fix(javascript): keep selected-input filesystem failures typed

A selected directory that is readable but not searchable passed the R_OK
selection check, then every entry lstat failed and the result became a
generic artifact I/O failure. The selection owner now checks search
permission for directories and reads the selection metadata inside its
classifier, so EACCES/EPERM from realpath, lstat or access is a host
access denial with the selected path and system code.

Host filesystem failures that no narrower owner classifies no longer
drop their facts: EMFILE/ENFILE become a retryable capacity constraint,
and other errno failures keep artifact I/O with the host message and
system_code, syscall and path diagnostics.

Fixes #6116
Fixes #5991

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

docs/cli.md

@@ -551,6 +551,14 @@ command, objdump, Rizin and GDB, and the agent environment server
 signal-derived status. This describes the current source routing; it is not a
 claim that every command or provider runtime has been independently exercised.
 
+Commands with `--evidence_output` select their delivered view, then publish the
+complete Evidence bundle atomically. Cancellation before publication leaves no
+new file. A publication that has committed can win a later cancellation; the
+`cancelled` result then keeps the written path and byte count under
+`details.diagnostics.evidence_bundle`. If staging cleanup stays incomplete
+after commit, the `cleanup_incomplete` error reports the same file as
+`details.published_path` and `details.bytes`.
+
 When the reader of piped output closes early, as `rea ... | head` does, the
 CLI stops writing, prints no error and exits `141` (`128 + 13`, the status of a
 SIGPIPE-terminated writer). The operation itself may have completed; only its

docs/javascript-runtime-reconciliation.md

@@ -106,7 +106,11 @@ nodes. REA evaluates compatible static candidates conservatively:
    that disagreement. If a mapped candidate's digest is unavailable and no
    mapped content match is known, the comparison remains `unknown`.
 6. Missing authorization mappings and incomplete or truncated input coverage
-   remain unknown or truncated rather than becoming absence claims.
+   remain unknown or truncated rather than becoming absence claims. A runtime
+   location with no automatic artifact-root or caller-declared mapping into
+   any layer, and no unique content match, is `unknown` with
+   `no-authorized-location-mapping`, with or without captured bytes. Only a
+   mapped location can be `unmatched` with `no-static-content-match`.
 
 Every successful cross-layer `observed_as` edge has
 `authority: cross-layer-reconciliation` and `state: inferred`. The underlying

docs/testing.md

@@ -65,6 +65,18 @@ API dependency, and independent fixture compiler oracles keep their existing
 TypeScript versions.
 
 `npm run build:cached` compiles the CLI/MCP runtime and its packaged skill.
+The build also records `dist/mcp-catalog.json` (compact inputs) and
+`dist/mcp-catalog-full.json` from the canonical SDK registrations and binds
+each to the runtime with its own SHA-256 digest. These are
+runtime artifacts, separate from the test catalog below. Default target-free
+MCP startup serves its schemas without constructing analysis validators;
+the first tool or guided-workflow request materializes the canonical runtime
+on that same SDK server. Explicit compact/full input selections preserve
+their advertised schemas throughout materialization. Initial-target,
+HTTP and output-schema-off startup keep the eager path; source runs without
+recorded artifacts also use eager composition. Compare memory both after discovery and after a completed
+request; report diagnostic GC separately from normal resident memory.
+
 Turbo's strict task environment preserves caller-selected `GOMAXPROCS`,
 `GOMEMLIMIT`, and `UV_THREADPOOL_SIZE` for resource-constrained builds and
 checks. These execution controls do not change artifact content, so changing

experiments/analysis-efficiency/managed-cli-runtime.mjs

@@ -6,8 +6,9 @@ import { join, relative } from "node:path";
 import { fileURLToPath } from "node:url";
 const sha = (value) => createHash("sha256").update(value).digest("hex");
 
-/** Bind a trial to its source checkout and the compiled CLI actually launched. */
-export const captureRuntimeBinding = async (runtime) => {
+/** Bind a trial to its source checkout and compiled runtime, including deferred assets. */
+export const captureRuntimeBinding = async (runtime, kind = "cli") => {
+  assert.ok(kind === "cli" || kind === "mcp", "Unknown runtime entry");
   const root = await realpath(runtime);
   const git = (args) =>
     execFileSync("git", args, { cwd: root, maxBuffer: 16 * 1024 * 1024 });
@@ -50,10 +51,16 @@ export const captureRuntimeBinding = async (runtime) => {
         files.push(relative(root, path));
     }
   };
-  await visit(join(root, "dist/cli-runtime"));
+  // MCP materializes additional workers and reads build-owned JSON after
+  // discovery. Bind every compiled JS/JSON asset, rather than only its entry.
+  await visit(join(root, kind === "mcp" ? "dist" : "dist/cli-runtime"));
   assert.ok(
-    files.includes(join("dist", "cli-runtime", "cli.js")),
-    "Missing compiled CLI entry",
+    files.includes(
+      kind === "mcp"
+        ? join("dist", "mcp", "main.js")
+        : join("dist", "cli-runtime", "cli.js"),
+    ),
+    "Missing compiled runtime entry",
   );
   const hash = createHash("sha256");
   let bytes = 0;
@@ -63,15 +70,23 @@ export const captureRuntimeBinding = async (runtime) => {
     hash.update(JSON.stringify([name, value.length, sha(value)]) + "\n");
   }
   return {
-    binding_version: 1,
+    binding_version: kind === "mcp" ? 2 : 1,
     root,
     node: process.version,
     git_revision: gitRevision,
     source_diff_sha256: sha(sourceDiff),
     untracked_source_sha256: sha(JSON.stringify(untrackedEntries)),
-    compiled_cli_sha256: hash.digest("hex"),
-    compiled_cli_files: files.length,
-    compiled_cli_bytes: bytes,
+    ...(kind === "mcp"
+      ? {
+          compiled_runtime_sha256: hash.digest("hex"),
+          compiled_runtime_files: files.length,
+          compiled_runtime_bytes: bytes,
+        }
+      : {
+          compiled_cli_sha256: hash.digest("hex"),
+          compiled_cli_files: files.length,
+          compiled_cli_bytes: bytes,
+        }),
   };
 };
 
@@ -82,6 +97,10 @@ export const assertRuntimeBinding = (actual, expected, mode) => {
 
 if (process.argv[1] && fileURLToPath(import.meta.url) === process.argv[1]) {
   console.log(
-    JSON.stringify(await captureRuntimeBinding(process.argv[2]), null, 2),
+    JSON.stringify(
+      await captureRuntimeBinding(process.argv[2], process.argv[3]),
+      null,
+      2,
+    ),
   );
 }

experiments/analysis-efficiency/mcp-input-catalog.md

@@ -226,3 +226,8 @@ keeps default valid calls and typed refusals while checking full producer
 constraints separately. Five isolated suites passed 14 tests across call paths,
 ADB start, browser scenarios, source selection and managed analysis. The first
 browser attempt failed and remains recorded; no performance cohort changed.
+
+The subsequent [startup audit](mcp-startup.md) extends this harness with
+source/bundle bindings and a post-materialization directory check. Its new
+measurements are a separate cohort; reproduce this report at its recorded
+revision when comparing the original timing and model-session receipts.

experiments/analysis-efficiency/mcp-input-catalog.mjs

@@ -7,6 +7,10 @@ import { parseArgs } from "node:util";
 import { Client } from "@modelcontextprotocol/client";
 import { StdioClientTransport } from "@modelcontextprotocol/client/stdio";
 import { Ajv2020 } from "ajv/dist/2020.js";
+import {
+  captureRuntimeBinding,
+  assertRuntimeBinding,
+} from "./managed-cli-runtime.mjs";
 
 const { values } = parseArgs({
   options: {
@@ -15,26 +19,68 @@ const { values } = parseArgs({
     oracle: { type: "string" },
     output: { type: "string" },
     profile: { type: "string", default: "default" },
+    phase: { type: "string", default: "analysis" },
+    cache: { type: "string", default: "cold" },
+    "cache-root": { type: "string" },
+    bindings: { type: "string" },
+    role: { type: "string" },
   },
 });
-for (const key of ["runtime", "artifact", "oracle", "output"])
+assert.ok(["analysis", "discovery"].includes(values.phase));
+assert.ok(["cold", "warm"].includes(values.cache));
+for (const key of values.phase === "analysis"
+  ? ["runtime", "artifact", "oracle", "output"]
+  : ["runtime", "output"])
   assert.ok(
     values[key] && resolve(values[key]) === values[key],
     `${key} must be absolute`,
   );
 assert.ok(["default", "full", "compact"].includes(values.profile));
+if (values.cache === "warm")
+  assert.ok(
+    values["cache-root"] &&
+      resolve(values["cache-root"]) === values["cache-root"],
+  );
 await mkdir(values.output, { recursive: false });
 const hash = (value) => createHash("sha256").update(value).digest("hex");
-const oracle = JSON.parse(await readFile(values.oracle, "utf8"));
-const artifactSha = hash(await readFile(values.artifact));
-assert.equal(artifactSha, oracle.artifact_sha256);
+let oracle;
+let artifactSha;
+if (values.phase === "analysis") {
+  oracle = JSON.parse(await readFile(values.oracle, "utf8"));
+  artifactSha = hash(await readFile(values.artifact));
+  assert.equal(artifactSha, oracle.artifact_sha256);
+}
+let expectedBinding;
+let bindingBefore;
+let auditBeforeMs;
+let measurementInputsSha256;
+const producerSources = {};
+if (values.bindings !== undefined) {
+  assert.ok(["baseline", "candidate"].includes(values.role));
+  const inputBytes = await readFile(values.bindings);
+  measurementInputsSha256 = hash(inputBytes);
+  const inputs = JSON.parse(inputBytes.toString("utf8"));
+  for (const name of ["mcp-input-catalog.mjs", "managed-cli-runtime.mjs"]) {
+    producerSources[name] = hash(
+      await readFile(new URL(name, import.meta.url)),
+    );
+    assert.equal(producerSources[name], inputs.harness_sources_sha256[name]);
+  }
+  expectedBinding = inputs.runtime_bindings[values.role];
+  const start = performance.now();
+  bindingBefore = await captureRuntimeBinding(values.runtime, "mcp");
+  auditBeforeMs = performance.now() - start;
+  assertRuntimeBinding(bindingBefore, expectedBinding, values.role);
+}
 const environment = {
   PATH: process.env.PATH,
   HOME: values.output,
   REA_LOG_LEVEL: "silent",
   UV_THREADPOOL_SIZE: "1",
   NODE_OPTIONS: "--max-old-space-size=2048",
-  NODE_DISABLE_COMPILE_CACHE: "1",
+  ...(values.cache === "cold"
+    ? { NODE_DISABLE_COMPILE_CACHE: "1" }
+    : { NODE_COMPILE_CACHE: values["cache-root"] }),
   ...(values.profile === "default"
     ? {}
     : { REA_MCP_INPUT_SCHEMA_PROFILE: values.profile }),
@@ -46,14 +92,29 @@ const transport = new StdioClientTransport({
   env: environment,
   stderr: "pipe",
 });
+const protocolRequests = {};
+const send = transport.send.bind(transport);
+transport.send = (...args) => {
+  const method = args[0].method;
+  if (typeof method === "string")
+    protocolRequests[method] = (protocolRequests[method] ?? 0) + 1;
+  return send(...args);
+};
 const client = new Client({ name: "rea-catalog-task", version: "1" });
 const report = {
   profile: values.profile,
+  phase: values.phase,
+  cache: values.cache,
+  cache_root: values["cache-root"] ?? null,
+  role: values.role,
+  measurement_inputs_sha256: measurementInputsSha256,
+  producer_sources_sha256: producerSources,
   artifact_sha256: artifactSha,
   calls: [],
   checks: [],
   status: "incomplete",
   cleanup_verified: false,
+  protocol_requests: protocolRequests,
 };
 const transcript = [];
 let stderr = "";
@@ -63,6 +124,15 @@ transport.stderr?.on("data", (value) => {
 const began = performance.now();
 try {
   await client.connect(transport);
+  report.protocol_era = client.getProtocolEra();
+  await writeFile(
+    join(values.output, "server.json"),
+    JSON.stringify({
+      info: client.getServerVersion(),
+      capabilities: client.getServerCapabilities(),
+      instructions: client.getInstructions(),
+    }),
+  );
   const catalog = await client.listTools();
   assert.equal(catalog.nextCursor, undefined);
   const definitions = new Map(catalog.tools.map((tool) => [tool.name, tool]));
@@ -73,97 +143,145 @@ try {
       ajv.validateSchema(tool.inputSchema),
       `Invalid schema: ${tool.name}`,
     );
-  await writeFile(join(values.output, "catalog.json"), JSON.stringify(catalog));
+  {
+    const encoded = JSON.stringify(catalog);
+    await writeFile(join(values.output, "catalog.json"), encoded);
+    report.catalog_sha256 = hash(encoded);
+  }
   report.tool_names = [...definitions.keys()];
-  const call = async (name, args) => {
-    const definition = definitions.get(name);
-    assert.ok(definition, `Missing named tool ${name}`);
-    const start = performance.now();
-    const reply = await client.callTool(
-      { name, arguments: args },
-      { toolDefinition: definition },
+  if (values.phase === "discovery") {
+    const prompts = await client.listPrompts();
+    assert.equal(prompts.nextCursor, undefined);
+    await writeFile(
+      join(values.output, "prompts.json"),
+      JSON.stringify(prompts),
     );
-    report.calls.push({
-      name,
-      elapsed_ms: performance.now() - start,
-      is_error: reply.isError === true,
-    });
-    transcript.push({ name, arguments: args, reply });
-    return reply;
-  };
-  const input = {
-    path: values.artifact,
-    view: {
-      collection: "packages",
-      names: ["serde"],
-      fields: ["name", "version", "kind"],
-    },
-  };
-  const first = await call("inspect_rust_binary", input);
-  assert.notEqual(first.isError, true);
-  const selected = first.structuredContent;
-  assert.ok(selected?.normalized_result?.page);
-  assert.deepEqual(selected.normalized_result.page.rows, oracle.serde_rows);
-  assert.equal(selected.subject.digest.sha256, artifactSha);
-  const parentId = selected.normalized_result.parent_evidence_id;
-  for (let index = 0; index < 2; index++) {
-    const reply = await call("inspect_analysis_view", {
-      source: { kind: "retained-evidence", evidence_id: parentId },
+    report.prompts_sha256 = hash(JSON.stringify(prompts));
+    report.answer = {
+      tools: report.tool_names,
+      prompts: prompts.prompts.map((prompt) => prompt.name),
+    };
+    report.status = "passed";
+  } else {
+    const call = async (name, args) => {
+      const definition = definitions.get(name);
+      assert.ok(definition, `Missing named tool ${name}`);
+      const start = performance.now();
+      const reply = await client.callTool(
+        { name, arguments: args },
+        { toolDefinition: definition },
+      );
+      report.calls.push({
+        name,
+        elapsed_ms: performance.now() - start,
+        is_error: reply.isError === true,
+      });
+      transcript.push({ name, arguments: args, reply });
+      return reply;
+    };
+    const input = {
+      path: values.artifact,
       view: {
-        kind: "rust",
         collection: "packages",
         names: ["serde"],
         fields: ["name", "version", "kind"],
       },
+    };
+    const first = await call("inspect_rust_binary", input);
+    assert.notEqual(first.isError, true);
+    const selected = first.structuredContent;
+    assert.ok(selected?.normalized_result?.page);
+    assert.deepEqual(selected.normalized_result.page.rows, oracle.serde_rows);
+    assert.equal(selected.subject.digest.sha256, artifactSha);
+    const parentId = selected.normalized_result.parent_evidence_id;
+    for (let index = 0; index < 2; index++) {
+      const reply = await call("inspect_analysis_view", {
+        source: { kind: "retained-evidence", evidence_id: parentId },
+        view: {
+          kind: "rust",
+          collection: "packages",
+          names: ["serde"],
+          fields: ["name", "version", "kind"],
+        },
+      });
+      assert.notEqual(reply.isError, true);
+      assert.deepEqual(
+        reply.structuredContent.normalized_result.page.rows,
+        oracle.serde_rows,
+      );
+      assert.equal(
+        reply.structuredContent.normalized_result.parent_evidence_id,
+        parentId,
+      );
+    }
+    const malformed = await call("inspect_rust_binary", {
+      path: values.artifact,
+      view: { collection: "packages", offset: -1 },
     });
-    assert.notEqual(reply.isError, true);
+    assert.equal(malformed.isError, true);
+    report.checks.push(
+      "Independent package rows and digest; repeated retained identity; canonical negative-offset refusal",
+    );
+    const exported = await call("export_evidence_bundle", {
+      path: join(values.output, "evidence.json"),
+    });
+    assert.notEqual(exported.isError, true);
+    const bundle = JSON.parse(
+      await readFile(join(values.output, "evidence.json"), "utf8"),
+    );
+    const parent = bundle.records.find(
+      (record) => record.evidence_id === parentId,
+    );
+    assert.ok(parent, "Complete original Evidence is retained");
+    assert.equal(parent.subject.digest.sha256, artifactSha);
     assert.deepEqual(
-      reply.structuredContent.normalized_result.page.rows,
-      oracle.serde_rows,
+      parent.normalized_result.auditable_metadata.packages,
+      oracle.packages,
     );
-    assert.equal(
-      reply.structuredContent.normalized_result.parent_evidence_id,
-      parentId,
+    assert.deepEqual(
+      parent.normalized_result.auditable_metadata.dependency_edges,
+      oracle.edges,
     );
+    report.parent_evidence_id = parentId;
+    report.parent_semantic_sha256 = hash(JSON.stringify(parent));
+    report.answer = oracle.serde_rows;
+    assert.deepEqual(
+      await client.listTools(),
+      catalog,
+      "Advertisement changed after canonical materialization",
+    );
+    report.checks.push(
+      "Catalog remains identical after canonical materialization",
+    );
+    report.status = "passed";
   }
-  const malformed = await call("inspect_rust_binary", {
-    path: values.artifact,
-    view: { collection: "packages", offset: -1 },
-  });
-  assert.equal(malformed.isError, true);
-  report.checks.push(
-    "Independent package rows and digest; repeated retained identity; canonical negative-offset refusal",
-  );
-  const exported = await call("export_evidence_bundle", {
-    path: join(values.output, "evidence.json"),
-  });
-  assert.notEqual(exported.isError, true);
-  const bundle = JSON.parse(
-    await readFile(join(values.output, "evidence.json"), "utf8"),
-  );
-  const parent = bundle.records.find(
-    (record) => record.evidence_id === parentId,
-  );
-  assert.ok(parent, "Complete original Evidence is retained");
-  assert.equal(parent.subject.digest.sha256, artifactSha);
-  assert.deepEqual(
-    parent.normalized_result.auditable_metadata.packages,
-    oracle.packages,
-  );
-  assert.deepEqual(
-    parent.normalized_result.auditable_metadata.dependency_edges,
-    oracle.edges,
-  );
-  report.parent_evidence_id = parentId;
-  report.parent_semantic_sha256 = hash(JSON.stringify(parent));
-  report.answer = oracle.serde_rows;
-  report.status = "passed";
 } finally {
   await client.close();
   await transport.close();
   report.cleanup_verified = transport.pid === null;
   assert.ok(report.cleanup_verified);
   report.elapsed_ms = performance.now() - began;
+  if (expectedBinding !== undefined) {
+    const start = performance.now();
+    const after = await captureRuntimeBinding(values.runtime, "mcp");
+    report.runtime_audit_ms = {
+      before: auditBeforeMs,
+      after: performance.now() - start,
+    };
+    assertRuntimeBinding(after, expectedBinding, values.role);
+    assert.deepEqual(after, bindingBefore);
+    assert.equal(
+      hash(await readFile(values.bindings)),
+      measurementInputsSha256,
+    );
+    for (const [name, digest] of Object.entries(producerSources))
+      assert.equal(
+        hash(await readFile(new URL(name, import.meta.url))),
+        digest,
+      );
+    report.runtime_binding = after;
+    report.runtime_binding_verified = true;
+  }
   await writeFile(
     join(values.output, "report.json"),
     JSON.stringify(report, null, 2) + "\n",

experiments/analysis-efficiency/mcp-startup-costs.py

@@ -0,0 +1,118 @@
+"""Verify paired SDK startup/analysis receipts and account for the whole task."""
+import argparse
+import hashlib
+import importlib.util
+import json
+import statistics
+from pathlib import Path
+
+import tiktoken
+
+parser = argparse.ArgumentParser(description=__doc__)
+parser.add_argument('root', type=Path)
+parser.add_argument('--output', type=Path, required=True)
+args = parser.parse_args()
+root = args.root
+input_bytes = (root / 'measurement-inputs.json').read_bytes()
+inputs = json.loads(input_bytes)
+expected = inputs['runtime_bindings']
+sha = lambda value: hashlib.sha256(value).hexdigest()
+compact = lambda value: json.dumps(value, ensure_ascii=False, separators=(',', ':'), allow_nan=False)
+encoding = tiktoken.get_encoding('cl100k_base')
+count = lambda value: len(encoding.encode(value, disallowed_special=()))
+for role in ['baseline', 'candidate']:
+    assert expected[role]['git_revision'] == inputs[f'{role}_revision']
+    assert expected[role]['source_diff_sha256'] == sha(b'')
+    assert expected[role]['untracked_source_sha256'] == sha(b'[]')
+assert expected['baseline']['root'] != expected['candidate']['root']
+assert expected['baseline']['compiled_runtime_sha256'] != expected['candidate']['compiled_runtime_sha256']
+spec = importlib.util.spec_from_file_location('catalog_costs', Path(__file__).with_name('mcp-input-catalog-costs.py'))
+module = importlib.util.module_from_spec(spec)
+spec.loader.exec_module(module)
+catalogs = {}
+identities = {}
+rows = []
+for case in inputs['cases']:
+    directory = root / case['case']
+    report = json.loads((directory / 'report.json').read_text())
+    assert report['status'] == 'passed' and report['cleanup_verified']
+    assert report['runtime_binding_verified']
+    assert report['measurement_inputs_sha256'] == sha(input_bytes)
+    for name, producer_digest in report['producer_sources_sha256'].items():
+        assert producer_digest == inputs['harness_sources_sha256'][name]
+    assert report['runtime_binding'] == expected[case['role']]
+    for key in ['role', 'cache', 'profile', 'phase']:
+        assert report[key] == case[key]
+    raw = (directory / 'catalog.json').read_bytes()
+    catalog_digest = sha(raw)
+    assert catalog_digest == report['catalog_sha256']
+    profile = case['profile']
+    if profile not in catalogs:
+        catalog = json.loads(raw)
+        definitions = [{key: tool[key] for key in ['name', 'description', 'inputSchema']} for tool in catalog['tools']]
+        catalogs[profile] = {'sha256': catalog_digest, 'tool_count': len(catalog['tools']),
+                             'input_catalog_tokens': count(compact(definitions)),
+                             'raw_catalog_tokens': count(raw.decode()), 'raw_catalog_bytes': len(raw)}
+    assert catalog_digest == catalogs[profile]['sha256'], 'Directory differs across roles or phases'
+    transcript = json.loads((directory / 'transcript.json').read_text())
+    server = json.loads((directory / 'server.json').read_text())
+    tokens = {'question_and_recipe': count(inputs['questions'][case['phase']] + '\n' + inputs['recipes'][case['phase']]),
+              'server_instructions': count(server.get('instructions') or ''),
+              'input_catalog_once': catalogs[profile]['input_catalog_tokens'],
+              'arguments': sum(count(compact({'name': call['name'], 'arguments': call['arguments']})) for call in transcript),
+              'text_replies': sum(count(block['text']) for call in transcript for block in call['reply']['content'] if block['type'] == 'text')}
+    requests = report['protocol_requests']
+    assert requests['initialize'] == 1
+    if case['phase'] == 'analysis':
+        assert len(transcript) == 5 and requests['tools/call'] == 5 and requests['tools/list'] == 2
+        assert report['artifact_sha256'] == inputs['artifacts'][case['artifact']]['sha256']
+        identity = (report['parent_evidence_id'], report['parent_semantic_sha256'], sha(compact(report['answer']).encode()))
+        assert identities.setdefault(case['artifact'], identity) == identity
+        assert sum(call['is_error'] for call in report['calls']) == 1
+    else:
+        assert not transcript and requests.get('tools/call', 0) == 0
+        assert requests['tools/list'] == 1 and requests['prompts/list'] == 1
+        prompts = (directory / 'prompts.json').read_bytes()
+        assert sha(prompts) == report['prompts_sha256']
+        assert identities.setdefault('prompts', report['prompts_sha256']) == report['prompts_sha256']
+        tokens['prompt_directory'] = count(prompts.decode())
+    tokens['whole_task'] = sum(tokens.values())
+    resource = module.resource(directory)
+    for name, guard_digest in resource['guard_sources_sha256'].items():
+        assert guard_digest == inputs['harness_sources_sha256'][name]
+    del resource['guard_sources_sha256']
+    row = {**case, 'runtime_binding_sha256': sha(compact(report['runtime_binding']).encode()), 'runtime_audit_ms': report['runtime_audit_ms'],
+           'catalog_sha256': catalog_digest, 'parent_evidence_id': report.get('parent_evidence_id'),
+           'parent_semantic_sha256': report.get('parent_semantic_sha256'),
+           'answer_sha256': sha(compact(report['answer']).encode()), 'tokens_estimated': tokens,
+           'raw_catalog_result_tokens_all_lists': catalogs[profile]['raw_catalog_tokens'] * requests['tools/list'],
+           'raw_catalog_result_bytes_all_lists': catalogs[profile]['raw_catalog_bytes'] * requests['tools/list'],
+           'actual_model_usage': None, 'protocol_era': report['protocol_era'], 'protocol_requests': requests, 'calls': report['calls'],
+           **resource,
+           'receipt_sha256': {name: sha((directory / name).read_bytes()) for name in ['report.json', 'catalog.json', 'server.json', 'transcript.json']}}
+    assert row['catalog_sha256'] == row['receipt_sha256']['catalog.json'] == catalogs[profile]['sha256']
+    rows.append(row)
+assert len(rows) == 72
+summary = []
+for phase in ['discovery', 'analysis']:
+    for cache in ['cold', 'warm']:
+        for profile in ['default', 'full']:
+            for artifact in ([None] if phase == 'discovery' else ['ripgrep', 'zellij']):
+                item = {'phase': phase, 'cache': cache, 'profile': profile, 'artifact': artifact}
+                for role in ['baseline', 'candidate']:
+                    selected = [row for row in rows if all(row[key] == item[key] for key in ['phase', 'cache', 'profile', 'artifact']) and row['role'] == role]
+                    assert len(selected) == 3
+                    item[role] = {metric: {'median': statistics.median(row[metric] for row in selected),
+                                           'min': min(row[metric] for row in selected), 'max': max(row[metric] for row in selected)}
+                                  for metric in ['wall_seconds', 'cpu_seconds', 'kernel_family_peak_bytes_including_page_cache']}
+                    item[role]['tokens_estimated'] = [row['tokens_estimated']['whole_task'] for row in selected]
+                summary.append(item)
+result = {'status': 'passed', 'tokenizer': f'tiktoken=={tiktoken.__version__}/cl100k_base; estimates, not model usage',
+          'aggregation_sources_sha256': {path.name: sha(path.read_bytes()) for path in [Path(__file__), Path(spec.origin)]},
+          'context_scope': 'Question, explicit recipe, server instructions, one complete name/description/input-schema directory, every tool argument and text reply, plus prompt directory for discovery. This projection assumes the client retains a single unchanged directory. Raw catalog result costs include every observed tools/list result separately, with output schemas and without JSON-RPC envelopes. SDK initialization/framing, reasoning and actual model usage are unmeasured. The analysis task includes retained-read, rejection, export/oracle and post-materialization directory checks.',
+          'cache_scope': 'Cold disables server Node compile cache. Warm enables a prepopulated role/profile-specific cache after one complete analysis priming run. Fresh server/client processes and HOME each trial. Driver compile cache disabled in both cohorts. Cache hit rate and OS page cache are unmeasured; source/runtime audits warm compiled-file pages before startup.',
+          'resource_scope': 'Whole SDK driver, resource observer and owned REA process family. Includes before/after source-and-all-compiled-JS/JSON binding, SDK schema checks, extra validation calls, bundle export and independent oracle checking. Kernel cgroup peak includes file cache. Build/download/oracle preparation and cache priming excluded. Retained V8 heap and forced-GC diagnostics were not separately measured.',
+          'measurement_inputs': inputs, 'catalogs': catalogs, 'summary': summary, 'records': rows,
+          'warmup_receipts': {name: sha((root / name / 'report.json').read_bytes()) for name in [f'warmup-{profile}-{role}' for profile in ['default', 'full'] for role in ['baseline', 'candidate']]}}
+args.output.write_text(json.dumps(result, indent=2) + '\n')
+print(json.dumps(summary, indent=2))

experiments/analysis-efficiency/mcp-startup.md

@@ -0,0 +1,61 @@
+# MCP discovery and complete Rust tasks
+
+Target-free stdio discovery previously constructed the canonical analysis runtime before the client could inspect its directory. The candidate records SDK advertisements at build time for default/explicit compact and explicit full inputs. Its first tool, prompt or completion request materializes canonical validators and handlers on the same SDK server. HTTP, output-schema-off, initial-target and unrecorded source runs retain eager composition.
+
+Pinned baseline: [`main@c465ff5a8`](https://github.com/morluto/rea/commit/c465ff5a814b8e1a386fc547cbcd94df5c35f086). Measured candidate: [`04900abbc`](https://github.com/leeguooooo/rea/commit/04900abbcd3c3438fce4af932ff28400fe744a7d). Both use the same main base and locked dependencies. Before/after source and all compiled JS/JSON bindings identify the exact runtime used in every trial. The input manifest and producer scripts are also hashed and checked.
+
+## Real tasks and independent facts
+
+Official Alpine v3.21 packages supply ripgrep 14.1.1-r0 (3,416,168-byte executable) and Zellij 0.40.0-r0 (17,151,864 bytes). Their download URLs, archive/executable digests and aports revisions are retained in [the measurement data](mcp-startup.json). The independent Python ELF/section/zlib/JSON oracle checks 42 packages and 88 dependency edges for ripgrep, and 422 packages and 1,063 edges for Zellij. Serde versions are 1.0.210 and 1.0.137 respectively; the selected package kind remains explicit unknown (`null`). Verification covers embedded static build metadata; execution and runtime reachability remain unverified.
+
+Each analysis task initializes the actual SDK client, lists and validates the input directory, selects serde name/version/kind, reads the exact retained parent twice, verifies canonical rejection of a negative offset, exports and independently checks the complete package/edge inventory, confirms unchanged advertisements after materialization, then closes. All five tool calls and both directory reads are included in the measured task. Discovery tasks initialize, list tools/prompts, validate the input directory and close without an analysis call.
+
+All 72 paired trials and four priming runs passed. Each artifact has identical answers, parent Evidence IDs and complete semantic hashes across roles, profiles and cache modes. Both profiles retain byte-identical directories across baseline/candidate and before/after canonical materialization. The directory contains 213 tools. Complete Evidence is retained and exported through the existing shared workflow.
+
+## Measured cost
+
+Three alternating pairs per condition; table values are medians. Min/max ranges and individual receipts are in [mcp-startup.json](mcp-startup.json). Each cell is baseline → candidate. Kernel process-family peak includes file cache, SDK driver, observer and REA children.
+
+| Task      | Cache | Inputs            |  Wall seconds | Family CPU seconds | Family peak MiB |
+| --------- | ----- | ----------------- | ------------: | -----------------: | --------------: |
+| Directory | cold  | compact (default) | 5.661 → 2.236 |      5.403 → 2.050 |   559.3 → 248.6 |
+| Directory | cold  | full              | 5.256 → 2.337 |      5.040 → 2.175 |   650.9 → 349.1 |
+| Directory | warm  | compact (default) | 5.056 → 2.236 |      4.800 → 2.015 |   572.8 → 251.4 |
+| Directory | warm  | full              | 4.957 → 2.338 |      4.754 → 2.139 |   672.7 → 349.6 |
+| ripgrep   | cold  | compact (default) | 8.177 → 8.078 |      7.945 → 7.899 |   849.7 → 792.5 |
+| zellij    | cold  | compact (default) | 8.276 → 7.276 |      8.041 → 7.105 |   846.2 → 819.0 |
+| ripgrep   | cold  | full              | 8.180 → 7.483 |      8.000 → 7.312 |   846.5 → 794.4 |
+| zellij    | cold  | full              | 8.484 → 7.776 |      8.284 → 7.514 |   850.4 → 813.1 |
+| ripgrep   | warm  | compact (default) | 7.976 → 6.879 |      7.739 → 6.678 |   826.8 → 802.6 |
+| zellij    | warm  | compact (default) | 8.285 → 7.472 |      8.019 → 7.254 |   882.1 → 811.4 |
+| ripgrep   | warm  | full              | 8.074 → 7.476 |      7.890 → 7.265 |   852.1 → 803.6 |
+| zellij    | warm  | full              | 8.382 → 7.479 |      8.151 → 7.293 |   854.3 → 830.0 |
+
+Discovery improves clearly in this cohort. Completed-task changes depend on the workload: default cold ripgrep is approximately unchanged. Initialization moves into the first actual analysis request; its latency must be assessed with the full workflow.
+
+| Default ripgrep first RPC | Baseline ms | Candidate ms |
+| ------------------------- | ----------: | -----------: |
+| cold                      |       231.5 |       2532.1 |
+| warm                      |       227.1 |       2118.2 |
+
+Within each profile, advertised context remains identical. Input-directory estimates are 49,670 tokens for default compact and 205,744 for full. Whole-task estimates include the supplied question/recipe, server instructions, directory once, every tool argument and text reply, and the prompt directory in discovery tasks. This projection assumes the client retains one unchanged directory; raw catalog result costs count every observed list result separately, including output schemas. These use tiktoken 0.14.0/cl100k_base; actual model usage, reasoning and SDK initialization/framing are unmeasured.
+
+Linux x64 / AMD EPYC 7B12 / kernel 6.1.0-54-cloud-amd64 / Node 24.18.0, npm 11.16.0. Timed SDK tasks negotiated the legacy protocol era; auto/modern correctness is covered separately by compiled boundary tests. Trials run serially under a 1-CPU quota pinned to CPU 15, 4 GiB hard memory / 3 GiB early stop, no swap and 192 tasks. No resource stop, OOM or remaining payload process was observed. Cold disables server Node compile cache; warm uses a role/profile-specific cache populated by one complete task. Fresh processes and HOME are used each trial. Cache hit rate and OS page cache are unmeasured. Runtime audits warm compiled-file pages and are included in whole-task costs. Builds, downloads, oracle generation and cache priming are preparation outside those costs. Retained V8 heap and forced-GC measurements were not separately collected.
+
+## Ownership and validation
+
+`OwnedMcpServers` seals publication before taking its close snapshot, keeps failed exact close capabilities for retry and serves both eager and deferred paths. Deferred startup still joins servers published before an asynchronous serving handle settles. Post-snapshot and post-close factory calls are refused before allocation. Both production-boundary regressions fail with only the shared guard removed and pass restored.
+
+The moved transport/delivery implementation preserves current complete-error retention, escaped-preview fitting, response/string-limit recovery, target-content provenance and native Evidence continuations. Canonical parsers remain authoritative after lazy binding. Both protocol eras, input/output profile choices, invalid input/output, completion cancellation, partial startup and cleanup retry are exercised.
+
+Aggregation keeps catalog, producer-script and guard-script digests in distinct variables. Before publishing a trial it verifies that the catalog digest matches both its catalog-file receipt and the shared profile identity. Deliberately selecting the guard digest for that field is rejected. Regeneration preserves all measured timing, CPU, memory, context and parent-Evidence values.
+
+Executed local gates: 125 focused tests across 14 files; a repeated 22-case schema/profile subset after the pinned main merge; all six static-check tasks plus architecture guards; builds for both pinned runtimes; six documentation checks and five README consistency tests. HTTP coverage includes the real compiled CLI session/replacement/Host tests. Runtime-binding admission rejects a mismatched compiled graph before MCP launch; aggregation rejects a tampered trial binding. The raw receipts remain in `/tmp/rea-perf-mcp-startup-20261022`, identified by hashes in the data. Real initial-target providers, foreign OS runtime behavior and other providers remain outside this measurement.
+
+## Reproduction
+
+Use the pinned Node/npm toolchain and separate clean baseline/candidate checkouts. Build each with `npm ci` and `npm run build:cached` (the measured workspace shared one locked dependency installation). Acquire and verify the official packages listed in the data, extract the named executables and generate independent oracles with `mcp-input-catalog-oracle.py`.
+
+Capture each checkout with `node experiments/analysis-efficiency/managed-cli-runtime.mjs CHECKOUT mcp`. Construct `measurement-inputs.json` using the recorded schema, updating absolute checkout/artifact/oracle paths and their independently verified bindings. Keep it immutable through a cohort; producer source digests cover `mcp-input-catalog.mjs`, `managed-cli-runtime.mjs`, `resource-run.py` and `resource_payload.py`.
+
+Run `mcp-input-catalog.mjs` through `resource-run.py --observe-payload-exit` with `--runtime`, `--output`, `--bindings`, `--role baseline|candidate`, `--profile default|full`, `--phase discovery|analysis` and `--cache cold|warm`. Analysis also takes `--artifact` and `--oracle`; warm requires a role/profile-specific `--cache-root`. Disable the driver compile cache for both cohorts. Prime each warm role/profile once with the complete ripgrep task. Follow the 72-case order in the data, reversing role order in every second pair. Aggregate with `python mcp-startup-costs.py LAB --output mcp-startup.json` using tiktoken 0.14.0. The aggregator verifies every input/runtime/guard binding and completed receipt before producing summaries.

package.json

@@ -305,8 +305,8 @@
     "verify:solidity:metadata": "npm run build:cached && node scripts/verify-solidity-metadata.mjs",
     "verify:recorded:crash": "npm run build:cached && node scripts/verify-recorded-crash.mjs",
     "mcp-catalog:check:built": "node scripts/generate-mcp-tool-catalog.mjs --check",
-    "compile": "node scripts/clean-build-output.mjs && node scripts/run-typescript.mjs -p tsconfig.build.json && node scripts/record-catalog-digests.mjs && node scripts/bundle-runtime.mjs",
-    "compile:termux": "node scripts/clean-build-output.mjs && node --max-old-space-size=3072 node_modules/typescript-termux/lib/tsc.js -p tsconfig.build.json && node scripts/record-catalog-digests.mjs && node scripts/bundle-runtime.mjs",
+    "compile": "node scripts/clean-build-output.mjs && node scripts/run-typescript.mjs -p tsconfig.build.json && node scripts/record-catalog-digests.mjs && node scripts/record-mcp-catalog.mjs && node scripts/bundle-runtime.mjs",
+    "compile:termux": "node scripts/clean-build-output.mjs && node --max-old-space-size=3072 node_modules/typescript-termux/lib/tsc.js -p tsconfig.build.json && node scripts/record-catalog-digests.mjs && node scripts/record-mcp-catalog.mjs && node scripts/bundle-runtime.mjs",
     "artifacts:mcp-catalog": "node scripts/generate-mcp-tool-catalog.mjs",
     "artifacts:skills": "node scripts/generate-skill-metadata.mjs",
     "artifacts:product-catalog": "node scripts/generate-product-catalog.mjs",

scripts/lib/development-tests.mjs

@@ -39,6 +39,7 @@ export const parseDevelopmentTestRequest = (mode, arguments_) => {
 // runtime or typecheck prerequisites. Add a consumer here when it reads one.
 const artifactConsumers = {
   "artifacts:mcp-catalog": [
+    "tests/boundary/mcp/deferredRuntime.test.ts",
     "tests/boundary/mcp/contractPresentation.test.ts",
     "tests/boundary/mcp/toolSchemaValidity.test.ts",
   ],

scripts/record-mcp-catalog.mjs

@@ -0,0 +1,119 @@
+import { createHash } from "node:crypto";
+import { mkdtemp, rm, writeFile } from "node:fs/promises";
+import { tmpdir } from "node:os";
+import { dirname, join, resolve } from "node:path";
+import { fileURLToPath, pathToFileURL } from "node:url";
+import { Client, InMemoryTransport } from "@modelcontextprotocol/client";
+
+// Runtime discovery is generated from the same canonical registrations, after
+// default identity has been recorded and before bundling. Test catalogs stay separate.
+const compiled = resolve(dirname(fileURLToPath(import.meta.url)), "../dist");
+const read = (name) => import(pathToFileURL(join(compiled, name)).href);
+const [
+  { createServer },
+  { createBinarySession },
+  { parseConfig },
+  { silentLogger },
+  { PROMPT_CONTRACTS },
+] = await Promise.all([
+  read("server/createServer.js"),
+  read("composition/binary.js"),
+  read("config/parseConfig.js"),
+  read("logger.js"),
+  read("contracts/promptContracts.js"),
+]);
+const recordCatalog = async (profile) => {
+  // Catalog generation is independent of the host account and user configuration.
+  const home = await mkdtemp(join(tmpdir(), "rea-mcp-catalog-"));
+  const environment = {
+    REA_MCP_INPUT_SCHEMA_PROFILE: profile,
+    HOME: home,
+    USERPROFILE: home,
+    XDG_CONFIG_HOME: join(home, "config"),
+    XDG_CACHE_HOME: join(home, "cache"),
+    XDG_STATE_HOME: join(home, "state"),
+  };
+  const cleanup = [];
+  let producerFailure;
+  try {
+    const config = parseConfig(environment);
+    if (!config.ok) throw config.error;
+    const session = createBinarySession(
+      config.value,
+      silentLogger,
+      environment,
+    );
+    cleanup.push(async () => {
+      const closed = await session.close({ retainProviderDocuments: true });
+      if (!closed.ok) throw closed.error;
+    });
+    const server = createServer({ kind: "session", session }, { environment });
+    cleanup.push(() => server.close());
+    const client = new Client({ name: "rea-catalog-recorder", version: "1" });
+    cleanup.push(() => client.close());
+    const [clientTransport, serverTransport] =
+      InMemoryTransport.createLinkedPair();
+    await server.connect(serverTransport);
+    await client.connect(clientTransport);
+    const tools = (await client.listTools()).tools;
+    const prompts = (await client.listPrompts()).prompts.map((prompt) => {
+      const contract = PROMPT_CONTRACTS.find(
+        (candidate) => candidate.name === prompt.name,
+      );
+      if (contract === undefined)
+        throw new Error(`Missing prompt ${prompt.name}`);
+      return { ...prompt, parameters: contract.arguments };
+    });
+    const catalog = {
+      version: 1,
+      info: client.getServerVersion(),
+      capabilities: client.getServerCapabilities(),
+      instructions: client.getInstructions(),
+      identity: server.catalogIdentity,
+      tools,
+      prompts,
+    };
+    const encoded = JSON.stringify(catalog);
+    const digest = createHash("sha256").update(encoded).digest("hex");
+    await writeFile(
+      join(
+        compiled,
+        profile === "full" ? "mcp-catalog-full.json" : "mcp-catalog.json",
+      ),
+      encoded,
+    );
+    return digest;
+  } catch (cause) {
+    producerFailure = { cause };
+    throw cause;
+  } finally {
+    const results = await Promise.allSettled(
+      cleanup.reverse().map((close) => Promise.resolve().then(close)),
+    );
+    const failures = results.flatMap((result) =>
+      result.status === "rejected" ? [result.reason] : [],
+    );
+    if (failures.length === 0) {
+      try {
+        await rm(home, { recursive: true, force: true });
+      } catch (cause) {
+        failures.push(cause);
+      }
+    }
+    if (failures.length > 0)
+      throw new AggregateError(
+        producerFailure === undefined
+          ? failures
+          : [producerFailure.cause, ...failures],
+        `Catalog cleanup failed; temporary home retained at ${home}`,
+      );
+  }
+};
+
+const digests = {};
+for (const profile of ["compact", "full"])
+  digests[profile] = await recordCatalog(profile);
+await writeFile(
+  join(compiled, "recordedMcpCatalog.js"),
+  `/** Recorded from the compiled runtime; do not edit. */\nexport const RECORDED_MCP_CATALOG_SHA256 = ${JSON.stringify(digests)};\n`,
+);

src/application/EvidenceBundleCommands.ts

@@ -98,26 +98,60 @@ export const deliverAnalysisEvidence = async (
         )
       : ok(evidence);
   if (!delivered.ok) return delivered;
-  const written = await persistEvidenceBundleCommand(
+  const published = await publishEvidenceDelivery({
     bundle,
+    complete: evidence,
+    delivered: delivered.value,
     outputPath,
+    operation: evidence.operation,
+    signal,
+  });
+  return published.ok ? ok(published.value.delivered) : published;
+};
+
+/** Selected Evidence delivered after its complete bundle was committed. */
+export interface PublishedEvidenceDelivery {
+  readonly delivered: Evidence;
+  readonly evidenceBundle: PublishedEvidenceFile;
+}
+
+/**
+ * Publish a complete bundle, then deliver Evidence already projected from it.
+ * Cancellation observed before commit leaves no output and retains the
+ * complete Evidence. A committed publication wins a later cancellation race;
+ * its receipt stays in the typed cancellation as diagnostics.evidence_bundle,
+ * and a cleanup failure after commit keeps its own published receipt.
+ */
+export const publishEvidenceDelivery = async (input: {
+  readonly bundle: EvidenceBundle;
+  readonly complete: Evidence;
+  readonly delivered: Evidence;
+  readonly outputPath: string;
+  readonly operation: string;
+  readonly signal?: AbortSignal | undefined;
+}): Promise<Result<PublishedEvidenceDelivery, AnalysisError>> => {
+  const { signal, operation } = input;
+  const written = await persistEvidenceBundleCommand(
+    input.bundle,
+    input.outputPath,
     false,
     signal,
-    evidence.operation,
+    operation,
   );
   // Deliver interrupts queued during final publication cleanup before the
   // command's signal owner accepts completion and removes its listeners.
   await dispatchQueuedInterrupts();
-  if (!written.ok) return err(written.error.retainPartialObservation(evidence));
+  if (!written.ok)
+    return err(written.error.retainPartialObservation(input.complete));
   if (signal?.aborted)
     return err(
-      new AnalysisCancelledError(evidence.operation, {
+      new AnalysisCancelledError(operation, {
         cause: signal.reason,
-        partialObservation: delivered.value,
+        partialObservation: input.delivered,
         diagnostics: { evidence_bundle: { ...written.value } },
       }),
     );
-  return delivered;
+  return ok({ delivered: input.delivered, evidenceBundle: written.value });
 };
 
 /** Resolve the caller's exact retained parent from an authenticated portable bundle. */

src/application/ReferenceSourceVcsAdapter.ts

@@ -9,6 +9,7 @@ import {
   RegularFileCleanupFailure,
   retryRegularFileCleanup,
 } from "./RegularFileRead.js";
+import { referenceSourceResourceFailure } from "../reference/ReferenceSourceReaderErrors.js";
 import type { ReferenceSourceReaderError } from "../reference/ReferenceSourceReaderTypes.js";
 
 export type ReferenceSourceVcsInfo =
@@ -59,13 +60,7 @@ export const readReferenceSourceVcs = async (
     });
   } catch (cause: unknown) {
     if (!(cause instanceof ArtifactReaderFailure)) throw cause;
-    return err({
-      tag: "reference-source-reader",
-      code: cause.reason === "cancelled" ? "cancelled" : "io",
-      message: cause.message,
-      ...(cause.cleanup === undefined ? {} : { cleanup: cause.cleanup }),
-      cause,
-    });
+    return err(referenceSourceResourceFailure(cause));
   }
 };
 

src/application/captures/PacketCaptureService.test.ts

@@ -0,0 +1,102 @@
+import { expect, it } from "vitest";
+
+import {
+  createAnalysisExecution,
+  type ExecutionOptions,
+} from "../AnalysisProvider.js";
+import { PacketCaptureService } from "./PacketCaptureService.js";
+import { createAnalysisProfile } from "../../domain/analysisProfile.js";
+import { inspectPacketCaptureInputSchema } from "../../domain/captures/packetCapture.js";
+import { ok } from "../../domain/result.js";
+
+it("retains provider metadata in a late-cancellation observation", async () => {
+  const input = inspectPacketCaptureInputSchema.parse({
+    path: process.platform === "win32" ? "C:\\capture.pcap" : "/capture.pcap",
+    fields: ["ip.addr"],
+  });
+  const provider = {
+    id: "fixture-capture",
+    name: "Fixture capture provider",
+    version: "1",
+  } as const;
+  const subject = {
+    path: input.path,
+    sha256: "a".repeat(64),
+    format: "file",
+  } as const;
+  const report = {
+    artifact: { path: input.path, sha256: subject.sha256, bytes: 12 },
+    selection: input,
+    packets: [],
+    output_window: {
+      matching_packets: 0,
+      returned_packets: 0,
+      has_more: false,
+    },
+    read_scope: "to-eof",
+    diagnostics: "",
+    tool: {
+      configured_path: "/fixture/tshark",
+      path: "/fixture/tshark",
+      sha256: "b".repeat(64),
+      version_banner: "TShark fixture",
+      version_diagnostics: "",
+      arguments: [],
+    },
+    configuration: "private-empty-personal-profile",
+    resource_limiter: {
+      configured_path: "/fixture/prlimit",
+      path: "/fixture/prlimit",
+      sha256: "c".repeat(64),
+      arguments: [],
+    },
+    limits: {
+      input_bytes: 1,
+      output_bytes: 1,
+      command_timeout_ms: 1,
+      address_space_bytes: 0,
+      file_bytes: 0,
+      cpu_seconds: 0,
+    },
+    hardware_acquisition: "not-performed",
+  } as const;
+  const rawResult = { producer: "fixture", bytes: 12 };
+  const profile = createAnalysisProfile(provider, { filter: null });
+  const relationshipCoverage = {
+    status: "unknown",
+    reason: "Packet relationships are not reported.",
+  } as const;
+  const execution = createAnalysisExecution(report, provider, {
+    subject,
+    rawResult,
+    analysisProfile: profile,
+    relationshipCoverage,
+    locations: [{ kind: "artifact-path", path: input.path }],
+  });
+  const controller = new AbortController();
+  const reason = Object.freeze({ requested: "cancel after capture result" });
+  const service = new PacketCaptureService({
+    inspect: async (_input, options?: ExecutionOptions) => {
+      controller.abort(reason);
+      expect(options?.signal).toBe(controller.signal);
+      return ok(execution);
+    },
+    inspectFields: async () => {
+      throw new Error("Unexpected field discovery call");
+    },
+    close: async () => {},
+  });
+
+  const result = await service.inspect(input, { signal: controller.signal });
+
+  expect(result.ok).toBe(false);
+  if (result.ok) throw new Error("Expected late cancellation");
+  expect(result.error).toMatchObject({ _tag: "AnalysisCancelledError" });
+  expect(result.error.cause).toBe(reason);
+  expect(result.error.partialObservation).toMatchObject({
+    operation: "inspect_packet_capture",
+    raw_result: rawResult,
+    analysis_profile: profile,
+    relationship_coverage: relationshipCoverage,
+  });
+});

src/application/captures/PacketCaptureService.ts

@@ -3,24 +3,25 @@ import {
   packetFieldsCatalogSchema,
   type InspectPacketFieldsInput,
 } from "../../domain/captures/packetFields.js";
-import type { JsonValue } from "../../domain/jsonValue.js";
-import type {
-  AnalysisExecution,
-  ExecutionOptions,
+import {
+  createAnalysisExecutionEvidence,
+  type AnalysisExecution,
+  type ExecutionOptions,
 } from "../AnalysisProvider.js";
 import type { AnalysisError } from "../../domain/analysisErrorBase.js";
 import {
   AnalysisCancelledError,
   AnalysisOutputError,
 } from "../../domain/analysisErrorCore.js";
-import { createEvidence, type Evidence } from "../../domain/evidence.js";
+import type { Evidence } from "../../domain/evidence.js";
 import { analysisInputErrorFromIssues } from "../../domain/inputIssueProjection.js";
 import {
   inspectPacketCaptureInputSchema,
   packetCaptureSchema,
   type InspectPacketCaptureInput,
 } from "../../domain/captures/packetCapture.js";
-import { err, ok, type Result } from "../../domain/result.js";
+import { err, type Result } from "../../domain/result.js";
+import { completeProviderEvidence } from "../ProviderOperationExecution.js";
 
 export interface PacketCapturePort {
   /** Release per-call resources before returning, or retain failed cleanup for close/retry. */
@@ -74,7 +75,15 @@ export class PacketCaptureService {
           "Capture analyzer returned malformed data or changed the selected artifact identity/options.",
         ),
       );
-    return this.#evidence(operation, input.data, execution, options);
+    return completeProviderEvidence(
+      createAnalysisExecutionEvidence(
+        operation,
+        input.data,
+        execution,
+        "observed",
+      ),
+      options?.signal,
+    );
   }
   async inspectFields(
     raw: unknown,
@@ -108,33 +117,14 @@ export class PacketCaptureService {
           "Field discovery returned malformed data or changed the selected installation/options.",
         ),
       );
-    return this.#evidence(operation, input.data, execution, options);
-  }
-  #evidence(
-    operation: string,
-    parameters: Readonly<Record<string, JsonValue>>,
-    execution: AnalysisExecution,
-    options?: ExecutionOptions,
-  ): Result<Evidence, AnalysisError> {
-    const evidence = createEvidence(
-      execution.subject ?? undefined,
-      execution.provider,
-      {
+    return completeProviderEvidence(
+      createAnalysisExecutionEvidence(
         operation,
-        parameters,
-        result: execution.result,
-        confidence: "observed",
-        locations: execution.locations,
-        limitations: execution.limitations,
-      },
+        input.data,
+        execution,
+        "observed",
+      ),
+      options?.signal,
     );
-    return options?.signal?.aborted
-      ? err(
-          new AnalysisCancelledError(operation, {
-            cause: options.signal.reason,
-            partialObservation: evidence,
-          }),
-        )
-      : ok(evidence);
   }
 }

src/application/firmware/FirmwareAnalysisService.test.ts

@@ -8,6 +8,7 @@ import {
 } from "../../domain/firmware/firmwareAnalysis.js";
 import { AnalysisOutputError } from "../../domain/analysisErrorCore.js";
 import { err, ok } from "../../domain/result.js";
+import { createAnalysisProfile } from "../../domain/analysisProfile.js";
 
 const fixture = (
   operation: FirmwareOperation,
@@ -68,15 +69,35 @@ it.each(["inspect_firmware_regions", "extract_firmware"] as const)(
   "retains %s Evidence after late cancellation and preserves provider failure precedence",
   async (operation) => {
     const { input, execution } = fixture(operation);
+    const profile = createAnalysisProfile(
+      { ...execution.provider, version: "1" },
+      {
+        signature_database: "caller-selected snapshot",
+      },
+    );
+    const coverage = {
+      status: "unknown",
+      reason: "No call graph examined",
+    } as const;
+    const observation = {
+      ...execution,
+      analysisProfile: profile,
+      relationshipCoverage: coverage,
+    };
     const control = await new FirmwareAnalysisService({
-      execute: async () => ok(execution),
+      execute: async () => ok(observation),
     }).execute(operation, input);
     if (!control.ok) throw control.error;
+    expect(control.value).toMatchObject({
+      raw_result: { source: "controlled producer" },
+      analysis_profile: profile,
+      relationship_coverage: coverage,
+    });
     const controller = new AbortController();
     const result = await new FirmwareAnalysisService({
       execute: async () => {
         controller.abort();
-        return ok(execution);
+        return ok(observation);
       },
     }).execute(operation, input, { signal: controller.signal });
     expect(result).toMatchObject({

src/application/firmware/FirmwareAnalysisService.ts

@@ -1,4 +1,7 @@
-import type { ExecutionOptions } from "../AnalysisProvider.js";
+import {
+  createAnalysisExecutionEvidence,
+  type ExecutionOptions,
+} from "../AnalysisProvider.js";
 import type { FirmwareAnalysisPort } from "./FirmwareAnalysisPort.js";
 import {
   firmwareRequestSchema,
@@ -12,8 +15,7 @@ import {
   AnalysisOutputError,
 } from "../../domain/analysisErrorCore.js";
 import type { AnalysisError } from "../../domain/analysisErrorBase.js";
-import { createEvidence, type Evidence } from "../../domain/evidence.js";
-import { jsonObjectSchema } from "../../domain/jsonValue.js";
+import type { Evidence } from "../../domain/evidence.js";
 import { projectInputIssues } from "../../domain/inputIssueProjection.js";
 import { err, type Result } from "../../domain/result.js";
 import { completeProviderEvidence } from "../ProviderOperationExecution.js";
@@ -71,15 +73,12 @@ export class FirmwareAnalysisService {
         ),
       );
     return completeProviderEvidence(
-      createEvidence(execution.subject, execution.provider, {
+      createAnalysisExecutionEvidence(
         operation,
-        parameters: jsonObjectSchema.parse(parsed.data.input),
-        result: execution.result,
-        rawResult: execution.rawResult,
-        locations: execution.locations,
-        limitations: execution.limitations,
-        confidence: "observed",
-      }),
+        parsed.data.input,
+        execution,
+        "observed",
+      ),
       options?.signal,
     );
   }

src/application/javascript/ElectronBoundaryGraphCallPaths.ts

@@ -1,3 +1,4 @@
+import { javascriptSourceRangeKey } from "../../domain/javascript/javascriptSourceCoordinates.js";
 import type { ApplicationNode } from "../../domain/javascript/javascriptApplicationGraphSchemas.js";
 import type { ElectronCallPath } from "../../domain/javascript/electronStaticAnalysisTypes.js";
 import type { JavaScriptArtifactFile } from "../../domain/javascript/javascriptArtifactFiles.js";
@@ -10,7 +11,6 @@ import {
 import {
   addElectronInferenceEdge,
   electronFindingSourceNode,
-  electronRangeKey,
 } from "./ElectronBoundaryGraphContext.js";
 import {
   artifactLocalIdentity,
@@ -191,13 +191,15 @@ const matches = (
     path.steps.some(
       (step) =>
         step.kind === sourceStepKind &&
-        electronRangeKey(step.location) === electronRangeKey(finding.location),
+        javascriptSourceRangeKey(step.location) ===
+          javascriptSourceRangeKey(finding.location),
     ) &&
     (invocation === undefined ||
       path.steps.some(
         (step) =>
           (step.kind === "call" || step.kind === "exposure") &&
-          electronRangeKey(step.location) === electronRangeKey(invocation),
+          javascriptSourceRangeKey(step.location) ===
+            javascriptSourceRangeKey(invocation),
       ))
   );
 };

src/application/javascript/ElectronBoundaryGraphContext.ts

@@ -108,23 +108,3 @@ export const addElectronInferenceEdge = (
     }),
   });
 };
-
-/** Deterministic source-range key for artifact-local graph identities. */
-export const electronRangeKey = (range: JavaScriptSourceRange): string =>
-  `${String(range.start.line)}:${String(range.start.column)}-${String(range.end.line)}:${String(range.end.column)}`;
-
-/** Test exact source-range containment without assuming runtime reachability. */
-export const electronRangeContains = (
-  outer: JavaScriptSourceRange,
-  inner: JavaScriptSourceRange,
-): boolean =>
-  comparePoint(outer.start, inner.start) <= 0 &&
-  comparePoint(outer.end, inner.end) >= 0;
-
-const comparePoint = (
-  left: JavaScriptSourceRange["start"],
-  right: JavaScriptSourceRange["start"],
-): number =>
-  left.line === right.line
-    ? left.column - right.column
-    : left.line - right.line;

src/application/javascript/ElectronBoundaryGraphIpc.ts

@@ -1,3 +1,7 @@
+import {
+  javascriptSourceRangeKey,
+  javascriptSourceRangeContains,
+} from "../../domain/javascript/javascriptSourceCoordinates.js";
 import type { ApplicationNode } from "../../domain/javascript/javascriptApplicationGraphSchemas.js";
 import type { ElectronSenderValidationFinding } from "../../domain/javascript/electronStaticAnalysisTypes.js";
 import type { JavaScriptArtifactFile } from "../../domain/javascript/javascriptArtifactFiles.js";
@@ -21,8 +25,6 @@ import {
   addElectronInferenceEdge,
   electronFindingSourceNode,
   electronObservationIdentity,
-  electronRangeContains,
-  electronRangeKey,
 } from "./ElectronBoundaryGraphContext.js";
 
 interface IpcGraphState {
@@ -182,7 +184,7 @@ const addHandlerNode = (input: IpcHandlerInput): ApplicationNode => {
     identity: artifactLocalIdentity(
       file.sha256,
       "electron-ipc-handler",
-      `${finding.side}:${finding.operation}:${finding.channel ?? finding.channel_expression}:${electronRangeKey(handlerRange)}`,
+      `${finding.side}:${finding.operation}:${finding.channel ?? finding.channel_expression}:${javascriptSourceRangeKey(handlerRange)}`,
     ),
     observations: [
       {
@@ -338,7 +340,7 @@ const containingHandler = (
       (record) =>
         record.file.path === file.path &&
         record.finding.handler_location !== null &&
-        electronRangeContains(
+        javascriptSourceRangeContains(
           record.finding.handler_location,
           validation.location,
         ),

src/application/javascript/ElectronBoundaryGraphNative.ts

@@ -1,3 +1,4 @@
+import { javascriptSourceRangeKey } from "../../domain/javascript/javascriptSourceCoordinates.js";
 import type { ElectronNativeAddonBindingFinding } from "../../domain/javascript/electronStaticAnalysisTypes.js";
 import type { JavaScriptArtifactFile } from "../../domain/javascript/javascriptArtifactFiles.js";
 import {
@@ -13,7 +14,6 @@ import {
   addElectronInferenceEdge,
   electronFindingSourceNode,
   electronObservationIdentity,
-  electronRangeKey,
 } from "./ElectronBoundaryGraphContext.js";
 
 interface NativeBindingInput {
@@ -65,7 +65,7 @@ const addNativeBinding = (input: NativeBindingInput): void => {
         value.members,
         value.namespace_access ?? null,
         value.dynamic_member_access ?? null,
-        electronRangeKey(value.location),
+        javascriptSourceRangeKey(value.location),
       ]),
     ),
     observations: [

src/application/javascript/ElectronBoundaryGraphWindows.ts

@@ -1,3 +1,4 @@
+import { javascriptSourceRangeKey } from "../../domain/javascript/javascriptSourceCoordinates.js";
 import type { ApplicationNode } from "../../domain/javascript/javascriptApplicationGraphSchemas.js";
 import type {
   ElectronBrowserWindowFinding,
@@ -21,7 +22,6 @@ import {
   addElectronAstEdge,
   addElectronInferenceEdge,
   electronFindingSourceNode,
-  electronRangeKey,
 } from "./ElectronBoundaryGraphContext.js";
 import {
   artifactPathResolutionProperties,
@@ -86,11 +86,11 @@ const addBrowserWindow = (
     identity: artifactLocalIdentity(
       file.sha256,
       "electron-browser-window",
-      electronRangeKey(value.location),
+      javascriptSourceRangeKey(value.location),
     ),
     observations: [
       {
-        label: `BrowserWindow@${electronRangeKey(value.location)}`,
+        label: `BrowserWindow@${javascriptSourceRangeKey(value.location)}`,
         properties: {
           source_path: file.path,
           options_status: value.options_status,
@@ -202,7 +202,7 @@ const addContextBridge = (
     identity: artifactLocalIdentity(
       file.sha256,
       "electron-context-bridge",
-      `${value.world}:${value.api_key ?? value.api_key_expression ?? "[missing]"}:${electronRangeKey(value.location)}`,
+      `${value.world}:${value.api_key ?? value.api_key_expression ?? "[missing]"}:${javascriptSourceRangeKey(value.location)}`,
     ),
     observations: [
       {
@@ -271,7 +271,7 @@ const addUtilityProcess = (
     identity: artifactLocalIdentity(
       file.sha256,
       "electron-utility-process",
-      `${value.module_path ?? value.module_expression}:${electronRangeKey(value.location)}`,
+      `${value.module_path ?? value.module_expression}:${javascriptSourceRangeKey(value.location)}`,
     ),
     observations: [
       {

src/application/javascript/JavaScriptApplicationService.ts

@@ -7,7 +7,10 @@ import {
   type JavaScriptApplicationAnalysisResult,
   parseOwnedJavaScriptApplicationAnalysisSteps,
 } from "../../domain/javascript/javascriptApplicationAnalysis.js";
-import { AnalysisOutputError } from "../../domain/analysisErrorCore.js";
+import {
+  AnalysisOutputError,
+  AnalysisResourceConstraintError,
+} from "../../domain/analysisErrorCore.js";
 import { ArtifactOperationError } from "../../domain/artifactOperationError.js";
 import { AnalysisError } from "../../domain/analysisErrorBase.js";
 import type { Evidence } from "../../domain/evidence.js";
@@ -149,13 +152,8 @@ export const analyzeJavaScriptApplicationValidated = async (
           cause,
         }),
       );
-    if (
-      cause instanceof Error &&
-      "code" in cause &&
-      typeof cause.code === "string" &&
-      FILESYSTEM_ERROR_CODES.has(cause.code)
-    )
-      return err(new ArtifactOperationError(OPERATION, "io"));
+    const filesystemFailure = hostFilesystemFailure(cause);
+    if (filesystemFailure !== undefined) return err(filesystemFailure);
     return err(
       new ProviderAdapterError(JAVASCRIPT_APPLICATION_PROVIDER.id, OPERATION, {
         cause,
@@ -208,6 +206,43 @@ const describeResultSchemaFailure = (cause: z.ZodError): string => {
 const escapePointerPart = (part: string): string =>
   part.replaceAll("~", "~0").replaceAll("/", "~1");
 
+/**
+ * Project a host filesystem failure that no narrower owner classified. Selected
+ * input denial is classified at selection; this failure may concern any path,
+ * including private workspace files, so it keeps the host's own facts rather
+ * than claiming a selected-read denial.
+ */
+const hostFilesystemFailure = (cause: unknown): AnalysisError | undefined => {
+  if (!(cause instanceof Error)) return undefined;
+  const code: unknown = Reflect.get(cause, "code");
+  if (typeof code !== "string" || !FILESYSTEM_ERROR_CODES.has(code))
+    return undefined;
+  const syscall: unknown = Reflect.get(cause, "syscall");
+  const path: unknown = Reflect.get(cause, "path");
+  const facts = {
+    system_code: code,
+    ...(typeof syscall === "string" ? { syscall } : {}),
+    ...(typeof path === "string" ? { path } : {}),
+  };
+  if (code === "EMFILE" || code === "ENFILE")
+    return new AnalysisResourceConstraintError(
+      OPERATION,
+      "capacity",
+      `Host file-descriptor limit reached (${code})${typeof path === "string" ? ` while accessing ${path}` : ""}`,
+      facts,
+      {
+        cause,
+        retryable: true,
+        remediationAction:
+          "Close unused files or raise the open-file limit for the process or host running REA, then retry.",
+      },
+    );
+  return new ArtifactOperationError(OPERATION, "io", undefined, cause.message, {
+    cause,
+    diagnostics: facts,
+  });
+};
+
 const FILESYSTEM_ERROR_CODES = new Set([
   "ENOENT",
   "EACCES",

src/application/javascript/JavaScriptArtifactReconstruction.ts

@@ -1,4 +1,4 @@
-import { constants } from "node:fs";
+import { constants, type Stats } from "node:fs";
 import { access, lstat, realpath } from "node:fs/promises";
 import { setImmediate } from "node:timers/promises";
 
@@ -91,8 +91,8 @@ export const reconstructJavaScriptArtifact = async (
     };
     const input = javascriptArtifactReconstructionInputSchema.parse(rawInput);
     abortIfNeeded(signal);
-    const path = await resolveSelectedInput(input.input_path);
-    const format = await resolveFormat(path, input);
+    const { path, metadata } = await resolveSelectedInput(input.input_path);
+    const format = selectedFormat(path, metadata, input);
     const snapshot = await scanCanonicalArtifactInventoryInScope(path, {
       resourceScope: scope,
       signal,
@@ -346,13 +346,21 @@ const OPERATION = "analyze_javascript_application";
 /**
  * Resolve the caller-selected input. A missing, looping, overlong, or
  * unreadable selection is a caller or host-resolution failure, not a damaged
- * artifact.
+ * artifact. A selected directory must also be searchable: without search
+ * permission its entries can be listed but not inspected, so no entry is
+ * readable. Other host failures propagate with their errno facts intact.
  */
-const resolveSelectedInput = async (inputPath: string): Promise<string> => {
+const resolveSelectedInput = async (
+  inputPath: string,
+): Promise<{ readonly path: string; readonly metadata: Stats }> => {
   try {
     const path = await realpath(inputPath);
-    await access(path, constants.R_OK);
-    return path;
+    const metadata = await lstat(path);
+    await access(
+      path,
+      metadata.isDirectory() ? constants.R_OK | constants.X_OK : constants.R_OK,
+    );
+    return { path, metadata };
   } catch (cause: unknown) {
     const code =
       cause instanceof Error && "code" in cause ? String(cause.code) : "";
@@ -389,11 +397,11 @@ const selectedInputResolutionMessage = (
     : `Selected input path could not be resolved because symbolic-link traversal looped or exceeded the host limit (ELOOP): ${inputPath}`;
 
 /** The selected input's kind, checked against the caller's requested format. */
-const resolveFormat = async (
+const selectedFormat = (
   path: string,
+  metadata: Stats,
   input: JavaScriptArtifactReconstructionInput,
-): Promise<"asar" | "directory"> => {
-  const metadata = await lstat(path);
+): "asar" | "directory" => {
   const observed = metadata.isDirectory()
     ? "directory"
     : metadata.isFile() && path.toLowerCase().endsWith(".asar")

src/application/javascript/JavaScriptSemanticGraphAsyncProjection.ts

@@ -10,7 +10,10 @@ import {
   addSemanticGraphUnknown,
 } from "./JavaScriptSemanticGraphConstruction.js";
 import { unknownSemanticEvidence } from "./JavaScriptSemanticGraphEvidence.js";
-import type { SemanticFlowProjectionContext } from "./JavaScriptSemanticGraphFlowProjection.js";
+import {
+  projectSemanticResultBindings,
+  type SemanticFlowProjectionContext,
+} from "./JavaScriptSemanticGraphFlowProjection.js";
 
 /** Project literal EventEmitter registrations, removals, and dispatches. */
 export const projectSemanticEvents = (
@@ -180,18 +183,11 @@ const projectTimerSchedule = (
     relation: "schedules-timer",
     resolution: "resolved",
   });
-  for (const projected of operation.projectedResultBindings)
-    addSemanticGraphRelation(context.state, {
-      source: timerNodes.get(operation.timerId),
-      target: context.bindingNodes.get(projected.bindingId),
-      relation: "destructures",
-      resolution:
-        projected.resolution === "complete" ? "resolved" : "candidate",
-      properties: {
-        projection_path: [...projected.projectionPath],
-        projection_resolution: projected.resolution,
-      },
-    });
+  projectSemanticResultBindings(
+    context,
+    timerNodes.get(operation.timerId),
+    operation.projectedResultBindings,
+  );
 };
 
 const projectTimerCancellation = (

src/application/javascript/JavaScriptSemanticGraphChildProcessProjection.ts

@@ -9,7 +9,10 @@ import {
   addSemanticGraphUnknown,
 } from "./JavaScriptSemanticGraphConstruction.js";
 import { unknownSemanticEvidence } from "./JavaScriptSemanticGraphEvidence.js";
-import type { SemanticFlowProjectionContext } from "./JavaScriptSemanticGraphFlowProjection.js";
+import {
+  projectSemanticResultBindings,
+  type SemanticFlowProjectionContext,
+} from "./JavaScriptSemanticGraphFlowProjection.js";
 
 interface ChildUnknownInput {
   readonly context: SemanticFlowProjectionContext;
@@ -80,18 +83,7 @@ const projectSpawn = (
     relation: "spawns",
     resolution: spawn.resolution === "complete" ? "resolved" : "candidate",
   });
-  for (const projected of spawn.projectedResultBindings)
-    addSemanticGraphRelation(context.state, {
-      source: child,
-      target: context.bindingNodes.get(projected.bindingId),
-      relation: "destructures",
-      resolution:
-        projected.resolution === "complete" ? "resolved" : "candidate",
-      properties: {
-        projection_path: [...projected.projectionPath],
-        projection_resolution: projected.resolution,
-      },
-    });
+  projectSemanticResultBindings(context, child, spawn.projectedResultBindings);
   if (spawn.argvCount !== null)
     addSemanticGraphRelation(context.state, {
       source: callSite,

src/application/javascript/JavaScriptSemanticGraphConstruction.ts

@@ -1,3 +1,4 @@
+import { javascriptSourceRangeKey } from "../../domain/javascript/javascriptSourceCoordinates.js";
 import type { z } from "zod";
 import type { JavaScriptApplicationGraph } from "../../domain/javascript/javascriptApplicationGraph.js";
 import type { JsonValue } from "../../domain/jsonValue.js";
@@ -338,7 +339,5 @@ const applicationLocationKey = (
   [
     artifactSha256,
     path,
-    range === null
-      ? "artifact-path"
-      : `${range.start.line}:${range.start.column}-${range.end.line}:${range.end.column}`,
+    range === null ? "artifact-path" : javascriptSourceRangeKey(range),
   ].join("\u0000");

src/application/javascript/JavaScriptSemanticGraphDataProjection.ts

@@ -10,7 +10,10 @@ import {
   addSemanticGraphUnknown,
 } from "./JavaScriptSemanticGraphConstruction.js";
 import { unknownSemanticEvidence } from "./JavaScriptSemanticGraphEvidence.js";
-import type { SemanticFlowProjectionContext } from "./JavaScriptSemanticGraphFlowProjection.js";
+import {
+  projectSemanticResultBindings,
+  type SemanticFlowProjectionContext,
+} from "./JavaScriptSemanticGraphFlowProjection.js";
 import { semanticResourceLimitReason } from "../../domain/javascript/javascriptSemanticResourceLimits.js";
 
 /** Project environment, argv, file, default, and precedence candidates. */
@@ -179,18 +182,11 @@ const projectRequestConstruction = (
     relation: "constructs-request",
     resolution: operation.resolution === "complete" ? "resolved" : "candidate",
   });
-  for (const projected of operation.projectedResultBindings)
-    addSemanticGraphRelation(context.state, {
-      source: request,
-      target: context.bindingNodes.get(projected.bindingId),
-      relation: "destructures",
-      resolution:
-        projected.resolution === "complete" ? "resolved" : "candidate",
-      properties: {
-        projection_path: [...projected.projectionPath],
-        projection_resolution: projected.resolution,
-      },
-    });
+  projectSemanticResultBindings(
+    context,
+    request,
+    operation.projectedResultBindings,
+  );
   for (const field of operation.fields)
     addSemanticGraphRelation(context.state, {
       source:

src/application/javascript/JavaScriptSemanticGraphFlowProjection.ts

@@ -1,6 +1,10 @@
+import { javascriptSourceRangeKey } from "../../domain/javascript/javascriptSourceCoordinates.js";
 import type { JavaScriptSemanticGraphNode } from "../../domain/javascript/javascriptSemanticGraphSchemas.js";
 import { javaScriptSemanticNodeId } from "../../domain/javascript/javascriptSemanticGraph.js";
-import type { JavaScriptSemanticIr } from "../../domain/javascript/javascriptSemanticIr.js";
+import type {
+  JavaScriptSemanticIr,
+  JavaScriptSemanticProjectedResultBinding,
+} from "../../domain/javascript/javascriptSemanticIr.js";
 import { sourceRangesEqual } from "../../domain/javascript/javascriptStaticAnalysisHelpers.js";
 import type { JavaScriptSourceRange } from "../../domain/javascript/javascriptStaticAnalysisTypes.js";
 import type { JavaScriptArtifactFile } from "../../domain/javascript/javascriptArtifactFiles.js";
@@ -34,6 +38,26 @@ export interface SemanticFlowProjectionContext {
   ) => JavaScriptSemanticGraphNode | undefined;
 }
 
+/** Project result destructuring consistently for timers, child processes, and requests. */
+export const projectSemanticResultBindings = (
+  context: Pick<SemanticFlowProjectionContext, "state" | "bindingNodes">,
+  source: JavaScriptSemanticGraphNode | undefined,
+  bindings: readonly JavaScriptSemanticProjectedResultBinding[],
+): void => {
+  for (const projected of bindings)
+    addSemanticGraphRelation(context.state, {
+      source,
+      target: context.bindingNodes.get(projected.bindingId),
+      relation: "destructures",
+      resolution:
+        projected.resolution === "complete" ? "resolved" : "candidate",
+      properties: {
+        projection_path: [...projected.projectionPath],
+        projection_resolution: projected.resolution,
+      },
+    });
+};
+
 /** Project explicit static Promise/task ownership without runtime claims. */
 export const projectSemanticPromises = (
   context: SemanticFlowProjectionContext,
@@ -198,9 +222,6 @@ interface ObjectReadIndex {
 
 const objectReadIndexes = new WeakMap<JavaScriptSemanticIr, ObjectReadIndex>();
 
-const objectReadRangeKey = (location: JavaScriptSourceRange): string =>
-  `${String(location.start.line)}:${String(location.start.column)}:${String(location.end.line)}:${String(location.end.column)}`;
-
 /**
  * The object projection owns a member read's occurrence. Index it once per
  * file so return and argument flow can connect that expression without
@@ -227,7 +248,7 @@ const objectReadOccurrences = (
       }),
     );
     if (node !== undefined)
-      nodes.set(objectReadRangeKey(operation.location), node);
+      nodes.set(javascriptSourceRangeKey(operation.location), node);
   }
   objectReadIndexes.set(context.ir, { state: context.state, nodes });
   return nodes;
@@ -240,7 +261,7 @@ export const semanticObjectReadOccurrence = (
 ): JavaScriptSemanticGraphNode | undefined =>
   location === null
     ? undefined
-    : objectReadOccurrences(context).get(objectReadRangeKey(location));
+    : objectReadOccurrences(context).get(javascriptSourceRangeKey(location));
 
 /** Link direct return expressions to their retained semantic references. */
 export const projectSemanticReturnValues = (

src/application/javascript/JavaScriptSemanticGraphProjection.ts

@@ -1,3 +1,8 @@
+import {
+  compareJavaScriptSourcePoints,
+  javascriptSourceRangeContains,
+  javascriptSourceRangeKey,
+} from "../../domain/javascript/javascriptSourceCoordinates.js";
 import { compareUnicodeCodePoints } from "../../domain/unicodeCodePointOrder.js";
 import type { JavaScriptSemanticGraphNode } from "../../domain/javascript/javascriptSemanticGraphSchemas.js";
 import { JAVASCRIPT_SEMANTIC_RELATION_FAMILIES } from "../../domain/javascript/javascriptSemanticGraphSchemas.js";
@@ -40,7 +45,7 @@ export const createSemanticCallableOwnerLookup = (
     }))
     .sort(
       (left, right) =>
-        pointCompare(left.range.start, right.range.start) ||
+        compareJavaScriptSourcePoints(left.range.start, right.range.start) ||
         left.order - right.order,
     );
   const tree = buildSourceIntervalTree(entries, 0, entries.length);
@@ -54,12 +59,13 @@ export const createSemanticCallableOwnerLookup = (
       const current = pending.pop();
       if (
         current === undefined ||
-        pointCompare(current.minimumStart, location.start) > 0 ||
-        pointCompare(current.maximumEnd, location.end) < 0
+        compareJavaScriptSourcePoints(current.minimumStart, location.start) >
+          0 ||
+        compareJavaScriptSourcePoints(current.maximumEnd, location.end) < 0
       )
         continue;
       const candidate = current.entry;
-      if (contains(candidate.range, location)) {
+      if (javascriptSourceRangeContains(candidate.range, location)) {
         const node = nodes.get(candidate.callableId);
         const rank =
           best === undefined
@@ -93,9 +99,15 @@ const buildSourceIntervalTree = <Interval extends SourceInterval>(
   let minimumEnd = entry.range.end;
   let maximumEnd = entry.range.end;
   for (const child of [left, right]) {
-    if (child !== null && pointCompare(child.minimumEnd, minimumEnd) < 0)
+    if (
+      child !== null &&
+      compareJavaScriptSourcePoints(child.minimumEnd, minimumEnd) < 0
+    )
       minimumEnd = child.minimumEnd;
-    if (child !== null && pointCompare(child.maximumEnd, maximumEnd) > 0)
+    if (
+      child !== null &&
+      compareJavaScriptSourcePoints(child.maximumEnd, maximumEnd) > 0
+    )
       maximumEnd = child.maximumEnd;
   }
   return {
@@ -120,7 +132,7 @@ export const createSemanticNodeRangeLookup = (
     })
     .sort(
       (left, right) =>
-        pointCompare(left.range.start, right.range.start) ||
+        compareJavaScriptSourcePoints(left.range.start, right.range.start) ||
         left.order - right.order,
     );
   const tree = buildSourceIntervalTree(entries, 0, entries.length);
@@ -132,11 +144,12 @@ export const createSemanticNodeRangeLookup = (
       const current = pending.pop();
       if (
         current === undefined ||
-        pointCompare(current.maximumStart, range.start) < 0 ||
-        pointCompare(current.minimumEnd, range.end) > 0
+        compareJavaScriptSourcePoints(current.maximumStart, range.start) < 0 ||
+        compareJavaScriptSourcePoints(current.minimumEnd, range.end) > 0
       )
         continue;
-      if (contains(range, current.entry.range)) matches.push(current.entry);
+      if (javascriptSourceRangeContains(range, current.entry.range))
+        matches.push(current.entry);
       if (current.left !== null) pending.push(current.left);
       if (current.right !== null) pending.push(current.right);
     }
@@ -155,18 +168,15 @@ export const createSemanticCallSiteLookup = (
 ) => JavaScriptSemanticGraphNode | undefined) => {
   const identifiers = new Map<string, string>();
   for (const call of ir.callSites) {
-    const key = rangeKey(call.location);
+    const key = javascriptSourceRangeKey(call.location);
     if (!identifiers.has(key)) identifiers.set(key, call.callSiteId);
   }
   return (range) => {
-    const identifier = identifiers.get(rangeKey(range));
+    const identifier = identifiers.get(javascriptSourceRangeKey(range));
     return identifier === undefined ? undefined : nodes.get(identifier);
   };
 };
 
-const rangeKey = (range: JavaScriptSourceRange): string =>
-  `${range.start.line}:${range.start.column}-${range.end.line}:${range.end.column}`;
-
 /** Report extractor support without treating missing families as absence. */
 export const semanticFamilyStatus = (
   family: (typeof JAVASCRIPT_SEMANTIC_RELATION_FAMILIES)[number],
@@ -191,17 +201,5 @@ export const semanticFamilyStatus = (
   return "partial";
 };
 
-const contains = (
-  outer: JavaScriptSourceRange,
-  inner: JavaScriptSourceRange,
-): boolean =>
-  pointCompare(outer.start, inner.start) <= 0 &&
-  pointCompare(outer.end, inner.end) >= 0;
-
-const pointCompare = (
-  left: JavaScriptSourceRange["start"],
-  right: JavaScriptSourceRange["start"],
-): number => left.line - right.line || left.column - right.column;
-
 const positionKey = (range: JavaScriptSourceRange): string =>
   `${String(range.start.line).padStart(12, "0")}:${String(range.start.column).padStart(12, "0")}`;

src/application/signals/SignalRecordingService.test.ts

@@ -0,0 +1,96 @@
+import { expect, it } from "vitest";
+
+import {
+  createAnalysisExecution,
+  type ExecutionOptions,
+} from "../AnalysisProvider.js";
+import { SignalRecordingService } from "./SignalRecordingService.js";
+import { createAnalysisProfile } from "../../domain/analysisProfile.js";
+import { decodeSignalRecordingInputSchema } from "../../domain/signals/signalRecording.js";
+import { ok } from "../../domain/result.js";
+
+it("retains provider metadata in a late-cancellation observation", async () => {
+  const input = decodeSignalRecordingInputSchema.parse({
+    path: process.platform === "win32" ? "C:\\recording.vcd" : "/recording.vcd",
+    decoders: "uart",
+  });
+  const provider = {
+    id: "fixture-signal",
+    name: "Fixture signal provider",
+    version: "1",
+  } as const;
+  const subject = {
+    path: input.path,
+    sha256: "a".repeat(64),
+    format: "file",
+  } as const;
+  const report = {
+    artifact: { path: input.path, sha256: subject.sha256, bytes: 12 },
+    selection: input,
+    annotations_text: "10-20 uart-1: 42\n",
+    output_window: { total_lines: 1, returned_lines: 1, has_more: false },
+    diagnostics: "",
+    tool: {
+      configured_path: "/fixture/sigrok-cli",
+      path: "/fixture/sigrok-cli",
+      sha256: "b".repeat(64),
+      version_banner: "sigrok-cli fixture",
+      version_diagnostics: "",
+      arguments: [],
+    },
+    resource_limiter: {
+      configured_path: "/fixture/prlimit",
+      path: "/fixture/prlimit",
+      sha256: "c".repeat(64),
+      arguments: [],
+    },
+    limits: {
+      input_bytes: 1,
+      output_bytes: 1,
+      command_timeout_ms: 1,
+      address_space_bytes: 0,
+      file_bytes: 0,
+      cpu_seconds: 0,
+    },
+    hardware_acquisition: "not-performed",
+  } as const;
+  const rawResult = { producer: "fixture", bytes: 12 };
+  const profile = createAnalysisProfile(provider, { decoder: "uart" });
+  const relationshipCoverage = {
+    status: "unknown",
+    reason: "Recording relationships are not reported.",
+  } as const;
+  const execution = createAnalysisExecution(report, provider, {
+    subject,
+    rawResult,
+    analysisProfile: profile,
+    relationshipCoverage,
+    locations: [{ kind: "artifact-path", path: input.path }],
+  });
+  const controller = new AbortController();
+  const reason = Object.freeze({ requested: "cancel after recording result" });
+  const service = new SignalRecordingService({
+    decode: async (_input, options?: ExecutionOptions) => {
+      controller.abort(reason);
+      expect(options?.signal).toBe(controller.signal);
+      return ok(execution);
+    },
+    inspectDecoders: async () => {
+      throw new Error("Unexpected decoder discovery call");
+    },
+    close: async () => {},
+  });
+
+  const result = await service.decode(input, { signal: controller.signal });
+
+  expect(result.ok).toBe(false);
+  if (result.ok) throw new Error("Expected late cancellation");
+  expect(result.error).toMatchObject({ _tag: "AnalysisCancelledError" });
+  expect(result.error.cause).toBe(reason);
+  expect(result.error.partialObservation).toMatchObject({
+    operation: "decode_signal_recording",
+    raw_result: rawResult,
+    analysis_profile: profile,
+    relationship_coverage: relationshipCoverage,
+  });
+});

src/application/signals/SignalRecordingService.ts

@@ -3,24 +3,25 @@ import {
   signalDecodersSchema,
   type InspectSignalDecodersInput,
 } from "../../domain/signals/signalDecoders.js";
-import type { JsonValue } from "../../domain/jsonValue.js";
-import type {
-  AnalysisExecution,
-  ExecutionOptions,
+import {
+  createAnalysisExecutionEvidence,
+  type AnalysisExecution,
+  type ExecutionOptions,
 } from "../AnalysisProvider.js";
 import type { AnalysisError } from "../../domain/analysisErrorBase.js";
 import {
   AnalysisCancelledError,
   AnalysisOutputError,
 } from "../../domain/analysisErrorCore.js";
-import { createEvidence, type Evidence } from "../../domain/evidence.js";
+import type { Evidence } from "../../domain/evidence.js";
 import { analysisInputErrorFromIssues } from "../../domain/inputIssueProjection.js";
 import {
   decodeSignalRecordingInputSchema,
   signalRecordingSchema,
   type DecodeSignalRecordingInput,
 } from "../../domain/signals/signalRecording.js";
-import { err, ok, type Result } from "../../domain/result.js";
+import { err, type Result } from "../../domain/result.js";
+import { completeProviderEvidence } from "../ProviderOperationExecution.js";
 
 export interface SignalRecordingPort {
   /** Release per-call resources before returning, or retain failed cleanup for close/retry. */
@@ -74,7 +75,15 @@ export class SignalRecordingService {
           "Decoder returned malformed data or changed the selected recording identity/options.",
         ),
       );
-    return this.#evidence(operation, input.data, execution, options);
+    return completeProviderEvidence(
+      createAnalysisExecutionEvidence(
+        operation,
+        input.data,
+        execution,
+        "observed",
+      ),
+      options?.signal,
+    );
   }
   async inspectDecoders(
     raw: unknown,
@@ -108,33 +117,14 @@ export class SignalRecordingService {
           "Decoder discovery returned malformed data or changed the selected installation/options.",
         ),
       );
-    return this.#evidence(operation, input.data, execution, options);
-  }
-  #evidence(
-    operation: string,
-    parameters: Readonly<Record<string, JsonValue>>,
-    execution: AnalysisExecution,
-    options?: ExecutionOptions,
-  ): Result<Evidence, AnalysisError> {
-    const evidence = createEvidence(
-      execution.subject ?? undefined,
-      execution.provider,
-      {
+    return completeProviderEvidence(
+      createAnalysisExecutionEvidence(
         operation,
-        parameters,
-        result: execution.result,
-        confidence: "observed",
-        locations: execution.locations,
-        limitations: execution.limitations,
-      },
+        input.data,
+        execution,
+        "observed",
+      ),
+      options?.signal,
     );
-    return options?.signal?.aborted
-      ? err(
-          new AnalysisCancelledError(operation, {
-            cause: options.signal.reason,
-            partialObservation: evidence,
-          }),
-        )
-      : ok(evidence);
   }
 }

src/application/wasm/WasmArtifactService.test.ts

@@ -5,6 +5,7 @@ import {
   wasmArtifactExecution,
 } from "../../../tests/fixtures/wasm/artifact.js";
 import { ok } from "../../domain/result.js";
+import { createAnalysisProfile } from "../../domain/analysisProfile.js";
 it.each([
   { path: "relative" },
   { path: "/module", glue_paths: ["relative"] },
@@ -119,30 +120,54 @@ it("cancels before provider work and delivers observed Evidence on success", asy
   });
 });
 
-it("retains completed Evidence when cancellation arrives after provider return", async () => {
-  const value = wasmArtifactFixture();
-  const controller = new AbortController();
-  const service = new WasmArtifactService({
-    close: () => Promise.resolve(),
-    inspect: async () => {
-      controller.abort();
-      return ok(wasmArtifactExecution(value));
-    },
-  });
+it.each([false, true])(
+  "retains provider provenance after completion (late cancellation: %s)",
+  async (cancel) => {
+    const value = wasmArtifactFixture();
+    const execution = wasmArtifactExecution(value);
+    const profile = createAnalysisProfile(
+      { ...execution.provider, version: "1" },
+      {
+        features: "selected",
+      },
+    );
+    const coverage = {
+      status: "unknown",
+      reason: "No call graph examined",
+    } as const;
+    const controller = new AbortController();
+    const service = new WasmArtifactService({
+      close: () => Promise.resolve(),
+      inspect: async () => {
+        if (cancel) controller.abort();
+        return ok({
+          ...execution,
+          rawResult: { stdout: "retained command output" },
+          analysisProfile: profile,
+          relationshipCoverage: coverage,
+        });
+      },
+    });
 
-  expect(
-    await service.inspect(
+    const result = await service.inspect(
       { path: value.artifact.path },
       { signal: controller.signal },
-    ),
-  ).toMatchObject({
-    ok: false,
-    error: {
-      _tag: "AnalysisCancelledError",
-      partialObservation: { normalized_result: value },
-    },
-  });
-});
+    );
+    if (cancel)
+      expect(result).toMatchObject({
+        ok: false,
+        error: { _tag: "AnalysisCancelledError" },
+      });
+    else expect(result.ok).toBe(true);
+    const evidence = result.ok ? result.value : result.error.partialObservation;
+    expect(evidence).toMatchObject({
+      normalized_result: value,
+      raw_result: { stdout: "retained command output" },
+      analysis_profile: profile,
+      relationship_coverage: coverage,
+    });
+  },
+);
 
 it("preserves malformed-output failure when cancellation arrives with it", async () => {
   const value = wasmArtifactFixture();

src/application/wasm/WasmArtifactService.ts

@@ -1,11 +1,14 @@
-import type { ExecutionOptions } from "../AnalysisProvider.js";
+import {
+  createAnalysisExecutionEvidence,
+  type ExecutionOptions,
+} from "../AnalysisProvider.js";
 import type { WasmArtifactPort } from "./WasmArtifactPort.js";
 import type { AnalysisError } from "../../domain/analysisErrorBase.js";
 import {
   AnalysisCancelledError,
   AnalysisOutputError,
 } from "../../domain/analysisErrorCore.js";
-import { createEvidence, type Evidence } from "../../domain/evidence.js";
+import type { Evidence } from "../../domain/evidence.js";
 import {
   inspectWasmArtifactInputSchema,
   wasmArtifactSchema,
@@ -69,17 +72,12 @@ export class WasmArtifactService {
         ),
       );
     return completeProviderEvidence(
-      createEvidence(execution.subject, execution.provider, {
-        operation: OPERATION,
-        parameters: input.data,
-        result: report.data,
-        ...(execution.rawResult === null
-          ? {}
-          : { rawResult: execution.rawResult }),
-        confidence: "observed",
-        locations: execution.locations,
-        limitations: execution.limitations,
-      }),
+      createAnalysisExecutionEvidence(
+        OPERATION,
+        input.data,
+        { ...execution, result: report.data },
+        "observed",
+      ),
       options?.signal,
     );
   }

src/browser/IsolatedWebBundleAnalyzer.ts

@@ -8,7 +8,7 @@ import {
   type WebBundleAnalysis,
 } from "../domain/webBundleAnalysis.js";
 import { buildCapturedWebBundleAnalysis } from "../domain/webBundleAnalyzerResult.js";
-import { isIncludedScript } from "../domain/webBundleAnalyzerInspection.js";
+import { isIncludedScript } from "../domain/webBundleAnalyzerState.js";
 import type { WebBundleScriptAnalysis } from "../domain/webBundleScriptAnalysis.js";
 import { AnalysisError } from "../domain/analysisErrorBase.js";
 import {

src/browser/PlaywrightElectronActiveActions.ts

@@ -5,6 +5,9 @@ import type { ExecutionOptions } from "../application/AnalysisProvider.js";
 import { BrowserObservationError } from "../domain/browserObservationError.js";
 import {
   electronActiveTimelineEventSchema,
+  electronActiveProcessMetricSchema,
+  electronActiveWindowSchema,
+  electronActiveObservationResultSchema,
   type ElectronActiveObservationInput,
   type ElectronActiveObservationResult,
 } from "../domain/javascript/electronActiveObservation.js";
@@ -17,49 +20,25 @@ const OPERATION = "capture_electron_scenario" as const;
 const CANCELLED_STATE_READ_TIMEOUT_MS = 5_000;
 const GRACE_EXPIRED = Symbol("cancellation grace expired");
 
+const retention = electronActiveObservationResultSchema.shape.retention.shape;
 const hookSnapshotSchema = z.strictObject({
   events: z.array(electronActiveTimelineEventSchema),
-  retention_budget_bytes: z.number().int().min(0),
-  estimated_retained_bytes: z.number().int().min(0),
-  event_serialized_byte_upper_bound: z.number().int().min(0),
-  retained: z.number().int().min(0),
-  dropped: z.number().int().min(0),
-  dropped_ipc: z.number().int().min(0),
-  dropped_runtime: z.number().int().min(0),
-  dropped_event_families: z.array(
-    z.strictObject({
-      family: z.string().min(1),
-      count: z.number().int().min(1),
-    }),
-  ),
-  dropped_event_roles: z.array(
-    z.strictObject({
-      role: z.string().min(1),
-      count: z.number().int().min(1),
-    }),
-  ),
+  retention_budget_bytes: retention.budget_bytes,
+  estimated_retained_bytes: retention.estimated_retained_bytes,
+  event_serialized_byte_upper_bound:
+    retention.event_serialized_byte_upper_bound,
+  retained: retention.retained,
+  dropped: retention.dropped,
+  dropped_ipc: retention.dropped_ipc,
+  dropped_runtime: retention.dropped_runtime,
+  dropped_event_families: retention.dropped_event_families,
+  dropped_event_roles: retention.dropped_event_roles,
   observed: z.number().int().min(0),
-  observed_ipc: z.number().int().min(0),
-  observed_runtime: z.number().int().min(0),
+  observed_ipc: retention.observed_ipc,
+  observed_runtime: retention.observed_runtime,
   hook_error: z.boolean(),
 });
 
-const metricSchema = z.strictObject({
-  pid: z.number().int().min(1),
-  type: z.string().min(1),
-  name: z.string().nullable(),
-  service_name: z.string().nullable(),
-});
-
-const windowMetadataSchema = z.strictObject({
-  window_id: z.string(),
-  web_contents_id: z.string(),
-  url: z.string(),
-  title: z.string(),
-  visible: z.boolean().nullable(),
-  destroyed: z.boolean(),
-});
-
 type ElectronAction = ElectronActiveObservationInput["actions"][number];
 type ElectronActions = ElectronActiveObservationResult["actions"];
 
@@ -67,8 +46,10 @@ export type ElectronHookSnapshot = z.infer<typeof hookSnapshotSchema>;
 export type ElectronHookEvent = z.infer<
   typeof electronActiveTimelineEventSchema
 >;
-export type ElectronMetrics = z.infer<typeof metricSchema>[];
-type ElectronWindowMetadata = z.infer<typeof windowMetadataSchema>;
+export type ElectronMetrics = z.infer<
+  typeof electronActiveProcessMetricSchema
+>[];
+type ElectronWindowMetadata = z.infer<typeof electronActiveWindowSchema>;
 type ElectronApplicationState = Awaited<
   ReturnType<typeof readApplicationState>
 >;
@@ -289,14 +270,7 @@ const emitDeepLink = (
 export const readApplicationState = async (
   application: ElectronApplication,
 ): Promise<{
-  readonly windows: ReadonlyArray<{
-    readonly window_id: string;
-    readonly web_contents_id: string;
-    readonly url: string;
-    readonly title: string;
-    readonly visible: boolean | null;
-    readonly destroyed: boolean;
-  }>;
+  readonly windows: ReadonlyArray<ElectronWindowMetadata>;
   readonly metrics: ElectronMetrics;
   readonly electronVersion: string;
   readonly hookSnapshot: ElectronHookSnapshot;
@@ -323,7 +297,7 @@ export const readApplicationState = async (
         }),
       ),
     )
-    .then((value) => z.array(windowMetadataSchema).parse(value));
+    .then((value) => z.array(electronActiveWindowSchema).parse(value));
   const processMetricsPromise: Promise<ElectronMetrics> = application
     .evaluate(({ app }) =>
       app
@@ -342,7 +316,7 @@ export const readApplicationState = async (
           }),
         ),
     )
-    .then((value) => z.array(metricSchema).parse(value));
+    .then((value) => z.array(electronActiveProcessMetricSchema).parse(value));
   const electronVersionPromise: Promise<string> = application
     .evaluate(() => process.versions.electron)
     .then((value) => z.string().parse(value));

src/browser/WebBundleAnalysisWorker.test.ts

@@ -3,7 +3,7 @@ import { access } from "node:fs/promises";
 import { expect, it } from "vitest";
 
 import { createWebTextArtifact } from "../domain/webContentArtifact.js";
-import type { IncludedScript } from "../domain/webBundleAnalyzerInspection.js";
+import type { IncludedScript } from "../domain/webBundleAnalyzerState.js";
 import {
   AnalysisCancelledError,
   AnalysisOutputError,

src/browser/WebBundleAnalysisWorker.ts

@@ -31,7 +31,7 @@ import { ProviderCleanupError } from "../domain/providerCleanupError.js";
 import { jsonParts, bufferedJsonParts } from "../domain/jsonSerialization.js";
 import { javaScriptRuntime } from "../domain/runtimeVersion.js";
 import { err, ok, type Result } from "../domain/result.js";
-import type { IncludedScript } from "../domain/webBundleAnalyzerInspection.js";
+import type { IncludedScript } from "../domain/webBundleAnalyzerState.js";
 import {
   webBundleScriptAnalysisSchema,
   type WebBundleScriptAnalysis,

src/browser/WebBundleAnalysisWorkerCapacity.test.ts

@@ -18,7 +18,7 @@ vi.mock("node:v8", async (importOriginal) => {
 
 import { AnalysisResourceConstraintError } from "../domain/analysisErrorCore.js";
 import { createWebTextArtifact } from "../domain/webContentArtifact.js";
-import type { IncludedScript } from "../domain/webBundleAnalyzerInspection.js";
+import type { IncludedScript } from "../domain/webBundleAnalyzerState.js";
 import { WebBundleAnalysisWorker } from "./WebBundleAnalysisWorker.js";
 
 it("refuses before spawning or reading source when no host result capacity remains", async () => {

src/browser/WebBundleAnalysisWorkerReadCompletion.test.ts

@@ -47,7 +47,7 @@ vi.mock("node:fs/promises", async (importOriginal) => {
 });
 
 import { createWebTextArtifact } from "../domain/webContentArtifact.js";
-import type { IncludedScript } from "../domain/webBundleAnalyzerInspection.js";
+import type { IncludedScript } from "../domain/webBundleAnalyzerState.js";
 import { ProviderCleanupError } from "../domain/providerCleanupError.js";
 import { cleanupOwnedProcessGroup } from "../process/ProcessOwnership.js";
 import {

src/browser/WebBundleAnalysisWorkerServer.test.ts

@@ -8,7 +8,7 @@ import { createInterface } from "node:readline";
 import { expect, it } from "vitest";
 
 import { createWebTextArtifact } from "../domain/webContentArtifact.js";
-import type { IncludedScript } from "../domain/webBundleAnalyzerInspection.js";
+import type { IncludedScript } from "../domain/webBundleAnalyzerState.js";
 import {
   webBundleWorkerMessageSchema,
   type WebBundleWorkerMessage,

src/browser/WebBundleAnalysisWorkerServer.ts

@@ -7,7 +7,7 @@ import { withArtifactFileHandle } from "../artifacts/ArtifactFileOperation.js";
 import { ArtifactReaderFailure } from "../artifacts/ArtifactReader.js";
 import { ArtifactResourceScope } from "../artifacts/ArtifactResourceScope.js";
 import { jsonParts } from "../domain/jsonSerialization.js";
-import type { IncludedScript } from "../domain/webBundleAnalyzerInspection.js";
+import type { IncludedScript } from "../domain/webBundleAnalyzerState.js";
 import {
   webBundleScriptAnalysisSchema,
   type WebBundleScriptAnalysis,

src/cli/analysisEvidenceDelivery.ts

@@ -4,12 +4,11 @@ import { parseEvidence, type Evidence } from "../domain/evidence.js";
 import type { JsonValue } from "../domain/jsonValue.js";
 import { projectAnalysisError } from "../domain/analysisErrorProjection.js";
 import type { AnalysisError } from "../domain/analysisErrorBase.js";
-import type { Result } from "../domain/result.js";
+import { ok, type Result } from "../domain/result.js";
 import { AnalysisInputError } from "../domain/analysisErrorCore.js";
 import { createEvidenceBundle } from "../domain/evidenceBundle.js";
-import { writeEvidenceBundle } from "../application/EvidenceBundleFiles.js";
+import { publishEvidenceDelivery } from "../application/EvidenceBundleCommands.js";
 import { inspectAnalysisView } from "../application/analysisView/AnalysisViewService.js";
-import { ArtifactResourceScope } from "../artifacts/ArtifactResourceScope.js";
 import { absoluteCallerPath } from "../filesystem/callerPath.js";
 import { finishAnalysisCommand } from "./finishAnalysisCommand.js";
 
@@ -106,7 +105,7 @@ export const publishCliAnalysisEvidence = async (
   value: JsonValue,
   input: CliEvidenceDelivery,
 ) => {
-  const { providerId, operation, signal, detail, evidenceOutput } = input;
+  const { operation, signal, detail, evidenceOutput } = input;
   if (!isEvidence(value)) return value;
   const complete = parseEvidence(value);
   const inputError = cliEvidenceDeliveryInputError(input);
@@ -115,43 +114,39 @@ export const publishCliAnalysisEvidence = async (
     return projectAnalysisError(inputError);
   }
   if (evidenceOutput === undefined) return complete;
-  const resources = new ArtifactResourceScope();
-  let receipt: { readonly path: string; readonly bytes: number } | undefined;
-  const delivered = await finishAnalysisCommand(
-    async () => {
-      const written = await writeEvidenceBundle(
-        createEvidenceBundle([
-          ...new Map(
-            [...(input.sourceEvidence ?? []), complete].map((record) => [
-              record.evidence_id,
-              record,
-            ]),
-          ).values(),
+  // Project before publication so a view failure cannot commit an
+  // unreported bundle; publication then owns every post-commit outcome.
+  const delivered =
+    detail === "summary"
+      ? inspectAnalysisView({
+          source: { kind: "inline", evidence: complete },
+          view: input.view ?? { kind: "summary" },
+        })
+      : ok(complete);
+  if (!delivered.ok)
+    return projectAnalysisError(
+      delivered.error.retainPartialObservation(complete),
+    );
+  const published = await publishEvidenceDelivery({
+    bundle: createEvidenceBundle([
+      ...new Map(
+        [...(input.sourceEvidence ?? []), complete].map((record) => [
+          record.evidence_id,
+          record,
         ]),
-        absoluteCallerPath(evidenceOutput),
-        false,
-        resources,
-        signal,
-      );
-      if (!written.ok) {
-        if (written.error.partialObservation === undefined)
-          written.error.retainPartialObservation(complete);
-        return written;
-      }
-      receipt = written.value;
-      return detail === "summary"
-        ? inspectAnalysisView({
-            source: { kind: "inline", evidence: complete },
-            view: input.view ?? { kind: "summary" },
-          })
-        : { ok: true as const, value: complete };
-    },
-    { close: () => resources.close() },
-    providerId,
+      ).values(),
+    ]),
+    complete,
+    delivered: delivered.value,
+    outputPath: absoluteCallerPath(evidenceOutput),
     operation,
     signal,
-  );
-  return isEvidence(delivered) && detail === "summary"
-    ? { summary: delivered, evidence_bundle: receipt }
-    : delivered;
+  });
+  if (!published.ok) return projectAnalysisError(published.error);
+  return detail === "summary"
+    ? {
+        summary: published.value.delivered,
+        evidence_bundle: published.value.evidenceBundle,
+      }
+    : published.value.delivered;
 };

src/cli/coreBinaryCommands.ts

@@ -9,6 +9,7 @@ import type { Logger } from "pino";
 import {
   directAnalysisOptionsFromCli,
   nativeOpenOptionFields,
+  snapshotSelectionOption,
 } from "./options.js";
 import type { CliInstance } from "./types.js";
 import { runCliJavaScriptApplicationAnalysis } from "./javascriptApplicationAnalysis.js";
@@ -38,11 +39,7 @@ const registerOverviewCommands = (
   runDirectAnalysis: DirectAnalysis["runDirectAnalysis"],
 ): void => {
   const overviewOptions = z.object({
-    snapshot: z
-      .string()
-      .min(1)
-      .optional()
-      .describe("Load and update a local analysis snapshot"),
+    snapshot: snapshotSelectionOption,
     ...nativeOpenOptionFields,
   });
   // `analyze` declares the JavaScript integrity policy for its JavaScript
@@ -179,11 +176,7 @@ const registerDecompileCommand = (
         .describe(
           "Ghidra source-file byte offset; mapped internally to an analysis address",
         ),
-      snapshot: z
-        .string()
-        .min(1)
-        .optional()
-        .describe("Load and update a local analysis snapshot"),
+      snapshot: snapshotSelectionOption,
       ...nativeOpenOptionFields,
     }),
     run: ({ args, options }) =>
@@ -266,11 +259,7 @@ const registerXrefsCommand = (
         .describe(
           "Address or symbol name; use --address=<value> for leading dashes",
         ),
-      snapshot: z
-        .string()
-        .min(1)
-        .optional()
-        .describe("Load and update a local analysis snapshot"),
+      snapshot: snapshotSelectionOption,
       ...nativeOpenOptionFields,
     }),
     run: ({ args, options }) =>
@@ -315,11 +304,7 @@ const registerTraceCommand = (
         .boolean()
         .default(false)
         .describe("Match the query with exact letter case"),
-      snapshot: z
-        .string()
-        .min(1)
-        .optional()
-        .describe("Load and update a local analysis snapshot"),
+      snapshot: snapshotSelectionOption,
       ...nativeOpenOptionFields,
     }),
     run: ({ args, options }) =>
@@ -365,11 +350,7 @@ const registerFunctionCommand = (
         .describe(
           "Procedure name or address; use --procedure=<value> for leading dashes",
         ),
-      snapshot: z
-        .string()
-        .min(1)
-        .optional()
-        .describe("Load and update a local analysis snapshot"),
+      snapshot: snapshotSelectionOption,
       ...nativeOpenOptionFields,
     }),
     run: ({ args, options }) =>
@@ -414,11 +395,7 @@ const registerInstructionsCommand = (
         .describe(
           "Procedure name or address; use --procedure=<value> for leading dashes",
         ),
-      snapshot: z
-        .string()
-        .min(1)
-        .optional()
-        .describe("Load and update a local analysis snapshot"),
+      snapshot: snapshotSelectionOption,
       ...nativeOpenOptionFields,
     }),
     run: ({ args, options }) =>
@@ -475,11 +452,7 @@ const registerSearchCommand = (
         .boolean()
         .default(false)
         .describe("Match the pattern with exact letter case"),
-      snapshot: z
-        .string()
-        .min(1)
-        .optional()
-        .describe("Load and update a local analysis snapshot"),
+      snapshot: snapshotSelectionOption,
       ...nativeOpenOptionFields,
     }),
     run: ({ args, options }) =>

src/cli/coreNativeCommands.ts

@@ -7,6 +7,7 @@ import type { Logger } from "pino";
 import {
   directAnalysisOptionsFromCli,
   nativeOpenOptionFields,
+  snapshotSelectionOption,
 } from "./options.js";
 import type { CliInstance } from "./types.js";
 
@@ -271,11 +272,9 @@ const registerNativeDispatchMetadataCommand = (
         .max(20_000)
         .default(5_000)
         .describe("Maximum symbol records to inspect"),
-      snapshot: z
-        .string()
-        .min(1)
-        .optional()
-        .describe("Load or update the local analysis snapshot"),
+      snapshot: snapshotSelectionOption.describe(
+        "Load or update the local analysis snapshot",
+      ),
       ...nativeOpenOptionFields,
     }),
     run: async ({ args, options }) =>
@@ -360,11 +359,7 @@ const registerNativeApiCommand = (
       address: z.string().describe("Procedure name or address"),
     }),
     options: z.object({
-      snapshot: z
-        .string()
-        .min(1)
-        .optional()
-        .describe("Load and update a local analysis snapshot"),
+      snapshot: snapshotSelectionOption,
       ...nativeOpenOptionFields,
     }),
     run: ({ args, options }) =>

src/cli/environmentCommands.ts

@@ -11,6 +11,7 @@ import { logCliCommand } from "../cliLogging.js";
 import { parseEnvironmentName } from "../config/environmentName.js";
 import {
   parseMcpHttpEndpoint,
+  mcpHttpListenerPortSchema,
   type McpHttpEndpoint,
 } from "../config/mcpHttpEndpoint.js";
 import type { AnalysisError } from "../domain/analysisErrorBase.js";
@@ -364,11 +365,7 @@ export const registerEnvironmentCommands = (
         .min(1)
         .optional()
         .describe("Listener address; default MCP_HOST, else 127.0.0.1"),
-      port: z
-        .number()
-        .int()
-        .min(0)
-        .max(65535)
+      port: mcpHttpListenerPortSchema
         .optional()
         .describe(
           "Listener port; default MCP_PORT, else 0 for an ephemeral port",

src/cli/gpuCommands.ts

@@ -2,6 +2,7 @@ import { inspectGpuCodeObjectsInputSchema } from "../domain/gpu/gpuCodeObjects.j
 import { analysisInputErrorFromIssues } from "../domain/inputIssueProjection.js";
 import { AnalysisInputError } from "../domain/analysisErrorCore.js";
 import { projectAnalysisError } from "../domain/analysisErrorProjection.js";
+import { safeParseJson } from "../domain/safeJson.js";
 import { z } from "incur";
 import type { Logger } from "pino";
 import type { CliInstance } from "./types.js";
@@ -59,19 +60,23 @@ export const registerGpuCommands = (cli: CliInstance, logger: Logger): void => {
           for (const name of ["object_ids", "targets", "view"] as const) {
             const value = options[name];
             if (value === undefined) continue;
-            try {
-              selectors[name] = JSON.parse(value);
-            } catch (cause) {
+            const decoded = safeParseJson(value);
+            if (!decoded.ok) {
               return projectAnalysisError(
-                new AnalysisInputError("inspect_gpu_code_objects", { cause }, [
-                  {
-                    path: [name],
-                    reason: "invalid_format",
-                    message: `${name} must be valid JSON`,
-                  },
-                ]),
+                new AnalysisInputError(
+                  "inspect_gpu_code_objects",
+                  { cause: decoded.cause },
+                  [
+                    {
+                      path: [name],
+                      reason: "invalid_format",
+                      message: `${name} must be valid JSON`,
+                    },
+                  ],
+                ),
               );
             }
+            selectors[name] = decoded.value;
           }
           const rawInput = {
             path: absoluteCallerPath(args.path),

src/cli/modelCommands.ts

@@ -2,6 +2,7 @@ import { inspectModelArtifactInputSchema } from "../domain/model/modelArtifactQu
 import { analysisInputErrorFromIssues } from "../domain/inputIssueProjection.js";
 import { AnalysisInputError } from "../domain/analysisErrorCore.js";
 import { projectAnalysisError } from "../domain/analysisErrorProjection.js";
+import { safeParseJson } from "../domain/safeJson.js";
 import { z } from "incur";
 import type { Logger } from "pino";
 import type { CliInstance } from "./types.js";
@@ -44,21 +45,26 @@ export const registerModelCommands = (
     run: ({ args, options }) =>
       withCommandCancellation((signal) =>
         logCliCommand(logger, CLI_COMMANDS.inspectModelArtifact, async () => {
-          let view: unknown;
-          try {
-            view =
-              options.view === undefined ? undefined : JSON.parse(options.view);
-          } catch (cause) {
+          const decoded =
+            options.view === undefined
+              ? { ok: true as const, value: undefined }
+              : safeParseJson(options.view);
+          if (!decoded.ok) {
             return projectAnalysisError(
-              new AnalysisInputError("inspect_model_artifact", { cause }, [
-                {
-                  path: ["view"],
-                  reason: "invalid_format",
-                  message: "view must be a JSON model page selection",
-                },
-              ]),
+              new AnalysisInputError(
+                "inspect_model_artifact",
+                { cause: decoded.cause },
+                [
+                  {
+                    path: ["view"],
+                    reason: "invalid_format",
+                    message: "view must be a JSON model page selection",
+                  },
+                ],
+              ),
             );
           }
+          const view = decoded.value;
           const selected = inspectModelArtifactInputSchema.safeParse({
             path: absoluteCallerPath(args.path),
             hash: options.hash,

src/cli/options.ts

@@ -26,6 +26,13 @@ export const providerSelectionOption = analysisProviderSelectorSchema
     "Bind deep analysis to a provider ID or use deterministic auto selection",
   );
 
+/** Optional path to the local analysis snapshot loaded or updated by a command. */
+export const snapshotSelectionOption = z
+  .string()
+  .min(1)
+  .optional()
+  .describe("Load and update a local analysis snapshot");
+
 /** Explicit interpretation for headerless native executable formats. */
 export const formatSelectionOption = executableFormatHintSchema
   .optional()

src/cli/rustCommands.ts

@@ -10,6 +10,7 @@ import { inspectRustBinaryRequestSchema } from "../domain/rust/rustBinaryQuery.j
 import { analysisInputErrorFromIssues } from "../domain/inputIssueProjection.js";
 import { AnalysisInputError } from "../domain/analysisErrorCore.js";
 import { projectAnalysisError } from "../domain/analysisErrorProjection.js";
+import { safeParseJson } from "../domain/safeJson.js";
 import type { Logger } from "pino";
 import type { CliInstance } from "./types.js";
 import { withCommandCancellation } from "./commandCancellation.js";
@@ -44,21 +45,26 @@ export const registerRustCommands = (
     run: ({ args, options }) =>
       withCommandCancellation((signal) =>
         logCliCommand(logger, CLI_COMMANDS.inspectRustBinary, async () => {
-          let view: unknown;
-          try {
-            view =
-              options.view === undefined ? undefined : JSON.parse(options.view);
-          } catch (cause) {
+          const decoded =
+            options.view === undefined
+              ? { ok: true as const, value: undefined }
+              : safeParseJson(options.view);
+          if (!decoded.ok) {
             return projectAnalysisError(
-              new AnalysisInputError("inspect_rust_binary", { cause }, [
-                {
-                  path: ["view"],
-                  reason: "invalid_format",
-                  message: "view must be a JSON package or edge selection",
-                },
-              ]),
+              new AnalysisInputError(
+                "inspect_rust_binary",
+                { cause: decoded.cause },
+                [
+                  {
+                    path: ["view"],
+                    reason: "invalid_format",
+                    message: "view must be a JSON package or edge selection",
+                  },
+                ],
+              ),
             );
           }
+          const view = decoded.value;
           const input = inspectRustBinaryRequestSchema.safeParse({
             path: absoluteCallerPath(args.path),
             ...(options.detail === undefined ? {} : { detail: options.detail }),

src/config/mcpHttpEndpoint.ts

@@ -11,12 +11,15 @@ export const DEFAULT_MCP_HTTP_HOST = "127.0.0.1";
 /** Port 0 asks the host for an ephemeral port, reported by the listening log line. */
 export const DEFAULT_MCP_HTTP_PORT = 0;
 
+/** A listener may request an ephemeral port with 0; connected endpoints may not. */
+export const mcpHttpListenerPortSchema = z.number().int().min(0).max(65535);
+
 /** Decimal TCP port text, shared by the `--port` flag and `MCP_PORT`. */
 export const mcpHttpPortSchema = z
   .string()
   .regex(/^(?:0|[1-9]\d*)$/u)
   .transform(Number)
-  .pipe(z.number().int().min(0).max(65535));
+  .pipe(mcpHttpListenerPortSchema);
 
 const mcpHttpHostSchema = z.string().trim().min(1);
 

src/config/mcpInputSchemaProfile.ts

@@ -12,11 +12,16 @@ export const COMPACT_INPUT_SCHEMA_BUDGET_BYTES = 13 * 1024;
 
 export const mcpInputSchemaProfileSchema = z.enum(["full", "compact"]);
 
+/** Resolve the selected advertisement at the configuration boundary. */
+export const resolveMcpInputSchemaProfile = (
+  profile: McpInputSchemaProfile | undefined,
+): McpInputSchemaProfile => profile ?? "compact";
+
 /** Select the default compact advertisement, preserving an explicit full choice. */
 export const compactPresentationForMcpInputSchemaProfile = (
   profile: "full" | "compact" | undefined,
 ): { readonly budgetBytes: number } | undefined =>
-  profile === "full"
+  resolveMcpInputSchemaProfile(profile) === "full"
     ? undefined
     : { budgetBytes: COMPACT_INPUT_SCHEMA_BUDGET_BYTES };
 

src/contracts/managed/managedWorkflowToolContracts.ts

@@ -1,5 +1,6 @@
 import { z } from "zod";
 import { evidenceSchema } from "../../domain/evidence.js";
+import { compareManagedMembersInputSchema } from "../../domain/managed/managedMemberComparison.js";
 import { managedNativeVerificationInputSchema } from "../../domain/managed/managedNativeVerificationSchemas.js";
 
 import { managedReconstructionImportInputSchema } from "../../domain/managed/managedReconstruction.js";
@@ -14,31 +15,13 @@ import {
 import { toolContractMetadata } from "../toolEffects.js";
 import { requireOutputSchema } from "../toolOutputSchemaPrimitives.js";
 
-/** Inputs for comparing two managed observations carried inline. */
-export const compareManagedMembersReferenceInputSchema = z
-  .strictObject({
-    left: evidenceSchema,
-    right: evidenceSchema,
-  })
-  .superRefine((input, context) => {
-    if (input.left.evidence_id === input.right.evidence_id)
-      context.addIssue({
-        code: "custom",
-        path: ["right"],
-        message: "Managed member Evidence must be distinct",
-      });
-  });
-
 /** Inline Evidence input for importing reconstruction. */
 export const managedReconstructionReferenceInputSchema =
   managedReconstructionImportInputSchema.extend({
     static_members: evidenceSchema,
   });
 
-const managedApplicationGraphReferenceFacts = {} as const;
-
 const managedApplicationGraphReferenceShape = z.strictObject({
-  ...managedApplicationGraphReferenceFacts,
   managed_artifact: evidenceSchema.optional(),
   managed_members: evidenceSchema.optional(),
   managed_native_boundaries: evidenceSchema.optional(),
@@ -100,7 +83,7 @@ export const MANAGED_WORKFLOW_TOOL_CONTRACTS = [
     description:
       "Compare two authenticated inspect_managed_members Evidence records using unique-only tiers: exact declared type, name, and CIL/signature; exact declared type, name, and signature (decoded or not); exact declared type, name, and decoded structural method shape; then exact CIL/signature or decoded structural method shape alone, which never takes a member whose own declared type and name remain unpaired on the other side or whose declaring type is unresolved. Signatures compare type operands by name, not by build-local metadata row. Names alone are never a matching basis; a member whose signature was not decoded, or whose same-named counterpart's was not, stays unknown rather than added or removed. Metadata tokens remain build-local coordinates bound to each artifact SHA-256 and MVID, and the tuple digest does not itself remap them.",
     kind: "application",
-    inputSchema: compareManagedMembersReferenceInputSchema,
+    inputSchema: compareManagedMembersInputSchema,
     outputSchema: comparisonOutputSchema,
     examples: [
       {

src/contracts/workflowInputContracts.test.ts

@@ -11,10 +11,7 @@ import {
   MANAGED_MEMBER_COMPARISON_EXAMPLE,
   MANAGED_NATIVE_VERIFICATION_EXAMPLE,
 } from "./managed/managedWorkflowExamples.js";
-import {
-  compareManagedMembersReferenceInputSchema,
-  managedApplicationGraphReferenceInputSchema,
-} from "./managed/managedWorkflowToolContracts.js";
+import { managedApplicationGraphReferenceInputSchema } from "./managed/managedWorkflowToolContracts.js";
 
 describe("workflow input contracts", () => {
   it("rejects application Evidence ID references and duplicate inline records", () => {
@@ -38,7 +35,7 @@ describe("workflow input contracts", () => {
 
   it("rejects duplicate inline managed Evidence records", () => {
     expect(
-      compareManagedMembersReferenceInputSchema.safeParse({
+      toolContract("compare_managed_members").inputSchema.safeParse({
         left: MANAGED_MEMBER_COMPARISON_EXAMPLE.left,
         right: MANAGED_MEMBER_COMPARISON_EXAMPLE.left,
       }).success,

src/domain/analysisProfile.ts

@@ -1,8 +1,6 @@
-import { createHash } from "node:crypto";
-
-import canonicalize from "canonicalize";
 import { z } from "zod";
 
+import { digestCanonicalValue } from "./canonicalDigest.js";
 import { jsonObjectSchema, type JsonValue } from "./jsonValue.js";
 import { digestSchema } from "./../domain/digests.js";
 
@@ -65,11 +63,4 @@ export const analysisProfilesEqual = (
 
 const profileDigest = (
   profile: z.infer<typeof unsignedAnalysisProfileSchema>,
-): string => createHash("sha256").update(canonicalJson(profile)).digest("hex");
-
-const canonicalJson = (value: JsonValue): string => {
-  const encoded = canonicalize(value);
-  if (encoded === undefined)
-    throw new TypeError("RFC 8785 canonicalization rejected analysis profile");
-  return encoded;
-};
+): string => digestCanonicalValue(profile, "Analysis profile");

src/domain/analysisView/analysisView.ts

@@ -100,7 +100,10 @@ import { evidenceSchema, type Evidence } from "../evidence.js";
 import { jsonObjectSchema, jsonValueSchema } from "../jsonValue.js";
 import { err, ok, type Result } from "../result.js";
 import type { AnalysisError } from "../analysisErrorBase.js";
-import { safeParseOwnedBinaryLayout } from "../native/binaryLayout.js";
+import {
+  binaryLayoutSchema,
+  safeParseOwnedBinaryLayout,
+} from "../native/binaryLayout.js";
 import { bundleResourceRootSchema } from "../apple/bundleResourceRoot.js";
 import { functionDossierSchema } from "../hopperValues.js";
 import {
@@ -380,14 +383,10 @@ const artifactSchema = z.strictObject({
 });
 
 const layoutSummarySchema = z.strictObject({
-  bytes: z.number().int().nonnegative(),
-  format: z.literal("elf"),
-  architecture: z.strictObject({
-    machine: z.literal("EM_X86_64"),
-    bits: z.literal(64),
-    byte_order: z.literal("little"),
-  }),
-  image_type: z.enum(["ET_EXEC", "ET_DYN", "ET_REL"]),
+  bytes: binaryLayoutSchema.shape.artifact.shape.bytes,
+  format: binaryLayoutSchema.shape.format,
+  architecture: binaryLayoutSchema.shape.architecture,
+  image_type: binaryLayoutSchema.shape.image_type,
   entry: z.strictObject({
     reported_value: z.string().min(1),
     meaning: z.enum(["linked-virtual-address", "not-applicable", "absent"]),

src/domain/android/androidApplication.ts

@@ -10,6 +10,7 @@ import {
 } from "../artifactInventoryEvidence.js";
 import { digestSchema } from "../digests.js";
 import { prefixedDigestSchema } from "../digests.js";
+import { digestCanonicalValue } from "../canonicalDigest.js";
 import { nativeRuntimeConvention } from "../nativeConvention.js";
 import {
   applicationInventoryProjectionInputSchema,
@@ -19,7 +20,6 @@ import {
   projectedInventoryEntries,
   projectedFileComponents,
   projectionCoverage,
-  projectionDigest,
   projectionEvidenceIdSchema,
   unavailableComponentSchema,
 } from "../mobileApplicationGraphProjection.js";
@@ -155,7 +155,7 @@ export const projectAndroidApplication = (
   return {
     projection: androidApplicationProjectionResultSchema.parse({
       ...withoutId,
-      projection_id: `adp_${projectionDigest(withoutId, "Android application projection")}`,
+      projection_id: `adp_${digestCanonicalValue(withoutId, "Android application projection")}`,
     }),
     sources: evidence,
   };

src/domain/apple/appleApplication.ts

@@ -21,6 +21,7 @@ import {
 import { evidenceSchema } from "../evidence.js";
 import { digestSchema } from "../digests.js";
 import { prefixedDigestSchema } from "../digests.js";
+import { digestCanonicalValue } from "../canonicalDigest.js";
 import {
   bridgeCandidateCoverageSchema,
   projectCartesianCandidates,
@@ -30,7 +31,6 @@ import {
   projectedComponentSchema,
   projectedInventoryEntries,
   projectedFileComponents,
-  projectionDigest,
   unavailableComponentSchema,
   type ProjectedInventoryEntry,
 } from "../mobileApplicationGraphProjection.js";
@@ -212,7 +212,7 @@ export const projectAppleApplication = (
 
 /** Identify the complete projection, including source Evidence provenance. */
 export const appleProjectionId = (projection: unknown): string =>
-  `aap_${digest(projection)}`;
+  `aap_${digestCanonicalValue(projection, "Apple application projection")}`;
 
 /**
  * AppleDouble sidecars describe neighbouring files and are never components.
@@ -442,6 +442,3 @@ const projectionLimitations = (facts: {
   "Bridge candidates are path-based hypotheses, not observed runtime calls.",
   "A bridge basis is inferred from the native path and is repeated for every managed component.",
 ];
-
-const digest = (value: unknown): string =>
-  projectionDigest(value, "Apple application projection");

src/domain/completionLedgerGeneration.ts

@@ -1,8 +1,6 @@
-import { createHash } from "node:crypto";
-
-import canonicalize from "canonicalize";
 import { z } from "zod";
 
+import { digestCanonicalValue } from "./canonicalDigest.js";
 import { IDENTIFIER_PATTERN } from "./stringPatterns.js";
 import {
   compareAsciiStrings,
@@ -125,19 +123,9 @@ const completionManifestObjectSchema = z.strictObject({
 });
 type CompletionManifestValue = z.infer<typeof completionManifestObjectSchema>;
 
-const canonicalJson = (value: unknown): string => {
-  const serialized = canonicalize(value);
-  if (serialized === undefined)
-    throw new TypeError(
-      "RFC 8785 canonicalization rejected completion metadata",
-    );
-  return serialized;
-};
-
 const computeManifestId = (
   manifest: Omit<CompletionManifestValue, "manifest_id">,
-): string =>
-  `ecm_${createHash("sha256").update(canonicalJson(manifest)).digest("hex")}`;
+): string => `ecm_${digestCanonicalValue(manifest, "Completion metadata")}`;
 
 const manifestIssues = (
   manifest: CompletionManifestValue,

src/domain/conformancePackage.ts

@@ -1,6 +1,3 @@
-import { createHash } from "node:crypto";
-
-import canonicalize from "canonicalize";
 import { z } from "zod";
 
 import { IDENTIFIER_PATTERN } from "./stringPatterns.js";
@@ -9,6 +6,7 @@ import { evidenceSchema } from "./evidence.js";
 import { evidenceBundleSchema } from "./evidenceBundle.js";
 import { err, ok, type Result } from "./result.js";
 import { prefixedDigestSchema } from "./../domain/digests.js";
+import { digestCanonicalValue } from "./canonicalDigest.js";
 
 const conformancePackageIdSchema = prefixedDigestSchema("cp");
 
@@ -317,8 +315,5 @@ const packageContents = (
 });
 
 const computePackageId = (contents: ConformancePackageContents): string => {
-  const json = canonicalize(contents);
-  if (json === undefined)
-    throw new TypeError("Could not canonicalize parsed conformance package");
-  return `cp_${createHash("sha256").update(json).digest("hex")}`;
+  return `cp_${digestCanonicalValue(contents, "Conformance package")}`;
 };

src/domain/evidenceCompletionLedger.ts

@@ -1,8 +1,6 @@
-import { createHash } from "node:crypto";
-
-import canonicalize from "canonicalize";
 import { z } from "zod";
 
+import { digestCanonicalValue } from "./canonicalDigest.js";
 import { IDENTIFIER_PATTERN } from "./stringPatterns.js";
 import { prefixedDigestSchema } from "./../domain/digests.js";
 import {
@@ -79,21 +77,9 @@ const summarize = (
   };
 };
 
-const canonicalJson = (value: unknown): string => {
-  const serialized = canonicalize(value);
-  if (serialized === undefined)
-    throw new TypeError(
-      "RFC 8785 canonicalization rejected the completion ledger",
-    );
-  return serialized;
-};
-
 const computeLedgerId = (
   records: readonly EvidenceCompletionRecord[],
-): string =>
-  `ecl_${createHash("sha256")
-    .update(canonicalJson({ records }))
-    .digest("hex")}`;
+): string => `ecl_${digestCanonicalValue({ records }, "Completion ledger")}`;
 
 const ledgerIssues = (
   ledger: EvidenceCompletionLedgerValue,

src/domain/harmony/harmonyApplication.ts

@@ -10,6 +10,7 @@ import {
 } from "../artifactInventoryEvidence.js";
 import { digestSchema } from "../digests.js";
 import { prefixedDigestSchema } from "../digests.js";
+import { digestCanonicalValue } from "../canonicalDigest.js";
 import { nativeRuntimeConvention } from "../nativeConvention.js";
 import {
   applicationInventoryProjectionInputSchema,
@@ -19,7 +20,6 @@ import {
   projectedInventoryEntries,
   projectedFileComponents,
   projectionCoverage,
-  projectionDigest,
   projectionEvidenceIdSchema,
   unavailableComponentSchema,
 } from "../mobileApplicationGraphProjection.js";
@@ -151,7 +151,7 @@ export const projectHarmonyApplication = (
   return {
     projection: harmonyApplicationProjectionResultSchema.parse({
       ...withoutId,
-      projection_id: `hmp_${projectionDigest(withoutId, "HarmonyOS application projection")}`,
+      projection_id: `hmp_${digestCanonicalValue(withoutId, "HarmonyOS application projection")}`,
     }),
     sources: evidence,
   };

src/domain/javascript/electronActiveObservation.ts

@@ -156,14 +156,16 @@ const ipcEventSchema = electronActiveTimelineEventSchema.extend({
   ]),
 });
 
-const processMetricSchema = z.strictObject({
+/** Process facts shared by the runtime boundary and retained active observation. */
+export const electronActiveProcessMetricSchema = z.strictObject({
   pid: z.number().int().min(1),
   type: z.string().min(1),
   name: z.string().nullable(),
   service_name: z.string().nullable(),
 });
 
-const windowResultSchema = z.strictObject({
+/** Window facts shared by the runtime boundary and retained active observation. */
+export const electronActiveWindowSchema = z.strictObject({
   window_id: z.string(),
   web_contents_id: z.string(),
   url: z.string(),
@@ -223,9 +225,9 @@ export const electronActiveObservationResultSchema = z.strictObject({
     cleanup: z.literal("terminated-owned-process"),
   }),
   actions: z.array(actionResultSchema),
-  windows: z.array(windowResultSchema),
+  windows: z.array(electronActiveWindowSchema),
   processes: z.strictObject({
-    items: z.array(processMetricSchema),
+    items: z.array(electronActiveProcessMetricSchema),
   }),
   ipc: z.strictObject({
     events: z.array(ipcEventSchema),

src/domain/javascript/javascriptApplicationChangeGraph.ts

@@ -1,7 +1,7 @@
 import {
   createJavaScriptApplicationEdge,
   createImmutableJavaScriptApplicationGraphSteps,
-  createJavaScriptApplicationNode,
+  mergeJavaScriptApplicationNodes,
   type JavaScriptApplicationGraph,
 } from "./javascriptApplicationGraph.js";
 import type {
@@ -30,22 +30,16 @@ export interface ApplicationChangeGraphProjection {
 export const buildJavaScriptApplicationChangeGraph = (
   input: ChangeGraphInput,
 ): ApplicationChangeGraphProjection => {
-  const allNodes = nodeCandidates(input);
+  const mergedNodes = mergeJavaScriptApplicationNodes(
+    nodeCandidates(input),
+  ).sort((left, right) =>
+    compareUnicodeCodePoints(left.node_id, right.node_id),
+  );
+  const retained = new Set(mergedNodes.map(({ node_id }) => node_id));
   const preferredRoots = uniqueSorted([
     ...input.right.root_node_ids,
     ...input.left.root_node_ids,
-  ]).filter((nodeId) => allNodes.has(nodeId));
-  const orderedNodeIds = uniqueSorted([
-    ...preferredRoots,
-    ...input.items.flatMap(({ left_node_id: left, right_node_id: right }) => [
-      ...(right === null ? [] : [right]),
-      ...(left === null ? [] : [left]),
-    ]),
-  ]);
-  const retained = new Set(orderedNodeIds);
-  const mergedNodes = mergeNodes(
-    orderedNodeIds.flatMap((nodeId) => allNodes.get(nodeId) ?? []),
-  );
+  ]).filter((nodeId) => retained.has(nodeId));
   const sourceEdges = uniqueEdges([
     ...input.left.edges,
     ...input.right.edges,
@@ -88,9 +82,7 @@ export const buildJavaScriptApplicationChangeGraph = (
   return { graph: next.value };
 };
 
-const nodeCandidates = (
-  input: ChangeGraphInput,
-): Map<string, ApplicationNode[]> => {
+const nodeCandidates = (input: ChangeGraphInput): ApplicationNode[] => {
   const required = new Set([
     ...input.left.root_node_ids,
     ...input.right.root_node_ids,
@@ -99,11 +91,9 @@ const nodeCandidates = (
       ...(right === null ? [] : [right]),
     ]),
   ]);
-  const output = new Map<string, ApplicationNode[]>();
-  for (const node of [...input.left.nodes, ...input.right.nodes])
-    if (required.has(node.node_id))
-      output.set(node.node_id, [...(output.get(node.node_id) ?? []), node]);
-  return output;
+  return [...input.left.nodes, ...input.right.nodes].filter((node) =>
+    required.has(node.node_id),
+  );
 };
 
 const changedFromEdge = (
@@ -245,37 +235,6 @@ const sourceCoverageLimits = (input: ChangeGraphInput) =>
 const combineOmittedCounts = (left: number | null, right: number | null) =>
   left === null || right === null ? null : left + right;
 
-const mergeNodes = (nodes: readonly ApplicationNode[]): ApplicationNode[] => {
-  const groups = new Map<string, ApplicationNode[]>();
-  for (const node of nodes)
-    groups.set(node.node_id, [...(groups.get(node.node_id) ?? []), node]);
-  const merged = [...groups.values()].map((group) => {
-    const first = group[0];
-    if (first === undefined)
-      throw new TypeError("Empty change-graph node group");
-    const observations = [
-      ...new Map(
-        group
-          .flatMap(({ observations: values }) => values)
-          .map((observation) => [observation.observation_id, observation]),
-      ).values(),
-    ].sort((left, right) =>
-      compareUnicodeCodePoints(left.observation_id, right.observation_id),
-    );
-    return createJavaScriptApplicationNode({
-      kind: first.kind,
-      identity: first.identity,
-      observations: observations.map(
-        ({ observation_id: _id, identifier_strategy: _strategy, ...value }) =>
-          value,
-      ),
-    });
-  });
-  return merged.sort((left, right) =>
-    compareUnicodeCodePoints(left.node_id, right.node_id),
-  );
-};
-
 const uniqueEdges = (edges: readonly ApplicationEdge[]): ApplicationEdge[] =>
   [...new Map(edges.map((edge) => [edge.edge_id, edge])).values()].sort(
     (left, right) => compareUnicodeCodePoints(left.edge_id, right.edge_id),

src/domain/javascript/javascriptApplicationGraph.test.ts

@@ -4,6 +4,7 @@ import {
   createJavaScriptApplicationEdge,
   createJavaScriptApplicationGraph,
   createJavaScriptApplicationNode,
+  mergeJavaScriptApplicationNodes,
   javascriptApplicationGraphSchema,
   parseJavaScriptApplicationGraph,
   serializeJavaScriptApplicationGraph,
@@ -23,6 +24,58 @@ import {
   sourceMapReference,
   unknownEvidence,
 } from "./javascriptApplicationGraph.fixture.js";
+
+it("merges observations by entity identity without changing source nodes", () => {
+  const evidence = artifactEvidence(APPLICATION_GRAPH_DIGESTS.asar, "main.js");
+  const first = contentNode(evidence, { selected: "first" });
+  const second = contentNode(evidence, { selected: "second" });
+  const reversedIdentity = {
+    sha256: APPLICATION_GRAPH_DIGESTS.asar,
+    stability: "global-exact" as const,
+    strategy: "content-digest" as const,
+  };
+  const merged = mergeJavaScriptApplicationNodes([
+    first,
+    { ...second, identity: reversedIdentity },
+    first,
+  ]);
+  expect(merged).toHaveLength(1);
+  const node = firstOf(merged, "merged node");
+  expect(node.node_id).toBe(first.node_id);
+  expect(node.observations.map(({ properties }) => properties)).toEqual(
+    expect.arrayContaining([{ selected: "first" }, { selected: "second" }]),
+  );
+  expect(node.observations).toHaveLength(2);
+  expect(first.observations).toHaveLength(1);
+  expect(second.observations).toHaveLength(1);
+  const graph = graphForNode(node);
+  expect(parseJavaScriptApplicationGraph(graph)).toEqual(graph);
+});
+
+it.each(["kind", "identity"] as const)(
+  "rejects colliding entity IDs with a different %s before merging observations",
+  (field) => {
+    const node = contentNode(
+      artifactEvidence(APPLICATION_GRAPH_DIGESTS.asar, "main.js"),
+    );
+    const conflicting =
+      field === "kind"
+        ? { ...node, kind: "javascript-asset" as const }
+        : {
+            ...node,
+            identity: {
+              strategy: "content-digest" as const,
+              stability: "global-exact" as const,
+              sha256: "f".repeat(64),
+            },
+          };
+    expect(() => mergeJavaScriptApplicationNodes([node, conflicting])).toThrow(
+      "Colliding JAG node identifiers disagree",
+    );
+    expect(node.observations).toHaveLength(1);
+  },
+);
+
 const createLargeNativeExportGraph = (): JavaScriptApplicationGraph => {
   const properties = Object.fromEntries(
     Array.from({ length: 1_001 }, (_, index) => [

src/domain/javascript/javascriptApplicationGraph.ts

@@ -502,6 +502,51 @@ export const createJavaScriptApplicationNode = (
   });
 };
 
+/** Merge authenticated entities, retaining every distinct observation. */
+export const mergeJavaScriptApplicationNodes = (
+  nodes: readonly ApplicationNode[],
+): ApplicationNode[] => {
+  const groups = new Map<
+    string,
+    {
+      node: ApplicationNode;
+      observations: Map<string, ApplicationNode["observations"][number]>;
+    }
+  >();
+  for (const node of nodes) {
+    const group = groups.get(node.node_id);
+    if (group === undefined) {
+      groups.set(node.node_id, {
+        node,
+        observations: new Map(
+          node.observations.map((observation) => [
+            observation.observation_id,
+            observation,
+          ]),
+        ),
+      });
+      continue;
+    }
+    if (
+      node.kind !== group.node.kind ||
+      canonicalJson(node.identity) !== canonicalJson(group.node.identity)
+    )
+      throw new TypeError("Colliding JAG node identifiers disagree");
+    for (const observation of node.observations)
+      group.observations.set(observation.observation_id, observation);
+  }
+  return [...groups.values()].map(({ node, observations }) =>
+    createJavaScriptApplicationNode({
+      kind: node.kind,
+      identity: node.identity,
+      observations: [...observations.values()].map(
+        ({ observation_id: _id, identifier_strategy: _strategy, ...value }) =>
+          value,
+      ),
+    }),
+  );
+};
+
 /** Build one normalized directed relationship and derive its semantic ID. */
 export const createJavaScriptApplicationEdge = (
   input: unknown,

src/domain/javascript/javascriptExportShapeComparison.ts

@@ -1,9 +1,7 @@
 import { uniqueSorted } from "../canonicalOrdering.js";
 import { compareUnicodeCodePoints } from "../unicodeCodePointOrder.js";
-import {
-  canonicalExportShapeValue,
-  digestExportShapeValue,
-} from "./javascriptExportShapeComparisonIdentity.js";
+import { canonicalJson } from "../comparisonSemantics.js";
+import { digestCanonicalValue } from "../canonicalDigest.js";
 import {
   javaScriptExportShapeComparisonResultSchema,
   type JavaScriptExportShapeComparisonChange,
@@ -86,7 +84,7 @@ export const compareJavaScriptExportShapes = (
   };
   return javaScriptExportShapeComparisonResultSchema.parse({
     ...semantic,
-    comparison_id: `jesc_${digestExportShapeValue(semantic)}`,
+    comparison_id: `jesc_${digestCanonicalValue(semantic, "JavaScript export shape comparison")}`,
   });
 };
 
@@ -97,14 +95,17 @@ const sortChanges = (
     .map((change, index) => ({
       change,
       index,
-      sortKey: canonicalExportShapeValue({
-        discriminant: change.discriminant,
-        path: change.path,
-        status: change.status,
-        left_source_range: change.left_source_range,
-        right_source_range: change.right_source_range,
-        change_id: change.change_id,
-      }),
+      sortKey: canonicalJson(
+        {
+          discriminant: change.discriminant,
+          path: change.path,
+          status: change.status,
+          left_source_range: change.left_source_range,
+          right_source_range: change.right_source_range,
+          change_id: change.change_id,
+        },
+        "JavaScript export shape comparison",
+      ),
     }))
     .sort(
       (left, right) =>

src/domain/javascript/javascriptExportShapeComparisonIdentity.ts

@@ -1,22 +0,0 @@
-import { createHash } from "node:crypto";
-
-import canonicalize from "canonicalize";
-
-/**
- * Canonically encode one export-shape comparison value.
- *
- * Comparison identifiers hash the full result semantics, including each
- * change's presence object and the per-variant property inventories.
- */
-export const canonicalExportShapeValue = (value: unknown): string => {
-  const encoded = canonicalize(value);
-  if (encoded === undefined)
-    throw new TypeError(
-      "JavaScript export shape comparison could not canonicalize data",
-    );
-  return encoded;
-};
-
-/** Derive one deterministic SHA-256 comparison identifier component. */
-export const digestExportShapeValue = (value: unknown): string =>
-  createHash("sha256").update(canonicalExportShapeValue(value)).digest("hex");

src/domain/javascript/javascriptExportShapeVariants.ts

@@ -1,7 +1,5 @@
-import {
-  canonicalExportShapeValue,
-  digestExportShapeValue,
-} from "./javascriptExportShapeComparisonIdentity.js";
+import { canonicalJson } from "../comparisonSemantics.js";
+import { digestCanonicalValue } from "../canonicalDigest.js";
 import type {
   JavaScriptExportShapeComparisonChange,
   JavaScriptExportShapeComparisonResult,
@@ -195,7 +193,10 @@ const discriminantOccurrences = (
       const value = literalValue(field);
       if (!value.found) continue;
       const discriminant = { path: field.path, value: value.value };
-      const key = canonicalExportShapeValue(discriminant);
+      const key = canonicalJson(
+        discriminant,
+        "JavaScript export shape comparison",
+      );
       const current = output.get(key);
       output.set(key, {
         discriminant,
@@ -254,8 +255,8 @@ const compareDiscriminants = (
   right: Discriminant,
 ): number =>
   compareUnicodeCodePoints(
-    canonicalExportShapeValue(left),
-    canonicalExportShapeValue(right),
+    canonicalJson(left, "JavaScript export shape comparison"),
+    canonicalJson(right, "JavaScript export shape comparison"),
   );
 
 const selectionUnknownChange = (
@@ -385,8 +386,8 @@ const fieldChangeStatus = ({
   if (
     leftField !== undefined &&
     rightField !== undefined &&
-    canonicalExportShapeValue(leftField) ===
-      canonicalExportShapeValue(rightField)
+    canonicalJson(leftField, "JavaScript export shape comparison") ===
+      canonicalJson(rightField, "JavaScript export shape comparison")
   )
     return null;
   if (leftPresence === "absent" && rightPresence === "absent") return null;
@@ -502,7 +503,7 @@ const changeWithId = (
   semantic: Omit<JavaScriptExportShapeComparisonChange, "change_id">,
 ): JavaScriptExportShapeComparisonChange => ({
   ...semantic,
-  change_id: `jesc_change_${digestExportShapeValue(semantic)}`,
+  change_id: `jesc_change_${digestCanonicalValue(semantic, "JavaScript export shape comparison")}`,
 });
 
 const literalValue = (

src/domain/javascript/javascriptRuntimeReconciliationActive.ts

@@ -8,10 +8,7 @@ import {
   parseAtPath,
 } from "./javascriptRuntimeReconciliationInputValidation.js";
 
-import {
-  classifyBrowserCompleteness,
-  type BrowserCompleteness,
-} from "../browserCompleteness.js";
+import { classifyBrowserCompleteness } from "../browserCompleteness.js";
 import {
   electronActiveObservationResultSchema,
   type ElectronActiveObservationResult,
@@ -81,19 +78,10 @@ const assertIdentity = (evidence: Evidence): void => {
 };
 const normalizeInspection = (
   result: ElectronActiveObservationResult,
-): {
-  readonly target: {
-    readonly target_id: string;
-    readonly type: string;
-    readonly title: string;
-    readonly attached: boolean;
-    readonly file_path: string;
-  };
-  readonly frames: readonly [];
-  readonly scripts: { readonly items: readonly [] };
-  readonly workers: readonly [];
-  readonly completeness: BrowserCompleteness;
-} => ({
+): Extract<
+  ParsedRuntimeCapture,
+  { kind: "electron-active" }
+>["inspection"] => ({
   target: {
     target_id: `electron-active:${digestCanonicalValue(result.application.application_path, "Runtime reconciliation").slice(0, 32)}`,
     type: "electron-application",

src/domain/javascript/javascriptRuntimeReconciliationGraph.ts

@@ -1,6 +1,6 @@
 import {
   createJavaScriptApplicationGraph,
-  createJavaScriptApplicationNode,
+  mergeJavaScriptApplicationNodes,
   type JavaScriptApplicationGraph,
 } from "./javascriptApplicationGraph.js";
 import type {
@@ -39,7 +39,7 @@ export interface ReconciledApplicationGraphProjection {
 export const buildReconciledApplicationGraph = (
   input: ReconciledGraphInput,
 ): ReconciledApplicationGraphProjection => {
-  const merged = mergeNodes([
+  const merged = mergeJavaScriptApplicationNodes([
     ...input.layers.flatMap(({ graph }) => graph.nodes),
     ...input.runtime.nodes,
   ]);
@@ -210,45 +210,6 @@ const graphCoverage = (
           limits: [],
         };
 
-const mergeNodes = (nodes: readonly ApplicationNode[]): ApplicationNode[] => {
-  const grouped = new Map<string, ApplicationNode[]>();
-  for (const node of nodes) {
-    const group = grouped.get(node.node_id);
-    if (group === undefined) grouped.set(node.node_id, [node]);
-    else group.push(node);
-  }
-  const merged = [...grouped.values()].map((group) => {
-    const first = group[0];
-    if (first === undefined) throw new TypeError("Empty JAG node group");
-    if (
-      group.some(
-        ({ kind, identity }) =>
-          kind !== first.kind ||
-          JSON.stringify(identity) !== JSON.stringify(first.identity),
-      )
-    )
-      throw new TypeError("Colliding JAG node identifiers disagree");
-    const observations = [
-      ...new Map(
-        group
-          .flatMap(({ observations: values }) => values)
-          .map((observation) => [observation.observation_id, observation]),
-      ).values(),
-    ].sort((left, right) =>
-      compareUnicodeCodePoints(left.observation_id, right.observation_id),
-    );
-    return createJavaScriptApplicationNode({
-      kind: first.kind,
-      identity: first.identity,
-      observations: observations.map(
-        ({ observation_id: _id, identifier_strategy: _strategy, ...value }) =>
-          value,
-      ),
-    });
-  });
-  return merged;
-};
-
 const uniqueEdges = (edges: readonly ApplicationEdge[]): ApplicationEdge[] => [
   ...new Map(edges.map((edge) => [edge.edge_id, edge])).values(),
 ];

src/domain/javascript/javascriptRuntimeReconciliationMatching.ts

@@ -77,14 +77,13 @@ const reconcileEntity = (
       reason: "runtime-location-unresolved",
       candidates: [],
     });
-  const locations = candidatesWithLocation(entity, index, layers);
+  const { locations, mapped } = locateEntity(entity, index, layers);
   if (entity.sourceSha256 !== null)
-    return reconcileCapturedSource(
-      entity,
-      entity.sourceSha256,
+    return reconcileCapturedSource(entity, entity.sourceSha256, {
       locations,
+      mapped,
       index,
-    );
+    });
 
   const location = locations.at(0);
   if (locations.length === 1 && location !== undefined) {
@@ -103,20 +102,40 @@ const reconcileEntity = (
       reason: "ambiguous-static-candidates",
       candidates: locations.map(({ candidate }) => candidate),
     });
-  const mapped = layers.some(
-    (layer) => mappedRuntimePaths(layer, entity).length > 0,
-  );
-  return unresolved(entity, {
-    status: mapped ? "unmatched" : "unknown",
-    basis: "none",
-    confidence: "unknown",
-    reason: mapped
-      ? "no-static-content-match"
-      : "no-authorized-location-mapping",
-    candidates: [],
-  });
+  return withoutStaticCandidate(entity, mapped, "unknown");
 };
 
+/**
+ * Classify an entity with no qualifying static candidate. Absence is claimed
+ * only beneath an automatic or caller-declared mapping; without one, the
+ * runtime location has no authorized static counterpart and stays unknown.
+ * Captured bytes compared against every static digest support a high-confidence
+ * absence; a location-only absence does not.
+ */
+const withoutStaticCandidate = (
+  entity: RuntimeReconciliationEntity,
+  mapped: boolean,
+  absenceConfidence: JavaScriptRuntimeReconciliationItem["confidence"],
+): EvaluatedMatch =>
+  unresolved(
+    entity,
+    mapped
+      ? {
+          status: "unmatched",
+          basis: "none",
+          confidence: absenceConfidence,
+          reason: "no-static-content-match",
+          candidates: [],
+        }
+      : {
+          status: "unknown",
+          basis: "none",
+          confidence: "unknown",
+          reason: "no-authorized-location-mapping",
+          candidates: [],
+        },
+  );
+
 interface LocatedCandidate {
   readonly candidate: StaticRuntimeCandidate;
   readonly mapping: MappedRuntimePath;
@@ -125,8 +144,15 @@ interface LocatedCandidate {
 const reconcileCapturedSource = (
   entity: RuntimeReconciliationEntity,
   sourceSha256: string,
-  locations: readonly LocatedCandidate[],
-  index: CandidateIndex,
+  {
+    locations,
+    mapped,
+    index,
+  }: {
+    readonly locations: readonly LocatedCandidate[];
+    readonly mapped: boolean;
+    readonly index: CandidateIndex;
+  },
 ): EvaluatedMatch => {
   // A known mapped candidate owns the comparison. Unrelated equal bytes cannot
   // repair a disagreement or establish the content of a candidate without a digest.
@@ -176,23 +202,19 @@ const reconcileCapturedSource = (
       candidates: locations.map(({ candidate: located }) => located),
     });
   }
-  return unresolved(entity, {
-    status: "unmatched",
-    basis: "none",
-    confidence: "high",
-    reason: "no-static-content-match",
-    candidates: [],
-  });
+  return withoutStaticCandidate(entity, mapped, "high");
 };
 
-const candidatesWithLocation = (
+const locateEntity = (
   entity: RuntimeReconciliationEntity,
   index: CandidateIndex,
   layers: readonly ParsedStaticLayer[],
-): LocatedCandidate[] => {
+): { readonly locations: LocatedCandidate[]; readonly mapped: boolean } => {
   const located = new Map<string, LocatedCandidate>();
+  let mapped = false;
   for (const layer of layers)
-    for (const mapping of mappedRuntimePaths(layer, entity))
+    for (const mapping of mappedRuntimePaths(layer, entity)) {
+      mapped = true;
       for (const candidate of [
         ...(index.byLayerCategoryPath.get(
           layerCategoryPathKey(layer.layerId, entity.staticKind, mapping.path),
@@ -215,12 +237,16 @@ const candidatesWithLocation = (
         const key = candidateKey(candidate);
         if (!located.has(key)) located.set(key, { candidate, mapping });
       }
-  return [...located.values()].sort((left, right) =>
-    compareUnicodeCodePoints(
-      candidateKey(left.candidate),
-      candidateKey(right.candidate),
+    }
+  return {
+    locations: [...located.values()].sort((left, right) =>
+      compareUnicodeCodePoints(
+        candidateKey(left.candidate),
+        candidateKey(right.candidate),
+      ),
     ),
-  );
+    mapped,
+  };
 };
 
 const indexCandidates = (

src/domain/javascript/javascriptSemanticAsyncEffects.ts

@@ -2,6 +2,7 @@ import * as t from "@babel/types";
 
 import type {
   JavaScriptSemanticCallable,
+  JavaScriptSemanticProjectedResultBinding,
   JavaScriptSemanticEventOperation,
   JavaScriptSemanticTimerOperation,
 } from "./javascriptSemanticIr.js";
@@ -18,6 +19,7 @@ import { traverseJavaScriptAst } from "./javascriptSemanticTraversal.js";
 import { range } from "./javascriptStaticAnalysisHelpers.js";
 import {
   builtinDataEffectMethod,
+  dataEffectArgumentBindingId,
   dataEffectLiteralString,
   dataEffectMemberCallee,
   assignedSemanticResultBindings,
@@ -71,11 +73,7 @@ interface TimerCandidate {
   readonly kind: JavaScriptSemanticTimerOperation["kind"];
   readonly ownerCallableId: string | null;
   readonly handleBindingId: string | null;
-  readonly projectedResultBindings: readonly {
-    readonly bindingId: string;
-    readonly projectionPath: readonly (string | number | null)[];
-    readonly resolution: "complete" | "partial";
-  }[];
+  readonly projectedResultBindings: readonly JavaScriptSemanticProjectedResultBinding[];
   readonly handleRead: {
     readonly origins: readonly t.Node[];
     readonly complete: boolean;
@@ -158,7 +156,7 @@ const collectEvent = (
     emitterKey: emitter.key,
     emitterBindingId: emitter.bindingId,
     eventName,
-    listenerBindingId: bindingId(listenerArgument, state),
+    listenerBindingId: dataEffectArgumentBindingId(listenerArgument, state),
     listenerLocation: t.isNode(listenerArgument)
       ? range(listenerArgument)
       : null,
@@ -264,7 +262,7 @@ const collectTimer = (input: TimerCollectionInput): void => {
     handleBindingId:
       kind === "schedule"
         ? scalarAssignedResultBinding(projectedResultBindings)
-        : bindingId(node.arguments[0], state),
+        : dataEffectArgumentBindingId(node.arguments[0], state),
     projectedResultBindings:
       kind === "schedule"
         ? semanticProjectedBindingFacts(
@@ -351,19 +349,6 @@ const admittedTimerMethod = (
     (candidate) => candidate === value,
   ) ?? null;
 
-const bindingId = (
-  node:
-    | t.Expression
-    | t.SpreadElement
-    | t.JSXNamespacedName
-    | t.ArgumentPlaceholder
-    | undefined,
-  state: JavaScriptSemanticAnalysisState,
-): string | null =>
-  t.isIdentifier(node)
-    ? (resolveSemanticBindingState(state, node, node.name)?.bindingId ?? null)
-    : null;
-
 const timerDelay = (candidate: TimerCandidate): number | null => {
   if (candidate.kind !== "schedule" || candidate.method === "setImmediate")
     return null;

src/domain/javascript/javascriptSemanticCallResolution.ts

@@ -1,3 +1,4 @@
+import { javascriptSourceRangeContains } from "./javascriptSourceCoordinates.js";
 import * as t from "@babel/types";
 
 import type {
@@ -270,7 +271,7 @@ const parameterAcceptsArgument = (
   if (!t.isFunction(node)) return false;
   const parameters = runtimeFunctionParameters(node);
   const parameterIndex = parameters.findIndex((parameter) =>
-    rangeContains(range(parameter), location),
+    javascriptSourceRangeContains(range(parameter), location),
   );
   if (parameterIndex === argumentIndex) return true;
   return (
@@ -280,16 +281,5 @@ const parameterAcceptsArgument = (
   );
 };
 
-const rangeContains = (
-  outer: JavaScriptSemanticArgumentFlow["parameterLocation"],
-  inner: JavaScriptSemanticArgumentFlow["parameterLocation"],
-): boolean =>
-  (outer.start.line < inner.start.line ||
-    (outer.start.line === inner.start.line &&
-      outer.start.column <= inner.start.column)) &&
-  (outer.end.line > inner.end.line ||
-    (outer.end.line === inner.end.line &&
-      outer.end.column >= inner.end.column));
-
 const uniqueCallableIds = (values: readonly string[]): string[] =>
   [...new Set(values)].sort(compareUnicodeCodePoints);

src/domain/javascript/javascriptSemanticChildProcesses.ts

@@ -2,6 +2,7 @@ import * as t from "@babel/types";
 
 import type {
   JavaScriptSemanticCallable,
+  JavaScriptSemanticProjectedResultBinding,
   JavaScriptSemanticChildProcessInteraction,
   JavaScriptSemanticChildProcessSpawn,
 } from "./javascriptSemanticIr.js";
@@ -49,11 +50,7 @@ interface SpawnCandidate {
   readonly method: JavaScriptSemanticChildProcessSpawn["method"];
   readonly ownerCallableId: string | null;
   readonly resultBindingId: string | null;
-  readonly projectedResultBindings: readonly {
-    readonly bindingId: string;
-    readonly projectionPath: readonly (string | number | null)[];
-    readonly resolution: "complete" | "partial";
-  }[];
+  readonly projectedResultBindings: readonly JavaScriptSemanticProjectedResultBinding[];
 }
 
 interface ChildInteractionContext {

src/domain/javascript/javascriptSemanticDataEffectHelpers.ts

@@ -8,7 +8,10 @@ import {
   semanticGlobalProcessOrigin,
   semanticMutableBuiltinOrigin,
 } from "./javascriptSemanticRequireOrigin.js";
-import type { JavaScriptModuleOrigin } from "./javascriptSemanticIr.js";
+import type {
+  JavaScriptModuleOrigin,
+  JavaScriptSemanticProjectedResultBinding,
+} from "./javascriptSemanticIr.js";
 import {
   evaluateSemanticProvenance,
   evaluateSemanticProvenanceAtRead,
@@ -35,11 +38,8 @@ import {
   unwrapJavaScriptExpression,
 } from "./javascriptAstValues.js";
 
-export interface SemanticProjectedBinding {
-  readonly bindingId: string;
+export interface SemanticProjectedBinding extends JavaScriptSemanticProjectedResultBinding {
   readonly identifier: t.Identifier;
-  readonly projectionPath: readonly (string | number | null)[];
-  readonly resolution: "complete" | "partial";
 }
 
 /** Resolve bindings written by the nearest variable or assignment owner. */
@@ -136,7 +136,7 @@ const projectedPatternBindings = (
 
 export const semanticProjectedBindingFacts = (
   bindings: readonly SemanticProjectedBinding[],
-): Omit<SemanticProjectedBinding, "identifier">[] =>
+): JavaScriptSemanticProjectedResultBinding[] =>
   bindings.map(({ identifier: _identifier, ...fact }) => fact);
 
 /** Return a scalar owner only for an unprojected identifier result. */

src/domain/javascript/javascriptSemanticGraphSerialization.ts

@@ -1,18 +1,9 @@
-import canonicalize from "canonicalize";
+import { canonicalJson } from "../comparisonSemantics.js";
 import {
   javaScriptSemanticGraphSchema,
   type JavaScriptSemanticGraph,
 } from "./javascriptSemanticGraph.js";
 
-const canonicalJson = (value: unknown): string => {
-  const encoded = canonicalize(value);
-  if (encoded === undefined)
-    throw new TypeError(
-      "JavaScript semantic graph could not canonicalize data",
-    );
-  return encoded;
-};
-
 /** Parse a stored semantic graph and reject stale IDs. */
 export const parseJavaScriptSemanticGraph = (
   input: unknown,
@@ -20,4 +11,7 @@ export const parseJavaScriptSemanticGraph = (
 
 /** Serialize a verified semantic graph as canonical JSON. */
 export const serializeJavaScriptSemanticGraph = (input: unknown): string =>
-  canonicalJson(parseJavaScriptSemanticGraph(input));
+  canonicalJson(
+    parseJavaScriptSemanticGraph(input),
+    "JavaScript semantic graph",
+  );

src/domain/javascript/javascriptSemanticPromises.ts

@@ -1,3 +1,4 @@
+import { javascriptSourceRangeKey } from "./javascriptSourceCoordinates.js";
 import * as t from "@babel/types";
 
 import type {
@@ -340,7 +341,7 @@ const indexReturnSites = (
 ): ReadonlyMap<string, string> => {
   const output = new Map<string, string>();
   for (const site of callable.returnSites) {
-    const key = returnSiteKey(site.location);
+    const key = javascriptSourceRangeKey(site.location);
     if (!output.has(key)) output.set(key, site.returnSiteId);
   }
   return output;
@@ -366,7 +367,7 @@ const createReturnSiteLookup = (
       returnSiteIds = indexReturnSites(callable);
       returnSiteIdsByCallable.set(callableId, returnSiteIds);
     }
-    return returnSiteIds.get(returnSiteKey(location)) ?? null;
+    return returnSiteIds.get(javascriptSourceRangeKey(location)) ?? null;
   };
 };
 
@@ -381,11 +382,6 @@ const indexCallablesById = (
   return output;
 };
 
-const returnSiteKey = (
-  location: JavaScriptSemanticPromiseOperation["location"],
-): string =>
-  `${location.start.line}:${location.start.column}:${location.end.line}:${location.end.column}`;
-
 const promiseSources = (
   candidate: PromiseCandidate,
   candidateByNode: WeakMap<t.Node, PromiseCandidate>,

src/domain/javascript/javascriptSemanticQueryIdentity.ts

@@ -1,6 +1,4 @@
-import { createHash } from "node:crypto";
-
-import canonicalize from "canonicalize";
+import { digestCanonicalValue } from "../canonicalDigest.js";
 
 import type { JavaScriptSemanticGraph } from "./javascriptSemanticGraph.js";
 import type { JavaScriptSemanticGraphNode } from "./javascriptSemanticGraphSchemas.js";
@@ -8,44 +6,30 @@ import { uniqueSorted } from "../canonicalOrdering.js";
 import { compareUnicodeCodePoints } from "../unicodeCodePointOrder.js";
 import type { JavaScriptSemanticQueryInput } from "./javascriptSemanticQuerySchemas.js";
 
-/** Canonical JSON used by semantic query commitments and ordering. */
-export const canonicalJavaScriptSemanticQueryJson = (
-  value: unknown,
-): string => {
-  const encoded = canonicalize(value);
-  if (encoded === undefined)
-    throw new TypeError(
-      "JavaScript semantic query could not canonicalize data",
-    );
-  return encoded;
-};
-
-const digest = (value: unknown): string =>
-  createHash("sha256")
-    .update(canonicalJavaScriptSemanticQueryJson(value))
-    .digest("hex");
-
 /** Derive the stable identity for one graph-bound query. */
 export const javaScriptSemanticQueryIdentifier = (
   graph: JavaScriptSemanticGraph,
   input: JavaScriptSemanticQueryInput,
 ): string => {
   const semantic = input;
-  return `jsrq_${digest({
-    source_graph_id: graph.graph_id,
-    ...semantic,
-    allowed_relations:
-      semantic.allowed_relations === undefined
-        ? undefined
-        : uniqueSorted(semantic.allowed_relations),
-    expected:
-      semantic.expected === null
-        ? null
-        : {
-            ...semantic.expected,
-            classes: uniqueSorted(semantic.expected.classes),
-          },
-  })}`;
+  return `jsrq_${digestCanonicalValue(
+    {
+      source_graph_id: graph.graph_id,
+      ...semantic,
+      allowed_relations:
+        semantic.allowed_relations === undefined
+          ? undefined
+          : uniqueSorted(semantic.allowed_relations),
+      expected:
+        semantic.expected === null
+          ? null
+          : {
+              ...semantic.expected,
+              classes: uniqueSorted(semantic.expected.classes),
+            },
+    },
+    "JavaScript semantic query",
+  )}`;
 };
 
 /** Resolve deterministic seed candidates without applying traversal limits. */

src/domain/javascript/javascriptSourceCoordinates.ts

@@ -1,4 +1,28 @@
 import { z } from "zod";
+import type {
+  JavaScriptSourcePoint,
+  JavaScriptSourceRange,
+} from "./javascriptStaticAnalysisTypes.js";
+
+/** Compare parser coordinates by line, then UTF-16 column. */
+export const compareJavaScriptSourcePoints = (
+  left: JavaScriptSourcePoint,
+  right: JavaScriptSourcePoint,
+): number => left.line - right.line || left.column - right.column;
+
+/** Include equal endpoints without implying runtime reachability. */
+export const javascriptSourceRangeContains = (
+  outer: JavaScriptSourceRange,
+  inner: JavaScriptSourceRange,
+): boolean =>
+  compareJavaScriptSourcePoints(outer.start, inner.start) <= 0 &&
+  compareJavaScriptSourcePoints(outer.end, inner.end) >= 0;
+
+/** Exact artifact-local coordinate key; callers supply the artifact identity. */
+export const javascriptSourceRangeKey = (
+  range: JavaScriptSourceRange,
+): string =>
+  `${range.start.line}:${range.start.column}-${range.end.line}:${range.end.column}`;
 
 const sourcePointSchema = z.strictObject({
   line: z.number().int().min(1),
@@ -9,11 +33,7 @@ const sourcePointSchema = z.strictObject({
 export const javascriptSourceRangeSchema = z
   .strictObject({ start: sourcePointSchema, end: sourcePointSchema })
   .superRefine((range, context) => {
-    if (
-      range.end.line < range.start.line ||
-      (range.end.line === range.start.line &&
-        range.end.column < range.start.column)
-    )
+    if (compareJavaScriptSourcePoints(range.end, range.start) < 0)
       context.addIssue({
         code: "custom",
         path: ["end"],

src/domain/jsonShape.ts

@@ -1,6 +1,7 @@
 import { z } from "zod";
 
 import { compareUnicodeCodePoints } from "./unicodeCodePointOrder.js";
+import { safeParseJson } from "./safeJson.js";
 
 const jsonValueTypeSchema = z.enum([
   "object",
@@ -133,13 +134,8 @@ export const inferJsonShape = (text: string): JsonShape | null => {
 export const parseJsonObject = (
   text: string,
 ): Readonly<Record<string, unknown>> | null => {
-  let root: unknown;
-  try {
-    root = JSON.parse(text);
-  } catch {
-    return null;
-  }
-  return isRecord(root) ? root : null;
+  const parsed = safeParseJson(text);
+  return parsed.ok && isRecord(parsed.value) ? parsed.value : null;
 };
 /** The JSON type name of one parsed value. */
 export const jsonValueType = (value: unknown): JsonValueType => {

src/domain/managed/managedApplicationGraph.ts

@@ -1,6 +1,3 @@
-import { createHash } from "node:crypto";
-
-import canonicalize from "canonicalize";
 import { z } from "zod";
 
 import { evidenceSchema, type Evidence } from "../evidence.js";
@@ -20,7 +17,7 @@ import {
   type ManagedMemberInspection,
   type ManagedNativeBoundaryInspection,
 } from "./managedArtifact.js";
-import type { JsonValue } from "../jsonValue.js";
+import { digestCanonicalValue } from "../canonicalDigest.js";
 import {
   assessManagedGraphOmissions,
   managedGraphEvidenceCoverage,
@@ -120,13 +117,6 @@ export interface GraphBuildState {
   readonly fieldNodes: Map<string, ApplicationNode>;
 }
 
-const sha256 = (value: JsonValue): string => {
-  const serialized = canonicalize(value);
-  if (serialized === undefined)
-    throw new TypeError("Managed application graph canonicalization failed");
-  return createHash("sha256").update(serialized).digest("hex");
-};
-
 /** Project authenticated managed Evidence records into the application graph. */
 export const projectManagedApplicationGraph = (
   input: ProjectManagedApplicationGraphInput,
@@ -194,7 +184,10 @@ export const projectManagedApplicationGraph = (
   };
   return managedApplicationGraphResultSchema.parse({
     ...withoutId,
-    projection_id: `magp_${sha256(withoutId)}`,
+    projection_id: `magp_${digestCanonicalValue(
+      withoutId,
+      "Managed application graph",
+    )}`,
   });
 };
 

src/domain/managed/managedArtifact.ts

@@ -1,7 +1,8 @@
 import { z } from "zod";
 import { digestSchema } from "../digests.js";
 
-const tokenSchema = z.string().regex(/^0x[0-9a-f]{8}$/u);
+/** Build-local ECMA-335 metadata token emitted as an eight-digit lowercase hex value. */
+export const managedMetadataTokenSchema = z.string().regex(/^0x[0-9a-f]{8}$/u);
 const offsetSchema = z.number().int().min(0);
 
 /** A 16-byte CLI metadata GUID without RFC 4122 version/variant restrictions. */
@@ -26,7 +27,7 @@ const assemblyIdentitySchema = z.object({
   flags: z.number().int().min(0).max(0xffff_ffff),
   hash_algorithm: z.number().int().min(0).max(0xffff_ffff),
   public_key: publicKeyIdentitySchema,
-  token: tokenSchema,
+  token: managedMetadataTokenSchema,
   row_offset: offsetSchema,
 });
 
@@ -36,7 +37,7 @@ const moduleIdentitySchema = z.object({
   mvid: cliMetadataGuidSchema.nullable(),
   enc_id: cliMetadataGuidSchema.nullable(),
   enc_base_id: cliMetadataGuidSchema.nullable(),
-  token: tokenSchema,
+  token: managedMetadataTokenSchema,
   row_offset: offsetSchema,
 });
 
@@ -70,7 +71,7 @@ const assemblyReferenceSchema = z.object({
   public_key_or_token: publicKeyIdentitySchema,
   hash_value_sha256: digestSchema.nullable(),
   hash_value_length: z.number().int().min(0),
-  token: tokenSchema,
+  token: managedMetadataTokenSchema,
   row_offset: offsetSchema,
 });
 
@@ -78,23 +79,23 @@ const managedResourceSchema = z.object({
   name: z.string(),
   flags: z.number().int().min(0).max(0xffff_ffff),
   visibility: z.enum(["public", "private", "unknown"]),
-  implementation_token: tokenSchema.nullable(),
+  implementation_token: managedMetadataTokenSchema.nullable(),
   embedded: z.boolean(),
   declared_offset: z.number().int().min(0).max(0xffff_ffff),
   data_length: z.number().int().min(0).nullable(),
   data_sha256: digestSchema.nullable(),
-  token: tokenSchema,
+  token: managedMetadataTokenSchema,
   row_offset: offsetSchema,
 });
 
 const customAttributeSchema = z.object({
-  parent_token: tokenSchema,
-  constructor_token: tokenSchema.nullable(),
+  parent_token: managedMetadataTokenSchema,
+  constructor_token: managedMetadataTokenSchema.nullable(),
   type_name: z.string().nullable(),
   value_length: z.number().int().min(0),
   value_sha256: digestSchema,
   decoded_fixed_string: z.string().nullable(),
-  token: tokenSchema,
+  token: managedMetadataTokenSchema,
   row_offset: offsetSchema,
 });
 
@@ -120,7 +121,7 @@ const managedSignatureSchema = z.object({
 });
 
 const managedTypeSchema = z.object({
-  token: tokenSchema,
+  token: managedMetadataTokenSchema,
   row_offset: offsetSchema,
   namespace: z.string(),
   name: z.string(),
@@ -132,8 +133,8 @@ const managedTypeSchema = z.object({
       "Framed nominal namespace/name/enclosing-name digest, independent of build-local rows. Null for historical Evidence or unresolved nesting; defining assemblies and CLR runtime identity are not established.",
     ),
   flags: z.number().int().min(0).max(0xffff_ffff),
-  extends_token: tokenSchema.nullable(),
-  enclosing_type_token: tokenSchema
+  extends_token: managedMetadataTokenSchema.nullable(),
+  enclosing_type_token: managedMetadataTokenSchema
     .nullable()
     .default(null)
     .describe(
@@ -153,20 +154,20 @@ const managedTypeSchema = z.object({
 
 /** One ExportedType row: a type this assembly exports from another module or forwards. */
 const managedExportedTypeSchema = z.object({
-  token: tokenSchema,
+  token: managedMetadataTokenSchema,
   row_offset: offsetSchema,
   namespace: z.string(),
   name: z.string(),
   flags: z.number().int().min(0).max(0xffff_ffff),
   forwarder: z.boolean(),
   type_def_id: z.number().int().min(0).max(0xffff_ffff),
-  implementation_token: tokenSchema.nullable(),
+  implementation_token: managedMetadataTokenSchema.nullable(),
 });
 
 const managedFieldSchema = z.object({
-  token: tokenSchema,
+  token: managedMetadataTokenSchema,
   row_offset: offsetSchema,
-  declaring_type_token: tokenSchema.nullable(),
+  declaring_type_token: managedMetadataTokenSchema.nullable(),
   declaring_type: z.string().nullable(),
   name: z.string(),
   flags: z.number().int().min(0).max(0xffff),
@@ -179,7 +180,7 @@ const managedExceptionRegionSchema = z.object({
   try_length: z.number().int().min(0),
   handler_offset: z.number().int().min(0),
   handler_length: z.number().int().min(0),
-  class_token: tokenSchema.nullable(),
+  class_token: managedMetadataTokenSchema.nullable(),
   filter_offset: z.number().int().min(0).nullable(),
 });
 
@@ -210,7 +211,7 @@ const managedMethodBodySchema = z.object({
   file_offset: offsetSchema.nullable(),
   max_stack: z.number().int().min(0).nullable(),
   init_locals: z.boolean().nullable(),
-  local_var_sig_token: tokenSchema.nullable(),
+  local_var_sig_token: managedMetadataTokenSchema.nullable(),
   il_size: z.number().int().min(0),
   il_sha256: digestSchema
     .nullable()
@@ -232,9 +233,9 @@ const managedMethodBodySchema = z.object({
 });
 
 const managedMethodSchema = z.object({
-  token: tokenSchema,
+  token: managedMetadataTokenSchema,
   row_offset: offsetSchema,
-  declaring_type_token: tokenSchema.nullable(),
+  declaring_type_token: managedMetadataTokenSchema.nullable(),
   declaring_type: z.string().nullable(),
   name: z.string(),
   rva: z.number().int().min(0).max(0xffff_ffff),
@@ -250,9 +251,9 @@ const managedMethodSchema = z.object({
 const declaringTypeNameSchema = z.string().nullable().default(null);
 
 const managedMemberReferenceSchema = z.object({
-  token: tokenSchema,
+  token: managedMetadataTokenSchema,
   row_offset: offsetSchema,
-  parent_token: tokenSchema.nullable(),
+  parent_token: managedMetadataTokenSchema.nullable(),
   parent_name: declaringTypeNameSchema.describe(
     "Name of a TypeDef, TypeRef, or generic-instantiation TypeSpec parent; null for other parents or when unknown",
   ),
@@ -261,7 +262,7 @@ const managedMemberReferenceSchema = z.object({
 });
 
 const managedUserStringSchema = z.object({
-  token: tokenSchema,
+  token: managedMetadataTokenSchema,
   offset: offsetSchema.describe("File offset of the #US item"),
   value: z
     .string()
@@ -271,21 +272,21 @@ const managedUserStringSchema = z.object({
 });
 
 const managedModuleReferenceSchema = z.object({
-  token: tokenSchema,
+  token: managedMetadataTokenSchema,
   row_offset: offsetSchema,
   name: z.string(),
 });
 
-const managedNativeImportSchema = z.object({
-  token: tokenSchema,
+export const managedNativeImportSchema = z.object({
+  token: managedMetadataTokenSchema,
   row_offset: offsetSchema,
   mapping_flags: z.number().int().min(0).max(0xffff),
   mapping_flags_hex: z.string().regex(/^0x[0-9a-f]{4}$/u),
-  member_token: tokenSchema.nullable(),
+  member_token: managedMetadataTokenSchema.nullable(),
   member_kind: z.enum(["method", "field", "unknown"]),
   member_name: z.string().nullable(),
   import_name: z.string(),
-  import_scope_token: tokenSchema.nullable(),
+  import_scope_token: managedMetadataTokenSchema.nullable(),
   import_scope_name: z.string().nullable(),
   no_mangle: z.boolean(),
   char_set: z.enum(["not-specified", "ansi", "unicode", "auto", "unknown"]),
@@ -310,7 +311,7 @@ const managedNativeImportSchema = z.object({
 });
 
 const managedNativeImplementationSchema = z.object({
-  token: tokenSchema,
+  token: managedMetadataTokenSchema,
   row_offset: offsetSchema,
   name: z.string(),
   rva: z.number().int().min(0).max(0xffff_ffff),
@@ -335,10 +336,10 @@ const managedNativeImplementationSchema = z.object({
 });
 
 const managedCallEdgeSchema = z.object({
-  caller_token: tokenSchema,
+  caller_token: managedMetadataTokenSchema,
   caller: z.string().nullable(),
   opcode: z.string(),
-  target_token: tokenSchema,
+  target_token: managedMetadataTokenSchema,
   target_kind: z.enum(["method-def", "member-ref", "method-spec", "unknown"]),
   target_name: z
     .string()
@@ -350,10 +351,10 @@ const managedCallEdgeSchema = z.object({
 });
 
 const managedFieldAccessSchema = z.object({
-  method_token: tokenSchema,
+  method_token: managedMetadataTokenSchema,
   method: z.string().nullable(),
   opcode: z.string(),
-  field_token: tokenSchema,
+  field_token: managedMetadataTokenSchema,
   field_name: z.string().nullable(),
   field_declaring_type: declaringTypeNameSchema.describe(
     "Declaring type of the accessed field; null when unknown",

src/domain/managed/managedMemberComparison.ts

@@ -1,9 +1,11 @@
 import { z } from "zod";
 
+import { digestCanonicalValue } from "../canonicalDigest.js";
 import { emptyArraySchema } from "../emptyArraySchema.js";
 import { evidenceSchema } from "../evidence.js";
 import {
   cliMetadataGuidSchema,
+  managedMetadataTokenSchema,
   type ManagedMemberInspection,
 } from "./managedArtifact.js";
 import {
@@ -17,13 +19,12 @@ import {
   buildFieldItems,
   buildMethodItems,
 } from "./managedMemberComparisonItems.js";
-import { keyMembers, sha256 } from "./managedMemberComparisonMatch.js";
+import { keyMembers } from "./managedMemberComparisonMatch.js";
 import { hasSignatureResolution } from "./managedMemberSignatureIdentity.js";
 import { digestSchema } from "../digests.js";
 import { prefixedDigestSchema } from "../digests.js";
 
 const evidenceIdSchema = prefixedDigestSchema("ev");
-const tokenSchema = z.string().regex(/^0x[0-9a-f]{8}$/u);
 const boundedTextSchema = z.string().min(1);
 
 /** Two authenticated managed member observations. */
@@ -47,7 +48,7 @@ const concreteMatchBasisSchema = z.enum([
   "structural-method-shape",
   "field-signature",
 ]);
-const candidateTokensSchema = z.array(tokenSchema).min(1);
+const candidateTokensSchema = z.array(managedMetadataTokenSchema).min(1);
 const matchedComparisonSchema = z.strictObject({
   status: z.literal("matched"),
   basis: concreteMatchBasisSchema,
@@ -70,7 +71,7 @@ const ambiguousComparisonSchema = z.strictObject({
   candidate_right_tokens: candidateTokensSchema,
 });
 const memberIdentitySchema = z.strictObject({
-  token: tokenSchema,
+  token: managedMetadataTokenSchema,
   declaring_type: z.string().nullable(),
   name: z.string(),
   signature_sha256: digestSchema,
@@ -247,12 +248,15 @@ export const compareManagedMembers = (
   });
   const limitations = comparisonLimitations(left.result, right.result);
   const result = {
-    comparison_id: `mmc_${sha256({
-      left: left.evidenceId,
-      right: right.evidenceId,
-      methods: [...methodItems],
-      fields: [...fieldItems],
-    })}`,
+    comparison_id: `mmc_${digestCanonicalValue(
+      {
+        left: left.evidenceId,
+        right: right.evidenceId,
+        methods: [...methodItems],
+        fields: [...fieldItems],
+      },
+      "Managed comparison",
+    )}`,
     algorithm: {
       name: "rea-managed-member-comparison" as const,
       token_identity: "build-local" as const,

src/domain/managed/managedMemberComparisonItems.ts

@@ -1,11 +1,11 @@
 import canonicalize from "canonicalize";
 
+import { digestCanonicalValue } from "../canonicalDigest.js";
 import type { ManagedMemberInspection } from "./managedArtifact.js";
 import type { ManagedMemberComparisonResult } from "./managedMemberComparison.js";
-import {
-  type ManagedFieldMatches,
-  type ManagedMethodMatches,
-  sha256,
+import type {
+  ManagedFieldMatches,
+  ManagedMethodMatches,
 } from "./managedMemberComparisonMatch.js";
 import { signatureIdentity } from "./managedMemberSignatureIdentity.js";
 
@@ -180,7 +180,7 @@ const methodOnlyItem = (
       inventory: "method",
     });
     return {
-      item_id: `mmc_method_${sha256({ token: member.left.token, side: "left" })}`,
+      item_id: `mmc_method_${digestCanonicalValue({ token: member.left.token, side: "left" }, "Managed comparison")}`,
       status: limitations.length === 0 ? "removed" : "unknown",
       left: methodIdentity(member.left),
       right: null,
@@ -203,7 +203,7 @@ const methodOnlyItem = (
     inventory: "method",
   });
   return {
-    item_id: `mmc_method_${sha256({ token: member.right.token, side: "right" })}`,
+    item_id: `mmc_method_${digestCanonicalValue({ token: member.right.token, side: "right" }, "Managed comparison")}`,
     status: limitations.length === 0 ? "added" : "unknown",
     left: null,
     right: methodIdentity(member.right),
@@ -377,7 +377,7 @@ const fieldOnlyItem = (
       inventory: "field",
     });
     return {
-      item_id: `mmc_field_${sha256({ token: member.left.token, side: "left" })}`,
+      item_id: `mmc_field_${digestCanonicalValue({ token: member.left.token, side: "left" }, "Managed comparison")}`,
       status: limitations.length === 0 ? "removed" : "unknown",
       left: fieldIdentity(member.left),
       right: null,
@@ -399,7 +399,7 @@ const fieldOnlyItem = (
     inventory: "field",
   });
   return {
-    item_id: `mmc_field_${sha256({ token: member.right.token, side: "right" })}`,
+    item_id: `mmc_field_${digestCanonicalValue({ token: member.right.token, side: "right" }, "Managed comparison")}`,
     status: limitations.length === 0 ? "added" : "unknown",
     left: null,
     right: fieldIdentity(member.right),
@@ -448,11 +448,14 @@ export const buildMethodItems = (
       : observedDimensions;
     const observedChange = observedDimensions.length > 0;
     items.push({
-      item_id: `mmc_method_${sha256({
-        left: pair.left.item.token,
-        right: pair.right.item.token,
-        basis: pair.basis,
-      })}`,
+      item_id: `mmc_method_${digestCanonicalValue(
+        {
+          left: pair.left.item.token,
+          right: pair.right.item.token,
+          basis: pair.basis,
+        },
+        "Managed comparison",
+      )}`,
       status: observedChange
         ? "changed"
         : bodyUnknown || signatureLimitations.length > 0
@@ -481,11 +484,14 @@ export const buildMethodItems = (
   }
   for (const ambiguous of matches.ambiguous) {
     items.push({
-      item_id: `mmc_method_${sha256({
-        left: ambiguous.left.map(({ item }) => item.token),
-        right: ambiguous.right.map(({ item }) => item.token),
-        basis: ambiguous.basis,
-      })}`,
+      item_id: `mmc_method_${digestCanonicalValue(
+        {
+          left: ambiguous.left.map(({ item }) => item.token),
+          right: ambiguous.right.map(({ item }) => item.token),
+          basis: ambiguous.basis,
+        },
+        "Managed comparison",
+      )}`,
       status: "unknown",
       left: null,
       right: null,
@@ -551,10 +557,13 @@ export const buildFieldItems = (
         signatureIdentity(pair.right.item.signature) ||
       pair.left.item.flags !== pair.right.item.flags;
     items.push({
-      item_id: `mmc_field_${sha256({
-        left: pair.left.item.token,
-        right: pair.right.item.token,
-      })}`,
+      item_id: `mmc_field_${digestCanonicalValue(
+        {
+          left: pair.left.item.token,
+          right: pair.right.item.token,
+        },
+        "Managed comparison",
+      )}`,
       status: changed
         ? "changed"
         : signatureLimitations.length > 0
@@ -575,10 +584,13 @@ export const buildFieldItems = (
   }
   for (const ambiguous of matches.ambiguous)
     items.push({
-      item_id: `mmc_field_${sha256({
-        left: ambiguous.left.map(({ item }) => item.token),
-        right: ambiguous.right.map(({ item }) => item.token),
-      })}`,
+      item_id: `mmc_field_${digestCanonicalValue(
+        {
+          left: ambiguous.left.map(({ item }) => item.token),
+          right: ambiguous.right.map(({ item }) => item.token),
+        },
+        "Managed comparison",
+      )}`,
       status: "unknown",
       left: null,
       right: null,

src/domain/managed/managedMemberComparisonMatch.ts

@@ -1,7 +1,4 @@
-import { createHash } from "node:crypto";
-
-import canonicalize from "canonicalize";
-
+import { digestCanonicalValue } from "../canonicalDigest.js";
 import {
   managedMemberInspectionSchema,
   type ManagedMemberInspection,
@@ -15,15 +12,6 @@ import {
   comparableSides,
   signatureIdentity,
 } from "./managedMemberSignatureIdentity.js";
-import type { JsonValue } from "../jsonValue.js";
-
-export const sha256 = (value: JsonValue): string => {
-  const serialized = canonicalize(value);
-  if (serialized === undefined)
-    throw new TypeError("Managed comparison canonicalization failed");
-  return createHash("sha256").update(serialized).digest("hex");
-};
-
 type Method = ManagedMemberInspection["methods"][number];
 type Field = ManagedMemberInspection["fields"][number];
 
@@ -69,49 +57,58 @@ const keyMethod = (item: Method, declared: DeclaredNameOf): Keyed<Method> => ({
     item.body.status === "present" &&
     item.body.il_sha256 !== null &&
     item.body.normalized_il_sha256 !== null
-      ? sha256([
-          "method-exact",
-          signatureIdentity(item.signature),
-          item.body.il_sha256,
-          item.body.normalized_il_sha256,
-        ])
+      ? digestCanonicalValue(
+          [
+            "method-exact",
+            signatureIdentity(item.signature),
+            item.body.il_sha256,
+            item.body.normalized_il_sha256,
+          ],
+          "Managed comparison",
+        )
       : null,
   // The blob, with type operands named, is the exact signature; decoding
   // only gates the shape keys.
   signatureKey:
     declared(item) === null
       ? null
-      : sha256([
-          "method-signature",
-          declared(item),
-          item.name,
-          signatureIdentity(item.signature),
-        ]),
+      : digestCanonicalValue(
+          [
+            "method-signature",
+            declared(item),
+            item.name,
+            signatureIdentity(item.signature),
+          ],
+          "Managed comparison",
+        ),
   structuralKey:
     item.signature.parse_status === "decoded" && item.body.status === "present"
-      ? sha256([
-          "method-structural",
-          // Decoded type strings carry build-local rows; the identity names them.
-          signatureIdentity(item.signature),
-          item.body.status,
-          item.body.header_format,
-          item.body.il_size,
-          item.body.max_stack,
-          item.body.init_locals,
-          item.body.opcode_counts,
-          item.body.anchors.map(({ opcode, operand_kind, operand }) => [
-            opcode,
-            operand_kind,
-            operand_kind === "constant" ? operand : null,
-          ]),
-          item.body.exception_regions.map((region) => [
-            region.flags,
-            region.try_length,
-            region.handler_length,
-            region.class_token === null ? null : "type-token",
-            region.filter_offset === null ? null : "filter",
-          ]),
-        ])
+      ? digestCanonicalValue(
+          [
+            "method-structural",
+            // Decoded type strings carry build-local rows; the identity names them.
+            signatureIdentity(item.signature),
+            item.body.status,
+            item.body.header_format,
+            item.body.il_size,
+            item.body.max_stack,
+            item.body.init_locals,
+            item.body.opcode_counts,
+            item.body.anchors.map(({ opcode, operand_kind, operand }) => [
+              opcode,
+              operand_kind,
+              operand_kind === "constant" ? operand : null,
+            ]),
+            item.body.exception_regions.map((region) => [
+              region.flags,
+              region.try_length,
+              region.handler_length,
+              region.class_token === null ? null : "type-token",
+              region.filter_offset === null ? null : "filter",
+            ]),
+          ],
+          "Managed comparison",
+        )
       : null,
 });
 
@@ -122,25 +119,34 @@ const keyField = (item: Field, declared: DeclaredNameOf): Keyed<Field> => ({
   signatureId: signatureIdentity(item.signature),
   exactKey:
     item.signature.parse_status === "decoded"
-      ? sha256(["field-exact", signatureIdentity(item.signature)])
+      ? digestCanonicalValue(
+          ["field-exact", signatureIdentity(item.signature)],
+          "Managed comparison",
+        )
       : null,
   // Only an undecoded field reaches this round: a decoded field with the
   // same signature already met its counterpart in the exact round.
   signatureKey:
     declared(item) === null
       ? null
-      : sha256([
-          "field-signature",
-          declared(item),
-          item.name,
-          signatureIdentity(item.signature),
-        ]),
-  structuralKey: sha256([
-    "field-structural",
-    item.signature.kind,
-    item.signature.field_type,
-    item.flags,
-  ]),
+      : digestCanonicalValue(
+          [
+            "field-signature",
+            declared(item),
+            item.name,
+            signatureIdentity(item.signature),
+          ],
+          "Managed comparison",
+        ),
+  structuralKey: digestCanonicalValue(
+    [
+      "field-structural",
+      item.signature.kind,
+      item.signature.field_type,
+      item.flags,
+    ],
+    "Managed comparison",
+  ),
 });
 
 const matchMethods = (
@@ -237,7 +243,8 @@ export const identityOf = ({
 }: {
   readonly declaring_type: DeclaredName;
   readonly name: string;
-}): string => sha256([declaring_type, name]);
+}): string =>
+  digestCanonicalValue([declaring_type, name], "Managed comparison");
 
 /** Narrow a key to members of one declared type and name. */
 const declaredAs =
@@ -246,7 +253,7 @@ const declaredAs =
     const value = key(item);
     return value === null || item.identityUnavailable
       ? null
-      : sha256([item.identity, value]);
+      : digestCanonicalValue([item.identity, value], "Managed comparison");
   };
 
 const matchByKeys = <Item extends Declared>({

src/domain/managed/managedNativeVerification.ts

@@ -1,14 +1,10 @@
-import { createHash } from "node:crypto";
-
-import canonicalize from "canonicalize";
-
+import { digestCanonicalValue } from "../canonicalDigest.js";
 import type { Evidence } from "../evidence.js";
 import {
   managedNativeBoundaryInspectionSchema,
   type ManagedNativeBoundaryInspection,
 } from "./managedArtifact.js";
 import { parseManagedInspectionEvidence } from "./managedInspectionEvidence.js";
-import type { JsonValue } from "../jsonValue.js";
 import {
   managedNativeVerificationResultSchema,
   type ManagedNativeVerificationInput,
@@ -20,13 +16,6 @@ import {
   verifyPinvoke,
 } from "./managedNativeVerificationMatch.js";
 
-const sha256 = (value: JsonValue): string => {
-  const serialized = canonicalize(value);
-  if (serialized === undefined)
-    throw new TypeError("Managed/native verification canonicalization failed");
-  return createHash("sha256").update(serialized).digest("hex");
-};
-
 const parseManagedBoundary = (
   input: ManagedNativeVerificationInput,
 ): {
@@ -65,6 +54,9 @@ export const verifyManagedNativeBoundaries = (
   });
   return managedNativeVerificationResultSchema.parse({
     ...withoutId,
-    verification_id: `mnv_${sha256(withoutId)}`,
+    verification_id: `mnv_${digestCanonicalValue(
+      withoutId,
+      "Managed/native verification",
+    )}`,
   });
 };

src/domain/managed/managedNativeVerificationMatch.ts

@@ -1,13 +1,10 @@
-import { createHash } from "node:crypto";
 import { basename } from "node:path";
 
-import canonicalize from "canonicalize";
-
 import { parseEvidence } from "../evidence.js";
+import { digestCanonicalValue } from "../canonicalDigest.js";
 import { functionDossierSchema } from "../hopperValues.js";
 import { inspectMachoSchema } from "../native/nativeInspection.js";
 import type { ManagedNativeBoundaryInspection } from "./managedArtifact.js";
-import type { JsonValue } from "../jsonValue.js";
 import {
   pinvokeVerificationSchema,
   type ManagedNativeVerificationInput,
@@ -16,13 +13,6 @@ import {
   type PinvokeVerification,
 } from "./managedNativeVerificationSchemas.js";
 
-const digest = (value: JsonValue): string => {
-  const serialized = canonicalize(value);
-  if (serialized === undefined)
-    throw new TypeError("Managed/native verification canonicalization failed");
-  return createHash("sha256").update(serialized).digest("hex");
-};
-
 type PinvokeImport = ManagedNativeBoundaryInspection["pinvoke_imports"][number];
 type VerifiedPinvoke = {
   readonly verification: PinvokeVerification;
@@ -326,13 +316,16 @@ export const verifyPinvoke = ({
   const limitations = pinvokeLimitations(selection.match, item);
   return {
     verification: pinvokeVerificationSchema.parse({
-      item_id: `mnv_pinvoke_${digest({
-        managedEvidenceId,
-        token: item.token,
-        importName: item.import_name,
-        importScope: item.import_scope_name,
-        candidates: selection.match.candidates,
-      })}`,
+      item_id: `mnv_pinvoke_${digestCanonicalValue(
+        {
+          managedEvidenceId,
+          token: item.token,
+          importName: item.import_name,
+          importScope: item.import_scope_name,
+          candidates: selection.match.candidates,
+        },
+        "Managed/native verification",
+      )}`,
       managed,
       ...selection.match,
       evidence_links: [

src/domain/managed/managedNativeVerificationSchemas.ts

@@ -2,12 +2,14 @@ import { z } from "zod";
 
 import { emptyArraySchema } from "../emptyArraySchema.js";
 import { evidenceSchema } from "../evidence.js";
-import { cliMetadataGuidSchema } from "./managedArtifact.js";
+import {
+  cliMetadataGuidSchema,
+  managedNativeImportSchema,
+} from "./managedArtifact.js";
 import { digestSchema } from "../digests.js";
 import { prefixedDigestSchema } from "../digests.js";
 
 const evidenceIdSchema = prefixedDigestSchema("ev");
-const tokenSchema = z.string().regex(/^0x[0-9a-f]{8}$/u);
 const textSchema = z.string().min(1);
 
 const nativeSymbolSchema = z.strictObject({
@@ -22,27 +24,26 @@ const nativeSymbolSchema = z.strictObject({
 
 export type NativeSymbol = z.infer<typeof nativeSymbolSchema>;
 
+const verifiedManagedDeclarationSchema = managedNativeImportSchema
+  .pick({
+    token: true,
+    member_token: true,
+    member_name: true,
+    import_name: true,
+    import_scope_name: true,
+    no_mangle: true,
+    char_set: true,
+    call_convention: true,
+  })
+  .extend({
+    import_name: z.string().min(1),
+    declaration_verification: managedNativeImportSchema.shape.verification,
+  })
+  .strict();
+
 const pinvokeVerificationContextShape = {
   item_id: prefixedDigestSchema("mnv_pinvoke"),
-  managed: z.strictObject({
-    token: tokenSchema,
-    member_token: tokenSchema.nullable(),
-    member_name: z.string().nullable(),
-    import_name: z.string().min(1),
-    import_scope_name: z.string().nullable(),
-    no_mangle: z.boolean(),
-    char_set: z.enum(["not-specified", "ansi", "unicode", "auto", "unknown"]),
-    call_convention: z.enum([
-      "not-specified",
-      "winapi",
-      "cdecl",
-      "stdcall",
-      "thiscall",
-      "fastcall",
-      "unknown",
-    ]),
-    declaration_verification: z.literal("managed-declaration-only"),
-  }),
+  managed: verifiedManagedDeclarationSchema,
   evidence_links: z.array(evidenceIdSchema).min(1),
   limitations: z.array(textSchema),
 };

src/domain/managed/managedReconstruction.ts

@@ -1,20 +1,19 @@
 import { createHash } from "node:crypto";
 
-import canonicalize from "canonicalize";
 import { z } from "zod";
 
 import { evidenceSchema, type Evidence } from "../evidence.js";
 import {
   cliMetadataGuidSchema,
+  managedMetadataTokenSchema,
   managedMemberInspectionSchema,
   type ManagedMemberInspection,
 } from "./managedArtifact.js";
-import type { JsonValue } from "../jsonValue.js";
+import { digestCanonicalValue } from "../canonicalDigest.js";
 import { digestSchema, prefixedDigestSchema } from "../digests.js";
 import { parseManagedInspectionEvidence } from "./managedInspectionEvidence.js";
 
 const evidenceIdSchema = prefixedDigestSchema("ev");
-const tokenSchema = z.string().regex(/^0x[0-9a-f]{8}$/u);
 const textSchema = z.string().min(1);
 
 const decompilerSchema = z.strictObject({
@@ -26,7 +25,7 @@ const decompilerSchema = z.strictObject({
 });
 
 const managedReconstructionMethodInputSchema = z.strictObject({
-  token: tokenSchema,
+  token: managedMetadataTokenSchema,
   signature_sha256: digestSchema,
   normalized_il_sha256: digestSchema.nullable(),
   reconstruction: z.strictObject({
@@ -52,7 +51,7 @@ export const managedReconstructionImportInputSchema = z.strictObject({
 });
 
 const importedMethodSchema = z.strictObject({
-  token: tokenSchema,
+  token: managedMetadataTokenSchema,
   declaring_type: z.string().nullable(),
   name: z.string(),
   signature_sha256: digestSchema,
@@ -122,13 +121,6 @@ type StaticObservation =
 const sha256Text = (value: string): string =>
   createHash("sha256").update(value).digest("hex");
 
-const sha256Json = (value: JsonValue): string => {
-  const serialized = canonicalize(value);
-  if (serialized === undefined)
-    throw new TypeError("Managed reconstruction canonicalization failed");
-  return createHash("sha256").update(serialized).digest("hex");
-};
-
 const countLines = (text: string): number =>
   text.length === 0 ? 0 : text.split(/\r\n|\r|\n/u).length;
 
@@ -227,7 +219,10 @@ const buildDecompilerRecord = (
   decompiler: ManagedReconstructionImportInput["decompiler"],
 ): ManagedReconstructionImportResult["decompiler"] => ({
   ...decompiler,
-  options_sha256: sha256Json(decompiler.options),
+  options_sha256: digestCanonicalValue(
+    decompiler.options,
+    "Managed reconstruction",
+  ),
 });
 
 const RECONSTRUCTION_LIMITATIONS = [
@@ -282,6 +277,9 @@ export const importManagedReconstruction = (
   );
   return managedReconstructionImportResultSchema.parse({
     ...withoutId,
-    reconstruction_id: `mre_${sha256Json(withoutId)}`,
+    reconstruction_id: `mre_${digestCanonicalValue(
+      withoutId,
+      "Managed reconstruction",
+    )}`,
   });
 };

src/domain/mobileApplicationGraphProjection.ts

@@ -1,6 +1,3 @@
-import { createHash } from "node:crypto";
-
-import canonicalize from "canonicalize";
 import { z } from "zod";
 
 import {
@@ -141,11 +138,3 @@ export const projectedFileComponents = (
       ? [component]
       : [],
   );
-
-/** Digest a canonical JSON projection payload for its stable identifier. */
-export const projectionDigest = (value: unknown, label: string): string => {
-  const encoded = canonicalize(value);
-  if (encoded === undefined)
-    throw new TypeError(`${label} is not canonical JSON`);
-  return createHash("sha256").update(encoded).digest("hex");
-};

src/domain/reconstructionCoverage.ts

@@ -1,6 +1,3 @@
-import { createHash } from "node:crypto";
-
-import canonicalize from "canonicalize";
 import { z } from "zod";
 
 import {
@@ -23,6 +20,7 @@ import {
 } from "./reconstructionCoverageEvaluation.js";
 import { digestSchema } from "./../domain/digests.js";
 import { prefixedDigestSchema } from "./../domain/digests.js";
+import { digestCanonicalValue } from "./canonicalDigest.js";
 import {
   offsetDateTimeInstantFromEpochMilliseconds,
   offsetDateTimeSchema,
@@ -289,7 +287,7 @@ export const createReconstructionVerifierContract = (
   const parsed = verifierContractBaseSchema.parse(input);
   return verifierContractSchema.parse({
     ...parsed,
-    contract_sha256: digest(parsed),
+    contract_sha256: digestCanonicalValue(parsed, "Reconstruction coverage"),
   });
 };
 
@@ -354,7 +352,13 @@ const validateCoverageReferences = (
   indexUnique(workspace.boundaries, "boundary_id");
   for (const contract of workspace.verifier_contracts) {
     const { contract_sha256: contractSha256, ...base } = contract;
-    if (contractSha256 !== digest(verifierContractBaseSchema.parse(base)))
+    if (
+      contractSha256 !==
+      digestCanonicalValue(
+        verifierContractBaseSchema.parse(base),
+        "Reconstruction coverage",
+      )
+    )
       throw new TypeError(
         `Verifier contract digest is invalid: ${contract.verifier_id}`,
       );
@@ -462,10 +466,3 @@ const reasonOrder = (left: ClosureReason, right: ClosureReason): number =>
     compositeKey([left.code, left.subject_id]),
     compositeKey([right.code, right.subject_id]),
   );
-
-const digest = (value: unknown): string => {
-  const encoded = canonicalize(value);
-  if (encoded === undefined)
-    throw new TypeError("Reconstruction coverage value is not canonical JSON");
-  return createHash("sha256").update(encoded).digest("hex");
-};

src/domain/reconstructionVerification.ts

@@ -1,6 +1,3 @@
-import { createHash } from "node:crypto";
-
-import canonicalize from "canonicalize";
 import { z } from "zod";
 
 import { artifactComparisonResultSchema } from "./artifactComparison.js";
@@ -19,6 +16,7 @@ import { functionDossierSchema } from "./hopperValues.js";
 import { assessFunctionCallCoverage } from "./functionCallCoverage.js";
 import { processCaptureComparisonSchema } from "./process/processComparison.js";
 import { parseProcessCapture } from "./process/processCaptureParsing.js";
+import { digestCanonicalValue } from "./canonicalDigest.js";
 import {
   reconstructionClaimResultSchema,
   reconstructionSpecificationSchema,
@@ -72,12 +70,15 @@ export const verifyReconstruction = (
   );
   const output = {
     status: failed > 0 ? "fail" : unresolved > 0 ? "unknown" : "pass",
-    specification_sha256: digest({
-      ...specification,
-      claims: [...specification.claims].sort((left, right) =>
-        compareUnicodeCodePoints(left.claim_id, right.claim_id),
-      ),
-    }),
+    specification_sha256: digestCanonicalValue(
+      {
+        ...specification,
+        claims: [...specification.claims].sort((left, right) =>
+          compareUnicodeCodePoints(left.claim_id, right.claim_id),
+        ),
+      },
+      "Reconstruction specification",
+    ),
     summary: {
       total: results.length,
       passed: count(results, "pass"),
@@ -377,13 +378,6 @@ const classify = (
   return "pass";
 };
 
-const digest = (value: unknown): string => {
-  const encoded = canonicalize(value);
-  if (encoded === undefined)
-    throw new TypeError("Specification canonicalization failed");
-  return createHash("sha256").update(encoded).digest("hex");
-};
-
 const count = (
   items: readonly ClaimResult[],
   status: ClaimResult["status"],

src/domain/residualUnknown.ts

@@ -1,7 +1,5 @@
-import { createHash } from "node:crypto";
-
-import canonicalize from "canonicalize";
 import { z } from "zod";
+import { digestCanonicalValue } from "./canonicalDigest.js";
 import {
   compareUnicodeCodePoints,
   compositeKey,
@@ -26,18 +24,17 @@ const stableUnknownId = (
   scopeDigest: string | null,
   comparisonConclusionScope?: z.infer<typeof comparisonConclusionScopeSchema>,
 ): string =>
-  `unk_${createHash("sha256")
-    .update(
-      canonicalJson({
-        domain: domain.trim(),
-        question: question.replace(/\s+/gu, " ").trim(),
-        scope_digest: scopeDigest,
-        ...(comparisonConclusionScope === undefined
-          ? {}
-          : { comparison_conclusion_scope: comparisonConclusionScope }),
-      }),
-    )
-    .digest("hex")}`;
+  `unk_${digestCanonicalValue(
+    {
+      domain: domain.trim(),
+      question: question.replace(/\s+/gu, " ").trim(),
+      scope_digest: scopeDigest,
+      ...(comparisonConclusionScope === undefined
+        ? {}
+        : { comparison_conclusion_scope: comparisonConclusionScope }),
+    },
+    "Unknown identity",
+  )}`;
 
 const probeSchema = z.strictObject({
   operation: z.string().min(1),
@@ -385,13 +382,7 @@ const computeRevisionDigest = (
   const { revision_digest: _revisionDigest, ...semantic } =
     "revision_digest" in value ? value : { ...value, revision_digest: "" };
   void _revisionDigest;
-  return createHash("sha256").update(canonicalJson(semantic)).digest("hex");
-};
-
-const canonicalJson = (value: unknown): string => {
-  const serialized = canonicalize(value);
-  if (serialized === undefined) throw new TypeError("Unknown identity failed");
-  return serialized;
+  return digestCanonicalValue(semantic, "Unknown identity");
 };
 
 const sortedUnique = (values: readonly string[]): string[] =>

src/domain/staticRuntimeCorrelation.ts

@@ -1,6 +1,4 @@
-import { createHash } from "node:crypto";
-
-import canonicalize from "canonicalize";
+import { digestCanonicalValue } from "./canonicalDigest.js";
 import { z } from "zod";
 
 import { artifactComparisonResultSchema } from "./artifactComparison.js";
@@ -238,7 +236,7 @@ const correlate = (
     hypothesis: mapping.hypothesis,
   } satisfies JsonValue;
   return correlationItemSchema.parse({
-    correlation_id: `cor_${sha256(canonicalJson(projection))}`,
+    correlation_id: `cor_${digestCanonicalValue(projection, "Static/runtime correlation")}`,
     static: { ...mapping.static, ...selectedStatic },
     runtime: { ...mapping.runtime, status: runtimeStatus },
     side_alignment: mapping.side_alignment,
@@ -411,15 +409,3 @@ const assertUnique = (evidence: readonly Evidence[], label: string): void => {
       `Static/runtime correlation rejects duplicate ${label}`,
     );
 };
-
-const sha256 = (value: string): string =>
-  createHash("sha256").update(value).digest("hex");
-
-const canonicalJson = (value: JsonValue): string => {
-  const serialized = canonicalize(value);
-  if (serialized === undefined)
-    throw new TypeError(
-      "RFC 8785 canonicalization rejected correlation mapping",
-    );
-  return serialized;
-};

src/domain/webBundleAnalysis.ts

@@ -9,7 +9,10 @@ import {
 } from "./browserDeadline.js";
 import { emptyArraySchema } from "./emptyArraySchema.js";
 import { inspectWebPageWithSourceInputSchema } from "./browserObservation.js";
-import { webTextArtifactSchema } from "./webContentArtifact.js";
+import {
+  webTextArtifactMetadataSchema,
+  webTextArtifactSchema,
+} from "./webContentArtifact.js";
 
 /** Isolated analyzer heap used when max_heap_mb is omitted. */
 export const DEFAULT_WEB_BUNDLE_HEAP_MB = 1024;
@@ -298,11 +301,7 @@ const sourceMapSchema = z.union([
   }),
 ]);
 
-const webTextArtifactSummarySchema = z.object({
-  sha256: z.string().regex(/^[a-f0-9]{64}$/u),
-  bytes: z.number().int().min(0),
-  media_type: z.string().min(1),
-  charset: z.literal("utf-8"),
+const webTextArtifactSummarySchema = webTextArtifactMetadataSchema.extend({
   text_available: z.literal(true),
 });
 

src/domain/webBundleAnalyzer.test.ts

@@ -8,7 +8,7 @@ import {
 } from "./webBundleAnalyzer.js";
 import { buildCapturedWebBundleAnalysis } from "./webBundleAnalyzerResult.js";
 import { webBundleAnalysisSchema } from "./webBundleAnalysis.js";
-import { isIncludedScript } from "./webBundleAnalyzerInspection.js";
+import { isIncludedScript } from "./webBundleAnalyzerState.js";
 import { webBundleScriptAnalysisSchema } from "./webBundleScriptAnalysis.js";
 import { createWebTextArtifact } from "./webContentArtifact.js";
 

src/domain/webBundleAnalyzer.ts

@@ -1,10 +1,10 @@
 import type { WebPageInspection } from "./browserObservationSchemas.js";
+import { analyzeScript } from "./webBundleAnalyzerInspection.js";
 import {
-  analyzeScript,
-  emptyAccumulator,
+  createWebBundleAnalysisAccumulator,
   isIncludedScript,
   type IncludedScript,
-} from "./webBundleAnalyzerInspection.js";
+} from "./webBundleAnalyzerState.js";
 import { buildCapturedWebBundleAnalysis } from "./webBundleAnalyzerResult.js";
 import type { WebBundleAnalysis } from "./webBundleAnalysis.js";
 import {
@@ -16,7 +16,7 @@ import {
 export const analyzeCapturedWebScript = (
   script: IncludedScript,
 ): WebBundleScriptAnalysis => {
-  const accumulator = emptyAccumulator();
+  const accumulator = createWebBundleAnalysisAccumulator();
   analyzeScript(script, accumulator);
   const failed = accumulator.failedScripts.length > 0;
   const recovered = accumulator.recoveredScripts.length > 0;

src/domain/webBundleAnalyzerInspection.ts

@@ -1,8 +1,11 @@
+import type {
+  AnalysisAccumulator,
+  IncludedScript,
+} from "./webBundleAnalyzerState.js";
 import * as t from "@babel/types";
 
 import { sanitizeEndpointCandidate } from "./browserObservation.js";
 import { compositeKey } from "./unicodeCodePointOrder.js";
-import type { WebPageInspection } from "./browserObservationSchemas.js";
 import type { WebBundleAnalysis } from "./webBundleAnalysis.js";
 import { traverseJavaScriptAst } from "./javascript/javascriptSemanticTraversal.js";
 import { indexJavaScriptBindingsWithReceiversSteps } from "./javascript/javascriptSemanticAnalysis.js";
@@ -37,26 +40,6 @@ type ChunkEdge = BundleObservations["chunks"]["edges"][number];
 type Finding = BundleObservations["routes"][number];
 type WebMcpDeclaration = BundleObservations["webmcp_declarations"][number];
 type Inference = WebBundleAnalysis["inferences"][number];
-type BrowserScript = WebPageInspection["scripts"]["items"][number];
-type IncludedSource = Extract<BrowserScript["source"], { included: true }>;
-export type IncludedScript = Omit<BrowserScript, "source"> & {
-  readonly source: IncludedSource;
-};
-
-export interface AnalysisAccumulator {
-  readonly edges: ChunkEdge[];
-  readonly routes: Finding[];
-  readonly endpoints: Finding[];
-  readonly webMcp: WebMcpDeclaration[];
-  readonly inferences: Inference[];
-  readonly seen: Set<string>;
-  visitedNodes: number;
-  parsedScripts: number;
-  readonly failedScripts: string[];
-  readonly recoveredScripts: string[];
-  readonly widenedScripts: string[];
-}
-
 export const analyzeScript = (
   script: IncludedScript,
   accumulator: AnalysisAccumulator,
@@ -501,24 +484,6 @@ const basis = (script: IncludedScript, detector: string) => ({
   detector,
 });
 
-export const emptyAccumulator = (): AnalysisAccumulator => ({
-  edges: [],
-  routes: [],
-  endpoints: [],
-  webMcp: [],
-  inferences: [],
-  seen: new Set(),
-  visitedNodes: 0,
-  parsedScripts: 0,
-  failedScripts: [],
-  recoveredScripts: [],
-  widenedScripts: [],
-});
-
-export const isIncludedScript = (
-  script: BrowserScript,
-): script is IncludedScript => script.source.included;
-
 const routeCallNames = [
   "route",
   "addRoute",