fix(apple): qualify rpath findings for conditional searches

chore: sync branch with latest main
fix(apple): distinguish dyld logging from path overrides
2026-10-08 23:52:43 +08:00 · 2026-10-08 23:52:43 +08:00 · 2026-10-08 23:46:06 +08:00 · 2026-10-08 23:46:02 +08:00 · 2026-10-08 23:45:07 +08:00 · 2026-10-08 23:32:34 +08:00
762 changed files with 53318 additions and 13797 deletions
@@ -28,7 +28,7 @@ intentionally not included. -->
 - Provider, bridge, target-format, or platform compatibility:
 - Evidence, artifact, provenance, or reconstruction contract:
 - Process execution, authorization, cleanup, or containment impact:
- Generated metadata (`docs/product-catalog.json`), package, or installation impact:
+- Generated metadata (`docs/public/product-catalog.json`), package, or installation impact (CI generates and validates ignored catalogs and `skills/`; edit authored instructions in `skill-src/` and never commit build outputs):

 ## Evidence and regression coverage

@@ -59,6 +59,10 @@ relevant real-provider or platform workflow, or explain why it was unavailable.
 limits, security/privacy/containment implications, and meaningful proof gaps. -->

 - Breaking changes or migration steps:
+  <!-- For ! / BREAKING CHANGE: show a previously valid call/configuration,
+  its new behavior and migration, and why compatibility/deprecation cannot
+  preserve it. Compatible fixes/additions should use patch/minor semantics.
+  See docs/releasing.md. -->
 - Real Hopper/Ghidra, browser, or OS coverage:
 - Package or release metadata impact:
 - Security, privacy, process, or containment review:
@@ -102,6 +102,8 @@ jobs:
        with:
          name: rea-dist
          path: dist
+      - name: Generate projections from downloaded build
+        run: npm run build:projections
      - run: npm run test:ci:shard:run -- --shard=${{ matrix.shard }}
      - uses: actions/upload-artifact@v4
        if: ${{ !cancelled() }}
@@ -229,7 +231,16 @@ jobs:
        with:
          node-version-file: .nvmrc
      - name: Prepare cross compiler
-        run: sudo apt-get update && sudo apt-get install --no-install-recommends -y g++-mingw-w64-x86-64
+        run: |
+          # Slow Azure archive transfers can exhaust the job before compilation.
+          # Keep the same signed packages and avoid slow HTTP mirror fallback.
+          for source in /etc/apt/apt-mirrors.txt /etc/apt/sources.list /etc/apt/sources.list.d/ubuntu.sources; do
+            if [ -f "$source" ]; then
+              sudo sed -i 's|azure.archive.ubuntu.com|archive.ubuntu.com|g; s|http://archive.ubuntu.com|https://archive.ubuntu.com|g' "$source"
+            fi
+          done
+          sudo apt-get update
+          sudo apt-get install --no-install-recommends -y g++-mingw-w64-x86-64
      - run: npm run build:windows-native
      - run: npm run verify:windows-native:artifact
      - uses: actions/upload-artifact@v4
@@ -306,14 +317,19 @@ jobs:
      - run: npm run verify:keyed-archive
      - run: npm run verify:asset-catalog
      - run: npm run verify:macos-bundle
-      - name: Native compiled NIB hierarchy regressions
-        run: npm run test:focused -- tests/boundary/filesystem/nibNativeHierarchy.test.ts tests/boundary/filesystem/interfaceBuilderBundle.test.ts
+      - run: npm run verify:dyld-shared-cache
+      - name: Native installer and compiled NIB hierarchy regressions
+        run: npm run test:focused -- tests/boundary/filesystem/installScript.test.ts tests/boundary/filesystem/nibNativeHierarchy.test.ts tests/boundary/filesystem/interfaceBuilderBundle.test.ts
      - name: Real binary metadata and Interface Builder integration
        run: npm run verify:apple-dispatch && npm run verify:interface-builder
      - name: Native plist CLI selection regressions
        run: npm run test:focused -- tests/boundary/cli/nativePlistCli.test.ts tests/boundary/cli/nativePlistPrototypeKeyCli.test.ts tests/boundary/cli/nativePlistSelectionFailureCli.test.ts
      - name: Native Swift demangling CLI and MCP regressions
        run: npm run test:focused -- tests/boundary/cli/nativeDemangleCli.test.ts tests/boundary/mcp/nativeDemangleMcp.test.ts
+      - name: Process filesystem snapshot descriptor regressions
+        run: npm run test:focused -- src/process/capture/FilesystemSnapshot.test.ts
+      - name: Native Darwin ownership and process cleanup regressions
+        run: npm run test:focused -- tests/boundary/process/darwinProcessRunTokenReader.test.ts tests/boundary/process/processCaptureLifecycle.test.ts tests/boundary/cli/processCli.test.ts tests/boundary/mcp/sessionMcp.test.ts

  reconstruction-readiness:
    name: Reconstruction readiness
@@ -428,12 +444,16 @@ jobs:
          tests/boundary/filesystem/safeOutputTree.test.ts
          tests/boundary/providers/native/artifactProvider.archiveSafety.test.ts
          tests/boundary/filesystem/setupUnavailableProvider.test.ts
+          tests/boundary/filesystem/windowsNpxRegistration.test.ts
+          src/application/ClientRegistrationIdentity.test.ts
+          tests/boundary/filesystem/webScriptManifestPaths.test.ts
+          tests/acceptance/webModuleCli.test.ts
+          tests/acceptance/webSourceLocationCli.test.ts
          tests/boundary/cli/referenceSourceImportStatus.test.ts
          src/cliReferenceSourceImportStatus.test.ts
          tests/boundary/filesystem/asarInventoryFreshness.test.ts
          tests/composition/javascript-applications/javascriptArtifactReconstruction.test.ts
          tests/conformance/providers/ghidra/windowsCapabilities.test.ts
-          tests/conformance/providers/ghidra/ghidraWindowsFixture.test.ts
          src/ghidra/GhidraInstallation.test.ts
          tests/boundary/providers/ghidra/ghidraTransport.test.ts
          tests/boundary/providers/ghidra/ghidraTargetSnapshot.test.ts
@@ -469,3 +489,13 @@ jobs:
          cache: npm
      - run: npm ci
      - run: npm run docs:check
+      - name: Generation leaves authored files unchanged
+        run: git diff --exit-code
+      - uses: actions/upload-artifact@v4
+        with:
+          name: generated-docs
+          path: |
+            docs/public/product-catalog.json
+            docs/verification/managed-conformance-*.json
+            skills/reverse-engineer-anything
+          if-no-files-found: error
@@ -0,0 +1,78 @@
+name: Real offline binary layout
+
+on:
+  workflow_dispatch:
+    inputs:
+      large_mcp:
+        description: "Also verify the complete 65,281-section result over MCP (slow)"
+        type: boolean
+        default: false
+  pull_request:
+    paths:
+      - ".github/workflows/real-binary-layout.yml"
+      - "bridge/pwntools/**"
+      - "src/native/pwntools/**"
+      - "src/domain/native/binaryLayout*"
+      - "src/application/binaryDiagnostics/**"
+      - "src/contracts/native/binaryDiagnosticsToolContracts.ts"
+      - "src/composition/binaryDiagnostics.ts"
+      - "src/server/registerBinaryDiagnosticsTools.ts"
+      - "src/server/createServer.ts"
+      - "src/cli/binaryDiagnosticsCommands.ts"
+      - "src/cli.ts"
+      - "src/cliCommandNames.ts"
+      - "src/contracts/toolContracts.ts"
+      - "src/contracts/toolEffects.ts"
+      - "src/process/OwnedCommand.ts"
+      - "src/process/ProviderProcess.ts"
+      - "src/process/ProviderDeadline.ts"
+      - "src/process/ProcessOwnership*.ts"
+      - "src/process/PrivateRuntimeRoot.ts"
+      - "src/artifacts/readStableArtifact*.ts"
+      - "src/artifacts/ArtifactReader.ts"
+      - "src/domain/analysisError*.ts"
+      - "scripts/verify-binary-layout.mjs"
+      - "scripts/lib/elf-section-name-fixtures.mjs"
+      - "scripts/lib/large-result-mcp.mjs"
+      - "scripts/fixtures/binary-layout*"
+      - "package.json"
+      - "package-lock.json"
+
+permissions:
+  contents: read
+
+concurrency:
+  group: real-binary-layout-${{ github.event.pull_request.number || github.ref }}
+  cancel-in-progress: true
+
+env:
+  NODE_OPTIONS: --max-old-space-size=768
+  HUSKY: "0"
+  REA_VERIFY_LARGE_ELF_MCP: ${{ inputs.large_mcp && '1' || '0' }}
+
+jobs:
+  real-binary-layout:
+    runs-on: ubuntu-24.04
+    timeout-minutes: 15
+    steps:
+      - uses: actions/checkout@v4
+      - uses: actions/setup-node@v4
+        with:
+          node-version-file: .nvmrc
+          cache: npm
+      - run: npm ci
+      - name: Acquire exact upstream libraries in an isolated runner environment
+        shell: bash
+        run: |
+          layout_python_root="${RUNNER_TEMP}/rea-pwntools-layout"
+          python3 -m venv "${layout_python_root}"
+          "${layout_python_root}/bin/python" -m pip install --disable-pip-version-check \
+            'pwntools==4.15.0' 'pyelftools==0.33' 'unicorn==2.1.2'
+          command -v gcc
+          command -v ld
+          command -v strip
+          command -v strace
+          echo "REA_PWNTOOLS_PYTHON=${layout_python_root}/bin/python" >> "${GITHUB_ENV}"
+          echo "REA_VERIFY_STRACE_COMMAND=$(command -v strace)" >> "${GITHUB_ENV}"
+      - name: Verify source-owned fixtures through public CLI and MCP
+        run: npm run verify:binary:layout
@@ -0,0 +1,66 @@
+name: Real offline EVM interface
+
+on:
+  workflow_dispatch:
+  pull_request:
+    paths:
+      - ".github/workflows/real-evm-interface.yml"
+      - "src/evm/**"
+      - "src/domain/evm/**"
+      - "src/application/evm/**"
+      - "src/contracts/evm/**"
+      - "src/composition/evm.ts"
+      - "src/cli/evmCommands.ts"
+      - "src/server/registerEvmTools.ts"
+      - "src/server/createServer.ts"
+      - "src/cli.ts"
+      - "src/cliCommandNames.ts"
+      - "src/contracts/toolContracts.ts"
+      - "src/contracts/toolEffects.ts"
+      - "src/process/OwnedCommand.ts"
+      - "src/process/ProviderProcess.ts"
+      - "src/process/ProcessOwnership*.ts"
+      - "src/process/ProviderDeadline.ts"
+      - "src/process/PrivateRuntimeRoot.ts"
+      - "src/artifacts/readStableArtifact*.ts"
+      - "src/artifacts/ArtifactReader.ts"
+      - "scripts/verify-evm-interface.mjs"
+      - "scripts/fixtures/evm-interface.sol"
+      - "third_party/evmole/**"
+      - "package.json"
+      - "package-lock.json"
+
+permissions:
+  contents: read
+
+concurrency:
+  group: real-evm-interface-${{ github.event.pull_request.number || github.ref }}
+  cancel-in-progress: true
+
+env:
+  NODE_OPTIONS: --max-old-space-size=768
+  HUSKY: "0"
+
+jobs:
+  real-evm-interface:
+    runs-on: ubuntu-24.04
+    timeout-minutes: 15
+    steps:
+      - uses: actions/checkout@v4
+      - uses: actions/setup-node@v4
+        with:
+          node-version-file: .nvmrc
+          cache: npm
+      - run: npm ci
+      - name: Acquire unchanged fixture compiler in isolated runner storage
+        shell: bash
+        run: |
+          evm_fixture_root="${RUNNER_TEMP}/rea-evm-fixture-compiler"
+          mkdir -p "${evm_fixture_root}"
+          npm install --prefix "${evm_fixture_root}" --ignore-scripts --no-audit --no-fund --save-exact solc@0.8.30
+          command -v prlimit
+          command -v strace
+          echo "REA_VERIFY_STRACE_COMMAND=$(command -v strace)" >> "${GITHUB_ENV}"
+          echo "REA_VERIFY_SOLC_MODULE=${evm_fixture_root}/node_modules/solc/index.js" >> "${GITHUB_ENV}"
+      - name: Verify source-owned compiled bytecode through public CLI and MCP
+        run: npm run verify:evm:interface
@@ -21,7 +21,14 @@ jobs:
        with:
          node-version-file: .nvmrc
      - name: Prepare cross compiler
-        run: sudo apt-get update && sudo apt-get install --no-install-recommends -y g++-mingw-w64-x86-64
+        run: |
+          for source in /etc/apt/apt-mirrors.txt /etc/apt/sources.list /etc/apt/sources.list.d/ubuntu.sources; do
+            if [ -f "$source" ]; then
+              sudo sed -i 's|azure.archive.ubuntu.com|archive.ubuntu.com|g; s|http://archive.ubuntu.com|https://archive.ubuntu.com|g' "$source"
+            fi
+          done
+          sudo apt-get update
+          sudo apt-get install --no-install-recommends -y g++-mingw-w64-x86-64
      - run: npm run build:windows-native
      - run: npm run verify:windows-native:artifact
      - uses: actions/upload-artifact@v4
@@ -53,10 +60,18 @@ jobs:
        env:
          REA_ANALYSIS_PROVIDER: ghidra
        run: npm run verify:ghidra:windows | Tee-Object -FilePath windows-ghidra-proof.log
+      - name: Verify native x86 Windows Ghidra operations
+        env:
+          REA_ANALYSIS_PROVIDER: ghidra
+        run: npm run verify:ghidra:windows -- --x86 | Tee-Object -FilePath windows-ghidra-x86-proof.log
      - name: Verify ordinary-user CLI and MCP operations
        env:
          REA_ANALYSIS_PROVIDER: ghidra
        run: npm run verify:ghidra:windows:package | Tee-Object -FilePath windows-ghidra-package-proof.log
+      - name: Verify ordinary-user x86 CLI and MCP operations
+        env:
+          REA_ANALYSIS_PROVIDER: ghidra
+        run: npm run verify:ghidra:windows:package -- --x86 | Tee-Object -FilePath windows-ghidra-x86-package-proof.log
      - uses: actions/upload-artifact@v4
        if: always()
        with:
@@ -64,4 +79,6 @@ jobs:
          path: |
            windows-ghidra-proof.log
            windows-ghidra-package-proof.log
+            windows-ghidra-x86-proof.log
+            windows-ghidra-x86-package-proof.log
          retention-days: 30
@@ -0,0 +1,99 @@
+name: Real recorded crash evidence
+
+on:
+  workflow_dispatch:
+  pull_request:
+    paths:
+      - ".github/workflows/real-recorded-crash.yml"
+      - "bridge/pwntools/**"
+      - "bridge/pwndbg/**"
+      - "src/native/pwntools/**"
+      - "src/native/pwndbg/**"
+      - "src/domain/native/recordedCrash*"
+      - "src/application/binaryDiagnostics/**"
+      - "src/contracts/native/binaryDiagnosticsToolContracts.ts"
+      - "src/contracts/toolEffects.ts"
+      - "src/contracts/toolOutputSchemaGroups.ts"
+      - "src/composition/binaryDiagnostics.ts"
+      - "src/server/registerRecordedCrashTools.ts"
+      - "src/server/createServer.ts"
+      - "src/server/sessionAvailabilityPolicy.ts"
+      - "src/cli/binaryDiagnosticsCommands.ts"
+      - "src/cliCommandNames.ts"
+      - "src/process/**"
+      - "src/artifacts/readStableArtifact*.ts"
+      - "src/domain/analysisError*.ts"
+      - "scripts/verify-recorded-crash.mjs"
+      - "scripts/verify/recorded-crash/**"
+      - "scripts/lib/recorded-core-fixtures.py"
+      - "scripts/fixtures/recorded-crash.c"
+      - "third_party/pwndbg/**"
+      - "package.json"
+      - "package-lock.json"
+
+permissions:
+  contents: read
+
+concurrency:
+  group: real-recorded-crash-${{ github.event.pull_request.number || github.ref }}
+  cancel-in-progress: true
+
+env:
+  NODE_OPTIONS: --max-old-space-size=768
+  HUSKY: "0"
+  UV_CONCURRENT_BUILDS: "1"
+  UV_CONCURRENT_INSTALLS: "1"
+  UV_PYTHON_DOWNLOADS: never
+
+jobs:
+  real-recorded-crash:
+    runs-on: ubuntu-24.04
+    timeout-minutes: 15
+    steps:
+      - uses: actions/checkout@v4
+      - uses: actions/setup-node@v4
+        with:
+          node-version-file: .nvmrc
+          cache: npm
+      - run: npm ci
+      - name: Install GDB on the disposable CI runner
+        shell: bash
+        run: |
+          sudo apt-get update -qq
+          sudo apt-get install --yes --no-install-recommends gdb
+      - name: Acquire exact unchanged upstreams in isolated runner storage
+        shell: bash
+        run: |
+          command -v gcc
+          command -v gdb
+          command -v strace
+          core_decoder_root="${RUNNER_TEMP}/rea-core-decoder"
+          core_pwndbg_root="${RUNNER_TEMP}/rea-core-pwndbg"
+          core_pwndbg_venv="${RUNNER_TEMP}/rea-core-pwndbg-venv"
+          python3 -m venv "${core_decoder_root}"
+          "${core_decoder_root}/bin/python" -m pip install --disable-pip-version-check \
+            'pwntools==4.15.0' 'pyelftools==0.33' 'unicorn==2.1.2' 'uv==0.12.0'
+          git init "${core_pwndbg_root}"
+          git -C "${core_pwndbg_root}" remote add origin https://github.com/pwndbg/pwndbg.git
+          git -C "${core_pwndbg_root}" fetch --depth=1 origin 55596aa676a2756efb8d67034f31675170eabe48
+          git -C "${core_pwndbg_root}" checkout --detach FETCH_HEAD
+          test "$(git -C "${core_pwndbg_root}" rev-parse HEAD)" = 55596aa676a2756efb8d67034f31675170eabe48
+          UV_PROJECT_ENVIRONMENT="${core_pwndbg_venv}" \
+            "${core_decoder_root}/bin/uv" sync --project "${core_pwndbg_root}" \
+            --frozen --no-editable --no-default-groups --python /usr/bin/python3 --no-managed-python
+          test -z "$(git -C "${core_pwndbg_root}" status --porcelain --untracked-files=no)"
+          echo "REA_PWNTOOLS_PYTHON=${core_decoder_root}/bin/python" >> "${GITHUB_ENV}"
+          echo "REA_PWNDBG_GDB=$(command -v gdb)" >> "${GITHUB_ENV}"
+          echo "REA_PWNDBG_GDBINIT=${core_pwndbg_root}/gdbinit.py" >> "${GITHUB_ENV}"
+          echo "REA_PWNDBG_VENV_PATH=${core_pwndbg_venv}" >> "${GITHUB_ENV}"
+          echo "REA_VERIFY_STRACE_COMMAND=$(command -v strace)" >> "${GITHUB_ENV}"
+      - name: Build and install the exact package in isolated runner storage
+        shell: bash
+        run: |
+          npm run build:cached
+          npm pack --ignore-scripts --json --pack-destination "${RUNNER_TEMP}" > "${RUNNER_TEMP}/rea-core-pack.json"
+          core_package_name=$(node -p 'JSON.parse(require("node:fs").readFileSync(process.argv[1], "utf8"))[0].filename' "${RUNNER_TEMP}/rea-core-pack.json")
+          npm install --prefix "${RUNNER_TEMP}/rea-core-installed" --ignore-scripts --no-fund --no-audit "${RUNNER_TEMP}/${core_package_name}"
+      - name: Verify installed CLI and MCP against the source-owned recording
+        shell: bash
+        run: node scripts/verify-recorded-crash.mjs "${RUNNER_TEMP}/rea-core-installed/node_modules/rea-agents/scripts/rea.mjs"
@@ -0,0 +1,75 @@
+name: Real historical web network captures
+
+on:
+  workflow_dispatch:
+  pull_request:
+    paths:
+      - ".github/workflows/real-web-network-captures.yml"
+      - "bridge/mitmproxy/**"
+      - "src/browser/history/**"
+      - "src/domain/webNetworkCapture*.ts"
+      - "src/domain/analysisError*.ts"
+      - "src/contracts/errorSchemas.ts"
+      - "src/domain/explicitSensitive*.ts"
+      - "src/application/WebNetworkCapture*"
+      - "src/composition/webNetworkCaptures.ts"
+      - "src/cli/webNetworkCaptureCommands.ts"
+      - "src/server/registerWebNetworkCaptureTool.ts"
+      - "src/server/createServer.ts"
+      - "src/server/toolRegistrationOptions.ts"
+      - "src/cli.ts"
+      - "src/cliCommandNames.ts"
+      - "src/contracts/toolContracts.ts"
+      - "src/contracts/toolEffects.ts"
+      - "src/process/OwnedCommand.ts"
+      - "src/process/ProviderProcess.ts"
+      - "src/process/ProviderDeadline.ts"
+      - "src/process/ProcessOwnership*.ts"
+      - "src/process/PrivateRuntimeRoot.ts"
+      - "src/process/capture/ProcessCaptureLifecycle.ts"
+      - "src/artifacts/readStableArtifact*.ts"
+      - "src/artifacts/ArtifactReader.ts"
+      - "src/contracts/webNetworkCaptureToolContracts.ts"
+      - "scripts/verify-web-network-captures.mjs"
+      - "scripts/fixtures/generate-mitmproxy-capture.py"
+      - "package.json"
+      - "package-lock.json"
+
+permissions:
+  contents: read
+
+concurrency:
+  group: real-web-network-captures-${{ github.event.pull_request.number || github.ref }}
+  cancel-in-progress: true
+
+env:
+  HUSKY: "0"
+  NODE_OPTIONS: --max-old-space-size=768
+
+jobs:
+  real-web-network-captures:
+    runs-on: ubuntu-24.04
+    timeout-minutes: 15
+    steps:
+      - uses: actions/checkout@v4
+      - uses: actions/setup-node@v4
+        with:
+          node-version-file: .nvmrc
+          cache: npm
+      - name: Use pinned package manager
+        run: npm install --global npm@11.16.0
+      - run: npm ci
+      - name: Acquire fixed upstream native profile in runner temporary storage
+        shell: bash
+        run: |
+          capture_tool_root="${RUNNER_TEMP}/rea-mitmproxy-12.2.3"
+          mkdir -p "${capture_tool_root}"
+          curl --fail --location --retry 3 --max-time 180 \
+            https://downloads.mitmproxy.org/12.2.3/mitmproxy-12.2.3-linux-x86_64.tar.gz \
+            --output "${capture_tool_root}/mitmproxy.tar.gz"
+          echo '2e95286b618fa6fd33e5e62a78c2e5112571d85f42ec2bac29b97ee242bdb5c5  mitmproxy.tar.gz' \
+            | (cd "${capture_tool_root}" && sha256sum --check --strict)
+          tar -xzf "${capture_tool_root}/mitmproxy.tar.gz" -C "${capture_tool_root}"
+          echo "REA_MITMDUMP_COMMAND=${capture_tool_root}/mitmdump" >> "${GITHUB_ENV}"
+      - name: Verify upstream producer fixtures through public CLI and MCP
+        run: npm run verify:web:network-captures
@@ -1,15 +1,24 @@
 name: Release

 on:
-  push:
-    branches: ["release/*"]
  workflow_dispatch:
+    inputs:
+      release_branch:
+        description: Frozen release branch (release/VERSION)
+        required: true
+        type: string
+      phase:
+        description: Prepare the release PR, or publish its reviewed merge
+        required: true
+        default: prepare
+        type: choice
+        options: [prepare, publish]

 env:
  HUSKY: "0"

 concurrency:
-  group: release-${{ github.ref }}
+  group: release-${{ inputs.release_branch }}
  cancel-in-progress: false

 jobs:
@@ -21,113 +30,154 @@ jobs:
      pull-requests: write
    outputs:
      release_created: ${{ steps.release.outputs.release_created }}
-      tag_name: ${{ steps.release.outputs.tag_name }}
      sha: ${{ steps.release.outputs.sha }}
    steps:
      - name: Validate release selection
        shell: bash
        env:
-          GH_TOKEN: ${{ github.token }}
-          RELEASE_BRANCH: ${{ github.ref_name }}
+          RELEASE_BRANCH: ${{ inputs.release_branch }}
+          RELEASE_PHASE: ${{ inputs.phase }}
        run: |
-          if [[ "${GITHUB_REF}" != "refs/heads/${RELEASE_BRANCH}" || "${RELEASE_BRANCH}" != release/* ]]; then
-            echo "Select a release/ branch; main and tags are not release checkpoints." >&2
+          if [[ "${RELEASE_PHASE}" != prepare && "${RELEASE_PHASE}" != publish ]]; then
+            echo "phase must be prepare or publish." >&2
+            exit 1
+          fi
+          if [[ "${RELEASE_PHASE}" == prepare && "${GITHUB_REF}" != "refs/heads/main" ]]; then
+            echo "Run prepare from main; release_branch selects the frozen source." >&2
+            exit 1
+          fi
+          if [[ "${RELEASE_PHASE}" == publish && "${GITHUB_REF}" != "refs/heads/${RELEASE_BRANCH}" ]]; then
+            echo "Run publish from the selected frozen release branch so npm provenance records its source." >&2
+            exit 1
+          fi
+          if [[ ! "${RELEASE_BRANCH}" =~ ^release/[^/]+$ ]]; then
+            echo "release_branch must select a release/ branch; main is not a release checkpoint." >&2
            exit 1
          fi
          if ! git check-ref-format "refs/heads/${RELEASE_BRANCH}"; then
-            echo "Invalid release branch: ${RELEASE_BRANCH}" >&2
+            echo "Invalid release_branch: ${RELEASE_BRANCH}" >&2
            exit 1
          fi
-          selected_sha="$(gh api "repos/${GITHUB_REPOSITORY}/git/ref/heads/${RELEASE_BRANCH}" --jq '.object.sha')"
-          if [[ "${selected_sha}" != "${GITHUB_SHA}" ]]; then
-            echo "The release branch moved after this run was triggered; review its new checkpoint before publication." >&2
+
+      - name: Resolve release branch tip
+        id: branch
+        shell: bash
+        env:
+          GH_TOKEN: ${{ github.token }}
+          RELEASE_BRANCH: ${{ inputs.release_branch }}
+        run: |
+          sha="$(gh api "repos/${GITHUB_REPOSITORY}/git/ref/heads/${RELEASE_BRANCH}" --jq '.object | select(.type == "commit") | .sha')"
+          if [[ ! "${sha}" =~ ^[0-9a-f]{40}$ ]]; then
+            echo "The release branch tip is not a commit." >&2
            exit 1
          fi
-          printf 'Selected release checkpoint: %s\n' "${selected_sha}"
+          echo "sha=${sha}" >> "${GITHUB_OUTPUT}"
+
+      - name: Require the publish dispatch to match the branch tip
+        if: inputs.phase == 'publish'
+        shell: bash
+        env:
+          BRANCH_SHA: ${{ steps.branch.outputs.sha }}
+        run: |
+          if [[ "${BRANCH_SHA}" != "${GITHUB_SHA}" ]]; then
+            echo "The release branch tip differs from the dispatched checkpoint; refusing to create a release for a moved source." >&2
+            exit 1
+          fi
+
+      - name: Check out release controller and Git history
+        uses: actions/checkout@v6
+        with:
+          ref: ${{ github.sha }}
+          fetch-depth: 0
+          persist-credentials: false
+
+      - name: Set up Node.js for checkpoint validation
+        uses: actions/setup-node@v6
+        with:
+          node-version-file: .nvmrc
+          package-manager-cache: false
+
+      - name: Install checkpoint validation dependencies
+        run: npm ci
+
+      - name: Validate checkpoint version and ancestry before release creation
+        env:
+          RELEASE_PHASE: ${{ inputs.phase }}
+          RELEASE_BRANCH: ${{ inputs.release_branch }}
+          SOURCE_SHA: ${{ steps.branch.outputs.sha }}
+        run: >-
+          node scripts/verify-release-checkpoint.mjs
+          --phase "$RELEASE_PHASE" --release-branch "$RELEASE_BRANCH"
+          --source-sha "$SOURCE_SHA"

      - uses: googleapis/release-please-action@v4
        id: release
        with:
-          # A dedicated credential lets release-PR updates trigger CI. GitHub
-          # requires manual approval for pull_request events from GITHUB_TOKEN.
+          # A dedicated credential starts PR CI automatically; the built-in
+          # token creates approval-required PR runs for maintainers to approve.
          token: ${{ secrets.RELEASE_PLEASE_TOKEN || secrets.GITHUB_TOKEN }}
-          target-branch: ${{ github.ref_name }}
+          target-branch: ${{ inputs.release_branch }}
+          skip-github-release: ${{ inputs.phase == 'prepare' }}
+          skip-github-pull-request: ${{ inputs.phase == 'publish' }}

-      - name: Bind publication to the triggering checkpoint
-        if: steps.release.outputs.release_created == 'true'
+      - name: Require a merged release PR for publication
+        if: inputs.phase == 'publish' && steps.release.outputs.release_created != 'true'
+        run: |
+          echo "No new release was created. Merge the reviewed release PR into its frozen branch before publishing. For a partial publication, re-run failed jobs in the original run." >&2
+          exit 1
+
+      - name: Bind publication to the dispatched checkpoint
+        if: inputs.phase == 'publish' && steps.release.outputs.release_created == 'true'
        shell: bash
        env:
          RELEASE_SHA: ${{ steps.release.outputs.sha }}
        run: |
          if [[ "${RELEASE_SHA}" != "${GITHUB_SHA}" ]]; then
-            echo "The tagged release SHA differs from the triggering checkpoint; refusing to publish mismatched source provenance." >&2
+            echo "The tagged release SHA differs from the dispatched checkpoint; refusing to publish mismatched source provenance. The GitHub release already exists; do not dispatch publish again." >&2
            exit 1
          fi

      - name: Check out release pull request
-        if: steps.release.outputs.prs_created == 'true'
+        if: inputs.phase == 'prepare' && steps.release.outputs.prs_created == 'true'
        uses: actions/checkout@v6
        with:
          ref: ${{ fromJSON(steps.release.outputs.pr).headBranchName }}
+          fetch-depth: 0
          persist-credentials: false

      - name: Set up Node.js for generated documentation
-        if: steps.release.outputs.prs_created == 'true'
+        if: inputs.phase == 'prepare' && steps.release.outputs.prs_created == 'true'
        uses: actions/setup-node@v6
        with:
          node-version-file: .nvmrc
          package-manager-cache: false

      - name: Install dependencies
-        if: steps.release.outputs.prs_created == 'true'
+        if: inputs.phase == 'prepare' && steps.release.outputs.prs_created == 'true'
        run: npm ci

+      - name: Validate prepared release version and migration notes
+        if: inputs.phase == 'prepare' && steps.release.outputs.prs_created == 'true'
+        env:
+          RELEASE_BRANCH: ${{ inputs.release_branch }}
+          SOURCE_SHA: ${{ steps.branch.outputs.sha }}
+        run: >-
+          node scripts/verify-release-checkpoint.mjs
+          --phase prepare --stage candidate --release-branch "$RELEASE_BRANCH"
+          --source-sha "$SOURCE_SHA"
+
      - name: Regenerate release documentation
-        if: steps.release.outputs.prs_created == 'true'
+        if: inputs.phase == 'prepare' && steps.release.outputs.prs_created == 'true'
        run: npm run docs:generate

-      - name: Commit canonical release catalog
-        if: steps.release.outputs.prs_created == 'true'
-        shell: bash
-        env:
-          # Use the same identity for the follow-up commit so it also triggers CI.
-          GH_TOKEN: ${{ secrets.RELEASE_PLEASE_TOKEN || secrets.GITHUB_TOKEN }}
-          RELEASE_PR_JSON: ${{ steps.release.outputs.pr }}
-        run: |
-          release_pr_branch="$(node --input-type=module -e '
-            const value = JSON.parse(process.env.RELEASE_PR_JSON ?? "");
-            if (
-              typeof value !== "object" ||
-              value === null ||
-              typeof value.headBranchName !== "string" ||
-              value.headBranchName.length === 0
-            ) {
-              process.exit(1);
-            }
-            process.stdout.write(value.headBranchName);
-          ')"
-          changed_paths="$(git diff --name-only)"
-          if [[ -z "${changed_paths}" ]]; then
-            echo "Release documentation is already canonical."
-            exit 0
-          fi
-          if [[ "${changed_paths}" != "docs/product-catalog.json" ]]; then
-            echo "docs:generate changed unexpected tracked paths:" >&2
-            printf '%s\n' "${changed_paths}" >&2
-            exit 1
-          fi
-          git diff --check
-          git config user.name "github-actions[bot]"
-          git config user.email "41898282+github-actions[bot]@users.noreply.github.com"
-          git add -- docs/product-catalog.json
-          git commit -m "chore: normalize release product catalog"
-          gh auth setup-git
-          git push origin "HEAD:${release_pr_branch}"
+      - name: Validate generated release documentation
+        if: inputs.phase == 'prepare' && steps.release.outputs.prs_created == 'true'
+        run: npm run docs:check && git diff --exit-code

  publish:
    name: Publish to npm
    needs: release-please
-    if: needs.release-please.outputs.release_created == 'true'
+    if: inputs.phase == 'publish' && needs.release-please.outputs.release_created == 'true'
    runs-on: ubuntu-latest
    permissions:
      contents: read
@@ -173,28 +223,32 @@ jobs:
          verification_root="$(mktemp -d)"
          trap 'rm -rf -- "${verification_root}"' EXIT
          cd "${verification_root}"
-          for attempt in $(seq 1 80); do
+          max_attempts=120
+          sleep_seconds=15
+          total_window_minutes=$((max_attempts * sleep_seconds / 60))
+          for attempt in $(seq 1 "${max_attempts}"); do
            published_version="$(npm view --prefer-online "rea-agents@${version}" version --json 2>/dev/null || true)"
            if [ "${published_version}" = "\"${version}\"" ]; then
-              echo "rea-agents@${version} is visible on npm after attempt ${attempt}; verifying the published CLI."
+              echo "rea-agents@${version} is visible on npm after attempt ${attempt}/${max_attempts}; verifying the published CLI."
              npm exec --yes --package="rea-agents@${version}" -- rea --help
              npm exec --yes --package="rea-agents@${version}" -- rea --llms
              node "${GITHUB_WORKSPACE}/scripts/verify-published-package.mjs" "${version}"
              exit 0
            else
-              echo "rea-agents@${version} is not visible on npm yet (attempt ${attempt}/80; up to 20 minutes)" >&2
+              echo "rea-agents@${version} is not visible on npm yet (attempt ${attempt}/${max_attempts}; up to ${total_window_minutes} minutes)" >&2
            fi
-            if [ "${attempt}" -lt 80 ]; then
-              sleep 15
+            if [ "${attempt}" -lt "${max_attempts}" ]; then
+              sleep "${sleep_seconds}"
            fi
          done
-          echo "rea-agents@${version} did not become visible on npm within 20 minutes" >&2
+          echo "rea-agents@${version} did not become visible on npm within ${total_window_minutes} minutes (${max_attempts} attempts × ${sleep_seconds}s)" >&2
+          echo "This indicates npm registry propagation delay, not a CLI verification failure." >&2
          exit 1

  publish-mcp:
    name: Publish to MCP Registry
    needs: [release-please, publish]
-    if: needs.release-please.outputs.release_created == 'true' && needs.publish.result == 'success'
+    if: inputs.phase == 'publish' && needs.release-please.outputs.release_created == 'true' && needs.publish.result == 'success'
    runs-on: ubuntu-latest
    permissions:
      contents: read
@@ -2,7 +2,7 @@ name: Website checks

 on:
  pull_request:
-    branches: [main]
+    branches: [main, "release/*"]
    paths:
      - "website/**"
      - "scripts/verify-website.py"
@@ -38,6 +38,7 @@ test-results.xml
 .turbo/
 .cache/
 docs/.vitepress/cache/
+docs/.vitepress/dist/

 # OS
 .DS_Store
@@ -48,3 +49,13 @@ Thumbs.db

 # Generated website download
 /website/public/examples/notes-example.zip
+
+# Build-generated MCP tool catalog (regenerated by `npm run build`; never commit)
+src/generatedMcpToolCatalog.ts
+
+# Derived catalogs, portable conformance projections, and packaged skill bundles
+# (regenerated from this checkout by `npm run build:cached`; never commit)
+/skills/
+/docs/public/product-catalog.json
+/docs/verification/managed-conformance-manifest.json
+/docs/verification/managed-conformance-ledger.json
@@ -1,3 +1,3 @@
 {
-  ".": "5.0.0"
+  ".": "6.0.0"
 }
@@ -2,7 +2,7 @@

 ## Product Direction

-REA exposes reverse-engineering tools through a CLI and MCP server. Hopper, the bring-your-own Ghidra adapter, and the bring-your-own IDA MCP adapter are operation-capable deep binary-analysis providers. Ghidra is supported on Linux x64 and macOS x64/arm64 with matching native decompiler tools, and has an experimental Windows x64 P0 boundary for approved native x86-64 PE applications; on Linux and macOS it supplies inventory, function analysis, and atomic function annotation edits in an ephemeral database, without modifying executable bytes or controlling a GUI. Windows P0 has no mutation authority. IDA adapts upstream legacy attached GUI and modern headless database-supervisor profiles for live read-only analysis; initial real verification covers Windows, and an attached GUI database is never saved or closed. Keep provider-specific code out of the domain and application layers.
+REA exposes reverse-engineering tools through a CLI and MCP server. Hopper, the bring-your-own Ghidra adapter, and the bring-your-own IDA MCP adapter are operation-capable deep binary-analysis providers. Ghidra is supported on Linux x64 and macOS x64/arm64 with matching native decompiler tools, and has an experimental Windows x64 P0 boundary for approved native x86 and x86-64 PE applications; on Linux and macOS it supplies inventory, function analysis, and atomic function annotation edits in an ephemeral database, without modifying executable bytes or controlling a GUI. Windows P0 has no mutation authority. IDA adapts upstream legacy attached GUI and modern headless database-supervisor profiles for live read-only analysis; initial real verification covers Windows, and an attached GUI database is never saved or closed. Keep provider-specific code out of the domain and application layers.

 Prioritize:

@@ -21,10 +21,11 @@ REA is a layered ESM TypeScript application. Dependencies flow inward from pure

 - `src/domain/` owns pure provider-neutral semantics; `src/contracts/` owns caller-visible schemas and the canonical tool inventory.
 - `src/hopper/`, `src/ghidra/`, `src/ida/`, `src/browser/`, `src/inspector/`, `src/native/`, `src/artifacts/`, and `src/dotnet/` own provider-specific boundaries. Keep provider protocols out of domain and application code.
- `src/application/` composes shared CLI/MCP workflows; `src/server/` translates MCP requests; `src/cli.ts` and `src/main.ts` are the CLI and MCP entry points.
- `src/process/` owns shared process lifecycle primitives, not provider wire protocols. `bridge/` contains provider-side adapters.
+- `src/application/` composes shared CLI/MCP workflows, including Evidence provenance, unknowns, and eligible snapshot bindings; `src/server/` translates MCP requests; `src/cli.ts` and `src/main.ts` are the CLI and MCP entry points.
+- `src/process/` owns shared process lifecycle primitives, not provider wire protocols. Reuse its supervision and identity primitives before adding provider-local lifecycle code; a PID and executable pathname alone do not establish ownership after exit or reuse. `bridge/` contains provider-side adapters.
 - `tests/` contains unit, composition, boundary, acceptance, and conformance tests. `scripts/verify-*` and capability directories under `scripts/verify/` contain real-toolchain checks.
- `docs/product-catalog.json` is generated. Update its source contracts and regenerate it; do not edit it directly.
+- `docs/public/product-catalog.json`, `docs/verification/managed-conformance-*.json`, and `skills/` are ignored build outputs. Update source contracts and authored instructions in `skill-src/`, then run `npm run build:cached`; never commit derived catalog digests or portable conformance projections.
+- `src/generatedMcpToolCatalog.ts` is build-generated and gitignored. Never commit it; resolve any trace of it in merges by deleting it and running `npm run build:cached`.

 ## Build, Test, and Development Commands

@@ -35,7 +36,7 @@ REA is a layered ESM TypeScript application. Dependencies flow inward from pure
 - `npm run check:changed`: run cached static checks and source tests affected since the branch merge base (default `origin/main`).
 - `npm run check:fast`: run cached typecheck and lint checks.
 - `npm run check:pr`: opt into the complete local deterministic gate and generated-document checks for broad changes; CI owns full coverage. Routine iterations need focused tests and relevant checks, not the whole gate each time.
- `npm run docs:check`: check committed generated documents; `npm run docs:generate` regenerates them.
+- `npm run docs:check`: build and validate generated documents for the current checkout; `npm run docs:generate` regenerates them. CI retains ignored outputs as artifacts and does not push snapshot commits to feature branches.
 - For provider-dependent changes, see [docs/testing.md](docs/testing.md) and run the matching real-provider verification.
 - Keep each verification lane's prerequisites limited to the claim it checks. Use host-native fixtures for host/provider acceptance; put optional cross-target formats and their external toolchains in a separate lane. Preflight required commands and report the missing dependency and lane clearly.

@@ -53,9 +54,11 @@ Use ESM TypeScript, two-space indentation, and the committed Oxfmt configuration

 Treat a boundary as a contract between the producer's actual representation and the consumer's required meaning. When implementing or auditing a boundary, trace the value through parsing, normalization, authorization, serialization, and the CLI/MCP result. Establish affected callers from their code paths; similar tool names or workflows do not prove that they share a schema or failure mode.

-Keep portable evidence and scenario validation distinct from host-native execution checks. Absolute filesystem paths, file URLs, and HTTP paths have different semantics; do not substitute one platform's syntax for the domain concept. Interpret provider metadata according to its documented or observed producer behavior. When a transformation loses information, preserve the reported value and an explicit unknown rather than guessing a canonical identity.
+When changing boundary behavior, inspect adjacent input representations, failure paths, and affected callers, and correct the underlying assumption across those cases.

-Preserve meaningful failure reasons through application and adapter layers. Malformed input is distinct from an unsupported target, unavailable provider, or host operating-system permission denial. Diagnostics should identify the failed constraint and the target or lifecycle request it applies to. Recovery advice must address that reason and point to an available workflow; generic catches must not erase actionable validation details.
+Keep portable evidence and scenario validation distinct from host-native execution checks. Absolute filesystem paths, file URLs, and HTTP paths have different semantics; do not substitute one platform's syntax for the domain concept. Interpret provider metadata according to its documented or observed producer behavior. Keep values used for identity, provenance, matching, and path resolution separate from display formatting. When normalization loses information, preserve the source value and an explicit unknown; display placeholders must not feed back into lookup or selection.
+
+Preserve meaningful failure reasons through application and adapter layers. Malformed input is distinct from an unsupported target, unavailable provider, or host operating-system permission denial. Diagnostics should identify the failed constraint and the target or lifecycle request it applies to. Recovery advice must address that reason and point to an available workflow; generic catches must not erase actionable validation details. Preserve collected observations on execution failure independently of whether cleanup succeeds.

 Leave meaningful target, action, capture, and output choices to the agent. A selected operation already expresses intent; do not require approval booleans or repeated permission declarations. Trace each setting to its consumer: remove ignored options and single-value confirmations, derive built-in lifecycle behavior, and supply defaults for omitted optional metadata. Report actual effects and limitations where they help interpret results rather than asking callers to restate them.

@@ -79,7 +82,7 @@ Let agents compose experiments with ordinary commands, scripts, and local fixtur
 - Use **observe/capture** only when runtime activity is required, and declare authority and lifecycle effects in the contract.
 - Extend an existing tool when intent and result contract are unchanged. Add a tool for a distinct analyst outcome or materially different authority.
 - Keep caller-facing names and results provider-neutral. Put engine-specific behavior in provider adapters and report each provider's exact coverage.
- Keep results complete by default. Add a limit only when it follows from a real format, protocol, authority, or resource-safety constraint; explain truncation and unsupported facets. Keep observed, derived, inferred, and unknown results distinct.
+- Keep results complete by default. Add a limit only when it follows from a real format, protocol, authority, or resource-safety constraint; explain truncation and unsupported facets. Account for representation expansion and products of independently bounded dimensions before allocating or retaining output. Derive facet completeness from what was examined and exhausted, not an empty failure list. Keep observed, derived, inferred, and unknown results distinct.
 - Include artifact identity, source locations, Evidence references, actionable errors, and relevant limitations when they affect conclusions. Return the evidence needed for the next analysis inline rather than requiring a resource or identifier lookup.
 - Implement shared application workflows behind CLI and MCP adapters. Update canonical contracts and generated catalog together.

@@ -1,5 +1,104 @@
 # Changelog

+## [6.0.0](https://github.com/morluto/rea/compare/rea-agents-5.0.0...rea-agents-6.0.0) (2026-10-08)
+
+
+### ⚠ BREAKING CHANGES
+
+* **contracts:** MCP filesystem inputs now require absolute host paths, including target/snapshot paths, evidence bundle paths, managed and firmware inputs, browser/Electron launch paths and expected server paths. Calls such as `open_binary({"path":"./app"})` must send an absolute path such as `/home/analyst/app` or `C:\analysis\app`. Optional paths remain optional. CLI operator-relative paths continue to work. See [#948](https://github.com/morluto/rea/pull/948) and [#1004](https://github.com/morluto/rea/pull/1004).
+
+### Features
+
+* **artifacts:** trace Mach-O dylib resolution in bundles ([78d594c](https://github.com/morluto/rea/commit/78d594cacd376725f833a99402069c103aae9aac))
+* **browser:** inspect historical web network captures ([#992](https://github.com/morluto/rea/issues/992)) ([2bf3663](https://github.com/morluto/rea/commit/2bf3663f654386c9fd8c1437c49659df97bd4697))
+* **evm:** inspect offline bytecode interfaces through EVMole ([#1051](https://github.com/morluto/rea/issues/1051)) ([7af7bc8](https://github.com/morluto/rea/commit/7af7bc88ce0e8f084eaa0db1e8f834d495440fd9))
+* **ghidra:** support native x86 PE applications on Windows ([#1030](https://github.com/morluto/rea/issues/1030)) ([c6dad93](https://github.com/morluto/rea/commit/c6dad932084032bcb32acc61e8066a7784497710))
+* **native:** inspect offline ELF layout through pwntools ([#1037](https://github.com/morluto/rea/issues/1037)) ([4fc6565](https://github.com/morluto/rea/commit/4fc6565b0ffb36d7105b3524e08d0c5d603ae07d))
+* **native:** inspect recorded crashes through pwntools and pwndbg ([#1054](https://github.com/morluto/rea/issues/1054)) ([163ee09](https://github.com/morluto/rea/commit/163ee09a7425479385e0ed0b5d74043e2587eab2))
+* **native:** observe function and Objective-C method calls under LLDB ([1d13cef](https://github.com/morluto/rea/commit/1d13cef5f46f5e07f594bde7b1a4725f189b9a5e))
+
+
+### Bug Fixes
+
+* **dotnet:** validate managed metadata and CIL boundaries ([#938](https://github.com/morluto/rea/pull/938)) ([bda4ada](https://github.com/morluto/rea/commit/bda4ada7fb6bd7dd70a444bb3c57e34f7f5cc00b))
+
+* **build:** clarify generated-file check hint and drop redundant catalog step ([#998](https://github.com/morluto/rea/pull/998)) ([6f0ef16](https://github.com/morluto/rea/commit/6f0ef160501ea3b24dfa2939dfcd3eea0dc13ee7))
+
+* **release:** extend npm propagation window and improve diagnostics ([#943](https://github.com/morluto/rea/pull/943)) ([06b047a](https://github.com/morluto/rea/commit/06b047a0929369d5b8635b3651da115c8fcd53a7))
+
+* **contracts:** require absolute local paths for session filesystem inputs ([#948](https://github.com/morluto/rea/pull/948)) ([5b172b1](https://github.com/morluto/rea/commit/5b172b1042fc09a4e12d956018f15d86cf397ffe))
+
+* **ci:** generate source catalog before shard tests ([#1002](https://github.com/morluto/rea/pull/1002)) ([eb8f649](https://github.com/morluto/rea/commit/eb8f6491a88bfa79d13f7923e4ef94d791f6ba4d))
+
+* **contracts:** require absolute local paths for remaining caller-supplied file inputs ([#1004](https://github.com/morluto/rea/pull/1004)) ([cbc0dd1](https://github.com/morluto/rea/commit/cbc0dd1e7ca36fa3504a9ea8eae303a0876b176b))
+
+* **cli:** classify ENOTDIR JSON input failures ([#1000](https://github.com/morluto/rea/pull/1000)) ([a6132be](https://github.com/morluto/rea/commit/a6132be0546d6a9e3fa83426c8b59b1280b3e5bd))
+
+* **browser:** preserve authorized redirect hops ([#986](https://github.com/morluto/rea/pull/986)) ([ae0f725](https://github.com/morluto/rea/commit/ae0f725fad368730c6198d49716ccc410bca0536))
+
+* **mcp:** reject unknown MCP tool inputs ([#975](https://github.com/morluto/rea/pull/975)) ([fe64fd6](https://github.com/morluto/rea/commit/fe64fd65d93eff202ad90145544dc9ff84651974))
+
+* **release:** publish from explicit source checkpoints ([#1003](https://github.com/morluto/rea/pull/1003)) ([64c7188](https://github.com/morluto/rea/commit/64c71880ae4f7bc658ffce46eb729c4141dbdf19))
+
+* **release:** publish from explicit source checkpoints ([#1006](https://github.com/morluto/rea/pull/1006)) ([b4fc0ec](https://github.com/morluto/rea/commit/b4fc0ecaa1f6b912dc27880e6b6127ace47abc2e))
+
+* **javascript:** bound semantic node projection for resource safety ([#966](https://github.com/morluto/rea/pull/966)) ([96a46ad](https://github.com/morluto/rea/commit/96a46ada0a36f0349f2b0fc20b4c932401b4ad84))
+
+* **ci:** avoid slow Azure archive for the native cross compiler ([#1016](https://github.com/morluto/rea/issues/1016)) ([51956c1](https://github.com/morluto/rea/commit/51956c1a49a7dc9ed70a6fba480a670a7e7b2b9b))
+* **ci:** decouple stdio smoke tests from Linux display probes ([#1014](https://github.com/morluto/rea/issues/1014)) ([93731e1](https://github.com/morluto/rea/commit/93731e17ddea76db86dfa84bb54536dcf8ebfa0b))
+* **cli:** stream large JavaScript JSON results ([#1024](https://github.com/morluto/rea/issues/1024)) ([0e25bef](https://github.com/morluto/rea/commit/0e25befe78f220691abe5d0291cc04a75c9cc877))
+* **javascript:** complete large-ASAR analysis with file-local projection ([#1055](https://github.com/morluto/rea/issues/1055)) ([b9fb438](https://github.com/morluto/rea/commit/b9fb43883570bef7cb29fd16f27c25d5a7e5bb54))
+* **javascript:** recognize digits in artifact URI schemes ([#1045](https://github.com/morluto/rea/issues/1045)) ([03424ae](https://github.com/morluto/rea/commit/03424ae91ef22efd57db1bdde9379a3ac450b8f7))
+* **javascript:** reconstruct HTML script loads accurately ([#1042](https://github.com/morluto/rea/issues/1042)) ([1154f2f](https://github.com/morluto/rea/commit/1154f2f03c0b0bb6cb6c5da09b8d8e1c837febc4))
+* **javascript:** report application analysis progress on the CLI ([#1008](https://github.com/morluto/rea/issues/1008)) ([7b18c58](https://github.com/morluto/rea/commit/7b18c581409848077de7a9cb6d7d1a0b91a02e12))
+* **javascript:** resolve module URLs and reject invalid exports targets ([#1031](https://github.com/morluto/rea/issues/1031)) ([8d5c88f](https://github.com/morluto/rea/commit/8d5c88f17cde4ab4fa54c5142f0a45e612619a53))
+* **javascript:** resolve root package exports arrays ([#1046](https://github.com/morluto/rea/issues/1046)) ([53409ab](https://github.com/morluto/rea/commit/53409ab1968d60c77f98feedefe237a08859a95c))
+* **mcp:** advertise JSON values without recursive schemas ([#995](https://github.com/morluto/rea/issues/995)) ([7425f70](https://github.com/morluto/rea/commit/7425f70fd0247a7ea7192deb959fd6f48ba83a21)), closes [#919](https://github.com/morluto/rea/issues/919)
+* **mcp:** bound capture comparison input schema depth ([#1005](https://github.com/morluto/rea/issues/1005)) ([6b55de0](https://github.com/morluto/rea/commit/6b55de017badc9066642e1ff2561eb1da0ff93f8))
+* **process:** preserve partial evidence and verify detached cleanup ([#1011](https://github.com/morluto/rea/issues/1011)) ([63cf28f](https://github.com/morluto/rea/commit/63cf28fd8f8acaf656e993300a2a24280b2fd692))
+* **release:** support built-in credentials and refresh release boundary ([6a278a6](https://github.com/morluto/rea/commit/6a278a68dd4fa69b9153697ecb7bba7de4c55c32))
+* **release:** support default credentials and record 5.0.0 boundary ([#1012](https://github.com/morluto/rea/issues/1012)) ([6a278a6](https://github.com/morluto/rea/commit/6a278a68dd4fa69b9153697ecb7bba7de4c55c32))
+* **release:** sync 5.0.0 checkpoint back to main ([966cca8](https://github.com/morluto/rea/commit/966cca8efe5ed08b3285cd06409688d871eb5e6b))
+* **snapshot:** replay validated workflow evidence ([#984](https://github.com/morluto/rea/issues/984)) ([1d62e54](https://github.com/morluto/rea/commit/1d62e54e1f976e64130e4e9b651c3180aa4fa727))
+* **windows:** allow Java to read retained target snapshots ([#1027](https://github.com/morluto/rea/issues/1027)) ([28d5c39](https://github.com/morluto/rea/commit/28d5c397c83f901e4086083868041711371ad32a))
+
+
+### Performance Improvements
+
+* **artifacts:** replace quadratic ZIP overlap checks ([#1013](https://github.com/morluto/rea/issues/1013)) ([76e7e51](https://github.com/morluto/rea/commit/76e7e510bb2d7d37728ca50749d524beb5890cf8))
+* **javascript:** cache canonical export comparison sort keys ([#1028](https://github.com/morluto/rea/issues/1028)) ([63ba742](https://github.com/morluto/rea/commit/63ba7424c0ab69b94397e8913f8e231de111583f))
+
+
+### Code Refactoring
+
+* **build:** generate MCP tool catalog at build time instead of committing it ([#997](https://github.com/morluto/rea/pull/997)) ([35a4e18](https://github.com/morluto/rea/commit/35a4e18d3028014e24d2e209ec99a590fde63152))
+
+* **process:** separate capture implementation from analyst workflows ([#988](https://github.com/morluto/rea/pull/988)) ([6aa9afb](https://github.com/morluto/rea/commit/6aa9afb5493a97801eb1126a0dcf11f9705165db))
+
+* **artifacts:** move inventory and extraction into provider owners ([#1032](https://github.com/morluto/rea/issues/1032)) ([6e4535c](https://github.com/morluto/rea/commit/6e4535c1011f1982e9ab07b7ebcd600c19cd494d))
+* remove abandoned test-only analysis scaffolding ([c93422a](https://github.com/morluto/rea/commit/c93422a898fdbedb7d28709144b4337a2669440b))
+
+
+### Documentation
+
+* improve Korean wording and particles ([#1047](https://github.com/morluto/rea/issues/1047)) ([c5d165b](https://github.com/morluto/rea/commit/c5d165bd03fed95a0b0105661d3ba7e0efbfa449))
+* simplify the English README and organize guides ([#1043](https://github.com/morluto/rea/issues/1043)) ([28f10cf](https://github.com/morluto/rea/commit/28f10cf2bc7b7c590700b50d47072015f3e3c66e))
+
+
+### Tests
+
+* **process:** wait for observable snapshot ctime changes ([#999](https://github.com/morluto/rea/pull/999)) ([161ed91](https://github.com/morluto/rea/commit/161ed9157134d5c3b0fbae19ceb756ac58a26c04))
+
+* **browser:** consolidate CDP workflows and colocate parser coverage ([2682904](https://github.com/morluto/rea/commit/26829045d0f0e744bb60d6babc2dc3312f4bfa53))
+* **ci:** stabilize browser source identity fixture delivery ([#1023](https://github.com/morluto/rea/issues/1023)) ([ed725da](https://github.com/morluto/rea/commit/ed725dace4a689e4e5c804dc6bf06c7fc663c7c9))
+* **cli:** reduce repeated startup and filesystem setup ([d88d6c1](https://github.com/morluto/rea/commit/d88d6c1897740ccbd6c57f4ba01861fc751fb3a8))
+* consolidate service and process fixtures ([f8a53a8](https://github.com/morluto/rea/commit/f8a53a8c065f1ccbdaa051a4e1ef267a2047d759))
+* **javascript:** consolidate source analysis and export regressions ([f517a5a](https://github.com/morluto/rea/commit/f517a5a1d7c0766ed50f8dfd5ee69e65525ac744))
+* **javascript:** cover plain long-line loader identities ([#1025](https://github.com/morluto/rea/issues/1025)) ([984fc27](https://github.com/morluto/rea/commit/984fc27ce19d57f708bdae688a258cf8663cdea6))
+* **mcp:** consolidate SDK schema checks and scenario ports ([9c3479e](https://github.com/morluto/rea/commit/9c3479ed95100d8ee5ed4d9158a4550e4ac2a752))
+* **providers:** verify framing through client socket boundaries ([1fd1989](https://github.com/morluto/rea/commit/1fd1989d342375a01b6d14b282ad58001b7d1800))
+* prune redundant conformance checks and document test priorities ([aafdf8a](https://github.com/morluto/rea/commit/aafdf8a01b42fb6fd927c0f2a66e758e1a510abc))
+
 ## [5.0.0](https://github.com/morluto/rea/compare/rea-agents-4.1.0...rea-agents-5.0.0) (2026-10-07)


@@ -28,19 +28,21 @@ Keep dependencies flowing inward through the existing domain, contracts, provide

 ## Documentation website

-The VitePress site uses the Markdown files in `docs/` and deploys to
-<https://morluto.github.io/rea/>. Run `npm run docs:dev` for live editing,
-`npm run docs:build` to check the production build and links, and
-`npm run docs:preview` to preview that build at `/rea/`.
+The VitePress site uses the Markdown files in `docs/`. Run `npm run docs:dev`
+for live editing, `npm run docs:build` to check the production build and
+links, and `npm run docs:preview` to preview that build at `/rea/`.

 Site navigation lives in `docs/.vitepress/config.ts`. Keep links to guides
 relative so they work on GitHub and the website; link to repository files
 outside `docs/` using their full GitHub URLs. Generated reference documents
-still use `npm run docs:generate`; `docs:build` only builds the website.
+use `npm run docs:generate`; `docs:build` generates them before building the website.

-The documentation workflow builds pull requests and deploys changes on `main`.
-The repository's **Settings → Pages → Build and deployment → Source** must be
-set to **GitHub Actions** before the first deployment.
+Pull requests run `npm run docs:check`. `.github/workflows/pages.yml` is a
+manual VitePress build and does not publish. The public site at
+<https://morluto.github.io/rea/> is published only by the manual website
+workflow on `main`. The repository's **Settings → Pages → Build and
+deployment → Source** must be set to **GitHub Actions** before the first
+deployment.

 ## Development feedback and PR verification

@@ -72,8 +74,24 @@ require the matching real-provider `verify:*` lane.
 Formatting uses Oxfmt and the committed `.oxfmtrc.json`; generated sources use
 the same configuration. Pre-commit formats and lints staged files; pre-push runs
 `check:fast`.
-`docs:check` checks committed generated metadata. `docs:generate` regenerates
-those files, and the docs CI lane checks them.
+`docs:check` builds and validates generated metadata for the current checkout.
+The product catalog (`docs/public/product-catalog.json`), portable managed
+conformance projections (`docs/verification/managed-conformance-*.json`), and
+packaged skill (`skills/`) are ignored build outputs. Edit skill instructions
+and references in `skill-src/`; the build adds catalog-dependent metadata to
+the packaged copy without rewriting authored files. The generated manifest
+commits to that exact packaged skill bundle. It is a portable projection of
+the deterministic managed verifier, not a record of optional real-provider runs.
+CI validates these outputs and retains them as artifacts instead of pushing
+generated-only commits onto feature branches. Reviewed source metadata such as
+`src/generatedPackageMetadata.ts` and `docs/error-contract.schema.json` remains
+tracked and checked for freshness. Do not commit ignored generated outputs.
+The build-generated product catalog contains documented facts and their provider
+identity, rather than full runtime schema hashes. The managed skill contains
+instructions and inventory metadata; doctor compares its installed files with
+the canonical bundle. Schema-only fixes should not change these outputs or the
+skill commitment in the conformance manifest. Runtime schema identity remains
+available through doctor and `binary_session`.
 Real-provider execution remains uncached; deterministic builds use Turbo.

 Local `npm test` runs every deterministic Vitest project without coverage or
@@ -121,9 +139,9 @@ Describe the behavior change and verification performed in the pull request. Nev
 ## Maintainer release checklist

 Use the [checkpoint release guide](docs/releasing.md). Releases start from an
-explicit `release/VERSION` branch cut at a recorded commit. Pushing the branch prepares
-the bot PR. Wait for its exact-head CI and review; merging into that frozen
-branch triggers publication through the official Release workflow. Main
+explicit `release/VERSION` branch cut at a recorded commit. Manually prepare
+the bot PR, wait for its exact-head CI and review, merge into that frozen
+branch, and manually publish through the official Release workflow. Main
 pushes do not update release PRs or publish packages. Both publishers build
 the exact SHA tagged by Release Please.

@@ -10,8 +10,9 @@

 [![npm version](https://img.shields.io/npm/v/rea-agents?style=flat-square&color=cb3837)](https://www.npmjs.com/package/rea-agents)
 [![CI](https://img.shields.io/github/actions/workflow/status/morluto/rea/ci.yml?branch=main&style=flat-square&label=CI)](https://github.com/morluto/rea/actions/workflows/ci.yml)
-[![MCP tool catalog](https://img.shields.io/badge/MCP-tool_catalog-5c4ee5?style=flat-square)](#tool-catalog-for-investigation)
+[![MCP tool catalog](https://img.shields.io/badge/MCP-tool_catalog-5c4ee5?style=flat-square)](docs/mcp-contracts.md#generated-catalog)
 [![Node.js 22+](https://img.shields.io/badge/Node.js-22.19%2B-339933?style=flat-square&logo=nodedotjs&logoColor=white)](https://nodejs.org/)
+[![skills.sh](https://skills.sh/b/morluto/rea?style=flat-square)](https://skills.sh/morluto/rea/reverse-engineer-anything)
 [![MIT license](https://img.shields.io/badge/license-MIT-f4c430?style=flat-square)](LICENSE)
 [![Discord](https://img.shields.io/discord/1556595354999332884?logo=discord&logoColor=white&label=Discord&color=5865F2)](https://discord.gg/GkcryMnJDM)

@@ -19,7 +20,7 @@

 **[Website](https://morluto.github.io/rea/) · [Guides](https://morluto.github.io/rea/guides/) · [Showcases](https://morluto.github.io/rea/showcase/)**

-[Quick start](#quick-start) · [Current status](#current-status) · [Investigation model](#the-investigation-model) · [Tool catalog](#tool-catalog-for-investigation) · [Roadmap](#roadmap) · [How it works](#how-it-works)
+[Quick start](#quick-start) · [How REA works](#how-rea-works) · [What you can analyze](#what-you-can-analyze) · [Showcases](#showcases) · [FAQ](#faq) · [Documentation](#documentation)

 <code>npx rea-agents setup</code>

@@ -53,767 +54,273 @@ REA connects your agent to tools for inspecting native binaries, JavaScript and

 Setup registers REA with your agent and installs matching workflow instructions. Native analysis can use an existing Hopper or Ghidra installation; setup can optionally install Hopper with approval. Static JavaScript analysis needs neither engine.

+> **[Visit the REA website](https://morluto.github.io/rea/)** for setup instructions, illustrated guides, and real case studies.
+
 ## Quick start

-### Run setup (recommended)
+### Set up your agent

-Set up REA with your agent:
+With Node.js and npm installed, run:

 ```bash
 npx rea-agents setup
 ```

-Choose which supported agents should use REA, then review the exact paths and changes before approving. Existing REA registrations are selected by default; newly detected agents are available to select, but detection alone does not select them. Setup adds MCP access and REA's guided workflow for selected agents. Hopper is a separate optional choice with its own consent. Setup can also record an existing Ghidra installation.
+Choose your agents, review the proposed changes, and approve them. Setup adds
+REA's MCP server and matching workflow instructions, with backups of existing
+configuration. Restart your agent afterward.

-Setup shows its changes before applying them and backs up existing configuration. See [Installation and setup](docs/installation.md) for requirements and setup options.
+Setup supports Claude Code, Codex, Cursor, Gemini CLI and
+[other agents](docs/installation.md#supported-agents). See
+[installation and setup](docs/installation.md) for provider configuration and
+manual MCP registration.

-### AI Coding Assistants (optional)
-
-Add the skill to your AI coding assistant for richer context:
-
-```bash
-npx skills add morluto/rea --skill reverse-engineer-anything
-```
-
-The skill provides REA's investigation workflow. Run setup above to connect REA to your agent and configure analysis tools. Setup already installs a version-matched skill by default; this command installs the repository version.
-
-### With an agent (recommended)
-
-After setup, restart your agent and [describe the app or feature](#just-ask-your-agent) you want to understand. Hopper can run in demo mode; if it shows a first-run prompt, choose the demo or enter an existing license.
-
-REA supports Claude Code, Claude Desktop, Codex, Cursor, Gemini CLI, Windsurf, Devin, OpenCode, Antigravity, GitHub Copilot CLI, Command Code, and VS Code. Existing REA registrations are selected by default during setup; other detected agents remain unselected until chosen. Other agents can use the [manual MCP configuration](#manual-mcp-configuration).
-
-### First result from the terminal
-
-For your extracted JavaScript/Electron application tree or ASAR, run:
-
-```bash
-npx -y rea-agents@latest analyze-javascript-application /absolute/path/to/app --json
-```
-
-Replace the path with your target (for example, `"D:/apps/example"` on Windows).
-This returns inline Evidence, recovered graph, limitations, and unknowns without
-MCP setup, Hopper, Ghidra, or executing the application. For a native app, configure
-its engine first, then use `analyze` with that app's path. Run `doctor` when you
-need diagnosis; it is not a prerequisite for each analysis.
-
-### Check readiness for the task at hand
-
-`rea doctor` without options is an audit of the whole integration. It checks
-every detected agent registration, the installed skill, and every optional
-analysis engine, so it can report `healthy: false` while your current task works.
-Choose a readiness scope for the work you are doing:
-
-| Task                                | Readiness check                                                                              |
-| ----------------------------------- | -------------------------------------------------------------------------------------------- |
-| Static JavaScript/Electron analysis | None. Run `analyze-javascript-application` directly.                                         |
-| Troubleshoot one analysis engine    | `rea doctor --provider ghidra --json` (or `hopper`, `ida`)                                   |
-| Check one agent's MCP registration  | `rea doctor --client codex --json` (see [client IDs](docs/installation.md#supported-agents)) |
-| Check the installed skill           | `rea doctor --skill --json`                                                                  |
-
-A scoped report has `scope.mode: "explicit"`. Only `scope_checks` determine
-`healthy` and the exit status. Everything else is listed in
-`informational_checks`; you don't need to fix it for this task. For example, a
-missing engine you are not using needs no repair. `environment_healthy` still
-summarizes the full audit. `--target` adds a target check, but without a scope
-option the report remains audit-wide.
-
-When more than one installed engine supports a native target, REA does not pick
-one: opening the target fails with `code: "capability_unavailable"`,
-`details.selection_reason: "ambiguous"`, and the providers in
-`details.candidate_ids`. Choose one once: pass `--provider` on
-the CLI or `provider_id` on `open_binary`, or set `REA_ANALYSIS_PROVIDER` as a
-standing preference. An explicit selector overrides the environment variable.
-The session keeps that choice and never falls back to another engine.
-Recovery depends on `details.selection_reason`. For `ambiguous`, choose one of
-the candidates. For `provider_unavailable`, the engine you selected needs repair,
-so run `rea doctor --provider <id> --json` and follow its remediation. Neither
-reason means you have to install every engine. See
-[Choosing a deep-analysis provider](#choosing-a-deep-analysis-provider).
-
-### Install the rea command
-
-Install the command-line interface:
-
-```bash
-curl -fsSL https://raw.githubusercontent.com/morluto/rea/main/install.sh | bash
-```
-
-The installer adds `rea` to your system and starts setup when run in a terminal. It requires Node.js and npm to be installed already.
-
-Alternatively, install with npm, then run setup:
-
-```bash
-npm install --global rea-agents
-rea setup
-```
-
-Update either installation with `rea update`.
-
-### Requirements
-
-Static JavaScript inspection requires the Node/npm runtime only. Host and
-external-tool prerequisites depend on the selected workflow; the native
-provider guides describe their supported platforms.
-
- macOS 12 or newer
- Ubuntu 24.04+, Fedora 41+, 64-bit Arch Linux, or CachyOS
- Node.js 22.x (>=22.19), 24.x (>=24.11), or 26+
- npm; REA does not require or install a particular npm version
-
-Deep native binary analysis requires [Hopper](https://www.hopperapp.com/), [Ghidra](#ghidra-analysis-provider), or [IDA Pro](#ida-pro-analysis-provider). Hopper is separate software with its own license; its demo supports analysis with vendor-defined limits. Ghidra and IDA are bring-your-own providers.
-
-Firmware region inspection and explicit extraction use caller-supplied Binwalk and Unblob on Linux. See [Firmware analysis](docs/firmware-analysis.md) for setup, provenance, resource limits and native handoff.
-
-Static APK analysis uses a separately supplied headless JADX JAR and a full JDK, with no emulator or APK execution. See [Android analysis](docs/android-analysis.md) for setup, CLI/MCP operations, coverage and public test fixtures. Authenticated IPA and macOS `.app`, ZIP, or DMG inventory Evidence can be projected into bundle anatomy, such as XPC services, app extensions, login items, privileged helpers, and launchd plists, with [Apple application analysis](docs/apple-application-analysis.md).
-
-Repository main and npm 4.1.0 include experimental Windows x64 Ghidra support for native x86-64 PE applications on local NTFS, with bundled Job Object, private-DACL, and path-admission controls. Check the [release boundary](docs/installation.md#released-package-and-main) before expecting this from an older npm package. See [Windows Ghidra P0](docs/windows-ghidra-p0.md) for prerequisites and verified scope.
-
-If something is not working, run:
-
-```bash
-npx -y rea-agents@latest doctor
-```
-
-`doctor` checks your host, dependencies, analysis tools, and agent configuration without changing them. Use `--json` for structured diagnostics.
-
-### Linux installation and troubleshooting
-
-On macOS, setup can install Hopper in `~/Applications` after approval. It verifies the official download and does not need Homebrew or administrator privileges.
-
-On supported Linux distributions, setup can install Hopper and its demo-session dependencies through your system package manager. You may see a system authorization prompt. Demo sessions use a private virtual display, leaving your desktop alone. See [Hopper installation](docs/installation.md#hopper) for download verification and platform details.
-
-REA prefers an executable `/opt/hopper/bin/Hopper` on Linux. If it is unavailable, REA automatically checks `~/.local/share/rea/hopper/bin/Hopper`. If Hopper was installed elsewhere:
-
-```bash
-export HOPPER_LAUNCHER_PATH=/absolute/path/to/Hopper
-rea doctor --json
-```
-
-If doctor reports a missing analysis engine even though the file exists, inspect shared-library resolution with:
-
-```bash
-ldd /absolute/path/to/Hopper | grep 'not found'
-```
-
-Install the missing packages and rerun `rea setup`. The Linux demo needs Xvfb, Python 3, X11, and XTEST; approved setup installs these dependencies. If you use the curl installer, add `~/.local/bin` to your shell `PATH` when needed.
-
-REA uses `/Applications/Hopper Disassembler.app/Contents/MacOS/hopper` by default on macOS. On Linux it prefers executable `/opt/hopper/bin/Hopper`, then executable `~/.local/share/rea/hopper/bin/Hopper`, and keeps `/opt/hopper/bin/Hopper` as the diagnostic fallback if neither exists. Explicit `HOPPER_LAUNCHER_PATH` configuration always takes precedence.
-
-### Ghidra analysis provider
-
-Already use Ghidra? REA can connect it to your agent on Linux x64 or macOS x64/arm64. It accepts **Ghidra 12.1.x** and the **64-bit full JDK** that installation declares (`application.java.min` through `application.java.max`). Current 12.1 releases require JDK 21 or newer and set no maximum. The bridge is verified with Ghidra 12.1.4 and JDK 21. On macOS, your Ghidra installation must also include the native decompiler for your architecture.
-
-Set the installation paths, then run setup:
-
-```bash
-export GHIDRA_INSTALL_DIR=/absolute/path/to/ghidra_12.1.4_PUBLIC
-export JAVA_HOME=/absolute/path/to/jdk-21 # optional when java and javac resolve from PATH
-rea doctor --json
-rea setup
-rea providers --json
-```
-
-Setup checks the installations and saves their paths in your selected agents' configuration after approval. Ghidra and Java must already be installed; REA does not download or change them.
-
-The adapter exposes inventory, function, memory and load-image inspection, plus atomic function annotation edits on Linux and macOS. `annotate_native_function` edits names and entry comments in the session database and returns a refreshed function dossier; executable bytes stay unchanged. Ghidra does not provide GUI controls through REA.
-
-Opening a Ghidra target selects its provider; the first analysis query starts import and auto-analysis. That query can take longer than a client's default request deadline. See [first-query deadlines and recovery](docs/mcp-contracts.md#ghidra-first-query-deadlines-and-recovery) for an SDK example and cancellation recovery.
-
-REA analyzes a temporary copy of the target and removes the temporary project when the session closes. Results identify what Ghidra observed and what it could not resolve. Decompilation produces pseudocode rather than the original source.
-
-Ghidra also imports DOS MZ executables with an explicit 16-bit x86 real-mode profile. Function results include complete observed body ranges, distinguishing owned bytes from the enclosing span. See the [DOS analysis guide](docs/ghidra-dos.md) for addresses, packing, and verification boundaries.
-See [optional NativeAOT metadata recovery](docs/ghidra-nativeaot.md) for the pinned
-headless adapter, supported layout and existing native-tool workflow.
-
-Windows Ghidra P0 uses bundled native controls for its read-only native x86-64 PE boundary on local NTFS; see the [Windows Ghidra P0 guide](docs/windows-ghidra-p0.md). See [Ghidra installation](docs/installation.md#ghidra), [provider evaluation](docs/provider-evaluation.md), and [testing](docs/testing.md) for configuration details, coverage, and real-provider verification.
-
-To remove only REA-owned MCP registrations and the managed skill:
-
-```bash
-rea uninstall
-rea uninstall --purge-data # also removes only ~/.rea/cache and ~/.rea/state
-```
-
-Uninstall preserves Hopper, Node.js, Evidence files, captures, unrelated skills, and other MCP servers. It refuses malformed client configuration and never follows purge-data symlinks.
-
-### IDA Pro analysis provider
-
-Already have [mrexodia/ida-pro-mcp](https://github.com/mrexodia/ida-pro-mcp) working? REA can reuse its MCP registration for read-only analysis of the current GUI target, or use its database supervisor to open and analyze a supplied binary headlessly.
-
-```bash
-export REA_IDA_MCP_CONFIG=/absolute/path/to/ida-mcp.json
-rea function /absolute/path/to/program main --provider ida --json
-```
-
-The registration selects `attached` (default, legacy 1.4 tools) or `headless` (modern database supervisor). Setup can preserve this file reference in your selected agent's REA registration. REA adapts existing analysis contracts and manages its own headless database; it leaves an attached GUI database open and never saves it. Results stay live because external IDA database changes are not immutable snapshots.
-
-See the [IDA provider guide](docs/ida-provider.md) for upstream installation links, exact configuration examples, Windows-native headless operation, lifecycle cleanup, and coverage. The initial real workflows cover a Windows GUI and Windows x64 headless IDA 9.3; other engine/platform combinations remain unverified. Use a package version that includes this adapter; repository main can lead the npm release.
-
-### CLI or agent?
-
-| If you want to…                                                  | Use                                                                 |
-| ---------------------------------------------------------------- | ------------------------------------------------------------------- |
-| Ask an agent to investigate an app and build a feature           | Run setup, restart your agent, then describe the task               |
-| Inspect or decompile one part of an app from the Terminal        | `rea analyze` or `rea decompile`                                    |
-| Validate, canonicalize, or compare Evidence bundles              | `rea evidence-import`, `rea evidence-export`, or `rea compare`      |
-| Map a local JavaScript/Electron application without executing it | `rea analyze PATH` or `rea analyze-javascript-application`          |
-| Reuse immutable analysis results without relaunching a provider  | Pass `--snapshot /path/to/analysis.json` to a deep-analysis command |
-| Import source as historical reference                            | `rea import-reference-source`                                       |
-| Capture or compare controlled process behavior                   | `rea capture-process` or `rea compare-process-captures`             |
-
-```bash
-rea evidence-import /absolute/path/to/evidence/bundle.json
-rea evidence-export /absolute/path/to/evidence/bundle.json /absolute/path/to/evidence/canonical.json
-rea compare /absolute/path/to/evidence/left.json /absolute/path/to/evidence/right.json
-```
-
-Analyze a JavaScript application directory or ASAR without executing it:
-
-```bash
-rea analyze /absolute/path/to/releases/app.asar --json
-rea analyze-javascript-application /absolute/path/to/releases/app.asar --json
-```
-
-For a directory or `.asar`, generic `rea analyze` automatically selects the
-static JavaScript application provider when neither `--provider` nor
-`--snapshot` is supplied. Both routes return the analysis and its Evidence
-context inline.
-
-Import an older source tree as a reference. REA keeps it separate from observations of the current app:
-
-```bash
-rea import-reference-source /absolute/path/to/source
-```
-
-Historical-source import requires safe no-follow file opens and currently runs
-on Linux and macOS. Native Windows reports `unsupported_host`; run the import
-with Linux REA in WSL or on another supported host. Changing permissions or
-reinstalling REA does not enable this Windows workflow.
-
-Imports read the path supplied to the command. File names do not cause automatic omissions; files are represented by hashes and metadata. To exclude selected paths, set `REA_REFERENCE_SECRET_PATTERNS_JSON` to a JSON string array of ignore patterns. Exports never replace an existing file unless `--overwrite` is explicit.
-
-Use a snapshot to save successful analysis results and reuse them on later runs. REA reuses a result only when the target bytes, operation, parameters, analysis tool, and settings match. It does not cache changes or cursor-dependent calls. Snapshot files stay local and use owner-only permissions.
-
-```bash
-rea analyze /absolute/path/to/app --snapshot /absolute/path/to/analysis/app.json
-# The same exact query can be answered from that snapshot.
-rea analyze /absolute/path/to/app --snapshot /absolute/path/to/analysis/app.json
-```
-
-Exact CLI cached-evidence reads happen before any provider process starts. In MCP sessions,
-pass `snapshot_path` to `open_binary` to import a snapshot atomically while
-opening its matching target; MCP providers may still start before a cached call
-result is returned. Pass `snapshot_path` and, when required, `overwrite: true` to
-`close_binary` to save atomically before Hopper resources are released. If the
-save fails, REA deliberately leaves the session open.
-
-## Just ask your agent
-
-After [setup](#quick-start), restart your agent and ask:
+### Ask your agent

 ```text
 Understand how search works in the Notes app, show me the evidence, and build a
 similar feature for my project.
 ```

-Replace Notes with the app you want to understand, or ask for an overview first.
+Replace Notes with your target app and the feature you want to understand.

-## The investigation model
+### Use the terminal

-<table>
-<tr>
-<td width="33%" valign="top">
-<strong>Decompile</strong><br /><br />
-Open an app and recover readable code, strings, names, and other clues about how it works.
-</td>
-<td width="33%" valign="top">
-<strong>Understand</strong><br /><br />
-Follow the code from one part of the app to another until the agent can explain how a feature actually works.
-</td>
-<td width="33%" valign="top">
-<strong>Recreate</strong><br /><br />
-Turn what the agent learned into a feature for your own product, adapted to your stack, interface, and requirements.
-</td>
-</tr>
-</table>
-
-REA shows how it reached its conclusions. It does not claim to recover original source code or automatically clone an application.
-
-## Why REA
-
-|                          |                                                                                                       |
-| ------------------------ | ----------------------------------------------------------------------------------------------------- |
-| **Built for agents**     | Ask what an app does and let your agent inspect it instead of guessing.                               |
-| **CLI and MCP**          | Run the same reverse-engineering capabilities from your terminal or agent.                            |
-| **Guided setup**         | Configure your agent, connect an existing analysis tool, or install Hopper with your approval.        |
-| **From insight to code** | Understand a feature, then build your own version in the same coding session.                         |
-| **Local by design**      | Analysis runs on your supported local host. REA does not upload the app to a hosted analysis service. |
-| **Keeps context**        | Investigate several apps without starting over for every question.                                    |
-
-## One prompt, a full investigation
-
-```text
-Reverse engineer the Notes app. Find how offline search works, explain it,
-and build a version for my project using TypeScript and SQLite.
-```
-
-REA gives the agent a clear path from that request to working code:
-
-| Step | What the agent does                     | REA tools                                                        |
-| ---: | --------------------------------------- | ---------------------------------------------------------------- |
-|    1 | Opens and identifies the binary         | `open_binary`, `binary_overview`                                 |
-|    2 | Finds likely offline-search clues       | `search_strings`, `search_procedures`, `list_names`              |
-|    3 | Connects those clues to executable code | `find_xrefs_to_name`, `xrefs`, `procedure_callers`               |
-|    4 | Reconstructs the relevant control flow  | `get_call_graph`, `procedure_callees`, `procedure_info`          |
-|    5 | Decompiles the relevant routines        | `procedure_pseudo_code`, `procedure_assembly`, `batch_decompile` |
-|    6 | Builds the feature in your project      | code adapted to your stack, product, and requirements            |
-
-REA handles the app analysis in steps 1 through 5. The agent performs step 6 with its normal file-editing and test tools, using what it learned about the app.
-
-## Showcase
-
-### DX-Ball: game reconstruction (in progress)
-
-[DX-Ball](https://github.com/N0zoM1z0/dx-ball) follows the journey from a classic
-Windows game's executable to maintainable C. Using REA's Ghidra provider, the
-project traces functions, game state and dependencies, then checks reconstructed
-behavior with original-x86 differential tests and pinned-compiler replay.
-
-A [sound-pan investigation](https://github.com/N0zoM1z0/dx-ball/blob/main/docs/GAMEPLAY_OWNER.md)
-turns incomplete pseudocode into a C implementation that passes 3,205 original-x86
-cases and reproduces all 63 compiled function bytes. Follow its
-[REA workflow](https://github.com/N0zoM1z0/dx-ball/blob/main/docs/REA.md)
-from binary evidence to reconstruction.
-
-## What agents can do
-
- Investigate a feature you like and build a version tailored to your own product.
- Explain how a feature works when its source code is unavailable.
- Reconstruct an app's authentication, storage, update, or networking flow.
- Recover enough structure to document an undocumented format or interface.
- Trace a suspicious behavior from a string or symbol to the code that implements it.
- Turn recovered behavior into product features, tests, migration notes, ports, or interoperable replacements.
- Analyze Swift and Objective-C metadata without manually untangling every mangled symbol.
- Leave names, comments, and bookmarks in Hopper so human and agent analysis reinforce each other.
-
-See [native investigation](docs/native-investigation.md) for keyed archives, instruction/call/type primitives, typed dispatch metadata, value traces and native desktop observation.
-
-## Tool catalog for investigation
-
-| Tool family               | Count | Examples                                                                                                                                                                                                 |
-| ------------------------- | ----: | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
-| Native inspection         |    41 | functions, pseudocode, assembly, strings, symbols, calls, references, annotations, byte reads, and file offsets                                                                                          |
-| Investigation workflows   |    14 | app overviews, function dossiers, native APIs and dispatch, batch decompilation, feature traces, call paths, call graphs, Swift and Objective-C discovery                                                |
-| Native macOS utilities    |     7 | Mach-O metadata, code signatures, plists, architectures, and Swift demangling without launching Hopper                                                                                                   |
-| Artifact graph            |     5 | directory and package inventories, compiled Interface Builder files, Apple asset catalogs, and extraction                                                                                                |
-| Managed PE/CLI            |     7 | .NET identity, metadata, CIL instructions, native dependencies, reconstruction imports, and build comparisons                                                                                            |
-| Firmware                  |     2 | Linux firmware region inspection and explicit extraction                                                                                                                                                 |
-| Android APK               |     5 | package and manifest declarations, class search, member inventories, method decompilation, and incoming static references                                                                                |
-| Browser observation       |    11 | page structure, network metadata, scripts, source maps, WebMCP discovery, screenshots, and capture comparisons                                                                                           |
-| Electron analysis         |     5 | renderer observation, static app mapping, and static/runtime reconciliation                                                                                                                              |
-| JavaScript runtime        |     2 | Node/Electron Inspector target discovery, script locations, and execution-context events                                                                                                                 |
-| Application workflows     |    13 | captured website script export; Android/Apple inventory projections; cross-layer feature traces, build comparisons, historical source mapping, static return-shape comparison, and reconstruction checks |
-| Workspace and observation |    21 | sessions, evidence bundles, navigation context, process/artifact/function comparisons, and open-question tracking                                                                                        |
-
-The public interface describes what the agent is trying to learn. Providers decide how to answer. macOS utilities handle common semantic inspection without launching Hopper; Hopper handles deeper native analysis; the process harness records direct behavioral captures.
-
-## Current status
-
-REA supports native application, JavaScript, Electron, .NET, and browser investigation on macOS and Linux. Individual tools have platform and runtime prerequisites. `rea capabilities` and `rea providers` describe the binary-session providers and auxiliary operations; they are not an inventory of every browser, Android, or application workflow. Use the connected MCP tool list and `binary_session` tool availability for the full MCP surface, and the relevant guide for each tool's prerequisites. Repository main can be ahead of [the npm release](docs/installation.md#released-package-and-main).
-
-Static Android APK inspection supports Linux and macOS; the current metadata bridge is verified on macOS arm64 with headless JADX; see [Android analysis](docs/android-analysis.md) for its separate prerequisites and coverage.
-
- **Native binaries:** Open Mach-O, ELF, PE, and Mac `.app` targets through a selected deep provider. Hopper and Ghidra cover broad inventory and function analysis; the IDA adapter supplies its documented read-only function/string operations. Hopper also accepts `.hop` databases and supports annotations.
- **Packages and resources:** Inspect directories, ZIP, APK, IPA, ASAR, plists, compiled Interface Builder files, and Apple asset catalogs. Artifact requests name the input and requested extraction or traversal directly; macOS DMG traversal also requires the host's native mounting support.
- **JavaScript and Electron:** Map modules, imports, source maps, routes, IPC channels, storage, and native add-ons without running the app. Compare builds and trace a feature across the recovered graph. Dynamic and ambiguous relationships remain unresolved. See [JavaScript application workflows](docs/javascript-application-workflows.md).
- **Websites:** Inspect a selected page in an existing Chrome-family browser. Capture page structure, network metadata, script evidence, and screenshots requested by the call. Passive observation does not navigate or execute page JavaScript. See [browser observation](docs/browser-observation.md).
-
-  Export retained scripts with `export_web_scripts` / `rea export-web-scripts`
-  into a verified local directory, then use the existing JavaScript analysis
-  and tracing tools. Source URLs, frame or transaction references, competing
-  versions, and missing-source states remain inline. See
-  [captured website scripts](docs/website-script-export.md).
-  Inspect a selected node's listener sources or observe an externally triggered
-  execution window with `inspect_web_event_listeners` / `observe_web_execution`.
-  Precise coverage resets counters and affects optimized execution; see
-  [website runtime attribution](docs/web-runtime.md).
-  Trace one exported script's native imports with `trace_web_module_imports` /
-  `rea trace-web-module-imports`, preserving query/fragment identity and optional
-  import-map context. Requires caller-supplied Chromium via
-  `REA_BROWSER_EXECUTABLE`; see [module relationships](docs/website-module-trace.md).
-
- **Source locations:** Trace one retained website script point through a selected
-  local source map with `rea trace-web-source-location`. See
-  [captured website source locations](docs/web-source-location.md) for byte
-  identities, embedded original content and coverage limits.
-  Recover readable modules from selected local bundles with
-  `recover_javascript_sources` / `rea recover-javascript-sources`, then pass
-  the returned `analysis_input` to static analysis. This optional Linux x64
-  adapter requires caller-supplied Wakaru 1.13.0; see
-  [JavaScript source recovery](docs/javascript-recovery.md).
-
- **Electron and Node runtime observation:** Inspect selected Electron pages or attach to a Node/Electron V8 Inspector target. Inspector observation records script locations and execution-context events; it does not infer imports, IPC activity, or which modules executed. See [runtime observation](docs/javascript-runtime-observation.md).
- **.NET assemblies:** Inspect metadata and CIL instructions, compare builds, and check declared native dependencies without loading or running the assembly. Imported decompiler output is labeled as analyst inference. See [managed-code analysis](docs/managed-code-analysis.md).
- **Controlled behavior capture:** Run process, browser, or Electron scenarios with the target, actions, and lifecycle declared in each request, then compare the resulting evidence. Missing observations cannot establish that two runs behaved the same way.
- **Evidence and comparison:** Save results with artifact identity, provider, locations, confidence, and limitations. Export or import bundles, compare artifacts and functions, and connect static findings to runtime observations without claiming causality from correlation.
- **Open questions:** Track unresolved findings, contradictions, and follow-up probes. Reconstruction checks report pass, fail, or unknown rather than treating missing evidence as a pass.
- **Guided workflows:** Start six [MCP investigation workflows](docs/mcp-prompts.md) with suggestions based on your current session.
-
-Windows x64 Ghidra P0 supports native, non-managed, non-DLL x86-64 PE applications on fixed local NTFS with 25 read-only operations. Linux/macOS Ghidra additionally supports atomic session-scoped function names and entry comments. Ghidra has no GUI controls; Windows P0 has no mutation authority.
-
-### Website observation with CDP
-
-REA can inspect an already-running Chrome-family browser through a literal loopback CDP endpoint. Each request names the endpoint and target; an optional origin filter can narrow discovery:
+Inspect an extracted JavaScript/Electron app directory or ASAR:

 ```bash
-rea list-browser-targets http://127.0.0.1:9222 --json
-rea inspect-web-page http://127.0.0.1:9222 TARGET_ID --json
+npx -y rea-agents@latest analyze-javascript-application /absolute/path/to/app --json
 ```

-The eight passive browser tools work through both CLI and MCP. They inspect the selected page without navigating, clicking, or evaluating its JavaScript. Credentials, cookies, authorization headers, and raw payload values are not retained. A request selects whether to include script sources, accessibility text, screenshots, or console and payload summaries. REA cannot observe activity that happened before it attached. See [browser observation](docs/browser-observation.md) for browser startup, capture options, and limits.
+The result includes modules, imports, Electron boundaries and their evidence.
+Replace the path with your target, such as `"D:/apps/example"` on Windows.

-### Controlled browser scenarios
-
-`capture_browser_scenario` runs a caller-declared sequence of browser actions through
-Playwright. Unlike passive observation, it can interact with the page. Each
-step records evidence such as screenshots, page structure, navigation, and
-network activity. Missing or truncated observations cannot establish that two
-runs behaved the same way.
-
-```bash
-rea capture-browser-scenario ./scenario.json --json
-```
-
-Launch mode owns a temporary browser profile and removes it after terminating
-the launched browser. Connect mode accepts one exact loopback CDP target and
-disconnects without closing the external browser. The request supplies the
-selected executable or endpoint, actions, and any origin or environment
-selections needed by the scenario. Scenario JSON contains secret references and
-environment-variable names, never secret values. The default capture retains
-only the final URL; request `dom`, `accessibility`, or `screenshot` when an
-interaction changes the page without navigating. For asynchronous updates,
-wait for a page-specific result-ready condition before capture. See the
-[browser scenario contract](docs/browser-scenario-contract.md), including its
-interaction example.
-
-### Node and Electron V8 Inspector observation
-
-Node and Electron runtime observation attaches to an existing Inspector target named in the request:
-
-```bash
-rea list-javascript-runtime-targets http://127.0.0.1:9229 --json
-rea observe-javascript-runtime http://127.0.0.1:9229 TARGET_ID \
-  --runtime-kind node --json
-```
-
-REA records script locations and execution-context events without evaluating
-code or setting breakpoints. These observations do not establish import
-relationships, event activity, IPC, process identity, or Electron roles. See
-[Node and Electron runtime observation](docs/javascript-runtime-observation.md)
-for the exact coverage.
-
-Exact package, tool-family, provider, setup-client, schema, and CLI facts are generated from source in [`docs/product-catalog.json`](docs/product-catalog.json). PR CI verifies this catalog, narrative documentation, and generated schemas.
-
-## Roadmap
-
-The [current status](#current-status) section describes shipped capabilities. These are the next areas of work.
-
-### Now
-
-1. **Keep documentation accurate:** update the generated catalog and documentation checks when tools, providers, setup options, or versions change.
-2. **Test more native binaries:** expand architecture and indirect-call coverage across Hopper and Ghidra.
-
-### Next
-
-1. **Connect more application layers:** add static extractors and runtime observations to feature traces.
-2. **Extend .NET analysis:** improve comparisons of obfuscated assemblies and connect managed findings to verified native analysis. See the [managed-code guide](docs/managed-code-analysis.md).
-3. **Compare more runtime behavior:** expand process, protocol, filesystem, reconnect, and version-comparison coverage.
-
-### Later
-
-1. **Expand browser and Electron interaction:** add scenario actions beyond the current click and wait operations.
-2. **Observe native apps at runtime:** explore LLDB, Frida, system logs, and native API tracing.
-3. **Evaluate more tools and targets:** assess Binary Ninja, Rizin, LIEF, Windows-native tools, mobile apps, and firmware. IDA support already ships via the bring-your-own upstream adapter; see the [IDA provider guide](docs/ida-provider.md).
-
-Setup already lets you choose agent integration and Hopper installation. Support for installing additional analysis tools is future work, described in the [installation roadmap](docs/roadmap.md).
-
-See [provider evaluation](docs/provider-evaluation.md) for coverage and remaining requirements, and the [native investigation guide](docs/native-investigation.md) for UI, dispatch, and value-flow analysis.
-
-## Using REA with other agents
-
-Setup offers supported agent integrations for selection. Existing REA registrations are selected by default; newly detected agents remain unselected until chosen. Any agent that supports local MCP servers can use the configuration below.
-
-### Manual MCP configuration
-
-<!-- x-release-please-start-version -->
-
-```json
-{
-  "mcpServers": {
-    "rea": {
-      "command": "npx",
-      "args": ["-y", "rea-agents@5.0.0", "mcp"]
-    }
-  }
-}
-```
-
-<!-- x-release-please-end -->
-
-Persistent registrations should use one exact package version. `rea setup`
-maintains that pin, updates the bundled skill at the same time, and gives Codex
-a 30-second startup allowance for a cold package-runner start. `rea update`
-installs an exact release and verifies the new executable. It returns an
-unapplied maintenance plan for existing REA integrations, with a scoped setup
-command to review and approve their changes. Restart affected agents afterward.
-
-MCP clients that support prompts can also discover six ordered investigation
-workflows through `prompts/list`. Their optional identifier arguments use the
-current session for bounded `completion/complete` suggestions; see
-[Guided MCP prompts and completion](docs/mcp-prompts.md).
-
-## How it works
-
-```mermaid
-flowchart LR
-    Agent["Agent"] --> REA["REA<br/>CLI + MCP"]
-    Terminal --> REA
-    REA --> Session["Target-bound session router"]
-    Session --> Registry["Deep-provider registry<br/>deterministic selection"]
-    Registry --> Hopper["Hopper provider"]
-    Registry --> Ghidra["Ghidra provider<br/>inventory + function analysis + annotations"]
-    Registry --> Ida["IDA MCP provider<br/>attached GUI or owned headless database"]
-    Hopper --> Runtime["Owned provider runtime<br/>deadline + bounded diagnostics + cleanup"]
-    Ghidra --> Runtime
-    Ida --> IdaRuntime["Upstream MCP lifecycle<br/>live observations + owned database cleanup"]
-    IdaRuntime --> Target
-    Session --> Native["Native macOS provider"]
-    Session --> Artifact["Artifact graph provider"]
-    REA --> Browser["Browser CDP provider"]
-    REA --> Android["Android static provider<br/>headless JADX adapter"]
-    Android --> Runtime
-    REA --> Firmware["Firmware providers<br/>Binwalk / Unblob adapters"]
-    Firmware --> Runtime
-    REA --> Process["Process capture provider"]
-    Runtime --> Target["Target software"]
-    Process --> Target
-    Native --> Target
-    Artifact --> Target
-```
-
-The CLI and MCP server use the same application workflows and evidence contracts. A provider declares which capabilities it supports and the side effects those capabilities may have. Terminal commands are short-lived; an MCP session can retain an active target and evidence ledger for the session.
-
-## CLI
-
-The agent workflow above is the easiest way to use REA. For a one-off overview from the Terminal:
-
-```bash
-npx -y rea-agents@latest analyze /Applications/Notes.app
-npx -y rea-agents@latest inspect /Applications/Notes.app
-npx -y rea-agents@latest search /Applications/Notes.app "offline"
-npx -y rea-agents@latest function /Applications/Notes.app 0x1000
-npx -y rea-agents@latest xrefs /Applications/Notes.app 0x1000
-npx -y rea-agents@latest trace /Applications/Notes.app "offline"
-npx -y rea-agents@latest compare /absolute/path/to/left-evidence.json /absolute/path/to/right-evidence.json
-npx -y rea-agents@latest capabilities
-npx -y rea-agents@latest providers
-```
-
-Run `npx -y rea-agents@latest --help` for direct decompilation, bounded search and
-other options. `analyze` and `inspect` share the same overview workflow;
-`function`, `xrefs`, and `trace` return the same Evidence envelopes as MCP.
-
-Or install the `rea` command globally:
+To install the `rea` command for regular use:

 ```bash
 npm install --global rea-agents
 rea --help
+```
+
+For native analysis, configure a provider first. See the
+[CLI and Evidence guide](docs/cli.md) for native commands, provider selection,
+snapshots and scripting.
+
+### Update REA
+
+REA changes quickly, and new releases include frequent bug fixes. Keep your
+installation up to date.
+
+For an npm-installed CLI:
+
+```bash
 rea update
-rea mcp
 ```

-REA accepts a Mac `.app` folder directly. If an agent cannot find an app by name, tell it where the app is installed.
+To refresh your agent registrations and skill, run the setup command printed
+by the update.

-### Choosing a deep-analysis provider
-
-Choose which analysis tool to use from the CLI:
+If you use `npx`, update your agent setup with:

 ```bash
-rea providers --json
-rea analyze /absolute/path/to/program --provider hopper
-REA_ANALYSIS_PROVIDER=hopper rea decompile /absolute/path/to/program 0x1000
+npx rea-agents@latest setup
 ```

-For MCP, pass the optional selector on `open_binary`:
+Review the setup changes and restart your agent. For one-off CLI commands,
+use `npx rea-agents@latest` followed by the command.

-```json
-{
-  "path": "/absolute/path/to/program",
-  "provider_id": "hopper"
-}
-```
+## How REA works

-Use `--provider`, or `provider_id` in MCP, to choose Hopper, Ghidra, or IDA for a target. This choice overrides `REA_ANALYSIS_PROVIDER`.
+Your agent calls REA through MCP to inspect the target and trace relevant code.
+REA returns findings with their evidence. The agent uses them to ask follow-up
+questions, explain the behavior, or write and test an implementation.
+CLI commands use the same workflows.

-With `auto`, REA selects the only available tool that supports the target. If both are available, specify one before opening the target. The session keeps that choice until you explicitly switch or close it; a failure never silently switches tools. Artifact-only analysis can work without a native analysis tool.
+![REA investigation flow: your agent asks about a local target, REA inspects and traces it using analysis tools, and the agent uses the returned code, references and unknowns to explain, implement and test.](website/public/assets/figures/rea-investigation-flow.svg)

-Run `rea providers` and `rea capabilities` to check availability and supported operations. Ghidra supports inspection and atomic function annotation edits on Linux and macOS. Its database edits are discarded on close; GUI controls require Hopper. Windows Ghidra P0 supports read-only analysis of native x86-64 PE applications on local NTFS with bundled native controls.
+[Open the full-size figure](website/public/assets/figures/rea-investigation-flow.svg).

-The session also reports active work and cleanup status. If a caller times out, the analysis tool may still be busy; `analysis_activity` reports that state. A `cleanup_incomplete` result identifies resources whose shutdown or removal could not be verified. See [provider selection and analysis profiles](docs/adr/0001-provider-selection-and-analysis-profiles.md) for session, cache, and process-tracking details.
+<a id="current-status"></a>

-### CLI exit status
+## What you can analyze

-| Status    | Meaning                                                                                                                                                                        |
-| --------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ |
-| `0`       | The operation completed. Results may still include warnings, partial evidence, or unresolved questions.                                                                        |
-| `1`       | The operation could not complete, for example because of invalid input, host permission denial, cancellation, or timeout. Structured output reports the reason when available. |
-| `128 + N` | The process ended from signal `N`, where the shell or runtime preserves the conventional signal-derived status.                                                                |
+REA requires Node.js 22.x (>=22.19), 24.x (>=24.11), or 26+, plus npm.
+Additional tools and host support depend on the target:

-`setup --dry-run` returns status `planned` and exits `0`. A setup result with
-status `cancelled` also exits `0`.
-`setup` returns `1` for `needs_confirmation` or `needs_human`
-because configuration is not ready; rerun it after approval or remediation.
-`doctor` returns `1` when required checks for its readiness scope are unhealthy.
-Unavailable optional provider prerequisites remain visible as informational
-diagnostics and do not block setup or unrelated providers. Output format, full envelopes,
-filters, and token controls never change the operation status.
+| Target                 | What REA returns                                                                     | Requirements and guide                                                                                                                |
+| ---------------------- | ------------------------------------------------------------------------------------ | ------------------------------------------------------------------------------------------------------------------------------------- |
+| Native binaries        | Pseudocode, assembly, strings, symbols, calls and references                         | Hopper, Ghidra or IDA; [native analysis](https://morluto.github.io/rea/guides/native/)                                                |
+| Offline ELF layout     | Sections, segments, original symbols/relocations and static mitigation candidates    | Caller-supplied pwntools on Linux x64; [binary diagnostics](docs/binary-diagnostics.md)                                               |
+| EVM bytecode           | Dispatch selectors, byte offsets, inferred arguments and mutability                  | Local raw/hex carrier; [offline EVM guide](docs/evm-bytecode.md)                                                                      |
+| Recorded Linux crashes | Raw notes, every recorded thread's registers/signals and optional mapping candidates | Caller-supplied pwntools; optional GDB/pwndbg; [recorded crashes](docs/recorded-crashes.md)                                           |
+| JavaScript / Electron  | Modules, imports, source maps, routes, IPC and native add-on relationships           | Node.js and npm; [application analysis](https://morluto.github.io/rea/guides/javascript/)                                             |
+| Websites               | Page structure, scripts, network observations and requested screenshots              | A Chrome-family browser; [browser analysis](https://morluto.github.io/rea/guides/browser/)                                            |
+| Saved network captures | Requests, responses, exposed payloads and source locations                           | HAR; mitmdump on Linux for native mitmproxy captures; [capture guide](docs/web-network-captures.md)                                   |
+| .NET assemblies        | Metadata, CIL instructions, declared native dependencies and build comparisons       | Static inspection; [managed-code guide](docs/managed-code-analysis.md)                                                                |
+| Android APKs           | Manifest declarations, classes, decompiled methods and references                    | Headless JADX and a full JDK on Linux/macOS; [Android guide](docs/android-analysis.md)                                                |
+| Firmware               | Regions, extraction results and native-analysis handoffs                             | Binwalk / Unblob on Linux; [firmware guide](docs/firmware-analysis.md)                                                                |
+| Packages and resources | File inventories, digests, plists, Apple bundle anatomy and extracted resources      | [Artifact and JavaScript guide](docs/javascript-artifact-reconstruction.md), [Apple applications](docs/apple-application-analysis.md) |
+| Process behavior       | Terminal output, interactions, exit and filesystem observations, and run comparisons | Linux/macOS with a native PTY; [process capture](docs/process-capture.md)                                                             |

-When REA feeds a shell pipeline, enable `pipefail` so a downstream formatter
-cannot hide its failure:
+Static JavaScript and .NET inspection read the supplied files without running
+the application. Runtime capture runs or interacts with the selected target
+using your user permissions; each runtime guide describes its effects.

-```bash
-set -o pipefail
-rea inspect-artifact ./app.asar --json | jq . > inspection.json
-```
+<a id="choosing-a-deep-analysis-provider"></a>

-## Current Hopper provider
+Native formats and host support vary by provider. See
+[Hopper and Ghidra setup](docs/installation.md#hopper), the
+[IDA guide](docs/ida-provider.md), and
+[experimental Windows Ghidra support](docs/windows-ghidra-p0.md).
+Ghidra also supports [16-bit DOS analysis](docs/ghidra-dos.md).
+For provider selection, see the [CLI guide](docs/cli.md#choose-a-provider).
+Check [release availability](docs/installation.md#released-package-and-main)
+for features added since the latest npm release.

-REA starts Hopper when an operation needs it. On macOS, Hopper may bring its window or a dialog to the foreground even though REA requests background startup. Demo or license prompts may need your attention.
+## Showcases

-Hopper handles one analysis request at a time. Cancelling your wait does not stop work already running inside Hopper; the session reports whether it is still busy. Successful decompilation results are cached until a relevant rename or comment change.
+### DX-Ball: reconstruct a sound-pan calculation

-Use `rea instructions` when you only need assembly instructions for a function. It avoids decompilation and a whole-program inventory.
+Follow a sound call into its position-to-pan helper, inspect the instructions,
+and turn incomplete pseudocode into C. The reconstruction passes 3,205
+original-x86 cases and reproduces all 63 compiled function bytes.

-Closing a session shuts down REA's bridge and removes its temporary socket directory while preserving a Hopper application you may be using. If cleanup cannot be verified, `close_binary` reports `cleanup_incomplete` and the affected resources.
+[Read the case study](https://morluto.github.io/rea/showcase/dx-ball/) ·
+[Reconstruction repository](https://github.com/N0zoM1z0/dx-ball)

-## Process capture
+### Notion: trace the Electron clipboard bridge

-Process capture runs the exact executable and scenario declared in the request,
-with the requested working directory and environment. Filesystem observation
-paths select what to snapshot. The process runs with your user permissions;
-Process Capture records behavior and is not a security sandbox.
+Find the renderer's clipboard API, follow it through preload and IPC into the
+main process, and inspect the rich clipboard format.

-Capture a scenario or compare two saved Process Capture Evidence records:
+[Read the case study](https://morluto.github.io/rea/showcase/notion/)

-```bash
-rea capture-process ./authority-scenario.json --json > authority-capture.json
-rea capture-process ./reconstruction-scenario.json --json > reconstruction-capture.json
-rea compare-process-captures authority-capture.json reconstruction-capture.json --json
-```
+### TH04: recover a DOS bullet-ring calculation

-The comparison reports each observed dimension separately and identifies the
-first terminal, interaction, exit, filesystem, or process divergence.
-See [Process Capture](docs/process-capture.md) for scenario fields, limits, and
-evidence boundaries.
+Inspect the original PC-98 game's 16-bit instructions, recover the fixed and
+aimed angle calculations, and compare the reconstructed C++ with the
+historical compiler output.

-Process Capture currently runs on Linux and macOS with a working native PTY
-backend. Native Windows capture remains unavailable until the PTY adapter can
-verify descendant cleanup; installing or reinstalling its Windows PTY binary
-does not enable capture. For Linux commands, run Linux REA inside WSL.
-Comparing existing capture Evidence remains available on Windows.
+[Read the case study](https://morluto.github.io/rea/showcase/th04/) ·
+[Reconstruction repository](https://github.com/N0zoM1z0/th04)

-On supported capture hosts, a missing or incompatible PTY binary can be fixed
-by reinstalling REA for the current platform, architecture, and Node.js version
-with optional dependencies enabled. Use separate scenario and output files;
-`--json` produces the JSON consumed by the comparison command.
-
-ASAR inventory verifies Electron integrity metadata for both archive entries
-and `.asar.unpacked` companion files. Integrity failures identify the logical
-path, declared and calculated SHA-256 values, and whether the entry was
-unpacked; REA does not silently accept the mismatched artifact. If a supplied
-ASAR declares unpacked companion bytes that are absent from the local artifact
-set, REA keeps that occurrence as `unavailable` and continues analyzing the
-embedded JavaScript instead of treating the missing native/resource bytes as
-verified or absent.
-
-## Security model
-
-Analysis runs locally. REA communicates with Hopper and Ghidra through authenticated private local sockets and with IDA through its configured local MCP registration. Your agent or model provider has its own data policy.
-
-Runtime requests act on the declared target and lifecycle. Analysis tools and launched targets run with your user permissions, and native UI capture still depends on macOS Accessibility and Screen Recording access. Static JavaScript analysis does not execute extracted modules; use direct browser, Electron, or process capture when runtime behavior is needed.
-
-Windows Ghidra P0 automatically uses native Job Objects, protected private-runtime DACLs, and handle-based admission. Its experimental scope is native x86-64 PE applications on local NTFS. Report vulnerabilities through the private process in [SECURITY.md](SECURITY.md).
+If you've used REA on something interesting, we'd love to see it. Share your
+case in an [issue](https://github.com/morluto/rea/issues) or a
+[pull request](https://github.com/morluto/rea/pulls), including the target,
+your question, how REA helped, and what you found.

 ## FAQ

-<details>
-<summary><strong>Does Hopper need to be running before I start REA?</strong></summary>
-
-No. REA starts Hopper when an operation needs it. An already-running Hopper application is also supported.
-
-</details>
-
-<details>
-<summary><strong>Why did Hopper appear in front of my other windows?</strong></summary>
-
-Hopper's launcher internally activates the application. REA requests background startup, but macOS and Hopper may still bring a window or dialog forward. See [Current Hopper provider](#current-hopper-provider).
-
-</details>
-
-<details>
-<summary><strong>Does REA include Hopper?</strong></summary>
-
-No. Setup can install Hopper for you, but Hopper remains separate software with its own license. REA supplies the CLI, MCP server, and workflows that make it usable by agents.
-
-</details>
-
-<details>
-<summary><strong>Does REA install or include Ghidra or Java?</strong></summary>
-
-No. REA connects to an existing Ghidra installation. Run setup after providing the Ghidra and Java paths shown in the [Ghidra section](#ghidra-analysis-provider).
-
-</details>
-
-<details>
-<summary><strong>Does REA upload the app?</strong></summary>
-
-REA has no hosted analysis service. Current providers analyze artifacts and capture behavior locally. Your agent or model provider may have its own data policy, so review that separately.
-
-</details>
-
-<details>
-<summary><strong>Can REA recover the original source code?</strong></summary>
-
-No decompiler can guarantee the original source. REA gives an agent pseudocode, assembly, symbols, strings, metadata, and relationships that it can use to explain or compatibly recreate observed behavior.
-
-</details>
-
 <details>
 <summary><strong>Which agents can use REA?</strong></summary>

-Any agent that can run a local MCP server can use the manual configuration. Setup offers the supported integrations listed in [Installation and setup](docs/installation.md#supported-agents); existing REA registrations are selected by default, and other detected agents require selection.
+Any agent that supports local MCP servers. Setup configures the
+[supported agents](docs/installation.md#supported-agents); other clients can use
+[manual MCP registration](docs/installation.md#mcp-registry).

 </details>

-## Development
+<details>
+<summary><strong>Do I need Hopper, Ghidra or IDA?</strong></summary>

-See [CONTRIBUTING.md](CONTRIBUTING.md) for development setup and contribution checks, and [docs/testing.md](docs/testing.md) for test scopes and real-tool verification. `npm run docs:check` checks committed generated documents; `npm run docs:generate` regenerates them.
+Deep native analysis uses one of them. Static JavaScript and .NET inspection
+work without a native analysis engine. Setup can install Hopper after approval;
+Ghidra and IDA use your existing installations. See [provider setup](docs/installation.md#hopper).

-`npm run verify:agent` evaluates native, JavaScript, managed, and browser investigation tasks through a real local Codex CLI. Its report covers tool selection, repeated calls, token use, completion quality, and handling of permissions and unknowns.
+</details>

-`npm run evidence:generate` regenerates the managed conformance manifest and Evidence completion ledger from live verification results. `npm run evidence:check` reruns verification and checks for drift. Unsupported claims remain explicit and do not count as passes. See [testing](docs/testing.md) for verification commands and process-cleanup checks.
+<details>
+<summary><strong>Do I need to start Hopper first?</strong></summary>
+
+REA starts Hopper when an operation needs it. On macOS, a first-run dialog may
+ask you to choose demo mode or activate your license. See
+[Hopper startup and troubleshooting](docs/installation.md#launcher-paths-and-troubleshooting).
+
+</details>
+
+<details>
+<summary><strong>What does installing the skill from skills.sh do?</strong></summary>
+
+The skill supplies investigation instructions for your agent. Use `rea setup`
+to register REA's MCP server and install the matching instructions, then restart
+your agent. See [skill-only installation](docs/installation.md#skill-only-installation).
+
+</details>
+
+<details>
+<summary><strong>What code does REA return?</strong></summary>
+
+Native analysis returns pseudocode and assembly. JavaScript/Electron analysis
+recovers modules and their relationships. Your agent uses these findings to
+write and test an implementation; the [showcases](#showcases) give worked examples.
+
+</details>
+
+<details>
+<summary><strong>Does REA upload my app?</strong></summary>
+
+REA analyzes targets locally. Your agent receives the tool results, and its
+model provider has its own data policy.
+
+</details>
+
+<details>
+<summary><strong>What should I do if I hit a bug?</strong></summary>
+
+Update first; a recent release may already fix it.
+
+For an npm-installed CLI:
+
+```bash
+rea update
+```
+
+For agent setup through `npx`:
+
+```bash
+npx rea-agents@latest setup
+```
+
+If you're using an agent, complete the [setup refresh](#update-rea) and restart
+it. Retry the same task. If the problem persists, [open an issue](https://github.com/morluto/rea/issues)
+with your REA version, target type, steps to reproduce and error output.
+
+</details>
+
+## Documentation
+
+Start with the website's [worked guides](https://morluto.github.io/rea/guides/).
+For exact options, prerequisites and result contracts:
+
+- [Installation and setup](docs/installation.md): agent registration, provider configuration, updates and uninstall.
+- [Readiness and troubleshooting](docs/installation.md#check-readiness-for-your-task): diagnose one agent or analysis engine.
+- [CLI and Evidence](docs/cli.md): commands, provider selection, snapshots, import/export and exit statuses.
+- [MCP contracts](docs/mcp-contracts.md) and [agent prompts](docs/mcp-prompts.md): tool results, sessions and guided investigations.
+- [Tool catalog](docs/mcp-contracts.md#generated-catalog): build-generated inventory of tools, providers and CLI commands.
+- [Roadmap](docs/roadmap.md): planned work and capability trackers.
+
+Report vulnerabilities through [SECURITY.md](SECURITY.md).
+
+## Contributing
+
+We'd love your help with REA! [Open an issue](https://github.com/morluto/rea/issues) to
+report a bug or suggest a feature, or [send a pull request](https://github.com/morluto/rea/pulls)
+to improve the code or docs.
+
+See [CONTRIBUTING.md](CONTRIBUTING.md) for development setup and checks,
+[testing](docs/testing.md) for verification lanes, and the
+[architecture map](docs/architecture.mermaid) for the project structure.

 ## Project links

-[npm](https://www.npmjs.com/package/rea-agents) · [Issues](https://github.com/morluto/rea/issues) · [Security](SECURITY.md) · [Contributing](CONTRIBUTING.md) · [Hopper](https://www.hopperapp.com/) · [Ghidra](https://github.com/NationalSecurityAgency/ghidra)
-
-## License
-
-[MIT](LICENSE)
+[Website](https://morluto.github.io/rea/) · [npm](https://www.npmjs.com/package/rea-agents) · [skills.sh](https://skills.sh/morluto/rea/reverse-engineer-anything) · [Issues](https://github.com/morluto/rea/issues) · [Security](SECURITY.md)

 ## Star history

+🎉 **20,000 GitHub stars — thank you!**
+
+Thanks to everyone using REA, reporting bugs, testing builds, and contributing fixes.
+
 <a href="https://www.star-history.com/?repos=morluto%2Frea&amp;type=date">
  <picture>
    <source media="(prefers-color-scheme: dark)" srcset="https://api.star-history.com/chart?repos=morluto/rea&amp;type=date&amp;theme=dark&amp;legend=top-left" />
@@ -825,3 +332,7 @@ See [CONTRIBUTING.md](CONTRIBUTING.md) for development setup and contribution ch
 ## Disclaimer

 REA provides tools for lawful reverse-engineering research, analysis, and reconstruction. You are responsible for obtaining any required authorization and complying with applicable laws. The project does not endorse illegal or unauthorized use.
+
+## License
+
+[MIT](LICENSE)
@@ -213,20 +213,20 @@ rea setup

 ## منصة أدوات التحقيق

-| عائلة الأدوات         | العدد | الاستخدام                                                                                                                                                 |
-| -------------------- | ----: | -------------------------------------------------------------------------------------------------------------------------------------------------------- |
-| الفحص الأصلي          |    41 | الدوال والشيفرة شبه المصدرية والتعليمات والسلاسل والرموز والاستدعاءات والمراجع والتعليقات وقراءة البايتات ومواضع الملفات                                   |
-| سير عمل التحقيق      |    14 | نظرات عامة على التطبيقات وملفات الدوال وواجهات API الأصلية والتوزيع وفك الترجمة الدفعي وتتبع الميزات ومسارات الاستدعاء ومخططاته واكتشاف Swift وObjective-C |
-| أدوات macOS الأصلية   |     7 | بيانات Mach-O والتوقيعات وplist والمعماريات واستعادة أسماء Swift دون تشغيل Hopper                                                                        |
-| مخطط المخرجات        |     5 | جرد الدلائل والحزم وملفات Interface Builder المترجمة وكتالوجات موارد Apple والاستخراج                                                                      |
-| PE/CLI المُدار        |     7 | هوية تجميعات .NET وبياناتها الوصفية وتعليمات CIL والاعتماديات الأصلية واستيراد إعادة البناء ومقارنة الإصدارات                                               |
-| البرامج الثابتة      |     2 | فحص مناطق البرامج الثابتة على Linux واستخراجها الصريح                                                                                                    |
-| Android APK          |     5 | بيانات الحزمة وmanifest والبحث عن الأصناف وقوائم الأعضاء وفك ترجمة الأساليب والمراجع الثابتة                                                                |
-| مراقبة المتصفح       |    11 | بنية الصفحات وبيانات الشبكة والبرامج النصية وخرائط المصدر واكتشاف WebMCP والصور ومقارنة الالتقاط                                                          |
-| تحليل Electron       |     5 | مراقبة العارضين وخريطة التطبيق الثابتة والمواءمة بين نتائج الثبات والتشغيل                                                                               |
-| وقت تشغيل JavaScript |     2 | اكتشاف أهداف Node/Electron Inspector ومواضع البرامج وأحداث سياقات التنفيذ                                                                                |
-| سير عمل التطبيقات    |    13 | تصدير النصوص البرمجية الملتقطة، تتبع الميزات عبر الطبقات ومقارنة الإصدارات ومواءمة المصدر التاريخي ومقارنة أشكال القيم المعادة والتحقق من إعادة الإنشاء    |
-| مساحة العمل والملاحظة |    21 | الجلسات وحزم الأدلة وسياق التنقل ومقارنة العمليات والمخرجات والدوال وتسجيل الأسئلة غير المحسومة                                                            |
+| عائلة الأدوات           | العدد | الاستخدام                                                                                                                                                                       |
+| ---------------------- | ----: | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ |
+| الفحص الأصلي            |    41 | الدوال والشيفرة شبه المصدرية والتعليمات والسلاسل والرموز والاستدعاءات والمراجع والتعليقات وقراءة البايتات ومواضع الملفات                                                         |
+| سير عمل التحقيق        |    14 | نظرات عامة على التطبيقات وملفات الدوال وواجهات API الأصلية والتوزيع وفك الترجمة الدفعي وتتبع الميزات ومسارات الاستدعاء ومخططاته واكتشاف Swift وObjective-C                       |
+| أدوات الملفات الثنائية |    10 | بيانات Mach-O والتوقيعات وplist والمعماريات وأسماء Swift ومراقبة الاستدعاءات عبر LLDB على macOS؛ تخطيط ELF وأدلة الحماية الثابتة وسجلات الأعطال على Linux                         |
+| مخطط المخرجات          |     7 | جرد الدلائل والحزم وملفات Interface Builder المترجمة وكتالوجات موارد Apple وتحليل تحميل Mach-O dylib والاستخراج واستدلال واجهات EVM دون اتصال                                     |
+| PE/CLI المُدار          |     7 | هوية تجميعات .NET وبياناتها الوصفية وتعليمات CIL والاعتماديات الأصلية واستيراد إعادة البناء ومقارنة الإصدارات                                                                     |
+| البرامج الثابتة        |     2 | فحص مناطق البرامج الثابتة على Linux واستخراجها الصريح                                                                                                                          |
+| Android APK            |     5 | بيانات الحزمة وmanifest والبحث عن الأصناف وقوائم الأعضاء وفك ترجمة الأساليب والمراجع الثابتة                                                                                      |
+| مراقبة المتصفح         |    12 | بنية الصفحات وبيانات الشبكة والبرامج النصية وخرائط المصدر واكتشاف WebMCP والصور ومقارنة الالتقاط                                                                                |
+| تحليل Electron         |     5 | مراقبة العارضين وخريطة التطبيق الثابتة والمواءمة بين نتائج الثبات والتشغيل                                                                                                     |
+| وقت تشغيل JavaScript   |     2 | اكتشاف أهداف Node/Electron Inspector ومواضع البرامج وأحداث سياقات التنفيذ                                                                                                      |
+| سير عمل التطبيقات      |    14 | تصدير النصوص البرمجية الملتقطة، فحص ذاكرة dyld المشتركة، تتبع الميزات عبر الطبقات ومقارنة الإصدارات ومواءمة المصدر التاريخي ومقارنة أشكال القيم المعادة والتحقق من إعادة الإنشاء |
+| مساحة العمل والملاحظة   |    21 | الجلسات وحزم الأدلة وسياق التنقل ومقارنة العمليات والمخرجات والدوال وتسجيل الأسئلة غير المحسومة                                                                                  |

 ## خطة العمل

@@ -243,7 +243,7 @@ rea setup
  "mcpServers": {
    "rea": {
      "command": "npx",
-      "args": ["-y", "rea-agents@5.0.0", "mcp"]
+      "args": ["-y", "rea-agents@6.0.0", "mcp"]
    }
  }
 }
@@ -336,6 +336,20 @@ npx -y rea-agents@latest compare /absolute/path/to/left-evidence.json /absolute/
 - [Hopper Disassembler](https://www.hopperapp.com/)
 - [سياسة الأمان](SECURITY.md)

+## تاريخ النجوم
+
+🎉 **وصلنا إلى 20,000 نجمة على GitHub، شكرًا لكم!**
+
+شكرًا لكل من يستخدم REA ويبلّغ عن الأخطاء ويختبر الإصدارات ويساهم في إصلاحها.
+
+<a href="https://www.star-history.com/?repos=morluto%2Frea&amp;type=date">
+  <picture>
+    <source media="(prefers-color-scheme: dark)" srcset="https://api.star-history.com/chart?repos=morluto/rea&amp;type=date&amp;theme=dark&amp;legend=top-left" />
+    <source media="(prefers-color-scheme: light)" srcset="https://api.star-history.com/chart?repos=morluto/rea&amp;type=date" />
+    <img alt="تاريخ نجوم REA على GitHub" src="https://api.star-history.com/chart?repos=morluto/rea&amp;type=date" />
+  </picture>
+</a>
+
 ## الترخيص

 [MIT](LICENSE)
@@ -4,9 +4,9 @@

 # REA：あらゆるものをリバースエンジニアリング

-### エージェントでアプリの動作からネイティブバイナリまで調べる。
+### バイナリ、アプリ、実行時の動作をひとつの MCP でリバースエンジニアリング。

-**気になる機能を見つけ、仕組みを理解し、自分の形で実装する。**
+**気に入った機能を見つけたら、その仕組みをバイナリのレベルまで理解する。**

 [![npm version](https://img.shields.io/npm/v/rea-agents?style=flat-square&color=cb3837)](https://www.npmjs.com/package/rea-agents)
 [![CI](https://img.shields.io/github/actions/workflow/status/morluto/rea/ci.yml?branch=main&style=flat-square&label=CI)](https://github.com/morluto/rea/actions/workflows/ci.yml)
@@ -45,11 +45,11 @@

 ---

-アプリの機能を自分のプロダクトにも取り入れたいときは、REA を使ってエージェントに調査を依頼できます。ソースコードがなくても、アプリを調べ、仕組みと根拠を示し、あなたのプロジェクト向けに同様の機能を実装できます。
+自分のプロダクトにも欲しい機能を他のアプリで見つけたら、REA を使ってエージェントに調査を依頼できます。エージェントはソースコードがなくてもアプリを調べ、機能の仕組みを説明して根拠を示し、あなたのプロジェクト向けの実装まで進められます。

-REA はネイティブバイナリ、JavaScript/Electron アプリ、.NET アセンブリ、Web サイトの解析ツールを提供します。エージェントからもターミナルからも使えます。解析はローカルで実行され、結果には根拠と制限が含まれます。
+REA は、ネイティブバイナリ、JavaScript/Electron アプリ、.NET アセンブリ、Web サイトを調べるためのツールをエージェントに提供します。同じツールはターミナルからも使えます。解析はローカルで実行され、結果には各結論の根拠と制限が含まれます。

-Setup はエージェントを設定し、既存の Hopper または Ghidra に接続します。承認後に Hopper をインストールすることもできます。
+セットアップは REA をエージェントに登録し、対応するワークフロー手順もインストールします。ネイティブ解析には既存の Hopper または Ghidra を使えます。承認すれば、セットアップで Hopper をインストールすることもできます。静的な JavaScript 解析にはどちらのエンジンも不要です。

 ## エージェントに頼むだけ

@@ -59,7 +59,7 @@ Setup はエージェントを設定し、既存の Hopper または Ghidra に
 メモアプリの検索機能を調べて根拠を示し、私のプロジェクト向けに同様の機能を実装してください。
 ```

-メモアプリを調べたいアプリに置き換えるか、まず概要を依頼してください。
+「メモアプリ」を調べたいアプリに置き換えてください。まずは概要の調査を依頼することもできます。

 ## バイナリから動作へ

@@ -67,56 +67,73 @@ Setup はエージェントを設定し、既存の Hopper または Ghidra に
 | -------------------------------------------------------------------------------------------------------------------------------- | -------------------------------------------------------------------------------------------------------------------------- | ------------------------------------------------------------------------------------------ |
 | ネイティブアプリや実行ファイルから、プロシージャ、疑似コード、アセンブリ、文字列、シンボル、セグメント、メタデータを復元します。 | 呼び出し元、呼び出し先、クロスリファレンス、コールグラフをたどり、機能やアルゴリズムの実際の動作を説明できる状態にします。 | エージェントが得た知見を、あなたの技術スタック、画面、要件に合うプロダクト機能へ変えます。 |

-REA は調査をバイナリ上の根拠に結び付けます。元のソースコードを復元したり、アプリ全体を自動複製したりするとは主張しません。
+REA は結論に至った根拠を示します。元のソースコードを復元できる、あるいはアプリ全体を自動的に複製できるとは主張しません。

 ## REA を選ぶ理由

-|                            |                                                                                                      |
-| -------------------------- | ---------------------------------------------------------------------------------------------------- |
-| **エージェント向け**       | アプリの動作について質問し、推測ではなくエージェントに調査させることができます。                     |
-| **CLI と MCP**             | ターミナルとエージェントから同じリバースエンジニアリング機能を使えます。                             |
-| **ガイド付きセットアップ** | エージェントの設定、既存の解析ツールへの接続、承認後の Hopper インストールに対応します。             |
-| **洞察からコードへ**       | 機能を理解したら、同じコーディングセッションで自分のプロダクト向けに実装できます。                   |
-| **ローカルで解析**         | 解析は対応するローカルホストで実行され、REA がバイナリをホスト型解析サービスへ送ることはありません。 |
-| **コンテキストを維持**     | 質問ごとに解析を最初からやり直さず、複数のアプリを続けて調査できます。                               |
+|                            |                                                                                                          |
+| -------------------------- | -------------------------------------------------------------------------------------------------------- |
+| **エージェント向け**       | アプリの動作を質問すると、エージェントが推測ではなく実際に調べて答えます。                               |
+| **CLI と MCP**             | 同じリバースエンジニアリング機能を、ターミナルからもエージェントからも使えます。                         |
+| **ガイド付きセットアップ** | エージェントの設定、既存の解析ツールへの接続、承認したうえでの Hopper のインストールに対応します。       |
+| **洞察からコードへ**       | 機能を理解したら、同じコーディングセッションで自分のプロダクト向けに実装できます。                       |
+| **ローカルで解析**         | 解析は対応するローカルホストで実行されます。REA がアプリをホスト型の解析サービスへ送ることはありません。 |
+| **コンテキストを維持**     | 質問のたびに解析をやり直すことなく、複数のアプリを続けて調査できます。                                   |

 ## クイックスタート

 ### セットアップを実行（推奨）

-REA をエージェントで使うための設定を行います：
+REA をエージェントで使えるように設定します：

 ```bash
 npx rea-agents setup
 ```

-Setup は最初に連携するエージェントを複数選択できるようにします。既存の REA 登録は初期選択されますが、検出されただけのクライアントは自動選択されず、未設定のクライアントも選べます。具体的なパスと変更内容を確認してから承認してください。選択したエージェントには通常 REA のワークフローをインストールします。Hopper は別の任意操作で、個別の承認が必要です。既存の Ghidra のパスも登録できます。
+セットアップでは、まず REA を使うエージェントを選び（複数選択可）、具体的なパスと変更内容を確認してから承認します。既存の REA 登録は最初から選択されています。新しく検出されたエージェントは選択肢に表示されますが、検出されただけでは選択されません。選択したエージェントには、MCP 接続と REA のガイド付きワークフローが追加されます。Hopper のインストールは別の任意項目で、個別に承認が必要です。既存の Ghidra のインストール先を登録することもできます。

-変更は事前に表示され、既存の設定はバックアップされます。要件と追加オプションは[インストールガイド](docs/installation.md)を参照してください。
+セットアップは変更を適用する前に内容を表示し、既存の設定をバックアップします。要件とセットアップのオプションは[インストールガイド](docs/installation.md)を参照してください。

-### エージェントで使う
+### エージェントで使う（推奨）

-設定後にエージェントを再起動し、調べたいアプリや機能を説明します。REA は Claude Code、Claude Desktop、Codex、Cursor、Gemini CLI、Windsurf、Devin、OpenCode、Antigravity、GitHub Copilot CLI、Command Code、VS Code に対応します。既存の REA 登録は初期選択され、それ以外の検出済みクライアントは選択が必要です。その他のエージェントは下記の MCP 設定を使えます。
+セットアップ後にエージェントを再起動し、理解したいアプリや機能を[説明してください](#エージェントに頼むだけ)。Hopper はデモモードでも動作します。初回起動の画面が表示されたら、デモを選ぶか既存のライセンスを入力してください。

-Hopper はデモモードで使えます。初回起動の画面ではデモを選択するか、既存のライセンスを入力してください。
+REA は Claude Code、Claude Desktop、Codex、Cursor、Gemini CLI、Windsurf、Devin、OpenCode、Antigravity、GitHub Copilot CLI、Command Code、VS Code に対応しています。セットアップでは既存の REA 登録が最初から選択され、それ以外の検出済みエージェントは選択するまで対象になりません。その他のエージェントは[手動の MCP 設定](#他のコーディングエージェントで使う)を使えます。

 ### AI コーディングアシスタント向けスキル（任意）

-AI コーディングアシスタントにスキルを追加すると、より豊富なコンテキストが得られます：
+AI コーディングアシスタントにスキルを追加すると、より豊富なコンテキストを利用できます：

 ```bash
 npx skills add morluto/rea --skill reverse-engineer-anything
 ```

-このスキルは REA の調査ワークフローを提供します。上記の setup を実行して REA をエージェントに接続し、解析ツールを設定してください。Setup は既定でバージョンに合ったスキルをインストールします。このコマンドではリポジトリ版のスキルをインストールします。
+このスキルは REA の調査ワークフローを提供します。REA をエージェントに接続して解析ツールを設定するには、上記のセットアップを実行してください。セットアップは既定でバージョンの一致したスキルをインストールします。このコマンドはリポジトリ版のスキルをインストールします。

-展開済みの JavaScript/Electron アプリのツリーや ASAR であれば、MCP の設定もネイティブエンジンも不要です：
+### ターミナルで最初の結果を得る
+
+展開済みの JavaScript/Electron アプリのディレクトリまたは ASAR に対して、次を実行します：

 ```bash
 npx -y rea-agents@latest analyze-javascript-application /absolute/path/to/app --json
 ```

-パスを調査対象に置き換えてください（Windows では `"D:/apps/example"` のようなパス）。この静的ワークフローではそのようなパスも扱えます。ネイティブ解析には専用のエンジン設定が必要です。
+パスは調査対象に置き換えてください（Windows では `"D:/apps/example"` など）。MCP の設定、Hopper、Ghidra を必要とせず、アプリを実行することもなく、Evidence、復元したグラフ、制限、未解決事項をその場で返します。ネイティブアプリの場合は、先にエンジンを設定してから、そのアプリのパスを指定して `analyze` を使います。`doctor` は問題を診断したいときに使うもので、解析のたびに実行する必要はありません。
+
+### 作業に合わせて準備状況を確認する
+
+オプションなしの `rea doctor` は連携全体の監査です。検出したすべてのエージェント登録、インストール済みのスキル、すべての任意の解析エンジンを確認するため、今の作業には支障がなくても `healthy: false` を報告することがあります。作業に合わせて確認範囲を指定してください：
+
+| 作業                                       | 準備状況の確認                                                                                 |
+| ------------------------------------------ | ---------------------------------------------------------------------------------------------- |
+| 静的な JavaScript/Electron 解析            | 不要です。`analyze-javascript-application` を直接実行します。                                  |
+| 特定の解析エンジンのトラブルシューティング | `rea doctor --provider ghidra --json`（または `hopper`、`ida`）                                |
+| 特定のエージェントの MCP 登録を確認        | `rea doctor --client codex --json`（[クライアント ID](docs/installation.md#supported-agents)） |
+| インストール済みのスキルを確認             | `rea doctor --skill --json`                                                                    |
+
+範囲を指定したレポートでは、`healthy` と終了ステータスを決めるのは `scope_checks` だけです。それ以外の項目は `informational_checks` に表示され、今の作業のために修正する必要はありません。たとえば、使っていないエンジンが見つからなくても対処は不要です。
+
+ネイティブ対象に対応するエンジンが複数インストールされている場合、REA は自動ではどれも選びません。対象を開くと `code: "capability_unavailable"` と `details.selection_reason: "ambiguous"` で失敗し、`details.candidate_ids` に候補が示されます。CLI の `--provider` か `open_binary` の `provider_id` で一度選ぶか、常用する設定として `REA_ANALYSIS_PROVIDER` を指定してください。詳しくは[英語版の解説](README.md#choosing-a-deep-analysis-provider)を参照してください。

 ### rea コマンドをインストール

@@ -126,9 +143,9 @@ npx -y rea-agents@latest analyze-javascript-application /absolute/path/to/app --
 curl -fsSL https://raw.githubusercontent.com/morluto/rea/main/install.sh | bash
 ```

-Node.js と npm を先にインストールしてください。ターミナルで実行すると、インストーラーは `rea` を追加してセットアップを開始します。
+Node.js と npm を先にインストールしておいてください。ターミナルで実行すると、インストーラーは `rea` を追加してセットアップを開始します。

-npm でインストールし、セットアップを実行することもできます：
+npm でインストールしてから、セットアップを実行することもできます：

 ```bash
 npm install --global rea-agents
@@ -137,38 +154,56 @@ rea setup

 ### 要件

+静的な JavaScript 解析に必要なのは Node.js と npm だけです。ホストと外部ツールの前提条件は使うワークフローによって異なり、ネイティブ解析プロバイダーの対応プラットフォームは各ガイドで説明しています。
+
 - macOS 12 以降
 - Ubuntu 24.04+、Fedora 41+、64 ビット Arch Linux、または CachyOS
- Node.js 22.x (>=22.19)、24.x (>=24.11)、または 26+ と npm
+- Node.js 22.x (>=22.19)、24.x (>=24.11)、または 26+
+- npm（特定のバージョンは不要で、REA が npm をインストールすることもありません）

-ネイティブバイナリ解析には Hopper または Ghidra が必要です。Hopper は別製品です。デモにはベンダー所定の制限がありますが、有料ライセンスは必須ではありません。
+ネイティブバイナリの詳細な解析には Hopper、Ghidra、IDA Pro のいずれかが必要です。Hopper は独自のライセンスを持つ別製品で、デモ版でもベンダーが定める制限の範囲で解析できます。Ghidra と IDA は、利用者が用意したものを使います。

-Ghidra は Linux x64 と macOS x64/arm64 に対応します。Ghidra 12.1.x と、そのインストールが宣言する完全な 64 ビット JDK（`application.java.min` から `application.java.max` まで）を別途インストールし、REA で使うように設定してください。現行の 12.1 リリースは JDK 21 以降を要求し、上限は設定しません。ブリッジは Ghidra 12.1.4 と JDK 21 で検証しています。macOS ではホストのアーキテクチャに合うネイティブデコンパイラーも必要です。
+Ghidra は Linux x64 と macOS x64/arm64 に対応しています。Ghidra 12.1.x と、そのインストールが宣言する 64 ビットの完全な JDK（`application.java.min` から `application.java.max` まで）を別途インストールし、REA で使うように設定してください。現行の 12.1 リリースは JDK 21 以降を必要とし、上限はありません。ブリッジは Ghidra 12.1.4 と JDK 21 で検証しています。macOS では、ホストのアーキテクチャに合うネイティブデコンパイラーも必要です。

-Setup はインストールを確認し、パスを保存できます。Ghidra、Java、Node.js、npm、Homebrew のインストールや更新は行いません。
+```bash
+export GHIDRA_INSTALL_DIR=/absolute/path/to/ghidra_12.1.4_PUBLIC
+export JAVA_HOME=/absolute/path/to/jdk-21 # java と javac が PATH から解決できる場合は省略可
+rea doctor --provider ghidra --json
+rea setup
+```

-リポジトリの main と npm 4.1.0 には、ローカル NTFS 上のネイティブ x86-64 PE アプリケーション（非マネージド、非 DLL 向け）を対象とする実験的な Windows x64 Ghidra P0 対応が含まれています。Job Object、プライベート DACL、パス許可の各制御が同梱されています。古い npm パッケージに期待する前に[リリース境界](docs/installation.md#released-package-and-main)を確認してください。前提条件と検証済みの範囲は [Windows Ghidra P0](docs/windows-ghidra-p0.md) を参照してください。
+セットアップはこれらのインストールを確認し、承認後にパスを保存します。Ghidra、Java、Node.js、npm、Homebrew のインストールや更新は行いません。
+
+IDA Pro は、すでに動作している [mrexodia/ida-pro-mcp](https://github.com/mrexodia/ida-pro-mcp) の MCP 登録を再利用します。開いている GUI の対象を読み取り専用で解析するか（`attached`、既定）、データベースのスーパーバイザーで指定したバイナリをヘッドレスで開いて解析します（`headless`）。REA が attached の GUI データベースを保存したり閉じたりすることはありません。最初の実環境での検証は、Windows の GUI と Windows x64 のヘッドレス IDA 9.3 が対象です。設定方法と対応範囲は [IDA プロバイダーガイド](docs/ida-provider.md)を参照してください。
+
+```bash
+export REA_IDA_MCP_CONFIG=/absolute/path/to/ida-mcp.json
+rea function /absolute/path/to/program main --provider ida --json
+```
+
+リポジトリの main と npm 4.1.0 には、ローカル NTFS 上のネイティブ x86-64 PE アプリケーション（マネージドコードと DLL を除く）を対象とする、実験的な Windows x64 Ghidra P0 対応が含まれています。Job Object、プライベート DACL、パスの受け入れ検査の各制御も同梱されています。古い npm パッケージでこの機能を使えるか確認するには[リリース境界](docs/installation.md#released-package-and-main)を、前提条件と検証済みの範囲は [Windows Ghidra P0](docs/windows-ghidra-p0.md) を参照してください。

 ### トラブルシューティング

-`npx -y rea-agents@latest doctor` はホスト、依存関係、解析ツール、エージェント設定を変更せずに確認します。構造化された診断には `--json` を追加してください。
+`npx -y rea-agents@latest doctor` は、ホスト、依存関係、解析ツール、エージェント設定を変更せずに確認します。構造化された診断結果が必要な場合は `--json` を追加してください。

-Linux では実行可能な `/opt/hopper/bin/Hopper` を優先し、利用できない場合は `~/.local/share/rea/hopper/bin/Hopper` を自動的に確認します。それ以外の場所では `HOPPER_LAUNCHER_PATH` を設定します。ファイルがあるのに解析エンジンが見つからない場合は、実際の Hopper パスに対して `ldd /absolute/path/to/Hopper | grep 'not found'` を実行し、不足ライブラリを確認してください。詳しくは [Hopper ガイド](docs/installation.md#hopper)を参照してください。
+Linux では実行可能な `/opt/hopper/bin/Hopper` を優先し、利用できない場合は `~/.local/share/rea/hopper/bin/Hopper` を自動的に確認します。それ以外の場所にインストールした場合は `HOPPER_LAUNCHER_PATH` を設定してください。ファイルがあるのに解析エンジンが見つからないと報告される場合は、実際の Hopper のパスに対して `ldd /absolute/path/to/Hopper | grep 'not found'` を実行し、不足しているライブラリを確認してください。詳しくは [Hopper ガイド](docs/installation.md#hopper)を参照してください。

 ### 更新とアンインストール

 - `rea update` は現在の REA インストールを更新します。
- `rea uninstall` は REA が管理するエージェント登録とワークフローファイルを削除します。Hopper は残ります。
- `rea uninstall --purge-data` は REA のキャッシュと状態も削除します。それらを削除したい場合にだけ使ってください。
+- `rea uninstall` は REA が管理するエージェント登録とスキルだけを削除します。Hopper、Node.js、Evidence ファイル、キャプチャ、無関係なスキル、他の MCP サーバーは残ります。
+- `rea uninstall --purge-data` は `~/.rea/cache` と `~/.rea/state` も削除します。それらを消したい場合にだけ使ってください。

 ## 現在の対応状況

 リポジトリの現在の機能とプラットフォーム要件は[英語の対応状況ガイド](README.md#current-status)で説明しています。main は [npm リリース](docs/installation.md#released-package-and-main)より先行する場合があります。

- Ghidra は Linux x64、macOS x64/arm64、実験的な Windows x64 P0 境界で 25 件の読み取り専用操作を提供します。Linux/macOS ではアトミックなセッション内関数注釈にも対応します。Windows P0 は読み取り専用であり、Ghidra に GUI 操作はありません。
- 静的な Android 検査には持ち込みの JADX/Java が別途必要です。実プロバイダー検証は Linux を対象とします。詳しくは[Android 解析](docs/android-analysis.md)を参照してください。
- ブラウザー、Electron、プロセスの各リクエストは対象・操作・ライフサイクルを直接指定し、ホストの実際のアクセスに依存します。REA 側の個別の許可付与は不要です。Setup による設定書き込みと Hopper のインストールは、引き続き正確な計画の承認が必要です。
- `rea capabilities` はバイナリセッション操作の説明であり、すべてのアプリ／ランタイムツールの目録ではありません。接続済み MCP ツール一覧と関連ガイドを参照してください。
+- Ghidra は Linux x64、macOS x64/arm64、実験的な Windows x64 P0 境界で 25 種類の読み取り専用操作を提供します。Linux と macOS では、セッション内での関数名とエントリーコメントのアトミックな編集にも対応します。Windows P0 には変更の権限がなく、Ghidra には REA から操作できる GUI 機能はありません。
+- IDA アダプターは、ドキュメントに記載された読み取り専用の関数・文字列操作を提供します。
+- 静的な Android APK の検査は Linux と macOS に対応し、別途用意したヘッドレス JADX と完全な JDK が必要です。現在のメタデータブリッジは macOS arm64 で検証しています。詳しくは [Android 解析](docs/android-analysis.md)を参照してください。
+- ブラウザー、Electron、プロセスの各リクエストは対象、操作、ライフサイクルを直接指定し、ホストで実際に許可されたアクセスの範囲で動作します。REA 側で別途権限を付与する必要はありません。セットアップによる設定の書き込みと Hopper のインストールには、引き続き具体的な計画の承認が必要です。
+- `rea capabilities` と `rea providers` はバイナリセッションのプロバイダーと補助操作を説明するもので、ブラウザー、Android、アプリのすべてのワークフローの一覧ではありません。MCP の機能全体は、接続中の MCP ツール一覧と `binary_session` が示すツールの利用可否で確認してください。

 ## ひとつのプロンプトで調査を完結

@@ -181,49 +216,54 @@ TypeScript と SQLite を使って私のプロジェクト向けに実装して
 | ---: | ------------------------------ | ---------------------------------------------------------------- |
 |    1 | バイナリを開いて識別           | `open_binary`, `binary_overview`                                 |
 |    2 | オフライン検索の手掛かりを探す | `search_strings`, `search_procedures`, `list_names`              |
-|    3 | 手掛かりと実行コードを接続     | `find_xrefs_to_name`, `xrefs`, `procedure_callers`               |
-|    4 | 制御フローを復元               | `get_call_graph`, `procedure_callees`, `procedure_info`          |
+|    3 | 手掛かりを実行コードに結び付け | `find_xrefs_to_name`, `xrefs`, `procedure_callers`               |
+|    4 | 関連する制御フローを復元       | `get_call_graph`, `procedure_callees`, `procedure_info`          |
 |    5 | 関連する処理を逆コンパイル     | `procedure_pseudo_code`, `procedure_assembly`, `batch_decompile` |
-|    6 | プロジェクトに機能を実装する   | 技術スタック、プロダクト、要件に合わせたコード                   |
+|    6 | プロジェクトに機能を実装       | 技術スタック、プロダクト、要件に合わせたコード                   |

-REA は手順 1〜5 のバイナリ解析を処理し、手順 6 はエージェントの通常の編集・テストツールが行います。
+手順 1〜5 のアプリ解析は REA が担当します。手順 6 は、アプリについて得た知見をもとに、エージェントが通常の編集ツールとテストツールで行います。

 ## エージェントにできること

- ソースコードがない機能の仕組みを説明する。
- アプリの認証、保存、更新、ネットワークフローを復元する。
- 非公開の形式やインターフェースを文書化できる構造を回収する。
- 文字列やシンボルから疑わしい動作の実装コードまで追跡する。
- 同じセッションで 2 バージョンを切り替え、実装経路を比較する。
- 気になる機能を調査し、自分のプロダクトに合わせた形で実装する。
- 復元した動作をプロダクト機能、テスト、移行ノート、移植、相互運用できる代替実装へ変換する。
- Swift / Objective-C のメタデータを解析する。
- Hopper に名前、コメント、ブックマークを残し、人間とエージェントの調査を共有する。
+- 気に入った機能を調査し、自分のプロダクトに合わせた形で実装する。
+- ソースコードが手に入らない機能の仕組みを説明する。
+- アプリの認証、保存、更新、ネットワーク処理の流れを復元する。
+- 文書化されていない形式やインターフェースについて、文書化に必要な構造を復元する。
+- 文字列やシンボルから、疑わしい動作を実装しているコードまでたどる。
+- 復元した動作を、プロダクト機能、テスト、移行メモ、移植版、相互運用できる代替実装に変える。
+- マングルされたシンボルをひとつずつ手作業で読み解かなくても、Swift と Objective-C のメタデータを解析する。
+- Hopper に名前、コメント、ブックマークを残し、人とエージェントの解析を互いに活かす。

 ## 調査ツールカタログ

-| ツール分類           |  数 | 用途                                                                                                                                         |
-| -------------------- | --: | -------------------------------------------------------------------------------------------------------------------------------------------- |
-| ネイティブ検査       |  41 | 関数、疑似コード、アセンブリ、文字列、シンボル、呼び出し、参照、注釈、バイト読み取り、ファイルオフセット                                     |
-| 調査ワークフロー     |  14 | アプリ概要、関数ドシエ、ネイティブ API とディスパッチ、一括逆コンパイル、機能トレース、コールパス、コールグラフ、Swift と Objective-C の検出 |
-| macOS ネイティブ     |   7 | Hopper を起動せずに扱える Mach-O メタデータ、署名、plist、アーキテクチャ、Swift 名の復元                                                     |
-| 成果物グラフ         |   5 | ディレクトリとパッケージの目録、コンパイル済み Interface Builder ファイル、Apple アセットカタログ、抽出                                      |
-| マネージド PE/CLI    |   7 | .NET の識別、メタデータ、CIL 命令、ネイティブ依存関係、再構築インポート、ビルド比較                                                          |
-| ファームウェア       |   2 | Linux ファームウェア領域の検査と明示的な展開                                                                                                 |
-| Android APK          |   5 | パッケージと manifest の宣言、クラス検索、メンバー一覧、メソッド逆コンパイル、静的参照                                                       |
-| ブラウザー観察       |  11 | ページ構成、ネットワークメタデータ、スクリプト、ソースマップ、WebMCP 検出、スクリーンショット、キャプチャ比較                                |
-| Electron 解析        |   5 | レンダラー観察、静的アプリマッピング、静的／実行時結果の対応付け                                                                             |
-| JavaScript 実行時    |   2 | Node/Electron Inspector 対象の検出、スクリプト位置、実行コンテキストイベント                                                                 |
-| アプリワークフロー   |  13 | 取得した Web スクリプトのエクスポート、層をまたぐ機能トレース、ビルド比較、履歴ソース対応、静的戻り値形状の比較、再実装検証                  |
-| ワークスペースと観察 |  21 | セッション、証跡バンドル、ナビゲーション文脈、プロセス・成果物・関数比較、未解決事項の記録                                                   |
+| ツール分類           |  数 | 用途                                                                                                                                                                                             |
+| -------------------- | --: | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ |
+| ネイティブ検査       |  41 | 関数、疑似コード、アセンブリ、文字列、シンボル、呼び出し、参照、注釈、バイト読み取り、ファイルオフセット                                                                                         |
+| 調査ワークフロー     |  14 | アプリ概要、関数ドシエ、ネイティブ API とディスパッチ、一括逆コンパイル、機能トレース、コールパス、コールグラフ、Swift と Objective-C の検出                                                     |
+| ネイティブバイナリ   |  10 | macOS の Mach-O メタデータ、署名、plist、アーキテクチャ、Swift シンボル、LLDB による呼び出し観測；Linux の ELF レイアウト、静的な保護機構の証拠と記録済みクラッシュ                              |
+| 成果物グラフ         |   7 | ディレクトリとパッケージの目録、コンパイル済み Interface Builder ファイル、Apple アセットカタログ、Mach-O dylib のロード解決、抽出、オフライン EVM インターフェース推定                          |
+| マネージド PE/CLI    |   7 | .NET の識別情報、メタデータ、CIL 命令、ネイティブ依存関係、再構築結果のインポート、ビルド比較                                                                                                    |
+| ファームウェア       |   2 | Linux ファームウェア領域の検査と明示的な展開                                                                                                                                                     |
+| Android APK          |   5 | パッケージと manifest の宣言、クラス検索、メンバー一覧、メソッドの逆コンパイル、静的な被参照                                                                                                     |
+| ブラウザー観察       |  12 | ページ構成、ネットワークメタデータ、スクリプト、ソースマップ、WebMCP の検出、スクリーンショット、キャプチャ比較                                                                                  |
+| Electron 解析        |   5 | レンダラーの観察、静的なアプリのマッピング、静的結果と実行時結果の照合                                                                                                                           |
+| JavaScript 実行時    |   2 | Node/Electron Inspector の対象検出、スクリプトの位置、実行コンテキストのイベント                                                                                                                 |
+| アプリワークフロー   |  14 | 取得した Web スクリプトのエクスポート、Android/Apple の目録の投影、dyld 共有キャッシュの検査、層をまたぐ機能トレース、ビルド比較、過去のソースとの対応付け、静的な戻り値形状の比較、再構築の検証 |
+| ワークスペースと観察 |  21 | セッション、Evidence バンドル、ナビゲーションの文脈、プロセス・成果物・関数の比較、未解決事項の記録                                                                                              |

 ## ロードマップ

-次の作業はネイティブ対象の検証拡大、JavaScript と .NET のバージョン比較、実行時の観察と再実装の検証です。Setup はエージェント連携と Hopper のインストールを選択できます。他の解析ツールのインストールは今後の作業です。[インストールのロードマップ](docs/roadmap.md)と[解析ツールの評価](docs/provider-evaluation.md)を参照してください。
+[現在の対応状況](#現在の対応状況)は提供済みの機能です。今後の作業は次のとおりです。
+
+- **現在：** ツール、プロバイダー、セットアップの選択肢、バージョンの変更に合わせてドキュメントを正確に保ち、Hopper と Ghidra で検証するネイティブバイナリのアーキテクチャと間接呼び出しの範囲を広げます。
+- **次：** 機能トレースに静的抽出と実行時の観察を追加し、難読化された .NET アセンブリの比較を改善し、プロセス、プロトコル、ファイルシステム、再接続、バージョン比較の範囲を広げます。
+- **その後：** ブラウザーと Electron のシナリオ操作を増やし、LLDB や Frida などによるネイティブアプリの実行時観察と、他の解析ツールや対象の評価を進めます。
+
+セットアップでは、すでにエージェント連携と Hopper のインストールを選べます。その他の解析ツールのインストールへの対応は今後の作業です。[インストールのロードマップ](docs/roadmap.md)と[解析ツールの評価](docs/provider-evaluation.md)を参照してください。

 ## 他のコーディングエージェントで使う

-Setup は Claude Code、Claude Desktop、Codex、Cursor、Gemini CLI、Windsurf、Devin、OpenCode、Antigravity、GitHub Copilot CLI、Command Code、VS Code に対応します。既存の REA 登録は初期選択され、それ以外の検出済みクライアントは選択が必要です。ローカル MCP サーバーに対応するエージェントは、次の設定でも接続できます。
+セットアップは Claude Code、Claude Desktop、Codex、Cursor、Gemini CLI、Windsurf、Devin、OpenCode、Antigravity、GitHub Copilot CLI、Command Code、VS Code に対応しています。既存の REA 登録は最初から選択され、それ以外の検出済みエージェントは選択するまで対象になりません。ローカル MCP サーバーに対応するエージェントであれば、次の設定でも接続できます。

 <!-- x-release-please-start-version -->

@@ -232,7 +272,7 @@ Setup は Claude Code、Claude Desktop、Codex、Cursor、Gemini CLI、Windsurf
  "mcpServers": {
    "rea": {
      "command": "npx",
-      "args": ["-y", "rea-agents@5.0.0", "mcp"]
+      "args": ["-y", "rea-agents@6.0.0", "mcp"]
    }
  }
 }
@@ -240,29 +280,33 @@ Setup は Claude Code、Claude Desktop、Codex、Cursor、Gemini CLI、Windsurf

 <!-- x-release-please-end -->

+常用する登録では、パッケージのバージョンを 1 つに固定してください。`rea setup` はその固定バージョンを維持し、同梱のスキルも同時に更新します。
+
 ## 仕組み

 ```mermaid
 flowchart LR
    Agent["コーディングエージェント"] --> REA["REA<br/>CLI + MCP"]
    Terminal["ターミナル"] --> REA
-    REA --> Hopper["Hopper 解析操作"]
+    REA --> Hopper["Hopper プロバイダー"]
+    REA --> Ghidra["Ghidra プロバイダー<br/>インベントリ + 関数解析 + 注釈"]
+    REA --> Ida["IDA MCP プロバイダー<br/>attached GUI または headless データベース"]
    Hopper --> App["あなたのアプリ"]
-    REA --> Ghidra["Ghidra 読み取り専用解析<br/>インベントリ + 関数解析"]
    Ghidra --> App
+    Ida --> App
 ```

-CLI と MCP サーバーは同じ解析処理を使います。ターミナルコマンドは完了後に自分のブリッジセッションを解放し、エージェントセッションは調査中の接続を維持できます。REA セッションを閉じても、ユーザーが利用中の Hopper は終了しません。
+CLI と MCP サーバーは、同じアプリケーションワークフローと Evidence の契約を使います。ターミナルのコマンドは完了すると自身のブリッジセッションを解放し、エージェントのセッションは調査中の対象と Evidence を保持できます。REA のセッションを閉じても、利用中の Hopper アプリは終了しません。

 ## CLI

-上のエージェントワークフローが、REA を使う最も簡単な方法です。ターミナルから一度だけアプリの概要を調べる場合は、次を実行します。
+上のエージェントワークフローが、REA を使う最も簡単な方法です。ターミナルからアプリの概要を一度だけ調べる場合は、次を実行します。

 ```bash
 npx -y rea-agents@latest analyze /Applications/Notes.app
 ```

-直接デコンパイルする方法やその他のオプションは、`npx -y rea-agents@latest --help` で確認できます。
+直接の逆コンパイルやその他のオプションは、`npx -y rea-agents@latest --help` で確認できます。

 グローバルな `rea` コマンドとしてもインストールできます。

@@ -272,41 +316,49 @@ rea --help
 rea mcp
 ```

-REA は Mac の `.app` フォルダーを直接開けます。エージェントがアプリを見つけられない場合は、インストール場所を伝えてください。
+REA は Mac の `.app` フォルダーを直接開けます。エージェントがアプリを名前で見つけられない場合は、インストール場所を伝えてください。

 ## Hopper アプリの動作

-REA は必要なときに Hopper を起動します。Hopper のランチャーは内部でアプリをアクティブ化するため、ターゲットを開くと Hopper が前面に出る場合があります。REA はバックグラウンド起動を要求しますが、常に背面に留まる保証はありません。
+REA は操作に必要になった時点で Hopper を起動します。Hopper のランチャーは内部でアプリをアクティブにするため、REA がバックグラウンドでの起動を要求しても、macOS では Hopper のウィンドウやダイアログが前面に出る場合があります。デモやライセンスの画面では操作が必要になることがあります。

-明示的な形式・アーキテクチャ引数により一般的な FAT / ARM 選択ダイアログを避けますが、別の Hopper / macOS ダイアログは人の操作を必要とする場合があります。セッションを閉じるとブリッジとソケットを削除しますが、ユーザーが利用中の Hopper は終了しません。
+Hopper は解析リクエストを一度に 1 つずつ処理します。待機をキャンセルしても、Hopper 内ですでに実行中の処理は止まりません。処理中かどうかはセッションが報告します。セッションを閉じると REA のブリッジと一時ソケットディレクトリを削除しますが、利用中の Hopper アプリは終了しません。後片付けを確認できなかった場合、`close_binary` は `cleanup_incomplete` と対象のリソースを報告します。

 ## セキュリティモデル

-各セッションはランダムな capability token と現在のユーザーだけが使える Unix ソケットを使用します。Ghidra セッションは隔離された一時プロジェクトも使用し、ユーザー所有の Ghidra プロジェクトを開いたり変更したりしません。これはサンドボックスではなく、同じ OS ユーザー権限で動作する悪意あるプロセスを防御しません。信頼できないバイナリの解析は、現在のユーザー権限で選択されたローカルプロバイダーに委譲されます。脆弱性は [SECURITY.md](SECURITY.md) の非公開手順で報告してください。
+解析はローカルで実行されます。REA は Hopper や Ghidra とは認証付きのプライベートなローカルソケットで、IDA とは設定済みのローカル MCP 登録を通じて通信します。Ghidra セッションは隔離された一時プロジェクトを使い、ユーザーの Ghidra プロジェクトを開いたり変更したりしません。
+
+これはサンドボックスではありません。解析ツールと起動した対象は現在のユーザー権限で動作し、同じ OS ユーザー権限で動く悪意のあるプロセスは防げません。Windows Ghidra P0 では、ネイティブの Job Object、保護されたプライベート DACL、ハンドルベースの受け入れ検査を自動的に使います。脆弱性は [SECURITY.md](SECURITY.md) に記載された非公開の手順で報告してください。

 ## FAQ

-<details><summary><strong>Hopper を先に起動する必要がありますか？</strong></summary>
+<details><summary><strong>Hopper を先に起動しておく必要はありますか？</strong></summary>

-いいえ。REA が必要時に起動します。Hopper が起動済みでも使えますが、既存の GUI ドキュメントには接続せず、新しい解析ドキュメントを開きます。
+いいえ。REA は必要になった時点で Hopper を起動します。すでに起動している Hopper でも使えますが、既存の GUI ドキュメントには接続せず、新しい解析ドキュメントを開きます。

 </details>

-<details><summary><strong>REA に Hopper は含まれますか？</strong></summary>
+<details><summary><strong>REA に Hopper は含まれていますか？</strong></summary>

-含まれません。Setup で Hopper をインストールできますが、Hopper は独自のライセンスを持つ別製品です。REA は CLI、MCP サーバー、エージェント向けワークフローを提供します。
+含まれていません。セットアップで Hopper をインストールできますが、Hopper は独自のライセンスを持つ別製品です。REA は、エージェントが Hopper を使えるようにする CLI、MCP サーバー、ワークフローを提供します。

 </details>

-<details><summary><strong>バイナリはアップロードされますか？</strong></summary>
+<details><summary><strong>REA は Ghidra や Java をインストールしたり同梱したりしますか？</strong></summary>

-REA にホスト型解析サービスはありません。ローカル Unix ソケット経由で Hopper を操作します。エージェントやモデル提供者のデータポリシーは別途確認してください。
+いいえ。REA は既存の Ghidra のインストールに接続します。[要件](#要件)にある Ghidra と Java のパスを設定してから、セットアップを実行してください。
+
+</details>
+
+<details><summary><strong>アプリはアップロードされますか？</strong></summary>
+
+REA にホスト型の解析サービスはありません。現在のプロバイダーは、成果物の解析と動作のキャプチャをローカルで行います。エージェントやモデルの提供元には独自のデータポリシーがあるため、別途確認してください。

 </details>

 <details><summary><strong>元のソースコードを復元できますか？</strong></summary>

-保証できません。REA は疑似コード、アセンブリ、シンボル、文字列、メタデータ、関係を提供し、エージェントが観察した動作を説明または互換再現できるようにします。
+元のソースコードを確実に復元できるデコンパイラーはありません。REA はエージェントに疑似コード、アセンブリ、シンボル、文字列、メタデータ、それらの関係を提供し、観察された動作の説明や互換性のある再現に役立てられるようにします。

 </details>

@@ -314,6 +366,20 @@ REA にホスト型解析サービスはありません。ローカル Unix ソ

 開発環境、アーキテクチャ、テスト、リリース手順は [CONTRIBUTING.md](CONTRIBUTING.md) を参照してください。

+## スター履歴
+
+🎉 **GitHub スターが 20,000 を突破しました。ありがとうございます！**
+
+REA を使い、問題を報告し、ビルドをテストし、修正を届けてくださる皆さんに感謝します。
+
+<a href="https://www.star-history.com/?repos=morluto%2Frea&amp;type=date">
+  <picture>
+    <source media="(prefers-color-scheme: dark)" srcset="https://api.star-history.com/chart?repos=morluto/rea&amp;type=date&amp;theme=dark&amp;legend=top-left" />
+    <source media="(prefers-color-scheme: light)" srcset="https://api.star-history.com/chart?repos=morluto/rea&amp;type=date" />
+    <img alt="REA の GitHub スター履歴" src="https://api.star-history.com/chart?repos=morluto/rea&amp;type=date" />
+  </picture>
+</a>
+
 ## ライセンス

 [MIT](LICENSE)
@@ -109,7 +109,7 @@ AI 코딩 어시스턴트에 스킬을 추가하면 더 풍부한 컨텍스트
 npx skills add morluto/rea --skill reverse-engineer-anything
 ```

-이 스킬은 REA의 조사 워크플로를 제공합니다. 위 setup을 실행해 REA를 에이전트에 연결하고 분석 도구를 설정하세요. Setup은 기본적으로 버전에 맞는 스킬을 설치합니다. 이 명령은 저장소 버전의 스킬을 설치합니다.
+이 스킬은 REA의 조사 워크플로를 제공합니다. 위 Setup을 실행해 REA를 에이전트에 연결하고 분석 도구를 설정하세요. Setup은 기본적으로 버전에 맞는 스킬을 설치합니다. 이 명령은 저장소 버전의 스킬을 설치합니다.

 압축을 해제한 JavaScript/Electron 앱 트리나 ASAR라면 MCP 설정이나 네이티브 엔진 없이 바로 분석할 수 있습니다.

@@ -117,7 +117,7 @@ npx skills add morluto/rea --skill reverse-engineer-anything
 npx -y rea-agents@latest analyze-javascript-application /absolute/path/to/app --json
 ```

-경로를 조사 대상으로 바꾸세요(Windows에서는 `"D:/apps/example"` 같은 경로). 이 정적 워크플로에서는 이런 경로도 지원됩니다. 네이티브 분석에는 전용 엔진 설정이 필요합니다.
+경로를 조사 대상의 경로로 바꾸세요(Windows에서는 `"D:/apps/example"` 같은 경로). 이 정적 워크플로에서는 이런 경로도 지원됩니다. 네이티브 분석에는 전용 엔진 설정이 필요합니다.

 ### rea 명령 설치하기

@@ -144,7 +144,7 @@ rea setup

 네이티브 바이너리 분석에는 Hopper 또는 Ghidra가 필요합니다. Hopper는 별도 소프트웨어입니다. 데모에는 공급업체의 제한이 있지만 유료 라이선스가 필수는 아닙니다.

-Ghidra는 Linux x64와 macOS x64/arm64를 지원합니다. Ghidra 12.1.x와 그 설치본이 선언한 완전한 64비트 JDK(`application.java.min`부터 `application.java.max`까지)를 별도로 설치한 뒤 REA가 사용하도록 설정하세요. 현재 12.1 릴리스는 JDK 21 이상을 요구하고 상한은 없습니다. 브리지는 Ghidra 12.1.4와 JDK 21에서 검증됩니다. macOS에서는 호스트 아키텍처에 맞는 네이티브 디컴파일러도 필요합니다.
+Ghidra는 Linux x64와 macOS x64/arm64를 지원합니다. Ghidra 12.1.x와 그 설치본이 선언한 완전한 64비트 JDK(`application.java.min`부터 `application.java.max`까지)를 별도로 설치한 뒤 REA에서 사용하도록 설정하세요. 현재 12.1 릴리스는 JDK 21 이상을 요구하고 상한은 없습니다. 브리지는 Ghidra 12.1.4와 JDK 21에서 검증됩니다. macOS에서는 호스트 아키텍처에 맞는 네이티브 디컴파일러도 필요합니다.

 Setup은 설치를 확인하고 경로를 저장할 수 있습니다. Ghidra, Java, Node.js, npm, Homebrew를 설치하거나 업데이트하지 않습니다.

@@ -164,7 +164,7 @@ Linux에서는 실행 가능한 `/opt/hopper/bin/Hopper`를 우선 사용하고,

 ## 현재 지원 범위

-저장소의 현재 기능과 플랫폼 요구 사항은 [영문 지원 가이드](README.md#current-status)에 설명되어 있습니다. main은 [npm 릴리스](docs/installation.md#released-package-and-main)보다 앞설 수 있습니다.
+저장소의 현재 기능과 플랫폼 요구 사항은 [영문 지원 가이드](README.md#current-status)에 설명되어 있습니다. main은 [npm 릴리스](docs/installation.md#released-package-and-main)보다 앞선 내용이 포함될 수 있습니다.

 - Ghidra는 Linux x64, macOS x64/arm64, 실험적인 Windows x64 P0 경계에서 25개의 읽기 전용 작업을 제공합니다. Linux/macOS에서는 원자적 세션 함수 주석도 추가로 지원합니다. Windows P0는 읽기 전용이며 Ghidra에는 GUI 제어가 없습니다.
 - 정적 Android 검사는 별도로 준비한 JADX/Java가 필요합니다. 실제 제공자 검증은 Linux를 대상으로 합니다. [Android 분석](docs/android-analysis.md)을 참고하세요.
@@ -187,7 +187,7 @@ TypeScript와 SQLite를 사용해 제 프로젝트에 맞는 버전을 구현해
 |    5 | 관련 루틴 디컴파일      | `procedure_pseudo_code`, `procedure_assembly`, `batch_decompile` |
 |    6 | 프로젝트에 기능 구현    | 기술 스택, 제품, 요구 사항에 맞는 코드                           |

-REA는 1–5단계의 바이너리 분석을 처리합니다. 6단계는 에이전트가 일반 파일 편집 및 테스트 도구로 수행합니다.
+REA는 1~5단계의 바이너리 분석을 처리합니다. 6단계는 에이전트가 일반 파일 편집 및 테스트 도구로 수행합니다.

 ## 에이전트가 할 수 있는 일

@@ -203,20 +203,20 @@ REA는 1–5단계의 바이너리 분석을 처리합니다. 6단계는 에이

 ## 조사 도구 카탈로그

-| 도구 분류         |  수 | 용도                                                                                                                      |
-| ----------------- | --: | ------------------------------------------------------------------------------------------------------------------------- |
-| 네이티브 검사     |  41 | 함수, 의사 코드, 어셈블리, 문자열, 심볼, 호출, 참조, 주석, 바이트 읽기, 파일 오프셋                                       |
-| 조사 워크플로     |  14 | 앱 개요, 함수 기록서, 네이티브 API와 디스패치, 일괄 디컴파일, 기능 추적, 호출 경로, 호출 그래프, Swift와 Objective-C 탐색 |
-| macOS 네이티브    |   7 | Hopper 실행 없이 처리하는 Mach-O 메타데이터, 서명, plist, 아키텍처, Swift 이름 복원                                       |
-| 아티팩트 그래프   |   5 | 디렉터리와 패키지 목록, 컴파일된 Interface Builder 파일, Apple 애셋 카탈로그, 추출                                        |
-| 관리 PE/CLI       |   7 | .NET 식별, 메타데이터, CIL 명령어, 네이티브 종속성, 재구성 가져오기, 빌드 비교                                            |
-| 펌웨어            |   2 | Linux 펌웨어 영역 검사 및 명시적 추출                                                                                     |
-| Android APK       |   5 | 패키지와 manifest 선언, 클래스 검색, 멤버 목록, 메서드 디컴파일, 정적 참조                                                |
-| 브라우저 관찰     |  11 | 페이지 구조, 네트워크 메타데이터, 스크립트, 소스 맵, WebMCP 탐색, 스크린샷, 캡처 비교                                     |
-| Electron 분석     |   5 | 렌더러 관찰, 정적 앱 매핑, 정적·런타임 결과 연결                                                                          |
-| JavaScript 런타임 |   2 | Node/Electron Inspector 대상 탐색, 스크립트 위치, 실행 컨텍스트 이벤트                                                    |
-| 앱 워크플로       |  13 | 캡처한 웹 스크립트 내보내기, 계층 간 기능 추적, 빌드 비교, 히스토리 소스 매핑, 정적 반환 구조 비교, 재구현 검증           |
-| 작업 공간과 관찰  |  21 | 세션, 근거 번들, 탐색 컨텍스트, 프로세스·아티팩트·함수 비교, 미해결 항목 기록                                             |
+| 도구 분류         |  수 | 용도                                                                                                                                     |
+| ----------------- | --: | ---------------------------------------------------------------------------------------------------------------------------------------- |
+| 네이티브 검사     |  41 | 함수, 의사 코드, 어셈블리, 문자열, 심볼, 호출, 참조, 주석, 바이트 읽기, 파일 오프셋                                                      |
+| 조사 워크플로     |  14 | 앱 개요, 함수 기록서, 네이티브 API와 디스패치, 일괄 디컴파일, 기능 추적, 호출 경로, 호출 그래프, Swift와 Objective-C 탐색                |
+| 네이티브 바이너리 |  10 | macOS의 Mach-O 메타데이터, 서명, plist, 아키텍처, Swift 심볼과 LLDB 호출 관찰; Linux의 ELF 레이아웃, 정적 보호 증거와 기록된 크래시      |
+| 아티팩트 그래프   |   7 | 디렉터리와 패키지 목록, 컴파일된 Interface Builder 파일, Apple 애셋 카탈로그, Mach-O dylib 로드 해석, 추출, 오프라인 EVM 인터페이스 추론 |
+| 관리 PE/CLI       |   7 | .NET 식별, 메타데이터, CIL 명령어, 네이티브 종속성, 재구성 가져오기, 빌드 비교                                                           |
+| 펌웨어            |   2 | Linux 펌웨어 영역 검사 및 명시적 추출                                                                                                    |
+| Android APK       |   5 | 패키지와 manifest 선언, 클래스 검색, 멤버 목록, 메서드 디컴파일, 정적 참조                                                               |
+| 브라우저 관찰     |  12 | 페이지 구조, 네트워크 메타데이터, 스크립트, 소스 맵, WebMCP 탐색, 스크린샷, 캡처 비교                                                    |
+| Electron 분석     |   5 | 렌더러 관찰, 정적 앱 매핑, 정적·런타임 결과 연결                                                                                         |
+| JavaScript 런타임 |   2 | Node/Electron Inspector 대상 탐색, 스크립트 위치, 실행 컨텍스트 이벤트                                                                   |
+| 앱 워크플로       |  14 | 캡처한 웹 스크립트 내보내기, dyld 공유 캐시 검사, 계층 간 기능 추적, 빌드 비교, 히스토리 소스 매핑, 정적 반환 구조 비교, 재구현 검증     |
+| 작업 공간과 관찰  |  21 | 세션, 근거 번들, 탐색 컨텍스트, 프로세스·아티팩트·함수 비교, 미해결 항목 기록                                                            |

 ## 로드맵

@@ -233,7 +233,7 @@ Setup은 Claude Code, Claude Desktop, Codex, Cursor, Gemini CLI, Windsurf, Devin
  "mcpServers": {
    "rea": {
      "command": "npx",
-      "args": ["-y", "rea-agents@5.0.0", "mcp"]
+      "args": ["-y", "rea-agents@6.0.0", "mcp"]
    }
  }
 }
@@ -273,7 +273,7 @@ rea --help
 rea mcp
 ```

-REA는 Mac의 `.app` 폴더를 직접 열 수 있습니다. 에이전트가 앱을 찾지 못하면 설치 위치를 알려 주세요.
+REA는 macOS의 `.app` 폴더를 직접 열 수 있습니다. 에이전트가 앱을 찾지 못하면 설치 위치를 알려 주세요.

 ## Hopper 앱 동작

@@ -315,6 +315,20 @@ REA에는 호스팅 분석 서비스가 없습니다. 로컬 Unix 소켓을 통

 개발 환경, 아키텍처, 테스트, 릴리스 지침은 [CONTRIBUTING.md](CONTRIBUTING.md)를 참고하세요.

+## 스타 기록
+
+🎉 **GitHub 스타 20,000개, 감사합니다!**
+
+REA를 사용하고, 버그를 제보하고, 빌드를 테스트하고, 수정에 기여해 주신 모든 분께 감사드립니다.
+
+<a href="https://www.star-history.com/?repos=morluto%2Frea&amp;type=date">
+  <picture>
+    <source media="(prefers-color-scheme: dark)" srcset="https://api.star-history.com/chart?repos=morluto/rea&amp;type=date&amp;theme=dark&amp;legend=top-left" />
+    <source media="(prefers-color-scheme: light)" srcset="https://api.star-history.com/chart?repos=morluto/rea&amp;type=date" />
+    <img alt="REA GitHub 스타 기록" src="https://api.star-history.com/chart?repos=morluto/rea&amp;type=date" />
+  </picture>
+</a>
+
 ## 라이선스

 [MIT](LICENSE)
@@ -202,20 +202,20 @@ REA 负责第 1–5 步中的二进制分析。第 6 步由智能体使用其常

 ## 调查工具目录

-| 工具类别          | 数量 | 用途                                                                                                   |
-| ----------------- | ---: | ------------------------------------------------------------------------------------------------------ |
-| 原生检查          |   41 | 函数、伪代码、汇编、字符串、符号、调用、引用、注释、字节读取与文件偏移                                 |
-| 调查工作流        |   14 | 应用概览、函数档案、原生 API 与分发、批量反编译、功能追踪、调用路径与调用图、Swift 与 Objective-C 发现 |
-| macOS 原生工具    |    7 | Mach-O 元数据、代码签名、plist、架构与 Swift 符号还原，无需启动 Hopper                                 |
-| 产物图            |    5 | 目录与软件包清单、编译后的 Interface Builder 文件、Apple 资源目录与提取                                |
-| 托管 PE/CLI       |    7 | .NET 程序集身份、元数据、CIL 指令、原生依赖声明、重建导入与构建比较                                    |
-| 固件              |    2 | Linux 固件区域检查与显式提取                                                                           |
-| Android APK       |    5 | 包与 manifest 声明、类搜索、成员清单、方法反编译与静态引用                                             |
-| 浏览器观察        |   11 | 页面结构、网络元数据、脚本、来源映射、WebMCP 发现、截图与捕获比较                                      |
-| Electron 分析     |    5 | 渲染进程观察、静态应用映射、静态/运行时结果关联                                                        |
-| JavaScript 运行时 |    2 | Node/Electron Inspector 目标发现、脚本位置与执行上下文事件                                             |
-| 应用工作流        |   13 | 捕获的网站脚本导出、跨层功能追踪、构建比较、历史源码映射、静态返回结构比较与重建验证                   |
-| 工作区与观察      |   21 | 会话、证据包、导航上下文、进程/产物/函数比较与待解决问题跟踪                                           |
+| 工具类别          | 数量 | 用途                                                                                                                 |
+| ----------------- | ---: | -------------------------------------------------------------------------------------------------------------------- |
+| 原生检查          |   41 | 函数、伪代码、汇编、字符串、符号、调用、引用、注释、字节读取与文件偏移                                               |
+| 调查工作流        |   14 | 应用概览、函数档案、原生 API 与分发、批量反编译、功能追踪、调用路径与调用图、Swift 与 Objective-C 发现               |
+| 原生二进制工具    |   10 | macOS 的 Mach-O 元数据、签名、plist、架构、Swift 符号与 LLDB 调用观察；Linux 的 ELF 布局、静态保护证据与历史崩溃记录 |
+| 产物图            |    7 | 目录与软件包清单、编译后的 Interface Builder 文件、Apple 资源目录、Mach-O dylib 加载解析、提取与离线 EVM 接口推断    |
+| 托管 PE/CLI       |    7 | .NET 程序集身份、元数据、CIL 指令、原生依赖声明、重建导入与构建比较                                                  |
+| 固件              |    2 | Linux 固件区域检查与显式提取                                                                                         |
+| Android APK       |    5 | 包与 manifest 声明、类搜索、成员清单、方法反编译与静态引用                                                           |
+| 浏览器观察        |   12 | 页面结构、网络元数据、脚本、来源映射、WebMCP 发现、截图与捕获比较                                                    |
+| Electron 分析     |    5 | 渲染进程观察、静态应用映射、静态/运行时结果关联                                                                      |
+| JavaScript 运行时 |    2 | Node/Electron Inspector 目标发现、脚本位置与执行上下文事件                                                           |
+| 应用工作流        |   14 | 捕获的网站脚本导出、dyld 共享缓存检查、跨层功能追踪、构建比较、历史源码映射、静态返回结构比较与重建验证              |
+| 工作区与观察      |   21 | 会话、证据包、导航上下文、进程/产物/函数比较与待解决问题跟踪                                                         |

 ## 路线图

@@ -232,7 +232,7 @@ Setup 支持 Claude Code、Claude Desktop、Codex、Cursor、Gemini CLI、Windsu
  "mcpServers": {
    "rea": {
      "command": "npx",
-      "args": ["-y", "rea-agents@5.0.0", "mcp"]
+      "args": ["-y", "rea-agents@6.0.0", "mcp"]
    }
  }
 }
@@ -316,6 +316,20 @@ REA 不提供托管分析服务，而是通过本地 Unix 套接字把操作交

 开发环境、架构、测试和发布说明请参阅 [CONTRIBUTING.md](CONTRIBUTING.md)。

+## Star 历史
+
+🎉 **GitHub Star 突破 20,000，感谢大家！**
+
+感谢每一位使用 REA、反馈问题、测试构建和贡献修复的朋友。
+
+<a href="https://www.star-history.com/?repos=morluto%2Frea&amp;type=date">
+  <picture>
+    <source media="(prefers-color-scheme: dark)" srcset="https://api.star-history.com/chart?repos=morluto/rea&amp;type=date&amp;theme=dark&amp;legend=top-left" />
+    <source media="(prefers-color-scheme: light)" srcset="https://api.star-history.com/chart?repos=morluto/rea&amp;type=date" />
+    <img alt="REA GitHub Star 历史" src="https://api.star-history.com/chart?repos=morluto/rea&amp;type=date" />
+  </picture>
+</a>
+
 ## 许可证

 [MIT](LICENSE)
@@ -0,0 +1,208 @@
+"""REA offline adapter using mitmproxy's unchanged native tnetstring decoder.
+
+No FlowReader migrations, HAR conversion, proxy listener, or target requests.
+The containing mitmdump process and its configuration directory are REA-owned.
+"""
+
+import base64
+import hashlib
+import json
+import math
+import re
+import resource
+from pathlib import Path
+
+from mitmproxy import ctx, version
+from mitmproxy.io import tnetstring
+
+PROFILE = "12.2.3"
+OUTPUT_BYTES = 96 * 1024 * 1024
+CREDENTIALS = {b"authorization", b"proxy-authorization", b"cookie", b"set-cookie"}
+
+
+class CaptureFailure(Exception):
+    def __init__(self, reason, message, pointer=""):
+        self.reason, self.pointer = reason, pointer
+        super().__init__(message)
+
+
+def pointer(parent, key):
+    return parent + "/" + str(key).replace("~", "~0").replace("/", "~1")
+
+
+class BoundedReader:
+    """Refuse malicious declared lengths before the upstream parser allocates."""
+    def __init__(self, handle, size):
+        self.handle, self.size = handle, size
+
+    def read(self, count):
+        if count < 0 or count > self.size - self.handle.tell():
+            raise CaptureFailure("format", "Native record declares bytes beyond the retained capture.")
+        return self.handle.read(count)
+
+
+def project_record(state, secrets):
+    binaries, numbers, redactions = [], [], []
+    byte_secrets = []
+    for secret in secrets:
+        try:
+            byte_secrets.append(secret.encode("utf-8", errors="strict"))
+        except UnicodeEncodeError:
+            # Non-scalar JSON strings have no UTF-8 byte representation.
+            # Keep them in secrets for the ordinary string projection.
+            pass
+
+    def redact(text, path, original):
+        if any(secret in text or secret in original for secret in secrets):
+            redactions.append({"pointer": path, "reason": "explicit-sensitive-value"})
+            return None
+        return text
+
+    def transport_value(value, path, transport_url):
+        if not (transport_url or re.fullmatch(r"/(?:backup/)*request/(?:path|authority)", path)):
+            return value, False
+        binary = isinstance(value, bytes)
+        pattern = rb"^([\x00-\x20]*(?:[a-z][a-z0-9+.-]*:)?//)[^/?#]*@" if binary else r"^([\x00-\x20]*(?:[a-z][a-z0-9+.-]*:)?//)[^/?#]*@"
+        replacement = rb"\1" if binary else r"\1"
+        separator = b"@" if binary else "@"
+        safe_url = re.sub(pattern, replacement, value, flags=re.I)
+        if path.endswith("/authority") and separator in safe_url:
+            safe_url = safe_url.rsplit(separator, 1)[1]
+        changed = safe_url != value
+        if changed:
+            redactions.append({"pointer": path, "reason": "transport-credential"})
+        return safe_url, changed
+
+    def validate_omitted(value, path, depth):
+        before = len(binaries), len(numbers), len(redactions)
+        visit(value, path, depth)
+        del binaries[before[0]:]
+        del numbers[before[1]:]
+        del redactions[before[2]:]
+
+    def visit(value, path, depth=0, credential=False, transport_url=False):
+        if depth > 64:
+            raise CaptureFailure("input-limit", "Native capture exceeds the 64-level evidence nesting budget.", path)
+        if credential:
+            validate_omitted(value, path, depth)
+            redactions.append({"pointer": path, "reason": "transport-credential"})
+            if isinstance(value, bytes):
+                binaries.append({"pointer": path, "representation": "producer-bytes", "state": "redacted", "content_base64": None, "bytes": None, "sha256": None})
+            return None
+        if isinstance(value, bytes):
+            safe_bytes, credential_url = transport_value(value, path, transport_url)
+            content_base64 = base64.b64encode(value).decode("ascii")
+            digest = hashlib.sha256(value).hexdigest()
+            hidden = any(secret in value or secret in safe_bytes for secret in byte_secrets) or any(secret in content_base64 or secret in digest for secret in secrets)
+            safe_text = None
+            try:
+                safe_text = safe_bytes.decode("utf-8", errors="strict")
+            except UnicodeDecodeError:
+                pass
+            if hidden:
+                redactions.append({"pointer": path, "reason": "explicit-sensitive-value"})
+            exclude = hidden or credential_url
+            binaries.append({"pointer": path, "representation": "producer-bytes", "state": "redacted" if exclude else "retained", "content_base64": None if exclude else content_base64, "bytes": None if exclude else len(value), "sha256": None if exclude else digest})
+            if hidden:
+                return None
+            return safe_text
+        if isinstance(value, str):
+            safe_text, _ = transport_value(value, path, transport_url)
+            return redact(safe_text, path, value)
+        if isinstance(value, bool) or value is None:
+            return value
+        if isinstance(value, (int, float)):
+            literal = repr(value)
+            if any(secret in literal for secret in secrets):
+                redactions.append({"pointer": path, "reason": "explicit-sensitive-value"})
+                return None
+            numbers.append({"pointer": path, "producer_type": "integer" if isinstance(value, int) else "float", "literal": literal})
+            return value if (abs(value) <= 9007199254740991 if isinstance(value, int) else math.isfinite(value)) else None
+        if isinstance(value, (list, tuple)):
+            fields = re.fullmatch(r"/(?:backup/)*(?:request|response)/(?:headers|trailers)", path)
+            if fields:
+                result = []
+                for index, field in enumerate(value):
+                    if not isinstance(field, (list, tuple)) or len(field) != 2 or not isinstance(field[0], bytes):
+                        raise CaptureFailure("format", "Native header/trailer is not an ordered byte pair.", pointer(path, index))
+                    result.append([visit(field[0], pointer(pointer(path, index), 0), depth + 2), visit(field[1], pointer(pointer(path, index), 1), depth + 2, field[0].lower() in CREDENTIALS, field[0].lower() in {b"location", b"referer", b"origin"})])
+                return result
+            return [visit(item, pointer(path, index), depth + 1) for index, item in enumerate(value)]
+        if isinstance(value, dict):
+            result = {}
+            for key, item in value.items():
+                if not isinstance(key, str):
+                    raise CaptureFailure("format", "Native record has a non-string dictionary key.", path)
+                if any(secret in key for secret in secrets):
+                    # Validate the omitted subtree too, then discard all of its
+                    # coordinates rather than inventing a replacement identity.
+                    validate_omitted(item, pointer(path, key), depth + 1)
+                    redactions.append({"pointer": path, "reason": "explicit-sensitive-value", "scope": "property-name"})
+                    continue
+                result[key] = visit(item, pointer(path, key), depth + 1)
+            return result
+        raise CaptureFailure("decoder", "Native parser returned an unexpected value type: " + type(value).__name__ + ".", path)
+
+    return {"reported": visit(state, ""), "binary_fields": binaries, "numeric_literals": numbers, "redactions": redactions}
+
+
+def decode(request):
+    if version.VERSION != PROFILE:
+        raise CaptureFailure("unsupported", "Expected mitmproxy " + PROFILE + "; observed " + version.VERSION + ".")
+    records = []
+    capture = Path(request["snapshot_path"])
+    size = capture.stat().st_size
+    with capture.open("rb") as handle:
+        reader = BoundedReader(handle, size)
+        while handle.tell() < size:
+            start = handle.tell()
+            try:
+                state = tnetstring.load(reader)
+            except CaptureFailure:
+                raise
+            except RecursionError:
+                raise CaptureFailure("input-limit", "Native parser exceeded its recursion budget at byte offset " + str(start) + ".") from None
+            except (ValueError, IndexError, UnicodeError, EOFError):
+                raise CaptureFailure("format", "Malformed native record at byte offset " + str(start) + ".") from None
+            if not isinstance(state, dict):
+                raise CaptureFailure("format", "Native flow record must be a dictionary at byte offset " + str(start) + ".")
+            records.append({"ordinal": len(records), "location": {"kind": "byte-range", "offset": start, "bytes": handle.tell() - start}, **project_record(state, request["sensitive_values"]), "limitations": ["Fields are original native states without FlowReader migration. Binary fields contain exact producer bytes; reported UTF-8 strings for those fields are derived display views. Unknown flow/version extensions are retained without interpretation."]})
+    return {"decoder": {"id": "mitmproxy-native-tnetstring", "name": "REA offline native mitmproxy adapter", "version": PROFILE}, "container": {"reported": None, "numeric_literals": [], "redactions": [], "records_pointer": None}, "total_records": len(records), "records": records}
+
+
+def failure_reply(error):
+    """Keep producer constraints, resource exhaustion and adapter defects distinct."""
+    if isinstance(error, CaptureFailure):
+        return {"ok": False, "reason": error.reason, "message": str(error), "pointer": error.pointer}
+    if isinstance(error, MemoryError):
+        return {"ok": False, "reason": "resource-limit", "message": "Native decoder exhausted its 768 MiB address-space budget.", "pointer": ""}
+    return {"ok": False, "reason": "decoder", "message": "Offline native decoder failed unexpectedly: " + type(error).__name__ + ".", "pointer": ""}
+
+
+class OfflineCapture:
+    def load(self, loader):
+        loader.add_option("rea_request_path", str, "", "REA private offline capture request")
+
+    def running(self):
+        resource.setrlimit(resource.RLIMIT_AS, (768 * 1024 * 1024, 768 * 1024 * 1024))
+        resource.setrlimit(resource.RLIMIT_CPU, (30, 30))
+        resource.setrlimit(resource.RLIMIT_FSIZE, (OUTPUT_BYTES, OUTPUT_BYTES))
+        resource.setrlimit(resource.RLIMIT_CORE, (0, 0))
+        request = json.loads(Path(ctx.options.rea_request_path).read_text(encoding="utf-8"))
+        try:
+            response = {"ok": True, "value": decode(request)}
+        except Exception as error:
+            response = failure_reply(error)
+        try:
+            try:
+                output = json.dumps(response, ensure_ascii=True, allow_nan=False, separators=(",", ":")).encode("ascii")
+            except Exception as error:
+                output = json.dumps(failure_reply(error), separators=(",", ":")).encode("ascii")
+            if len(output) > OUTPUT_BYTES:
+                output = b'{"ok":false,"reason":"limit","message":"Native reply exceeds the complete-evidence output budget.","pointer":""}'
+            Path(request["reply_path"]).write_bytes(output)
+        finally:
+            ctx.master.shutdown()
+
+
+addons = [OfflineCapture()]
@@ -0,0 +1,303 @@
+"""Bounded native call observation executed inside LLDB's embedded Python.
+
+REA imports this module into `lldb --batch` and runs `rea_trace <config.json>`.
+It launches one owned process, stops at the requested functions and
+Objective-C methods, records each entry from registers and memory reads only,
+continues, and kills the process once it exits, the event limit is reached or
+the duration elapses. No expression is evaluated and no target code runs on
+the tracer's behalf. The result is written as JSON to the configured path.
+"""
+
+import json
+import time
+
+import lldb
+
+ARGUMENT_REGISTERS = {
+    "arm64": ["x0", "x1", "x2", "x3", "x4", "x5", "x6", "x7"],
+    "arm64e": ["x0", "x1", "x2", "x3", "x4", "x5", "x6", "x7"],
+    "x86_64": ["rdi", "rsi", "rdx", "rcx", "r8", "r9"],
+    "x86_64h": ["rdi", "rsi", "rdx", "rcx", "r8", "r9"],
+}
+MAX_SELECTOR_BYTES = 1024
+MAX_REPORTED_LOCATIONS = 64
+MAX_OTHER_STOPS = 256
+LISTENER_NAME = "rea-native-call-observation"
+
+
+def _hex(value):
+    return "0x%x" % value
+
+
+def _location(address, target):
+    """Load and file address, module and symbol of one code address."""
+    module = address.GetModule()
+    symbol = address.GetSymbol()
+    file_address = address.GetFileAddress()
+    return {
+        "load_address": _hex(address.GetLoadAddress(target)),
+        "file_address": None
+        if file_address == lldb.LLDB_INVALID_ADDRESS
+        else _hex(file_address),
+        "module": module.GetFileSpec().GetFilename() if module.IsValid() else None,
+        "module_path": str(module.GetFileSpec()) if module.IsValid() else None,
+        "symbol": symbol.GetName() if symbol.IsValid() else None,
+    }
+
+
+def _no_files():
+    return lldb.SBFileSpecList()
+
+
+def _create_breakpoints(target, spec):
+    """LLDB breakpoints for one request; a class-qualified method may need two."""
+    if spec["kind"] == "function":
+        modules = lldb.SBFileSpecList()
+        if spec.get("module"):
+            modules.Append(lldb.SBFileSpec(spec["module"], False))
+        return [
+            target.BreakpointCreateByName(
+                spec["name"], lldb.eFunctionNameTypeAuto, modules, _no_files()
+            )
+        ]
+    class_name = spec.get("class_name")
+    method_type = spec.get("method_type", "any")
+    if class_name is None:
+        return [
+            target.BreakpointCreateByName(
+                spec["selector"], lldb.eFunctionNameTypeSelector, _no_files(), _no_files()
+            )
+        ]
+    prefixes = {"instance": ["-"], "class": ["+"], "any": ["-", "+"]}[method_type]
+    return [
+        target.BreakpointCreateByName(
+            "%s[%s %s]" % (prefix, class_name, spec["selector"]),
+            lldb.eFunctionNameTypeFull,
+            _no_files(),
+            _no_files(),
+        )
+        for prefix in prefixes
+    ]
+
+
+def _dynamic_class(target, pointer):
+    """Class of an Objective-C receiver from LLDB's runtime reader, without running code."""
+    if pointer == 0:
+        return None
+    data = lldb.SBData.CreateDataFromUInt64Array(
+        target.GetByteOrder(), target.GetAddressByteSize(), [pointer]
+    )
+    value = target.CreateValueFromData(
+        "receiver", data, target.GetBasicType(lldb.eBasicTypeObjCID)
+    )
+    dynamic = value.GetDynamicValue(lldb.eDynamicDontRunTarget)
+    name = dynamic.GetTypeName() if dynamic.IsValid() else None
+    if not name or name in ("id", "objc_object *"):
+        return None
+    return name[:-2] if name.endswith(" *") else name
+
+
+def _wanted(spec, symbol):
+    """Selector-only requests may admit only instance or only class methods."""
+    if spec["kind"] != "objc-method" or spec.get("class_name") is not None:
+        return True
+    method_type = spec.get("method_type", "any")
+    if method_type == "any":
+        return True
+    return symbol.startswith("-[" if method_type == "instance" else "+[")
+
+
+def _record(context, thread, index, sequence):
+    target, process, config = context["target"], context["process"], context["config"]
+    frame = thread.GetFrameAtIndex(0)
+    location = _location(frame.GetPCAddress(), target)
+    symbol = location["symbol"] or ""
+    if not _wanted(config["breakpoints"][index], symbol):
+        return None
+    names = ARGUMENT_REGISTERS.get(config["architecture"], [])
+    registers = [
+        {"name": name, "value": _hex(frame.FindRegister(name).GetValueAsUnsigned())}
+        for name in names[: config["argument_registers"]]
+    ]
+    receiver_class = None
+    selector = None
+    if symbol.startswith("-[") or symbol.startswith("+["):
+        error = lldb.SBError()
+        text = process.ReadCStringFromMemory(
+            frame.FindRegister(names[1]).GetValueAsUnsigned(),
+            MAX_SELECTOR_BYTES,
+            error,
+        )
+        selector = text if error.Success() and text else None
+        if symbol.startswith("-["):
+            receiver_class = _dynamic_class(
+                target, frame.FindRegister(names[0]).GetValueAsUnsigned()
+            )
+    frames = min(thread.GetNumFrames(), 1 + config["backtrace_frames"])
+    record = {
+        "sequence": sequence,
+        "elapsed_ms": round((time.monotonic() - context["started"]) * 1000, 3),
+        "thread_id": thread.GetThreadID(),
+        "breakpoint_index": index,
+        "receiver_class": receiver_class,
+        "selector": selector,
+        "registers": registers,
+        "backtrace": [
+            _location(thread.GetFrameAtIndex(depth).GetPCAddress(), target)
+            for depth in range(1, frames)
+        ],
+    }
+    record.update(location)
+    return record
+
+
+def _handle_stop(context, events, other_stops):
+    """Record breakpoint hits of one stop; return an outcome when tracing must end."""
+    process = context["process"]
+    for thread in process:
+        reason = thread.GetStopReason()
+        if reason == lldb.eStopReasonBreakpoint:
+            index = context["breakpoint_index"].get(thread.GetStopReasonDataAtIndex(0))
+            if index is None:
+                continue
+            record = _record(context, thread, index, len(events))
+            if record is not None:
+                events.append(record)
+            if len(events) >= context["config"]["max_events"]:
+                return "event-limit"
+        elif reason in (lldb.eStopReasonSignal, lldb.eStopReasonException):
+            other_stops.append(thread.GetStopDescription(256))
+            if len(other_stops) >= MAX_OTHER_STOPS:
+                return "stop-limit"
+    return None
+
+
+def _breakpoint_report(target, created):
+    report = []
+    for index, breakpoints in enumerate(created):
+        locations = []
+        count = 0
+        for breakpoint in breakpoints:
+            count += breakpoint.GetNumLocations()
+            for position in range(breakpoint.GetNumLocations()):
+                if len(locations) < MAX_REPORTED_LOCATIONS:
+                    locations.append(
+                        _location(breakpoint.GetLocationAtIndex(position).GetAddress(), target)
+                    )
+        report.append({"index": index, "location_count": count, "locations": locations})
+    return report
+
+
+def _launch_info(target, config, listener):
+    launch = lldb.SBLaunchInfo(config["arguments"])
+    launch.SetListener(listener)
+    environment = target.GetEnvironment()
+    for key, value in config["environment"].items():
+        environment.Set(key, value, True)
+    launch.SetEnvironment(environment, False)
+    if config.get("working_directory"):
+        launch.SetWorkingDirectory(config["working_directory"])
+    launch.AddOpenFileAction(0, "/dev/null", True, False)
+    launch.AddOpenFileAction(1, config["stdout_path"], False, True)
+    launch.AddOpenFileAction(2, config["stderr_path"], False, True)
+    return launch
+
+
+def _wait_for_exit(listener, process, seconds):
+    event = lldb.SBEvent()
+    deadline = time.monotonic() + seconds
+    while process.GetState() != lldb.eStateExited and time.monotonic() < deadline:
+        listener.WaitForEvent(1, event)
+
+
+def trace(debugger, config):
+    debugger.SetAsync(True)
+    # Stop at the symbol itself, where argument registers still hold the ABI
+    # arguments, even when line tables would let LLDB skip the prologue.
+    lldb.SBDebugger.SetInternalVariable(
+        "target.skip-prologue", "false", debugger.GetInstanceName()
+    )
+    error = lldb.SBError()
+    target = debugger.CreateTarget(
+        config["executable"], config["architecture"], None, False, error
+    )
+    if not target.IsValid():
+        return {"status": "target-error", "error": error.GetCString()}
+    created = [_create_breakpoints(target, spec) for spec in config["breakpoints"]]
+    breakpoint_index = {}
+    for index, breakpoints in enumerate(created):
+        for breakpoint in breakpoints:
+            breakpoint_index[breakpoint.GetID()] = index
+    listener = lldb.SBListener(LISTENER_NAME)
+    started = time.monotonic()
+    process = target.Launch(_launch_info(target, config, listener), error)
+    if not error.Success() or not process.IsValid():
+        return {"status": "launch-error", "error": error.GetCString()}
+    with open(config["pid_path"], "w") as handle:
+        handle.write(str(process.GetProcessID()))
+    context = {
+        "target": target,
+        "process": process,
+        "config": config,
+        "started": started,
+        "breakpoint_index": breakpoint_index,
+    }
+    events = []
+    other_stops = []
+    outcome = None
+    deadline = started + config["duration_ms"] / 1000
+    event = lldb.SBEvent()
+    while outcome is None:
+        if time.monotonic() >= deadline:
+            outcome = "duration-elapsed"
+            break
+        if not listener.WaitForEvent(1, event):
+            continue
+        if not lldb.SBProcess.EventIsProcessEvent(event):
+            continue
+        state = lldb.SBProcess.GetStateFromEvent(event)
+        if state == lldb.eStateExited:
+            outcome = "exited"
+        elif state == lldb.eStateStopped and not lldb.SBProcess.GetRestartedFromEvent(event):
+            outcome = _handle_stop(context, events, other_stops)
+            if outcome is None:
+                process.Continue()
+    pid = process.GetProcessID()
+    exit_status = None
+    exit_description = None
+    if outcome == "exited":
+        exit_status = process.GetExitStatus()
+        exit_description = process.GetExitDescription()
+    else:
+        process.Kill()
+        _wait_for_exit(listener, process, 5)
+    return {
+        "status": "traced",
+        "version": lldb.SBDebugger.GetVersionString().splitlines()[0],
+        "pid": pid,
+        "outcome": outcome,
+        "exit_status": exit_status,
+        "exit_description": exit_description,
+        "killed": outcome != "exited",
+        "terminated": process.GetState() == lldb.eStateExited,
+        "elapsed_ms": round((time.monotonic() - started) * 1000, 3),
+        "breakpoints": _breakpoint_report(target, created),
+        "events": events,
+        "other_stops": other_stops,
+    }
+
+
+def run(debugger, command, result, internal_dict):
+    """LLDB command entry point: `rea_trace <config.json>`."""
+    with open(command.strip()) as handle:
+        config = json.load(handle)
+    try:
+        output = trace(debugger, config)
+    except Exception as error:  # Reported as a tracer failure, never re-raised into LLDB.
+        output = {"status": "tracer-error", "error": "%s: %s" % (type(error).__name__, error)}
+    with open(config["result_path"], "w") as handle:
+        json.dump(output, handle)
+
+
+def __lldb_init_module(debugger, internal_dict):
+    debugger.HandleCommand("command script add -f rea_lldb_tracer.run rea_trace")
@@ -0,0 +1,293 @@
+import Darwin
+import Foundation
+
+struct RunTokenObservation: Encodable {
+  let pid: Int32
+  let state: String
+  let run_id: String?
+  let reason: String?
+}
+
+struct ProcessIdentityObservation: Encodable {
+  let pid: Int32
+  let state: String
+  let identity: String?
+  let reason: String?
+}
+
+private struct ProcessMetadata {
+  let identity: String
+  let pointerSize: Int
+}
+
+struct ProcessSnapshot {
+  fileprivate let metadata: [Int32: ProcessMetadata]
+  let failure: String?
+}
+
+typealias ProcessTableSysctlCall = (
+  _ mib: inout [Int32],
+  _ output: UnsafeMutableRawPointer?,
+  _ size: inout Int
+) -> Int32
+
+private func readProcessSnapshot() -> ProcessSnapshot {
+  readProcessSnapshot { mib, output, size in
+    sysctl(&mib, u_int(mib.count), output, &size, nil, 0)
+  }
+}
+
+func readProcessSnapshot(
+  sysctlCall: ProcessTableSysctlCall
+) -> ProcessSnapshot {
+  for _ in 0..<3 {
+    var mib = [CTL_KERN, KERN_PROC, KERN_PROC_ALL, 0]
+    var size = 0
+    guard sysctlCall(&mib, nil, &size) == 0 else {
+      let failure = errno
+      return ProcessSnapshot(metadata: [:], failure: "process_table_failed_\(failure)")
+    }
+    guard size >= MemoryLayout<kinfo_proc>.size,
+          size % MemoryLayout<kinfo_proc>.stride == 0 else {
+      return ProcessSnapshot(metadata: [:], failure: "process_table_failed_\(errno)")
+    }
+    var processes = [kinfo_proc](
+      repeating: kinfo_proc(),
+      count: size / MemoryLayout<kinfo_proc>.stride
+    )
+    let result = processes.withUnsafeMutableBufferPointer { buffer in
+      let output = buffer.baseAddress.map { UnsafeMutableRawPointer($0) }
+      return sysctlCall(&mib, output, &size)
+    }
+    guard result == 0 else {
+      let failure = errno
+      if failure == ENOMEM { continue }
+      return ProcessSnapshot(metadata: [:], failure: "process_table_failed_\(failure)")
+    }
+    guard size % MemoryLayout<kinfo_proc>.stride == 0 else {
+      return ProcessSnapshot(metadata: [:], failure: "process_table_failed_\(errno)")
+    }
+    let processCount = size / MemoryLayout<kinfo_proc>.stride
+    let metadata = Dictionary(
+      processes.prefix(processCount).map { process in
+        let start = process.kp_proc.p_starttime
+        return (
+          process.kp_proc.p_pid,
+          ProcessMetadata(
+            identity: "\(start.tv_sec):\(start.tv_usec)",
+            pointerSize: process.kp_proc.p_flag & P_LP64 != 0 ? 8 : 4
+          )
+        )
+      },
+      uniquingKeysWith: { first, _ in first }
+    )
+    return ProcessSnapshot(metadata: metadata, failure: nil)
+  }
+  return ProcessSnapshot(metadata: [:], failure: "process_table_failed_\(ENOMEM)")
+}
+
+func readProcessIdentities(pids: [Int32]) -> [ProcessIdentityObservation] {
+  let snapshot = readProcessSnapshot()
+  return pids.map { pid in
+    guard let metadata = snapshot.metadata[pid] else {
+      return unavailableIdentity(
+        pid: pid,
+        reason: snapshot.failure ?? "process_not_in_snapshot"
+      )
+    }
+    return ProcessIdentityObservation(pid: pid, state: "readable", identity: metadata.identity, reason: nil)
+  }
+}
+
+private func unavailableIdentity(pid: Int32, reason: String) -> ProcessIdentityObservation {
+  ProcessIdentityObservation(pid: pid, state: "unavailable", identity: nil, reason: reason)
+}
+
+enum RunTokenReadError: Error {
+  case invalidBuffer
+  case duplicateToken
+  case invalidTokenEncoding
+  case environmentUnavailable
+  case appleVectorUnavailable
+  case ambiguousEnvironmentBoundary
+}
+
+@_silgen_name("csops")
+private func csops(
+  _ pid: Int32,
+  _ ops: UInt32,
+  _ addr: UnsafeMutableRawPointer?,
+  _ size: Int
+) -> Int32
+
+private let csOpsStatus: UInt32 = 0
+private let csPlatformBinary: UInt32 = 0x0400_0000
+
+/**
+ * Whether the target image is an Apple platform binary. Current macOS omits
+ * the environment of platform binaries from KERN_PROCARGS2 for every caller,
+ * so this distinguishes a policy-withheld environment from a process whose
+ * environment is genuinely absent or transiently unreadable.
+ */
+func isPlatformBinary(pid: Int32) -> Bool {
+  var flags: UInt32 = 0
+  let result = withUnsafeMutablePointer(to: &flags) { pointer in
+    csops(pid, csOpsStatus, UnsafeMutableRawPointer(pointer), MemoryLayout<UInt32>.size)
+  }
+  return result == 0 && (flags & csPlatformBinary) != 0
+}
+
+private func readRunToken(pid: Int32, pointerSize: Int) -> RunTokenObservation {
+  var mib = [CTL_KERN, KERN_PROCARGS2, Int32(pid)]
+  var size = 0
+  guard sysctl(&mib, u_int(mib.count), nil, &size, nil, 0) == 0, size >= MemoryLayout<Int32>.size else {
+    return unavailable(pid: pid, reason: "sysctl_failed_\(errno)")
+  }
+  var bytes = [UInt8](repeating: 0, count: size)
+  let result = bytes.withUnsafeMutableBytes { buffer in
+    sysctl(&mib, u_int(mib.count), buffer.baseAddress, &size, nil, 0)
+  }
+  guard result == 0 else {
+    return unavailable(pid: pid, reason: "sysctl_failed_\(errno)")
+  }
+  bytes = Array(bytes.prefix(size))
+  do {
+    return RunTokenObservation(pid: pid, state: "readable", run_id: try token(in: bytes, pointerSize: pointerSize), reason: nil)
+  } catch RunTokenReadError.duplicateToken {
+    return unavailable(pid: pid, reason: "duplicate_run_token")
+  } catch RunTokenReadError.invalidTokenEncoding {
+    return unavailable(pid: pid, reason: "invalid_run_token_encoding")
+  } catch RunTokenReadError.environmentUnavailable {
+    return unavailable(
+      pid: pid,
+      reason: isPlatformBinary(pid: pid)
+        ? "platform_binary_environment_withheld"
+        : "environment_unavailable"
+    )
+  } catch RunTokenReadError.appleVectorUnavailable {
+    return unavailable(pid: pid, reason: "apple_vector_unavailable")
+  } catch RunTokenReadError.ambiguousEnvironmentBoundary {
+    return unavailable(pid: pid, reason: "ambiguous_environment_boundary")
+  } catch {
+    return unavailable(pid: pid, reason: "malformed_procargs")
+  }
+}
+
+func readRunTokens(pids: [Int32]) -> [RunTokenObservation] {
+  let before = readProcessSnapshot()
+  let observations = pids.map { pid -> RunTokenObservation in
+    guard let metadata = before.metadata[pid] else {
+      return unavailable(pid: pid, reason: before.failure ?? "process_not_in_snapshot")
+    }
+    return readRunToken(pid: pid, pointerSize: metadata.pointerSize)
+  }
+  let after = readProcessSnapshot()
+  return zip(pids, observations).map { pid, observation in
+    guard let initial = before.metadata[pid], let current = after.metadata[pid] else {
+      return unavailable(pid: pid, reason: after.failure ?? "process_not_in_snapshot")
+    }
+    guard initial.identity == current.identity,
+          initial.pointerSize == current.pointerSize else {
+      return unavailable(pid: pid, reason: "process_identity_changed_during_token_read")
+    }
+    return observation
+  }
+}
+
+func token(in bytes: [UInt8], pointerSize: Int = MemoryLayout<UnsafeRawPointer>.size) throws -> String? {
+  guard bytes.count >= MemoryLayout<Int32>.size else { throw RunTokenReadError.invalidBuffer }
+  let argc = bytes.withUnsafeBytes { $0.loadUnaligned(as: Int32.self).littleEndian }
+  guard argc >= 0, Int(argc) <= bytes.count else { throw RunTokenReadError.invalidBuffer }
+  var offset = MemoryLayout<Int32>.size
+  guard let executablePath = readString(in: bytes, offset: &offset) else {
+    throw RunTokenReadError.invalidBuffer
+  }
+  guard pointerSize == 4 || pointerSize == 8 else { throw RunTokenReadError.invalidBuffer }
+  let pathRecordSize = Array("executable_path=".utf8).count + executablePath.count + 1
+  let padding = (pointerSize - pathRecordSize % pointerSize) % pointerSize
+  guard offset + padding <= bytes.count,
+        bytes[offset..<(offset + padding)].allSatisfy({ $0 == 0 }) else {
+    throw RunTokenReadError.invalidBuffer
+  }
+  offset += padding
+  for _ in 0..<argc {
+    guard readString(in: bytes, offset: &offset, allowEmpty: true) != nil else {
+      throw RunTokenReadError.invalidBuffer
+    }
+  }
+  guard bytes.last == 0 else { throw RunTokenReadError.invalidBuffer }
+  if offset == bytes.count {
+    throw RunTokenReadError.environmentUnavailable
+  }
+  var trailingEntries: [ArraySlice<UInt8>] = []
+  var zeroedAppleVectorStart: Int?
+  while offset < bytes.count {
+    if bytes[offset] == 0 {
+      let start = offset
+      while offset < bytes.count, bytes[offset] == 0 {
+        offset += 1
+      }
+      if offset - start > 1 {
+        zeroedAppleVectorStart = zeroedAppleVectorStart ?? trailingEntries.count
+      }
+      continue
+    }
+    guard let entry = readString(in: bytes, offset: &offset) else {
+      throw RunTokenReadError.invalidBuffer
+    }
+    trailingEntries.append(entry)
+  }
+  // XNU appends its Apple vector after the environment. libc clears the
+  // initial `pfz=` record after startup, leaving a multi-NUL run in its place.
+  // A caller can also set `pfz`, so prefer the final intact sentinel when it
+  // remains available and otherwise stop at the cleared record.
+  let intactAppleVectorStart = trailingEntries.lastIndex(where: {
+    $0.starts(with: Array("pfz=".utf8))
+  })
+  let preferZeroedBoundary = zeroedAppleVectorStart.flatMap { zeroedStart in
+    intactAppleVectorStart.map { intactStart in intactStart < zeroedStart } ?? true
+  } ?? false
+  let appleVectorStart = preferZeroedBoundary
+    ? zeroedAppleVectorStart
+    : intactAppleVectorStart
+  guard let appleVectorStart else {
+    throw RunTokenReadError.appleVectorUnavailable
+  }
+  if trailingEntries[appleVectorStart...].contains(where: {
+    $0.starts(with: Array("REA_PROCESS_RUN_ID=".utf8))
+  }) {
+    throw RunTokenReadError.ambiguousEnvironmentBoundary
+  }
+  let environmentEntries = trailingEntries[..<appleVectorStart]
+  guard !environmentEntries.isEmpty else {
+    throw RunTokenReadError.environmentUnavailable
+  }
+  var found: String?
+  for entry in environmentEntries {
+    if entry.starts(with: Array("REA_PROCESS_RUN_ID=".utf8)) {
+      guard found == nil else { throw RunTokenReadError.duplicateToken }
+      let value = entry.dropFirst("REA_PROCESS_RUN_ID=".utf8.count)
+      guard let decoded = String(bytes: value, encoding: .utf8) else {
+        throw RunTokenReadError.invalidTokenEncoding
+      }
+      found = decoded
+    }
+  }
+  return found
+}
+
+private func readString(
+  in bytes: [UInt8],
+  offset: inout Int,
+  allowEmpty: Bool = false
+) -> ArraySlice<UInt8>? {
+  guard offset < bytes.count, let end = bytes[offset...].firstIndex(of: 0),
+        allowEmpty || end > offset else { return nil }
+  let string = bytes[offset..<end]
+  offset = end + 1
+  return string
+}
+
+private func unavailable(pid: Int32, reason: String) -> RunTokenObservation {
+  RunTokenObservation(pid: pid, state: "unavailable", run_id: nil, reason: reason)
+}
@@ -0,0 +1,35 @@
+import Foundation
+
+struct RunTokenResponse: Encodable {
+  let results: [RunTokenObservation]
+}
+
+struct ProcessIdentityResponse: Encodable {
+  let results: [ProcessIdentityObservation]
+}
+
+@main
+struct ProcessRunTokenReaderMain {
+  static func main() {
+    let arguments = Array(CommandLine.arguments.dropFirst())
+    let identityMode = arguments.first == "--identities"
+    let pidArguments = identityMode ? Array(arguments.dropFirst()) : arguments
+    let pids = pidArguments.compactMap(Int32.init)
+    guard pids.count == pidArguments.count else {
+      fputs("invalid process ID input\n", stderr)
+      exit(64)
+    }
+    do {
+      let output: Data
+      if identityMode {
+        output = try JSONEncoder().encode(ProcessIdentityResponse(results: readProcessIdentities(pids: pids)))
+      } else {
+        output = try JSONEncoder().encode(RunTokenResponse(results: readRunTokens(pids: pids)))
+      }
+      FileHandle.standardOutput.write(output)
+    } catch {
+      fputs("could not encode process token observations\n", stderr)
+      exit(70)
+    }
+  }
+}
@@ -0,0 +1,101 @@
+"""Fixed core-only GDB/pwndbg operation; no caller commands or historical PID lookup."""
+import json
+import os
+from pathlib import Path
+import resource
+import gdb
+
+OUTPUT_BYTES = 64 * 1024 * 1024
+
+
+class ContextFailure(Exception):
+    def __init__(self, reason, message):
+        super().__init__(message)
+        self.reason = reason
+
+
+def inspect(request):
+    if gdb.selected_inferior().connection is not None:
+        raise ContextFailure("decoder", "Owned GDB unexpectedly has an inferior connection before core loading.")
+    root = Path(os.environ["REA_CORE_CONTEXT_REQUEST"]).parent
+    empty = root / "no-libraries"
+    empty.mkdir(mode=0o700)
+    for command in ["set auto-load off", "set debuginfod enabled off", "set auto-solib-add off", "set history save off", "set pagination off",
+                    "set sysroot ./no-libraries", "set solib-search-path ./no-libraries"]:
+        gdb.execute(command, to_string=True)
+    entry = request["gdbinit"]
+    try:
+        exec(compile(Path(entry).read_bytes(), entry, "exec"), {"__name__": "__main__", "__file__": entry})
+        import pwndbg.aglib.vmmap
+        import pwndbg.lib.version
+    except (ImportError, OSError) as error:
+        raise ContextFailure("unavailable", "Selected pwndbg could not initialize: " + str(error)) from error
+    version = pwndbg.lib.version.__version__
+    if version != "2026.09.15" and not version.startswith("2026.09.15 build: "):
+        raise ContextFailure("unsupported", "Expected unchanged pwndbg2026.09.15; selected plugin reports " + version + ".")
+    gdb.execute('set context-sections ""', to_string=True)
+    # core-file takes a raw filename and retains quote characters. Use a fixed
+    # relative filename in the owned cwd so no selected path becomes GDB syntax.
+    if Path(request["snapshot_path"]) != root.parent / "object.snapshot":
+        raise ContextFailure("decoder", "Core context request did not select the shared owned snapshot.")
+    gdb.execute("core-file ../object.snapshot", to_string=True)
+    inferior = gdb.selected_inferior()
+    if inferior.connection is None or inferior.connection.type != "core" or gdb.current_progspace().filename is not None:
+        raise ContextFailure("decoder", "Requested core-only boundary was not established; no mapping query performed.")
+    maps = []
+    for page in pwndbg.aglib.vmmap.get():
+        flags = page.flags
+        maps.append({"start": hex(page.start), "end": hex(page.end), "offset": hex(page.offset), "reported_flags": flags,
+                     "permissions": {"read": bool(flags & 4), "write": bool(flags & 2), "execute": bool(flags & 1)} if 1 <= flags <= 7 else None,
+                     "pathname_display": page.objfile, "current_file_identity": "unknown"})
+    return {"status": "available", "gdb_version": gdb.VERSION, "pwndbg_version": version, "connection": "core", "executable": None,
+            "historical_pid": inferior.pid, "reported_limits": {"address_space_bytes": resource.getrlimit(resource.RLIMIT_AS)[0], "cpu_seconds": resource.getrlimit(resource.RLIMIT_CPU)[0], "file_size_bytes": resource.getrlimit(resource.RLIMIT_FSIZE)[0]}, "maps": maps, "confidence": "derived", "completeness": "unknown",
+            "diagnostics": {"stdout": "", "stderr": "", "truncated": False}}
+
+
+def failure_exit(request_path, status, marker):
+    try:
+        descriptor = os.open(Path(request_path).parent / "resource.failure", os.O_WRONLY | os.O_CREAT | os.O_EXCL, 0o600)
+        os.write(descriptor, marker)
+        os.close(descriptor)
+    except (OSError, MemoryError):
+        pass
+    os._exit(status)
+
+
+def main():
+    request_path = os.environ["REA_CORE_CONTEXT_REQUEST"]
+    request = json.loads(Path(request_path).read_text(encoding="utf-8"))
+    reserve = bytearray(1024 * 1024)
+    try:
+        reply = {"ok": True, "value": inspect(request)}
+    except ContextFailure as error:
+        reply = {"ok": False, "reason": error.reason, "message": str(error)}
+    except MemoryError:
+        reserve = None
+        failure_exit(request_path, 75, b"M")
+    except Exception as error:
+        if isinstance(error, OSError) and error.errno == 12:
+            reserve = None
+            failure_exit(request_path, 75, b"M")
+        reply = {"ok": False, "reason": "decoder", "message": type(error).__name__ + ": " + str(error)}
+    try:
+        encoded = json.dumps(reply, ensure_ascii=True, allow_nan=False).encode("utf-8")
+        if len(encoded) > OUTPUT_BYTES:
+            encoded = json.dumps({"ok": False, "reason": "output-limit", "message": "Complete debugger context exceeds64 MiB reply budget."}).encode("utf-8")
+        descriptor = os.open(request["reply_path"], os.O_WRONLY | os.O_CREAT | os.O_EXCL, 0o600)
+        with os.fdopen(descriptor, "wb") as handle:
+            handle.write(encoded)
+    except MemoryError:
+        reserve = None
+        failure_exit(request_path, 75, b"M")
+    except OSError as error:
+        if error.errno == 27:
+            failure_exit(request_path, 76, b"F")
+        if error.errno == 12:
+            reserve = None
+            failure_exit(request_path, 75, b"M")
+        raise
+
+
+main()
@@ -0,0 +1,39 @@
+"""Catch typed resource failures while loading or running the owned debugger launcher.
+
+Only this package's fixed sibling is executed; caller input stays in request.json.
+Interpreter startup failures before this boundary remain unclassified.
+"""
+import os
+import sys
+
+
+def resource_exit(status, marker):
+    try:
+        if len(sys.argv) > 2:
+            descriptor = os.open(sys.argv[1], os.O_WRONLY | os.O_CREAT | os.O_EXCL, 0o600)
+            os.write(descriptor, marker)
+            os.close(descriptor)
+    except (OSError, MemoryError):
+        # Without a complete marker the parent keeps this failure unclassified.
+        pass
+    os._exit(status)
+
+try:
+    implementation = os.path.join(os.path.dirname(__file__), "launch_impl.py")
+    with open(implementation, "rb") as handle:
+        source = handle.read()
+    exec(compile(source, implementation, "exec"), {
+        "__file__": implementation,
+        "__name__": "__main__",
+    })
+except MemoryError:
+    # Reserved status: an observed allocation failure, including imports/compile.
+    resource_exit(75, b"M")
+except OSError as error:
+    # Linux ENOMEM is an observed allocation failure, independent of error text.
+    if error.errno == 12:
+        resource_exit(75, b"M")
+    # Linux EFBIG is observed directly, including a partial limits/reply write.
+    if error.errno == 27:
+        resource_exit(76, b"F")
+    raise
@@ -0,0 +1,34 @@
+"""Lower inherited limits before replacing this owned process with GDB."""
+import json
+import os
+from pathlib import Path
+import sys
+
+runtime_path = Path(__file__).parent.parent / "pwntools" / "decoder_runtime.py"
+runtime = {"__file__": str(runtime_path), "__name__": "rea_decoder_runtime"}
+exec(compile(runtime_path.read_bytes(), str(runtime_path), "exec"), runtime)
+
+
+class LaunchFailure(Exception):
+    def __init__(self, reason, message):
+        super().__init__(message)
+        self.reason = reason
+
+
+def launch(snapshot, cache):
+    request_path = sys.argv[-1]
+    request = json.loads(Path(request_path).read_text(encoding="utf-8"))
+    bridge = str(Path(__file__).with_name("core_context.py"))
+    environment = dict(os.environ, REA_CORE_CONTEXT_REQUEST=request_path)
+    # Only fixed package code appears in the GDB Python command. Selected paths stay JSON data.
+    command = "python exec(compile(open(" + repr(bridge) + ", 'rb').read(), " + repr(bridge) + ", 'exec'), {'__name__':'__main__','__file__':" + repr(bridge) + "})"
+    try:
+        os.execve(request["gdb"], [request["gdb"], "-nx", "-nh", "--batch", "--quiet",
+                                  "-iex", "set auto-load off", "-iex", "set debuginfod enabled off",
+                                  "-iex", "set auto-solib-add off", "-ex", command], environment)
+    except OSError as error:
+        raise LaunchFailure("unavailable", "Selected GDB could not start (" + str(error.errno) + "): " + request["gdb"] + "; " + str(error)) from error
+
+
+if __name__ == "__main__":
+    runtime["main"](sys.argv[-1], launch, LaunchFailure, "pwndbg-core-launcher")
@@ -0,0 +1,59 @@
+"""Shared bounded reply/limit protocol, independent of the supplied artifact format."""
+import json
+import os
+from pathlib import Path
+import resource
+import sys
+
+OUTPUT_BYTES = 64 * 1024 * 1024
+
+def lower_resource_limits():
+    limits = {}
+    for name, kind, maximum in (
+        ("address_space_bytes", resource.RLIMIT_AS, 3 * 1024**3),
+        ("cpu_seconds", resource.RLIMIT_CPU, 30),
+        ("file_size_bytes", resource.RLIMIT_FSIZE, OUTPUT_BYTES),
+    ):
+        soft, hard = resource.getrlimit(kind)
+        finite = [maximum] + [value for value in (soft, hard) if value != resource.RLIM_INFINITY]
+        effective = min(finite)
+        # Preserve the inherited hard boundary and never raise a caller's soft limit.
+        resource.setrlimit(kind, (effective, hard))
+        limits[name] = effective
+    return limits
+
+
+def main(request_path, inspect, failure_type, profile):
+    request = json.loads(Path(request_path).read_text(encoding="utf-8"))
+    os.environ["PWNLIB_NOTERM"] = "1"
+    os.environ["PWNLIB_CACHE_DIR"] = str(Path(request_path).parent / "cache")
+    limits = None
+    # Release bounded emergency headroom before constructing a MemoryError reply.
+    # The outer exit-status contract also covers allocation failure during serialization.
+    memory_reserve = bytearray(1024 * 1024)
+    try:
+        limits = lower_resource_limits()
+        descriptor = os.open(Path(request_path).parent / "limits.json", os.O_WRONLY | os.O_CREAT | os.O_EXCL, 0o600)
+        with os.fdopen(descriptor, "w", encoding="utf-8") as handle:
+            json.dump(limits, handle)
+        value = inspect(Path(request["snapshot_path"]), Path(request_path).parent / "cache")
+        value["limitations"].append("Effective owned Python resource soft limits: " + json.dumps(limits, sort_keys=True) + ". Inherited tighter limits are retained.")
+        reply = {"ok": True, "profile": profile, "value": value}
+    except failure_type as error:
+        reply = {"ok": False, "reason": error.reason, "message": str(error)}
+    except MemoryError:
+        memory_reserve = None
+        reply = {"ok": False, "reason": "resource-limit", "message": "pwntools memory allocation failed under the effective resource limits; the exact allocation cause is unknown.", "reported_limits": limits}
+    except Exception as error:
+        if isinstance(error, OSError) and error.errno == 12:
+            memory_reserve = None
+            reply = {"ok": False, "reason": "resource-limit", "message": "pwntools reported OSError(ENOMEM); the exact allocation cause is unknown.", "reported_limits": limits}
+        else:
+            reply = {"ok": False, "reason": "decoder", "message": type(error).__name__ + ": " + str(error)}
+    encoded = json.dumps(reply, ensure_ascii=True, allow_nan=False).encode("utf-8")
+    if len(encoded) > OUTPUT_BYTES:
+        encoded = json.dumps({"ok": False, "reason": "output-limit", "message": "Complete artifact result exceeds the 64 MiB reply budget."}).encode("utf-8")
+    descriptor = os.open(request["reply_path"], os.O_WRONLY | os.O_CREAT | os.O_EXCL, 0o600)
+    with os.fdopen(descriptor, "wb") as handle:
+        handle.write(encoded)
+
@@ -0,0 +1,39 @@
+"""Catch typed resource failures while loading or running the owned ELF adapter.
+
+Only this package's fixed sibling is executed; caller input stays in request.json.
+Interpreter startup failures before this boundary remain unclassified.
+"""
+import os
+import sys
+
+
+def resource_exit(status, marker):
+    try:
+        if len(sys.argv) > 2:
+            descriptor = os.open(sys.argv[1], os.O_WRONLY | os.O_CREAT | os.O_EXCL, 0o600)
+            os.write(descriptor, marker)
+            os.close(descriptor)
+    except (OSError, MemoryError):
+        # Without a complete marker the parent keeps this failure unclassified.
+        pass
+    os._exit(status)
+
+try:
+    implementation = os.path.join(os.path.dirname(__file__), "layout_impl.py")
+    with open(implementation, "rb") as handle:
+        source = handle.read()
+    exec(compile(source, implementation, "exec"), {
+        "__file__": implementation,
+        "__name__": "__main__",
+    })
+except MemoryError:
+    # Reserved status: an observed allocation failure, including imports/compile.
+    resource_exit(75, b"M")
+except OSError as error:
+    # Linux ENOMEM is an observed allocation failure, independent of error text.
+    if error.errno == 12:
+        resource_exit(75, b"M")
+    # Linux EFBIG is observed directly, including a partial limits/reply write.
+    if error.errno == 27:
+        resource_exit(76, b"F")
+    raise
@@ -0,0 +1,309 @@
+"""Offline adapter to unchanged pwntools 4.15.0; never use libs/maps/libc.
+
+Owned request/snapshot/reply paths are supplied by REA. No host target-process launch,
+user configuration initialization, debugger startup, or dependency installation.
+"""
+import base64
+import importlib.metadata
+import io
+import json
+import os
+from pathlib import Path
+import resource
+import sys
+
+PROFILE = "pwntools@4.15.0;pyelftools@0.33;unicorn@2.1.2"
+PACKAGES = {"pwntools": "4.15.0", "pyelftools": "0.33", "unicorn": "2.1.2"}
+OUTPUT_BYTES = 64 * 1024 * 1024
+
+
+class LayoutFailure(Exception):
+    def __init__(self, reason, message):
+        super().__init__(message)
+        self.reason = reason
+
+
+def address(value):
+    return hex(int(value))
+
+
+def file_range(offset, size, length):
+    return 0 <= offset <= length and 0 <= size <= length - offset
+
+
+def location(offset, size, length):
+    if not file_range(offset, size, length):
+        raise LayoutFailure("format", "ELF contains a file-backed range outside the selected snapshot.")
+    return {"offset": address(offset), "bytes": address(size)}
+
+
+def name_reference(display, section, offset, content):
+    header = getattr(section, "header", None)
+    if header is None or header.sh_type != "SHT_STRTAB":
+        return {"display": display, "bytes_base64": None, "location": None,
+                "unknown_reason": "Referenced string table could not be resolved."}
+    return name_in_table(display, header.sh_offset, header.sh_size, offset, content)
+
+
+def name_in_table(display, table_start, table_size, offset, content):
+    location(table_start, table_size, len(content))
+    if not 0 <= offset < table_size:
+        raise LayoutFailure("format", f"ELF name offset {offset} lies outside its declared string table of {table_size} bytes at file offset {table_start}.")
+    start = table_start + offset
+    limit = table_start + table_size
+    end = content.find(b"\0", start, limit)
+    if end < 0:
+        raise LayoutFailure("format", "ELF name lacks a terminator within its reported string table.")
+    raw = content[start:end]
+    return {"display": raw.decode("utf-8", "replace") if display is None else display, "bytes_base64": base64.b64encode(raw).decode("ascii"),
+            "location": location(start, len(raw) + 1, len(content)), "unknown_reason": None}
+
+
+def dynamic_name_reference(tags, offset, image, content):
+    starts = [tag.d_val for tag in tags if tag.d_tag == "DT_STRTAB"]
+    sizes = [tag.d_val for tag in tags if tag.d_tag == "DT_STRSZ"]
+    if not starts or not sizes:
+        raise LayoutFailure("format", "ELF dependency requires DT_STRTAB and DT_STRSZ.")
+    if len(starts) != 1 or len(sizes) != 1:
+        raise LayoutFailure("unsupported-target", "ELF dependency string-table tags are ambiguous: " + repr({"DT_STRTAB": starts, "DT_STRSZ": sizes}))
+    if not 0 <= offset < sizes[0]:
+        raise LayoutFailure("format", f"ELF dependency name offset {offset} lies outside declared DT_STRSZ {sizes[0]}.")
+    offsets = set()
+    if len(starts) == 1 and len(sizes) == 1:
+        for segment in image.iter_segments_by_type("PT_LOAD"):
+            h = segment.header
+            if starts[0] >= h.p_vaddr and starts[0] + sizes[0] <= h.p_vaddr + h.p_filesz:
+                offsets.add(h.p_offset + starts[0] - h.p_vaddr)
+    if len(offsets) != 1:
+        raise LayoutFailure("unsupported-target", "Dynamic string table lacks a unique file-backed mapping: " + repr({"DT_STRTAB": starts, "DT_STRSZ": sizes, "candidate_file_offsets": sorted(offsets)}))
+    return name_in_table(None, offsets.pop(), sizes[0], offset, content)
+
+
+def symbol_value_meaning(raw, image_type, sections):
+    index = raw.st_shndx
+    if raw.st_info.type == "STT_FILE": return "no-address"
+    if index == "SHN_UNDEF": return "undefined"
+    if index == "SHN_COMMON": return "alignment"
+    if index == "SHN_ABS": return "absolute-value"
+    if not isinstance(index, int) or not 0 < index < len(sections) or index >= 0xff00:
+        return "unknown-section-index"
+    if sections[index].header.sh_type == "SHT_NULL":
+        return "unknown-section-index"
+    if image_type == "ET_REL": return "section-offset"
+    if raw.st_info.type == "STT_TLS": return "tls-offset"
+    return "linked-virtual-address"
+
+
+def relocation_target(image_type, section_index, offset, sections):
+    if image_type != "ET_REL":
+        return {"kind": "linked-virtual-address", "address": address(offset)}
+    if section_index == 0 or sections[section_index].header.sh_type == "SHT_NULL":
+        return {"kind": "unknown-section", "reported_section_index": section_index,
+                "offset": address(offset), "unknown_reason": "undefined-section-reference" if section_index == 0 else "inactive-section-header"}
+    return {"kind": "section-offset", "section_index": section_index, "offset": address(offset)}
+
+
+def inspect_elf(path, cache):
+    for package, expected in PACKAGES.items():
+        try:
+            version = importlib.metadata.version(package)
+        except importlib.metadata.PackageNotFoundError as error:
+            raise LayoutFailure("unavailable", "Selected Python lacks " + package + " " + expected + ".") from error
+        if version != expected:
+            raise LayoutFailure("unsupported", "Expected " + package + " " + expected + "; selected Python reports " + version + ".")
+    content = path.read_bytes()
+    if len(content) < 4 or content[:4] != b"\x7fELF":
+        raise LayoutFailure("format", "Selected object does not contain an ELF header.")
+    if len(content) < 16:
+        raise LayoutFailure("format", "Selected ELF identification is truncated.")
+    if content[4] != 2 or content[5] != 1:
+        raise LayoutFailure("unsupported-target", "Initial layout profile requires ELF64 little-endian objects.")
+    if len(content) < 64:
+        raise LayoutFailure("format", "Selected ELF64 header is truncated.")
+    if int.from_bytes(content[18:20], "little") != 62:
+        raise LayoutFailure("unsupported-target", "Initial layout profile requires x86-64 ELF objects.")
+    if int.from_bytes(content[16:18], "little") not in (1, 2, 3):
+        raise LayoutFailure("unsupported-target", "Selected ELF type is outside the EXEC/DYN/REL layout profile; recorded core analysis is separate.")
+    from pwnlib.context import context
+    with context.local(cache_dir=str(cache), log_level="warning"):
+        from elftools.common.exceptions import ELFError
+        from elftools.elf.elffile import ELFFile
+        from pwnlib.elf import ELF
+        try:
+            headers = ELFFile(io.BytesIO(content))
+            section_count = headers.num_sections()
+            if headers.header.e_shstrndx == 0xffff and section_count == 0:
+                raise LayoutFailure("format", "ELF extended section-name index requires a declared section-zero header.")
+            raw_name_index = headers.header.e_shstrndx
+            if 0xff00 <= raw_name_index < 0xffff:
+                raise LayoutFailure("format", f"ELF section-name index {raw_name_index} is reserved and cannot directly reference a section.")
+            section_name_index = headers.get_shstrndx()
+            if raw_name_index == 0xffff and section_name_index < 0xff00:
+                raise LayoutFailure("format", f"ELF SHN_XINDEX resolves to ordinary index {section_name_index}; the escape requires an index at least SHN_LORESERVE (0xff00).")
+            if section_name_index != 0:
+                if section_name_index >= section_count:
+                    raise LayoutFailure("format", f"ELF section-name table index {section_name_index} lies outside the declared section count {section_count}.")
+                names_header = headers._get_section_header(section_name_index)
+                if names_header.sh_type != "SHT_STRTAB":
+                    raise LayoutFailure("format", f"ELF section-name table {section_name_index} is not SHT_STRTAB.")
+                location(names_header.sh_offset, names_header.sh_size, len(content))
+        except ELFError as error:
+            raise LayoutFailure("format", str(error)) from error
+        class LayoutELF(ELF):
+            def _get_section_name(self, header):
+                # SHN_UNDEF declares no names; upstream would otherwise read
+                # strings at the inactive section-zero offset.
+                return "" if section_name_index == 0 else super()._get_section_name(header)
+
+            # pyelftools 0.33 calls these documented filters internally;
+            # pwntools 4.15.0's cached overrides do not accept the argument.
+            # Forward the filter on this adapter instance, without modifying
+            # either upstream package or process-global methods.
+            def iter_segments(self, type=None):
+                return (segment for segment in super().iter_segments()
+                        if type is None or segment.header.p_type == type)
+
+            def iter_sections(self, type=None):
+                return (section for section in super().iter_sections()
+                        if type is None or section.header.sh_type == type)
+        try:
+            image = LayoutELF(str(path), checksec=False)
+            if image.arch != "amd64" or image.bits != 64 or image.endian != "little":
+                raise LayoutFailure("unsupported-target", "Initial layout profile requires x86-64 ELF64 little-endian objects.")
+            if image.header.e_type not in ("ET_EXEC", "ET_DYN", "ET_REL"):
+                raise LayoutFailure("unsupported-target", "Selected ELF type is outside the EXEC/DYN/REL layout profile; recorded core analysis is separate.")
+            length = len(content)
+            all_sections = list(image.iter_sections())
+            shstrings = image.get_section(section_name_index) if all_sections and section_name_index != 0 else None
+            sections, segments, symbols, relocations, packed_relatives = [], [], [], [], []
+            needed, interpreters = [], []
+            for index, section in enumerate(all_sections):
+                h = section.header
+                backing = h.sh_type not in ("SHT_NOBITS", "SHT_NULL")
+                if backing: location(h.sh_offset, h.sh_size, length)
+                sections.append({
+                    "index": index, "name": name_reference(section.name, shstrings, h.sh_name, content) if shstrings is not None else {"display": "", "bytes_base64": None, "location": None, "unknown_reason": "ELF declares no section-name table (SHN_UNDEF index 0)."}, "name_offset": address(h.sh_name), "type": h.sh_type,
+                    "header_location": location(image.header.e_shoff + index * image.header.e_shentsize, image.header.e_shentsize, length),
+                    "address": address(h.sh_addr), "offset": address(h.sh_offset),
+                    "size": address(h.sh_size), "alignment": address(h.sh_addralign),
+                    "flags": address(h.sh_flags), "link": h.sh_link, "info": h.sh_info,
+                    "entry_size": address(h.sh_entsize), "file_backing": "file" if backing else "none",
+                })
+                if h.sh_type in ("SHT_SYMTAB", "SHT_DYNSYM"):
+                    if h.sh_entsize < image.structs.Elf_Sym.sizeof():
+                        raise LayoutFailure("format", "ELF symbol entry is smaller than the decoded Elf64_Sym structure.")
+                    if h.sh_link >= len(all_sections) or all_sections[h.sh_link].header.sh_type != "SHT_STRTAB":
+                        raise LayoutFailure("format", f"ELF symbol table {index} links to invalid string table {h.sh_link}.")
+                    strings = all_sections[h.sh_link]
+                    for entry, symbol in enumerate(section.iter_symbols()):
+                        raw = symbol.entry
+                        symbols.append({
+                            "table_index": index, "entry_index": entry,
+                            "name": name_reference(symbol.name, strings, raw.st_name, content), "name_offset": address(raw.st_name),
+                            "location": location(h.sh_offset + entry * h.sh_entsize, h.sh_entsize, length),
+                            "value": address(raw.st_value), "value_meaning": symbol_value_meaning(raw, image.header.e_type, all_sections),
+                            "size": address(raw.st_size), "binding": raw.st_info.bind, "type": raw.st_info.type,
+                            "visibility": raw.st_other.visibility, "section_index": raw.st_shndx,
+                        })
+                if h.sh_type in ("SHT_REL", "SHT_RELA"):
+                    if image.header.e_type == "ET_REL" and h.sh_info >= len(all_sections):
+                        raise LayoutFailure("format", f"ELF relocation section {index} references missing target section {h.sh_info}.")
+                    symbol_table = None
+                    if h.sh_link != 0:
+                        if h.sh_link >= len(all_sections) or all_sections[h.sh_link].header.sh_type not in ("SHT_SYMTAB", "SHT_DYNSYM"):
+                            raise LayoutFailure("format", f"ELF relocation section {index} links to invalid symbol table {h.sh_link}.")
+                        symbol_table = all_sections[h.sh_link]
+                    for entry, relocation in enumerate(section.iter_relocations()):
+                        raw = relocation.entry
+                        if raw.r_info_sym != 0 and (symbol_table is None or raw.r_info_sym >= symbol_table.num_symbols()):
+                            raise LayoutFailure("format", f"ELF relocation section {index} entry {entry} references missing symbol {raw.r_info_sym} in table {h.sh_link}.")
+                        relocations.append({
+                            "section_index": index, "entry_index": entry, "reported_offset": address(raw.r_offset),
+                            "target": relocation_target(image.header.e_type, h.sh_info, raw.r_offset, all_sections),
+                            "location": location(h.sh_offset + entry * h.sh_entsize, h.sh_entsize, length),
+                            "type": raw.r_info_type, "symbol_table_index": h.sh_link, "symbol_index": raw.r_info_sym,
+                            "symbol_reference_meaning": "zero-symbol-value" if raw.r_info_sym == 0 else "symbol-table-entry",
+                            "addend": None if "r_addend" not in raw else str(raw.r_addend),
+                        })
+                if h.sh_type == "SHT_RELR":
+                    packed_relatives.append({
+                        "section_index": index,
+                        "location": location(h.sh_offset, h.sh_size, length),
+                        "encoded_bytes_base64": base64.b64encode(content[h.sh_offset:h.sh_offset + h.sh_size]).decode("ascii"),
+                        "entries": [{"decoded_index": decoded, "reported_offset": address(relocation.entry.r_offset)} for decoded, relocation in enumerate(section.iter_relocations())],
+                        "offset_meaning": "unknown" if image.header.e_type == "ET_REL" else "linked-virtual-address",
+                        "evidence_kind": "derived", "entry_source_locations": None, "addends": None,
+                    })
+            for index, segment in enumerate(image.iter_segments()):
+                h = segment.header
+                backing = h.p_type != "PT_NULL" and h.p_filesz != 0
+                if backing: location(h.p_offset, h.p_filesz, length)
+                if h.p_type == "PT_LOAD" and h.p_memsz < h.p_filesz:
+                    raise LayoutFailure("format", "ELF load segment memory size is smaller than its file size.")
+                segments.append({
+                    "index": index, "type": h.p_type, "offset": address(h.p_offset),
+                    "header_location": location(image.header.e_phoff + index * image.header.e_phentsize, image.header.e_phentsize, length),
+                    "file_size": address(h.p_filesz), "memory_size": address(h.p_memsz),
+                    "virtual_address": address(h.p_vaddr), "physical_address": address(h.p_paddr),
+                    "alignment": address(h.p_align), "flags": address(h.p_flags),
+                    "file_backing": "file" if backing else "none",
+                    "permissions": None if h.p_type == "PT_NULL" else {"read": bool(h.p_flags & 4), "write": bool(h.p_flags & 2), "execute": bool(h.p_flags & 1)},
+                })
+                if h.p_type == "PT_DYNAMIC":
+                    tag_size = image.structs.Elf_Dyn.sizeof()
+                    tags = []
+                    for tag_index in range(h.p_filesz // tag_size):
+                        tag = segment._get_tag(tag_index)
+                        tags.append(tag)
+                        if tag.d_tag == "DT_NULL":
+                            break
+                    else:
+                        raise LayoutFailure("format", f"ELF dynamic segment {index} has no complete DT_NULL terminator within its reported file range.")
+                    for tag in tags:
+                        if tag.d_tag == "DT_NEEDED":
+                            needed.append(dynamic_name_reference(tags, tag.d_val, image, content))
+                if h.p_type == "PT_INTERP":
+                    raw = content[h.p_offset:h.p_offset + h.p_filesz]
+                    end = raw.find(b"\0")
+                    if end < 0:
+                        raise LayoutFailure("format", "ELF interpreter lacks a reported terminator.")
+                    interpreters.append({"display": raw[:end].decode("utf-8", "replace"), "bytes_base64": base64.b64encode(raw[:end]).decode("ascii"), "location": location(h.p_offset, end + 1, length), "unknown_reason": None})
+            return {
+                "format": "elf", "architecture": {"machine": image.header.e_machine, "bits": image.bits, "byte_order": image.endian},
+                "image_type": image.header.e_type,
+                "entry_point": {"reported_value": address(image.header.e_entry), "meaning": "not-applicable" if image.header.e_type == "ET_REL" else "absent" if image.header.e_entry == 0 else "linked-virtual-address", "execution_status": "unknown"},
+                "runtime_load_base": None, "sections": sections, "segments": segments, "symbols": symbols, "relocations": relocations,
+                "packed_relative_relocations": packed_relatives, "relocation_inventory_completeness": "unknown",
+                "linkage": {"needed_libraries": needed, "interpreters": interpreters,
+                    "got": [{"display_name": name, "address": address(value)} for name, value in image.got.items()],
+                    "plt": [{"display_name": name, "address": address(value)} for name, value in image.plt.items()],
+                    "convenience_maps_completeness": "unknown", "runtime_library_paths": None},
+                "mitigations": {"evidence_kind": "inferred", "position_independent": image.pie, "nx_indicator": image.nx, "executable_stack_indicator": image.execstack, "stack_canary_indicator": image.canary, "relro": image.relro},
+                "limitations": [
+                    "PT_NULL payload fields are unused and retain their reported numbers without file-byte or permission claims. Zero-file-size segments provide no file bytes.",
+                    "SHN_XINDEX symbol values remain unresolved in this upstream representation; an external index table does not establish a resolved index in this report.",
+                    "Reported values preserve linked addresses, section offsets, TLS offsets, alignment and absolute values separately. Runtime load base and library paths are unknown.",
+                    "Names are display strings plus raw bytes and file ranges where resolvable; section/table/entry indices preserve identity and duplicates. Name ranges include their terminating NUL; raw name bytes exclude it.",
+                    "Ordinary relocation rows cover REL/RELA. RELR tables retain complete encoded bytes and upstream-decoded offsets as derived evidence; per-offset packed-word locations and implicit addends remain unknown. Relocation inventory completeness is unknown, including other encodings and missing section tables.",
+                    "Relocation symbol index zero uses a zero symbol value without a table lookup. Positive indices reference validated original symbol-table entries; raw table and symbol indices remain reported.",
+                    "Relocatable relocation targets with SHN_UNDEF or inactive SHT_NULL headers retain their reported section index/offset as unknown; they do not establish an associated target section.",
+                    "GOT/PLT are derived upstream convenience maps; PLT inference can emulate selected instructions in Unicorn. They do not establish target runtime behavior; aliases may collapse and warnings may indicate incomplete coverage. Their completeness is unknown.",
+                    "Mitigations are upstream static heuristics, not runtime protection. ET_DYN does not prove an executable; absent canary symbols do not prove every function unprotected.",
+                    "This profile inspects ELF EXEC/DYN/REL layout only. It does not analyze recorded cores, resolve loaded libraries, launch the target as a host process or start a debugger.",
+                    "Symbol/relocation inventories reflect original section tables. A sectionless image can still report dynamic dependency names; missing tables do not prove absence of dynamic symbols or relocations.",
+                    *(["Absent section-name table: section-dependent RELRO/canary heuristics may be incomplete; protection coverage is unknown."] if all_sections and section_name_index == 0 else []),
+                    *(["Sectionless images lack the .dynamic section and symbol tables used by upstream heuristics. RELRO/canary indicators may be incomplete; their values remain reported static candidates, with protection coverage unknown."] if not all_sections else []),
+                ],
+            }
+        except LayoutFailure:
+            raise
+        except (ELFError, ValueError, AssertionError, IndexError) as error:
+            raise LayoutFailure("format", "Selected ELF failed unchanged upstream structural parsing: " + str(error)) from error
+
+
+
+if __name__ == "__main__":
+    runtime_path = Path(__file__).with_name("decoder_runtime.py")
+    runtime = {"__file__": str(runtime_path), "__name__": "rea_decoder_runtime"}
+    exec(compile(runtime_path.read_bytes(), str(runtime_path), "exec"), runtime)
+    runtime["main"](sys.argv[-1], inspect_elf, LayoutFailure, PROFILE)
@@ -0,0 +1,39 @@
+"""Catch typed resource failures while loading or running the owned recorded-core adapter.
+
+Only this package's fixed sibling is executed; caller input stays in request.json.
+Interpreter startup failures before this boundary remain unclassified.
+"""
+import os
+import sys
+
+
+def resource_exit(status, marker):
+    try:
+        if len(sys.argv) > 2:
+            descriptor = os.open(sys.argv[1], os.O_WRONLY | os.O_CREAT | os.O_EXCL, 0o600)
+            os.write(descriptor, marker)
+            os.close(descriptor)
+    except (OSError, MemoryError):
+        # Without a complete marker the parent keeps this failure unclassified.
+        pass
+    os._exit(status)
+
+try:
+    implementation = os.path.join(os.path.dirname(__file__), "recorded_crash_impl.py")
+    with open(implementation, "rb") as handle:
+        source = handle.read()
+    exec(compile(source, implementation, "exec"), {
+        "__file__": implementation,
+        "__name__": "__main__",
+    })
+except MemoryError:
+    # Reserved status: an observed allocation failure, including imports/compile.
+    resource_exit(75, b"M")
+except OSError as error:
+    # Linux ENOMEM is an observed allocation failure, independent of error text.
+    if error.errno == 12:
+        resource_exit(75, b"M")
+    # Linux EFBIG is observed directly, including a partial limits/reply write.
+    if error.errno == 27:
+        resource_exit(76, b"F")
+    raise
@@ -0,0 +1,143 @@
+"""Bounded Linux core evidence via unchanged ELFFile/structs and pwntools ctypes.
+
+No Corefile-selected thread, executable guessing, process lookup or target launch.
+"""
+import base64
+import ctypes
+import importlib.metadata
+import io
+from pathlib import Path
+import sys
+
+PROFILE = "pwntools@4.15.0;pyelftools@0.33;unicorn@2.1.2"
+
+
+class CoreFailure(Exception):
+    def __init__(self, reason, message):
+        super().__init__(message)
+        self.reason = reason
+
+
+def encoded(value):
+    return base64.b64encode(value).decode("ascii")
+
+
+def location(offset, size, limit):
+    if not 0 <= offset <= limit or not 0 <= size <= limit - offset:
+        raise CoreFailure("format", "Recorded source range exceeds its declared container.")
+    return {"offset": hex(offset), "bytes": hex(size)}
+
+
+def inspect_core(path, cache):
+    for package, required in {"pwntools": "4.15.0", "pyelftools": "0.33", "unicorn": "2.1.2"}.items():
+        try:
+            actual = importlib.metadata.version(package)
+        except importlib.metadata.PackageNotFoundError as error:
+            raise CoreFailure("unavailable", "Selected Python lacks " + package + " " + required + ".") from error
+        if actual != required:
+            raise CoreFailure("unsupported", "Expected " + package + " " + required + "; selected Python reports " + actual + ".")
+    content = path.read_bytes()
+    if len(content) < 16 or content[:4] != b"\x7fELF":
+        raise CoreFailure("format", "Selected recording lacks a complete ELF identification.")
+    if content[4:6] != b"\x02\x01":
+        raise CoreFailure("unsupported-target", "Initial recorded-core profile requires ELF64 little-endian.")
+    if len(content) < 64:
+        raise CoreFailure("format", "Selected ELF64 core header is truncated.")
+    # Linux commonly emits ELFOSABI_NONE (0), also accepted as GNU/Linux (3).
+    # Other declared OSABIs must never select Linux note ctypes.
+    if content[7] not in (0, 3) or content[8] != 0:
+        raise CoreFailure("unsupported-target", "Initial recorded-core profile requires System V or GNU/Linux OSABI with ABI version zero; selected OSABI=" + str(content[7]) + ", ABI version=" + str(content[8]) + ".")
+    if int.from_bytes(content[16:18], "little") != 4 or int.from_bytes(content[18:20], "little") != 62:
+        raise CoreFailure("unsupported-target", "Initial recorded-core profile requires x86-64 ET_CORE.")
+    from elftools.common.exceptions import ELFError
+    from elftools.common.utils import struct_parse
+    from elftools.elf.elffile import ELFFile
+    from pwnlib.elf.datatypes import elf_prstatus_amd64, elf_siginfo_64, user_regs_struct_amd64
+    try:
+        image = ELFFile(io.BytesIO(content))
+        header = image.header
+        count = image.num_segments()
+        if count and header.e_phentsize < image.structs.Elf_Phdr.sizeof():
+            raise CoreFailure("format", "Program-header entry is shorter than the required ELF64 structure.")
+        location(header.e_phoff, count * header.e_phentsize, len(content))
+        segments, notes, padding, threads, signals = [], [], [], [], []
+        for segment_index, segment in enumerate(image.iter_segments()):
+            h = segment.header
+            backing = h.p_type != "PT_NULL" and h.p_filesz > 0
+            if backing:
+                location(h.p_offset, h.p_filesz, len(content))
+            if h.p_type == "PT_LOAD" and h.p_filesz > h.p_memsz:
+                raise CoreFailure("format", "Recorded PT_LOAD file bytes exceed memory size.")
+            segments.append({"index": segment_index, "type": h.p_type,
+                             "header_location": location(header.e_phoff + segment_index * header.e_phentsize, header.e_phentsize, len(content)),
+                             "offset": hex(h.p_offset), "file_size": hex(h.p_filesz), "memory_size": hex(h.p_memsz),
+                             "virtual_address": hex(h.p_vaddr), "physical_address": hex(h.p_paddr), "alignment": hex(h.p_align), "flags": hex(h.p_flags), "file_backing": "file" if backing else "none"})
+            if h.p_type != "PT_NOTE" or h.p_filesz == 0:
+                continue
+            position, end = h.p_offset, h.p_offset + h.p_filesz
+            header_size = image.structs.Elf_Nhdr.sizeof()
+            while position < end:
+                if end - position < header_size:
+                    raw = content[position:end]
+                    if any(raw):
+                        raise CoreFailure("format", "Nonzero trailing note bytes lack a complete note header.")
+                    padding.append({"segment_index": segment_index, "location": location(position, len(raw), end), "bytes_base64": encoded(raw)})
+                    break
+                note = struct_parse(image.structs.Elf_Nhdr, image.stream, stream_pos=position)
+                owner_start = position + header_size
+                descriptor_start = owner_start + ((note.n_namesz + 3) // 4) * 4
+                note_end = descriptor_start + ((note.n_descsz + 3) // 4) * 4
+                location(position, note_end - position, end)
+                owner = content[owner_start:owner_start + note.n_namesz]
+                if owner and b"\0" not in owner:
+                    raise CoreFailure("format", "Declared note owner has no NUL terminator.")
+                display = owner.split(b"\0", 1)[0].decode("utf-8", "replace") if owner else None
+                descriptor = content[descriptor_start:descriptor_start + note.n_descsz]
+                note_index = len(notes)
+                notes.append({"index": note_index, "segment_index": segment_index, "type": note.n_type,
+                              "location": location(position, note_end - position, end),
+                              "owner_location": location(owner_start, len(owner), end), "owner_bytes_base64": encoded(owner), "owner_display": display,
+                              "descriptor_location": location(descriptor_start, len(descriptor), end), "descriptor_bytes_base64": encoded(descriptor)})
+                position = note_end
+                # Only the initial Linux CORE ABI is interpreted. Other owners retain exact bytes.
+                if owner != b"CORE\0":
+                    continue
+                if note.n_type == "NT_PRSTATUS":
+                    if len(descriptor) < ctypes.sizeof(elf_prstatus_amd64):
+                        raise CoreFailure("format", "Linux amd64 NT_PRSTATUS descriptor is truncated.")
+                    status = elf_prstatus_amd64.from_buffer_copy(descriptor)
+                    registers = []
+                    for name, kind in user_regs_struct_amd64._fields_:
+                        relative = elf_prstatus_amd64.pr_reg.offset + getattr(user_regs_struct_amd64, name).offset
+                        registers.append({"name": name, "value": hex(getattr(status.pr_reg, name)), "location": location(descriptor_start + relative, ctypes.sizeof(kind), end)})
+                    threads.append({"note_index": note_index, "historical_pid": ctypes.c_int32(status.pr_pid).value, "recorded_current_signal": status.pr_cursig, "registers": registers})
+                elif note.n_type == "NT_SIGINFO":
+                    if len(descriptor) < ctypes.sizeof(elf_siginfo_64):
+                        raise CoreFailure("format", "Linux amd64 NT_SIGINFO descriptor is truncated.")
+                    signal = elf_siginfo_64.from_buffer_copy(descriptor)
+                    number = ctypes.c_int32(signal.si_signo).value
+                    code = ctypes.c_int32(signal.si_code).value
+                    known = number == 11 and code in (1, 2)
+                    signals.append({"note_index": note_index, "number": number, "code": code, "errno": ctypes.c_int32(signal.si_errno).value,
+                                    "fault_address": hex(signal.sigfault_addr) if known else None,
+                                    "fault_address_meaning": "recorded-sigsegv-address" if known else "unknown", "thread_association": "unknown"})
+        return {"format": "elf-core", "architecture": "x86_64-little-endian", "target_execution": "not-performed", "live_process_identity": "unknown",
+                "segments": segments, "notes": notes, "note_padding": padding, "threads": threads, "signals": signals,
+                "note_interpretation_completeness": "unknown",
+                "limitations": ["The initial Linux note profile accepts System V/unspecified or GNU/Linux OSABI with ABI version zero; an unspecified OSABI alone does not prove operating-system origin.",
+                                "Historical PID and signal values are recorded metadata, not current process identity or attach authority.",
+                                "Only exact Linux CORE NT_PRSTATUS/NT_SIGINFO owners are interpreted; every descriptor and owner retains original bytes. Other note semantics remain unknown.",
+                                "NT_SIGINFO thread association is unknown. Only SIGSEGV SEGV_MAPERR/SEGV_ACCERR initially establish a fault-address union meaning.",
+                                "PT_LOAD file bytes are recorded bytes. Undumped memory and current executable/library identity remain unknown; no current host file is resolved from a recorded pathname.",
+                                "Missing notes/registers/signals do not establish their absence at the original crash. Full unwinding, executable pairing and live control are not provided."]}
+    except CoreFailure:
+        raise
+    except (ELFError, ValueError, AssertionError, IndexError) as error:
+        raise CoreFailure("format", "Recorded core failed unchanged upstream structural parsing: " + str(error)) from error
+
+
+if __name__ == "__main__":
+    runtime_path = Path(__file__).with_name("decoder_runtime.py")
+    runtime = {"__file__": str(runtime_path), "__name__": "rea_decoder_runtime"}
+    exec(compile(runtime_path.read_bytes(), str(runtime_path), "exec"), runtime)
+    runtime["main"](sys.argv[-1], inspect_core, CoreFailure, PROFILE)
@@ -17,6 +17,7 @@ export default defineConfig({
        text: "Getting started",
        items: [
          { text: "Installation and setup", link: "/installation" },
+          { text: "CLI and Evidence", link: "/cli" },
          { text: "Agent prompts", link: "/mcp-prompts" },
          { text: "Roadmap", link: "/roadmap" },
        ],
@@ -110,3 +110,138 @@ The projection does not read plists. Use `inspect_plist` on a bundle's
 `info_plist_path` or a launchd plist to read `CFBundleExecutable`, identifiers,
 `SMPrivilegedExecutables`, `BundleProgram`, URL schemes, and usage descriptions.
 Use `inspect_signature` on an executable candidate for code-signing claims.
+
+## Dylib load resolution
+
+`trace_dylib_resolution` answers which file each Mach-O dylib load reaches. It
+runs on the active Mach-O, or on every executable in the active `.app`. Each
+executable in a bundle (the main app, XPC services, app extensions, login items,
+privileged helpers, and helper tools) is a separate process root with its own
+`@executable_path`.
+
+```sh
+rea trace-dylib-resolution MyApp.app --json
+rea trace-dylib-resolution MyApp.app --root Contents/MacOS/MyApp --architecture arm64 --json
+```
+
+```json
+{
+  "name": "trace_dylib_resolution",
+  "arguments": { "roots": ["Contents/MacOS/MyApp"], "architecture": "arm64" }
+}
+```
+
+Load commands are parsed in TypeScript from Mach-O and FAT headers, including
+the `dylib_use_command` encoding newer linkers emit for flags such as delayed
+initialization. Nothing is executed and no Apple tool is required, so the tool
+also works off macOS.
+
+Resolution follows dyld:
+
+- `@executable_path` is the directory of the process root's executable. It is
+  undetermined when the root is a library.
+- `@loader_path` is the directory of the image that holds the load command, or
+  of the image that owns the `LC_RPATH` entry being expanded.
+- `@rpath` tries each `LC_RPATH` of the loading image first, then those of the
+  image that loaded it, up to the process root.
+- Dependencies load dependents-first in load-command order, and each image
+  loads once per process. A later request whose install name matches an
+  already loaded image reuses it.
+- Symlinks such as `Versions/Current` are followed inside the analyzed root.
+  An escape through `..` or an absolute link is `escapes-target`.
+
+Each edge lists every candidate path tried, with its outcome: `resolved`,
+`absent`, `not-mach-o`, `malformed`, `unsupported` (recognized Mach-O outside
+parser coverage, such as big-endian images), `architecture-missing`,
+`outside-target`, `shared-cache`, `escapes-target`, or `undetermined`. Slices follow dyld's
+graded architectures, so an `x86_64h` process also loads `x86_64`. The edge's `resolution` is one of:
+
+| Status         | Meaning                                                                                                                                                                                                                                |
+| -------------- | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
+| `resolved`     | An image inside the analyzed root loads, and no earlier candidate was undeterminable.                                                                                                                                                  |
+| `conditional`  | An image inside the root, or in the supplied shared cache, resolves, but an earlier candidate that REA cannot decide (for example `/opt/vendor/lib` or `/usr/lib/swift` without a cache) would win if it exists on the running system. |
+| `unresolved`   | Every candidate is definitively absent or unusable inside the root.                                                                                                                                                                    |
+| `undetermined` | No candidate resolves inside the root, and some candidate lies outside it or depends on the environment.                                                                                                                               |
+| `shared-cache` | An absolute install path, or an `@rpath` candidate outside the root, was found in the dyld shared cache passed as `shared_cache` (CLI `--shared-cache`). dyld loads the cached image, so later in-root candidates are unused.          |
+
+A `conditional` image is still traced, because it is the image the analyzed
+root supplies. Every edge below it has `loader_conditional: true`, and a
+request that reuses it by install name is `conditional` too. Findings on those
+edges say that they apply only if the conditional image loads.
+
+Absolute install names such as `/usr/lib/libSystem.B.dylib` are
+`outside-target`. On macOS 11 and later most of them live in the dyld shared
+cache rather than on disk, so REA does not check them against the host.
+
+`findings` are derived, not observed:
+
+- `required-load-unresolved`, `weak-load-unresolved`, and `lazy-load-unresolved`.
+  `LC_LAZY_LOAD_DYLIB` dependencies are resolved but not traversed, because dyld
+  loads them on first use; an unresolved one is not a launch failure.
+- `earlier-rpath-candidate-absent`: a Mach-O placed at an earlier search path
+  would load first. Whether code-signing library validation would reject it is
+  not evaluated; use `inspect_signature`.
+- `dyld-environment-present`: `LC_DYLD_ENVIRONMENT` search paths are not modeled.
+
+`verify:macos-bundle` checks the parser against `otool -l` for every traced
+image. It also compares the predicted load order of two process roots with the
+images dyld actually loads (`DYLD_PRINT_LIBRARIES`).
+
+With `shared_cache`, absolute candidates are looked up in that cache's image
+list. A process uses the cache only when both of these hold:
+
+- the cache serves its CPU family (an arm64e cache serves arm64 and arm64e);
+- one of its `LC_BUILD_VERSION` or `LC_VERSION_MIN_*` platforms (reported per
+  slice as `platforms`) matches the cache's platform or alternate platform.
+
+An iOS cache extracted from an IPSW is therefore not used for a macOS
+executable. A limitation names each process root the cache was not used for,
+and why. The result's `shared_cache` names the cache path, UUID, architecture
+and OS version. Cached images are not traversed.
+
+An image listed in the cache but mapped in a missing or UUID-mismatched
+subcache is `undetermined`. It is listed in
+`coverage.unverified_shared_cache_images` and makes coverage partial. Without a
+cache, system paths stay `undetermined`.
+
+## dyld shared cache
+
+`inspect_dyld_shared_cache` reads a dyld shared cache file set selected by path.
+On current macOS this is
+`/System/Volumes/Preboot/Cryptexes/OS/System/Library/dyld/dyld_shared_cache_arm64e`;
+a cache extracted from an IPSW also works. It runs without an open target.
+
+```sh
+rea inspect-dyld-shared-cache /System/Volumes/Preboot/Cryptexes/OS/System/Library/dyld/dyld_shared_cache_arm64e --image /usr/lib/libSystem.B.dylib --json
+```
+
+```json
+{
+  "name": "inspect_dyld_shared_cache",
+  "arguments": {
+    "cache_path": "/System/Volumes/Preboot/Cryptexes/OS/System/Library/dyld/dyld_shared_cache_arm64e",
+    "images": ["/usr/lib/libSystem.B.dylib"]
+  }
+}
+```
+
+The result reports:
+
+- the magic, architecture, UUID, platform and OS version, any alternate platform
+  (Mac Catalyst), cache type, the development/production subtype for multi-caches
+  (including its raw ID when unknown), shared region and maximum slide;
+- every VM mapping, with the file that holds it;
+- every subcache by file suffix, with its UUID checked against the main cache.
+  A missing or mismatched subcache makes coverage `partial`, and images mapped
+  there are `unmapped`;
+- the complete image list with addresses.
+
+For each requested install path, the tool reads that image's load commands
+(install name, dependencies with their re-export, weak, upward and delayed-init
+flags, and rpaths) through the cache mappings. A path the cache does not
+contain is `absent`. Older single-file caches are read from their legacy header
+fields.
+
+Nothing is executed, slid or extracted. Slide info, local symbols and the
+cache's code signature are not parsed. The Evidence subject is the main cache
+file, identified by its digest.
@@ -26,11 +26,13 @@ graph TD
    end

    subgraph "Provider Layers"
+        PWNTOOLS["src/native/pwntools/ + src/native/pwndbg/<br/>BYO offline ELF/core adapters<br/>owned snapshots/Python and optional core-only GDB<br/>unchanged upstream parsers, ABI structures and mapping API"]
+        EVM["src/evm/<br/>unchanged EVMole/WASM in bounded owned worker<br/>explicit carrier parsing and inferred interface adapter"]
        HOPPER["src/hopper/<br/>Hopper launch & Unix-socket protocol<br/>BridgeLauncher, HopperClient, protocol"]
        GHIDRA["src/ghidra/<br/>Ghidra discovery, profile & function analysis<br/>snapshot, Unix/Windows transport, bounded lifecycle"]
        IDA["src/ida/<br/>Upstream MCP contract adaptation<br/>live GUI binding or owned headless database"]
        IDA_MCP["External ida-pro-mcp<br/>GUI proxy or database supervisor<br/>upstream installation and engine lifecycle"]
-        AUX["src/artifacts/ + src/native/<br/>disjoint artifact and native capabilities"]
+        AUX["src/artifacts/ + src/native/<br/>artifact inventory and extraction<br/>format readers and native capabilities"]
        BROWSER["src/browser/<br/>CDP / Playwright capture<br/>captured scripts and native module resolution<br/>execution/: coverage, listener and source attribution"]
        JS_CODEC["src/javascript/sourceMaps/<br/>pinned upstream map codec<br/>owned heap-limited Node process, complete point evidence"]
        INSPECTOR["src/inspector/<br/>passive V8 Inspector discovery and capture<br/>script and target locations"]
@@ -92,6 +94,9 @@ graph TD
    APP -->|record callbacks| RECORDS
    SERVER -->|narrow record ports| RECORDS
    RECORDS --> DOMAIN
+    COMPOSITION --> PWNTOOLS
+    PWNTOOLS --> PROCESS
+    PWNTOOLS --> DOMAIN
    COMPOSITION --> HOPPER
    COMPOSITION --> GHIDRA
    COMPOSITION --> IDA
@@ -140,3 +145,8 @@ graph TD
    TESTS -.-> BROWSER
    TESTS -.-> EVALUATION
    TESTS -.-> ERRORS
+
+    COMPOSITION --> EVM
+    APP -->|EVM interface port| EVM
+    EVM --> PROCESS
+    EVM --> DOMAIN
@@ -0,0 +1,131 @@
+# Offline binary diagnostics
+
+`inspect_binary_layout` / `inspect-binary-layout` answers what an explicit
+file contains: section/segment layout, original symbols/relocations, static
+linkage names and mitigation indicators. It works without an active Hopper,
+Ghidra or IDA target. CTF is one possible use; crash triage, compatibility and
+ordinary binary inspection use the same modular capability.
+
+## Bring your own engine
+
+Initial real verification covers **Linux x64, ELF64 x86-64 little-endian
+EXEC/DYN/REL**. Provide an absolute Python executable whose environment already
+contains unchanged pwntools 4.15.0, pyelftools 0.33 and Unicorn 2.1.2:
+
+```sh
+REA_PWNTOOLS_PYTHON=/absolute/isolated-env/bin/python \
+  rea inspect-binary-layout ./selected.elf --json
+```
+
+```json
+{
+  "name": "inspect_binary_layout",
+  "arguments": { "path": "/artifacts/selected.elf" }
+}
+```
+
+REA never installs Python, packages or GDB, changes a user init file, launches
+the selected object as a host process, or requests runtime library resolution. The Python process
+uses isolated mode and an owned cache. Exact upstream profiles are recorded in
+[upstream provenance](https://github.com/morluto/rea/blob/main/third_party/pwntools/README.md).
+
+## Interpreting results
+
+- Artifact path, SHA-256 and size identify original selected bytes. All parsing
+  reads an owned stable snapshot; the original is unchanged.
+- Addresses, offsets, lengths and flags are hexadecimal strings. A linked
+  address is not a runtime address. Runtime load base remains null. A zero
+  EXEC/DYN entry means absent; a relocatable entry is not applicable.
+- Each symbol retains its table and entry index. Its reported value can mean
+  undefined, alignment, absolute value, no address, unknown section index,
+  section offset, TLS offset or linked virtual address. Duplicate names remain
+  separate entries. SHN_XINDEX remains unresolved in the selected upstream
+  representation; its external index table is not silently treated as resolved.
+- Relocatable objects have section-relative relocations and no executable entry
+  claim. Signed REL/RELA relocation addends are decimal strings. Packed RELR
+  tables retain full original bytes and upstream-decoded offsets as derived
+  evidence, with per-offset packed-word locations and implicit addends unknown.
+  Overall relocation inventory completeness remains unknown.
+  A relocatable SHN_UNDEF target or inactive SHT_NULL header remains an explicit
+  unknown with the original reported section index and offset.
+- REL/RELA symbol references retain their original table and entry indices.
+  Positive indices resolve through a validated symbol table; symbol index zero
+  means a zero symbol value without a table lookup, including when no table is
+  linked. Malformed references fail with the affected section and symbol index.
+- Section-name and symbol tables require declared SHT_STRTAB links.
+  SHN_UNDEF explicitly means no section names: display is empty, raw name and
+  location unknown, with the original name offsets retained. Extended section-name
+  indices resolve through section zero and undergo the same validation.
+- Symbol tables require a declared SHT_STRTAB link. Name offsets and terminators
+  must stay inside the declared string table; malformed references fail before
+  unrelated bytes can become names. Dynamic dependencies use DT_STRTAB/DT_STRSZ
+  with a unique file-backed mapping; ambiguous or unbacked mappings are
+  explicitly unsupported.
+- Name display strings use UTF-8 replacement for opaque bytes, including
+  sectionless dependency names and interpreter paths. Raw name
+  bytes and string-table ranges retain observed identity where resolvable;
+  ranges include the terminating NUL and base64 bytes exclude it.
+- NOBITS and NULL sections provide no file bytes. Reported file-backed ranges
+  are checked against snapshot size again at the public boundary. PT_NULL payload
+  fields are unused: reported numbers remain, file backing is none and interpreted
+  permissions are null. Segments with zero file size also have no file bytes.
+- Sectionless dynamic images still report dependency names with raw bytes and
+  file locations where uniquely mapped. Missing symbol/relocation section tables
+  do not establish that those runtime tables are absent.
+  Upstream RELRO/canary heuristics rely on sections and can be incomplete in
+  this case; their reported candidates retain an explicit coverage limitation.
+- DT_NEEDED/PT_INTERP are reported names, not resolved runtime paths. GOT/PLT
+  maps are derived convenience views and may collapse aliases. PLT inference
+  can emulate selected instructions in Unicorn; its outputs are static candidates.
+  Exec syscall tracing observes host process launches. Map completeness
+  remains unknown and original upstream warnings are returned inline.
+- Canary, PIE, NX, executable-stack and RELRO are static inferences. NX and
+  executable-stack are separate upstream indicators: on x86-64 an executable
+  stack can accompany an unknown (`null`) NX indicator. ET_DYN can be a shared
+  library, and an absent canary symbol does not prove every function unprotected.
+
+Complete results have a 32 MiB input, 64 MiB reply, 1 MiB combined diagnostics
+and 30-second owned command deadline. The reply budget applies to the decoder
+record; the CLI/MCP Evidence envelope adds copies and encoding overhead. The
+pinned MCP SDK defaults to a 10 MiB receive buffer. Large complete results need
+a caller-configured `StdioClientTransport({ maxBufferSize: ... })`; the large
+extended-index verification uses 256 MiB and an explicit five-minute request
+timeout in its separate opt-in MCP lane. REA does not silently truncate the result. Python lowers resource soft limits to at most 3 GiB virtual address space,
+30 CPU seconds and 64 MiB file output. Inherited tighter soft/hard limits are
+retained, and the effective values are returned in the result limitations. Virtual address space is not RSS;
+Unicorn needs a large virtual map. Limits fail with no partial success, and
+owned process/root cleanup completes independently of cancellation.
+
+Core files, GDB session/state/control, optional pwndbg enrichment and instruction
+inspection are separate increments tracked by #969. This increment makes no
+real support claim for those features or other operating systems/architectures.
+
+Typed decoder failures retain bounded `captured_output` (stdout, stderr and an
+explicit truncation flag) alongside the original failure category and reason.
+Successful `diagnostics` also exposes the supervisor's `truncated` flag. Output
+beyond the complete diagnostic budget is rejected, including when the decoder
+writes a valid reply; cleanup and late cancellation reuse the observed flag.
+Memory allocation failures use `resource_constraint`, with effective resource
+limits (or an explicit unknown) and memory-specific recovery guidance. A
+MemoryError alone does not establish the exact failed allocation or that a
+particular budget was exhausted. Invalid undersized symbol entries are rejected
+before REA reports source ranges for them.
+The bridge reserves 1 MiB to report allocation failures. If even error reporting
+or serialization fails with MemoryError, its reserved exit status preserves the
+resource classification with unknown effective limits.
+Reserved exits require a matching private marker written by the bridge's actual
+failure branch. Bare launcher exits or missing/unwritable markers retain process
+diagnostics with the resource cause unverified.
+Signal termination alone is never classified as observed memory exhaustion.
+The small bootstrap also covers catchable MemoryError during adapter imports,
+compilation and initialization. Python interpreter startup failures before the
+bootstrap runs retain their observed process diagnostics without guessed causes.
+SIGXCPU retains a CPU resource diagnostic and CPU-specific recovery advice.
+Observed EFBIG writes or SIGXFSZ termination retain a file-size resource
+diagnostic and file-size-specific recovery advice. If a tight file limit also
+prevents writing the limit record, effective values remain unknown.
+The bridge records actual limits in owned storage before analysis; missing or
+malformed limit reports remain unknown with their read failure preserved. A
+received signal alone does not establish its exact cause. Dynamic tags require
+a complete DT_NULL inside PT_DYNAMIC; interpreter names and ranges end at the
+first NUL, with any padding still represented by the original segment range.
@@ -133,7 +133,7 @@ REA retains local observation data and removes only URL userinfo credentials, ex
 - URL observations preserve the complete local URL, including query values, fragments, duplicate parameters, and their order. Only username/password userinfo is removed; malformed original URL strings remain available with `origin: null`.
 - DOM snapshots retain node types, node names, value lengths, and attribute names, but not text or attribute values.
 - Accessibility structure and roles are retained by default, while names and descriptions require `include_accessibility_text: true`.
- Network observations retain method, status, MIME type, size, type, initiator stack location, and complete URLs with userinfo credentials removed. Headers are discarded after an allowlisted projection of length/encoding, structured CSP/Link/policy fields, and untrusted agent hints. Cookies and authorization headers are never retained.
+- Network observations retain method, status, MIME type, size, type, initiator stack location, and complete URLs with userinfo credentials removed. Redirects reported by CDP are attached as ordered `redirects` on the one request ID, with the prior request URL, CDP response URL, method/type, response status/MIME/encoded length, request timestamp, and the next `requestWillBeSent` event timestamp. CDP delivers `redirectResponse` with that next request event, so the latter is an event boundary rather than an exact response timestamp. Redirect response headers and bodies are discarded; hops outside the selected origins are discarded with the request chain. Headers are discarded after an allowlisted projection of length/encoding, structured CSP/Link/policy fields, and untrusted agent hints. Cookies and authorization headers are never retained.
 - Request/response bodies are not requested or parsed by default. When selected, only allowed-origin JSON media types are read, converted immediately to complete value-free property paths/types, and discarded. `Network.getResponseBody` is never sent unless JSON body shape capture is selected.
 - Console observations with a stack source retain call type, argument types, timestamp, and source location. When console text capture is selected, already-delivered primitive values are retained verbatim; objects, getters, and remote properties are never expanded.
 - WebSocket observations retain direction, opcode, and payload byte length. When shape capture is selected, text frames are classified as text or complete value-free JSON shape; binary bytes, hashes, prefixes, and raw frames are never retained.
@@ -385,6 +385,30 @@ claims. Actual Swift/Xcode, assetutil, native NIB, bundle signing and DMG lifecy
 claims require the real Apple lane. Native binary API/value-flow semantics and
 shared cross-domain contract aggregates keep their separate owners.

+## Artifact inventory and extraction ownership
+
+`src/artifacts/inventory/` owns format classification, reader selection, inventory
+policy, canonical scanning and artifact graph construction. The shared artifact
+provider and JavaScript reconstruction workflow consume this owner. Snapshot
+semantics remain in `src/domain/artifactInventorySnapshot.ts`.
+
+`src/artifacts/extraction/` owns member selection, integrity checks and transactional
+materialization through the existing readers and safe output tree. Reader cleanup,
+cancellation, rollback, archive containment and caller-visible results retain their
+existing behavior. Acquisition guards reject imports from these producer owners
+into application workflows, production composition or CLI/MCP adapters.
+
+`src/application/artifacts/ArtifactExtractionDestination.ts` owns the caller's
+default temporary output-root choice for both CLI and MCP. The adapters pass this
+destination to the existing provider operation; format handling and member writes
+remain in the artifact owner.
+
+Add format-specific acquisition behavior beside the inventory readers and exercise
+its actual producer representation in filesystem boundary tests. Add caller
+workflow behavior in the application owner and verify both adapters. The installed
+package lane checks inventory identity and extraction through CLI and MCP; the
+real Apple bundle lane separately establishes DMG mount and detach behavior.
+
 ## Binary production composition closure

 `src/composition/binary.ts` is the shared production owner for deep candidate
@@ -425,3 +449,29 @@ native-value verifier locations are retained until their own proof lanes migrate
 interactive macOS UI success and real dependency tracing require their respective
 host/engine workflows. Portable source fixtures and injected call-route tests
 establish their narrower boundaries, without expanding provider/platform support.
+
+## Process capture and analyst workflow ownership
+
+`src/domain/process/` owns scenario/capture validation, portable process trees,
+trace specifications, observations, comparisons and the canonical process Evidence
+identity. The standalone contract example lives in `src/contracts/process/`;
+shared session contracts retain their broader investigation owner.
+
+`src/process/capture/` owns the actual PTY boundary, terminal rendering, sampling,
+selected child environment, filesystem snapshots/effects, runtime path admission,
+event journal, settlement and resource cleanup. It reuses `src/process/` ownership
+primitives and the Windows host substrate. Its identity import follows the
+existing pure declaration directly. A source guard rejects outward application,
+composition and caller imports; no new provider or lifecycle interface is added.
+
+`src/application/process/` retains Evidence projection and file-backed CLI
+capture/comparison workflows. Capture helper tests use the forked adapter lane;
+Evidence/host integration tests use the serial process-boundary lane. Their
+fixtures and assertions remain unchanged. Installed capability-probe URLs follow
+the new compiled adapter path, including the optional-dependency failure probe.
+
+Windows PTY capture retains its existing unavailable outcome because descendant
+cleanup is not yet verified. Native Job Objects and a PTY binary do not establish
+that capture workflow. Real POSIX capture/cleanup and installed terminal/PTY module
+resolution require their actual host and package lanes; portable comparison
+fixtures establish their separate evidence semantics.
@@ -0,0 +1,184 @@
+# CLI and Evidence
+
+Use the CLI for a direct inspection or a script. It uses the same application
+workflows and evidence contracts as REA's MCP server. Each CLI invocation is a
+separate process; save results when you want to use them in a later command.
+
+## Run a command
+
+After [installing REA](installation.md), use `rea`. You can also run a command
+without a global installation:
+
+```bash
+npx -y rea-agents@latest analyze-javascript-application /absolute/path/to/app --json
+```
+
+Use an extracted application directory or an ASAR as the target. Static
+JavaScript analysis returns the application graph and Evidence directly.
+Generic `rea analyze PATH` selects this workflow for directories and `.asar`
+files when neither `--provider` nor `--snapshot` is supplied. See
+[JavaScript artifact reconstruction](javascript-artifact-reconstruction.md)
+for results, integrity checks and coverage.
+
+## Native analysis
+
+Configure [Hopper or Ghidra](installation.md#hopper), or the
+[IDA adapter](ida-provider.md), before analyzing a native target. Substitute
+your target, search text and function name or address in these examples:
+
+```bash
+rea analyze /absolute/path/to/program --provider ghidra --json
+rea search /absolute/path/to/program "search" --provider ghidra --json
+rea function /absolute/path/to/program main --provider ghidra --json
+rea decompile /absolute/path/to/program 0x1000 --provider ghidra --json
+rea xrefs /absolute/path/to/program 0x1000 --provider ghidra --json
+rea trace /absolute/path/to/program "search" --provider ghidra --json
+```
+
+`analyze` and `inspect` share the native overview workflow. `function` returns
+a function dossier; `decompile` returns pseudocode. For assembly instructions
+alone, use `rea instructions`. A macOS `.app` bundle can be supplied directly.
+
+Run `rea --help` or a command's `--help` for arguments and output options.
+The [generated catalog](product-catalog.json) lists all CLI commands and MCP
+tools. Provider-specific target support is described in the
+[native guide](native-investigation.md), [DOS guide](ghidra-dos.md), and
+[Windows Ghidra guide](windows-ghidra-p0.md).
+
+## Choose a provider
+
+List the available providers and their supported operations:
+
+```bash
+rea providers --json
+rea capabilities --json
+```
+
+These commands describe binary-session providers and auxiliary capabilities.
+For the complete MCP surface, use the connected server's tool list and the
+session's advertised availability; individual guides describe prerequisites.
+
+With automatic selection, REA uses the single available provider that supports
+the target. When several providers support it, select one explicitly:
+
+```bash
+rea analyze /absolute/path/to/program --provider hopper
+```
+
+Set `REA_ANALYSIS_PROVIDER` for a standing preference. An explicit `--provider`
+overrides it. In MCP, pass `provider_id` to `open_binary`:
+
+```json
+{
+  "path": "/absolute/path/to/program",
+  "provider_id": "hopper"
+}
+```
+
+The selected provider remains bound to the session until an explicit switch
+or close. Provider failures are returned with their original reason. For an
+`ambiguous` selection error, choose from `details.candidate_ids`; for
+`provider_unavailable`, run `rea doctor --provider ID --json` to diagnose the
+selected engine. See [task readiness](installation.md#check-readiness-for-your-task)
+and [provider selection](adr/0001-provider-selection-and-analysis-profiles.md).
+
+The session reports work still in progress through `analysis_activity`.
+A client timeout can end its wait while the provider continues analyzing.
+`cleanup_incomplete` identifies resources whose shutdown or removal could not
+be verified. See [MCP contracts](mcp-contracts.md) for session lifecycle and
+[Ghidra first-query deadlines](mcp-contracts.md#ghidra-first-query-deadlines-and-recovery)
+for import, client timeouts and recovery.
+
+## Save and reuse analysis snapshots
+
+A snapshot retains successful analysis results for later queries. REA reuses
+an exact result when the target bytes, operation, parameters, provider and
+settings match. Mutations and cursor-dependent calls are excluded from the
+cache. Snapshot files are local and use owner-only permissions.
+
+```bash
+rea analyze /absolute/path/to/program --provider ghidra --snapshot /absolute/path/to/analysis/program.json
+# Repeat the same query to reuse its saved result.
+rea analyze /absolute/path/to/program --provider ghidra --snapshot /absolute/path/to/analysis/program.json
+```
+
+An exact CLI cache hit is read before starting a provider process.
+In MCP, `open_binary` accepts `snapshot_path` to import a snapshot atomically
+for its matching target; an MCP provider may still start before returning a
+cached result. `close_binary` accepts `snapshot_path` and optional
+`overwrite: true` to save before releasing provider resources. A failed save
+leaves the session open so the caller can resolve the output failure.
+
+## Import, export and compare Evidence
+
+Evidence records retain artifact identity, source locations, observations,
+inferences and unresolved findings. Validate an existing bundle, export its
+canonical form, or compare two supplied bundles:
+
+```bash
+rea evidence-import /absolute/path/to/evidence/bundle.json
+rea evidence-export /absolute/path/to/evidence/bundle.json /absolute/path/to/evidence/canonical.json
+rea compare /absolute/path/to/evidence/left.json /absolute/path/to/evidence/right.json
+```
+
+Exports preserve an existing destination unless `--overwrite` is explicit.
+For application traces and version comparisons, see
+[JavaScript application workflows](javascript-application-workflows.md).
+MCP [retained Evidence references](mcp-contracts.md#retained-application-evidence-inputs)
+belong to one connection. Separate CLI calls consume full saved records.
+
+## Import historical source
+
+Import an older source tree to compare with the current artifact:
+
+```bash
+rea import-reference-source /absolute/path/to/source
+```
+
+The import records hashes and metadata for the supplied files, separately
+from observations of the current app. File names do not automatically exclude
+files. Set `REA_REFERENCE_SECRET_PATTERNS_JSON` to a JSON array of ignore
+patterns when you want to exclude selected paths.
+
+Historical-source import requires safe no-follow file opens on Linux or
+macOS. Native Windows returns `unsupported_host`; use Linux REA inside WSL
+or another supported host. See
+[source-to-bundle comparison](javascript-application-workflows.md#historical-source-to-bundle-comparison)
+for mapping identities, inferences and unknowns.
+
+## Capture runtime behavior
+
+Choose the guide for the target and intended interaction:
+
+- [Browser observation](browser-observation.md): inspect a selected page through CDP.
+- [Browser scenarios](browser-scenario-contract.md): run declared interactions and capture their results.
+- [Electron observation](electron-observation.md): inspect an Electron renderer or capture an application scenario.
+- [Node/Electron Inspector](javascript-runtime-observation.md): record script locations and execution contexts.
+- [Process capture](process-capture.md): run an executable and compare terminal, exit and filesystem observations.
+
+Runtime requests name the target and actions. Launched targets run with your
+user permissions; consult the chosen guide for host requirements and effects.
+
+## Output and exit status
+
+The default terminal format is TOON. Use `--json` when saving results for a
+JSON consumer. Output selection and formatting do not change operation status.
+
+| Status    | Meaning                                                                                                                                              |
+| --------- | ---------------------------------------------------------------------------------------------------------------------------------------------------- |
+| `0`       | The operation completed. Its result may include partial evidence, warnings or unresolved questions.                                                  |
+| `1`       | The operation could not complete. Structured output identifies invalid input, permissions, cancellation, timeouts or another failure when available. |
+| `128 + N` | Signal `N` ended the process, where the shell or runtime preserves the conventional signal-derived status.                                           |
+
+`setup --dry-run` returns `planned` and exits `0`; a cancelled setup also exits
+`0`. Setup returns `1` for `needs_confirmation` or `needs_human`.
+`doctor` returns `1` when required checks in its selected readiness scope fail;
+unavailable optional providers remain informational for unrelated tasks.
+
+Enable `pipefail` in a supporting shell so a downstream formatter preserves
+REA's failure status:
+
+```bash
+set -o pipefail
+rea inspect-artifact ./app.asar --json | jq . > inspection.json
+```
@@ -10,10 +10,12 @@
          "enum": [
            "invalid_input",
            "unsupported_provider",
+            "unsupported_target",
            "integrity_mismatch",
            "truncated",
            "cancelled",
            "timeout",
+            "resource_constraint",
            "unavailable",
            "execution_failure"
          ]
@@ -29,7 +31,79 @@
        "details": {
          "type": "object",
          "propertyNames": { "type": "string" },
-          "additionalProperties": { "$ref": "#/$defs/__schema0" }
+          "additionalProperties": {}
+        }
+      },
+      "required": ["code", "category", "message", "retryable", "remediation"],
+      "additionalProperties": false
+    },
+    {
+      "type": "object",
+      "properties": {
+        "code": { "type": "string", "const": "access_denied" },
+        "category": {
+          "type": "string",
+          "enum": [
+            "invalid_input",
+            "unsupported_provider",
+            "unsupported_target",
+            "integrity_mismatch",
+            "truncated",
+            "cancelled",
+            "timeout",
+            "resource_constraint",
+            "unavailable",
+            "execution_failure"
+          ]
+        },
+        "message": { "type": "string", "minLength": 1 },
+        "retryable": { "type": "boolean" },
+        "remediation": {
+          "type": "object",
+          "properties": { "action": { "type": "string", "minLength": 1 } },
+          "required": ["action"],
+          "additionalProperties": false
+        },
+        "details": {
+          "type": "object",
+          "propertyNames": { "type": "string" },
+          "additionalProperties": {}
+        }
+      },
+      "required": ["code", "category", "message", "retryable", "remediation"],
+      "additionalProperties": false
+    },
+    {
+      "type": "object",
+      "properties": {
+        "code": { "type": "string", "const": "artifact_changed" },
+        "category": {
+          "type": "string",
+          "enum": [
+            "invalid_input",
+            "unsupported_provider",
+            "unsupported_target",
+            "integrity_mismatch",
+            "truncated",
+            "cancelled",
+            "timeout",
+            "resource_constraint",
+            "unavailable",
+            "execution_failure"
+          ]
+        },
+        "message": { "type": "string", "minLength": 1 },
+        "retryable": { "type": "boolean" },
+        "remediation": {
+          "type": "object",
+          "properties": { "action": { "type": "string", "minLength": 1 } },
+          "required": ["action"],
+          "additionalProperties": false
+        },
+        "details": {
+          "type": "object",
+          "propertyNames": { "type": "string" },
+          "additionalProperties": {}
        }
      },
      "required": ["code", "category", "message", "retryable", "remediation"],
@@ -44,10 +118,12 @@
          "enum": [
            "invalid_input",
            "unsupported_provider",
+            "unsupported_target",
            "integrity_mismatch",
            "truncated",
            "cancelled",
            "timeout",
+            "resource_constraint",
            "unavailable",
            "execution_failure"
          ]
@@ -63,7 +139,7 @@
        "details": {
          "type": "object",
          "propertyNames": { "type": "string" },
-          "additionalProperties": { "$ref": "#/$defs/__schema0" }
+          "additionalProperties": {}
        }
      },
      "required": ["code", "category", "message", "retryable", "remediation"],
@@ -78,10 +154,12 @@
          "enum": [
            "invalid_input",
            "unsupported_provider",
+            "unsupported_target",
            "integrity_mismatch",
            "truncated",
            "cancelled",
            "timeout",
+            "resource_constraint",
            "unavailable",
            "execution_failure"
          ]
@@ -97,7 +175,43 @@
        "details": {
          "type": "object",
          "propertyNames": { "type": "string" },
-          "additionalProperties": { "$ref": "#/$defs/__schema0" }
+          "additionalProperties": {}
+        }
+      },
+      "required": ["code", "category", "message", "retryable", "remediation"],
+      "additionalProperties": false
+    },
+    {
+      "type": "object",
+      "properties": {
+        "code": { "type": "string", "const": "unsupported_target" },
+        "category": {
+          "type": "string",
+          "enum": [
+            "invalid_input",
+            "unsupported_provider",
+            "unsupported_target",
+            "integrity_mismatch",
+            "truncated",
+            "cancelled",
+            "timeout",
+            "resource_constraint",
+            "unavailable",
+            "execution_failure"
+          ]
+        },
+        "message": { "type": "string", "minLength": 1 },
+        "retryable": { "type": "boolean" },
+        "remediation": {
+          "type": "object",
+          "properties": { "action": { "type": "string", "minLength": 1 } },
+          "required": ["action"],
+          "additionalProperties": false
+        },
+        "details": {
+          "type": "object",
+          "propertyNames": { "type": "string" },
+          "additionalProperties": {}
        }
      },
      "required": ["code", "category", "message", "retryable", "remediation"],
@@ -112,10 +226,12 @@
          "enum": [
            "invalid_input",
            "unsupported_provider",
+            "unsupported_target",
            "integrity_mismatch",
            "truncated",
            "cancelled",
            "timeout",
+            "resource_constraint",
            "unavailable",
            "execution_failure"
          ]
@@ -131,7 +247,7 @@
        "details": {
          "type": "object",
          "propertyNames": { "type": "string" },
-          "additionalProperties": { "$ref": "#/$defs/__schema0" }
+          "additionalProperties": {}
        }
      },
      "required": ["code", "category", "message", "retryable", "remediation"],
@@ -146,10 +262,12 @@
          "enum": [
            "invalid_input",
            "unsupported_provider",
+            "unsupported_target",
            "integrity_mismatch",
            "truncated",
            "cancelled",
            "timeout",
+            "resource_constraint",
            "unavailable",
            "execution_failure"
          ]
@@ -165,7 +283,43 @@
        "details": {
          "type": "object",
          "propertyNames": { "type": "string" },
-          "additionalProperties": { "$ref": "#/$defs/__schema0" }
+          "additionalProperties": {}
+        }
+      },
+      "required": ["code", "category", "message", "retryable", "remediation"],
+      "additionalProperties": false
+    },
+    {
+      "type": "object",
+      "properties": {
+        "code": { "type": "string", "const": "resource_constraint" },
+        "category": {
+          "type": "string",
+          "enum": [
+            "invalid_input",
+            "unsupported_provider",
+            "unsupported_target",
+            "integrity_mismatch",
+            "truncated",
+            "cancelled",
+            "timeout",
+            "resource_constraint",
+            "unavailable",
+            "execution_failure"
+          ]
+        },
+        "message": { "type": "string", "minLength": 1 },
+        "retryable": { "type": "boolean" },
+        "remediation": {
+          "type": "object",
+          "properties": { "action": { "type": "string", "minLength": 1 } },
+          "required": ["action"],
+          "additionalProperties": false
+        },
+        "details": {
+          "type": "object",
+          "propertyNames": { "type": "string" },
+          "additionalProperties": {}
        }
      },
      "required": ["code", "category", "message", "retryable", "remediation"],
@@ -180,10 +334,12 @@
          "enum": [
            "invalid_input",
            "unsupported_provider",
+            "unsupported_target",
            "integrity_mismatch",
            "truncated",
            "cancelled",
            "timeout",
+            "resource_constraint",
            "unavailable",
            "execution_failure"
          ]
@@ -199,7 +355,7 @@
        "details": {
          "type": "object",
          "propertyNames": { "type": "string" },
-          "additionalProperties": { "$ref": "#/$defs/__schema0" }
+          "additionalProperties": {}
        }
      },
      "required": ["code", "category", "message", "retryable", "remediation"],
@@ -214,10 +370,12 @@
          "enum": [
            "invalid_input",
            "unsupported_provider",
+            "unsupported_target",
            "integrity_mismatch",
            "truncated",
            "cancelled",
            "timeout",
+            "resource_constraint",
            "unavailable",
            "execution_failure"
          ]
@@ -270,10 +428,12 @@
          "enum": [
            "invalid_input",
            "unsupported_provider",
+            "unsupported_target",
            "integrity_mismatch",
            "truncated",
            "cancelled",
            "timeout",
+            "resource_constraint",
            "unavailable",
            "execution_failure"
          ]
@@ -289,7 +449,7 @@
        "details": {
          "type": "object",
          "propertyNames": { "type": "string" },
-          "additionalProperties": { "$ref": "#/$defs/__schema0" }
+          "additionalProperties": {}
        }
      },
      "required": ["code", "category", "message", "retryable", "remediation"],
@@ -304,10 +464,12 @@
          "enum": [
            "invalid_input",
            "unsupported_provider",
+            "unsupported_target",
            "integrity_mismatch",
            "truncated",
            "cancelled",
            "timeout",
+            "resource_constraint",
            "unavailable",
            "execution_failure"
          ]
@@ -323,7 +485,7 @@
        "details": {
          "type": "object",
          "propertyNames": { "type": "string" },
-          "additionalProperties": { "$ref": "#/$defs/__schema0" }
+          "additionalProperties": {}
        }
      },
      "required": ["code", "category", "message", "retryable", "remediation"],
@@ -338,10 +500,12 @@
          "enum": [
            "invalid_input",
            "unsupported_provider",
+            "unsupported_target",
            "integrity_mismatch",
            "truncated",
            "cancelled",
            "timeout",
+            "resource_constraint",
            "unavailable",
            "execution_failure"
          ]
@@ -357,7 +521,7 @@
        "details": {
          "type": "object",
          "propertyNames": { "type": "string" },
-          "additionalProperties": { "$ref": "#/$defs/__schema0" }
+          "additionalProperties": {}
        }
      },
      "required": ["code", "category", "message", "retryable", "remediation"],
@@ -372,10 +536,12 @@
          "enum": [
            "invalid_input",
            "unsupported_provider",
+            "unsupported_target",
            "integrity_mismatch",
            "truncated",
            "cancelled",
            "timeout",
+            "resource_constraint",
            "unavailable",
            "execution_failure"
          ]
@@ -391,7 +557,7 @@
        "details": {
          "type": "object",
          "propertyNames": { "type": "string" },
-          "additionalProperties": { "$ref": "#/$defs/__schema0" }
+          "additionalProperties": {}
        }
      },
      "required": ["code", "category", "message", "retryable", "remediation"],
@@ -406,10 +572,12 @@
          "enum": [
            "invalid_input",
            "unsupported_provider",
+            "unsupported_target",
            "integrity_mismatch",
            "truncated",
            "cancelled",
            "timeout",
+            "resource_constraint",
            "unavailable",
            "execution_failure"
          ]
@@ -425,7 +593,7 @@
        "details": {
          "type": "object",
          "propertyNames": { "type": "string" },
-          "additionalProperties": { "$ref": "#/$defs/__schema0" }
+          "additionalProperties": {}
        }
      },
      "required": ["code", "category", "message", "retryable", "remediation"],
@@ -440,10 +608,12 @@
          "enum": [
            "invalid_input",
            "unsupported_provider",
+            "unsupported_target",
            "integrity_mismatch",
            "truncated",
            "cancelled",
            "timeout",
+            "resource_constraint",
            "unavailable",
            "execution_failure"
          ]
@@ -459,7 +629,7 @@
        "details": {
          "type": "object",
          "propertyNames": { "type": "string" },
-          "additionalProperties": { "$ref": "#/$defs/__schema0" }
+          "additionalProperties": {}
        }
      },
      "required": ["code", "category", "message", "retryable", "remediation"],
@@ -474,10 +644,12 @@
          "enum": [
            "invalid_input",
            "unsupported_provider",
+            "unsupported_target",
            "integrity_mismatch",
            "truncated",
            "cancelled",
            "timeout",
+            "resource_constraint",
            "unavailable",
            "execution_failure"
          ]
@@ -493,7 +665,7 @@
        "details": {
          "type": "object",
          "propertyNames": { "type": "string" },
-          "additionalProperties": { "$ref": "#/$defs/__schema0" }
+          "additionalProperties": {}
        }
      },
      "required": ["code", "category", "message", "retryable", "remediation"],
@@ -508,10 +680,12 @@
          "enum": [
            "invalid_input",
            "unsupported_provider",
+            "unsupported_target",
            "integrity_mismatch",
            "truncated",
            "cancelled",
            "timeout",
+            "resource_constraint",
            "unavailable",
            "execution_failure"
          ]
@@ -527,7 +701,7 @@
        "details": {
          "type": "object",
          "propertyNames": { "type": "string" },
-          "additionalProperties": { "$ref": "#/$defs/__schema0" }
+          "additionalProperties": {}
        }
      },
      "required": ["code", "category", "message", "retryable", "remediation"],
@@ -542,10 +716,12 @@
          "enum": [
            "invalid_input",
            "unsupported_provider",
+            "unsupported_target",
            "integrity_mismatch",
            "truncated",
            "cancelled",
            "timeout",
+            "resource_constraint",
            "unavailable",
            "execution_failure"
          ]
@@ -561,27 +737,11 @@
        "details": {
          "type": "object",
          "propertyNames": { "type": "string" },
-          "additionalProperties": { "$ref": "#/$defs/__schema0" }
+          "additionalProperties": {}
        }
      },
      "required": ["code", "category", "message", "retryable", "remediation"],
      "additionalProperties": false
    }
-  ],
-  "$defs": {
-    "__schema0": {
-      "anyOf": [
-        { "type": "string" },
-        { "type": "number" },
-        { "type": "boolean" },
-        { "type": "null" },
-        { "type": "array", "items": { "$ref": "#/$defs/__schema0" } },
-        {
-          "type": "object",
-          "propertyNames": { "type": "string" },
-          "additionalProperties": { "$ref": "#/$defs/__schema0" }
-        }
-      ]
-    }
-  }
+  ]
 }
@@ -0,0 +1,84 @@
+# Offline EVM bytecode
+
+`inspect_evm_interface` / `inspect-evm-interface` infers interface candidates
+from one explicitly selected local bytecode carrier. The capability is general:
+contract investigation, compatibility, audit and CTF showcases use the same
+portable primitive. It does not require an active native binary target.
+
+```sh
+rea inspect-evm-interface ./runtime.hex hex --json
+rea inspect-evm-interface ./runtime.bin raw --json
+```
+
+```json
+{
+  "name": "inspect_evm_interface",
+  "arguments": { "path": "/artifacts/runtime.hex", "encoding": "hex" }
+}
+```
+
+Initial real verification covers flat legacy bytecode on Linux x64 and unchanged
+bundled EVMole 0.9.3. EOF-style EF00 containers return `unsupported_target`,
+with the selected path and format reason. Provider/configuration failures retain
+their distinct unavailable-provider or capability classification.
+The host must already provide util-linux `prlimit`, normally `/usr/bin/prlimit`;
+`REA_EVM_PRLIMIT_COMMAND` can select another absolute executable. REA installs
+no system tools and changes no user configuration. [Upstream provenance and
+license](https://github.com/morluto/rea/blob/main/third_party/evmole/README.md) are packaged.
+
+## Evidence semantics
+
+- `encoding` is required: raw bytes or UTF-8 hex, with optional `0x` prefix and
+  outer ASCII whitespace. Odd hex, interior separators, BOM, non-ASCII whitespace
+  and invalid UTF-8 are rejected. Empty bytecode is valid and has unknown coverage.
+- Carrier SHA-256 identifies the exact original file, including prefix/casing
+  and whitespace. Decoded-byte SHA-256 identifies actual selected EVM bytes.
+  Neither digest is the Ethereum Keccak code hash.
+- Full bytecode, upstream function offsets and original producer representation
+  are returned inline. Offsets are byte positions in decoded bytecode.
+- Upstream also returns terminal metadata during selector recovery. Its reported
+  values remain in `raw_result`; integer precision and non-text-key coverage are
+  unknown in the JS binding. Full bytecode retains the original encoded metadata.
+- Selectors, argument strings and state mutability are **inferences**. Function
+  names/signatures are not looked up. Optimized code may produce different
+  mutability candidates; recovered types are not a verified source ABI.
+- Runtime/init-code identity, deployed authenticity, hardfork and discovery
+  completeness remain unknown. Empty candidates do not prove no callable interface.
+- Analysis is offline: no target runtime execution, implicit chain/RPC/explorer
+  lookup, wallet action, transaction broadcast or network request.
+
+## Resource and lifecycle limits
+
+Inputs are limited to 4 MiB, complete replies to 16 MiB and combined diagnostic
+output to 1 MiB. An owned worker has a 256 MiB JavaScript heap, 3 GiB virtual
+address-space limit, 30 CPU seconds and a 30-second command deadline. Virtual
+address space differs from resident memory. The worker retains inherited tighter
+soft/hard limits, reports its configured soft limits inline and leaves hard limits
+unchanged. WASM trap reservations are disabled
+so the engine can run within that virtual limit; actual memory is not equated to
+its 3 GiB allowance. Limits fail without partial success. Stable snapshots,
+private files and owned processes are cleaned independently of caller cancellation.
+Invalid-input, unsupported, cancellation, timeout and malformed-reply failures
+retain bounded stdout/stderr under `details.captured_output`, including whether
+diagnostic output was truncated. Cleanup failures preserve the
+original error projection and any captured output.
+Successful results expose `diagnostics.truncated` from the supervisor as well.
+Excess diagnostic output fails the complete-output contract even when the worker
+has written a valid reply.
+SIGXCPU retains a CPU resource diagnostic and CPU-specific guidance. Observed
+file-size write failures (EFBIG) and SIGXFSZ likewise retain a file-size resource
+diagnostic. Exact signal/write causes remain unknown. Configured
+soft limits are reported separately from unknown effective limits; the received
+signal alone does not establish its exact cause.
+Reserved file-size exits require a matching private marker written by the
+worker's EFBIG branch. Bare launcher exits or unwritable markers retain process
+diagnostics with the resource cause unverified.
+
+Source/metadata, proxy resolution, storage/CFG and fork-explicit execution/traces
+remain separate increments under #972, with materially different result or
+execution authority. This primitive makes no deployment or runtime behavior claim.
+
+The real verification lane traces representative raw/hex CLI workflows and checks
+that only declared Node/prlimit launchers and process ownership inspection run.
+Socket traces permit local stdio socket pairs and reject attempted network requests.
+These observations verify those fixtures; they are not a general network sandbox.
@@ -68,13 +68,18 @@ selects the npm release, and persistent MCP registrations are pinned to the
 version that performed setup. Installing newer instructions does not update a
 running server or its registration.

-The release checked on **2026-10-06** was **4.1.0** (125 MCP tools). That artifact
-includes main's Windows native control bundle, Android/JADX and firmware
-tools, Ghidra function annotation workflow, and retained application-Evidence
-references.
-Main's catalog describes the current code; a source build or a subsequent
-release containing later changes is required for anything newer. Package startup alone does not verify a
-provider's real platform workflow.
+The release checked on **2026-10-07** was **5.0.0** (133 MCP tools), published
+from the fixed checkpoint
+[`b33236ec`](https://github.com/morluto/rea/releases/tag/rea-agents-5.0.0).
+The public CLI, MCP catalog and target-free session, and isolated update from
+4.1.0 to 5.0.0 were verified through npm. The artifact includes Windows native
+controls, Android/JADX and firmware tools, Ghidra function annotations, and
+retained application-Evidence references.
+
+Main's catalog describes the current code. A source build or a subsequent
+release containing changes after this checkpoint is required for newer
+functionality. Package startup alone does not verify a provider's real
+platform workflow.

 To check the published version, run `npm view rea-agents dist-tags.latest`.
 Use the connected server's actual tool list and advertised input schemas for
@@ -90,7 +95,7 @@ npx skills add morluto/rea --skill reverse-engineer-anything

 This installs agent instructions and bundled references, not REA MCP
 registration or analysis engines. Follow the skill's
-[conditional connection guide](https://github.com/morluto/rea/blob/main/skills/reverse-engineer-anything/SKILL.md#connect-only-when-needed).
+[conditional connection guide](https://github.com/morluto/rea/blob/main/skill-src/reverse-engineer-anything/SKILL.md#connect-only-when-needed).
 Working tools can be used immediately. If tools are missing, inspect the current
 client's registration with `doctor --client codex --json` (substitute its client
 ID), then plan repairs with `setup --client codex --dry-run --json`. Show and
@@ -110,7 +115,7 @@ npx -y rea-agents@latest analyze-javascript-application /absolute/path/to/app --
 It returns the complete Evidence record directly and requires no native engine.
 Provider failures in doctor do not prevent unrelated target-free tools. To check
 readiness for one task instead of auditing every integration, see
-[Check readiness for the task at hand](https://github.com/morluto/rea/blob/main/README.md#check-readiness-for-the-task-at-hand).
+[Check readiness for your task](#check-readiness-for-your-task).

 ## Supported agents

@@ -213,12 +218,44 @@ installed REA skill. Run the returned scoped setup command to review and approve
 those changes, then restart affected agents. The plan is returned in terminal,
 non-TTY, and JSON modes without applying configuration changes.

+## Check readiness for your task
+
+Run `rea doctor` when you need diagnosis. It reads host prerequisites and agent
+configuration without changing them. Without options, it audits every detected
+registration, the installed skill and optional analysis engines; its overall
+`healthy` value can be false while your chosen workflow works.
+
+Select the part you want to check:
+
+| Task                                | Readiness check                                                          |
+| ----------------------------------- | ------------------------------------------------------------------------ |
+| Static JavaScript/Electron analysis | Run `rea analyze-javascript-application PATH --json` directly.           |
+| One analysis engine                 | `rea doctor --provider ghidra --json` (or `hopper`, `ida`)               |
+| One agent registration              | `rea doctor --client codex --json` (see [client IDs](#supported-agents)) |
+| Installed workflow instructions     | `rea doctor --skill --json`                                              |
+
+A scoped report has `scope.mode: "explicit"`. Its `scope_checks` determine
+`healthy` and the exit status. Other checks appear in `informational_checks`;
+`environment_healthy` summarizes the full audit. `--target` adds a target check,
+but the report remains audit-wide unless a scope option is also supplied.
+
+Follow the remediation for the failed check. If a native target has several
+available providers, choose one with `--provider` on the CLI or `provider_id`
+on `open_binary`. A `capability_unavailable` failure carries
+`details.selection_reason`: `ambiguous` asks you to choose from
+`details.candidate_ids`, while `provider_unavailable` asks you to repair the
+selected engine. See [provider selection](cli.md#choose-a-provider).
+
 ## Hopper

 Hopper is separate commercial software with its own license. Its free demo has
 vendor-defined limits, and a paid license is optional. REA reuses any detected
 installation and preserves Hopper during uninstall.

+The supported native host baseline is macOS 12+, Ubuntu 24.04+, Fedora 41+,
+64-bit Arch Linux, or CachyOS. Ghidra and IDA have their own provider-specific
+host requirements; Windows Ghidra uses the [experimental P0 boundary](windows-ghidra-p0.md).
+
 On macOS, approved setup downloads the official DMG, checks its published size
 and digest, validates the application bundle, and atomically installs it to
 `~/Applications/Hopper Disassembler.app`. REA then opens Hopper so the
@@ -247,6 +284,40 @@ host mount and the rest of `/tmp` remain unchanged; this fallback never invokes
 `sudo`. `rea doctor --provider hopper --json` reports the selected
 strategy and both host and effective mount facts.

+### Launcher paths and troubleshooting
+
+On macOS, REA uses
+`/Applications/Hopper Disassembler.app/Contents/MacOS/hopper` by default.
+On Linux, it prefers executable `/opt/hopper/bin/Hopper`, then executable
+`~/.local/share/rea/hopper/bin/Hopper`; if neither exists, the former remains
+the diagnostic fallback. `HOPPER_LAUNCHER_PATH` overrides those choices:
+
+```bash
+export HOPPER_LAUNCHER_PATH=/absolute/path/to/Hopper
+rea doctor --provider hopper --json
+```
+
+If a Linux launcher exists but cannot start, inspect its shared libraries:
+
+```bash
+ldd /absolute/path/to/Hopper | grep 'not found'
+```
+
+Install the missing packages and rerun the scoped check. Linux demo sessions
+need Xvfb, Python 3, X11 and XTEST; approved setup installs those dependencies
+on supported distributions. Add the curl installer's reported executable
+directory, commonly `~/.local/bin`, to your shell `PATH` if needed.
+
+REA starts Hopper when needed. On macOS, its launcher can bring a window or
+first-run dialog forward; choose demo mode or activate your existing license.
+Hopper serializes analysis requests. Cancelling a wait can leave provider work
+running, which the session reports. Successful decompilation is cached until
+a relevant rename or comment changes it.
+
+Closing a session shuts down REA's bridge and removes its temporary socket
+directory while preserving the Hopper application. A `cleanup_incomplete`
+result identifies resources whose cleanup could not be verified.
+
 ### Hopper in CI

 REA's unattended Linux path is validated against Hopper's offered demo mode.
@@ -289,7 +360,7 @@ entry comments atomically and returns refreshed analysis. These session metadata
 edits leave executable bytes unchanged and are discarded on close. GUI controls
 require Hopper; Windows P0 remains read-only.

-Windows P0 admits native x86-64 PE applications on fixed local NTFS volumes.
+Windows P0 admits native x86 and x86-64 PE applications on fixed local NTFS volumes.
 The npm package bundles native Job Object ownership, protected private runtime
 DACLs, and handle-based path admission; no separate addon installation is needed.
 See the [Windows Ghidra P0 guide](windows-ghidra-p0.md) for verified scope and
@@ -389,6 +460,17 @@ Ghidra/JDK installation; neither is inferred from startup alone.

 `rea doctor --json` is strictly read-only. `rea update` updates only the npm installation that owns the running CLI. Source checkouts and package-runner copies must be updated through the mechanism that owns them; a fresh package-runner invocation can use `npx rea-agents@latest`. `rea uninstall` removes only REA-owned agent registrations and skill files; `--purge-data` additionally removes REA cache and state paths.

+```bash
+rea update
+rea uninstall
+rea uninstall --purge-data
+```
+
+Uninstall preserves Hopper, Node.js, Evidence files, captures, unrelated skills
+and other MCP servers. Purging removes only REA's cache and state under
+`~/.rea`; malformed client configuration or purge-path symlinks stop the
+operation. See the [CLI guide](cli.md#output-and-exit-status) for exit statuses.
+
 ## MCP Registry

 REA is published in the official MCP Registry as `io.github.morluto/rea`. Registry
@@ -408,7 +490,7 @@ For a client that requires manual configuration, use:
  "mcpServers": {
    "rea": {
      "command": "npx",
-      "args": ["-y", "rea-agents@5.0.0", "mcp"]
+      "args": ["-y", "rea-agents@6.0.0", "mcp"]
    }
  }
 }
@@ -31,6 +31,11 @@ command and the generic route return their complete results inline. Native
 targets, single JavaScript files, `.app` bundles, and explicit deep-provider or
 snapshot requests retain the native deep-analysis route.

+Both CLI routes emit `rea_progress` JSON lines on stderr as inventory, source
+parsing, graph construction, validation, and Evidence hashing begin. Stdout
+remains the selected result document. Completion is reported after Evidence
+creation; a failed analysis retains its typed diagnostic result.
+
 Configure an MCP client with the ordinary REA setup command:

 ```bash
@@ -52,22 +57,65 @@ manifest and graph commitments, JavaScript Application Graph, static
 Electron summary, reconstruction statistics, and explicit limitations. It does
 not require a live Hopper, Ghidra, browser, or Electron process.

+## ASAR integrity
+
+ASAR inventory checks Electron integrity metadata for embedded archive entries
+and supplied `.asar.unpacked` companion files. An integrity failure identifies
+the logical path, declared and calculated SHA-256 values, and whether the entry
+was unpacked. By default, a mismatch is returned as a failure with its artifact
+context. Requests that support `integrity_policy` can explicitly select
+`record-and-continue` to inspect verified siblings while retaining the mismatch.
+
+An unpacked entry whose companion bytes were not supplied remains
+`unavailable`. REA continues analyzing embedded JavaScript and records the
+missing native/resource bytes as unknown. See [what is reconstructed](#what-is-reconstructed)
+for the inventory fields and [MCP integrity handling](mcp-contracts.md#integrity-record-and-continue)
+for the tool-result contract.
+
 ## Large results

+Application analysis projects semantic relationships one source file at a time.
+After projection, it retains only the lexical module facts and exported return
+shapes needed to build application relationships. Full source IR does not stay
+resident for every file together. Callable ownership and contained-reference
+queries use per-file range indexes, while call sites use exact-range lookups.
+Existing node budgets and coverage reporting remain in effect.
+
+Progress identifies the source file being parsed and projected. Cancellation is
+checked between files, with event-loop yields that allow notifications and
+completed file-local allocations to be released. A single file's synchronous
+parser and semantic extraction still need to finish before that boundary.
+
 Graph and Evidence identifiers hash canonical JSON incrementally, without
 assembling a single string for the whole graph. The canonical bytes and existing
 identifiers remain unchanged. The opt-in regression check is
 `npm run verify:javascript:digests`;
 it hashes a value larger than the running Node engine's single-string limit.

-Output formatters and MCP transport serialization still assemble whole strings.
-For a large CLI result, select the needed fields
-before formatting, for example `--format json --filter-output
-evidence_id,normalized_result.statistics`. Complete serialization of a result
-beyond the engine's string limit is not established by this digest check.
-Client framing limits also apply: the pinned Node MCP SDK's stdio transport
-defaults to a 10 MiB buffer. Its caller-selected `maxBufferSize` must accommodate
-the complete response, including text and structured Evidence projections.
+Both application CLI routes stream complete JSON and JSONL output in bounded
+chunks, including field filters and `--full-output`. They wait for each stdout
+write instead of constructing or reparsing a document-sized string. The opt-in
+`npm run verify:javascript:output` checks the actual CLI formatting boundary with
+a temporary output file larger than the running engine's string limit, verifies
+its bytes and digest, and removes it. Use `-- jsonl` for the compact JSONL check.
+Each check needs space for one output file plus a 1 GiB free-space reserve.
+
+Other CLI formats and `--token-count` still assemble whole strings.
+Field selection remains useful when the caller needs a
+smaller view, for example `--format json --filter-output
+evidence_id,normalized_result.statistics`. Streaming output does not bound the
+memory needed to construct the analysis graph itself.
+MCP prepares the complete repeated response incrementally against the pinned
+SDK's 10 MiB stdio receive-buffer budget. Oversized results return an actionable
+transport constraint and the exact same-session Evidence reference. Use
+`trace_application_feature` to inspect a selected module's relationships, or
+`export_evidence_bundle` to write the complete canonical bundle without a
+document-sized allocation. Same-session analysis reads reuse authenticated
+immutable snapshots; foreign inline Evidence is still parsed and authenticated.
+See [MCP tool results](mcp-contracts.md#tool-results) for larger client buffers
+and `REA_MCP_MAX_RESPONSE_BYTES`. Follow-up results remain complete and can also
+exceed the transport budget. Compact result views are tracked separately in
+[#1050](https://github.com/morluto/rea/issues/1050).

 ## What is reconstructed

@@ -193,3 +241,27 @@ paired, ambiguous, and unpaired IPC, validation candidates, utility processes,
 and native binding requests. These fixtures establish parser and artifact-reader
 claims; they do not replace the later operator-supplied real-application
 benchmark.
+
+URI schemes are classified independently of local file names: a reference such
+as `web3:app.js` remains external even when an artifact has that literal name.
+Scheme characters may include digits after the initial letter; a relative path
+such as `./web3:app.js` still names a local artifact.
+
+Package `exports` fallback arrays are supported both at the top level and under
+the root `"."` entry. The resolver selects targets in declared order using the
+same conditional and invalid-entry handling as nested exports arrays.
+
+ESM relative module paths and selected package exports targets use URL suffix handling
+and one percent-decoding pass. CommonJS relative paths and legacy package main
+fields retain literal filename punctuation. Exports targets must start with
+`./` and exclude `.`, `..`, and `node_modules` path segments, including their
+encoded forms, before URL normalization. Arrays skip invalid exports targets
+in declared order; URL decoding and file lookup failures for a selected target
+do not select a later entry. Rejected references retain the package metadata
+path, original target, failed constraint, and importing source location.
+
+HTML script references resolve to exact inventoried files after applying the
+document base and query/fragment rules. CommonJS module lookups retain extension
+and directory resolution.
+Unresolved HTML references retain their declaration, source range, and resolution
+reason in the renderer observations.
@@ -25,7 +25,7 @@ part of the current tool set.

 This guide describes the implementation and verification of
 [ADR-0003](adr/0003-managed-code-evidence-and-provider-boundary.md). The canonical
-tool inventory is [`product-catalog.json`](https://github.com/morluto/rea/blob/main/docs/product-catalog.json).
+tool inventory is the [build-generated catalog](mcp-contracts.md#generated-catalog).

 ## Shipped scope

@@ -125,7 +125,7 @@ The upstream analyzer currently gates its own analysis to x86-64. NativeAOT's
 broader platform matrix does not establish REA coverage: PE/COFF, ELF, Mach-O,
 shared libraries, target architectures, and runtime metadata versions each need
 their own provider verification. REA's experimental Windows Ghidra boundary is
-limited to admitted native x86-64 PE applications, so it does not currently
+limited to admitted native x86 and x86-64 PE applications, so it does not currently
 establish coverage for PE DLLs. Mobile NativeAOT targets should remain
 experimental until REA has a matching provider and package-level verification.

@@ -1,5 +1,15 @@
 # MCP runtime contracts

+## Generated catalog
+
+Run `npm run build:cached` in a source checkout to generate the machine-readable
+catalog at `docs/public/product-catalog.json`. The [catalog](product-catalog.json)
+is also included in documentation builds. PR CI retains it with the packaged
+skill and portable conformance projections in the `generated-docs` artifact.
+These outputs describe the exact source revision being built; they are not
+checked-in snapshots. For a running server, `binary_session` remains the
+authoritative source of catalog identity and tool availability.
+
 ## Identity and discovery

 `binary_session` reports the active package, server, SDK, and negotiated
@@ -13,6 +23,24 @@ are currently unavailable. Opening or closing a target or observing a provider
 health transition leaves that catalog unchanged and does not emit
 `notifications/tools/list_changed`.

+Advertised input and output schemas contain no reachable recursive references.
+The input compatibility profile limits nesting to ten object, array, and
+`anyOf`/`oneOf`/`allOf` levels, following local references per path. Property
+maps, reference definitions, and example data do not add schema levels. Tests
+check the complete catalog after SDK conversion and its generated counterpart.
+This is REA's local compatibility profile; individual model APIs can impose
+additional limits.
+
+For passive `compare_web_captures` inputs, pass each complete
+`inspect_web_page` result in `before.inspection` or `after.inspection`, with an
+optional complete `discover_webmcp_tools` result in the matching `webmcp` field.
+The input schema describes these producer-result objects as round-trip payloads.
+For scenario comparisons, pass complete `capture_browser_scenario` results in
+`before_scenario` and `after_scenario`. REA validates all nested fields with the
+original capture schemas; observation output schemas remain complete. Scenario
+authoring inputs and comparison normalization options retain their full
+advertised structure.
+
 Call `binary_session` with `{}` and read `result.tool_availability` to choose a
 callable operation for the current target, provider, host, and negotiated client
 capabilities. The default result includes the complete inventory with each
@@ -136,6 +164,26 @@ directly to `compare_functions`, and `inspect_artifact` Evidence to
 `compare_artifacts`. Use `get_evidence_bundle` when the task needs broader
 retained session history or an explicit bundle for transfer.

+REA prepares complete MCP results within the pinned stdio client's 10 MiB
+receive-buffer budget, including both text and structured representations and
+room for the JSON-RPC envelope. If a result cannot fit, REA returns
+`resource_constraint` with `details.resource: "transport"` before constructing
+a document-sized string. Analysis Evidence remains complete in the current
+session. Its exact reference is reported in
+`details.reported_limits.evidence_reference`; use it with a focused application
+workflow, or call `export_evidence_bundle` with a destination path. Complete
+bundle exports stream canonical JSON into an atomically published file. A broad
+follow-up or `get_evidence_bundle` can also exceed the response budget; exporting
+preserves the complete session without sending it through a single MCP frame.
+
+Clients that explicitly configure a larger receive buffer can set the REA
+server's `REA_MCP_MAX_RESPONSE_BYTES` environment variable to the same byte
+count. This setting must be a safe decimal integer at least 10485760; REA
+reserves 1024 bytes for the envelope. Raising it restores complete inline
+delivery for responses that fit that buffer and Node's single-string limit.
+It does not change the client's buffer, analysis coverage, or retained content.
+Ordinary responses keep their existing complete result contract.
+
 ## Retained application Evidence inputs

 `trace_application_feature`, `trace_javascript_semantics`,
@@ -12,6 +12,13 @@ input file and include the observed lipo slice offset for universal binaries.
 If that offset is unavailable, segment evidence locations are omitted with an
 explicit limitation; architecture inventory locations remain available.

+- `trace_dylib_resolution` / `rea trace-dylib-resolution <app-or-mach-o>`
+  parses Mach-O load commands in TypeScript and follows dyld's path expansion
+  for every executable in an app bundle, or for one Mach-O within its directory.
+  It reports each `@rpath`, `@loader_path` and `@executable_path` candidate with
+  its outcome. Paths outside the analyzed root, including shared-cache system
+  libraries, stay undetermined. See
+  [Apple application analysis](apple-application-analysis.md#dylib-load-resolution).
 - `inspect_asset_catalog` / `rea inspect-asset-catalog <app>` reads compiled
  `Assets.car` metadata through macOS `assetutil --info`. Catalog digests, raw
  rendition fields, pagination and exact UI resource-name matches are returned.
@@ -159,6 +166,47 @@ owned helper per scenario, removes its temporary compiler cache and stops its
 helper on cancellation. It does not launch or own the selected application. UI
 actions may change application data or trigger network activity.

+## Native call observation
+
+`observe_native_calls` / `rea observe-native-calls <app-or-mach-o> <input-json>`
+launches the active Mach-O as a new, owned process under LLDB. It stops at
+caller-selected entries, records them and continues:
+
+- functions by exact symbol name, optionally limited to one image;
+- Objective-C methods by selector, optionally limited to one class and to
+  instance or class methods.
+
+```sh
+rea observe-native-calls /Applications/Example.app '{"breakpoints":[{"kind":"objc-method","class_name":"NSURLSession","selector":"dataTaskWithRequest:completionHandler:"},{"kind":"function","name":"open","module":"libsystem_kernel.dylib"}],"duration_ms":5000,"backtrace_frames":4}' --json
+```
+
+Each event is an observation: thread, image, symbol, load and file address,
+the raw integer argument registers, optional caller frames and, for an
+Objective-C method, the selector read from `_cmd` and the receiver's dynamic
+class. Breakpoints stop at the symbol itself, so the registers hold the ABI
+arguments. The receiver class comes from LLDB's Objective-C runtime reader
+without running target code; no expression is evaluated, and REA never
+attaches to a process it did not launch.
+
+The run ends when the process exits, `max_events` entries are recorded, or
+`duration_ms` elapses. In the last two cases the process is killed, and REA
+confirms that it is gone. The result reports:
+
+- the outcome, exit status and captured stdout/stderr (1 MiB kept per stream);
+- signal or exception stops;
+- every breakpoint's resolved locations; a breakpoint that matched no loaded
+  code makes coverage partial;
+- limitations.
+
+Only entries are observed: return values, floating-point and stack arguments,
+and inlined or `objc_direct` calls are not. The target runs with the current
+user's permissions and may change files, show UI or use the network.
+
+Debugging must be allowed for the user (Developer Tools access). A
+hardened-runtime target without `com.apple.security.get-task-allow` cannot be
+debugged; `inspect_signature` reports this as the debugger-attach facet, and
+the tool fails with a `debugger-attach-denied` reason.
+
 ## Provider and verification boundaries

 Install a Ghidra 12.1.x release and the 64-bit full JDK it declares, then configure REA to
@@ -30,6 +30,14 @@ different recovery: reinstall REA for the active platform, architecture, and
 Node.js version with optional dependencies enabled. Capability diagnostics
 distinguish this from the Windows capture-adapter limitation.

+macOS also requires Apple's Swift compiler through `xcrun` for process
+ownership inspection. REA compiles its packaged, narrow process-inspection
+helper into a private temporary directory before a capture or owned provider
+process starts; the same prerequisite applies to owned provider-process
+supervision on macOS. REA removes that directory when it exits. REA does not
+install Xcode, Command Line Tools, or other software. Capability checks prepare
+this helper before reporting macOS capture as available.
+
 ## Capture a command

 Write a JSON scenario and pass its path to the CLI:
@@ -94,6 +102,12 @@ run the same owned-process cleanup path. Settlement reports whether the
 sampled process group quiesced or whether cleanup was needed or unverifiable;
 sampling cannot prove that every short-lived or detached descendant was seen.

+When the host withholds an unrelated process’s ownership token, REA leaves that
+process untouched and records its PID and reason in `cleanup.unverified_processes`
+and process residual unknowns. Successful cleanup verifies the owned group;
+it does not attribute those unrelated processes. Related or otherwise unexplained
+unreadable processes still prevent successful cleanup.
+
 ## Compare two captures

 Compare saved capture Evidence with:
@@ -1,684 +0,0 @@
-{
-  "package": {
-    "name": "rea-agents",
-    "version": "5.0.0",
-    "sdk": {
-      "server": "2.3.1",
-      "client": "2.3.1",
-      "core": "2.3.1"
-    },
-    "skill_version": "27"
-  },
-  "tools": {
-    "total": 133,
-    "families": [
-      {
-        "id": "direct",
-        "surface": "official-proxy",
-        "count": 41,
-        "tools": [
-          "address_name",
-          "address_to_file_offset",
-          "annotate_native_function",
-          "comment",
-          "current_address",
-          "current_document",
-          "current_procedure",
-          "goto_address",
-          "inline_comment",
-          "inspect_native_data_type",
-          "inspect_native_instruction",
-          "inspect_native_load_image",
-          "list_bookmarks",
-          "list_documents",
-          "list_names",
-          "list_procedures",
-          "list_segments",
-          "list_strings",
-          "next_address",
-          "prev_address",
-          "procedure_address",
-          "procedure_assembly",
-          "procedure_callees",
-          "procedure_callers",
-          "procedure_info",
-          "procedure_pseudo_code",
-          "procedure_references",
-          "read_bytes",
-          "read_function_instructions",
-          "resolve_containing_procedure",
-          "resolve_native_call_targets",
-          "search_procedures",
-          "search_strings",
-          "set_address_name",
-          "set_addresses_names",
-          "set_bookmark",
-          "set_comment",
-          "set_current_document",
-          "set_inline_comment",
-          "unset_bookmark",
-          "xrefs"
-        ]
-      },
-      {
-        "id": "enhanced",
-        "surface": "enhanced",
-        "count": 14,
-        "tools": [
-          "analyze_function",
-          "analyze_swift_types",
-          "batch_decompile",
-          "binary_overview",
-          "find_xrefs_to_name",
-          "get_call_graph",
-          "get_objc_classes",
-          "get_objc_protocols",
-          "inspect_native_api",
-          "inspect_native_dispatch_metadata",
-          "trace_call_path",
-          "trace_feature",
-          "trace_native_ui_action",
-          "trace_native_values"
-        ]
-      },
-      {
-        "id": "native",
-        "surface": "native-provider",
-        "count": 7,
-        "tools": [
-          "capture_native_ui_scenario",
-          "demangle_swift",
-          "inspect_macho",
-          "inspect_plist",
-          "inspect_signature",
-          "list_architectures",
-          "observe_native_ui"
-        ]
-      },
-      {
-        "id": "artifact",
-        "surface": "artifact-provider",
-        "count": 5,
-        "tools": [
-          "decode_interface_builder",
-          "extract_artifact",
-          "inspect_artifact",
-          "inspect_asset_catalog",
-          "inspect_keyed_archive"
-        ]
-      },
-      {
-        "id": "managed",
-        "surface": "managed",
-        "count": 7,
-        "tools": [
-          "compare_managed_members",
-          "import_managed_reconstruction",
-          "inspect_managed_artifact",
-          "inspect_managed_members",
-          "inspect_managed_native_boundaries",
-          "project_managed_application_graph",
-          "verify_managed_native_boundaries"
-        ]
-      },
-      {
-        "id": "firmware",
-        "surface": "firmware-provider",
-        "count": 2,
-        "tools": ["extract_firmware", "inspect_firmware_regions"]
-      },
-      {
-        "id": "android",
-        "surface": "android-provider",
-        "count": 5,
-        "tools": [
-          "inspect_android_class",
-          "inspect_android_method",
-          "inspect_android_package",
-          "search_android_classes",
-          "trace_android_references"
-        ]
-      },
-      {
-        "id": "browser",
-        "surface": "browser-provider",
-        "count": 11,
-        "tools": [
-          "analyze_web_bundle",
-          "capture_browser_scenario",
-          "capture_web_screenshot",
-          "compare_web_captures",
-          "compare_web_screenshots",
-          "discover_webmcp_tools",
-          "inspect_web_event_listeners",
-          "inspect_web_page",
-          "list_browser_targets",
-          "observe_web_execution",
-          "observe_web_session"
-        ]
-      },
-      {
-        "id": "electron",
-        "surface": "electron-provider",
-        "count": 5,
-        "tools": [
-          "analyze_javascript_application",
-          "capture_electron_scenario",
-          "inspect_electron_page",
-          "list_electron_targets",
-          "reconcile_javascript_runtime"
-        ]
-      },
-      {
-        "id": "javascript-runtime",
-        "surface": "runtime-provider",
-        "count": 2,
-        "tools": [
-          "list_javascript_runtime_targets",
-          "observe_javascript_runtime"
-        ]
-      },
-      {
-        "id": "application",
-        "surface": "application-workflow",
-        "count": 13,
-        "tools": [
-          "build_reconstruction_obligation_ledger",
-          "compare_application_versions",
-          "compare_javascript_export_shapes",
-          "compare_source_to_bundle",
-          "evaluate_reconstruction_coverage",
-          "export_web_scripts",
-          "project_android_application_graph",
-          "project_apple_application_graph",
-          "recover_javascript_sources",
-          "trace_application_feature",
-          "trace_javascript_semantics",
-          "trace_web_module_imports",
-          "trace_web_source_location"
-        ]
-      },
-      {
-        "id": "session",
-        "surface": "session",
-        "count": 21,
-        "tools": [
-          "binary_session",
-          "build_call_path",
-          "capture_process_scenario",
-          "close_binary",
-          "compare_artifacts",
-          "compare_bundles",
-          "compare_functions",
-          "compare_process_captures",
-          "correlate_static_and_runtime",
-          "export_evidence_bundle",
-          "find_changed_behavior",
-          "get_evidence_bundle",
-          "get_navigation_context",
-          "import_evidence_bundle",
-          "inspect_address_context",
-          "list_unknowns",
-          "open_binary",
-          "record_unknown",
-          "update_unknown",
-          "verify_reconstruction",
-          "verify_unknown_resolution"
-        ]
-      }
-    ]
-  },
-  "providers": [
-    {
-      "id": "binwalk",
-      "name": "Binwalk",
-      "version": "3.1.0",
-      "capabilities": ["inspect_firmware_regions"]
-    },
-    {
-      "id": "ghidra",
-      "name": "Ghidra",
-      "version": null,
-      "capabilities": [
-        "address_name",
-        "address_to_file_offset",
-        "analyze_function",
-        "annotate_native_function",
-        "inspect_native_data_type",
-        "inspect_native_instruction",
-        "inspect_native_load_image",
-        "list_documents",
-        "list_names",
-        "list_procedures",
-        "list_segments",
-        "list_strings",
-        "procedure_address",
-        "procedure_assembly",
-        "procedure_callees",
-        "procedure_callers",
-        "procedure_info",
-        "procedure_pseudo_code",
-        "procedure_references",
-        "read_bytes",
-        "read_function_instructions",
-        "resolve_containing_procedure",
-        "resolve_native_call_targets",
-        "search_procedures",
-        "search_strings",
-        "xrefs"
-      ]
-    },
-    {
-      "id": "hopper",
-      "name": "Hopper Disassembler",
-      "version": null,
-      "capabilities": [
-        "address_name",
-        "address_to_file_offset",
-        "analyze_function",
-        "comment",
-        "current_address",
-        "current_document",
-        "current_procedure",
-        "goto_address",
-        "inline_comment",
-        "list_bookmarks",
-        "list_documents",
-        "list_names",
-        "list_procedures",
-        "list_segments",
-        "list_strings",
-        "next_address",
-        "prev_address",
-        "procedure_address",
-        "procedure_assembly",
-        "procedure_callees",
-        "procedure_callers",
-        "procedure_info",
-        "procedure_pseudo_code",
-        "procedure_references",
-        "read_bytes",
-        "read_function_instructions",
-        "resolve_containing_procedure",
-        "search_procedures",
-        "search_strings",
-        "set_address_name",
-        "set_addresses_names",
-        "set_bookmark",
-        "set_comment",
-        "set_current_document",
-        "set_inline_comment",
-        "unset_bookmark",
-        "xrefs"
-      ]
-    },
-    {
-      "id": "ida",
-      "name": "IDA Pro MCP adapter",
-      "version": "1",
-      "capabilities": [
-        "analyze_function",
-        "list_procedures",
-        "list_strings",
-        "procedure_address",
-        "procedure_assembly",
-        "procedure_callees",
-        "procedure_callers",
-        "procedure_pseudo_code",
-        "read_function_instructions",
-        "search_procedures",
-        "search_strings",
-        "xrefs"
-      ]
-    },
-    {
-      "id": "jadx",
-      "name": "JADX headless",
-      "version": "0.7.1",
-      "capabilities": [
-        "inspect_android_class",
-        "inspect_android_method",
-        "inspect_android_package",
-        "search_android_classes",
-        "trace_android_references"
-      ]
-    },
-    {
-      "id": "native-macos",
-      "name": "macOS native inspection utilities",
-      "version": null,
-      "capabilities": [
-        "capture_native_ui_scenario",
-        "demangle_swift",
-        "inspect_macho",
-        "inspect_plist",
-        "inspect_signature",
-        "list_architectures",
-        "observe_native_ui"
-      ]
-    },
-    {
-      "id": "rea-android-application",
-      "name": "REA Android application workflows",
-      "version": "1",
-      "capabilities": ["project_android_application_graph"]
-    },
-    {
-      "id": "rea-apple-application",
-      "name": "REA Apple application workflows",
-      "version": "1",
-      "capabilities": ["project_apple_application_graph"]
-    },
-    {
-      "id": "rea-artifact-graph",
-      "name": "REA safe artifact graph provider",
-      "version": "1",
-      "capabilities": [
-        "decode_interface_builder",
-        "extract_artifact",
-        "inspect_artifact",
-        "inspect_asset_catalog",
-        "inspect_keyed_archive"
-      ]
-    },
-    {
-      "id": "rea-cdp-browser",
-      "name": "REA Chrome DevTools Protocol observation provider",
-      "version": "2",
-      "capabilities": [
-        "analyze_web_bundle",
-        "capture_web_screenshot",
-        "compare_web_captures",
-        "compare_web_screenshots",
-        "discover_webmcp_tools",
-        "inspect_web_event_listeners",
-        "inspect_web_page",
-        "list_browser_targets",
-        "observe_web_execution",
-        "observe_web_session"
-      ]
-    },
-    {
-      "id": "rea-cdp-electron",
-      "name": "REA Electron file-page CDP observation provider",
-      "version": "1",
-      "capabilities": ["inspect_electron_page", "list_electron_targets"]
-    },
-    {
-      "id": "rea-dotnet-static",
-      "name": "REA managed static analysis provider",
-      "version": "1",
-      "capabilities": [
-        "inspect_managed_artifact",
-        "inspect_managed_members",
-        "inspect_managed_native_boundaries"
-      ]
-    },
-    {
-      "id": "rea-dotnet-workflows",
-      "name": "REA managed-code workflows",
-      "version": "1",
-      "capabilities": [
-        "compare_managed_members",
-        "import_managed_reconstruction",
-        "project_managed_application_graph",
-        "verify_managed_native_boundaries"
-      ]
-    },
-    {
-      "id": "rea-javascript-application",
-      "name": "REA JavaScript application analyzer",
-      "version": "1",
-      "capabilities": ["analyze_javascript_application"]
-    },
-    {
-      "id": "rea-javascript-application-workflows",
-      "name": "REA JavaScript application workflows",
-      "version": "1",
-      "capabilities": [
-        "build_reconstruction_obligation_ledger",
-        "compare_application_versions",
-        "compare_javascript_export_shapes",
-        "compare_source_to_bundle",
-        "evaluate_reconstruction_coverage",
-        "trace_application_feature",
-        "trace_javascript_semantics"
-      ]
-    },
-    {
-      "id": "rea-javascript-runtime-reconciliation",
-      "name": "REA JavaScript runtime reconciliation",
-      "version": "1",
-      "capabilities": ["reconcile_javascript_runtime"]
-    },
-    {
-      "id": "rea-playwright-browser-scenario",
-      "name": "REA Playwright browser scenario capture provider",
-      "version": "1",
-      "capabilities": ["capture_browser_scenario"]
-    },
-    {
-      "id": "rea-playwright-electron-active",
-      "name": "REA Playwright active Electron observation provider",
-      "version": "1",
-      "capabilities": ["capture_electron_scenario"]
-    },
-    {
-      "id": "rea-v8-inspector",
-      "name": "REA passive Node/Electron V8 Inspector provider",
-      "version": "1",
-      "capabilities": [
-        "list_javascript_runtime_targets",
-        "observe_javascript_runtime"
-      ]
-    },
-    {
-      "id": "rea-web-script-export",
-      "name": "REA captured script export",
-      "version": "1",
-      "capabilities": [
-        "export_web_scripts",
-        "trace_web_module_imports",
-        "trace_web_source_location"
-      ]
-    },
-    {
-      "id": "unblob",
-      "name": "Unblob",
-      "version": "26.6.4",
-      "capabilities": ["extract_firmware"]
-    },
-    {
-      "id": "wakaru",
-      "name": "Wakaru",
-      "version": "1.13.0",
-      "capabilities": ["recover_javascript_sources"]
-    }
-  ],
-  "setup_clients": [
-    {
-      "id": "claude_code",
-      "display_name": "Claude Code",
-      "format": "json",
-      "configuration": "managed"
-    },
-    {
-      "id": "claude_desktop",
-      "display_name": "Claude Desktop",
-      "format": "json",
-      "configuration": "managed"
-    },
-    {
-      "id": "codex",
-      "display_name": "Codex",
-      "format": "toml",
-      "configuration": "managed"
-    },
-    {
-      "id": "cursor",
-      "display_name": "Cursor",
-      "format": "json",
-      "configuration": "managed"
-    },
-    {
-      "id": "gemini_cli",
-      "display_name": "Gemini CLI",
-      "format": "json",
-      "configuration": "managed"
-    },
-    {
-      "id": "windsurf",
-      "display_name": "Windsurf",
-      "format": "json",
-      "configuration": "managed"
-    },
-    {
-      "id": "devin",
-      "display_name": "Devin",
-      "format": "json",
-      "configuration": "managed"
-    },
-    {
-      "id": "opencode",
-      "display_name": "OpenCode",
-      "format": "opencode",
-      "configuration": "managed"
-    },
-    {
-      "id": "antigravity",
-      "display_name": "Antigravity",
-      "format": "json",
-      "configuration": "managed"
-    },
-    {
-      "id": "copilot_cli",
-      "display_name": "GitHub Copilot CLI",
-      "format": "copilot_cli",
-      "configuration": "managed"
-    },
-    {
-      "id": "commandcode",
-      "display_name": "Command Code",
-      "format": "commandcode",
-      "configuration": "managed"
-    },
-    {
-      "id": "vscode",
-      "display_name": "VS Code",
-      "format": "vscode",
-      "configuration": "managed"
-    }
-  ],
-  "cli": {
-    "primary_count": 88,
-    "commands": [
-      "address-to-file-offset",
-      "analyze",
-      "analyze-javascript-application",
-      "analyze-web-bundle",
-      "annotate-native-function",
-      "build-reconstruction-obligation-ledger",
-      "capabilities",
-      "capture-browser-scenario",
-      "capture-electron-scenario",
-      "capture-native-ui-scenario",
-      "capture-process",
-      "capture-web-screenshot",
-      "compare",
-      "compare-application-versions",
-      "compare-javascript-export-shapes",
-      "compare-managed-members",
-      "compare-process-captures",
-      "compare-source-to-bundle",
-      "compare-web-captures",
-      "compare-web-screenshots",
-      "decode-interface-builder",
-      "decompile",
-      "demangle-swift",
-      "discover-webmcp-tools",
-      "doctor",
-      "evaluate-reconstruction-coverage",
-      "evidence-export",
-      "evidence-import",
-      "export-web-scripts",
-      "extract-artifact",
-      "extract-firmware",
-      "function",
-      "import-managed-reconstruction",
-      "import-reference-source",
-      "inspect",
-      "inspect-android-class",
-      "inspect-android-method",
-      "inspect-android-package",
-      "inspect-artifact",
-      "inspect-asset-catalog",
-      "inspect-electron-page",
-      "inspect-firmware-regions",
-      "inspect-keyed-archive",
-      "inspect-macho",
-      "inspect-managed-artifact",
-      "inspect-managed-members",
-      "inspect-managed-native-boundaries",
-      "inspect-native-api",
-      "inspect-native-data-type",
-      "inspect-native-dispatch-metadata",
-      "inspect-native-instruction",
-      "inspect-native-load-image",
-      "inspect-plist",
-      "inspect-signature",
-      "inspect-web-event-listeners",
-      "inspect-web-page",
-      "instructions",
-      "list-architectures",
-      "list-browser-targets",
-      "list-electron-targets",
-      "list-javascript-runtime-targets",
-      "observe-javascript-runtime",
-      "observe-native-ui",
-      "observe-web-execution",
-      "observe-web-session",
-      "project-android-application-graph",
-      "project-apple-application-graph",
-      "project-managed-application-graph",
-      "providers",
-      "read-bytes",
-      "reconcile-javascript-runtime",
-      "recover-javascript-sources",
-      "resolve-native-call-targets",
-      "search",
-      "search-android-classes",
-      "setup",
-      "trace",
-      "trace-android-references",
-      "trace-application-feature",
-      "trace-javascript-semantics",
-      "trace-native-ui-action",
-      "trace-native-values",
-      "trace-web-module-imports",
-      "trace-web-source-location",
-      "uninstall",
-      "update",
-      "verify-managed-native-boundaries",
-      "xrefs"
-    ],
-    "aliases": [
-      {
-        "name": "compare-bundles",
-        "target": "compare"
-      }
-    ]
-  },
-  "runtime_catalog": {
-    "counts": {
-      "cli_commands": 88,
-      "mcp_tools": 133,
-      "mcp_prompts": 6
-    },
-    "digests": {
-      "tools_sha256": "af7fe81ec689c2a77f04579b6f4beb4abe86aa71d49c4844d8e0f4d7ed7a3a1e",
-      "prompts_sha256": "ef2de8814390b340623c32001610aa2709d90bed51537b6e562ab3abf144ab4d",
-      "combined_sha256": "83b4c3445ed0ec003c0aeefa3188f123d9ae319484f8b1e2b611d2fe278c9c72",
-      "providers_sha256": "aea15f517c822d80918ccaba57a4fa06557f484cf27b8acbaed4e1a660fac896"
-    }
-  }
-}
@@ -18,7 +18,7 @@ comments atomically, verifies readback, and returns refreshed function analysis.
 Changes live only in the session database and leave executable bytes unchanged.
 Ghidra does not expose GUI controls; Windows P0 remains read-only.

-Windows x64 P0 supports native x86-64 PE applications on local NTFS with
+Windows x64 P0 supports native x86 and x86-64 PE applications on local NTFS with
 bundled Job Object ownership, protected runtime DACLs, and handle-based path
 admission. Real ordinary-user verification covers all 25 read-only operations
 through the packaged CLI and MCP, target integrity, and cleanup. This remains
@@ -49,8 +49,8 @@ follow.
 - Report GUI cursor/navigation and persistent mutation operations as unavailable
  until their semantics and project ownership are explicitly designed.
 - Verify real claims on Linux with at least two distinct source-owned binaries.
-  Verify the Windows host claim with the deterministic source-owned x86-64 PE
-  fixture and all admitted operations; compare normalized semantic facts rather
+  Verify the Windows host claim with the deterministic source-owned x86 and x86-64 PE
+  fixtures and all admitted operations; compare normalized semantic facts rather
  than provider-specific pseudocode text.

 ## Shipped foundation boundary
@@ -62,7 +62,7 @@ maximum, when the release leaves those at the 12.1 defaults). Otherwise doctor
 probes `java`/`javac` or `java.exe`/`javac.exe` from `PATH`. Supported Linux and macOS
 hosts accept compatible ELF, PE, and Mach-O executable targets. Host admission
 and target compatibility are separate checks. Windows x64 P0 admits only native,
-non-managed, non-DLL x86-64 PE applications on fixed local NTFS, with the packaged
+non-managed, non-DLL x86 and x86-64 PE applications on fixed local NTFS, with the packaged
 native authority available before launch.

 The launcher creates one ephemeral runtime root with project,
@@ -136,7 +136,7 @@ Mach-O target coverage. It requires `clang`, LLD, and `lld-link`; set
 these tools before compilation. Keeping this matrix separate lets Linux
 host/provider acceptance run with only the host compiler.

-`npm run verify:ghidra:windows` checks the source-owned native x86-64 PE
+`npm run verify:ghidra:windows` and its `-- --x86` variant check the source-owned native x86 and x86-64 PE
 fixture, all 25 read-only operations, target/snapshot/import SHA-256 linkage,
 and project, endpoint, process, and runtime cleanup. The independent native
 lane checks DACLs, handle admission, cancellation, and Job Object lifecycle.
@@ -165,12 +165,12 @@ only the generic process mechanisms.

 ## Shortlist

-| Provider                                                                                    | License / automation surface                                                                                                                                           | What it brings                                                                                                                                          | REA fit and blockers                                                                                                                                                                                                                                                                                                                                                                                                                |
-| ------------------------------------------------------------------------------------------- | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------- | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
-| [Ghidra](https://github.com/NationalSecurityAgency/ghidra)                                  | Apache-2.0 source license; `analyzeHeadless`, Java APIs, and PyGhidra                                                                                                  | Static analysis, multiple processors and formats, scripting, and project/database workflows                                                             | 25 read-only operations shipped on Linux/macOS with installation checks, temporary projects, a serial API queue, and real ELF/PE/Mach-O conformance. Experimental Windows x64 P0 supports native x86-64 PE on local NTFS with bundled native controls and ordinary-user CLI/MCP verification; Linux/macOS additionally support atomic session function annotations; Windows mutation and all Ghidra GUI operations are unavailable. |
-| [Rizin](https://github.com/rizinorg/rizin) / [rz-pipe](https://github.com/rizinorg/rz-pipe) | Rizin repository contains LGPL-3.0 and GPL-3.0 components; `rizin`, `rz-bin`, and language bridges through `rzpipe`                                                    | Portable CLI analysis, disassembly/debugging, many architectures and file formats, JSON command output                                                  | Good candidate for a process-backed Linux provider and fast metadata fallback. License/component inventory must be preserved; command output needs version-pinned parsers and semantic conformance before evidence is trusted.                                                                                                                                                                                                      |
-| [LIEF](https://github.com/lief-project/LIEF)                                                | Apache-2.0; C++, Python, and other bindings                                                                                                                            | Deterministic parsing and modification of ELF, PE, Mach-O, COFF, and related executable formats; headers, sections, symbols, relocations, and functions | Best near-term complement, not a decompiler replacement. It can cover format metadata and artifact evidence without a long-lived analysis process; function semantics, pseudocode, CFG, and cross-reference parity remain out of scope unless separately demonstrated.                                                                                                                                                              |
-| [Binary Ninja](https://docs.binary.ninja/dev/index.html)                                    | API/documentation components are MIT, while the analysis product is licensed by edition; commercial, Ultimate, or Headless license is required for headless automation | Python/Core/C++/Rust APIs, headless loading, IL layers, function analysis, plugins, and configurable analysis                                           | Strong technical fit for a native provider, especially function dossiers. Commercial licensing, license-secret handling, native runtime packaging, and multithreaded lifecycle rules are material deployment blockers.                                                                                                                                                                                                              |
+| Provider                                                                                    | License / automation surface                                                                                                                                           | What it brings                                                                                                                                          | REA fit and blockers                                                                                                                                                                                                                                                                                                                                                                                                                        |
+| ------------------------------------------------------------------------------------------- | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
+| [Ghidra](https://github.com/NationalSecurityAgency/ghidra)                                  | Apache-2.0 source license; `analyzeHeadless`, Java APIs, and PyGhidra                                                                                                  | Static analysis, multiple processors and formats, scripting, and project/database workflows                                                             | 25 read-only operations shipped on Linux/macOS with installation checks, temporary projects, a serial API queue, and real ELF/PE/Mach-O conformance. Experimental Windows x64 P0 supports native x86 and x86-64 PE on local NTFS with bundled native controls and ordinary-user CLI/MCP verification; Linux/macOS additionally support atomic session function annotations; Windows mutation and all Ghidra GUI operations are unavailable. |
+| [Rizin](https://github.com/rizinorg/rizin) / [rz-pipe](https://github.com/rizinorg/rz-pipe) | Rizin repository contains LGPL-3.0 and GPL-3.0 components; `rizin`, `rz-bin`, and language bridges through `rzpipe`                                                    | Portable CLI analysis, disassembly/debugging, many architectures and file formats, JSON command output                                                  | Good candidate for a process-backed Linux provider and fast metadata fallback. License/component inventory must be preserved; command output needs version-pinned parsers and semantic conformance before evidence is trusted.                                                                                                                                                                                                              |
+| [LIEF](https://github.com/lief-project/LIEF)                                                | Apache-2.0; C++, Python, and other bindings                                                                                                                            | Deterministic parsing and modification of ELF, PE, Mach-O, COFF, and related executable formats; headers, sections, symbols, relocations, and functions | Best near-term complement, not a decompiler replacement. It can cover format metadata and artifact evidence without a long-lived analysis process; function semantics, pseudocode, CFG, and cross-reference parity remain out of scope unless separately demonstrated.                                                                                                                                                                      |
+| [Binary Ninja](https://docs.binary.ninja/dev/index.html)                                    | API/documentation components are MIT, while the analysis product is licensed by edition; commercial, Ultimate, or Headless license is required for headless automation | Python/Core/C++/Rust APIs, headless loading, IL layers, function analysis, plugins, and configurable analysis                                           | Strong technical fit for a native provider, especially function dossiers. Commercial licensing, license-secret handling, native runtime packaging, and multithreaded lifecycle rules are material deployment blockers.                                                                                                                                                                                                                      |

 ## Recommended order

@@ -0,0 +1,88 @@
+# Recorded crash evidence
+
+`inspect_recorded_crash` / `rea inspect-recorded-crash` inspect a caller-selected
+Linux ELF64 x86-64 little-endian core independently of an active binary target.
+
+```sh
+export REA_PWNTOOLS_PYTHON=/absolute/existing/venv/bin/python
+rea inspect-recorded-crash ./crash.core --json
+```
+
+The selected Python needs unchanged pwntools 4.15.0, pyelftools 0.33 and Unicorn 2.1.2.
+REA does not install these dependencies. ELFFile/its original ELF structures and
+pwntools' original Linux amd64 ctypes provide parsing and ABI layout. The adapter
+adds bounds, representation preservation and lifecycle ownership.
+The initial Linux note profile accepts System V/unspecified and GNU/Linux OSABI
+with ABI version zero. Other declared ABIs return `unsupported_target` before
+note interpretation; an unspecified OSABI alone does not prove OS origin.
+
+## Recorded observations
+
+- Artifact path, original SHA-256 and size; full normalized result and Evidence
+  are inline through CLI and MCP.
+- Original program headers and recorded segment file/memory ranges. Undumped
+  memory and current executable/library identity remain unknown.
+- Every note's original identity, owner/descriptor bytes and source ranges,
+  including unfamiliar owners and note kinds.
+- Every exact Linux CORE PRSTATUS note as a separate recorded thread, with
+  historical PID, signal and lossless uint64 registers bound to source bytes.
+  Each supported note has exactly one interpretation; each thread contains the
+  complete 27-register ABI set, with names bound to their original ABI offsets.
+  Physical note ranges cannot overlap or leave segment gaps. ELF and note headers
+  are independently bound to the snapshot, including extended program counts.
+- Signed SIGINFO number/code/errno. Initially only SIGSEGV codes 1/2 establish the
+  fault-address union; other variants retain raw bytes and unknown meaning.
+
+Historical PIDs are metadata. They never select a live process or authorize
+attach/control. Missing notes do not establish absence at the crash; note
+interpretation completeness and signal-thread association remain unknown.
+
+## Optional debugger mapping context
+
+```sh
+export REA_PWNDBG_GDB=/absolute/existing/gdb
+export REA_PWNDBG_GDBINIT=/absolute/unchanged/pwndbg/gdbinit.py
+export REA_PWNDBG_VENV_PATH=/absolute/existing/pwndbg-venv
+rea inspect-recorded-crash ./crash.core --debugger-context --json
+```
+
+MCP uses `{ "path": "/artifacts/crash.core", "include_debugger_context": true }`.
+Omitting this meaningful facet requests only recorded evidence. Requested but
+unavailable context returns an actionable failure; it never silently claims
+debugger coverage. GDB defaults to `/usr/bin/gdb`; the plugin and virtual
+environment require explicit absolute paths. Initial local verification covers
+Linux x64, GDB 13.1 and unchanged pwndbg 2026.09.15.
+
+The outer provider owns both processes and one stable core snapshot. An owned
+Python launcher lowers inherited soft limits before replacing itself with GDB.
+GDB starts without initfiles, auto-load, debuginfod or automatic shared-library
+loading. Owned empty library search paths and caches are used, with plugin
+updates disabled. Fixed package code verifies a core connection and no paired
+executable before querying mapping candidates. No caller GDB command language is
+exposed. The exact observed GDB/plugin version strings are retained.
+
+Mapping names are producer display metadata, with unknown current file identity.
+Map permissions are derived from reported flags; zero/unfamiliar flags leave
+permissions unknown. These maps do not establish page contents or an executable
+match. Core source bytes remain available independently of this enrichment.
+An Evidence envelope containing these maps is `derived`; inspection without
+debugger context is `observed`.
+
+## Bounds and verification
+
+Initial Linux x64 limits: 32 MiB input, 64 MiB decoder reply, 1 MiB diagnostics per
+stage, 30 seconds owned wall deadline per stage, 3 GiB address-space soft ceiling
+and 30 seconds CPU soft ceiling. Tighter inherited soft/hard limits are retained;
+hard limits are not raised. Complete oversized results fail explicitly. These
+process limits do not constitute a sandbox for caller-supplied engine code.
+
+Resource exit statuses need matching private failure-branch markers. Unmarked
+launcher failures retain their actual status/output and unknown resource cause.
+Cancellation, output truncation and independent owned cleanup remain explicit.
+
+`npm run verify:recorded:crash` uses source-owned fixtures and caller-supplied
+GDB/Python/pwndbg/strace. Fixture generation explicitly launches its owned test
+program; subsequent inspection only reads the resulting core. Real acceptance
+checks recorded threads, high registers, missing/malformed notes, opaque owners,
+CLI/MCP parity, optional debugger context and historical PID collision with an
+owned live sentinel. Original inputs and host configuration remain unchanged.
@@ -1,16 +1,42 @@
 # Releasing from a checkpoint

-REA releases use a frozen source checkpoint. Main can continue accepting
+REA releases use an explicit source checkpoint. Main can continue accepting
 changes while a release is tested and published. The Release workflow runs
-on `release/*` branches; main pushes do not refresh release PRs.
+only when a maintainer dispatches it; main pushes do not refresh release PRs.

-## 1. Cut the release branch
+## 1. Select the source

 Choose the next version from the unreleased Conventional Commits, including
 breaking changes. Record the full source SHA and create `release/VERSION` at
 that commit. The version is a maintainer choice; Release Please's proposed
 version must agree before publication.

+`release/VERSION` also sets the expected version for the workflow. Use an exact
+SemVer such as `release/6.1.0` or `release/6.1.0-rc.1`, without build metadata.
+The checkpoint validator rejects a candidate whose package, lockfile, manifest,
+registry metadata or changelog disagrees with that version before creating a tag.
+
+### Compatibility and version selection
+
+REA uses the default SemVer strategy: compatible fixes increment patch;
+compatible capabilities increment minor; incompatible public behavior increments
+major. Adding tools, internal refactoring and correcting behavior outside the
+supported contract do not by themselves require a major release.
+
+The supported public surface includes documented CLI commands/options, MCP tool
+names and input/result contracts, saved evidence formats and supported runtime
+requirements. Before adding `!` or a `BREAKING CHANGE` footer, a PR must identify
+a previously valid call or configuration that will fail or change meaning,
+explain why compatibility cannot be preserved, and give its migration. Prefer
+optional additions, compatibility adapters and a documented deprecation period;
+group deliberate removals into a planned major release. Maintainers review this
+impact before merging; the bot parses markers and cannot infer compatibility.
+
+For example, adding an optional inspection tool is a minor change. Rejecting a
+relative MCP path previously accepted by the public contract is breaking;
+rejecting an input that the existing contract already prohibited is a fix.
+Changing the version number alone does not restore compatibility.
+
 For example, after selecting a reviewed commit for 5.0.0:

 ```bash
@@ -25,43 +51,76 @@ older checkpoint, backport only the release infrastructure first and record
 that additional commit. Do not merge later implementation changes into the
 release branch or rebase the candidate onto a moving main.

-The branch push runs Release Please against that branch and opens a PR for
-the version, changelog, and registry metadata. The generation step normalizes
-the product catalog. To retry preparation after a failed run, select the same
-frozen branch explicitly:
+## 2. Prepare the bot PR
+
+Run the workflow definition from main and select the frozen source separately:

 ```bash
-gh workflow run release.yml --ref release/5.0.0
+gh workflow run release.yml --ref main \
+  -f release_branch=release/5.0.0 -f phase=prepare
 ```

-## 2. Review and merge the bot PR
+Release Please targets that branch and prepares its version, changelog, and
+registry metadata. The workflow uses an optional `RELEASE_PLEASE_TOKEN`
+repository secret and otherwise uses the built-in `GITHUB_TOKEN`. A dedicated
+GitHub App or personal access token can start PR CI automatically. With the
+built-in token, `opened`, `synchronize`, and `reopened` PR events create runs
+that require a maintainer with write access to approve them. See
+[GitHub's workflow trigger documentation](https://docs.github.com/en/actions/how-tos/write-workflows/choose-when-workflows-run/trigger-a-workflow).

-Record the final bot PR head after normalization. Approve GitHub-blocked bot
-workflow runs for that head when needed. Review the candidate's version,
-notes, generated metadata, and package contents. Wait for the candidate's CI
-and relevant real-provider checks. Routine local iterations need focused
-checks; CI owns full deterministic coverage and platform lanes. If an artifact
-or real-provider check is unavailable, report that limit before deciding to
-publish.
+The generation step normalizes the product catalog. Preparation cannot create
+a GitHub release or publish a package. Record the final bot PR head after
+normalization, then approve that head's blocked runs from the PR page. Updates
+to the bot branch can create new approval-required runs; approval of an older
+head does not verify the normalized candidate. Wait for the final head's CI.

-Merge the reviewed PR into `release/5.0.0` with its head SHA matched. **This
-merge authorizes and triggers publication.** Further main commits do not change
-this candidate. Do not push or merge anything else into the release branch
-while publication is running. A necessary release fix must be reviewed and
-tested before the bot PR merges and establishes a new recorded checkpoint.
+The validator reads the actual ancestry range from the published baseline tag
+to the selected checkpoint, including visible first-parent Conventional Commits
+and the PR titles in GitHub's default merge messages. The report preserves the
+original merge subject alongside the extracted Conventional Commit title.
+This matters after merging a side-branch release back into a newer main:
+Release Please's chronological history cutoff can omit unreleased mainline
+commits. Unreleased breaking markers require a major increment and references
+in the new release's breaking-change migration section. Other omitted entries
+are reported for review. Historical notes from an older release cannot satisfy
+the new release's migration check. This audits declared markers and references;
+it does not prove API compatibility or the quality of a migration explanation.

-## 3. Verify publication
+If preparation reports a mismatch or omitted breaking changes, inspect the
+recorded ancestry report, correct the release PR's version artifacts and notes,
+regenerate documentation, and review/test its final head. Do not repeatedly
+prepare over manual corrections. Publication independently checks the merged
+candidate again before Release Please can create a tag.

-The merge push runs Release Please again, creates the tag and GitHub release,
-and publishes npm followed by MCP Registry metadata. Both publishers check
-out Release Please's exact release SHA. The triggering workflow also runs
-from that release commit so npm's provenance records the actual source.
+Review the candidate's version, notes, generated metadata, and package
+contents. Wait for the candidate's CI and relevant real-provider checks.
+Routine local iterations need focused checks; CI owns full deterministic
+coverage and platform lanes. If an artifact or real-provider check is
+unavailable, report that limit before deciding to publish.

-Before invoking Release Please, the workflow checks that the release branch
-still equals the triggering SHA and rejects main or tag refs. Before either
-registry publish, it rejects a mismatch between the tagged release SHA and
-the triggering SHA. These checks detect moved branches; maintainers must also
-keep the release branch frozen throughout publication.
+Merge the reviewed PR into `release/5.0.0` with its head SHA matched. Further
+main commits do not change this candidate. A necessary release fix belongs
+on the release branch, must be reviewed and tested, and establishes a new
+recorded checkpoint.
+
+## 3. Publish the reviewed merge
+
+After the release PR has merged:
+
+```bash
+gh workflow run release.yml --ref release/5.0.0 \
+  -f release_branch=release/5.0.0 -f phase=publish
+```
+
+Publication creates the release from the merged bot PR without preparing or
+updating another PR. Both npm and MCP Registry jobs check out Release Please's
+exact release SHA. They do not build the current main tip or a mutable branch.
+The publish dispatch runs from the frozen release branch so npm's provenance
+records the actual release commit. Before Release Please creates a tag, the
+workflow accepts only `prepare` or `publish` and requires the selected branch
+tip to equal the dispatch SHA. Registry jobs run only during `publish`. After
+a tag exists, a mismatch between that tag's SHA and the dispatch SHA stops
+both registry publishes.
 See [npm's provenance implementation](https://github.com/npm/cli/blob/v11.16.0/workspaces/libnpmpublish/lib/provenance.js)
 for the use of GitHub's workflow ref and commit SHA.

@@ -78,16 +137,38 @@ Record these outcomes separately:

 A GitHub tag alone does not establish npm or MCP Registry publication.

-## Sync metadata back to main
+## 4. Sync metadata back to main
+
+Post-release synchronization is part of completing the release. Finish it
+before cutting the next checkpoint; otherwise main retains the previous
+release baseline and can propose an already-published version again.

 After publication, open a PR from the release branch back to main. Preserve
-main's later implementation changes and resolve generated-file conflicts by
-regenerating from the combined contracts with the released package version.
+main's later implementation changes and regenerate ignored build outputs from
+the combined contracts with the released package version.
 Review and test this synchronization PR, then use a merge commit so the release
 tag remains in main's ancestry. Keep the released tag unchanged.

+The synchronization must include `.release-please-manifest.json`,
+`package.json`, both root versions in `package-lock.json`, `CHANGELOG.md`,
+`server.json`, and the versioned documentation examples. Run
+`npm run docs:generate`, `npm run docs:check`, and the release configuration
+tests against the combined tree. After the merge, verify that the released
+tag is an ancestor of main:
+
+```bash
+git fetch origin main --tags
+git merge-base --is-ancestor rea-agents-5.0.0 origin/main
+```
+
 Close any superseded rolling release PR. Future releases repeat the checkpoint
 procedure from main; never resume automatic release-PR refreshes on main pushes.
+Preparation generates and validates the catalog, portable conformance
+projections, and packaged skill from the candidate checkout without committing
+them. The checkpoint validator binds tracked version authority to the source
+SHA; generated-catalog and package checks validate the derived representation.
+No generated-metadata workflow pushes follow-up commits onto feature or release
+branches.

 ## Partial publication and retries

@@ -97,7 +178,8 @@ publishing it again. Re-run failed jobs in the original publication run so its
 release SHA and outputs stay fixed. If only MCP publication failed, retry that
 job after checking that the npm canary succeeded.

-Do not start a fresh workflow run to repair an already-created release:
-Release Please will not create the same release again. Do not move the tag,
-delete the release, or unpublish npm as a retry. A defective public package
-requires a reviewed correction and a new version.
+A branch tip that moved after dispatch fails before Release Please creates a
+tag. Do not dispatch a fresh publish phase to repair an already-created
+release: Release Please will not create the same release again. Do not move
+the tag, delete the release, or unpublish npm as a retry. A defective public
+package requires a reviewed correction and a new version.
@@ -20,6 +20,30 @@ validation, provider prerequisites, target identity, cancellation, and owned
 resource cleanup remain part of each tool's contract. Setup still discloses
 installation changes and requires approval before writing or installing.

+## Planned work
+
+The [website guides](https://morluto.github.io/rea/guides/) and
+[generated catalog](product-catalog.json) describe available workflows.
+Current development priorities are:
+
+- Keep generated metadata and narrative documentation aligned with tools,
+  providers, setup options and releases.
+- Expand native architecture, type and indirect-call verification across
+  Hopper and Ghidra.
+- Connect additional static extractors and runtime observations to
+  cross-layer feature traces.
+- Improve obfuscated .NET comparisons and links between managed findings
+  and verified native analysis.
+- Extend process, protocol, filesystem, reconnect and build-comparison
+  coverage, plus browser and Electron scenario actions.
+- Evaluate native runtime observation through LLDB, Frida, system logs and
+  API tracing, and additional tools and targets such as Binary Ninja, Rizin,
+  LIEF, Windows-native workflows, mobile applications and firmware.
+
+Provider additions and platform support require the corresponding real
+verification lanes; see [testing](testing.md) and
+[provider evaluation](provider-evaluation.md).
+
 ## Remaining evidence and provider work

 The [platform roadmap](https://github.com/morluto/rea/issues/32),
@@ -62,7 +86,7 @@ Mach-O cross-target fixtures. See [testing](testing.md) for the prerequisites
 and exact commands.

 Experimental Windows x64 P0 now supplies bundled Job Object ownership,
-protected runtime DACLs, and handle-based admission for native x86-64 PE
+protected runtime DACLs, and handle-based admission for native x86 and x86-64 PE
 applications on local NTFS. Real ordinary-user CLI/MCP verification covers
 all 25 read-only operations and cleanup. The [Windows P0 guide](windows-ghidra-p0.md)
 describes this boundary and unverified broader coverage.
@@ -6,10 +6,27 @@ from real captured inputs. Keep focused module tests for distinct failure or
 semantic cases that these workflows cannot reliably reproduce. A test's path
 or suite name does not establish its behavioral depth.

+Avoid tests that mirror getters, enum mappings, fixture helpers, or prescribed
+call sequences. Prefer one representative workflow over a Cartesian matrix
+when every row crosses the same boundary. Keep distinct command handlers,
+producer representations, failure reasons, and lifecycle states covered.
+Consolidate their shared setup without hiding the inputs or expected evidence.
+
 Tests are grouped into Vitest projects so ownership, allowed dependencies and
-runtime cost are visible from their paths. Before pruning a test, identify the
-replacement scenario and its assertions; passing success journeys do not
-replace malformed input, cancellation, permission or cleanup coverage.
+runtime cost are visible from their paths. Before pruning a distinct boundary
+regression, identify the replacement scenario and its assertions; passing
+success journeys do not replace malformed input, cancellation, permission or
+cleanup coverage. Trivial helper checks do not need a replacement. If only
+tests consume a production module, trace CLI/MCP and verifier imports,
+including imports of compiled files, and remove abandoned scaffolding with its
+tests when it has no runtime consumer.
+
+Measure slow files before removing capacity regressions. Optimize repeated
+process startup, fixture construction, and production algorithms when they
+dominate runtime. Keep at least one input beyond each formerly failing size or
+depth; smaller fixtures do not establish that truncation or stack exhaustion
+has been fixed. Record the toolchain, coverage mode, and cache conditions when
+comparing durations.

 ## Behavioral depths

@@ -81,13 +98,28 @@ an XML graph golden. `verify:asset-catalog` compiles source-owned colors with
 `actool`, invokes real `assetutil`, then checks CLI/MCP results, exact catalog
 digest, every raw metadata field, pagination and malformed input rejection.
 Neither artifact workflow requires Hopper or launches it. Both run in macOS CI.
+`verify:dyld-shared-cache` reads the host's dyld shared cache. It checks that
+the image list, and every image's dependencies with their attributes, equal
+`dyld_info -all_dyld_cache -linked_dylibs`, and that `inspect-dyld-shared-cache`
+agrees between CLI and stdio MCP. It then traces the clang-built fixture app
+with `--shared-cache` and checks that every `shared-cache` edge names a library
+dyld actually loads under `DYLD_PRINT_LIBRARIES`.
 `verify:macos-bundle` needs only macOS with Command Line Tools. It compiles a
 source-owned app with `clang`: a versioned framework, XPC services, an app
 extension, a login item, a privileged helper, launchd plists, and a helper tool,
 signed ad hoc. It packs the app as a directory, a `ditto` ZIP, and an APFS DMG,
 then checks that `inspect-artifact` plus `project-apple-application-graph`
 report the same bundle anatomy for all three through the CLI, with stdio MCP
-parity. It also checks that the DMG is detached afterwards. It runs in macOS CI.
+parity. It also checks that the DMG is detached afterwards. The same app
+covers `trace-dylib-resolution`:
+
+- each resolution status and finding, with CLI/MCP parity;
+- for every traced image, dependencies, rpaths, and install names equal to
+  `otool -l`;
+- for the main executable and an XPC service, a predicted load order equal to
+  the images dyld actually loads under `DYLD_PRINT_LIBRARIES`.
+
+It runs in macOS CI.

 Apple artifact verifiers live in `scripts/verify/apple/`, with the macOS bundle
 builder under `scripts/fixtures/apple/` and NIB byte fixtures beside the decoder
@@ -103,6 +135,15 @@ names remain unchanged.
 The existing Apple CI job also runs the host Swift-demangling CLI/MCP regression
 suites, including option-like symbols, carriage returns and multiline rejection.

+Process semantics/tests live in `src/domain/process/`; PTY capture implementation
+and forked helper tests live in `src/process/capture/`. Evidence projection and
+file workflows live in `src/application/process/`; producer-backed Evidence/host
+cases run in the serial `tests/boundary/process/` lane. Installed-package probes
+load the compiled capture capability owner, including the missing-optional-module
+case. Real capture tests preserve actual descendant and cleanup checks.
+The existing Apple job also exercises the relocated filesystem snapshot identity,
+cancellation and descriptor cleanup regressions on macOS.
+
 MCP SDK transport tests with recording providers remain integration tests.
 They are useful for schema drift and failure projection but do not prove that
 Hopper, Ghidra or another substituted engine works. `verify:package` proves
@@ -171,7 +212,7 @@ prove behavior on the verified Ghidra 12.1.4 and JDK 21 build.
 | `npm run verify:ghidra:switch`             | Linux x64 ELF; GCC/Clang optimized and stripped switch fixtures                    | GCC, Clang, GNU nm/objdump/strip, Ghidra 12.1.4, and full JDK 21    |
 | `npm run verify:ghidra:aarch64-jump-table` | Any supported Ghidra host; AArch64 ELF; byte/halfword tables; host ARM64 Mach-O    | Clang with AArch64 target support, Ghidra 12.1.4, and full JDK 21   |
 | `npm run verify:ghidra:cross-format`       | Any supported Ghidra host; also analyzes AArch64 ELF, x86-64 PE, and x86-64 Mach-O | `clang`, LLD, and `lld-link` in addition to host-lane prerequisites |
-| `npm run verify:ghidra:windows`            | Controlled Windows x64 with native x86-64 PE                                       | Ghidra 12.1.4, full JDK 21, and the matching native artifact        |
+| `npm run verify:ghidra:windows`            | Controlled Windows x64 with native x86-64 PE; `-- --x86` selects native x86 PE     | Ghidra 12.1.4, full JDK 21, and the matching native artifact        |

 Windows native conformance runs with `npm run verify:windows-native` and does
 not require Ghidra or Java. An optional independently compiled Windows fixture
@@ -390,7 +431,7 @@ behavior, and complete CI evidence before merging.
 | `npm run test:watch:all`          | Changed tests from every project; builds at startup, so rebuild after production edits before relying on compiled tests |
 | `npm run check:changed`           | Cached typecheck/lint and branch-related source feedback                                                                |
 | `npm run check:pr`                | Opt-in complete local deterministic gate and generated-file checks                                                      |
-| `npm run docs:check`              | Committed generated-document freshness                                                                                  |
+| `npm run docs:check`              | Generated-document validation from current source and build outputs                                                     |

 For example:

@@ -425,19 +466,21 @@ broad changes or diagnosing CI, rather than after every edit. Package/install
 changes additionally need package verification; provider changes need actual
 provider evidence.

-Local full-suite Vitest runs use up to two workers and schedule projects one
-at a time. Process, acceptance and process-global projects serialize their
-files to prevent competing lifecycle observations. CI retains its two-worker
-budget.
+Each Vitest project uses up to two workers, bounded by available host parallelism.
+Default-group projects can run together. Only `process-boundary` runs in the
+later sequence group and serializes its files because process-tree observations
+share host sampling resources. Acceptance and process-global files retain isolated
+forks but are not serialized; isolation does not imply serial scheduling. CI uses
+the same per-project worker bound.
 The pure domain/contracts and recording-port service projects share one worker
 module context because their tests own no mutable runtime resources. MCP
 boundary files also share the immutable server module graph while creating and
 closing independent in-memory sessions. Adapter, composition, acceptance,
 process-global, and other boundary projects retain per-file isolation.
-`npm test`, `npm run docs:check`, and `npm run docs:generate` share
-repository-local locks and fail fast when the same class of command is already
-running. The `npm test` build is inside that lock. `check:pr` runs its test task
-before starting generated-document validation.
+Build and documentation writers use checkout-local locks for their respective
+output files. `npm test` delegates its build to the build lock; the Vitest suite
+does not hold a test-command lock. `check:pr` runs its test task before starting
+generated-document validation.

 Vitest and Node persistent compile caches are deliberately not enabled by
 default. To evaluate repeated local runs, opt in for both cold and warm
@@ -494,6 +537,17 @@ conformance/vtable fixture.
  `positive_e2e: false`; it must not be reported as capture/action proof.
  Both commands reject a changed executable digest and clean up the fixture
  process and helper. These lanes require an interactive macOS desktop. See [native investigation](native-investigation.md)
+
+`npm run verify:native-calls` needs only macOS with Command Line Tools (`clang`,
+`lldb`, `codesign`, `nm`). It compiles `tests/conformance/native/calls.m` and
+runs `observe-native-calls` through the CLI and stdio MCP. It checks:
+
+- the receiver class, selector and argument registers of every entry, and that
+  breakpoint addresses equal `nm`'s symbol addresses;
+- captured stdout and an environment override;
+- the event-limit and duration outcomes, with the process confirmed gone;
+- that a hardened-runtime copy is refused with `debugger-attach-denied`, and
+  that the same copy signed with `get-task-allow` is traced.
  for the exact ABI, authority, graph and observation boundaries.

 ### Firmware adapters
@@ -552,6 +606,18 @@ conditional `real-web-source-map` CI job supplies Chrome and an isolated pinned
 fixture compiler; static/unit checks do not acquire a browser. See
 [the source location guide](web-source-location.md) for the verified decoder profile.

+### JavaScript large-output lane
+
+`npm run verify:javascript:output` exercises the CLI JSON result surface beyond
+the running Node engine's single-string limit. Shared input leaves keep the
+fixture's graph small; the verifier writes one temporary output file, checks its
+complete byte count and an independent digest, then removes it. It requires only
+Node and the built REA runtime, with space for the output plus a 1 GiB reserve.
+Run `npm run verify:javascript:output -- jsonl` for compact JSONL coverage. This
+opt-in lane is separate from routine tests and the canonical hash check
+`npm run verify:javascript:digests`. It verifies serialization rather than an
+arbitrary third-party application's parsing cost or MCP client capacity.
+
 ### Website runtime attribution lane

 `npm run verify:browser:runtime` uses caller-supplied
@@ -567,3 +633,75 @@ same checks through an isolated installed package. The conditional
 compiler. Ordinary unit/static gates acquire no browser. See
 [website runtime attribution](web-runtime.md) for effects, resource bounds and
 coverage limits.
+
+### Offline binary layout
+
+`npm run verify:binary:layout` requires Linux x64, GCC/binutils, absolute
+`REA_PWNTOOLS_PYTHON` with pwntools 4.15.0/pyelftools 0.33/Unicorn 2.1.2 and
+absolute `REA_VERIFY_STRACE_COMMAND`. It compiles ephemeral source-owned ELF
+fixtures and checks public CLI/MCP, lossless addresses/names, file ranges,
+mitigation inferences, malformed/unsupported input, original file hashes and
+released process ownership. Exec syscall tracing must identify only the declared
+Node/Python launchers; no target binary is executed. Core/debugger claims need
+separate verification lanes. Pass an installed package entrypoint as the script's
+first argument to verify packaging independently of the checkout.
+The valid SHN_XINDEX fixture has 65,281 full section rows; CLI is checked in
+the ordinary lane. Its large MCP transfer is opt-in with
+`REA_VERIFY_LARGE_ELF_MCP=1` (or the workflow dispatch `large_mcp` input), an
+explicit 256 MiB SDK receive buffer and five-minute request timeout. Ordinary
+MCP fixtures retain the pinned SDK defaults.
+
+### Offline EVM interface
+
+`npm run verify:evm:interface` requires Linux x64, an absolute
+`REA_VERIFY_STRACE_COMMAND`, caller-supplied util-linux `prlimit` and `REA_VERIFY_SOLC_MODULE` selecting the absolute module path for
+solc 0.8.30. It compiles source-owned plain/optimized/via-IR Cancun fixtures in
+private storage and checks actual CLI/MCP selector evidence, raw/hex identity,
+unknowns, malformed carriers and independent cleanup. An optional positional
+entrypoint verifies a fresh installed package. It acquires no engine, compiler
+or chain dependency and does not execute a contract on a chain.
+
+### Recorded crash evidence
+
+`npm run verify:recorded:crash` is a separate Linux x64 lane. It requires GCC,
+GDB, absolute `REA_PWNTOOLS_PYTHON` with the offline ELF profile above,
+`REA_PWNDBG_GDBINIT` and `REA_PWNDBG_VENV_PATH` with unchanged pwndbg 2026.09.15,
+and `REA_VERIFY_STRACE_COMMAND`. Its disposable CI runner installs GDB, checks out the exact upstream
+commit and installs its frozen lockfile in isolated runner storage. No developer
+host configuration or core-pattern setting changes.
+
+Fixture generation explicitly runs an owned source-built two-thread program
+under GDB to create a recording. Subsequent public CLI/MCP inspection verifies
+lossless high registers, signed signals, note source bytes, malformed/missing
+notes, unfamiliar owners, optional core-only mapping context and actionable
+missing/unsupported plugin errors. A historical-PID collision fixture references
+an owned live sentinel; inspection syscall traces reject process attach/memory
+access, provider lookups of that PID's `/proc` files and attempted Internet sockets. Traces admit
+the observed upstream startup helpers (`iconv -l`, the selected checkout's Git
+version lookup) and REA ownership inspection separately from target execution.
+This is fixture evidence, not a sandbox claim. Inputs remain unchanged and the
+sentinel must stay alive; owned cleanup and empty verifier descendants are required. Pass an
+installed package entrypoint as the script's first argument for package coverage.
+
+## Agent evaluation and conformance records
+
+Evaluate native, JavaScript, managed and browser investigation tasks through a
+real local Codex CLI with:
+
+```bash
+npm run verify:agent
+```
+
+Its report records tool selection, repeated calls, token use, completion quality,
+and handling of permissions and unknowns.
+
+Regenerate the managed conformance manifest and Evidence completion ledger from
+live verification results, or check them for drift:
+
+```bash
+npm run evidence:generate
+npm run evidence:check
+```
+
+The records preserve unsupported and unverified coverage as explicit unknowns.
+Run the matching real-tool prerequisites described in this guide.
@@ -80,7 +80,18 @@ or model-authored loop when one call can answer the question.
 ## Implement and evaluate

 - Put shared user workflows in the application layer; keep MCP translation in
-  the server adapter and CLI behavior aligned with the same workflow.
+  the server adapter and CLI behavior aligned with the same workflow. Share
+  Evidence provenance, unknown projection, and eligible snapshot binding through
+  application/session owners. Matching result payloads alone do not establish
+  equivalent retention or replay behavior.
+- Derive each facet's coverage from examined records, unsupported representations,
+  and exhaustiveness. Keep issues structured until presentation; do not select a
+  facet by matching diagnostic prose or infer completeness from an empty failure
+  list. Preserve available observations independently of cleanup success.
+- Measure the resource consumed before choosing a limit. Value alternatives,
+  retained records, trace-frame products, output bytes, and temporary-file growth
+  need different accounting. Enforce a justified budget before the costly step
+  and report its effect; an input-byte or graph-node cap does not bound every stage.
 - Update the canonical contract inventory, output schemas, examples, generated
  catalog, and relevant docs together.
 - Verify valid, malformed, boundary, unavailable, cancellation, and partial
@@ -68,12 +68,12 @@ harm_rank,location,trigger,current_copy,user_risk,proposed_replacement,implement
 58,src/application/SetupHost.ts:unsupported Node,Runtime version cannot run setup,"Install Node.js 22.x (>=22.19), 24.x (>=24.11), or 26+ and rerun setup.",Low risk; exact dependency and retry,Keep current copy,unchanged,verified by setup host tests
 59,src/application/Setup.ts:unsupported macOS,macOS version is missing or older than 12,Upgrade to macOS 12 or newer.,Low risk; exact support floor,Keep current copy,unchanged,verified by setup host tests
 60,src/application/Setup.ts:unsupported Linux,Linux distribution is outside supported set,"REA supports Hopper on Ubuntu 24.04+, Fedora 41+, 64-bit Arch Linux, and CachyOS.",Low risk; exact supported alternatives,Keep current copy,unchanged,verified by setup unit test
-61,src/application/ProcessCli.ts:readJson read,Process scenario or evidence file cannot be read,Raw filesystem exception through CLI framework,Can expose local paths/codes and no recovery,"Process input file could not be read. Check that the path exists and is readable.",implemented,verified by focused CLI test
-62,src/application/ProcessCli.ts:readJson size,Process scenario or evidence file exceeds 64 MiB,Process JSON input exceeds byte limit,Does not state limit or recovery,"Process input file is too large. Reduce it below 64 MiB, then try again.",implemented,verified by focused sparse-file CLI test
-63,src/application/ProcessCli.ts:readJson parse,Process scenario or evidence file is malformed JSON,Raw JSON parser exception through CLI framework,Can expose parser implementation and lacks recovery,"Process input file is not valid JSON. Repair the file, then try again.",implemented,verified by focused CLI test
-64,src/application/ProcessCli.ts:capture scenario parse,Scenario fails Process Capture schema,Raw Zod validation exception through CLI framework,Exposes schema internals and field paths without stable recovery,"Process scenario is invalid. Check its required fields and limits, then try again.",implemented,verified by focused CLI test
-66,src/application/ProcessCli.ts:wrong evidence,Comparison receives valid Evidence from another workflow,Expected REA process capture Evidence,Uses internal schema name and does not explain recovery,"Capture evidence is not from the current process-capture workflow. Create new capture evidence, then try again.",implemented,verified by focused CLI test
-67,src/application/ProcessCli.ts:unexpected,Unexpected parser/comparison/canonicalization failure escapes expected classifications,Raw thrown exception through CLI framework,Can expose stack or internal invariant,"Process command could not complete. Check the input files and run `rea doctor`, then try again.",implemented,verified by direct unexpected-cause projection test
+61,src/application/process/ProcessCli.ts:readJson read,Process scenario or evidence file cannot be read,Raw filesystem exception through CLI framework,Can expose local paths/codes and no recovery,"Process input file could not be read. Check that the path exists and is readable.",implemented,verified by focused CLI test
+62,src/application/process/ProcessCli.ts:readJson size,Process scenario or evidence file exceeds 64 MiB,Process JSON input exceeds byte limit,Does not state limit or recovery,"Process input file is too large. Reduce it below 64 MiB, then try again.",implemented,verified by focused sparse-file CLI test
+63,src/application/process/ProcessCli.ts:readJson parse,Process scenario or evidence file is malformed JSON,Raw JSON parser exception through CLI framework,Can expose parser implementation and lacks recovery,"Process input file is not valid JSON. Repair the file, then try again.",implemented,verified by focused CLI test
+64,src/application/process/ProcessCli.ts:capture scenario parse,Scenario fails Process Capture schema,Raw Zod validation exception through CLI framework,Exposes schema internals and field paths without stable recovery,"Process scenario is invalid. Check its required fields and limits, then try again.",implemented,verified by focused CLI test
+66,src/application/process/ProcessCli.ts:wrong evidence,Comparison receives valid Evidence from another workflow,Expected REA process capture Evidence,Uses internal schema name and does not explain recovery,"Capture evidence is not from the current process-capture workflow. Create new capture evidence, then try again.",implemented,verified by focused CLI test
+67,src/application/process/ProcessCli.ts:unexpected,Unexpected parser/comparison/canonicalization failure escapes expected classifications,Raw thrown exception through CLI framework,Can expose stack or internal invariant,"Process command could not complete. Check the input files and run `rea doctor`, then try again.",implemented,verified by direct unexpected-cause projection test
 68,src/server/registerEvidenceTools.ts:object guard,Validated provider-tool input is unexpectedly not an object,Provider tool input was not an object,Exposes provider architecture and implies caller can fix impossible state,Remove the impossible duplicate guard and parse through the declared JSON-object schema.,removed,verified by typecheck and MCP integration tests
 69,src/server/registerEnhancedTools.ts:object guard,Validated enhanced-tool input is unexpectedly not an object,Validated enhanced input was not a JSON object,Exposes validation/JSON implementation detail,Remove the impossible duplicate guard and parse through the declared JSON-object schema.,removed,verified by typecheck and enhanced MCP integration tests
 70,src/server/registerOfficialTools.ts:object guard,Validated direct-tool input is unexpectedly not an object,Validated MCP tool input was not a JSON object,Exposes MCP validation implementation detail,Remove the impossible duplicate guard and parse through the declared JSON-object schema.,removed,verified by typecheck and official MCP integration tests
@@ -1,105 +0,0 @@
-{
-  "ledger_id": "ecl_132e857a8a93f0b366cd72f9cfa1c338ffd4100460a7834ef69abff936c84472",
-  "records": [
-    {
-      "claim_id": "managed.application-graph-projection",
-      "status": "pass",
-      "evidence_ids": [
-        "ev_b061a5a559acb3748cb9784c637f6693f74faeb564ba2b11d6fc32619e757459"
-      ]
-    },
-    {
-      "claim_id": "managed.decompiler-reconstruction-import",
-      "status": "pass",
-      "evidence_ids": [
-        "ev_13f3401a3aaddc3f6d087ad160fa928374e142cdb9861254359b46865b8c992e"
-      ]
-    },
-    {
-      "claim_id": "managed.dotnet-framework-x86-pinvoke",
-      "status": "pass",
-      "evidence_ids": [
-        "ev_6f026216826ca06e080b77ff608f02634fa945fbd2e151b4cd261c1444f8bbb1"
-      ]
-    },
-    {
-      "claim_id": "managed.ilspy-reconstruction-oracle",
-      "status": "unsupported",
-      "evidence_ids": [
-        "ev_65a94c4de03f9c6ebdaff3f381cca377821f349d3ca6dfad47a31cc586fae939"
-      ]
-    },
-    {
-      "claim_id": "managed.malformed-metadata",
-      "status": "pass",
-      "evidence_ids": [
-        "ev_deae4259ea4395623176de40d06c2abcbc2b3a77f0bfb068d76e568d801f45a8"
-      ]
-    },
-    {
-      "claim_id": "managed.managed-native-verification",
-      "status": "pass",
-      "evidence_ids": [
-        "ev_0edcbbcaa1191a4e5324a437f739957b77f9ac45e7897724337f2d6d06b3f9d1"
-      ]
-    },
-    {
-      "claim_id": "managed.modern-dotnet-anycpu",
-      "status": "pass",
-      "evidence_ids": [
-        "ev_d1af50e8dc04cd589385769efd8758e82095425f6e9c1cc4bf2f530c6b434c93"
-      ]
-    },
-    {
-      "claim_id": "managed.mvid-and-token-drift",
-      "status": "pass",
-      "evidence_ids": [
-        "ev_5493f40bc875535488d789a490361abcc1f76bfbdf52536d09ff127442a8e854"
-      ]
-    },
-    {
-      "claim_id": "managed.not-managed",
-      "status": "pass",
-      "evidence_ids": [
-        "ev_03ce0cc0183ee0710f8120e837565129559ab3bc41927df326066370c2341699"
-      ]
-    },
-    {
-      "claim_id": "managed.operator-local-manifest",
-      "status": "unsupported",
-      "evidence_ids": [
-        "ev_9d3e50da1d372c55f46649e69eae702cbe8f0ba6a81d1e46afc3e1a284c81757"
-      ]
-    },
-    {
-      "claim_id": "managed.operator-manifest-self-test",
-      "status": "pass",
-      "evidence_ids": [
-        "ev_f974f4b9d039cda841894c6173cae86427ecef48f4e7a4d6c73edf7b23af2b2a"
-      ]
-    },
-    {
-      "claim_id": "managed.unicode-obfuscated-identifiers",
-      "status": "pass",
-      "evidence_ids": [
-        "ev_c4f38ce76d8359d92ee8e9442503e47b7913550442349a0df688bd274a3def67"
-      ]
-    },
-    {
-      "claim_id": "managed.x64-ready-to-run-native-body",
-      "status": "pass",
-      "evidence_ids": [
-        "ev_3e05ef1d6a796d3d4cb3372fe8e549efec759c59bf09d8ff660059a2e448cbc0"
-      ]
-    }
-  ],
-  "summary": {
-    "total": 13,
-    "pass": 11,
-    "fail": 0,
-    "unsupported": 2,
-    "truncated": 0,
-    "unknown": 0,
-    "complete": false
-  }
-}
@@ -1,201 +0,0 @@
-{
-  "manifest_id": "ecm_880356f1ceceb9e29b43e3e89f7a326aa83132e1e1fae0573245848ba714f404",
-  "verifier": {
-    "id": "rea-managed-conformance",
-    "version": "1"
-  },
-  "environment": {
-    "platform": "portable",
-    "architecture": "portable",
-    "runtime": "node",
-    "runtime_version": "portable"
-  },
-  "skill_digests": [
-    {
-      "skill_id": "reverse-engineer-anything",
-      "sha256": "97dc167b6e0d41ac69953501c96a918319fa6e4b3be0affe2fc2119294e7101d"
-    }
-  ],
-  "claims": [
-    {
-      "claim_id": "managed.application-graph-projection",
-      "scenario": {
-        "id": "managed-application-graph-projection",
-        "version": 1
-      },
-      "artifact_sha256s": [
-        "f17fe6286cb07c6385e786e0aa877564d44123197f02617dfec70c537a33e4ea"
-      ],
-      "provider": {
-        "id": "rea-managed-conformance",
-        "version": "1"
-      }
-    },
-    {
-      "claim_id": "managed.decompiler-reconstruction-import",
-      "scenario": {
-        "id": "decompiler-reconstruction-import",
-        "version": 1
-      },
-      "artifact_sha256s": [
-        "cead4cc99733e4e56a5fd0cec8a0813bbc24e249aa72a10eca4c47ee3b0e129d"
-      ],
-      "provider": {
-        "id": "rea-managed-conformance",
-        "version": "1"
-      }
-    },
-    {
-      "claim_id": "managed.dotnet-framework-x86-pinvoke",
-      "scenario": {
-        "id": "dotnet-framework-x86-pinvoke",
-        "version": 1
-      },
-      "artifact_sha256s": [
-        "f17fe6286cb07c6385e786e0aa877564d44123197f02617dfec70c537a33e4ea"
-      ],
-      "provider": {
-        "id": "rea-managed-conformance",
-        "version": "1"
-      }
-    },
-    {
-      "claim_id": "managed.ilspy-reconstruction-oracle",
-      "scenario": {
-        "id": "ilspy-reconstruction-oracle",
-        "version": 1
-      },
-      "artifact_sha256s": [],
-      "provider": {
-        "id": "rea-managed-conformance",
-        "version": "1"
-      }
-    },
-    {
-      "claim_id": "managed.malformed-metadata",
-      "scenario": {
-        "id": "malformed-metadata",
-        "version": 1
-      },
-      "artifact_sha256s": [
-        "827e10b6391d29edca48c191e2ddd79f3bc1165e46e4ba2f4edf41ab60f45e78"
-      ],
-      "provider": {
-        "id": "rea-managed-conformance",
-        "version": "1"
-      }
-    },
-    {
-      "claim_id": "managed.managed-native-verification",
-      "scenario": {
-        "id": "managed-native-verification",
-        "version": 1
-      },
-      "artifact_sha256s": [
-        "9999999999999999999999999999999999999999999999999999999999999999",
-        "f17fe6286cb07c6385e786e0aa877564d44123197f02617dfec70c537a33e4ea"
-      ],
-      "provider": {
-        "id": "rea-managed-conformance",
-        "version": "1"
-      }
-    },
-    {
-      "claim_id": "managed.modern-dotnet-anycpu",
-      "scenario": {
-        "id": "modern-dotnet-anycpu",
-        "version": 1
-      },
-      "artifact_sha256s": [
-        "92b588ae43d418117fa108c0004b5d0451f6112238d21bad8d75c0eb1da860f0"
-      ],
-      "provider": {
-        "id": "rea-managed-conformance",
-        "version": "1"
-      }
-    },
-    {
-      "claim_id": "managed.mvid-and-token-drift",
-      "scenario": {
-        "id": "mvid-and-token-drift",
-        "version": 1
-      },
-      "artifact_sha256s": [
-        "276395c671a656ab57d583158443c10de552dccfb37dc97cd013f673c0f86b43",
-        "ef009dab7424fdeba996f2524dbe86fd899c96394498cca0463fcfdb228c5572"
-      ],
-      "provider": {
-        "id": "rea-managed-conformance",
-        "version": "1"
-      }
-    },
-    {
-      "claim_id": "managed.not-managed",
-      "scenario": {
-        "id": "not-managed",
-        "version": 1
-      },
-      "artifact_sha256s": [
-        "de74dab8ab034054a811d4248efcda0bed505187a061a806e274ae87bc453754"
-      ],
-      "provider": {
-        "id": "rea-managed-conformance",
-        "version": "1"
-      }
-    },
-    {
-      "claim_id": "managed.operator-local-manifest",
-      "scenario": {
-        "id": "operator-local-manifest",
-        "version": 1
-      },
-      "artifact_sha256s": [],
-      "provider": {
-        "id": "rea-managed-conformance",
-        "version": "1"
-      }
-    },
-    {
-      "claim_id": "managed.operator-manifest-self-test",
-      "scenario": {
-        "id": "operator-manifest-self-test",
-        "version": 1
-      },
-      "artifact_sha256s": [
-        "cdc11ec7fd0f392e43b9b23971cb41ec49fd0a997fc33c24fcc553cd4386ae37"
-      ],
-      "provider": {
-        "id": "rea-managed-conformance",
-        "version": "1"
-      }
-    },
-    {
-      "claim_id": "managed.unicode-obfuscated-identifiers",
-      "scenario": {
-        "id": "unicode-obfuscated-identifiers",
-        "version": 1
-      },
-      "artifact_sha256s": [
-        "cead4cc99733e4e56a5fd0cec8a0813bbc24e249aa72a10eca4c47ee3b0e129d"
-      ],
-      "provider": {
-        "id": "rea-managed-conformance",
-        "version": "1"
-      }
-    },
-    {
-      "claim_id": "managed.x64-ready-to-run-native-body",
-      "scenario": {
-        "id": "x64-ready-to-run-native-body",
-        "version": 1
-      },
-      "artifact_sha256s": [
-        "e47402428322cdcb06f561036d7d108528cbc6e262d92a21f869218a20c80bfb"
-      ],
-      "provider": {
-        "id": "rea-managed-conformance",
-        "version": "1"
-      }
-    }
-  ]
-}
@@ -0,0 +1,147 @@
+# Historical web network captures
+
+Use `inspect_web_network_capture` / `inspect-web-network-capture` to inspect
+retained producer evidence. This is an offline operation: recorded URLs are
+never fetched, and no browser or proxy listener is started.
+
+```sh
+rea inspect-web-network-capture /absolute/session.har har --json
+rea inspect-web-network-capture /absolute/session.har har --record 2 --record 0 --json
+```
+
+```json
+{
+  "name": "inspect_web_network_capture",
+  "arguments": {
+    "capture_path": "/absolute/session.har",
+    "format": "har",
+    "record_ordinals": [2, 0]
+  }
+}
+```
+
+Omit ordinals to return every record. Explicit selection preserves caller order
+and original zero-based producer ordinals; duplicate or out-of-range selections
+are input errors. Every record is validated before selection, so selecting one
+entry does not hide a malformed entry elsewhere.
+
+## Formats and upstream profiles
+
+HAR uses unchanged `har-schema@2.0.0` draft-06 schemas, `ajv@8.20.0`,
+`ajv-formats@3.0.1`, `jsonc-parser@3.3.1` JSON visitor, and
+`lossless-json@4.3.1` numeric representations, pinned in the npm lockfile.
+Only the HAR 1.2 profile is supported. Unknown extensions remain reported
+evidence. Duplicate object keys, including equal values and escaped spellings,
+are rejected before materialization. Prototype-named members such as
+`__proto__` are preserved as ordinary own JSON members without prototype
+mutation. Original capture files remain unchanged.
+The observed mitmproxy 12.2.3 `SaveHar` profile can emit `postData.text: null`
+for a missing request body. REA preserves that reported null, omitting the
+optional field only from its validation copy for this exact producer profile;
+it does not invent an empty string or body bytes.
+
+Native mitmproxy decoding requires a caller-supplied **mitmdump 12.2.3 on
+Linux**. Set its absolute executable path:
+
+```sh
+REA_MITMDUMP_COMMAND=/absolute/mitmdump rea inspect-web-network-capture /absolute/session.mitm mitmproxy --json
+```
+
+REA does not install mitmproxy. Its owned process uses a private configuration
+directory, `--no-server`, and the unchanged upstream `mitmproxy.io.tnetstring`
+decoder. It does not run `FlowReader` migrations or convert native states to
+HAR. Raw IDs, state versions, flow types, backup states and unknown extensions
+are preserved without synthesizing connections, timestamps or content. The
+tested upstream source is tag `v12.2.3`, commit
+`6c09d56e4c29a92f5ad01b03199977584b8ea14f`; other native tool versions return
+an explicit unsupported-profile diagnostic. Non-Linux native decoding is not
+supported by this adapter.
+
+## Reading the evidence
+
+- `artifact` identifies the caller-selected file and stable snapshot digest.
+- `records` preserve producer order/ordinals and original JSON pointers or byte
+  ranges. No live browser transaction or scenario IDs are invented.
+- `reported` retains the producer's fields. HAR container metadata is returned
+  separately, with `log.entries` replaced by `null` and `records_pointer`
+  identifying the record collection. This is an inspection representation,
+  not a reconstructed HAR file.
+- `numeric_literals` preserve HAR number lexemes and native integer/float
+  representations, including unsafe integers and non-finite native floats.
+  Values that cannot be safely represented as JSON numbers are `null` in the
+  reported view. Unsafe standard HAR numeric fields fail schema validation;
+  unsafe extension numbers remain available through their sidecars.
+- `binary_fields` retain exposed bytes, base64 and SHA-256 independently of
+  declared sizes. Valid HAR `content.encoding: "base64"` is decoded exactly;
+  producer-decoded Unicode text, missing text and unknown encodings do not
+  establish original body bytes. Post-data parameters do not reconstruct a
+  multipart body. Native byte fields also have an exact UTF-8 display view
+  when valid; binary sidecars establish their actual representation. Native
+  missing content and empty content remain distinct.
+- `redactions` identify known transport authentication exclusions and explicit
+  sensitive-value exclusions. Redacted byte fields retain neither original
+  bytes nor their digest. Unknown extension names and token-looking query
+  parameters do not establish sensitivity.
+
+Mark sensitive literal string/UTF-8 byte values with MCP `sensitive_values`, or
+repeat CLI `--sensitive-value`. These declarations are never persisted in
+Evidence parameters; the count is retained. Explicit text/UTF-8 byte matches
+exclude the entire field with a reported `null` rather than substitute a text
+marker or rewrite payload bytes. This prevents replacement markers from
+reintroducing declared literals. The file digest identifies the original artifact
+unless it matches an explicit declaration; in that case `artifact.sha256` and
+Evidence `subject` are null with an explanation. A sensitive property name excludes that
+entire property and its sidecars; a `scope: "property-name"` redaction points
+to its actual parent. No substitute property name or child pointer is invented.
+Omitted subtrees are still validated, including canonical HAR base64. Explicitly sensitive artifact
+paths are empty in Evidence and omitted from locations, while the original
+SHA-256 and size remain available unless the digest itself is explicitly excluded. Failure messages, diagnostics and cleanup
+resources follow the same explicit declarations without changing error types;
+sensitive issue pointers identify a real ancestor instead of a fabricated
+coordinate. Header/cookie authentication values and known
+transport URL userinfo are excluded structurally, including native backups.
+
+Generated free-text limitations follow the same literal declarations, including
+global, per-record and Evidence explanations added during projection. Contract
+field names, typed discriminators and exact decoder identities keep their
+canonical meanings; declarations do not rename formats or providers.
+
+Historical evidence does not prove runtime attribution, execution or deployment
+authenticity. Mitmproxy messages are upstream-assembled messages, not recovered
+wire fragments. Native dictionary duplicate keys have the unchanged upstream
+decoder's last-value semantics; this adapter does not claim to recover discarded
+duplicates or the original numeric spelling of parsed native floats.
+
+## Resource and lifecycle boundaries
+
+Complete evidence has a 32 MiB input, 96 MiB decoder reply and 64-level nesting
+budget. Exceeding a budget returns no partial success.
+Oversized selected captures return an input error identifying `capture_path`
+and the byte budget; owned reply/output failures remain output or provider errors.
+HAR runs in an owned
+192 MiB Node old-generation heap with one V8 worker. Native decoding applies
+Linux limits of 768 MiB address space, 30 seconds CPU and 96 MiB file output;
+both commands have a 30-second wall deadline and independently supervised
+process cleanup. Owned decoder diagnostics retain at most 1 MiB across stdout
+and stderr; the collector drops overflow as it arrives, reports the limit
+failure and verifies cleanup. Heap limits alone do not establish aggregate RSS limits.
+
+Stable regular-file reads reject symlinks, replacement and concurrent changes.
+Private snapshots, declarations and tool configuration are removed before the
+result returns. Cleanup uncertainty retains the selected capture, resource and
+original failure information. The original capture is never changed.
+
+## Excluded coordinates and read failures
+
+Explicitly marked values also exclude matching source coordinates and their sidecars. A hidden record coordinate is reported as `location.kind: "unknown"`; REA does not invent a replacement pointer. Original record ordinals and artifact digests remain available.
+
+Host filesystem read denials return `code: "access_denied"`, `category: "unavailable"`, the actual `EACCES`/`EPERM` code and read-access guidance. Missing files remain input failures. Cleanup failures retain the prior structured error, including its input constraints or provider diagnostics, with explicitly marked text excluded.
+
+An observed replacement or in-place change during stable artifact acquisition
+returns `code: "artifact_changed"`, `category: "integrity_mismatch"` and
+`retryable: true`, retaining the selected path and reader's reason. Wait until
+the capture file is stable before retrying. No unstable snapshot is decoded.
+Command cleanup failures retain the original status and both diagnostic streams;
+the decoder's ownership preparation receives the same cancellation signal.
+
+MCP advertises the same strict named input contract used by the application. Historical inspection delegates argument validation to that shared application boundary so accepted explicit-sensitive declarations also cover invalid argument names and other correction details. The SDK receives raw arguments through its Standard Schema interface; malformed inputs still fail before decoder or filesystem effects and return the normal structured REA error. Protocol-envelope validation remains owned by MCP.
@@ -3,6 +3,8 @@
 This guide describes repository main. npm 4.1.0 includes the Windows
 native bundle; check the [release boundary](installation.md#released-package-and-main)
 before applying these instructions to an older published package.
+Native x86 (32-bit) PE support is available on repository main; npm releases
+through 5.0.0 admit x86-64 PE targets on Windows.

 Status: experimental Windows x64 support for the read-only P0 boundary. Windows
 package builds bundle native process, filesystem, and DACL controls. REA
@@ -15,7 +17,7 @@ additional permission flag or degraded mode is required.
 - Node.js 22.x (>=22.19), 24.x (>=24.11), or 26+;
 - an operator-installed Ghidra 12.1.x distribution (verified with 12.1.4);
 - a 64-bit full JDK inside that installation's declared Java range (JDK 21 or newer, with no maximum, for current 12.1 releases);
- an explicit native, non-managed, non-DLL x86-64 PE application; and
+- an explicit native, non-managed, non-DLL x86 or x86-64 PE application; and
 - the 25 read-only Ghidra inventory, memory, and function-analysis operations.

 Loaded memory reads and file offsets preserve Ghidra's observed source mappings.
@@ -98,7 +100,7 @@ and artifact SHA-256 before loading the package-owned addon. Native failure
 reasons remain distinct from a valid installation and an unsupported target.

 PE header classification and SHA-256 come from the same open file. The Windows
-provider admits native x86-64 PE applications and rejects unsupported roles,
+provider admits native x86 and x86-64 PE applications and rejects unsupported roles,
 architectures, managed images, and malformed headers. The original selected
 source coordinate is preserved for native admission.

@@ -156,6 +158,8 @@ artifact and manifest.
 ```powershell
 npm run verify:windows-native
 npm run verify:ghidra:windows
+npm run verify:ghidra:windows -- --x86
+npm run verify:ghidra:windows:package -- --x86
 npm run verify:ghidra:windows:package -- C:\fixtures\installed-rea C:\fixtures\sample.exe
 ```

@@ -107,7 +107,7 @@ if [[ "$dry_run" == true ]]; then
 fi

 printf 'Installing %s@%s...\n' "$PACKAGE" "$version"
-npm install --global "${prefix_args[@]}" "$PACKAGE@$version" || fail "npm could not install REA. Check registry access and npm permissions, then retry."
+npm install --global ${prefix_args[@]+"${prefix_args[@]}"} "$PACKAGE@$version" || fail "npm could not install REA. Check registry access and npm permissions, then retry."
 [[ -x "$install_bin" ]] || fail "npm completed without installing the rea command. Check the npm global bin directory and PATH, then retry."
 installed_version="$("$install_bin" --version 2>/dev/null | tr -d '[:space:]')" || fail "the installed REA version could not be read. Reinstall the requested version, then retry."
 [[ "$installed_version" == "$version" ]] || fail "installed version $installed_version does not match $version. Reinstall the requested version, then retry."
@@ -277,14 +277,15 @@ static void directory(Runtime& root, const std::wstring& relative) {
  }
 }

-static Handle createPrivateFile(Runtime& root, const std::wstring& relative) {
+static Handle createPrivateFile(Runtime& root, const std::wstring& relative,
+                                DWORD access = DELETE | GENERIC_WRITE | GENERIC_READ | READ_CONTROL) {
  const auto path = relativePath(root, relative);
  const auto parentPath = path.substr(0, path.find_last_of(L'\\'));
  auto parent = runtimeDirectory(root, parentPath);
  verifyPrivate(parent->get(), parentPath, parentPath == root.path);
  Security security;
  auto file = createRelative(parent->get(), path.substr(path.find_last_of(L'\\') + 1),
-                             DELETE | GENERIC_WRITE | GENERIC_READ | READ_CONTROL, false, security, path);
+                              access, false, security, path);
  verifyPrivate(file.get(), path, false);
  return file;
 }
@@ -305,6 +306,26 @@ static void dispose(HANDLE handle, const std::wstring& path) {
  require(SetFileInformationByHandle(handle, FileDispositionInfo, &deletion, sizeof(deletion)), "Delete owned object by handle failed", path);
 }

+static void disposeSnapshot(Runtime& root, Handle& file, const std::wstring& path) {
+  // Snapshot readers do not share DELETE access. Release the writer only for
+  // failed-copy cleanup, with its parent pinned and its identity recorded.
+  auto parent = runtimeDirectory(root, path.substr(0, path.find_last_of(L'\\')));
+  FILE_ID_INFO expected{};
+  require(GetFileInformationByHandleEx(file.get(), FileIdInfo, &expected, sizeof(expected)),
+          "Read incomplete snapshot identity failed", path);
+  file.reset();
+  auto cleanup = openComponent(path, DELETE | GENERIC_READ | FILE_WRITE_ATTRIBUTES, false);
+  FILE_ID_INFO observed{};
+  require(GetFileInformationByHandleEx(cleanup.get(), FileIdInfo, &observed, sizeof(observed)),
+          "Read snapshot cleanup identity failed", path);
+  require(expected.VolumeSerialNumber == observed.VolumeSerialNumber &&
+          std::equal(std::begin(expected.FileId.Identifier), std::end(expected.FileId.Identifier),
+                     std::begin(observed.FileId.Identifier)),
+          "Incomplete snapshot identity changed before cleanup", path, ERROR_ACCESS_DENIED);
+  verifyPrivate(cleanup.get(), path, false);
+  dispose(cleanup.get(), path);
+}
+
 void closeRuntime(Runtime& root) {
  if (root.closed) return;
  // Windows keeps the bearer descriptor and snapshot leases until this owner
@@ -414,8 +435,7 @@ static void completeSnapshot(napi_env env, napi_status status, void* pointer) {
  work->root->snapshotPending = false;
  const auto reject = [&](const Failure& failure) {
    try {
-      dispose(work->destination.get(), work->path);
-      work->destination.reset();
+      disposeSnapshot(*work->root, work->destination, work->path);
      napi_reject_deferred(env, work->deferred, failureValue(env, failure));
    } catch (const Failure& cleanupFailure) {
      const Failure combined(
@@ -447,7 +467,9 @@ static napi_value snapshot(napi_env env, napi_value rootValue, Runtime& root,
  auto work = std::make_unique<SnapshotWork>(env, root);
  work->source = openFile(sourcePath);
  work->path = relativePath(root, relative);
-  work->destination = createPrivateFile(root, relative);
+  // Retain the write lease with read-only sharing, but omit DELETE authority:
+  // Java's RandomAccessFile reader shares read/write, not delete access.
+  work->destination = createPrivateFile(root, relative, GENERIC_WRITE | GENERIC_READ | READ_CONTROL);
  napi_value promise;
  check(napi_create_promise(env, &work->deferred, &promise));
  check(napi_create_reference(env, rootValue, 1, &work->rootReference));
@@ -1,12 +1,12 @@
 {
  "name": "rea-agents",
-  "version": "5.0.0",
+  "version": "6.0.0",
  "lockfileVersion": 3,
  "requires": true,
  "packages": {
    "": {
      "name": "rea-agents",
-      "version": "5.0.0",
+      "version": "6.0.0",
      "license": "MIT",
      "dependencies": {
        "@babel/parser": "8.0.4",
@@ -19,14 +19,20 @@
        "@modelcontextprotocol/server": "2.3.1",
        "@xterm/addon-serialize": "0.14.0",
        "@xterm/headless": "6.0.0",
-        "@zip.js/zip.js": "2.8.26",
+        "@zip.js/zip.js": "2.15.0",
+        "ajv": "8.20.0",
+        "ajv-formats": "3.0.1",
        "canonicalize": "3.0.0",
        "cross-spawn": "7.0.6",
        "diff": "9.0.0",
+        "evmole": "0.9.3",
+        "har-schema": "2.0.0",
        "ignore": "7.0.6",
        "incur": "0.6.1",
        "isomorphic-git": "1.38.7",
        "jsonc-parser": "3.3.1",
+        "lossless-json": "4.3.1",
+        "parse5": "8.0.1",
        "pino": "10.4.0",
        "playwright-core": "1.58.2",
        "plist": "5.0.0",
@@ -48,7 +54,6 @@
        "@types/write-file-atomic": "4.0.3",
        "@types/ws": "8.18.1",
        "@vitest/coverage-v8": "5.0.3",
-        "ajv": "8.20.0",
        "husky": "9.1.7",
        "jscpd": "5.0.12",
        "knip": "6.39.0",
@@ -3945,9 +3950,9 @@
      ]
    },
    "node_modules/@zip.js/zip.js": {
-      "version": "2.8.26",
-      "resolved": "https://registry.npmjs.org/@zip.js/zip.js/-/zip.js-2.8.26.tgz",
-      "integrity": "sha512-RQ4h9F6DOiHxpdocUDrOl6xBM+yOtz+LkUol47AVWcfebGBDpZ7w7Xvz9PS24JgXvLGiXXzSAfdCdVy1tPlaFA==",
+      "version": "2.15.0",
+      "resolved": "https://registry.npmjs.org/@zip.js/zip.js/-/zip.js-2.15.0.tgz",
+      "integrity": "sha512-hYAuHAaWjt0axbofaDL5XUlmrQPsBDcK3f45ApZuh6N+8UGVk26GoGdtGDvcvzahsHytTQ6DtBVXwG9IcCMjjQ==",
      "license": "BSD-3-Clause",
      "engines": {
        "bun": ">=0.7.0",
@@ -3971,7 +3976,6 @@
      "version": "8.20.0",
      "resolved": "https://registry.npmjs.org/ajv/-/ajv-8.20.0.tgz",
      "integrity": "sha512-Thbli+OlOj+iMPYFBVBfJ3OmCAnaSyNn4M1vz9T6Gka5Jt9ba/HIR56joy65tY6kx/FCF5VXNB819Y7/GUrBGA==",
-      "dev": true,
      "license": "MIT",
      "dependencies": {
        "fast-deep-equal": "^3.1.3",
@@ -3984,6 +3988,23 @@
        "url": "https://github.com/sponsors/epoberezkin"
      }
    },
+    "node_modules/ajv-formats": {
+      "version": "3.0.1",
+      "resolved": "https://registry.npmjs.org/ajv-formats/-/ajv-formats-3.0.1.tgz",
+      "integrity": "sha512-8iUql50EUR+uUcdRQ3HDqa6EVyo3docL8g5WJ3FNcWmu62IbkGUue/pEyLBW8VGKKucTPgqeks4fIU1DA4yowQ==",
+      "license": "MIT",
+      "dependencies": {
+        "ajv": "^8.0.0"
+      },
+      "peerDependencies": {
+        "ajv": "^8.0.0"
+      },
+      "peerDependenciesMeta": {
+        "ajv": {
+          "optional": true
+        }
+      }
+    },
    "node_modules/algoliasearch": {
      "version": "5.59.0",
      "resolved": "https://registry.npmjs.org/algoliasearch/-/algoliasearch-5.59.0.tgz",
@@ -4623,6 +4644,18 @@
        "node": ">=18.0.0"
      }
    },
+    "node_modules/evmole": {
+      "version": "0.9.3",
+      "resolved": "https://registry.npmjs.org/evmole/-/evmole-0.9.3.tgz",
+      "integrity": "sha512-UhO5HMAoEPCupSxvBJPlm/L0Qk/KVJ/OJo3r4EyhXADIEHqU5aTkAzsBfzk4lXGjqxVnaYbh1GPSmZtmSHFnQQ==",
+      "license": "MIT",
+      "bin": {
+        "evmole": "dist/evmole_cli.mjs"
+      },
+      "engines": {
+        "node": ">=22"
+      }
+    },
    "node_modules/expect-type": {
      "version": "1.4.0",
      "resolved": "https://registry.npmjs.org/expect-type/-/expect-type-1.4.0.tgz",
@@ -4660,7 +4693,6 @@
      "version": "3.1.3",
      "resolved": "https://registry.npmjs.org/fast-deep-equal/-/fast-deep-equal-3.1.3.tgz",
      "integrity": "sha512-f3qQ9oQy9j2AhBe/H9VC91wLmKBCCU/gDOnKNAYG5hswO7BLKj09Hc5HYNz9cGI++xlpDCIgDaitVs03ATR84Q==",
-      "dev": true,
      "license": "MIT"
    },
    "node_modules/fast-string-truncated-width": {
@@ -4682,7 +4714,6 @@
      "version": "3.1.8",
      "resolved": "https://registry.npmjs.org/fast-uri/-/fast-uri-3.1.8.tgz",
      "integrity": "sha512-GZMtZUTNRpOVIECoXwLNZS5xUGE+mVNbTB8h/7Rwh2TFWcBQiPzTgyZi05BF9UMZKkLJv8XBRJTlU7zg8+ZfMg==",
-      "dev": true,
      "funding": [
        {
          "type": "github",
@@ -4890,6 +4921,15 @@
        "url": "https://github.com/sponsors/ljharb"
      }
    },
+    "node_modules/har-schema": {
+      "version": "2.0.0",
+      "resolved": "https://registry.npmjs.org/har-schema/-/har-schema-2.0.0.tgz",
+      "integrity": "sha512-Oqluz6zhGX8cyRaTQlFMPw80bSJVG2x/cFb8ZPhUILGgHka9SsokCCOQgpveePerqidZOrT14ipqfJb7ILcW5Q==",
+      "license": "ISC",
+      "engines": {
+        "node": ">=4"
+      }
+    },
    "node_modules/has-property-descriptors": {
      "version": "1.0.2",
      "resolved": "https://registry.npmjs.org/has-property-descriptors/-/has-property-descriptors-1.0.2.tgz",
@@ -5315,7 +5355,6 @@
      "version": "1.0.0",
      "resolved": "https://registry.npmjs.org/json-schema-traverse/-/json-schema-traverse-1.0.0.tgz",
      "integrity": "sha512-NM8/P9n3XjXhIZn1lLhkFaACTOURQXjWhV4BA/RnOv8xvgqtqpAX9IO4mRQxSx1Rlo4tqzeqb0sOlruaOy3dug==",
-      "dev": true,
      "license": "MIT"
    },
    "node_modules/jsonc-parser": {
@@ -5743,6 +5782,12 @@
        "url": "https://github.com/chalk/slice-ansi?sponsor=1"
      }
    },
+    "node_modules/lossless-json": {
+      "version": "4.3.1",
+      "resolved": "https://registry.npmjs.org/lossless-json/-/lossless-json-4.3.1.tgz",
+      "integrity": "sha512-SqD/Bg3ZfltBJ2Z14hJ/BihnvtV553WO4g9/ePtlp4lrnl9jF3AdIJt53A/Wkg/0Li+LMfxaBqgx1MiFZdQlpQ==",
+      "license": "MIT"
+    },
    "node_modules/lru-cache": {
      "version": "11.5.2",
      "resolved": "https://registry.npmjs.org/lru-cache/-/lru-cache-11.5.2.tgz",
@@ -6308,6 +6353,30 @@
      "integrity": "sha512-4hLB8Py4zZce5s4yd9XzopqwVv/yGNhV1Bl8NTmCq1763HeK2+EwVTv+leGeL13Dnh2wfbqowVPXCIO0z4taYw==",
      "license": "(MIT AND Zlib)"
    },
+    "node_modules/parse5": {
+      "version": "8.0.1",
+      "resolved": "https://registry.npmjs.org/parse5/-/parse5-8.0.1.tgz",
+      "integrity": "sha512-z1e/HMG90obSGeidlli3hj7cbocou0/wa5HacvI3ASx34PecNjNQeaHNo5WIZpWofN9kgkqV1q5YvXe3F0FoPw==",
+      "license": "MIT",
+      "dependencies": {
+        "entities": "^8.0.0"
+      },
+      "funding": {
+        "url": "https://github.com/inikulin/parse5?sponsor=1"
+      }
+    },
+    "node_modules/parse5/node_modules/entities": {
+      "version": "8.1.0",
+      "resolved": "https://registry.npmjs.org/entities/-/entities-8.1.0.tgz",
+      "integrity": "sha512-kxL7msIffSuh9aaFAMD7rxAIuTRMAHMeBtgHW2yUdWw732ZNh4MehkF2gdjvtdmikkaIP9bFDDJOPlsvm7avrA==",
+      "license": "BSD-2-Clause",
+      "engines": {
+        "node": ">=20.19.0"
+      },
+      "funding": {
+        "url": "https://github.com/fb55/entities?sponsor=1"
+      }
+    },
    "node_modules/path-key": {
      "version": "3.1.1",
      "resolved": "https://registry.npmjs.org/path-key/-/path-key-3.1.1.tgz",
@@ -6609,7 +6678,6 @@
      "version": "2.0.2",
      "resolved": "https://registry.npmjs.org/require-from-string/-/require-from-string-2.0.2.tgz",
      "integrity": "sha512-Xf0nWe6RseziFMu+Ap9biiUbmplq6S9/p+7w7YXP/JBHhrUDDUhwa+vANyubuqfZWTveU//DYVGsDG7RKL/vEw==",
-      "dev": true,
      "license": "MIT",
      "engines": {
        "node": ">=0.10.0"
@@ -1,7 +1,7 @@
 {
  "name": "rea-agents",
  "mcpName": "io.github.morluto/rea",
-  "version": "5.0.0",
+  "version": "6.0.0",
  "description": "Reverse engineer anything from your terminal or agent with one CLI and MCP server.",
  "license": "MIT",
  "repository": {
@@ -44,10 +44,14 @@
    "bridge/hopper_bridge.py",
    "bridge/native/NativeUIChildren.swift",
    "bridge/native/ReaNativeUI.swift",
+    "bridge/native/rea_lldb_tracer.py",
+    "bridge/process/ProcessRunTokenReader.swift",
+    "bridge/process/ProcessRunTokenReaderMain.swift",
    "bridge/ghidra/ReaGhidraBridge.java",
    "bridge/ghidra/ReaGhidraExtensions.java",
    "bridge/ghidra/ReaGhidraPrepareCom.java",
    "bridge/android/ReaJadxBridge.java",
+    "bridge/mitmproxy/capture.py",
    "scripts/rea.mjs",
    "scripts/electron-active-hook.cjs",
    "scripts/electron-active-hook-boundaries.cjs",
@@ -59,18 +63,32 @@
    "LICENSE",
    "native/windows/build/manifest.json",
    "native/windows/build/rea-windows-x64.node",
-    "scripts/verify-windows-native-artifact.mjs"
+    "scripts/verify-windows-native-artifact.mjs",
+    "bridge/pwntools/layout.py",
+    "bridge/pwntools/layout_impl.py",
+    "third_party/pwntools/README.md",
+    "third_party/evmole/README.md",
+    "third_party/evmole/LICENSE",
+    "bridge/pwntools/decoder_runtime.py",
+    "bridge/pwntools/recorded_crash.py",
+    "bridge/pwntools/recorded_crash_impl.py",
+    "bridge/pwndbg/launch.py",
+    "bridge/pwndbg/launch_impl.py",
+    "bridge/pwndbg/core_context.py",
+    "third_party/pwndbg/README.md",
+    "third_party/pwndbg/LICENSE.md"
  ],
  "scripts": {
    "deps:check": "node scripts/check-dependency-install.mjs",
    "metadata:generate": "node scripts/generate-package-metadata.mjs",
    "metadata:check": "node scripts/generate-package-metadata.mjs --check",
    "mcp-registry:check": "node scripts/verify-mcp-registry-metadata.mjs",
-    "mcp-catalog:generate": "npm run build:cached && node scripts/generate-mcp-tool-catalog.mjs",
+    "mcp-catalog:generate": "npm run build:cached",
    "mcp-catalog:check": "node scripts/generate-mcp-tool-catalog.mjs --check",
    "prebuild": "npm run deps:check && npm run metadata:check",
    "build": "node scripts/run-exclusive.mjs build npm run build:unlocked",
-    "build:unlocked": "node scripts/clean-build-output.mjs && tsc -p tsconfig.build.json",
+    "build:unlocked": "node scripts/clean-build-output.mjs && tsc -p tsconfig.build.json && npm run build:projections",
+    "build:projections": "node scripts/generate-mcp-tool-catalog.mjs && node scripts/generate-skill-metadata.mjs && node scripts/generate-product-catalog.mjs && node scripts/generate-completion-ledger.mjs",
    "precheck": "npm run deps:check",
    "check": "turbo run typecheck lint format:check knip metadata:check",
    "precheck:fast": "npm run deps:check",
@@ -124,6 +142,7 @@
    "verify:apple-dispatch": "npm run build:cached && node scripts/verify/apple/dispatch.mjs",
    "verify:native-ui": "npm run build:cached && node scripts/verify-native-ui.mjs",
    "verify:keyed-archive": "npm run build:cached && node scripts/verify/apple/keyed-archive.mjs",
+    "verify:dyld-shared-cache": "npm run build:cached && node scripts/verify/apple/dyld-shared-cache.mjs",
    "verify:macos-bundle": "npm run build:cached && node scripts/verify/apple/macos-bundle.mjs",
    "verify:ghidra": "npm run build:cached && node scripts/verify-real-ghidra.mjs",
    "verify:ida": "npm run build:cached && node scripts/verify-real-ida.mjs",
@@ -141,6 +160,7 @@
    "verify:inspector": "npm run build:cached && node scripts/verify/inspector/runtime-observation.mjs",
    "verify:javascript-runtime": "npm run build:cached && node scripts/verify/javascript/runtime-observation.mjs",
    "verify:javascript:digests": "npm run build:cached && node scripts/verify/javascript/digests.mjs",
+    "verify:javascript:output": "npm run build:cached && node scripts/verify/javascript/output.mjs",
    "verify:application-workflows": "npm run build:cached && node scripts/verify/javascript/application-workflows.mjs",
    "verify:managed": "npm run build:cached && node scripts/verify/managed/conformance.mjs",
    "verify:firmware": "npm run build:cached && node scripts/verify/firmware/analysis.mjs",
@@ -161,17 +181,20 @@
    "config:print": "node scripts/print-mcp-config.mjs",
    "evidence:generate": "npm run build:cached && node scripts/generate-completion-ledger.mjs",
    "evidence:check": "npm run build:cached && node scripts/generate-completion-ledger.mjs --check",
+    "predocs:dev": "npm run docs:generate",
    "docs:dev": "vitepress dev docs",
+    "predocs:build": "npm run docs:generate",
    "docs:build": "vitepress build docs",
    "docs:preview": "vitepress preview docs",
    "docs:generate": "node scripts/run-exclusive.mjs docs npm run docs:generate:unlocked",
-    "docs:generate:unlocked": "npm run metadata:generate && npm run build:cached && node scripts/generate-mcp-tool-catalog.mjs && node scripts/generate-skill-metadata.mjs && node scripts/generate-product-catalog.mjs && node scripts/generate-completion-ledger.mjs && node scripts/generate-error-schema.mjs",
+    "docs:generate:unlocked": "npm run metadata:generate && npm run build:cached && node scripts/generate-error-schema.mjs",
    "docs:check": "node scripts/run-exclusive.mjs docs turbo run docs:check:built",
    "docs:check:built": "node scripts/generate-package-metadata.mjs --check && node scripts/generate-mcp-tool-catalog.mjs --check && node scripts/generate-skill-metadata.mjs --check && node scripts/generate-product-catalog.mjs --check && node scripts/generate-completion-ledger.mjs --check && node scripts/check-doc-facts.mjs && node scripts/generate-error-schema.mjs --check",
    "docs:error-schema": "npm run build:cached && node scripts/generate-error-schema.mjs",
    "prepack": "node scripts/prepack.mjs",
    "prepare": "node scripts/prepare.mjs",
    "verify:asset-catalog": "npm run build:cached && node scripts/verify/apple/asset-catalog.mjs",
+    "verify:native-calls": "npm run build:cached && node scripts/verify-native-calls.mjs",
    "verify:native-ui:permissions": "npm run build:cached && node scripts/verify-native-ui.mjs --allow-permission-denial",
    "test:focused": "node scripts/run-development-tests.mjs focused",
    "build:windows-native": "node scripts/build-windows-native.mjs",
@@ -188,7 +211,11 @@
    "verify:javascript:recovery": "node scripts/verify/javascript/recovery.mjs",
    "verify:module-boundaries": "node scripts/verify-module-boundaries.mjs",
    "verify:browser:source-maps": "npm run build:cached && node scripts/verify-browser-source-maps.mjs",
-    "verify:browser:runtime": "npm run build:cached && node scripts/verify-browser-runtime.mjs"
+    "verify:browser:runtime": "npm run build:cached && node scripts/verify-browser-runtime.mjs",
+    "verify:web:network-captures": "npm run build:cached && node scripts/verify-web-network-captures.mjs",
+    "verify:binary:layout": "npm run build:cached && node scripts/verify-binary-layout.mjs",
+    "verify:evm:interface": "npm run build:cached && node scripts/verify-evm-interface.mjs",
+    "verify:recorded:crash": "npm run build:cached && node scripts/verify-recorded-crash.mjs"
  },
  "lint-staged": {
    "*.{cjs,cts,js,jsx,mjs,mts,ts,tsx}": [
@@ -208,14 +235,19 @@
    "@modelcontextprotocol/server": "2.3.1",
    "@xterm/addon-serialize": "0.14.0",
    "@xterm/headless": "6.0.0",
-    "@zip.js/zip.js": "2.8.26",
+    "@zip.js/zip.js": "2.15.0",
+    "ajv": "8.20.0",
+    "ajv-formats": "3.0.1",
    "canonicalize": "3.0.0",
    "cross-spawn": "7.0.6",
    "diff": "9.0.0",
+    "har-schema": "2.0.0",
    "ignore": "7.0.6",
    "incur": "0.6.1",
    "isomorphic-git": "1.38.7",
    "jsonc-parser": "3.3.1",
+    "lossless-json": "4.3.1",
+    "parse5": "8.0.1",
    "pino": "10.4.0",
    "playwright-core": "1.58.2",
    "plist": "5.0.0",
@@ -223,7 +255,8 @@
    "smol-toml": "1.9.0",
    "write-file-atomic": "7.0.0",
    "ws": "8.21.0",
-    "zod": "4.4.3"
+    "zod": "4.4.3",
+    "evmole": "0.9.3"
  },
  "overrides": {
    "vitepress": {
@@ -238,7 +271,6 @@
    "@types/write-file-atomic": "4.0.3",
    "@types/ws": "8.18.1",
    "@vitest/coverage-v8": "5.0.3",
-    "ajv": "8.20.0",
    "husky": "9.1.7",
    "jscpd": "5.0.12",
    "knip": "6.39.0",
@@ -16,7 +16,6 @@
    ".": {
      "package-name": "rea-agents",
      "extra-files": [
-        { "type": "generic", "path": "README.md" },
        { "type": "generic", "path": "README_zh.md" },
        { "type": "generic", "path": "README_ja.md" },
        { "type": "generic", "path": "README_ko.md" },
@@ -35,11 +34,6 @@
          "type": "json",
          "path": "server.json",
          "jsonpath": "$.packages[0].version"
-        },
-        {
-          "type": "json",
-          "path": "docs/product-catalog.json",
-          "jsonpath": "$.package.version"
        }
      ]
    }
@@ -3,50 +3,68 @@ import { dirname, resolve } from "node:path";
 import { fileURLToPath } from "node:url";

 const root = resolve(dirname(fileURLToPath(import.meta.url)), "..");
-const output = resolve(root, "build", "fixtures", "rea-ghidra-windows.exe");
-const bytes = Buffer.alloc(1024);
-const peOffset = 0x80;
-const optionalHeader = peOffset + 24;
-const sectionTable = optionalHeader + 0xf0;
+for (const architecture of ["x86_64", "x86"]) {
+  const x86 = architecture === "x86";
+  const output = resolve(
+    root,
+    "build",
+    "fixtures",
+    x86 ? "rea-ghidra-windows-x86.exe" : "rea-ghidra-windows.exe",
+  );
+  const bytes = Buffer.alloc(1024);
+  const peOffset = 0x80;
+  const optionalHeader = peOffset + 24;
+  const optionalHeaderSize = x86 ? 0xe0 : 0xf0;
+  const sectionTable = optionalHeader + optionalHeaderSize;

-bytes.write("MZ", 0, "ascii");
-bytes.writeUInt32LE(peOffset, 0x3c);
-bytes.write("PE\0\0", peOffset, "binary");
-bytes.writeUInt16LE(0x8664, peOffset + 4);
-bytes.writeUInt16LE(1, peOffset + 6);
-bytes.writeUInt16LE(0xf0, peOffset + 20);
-bytes.writeUInt16LE(0x22, peOffset + 22);
+  bytes.write("MZ", 0, "ascii");
+  bytes.writeUInt32LE(peOffset, 0x3c);
+  bytes.write("PE\0\0", peOffset, "binary");
+  bytes.writeUInt16LE(x86 ? 0x14c : 0x8664, peOffset + 4);
+  bytes.writeUInt16LE(1, peOffset + 6);
+  bytes.writeUInt16LE(optionalHeaderSize, peOffset + 20);
+  bytes.writeUInt16LE(x86 ? 0x102 : 0x22, peOffset + 22);

-bytes.writeUInt16LE(0x20b, optionalHeader);
-bytes.writeUInt32LE(0x200, optionalHeader + 4);
-bytes.writeUInt32LE(0x1000, optionalHeader + 16);
-bytes.writeUInt32LE(0x1000, optionalHeader + 20);
-bytes.writeBigUInt64LE(0x1_4000_0000n, optionalHeader + 24);
-bytes.writeUInt32LE(0x1000, optionalHeader + 32);
-bytes.writeUInt32LE(0x200, optionalHeader + 36);
-bytes.writeUInt16LE(6, optionalHeader + 40);
-bytes.writeUInt16LE(6, optionalHeader + 48);
-bytes.writeUInt32LE(0x2000, optionalHeader + 56);
-bytes.writeUInt32LE(0x200, optionalHeader + 60);
-bytes.writeUInt16LE(3, optionalHeader + 68);
-bytes.writeUInt16LE(0x8160, optionalHeader + 70);
-bytes.writeBigUInt64LE(0x10_0000n, optionalHeader + 72);
-bytes.writeBigUInt64LE(0x1000n, optionalHeader + 80);
-bytes.writeBigUInt64LE(0x10_0000n, optionalHeader + 88);
-bytes.writeBigUInt64LE(0x1000n, optionalHeader + 96);
-bytes.writeUInt32LE(16, optionalHeader + 108);
+  bytes.writeUInt16LE(x86 ? 0x10b : 0x20b, optionalHeader);
+  bytes.writeUInt32LE(0x200, optionalHeader + 4);
+  bytes.writeUInt32LE(0x1000, optionalHeader + 16);
+  bytes.writeUInt32LE(0x1000, optionalHeader + 20);
+  if (x86) bytes.writeUInt32LE(0x400000, optionalHeader + 28);
+  else bytes.writeBigUInt64LE(0x1_4000_0000n, optionalHeader + 24);
+  bytes.writeUInt32LE(0x1000, optionalHeader + 32);
+  bytes.writeUInt32LE(0x200, optionalHeader + 36);
+  bytes.writeUInt16LE(6, optionalHeader + 40);
+  bytes.writeUInt16LE(6, optionalHeader + 48);
+  bytes.writeUInt32LE(0x2000, optionalHeader + 56);
+  bytes.writeUInt32LE(0x200, optionalHeader + 60);
+  bytes.writeUInt16LE(3, optionalHeader + 68);
+  bytes.writeUInt16LE(x86 ? 0x8140 : 0x8160, optionalHeader + 70);
+  if (x86) {
+    bytes.writeUInt32LE(0x10_0000, optionalHeader + 72);
+    bytes.writeUInt32LE(0x1000, optionalHeader + 76);
+    bytes.writeUInt32LE(0x10_0000, optionalHeader + 80);
+    bytes.writeUInt32LE(0x1000, optionalHeader + 84);
+    bytes.writeUInt32LE(16, optionalHeader + 92);
+  } else {
+    bytes.writeBigUInt64LE(0x10_0000n, optionalHeader + 72);
+    bytes.writeBigUInt64LE(0x1000n, optionalHeader + 80);
+    bytes.writeBigUInt64LE(0x10_0000n, optionalHeader + 88);
+    bytes.writeBigUInt64LE(0x1000n, optionalHeader + 96);
+    bytes.writeUInt32LE(16, optionalHeader + 108);
+  }

-bytes.write(".text", sectionTable, "ascii");
-bytes.writeUInt32LE(0x16, sectionTable + 8);
-bytes.writeUInt32LE(0x1000, sectionTable + 12);
-bytes.writeUInt32LE(0x200, sectionTable + 16);
-bytes.writeUInt32LE(0x200, sectionTable + 20);
-bytes.writeUInt32LE(0x6000_0020, sectionTable + 36);
+  bytes.write(".text", sectionTable, "ascii");
+  bytes.writeUInt32LE(0x16, sectionTable + 8);
+  bytes.writeUInt32LE(0x1000, sectionTable + 12);
+  bytes.writeUInt32LE(0x200, sectionTable + 16);
+  bytes.writeUInt32LE(0x200, sectionTable + 20);
+  bytes.writeUInt32LE(0x6000_0020, sectionTable + 36);

-// entry calls the second function, returns zero; second returns 42.
-bytes.set([0xe8, 0x0b, 0, 0, 0, 0x31, 0xc0, 0xc3], 0x200);
-bytes.set([0xb8, 0x2a, 0, 0, 0, 0xc3], 0x210);
+  // entry calls the second function, returns zero; second returns 42.
+  bytes.set([0xe8, 0x0b, 0, 0, 0, 0x31, 0xc0, 0xc3], 0x200);
+  bytes.set([0xb8, 0x2a, 0, 0, 0, 0xc3], 0x210);

-await mkdir(dirname(output), { recursive: true });
-await writeFile(output, bytes);
-process.stdout.write(`${output}\n`);
+  await mkdir(dirname(output), { recursive: true });
+  await writeFile(output, bytes);
+  if (!x86) process.stdout.write(`${output}\n`);
+}
@@ -138,7 +138,11 @@ const char *core_chain(void) { return sibling_value() == 7 ? chain_variant() : "
  return join(version, "Core");
 };

-/** The main executable, with a weak dependency deleted after linking. */
+/**
+ * The main executable. It searches a missing `Overrides` rpath before
+ * `Frameworks`, weakly links a library deleted after linking, and
+ * delay-links a library, which the linker encodes as `dylib_use_command`.
+ */
 const buildMainExecutable = async (root, contents, coreBinary) => {
  const gone = join(contents, "Frameworks", "libgone.dylib");
  await clang(root, {
@@ -147,22 +151,33 @@ const buildMainExecutable = async (root, contents, coreBinary) => {
    output: gone,
    flags: ["-dynamiclib", "-install_name", "@rpath/libgone.dylib"],
  });
+  const delayed = join(contents, "Frameworks", "libdelay.dylib");
+  await clang(root, {
+    name: "delay",
+    source: `int delay_value(void) { return 3; }\n`,
+    output: delayed,
+    flags: ["-dynamiclib", "-install_name", "@rpath/libdelay.dylib"],
+  });
  const executable = join(contents, "MacOS", "MacFixture");
  await clang(root, {
    name: "main",
    source: `#include <stdio.h>
 const char *core_chain(void);
+int delay_value(void);
 extern int gone_value(void) __attribute__((weak_import));
 int main(void) {
+  if (delay_value() != 3) return 1;
  printf("chain=%s weak=%s\\n", core_chain(), gone_value ? "present" : "absent");
  return 0;
 }
 `,
    output: executable,
    flags: [
+      "-Wl,-rpath,@executable_path/../Overrides",
      "-Wl,-rpath,@executable_path/../Frameworks",
      coreBinary,
      `-Wl,-weak_library,${gone}`,
+      `-Wl,-delay_library,${delayed}`,
    ],
  });
  await rm(gone);
@@ -191,7 +206,12 @@ const buildNestedBundles = async (root, contents, coreBinary) => {
 int main(void) { return core_chain()[0] == 'b'; }
 `,
    output: join(service, "MacOS", "Svc"),
-    flags: ["-Wl,-rpath,@executable_path/../../../../Frameworks", coreBinary],
+    // An absolute rpath outside the bundle precedes the bundled framework.
+    flags: [
+      "-Wl,-rpath,/opt/rea-fixture-absent/lib",
+      "-Wl,-rpath,@executable_path/../../../../Frameworks",
+      coreBinary,
+    ],
  });
  await write(
    join(service, "Info.plist"),
@@ -0,0 +1,10 @@
+.globl _start
+.globl absolute_value
+.set absolute_value, 0x20000000000007
+.bss
+.lcomm zero_backing, 8192
+.text
+_start:
+  mov $60, %eax
+  xor %edi, %edi
+  syscall
@@ -0,0 +1,17 @@
+#include <stdio.h>
+#include <stdlib.h>
+
+int stored_value = 7;
+char zero_backing[8192];
+__thread int tls_value;
+int common_value;
+
+__attribute__((noinline)) int read_values(const char *text) {
+  char buffer[32];
+  snprintf(buffer, sizeof(buffer), "%s", text);
+  return buffer[0] + stored_value + tls_value + common_value;
+}
+
+int main(int argc, char **argv) {
+  return read_values(argc > 1 ? argv[1] : "source-owned");
+}
@@ -0,0 +1,12 @@
+// SPDX-License-Identifier: MIT
+pragma solidity 0.8.30;
+
+// Public source-owned fixture; generated runtime bytecode is never tracked.
+contract InterfaceFixture {
+  uint256 public stored;
+  function set(uint256 value) external { stored = value; }
+  function read() external view returns (uint256) { return stored; }
+  function pair(uint32 a, address b) external pure returns (uint32, address) { return (a, b); }
+  receive() external payable {}
+  fallback() external {}
+}
@@ -0,0 +1,151 @@
+import importlib.util
+import json
+from pathlib import Path
+from mitmproxy import connection, ctx, http
+from mitmproxy.io import FlowWriter
+from mitmproxy.io import tnetstring
+from mitmproxy.addons.savehar import SaveHar
+from mitmproxy.websocket import WebSocketData, WebSocketMessage
+
+class Generator:
+    def load(self, loader):
+        loader.add_option("rea_fixture_root", str, "", "Owned synthetic fixture root")
+        loader.add_option("rea_adapter_path", str, "", "REA native adapter under verification")
+
+    def running(self):
+        root = Path(ctx.options.rea_fixture_root)
+        spec = importlib.util.spec_from_file_location("rea_capture_under_test", ctx.options.rea_adapter_path)
+        adapter = importlib.util.module_from_spec(spec)
+        spec.loader.exec_module(adapter)
+        classifications = [
+            (adapter.CaptureFailure("format", "Malformed retained record.", "/record"), "format"),
+            (adapter.CaptureFailure("input-limit", "Nesting budget.", "/extension"), "input-limit"),
+            (MemoryError("payload must not enter diagnostics"), "resource-limit"),
+            (RuntimeError("payload must not enter diagnostics"), "decoder"),
+            (OSError("payload must not enter diagnostics"), "decoder"),
+        ]
+        for error, expected in classifications:
+            reply = adapter.failure_reply(error)
+            assert reply["reason"] == expected, reply
+            assert "payload must not enter diagnostics" not in json.dumps(reply)
+        for state, expected in [({"metadata": {1: b"bad-key"}}, "format"), ({"metadata": object()}, "decoder")]:
+            try:
+                adapter.project_record(state, [])
+            except adapter.CaptureFailure as error:
+                assert error.reason == expected, (error.reason, expected)
+                assert error.pointer == "/metadata", error.pointer
+            else:
+                raise AssertionError("Invalid native representation was accepted")
+        non_utf8 = adapter.project_record({"request": {"headers": [(b"Referer", b"https://byte-user:byte-secret@example.test/path\xff")] }}, [])
+        assert non_utf8["reported"]["request"]["headers"][0][1] is None, non_utf8
+        assert non_utf8["binary_fields"][-1]["state"] == "redacted", non_utf8
+        for value in [" \tHTTPS://ows-user:ows-secret@example.test/path\t ", b" \tHTTPS://ows-user:ows-secret@example.test/path\t "]:
+            projected = adapter.project_record({"request": {"headers": [(b"Referer", value)]}}, [])
+            assert projected["reported"]["request"]["headers"][0][1] == " \tHTTPS://example.test/path\t ", projected
+            assert "ows-secret" not in json.dumps(projected), projected
+            if isinstance(value, bytes):
+                assert projected["binary_fields"][-1]["state"] == "redacted", projected
+        (root / "native-error-classifications.json").write_text(json.dumps({"passed": len(classifications) + 2}))
+        first = http.HTTPFlow(connection.Client(peername=("127.0.0.1", 1), sockname=("127.0.0.1", 2)), connection.Server(address=("example.test", 80)))
+        first.id = "original-producer-id"
+        first.request = http.Request.make("POST", "http://example.test/a?token=ordinary", b"\x00\xffbody", [(b"Authorization", b"Bearer native-transport-secret"), (b"X-Duplicate", b"one"), (b"X-Duplicate", b"two")])
+        first.request.path = "http://user:password@example.test/a?token=ordinary#fragment"
+        first.response = http.Response.make(200, b"\x00\xfeanswer", [(b"Set-Cookie", b"session=cookie-secret"), (b"Location", b"https://redirect-user:redirect-password@example.test/b?token=ordinary")])
+        first.metadata = {"big_integer": 9007199254740993, "nonfinite": float("inf"), "isLosslessNumber": True, "value": "ordinary-extension", "response": {"headers": [["Authorization", "ordinary-extension-credential-name"]]}}
+        first.websocket = WebSocketData(messages=[WebSocketMessage(2, True, b"\x00\xfdmessage", 123.5)])
+        first.backup()
+        first.comment = "caller-selected-fixture"
+        second = first.copy()
+        second.id = first.id
+        second.request.raw_content = None
+        second.response.raw_content = b""
+        second.websocket = None
+        with (root / "flows.mitm").open("wb") as handle:
+            writer = FlowWriter(handle)
+            writer.add(first)
+            writer.add(second)
+        har_first, har_second = first.copy(), second.copy()
+        har_first.request.path = "/a?token=ordinary#fragment"
+        har_second.request.path = "/a?token=ordinary#fragment"
+        har_first.response.raw_content = b"\x00\xff\x01\xfe"
+        markers = {"sensitive": "REDACTED", "bracket": "literal[", "overlap": "secret", "ordinary": "unmarked"}
+        har = SaveHar().make_har([har_first, har_second])
+        har["log"]["entries"][0]["_markers"] = markers
+        har["log"]["entries"][0]["_private_properties"] = {"private-property/~": {"number": 123, "text": "private-property"}, "kept": 7}
+        (root / "producer.har").write_text(json.dumps(har))
+        har_text = json.dumps(har)
+        for name, members in [
+            ("equal-number", '"_duplicate": 1, "_duplicate": 1'),
+            ("equal-null", '"_duplicate": null, "_duplicate": null'),
+            ("equal-object", '"_duplicate": {"value": 1}, "_duplicate": {"value": 1}'),
+            ("escaped-key", '"_duplicate": 1, "\\u005fduplicate": 1'),
+        ]:
+            duplicate = har_text.replace('"cache": {}', '"cache": {}, ' + members, 1)
+            assert duplicate != har_text
+            (root / ("duplicate-" + name + ".har")).write_text(duplicate)
+        duplicate = har_text.replace('"version": "1.2"', '"version": "1.2", "version": "1.2"', 1)
+        assert duplicate != har_text
+        (root / "duplicate-core.har").write_text(duplicate)
+        prototype = json.loads(har_text)
+        prototype["_extension"] = {"__proto__": {"preserved": 7}, "constructor": "ordinary"}
+        (root / "prototype.har").write_text(json.dumps(prototype))
+        prototype_native = first.get_state()
+        prototype_native["metadata"]["__proto__"] = {"preserved": 7}
+        with (root / "prototype.mitm").open("wb") as handle:
+            tnetstring.dump(prototype_native, handle)
+        invalid_har = json.loads(json.dumps(har))
+        invalid_har["log"]["entries"][0]["response"]["content"].update({"encoding": "base64", "text": "AR=="})
+        (root / "invalid-private-parent.har").write_text(json.dumps(invalid_har))
+        strings = first.get_state()
+        for state in [strings, strings["backup"]]:
+            state["request"]["path"] = "https://native-user:string-password@example.test/string-path"
+            state["request"]["authority"] = "authority-user:authority-password@example.test"
+            state["request"]["headers"] = [(b"Referer", "https://referer-user:referer-password@example.test/from"), (b"Origin", "//origin-user:origin-password@example.test")]
+            state["response"]["headers"] = [(b"Location", "https://location-user:location-password@example.test/to")]
+            state["metadata"]["_markers"] = dict(markers)
+            state["metadata"]["_private_properties"] = {"private-property/~": {"number": 123, "bytes": b"private-property"}, "kept": 7}
+        with (root / "string-urls.mitm").open("wb") as handle:
+            tnetstring.dump(strings, handle)
+        strings["metadata"]["_private_properties"]["private-property/~"] = {1: b"unsupported-key"}
+        with (root / "invalid-private-key.mitm").open("wb") as handle:
+            tnetstring.dump(strings, handle)
+        extension = "leaf"
+        for _ in range(66):
+            extension = {"child": extension}
+        har["_extension"] = extension
+        (root / "deep.har").write_text(json.dumps(har))
+        deep = first.get_state()
+        deep["_extension"] = extension
+        with (root / "deep.mitm").open("wb") as handle:
+            tnetstring.dump(deep, handle)
+        for name, value in [("invalid-credential-key", {1: b"bad-key"}), ("deep-credential", extension)]:
+            malformed = first.get_state()
+            malformed["request"]["headers"] = [(b"Authorization", value)]
+            with (root / (name + ".mitm")).open("wb") as handle:
+                tnetstring.dump(malformed, handle)
+        for prefix, name in [(" \t", "ows"), ("\r\n \v\f\x00\x1f", "controls")]:
+            url = prefix + "HTTPS://ows-user:ows-secret@example.test/path?token=ordinary#fragment\t "
+            relative = prefix + "//ows-user:ows-secret@example.test/path?token=ordinary#fragment\t "
+            whitespace_har = json.loads((root / "producer.har").read_text())
+            entry = whitespace_har["log"]["entries"][0]
+            for side, header in [("response", "Location"), ("request", "Referer"), ("request", "Origin")]:
+                entry[side]["headers"] = [{"name": header, "value": url}] + entry[side]["headers"]
+            (root / (name + ".har")).write_text(json.dumps(whitespace_har))
+            whitespace_native = first.get_state()
+            for state in [whitespace_native, whitespace_native["backup"]]:
+                state["request"]["headers"] = [(b"Referer", url.encode("utf-8")), (b"Origin", relative)]
+                state["response"]["headers"] = [(b"Location", url)]
+            with (root / (name + ".mitm")).open("wb") as handle:
+                tnetstring.dump(whitespace_native, handle)
+        non_utf8_native = first.get_state()
+        for state in [non_utf8_native, non_utf8_native["backup"]]:
+            state["request"]["path"] = b"https://byte-user:byte-secret@example.test/path\xff"
+            state["request"]["authority"] = b"byte-user:byte-secret@example.test\xff"
+            state["request"]["headers"] = [(b"Referer", b" https://byte-user:byte-secret@example.test/from\xff"), (b"Origin", b"//byte-user:byte-secret@example.test\xff")]
+            state["response"]["headers"] = [(b"Location", b"https://byte-user:byte-secret@example.test/to\xff")]
+        with (root / "non-utf8-urls.mitm").open("wb") as handle:
+            tnetstring.dump(non_utf8_native, handle)
+        (root / "oracle.json").write_text(json.dumps({"records": 2, "request_base64": "AP9ib2R5", "response_base64": "AP5hbnN3ZXI=", "websocket_base64": "AP1tZXNzYWdl", "id": first.id}))
+        ctx.master.shutdown()
+
+addons = [Generator()]
@@ -0,0 +1,24 @@
+#include <stdint.h>
+#include <pthread.h>
+#include <stdatomic.h>
+#include <unistd.h>
+static atomic_int ready;
+static void *recorded_thread(void *unused) {
+  (void)unused;
+  __asm__ volatile("movabs $0xfedcba9876543210, %%r12" ::: "r12");
+  atomic_store(&ready, 1);
+  for (;;) pause();
+  return 0;
+}
+__attribute__((noinline)) static void fixture_crash(uint64_t value) {
+  volatile uint64_t *pointer = (volatile uint64_t *)(uintptr_t)0x123;
+  *pointer = value;
+}
+int main(void) {
+  pthread_t thread;
+  pthread_attr_t attr;
+  if (pthread_attr_init(&attr) || pthread_attr_setstacksize(&attr, 65536) || pthread_create(&thread, &attr, recorded_thread, 0)) return 1;
+  while (!atomic_load(&ready)) usleep(1000);
+  fixture_crash(UINT64_C(0x1122334455667788));
+  return 0;
+}
@@ -30,7 +30,7 @@ const { stdout } = await exec(
  },
 );
 const verifierOutput = JSON.parse(stdout);
-// Managed conformance claims are host-independent. Keep the checked-in
+// Managed conformance claims are host-independent. Keep the generated
 // commitment reproducible across macOS, Linux, and Windows rather than
 // embedding the machine that happened to generate it.
 const portableCompletionReport = {
@@ -17,8 +17,9 @@ for (const argument of arguments_)
    throw new Error(`Unknown MCP tool catalog option: ${argument}`);

 const root = join(dirname(fileURLToPath(import.meta.url)), "..");
-// The checked-in catalog is a portable package artifact. Keep its canonical
-// provider metadata independent of the machine running the generator.
+// The build-generated catalog is a portable package artifact that is not
+// committed to git. Keep its canonical provider metadata independent of the
+// machine running the generator. It is regenerated by `npm run build`.
 const CATALOG_PLATFORM = "darwin";
 const sessionToolNames = new Set([
  ...TOOL_CONTRACTS.filter(({ kind }) => kind === "session").map(
@@ -17,7 +17,7 @@ const lock = JSON.parse(
  await readFile(join(root, "package-lock.json"), "utf8"),
 );
 const skill = await readFile(
-  join(root, "skills/reverse-engineer-anything/SKILL.md"),
+  join(root, "skill-src/reverse-engineer-anything/SKILL.md"),
  "utf8",
 );
 const skillVersion = /^\s{2}version:\s*"([^"]+)"\s*$/mu.exec(skill)?.[1];
@@ -1,3 +1,4 @@
+import { mkdir } from "node:fs/promises";
 import { dirname, join } from "node:path";
 import { fileURLToPath } from "node:url";

@@ -14,8 +15,10 @@ for (const argument of arguments_)

 const root = join(dirname(fileURLToPath(import.meta.url)), "..");
 const catalog = await createProductCatalog(root);
+const path = join(root, "docs/public/product-catalog.json");
+if (!arguments_.has("--check")) await mkdir(dirname(path), { recursive: true });
 await ensureGeneratedFile({
-  path: join(root, "docs/product-catalog.json"),
+  path,
  source: await serializeProductCatalog(catalog),
  check: arguments_.has("--check"),
  generateCommand: "npm run docs:generate",
@@ -1,4 +1,4 @@
-import { readFile } from "node:fs/promises";
+import { mkdir, readFile, readdir, rm } from "node:fs/promises";
 import { dirname, join } from "node:path";
 import { fileURLToPath, pathToFileURL } from "node:url";

@@ -10,26 +10,69 @@ for (const argument of arguments_)
    throw new Error(`Unknown skill metadata option: ${argument}`);

 const root = join(dirname(fileURLToPath(import.meta.url)), "..");
-const path = join(root, "skills/reverse-engineer-anything/SKILL.md");
-const current = await readFile(path, "utf8");
+const sourceRoot = join(root, "skill-src/reverse-engineer-anything");
+const outputRoot = join(root, "skills/reverse-engineer-anything");
+const check = arguments_.has("--check");
+const current = (
+  await readFile(join(sourceRoot, "SKILL.md"), "utf8")
+).replaceAll("\r\n", "\n");
 const { CATALOG_IDENTITY } = await import(
  `${pathToFileURL(join(root, "dist/catalogIdentity.js")).href}?${String(Date.now())}`
 );
-const withCount = current.replace(
-  /^\s{2}tool_count:\s*\d+\s*$/mu,
-  `  tool_count: ${String(CATALOG_IDENTITY.counts.mcp_tools)}`,
+if (/^\s{2}(?:tool_count|catalog_digest):/mu.test(current))
+  throw new Error(
+    "Catalog metadata belongs in the generated skill, not skill-src",
+  );
+const versionLine = /^ {2}version: "[^"\r\n]+"$/mu;
+if (!versionLine.test(current))
+  throw new Error("Missing authored skill version");
+const source = current.replace(
+  versionLine,
+  `$&\n  tool_count: ${String(CATALOG_IDENTITY.counts.mcp_tools)}`,
 );
-const digestLine = `  catalog_digest: "${CATALOG_IDENTITY.digests.combined_sha256}"`;
-const source = /^\s{2}catalog_digest:/mu.test(withCount)
-  ? withCount.replace(
-      /^\s{2}catalog_digest:\s*"[a-f0-9]{64}"\s*$/mu,
-      digestLine,
-    )
-  : withCount.replace(/^(\s{2}tool_count:\s*\d+\s*)$/mu, `$1\n${digestLine}`);
+const paths = await filePaths(sourceRoot);
+// Rebuild this owned output directory so removed references cannot survive a build.
+if (!check) await rm(outputRoot, { recursive: true, force: true });
+for (const relativePath of paths) {
+  const path = join(outputRoot, relativePath);
+  if (!check) await mkdir(dirname(path), { recursive: true });
+  await ensureGeneratedFile({
+    path,
+    source:
+      relativePath === "SKILL.md"
+        ? source
+        : (await readFile(join(sourceRoot, relativePath), "utf8")).replaceAll(
+            "\r\n",
+            "\n",
+          ),
+    check,
+    generateCommand: "npm run docs:generate",
+  });
+}
+if (
+  check &&
+  JSON.stringify(await filePaths(outputRoot)) !== JSON.stringify(paths)
+)
+  throw new Error(
+    "Generated skill file inventory drifted; run npm run docs:generate",
+  );

-await ensureGeneratedFile({
-  path,
-  source,
-  check: arguments_.has("--check"),
-  generateCommand: "npm run docs:generate",
-});
+async function filePaths(directory, prefix = "") {
+  const paths = [];
+  for (const entry of (await readdir(directory, { withFileTypes: true })).sort(
+    (left, right) =>
+      left.name < right.name ? -1 : left.name > right.name ? 1 : 0,
+  )) {
+    const relativePath = prefix === "" ? entry.name : `${prefix}/${entry.name}`;
+    if (entry.isDirectory())
+      paths.push(
+        ...(await filePaths(join(directory, entry.name), relativePath)),
+      );
+    else if (entry.isFile()) paths.push(relativePath);
+    else
+      throw new Error(
+        `Skill bundle requires regular files or directories: ${relativePath}`,
+      );
+  }
+  return paths;
+}
@@ -38,7 +38,7 @@ export async function artifactCliEvidence(command, target, arguments_ = []) {
  return evidence;
 }

-/** Run a real stdio MCP subprocess, owning and closing its transport. */
+/** Run a real stdio MCP subprocess, owning and closing its transport; open `target` unless it is null. */
 export async function withArtifactMcp(target, verify) {
  const transport = new StdioClientTransport({
    command: process.execPath,
@@ -49,11 +49,14 @@ export async function withArtifactMcp(target, verify) {
  const client = new Client({ name: "artifact-real-e2e", version: "1" });
  try {
    await client.connect(transport);
-    const opened = await client.callTool({
-      name: "open_binary",
-      arguments: { path: target },
-    });
-    assert.notEqual(opened.isError, true, JSON.stringify(opened));
+    // Target-free tools pass `null` and need no open session.
+    if (target !== null) {
+      const opened = await client.callTool({
+        name: "open_binary",
+        arguments: { path: target },
+      });
+      assert.notEqual(opened.isError, true, JSON.stringify(opened));
+    }
    await verify(client);
  } finally {
    await client.close();
@@ -1,5 +1,8 @@
 import assert from "node:assert/strict";
 import { execFile } from "node:child_process";
+import { mkdtemp, readFile, rm } from "node:fs/promises";
+import { tmpdir } from "node:os";
+import { join } from "node:path";
 import { promisify } from "node:util";
 import { fileURLToPath } from "node:url";
 import { chromium } from "playwright-core";
@@ -62,13 +65,21 @@ export async function verifyLargeScreenshotE2e(endpoint, origin) {
    );
    assert.equal(bytes.readUInt32BE(16), 2048);
    assert.equal(bytes.readUInt32BE(20), 1536);
+    await verifyDefaultScreenshotDelivery({
+      entrypoint,
+      environment: env,
+      endpoint,
+      targetId: target.id,
+      screenshot,
+    });
+    const maxBufferSize = 64 * 1024 * 1024;
    transport = new StdioClientTransport({
      command: process.execPath,
      args: [entrypoint, "mcp"],
-      env,
+      env: { ...env, REA_MCP_MAX_RESPONSE_BYTES: String(maxBufferSize) },
      stderr: "pipe",
      // The SDK defaults to a 10 MiB receive buffer; inline PNG output is larger.
-      maxBufferSize: 64 * 1024 * 1024,
+      maxBufferSize,
    });
    client = new Client({ name: "browser-screenshot-real-e2e", version: "1" });
    await client.connect(transport);
@@ -102,6 +113,9 @@ export async function verifyLargeScreenshotE2e(endpoint, origin) {
      mocked: false,
      cli: true,
      stdio_mcp: true,
+      default_buffer_recovery: true,
+      complete_export: true,
+      matched_large_buffer: true,
      png_bytes: bytes.byteLength,
    };
  } finally {
@@ -117,3 +131,73 @@ export async function verifyLargeScreenshotE2e(endpoint, origin) {
    }
  }
 }
+
+const verifyDefaultScreenshotDelivery = async ({
+  entrypoint,
+  environment,
+  endpoint,
+  targetId,
+  screenshot,
+}) => {
+  const workspace = await mkdtemp(join(tmpdir(), "rea-screenshot-delivery-"));
+  const transport = new StdioClientTransport({
+    command: process.execPath,
+    args: [entrypoint, "mcp"],
+    env: environment,
+    stderr: "pipe",
+  });
+  const client = new Client({
+    name: "browser-screenshot-default-e2e",
+    version: "1",
+  });
+  try {
+    await client.connect(transport);
+    const constrained = await client.callTool(
+      {
+        name: "capture_web_screenshot",
+        arguments: { cdp_endpoint: endpoint, target_id: targetId },
+      },
+      { timeout: 60000 },
+    );
+    assert.equal(constrained.isError, true);
+    assert.equal(
+      constrained.structuredContent?.error?.details?.resource,
+      "transport",
+    );
+    const reference =
+      constrained.structuredContent?.error?.details?.reported_limits
+        ?.evidence_reference;
+    assert.equal(reference?.kind, "retained-evidence");
+    await client.ping();
+    const exported = await client.callTool({
+      name: "export_evidence_bundle",
+      arguments: { path: join(workspace, "screenshot-evidence.json") },
+    });
+    assert.notEqual(exported.isError, true, JSON.stringify(exported));
+    const bundle = JSON.parse(
+      await readFile(join(workspace, "screenshot-evidence.json"), "utf8"),
+    );
+    const record = bundle.records.find(
+      (record) => record.evidence_id === reference.evidence_id,
+    );
+    assert.ok(
+      record,
+      "Full screenshot Evidence must remain exportable after the delivery constraint",
+    );
+    const retained = webScreenshotSchema.parse(
+      parseEvidence(record).normalized_result,
+    );
+    assert.deepEqual(retained.artifact, screenshot.artifact);
+    await client.ping();
+  } finally {
+    try {
+      await client.close();
+    } finally {
+      try {
+        await transport.close();
+      } finally {
+        await rm(workspace, { recursive: true, force: true });
+      }
+    }
+  }
+};
@@ -16,12 +16,18 @@ export const toolFamilyCatalog = (sources) => {
    {
      id: "native",
      surface: "native-provider",
-      contracts: sources.nativeContracts.NATIVE_TOOL_CONTRACTS,
+      contracts: [
+        ...sources.nativeContracts.NATIVE_TOOL_CONTRACTS,
+        ...sources.binaryDiagnosticsContracts.BINARY_DIAGNOSTICS_TOOL_CONTRACTS,
+      ],
    },
    {
      id: "artifact",
      surface: "artifact-provider",
-      contracts: sources.artifactContracts.ARTIFACT_TOOL_CONTRACTS,
+      contracts: [
+        ...sources.artifactContracts.ARTIFACT_TOOL_CONTRACTS,
+        ...sources.evmContracts.EVM_TOOL_CONTRACTS,
+      ],
    },
    {
      id: "managed",
@@ -48,6 +54,8 @@ export const toolFamilyCatalog = (sources) => {
        ...sources.browserContracts.BROWSER_TOOL_CONTRACTS,
        ...sources.webRuntimeContracts.WEB_RUNTIME_TOOL_CONTRACTS,
        ...sources.browserScenarioContracts.BROWSER_SCENARIO_TOOL_CONTRACTS,
+        ...sources.webNetworkCaptureContracts
+          .WEB_NETWORK_CAPTURE_TOOL_CONTRACTS,
      ],
    },
    {
@@ -141,6 +149,15 @@ export const providerCatalog = (sources) => {
      identity: sources.nativeProvider.NATIVE_MACOS_PROVIDER_IDENTITY,
      contracts: sources.nativeContracts.NATIVE_TOOL_CONTRACTS,
    },
+    {
+      identity: sources.pwntoolsProvider.PWNTOOLS_PROVIDER_IDENTITY,
+      contracts:
+        sources.binaryDiagnosticsContracts.BINARY_DIAGNOSTICS_TOOL_CONTRACTS,
+    },
+    {
+      identity: sources.evmProvider.EVMOLE_PROVIDER_IDENTITY,
+      contracts: sources.evmContracts.EVM_TOOL_CONTRACTS,
+    },
    {
      identity: sources.artifactProviders.ARTIFACT_GRAPH_PROVIDER,
      contracts: sources.artifactContracts.ARTIFACT_TOOL_CONTRACTS,
@@ -170,6 +187,17 @@ export const providerCatalog = (sources) => {
      identity: sources.androidProvider.JADX_PROVIDER_IDENTITY,
      contracts: sources.androidContracts.ANDROID_TOOL_CONTRACTS,
    },
+    {
+      identity: sources.webNetworkCaptureProvider.HAR_CAPTURE_PROVIDER_IDENTITY,
+      contracts:
+        sources.webNetworkCaptureContracts.WEB_NETWORK_CAPTURE_TOOL_CONTRACTS,
+    },
+    {
+      identity:
+        sources.webNetworkCaptureProvider.MITMPROXY_CAPTURE_PROVIDER_IDENTITY,
+      contracts:
+        sources.webNetworkCaptureContracts.WEB_NETWORK_CAPTURE_TOOL_CONTRACTS,
+    },
    {
      identity: sources.browserProvider.CDP_BROWSER_PROVIDER_IDENTITY,
      contracts: [
@@ -215,7 +243,8 @@ export const providerCatalog = (sources) => {
      contracts: sources.applicationContracts.APPLICATION_TOOL_CONTRACTS.filter(
        ({ name }) =>
          name !== "project_android_application_graph" &&
-          name !== "project_apple_application_graph",
+          name !== "project_apple_application_graph" &&
+          name !== "inspect_dyld_shared_cache",
      ),
    },
    {
@@ -227,7 +256,9 @@ export const providerCatalog = (sources) => {
    {
      identity: sources.artifactProviders.APPLE_APPLICATION_PROVIDER,
      contracts: sources.applicationContracts.APPLICATION_TOOL_CONTRACTS.filter(
-        ({ name }) => name === "project_apple_application_graph",
+        ({ name }) =>
+          name === "project_apple_application_graph" ||
+          name === "inspect_dyld_shared_cache",
      ),
    },
    {
@@ -40,7 +40,12 @@ const SOURCE_PATHS = {
  officialContracts: "dist/contracts/officialToolContracts.js",
  enhancedContracts: "dist/contracts/enhancedToolContracts.js",
  sessionContracts: "dist/contracts/sessionToolContracts.js",
+  binaryDiagnosticsContracts:
+    "dist/contracts/native/binaryDiagnosticsToolContracts.js",
+  pwntoolsProvider: "dist/native/pwntools/PwntoolsRelease.js",
  nativeContracts: "dist/contracts/native/nativeToolContracts.js",
+  evmContracts: "dist/contracts/evm/evmToolContracts.js",
+  evmProvider: "dist/evm/EvmoleRelease.js",
  artifactContracts: "dist/contracts/artifactToolContracts.js",
  managedContracts: "dist/contracts/managed/managedToolContracts.js",
  firmwareContracts: "dist/contracts/firmware/firmwareToolContracts.js",
@@ -51,6 +56,9 @@ const SOURCE_PATHS = {
    "dist/contracts/managed/managedWorkflowToolContracts.js",
  browserContracts: "dist/contracts/browserToolContracts.js",
  webRuntimeContracts: "dist/contracts/webRuntimeToolContracts.js",
+  webNetworkCaptureContracts:
+    "dist/contracts/webNetworkCaptureToolContracts.js",
+  webNetworkCaptureProvider: "dist/browser/history/CaptureRelease.js",
  browserScenarioContracts: "dist/contracts/browserScenarioToolContracts.js",
  electronContracts: "dist/contracts/javascript/electronToolContracts.js",
  javascriptRuntimeObservationContracts:
@@ -75,7 +83,7 @@ const SOURCE_PATHS = {
  evidenceBundle: "dist/domain/evidenceBundle.js",
  evidenceCompletion: "dist/domain/evidenceCompletionLedger.js",
  completionGeneration: "dist/domain/completionLedgerGeneration.js",
-  processCapture: "dist/domain/processCapture.js",
+  processCapture: "dist/domain/process/processCapture.js",
  analysisSnapshot: "dist/domain/analysisSnapshot.js",
  artifactGraph: "dist/domain/artifactGraph.js",
  browserObservation: "dist/domain/browserObservation.js",
@@ -75,6 +75,16 @@ export const documentationFactIssues = async (root, catalog) => {
  for (const path of README_PATHS) {
    const content = await readFile(join(root, path), "utf8");
    requireText(issues, path, content, "MCP-tool_catalog");
+    if (path === "README.md") {
+      requireText(issues, path, content, "(docs/installation.md");
+      requireText(
+        issues,
+        path,
+        content,
+        "(docs/mcp-contracts.md#generated-catalog)",
+      );
+      continue;
+    }
    for (const client of catalog.setup_clients)
      requireText(issues, path, content, client.display_name);
    try {
@@ -88,15 +98,23 @@ export const documentationFactIssues = async (root, catalog) => {
    }
  }

+  const installationPath = "docs/installation.md";
+  const installation = await readFile(join(root, installationPath), "utf8");
+  for (const client of catalog.setup_clients)
+    requireText(issues, installationPath, installation, client.display_name);
+
  const agents = await readFile(join(root, "AGENTS.md"), "utf8");
-  requireText(issues, "AGENTS.md", agents, "docs/product-catalog.json");
+  requireText(issues, "AGENTS.md", agents, "docs/public/product-catalog.json");

  const templatePath = ".github/pull_request_template.md";
  const template = await readFile(join(root, templatePath), "utf8");
-  requireText(issues, templatePath, template, "docs/product-catalog.json");
+  requireText(
+    issues,
+    templatePath,
+    template,
+    "docs/public/product-catalog.json",
+  );

-  const english = await readFile(join(root, "README.md"), "utf8");
-  requireText(issues, "README.md", english, "docs/product-catalog.json");
  return issues;
 };

@@ -0,0 +1,88 @@
+import assert from "node:assert/strict";
+
+/** Source-owned ELF64 mutations for declared, absent and escaped name-table references. */
+export const sectionNameFixtures = (original, report) => {
+  // ELF gABI: https://gabi.xinuos.com/elf/02-eheader.html#e-shstrndx
+  // SHN_XINDEX must carry an actual index >= SHN_LORESERVE, not a small index.
+  const sourceTable = report.sections[original.readUInt16LE(62)];
+  assert.equal(sourceTable.type, "SHT_STRTAB");
+  const sourceHeader = Number(BigInt(sourceTable.header_location.offset));
+  const fixtures = [];
+  for (const problem of [
+    "out-of-range",
+    "wrong-type",
+    "undeclared-header",
+    "extended-undeclared-header",
+    "extended-without-sections",
+    "extended-absent",
+    "extended-small",
+  ]) {
+    let bytes = Buffer.from(original);
+    let selected = report.sections.length + 100;
+    if (problem === "wrong-type")
+      selected = report.sections.find(
+        (section) => section.type === "SHT_PROGBITS",
+      ).index;
+    else if (problem.includes("undeclared-header")) {
+      const end =
+        Number(bytes.readBigUInt64LE(40)) +
+        report.sections.length * bytes.readUInt16LE(58);
+      const extended = Buffer.alloc(Math.max(bytes.length, end + 64));
+      bytes.copy(extended);
+      bytes.copy(extended, end, sourceHeader, sourceHeader + 64);
+      bytes = extended;
+      selected = report.sections.length;
+    }
+    if (problem === "extended-without-sections") {
+      bytes.writeBigUInt64LE(0n, 40);
+      bytes.writeUInt16LE(0, 60);
+      bytes.writeUInt16LE(0xffff, 62);
+    } else if (problem.startsWith("extended-")) {
+      bytes.writeUInt16LE(0xffff, 62);
+      if (problem === "extended-absent") selected = 0;
+      if (problem === "extended-small") selected = sourceTable.index;
+      bytes.writeUInt32LE(selected, Number(bytes.readBigUInt64LE(40)) + 40);
+    } else bytes.writeUInt16LE(selected, 62);
+    fixtures.push({ name: problem, bytes, expectation: "invalid_input" });
+  }
+  const absent = Buffer.from(original);
+  absent.writeUInt16LE(0, 62);
+  fixtures.push({ name: "absent", bytes: absent, expectation: "absent" });
+
+  // A genuine escape requires a large table. Relocate the original table, keep
+  // its referenced indices and move only the name table to index SHN_LORESERVE.
+  const selected = 0xff00,
+    count = selected + 1;
+  const start = Math.ceil(original.length / 8) * 8;
+  const large = Buffer.alloc(start + count * 64);
+  original.copy(large);
+  const oldStart = Number(original.readBigUInt64LE(40));
+  original.copy(large, start, oldStart, oldStart + report.sections.length * 64);
+  large.fill(
+    0,
+    start + sourceTable.index * 64,
+    start + (sourceTable.index + 1) * 64,
+  );
+  original.copy(large, start + selected * 64, sourceHeader, sourceHeader + 64);
+  large.writeBigUInt64LE(BigInt(start), 40);
+  large.writeUInt16LE(0, 60);
+  large.writeUInt16LE(0xffff, 62);
+  large.writeBigUInt64LE(BigInt(count), start + 32);
+  large.writeUInt32LE(selected, start + 40);
+  fixtures.push({
+    name: "extended-large",
+    bytes: large,
+    expectation: "resolved",
+    tableIndex: selected,
+    sectionCount: count,
+  });
+  const reserved = Buffer.from(large);
+  reserved.writeUInt16LE(selected, 62);
+  reserved.writeUInt32LE(0, start + 40);
+  fixtures.push({
+    name: "direct-reserved",
+    bytes: reserved,
+    expectation: "invalid_input",
+  });
+  return fixtures;
+};
@@ -33,7 +33,7 @@ export const ensureGeneratedFile = async ({
    return { changed: false };
  if (check)
    throw new Error(
-      `${path} is missing or stale. Run \`${generateCommand}\` and commit the result.`,
+      `${path} is missing or stale. Run \`${generateCommand}\` to regenerate it; commit the result if the file is tracked.`,
    );
  await writeFile(path, preserveLineEndings(source, existing), "utf8");
  return { changed: true };
@@ -0,0 +1,30 @@
+import { Client } from "@modelcontextprotocol/client";
+import { StdioClientTransport } from "@modelcontextprotocol/client/stdio";
+
+/** Own one SDK client with an explicit receive budget for a large complete result. */
+export const withLargeResultMcp = async (
+  { entrypoint, environment, maxBufferSize },
+  useClient,
+) => {
+  const client = new Client({ name: "large-result-verifier", version: "1" });
+  const transport = new StdioClientTransport({
+    command: process.execPath,
+    args: [entrypoint, "mcp"],
+    env: {
+      ...environment,
+      REA_MCP_MAX_RESPONSE_BYTES: String(maxBufferSize),
+    },
+    stderr: "inherit",
+    maxBufferSize,
+  });
+  try {
+    await client.connect(transport);
+    return await useClient(client);
+  } finally {
+    try {
+      await client.close();
+    } finally {
+      await transport.close();
+    }
+  }
+};
@@ -6,6 +6,7 @@ export interface ModuleBoundaryViolation {
  readonly target: string;
  readonly boundary:
    | "artifact-acquisition"
+    | "process-capture"
    | "pure-layer"
    | "application-composition"
    | "provider-construction"
@@ -5,6 +5,7 @@ import { fileURLToPath, pathToFileURL } from "node:url";

 const PURE_LAYERS = new Set(["domain", "contracts"]);
 const MIGRATED_PROVIDER_ROOTS = new Set([
+  "evm",
  "android",
  "firmware",
  "ghidra",
@@ -60,6 +61,14 @@ const failedBoundary = (file, target) => {
  if (!file.startsWith("src/") || !target.startsWith("src/")) return undefined;
  const layer = file.split("/")[1];
  const targetLayer = target.split("/")[1];
+  if (
+    file.startsWith("src/process/capture/") &&
+    (["application", "composition", "server", "cli", "main"].includes(
+      targetLayer,
+    ) ||
+      /^src\/(?:cli|main)\./u.test(target))
+  )
+    return "process-capture";
  if (
    file.startsWith("src/application/javascript/") &&
    /^src\/artifacts\/(?:Asar|Directory)ArtifactReader\.(?:js|ts)$/u.test(
@@ -70,6 +79,8 @@ const failedBoundary = (file, target) => {
  if (
    (file.startsWith("src/artifacts/javascript/") ||
      file.startsWith("src/artifacts/apple/") ||
+      file.startsWith("src/artifacts/inventory/") ||
+      file.startsWith("src/artifacts/extraction/") ||
      /^src\/artifacts\/ArtifactHash\.(?:js|ts)$/u.test(file)) &&
    (["application", "composition", "server", "cli", "main"].includes(
      targetLayer,
@@ -58,16 +58,16 @@ export const createProductCatalog = async (root) => {
    runtime_catalog: {
      counts: sources.catalogIdentity.CATALOG_IDENTITY.counts,
      digests: {
-        ...sources.catalogIdentity.CATALOG_IDENTITY.digests,
+        // Full runtime schema digests belong to server identity, not this facts projection.
        providers_sha256: providerCatalogDigest(providers),
      },
    },
  };
 };

-/** Stable checked-in representation of the product catalog. */
+/** Stable build-generated representation of the product catalog. */
 export const serializeProductCatalog = (catalog) =>
  formatGeneratedFile(
-    "docs/product-catalog.json",
+    "docs/public/product-catalog.json",
    JSON.stringify(catalog, null, 2),
  );
@@ -0,0 +1,94 @@
+"""Source-owned mutations built with the same unchanged upstream ELF/ABI structures."""
+import ctypes
+import io
+import json
+from pathlib import Path
+import sys
+from elftools.elf.elffile import ELFFile
+from elftools.construct import Container
+from pwnlib.elf.datatypes import elf_prstatus_amd64
+
+source, directory, sentinel = Path(sys.argv[1]), Path(sys.argv[2]), int(sys.argv[3])
+original = source.read_bytes()
+image = ELFFile(io.BytesIO(original))
+segments = list(image.iter_segments())
+notes = [note for segment in segments if segment.header.p_type == "PT_NOTE" for note in segment.iter_notes()]
+status = next(note for note in notes if note.n_name == "CORE" and note.n_type == "NT_PRSTATUS")
+descriptor_start = lambda note: note.n_offset + image.structs.Elf_Nhdr.sizeof() + ((note.n_namesz + 3) // 4) * 4
+files = {}
+
+
+def save(name, content):
+    path = directory / (name + ".core")
+    path.write_bytes(content)
+    files[name] = str(path)
+
+
+def note_header(content, note, **changes):
+    header = dict(note)
+    header.update(changes)
+    encoded = image.structs.Elf_Nhdr.build(Container(**header))
+    content[note.n_offset:note.n_offset + len(encoded)] = encoded
+
+
+save("truncated-header", original[:32])
+for name, osabi, version in [("linux-osabi", 3, 0), ("solaris-osabi", 6, 0), ("freebsd-osabi", 9, 0), ("unsupported-abi-version", 0, 1)]:
+    content = bytearray(original)
+    content[7:9] = bytes([osabi, version])
+    save(name, content)
+content = bytearray(original)
+section = Container(sh_name=0, sh_type="SHT_NULL", sh_flags=0, sh_addr=0, sh_offset=0, sh_size=0, sh_link=0, sh_info=len(segments), sh_addralign=0, sh_entsize=0)
+content.extend(image.structs.Elf_Shdr.build(section))
+header = Container(**dict(image.header, e_phnum=0xffff, e_shoff=len(original), e_shentsize=image.structs.Elf_Shdr.sizeof(), e_shnum=1, e_shstrndx=0))
+content[:image.structs.Elf_Ehdr.sizeof()] = image.structs.Elf_Ehdr.build(header)
+save("extended-program-count", content)
+for index, segment in enumerate(segments):
+    if segment.header.p_type != "PT_NOTE":
+        continue
+    content = bytearray(original)
+    raw_notes = original[segment.header.p_offset:segment.header.p_offset + segment.header.p_filesz]
+    content.extend(raw_notes + b"\0\0\0")
+    header = Container(**dict(segment.header, p_offset=len(original), p_filesz=len(raw_notes) + 3))
+    start = image.header.e_phoff + index * image.header.e_phentsize
+    content[start:start + image.structs.Elf_Phdr.sizeof()] = image.structs.Elf_Phdr.build(header)
+    save("zero-note-tail", content)
+    content[-1] = 1
+    save("nonzero-note-tail", content)
+    break
+content = bytearray(original)
+note_header(content, status, n_descsz=1)
+save("truncated-status", content)
+content = bytearray(original)
+note_header(content, status, n_namesz=len(original))
+save("truncated-owner", content)
+content = bytearray(original)
+content[status.n_offset + image.structs.Elf_Nhdr.sizeof()] = 255
+save("opaque-owner", content)
+content = bytearray(original)
+for note in notes:
+    if note.n_type == "NT_SIGINFO":
+        note_header(content, note, n_type=0x7ffeff)
+save("unknown-signals", content)
+content = bytearray(original)
+for index, segment in enumerate(segments):
+    if segment.header.p_type == "PT_NOTE":
+        header = dict(segment.header, p_type="PT_NULL")
+        encoded = image.structs.Elf_Phdr.build(Container(**header))
+        start = image.header.e_phoff + index * image.header.e_phentsize
+        content[start:start + len(encoded)] = encoded
+save("missing-notes", content)
+content = bytearray(original)
+start = descriptor_start(status) + elf_prstatus_amd64.pr_pid.offset
+content[start:start + ctypes.sizeof(ctypes.c_uint32)] = (0xfffffffe).to_bytes(4, "little")
+save("negative-pid", content)
+content = bytearray(original)
+content[start:start + ctypes.sizeof(ctypes.c_uint32)] = sentinel.to_bytes(4, "little")
+for note in notes:
+    if note.n_name == "CORE" and note.n_type == "NT_PRPSINFO":
+        # Build with unchanged pyelftools; no hard-coded PID offset or host file resolution.
+        raw = dict(note.n_desc, pr_pid=sentinel)
+        encoded = image.structs.Elf_Prpsinfo.build(Container(**raw))
+        offset = descriptor_start(note)
+        content[offset:offset + len(encoded)] = encoded
+save("historical-pid-collision", content)
+print(json.dumps(files))
@@ -0,0 +1,333 @@
+import { gt, major, valid } from "semver";
+import { z } from "zod";
+
+const shaSchema = z.string().regex(/^[a-f0-9]{40}$/u);
+const versionSchema = z.object({ version: z.string() });
+const manifestSchema = z.object({ ".": z.string() });
+const sectionsSchema = z.object({
+  "changelog-sections": z.array(
+    z.object({ type: z.string(), hidden: z.boolean().optional() }),
+  ),
+});
+const GITHUB_MERGE_SUBJECT = /^Merge pull request #(\d+) from \S+/u;
+
+function conventionalTitle(subject, body) {
+  if (!GITHUB_MERGE_SUBJECT.test(subject)) return subject;
+  // GitHub's default merge message puts the PR title after its subject.
+  // Inspect that first nonempty line, not arbitrary examples in commit prose.
+  return (
+    body
+      .split(/\r?\n/u)
+      .slice(1)
+      .find((line) => line.trim() !== "")
+      ?.trim() ?? subject
+  );
+}
+
+function releaseVersion(value, location) {
+  if (valid(value) !== value || value.includes("+")) {
+    throw new Error(
+      `${location} must contain an exact SemVer without build metadata: ${value}`,
+    );
+  }
+  return value;
+}
+
+async function readJson(git, sha, path, schema) {
+  const text = await git(["show", `${sha}:${path}`]);
+  let value;
+  try {
+    value = JSON.parse(text);
+  } catch (error) {
+    if (error instanceof SyntaxError) {
+      throw new Error(`${path}@${sha} contains invalid JSON: ${error.message}`);
+    }
+    throw error;
+  }
+  const parsed = schema.safeParse(value);
+  if (!parsed.success) {
+    throw new Error(`${path}@${sha} is malformed: ${parsed.error.message}`);
+  }
+  return parsed.data;
+}
+
+function readCommits(text) {
+  if (text.length === 0) return [];
+  const fields = text.split("\0");
+  if (fields.pop() !== "" || fields.length % 3 !== 0) {
+    throw new Error("Git returned malformed checkpoint history records.");
+  }
+  const commits = [];
+  for (let index = 0; index < fields.length; index += 3) {
+    const sha = shaSchema.parse(fields[index]);
+    const subject = z.string().parse(fields[index + 1]);
+    const body = z.string().parse(fields[index + 2]);
+    const title = conventionalTitle(subject, body);
+    const type = /^([a-z]+)(?:\([^)]*\))?!?: /u.exec(title)?.[1];
+    commits.push({
+      sha,
+      subject,
+      ...(title !== subject ? { conventionalTitle: title } : {}),
+      type,
+      breaking:
+        /^[a-z]+(?:\([^)]*\))?!: /u.test(title) ||
+        /^BREAKING(?: CHANGE|-CHANGE):\s*\S/mu.test(body),
+    });
+  }
+  return commits;
+}
+
+function referencesCommit(text, commit) {
+  if (text.includes(commit.sha.slice(0, 7))) return true;
+  const pullRequest =
+    GITHUB_MERGE_SUBJECT.exec(commit.subject)?.[1] ??
+    /\(#(\d+)\)$/u.exec(commit.subject)?.[1];
+  return (
+    pullRequest !== undefined &&
+    new RegExp(`#${pullRequest}(?!\\d)`, "u").test(text)
+  );
+}
+
+function releaseNotes(text, expectedVersion) {
+  const headings = Array.from(text.matchAll(/^## \[([^\]]+)\].*$/gmu));
+  const first = headings[0];
+  if (first?.[1] !== expectedVersion || first.index === undefined) {
+    throw new Error(`CHANGELOG.md must start with release ${expectedVersion}.`);
+  }
+  return text.slice(first.index, headings[1]?.index ?? text.length);
+}
+
+function breakingSection(notes) {
+  const heading = /^### [^\n]*BREAKING CHANGES[^\n]*\n/imu.exec(notes);
+  if (heading === null) return "";
+  const body = notes.slice(heading.index + heading[0].length);
+  const end = body.search(/^### /mu);
+  return end < 0 ? body : body.slice(0, end);
+}
+
+async function requireAncestor(git, ancestor, descendant, description) {
+  try {
+    await git(["merge-base", "--is-ancestor", ancestor, descendant]);
+  } catch (error) {
+    const failure = z.object({ code: z.literal(1) }).safeParse(error);
+    if (!failure.success) throw error;
+    throw new Error(
+      `${description}: ${ancestor} is not an ancestor of ${descendant}. Sync the released tag into main before cutting a checkpoint, and prepare candidates from that frozen source.`,
+    );
+  }
+}
+
+async function resolveBaseline(git, tag) {
+  try {
+    return shaSchema.parse(
+      (await git(["rev-parse", "--verify", `${tag}^{commit}`])).trim(),
+    );
+  } catch (error) {
+    const failure = z.object({ code: z.literal(128) }).safeParse(error);
+    if (!failure.success) throw error;
+    throw new Error(
+      `Published baseline ${tag} is unavailable. Fetch release tags and finish the previous release sync before preparing this checkpoint. ${error instanceof Error ? error.message : String(error)}`,
+    );
+  }
+}
+
+async function validateCandidate(git, sha, version, commits) {
+  const versions = [
+    [
+      "package.json",
+      (await readJson(git, sha, "package.json", versionSchema)).version,
+    ],
+    [
+      ".release-please-manifest.json",
+      (
+        await readJson(
+          git,
+          sha,
+          ".release-please-manifest.json",
+          manifestSchema,
+        )
+      )["."],
+    ],
+  ];
+  const lock = await readJson(
+    git,
+    sha,
+    "package-lock.json",
+    versionSchema.extend({
+      packages: z.object({ "": versionSchema }),
+    }),
+  );
+  versions.push(
+    ["package-lock.json", lock.version],
+    ["package-lock.json packages.root", lock.packages[""].version],
+  );
+  const server = await readJson(
+    git,
+    sha,
+    "server.json",
+    versionSchema.extend({
+      packages: z.array(
+        z.object({ identifier: z.string(), version: z.string() }),
+      ),
+    }),
+  );
+  const npmPackage = server.packages.find(
+    (entry) => entry.identifier === "rea-agents",
+  );
+  if (npmPackage === undefined)
+    throw new Error("server.json is missing the rea-agents package.");
+  versions.push(
+    ["server.json", server.version],
+    ["server.json rea-agents package", npmPackage.version],
+  );
+  // Catalogs are generated and checked from this candidate by the release job;
+  // they are not version authority stored in the immutable source tree.
+  const generated = await git([
+    "show",
+    `${sha}:src/generatedPackageMetadata.ts`,
+  ]);
+  const generatedVersions = Array.from(
+    generated.matchAll(/^\s+version: "([^"]+)"/gmu),
+  );
+  if (generatedVersions.length !== 1)
+    throw new Error(
+      "Generated package metadata must declare one literal version.",
+    );
+  versions.push(["src/generatedPackageMetadata.ts", generatedVersions[0]?.[1]]);
+  for (const [location, actual] of versions) {
+    if (actual !== version) {
+      throw new Error(
+        `${location}@${sha} declares ${actual}; release branch requires ${version}.`,
+      );
+    }
+  }
+  const notes = releaseNotes(
+    await git(["show", `${sha}:CHANGELOG.md`]),
+    version,
+  );
+  const breakingNotes = breakingSection(notes);
+  const missingBreaking = commits.filter(
+    (commit) => commit.breaking && !referencesCommit(breakingNotes, commit),
+  );
+  if (missingBreaking.length > 0) {
+    throw new Error(
+      `Release ${version} migration notes omit unreleased breaking changes: ${missingBreaking.map((commit) => `${commit.sha} ${commit.subject}`).join("; ")}`,
+    );
+  }
+  return commits.filter((commit) => !referencesCommit(notes, commit));
+}
+
+/** Validate a recorded checkpoint and optional candidate using exact Git ancestry. */
+export async function inspectReleaseCheckpoint(git, options) {
+  const { phase, stage, releaseBranch, sourceSha, candidateSha } = z
+    .object({
+      phase: z.enum(["prepare", "publish"]),
+      stage: z.enum(["source", "candidate"]),
+      releaseBranch: z.string().startsWith("release/"),
+      sourceSha: shaSchema,
+      candidateSha: shaSchema.optional(),
+    })
+    .parse(options);
+  const expectedVersion = releaseVersion(
+    releaseBranch.slice("release/".length),
+    "release/VERSION",
+  );
+  if (phase === "publish" && stage === "candidate") {
+    throw new Error(
+      "Publish validates its merged source SHA; candidate stage applies only to prepare.",
+    );
+  }
+  const applicationSha =
+    phase === "publish"
+      ? shaSchema.parse((await git(["rev-parse", `${sourceSha}^1`])).trim())
+      : sourceSha;
+  const manifest = await readJson(
+    git,
+    applicationSha,
+    ".release-please-manifest.json",
+    manifestSchema,
+  );
+  const baselineVersion = releaseVersion(
+    manifest["."],
+    "published baseline manifest",
+  );
+  const sourcePackage = await readJson(
+    git,
+    applicationSha,
+    "package.json",
+    versionSchema,
+  );
+  if (sourcePackage.version !== baselineVersion) {
+    throw new Error(
+      `Source package ${sourcePackage.version} and release baseline ${baselineVersion} disagree.`,
+    );
+  }
+  if (!gt(expectedVersion, baselineVersion)) {
+    throw new Error(
+      `Expected release ${expectedVersion} must advance published baseline ${baselineVersion}.`,
+    );
+  }
+  const baselineTag = `refs/tags/rea-agents-${baselineVersion}`;
+  const baselineSha = await resolveBaseline(git, baselineTag);
+  await requireAncestor(
+    git,
+    baselineSha,
+    applicationSha,
+    "Published baseline is outside the checkpoint ancestry",
+  );
+  const configuration = await readJson(
+    git,
+    applicationSha,
+    "release-please-config.json",
+    sectionsSchema,
+  );
+  const visibleTypes = new Set(
+    configuration["changelog-sections"]
+      .filter((section) => !section.hidden)
+      .map((section) => section.type),
+  );
+  const commits = readCommits(
+    await git([
+      "log",
+      "--first-parent",
+      "-z",
+      "--format=%H%x00%s%x00%B",
+      `${baselineSha}..${applicationSha}`,
+    ]),
+  ).filter((commit) => commit.breaking || visibleTypes.has(commit.type));
+  const breaking = commits.filter((commit) => commit.breaking);
+  if (
+    breaking.length > 0 &&
+    major(baselineVersion) > 0 &&
+    major(expectedVersion) <= major(baselineVersion)
+  ) {
+    throw new Error(
+      `Expected release ${expectedVersion} contains unreleased breaking markers since ${baselineVersion}: ${breaking.map((commit) => `${commit.sha} ${commit.subject}`).join("; ")}. Review compatibility or select a major version.`,
+    );
+  }
+  let snapshot = phase === "publish" ? sourceSha : candidateSha;
+  if (stage === "candidate" && snapshot === undefined) {
+    snapshot = shaSchema.parse((await git(["rev-parse", "HEAD"])).trim());
+  }
+  if (phase === "publish" || stage === "candidate") {
+    await requireAncestor(
+      git,
+      applicationSha,
+      snapshot,
+      "Candidate is outside the selected checkpoint ancestry",
+    );
+  }
+  const missingNotes =
+    phase === "publish" || stage === "candidate"
+      ? await validateCandidate(git, snapshot, expectedVersion, commits)
+      : [];
+  return {
+    expectedVersion,
+    baselineVersion,
+    baselineSha,
+    sourceSha,
+    applicationSha,
+    commits,
+    missingNotes,
+  };
+}
@@ -19,7 +19,7 @@ const runtimeFiles = isMcpMode
  ? ["dist/main.js"]
  : isMcpDoctorMode
    ? ["dist/main.js", "dist/mcpDoctor.js"]
-    : ["dist/cli.js", "dist/cliOutput.js"];
+    : ["dist/cli.js", "dist/cliOutput.js", "dist/cli/streamedJsonOutput.js"];

 if (!(await compiledRuntimeExists(runtimeFiles))) {
  process.stderr.write(
@@ -39,6 +39,8 @@ if (!(await compiledRuntimeExists(runtimeFiles))) {
  process.exitCode = result.exitCode;
 } else {
  const { createCli } = await import("../dist/cli.js");
+  const { createStreamedCliJsonOutput } =
+    await import("../dist/cli/streamedJsonOutput.js");
  const {
    renderCliOutputArgumentError,
    renderEmptyFilteredCliOutput,
@@ -51,14 +53,20 @@ if (!(await compiledRuntimeExists(runtimeFiles))) {
    process.exitCode = 1;
  } else {
    let wroteOutput = false;
-    await createCli().serve(args, {
+    const resultOutput = createStreamedCliJsonOutput(args, process.stdout);
+    await createCli(process.env, resultOutput).serve(args, {
      stdout: (output) => {
+        if (resultOutput?.handled) {
+          if (resultOutput.failed)
+            process.stderr.write(sanitizeCliOutput(output));
+          return;
+        }
        const sanitized = sanitizeCliOutput(output);
        if (sanitized.length > 0) wroteOutput = true;
        process.stdout.write(sanitized);
      },
    });
-    if (!wroteOutput)
+    if (!wroteOutput && !resultOutput?.handled)
      process.stdout.write(renderEmptyFilteredCliOutput(args) ?? "");
  }
 }
@@ -0,0 +1,579 @@
+#!/usr/bin/env node
+import assert from "node:assert/strict";
+import { execFile } from "node:child_process";
+import { createHash } from "node:crypto";
+import { access, readFile, readdir, writeFile } from "node:fs/promises";
+import { constants } from "node:fs";
+import { isAbsolute, join } from "node:path";
+import { fileURLToPath, pathToFileURL } from "node:url";
+import { promisify } from "node:util";
+import { Client } from "@modelcontextprotocol/client";
+import { StdioClientTransport } from "@modelcontextprotocol/client/stdio";
+import { PrivateRuntimeRoot } from "../dist/process/PrivateRuntimeRoot.js";
+import { parseEvidence } from "../dist/domain/evidence.js";
+import { mcpTextValue } from "./lib/mcp-verifier-results.mjs";
+import { createVerifierRun, completeVerifierRun } from "./lib/verifier-run.mjs";
+
+const solcModule = process.env.REA_VERIFY_SOLC_MODULE;
+const strace = process.env.REA_VERIFY_STRACE_COMMAND;
+if (
+  process.platform !== "linux" ||
+  process.arch !== "x64" ||
+  !isAbsolute(solcModule ?? "") ||
+  !isAbsolute(strace ?? "")
+)
+  throw new Error(
+    "verify:evm:interface requires Linux x64, caller-supplied util-linux prlimit and absolute REA_VERIFY_SOLC_MODULE pointing to unchanged solc 0.8.30 and absolute REA_VERIFY_STRACE_COMMAND. No target or chain is executed.",
+  );
+try {
+  await access(
+    process.env.REA_EVM_PRLIMIT_COMMAND ?? "/usr/bin/prlimit",
+    constants.X_OK,
+  );
+  await access(solcModule, constants.R_OK);
+  await access(strace, constants.X_OK);
+} catch (cause) {
+  throw new Error(
+    "verify:evm:interface prerequisite unavailable: selected solc module, strace or util-linux prlimit",
+    { cause },
+  );
+}
+const solc = (await import(pathToFileURL(solcModule).href)).default;
+assert.equal(solc.version(), "0.8.30+commit.73712a01.Emscripten.clang");
+const source = await readFile(
+  new URL("./fixtures/evm-interface.sol", import.meta.url),
+  "utf8",
+);
+const entrypoint =
+  process.argv[2] ?? fileURLToPath(new URL("./rea.mjs", import.meta.url));
+const execute = promisify(execFile);
+const environment = Object.fromEntries(
+  Object.entries(process.env).filter(([, value]) => typeof value === "string"),
+);
+const run = createVerifierRun();
+const root = await PrivateRuntimeRoot.create({ prefix: "rea-evm-verifier-" });
+const client = new Client({ name: "evm-interface-verifier", version: "1" });
+const transport = new StdioClientTransport({
+  command: process.execPath,
+  args: [entrypoint, "mcp"],
+  env: environment,
+  stderr: "pipe",
+});
+const failures = [];
+let cases = 0;
+try {
+  await client.connect(transport);
+  const tools = await client.listTools();
+  assert.ok(tools.tools.some(({ name }) => name === "inspect_evm_interface"));
+  const inspect = async (
+    mode,
+    path,
+    encoding,
+    expectedCategory,
+    scope = { command: process.execPath, prefix: [], client },
+  ) => {
+    let value;
+    if (mode === "cli") {
+      let stdout;
+      try {
+        ({ stdout } = await execute(
+          scope.command,
+          [
+            ...scope.prefix,
+            entrypoint,
+            "inspect-evm-interface",
+            path,
+            encoding,
+            "--json",
+          ],
+          {
+            env: scope.environment ?? environment,
+            timeout: 45_000,
+            maxBuffer: 32 * 1024 * 1024,
+          },
+        ));
+      } catch (cause) {
+        if (typeof cause.code !== "number" || typeof cause.stdout !== "string")
+          throw cause;
+        stdout = cause.stdout;
+      }
+      value = JSON.parse(stdout);
+    } else {
+      const reply = await scope.client.callTool({
+        name: "inspect_evm_interface",
+        arguments: { path, encoding },
+      });
+      value = JSON.parse(mcpTextValue(reply));
+      if (expectedCategory !== undefined) {
+        assert.equal(reply.isError, true);
+        value = value.error;
+      } else assert.notEqual(reply.isError, true, mcpTextValue(reply));
+    }
+    if (expectedCategory !== undefined) {
+      assert.equal(value.category, expectedCategory, JSON.stringify(value));
+      return value;
+    }
+    assert.equal(
+      value.category,
+      undefined,
+      `Unexpected public failure: ${JSON.stringify(value)}`,
+    );
+    const evidence = parseEvidence(mode === "cli" ? value : value.evidence);
+    const report = evidence.normalized_result;
+    assert.equal(report.diagnostics.truncated, false);
+    assert.equal(evidence.provider.version, "evmole@0.9.3");
+    assert.equal(evidence.confidence, "inferred");
+    assert.equal(report.artifact.path, path);
+    assert.equal(report.artifact.encoding, encoding);
+    const carrier = await readFile(path);
+    assert.equal(
+      report.artifact.sha256,
+      createHash("sha256").update(carrier).digest("hex"),
+    );
+    assert.equal(evidence.subject.digest.sha256, report.artifact.sha256);
+    assert.equal(report.artifact.bytes, carrier.length);
+    assert.equal(
+      report.bytecode.sha256,
+      createHash("sha256")
+        .update(Buffer.from(report.bytecode.hex, "hex"))
+        .digest("hex"),
+    );
+    assert.equal(report.bytecode.bytes, report.bytecode.hex.length / 2);
+    for (const key of ["kind", "hardfork", "deployment_authenticity"])
+      assert.equal(report.bytecode[key], "unknown");
+    assert.equal(report.discovery_completeness, "unknown");
+    assert.equal(report.runtime_execution, "not-performed");
+    assert.deepEqual(
+      report.functions.map((fn) => ({
+        selector: fn.selector.slice(2),
+        bytecodeOffset: fn.bytecode_offset,
+        dispatch: fn.dispatch,
+        ...(fn.inferred_arguments === null
+          ? {}
+          : { arguments: fn.inferred_arguments }),
+        ...(fn.inferred_state_mutability === null
+          ? {}
+          : { stateMutability: fn.inferred_state_mutability }),
+      })),
+      evidence.raw_result.functions ?? [],
+    );
+    if (mode === "mcp") assert.deepEqual(value.result, report);
+    return report;
+  };
+  for (const [name, optimizer, viaIR] of [
+    ["plain", false, false],
+    ["optimized", true, false],
+    ["via-ir", true, true],
+  ]) {
+    const output = JSON.parse(
+      solc.compile(
+        JSON.stringify({
+          language: "Solidity",
+          sources: { "Interface.sol": { content: source } },
+          settings: {
+            optimizer: { enabled: optimizer, runs: 200 },
+            viaIR,
+            evmVersion: "cancun",
+            outputSelection: {
+              "*": {
+                "*": [
+                  "evm.deployedBytecode.object",
+                  "evm.methodIdentifiers",
+                  "abi",
+                ],
+              },
+            },
+          },
+        }),
+      ),
+    );
+    assert.ok(
+      !output.errors?.some(({ severity }) => severity === "error"),
+      JSON.stringify(output.errors),
+    );
+    const artifact = output.contracts["Interface.sol"].InterfaceFixture;
+    const hex = artifact.evm.deployedBytecode.object;
+    const expected = Object.values(artifact.evm.methodIdentifiers)
+      .map((selector) => "0x" + selector)
+      .sort();
+    const forms = [
+      ["hex", ` \t0x${hex.toUpperCase()}\r\n`],
+      ["raw", Buffer.from(hex, "hex")],
+    ];
+    for (const [encoding, data] of forms) {
+      const path = join(root.path, `${name}.${encoding}`);
+      await writeFile(path, data);
+      const original = await readFile(path);
+      for (const mode of ["cli", "mcp"]) {
+        const report = await inspect(mode, path, encoding);
+        assert.equal(report.bytecode.hex, hex);
+        assert.deepEqual(
+          report.functions
+            .filter(({ dispatch }) => dispatch === "abi")
+            .map(({ selector }) => selector)
+            .sort(),
+          expected,
+        );
+        assert.ok(
+          report.functions.every(
+            ({ bytecode_offset }) => bytecode_offset < report.bytecode.bytes,
+          ),
+        );
+        const set = report.functions.find(
+          ({ selector }) =>
+            selector === "0x" + artifact.evm.methodIdentifiers["set(uint256)"],
+        );
+        assert.equal(set.inferred_arguments, "uint256");
+        assert.equal(set.inferred_state_mutability, "nonpayable");
+        cases++;
+      }
+      assert.deepEqual(await readFile(path), original);
+    }
+  }
+  for (const [name, data, encoding] of [
+    ["empty", "0x", "hex"],
+    ["empty-raw", Buffer.alloc(0), "raw"],
+    ["incomplete-push", Buffer.from([0x7f]), "raw"],
+    ["no-dispatch", "60006000f3", "hex"],
+  ]) {
+    const path = join(root.path, name);
+    await writeFile(path, data);
+    for (const mode of ["cli", "mcp"]) {
+      const report = await inspect(mode, path, encoding);
+      assert.equal(report.functions.length, 0);
+      cases++;
+    }
+  }
+  for (const [name, hex, expected] of [
+    ["zero-selector", "60003560e01c630000000014601057005b00", ["0x00000000"]],
+    ["push-immediate", "63123456785060006000f3", []],
+  ]) {
+    const path = join(root.path, name);
+    await writeFile(path, hex);
+    for (const mode of ["cli", "mcp"]) {
+      const report = await inspect(mode, path, "hex");
+      assert.deepEqual(
+        report.functions.map(({ selector }) => selector),
+        expected,
+      );
+      cases++;
+    }
+  }
+  for (const [encoding, data] of [
+    ["raw", Buffer.from("ef0001", "hex")],
+    ["hex", "0xef0001"],
+  ]) {
+    const path = join(root.path, "eof." + encoding);
+    await writeFile(path, data);
+    for (const mode of ["cli", "mcp"]) {
+      const failure = await inspect(mode, path, encoding, "unsupported_target");
+      assert.equal(failure.code, "unsupported_target");
+      assert.equal(failure.details.path, path);
+      assert.match(failure.details.reason, /EF00/);
+      assert.match(failure.remediation.action, /target format/);
+      cases++;
+    }
+  }
+  for (const [name, data] of [
+    ["odd", "0x1"],
+    ["invalid-hex", "xyz"],
+    ["interior-space", "60 00"],
+    ["bom", "\uFEFF6000"],
+    ["utf8", Buffer.from([0xff])],
+  ]) {
+    const path = join(root.path, name);
+    await writeFile(path, data);
+    for (const mode of ["cli", "mcp"]) {
+      await inspect(mode, path, "hex", "invalid_input");
+      cases++;
+    }
+  }
+  for (const mode of ["cli", "mcp"]) {
+    await inspect(mode, join(root.path, "absent"), "raw", "invalid_input");
+    cases++;
+  }
+  for (const [option, expected] of [
+    ["--as=2147483648", "address_space_bytes=2147483648"],
+    ["--cpu=20", "cpu_seconds=20"],
+    ["--fsize=8388608", "file_size_bytes=8388608"],
+  ]) {
+    const limiter = environment.REA_EVM_PRLIMIT_COMMAND ?? "/usr/bin/prlimit";
+    const prefix = [
+      option,
+      "--",
+      process.execPath,
+      "--disable-wasm-trap-handler",
+    ];
+    const limitedClient = new Client({
+      name: "limited-evm-verifier",
+      version: "1",
+    });
+    const limitedTransport = new StdioClientTransport({
+      command: limiter,
+      args: [...prefix, entrypoint, "mcp"],
+      env: environment,
+      stderr: "pipe",
+    });
+    try {
+      await limitedClient.connect(limitedTransport);
+      const scope = { command: limiter, prefix, client: limitedClient };
+      for (const mode of ["cli", "mcp"]) {
+        const report = await inspect(
+          mode,
+          join(root.path, "zero-selector"),
+          "hex",
+          undefined,
+          scope,
+        );
+        assert.ok(report.limitations.some((item) => item.includes(expected)));
+        cases++;
+      }
+    } finally {
+      try {
+        await limitedClient.close();
+      } finally {
+        await limitedTransport.close();
+      }
+    }
+  }
+  const brokenLimiter = join(root.path, "broken-limiter");
+  await writeFile(brokenLimiter, "#!/rea-verifier-missing-interpreter\n", {
+    mode: 0o700,
+  });
+  const signalLimiter = join(root.path, "signal-limiter");
+  await writeFile(signalLimiter, '#!/bin/sh\nulimit -c 0\nkill -XCPU "$$"\n', {
+    mode: 0o700,
+  });
+  const fileLimiter = join(root.path, "file-size-limiter");
+  const unmarkedLimiter = join(root.path, "unmarked-file-size-limiter");
+  await writeFile(
+    unmarkedLimiter,
+    '#!/bin/sh\nprintf "launcher exit 76\\n" >&2\nexit 76\n',
+    { mode: 0o700 },
+  );
+  // Fixture-only launcher: run the actual Node/WASM worker with a one-byte
+  // file allowance, keeping the usual address-space, CPU and core budgets.
+  await writeFile(
+    fileLimiter,
+    '#!/bin/sh\nwhile [ "$#" -gt 0 ] && [ "$1" != "--" ]; do shift; done\n[ "$#" -gt 0 ] || exit 64\nshift\nexec /usr/bin/prlimit --as=3221225472: --cpu=30: --fsize=1: --core=0: -- "$@"\n',
+    { mode: 0o700 },
+  );
+  for (const [limiter, category, resource] of [
+    [root.path, "unsupported_provider"],
+    [brokenLimiter, "unsupported_provider"],
+    [signalLimiter, "resource_constraint", "cpu"],
+    [fileLimiter, "resource_constraint", "file-size"],
+    [unmarkedLimiter, "execution_failure"],
+  ]) {
+    const selectedEnvironment = {
+      ...environment,
+      REA_EVM_PRLIMIT_COMMAND: limiter,
+    };
+    const selectedClient = new Client({
+      name: "unavailable-evm-limiter-verifier",
+      version: "1",
+    });
+    const selectedTransport = new StdioClientTransport({
+      command: process.execPath,
+      args: [entrypoint, "mcp"],
+      env: selectedEnvironment,
+      stderr: "pipe",
+    });
+    try {
+      await selectedClient.connect(selectedTransport);
+      const scope = {
+        command: process.execPath,
+        prefix: [],
+        client: selectedClient,
+        environment: selectedEnvironment,
+      };
+      for (const mode of ["cli", "mcp"]) {
+        const error = await inspect(
+          mode,
+          join(root.path, "zero-selector"),
+          "hex",
+          category,
+          scope,
+        );
+        if (category === "resource_constraint") {
+          assert.equal(error.code, "resource_constraint");
+          assert.equal(error.details.resource, resource);
+          assert.equal(
+            error.details.reported_limits.effective_soft_limits,
+            null,
+          );
+          assert.equal(
+            typeof error.details.reported_limits.configured_soft_limits
+              .cpu_seconds,
+            "number",
+          );
+          assert.ok(
+            JSON.stringify(error).includes(
+              resource === "cpu" ? "SIGXCPU" : "EFBIG",
+            ),
+          );
+        } else if (category === "execution_failure") {
+          assert.equal(error.code, "execution_failure");
+          assert.ok(JSON.stringify(error).includes("launcher exit 76"));
+          assert.ok(JSON.stringify(error).includes("file_size_failure_marker"));
+        } else {
+          assert.equal(error.code, "capability_unavailable");
+          assert.ok(JSON.stringify(error).includes(limiter));
+        }
+        cases++;
+      }
+    } finally {
+      try {
+        await selectedClient.close();
+      } finally {
+        await selectedTransport.close();
+      }
+    }
+  }
+  for (const [name, encoding] of [
+    ["plain.hex", "hex"],
+    ["via-ir.raw", "raw"],
+  ]) {
+    await execute(
+      strace,
+      [
+        "-ff",
+        "-e",
+        "trace=network,execve,execveat",
+        "-s",
+        "4096",
+        "-o",
+        join(root.path, `offline.trace.${name}`),
+        process.execPath,
+        entrypoint,
+        "inspect-evm-interface",
+        join(root.path, name),
+        encoding,
+        "--json",
+      ],
+      {
+        env: { ...environment, PATH: "/usr/bin:/bin" },
+        timeout: 45_000,
+        maxBuffer: 32 * 1024 * 1024,
+      },
+    );
+  }
+  const observedExecutables = new Set();
+  for (const file of await readdir(root.path)) {
+    if (!file.startsWith("offline.trace.")) continue;
+    const localSocketDescriptors = new Set();
+    for (const line of (await readFile(join(root.path, file), "utf8")).split(
+      "\n",
+    )) {
+      if (/execve(?:at)?\(/.test(line)) {
+        const match = /^execve\("([^"]+)"/.exec(line);
+        assert.notEqual(match, null, `Unresolved executable identity: ${line}`);
+        assert.ok(
+          line.endsWith(" = 0") || / = -1 [A-Z]+/.test(line),
+          `Incomplete exec observation: ${line}`,
+        );
+        const ownershipInspection =
+          ["/usr/bin/ps", "/bin/ps"].includes(match[1]) &&
+          line.includes(
+            '["ps", "-axo", "pid=,ppid=,pgid=,uid=,stat=,command="]',
+          );
+        assert.ok(
+          [
+            process.execPath,
+            environment.REA_EVM_PRLIMIT_COMMAND ?? "/usr/bin/prlimit",
+          ].includes(match[1]) || ownershipInspection,
+          `Unexpected host execution: ${line}`,
+        );
+        observedExecutables.add(match[1]);
+      } else if (/^[a-z]+\(/.test(line)) {
+        assert.ok(
+          permitsStdioSocketObservation(line, localSocketDescriptors),
+          `Unexpected attempted network operation: ${line}`,
+        );
+      }
+    }
+  }
+  assert.ok(observedExecutables.has(process.execPath));
+  assert.ok(
+    observedExecutables.has(
+      environment.REA_EVM_PRLIMIT_COMMAND ?? "/usr/bin/prlimit",
+    ),
+  );
+  cases += 2;
+} catch (cause) {
+  failures.push(cause);
+} finally {
+  for (const close of [
+    () => client.close(),
+    () => transport.close(),
+    () => root.close(),
+  ]) {
+    try {
+      await close();
+    } catch (cause) {
+      failures.push(cause);
+    }
+  }
+}
+const verifier = await completeVerifierRun(run);
+if (
+  verifier.process_lineage.status !== "verified" ||
+  verifier.process_lineage.descendants.length !== 0
+)
+  failures.push(
+    new Error(
+      "Verifier process lineage was not fully released: " +
+        JSON.stringify(verifier),
+    ),
+  );
+console.log(
+  JSON.stringify(
+    {
+      status: failures.length === 0 ? "passed" : "failed",
+      public_cases: cases,
+      compiler: solc.version(),
+      engine: "evmole@0.9.3",
+      ...(failures.length === 0
+        ? {
+            target_execution: "exec-syscalls-verified-absent",
+            network_requests: "socket-syscalls-verified-absent",
+          }
+        : {}),
+      verifier,
+    },
+    null,
+    2,
+  ),
+);
+if (failures.length !== 0)
+  throw new AggregateError(
+    failures,
+    "Offline EVM interface verification failed; cleanup failures retained.",
+  );
+
+function permitsStdioSocketObservation(line, localDescriptors) {
+  if (line.startsWith("socketpair(AF_UNIX,")) {
+    const pair = /\[(\d+), (\d+)\]\)\s+= 0$/.exec(line);
+    if (pair !== null) {
+      localDescriptors.add(pair[1]);
+      localDescriptors.add(pair[2]);
+    }
+    return true;
+  }
+  const name = /^getsockname\((\d+), \{sa_family=AF_UNIX\}/.exec(line);
+  if (name !== null) {
+    localDescriptors.add(name[1]);
+    return true;
+  }
+  // A failed descriptor query performs no request and identifies no socket.
+  if (line.startsWith("getsockname(") && / = -1 ENOTSOCK/.test(line))
+    return true;
+  const metadata =
+    /^(?:getsockopt\((\d+), SOL_SOCKET, SO_TYPE,|setsockopt\((\d+), SOL_SOCKET, SO_(?:RCVBUF|SNDBUF),|shutdown\((\d+), SHUT_WR\))/.exec(
+      line,
+    );
+  const descriptor = metadata?.[1] ?? metadata?.[2] ?? metadata?.[3];
+  // Allow descriptor queries/buffer configuration only after observing a local
+  // stdio socket. Other socket creation, connection and data operations fail.
+  return descriptor !== undefined && localDescriptors.has(descriptor);
+}
@@ -0,0 +1,240 @@
+import assert from "node:assert/strict";
+import { execFile } from "node:child_process";
+import { mkdtemp, rm, writeFile } from "node:fs/promises";
+import { tmpdir } from "node:os";
+import { basename, join } from "node:path";
+import { fileURLToPath } from "node:url";
+import { promisify } from "node:util";
+
+import {
+  artifactCli,
+  artifactMcpResult,
+  withArtifactMcp,
+} from "./lib/artifact-e2e.mjs";
+
+const exec = promisify(execFile);
+
+if (process.platform !== "darwin")
+  throw new Error(
+    "Native call observation verification requires macOS with Command Line Tools",
+  );
+for (const tool of ["clang", "lldb", "codesign", "nm"])
+  try {
+    await exec("/usr/bin/xcrun", ["--find", tool]);
+  } catch (cause) {
+    throw new Error(
+      `Native call observation verification requires ${tool} from Command Line Tools (xcrun --find ${tool} failed)`,
+      { cause },
+    );
+  }
+
+const SOURCE = fileURLToPath(
+  new URL("../tests/conformance/native/calls.m", import.meta.url),
+);
+const GREET = "-[ReaCallGreeter greet:times:]";
+const INPUT = {
+  breakpoints: [
+    {
+      kind: "objc-method",
+      class_name: "ReaCallGreeter",
+      selector: "greet:times:",
+      method_type: "instance",
+    },
+    { kind: "function", name: "rea_call_add" },
+  ],
+  environment: { REA_CALLS_MARKER: "observed" },
+  argument_registers: 4,
+  backtrace_frames: 1,
+};
+
+/** Pointer-free facts that two runs of the same scenario must share. */
+const stable = (result) =>
+  result.events.map((event) => ({
+    symbol: event.symbol,
+    file_address: event.file_address,
+    selector: event.selector,
+    receiver_class: event.receiver_class,
+    counter:
+      event.symbol === GREET
+        ? event.registers[3].value
+        : event.registers[0].value,
+  }));
+
+const symbolAddress = async (binary, symbol) => {
+  const { stdout } = await exec("/usr/bin/xcrun", ["nm", "-n", binary]);
+  const line = stdout.split("\n").find((entry) => entry.endsWith(` ${symbol}`));
+  assert.ok(line, `nm lists ${symbol}`);
+  return `0x${BigInt(`0x${line.split(" ")[0]}`).toString(16)}`;
+};
+
+const checkScenario = async (binary) => {
+  const result = await artifactCli("observe-native-calls", binary, [
+    JSON.stringify(INPUT),
+  ]);
+  assert.equal(result.process.outcome, "exited");
+  assert.equal(result.process.exit_status, 0);
+  assert.equal(result.process.terminated, true);
+  assert.match(result.process.stdout.text, /^world x0 40\n/u);
+  assert.match(result.process.stdout.text, /marker observed\n$/u);
+  assert.deepEqual(result.coverage, {
+    status: "complete",
+    event_limit_reached: false,
+    unresolved_breakpoints: [],
+  });
+  const greet = result.events.filter(({ symbol }) => symbol === GREET);
+  const add = result.events.filter(({ symbol }) => symbol === "rea_call_add");
+  assert.equal(greet.length, 3);
+  assert.equal(add.length, 3);
+  for (const [index, event] of greet.entries()) {
+    assert.equal(event.receiver_class, "ReaCallGreeter");
+    assert.equal(event.selector, "greet:times:");
+    assert.equal(event.registers[3].value, `0x${index}`);
+    assert.equal(event.backtrace[0].symbol, "main");
+    assert.equal(event.module, basename(binary));
+  }
+  for (const [index, event] of add.entries()) {
+    assert.equal(event.registers[0].value, `0x${index}`);
+    assert.equal(event.registers[1].value, "0x28");
+  }
+  // Breakpoints stop at the symbol itself, which Apple's nm reports.
+  assert.equal(
+    add[0].file_address,
+    await symbolAddress(binary, "_rea_call_add"),
+  );
+  assert.equal(greet[0].file_address, await symbolAddress(binary, GREET));
+  return result;
+};
+
+const alive = (pid) => {
+  try {
+    process.kill(pid, 0);
+    return true;
+  } catch {
+    return false;
+  }
+};
+
+const checkBounds = async (binary) => {
+  const limited = await artifactCli("observe-native-calls", binary, [
+    JSON.stringify({
+      breakpoints: [{ kind: "function", name: "nanosleep" }],
+      arguments: ["--wait"],
+      max_events: 2,
+      duration_ms: 30_000,
+    }),
+  ]);
+  assert.equal(limited.process.outcome, "event-limit");
+  assert.equal(limited.events.length, 2);
+  assert.equal(limited.process.terminated, true);
+  assert.equal(alive(limited.process.pid), false);
+  const elapsed = await artifactCli("observe-native-calls", binary, [
+    JSON.stringify({
+      breakpoints: [{ kind: "function", name: "rea_call_add" }],
+      arguments: ["--wait"],
+      duration_ms: 1_500,
+    }),
+  ]);
+  assert.equal(elapsed.process.outcome, "duration-elapsed");
+  assert.equal(elapsed.events.length, 0);
+  assert.equal(alive(elapsed.process.pid), false);
+};
+
+const cliFailure = async (binary) => {
+  try {
+    await exec(
+      process.execPath,
+      [
+        fileURLToPath(new URL("rea.mjs", import.meta.url)),
+        "observe-native-calls",
+        binary,
+        JSON.stringify(INPUT),
+        "--json",
+      ],
+      { env: { ...process.env, REA_LOG_LEVEL: "silent" }, timeout: 120_000 },
+    );
+  } catch (cause) {
+    return JSON.parse(cause.stdout);
+  }
+  throw new Error("observe-native-calls unexpectedly succeeded");
+};
+
+/** Hardened runtime blocks the debugger unless get-task-allow is granted. */
+const checkHardenedRuntime = async (directory, binary) => {
+  const blocked = join(directory, "hardened");
+  await exec("/bin/cp", [binary, blocked]);
+  await exec("/usr/bin/xcrun", [
+    "codesign",
+    "-f",
+    "-s",
+    "-",
+    "-o",
+    "runtime",
+    blocked,
+  ]);
+  const denied = await cliFailure(blocked);
+  assert.equal(denied.code, "capability_unavailable");
+  assert.match(denied.details.reason, /^debugger-attach-denied: /u);
+  const allowed = join(directory, "debuggable");
+  const entitlements = join(directory, "get-task-allow.plist");
+  await writeFile(
+    entitlements,
+    '<?xml version="1.0" encoding="UTF-8"?><plist version="1.0"><dict><key>com.apple.security.get-task-allow</key><true/></dict></plist>',
+  );
+  await exec("/bin/cp", [binary, allowed]);
+  await exec("/usr/bin/xcrun", [
+    "codesign",
+    "-f",
+    "-s",
+    "-",
+    "-o",
+    "runtime",
+    "--entitlements",
+    entitlements,
+    allowed,
+  ]);
+  const traced = await checkScenario(allowed);
+  assert.equal(traced.process.exit_status, 0);
+};
+
+const directory = await mkdtemp(join(tmpdir(), "rea-native-calls-"));
+try {
+  const binary = join(directory, "ReaCalls");
+  await exec("/usr/bin/xcrun", [
+    "clang",
+    "-fobjc-arc",
+    "-framework",
+    "Foundation",
+    SOURCE,
+    "-o",
+    binary,
+  ]);
+  const viaCli = await checkScenario(binary);
+  await withArtifactMcp(binary, async (client) => {
+    const viaMcp = await artifactMcpResult(
+      client,
+      "observe_native_calls",
+      INPUT,
+    );
+    assert.deepEqual(stable(viaMcp), stable(viaCli));
+    assert.equal(viaMcp.process.stdout.text, viaCli.process.stdout.text);
+  });
+  await checkBounds(binary);
+  await checkHardenedRuntime(directory, binary);
+  console.log(
+    JSON.stringify({
+      ok: true,
+      mocked: false,
+      cli: true,
+      stdio_mcp: true,
+      debugger: viaCli.debugger.version,
+      events: viaCli.events.length,
+      outcomes: ["exited", "event-limit", "duration-elapsed"],
+      hardened_runtime: {
+        without_get_task_allow: "denied",
+        with_get_task_allow: "traced",
+      },
+    }),
+  );
+} finally {
+  await rm(directory, { recursive: true, force: true });
+}
@@ -31,7 +31,7 @@ export async function verifyPackageInstall({
  const processCaptureCapabilityUrl = pathToFileURL(
    join(
      prefix,
-      "lib/node_modules/rea-agents/dist/application/ProcessCaptureCapability.js",
+      "lib/node_modules/rea-agents/dist/process/capture/ProcessCaptureCapability.js",
    ),
  ).href;
  const processCaptureCapability = json(
@@ -77,7 +77,7 @@ export async function verifyPackageInstall({
  const noOptionalCapabilityUrl = pathToFileURL(
    join(
      noOptionalPrefix,
-      "lib/node_modules/rea-agents/dist/application/ProcessCaptureCapability.js",
+      "lib/node_modules/rea-agents/dist/process/capture/ProcessCaptureCapability.js",
    ),
  ).href;
  const noOptionalCapability = json(
@@ -2,6 +2,7 @@ import assert from "node:assert/strict";
 import { join } from "node:path";
 import { execFile } from "node:child_process";
 import { promisify } from "node:util";
+import { readFile, rm } from "node:fs/promises";

 import { Client } from "@modelcontextprotocol/client";
 import { StdioClientTransport } from "@modelcontextprotocol/client/stdio";
@@ -167,6 +168,7 @@ const verifyMcpInlineArtifactEvidence = async (
    mcpOptions,
  );
  assert.notEqual(opened.isError, true, JSON.stringify(opened));
+  let outputRoot;
  try {
    const inspected = await client.callTool(
      { name: "inspect_artifact", arguments: {} },
@@ -212,12 +214,35 @@ const verifyMcpInlineArtifactEvidence = async (
        evidence,
      );
    }
-  } finally {
-    const closed = await client.callTool(
-      { name: "close_binary", arguments: {} },
+    const extracted = await client.callTool(
+      { name: "extract_artifact", arguments: {} },
      mcpOptions,
    );
-    assert.notEqual(closed.isError, true, JSON.stringify(closed));
+    assert.notEqual(extracted.isError, true, JSON.stringify(extracted));
+    const extraction = parseEvidence(extracted.structuredContent?.evidence);
+    assert.deepEqual(
+      extraction.normalized_result,
+      extracted.structuredContent?.result,
+    );
+    const materialized = extracted.structuredContent?.result;
+    assert.equal(typeof materialized?.output_root, "string");
+    outputRoot = materialized.output_root;
+    assert.equal(materialized.containment_verified, true);
+    assert.equal(
+      await readFile(join(outputRoot, "app/main.js"), "utf8"),
+      "main();",
+    );
+  } finally {
+    try {
+      const closed = await client.callTool(
+        { name: "close_binary", arguments: {} },
+        mcpOptions,
+      );
+      assert.notEqual(closed.isError, true, JSON.stringify(closed));
+    } finally {
+      if (outputRoot !== undefined)
+        await rm(outputRoot, { recursive: true, force: true });
+    }
  }
 };

@@ -1,4 +1,5 @@
 import { join } from "node:path";
+import { CATALOG_IDENTITY } from "../dist/catalogIdentity.js";

 import { exec } from "./lib/verify-package-core.mjs";
 import { verifyPackedBridge } from "./verify-packed-bridge.mjs";
@@ -28,6 +29,26 @@ export async function verifyPackagePack({ root, workspace }) {
    throw new Error("package did not expose both rea command entry points");
  if (packedManifest.mcpName !== "io.github.morluto/rea")
    throw new Error("package did not retain its MCP Registry ownership marker");
+  if (packedFiles.some((path) => path.startsWith("package/skill-src/")))
+    throw new Error(
+      "package included authored skill sources instead of only the generated bundle",
+    );
+  const skill = (
+    await exec("tar", [
+      "-xOf",
+      join(root, tarball),
+      "package/skills/reverse-engineer-anything/SKILL.md",
+    ])
+  ).stdout;
+  if (
+    !skill.includes(
+      `  tool_count: ${String(CATALOG_IDENTITY.counts.mcp_tools)}\n`,
+    ) ||
+    skill.includes("  catalog_digest:")
+  )
+    throw new Error(
+      "packaged skill metadata did not match the catalog shipped in the package",
+    );
  if (
    packedFiles.some(
      (path) => path.includes("__pycache__") || path.endsWith(".pyc"),
@@ -25,10 +25,12 @@ if (process.platform !== "win32" || process.arch !== "x64")
  );
 const workspace = await mkdtemp(join(tmpdir(), "rea-packaged-ghidra-"));
 const exec = promisify(execFile);
-let packageRoot = resolve(process.argv[2] ?? ".");
+const x86Fixture = process.argv[2] === "--x86";
+const packageRootArgument = x86Fixture ? undefined : process.argv[2];
+let packageRoot = resolve(packageRootArgument ?? ".");
 // The default lane verifies the npm artifact in an isolated prefix. Explicit
 // package roots support an already-installed artifact without a second install.
-if (process.argv[2] === undefined) {
+if (packageRootArgument === undefined) {
  try {
    const npmEntry =
      process.env.npm_execpath ??
@@ -77,7 +79,10 @@ if (process.argv[2] === undefined) {
  }
 }
 const target = resolve(
-  process.argv[3] ?? "build/fixtures/rea-ghidra-windows.exe",
+  process.argv[3] ??
+    (x86Fixture
+      ? "build/fixtures/rea-ghidra-windows-x86.exe"
+      : "build/fixtures/rea-ghidra-windows.exe"),
 );
 let TOOL_CONTRACTS, native, token, sha256;
 try {
@@ -215,7 +220,8 @@ try {
  };
  try {
    await client.connect(transport);
-    await call("open_binary", { path: target, provider_id: "ghidra" });
+    await call("open_binary", { path: target });
+    await call("binary_overview", {});
    assert.equal((await call("list_documents", {})).length, 1);
    await call("list_names", {});
    const procedures = await call("list_procedures", {});
@@ -63,12 +63,20 @@ if (
  );

 const root = resolve(fileURLToPath(new URL("..", import.meta.url)));
-const targetPath = resolve(root, "build", "fixtures", "rea-ghidra-windows.exe");
+const architecture = process.argv[2] === "--x86" ? "x86" : "x86_64";
+const targetPath = resolve(
+  root,
+  "build",
+  "fixtures",
+  architecture === "x86"
+    ? "rea-ghidra-windows-x86.exe"
+    : "rea-ghidra-windows.exe",
+);
 const target = await parseBinaryTarget(targetPath);
 if (
  !target.ok ||
  target.value.format !== "pe" ||
-  target.value.architecture !== "x86_64" ||
+  target.value.architecture !== architecture ||
  target.value.executableRole !== "application" ||
  target.value.managed !== false
 )
@@ -113,6 +121,9 @@ try {
    target.value.sha256,
    profile.value.profile.digest,
  );
+  const languagePrefix = architecture === "x86" ? "x86:LE:32:" : "x86:LE:64:";
+  if (!started.value.target.language_id.startsWith(languagePrefix))
+    throw new Error("Windows fixture imported with the wrong Ghidra language");
  coordinates = client.diagnostics();
  assertRuntimeCoordinates(coordinates, target.value.sha256);

@@ -137,6 +148,19 @@ try {
  );
  if (procedure === undefined)
    throw new Error("Windows Ghidra fixture exposed no local procedure");
+  const calleeAddress = architecture === "x86" ? 0x401010n : 0x140001010n;
+  const callee = procedures.find(
+    (item) => BigInt(item.address) === calleeAddress,
+  );
+  if (callee === undefined)
+    throw new Error("Windows fixture exposed no controlled callee");
+  const pseudoCode = await functionOperation("procedure_pseudo_code", {
+    procedure: callee.value,
+  });
+  if (typeof pseudoCode !== "string" || !/\b(?:42|0x2a)\b/iu.test(pseudoCode))
+    throw new Error(
+      "Windows fixture decompilation lost its known return value",
+    );

  await inventory("inspect_native_load_image", {});
  const memory = await inventory("read_bytes", {
@@ -210,6 +234,7 @@ try {
  report = {
    ok: true,
    provider: { id: "ghidra", version: SUPPORTED_GHIDRA_VERSION },
+    language_id: started.value.target.language_id,
    target: {
      format: target.value.format,
      architecture: target.value.architecture,
@@ -228,7 +253,7 @@ try {
    limitations: [
      "approved-non-sensitive-fixtures-only",
      "windows-x64-local-ntfs-only",
-      "native-x86-64-pe-applications-only",
+      "native-x86-and-x86-64-pe-applications-only",
      "no-gui-or-mutation-authority",
    ],
  };
@@ -0,0 +1,318 @@
+#!/usr/bin/env node
+import assert from "node:assert/strict";
+import { writeFile, readFile, copyFile } from "node:fs/promises";
+import { isAbsolute, join } from "node:path";
+import { fileURLToPath } from "node:url";
+import { PrivateRuntimeRoot } from "../dist/process/PrivateRuntimeRoot.js";
+import { createVerifierRun, completeVerifierRun } from "./lib/verifier-run.mjs";
+import { verifyCompleteToolCatalog } from "./lib/verify-package-core.mjs";
+import { connectRecordedCrash } from "./verify/recorded-crash/public.mjs";
+import {
+  createRecordedCore,
+  fixtureCommand,
+  startCoreSentinel,
+} from "./verify/recorded-crash/fixtures.mjs";
+import { verifyCoreInspectionTrace } from "./verify/recorded-crash/trace.mjs";
+
+const environment = Object.fromEntries(
+  Object.entries(process.env).filter(([, value]) => typeof value === "string"),
+);
+environment.REA_PWNDBG_GDB ??= "/usr/bin/gdb";
+for (const key of [
+  "REA_PWNTOOLS_PYTHON",
+  "REA_PWNDBG_GDB",
+  "REA_PWNDBG_GDBINIT",
+  "REA_PWNDBG_VENV_PATH",
+  "REA_VERIFY_STRACE_COMMAND",
+])
+  if (!isAbsolute(environment[key] ?? ""))
+    throw new Error(
+      `verify:recorded:crash requires absolute ${key}; see docs/recorded-crashes.md. No dependencies are installed by this verifier.`,
+    );
+if (process.platform !== "linux" || process.arch !== "x64")
+  throw new Error("verify:recorded:crash requires Linux x64.");
+const run = createVerifierRun();
+environment.REA_PROCESS_RUN_ID = run.run_id;
+const root = await PrivateRuntimeRoot.create({ prefix: "rea-core-verifier-" });
+const options = { root: root.path, environment, runId: run.run_id };
+const entrypoint =
+  process.argv[2] ?? fileURLToPath(new URL("./rea.mjs", import.meta.url));
+const failures = [];
+const sessions = [];
+let sentinel;
+let cases = 0;
+let trace;
+let catalogTools;
+try {
+  for (const [command, args] of [
+    ["gcc", ["--version"]],
+    [environment.REA_PWNDBG_GDB, ["--version"]],
+    [environment.REA_VERIFY_STRACE_COMMAND, ["-V"]],
+  ]) {
+    try {
+      await fixtureCommand(command, args, options);
+    } catch (cause) {
+      throw new Error(
+        `verify:recorded:crash prerequisite unavailable: ${command}`,
+        { cause },
+      );
+    }
+  }
+  const core = await createRecordedCore(options);
+  sentinel = await startCoreSentinel(options);
+  sentinel.assertAlive();
+  const fixtures = JSON.parse(
+    await fixtureCommand(
+      environment.REA_PWNTOOLS_PYTHON,
+      [
+        "-I",
+        fileURLToPath(
+          new URL("./lib/recorded-core-fixtures.py", import.meta.url),
+        ),
+        core,
+        root.path,
+        String(sentinel.pid),
+      ],
+      options,
+    ),
+  );
+  const spaced = join(root.path, "recording with spaces.core");
+  await copyFile(core, spaced);
+  const basic = await connectRecordedCrash({ entrypoint, environment });
+  sessions.push(basic);
+  const advertised = (await basic.client.listTools()).tools;
+  assert.equal(
+    advertised.filter((tool) => tool.name === "inspect_recorded_crash").length,
+    1,
+  );
+  const catalog = await verifyCompleteToolCatalog(basic.client, {
+    timeout: 90_000,
+  });
+  for (const name of [
+    "inspect_binary_layout",
+    "inspect_recorded_crash",
+    "inspect_evm_interface",
+  ])
+    assert.ok(catalog.includes(name));
+  catalogTools = catalog.length;
+  for (const mode of ["cli", "mcp"]) {
+    const report = await basic.inspect(mode, spaced);
+    assert.equal(report.threads.length, 2);
+    assert.ok(
+      report.threads.some((thread) =>
+        thread.registers.some(
+          (register) =>
+            register.name === "rdi" && register.value === "0x1122334455667788",
+        ),
+      ),
+    );
+    assert.ok(
+      report.threads.some((thread) =>
+        thread.registers.some(
+          (register) =>
+            register.name === "r12" && register.value === "0xfedcba9876543210",
+        ),
+      ),
+    );
+    assert.ok(
+      report.signals.some(
+        (signal) =>
+          signal.number === 11 &&
+          signal.code === 1 &&
+          signal.fault_address === "0x123",
+      ),
+    );
+    assert.ok(
+      report.signals.some(
+        (signal) => signal.code === -6 && signal.fault_address === null,
+      ),
+    );
+    cases++;
+    const enriched = await basic.inspect(mode, spaced, {
+      debuggerContext: true,
+    });
+    assert.deepEqual(enriched.threads, report.threads);
+    assert.deepEqual(enriched.notes, report.notes);
+    assert.ok(enriched.debugger.pwndbg_version.startsWith("2026.09.15"));
+    assert.equal(enriched.debugger.connection, "core");
+    assert.equal(enriched.debugger.executable, null);
+    assert.ok(enriched.debugger.maps.length > 0);
+    assert.ok(
+      enriched.debugger.maps.every(
+        (map) => map.reported_flags !== 0 || map.permissions === null,
+      ),
+    );
+    assert.ok(
+      enriched.debugger.maps.every(
+        (map) => map.current_file_identity === "unknown",
+      ),
+    );
+    assert.ok(
+      enriched.debugger.reported_limits.address_space_bytes <= 3 * 1024 ** 3,
+    );
+    assert.ok(enriched.debugger.reported_limits.cpu_seconds <= 30);
+    assert.ok(
+      enriched.debugger.reported_limits.file_size_bytes <= 64 * 1024 ** 2,
+    );
+    assert.ok(enriched.diagnostics.stdout.includes("[core decoder]"));
+    assert.equal(enriched.decoder_diagnostics.truncated, false);
+    cases++;
+    for (const name of [
+      "truncated-header",
+      "truncated-status",
+      "truncated-owner",
+      "nonzero-note-tail",
+    ]) {
+      await basic.inspect(mode, fixtures[name], { category: "invalid_input" });
+      cases++;
+    }
+    const opaque = await basic.inspect(mode, fixtures["opaque-owner"]);
+    assert.ok(
+      opaque.notes.some(
+        (note) => Buffer.from(note.owner_bytes_base64, "base64")[0] === 255,
+      ),
+    );
+    assert.equal(opaque.threads.length, 1);
+    cases++;
+    const noSignals = await basic.inspect(mode, fixtures["unknown-signals"]);
+    assert.equal(noSignals.signals.length, 0);
+    assert.equal(noSignals.threads.length, 2);
+    cases++;
+    const noNotes = await basic.inspect(mode, fixtures["missing-notes"]);
+    assert.equal(noNotes.notes.length, 0);
+    assert.equal(noNotes.threads.length, 0);
+    assert.equal(noNotes.note_interpretation_completeness, "unknown");
+    cases++;
+    const negative = await basic.inspect(mode, fixtures["negative-pid"]);
+    assert.ok(negative.threads.some((thread) => thread.historical_pid === -2));
+    cases++;
+    const linux = await basic.inspect(mode, fixtures["linux-osabi"]);
+    assert.deepEqual(linux.threads, report.threads);
+    assert.deepEqual(linux.signals, report.signals);
+    cases++;
+    const extended = await basic.inspect(
+      mode,
+      fixtures["extended-program-count"],
+    );
+    assert.deepEqual(extended.threads, report.threads);
+    assert.deepEqual(extended.signals, report.signals);
+    cases++;
+    const padded = await basic.inspect(mode, fixtures["zero-note-tail"]);
+    assert.equal(padded.threads.length, 2);
+    assert.ok(
+      padded.note_padding.some((padding) => padding.bytes_base64 === "AAAA"),
+    );
+    cases++;
+    for (const name of [
+      "solaris-osabi",
+      "freebsd-osabi",
+      "unsupported-abi-version",
+    ]) {
+      await basic.inspect(mode, fixtures[name], {
+        category: "unsupported_target",
+      });
+      cases++;
+    }
+    const collision = await basic.inspect(
+      mode,
+      fixtures["historical-pid-collision"],
+      { debuggerContext: true },
+    );
+    assert.ok(
+      collision.threads.some(
+        (thread) => thread.historical_pid === sentinel.pid,
+      ),
+    );
+    sentinel.assertAlive();
+    cases++;
+  }
+  for (const [name, changes] of [
+    ["missing", { REA_PWNDBG_GDBINIT: join(root.path, "missing-plugin.py") }],
+    [
+      "wrong-profile",
+      { REA_PWNDBG_GDBINIT: join(root.path, "wrong-profile.py") },
+    ],
+  ]) {
+    if (name === "wrong-profile") {
+      // Source-owned failure injection changes only the in-memory reported version.
+      // The selected upstream checkout and its installed files remain unchanged.
+      await writeFile(
+        changes.REA_PWNDBG_GDBINIT,
+        `from pathlib import Path\nentry = ${JSON.stringify(environment.REA_PWNDBG_GDBINIT)}\nexec(compile(Path(entry).read_bytes(), entry, 'exec'), {'__name__': '__main__', '__file__': entry})\nimport pwndbg.lib.version\npwndbg.lib.version.__version__ = '0.0.0-source-owned'\n`,
+      );
+    }
+    const session = await connectRecordedCrash({
+      entrypoint,
+      environment: { ...environment, ...changes },
+    });
+    sessions.push(session);
+    for (const mode of ["cli", "mcp"]) {
+      const error = await session.inspect(mode, core, {
+        debuggerContext: true,
+        category: "unsupported_provider",
+      });
+      assert.ok(
+        JSON.stringify(error).includes(
+          name === "missing" ? "REA_PWNDBG_GDBINIT" : "source-owned",
+        ),
+      );
+      cases++;
+    }
+  }
+  const executableCarrier = join(root.path, "executable-as-core");
+  const executableBytes = Buffer.from(await readFile(core));
+  executableBytes.writeUInt16LE(2, 16);
+  await writeFile(executableCarrier, executableBytes);
+  for (const mode of ["cli", "mcp"]) {
+    const error = await basic.inspect(mode, executableCarrier, {
+      category: "unsupported_target",
+    });
+    assert.ok(JSON.stringify(error).includes("ET_CORE"));
+    cases++;
+  }
+  trace = await verifyCoreInspectionTrace({
+    ...options,
+    entrypoint,
+    core: fixtures["historical-pid-collision"],
+    sentinel,
+  });
+  cases += trace.length;
+  assert.ok((await readFile(core)).length > 0);
+} catch (cause) {
+  failures.push(cause);
+} finally {
+  for (const close of [
+    ...sessions.map((session) => () => session.close()),
+    ...(sentinel ? [() => sentinel.close()] : []),
+    () => root.close(),
+  ]) {
+    try {
+      await close();
+    } catch (cause) {
+      failures.push(cause);
+    }
+  }
+}
+const verifier = await completeVerifierRun(run);
+try {
+  assert.equal(verifier.process_lineage.status, "verified");
+  assert.deepEqual(verifier.process_lineage.descendants, []);
+} catch (cause) {
+  failures.push(cause);
+}
+const result = {
+  status: failures.length === 0 ? "passed" : "failed",
+  public_cases: cases,
+  catalog_tools: catalogTools,
+  profile:
+    "Linux x64; pwntools4.15.0/pyelftools0.33/Unicorn2.1.2; core-only BYO GDB/pwndbg2026.09.15",
+  fixture_generation: "owned test program executed",
+  inspection_trace: trace,
+  verifier,
+};
+console.log(JSON.stringify(result, null, 2));
+if (failures.length > 0)
+  throw new AggregateError(
+    failures,
+    "Recorded crash verification failed; cleanup failures are retained.",
+  );
@@ -0,0 +1,44 @@
+#!/usr/bin/env node
+import { execFile } from "node:child_process";
+import { parseArgs, promisify } from "node:util";
+import { inspectReleaseCheckpoint } from "./lib/release-checkpoint.mjs";
+
+const execFileAsync = promisify(execFile);
+
+async function git(args) {
+  const result = await execFileAsync("git", args, {
+    encoding: "utf8",
+    maxBuffer: 16 * 1024 * 1024,
+  });
+  return result.stdout;
+}
+
+async function main() {
+  const { values } = parseArgs({
+    options: {
+      phase: { type: "string" },
+      stage: { type: "string", default: "source" },
+      "release-branch": { type: "string" },
+      "source-sha": { type: "string" },
+    },
+  });
+  const report = await inspectReleaseCheckpoint(git, {
+    phase: values.phase,
+    stage: values.stage,
+    releaseBranch: values["release-branch"],
+    sourceSha: values["source-sha"],
+  });
+  process.stdout.write(`${JSON.stringify(report, null, 2)}\n`);
+  if (report.missingNotes.length > 0) {
+    process.stderr.write(
+      `Review ${report.missingNotes.length} additional unreleased mainline entries missing from these release notes; see the ancestry report above.\n`,
+    );
+  }
+}
+
+await main().catch((error) => {
+  process.stderr.write(
+    `Release checkpoint validation failed: ${error instanceof Error ? error.message : String(error)}\n`,
+  );
+  process.exitCode = 1;
+});
@@ -0,0 +1,996 @@
+#!/usr/bin/env node
+import assert from "node:assert/strict";
+import { execFile } from "node:child_process";
+import { createHash, randomUUID } from "node:crypto";
+import {
+  access,
+  copyFile,
+  chmod,
+  readFile,
+  truncate,
+  writeFile,
+} from "node:fs/promises";
+import { dirname, isAbsolute, join, resolve } from "node:path";
+import { fileURLToPath } from "node:url";
+import { promisify } from "node:util";
+import { Client } from "@modelcontextprotocol/client";
+import { StdioClientTransport } from "@modelcontextprotocol/client/stdio";
+import { PrivateRuntimeRoot } from "../dist/process/PrivateRuntimeRoot.js";
+import { runOwnedCommand } from "../dist/process/OwnedCommand.js";
+import { WEB_NETWORK_CAPTURE_LIMITS } from "../dist/domain/webNetworkCapture.js";
+import { mcpTextValue } from "./lib/mcp-verifier-results.mjs";
+import { createVerifierRun, completeVerifierRun } from "./lib/verifier-run.mjs";
+
+const executable = process.env.REA_MITMDUMP_COMMAND;
+if (
+  process.platform !== "linux" ||
+  executable === undefined ||
+  !isAbsolute(executable)
+)
+  throw new Error(
+    "verify:web:network-captures requires Linux and absolute REA_MITMDUMP_COMMAND for caller-supplied mitmdump 12.2.3",
+  );
+await access(executable);
+const entrypoint =
+  process.argv[2] ?? fileURLToPath(new URL("./rea.mjs", import.meta.url));
+const run = createVerifierRun();
+const runtime = await PrivateRuntimeRoot.create({
+  prefix: "rea-history-verifier-",
+});
+const environment = Object.fromEntries(
+  Object.entries(process.env).filter(([, value]) => typeof value === "string"),
+);
+const client = new Client({
+  name: "historical-web-capture-verifier",
+  version: "1",
+});
+const transport = new StdioClientTransport({
+  command: process.execPath,
+  args: [entrypoint, "mcp"],
+  env: environment,
+  stderr: "pipe",
+});
+const failures = [];
+let cases = 0;
+try {
+  await runOwnedCommand(
+    {
+      command: executable,
+      arguments: [
+        "--no-server",
+        "-q",
+        "--set",
+        `confdir=${join(runtime.path, "config")}`,
+        "--set",
+        `rea_fixture_root=${runtime.path}`,
+        "--set",
+        `rea_adapter_path=${resolve(dirname(entrypoint), "../bridge/mitmproxy/capture.py")}`,
+        "-s",
+        fileURLToPath(
+          new URL("./fixtures/generate-mitmproxy-capture.py", import.meta.url),
+        ),
+      ],
+      cwd: runtime.path,
+      runId: `rea-history-fixture-${randomUUID()}`,
+      hostEnvironment: environment,
+    },
+    { timeoutMs: 30_000, diagnosticBytes: 1024 * 1024 },
+  );
+  assert.deepEqual(
+    JSON.parse(
+      await readFile(
+        join(runtime.path, "native-error-classifications.json"),
+        "utf8",
+      ),
+    ),
+    { passed: 7 },
+  );
+  await client.connect(transport);
+  for (const format of ["har", "mitmproxy"]) {
+    const path = join(
+      runtime.path,
+      format === "har" ? "producer.har" : "flows.mitm",
+    );
+    const raw = await readFile(path);
+    const input = { capture_path: path, format, record_ordinals: [1, 0] };
+    for (const mode of ["cli", "mcp"]) {
+      const value = await inspect(mode, input);
+      assert.equal(value.total_records, 2);
+      assert.deepEqual(
+        value.records.map((record) => record.ordinal),
+        [1, 0],
+      );
+      assert.equal(
+        value.artifact.sha256,
+        createHash("sha256").update(raw).digest("hex"),
+      );
+      assert.equal(value.runtime_attribution, "unknown");
+      const first = value.records[1];
+      if (format === "mitmproxy") {
+        assert.equal(first.reported.id, "original-producer-id");
+        assert.equal(value.records[0].reported.id, first.reported.id);
+        assert.equal(first.location.offset, 0);
+        assert.equal(
+          value.records[0].location.offset + value.records[0].location.bytes,
+          raw.length,
+        );
+        assert.equal(
+          first.reported.request.path,
+          "http://example.test/a?token=ordinary#fragment",
+        );
+        assertBinary(
+          first,
+          "/request/content",
+          Buffer.from([0, 255, ...Buffer.from("body")]),
+        );
+        assertBinary(
+          first,
+          "/response/content",
+          Buffer.from([0, 254, ...Buffer.from("answer")]),
+        );
+        assertBinary(
+          first,
+          "/websocket/messages/0/2",
+          Buffer.from([0, 253, ...Buffer.from("message")]),
+        );
+        assert.equal(value.records[0].reported.request.content, null);
+        assertBinary(value.records[0], "/response/content", Buffer.alloc(0));
+        assert.ok(
+          first.numeric_literals.some(
+            (number) =>
+              number.pointer === "/metadata/big_integer" &&
+              number.literal === "9007199254740993",
+          ),
+        );
+        assert.ok(
+          first.numeric_literals.some(
+            (number) =>
+              number.pointer === "/metadata/nonfinite" &&
+              number.literal === "inf",
+          ),
+        );
+        assert.equal(
+          first.reported.metadata.response.headers[0][1],
+          "ordinary-extension-credential-name",
+        );
+      } else {
+        assert.equal(value.container.reported.log.creator.name, "mitmproxy");
+        assert.equal(value.container.reported.log.creator.version, "12.2.3");
+        assert.equal(value.records[0].reported.request.postData.text, null);
+        assertBinary(
+          first,
+          "/response/content/text",
+          Buffer.from([0, 255, 1, 254]),
+        );
+      }
+      const text = JSON.stringify(value);
+      for (const secret of [
+        "native-transport-secret",
+        "cookie-secret",
+        "redirect-password",
+        "user:password",
+      ])
+        assert.ok(
+          !text.includes(secret),
+          `Credential leaked through ${mode}/${format}`,
+        );
+      cases++;
+    }
+  }
+  for (const mode of ["cli", "mcp"]) {
+    const value = await inspect(mode, {
+      capture_path: join(runtime.path, "string-urls.mitm"),
+      format: "mitmproxy",
+    });
+    const first = value.records[0];
+    for (const state of [first.reported, first.reported.backup]) {
+      assert.equal(state.request.path, "https://example.test/string-path");
+      assert.equal(state.request.authority, "example.test");
+      assert.deepEqual(
+        state.request.headers.map((field) => field[1]),
+        ["https://example.test/from", "//example.test"],
+      );
+      assert.equal(state.response.headers[0][1], "https://example.test/to");
+    }
+    assert.ok(!JSON.stringify(value).includes("password"));
+    assert.ok(
+      first.redactions.some(
+        (redaction) =>
+          redaction.pointer === "/backup/request/authority" &&
+          redaction.reason === "transport-credential",
+      ),
+    );
+    cases++;
+  }
+  for (const sensitive_values of [
+    ["REDACTED", "["],
+    ["secret", "REDACTED"],
+  ]) {
+    for (const format of ["har", "mitmproxy"]) {
+      for (const mode of ["cli", "mcp"]) {
+        const value = await inspect(mode, {
+          capture_path: join(
+            runtime.path,
+            format === "har" ? "producer.har" : "string-urls.mitm",
+          ),
+          format,
+          record_ordinals: [0],
+          sensitive_values,
+        });
+        const first = value.records[0];
+        const markers =
+          format === "har"
+            ? first.reported._markers
+            : first.reported.metadata._markers;
+        assert.equal(markers.sensitive, null);
+        assert.equal(markers.ordinary, "unmarked");
+        assert.equal(
+          sensitive_values.includes("[") ? markers.bracket : markers.overlap,
+          null,
+        );
+        if (format === "mitmproxy")
+          assert.equal(first.reported.backup.metadata._markers.sensitive, null);
+        cases++;
+      }
+    }
+  }
+  for (const name of [
+    "equal-number",
+    "equal-null",
+    "equal-object",
+    "escaped-key",
+    "core",
+  ]) {
+    const path = join(runtime.path, `duplicate-${name}.har`);
+    const original = await readFile(path);
+    for (const mode of ["cli", "mcp"]) {
+      await inspect(
+        mode,
+        { capture_path: path, format: "har" },
+        "invalid_input",
+      );
+      assert.deepEqual(await readFile(path), original);
+      cases++;
+    }
+  }
+  for (const format of ["har", "mitmproxy"]) {
+    const path = join(
+      runtime.path,
+      format === "har" ? "prototype.har" : "prototype.mitm",
+    );
+    const original = await readFile(path);
+    for (const mode of ["cli", "mcp"]) {
+      const value = await inspect(mode, { capture_path: path, format });
+      const reported =
+        format === "har"
+          ? value.container.reported._extension
+          : value.records[0].reported.metadata;
+      assert.equal(Object.hasOwn(reported, "__proto__"), true);
+      assert.deepEqual(reported["__proto__"], { preserved: 7 });
+      assert.equal(Object.getPrototypeOf(reported), Object.prototype);
+      assert.equal(Reflect.get(Object.prototype, "preserved"), undefined);
+      if (format === "har") assert.equal(reported.constructor, "ordinary");
+      assert.deepEqual(await readFile(path), original);
+      cases++;
+    }
+  }
+  for (const format of ["har", "mitmproxy"]) {
+    const path = join(runtime.path, `malformed-${format}`);
+    await writeFile(path, format === "har" ? "{invalid-json" : "999999999999:");
+    for (const mode of ["cli", "mcp"]) {
+      await inspect(mode, { capture_path: path, format }, "invalid_input");
+      cases++;
+    }
+  }
+  for (const format of ["har", "mitmproxy"]) {
+    for (const mode of ["cli", "mcp"]) {
+      const value = await inspect(mode, {
+        capture_path: join(
+          runtime.path,
+          format === "har" ? "producer.har" : "string-urls.mitm",
+        ),
+        format,
+        sensitive_values: ["private-property"],
+      });
+      const record = value.records[0];
+      const properties =
+        format === "har"
+          ? record.reported._private_properties
+          : record.reported.metadata._private_properties;
+      assert.deepEqual(properties, { kept: 7 });
+      assert.ok(!JSON.stringify(value).includes("private-property"));
+      assert.ok(
+        record.redactions.some(
+          (item) =>
+            item.scope === "property-name" &&
+            item.pointer ===
+              (format === "har"
+                ? "/_private_properties"
+                : "/metadata/_private_properties"),
+        ),
+      );
+      if (format === "mitmproxy")
+        assert.deepEqual(record.reported.backup.metadata._private_properties, {
+          kept: 7,
+        });
+      cases++;
+    }
+  }
+  for (const [fixture, prefix] of [
+    ["ows", " \t"],
+    ["controls", "\r\n \v\f\x00\x1f"],
+  ]) {
+    for (const format of ["har", "mitmproxy"]) {
+      for (const mode of ["cli", "mcp"]) {
+        const value = await inspect(mode, {
+          capture_path: join(
+            runtime.path,
+            `${fixture}.${format === "har" ? "har" : "mitm"}`,
+          ),
+          format,
+        });
+        assert.ok(!JSON.stringify(value).includes("ows-secret"));
+        const record = value.records[0];
+        const states =
+          format === "har"
+            ? [record.reported]
+            : [record.reported, record.reported.backup];
+        for (const state of states) {
+          if (format === "har") {
+            for (const side of ["request", "response"])
+              assert.ok(
+                state[side].headers.some(
+                  (header) =>
+                    header.value ===
+                    `${prefix}HTTPS://example.test/path?token=ordinary#fragment\t `,
+                ),
+              );
+          } else {
+            assert.deepEqual(state.request.headers, [
+              [
+                "Referer",
+                `${prefix}HTTPS://example.test/path?token=ordinary#fragment\t `,
+              ],
+              [
+                "Origin",
+                `${prefix}//example.test/path?token=ordinary#fragment\t `,
+              ],
+            ]);
+            assert.deepEqual(state.response.headers, [
+              [
+                "Location",
+                `${prefix}HTTPS://example.test/path?token=ordinary#fragment\t `,
+              ],
+            ]);
+          }
+        }
+        if (format === "mitmproxy") {
+          for (const pointer of [
+            "/request/headers/0/1",
+            "/backup/request/headers/0/1",
+          ])
+            assert.deepEqual(
+              record.binary_fields.find((field) => field.pointer === pointer),
+              {
+                pointer,
+                representation: "producer-bytes",
+                state: "redacted",
+                content_base64: null,
+                bytes: null,
+                sha256: null,
+              },
+            );
+        }
+        cases++;
+      }
+    }
+  }
+  for (const mode of ["cli", "mcp"]) {
+    const value = await inspect(mode, {
+      capture_path: join(runtime.path, "non-utf8-urls.mitm"),
+      format: "mitmproxy",
+    });
+    const record = value.records[0];
+    assert.ok(!JSON.stringify(value).includes("byte-secret"));
+    for (const prefix of ["", "/backup"]) {
+      for (const suffix of [
+        "/request/path",
+        "/request/authority",
+        "/request/headers/0/1",
+        "/request/headers/1/1",
+        "/response/headers/0/1",
+      ]) {
+        const pointer = prefix + suffix;
+        assert.deepEqual(
+          record.binary_fields.find((field) => field.pointer === pointer),
+          {
+            pointer,
+            representation: "producer-bytes",
+            state: "redacted",
+            content_base64: null,
+            bytes: null,
+            sha256: null,
+          },
+        );
+      }
+    }
+    cases++;
+  }
+  const nativeCoordinateInput = {
+    capture_path: join(runtime.path, "flows.mitm"),
+    format: "mitmproxy",
+  };
+  const nativeCoordinates = await inspect("mcp", nativeCoordinateInput);
+  const originalLocation = nativeCoordinates.records[1].location;
+  assert.equal(originalLocation.kind, "byte-range");
+  for (const literal of [
+    String(originalLocation.offset),
+    String(originalLocation.bytes),
+  ]) {
+    for (const mode of ["cli", "mcp"]) {
+      const excluded = await inspect(mode, {
+        ...nativeCoordinateInput,
+        sensitive_values: [literal],
+      });
+      assert.deepEqual(excluded.records[1].location, {
+        kind: "unknown",
+        reason: "explicit-sensitive-value",
+      });
+      cases++;
+    }
+  }
+  cases++;
+  const deniedPath = join(runtime.path, "unreadable.har");
+  await copyFile(join(runtime.path, "producer.har"), deniedPath);
+  await chmod(deniedPath, 0o000);
+  for (const mode of ["cli", "mcp"]) {
+    for (const format of ["har", "mitmproxy"]) {
+      const failure = await inspect(
+        mode,
+        { capture_path: deniedPath, format },
+        "unavailable",
+      );
+      assert.equal(failure.code, "access_denied");
+      assert.equal(failure.details.system_code, "EACCES");
+      assert.equal(failure.details.path, deniedPath);
+      cases++;
+    }
+    for (const literal of ["log", "entries"]) {
+      const value = await inspect(mode, {
+        capture_path: join(runtime.path, "producer.har"),
+        format: "har",
+        sensitive_values: [literal],
+      });
+      assert.equal(value.container.records_pointer, null);
+      assert.ok(
+        value.records.every(
+          (record) =>
+            record.location.kind === "unknown" &&
+            record.location.reason === "explicit-sensitive-value",
+        ),
+      );
+      assert.ok(!JSON.stringify(value).includes(literal));
+      cases++;
+    }
+    for (const format of ["har", "mitmproxy"]) {
+      const value = await inspect(mode, {
+        capture_path: join(
+          runtime.path,
+          format === "har" ? "producer.har" : "string-urls.mitm",
+        ),
+        format,
+        sensitive_values: ["~1"],
+      });
+      assert.ok(!JSON.stringify(value).includes("~1"));
+      cases++;
+    }
+  }
+  for (const mode of ["cli", "mcp"]) {
+    for (const format of ["har", "mitmproxy"]) {
+      for (const sensitive_values of [
+        ["producer"],
+        ["producer", "REDACTED", "…"],
+      ]) {
+        await inspect(mode, {
+          capture_path: join(
+            runtime.path,
+            format === "har" ? "producer.har" : "flows.mitm",
+          ),
+          format,
+          sensitive_values,
+        });
+        cases++;
+      }
+    }
+  }
+  for (const mode of ["cli", "mcp"]) {
+    for (const selection of [
+      { record_ordinals: [12345], sensitive_values: ["12345"] },
+      { record_ordinals: [0, 0], sensitive_values: ["Each"] },
+    ]) {
+      await inspect(
+        mode,
+        {
+          capture_path: join(runtime.path, "producer.har"),
+          format: "har",
+          ...selection,
+        },
+        "invalid_input",
+      );
+      cases++;
+    }
+  }
+  await inspect(
+    "mcp",
+    {
+      capture_path: "relative.har",
+      format: "har",
+      sensitive_values: ["absolute"],
+    },
+    "invalid_input",
+  );
+  cases++;
+  const privatePath = join(runtime.path, "REDACTED.har");
+  for (const name of ["mysecret", "/ordinary/secret"]) {
+    const unknownArgument = await inspect(
+      "mcp",
+      {
+        capture_path: join(runtime.path, "producer.har"),
+        format: "har",
+        sensitive_values: ["secret"],
+        [name]: true,
+      },
+      "invalid_input",
+    );
+    assert.deepEqual(unknownArgument.details.issues[0].path, []);
+    cases++;
+  }
+  await inspect("mcp", {
+    capture_path: join(runtime.path, "flows.mitm"),
+    format: "mitmproxy",
+    sensitive_values: ["\ud800", "ordinary-scalar"],
+  });
+  cases++;
+  const replacementHar = JSON.parse(
+    await readFile(join(runtime.path, "producer.har"), "utf8"),
+  );
+  replacementHar.log.entries[0].response.content = {
+    size: 3,
+    mimeType: "application/octet-stream",
+    encoding: "base64",
+    text: "77+9",
+  };
+  const replacementHarPath = join(runtime.path, "unicode-scalar.har");
+  await writeFile(replacementHarPath, JSON.stringify(replacementHar));
+  for (const literal of ["\ud800", "\udfff", "\ufffd"]) {
+    const unicode = await inspect("mcp", {
+      capture_path: replacementHarPath,
+      format: "har",
+      sensitive_values: [literal],
+    });
+    const body = unicode.records[0].binary_fields.find(
+      (field) => field.pointer === "/response/content/text",
+    );
+    assert.equal(body?.state, literal === "\ufffd" ? "redacted" : "retained");
+    assert.equal(body.content_base64, literal === "\ufffd" ? null : "77+9");
+    cases++;
+  }
+  const numericHar = (
+    await readFile(join(runtime.path, "producer.har"), "utf8")
+  ).replace('"cache": {}', '"cache": {}, "_big": 9007199254740993');
+  const numericPath = join(runtime.path, "numeric.har");
+  await writeFile(numericPath, numericHar);
+  assert.ok(numericHar.includes('"_big": 9007199254740993'));
+  for (const mode of ["cli", "mcp"]) {
+    for (const format of ["har", "mitmproxy"]) {
+      for (const literal of ["9007199254740993", "4740993"]) {
+        const value = await inspect(mode, {
+          capture_path:
+            format === "har" ? numericPath : join(runtime.path, "flows.mitm"),
+          format,
+          sensitive_values: [literal],
+        });
+        assert.ok(!JSON.stringify(value).includes(literal));
+        const first = value.records[0];
+        const pointer = format === "har" ? "/_big" : "/metadata/big_integer";
+        assert.ok(
+          first.redactions.some(
+            (redaction) =>
+              redaction.pointer === pointer &&
+              redaction.reason === "explicit-sensitive-value",
+          ),
+        );
+        assert.ok(
+          first.numeric_literals.every(
+            (number) => !number.literal.includes(literal),
+          ),
+        );
+        cases++;
+      }
+    }
+  }
+  for (const mode of ["cli", "mcp"]) {
+    for (const format of ["har", "mitmproxy"]) {
+      await inspect(mode, {
+        capture_path: join(
+          runtime.path,
+          format === "har" ? "producer.har" : "flows.mitm",
+        ),
+        format,
+        sensitive_values: [format],
+      });
+      cases++;
+    }
+  }
+  const encodedHar = JSON.parse(
+    await readFile(join(runtime.path, "producer.har"), "utf8"),
+  );
+  encodedHar.log.entries[0].response.content = {
+    size: 6,
+    mimeType: "application/octet-stream",
+    encoding: "base64",
+    text: "c2 VjcmV0",
+  };
+  const encodedHarPath = join(runtime.path, "encoded-sensitive.har");
+  await writeFile(encodedHarPath, JSON.stringify(encodedHar));
+  for (const mode of ["cli", "mcp"]) {
+    for (const format of ["har", "mitmproxy"]) {
+      const bytes =
+        format === "har"
+          ? Buffer.from("secret")
+          : Buffer.from([0, 255, ...Buffer.from("body")]);
+      for (const literal of [
+        bytes.toString("base64"),
+        bytes.toString("base64").slice(0, 4),
+        createHash("sha256").update(bytes).digest("hex"),
+      ]) {
+        const value = await inspect(mode, {
+          capture_path:
+            format === "har"
+              ? encodedHarPath
+              : join(runtime.path, "flows.mitm"),
+          format,
+          sensitive_values: [literal],
+        });
+        const pointer =
+          format === "har" ? "/response/content/text" : "/request/content";
+        const field = value.records[0].binary_fields.find(
+          (field) => field.pointer === pointer,
+        );
+        assert.equal(field?.state, "redacted");
+        assert.equal(field.content_base64, null);
+        assert.equal(field.sha256, null);
+        assert.ok(!JSON.stringify(value).includes(literal));
+        cases++;
+      }
+    }
+  }
+  for (const mode of ["cli", "mcp"]) {
+    for (const format of ["har", "mitmproxy"]) {
+      const capturePath = join(
+        runtime.path,
+        format === "har" ? "producer.har" : "flows.mitm",
+      );
+      const digest = createHash("sha256")
+        .update(await readFile(capturePath))
+        .digest("hex");
+      for (const literal of [digest, digest.slice(0, 12)]) {
+        const value = await inspect(mode, {
+          capture_path: capturePath,
+          format,
+          sensitive_values: [literal],
+        });
+        assert.equal(value.artifact.sha256, null);
+        assert.equal(value.artifact.path, capturePath);
+        assert.ok(!JSON.stringify(value).includes(literal));
+        cases++;
+      }
+    }
+  }
+  const oversizedPath = join(runtime.path, "oversized-capture");
+  for (const mode of ["cli", "mcp"]) {
+    for (const literal of ["log", "entries"]) {
+      const hidden = await inspect(mode, {
+        capture_path: join(runtime.path, "producer.har"),
+        format: "har",
+        sensitive_values: [literal],
+      });
+      assert.equal(hidden.total_records, 2);
+      assert.equal(hidden.container.records_pointer, null);
+      for (const [ordinal, record] of hidden.records.entries()) {
+        assert.equal(record.ordinal, ordinal);
+        assert.deepEqual(record.location, {
+          kind: "unknown",
+          reason: "explicit-sensitive-value",
+        });
+        assert.equal(record.reported, null);
+        assert.deepEqual(record.binary_fields, []);
+        assert.deepEqual(record.numeric_literals, []);
+      }
+      cases++;
+    }
+  }
+  await writeFile(oversizedPath, "");
+  await truncate(oversizedPath, WEB_NETWORK_CAPTURE_LIMITS.inputBytes + 1);
+  await copyFile(join(runtime.path, "producer.har"), privatePath);
+  for (const mode of ["cli", "mcp"]) {
+    for (const format of ["har", "mitmproxy"]) {
+      const failure = await inspect(
+        mode,
+        { capture_path: oversizedPath, format },
+        "invalid_input",
+      );
+      assert.equal(failure.details.issues[0].reason, "out_of_range");
+      assert.deepEqual(failure.details.issues[0].path, ["capture_path"]);
+      assert.equal(
+        failure.details.issues[0].expected.maximum_capture_bytes,
+        WEB_NETWORK_CAPTURE_LIMITS.inputBytes,
+      );
+      cases++;
+    }
+    for (const format of ["har", "mitmproxy"]) {
+      const failure = await inspect(
+        mode,
+        {
+          capture_path: join(
+            runtime.path,
+            format === "har" ? "deep.har" : "deep.mitm",
+          ),
+          format,
+        },
+        "invalid_input",
+      );
+      const issue = failure.details.issues[0];
+      assert.equal(issue.reason, "out_of_range");
+      assert.equal(issue.path[0], "capture_path");
+      assert.match(issue.path[1], /^\/_extension\/child/);
+      assert.equal(
+        issue.expected.maximum_capture_nesting,
+        WEB_NETWORK_CAPTURE_LIMITS.depth,
+      );
+      cases++;
+    }
+    await inspect(
+      mode,
+      {
+        capture_path: join(runtime.path, "invalid-credential-key.mitm"),
+        format: "mitmproxy",
+      },
+      "invalid_input",
+    );
+    cases++;
+    const credentialDepth = await inspect(
+      mode,
+      {
+        capture_path: join(runtime.path, "deep-credential.mitm"),
+        format: "mitmproxy",
+      },
+      "invalid_input",
+    );
+    assert.equal(credentialDepth.details.issues[0].reason, "out_of_range");
+    assert.match(
+      credentialDepth.details.issues[0].path[1],
+      /^\/request\/headers\/0\/1\/child/,
+    );
+    cases++;
+    const value = await inspect(mode, {
+      capture_path: privatePath,
+      format: "har",
+      sensitive_values: ["REDACTED", "["],
+    });
+    assert.equal(value.artifact.path, "");
+    assert.ok(!JSON.stringify(value).includes("REDACTED"));
+    cases++;
+    await inspect(
+      mode,
+      {
+        capture_path: join(runtime.path, "invalid-private-parent.har"),
+        format: "har",
+        sensitive_values: ["response"],
+      },
+      "invalid_input",
+    );
+    cases++;
+    await inspect(
+      mode,
+      {
+        capture_path: join(runtime.path, "private-property-absent.har"),
+        format: "har",
+        sensitive_values: ["private-property", "REDACTED"],
+      },
+      "invalid_input",
+    );
+    cases++;
+    await inspect(
+      mode,
+      {
+        capture_path: join(runtime.path, "invalid-private-key.mitm"),
+        format: "mitmproxy",
+        sensitive_values: ["private-property"],
+      },
+      "invalid_input",
+    );
+    cases++;
+  }
+  for (const mode of ["cli", "mcp"]) {
+    const value = await inspect(mode, {
+      capture_path: join(runtime.path, "flows.mitm"),
+      format: "mitmproxy",
+      record_ordinals: [0],
+      sensitive_values: ["body"],
+    });
+    assert.equal(
+      value.records[0].binary_fields.find(
+        (field) => field.pointer === "/request/content",
+      ).state,
+      "redacted",
+    );
+    cases++;
+  }
+  for (const format of ["har", "mitmproxy"]) {
+    const path = join(runtime.path, `empty-${format}`);
+    await writeFile(
+      path,
+      format === "har"
+        ? JSON.stringify({
+            log: {
+              version: "1.2",
+              creator: { name: "source-owned-empty-fixture", version: "1" },
+              entries: [],
+            },
+          })
+        : "",
+    );
+    for (const mode of ["cli", "mcp"]) {
+      const value = await inspect(mode, { capture_path: path, format });
+      assert.equal(value.total_records, 0);
+      cases++;
+    }
+  }
+} catch (cause) {
+  failures.push(cause);
+} finally {
+  for (const cleanup of [
+    () => client.close(),
+    () => transport.close(),
+    () => runtime.close(),
+  ]) {
+    try {
+      await cleanup();
+    } catch (cause) {
+      failures.push(cause);
+    }
+  }
+}
+const verifier = await completeVerifierRun(run);
+try {
+  assert.equal(verifier.process_lineage.status, "verified");
+  assert.deepEqual(verifier.process_lineage.descendants, []);
+} catch (cause) {
+  failures.push(cause);
+}
+if (failures.length > 0) {
+  console.error(
+    JSON.stringify(
+      { status: "failed", public_cases: cases, verifier },
+      null,
+      2,
+    ),
+  );
+  throw new AggregateError(
+    failures,
+    "Historical capture verification failed; analysis and cleanup failures are retained.",
+  );
+}
+console.log(
+  JSON.stringify(
+    {
+      status: "passed",
+      public_cases: cases,
+      upstream: "mitmproxy 12.2.3 FlowWriter + SaveHar",
+      native_failure_classifications: 7,
+      offline: true,
+      verifier,
+    },
+    null,
+    2,
+  ),
+);
+
+async function inspect(mode, input, errorCategory) {
+  if (mode === "mcp") {
+    const result = await client.callTool({
+      name: "inspect_web_network_capture",
+      arguments: input,
+    });
+    const value = JSON.parse(mcpTextValue(result));
+    if (errorCategory !== undefined) {
+      assert.equal(result.isError, true);
+      assert.equal(value.error.category, errorCategory);
+      for (const literal of input.sensitive_values ?? [])
+        assert.ok(!JSON.stringify(value.error).includes(literal));
+      return value.error;
+    }
+    assert.notEqual(result.isError, true, mcpTextValue(result));
+    assertSensitiveLimitations(value.evidence, input.sensitive_values ?? []);
+    return value.result;
+  }
+  const args = [
+    entrypoint,
+    "inspect-web-network-capture",
+    input.capture_path,
+    input.format,
+    "--json",
+    ...(input.record_ordinals ?? []).flatMap((ordinal) => [
+      "--record",
+      String(ordinal),
+    ]),
+    ...(input.sensitive_values ?? []).flatMap((value) => [
+      "--sensitive-value",
+      value,
+    ]),
+  ];
+  let result;
+  try {
+    result = await promisify(execFile)(process.execPath, args, {
+      env: environment,
+      timeout: 40_000,
+      maxBuffer: 96 * 1024 * 1024,
+    });
+  } catch (cause) {
+    if (errorCategory === undefined) throw cause;
+    assert.equal(typeof cause.code, "number");
+    const value = JSON.parse(cause.stdout);
+    assert.equal(value.category, errorCategory);
+    for (const literal of input.sensitive_values ?? [])
+      assert.ok(!JSON.stringify(value).includes(literal));
+    return value;
+  }
+  assert.equal(errorCategory, undefined, "Expected malformed capture to fail");
+  const evidence = JSON.parse(result.stdout);
+  assertSensitiveLimitations(evidence, input.sensitive_values ?? []);
+  return evidence.normalized_result;
+}
+
+function assertSensitiveLimitations(evidence, literals) {
+  for (const value of Object.values(evidence.parameters))
+    if (typeof value === "string")
+      for (const literal of literals)
+        assert.ok(
+          !value.includes(literal),
+          "Declared literal retained in Evidence parameter",
+        );
+  const result = evidence.normalized_result;
+  if (result.artifact.sha256 === null) assert.equal(evidence.subject, null);
+  else assert.equal(evidence.subject.digest.sha256, result.artifact.sha256);
+  assert.deepEqual(
+    evidence.provider,
+    result.decoder,
+    "Evidence provider tuple changed",
+  );
+  assert.equal(
+    result.decoder.name,
+    result.format === "har"
+      ? "REA HAR capture adapter"
+      : "REA offline native mitmproxy adapter",
+  );
+  const texts = [
+    evidence.limitations,
+    result.limitations,
+    ...result.records.map((record) => record.limitations),
+  ].flat();
+  for (const literal of literals)
+    assert.ok(
+      texts.every((text) => !text.includes(literal)),
+      "Declared literal retained in authored limitations",
+    );
+}
+
+function assertBinary(record, pointer, bytes) {
+  const field = record.binary_fields.find((item) => item.pointer === pointer);
+  assert.ok(field, `Missing native byte field ${pointer}`);
+  assert.equal(field.state, "retained");
+  assert.equal(field.content_base64, bytes.toString("base64"));
+  assert.equal(field.bytes, bytes.length);
+  assert.equal(field.sha256, createHash("sha256").update(bytes).digest("hex"));
+}
--- a/Show More
+++ b/Show More