architecture.
+
+Set the installation paths, then run setup:
+
+```bash
+export GHIDRA_INSTALL_DIR=/absolute/path/to/ghidra_12.1.4_PUBLIC
+export JAVA_HOME=/absolute/path/to/jdk-21 # optional when java and javac resolve from PATH
+rea doctor --json
+rea setup
+rea providers --json
+```
+
+Setup checks the installations and saves their paths in your selected agents' configuration after approval. Ghidra and Java must already be installed; REA does not download or change them.
+
+The adapter exposes inventory, function, memory and load-image inspection, plus atomic function annotation edits on Linux and macOS. `annotate_native_function` edits names and entry comments in the session database and returns a refreshed function dossier; executable bytes stay unchanged. Ghidra does not provide GUI controls through REA.
+
+Opening a Ghidra target selects its provider; the first analysis query starts import and auto-analysis. That query can take longer than a client's default request deadline. See [first-query deadlines and recovery](docs/mcp-contracts.md#ghidra-first-query-deadlines-and-recovery) for an SDK example and cancellation recovery.
+
+REA analyzes a temporary copy of the target and removes the temporary project when the session closes. Results identify what Ghidra observed and what it could not resolve. Decompilation produces pseudocode rather than the original source.
+
+Ghidra also imports DOS MZ executables with an explicit 16-bit x86 real-mode profile. Function results include complete observed body ranges, distinguishing owned bytes from the enclosing span. See the [DOS analysis guide](docs/ghidra-dos.md) for addresses, packing, and verification boundaries.
+See [optional NativeAOT metadata recovery](docs/ghidra-nativeaot.md) for the pinned
+headless adapter, supported layout and existing native-tool workflow.
+
+Windows Ghidra P0 uses bundled native controls for its read-only native x86-64 PE boundary on local NTFS; see the [Windows Ghidra P0 guide](docs/windows-ghidra-p0.md). See [Ghidra installation](docs/installation.md#ghidra), [provider evaluation](docs/provider-evaluation.md), and [testing](docs/testing.md) for configuration details, coverage, and real-provider verification.
+
+To remove only REA-owned MCP registrations and the managed skill:
+
+```bash
+rea uninstall
+rea uninstall --purge-data # also removes only ~/.rea/cache and ~/.rea/state
+```
+
+Uninstall preserves Hopper, Node.js, Evidence files, captures, unrelated skills, and other MCP servers. It refuses malformed client configuration and never follows purge-data symlinks.
+
+### IDA Pro analysis provider
+
+Already have [mrexodia/ida-pro-mcp](https://github.com/mrexodia/ida-pro-mcp) working? REA can reuse its MCP registration for read-only analysis of the current GUI target, or use its database supervisor to open and analyze a supplied binary headlessly.
+
+```bash
+export REA_IDA_MCP_CONFIG=/absolute/path/to/ida-mcp.json
+rea function /absolute/path/to/program main --provider ida --json
+```
+
+The registration selects `attached` (default, legacy 1.4 tools) or `headless` (modern database supervisor). Setup can preserve this file reference in your selected agent's REA registration. REA adapts existing analysis contracts and manages its own headless database; it leaves an attached GUI database open and never saves it. Results stay live because external IDA database changes are not immutable snapshots.
+
+See the [IDA provider guide](docs/ida-provider.md) for upstream installation links, exact configuration examples, Windows-native headless operation, lifecycle cleanup, and coverage. The initial real workflows cover a Windows GUI and Windows x64 headless IDA 9.3; other engine/platform combinations remain unverified. Use a package version that includes this adapter; repository main can lead the npm release.
+
+### CLI or agent?
+
+| If you want to…                                                  | Use                                                                 |
+| ---------------------------------------------------------------- | ------------------------------------------------------------------- |
+| Ask an agent to investigate an app and build a feature           | Run setup, restart your agent, then describe the task               |
+| Inspect or decompile one part of an app from the Terminal        | `rea analyze` or `rea decompile`                                    |
+| Validate, canonicalize, or compare Evidence bundles              | `rea evidence-import`, `rea evidence-export`, or `rea compare`      |
+| Map a local JavaScript/Electron application without executing it | `rea analyze PATH` or `rea analyze-javascript-application`          |
+| Reuse immutable analysis results without relaunching a provider  | Pass `--snapshot /path/to/analysis.json` to a deep-analysis command |
+| Import source as historical reference                            | `rea import-reference-source`                                       |
+| Capture or compare controlled process behavior                   | `rea capture-process` or `rea compare-process-captures`             |
+
+```bash
+rea evidence-import /absolute/path/to/evidence/bundle.json
+rea evidence-export /absolute/path/to/evidence/bundle.json /absolute/path/to/evidence/canonical.json
+rea compare /absolute/path/to/evidence/left.json /absolute/path/to/evidence/right.json
+```
+
+Analyze a JavaScript application directory or ASAR without executing it:
+
+```bash
+rea analyze /absolute/path/to/releases/app.asar --json
+rea analyze-javascript-application /absolute/path/to/releases/app.asar --json
+```
+
+For a directory or `.asar`, generic `rea analyze` automatically selects the
+static JavaScript application provider when neither `--provider` nor
+`--snapshot` is supplied. Both routes return the analysis and its Evidence
+context inline.
+
+Import an older source tree as a reference. REA keeps it separate from observations of the current app:
+
+```bash
+rea import-reference-source /absolute/path/to/source
+```
+
+Historical-source import requires safe no-follow file opens and currently runs
+on Linux and macOS. Native Windows reports `unsupported_host`; run the import
+with Linux REA in WSL or on another supported host. Changing permissions or
+reinstalling REA does not enable this Windows workflow.
+
+Imports read the path supplied to the command. File names do not cause automatic omissions; files are represented by hashes and metadata. To exclude selected paths, set `REA_REFERENCE_SECRET_PATTERNS_JSON` to a JSON string array of ignore patterns. Exports never replace an existing file unless `--overwrite` is explicit.
+
+Use a snapshot to save successful analysis results and reuse them on later runs. REA reuses a result only when the target bytes, operation, parameters, analysis tool, and settings match. It does not cache changes or cursor-dependent calls. Snapshot files stay local and use owner-only permissions.
+
+```bash
+rea analyze /absolute/path/to/app --snapshot /absolute/path/to/analysis/app.json
+# The same exact query can be answered from that snapshot.
+rea analyze /absolute/path/to/app --snapshot /absolute/path/to/analysis/app.json
+```
+
+Exact CLI cached-evidence reads happen before any provider process starts. In MCP sessions,
+pass `snapshot_path` to `open_binary` to import a snapshot atomically while
+opening its matching target; MCP providers may still start before a cached call
+result is returned. Pass `snapshot_path` and, when required, `overwrite: true` to
+`close_binary` to save atomically before Hopper resources are released. If the
+save fails, REA deliberately leaves the session open.

 ## Just ask your agent

@@ -92,182 +315,6 @@ REA shows how it reached its conclusions. It does not claim to recover original
 | **Local by design**      | Analysis runs on your supported local host. REA does not upload the app to a hosted analysis service. |
 | **Keeps context**        | Investigate several apps without starting over for every question.                                    |

-## Quick start
-
-### Run setup (recommended)
-
-Set up REA with your agent:
-
-```bash
-npx rea-agents setup
-```
-
-Choose which supported agents should use REA, then review the exact paths and changes before approving. Existing REA registrations are selected by default; newly detected agents are available to select, but detection alone does not select them. Setup adds MCP access and REA's guided workflow for selected agents. Hopper is a separate optional choice with its own consent. Setup can also record an existing Ghidra installation.
-
-Setup shows its changes before applying them and backs up existing configuration. See [Installation and setup](docs/installation.md) for requirements and setup options.
-
-### With an agent (recommended)
-
-After setup, restart your agent and [describe the app or feature](#just-ask-your-agent) you want to understand. Hopper can run in demo mode; if it shows a first-run prompt, choose the demo or enter an existing license.
-
-REA supports Claude Code, Claude Desktop, Codex, Cursor, Gemini CLI, Windsurf, Devin, OpenCode, Antigravity, GitHub Copilot CLI, and VS Code. Existing REA registrations are selected by default during setup; other detected agents remain unselected until chosen. Other agents can use the [manual MCP configuration](#manual-mcp-configuration).
-
-### From the terminal with npx
-
-After setup, run:
-
-```bash
-npx -y rea-agents@latest doctor
-npx -y rea-agents@latest analyze /Applications/Notes.app
-```
-
-### Install the rea command
-
-Install the command-line interface:
-
-```bash
-curl -fsSL https://raw.githubusercontent.com/morluto/rea/main/install.sh | bash
-```
-
-The installer adds `rea` to your system and starts setup when run in a terminal. It requires Node.js and npm to be installed already.
-
-Alternatively, install with npm, then run setup:
-
-```bash
-npm install --global rea-agents
-rea setup
-```
-
-Update either installation with `rea update`.
-
-### Requirements
-
- macOS 12 or newer
- Ubuntu 24.04+, Fedora 41+, or 64-bit Arch Linux
- Node.js 22.19+ or 24.11+ (including newer releases)
- npm; REA does not require or install a particular npm version
-
-Native binary analysis requires [Hopper](https://www.hopperapp.com/) or [Ghidra](#ghidra-read-only-analysis-provider). Hopper is separate software with its own license; its demo supports analysis with vendor-defined limits. REA can use Ghidra that you have already installed.
-
-Windows Ghidra support is experimental and currently unavailable. The required Windows process ownership, private-directory permissions, and safe-path checks are not implemented. See [Windows Ghidra P0](docs/windows-ghidra-p0.md) for the remaining requirements.
-
-If something is not working, run:
-
-```bash
-npx -y rea-agents@latest doctor
-```
-
-`doctor` checks your host, dependencies, analysis tools, and agent configuration without changing them. Use `--json` for structured diagnostics.
-
-### Linux installation and troubleshooting
-
-On macOS, setup can install Hopper in `~/Applications` after approval. It verifies the official download and does not need Homebrew or administrator privileges.
-
-On supported Linux distributions, setup can install Hopper and its demo-session dependencies through your system package manager. You may see a system authorization prompt. Demo sessions use a private virtual display, leaving your desktop alone. See [Hopper installation](docs/installation.md#hopper) for download verification and platform details.
-
-The normal Linux launcher is `/opt/hopper/bin/Hopper`. If Hopper was installed elsewhere:
-
-```bash
-export HOPPER_LAUNCHER_PATH=/absolute/path/to/Hopper
-rea doctor --json
-```
-
-If doctor reports a missing analysis engine even though the file exists, inspect shared-library resolution with:
-
-```bash
-ldd /opt/hopper/bin/Hopper | grep 'not found'
-```
-
-Install the missing packages and rerun `rea setup`. The Linux demo needs Xvfb, Python 3, X11, and XTEST; approved setup installs these dependencies. If you use the curl installer, add `~/.local/bin` to your shell `PATH` when needed.
-
-REA defaults `HOPPER_LAUNCHER_PATH` to `/Applications/Hopper Disassembler.app/Contents/MacOS/hopper` on macOS and `/opt/hopper/bin/Hopper` on Linux. Explicit configuration always takes precedence.
-
-### Ghidra read-only analysis provider
-
-Already use Ghidra? REA can connect it to your agent on Linux x64 or macOS x64/arm64. It requires **Ghidra 12.1.4** and a **64-bit JDK 21**. On macOS, your Ghidra installation must also include the native decompiler for your architecture.
-
-Set the installation paths, then run setup:
-
-```bash
-export GHIDRA_INSTALL_DIR=/absolute/path/to/ghidra_12.1.4_PUBLIC
-export JAVA_HOME=/absolute/path/to/jdk-21 # optional when java and javac resolve from PATH
-rea doctor --json
-rea setup
-rea providers --json
-```
-
-Setup checks the installations and saves their paths in your selected agents' configuration after approval. Ghidra and Java must already be installed; REA does not download or change them.
-
-The adapter exposes **22 read-only operations** for functions, strings, symbols, assembly, decompilation, calls, references, instructions, and data types. These also support REA's overview, search, call-graph, and function-analysis workflows. Ghidra does not provide GUI controls or annotation changes through REA.
-
-REA analyzes a temporary copy of the target and removes the temporary project when the session closes. Results identify what Ghidra observed and what it could not resolve. Decompilation produces pseudocode rather than the original source.
-
-Ghidra also imports DOS MZ executables with an explicit 16-bit x86 real-mode profile. Function results include complete observed body ranges, distinguishing owned bytes from the enclosing span. See the [DOS analysis guide](docs/ghidra-dos.md) for addresses, packing, and verification boundaries.
-
-Windows operations remain unavailable pending the controls described in the [Windows Ghidra P0 guide](docs/windows-ghidra-p0.md). See [Ghidra installation](docs/installation.md#ghidra), [provider evaluation](docs/provider-evaluation.md), and [testing](docs/testing.md) for configuration details, coverage, and real-provider verification.
-
-To remove only REA-owned MCP registrations and the managed skill:
-
-```bash
-rea uninstall
-rea uninstall --purge-data # also removes only ~/.rea/cache and ~/.rea/state
-```
-
-Uninstall preserves Hopper, Node.js, Evidence files, captures, unrelated skills, and other MCP servers. It refuses malformed client configuration and never follows purge-data symlinks.
-
-### CLI or agent?
-
-| If you want to…                                                  | Use                                                                 |
-| ---------------------------------------------------------------- | ------------------------------------------------------------------- |
-| Ask an agent to investigate an app and build a feature           | Run setup, restart your agent, then describe the task               |
-| Inspect or decompile one part of an app from the Terminal        | `rea analyze` or `rea decompile`                                    |
-| Validate, canonicalize, or compare Evidence bundles              | `rea evidence-import`, `rea evidence-export`, or `rea compare`      |
-| Map a local JavaScript/Electron application without executing it | `rea analyze PATH` or `rea analyze-javascript-application`          |
-| Reuse immutable analysis results without relaunching a provider  | Pass `--snapshot /path/to/analysis.json` to a deep-analysis command |
-| Import source as historical reference                            | `rea import-reference-source`                                       |
-| Capture or compare controlled process behavior                   | `rea capture-process` or `rea compare-process-captures`             |
-
-```bash
-rea evidence-import /absolute/path/to/evidence/bundle.json
-rea evidence-export /absolute/path/to/evidence/bundle.json /absolute/path/to/evidence/canonical.json
-rea compare /absolute/path/to/evidence/left.json /absolute/path/to/evidence/right.json
-```
-
-Analyze a JavaScript application directory or ASAR without executing it:
-
-```bash
-rea analyze /absolute/path/to/releases/app.asar --json
-rea analyze-javascript-application /absolute/path/to/releases/app.asar --json
-```
-
-For a directory or `.asar`, generic `rea analyze` automatically selects the
-static JavaScript application provider when neither `--provider` nor
-`--snapshot` is supplied. Both routes return the analysis and its Evidence
-context inline.
-
-Import an older source tree as a reference. REA keeps it separate from observations of the current app:
-
-```bash
-rea import-reference-source /absolute/path/to/source
-```
-
-Imports read the path supplied to the command. File names do not cause automatic omissions; files are represented by hashes and metadata. To exclude selected paths, set `REA_REFERENCE_SECRET_PATTERNS_JSON` to a JSON string array of ignore patterns. Exports never replace an existing file unless `--overwrite` is explicit.
-
-Use a snapshot to save successful analysis results and reuse them on later runs. REA reuses a result only when the target bytes, operation, parameters, analysis tool, and settings match. It does not cache changes or cursor-dependent calls. Snapshot files stay local and use owner-only permissions.
-
-```bash
-rea analyze /absolute/path/to/app --snapshot /absolute/path/to/analysis/app.json
-# The same exact query can be answered from that snapshot.
-rea analyze /absolute/path/to/app --snapshot /absolute/path/to/analysis/app.json
-```
-
-Exact CLI cached-evidence reads happen before any provider process starts. In MCP sessions,
-pass `snapshot_path` to `open_binary` to import a snapshot atomically while
-opening its matching target; MCP providers may still start before a cached call
-result is returned. Pass `snapshot_path` and, when required, `overwrite: true` to
-`close_binary` to save atomically before Hopper resources are released. If the
-save fails, REA deliberately leaves the session open.
-
 ## One prompt, a full investigation

 ```text
@@ -303,29 +350,40 @@ See [native investigation](docs/native-investigation.md) for keyed archives, ins

 ## Tool catalog for investigation

-| Tool family               | Count | Examples                                                                                                                                                  |
-| ------------------------- | ----: | --------------------------------------------------------------------------------------------------------------------------------------------------------- |
-| Native inspection         |    39 | functions, pseudocode, assembly, strings, symbols, calls, references, annotations, byte reads, and file offsets                                           |
-| Investigation workflows   |    14 | app overviews, function dossiers, native APIs and dispatch, batch decompilation, feature traces, call paths, call graphs, Swift and Objective-C discovery |
-| Native macOS utilities    |     7 | Mach-O metadata, code signatures, plists, architectures, and Swift demangling without launching Hopper                                                    |
-| Artifact graph            |     5 | directory and package inventories, compiled Interface Builder files, Apple asset catalogs, and extraction                                                 |
-| Managed PE/CLI            |     7 | .NET identity, metadata, CIL instructions, native dependencies, reconstruction imports, and build comparisons                                             |
-| Browser observation       |     9 | page structure, network metadata, scripts, source maps, WebMCP discovery, screenshots, and capture comparisons                                            |
-| Electron analysis         |     5 | renderer observation, static app mapping, and static/runtime reconciliation                                                                               |
-| JavaScript runtime        |     2 | Node/Electron Inspector target discovery, script locations, and execution-context events                                                                  |
-| Application workflows     |     7 | cross-layer feature traces, build comparisons, historical source mapping, static return-shape comparison, and reconstruction checks                       |
-| Workspace and observation |    21 | sessions, evidence bundles, navigation context, process/artifact/function comparisons, and open-question tracking                                         |
+| Tool family               | Count | Examples                                                                                                                                                            |
+| ------------------------- | ----: | ------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
+| Native inspection         |    41 | functions, pseudocode, assembly, strings, symbols, calls, references, annotations, byte reads, and file offsets                                                     |
+| Investigation workflows   |    14 | app overviews, function dossiers, native APIs and dispatch, batch decompilation, feature traces, call paths, call graphs, Swift and Objective-C discovery           |
+| Native macOS utilities    |     7 | Mach-O metadata, code signatures, plists, architectures, and Swift demangling without launching Hopper                                                              |
+| Artifact graph            |     5 | directory and package inventories, compiled Interface Builder files, Apple asset catalogs, and extraction                                                           |
+| Managed PE/CLI            |     7 | .NET identity, metadata, CIL instructions, native dependencies, reconstruction imports, and build comparisons                                                       |
+| Firmware                  |     2 | Linux firmware region inspection and explicit extraction                                                                                                            |
+| Android APK               |     5 | package and manifest declarations, class search, member inventories, method decompilation, and incoming static references                                           |
+| Browser observation       |     9 | page structure, network metadata, scripts, source maps, WebMCP discovery, screenshots, and capture comparisons                                                      |
+| Electron analysis         |     5 | renderer observation, static app mapping, and static/runtime reconciliation                                                                                         |
+| JavaScript runtime        |     2 | Node/Electron Inspector target discovery, script locations, and execution-context events                                                                            |
+| Application workflows     |     8 | captured website script export; cross-layer feature traces, build comparisons, historical source mapping, static return-shape comparison, and reconstruction checks |
+| Workspace and observation |    21 | sessions, evidence bundles, navigation context, process/artifact/function comparisons, and open-question tracking                                                   |

 The public interface describes what the agent is trying to learn. Providers decide how to answer. macOS utilities handle common semantic inspection without launching Hopper; Hopper handles deeper native analysis; the process harness records direct behavioral captures.

 ## Current status

-REA supports native application, JavaScript, Electron, .NET, and browser investigation on macOS and Linux. Individual tools have platform and runtime prerequisites; use `rea capabilities` to check what is available on your host.
+REA supports native application, JavaScript, Electron, .NET, and browser investigation on macOS and Linux. Individual tools have platform and runtime prerequisites. `rea capabilities` and `rea providers` describe the binary-session providers and auxiliary operations; they are not an inventory of every browser, Android, or application workflow. Use the connected MCP tool list and `binary_session` tool availability for the full MCP surface, and the relevant guide for each tool's prerequisites. Repository main can be ahead of [the npm release](docs/installation.md#released-package-and-main).

- **Native binaries:** Open Mach-O, ELF, PE, and Mac `.app` targets through Hopper or Ghidra. Inspect functions, strings, assembly, decompilation, calls, and references. Hopper also accepts `.hop` databases and supports annotations.
+Static Android APK inspection is verified on Linux with headless JADX; see [Android analysis](docs/android-analysis.md) for its separate prerequisites and coverage.
+
+- **Native binaries:** Open Mach-O, ELF, PE, and Mac `.app` targets through a selected deep provider. Hopper and Ghidra cover broad inventory and function analysis; the IDA adapter supplies its documented read-only function/string operations. Hopper also accepts `.hop` databases and supports annotations.
 - **Packages and resources:** Inspect directories, ZIP, APK, IPA, ASAR, plists, compiled Interface Builder files, and Apple asset catalogs. Artifact requests name the input and requested extraction or traversal directly; macOS DMG traversal also requires the host's native mounting support.
 - **JavaScript and Electron:** Map modules, imports, source maps, routes, IPC channels, storage, and native add-ons without running the app. Compare builds and trace a feature across the recovered graph. Dynamic and ambiguous relationships remain unresolved. See [JavaScript application workflows](docs/javascript-application-workflows.md).
 - **Websites:** Inspect a selected page in an existing Chrome-family browser. Capture page structure, network metadata, script evidence, and screenshots requested by the call. Passive observation does not navigate or execute page JavaScript. See [browser observation](docs/browser-observation.md).
+
+  Export retained scripts with `export_web_scripts` / `rea export-web-scripts`
+  into a verified local directory, then use the existing JavaScript analysis
+  and tracing tools. Source URLs, frame or transaction references, competing
+  versions, and missing-source states remain inline. See
+  [captured website scripts](docs/website-script-export.md).
+
 - **Electron and Node runtime observation:** Inspect selected Electron pages or attach to a Node/Electron V8 Inspector target. Inspector observation records script locations and execution-context events; it does not infer imports, IPC activity, or which modules executed. See [runtime observation](docs/javascript-runtime-observation.md).
 - **.NET assemblies:** Inspect metadata and CIL instructions, compare builds, and check declared native dependencies without loading or running the assembly. Imported decompiler output is labeled as analyst inference. See [managed-code analysis](docs/managed-code-analysis.md).
 - **Controlled behavior capture:** Run process, browser, or Electron scenarios with the target, actions, and lifecycle declared in each request, then compare the resulting evidence. Missing observations cannot establish that two runs behaved the same way.
@@ -333,7 +391,7 @@ REA supports native application, JavaScript, Electron, .NET, and browser investi
 - **Open questions:** Track unresolved findings, contradictions, and follow-up probes. Reconstruction checks report pass, fail, or unknown rather than treating missing evidence as a pass.
 - **Guided workflows:** Start six [MCP investigation workflows](docs/mcp-prompts.md) with suggestions based on your current session.

-Windows Ghidra operations are currently unavailable. Hopper-only features, such as GUI controls and annotations, are not available through Ghidra.
+Windows x64 Ghidra P0 supports native, non-managed, non-DLL x86-64 PE applications on fixed local NTFS with 25 read-only operations. Linux/macOS Ghidra additionally supports atomic session-scoped function names and entry comments. Ghidra has no GUI controls; Windows P0 has no mutation authority.

 ### Website observation with CDP

@@ -363,8 +421,12 @@ the launched browser. Connect mode accepts one exact loopback CDP target and
 disconnects without closing the external browser. The request supplies the
 selected executable or endpoint, actions, and any origin or environment
 selections needed by the scenario. Scenario JSON contains secret references and
-environment-variable names, never secret values. See the
-[browser scenario contract](docs/browser-scenario-contract.md).
+environment-variable names, never secret values. The default capture retains
+only the final URL; request `dom`, `accessibility`, or `screenshot` when an
+interaction changes the page without navigating. For asynchronous updates,
+wait for a page-specific result-ready condition before capture. See the
+[browser scenario contract](docs/browser-scenario-contract.md), including its
+interaction example.

 ### Node and Electron V8 Inspector observation

@@ -382,7 +444,7 @@ relationships, event activity, IPC, process identity, or Electron roles. See
 [Node and Electron runtime observation](docs/javascript-runtime-observation.md)
 for the exact coverage.

-Exact package, tool-family, provider, setup-client, schema, and CLI facts are generated from source in [`docs/product-catalog.json`](docs/product-catalog.json). PR CI verifies this catalog, narrative documentation, generated schemas, and a clean TypeDoc render.
+Exact package, tool-family, provider, setup-client, schema, and CLI facts are generated from source in [`docs/product-catalog.json`](docs/product-catalog.json). PR CI verifies this catalog, narrative documentation, and generated schemas.

 ## Roadmap

@@ -403,7 +465,7 @@ The [current status](#current-status) section describes shipped capabilities. Th

 1. **Expand browser and Electron interaction:** add scenario actions beyond the current click and wait operations.
 2. **Observe native apps at runtime:** explore LLDB, Frida, system logs, and native API tracing.
-3. **Evaluate more tools and targets:** assess IDA/Hex-Rays, Binary Ninja, Rizin, LIEF, Windows-native tools, mobile apps, and firmware.
+3. **Evaluate more tools and targets:** assess Binary Ninja, Rizin, LIEF, Windows-native tools, mobile apps, and firmware. IDA support already ships via the bring-your-own upstream adapter; see the [IDA provider guide](docs/ida-provider.md).

 Setup already lets you choose agent integration and Hopper installation. Support for installing additional analysis tools is future work, described in the [installation roadmap](docs/roadmap.md).

@@ -422,7 +484,7 @@ Setup offers supported agent integrations for selection. Existing REA registrati
  "mcpServers": {
    "rea": {
      "command": "npx",
-      "args": ["-y", "rea-agents@4.0.1", "mcp"]
+      "args": ["-y", "rea-agents@4.1.0", "mcp"]
    }
  }
 }
@@ -451,12 +513,19 @@ flowchart LR
    REA --> Session["Target-bound session router"]
    Session --> Registry["Deep-provider registry<br/>deterministic selection"]
    Registry --> Hopper["Hopper provider"]
-    Registry --> Ghidra["Ghidra provider<br/>read-only inventory + function analysis"]
+    Registry --> Ghidra["Ghidra provider<br/>inventory + function analysis + annotations"]
+    Registry --> Ida["IDA MCP provider<br/>attached GUI or owned headless database"]
    Hopper --> Runtime["Owned provider runtime<br/>deadline + bounded diagnostics + cleanup"]
    Ghidra --> Runtime
+    Ida --> IdaRuntime["Upstream MCP lifecycle<br/>live observations + owned database cleanup"]
+    IdaRuntime --> Target
    Session --> Native["Native macOS provider"]
    Session --> Artifact["Artifact graph provider"]
    REA --> Browser["Browser CDP provider"]
+    REA --> Android["Android static provider<br/>headless JADX adapter"]
+    Android --> Runtime
+    REA --> Firmware["Firmware providers<br/>Binwalk / Unblob adapters"]
+    Firmware --> Runtime
    REA --> Process["Process capture provider"]
    Runtime --> Target["Target software"]
    Process --> Target
@@ -516,11 +585,11 @@ For MCP, pass the optional selector on `open_binary`:
 }
 ```

-Use `--provider`, or `provider_id` in MCP, to choose Hopper or Ghidra for a target. This choice overrides `REA_ANALYSIS_PROVIDER`.
+Use `--provider`, or `provider_id` in MCP, to choose Hopper, Ghidra, or IDA for a target. This choice overrides `REA_ANALYSIS_PROVIDER`.

 With `auto`, REA selects the only available tool that supports the target. If both are available, specify one before opening the target. The session keeps that choice until you explicitly switch or close it; a failure never silently switches tools. Artifact-only analysis can work without a native analysis tool.

-Run `rea providers` and `rea capabilities` to check availability and supported operations. Ghidra exposes 22 read-only operations on supported Linux and macOS hosts. GUI controls and annotation changes require Hopper. Windows Ghidra operations remain unavailable.
+Run `rea providers` and `rea capabilities` to check availability and supported operations. Ghidra supports inspection and atomic function annotation edits on Linux and macOS. Its database edits are discarded on close; GUI controls require Hopper. Windows Ghidra P0 supports read-only analysis of native x86-64 PE applications on local NTFS with bundled native controls.

 The session also reports active work and cleanup status. If a caller times out, the analysis tool may still be busy; `analysis_activity` reports that state. A `cleanup_incomplete` result identifies resources whose shutdown or removal could not be verified. See [provider selection and analysis profiles](docs/adr/0001-provider-selection-and-analysis-profiles.md) for session, cache, and process-tracking details.

@@ -532,7 +601,9 @@ The session also reports active work and cleanup status. If a caller times out,
 | `1`       | The operation could not complete, for example because of invalid input, host permission denial, cancellation, or timeout. Structured output reports the reason when available. |
 | `128 + N` | The process ended from signal `N`, where the shell or runtime preserves the conventional signal-derived status.                                                                |

-`setup` returns `1` for `planned`, `needs_confirmation`, or `needs_human`
+`setup --dry-run` returns status `planned` and exits `0`. A setup result with
+status `cancelled` also exits `0`.
+`setup` returns `1` for `needs_confirmation` or `needs_human`
 because configuration is not ready; rerun it after approval or remediation.
 `doctor` returns `1` when required checks for its readiness scope are unhealthy.
 Unavailable optional provider prerequisites remain visible as informational
@@ -544,7 +615,7 @@ cannot hide its failure:

 ```bash
 set -o pipefail
-rea inventory-artifact ./app.asar --json | jq . > inventory.json
+rea inspect-artifact ./app.asar --json | jq . > inspection.json
 ```

 ## Current Hopper provider
@@ -567,9 +638,9 @@ Process Capture records behavior and is not a security sandbox.
 Capture a scenario or compare two saved Process Capture Evidence records:

 ```bash
-rea capture-process ./scenario.json > authority.json
-rea capture-process ./reconstruction.json > reconstruction.json
-rea compare-process-captures authority.json reconstruction.json
+rea capture-process ./authority-scenario.json --json > authority-capture.json
+rea capture-process ./reconstruction-scenario.json --json > reconstruction-capture.json
+rea compare-process-captures authority-capture.json reconstruction-capture.json --json
 ```

 The comparison reports each observed dimension separately and identifies the
@@ -577,9 +648,16 @@ first terminal, interaction, exit, filesystem, or process divergence.
 See [Process Capture](docs/process-capture.md) for scenario fields, limits, and
 evidence boundaries.

-REA installs a prebuilt PTY backend for supported macOS, Linux, and Windows
-architectures. If the capability check reports that the backend is unavailable,
-reinstall REA for the current platform and architecture.
+Process Capture currently runs on Linux and macOS with a working native PTY
+backend. Native Windows capture remains unavailable until the PTY adapter can
+verify descendant cleanup; installing or reinstalling its Windows PTY binary
+does not enable capture. For Linux commands, run Linux REA inside WSL.
+Comparing existing capture Evidence remains available on Windows.
+
+On supported capture hosts, a missing or incompatible PTY binary can be fixed
+by reinstalling REA for the current platform, architecture, and Node.js version
+with optional dependencies enabled. Use separate scenario and output files;
+`--json` produces the JSON consumed by the comparison command.

 ASAR inventory verifies Electron integrity metadata for both archive entries
 and `.asar.unpacked` companion files. Integrity failures identify the logical
@@ -592,11 +670,11 @@ verified or absent.

 ## Security model

-Analysis runs locally. REA communicates with Hopper and Ghidra through authenticated private local sockets. Your agent or model provider has its own data policy.
+Analysis runs locally. REA communicates with Hopper and Ghidra through authenticated private local sockets and with IDA through its configured local MCP registration. Your agent or model provider has its own data policy.

 Runtime requests act on the declared target and lifecycle. Analysis tools and launched targets run with your user permissions, and native UI capture still depends on macOS Accessibility and Screen Recording access. Static JavaScript analysis does not execute extracted modules; use direct browser, Electron, or process capture when runtime behavior is needed.

-Windows Ghidra operations are blocked until REA implements the required process ownership, private-directory permissions, and safe-path checks. Report vulnerabilities through the private process in [SECURITY.md](SECURITY.md).
+Windows Ghidra P0 automatically uses native Job Objects, protected private-runtime DACLs, and handle-based admission. Its experimental scope is native x86-64 PE applications on local NTFS. Report vulnerabilities through the private process in [SECURITY.md](SECURITY.md).

 ## FAQ

@@ -624,7 +702,7 @@ No. Setup can install Hopper for you, but Hopper remains separate software with
 <details>
 <summary><strong>Does REA install or include Ghidra or Java?</strong></summary>

-No. REA connects to an existing Ghidra installation. Run setup after providing the Ghidra and Java paths shown in the [Ghidra section](#ghidra-read-only-analysis-provider).
+No. REA connects to an existing Ghidra installation. Run setup after providing the Ghidra and Java paths shown in the [Ghidra section](#ghidra-analysis-provider).

 </details>

@@ -651,7 +729,7 @@ Any agent that can run a local MCP server can use the manual configuration. Setu

 ## Development

-See [CONTRIBUTING.md](CONTRIBUTING.md) for development setup and contribution checks, and [docs/testing.md](docs/testing.md) for test scopes and real-tool verification. PR CI publishes generated API documentation as the `api-docs` artifact.
+See [CONTRIBUTING.md](CONTRIBUTING.md) for development setup and contribution checks, and [docs/testing.md](docs/testing.md) for test scopes and real-tool verification. `npm run docs:check` checks committed generated documents; `npm run docs:generate` regenerates them.

 `npm run verify:agent` evaluates native, JavaScript, managed, and browser investigation tasks through a real local Codex CLI. Its report covers tool selection, repeated calls, token use, completion quality, and handling of permissions and unknowns.

@@ -2,9 +2,9 @@

 [English](README.md) · [简体中文](README_zh.md) · [日本語](README_ja.md) · [한국어](README_ko.md) · **العربية**

-# REA: هندسة أي شيء عكسيًا
+# REA: اعكس هندسة أي شيء

-### استقصِ سلوك التطبيقات والملفات التنفيذية الأصلية باستخدام وكيلك.
+### وسيط MCP واحد للهندسة العكسية عبر الملفات التنفيذية والتطبيقات وسلوك وقت التشغيل.

 **اعثر على ميزة تعجبك. افهم آلية عملها. ابنها بالطريقة التي تريدها.**

@@ -15,6 +15,8 @@
 [![MIT license](https://img.shields.io/badge/license-MIT-f4c430?style=flat-square)](LICENSE)
 [![Discord](https://img.shields.io/discord/1556595354999332884?logo=discord&logoColor=white&label=Discord&color=5865F2)](https://discord.gg/GkcryMnJDM)

+<a href="https://trendshift.io/repositories/82054?utm_source=repository-badge&amp;utm_medium=badge&amp;utm_campaign=badge-repository-82054" target="_blank" rel="noopener noreferrer"><img src="https://trendshift.io/api/badge/repositories/82054" alt="morluto%2Frea | Trendshift" width="250" height="55"/></a>
+
 [البدء السريع](#البدء-السريع) · [حالة الدعم](#حالة-الدعم) · [من الملف التنفيذي إلى السلوك](#من-الملف-التنفيذي-إلى-السلوك) · [منصة أدوات التحقيق](#منصة-أدوات-التحقيق) · [خطة العمل](#خطة-العمل) · [كيف يعمل؟](#كيف-يعمل)

 <table aria-label="REA community">
@@ -45,7 +47,7 @@

 يوفر REA أدوات لتحليل الملفات التنفيذية الأصلية وتطبيقات JavaScript وElectron وتجميعات .NET والمواقع. يمكنك استخدامها من وكيلك أو من الطرفية. يعمل التحليل محليًا، وتتضمن النتائج الأدلة والقيود.

-يضبط Setup إعدادات الوكيل ويربطه بتثبيت موجود من Hopper أو Ghidra. ويمكنه تثبيت Hopper بعد موافقتك.
+يضبط Setup إعدادات الوكيل ويربطه بتثبيت موجود من Hopper أو Ghidra، ويثبّت سير عمل REA الموجّه. ويمكنه تثبيت Hopper بعد موافقتك. ولا يحتاج التحليل الثابت لتطبيقات JavaScript إلى أي محرك.

 ## اطلب من وكيلك مباشرة

@@ -67,14 +69,14 @@

 ## لماذا REA؟

-|                      |                                                                                       |
-| -------------------- | ------------------------------------------------------------------------------------- |
-| **مصمم للوكلاء**      | اسأل عما يفعله تطبيق مترجم ودع الوكيل يجمع الأدلة بدلًا من التخمين.                      |
-| **CLI وMCP**         | استخدم قدرات الهندسة العكسية نفسها من الطرفية أو وكيل البرمجة.                        |
-| **يتولى التعقيد**    | يدير REA إعداد الأدوات وفتح التطبيق واستمرار الاستقصاء والتنظيف بعد الانتهاء.            |
-| **سير عمل كامل**     | انتقل من النظرة الأولى إلى الشيفرة شبه المصدرية وعلاقات الاستدعاء والأنواع وأدلة التنفيذ. |
-| **محلي حسب التصميم** | يجري التحليل على جهازك المدعوم ولا يرفع REA الملف التنفيذي إلى خدمة تحليل مستضافة.     |
-| **يحافظ على السياق** | استقصِ عدة ملفات تنفيذية من دون بدء التحليل من جديد عند كل سؤال.                       |
+|                          |                                                                              |
+| ------------------------ | ---------------------------------------------------------------------------- |
+| **مصمم للوكلاء**          | اسأل عما يفعله التطبيق ودع الوكيل يفحصه بدلًا من التخمين.                      |
+| **CLI وMCP**             | استخدم قدرات الهندسة العكسية نفسها من الطرفية أو الوكيل.                     |
+| **إعداد موجّه**           | اضبط وكيلك، واربط أداة تحليل موجودة، أو ثبّت Hopper بموافقتك.                 |
+| **من الفهم إلى الشيفرة** | افهم الميزة ثم ابنِ نسختك الخاصة في جلسة البرمجة نفسها.                       |
+| **محلي حسب التصميم**     | يجري التحليل على مضيفك المحلي المدعوم، ولا يرفع REA التطبيق إلى خدمة مستضافة. |
+| **يحافظ على السياق**     | استقصِ عدة تطبيقات دون بدء التحليل من جديد عند كل سؤال.                       |

 ## البدء السريع

@@ -92,19 +94,28 @@ npx rea-agents setup

 ### الاستخدام مع وكيل

-بعد الإعداد، أعد تشغيل الوكيل واشرح التطبيق أو الميزة التي تريد استقصاءها. يدعم REA Claude Code وClaude Desktop وCodex وCursor وGemini CLI وWindsurf وDevin وOpenCode وAntigravity وGitHub Copilot CLI وVS Code. تكون تسجيلات REA الموجودة محددة افتراضياً، ويجب اختيار العملاء المكتشفين الآخرين يدوياً. يمكن للوكلاء الآخرين استخدام إعداد MCP أدناه.
+بعد الإعداد، أعد تشغيل الوكيل واشرح التطبيق أو الميزة التي تريد استقصاءها. يدعم REA Claude Code وClaude Desktop وCodex وCursor وGemini CLI وWindsurf وDevin وOpenCode وAntigravity وGitHub Copilot CLI وCommand Code وVS Code. تكون تسجيلات REA الموجودة محددة افتراضياً، ويجب اختيار العملاء المكتشفين الآخرين يدوياً. يمكن للوكلاء الآخرين استخدام إعداد MCP أدناه.

 يمكن تشغيل Hopper في الوضع التجريبي. إذا ظهرت رسالة عند التشغيل الأول، فاختر التجربة أو أدخل ترخيصًا موجودًا.

-### الاستخدام من الطرفية
+### مهارة مساعد البرمجة (اختياري)

-بعد الإعداد، شغّل:
+أضف المهارة إلى مساعد البرمجة للحصول على سياق أغنى:

 ```bash
-npx -y rea-agents@latest doctor
-npx -y rea-agents@latest analyze /Applications/Notes.app
+npx skills add morluto/rea --skill reverse-engineer-anything
 ```

+توفر المهارة سير عمل التحقيق في REA. نفّذ الإعداد أعلاه لربط REA بالوكيل وضبط أدوات التحليل. يثبّت الإعداد افتراضيًا مهارة مطابقة للإصدار؛ وهذا الأمر يثبّت نسخة المستودع.
+
+لشجرة JavaScript/Electron المستخرجة أو ملف ASAR، لا يلزم إعداد MCP ولا محرك أصلي:
+
+```bash
+npx -y rea-agents@latest analyze-javascript-application /absolute/path/to/app --json
+```
+
+استبدل المسار بهدفك (مثل `"D:/apps/example"` على Windows). يدعم سير العمل الثابت هذه المسارات، بينما يتطلب التحليل الأصلي محركه الخاص.
+
 ### تثبيت أمر rea

 ثبت واجهة سطر الأوامر:
@@ -126,7 +137,7 @@ rea setup

 - macOS 12 أو أحدث
 - Ubuntu 24.04+ أو Fedora 41+ أو Arch Linux بنواة 64 بت
- Node.js 22.19+ أو 24.11+ وnpm
+- Node.js 22.x (>=22.19) أو 24.x (>=24.11) أو 26+ وnpm

 يتطلب تحليل الملفات التنفيذية الأصلية Hopper أو Ghidra. Hopper برنامج منفصل، وللوضع التجريبي قيود يحددها المورّد، لكن الترخيص المدفوع ليس إلزاميًا.

@@ -134,7 +145,7 @@ rea setup

 يستطيع Setup التحقق من التثبيت وحفظ المسارات؛ ولا يثبت أو يحدّث Ghidra أو Java أو Node.js أو npm أو Homebrew.

-تحليل Ghidra على Windows غير متاح. لم تُنفذ بعد ضوابط ملكية العمليات وأذونات المجلدات الخاصة والتحقق الآمن من المسارات. حتى التثبيت الصحيح لـ Ghidra وJava لا يفعّل التحليل. راجع [Windows Ghidra P0](docs/windows-ghidra-p0.md).
+يتضمن فرع main والحزمة npm 4.1.0 دعمًا تجريبيًا لـ Windows x64 Ghidra P0 لتطبيقات PE الأصلية x86-64 (غير المُدارة وغير DLL) على NTFS محلي، مع ضوابط Job Object وقوائم DACL الخاصة وقبول المسارات المجمّعة. تحقق من [حد الإصدار](docs/installation.md#released-package-and-main) قبل توقع ذلك من حزمة npm أقدم. راجع [دليل Windows Ghidra P0](docs/windows-ghidra-p0.md) للمتطلبات والنطاق الموثق.

 ### تشخيص المشكلات

@@ -150,12 +161,12 @@ rea setup

 ## حالة الدعم

-يوفر REA عبر CLI وMCP تحليل الملفات التنفيذية الأصلية وتطبيقات JavaScript وElectron وتجميعات .NET والمواقع. تعتمد العمليات المتاحة على الجهاز والهدف وأداة التحليل المختارة.
+تُوصف قدرات المستودع الحالية ومتطلبات الأنظمة في [دليل الدعم الإنجليزي](README.md#current-status). قد يسبق فرع main [إصدار npm](docs/installation.md#released-package-and-main).

- يدعم Hopper التحليل الأصلي والتعليقات؛ ويختلف سلوك واجهته الرسومية حسب المنصة.
- يقدم Ghidra على Linux x64 وmacOS x64/arm64 عددًا قدره 22 عملية للقراءة فقط: الجرد والبحث وفك الترجمة والتعليمات والاستدعاءات والمراجع والأنواع. لا يقدم عمليات واجهة رسومية أو تعديل.
- لسير عمل المتصفح وElectron وتشغيل العمليات متطلبات مستقلة للإعداد والموافقة وإدارة دورة الحياة. راجع [English README](README.md#current-status) للتفاصيل الكاملة.
- تحليل Ghidra على Windows غير مفعّل. تابع التقدم في [#527](https://github.com/morluto/rea/issues/527).
+- يوفر Ghidra 25 عملية للقراءة فقط على Linux x64 وmacOS x64/arm64 وحدود Windows x64 P0 التجريبية. يدعم Linux/macOS أيضًا تعليقات الدوال الذرية على مستوى الجلسة. نظام Windows P0 للقراءة فقط، ولا يوفر Ghidra أي تحكم في الواجهة.
+- يتطلب الفحص الثابت لنظام Android تجهيز JADX/Java بشكل منفصل؛ ويغطي التحقق بالموفر الحقيقي نظام Linux. راجع [تحليل Android](docs/android-analysis.md).
+- تحدد طلبات المتصفح وElectron والعمليات هدفها وإجراءاتها ودورة حياتها مباشرة، وتعتمد على وصول المضيف الفعلي دون منح أذونات منفصلة من REA. ما زالت كتابة إعدادات Setup وتثبيت Hopper تتطلب الموافقة على خطتها الدقيقة.
+- يصف `rea capabilities` عمليات جلسة الملف التنفيذي لا كل أدوات التطبيقات ووقت التشغيل. راجع قائمة أدوات MCP الكاملة والدليل ذا الصلة.

 ## استقصاء كامل بطلب واحد

@@ -200,18 +211,20 @@ rea setup

 ## منصة أدوات التحقيق

-| عائلة الأدوات          | العدد | الاستخدام                                                                               |
-| --------------------- | ----: | -------------------------------------------------------------------------------------- |
-| فحص الملفات التنفيذية |    39 | الدوال والشيفرة شبه المصدرية والتعليمات والسلاسل والرموز والمراجع والتعليقات            |
-| التحليل المركب        |    14 | النظرة العامة وتحليل الدوال وفك الترجمة الدفعي ومخطط الاستدعاء وفحص Swift وObjC         |
-| أدوات macOS الأصلية    |     7 | بيانات Mach-O والتوقيعات وplist والمعماريات واستعادة أسماء Swift                       |
-| الملفات والحزم        |     5 | فحص الدلائل والحزم وInterface Builder وموارد Apple والاستخراج                            |
-| .NET PE/CLI           |     7 | هوية التجميع والبيانات الوصفية وCIL والاستدعاءات الأصلية والمقارنة واستيراد إعادة البناء |
-| مراقبة المتصفح        |     9 | الصفحات والبرامج النصية وخرائط المصدر وWebMCP والصور ومقارنة الالتقاط                   |
-| تحليل Electron        |     5 | مراقبة الصفحات وبنية التطبيق وربط النتائج الثابتة بنتائج التشغيل                       |
-| وقت تشغيل JavaScript  |     2 | الاتصال بهدف Node/Electron Inspector موجود لمراقبة البرامج وسياقات التنفيذ              |
-| سير عمل التطبيقات     |     7 | تتبع الميزات ومقارنة الإصدارات وبنية قيم الإرجاع والتحقق من إعادة الإنشاء                 |
-| جلسة الملف التنفيذي   |    21 | تبديل الأهداف وحفظ الأدلة ومقارنة العمليات والدوال وتسجيل الأسئلة غير المحسومة            |
+| عائلة الأدوات         | العدد | الاستخدام                                                                                                                                                 |
+| -------------------- | ----: | -------------------------------------------------------------------------------------------------------------------------------------------------------- |
+| الفحص الأصلي          |    41 | الدوال والشيفرة شبه المصدرية والتعليمات والسلاسل والرموز والاستدعاءات والمراجع والتعليقات وقراءة البايتات ومواضع الملفات                                   |
+| سير عمل التحقيق      |    14 | نظرات عامة على التطبيقات وملفات الدوال وواجهات API الأصلية والتوزيع وفك الترجمة الدفعي وتتبع الميزات ومسارات الاستدعاء ومخططاته واكتشاف Swift وObjective-C |
+| أدوات macOS الأصلية   |     7 | بيانات Mach-O والتوقيعات وplist والمعماريات واستعادة أسماء Swift دون تشغيل Hopper                                                                        |
+| مخطط المخرجات        |     5 | جرد الدلائل والحزم وملفات Interface Builder المترجمة وكتالوجات موارد Apple والاستخراج                                                                      |
+| PE/CLI المُدار        |     7 | هوية تجميعات .NET وبياناتها الوصفية وتعليمات CIL والاعتماديات الأصلية واستيراد إعادة البناء ومقارنة الإصدارات                                               |
+| البرامج الثابتة      |     2 | فحص مناطق البرامج الثابتة على Linux واستخراجها الصريح                                                                                                    |
+| Android APK          |     5 | بيانات الحزمة وmanifest والبحث عن الأصناف وقوائم الأعضاء وفك ترجمة الأساليب والمراجع الثابتة                                                                |
+| مراقبة المتصفح       |     9 | بنية الصفحات وبيانات الشبكة والبرامج النصية وخرائط المصدر واكتشاف WebMCP والصور ومقارنة الالتقاط                                                          |
+| تحليل Electron       |     5 | مراقبة العارضين وخريطة التطبيق الثابتة والمواءمة بين نتائج الثبات والتشغيل                                                                               |
+| وقت تشغيل JavaScript |     2 | اكتشاف أهداف Node/Electron Inspector ومواضع البرامج وأحداث سياقات التنفيذ                                                                                |
+| سير عمل التطبيقات    |     8 | تصدير النصوص البرمجية الملتقطة، تتبع الميزات عبر الطبقات ومقارنة الإصدارات ومواءمة المصدر التاريخي ومقارنة أشكال القيم المعادة والتحقق من إعادة الإنشاء    |
+| مساحة العمل والملاحظة |    21 | الجلسات وحزم الأدلة وسياق التنقل ومقارنة العمليات والمخرجات والدوال وتسجيل الأسئلة غير المحسومة                                                            |

 ## خطة العمل

@@ -219,7 +232,7 @@ rea setup

 ## استخدام REA مع وكلاء برمجة آخرين

-يدعم Setup Claude Code وClaude Desktop وCodex وCursor وGemini CLI وWindsurf وDevin وOpenCode وAntigravity وGitHub Copilot CLI وVS Code. تكون تسجيلات REA الموجودة محددة افتراضياً، ويجب اختيار العملاء المكتشفين الآخرين يدوياً. يمكن لأي وكيل يدعم خوادم MCP المحلية الاتصال باستخدام الإعداد التالي:
+يدعم Setup Claude Code وClaude Desktop وCodex وCursor وGemini CLI وWindsurf وDevin وOpenCode وAntigravity وGitHub Copilot CLI وCommand Code وVS Code. تكون تسجيلات REA الموجودة محددة افتراضياً، ويجب اختيار العملاء المكتشفين الآخرين يدوياً. يمكن لأي وكيل يدعم خوادم MCP المحلية الاتصال باستخدام الإعداد التالي:

 <!-- x-release-please-start-version -->

@@ -228,7 +241,7 @@ rea setup
  "mcpServers": {
    "rea": {
      "command": "npx",
-      "args": ["-y", "rea-agents@4.0.1", "mcp"]
+      "args": ["-y", "rea-agents@4.1.0", "mcp"]
    }
  }
 }
@@ -272,8 +285,9 @@ npx -y rea-agents@latest compare /absolute/path/to/left-evidence.json /absolute/

 ## الأمان والخصوصية

- يبقى تحليل الملف التنفيذي محليًا بين REA ومزوّد التحليل المختار.
+- يبقى التحليل محليًا بين REA وموفر التحليل المختار عبر مقابس محلية خاصة، ومع IDA عبر تسجيل MCP المحلي المضبوط.
 - لا يرفع REA الأهداف إلى خدمة مستضافة.
+- تعمل أدوات التحليل والأهداف المطلقة بصلاحيات المستخدم نفسه؛ وما زال التقاط واجهة النظام على macOS يعتمد على الوصول إلى تسهيلات الاستخدام وتسجيل الشاشة. ولا ينفّذ التحليل الثابت للـ JavaScript الوحدات المستخرجة.
 - تستخدم جلسات Ghidra مشروعًا مؤقتًا معزولًا ولا تفتح مشاريع Ghidra التي يملكها المستخدم أو تعدّلها.
 - راجع الملفات التنفيذية غير الموثوقة واعزلها كما تفعل مع أي مدخل أصلي قد يكون ضارًا.
 - أبلغ عن الثغرات وفق [سياسة الأمان](SECURITY.md)، وليس عبر قضية عامة.
@@ -297,7 +311,7 @@ npx -y rea-agents@latest compare /absolute/path/to/left-evidence.json /absolute/
 <details>
 <summary><strong>هل يعمل REA على Linux أو Windows؟</strong></summary>

-يدعم REA نظام macOS 12+ وUbuntu 24.04+ وFedora 41+ وArch Linux بنواة 64 بت. يعمل تحليل Ghidra للقراءة فقط على Linux x64 وmacOS x64/arm64 مع Ghidra 12.1.4 وJDK 21 الكامل. تحليل Ghidra على Windows غير متاح بسبب الضوابط الأصلية غير المنفذة؛ راجع [Windows Ghidra P0](docs/windows-ghidra-p0.md).
+يدعم REA نظام macOS 12+ وUbuntu 24.04+ وFedora 41+ وArch Linux بنواة 64 بت. يعمل تحليل Ghidra للقراءة فقط على Linux x64 وmacOS x64/arm64 مع Ghidra 12.1.4 وJDK 21 الكامل، إضافة إلى حد Windows x64 P0 التجريبي لتطبيقات PE الأصلية x86-64 على NTFS محلي؛ راجع [دليل Windows Ghidra P0](docs/windows-ghidra-p0.md) للنطاق الموثق.

 </details>

@@ -15,6 +15,8 @@
 [![MIT license](https://img.shields.io/badge/license-MIT-f4c430?style=flat-square)](LICENSE)
 [![Discord](https://img.shields.io/discord/1556595354999332884?logo=discord&logoColor=white&label=Discord&color=5865F2)](https://discord.gg/GkcryMnJDM)

+<a href="https://trendshift.io/repositories/82054?utm_source=repository-badge&amp;utm_medium=badge&amp;utm_campaign=badge-repository-82054" target="_blank" rel="noopener noreferrer"><img src="https://trendshift.io/api/badge/repositories/82054" alt="morluto%2Frea | Trendshift" width="250" height="55"/></a>
+
 [クイックスタート](#クイックスタート) · [現在の対応状況](#現在の対応状況) · [バイナリから動作へ](#バイナリから動作へ) · [調査ツールカタログ](#調査ツールカタログ) · [ロードマップ](#ロードマップ) · [仕組み](#仕組み)

 <table aria-label="REA community">
@@ -67,14 +69,14 @@ REA は調査をバイナリ上の根拠に結び付けます。元のソース

 ## REA を選ぶ理由

-|                        |                                                                                                      |
-| ---------------------- | ---------------------------------------------------------------------------------------------------- |
-| **エージェント向け**   | コンパイル済みアプリについて質問し、推測ではなく根拠を集めさせることができます。                     |
-| **CLI と MCP**         | ターミナルとコーディングエージェントから同じリバースエンジニアリング機能を使えます。                 |
-| **複雑さを処理**       | ツール設定、アプリの読み込み、調査の維持、終了後のクリーンアップを REA が担います。                  |
-| **一連の調査に対応**   | 最初の概要から疑似コード、呼び出し関係、型、実装の手掛かりまで掘り下げられます。                     |
-| **ローカルで解析**     | 解析は対応するローカルホストで実行され、REA がバイナリをホスト型解析サービスへ送ることはありません。 |
-| **コンテキストを維持** | 質問ごとに解析を最初からやり直さず、複数のバイナリを続けて調査できます。                             |
+|                            |                                                                                                      |
+| -------------------------- | ---------------------------------------------------------------------------------------------------- |
+| **エージェント向け**       | アプリの動作について質問し、推測ではなくエージェントに調査させることができます。                     |
+| **CLI と MCP**             | ターミナルとエージェントから同じリバースエンジニアリング機能を使えます。                             |
+| **ガイド付きセットアップ** | エージェントの設定、既存の解析ツールへの接続、承認後の Hopper インストールに対応します。             |
+| **洞察からコードへ**       | 機能を理解したら、同じコーディングセッションで自分のプロダクト向けに実装できます。                   |
+| **ローカルで解析**         | 解析は対応するローカルホストで実行され、REA がバイナリをホスト型解析サービスへ送ることはありません。 |
+| **コンテキストを維持**     | 質問ごとに解析を最初からやり直さず、複数のアプリを続けて調査できます。                               |

 ## クイックスタート

@@ -92,19 +94,28 @@ Setup は最初に連携するエージェントを複数選択できるよう

 ### エージェントで使う

-設定後にエージェントを再起動し、調べたいアプリや機能を説明します。REA は Claude Code、Claude Desktop、Codex、Cursor、Gemini CLI、Windsurf、Devin、OpenCode、Antigravity、GitHub Copilot CLI、VS Code に対応します。既存の REA 登録は初期選択され、それ以外の検出済みクライアントは選択が必要です。その他のエージェントは下記の MCP 設定を使えます。
+設定後にエージェントを再起動し、調べたいアプリや機能を説明します。REA は Claude Code、Claude Desktop、Codex、Cursor、Gemini CLI、Windsurf、Devin、OpenCode、Antigravity、GitHub Copilot CLI、Command Code、VS Code に対応します。既存の REA 登録は初期選択され、それ以外の検出済みクライアントは選択が必要です。その他のエージェントは下記の MCP 設定を使えます。

 Hopper はデモモードで使えます。初回起動の画面ではデモを選択するか、既存のライセンスを入力してください。

-### ターミナルで使う
+### AI コーディングアシスタント向けスキル（任意）

-設定後に実行します：
+AI コーディングアシスタントにスキルを追加すると、より豊富なコンテキストが得られます：

 ```bash
-npx -y rea-agents@latest doctor
-npx -y rea-agents@latest analyze /Applications/Notes.app
+npx skills add morluto/rea --skill reverse-engineer-anything
 ```

+このスキルは REA の調査ワークフローを提供します。上記の setup を実行して REA をエージェントに接続し、解析ツールを設定してください。Setup は既定でバージョンに合ったスキルをインストールします。このコマンドではリポジトリ版のスキルをインストールします。
+
+展開済みの JavaScript/Electron アプリのツリーや ASAR であれば、MCP の設定もネイティブエンジンも不要です：
+
+```bash
+npx -y rea-agents@latest analyze-javascript-application /absolute/path/to/app --json
+```
+
+パスを調査対象に置き換えてください（Windows では `"D:/apps/example"` のようなパス）。この静的ワークフローではそのようなパスも扱えます。ネイティブ解析には専用のエンジン設定が必要です。
+
 ### rea コマンドをインストール

 コマンドラインツールをインストールします：
@@ -126,7 +137,7 @@ rea setup

 - macOS 12 以降
 - Ubuntu 24.04+、Fedora 41+、または 64 ビット Arch Linux
- Node.js 22.19+ または 24.11+ と npm
+- Node.js 22.x (>=22.19)、24.x (>=24.11)、または 26+ と npm

 ネイティブバイナリ解析には Hopper または Ghidra が必要です。Hopper は別製品です。デモにはベンダー所定の制限がありますが、有料ライセンスは必須ではありません。

@@ -134,7 +145,7 @@ Ghidra は Linux x64 と macOS x64/arm64 に対応します。Ghidra 12.1.4 と

 Setup はインストールを確認し、パスを保存できます。Ghidra、Java、Node.js、npm、Homebrew のインストールや更新は行いません。

-Windows の Ghidra 解析は利用できません。プロセスの所有権、プライベートディレクトリの権限、安全なパス検証が未実装のため、Ghidra と Java を正しくインストールしても有効になりません。[Windows Ghidra P0](docs/windows-ghidra-p0.md)を参照してください。
+リポジトリの main と npm 4.1.0 には、ローカル NTFS 上のネイティブ x86-64 PE アプリケーション（非マネージド、非 DLL 向け）を対象とする実験的な Windows x64 Ghidra P0 対応が含まれています。Job Object、プライベート DACL、パス許可の各制御が同梱されています。古い npm パッケージに期待する前に[リリース境界](docs/installation.md#released-package-and-main)を確認してください。前提条件と検証済みの範囲は [Windows Ghidra P0](docs/windows-ghidra-p0.md) を参照してください。

 ### トラブルシューティング

@@ -150,12 +161,12 @@ Linux の既定ランチャーは `/opt/hopper/bin/Hopper` です。別の場所

 ## 現在の対応状況

-REA は CLI と MCP からネイティブバイナリ、JavaScript/Electron アプリ、.NET アセンブリ、Web サイトを解析できます。使える操作はホスト、対象、選択した解析ツールによって異なります。
+リポジトリの現在の機能とプラットフォーム要件は[英語の対応状況ガイド](README.md#current-status)で説明しています。main は [npm リリース](docs/installation.md#released-package-and-main)より先行する場合があります。

- Hopper はネイティブ解析と注釈操作に対応します。GUI の動作はプラットフォームによって異なります。
- Ghidra は Linux x64 と macOS x64/arm64 で、一覧、検索、逆コンパイル、アセンブリ、呼び出し、参照、命令、型の検査など 22 の読み取り専用操作を提供します。GUI 操作や変更操作はありません。
- ブラウザー、Electron、プロセスの実行時ワークフローには、それぞれ設定、承認、終了処理の要件があります。詳細は [English README](README.md#current-status) を参照してください。
- Windows の Ghidra 解析は未対応です。進捗は [#527](https://github.com/morluto/rea/issues/527) で確認できます。
+- Ghidra は Linux x64、macOS x64/arm64、実験的な Windows x64 P0 境界で 25 件の読み取り専用操作を提供します。Linux/macOS ではアトミックなセッション内関数注釈にも対応します。Windows P0 は読み取り専用であり、Ghidra に GUI 操作はありません。
+- 静的な Android 検査には持ち込みの JADX/Java が別途必要です。実プロバイダー検証は Linux を対象とします。詳しくは[Android 解析](docs/android-analysis.md)を参照してください。
+- ブラウザー、Electron、プロセスの各リクエストは対象・操作・ライフサイクルを直接指定し、ホストの実際のアクセスに依存します。REA 側の個別の許可付与は不要です。Setup による設定書き込みと Hopper のインストールは、引き続き正確な計画の承認が必要です。
+- `rea capabilities` はバイナリセッション操作の説明であり、すべてのアプリ／ランタイムツールの目録ではありません。接続済み MCP ツール一覧と関連ガイドを参照してください。

 ## ひとつのプロンプトで調査を完結

@@ -189,18 +200,20 @@ REA は手順 1〜5 のバイナリ解析を処理し、手順 6 はエージェ

 ## 調査ツールカタログ

-| ツール分類           |  数 | 用途                                                                        |
-| -------------------- | --: | --------------------------------------------------------------------------- |
-| バイナリ検査         |  39 | 関数、疑似コード、アセンブリ、文字列、シンボル、参照、注釈                  |
-| 組み合わせた解析     |  14 | 概要、関数解析、一括逆コンパイル、呼び出しグラフ、Swift と ObjC             |
-| macOS ネイティブ     |   7 | Mach-O メタデータ、署名、plist、アーキテクチャ、Swift 名の復元              |
-| ファイルとパッケージ |   5 | ディレクトリとパッケージ、Interface Builder、Apple リソース、抽出           |
-| .NET PE/CLI          |   7 | アセンブリ識別、メタデータ、CIL、ネイティブ呼び出し、比較、再構築の取り込み |
-| ブラウザー観察       |   9 | ページ、スクリプト、ソースマップ、WebMCP、スクリーンショット、比較          |
-| Electron 解析        |   5 | ページ観察、アプリ構造、静的・実行時結果の対応付け                          |
-| JavaScript 実行時    |   2 | 既存の Node/Electron Inspector に接続し、スクリプトと実行コンテキストを観察 |
-| アプリのワークフロー |   7 | 機能追跡、バージョン比較、戻り値構造の比較、再実装の検証                    |
-| バイナリセッション   |  21 | 対象切り替え、根拠の保存、プロセス・関数比較、未解決事項の記録              |
+| ツール分類           |  数 | 用途                                                                                                                                         |
+| -------------------- | --: | -------------------------------------------------------------------------------------------------------------------------------------------- |
+| ネイティブ検査       |  41 | 関数、疑似コード、アセンブリ、文字列、シンボル、呼び出し、参照、注釈、バイト読み取り、ファイルオフセット                                     |
+| 調査ワークフロー     |  14 | アプリ概要、関数ドシエ、ネイティブ API とディスパッチ、一括逆コンパイル、機能トレース、コールパス、コールグラフ、Swift と Objective-C の検出 |
+| macOS ネイティブ     |   7 | Hopper を起動せずに扱える Mach-O メタデータ、署名、plist、アーキテクチャ、Swift 名の復元                                                     |
+| 成果物グラフ         |   5 | ディレクトリとパッケージの目録、コンパイル済み Interface Builder ファイル、Apple アセットカタログ、抽出                                      |
+| マネージド PE/CLI    |   7 | .NET の識別、メタデータ、CIL 命令、ネイティブ依存関係、再構築インポート、ビルド比較                                                          |
+| ファームウェア       |   2 | Linux ファームウェア領域の検査と明示的な展開                                                                                                 |
+| Android APK          |   5 | パッケージと manifest の宣言、クラス検索、メンバー一覧、メソッド逆コンパイル、静的参照                                                       |
+| ブラウザー観察       |   9 | ページ構成、ネットワークメタデータ、スクリプト、ソースマップ、WebMCP 検出、スクリーンショット、キャプチャ比較                                |
+| Electron 解析        |   5 | レンダラー観察、静的アプリマッピング、静的／実行時結果の対応付け                                                                             |
+| JavaScript 実行時    |   2 | Node/Electron Inspector 対象の検出、スクリプト位置、実行コンテキストイベント                                                                 |
+| アプリワークフロー   |   8 | 取得した Web スクリプトのエクスポート、層をまたぐ機能トレース、ビルド比較、履歴ソース対応、静的戻り値形状の比較、再実装検証                  |
+| ワークスペースと観察 |  21 | セッション、証跡バンドル、ナビゲーション文脈、プロセス・成果物・関数比較、未解決事項の記録                                                   |

 ## ロードマップ

@@ -208,7 +221,7 @@ REA は手順 1〜5 のバイナリ解析を処理し、手順 6 はエージェ

 ## 他のコーディングエージェントで使う

-Setup は Claude Code、Claude Desktop、Codex、Cursor、Gemini CLI、Windsurf、Devin、OpenCode、Antigravity、GitHub Copilot CLI、VS Code に対応します。既存の REA 登録は初期選択され、それ以外の検出済みクライアントは選択が必要です。ローカル MCP サーバーに対応するエージェントは、次の設定でも接続できます。
+Setup は Claude Code、Claude Desktop、Codex、Cursor、Gemini CLI、Windsurf、Devin、OpenCode、Antigravity、GitHub Copilot CLI、Command Code、VS Code に対応します。既存の REA 登録は初期選択され、それ以外の検出済みクライアントは選択が必要です。ローカル MCP サーバーに対応するエージェントは、次の設定でも接続できます。

 <!-- x-release-please-start-version -->

@@ -217,7 +230,7 @@ Setup は Claude Code、Claude Desktop、Codex、Cursor、Gemini CLI、Windsurf
  "mcpServers": {
    "rea": {
      "command": "npx",
-      "args": ["-y", "rea-agents@4.0.1", "mcp"]
+      "args": ["-y", "rea-agents@4.1.0", "mcp"]
    }
  }
 }
@@ -15,6 +15,8 @@
 [![MIT license](https://img.shields.io/badge/license-MIT-f4c430?style=flat-square)](LICENSE)
 [![Discord](https://img.shields.io/discord/1556595354999332884?logo=discord&logoColor=white&label=Discord&color=5865F2)](https://discord.gg/GkcryMnJDM)

+<a href="https://trendshift.io/repositories/82054?utm_source=repository-badge&amp;utm_medium=badge&amp;utm_campaign=badge-repository-82054" target="_blank" rel="noopener noreferrer"><img src="https://trendshift.io/api/badge/repositories/82054" alt="morluto%2Frea | Trendshift" width="250" height="55"/></a>
+
 [빠른 시작](#빠른-시작) · [현재 지원 범위](#현재-지원-범위) · [바이너리에서 동작까지](#바이너리에서-동작까지) · [조사 도구 카탈로그](#조사-도구-카탈로그) · [로드맵](#로드맵) · [작동 방식](#작동-방식)

 <table aria-label="REA community">
@@ -68,14 +70,14 @@ REA는 분석을 바이너리 증거에 근거하게 합니다. 원본 소스

 ## REA를 사용하는 이유

-|                    |                                                                                                     |
-| ------------------ | --------------------------------------------------------------------------------------------------- |
-| **에이전트용**     | 컴파일된 앱에 관해 질문하고 추측 대신 증거를 수집하게 합니다.                                       |
-| **CLI와 MCP**      | 터미널과 코딩 에이전트에서 동일한 리버스 엔지니어링 기능을 사용합니다.                              |
-| **복잡성 처리**    | 도구 설정, 앱 열기, 조사 유지, 작업 후 정리를 REA가 처리합니다.                                     |
-| **전체 조사 과정** | 첫 개요에서 의사 코드, 호출 관계, 타입, 구현 단서까지 이어서 조사합니다.                            |
-| **로컬 분석**      | 분석은 지원되는 로컬 호스트에서 실행되며 REA는 바이너리를 호스팅 분석 서비스에 업로드하지 않습니다. |
-| **컨텍스트 유지**  | 질문마다 분석을 처음부터 시작하지 않고 여러 바이너리를 연속으로 조사합니다.                         |
+|                     |                                                                                                     |
+| ------------------- | --------------------------------------------------------------------------------------------------- |
+| **에이전트용**      | 앱의 동작에 대해 질문하고 추측 대신 에이전트가 조사하게 합니다.                                     |
+| **CLI와 MCP**       | 터미널과 에이전트에서 동일한 리버스 엔지니어링 기능을 사용합니다.                                   |
+| **안내식 설정**     | 에이전트 설정, 기존 분석 도구 연결, 승인 후 Hopper 설치를 지원합니다.                               |
+| **통찰에서 코드로** | 기능을 이해한 뒤 같은 코딩 세션에서 자신의 제품에 맞는 버전을 구현합니다.                           |
+| **로컬 분석**       | 분석은 지원되는 로컬 호스트에서 실행되며 REA는 바이너리를 호스팅 분석 서비스에 업로드하지 않습니다. |
+| **컨텍스트 유지**   | 질문마다 분석을 처음부터 시작하지 않고 여러 앱을 연속으로 조사합니다.                               |

 ## 빠른 시작

@@ -93,19 +95,28 @@ Setup은 먼저 연결할 에이전트를 여러 개 선택하도록 안내합

 ### 에이전트에서 사용하기

-설정 후 에이전트를 다시 시작하고 조사할 앱이나 기능을 설명하세요. REA는 Claude Code, Claude Desktop, Codex, Cursor, Gemini CLI, Windsurf, Devin, OpenCode, Antigravity, GitHub Copilot CLI, VS Code를 지원합니다. 기존 REA 등록은 기본 선택되고, 그 밖의 감지된 클라이언트는 직접 선택해야 합니다. 다른 에이전트는 아래 MCP 설정을 사용할 수 있습니다.
+설정 후 에이전트를 다시 시작하고 조사할 앱이나 기능을 설명하세요. REA는 Claude Code, Claude Desktop, Codex, Cursor, Gemini CLI, Windsurf, Devin, OpenCode, Antigravity, GitHub Copilot CLI, Command Code, VS Code를 지원합니다. 기존 REA 등록은 기본 선택되고, 그 밖의 감지된 클라이언트는 직접 선택해야 합니다. 다른 에이전트는 아래 MCP 설정을 사용할 수 있습니다.

 Hopper는 데모 모드로 사용할 수 있습니다. 첫 실행 안내가 나오면 데모를 선택하거나 기존 라이선스를 입력하세요.

-### 터미널에서 실행하기
+### AI 코딩 어시스턴트용 스킬(선택)

-설정 후 실행하세요.
+AI 코딩 어시스턴트에 스킬을 추가하면 더 풍부한 컨텍스트를 얻을 수 있습니다.

 ```bash
-npx -y rea-agents@latest doctor
-npx -y rea-agents@latest analyze /Applications/Notes.app
+npx skills add morluto/rea --skill reverse-engineer-anything
 ```

+이 스킬은 REA의 조사 워크플로를 제공합니다. 위 setup을 실행해 REA를 에이전트에 연결하고 분석 도구를 설정하세요. Setup은 기본적으로 버전에 맞는 스킬을 설치합니다. 이 명령은 저장소 버전의 스킬을 설치합니다.
+
+압축을 해제한 JavaScript/Electron 앱 트리나 ASAR라면 MCP 설정이나 네이티브 엔진 없이 바로 분석할 수 있습니다.
+
+```bash
+npx -y rea-agents@latest analyze-javascript-application /absolute/path/to/app --json
+```
+
+경로를 조사 대상으로 바꾸세요(Windows에서는 `"D:/apps/example"` 같은 경로). 이 정적 워크플로에서는 이런 경로도 지원됩니다. 네이티브 분석에는 전용 엔진 설정이 필요합니다.
+
 ### rea 명령 설치하기

 명령줄 도구를 설치하세요.
@@ -127,7 +138,7 @@ rea setup

 - macOS 12 이상
 - Ubuntu 24.04+, Fedora 41+ 또는 64비트 Arch Linux
- Node.js 22.19+ 또는 24.11+와 npm
+- Node.js 22.x (>=22.19), 24.x (>=24.11) 또는 26+와 npm

 네이티브 바이너리 분석에는 Hopper 또는 Ghidra가 필요합니다. Hopper는 별도 소프트웨어입니다. 데모에는 공급업체의 제한이 있지만 유료 라이선스가 필수는 아닙니다.

@@ -135,7 +146,7 @@ Ghidra는 Linux x64와 macOS x64/arm64를 지원합니다. Ghidra 12.1.4와 완

 Setup은 설치를 확인하고 경로를 저장할 수 있습니다. Ghidra, Java, Node.js, npm, Homebrew를 설치하거나 업데이트하지 않습니다.

-Windows Ghidra 분석은 사용할 수 없습니다. 프로세스 소유권, 비공개 디렉터리 권한, 안전한 경로 검사가 구현되지 않았으므로 Ghidra와 Java를 올바르게 설치해도 분석을 활성화할 수 없습니다. [Windows Ghidra P0](docs/windows-ghidra-p0.md)를 참고하세요.
+저장소 main과 npm 4.1.0에는 로컬 NTFS상의 네이티브 x86-64 PE 애플리케이션(비관리, 비 DLL 대상)을 위한 실험적인 Windows x64 Ghidra P0 지원이 포함되어 있습니다. Job Object, 비공개 DACL, 경로 승인 제어가 함께 제공됩니다. 이전 npm 패키지에 이 기능이 있을 것으로 기대하기 전에 [릴리스 경계](docs/installation.md#released-package-and-main)를 확인하세요. 전제 조건과 검증 범위는 [Windows Ghidra P0](docs/windows-ghidra-p0.md)를 참고하세요.

 ### 문제 해결

@@ -151,12 +162,12 @@ Linux의 기본 Hopper 실행 파일은 `/opt/hopper/bin/Hopper`입니다. 다

 ## 현재 지원 범위

-REA는 CLI와 MCP로 네이티브 바이너리, JavaScript/Electron 앱, .NET 어셈블리, 웹사이트를 분석합니다. 사용할 수 있는 작업은 호스트, 대상, 선택한 분석 도구에 따라 다릅니다.
+저장소의 현재 기능과 플랫폼 요구 사항은 [영문 지원 가이드](README.md#current-status)에 설명되어 있습니다. main은 [npm 릴리스](docs/installation.md#released-package-and-main)보다 앞설 수 있습니다.

- Hopper는 네이티브 분석과 주석 작업을 지원합니다. GUI 동작은 플랫폼에 따라 다릅니다.
- Ghidra는 Linux x64와 macOS x64/arm64에서 목록, 검색, 디컴파일, 어셈블리, 호출, 참조, 명령어, 타입 검사 등 읽기 전용 작업 22개를 제공합니다. GUI나 변경 작업은 제공하지 않습니다.
- 브라우저, Electron, 프로세스 런타임 워크플로에는 각각 설정, 승인, 종료 처리 요구 사항이 있습니다. 자세한 내용은 [English README](README.md#current-status)를 참고하세요.
- Windows Ghidra 분석은 아직 사용할 수 없습니다. 진행 상황은 [#527](https://github.com/morluto/rea/issues/527)에서 확인하세요.
+- Ghidra는 Linux x64, macOS x64/arm64, 실험적인 Windows x64 P0 경계에서 25개의 읽기 전용 작업을 제공합니다. Linux/macOS에서는 원자적 세션 함수 주석도 추가로 지원합니다. Windows P0는 읽기 전용이며 Ghidra에는 GUI 제어가 없습니다.
+- 정적 Android 검사는 별도로 준비한 JADX/Java가 필요합니다. 실제 제공자 검증은 Linux를 대상으로 합니다. [Android 분석](docs/android-analysis.md)을 참고하세요.
+- 브라우저, Electron, 프로세스 요청은 대상·동작·수명 주기를 직접 지정하며 호스트의 실제 접근에 의존합니다. 별도의 REA 권한 승인은 필요 없습니다. Setup의 설정 쓰기와 Hopper 설치는 여전히 정확한 계획에 대한 승인이 필요합니다.
+- `rea capabilities`는 모든 앱/런타임 도구의 목록이 아니라 바이너리 세션 작업을 설명합니다. 연결된 MCP 도구 목록과 관련 가이드를 참고하세요.

 ## 하나의 프롬프트로 전체 조사

@@ -190,18 +201,20 @@ REA는 1–5단계의 바이너리 분석을 처리합니다. 6단계는 에이

 ## 조사 도구 카탈로그

-| 도구 분류         |  수 | 용도                                                                 |
-| ----------------- | --: | -------------------------------------------------------------------- |
-| 바이너리 검사     |  39 | 함수, 의사 코드, 어셈블리, 문자열, 심볼, 참조, 주석                  |
-| 결합 분석         |  14 | 개요, 함수 분석, 일괄 디컴파일, 호출 그래프, Swift와 ObjC 검사       |
-| macOS 네이티브    |   7 | Mach-O 메타데이터, 서명, plist, 아키텍처, Swift 이름 복원            |
-| 파일과 패키지     |   5 | 디렉터리와 패키지 검사, Interface Builder, Apple 리소스, 추출        |
-| .NET PE/CLI       |   7 | 어셈블리 식별, 메타데이터, CIL, 네이티브 호출, 비교, 재구성 가져오기 |
-| 브라우저 관찰     |   9 | 페이지, 스크립트, 소스 맵, WebMCP, 스크린샷, 캡처 비교               |
-| Electron 분석     |   5 | 페이지 관찰, 앱 구조, 정적·런타임 결과 연결                          |
-| JavaScript 런타임 |   2 | 기존 Node/Electron Inspector에 연결해 스크립트와 실행 컨텍스트 관찰  |
-| 앱 워크플로       |   7 | 기능 추적, 버전 비교, 반환 구조 비교, 재구현 검증                    |
-| 바이너리 세션     |  21 | 대상 전환, 근거 저장, 프로세스·함수 비교, 미해결 항목 기록           |
+| 도구 분류         |  수 | 용도                                                                                                                      |
+| ----------------- | --: | ------------------------------------------------------------------------------------------------------------------------- |
+| 네이티브 검사     |  41 | 함수, 의사 코드, 어셈블리, 문자열, 심볼, 호출, 참조, 주석, 바이트 읽기, 파일 오프셋                                       |
+| 조사 워크플로     |  14 | 앱 개요, 함수 기록서, 네이티브 API와 디스패치, 일괄 디컴파일, 기능 추적, 호출 경로, 호출 그래프, Swift와 Objective-C 탐색 |
+| macOS 네이티브    |   7 | Hopper 실행 없이 처리하는 Mach-O 메타데이터, 서명, plist, 아키텍처, Swift 이름 복원                                       |
+| 아티팩트 그래프   |   5 | 디렉터리와 패키지 목록, 컴파일된 Interface Builder 파일, Apple 애셋 카탈로그, 추출                                        |
+| 관리 PE/CLI       |   7 | .NET 식별, 메타데이터, CIL 명령어, 네이티브 종속성, 재구성 가져오기, 빌드 비교                                            |
+| 펌웨어            |   2 | Linux 펌웨어 영역 검사 및 명시적 추출                                                                                     |
+| Android APK       |   5 | 패키지와 manifest 선언, 클래스 검색, 멤버 목록, 메서드 디컴파일, 정적 참조                                                |
+| 브라우저 관찰     |   9 | 페이지 구조, 네트워크 메타데이터, 스크립트, 소스 맵, WebMCP 탐색, 스크린샷, 캡처 비교                                     |
+| Electron 분석     |   5 | 렌더러 관찰, 정적 앱 매핑, 정적·런타임 결과 연결                                                                          |
+| JavaScript 런타임 |   2 | Node/Electron Inspector 대상 탐색, 스크립트 위치, 실행 컨텍스트 이벤트                                                    |
+| 앱 워크플로       |   8 | 캡처한 웹 스크립트 내보내기, 계층 간 기능 추적, 빌드 비교, 히스토리 소스 매핑, 정적 반환 구조 비교, 재구현 검증           |
+| 작업 공간과 관찰  |  21 | 세션, 근거 번들, 탐색 컨텍스트, 프로세스·아티팩트·함수 비교, 미해결 항목 기록                                             |

 ## 로드맵

@@ -209,7 +222,7 @@ REA는 1–5단계의 바이너리 분석을 처리합니다. 6단계는 에이

 ## 다른 코딩 에이전트에서 사용하기

-Setup은 Claude Code, Claude Desktop, Codex, Cursor, Gemini CLI, Windsurf, Devin, OpenCode, Antigravity, GitHub Copilot CLI, VS Code를 지원합니다. 기존 REA 등록은 기본 선택되고, 그 밖의 감지된 클라이언트는 직접 선택해야 합니다. 로컬 MCP 서버를 지원하는 에이전트는 다음 설정으로 연결할 수 있습니다.
+Setup은 Claude Code, Claude Desktop, Codex, Cursor, Gemini CLI, Windsurf, Devin, OpenCode, Antigravity, GitHub Copilot CLI, Command Code, VS Code를 지원합니다. 기존 REA 등록은 기본 선택되고, 그 밖의 감지된 클라이언트는 직접 선택해야 합니다. 로컬 MCP 서버를 지원하는 에이전트는 다음 설정으로 연결할 수 있습니다.

 <!-- x-release-please-start-version -->

@@ -218,7 +231,7 @@ Setup은 Claude Code, Claude Desktop, Codex, Cursor, Gemini CLI, Windsurf, Devin
  "mcpServers": {
    "rea": {
      "command": "npx",
-      "args": ["-y", "rea-agents@4.0.1", "mcp"]
+      "args": ["-y", "rea-agents@4.1.0", "mcp"]
    }
  }
 }
@@ -15,6 +15,8 @@
 [![MIT license](https://img.shields.io/badge/license-MIT-f4c430?style=flat-square)](LICENSE)
 [![Discord](https://img.shields.io/discord/1556595354999332884?logo=discord&logoColor=white&label=Discord&color=5865F2)](https://discord.gg/GkcryMnJDM)

+<a href="https://trendshift.io/repositories/82054?utm_source=repository-badge&amp;utm_medium=badge&amp;utm_campaign=badge-repository-82054" target="_blank" rel="noopener noreferrer"><img src="https://trendshift.io/api/badge/repositories/82054" alt="morluto%2Frea | Trendshift" width="250" height="55"/></a>
+
 [快速开始](#快速开始) · [当前状态](#当前状态) · [从二进制到行为](#从二进制到行为) · [调查工具目录](#调查工具目录) · [路线图](#路线图) · [工作原理](#工作原理)

 <table aria-label="REA community">
@@ -69,12 +71,12 @@ REA 让调查始终以二进制证据为依据。它不会声称能恢复原始

 |                  |                                                                      |
 | ---------------- | -------------------------------------------------------------------- |
-| **为智能体设计** | 直接询问编译后应用的行为，让智能体搜集证据，而不是猜测。             |
-| **CLI 与 MCP**   | 在终端或编程智能体中使用同一套逆向工程能力。                         |
-| **处理复杂流程** | REA 负责工具设置、打开应用、维持调查过程，并在完成后清理资源。       |
-| **完整工作流**   | 从初步概览推进到伪代码、调用关系、类型和实现线索。                   |
+| **为智能体设计** | 直接询问应用的行为，让智能体去检查，而不是猜测。                     |
+| **CLI 与 MCP**   | 在终端或智能体中使用同一套逆向工程能力。                             |
+| **引导式设置**   | 配置智能体、连接已有分析工具，或在你批准后安装 Hopper。              |
+| **从洞察到代码** | 理解功能后，在同一次编程会话中构建属于你自己的版本。                 |
 | **本地运行**     | 分析在受支持的本机系统上运行；REA 不会把二进制上传到托管式分析服务。 |
-| **保留上下文**   | 连续调查多个二进制文件，无需为每个问题重新开始整个分析过程。         |
+| **保留上下文**   | 连续调查多个应用，无需为每个问题重新开始整个分析过程。               |

 ## 快速开始

@@ -92,19 +94,28 @@ Setup 会先展示变更并备份已有配置。要求与更多选项见[安装

 ### 使用智能体

-设置完成后，重启智能体并描述你想了解的应用或功能。REA 支持 Claude Code、Claude Desktop、Codex、Cursor、Gemini CLI、Windsurf、Devin、OpenCode、Antigravity、GitHub Copilot CLI 和 VS Code。已有 REA 注册默认选中；其他检测到的客户端需手动选择。其他智能体可以使用下方的 MCP 配置。
+设置完成后，重启智能体并描述你想了解的应用或功能。REA 支持 Claude Code、Claude Desktop、Codex、Cursor、Gemini CLI、Windsurf、Devin、OpenCode、Antigravity、GitHub Copilot CLI、Command Code 和 VS Code。已有 REA 注册默认选中；其他检测到的客户端需手动选择。其他智能体可以使用下方的 MCP 配置。

 Hopper 支持演示模式。如果首次启动时出现提示，选择演示模式或输入已有许可证。

-### 从终端运行
+### AI 编程助手技能（可选）

-设置完成后：
+为你的 AI 编程助手添加 skill，以获得更丰富的上下文：

 ```bash
-npx -y rea-agents@latest doctor
-npx -y rea-agents@latest analyze /Applications/Notes.app
+npx skills add morluto/rea --skill reverse-engineer-anything
 ```

+该 skill 提供 REA 的调查工作流。先运行上文的 setup，把 REA 连接到你的智能体并配置分析工具。Setup 默认会安装版本匹配的 skill；这条命令安装的是仓库版本。
+
+对于已解包的 JavaScript/Electron 应用目录或 ASAR，无需 MCP 配置，也无需原生引擎：
+
+```bash
+npx -y rea-agents@latest analyze-javascript-application /absolute/path/to/app --json
+```
+
+把路径换成你的目标（例如 Windows 上的 `"D:/apps/example"`）。这条静态流程支持此类路径。原生分析仍需要先配置对应的分析引擎。
+
 ### 安装 rea 命令

 安装命令行工具：
@@ -122,11 +133,11 @@ npm install --global rea-agents
 rea setup
 ```

-### 运行要求
+### 系统要求

 - macOS 12 或更高版本
 - Ubuntu 24.04+、Fedora 41+ 或 64 位 Arch Linux
- Node.js 22.19+ 或 24.11+，以及 npm
+- Node.js 22.x (>=22.19)、24.x (>=24.11) 或 26+，以及 npm

 原生二进制分析需要 Hopper 或 Ghidra。Hopper 是独立软件；演示模式有厂商规定的限制，不要求购买许可证。

@@ -134,9 +145,9 @@ Ghidra 支持 Linux x64 和 macOS x64/arm64。单独安装 Ghidra 12.1.4 和完

 Setup 可以验证安装并保存路径，不会安装或升级 Ghidra、Java、Node.js、npm 或 Homebrew。

-Windows Ghidra 分析目前不可用。进程归属、私有目录权限和安全路径检查尚未实现，正确安装 Ghidra 和 Java 也不能启用分析。详见 [Windows Ghidra P0](docs/windows-ghidra-p0.md)。
+仓库 main 分支与 npm 4.1.0 已包含实验性的 Windows x64 Ghidra P0 支持，适用于本地 NTFS 上的原生 x86-64 PE 应用（非托管、非 DLL），并附带 Job Object、私有 DACL 与路径准入控制。请先确认[发布边界](docs/installation.md#released-package-and-main)，再假定旧版 npm 包具备该能力。详见 [Windows Ghidra P0](docs/windows-ghidra-p0.md) 的前置条件与已验证范围。

-### 故障排查
+### 故障排除

 运行 `npx -y rea-agents@latest doctor`，检查主机、依赖、分析工具和智能体配置。该命令不会修改文件。添加 `--json` 可获取结构化诊断。

@@ -150,12 +161,12 @@ Linux 上的默认 Hopper 启动器为 `/opt/hopper/bin/Hopper`。其他路径

 ## 当前状态

-REA 可以通过 CLI 和 MCP 分析原生二进制、JavaScript/Electron 应用、.NET 程序集和网站。具体操作取决于主机、目标和所选分析工具。
+仓库当前能力与平台要求见[英文支持指南](README.md#current-status)。main 分支可能领先于 [npm 发布版](docs/installation.md#released-package-and-main)。

- Hopper 支持原生分析和注释操作；GUI 行为取决于平台。
- Ghidra 在 Linux x64 和 macOS x64/arm64 上提供 22 项只读操作，包括清单、搜索、反编译、汇编、调用关系、引用、指令与类型检查。它不提供 GUI 或修改操作。
- 浏览器、Electron 和进程运行时工作流有独立的配置、批准和生命周期要求。详见 [English README](README.md#current-status) 中的完整状态说明。
- Windows Ghidra 分析尚未启用，跟踪进展见 [#527](https://github.com/morluto/rea/issues/527)。
+- Ghidra 在 Linux x64、macOS x64/arm64 以及实验性的 Windows x64 P0 边界上提供 25 个只读操作。Linux/macOS 额外支持原子化的会话级函数注释。Windows P0 为只读；Ghidra 不提供 GUI 控制。
+- 静态 Android 检查需要自备 JADX/Java，前置条件独立；真机验证覆盖 Linux。详见 [Android 分析](docs/android-analysis.md)。
+- 浏览器、Electron 与进程请求需直接声明目标、动作与生命周期，并依赖宿主的实际访问权限，无需 REA 另行授权。Setup 的配置写入与 Hopper 安装仍需逐项批准确切计划。
+- `rea capabilities` 描述的是二进制会话操作，而非全部应用/运行时工具。请以已连接 MCP 工具列表与相关指南为准。

 ## 一个提示词，完成一次完整调查

@@ -189,18 +200,20 @@ REA 负责第 1–5 步中的二进制分析。第 6 步由智能体使用其常

 ## 调查工具目录

-| 工具类别          | 数量 | 用途                                                      |
-| ----------------- | ---: | --------------------------------------------------------- |
-| 二进制检查        |   39 | 函数、伪代码、汇编、字符串、符号、段、引用与注释          |
-| 组合分析          |   14 | 概览、函数分析、批量反编译、调用图、Swift 与 ObjC 检查    |
-| macOS 原生工具    |    7 | Mach-O 元数据、代码签名、plist、架构与 Swift 符号还原     |
-| 制品检查          |    5 | 目录与软件包检查、Interface Builder、Apple 资源目录与提取 |
-| .NET PE/CLI       |    7 | 程序集身份、元数据、CIL、原生调用声明、成员比较与重建导入 |
-| 浏览器观察        |    9 | 页面、脚本、来源映射、WebMCP 工具、截图与捕获比较         |
-| Electron 分析     |    5 | 页面观察、应用结构与静态/运行时结果关联                   |
-| JavaScript 运行时 |    2 | 连接现有 Node/Electron Inspector，观察脚本与执行上下文    |
-| 应用工作流        |    7 | 功能追踪、版本比较、返回结构比较与重建验证                |
-| 二进制会话        |   21 | 目标切换、证据包、进程与函数比较、待解决问题记录          |
+| 工具类别          | 数量 | 用途                                                                                                   |
+| ----------------- | ---: | ------------------------------------------------------------------------------------------------------ |
+| 原生检查          |   41 | 函数、伪代码、汇编、字符串、符号、调用、引用、注释、字节读取与文件偏移                                 |
+| 调查工作流        |   14 | 应用概览、函数档案、原生 API 与分发、批量反编译、功能追踪、调用路径与调用图、Swift 与 Objective-C 发现 |
+| macOS 原生工具    |    7 | Mach-O 元数据、代码签名、plist、架构与 Swift 符号还原，无需启动 Hopper                                 |
+| 产物图            |    5 | 目录与软件包清单、编译后的 Interface Builder 文件、Apple 资源目录与提取                                |
+| 托管 PE/CLI       |    7 | .NET 程序集身份、元数据、CIL 指令、原生依赖声明、重建导入与构建比较                                    |
+| 固件              |    2 | Linux 固件区域检查与显式提取                                                                           |
+| Android APK       |    5 | 包与 manifest 声明、类搜索、成员清单、方法反编译与静态引用                                             |
+| 浏览器观察        |    9 | 页面结构、网络元数据、脚本、来源映射、WebMCP 发现、截图与捕获比较                                      |
+| Electron 分析     |    5 | 渲染进程观察、静态应用映射、静态/运行时结果关联                                                        |
+| JavaScript 运行时 |    2 | Node/Electron Inspector 目标发现、脚本位置与执行上下文事件                                             |
+| 应用工作流        |    8 | 捕获的网站脚本导出、跨层功能追踪、构建比较、历史源码映射、静态返回结构比较与重建验证                   |
+| 工作区与观察      |   21 | 会话、证据包、导航上下文、进程/产物/函数比较与待解决问题跟踪                                           |

 ## 路线图

@@ -208,7 +221,7 @@ REA 负责第 1–5 步中的二进制分析。第 6 步由智能体使用其常

 ## 与其他编程智能体一起使用

-Setup 支持 Claude Code、Claude Desktop、Codex、Cursor、Gemini CLI、Windsurf、Devin、OpenCode、Antigravity、GitHub Copilot CLI 和 VS Code。已有 REA 注册默认选中；其他检测到的客户端需手动选择。任何支持本地 MCP 服务器的智能体都可以使用以下配置连接 REA。
+Setup 支持 Claude Code、Claude Desktop、Codex、Cursor、Gemini CLI、Windsurf、Devin、OpenCode、Antigravity、GitHub Copilot CLI、Command Code 和 VS Code。已有 REA 注册默认选中；其他检测到的客户端需手动选择。任何支持本地 MCP 服务器的智能体都可以使用以下配置连接 REA。

 <!-- x-release-please-start-version -->

@@ -217,7 +230,7 @@ Setup 支持 Claude Code、Claude Desktop、Codex、Cursor、Gemini CLI、Windsu
  "mcpServers": {
    "rea": {
      "command": "npx",
-      "args": ["-y", "rea-agents@4.0.1", "mcp"]
+      "args": ["-y", "rea-agents@4.1.0", "mcp"]
    }
  }
 }
@@ -73,6 +73,11 @@ import ghidra.program.model.listing.Instruction;
 import ghidra.program.model.listing.InstructionIterator;
 import ghidra.program.model.listing.Variable;
 import ghidra.program.model.mem.MemoryBlock;
+import ghidra.program.model.mem.MemoryBlockSourceInfo;
+import ghidra.program.database.mem.FileBytes;
+import ghidra.program.model.address.SegmentedAddress;
+import ghidra.program.model.reloc.Relocation;
+import java.io.ByteArrayOutputStream;
 import ghidra.program.model.symbol.RefType;
 import ghidra.program.model.symbol.Reference;
 import ghidra.program.model.symbol.ReferenceIterator;
@@ -112,6 +117,10 @@ public final class ReaGhidraBridge extends HeadlessScript {
        "params"
    );
    private static final String[] CAPABILITIES = {
+        "annotate_native_function",
+        "inspect_native_load_image",
+        "read_bytes",
+        "address_to_file_offset",
        "ping",
        "shutdown",
        "address_name",
@@ -142,6 +151,7 @@ public final class ReaGhidraBridge extends HeadlessScript {
    private List<FunctionEntry> procedureInventory;
    private List<InventoryItem> stringInventory;
    private DecompInterface decompiler;
+    private final ReaGhidraExtensions analysisExtensions = new ReaGhidraExtensions();
    private static AddressSpace sessionDefaultAddressSpace;

    @Override
@@ -152,12 +162,24 @@ public final class ReaGhidraBridge extends HeadlessScript {
        }
        Path descriptorPath = Path.of(arguments[0]);
        SessionDescriptor descriptor = readDescriptor(descriptorPath);
-        Files.deleteIfExists(descriptorPath);
+        // Windows retains a native immutable bearer descriptor lease until
+        // runtime_close; POSIX removes it after this read. Normal cleanup removes
+        // the Windows file, while abrupt owner death can leave private residue.
+        // Its protected runtime DACL also protects the bearer token while the
+        // bridge is running. POSIX keeps its existing consume-and-delete flow.
+        if (!isWindowsHost()) {
+            Files.deleteIfExists(descriptorPath);
+        }
        if (currentProgram == null) {
            throw new IllegalStateException("REA bridge requires an imported program");
        }
        sessionDefaultAddressSpace =
            currentProgram.getAddressFactory().getDefaultAddressSpace();
+        if (currentProgram.getExecutableFormat().equals("Raw Binary") &&
+            !currentProgram.getOptions(ghidra.program.model.listing.Program.PROGRAM_INFO)
+                .getBoolean("REA DOS COM prepared", false)) {
+            throw new IllegalStateException("REA DOS COM entry/context preparation failed");
+        }
        if (!Application.getApplicationVersion().equals(descriptor.providerVersion)) {
            throw new IllegalStateException("Ghidra provider version does not match the session");
        }
@@ -171,7 +193,13 @@ public final class ReaGhidraBridge extends HeadlessScript {
                "Ghidra imported-byte digest does not match the admitted target"
            );
        }
+        // GhidraScript wraps run() in a transaction. End it before serving so
+        // each edit owns a real outer transaction and can roll back immediately.
+        end(true);
        try {
+            if (!descriptor.transport.equals("unix-socket") && descriptor.analysisExtensions.size() > 0)
+                throw new IOException("Windows Ghidra P0 does not admit metadata recovery or database mutation.");
+            analysisExtensions.analyze(descriptor.analysisExtensions, currentProgram, monitor);
            initializeDecompiler();
            serve(descriptor);
        }
@@ -180,6 +208,7 @@ public final class ReaGhidraBridge extends HeadlessScript {
                decompiler.dispose();
                decompiler = null;
            }
+            analysisExtensions.close();
        }
    }

@@ -219,18 +248,23 @@ public final class ReaGhidraBridge extends HeadlessScript {
            JsonObject endpoint = new JsonObject();
            endpoint.addProperty("host", "127.0.0.1");
            endpoint.addProperty("port", address.getPort());
+            // The Windows native reader refuses a file while a writer still
+            // owns it. Closing CREATE_NEW publishes the complete record without
+            // requesting rename rights on the retained private directory guard.
            Files.writeString(
-                pendingPath,
+                isWindowsHost() ? endpointPath : pendingPath,
                GSON.toJson(endpoint) + "\n",
                StandardCharsets.UTF_8,
                StandardOpenOption.CREATE_NEW,
                StandardOpenOption.WRITE
            );
-            try {
-                Files.move(pendingPath, endpointPath, StandardCopyOption.ATOMIC_MOVE);
-            }
-            catch (AtomicMoveNotSupportedException exception) {
-                Files.move(pendingPath, endpointPath);
+            if (!isWindowsHost()) {
+                try {
+                    Files.move(pendingPath, endpointPath, StandardCopyOption.ATOMIC_MOVE);
+                }
+                catch (AtomicMoveNotSupportedException exception) {
+                    Files.move(pendingPath, endpointPath);
+                }
            }
            acceptClient(server, descriptor);
        }
@@ -240,6 +274,10 @@ public final class ReaGhidraBridge extends HeadlessScript {
        }
    }

+    private static boolean isWindowsHost() {
+        return System.getProperty("os.name", "").startsWith("Windows");
+    }
+
    private void acceptClient(
            ServerSocketChannel server,
            SessionDescriptor descriptor) throws Exception {
@@ -309,6 +347,9 @@ public final class ReaGhidraBridge extends HeadlessScript {
            );
        }
        return switch (request.method) {
+            case "inspect_native_load_image" -> inspectNativeLoadImage(request.params);
+            case "read_bytes" -> readMemoryBytes(request.params);
+            case "address_to_file_offset" -> addressToFileOffset(request.params);
            case "address_name" -> addressName(request.params);
            case "list_documents" -> listDocuments(request.params);
            case "list_names" -> listNames(request.params);
@@ -331,6 +372,11 @@ public final class ReaGhidraBridge extends HeadlessScript {
            case "resolve_native_call_targets" -> resolveNativeCallTargets(request.params);
            case "xrefs" -> xrefs(request.params);
            case "analyze_function" -> analyzeFunction(request.params);
+            case "annotate_native_function" -> {
+                if (!descriptor.transport.equals("unix-socket"))
+                    throw new RequestFailure("method_unavailable", "Windows P0 does not admit database mutation");
+                yield annotateNativeFunction(request.params);
+            }
            default -> throw new RequestFailure(
                "method_unavailable",
                "Bridge method is unavailable"
@@ -363,11 +409,217 @@ public final class ReaGhidraBridge extends HeadlessScript {
        result.addProperty("run_id", descriptor.runId);
        result.addProperty("profile_digest", descriptor.profileDigest);
        result.add("provider", provider);
-        result.addProperty("read_only", true);
+        boolean readOnly = !descriptor.transport.equals("unix-socket");
+        result.addProperty("read_only", readOnly);
        result.addProperty("analysis_complete", !timedOut);
        result.addProperty("analysis_timed_out", timedOut);
-        result.add("capabilities", GSON.toJsonTree(CAPABILITIES));
+        result.add("capabilities", GSON.toJsonTree(
+            java.util.Arrays.stream(CAPABILITIES)
+                .filter(value -> !readOnly || !value.equals("annotate_native_function"))
+                .toArray(String[]::new)
+        ));
        result.add("target", target);
+        JsonArray extensions = analysisExtensions.reports();
+        if (extensions.size() > 0) result.add("analysis_extensions", extensions);
+        return result;
+    }
+
+    private static String bytesHex(byte[] bytes) {
+        return java.util.HexFormat.of().formatHex(bytes);
+    }
+
+    private String hashFileBytes(FileBytes source, boolean modified) throws Exception {
+        MessageDigest digest = MessageDigest.getInstance("SHA-256");
+        byte[] chunk = new byte[65536];
+        for (long offset = 0; offset < source.getSize();) {
+            monitor.checkCancelled();
+            int length = (int) Math.min(chunk.length, source.getSize() - offset);
+            int read = modified
+                ? source.getModifiedBytes(offset, chunk, 0, length)
+                : source.getOriginalBytes(offset, chunk, 0, length);
+            if (read != length) throw new IOException("Incomplete FileBytes read at " + offset);
+            digest.update(chunk, 0, read);
+            offset += read;
+        }
+        return bytesHex(digest.digest());
+    }
+
+    private String hashMemory(Address start, long length) throws Exception {
+        MessageDigest digest = MessageDigest.getInstance("SHA-256");
+        byte[] chunk = new byte[65536];
+        for (long offset = 0; offset < length;) {
+            monitor.checkCancelled();
+            int count = (int) Math.min(chunk.length, length - offset);
+            int read = currentProgram.getMemory().getBytes(start.add(offset), chunk, 0, count);
+            if (read != count) throw new IOException("Incomplete memory read at " + start.add(offset));
+            digest.update(chunk, 0, read);
+            offset += read;
+        }
+        return bytesHex(digest.digest());
+    }
+
+    private JsonObject inspectNativeLoadImage(JsonObject params) throws Exception {
+        requireKeys(params, Set.of());
+        JsonObject result = new JsonObject();
+        JsonArray recovery = analysisExtensions.inspectImage();
+        if (recovery.size() > 0) result.add("metadata_recovery", recovery);
+        result.addProperty("executable_format", currentProgram.getExecutableFormat());
+        result.addProperty("language_id", currentProgram.getLanguageID().getIdAsString());
+        result.addProperty("compiler_spec_id", currentProgram.getCompilerSpec().getCompilerSpecID().getIdAsString());
+        result.addProperty("image_base", canonicalAddress(currentProgram.getImageBase()));
+        result.addProperty("default_address_space", sessionDefaultAddressSpace.getName());
+        List<FileBytes> files = currentProgram.getMemory().getAllFileBytes();
+        JsonArray sources = new JsonArray();
+        for (FileBytes file : files) {
+            JsonObject source = new JsonObject();
+            source.addProperty("name", file.getFilename());
+            source.addProperty("size", file.getSize());
+            source.addProperty("original_sha256", hashFileBytes(file, false));
+            source.addProperty("modified_sha256", hashFileBytes(file, true));
+            sources.add(source);
+        }
+        result.add("source_files", sources);
+        JsonArray mappings = new JsonArray();
+        for (MemoryBlock block : currentProgram.getMemory().getBlocks()) {
+            for (MemoryBlockSourceInfo source : block.getSourceInfos()) {
+                monitor.checkCancelled();
+                JsonObject mapping = new JsonObject();
+                mapping.addProperty("block", block.getName());
+                mapping.addProperty("start", canonicalAddress(source.getMinAddress()));
+                mapping.addProperty("end", canonicalAddress(source.getMaxAddress()));
+                mapping.addProperty("address_space", source.getMinAddress().getAddressSpace().getName());
+                mapping.addProperty("initialized", block.isInitialized());
+                mapping.addProperty("loaded", block.isLoaded());
+                mapping.addProperty("overlay", block.isOverlay());
+                mapping.addProperty("length", source.getLength());
+                FileBytes backing = source.getFileBytes().orElse(null);
+                int sourceIndex = backing == null ? -1 : files.indexOf(backing);
+                if (sourceIndex < 0) mapping.add("source_file_index", JsonNull.INSTANCE);
+                else mapping.addProperty("source_file_index", sourceIndex);
+                long offset = source.getFileBytesOffset();
+                if (offset < 0) mapping.add("file_offset", JsonNull.INSTANCE);
+                else mapping.addProperty("file_offset", offset);
+                if (block.isInitialized()) mapping.addProperty("sha256", hashMemory(source.getMinAddress(), source.getLength()));
+                else mapping.add("sha256", JsonNull.INSTANCE);
+                mappings.add(mapping);
+            }
+        }
+        result.add("mappings", mappings);
+        JsonArray relocations = new JsonArray();
+        Iterator<Relocation> iterator = currentProgram.getRelocationTable().getRelocations();
+        while (iterator.hasNext()) {
+            monitor.checkCancelled();
+            Relocation relocation = iterator.next();
+            Address location = relocation.getAddress();
+            JsonObject row = new JsonObject();
+            row.addProperty("address", canonicalAddress(location));
+            if (location instanceof SegmentedAddress segmented) {
+                row.addProperty("segment", segmented.getSegment());
+                row.addProperty("offset", segmented.getSegmentOffset());
+            } else {
+                row.add("segment", JsonNull.INSTANCE);
+                row.add("offset", JsonNull.INSTANCE);
+            }
+            row.addProperty("status", relocation.getStatus().toString());
+            row.addProperty("type", relocation.getType());
+            row.add("values", GSON.toJsonTree(relocation.getValues() == null ? new long[0] : relocation.getValues()));
+            byte[] original = relocation.getBytes();
+            row.add("original_bytes_hex", original == null ? JsonNull.INSTANCE : GSON.toJsonTree(bytesHex(original)));
+            if (original != null && original.length > 0) {
+                byte[] memory = new byte[original.length];
+                int read = currentProgram.getMemory().getBytes(location, memory);
+                row.add("memory_bytes_hex", read == memory.length ? GSON.toJsonTree(bytesHex(memory)) : JsonNull.INSTANCE);
+            } else row.add("memory_bytes_hex", JsonNull.INSTANCE);
+            relocations.add(row);
+        }
+        result.add("relocations", relocations);
+        List<Address> entries = new ArrayList<>();
+        var entryIterator = currentProgram.getSymbolTable().getExternalEntryPointIterator();
+        while (entryIterator.hasNext()) entries.add(entryIterator.next());
+        entries.sort(Address::compareTo);
+        JsonArray entryPoints = new JsonArray();
+        for (Address entry : entries) entryPoints.add(canonicalAddress(entry));
+        result.add("entry_points", entryPoints);
+        JsonArray contexts = new JsonArray();
+        for (Address entry : entries) {
+            JsonObject context = new JsonObject();
+            context.addProperty("address", canonicalAddress(entry));
+            JsonArray registers = new JsonArray();
+            for (String name : new String[] { "CS", "DS", "ES", "SS" }) {
+                Register register = currentProgram.getRegister(name);
+                if (register == null) continue;
+                JsonObject row = new JsonObject();
+                row.addProperty("name", name);
+                BigInteger value = currentProgram.getProgramContext().getValue(register, entry, false);
+                row.add("value_hex", value == null ? JsonNull.INSTANCE : GSON.toJsonTree("0x" + value.toString(16)));
+                registers.add(row);
+            }
+            context.add("registers", registers);
+            contexts.add(context);
+        }
+        result.add("entry_context", contexts);
+        return result;
+    }
+
+    private JsonObject readMemoryBytes(JsonObject params) throws Exception {
+        requireKeys(params, Set.of("document", "address", "length"));
+        requireDocument(params);
+        Address start = requireAddress(params, "address");
+        JsonElement requested = params.get("length");
+        long length;
+        try {
+            if (requested == null || !requested.isJsonPrimitive() || !requested.getAsJsonPrimitive().isNumber())
+                throw new IllegalArgumentException();
+            length = requested.getAsBigDecimal().longValueExact();
+            if (length < 1 || length > 9007199254740991L) throw new IllegalArgumentException();
+        } catch (RuntimeException failure) {
+            throw new RequestFailure("invalid_request", "Byte length must be a positive safe integer");
+        }
+        ByteArrayOutputStream bytes = new ByteArrayOutputStream();
+        byte[] chunk = new byte[65536];
+        for (long offset = 0; offset < length;) {
+            monitor.checkCancelled();
+            Address at;
+            try { at = start.addNoWrap(offset); }
+            catch (Exception endOfSpace) { break; }
+            MemoryBlock block = currentProgram.getMemory().getBlock(at);
+            if (block == null || !block.isInitialized()) break;
+            int count = (int) Math.min(chunk.length, Math.min(length - offset, block.getEnd().subtract(at) + 1));
+            int read = currentProgram.getMemory().getBytes(at, chunk, 0, count);
+            bytes.write(chunk, 0, read);
+            if (read != count) break;
+            offset += read;
+        }
+        JsonObject result = new JsonObject();
+        result.addProperty("address", canonicalAddress(start));
+        result.addProperty("requested_bytes", length);
+        result.addProperty("returned_bytes", bytes.size());
+        result.addProperty("bytes_hex", bytesHex(bytes.toByteArray()));
+        result.addProperty("complete", bytes.size() == length);
+        return result;
+    }
+
+    private JsonObject addressToFileOffset(JsonObject params) {
+        requireKeys(params, Set.of("document", "address"));
+        requireDocument(params);
+        Address address = requireAddress(params, "address");
+        MemoryBlock block = currentProgram.getMemory().getBlock(address);
+        if (block == null || !block.isInitialized())
+            throw new RequestFailure("invalid_request", "Address has no initialized file-backed memory: " + canonicalAddress(address));
+        Long fileOffset = null;
+        int mappings = 0;
+        for (MemoryBlockSourceInfo source : block.getSourceInfos()) {
+            if (!source.contains(address) || source.getFileBytes().isEmpty()) continue;
+            long offset = source.getFileBytesOffset(address);
+            if (offset < 0) continue;
+            fileOffset = offset;
+            mappings++;
+        }
+        if (mappings != 1)
+            throw new RequestFailure("invalid_request", "Address has " + mappings + " authoritative source mappings: " + canonicalAddress(address));
+        JsonObject result = new JsonObject();
+        result.addProperty("address", canonicalAddress(address));
+        result.addProperty("file_offset", fileOffset);
        return result;
    }

@@ -579,6 +831,10 @@ public final class ReaGhidraBridge extends HeadlessScript {
        result.addProperty("total_fields", totalFields);
        result.addProperty("truncated", totalFields > 20_000);
        result.add("limitations", GSON.toJsonTree(List.of("Layouts are Ghidra data-type database observations; original debug/source authority and flexible-tail semantics are not inferred. Nested and recursive types retain category-path identities for separate inspection.", "At most 20000 fields or enum members are serialized per type to bound provider output. total_fields and truncated report omissions. Enum values preserve Ghidra's signed long representation.")));
+        if (type != null) {
+            JsonObject metadata = analysisExtensions.inspectDataType(currentProgram, type, address, monitor);
+            if (metadata != null) result.add("metadata_recovery", metadata);
+        }
        return result;
    }

@@ -725,6 +981,90 @@ public final class ReaGhidraBridge extends HeadlessScript {
        return result;
    }

+    private void invalidateAnalysisCaches() {
+        nameInventory = null;
+        procedureInventory = null;
+        stringInventory = null;
+        if (decompiler != null) decompiler.flushCache();
+    }
+
+    private JsonObject annotationReadback(Function function) {
+        Address entry = function.getEntryPoint();
+        JsonObject value = new JsonObject();
+        value.addProperty("address", canonicalAddress(entry));
+        value.addProperty("name", procedureName(function));
+        value.addProperty("comment", currentProgram.getListing().getComment(CommentType.PRE, entry));
+        value.addProperty("inline_comment", currentProgram.getListing().getComment(CommentType.EOL, entry));
+        return value;
+    }
+
+    private JsonObject annotateNativeFunction(JsonObject params) throws Exception {
+        if (!Set.of("procedure", "name", "comment", "inline_comment").containsAll(params.keySet()))
+            throw new RequestFailure("invalid_request", "Unknown function annotation field");
+        if (!params.has("name") && !params.has("comment") && !params.has("inline_comment"))
+            throw new RequestFailure("invalid_request", "Supply at least one annotation change");
+        Function function = resolveProcedure(requireString(params, "procedure"));
+        Address entry = function.getEntryPoint();
+        if (function.isExternal() || !currentProgram.getMemory().contains(entry))
+            throw new RequestFailure("invalid_request", "Annotations require a local function entry: " + canonicalAddress(entry));
+        int transaction = currentProgram.startTransaction("REA function annotations");
+        boolean commit = false;
+        try {
+            // Validate edits through Ghidra's own setters, including name rules.
+            // A later invalid name must roll back earlier comment writes.
+            for (String field : List.of("comment", "inline_comment")) {
+                if (params.has(field)) {
+                    String text = requireText(params, field);
+                    CommentType type = field.equals("comment") ? CommentType.PRE : CommentType.EOL;
+                    currentProgram.getListing().setComment(entry, type, text.isEmpty() ? null : text);
+                }
+            }
+            if (params.has("name"))
+                function.setName(requireString(params, "name"), SourceType.USER_DEFINED);
+            monitor.checkCancelled();
+            invalidateAnalysisCaches();
+            JsonObject readback = annotationReadback(function);
+            for (String field : List.of("name", "comment", "inline_comment")) {
+                if (!params.has(field)) continue;
+                String requested = requireText(params, field);
+                JsonElement measured = readback.get(field);
+                String expected = !field.equals("name") && requested.isEmpty() ? null : requested;
+                String observed = field.equals("name") ? function.getName() :
+                    (measured.isJsonNull() ? null : measured.getAsString());
+                if (!java.util.Objects.equals(expected, observed))
+                    throw new RequestFailure("annotation_readback_mismatch", "Annotation readback differs for " + field + " at " + canonicalAddress(entry));
+            }
+            JsonObject query = new JsonObject();
+            query.addProperty("procedure", canonicalAddress(entry));
+            JsonObject result = new JsonObject();
+            result.add("annotations", readback);
+            result.add("dossier", analyzeFunction(query));
+            JsonObject effects = new JsonObject();
+            effects.addProperty("scope", "session-analysis-database");
+            effects.addProperty("source_bytes_modified", false);
+            effects.addProperty("persists_after_close", false);
+            result.add("effects", effects);
+            monitor.checkCancelled();
+            commit = true;
+            return result;
+        }
+        catch (ghidra.util.exception.InvalidInputException | ghidra.util.exception.DuplicateNameException exception) {
+            throw new RequestFailure("invalid_function_name", "Invalid function name at " + canonicalAddress(entry) + ": " + safeMessage(exception));
+        }
+        finally {
+            currentProgram.endTransaction(transaction, commit);
+            // Rollback also invalidates inventory and decompiler views.
+            invalidateAnalysisCaches();
+        }
+    }
+
+    private static String requireText(JsonObject params, String field) {
+        JsonElement value = params.get(field);
+        if (value == null || !value.isJsonPrimitive() || !value.getAsJsonPrimitive().isString())
+            throw new RequestFailure("invalid_request", "Annotation " + field + " must be text");
+        return value.getAsString();
+    }
+
    private JsonObject analyzeFunction(JsonObject params) throws Exception {
        requireKeys(params, Set.of("procedure"));
        Function function = resolveProcedure(requireString(params, "procedure"));
@@ -2724,10 +3064,11 @@ public final class ReaGhidraBridge extends HeadlessScript {
        if (!Files.isRegularFile(path, LinkOption.NOFOLLOW_LINKS)) {
            throw new IllegalArgumentException("REA session descriptor is invalid");
        }
-        JsonObject object = requireObject(
-            JsonParser.parseString(Files.readString(path, StandardCharsets.UTF_8)),
-            DESCRIPTOR_KEYS
-        );
+        JsonElement parsed = JsonParser.parseString(Files.readString(path, StandardCharsets.UTF_8));
+        Set<String> keys = new HashSet<>(DESCRIPTOR_KEYS);
+        if (parsed.isJsonObject() && parsed.getAsJsonObject().has("analysis_extensions"))
+            keys.add("analysis_extensions");
+        JsonObject object = requireObject(parsed, keys);
        return new SessionDescriptor(
            requireString(object, "transport"),
            requireString(object, "endpoint_path"),
@@ -2735,7 +3076,8 @@ public final class ReaGhidraBridge extends HeadlessScript {
            requireString(object, "run_id"),
            requireSha256(object, "target_sha256"),
            requireString(object, "provider_version"),
-            requireString(object, "profile_digest")
+            requireString(object, "profile_digest"),
+            object.has("analysis_extensions") ? object.getAsJsonArray("analysis_extensions") : new JsonArray()
        );
    }

@@ -2919,7 +3261,8 @@ public final class ReaGhidraBridge extends HeadlessScript {
        String runId,
        String targetSha256,
        String providerVersion,
-        String profileDigest
+        String profileDigest,
+        JsonArray analysisExtensions
    ) {}
    private record Request(int id, String method, JsonObject params) {}

@@ -0,0 +1,113 @@
+import com.google.gson.JsonArray;
+import com.google.gson.JsonNull;
+import com.google.gson.JsonObject;
+import ghidra.program.model.address.Address;
+import ghidra.program.model.data.DataType;
+import ghidra.program.model.listing.Program;
+import ghidra.util.exception.CancelledException;
+import ghidra.util.task.TaskMonitor;
+import java.lang.reflect.InvocationTargetException;
+import java.net.URLClassLoader;
+import java.nio.file.Files;
+import java.nio.file.LinkOption;
+import java.nio.file.Path;
+import java.security.MessageDigest;
+import java.util.ArrayList;
+import java.util.List;
+
+/** Session-owned extension loading; analyzer algorithms stay behind each adapter ABI. */
+final class ReaGhidraExtensions implements AutoCloseable {
+    private record Loaded(URLClassLoader loader, Object instance, String sha256) {}
+    private final List<Loaded> loaded = new ArrayList<>();
+    private final JsonArray reports = new JsonArray();
+
+    void analyze(JsonArray descriptors, Program program, TaskMonitor monitor) throws Exception {
+        for (var item : descriptors) {
+            monitor.checkCancelled();
+            JsonObject descriptor = item.getAsJsonObject();
+            String id = descriptor.get("id").getAsString();
+            String entry = descriptor.get("entry_class").getAsString();
+            String digest = descriptor.get("sha256").getAsString();
+            JsonObject report = new JsonObject();
+            report.addProperty("id", id);
+            report.addProperty("sha256", digest);
+            URLClassLoader loader = null;
+            try {
+                if (!id.equals("nativeaot") || !entry.equals("rea.extensions.nativeaot.NativeAotExtension") ||
+                    descriptor.get("integration_api").getAsInt() != 1)
+                    throw new IllegalArgumentException("Unregistered Ghidra extension ABI: " + id);
+                Path path = Path.of(descriptor.get("path").getAsString());
+                if (!path.isAbsolute() || !Files.isRegularFile(path, LinkOption.NOFOLLOW_LINKS) || Files.size(path) > 8 * 1024 * 1024)
+                    throw new IllegalArgumentException("Invalid private extension artifact: " + path);
+                String measured = java.util.HexFormat.of().formatHex(MessageDigest.getInstance("SHA-256").digest(Files.readAllBytes(path)));
+                if (!measured.equals(digest)) throw new IllegalArgumentException("Private extension digest mismatch: " + id);
+                loader = new URLClassLoader(new java.net.URL[] { path.toUri().toURL() }, getClass().getClassLoader());
+                Class<?> type = Class.forName(entry, true, loader);
+                Object instance = type.getConstructor().newInstance();
+                Object response = type.getMethod("analyze", Program.class, TaskMonitor.class).invoke(instance, program, monitor);
+                if (!(response instanceof JsonObject result)) throw new IllegalArgumentException("Invalid Ghidra extension result: " + id);
+                report.addProperty("status", result.get("status").getAsString());
+                report.add("reason", result.get("reason").deepCopy());
+                report.add("result", result);
+                loaded.add(new Loaded(loader, instance, digest));
+                loader = null;
+            } catch (InvocationTargetException ex) {
+                if (ex.getCause() instanceof CancelledException cancelled) throw cancelled;
+                failure(report, ex.getCause());
+            } catch (Exception | LinkageError ex) {
+                failure(report, ex);
+            } finally {
+                if (loader != null) loader.close();
+            }
+            reports.add(report);
+        }
+    }
+
+    JsonArray reports() { return reports.deepCopy(); }
+
+    JsonArray inspectImage() throws Exception {
+        JsonArray summaries = new JsonArray();
+        for (Loaded extension : loaded) {
+            Object response = extension.instance.getClass().getMethod("inspectImage").invoke(extension.instance);
+            if (!(response instanceof JsonObject summary)) throw new IllegalArgumentException("Invalid extension image summary");
+            summary.addProperty("analysis_artifact_sha256", extension.sha256);
+            summaries.add(summary);
+        }
+        return summaries;
+    }
+
+    JsonObject inspectDataType(Program program, DataType type, Address address, TaskMonitor monitor) throws Exception {
+        for (Loaded extension : loaded) {
+            try {
+                Object response = extension.instance.getClass().getMethod("inspectDataType", Program.class, DataType.class, Address.class, TaskMonitor.class)
+                    .invoke(extension.instance, program, type, address, monitor);
+                if (response instanceof JsonObject result) return result;
+                if (response != null) throw new IllegalArgumentException("Invalid extension type metadata result");
+            } catch (InvocationTargetException ex) {
+                if (ex.getCause() instanceof CancelledException cancelled) throw cancelled;
+                throw new IllegalStateException("Ghidra extension type inspection failed: " + ex.getCause(), ex.getCause());
+            }
+        }
+        return null;
+    }
+
+    private static void failure(JsonObject report, Throwable ex) {
+        String reason = "Extension loading/analysis failed: " + ex;
+        if (ex.getCause() != null) reason += "; caused by " + ex.getCause();
+        report.addProperty("status", "failed");
+        report.addProperty("reason", reason);
+        JsonObject result = new JsonObject();
+        result.addProperty("loader_failure", reason);
+        report.add("result", result);
+    }
+
+    @Override public void close() throws Exception {
+        Exception failure = null;
+        for (Loaded extension : loaded) {
+            try { extension.loader.close(); }
+            catch (Exception ex) { if (failure == null) failure = ex; else failure.addSuppressed(ex); }
+        }
+        loaded.clear();
+        if (failure != null) throw failure;
+    }
+}
@@ -0,0 +1,32 @@
+import ghidra.app.script.GhidraScript;
+import ghidra.program.model.address.Address;
+import ghidra.program.model.listing.Program;
+import java.math.BigInteger;
+
+/** Seed the declared DOS COM analysis context before default auto-analysis. */
+public final class ReaGhidraPrepareCom extends GhidraScript {
+    @Override
+    public void run() throws Exception {
+        if (!currentProgram.getLanguageID().getIdAsString().equals("x86:LE:16:Real Mode") ||
+            !currentProgram.getExecutableFormat().equals("Raw Binary")) {
+            throw new IllegalArgumentException("DOS COM preparation requires raw x86 real-mode import");
+        }
+        Address entry = currentProgram.getAddressFactory().getDefaultAddressSpace().getAddress("1000:0100");
+        Address start = currentProgram.getMinAddress();
+        Address end = currentProgram.getMaxAddress();
+        if (!entry.equals(start) || end.subtract(start) + 1 > 0xff00) {
+            throw new IllegalArgumentException("DOS COM import must map 1..65280 bytes at 1000:0100");
+        }
+        for (String name : new String[] { "CS", "DS", "ES", "SS" }) {
+            monitor.checkCancelled();
+            currentProgram.getProgramContext().setValue(
+                currentProgram.getRegister(name), start, end, BigInteger.valueOf(0x1000)
+            );
+        }
+        addEntryPoint(entry);
+        if (!disassemble(entry) || createFunction(entry, "entry") == null) {
+            throw new IllegalStateException("DOS COM entry cannot be decoded as a function");
+        }
+        currentProgram.getOptions(Program.PROGRAM_INFO).setBoolean("REA DOS COM prepared", true);
+    }
+}
@@ -0,0 +1,70 @@
+package rea.extensions.nativeaot;
+
+import ghidra.app.util.importer.MessageLog;
+import ghidra.program.model.address.Address;
+import ghidra.program.model.listing.Program;
+import ghidra.util.task.TaskMonitor;
+import java.util.LinkedHashSet;
+import nativeaot.rtr.ReadyToRunDirectory;
+import nativeaot.rtr.ReadyToRunSection;
+import nativeaot.rtr.SignatureReadyToRunLocator;
+import nativeaot.rtr.SymbolReadyToRunLocator;
+
+/** Validate the producer's NativeAOT row layout before database mutation. */
+final class NativeAotDirectory {
+    record Located(Address address, ReadyToRunDirectory directory, String discovery) {}
+
+    static Located locate(Program program, TaskMonitor monitor, MessageLog log) throws Exception {
+        Address[] symbols = SymbolReadyToRunLocator.instance.locateModules(program, monitor, log);
+        String discovery = symbols.length == 0 ? "signature-heuristic" : "symbol";
+        Address[] found = symbols.length == 0
+            ? SignatureReadyToRunLocator.instance.locateModules(program, monitor, log) : symbols;
+        var candidates = new LinkedHashSet<Address>();
+        for (Address address : found) if (address.getOffset() != 0) candidates.add(address);
+        if (candidates.isEmpty()) return null;
+        if (candidates.size() != 1)
+            throw new UnsupportedOperationException("Ambiguous NativeAOT directory candidates: " + candidates);
+        Address address = candidates.iterator().next();
+        var memory = program.getMemory();
+        byte[] header = new byte[16];
+        if (memory.getBytes(address, header) != header.length)
+            throw new IllegalArgumentException("Incomplete NativeAOT header at " + address);
+        int count = Short.toUnsignedInt(memory.getShort(address.add(12)));
+        if (count < 1 || count > 80 || Byte.toUnsignedInt(header[14]) != 24 || header[15] != 1)
+            throw new UnsupportedOperationException("Unsupported NativeAOT row layout at " + address +
+                ": sections=" + count + ", entry_size=" + Byte.toUnsignedInt(header[14]) + ", entry_type=" + Byte.toUnsignedInt(header[15]));
+        byte[] rows = new byte[count * 24];
+        if (memory.getBytes(address.add(16), rows) != rows.length)
+            throw new IllegalArgumentException("Incomplete NativeAOT directory rows at " + address);
+        ReadyToRunDirectory directory = ReadyToRunDirectory.readAtAddress(program, address);
+        if (directory.getMajorVersion() != 9 || directory.getMinorVersion() != 1)
+            throw new UnsupportedOperationException("Unsupported NativeAOT RTR format " +
+                directory.getMajorVersion() + "." + directory.getMinorVersion() + " at " + address + "; verified format is 9.1 (.NET 8.0.22 Linux x64 fixture).");
+        var types = new LinkedHashSet<Integer>();
+        for (ReadyToRunSection section : directory.getSections()) {
+            monitor.checkCancelled();
+            if (!types.add(section.getType())) throw new IllegalArgumentException("Duplicate NativeAOT section " + section.getType() + " at " + address);
+            // ModuleInfoRow flags bit 0 declares an end pointer. ThreadStaticIndex
+            // (204) is a single-address entry with flags=0 and an absent end.
+            if (section.getFlags() != 0 && section.getFlags() != 1)
+                throw new UnsupportedOperationException("Unsupported NativeAOT section flags " + section.getFlags() + " for section " + section.getType());
+            boolean hasEnd = section.getFlags() == 1;
+            if (!hasEnd && section.getEnd() != 0)
+                throw new IllegalArgumentException("NativeAOT single-address section " + section.getType() + " reports an unexpected end");
+            if (hasEnd && Long.compareUnsigned(section.getStart(), section.getEnd()) > 0)
+                throw new IllegalArgumentException("Reversed NativeAOT section " + section.getType() + " at " + address);
+            if (section.getStart() != 0 && (!hasEnd || section.getStart() != section.getEnd()) &&
+                (!memory.contains(address.getNewAddress(section.getStart())) ||
+                 (hasEnd && !memory.contains(address.getNewAddress(section.getEnd() - 1)))))
+                throw new IllegalArgumentException("Unmapped NativeAOT section " + section.getType() + " at " + address);
+        }
+        if (directory.getSectionByType(ReadyToRunSection.DEHYDRATED_DATA) == null)
+            throw new UnsupportedOperationException("NativeAOT directory at " + address + " has no DEHYDRATED_DATA; non-dehydrated layouts are not verified.");
+        for (int type : new int[] { ReadyToRunSection.DEHYDRATED_DATA, ReadyToRunSection.FROZEN_OBJECT_REGION }) {
+            ReadyToRunSection section = directory.getSectionByType(type);
+            if (section != null && section.getFlags() != 1)
+                throw new IllegalArgumentException("NativeAOT section " + type + " requires an end pointer");
+        }
+        return new Located(address, directory, discovery);
+    }
+}
@@ -0,0 +1,183 @@
+package rea.extensions.nativeaot;
+
+import com.google.gson.JsonArray;
+import com.google.gson.JsonNull;
+import com.google.gson.JsonObject;
+import ghidra.app.util.importer.MessageLog;
+import ghidra.program.model.address.Address;
+import ghidra.program.model.address.AddressSet;
+import ghidra.program.model.data.DataType;
+import ghidra.program.model.listing.Program;
+import ghidra.util.exception.CancelledException;
+import ghidra.util.task.TaskMonitor;
+import nativeaot.objectmodel.FrozenObjectAnnotator;
+import nativeaot.objectmodel.MethodTableCrawler;
+import nativeaot.objectmodel.MethodTableManager;
+import nativeaot.rehydration.MetadataRehydratorNet80;
+import nativeaot.rtr.ReadyToRunSection;
+import java.util.ArrayList;
+import java.util.List;
+import java.security.MessageDigest;
+
+/** Optional headless facade over the unchanged upstream analysis primitives. */
+public final class NativeAotExtension {
+    private MethodTableManager manager;
+    private NativeAotDirectory.Located located;
+    private JsonObject report;
+    private final List<String> diagnostics = new ArrayList<>();
+    private JsonObject derivedRange;
+
+    public JsonObject analyze(Program program, TaskMonitor monitor) throws Exception {
+        report = new JsonObject();
+        report.addProperty("id", "nativeaot");
+        report.addProperty("integration_api", 1);
+        report.addProperty("source_revision", "effeb734fc570c32650f88b159608979dc7b423e");
+        report.addProperty("source_revision_authority", "build-reported-unattested");
+        report.addProperty("status", "not_applicable");
+        report.addProperty("reason", "No NativeAOT directory with the supported row layout was found.");
+        report.addProperty("method_tables", 0);
+        if (!program.getLanguageID().getIdAsString().startsWith("x86:LE:64"))
+            return failure("unsupported", "NativeAOT adapter supports x86-64 only.");
+        MessageLog log = new MessageLog();
+        int transaction = program.startTransaction("REA NativeAOT metadata recovery");
+        boolean commit = false;
+        String stage = "directory-discovery";
+        try {
+            located = NativeAotDirectory.locate(program, monitor, log);
+            if (located == null) return finish(log);
+            report.addProperty("header_address", address(located.address()));
+            report.addProperty("discovery", located.discovery());
+            report.addProperty("format_major", located.directory().getMajorVersion());
+            report.addProperty("format_minor", located.directory().getMinorVersion());
+            stage = "metadata-rehydration";
+            var section = located.directory().getSectionByType(ReadyToRunSection.DEHYDRATED_DATA);
+            Address start = located.address().getNewAddress(section.getStart());
+            Address end = located.address().getNewAddress(section.getEnd());
+            if (start.compareTo(end) >= 0) throw new IllegalArgumentException("Empty dehydrated section at " + start);
+            var scan = new MetadataRehydratorNet80().rehydrate(program, new AddressSet(start, end).getFirstRange(), monitor, log);
+            // Upstream reports an inclusive end at base + written length.
+            long writtenLength = scan.getScanningRange().getLength() - 1;
+            derivedRange = new JsonObject();
+            derivedRange.addProperty("address", address(scan.getScanningRange().getMinAddress()));
+            derivedRange.addProperty("size_bytes", writtenLength);
+            derivedRange.addProperty("sha256", hashMemory(program, scan.getScanningRange().getMinAddress(), writtenLength, monitor));
+            derivedRange.add("file_offset", JsonNull.INSTANCE);
+            stage = "method-table-recovery";
+            manager = MethodTableManager.createForDirectory(program, located.directory());
+            var conventions = NativeAotMethodConventions.capture(program, monitor);
+            new MethodTableCrawler(manager, program, scan).analyze(monitor, log);
+            stage = "calling-convention-preservation";
+            NativeAotMethodConventions.restore(program, manager, conventions, monitor);
+            log.appendMsg("REA", "Preserved pre-recovery calling conventions; new functions use the loaded compiler specification default. Original method signatures remain unknown.");
+            if (manager.getObjectMT() == null || manager.getMethodTableCount() == 0)
+                throw new UnsupportedOperationException("No unambiguous System.Object method table was recovered at header " + located.address());
+            stage = "frozen-object-annotation";
+            if (manager.getStringMT() == null || scan.getPointerLocations().length == 0) {
+                diagnostics.add("Frozen-object annotation unavailable: System.String table or pointer locations were not recovered.");
+            } else {
+                new FrozenObjectAnnotator(program, manager).analyze(located.directory(), scan.getPointerLocations(), monitor, log);
+            }
+            monitor.checkCancelled();
+            report.addProperty("method_tables", manager.getMethodTableCount());
+            JsonObject coverage = auditFrozenObjects(program, scan.getPointerLocations(), monitor);
+            report.add("coverage", coverage);
+            if (coverage.get("frozen_objects_annotated").getAsInt() != coverage.get("frozen_object_candidates").getAsInt())
+                diagnostics.add("Some frozen-object candidates lack committed instance annotations; inspect coverage counts and Ghidra diagnostics.");
+            report.addProperty("status", diagnostics.isEmpty() ? "complete" : "partial");
+            report.add("reason", JsonNull.INSTANCE);
+            report.add("derived_memory", derivedRange.deepCopy());
+            JsonArray tables = new JsonArray();
+            for (var mt : manager.getMethodTables()) {
+                monitor.checkCancelled();
+                JsonObject identity = new JsonObject();
+                identity.addProperty("address", address(mt.getAddress()));
+                identity.addProperty("type", mt.getMTType().getPathName());
+                tables.add(identity);
+            }
+            report.add("types", tables);
+            commit = true;
+            return finish(log);
+        } catch (CancelledException ex) {
+            manager = null;
+            throw ex;
+        } catch (Exception ex) {
+            manager = null;
+            diagnostics.add(stage + ": " + ex.getClass().getSimpleName() + ": " + ex.getMessage());
+            report.addProperty("status", ex instanceof UnsupportedOperationException ? "unsupported" : "failed");
+            report.addProperty("reason", stage + ": " + ex.getMessage());
+            return finish(log);
+        } finally {
+            program.endTransaction(transaction, commit);
+        }
+    }
+
+    /** Inline discovery for the existing loaded-image inspection. */
+    public JsonObject inspectImage() {
+        JsonObject summary = new JsonObject();
+        summary.addProperty("format", "dotnet-nativeaot");
+        for (String key : new String[] { "status", "reason", "header_address", "discovery", "format_major", "format_minor", "method_tables", "derived_memory", "coverage", "diagnostics" })
+            summary.add(key, report.has(key) ? report.get(key).deepCopy() : JsonNull.INSTANCE);
+        summary.add("types", report.has("types") ? report.get("types").deepCopy() : new JsonArray());
+        JsonArray limitations = new JsonArray();
+        limitations.add("Recovery covers the reported metadata candidates; it does not reconstruct original C# source, custom field layouts, every runtime object, or execution behavior.");
+        limitations.add("Method prototypes and parameter names remain Ghidra inferences; verify them against instructions and call sites. Pre-recovery conventions are retained rather than universally forcing __thiscall.");
+        limitations.add("NativeAOT type identities and relationships are inferred; generated names are not original names. Derived memory has no original file offsets.");
+        summary.add("limitations", limitations);
+        return summary;
+    }
+
+    /** Read recovered relationships without restoring or mutating database state. */
+    public JsonObject inspectDataType(Program program, DataType type, Address selected, TaskMonitor monitor) throws Exception {
+        if (manager == null) return null;
+        return NativeAotTypeMetadata.describe(program, manager, located, type, report, derivedRange, monitor);
+    }
+
+    private JsonObject auditFrozenObjects(Program program, Address[] pointerLocations, TaskMonitor monitor) throws Exception {
+        JsonObject coverage = new JsonObject();
+        int candidates = 0, annotated = 0;
+        var section = located.directory().getSectionByType(ReadyToRunSection.FROZEN_OBJECT_REGION);
+        if (section != null) for (Address location : section.getPointersInSection(pointerLocations)) {
+            monitor.checkCancelled();
+            var table = manager.getMethodTable(program.getMemory().getLong(location));
+            if (table == null) continue;
+            candidates++;
+            var expected = table.getInstanceType();
+            var actual = program.getListing().getDataAt(location);
+            if (expected != null && actual != null && actual.getDataType().getPathName().equals(expected.getPathName())) annotated++;
+        }
+        coverage.addProperty("frozen_object_candidates", candidates);
+        coverage.addProperty("frozen_objects_annotated", annotated);
+        coverage.addProperty("basis", "rehydrated-pointer-candidates-and-committed-instance-types");
+        return coverage;
+    }
+
+    private JsonObject finish(MessageLog log) {
+        if (!log.toString().isBlank()) diagnostics.add(log.toString());
+        JsonArray messages = new JsonArray();
+        for (String message : diagnostics) messages.add(message);
+        report.add("diagnostics", messages);
+        return report;
+    }
+
+    private JsonObject failure(String status, String reason) {
+        report.addProperty("status", status);
+        report.addProperty("reason", reason);
+        return finish(new MessageLog());
+    }
+
+    static String address(Address value) { return "0x" + Long.toUnsignedString(value.getOffset(), 16); }
+
+    private static String hashMemory(Program program, Address start, long length, TaskMonitor monitor) throws Exception {
+        MessageDigest digest = MessageDigest.getInstance("SHA-256");
+        byte[] buffer = new byte[65536];
+        for (long offset = 0; offset < length;) {
+            monitor.checkCancelled();
+            int count = (int)Math.min(buffer.length, length - offset);
+            if (program.getMemory().getBytes(start.add(offset), buffer, 0, count) != count)
+                throw new IllegalStateException("Incomplete derived-memory read at " + start.add(offset));
+            digest.update(buffer, 0, count);
+            offset += count;
+        }
+        return java.util.HexFormat.of().formatHex(digest.digest());
+    }
+}
@@ -0,0 +1,38 @@
+package rea.extensions.nativeaot;
+
+import ghidra.program.model.address.Address;
+import ghidra.program.model.listing.Program;
+import ghidra.util.task.TaskMonitor;
+import nativeaot.objectmodel.MethodTableManager;
+import java.util.HashMap;
+import java.util.HashSet;
+import java.util.Map;
+
+/** Keep upstream's unconditional __thiscall assignment out of x64 ABI evidence. */
+final class NativeAotMethodConventions {
+    static Map<Address, String> capture(Program program, TaskMonitor monitor) throws Exception {
+        Map<Address, String> result = new HashMap<>();
+        var functions = program.getFunctionManager().getFunctions(true);
+        while (functions.hasNext()) {
+            monitor.checkCancelled();
+            var function = functions.next();
+            result.put(function.getEntryPoint(), function.getCallingConventionName());
+        }
+        return result;
+    }
+
+    static void restore(Program program, MethodTableManager manager, Map<Address, String> previous, TaskMonitor monitor) throws Exception {
+        var visited = new HashSet<Address>();
+        String defaultConvention = program.getCompilerSpec().getDefaultCallingConvention().getName();
+        for (var table : manager.getMethodTables()) for (long target : table.getVTable()) {
+            monitor.checkCancelled();
+            Address address = table.getAddress().getNewAddress(target);
+            if (!visited.add(address)) continue;
+            var function = program.getFunctionManager().getFunctionAt(address);
+            if (function == null) continue;
+            String convention = previous.containsKey(address) ? previous.get(address) : defaultConvention;
+            if (!java.util.Objects.equals(function.getCallingConventionName(), convention))
+                function.setCallingConvention(convention);
+        }
+    }
+}
@@ -0,0 +1,70 @@
+package rea.extensions.nativeaot;
+
+import com.google.gson.JsonArray;
+import com.google.gson.JsonNull;
+import com.google.gson.JsonObject;
+import ghidra.program.model.data.DataType;
+import ghidra.program.model.listing.Program;
+import ghidra.util.task.TaskMonitor;
+import nativeaot.objectmodel.MethodTable;
+import nativeaot.objectmodel.MethodTableManager;
+
+/** Translate a selected recovered type into provider-neutral metadata evidence. */
+final class NativeAotTypeMetadata {
+    static JsonObject describe(Program program, MethodTableManager manager, NativeAotDirectory.Located located,
+        DataType type, JsonObject report, JsonObject derivedRange, TaskMonitor monitor) throws Exception {
+        for (MethodTable table : manager.getMethodTables()) {
+            monitor.checkCancelled();
+            boolean sameType = type.getPathName().equals(table.getMTType().getPathName()) ||
+                (table.getInstanceType() != null && type.getPathName().equals(table.getInstanceType().getPathName()));
+            if (!sameType) continue;
+            JsonObject result = new JsonObject();
+            result.addProperty("format", "dotnet-nativeaot");
+            result.addProperty("status", report.get("status").getAsString());
+            result.addProperty("header_address", NativeAotExtension.address(located.address()));
+            result.addProperty("format_major", located.directory().getMajorVersion());
+            result.addProperty("format_minor", located.directory().getMinorVersion());
+            result.addProperty("method_table_address", NativeAotExtension.address(table.getAddress()));
+            result.addProperty("name_origin", table == manager.getObjectMT() || table == manager.getStringMT() ? "inferred" : "generated");
+            result.add("original_name", JsonNull.INSTANCE);
+            result.addProperty("base_size_bytes", table.getBaseSize());
+            result.add("related_type", identity(manager, table.getRelatedTypeAddress()));
+            JsonArray interfaces = new JsonArray();
+            for (long value : table.getInterfaceAddresses()) if (value != 0) interfaces.add(identity(manager, value));
+            result.add("interfaces", interfaces);
+            JsonArray slots = new JsonArray();
+            for (int slot = 0; slot < table.getVTableSlotCount(); slot++) {
+                monitor.checkCancelled();
+                long value = table.getVTableSlot(slot);
+                JsonObject target = new JsonObject();
+                target.addProperty("slot", slot);
+                target.addProperty("slot_address", NativeAotExtension.address(table.getAddress().add(24 + slot * 8L)));
+                target.add("target_address", value == 0 ? JsonNull.INSTANCE : new com.google.gson.JsonPrimitive("0x" + Long.toUnsignedString(value, 16)));
+                var function = value == 0 ? null : program.getFunctionManager().getFunctionAt(table.getAddress().getNewAddress(value));
+                target.add("procedure_name", function == null ? JsonNull.INSTANCE : new com.google.gson.JsonPrimitive(function.getName(true)));
+                target.addProperty("basis", "method-table-pointer");
+                slots.add(target);
+            }
+            result.add("virtual_slots", slots);
+            result.add("derived_memory", derivedRange.deepCopy());
+            result.add("diagnostics", report.get("diagnostics").deepCopy());
+            JsonArray limitations = new JsonArray();
+            limitations.add("Type identities and relationships are recovered by upstream heuristics. Original source names and custom field layouts are not recovered.");
+            limitations.add("Method prototypes are inferred, not original signatures. REA preserves pre-recovery calling conventions and the loaded compiler default for new functions.");
+            limitations.add("Rehydrated metadata bytes are derived analysis-memory content; their original file offsets and runtime behavior remain unknown.");
+            limitations.add("Verified workflow: .NET 8.0.22 NativeAOT RTR 9.1, Linux x64 ELF / Windows x64 PE on Linux; other runtime layouts and hosts are unverified.");
+            result.add("limitations", limitations);
+            return result;
+        }
+        return null;
+    }
+
+    private static com.google.gson.JsonElement identity(MethodTableManager manager, long value) throws Exception {
+        if (value == 0) return JsonNull.INSTANCE;
+        JsonObject result = new JsonObject();
+        result.addProperty("address", "0x" + Long.toUnsignedString(value, 16));
+        MethodTable table = manager.getMethodTable(value);
+        result.add("type", table == null ? JsonNull.INSTANCE : new com.google.gson.JsonPrimitive(table.getMTType().getPathName()));
+        return result;
+    }
+}
@@ -5,9 +5,12 @@
 - Implementation status: The provider registry, deterministic selection,
  target binding, analysis-profile commitment, and snapshot/Evidence migration
  are implemented. Ghidra discovery, target/profile resolution, doctor checks,
-  the private headless-session foundation, ten read-only inventory capabilities,
-  and twelve function-analysis capabilities are implemented with real
-  cross-format conformance.
+  the private headless-session foundation, thirteen read-only inventory/load-image
+  capabilities, and twelve function-analysis capabilities are implemented with
+  real cross-format conformance. Linux/macOS also supports atomic session
+  function annotations; experimental Windows x64 P0 uses bundled native controls
+  and admits only the 25 read-only operations. See the
+  [release boundary](../installation.md#released-package-and-main).

 ## Context

@@ -25,7 +28,7 @@ engine, engine version, or complete analysis configuration. Two analyses of the
 same bytes could therefore disagree because of language, compiler, loader,
 analyzer, or provider-version differences while appearing target-compatible.

-These constraints are embodied in the current
+The decision addressed the earlier representations of
 [`CompositeProvider`](../../src/application/CompositeProvider.ts),
 [runtime composition](../../src/application/runtime.ts),
 [`BinarySession`](../../src/application/BinarySession.ts),
@@ -569,5 +572,7 @@ The first six implementation stages are shipped:

 Future stages may deepen format and indirect-flow coverage, but must continue
 to compare normalized semantics rather than provider-specific pseudocode or
-assembly text. Ghidra continues to omit GUI and mutation operations, so
-unsupported requests cannot route to an unverified implementation.
+assembly text. Linux and macOS now admit atomic function-name and entry-comment
+edits in the ephemeral database, with readback, rollback, and cache invalidation.
+Executable bytes remain unchanged. Windows P0 retains its read-only boundary;
+GUI and other unimplemented mutations remain unavailable.
@@ -4,8 +4,8 @@ Accepted decisions describe the architecture that implementation PRs must
 follow. Acceptance does not by itself mean the behavior is shipped; each record
 states its implementation status separately.

-| ADR                                                                                                                | Status               | Implementation                                                                               |
-| ------------------------------------------------------------------------------------------------------------------ | -------------------- | -------------------------------------------------------------------------------------------- |
-| [0001: Provider selection and analysis profiles](0001-provider-selection-and-analysis-profiles.md)                 | Accepted             | Provider selection and 22 Ghidra operations shipped on Linux/macOS; Windows analysis blocked |
-| [0002: Controlled JavaScript replay authority and sandbox policy](0002-controlled-replay-authority-and-sandbox.md) | Superseded           | Historical design; the controlled JavaScript replay tool was removed                         |
-| [0003: Managed-code evidence and provider boundary](0003-managed-code-evidence-and-provider-boundary.md)           | Partially superseded | Seven static managed tools remain; runtime planning removed                                  |
+| ADR                                                                                                                | Status               | Implementation                                                                                                                        |
+| ------------------------------------------------------------------------------------------------------------------ | -------------------- | ------------------------------------------------------------------------------------------------------------------------------------- |
+| [0001: Provider selection and analysis profiles](0001-provider-selection-and-analysis-profiles.md)                 | Accepted             | Provider selection and 25 read-only Ghidra operations on Linux/macOS and experimental Windows x64 P0; Linux/macOS session annotations |
+| [0002: Controlled JavaScript replay authority and sandbox policy](0002-controlled-replay-authority-and-sandbox.md) | Superseded           | Historical design; the controlled JavaScript replay tool was removed                                                                  |
+| [0003: Managed-code evidence and provider boundary](0003-managed-code-evidence-and-provider-boundary.md)           | Partially superseded | Seven static managed tools remain; runtime planning removed                                                                           |
@@ -0,0 +1,130 @@
+# Static Android APK analysis
+
+REA wraps an existing headless JADX engine through `src/android/`. Its source is
+kept as an unmodified, commit-pinned Git submodule; see
+[upstream provenance](../third_party/README.md). CLI and MCP use the same
+application workflow and return artifact-bound Evidence inline.
+
+This family is present on repository main and in npm 4.1.0. Check the
+[released package boundary](installation.md#released-package-and-main) and the
+connected server's tool list before selecting it.
+
+## Supply tools
+
+Use **Java 17 or newer** and **jadx-headless-mcp 0.7.1**. REA does not install Java,
+an Android SDK, JADX, a device service or an emulator. Set the path in the shell
+or MCP server environment:
+
+```sh
+export REA_JADX_MCP_JAR=/absolute/path/jadx-headless-mcp-0.7.1-all.jar
+# Optional: select an existing JDK rather than java on PATH.
+export JAVA_HOME=/absolute/path/existing-jdk
+```
+
+Linux is verified with the public Appium ApiDemos fixture. The POSIX adapter can
+run on macOS, but that host has not undergone real Android verification.
+Windows is unsupported for this provider's owned stdio process boundary.
+
+## Answer an analyst question
+
+```sh
+rea inspect-android-package /path/Example.apk
+rea search-android-classes /path/Example.apk MainActivity
+rea inspect-android-class /path/Example.apk example.MainActivity
+rea inspect-android-method /path/Example.apk example.MainActivity onCreate
+rea inspect-android-method /path/Example.apk example.MainActivity select --overload-index 1
+rea trace-android-references /path/Example.apk example.MainActivity
+rea trace-android-references /path/Example.apk example.MainActivity --method-name onCreate
+```
+
+Equivalent MCP methods are `inspect_android_package`, `search_android_classes`,
+`inspect_android_class`, `inspect_android_method` and `trace_android_references`.
+Every request includes `path`. Class/method operations use `class_name`,
+`method_name` and optional `overload_index` as applicable. For example:
+
+```json
+{
+  "name": "inspect_android_method",
+  "arguments": {
+    "path": "/path/Example.apk",
+    "class_name": "example.MainActivity",
+    "method_name": "select",
+    "overload_index": 1
+  }
+}
+```
+
+Use `inspect_android_class` to choose an overload. REA rejects an ambiguous
+method request rather than silently selecting the first match. The engine's
+method reference operation cannot select overloads, so REA reports that boundary
+as unsupported when multiple same-name methods exist.
+
+The engine's smali fallback also joins same-name overloads; REA rejects that
+fallback for an overloaded method instead of attributing all bodies to one
+selected overload. Native/abstract methods with no decompiled body report
+`body_status: "not_available"` without inferring which implementation flag caused it.
+
+## Interpret the result
+
+- Package inspection retains decoded manifest XML, summary declarations,
+  permissions and class/resource counts. Summary fields are extracted by the
+  upstream engine and should be checked against the retained XML when needed.
+  Signature verification is explicitly `not_performed`.
+- Class search consumes all pages and checks their counts. An empty `query`
+  inventories all class names; class names are decompiler representations.
+- Class inventories return display signatures, fields and inner class names.
+  Exact DEX descriptors are unknown. Overload indices are tied to this artifact
+  and engine, not stable identities across different builds.
+- Method inspection reports Java or smali, fallback markers and complete/partial
+  returned text. Decompiled source is a derived representation. A complete text
+  result does not establish complete semantics or a byte-identical reconstruction.
+- Reference results are incoming static relationships between provider nodes.
+  Source lines and DEX instruction offsets remain unknown. They are not observed
+  runtime calls.
+- Original requests, APK SHA-256, actual engine JAR SHA-256 and raw producer
+  responses remain in Evidence. Source revision is populated only for bytes
+  matching the audited release JAR.
+
+These operations do not execute the APK or provide split APK/AAB handling,
+signature validation, full resource-table semantics, native-library analysis or
+Android runtime capture. Existing artifact inventory/extraction tools can supply
+archive evidence; `project_android_application_graph` remains a separate,
+execution-free inventory projection.
+
+## Resource and lifecycle limits
+
+Each request creates private, immutable APK and JAR copies. Their workspace and
+owned process group are cleaned on success, failure, timeout and cancellation.
+REA never writes to the original APK or launches target code.
+
+If process cleanup cannot be confirmed, REA retains the workspace and reports its
+location. That provider instance blocks subsequent engine launches until the
+caller resolves the reported resources and starts a fresh instance.
+
+The provider serializes requests within each REA instance, uses one worker and
+sets JVM maximum heap to **512 MiB**. Heap is not a total RSS cap: the JVM also
+uses native memory. Independent REA instances have independent queues. Whole
+operations have a **120-second** execution deadline after reaching the queue's
+front; upstream decompilation is limited to **90 seconds**.
+
+Decoded manifest and method text have a **1 MiB** upstream byte budget and report
+truncation. A protocol frame above **8 MiB**, or cumulative stdout/stderr above
+**32 MiB**, fails with a diagnostic instead of returning an incomplete inventory
+as complete. These are memory-safety boundaries, not undocumented result caps.
+
+## Real verification
+
+Download the explicit public fixtures once; this installs no tools:
+
+```sh
+npm run fixtures:android
+export REA_JADX_MCP_JAR="$PWD/_reference/apk-integration/jadx-headless-mcp-0.7.1-all.jar"
+export REA_ANDROID_TEST_APK="$PWD/_reference/apk-integration/ApiDemos-debug.apk"
+npm run verify:android
+```
+
+The download script verifies fixed SHA-256 values, reuses matching files and
+refuses to overwrite a different existing file. APK/JAR files live under ignored
+`_reference/` and are excluded from package contents. The lane exercises actual
+REA CLI and MCP results with the real engine, separately from synthetic protocol
+regressions. It needs no Gradle build, emulator, Android SDK or Ghidra.
@@ -1,7 +1,7 @@
 graph TD
    subgraph "Entry Points"
-        CLI["src/cli.ts<br/>One-shot CLI adapter<br/>setup, diagnostics, analysis, decompilation"]
-        MAIN["src/main.ts<br/>MCP stdio server adapter<br/>config, session, process lifetime"]
+        CLI["src/cli.ts + src/cli/<br/>One-shot CLI adapter<br/>setup, diagnostics, analysis, decompilation"]
+        MAIN["src/main.ts + src/main/<br/>MCP stdio server adapter<br/>config, session, process lifetime"]
        DISPATCH["scripts/rea.mjs<br/>Executable dispatcher<br/>routes mcp / one-shot"]
    end

@@ -9,29 +9,38 @@ graph TD
        SERVER["src/server/<br/>MCP request translation<br/>createServer, tool registration, toolResult"]
        HOPPER_BRIDGE["bridge/hopper_bridge.py<br/>Runs inside Hopper<br/>adapts operations to Hopper Python API"]
        GHIDRA_BRIDGE["bridge/ghidra/ReaGhidraBridge.java<br/>Packaged HeadlessScript<br/>inventory, decompiler, references, CFG"]
-        INSTALL["Host installation adapters<br/>macOS: verified vendor DMG to ~/Applications<br/>Linux: verified vendor package + apt/dnf/pacman"]
+        INSTALL["src/cli/ + src/application/Setup*<br/>Host installation adapters<br/>macOS: verified vendor DMG to ~/Applications<br/>Linux: verified vendor package + apt/dnf/pacman"]
    end

    subgraph "Application Layer"
        APP["src/application/<br/>Shared CLI/MCP workflows<br/>enhanced analysis and investigations"]
        SESSION["SessionProviderRouter + BinarySession<br/>one immutable deep binding per target<br/>disjoint auxiliary routing"]
        REGISTRY["AnalysisProviderRegistry<br/>sorted deep candidates<br/>deterministic selection, no fallback"]
-        JS_RECON["JavaScript artifact reconstruction<br/>directory/ASAR reads<br/>AST-only bundle projection"]
+        JS_RECON["src/application/ + src/artifacts/<br/>JavaScript artifact reconstruction<br/>directory/ASAR reads<br/>AST-only bundle projection"]
    end

    subgraph "Provider Layers"
        HOPPER["src/hopper/<br/>Hopper launch & Unix-socket protocol<br/>BridgeLauncher, HopperClient, protocol"]
        GHIDRA["src/ghidra/<br/>Ghidra discovery, profile & function analysis<br/>snapshot, Unix/Windows transport, bounded lifecycle"]
+        IDA["src/ida/<br/>Upstream MCP contract adaptation<br/>live GUI binding or owned headless database"]
+        IDA_MCP["External ida-pro-mcp<br/>GUI proxy or database supervisor<br/>upstream installation and engine lifecycle"]
        AUX["src/artifacts/ + src/native/<br/>disjoint artifact and native capabilities"]
-        BROWSER["src/browser/<br/>Loopback CDP transport<br/>exact-origin passive observation"]
+        BROWSER["src/browser/<br/>CDP / Playwright capture<br/>captured script adapters and publication"]
+        DOTNET["src/dotnet/<br/>Managed static metadata provider<br/>PE/CLI metadata inventory, members, IL"]
+        FIRMWARE["src/firmware/<br/>Binwalk / Unblob adapters<br/>owned processes, report normalization, private extraction"]
+        ANDROID["src/android/<br/>Static APK adapter<br/>owned SDK stdio, pinned headless JADX, normalization"]
+        REFERENCE["src/reference/<br/>Filesystem reference-source reader<br/>bounded traversal, validation, errors"]
    end

    subgraph "Provider Process Foundation"
        PROCESS["src/process/<br/>owned process groups, private roots<br/>deadlines, bounded file reads and diagnostics, cleanup"]
+        WINDOWS["src/windows/<br/>Windows host boundary adapters<br/>package loader, opaque handles, owned jobs and private runtimes"]
+        WINDOWS_NATIVE["native/windows/src/<br/>Node-API implementation<br/>NTFS admission, protected DACLs and atomic Job Object assignment"]
    end

    subgraph "Contracts Layer"
        CONTRACTS["src/contracts/<br/>Caller-visible schemas for analysis, managed, browser, Electron, application, and session tools"]
+        ERRORS["src/contracts/errorSchemas.ts<br/>Shared analysis error schemas<br/>CLI diagnostics, generated error catalog"]
    end

    subgraph "Domain Layer"
@@ -39,48 +48,71 @@ graph TD
    end

    subgraph "Configuration"
-        CONFIG["src/config.ts<br/>Zod-validated env parsing<br/>provider settings and origins"]
+        CONFIG["src/config.ts + src/config/<br/>Zod-validated env parsing<br/>provider settings and origins"]
    end

    subgraph "Tests"
        TESTS["tests/<br/>Vitest suite<br/>fixtures/ holds fake launcher, bridge, and CDP seams"]
    end

+    subgraph "Evaluation"
+        EVALUATION["src/evaluation/<br/>Agent release evaluation<br/>session transcript scoring"]
+    end
+
    DISPATCH --> CLI
    DISPATCH --> MAIN
    MAIN --> CONFIG
    MAIN --> SERVER
    MAIN --> APP
    CLI --> APP
+    APP --> FIRMWARE
+    FIRMWARE --> PROCESS
+    FIRMWARE --> CONTRACTS
+    APP --> ANDROID
+    ANDROID --> PROCESS
+    ANDROID --> CONTRACTS
+    ANDROID --> DOMAIN
+    CLI --> ERRORS
    APP --> SESSION
    SESSION --> REGISTRY
    REGISTRY --> HOPPER
    REGISTRY --> GHIDRA
+    REGISTRY --> IDA
+    IDA --> IDA_MCP
+    IDA --> CONTRACTS
+    IDA --> DOMAIN
    SESSION --> AUX
    APP --> JS_RECON
    APP --> INSTALL
    SERVER --> CONTRACTS
    SERVER --> APP
    APP --> BROWSER
-    APP --> REPLAY
+    APP --> DOTNET
+    DOTNET --> DOMAIN
    HOPPER --> HOPPER_BRIDGE
    GHIDRA --> GHIDRA_BRIDGE
    HOPPER --> PROCESS
    GHIDRA --> PROCESS
+    GHIDRA --> WINDOWS
+    PROCESS --> WINDOWS
+    WINDOWS --> WINDOWS_NATIVE
    APP --> PROCESS
    APP --> DOMAIN
    JS_RECON --> AUX
    JS_RECON --> DOMAIN
+    APP --> REFERENCE
+    REFERENCE --> DOMAIN
    CONTRACTS --> DOMAIN
    HOPPER --> DOMAIN
    GHIDRA --> DOMAIN
    AUX --> DOMAIN
    BROWSER --> DOMAIN
-    REPLAY --> DOMAIN
    PROCESS --> DOMAIN
    TESTS -.-> MAIN
    TESTS -.-> HOPPER
    TESTS -.-> GHIDRA
+    TESTS -.-> IDA
    TESTS -.-> PROCESS
    TESTS -.-> BROWSER
-    TESTS -.-> REPLAY
+    TESTS -.-> EVALUATION
+    TESTS -.-> ERRORS
@@ -1,14 +1,18 @@
 # Website observation with CDP

+Captured Debugger sources can be exported for REA's existing static JavaScript
+analysis with `export_web_scripts`. See [captured website scripts](website-script-export.md)
+for the capture options, source mappings, and browser/local resolution limits.
+
 REA can attach to a user-owned Chrome-family browser through the Chrome DevTools Protocol (CDP) and produce bounded Evidence about an existing page. This is a passive reverse-engineering capability, not a general browser automation or remote-control surface.

 ## Shipped surfaces

- `list_browser_targets` / `rea list-browser-targets` discovers page targets at the selected target's current origin by default, with an optional exact-origin filter.
+- `list_browser_targets` / `rea list-browser-targets` discovers all eligible page targets at the endpoint by default, with an optional exact-origin filter.
 - `inspect_web_page` / `rea inspect-web-page` captures DOM structure, accessibility nodes, scripts, resources, safe response/DOM metadata, attach-window network and console metadata, WebSocket frame sizes, workers, quota, and optionally selected storage key names, redacted storage-content fingerprints, or script sources.
 - `analyze_web_bundle` / `rea analyze-web-bundle` parses selected script artifacts without execution and derives chunk edges, route and endpoint candidates, vendor fingerprints, static WebMCP declarations, and optionally source-map/original-source evidence.
 - `observe_web_session` / `rea observe-web-session` arms an observation window of the requested duration for an external user action and records ordered reload, SPA navigation, redirect, failure, lifecycle, and target-termination metadata.
- `discover_webmcp_tools` / `rea discover-webmcp-tools` uses the experimental CDP WebMCP domain to return every in-scope registration and its complete structural input-schema summary inline. REA never exposes `WebMCP.invokeTool`; malformed protocol payloads fail explicitly instead of returning incomplete tool metadata.
+- `discover_webmcp_tools` / `rea discover-webmcp-tools` uses the experimental CDP WebMCP domain to return every in-scope registration and its complete structural input-schema summary inline. Registrations with the same name and URL in distinct observed frames retain separate identities. `tool_key` includes the observed frame ID; it is not a stable identity across navigation or browser sessions. Same-frame registration updates replace that owner only, and removal leaves other owners intact. REA never exposes `WebMCP.invokeTool`; malformed protocol payloads fail explicitly instead of returning incomplete tool metadata.
 - `compare_web_captures` / `rea compare-web-captures` compares passive captures or exact-step-aligned browser scenarios. Scenario results commit reproducible literal normalization and expose alignment failures plus artifact-level action, screenshot, DOM, accessibility, URL, history, storage, and event differences. Missing or truncated evidence is never treated as equivalence.
 - `capture_web_screenshot` / `rea capture-web-screenshot` returns a content-addressed visible-viewport PNG.
 - `compare_web_screenshots` / `rea compare-web-screenshots` performs bounded local PNG pixel comparison without OCR or external services.
@@ -37,9 +41,9 @@ REA does not launch, own, or terminate this browser. Use a dedicated profile and

 ## Request boundary

-Each request supplies a literal loopback CDP endpoint and target. Target
-discovery uses the selected target's current origin by default; an optional
-exact HTTP(S) origin filter can narrow the result. `localhost`, private-LAN
+Discovery supplies a literal loopback CDP endpoint and returns all eligible
+page targets unless an exact HTTP(S) origin filter narrows the result. Follow-up
+inspection requests select one target; their default scope is its current origin. `localhost`, private-LAN
 addresses, HTTPS CDP endpoints, credentials, paths, queries, fragments, and
 implicit ports are not valid CDP endpoints. Origin filters contain only scheme,
 host, and port; paths, credentials, queries, fragments, and wildcards are not
@@ -120,7 +124,7 @@ REA retains local observation data and removes only URL userinfo credentials, ex
 - Request/response bodies are not requested or parsed by default. When selected, only allowed-origin JSON media types are read, converted immediately to complete value-free property paths/types, and discarded. `Network.getResponseBody` is never sent unless JSON body shape capture is selected.
 - Console observations with a stack source retain call type, argument types, timestamp, and source location. When console text capture is selected, already-delivered primitive values are retained verbatim; objects, getters, and remote properties are never expanded.
 - WebSocket observations retain direction, opcode, and payload byte length. When shape capture is selected, text frames are classified as text or complete value-free JSON shape; binary bytes, hashes, prefixes, and raw frames are never retained.
- Storage observations always redact values. Key names, IndexedDB names, and cache names require `include_storage_keys`; stable content fingerprints require the additional `include_storage_fingerprints` selection. Cache bodies above 64 KiB and partial IndexedDB remote objects make fingerprint coverage incomplete, so identical observations remain `unknown`.
+- Storage observations always redact values. Key names, IndexedDB names, and cache names require `include_storage_keys`; stable content fingerprints require the additional `include_storage_fingerprints` selection. Cookie fingerprints cover cookies applicable to the current main-frame URL, including its path, rather than every cookie path on that origin. Other storage remains scoped to the origin. Cache bodies above 64 KiB and partial IndexedDB remote objects make fingerprint coverage incomplete, so identical observations remain `unknown`.
 - Script metadata is included only when CDP supplies a URL on an allowed origin. Stable keys exclude transient CDP script IDs, and exact transient raw URLs are used only during script/resource reconciliation. URL-less scripts are excluded because their origin cannot be established. When CDP supplies an execution-context association, the accepted script retains its authorized frame ID for later attribution. Source content is omitted unless explicitly requested and is returned inline as a self-verifying artifact with its SHA-256 digest.

 Frames, resources, scripts, events, and workers outside the selected origin scope are excluded. An explicit `allowed_origins` list can include additional origins; excluded target details are counted without being exposed.
@@ -142,10 +146,12 @@ Disallowed-origin entries are filtered before retention.

 CDP discovery, WebSocket connection, and commands continue until the peer responds or the caller cancels the operation; REA has no internal byte, message-count, or pending-command quota for these exchanges. Without caller cancellation, a stalled peer can leave an operation waiting. On cancellation, REA closes only its own WebSocket, waiting up to one second before terminating it. Malformed unsolicited protocol events poison the connection so later commands fail closed.

-Network and console coverage starts only after REA attaches and enables the relevant CDP domains. `prior_activity_available` is always `false`; absence from these arrays is not evidence that an event never occurred. Source maps are not fetched by inspection. Bundle analysis fetches them only when `fetch_source_maps` is selected, with exact-origin redirect checks and no credentials, cookies, or referrer. Every requested map, mapping, original source, AST node, and finding from parsed content is returned inline; failed maps remain explicitly unavailable and make bundle completeness partial.
+Network and console coverage starts only after REA attaches and enables the relevant CDP domains. `prior_activity_available` is always `false`; absence from these arrays is not evidence that an event never occurred. Source maps are not fetched by inspection. Bundle analysis fetches them only when `fetch_source_maps` is selected, with exact-origin redirect checks and no credentials, cookies, or referrer. Every requested map, mapping, original source, AST node, and finding from parsed content is returned inline; failed maps remain explicitly unavailable and make bundle completeness partial. Original source artifacts with `.ts`, `.tsx`, `.mts`, or `.cts` suffixes carry `text/typescript`; other source names retain `text/javascript`.

 ## Non-goals and threat model

 The browser provider deliberately does not expose generic CDP commands, `Runtime.evaluate`, WebMCP invocation, navigation, input, downloads, page closure, or browser closure. Screenshot capture is the sole pixel surface and returns an image only when requested. REA disables the domains it enabled, detaches the target session, and closes only its own WebSocket.

 This feature is not a browser sandbox or network containment mechanism. The attached page and browser continue running with their existing privileges and may make external requests independently of REA. CDP gives deep access to the selected browser profile, so use a dedicated profile, include only origins you intend to inspect, and treat other same-user processes as outside this boundary.
+
+Response metadata normalizes a `Referrer-Policy` fallback list to its last recognized nonempty policy, including mixed-case tokens. Unknown policy names are skipped; malformed token syntax and lists without a recognized policy remain `null`. This reports the response's declared policy, not the effective policy of a document or an inferred browser default.
@@ -21,6 +21,115 @@ Duration, action, and navigation
 timeouts remain fixed provider-owned liveness limits; the request does not
 accept a caller-controlled `limits` object.

+## Minimal launch example
+
+Save this as `browser-scenario.json`, replacing the executable path with an
+already-installed Chrome-family browser and the URL with your running fixture:
+
+```json
+{
+  "browser": {
+    "mode": "launch",
+    "executable_path": "/absolute/path/to/chromium"
+  },
+  "start_url": { "url": "http://127.0.0.1:3000" },
+  "actions": [
+    { "step_id": "settle", "action": "wait_for_timeout", "duration_ms": 100 }
+  ]
+}
+```
+
+```bash
+rea capture-browser-scenario ./browser-scenario.json --json > browser-capture.json
+```
+
+The default capture includes the final URL. Select DOM, screenshots, or events
+only when they help answer the question. REA launches and cleans up the browser
+profile for this request; it does not start your fixture server or install a
+browser. A schema-valid scenario does not prove that the executable or target
+is available on the host.
+
+## Interaction example: capture the visible result
+
+The default final URL answers "where did the page end up?", not "what did the
+page show?". Many interactions, such as a search button that renders results in
+place, change the page without changing the URL. A capture with only the
+default `url` artifact then reports that the click succeeded and the URL is
+unchanged, which cannot tell you whether results appeared.
+
+Request the artifacts that answer your question and wait for the state you want
+to inspect. This scenario clicks a Search button, waits for the current search
+results, and captures the final DOM, accessibility tree, and URL. It assumes the
+local page clears `#results`'s `data-state` while loading and sets it to `ready`
+after rendering the current response. Adapt the selectors and readiness marker
+to your page; an already-visible container or previous results are insufficient.
+
+```json
+{
+  "browser": {
+    "mode": "launch",
+    "executable_path": "/absolute/path/to/chromium"
+  },
+  "start_url": { "url": "http://127.0.0.1:3000" },
+  "actions": [
+    {
+      "step_id": "search",
+      "action": "click",
+      "locator": { "kind": "css", "selector": "#search" },
+      "timeout_ms": 10000
+    },
+    {
+      "step_id": "results-ready",
+      "action": "wait_for",
+      "locator": { "kind": "css", "selector": "#results[data-state='ready']" },
+      "state": "visible",
+      "timeout_ms": 10000
+    }
+  ],
+  "capture": { "at_end": ["dom", "accessibility", "url"] }
+}
+```
+
+Save it as `browser-search.json` and run it the same way as the minimal
+example:
+
+```bash
+rea capture-browser-scenario ./browser-search.json --json > browser-search-capture.json
+```
+
+Through MCP, pass the same object as the `capture_browser_scenario` arguments.
+The final step's DOM and accessibility artifacts retain the page state at that
+capture time inline. REA still launches and cleans up the browser profile.
+
+The click's `timeout_ms` covers the click action. A non-navigating `fetch` or
+delayed render can finish later, so use `wait_for` to observe a page-specific
+ready condition before final capture. A page that updates synchronously can
+omit that wait. REA does not infer application readiness from capture selection.
+
+Choose captures by the question being asked:
+
+- `dom` and `accessibility`: text or structure the page rendered, such as
+  search results, validation messages, or updated lists. The accessibility tree
+  is usually the more compact way to read visible text.
+- `screenshot`: visual layout or styling, or content not exposed as text, such
+  as a canvas.
+- `history` or `storage`: navigation history, or cookies and web storage the
+  interaction wrote. Request them only when that state is the question; they
+  are never captured implicitly.
+- `after_each_step` instead of `at_end`: intermediate state between actions in
+  a multi-step scenario.
+- `events` (`console`, `page-errors`, `network`, and so on): how the page
+  reached its result, such as the request a search issued or an error it
+  logged. Select only the event families you need.
+
+Capture states are reported per artifact. An artifact you did not request is
+`not_requested`, which means REA did not look, not that the page had nothing
+to show. A step's `completeness` of `complete` covers only the sections that
+were requested. A URL-only capture can be `complete` and still be unable to
+answer a question about rendered content, so add the relevant artifact and run
+the scenario again rather than inferring from its absence. Capture completeness
+also does not assert that the page's background work has finished.
+
 The browser boundary is part of the contract. Launch mode requires a
 caller-selected executable and always uses a provider-owned temporary profile
 that is closed and deleted during cleanup. Connect mode accepts only an
@@ -85,6 +194,83 @@ external browser without closing it. The request itself defines the operation;
 there is no additional REA grant step. The browser and host still enforce their
 own access and process rules.

+## Network evidence
+
+`capture.events: ["network"]` retains request, response, completion, failure,
+and unfinished-request metadata. Select content independently:
+
+```json
+{
+  "browser": {
+    "mode": "launch",
+    "executable_path": "/absolute/path/to/chromium"
+  },
+  "start_url": { "url": "http://127.0.0.1:3000" },
+  "actions": [
+    {
+      "step_id": "run",
+      "action": "click",
+      "locator": { "kind": "css", "selector": "#start" },
+      "timeout_ms": 10000
+    },
+    {
+      "step_id": "ready",
+      "action": "wait_for",
+      "locator": { "kind": "css", "selector": "#done" },
+      "state": "visible",
+      "timeout_ms": 10000
+    }
+  ],
+  "capture": {
+    "network": {
+      "request_body": true,
+      "response_body": true,
+      "header_values": true
+    }
+  }
+}
+```
+
+All three options default to `false`. Any selected network content also enables
+network metadata observation; listing `network` in `events` is then optional.
+Each observed request object receives a capture-scoped `transaction_id`.
+Requests sharing a URL remain distinct. Redirects link to the preceding
+transaction only when it was observed; a null predecessor does not establish
+that no earlier hop existed. Older captures without IDs remain readable and
+their transaction association is unknown.
+
+`scenario.network_content` records the resolved content selection. Comparing
+captures with different selection, or legacy captures without that coverage
+information, reports network evidence as unknown with a recovery instruction.
+Capturing more data alone does not establish a website change.
+
+`network-content` events reference the exact request or response event through
+`source_event_sequence`. They include independently typed headers and body
+states. Captured bodies retain base64 bytes, byte count, media type, and SHA-256
+of the retained bytes. Request bytes are those exposed by Playwright; a
+`not_exposed` request body does not prove absence or complete multipart file
+coverage. Response bytes are decoded by the browser, not the compressed wire
+representation. No later fetch is substituted for the original response.
+Headers preserve producer order and duplicates. Authorization,
+Proxy-Authorization, Cookie, and Set-Cookie values are null with
+`redacted: true`; ordinary values remain intact. Declared UTF-8 secret values
+and their standard URI/form or JSON-escaped representations are replaced without
+decoding unrelated binary bytes. Other encodings are not interpreted. Digests describe the
+retained representation after redaction.
+
+Only completed responses are read. At the end of the final step, observation
+stops; requests still in flight emit `request-unfinished`, and their observed
+responses have explicitly unavailable bodies. This cutoff does not wait for
+long-lived streaming connections. Already-started content reads settle before
+browser cleanup, with a provider-owned five-second timeout per read and
+cancellation support. Failed or unexposed reads retain per-content states and make selected
+event coverage incomplete. Body events can arrive during later steps or final
+drain; event bounds describe receipt during the step, while the source event
+reference establishes the transaction phase. Comparison attributes content to
+its source event's step and excludes the sequence reference from normalization.
+Playwright scenario capture does not supply initiator stacks; passive CDP
+observation retains its own initiator evidence.
+
 ## Scenario comparison

 `compare_web_captures` and `compare-web-captures` also accept two complete
@@ -0,0 +1,95 @@
+# Incremental capability migration
+
+This working guide tracks the migration in #740. Update it as concrete domains
+migrate. Existing public contracts and domain-specific ports remain authoritative;
+there is no new universal provider interface or fixed module manifest.
+
+## Ownership to preserve
+
+| Responsibility                                | Current owner                            | Migration direction                                            |
+| --------------------------------------------- | ---------------------------------------- | -------------------------------------------------------------- |
+| Analyst semantics and Evidence representation | domain                                   | Keep pure and provider-neutral                                 |
+| Named public input/output contracts           | contracts                                | Keep exact CLI/MCP meaning and complete discovery              |
+| Producer parsing and external tool protocols  | provider adapters                        | Keep behind the relevant typed port                            |
+| Shared analyst workflows                      | application                              | Share between CLI and MCP                                      |
+| Concrete provider construction                | binary runtime, composition, MCP startup | Consolidate one capability at a time in production composition |
+| Investigation Evidence and Unknowns           | BinarySessionRecords                     | Extract one composed record owner after caller migration       |
+| Target/profile snapshots and invalidation     | BinarySessionRecords/BinarySession       | Keep binary-owned                                              |
+| Subprocess ownership and host primitives      | process/windows                          | Reuse; preserve cancellation and cleanup                       |
+| Public translation                            | CLI/MCP adapters                         | Delegate to shared workflows and named contracts               |
+
+Retain exact Evidence IDs, provenance, detached reads, atomic Evidence/Unknown
+mutations and optimistic revisions. Preserve current close and failed-cleanup
+record clearing while extracting ownership; #721 owns any retention-policy change.
+Each CLI invocation and MCP connection keeps its own state. Provider registration
+must not launch engines or install prerequisites.
+
+## Migrate before generalizing
+
+1. Record the actual callers, state, environment, protocol and verification owner
+   of the capability being migrated.
+2. Move concrete construction behind its existing typed port. Preserve injected
+   ports, selected environment, queues, failure state and cleanup behavior.
+3. Test both caller paths and the applicable package/real-provider boundary.
+4. Use independently migrated capabilities to identify repeated metadata and
+   composition needs. Derive a small source declaration only when those needs
+   are established; keep unlike target/lifecycle semantics separate.
+5. Move a coherent capability's files, fixtures and verification lanes in a
+   mechanical PR. Update all path-sensitive consumers in that same PR.
+
+Pure helpers do not need an interface each. A capture-format adapter or typed
+factory may be sufficient. Avoid generic JSON execution, external MCP catalog
+passthrough, eager provider acquisition, new permission fields or a multi-package
+rewrite. Optional loading should preserve successful peers and report the failed
+capability without hiding tools from the catalog.
+
+## Checks before and after a move
+
+`npm run verify:test-discovery` compares actual Vitest file discovery with every
+repository-owned `*.test.ts` under src and tests, including newly added files. The
+check requires Git, includes untracked non-ignored tests, and excludes removed
+paths during a move. It
+rejects missing files and overlapping project ownership. It only lists files;
+it does not replace behavior tests or real-provider verification.
+
+Check imports, project isolation and coverage, development-test selection,
+lint exceptions, catalog/generator imports, npm and CI verification entrypoints,
+fixture ownership, and installed-package bridge/native path resolution.
+Domain and contracts must not import application workflows, caller adapters or
+provider implementations. Production composition is a deliberate outer boundary.
+Other existing adapter imports will migrate incrementally; do not widen a lint
+exception to conceal new protocol code inside application workflows.
+
+Select verification by the claim changed: schema/composition, package, real
+engine or host-native workflow. Record host/target prerequisites and source-owned
+fixtures. Run heavy lanes serially with bounded workers/heaps and reuse existing
+engines. Recording ports do not prove real provider or platform support.
+
+## Extension examples to validate during migration
+
+An implementation of an existing port should require a provider adapter, typed
+production factory selection, exact producer parsing/provenance and matching
+verification. Existing workflow meaning and public contracts should stay stable.
+
+A new analyst capability deliberately adds semantics, named contracts, a typed
+port/workflow when needed, both caller adapters, availability, documentation and
+verification. Its integration is broader than swapping a provider. The migration
+should eliminate incidental duplicate wiring, not erase those design decisions.
+
+Update these examples with real migrated entrypoints before closing #740.
+
+## First production factory migration
+
+`src/composition/android.ts` and `src/composition/firmware.ts` construct providers
+behind the existing AndroidAnalysisPort and FirmwareAnalysisPort. CLI registrars
+pass their selected environment; MCP uses the process environment unless a caller
+injects a port. Each factory call returns a fresh instance and acquires no process,
+workspace or toolchain. Queues, cleanup-failure state and per-request cleanup stay
+inside the provider. The existing launcher seams remain available to boundary
+fixtures, which now exercise the production factories.
+
+Application workflows and MCP registration must not import these concrete
+providers. Composition may import their implementations. Binary composition is
+still at its existing entrypoint while its direct-analysis callers are investigated.
+This concrete pilot does not introduce a shared provider interface or module
+manifest.
@@ -0,0 +1,173 @@
+# Firmware analysis
+
+REA integrates **Binwalk 3.1.0** for region inspection and **Unblob 26.6.4** for
+explicit extraction. This first firmware milestone is verified on Linux x64.
+No device, root privilege, mount, emulation or execution of extracted programs
+is needed. Arbitrary firmware bytes do not pass native executable admission;
+select a returned ELF separately for supported Ghidra analysis.
+
+## Caller-supplied tools
+
+Provide existing tools using absolute executable paths, scoped to your shell:
+
+```sh
+export REA_BINWALK_COMMAND=/absolute/path/to/binwalk
+export REA_UNBLOB_COMMAND=/absolute/path/to/unblob
+```
+
+REA does not install these tools, their dependencies or system packages. It
+checks the actual tool version when executing a request. Inspection and
+extraction have independent prerequisites; one does not require the other.
+Both require util-linux `prlimit`, normally `/usr/bin/prlimit`; override its
+absolute path with `REA_FIRMWARE_PRLIMIT_COMMAND` if needed.
+
+Unblob needs the external extractor for the selected format on its inherited
+`PATH`: for example, `debugfs` for ext2/ext3/ext4. Its default Landlock sandbox
+and skip rules stay enabled. Sandbox startup failures remain actionable errors;
+REA does not retry with `--no-sandbox`. Missing extractors reported in a valid
+analysis report retain partial results and dependency names inline.
+
+Upstream sources are preserved unmodified as optional pinned submodules:
+
+```sh
+git submodule update --init third_party/binwalk third_party/unblob
+```
+
+Normal REA builds and npm packages do not include or build these sources or
+engine binaries. See [upstream provenance](../third_party/README.md).
+
+## CLI and MCP
+
+```sh
+rea inspect-firmware-regions /path/to/firmware.bin
+rea extract-firmware /path/to/firmware.bin /path/to/new-output
+rea extract-firmware /path/to/firmware.bin /path/to/selected-output \
+  --offset 64 --length 4096 --max-depth 3
+```
+
+The corresponding MCP tools accept the same intent:
+
+```json
+{
+  "name": "inspect_firmware_regions",
+  "arguments": { "path": "/path/to/firmware.bin" }
+}
+```
+
+```json
+{
+  "name": "extract_firmware",
+  "arguments": {
+    "path": "/path/to/firmware.bin",
+    "output_directory": "/path/to/new-output",
+    "range": { "offset": 64, "length": 4096 },
+    "max_depth": 3
+  }
+}
+```
+
+Both return Evidence with the original path and SHA-256, raw producer reports,
+actual executable path/digest, version and limitations. Binwalk signature UUIDs
+and Unblob blob IDs are producer-local identities; compare content hashes and
+source ranges across runs. A matching version does not attest an installed
+build's source revision, so that field remains unknown.
+
+### Interpret the results
+
+- Region offsets refer to bytes in the original firmware. `reported_size`
+  preserves Binwalk's output; `size_basis=provider_reported_validation_unknown`
+  reflects that Binwalk can replace unknown lengths with the next signature or
+  EOF before serialization. Neither a signature nor its confidence byte proves
+  a valid partition, encryption or runtime behavior.
+- Extraction returns regular file paths, independently verified SHA-256 values,
+  producer hashes when available, chunks, diagnostics and task derivations.
+  Unblob's task report is unordered; REA resolves relationships by paths and
+  blob IDs. Logical references use `$input`, `$output`, or `$output/<relative-path>`
+  so a real file named `$input` stays distinct from the original input.
+  Chunk offsets belong to the task's input file. Only chunks in the
+  selected input have a known `root_file_range`, adjusted by the selected offset.
+- Decompressed children have unknown original byte ranges and runtime addresses.
+  Task lineage does not establish a byte-for-byte mapping through decompression.
+- `partial` marks unknown/encrypted chunks, reported extraction problems,
+  unpublished links/special files or reached depth limits. `complete` means the
+  engine finished its configured extraction without those reported conditions;
+  default skip rules and format coverage still apply. It does not establish
+  complete firmware reconstruction.
+- The destination must be absent, absolute, with an existing parent. Publication
+  uses exclusive, symlink-resistant writes and durable digest readback. Existing
+  destinations are never overwritten. This is not an atomic directory rename:
+  a new tree can be visible while files are written. Failed uncommitted output
+  is rolled back. Symlinks and special files are recorded without publication;
+  empty directories, ownership and executable permission bits are not reproduced.
+
+Select a verified native child for the existing tools:
+
+```json
+{
+  "name": "open_binary",
+  "arguments": {
+    "path": "/path/from/extraction/usr/bin/program",
+    "provider_id": "ghidra"
+  }
+}
+```
+
+Then use `analyze_function`, `inspect_native_api` or the other native primitives.
+Native architecture and executable validation still apply. This milestone does
+not add MIPS/PPC/RISC-V decompilation, raw flash load profiles, bootloader/device
+tree semantics, vulnerability scanning, emulation or hardware runtime capture.
+
+## Resource and lifecycle policy
+
+- Nonempty regular firmware inputs: at most **128 MiB**, copied and hashed into
+  a private workspace before analysis. No in-place source modification.
+- One queued heavy operation per provider instance; Binwalk one thread and
+  Unblob one worker. No automatic parallel extraction engines.
+- **120-second** deadline; inherited **1 GiB per-process address-space** limit,
+  120 CPU seconds and zero core-dump allowance through `prlimit`.
+- JSON reports: at most **8 MiB**; oversized reports fail without a truncated
+  success. Diagnostic output is bounded with exact captured byte counts.
+- Default staging budget: **256 MiB** and **10,000 entries**, configurable using
+  `max_output_bytes` / `max_output_files` (CLI `--max-output-bytes` /
+  `--max-output-files`). Depth defaults to 3, allowed range 1–10.
+
+Staging budgets are polled and rechecked after exit; short-lived overshoot is
+possible. The inherited file-size limit bounds each file, not total storage;
+address-space limits are per process, not an aggregate memory quota. Worker
+count is not CPU affinity for every external extractor. These limits do not
+claim cgroup/container containment. Cancellation cleans the owned process group
+before removing its workspace; uncertain cleanup retains resources and blocks
+further operations in that provider instance.
+
+## Verification
+
+Generate small public, source-derived fixtures into ignored `_reference/`:
+
+```sh
+npm run fixtures:firmware
+npm run verify:firmware
+```
+
+Fixture generation requires existing Python 3 and a host C compiler (`cc`);
+override with `REA_FIRMWARE_PYTHON` / `REA_FIRMWARE_CC`. The independent oracle
+records gzip offset/length and extracted file hashes. Real verification checks
+CLI/MCP, full-file and selected-range extraction, unknown chunks, depth limits,
+content parity and unchanged source bytes. No binary fixture is committed.
+
+Additional lanes are explicit, so the base lane stays small:
+
+```sh
+# Existing mke2fs and debugfs required; put debugfs on the scoped PATH.
+REA_FIRMWARE_VERIFY_EXT4=1 npm run fixtures:firmware
+REA_FIRMWARE_VERIFY_EXT4=1 npm run verify:firmware
+
+# Existing Ghidra 12.1.4 and Java required.
+REA_FIRMWARE_VERIFY_GHIDRA=1 npm run verify:firmware
+```
+
+`REA_FIRMWARE_MKE2FS_COMMAND` selects the optional ext4 fixture producer.
+`REA_FIRMWARE_FIXTURE_ROOT` selects generated data storage.
+`REA_FIRMWARE_TEST_ENTRYPOINT` can select an isolated installed npm package's
+`scripts/rea.mjs` to verify the packaged CLI/MCP workflow. Real coverage here is
+generated gzip/USTAR/ext4 with a Linux x64 ELF child; SquashFS, UBIFS, proprietary
+firmware, other hosts and architectures remain unverified.
@@ -1,6 +1,6 @@
-# DOS MZ analysis with Ghidra
+# DOS MZ and COM analysis with Ghidra

-REA can analyze DOS MZ executables through the bring-your-own Ghidra adapter.
+REA can analyze DOS MZ executables and explicitly selected COM images through the bring-your-own Ghidra adapter.
 The Linux x64 verification lane exercises actual 16-bit disassembly and
 decompilation through the CLI and stdio MCP. It requires the same Ghidra
 12.1.4 and 64-bit JDK 21 installation as other Ghidra sessions; no DOS emulator
@@ -13,6 +13,9 @@ rea inspect /absolute/path/to/legacy.exe --provider ghidra --json
 rea search /absolute/path/to/legacy.exe entry --kind procedures --provider ghidra --json
 rea instructions /absolute/path/to/legacy.exe entry --provider ghidra --json
 rea function /absolute/path/to/legacy.exe entry --provider ghidra --json
+rea inspect-native-load-image /absolute/path/to/legacy.exe --provider ghidra --json
+rea read-bytes /absolute/path/to/legacy.exe 0x10000 --length 16 --provider ghidra --json
+rea address-to-file-offset /absolute/path/to/legacy.exe 0x10000 --provider ghidra --json
 ```

 Use an observed procedure name or address from discovery when the target does
@@ -38,6 +41,43 @@ The profile also commits `function_body_evidence: complete-inclusive-ranges-v1`,
 so snapshots from older length-only Ghidra results do not satisfy the current
 profile.

+## Headerless COM images
+
+COM has no identifying header. Select its interpretation explicitly; neither the
+`.com` suffix nor arbitrary unrecognized bytes are enough to admit it.
+
+```bash
+rea inspect /absolute/path/to/legacy.com --target-format dos-com --provider ghidra --json
+rea function /absolute/path/to/legacy.com 0x10100 --target-format dos-com --provider ghidra --json
+rea inspect-native-load-image /absolute/path/to/legacy.com --target-format dos-com --provider ghidra --json
+```
+
+```json
+{
+  "name": "open_binary",
+  "arguments": {
+    "path": "/absolute/path/to/legacy.com",
+    "format": "dos-com",
+    "provider_id": "ghidra"
+  }
+}
+```
+
+The caller's interpretation applies to the complete file, even if its filename
+suggests another format. Files must contain 1..65280 bytes: the 64 KiB COM segment
+minus the 256-byte PSP prefix. Ghidra uses `BinaryLoader` with real-mode language
+and maps file offset zero at `1000:0100` (linear `0x10100`). A packaged pre-analysis
+script seeds the entry function and CS/DS/ES/SS context `0x1000`. These settings
+and the preparation policy are committed in the analysis profile; a failed
+preparation prevents the resident bridge from serving results.
+
+Load-image verification checks all original and modified file bytes, complete
+source mapping/memory digests, absence of relocations, entry and measured register
+context. The context is imposed for analysis, not observed from execution. PSP
+memory, initial stack contents/SP, DOS interrupts and PC-98 devices are not
+modeled. COM has no MZ header, relocation table or appended-overlay model; all
+selected bytes belong to its analysis module. The original file stays unchanged.
+
 ## Addresses and function extent

 Returned default-space addresses are linear byte coordinates. A Ghidra
@@ -71,6 +111,30 @@ Ghidra's database observation, not a proof of original source ownership or
 exhaustive code discovery. Providers that do not report complete ranges return
 `available: false` and an explicit reason.

+## Loaded-image evidence
+
+`inspect_native_load_image` independently checks the immutable session snapshot
+against the loaded Ghidra Program. It measures complete original and modified
+FileBytes digests, every source mapping and its memory digest, relocation records
+(including multiplicity), and external entry points. It verifies MZ header and
+module partitions, relocation fixups and linear coordinates rather than relying
+on the imported executable SHA alone.
+
+The result is `verified`, `mismatch`, or `unsupported`. Every check retains its
+expected and observed values. A memory-digest mismatch identifies the source
+range's file offset and analysis address; it does not locate the first differing
+byte inside that range. Mapping ends are **inclusive**, unlike the exclusive ends
+from `list_segments`. Appended overlays remain in source-file identity and are
+excluded from initialized module coverage. Uninitialized allocations are reported;
+their contents and DOS runtime semantics are not verified. Formats other than MZ and explicit COM return
+`unsupported` with measured observations, not a successful MZ verification.
+
+`read_bytes` returns initialized provider memory, including loader fixups; an
+unmapped or uninitialized byte ends the read with an explicit returned length and
+`complete: false`. `address_to_file_offset` uses the provider's source mapping;
+unmapped, uninitialized and ambiguous mappings fail explicitly. A relocated word
+can differ from the original file word even when its source offset is known.
+
 ## Coverage boundaries

 Static decompilation does not execute the target or emulate BIOS, DOS
@@ -103,3 +167,22 @@ executable fixtures, an emulator, or an existing analysis database.
 Provider p-code representations can contain process-specific address-space selector
 tokens. The lane preserves those reported values and compares stable dossier
 observations rather than asserting cross-process identity of raw p-code.
+
+## Function annotations
+
+`annotate_native_function` changes the name and/or comments at one exact local function entry, verifies readback, and returns a refreshed dossier. This is useful when recording recovered DOS function roles; it does not claim original-source names. Name writes preserve the existing namespace; readback returns the fully qualified name used by function inventories. Regular comments map to Ghidra PRE comments and inline comments to EOL comments. Empty text clears a comment; omitted fields preserve it. The whole edit rolls back if a setter, readback or analysis fails.
+
+```json
+{
+  "procedure": "0x10100",
+  "name": "entry",
+  "comment": "Recovered startup role",
+  "inline_comment": "Inspect segment setup"
+}
+```
+
+```bash
+rea annotate-native-function /local/program.com 0x10100 --target-format dos-com --provider ghidra --name entry --comment 'Recovered startup role' --json
+```
+
+The CLI returns the updated analysis before closing its isolated session. MCP edits remain visible to later reads until `close_binary`. Original bytes remain unchanged, database edits are discarded on close, and immutable analysis snapshots are invalidated after edits. This operation does not save a Ghidra project, change ABI/types/body ranges, patch instructions, or emulate a DOS runtime. Windows P0 does not admit it.
@@ -0,0 +1,99 @@
+# Optional NativeAOT metadata recovery
+
+REA integrates [Washi1337/ghidra-nativeaot](https://github.com/Washi1337/ghidra-nativeaot)
+through an optional headless adapter. The original source is an opt-in submodule,
+pinned to `effeb734fc570c32650f88b159608979dc7b423e`; its MIT license and existing
+source notices are retained. No upstream source or algorithms are rewritten.
+
+The initial tested layout is .NET runtime **8.0.22**, NativeAOT RTR **9.1**,
+x86-64 ELF and native Windows PE **targets analyzed on Linux x64**, using
+Ghidra **12.1.4** and JDK **21**. Other layouts/architectures/hosts are unsupported.
+Windows Ghidra P0 has no database mutation authority. A PE/CLI or ReadyToRun
+assembly should use `inspect_managed_artifact`; it is not NativeAOT.
+
+## Build and configure
+
+Bring your own supported Ghidra/JDK installation. This developer build needs
+existing `git`, `javac` and `jar`; it does not invoke Gradle, download toolchains,
+or change host configuration:
+
+```sh
+git submodule update --init third_party/ghidra-nativeaot
+npm run build:ghidra:nativeaot
+export REA_GHIDRA_NATIVEAOT_JAR="$PWD/_reference/nativeaot-integration/extension/rea-ghidra-nativeaot.jar"
+```
+
+The build requires a clean pinned upstream checkout, compiles unchanged upstream
+Java plus the REA facade, uses a fresh classes directory, and writes the JAR and
+build manifest under ignored `_reference/`. `REA_NATIVEAOT_BUILD_ROOT` can select
+another local output directory; `REA_NATIVEAOT_SOURCE` can select an equivalent
+clean pinned source checkout. Neither output nor compiled fixture belongs in Git
+or the npm package. An installed REA accepts an existing explicitly supplied JAR.
+
+REA commits the actual JAR SHA-256 into the analysis profile, copies identical
+bytes into the owned runtime, rechecks the digest before loading, and closes the
+classloader/project on session close. Profiles cannot enable code absent from
+explicit local configuration. JARs execute within Ghidra; supply a build you trust.
+The producer's reported source revision is build metadata, not an attestation of
+arbitrary caller-supplied bytes. The bounded loader accepts regular JARs up to
+8 MiB to limit startup artifact memory; this does not truncate analysis results.
+
+## Use existing tools
+
+Open the executable with provider `ghidra`. `inspect_native_load_image` returns
+optional `observations.metadata_recovery` inline, including the detected header,
+layout, recovery status, type category paths/addresses, diagnostics, annotation
+coverage and derived-memory SHA. The enclosing `unsupported` load-image status
+for PE/ELF concerns independent DOS loader verification; metadata recovery has
+its own status. It is not a failed import.
+
+Pass one returned type path or its typed address to `inspect_native_data_type`.
+Its optional `metadata_recovery` includes related/base type, implemented
+interfaces and virtual slots with targets and known procedure names. Follow
+these with `analyze_function`, string searches and ordinary cross-references.
+For CLI use:
+
+```sh
+rea inspect-native-load-image ./NativeAotFixture --provider ghidra --json
+rea inspect-native-data-type ./NativeAotFixture --type /NativeAOT/MethodTables/Class_ADDRESS_MT --provider ghidra --json
+rea function ./NativeAotFixture 0xADDRESS --provider ghidra --json
+```
+
+No new MCP workflow or approval flag is required. Configuration opts into the
+adapter; without it ordinary Ghidra profiles/results remain unchanged.
+
+## Evidence boundaries
+
+Discovery prefers an imported RTR symbol, otherwise the upstream initialized,
+non-executable-memory signature heuristic. REA rejects ambiguous candidates,
+unknown layout versions, malformed directory rows, unsupported flags and
+unmapped ranges before recovery. It requires the verified dehydrated layout.
+
+The adapter performs rehydration, method-table recovery and frozen-object
+annotation in one ephemeral Program transaction. Fatal failure/cancellation
+rolls it back. Recovery may change analysis-memory bytes, never the original
+executable file. Derived ranges have a digest and **no original file offset**;
+they are not captured runtime state. Candidate/committed instance annotation
+counts distinguish partial frozen-object coverage. Coverage concerns the
+recovered candidate set, not every possible object or every runtime type.
+
+REA preserves pre-recovery calling conventions and uses the loaded compiler
+specification default for newly created methods. The upstream universal
+`__thiscall` assignment is not treated as x64 ABI authority. Parameters and
+method prototypes remain inferences; verify them against instructions/call sites.
+
+Type relationships and System.Object/System.String identification use upstream
+heuristics. Generated names are explicitly marked; original class/member names
+and custom field layouts remain unknown. Pseudocode is recovered native logic,
+not original C# source. Unsupported recovery reports its stage and reason; it
+does not imply that ordinary native disassembly/decompilation is impossible.
+
+## Verification
+
+See [the dedicated lane](testing.md#optional-nativeaot-ghidra-analysis).
+Fixtures are source-built benign .NET programs with inheritance, an interface,
+virtual dispatch, representative arithmetic and frozen strings. Independent
+compiler/linker symbols and raw directory bytes provide the oracle. Stripped
+fixtures exercise heuristic detection. Tests do not execute the resulting
+NativeAOT binaries. Fixture generation and adapter compilation are optional and
+never prerequisites of ordinary native analysis or setup.
@@ -0,0 +1,111 @@
+# IDA Pro provider
+
+REA adapts an existing [mrexodia/ida-pro-mcp](https://github.com/mrexodia/ida-pro-mcp) server into its native analysis tools. Install and configure IDA, Hex-Rays, Python, and upstream MCP using that repository's instructions. REA does not install, upgrade, activate, or license them, and does not bundle another IDA server.
+
+Choose one lifecycle mode in an upstream MCP JSON registration. Set `REA_IDA_MCP_CONFIG` to that file, then select `ida` once through `REA_ANALYSIS_PROVIDER`, the CLI's `--provider ida`, or MCP's `open_binary.provider_id`. No provider startup occurs during discovery.
+
+## Analyze an already-open GUI target
+
+The attached profile supports upstream **1.4.0 legacy tools**, including `get_metadata`, `list_functions`, and `decompile_function`. Copy the upstream registration's `command`, `args`, and optional `env` into a JSON file. An existing `mcpServers` object with an `ida-pro-mcp` entry is also accepted. For example:
+
+```json
+{
+  "command": "python",
+  "args": [
+    "/absolute/path/to/ida_pro_mcp/server.py",
+    "--ida-rpc",
+    "http://127.0.0.1:13337"
+  ]
+}
+```
+
+Use the executable and arguments from your working upstream registration. The legacy GUI's `/mcp` endpoint is its internal RPC endpoint; connect REA through the upstream stdio proxy rather than treating that URL as Streamable HTTP.
+
+```bash
+export REA_IDA_MCP_CONFIG=/absolute/path/to/ida-mcp.json
+export REA_ANALYSIS_PROVIDER=ida
+rea function /absolute/path/to/program main --json
+rea decompile /absolute/path/to/program main --json
+```
+
+Open the **original input binary** in REA, not an `.idb` or `.i64` database. Its SHA-256 must match IDA's recorded input hash. REA checks the attached identity and image base around each analysis request. A mismatch or target switch fails with recovery guidance. The original input must remain readable by REA; WSL can use its mounted alias while the GUI runs on Windows.
+
+REA's close operation releases its MCP connection or proxy. It never saves or closes the existing GUI database. External edits remain visible because results are live and are not replayed from snapshots. These checks do not lock the GUI or prove that the database is unpatched.
+
+## Give REA a target for headless analysis
+
+The headless profile supports upstream's **database supervisor** API: `idb_open`, `idb_list`, `idb_close`, explicit `database` arguments, and modern analysis tools. Legacy 1.4.0 `idalib-mcp`, which accepts one initial filename and serves SSE, does not implement this profile. Follow the [upstream headless instructions](https://github.com/mrexodia/ida-pro-mcp#headless-idalib-session-model) for an installation with the supervisor API.
+
+```json
+{
+  "command": "idalib-mcp",
+  "args": ["--stdio", "--max-workers", "1"],
+  "mode": "headless"
+}
+```
+
+Use an already-installed executable. When required by your existing idalib installation, include `"env": { "IDADIR": "/absolute/path/to/ida" }`. REA neither edits the global activation configuration nor installs dependencies. A configured local Streamable HTTP supervisor can instead use `"url": "http://127.0.0.1:8745/mcp"` and `"mode": "headless"`.
+
+The same CLI commands work in both modes. For a Windows-native REA process:
+
+```powershell
+$env:REA_IDA_MCP_CONFIG = 'D:\analysis\ida-mcp.json'
+$env:REA_ANALYSIS_PROVIDER = 'ida'
+rea function 'D:\samples\program.exe' main --json
+```
+
+Headless REA and the configured supervisor must share the host filesystem and native path syntax. Run REA on Windows when the supervisor runs on Windows. The attached profile can span WSL and a Windows GUI because it binds recorded input hashes instead of asking the GUI to open a WSL path.
+
+REA copies the admitted binary into a private temporary directory, checks its digest, and requests an owned worker with `force_headless`. POSIX workspaces use mode `0700`; Windows uses the matching package's native private-DACL boundary on a local NTFS temporary directory. It injects the returned database ID into analysis requests. It verifies the active owned worker and input path rather than adopting a user database. On close or failed startup, it releases its session with `save: false`, verifies that it is absent from upstream session discovery, and removes its private input and sidecars. An unverified release retains the workspace and reports incomplete cleanup.
+
+One REA session owns one database. Stdio registrations default `IDA_MCP_MAX_WORKERS` to `1`; the explicit upstream `--max-workers 1` also bounds a supervisor. Database size and engine memory depend on the target and upstream; REA does not impose an engine memory limit. The original binary is never executed or overwritten. Optional `workspaceRoot` selects an existing absolute temporary-directory parent on the REA host. Ensure it has space for the input copy and IDA working files.
+
+Headless cleanup uses the upstream database lifecycle. Abruptly terminating REA, its proxy, or the supervisor does not establish worker release. Prefer `close_binary` for MCP sessions; after an interrupted process, inspect upstream session inventory and retained workspace diagnostics before removing working files. This adapter does not claim Windows Job Object containment for the upstream detached workers.
+
+## Connect an agent once
+
+Add the registration path to the **REA** MCP entry's environment, keeping the upstream registration in its separate JSON file:
+
+```json
+{
+  "mcpServers": {
+    "rea": {
+      "command": "npx",
+      "args": ["-y", "rea-agents@<version-with-ida>", "mcp"],
+      "env": {
+        "REA_ANALYSIS_PROVIDER": "ida",
+        "REA_IDA_MCP_CONFIG": "/absolute/path/to/ida-mcp.json"
+      }
+    }
+  }
+}
+```
+
+Use a package version that actually includes this adapter; repository main can be ahead of the npm release. After reconnecting, call:
+
+```json
+{"name":"open_binary","arguments":{"path":"/absolute/path/to/program","provider_id":"ida"}}
+{"name":"analyze_function","arguments":{"procedure":"main"}}
+{"name":"search_strings","arguments":{"pattern":"license"}}
+{"name":"close_binary","arguments":{}}
+```
+
+Opening an MCP target starts its selected provider session; headless opening waits for auto-analysis. Set the agent's MCP request deadline long enough for the target. The registration's optional `timeoutMs` defaults to 300000 for upstream requests. Cancellation drains the current upstream request before cleanup; it does not force-stop GUI analysis. An open request that times out without a completed response retains the private workspace because worker inventory alone cannot prove the request has stopped. `binary_session` reports actual tool availability. Repeated doctor/setup calls are unnecessary when the registration already works.
+
+For guided registration, set `REA_IDA_MCP_CONFIG` before `rea setup --client <client>`. Setup includes that file reference in its reviewed plan and preserves it after approval; it does not copy upstream credentials into the agent configuration. `rea doctor --provider ida --json` validates the registration without starting IDA and explicitly leaves runtime compatibility and target binding for analysis.
+
+## Coverage and evidence
+
+Both profiles support procedure/string inventory and literal or regex search, procedure resolution, pseudocode, assembly, raw function instructions, resolved callees, incoming address references, and a function dossier. Inventories and modern pseudocode/assembly follow upstream pagination. Upstream limits on modern xrefs and callees are retained as explicit truncation limitations. A transport-level truncated preview is rejected rather than reported as complete evidence; the error preserves upstream retrieval guidance.
+
+The legacy profile additionally supports direct callers. Its producer may report call-site or interior addresses; REA resolves the reported function symbol to its canonical entry. The modern profile does not prove direct callers from its code/data xref labels, so that capability is unavailable and the dossier marks it unknown.
+
+Complete body ranges, typed reference edges, CFG, referenced data, source locals, comment kinds, and database revision are unavailable. Empty unsupported dossier facets mean **unknown**, not observed absence. `binary_overview`, whole-symbol inventory, mutation, debugging, arbitrary Python forwarding, and GUI navigation are outside this adapter's coverage. Check session availability before composing a workflow that needs those facets.
+
+`provider.version` identifies the REA adapter; the profile explicitly records `version_scope: "rea-ida-adapter"`. The MCP handshake's `serverInfo` is separate and does not establish IDA or Python distribution versions. Raw observations preserve producer metadata and output. Attached hashes identify the recorded original input; headless identity uses the digest-verified private copy and observed worker input path. Neither proves source-code recovery or an unmodified analysis database.
+
+## Verification
+
+Run `npm run verify:ida -- --target /absolute/path/to/program --procedure main` with a configured upstream server. It exercises production CLI and MCP tools, validates their output contracts and Evidence, checks original-input preservation and session cleanup, and keeps local target data out of its console summary. Supply `--package-root` to verify an extracted or installed package. See [testing](testing.md) for the distinction between adapter tests and real-provider evidence.
+
+The initial real workflows use stdio registrations for the legacy Windows GUI profile and a Windows x64 headless supervisor with IDA 9.3. Streamable HTTP is tested against a loopback MCP fixture with the pinned client SDK; a real IDA HTTP-supervisor workflow remains unverified. Linux/macOS headless engine operation, other IDA releases, architectures, and modern attached GUI tools require their corresponding real workflows before support is claimed.
@@ -36,7 +36,7 @@ Setup continues to pin persistent MCP registrations to the exact version that
 performed setup. Running current setup later migrates unversioned or older
 managed registrations through the normal reviewed setup transaction.

-REA supports Node.js 22.19+ and 24.11+ (including newer releases). It uses the npm already paired with that runtime and never upgrades Node.js, npm, or Homebrew.
+REA supports Node.js 22.x (>=22.19), 24.x (>=24.11), and 26+. Node.js 23, 25, and prereleases are unsupported. It uses the npm already paired with that runtime and never upgrades Node.js, npm, or Homebrew.

 Running `npm install rea-agents` without `--global` installs the executable only
 in the current project's `node_modules/.bin`; it does not make `rea` available
@@ -61,6 +61,55 @@ curl -fsSL https://raw.githubusercontent.com/morluto/rea/main/install.sh |

 Supported options are `--version <semver>`, `--dry-run`, `--no-setup`, `--no-prompt`, and `--verbose`. Neither `--no-prompt` nor a non-interactive shell grants permission to install external dependencies.

+## Released package and main
+
+Repository main documents its current code and generated catalog. `@latest`
+selects the npm release, and persistent MCP registrations are pinned to the
+version that performed setup. Installing newer instructions does not update a
+running server or its registration.
+
+The release checked on **2026-10-06** was **4.1.0** (125 MCP tools). That artifact
+includes main's Windows native control bundle, Android/JADX and firmware
+tools, Ghidra function annotation workflow, and retained application-Evidence
+references.
+Main's catalog describes the current code; a source build or a subsequent
+release containing later changes is required for anything newer. Package startup alone does not verify a
+provider's real platform workflow.
+
+To check the published version, run `npm view rea-agents dist-tags.latest`.
+Use the connected server's actual tool list and advertised input schemas for
+feature selection. The same package version string in a development checkout
+does not establish that its bytes match the npm tarball. Update a registration
+through a reviewed, scoped setup plan, then restart/reconnect the agent.
+
+## Skill-only installation
+
+```bash
+npx skills add morluto/rea --skill reverse-engineer-anything
+```
+
+This installs agent instructions and bundled references, not REA MCP
+registration or analysis engines. Follow the skill's
+[conditional connection guide](../skills/reverse-engineer-anything/SKILL.md#connect-only-when-needed).
+Working tools can be used immediately. If tools are missing, inspect the current
+client's registration with `doctor --client codex --json` (substitute its client
+ID), then plan repairs with `setup --client codex --dry-run --json`. Show and
+approve the exact changes before applying that scope. An aligned registration
+with tools absent from the active session needs a restart/reconnection;
+`doctor` checks files and prerequisites, not the live agent connection.
+
+Guided setup installs the package's matching skill by default. The skills.sh
+route can select newer repository instructions, so follow actual server schemas
+and the release boundary above. Static JavaScript CLI inspection can proceed
+while MCP is unavailable:
+
+```bash
+npx -y rea-agents@latest analyze-javascript-application /absolute/path/to/app --json
+```
+
+It returns the complete Evidence record directly and requires no native engine.
+Provider failures in doctor do not prevent unrelated target-free tools.
+
 ## Supported agents

 Setup can configure these clients for REA's local MCP server:
@@ -77,6 +126,7 @@ Setup can configure these clients for REA's local MCP server:
 | OpenCode           | `opencode`       |
 | Antigravity        | `antigravity`    |
 | GitHub Copilot CLI | `copilot_cli`    |
+| Command Code       | `commandcode`    |
 | VS Code            | `vscode`         |

 ## Review setup changes
@@ -212,22 +262,28 @@ copying license secrets into logs, or killing unrelated Hopper processes.

 ## Ghidra

-REA connects to an existing Ghidra installation on Linux x64 or macOS x64/arm64.
+REA connects to an existing Ghidra installation on Linux x64, macOS x64/arm64,
+or experimental Windows x64 P0.
 It requires Ghidra 12.1.4 and a 64-bit full JDK 21. On macOS, the installation
 must include the native decompiler for the host architecture; REA does not
 build it or change Gatekeeper quarantine settings.

-The adapter exposes 22 read-only operations: ten inventory/name/search
+The adapter exposes 25 read-only operations: thirteen inventory/name/search
 operations and twelve function-analysis operations. These cover metadata,
 decompilation, assembly, resolved calls, typed references, xrefs, function
-dossiers, instructions, and recovered data types. GUI controls and annotation
-changes require Hopper.
+dossiers, instructions, recovered data types, measured load mappings, loaded
+memory bytes, and observed file offsets. Independent load-image attestation
+supports DOS MZ and explicitly selected COM; PE returns its measurements with that limitation.
+On Linux and macOS, `annotate_native_function` also edits a function name and/or
+entry comments atomically and returns refreshed analysis. These session metadata
+edits leave executable bytes unchanged and are discarded on close. GUI controls
+require Hopper; Windows P0 remains read-only.

-Windows Ghidra operations are currently unavailable. The adapter reports
-`unsupported_host` until verified Job Object process ownership, private runtime
-DACLs, and reparse-safe path admission are implemented. The
-[Windows Ghidra P0 guide](windows-ghidra-p0.md) describes the intended boundary
-and remaining controls.
+Windows P0 admits native x86-64 PE applications on fixed local NTFS volumes.
+The npm package bundles native Job Object ownership, protected private runtime
+DACLs, and handle-based path admission; no separate addon installation is needed.
+See the [Windows Ghidra P0 guide](windows-ghidra-p0.md) for verified scope and
+limitations.

 Extract Ghidra and install the JDK outside REA, then export absolute paths:

@@ -238,7 +294,7 @@ rea doctor --json
 rea setup
 ```

-For Windows diagnostics, use the same installation paths in PowerShell. These settings do not enable the blocked analysis operations:
+On Windows, configure the existing installation in PowerShell:

 ```powershell
 $env:GHIDRA_INSTALL_DIR = "C:\tools\ghidra_12.1.4_PUBLIC"
@@ -251,8 +307,8 @@ rea providers --json
 REA skill after approval. Direct registrations use Node to launch REA's entry
 script; package-runner registrations use the pinned `npx` command. Hopper
 installation remains unavailable on Windows. Setup never installs Ghidra,
-Java, or Python, and agent registration does not enable blocked Ghidra
-operations. See [Windows Ghidra P0](windows-ghidra-p0.md) for provider diagnostics.
+Java, or Python. It preserves valid detected Ghidra/JDK settings in agent
+registrations. See [Windows Ghidra P0](windows-ghidra-p0.md) for provider diagnostics.

 Doctor validates the platform, architecture, application version,
 `support/analyzeHeadless` or `support/analyzeHeadless.bat`, Java
@@ -267,12 +323,21 @@ home/cache/config/temp paths. REA passes `-readOnly`, `-deleteProject`, uses
 Ghidra's default analysis and resource settings, and loads its packaged Java
 bridge via `-scriptPath`; it never opens an existing user project. Linux and
 macOS use a current-user-only local bridge socket and descriptor. The
-experimental Windows transport uses authenticated IPv4 loopback, but missing
-native ownership and path controls keep Windows operations unavailable.
+experimental Windows transport uses authenticated IPv4 loopback with a
+private native-owned bearer descriptor and Job Object process ownership.

-Operations begin only after default auto-analysis completes. The provider
-startup deadline fails the open rather than exposing partial analysis. One
-session contains exactly one imported Program; use `provider_id: "ghidra"`, `--provider ghidra`, or
+Operations begin only after default auto-analysis completes. `open_binary`
+selects and validates the target/provider binding; it does not wait for Ghidra
+import and auto-analysis. The first Ghidra-backed query starts that work lazily.
+The provider startup deadline is 330,000 ms for import, analysis, bridge, and
+health readiness; a startup failure is returned by the query that triggered it,
+without exposing partial analysis. This deadline is separate from MCP transport
+initialization and the client's deadline for that individual tool call. A client
+can time out earlier even when Ghidra would complete within its startup deadline.
+See [Ghidra first-query deadlines and recovery](mcp-contracts.md#ghidra-first-query-deadlines-and-recovery)
+for client options and the close/reopen recovery flow.
+
+One session contains exactly one imported Program; use `provider_id: "ghidra"`, `--provider ghidra`, or
 `REA_ANALYSIS_PROVIDER=ghidra` when both Hopper and Ghidra support the target.
 One persistent decompiler is owned by the Program, and a serial queue keeps
 Ghidra API calls on the owning Program thread without a fixed queue length.
@@ -281,6 +346,14 @@ is no fixed per-operation or response-size ceiling. Unresolved computed calls
 remain unknown, reference-kind provenance is preserved, and provider-specific
 pseudocode is never treated as original source or Hopper-equivalent text.

+Unexpected request failures retain their original internal cause. CLI and MCP
+errors expose Error names, messages, and available codes under
+`details.diagnostics.failure_cause`; other rejection values retain their
+primitive value or an explicit type. Shutdown warnings include the failure
+kind, message, and diagnostics, while process and temporary-project cleanup
+continues. These messages redact known bridge authentication tokens and
+preserve local paths and other analysis context.
+
 Run `GHIDRA_INSTALL_DIR=... npm run verify:ghidra` from a source checkout to
 compile and analyze debug and stripped host-native fixtures (ELF on Linux x64
 or Mach-O on macOS), plus a native DWARF 4 type-layout object. This lane needs a
@@ -295,9 +368,12 @@ host-native Ghidra acceptance lane.
 On a controlled Windows x64 runner, use
 `npm run verify:ghidra:windows`. The verifier generates a deterministic native
 PE fixture from source bytes and requires the Windows native authority before
-opening the provider. This lane remains blocked until those controls are
-implemented; its intended checks include operation coverage, digest identity,
-and complete runtime cleanup.
+opening the provider. The controls are implemented on main; see the
+[release boundary](#released-package-and-main). The lane verifies all 25 admitted
+read-only operations, digest identity, and runtime cleanup. The separate
+`verify:ghidra:windows:package` lane checks the packed CLI/MCP boundary with an
+ordinary user. It requires the built Windows native bundle and an existing
+Ghidra/JDK installation; neither is inferred from startup alone.

 ## Diagnose, update, and remove

@@ -315,17 +391,22 @@ server through `npx` with the `mcp` command.

 For a client that requires manual configuration, use:

+<!-- x-release-please-start-version -->
+
 ```json
 {
  "mcpServers": {
    "rea": {
      "command": "npx",
-      "args": ["-y", "rea-agents@latest", "mcp"]
+      "args": ["-y", "rea-agents@4.1.0", "mcp"]
    }
  }
 }
 ```

-Use an exact `rea-agents@VERSION` in the arguments when a reproducible client
-configuration is required. `rea setup` writes the same package-runner shape and
-pins it to the exact version that performed setup.
+<!-- x-release-please-end -->
+
+Persistent registrations should use one exact package version. `rea setup`
+writes the same package-runner shape and pins it to the exact version that
+performed setup. Run current setup to refresh an older registration, then
+restart the client.
@@ -55,6 +55,16 @@ registrations/removals and dispatch, Node timers and cancellation handles, async
 defaults, request construction and response consumers, parse/coercion/
 validation boundaries, and built-in resource acquisition/release.

+Mutation tracking covers explicit member assignments, updates, deletion, and
+loop assignment targets, including the supported local aliases and shared
+nested references. Calls such as `Object.assign`, `Reflect.set`, and
+`Reflect.deleteProperty`, and writes reaching a caller's object through another
+function's parameter, are not tracked by this mutation pass. These channels
+can leave an initializer-derived literal in the graph even after the runtime
+value changes. Treat such a result as an uncovered mutation channel, not as
+proof of the current runtime value; a follow-up needs to model that channel
+and verify its caller/alias behavior.
+
 Function fingerprints commit normalized syntax, control-flow shape, relation
 shape, literal sets, arity, and detected effects without using local names or
 source offsets. Equal duplicate fingerprints remain ambiguous. Dynamic
@@ -139,9 +149,34 @@ available browser, Electron, or process workflows.

 ## CLI and verification

-All five CLI commands accept inline JSON or a path to a JSON file. Put the full
-Evidence records in the workflow input, as in the corresponding MCP tool; the
-CLI does not resolve Evidence IDs from a separate bundle.
+All five CLI commands accept inline JSON or a path to a JSON file. The CLI
+returns an Evidence record directly. Put the full records in a later CLI input;
+a separate CLI process has no retained MCP connection state.
+
+For a literal string trace, analyze your supplied tree once, then build the
+input from the saved Evidence (replace the target and seed):
+
+```bash
+rea analyze-javascript-application /absolute/path/to/app --json > application-evidence.json
+node --input-type=module -e '
+import { readFileSync, writeFileSync } from "node:fs";
+const application = JSON.parse(readFileSync("application-evidence.json", "utf8"));
+writeFileSync("trace-input.json", JSON.stringify({
+  application, seed: { kind: "string", value: "search-result" }, direction: "both"
+}));'
+rea trace-application-feature ./trace-input.json --json
+```
+
+MCP analysis returns an envelope containing `result`, `evidence_id`, and full
+`evidence`. If the connected server advertises retained references, reuse its
+exact returned ID as `{"kind":"retained-evidence","evidence_id":"RETURNED_ID"}`
+in `application`, or `left`/`right` for comparisons. `RETURNED_ID` is a template,
+not a literal valid ID. Native Evidence arrays still use complete records.
+References are scoped to one connection; `close_binary` clears them. Export a
+bundle before closing and import it on another connection, or supply the full
+inline Evidence there. Versions before 4.1.0 accept full inline Evidence only; installing
+newer skill instructions does not change that schema. See
+[MCP Evidence inputs](mcp-contracts.md#retained-application-evidence-inputs).

 For two operator-provided directories or ASARs, run:

@@ -52,6 +52,23 @@ manifest and graph commitments, JavaScript Application Graph, static
 Electron summary, reconstruction statistics, and explicit limitations. It does
 not require a live Hopper, Ghidra, browser, or Electron process.

+## Large results
+
+Graph and Evidence identifiers hash canonical JSON incrementally, without
+assembling a single string for the whole graph. The canonical bytes and existing
+identifiers remain unchanged. The opt-in regression check is
+`npm run verify:javascript:digests`;
+it hashes a value larger than the running Node engine's single-string limit.
+
+Output formatters and MCP transport serialization still assemble whole strings.
+For a large CLI result, select the needed fields
+before formatting, for example `--format json --filter-output
+evidence_id,normalized_result.statistics`. Complete serialization of a result
+beyond the engine's string limit is not established by this digest check.
+Client framing limits also apply: the pinned Node MCP SDK's stdio transport
+defaults to a 10 MiB buffer. Its caller-selected `maxBufferSize` must accommodate
+the complete response, including text and structured Evidence projections.
+
 ## What is reconstructed

 The projector reuses the content-addressed artifact inventory and safe artifact
@@ -18,6 +18,24 @@ rea observe-javascript-runtime http://127.0.0.1:9229 TARGET_ID \
  --runtime-kind node --json
 ```

+## Start a caller-owned Node target
+
+Run your selected application with Inspector bound to loopback:
+
+```bash
+node --inspect=127.0.0.1:9229 ./app.mjs
+```
+
+Keep it running while listing targets and observing the selected ID. Use a free
+port and the same literal endpoint in both REA calls. Stop the application
+through its normal lifecycle when finished; REA disconnects but does not own or
+terminate it. Node.js must already be installed.
+
+Use `--inspect` for this passive workflow. `--inspect-brk` pauses before the
+application starts, and REA never resumes it or sends
+`Runtime.runIfWaitingForDebugger`. Resume a paused target with a separate
+caller-owned debugger before requesting application runtime observations.
+
 The caller supplies the literal-loopback HTTP endpoint directly. Selecting an endpoint exposes all targets it serves and their local script locations or renderer origins. A target must match the exact requested target ID and expose a same-port WebSocket reported by that endpoint. Targets already marked attached are rejected rather than displacing another debugger. Local paths are canonicalized after symlink resolution.

 `list_javascript_runtime_targets` returns every available target in one inline
@@ -1,4 +1,4 @@
-# Managed-code analysis plan
+# Managed-code analysis and planned extensions

 REA inspects .NET PE/CLI artifacts without loading or executing their code.
 It can identify an assembly, inspect metadata and CIL, compare members across
@@ -27,6 +27,20 @@ This guide describes the implementation and verification of
 [ADR-0003](adr/0003-managed-code-evidence-and-provider-boundary.md). The canonical
 tool inventory is [`product-catalog.json`](product-catalog.json).

+## Shipped scope
+
+The canonical parser admits PE/CLI bytes and their metadata/CIL without loading
+an assembly. It reports observed implementation markers and unavailable facts;
+it does not unpack .NET single-file hosts, decode IL2CPP metadata, or infer a
+NativeAOT identity from an ordinary native PE. Inputs without admitted CLI
+metadata do not become managed assemblies through naming or routing guesses.
+Inspect separately obtained components explicitly and preserve their identities.
+
+The broader deployment classification and native-body mapping below are design
+goals from ADR-0003, not claims that every row has an implemented parser. A
+valid marker can establish a candidate native boundary, not recovered native
+semantics or runtime behavior.
+
 ## Analysis objective

 REA's managed-code track is intended to answer five different questions without
@@ -43,9 +57,9 @@ collapsing them:
 The ordinary workflow ends at question four. Static analysis never loads or
 executes the target.

-## Classification workflow
+## Planned deployment classification

-Classification proceeds from the outermost authenticated bytes inward:
+The intended extended classifier proceeds from outermost authenticated bytes inward:

 ```text
 source path
@@ -58,7 +72,7 @@ source path
  -> managed-only, native-only, composed, degraded, or unsupported route
 ```

-The result is a vector rather than one label. For example, a single-file modern
+The planned result is a vector rather than one label. For example, a single-file modern
 .NET deployment can contain a native host, ordinary CIL assemblies, and
 ReadyToRun components. Each component receives its own digest, classification,
 coverage, and route while retaining the outer bundle commitment.
@@ -76,6 +90,51 @@ coverage, and route while retaining the outer bundle commitment.
 | Obfuscated assembly   | Same positive byte observations as its underlying deployment form            | Meaning inferred only from names                                                          |
 | Malformed/unsupported | Exact admitted regions and failure locations                                 | Completeness, successfully skipped rows, or semantics beyond the admitted parser boundary |

+### NativeAOT metadata recovery
+
+NativeAOT removes the ordinary CIL method bodies, so a CIL decompiler cannot
+reconstruct those bodies as C# source. The executable remains a native target
+for Hopper or Ghidra, where decompilation produces pseudocode and analyst
+inference. This is a different route from ordinary managed member inspection.
+
+NativeAOT is not limited to Windows `.exe` files. The native image can be PE,
+ELF, or Mach-O, and NativeAOT can also publish shared libraries (PE DLL, ELF
+`.so`, or Mach-O `.dylib`) with explicitly exported entry points. Identify the
+image from its bytes and loader metadata, not its filename extension. When the
+image is inside an application bundle, inventory or extract the bundle first
+and carry the component identity into native analysis. Matching PDB, ELF debug,
+or dSYM sidecars can add symbol evidence when the selected provider supports
+them; verify their identity and keep them separate from observations made from
+the executable itself. [Microsoft's NativeAOT overview](https://learn.microsoft.com/en-us/dotnet/core/deploying/native-aot/)
+lists supported OS/architecture targets and deployment limitations, while its
+[native library guide](https://learn.microsoft.com/en-us/dotnet/core/deploying/native-aot/libraries)
+describes exported shared-library entry points.
+
+The [Ghidra NativeAOT analyzer](https://github.com/Washi1337/ghidra-nativeaot)
+is a useful optional companion for recovering ReadyToRun metadata. It
+rehydrates the `DEHYDRATED_DATA` section and annotates method tables, type
+relationships, vtable slots, frozen objects, and strings. It does not recover
+original C# method bodies. It is a separate Ghidra extension and interactive
+metadata browser; REA does not currently install or invoke it through its
+headless bridge. Its README describes ReadyToRun header discovery, including
+symbol-based and heuristic paths, so a missed header or unsupported binary
+should remain an explicit limitation rather than a failed claim about the
+binary's contents.
+
+The upstream analyzer currently gates its own analysis to x86-64. NativeAOT's
+broader platform matrix does not establish REA coverage: PE/COFF, ELF, Mach-O,
+shared libraries, target architectures, and runtime metadata versions each need
+their own provider verification. REA's experimental Windows Ghidra boundary is
+limited to admitted native x86-64 PE applications, so it does not currently
+establish coverage for PE DLLs. Mobile NativeAOT targets should remain
+experimental until REA has a matching provider and package-level verification.
+
+For REA's native analysis, preserve the same artifact path and digest used by
+`inspect_managed_artifact`, and report recovered type data as provider
+observations. Linking those types to native function addresses requires verified
+provider evidence; names or vtable similarity alone do not prove that a native
+function implements a specific managed method.
+
 ## Evidence record shape

 Every planned operation returns a provider result and Evidence with four
@@ -257,17 +316,20 @@ or server-side behavior.
 ## Tool and packaging boundary

 The production parser is REA-owned TypeScript and ships with the existing Node
-application. It is verified against the ECMA-335 format and independent pinned
-oracles but has no runtime dependency on them.
+application. Deterministic conformance uses source-owned byte-built PE/CLI
+fixtures and expected semantic facts. An optional real ILSpy lane runs only when
+its executable is explicitly supplied; the default lane does not establish
+independent pinned-oracle parity. Production inspection needs none of those tools.

- `System.Reflection.Metadata` is the primary independent metadata/CIL oracle.
- `ICSharpCode.Decompiler` and `ilspycmd` are reconstruction and differential
-  oracles. An admitted BYO reconstruction operation records its exact version
+- A pinned `System.Reflection.Metadata` differential oracle is planned; it is
+  not part of the current verifier.
+- `ICSharpCode.Decompiler`/`ilspycmd` can supply reconstruction inference.
+  A BYO reconstruction import records the supplied version
  and remains non-canonical. When `REA_ILSPY_CMD_PATH` points to an absolute
  runnable `ilspycmd`, `verify:managed` runs a source-owned real ILSpy oracle
  and imports its C# output as reconstruction inference against exact static
  member Evidence.
- dnlib and Mono.Cecil may increase differential coverage. Their mutation APIs
+- dnlib and Mono.Cecil are potential future differential oracles. Their mutation APIs
  are not exposed or included in the production parsing boundary.
 - The package contains no .NET runtime, SDK, ILSpy installation, proprietary
  assembly, or compiled conformance fixture.
@@ -288,6 +350,11 @@ by the selected Hopper/Ghidra host and format matrix.

 ## Source-built conformance corpus

+The current lane uses source-owned byte-built fixtures and malformed-input
+regressions, with optional operator-supplied applications and ILSpy verification.
+The table below describes the desired expanded corpus; it is not a report that
+all compiler-generated forms have been independently verified.
+
 Fixture sources are intentionally small and behavior-focused. Build outputs
 are generated outside tracked fixture directories and must not remain after
 verification or packaging.
@@ -437,3 +504,11 @@ The managed-code track advances as reviewable pull requests:

 Each implementation PR updates generated product facts only for behavior it
 actually ships and states which real-tool checks were performed.
+
+### Method metadata during build comparison
+
+Managed member comparisons report a `metadata` dimension when an observed
+MethodDef flags or implementation flags value differs, including accessibility
+or synchronization changes. This is separate from the CIL/signature matching
+tiers: identical instructions do not establish unchanged method metadata. The
+reported difference is static metadata evidence, not proof of runtime behavior.
@@ -8,15 +8,19 @@ registrations, reports their command vectors as aligned, stale, missing, or
 invalid, and keeps live-server state `unknown` unless the active connection
 supplies identity.

-Canonical tool names remain stable, while `tools/list` advertises only the
-operations callable for the current target, provider, host, and
-negotiated client capabilities. `binary_session.tool_availability` remains the
-complete inventory: it explains advertised and hidden operations with stable
-availability reasons and remediation. Each entry also reports required and
-optional negotiated client features plus the currently missing features.
-Opening or closing a target or observing a provider health transition emits
+`tools/list` returns the complete canonical tool inventory, including tools that
+are currently unavailable. Opening or closing a target or observing a provider
+health transition leaves that catalog unchanged and does not emit
 `notifications/tools/list_changed`.

+Call `binary_session` with `{}` and read `result.tool_availability` to choose a
+callable operation for the current target, provider, host, and negotiated client
+capabilities. The default result includes the complete inventory with each
+tool's availability, reason, and remediation. Each entry also reports required
+and optional negotiated client features plus the currently missing features.
+The optional inputs `expected_package_version`, `expected_catalog_digest`, and
+`expected_server_path` compare the live session with the caller's expectations.
+
 `binary_session.analysis_provider_candidates` is authoritative for deep-engine
 discovery. Target-free discovery is sorted by provider ID, reports host
 availability and `unknown` target support, and does not create an analysis
@@ -53,6 +57,74 @@ CLI calls work without a progress token and translate SIGINT into the same
 AbortSignal used by providers. Existing controlled-process cleanup and provider
 shutdown rules still apply; REA never kills a process it cannot prove it owns.

+## Ghidra first-query deadlines and recovery
+
+A successful MCP initialize handshake establishes the REA connection.
+`open_binary` then selects a target and provider binding; it does not establish
+that Ghidra has finished importing the target. The first Ghidra-backed query,
+such as `binary_overview`, starts the engine and waits for import, default
+auto-analysis, bridge connection, and health readiness before returning analysis.
+
+These deadlines have different owners:
+
+| Deadline             | Owner and effect                                                                                                                                                 |
+| -------------------- | ---------------------------------------------------------------------------------------------------------------------------------------------------------------- |
+| MCP initialize       | The client bounds transport/REA connection startup, before any target query.                                                                                     |
+| Ghidra startup       | REA allows 330,000 ms for engine readiness from the first provider query; startup failure is reported by that query.                                             |
+| Individual tool call | The client bounds its wait, including cold engine startup. The pinned client SDK 2.3.1 defaults to 60,000 ms and can cancel earlier than REA's startup deadline. |
+
+For an already connected client using the pinned SDK, request options are the
+**second** argument of `callTool`:
+
+```js
+const overview = await client.callTool(
+  { name: "binary_overview", arguments: {} },
+  {
+    timeout: 240000,
+    onprogress: ({ progress, total, message }) => {
+      console.error({ progress, total, message });
+    },
+  },
+);
+```
+
+The SDK's `onprogress` option supplies a progress token and handles matching
+notifications. A raw MCP client can instead send `_meta.progressToken` in the
+request and handle `notifications/progress`. Progress reports do not establish
+engine readiness or a percentage of Ghidra auto-analysis. A longer server
+startup allowance does not extend the client's deadline; progress also does not
+extend it unless the client explicitly implements that policy.
+
+The 240-second setting is a measured example, not a universal timeout: a
+controlled Linux x64/WSL2 fixture took about 64 seconds for its first overview
+with Ghidra 12.1.4 on a mounted NTFS installation, native JDK 21, two CPUs, and a
+512 MiB Java heap. Target size, storage, and analysis work can change that time.
+Configure the deadline in the caller's existing request settings; it is not a
+tool argument, setup grant, or server-side automatic extension. CLI analysis has
+no MCP client request deadline, but keeps the provider startup deadline and
+SIGINT cancellation.
+
+If the client timed out or cancelled during startup, the pending query may have
+been interrupted. Reissuing `open_binary` for the same active target can reuse
+the current client, so it is not a fresh-start recovery. On the same connection:
+
+1. Keep any useful inline Evidence, or export a bundle before closing if retained
+   records are needed. `binary_session` can show the selected binding and its
+   recorded state; target selection alone does not prove engine readiness.
+2. Call `close_binary` and check its result. It drains owned work, closes the
+   provider, and clears retained session records. A `cleanup_incomplete` result
+   must be addressed according to its reported owned resources before retrying.
+3. Call `open_binary` with the same caller-selected path and
+   `provider_id: "ghidra"`, then retry the first query with an appropriate client
+   deadline. The connection and selected provider do not need to change.
+
+This close/reopen flow was exercised on one real Linux stdio connection after a
+controlled startup timeout, followed by a successful overview and function
+analysis. It is not a Windows/macOS coverage claim. REA cleans only resources it
+owns and never switches to another provider automatically. A provider timeout,
+installation failure, or host permission denial needs its own reported recovery;
+increasing a client deadline alone does not fix those failures.
+
 ## Tool results

 Evidence-producing tools return `{ result, evidence_id, evidence }` in both
@@ -64,6 +136,47 @@ directly to `compare_functions`, and `inspect_artifact` Evidence to
 `compare_artifacts`. Use `get_evidence_bundle` when the task needs broader
 retained session history or an explicit bundle for transfer.

+## Retained application Evidence inputs
+
+`trace_application_feature`, `trace_javascript_semantics`,
+`compare_application_versions`, `compare_source_to_bundle`, and
+`compare_javascript_export_shapes` accept complete inline application Evidence
+or an exact reference to a record already retained by the current connection:
+
+```json
+{
+  "name": "trace_application_feature",
+  "arguments": {
+    "application": {
+      "kind": "retained-evidence",
+      "evidence_id": "ev_<64 lowercase hex characters>"
+    },
+    "seed": { "kind": "module", "value": "search.js", "match": "exact" }
+  }
+}
+```
+
+Use the `evidence_id` returned by `analyze_javascript_application` (or another
+compatible application-graph producer). Comparisons accept this form in `left`
+and `right`; each side can independently be inline or retained. Native
+observation arrays continue to take complete inline Evidence. Results and their
+Evidence remain complete inline, and both input forms pass the same semantic,
+identity, authority, and provenance checks without running the producer again.
+
+References belong to the current connection's Evidence ledger. Opening another
+target preserves retained records; `close_binary` clears them, even when no
+binary is active. A fresh connection has its own ledger. A missing reference
+reports its exact ID and `details.reason: "missing"`; the server cannot infer
+whether it was never recorded, cleared, or retained by another connection.
+Supply complete inline Evidence, repeat its producer, or import an exported
+Evidence bundle before referencing that imported record. Export a bundle before
+closing if the investigation needs it later.
+
+CLI application workflows continue to read portable inline Evidence from files
+and run the same analysis workflows; a standalone CLI invocation cannot resolve
+another MCP connection's retained records. No additional lookup call, provider
+selection, or approval step is required for a same-session follow-up.
+
 ## Aggregate native context

 `get_navigation_context` composes the selected document, current address, and
@@ -25,6 +25,13 @@ Tool results include their Evidence inline. Prompts do not require a bundle or
 resource fetch to read a result; an Evidence ID is only a reference when a
 prompt argument or tool explicitly accepts one.

+For a JavaScript/Electron application directory, `investigate_feature` points
+directly to `analyze_javascript_application` with `input_path`; it does not
+require `open_binary`. The CLI equivalent is `rea analyze <directory>`.
+`open_binary` and the doctor target check admit files and macOS app bundles.
+A directory outside that opening route is reported with an available analysis
+action; this does not establish support for every directory format.
+
 For target paths in `compare_application_versions`, the prompt suggests
 opening each target before calling `inspect_artifact`; inspection operates on
 the active target and returns the graph and findings together inline.
@@ -6,6 +6,12 @@ coverage and unknowns. The CLI and MCP use the same application workflows.

 ## Static inspection

+`inspect_macho` retains otool segment `file_offset` values relative to the
+selected Mach-O slice. Its evidence file-offset ranges address the original
+input file and include the observed lipo slice offset for universal binaries.
+If that offset is unavailable, segment evidence locations are omitted with an
+explicit limitation; architecture inventory locations remain available.
+
 - `inspect_asset_catalog` / `rea inspect-asset-catalog <app>` reads compiled
  `Assets.car` metadata through macOS `assetutil --info`. Catalog digests, raw
  rendition fields, pagination and exact UI resource-name matches are returned.
@@ -146,12 +152,14 @@ actions may change application data or trigger network activity.

 Install Ghidra 12.1.4 and a full 64-bit JDK 21 separately, then configure REA to
 use them. Ghidra analysis supports Linux x64 and macOS x64/arm64; macOS requires
-the matching native decompiler. Windows Ghidra analysis is unavailable until
-Job Object process ownership, private runtime DACLs, and reparse-safe path checks
-are implemented and verified. See [Windows Ghidra P0](windows-ghidra-p0.md) and
+the matching native decompiler. Experimental Windows x64 P0 admits native
+x86-64 PE applications on local NTFS using bundled Job Object ownership,
+protected runtime DACLs, and handle-based path admission. See [Windows Ghidra P0](windows-ghidra-p0.md) and
 [issue #527](https://github.com/morluto/rea/issues/527).
-Ghidra has no GUI or mutation authority, and REA never falls back automatically
-to Hopper.
+On Linux and macOS, `annotate_native_function` atomically edits a function name
+and entry comments in the ephemeral database, returning refreshed analysis
+without changing executable bytes. Windows P0 remains read-only. Ghidra has no
+GUI authority, and REA never falls back automatically to Hopper.

 - `npm run verify:ghidra`: host-native debug/stripped targets, native type layout,
  instruction/call facts, value dependencies and process/project cleanup.
@@ -12,14 +12,37 @@ sandbox. Filesystem observation paths select what REA snapshots; they do not
 restrict what the process can read or write. The inherited environment is not
 recorded, so its influence may remain unknown.

+## Host support
+
+Capturing a new scenario currently requires Linux or macOS and a working
+native PTY backend. Native Windows capture is unavailable because the PTY
+adapter does not yet verify descendant cleanup. The native Job Object controls
+used by other REA providers do not establish PTY capture support. Reinstalling
+the Windows PTY binary does not enable this workflow.
+
+For Linux commands, use Linux REA inside WSL. Adapt the scenario to that host;
+this does not establish capture of a native Windows process tree. Comparing
+existing capture Evidence through the CLI or MCP remains available on Windows
+and does not launch a PTY or the captured target.
+
+On supported capture hosts, a missing or incompatible native PTY binary has a
+different recovery: reinstall REA for the active platform, architecture, and
+Node.js version with optional dependencies enabled. Capability diagnostics
+distinguish this from the Windows capture-adapter limitation.
+
 ## Capture a command

 Write a JSON scenario and pass its path to the CLI:

 ```sh
-rea capture-process ./scenario.json > capture.json
+rea capture-process ./scenario.json --json > capture.json
 ```

+`--json` is required when saving input for JSON consumers; the default terminal
+format is TOON. The file contains the complete capture Evidence record.
+Choose an output file distinct from the scenario input: shell redirection opens
+and truncates the output before REA reads the scenario.
+
 For example:

 ```json
@@ -1,24 +1,25 @@
 {
  "package": {
    "name": "rea-agents",
-    "version": "4.0.1",
+    "version": "4.1.0",
    "sdk": {
-      "server": "2.0.0",
-      "client": "2.0.0",
-      "core": "2.0.0"
+      "server": "2.3.1",
+      "client": "2.3.1",
+      "core": "2.3.1"
    },
-    "skill_version": "24"
+    "skill_version": "26"
  },
  "tools": {
-    "total": 116,
+    "total": 126,
    "families": [
      {
        "id": "direct",
        "surface": "official-proxy",
-        "count": 39,
+        "count": 41,
        "tools": [
          "address_name",
          "address_to_file_offset",
+          "annotate_native_function",
          "comment",
          "current_address",
          "current_document",
@@ -27,6 +28,7 @@
          "inline_comment",
          "inspect_native_data_type",
          "inspect_native_instruction",
+          "inspect_native_load_image",
          "list_bookmarks",
          "list_documents",
          "list_names",
@@ -119,6 +121,24 @@
          "verify_managed_native_boundaries"
        ]
      },
+      {
+        "id": "firmware",
+        "surface": "firmware-provider",
+        "count": 2,
+        "tools": ["extract_firmware", "inspect_firmware_regions"]
+      },
+      {
+        "id": "android",
+        "surface": "android-provider",
+        "count": 5,
+        "tools": [
+          "inspect_android_class",
+          "inspect_android_method",
+          "inspect_android_package",
+          "search_android_classes",
+          "trace_android_references"
+        ]
+      },
      {
        "id": "browser",
        "surface": "browser-provider",
@@ -159,13 +179,14 @@
      {
        "id": "application",
        "surface": "application-workflow",
-        "count": 7,
+        "count": 8,
        "tools": [
          "build_reconstruction_obligation_ledger",
          "compare_application_versions",
          "compare_javascript_export_shapes",
          "compare_source_to_bundle",
          "evaluate_reconstruction_coverage",
+          "export_web_scripts",
          "trace_application_feature",
          "trace_javascript_semantics"
        ]
@@ -201,15 +222,24 @@
    ]
  },
  "providers": [
+    {
+      "id": "binwalk",
+      "name": "Binwalk",
+      "version": "3.1.0",
+      "capabilities": ["inspect_firmware_regions"]
+    },
    {
      "id": "ghidra",
      "name": "Ghidra",
      "version": null,
      "capabilities": [
        "address_name",
+        "address_to_file_offset",
        "analyze_function",
+        "annotate_native_function",
        "inspect_native_data_type",
        "inspect_native_instruction",
+        "inspect_native_load_image",
        "list_documents",
        "list_names",
        "list_procedures",
@@ -222,6 +252,7 @@
        "procedure_info",
        "procedure_pseudo_code",
        "procedure_references",
+        "read_bytes",
        "read_function_instructions",
        "resolve_containing_procedure",
        "resolve_native_call_targets",
@@ -274,6 +305,37 @@
        "xrefs"
      ]
    },
+    {
+      "id": "ida",
+      "name": "IDA Pro MCP adapter",
+      "version": "1",
+      "capabilities": [
+        "analyze_function",
+        "list_procedures",
+        "list_strings",
+        "procedure_address",
+        "procedure_assembly",
+        "procedure_callees",
+        "procedure_callers",
+        "procedure_pseudo_code",
+        "read_function_instructions",
+        "search_procedures",
+        "search_strings",
+        "xrefs"
+      ]
+    },
+    {
+      "id": "jadx",
+      "name": "JADX headless",
+      "version": "0.7.1",
+      "capabilities": [
+        "inspect_android_class",
+        "inspect_android_method",
+        "inspect_android_package",
+        "search_android_classes",
+        "trace_android_references"
+      ]
+    },
    {
      "id": "native-macos",
      "name": "macOS native inspection utilities",
@@ -388,6 +450,18 @@
        "list_javascript_runtime_targets",
        "observe_javascript_runtime"
      ]
+    },
+    {
+      "id": "rea-web-script-export",
+      "name": "REA captured script export",
+      "version": "1",
+      "capabilities": ["export_web_scripts"]
+    },
+    {
+      "id": "unblob",
+      "name": "Unblob",
+      "version": "26.6.4",
+      "capabilities": ["extract_firmware"]
    }
  ],
  "setup_clients": [
@@ -451,6 +525,12 @@
      "format": "copilot_cli",
      "configuration": "managed"
    },
+    {
+      "id": "commandcode",
+      "display_name": "Command Code",
+      "format": "commandcode",
+      "configuration": "managed"
+    },
    {
      "id": "vscode",
      "display_name": "VS Code",
@@ -459,11 +539,13 @@
    }
  ],
  "cli": {
-    "primary_count": 69,
+    "primary_count": 81,
    "commands": [
+      "address-to-file-offset",
      "analyze",
      "analyze-javascript-application",
      "analyze-web-bundle",
+      "annotate-native-function",
      "build-reconstruction-obligation-ledger",
      "capabilities",
      "capture-browser-scenario",
@@ -487,14 +569,20 @@
      "evaluate-reconstruction-coverage",
      "evidence-export",
      "evidence-import",
+      "export-web-scripts",
      "extract-artifact",
+      "extract-firmware",
      "function",
      "import-managed-reconstruction",
      "import-reference-source",
      "inspect",
+      "inspect-android-class",
+      "inspect-android-method",
+      "inspect-android-package",
      "inspect-artifact",
      "inspect-asset-catalog",
      "inspect-electron-page",
+      "inspect-firmware-regions",
      "inspect-keyed-archive",
      "inspect-macho",
      "inspect-managed-artifact",
@@ -504,6 +592,7 @@
      "inspect-native-data-type",
      "inspect-native-dispatch-metadata",
      "inspect-native-instruction",
+      "inspect-native-load-image",
      "inspect-plist",
      "inspect-signature",
      "inspect-web-page",
@@ -517,11 +606,14 @@
      "observe-web-session",
      "project-managed-application-graph",
      "providers",
+      "read-bytes",
      "reconcile-javascript-runtime",
      "resolve-native-call-targets",
      "search",
+      "search-android-classes",
      "setup",
      "trace",
+      "trace-android-references",
      "trace-application-feature",
      "trace-javascript-semantics",
      "trace-native-ui-action",
@@ -540,15 +632,15 @@
  },
  "runtime_catalog": {
    "counts": {
-      "cli_commands": 69,
-      "mcp_tools": 116,
+      "cli_commands": 81,
+      "mcp_tools": 126,
      "mcp_prompts": 6
    },
    "digests": {
-      "tools_sha256": "7849b6f39bed200cfbf5f4d09ba3f9e0661824efb5753ae2edde8ef2fb66535e",
-      "prompts_sha256": "4762db348821fec787a5b8c6423f2c48a71f6f0ec2afee97b16ad69030ec504b",
-      "combined_sha256": "5bb3f994a3c4d0c87a34ff5aab4e28141b5fa6f3a98b5ae7e95686d85d9d983e",
-      "providers_sha256": "2ae8b85b20be338739e500549d275e78e875aaa10235d2ca283f0ade7787da90"
+      "tools_sha256": "569db1182f19869a3bdb22cf217bc75526f317b59635c8866d0e62741077cd52",
+      "prompts_sha256": "ef2de8814390b340623c32001610aa2709d90bed51537b6e562ab3abf144ab4d",
+      "combined_sha256": "e21455dd7d64af94e0b07aff55ab82f03a37e46729ece51be38b50083d2d5b55",
+      "providers_sha256": "7949ddcf2eb5ba41b022bb3dfa1951ab96dbf5640285fa7fd5d35b0e4a5bdab3"
    }
  }
 }
@@ -1,21 +1,27 @@
 # Static-analysis provider evaluation

+This guide describes repository main. Check the [released package boundary](installation.md#released-package-and-main) when using npm.
+
 Ghidra read-only analysis is available on Linux x64 and macOS x64/arm64.
 Install Ghidra 12.1.4 and a full 64-bit JDK 21 separately, then configure REA to
 use them. macOS installations need the matching native decompiler.

-REA imports one target into a temporary project and exposes 22 read-only
+REA imports one target into a temporary project and exposes 25 read-only
 operations after analysis completes. They cover inventories, search,
 decompilation, assembly, function metadata, resolved calls, references, control
 flow, instructions, and recovered types. Results identify the provider version,
 analysis settings, target digest, and any unavailable or incomplete facts.
-Ghidra does not expose Hopper's GUI or annotation operations.
+On Linux and macOS, `annotate_native_function` additionally edits names and entry
+comments atomically, verifies readback, and returns refreshed function analysis.
+Changes live only in the session database and leave executable bytes unchanged.
+Ghidra does not expose GUI controls; Windows P0 remains read-only.

-Windows Ghidra analysis is unavailable, including on a correctly configured
-Ghidra/JDK host. Job Object process ownership, private runtime DACLs, and
-reparse-safe path checks are not implemented. Package and adapter tests do not
-establish real Windows analysis support. See [Windows Ghidra P0](windows-ghidra-p0.md)
-and [issue #527](https://github.com/morluto/rea/issues/527).
+Windows x64 P0 supports native x86-64 PE applications on local NTFS with
+bundled Job Object ownership, protected runtime DACLs, and handle-based path
+admission. Real ordinary-user verification covers all 25 read-only operations
+through the packaged CLI and MCP, target integrity, and cleanup. This remains
+an experimental boundary; see [Windows Ghidra P0](windows-ghidra-p0.md) and
+[issue #527](https://github.com/morluto/rea/issues/527).

 [ADR-0001](adr/0001-provider-selection-and-analysis-profiles.md) fixes the
 provider registry, deterministic selection, target binding, analysis profile,
@@ -51,8 +57,9 @@ follow.
 optional `JAVA_HOME` must identify a 64-bit full JDK 21, otherwise doctor probes
 `java`/`javac` or `java.exe`/`javac.exe` from `PATH`. Supported Linux and macOS
 hosts accept compatible ELF, PE, and Mach-O executable targets. Host admission
-and target compatibility are separate checks. The intended Windows P0 accepts
-only native x86-64 PE applications; it remains blocked before launch.
+and target compatibility are separate checks. Windows x64 P0 admits only native,
+non-managed, non-DLL x86-64 PE applications on fixed local NTFS, with the packaged
+native authority available before launch.

 The launcher creates one ephemeral runtime root with project,
 home/cache/config/data/temp, logs, descriptor, endpoint, target snapshot, and
@@ -63,18 +70,21 @@ On Linux, the mode-0600 descriptor carries the random token without
 exposing it in argv or environment and the Java bridge binds a mode-restricted
 Unix socket. macOS uses the same local transport. The bridge reports actual
 Ghidra/language/compiler/analysis/import-digest metadata and accepts only
-authenticated `ping`, `shutdown`, ten inventory methods, and twelve
-function-analysis methods. Close, cancellation, timeout, malformed protocol,
+authenticated `ping`, `shutdown`, thirteen read-only inventory/load-image methods,
+and twelve function-analysis methods. Linux/macOS also admits atomic function
+annotation changes in the ephemeral database. Close, cancellation, timeout, malformed protocol,
 or process exit stops the owned process resources, closes the socket, and
 removes the runtime root.

 The experimental Windows transport uses authenticated IPv4 loopback with a
-token-free endpoint record, but cannot start while the native authority is
-unavailable. Its `taskkill` cleanup code does not establish Job Object ownership,
-private DACLs, or reparse-safe paths.
+token-free endpoint record. The bundled native authority establishes Job Object
+ownership, protected runtime DACLs, and handle-based path admission before
+launch. If the bundle or an admission constraint is unavailable, the provider
+remains unavailable; a `taskkill` fallback does not establish that authority.

-The provider catalog lists the 22 Ghidra operations. GUI cursor,
-navigation, and mutation operations remain absent; the router therefore
+The provider catalog lists 25 read-only Ghidra operations and the Linux/macOS
+session annotation operation. GUI cursor/navigation and persistent mutations
+remain unavailable; Windows P0 admits no database mutation. The router therefore
 reports them unavailable instead of borrowing Hopper semantics or inferring
 capability from a successful import.

@@ -122,12 +132,14 @@ Mach-O target coverage. It requires `clang`, LLD, and `lld-link`; set
 these tools before compilation. Keeping this matrix separate lets Linux
 host/provider acceptance run with only the host compiler.

-`npm run verify:ghidra:windows` remains blocked by the missing Windows native
-authority. After those controls are implemented, the lane must check the
-source-owned native x86-64 PE fixture, all read-only operations,
-target/snapshot/import SHA-256 linkage, and project, endpoint, process, and
-runtime cleanup. The existence of this verifier is not evidence that Windows
-Ghidra analysis works.
+`npm run verify:ghidra:windows` checks the source-owned native x86-64 PE
+fixture, all 25 read-only operations, target/snapshot/import SHA-256 linkage,
+and project, endpoint, process, and runtime cleanup. The independent native
+lane checks DACLs, handle admission, cancellation, and Job Object lifecycle.
+`npm run verify:ghidra:windows:package` packs and installs REA into an isolated
+prefix, then checks ordinary-user CLI/MCP operations against canonical contracts.
+All lanes require matching native controls; package startup alone establishes
+only package compatibility.

 ## Shared provider-process foundation

@@ -138,8 +150,8 @@ request cancellation and lifecycle-deadline cleanup, bounded stdout and stderr r
 exact byte counts, process-exit diagnostics, and bounded TERM-to-KILL shutdown.
 Reusable fixtures exercise exit, timeout, cancellation, graceful termination,
 forced termination, double-close, spawn failure, and resource release. Windows
-process-tree termination code exists, but the missing Job Object and private
-runtime controls prevent it from establishing an available Ghidra session.
+Ghidra uses its native Job Object, private runtime, and path-admission boundary;
+generic process-tree termination alone cannot establish provider availability.

 The foundation does not define a bridge schema, socket framing, health payload,
 analysis model, or shutdown acknowledgement. Hopper keeps its authenticated
@@ -149,12 +161,12 @@ only the generic process mechanisms.

 ## Shortlist

-| Provider                                                                                    | License / automation surface                                                                                                                                           | What it brings                                                                                                                                          | REA fit and blockers                                                                                                                                                                                                                                                   |
-| ------------------------------------------------------------------------------------------- | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------- | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
-| [Ghidra](https://github.com/NationalSecurityAgency/ghidra)                                  | Apache-2.0 source license; `analyzeHeadless`, Java APIs, and PyGhidra                                                                                                  | Static analysis, multiple processors and formats, scripting, and project/database workflows                                                             | 22 read-only operations shipped on Linux/macOS with installation checks, temporary projects, a serial API queue, and real ELF/PE/Mach-O conformance. Windows analysis is blocked; GUI and mutation operations are unavailable.                                         |
-| [Rizin](https://github.com/rizinorg/rizin) / [rz-pipe](https://github.com/rizinorg/rz-pipe) | Rizin repository contains LGPL-3.0 and GPL-3.0 components; `rizin`, `rz-bin`, and language bridges through `rzpipe`                                                    | Portable CLI analysis, disassembly/debugging, many architectures and file formats, JSON command output                                                  | Good candidate for a process-backed Linux provider and fast metadata fallback. License/component inventory must be preserved; command output needs version-pinned parsers and semantic conformance before evidence is trusted.                                         |
-| [LIEF](https://github.com/lief-project/LIEF)                                                | Apache-2.0; C++, Python, and other bindings                                                                                                                            | Deterministic parsing and modification of ELF, PE, Mach-O, COFF, and related executable formats; headers, sections, symbols, relocations, and functions | Best near-term complement, not a decompiler replacement. It can cover format metadata and artifact evidence without a long-lived analysis process; function semantics, pseudocode, CFG, and cross-reference parity remain out of scope unless separately demonstrated. |
-| [Binary Ninja](https://docs.binary.ninja/dev/index.html)                                    | API/documentation components are MIT, while the analysis product is licensed by edition; commercial, Ultimate, or Headless license is required for headless automation | Python/Core/C++/Rust APIs, headless loading, IL layers, function analysis, plugins, and configurable analysis                                           | Strong technical fit for a native provider, especially function dossiers. Commercial licensing, license-secret handling, native runtime packaging, and multithreaded lifecycle rules are material deployment blockers.                                                 |
+| Provider                                                                                    | License / automation surface                                                                                                                                           | What it brings                                                                                                                                          | REA fit and blockers                                                                                                                                                                                                                                                                                                                                                                                                                |
+| ------------------------------------------------------------------------------------------- | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------- | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
+| [Ghidra](https://github.com/NationalSecurityAgency/ghidra)                                  | Apache-2.0 source license; `analyzeHeadless`, Java APIs, and PyGhidra                                                                                                  | Static analysis, multiple processors and formats, scripting, and project/database workflows                                                             | 25 read-only operations shipped on Linux/macOS with installation checks, temporary projects, a serial API queue, and real ELF/PE/Mach-O conformance. Experimental Windows x64 P0 supports native x86-64 PE on local NTFS with bundled native controls and ordinary-user CLI/MCP verification; Linux/macOS additionally support atomic session function annotations; Windows mutation and all Ghidra GUI operations are unavailable. |
+| [Rizin](https://github.com/rizinorg/rizin) / [rz-pipe](https://github.com/rizinorg/rz-pipe) | Rizin repository contains LGPL-3.0 and GPL-3.0 components; `rizin`, `rz-bin`, and language bridges through `rzpipe`                                                    | Portable CLI analysis, disassembly/debugging, many architectures and file formats, JSON command output                                                  | Good candidate for a process-backed Linux provider and fast metadata fallback. License/component inventory must be preserved; command output needs version-pinned parsers and semantic conformance before evidence is trusted.                                                                                                                                                                                                      |
+| [LIEF](https://github.com/lief-project/LIEF)                                                | Apache-2.0; C++, Python, and other bindings                                                                                                                            | Deterministic parsing and modification of ELF, PE, Mach-O, COFF, and related executable formats; headers, sections, symbols, relocations, and functions | Best near-term complement, not a decompiler replacement. It can cover format metadata and artifact evidence without a long-lived analysis process; function semantics, pseudocode, CFG, and cross-reference parity remain out of scope unless separately demonstrated.                                                                                                                                                              |
+| [Binary Ninja](https://docs.binary.ninja/dev/index.html)                                    | API/documentation components are MIT, while the analysis product is licensed by edition; commercial, Ultimate, or Headless license is required for headless automation | Python/Core/C++/Rust APIs, headless loading, IL layers, function analysis, plugins, and configurable analysis                                           | Strong technical fit for a native provider, especially function dossiers. Commercial licensing, license-secret handling, native runtime packaging, and multithreaded lifecycle rules are material deployment blockers.                                                                                                                                                                                                              |

 ## Recommended order

@@ -43,12 +43,14 @@ REA setup lets you select agent integration and optional Hopper installation.
 It installs the bundled workflow, configures detected agents, and can save
 verified paths for an existing Ghidra installation. It configures Claude Code,
 Claude Desktop, Codex, Cursor, Gemini CLI, Windsurf, Devin, OpenCode, Antigravity,
-GitHub Copilot CLI, and VS Code using each client's configuration format.
+GitHub Copilot CLI, Command Code, and VS Code using each client's configuration format.

 Ghidra analysis supports Linux x64 and macOS x64/arm64 with Ghidra 12.1.4 and a
 64-bit full JDK 21. macOS also requires the matching native decompiler. The
-adapter exposes ten inventory operations and twelve function-analysis
-operations, for 22 read-only operations total. Approved setup saves verified
+adapter exposes thirteen inventory operations and twelve function-analysis
+operations, for 25 read-only operations total. Linux and macOS additionally support
+atomic function-name and entry-comment edits with refreshed analysis; metadata
+is discarded on close and executable bytes stay unchanged. Approved setup saves verified
 installation paths in agent configurations without installing or changing
 Ghidra or Java.

@@ -57,11 +59,11 @@ a native type-layout object. A separate lane covers AArch64 ELF, PE, and
 Mach-O cross-target fixtures. See [testing](testing.md) for the prerequisites
 and exact commands.

-Windows Ghidra operations remain unavailable until REA implements verified
-Job Object process ownership, private runtime DACLs, and reparse-safe path
-admission. Windows package and adapter tests do not establish a usable real
-Ghidra session. The [Windows P0 guide](windows-ghidra-p0.md) describes the
-intended boundary and remaining requirements.
+Experimental Windows x64 P0 now supplies bundled Job Object ownership,
+protected runtime DACLs, and handle-based admission for native x86-64 PE
+applications on local NTFS. Real ordinary-user CLI/MCP verification covers
+all 25 read-only operations and cleanup. The [Windows P0 guide](windows-ghidra-p0.md)
+describes this boundary and unverified broader coverage.

 ## Ghidra maintenance boundary

@@ -71,11 +73,10 @@ not expected to match; unresolved targetless flow remains unknown. Automatic
 Ghidra acquisition, if ever added, remains a separately planned and approved
 related-tool change; setup must never install Java.

-Before enabling Windows Ghidra operations, add current-user-only DACL creation and
-readback, handle-based reparse-point-safe path authority, a DACL-protected IPC
-backend, and Job Object assignment before provider execution. Process capture,
-Hopper, and broad filesystem-sensitive workflows remain separate Windows
-projects rather than implied parity.
+Maintain Windows P0 with independent DACL readback, handle-based admission,
+private authenticated IPC, and Job Object assignment before provider execution.
+Process capture, Hopper, and broad filesystem-sensitive workflows remain
+separate Windows projects; P0 does not imply their parity.

 ## Capability-selective setup

@@ -47,7 +47,7 @@ The process-global Vitest configuration contract rejects new direct temporary-ro
 creation outside the workspace seam and its narrowly documented boundary/package
 exceptions.

-Real Hopper, Ghidra, browser, package, and managed-code claims belong to their
+Real Hopper, Ghidra, IDA, browser, package, and managed-code claims belong to their
 explicit `npm run verify:*` lanes. The reconstruction-readiness lane also
 checks deterministic rerun, tamper, and stale-input handling; those checks do
 not execute extracted JavaScript modules. When application runtime behavior is
@@ -85,6 +85,27 @@ regressions until a real fixture establishes equivalent coverage.
 decoding. Its SDK client explicitly permits the larger inline JSON response;
 this lane does not establish large image-comparison request transport coverage.

+`verify:browser:network` is a focused real-browser lane for transaction identity,
+selected request/response bytes, binary and compressed responses, duplicate
+headers, credential and declared-secret redaction, redirects, streaming cutoff,
+CLI/MCP parity, and owned-profile cleanup. Set `REA_BROWSER_EXECUTABLE` to an
+installed Chrome-family browser. An optional script argument selects an already
+installed package's `scripts/rea.mjs` entry point for packaged-artifact checks.
+The complete `verify:browser` lane includes these same checks.
+
+After building, `verify:browser:dom` checks empty and HTML-whitespace form
+destinations against a native Chrome DOM-property oracle through CLI and stdio
+MCP. It requires `REA_BROWSER_EXECUTABLE` and accepts an optional installed REA
+entrypoint. The full browser lane includes the same public-adapter assertions
+before other fixtures navigate the selected page.
+
+`verify:browser:scripts` checks active script capture → exact-byte export →
+existing static JavaScript analysis through CLI and stdio MCP, including
+manifest readback, competing query variants, and resolved relative imports.
+It uses an installed browser and accepts an optional installed REA entrypoint.
+The complete `verify:browser` lane also exercises passive script export through
+both public adapters. See [website script export](website-script-export.md).
+
 The [test suite audit](test-suite-audit.md) records the pruning decisions,
 replacement evidence and remaining priorities.

@@ -103,8 +124,15 @@ that a host or target is covered when it was skipped.
 | `npm run verify:ghidra:switch`             | Linux x64 ELF; GCC/Clang optimized and stripped switch fixtures                    | GCC, Clang, GNU nm/objdump/strip, Ghidra 12.1.4, and full JDK 21    |
 | `npm run verify:ghidra:aarch64-jump-table` | Any supported Ghidra host; AArch64 ELF; byte/halfword tables; host ARM64 Mach-O    | Clang with AArch64 target support, Ghidra 12.1.4, and full JDK 21   |
 | `npm run verify:ghidra:cross-format`       | Any supported Ghidra host; also analyzes AArch64 ELF, x86-64 PE, and x86-64 Mach-O | `clang`, LLD, and `lld-link` in addition to host-lane prerequisites |
-| `npm run verify:ghidra:windows`            | Controlled Windows x64 with native x86-64 PE                                       | Ghidra 12.1.4, full JDK 21, and the Windows P0 fixture toolchain    |
+| `npm run verify:ghidra:windows`            | Controlled Windows x64 with native x86-64 PE                                       | Ghidra 12.1.4, full JDK 21, and the matching native artifact        |

+Windows native conformance runs with `npm run verify:windows-native` and does
+not require Ghidra or Java. An optional independently compiled Windows fixture
+adds in-place reparse, breakaway, environment, and token observations.
+`npm run verify:ghidra:windows:package` additionally packs and installs REA into
+an isolated prefix and runs ordinary-user CLI/MCP operations against their
+canonical schemas. Run the controlled fixture generator before that lane, or
+supply an installed package root and an explicit fixture as arguments.
 The host-native Ghidra lane also verifies native value tracing through the
 production CLI and a separate stdio MCP process. It compares complete dependency
 graphs, validates Evidence and upstream/workflow profiles, checks capability
@@ -141,6 +169,84 @@ the CLI and stdio MCP, including special filenames, unresolved discovery
 locations, and independently resolved loaded scripts. Double-quote filenames
 are tested on POSIX only because Windows does not support them.

+## Android APK analysis
+
+`npm run verify:android` requires an existing Java 17+ and an explicit
+`REA_JADX_MCP_JAR` for jadx-headless-mcp 0.7.1. Set `REA_ANDROID_TEST_APK` to the
+fixed public ApiDemos v6.0.18 fixture. Obtain both with the explicit
+`npm run fixtures:android` command; files are SHA-256 verified and
+kept under ignored `_reference/`. No Gradle build, Android SDK, emulator or
+application execution is required. The lane compares real CLI/MCP package,
+class search, class inventory, method decompilation and incoming references.
+See [Android analysis](android-analysis.md) for boundaries and resource budgets.
+
+Synthetic producer regressions run independently:
+
+```sh
+npm run test:focused -- tests/boundary/android/jadxIntegration.test.ts tests/boundary/mcp/androidAnalysisMcp.test.ts
+```
+
+## Optional NativeAOT Ghidra analysis
+
+This lane is separate from the default native lane. `build:fixtures:nativeaot`
+requires an existing .NET SDK 8.0.416, the platform NativeAOT compiler/linker and
+runtime pack 8.0.22. It builds benign sources into ignored `_reference/` and
+records independent symbol/directory/SHA oracles; it never executes the target.
+Linux also builds stripped, ordinary-native and small malformed/ambiguous/layout
+negative inputs. The optional Windows fixture workflow builds a PE on a Windows
+runner; analyzing that PE on Linux does not verify a Windows Ghidra host.
+
+Build the clean pinned upstream adapter with `build:ghidra:nativeaot`, then set
+`REA_GHIDRA_NATIVEAOT_JAR`. Run `verify:ghidra:nativeaot -- symbols`, `-- stripped`,
+`-- ordinary`, `-- unsupported`, `-- malformed`, `-- ambiguous`, and
+`-- loader-failure`, and `-- default-native` separately. The loader-failure mode source-builds
+a deliberately failing JDK 21 initializer and checks the actual loader cause and
+cleanup. The default-native mode verifies ordinary analysis with the optional
+extension disabled.
+The real MCP lane checks source identity, inline format discovery, metadata
+relationships/slots against independent compiler symbols, frozen strings,
+pseudocode and owned cleanup. Set `REA_NATIVEAOT_PROOF_CLI=1` for one equivalent
+CLI type inspection; this costs an additional full import. Select an unpacked
+installed package with `REA_NATIVEAOT_PROOF_PACKAGE_ROOT`, a fixture directory
+with `REA_NATIVEAOT_PROOF_FIXTURE_ROOT`, and optional evidence capture directory
+with `REA_NATIVEAOT_PROOF_CAPTURE_DIR` (absolute paths).
+
+Keep builds/imports sequential on small hosts; scope `GHIDRA_HEADLESS_MAXMEM`
+(e.g. `768M`) to this command and use CPU affinity if needed. REA does not install
+or upgrade Java, Ghidra, .NET or native toolchains. See
+[the supported layout and provenance](ghidra-nativeaot.md).
+
+## IDA MCP adapter
+
+`npm run verify:ida -- --target /absolute/path/to/program --procedure main`
+uses the existing `REA_IDA_MCP_CONFIG` registration. It installs no engine,
+Python package, or compiler. The target must already be open in the GUI for
+the legacy attached profile; the database-supervisor headless profile opens
+a digest-verified private copy. A caller-supplied fixture keeps prerequisites
+limited to the selected engine and host. `tests/conformance/ida/inventory.c`
+provides an optional small native fixture source with an exported
+`rea_fixture_add` function.
+
+The lane invokes the production CLI dispatcher and connects the pinned MCP
+client SDK to the production REA server. It verifies function Evidence and
+CLI/MCP parity, inventory/search, pseudocode, instructions, xrefs, malformed
+input, original-input preservation, and lifecycle cleanup. For headless
+analysis it confirms that the owned database IDs disappear from upstream
+discovery and private workspaces are removed. For attached analysis it confirms
+the existing GUI target remains reachable with the same input identity.
+`--package-root` selects an installed/extracted REA artifact. `--report` writes
+private local observations with mode `0600`; the console summary contains no
+target paths or upstream output.
+
+Adapter and composition tests cover producer parsing, pagination, canonical
+entries, external callees, target switches, cancellation draining, snapshot
+replay exclusion, ownership failures, and incomplete cleanup. They do not
+establish real IDA operation. The initial real workflows cover legacy upstream
+1.4.0 on a Windows GUI and the modern supervisor at upstream commit
+`c133c3853faa111a9b00ee615c013b720d0c4acd` with Windows x64 IDA 9.3.
+Linux/macOS headless, modern attached GUI tools, other engine versions and
+architectures remain unverified; see the [provider guide](ida-provider.md).
+
 ## DOS Ghidra analysis

 `npm run verify:ghidra:dos` requires the supported Ghidra and JDK installation
@@ -153,6 +259,13 @@ the stable observation comparison. Linux x64 is verified; macOS DOS remains
 unverified. This lane is separate from host-native and optional cross-format
 verification. See [DOS analysis](ghidra-dos.md).

+`npm run verify:ghidra:com` uses a generated headerless fixture with no compiler,
+DOS emulator or game data. It exercises explicit admission, BinaryLoader entry
+preparation, measured register context, whole-file byte readback, source offsets,
+unmapped PSP/partial reads, actual decompilation, CLI/MCP parity and owned cleanup.
+It has the same Ghidra/JDK prerequisites as the MZ lane. Neither lane claims DOS
+runtime or PC-98 device execution.
+
 ## Apple Interface Builder archives

 `npm run verify:interface-builder` compiles the source-owned AppKit XIB into a
@@ -182,8 +295,7 @@ behavior, and complete CI evidence before merging.
 | `npm run test:watch:all`          | Changed tests from every project; builds at startup, so rebuild after production edits before relying on compiled tests |
 | `npm run check:changed`           | Cached typecheck/lint and branch-related source feedback                                                                |
 | `npm run check:pr`                | Opt-in complete local deterministic gate and generated-file checks                                                      |
-| `npm run docs:check`              | Committed generated-document freshness, without API HTML rendering                                                      |
-| `npm run docs:api:cached`         | Explicit cached API HTML rendering                                                                                      |
+| `npm run docs:check`              | Committed generated-document freshness                                                                                  |

 For example:

@@ -230,8 +342,7 @@ process-global, and other boundary projects retain per-file isolation.
 `npm test`, `npm run docs:check`, and `npm run docs:generate` share
 repository-local locks and fail fast when the same class of command is already
 running. The `npm test` build is inside that lock. `check:pr` runs its test task
-before starting generated-document validation. TypeDoc rendering is a separate
-command and CI step.
+before starting generated-document validation.

 Vitest and Node persistent compile caches are deliberately not enabled by
 default. To evaluate repeated local runs, opt in for both cold and warm
@@ -282,3 +393,15 @@ allows a host-permission-boundary-only result and explicitly reports
 Both commands reject a changed executable digest and clean up the fixture
 process and helper. These lanes require an interactive macOS desktop. See [native investigation](native-investigation.md)
 for the exact ABI, authority, graph and observation boundaries.
+
+### Firmware adapters
+
+`npm run fixtures:firmware` uses existing Python 3 and a host C compiler to make
+an ignored gzip/USTAR firmware fixture and independent offset/hash oracle.
+`npm run verify:firmware` requires caller-supplied Binwalk 3.1.0, Unblob 26.6.4
+and util-linux prlimit on Linux. It verifies CLI/MCP parity, selected ranges,
+unknown chunks, depth limits and extracted child digests. The optional
+`REA_FIRMWARE_VERIFY_EXT4=1` lane requires existing mke2fs/debugfs; the separate
+`REA_FIRMWARE_VERIFY_GHIDRA=1` lane checks a selected host ELF through real Ghidra.
+Neither optional toolchain is a base-lane prerequisite. See
+[firmware analysis](firmware-analysis.md) for limits and unverified formats.
@@ -7,7 +7,7 @@ harm_rank,location,trigger,current_copy,user_risk,proposed_replacement,implement
 6,src/domain/errors.ts:AnalysisProtocolError,Application protocol fails,Raw constructor message,Can expose protocol internals,"Analysis returned an unreadable result. Retry once; if it continues, run `rea doctor`.",implemented,focused assertions passed; full `npm run check` passed
 7,src/domain/errors.ts:HopperProcessError,Analysis subprocess stops,"Hopper bridge stopped unexpectedly with code {exitCode}",Exposes provider bridge and process code,"Analysis could not start or stopped unexpectedly. Run `rea doctor`, then try again.",implemented,focused assertions passed; full `npm run check` passed
 8,src/domain/errors.ts:HopperStartError,Analysis subprocess cannot start,Hopper application bridge could not be started,Exposes provider and bridge implementation,"Analysis could not start or stopped unexpectedly. Run `rea doctor`, then try again.",implemented,focused assertions passed; full `npm run check` passed
-9,src/domain/errors.ts:BinaryTargetError,Target cannot open,"Cannot open artifact: {reason}",May expose raw reason and lacks checks,"REA could not open that app or binary. Check that the path exists, is readable, and points to a supported file.",implemented,focused assertions passed; full `npm run check` passed
+9,src/domain/errors.ts:BinaryTargetError,Target cannot open,"Cannot open artifact: {reason}",May expose raw reason and lacks checks,"Preserve the target admission reason; directories name analyze_javascript_application and rea analyze as available alternatives.",implemented,focused assertions passed; full `npm run check` passed
 10,src/domain/errors.ts:ConfigurationError,Environment configuration invalid,Raw constructor message,May expose provider-specific variables and lacks recovery,"REA configuration is invalid. Run `rea doctor` and fix the reported setting.",implemented,focused assertions passed; full `npm run check` passed
 11,src/domain/errors.ts:ArtifactOperationError,Artifact inventory or extraction fails,"Artifact {operation} failed: {reason} at {logicalPath} (declared_sha256=...)",Exposes paths hashes and internal reason,"Reason-specific plain message with safe recovery step.",implemented,focused assertions passed; full `npm run check` passed
 12,src/domain/errors.ts:EvidenceFileError,Evidence file operation fails,"Evidence bundle {operation} failed: {reason}",Internal reason token gives weak recovery,"Reason-specific plain message with safe recovery step.",implemented,focused assertions passed; full `npm run check` passed
@@ -55,7 +55,7 @@ harm_rank,location,trigger,current_copy,user_risk,proposed_replacement,implement
 45.5,src/application/Uninstall.ts:removeClient restore,Configuration update fails and restoring the original also fails,"Configuration could not be updated or restored. Restore its `.rea.backup` manually, then rerun uninstall.","High risk; persistent configuration may be damaged, but retained backup is authoritative",Keep new recovery copy,implemented,verified by injected restoration failure test
 46,src/application/Uninstall.ts:removeManagedPath symlink,Managed cache/state/skill path is a symbolic link,Refused to follow symlink {path}.,Exposes local path and does not explain manual safety check,"REA did not remove this item because its managed path is a symbolic link. Verify the link target before removing it manually.",implemented,focused assertion passed
 47,src/application/Uninstall.ts:removeManagedPath failure,Managed item removal fails,{path} could not be removed.,Exposes local path and gives no recovery,"This item could not be removed. Check file permissions, then rerun uninstall.",implemented,verified by injected managed-path removal failure test
-48,src/application/Doctor.ts:node,Runtime version is outside supported ranges,Install Node.js 22.19+ or 24.11+.,Low risk; exact dependency recovery,Keep current copy,unchanged,verified by doctor unit test
+48,src/application/DoctorDiagnostics.ts:node,Runtime version is outside supported ranges,"Install Node.js 22.x (>=22.19), 24.x (>=24.11), or 26+.",Low risk; exact dependency recovery,Keep current copy,unchanged,verified by doctor unit test
 49,src/application/Doctor.ts:host,Host OS/distribution is unsupported,"REA supports macOS 12+, Ubuntu 24.04+, Fedora 41+, and 64-bit Arch Linux.",Low risk; clearly states supported choices,Keep current copy,unchanged,verified by doctor unit tests
 50,src/application/Doctor.ts:analysis engine,Optional deep-analysis executable cannot be found,"Run rea setup to install Hopper, or set HOPPER_LAUNCHER_PATH.",Low risk in setup-specific diagnostic; exact recovery paths,Keep current copy,unchanged,verified by doctor unit tests
 51,src/application/Doctor.ts:target,Optional target path fails shared validation,Supply a readable local app or program path.,Low risk; tells caller valid target class,Keep current copy,unchanged,verified by doctor unit test
@@ -65,7 +65,7 @@ harm_rank,location,trigger,current_copy,user_risk,proposed_replacement,implement
 55,src/application/Setup.ts:optional engine,Setup completes without optional deep-analysis engine,Hopper is optional for non-Hopper providers. Rerun with --yes --install-hopper for deep native analysis.,Exposes provider terminology but this is an explanatory setup status rather than an error; recovery command is exact,Keep current copy,unchanged,verified by setup unit test
 56,src/application/Setup.ts:doctor fallback,Post-setup diagnostics remain unhealthy,Run rea doctor and apply each reported remediation.,Low risk; delegates to structured per-check recovery,Keep current copy,unchanged,verified by exact setup unit test
 57,src/application/Setup.ts:unsupported platform,Platform is neither macOS nor Linux,REA supports Hopper on macOS and selected 64-bit Linux distributions.,Low risk; states support boundary,Keep current copy,unchanged,verified by setup unit test
-58,src/application/Setup.ts:unsupported Node,Runtime version cannot run setup,Install Node.js 22.19+ or 24.11+ and rerun setup.,Low risk; exact dependency and retry,Keep current copy,unchanged,verified by setup host tests
+58,src/application/SetupHost.ts:unsupported Node,Runtime version cannot run setup,"Install Node.js 22.x (>=22.19), 24.x (>=24.11), or 26+ and rerun setup.",Low risk; exact dependency and retry,Keep current copy,unchanged,verified by setup host tests
 59,src/application/Setup.ts:unsupported macOS,macOS version is missing or older than 12,Upgrade to macOS 12 or newer.,Low risk; exact support floor,Keep current copy,unchanged,verified by setup host tests
 60,src/application/Setup.ts:unsupported Linux,Linux distribution is outside supported set,"REA supports Hopper on Ubuntu 24.04+, Fedora 41+, and 64-bit Arch Linux.",Low risk; exact supported alternatives,Keep current copy,unchanged,verified by setup unit test
 61,src/application/ProcessCli.ts:readJson read,Process scenario or evidence file cannot be read,Raw filesystem exception through CLI framework,Can expose local paths/codes and no recovery,"Process input file could not be read. Check that the path exists and is readable.",implemented,verified by focused CLI test
@@ -83,11 +83,11 @@ harm_rank,location,trigger,current_copy,user_risk,proposed_replacement,implement
 74,install.sh:unknown option,Installer receives an unsupported flag,unknown option with caller-provided flag,Low risk; identifies offending input,Keep current copy,unchanged,verified by shell branch inspection
 75,install.sh:platform,Installer runs outside macOS or supported Linux,REA supports macOS and selected 64-bit Linux distributions.,Low risk; states support boundary,Keep current copy,unchanged,verified by shell branch inspection
 76,install.sh:curl missing,curl is absent,curl is required.,No recovery instruction,"curl is required. Install curl, then rerun this installer.",implemented,verified by exact missing-curl installer test
-77,install.sh:node missing,node is absent,Node.js 22.19+ or 24.11+ is required; install it from nodejs.org and retry.,Low risk; exact versions and recovery,Keep current copy,unchanged,verified by shell branch inspection
+77,install.sh:node missing,node is absent,"Node.js 22.x (>=22.19), 24.x (>=24.11), or 26+ is required; install it from nodejs.org and retry.",Low risk; exact versions and recovery,Keep current copy,unchanged,verified by shell branch inspection
 78,install.sh:npm missing,npm is absent,npm is required; install it with Node.js and retry.,Low risk; exact recovery,Keep current copy,unchanged,verified by shell branch inspection
 79,install.sh:node unreadable,node exists but does not report a parseable version,could not determine the active Node.js version.,No cause-local recovery,"The active Node.js version could not be read. Check that node works and is on PATH, then retry.",implemented,verified by exact unreadable-Node-version installer test
-80,install.sh:Node 22 floor,Node 22 minor version is below 19,Node.js VERSION is unsupported; use Node.js 22.19+ or 24.11+.,Low risk; exact detected version and supported alternatives,Keep current copy,unchanged,verified by exact installer test using Node 20 and branch inspection
-81,install.sh:Node 24 floor,Node 24 minor version is below 11,Node.js VERSION is unsupported; use Node.js 24.11 or newer.,Low risk; exact detected version and floor,Keep current copy,unchanged,verified by shell branch inspection
+80,install.sh:Node 22 floor,Node 22 minor version is below 19,"Node.js VERSION is unsupported; use Node.js 22.x (>=22.19), 24.x (>=24.11), or 26+.",Low risk; exact detected version and supported alternatives,Keep current copy,unchanged,verified by exact installer test using Node 20 and branch inspection
+81,install.sh:Node 24 floor,Node 24 minor version is below 11,"Node.js VERSION is unsupported; use Node.js 22.x (>=22.19), 24.x (>=24.11), or 26+.",Low risk; exact detected version and floor,Keep current copy,unchanged,verified by shell branch inspection
 82,install.sh:version syntax,Explicit version is not exact semantic version,version must be an exact semantic version.,Low risk; exact correction,Keep current copy,unchanged,verified by shell branch inspection
 83,install.sh:release lookup,Latest GitHub release request fails,could not resolve the latest GitHub release.,No fallback despite supporting pinned versions,"The latest REA release could not be resolved. Check network access or pass --version VERSION, then retry.",implemented,verified by exact release-lookup installer test
 84,install.sh:release response,Latest release response is not valid expected JSON,Node JSON parser stack followed by the safe release-response message,Leaks a parser stack and buries recovery guidance,The release response was invalid. Retry later or pass --version VERSION.,implemented,verified by exact malformed-release test with parser stderr suppressed
@@ -1,5 +1,5 @@
 {
-  "manifest_id": "ecm_7da021af56cf2eb25489ed7ce494bfe92244e791fa3b5ad5a238a5eb14a23d9a",
+  "manifest_id": "ecm_d68a1575bdaa1a044ccce8e27c5dd335612f909bc81c52ce3089b576fd772940",
  "verifier": {
    "id": "rea-managed-conformance",
    "version": "1"
@@ -13,7 +13,7 @@
  "skill_digests": [
    {
      "skill_id": "reverse-engineer-anything",
-      "sha256": "411d5b61e237e3b9b2cb9b3a987d83a36134a2ea1810ddd8d9f695dc05709f5b"
+      "sha256": "d2d971cc67bb0f7b80b4e39382a6bd1146445ed1dbf52043f89e2da2985c97ba"
    }
  ],
  "claims": [
@@ -0,0 +1,86 @@
+# Captured website scripts and static JavaScript analysis
+
+`export_web_scripts` bridges retained browser sources into the existing local
+JavaScript analyzer. Both CLI and MCP use the same workflow. It reads a saved
+`inspect_web_page` or `capture_browser_scenario` capture and writes scripts plus a
+verified manifest into one caller-selected, absent directory.
+
+## Capture and export
+
+For passive inspection, select `include_script_sources: true` (CLI:
+`--include-script-sources`). For scenarios, select
+`capture.network.response_body: true`. Save either the complete Evidence record
+or its normalized result as UTF-8 JSON. The compact MCP wrapper's `evidence`
+field contains the complete Evidence record.
+
+```sh
+rea export-web-scripts /analysis/capture.json /analysis/exported-scripts --json
+rea analyze-javascript-application /analysis/exported-scripts/files --json
+```
+
+MCP uses `export_web_scripts` with `capture_path` and `output_directory` absolute
+filesystem paths. Its inline result includes `analysis_input`, which can be
+passed directly to `analyze_javascript_application`. When no script bytes are
+exportable, `analysis_input` is null and the manifest retains the unavailable
+sources and their reasons. Capture again with the corresponding content option.
+
+The destination must not exist. Use a new directory for each capture; an
+existing directory or symlink is rejected without overwriting its contents.
+REA creates private output, verifies every written file by digest and durable
+readback, and removes its own partial output on failure or cancellation.
+A failed rollback reports residual paths.
+
+## Sources and mappings
+
+Every source is returned inline with its URL and its script/frame identity or
+request transaction and event sequence references. The result also contains
+the input capture's byte digest, original coverage, source Evidence link when
+provided, and the persisted manifest's digest and byte count. A saved Evidence
+envelope must have a valid semantic identifier and matching operation.
+
+Exported `relative_path` values are relative to `analysis_input.input_path`.
+The persisted `manifest.json` contains the same inline manifest fields, excluding
+its own descriptor. It does not duplicate script bytes.
+
+- Passive sources are the Debugger-exposed text encoded as UTF-8, with the
+  verified source digest and source-map declaration retained. Unavailable or
+  explicitly non-JavaScript sources remain unavailable.
+- Scenario sources use observed requests classified as `script`, matched to
+  completed response bytes by transaction and event identity. URLs never select
+  the response. Binary and empty retained bytes are written exactly.
+- Ordinary query-free `.js`, `.mjs`, and `.cjs` URL paths are arranged under a
+  directory for each origin, preserving their relative module layout when it
+  is unambiguous.
+- Competing versions, query/fragment variants, case and file/directory prefix
+  collisions, inline sources, and unrepresentable paths use unique isolated
+  names with a stated reason. Missing competing sources also prevent selection
+  of an apparently canonical version.
+
+## Interpretation and limits
+
+Export does not fetch URLs or execute JavaScript. Retained Debugger sources and
+response bytes do not establish execution or a complete website. Response bytes
+are browser-decoded bytes; they do not represent transfer encoding. Declared
+redaction is preserved and can change JavaScript syntax; passive captures do
+not report a byte-redaction flag, so that value remains unknown.
+
+The existing analyzer inventories and parses the actual exported files. It can
+resolve ordinary captured relative modules, but does not implement browser
+import maps, root-relative URL loading, remote imports, or runtime behavior.
+Its local resolver may strip import queries/fragments; isolated variants are
+kept away from canonical paths to prevent those from selecting a different
+observed version. Missing dependencies remain unknown. Source maps are not
+fetched or reconstructed during export.
+
+The export Evidence describes a derivation from the saved capture. Subsequent
+application-analysis Evidence describes the local exported artifact. Their
+identities and authorities remain separate.
+
+## Verification
+
+`npm run verify:browser:scripts` exercises active capture, exact source export,
+manifest readback, query variants, and relative-module analysis through a real
+browser, CLI, and stdio MCP. Set `REA_BROWSER_EXECUTABLE` to an installed
+Chrome-family browser. The verifier accepts an optional installed REA entrypoint
+argument for package verification. `npm run verify:browser` additionally covers
+passive `inspect_web_page` export through both public adapters.
@@ -1,165 +1,173 @@
 # Windows Ghidra P0

-Status: experimental and currently unavailable. The production adapter reports
-`unsupported_host` because verified Job Object process ownership, private
-runtime DACLs, and reparse-safe path admission are not implemented. Installation
-paths or manual MCP registration do not enable operations.
+This guide describes repository main. npm 4.1.0 includes the Windows
+native bundle; check the [release boundary](installation.md#released-package-and-main)
+before applying these instructions to an older published package.

-This guide describes the intended P0 boundary and adapter mechanisms. It does
-not establish general Windows REA support. Even after the required controls
-are implemented, hostile, sensitive, security-decision, and concurrently
-mutable targets require separate acceptance.
+Status: experimental Windows x64 support for the read-only P0 boundary. Windows
+package builds bundle native process, filesystem, and DACL controls. REA
+uses them automatically when the analyst selects a Ghidra operation; no
+additional permission flag or degraded mode is required.

 ## Supported boundary

-Once the required native controls are implemented, the intended P0 is limited to:
-
- a Windows x64 host;
- Node.js 22.19+ or 24.11+;
+- Windows 10+ x64 with fixed local NTFS target and temporary volumes;
+- Node.js 22.x (>=22.19), 24.x (>=24.11), or 26+;
 - an operator-installed official Ghidra 12.1.4 distribution;
 - a 64-bit full JDK 21;
 - an explicit native, non-managed, non-DLL x86-64 PE application; and
- the 22 read-only Ghidra inventory and function-analysis operations.
+- the 25 read-only Ghidra inventory, memory, and function-analysis operations.

-Hopper, Ghidra GUI state, mutation, process capture, browser/Electron
-observation, artifact extraction, and general Windows feature parity are not
-implied by this boundary. Managed PE/CLI
-inspection remains a separate execution-free provider and is not routed
-through Windows Ghidra P0.
+Loaded memory reads and file offsets preserve Ghidra's observed source mappings.
+PE load-image inspection returns measurements with an explicit unsupported
+attestation status; independent format-specific verification currently supports
+DOS MZ only.

-REA does not install or upgrade Ghidra, Java, Python, npm, Node.js, Hopper, or
-another package on Windows. The production adapter uses the packaged Java
-`HeadlessScript`; Python and PyGhidra are not prerequisites.
+This boundary does not establish general Windows feature parity. Ghidra GUI
+state, annotations, other target architectures and formats, and Hopper-only
+operations remain unavailable through this provider. Managed PE/CLI inspection
+uses its separate execution-free provider.
+
+REA does not install or upgrade Ghidra, Java, Python, npm, Node.js, Hopper, or a
+compiler. The adapter uses the packaged Java `HeadlessScript`; Python and
+PyGhidra are not prerequisites. Users do not build the native addon.
+
+REA selects its packaged bridge scripts by explicit path. Same-named files or
+directories in the caller's working directory do not select a different
+script or require users to clean that directory before analysis.

 ## Configuration

-For installation diagnostics, configure REA, Ghidra, and JDK 21 in PowerShell. Analysis remains blocked:
-
 ```powershell
 npm install --global rea-agents
 $env:GHIDRA_INSTALL_DIR = "C:\tools\ghidra_12.1.4_PUBLIC"
-$env:JAVA_HOME = "C:\Program Files\Java\jdk-21"
+$env:JAVA_HOME = "C:\tools\jdk-21"
 $env:REA_ANALYSIS_PROVIDER = "ghidra"

 rea doctor --json
 rea providers --json
-rea inspect "C:\approved-fixtures\sample.exe" --provider ghidra --format json
+rea inspect "C:\fixtures\sample.exe" --provider ghidra --format json
 ```

-`rea doctor` checks the x64 host, exact Ghidra release,
-`support\analyzeHeadless.bat`, `java.exe`, `javac.exe`, JDK bitness, and JDK
-major version. `rea setup` can configure supported agent integrations and the
-bundled REA skill on Windows after approval. It does not install Hopper, Ghidra,
-or Java, and configuring an agent does not enable the blocked Ghidra operations.
+`rea doctor` distinguishes installation prerequisites from native artifact or
+OS failures. It checks the Ghidra release, headless launcher, full JDK, x64
+host, and native controls. A missing or mismatched addon requires the matching
+Windows x64 package; changing MCP registration cannot supply that artifact.
+A filesystem or access failure identifies the failed native constraint.
+Other doctor checks, including unconfigured agent integrations, can remain
+unready while Ghidra itself is available.

-For an MCP client, register the resolved Node entry point and preserve the
-three environment variables above. A representative configuration is:
+`rea setup` can register supported agent integrations and the bundled skill.
+Its existing preview and approval apply to configuration writes. Setup
+preserves valid Ghidra and Java settings even when a separate runtime
+prerequisite is unavailable.
+
+For MCP, register the resolved Node entry point and the same provider settings:

 ```json
 {
  "mcpServers": {
-    "rea-windows-ghidra-p0": {
-      "command": "C:\\Program Files\\nodejs\\node.exe",
-      "args": [
-        "C:\\Users\\analyst\\AppData\\Roaming\\npm\\node_modules\\rea-agents\\scripts\\rea.mjs",
-        "mcp"
-      ],
+    "rea": {
+      "command": "C:\\tools\\node\\node.exe",
+      "args": ["C:\\tools\\rea\\scripts\\rea.mjs", "mcp"],
      "env": {
        "REA_ANALYSIS_PROVIDER": "ghidra",
        "GHIDRA_INSTALL_DIR": "C:\\tools\\ghidra_12.1.4_PUBLIC",
-        "JAVA_HOME": "C:\\Program Files\\Java\\jdk-21"
+        "JAVA_HOME": "C:\\tools\\jdk-21"
      }
    }
  }
 }
 ```

-Resolve the actual global package path on the intended machine; do not copy the
-example path blindly. Restart the MCP client after changing its registration.
+These paths are examples. Use the actual package location and restart the MCP
+client after registration changes. Cold Ghidra import can exceed a client's
+short default request timeout; the real verification lane allows the existing
+330-second provider startup deadline to complete.

-## Target and import identity
+## Native authority and target identity

-PE parsing records architecture, COFF executable role, and whether the CLI
-header data-directory entry is non-empty. Header classification and SHA-256
-are read from the same open file handle. Windows admission then rejects:
+The verified boundary excludes SUBST aliases and changing drive-letter/DOS-device
+namespaces. REA does not claim a separate SUBST detector. Mounted-folder entries
+that expose reparse tags fail component admission; broader namespace variants
+have not been established by this lane. Requested paths, final handle paths,
+volume serials, and file IDs remain separate observations.

- non-PE formats;
- x86, ARM, ARM64, or unknown architectures;
- DLL/shared-library and non-executable image roles;
- managed or incompletely classified PE targets; and
- malformed optional headers or data-directory declarations.
+The loader validates package version, ABI, Node-API compatibility, PE machine,
+and artifact SHA-256 before loading the package-owned addon. Native failure
+reasons remain distinct from a valid installation and an unsupported target.

-After admission, REA copies the target into the ephemeral Ghidra runtime and
-requires the snapshot digest to match the admitted SHA-256. Ghidra imports only
-that snapshot. Before serving a request, the Java bridge requires Ghidra's
-`Program.getExecutableSHA256()` observation to match the same digest. A path
-replacement that changes bytes therefore fails before Evidence is created.
+PE header classification and SHA-256 come from the same open file. The Windows
+provider admits native x86-64 PE applications and rejects unsupported roles,
+architectures, managed images, and malformed headers. The original selected
+source coordinate is preserved for native admission.

-This linkage does not establish Windows reparse-point or hostile-path safety.
-The current implementation has no handle-based `CreateFileW` authority backend
-and no verified no-follow equivalent for every path component.
+Admission opens and checks every path component without following a reparse
+point. It retains handles, verifies local NTFS semantics, and observes volume
+serial, 128-bit file ID, final handle path, requested path, and size. Reparse
+paths, alternate streams, ambiguous coordinates, UNC paths, and other
+filesystems are rejected with the actual constraint.

-## Local transport and lifecycle
+The snapshot streams from the admitted source handle on a background worker.
+Its digest must match the parsed target digest. Ghidra imports that private,
+immutable snapshot, and the bridge requires the imported program SHA-256 to
+match before serving operations. Source and snapshot identities remain
+separate diagnostic observations. Snapshot cancellation is checked between
+64 KiB reads and cleanup waits for worker settlement.

-Linux continues to use a mode-restricted Unix socket. Windows uses a Java
-listener bound to `127.0.0.1` on an ephemeral port. The bridge atomically
-publishes a bounded endpoint record containing only the literal loopback host
-and port. The random 256-bit request token remains only in the
-ephemeral session descriptor and every request is authenticated.
+## Private runtime, transport, and lifecycle

-`analyzeHeadless.bat` is invoked through an absolute `cmd.exe` with a fixed
-argument sequence, command extensions enabled for the Ghidra script, delayed
-expansion disabled, and Node shell execution disabled. Every batch token is
-quoted. Paths containing command-interpreter metacharacters are rejected
-instead of escaped heuristically.
+Runtime creation installs a protected DACL permitting exactly the current user
+and SYSTEM. Readback checks the actual owner and ACEs by handle. Descriptors
+and snapshots remain locked until owner cleanup. Child files inherit the
+private boundary. Analysis runs with the caller's authority; these controls
+are not a sandbox for the Ghidra engine or other processes using the same user.

-Close, cancellation, timeout, protocol failure, or provider exit removes the
-project and runtime root. Windows P0 uses bounded `taskkill /T /F` process-tree
-termination. It does not assign Ghidra to a Job Object and cannot make the same
-PID-reuse and descendant-ownership claim as the POSIX process-group backend.
+Windows uses an authenticated listener bound to `127.0.0.1` on an ephemeral
+port. The endpoint record contains only the literal loopback host and port.
+The bridge writes a new record and closes its writer before the native reader
+can admit it. The reader refuses concurrent writers and verifies its opened
+object's private DACL. The random 256-bit bearer token stays in the private,
+immutable session descriptor and is redacted from diagnostic output.

-## Known security gates
+The batch launcher uses an absolute `cmd.exe`, fixed switches, delayed
+expansion disabled, and quoted tokens. Command-interpreter metacharacters in
+launch paths are unsupported. JVM home and temporary properties use quoted
+`JDK_JAVA_OPTIONS`, preserving spaces. `APPDATA` and `LOCALAPPDATA` point into
+the private runtime, isolating Ghidra preferences, logs, and caches.

-The following remain explicitly unavailable:
-
- verified current-user-only DACLs for runtime directories, descriptors, logs,
-  snapshots, and endpoint records;
- a DACL-protected Windows named pipe or equivalent OS-identity-restricted IPC;
- reparse-point-safe, handle-based input and output authority;
- Job Object assignment before child execution and kill-on-close proof;
- general extraction containment and filesystem-sensitive workflows; and
- independent security acceptance for hostile or mutable targets.
-
-Successful symlink creation or ConPTY availability does not satisfy any of
-these gates. Inspect the machine-readable report with:
-
-```powershell
-npm run probe:windows-capabilities
-```
+Process creation assigns a suspended child atomically to an owned Job Object.
+Membership and kill-on-owner-close policy are verified before resume.
+Breakaway is disabled. Only the child's default file owner is normalized;
+the caller token stays unchanged. Caller CPU affinity and priority are
+preserved. Close, cancellation, timeout, startup failure, and provider failure
+terminate the job and verify all members have settled before runtime cleanup.
+Cleanup removes admitted objects by handle and unlinks reparse entries without
+following their targets. Abrupt owner death kills the job but can leave
+private runtime files; crash-time transactional deletion is not claimed.

 ## Verification

-Hosted CI builds, type-checks, runs the curated Windows tests, records the named
-host capability report, packs the real npm artifact, installs it in isolation,
-and compares the packaged MCP catalog with `TOOL_CONTRACTS`.
-
-The controlled real-engine lane requires the missing native authority and currently remains blocked:
+See [native controls](../native/windows/README.md) for the separate artifact
+build lane and native boundary checks. Development tarballs without the built
+artifact report native controls unavailable; publishing requires the verified
+artifact and manifest.

 ```powershell
-$env:GHIDRA_INSTALL_DIR = "C:\tools\ghidra_12.1.4_PUBLIC"
-$env:JAVA_HOME = "C:\Program Files\Java\jdk-21"
-npm ci
+npm run verify:windows-native
 npm run verify:ghidra:windows
+npm run verify:ghidra:windows:package -- C:\fixtures\installed-rea C:\fixtures\sample.exe
 ```

-The verifier requires the native authority before opening Ghidra. Its intended
-checks include a deterministic x86-64 PE fixture, the read-only operation
-contract, target/snapshot/import digest linkage, and endpoint, project,
-process, and runtime cleanup. The GitHub workflow
-accepts only the fixed `real-ghidra-windows` repository-dispatch event against
-default-branch `main`, a protected `real-ghidra-windows` environment, and a
-self-hosted runner labelled `Windows`, `x64`, and `ghidra-12-1-2`.
+The package lane must run with an ordinary, non-elevated user token. It exercises
+CLI inspection and every admitted MCP operation, validates named canonical
+input/output contracts, checks the source digest stays unchanged, and verifies
+runtime cleanup. Use a source-owned fixture, one analysis process at a time,
+and a bounded heap for real-provider verification.

-Build, package, or adapter-test success does not prove the P0 operation claim.
-Real-engine acceptance requires the native controls and the separate
-verification lane; broader target and IPC security requirements remain distinct.
+The controlled GitHub workflow runs only default-branch code on its protected
+self-hosted Windows environment. A separate Linux job builds the matching
+native artifact. Hosted Windows CI verifies native controls and packaged
+startup separately from real Ghidra acceptance. Broader hostile-target,
+concurrently mutable-path, extraction, and IPC-security claims require their
+own acceptance and are not implied by this P0 result.
@@ -1,28 +0,0 @@
-import eslint from "@eslint/js";
-import tseslint from "typescript-eslint";
-
-export default tseslint.config(
-  { ignores: ["dist/**", "node_modules/**"] },
-  eslint.configs.recommended,
-  ...tseslint.configs.strictTypeChecked,
-  {
-    files: ["**/*.ts"],
-    languageOptions: {
-      parserOptions: {
-        projectService: true,
-        tsconfigRootDir: import.meta.dirname,
-      },
-    },
-    rules: {
-      "@typescript-eslint/consistent-type-imports": "error",
-      "@typescript-eslint/no-confusing-void-expression": "error",
-      "@typescript-eslint/no-floating-promises": "error",
-      "@typescript-eslint/no-non-null-assertion": "error",
-      "@typescript-eslint/no-unnecessary-condition": "error",
-      "@typescript-eslint/no-unsafe-type-assertion": "error",
-      "@typescript-eslint/only-throw-error": "error",
-      "@typescript-eslint/require-await": "error",
-      "@typescript-eslint/switch-exhaustiveness-check": "error",
-    },
-  },
-);
@@ -55,17 +55,15 @@ fi
 platform="$(uname -s)"
 [[ "$platform" == "Darwin" || "$platform" == "Linux" ]] || fail "REA supports macOS and selected 64-bit Linux distributions."
 command -v curl >/dev/null 2>&1 || fail "curl is required. Install curl, then rerun this installer."
-command -v node >/dev/null 2>&1 || fail "Node.js 22.19+ or 24.11+ is required; install it from https://nodejs.org and retry."
+command -v node >/dev/null 2>&1 || fail "Node.js 22.x (>=22.19), 24.x (>=24.11), or 26+ is required; install it from https://nodejs.org and retry."
 command -v npm >/dev/null 2>&1 || fail "npm is required; install it with Node.js and retry."

 node_version="$(node -p 'process.versions.node' 2>/dev/null || true)"
 IFS=. read -r node_major node_minor _node_patch <<<"$node_version"
 [[ "$node_major" =~ ^[0-9]+$ && "$node_minor" =~ ^[0-9]+$ ]] || fail "the active Node.js version could not be read. Check that node works and is on PATH, then retry."
-if ! ((node_major == 22 && node_minor >= 19 || node_major >= 24)); then
-  fail "Node.js $node_version is unsupported; use Node.js 22.19+ or 24.11+."
-fi
-if ((node_major == 24 && node_minor < 11)); then
-  fail "Node.js $node_version is unsupported; use Node.js 24.11 or newer."
+if ! [[ "$_node_patch" =~ ^[0-9]+(\+[0-9A-Za-z.-]+)?$ ]] ||
+  ! ((node_major == 22 && node_minor >= 19 || node_major == 24 && node_minor >= 11 || node_major >= 26)); then
+  fail "Node.js $node_version is unsupported; use Node.js 22.x (>=22.19), 24.x (>=24.11), or 26+."
 fi

 if [[ -n "$version" ]]; then
@@ -1,21 +1,9 @@
 {
  "$schema": "./node_modules/knip/schema.json",
-  "entry": [
-    "src/main.ts",
-    "src/cli.ts",
-    "src/contracts/errorSchemas.ts",
-    "scripts/run-development-tests.mjs"
-  ],
+  "entry": ["src/main.ts", "src/cli.ts", "src/contracts/errorSchemas.ts"],
  "project": ["src/**/*.ts", "tests/**/*.ts", "scripts/**/*.mjs"],
  "ignoreDependencies": ["electron"],
-  "ignoreBinaries": ["ps"],
  "ignoreExportsUsedInFile": true,
-  "ignoreIssues": {
-    "src/domain/mobileApplicationInvestigation.ts": ["types"],
-    "src/domain/objcSwiftMetadata.ts": ["types"],
-    "src/domain/interfaceBuilderGraph.ts": ["types"],
-    "src/domain/nativeInvestigationGraph.ts": ["types"]
-  },
  "rules": {
    "files": "error",
    "dependencies": "error",
@@ -0,0 +1,107 @@
+# Windows native controls
+
+REA ships one Windows x64 Node-API 8 addon. Users do not compile it or install
+another runtime. Ghidra and a full JDK remain bring-your-own prerequisites.
+The addon uses Windows 10+ APIs and admits fixed local NTFS volumes only.
+
+The package owns the artifact path. The loader checks the package version,
+ABI, Node-API compatibility, PE architecture, and SHA-256 before loading it.
+There is no environment override for loading an arbitrary native module.
+
+## Build
+
+The artifact lane requires Linux, MinGW-w64 `x86_64-w64-mingw32-g++`,
+`x86_64-w64-mingw32-dlltool`, and `tar`. It never installs these commands.
+Node-API headers are reused from the build cache or downloaded from the
+pinned official Node release with its published SHA-256 checked.
+
+```sh
+npm run build:windows-native
+npm run verify:windows-native:artifact
+npm pack
+```
+
+`build/` is ignored by Git. The npm file inventory includes only the addon and
+its manifest. Release CI builds both, and `prepublishOnly` rejects a missing,
+stale, mismatched, or wrong-architecture artifact. A development tarball built
+without this lane reports Windows native controls as unavailable.
+
+## Boundaries
+
+- Opaque Node objects carry a native type tag, resource kind, and closed state.
+  A pathname, serialized object, or forged handle cannot grant authority.
+- Input admission opens every component with `OPEN_REPARSE_POINT`, verifies
+  the actual NTFS object, and retains handles that deny replacement and source
+  writing. An admitted child keeps each ancestor nonempty; ancestor handles
+  permit unrelated writes while NTFS rejects in-place reparse conversion. Volume serial, 128-bit file ID, final handle path,
+  requested path, size, and digest observations are preserved separately.
+- New runtime roots and private child objects are created relative to admitted
+  parent handles with `NtCreateFile`. A protected DACL and current-user owner
+  are installed at creation. Readback permits exactly the current user and SYSTEM. Child
+  files inherit this boundary; private files are also checked by handle.
+- Snapshots stream through a 64 KiB buffer on a Node async worker. Cancellation
+  is checked between reads, cleanup waits for settlement, and the digest
+  commits to the bytes written. Descriptor and snapshot handles remain held
+  until runtime cleanup.
+  Snapshot ownership is single-flight per runtime: an overlapping request fails
+  with `ERROR_BUSY` before acquiring cancellation ownership. The TypeScript owner
+  records only the accepted promise and abort listener; aborting a rejected copy
+  must not cancel the active copy.
+- `PROC_THREAD_ATTRIBUTE_JOB_LIST` assigns a suspended child atomically to an
+  unnamed, non-inherited Job Object. Membership and kill-on-close policy are
+  checked before resume. Breakaway is disabled, and cleanup waits for all
+  job members and captured output, including detached descendants.
+- Only the suspended child's default file owner is normalized. Caller token
+  privileges and ownership remain unchanged. Caller CPU affinity and process
+  priority are preserved in the child. Environment names are sorted and
+  deduplicated using Windows ordinal comparison, preserving their native Unicode
+  semantics and caller-selected values.
+- Cleanup walks locked directory objects, removes files by handle, and unlinks
+  reparse entries without traversing their targets. Normal close, cancellation,
+  startup failure, and timeout release provider resources. Abrupt owner death
+  kills the owned job; it can leave private runtime files for later operator
+  cleanup and does not claim transactional deletion after a crash.
+
+Windows failures retain their constraint, requested coordinate, Win32 code,
+and system message. Unsupported filesystems and reparse paths are distinct
+from OS access denial and missing packaged controls.
+
+Ordinary drive-absolute paths accept backslashes, forward slashes, or mixed
+separators. File identity retains the original requested spelling. Separator
+translation does not resolve dot components, repeated separators, or extend
+the supported device/UNC namespaces; existing admission checks still apply.
+
+The bearer-token descriptor remains under its immutable private lease until
+`runtime_close` on Windows; POSIX removes the descriptor after the bridge reads
+it. Job ownership guarantees process termination on owner death, not deletion
+of private files after a crash. SUBST drive aliases and changing DOS-device
+namespaces are outside the verified P0 scope and are not detected as a separate
+alias policy. Mounted-folder paths that report a reparse tag are rejected by
+component admission; broader namespace variants remain unverified. Preserve
+requested and final handle coordinates rather than treating them as one identity.
+
+## Real verification
+
+```powershell
+npm run verify:windows-native
+npm run verify:ghidra:windows
+```
+
+The native lane checks DACL readback independently, source write/replacement
+rejection, unrelated sibling renames, reparse rejection, immutable snapshots,
+asynchronous cancellation, cleanup containment,
+descendant termination, unrelated-process preservation, normal exit, owner
+close, and forced owner exit. An optional independently built
+`tests/fixtures/windows/processBoundary.cc` executable adds breakaway and
+caller/child token observations and an in-place ancestor reparse attempt:
+
+```powershell
+node scripts/verify-windows-native.mjs . C:\fixtures\process-boundary.exe
+```
+
+`nonAdminRunner.cc` is a test-only launcher for an elevated development shell.
+It duplicates an existing non-elevated Explorer token belonging to the same
+user, creates private temporary window-station objects, and launches the test
+inside a kill-on-close fixture job. It does not create accounts, modify host
+policy, or change the caller's token. A real-provider claim must additionally
+verify the packaged CLI and MCP on that ordinary-user token.
@@ -0,0 +1,123 @@
+#include "authority.hpp"
+
+namespace rea {
+
+static const napi_type_tag RESOURCE_TAG = {0x45fcbf0b49e84fe3ULL, 0x9e3e5074130de843ULL};
+
+void check(napi_status status) {
+  if (status != napi_ok) throw Failure("Invalid native boundary value", L"", ERROR_INVALID_PARAMETER);
+}
+napi_value object(napi_env env) { napi_value value; check(napi_create_object(env, &value)); return value; }
+napi_value null(napi_env env) { napi_value value; check(napi_get_null(env, &value)); return value; }
+napi_value string(napi_env env, const std::string& text) {
+  napi_value value; check(napi_create_string_utf8(env, text.data(), text.size(), &value)); return value;
+}
+napi_value string(napi_env env, const std::wstring& text) {
+  static_assert(sizeof(wchar_t) == sizeof(char16_t));
+  napi_value value;
+  check(napi_create_string_utf16(env, reinterpret_cast<const char16_t*>(text.data()), text.size(), &value));
+  return value;
+}
+napi_value number(napi_env env, double numeric) {
+  napi_value value; check(napi_create_double(env, numeric, &value)); return value;
+}
+napi_value boolean(napi_env env, bool flag) {
+  napi_value value; check(napi_get_boolean(env, flag, &value)); return value;
+}
+void set(napi_env env, napi_value target, const char* key, napi_value value) {
+  check(napi_set_named_property(env, target, key, value));
+}
+std::wstring wide(napi_env env, napi_value value) {
+  size_t size = 0;
+  check(napi_get_value_string_utf16(env, value, nullptr, 0, &size));
+  require(size <= 32767, "Windows value exceeds the native string limit", L"", ERROR_INVALID_PARAMETER);
+  std::vector<char16_t> buffer(size + 1);
+  check(napi_get_value_string_utf16(env, value, buffer.data(), buffer.size(), &size));
+  std::wstring result(reinterpret_cast<const wchar_t*>(buffer.data()), size);
+  require(result.find(L'\0') == std::wstring::npos, "Windows value contains NUL", L"", ERROR_INVALID_PARAMETER);
+  return result;
+}
+double numeric(napi_env env, napi_value value) {
+  double result; check(napi_get_value_double(env, value, &result)); return result;
+}
+std::vector<napi_value> array(napi_env env, napi_value value) {
+  bool valid; check(napi_is_array(env, value, &valid));
+  require(valid, "Native arguments must be an array", L"", ERROR_INVALID_PARAMETER);
+  uint32_t length; check(napi_get_array_length(env, value, &length));
+  std::vector<napi_value> result(length);
+  for (uint32_t index = 0; index < length; ++index)
+    check(napi_get_element(env, value, index, &result[index]));
+  return result;
+}
+static void finalize(napi_env, void* data, void*) { delete static_cast<Resource*>(data); }
+napi_value wrap(napi_env env, std::unique_ptr<Resource> value) {
+  auto result = object(env);
+  check(napi_type_tag_object(env, result, &RESOURCE_TAG));
+  check(napi_wrap(env, result, value.get(), finalize, nullptr, nullptr));
+  value.release();
+  return result;
+}
+Resource& resource(napi_env env, napi_value value, Kind kind) {
+  bool tagged = false;
+  check(napi_check_object_type_tag(env, value, &RESOURCE_TAG, &tagged));
+  require(tagged, "Native handle does not belong to REA", L"", ERROR_INVALID_HANDLE);
+  void* pointer = nullptr; check(napi_unwrap(env, value, &pointer));
+  auto& result = *static_cast<Resource*>(pointer);
+  require(result.kind == kind && !result.closed, "Native handle is closed or has the wrong kind", L"", ERROR_INVALID_HANDLE);
+  return result;
+}
+
+napi_value failureValue(napi_env env, const Failure& failure) {
+    wchar_t* message = nullptr;
+    FormatMessageW(FORMAT_MESSAGE_ALLOCATE_BUFFER | FORMAT_MESSAGE_FROM_SYSTEM | FORMAT_MESSAGE_IGNORE_INSERTS,
+                   nullptr, failure.win32, 0, reinterpret_cast<wchar_t*>(&message), 0, nullptr);
+    std::wstring detail = message == nullptr ? L"" : message;
+    if (message != nullptr) LocalFree(message);
+    const std::wstring constraint(failure.constraint.begin(), failure.constraint.end());
+    auto text = string(env, constraint + (failure.path.empty() ? L"" : L" [" + failure.path + L"]") +
+                           L" (Win32 " + std::to_wstring(failure.win32) + L"): " + detail);
+    napi_value error; napi_create_error(env, nullptr, text, &error);
+    const char* code = failure.win32 == ERROR_FILE_NOT_FOUND || failure.win32 == ERROR_PATH_NOT_FOUND ? "ENOENT"
+                     : failure.win32 == ERROR_ACCESS_DENIED ? "EACCES" : "ERR_REA_WINDOWS_NATIVE";
+    set(env, error, "code", string(env, std::string(code)));
+    set(env, error, "constraint", string(env, failure.constraint));
+    set(env, error, "requestedPath", string(env, failure.path));
+    set(env, error, "win32Code", number(env, failure.win32));
+    set(env, error, "win32Message", string(env, detail));
+    return error;
+}
+
+static napi_value call(napi_env env, napi_callback_info info) {
+  try {
+    std::array<napi_value, 2> args;
+    size_t count = args.size();
+    check(napi_get_cb_info(env, info, &count, args.data(), nullptr, nullptr));
+    require(count == 2, "Native call requires operation and arguments", L"", ERROR_INVALID_PARAMETER);
+    const auto operation = wide(env, args[0]);
+    const auto values = array(env, args[1]);
+    if (operation == L"inspect") {
+      require(values.empty(), "Inspect takes no arguments", L"", ERROR_INVALID_PARAMETER);
+      return inspect(env);
+    }
+    if (operation.rfind(L"process_", 0) == 0) return processCall(env, operation, values);
+    return filesystemCall(env, operation, values);
+  } catch (const Failure& failure) {
+    auto error = failureValue(env, failure);
+    napi_throw(env, error);
+    return nullptr;
+  } catch (const std::exception& failure) {
+    napi_throw_error(env, "ERR_REA_WINDOWS_NATIVE", failure.what());
+    return nullptr;
+  }
+}
+
+static napi_value initialize(napi_env env, napi_value exports) {
+  napi_value function;
+  if (napi_create_function(env, "call", NAPI_AUTO_LENGTH, call, nullptr, &function) != napi_ok) return nullptr;
+  if (napi_set_named_property(env, exports, "call", function) != napi_ok) return nullptr;
+  return exports;
+}
+
+} // namespace rea
+
+NAPI_MODULE(NODE_GYP_MODULE_NAME, rea::initialize)
@@ -0,0 +1,130 @@
+#pragma once
+
+#define WIN32_LEAN_AND_MEAN
+#define NOMINMAX
+#include <windows.h>
+#include <aclapi.h>
+#include <bcrypt.h>
+#include <node_api.h>
+
+#include <algorithm>
+#include <array>
+#include <atomic>
+#include <cstdint>
+#include <memory>
+#include <stdexcept>
+#include <string>
+#include <utility>
+#include <vector>
+
+namespace rea {
+
+// Translate ordinary DOS drive separators without resolving components or
+// changing extended, device, UNC, relative, or drive-relative namespaces.
+inline std::wstring ordinaryDriveSeparators(std::wstring path) {
+  if (path.size() >= 3 && path[1] == L':' &&
+      ((path[0] >= L'A' && path[0] <= L'Z') || (path[0] >= L'a' && path[0] <= L'z')) &&
+      (path[2] == L'\\' || path[2] == L'/'))
+    std::replace(path.begin(), path.end(), L'/', L'\\');
+  return path;
+}
+
+struct Failure : std::runtime_error {
+  DWORD win32;
+  std::wstring path;
+  std::string constraint;
+  Failure(std::string constraint, std::wstring path = L"", DWORD code = GetLastError())
+      : std::runtime_error(constraint), win32(code), path(std::move(path)),
+        constraint(std::move(constraint)) {}
+};
+
+inline void require(bool condition, const char* constraint, const std::wstring& path = L"") {
+  if (!condition) {
+    const auto code = GetLastError();
+    throw Failure(constraint, path, code);
+  }
+}
+inline void require(bool condition, const char* constraint, const std::wstring& path, DWORD code) {
+  if (!condition) throw Failure(constraint, path, code);
+}
+
+class Handle {
+  HANDLE value_ = INVALID_HANDLE_VALUE;
+public:
+  Handle() = default;
+  explicit Handle(HANDLE value) : value_(value) {}
+  ~Handle() { reset(); }
+  Handle(const Handle&) = delete;
+  Handle& operator=(const Handle&) = delete;
+  Handle(Handle&& other) noexcept : value_(other.release()) {}
+  Handle& operator=(Handle&& other) noexcept { reset(other.release()); return *this; }
+  HANDLE get() const { return value_; }
+  bool valid() const { return value_ != INVALID_HANDLE_VALUE && value_ != nullptr; }
+  HANDLE release() { return std::exchange(value_, INVALID_HANDLE_VALUE); }
+  void reset(HANDLE next = INVALID_HANDLE_VALUE) {
+    if (valid()) CloseHandle(value_);
+    value_ = next;
+  }
+};
+
+enum class Kind { File, Runtime, Process };
+struct Resource {
+  const Kind kind;
+  bool closed = false;
+  explicit Resource(Kind value) : kind(value) {}
+  virtual ~Resource() = default;
+};
+struct File : Resource {
+  std::wstring requestedPath;
+  std::wstring path;
+  std::vector<Handle> handles;
+  explicit File(std::wstring path) : Resource(Kind::File), requestedPath(path), path(std::move(path)) {}
+  HANDLE get() const { return handles.back().get(); }
+};
+struct Runtime : Resource {
+  std::wstring path;
+  std::vector<Handle> parents;
+  Handle directory;
+  std::vector<Handle> immutableFiles;
+  // Main-thread admission is single-flight; only the accepted copy owns the
+  // atomic cancellation flag consumed by its async worker. ERROR_BUSY rejects
+  // another copy before it can reset that flag or replace pending ownership.
+  bool snapshotPending = false;
+  std::atomic_bool snapshotCancelled{false};
+  Runtime() : Resource(Kind::Runtime) {}
+};
+struct Process : Resource {
+  Handle job, process, stdoutRead, stderrRead;
+  DWORD pid = 0;
+  Process() : Resource(Kind::Process) {}
+};
+
+void check(napi_status status);
+napi_value failureValue(napi_env env, const Failure& failure);
+napi_value object(napi_env env);
+napi_value string(napi_env env, const std::string& value);
+napi_value string(napi_env env, const std::wstring& value);
+napi_value number(napi_env env, double value);
+napi_value boolean(napi_env env, bool value);
+napi_value null(napi_env env);
+void set(napi_env env, napi_value object, const char* key, napi_value value);
+std::wstring wide(napi_env env, napi_value value);
+double numeric(napi_env env, napi_value value);
+std::vector<napi_value> array(napi_env env, napi_value value);
+napi_value wrap(napi_env env, std::unique_ptr<Resource> resource);
+Resource& resource(napi_env env, napi_value value, Kind kind);
+
+std::unique_ptr<File> openFile(const std::wstring& path, DWORD access = GENERIC_READ,
+                             bool directory = false);
+napi_value identity(napi_env env, HANDLE handle, const std::wstring& path);
+std::unique_ptr<Runtime> createRuntime(const std::wstring& parent, const std::wstring& prefix);
+void closeRuntime(Runtime& runtime);
+napi_value filesystemCall(napi_env env, const std::wstring& operation,
+                          const std::vector<napi_value>& args);
+std::unique_ptr<Process> spawnProcess(const std::wstring& command, const std::wstring& commandLine,
+                                    const std::wstring& cwd, const std::vector<std::wstring>& environment);
+napi_value processCall(napi_env env, const std::wstring& operation,
+                       const std::vector<napi_value>& args);
+napi_value inspect(napi_env env);
+
+} // namespace rea
@@ -0,0 +1,532 @@
+#include "authority.hpp"
+#include <sddl.h>
+#include <winternl.h>
+
+namespace rea {
+
+static std::wstring hex(const unsigned char* bytes, size_t count) {
+  constexpr wchar_t digits[] = L"0123456789abcdef";
+  std::wstring result;
+  for (size_t index = 0; index < count; ++index) {
+    result += digits[bytes[index] >> 4]; result += digits[bytes[index] & 15];
+  }
+  return result;
+}
+
+static std::wstring localPath(std::wstring path) {
+  path = ordinaryDriveSeparators(std::move(path));
+  if (path.rfind(L"\\\\?\\", 0) == 0) path.erase(0, 4);
+  require(path.size() >= 3 && path[1] == L':' && path[2] == L'\\' &&
+          ((path[0] >= L'A' && path[0] <= L'Z') || (path[0] >= L'a' && path[0] <= L'z')),
+          "Only absolute local NTFS drive paths are supported", path, ERROR_NOT_SUPPORTED);
+  require(path.find(L'/', 0) == std::wstring::npos && path.find(L':', 2) == std::wstring::npos,
+          "Alternate streams and non-local path syntax are unsupported", path, ERROR_NOT_SUPPORTED);
+  require(GetDriveTypeW(path.substr(0, 3).c_str()) == DRIVE_FIXED,
+          "Only fixed local NTFS volumes are supported", path, ERROR_NOT_SUPPORTED);
+  if (path.size() > 3 && path.back() == L'\\') path.pop_back();
+  require(path.size() == 3 || path.back() != L'\\', "Repeated path separators are unsupported", path, ERROR_NOT_SUPPORTED);
+  size_t begin = 3;
+  while (begin < path.size()) {
+    const auto end = path.find(L'\\', begin);
+    const auto component = path.substr(begin, end == std::wstring::npos ? end : end - begin);
+    require(!component.empty() && component != L"." && component != L".." &&
+            component.back() != L'.' && component.back() != L' ',
+            "Ambiguous Windows path component is unsupported", path, ERROR_NOT_SUPPORTED);
+    if (end == std::wstring::npos) break;
+    begin = end + 1;
+  }
+  return path;
+}
+
+static Handle openComponent(const std::wstring& path, DWORD access, bool directory, DWORD sharing = FILE_SHARE_READ) {
+  // Attribute-only opens do not participate in Windows share-access checks.
+  // Directory guards need FILE_LIST_DIRECTORY to prevent replacement and
+  // in-place reparse conversion while descendant paths are being consumed.
+  Handle handle(CreateFileW((L"\\\\?\\" + path).c_str(), access | FILE_READ_ATTRIBUTES | READ_CONTROL |
+                           (directory ? FILE_LIST_DIRECTORY : 0),
+                           sharing, nullptr, OPEN_EXISTING,
+                           FILE_FLAG_OPEN_REPARSE_POINT | FILE_FLAG_BACKUP_SEMANTICS, nullptr));
+  require(handle.valid(), "Open Windows path component failed", path);
+  FILE_ATTRIBUTE_TAG_INFO info{};
+  require(GetFileInformationByHandleEx(handle.get(), FileAttributeTagInfo, &info, sizeof(info)),
+          "Read Windows path attributes failed", path);
+  if ((info.FileAttributes & FILE_ATTRIBUTE_REPARSE_POINT) != 0)
+    throw Failure("Reparse path component is unsupported (tag " + std::to_string(info.ReparseTag) + ")",
+                  path, ERROR_NOT_SUPPORTED);
+  require(((info.FileAttributes & FILE_ATTRIBUTE_DIRECTORY) != 0) == directory,
+          directory ? "Expected a directory path component" : "Target is not a regular file", path,
+          directory ? ERROR_PATH_NOT_FOUND : ERROR_DIRECTORY);
+  require(GetFileType(handle.get()) == FILE_TYPE_DISK, "Windows object is not a disk file", path, ERROR_NOT_SUPPORTED);
+  return handle;
+}
+
+std::unique_ptr<File> openFile(const std::wstring& requested, DWORD access, bool directory) {
+  auto result = std::make_unique<File>(localPath(requested));
+  result->requestedPath = requested;
+  const auto& path = result->path;
+  require(directory || path.size() > 3, "Target is not a regular file", requested, ERROR_DIRECTORY);
+  result->handles.push_back(openComponent(path.substr(0, 3), 0, true));
+  wchar_t filesystem[64]{};
+  DWORD flags = 0;
+  require(GetVolumeInformationByHandleW(result->handles.front().get(), nullptr, 0, nullptr, nullptr,
+                                       &flags, filesystem, 64), "Read volume semantics failed", path);
+  require(std::wstring(filesystem) == L"NTFS" && (flags & FILE_PERSISTENT_ACLS) != 0,
+          "Backing volume must be NTFS with persistent ACLs", path, ERROR_NOT_SUPPORTED);
+  size_t offset = 3;
+  while (offset < path.size()) {
+    auto end = path.find(L'\\', offset);
+    const bool final = end == std::wstring::npos;
+    auto child = openComponent(path.substr(0, end), final ? access : 0, !final || directory);
+    // Once the next component is pinned against deletion, its parent cannot
+    // become empty and NTFS cannot convert that parent into a reparse point.
+    // Relax only ancestor write sharing so unrelated child renames can proceed.
+    // Independent evidence: tests/fixtures/windows/processBoundary.cc attempts
+    // FSCTL_SET_REPARSE_POINT on the nonempty pinned ancestor and observes denial.
+    // SUBST aliases and mounted-folder/reparse namespace variants are outside
+    // the admitted P0 evidence; requested and final handle paths remain distinct.
+    const auto parentPath = offset == 3 ? path.substr(0, 3) : path.substr(0, offset - 1);
+    result->handles.back() = openComponent(parentPath, 0, true, FILE_SHARE_READ | FILE_SHARE_WRITE);
+    result->handles.push_back(std::move(child));
+    if (final) break;
+    offset = end + 1;
+  }
+  return result;
+}
+
+napi_value identity(napi_env env, HANDLE handle, const std::wstring& path) {
+  FILE_ID_INFO info{};
+  require(GetFileInformationByHandleEx(handle, FileIdInfo, &info, sizeof(info)),
+          "Stable 128-bit Windows file identity is unavailable", path);
+  std::array<wchar_t, 32768> finalPath;
+  const auto length = GetFinalPathNameByHandleW(handle, finalPath.data(), finalPath.size(), FILE_NAME_NORMALIZED);
+  require(length > 0 && length < finalPath.size(), "Read final handle path failed", path);
+  LARGE_INTEGER size{};
+  FILE_STANDARD_INFO standard{};
+  require(GetFileInformationByHandleEx(handle, FileStandardInfo, &standard, sizeof(standard)),
+          "Read handle metadata failed", path);
+  size = standard.EndOfFile;
+  require(size.QuadPart >= 0 && size.QuadPart <= 9007199254740991LL, "File size exceeds exact numeric representation", path,
+          ERROR_NOT_SUPPORTED);
+  auto result = object(env);
+  set(env, result, "requestedPath", string(env, path));
+  set(env, result, "finalPath", string(env, std::wstring(finalPath.data(), length)));
+  set(env, result, "filesystem", string(env, std::string("NTFS")));
+  std::array<unsigned char, 8> serial;
+  for (size_t index = 0; index < serial.size(); ++index)
+    serial[index] = static_cast<unsigned char>(info.VolumeSerialNumber >> ((7 - index) * 8));
+  set(env, result, "volumeSerial", string(env, hex(serial.data(), serial.size())));
+  set(env, result, "fileId", string(env, hex(info.FileId.Identifier, 16)));
+  set(env, result, "size", number(env, static_cast<double>(size.QuadPart)));
+  set(env, result, "directory", boolean(env, standard.Directory != FALSE));
+  return result;
+}
+
+struct Security {
+  std::vector<unsigned char> user;
+  std::array<unsigned char, SECURITY_MAX_SID_SIZE> system{};
+  std::vector<unsigned char> acl;
+  SECURITY_DESCRIPTOR descriptor{};
+  PSID userSid() const { return reinterpret_cast<const TOKEN_USER*>(user.data())->User.Sid; }
+  Security() {
+    Handle token;
+    HANDLE raw;
+    require(OpenProcessToken(GetCurrentProcess(), TOKEN_QUERY, &raw), "Read current user token failed");
+    token.reset(raw);
+    DWORD size = 0;
+    GetTokenInformation(token.get(), TokenUser, nullptr, 0, &size);
+    user.resize(size);
+    require(GetTokenInformation(token.get(), TokenUser, user.data(), size, &size), "Read current user SID failed");
+    DWORD systemSize = system.size();
+    require(CreateWellKnownSid(WinLocalSystemSid, nullptr, system.data(), &systemSize), "Create SYSTEM SID failed");
+    acl.resize(sizeof(ACL) + 2 * (sizeof(ACCESS_ALLOWED_ACE) - sizeof(DWORD)) + GetLengthSid(userSid()) + systemSize);
+    auto access = reinterpret_cast<PACL>(acl.data());
+    require(InitializeAcl(access, acl.size(), ACL_REVISION), "Initialize private DACL failed");
+    for (PSID sid : {userSid(), static_cast<PSID>(system.data())})
+      require(AddAccessAllowedAceEx(access, ACL_REVISION, OBJECT_INHERIT_ACE | CONTAINER_INHERIT_ACE,
+                                   FILE_ALL_ACCESS, sid), "Populate private DACL failed");
+    require(InitializeSecurityDescriptor(&descriptor, SECURITY_DESCRIPTOR_REVISION) &&
+            SetSecurityDescriptorOwner(&descriptor, userSid(), FALSE) &&
+            SetSecurityDescriptorDacl(&descriptor, TRUE, access, FALSE) &&
+            SetSecurityDescriptorControl(&descriptor, SE_DACL_PROTECTED, SE_DACL_PROTECTED),
+            "Create protected security descriptor failed");
+  }
+};
+
+static Handle createRelative(HANDLE parent, const std::wstring& name, DWORD access, bool directory,
+                             Security& security, const std::wstring& path) {
+  require(!name.empty() && name.find_first_of(L"\\/:\"<>|?*") == std::wstring::npos && name.size() < 32768,
+          "Private object requires one filename component", path, ERROR_INVALID_PARAMETER);
+  UNICODE_STRING coordinate{};
+  coordinate.Buffer = const_cast<wchar_t*>(name.data());
+  coordinate.Length = static_cast<USHORT>(name.size() * sizeof(wchar_t));
+  coordinate.MaximumLength = coordinate.Length;
+  OBJECT_ATTRIBUTES attributes;
+  InitializeObjectAttributes(&attributes, &coordinate, OBJ_CASE_INSENSITIVE, parent, &security.descriptor);
+  IO_STATUS_BLOCK observation{};
+  HANDLE raw = INVALID_HANDLE_VALUE;
+  const auto status = NtCreateFile(&raw, access | SYNCHRONIZE, &attributes, &observation, nullptr,
+                                   FILE_ATTRIBUTE_NORMAL, FILE_SHARE_READ, FILE_CREATE,
+                                   FILE_SYNCHRONOUS_IO_NONALERT | FILE_OPEN_REPARSE_POINT |
+                                   (directory ? FILE_DIRECTORY_FILE : FILE_NON_DIRECTORY_FILE), nullptr, 0);
+  if (status < 0) throw Failure("Create private object relative to its admitted parent failed", path,
+                                RtlNtStatusToDosError(status));
+  Handle result(raw);
+  require(result.valid() && observation.Information == FILE_CREATED,
+          "Private creation did not return a new object handle", path, ERROR_ACCESS_DENIED);
+  return result;
+}
+
+static void verifyPrivate(HANDLE handle, const std::wstring& path, bool root) {
+  Security expected;
+  PSID owner = nullptr;
+  PACL acl = nullptr;
+  PSECURITY_DESCRIPTOR raw = nullptr;
+  const DWORD code = GetSecurityInfo(handle, SE_FILE_OBJECT, OWNER_SECURITY_INFORMATION | DACL_SECURITY_INFORMATION,
+                                     &owner, nullptr, &acl, nullptr, &raw);
+  if (code != ERROR_SUCCESS) throw Failure("Read private DACL by handle failed", path, code);
+  const auto descriptor = std::unique_ptr<void, decltype(&LocalFree)>(raw, LocalFree);
+  require(owner != nullptr && EqualSid(owner, expected.userSid()), "Private object owner is not the current user", path,
+          ERROR_ACCESS_DENIED);
+  SECURITY_DESCRIPTOR_CONTROL control;
+  DWORD revision;
+  require(GetSecurityDescriptorControl(raw, &control, &revision), "Read DACL control flags failed", path);
+  require(acl != nullptr && (control & SE_DACL_PRESENT) != 0 && (!root || (control & SE_DACL_PROTECTED) != 0),
+          "Private object requires a present protected DACL", path, ERROR_ACCESS_DENIED);
+  require(acl->AceCount == 2, "Private DACL contains unexpected trustees", path, ERROR_ACCESS_DENIED);
+  bool user = false, system = false;
+  for (DWORD index = 0; index < acl->AceCount; ++index) {
+    void* rawAce;
+    require(GetAce(acl, index, &rawAce), "Read private DACL entry failed", path);
+    const auto ace = static_cast<ACCESS_ALLOWED_ACE*>(rawAce);
+    require(ace->Header.AceType == ACCESS_ALLOWED_ACE_TYPE && ace->Mask == FILE_ALL_ACCESS &&
+            (ace->Header.AceFlags & INHERIT_ONLY_ACE) == 0 &&
+            (!root || (ace->Header.AceFlags & (OBJECT_INHERIT_ACE | CONTAINER_INHERIT_ACE)) ==
+                      (OBJECT_INHERIT_ACE | CONTAINER_INHERIT_ACE)),
+            "Private DACL contains unsupported rights or ACE type", path, ERROR_ACCESS_DENIED);
+    PSID sid = const_cast<DWORD*>(&ace->SidStart);
+    if (EqualSid(sid, expected.userSid())) user = true;
+    else if (EqualSid(sid, expected.system.data())) system = true;
+    else throw Failure("Private DACL permits an unrelated principal", path, ERROR_ACCESS_DENIED);
+  }
+  require(user && system, "Private DACL must allow only current user and SYSTEM", path, ERROR_ACCESS_DENIED);
+}
+
+std::unique_ptr<Runtime> createRuntime(const std::wstring& parentPath, const std::wstring& prefix) {
+  auto parent = openFile(parentPath, 0, true);
+  require(!prefix.empty() && prefix.find_first_of(L"\\/:\"<>|?*") == std::wstring::npos,
+          "Runtime prefix must be one filename component", parentPath, ERROR_INVALID_PARAMETER);
+  std::array<unsigned char, 16> random;
+  require(BCryptGenRandom(nullptr, random.data(), random.size(), BCRYPT_USE_SYSTEM_PREFERRED_RNG) == 0,
+          "Generate runtime identity failed", parentPath, ERROR_GEN_FAILURE);
+  auto result = std::make_unique<Runtime>();
+  result->path = parent->path + L"\\" + prefix + hex(random.data(), random.size());
+  Security security;
+  result->directory = createRelative(parent->get(), prefix + hex(random.data(), random.size()),
+                                     DELETE | FILE_LIST_DIRECTORY | FILE_READ_ATTRIBUTES | READ_CONTROL,
+                                     true, security, result->path);
+  try {
+    verifyPrivate(result->directory.get(), result->path, true);
+    // The owned child pins the parent nonempty before write sharing is relaxed.
+    parent->handles.back() = openComponent(parent->path, 0, true, FILE_SHARE_READ | FILE_SHARE_WRITE);
+    result->parents = std::move(parent->handles);
+  } catch (...) {
+    FILE_DISPOSITION_INFO deletion{TRUE};
+    SetFileInformationByHandle(result->directory.get(), FileDispositionInfo, &deletion, sizeof(deletion));
+    throw;
+  }
+  return result;
+}
+
+static std::wstring relativePath(Runtime& root, const std::wstring& relative) {
+  require(!relative.empty() && relative[0] != L'\\' && relative.find(L':') == std::wstring::npos,
+          "Runtime coordinate must be a relative path", relative, ERROR_INVALID_PARAMETER);
+  return localPath(root.path + L"\\" + relative);
+}
+
+static std::unique_ptr<File> runtimeDirectory(Runtime& root, const std::wstring& path) {
+  auto result = std::make_unique<File>(path);
+  HANDLE duplicate;
+  require(DuplicateHandle(GetCurrentProcess(), root.directory.get(), GetCurrentProcess(), &duplicate, 0, FALSE,
+                          DUPLICATE_SAME_ACCESS), "Duplicate private directory handle failed", path);
+  result->handles.emplace_back(duplicate);
+  size_t offset = root.path.size() + 1;
+  while (offset < path.size()) {
+    const auto end = path.find(L'\\', offset);
+    result->handles.push_back(openComponent(path.substr(0, end), 0, true));
+    if (end == std::wstring::npos) break;
+    offset = end + 1;
+  }
+  return result;
+}
+
+static void directory(Runtime& root, const std::wstring& relative) {
+  const auto path = relativePath(root, relative);
+  const auto parentPath = path.substr(0, path.find_last_of(L'\\'));
+  auto parent = runtimeDirectory(root, parentPath);
+  verifyPrivate(parent->get(), parentPath, parentPath == root.path);
+  Security security;
+  try {
+    auto created = createRelative(parent->get(), path.substr(path.find_last_of(L'\\') + 1),
+                                  FILE_LIST_DIRECTORY | FILE_READ_ATTRIBUTES | READ_CONTROL,
+                                  true, security, path);
+    verifyPrivate(created.get(), path, false);
+  } catch (const Failure& failure) {
+    if (failure.win32 != ERROR_ALREADY_EXISTS && failure.win32 != ERROR_FILE_EXISTS) throw;
+    auto existing = runtimeDirectory(root, path);
+    verifyPrivate(existing->get(), path, false);
+  }
+}
+
+static Handle createPrivateFile(Runtime& root, const std::wstring& relative) {
+  const auto path = relativePath(root, relative);
+  const auto parentPath = path.substr(0, path.find_last_of(L'\\'));
+  auto parent = runtimeDirectory(root, parentPath);
+  verifyPrivate(parent->get(), parentPath, parentPath == root.path);
+  Security security;
+  auto file = createRelative(parent->get(), path.substr(path.find_last_of(L'\\') + 1),
+                             GENERIC_WRITE | GENERIC_READ | READ_CONTROL, false, security, path);
+  verifyPrivate(file.get(), path, false);
+  return file;
+}
+
+static void writeBytes(HANDLE file, const void* bytes, DWORD count, const std::wstring& path) {
+  DWORD written;
+  require(WriteFile(file, bytes, count, &written, nullptr) && written == count, "Write private file failed", path);
+}
+
+static void dispose(HANDLE handle, const std::wstring& path) {
+  FILE_BASIC_INFO info{};
+  require(GetFileInformationByHandleEx(handle, FileBasicInfo, &info, sizeof(info)), "Read cleanup attributes failed", path);
+  if ((info.FileAttributes & FILE_ATTRIBUTE_READONLY) != 0) {
+    info.FileAttributes &= ~FILE_ATTRIBUTE_READONLY;
+    require(SetFileInformationByHandle(handle, FileBasicInfo, &info, sizeof(info)), "Clear owned readonly attribute failed", path);
+  }
+  FILE_DISPOSITION_INFO deletion{TRUE};
+  require(SetFileInformationByHandle(handle, FileDispositionInfo, &deletion, sizeof(deletion)), "Delete owned object by handle failed", path);
+}
+
+void closeRuntime(Runtime& root) {
+  if (root.closed) return;
+  // Windows keeps the bearer descriptor and snapshot leases until this owner
+  // cleanup. POSIX removes its consumed descriptor earlier. Abrupt owner death
+  // closes process jobs but cannot run this walk, so private files can remain.
+  root.immutableFiles.clear();
+  struct ReleaseRuntime {
+    Runtime& root;
+    ~ReleaseRuntime() { root.directory.reset(); root.parents.clear(); root.closed = true; }
+  } release{root};
+  // Each traversed directory stays locked against replacement. Reparse entries
+  // are unlinked as objects; their targets are never enumerated or deleted.
+  struct Frame {
+    Handle directory;
+    HANDLE search = INVALID_HANDLE_VALUE;
+    std::wstring path;
+    WIN32_FIND_DATAW next{};
+    bool pending = false;
+    Frame(Handle handle, std::wstring path) : directory(std::move(handle)), path(std::move(path)) {
+      search = FindFirstFileExW((L"\\\\?\\" + this->path + L"\\*").c_str(), FindExInfoBasic, &next,
+                               FindExSearchNameMatch, nullptr, 0);
+      pending = search != INVALID_HANDLE_VALUE;
+      require(pending || GetLastError() == ERROR_FILE_NOT_FOUND, "Enumerate runtime cleanup failed", this->path);
+    }
+    ~Frame() { if (search != INVALID_HANDLE_VALUE) FindClose(search); }
+  };
+  std::vector<std::unique_ptr<Frame>> frames;
+  HANDLE duplicate;
+  require(DuplicateHandle(GetCurrentProcess(), root.directory.get(), GetCurrentProcess(), &duplicate, 0, FALSE,
+                          DUPLICATE_SAME_ACCESS), "Duplicate runtime cleanup handle failed", root.path);
+  frames.push_back(std::make_unique<Frame>(Handle(duplicate), root.path));
+  while (!frames.empty()) {
+    auto& frame = *frames.back();
+    if (!frame.pending) {
+      if (frame.search != INVALID_HANDLE_VALUE) { FindClose(frame.search); frame.search = INVALID_HANDLE_VALUE; }
+      dispose(frame.directory.get(), frame.path);
+      frames.pop_back();
+      continue;
+    }
+    const auto name = std::wstring(frame.next.cFileName);
+    frame.pending = FindNextFileW(frame.search, &frame.next) != FALSE;
+    require(frame.pending || GetLastError() == ERROR_NO_MORE_FILES, "Continue runtime cleanup enumeration failed", frame.path);
+    if (name == L"." || name == L"..") continue;
+    const auto path = frame.path + L"\\" + name;
+    Handle child(CreateFileW((L"\\\\?\\" + path).c_str(), DELETE | GENERIC_READ | FILE_WRITE_ATTRIBUTES,
+                            FILE_SHARE_READ, nullptr, OPEN_EXISTING,
+                            FILE_FLAG_OPEN_REPARSE_POINT | FILE_FLAG_BACKUP_SEMANTICS, nullptr));
+    require(child.valid(), "Open owned cleanup object failed", path);
+    FILE_ATTRIBUTE_TAG_INFO info{};
+    require(GetFileInformationByHandleEx(child.get(), FileAttributeTagInfo, &info, sizeof(info)), "Read cleanup object tag failed", path);
+    if ((info.FileAttributes & FILE_ATTRIBUTE_DIRECTORY) != 0 && (info.FileAttributes & FILE_ATTRIBUTE_REPARSE_POINT) == 0)
+      frames.push_back(std::make_unique<Frame>(std::move(child), path));
+    else dispose(child.get(), path);
+  }
+}
+
+struct SnapshotWork {
+  napi_env env;
+  napi_async_work work = nullptr;
+  napi_deferred deferred = nullptr;
+  napi_ref rootReference = nullptr;
+  Runtime* root;
+  std::unique_ptr<File> source;
+  Handle destination;
+  std::wstring path;
+  std::wstring digest;
+  std::unique_ptr<Failure> failure;
+  SnapshotWork(napi_env env, Runtime& root) : env(env), root(&root) {}
+};
+
+static void copySnapshot(napi_env, void* pointer) {
+  auto& work = *static_cast<SnapshotWork*>(pointer);
+  try {
+    BCRYPT_ALG_HANDLE algorithm = nullptr;
+    require(BCryptOpenAlgorithmProvider(&algorithm, BCRYPT_SHA256_ALGORITHM, nullptr, 0) == 0,
+            "Initialize snapshot SHA-256 failed", work.source->path, ERROR_GEN_FAILURE);
+    struct Algorithm { BCRYPT_ALG_HANDLE handle; ~Algorithm() { BCryptCloseAlgorithmProvider(handle, 0); } } owner{algorithm};
+    BCRYPT_HASH_HANDLE hash = nullptr;
+    require(BCryptCreateHash(algorithm, &hash, nullptr, 0, nullptr, 0, 0) == 0,
+            "Create snapshot SHA-256 state failed", work.source->path, ERROR_GEN_FAILURE);
+    struct Hash { BCRYPT_HASH_HANDLE handle; ~Hash() { BCryptDestroyHash(handle); } } hashOwner{hash};
+    std::array<unsigned char, 65536> buffer;
+    while (true) {
+      require(!work.root->snapshotCancelled.load(), "Admitted snapshot was cancelled", work.path, ERROR_OPERATION_ABORTED);
+      DWORD count;
+      require(ReadFile(work.source->get(), buffer.data(), buffer.size(), &count, nullptr),
+              "Read admitted source handle failed", work.source->path);
+      if (count == 0) break;
+      writeBytes(work.destination.get(), buffer.data(), count, work.path);
+      require(BCryptHashData(hash, buffer.data(), count, 0) == 0,
+              "Hash admitted snapshot bytes failed", work.source->path, ERROR_GEN_FAILURE);
+    }
+    std::array<unsigned char, 32> digest;
+    require(BCryptFinishHash(hash, digest.data(), digest.size(), 0) == 0,
+            "Finish snapshot SHA-256 failed", work.source->path, ERROR_GEN_FAILURE);
+    require(FlushFileBuffers(work.destination.get()), "Flush private snapshot failed", work.path);
+    work.digest = hex(digest.data(), digest.size());
+  } catch (const Failure& failure) {
+    work.failure = std::make_unique<Failure>(failure);
+  } catch (const std::exception& failure) {
+    work.failure = std::make_unique<Failure>(failure.what(), work.path, ERROR_GEN_FAILURE);
+  }
+}
+
+static void completeSnapshot(napi_env env, napi_status status, void* pointer) {
+  std::unique_ptr<SnapshotWork> work(static_cast<SnapshotWork*>(pointer));
+  work->root->snapshotPending = false;
+  try {
+    if (work->failure) throw *work->failure;
+    require(status == napi_ok && !work->root->snapshotCancelled.load(), "Native snapshot worker was cancelled", work->path, ERROR_OPERATION_ABORTED);
+    auto result = object(env);
+    set(env, result, "sha256", string(env, work->digest));
+    set(env, result, "source", identity(env, work->source->get(), work->source->requestedPath));
+    set(env, result, "snapshot", identity(env, work->destination.get(), work->path));
+    work->root->immutableFiles.push_back(std::move(work->destination));
+    check(napi_resolve_deferred(env, work->deferred, result));
+  } catch (const Failure& failure) {
+    napi_reject_deferred(env, work->deferred, failureValue(env, failure));
+  } catch (const std::exception& failure) {
+    napi_reject_deferred(env, work->deferred,
+                         failureValue(env, Failure(failure.what(), work->path, ERROR_GEN_FAILURE)));
+  }
+  napi_delete_reference(env, work->rootReference);
+  napi_delete_async_work(env, work->work);
+}
+
+static napi_value snapshot(napi_env env, napi_value rootValue, Runtime& root,
+                           const std::wstring& sourcePath, const std::wstring& relative) {
+  auto work = std::make_unique<SnapshotWork>(env, root);
+  work->source = openFile(sourcePath);
+  work->path = relativePath(root, relative);
+  work->destination = createPrivateFile(root, relative);
+  napi_value promise;
+  check(napi_create_promise(env, &work->deferred, &promise));
+  check(napi_create_reference(env, rootValue, 1, &work->rootReference));
+  const auto label = string(env, std::string("REA admitted Windows snapshot"));
+  root.snapshotCancelled.store(false);
+  try {
+    check(napi_create_async_work(env, nullptr, label, copySnapshot, completeSnapshot, work.get(), &work->work));
+    check(napi_queue_async_work(env, work->work));
+  } catch (...) {
+    if (work->work) napi_delete_async_work(env, work->work);
+    napi_delete_reference(env, work->rootReference);
+    throw;
+  }
+  root.snapshotPending = true;
+  work.release();
+  return promise;
+}
+
+napi_value filesystemCall(napi_env env, const std::wstring& operation, const std::vector<napi_value>& args) {
+  const auto expected = operation == L"open" || operation == L"close" || operation == L"runtime_close" || operation == L"runtime_snapshot_cancel" ? 1
+                      : operation == L"runtime_create" || operation == L"runtime_mkdir" || operation == L"runtime_open" ? 2 : 3;
+  require(args.size() == static_cast<size_t>(expected), "Wrong native filesystem argument count", L"", ERROR_INVALID_PARAMETER);
+  if (operation == L"open") {
+    auto file = openFile(wide(env, args[0]));
+    auto result = identity(env, file->get(), file->requestedPath);
+    set(env, result, "handle", wrap(env, std::move(file)));
+    return result;
+  }
+  if (operation == L"close") {
+    auto& file = static_cast<File&>(resource(env, args[0], Kind::File));
+    file.handles.clear(); file.closed = true;
+    return null(env);
+  }
+  if (operation == L"read") {
+    auto& file = static_cast<File&>(resource(env, args[0], Kind::File));
+    const auto position = numeric(env, args[1]);
+    const auto length = numeric(env, args[2]);
+    require(position >= 0 && position <= 9007199254740991.0 && position == static_cast<int64_t>(position) &&
+            length >= 0 && length <= 65536 && length == static_cast<DWORD>(length),
+            "Read coordinates exceed the native chunk boundary", file.path, ERROR_INVALID_PARAMETER);
+    LARGE_INTEGER offset; offset.QuadPart = static_cast<int64_t>(position);
+    require(SetFilePointerEx(file.get(), offset, nullptr, FILE_BEGIN), "Seek admitted file handle failed", file.path);
+    std::array<unsigned char, 65536> buffer;
+    DWORD count;
+    require(ReadFile(file.get(), buffer.data(), static_cast<DWORD>(length), &count, nullptr), "Read admitted file handle failed", file.path);
+    napi_value result;
+    check(napi_create_buffer_copy(env, count, buffer.data(), nullptr, &result));
+    return result;
+  }
+  if (operation == L"runtime_create") {
+    auto root = createRuntime(wide(env, args[0]), wide(env, args[1]));
+    auto result = identity(env, root->directory.get(), root->path);
+    set(env, result, "path", string(env, root->path));
+    set(env, result, "privateDacl", boolean(env, true));
+    set(env, result, "handle", wrap(env, std::move(root)));
+    return result;
+  }
+  auto& root = static_cast<Runtime&>(resource(env, args[0], Kind::Runtime));
+  if (operation == L"runtime_snapshot_cancel") { root.snapshotCancelled.store(true); return null(env); }
+  require(!root.snapshotPending, "Runtime snapshot is still pending", root.path, ERROR_BUSY);
+  // Reject overlapping operations before snapshot() resets cancellation. The
+  // one accepted worker and WindowsPrivateRuntime retain the same root lease.
+  if (operation == L"runtime_close") { closeRuntime(root); return null(env); }
+  if (operation == L"runtime_mkdir") { directory(root, wide(env, args[1])); return null(env); }
+  if (operation == L"runtime_open") {
+    const auto path = relativePath(root, wide(env, args[1]));
+    auto file = runtimeDirectory(root, path.substr(0, path.find_last_of(L'\\')));
+    file->path = path;
+    file->requestedPath = path;
+    file->handles.push_back(openComponent(path, GENERIC_READ, false));
+    verifyPrivate(file->get(), path, false);
+    auto result = identity(env, file->get(), path);
+    set(env, result, "handle", wrap(env, std::move(file)));
+    return result;
+  }
+  if (operation == L"runtime_write") {
+    bool isBuffer; check(napi_is_buffer(env, args[2], &isBuffer));
+    require(isBuffer, "Private write requires a byte buffer", root.path, ERROR_INVALID_PARAMETER);
+    void* bytes; size_t length; check(napi_get_buffer_info(env, args[2], &bytes, &length));
+    require(length <= MAXDWORD, "Private write exceeds Win32 byte representation", root.path, ERROR_INVALID_PARAMETER);
+    auto file = createPrivateFile(root, wide(env, args[1]));
+    writeBytes(file.get(), bytes, static_cast<DWORD>(length), root.path);
+    require(FlushFileBuffers(file.get()), "Flush private runtime file failed", root.path);
+    root.immutableFiles.push_back(std::move(file));
+    return null(env);
+  }
+  if (operation == L"runtime_snapshot") {
+    return snapshot(env, args[0], root, wide(env, args[1]), wide(env, args[2]));
+  }
+  throw Failure("Unknown native filesystem operation", L"", ERROR_INVALID_PARAMETER);
+}
+
+} // namespace rea
@@ -0,0 +1,272 @@
+#include "authority.hpp"
+
+namespace rea {
+
+class Attributes {
+  std::vector<unsigned char> storage_;
+public:
+  explicit Attributes(DWORD count) {
+    SIZE_T size = 0;
+    InitializeProcThreadAttributeList(nullptr, count, 0, &size);
+    storage_.resize(size);
+    require(InitializeProcThreadAttributeList(get(), count, 0, &size), "Initialize process attributes failed");
+  }
+  ~Attributes() { DeleteProcThreadAttributeList(get()); }
+  LPPROC_THREAD_ATTRIBUTE_LIST get() { return reinterpret_cast<LPPROC_THREAD_ATTRIBUTE_LIST>(storage_.data()); }
+  void add(DWORD_PTR key, void* value, SIZE_T size) {
+    require(UpdateProcThreadAttribute(get(), 0, key, value, size, nullptr, nullptr),
+            "Windows atomic process attribute is unavailable");
+  }
+};
+
+static Handle createJob() {
+  Handle job(CreateJobObjectW(nullptr, nullptr));
+  require(job.valid(), "Create owned Job Object failed");
+  JOBOBJECT_EXTENDED_LIMIT_INFORMATION policy{};
+  policy.BasicLimitInformation.LimitFlags = JOB_OBJECT_LIMIT_KILL_ON_JOB_CLOSE;
+  require(SetInformationJobObject(job.get(), JobObjectExtendedLimitInformation, &policy, sizeof(policy)),
+          "Apply kill-on-owner-close Job Object policy failed");
+  JOBOBJECT_EXTENDED_LIMIT_INFORMATION actual{};
+  require(QueryInformationJobObject(job.get(), JobObjectExtendedLimitInformation, &actual, sizeof(actual), nullptr),
+          "Read Job Object policy failed");
+  require(actual.BasicLimitInformation.LimitFlags == JOB_OBJECT_LIMIT_KILL_ON_JOB_CLOSE,
+          "Job Object policy permits unexpected breakaway", L"", ERROR_ACCESS_DENIED);
+  return job;
+}
+
+static void pipe(Handle& read, Handle& write) {
+  SECURITY_ATTRIBUTES attributes{sizeof(SECURITY_ATTRIBUTES), nullptr, TRUE};
+  HANDLE rawRead, rawWrite;
+  require(CreatePipe(&rawRead, &rawWrite, &attributes, 0), "Create owned process output pipe failed");
+  read.reset(rawRead); write.reset(rawWrite);
+  require(SetHandleInformation(read.get(), HANDLE_FLAG_INHERIT, 0), "Protect process output handle inheritance failed");
+}
+
+std::unique_ptr<Process> spawnProcess(const std::wstring& command, const std::wstring& commandLine,
+                                    const std::wstring& cwd, const std::vector<std::wstring>& environment) {
+  const auto executable = ordinaryDriveSeparators(command);
+  require(executable.size() >= 3 && executable[1] == L':' && executable[2] == L'\\',
+          "Owned Windows process requires an absolute executable path", command, ERROR_INVALID_PARAMETER);
+  auto result = std::make_unique<Process>();
+  result->job = createJob();
+  Handle stdoutWrite, stderrWrite;
+  pipe(result->stdoutRead, stdoutWrite); pipe(result->stderrRead, stderrWrite);
+  SECURITY_ATTRIBUTES security{sizeof(SECURITY_ATTRIBUTES), nullptr, TRUE};
+  Handle input(CreateFileW(L"NUL", GENERIC_READ, FILE_SHARE_READ | FILE_SHARE_WRITE,
+                          &security, OPEN_EXISTING, FILE_ATTRIBUTE_NORMAL, nullptr));
+  require(input.valid(), "Open owned process null input failed");
+  Attributes attributes(2);
+  HANDLE job = result->job.get();
+  attributes.add(PROC_THREAD_ATTRIBUTE_JOB_LIST, &job, sizeof(job));
+  std::array<HANDLE, 3> inherited{input.get(), stdoutWrite.get(), stderrWrite.get()};
+  attributes.add(PROC_THREAD_ATTRIBUTE_HANDLE_LIST, inherited.data(), sizeof(inherited));
+  STARTUPINFOEXW startup{};
+  startup.StartupInfo.cb = sizeof(startup);
+  startup.StartupInfo.dwFlags = STARTF_USESTDHANDLES;
+  startup.StartupInfo.hStdInput = input.get();
+  startup.StartupInfo.hStdOutput = stdoutWrite.get();
+  startup.StartupInfo.hStdError = stderrWrite.get();
+  startup.lpAttributeList = attributes.get();
+  // Windows environment names use ordinal case-insensitive comparison, not
+  // locale collation or JavaScript's expanding Unicode uppercase conversion.
+  auto orderedEnvironment = environment;
+  auto keyLength = [&](const std::wstring& entry) {
+    const auto end = entry.find(L'=', entry.front() == L'=' ? 1 : 0);
+    require(end != std::wstring::npos && end > 0, "Invalid child environment name", command,
+            ERROR_INVALID_PARAMETER);
+    return static_cast<int>(end);
+  };
+  for (const auto& entry : orderedEnvironment) {
+    require(!entry.empty(), "Empty child environment entry", command, ERROR_INVALID_PARAMETER);
+    keyLength(entry);
+  }
+  auto compareNames = [&](const std::wstring& left, const std::wstring& right) {
+    const auto result = CompareStringOrdinal(left.data(), keyLength(left), right.data(), keyLength(right), TRUE);
+    require(result != 0, "Compare Windows environment names failed", command);
+    return result;
+  };
+  std::stable_sort(orderedEnvironment.begin(), orderedEnvironment.end(),
+                   [&](const std::wstring& left, const std::wstring& right) {
+                     return compareNames(left, right) == CSTR_LESS_THAN;
+                   });
+  std::vector<std::wstring> uniqueEnvironment;
+  for (auto& entry : orderedEnvironment) {
+    if (!uniqueEnvironment.empty() && compareNames(uniqueEnvironment.back(), entry) == CSTR_EQUAL)
+      uniqueEnvironment.back() = std::move(entry);
+    else uniqueEnvironment.push_back(std::move(entry));
+  }
+  std::vector<wchar_t> variables;
+  for (const auto& entry : uniqueEnvironment) {
+    variables.insert(variables.end(), entry.begin(), entry.end()); variables.push_back(L'\0');
+  }
+  variables.push_back(L'\0');
+  if (uniqueEnvironment.empty()) variables.push_back(L'\0');
+  std::vector<wchar_t> line(commandLine.begin(), commandLine.end()); line.push_back(L'\0');
+  PROCESS_INFORMATION process{};
+  require(CreateProcessW(executable.c_str(), line.data(), nullptr, nullptr, TRUE,
+                         CREATE_UNICODE_ENVIRONMENT | EXTENDED_STARTUPINFO_PRESENT | CREATE_SUSPENDED | CREATE_NO_WINDOW,
+                         variables.data(), cwd.empty() ? nullptr : cwd.c_str(), &startup.StartupInfo, &process),
+          "Create process atomically inside owned Job Object failed", command);
+  result->process.reset(process.hProcess);
+  Handle thread(process.hThread);
+  result->pid = process.dwProcessId;
+  // An elevated token may default file ownership to Administrators. Normalize
+  // only the suspended child's default owner so its runtime files belong to the
+  // current user; the caller's token and privileges are not modified.
+  HANDLE rawToken;
+  require(OpenProcessToken(result->process.get(), TOKEN_QUERY | TOKEN_ADJUST_DEFAULT, &rawToken),
+          "Open suspended process default-owner token failed", command);
+  Handle token(rawToken);
+  DWORD tokenSize = 0;
+  GetTokenInformation(token.get(), TokenUser, nullptr, 0, &tokenSize);
+  std::vector<unsigned char> tokenUser(tokenSize);
+  require(GetTokenInformation(token.get(), TokenUser, tokenUser.data(), tokenSize, &tokenSize),
+          "Read suspended process user identity failed", command);
+  TOKEN_OWNER owner{reinterpret_cast<TOKEN_USER*>(tokenUser.data())->User.Sid};
+  require(SetTokenInformation(token.get(), TokenOwner, &owner, sizeof(owner)),
+          "Set suspended process file owner failed", command);
+  DWORD_PTR affinity = 0, systemAffinity = 0;
+  require(GetProcessAffinityMask(GetCurrentProcess(), &affinity, &systemAffinity),
+          "Read caller process affinity failed", command);
+  if (affinity != 0)
+    require(SetProcessAffinityMask(result->process.get(), affinity), "Preserve caller process affinity failed", command);
+  const DWORD priority = GetPriorityClass(GetCurrentProcess());
+  require(priority != 0 && SetPriorityClass(result->process.get(), priority),
+          "Preserve caller process priority failed", command);
+  BOOL assigned = FALSE;
+  if (!IsProcessInJob(result->process.get(), result->job.get(), &assigned) || !assigned) {
+    TerminateJobObject(result->job.get(), 1);
+    throw Failure("Suspended process has no owned Job Object membership", command, ERROR_ACCESS_DENIED);
+  }
+  require(ResumeThread(thread.get()) != MAXDWORD, "Resume job-owned process failed", command);
+  return result;
+}
+
+static napi_value readOutput(napi_env env, Handle& read, bool& ended) {
+  std::array<unsigned char, 65536> bytes;
+  DWORD available = 0, count = 0;
+  if (!read.valid()) ended = true;
+  else if (!PeekNamedPipe(read.get(), nullptr, 0, nullptr, &available, nullptr)) {
+    require(GetLastError() == ERROR_BROKEN_PIPE, "Observe owned process output failed");
+    read.reset(); ended = true;
+  } else if (available > 0) {
+    require(ReadFile(read.get(), bytes.data(), std::min<DWORD>(available, bytes.size()), &count, nullptr),
+            "Read owned process output failed");
+  }
+  napi_value result;
+  check(napi_create_buffer_copy(env, count, bytes.data(), nullptr, &result));
+  return result;
+}
+
+static DWORD activeProcesses(Process& process) {
+  JOBOBJECT_BASIC_ACCOUNTING_INFORMATION state{};
+  require(QueryInformationJobObject(process.job.get(), JobObjectBasicAccountingInformation, &state, sizeof(state), nullptr),
+          "Observe owned Job Object settlement failed");
+  return state.ActiveProcesses;
+}
+
+static napi_value callerToken(napi_env env) {
+  HANDLE raw;
+  require(OpenProcessToken(GetCurrentProcess(), TOKEN_QUERY | TOKEN_DUPLICATE, &raw), "Read caller token failed");
+  Handle token(raw);
+  DWORD size;
+  TOKEN_ELEVATION elevation{};
+  require(GetTokenInformation(token.get(), TokenElevation, &elevation, sizeof(elevation), &size), "Read caller elevation failed");
+  std::vector<unsigned char> user(4096), owner(4096), integrity(4096);
+  require(GetTokenInformation(token.get(), TokenUser, user.data(), user.size(), &size) &&
+          GetTokenInformation(token.get(), TokenOwner, owner.data(), owner.size(), &size) &&
+          GetTokenInformation(token.get(), TokenIntegrityLevel, integrity.data(), integrity.size(), &size),
+          "Read caller token observations failed");
+  HANDLE rawImpersonation;
+  require(DuplicateToken(token.get(), SecurityIdentification, &rawImpersonation), "Observe caller group membership failed");
+  Handle impersonation(rawImpersonation);
+  std::array<unsigned char, SECURITY_MAX_SID_SIZE> administrators;
+  DWORD administratorSize = administrators.size();
+  require(CreateWellKnownSid(WinBuiltinAdministratorsSid, nullptr, administrators.data(), &administratorSize),
+          "Create administrator group identity failed");
+  BOOL administrator = FALSE, assigned = FALSE;
+  require(CheckTokenMembership(impersonation.get(), administrators.data(), &administrator), "Read caller administrator membership failed");
+  require(IsProcessInJob(GetCurrentProcess(), nullptr, &assigned), "Read caller job membership failed");
+  const auto sid = reinterpret_cast<TOKEN_MANDATORY_LABEL*>(integrity.data())->Label.Sid;
+  auto result = object(env);
+  set(env, result, "elevated", boolean(env, elevation.TokenIsElevated != 0));
+  set(env, result, "administrator", boolean(env, administrator != FALSE));
+  set(env, result, "integrityLevel", number(env, *GetSidSubAuthority(sid, *GetSidSubAuthorityCount(sid) - 1)));
+  set(env, result, "defaultOwnerIsUser", boolean(env, EqualSid(reinterpret_cast<TOKEN_USER*>(user.data())->User.Sid,
+                                                              reinterpret_cast<TOKEN_OWNER*>(owner.data())->Owner)));
+  set(env, result, "inJob", boolean(env, assigned != FALSE));
+  return result;
+}
+
+napi_value processCall(napi_env env, const std::wstring& operation, const std::vector<napi_value>& args) {
+  if (operation == L"process_caller_token") {
+    require(args.empty(), "Caller token observation takes no arguments", L"", ERROR_INVALID_PARAMETER);
+    return callerToken(env);
+  }
+  if (operation == L"process_spawn") {
+    require(args.size() == 4, "Wrong native process launch argument count", L"", ERROR_INVALID_PARAMETER);
+    std::vector<std::wstring> environment;
+    for (const auto& entry : array(env, args[3])) environment.push_back(wide(env, entry));
+    auto process = spawnProcess(wide(env, args[0]), wide(env, args[1]), wide(env, args[2]), environment);
+    auto result = object(env);
+    set(env, result, "pid", number(env, process->pid));
+    set(env, result, "jobAssigned", boolean(env, true));
+    set(env, result, "killOnOwnerClose", boolean(env, true));
+    set(env, result, "handle", wrap(env, std::move(process)));
+    return result;
+  }
+  require(args.size() == 1, "Wrong native process handle argument count", L"", ERROR_INVALID_PARAMETER);
+  auto& process = static_cast<Process&>(resource(env, args[0], Kind::Process));
+  if (operation == L"process_poll") {
+    auto result = object(env);
+    bool stdoutEnded = false, stderrEnded = false;
+    set(env, result, "stdout", readOutput(env, process.stdoutRead, stdoutEnded));
+    set(env, result, "stderr", readOutput(env, process.stderrRead, stderrEnded));
+    set(env, result, "stdoutEnded", boolean(env, stdoutEnded));
+    set(env, result, "stderrEnded", boolean(env, stderrEnded));
+    const auto exited = WaitForSingleObject(process.process.get(), 0);
+    require(exited == WAIT_OBJECT_0 || exited == WAIT_TIMEOUT, "Observe owned process exit failed");
+    DWORD code = 0;
+    if (exited == WAIT_OBJECT_0) require(GetExitCodeProcess(process.process.get(), &code), "Read owned process exit code failed");
+    set(env, result, "exitCode", exited == WAIT_OBJECT_0 ? number(env, code) : null(env));
+    set(env, result, "activeProcesses", number(env, activeProcesses(process)));
+    return result;
+  }
+  if (operation == L"process_alive") return number(env, activeProcesses(process));
+  if (operation == L"process_terminate") {
+    const auto active = activeProcesses(process);
+    if (active > 0) require(TerminateJobObject(process.job.get(), 1), "Terminate owned Job Object failed");
+    return boolean(env, active > 0);
+  }
+  if (operation == L"process_close") {
+    // Closing the job is the crash-safe authority; no PID enumeration is used.
+    process.job.reset(); process.process.reset(); process.stdoutRead.reset(); process.stderrRead.reset();
+    process.closed = true;
+    return null(env);
+  }
+  throw Failure("Unknown native process operation", L"", ERROR_INVALID_PARAMETER);
+}
+
+napi_value inspect(napi_env env) {
+  wchar_t temp[32768];
+  const auto length = GetTempPathW(32768, temp);
+  require(length > 0 && length < 32768, "Read temporary directory coordinate failed");
+  auto root = createRuntime(std::wstring(temp, length), L"rea-native-probe-");
+  auto filesystem = identity(env, root->directory.get(), root->path);
+  closeRuntime(*root);
+  auto job = createJob();
+  Attributes attributes(1);
+  HANDLE raw = job.get();
+  attributes.add(PROC_THREAD_ATTRIBUTE_JOB_LIST, &raw, sizeof(raw));
+  auto result = object(env);
+  set(env, result, "abiVersion", number(env, 1));
+  set(env, result, "nodeApiVersion", number(env, 8));
+  set(env, result, "architecture", string(env, std::string("x64")));
+  set(env, result, "filesystem", filesystem);
+  set(env, result, "privateDacl", boolean(env, true));
+  set(env, result, "atomicJobAssignment", boolean(env, true));
+  set(env, result, "killOnOwnerClose", boolean(env, true));
+  return result;
+}
+
+} // namespace rea
@@ -1,7 +1,7 @@
 {
  "name": "rea-agents",
  "mcpName": "io.github.morluto/rea",
-  "version": "4.0.1",
+  "version": "4.1.0",
  "description": "Reverse engineer anything from your terminal or agent with one CLI and MCP server.",
  "license": "MIT",
  "repository": {
@@ -35,7 +35,7 @@
    "rea-agents": "scripts/rea.mjs"
  },
  "engines": {
-    "node": "^22.19.0 || >=24.11.0"
+    "node": "^22.19.0 || ^24.11.0 || >=26.0.0"
  },
  "packageManager": "npm@11.16.0",
  "files": [
@@ -44,6 +44,8 @@
    "bridge/hopper_bridge.py",
    "bridge/native/ReaNativeUI.swift",
    "bridge/ghidra/ReaGhidraBridge.java",
+    "bridge/ghidra/ReaGhidraExtensions.java",
+    "bridge/ghidra/ReaGhidraPrepareCom.java",
    "scripts/rea.mjs",
    "scripts/electron-active-hook.cjs",
    "scripts/electron-active-hook-boundaries.cjs",
@@ -52,7 +54,10 @@
    "scripts/prepare.mjs",
    "skills",
    "README.md",
-    "LICENSE"
+    "LICENSE",
+    "native/windows/build/manifest.json",
+    "native/windows/build/rea-windows-x64.node",
+    "scripts/verify-windows-native-artifact.mjs"
  ],
  "scripts": {
    "deps:check": "node scripts/check-dependency-install.mjs",
@@ -73,7 +78,7 @@
    "precheck:test": "npm run deps:check",
    "check:test": "turbo run typecheck lint format:check knip metadata:check test:run",
    "precheck:pr": "npm run deps:check",
-    "check:pr": "turbo run typecheck lint format:check knip metadata:check test:run && npm run docs:check",
+    "check:pr": "turbo run typecheck lint format:check knip metadata:check test:run && npm run docs:check && npm run jscpd && npm run scan:todos",
    "precheck:ci": "npm run deps:check",
    "check:ci": "turbo run typecheck lint format:check knip metadata:check jscpd scan:todos",
    "build:cached": "turbo run build",
@@ -82,7 +87,6 @@
    "lint": "oxlint",
    "lint:fix": "oxlint --fix",
    "knip": "knip",
-    "lint:dead": "knip",
    "jscpd": "jscpd src/ tests/",
    "scan:todos": "node scripts/scan-todos.mjs",
    "start": "node scripts/rea.mjs mcp",
@@ -119,18 +123,27 @@
    "verify:native-ui": "npm run build:cached && node scripts/verify-native-ui.mjs",
    "verify:keyed-archive": "npm run build:cached && node scripts/verify-keyed-archive.mjs",
    "verify:ghidra": "npm run build:cached && node scripts/verify-real-ghidra.mjs",
+    "verify:ida": "npm run build:cached && node scripts/verify-real-ida.mjs",
    "verify:ghidra:switch": "npm run build:cached && node scripts/verify-real-ghidra-switch.mjs",
    "verify:ghidra:dos": "npm run build:cached && node scripts/verify-real-ghidra-dos.mjs",
+    "verify:ghidra:com": "npm run build:cached && node scripts/verify-real-ghidra-com.mjs",
    "verify:ghidra:aarch64-jump-table": "npm run build:cached && node scripts/verify-real-ghidra.mjs --aarch64-jump-table",
    "verify:interface-builder": "npm run build:cached && node scripts/verify-interface-builder.mjs",
    "verify:ghidra:cross-format": "npm run build:cached && node scripts/verify-real-ghidra.mjs --cross-format",
    "verify:ghidra:windows": "npm run build:cached && npm run build:ghidra-windows-fixture && node scripts/verify-real-ghidra-windows.mjs",
    "verify:browser": "npm run build:cached && node scripts/verify-real-browser.mjs",
+    "verify:browser:dom": "node scripts/verify-browser-dom-destinations.mjs",
+    "verify:browser:network": "npm run build:cached && node scripts/verify-browser-network.mjs",
    "verify:electron": "npm run build:cached && node scripts/verify-real-electron.mjs",
    "verify:inspector": "npm run build:cached && node scripts/verify-real-javascript-runtime-observation.mjs",
    "verify:javascript-runtime": "npm run build:cached && node scripts/verify-local-javascript-runtime.mjs",
+    "verify:javascript:digests": "npm run build:cached && node scripts/verify-large-javascript-digests.mjs",
    "verify:application-workflows": "npm run build:cached && node scripts/verify-local-application-workflows.mjs",
    "verify:managed": "npm run build:cached && node scripts/verify-managed-conformance.mjs",
+    "verify:firmware": "npm run build:cached && node scripts/verify-real-firmware.mjs",
+    "fixtures:firmware": "node scripts/generate-firmware-fixtures.mjs",
+    "verify:android": "npm run build:cached && node scripts/verify-real-android.mjs",
+    "fixtures:android": "node scripts/fetch-android-fixtures.mjs",
    "verify:agent": "npm run build:cached && node scripts/verify-agent-experience.mjs",
    "verify:hopper:linux": "npm run verify:fixtures && npm run build:cached && node scripts/verify-real-hopper-linux.mjs",
    "verify:setup:linux": "npm run build:cached && node scripts/verify-linux-setup-e2e.mjs",
@@ -145,8 +158,6 @@
    "config:print": "node scripts/print-mcp-config.mjs",
    "evidence:generate": "npm run build:cached && node scripts/generate-completion-ledger.mjs",
    "evidence:check": "npm run build:cached && node scripts/generate-completion-ledger.mjs --check",
-    "docs:api": "typedoc",
-    "docs:api:cached": "turbo run docs:api",
    "docs:generate": "node scripts/run-exclusive.mjs docs npm run docs:generate:unlocked",
    "docs:generate:unlocked": "npm run metadata:generate && npm run build:cached && node scripts/generate-mcp-tool-catalog.mjs && node scripts/generate-skill-metadata.mjs && node scripts/generate-product-catalog.mjs && node scripts/generate-completion-ledger.mjs && node scripts/generate-error-schema.mjs",
    "docs:check": "node scripts/run-exclusive.mjs docs turbo run docs:check:built",
@@ -156,7 +167,17 @@
    "prepare": "node scripts/prepare.mjs",
    "verify:asset-catalog": "npm run build:cached && node scripts/verify-asset-catalog.mjs",
    "verify:native-ui:permissions": "npm run build:cached && node scripts/verify-native-ui.mjs --allow-permission-denial",
-    "test:focused": "node scripts/run-development-tests.mjs focused"
+    "test:focused": "node scripts/run-development-tests.mjs focused",
+    "build:windows-native": "node scripts/build-windows-native.mjs",
+    "verify:windows-native:artifact": "node scripts/verify-windows-native-artifact.mjs",
+    "prepublishOnly": "npm run verify:windows-native:artifact",
+    "verify:windows-native": "node scripts/verify-windows-native.mjs",
+    "verify:ghidra:windows:package": "node scripts/verify-packaged-ghidra-windows.mjs",
+    "build:ghidra:nativeaot": "node scripts/build-ghidra-nativeaot.mjs",
+    "build:fixtures:nativeaot": "node scripts/generate-nativeaot-fixtures.mjs",
+    "verify:ghidra:nativeaot": "npm run build:cached && node scripts/verify-real-ghidra-nativeaot.mjs",
+    "verify:browser:scripts": "npm run build:cached && node scripts/verify-browser-scripts.mjs",
+    "verify:test-discovery": "node scripts/verify-test-discovery.mjs"
  },
  "lint-staged": {
    "*.{cjs,cts,js,jsx,mjs,mts,ts,tsx}": [
@@ -172,48 +193,45 @@
    "@electron/asar": "4.2.0",
    "@jridgewell/trace-mapping": "0.3.31",
    "@lydell/node-pty": "1.1.0",
-    "@modelcontextprotocol/client": "2.0.0",
-    "@modelcontextprotocol/server": "2.0.0",
+    "@modelcontextprotocol/client": "2.3.1",
+    "@modelcontextprotocol/server": "2.3.1",
    "@xterm/addon-serialize": "0.14.0",
    "@xterm/headless": "6.0.0",
    "@zip.js/zip.js": "2.8.26",
    "canonicalize": "3.0.0",
    "cross-spawn": "7.0.6",
    "diff": "9.0.0",
-    "graphology": "0.26.0",
-    "graphology-shortest-path": "2.1.0",
    "ignore": "7.0.6",
-    "incur": "0.4.13",
+    "incur": "0.6.1",
    "isomorphic-git": "1.38.7",
    "jsonc-parser": "3.3.1",
-    "pino": "9.14.0",
+    "pino": "10.4.0",
    "playwright-core": "1.58.2",
    "plist": "5.0.0",
    "semver": "7.8.5",
-    "smol-toml": "^1.7.0",
+    "smol-toml": "1.7.0",
    "write-file-atomic": "7.0.0",
    "ws": "8.21.0",
    "zod": "4.4.3"
  },
  "devDependencies": {
-    "@fast-check/vitest": "0.4.1",
+    "@fast-check/vitest": "0.5.0",
    "@types/cross-spawn": "6.0.6",
-    "@types/node": "24.10.1",
+    "@types/node": "26.6.4",
    "@types/semver": "7.7.1",
    "@types/write-file-atomic": "4.0.3",
    "@types/ws": "8.18.1",
-    "@vitest/coverage-v8": "4.1.10",
+    "@vitest/coverage-v8": "5.0.3",
    "ajv": "8.20.0",
    "husky": "9.1.7",
    "jscpd": "5.0.12",
-    "knip": "6.26.0",
+    "knip": "6.39.0",
    "lint-staged": "16.4.0",
    "oxfmt": "0.72.0",
-    "oxlint": "1.73.0",
-    "turbo": "2.10.5",
-    "typedoc": "0.28.20",
-    "typescript": "5.9.3",
-    "vitest": "4.1.10",
+    "oxlint": "1.87.0",
+    "turbo": "2.11.7",
+    "typescript": "7.0.2",
+    "vitest": "5.0.3",
    "yaml": "2.9.0"
  }
 }
@@ -21,6 +21,7 @@
        { "type": "generic", "path": "README_ja.md" },
        { "type": "generic", "path": "README_ko.md" },
        { "type": "generic", "path": "README_ar.md" },
+        { "type": "generic", "path": "docs/installation.md" },
        {
          "type": "generic",
          "path": "src/generatedPackageMetadata.ts"
@@ -0,0 +1,140 @@
+#!/usr/bin/env node
+import { spawnSync } from "node:child_process";
+import { createHash } from "node:crypto";
+import {
+  mkdir,
+  mkdtemp,
+  readdir,
+  readFile,
+  rm,
+  writeFile,
+} from "node:fs/promises";
+import { dirname, join, resolve } from "node:path";
+import { fileURLToPath } from "node:url";
+
+const root = resolve(dirname(fileURLToPath(import.meta.url)), "..");
+const source = resolve(
+  process.env.REA_NATIVEAOT_SOURCE ??
+    join(root, "third_party/ghidra-nativeaot"),
+);
+const install = process.env.GHIDRA_INSTALL_DIR;
+if (!install)
+  throw new Error(
+    "NativeAOT build lane requires existing GHIDRA_INSTALL_DIR (Ghidra 12.1.4).",
+  );
+const properties = await readFile(
+  join(install, "Ghidra/application.properties"),
+  "utf8",
+);
+if (!/^application.version=12\.1\.4\s*$/m.test(properties))
+  throw new Error("NativeAOT build lane requires Ghidra 12.1.4.");
+const output = resolve(
+  process.env.REA_NATIVEAOT_BUILD_ROOT ??
+    join(root, "_reference/nativeaot-integration/extension"),
+);
+const java = process.env.JAVA_HOME ? join(process.env.JAVA_HOME, "bin") : null;
+const run = (command, args) => {
+  const result = spawnSync(command, args, {
+    cwd: root,
+    encoding: "utf8",
+    timeout: 120_000,
+    maxBuffer: 4 * 1024 * 1024,
+  });
+  if (result.error || result.status !== 0)
+    throw new Error(
+      `NativeAOT build prerequisite/action ${command} failed: ${result.error?.message ?? ""}\n${result.stdout ?? ""}${result.stderr ?? ""}`,
+    );
+  return result.stdout.trim();
+};
+const javac = java ? join(java, "javac") : "javac";
+if (!/^javac 21(?:\.|$)/u.test(run(javac, ["-version"])))
+  throw new Error(
+    "NativeAOT build lane requires an existing JDK 21 javac; REA does not install or upgrade Java.",
+  );
+const revision = run("git", ["-C", source, "rev-parse", "HEAD"]);
+if (
+  revision !== "effeb734fc570c32650f88b159608979dc7b423e" ||
+  run("git", ["-C", source, "status", "--porcelain"])
+)
+  throw new Error(
+    "NativeAOT build requires the clean pinned upstream source; initialize third_party/ghidra-nativeaot.",
+  );
+const files = async (path, extension) => {
+  const result = [];
+  for (const entry of await readdir(path, { withFileTypes: true })) {
+    const child = join(path, entry.name);
+    if (entry.isDirectory()) result.push(...(await files(child, extension)));
+    else if (entry.isFile() && child.endsWith(extension)) result.push(child);
+  }
+  return result.sort();
+};
+await mkdir(output, { recursive: true });
+const classes = await mkdtemp(join(output, "classes-"));
+try {
+  const sources = [
+    ...(await files(join(source, "src/main/java"), ".java")),
+    ...(await files(join(root, "bridge/ghidra/extensions/nativeaot"), ".java")),
+  ];
+  const jars = await files(join(install, "Ghidra"), ".jar");
+  const args = [
+    "-proc:none",
+    "-cp",
+    jars.join(process.platform === "win32" ? ";" : ":"),
+    "-d",
+    classes,
+    ...sources,
+  ];
+  await writeFile(
+    join(output, "javac.args"),
+    args
+      .map((s) => `"${s.replaceAll("\\", "\\\\").replaceAll('"', '\\"')}"`)
+      .join("\n"),
+  );
+  run(javac, [
+    "-J-Xmx512m",
+    "-J-XX:ActiveProcessorCount=1",
+    `@${join(output, "javac.args")}`,
+  ]);
+  await writeFile(
+    join(classes, "LICENSE-ghidra-nativeaot.md"),
+    await readFile(join(source, "LICENSE.md")),
+  );
+  const jar = join(output, "rea-ghidra-nativeaot.jar");
+  run(java ? join(java, "jar") : "jar", [
+    "--create",
+    "--file",
+    jar,
+    "--date=2025-01-01T00:00:00Z",
+    "-C",
+    classes,
+    ".",
+  ]);
+  const sha256 = createHash("sha256")
+    .update(await readFile(jar))
+    .digest("hex");
+  await writeFile(
+    join(output, "build.json"),
+    JSON.stringify(
+      {
+        jar,
+        sha256,
+        upstream_revision: revision,
+        ghidra_version: "12.1.4",
+        integration_api: 1,
+      },
+      null,
+      2,
+    ) + "\n",
+  );
+  console.log(
+    JSON.stringify({
+      jar,
+      sha256,
+      upstream_revision: revision,
+      ghidra_version: "12.1.4",
+      integration_api: 1,
+    }),
+  );
+} finally {
+  await rm(classes, { recursive: true, force: true });
+}
@@ -0,0 +1,150 @@
+#!/usr/bin/env node
+
+import { createHash } from "node:crypto";
+import { spawnSync } from "node:child_process";
+import { access, mkdir, readFile, writeFile } from "node:fs/promises";
+import { homedir } from "node:os";
+import { dirname, join } from "node:path";
+import { fileURLToPath } from "node:url";
+
+const root = join(dirname(fileURLToPath(import.meta.url)), "..");
+const nodeVersion = "22.19.0";
+const compiler = "x86_64-w64-mingw32-g++";
+const cache = join(homedir(), ".cache", "rea-windows-native");
+const output = join(root, "native", "windows", "build");
+const run = (command, args) => {
+  const result = spawnSync(command, args, {
+    cwd: root,
+    encoding: "utf8",
+    maxBuffer: 4 * 1_024 * 1_024,
+    timeout: 120_000,
+  });
+  if (result.error !== undefined)
+    throw new Error(
+      `Windows native build lane requires ${command}: ${result.error.message}`,
+    );
+  if (result.status !== 0)
+    throw new Error(
+      `Windows native build failed: ${result.stdout}${result.stderr}`,
+    );
+  return result.stdout;
+};
+if (process.platform !== "linux")
+  throw new Error(
+    "The Windows x64 artifact build lane currently requires Linux and MinGW-w64.",
+  );
+run(compiler, ["--version"]);
+await mkdir(cache, { recursive: true });
+await mkdir(output, { recursive: true });
+const exists = async (path) =>
+  access(path).then(
+    () => true,
+    () => false,
+  );
+const fetchBytes = async (name) => {
+  const response = await fetch(
+    `https://nodejs.org/dist/v${nodeVersion}/${name}`,
+    {
+      signal: AbortSignal.timeout(60_000),
+    },
+  );
+  if (!response.ok)
+    throw new Error(
+      `Node build prerequisite download failed: ${name}: HTTP ${response.status}`,
+    );
+  return Buffer.from(await response.arrayBuffer());
+};
+const checksums = (await fetchBytes("SHASUMS256.txt")).toString("utf8");
+const verifiedDownload = async (name, path) => {
+  if (!(await exists(path))) await writeFile(path, await fetchBytes(name));
+  const digest = createHash("sha256")
+    .update(await readFile(path))
+    .digest("hex");
+  const expected = checksums
+    .split("\n")
+    .find((line) => line.slice(66) === name)
+    ?.slice(0, 64);
+  if (expected === undefined || digest !== expected)
+    throw new Error(`Node build prerequisite SHA-256 mismatch: ${name}`);
+};
+const cachedHeaders = join(
+  homedir(),
+  ".cache",
+  "node-gyp",
+  nodeVersion,
+  "include",
+  "node",
+);
+let headers = cachedHeaders;
+if (!(await exists(join(headers, "node_api.h")))) {
+  const archive = join(cache, `node-v${nodeVersion}-headers.tar.gz`);
+  await verifiedDownload(`node-v${nodeVersion}-headers.tar.gz`, archive);
+  run("tar", ["xzf", archive, "-C", cache]);
+  headers = join(cache, `node-v${nodeVersion}`, "include", "node");
+}
+const artifact = "rea-windows-x64.node";
+// MSVC short-import libraries do not produce a correct Node import table with
+// GNU ld. Generate a GNU import library for the exact stable Node-API symbols.
+const sources = ["addon.cc", "filesystem.cc", "process.cc"];
+const sourceText = (
+  await Promise.all(
+    sources.map((path) =>
+      readFile(join(root, "native", "windows", "src", path), "utf8"),
+    ),
+  )
+).join("\n");
+const symbols = [
+  ...new Set(
+    [...sourceText.matchAll(/\b(napi_[a-z0-9_]+)\s*\(/gu)].map(
+      (match) => match[1],
+    ),
+  ),
+].sort();
+const definition = join(cache, "node-api.def");
+const library = join(cache, "libnode-api.a");
+await writeFile(
+  definition,
+  `LIBRARY node.exe\nEXPORTS\n${symbols.join("\n")}\n`,
+);
+run("x86_64-w64-mingw32-dlltool", ["-d", definition, "-l", library]);
+run(compiler, [
+  "-std=c++17",
+  "-O2",
+  "-DNAPI_VERSION=8",
+  "-D_WIN32_WINNT=0x0A00",
+  "-shared",
+  "-static",
+  "-static-libgcc",
+  "-static-libstdc++",
+  "-Wl,--no-insert-timestamp",
+  `-I${headers}`,
+  "native/windows/src/addon.cc",
+  "native/windows/src/filesystem.cc",
+  "native/windows/src/process.cc",
+  library,
+  "-ladvapi32",
+  "-lbcrypt",
+  "-lntdll",
+  "-o",
+  join(output, artifact),
+]);
+const packageJson = JSON.parse(
+  await readFile(join(root, "package.json"), "utf8"),
+);
+const bytes = await readFile(join(output, artifact));
+const metadata = {
+  packageVersion: packageJson.version,
+  platform: "win32",
+  architecture: "x64",
+  abiVersion: 1,
+  nodeApiVersion: 8,
+  artifact,
+  artifactSha256: createHash("sha256").update(bytes).digest("hex"),
+};
+await writeFile(
+  join(output, "manifest.json"),
+  `${JSON.stringify(metadata, null, 2)}\n`,
+);
+process.stdout.write(
+  `${JSON.stringify({ ...metadata, artifactBytes: bytes.length })}\n`,
+);
@@ -0,0 +1,70 @@
+import { createHash, randomUUID } from "node:crypto";
+import { createReadStream } from "node:fs";
+import { link, mkdir, open, rm } from "node:fs/promises";
+import { resolve, join } from "node:path";
+import { fileURLToPath } from "node:url";
+import { JADX_RELEASE } from "../src/android/JadxRelease.ts";
+import fixture from "./fixtures/android-apidemos.json" with { type: "json" };
+
+const args = process.argv.slice(2);
+if (args.length > 1)
+  throw new Error("Usage: node scripts/fetch-android-fixtures.mjs [DIRECTORY]");
+const directory = resolve(
+  args[0] ??
+    fileURLToPath(new URL("../_reference/apk-integration/", import.meta.url)),
+);
+await mkdir(directory, { recursive: true });
+const hashFile = async (path) => {
+  const hash = createHash("sha256");
+  for await (const chunk of createReadStream(path)) hash.update(chunk);
+  return hash.digest("hex");
+};
+for (const item of [
+  {
+    url: JADX_RELEASE.url,
+    sha256: JADX_RELEASE.sha256,
+    filename: "jadx-headless-mcp-0.7.1-all.jar",
+  },
+  fixture,
+]) {
+  const path = join(directory, item.filename);
+  try {
+    const digest = await hashFile(path);
+    if (digest !== item.sha256)
+      throw new Error(
+        `Existing ${path} has a different SHA-256; it was not overwritten`,
+      );
+    console.log(`Verified existing ${path}: ${digest}`);
+    continue;
+  } catch (cause) {
+    if (!(cause instanceof Error && "code" in cause && cause.code === "ENOENT"))
+      throw cause;
+  }
+  const temporary = `${path}.${randomUUID()}.partial`;
+  try {
+    const response = await fetch(item.url, {
+      signal: AbortSignal.timeout(120_000),
+    });
+    if (!response.ok || response.body === null)
+      throw new Error(`Download failed: ${item.url}: HTTP ${response.status}`);
+    const handle = await open(temporary, "wx", 0o600);
+    const hash = createHash("sha256");
+    try {
+      for await (const chunk of response.body) {
+        hash.update(chunk);
+        await handle.writeFile(chunk);
+      }
+    } finally {
+      await handle.close();
+    }
+    const digest = hash.digest("hex");
+    if (digest !== item.sha256)
+      throw new Error(
+        `SHA-256 mismatch for ${item.filename}: expected ${item.sha256}, received ${digest}`,
+      );
+    await link(temporary, path);
+    console.log(`Downloaded and verified ${path}: ${digest}`);
+  } finally {
+    await rm(temporary, { force: true });
+  }
+}
@@ -0,0 +1,14 @@
+{
+  "name": "Appium ApiDemos",
+  "version": "6.0.18",
+  "source": "https://github.com/appium/android-apidemos",
+  "source_revision": "3e716ee04ef3390284bfab761e28da8c15c08143",
+  "license": "Apache-2.0",
+  "license_url": "https://github.com/appium/android-apidemos/blob/3e716ee04ef3390284bfab761e28da8c15c08143/LICENSE",
+  "url": "https://github.com/appium/android-apidemos/releases/download/v6.0.18/ApiDemos-debug.apk",
+  "filename": "ApiDemos-debug.apk",
+  "sha256": "a9eecf37b26cd084855c530db81c2bb1b91f4c1b095a04f47aa7c20e2791f686",
+  "package": "io.appium.android.apis",
+  "class_name": "io.appium.android.apis.ApiDemos",
+  "method_name": "onCreate"
+}
@@ -0,0 +1,109 @@
+import { once } from "node:events";
+import { createServer } from "node:http";
+import { gzipSync } from "node:zlib";
+
+export const networkFixtureSecret = "私密-network-fixture";
+export const networkFixtureBinary = Buffer.from([0xff, 0, 0xfe, 1]);
+export const networkFixtureDecoded = Buffer.from("decoded-response-marker");
+
+const html = `<!doctype html><meta charset="utf-8"><body><button id="start">Run</button><main id="done" hidden>Done</main>
+<script>document.querySelector('#start').onclick = async () => {
+  const send = marker => fetch('/same', {method:'POST', headers:{
+    'Content-Type':'application/json', 'Authorization':'Bearer transport-only', 'X-Marker': marker
+  }, body:JSON.stringify({marker, password:'ordinary-selected-value', declared:'${networkFixtureSecret}'})}).then(r=>r.text());
+  await Promise.all([send('slow'),send('fast'),fetch('/redirect').then(r=>r.text()),
+    fetch('/binary').then(r=>r.arrayBuffer()),fetch('/compressed').then(r=>r.text()),
+    fetch('/empty').then(r=>r.text()),
+    fetch('/form', {method:'POST', body:new URLSearchParams({declared:'${networkFixtureSecret}'})}).then(r=>r.text())]);
+  await fetch('/stream');
+  document.querySelector('#done').hidden=false;
+};</script>`;
+
+/** Start an isolated fixture with concurrent, redirected, binary, and streaming responses. */
+export async function startBrowserNetworkSite() {
+  const counts = new Map();
+  const timers = new Set();
+  const server = createServer(async (request, response) => {
+    const path = new URL(request.url, "http://fixture.test").pathname;
+    counts.set(path, (counts.get(path) ?? 0) + 1);
+    if (path === "/same") {
+      const chunks = [];
+      for await (const chunk of request) chunks.push(chunk);
+      const body = JSON.parse(Buffer.concat(chunks).toString());
+      const timer = setTimeout(
+        () => {
+          timers.delete(timer);
+          response.writeHead(200, [
+            "Content-Type",
+            "application/json",
+            "X-Repeat",
+            "first",
+            "X-Repeat",
+            "second",
+            "Set-Cookie",
+            "fixture_session=transport-cookie; HttpOnly",
+            "X-Declared",
+            encodeURIComponent(networkFixtureSecret),
+          ]);
+          response.end(
+            JSON.stringify({
+              marker: body.marker,
+              password: body.password,
+              declared: body.declared,
+            }),
+          );
+        },
+        body.marker === "slow" ? 120 : 5,
+      );
+      timers.add(timer);
+    } else if (path === "/redirect") {
+      response.writeHead(302, { Location: "/landing" });
+      response.end();
+    } else if (path === "/landing") {
+      response.end("redirect-target");
+    } else if (path === "/form") {
+      const chunks = [];
+      for await (const chunk of request) chunks.push(chunk);
+      response.end(
+        new URLSearchParams(Buffer.concat(chunks).toString()).get("declared"),
+      );
+    } else if (path === "/binary") {
+      response.writeHead(200, { "Content-Type": "application/octet-stream" });
+      response.end(networkFixtureBinary);
+    } else if (path === "/compressed") {
+      response.writeHead(200, {
+        "Content-Type": "text/plain",
+        "Content-Encoding": "gzip",
+      });
+      response.end(gzipSync(networkFixtureDecoded));
+    } else if (path === "/empty") {
+      response.writeHead(204);
+      response.end();
+    } else if (path === "/stream") {
+      response.writeHead(200, { "Content-Type": "text/event-stream" });
+      response.write("data: still-open\n\n");
+    } else if (path === "/favicon.ico") {
+      response.writeHead(204);
+      response.end();
+    } else {
+      response.writeHead(200, { "Content-Type": "text/html; charset=utf-8" });
+      response.end(html);
+    }
+  });
+  server.listen(0, "127.0.0.1");
+  await once(server, "listening");
+  const address = server.address();
+  if (typeof address !== "object" || address === null)
+    throw new Error("Network fixture has no TCP address");
+  return {
+    origin: `http://127.0.0.1:${address.port}`,
+    counts,
+    async close() {
+      for (const timer of timers) clearTimeout(timer);
+      server.closeAllConnections();
+      await new Promise((resolve, reject) =>
+        server.close((error) => (error ? reject(error) : resolve())),
+      );
+    },
+  };
+}
@@ -0,0 +1,49 @@
+import { createServer } from "node:http";
+
+/** Independently authored modules and competing query variants for export verification. */
+export async function startBrowserScriptSite() {
+  const assets = new Map([
+    [
+      "/app/main.js",
+      "import { sourceMarker } from './lib/dep.js'; export const result = sourceMarker; document.body.dataset.ready = 'true';\n",
+    ],
+    [
+      "/app/lib/dep.js",
+      "export const sourceMarker = 'independent-source-marker';\n",
+    ],
+    ["/variant.js?v=1", "globalThis.variantOne = 'query-variant-one';\n"],
+    ["/variant.js?v=2", "globalThis.variantTwo = 'query-variant-two';\n"],
+  ]);
+  const counts = new Map();
+  const server = createServer((request, response) => {
+    counts.set(request.url, (counts.get(request.url) ?? 0) + 1);
+    const source = assets.get(request.url);
+    if (source !== undefined) {
+      response.setHeader("content-type", "text/javascript; charset=utf-8");
+      response.end(source);
+      return;
+    }
+    response.setHeader("content-type", "text/html; charset=utf-8");
+    response.end(
+      '<!doctype html><html><body><script src="/variant.js?v=1"></script><script src="/variant.js?v=2"></script><script type="module" src="/app/main.js"></script></body></html>',
+    );
+  });
+  await new Promise((resolve, reject) => {
+    server.once("error", reject);
+    server.listen(0, "127.0.0.1", resolve);
+  });
+  const address = server.address();
+  if (address === null || typeof address === "string")
+    throw new Error("Script fixture did not bind a port");
+  return {
+    origin: `http://127.0.0.1:${address.port}`,
+    assets,
+    counts,
+    close: () =>
+      new Promise((resolve, reject) =>
+        server.close((cause) =>
+          cause === undefined ? resolve() : reject(cause),
+        ),
+      ),
+  };
+}
@@ -52,8 +52,12 @@ export async function startBrowserVerifierSite() {
      return;
    }
    response.setHeader("content-type", "text/html");
+    response.setHeader("set-cookie", [
+      "rea-root-cookie=root-fixture; Path=/; SameSite=Lax",
+      "rea-app-cookie=app-fixture; Path=/app; SameSite=Lax",
+    ]);
    response.end(
-      '<!doctype html><html><head><title>REA browser verifier</title></head><body><main><h1>Browser evidence</h1><button aria-label="ax-private-label-value">Verify</button></main><script type="module" src="/app.js?token=script-query-secret"></script></body></html>',
+      '<!doctype html><html><head><title>REA browser verifier</title><base href="assets/"></head><body><main><h1>Browser evidence</h1><a href="guide">Guide</a><button aria-label="ax-private-label-value">Verify</button><form action=""></form><form action=" "></form><button formaction=""></button><input formaction=""></main><script type="module" src="/app.js?token=script-query-secret"></script></body></html>',
    );
  });
  const webSockets = new WebSocketServer({ noServer: true });
@@ -0,0 +1,42 @@
+import { execFile } from "node:child_process";
+import { resolve } from "node:path";
+import { fileURLToPath } from "node:url";
+import { promisify } from "node:util";
+
+const exec = promisify(execFile);
+const root = resolve(
+  process.env.REA_FIRMWARE_FIXTURE_ROOT ??
+    "_reference/firmware-integration/generated",
+);
+for (const [command, args, purpose] of [
+  [
+    process.env.REA_FIRMWARE_PYTHON ?? "python3",
+    ["--version"],
+    "Python 3 standard-library fixture generator",
+  ],
+  [
+    process.env.REA_FIRMWARE_CC ?? "cc",
+    ["--version"],
+    "host ELF fixture compiler",
+  ],
+]) {
+  try {
+    await exec(command, args);
+  } catch (cause) {
+    throw new Error(`fixtures:firmware requires ${purpose}: ${command}`, {
+      cause,
+    });
+  }
+}
+const ext4 =
+  process.env.REA_FIRMWARE_VERIFY_EXT4 === "1"
+    ? [process.env.REA_FIRMWARE_MKE2FS_COMMAND ?? "mke2fs"]
+    : [];
+for (const command of ext4) await exec(command, ["-V"]);
+const generated = await exec(process.env.REA_FIRMWARE_PYTHON ?? "python3", [
+  fileURLToPath(new URL("./lib/generate-firmware-fixture.py", import.meta.url)),
+  root,
+  process.env.REA_FIRMWARE_CC ?? "cc",
+  ...ext4,
+]);
+console.log(generated.stdout.trim());
@@ -109,6 +109,8 @@ const canonicalizeJson = (value) => {

 const payloadJson = JSON.stringify(
  canonicalizeJson({ catalog, auxiliaryProviders }),
+  null,
+  2,
 );
 const source = await formatGeneratedFile(
  "src/generatedMcpToolCatalog.ts",
@@ -0,0 +1,188 @@
+#!/usr/bin/env node
+import { spawnSync } from "node:child_process";
+import { createHash } from "node:crypto";
+import { copyFile, mkdir, readFile, writeFile } from "node:fs/promises";
+import { dirname, join, resolve } from "node:path";
+import { fileURLToPath } from "node:url";
+
+const root = resolve(dirname(fileURLToPath(import.meta.url)), "..");
+if (process.arch !== "x64" || !["linux", "win32"].includes(process.platform))
+  throw new Error(
+    "NativeAOT fixture lane requires Linux or Windows x64; it does not cross-compile NativeAOT.",
+  );
+const runtime = process.platform === "win32" ? "win-x64" : "linux-x64";
+const directory = resolve(
+  process.env.REA_NATIVEAOT_FIXTURE_ROOT ??
+    join(root, "_reference/nativeaot-integration/generated"),
+);
+const output = join(directory, runtime);
+await mkdir(output, { recursive: true });
+const env = {
+  ...process.env,
+  DOTNET_CLI_HOME: join(output, "cli-home"),
+  DOTNET_CLI_TELEMETRY_OPTOUT: "1",
+  DOTNET_SKIP_FIRST_TIME_EXPERIENCE: "1",
+  DOTNET_PROCESSOR_COUNT: "1",
+  COMPlus_GCHeapHardLimit: "30000000",
+  NUGET_PACKAGES: process.env.NUGET_PACKAGES ?? join(directory, "nuget"),
+};
+await writeFile(
+  join(output, "global.json"),
+  JSON.stringify({ sdk: { version: "8.0.416", rollForward: "disable" } }) +
+    "\n",
+);
+const run = (command, args) => {
+  const result = spawnSync(command, args, {
+    cwd: output,
+    env,
+    encoding: "utf8",
+    timeout: 300_000,
+    maxBuffer: 8 * 1024 * 1024,
+  });
+  if (result.error || result.status !== 0)
+    throw new Error(
+      `NativeAOT fixture lane requires/action failed ${command}: ${result.error?.message ?? ""}\n${result.stdout ?? ""}${result.stderr ?? ""}`,
+    );
+  return result.stdout;
+};
+const dotnet = process.env.REA_NATIVEAOT_DOTNET ?? "dotnet";
+if (run(dotnet, ["--version"]).trim() !== "8.0.416")
+  throw new Error(
+    "NativeAOT fixtures require existing .NET SDK 8.0.416; REA does not install SDKs.",
+  );
+if (process.platform === "linux") {
+  run(process.env.REA_NATIVEAOT_STRIP ?? "strip", ["--version"]);
+  run(process.env.REA_NATIVEAOT_NM ?? "nm", ["--version"]);
+  run(process.env.REA_NATIVEAOT_CC ?? "cc", ["--version"]);
+  run("clang", ["--version"]);
+}
+const map = join(output, "NativeAotFixture.map");
+run(dotnet, [
+  "publish",
+  join(root, "tests/fixtures/nativeaot/NativeAotFixture.csproj"),
+  "-r",
+  runtime,
+  "-c",
+  "Release",
+  "-o",
+  join(output, "symbols"),
+  "--maxcpucount:1",
+  `-p:BaseIntermediateOutputPath=${join(output, "obj")}/`,
+  `-p:BaseOutputPath=${join(output, "bin")}/`,
+  `-p:NativeAotMapPath=${map}`,
+]);
+const name =
+  process.platform === "win32" ? "NativeAotFixture.exe" : "NativeAotFixture";
+const binary = join(output, "symbols", name);
+let symbols = "";
+if (process.platform === "linux") {
+  // Preserve the symbol table as an independent oracle while avoiding a full
+  // runtime DWARF import in this metadata-specific lane.
+  run(process.env.REA_NATIVEAOT_STRIP ?? "strip", ["--strip-debug", binary]);
+  symbols = run(process.env.REA_NATIVEAOT_NM ?? "nm", ["-n", binary]);
+  await mkdir(join(output, "stripped"), { recursive: true });
+  const stripped = join(output, "stripped", name);
+  await copyFile(binary, stripped);
+  run(process.env.REA_NATIVEAOT_STRIP ?? "strip", ["--strip-all", stripped]);
+} else {
+  symbols = await readFile(map, "utf8");
+}
+const bytes = await readFile(binary);
+const candidates = [];
+for (let offset = 0; offset <= bytes.length - 16; offset++) {
+  if (
+    bytes.readUInt32LE(offset) !== 0x00525452 ||
+    bytes[offset + 14] !== 24 ||
+    bytes[offset + 15] !== 1
+  )
+    continue;
+  const count = bytes.readUInt16LE(offset + 12);
+  if (count === 0 || count > 80 || offset + 16 + count * 24 > bytes.length)
+    continue;
+  candidates.push({
+    offset,
+    major: bytes.readUInt16LE(offset + 4),
+    minor: bytes.readUInt16LE(offset + 6),
+    sections: Array.from({ length: count }, (_, index) => {
+      const row = offset + 16 + index * 24;
+      return {
+        type: bytes.readUInt32LE(row),
+        flags: bytes.readUInt32LE(row + 4),
+        start: `0x${bytes.readBigUInt64LE(row + 8).toString(16)}`,
+        end: `0x${bytes.readBigUInt64LE(row + 16).toString(16)}`,
+      };
+    }),
+  });
+}
+if (
+  candidates.length !== 1 ||
+  candidates[0].major !== 9 ||
+  candidates[0].minor !== 1
+)
+  throw new Error(
+    "NativeAOT fixture did not produce exactly one independent RTR 9.1 directory.",
+  );
+const sha256 = createHash("sha256").update(bytes).digest("hex");
+await writeFile(join(output, "symbols.txt"), symbols);
+await writeFile(
+  join(output, "oracle.json"),
+  JSON.stringify(
+    {
+      sdk: "8.0.416",
+      runtime_version: "8.0.22",
+      runtime,
+      binary,
+      sha256,
+      headers: candidates,
+      expected_strings: [
+        "REA_NATIVEAOT_FROZEN",
+        "REA_NATIVEAOT_BASE",
+        "REA_NATIVEAOT_DERIVED",
+      ],
+    },
+    null,
+    2,
+  ) + "\n",
+);
+// A source-built negative input, not a downloaded third-party target.
+if (process.platform === "linux") {
+  const source = join(output, "ordinary.c");
+  await writeFile(
+    source,
+    "int ordinary_probe(int x) { return x * 3 + 1; }\nint main(void) { return ordinary_probe(1); }\n",
+  );
+  run(process.env.REA_NATIVEAOT_CC ?? "cc", [
+    "-g",
+    "-O0",
+    source,
+    "-o",
+    join(output, "ordinary"),
+  ]);
+  // Small source-built producer regressions run in seconds: no executable
+  // patching, large runtime import, or downloaded opaque negative inputs.
+  const row = "struct Row { unsigned type, flags; const char *start, *end; };";
+  const header =
+    "struct Header { unsigned signature; unsigned short major, minor; unsigned flags; unsigned short count; unsigned char size, type; struct Row row; };";
+  for (const kind of ["unsupported", "malformed", "ambiguous"]) {
+    const major = kind === "unsupported" ? 99 : 9;
+    const declaration = `const struct Header __attribute__((aligned(8))) probe = {0x00525452, ${major}, 1, 0, 1, 24, 1, {207, 1, data + 8, data}};`;
+    const extra =
+      kind === "ambiguous" ? declaration.replace("probe", "second_probe") : "";
+    const negative = join(output, `${kind}.c`);
+    await writeFile(
+      negative,
+      `${row}\n${header}\nconst char data[16] = {0};\n${declaration}\n${extra}\nint main(void) { return 0; }\n`,
+    );
+    run(process.env.REA_NATIVEAOT_CC ?? "cc", [
+      "-O0",
+      "-fno-pie",
+      "-no-pie",
+      negative,
+      "-o",
+      join(output, kind),
+    ]);
+  }
+}
+console.log(
+  `PASS source-built ${runtime} NativeAOT fixture, independent RTR 9.1 oracle and SHA-256 ${sha256}; no target execution`,
+);
@@ -0,0 +1,120 @@
+import assert from "node:assert/strict";
+import { spawn } from "node:child_process";
+import {
+  cleanupOwnedProcessGroup,
+  readProcessRunId,
+} from "../../dist/process/ProcessOwnership.js";
+
+/** Exercise a real CLI signal while the owned Java engine is still running. */
+export const verifyAndroidCliCancellation = async ({
+  entrypoint,
+  environment,
+  path,
+  repository,
+  execute,
+}) => {
+  const child = spawn(
+    process.execPath,
+    [entrypoint, "inspect-android-package", path, "--format", "json"],
+    { cwd: repository, env: environment, stdio: ["ignore", "pipe", "pipe"] },
+  );
+  let stdout = "";
+  let stderr = "";
+  child.stdout.on("data", (chunk) => {
+    stdout += chunk.toString();
+  });
+  child.stderr.on("data", (chunk) => {
+    stderr += chunk.toString();
+  });
+  const exited = new Promise((resolve, reject) => {
+    child.once("error", reject);
+    child.once("exit", (code, signal) => resolve({ code, signal }));
+  });
+  let group;
+  let ownership;
+  try {
+    const deadline = Date.now() + 30_000;
+    while (Date.now() < deadline) {
+      const table = (
+        await execute("ps", ["-eo", "pid=,ppid=,pgid=,args="], {
+          timeout: 5_000,
+          maxBuffer: 2 * 1024 * 1024,
+        })
+      ).stdout;
+      for (const row of table.split("\n")) {
+        const entry = /^\s*(\d+)\s+(\d+)\s+(\d+)\s+(.*)$/u.exec(row);
+        if (
+          entry !== null &&
+          Number(entry[2]) === child.pid &&
+          entry[4].includes("engine.jar") &&
+          entry[4].includes("-Xmx512m")
+        ) {
+          group = Number(entry[3]);
+          const runId = await readProcessRunId(Number(entry[1]));
+          assert.ok(
+            runId !== undefined,
+            "Owned Java process did not carry an identity token",
+          );
+          ownership = {
+            runId,
+            leaderPid: Number(entry[1]),
+            processGroupId: group,
+          };
+        }
+      }
+      if (group !== undefined) break;
+      if (child.exitCode !== null || child.signalCode !== null)
+        throw new Error(
+          `CLI exited before acquiring JADX: ${stdout}\n${stderr}`,
+        );
+      await new Promise((resolve) => setTimeout(resolve, 100));
+    }
+    assert.ok(
+      group !== undefined,
+      "CLI did not acquire the expected owned Java group",
+    );
+    child.kill("SIGTERM");
+    let timer;
+    const result = await Promise.race([
+      exited,
+      new Promise((_, reject) => {
+        timer = setTimeout(
+          () => reject(new Error("CLI cancellation did not finish cleanup")),
+          10_000,
+        );
+      }),
+    ]).finally(() => clearTimeout(timer));
+    assert.equal(result.code, 143, `${stdout}\n${stderr}`);
+    assert.equal(result.signal, null);
+    assert.equal(JSON.parse(stdout).code, "cancelled");
+    assert.throws(() => process.kill(-group, 0), { code: "ESRCH" });
+    console.log(
+      "PASS real CLI SIGTERM cancellation and owned Java group cleanup",
+    );
+  } finally {
+    await cleanupCancellation(child, exited, ownership);
+  }
+};
+
+const cleanupCancellation = async (child, exited, ownership) => {
+  if (child.exitCode === null && child.signalCode === null) {
+    child.kill("SIGTERM");
+    let timer;
+    await Promise.race([
+      exited,
+      new Promise((resolve) => {
+        timer = setTimeout(resolve, 2_000);
+      }),
+    ]).finally(() => clearTimeout(timer));
+    if (child.exitCode === null && child.signalCode === null) {
+      child.kill("SIGKILL");
+      await exited;
+    }
+  }
+  if (ownership !== undefined)
+    assert.equal(
+      (await cleanupOwnedProcessGroup(ownership)).cleaned,
+      true,
+      "Verifier could not confirm its owned Java group cleanup",
+    );
+};
@@ -0,0 +1,60 @@
+import assert from "node:assert/strict";
+import { execFile } from "node:child_process";
+import { fileURLToPath } from "node:url";
+import { promisify } from "node:util";
+import { Client } from "@modelcontextprotocol/client";
+import { StdioClientTransport } from "@modelcontextprotocol/client/stdio";
+
+import { parseEvidence } from "../../dist/domain/evidence.js";
+import { assertFormDestinations } from "./browser-verifier-assertions.mjs";
+import { mcpTextValue } from "./mcp-verifier-results.mjs";
+
+/** Verify the real fixture's form destinations through CLI and stdio MCP. */
+export async function verifyBrowserDomDestinations(
+  attachment,
+  entrypoint = fileURLToPath(new URL("../rea.mjs", import.meta.url)),
+  documentUrl,
+) {
+  const env = { ...process.env, REA_LOG_LEVEL: "silent" };
+  const { stdout } = await promisify(execFile)(
+    process.execPath,
+    [
+      entrypoint,
+      "inspect-web-page",
+      attachment.cdp_endpoint,
+      attachment.target_id,
+      "--observation-ms",
+      "100",
+      "--json",
+    ],
+    { env, timeout: 60000, maxBuffer: 32 * 1024 * 1024 },
+  );
+  assertFormDestinations(
+    parseEvidence(JSON.parse(stdout)).normalized_result,
+    documentUrl,
+  );
+  const transport = new StdioClientTransport({
+    command: process.execPath,
+    args: [entrypoint, "mcp"],
+    env,
+    stderr: "pipe",
+  });
+  const client = new Client({ name: "browser-dom-destinations", version: "1" });
+  try {
+    await client.connect(transport);
+    const result = await client.callTool({
+      name: "inspect_web_page",
+      arguments: { ...attachment, observation_ms: 100 },
+    });
+    assert.notEqual(result.isError, true, mcpTextValue(result));
+    assertFormDestinations(
+      parseEvidence(JSON.parse(mcpTextValue(result)).evidence)
+        .normalized_result,
+      documentUrl,
+    );
+    return { cli: true, stdio_mcp: true, current_document_destinations: 4 };
+  } finally {
+    await client.close();
+    await transport.close();
+  }
+}
@@ -0,0 +1,156 @@
+import assert from "node:assert/strict";
+import {
+  networkFixtureBinary,
+  networkFixtureDecoded,
+  networkFixtureSecret,
+} from "../fixtures/browser-network-site.mjs";
+
+const retained = (event) => {
+  assert.equal(event?.kind, "network-content");
+  assert.equal(event.body.state, "captured", JSON.stringify(event.body));
+  return Buffer.from(event.body.content, "base64");
+};
+
+/** Verify association against server-authored markers rather than provider-derived expectations. */
+export function assertBrowserNetworkEvidence(
+  capture,
+  origin,
+  expectedCleanup = "terminated-owned-process",
+) {
+  assert.ok(capture.steps.every((step) => step.status === "completed"));
+  assert.equal(capture.browser.cleanup, expectedCleanup);
+  assert.deepEqual(capture.scenario.network_content, {
+    request_body: true,
+    response_body: true,
+    header_values: true,
+  });
+  assert.equal(capture.completeness.equality_eligible, false);
+  assert.ok(!JSON.stringify(capture).includes(networkFixtureSecret));
+  const events = capture.events.items;
+  const content = events.filter((event) => event.kind === "network-content");
+  const requestEvents = events.filter((event) => event.kind === "request");
+  const sameUrlRequests = requestEvents.filter(
+    (event) => event.url.url === `${origin}/same`,
+  );
+  assert.equal(sameUrlRequests.length, 2);
+  assert.equal(
+    new Set(sameUrlRequests.map((event) => event.transaction_id)).size,
+    2,
+  );
+  const markers = [];
+  for (const request of sameUrlRequests) {
+    const requestContent = content.find(
+      (event) =>
+        event.phase === "request" &&
+        event.transaction_id === request.transaction_id,
+    );
+    const responseContent = content.find(
+      (event) =>
+        event.phase === "response" &&
+        event.transaction_id === request.transaction_id,
+    );
+    const input = JSON.parse(retained(requestContent).toString());
+    const output = JSON.parse(retained(responseContent).toString());
+    assert.equal(
+      output.marker,
+      input.marker,
+      "Response was associated with a different same-URL request",
+    );
+    assert.equal(output.password, "ordinary-selected-value");
+    assert.equal(input.declared, "[REDACTED:network_secret]");
+    assert.equal(output.declared, input.declared);
+    assert.equal(requestContent.body.redacted, true);
+    assert.equal(responseContent.headers.state, "captured");
+    assert.ok(
+      responseContent.headers.items.some(
+        (item) =>
+          item.name.toLowerCase() === "x-declared" &&
+          item.value === "[REDACTED:network_secret]" &&
+          item.redacted,
+      ),
+    );
+    assert.deepEqual(
+      responseContent.headers.items
+        .filter((item) => item.name.toLowerCase() === "x-repeat")
+        .map((item) => item.value),
+      ["first", "second"],
+    );
+    assert.ok(
+      responseContent.headers.items.some(
+        (item) =>
+          item.name.toLowerCase() === "set-cookie" &&
+          item.value === null &&
+          item.redacted,
+      ),
+    );
+    assert.ok(
+      requestContent.headers.items.some(
+        (item) =>
+          item.name.toLowerCase() === "authorization" &&
+          item.value === null &&
+          item.redacted,
+      ),
+    );
+    assert.ok(
+      events.some(
+        (event) =>
+          event.kind === "request-finished" &&
+          event.transaction_id === request.transaction_id,
+      ),
+    );
+    markers.push(input.marker);
+  }
+  assert.deepEqual(markers.sort(), ["fast", "slow"]);
+  const responseFor = (path) => {
+    const response = events.find(
+      (event) =>
+        event.kind === "response" && event.url.url === `${origin}${path}`,
+    );
+    assert.ok(response, `Missing response ${path}`);
+    return content.find(
+      (event) =>
+        event.phase === "response" &&
+        event.source_event_sequence === response.sequence,
+    );
+  };
+  assert.deepEqual(retained(responseFor("/binary")), networkFixtureBinary);
+  assert.deepEqual(retained(responseFor("/compressed")), networkFixtureDecoded);
+  assert.equal(
+    responseFor("/compressed").body.representation,
+    "browser-decoded-response-bytes",
+  );
+  const formRequest = requestEvents.find(
+    (event) => event.url.url === `${origin}/form`,
+  );
+  assert.ok(formRequest);
+  const formContent = content.find(
+    (event) =>
+      event.phase === "request" &&
+      event.transaction_id === formRequest.transaction_id,
+  );
+  assert.equal(
+    retained(formContent).toString(),
+    "declared=[REDACTED:network_secret]",
+  );
+  assert.equal(
+    retained(responseFor("/form")).toString(),
+    "[REDACTED:network_secret]",
+  );
+  assert.equal(responseFor("/stream").body.state, "unavailable");
+  assert.equal(responseFor("/stream").body.reason, "response-unfinished");
+  const first = requestEvents.find(
+    (event) => event.url.url === `${origin}/redirect`,
+  );
+  const next = requestEvents.find(
+    (event) => event.url.url === `${origin}/landing`,
+  );
+  assert.ok(first && next);
+  assert.equal(next.redirected_from_transaction_id, first.transaction_id);
+  return {
+    same_url_markers: markers,
+    binary_bytes: networkFixtureBinary.length,
+    compressed_representation: "browser-decoded-response-bytes",
+    unfinished_stream: "response-unfinished",
+    empty_response_state: responseFor("/empty").body.state,
+  };
+}
@@ -0,0 +1,192 @@
+import assert from "node:assert/strict";
+import { execFile } from "node:child_process";
+import { fileURLToPath } from "node:url";
+import { promisify } from "node:util";
+import { Client } from "@modelcontextprotocol/client";
+import { StdioClientTransport } from "@modelcontextprotocol/client/stdio";
+
+import { browserScenarioSchema } from "../../dist/domain/browserScenario.js";
+import { browserScenarioCaptureSchema } from "../../dist/domain/browserScenarioCapture.js";
+import { parseEvidence } from "../../dist/domain/evidence.js";
+import {
+  startBrowserNetworkSite,
+  networkFixtureSecret,
+} from "../fixtures/browser-network-site.mjs";
+import { assertBrowserNetworkEvidence } from "./browser-network-assertions.mjs";
+import { scenarioProfiles } from "./browser-scenario-verifier.mjs";
+
+/** Exercise selected network content through real CLI and stdio MCP, one browser at a time. */
+export async function verifyBrowserNetworkEvidence(
+  executable,
+  entrypoint = fileURLToPath(new URL("../rea.mjs", import.meta.url)),
+  attachment,
+) {
+  const site = await startBrowserNetworkSite();
+  const profilesBefore = await scenarioProfiles();
+  try {
+    const scenario = browserScenarioSchema.parse({
+      browser: { mode: "launch", executable_path: executable },
+      start_url: { url: site.origin },
+      actions: [
+        {
+          step_id: "run",
+          action: "click",
+          locator: { kind: "css", selector: "#start" },
+          timeout_ms: 10_000,
+        },
+        {
+          step_id: "ready",
+          action: "wait_for",
+          locator: { kind: "css", selector: "#done" },
+          state: "visible",
+          timeout_ms: 10_000,
+        },
+      ],
+      secrets: [
+        {
+          secret_id: "network_secret",
+          environment_variable: "REA_NETWORK_FIXTURE_SECRET",
+        },
+      ],
+      capture: {
+        at_end: ["url"],
+        network: {
+          request_body: true,
+          response_body: true,
+          header_values: true,
+        },
+      },
+    });
+    const env = {
+      ...process.env,
+      REA_LOG_LEVEL: "silent",
+      REA_NETWORK_FIXTURE_SECRET: networkFixtureSecret,
+      HOPPER_LAUNCHER_PATH: "/rea-unconfigured-provider/hopper",
+    };
+    const { stdout } = await promisify(execFile)(
+      process.execPath,
+      [
+        entrypoint,
+        "capture-browser-scenario",
+        JSON.stringify(scenario),
+        "--json",
+      ],
+      { env, timeout: 60_000, maxBuffer: 16 * 1024 * 1024 },
+    );
+    const cli = browserScenarioCaptureSchema.parse(
+      parseEvidence(JSON.parse(stdout)).normalized_result,
+    );
+    const cliProof = assertBrowserNetworkEvidence(cli, site.origin);
+    // The oracle must reject a deliberately incorrect same-URL association.
+    const swapped = structuredClone(cli);
+    const responses = swapped.events.items.filter(
+      (event) =>
+        event.kind === "network-content" &&
+        event.phase === "response" &&
+        event.body.state === "captured" &&
+        Buffer.from(event.body.content, "base64")
+          .toString()
+          .includes('"marker":'),
+    );
+    assert.equal(responses.length, 2);
+    [responses[0].transaction_id, responses[1].transaction_id] = [
+      responses[1].transaction_id,
+      responses[0].transaction_id,
+    ];
+    assert.throws(
+      () => assertBrowserNetworkEvidence(swapped, site.origin),
+      /associated with a different same-URL request/,
+    );
+    const transport = new StdioClientTransport({
+      command: process.execPath,
+      args: [entrypoint, "mcp"],
+      env,
+      stderr: "pipe",
+    });
+    const client = new Client({ name: "network-real-e2e", version: "1" });
+    let mcpProof;
+    try {
+      await client.connect(transport);
+      const result = await client.callTool(
+        { name: "capture_browser_scenario", arguments: scenario },
+        { timeout: 60_000 },
+      );
+      assert.notEqual(result.isError, true, JSON.stringify(result));
+      const evidence = parseEvidence({
+        ...result.structuredContent?.evidence,
+        normalized_result: result.structuredContent?.result,
+      });
+      mcpProof = assertBrowserNetworkEvidence(
+        browserScenarioCaptureSchema.parse(evidence.normalized_result),
+        site.origin,
+      );
+      if (attachment !== undefined) {
+        const connectedScenario = browserScenarioSchema.parse({
+          ...scenario,
+          browser: { mode: "connect", ...attachment },
+        });
+        const connected = await client.callTool(
+          { name: "capture_browser_scenario", arguments: connectedScenario },
+          { timeout: 60_000 },
+        );
+        assert.notEqual(connected.isError, true, JSON.stringify(connected));
+        const connectedEvidence = parseEvidence({
+          ...connected.structuredContent?.evidence,
+          normalized_result: connected.structuredContent?.result,
+        });
+        assert.deepEqual(
+          assertBrowserNetworkEvidence(
+            browserScenarioCaptureSchema.parse(
+              connectedEvidence.normalized_result,
+            ),
+            site.origin,
+            "disconnected-external",
+          ),
+          cliProof,
+        );
+        assert.ok(
+          (await fetch(`${attachment.cdp_endpoint}/json/version`)).ok,
+          "Network capture closed the external browser",
+        );
+      }
+    } finally {
+      try {
+        await client.close();
+      } finally {
+        await transport.close();
+      }
+    }
+    assert.deepEqual(mcpProof, cliProof);
+    for (const path of [
+      "/redirect",
+      "/landing",
+      "/binary",
+      "/compressed",
+      "/stream",
+      "/empty",
+      "/form",
+    ])
+      assert.equal(
+        site.counts.get(path),
+        attachment === undefined ? 2 : 3,
+        `Unexpected implicit refetch of ${path}`,
+      );
+    assert.equal(site.counts.get("/same"), attachment === undefined ? 4 : 6);
+    const profilesAfter = await scenarioProfiles();
+    assert.ok(
+      [...profilesAfter].every((profile) => profilesBefore.has(profile)),
+      "A scenario profile survived cleanup",
+    );
+    return {
+      ...cliProof,
+      cli: true,
+      mcp: true,
+      association_fault_rejected: true,
+      implicit_refetches: 0,
+      profile_cleanup: true,
+      connected_network_verified: attachment !== undefined,
+    };
+  } finally {
+    await site.close();
+  }
+}
@@ -204,11 +204,20 @@ export function assertScenarioCapture(capture) {
    throw new Error(
      "Scenario event URL did not report declared-secret redaction",
    );
+  const unfinished = capture.events.items.filter(
+    ({ kind }) => kind === "request-unfinished",
+  );
+  // This fixture polls continuously. A request crossing the capture cutoff
+  // makes later activity unknown even when no response body was selected.
+  const expectedMissing = unfinished.length === 0 ? [] : ["events"];
  if (
    capture.events.items.length === 0 ||
-    capture.completeness.equality_eligible !== true
+    capture.completeness.equality_eligible !== (unfinished.length === 0) ||
+    JSON.stringify(capture.completeness.missing_sections) !==
+      JSON.stringify(expectedMissing) ||
+    capture.completeness.truncated_sections.length !== 0
  )
    throw new Error(
-      "Scenario launch did not produce complete runtime evidence",
+      `Scenario launch completeness disagrees with its capture cutoff: ${JSON.stringify({ completeness: capture.completeness, unfinished })}`,
    );
 }
@@ -0,0 +1,70 @@
+import assert from "node:assert/strict";
+import { createHash } from "node:crypto";
+import { readFile } from "node:fs/promises";
+import { join } from "node:path";
+import { webScriptExportResultSchema } from "../../dist/domain/webScriptExport.js";
+import { javascriptApplicationAnalysisResultSchema } from "../../dist/domain/javascriptApplicationAnalysis.js";
+
+/** Verify exact exported bytes and the independently authored source manifest. */
+export const assertWebScriptExport = async (evidence, capture, assets) => {
+  const result = webScriptExportResultSchema.parse(evidence.normalized_result);
+  assert.equal(result.source_evidence_id, capture.evidence_id);
+  assert.deepEqual(evidence.evidence_links, [capture.evidence_id]);
+  const manifest = await readFile(result.manifest.path);
+  assert.equal(
+    createHash("sha256").update(manifest).digest("hex"),
+    result.manifest.sha256,
+  );
+  const { manifest: descriptor, ...inline } = result;
+  assert.equal(descriptor.bytes, manifest.length);
+  assert.deepEqual(JSON.parse(manifest.toString()), inline);
+  assert.ok(result.analysis_input);
+  assert.ok(result.scripts.length > 0);
+  for (const script of result.scripts) {
+    assert.equal(script.content.state, "exported");
+    const bytes = await readFile(
+      join(result.analysis_input.input_path, script.content.relative_path),
+    );
+    assert.equal(
+      createHash("sha256").update(bytes).digest("hex"),
+      script.content.sha256,
+    );
+    if (assets) {
+      const url = new URL(script.url);
+      assert.equal(
+        bytes.toString(),
+        assets.get(`${url.pathname}${url.search}`),
+        `Wrong bytes for ${script.url}`,
+      );
+    }
+  }
+  if (assets) {
+    assert.equal(result.scripts.length, assets.size);
+    const variants = result.scripts.filter(({ url }) =>
+      url.includes("/variant.js?"),
+    );
+    assert.equal(variants.length, 2);
+    assert.ok(variants.every(({ content }) => content.layout === "isolated"));
+    assert.equal(
+      new Set(variants.map(({ content }) => content.relative_path)).size,
+      2,
+    );
+  }
+  return result;
+};
+/** Verify existing application analysis and an observed relative module layout. */
+export const assertExportedScriptAnalysis = (evidence, modules, imports) => {
+  const result = javascriptApplicationAnalysisResultSchema.parse(
+    evidence.normalized_result,
+  );
+  assert.equal(result.statistics.parsed_javascript_files, modules);
+  if (imports)
+    assert.ok(
+      result.graph.edges.some(
+        ({ relation, properties }) =>
+          relation === "imports" &&
+          properties.specifier === "./lib/dep.js" &&
+          properties.resolution_status === "resolved",
+      ),
+    );
+};
@@ -0,0 +1,192 @@
+import assert from "node:assert/strict";
+import { execFile } from "node:child_process";
+import { mkdtemp, rm, writeFile } from "node:fs/promises";
+import { tmpdir } from "node:os";
+import { join } from "node:path";
+import { fileURLToPath } from "node:url";
+import { promisify } from "node:util";
+import { Client } from "@modelcontextprotocol/client";
+import { StdioClientTransport } from "@modelcontextprotocol/client/stdio";
+
+import { parseEvidence } from "../../dist/domain/evidence.js";
+import { startBrowserScriptSite } from "../fixtures/browser-script-site.mjs";
+import {
+  assertWebScriptExport,
+  assertExportedScriptAnalysis,
+} from "./browser-script-export-assertions.mjs";
+import { mcpTextValue } from "./mcp-verifier-results.mjs";
+
+/** Verify capture → export → existing analysis through real CLI and stdio MCP. */
+export async function verifyBrowserScriptExport(
+  executable,
+  entrypoint = fileURLToPath(new URL("../rea.mjs", import.meta.url)),
+  attachment,
+) {
+  const site = await startBrowserScriptSite();
+  const root = await mkdtemp(join(tmpdir(), "rea-browser-script-export-"));
+  const env = {
+    ...process.env,
+    REA_LOG_LEVEL: "silent",
+    HOPPER_LAUNCHER_PATH: "/rea-unconfigured-provider/hopper",
+  };
+  const cli = exportCli(entrypoint, env);
+  const scenario = scriptCaptureScenario(executable, site.origin);
+  const save = (name, capture) => saveCapture(root, name, capture);
+  const transport = new StdioClientTransport({
+    command: process.execPath,
+    args: [entrypoint, "mcp"],
+    env,
+    stderr: "pipe",
+  });
+  const client = new Client({ name: "web-script-real-e2e", version: "1" });
+  try {
+    const cliCapture = await cli(
+      "capture-browser-scenario",
+      JSON.stringify(scenario),
+    );
+    const cliInput = await save("cli", cliCapture);
+    const counts = new Map(site.counts);
+    const cliExport = await cli(
+      "export-web-scripts",
+      cliInput.capture_path,
+      cliInput.output_directory,
+    );
+    const cliResult = await assertWebScriptExport(
+      cliExport,
+      cliCapture,
+      site.assets,
+    );
+    await cli(
+      "analyze-javascript-application",
+      cliResult.analysis_input.input_path,
+    ).then((value) => assertExportedScriptAnalysis(value, 4, true));
+    assert.deepEqual(
+      site.counts,
+      counts,
+      "Export/analysis refetched a captured asset",
+    );
+    await client.connect(transport);
+    const call = async (name, args) => {
+      const result = await client.callTool({ name, arguments: args });
+      assert.notEqual(result.isError, true, mcpTextValue(result));
+      return parseEvidence(JSON.parse(mcpTextValue(result)).evidence);
+    };
+    const mcpCapture = await call("capture_browser_scenario", scenario);
+    const mcpInput = await save("mcp", mcpCapture);
+    const mcpCounts = new Map(site.counts);
+    const mcpResult = await assertWebScriptExport(
+      await call("export_web_scripts", mcpInput),
+      mcpCapture,
+      site.assets,
+    );
+    assertExportedScriptAnalysis(
+      await call("analyze_javascript_application", mcpResult.analysis_input),
+      4,
+      true,
+    );
+    assert.deepEqual(
+      site.counts,
+      mcpCounts,
+      "MCP export/analysis refetched a captured asset",
+    );
+    const passive = attachment
+      ? await verifyPassiveExport(attachment, { cli, call, save })
+      : false;
+    return {
+      cli: true,
+      stdio_mcp: true,
+      active_scripts: 4,
+      passive,
+      exact_bytes: true,
+      manifest_readback: true,
+      relative_import_resolved: true,
+      query_variants_isolated: true,
+      implicit_refetches: 0,
+    };
+  } finally {
+    await client.close();
+    await transport.close();
+    await site.close();
+    await rm(root, { recursive: true, force: true });
+  }
+}
+
+const verifyPassiveExport = async (attachment, { cli, call, save }) => {
+  const input = {
+    ...attachment,
+    observation_ms: 100,
+    include_script_sources: true,
+  };
+  const page = await call("inspect_web_page", input);
+  const pageInput = await save("passive", page);
+  const exported = await assertWebScriptExport(
+    await call("export_web_scripts", pageInput),
+    page,
+  );
+  assertExportedScriptAnalysis(
+    await call("analyze_javascript_application", exported.analysis_input),
+    exported.scripts.length,
+    false,
+  );
+  const pageCli = await cli(
+    "inspect-web-page",
+    attachment.cdp_endpoint,
+    attachment.target_id,
+    "--include-script-sources",
+    "--observation-ms",
+    "100",
+  );
+  const pageCliInput = await save("passive-cli", pageCli);
+  const pageCliResult = await assertWebScriptExport(
+    await cli(
+      "export-web-scripts",
+      pageCliInput.capture_path,
+      pageCliInput.output_directory,
+    ),
+    pageCli,
+  );
+  assertExportedScriptAnalysis(
+    await cli(
+      "analyze-javascript-application",
+      pageCliResult.analysis_input.input_path,
+    ),
+    pageCliResult.scripts.length,
+    false,
+  );
+  return true;
+};
+
+const exportCli =
+  (entrypoint, env) =>
+  async (...args) => {
+    const { stdout } = await promisify(execFile)(
+      process.execPath,
+      [entrypoint, ...args, "--json"],
+      { env, timeout: 60000, maxBuffer: 32 * 1024 * 1024 },
+    );
+    return parseEvidence(JSON.parse(stdout));
+  };
+
+const saveCapture = async (root, name, capture) => {
+  const capturePath = join(root, `${name}.json`);
+  await writeFile(capturePath, JSON.stringify(capture));
+  return {
+    capture_path: capturePath,
+    output_directory: join(root, `${name}-export`),
+  };
+};
+
+const scriptCaptureScenario = (executable, origin) => ({
+  browser: { mode: "launch", executable_path: executable },
+  start_url: { url: origin },
+  actions: [
+    {
+      step_id: "ready",
+      action: "wait_for",
+      locator: { kind: "css", selector: '[data-ready="true"]' },
+      state: "visible",
+      timeout_ms: 10000,
+    },
+  ],
+  capture: { network: { response_body: true } },
+});
@@ -22,7 +22,7 @@ export function assertObservation(result, origin) {
  assertObservationInventory(result, origin);
  assertObservationEvents(result);
  assertObservationPrivacy(result);
-  assertObservationMetadata(result);
+  assertObservationMetadata(result, origin);
 }

 function assertObservationInventory(result, origin) {
@@ -86,9 +86,27 @@ function assertObservationPrivacy(result) {
    );
 }

-function assertObservationMetadata(result) {
+function assertObservationMetadata(result, origin) {
+  assertFormDestinations(result);
+  if (
+    !result.metadata.dom_urls.some(
+      ({ attribute, url }) =>
+        attribute === "href" && url === `${origin}/assets/guide`,
+    )
+  )
+    throw new Error(
+      "Real Chrome relative DOM URL did not use the document base",
+    );
  if (!result.storage.local_storage_keys.includes("rea-storage-key"))
    throw new Error("Real Chrome local-storage key inventory was missing");
+  if (
+    result.storage.content_fingerprints.filter(
+      ({ scope }) => scope === "cookie",
+    ).length !== 2
+  )
+    throw new Error(
+      "Real Chrome root and current-page cookie fingerprints were missing",
+    );
  if (!result.storage.indexed_db_names.includes("rea-browser-db"))
    throw new Error("Real Chrome IndexedDB name inventory was missing");
  if (!result.storage.cache_names.includes("rea-browser-cache"))
@@ -104,6 +122,23 @@ function assertObservationMetadata(result) {
    throw new Error("Real Chrome safe response metadata was missing");
 }

+/** Assert the fixture's empty form destinations retain the current document URL. */
+export function assertFormDestinations(
+  result,
+  documentUrl = result.target.url,
+) {
+  const destinations = result.metadata.dom_urls.filter(
+    ({ attribute }) => attribute === "action" || attribute === "formaction",
+  );
+  if (
+    destinations.length !== 4 ||
+    destinations.some(({ url }) => url !== documentUrl)
+  )
+    throw new Error(
+      `Real Chrome form destinations did not use the current document URL: ${JSON.stringify({ expected: documentUrl, target: result.target.url, destinations })}`,
+    );
+}
+
 /** Assert real-browser static bundle and source-map findings. */
 export function assertBundleAnalysis(result) {
  if (
@@ -6,12 +6,12 @@ export const toolFamilyCatalog = (sources) => {
    {
      id: "direct",
      surface: "official-proxy",
-      contracts: sources.toolContracts.OFFICIAL_TOOL_CONTRACTS,
+      contracts: sources.officialContracts.OFFICIAL_TOOL_CONTRACTS,
    },
    {
      id: "enhanced",
      surface: "enhanced",
-      contracts: sources.toolContracts.ENHANCED_TOOL_CONTRACTS,
+      contracts: sources.enhancedContracts.ENHANCED_TOOL_CONTRACTS,
    },
    {
      id: "native",
@@ -31,6 +31,16 @@ export const toolFamilyCatalog = (sources) => {
        ...sources.managedWorkflowContracts.MANAGED_WORKFLOW_TOOL_CONTRACTS,
      ],
    },
+    {
+      id: "firmware",
+      surface: "firmware-provider",
+      contracts: sources.firmwareContracts.FIRMWARE_TOOL_CONTRACTS,
+    },
+    {
+      id: "android",
+      surface: "android-provider",
+      contracts: sources.androidContracts.ANDROID_TOOL_CONTRACTS,
+    },
    {
      id: "browser",
      surface: "browser-provider",
@@ -54,12 +64,15 @@ export const toolFamilyCatalog = (sources) => {
    {
      id: "application",
      surface: "application-workflow",
-      contracts: sources.applicationContracts.APPLICATION_TOOL_CONTRACTS,
+      contracts: [
+        ...sources.applicationContracts.APPLICATION_TOOL_CONTRACTS,
+        ...sources.webScriptContracts.WEB_SCRIPT_TOOL_CONTRACTS,
+      ],
    },
    {
      id: "session",
      surface: "session",
-      contracts: sources.toolContracts.SESSION_TOOL_CONTRACTS,
+      contracts: sources.sessionContracts.SESSION_TOOL_CONTRACTS,
    },
  ].map(({ id, surface, contracts }) => ({
    id,
@@ -96,6 +109,10 @@ export const providerCatalog = (sources) => {
      identity: sources.ghidraProvider.GHIDRA_PROVIDER_IDENTITY,
      contracts: sources.ghidraProvider.GHIDRA_PROVIDER_TOOL_CONTRACTS,
    },
+    {
+      identity: sources.idaProvider.IDA_PROVIDER_IDENTITY,
+      contracts: sources.idaProvider.IDA_PROVIDER_TOOL_CONTRACTS,
+    },
    {
      identity: sources.nativeProvider.NATIVE_MACOS_PROVIDER_IDENTITY,
      contracts: sources.nativeContracts.NATIVE_TOOL_CONTRACTS,
@@ -113,6 +130,22 @@ export const providerCatalog = (sources) => {
      contracts:
        sources.managedWorkflowContracts.MANAGED_WORKFLOW_TOOL_CONTRACTS,
    },
+    {
+      identity: sources.firmwareProvider.BINWALK_PROVIDER_IDENTITY,
+      contracts: sources.firmwareContracts.FIRMWARE_TOOL_CONTRACTS.filter(
+        ({ name }) => name === "inspect_firmware_regions",
+      ),
+    },
+    {
+      identity: sources.firmwareProvider.UNBLOB_PROVIDER_IDENTITY,
+      contracts: sources.firmwareContracts.FIRMWARE_TOOL_CONTRACTS.filter(
+        ({ name }) => name === "extract_firmware",
+      ),
+    },
+    {
+      identity: sources.androidProvider.JADX_PROVIDER_IDENTITY,
+      contracts: sources.androidContracts.ANDROID_TOOL_CONTRACTS,
+    },
    {
      identity: sources.browserProvider.CDP_BROWSER_PROVIDER_IDENTITY,
      contracts: sources.browserContracts.BROWSER_TOOL_CONTRACTS,
@@ -154,6 +187,10 @@ export const providerCatalog = (sources) => {
        sources.artifactProviders.JAVASCRIPT_APPLICATION_WORKFLOW_PROVIDER,
      contracts: sources.applicationContracts.APPLICATION_TOOL_CONTRACTS,
    },
+    {
+      identity: sources.artifactProviders.WEB_SCRIPT_EXPORT_PROVIDER,
+      contracts: sources.webScriptContracts.WEB_SCRIPT_TOOL_CONTRACTS,
+    },
  ]
    .map(({ identity, contracts }) => ({
      id: identity.id,
@@ -37,9 +37,16 @@ const SOURCE_PATHS = {
  catalogIdentity: "dist/catalogIdentity.js",
  cli: "dist/cli.js",
  toolContracts: "dist/contracts/toolContracts.js",
+  officialContracts: "dist/contracts/officialToolContracts.js",
+  enhancedContracts: "dist/contracts/enhancedToolContracts.js",
+  sessionContracts: "dist/contracts/sessionToolContracts.js",
  nativeContracts: "dist/contracts/nativeToolContracts.js",
  artifactContracts: "dist/contracts/artifactToolContracts.js",
  managedContracts: "dist/contracts/managedToolContracts.js",
+  firmwareContracts: "dist/contracts/firmwareToolContracts.js",
+  firmwareProvider: "dist/firmware/FirmwareRelease.js",
+  androidContracts: "dist/contracts/androidToolContracts.js",
+  androidProvider: "dist/android/JadxRelease.js",
  managedWorkflowContracts: "dist/contracts/managedWorkflowToolContracts.js",
  browserContracts: "dist/contracts/browserToolContracts.js",
  browserScenarioContracts: "dist/contracts/browserScenarioToolContracts.js",
@@ -47,9 +54,11 @@ const SOURCE_PATHS = {
  javascriptRuntimeObservationContracts:
    "dist/contracts/javascriptRuntimeObservationToolContracts.js",
  applicationContracts: "dist/contracts/applicationToolContracts.js",
+  webScriptContracts: "dist/contracts/webScriptToolContracts.js",
  supportedClients: "dist/application/SupportedClients.js",
  hopperProvider: "dist/hopper/HopperProvider.js",
  ghidraProvider: "dist/ghidra/GhidraProvider.js",
+  idaProvider: "dist/ida/IdaProviderCapabilities.js",
  nativeProvider: "dist/native/NativeMacOSProvider.js",
  artifactProviders: "dist/application/InvestigationProviders.js",
  browserProvider: "dist/browser/CdpBrowserProvider.js",
@@ -1,5 +1,9 @@
 import type { ProductCatalog } from "./product-catalog.mjs";

+export function skillReferenceIssues(
+  skillRoot: string,
+): Promise<readonly string[]>;
+
 export function documentationFactIssues(
  root: string,
  catalog: ProductCatalog,
@@ -1,5 +1,5 @@
-import { readFile } from "node:fs/promises";
-import { join } from "node:path";
+import { readFile, readdir, stat } from "node:fs/promises";
+import { dirname, isAbsolute, join, relative, resolve, sep } from "node:path";

 const README_PATHS = [
  "README.md",
@@ -28,9 +28,49 @@ const requireText = (issues, path, content, expected) => {
  if (!content.includes(expected)) issues.push(`${path}: missing ${expected}`);
 };

+/** Check that local Markdown references travel with an installed skill bundle. */
+export const skillReferenceIssues = async (skillRoot) => {
+  const issues = [];
+  const paths = (await readdir(skillRoot, { recursive: true }))
+    .filter((path) => path.endsWith(".md"))
+    .sort();
+  for (const path of paths) {
+    const content = await readFile(join(skillRoot, path), "utf8");
+    for (const match of content.matchAll(/\[[^\]\n]*\]\(([^)\s]+)\)/gu)) {
+      const destination = match[1];
+      if (/^(?:https?:\/\/|mailto:|#)/u.test(destination)) continue;
+      const target = resolve(
+        dirname(join(skillRoot, path)),
+        destination.split("#")[0],
+      );
+      const withinBundle = relative(resolve(skillRoot), target);
+      if (
+        withinBundle === ".." ||
+        withinBundle.startsWith(`..${sep}`) ||
+        isAbsolute(withinBundle)
+      ) {
+        issues.push(
+          `${path}: reference escapes installed skill bundle: ${destination}`,
+        );
+        continue;
+      }
+      try {
+        if (!(await stat(target)).isFile())
+          issues.push(`${path}: reference is not a file: ${destination}`);
+      } catch (cause) {
+        if (cause?.code !== "ENOENT") throw cause;
+        issues.push(`${path}: missing skill reference: ${destination}`);
+      }
+    }
+  }
+  return issues;
+};
+
 /** Return every caller-visible documentation mismatch against canonical facts. */
 export const documentationFactIssues = async (root, catalog) => {
-  const issues = [];
+  const issues = await skillReferenceIssues(
+    join(root, "skills/reverse-engineer-anything"),
+  );
  const expectedCounts = catalog.tools.families.map(({ count }) => count);
  for (const path of README_PATHS) {
    const content = await readFile(join(root, path), "utf8");
@@ -0,0 +1,43 @@
+"""Generate firmware bytes using standard format producers, with an independent oracle."""
+import gzip
+import hashlib
+import io
+import json
+from pathlib import Path
+import subprocess
+import sys
+import tarfile
+
+root = Path(sys.argv[1]).resolve()
+root.mkdir(parents=True, exist_ok=True)
+source = root / "probe.c"
+source.write_text("int firmware_probe(int x){return x*7+3;} int main(void){return firmware_probe(4);}\n")
+subprocess.run([sys.argv[2], "-O0", "-g", "-fno-inline", str(source), "-o", str(root / "probe")], check=True)
+payloads = {"etc/rea.conf": b"rea_fixture=true\n", "usr/bin/probe": (root / "probe").read_bytes()}
+buffer = io.BytesIO()
+with tarfile.open(fileobj=buffer, mode="w", format=tarfile.USTAR_FORMAT) as archive:
+    for name, data in payloads.items():
+        info = tarfile.TarInfo(name)
+        info.size = len(data)
+        info.mode = 0o644
+        info.mtime = 0
+        archive.addfile(info, io.BytesIO(data))
+compressed = gzip.compress(buffer.getvalue(), mtime=0)
+image = b"REA firmware fixture\n".ljust(64, b"\xff") + compressed + b"\x00" * 128
+(root / "firmware.bin").write_bytes(image)
+(root / "oracle.json").write_text(json.dumps({
+    "generator": "Python tarfile USTAR + gzip; host cc; no target execution",
+    "offset": 64, "length": len(compressed), "size": len(image),
+    "sha256": hashlib.sha256(image).hexdigest(),
+    "files": {name: {"sha256": hashlib.sha256(data).hexdigest(), "size": len(data)} for name, data in payloads.items()},
+}, indent=2) + "\n")
+print(root)
+
+if len(sys.argv) > 3:
+    tree = root / "ext4-root"
+    tree.mkdir(exist_ok=True)
+    for name, data in payloads.items():
+        target = tree / name
+        target.parent.mkdir(parents=True, exist_ok=True)
+        target.write_bytes(data)
+    subprocess.run([sys.argv[3], "-q", "-t", "ext4", "-F", "-d", str(tree), str(root / "ext4.bin"), "8192"], check=True)
@@ -0,0 +1,14 @@
+/** Compare actual Vitest discovery with repository-owned test paths. */
+export function compareTestDiscovery(
+  expectedPaths: readonly string[],
+  discovery: unknown,
+  root: string,
+): {
+  readonly missing: readonly string[];
+  readonly unexpected: readonly string[];
+  readonly duplicates: readonly {
+    readonly file: string;
+    readonly projects: readonly string[];
+  }[];
+  readonly discovered: number;
+};
@@ -0,0 +1,41 @@
+import { relative, resolve } from "node:path";
+
+/** Compare actual Vitest discovery with repository-owned test paths. */
+export const compareTestDiscovery = (expectedPaths, discovery, root) => {
+  if (!Array.isArray(discovery))
+    throw new TypeError("Vitest file discovery must be an array");
+  const projectsByFile = new Map();
+  for (const entry of discovery) {
+    if (
+      entry === null ||
+      typeof entry !== "object" ||
+      typeof entry.file !== "string" ||
+      entry.file.length === 0 ||
+      typeof entry.projectName !== "string" ||
+      entry.projectName.length === 0
+    )
+      throw new TypeError(
+        "Vitest discovery requires file and projectName strings",
+      );
+    const path = relative(root, resolve(root, entry.file)).replaceAll(
+      "\\",
+      "/",
+    );
+    const projects = projectsByFile.get(path) ?? [];
+    projects.push(entry.projectName);
+    projectsByFile.set(path, projects);
+  }
+  const expected = new Set(expectedPaths);
+  const sorted = (values) => [...values].sort();
+  return {
+    missing: sorted(expected).filter((path) => !projectsByFile.has(path)),
+    unexpected: sorted(projectsByFile.keys()).filter(
+      (path) => !expected.has(path),
+    ),
+    duplicates: sorted(projectsByFile.keys()).flatMap((file) => {
+      const projects = projectsByFile.get(file);
+      return projects.length > 1 ? [{ file, projects: sorted(projects) }] : [];
+    }),
+    discovered: projectsByFile.size,
+  };
+};
@@ -39,7 +39,7 @@ const observeVerifierLineage = async (run, observedAt) => {
      run,
      observedAt,
      null,
-      "Windows verifier lineage ownership is unavailable without Job Objects",
+      "The verifier has no retained native Job Object lease for lineage observation; provider jobs are verified by their native owners",
    );
  try {
    const { members, observerPid } = await processSnapshot();
@@ -23,7 +23,7 @@ const runtimeFiles = isMcpMode

 if (!(await compiledRuntimeExists(runtimeFiles))) {
  process.stderr.write(
-    `REA's compiled runtime is missing. Run \`npm ci\` in ${packageRoot} to install dependencies and build REA, then restart it. If this is an installed package, reinstall rea-agents.\n`,
+    `REA's compiled runtime is missing. Run \`npm ci && npm run build:cached\` in ${packageRoot} to install dependencies and build REA, then restart it. If this is an installed package, reinstall rea-agents.\n`,
  );
  process.exitCode = 1;
 } else if (isMcpMode) {
@@ -0,0 +1,53 @@
+#!/usr/bin/env node
+import assert from "node:assert/strict";
+import { mkdtemp, readFile, rm } from "node:fs/promises";
+import { tmpdir } from "node:os";
+import { join } from "node:path";
+import { chromium } from "playwright-core";
+import { startBrowserVerifierSite } from "./fixtures/browser-verifier-site.mjs";
+import { verifyBrowserDomDestinations } from "./lib/browser-dom-destinations-e2e.mjs";
+
+const executable = process.env.REA_BROWSER_EXECUTABLE;
+if (!executable)
+  throw new Error("verify:browser:dom requires REA_BROWSER_EXECUTABLE");
+const profile = await mkdtemp(join(tmpdir(), "rea-browser-dom-"));
+const site = await startBrowserVerifierSite();
+let context;
+try {
+  context = await chromium.launchPersistentContext(profile, {
+    executablePath: executable,
+    headless: true,
+    args: ["--remote-debugging-port=0"],
+  });
+  const page = context.pages()[0] ?? (await context.newPage());
+  await page.goto(`${site.origin}/app?selected=fixture#section`);
+  const native = await page.evaluate(() =>
+    [
+      ...document.querySelectorAll("form,button[formaction],input[formaction]"),
+    ].map((element) =>
+      element.tagName === "FORM" ? element.action : element.formAction,
+    ),
+  );
+  assert.deepEqual(native, Array(4).fill(page.url()));
+  const session = await context.newCDPSession(page);
+  const { targetInfo } = await session.send("Target.getTargetInfo");
+  await session.detach();
+  const [port] = (
+    await readFile(join(profile, "DevToolsActivePort"), "utf8")
+  ).split("\n");
+  const result = await verifyBrowserDomDestinations(
+    {
+      cdp_endpoint: `http://127.0.0.1:${port}`,
+      target_id: targetInfo.targetId,
+    },
+    process.argv[2],
+    page.url(),
+  );
+  process.stdout.write(
+    `${JSON.stringify({ ...result, browser: context.browser().version(), native_oracle: true, verified: true })}\n`,
+  );
+} finally {
+  await context?.close();
+  await site.close();
+  await rm(profile, { recursive: true, force: true });
+}
@@ -0,0 +1,16 @@
+#!/usr/bin/env node
+import { access } from "node:fs/promises";
+import { verifyBrowserNetworkEvidence } from "./lib/browser-network-e2e.mjs";
+import { createVerifierRun, completeVerifierRun } from "./lib/verifier-run.mjs";
+
+const executable = process.env.REA_BROWSER_EXECUTABLE;
+if (executable === undefined || executable === "")
+  throw new Error(
+    "verify:browser:network requires REA_BROWSER_EXECUTABLE pointing to an installed Chrome-family browser",
+  );
+await access(executable);
+const run = createVerifierRun();
+const proof = await verifyBrowserNetworkEvidence(executable, process.argv[2]);
+process.stdout.write(
+  `${JSON.stringify({ ...proof, verifier_run: await completeVerifierRun(run), verified: true })}\n`,
+);
@@ -0,0 +1,16 @@
+#!/usr/bin/env node
+import { access } from "node:fs/promises";
+import { verifyBrowserScriptExport } from "./lib/browser-script-export-e2e.mjs";
+import { createVerifierRun, completeVerifierRun } from "./lib/verifier-run.mjs";
+
+const executable = process.env.REA_BROWSER_EXECUTABLE;
+if (executable === undefined || executable === "")
+  throw new Error(
+    "verify:browser:scripts requires REA_BROWSER_EXECUTABLE pointing to an installed Chrome-family browser",
+  );
+await access(executable);
+const run = createVerifierRun();
+const proof = await verifyBrowserScriptExport(executable, process.argv[2]);
+process.stdout.write(
+  `${JSON.stringify({ ...proof, verifier_run: await completeVerifierRun(run), verified: true })}\n`,
+);
@@ -0,0 +1,38 @@
+#!/usr/bin/env node
+
+import assert from "node:assert/strict";
+import { constants } from "node:buffer";
+import { createHash } from "node:crypto";
+
+import { canonicalDigest } from "../dist/domain/comparisonSemantics.js";
+import { createEvidence, parseEvidence } from "../dist/domain/evidence.js";
+
+// This opt-in check crosses the actual engine string limit; keep it outside
+// routine source tests. Build first, then run this script with the local Node.
+const leaf = "x".repeat(1024 * 1024);
+const encodedLeaf = JSON.stringify(leaf);
+const count = Math.ceil(constants.MAX_STRING_LENGTH / encodedLeaf.length) + 1;
+const value = { payload: Array.from({ length: count }, () => leaf) };
+const expected = createHash("sha256");
+expected.update('{"payload":[');
+for (let index = 0; index < count; index += 1) {
+  if (index > 0) expected.update(",");
+  expected.update(encodedLeaf);
+}
+expected.update("]}");
+assert.equal(canonicalDigest(value), expected.digest("hex"));
+
+const evidence = createEvidence(
+  undefined,
+  { id: "large-json-fixture", name: "Large JSON fixture", version: "1" },
+  { operation: "inspect_fixture", parameters: {}, result: value },
+);
+assert.equal(parseEvidence(evidence).evidence_id, evidence.evidence_id);
+process.stdout.write(
+  `${JSON.stringify({
+    verified: true,
+    serialized_value_bytes: count * encodedLeaf.length + count - 1 + 14,
+    engine_string_limit: constants.MAX_STRING_LENGTH,
+    evidence_id: evidence.evidence_id,
+  })}\n`,
+);
@@ -12,10 +12,15 @@ const buildManagedFixtures = async (workspace) => {
    writeFile(
      managedPath,
      buildManagedPeFixture({
+        methods: [
+          { name: "Main", flags: 0x0016 },
+          { name: "NativeMessageBox", flags: 0x2016, rva: 0 },
+        ],
        pinvoke: {
          moduleName: "user32.dll",
          importName: "MessageBoxW",
          mappingFlags: 0x0345,
+          memberRow: 2,
        },
      }),
    ),
@@ -59,7 +64,7 @@ const verifyManagedMembers = async ({ cli, managedPath, environment }) => {
  );
  if (
    managedMembers.operation !== "inspect_managed_members" ||
-    managedMembers.normalized_result?.methods?.length !== 1
+    managedMembers.normalized_result?.methods?.length !== 2
  )
    throw new Error("packaged managed member CLI failed");
  return managedMembers;
@@ -2,11 +2,12 @@ import {
  lstat,
  mkdir,
  readFile,
+  readdir,
  rm,
  symlink,
  writeFile,
 } from "node:fs/promises";
-import { join } from "node:path";
+import { dirname, join } from "node:path";

 import { spawn } from "@lydell/node-pty";

@@ -19,6 +20,7 @@ import {
  runWithStatus,
 } from "./lib/verify-package-core.mjs";
 import { parse as parseJsonc } from "jsonc-parser";
+import { skillReferenceIssues } from "./lib/docs-facts.mjs";

 const OPENCODE_ORIGINAL = `{
  // OpenCode preferences must survive setup.
@@ -473,19 +475,23 @@ const assertSkill = async ({ skillPath, siblingSkillPath, root }) => {
  );
  if (skill !== canonicalSkill)
    throw new Error("packaged skill did not match its canonical source");
-  const installedReference = await readFile(
-    join(skillPath, "..", "references/javascript-applications.md"),
-    "utf8",
-  );
-  const canonicalReference = await readFile(
-    join(
-      root,
-      "skills/reverse-engineer-anything/references/javascript-applications.md",
-    ),
-    "utf8",
-  );
-  if (installedReference !== canonicalReference)
-    throw new Error("packaged skill references did not match canonical source");
+  const canonicalRoot = join(root, "skills/reverse-engineer-anything");
+  for (const reference of await readdir(join(canonicalRoot, "references"))) {
+    const installed = await readFile(
+      join(dirname(skillPath), "references", reference),
+      "utf8",
+    );
+    const canonical = await readFile(
+      join(canonicalRoot, "references", reference),
+      "utf8",
+    );
+    if (installed !== canonical)
+      throw new Error(
+        `packaged skill reference did not match canonical source: ${reference}`,
+      );
+  }
+  const issues = await skillReferenceIssues(dirname(skillPath));
+  if (issues.length > 0) throw new Error(issues.join("\n"));
  if ((await readFile(siblingSkillPath, "utf8")) !== "unrelated skill\n")
    throw new Error("packaged skill installation modified a sibling skill");
 };
--- a/Show More
+++ b/Show More