fix(hopper): retain launcher exits observed before startup interruption

Record whether the current owned launcher exit was known when the startup deadline aborted. Reuse the existing launcher failure projection for exit-first ordering while preserving the exact caller cancellation reason when cancellation occurs first. Validation: root focused run passed 38/40 tests including both new real-child ordering controls; two existing cleanup tests timed out and then passed unchanged in a targeted 13/13 rerun. Full check:ci passed. This uses inert Node children, not real Hopper. Keep this audit-branch candidate out of main pending required real-engine qualification. Refs #5429
fix(hopper): retain caller cancellation causes across provider boundaries
2026-10-21 11:34:42 +08:00 · 2026-10-21 07:48:55 +08:00 · 2026-10-21 07:48:55 +08:00 · 2026-10-21 07:37:36 +08:00 · 2026-10-21 07:37:15 +08:00 · 2026-10-21 07:26:20 +08:00
626 changed files with 46495 additions and 4588 deletions
@@ -2,7 +2,7 @@
 name: reverse-engineer-anything
 description: Reverse engineer native, managed, Electron/JavaScript, packaged, firmware, and browser targets with REA. Use shipped-artifact or requested runtime evidence to explain features, compare versions, decompile code, or guide a reconstruction. Skip REA for ordinary source-repository architecture analysis.
 metadata:
-  version: "43"
+  version: "44"
 ---

 # REA
@@ -30,6 +30,8 @@ unavailable, read [connection and recovery](references/connection-and-recovery.m
 Diagnose the observed blocker, continue useful supported work, and resume the
 original task after repair. Client approval, shell PATH, registration and engine
 availability have different remedies; avoid repeating setup for all of them.
+If the host times out without a REA result, do not repeat the unchanged call or
+assume work stopped. Read the recovery guide's deadline distinction before retrying.

 1. Diagnose without changing REA or client configuration. `npx` may download
   the package and write to npm's cache. For Codex, run
@@ -92,6 +94,10 @@ explicit path or endpoint and do not need it.
 - Archive/package member inventory (ZIP/APK/IPA/MSIX/AppX or DMG):
  `open_binary` with the supplied local path; use `inspect_artifact` when its
  graph and findings help answer the question.
+- Apple app plist, Interface Builder, asset catalog, or keyed archive resources:
+  `open_bundle_resources`, then the selected resource tool. This does not
+  require `CFBundleExecutable` or a deep provider. Resource sessions have no
+  executable digest or binary snapshot; use `open_binary` for native code.
 - Android APK code, classes, methods, or incoming references:
  `inspect_android_package`, then focused Android tools when advertised.
  Archive member inventory still uses the archive route above.
@@ -169,6 +175,15 @@ explicit path or endpoint and do not need it.
  absent metadata does not prove a binary is not Go, and unparsed text records
  remain explicit. See the
  [Go binary guide](https://github.com/morluto/rea/blob/main/docs/go-binaries.md).
+- Bundled GGUF or safetensors model declarations: `inspect_model_artifact`
+  with the explicit local file. Default header hashing leaves full-file identity
+  unknown; `hash: "full"` additionally reads all weights for SHA-256. MCP returns
+  retained summaries; optional `view` selects one page in the initial call. Use
+  `inspect_analysis_view` kind `model-artifact` for
+  batched metadata keys, tensor names or type totals, selected fields and pages.
+  Preserve header-scoped indices and array preview omissions; do not infer model
+  behavior from declared architecture or tensor types. See the
+  [model file guide](https://github.com/morluto/rea/blob/main/docs/model-artifacts.md).
 - Unity IL2CPP names, member owners and string literals from `global-metadata.dat`:
  `inspect_il2cpp_metadata` with the explicit local file; MCP defaults to compact
  counts. Query sections, images, types, methods, fields, properties, events,
@@ -34,6 +34,47 @@ answers part of the question, and name the unavailable evidence separately.
 Do not substitute another target. Label observations from ordinary shell tools
 as such; only actual REA output supplies REA Evidence.

+## Distinguish client and server deadlines
+
+A host message such as `timed out awaiting tools/call` with no REA result means
+the client's deadline expired before a result arrived. It does not establish
+that REA finished, canceled successfully, or released all resources. Do not
+repeat the unchanged analysis. Inspect available session/provider state and
+retained Evidence only when useful; an idle `binary_session` is not proof that
+every target-free operation stopped. Never invent a missing Evidence reference.
+
+Allow the host tool deadline to cover execution, cancellation/cleanup, and
+response delivery. In Codex, the setting is
+`mcp_servers.<server-id>.tool_timeout_sec` in **seconds**, not
+`startup_timeout_sec`. Select a value for the actual operation budget and
+headroom, not a universal timeout. See the
+[official MCP configuration reference](https://learn.chatgpt.com/docs/extend/mcp?surface=cli).
+Apply configuration changes only within the authorized scope, preserving
+unrelated entries and backups; reconnect/restart as required by the host.
+When configuration is not editable, report the setting needed or use an
+authorized CLI fallback. Do not silently broaden permissions or switch targets.
+
+A returned REA `provider_timeout` instead means the **server/provider** reached
+its deadline. Follow its `remediation.action`, reuse accessible partial Evidence,
+and resolve reported incomplete cleanup before retrying. Raising only the
+client deadline does not change this server budget. For static JavaScript,
+`analysis_timeout_ms` (CLI `rea analyze-javascript-application <path>
+--analysis-timeout-ms <milliseconds>`) controls each source's
+startup, analysis and transfer deadline in **milliseconds**. Increase that
+budget or reduce semantic work / select exact inventoried `source_paths` when
+the task permits. Omit `source_paths` for all sources; `[]` is invalid.
+`detail: "summary"` reduces delivery, not analysis work. A per-source budget
+does not bound the elapsed time for an entire multi-source application.
+Partial-Evidence inspection can avoid recomputation; an unavailable reader is
+not itself a reason to block a corrected static-analysis retry.
+The shorthand `rea analyze <path>` does not expose this timeout flag; use the
+explicit JavaScript command when changing that budget.
+
+For invalid arguments, use the connected tool's current input schema, or the
+installed CLI's command help. Refresh the catalog if stale; do not guess fields
+from an older skill or return the entire catalog to repair one field. Correct
+all reported fields before retrying.
+
 ## Repair registration when needed

 For Codex:
@@ -18,7 +18,8 @@ only selected files. The result and summary record `source_selection`; files
 outside scope and their relationships remain unknown, so partial application
 coverage does not mean the selected source failed. Use repeated `--source-path`
 on either static application CLI route. Omit the selection when the question
-requires complete application analysis. `detail: "summary"` reduces delivery
+requires complete application analysis; `source_paths: []` is invalid, not an
+unfiltered request. `detail: "summary"` reduces delivery
 and does not by itself reduce analysis work.

 Exact `#alias` specifiers resolve through the importer's
@@ -35,7 +36,9 @@ the complete application Evidence inline when it fits.
 When the connected schema advertises `max_heap_mb` and `analysis_timeout_ms`,
 these select the isolated source analyzer's old-space heap and per-source
 deadline. Defaults are 1024 MiB and 300000 ms. They do not change the MCP
-process heap. A Bun-hosted REA does not enforce the heap choice; on Windows it
+process heap or the client's tool deadline. For a host timeout without REA
+output, use the [deadline recovery guide](connection-and-recovery.md#distinguish-client-and-server-deadlines)
+instead of raising the server budget. A Bun-hosted REA does not enforce the heap choice; on Windows it
 instead limits the analyzer's committed memory to that choice plus a 512 MiB
 runtime reserve.
 Resource-limited analyses preserve completed static facts and
@@ -11,6 +11,22 @@ Select columns, batch IDs and page individual facts; aliases remain unresolved.
 Unpaired observations do not prove additions/removals. Existing matched dossier
 pairs include inputs for `compare_functions`; otherwise analyze just chosen pairs.

+## Apple app resources
+
+Use `open_bundle_resources` with the selected app path, then `inspect_plist`,
+`decode_interface_builder`, `inspect_asset_catalog`, or `inspect_keyed_archive`.
+The resource session reads the app without resolving `CFBundleExecutable` or
+starting a deep provider. Preserve `resource_root` provenance, per-resource
+hashes where reported, and null executable identity; a directory path is not
+an executable digest. Export retained Evidence before closing or switching
+roots. Binary analysis snapshots do not apply. Use `open_binary` to switch to
+executable analysis, and `close_binary` to release either session kind.
+
+The four matching CLI commands accept the app path directly. For an archive
+inside the app, use `inspect-keyed-archive APP_PATH RELATIVE_ARCHIVE_PATH`.
+Host requirements for plist and compiled asset/Interface Builder tooling still
+apply; a resource-only session does not establish provider availability.
+
 ## Desktop installation directories

 When an installation directory is supplied and its runtime is unknown, use
@@ -38,6 +54,16 @@ unparsed module-text line. A missing record is an unknown, not proof of a
 non-Go binary; observed metadata does not authenticate its claims. Function,
 source and type recovery remain a separate native-analysis question.

+## Model files
+
+Use `inspect_model_artifact` (`inspect-model-artifact PATH`) for local GGUF v2/v3
+and safetensors declarations without a model runtime. Header-only mode does not
+read weights or establish full-file identity. `hash: "full"` explicitly streams
+all bytes. Retained `model-artifact` views page `metadata`, `tensors` and derived
+`types`, with exact batch filters and selected fields. Arrays retain typed counts
+and eight-element previews; omitted values, unknown types and runtime behavior
+stay explicit. See [model files](https://github.com/morluto/rea/blob/main/docs/model-artifacts.md).
+
 ## IL2CPP metadata

 Use `inspect_il2cpp_metadata` for an explicit local Unity `global-metadata.dat`
@@ -1,5 +1,10 @@
 name: Cache npm package downloads
-description: Restore npm's download cache and save it only from trusted default-branch events.
+description: Restore npm's download cache. Trusted default-branch jobs that opt in may save it.
+inputs:
+  save:
+    description: Save the shared download cache when this event is allowed to write it.
+    required: false
+    default: "false"
 outputs:
  can-save:
    description: Whether this run may update the shared npm download cache.
@@ -23,20 +28,25 @@ runs:
          can_save=true
        fi
        cache_key="npm-download-${RUNNER_OS}-${runtime_arch}-${LOCKFILES_HASH}"
+        # Same platform only. A lockfile change can reuse tarballs from the previous key.
+        restore_key="npm-download-${RUNNER_OS}-${runtime_arch}-"
        {
          printf 'can-save=%s\n' "${can_save}"
          printf 'path=%s\n' "${cache_path}"
          printf 'key=%s\n' "${cache_key}"
+          printf 'restore-key=%s\n' "${restore_key}"
        } >> "${GITHUB_OUTPUT}"
    - name: Restore and save npm package downloads
-      if: steps.context.outputs.can-save == 'true'
+      if: steps.context.outputs.can-save == 'true' && inputs.save == 'true'
      uses: actions/cache@0057852bfaa89a56745cba8c7296529d2fc39830 # v4.3.0
      with:
        path: ${{ steps.context.outputs.path }}
        key: ${{ steps.context.outputs.key }}
+        restore-keys: ${{ steps.context.outputs.restore-key }}
    - name: Restore npm package downloads without saving
-      if: steps.context.outputs.can-save != 'true'
+      if: steps.context.outputs.can-save != 'true' || inputs.save != 'true'
      uses: actions/cache/restore@0057852bfaa89a56745cba8c7296529d2fc39830 # v4.3.0
      with:
        path: ${{ steps.context.outputs.path }}
        key: ${{ steps.context.outputs.key }}
+        restore-keys: ${{ steps.context.outputs.restore-key }}
@@ -0,0 +1,64 @@
+name: Cache retention
+
+on:
+  workflow_run:
+    workflows: ["CI"]
+    types: [completed]
+
+# Qualification calls ci.yml with actions: read. A nested workflow cannot raise
+# that token, so cache deletion stays in this workflow.
+permissions:
+  contents: read
+  actions: write
+
+concurrency:
+  group: cache-retention-${{ github.event.workflow_run.head_sha }}
+  cancel-in-progress: false
+
+jobs:
+  retain:
+    name: Retain Turbo snapshots and npm download caches
+    # Restrict the triggering-source checkout to same-repository default-branch
+    # CI events. The helper runs from this trusted workflow revision; triggering
+    # source is used only for cache identity and is never executed. Static and
+    # build save snapshots before later lanes finish, so failed, timed-out, or
+    # cancelled runs still retain those snapshots.
+    if: >-
+      (github.event.workflow_run.conclusion == 'success' ||
+      github.event.workflow_run.conclusion == 'failure' ||
+      github.event.workflow_run.conclusion == 'timed_out' ||
+      github.event.workflow_run.conclusion == 'cancelled') &&
+      github.event.workflow_run.head_repository.full_name == github.repository &&
+      github.event.workflow_run.head_branch == github.event.repository.default_branch &&
+      (github.event.workflow_run.event == 'push' ||
+      github.event.workflow_run.event == 'schedule' ||
+      github.event.workflow_run.event == 'workflow_dispatch')
+    runs-on: ubuntu-latest
+    timeout-minutes: 10
+    steps:
+      - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0
+        with:
+          ref: ${{ github.workflow_sha }}
+          path: trusted-retention
+          persist-credentials: false
+      - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0
+        with:
+          ref: ${{ github.event.workflow_run.head_sha }}
+          path: triggering-source
+          persist-credentials: false
+      - uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4.4.0
+        with:
+          node-version-file: trusted-retention/.nvmrc
+      - name: Retain current Turbo snapshots and npm download caches
+        env:
+          GH_TOKEN: ${{ github.token }}
+          CI_REPOSITORY: ${{ github.repository }}
+          CACHE_PREFIX: rea-static-v1-${{ runner.os }}-${{ runner.arch }}-
+          CACHE_KEEP_KEY: rea-static-v1-${{ runner.os }}-${{ runner.arch }}-${{ hashFiles('triggering-source/.nvmrc', 'triggering-source/.npmrc', 'triggering-source/package-lock.json') }}-${{ github.event.workflow_run.head_sha }}
+          CACHE_DEEP_PREFIX: rea-static-deep-v1-${{ runner.os }}-${{ runner.arch }}-
+          CACHE_DEEP_KEEP_KEY: rea-static-deep-v1-${{ runner.os }}-${{ runner.arch }}-${{ hashFiles('triggering-source/.nvmrc', 'triggering-source/.npmrc', 'triggering-source/package-lock.json') }}-${{ github.event.workflow_run.head_sha }}
+          CACHE_KNIP_PREFIX: knip-meta-v1-${{ runner.os }}-
+          CACHE_KNIP_KEEP_KEY: knip-meta-v1-${{ runner.os }}-${{ hashFiles('triggering-source/knip.json', 'triggering-source/tsconfig.json', 'triggering-source/package.json', 'triggering-source/package-lock.json') }}-${{ github.event.workflow_run.head_sha }}
+          CACHE_PORTABLE_PREFIX: rea-portable-build-v2-${{ runner.os }}-${{ runner.arch }}-
+          DEDUPE_NPM_DOWNLOADS: "true"
+        run: node trusted-retention/scripts/ci/cache-retention.mjs
@@ -15,6 +15,15 @@ on:
        description: Exact qualification source; must match the caller revision.
        required: true
        type: string
+      remote_cache_write:
+        description: Trusted release qualification may publish the remote cache.
+        required: false
+        type: boolean
+        default: false
+    secrets:
+      TURBO_TOKEN:
+        description: Remote cache token. Only trusted release qualification passes it.
+        required: false

 permissions:
  contents: read
@@ -29,6 +38,15 @@ concurrency:

 env:
  HUSKY: "0"
+  # Set Actions secret TURBO_TOKEN and variable TURBO_TEAM. OIDC can mint
+  # TURBO_TOKEN via vercel/setup-turborepo-remote-cache-action; do not commit a token.
+  # A called workflow sees the caller event, so workflow_call is not an event
+  # name here. Release qualification sets remote_cache_write and passes the
+  # token. Open pull requests get an empty token and the local cache only.
+  # Remote reads need a credential, and pull requests do not receive one.
+  TURBO_TOKEN: "${{ (inputs.remote_cache_write == true || (github.ref == format('refs/heads/{0}', github.event.repository.default_branch) && (github.event_name == 'push' || github.event_name == 'schedule' || github.event_name == 'workflow_dispatch'))) && secrets.TURBO_TOKEN || '' }}"
+  TURBO_TEAM: ${{ vars.TURBO_TEAM }}
+  TURBO_CACHE: "${{ (inputs.remote_cache_write == true || (github.ref == format('refs/heads/{0}', github.event.repository.default_branch) && (github.event_name == 'push' || github.event_name == 'schedule' || github.event_name == 'workflow_dispatch'))) && 'local:rw,remote:rw' || 'local:rw' }}"

 jobs:
  changes:
@@ -128,6 +146,9 @@ jobs:
      - name: Cache npm package downloads
        id: npm-cache
        uses: ./.github/actions/npm-cache
+        with:
+          # Linux x64 writer. Parallel Linux jobs restore this key.
+          save: "true"
      - run: npm ci
      - name: Restore static task cache
        if: needs.changes.outputs.code == 'true'
@@ -151,14 +172,10 @@ jobs:
        if: needs.changes.outputs.code == 'true'
        env:
          CI_PR_HEAD_SHA: ${{ github.event.pull_request.head.sha }}
+          CI_STATIC_CONTEXT_SCRIPT: check:ci:fast:tasks
        run: npm run ci:static-context
      - if: needs.changes.outputs.code == 'true'
-        run: npm run check:ci
-      - if: needs.changes.outputs.code == 'true'
-        run: npm run verify:test-discovery
-      - name: Check LLDB producer retention and launch contracts
-        if: needs.changes.outputs.code == 'true'
-        run: npm run test:python
+        run: npm run check:ci:fast
      - if: needs.changes.outputs.code != 'true'
        run: npm run format:check
      - name: Save validated static task cache
@@ -180,6 +197,72 @@ jobs:
          if-no-files-found: ignore
          retention-days: 7

+  static-deep:
+    name: Deep static checks
+    needs: changes
+    # Full qualification only. Provider lanes wait on fast static, not this job.
+    if: needs.changes.outputs.tier == 'full' && needs.changes.outputs.code == 'true'
+    runs-on: ubuntu-latest
+    timeout-minutes: 15
+    steps:
+      - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0
+      - uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4.4.0
+        with:
+          node-version-file: .nvmrc
+      - name: Cache npm package downloads
+        id: npm-cache
+        uses: ./.github/actions/npm-cache
+      - run: npm ci
+      - name: Restore deep static task cache
+        id: static-cache
+        uses: actions/cache/restore@0057852bfaa89a56745cba8c7296529d2fc39830 # v4.3.0
+        with:
+          path: .turbo/cache/
+          key: rea-static-deep-v1-${{ runner.os }}-${{ runner.arch }}-${{ hashFiles('.nvmrc', '.npmrc', 'package-lock.json') }}-${{ github.sha }}
+          restore-keys: rea-static-deep-v1-${{ runner.os }}-${{ runner.arch }}-${{ hashFiles('.nvmrc', '.npmrc', 'package-lock.json') }}-
+      - name: Restore Knip analysis cache
+        id: knip-cache
+        uses: actions/cache/restore@0057852bfaa89a56745cba8c7296529d2fc39830 # v4.3.0
+        with:
+          path: node_modules/.cache/knip
+          # Each trusted commit publishes a new entry. Restore still matches the
+          # configuration prefix from the previous successful full run.
+          key: knip-meta-v1-${{ runner.os }}-${{ hashFiles('knip.json', 'tsconfig.json', 'package.json', 'package-lock.json') }}-${{ github.sha }}
+          restore-keys: knip-meta-v1-${{ runner.os }}-${{ hashFiles('knip.json', 'tsconfig.json', 'package.json', 'package-lock.json') }}-
+      - name: Record deep static task source and execution identity
+        continue-on-error: true
+        env:
+          CI_PR_HEAD_SHA: ${{ github.event.pull_request.head.sha }}
+          CI_STATIC_CONTEXT_SCRIPT: check:ci:deep:tasks
+        run: npm run ci:static-context
+      - name: Run deep static checks
+        run: npm run check:ci:deep
+      - name: Save validated deep static task cache
+        if: >-
+          success() && steps.npm-cache.outputs.can-save == 'true' &&
+          steps.static-cache.outputs.cache-hit != 'true'
+        uses: actions/cache/save@0057852bfaa89a56745cba8c7296529d2fc39830 # v4.3.0
+        with:
+          path: .turbo/cache/
+          key: ${{ steps.static-cache.outputs.cache-primary-key }}
+      - name: Save Knip analysis cache
+        if: >-
+          success() && steps.npm-cache.outputs.can-save == 'true' &&
+          steps.knip-cache.outputs.cache-hit != 'true'
+        uses: actions/cache/save@0057852bfaa89a56745cba8c7296529d2fc39830 # v4.3.0
+        with:
+          path: node_modules/.cache/knip
+          key: ${{ steps.knip-cache.outputs.cache-primary-key }}
+      - name: Upload complete deep static diagnostics
+        if: always()
+        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
+        with:
+          name: static-deep-check-reports
+          path: .cache/static-checks/
+          include-hidden-files: true
+          if-no-files-found: ignore
+          retention-days: 7
+
  test-source:
    name: Source tests
    needs: changes
@@ -219,9 +302,11 @@ jobs:
      # every shard's diagnostics and coverage. Passing PRs run the full suite.
      fail-fast: ${{ github.event_name == 'pull_request' && needs.changes.outputs.tier == 'fast' }}
      matrix:
-        # Fast feedback spends the same six test jobs on one source group and
-        # five built groups; full qualification retains six complete shards.
-        shard: ${{ fromJSON(needs.changes.outputs.tier == 'fast' && '["1/5","2/5","3/5","4/5","5/5"]' || '["1/6","2/6","3/6","4/6","5/6","6/6"]') }}
+        # Fast feedback uses one source group and eight built groups so the
+        # slowest built shard job stays inside a ten-minute execution budget.
+        # Classification, build, and report merge sit outside that job.
+        # Full qualification retains six complete shards with coverage.
+        shard: ${{ fromJSON(needs.changes.outputs.tier == 'fast' && '["1/8","2/8","3/8","4/8","5/8","6/8","7/8","8/8"]' || '["1/6","2/6","3/6","4/6","5/6","6/6"]') }}
    steps:
      - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0
      - uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4.4.0
@@ -373,8 +458,9 @@ jobs:
          retention-days: 7

  sqlite-runtime:
-    # Preserve all selected coverage, but admit expensive host/provider work
-    # only after static validation. Portable tests still provide early feedback.
+    # Admit expensive host/provider work after fast static validation
+    # (typecheck, lint, format). Deep static does not gate these lanes.
+    # Portable tests still provide early feedback.
    needs: [changes, static, build]
    if: needs.changes.outputs.sqlite == 'true'
    uses: ./.github/workflows/sqlite-runtime.yml
@@ -577,6 +663,9 @@ jobs:
      - name: Cache npm package downloads
        id: npm-cache
        uses: ./.github/actions/npm-cache
+        with:
+          # ubuntu-latest is the Linux x64 writer above. Other hosts save their own key.
+          save: ${{ matrix.os != 'ubuntu-latest' }}
      - name: Verify native runtime identity
        env:
          EXPECTED_CI_PLATFORM: ${{ matrix.platform }}
@@ -713,6 +802,8 @@ jobs:
      - name: Cache npm package downloads
        id: npm-cache
        uses: ./.github/actions/npm-cache
+        with:
+          save: "true"
      - run: npm ci
      - uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v4.3.0
        with:
@@ -858,68 +949,96 @@ jobs:
            skills/reverse-engineer-anything
          if-no-files-found: error

+  # Provider lanes wait for fast static and the portable build, not deep static.
  browser:
    needs: [changes, static, build]
    if: needs.changes.outputs.browser == 'true'
+    secrets:
+      TURBO_TOKEN: ${{ secrets.TURBO_TOKEN }}
    uses: ./.github/workflows/real-browser.yml
    with:
      build_cache_artifact: rea-build-cache
+      remote_cache_write: ${{ inputs.remote_cache_write == true || (github.ref == format('refs/heads/{0}', github.event.repository.default_branch) && (github.event_name == 'push' || github.event_name == 'schedule' || github.event_name == 'workflow_dispatch')) }}

  binary_layout:
    needs: [changes, static, build]
    if: needs.changes.outputs.binary_layout == 'true'
+    secrets:
+      TURBO_TOKEN: ${{ secrets.TURBO_TOKEN }}
    uses: ./.github/workflows/real-binary-layout.yml
    with:
      build_cache_artifact: rea-build-cache
+      remote_cache_write: ${{ inputs.remote_cache_write == true || (github.ref == format('refs/heads/{0}', github.event.repository.default_branch) && (github.event_name == 'push' || github.event_name == 'schedule' || github.event_name == 'workflow_dispatch')) }}

  evm:
    needs: [changes, static, build]
    if: needs.changes.outputs.evm == 'true'
+    secrets:
+      TURBO_TOKEN: ${{ secrets.TURBO_TOKEN }}
    uses: ./.github/workflows/real-evm-interface.yml
    with:
      build_cache_artifact: rea-build-cache
+      remote_cache_write: ${{ inputs.remote_cache_write == true || (github.ref == format('refs/heads/{0}', github.event.repository.default_branch) && (github.event_name == 'push' || github.event_name == 'schedule' || github.event_name == 'workflow_dispatch')) }}

  javascript_recovery:
    needs: [changes, static, build]
    if: needs.changes.outputs.javascript_recovery == 'true'
+    secrets:
+      TURBO_TOKEN: ${{ secrets.TURBO_TOKEN }}
    uses: ./.github/workflows/real-javascript-recovery.yml
    with:
      build_cache_artifact: rea-build-cache
+      remote_cache_write: ${{ inputs.remote_cache_write == true || (github.ref == format('refs/heads/{0}', github.event.repository.default_branch) && (github.event_name == 'push' || github.event_name == 'schedule' || github.event_name == 'workflow_dispatch')) }}

  recorded_crash:
    needs: [changes, static, build]
    if: needs.changes.outputs.recorded_crash == 'true'
+    secrets:
+      TURBO_TOKEN: ${{ secrets.TURBO_TOKEN }}
    uses: ./.github/workflows/real-recorded-crash.yml
    with:
      build_cache_artifact: rea-build-cache
+      remote_cache_write: ${{ inputs.remote_cache_write == true || (github.ref == format('refs/heads/{0}', github.event.repository.default_branch) && (github.event_name == 'push' || github.event_name == 'schedule' || github.event_name == 'workflow_dispatch')) }}

  web_network:
    needs: [changes, static, build]
    if: needs.changes.outputs.web_network == 'true'
+    secrets:
+      TURBO_TOKEN: ${{ secrets.TURBO_TOKEN }}
    uses: ./.github/workflows/real-web-network-captures.yml
    with:
      build_cache_artifact: rea-build-cache
+      remote_cache_write: ${{ inputs.remote_cache_write == true || (github.ref == format('refs/heads/{0}', github.event.repository.default_branch) && (github.event_name == 'push' || github.event_name == 'schedule' || github.event_name == 'workflow_dispatch')) }}

  web_runtime:
    needs: [changes, static, build]
    if: needs.changes.outputs.web_runtime == 'true'
+    secrets:
+      TURBO_TOKEN: ${{ secrets.TURBO_TOKEN }}
    uses: ./.github/workflows/real-web-runtime.yml
    with:
      build_cache_artifact: rea-build-cache
+      remote_cache_write: ${{ inputs.remote_cache_write == true || (github.ref == format('refs/heads/{0}', github.event.repository.default_branch) && (github.event_name == 'push' || github.event_name == 'schedule' || github.event_name == 'workflow_dispatch')) }}

  web_source_map:
    needs: [changes, static, build]
    if: needs.changes.outputs.web_source_map == 'true'
+    secrets:
+      TURBO_TOKEN: ${{ secrets.TURBO_TOKEN }}
    uses: ./.github/workflows/real-web-source-map.yml
    with:
      build_cache_artifact: rea-build-cache
+      remote_cache_write: ${{ inputs.remote_cache_write == true || (github.ref == format('refs/heads/{0}', github.event.repository.default_branch) && (github.event_name == 'push' || github.event_name == 'schedule' || github.event_name == 'workflow_dispatch')) }}

  agentenv:
    needs: [changes, static, build]
    if: needs.changes.outputs.agentenv == 'true'
+    secrets:
+      TURBO_TOKEN: ${{ secrets.TURBO_TOKEN }}
    uses: ./.github/workflows/real-agentenv.yml
    with:
      build_cache_artifact: rea-build-cache
+      remote_cache_write: ${{ inputs.remote_cache_write == true || (github.ref == format('refs/heads/{0}', github.event.repository.default_branch) && (github.event_name == 'push' || github.event_name == 'schedule' || github.event_name == 'workflow_dispatch')) }}

  nativeaot:
    needs: [changes, static]
@@ -944,6 +1063,7 @@ jobs:
      [
        changes,
        static,
+        static-deep,
        build,
        reverse-tools-quality,
        test-shard,
@@ -14,6 +14,11 @@ concurrency:

 env:
  HUSKY: "0"
+  # Writes only on the default branch for push, schedule, manual dispatch,
+  # and workflow_call. Pull requests get an empty token and remote read-only mode.
+  TURBO_TOKEN: "${{ (github.ref == format('refs/heads/{0}', github.event.repository.default_branch) && (github.event_name == 'push' || github.event_name == 'schedule' || github.event_name == 'workflow_dispatch' || github.event_name == 'workflow_call')) && secrets.TURBO_TOKEN || '' }}"
+  TURBO_TEAM: ${{ vars.TURBO_TEAM }}
+  TURBO_CACHE: "${{ (github.ref == format('refs/heads/{0}', github.event.repository.default_branch) && (github.event_name == 'push' || github.event_name == 'schedule' || github.event_name == 'workflow_dispatch' || github.event_name == 'workflow_call')) && 'local:rw,remote:rw' || 'local:rw,remote:r' }}"

 jobs:
  mutation:
@@ -9,12 +9,28 @@ on:
        required: false
        type: string
        default: ""
+      remote_cache_write:
+        description: Trusted release qualification may publish the remote cache.
+        required: false
+        type: boolean
+        default: false
+    secrets:
+      TURBO_TOKEN:
+        description: Remote cache token. Only trusted callers pass it.
+        required: false

 permissions:
  contents: read

 env:
  HUSKY: "0"
+  # A called workflow sees the caller event, so workflow_call is not an event
+  # name here. Writes when remote_cache_write is set, or on the default branch
+  # for push, schedule, and manual dispatch. Open pull requests stay empty-token
+  # and use the local cache only.
+  TURBO_TOKEN: "${{ (inputs.remote_cache_write == true || (github.ref == format('refs/heads/{0}', github.event.repository.default_branch) && (github.event_name == 'push' || github.event_name == 'schedule' || github.event_name == 'workflow_dispatch'))) && secrets.TURBO_TOKEN || '' }}"
+  TURBO_TEAM: ${{ vars.TURBO_TEAM }}
+  TURBO_CACHE: "${{ (inputs.remote_cache_write == true || (github.ref == format('refs/heads/{0}', github.event.repository.default_branch) && (github.event_name == 'push' || github.event_name == 'schedule' || github.event_name == 'workflow_dispatch'))) && 'local:rw,remote:rw' || 'local:rw' }}"
  NODE_OPTIONS: --max-old-space-size=768
  PIP_DISABLE_PIP_VERSION_CHECK: "1"

@@ -14,6 +14,15 @@ on:
        required: false
        type: string
        default: ""
+      remote_cache_write:
+        description: Trusted release qualification may publish the remote cache.
+        required: false
+        type: boolean
+        default: false
+    secrets:
+      TURBO_TOKEN:
+        description: Remote cache token. Only trusted callers pass it.
+        required: false

 permissions:
  contents: read
@@ -21,6 +30,13 @@ permissions:
 env:
  NODE_OPTIONS: --max-old-space-size=768
  HUSKY: "0"
+  # A called workflow sees the caller event, so workflow_call is not an event
+  # name here. Writes when remote_cache_write is set, or on the default branch
+  # for push, schedule, and manual dispatch. Open pull requests stay empty-token
+  # and use the local cache only.
+  TURBO_TOKEN: "${{ (inputs.remote_cache_write == true || (github.ref == format('refs/heads/{0}', github.event.repository.default_branch) && (github.event_name == 'push' || github.event_name == 'schedule' || github.event_name == 'workflow_dispatch'))) && secrets.TURBO_TOKEN || '' }}"
+  TURBO_TEAM: ${{ vars.TURBO_TEAM }}
+  TURBO_CACHE: "${{ (inputs.remote_cache_write == true || (github.ref == format('refs/heads/{0}', github.event.repository.default_branch) && (github.event_name == 'push' || github.event_name == 'schedule' || github.event_name == 'workflow_dispatch'))) && 'local:rw,remote:rw' || 'local:rw' }}"
  REA_VERIFY_LARGE_ELF_MCP: ${{ inputs.large_mcp && '1' || '0' }}

 jobs:
@@ -8,10 +8,26 @@ on:
        required: false
        type: string
        default: ""
+      remote_cache_write:
+        description: Trusted release qualification may publish the remote cache.
+        required: false
+        type: boolean
+        default: false
+    secrets:
+      TURBO_TOKEN:
+        description: Remote cache token. Only trusted callers pass it.
+        required: false
  workflow_dispatch:

 env:
  HUSKY: "0"
+  # A called workflow sees the caller event, so workflow_call is not an event
+  # name here. Writes when remote_cache_write is set, or on the default branch
+  # for push, schedule, and manual dispatch. Open pull requests stay empty-token
+  # and use the local cache only.
+  TURBO_TOKEN: "${{ (inputs.remote_cache_write == true || (github.ref == format('refs/heads/{0}', github.event.repository.default_branch) && (github.event_name == 'push' || github.event_name == 'schedule' || github.event_name == 'workflow_dispatch'))) && secrets.TURBO_TOKEN || '' }}"
+  TURBO_TEAM: ${{ vars.TURBO_TEAM }}
+  TURBO_CACHE: "${{ (inputs.remote_cache_write == true || (github.ref == format('refs/heads/{0}', github.event.repository.default_branch) && (github.event_name == 'push' || github.event_name == 'schedule' || github.event_name == 'workflow_dispatch'))) && 'local:rw,remote:rw' || 'local:rw' }}"

 permissions:
  contents: read
@@ -8,6 +8,14 @@ on:
 permissions:
  contents: read

+env:
+  HUSKY: "0"
+  # Writes only on the default branch for push, schedule, manual dispatch,
+  # and workflow_call. Pull requests get an empty token and remote read-only mode.
+  TURBO_TOKEN: "${{ (github.ref == format('refs/heads/{0}', github.event.repository.default_branch) && (github.event_name == 'push' || github.event_name == 'schedule' || github.event_name == 'workflow_dispatch' || github.event_name == 'workflow_call')) && secrets.TURBO_TOKEN || '' }}"
+  TURBO_TEAM: ${{ vars.TURBO_TEAM }}
+  TURBO_CACHE: "${{ (github.ref == format('refs/heads/{0}', github.event.repository.default_branch) && (github.event_name == 'push' || github.event_name == 'schedule' || github.event_name == 'workflow_dispatch' || github.event_name == 'workflow_call')) && 'local:rw,remote:rw' || 'local:rw,remote:r' }}"
+
 jobs:
  windows-native-artifact:
    name: Build Windows bridge security boundary
@@ -9,6 +9,15 @@ on:
        required: false
        type: string
        default: ""
+      remote_cache_write:
+        description: Trusted release qualification may publish the remote cache.
+        required: false
+        type: boolean
+        default: false
+    secrets:
+      TURBO_TOKEN:
+        description: Remote cache token. Only trusted callers pass it.
+        required: false

 permissions:
  contents: read
@@ -16,6 +25,13 @@ permissions:
 env:
  NODE_OPTIONS: --max-old-space-size=768
  HUSKY: "0"
+  # A called workflow sees the caller event, so workflow_call is not an event
+  # name here. Writes when remote_cache_write is set, or on the default branch
+  # for push, schedule, and manual dispatch. Open pull requests stay empty-token
+  # and use the local cache only.
+  TURBO_TOKEN: "${{ (inputs.remote_cache_write == true || (github.ref == format('refs/heads/{0}', github.event.repository.default_branch) && (github.event_name == 'push' || github.event_name == 'schedule' || github.event_name == 'workflow_dispatch'))) && secrets.TURBO_TOKEN || '' }}"
+  TURBO_TEAM: ${{ vars.TURBO_TEAM }}
+  TURBO_CACHE: "${{ (inputs.remote_cache_write == true || (github.ref == format('refs/heads/{0}', github.event.repository.default_branch) && (github.event_name == 'push' || github.event_name == 'schedule' || github.event_name == 'workflow_dispatch'))) && 'local:rw,remote:rw' || 'local:rw' }}"

 jobs:
  real-evm-interface:
@@ -6,6 +6,11 @@ on:

 env:
  HUSKY: "0"
+  # Writes only on the default branch for push, schedule, manual dispatch,
+  # and workflow_call. Pull requests get an empty token and remote read-only mode.
+  TURBO_TOKEN: "${{ (github.ref == format('refs/heads/{0}', github.event.repository.default_branch) && (github.event_name == 'push' || github.event_name == 'schedule' || github.event_name == 'workflow_dispatch' || github.event_name == 'workflow_call')) && secrets.TURBO_TOKEN || '' }}"
+  TURBO_TEAM: ${{ vars.TURBO_TEAM }}
+  TURBO_CACHE: "${{ (github.ref == format('refs/heads/{0}', github.event.repository.default_branch) && (github.event_name == 'push' || github.event_name == 'schedule' || github.event_name == 'workflow_dispatch' || github.event_name == 'workflow_call')) && 'local:rw,remote:rw' || 'local:rw,remote:r' }}"

 permissions:
  contents: read
@@ -13,20 +13,8 @@ on:
      - "src/composition/go.ts"
      - "src/cli/goCommands.ts"
      - "src/server/registerGoTools.ts"
-      - "src/server/createServer.ts"
-      - "src/cli.ts"
-      - "src/cliCommandNames.ts"
-      - "src/contracts/toolContracts.ts"
-      - "src/contracts/toolEffects.ts"
-      - "src/artifacts/readStableArtifact*.ts"
-      - "src/artifacts/ArtifactReader.ts"
-      - "src/process/PrivateRuntimeRoot.ts"
      - "scripts/verify-go-binary.mjs"
      - "scripts/lib/mcp-verifier-results.mjs"
-      - "scripts/rea.mjs"
-      - "package.json"
-      - "package-lock.json"
-      - ".nvmrc"

 permissions:
  contents: read
@@ -38,6 +26,11 @@ concurrency:
 env:
  NODE_OPTIONS: --max-old-space-size=768
  HUSKY: "0"
+  # Writes only on the default branch for push, schedule, manual dispatch,
+  # and workflow_call. Pull requests get an empty token and remote read-only mode.
+  TURBO_TOKEN: "${{ (github.ref == format('refs/heads/{0}', github.event.repository.default_branch) && (github.event_name == 'push' || github.event_name == 'schedule' || github.event_name == 'workflow_dispatch' || github.event_name == 'workflow_call')) && secrets.TURBO_TOKEN || '' }}"
+  TURBO_TEAM: ${{ vars.TURBO_TEAM }}
+  TURBO_CACHE: "${{ (github.ref == format('refs/heads/{0}', github.event.repository.default_branch) && (github.event_name == 'push' || github.event_name == 'schedule' || github.event_name == 'workflow_dispatch' || github.event_name == 'workflow_call')) && 'local:rw,remote:rw' || 'local:rw,remote:r' }}"

 jobs:
  real-go-binary:
@@ -5,6 +5,11 @@ on:

 env:
  HUSKY: "0"
+  # Writes only on the default branch for push, schedule, manual dispatch,
+  # and workflow_call. Pull requests get an empty token and remote read-only mode.
+  TURBO_TOKEN: "${{ (github.ref == format('refs/heads/{0}', github.event.repository.default_branch) && (github.event_name == 'push' || github.event_name == 'schedule' || github.event_name == 'workflow_dispatch' || github.event_name == 'workflow_call')) && secrets.TURBO_TOKEN || '' }}"
+  TURBO_TEAM: ${{ vars.TURBO_TEAM }}
+  TURBO_CACHE: "${{ (github.ref == format('refs/heads/{0}', github.event.repository.default_branch) && (github.event_name == 'push' || github.event_name == 'schedule' || github.event_name == 'workflow_dispatch' || github.event_name == 'workflow_call')) && 'local:rw,remote:rw' || 'local:rw,remote:r' }}"

 permissions:
  contents: read
@@ -5,6 +5,11 @@ on:

 env:
  HUSKY: "0"
+  # Writes only on the default branch for push, schedule, manual dispatch,
+  # and workflow_call. Pull requests get an empty token and remote read-only mode.
+  TURBO_TOKEN: "${{ (github.ref == format('refs/heads/{0}', github.event.repository.default_branch) && (github.event_name == 'push' || github.event_name == 'schedule' || github.event_name == 'workflow_dispatch' || github.event_name == 'workflow_call')) && secrets.TURBO_TOKEN || '' }}"
+  TURBO_TEAM: ${{ vars.TURBO_TEAM }}
+  TURBO_CACHE: "${{ (github.ref == format('refs/heads/{0}', github.event.repository.default_branch) && (github.event_name == 'push' || github.event_name == 'schedule' || github.event_name == 'workflow_dispatch' || github.event_name == 'workflow_call')) && 'local:rw,remote:rw' || 'local:rw,remote:r' }}"

 permissions:
  contents: read
@@ -8,6 +8,15 @@ on:
        required: false
        type: string
        default: ""
+      remote_cache_write:
+        description: Trusted release qualification may publish the remote cache.
+        required: false
+        type: boolean
+        default: false
+    secrets:
+      TURBO_TOKEN:
+        description: Remote cache token. Only trusted callers pass it.
+        required: false
  workflow_dispatch:

 permissions:
@@ -15,6 +24,13 @@ permissions:

 env:
  HUSKY: "0"
+  # A called workflow sees the caller event, so workflow_call is not an event
+  # name here. Writes when remote_cache_write is set, or on the default branch
+  # for push, schedule, and manual dispatch. Open pull requests stay empty-token
+  # and use the local cache only.
+  TURBO_TOKEN: "${{ (inputs.remote_cache_write == true || (github.ref == format('refs/heads/{0}', github.event.repository.default_branch) && (github.event_name == 'push' || github.event_name == 'schedule' || github.event_name == 'workflow_dispatch'))) && secrets.TURBO_TOKEN || '' }}"
+  TURBO_TEAM: ${{ vars.TURBO_TEAM }}
+  TURBO_CACHE: "${{ (inputs.remote_cache_write == true || (github.ref == format('refs/heads/{0}', github.event.repository.default_branch) && (github.event_name == 'push' || github.event_name == 'schedule' || github.event_name == 'workflow_dispatch'))) && 'local:rw,remote:rw' || 'local:rw' }}"
  NODE_OPTIONS: "--max-old-space-size=768"
  RAYON_NUM_THREADS: "1"

@@ -20,21 +20,17 @@ on:
      - "src/composition/captures.ts"
      - "src/cli/captureCommands.ts"
      - "src/server/registerCaptureTools.ts"
-      - "src/server/createServer.ts"
-      - "src/server/sessionAvailabilityPolicy.ts"
-      - "src/application/CapabilityInventory.ts"
-      - "src/contracts/toolContracts.ts"
-      - "src/contracts/toolEffects.ts"
-      - "src/cli.ts"
-      - "src/cliCommandNames.ts"
-      - "src/process/**"
-      - "src/artifacts/readStableArtifact.ts"
      - "scripts/verify-packet-capture.mjs"
      - ".github/workflows/real-packet-capture.yml"
-      - "package*.json"
-      - ".nvmrc"
 permissions:
  contents: read
+env:
+  HUSKY: "0"
+  # Writes only on the default branch for push, schedule, manual dispatch,
+  # and workflow_call. Pull requests get an empty token and remote read-only mode.
+  TURBO_TOKEN: "${{ (github.ref == format('refs/heads/{0}', github.event.repository.default_branch) && (github.event_name == 'push' || github.event_name == 'schedule' || github.event_name == 'workflow_dispatch' || github.event_name == 'workflow_call')) && secrets.TURBO_TOKEN || '' }}"
+  TURBO_TEAM: ${{ vars.TURBO_TEAM }}
+  TURBO_CACHE: "${{ (github.ref == format('refs/heads/{0}', github.event.repository.default_branch) && (github.event_name == 'push' || github.event_name == 'schedule' || github.event_name == 'workflow_dispatch' || github.event_name == 'workflow_call')) && 'local:rw,remote:rw' || 'local:rw,remote:r' }}"
 concurrency:
  group: real-packet-capture-${{ github.event.pull_request.number || github.ref }}
  cancel-in-progress: true
@@ -9,6 +9,15 @@ on:
        required: false
        type: string
        default: ""
+      remote_cache_write:
+        description: Trusted release qualification may publish the remote cache.
+        required: false
+        type: boolean
+        default: false
+    secrets:
+      TURBO_TOKEN:
+        description: Remote cache token. Only trusted callers pass it.
+        required: false

 permissions:
  contents: read
@@ -16,6 +25,13 @@ permissions:
 env:
  NODE_OPTIONS: --max-old-space-size=768
  HUSKY: "0"
+  # A called workflow sees the caller event, so workflow_call is not an event
+  # name here. Writes when remote_cache_write is set, or on the default branch
+  # for push, schedule, and manual dispatch. Open pull requests stay empty-token
+  # and use the local cache only.
+  TURBO_TOKEN: "${{ (inputs.remote_cache_write == true || (github.ref == format('refs/heads/{0}', github.event.repository.default_branch) && (github.event_name == 'push' || github.event_name == 'schedule' || github.event_name == 'workflow_dispatch'))) && secrets.TURBO_TOKEN || '' }}"
+  TURBO_TEAM: ${{ vars.TURBO_TEAM }}
+  TURBO_CACHE: "${{ (inputs.remote_cache_write == true || (github.ref == format('refs/heads/{0}', github.event.repository.default_branch) && (github.event_name == 'push' || github.event_name == 'schedule' || github.event_name == 'workflow_dispatch'))) && 'local:rw,remote:rw' || 'local:rw' }}"
  UV_CONCURRENT_BUILDS: "1"
  UV_CONCURRENT_INSTALLS: "1"
  UV_PYTHON_DOWNLOADS: never
@@ -13,21 +13,17 @@ on:
      - "src/composition/signals.ts"
      - "src/cli/signalCommands.ts"
      - "src/server/registerSignalTools.ts"
-      - "src/server/createServer.ts"
-      - "src/server/sessionAvailabilityPolicy.ts"
-      - "src/application/CapabilityInventory.ts"
-      - "src/contracts/toolContracts.ts"
-      - "src/contracts/toolEffects.ts"
-      - "src/cli.ts"
-      - "src/cliCommandNames.ts"
-      - "src/process/**"
-      - "src/artifacts/readStableArtifact.ts"
      - "scripts/verify-signal-recording.mjs"
      - ".github/workflows/real-signal-recording.yml"
-      - "package*.json"
-      - ".nvmrc"
 permissions:
  contents: read
+env:
+  HUSKY: "0"
+  # Writes only on the default branch for push, schedule, manual dispatch,
+  # and workflow_call. Pull requests get an empty token and remote read-only mode.
+  TURBO_TOKEN: "${{ (github.ref == format('refs/heads/{0}', github.event.repository.default_branch) && (github.event_name == 'push' || github.event_name == 'schedule' || github.event_name == 'workflow_dispatch' || github.event_name == 'workflow_call')) && secrets.TURBO_TOKEN || '' }}"
+  TURBO_TEAM: ${{ vars.TURBO_TEAM }}
+  TURBO_CACHE: "${{ (github.ref == format('refs/heads/{0}', github.event.repository.default_branch) && (github.event_name == 'push' || github.event_name == 'schedule' || github.event_name == 'workflow_dispatch' || github.event_name == 'workflow_call')) && 'local:rw,remote:rw' || 'local:rw,remote:r' }}"
 concurrency:
  group: real-signal-recording-${{ github.event.pull_request.number || github.ref }}
  cancel-in-progress: true
@@ -12,6 +12,11 @@ permissions:

 env:
  HUSKY: "0"
+  # Writes only on the default branch for push, schedule, manual dispatch,
+  # and workflow_call. Pull requests get an empty token and remote read-only mode.
+  TURBO_TOKEN: "${{ (github.ref == format('refs/heads/{0}', github.event.repository.default_branch) && (github.event_name == 'push' || github.event_name == 'schedule' || github.event_name == 'workflow_dispatch' || github.event_name == 'workflow_call')) && secrets.TURBO_TOKEN || '' }}"
+  TURBO_TEAM: ${{ vars.TURBO_TEAM }}
+  TURBO_CACHE: "${{ (github.ref == format('refs/heads/{0}', github.event.repository.default_branch) && (github.event_name == 'push' || github.event_name == 'schedule' || github.event_name == 'workflow_dispatch' || github.event_name == 'workflow_call')) && 'local:rw,remote:rw' || 'local:rw,remote:r' }}"

 jobs:
  real-termux:
@@ -9,12 +9,28 @@ on:
        required: false
        type: string
        default: ""
+      remote_cache_write:
+        description: Trusted release qualification may publish the remote cache.
+        required: false
+        type: boolean
+        default: false
+    secrets:
+      TURBO_TOKEN:
+        description: Remote cache token. Only trusted callers pass it.
+        required: false

 permissions:
  contents: read

 env:
  HUSKY: "0"
+  # A called workflow sees the caller event, so workflow_call is not an event
+  # name here. Writes when remote_cache_write is set, or on the default branch
+  # for push, schedule, and manual dispatch. Open pull requests stay empty-token
+  # and use the local cache only.
+  TURBO_TOKEN: "${{ (inputs.remote_cache_write == true || (github.ref == format('refs/heads/{0}', github.event.repository.default_branch) && (github.event_name == 'push' || github.event_name == 'schedule' || github.event_name == 'workflow_dispatch'))) && secrets.TURBO_TOKEN || '' }}"
+  TURBO_TEAM: ${{ vars.TURBO_TEAM }}
+  TURBO_CACHE: "${{ (inputs.remote_cache_write == true || (github.ref == format('refs/heads/{0}', github.event.repository.default_branch) && (github.event_name == 'push' || github.event_name == 'schedule' || github.event_name == 'workflow_dispatch'))) && 'local:rw,remote:rw' || 'local:rw' }}"
  NODE_OPTIONS: --max-old-space-size=768

 jobs:
@@ -7,11 +7,27 @@ on:
        required: false
        type: string
        default: ""
+      remote_cache_write:
+        description: Trusted release qualification may publish the remote cache.
+        required: false
+        type: boolean
+        default: false
+    secrets:
+      TURBO_TOKEN:
+        description: Remote cache token. Only trusted callers pass it.
+        required: false
  workflow_dispatch:
 permissions:
  contents: read
 env:
  HUSKY: "0"
+  # A called workflow sees the caller event, so workflow_call is not an event
+  # name here. Writes when remote_cache_write is set, or on the default branch
+  # for push, schedule, and manual dispatch. Open pull requests stay empty-token
+  # and use the local cache only.
+  TURBO_TOKEN: "${{ (inputs.remote_cache_write == true || (github.ref == format('refs/heads/{0}', github.event.repository.default_branch) && (github.event_name == 'push' || github.event_name == 'schedule' || github.event_name == 'workflow_dispatch'))) && secrets.TURBO_TOKEN || '' }}"
+  TURBO_TEAM: ${{ vars.TURBO_TEAM }}
+  TURBO_CACHE: "${{ (inputs.remote_cache_write == true || (github.ref == format('refs/heads/{0}', github.event.repository.default_branch) && (github.event_name == 'push' || github.event_name == 'schedule' || github.event_name == 'workflow_dispatch'))) && 'local:rw,remote:rw' || 'local:rw' }}"
 jobs:
  real-web-runtime:
    runs-on: ubuntu-latest
@@ -7,11 +7,27 @@ on:
        required: false
        type: string
        default: ""
+      remote_cache_write:
+        description: Trusted release qualification may publish the remote cache.
+        required: false
+        type: boolean
+        default: false
+    secrets:
+      TURBO_TOKEN:
+        description: Remote cache token. Only trusted callers pass it.
+        required: false
  workflow_dispatch:
 permissions:
  contents: read
 env:
  HUSKY: "0"
+  # A called workflow sees the caller event, so workflow_call is not an event
+  # name here. Writes when remote_cache_write is set, or on the default branch
+  # for push, schedule, and manual dispatch. Open pull requests stay empty-token
+  # and use the local cache only.
+  TURBO_TOKEN: "${{ (inputs.remote_cache_write == true || (github.ref == format('refs/heads/{0}', github.event.repository.default_branch) && (github.event_name == 'push' || github.event_name == 'schedule' || github.event_name == 'workflow_dispatch'))) && secrets.TURBO_TOKEN || '' }}"
+  TURBO_TEAM: ${{ vars.TURBO_TEAM }}
+  TURBO_CACHE: "${{ (inputs.remote_cache_write == true || (github.ref == format('refs/heads/{0}', github.event.repository.default_branch) && (github.event_name == 'push' || github.event_name == 'schedule' || github.event_name == 'workflow_dispatch'))) && 'local:rw,remote:rw' || 'local:rw' }}"
 jobs:
  real-web-source-map:
    runs-on: ubuntu-latest
@@ -21,6 +21,12 @@ on:

 env:
  HUSKY: "0"
+  # Remote cache stays local when either value is empty.
+  # Writes only on the default branch for push, schedule, manual dispatch,
+  # and workflow_call. Pull requests get an empty token and remote read-only mode.
+  TURBO_TOKEN: "${{ (github.ref == format('refs/heads/{0}', github.event.repository.default_branch) && (github.event_name == 'push' || github.event_name == 'schedule' || github.event_name == 'workflow_dispatch' || github.event_name == 'workflow_call')) && secrets.TURBO_TOKEN || '' }}"
+  TURBO_TEAM: ${{ vars.TURBO_TEAM }}
+  TURBO_CACHE: "${{ (github.ref == format('refs/heads/{0}', github.event.repository.default_branch) && (github.event_name == 'push' || github.event_name == 'schedule' || github.event_name == 'workflow_dispatch' || github.event_name == 'workflow_call')) && 'local:rw,remote:rw' || 'local:rw,remote:r' }}"

 concurrency:
  group: release-${{ inputs.release_branch || github.event.pull_request.merge_commit_sha || github.ref_name }}
@@ -301,8 +307,11 @@ jobs:
      contents: read
      actions: read
    uses: ./.github/workflows/ci.yml
+    secrets:
+      TURBO_TOKEN: ${{ secrets.TURBO_TOKEN }}
    with:
      source_sha: ${{ needs.merged-release.outputs.sha || needs.release-please.outputs.sha }}
+      remote_cache_write: true

  rehearsal:
    name: Rehearse qualified release on a clean runner
@@ -180,6 +180,7 @@ Additional tools and host support depend on the target:
 | Native binaries        | Pseudocode, assembly, strings, symbols, calls and references                                      | Hopper, Ghidra or IDA; [native analysis](docs/native-investigation.md)                                                                |
 | Offline ELF layout     | Sections, segments, original symbols/relocations and static mitigation candidates                 | Caller-supplied pwntools on Linux x64; [binary diagnostics](docs/binary-diagnostics.md)                                               |
 | Go binaries            | Embedded compiler version, modules, replacements and build settings                               | Built-in static ELF/PE/thin Mach-O inspection; no Go installation required                                                            |
+| Model artifacts        | GGUF / safetensors metadata, tensor declarations and derived totals                               | Built-in header inspection; optional full-file hash; [model files](docs/model-artifacts.md)                                           |
 | IL2CPP metadata        | Unity global-metadata.dat assembly images, type and method names and index ranges                 | Built-in static decoding of versions 24, 27, 29, 31 and 39; no Unity required                                                         |
 | Godot PCK              | Archive inventory and extraction, original header/directory facts and selected content identities | Built-in static formats 2, 3 and 4; no Godot required                                                                                 |
 | Rust binaries          | Embedded cargo-auditable crate names, versions, sources and dependency edges                      | Built-in static ELF/PE/thin Mach-O inspection; [Rust binaries](docs/rust-binaries.md)                                                 |
@@ -30,6 +30,7 @@ export default defineConfig({
          { text: "Native binaries", link: "/native-investigation" },
          { text: "Go build metadata", link: "/go-binaries" },
          { text: "IL2CPP metadata", link: "/il2cpp-metadata" },
+          { text: "Model artifacts", link: "/model-artifacts" },
          { text: "Rust dependencies", link: "/rust-binaries" },
          {
            text: "JavaScript and Electron",
@@ -180,8 +180,21 @@ rea trace-dylib-resolution MyApp.app --root Contents/MacOS/MyApp --architecture

 Load commands are parsed in TypeScript from Mach-O and FAT headers, including
 the `dylib_use_command` encoding newer linkers emit for flags such as delayed
-initialization. Nothing is executed and no Apple tool is required, so the tool
-also works off macOS.
+initialization, and `LC_LAZY_LOAD_DYLIB_INFO` (`0x3a`). That command stores its
+install name in a linkedit payload rather than in the load command itself.
+Its flag and chain-start image offsets must lie in the slice VM range, which
+is dyld's one-page floor extended by every segment except `__LINKEDIT`,
+measured from the `__TEXT` vmaddr. Payload strings must start after the 24-byte
+header. The load-path NUL must occur before the payload's final byte, matching
+dyld's scan. Distinct payload bytes and payload-range lookups stay within the 16 MiB
+limit, and a file range already read is reused. String scanning and UTF-8
+checks count every reference, including repeats and overlaps, and stop at that
+same aggregate. A slice retains at most 1024 of these commands; further copies are
+unsupported instead of becoming one traced edge each. Symbol references,
+including repeats, stop at 65536 per slice. A larger table is unsupported
+instead of caching one string per offset.
+Nothing is executed and no Apple tool is required, so the tool also works off
+macOS.

 Resolution follows dyld:

@@ -215,15 +228,23 @@ root supplies. Every edge below it has `loader_conditional: true`, and a
 request that reuses it by install name is `conditional` too. Findings on those
 edges say that they apply only if the conditional image loads.

-Absolute install names such as `/usr/lib/libSystem.B.dylib` are
-`outside-target`. On macOS 11 and later most of them live in the dyld shared
-cache rather than on disk, so REA does not check them against the host.
+Absolute install names that name a path beneath the analyzed root are checked
+within that root, with symlinks and `..` resolved by the same bounded tree
+resolver. Absolute paths outside the root, such as
+`/usr/lib/libSystem.B.dylib`, are `outside-target`; on macOS 11 and later most
+system libraries live in the dyld shared cache rather than on disk, so REA does
+not check them against the host. Mach-O path strings are not converted from
+`file:` URLs or looked up through unrelated host paths.

 `findings` are derived, not observed:

 - `required-load-unresolved`, `weak-load-unresolved`, and `lazy-load-unresolved`.
-  `LC_LAZY_LOAD_DYLIB` dependencies are resolved but not traversed, because dyld
-  loads them on first use; an unresolved one is not a launch failure.
+  `LC_LAZY_LOAD_DYLIB` and `LC_LAZY_LOAD_DYLIB_INFO` dependencies are resolved
+  but not traversed, because dyld loads them on first use; an unresolved one is
+  not a launch failure. `LC_LAZY_LOAD_DYLIB_INFO` has no compatibility version,
+  so those fields are null. Its may-be-missing flag is reported as `weak`, and
+  an unresolved dependency with that flag is not a first-use failure: dyld
+  continues if the image is absent.
 - `earlier-rpath-candidate-absent`: a compatible Mach-O placed at an earlier
  modeled search path could take precedence, subject to unmodeled search inputs
  and code-signing library validation. These findings do not establish which
@@ -19,8 +19,24 @@ Inspect native SAZ or HAR 1.2 offline with REA, or connect Everywhere's separate
 - `analyze_web_bundle` / `rea analyze-web-bundle` parses selected script artifacts without execution and derives chunk edges, route and endpoint candidates, vendor fingerprints, static WebMCP declarations, and optionally source-map/original-source evidence.
 - `observe_web_session` / `rea observe-web-session` arms an observation window of the requested duration for an external user action and records ordered reload, SPA navigation, redirect, failure, lifecycle, and target-termination metadata.
 - `discover_webmcp_tools` / `rea discover-webmcp-tools` uses the experimental CDP WebMCP domain to return every in-scope registration and its complete observed `input_schema` declaration and canonical `input_schema_sha256` digest inline. Declarations are untrusted JSON data, including declared types, required fields, enums, examples and reference URLs. REA does not resolve schema references. These fields replace `input_schema_shape`. Registrations with the same name and URL in distinct observed frames retain separate identities. `tool_key` includes the observed frame ID; it is not a stable identity across navigation or browser sessions. Same-frame registration updates replace that owner only, and removal leaves other owners intact. Declared `readOnly`, `untrustedContent`, `consequential`, and `autosubmit` annotation hints are reported per registration: `true`/`false` are declared values, `null` means the declaration did not provide the hint in that capture, and a missing `consequential` key means the hint was not recorded, either in a historical capture or because the observed annotation was invalid. Consult discovery completeness and exclusions to distinguish these cases. Malformed annotation values retain the registration with incomplete coverage and an `invalid_protocol_value` exclusion. Other malformed protocol payloads can fail discovery explicitly. REA never exposes `WebMCP.invokeTool`.
+
 - `compare_web_captures` / `rea compare-web-captures` compares passive captures or exact-step-aligned browser scenarios. Scenario results commit reproducible literal normalization and expose alignment failures plus artifact-level action, screenshot, DOM, accessibility, URL, history, storage, and event differences. Missing or truncated evidence is never treated as equivalence.

+For `analyze_web_bundle`, each `webmcp_declarations` entry's
+`schema_property_names` is a source-derived projection of statically known own
+property keys, not schema validation. `schema_property_names_coverage` reports
+how complete that projection is: `complete` means a literal properties object
+was fully enumerated (including an empty literal); `partial` means a literal
+object was available but some computed or spread membership was unresolved,
+and the name array retains keys that were known; `unknown` means the schema or
+properties owner could not be enumerated as an object literal, including
+explicit non-object values; `not_present` means no effective schema or own
+`properties` member was present after the `inputSchema ?? input_schema` alias
+selection. `not_present` describes this projection only: it does not validate a
+schema or rule out properties expressed through other schema constructs. Older
+observations may omit the coverage field; treat omission as `unknown` rather
+than inferring completeness from the array.
+
 Passive DOM comparison checks complete node inventories and complete frame
 parent/child structure independently. Frame IDs and sibling enumeration order
 are capture-local and do not establish a change; duplicate IDs, missing parents,
@@ -201,6 +217,11 @@ rea inspect-web-page http://127.0.0.1:9222 TARGET_ID \
  --json
 ```

+Passive observation honors the requested duration using cancellable waits within
+the runtime's timer range. Long windows stay pending across successive waits;
+caller cancellation, target termination or leaving the allowed origins ends
+collection early. `window_elapsed` identifies completion of the requested wait.
+
 Static bundle analysis and a user-driven observation window are separate operations:

 ```bash
@@ -283,6 +304,20 @@ Call `list_browser_targets` first because target IDs are browser-instance-specif

 REA establishes a main-frame origin boundary before enabling Runtime, Debugger, or Network observation, rechecks it before document capture, and validates it again afterward. If the main frame navigates during final capture, REA discards the mixed result and returns `target_changed`.

+The web-session timeline uses CDP monotonic seconds where the event producer
+provides a comparable timestamp; absent or invalid timestamps are `null` rather
+than a synthetic zero. Events buffered while REA samples the window boundary are
+retained only when their timestamp places them after that boundary; older events
+are excluded. A buffered event without a comparable timestamp may remain as
+contextual evidence with `timestamp: null`, accompanied by a limitation stating
+that it does not establish activity in the selected window. Main-frame scope
+enforcement still applies to contextual navigation events. Network redirect
+events retain their paired prior-hop response context when the timestamped
+next-request event falls inside the window. The pre-arm timeline buffer is bounded
+by original CDP message bytes. If clock sampling completes after that budget is
+exhausted, the operation returns `payload_limit` instead of a partial window.
+Cancellation and clock-request failures retain their own outcomes.
+
 ## Data minimization

 The Link projection parses repeated CDP header field lines independently and
@@ -326,8 +361,8 @@ REA retains local observation data and removes only URL userinfo credentials, ex
  WebSocket stream inventories and connection counts likewise require complete
  WebSocket coverage. Redirect resource types use only shared known metadata:
  an omitted type leaves equality unknown rather than proving a modification.
- Console observations with a stack source retain call type, argument types, timestamp, and source location. When console text capture is selected, already-delivered primitive values are retained verbatim; objects, getters, and remote properties are never expanded.
- WebSocket observations retain direction, opcode, and payload byte length. When shape capture is selected, text frames are classified as text or complete value-free JSON shape; binary bytes, hashes, prefixes, and raw frames are never retained.
+- Console observations with a stack source retain call type, argument types, the CDP `Runtime.Timestamp` in milliseconds since Unix epoch, and source location. An absent or invalid timestamp is `null` and makes `console_events` incomplete; an observed zero remains zero. This epoch-millisecond clock is separate from the monotonic-second timestamps in `observe-web-session`. When console text capture is selected, already-delivered primitive values are retained verbatim; objects, getters, and remote properties are never expanded.
+- WebSocket observations retain direction, opcode, and payload byte length. A missing or malformed CDP opcode is returned as `null`, with opcode-dependent payload byte length and shape also `null`, and marks `websocket_frames` incomplete. Missing or wrong-typed payload data is not treated as empty; its byte length is `null`, and a text payload shape is unknown. Numeric opcode `0` and an observed empty payload remain distinct from missing data. Opcode is nullable in the public inspection schema, so clients must handle unknown protocol values. When shape capture is selected, text messages are classified as text or complete value-free JSON shape; binary bytes, hashes, prefixes, and raw payloads are never retained.
 - Storage observations always redact values. Key names, IndexedDB names, and cache names require `include_storage_keys`; stable content fingerprints require the additional `include_storage_fingerprints` selection. Cookie fingerprints cover cookies applicable to the current main-frame URL, including its path, rather than every cookie path on that origin. Other storage remains scoped to the origin. Cache fingerprints hash all decoded response bytes, including bodies above 64 KiB, subject to the [64 MiB per-message CDP limit](#request-boundary). Missing or undecodable cache bodies and partial IndexedDB remote objects make fingerprint coverage incomplete, so identical observations remain `unknown`.
 - Unavailable or malformed storage inventories mark `storage_keys` unavailable, even without fingerprints. Comparisons suppress inferred key additions and removals while preserving modifications proven by complete fingerprints on both sides. Previously exported captures are not retroactively corrected; recapture them to obtain these coverage markers.
 - Script metadata is included only when CDP supplies a URL on an allowed origin. Stable keys exclude transient CDP script IDs, and exact transient raw URLs are used only during script/resource reconciliation. URL-less scripts are excluded because their origin cannot be established. When CDP supplies an execution-context association, the accepted script retains its authorized frame ID for later attribution. Script metadata admission bounds retained identity and source-map strings to 8 MiB and 50,000 records. When a source-map URL cannot fit, the script identity remains and source-map coverage reports `resource_budget_exhausted`; rejected script observations are counted without retaining their IDs. Source content is omitted unless explicitly requested and is returned inline as a self-verifying artifact with its SHA-256 digest.
@@ -103,6 +103,19 @@ Formats 2, 3 and 4 retain header, directory and integrity facts. Compact deliver
 keeps complete Evidence in the requested bundle. See [Godot PCK](godot-pck.md)
 for embedded packs, batch queries and unknown encrypted coverage.

+Inspect local model declarations without loading weights:
+
+```bash
+rea inspect-model-artifact /absolute/path/model.gguf --json
+rea inspect-model-artifact /absolute/path/model.safetensors --hash full --json
+```
+
+Default hashing reads only headers and leaves full-file identity unknown.
+`--hash full` streams the complete file for SHA-256. Both return typed metadata,
+original tensor declarations and derived totals. MCP summaries retain complete
+Evidence for filtered metadata, tensor and type-total pages; CLI compact delivery
+uses `--detail summary --evidence_output FILE`. See [model files](model-artifacts.md).
+
 Inspect Unity IL2CPP metadata names without Unity or a disassembler:

 ```bash
@@ -457,13 +457,22 @@ disposable HOME and CODEX_HOME under `~/.cache/rea-agent-evaluations/`. Set
 `REA_AGENT_EVAL_ROOT` to choose another parent directory outside the OS temporary
 directory: current Codex refuses helper aliases under `/tmp`, preventing shell
 commands and skill reads even if MCP works. Each owned run directory is removed
-after verification unless fixture retention is requested. Cleanup attempts the
+after verification unless fixture retention is requested. Commands share the
+owned-process supervisor: native ownership preparation has its own bounded
+deadline before each short command budget, and timeouts join bounded process-tree
+and output cleanup before returning. If cleanup remains incomplete, the lane retries its retained
+owner and preserves the run directory (including disposable auth) rather than
+removing files still in use; the error retains ownership and recovery details.
+Command stderr is limited to 32 KiB and combined version output to 8 KiB;
+exceeding these diagnostic budgets fails explicitly. Scenario JSON events stream
+to the evaluator without retaining a second raw stdout copy. Cleanup attempts the
 remaining run tree even if auth removal fails, and reports unresolved cleanup
 together with the original verification failure. The lane
 installs the packaged skill and MCP registration through public `rea setup`,
 rather than copying a skill into a project that also inherits the caller's
 skills and configuration. Only authentication is copied, when present, and it
-is removed even with `REA_AGENT_EVAL_KEEP_FIXTURES=true`. No user configuration,
+is removed after confirmed process cleanup even with
+`REA_AGENT_EVAL_KEEP_FIXTURES=true`. No user configuration,
 rules, plugins or history is copied; shell snapshots and additional agents are
 disabled. Existing API-key environment authentication remains available.
 The native missing-provider scenario preapproves only `open_binary` and
@@ -91,17 +91,20 @@ same bundle. Export writes only the caller-selected output file.

 ## Facts and uncertainty

-| Family       | Evidence used                                                                                                                                                                                    |
-| ------------ | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ |
-| .NET         | A PE optional header declares a nonempty CLI directory.                                                                                                                                          |
-| Unity Mono   | A managed assembly below `*_Data/Managed` or `Contents/Resources/Data/Managed` has an exact UnityEngine assembly reference.                                                                      |
-| Unity IL2CPP | An IL2CPP metadata header coexists with a conventionally named native `GameAssembly.dll`, `GameAssembly.so`, `GameAssembly.dylib` or `libil2cpp.so` image. Build correspondence remains unknown. |
-| Godot        | A `GDPC` header at file start or a validated executable trailer offset.                                                                                                                          |
-| GameMaker    | A bounded `FORM` container starts with a `GEN8` chunk.                                                                                                                                           |
-| Unreal       | `Content/Paks` path conventions or an IoStore TOC signature; arbitrary `.pak` filenames are insufficient.                                                                                        |
-| Electron     | A `resources/app.asar` or `resources/default_app.asar` path convention; archive validity is unverified.                                                                                          |
+| Family       | Evidence used                                                                                                                                                                                                                                  |
+| ------------ | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
+| .NET         | A PE optional header declares a nonempty CLI directory.                                                                                                                                                                                        |
+| Unity Mono   | A managed assembly below `*_Data/Managed` or `Contents/Resources/Data/Managed` has an exact UnityEngine assembly reference.                                                                                                                    |
+| Unity IL2CPP | A recognized IL2CPP metadata magic (with the raw version when complete) coexists with a conventionally named native `GameAssembly.dll`, `GameAssembly.so`, `GameAssembly.dylib` or `libil2cpp.so` image. Build correspondence remains unknown. |
+| Godot        | A `GDPC` header at file start or a validated executable trailer offset.                                                                                                                                                                        |
+| GameMaker    | A bounded `FORM` container starts with a `GEN8` chunk.                                                                                                                                                                                         |
+| Unreal       | `Content/Paks` path conventions or an IoStore TOC signature; arbitrary `.pak` filenames are insufficient.                                                                                                                                      |
+| Electron     | A `resources/app.asar` or `resources/default_app.asar` path convention; archive validity is unverified.                                                                                                                                        |

-An observed metadata header with supported raw version 29, 31 or 39 offers an
+When the four-byte metadata magic is present but version bytes are incomplete,
+the fact retains `raw_version: null`; it does not offer an IL2CPP metadata
+inspection probe. A complete magic/version prefix with supported raw version 29,
+31 or 39 offers an
 `inspect_il2cpp_metadata` follow-up at its admitted file path, including when no
 native library was found. This probe does not establish full metadata validity
 or correspondence to a native binary. See [IL2CPP metadata](il2cpp-metadata.md).
@@ -6,6 +6,22 @@ For remote devices, pass a host with an optional port (`host[:port]`; bracket IP

 MCP exposes `list_frida_devices`, `list_frida_processes`, `start_frida_session`, `load_frida_script`, `resume_frida_session`, `unload_frida_script`, `frida_session_status`, and `close_frida_session`. A spawned process starts paused so scripts can load first. Closing unloads session scripts and detaches. If a spawn remains paused, REA resumes it only after script cleanup or session detach confirms the instrumentation is released; if both cleanup paths fail, the target stays paused and the cleanup error is retained. REA never kills the target. MCP sessions end with the server process. The one-shot CLI command `instrument-with-frida` accepts one inline script or script file, observes messages for a bounded duration, and returns Evidence with the source hash and captured messages.

+For state and capture-coverage checks, pass `{"session_id":"SESSION_ID","detail":"summary"}` to `frida_session_status`. Each call reads the observed session state and retains the complete observation. The reply is an `inspect_analysis_view` Evidence summary with the session identity, state, scripts, `messages_retained`, and `messages_truncated`; message payloads remain in its `parent_evidence_id`. The count covers retained queued messages, not every target event. Omitted `detail` or `detail=complete` preserves the existing complete reply.
+
+A summary's selected fields look like this (excerpt):
+
+```json
+{
+  "summary": {
+    "state": "running",
+    "messages_retained": 50,
+    "messages_truncated": false
+  }
+}
+```
+
+Use `get_evidence_bundle` with `detail="summary"` and `filters={"evidence_id":"PARENT_ID"}` to discover parent metadata without message payloads. Filters apply only to summary delivery. Use `export_evidence_bundle` for the complete canonical bundle, then select the record whose `evidence_id` matches `normalized_result.parent_evidence_id` from the status summary. To use the existing CLI `inspect-analysis-view`, extract that record into a standalone Evidence JSON file and select it as an Evidence-file source with `view={"kind":"summary"}`. Reading retained Evidence does not refresh a live session or verify a process after exit or PID reuse.
+
 Failed startup cleanup retains acquired Frida handles, including a paused spawn that has not attached, for later cleanup retries. Its remote connection stays leased until session detach and target resume complete. CLI commands await provider cleanup before returning; MCP retains these resources for cleanup when its server closes. Server shutdown stops admitting new Frida operations and waits for admitted startup, discovery, and queued work before releasing their resources. A failed cleanup remains reported and can be retried by closing the server again, rather than treating an unregistered session as fully released.

 Frida scripts execute inside the selected target with that process's memory, filesystem, and network authority. Message capture is bounded to 16 MiB and reports truncation. Script source is not stored in Evidence; its selected path and SHA-256 digest are. For a file, `source_sha256` identifies the original selected bytes. Invalid UTF-8 continues to use replacement decoding; Evidence then records that limitation and `raw_result.source_representation` with the encoding, decoding mode, and `loaded_source_sha256` of the UTF-8 string passed to Frida. Valid UTF-8 files and inline scripts do not need this additional representation fact. Evidence retains non-authentication target selection such as device or endpoint, mode, program or PID, and spawn arguments. Authentication values remain excluded. Results report the observed session and messages, while unsupported platform metadata remains unknown. A request cancelled before a Frida operation starts has no provider effects. If cancellation arrives during a native Frida call, REA waits for that call to return, then closes any session it created and returns the observed session as a partial observation. A cancelled script load on an existing session releases only its new script before queued operations can run; the session and previously loaded scripts remain available. If cancellation is observed when the native call returns, partial Evidence retains the source identity and captured messages even if that call rejects, including messages emitted during awaited cleanup. The caller's cancellation reason remains primary and a native rejection is retained as a sanitized diagnostic. A failure already observed before cleanup stays primary if cancellation arrives during cleanup. The cancellation cutoff is REA's observation of native completion, rather than a claim about unobservable native event order. `script_id` is REA's load-attempt identity. When creation rejects without returning a handle, `script_cleanup: "no_handle"` means REA acquired no handle to unload; it does not prove that the engine performed no work. Once the provider commits a successful load, later request cancellation does not unload that script; use `unload_frida_script` to release it. If script cleanup fails, the script remains owned and a paused target cannot resume until the pending instrumentation is released. Queued script loads, resumes, and unloads check cancellation before dispatching native effects. Cancellation Evidence separately reports whether a target resume was observed, whether instrumentation cleanup completed, and that final target liveness remains unknown. REA does not kill the target. Remote discovery retains its observations and reports a separate cleanup error if the temporary connection cannot be removed.
@@ -19,6 +19,56 @@ requires an absolute filesystem path and preserves that exact selection:
 }
 ```

+For build identity and counts, select `detail: "summary"`. MCP retains the same
+complete Evidence and returns `normalized_result.parent_evidence_id`. Read
+selected dependency versions without reopening the file:
+
+```json
+{
+  "name": "inspect_analysis_view",
+  "arguments": {
+    "source": {
+      "kind": "retained-evidence",
+      "evidence_id": "ev_<parent digest>"
+    },
+    "view": {
+      "kind": "go",
+      "collection": "dependencies",
+      "paths": ["golang.org/x/crypto"],
+      "fields": ["path", "version", "replacement"],
+      "offset": 0,
+      "limit": 10
+    }
+  }
+}
+```
+
+Go views support `dependencies` (exact `paths`) and `settings` (exact `keys`),
+optional original `indices`, field selection, and pagination. Filters intersect;
+empty filter arrays select no rows and `fields: []` returns only row identity.
+Each row keeps its original `index`, scoped to the parent Evidence and collection;
+duplicate module paths and setting keys keep distinct indices. Page offsets
+count matching records. Exhausting retained rows does not establish complete
+runtime dependencies. Original bytes, unknown lines and all complete metadata
+remain in the parent and can be exported as an Evidence bundle.
+
+One-shot CLI summaries save complete Evidence before returning the projection:
+
+```bash
+rea inspect-go-binary ./application --detail summary --evidence_output ./go-evidence.json --json
+```
+
+`--evidence_output` is required for CLI summary delivery and never overwrites an
+existing file. The default CLI/MCP reply remains complete.
+
+[Measured workflows](../experiments/analysis-efficiency/go-build-views.md) include
+catalog repetition and extra calls. Identity/count questions benefit from a
+single summary. In the tested Codex full-catalog configuration, a compound
+question about identity and one dependency uses fewer tokens in captured request JSON with
+one complete inspection than with a summary followed by a lookup. The complete
+reply remains useful for that initial question; retained views support later
+selected reads. Token figures are serialization estimates, not model usage.
+
 ## Observations

 The inline Evidence result contains the artifact path, SHA-256, byte length,
@@ -340,6 +340,13 @@ A scoped report has `scope.mode: "explicit"`. Its `scope_checks` determine
 `environment_healthy` summarizes the full audit. `--target` adds a target check,
 but the report remains audit-wide unless a scope option is also supplied.

+An invalid `REA_LOG_LEVEL` fails every scope, including one client or the
+installed skill, because the executable rejects it before any command. A
+selected client also fails for every other setting that MCP startup rejects,
+including `REA_GHIDRA_STARTUP_TIMEOUT_MS` and `REA_HOPPER_STARTUP_TIMEOUT_MS`.
+Those settings still fail a selected provider and the audit-wide result. A
+skill-only report leaves them informational.
+
 Follow the remediation for the failed check. If a native target has several
 available providers, choose one with `--provider` on the CLI or `provider_id`
 on `open_binary`. A `capability_unavailable` failure carries
@@ -95,9 +95,10 @@ optional bounded `recovery` next step. `recovery.kind=inspect_input_contract`
 names the rejected operation: re-read that operation's advertised input schema
 (call `tools/list` if the catalog may be stale), correct the listed fields, and
 do not repeat the unchanged call. `recovery.kind=inspect_timeout_state` names
-the operation and the REA server/provider deadline; inspect session/provider
-state before retrying, and raise the MCP client's tool deadline only when the
-client ended the call before REA returned this response. These hints never
+the operation and the REA server/provider deadline; inspect partial Evidence
+and reported cleanup state, then follow producer-specific remediation or reduce
+supported work. Generic errors do not assume adjustable timeout controls. Raising
+only the MCP client's deadline cannot extend this budget. These hints never
 include the complete catalog or caller arguments.
 Failures omit `structuredContent`, since each advertised `outputSchema`
 describes successful results. Successful replies retain their schema-validated
@@ -239,6 +240,23 @@ delivery for responses that fit that buffer and Node's single-string limit.
 It does not change the client's buffer, analysis coverage, or retained content.
 Ordinary responses keep their existing complete result contract.

+### Error recovery and deadline ownership
+
+Initialization instructions and the static JavaScript tool description teach
+recovery before a host can discard a tool response. Invalid input calls should be corrected from the connected schema
+(refresh `tools/list` only if stale), not retried unchanged. REA's returned
+`provider_timeout` describes its server/provider deadline; provider-authored
+remediation names the applicable controls and preserves partial Evidence and
+cleanup uncertainty.
+
+A host timeout without a REA result is different: execution and cleanup remain
+unknown. Increasing an advertised `analysis_timeout_ms` cannot fix a shorter
+client deadline. Configure the client's tool timeout with execution, cleanup
+and delivery headroom, or report that change is needed when not authorized.
+Session status does not establish that all target-free work stopped. Detailed
+host settings and bounded retry guidance live in the shipped skill's
+[recovery reference](https://github.com/morluto/rea/blob/main/.agents/skills/reverse-engineer-anything/references/connection-and-recovery.md#distinguish-client-and-server-deadlines).
+
 ### Untrusted target content

 Strings, symbols, decompiled code and pseudocode, page text, script bodies,
@@ -510,6 +528,17 @@ concrete version, selection source, and complete analysis profile through
 choices return typed selection details. A selected provider is never replaced
 automatically after a runtime failure.

+`open_bundle_resources` selects a separate read-only app resource session
+without resolving `CFBundleExecutable`, including when it is absent or
+unresolvable. `binary_session` reports `session_kind: "bundle_resources"` and the
+caller and canonical resource-root paths; it does not report a binary target or
+deep-provider binding. `inspect_plist`, `decode_interface_builder`,
+`inspect_asset_catalog`, and `inspect_keyed_archive` retain resource-root
+provenance and use a null Evidence subject when executable identity is unknown.
+Binary-only operations and binary analysis snapshots do not apply in this
+session. `open_binary` can switch back to executable analysis, and
+`close_binary` retires either session kind.
+
 Each provider client receives `binary_session.analysis_run.run_id` before any
 provider startup, including clients whose startup fails. `process_lineage` is
 `not_observed` until a dynamic provider starts, then becomes `snapshots` with
@@ -0,0 +1,145 @@
+# Model file declarations
+
+Use `inspect_model_artifact` (CLI: `inspect-model-artifact`) to inspect a local
+GGUF v2/v3 or safetensors file. Detection uses content, including GGUF byte
+order, rather than its extension. REA does not load a model, interpret weights,
+run inference, import Python, open external-data references or use the network.
+
+```bash
+rea inspect-model-artifact /absolute/path/model.gguf --json
+rea inspect-model-artifact /absolute/path/model.safetensors --hash full --json
+```
+
+The CLI defaults to complete Evidence. For compact delivery with portable access
+to every retained observation:
+
+```bash
+rea inspect-model-artifact /absolute/path/model.gguf \
+  --detail summary --evidence_output /absolute/path/model-evidence.json --json
+```
+
+## Identity and reads
+
+The default `hash: "header"` reads only the metadata and tensor directory. The
+result records the exact selected path, file size, header length, header SHA-256,
+bytes read and read scope. GGUF alignment padding is outside this prefix.
+`artifact.sha256` and the Evidence subject are null: a header digest is not a
+commitment to the weights. Different files can have identical headers and sizes.
+
+`hash: "full"` additionally streams the remaining file bytes through SHA-256.
+It returns a full-file digest and Evidence subject, while retaining the same
+header digest. It uses bounded buffers and does not interpret tensor data, but
+it does read the whole file. Cost therefore grows with file size. Both modes
+check descriptor and selected-path identity and metadata before completion;
+this detects observed replacement or modification, not adversarial modification
+that defeats filesystem metadata checks.
+
+## Facts and selected queries
+
+GGUF reports version, byte order, alignment, typed metadata, and each tensor's
+name, original type ID, dimensions, relative data offset, file offset and derived
+byte length. Alignment accepts every positive UINT32 multiple of eight, including
+non-powers of two. Metadata keys use ASCII lower-snake-case hierarchy components;
+standard numeric components such as `general.base_model.0.name` are preserved.
+Scalar metadata is complete. Arrays have declared element types,
+counts and at most eight preview elements per array, with an explicit
+`preview_complete` flag. This includes tokenizer vocabularies: omitted values
+are not silently represented as a complete array. Strings are UTF-8; 64-bit
+integer metadata and all shape dimensions use decimal strings without rounding.
+Nonfinite floating metadata uses `NaN`, `+Infinity` or `-Infinity` with its
+declared float type; negative zero is `"-0"`. Unknown tensor types retain their numeric IDs and null byte
+lengths; affected totals and storage validation remain unknown.
+
+Safetensors reports the header extent, exact string `__metadata__` values, dtype,
+shape and declared data ranges. JSON duplicate keys, invalid UTF-8, out-of-file
+ranges, overlaps, gaps, trailing unindexed data and known dtype/shape byte-length
+contradictions are rejected with a typed `file_format_rejected` constraint (public code `target_unavailable`, category `unsupported_target`). Empty
+tensors and scalar shapes are supported; packed sub-byte types require whole
+byte storage. Unknown dtypes retain declared ranges and an explicit limitation
+that shape-to-storage validation is unavailable. Each tensor records
+`storage_validation: "consistent" | "unknown"`; `coverage.storage_sizes` remains
+partial when that consistency cannot be checked. Tensor filters accept these
+`storage_validation` states independently of dtype or name.
+
+Parameter counts and per-type totals are **derived from declarations**, not
+measurements of effective parameters or inference behavior. Shared or repeated
+weights are not deduplicated. GGUF dimensions retain their original fastest-first
+order; safetensors shapes retain JSON order. Safetensors tensor rows use name
+order; GGUF rows use directory order. An index identifies a declaration within
+its collection and header digest, not tensor contents or a cross-version match.
+GGUF supports zero extents and scalar shapes, with at most four dimensions;
+known quantized types still require complete blocks in the first dimension.
+
+MCP defaults to a compact summary with counts, selected short headline metadata,
+chat-template presence and derived totals. The full type histogram and all rows
+remain in complete Evidence. Headline metadata uses short keys/types and scalar
+values; long or compound values remain available through explicit metadata
+queries. Use the returned `parent_evidence_id`:
+
+```json
+{
+  "source": {
+    "kind": "retained-evidence",
+    "evidence_id": "<parent_evidence_id>"
+  },
+  "view": {
+    "kind": "model-artifact",
+    "collection": "tensors",
+    "names": ["token_embd.weight", "output.weight"],
+    "fields": ["name", "type", "shape", "file_offset", "byte_length"],
+    "offset": 0,
+    "limit": 32
+  }
+}
+```
+
+To answer a known question in the initial inspection, pass the same selection
+without `kind` as `inspect_model_artifact`'s optional `view`, for example
+`{"path":"/absolute/path/model.gguf","view":{"collection":"tensors","names":["token_embd.weight"],"fields":["type","shape","file_offset"]}}`.
+This returns one selected page with compact model context and retains the full
+source Evidence, avoiding another tool call. `view` requires summary delivery;
+complete detail and a selection are rejected as conflicting choices.
+CLI uses `--view '{"collection":"tensors","names":["token_embd.weight"]}'`
+with `--detail summary --evidence_output FILE`.
+
+Call `inspect_analysis_view` with the historical query object above for further pages. `collection: "metadata"` accepts
+exact `keys`, indices, fields and paging; use it for `tokenizer.chat_template`
+or tokenizer array previews. `collection: "types"` pages derived storage and
+parameter totals and accepts exact `types`. Tensor pages also accept `types`.
+Filters intersect; omitted filters mean all recorded rows and empty arrays mean
+none. Every row retains its source-scoped index. Names, keys and type labels
+follow field selection; `fields: []` returns only indices. Omitted fields return
+all recorded columns. Compact warnings use the shared bounded view budget and
+link to complete parent Evidence when messages are omitted. Page offsets count filtered
+matches, while row indices retain their original scope. Each page carries source
+identity, header coverage, array omissions, unknowns and parent Evidence links.
+
+Pages read historical retained facts without reopening the model. Complete
+Evidence can also be supplied inline or as a single authenticated Evidence JSON
+record through `source: {"kind": "evidence-file", "path": "/absolute/path/model-record.json"}`.
+CLI Evidence bundles contain a `records` array; import the bundle with
+`import_evidence_bundle` before using retained queries, or save one complete
+record as a standalone Evidence file. A bundle is not a single Evidence record.
+The session owns validated indexes until that Evidence is released; there is no
+live-file result cache or automatic freshness claim.
+Imported reports must retain positional indices and unique names, keys and
+type identities; malformed reports return a typed input error before indexing.
+
+## Bounds and unsupported inputs
+
+The reader admits one active inspection per provider. It enforces a 100,000,000
+byte header ceiling (safetensors counts its declared JSON bytes separately from
+the fixed eight-byte length prefix; GGUF counts the complete header) and a separate 32 MiB
+retained representation budget before retaining rows or expanding strings.
+Numeric products use exact integer arithmetic. GGUF follows its four-dimensional
+tensor layout and limits metadata array nesting to 32 frames. Resource refusals
+are typed, rather than returned as complete empty inventories. Cancellation
+joins descriptor finalization; failed cleanup remains owned for retry.
+
+PyTorch pickle and ZIP model deserialization are unsupported; convert using a
+trusted external workflow and supply GGUF or safetensors. ONNX, TFLite, Core ML,
+model execution and conversion are outside this operation.
+
+Format references: [GGUF specification](https://github.com/ggml-org/ggml/blob/da8e2a54b919557b816b1c2beb432ccb766f7ce0/docs/gguf.md),
+[ggml tensor layouts](https://github.com/ggml-org/ggml/blob/da8e2a54b919557b816b1c2beb432ccb766f7ce0/src/ggml-common.h),
+[safetensors format](https://github.com/huggingface/safetensors/tree/e246a2560645b7525f5775669ed816eb57c5bcc8#format).
@@ -425,6 +425,10 @@ complete observation.
  vtable descriptors. Records include exact virtual addresses/file offsets and
  artifact evidence. Vtable indexes are metadata word offsets; witness indexes
  start after the conformance header. Names unavailable in metadata remain null.
+  The `swift_class_vtable_descriptors` coverage counters count examined vtable
+  slots and successfully decoded slots, rather than type-section entries.
+  The `objc_class_method_ivar_metadata` counters count admitted class and
+  metaclass objects and successfully decoded objects.
  Pointers are decoded through the image's fixups:
  - `LC_DYLD_CHAINED_FIXUPS` rebases and binds, including the authenticated
    arm64e formats;
@@ -466,6 +470,21 @@ complete observation.
  that operation is unavailable; runtime failures remain failures rather than
  being replaced by symbol-only results.

+`get_objc_classes` keeps names from the provider inventory. It coalesces rows
+only when their exact selected-image pointer slots decode to the same class
+import, including its binding stream, raw library ordinal, resolved library, weak status, and addend. A literal filter is
+applied to the original names before that join; if the filter selects only an
+alias, the output keeps that exact row. `identity_coverage` distinguishes a
+complete selected-inventory scan from partial, unsupported, and unknown cases.
+Recognized Mach-O formats outside the native metadata reader's support retain
+the provider's class labels with unknown import identity; malformed headers and
+read failures remain errors.
+The join also requires matching whole-artifact digests and matching provider-
+owned selected-image facts: container, byte range, full raw CPU type/subtype,
+and FAT table digest when present. A missing or overridden loader selection
+remains unknown; the result describes agreement on the selected artifact image,
+not an atomic observation of a running process or whole-program class coverage.
+
 ## Native desktop observation

 `observe_native_ui` captures one explicitly selected existing PID/window ID.
@@ -266,6 +266,7 @@ npx rea-agents@latest setup

 - [التثبيت والإعداد](../installation.md): تسجيل الوكلاء، وتهيئة الموفّرين، والتحديثات، وإلغاء التثبيت.
 - [الجاهزية واستكشاف الأخطاء](../installation.md#check-readiness-for-your-task): تشخيص وكيل أو محرك تحليل محدد.
+- [GGUF / safetensors](../model-artifacts.md)
 - [CLI وEvidence](../cli.md): الأوامر، واختيار الموفّر، واللقطات، والاستيراد/التصدير، وحالات الخروج.
 - [عقود MCP](../mcp-contracts.md) و[تعليمات الوكلاء](../mcp-prompts.md): نتائج الأدوات، والجلسات، والاستقصاءات الموجّهة.
 - [كتالوج الأدوات](../mcp-contracts.md#generated-catalog): قائمة الأدوات والموفّرين وأوامر CLI المولّدة أثناء البناء.
@@ -264,6 +264,7 @@ Beginne mit den [praxisnahen Anleitungen](https://rea.tools/de/guides/) auf der

 - [Installation und Einrichtung](../installation.md): Agentenregistrierung, Provider-Konfiguration, Updates und Deinstallation.
 - [Bereitschaft und Fehlerbehebung](../installation.md#check-readiness-for-your-task): Diagnose eines bestimmten Agenten oder einer Analyse-Engine.
+- [GGUF / safetensors](../model-artifacts.md)
 - [CLI und Evidence](../cli.md): Befehle, Provider-Auswahl, Snapshots, Import/Export und Exit-Status.
 - [MCP-Kontrakte](../mcp-contracts.md) und [Agenten-Prompts](../mcp-prompts.md): Werkzeugergebnisse, Sitzungen und geführte Untersuchungen.
 - [Werkzeugkatalog](../mcp-contracts.md#generated-catalog): Beim Build erzeugtes Inventar von Werkzeugen, Providern und CLI-Befehlen.
@@ -277,6 +277,7 @@ npx rea-agents@latest setup

 - [Εγκατάσταση και ρύθμιση](../installation.md): καταχώριση agents, ρύθμιση παρόχων ανάλυσης, ενημερώσεις και απεγκατάσταση.
 - [Έλεγχος ετοιμότητας και αντιμετώπιση προβλημάτων](../installation.md#check-readiness-for-your-task): διάγνωση ενός agent ή μιας μηχανής ανάλυσης.
+- [GGUF / safetensors](../model-artifacts.md)
 - [CLI και Evidence](../cli.md): εντολές, επιλογή παρόχου, στιγμιότυπα, εισαγωγή/εξαγωγή και κωδικοί εξόδου.
 - [Προδιαγραφές MCP](../mcp-contracts.md) και [prompts για agents](../mcp-prompts.md): αποτελέσματα εργαλείων, συνεδρίες και καθοδηγούμενες διερευνήσεις.
 - [Κατάλογος εργαλείων](../mcp-contracts.md#generated-catalog): αυτόματα παραγόμενος κατάλογος εργαλείων, παρόχων και εντολών CLI.
@@ -264,6 +264,7 @@ Empieza con las [guías prácticas](https://rea.tools/es/guides/) del sitio web.

 - [Instalación y configuración](../installation.md): registro de agentes, configuración de proveedores, actualizaciones y desinstalación.
 - [Preparación y resolución de problemas](../installation.md#check-readiness-for-your-task): diagnóstico de un agente o motor de análisis concreto.
+- [GGUF / safetensors](../model-artifacts.md)
 - [CLI y Evidence](../cli.md): comandos, selección de proveedores, instantáneas, importación/exportación y estados de salida.
 - [Contratos de MCP](../mcp-contracts.md) y [prompts para agentes](../mcp-prompts.md): resultados de herramientas, sesiones e investigaciones guiadas.
 - [Catálogo de herramientas](../mcp-contracts.md#generated-catalog): inventario de herramientas, proveedores y comandos de CLI generado durante la compilación.
@@ -249,6 +249,7 @@ npx rea-agents@latest setup

 - [نصب و راه‌اندازی](../installation.md): ثبت ایجنت، پیکربندی ارائه‌دهنده، به‌روزرسانی و حذف نصب.
 - [آمادگی و رفع اشکال](../installation.md#check-readiness-for-your-task): عیب‌یابی یک ایجنت یا موتور تحلیل.
+- [GGUF / safetensors](../model-artifacts.md)
 - [CLI و شواهد](../cli.md): دستورات، انتخاب ارائه‌دهنده، snapshotها، ورود/خروج داده و وضعیت‌های خروج.
 - [قراردادهای MCP](../mcp-contracts.md) و [پرامپت‌های ایجنت](../mcp-prompts.md): نتایج ابزارها، نشست‌ها و بررسی‌های هدایت‌شده.
 - [فهرست ابزارها](../mcp-contracts.md#generated-catalog): فهرست تولیدشده هنگام build از ابزارها، ارائه‌دهندگان و دستورات CLI.
@@ -268,6 +268,7 @@ Commencez par les [guides pas à pas](https://rea.tools/fr/guides/) du site web.

 - [Installation et configuration](../installation.md) : enregistrement des agents, configuration des fournisseurs, mises à jour et désinstallation.
 - [Vérification et dépannage](../installation.md#check-readiness-for-your-task) : diagnostiquer un agent ou un moteur d'analyse donné.
+- [GGUF / safetensors](../model-artifacts.md)
 - [CLI et Evidence](../cli.md) : commandes, choix du fournisseur, snapshots, import/export et codes de sortie.
 - [Contrats MCP](../mcp-contracts.md) et [prompts pour agents](../mcp-prompts.md) : résultats des outils, sessions et investigations guidées.
 - [Catalogue des outils](../mcp-contracts.md#generated-catalog) : inventaire des outils, fournisseurs et commandes CLI, généré lors du build.
@@ -289,6 +289,7 @@ Untuk mengetahui opsi, prasyarat, dan kontrak hasil secara tepat:

 - [Instalasi dan penyiapan](../installation.md): pendaftaran agen, konfigurasi penyedia, pembaruan, dan penghapusan instalasi.
 - [Kesiapan dan pemecahan masalah](../installation.md#check-readiness-for-your-task): mendiagnosis satu agen atau mesin analisis.
+- [GGUF / safetensors](../model-artifacts.md)
 - [CLI dan Bukti](../cli.md): perintah, pemilihan penyedia, snapshot, impor/ekspor, dan status keluar.
 - [Kontrak MCP](../mcp-contracts.md) dan [prompt agen](../mcp-prompts.md): hasil alat, sesi, dan investigasi terpandu.
 - [Katalog alat](../mcp-contracts.md#generated-catalog): inventaris alat, penyedia, dan perintah CLI yang dibuat secara otomatis.
@@ -268,6 +268,7 @@ Inizia dalle [guide pratiche](https://rea.tools/it/guides/) del sito web. Per op

 - [Installazione e configurazione](../installation.md): registrazione agente, configurazione provider, aggiornamenti e disinstallazione.
 - [Pronto all'uso e risoluzione dei problemi](../installation.md#check-readiness-for-your-task): diagnostica un agente o un motore di analisi.
+- [GGUF / safetensors](../model-artifacts.md)
 - [CLI ed Evidence](../cli.md): comandi, selezione provider, snapshot, import/export e stati di uscita.
 - [Contratti MCP](../mcp-contracts.md) e [prompt agente](../mcp-prompts.md): risultati degli strumenti, sessioni e indagini guidate.
 - [Catalogo strumenti](../mcp-contracts.md#generated-catalog): inventario generato di strumenti, provider e comandi CLI.
@@ -266,6 +266,7 @@ npx rea-agents@latest setup

 - [インストールとセットアップ](../installation.md)：エージェントの登録、プロバイダーの設定、更新、アンインストール。
 - [準備状況の確認とトラブルシューティング](../installation.md#check-readiness-for-your-task)：特定のエージェントや分析エンジンを診断。
+- [GGUF / safetensors](../model-artifacts.md)
 - [CLI と Evidence](../cli.md)：コマンド、プロバイダーの選択、スナップショット、インポート／エクスポート、終了ステータス。
 - [MCP 契約](../mcp-contracts.md)と[エージェント向けプロンプト](../mcp-prompts.md)：ツールの結果、セッション、ガイド付き調査。
 - [ツールカタログ](../mcp-contracts.md#generated-catalog)：ビルド時に生成されるツール、プロバイダー、CLI コマンドの一覧。
@@ -279,6 +279,7 @@ npx rea-agents@latest setup

 - [설치 및 설정](../installation.md): 에이전트 등록, 제공자 설정, 업데이트, 제거.
 - [준비 상태 확인 및 문제 해결](../installation.md#check-readiness-for-your-task): 특정 에이전트 또는 분석 엔진 진단.
+- [GGUF / safetensors](../model-artifacts.md)
 - [CLI 및 Evidence](../cli.md): 명령, 제공자 선택, 스냅샷, 가져오기/내보내기, 종료 상태.
 - [MCP 계약](../mcp-contracts.md) 및 [에이전트 프롬프트](../mcp-prompts.md): 도구 결과, 세션, 안내에 따른 조사.
 - [도구 카탈로그](../mcp-contracts.md#generated-catalog): 빌드 시 생성되는 도구, 제공자, CLI 명령 목록.
@@ -282,6 +282,7 @@ npx rea-agents@latest setup

 - [Installation and setup](../installation.md): agent registration, provider configuration, updates, uninstall.
 - [Readiness and troubleshooting](../installation.md#check-readiness-for-your-task): ഒരു agent-ന്റെയോ analysis engine-ന്റെയോ പ്രശ്നങ്ങൾ കണ്ടെത്തുക.
+- [GGUF / safetensors](../model-artifacts.md)
 - [CLI and Evidence](../cli.md): commands, provider തിരഞ്ഞെടുക്കൽ, snapshots, import/export, exit statuses.
 - [MCP contracts](../mcp-contracts.md), [agent prompts](../mcp-prompts.md): tool results, sessions, guided investigations.
 - [Tool catalog](../mcp-contracts.md#generated-catalog): tools, providers, CLI commands എന്നിവയുടെ സ്വയമേവ സൃഷ്ടിച്ച പട്ടിക.
@@ -264,6 +264,7 @@ Zacznij od [przewodników z przykładami](https://rea.tools/pl/guides/) na stron

 - [Instalacja i konfiguracja](../installation.md): rejestracja agentów, konfiguracja dostawców analizy, aktualizacje i odinstalowanie.
 - [Gotowość i rozwiązywanie problemów](../installation.md#check-readiness-for-your-task): diagnostyka jednego agenta lub silnika analizy.
+- [GGUF / safetensors](../model-artifacts.md)
 - [CLI i Evidence](../cli.md): polecenia, wybór dostawcy, migawki, import/eksport i kody zakończenia.
 - [Kontrakty MCP](../mcp-contracts.md) i [prompty dla agentów](../mcp-prompts.md): wyniki narzędzi, sesje i prowadzone analizy.
 - [Katalog narzędzi](../mcp-contracts.md#generated-catalog): generowany podczas kompilacji wykaz narzędzi, dostawców i poleceń CLI.
@@ -264,6 +264,7 @@ Comece pelos [guias práticos](https://rea.tools/pt-BR/guides/) do site. Para op

 - [Instalação e configuração](../installation.md): registro de agentes, configuração de provedores, atualizações e desinstalação.
 - [Prontidão e solução de problemas](../installation.md#check-readiness-for-your-task): diagnóstico de um agente ou motor de análise específico.
+- [GGUF / safetensors](../model-artifacts.md)
 - [CLI e Evidence](../cli.md): comandos, seleção de provedores, snapshots, importação/exportação e status de saída.
 - [Contratos MCP](../mcp-contracts.md) e [prompts para agentes](../mcp-prompts.md): resultados das ferramentas, sessões e investigações guiadas.
 - [Catálogo de ferramentas](../mcp-contracts.md#generated-catalog): inventário de ferramentas, provedores e comandos da CLI gerado durante o build.
@@ -264,6 +264,7 @@ npx rea-agents@latest setup

 - [Установка и настройка](../installation.md): регистрация агентов, настройка провайдеров, обновление и удаление.
 - [Готовность и устранение неполадок](../installation.md#check-readiness-for-your-task): диагностика конкретного агента или движка анализа.
+- [GGUF / safetensors](../model-artifacts.md)
 - [CLI и Evidence](../cli.md): команды, выбор провайдера, снимки, импорт/экспорт и коды завершения.
 - [Контракты MCP](../mcp-contracts.md) и [промпты агентов](../mcp-prompts.md): результаты инструментов, сеансы и исследования с подсказками.
 - [Каталог инструментов](../mcp-contracts.md#generated-catalog): создаваемый при сборке перечень инструментов, провайдеров и команд CLI.
@@ -264,6 +264,7 @@ npx rea-agents@latest setup

 - [การติดตั้งและตั้งค่า](../installation.md): การลงทะเบียนเอเจนต์ การตั้งค่าผู้ให้บริการ การอัปเดต และการถอนการติดตั้ง
 - [ความพร้อมใช้งานและการแก้ไขปัญหา](../installation.md#check-readiness-for-your-task): ตรวจวินิจฉัยเอเจนต์หรือเอนจินวิเคราะห์หนึ่งตัว
+- [GGUF / safetensors](../model-artifacts.md)
 - [CLI และ Evidence](../cli.md): คำสั่ง การเลือกผู้ให้บริการ สแนปช็อต การนำเข้า/ส่งออก และรหัสการสิ้นสุด
 - [สัญญา MCP](../mcp-contracts.md) และ[พรอมป์ต์สำหรับเอเจนต์](../mcp-prompts.md): ผลลัพธ์เครื่องมือ เซสชัน และการตรวจสอบตามคำแนะนำ
 - [แค็ตตาล็อกเครื่องมือ](../mcp-contracts.md#generated-catalog): รายการเครื่องมือ ผู้ให้บริการ และคำสั่ง CLI ที่สร้างระหว่างการบิลด์
@@ -269,6 +269,7 @@ Web sitesindeki [uygulamalı rehberlerden](https://rea.tools/tr/guides/) başlay

 - [Yükleme ve kurulum](../installation.md): ajan kaydı, sağlayıcı yapılandırması, güncellemeler ve kaldırma.
 - [Hazırlık ve sorun giderme](../installation.md#check-readiness-for-your-task): belirli bir ajanı veya analiz motorunu tanılama.
+- [GGUF / safetensors](../model-artifacts.md)
 - [CLI ve Evidence](../cli.md): komutlar, sağlayıcı seçimi, anlık görüntüler, içe/dışa aktarma ve çıkış durumları.
 - [MCP sözleşmeleri](../mcp-contracts.md) ve [ajan istemleri](../mcp-prompts.md): araç sonuçları, oturumlar ve yönlendirmeli araştırmalar.
 - [Araç kataloğu](../mcp-contracts.md#generated-catalog): derleme sırasında oluşturulan araç, sağlayıcı ve CLI komutu envanteri.
@@ -264,6 +264,7 @@ npx rea-agents@latest setup

 - [Встановлення й налаштування](../installation.md): реєстрація агентів, конфігурація провайдерів, оновлення та видалення.
 - [Готовність та усунення неполадок](../installation.md#check-readiness-for-your-task): діагностика конкретного агента або рушія аналізу.
+- [GGUF / safetensors](../model-artifacts.md)
 - [CLI та Evidence](../cli.md): команди, вибір провайдера, знімки, імпорт/експорт і статуси завершення.
 - [Контракти MCP](../mcp-contracts.md) і [промпти агентів](../mcp-prompts.md): результати інструментів, сеанси й керовані дослідження.
 - [Каталог інструментів](../mcp-contracts.md#generated-catalog): створюваний під час збірки перелік інструментів, провайдерів і команд CLI.
@@ -264,6 +264,7 @@ Bắt đầu với [hướng dẫn thực hành](https://rea.tools/vi/guides/) t

 - [Cài đặt và thiết lập](../installation.md): đăng ký tác nhân, cấu hình trình phân tích, cập nhật và gỡ cài đặt.
 - [Kiểm tra mức sẵn sàng và khắc phục sự cố](../installation.md#check-readiness-for-your-task): chẩn đoán một tác nhân hoặc bộ máy phân tích cụ thể.
+- [GGUF / safetensors](../model-artifacts.md)
 - [CLI và Evidence](../cli.md): lệnh, lựa chọn trình phân tích, ảnh chụp trạng thái, nhập/xuất và trạng thái thoát.
 - [Hợp đồng MCP](../mcp-contracts.md) và [prompt cho tác nhân](../mcp-prompts.md): kết quả công cụ, phiên làm việc và điều tra có hướng dẫn.
 - [Danh mục công cụ](../mcp-contracts.md#generated-catalog): danh sách công cụ, trình phân tích và lệnh CLI được tạo khi dựng dự án.
@@ -270,6 +270,7 @@ npx rea-agents@latest setup

 - [安裝與設定](../installation.md)：AI 代理註冊、提供者組態、更新和卸載。
 - [就緒檢查與故障排查](../installation.md#check-readiness-for-your-task)：診斷特定 AI 代理或分析引擎。
+- [GGUF / safetensors](../model-artifacts.md)
 - [CLI 與 Evidence](../cli.md)：命令、提供者選擇、快照、匯入/匯出和退出狀態。
 - [MCP 契約](../mcp-contracts.md)和[AI 代理提示詞](../mcp-prompts.md)：工具結果、會話和引導式調查。
 - [工具目錄](../mcp-contracts.md#generated-catalog)：建置時生成的工具、提供者和 CLI 命令清單。
@@ -270,6 +270,7 @@ npx rea-agents@latest setup

 - [安装与设置](../installation.md)：智能体注册、提供方配置、更新和卸载。
 - [就绪检查与故障排查](../installation.md#check-readiness-for-your-task)：诊断特定智能体或分析引擎。
+- [GGUF / safetensors](../model-artifacts.md)
 - [CLI 与 Evidence](../cli.md)：命令、提供方选择、快照、导入/导出和退出状态。
 - [MCP 契约](../mcp-contracts.md)和[智能体提示词](../mcp-prompts.md)：工具结果、会话和引导式调查。
 - [工具目录](../mcp-contracts.md#generated-catalog)：构建时生成的工具、提供方和 CLI 命令清单。
@@ -69,8 +69,14 @@ Source projects also contain large capacity regressions; `test:fast` promises
 no compiled-runtime prerequisite, not a fixed time budget.

 `npm run lint` prints errors and a warning summary; `npm run jscpd` prints
-duplication statistics. Complete reports remain in `.cache/static-checks/` and
-CI uploads them as `static-check-reports`, including after a failed static gate.
+duplication statistics. Complete reports remain in `.cache/static-checks/`.
+The fast gate uploads them as `static-check-reports`. Full qualification
+uploads duplication diagnostics from the deep job as
+`static-deep-check-reports`, including after that gate fails.
+Task-graph recording runs `check:ci:fast:tasks` and `check:ci:deep:tasks`
+without the artifacts lock, so it can record hashes while `check:pr` or
+`check:test` already holds that lock. The CI jobs still run the locked
+`check:ci:fast` and `check:ci:deep` commands.
 Use `npm run lint:details` or `npm run jscpd:details` for all console diagnostics.
 Both duplicate commands scan production and test code with the same 3% limit;
 the summary commands preserve checker failures and restore reports from cached
@@ -140,6 +146,17 @@ the fixture cache. These subprocesses are outside aggregate Vitest coverage;
 subprocess coverage attachment remains disabled. Cold-start import checks launch
 independently without this fixture cache.

+`analyzeJavaScriptDirectory` stdio MCP cases in one `cliTest` file share one
+server and that compile cache. The first case pays startup; later cases reuse
+the process. File teardown waits for startup still in flight, closes a server
+registered during that wait, and does not open a server after close. A failed
+handshake stays the caller error when its cleanup also fails, including a
+rejection without a reason. That cleanup stays owned until a later close or
+call releases it. Another server does not open while the cleanup remains, and
+a cleanup that already succeeded is not run again. Pass
+`mcpCall` when a case needs its own server, environment, or lifecycle. CLI
+cases still start a fresh process.
+
 The Apple artifact verifier step shares a job-temporary bytecode cache among
 its fresh CLI/MCP children via `REA_ARTIFACT_NODE_COMPILE_CACHE`. The artifact
 helper maps this setting to child `NODE_COMPILE_CACHE`; npm, Turbo, and nested
@@ -454,8 +471,8 @@ partial diagnostics and preflights do not establish complete mutation outcomes
 or qualify the release revision for mutation coverage.

 Fast CI starts the source-only projects after classification, independently of
-build and static checks, and runs five built-dependent shards after the build.
-The six test jobs still select every portable test. Full qualification keeps six
+build and static checks, and runs eight built-dependent shards after the build.
+Those nine test jobs still select every portable test. Full qualification keeps six
 complete Vitest shards with coverage. Neither tier retries tests. Canonical
 project ownership lives in `scripts/lib/test-projects.mjs`, shared by Vitest,
 CI group execution, and development-test preparation. A test importing compiled
@@ -481,14 +498,16 @@ real-system lanes remain separate jobs so one kind of evidence cannot stand in
 for another. Workflow syntax and expression validation runs inside the required
 static-check job when workflow changes select it, avoiding a separate runner.
 Native, provider, fixture, SQLite compatibility, and website lanes wait for
-static checks to succeed before allocating their runners. This avoids spending
-those runner slots on revisions that already fail static validation. Portable
-test shards and documentation checks remain independent of static results, so
-they can still provide diagnostic feedback. The required gate rejects skipped
-selected lanes when static checks fail; passing revisions retain all selected
-coverage. This ordering reduces peak demand on invalid revisions but can add
-static-check waiting to otherwise passing runs; it is not a measured reduction
-in end-to-end latency.
+the fast static checks (typecheck, built lint, and format) to succeed before
+allocating their runners. Knip, duplication, architecture guards, test
+discovery, and the Python producer run in the separate full-tier deep static
+job and do not gate provider admission. Portable test shards and documentation
+checks remain independent of static results, so they can still provide
+diagnostic feedback. The required gate rejects skipped selected lanes when
+static checks fail; on the full tier it also requires the deep static job.
+Passing revisions retain all selected coverage. This ordering reduces peak
+demand on invalid revisions but can add static-check waiting to otherwise
+passing runs; it is not a measured reduction in end-to-end latency.

 Core jobs have execution limits of five minutes for classification, ten minutes
 for static checks, builds, docs, and report merging, and thirty minutes per
@@ -514,11 +533,35 @@ JSON artifact members without executing artifact content. Reports and limits
 are retained in `ci-health-diagnostics`; its ten-minute job limit covers the
 existing four-minute timing collection plus the bounded diagnostic stages.

-Shard-count reduction remains deferred: the available successful timing sample
-covers an older inventory, and file phase weights are not job wall time. The
-one-source/five-built split retains six test jobs; it makes no hosted speedup
-claim. Current complete timings and completed candidate hosted runs are needed
-before enabling a smaller adaptive matrix.
+Fast built shards target under ten minutes of uncontended shard-job execution.
+That figure is the `test-shard` job. The job waits for classification and the
+build, and the portable-test merge runs after the slowest shard. On 2026-10-20,
+run `39451548945` measured those surrounding jobs with runner queue excluded:
+classification 15 seconds, build 49 seconds, and the portable-test merge 29
+seconds. Shard 1/5 of that run spent 22 seconds before built Vitest and 3
+seconds after it, including `npm ci` at 9 seconds. `node_modules` is about 674
+MiB, so publishing it as a shared artifact would transfer more data than that
+install saves. The npm download cache stays the setup cache.
+
+File timings from that run put the built suite at 7944 seconds of module time.
+The sequencer keeps each file's full duration on one worker. Extra workers
+overlap other files in the same sequence group, and `process-boundary` runs
+after that group. Scheduling the unsplit inventory onto five shards peaks at
+820 seconds of tests. That run's slowest built shard job lasted 925 seconds
+(shard 4/5), and shard 1/5 spent 874 seconds in built Vitest, so hosted job
+time sits above the file schedule. Six shards of the same inventory peak at
+684 seconds of tests. Eight shards, after the 578-second loader file is split
+by case count (54 cases stay in that file and 46 move into each of three
+files), peak at 513 seconds of tests. With the measured 25-second shard setup,
+that shard job is about 538 seconds. Adding the measured classification, build,
+and merge makes an uncontended portable critical path of about 631 seconds,
+still before the gap between this file schedule and hosted Vitest. Runner queue
+is separate and grows when more shard jobs compete for runners.
+`process-boundary` stays serial because process-tree sampling shares the host.
+Raising the worker cap from two to four on this four-core host cut a six-file
+acceptance sample from 96–101 seconds to 71 seconds and did not remove the
+single-file floor, so the cap stays two. Full qualification keeps six covered
+shards; its longer instrumentation is outside this fast budget.

 The separate `CI timings` workflow batches recent completed CI and Release runs
 hourly or on manual dispatch. It uploads `ci-job-timings-batch` with raw API pages and
@@ -560,8 +603,9 @@ metadata, and available manifests into `.cache/ci-build-cache/`.
 `portable-build-cache.json` records availability per task. Evicted or partially
 missing entries are omitted as whole entries, and consumers rebuild cache misses,
 including when every entry is unavailable. Malformed plans, non-file entries,
-and I/O errors other than disappearance still fail publication. Older cross-run entries stay in the
-original cache. The Windows lane relies on the Linux static job for typechecking. They retain the normal build and prepack
+and I/O errors other than disappearance still fail publication. After a trusted
+static run, superseded cross-run Turbo snapshots for that OS and architecture
+are deleted down to the two newest generations. The Windows lane relies on the Linux static job for typechecking. They retain the normal build and prepack
 commands, which restore matching outputs or rebuild on a cache miss. Native
 artifacts, dependency installs, package archives, and runtime verification remain
 host-local. Keep platform-dependent outputs out of this shared cache.
@@ -1110,7 +1154,7 @@ suite, without the source-test shards or native package
 lanes. Classification compares the PR head with its merge base, so later
 base-branch changes do not expand that scope. Static and portable-test aggregate jobs
 remain present and fail if classification fails. Every code change retains the
-complete six-shard Linux suite; individual test files are not selected by
+complete portable Linux suite; individual test files are not selected by
 imports or filenames.

 Ordinary PRs also produce an **observational** test-selection plan. The candidate
@@ -1121,7 +1165,7 @@ tests. Shared inputs, unknown paths, missing owner tests, and removed tests fall
 back to the complete inventory. Renames account for both paths. Main, scheduled,
 manual, and `ci:full` runs always propose the full suite.

-All six shards still execute the complete suite. The existing report merge
+The source group and every built shard together still execute the complete suite. The existing report merge
 compares the proposal with actual module outcomes and retains
 `.cache/ci-test-selection/report.json` in `test-results`, including selected and
 omitted paths, changed input paths, missed failures, unobserved files, scheduling weights, PR head and
@@ -1167,13 +1211,16 @@ scripts also select it. Unrelated code edits retain the complete portable suite
 on the pinned Node version without starting four additional compatibility jobs.
 Full qualification retains every SQLite version.
 Shared process/contract/CLI boundaries, dependencies, other packaging inputs,
-unknown paths, and changes to the planner select the full baseline.
+unknown paths, and changes to the planner select the fast Linux x64 baseline:
+portable code checks and the installed-package runtime lane, without provider
+lanes or the multi-host package matrix. A shared file with exactly one owner
+still selects that owner. Full qualification still selects every lane.
 CI timing collection, timing history, and test-report helper edits retain static
 checks and the complete portable suite without selecting unrelated host/provider
 lanes. Classification, qualification, gate, release receipt, and unknown CI
-scripts keep the broad fallback.
+scripts keep that fast baseline.
 Package script-only edits select their owning verifier when its entrypoint is
-identifiable; unknown or shared script changes select everything. Android
+identifiable; unknown or shared script changes select the fast baseline. Android
 build-script edits retain the Linux suite and workflow validation; real Android
 verification stays manual. Renames account for both paths.

@@ -1197,9 +1244,10 @@ or provider effects outside its owners.
 Ordinary main pushes use the same owner scopes as PRs. Their diff starts at a
 successful ancestor push run of this CI workflow, rather than the preceding
 push: changes from failed or cancelled intermediate runs remain in scope.
-Missing, untrusted, or non-ancestor history selects every lane. The lookup is
+Missing, untrusted, or non-ancestor history selects the fast Linux x64
+baseline: portable checks and the Linux runtime lane. The lookup is
 bounded to the last 100 successful push runs; lookup failures broaden selection.
-Every code change still selects all six portable shards, without coverage
+Every code change still selects the source group and all eight fast built shards, without coverage
 instrumentation in this fast tier. Ordinary PR matrices cancel remaining
 shards after the first failure; passing PRs execute the complete suite. Main,
 `ci:full`, scheduled, manual, and release qualification retain every shard's
@@ -1227,8 +1275,11 @@ immediately starts the separate `Full PR qualification` workflow against the
 label event's merge revision; subsequent PR revisions also select the full tier
 in normal CI while that label remains. Unrelated labels do not start validation
 jobs or replace the main CI checks. Manual dispatch also requests full validation.
-Fast-tier broad fallbacks retain all owner lanes and the three-host
-package matrix; Intel macOS and coverage remain full-tier obligations. Each
+Fast-tier broad fallbacks keep the portable suite and the Linux x64 runtime
+baseline. They do not start every owner lane or the three-host package
+matrix. Intel macOS and coverage remain full-tier obligations. Real provider
+lanes stay path-gated, and a shared registration file listed by many lanes
+does not start those lanes on a fast PR. Each
 classification job records its selection and broad-fallback reasons in the run
 summary. Representative Git-diff cases live in
 `tests/boundary/filesystem/ciChangeScope.test.ts`.
@@ -1308,9 +1359,16 @@ report in each shard's snapshot. The bounded lookup verifies the artifact's
 producer; newer schedules that reuse qualification without producing timings do
 not hide the last full run's artifact.
 CI assigns discovered files by historical duration, with a deterministic
-fallback weight for new files, rather than dividing only by file count. Every
-discovered file still belongs to exactly one shard; worker limits and project
-ordering remain unchanged. The merge job rejects successful reports with missing,
+fallback weight for new files, rather than dividing only by file count.
+Each file keeps its full duration on one worker. Extra workers overlap other
+files in the same sequence group, and `process-boundary` runs after that
+group. History published before the competing-loader split still names only
+`javascriptLiteralPercentPaths.test.ts`. Until that artifact records one of
+the three new files, the sequencer assigns that recorded duration by the
+pre-split case counts: 54/192 to the remaining file and 46/192 to each new
+file. Every discovered file still belongs to exactly one shard; worker limits
+and project ordering remain unchanged. Fast qualification keeps eight built
+shards without coverage. The merge job rejects successful reports with missing,
 unexpected, or duplicate portable files. Coverage instrumentation and aggregate
 thresholds remain enforced in full qualification.
 Missing or unusable history falls back to Vitest's default assignment. Only
@@ -1318,18 +1376,56 @@ timing data is reused; live provider results are never cached. Turbo outputs are
 restored by task hash, with trusted default-branch runs as cache writers and PRs
 as restore-only consumers. The static job also restores its Turbo snapshot;
 each task revalidates its own input hash before reusing outputs or diagnostics.
-The Node pin and npm install settings are global hash inputs. Knip includes its ignore rules and VitePress
+The Node pin and npm install settings are global hash inputs. Knip runs only
+in full qualification, with `--cache` and a GitHub cache of
+`node_modules/.cache/knip`. The saved key includes the commit SHA. Restore uses
+the configuration prefix, so the next trusted full run can publish a refreshed
+snapshot. That cache is an AST cache keyed by file mtime and size, so a
+fresh checkout often misses it; Turbo still hashes the Knip task inputs. Knip
+includes its ignore rules and VitePress
 entry, so changes to those inputs cannot reuse an older successful check.
+Jobs that run Turbo export `TURBO_TEAM`. A called workflow sees the caller
+event, so `workflow_call` is not an event name inside CI. `TURBO_TOKEN` is set
+when release qualification passes `remote_cache_write`, or when the ref is the
+default branch and the event is push, schedule, or workflow_dispatch, and only
+when that secret is available to the run. Release qualification passes
+`TURBO_TOKEN` and `remote_cache_write` into the called workflow. Labeled
+pull-request qualification does not. Pull requests receive an empty token and
+`TURBO_CACHE=local:rw`. Remote reads require `TURBO_TOKEN`, and this repository
+does not pass a separate read-only credential into pull requests. An empty
+token leaves the local Turbo cache in place.

 The shared npm-cache action caches downloads, not `node_modules`, and every
 consumer still runs `npm ci`. Keys cover the runner OS, actual Node architecture,
-root lockfiles, and `.npmrc`. Only push, schedule, and manual events on the
-repository's default branch may save shared npm caches; PRs restore only.
-Static snapshots use the same write authority and are saved only after the
-static job's validation succeeds. Main warms the new cache namespace after
-merge; a cold cache or changed lockfile falls back to the normal install.
-This prevents each PR from saving another branch-scoped copy of the same
-download cache. It does not remove runner assignment waits.
+root lockfiles, and `.npmrc`. An exact-key miss restores the newest cache for
+that OS and architecture, so a lockfile change reuses unchanged tarballs while
+`npm ci` still verifies the lockfile. Only push, schedule, and manual events on
+the repository's default branch may save shared npm caches, and only from the
+opted-in writer for that host: Static checks for Linux x64, the package matrix
+for every other included host, and the Windows curated lane. Every other job
+restores without saving, so parallel jobs do not publish duplicate copies.
+Pull requests restore only. Static snapshots are saved only after the static
+job's validation succeeds. Cache deletion is a
+separate workflow, because reusable qualification calls this workflow and
+cannot raise its read-only token. After a push, schedule, or manual CI run on
+the default branch finishes, including when a later lane fails, times out, or
+is cancelled, that workflow runs on `ubuntu-latest` and deletes older
+`rea-static-v1`, `rea-static-deep-v1`, and `rea-portable-build-v2` entries for
+that runner's OS and architecture, plus older `knip-meta-v1` entries for that
+OS. It keeps two generations plus the key that run saved. A fast run that did
+not publish a deep or Knip snapshot still leaves the two newest entries in
+those families. It
+deletes an npm download record only when another record has the same key, cache
+version, and git ref, and it keeps the most recently accessed copy. A different
+version or ref is a different restore target and stays. One cache id is one
+record: a repeated id keeps the later access time when its key, version, ref,
+size, and creation time agree, and an inconsistent repeat deletes nothing. An
+incomplete or unexpected cache list deletes nothing.
+Distinct lockfile generations of the download cache stay, so the restore
+prefix still has a seed.
+Main warms the new cache namespace after merge; a cold cache falls back to the
+normal install. This prevents each PR from saving another branch-scoped copy of
+the same download cache. It does not remove runner assignment waits.

 Portable owner-based test selection remains observational. Its reports compare
 proposed omissions with the full run; incomplete or skipped observations do not
@@ -17,7 +17,7 @@ harm_rank,location,trigger,current_copy,user_risk,proposed_replacement,implement
 13,src/domain/errors.ts:EvidenceIntegrityError,Evidence validation fails,Raw constructor message,May expose validation internals and lacks recovery,"Evidence is invalid or has changed. Recreate or re-import it, then try again.",implemented,focused assertions passed; full `npm run check` passed
 14,src/domain/errors.ts:UnknownRegistryError,Evidence-state mutation fails,"Residual unknown registry mutation failed: {reason}",Exposes internal subsystem and state token,"Missing IDs identify the session and retry; concurrent revision conflicts refresh current state.",implemented,focused assertions passed; full `npm run check` passed
 15,src/domain/errors.ts:ProcessCaptureError,Process capture fails,Raw constructor message,May expose process and cleanup internals,"Process capture could not complete. Check command access and limits, then try again.",implemented,focused assertions passed; full `npm run check` passed
-16,src/domain/errors.ts:AnalysisTimeoutError,Analysis deadline expires,"REA's {operation} operation reached its {timeoutMs}ms server/provider deadline; the MCP client may have ended the call earlier",Explains the two deadline owners and avoids blind retry,"Inspect session/provider state first. If the MCP client ended the call, raise its tool deadline above {timeoutMs}ms; otherwise retry with a smaller request and do not repeat an unchanged call.",implemented,verified by projection tests and real MCP/Codex CLI timeout-recovery probes
+16,src/domain/errors.ts:AnalysisTimeoutError,Analysis deadline expires,"REA's {operation} operation reached its {timeoutMs}ms server/provider deadline; extending only the client deadline does not change this budget",Returned server deadline is distinct from a host timeout that discards the response,"Inspect partial Evidence and reported cleanup state; diagnose the provider or reduce supported work without assuming adjustable limits. JavaScript specifically names analysis_timeout_ms and exact source_paths; omit an unneeded filter rather than passing an empty array.",implemented,projection and public CLI/MCP timeout regression coverage; client recovery also taught during initialization and in the shipped skill
 17,src/domain/errors.ts:HopperTimeoutError,Provider deadline expires,"Hopper did not respond within {timeoutMs}ms",Exposes provider and internal deadline,"Analysis took too long. Try a smaller request, then run `rea doctor` if it continues.",implemented,focused assertions passed; full `npm run check` passed
 18,src/domain/errors.ts:ProviderSelectionError,Deep-provider selection fails,"Analysis provider selection failed ({reason}) for {requestedProviderId}; candidates: {candidateIds}",Retains non-secret local selection context that needs a safe structured projection,Reason-specific guidance with stable candidate IDs and actionable rejection diagnostics,implemented,focused registry/CLI/MCP assertions passed; full `npm run check` passed
 20,src/domain/errors.ts:AnalysisInputError,Parsed analysis input invalid,"Invalid analysis input for {operation}",Exposes operation identifier and lacks correction,"Analysis input is invalid. Check the arguments and try again.",implemented,focused assertions passed; full `npm run check` passed
@@ -0,0 +1,32 @@
+"""Count all actual client JSON inputs and preserve bounded family resource receipts."""
+from pathlib import Path
+import argparse, json, hashlib
+import tiktoken
+parser=argparse.ArgumentParser(description=__doc__)
+parser.add_argument('--root',type=Path,required=True)
+parser.add_argument('--output',type=Path,required=True)
+args=parser.parse_args();lab=args.root;enc=tiktoken.get_encoding('cl100k_base')
+compact=lambda value:json.dumps(value,ensure_ascii=False,separators=(',',':'),allow_nan=False)
+count=lambda value:len(enc.encode(compact(value),disallowed_special=()))
+def resources(root):
+ scope=json.loads(Path(str(root)+'.log').read_text().splitlines()[-1]);o=scope['payload_resource_observation']
+ assert scope['abort'] is None and scope['payload_resource_observation_verified'] and o['payload_exit_code']==0 and o['payload_cleanup_verified']
+ for event in o['resource_events'].values():assert not any(event.values())
+ return {'wall_seconds':scope['elapsed_seconds'],'cpu_seconds':o['cpu_stat']['usage_usec']/1e6,'family_peak_mib':o['memory_peak_bytes']/1048576,'payload_cleanup_verified':True,'final_whole_scope_counters_verified':scope['resource_counters_verified']}
+wire=[];sdk=[]
+for root in sorted(lab.glob('final-wire-*')):
+ if not root.is_dir():continue
+ report=json.loads((root/'report.json').read_text());requests=json.loads((root/'model-requests.json').read_text());assert report['status'] in ['passed','expected-incomplete-task'] and not report['cleanup_failures'] and report['appserver_exit_code']==0 and report['owned_scope_drain']['remaining_processes']==[]
+ rows=[]
+ for index,captured in enumerate(requests):
+  body=captured['body'];namespace=[n for n in body.get('tools',[]) if n.get('type')=='namespace' and n.get('name')=='mcp__rea_audit'];compaction=not namespace
+  if compaction:assert 'CONTEXT CHECKPOINT COMPACTION' in compact(body['input'][-1])
+  else:assert len(namespace)==1 and len(namespace[0]['tools'])==210
+  rows.append({'index':index+1,'kind':'compaction' if compaction else 'normal','whole_json_tokens_proxy':count(body),'rea_namespace_tokens_proxy':0 if not namespace else count(namespace[0]),'rea_function_count':0 if not namespace else len(namespace[0]['tools'])})
+ wire.append({'case':root.name,'task_completed':report['task_completed'],'mode':report['mode'],'budget':report['observations']['tool_output_budget'],'requests':len(rows),'compactions':sum(r['kind']=='compaction' for r in rows),'whole_json_tokens_proxy':sum(r['whole_json_tokens_proxy'] for r in rows),'request_details':rows,**resources(root)})
+for root in sorted(lab.glob('final-sdk-*')):
+ if not root.is_dir():continue
+ report=json.loads((root/'report.json').read_text());assert report['status']=='passed' and not report['cleanup_failures'] and not report['receipt_failures']
+ sdk.append({'case':root.name,'provider':report['provider'],'symbol':report['symbol'],'detail':report['detail'],'warm':report['warm'],'tool_calls':len(report['calls']),'exported_bundle_bytes':(root/'evidence.json').stat().st_size,'disassembly_calls':[r for r in report['calls'] if r['phase'].startswith('disassembly:')],**resources(root)})
+receipt={'measurement_scope':'Actual public SDK and Codex0.163 app-server with real GDB/BFD. Local deterministic SSE fixture and observed-ID checkpoint; no AI inference, model usage/quality/acceptance or billing claim. Whole compact JSON serialization tokens are proxies and include all schemas/replays/compaction. Incomplete default baseline is excluded from completed-workflow gains. Fresh processes have unflushed OS caches; warm SDK cases repeat the selected disassembly in the same server. Native target never executed.','tokenizer':{'package':tiktoken.__version__,'encoding':enc.name},'runtime_pins':{variant:{k:v for k,v in json.loads((lab/(variant+'-manifest.json')).read_text()).items() if k!='files'} for variant in ['baseline','candidate']},'native':json.loads((lab/'native-prerequisite-manifest.json').read_text()),'wire':wire,'sdk':sdk}
+args.output.write_text(json.dumps(receipt,indent=2)+'\n');print(json.dumps({'wire':[{k:v for k,v in row.items() if k!='request_details'} for row in wire],'sdk':[{k:v for k,v in row.items() if k!='disassembly_calls'} for row in sdk]},indent=2))
@@ -0,0 +1,22 @@
+from pathlib import Path
+import struct,hashlib,json,argparse
+parser=argparse.ArgumentParser(description='Independent ELF64 little-endian native-command byte oracle');parser.add_argument('--input',type=Path,required=True);parser.add_argument('--output',type=Path,required=True);args=parser.parse_args();path=args.input;b=path.read_bytes();assert b[:6]==b'\x7fELF\x02\x01'
+shoff=struct.unpack_from('<Q',b,40)[0];entsize,n,strings=struct.unpack_from('<HHH',b,58)
+assert entsize==64 and shoff+n*entsize<=len(b)
+sections=[struct.unpack_from('<IIQQQQIIQQ',b,shoff+i*entsize) for i in range(n)]
+rows=[]
+for si,s in enumerate(sections):
+ if s[1]!=11:continue
+ text=sections[s[6]];names=b[text[4]:text[4]+text[5]]
+ assert s[9]==24 and s[5]%s[9]==0
+ for ordinal,off in enumerate(range(s[4],s[4]+s[5],24)):
+  name,info,other,section,value,size=struct.unpack_from('<IBBHQQ',b,off)
+  end=names.find(b'\0',name);assert end>=name
+  if names[name:end] not in [b'execute_command',b'execute_command_internal'] or info&15!=2:continue
+  target=sections[section];file_offset=target[4]+value-target[3]
+  assert target[4]<=file_offset and file_offset+size<=target[4]+target[5]
+  rows.append({'symbol_table_section':si,'symbol_ordinal':ordinal,'name':names[name:end].decode('ascii'),'address':value,'bytes':size,'file_offset':file_offset,'first_16_bytes_hex':b[file_offset:file_offset+16].hex()})
+assert rows
+result={'path':str(path),'artifact_sha256':hashlib.sha256(b).hexdigest(),'artifact_bytes':len(b),'elf_class':64,'byte_order':'little','elf_machine':struct.unpack_from('<H',b,18)[0],'symbols':rows,'scope':'Independent ELF64 little-endian dynamic symbol/section mapping; no target execution or REA parser.'}
+args.output.write_text(json.dumps(result,indent=2)+'\n')
+print(json.dumps(result))
@@ -0,0 +1,212 @@
+import assert from "node:assert/strict";
+import { createHash } from "node:crypto";
+import { createWriteStream } from "node:fs";
+import { mkdir, mkdtemp, readFile, writeFile } from "node:fs/promises";
+import { createRequire } from "node:module";
+import { tmpdir } from "node:os";
+import { join, resolve } from "node:path";
+import { finished } from "node:stream/promises";
+import { pathToFileURL } from "node:url";
+import { parseArgs } from "node:util";
+import { createRetainedQueryCaller } from "./retained-query-calls.mjs";
+import { finalizeRetainedQueryReceipt } from "./retained-query-finalization.mjs";
+
+const { values } = parseArgs({
+  options: {
+    runtime: { type: "string" },
+    input: { type: "string" },
+    oracle: { type: "string" },
+    output: { type: "string" },
+    provider: { type: "string" },
+    symbol: { type: "string" },
+    detail: { type: "string", default: "complete" },
+    warm: { type: "boolean", default: false },
+  },
+});
+for (const key of ["runtime", "input", "oracle", "output"])
+  assert.equal(values[key], resolve(values[key]));
+assert.ok(["gdb", "objdump"].includes(values.provider));
+assert.ok(["complete", "summary"].includes(values.detail));
+const oracle = JSON.parse(await readFile(values.oracle, "utf8"));
+assert.ok(oracle.symbols.some((row) => row.name === values.symbol));
+const inputBytes = await readFile(values.input);
+assert.equal(
+  createHash("sha256").update(inputBytes).digest("hex"),
+  oracle.artifact_sha256,
+);
+const require = createRequire(join(values.runtime, "package.json"));
+const { Client } = await import(
+  pathToFileURL(require.resolve("@modelcontextprotocol/client"))
+);
+const { StdioClientTransport } = await import(
+  pathToFileURL(require.resolve("@modelcontextprotocol/client/stdio"))
+);
+await mkdir(values.output, { mode: 0o700 });
+const account = await mkdtemp(join(tmpdir(), "rea-command-views-"));
+const client = new Client({ name: "command-observation-task", version: "1" });
+const transport = new StdioClientTransport({
+  command: process.execPath,
+  args: [join(values.runtime, "scripts/rea.mjs"), "mcp"],
+  env: {
+    HOME: account,
+    PATH: process.env.PATH,
+    NODE_OPTIONS: "--max-old-space-size=2048",
+    UV_THREADPOOL_SIZE: "1",
+    REA_LOG_LEVEL: "silent",
+  },
+  stderr: "pipe",
+});
+const serverLog = createWriteStream(join(values.output, "server.log"));
+const serverLogFinished = finished(serverLog);
+serverLogFinished.catch(() => {});
+transport.stderr?.pipe(serverLog);
+const transcript = [];
+const report = {
+  question:
+    "Read architecture and the complete byte-annotated disassembly of one selected native function; export complete Evidence. No inferior execution.",
+  provider: values.provider,
+  symbol: values.symbol,
+  detail: values.detail,
+  warm: values.warm,
+  calls: [],
+  observations: [],
+};
+const call = createRetainedQueryCaller(client, (receipt, event) => {
+  report.calls.push(receipt);
+  transcript.push(event);
+});
+let sessionId;
+try {
+  await client.connect(transport);
+  const catalog = await client.listTools();
+  await writeFile(join(values.output, "catalog.json"), JSON.stringify(catalog));
+  const definitions = new Map(catalog.tools.map((tool) => [tool.name, tool]));
+  const originalCall = client.callTool.bind(client);
+  client.callTool = (input, options) =>
+    originalCall(input, {
+      ...options,
+      timeout: 60000,
+      toolDefinition: definitions.get(input.name),
+    });
+  const observe = async (name, input, phase = name) => {
+    const response = await call(name, input, phase);
+    assert.ok(!response.isError, JSON.stringify(response));
+    report.observations.push({
+      name,
+      phase,
+      evidence: response.structuredContent,
+    });
+    return response.structuredContent;
+  };
+  const completeParents = [];
+  const disassemble = async (phase) => {
+    const selection = values.detail === "summary" ? { detail: "summary" } : {};
+    const result =
+      values.provider === "gdb"
+        ? await observe(
+            "gdb_console",
+            {
+              session_id: sessionId,
+              command: `disassemble /r ${values.symbol}`,
+              ...selection,
+            },
+            phase,
+          )
+        : await observe(
+            "inspect_with_objdump",
+            {
+              path: values.input,
+              operation: "disassemble",
+              symbol: values.symbol,
+              ...selection,
+            },
+            phase,
+          );
+    completeParents.push(result);
+  };
+  if (values.provider === "gdb") {
+    const started = await observe("start_gdb_session", {});
+    sessionId = started.session_id;
+    for (const command of [
+      "set auto-load off",
+      "set debuginfod enabled off",
+      `file ${values.input}`,
+      "show architecture",
+    ])
+      await observe("gdb_console", { session_id: sessionId, command });
+  } else
+    await observe("inspect_with_objdump", {
+      path: values.input,
+      operation: "file_headers",
+    });
+  await disassemble("disassembly:fresh");
+  if (values.warm) await disassemble("disassembly:repeat");
+  if (sessionId) {
+    await observe("close_gdb_session", { session_id: sessionId });
+    sessionId = undefined;
+  }
+  await observe("export_evidence_bundle", {
+    path: join(values.output, "evidence.json"),
+  });
+  const bundle = JSON.parse(
+    await readFile(join(values.output, "evidence.json"), "utf8"),
+  );
+  for (const delivered of completeParents) {
+    const parent =
+      values.detail === "complete"
+        ? delivered
+        : bundle.records.find(
+            (record) =>
+              record.evidence_id ===
+              delivered.normalized_result.parent_evidence_id,
+          );
+    assert.ok(parent);
+    assert.equal(parent.normalized_result.completion_status, "complete");
+    assert.equal(parent.normalized_result.output_truncated, false);
+    if (values.provider === "gdb") assert.equal(parent.subject, null);
+    else assert.equal(parent.subject.digest.sha256, oracle.artifact_sha256);
+    if (values.detail === "summary") {
+      const selected = delivered.normalized_result.summary;
+      const { available_counts: counts, ...facts } = selected;
+      const { console, target, log, ...records } = parent.normalized_result;
+      assert.deepEqual(
+        values.provider === "gdb" ? facts : selected,
+        values.provider === "gdb" ? records : parent.normalized_result,
+      );
+      if (values.provider === "gdb")
+        assert.equal(counts.console_utf16_units, console.length);
+      assert.equal(delivered.raw_result, null);
+    }
+  }
+  report.status = "passed";
+} catch (error) {
+  report.status = "failed";
+  report.failure = String(error?.stack ?? error);
+  process.exitCode = 1;
+} finally {
+  if (sessionId)
+    try {
+      const closed = await call(
+        "close_gdb_session",
+        { session_id: sessionId },
+        "cleanup:gdb",
+      );
+      assert.ok(!closed.isError);
+    } catch (error) {
+      report.gdb_cleanup_failure = String(error);
+      process.exitCode = 1;
+    }
+  if (
+    !(await finalizeRetainedQueryReceipt({
+      report,
+      client,
+      transport,
+      account,
+      serverLog,
+      serverLogFinished,
+      output: values.output,
+      transcript,
+    }))
+  )
+    process.exitCode = 1;
+}
@@ -0,0 +1,28 @@
+from pathlib import Path
+import json,re,hashlib,argparse
+parser=argparse.ArgumentParser(description='Match every native instruction byte against independently mapped ELF file ranges');parser.add_argument('--root',type=Path,required=True);args=parser.parse_args();lab=args.root;oracle=json.loads((lab/'elf-oracle.json').read_text());image=Path(oracle['path']).read_bytes();assert hashlib.sha256(image).hexdigest()==oracle['artifact_sha256'];rows=[]
+for directory in sorted(lab.iterdir()):
+ bundle=directory/'evidence.json'
+ if not bundle.is_file():continue
+ for parent in json.loads(bundle.read_text())['records']:
+  if parent['operation'] not in ['gdb_console','inspect_with_objdump']:continue
+  params=parent['parameters'];gdb=parent['operation']=='gdb_console'
+  symbol=params.get('command','').removeprefix('disassemble /r ') if gdb else params.get('symbol')
+  if symbol not in {s['name'] for s in oracle['symbols']}:continue
+  spec=next(s for s in oracle['symbols'] if s['name']==symbol)
+  report=parent['normalized_result'];assert report['completion_status']=='complete' and not report['output_truncated']
+  if gdb:
+   assert parent['subject'] is None
+   console='\n'.join(line for line in report['records'] if line.startswith('~'));assert console==report['console']
+   text=''.join(json.loads(line[1:]) for line in report['records'] if line.startswith('~'))
+   pattern=r'^\s*(?:=>\s*)?0x([0-9a-f]+)[^:]*:\s*((?:[0-9a-f]{2}(?:\s+|$))+)'
+  else:
+   assert parent['subject']['digest']['sha256']==oracle['artifact_sha256'];text=report['stdout'];pattern=r'^\s*([0-9a-f]+):\s*((?:[0-9a-f]{2}(?:\s+|$))+)'
+  address=spec['address'];collected=bytearray();count=0
+  for line in text.splitlines():
+   m=re.match(pattern,line)
+   if not m:continue
+   actual=int(m[1],16);raw=bytes.fromhex(m[2]);assert actual==address+len(collected),(directory,actual,address+len(collected));collected.extend(raw);count+=1
+  expected=image[spec['file_offset']:spec['file_offset']+spec['bytes']];assert collected==expected,(directory,len(collected),len(expected));rows.append({'case':directory.name,'mode':'gdb' if gdb else 'objdump','symbol':symbol,'byte_bearing_lines':count,'bytes':len(collected),'exact_file_bytes':True,'parent_evidence_id':parent['evidence_id']})
+assert rows
+(lab/'native-final-verification.json').write_text(json.dumps({'status':'passed','artifact_sha256':oracle['artifact_sha256'],'records':rows},indent=2)+'\n');print(json.dumps(rows))
@@ -0,0 +1,139 @@
+# Retained command observations
+
+Addresses [#5584](https://github.com/morluto/rea/issues/5584). GDB command Evidence
+repeats ordered MI records in stream groups and a raw mirror; objdump repeats
+stdout/stderr in its raw mirror. Explicit `detail: summary` retains the complete
+parent and projects existing owner facts once. Default complete Evidence is
+unchanged. This adds no tool, MI decoder, live-state cache or command authority.
+
+GDB summaries preserve **every ordered record**, including asynchronous and
+unrecognized records, correlated MI result, command, completion/truncation,
+invalid-UTF-8 and process-exit facts. They omit the convenience console/target/log
+groupings and report their original UTF-16 sizes. Objdump summaries preserve
+opaque stdout/stderr, exit/signal, completion and pre/post digest-change facts.
+Both carry source parameters/provider/profile, parent identity, limitations and
+unknowns. Subjectless observations stay subjectless. Historical observations do
+not establish current target state or global coverage. The existing
+`inspect_analysis_view` summary operation works after debugger close.
+
+The domain codec now owns the command fact shapes used by contracts and GDB's
+capture type; protocol interpretation stays with its provider. MCP requires
+retention before command execution. CLI uses the existing shared projection and
+nonoverwriting bundle publisher after provider cleanup:
+
+```sh
+rea inspect-with-objdump /usr/bin/bash disassemble --symbol execute_command \
+  --detail summary --evidence_output /tmp/bash-command-evidence.json --json
+```
+
+## Real input and correctness
+
+Linux x86-64, Node 24.18.0/npm 11.16.0; GNU GDB 13.1 (Debian 13.1-3),
+GNU objdump 2.40, installed Bash ELF 1,265,648 bytes, SHA-256
+`55b89ab22bee4792a210f493a53fb066accd5d30b69837c28d98be5ff863efcf`.
+The [receipt](command-observation-views.json) pins native binaries, baseline main
+`c2858d2aa0916f0dd2d073d848b8c2195d9bf6b3`, source patch and packaged runtime digests.
+No target execution, attach, GUI or database mutation occurred.
+
+An [independent ELF reader](command-observation-oracle.py) maps dynamic symbols
+to exact file ranges: `execute_command`, 239 bytes at `0x4ba50`, and
+`execute_command_internal`, 15,428 bytes at `0x47e00`. The
+[verifier](command-observation-verify.py) checks every disassembled byte and its
+contiguous address against those ranges. GDB reports 66/3,365 instructions;
+objdump byte lines also include continuations, so their count is not an
+instruction count. Ordered summary facts match each exported complete parent.
+GDB Evidence has a null subject; the external oracle does not manufacture a
+target binding. Actual CLI default objdump Evidence matches the baseline exactly,
+including identity; symbol/pathless summaries preserve it in bundles. CLI checks
+also cover rejected overwrite, missing destination before dispatch, and a real
+GDB command with a caller-owned PTY that remains available after debugger exit.
+
+## Whole tasks and resource costs
+
+The [SDK driver](command-observation-queries.mjs) discovers all 210 tools, reads
+architecture and symbol-scoped disassembly, closes GDB where applicable, exports
+complete Evidence and finalizes owned resources. GDB uses 8 calls; objdump uses 3.
+Warm cases repeat disassembly in the same process, adding one call. Fresh-process
+cases have **unflushed OS caches**, not disk-cold inputs. Native commands are
+rerun; results are not reused as current live state.
+
+The [actual Codex 0.163 app-server driver](command-observation-wire.py) uses a
+loopback deterministic SSE fixture, no AI inference or paid service. All 210
+function schemas are present in every normal model-facing request. Matched tasks
+use full input/output profiles; only disassembly selects summary. The
+[counter](command-observation-costs.py) counts compact JSON serialization with
+`tiktoken 0.12.0 / cl100k_base` across **every** request, including schemas,
+replayed results and the actual client's local compaction request. The fixture
+answers compaction with observed identifiers and the retained-body location.
+These are serialization-token proxies, not model rendering, acceptance, answer
+quality, actual usage or billing. Compaction behavior is qualified only for this
+client/configuration; no inference quality is established.
+
+| Completed GDB task             | JSON token proxy before → after | Requests |  Wall seconds |   CPU seconds | Family peak MiB |
+| ------------------------------ | ------------------------------: | -------: | ------------: | ------------: | --------------: |
+| Small, 30,000 per-tool budget  |               605,133 → 580,070 |    9 → 9 | 7.906 → 8.618 | 7.195 → 7.832 |   788.9 → 785.9 |
+| Large, 350,000 per-tool budget |           1,269,405 → 1,091,290 |   10 → 9 | 9.551 → 9.127 | 8.832 → 8.370 |   805.2 → 770.8 |
+
+Whole-task context proxies decrease **4.14% / 14.03%**, rather than the much
+larger reply-byte reduction. The large baseline makes one compaction request;
+the candidate makes none. The small task is slower. These single paired samples
+do not establish a general speedup. With the client's default output budget,
+the small baseline delivers truncated invalid inner JSON and does **not**
+complete the question; summary completes it. That incomplete baseline is
+excluded from the percentage comparison.
+
+| SDK task      | Reply bytes before → after | Whole wall seconds |   CPU seconds | Family peak MiB |
+| ------------- | -------------------------: | -----------------: | ------------: | --------------: |
+| GDB small     |            54,123 → 18,009 |      6.631 → 5.447 | 6.102 → 5.240 |   536.3 → 535.8 |
+| GDB large     |        2,763,983 → 700,453 |      6.965 → 6.660 | 6.729 → 6.451 |   595.0 → 545.8 |
+| Objdump small |            22,467 → 15,990 |      7.599 → 7.699 | 7.110 → 7.264 |   527.8 → 532.5 |
+| Objdump large |          964,889 → 487,219 |      7.737 → 7.499 | 7.334 → 6.935 |   537.0 → 536.6 |
+
+Same-process repeat disassembly takes 1,100 → 1,016 ms for GDB and
+1,070 → 939 ms for objdump in these observations. Whole warm-task CPU improves
+7.613 → 7.162 s for GDB but increases 7.819 → 7.859 s for objdump. Timings include
+existing ownership checks; no check was removed or cached.
+
+Retaining a summary also retains an additional derived record: large GDB bundles
+grow 1,310,073 → 1,640,022 bytes; objdump 474,288 → 712,656. This trades retained
+storage for smaller delivery; long-session heap growth is unmeasured. Retained-data lifetime follows the existing investigation ledger and cleanup
+owners. Output still scales
+with the requested complete disassembly; summary is not a fixed-size preview.
+
+Each experiment runs in one owned systemd scope, one CPU, no swap, 4 GiB hard /
+3 GiB early memory thresholds and host-memory admission/stop thresholds. Recorded
+payload exit and cleanup are verified, with zero OOM/resource events. Final
+whole-scope counters disappear after teardown and remain explicitly unverified.
+The receipt includes CPU time, wall time, peak family memory, warm cases and
+bundle growth. Build/check scopes use separate bounded budgets. Host-memory
+check stops and initial fixture failures are preserved locally and are not passes.
+
+## Coverage and reproduction
+
+320 focused tests cover the new SDK schemas/views plus existing GDB queue,
+malformed output, cancellation, process exit, target identity and cleanup cases,
+objdump symbol selection and command admission. Real provider evidence is from
+the CLI/SDK/client runs above, not simulated-provider tests.
+
+Run the oracle for the selected Bash image, then use the SDK driver with
+`--runtime`, `--input`, `--oracle`, `--output`, `--provider gdb|objdump`,
+`--symbol`, `--detail complete|summary` and optional `--warm`. The wire driver
+also takes the fixed Codex/Node paths, `--mode`, `--symbol` and `--budget`; it always performs the
+export (eight tool calls). Run each through `resource-run.py --observe-payload-exit`, preserving
+its sibling `.log`; the verifier and counter accept `--root` for those results.
+
+Default Rizin execution returned ENOENT with no configured alternative. Cutter
+reported no live bridge; no configured selector or default bridge directory was
+present. Real Rizin/Cutter performance and GUI workflows remain unverified.
+Their command semantics were not changed. Existing objdump native symbol
+selection was reused. No claim covers arbitrary GDB target execution or another
+host client's output budget.
+
+Review follow-up adds nine CLI publication regressions (16 CLI tests including the
+existing cleanup cases), three deterministic delivery-oracle tests, and a focused
+strict typecheck of the new CLI boundary and its transitive source. Real client
+small/default and large/generous summary runs pass the strengthened oracle and
+export complete parents; only the explicit complete/default baseline may finish
+with an incomplete answer. The unused export switch was removed: export is
+mandatory in this question. Product source and the original paired measurements
+are unchanged; the receipt records these additional validation runs separately.
@@ -0,0 +1,301 @@
+"""Actual Codex wire capture with a deterministic local SSE backend; no AI inference."""
+import argparse
+import http.server
+import threading
+import asyncio
+import hashlib
+import json
+import os
+from pathlib import Path
+import re
+import time
+import traceback
+import subprocess
+from command_observation_delivery import verify_command_delivery
+
+
+async def main():
+    parser = argparse.ArgumentParser(description=__doc__)
+    parser.add_argument("--output", type=Path, required=True)
+    parser.add_argument("--runtime", type=Path, required=True)
+    parser.add_argument("--codex", type=Path, required=True)
+    parser.add_argument("--node", type=Path, required=True)
+    parser.add_argument("--input-profile", choices=["full", "compact"], default="full")
+    parser.add_argument("--output-profile", choices=["full", "off"], default="full")
+    parser.add_argument("--input", type=Path, required=True)
+    parser.add_argument("--oracle", type=Path, required=True)
+    parser.add_argument("--expected-tools", type=int, default=210)
+    parser.add_argument("--mode", choices=["complete", "summary"], required=True)
+    parser.add_argument("--question", choices=["disassembly"], default="disassembly")
+    parser.add_argument("--symbol", choices=["execute_command", "execute_command_internal"], required=True)
+    parser.add_argument("--budget", type=int, default=30000)
+    args = parser.parse_args()
+    oracle=json.loads(args.oracle.read_text())
+    target=str(args.input)
+    assert args.input.is_absolute() and args.oracle.is_absolute() and args.output.is_absolute()
+    assert hashlib.sha256(args.input.read_bytes()).hexdigest()==oracle["artifact_sha256"]
+    def delivered(pieces):
+        assert isinstance(pieces,str) and pieces.startswith("Wall time: "), pieces[:300]
+        _,sep,payload=pieces.partition("Output:\n");assert sep
+        try: value=json.loads(payload)
+        except json.JSONDecodeError: return {"_invalid_json_payload":payload}
+        return value["result"] if "result" in value and "normalized_result" not in value else value
+    def outputs_of(body):
+        return {item["call_id"]:delivered(item["output"]) for item in body.get("input",[]) if item.get("type")=="function_call_output"}
+    steps=8
+    args.output.mkdir(mode=0o700)
+    audit_home = args.output / "account"
+    codex_state = audit_home / ".codex"
+    mcp_home = audit_home / "mcp"
+    workspace = audit_home / "workspace"
+    for directory in [codex_state, mcp_home, workspace]:
+        directory.mkdir(parents=True)
+    captured = []
+    known_outputs = {}
+    state = {"normal_requests":0,"compactions":0}
+    class Capture(http.server.BaseHTTPRequestHandler):
+        def log_message(self, *_):
+            pass
+        def do_POST(self):
+            size = int(self.headers["Content-Length"])
+            assert 0 < size <= 16 * 1024 * 1024
+            assert self.headers.get("Content-Encoding", "identity") == "identity"
+            body = json.loads(self.rfile.read(size))
+            captured.append({"path": self.path, "body": body})
+            (args.output / "model-requests.json").write_text(json.dumps(captured) + "\n")
+            http_index = len(captured)
+            known_outputs.update(outputs_of(body))
+            names = [t.get("name", "") for ns in body.get("tools", []) if ns.get("type") == "namespace" and ns.get("name") == "mcp__rea_audit" for t in ns.get("tools", [])]
+            if not names:
+                last=body.get('input',[])[-1]
+                assert 'CONTEXT CHECKPOINT COMPACTION' in json.dumps(last)
+                state['compactions']+=1;assert state['compactions']<=1
+                evidence=known_outputs['call_local_6'];assert 'normalized_result' in evidence
+                captured_result=evidence['normalized_result'];command_report=captured_result.get('summary',captured_result)
+                checkpoint={'fixture':'deterministic protocol checkpoint; no AI inference or model-quality claim','task':'Full native Bash function disassembly has been delivered to this compaction request. Retain complete Evidence and finish owned cleanup.','path':target,'artifact_sha256_external_oracle':oracle['artifact_sha256'],'symbol':args.symbol,'session_id':known_outputs['call_local_1']['session_id'],'parent_evidence_id':captured_result.get('parent_evidence_id',evidence['evidence_id']),'subject':evidence['subject'],'completion_status':command_report['completion_status'],'output_truncated':command_report['output_truncated'],'native_console_utf16_units':command_report.get('available_counts',{}).get('console_utf16_units',len(command_report.get('console','').encode('utf-16-le'))//2),'full_body_location':'same-session retained Evidence; export next to '+str(args.output/'evidence.json'),'remaining':['close_gdb_session','export_evidence_bundle']}
+                text=json.dumps(checkpoint)
+                item={"type":"message","id":f"msg_checkpoint_{state['compactions']}","role":"assistant","status":"completed","content":[{"type":"output_text","text":text,"annotations":[]}]}
+                captured[-1]['kind']='deterministic-compaction'
+            else:
+                state['normal_requests']+=1;index=state['normal_requests'];assert index<=steps+1
+                captured[-1]['kind']='tool-planning-or-final'
+                if index<=steps:
+                    if index==1:
+                        operation="start_gdb_session";arguments={}
+                    else:
+                        session=known_outputs["call_local_1"]["session_id"]
+                        if index<=6:
+                            command=['set auto-load off','set debuginfod enabled off',f'file {target}','show architecture',f'disassemble /r {args.symbol}'][index-2]
+                            operation="gdb_console";arguments={"session_id":session,"command":command}
+                            if index==6 and args.mode=="summary":arguments["detail"]="summary"
+                        elif index==7:
+                            operation="close_gdb_session";arguments={"session_id":session}
+                        else:
+                            operation="export_evidence_bundle";arguments={"path":str(args.output/'evidence.json')}
+                    selected=[name for name in names if name.endswith(operation)];assert len(selected)==1
+                    item={"type":"function_call","id":f"fc_local_{index}","call_id":f"call_local_{index}","name":selected[0],"namespace":"mcp__rea_audit","arguments":json.dumps(arguments),"status":"completed"}
+                else:
+                    item={"type":"message","id":"msg_local_done","role":"assistant","status":"completed","content":[{"type":"output_text","text":"Scripted local GDB disassembly task complete.","annotations":[]}]}
+            response_id=f"resp_local_{http_index}"
+            base = {"id": response_id, "object": "response", "model": body.get("model"), "status": "completed", "output": [item]}
+            events = [
+                {"type": "response.created", "response": {**base, "status": "in_progress", "output": []}},
+                {"type": "response.output_item.added", "output_index": 0, "item": {**item, "status": "in_progress"}},
+                {"type": "response.output_item.done", "output_index": 0, "item": item},
+                {"type": "response.completed", "response": base},
+            ]
+            wire = "".join("event: " + e["type"] + "\ndata: " + json.dumps(e) + "\n\n" for e in events).encode()
+            self.send_response(200)
+            self.send_header("Content-Type", "text/event-stream")
+            self.send_header("Content-Length", str(len(wire)))
+            self.end_headers()
+            self.wfile.write(wire)
+    endpoint = http.server.HTTPServer(("127.0.0.1", 0), Capture)
+    endpoint_thread = threading.Thread(target=endpoint.serve_forever, daemon=True)
+    endpoint_thread.start()
+    task_path = f"{args.node.parent}:/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin"
+    mcp_env = {"HOME": str(mcp_home), "PATH": task_path,
+               "NODE_OPTIONS": "--max-old-space-size=2048", "UV_THREADPOOL_SIZE": "1",
+               "REA_LOG_LEVEL": "silent", "REA_MCP_INPUT_SCHEMA_PROFILE": args.input_profile,
+               "REA_MCP_OUTPUT_SCHEMA_PROFILE": args.output_profile}
+    config = 'model_provider = "rea_capture"\nmodel = "rea-wire-probe"\n[analytics]\nenabled = false\n[mcp_servers.rea_audit]\n'
+    config += f'command = {json.dumps(str(args.node))}\n'
+    config += f'args = {json.dumps([str(args.runtime / "scripts/rea.mjs"), "mcp"])}\n'
+    config += 'startup_timeout_sec = 60\ntool_timeout_sec = 60\n'
+    config += '[mcp_servers.rea_audit.env]\n'
+    config += ''.join(f'{key} = {json.dumps(value)}\n' for key, value in mcp_env.items())
+    for name in ['start_gdb_session','gdb_console','close_gdb_session','export_evidence_bundle']:
+        config += f'[mcp_servers.rea_audit.tools.{name}]\napproval_mode = "approve"\n'
+        if args.budget: config += f'output_token_limit = {args.budget}\n'
+    config += f'\n[model_providers.rea_capture]\nname = "Local scripted capture"\nbase_url = "http://127.0.0.1:{endpoint.server_port}/v1"\nwire_api = "responses"\nrequires_openai_auth = false\nsupports_websockets = false\nrequest_max_retries = 0\nstream_max_retries = 0\n'
+    (codex_state / "config.toml").write_text(config)
+    (args.output / "declared-config.toml").write_text(config)
+    environment = {"HOME": str(audit_home), "CODEX_HOME": str(codex_state), "PATH": task_path,
+                   "NODE_OPTIONS": "--max-old-space-size=2048", "UV_THREADPOOL_SIZE": "1"}
+    report = {"question": "Return architecture and complete byte-annotated disassembly for one selected native Bash function and export complete Evidence. No target execution.",
+              "client": "Codex app-server 0.163.0", "model_turns_started": 1, "backend": "local deterministic SSE fixture; no AI model or paid service",
+              "actual_model_usage": None, "input_profile": args.input_profile,
+              "output_profile": args.output_profile, "calls": [], "observations": [],
+              "unexpected_server_requests": [], "cleanup_failures": []}
+    client_version = subprocess.check_output([str(args.codex), "--version"], env=environment, cwd=workspace, text=True, timeout=10).strip()
+    assert client_version == "codex-cli 0.163.0", client_version
+    transcript = []
+    pending = {}
+    completed_turn = asyncio.Event()
+    next_id = 0
+    stderr = (args.output / "server.log").open("wb")
+    process = await asyncio.create_subprocess_exec(str(args.codex), "app-server", "--stdio",
+        stdin=asyncio.subprocess.PIPE, stdout=asyncio.subprocess.PIPE, stderr=stderr,
+        cwd=workspace, env=environment, limit=16 * 1024 * 1024)
+
+    async def send(message):
+        encoded = (json.dumps(message, separators=(",", ":")) + "\n").encode()
+        transcript.append({"direction": "client", "bytes": len(encoded), "message": message})
+        process.stdin.write(encoded)
+        await process.stdin.drain()
+
+    async def read_messages():
+        try:
+            while line := await process.stdout.readline():
+                value = json.loads(line)
+                transcript.append({"direction": "server", "bytes": len(line), "message": value})
+                if value.get("method") == "turn/completed":
+                    report["turn"] = value["params"]["turn"]
+                    completed_turn.set()
+                if "id" in value and "method" not in value:
+                    future = pending.pop(value["id"], None)
+                    if future and not future.done():
+                        future.set_result(value)
+                elif "id" in value:
+                    report["unexpected_server_requests"].append(value["method"])
+                    await send({"id": value["id"], "error": {"code": -32601, "message": "Unexpected request in scripted metadata probe"}})
+            raise RuntimeError("app-server stdout closed")
+        except Exception as error:
+            for future in pending.values():
+                if not future.done():
+                    future.set_exception(error)
+
+    reader = asyncio.create_task(read_messages())
+
+    async def request(method, params):
+        nonlocal next_id
+        assert method in ["initialize", "thread/start", "mcpServerStatus/list", "mcpServer/tool/call", "turn/start"]
+        next_id += 1
+        message = {"id": next_id, "method": method, "params": params}
+        future = asyncio.get_running_loop().create_future()
+        pending[next_id] = future
+        start = time.monotonic()
+        await send(message)
+        reply = await asyncio.wait_for(future, 90)
+        report["calls"].append({"method": method, "elapsed_ms": (time.monotonic() - start) * 1000,
+                                "error": reply.get("error")})
+        if "error" in reply:
+            raise RuntimeError(json.dumps(reply["error"])[:4000])
+        return reply["result"]
+
+    try:
+        await request("initialize", {"clientInfo": {"name": "rea_host_probe", "title": "REA host compatibility probe", "version": "1"},
+                                     "capabilities": {"experimentalApi": True, "explicitGatewayOauth": True}})
+        await send({"method": "initialized"})
+        created = await request("thread/start", {"cwd": str(workspace), "ephemeral": True,
+                    "approvalPolicy": "never", "sandbox": "read-only"})
+        thread_id = created["thread"]["id"]
+        assert not created["thread"].get("turns", [])
+        inventory = await request("mcpServerStatus/list", {"threadId": thread_id,
+                    "serverName": "rea_audit", "detail": "toolsAndAuthOnly", "limit": 10})
+        assert inventory.get("nextCursor") is None
+        assert len(inventory["data"]) == 1
+        server = inventory["data"][0]
+        assert server["name"] == "rea_audit" and server.get("toolsError") is None
+        tools = list(server["tools"].values())
+        names = [tool["name"] for tool in tools]
+        assert len(names) == len(set(names)) == args.expected_tools
+        assert "gdb_console" in names
+        output_schemas = sum(tool.get("outputSchema") is not None for tool in tools)
+        assert output_schemas == (args.expected_tools if args.output_profile == "full" else 0)
+        raw = json.dumps(inventory, separators=(",", ":"), ensure_ascii=False).encode()
+        (args.output / "catalog.json").write_bytes(raw)
+        report["catalog"] = {"tools": len(tools), "output_schemas": output_schemas,
+                             "bytes": len(raw), "sha256": hashlib.sha256(raw).hexdigest(),
+                             "server_info": server.get("serverInfo"), "runtime_status": server.get("runtimeStatus")}
+        await request("turn/start", {"threadId":thread_id,"input":[{"type":"text","text":f"Read architecture and the complete byte-annotated disassembly of {args.symbol} in the selected Bash executable. Retain and export complete Evidence, then close the owned debugger. The local fixture scripts the required tools; no AI inference or target execution is used."}]})
+        await asyncio.wait_for(completed_turn.wait(), 90)
+        assert report["turn"]["status"] == "completed", report["turn"]
+        assert state["normal_requests"]==steps+1
+        assert len(captured)==steps+1+state["compactions"]
+        outputs=known_outputs
+        assert len(outputs)==steps
+        bundle=json.loads((args.output/'evidence.json').read_text())
+        evidence=next(e for e in bundle['records'] if e['operation']=='gdb_console' and e['parameters']['command']==f'disassemble /r {args.symbol}')
+        assert evidence['subject'] is None
+        assert evidence['normalized_result']['completion_status']=='complete' and not evidence['normalized_result']['output_truncated']
+        delivered_result=outputs['call_local_6']
+        delivery_complete=verify_command_delivery(delivered_result,evidence,args.mode,args.budget)
+        if delivery_complete and args.mode=='summary':
+            assert next(e for e in bundle['records'] if e['evidence_id']==delivered_result['evidence_id'])==delivered_result
+        report['task_completed']=delivery_complete
+        report['observations']={'parent_evidence_id':evidence['evidence_id'],'exported':True,'native_console_utf16_units':len(evidence['normalized_result']['console'].encode('utf-16-le'))//2,'client_delivered_full_evidence':delivery_complete,'selected_symbol':args.symbol,'tool_output_budget':args.budget or 'client default','subject':evidence['subject']}
+        report["captured_requests"]=len(captured)
+        report["compaction_requests"]=state["compactions"]
+        report["compaction_backend"]="Deterministic checkpoint of observed identifiers and retained-body location; no AI inference or quality claim."
+        report["mode"]=args.mode
+        report["request_tool_counts"] = [len(c["body"].get("tools", [])) for c in captured]
+        assert not report["unexpected_server_requests"]
+        assert hashlib.sha256(args.input.read_bytes()).hexdigest()==oracle["artifact_sha256"]
+        report["status"] = "passed" if report["task_completed"] else "expected-incomplete-task"
+    except Exception:
+        report["status"] = "failed"
+        report["failure"] = traceback.format_exc()[-6000:]
+    finally:
+        process.stdin.close()
+        try:
+            await asyncio.wait_for(process.wait(), 15)
+        except asyncio.TimeoutError:
+            report["cleanup_failures"].append("app-server did not exit after stdin close; terminated owned process")
+            process.terminate()
+            try:
+                await asyncio.wait_for(process.wait(), 5)
+            except asyncio.TimeoutError:
+                process.kill()
+                await process.wait()
+        await reader
+        # app-server can acknowledge exit before its MCP child finishes EOF
+        # cleanup. Wait on the allocated resource scope; never target a PID.
+        try:
+            groups = [line[3:] for line in Path("/proc/self/cgroup").read_text().splitlines()
+                      if line.startswith("0::")]
+            assert len(groups) == 1
+            group = Path("/sys/fs/cgroup") / groups[0].lstrip("/")
+            assert re.fullmatch(r"rea-efficiency-[0-9a-f]{32}\.scope", group.name)
+            observer = os.getppid()
+            observer_args = Path(f"/proc/{observer}/cmdline").read_bytes().split(b"\0")
+            assert any(Path(os.fsdecode(value)).name == "resource_payload.py" for value in observer_args if value)
+            expected = {os.getpid(), observer}
+            until = time.monotonic() + 10
+            while True:
+                actors = {int(value) for value in (group / "cgroup.procs").read_text().splitlines()}
+                assert expected <= actors
+                remaining = sorted(actors - expected)
+                if not remaining or time.monotonic() >= until:
+                    break
+                await asyncio.sleep(0.05)
+            report["owned_scope_drain"] = {"remaining_processes": remaining}
+            if remaining:
+                report["cleanup_failures"].append("owned MCP child did not settle after app-server exit")
+        except (OSError, ValueError, AssertionError) as error:
+            report["owned_scope_drain"] = {"status": "unavailable", "reason": type(error).__name__}
+            report["cleanup_failures"].append("allocated resource-scope cleanup could not be verified")
+        endpoint.shutdown()
+        endpoint.server_close()
+        endpoint_thread.join(5)
+        stderr.close()
+        report["appserver_exit_code"] = process.returncode
+        if process.returncode != 0:
+            report["cleanup_failures"].append(f"app-server exit code: {process.returncode}")
+        (args.output / "transcript.json").write_text(json.dumps(transcript) + "\n")
+        (args.output / "report.json").write_text(json.dumps(report, indent=2) + "\n")
+        print(json.dumps({key: report.get(key) for key in ["status", "failure", "catalog", "observations", "cleanup_failures", "appserver_exit_code"]}))
+    return 0 if report["status"] in ["passed","expected-incomplete-task"] and not report["cleanup_failures"] else 1
+
+
+raise SystemExit(asyncio.run(main()))
@@ -0,0 +1,39 @@
+"""Acceptance of the captured GDB answer, separate from native execution success."""
+
+
+def verify_command_delivery(delivered, parent, mode, budget):
+    assert mode in ('complete', 'summary')
+    if '_invalid_json_payload' in delivered:
+        assert mode == 'complete' and budget == 0, (
+            'Incomplete delivery is allowed only for the '
+            'complete/default-budget baseline'
+        )
+        return False
+    if mode == 'complete':
+        assert delivered == parent
+        return True
+
+    selected = delivered['normalized_result']
+    assert selected['parent_evidence_id'] == parent['evidence_id']
+    assert selected['artifact'] is None
+    profile = parent['analysis_profile']
+    expected_profile = None if profile is None else profile['digest']
+    assert selected['source_analysis_profile_digest'] == expected_profile
+    assert selected['source_parameters'] == parent['parameters']
+    assert selected['source_provider'] == parent['provider']
+    assert delivered['raw_result'] is None and delivered['subject'] is None
+    expected = {
+        key: value for key, value in parent['normalized_result'].items()
+        if key not in ('console', 'target', 'log')
+    }
+    actual = {
+        key: value for key, value in selected['summary'].items()
+        if key != 'available_counts'
+    }
+    assert actual == expected
+    counts = {'records': len(expected['records'])}
+    for name in ('console', 'target', 'log'):
+        text = parent['normalized_result'][name]
+        counts[name + '_utf16_units'] = len(text.encode('utf-16-le')) // 2
+    assert selected['summary']['available_counts'] == counts
+    return True
@@ -0,0 +1,81 @@
+"""Count complete actual-client requests, not only smaller tool-reply bytes."""
+import argparse
+import hashlib
+import json
+from pathlib import Path
+import tiktoken
+
+parser = argparse.ArgumentParser(description=__doc__)
+parser.add_argument('--lab', type=Path, required=True)
+parser.add_argument('--output', type=Path, required=True)
+args = parser.parse_args()
+enc = tiktoken.get_encoding('cl100k_base')
+
+
+def tokens(value):
+    return len(enc.encode(json.dumps(value, ensure_ascii=False, separators=(',', ':'), allow_nan=False), disallowed_special=()))
+
+
+def resources(root):
+    receipt = json.loads(Path(str(root) + '.log').read_text().splitlines()[-1])
+    payload = receipt['payload_resource_observation']
+    assert receipt['abort'] is None and receipt['payload_resource_observation_verified']
+    assert payload['payload_exit_code'] == 0 and payload['payload_cleanup_verified']
+    for events in payload['resource_events'].values():
+        assert not any(events.values())
+    return {'wall_seconds': receipt['elapsed_seconds'], 'cpu_seconds': payload['cpu_stat']['usage_usec'] / 1e6,
+            'family_peak_mib': payload['memory_peak_bytes'] / 1048576,
+            'payload_cleanup_verified': True, 'final_whole_scope_counters_verified': receipt['resource_counters_verified']}
+
+
+wire, sdk = [], []
+for root in sorted(args.lab.glob('wire-v2-*')):
+    if not root.is_dir():
+        continue
+    report = json.loads((root / 'report.json').read_text())
+    assert report['status'] in ['passed', 'expected-incomplete-task'] and not report['cleanup_failures']
+    assert report['appserver_exit_code'] == 0 and report['owned_scope_drain']['remaining_processes'] == []
+    requests = json.loads((root / 'model-requests.json').read_text())
+    details = []
+    for captured in requests:
+        body = captured['body']
+        namespace = [n for n in body.get('tools', []) if n.get('type') == 'namespace' and n.get('name') == 'mcp__rea_audit']
+        assert len(namespace) == 1 and len(namespace[0]['tools']) == 211, 'Unexpected compaction/catalog: audit before comparing'
+        details.append({'whole_json_tokens_proxy': tokens(body), 'rea_namespace_tokens_proxy': tokens(namespace[0]), 'rea_functions': 211})
+    wire.append({'case': root.name, 'task_completed': report['task_completed'], 'mode': report['mode'],
+                 'budget': report['observations']['tool_output_budget'], 'requests': len(details), 'compactions': report['compaction_requests'],
+                 'whole_json_tokens_proxy': sum(r['whole_json_tokens_proxy'] for r in details), 'request_details': details, **resources(root)})
+for root in sorted(args.lab.glob('sdk-*')):
+    if not root.is_dir():
+        continue
+    report = json.loads((root / 'report.json').read_text())
+    assert report['status'] == 'passed' and not report['cleanup_failures'] and not report['receipt_failures']
+    transcript = json.loads((root / 'transcript.json').read_text())
+    catalog = json.loads((root / 'catalog.json').read_text())
+    assert len(catalog['tools']) == 211 and report['original_target_exited']
+    sdk.append({'case': root.name, 'detail': report['detail'], 'capture': report['capture'], 'tool_calls': len(report['calls']),
+                'exported_bundle_bytes': report['exported_bundle_bytes'], 'answer': report['answer'],
+                'status_calls': [c for c in report['calls'] if c['name'] == 'frida_session_status'],
+                'one_catalog_plus_all_sdk_calls_tokens_proxy': tokens(catalog) + sum(tokens({'name': t['name'], 'input': t['input'], 'reply': t['reply']}) for t in transcript), **resources(root)})
+assert len(sdk) == len(wire) == 4, 'A partial cohort cannot qualify a comparison'
+for capture in ['small', 'libc']:
+    pair = [r for r in sdk if r['capture'] == capture]
+    assert len(pair) == 2 and {r['detail'] for r in pair} == {'complete', 'summary'}
+    assert {k: v for k, v in pair[0]['answer'].items() if k != 'pid'} == {k: v for k, v in pair[1]['answer'].items() if k != 'pid'}
+    reports = [json.loads((args.lab / r['case'] / 'report.json').read_text()) for r in pair]
+    assert reports[0]['load']['source_sha256'] == reports[1]['load']['source_sha256']
+completed = [r for r in wire if r['budget'] == 300000]
+assert len(completed) == 2 and all(r['task_completed'] for r in completed)
+answers = [json.loads((args.lab / r['case'] / 'report.json').read_text())['observations']['answers'] for r in completed]
+comparable_answers = [[{k: v for k, v in a.items() if k != 'parent_evidence_id'} for a in run] for run in answers]
+assert comparable_answers[0] == comparable_answers[1]
+result = {
+    'scope': 'Real local Frida binding with controlled sleep target and caller-authored libc export inventory. Actual Codex0.163 app-server uses a deterministic local SSE fixture: no AI inference, model usage, quality or billing claim. Whole compact JSON token estimates include all 211 schemas and every request replay. Incomplete default baseline is excluded from completed-task gains. SDK exchange estimates are not model-input measurements. Fresh processes have unflushed OS caches; both status reads query live session observations. Timings include the eight-second target lifetime and cleanup; single pairs establish no general speedup. Payload-exit cgroup counters are verified; final whole-scope counters may be unavailable.',
+    'tokenizer': {'package': tiktoken.__version__, 'encoding': enc.name},
+    'runtime_pins': {v: {k: x for k, x in json.loads((args.lab / (v + '-manifest.json')).read_text()).items() if k != 'files'} for v in ['baseline', 'candidate']},
+    'native': json.loads((args.lab / 'native-prerequisite-manifest.json').read_text()),
+    'script_pins': {p.name: hashlib.sha256(p.read_bytes()).hexdigest() for p in Path(__file__).parent.glob('frida*') if p.suffix in ['.py', '.mjs']},
+    'wire': wire, 'sdk': sdk,
+}
+args.output.write_text(json.dumps(result, indent=2) + '\n')
+print(json.dumps({'wire': [{k: v for k, v in r.items() if k != 'request_details'} for r in wire], 'sdk': [{k: v for k, v in r.items() if k not in ['status_calls', 'answer']} for r in sdk]}, indent=2))
@@ -0,0 +1,267 @@
+import assert from "node:assert/strict";
+import { createHash } from "node:crypto";
+import { createWriteStream } from "node:fs";
+import { mkdir, mkdtemp, readFile, writeFile } from "node:fs/promises";
+import { createRequire } from "node:module";
+import { join } from "node:path";
+import { tmpdir } from "node:os";
+import { pathToFileURL } from "node:url";
+import { finished } from "node:stream/promises";
+import { parseArgs } from "node:util";
+import { createRetainedQueryCaller } from "./retained-query-calls.mjs";
+import { finalizeRetainedQueryReceipt } from "./retained-query-finalization.mjs";
+const { values } = parseArgs({
+  options: {
+    runtime: { type: "string" },
+    output: { type: "string" },
+    detail: { type: "string", default: "complete" },
+    capture: { type: "string", default: "libc" },
+  },
+});
+const { runtime, output, detail, capture } = values;
+assert.ok(runtime && output);
+assert.ok(["complete", "summary"].includes(detail));
+assert.ok(["libc", "small"].includes(capture));
+const require = createRequire(join(runtime, "package.json"));
+const { Client } = await import(
+  pathToFileURL(require.resolve("@modelcontextprotocol/client"))
+);
+const { StdioClientTransport } = await import(
+  pathToFileURL(require.resolve("@modelcontextprotocol/client/stdio"))
+);
+const { parseLinuxProcessStat } = await import(
+  pathToFileURL(join(runtime, "dist/process/LinuxProcessStat.js"))
+);
+await mkdir(output, { mode: 0o700 });
+const account = await mkdtemp(join(tmpdir(), "rea-frida-real-"));
+const serverLog = createWriteStream(join(output, "server.log"));
+const serverLogFinished = finished(serverLog);
+serverLogFinished.catch(() => {});
+const client = new Client({ name: "rea-frida-audit", version: "1" });
+const transport = new StdioClientTransport({
+  command: process.execPath,
+  args: [join(runtime, "scripts/rea.mjs"), "mcp"],
+  env: {
+    PATH: process.env.PATH,
+    HOME: account,
+    NODE_OPTIONS: "--max-old-space-size=2048",
+    UV_THREADPOOL_SIZE: "1",
+    REA_LOG_LEVEL: "silent",
+  },
+  stderr: "pipe",
+});
+transport.stderr?.pipe(serverLog, { end: false });
+const report = {
+  question:
+    "Retain a complete caller-requested libc export inventory, then check only session identity/state and message capture coverage twice, preserving complete Evidence.",
+  detail,
+  capture,
+  calls: [],
+  status: "pending",
+};
+const transcript = [];
+const caller = createRetainedQueryCaller(client, (receipt, event) => {
+  report.calls.push(receipt);
+  transcript.push(event);
+});
+const call = async (name, input) => {
+  const r = await caller(name, input, name);
+  assert.ok(!r.isError, JSON.stringify(r));
+  return r.structuredContent;
+};
+const delay = (ms) => new Promise((r) => setTimeout(r, ms));
+let session;
+let birth;
+const stat = async () => {
+  try {
+    return parseLinuxProcessStat(
+      await readFile(`/proc/${session.pid}/stat`, "utf8"),
+    );
+  } catch (e) {
+    if (e.code === "ENOENT") return null;
+    throw e;
+  }
+};
+try {
+  await client.connect(transport);
+  const catalog = await client.listTools();
+  await writeFile(join(output, "catalog.json"), JSON.stringify(catalog));
+  report.catalog_tools = catalog.tools.length;
+  const defs = new Map(catalog.tools.map((t) => [t.name, t]));
+  const orig = client.callTool.bind(client);
+  client.callTool = (input, options) =>
+    orig(input, {
+      ...options,
+      timeout: 30000,
+      toolDefinition: defs.get(input.name),
+    });
+  report.devices = await call("list_frida_devices", {});
+  session = await call("start_frida_session", {
+    mode: "spawn",
+    device_id: "local",
+    program: "/usr/bin/sleep",
+    argv: ["8"],
+  });
+  report.session = session;
+  birth = await stat();
+  assert.ok(birth);
+  report.target_birth = birth;
+  report.same_owned_cgroup =
+    (await readFile(`/proc/${session.pid}/cgroup`, "utf8")) ===
+    (await readFile("/proc/self/cgroup", "utf8"));
+  assert.ok(report.same_owned_cgroup);
+  const source = `send({kind:'ready',pid:Process.id});
+setTimeout(() => {
+  if (${JSON.stringify(capture)} === 'small') { send({kind:'complete',total:0}); return; }
+  const module = Process.enumerateModules().find(m => /(^|\\/)libc\\.so\\.6$/.test(m.path));
+  if (!module) { send({kind:'missing-libc'}); return; }
+  const exports = module.enumerateExports().map(e => ({type:e.type,name:e.name,address:e.address.toString()}));
+  send({kind:'module',pid:Process.id,path:module.path,base:module.base.toString(),size:module.size,total:exports.length});
+  for (let offset = 0; offset < exports.length; offset += 64) send({kind:'exports',offset,items:exports.slice(offset,offset+64)});
+  send({kind:'complete',total:exports.length});
+}, 300);`;
+  await writeFile(join(output, "selected-script.js"), source);
+  report.source_sha256 = createHash("sha256").update(source).digest("hex");
+  const loaded = await call("load_frida_script", {
+    session_id: session.session_id,
+    source_kind: "inline",
+    source,
+  });
+  assert.equal(loaded.normalized_result.source_sha256, report.source_sha256);
+  report.load = loaded.normalized_result;
+  await call("resume_frida_session", { session_id: session.session_id });
+  await delay(750);
+  const snapshots = [];
+  for (let n = 0; n < 2; n++)
+    snapshots.push(
+      await call("frida_session_status", {
+        session_id: session.session_id,
+        ...(detail === "summary" ? { detail } : {}),
+      }),
+    );
+  await call("export_evidence_bundle", { path: join(output, "evidence.json") });
+  const bundle = JSON.parse(
+    await readFile(join(output, "evidence.json"), "utf8"),
+  );
+  for (const snapshot of snapshots) {
+    assert.equal(snapshot.raw_result, null);
+    const parent =
+      detail === "summary"
+        ? bundle.records.find(
+            (e) =>
+              e.evidence_id === snapshot.normalized_result.parent_evidence_id,
+          )
+        : snapshot;
+    assert.ok(parent);
+    assert.equal(parent.authority, "external-service");
+    assert.equal(parent.environment, null);
+    assert.equal(parent.raw_result, null);
+    assert.equal(parent.operation, "frida_session_status");
+    assert.deepEqual(parent.parameters, { session_id: session.session_id });
+    const r = parent.normalized_result;
+    assert.equal(r.pid, session.pid);
+    assert.equal(r.state, "running");
+    assert.equal(r.messages_truncated, false);
+    const payloads = r.messages
+      .filter((m) => m.type === "send")
+      .map((m) => m.payload);
+    const ready = payloads.find((p) => p?.kind === "ready");
+    const complete = payloads.find((p) => p?.kind === "complete");
+    assert.equal(ready?.pid, session.pid);
+    assert.ok(complete);
+    let count = 0;
+    let header;
+    if (capture === "libc") {
+      header = payloads.find((p) => p?.kind === "module");
+      assert.ok(header);
+      assert.equal(header.pid, session.pid);
+      for (const chunk of payloads.filter((p) => p?.kind === "exports")) {
+        assert.equal(chunk.offset, count);
+        count += chunk.items.length;
+      }
+      assert.equal(count, header.total);
+      assert.ok(count > 1000);
+      const maps = await readFile(`/proc/${session.pid}/maps`, "utf8");
+      assert.ok(maps.includes(header.path));
+    }
+    assert.equal(count, complete.total);
+    if (detail === "summary") {
+      const view = snapshot.normalized_result;
+      assert.equal(view.parent_operation, parent.operation);
+      assert.equal(view.parent_digest, parent.evidence_id.slice(3));
+      assert.equal(view.artifact, null);
+      assert.deepEqual(view.source_parameters, parent.parameters);
+      assert.deepEqual(view.source_provider, parent.provider);
+      const { messages, ...metadata } = r;
+      assert.deepEqual(view.summary, {
+        ...metadata,
+        messages_retained: messages.length,
+      });
+      assert.ok(view.unknowns.length > 0);
+      assert.ok(view.limitations.some((m) => m.includes("operating system")));
+      assert.deepEqual(
+        bundle.records.find((e) => e.evidence_id === snapshot.evidence_id),
+        snapshot,
+      );
+    }
+    report.answer = {
+      pid: r.pid,
+      state: r.state,
+      scripts: r.scripts.length,
+      messages: r.messages.length,
+      messages_truncated: r.messages_truncated,
+      exports: count,
+      module_path: header?.path ?? null,
+    };
+  }
+  report.native_oracle =
+    "Caller-authored script digest and contiguous chunk coverage; PID/birthtime/cgroup and libc path independently checked in procfs. Export addresses and native export completeness not independently qualified.";
+  report.exported_bundle_bytes = Buffer.byteLength(
+    await readFile(join(output, "evidence.json")),
+  );
+  await call("close_frida_session", { session_id: session.session_id });
+  session.closed = true;
+  const deadline = performance.now() + 12000;
+  while (true) {
+    const current = await stat();
+    if (
+      current === null ||
+      current.startTime !== birth.startTime ||
+      ["zombie", "dead"].includes(current.lifecycle)
+    ) {
+      report.original_target_exited = true;
+      break;
+    }
+    assert.ok(
+      performance.now() < deadline,
+      "Original target exit not observed",
+    );
+    await delay(50);
+  }
+  report.status = "passed";
+} catch (error) {
+  report.status = "failed";
+  report.failure = String(error?.stack ?? error);
+  process.exitCode = 1;
+} finally {
+  if (session && !session.closed)
+    try {
+      await call("close_frida_session", { session_id: session.session_id });
+    } catch (error) {
+      report.session_cleanup_failure = String(error);
+      process.exitCode = 1;
+    }
+  if (
+    !(await finalizeRetainedQueryReceipt({
+      report,
+      client,
+      transport,
+      account,
+      serverLog,
+      serverLogFinished,
+      output,
+      transcript,
+    }))
+  )
+    process.exitCode = 1;
+}
@@ -0,0 +1,468 @@
+{
+  "scope": "Real local Frida binding with controlled sleep target and caller-authored libc export inventory. Actual Codex0.163 app-server uses a deterministic local SSE fixture: no AI inference, model usage, quality or billing claim. Whole compact JSON token estimates include all 211 schemas and every request replay. Incomplete default baseline is excluded from completed-task gains. SDK exchange estimates are not model-input measurements. Fresh processes have unflushed OS caches; both status reads query live session observations. Timings include the eight-second target lifetime and cleanup; single pairs establish no general speedup. Payload-exit cgroup counters are verified; final whole-scope counters may be unavailable.",
+  "tokenizer": {
+    "package": "0.12.0",
+    "encoding": "cl100k_base"
+  },
+  "runtime_pins": {
+    "baseline": {
+      "source_base": "17f581ff75d2b6cf643a997275e3e296f6c95760",
+      "patch_sha256": "e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855",
+      "archive_sha256": "cd16ca3e36633459bffc10bb90d1fe4ff5887fdd403729765b9a812969013807"
+    },
+    "candidate": {
+      "source_base": "32a4690059907f09fb29e284ad492d94c1722278",
+      "patch_sha256": "e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855",
+      "archive_sha256": "4ac402f1de93f76f71b7ccdb8b8e36d8c8d0a87b1184812f06393bfc6fadccba"
+    }
+  },
+  "native": {
+    "host": "Linux-6.1.0-53-cloud-amd64-x86_64-with-glibc2.36",
+    "toolchain": {
+      "node": "24.18.0",
+      "npm": "11.16.0"
+    },
+    "frida_binding_package_version": "17.23.2",
+    "files": [
+      {
+        "path": "/usr/bin/sleep",
+        "bytes": 43888,
+        "sha256": "4add4bb89d8ca0e3b1bd861130ddd7ae0fd9617a8055de0a38c8d2ca1ac95723"
+      },
+      {
+        "path": "/usr/lib/x86_64-linux-gnu/libc.so.6",
+        "bytes": 1926232,
+        "sha256": "6b4a45352fd0c540a9c7c718f35ce8c8e46a4e482f9d3885a910c32d1a0e1421"
+      },
+      {
+        "path": "/home/yann/yann/rea-perf-next-audit-20261020/node_modules/frida/package.json",
+        "bytes": 2252,
+        "sha256": "7efb59d2050b7b6304e1617f463c4eb7b2f7cb7e3e80e677976825a76ee31e8d"
+      },
+      {
+        "path": "/home/yann/yann/rea-perf-next-audit-20261020/node_modules/frida/build/frida_binding.node",
+        "bytes": 112775824,
+        "sha256": "5b2db5ae57c058ad0765e627d9d9c9c98e4e90c09746c6f727b7a80769eed7a5"
+      }
+    ],
+    "qualifications": {
+      "Inspector": "real REA MCP target, concurrent native metadata only oracle, 776 rows matched hash/length; not global completeness or execution proof",
+      "Frida": "local native binding and controlled sleep spawn; caller script digest and procfs PID/birthtime/cgroup/libc path verified; native export address/global completeness oracle unavailable",
+      "ADB": "default executable unavailable in prior public call; no real device qualified"
+    }
+  },
+  "script_pins": {
+    "frida_status_delivery.py": "ed19bcd003165c7b522c8cdd4799bcf987178e4b79fc8d5c2442012f3bf60b8d",
+    "frida-status-costs.py": "2f3196bcc3198a265f7f4842effc8dce31669723b42f07367f065afee0073906",
+    "frida-status-queries.mjs": "c5919ae8bba046909858e92a945b4472645bbacbfcf88dd75c89ba959a986980",
+    "frida-status-wire.py": "b4d20e64bf77b7815bd43b52569b3e4756983b254ab44c50ddae874d1964ef69"
+  },
+  "wire": [
+    {
+      "case": "wire-v2-baseline-0",
+      "task_completed": false,
+      "mode": "complete",
+      "budget": "client default",
+      "requests": 8,
+      "compactions": 0,
+      "whole_json_tokens_proxy": 540065,
+      "request_details": [
+        {
+          "whole_json_tokens_proxy": 62729,
+          "rea_namespace_tokens_proxy": 53518,
+          "rea_functions": 211
+        },
+        {
+          "whole_json_tokens_proxy": 62917,
+          "rea_namespace_tokens_proxy": 53518,
+          "rea_functions": 211
+        },
+        {
+          "whole_json_tokens_proxy": 63599,
+          "rea_namespace_tokens_proxy": 53518,
+          "rea_functions": 211
+        },
+        {
+          "whole_json_tokens_proxy": 63739,
+          "rea_namespace_tokens_proxy": 53518,
+          "rea_functions": 211
+        },
+        {
+          "whole_json_tokens_proxy": 68261,
+          "rea_namespace_tokens_proxy": 53518,
+          "rea_functions": 211
+        },
+        {
+          "whole_json_tokens_proxy": 72785,
+          "rea_namespace_tokens_proxy": 53518,
+          "rea_functions": 211
+        },
+        {
+          "whole_json_tokens_proxy": 72926,
+          "rea_namespace_tokens_proxy": 53518,
+          "rea_functions": 211
+        },
+        {
+          "whole_json_tokens_proxy": 73109,
+          "rea_namespace_tokens_proxy": 53518,
+          "rea_functions": 211
+        }
+      ],
+      "wall_seconds": 15.993,
+      "cpu_seconds": 8.211179,
+      "family_peak_mib": 830.6484375,
+      "payload_cleanup_verified": true,
+      "final_whole_scope_counters_verified": false
+    },
+    {
+      "case": "wire-v2-baseline-300000",
+      "task_completed": true,
+      "mode": "complete",
+      "budget": 300000,
+      "requests": 8,
+      "compactions": 0,
+      "whole_json_tokens_proxy": 1049997,
+      "request_details": [
+        {
+          "whole_json_tokens_proxy": 62715,
+          "rea_namespace_tokens_proxy": 53518,
+          "rea_functions": 211
+        },
+        {
+          "whole_json_tokens_proxy": 62903,
+          "rea_namespace_tokens_proxy": 53518,
+          "rea_functions": 211
+        },
+        {
+          "whole_json_tokens_proxy": 63577,
+          "rea_namespace_tokens_proxy": 53518,
+          "rea_functions": 211
+        },
+        {
+          "whole_json_tokens_proxy": 63714,
+          "rea_namespace_tokens_proxy": 53518,
+          "rea_functions": 211
+        },
+        {
+          "whole_json_tokens_proxy": 141108,
+          "rea_namespace_tokens_proxy": 53518,
+          "rea_functions": 211
+        },
+        {
+          "whole_json_tokens_proxy": 218504,
+          "rea_namespace_tokens_proxy": 53518,
+          "rea_functions": 211
+        },
+        {
+          "whole_json_tokens_proxy": 218646,
+          "rea_namespace_tokens_proxy": 53518,
+          "rea_functions": 211
+        },
+        {
+          "whole_json_tokens_proxy": 218830,
+          "rea_namespace_tokens_proxy": 53518,
+          "rea_functions": 211
+        }
+      ],
+      "wall_seconds": 15.418,
+      "cpu_seconds": 8.026944,
+      "family_peak_mib": 824.28125,
+      "payload_cleanup_verified": true,
+      "final_whole_scope_counters_verified": false
+    },
+    {
+      "case": "wire-v2-candidate-0",
+      "task_completed": true,
+      "mode": "summary",
+      "budget": "client default",
+      "requests": 8,
+      "compactions": 0,
+      "whole_json_tokens_proxy": 515539,
+      "request_details": [
+        {
+          "whole_json_tokens_proxy": 62791,
+          "rea_namespace_tokens_proxy": 53581,
+          "rea_functions": 211
+        },
+        {
+          "whole_json_tokens_proxy": 62978,
+          "rea_namespace_tokens_proxy": 53581,
+          "rea_functions": 211
+        },
+        {
+          "whole_json_tokens_proxy": 63661,
+          "rea_namespace_tokens_proxy": 53581,
+          "rea_functions": 211
+        },
+        {
+          "whole_json_tokens_proxy": 63803,
+          "rea_namespace_tokens_proxy": 53581,
+          "rea_functions": 211
+        },
+        {
+          "whole_json_tokens_proxy": 64749,
+          "rea_namespace_tokens_proxy": 53581,
+          "rea_functions": 211
+        },
+        {
+          "whole_json_tokens_proxy": 65697,
+          "rea_namespace_tokens_proxy": 53581,
+          "rea_functions": 211
+        },
+        {
+          "whole_json_tokens_proxy": 65837,
+          "rea_namespace_tokens_proxy": 53581,
+          "rea_functions": 211
+        },
+        {
+          "whole_json_tokens_proxy": 66023,
+          "rea_namespace_tokens_proxy": 53581,
+          "rea_functions": 211
+        }
+      ],
+      "wall_seconds": 15.889,
+      "cpu_seconds": 7.939387,
+      "family_peak_mib": 823.69921875,
+      "payload_cleanup_verified": true,
+      "final_whole_scope_counters_verified": false
+    },
+    {
+      "case": "wire-v2-candidate-300000",
+      "task_completed": true,
+      "mode": "summary",
+      "budget": 300000,
+      "requests": 8,
+      "compactions": 0,
+      "whole_json_tokens_proxy": 515713,
+      "request_details": [
+        {
+          "whole_json_tokens_proxy": 62804,
+          "rea_namespace_tokens_proxy": 53581,
+          "rea_functions": 211
+        },
+        {
+          "whole_json_tokens_proxy": 62990,
+          "rea_namespace_tokens_proxy": 53581,
+          "rea_functions": 211
+        },
+        {
+          "whole_json_tokens_proxy": 63677,
+          "rea_namespace_tokens_proxy": 53581,
+          "rea_functions": 211
+        },
+        {
+          "whole_json_tokens_proxy": 63815,
+          "rea_namespace_tokens_proxy": 53581,
+          "rea_functions": 211
+        },
+        {
+          "whole_json_tokens_proxy": 64772,
+          "rea_namespace_tokens_proxy": 53581,
+          "rea_functions": 211
+        },
+        {
+          "whole_json_tokens_proxy": 65731,
+          "rea_namespace_tokens_proxy": 53581,
+          "rea_functions": 211
+        },
+        {
+          "whole_json_tokens_proxy": 65870,
+          "rea_namespace_tokens_proxy": 53581,
+          "rea_functions": 211
+        },
+        {
+          "whole_json_tokens_proxy": 66054,
+          "rea_namespace_tokens_proxy": 53581,
+          "rea_functions": 211
+        }
+      ],
+      "wall_seconds": 15.439,
+      "cpu_seconds": 8.371664,
+      "family_peak_mib": 813.6328125,
+      "payload_cleanup_verified": true,
+      "final_whole_scope_counters_verified": false
+    }
+  ],
+  "sdk": [
+    {
+      "case": "sdk-baseline-libc",
+      "detail": "complete",
+      "capture": "libc",
+      "tool_calls": 8,
+      "exported_bundle_bytes": 214214,
+      "answer": {
+        "pid": 517427,
+        "state": "running",
+        "scripts": 1,
+        "messages": 50,
+        "messages_truncated": false,
+        "exports": 2963,
+        "module_path": "/usr/lib/x86_64-linux-gnu/libc.so.6"
+      },
+      "status_calls": [
+        {
+          "name": "frida_session_status",
+          "input": {
+            "session_id": "ef8982d3-dbf2-43cb-8256-3a4f4bc83cc3"
+          },
+          "phase": "frida_session_status",
+          "elapsed_ms": 197.58100300000024,
+          "reply_bytes": 462831,
+          "is_error": false
+        },
+        {
+          "name": "frida_session_status",
+          "input": {
+            "session_id": "ef8982d3-dbf2-43cb-8256-3a4f4bc83cc3"
+          },
+          "phase": "frida_session_status",
+          "elapsed_ms": 108.50572199999988,
+          "reply_bytes": 462831,
+          "is_error": false
+        }
+      ],
+      "one_catalog_plus_all_sdk_calls_tokens_proxy": 1186065,
+      "wall_seconds": 13.759,
+      "cpu_seconds": 6.097489,
+      "family_peak_mib": 578.5625,
+      "payload_cleanup_verified": true,
+      "final_whole_scope_counters_verified": false
+    },
+    {
+      "case": "sdk-baseline-small",
+      "detail": "complete",
+      "capture": "small",
+      "tool_calls": 8,
+      "exported_bundle_bytes": 2335,
+      "answer": {
+        "pid": 516970,
+        "state": "running",
+        "scripts": 1,
+        "messages": 2,
+        "messages_truncated": false,
+        "exports": 0,
+        "module_path": null
+      },
+      "status_calls": [
+        {
+          "name": "frida_session_status",
+          "input": {
+            "session_id": "3f1f778f-ca18-48ba-a7db-b58afbf4710d"
+          },
+          "phase": "frida_session_status",
+          "elapsed_ms": 79.25232200000028,
+          "reply_bytes": 2643,
+          "is_error": false
+        },
+        {
+          "name": "frida_session_status",
+          "input": {
+            "session_id": "3f1f778f-ca18-48ba-a7db-b58afbf4710d"
+          },
+          "phase": "frida_session_status",
+          "elapsed_ms": 6.851230000000214,
+          "reply_bytes": 2643,
+          "is_error": false
+        }
+      ],
+      "one_catalog_plus_all_sdk_calls_tokens_proxy": 882323,
+      "wall_seconds": 13.039,
+      "cpu_seconds": 4.953337,
+      "family_peak_mib": 577.140625,
+      "payload_cleanup_verified": true,
+      "final_whole_scope_counters_verified": false
+    },
+    {
+      "case": "sdk-candidate-libc",
+      "detail": "summary",
+      "capture": "libc",
+      "tool_calls": 8,
+      "exported_bundle_bytes": 216931,
+      "answer": {
+        "pid": 517901,
+        "state": "running",
+        "scripts": 1,
+        "messages": 50,
+        "messages_truncated": false,
+        "exports": 2963,
+        "module_path": "/usr/lib/x86_64-linux-gnu/libc.so.6"
+      },
+      "status_calls": [
+        {
+          "name": "frida_session_status",
+          "input": {
+            "session_id": "9af7f188-05f8-4559-b570-98556196090e",
+            "detail": "summary"
+          },
+          "phase": "frida_session_status",
+          "elapsed_ms": 159.16798299999937,
+          "reply_bytes": 5597,
+          "is_error": false
+        },
+        {
+          "name": "frida_session_status",
+          "input": {
+            "session_id": "9af7f188-05f8-4559-b570-98556196090e",
+            "detail": "summary"
+          },
+          "phase": "frida_session_status",
+          "elapsed_ms": 61.96135099999992,
+          "reply_bytes": 5597,
+          "is_error": false
+        }
+      ],
+      "one_catalog_plus_all_sdk_calls_tokens_proxy": 885626,
+      "wall_seconds": 12.843,
+      "cpu_seconds": 5.012703,
+      "family_peak_mib": 579.0,
+      "payload_cleanup_verified": true,
+      "final_whole_scope_counters_verified": false
+    },
+    {
+      "case": "sdk-candidate-small",
+      "detail": "summary",
+      "capture": "small",
+      "tool_calls": 8,
+      "exported_bundle_bytes": 5051,
+      "answer": {
+        "pid": 517162,
+        "state": "running",
+        "scripts": 1,
+        "messages": 2,
+        "messages_truncated": false,
+        "exports": 0,
+        "module_path": null
+      },
+      "status_calls": [
+        {
+          "name": "frida_session_status",
+          "input": {
+            "session_id": "1bcda0f5-e3cd-45ee-b82c-5886d8312bc6",
+            "detail": "summary"
+          },
+          "phase": "frida_session_status",
+          "elapsed_ms": 107.78244100000029,
+          "reply_bytes": 5595,
+          "is_error": false
+        },
+        {
+          "name": "frida_session_status",
+          "input": {
+            "session_id": "1bcda0f5-e3cd-45ee-b82c-5886d8312bc6",
+            "detail": "summary"
+          },
+          "phase": "frida_session_status",
+          "elapsed_ms": 5.996030000000246,
+          "reply_bytes": 5595,
+          "is_error": false
+        }
+      ],
+      "one_catalog_plus_all_sdk_calls_tokens_proxy": 885676,
+      "wall_seconds": 13.533,
+      "cpu_seconds": 5.495048,
+      "family_peak_mib": 576.48046875,
+      "payload_cleanup_verified": true,
+      "final_whole_scope_counters_verified": false
+    }
+  ]
+}
@@ -0,0 +1,163 @@
+# Frida status delivery and runtime-observation audit
+
+Issue: [#5640](https://github.com/morluto/rea/issues/5640). Paired runtime base:
+`17f581ff75d2b6cf643a997275e3e296f6c95760`. Final candidate source: `32a4690059907f09fb29e284ad492d94c1722278` (clean tree).
+Exact package, patch, native input,
+script and resource pins are in [the measurement record](frida-status-views.json).
+
+The analyst requests a complete libc export inventory as retained evidence,
+then checks the session's identity/state, script identity, queued message count
+and truncation twice. The caller-authored script enumerates actual native module
+exports in a controlled `/usr/bin/sleep` spawn, in chunks of 64. Both workflows
+retain all captured messages and export the complete Evidence bundle.
+
+Start, status and one-shot contracts share one canonical session envelope.
+Message JSON is validated at the Evidence owner; the summary validates the
+envelope without reinterpreting opaque payloads.
+
+The owning application service now accepts optional `detail=summary` for
+`frida_session_status`. It reads the provider on every call, retains the original
+complete Evidence, then uses the existing shared analysis-view projector.
+The summary omits arbitrary message payloads and preserves all other status
+fields, the retained message count, truncation, exact parent identity/digest,
+provider and source parameters. Default and explicit complete delivery keep the
+original Evidence identity and payload. Historical CLI/file projections use the
+same projector. Source script decoding/representation Evidence and session
+resource ownership are unchanged.
+
+## Completed tasks
+
+The native Frida Node binding package 17.23.2 captured 2,963 libc exports in 50 queued
+messages. Independent checks establish the test-owned process birthtime, cgroup,
+PID and libc mapping; the selected script digest and contiguous chunks are
+checked against the complete retained parent. This does not independently
+validate every native export address or establish global event coverage.
+
+| Public SDK task                            | Complete | Summary |
+| ------------------------------------------ | -------: | ------: |
+| Large-history status reply, bytes per call |  462,831 |   5,597 |
+| Small-history status reply, bytes per call |    2,643 |   5,595 |
+| Large complete bundle, bytes               |  214,214 | 216,931 |
+| Small complete bundle, bytes               |    2,335 |   5,051 |
+| Large task elapsed, seconds                |   13.759 |  12.843 |
+| Large task CPU, seconds                    |    6.097 |   5.013 |
+| Large family peak, MiB                     |    578.6 |   579.0 |
+| Small task elapsed, seconds                |   13.039 |  13.533 |
+| Small task CPU, seconds                    |    4.953 |   5.495 |
+| Small family peak, MiB                     |    577.1 |   576.5 |
+
+Each SDK task discovers all 211 tools and executes eight public calls, including
+two status reads and complete export. Small history contains two readiness/
+completion messages. Fresh processes retain unflushed OS caches. The second
+status read is a repeated live observation, not a cache hit. Every task includes
+the controlled target's eight-second lifetime and verified natural exit.
+Single pairs and this fixed wait establish no general latency/CPU advantage.
+Large status calls took 159.2/62.0 ms versus 197.6/108.5 ms. The first small
+summary status was slower (107.8 versus 79.3 ms).
+
+## Actual client context
+
+Codex app-server 0.163.0 performs the native Frida workflow through the actual
+REA MCP package. A deterministic local Responses/SSE fixture selects the calls;
+there is no AI inference, paid model, model-quality or billing claim. The capture
+contains all 211 tool input schemas on each request and all history replays. `tiktoken`
+0.12.0 `cl100k_base` counts compact JSON as a token estimate, not actual model
+usage. Both completed paths use the same 300,000 tool-output budget.
+
+| Completed client task                  |  Complete | Summary |
+| -------------------------------------- | --------: | ------: |
+| Requests / compactions                 |     8 / 0 |   8 / 0 |
+| Whole request JSON token estimate, sum | 1,049,997 | 515,713 |
+| Elapsed seconds                        |    15.418 |  15.439 |
+| CPU seconds                            |     8.027 |   8.372 |
+| Family peak MiB                        |     824.3 |   813.6 |
+
+The completed task uses **50.9% fewer estimated request tokens**, including
+schemas and continuations. Client elapsed and CPU time increased in this pair. At the client's
+default output budget, complete status JSON is truncated and the task is
+incomplete; summary status is intact and completes. That failed delivery is
+excluded from completed-task gains. Three acceptance tests exercise invalid
+JSON, incorrect counts/state/source linkage, missing chunks and wrong sessions.
+
+The complete catalog plus all SDK exchanges also shrinks for the large case
+(1,186,065 to 885,626 estimated tokens), but grows for the small case (882,323 to
+885,676). These SDK exchange estimates include advertised output schemas and
+are **not** actual model-input measurements. Summary delivery is optional
+because its provenance wrapper costs more than a small complete observation.
+
+## Resource accounting and limits
+
+Runtime cases use one CPU, a 4 GiB cgroup ceiling, a 3 GiB early stop, no swap,
+192 tasks, and host-memory admission/early-stop guards. Payload exit, descendant
+cleanup and zero resource-limit/OOM events are verified while the scope observer
+remains alive. Final whole-scope counters disappear after teardown and remain
+unknown. Runtime family peaks stay below 1 GiB. Build/typecheck use separately
+guarded larger limits; they are not runtime performance measurements.
+
+Full queued messages still undergo validation, Evidence creation and retention;
+this change primarily reduces delivery and repeated context. The extra derived
+record increases retained bundle size. Long-lived heap retention, many-script
+sessions, remote devices, binary messages and saturated capture budgets are not
+performance-qualified by these native cases. Boundary tests preserve malformed
+input, truncation, cancellation and cleanup semantics; simulated providers do
+not qualify real remote behavior.
+
+## Other providers in this audit
+
+Inspector was measured against a test-owned real REA MCP process while it
+handled a verified GitHub CLI Go build-information request. A concurrent native
+CDP metadata subscription matched all 776 retained scripts by hash and reported
+length: 565 file locations and 211 built-ins. The reply was 608,719 bytes;
+capture retained 996/996 events with no reported drop/truncation. The qualification
+run took 20.956 seconds, 18.076 CPU seconds and 987.4 MiB peak family memory,
+including the independent oracle. This is not a paired performance cohort,
+global completeness proof, source-byte validation or evidence of script
+execution. Only `Runtime.enable` and `Debugger.enable` were sent. A prior
+post-capture oracle missed 25 historical rows and was rejected; it does not
+establish an Inspector regression. Existing raw-null delivery, grouped location
+validation and eight-worker projection were already present and were preserved.
+
+ADB's configured default executable is unavailable on this host, and no real
+device is qualified. This audit makes no ADB device-performance claim. Inspector
+selection/caching and Frida queue/filter redesign remain unimplemented without
+an equivalent completed-task measurement that justifies them.
+
+The existing bundled Frida verifier also returned functional success, but its
+1,500 ms fixture outlived the verifier's 500 ms observation. Its payload-exit
+cleanup receipt was therefore unverified and is excluded from qualified
+resource/performance results. That unchanged verifier has no process birthtime
+stamp to safely wait on an arbitrary later PID. The paired harness instead owns
+the paused spawn and records birthtime/cgroup before resume, then waits for the
+original target's natural exit. No PID-only cleanup or target-kill policy was
+introduced.
+
+The shared-service import also exposed an existing module-mock load-order
+assumption in the Evidence-file cancellation test. That one mocked test now
+runs in the existing isolated `process-global` lane, with an assertion that the
+mocked read actually ran. Other file/service tests keep the shared module graph.
+The final exact ten-file gate passes 225 tests with file parallelism disabled
+under one CPU. An earlier parallel gate hit one existing 30-second MCP lifecycle
+timeout; its serial retry passed without increasing a timeout or changing the
+production lifecycle contract.
+
+## Reproduction
+
+Use the pinned Node/npm toolchain and native Frida dependency. Freeze separate
+baseline/candidate built packages and install the same locked dependencies.
+Run each case independently with the resource observer:
+
+```sh
+python3 experiments/analysis-efficiency/resource-run.py --observe-payload-exit -- \
+  node experiments/analysis-efficiency/frida-status-queries.mjs \
+  --runtime /absolute/built-package --output /absolute/new-case \
+  --capture libc --detail summary
+```
+
+Repeat with `--detail complete` and `--capture small`. For actual-client captures,
+`frida-status-wire.py --help` names the runtime, pinned Codex and Node executables,
+output directory and selected script file (`selected-script.js` from the SDK
+case). Use both `--mode complete`/`summary` and `--budget 300000`/`0`.
+`frida-status-costs.py` checks task/resource receipts and counts complete requests.
+The first wire attempt used ambiguous suffix matching for load/unload names;
+the fixture now selects exact operation names. Failed attempts remain outside
+the performance cohort. No production behavior changed to accommodate them.
@@ -0,0 +1,299 @@
+"""Actual Codex wire capture with a deterministic local SSE backend; no AI inference."""
+import argparse
+import http.server
+import threading
+import asyncio
+import hashlib
+import json
+import os
+from pathlib import Path
+import re
+import time
+import traceback
+import subprocess
+from frida_status_delivery import verify_frida_delivery
+
+
+
+async def main():
+    parser = argparse.ArgumentParser(description=__doc__)
+    parser.add_argument("--output", type=Path, required=True)
+    parser.add_argument("--runtime", type=Path, required=True)
+    parser.add_argument("--codex", type=Path, required=True)
+    parser.add_argument("--node", type=Path, required=True)
+    parser.add_argument("--input-profile", choices=["full", "compact"], default="full")
+    parser.add_argument("--output-profile", choices=["full", "off"], default="full")
+    parser.add_argument("--script", type=Path, required=True)
+    parser.add_argument("--expected-tools", type=int, default=211)
+    parser.add_argument("--mode", choices=["complete", "summary"], required=True)
+    parser.add_argument("--budget", type=int, default=30000)
+    args = parser.parse_args()
+    source=args.script.read_text()
+    assert args.runtime.is_absolute() and args.output.is_absolute() and args.script.is_absolute()
+    def delivered(pieces):
+        assert isinstance(pieces,str) and pieces.startswith("Wall time: "), pieces[:300]
+        _,sep,payload=pieces.partition("Output:\n");assert sep
+        try: value=json.loads(payload)
+        except json.JSONDecodeError: return {"_invalid_json_payload":payload}
+        return value["result"] if "result" in value and "normalized_result" not in value else value
+    def outputs_of(body):
+        return {item["call_id"]:delivered(item["output"]) for item in body.get("input",[]) if item.get("type")=="function_call_output"}
+    steps=7
+    args.output.mkdir(mode=0o700)
+    audit_home = args.output / "account"
+    codex_state = audit_home / ".codex"
+    mcp_home = audit_home / "mcp"
+    workspace = audit_home / "workspace"
+    for directory in [codex_state, mcp_home, workspace]:
+        directory.mkdir(parents=True)
+    captured = []
+    known_outputs = {}
+    state = {"normal_requests":0,"compactions":0}
+    class Capture(http.server.BaseHTTPRequestHandler):
+        def log_message(self, *_):
+            pass
+        def do_POST(self):
+            size = int(self.headers["Content-Length"])
+            assert 0 < size <= 16 * 1024 * 1024
+            assert self.headers.get("Content-Encoding", "identity") == "identity"
+            body = json.loads(self.rfile.read(size))
+            captured.append({"path": self.path, "body": body})
+            (args.output / "model-requests.json").write_text(json.dumps(captured) + "\n")
+            http_index = len(captured)
+            known_outputs.update(outputs_of(body))
+            names = [t.get("name", "") for ns in body.get("tools", []) if ns.get("type") == "namespace" and ns.get("name") == "mcp__rea_audit" for t in ns.get("tools", [])]
+            if not names:
+                last=body.get('input',[])[-1]
+                assert 'CONTEXT CHECKPOINT COMPACTION' in json.dumps(last)
+                state['compactions']+=1;assert state['compactions']<=1
+                checkpoint={'fixture':'deterministic observed-ID checkpoint, no AI inference','task':'Check Frida session state, queued message count and truncation twice; retain/export complete observations and close instrumentation.','session_id':known_outputs['call_local_1']['session_id'],'delivered_call_ids':list(known_outputs),'remaining':'Continue scripted tools; source message bodies remain in retained Evidence.'}
+                text=json.dumps(checkpoint)
+                item={"type":"message","id":f"msg_checkpoint_{state['compactions']}","role":"assistant","status":"completed","content":[{"type":"output_text","text":text,"annotations":[]}]}
+                captured[-1]['kind']='deterministic-compaction'
+            else:
+                state['normal_requests']+=1;index=state['normal_requests'];assert index<=steps+1
+                captured[-1]['kind']='tool-planning-or-final'
+                if index<=steps:
+                    if index==1:
+                        operation='start_frida_session';arguments={'mode':'spawn','device_id':'local','program':'/usr/bin/sleep','argv':['8']}
+                    else:
+                        session=known_outputs['call_local_1']['session_id']
+                        if index==2:
+                            operation='load_frida_script';arguments={'session_id':session,'source_kind':'inline','source':source}
+                        elif index==3:
+                            operation='resume_frida_session';arguments={'session_id':session}
+                        elif index in [4,5]:
+                            if index==4: time.sleep(0.75)
+                            operation='frida_session_status';arguments={'session_id':session,**({'detail':'summary'} if args.mode=='summary' else {})}
+                        elif index==6:
+                            operation='close_frida_session';arguments={'session_id':session}
+                        else:
+                            operation='export_evidence_bundle';arguments={'path':str(args.output/'evidence.json')}
+                    selected=[name for name in names if name == operation];assert len(selected)==1
+                    item={"type":"function_call","id":f"fc_local_{index}","call_id":f"call_local_{index}","name":selected[0],"namespace":"mcp__rea_audit","arguments":json.dumps(arguments),"status":"completed"}
+                else:
+                    item={"type":"message","id":"msg_local_done","role":"assistant","status":"completed","content":[{"type":"output_text","text":"Scripted local Frida state and capture-coverage task complete.","annotations":[]}]}
+            response_id=f"resp_local_{http_index}"
+            base = {"id": response_id, "object": "response", "model": body.get("model"), "status": "completed", "output": [item]}
+            events = [
+                {"type": "response.created", "response": {**base, "status": "in_progress", "output": []}},
+                {"type": "response.output_item.added", "output_index": 0, "item": {**item, "status": "in_progress"}},
+                {"type": "response.output_item.done", "output_index": 0, "item": item},
+                {"type": "response.completed", "response": base},
+            ]
+            wire = "".join("event: " + e["type"] + "\ndata: " + json.dumps(e) + "\n\n" for e in events).encode()
+            self.send_response(200)
+            self.send_header("Content-Type", "text/event-stream")
+            self.send_header("Content-Length", str(len(wire)))
+            self.end_headers()
+            self.wfile.write(wire)
+    endpoint = http.server.HTTPServer(("127.0.0.1", 0), Capture)
+    endpoint_thread = threading.Thread(target=endpoint.serve_forever, daemon=True)
+    endpoint_thread.start()
+    task_path = f"{args.node.parent}:/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin"
+    mcp_env = {"HOME": str(mcp_home), "PATH": task_path,
+               "NODE_OPTIONS": "--max-old-space-size=2048", "UV_THREADPOOL_SIZE": "1",
+               "REA_LOG_LEVEL": "silent", "REA_MCP_INPUT_SCHEMA_PROFILE": args.input_profile,
+               "REA_MCP_OUTPUT_SCHEMA_PROFILE": args.output_profile}
+    config = 'model_provider = "rea_capture"\nmodel = "rea-wire-probe"\n[analytics]\nenabled = false\n[mcp_servers.rea_audit]\n'
+    config += f'command = {json.dumps(str(args.node))}\n'
+    config += f'args = {json.dumps([str(args.runtime / "scripts/rea.mjs"), "mcp"])}\n'
+    config += 'startup_timeout_sec = 60\ntool_timeout_sec = 60\n'
+    config += '[mcp_servers.rea_audit.env]\n'
+    config += ''.join(f'{key} = {json.dumps(value)}\n' for key, value in mcp_env.items())
+    for name in ['start_frida_session','load_frida_script','resume_frida_session','frida_session_status','close_frida_session','export_evidence_bundle']:
+        config += f'[mcp_servers.rea_audit.tools.{name}]\napproval_mode = "approve"\n'
+        if args.budget: config += f'output_token_limit = {args.budget}\n'
+    config += f'\n[model_providers.rea_capture]\nname = "Local scripted capture"\nbase_url = "http://127.0.0.1:{endpoint.server_port}/v1"\nwire_api = "responses"\nrequires_openai_auth = false\nsupports_websockets = false\nrequest_max_retries = 0\nstream_max_retries = 0\n'
+    (codex_state / "config.toml").write_text(config)
+    (args.output / "declared-config.toml").write_text(config)
+    environment = {"HOME": str(audit_home), "CODEX_HOME": str(codex_state), "PATH": task_path,
+                   "NODE_OPTIONS": "--max-old-space-size=2048", "UV_THREADPOOL_SIZE": "1"}
+    report = {"question": "Retain a caller-requested native libc export inventory, check session identity/state, queued message count and truncation twice, close instrumentation and export complete Evidence.",
+              "client": "Codex app-server 0.163.0", "model_turns_started": 1, "backend": "local deterministic SSE fixture; no AI model or paid service",
+              "actual_model_usage": None, "input_profile": args.input_profile,
+              "output_profile": args.output_profile, "calls": [], "observations": [],
+              "unexpected_server_requests": [], "cleanup_failures": []}
+    client_version = subprocess.check_output([str(args.codex), "--version"], env=environment, cwd=workspace, text=True, timeout=10).strip()
+    assert client_version == "codex-cli 0.163.0", client_version
+    transcript = []
+    pending = {}
+    completed_turn = asyncio.Event()
+    next_id = 0
+    stderr = (args.output / "server.log").open("wb")
+    process = await asyncio.create_subprocess_exec(str(args.codex), "app-server", "--stdio",
+        stdin=asyncio.subprocess.PIPE, stdout=asyncio.subprocess.PIPE, stderr=stderr,
+        cwd=workspace, env=environment, limit=16 * 1024 * 1024)
+
+    async def send(message):
+        encoded = (json.dumps(message, separators=(",", ":")) + "\n").encode()
+        transcript.append({"direction": "client", "bytes": len(encoded), "message": message})
+        process.stdin.write(encoded)
+        await process.stdin.drain()
+
+    async def read_messages():
+        try:
+            while line := await process.stdout.readline():
+                value = json.loads(line)
+                transcript.append({"direction": "server", "bytes": len(line), "message": value})
+                if value.get("method") == "turn/completed":
+                    report["turn"] = value["params"]["turn"]
+                    completed_turn.set()
+                if "id" in value and "method" not in value:
+                    future = pending.pop(value["id"], None)
+                    if future and not future.done():
+                        future.set_result(value)
+                elif "id" in value:
+                    report["unexpected_server_requests"].append(value["method"])
+                    await send({"id": value["id"], "error": {"code": -32601, "message": "Unexpected request in scripted metadata probe"}})
+            raise RuntimeError("app-server stdout closed")
+        except Exception as error:
+            for future in pending.values():
+                if not future.done():
+                    future.set_exception(error)
+
+    reader = asyncio.create_task(read_messages())
+
+    async def request(method, params):
+        nonlocal next_id
+        assert method in ["initialize", "thread/start", "mcpServerStatus/list", "mcpServer/tool/call", "turn/start"]
+        next_id += 1
+        message = {"id": next_id, "method": method, "params": params}
+        future = asyncio.get_running_loop().create_future()
+        pending[next_id] = future
+        start = time.monotonic()
+        await send(message)
+        reply = await asyncio.wait_for(future, 90)
+        report["calls"].append({"method": method, "elapsed_ms": (time.monotonic() - start) * 1000,
+                                "error": reply.get("error")})
+        if "error" in reply:
+            raise RuntimeError(json.dumps(reply["error"])[:4000])
+        return reply["result"]
+
+    try:
+        await request("initialize", {"clientInfo": {"name": "rea_host_probe", "title": "REA host compatibility probe", "version": "1"},
+                                     "capabilities": {"experimentalApi": True, "explicitGatewayOauth": True}})
+        await send({"method": "initialized"})
+        created = await request("thread/start", {"cwd": str(workspace), "ephemeral": True,
+                    "approvalPolicy": "never", "sandbox": "read-only"})
+        thread_id = created["thread"]["id"]
+        assert not created["thread"].get("turns", [])
+        inventory = await request("mcpServerStatus/list", {"threadId": thread_id,
+                    "serverName": "rea_audit", "detail": "toolsAndAuthOnly", "limit": 10})
+        assert inventory.get("nextCursor") is None
+        assert len(inventory["data"]) == 1
+        server = inventory["data"][0]
+        assert server["name"] == "rea_audit" and server.get("toolsError") is None
+        tools = list(server["tools"].values())
+        names = [tool["name"] for tool in tools]
+        assert len(names) == len(set(names)) == args.expected_tools
+        assert "frida_session_status" in names
+        output_schemas = sum(tool.get("outputSchema") is not None for tool in tools)
+        assert output_schemas == (args.expected_tools if args.output_profile == "full" else 0)
+        raw = json.dumps(inventory, separators=(",", ":"), ensure_ascii=False).encode()
+        (args.output / "catalog.json").write_bytes(raw)
+        report["catalog"] = {"tools": len(tools), "output_schemas": output_schemas,
+                             "bytes": len(raw), "sha256": hashlib.sha256(raw).hexdigest(),
+                             "server_info": server.get("serverInfo"), "runtime_status": server.get("runtimeStatus")}
+        await request("turn/start", {"threadId":thread_id,"input":[{"type":"text","text":"Retain a complete libc export inventory using the selected caller-authored script. Check session state and queued message capture count/truncation twice, close Frida instrumentation and export complete Evidence. The local fixture scripts the tools; no AI inference."}]})
+        await asyncio.wait_for(completed_turn.wait(), 90)
+        assert report["turn"]["status"] == "completed", report["turn"]
+        assert state["normal_requests"]==steps+1
+        assert len(captured)==steps+1+state["compactions"]
+        outputs=known_outputs
+        assert len(outputs)==steps
+        bundle=json.loads((args.output/'evidence.json').read_text())
+        delivery_complete=True
+        answers=[]
+        for index in [4,5]:
+            delivered_result=outputs[f'call_local_{index}']
+            answer=verify_frida_delivery(delivered_result,bundle,args.mode,args.budget,outputs['call_local_1'])
+            if answer is None: delivery_complete=False
+            else: answers.append(answer)
+        loaded=next(e for e in bundle['records'] if e['operation']=='load_frida_script')
+        assert loaded['normalized_result']['source_sha256']==hashlib.sha256(source.encode()).hexdigest()
+        report['task_completed']=delivery_complete
+        report['observations']={'answers':answers,'exported':True,'exported_bundle_bytes':(args.output/'evidence.json').stat().st_size,'tool_output_budget':args.budget or 'client default','source_sha256':hashlib.sha256(source.encode()).hexdigest()}
+        report["captured_requests"]=len(captured)
+        report["compaction_requests"]=state["compactions"]
+        report["compaction_backend"]="Deterministic checkpoint of observed identifiers and retained-body location; no AI inference or quality claim."
+        report["mode"]=args.mode
+        report["request_tool_counts"] = [len(c["body"].get("tools", [])) for c in captured]
+        assert not report["unexpected_server_requests"]
+        report["status"] = "passed" if report["task_completed"] else "expected-incomplete-task"
+    except Exception:
+        report["status"] = "failed"
+        report["failure"] = traceback.format_exc()[-6000:]
+    finally:
+        process.stdin.close()
+        try:
+            await asyncio.wait_for(process.wait(), 15)
+        except asyncio.TimeoutError:
+            report["cleanup_failures"].append("app-server did not exit after stdin close; terminated owned process")
+            process.terminate()
+            try:
+                await asyncio.wait_for(process.wait(), 5)
+            except asyncio.TimeoutError:
+                process.kill()
+                await process.wait()
+        await reader
+        # app-server can acknowledge exit before its MCP child finishes EOF
+        # cleanup. Wait on the allocated resource scope; never target a PID.
+        try:
+            groups = [line[3:] for line in Path("/proc/self/cgroup").read_text().splitlines()
+                      if line.startswith("0::")]
+            assert len(groups) == 1
+            group = Path("/sys/fs/cgroup") / groups[0].lstrip("/")
+            assert re.fullmatch(r"rea-efficiency-[0-9a-f]{32}\.scope", group.name)
+            observer = os.getppid()
+            observer_args = Path(f"/proc/{observer}/cmdline").read_bytes().split(b"\0")
+            assert any(Path(os.fsdecode(value)).name == "resource_payload.py" for value in observer_args if value)
+            expected = {os.getpid(), observer}
+            until = time.monotonic() + 10
+            while True:
+                actors = {int(value) for value in (group / "cgroup.procs").read_text().splitlines()}
+                assert expected <= actors
+                remaining = sorted(actors - expected)
+                if not remaining or time.monotonic() >= until:
+                    break
+                await asyncio.sleep(0.05)
+            report["owned_scope_drain"] = {"remaining_processes": remaining}
+            if remaining:
+                report["cleanup_failures"].append("owned MCP child did not settle after app-server exit")
+        except (OSError, ValueError, AssertionError) as error:
+            report["owned_scope_drain"] = {"status": "unavailable", "reason": type(error).__name__}
+            report["cleanup_failures"].append("allocated resource-scope cleanup could not be verified")
+        endpoint.shutdown()
+        endpoint.server_close()
+        endpoint_thread.join(5)
+        stderr.close()
+        report["appserver_exit_code"] = process.returncode
+        if process.returncode != 0:
+            report["cleanup_failures"].append(f"app-server exit code: {process.returncode}")
+        (args.output / "transcript.json").write_text(json.dumps(transcript) + "\n")
+        (args.output / "report.json").write_text(json.dumps(report, indent=2) + "\n")
+        print(json.dumps({key: report.get(key) for key in ["status", "failure", "catalog", "observations", "cleanup_failures", "appserver_exit_code"]}))
+    return 0 if report["status"] in ["passed","expected-incomplete-task"] and not report["cleanup_failures"] else 1
+
+
+raise SystemExit(asyncio.run(main()))
@@ -0,0 +1,37 @@
+"""Accept only complete client delivery of the selected Frida status question."""
+
+
+def verify_frida_delivery(delivered, bundle, mode, budget, session):
+    if '_invalid_json_payload' in delivered:
+        assert mode == 'complete' and budget == 0, 'A truncated summary never completes the task'
+        return None
+    value = delivered['normalized_result']
+    parent = next(e for e in bundle['records'] if e['evidence_id'] == value['parent_evidence_id']) if mode == 'summary' else delivered
+    assert parent in bundle['records'] and parent['operation'] == 'frida_session_status'
+    assert parent['authority'] == 'external-service' and parent['environment'] is None
+    assert parent['raw_result'] is None and parent['subject'] is None
+    assert parent['parameters'] == {'session_id': session['session_id']}
+    facts = parent['normalized_result']
+    assert facts['state'] == 'running' and not facts['messages_truncated']
+    assert facts['session_id'] == session['session_id'] and facts['pid'] == session['pid']
+    payloads = [m['payload'] for m in facts['messages'] if m.get('type') == 'send']
+    header = next(p for p in payloads if p['kind'] == 'module')
+    complete = next(p for p in payloads if p['kind'] == 'complete')
+    count = 0
+    for chunk in [p for p in payloads if p['kind'] == 'exports']:
+        assert chunk['offset'] == count
+        count += len(chunk['items'])
+    assert count == header['total'] == complete['total'] and count > 1000
+    assert facts['pid'] == header['pid']
+    if mode == 'summary':
+        assert delivered in bundle['records']
+        assert delivered['subject'] is None and delivered['raw_result'] is None
+        assert delivered['authority'] == parent['authority']
+        assert value['parent_operation'] == parent['operation']
+        assert value['source_parameters'] == parent['parameters'] and value['source_provider'] == parent['provider']
+        assert value['parent_digest'] == parent['evidence_id'][3:] and value['artifact'] is None
+        assert value['summary'] == {**{k: v for k, v in facts.items() if k != 'messages'}, 'messages_retained': len(facts['messages'])}
+        assert value['unknowns'] and value['limitations']
+    return {'state': facts['state'], 'messages_retained': len(facts['messages']),
+            'messages_truncated': facts['messages_truncated'], 'exports': count,
+            'parent_evidence_id': parent['evidence_id']}
@@ -0,0 +1,74 @@
+"""Count verified Go tasks; tokenizer estimates are not model usage or billing."""
+import argparse
+import hashlib
+import json
+from pathlib import Path
+
+import tiktoken
+
+
+def compact(value):
+    return json.dumps(value, ensure_ascii=False, separators=(",", ":"), allow_nan=False)
+
+
+def inspect(path, encoding):
+    report = json.loads((path / "report.json").read_text())
+    catalog = json.loads((path / "catalog.json").read_text())
+    transcript = json.loads((path / "transcript.json").read_text())
+    log = path.with_suffix(".log")
+    scope = next(json.loads(line) for line in reversed(log.read_text().splitlines())
+                 if line.startswith('{"resource_scope":'))
+    observed = scope.get("payload_resource_observation") or {}
+    events = observed.get("resource_events", {})
+    memory = events.get("memory.events", {})
+    verified = (report["status"] == "observed"
+                and not report["cleanup_failures"] and not report["receipt_failures"]
+                and scope["abort"] is None
+                and scope.get("payload_resource_observation_verified") is True
+                and observed.get("payload_cleanup_verified") is True
+                and observed.get("payload_exit_code") == 0
+                and all(memory.get(key) == 0 for key in ["high", "max", "oom", "oom_kill"])
+                and events.get("pids.events", {}).get("max") == 0)
+    count = lambda value: len(encoding.encode(value, disallowed_special=()))
+    inputs = count(compact([{key: tool[key] for key in ["name", "description", "inputSchema"]}
+                            for tool in catalog["tools"]]))
+    arguments = sum(count(compact({"name": event["name"], "arguments": event["input"]}))
+                    for event in transcript)
+    replies = sum(count(block["text"]) for event in transcript
+                  for block in event["reply"]["content"] if block["type"] == "text")
+    cpu = observed.get("cpu_stat", {}).get("usage_usec")
+    return {"case": path.name, "completed_with_verified_cleanup": verified,
+            "mode": report["mode"], "warm_diagnostic": report["warm_diagnostic"],
+            "answer": report["answer"], "parent_evidence_id": report["parent_evidence_id"],
+            "artifact_sha256": report["artifact_sha256"],
+            "complete_result_sha256": report["complete_result_file_sha256"],
+            "calls": report["calls"], "wall_seconds": scope["elapsed_seconds"],
+            "cpu_seconds": None if cpu is None else cpu / 1e6,
+            "kernel_family_peak_bytes": observed.get("memory_peak_bytes"),
+            "events_at_payload_exit": events,
+            "final_whole_scope_events": scope.get("resource_events_final"),
+            "token_proxy": {"input_catalog": inputs, "arguments": arguments,
+                            "text_replies": replies, "combined": inputs + arguments + replies,
+                            "complete_transport_catalog": count(compact(catalog))},
+            "sha256": {file.name: hashlib.sha256(file.read_bytes()).hexdigest()
+                       for file in [path / "report.json", path / "catalog.json",
+                                    path / "transcript.json", log]}}
+
+
+def main():
+    parser = argparse.ArgumentParser(description=__doc__)
+    parser.add_argument("--output", type=Path, required=True)
+    parser.add_argument("cases", type=Path, nargs="+")
+    args = parser.parse_args()
+    encoding = tiktoken.get_encoding("cl100k_base")
+    records = [inspect(path, encoding) for path in args.cases]
+    receipt = {"tiktoken": tiktoken.__version__, "encoding": encoding.name,
+               "actual_model_usage": None,
+               "projection": "All discovered input schemas once, plus every call's arguments and text replies, including export. Full transport catalog counted separately; no model turn or host injection measured.",
+               "recordings": records}
+    args.output.write_text(json.dumps(receipt, ensure_ascii=False, indent=2) + "\n")
+    assert all(record["completed_with_verified_cleanup"] for record in records)
+
+
+if __name__ == "__main__":
+    main()
@@ -0,0 +1,81 @@
+"""Pin a completed Go report only after checking native build text and file bytes."""
+import argparse
+import base64
+import hashlib
+import json
+from pathlib import Path
+import subprocess
+
+
+def main():
+    parser = argparse.ArgumentParser(description=__doc__)
+    parser.add_argument("--evidence", type=Path, required=True)
+    parser.add_argument("--input", type=Path, required=True)
+    parser.add_argument("--go", type=Path, required=True)
+    parser.add_argument("--dependency", required=True)
+    parser.add_argument("--output", type=Path, required=True)
+    args = parser.parse_args()
+    source = args.input.read_bytes()
+    evidence = json.loads(args.evidence.read_text())
+    if "records" in evidence:
+        evidence = next(record for record in evidence["records"]
+                        if record["operation"] == "inspect_go_binary"
+                        and record["parameters"] == {"path": str(args.input)})
+    report = evidence["normalized_result"]
+    info = report["build_info"]
+    digest = hashlib.sha256(source).hexdigest()
+    assert report["artifact"] == {"path": str(args.input), "sha256": digest,
+                                  "bytes": len(source)}
+    native = subprocess.check_output(
+        [str(args.go), "version", "-m", str(args.input)], text=True)
+    lines = native.splitlines()
+    assert info["go_version"] == lines[0].rsplit(" ", 1)[1]
+    text = "\n".join(line.removeprefix("\t") for line in lines[1:]) + "\n"
+    assert info["module_text"] == text
+    for name in ["version", "module"]:
+        location = info[name + "_location"]
+        key = ("go_version" if name == "version" else "module") + "_bytes_base64"
+        assert source[location["offset"]:location["offset"] + location["bytes"]] == base64.b64decode(info[key])
+    # Module identity columns are literal tab-separated fields. Preserve empty
+    # sums, development versions, original ordering and local replacements.
+    dependencies = []
+    main_module = None
+    previous = None
+    for line in text.splitlines():
+        columns = line.split("\t")
+        tag = columns[0]
+        if tag not in ["dep", "mod", "=>"]:
+            continue
+        assert len(columns) in [3, 4], columns
+        item = {"path": columns[1], "version": columns[2],
+                "sum": columns[3] if len(columns) == 4 else None}
+        if tag == "=>":
+            assert previous is not None
+            previous["replacement"] = item
+        else:
+            item["replacement"] = None
+            previous = item
+            if tag == "mod":
+                main_module = item
+            else:
+                dependencies.append(item)
+    assert info["module"]["main"] == main_module
+    assert info["module"]["dependencies"] == dependencies
+    answer = {"go_version": info["go_version"], "main": main_module,
+              "runtime_dependencies": "unknown",
+              "dependencies": [{"index": index, **item}
+                               for index, item in enumerate(dependencies)
+                               if item["path"] == args.dependency]}
+    complete = args.output.with_suffix(".complete-result.json")
+    complete.write_text(json.dumps(report, ensure_ascii=False, indent=2) + "\n")
+    receipt = {"artifact_sha256": digest, "dependency_path": args.dependency,
+               "dependency_count": len(dependencies), "answer": answer,
+               "complete_result_path": str(complete.resolve()),
+               "native_text_sha256": hashlib.sha256(native.encode()).hexdigest(),
+               "native_go_path": str(args.go),
+               "native_go_sha256": hashlib.sha256(args.go.read_bytes()).hexdigest()}
+    args.output.write_text(json.dumps(receipt, ensure_ascii=False, indent=2) + "\n")
+
+
+if __name__ == "__main__":
+    main()
@@ -0,0 +1,195 @@
+# Selected Go build metadata
+
+Addresses [#5499](https://github.com/morluto/rea/issues/5499). A compiler/main-module
+identity question previously required the complete Go report, including raw framed
+bytes, base64, module text and every parsed dependency. Opt-in `detail: summary`
+retains the same complete parent and returns identity, source ranges, counts and
+explicit unknowns. Default complete delivery remains compatible.
+
+`inspect_analysis_view` reuses that parent for `kind: go`, collection
+`dependencies` or `settings`. Exact paths/keys and original indices intersect;
+fields select columns, while every row keeps its original index. Pagination
+counts matching rows in producer order, including duplicate module paths. The
+view never reopens a target or reparses module text. Unknown lines and original
+bytes remain in the complete parent. CLI summaries save that parent in a new
+Evidence bundle before returning their projection.
+
+Only immutable authenticated Evidence results reuse schema validation, keyed
+by their object identity for the Evidence lifetime. Mutable inline results are
+validated on each call. Subject identity is checked separately on every view.
+There is no live-file cache. Only page rows are projected; inherited messages
+use the existing bounded, deduplicating view-message owner.
+
+## Question and independent checks
+
+The main artifact is the official GitHub CLI v2.102.0 Linux amd64 release:
+42,086,560 bytes, SHA-256
+`7469124f706944133d6a169691dd1c6c3511b12e85878d255e044e2948df4c9b`.
+The archive digest matches its official GitHub asset metadata. Its embedded
+compiler is `go1.27.1`, main module `github.com/cli/cli/v2@v2.102.0`, and it has
+165 parsed dependency records. The selected `golang.org/x/crypto@v0.57.0` record
+keeps original index 152. These are embedded observations, not authentication
+of the compiler, supply chain or runtime behavior.
+
+Native `go version -m` independently matches module text, main identity and all
+165 dependency identities in original order. Original file ranges match the
+reported compiler and framed module bytes. Before/after exports have identical
+complete normalized results and parent Evidence identity. The small real case
+is the installed 12,366,352-byte Go tool: embedded `go1.23.5`, no decoded main
+module and zero retained dependencies, with dependency coverage still unknown.
+REA reads both inputs without executing them. The installed Go tool also runs
+as the trusted native verifier; the downloaded GitHub CLI binary is never
+executed.
+
+Timing baseline is main `ee12d517a25d34853d40e31fc039c7d1576c60e1`. Packaged runtimes
+and source patch are pinned in the [receipt](go-build-views.json); later changes
+do not relabel these timings. Node 24.18.0/npm 11.16.0, MCP SDK 2.3.1, Linux
+x86-64. Fresh processes use unflushed OS caches; the SDK controller pre-reads
+the input for verification. These are not disk-cold measurements.
+
+## Actual client context, including every request
+
+The [wire driver](go-build-wire.py) starts actual Codex app-server 0.163.0 with a
+fresh account/workspace and a loopback deterministic Responses SSE backend.
+It starts a scripted turn and real MCP calls, with **no AI inference or paid
+service**. All 210 tools remain discovered/advertised. Full input/output
+profiles are explicit, and each relevant tool has a 30,000-token output budget
+so complete JSON is delivered without retries or truncation. This does not
+qualify another client's defaults or a real model's reasoning/schema acceptance.
+
+All original facts and parent identities match the native oracle. Export cases
+also verify the complete parent. The [counter](go-build-wire-costs.py) counts
+**every captured request**, including repeated schemas and accumulated tool
+outputs, using `tiktoken 0.12.0` / `cl100k_base` on compact request JSON. These are
+serialization-token proxies; actual model rendering, usage and cache billing
+remain unmeasured.
+
+| Completed question                                     | Requests before → after | Whole request JSON proxy before → after |
+| ------------------------------------------------------ | ----------------------: | --------------------------------------: |
+| Compiler, main module and dependency count             |                   2 → 2 |          158,529 → 123,368 (22.2% less) |
+| Compiler, main module and one selected dependency      |                   2 → 3 |          158,538 → 186,812 (17.8% more) |
+| Same selected dependency question plus Evidence export |                   3 → 4 |           256,342 → 250,352 (2.3% less) |
+
+The actual REA namespace costs 51,821 → 51,983 proxy tokens **per request**.
+An extra round can outweigh a smaller reply. Summary is useful when identity
+and counts already answer the question; complete delivery remains useful for
+an initial compound question. Retained views provide selected follow-up facts,
+without a claim that every such composition saves total context.
+
+One recording per cell: identity wall/CPU/family peak is
+6.970 s / 6.331 s / 861.5 MiB before and 7.069 s / 6.457 s / 857.0 MiB after.
+Compound answer-only is 6.973 / 6.333 / 865.0 before and 6.969 / 6.348 / 861.6
+after. Export is 7.175 / 6.537 / 866.7 before and 7.274 / 6.568 / 872.6 after.
+These scripted-client observations establish no universal latency or memory
+gain, and do not measure model inference time.
+
+## Direct SDK task and cold/warm costs
+
+The [SDK driver](go-build-views.mjs) discovers all tools, answers the compound
+question, verifies exact facts and exports complete Evidence. Before: one
+complete inspection and export. After: summary, selected dependency and export.
+For the zero-dependency small case, the summary avoids an unnecessary empty
+query. Two repetitions alternate version/target order. All 208 other named
+catalog definitions agree; only Go inspection and the retained-view tool change.
+
+| Input      | Whole wall s before → after | Family CPU s before → after | Kernel family peak MiB before → after |
+| ---------- | --------------------------- | --------------------------- | ------------------------------------- |
+| GitHub CLI | 4.855–4.952 → 6.370–6.564   | 4.682–4.725 → 6.175–6.400   | 671.2–680.1 → 846.4–868.7             |
+| Go tool    | 4.349–4.351 → 4.250–4.450   | 4.093–4.140 → 4.092–4.179   | 548.4–548.6 → 544.3–555.6             |
+
+Cold selected-query calls take 1.719–1.751 s in the SDK task, including its
+output-schema validation. A separate warm diagnostic takes 1.712 s for the first
+query and 32.86 ms for the repeat in one session; both the client validator and
+retained facts are warm. This is not a paired whole-task speedup. The complete
+warm diagnostic is separately recorded, not mixed into the eight matched runs.
+
+The [SDK counter](go-build-view-costs.py) counts the discovered input catalog
+once plus all arguments and text replies, including export: 229,183 → 195,643
+for GitHub CLI and 194,854 → 194,724 for the small case. Catalog cost grows
+193,192 → 193,652. This catalog-once projection is **not** the actual host
+exchange above; omitting repeated schemas would hide the compound-task penalty.
+
+All qualified recordings use one CPU, a 4 GiB hard/3 GiB early family memory
+boundary, no swap and 192 tasks. Verified payload exits are zero, only the
+observer remains, and observed memory/task resource events are zero. Kernel
+family peaks include attributed file cache. Final whole-scope counters are
+unavailable. Release acquisition, oracle preparation and compilation are outside
+the timed tasks. An initial symlink input was correctly refused; qualification
+explicitly selects its regular target. One development static check was stopped
+by the host-available-memory guard, with owned cleanup verified and no observed
+OOM; the unchanged guard succeeded after headroom recovered.
+
+## Coverage and reproduction
+
+Executed: 10 files / 202 tests covering existing Go readers, mappings, provider,
+CLI/MCP and Rust readers, plus selected rows, duplicate paths, empty filters,
+identity-only fields, malformed/mutable parents, source conflicts, bounded
+messages and unavailable metadata. Actual CLI complete output is identical
+before/after; summary bundles retain that exact parent, and file-based CLI
+selected queries match the native oracle. Full `npm run check` passed.
+After rebasing onto main `c374c2fe7`, the 202 focused tests, full
+`npm run check` and `npm run docs:check` (including five README consistency
+tests) pass again. A real SDK selected query and complete export also pass
+against that rebuilt runtime, retaining the original parent identity and all
+165 dependencies. These checks do not relabel the frozen timing cohort.
+
+A review found that a transcript-write failure could skip the SDK driver's
+cleanup. The shared finalizer now closes owned resources before publishing the
+optional transcript and records publication failures separately. All 11 receipt
+failure tests pass. A real selected SDK task and full export pass again; the
+same task with an injected transcript-write failure exits 1, preserves its
+answer and failure receipt, and verifies that the process family was cleaned.
+These qualification runs do not replace the frozen performance measurements.
+
+A second review found that a valid external parent could disagree with its
+report's architecture. Go domain now owns the existing architecture-to-subject
+mapping; both Evidence production and every Go view use it. The view checks
+mapped architecture as well as path, digest and format, including `null` for
+unrecognized report names. All 213 focused tests pass, including authenticated
+inline/file conflicts and known-alias/unknown-architecture cases.
+
+Initial CI also exposed two existing baseline failures. On unmodified `c374c2fe7`,
+`src/cliJsonPaths.test.ts` has the same three URL-message assertion failures.
+The duplication gate is already above its 3.5% threshold: 31,737 / 899,602 lines
+(3.52789%) on baseline versus 31,748 / 900,474 (3.52570%) on the initial PR head.
+These were reproduced separately with the pinned toolchain, bounded resources
+and verified cleanup; this PR leaves those unrelated failures unchanged.
+
+Final qualification rebased onto main `cf5194f68`, preserving its new IL2CPP
+view contract alongside the Go additions. All 258 tests in 12 files pass,
+including 32 IL2CPP view tests and the now-fixed CLI path assertions. Full
+`npm run check`, `npm run docs:check` plus five README tests, and the real SDK
+selected query/full export pass again. Complete parent identity and all 165
+dependencies remain exact. Duplication now passes: baseline 31,644 / 904,778
+lines (3.49743%), PR 31,612 / 905,740 (3.49018%), against 3.5%.
+One latest-main build was guard-stopped during a host-memory dip; its owned
+scope was verified inactive with zero OOM events, then the unchanged guard's
+retry passed. These results qualify the rebased source, not new task timings.
+
+The broader metadata audit also read three real Rust binaries. Alpine ripgrep
+14.1.1-r0's original `.dep-v0` matches native `readelf` coordinates and independent
+zlib/JSON decoding: 42 packages, 88 indexed edges, root index 33. The other two
+have no dependency section, which remains unknown coverage. Compiler-path
+inferences in all three match native read-only ranges and original byte offsets;
+they remain inferences. These fast metadata reads did not justify a Rust cache.
+The Alpine archive is pinned by observed SHA-256; APK signatures were not checked.
+Real provider verification here covers Linux ELF; PE/Mach-O use authored fixtures.
+
+To reproduce, use built baseline/candidate runtimes and the pinned public input.
+Create a baseline complete CLI Evidence JSON, then pin the independent oracle:
+
+```sh
+python3 experiments/analysis-efficiency/go-build-view-oracle.py \
+  --evidence /tmp/baseline-evidence.json --input /absolute/gh \
+  --go /absolute/go --dependency golang.org/x/crypto --output /tmp/go-oracle.json
+```
+
+Run `go-build-views.mjs` with absolute `--runtime`, `--input`, `--oracle` and
+new `--output` directories, and `--mode complete` or `selected`, under
+`resource-run.py --observe-payload-exit`. `--warm` adds a separate diagnostic.
+The wire driver additionally requires pinned `--codex` and `--node`, and takes
+`--question identity --mode complete|summary` or
+`--question dependency --mode complete|selected`; `--export` adds export.
+All wire recordings require the same resource guard for owned-scope cleanup.
+Counter scripts take `--output` and recording directories, with their guard
+logs at the same path plus `.log`. Both counters require `tiktoken==0.12.0`.
@@ -0,0 +1,228 @@
+import assert from "node:assert/strict";
+import { createHash } from "node:crypto";
+import { createWriteStream } from "node:fs";
+import { mkdir, mkdtemp, readFile, writeFile } from "node:fs/promises";
+import { createRequire } from "node:module";
+import { tmpdir } from "node:os";
+import { join, resolve } from "node:path";
+import { finished } from "node:stream/promises";
+import { pathToFileURL } from "node:url";
+import { parseArgs } from "node:util";
+import { createRetainedQueryCaller } from "./retained-query-calls.mjs";
+import { finalizeRetainedQueryReceipt } from "./retained-query-finalization.mjs";
+
+const { values } = parseArgs({
+  options: {
+    runtime: { type: "string" },
+    input: { type: "string" },
+    oracle: { type: "string" },
+    output: { type: "string" },
+    mode: { type: "string" },
+    warm: { type: "boolean", default: false },
+  },
+});
+for (const key of ["runtime", "input", "oracle", "output"])
+  assert.equal(values[key], resolve(values[key]));
+assert.ok(["complete", "selected"].includes(values.mode));
+const oracle = JSON.parse(await readFile(values.oracle, "utf8"));
+const sha256 = (bytes) => createHash("sha256").update(bytes).digest("hex");
+const bytes = await readFile(values.input);
+assert.equal(sha256(bytes), oracle.artifact_sha256);
+const require = createRequire(join(values.runtime, "package.json"));
+const { Client } = await import(
+  pathToFileURL(require.resolve("@modelcontextprotocol/client"))
+);
+const { StdioClientTransport } = await import(
+  pathToFileURL(require.resolve("@modelcontextprotocol/client/stdio"))
+);
+await mkdir(values.output, { mode: 0o700 });
+const account = await mkdtemp(join(tmpdir(), "rea-go-build-views-"));
+const report = {
+  question:
+    "Report compiler, main module and the selected embedded dependency; preserve complete original Evidence.",
+  mode: values.mode,
+  warm_diagnostic: values.warm,
+  calls: [],
+  artifact_sha256: oracle.artifact_sha256,
+};
+const client = new Client({ name: "rea-go-build-views", version: "1" });
+const transport = new StdioClientTransport({
+  command: process.execPath,
+  args: [join(values.runtime, "scripts/rea.mjs"), "mcp"],
+  env: {
+    HOME: account,
+    PATH: process.env.PATH,
+    NODE_OPTIONS: "--max-old-space-size=2048",
+    UV_THREADPOOL_SIZE: "1",
+    REA_LOG_LEVEL: "silent",
+  },
+  stderr: "pipe",
+});
+const serverLog = createWriteStream(join(values.output, "server.log"));
+const serverLogFinished = finished(serverLog);
+serverLogFinished.catch(() => {});
+transport.stderr?.pipe(serverLog);
+const transcript = [];
+const call = createRetainedQueryCaller(client, (receipt, event) => {
+  report.calls.push(receipt);
+  transcript.push(event);
+});
+async function result(name, input, phase = name) {
+  const reply = await call(name, input, phase);
+  assert.ok(!reply.isError, JSON.stringify(reply));
+  assert.ok(reply.structuredContent);
+  assert.equal(reply.content.length, 1);
+  assert.equal(reply.content[0].type, "text");
+  assert.deepEqual(JSON.parse(reply.content[0].text), reply.structuredContent);
+  return reply.structuredContent;
+}
+try {
+  await client.connect(transport);
+  const catalog = await client.listTools();
+  assert.equal(catalog.nextCursor, undefined);
+  report.catalog_tools = catalog.tools.length;
+  await writeFile(join(values.output, "catalog.json"), JSON.stringify(catalog));
+  const definitions = new Map(catalog.tools.map((tool) => [tool.name, tool]));
+  const original = client.callTool.bind(client);
+  client.callTool = (input, options) =>
+    original(input, {
+      ...options,
+      timeout: 60000,
+      toolDefinition: definitions.get(input.name),
+    });
+  const inspected = await result(
+    "inspect_go_binary",
+    {
+      path: values.input,
+      ...(values.mode === "selected" ? { detail: "summary" } : {}),
+    },
+    "inspection:first",
+  );
+  let answer;
+  if (values.mode === "complete") {
+    report.parent_evidence_id = inspected.evidence_id;
+    const info = inspected.normalized_result.build_info;
+    assert.ok(info);
+    answer = {
+      go_version: info.go_version,
+      main: info.module.main,
+      runtime_dependencies: "unknown",
+      dependencies: info.module.dependencies.flatMap((row, index) =>
+        row.path === oracle.dependency_path ? [{ index, ...row }] : [],
+      ),
+    };
+  } else {
+    const summary = inspected.normalized_result;
+    assert.equal(summary.kind, "summary");
+    report.parent_evidence_id = summary.parent_evidence_id;
+    assert.equal(summary.source_coverage.runtime_dependencies, "unknown");
+    assert.equal(
+      summary.summary.build_info.module.available_counts.dependencies,
+      oracle.dependency_count,
+    );
+    const input = {
+      source: {
+        kind: "retained-evidence",
+        evidence_id: report.parent_evidence_id,
+      },
+      view: {
+        kind: "go",
+        collection: "dependencies",
+        paths: [oracle.dependency_path],
+        fields: ["path", "version", "sum", "replacement"],
+        offset: 0,
+        limit: 64,
+      },
+    };
+    let dependencies = [];
+    if (summary.summary.build_info.module.available_counts.dependencies > 0) {
+      const selected = await result(
+        "inspect_analysis_view",
+        input,
+        "retained-query:first",
+      );
+      assert.equal(selected.normalized_result.coverage.exhausted, true);
+      assert.equal(
+        selected.normalized_result.source_coverage.runtime_dependencies,
+        "unknown",
+      );
+      dependencies = selected.normalized_result.page.rows;
+      if (values.warm) {
+        const warm = await result(
+          "inspect_analysis_view",
+          input,
+          "retained-query:warm-diagnostic",
+        );
+        assert.deepEqual(warm, selected);
+      }
+    }
+    answer = {
+      go_version: summary.summary.build_info.go_version,
+      main: summary.summary.build_info.module.main,
+      runtime_dependencies: "unknown",
+      dependencies,
+    };
+  }
+  assert.deepEqual(answer, oracle.answer);
+  report.answer = answer;
+  await result("export_evidence_bundle", {
+    path: join(values.output, "evidence.json"),
+  });
+  const bundle = JSON.parse(
+    await readFile(join(values.output, "evidence.json"), "utf8"),
+  );
+  const parent = bundle.records.find(
+    (e) => e.evidence_id === report.parent_evidence_id,
+  );
+  assert.ok(parent);
+  assert.equal(parent.operation, "inspect_go_binary");
+  assert.deepEqual(parent.parameters, { path: values.input });
+  assert.equal(
+    parent.normalized_result.artifact.sha256,
+    oracle.artifact_sha256,
+  );
+  // The pre-change normalized result was independently checked against native
+  // go version -m and its file-backed bytes before pinning this exact JSON.
+  const expected = JSON.parse(
+    await readFile(oracle.complete_result_path, "utf8"),
+  );
+  assert.deepEqual(parent.normalized_result, expected);
+  assert.equal(
+    parent.normalized_result.build_info.module.dependencies.length,
+    oracle.dependency_count,
+  );
+  for (const name of ["version", "module"]) {
+    const info = parent.normalized_result.build_info;
+    const location = info[name + "_location"];
+    const encoded =
+      info[(name === "version" ? "go_version" : "module") + "_bytes_base64"];
+    assert.deepEqual(
+      bytes.subarray(location.offset, location.offset + location.bytes),
+      Buffer.from(encoded, "base64"),
+    );
+  }
+  assert.equal(sha256(await readFile(values.input)), oracle.artifact_sha256);
+  report.oracle_file_sha256 = sha256(await readFile(values.oracle));
+  report.complete_result_file_sha256 = sha256(
+    await readFile(oracle.complete_result_path),
+  );
+  report.status = "observed";
+} catch (cause) {
+  report.status = "failed";
+  report.failure = String(cause?.stack ?? cause);
+  process.exitCode = 1;
+} finally {
+  if (
+    !(await finalizeRetainedQueryReceipt({
+      report,
+      client,
+      transport,
+      account,
+      serverLog,
+      serverLogFinished,
+      output: values.output,
+      transcript,
+    }))
+  )
+    process.exitCode = 1;
+}
@@ -0,0 +1,86 @@
+"""Count entire captured Codex request sequences, without claiming model usage."""
+import argparse
+import hashlib
+import json
+from pathlib import Path
+
+import tiktoken
+
+
+def compact(value):
+    return json.dumps(value, ensure_ascii=False, separators=(",", ":"))
+
+
+def request_text(body):
+    pieces = []
+    if isinstance(body.get("instructions"), str):
+        pieces.append(body["instructions"])
+    for item in body.get("input", []):
+        kind = item.get("type")
+        if kind == "function_call_output":
+            pieces.append(item["output"])
+        elif kind == "function_call":
+            pieces.append(item["arguments"])
+        elif kind == "message" or "role" in item:
+            for part in item.get("content", []):
+                if isinstance(part, dict) and isinstance(part.get("text"), str):
+                    pieces.append(part["text"])
+    return pieces
+
+
+def inspect(root, encoding):
+    report = json.loads((root / "report.json").read_text())
+    assert (report["status"] == "passed" and not report["cleanup_failures"]
+            and report["appserver_exit_code"] == 0)
+    requests = json.loads((root / "model-requests.json").read_text())
+    whole, namespaces, texts = [], [], []
+    count = lambda value: len(encoding.encode(value, disallowed_special=()))
+    for event in requests:
+        body = event["body"]
+        whole.append(count(compact(body)))
+        namespace = next(tool for tool in body["tools"]
+                         if tool.get("type") == "namespace"
+                         and tool["name"] == "mcp__rea_audit")
+        namespaces.append(count(compact(namespace)))
+        texts.append(sum(count(piece) for piece in request_text(body)))
+    log = root.with_suffix(".log")
+    scope = next(json.loads(line) for line in reversed(log.read_text().splitlines())
+                 if line.startswith('{"resource_scope":'))
+    observed = scope["payload_resource_observation"]
+    assert (scope["abort"] is None and scope["payload_resource_observation_verified"]
+            and observed["payload_cleanup_verified"] and observed["payload_exit_code"] == 0)
+    memory = observed["resource_events"]["memory.events"]
+    assert all(memory[key] == 0 for key in ["high", "max", "oom", "oom_kill"])
+    assert observed["resource_events"]["pids.events"]["max"] == 0
+    return {"case": root.name, "question": report["question_kind"],
+            "request_count": len(requests), "whole_request_json_proxy": whole,
+            "whole_request_json_proxy_sum": sum(whole),
+            "rea_namespace_json_proxy": namespaces,
+            "rea_namespace_json_proxy_sum": sum(namespaces),
+            "unescaped_instruction_and_input_text_proxy": texts,
+            "rea_namespace_plus_text_proxy_sum": sum(namespaces) + sum(texts),
+            "wall_seconds": scope["elapsed_seconds"],
+            "family_cpu_seconds": observed["cpu_stat"]["usage_usec"] / 1e6,
+            "family_peak_mib": observed["memory_peak_bytes"] / 2**20,
+            "completed_with_verified_cleanup": True,
+            "sha256": {file.name: hashlib.sha256(file.read_bytes()).hexdigest()
+                       for file in [root / "report.json", root / "model-requests.json",
+                                    root / "transcript.json", log]}}
+
+
+def main():
+    parser = argparse.ArgumentParser(description=__doc__)
+    parser.add_argument("--output", type=Path, required=True)
+    parser.add_argument("cases", type=Path, nargs="+")
+    args = parser.parse_args()
+    encoding = tiktoken.get_encoding("cl100k_base")
+    receipt = {"actual_model_usage": None,
+               "backend": "deterministic local Responses SSE; no AI inference or paid service; not a model-quality or billing test",
+               "client": "Codex app-server 0.163.0", "tiktoken": tiktoken.__version__,
+               "encoding": encoding.name,
+               "records": [inspect(root, encoding) for root in args.cases]}
+    args.output.write_text(json.dumps(receipt, ensure_ascii=False, indent=2) + "\n")
+
+
+if __name__ == "__main__":
+    main()
@@ -0,0 +1,292 @@
+"""Actual Codex wire capture with a deterministic local SSE backend; no AI inference."""
+import argparse
+import http.server
+import threading
+import asyncio
+import hashlib
+import json
+import os
+from pathlib import Path
+import re
+import time
+import traceback
+import subprocess
+
+
+async def main():
+    parser = argparse.ArgumentParser(description=__doc__)
+    parser.add_argument("--output", type=Path, required=True)
+    parser.add_argument("--runtime", type=Path, required=True)
+    parser.add_argument("--codex", type=Path, required=True)
+    parser.add_argument("--node", type=Path, required=True)
+    parser.add_argument("--input-profile", choices=["full", "compact"], default="full")
+    parser.add_argument("--output-profile", choices=["full", "off"], default="full")
+    parser.add_argument("--input", type=Path, required=True)
+    parser.add_argument("--oracle", type=Path, required=True)
+    parser.add_argument("--expected-tools", type=int, default=210)
+    parser.add_argument("--mode", choices=["complete", "selected", "summary"], required=True)
+    parser.add_argument("--export", action="store_true")
+    parser.add_argument("--question", choices=["identity", "dependency"], default="dependency")
+    args = parser.parse_args()
+    assert args.question != "identity" or args.mode != "selected"
+    assert args.mode != "summary" or args.question == "identity"
+    oracle=json.loads(args.oracle.read_text())
+    target=str(args.input)
+    assert args.input.is_absolute() and args.oracle.is_absolute() and args.output.is_absolute()
+    assert hashlib.sha256(args.input.read_bytes()).hexdigest()==oracle["artifact_sha256"]
+    def delivered(pieces):
+        assert isinstance(pieces,str) and pieces.startswith("Wall time: "), pieces[:300]
+        _,sep,payload=pieces.partition("Output:\n");assert sep
+        value=json.loads(payload)
+        return value["result"] if "result" in value and "normalized_result" not in value else value
+    def outputs_of(body):
+        return {item["call_id"]:delivered(item["output"]) for item in body.get("input",[]) if item.get("type")=="function_call_output"}
+    steps=1+(args.mode=="selected")+args.export
+    args.output.mkdir(mode=0o700)
+    audit_home = args.output / "account"
+    codex_state = audit_home / ".codex"
+    mcp_home = audit_home / "mcp"
+    workspace = audit_home / "workspace"
+    for directory in [codex_state, mcp_home, workspace]:
+        directory.mkdir(parents=True)
+    captured = []
+    class Capture(http.server.BaseHTTPRequestHandler):
+        def log_message(self, *_):
+            pass
+        def do_POST(self):
+            size = int(self.headers["Content-Length"])
+            assert 0 < size <= 16 * 1024 * 1024
+            assert self.headers.get("Content-Encoding", "identity") == "identity"
+            body = json.loads(self.rfile.read(size))
+            captured.append({"path": self.path, "body": body})
+            (args.output / "model-requests.json").write_text(json.dumps(captured) + "\n")
+            index = len(captured)
+            names = [t.get("name", "") for ns in body.get("tools", []) if ns.get("type") == "namespace" and ns.get("name") == "mcp__rea_audit" for t in ns.get("tools", [])]
+            assert index <= steps+1
+            response_id=f"resp_local_{index}"
+            if index <= steps:
+                previous=outputs_of(body)
+                if index==1:
+                    operation="inspect_go_binary";arguments={"path":target}
+                    if args.mode!="complete":arguments["detail"]="summary"
+                elif args.mode=="selected" and index==2:
+                    parent=previous["call_local_1"]["normalized_result"]["parent_evidence_id"]
+                    operation="inspect_analysis_view";arguments={"source":{"kind":"retained-evidence","evidence_id":parent},"view":{"kind":"go","collection":"dependencies","paths":[oracle["dependency_path"]],"fields":["path","version","sum","replacement"],"offset":0,"limit":64}}
+                else:
+                    operation="export_evidence_bundle";arguments={"path":str(args.output/"evidence.json")}
+                selected=[name for name in names if name.endswith(operation)];assert len(selected)==1
+                item={"type":"function_call","id":f"fc_local_{index}","call_id":f"call_local_{index}","name":selected[0],"namespace":"mcp__rea_audit","arguments":json.dumps(arguments),"status":"completed"}
+            else:
+                item={"type":"message","id":"msg_local_done","role":"assistant","status":"completed","content":[{"type":"output_text","text":"Scripted local Go metadata query complete.","annotations":[]}]}
+            base = {"id": response_id, "object": "response", "model": body.get("model"), "status": "completed", "output": [item]}
+            events = [
+                {"type": "response.created", "response": {**base, "status": "in_progress", "output": []}},
+                {"type": "response.output_item.added", "output_index": 0, "item": {**item, "status": "in_progress"}},
+                {"type": "response.output_item.done", "output_index": 0, "item": item},
+                {"type": "response.completed", "response": base},
+            ]
+            wire = "".join("event: " + e["type"] + "\ndata: " + json.dumps(e) + "\n\n" for e in events).encode()
+            self.send_response(200)
+            self.send_header("Content-Type", "text/event-stream")
+            self.send_header("Content-Length", str(len(wire)))
+            self.end_headers()
+            self.wfile.write(wire)
+    endpoint = http.server.HTTPServer(("127.0.0.1", 0), Capture)
+    endpoint_thread = threading.Thread(target=endpoint.serve_forever, daemon=True)
+    endpoint_thread.start()
+    task_path = f"{args.node.parent}:/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin"
+    mcp_env = {"HOME": str(mcp_home), "PATH": task_path,
+               "NODE_OPTIONS": "--max-old-space-size=2048", "UV_THREADPOOL_SIZE": "1",
+               "REA_LOG_LEVEL": "silent", "REA_MCP_INPUT_SCHEMA_PROFILE": args.input_profile,
+               "REA_MCP_OUTPUT_SCHEMA_PROFILE": args.output_profile}
+    config = 'model_provider = "rea_capture"\nmodel = "rea-wire-probe"\n[analytics]\nenabled = false\n[mcp_servers.rea_audit]\n'
+    config += f'command = {json.dumps(str(args.node))}\n'
+    config += f'args = {json.dumps([str(args.runtime / "scripts/rea.mjs"), "mcp"])}\n'
+    config += 'startup_timeout_sec = 60\ntool_timeout_sec = 60\n'
+    config += '[mcp_servers.rea_audit.env]\n'
+    config += ''.join(f'{key} = {json.dumps(value)}\n' for key, value in mcp_env.items())
+    for name in ['inspect_go_binary','inspect_analysis_view','export_evidence_bundle']:
+        config += f'[mcp_servers.rea_audit.tools.{name}]\napproval_mode = "approve"\noutput_token_limit = 30000\n'
+    config += f'\n[model_providers.rea_capture]\nname = "Local scripted capture"\nbase_url = "http://127.0.0.1:{endpoint.server_port}/v1"\nwire_api = "responses"\nrequires_openai_auth = false\nsupports_websockets = false\nrequest_max_retries = 0\nstream_max_retries = 0\n'
+    (codex_state / "config.toml").write_text(config)
+    (args.output / "declared-config.toml").write_text(config)
+    environment = {"HOME": str(audit_home), "CODEX_HOME": str(codex_state), "PATH": task_path,
+                   "NODE_OPTIONS": "--max-old-space-size=2048", "UV_THREADPOOL_SIZE": "1"}
+    report = {"question": "Read embedded Go identity/counts or a selected dependency. Export is a separate task variant.",
+              "client": "Codex app-server 0.163.0", "model_turns_started": 1, "backend": "local deterministic SSE fixture; no AI model or paid service",
+              "actual_model_usage": None, "input_profile": args.input_profile,
+              "output_profile": args.output_profile, "calls": [], "observations": [],
+              "unexpected_server_requests": [], "cleanup_failures": []}
+    client_version = subprocess.check_output([str(args.codex), "--version"], env=environment, cwd=workspace, text=True, timeout=10).strip()
+    assert client_version == "codex-cli 0.163.0", client_version
+    transcript = []
+    pending = {}
+    completed_turn = asyncio.Event()
+    next_id = 0
+    stderr = (args.output / "server.log").open("wb")
+    process = await asyncio.create_subprocess_exec(str(args.codex), "app-server", "--stdio",
+        stdin=asyncio.subprocess.PIPE, stdout=asyncio.subprocess.PIPE, stderr=stderr,
+        cwd=workspace, env=environment, limit=16 * 1024 * 1024)
+
+    async def send(message):
+        encoded = (json.dumps(message, separators=(",", ":")) + "\n").encode()
+        transcript.append({"direction": "client", "bytes": len(encoded), "message": message})
+        process.stdin.write(encoded)
+        await process.stdin.drain()
+
+    async def read_messages():
+        try:
+            while line := await process.stdout.readline():
+                value = json.loads(line)
+                transcript.append({"direction": "server", "bytes": len(line), "message": value})
+                if value.get("method") == "turn/completed":
+                    report["turn"] = value["params"]["turn"]
+                    completed_turn.set()
+                if "id" in value and "method" not in value:
+                    future = pending.pop(value["id"], None)
+                    if future and not future.done():
+                        future.set_result(value)
+                elif "id" in value:
+                    report["unexpected_server_requests"].append(value["method"])
+                    await send({"id": value["id"], "error": {"code": -32601, "message": "Unexpected request in scripted metadata probe"}})
+            raise RuntimeError("app-server stdout closed")
+        except Exception as error:
+            for future in pending.values():
+                if not future.done():
+                    future.set_exception(error)
+
+    reader = asyncio.create_task(read_messages())
+
+    async def request(method, params):
+        nonlocal next_id
+        assert method in ["initialize", "thread/start", "mcpServerStatus/list", "mcpServer/tool/call", "turn/start"]
+        next_id += 1
+        message = {"id": next_id, "method": method, "params": params}
+        future = asyncio.get_running_loop().create_future()
+        pending[next_id] = future
+        start = time.monotonic()
+        await send(message)
+        reply = await asyncio.wait_for(future, 90)
+        report["calls"].append({"method": method, "elapsed_ms": (time.monotonic() - start) * 1000,
+                                "error": reply.get("error")})
+        if "error" in reply:
+            raise RuntimeError(json.dumps(reply["error"])[:4000])
+        return reply["result"]
+
+    try:
+        await request("initialize", {"clientInfo": {"name": "rea_host_probe", "title": "REA host compatibility probe", "version": "1"},
+                                     "capabilities": {"experimentalApi": True, "explicitGatewayOauth": True}})
+        await send({"method": "initialized"})
+        created = await request("thread/start", {"cwd": str(workspace), "ephemeral": True,
+                    "approvalPolicy": "never", "sandbox": "read-only"})
+        thread_id = created["thread"]["id"]
+        assert not created["thread"].get("turns", [])
+        inventory = await request("mcpServerStatus/list", {"threadId": thread_id,
+                    "serverName": "rea_audit", "detail": "toolsAndAuthOnly", "limit": 10})
+        assert inventory.get("nextCursor") is None
+        assert len(inventory["data"]) == 1
+        server = inventory["data"][0]
+        assert server["name"] == "rea_audit" and server.get("toolsError") is None
+        tools = list(server["tools"].values())
+        names = [tool["name"] for tool in tools]
+        assert len(names) == len(set(names)) == args.expected_tools
+        assert "inspect_go_binary" in names
+        output_schemas = sum(tool.get("outputSchema") is not None for tool in tools)
+        assert output_schemas == (args.expected_tools if args.output_profile == "full" else 0)
+        raw = json.dumps(inventory, separators=(",", ":"), ensure_ascii=False).encode()
+        (args.output / "catalog.json").write_bytes(raw)
+        report["catalog"] = {"tools": len(tools), "output_schemas": output_schemas,
+                             "bytes": len(raw), "sha256": hashlib.sha256(raw).hexdigest(),
+                             "server_info": server.get("serverInfo"), "runtime_status": server.get("runtimeStatus")}
+        await request("turn/start", {"threadId": thread_id, "input": [{"type": "text", "text": ("Read the embedded Go compiler, main module and embedded dependency count; state runtime dependency coverage." if args.question=="identity" else "Read the embedded Go compiler, main module and golang.org/x/crypto dependency and state runtime dependency coverage.")+" The local fixture scripts the required tools; no AI inference is used."}]})
+        await asyncio.wait_for(completed_turn.wait(), 90)
+        assert report["turn"]["status"] == "completed", report["turn"]
+        assert len(captured)==steps+1
+        outputs=outputs_of(captured[-1]["body"])
+        assert len(outputs)==steps
+        initial=outputs["call_local_1"]
+        assert initial["normalized_result"]["artifact"]["sha256"]==oracle["artifact_sha256"]
+        if args.question=="identity":
+            info=initial["normalized_result"]["build_info"] if args.mode=="complete" else initial["normalized_result"]["summary"]["build_info"]
+            count=len(info["module"]["dependencies"]) if args.mode=="complete" else info["module"]["available_counts"]["dependencies"]
+            facts={"go_version":info["go_version"],"main":info["module"]["main"],"runtime_dependencies":"unknown","dependency_count":count}
+            parent=initial["evidence_id"] if args.mode=="complete" else initial["normalized_result"]["parent_evidence_id"]
+        elif args.mode=="complete":
+            info=initial["normalized_result"]["build_info"]
+            facts={"go_version":info["go_version"],"main":info["module"]["main"],"runtime_dependencies":"unknown","dependencies":[{"index":i,**d} for i,d in enumerate(info["module"]["dependencies"]) if d["path"]==oracle["dependency_path"]]}
+            parent=initial["evidence_id"]
+        else:
+            info=initial["normalized_result"]["summary"]["build_info"]
+            selected=outputs["call_local_2"]["normalized_result"]
+            assert selected["coverage"]["exhausted"] and selected["source_coverage"]["runtime_dependencies"]=="unknown"
+            facts={"go_version":info["go_version"],"main":info["module"]["main"],"runtime_dependencies":"unknown","dependencies":selected["page"]["rows"]}
+            parent=initial["normalized_result"]["parent_evidence_id"]
+        expected=({key:oracle["answer"][key] for key in ["go_version","main","runtime_dependencies"]}|{"dependency_count":oracle["dependency_count"]}) if args.question=="identity" else oracle["answer"]
+        assert facts==expected
+        report["question_kind"]=args.question
+        if args.export:
+            bundle=json.loads((args.output/"evidence.json").read_text());evidence=next(e for e in bundle["records"] if e["evidence_id"]==parent)
+            assert evidence["normalized_result"]==json.loads(Path(oracle["complete_result_path"]).read_text())
+        report["observations"]={"answer":facts,"parent_evidence_id":parent,"exported":args.export}
+        report["captured_requests"]=len(captured)
+        report["mode"]=args.mode
+        report["request_tool_counts"] = [len(c["body"].get("tools", [])) for c in captured]
+        assert not report["unexpected_server_requests"]
+        assert hashlib.sha256(args.input.read_bytes()).hexdigest()==oracle["artifact_sha256"]
+        report["status"] = "passed"
+    except Exception:
+        report["status"] = "failed"
+        report["failure"] = traceback.format_exc()[-6000:]
+    finally:
+        process.stdin.close()
+        try:
+            await asyncio.wait_for(process.wait(), 15)
+        except asyncio.TimeoutError:
+            report["cleanup_failures"].append("app-server did not exit after stdin close; terminated owned process")
+            process.terminate()
+            try:
+                await asyncio.wait_for(process.wait(), 5)
+            except asyncio.TimeoutError:
+                process.kill()
+                await process.wait()
+        await reader
+        # app-server can acknowledge exit before its MCP child finishes EOF
+        # cleanup. Wait on the allocated resource scope; never target a PID.
+        try:
+            groups = [line[3:] for line in Path("/proc/self/cgroup").read_text().splitlines()
+                      if line.startswith("0::")]
+            assert len(groups) == 1
+            group = Path("/sys/fs/cgroup") / groups[0].lstrip("/")
+            assert re.fullmatch(r"rea-efficiency-[0-9a-f]{32}\.scope", group.name)
+            observer = os.getppid()
+            observer_args = Path(f"/proc/{observer}/cmdline").read_bytes().split(b"\0")
+            assert any(Path(os.fsdecode(value)).name == "resource_payload.py" for value in observer_args if value)
+            expected = {os.getpid(), observer}
+            until = time.monotonic() + 10
+            while True:
+                actors = {int(value) for value in (group / "cgroup.procs").read_text().splitlines()}
+                assert expected <= actors
+                remaining = sorted(actors - expected)
+                if not remaining or time.monotonic() >= until:
+                    break
+                await asyncio.sleep(0.05)
+            report["owned_scope_drain"] = {"remaining_processes": remaining}
+            if remaining:
+                report["cleanup_failures"].append("owned MCP child did not settle after app-server exit")
+        except (OSError, ValueError, AssertionError) as error:
+            report["owned_scope_drain"] = {"status": "unavailable", "reason": type(error).__name__}
+            report["cleanup_failures"].append("allocated resource-scope cleanup could not be verified")
+        endpoint.shutdown()
+        endpoint.server_close()
+        endpoint_thread.join(5)
+        stderr.close()
+        report["appserver_exit_code"] = process.returncode
+        if process.returncode != 0:
+            report["cleanup_failures"].append(f"app-server exit code: {process.returncode}")
+        (args.output / "transcript.json").write_text(json.dumps(transcript) + "\n")
+        (args.output / "report.json").write_text(json.dumps(report, indent=2) + "\n")
+        print(json.dumps({key: report.get(key) for key in ["status", "failure", "catalog", "observations", "cleanup_failures", "appserver_exit_code"]}))
+    return 0 if report["status"] == "passed" and not report["cleanup_failures"] else 1
+
+
+raise SystemExit(asyncio.run(main()))
@@ -40,6 +40,7 @@ export const finalizeRetainedQueryReceipt = async ({
  serverLog,
  serverLogFinished,
  output,
+  transcript,
  stdout = process.stdout,
 }) => {
  report.cleanup_failures = [];
@@ -58,6 +59,10 @@ export const finalizeRetainedQueryReceipt = async ({
  if (report.cleanup_failures.length > 0) report.retained_workspace = account;

  report.receipt_failures = [];
+  if (transcript !== undefined)
+    await attempt(report.receipt_failures, "transcript-file", () =>
+      writeFile(join(output, "transcript.json"), JSON.stringify(transcript)),
+    );
  let publication = 0;
  const saveReport = async () => {
    // Keep failed publications in the owned output directory for inspection.
@@ -0,0 +1,81 @@
+"""A truncated summary must never qualify as a completed investigation."""
+from copy import deepcopy
+import unittest
+from command_observation_delivery import verify_command_delivery
+
+
+class CommandDelivery(unittest.TestCase):
+    def test_truncation_is_accepted_only_for_complete_default_baseline(self):
+        truncated = {'_invalid_json_payload': '{truncated'}
+        self.assertFalse(verify_command_delivery(truncated, {}, 'complete', 0))
+        for mode, budget in [
+            ('summary', 0), ('summary', 30000), ('complete', 30000),
+        ]:
+            with self.subTest(mode=mode, budget=budget):
+                with self.assertRaises(AssertionError):
+                    verify_command_delivery(truncated, {}, mode, budget)
+
+    def test_valid_complete_answer_can_complete_under_either_budget(self):
+        parent = {'evidence_id': 'parent'}
+        for budget in [0, 30000]:
+            self.assertTrue(
+                verify_command_delivery(parent, parent, 'complete', budget)
+            )
+        with self.assertRaises(AssertionError):
+            verify_command_delivery({'error': 'failed command'}, parent, 'complete', 0)
+
+    def test_summary_must_preserve_every_record_and_accurate_stream_counts(self):
+        report = {
+            'command': 'disassemble /r entry', 'mi': '7^done',
+            'records': ['~"🧪\\n"', '=async', 'unknown', '7^done'],
+            'console': '🧪', 'target': '', 'log': '',
+            'completion_status': 'complete', 'output_truncated': False,
+        }
+        parent = {
+            'evidence_id': 'parent',
+            'parameters': {'command': report['command']},
+            'provider': {'id': 'gdb'}, 'analysis_profile': None,
+            'normalized_result': report,
+        }
+        facts = {
+            key: value for key, value in report.items()
+            if key not in ('console', 'target', 'log')
+        }
+        selected = {
+            'evidence_id': 'derived', 'raw_result': None, 'subject': None,
+            'normalized_result': {
+                'parent_evidence_id': 'parent', 'artifact': None,
+                'source_analysis_profile_digest': None,
+                'source_parameters': parent['parameters'],
+                'source_provider': parent['provider'],
+                'summary': {
+                    **facts,
+                    'available_counts': {
+                        'records': 4, 'console_utf16_units': 2,
+                        'target_utf16_units': 0, 'log_utf16_units': 0,
+                    },
+                },
+            },
+        }
+        self.assertTrue(verify_command_delivery(selected, parent, 'summary', 0))
+        for damage in ['records', 'counts', 'parameters', 'profile']:
+            bad = deepcopy(selected)
+            result = bad['normalized_result']
+            if damage == 'records':
+                result['summary']['records'].pop(1)
+            elif damage == 'counts':
+                result['summary']['available_counts']['console_utf16_units'] = 1
+            elif damage == 'profile':
+                result['source_analysis_profile_digest'] = 'wrong'
+            else:
+                result['source_parameters'] = {}
+            with self.subTest(damage=damage):
+                with self.assertRaises(AssertionError):
+                    verify_command_delivery(bad, parent, 'summary', 0)
+        parent['analysis_profile'] = {'digest': 'recorded-profile'}
+        selected['normalized_result']['source_analysis_profile_digest'] = 'recorded-profile'
+        self.assertTrue(verify_command_delivery(selected, parent, 'summary', 0))
+
+
+if __name__ == '__main__':
+    unittest.main()
@@ -0,0 +1,48 @@
+"""Reject incomplete status delivery and incorrect retained-source claims."""
+from copy import deepcopy
+import unittest
+from frida_status_delivery import verify_frida_delivery
+
+
+class FridaDelivery(unittest.TestCase):
+    def fixture(self):
+        session = {'session_id': 'selected', 'pid': 12}
+        payloads = [{'kind': 'module', 'pid': 12, 'total': 1001}, {'kind': 'exports', 'offset': 0, 'items': [None] * 1001}, {'kind': 'complete', 'total': 1001}]
+        facts = {**session, 'state': 'running', 'messages_truncated': False, 'messages': [{'type': 'send', 'payload': p} for p in payloads]}
+        parent = {'evidence_id': 'ev_parent', 'operation': 'frida_session_status', 'authority': 'external-service', 'environment': None, 'raw_result': None, 'subject': None, 'parameters': {'session_id': 'selected'}, 'provider': {'id': 'frida'}, 'normalized_result': facts}
+        summary = {'evidence_id': 'ev_summary', 'subject': None, 'raw_result': None, 'authority': 'external-service', 'normalized_result': {
+            'parent_evidence_id': 'ev_parent', 'parent_digest': 'parent', 'parent_operation': 'frida_session_status', 'artifact': None,
+            'source_parameters': parent['parameters'], 'source_provider': parent['provider'], 'unknowns': ['historical snapshot'], 'limitations': ['parent retained'],
+            'summary': {**{k: v for k, v in facts.items() if k != 'messages'}, 'messages_retained': 3}}}
+        return session, parent, summary
+
+    def test_truncated_summary_never_qualifies(self):
+        truncated = {'_invalid_json_payload': 'truncated'}
+        self.assertIsNone(verify_frida_delivery(truncated, {}, 'complete', 0, {}))
+        for mode, budget in [('summary', 0), ('summary', 300000), ('complete', 300000)]:
+            with self.subTest(mode=mode, budget=budget), self.assertRaises(AssertionError):
+                verify_frida_delivery(truncated, {}, mode, budget, {})
+
+    def test_complete_and_summary_require_correct_facts_and_source(self):
+        session, parent, summary = self.fixture()
+        for mode, delivered in [('complete', parent), ('summary', summary)]:
+            self.assertEqual(verify_frida_delivery(delivered, {'records': [parent, summary]}, mode, 300000, session)['exports'], 1001)
+        for field in ['messages_retained', 'state', 'messages', 'source_parameters', 'parent_digest', 'source_provider']:
+            broken = deepcopy(summary)
+            target = broken['normalized_result']['summary'] if field in ['messages_retained', 'state', 'messages'] else broken['normalized_result']
+            target[field] = 'incorrect'
+            with self.subTest(field=field), self.assertRaises(AssertionError):
+                verify_frida_delivery(broken, {'records': [parent, broken]}, 'summary', 0, session)
+
+    def test_missing_native_chunk_and_wrong_session_fail(self):
+        session, parent, _ = self.fixture()
+        broken = deepcopy(parent)
+        broken['normalized_result']['messages'][1]['payload']['items'].pop()
+        with self.assertRaises(AssertionError):
+            verify_frida_delivery(broken, {'records': [broken]}, 'complete', 300000, session)
+        with self.assertRaises(AssertionError):
+            verify_frida_delivery(parent, {'records': [parent]}, 'complete', 300000, {**session, 'session_id': 'other'})
+
+
+if __name__ == '__main__':
+    unittest.main()
@@ -109,6 +109,23 @@ assert.match(report.cleanup_failures[0],/^workspace:/);
 assert.equal(report.retained_workspace,malformedAccount);
 assert.deepEqual((await saved()).failure,originalFailure);
 assert.deepEqual(JSON.parse(chunks.join('')),report);
+''')
+
+    def test_transcript_failure_cannot_skip_cleanup_or_lose_original_failure(self):
+        self.run_finalization('''
+await mkdir(join(output,'transcript.json'));
+const closed=[];
+assert.equal(await finalizeRetainedQueryReceipt({...input,transcript:[{phase:'page'}],
+  client:{close:async()=>{closed.push('client');}},
+  transport:{close:async()=>{closed.push('transport');}}}),false);
+assert.deepEqual(closed,['client','transport']);
+assert.equal(serverLog.writableEnded,true);
+await assert.rejects(stat(account),error=>error.code==='ENOENT');
+assert.deepEqual(report.cleanup_failures,[]);
+assert.match(report.receipt_failures[0],/^transcript-file:/);
+assert.strictEqual(report.failure,originalFailure);
+assert.equal(report.calls[0].elapsed_ms,17);
+assert.deepEqual(await saved(),report);assert.deepEqual(JSON.parse(chunks.join('')),report);
 ''')

    def test_report_file_refusal_preserves_the_stdout_receipt(self):
@@ -119,7 +119,13 @@
    "precheck:pr": "npm run deps:check",
    "check:pr": "node scripts/run-exclusive.mjs artifacts turbo run typecheck lint:built format:check knip metadata:check test:run && npm run test:python && npm run docs:check && npm run jscpd && npm run scan:todos",
    "precheck:ci": "npm run deps:check",
-    "check:ci": "node scripts/run-exclusive.mjs artifacts npm run check:ci:tasks && npm run verify:architecture-guards",
+    "precheck:ci:fast": "npm run deps:check",
+    "precheck:ci:deep": "npm run deps:check",
+    "check:ci": "npm run check:ci:fast && npm run check:ci:deep",
+    "check:ci:fast": "node scripts/run-exclusive.mjs artifacts npm run check:ci:fast:tasks",
+    "check:ci:fast:tasks": "turbo run typecheck lint:built format:check",
+    "check:ci:deep": "node scripts/run-exclusive.mjs artifacts npm run check:ci:deep:tasks && npm run verify:architecture-guards && npm run verify:test-discovery && npm run test:python",
+    "check:ci:deep:tasks": "turbo run knip metadata:check jscpd scan:todos",
    "check:ci:tasks": "turbo run typecheck lint:built format:check knip metadata:check jscpd scan:todos",
    "ci:static-context": "node scripts/ci/static-task-context.mjs",
    "build:cached": "node scripts/check-dependency-install.mjs && node scripts/run-exclusive.mjs artifacts turbo run artifacts:skills",
@@ -131,7 +137,7 @@
    "lint:details": "oxlint && npm run verify:module-boundaries",
    "lint:built": "npm run lint",
    "lint:fix": "oxlint --fix && npm run verify:module-boundaries",
-    "knip": "knip",
+    "knip": "knip --cache",
    "jscpd": "node scripts/ci/static-check-report.mjs duplicates",
    "jscpd:details": "jscpd src/ tests/ --no-tips",
    "scan:todos": "node scripts/scan-todos.mjs",
@@ -49,6 +49,7 @@ export function selectStaticCheckArtifact(
  page: unknown,
  run: { id?: string | number; head_sha?: string },
  runAttempt: number,
+  name?: string,
 ): unknown | null;

 export function readStaticCheckArtifact(options: {
@@ -7,6 +7,11 @@ import { promisify } from "node:util";
 import { parseStaticTaskContext } from "./static-task-context.mjs";

 const execute = promisify(execFile);
+/** Job display name owns the artifact that contains that gate's diagnostics. */
+export const STATIC_EVIDENCE_ARTIFACTS = {
+  "Static checks": "static-check-reports",
+  "Deep static checks": "static-deep-check-reports",
+};
 const MAX_ARCHIVE_BYTES = 32 * 1024 * 1024;
 const MAX_MEMBER_BYTES = 4 * 1024 * 1024;
 const MAX_DIAGNOSTICS = 10_000;
@@ -43,7 +48,8 @@ export function classifyFailure({
      "run_event_or_repository_identity_unverified",
    ],
    () => [
-      job?.name !== mainJob?.name || job?.name !== "Static checks",
+      job?.name !== mainJob?.name ||
+        !Object.hasOwn(STATIC_EVIDENCE_ARTIFACTS, job?.name ?? ""),
      "failed_job_not_the_same_static_gate",
    ],
    () => [
@@ -134,7 +140,12 @@ export function safeSha(value) {
    ? value.toLowerCase()
    : null;
 }
-export function selectStaticCheckArtifact(page, run, runAttempt) {
+export function selectStaticCheckArtifact(
+  page,
+  run,
+  runAttempt,
+  name = STATIC_EVIDENCE_ARTIFACTS["Static checks"],
+) {
  if (runAttempt !== 1) return null;
  if (
    !Array.isArray(page?.artifacts) ||
@@ -143,9 +154,7 @@ export function selectStaticCheckArtifact(page, run, runAttempt) {
    page.artifacts.length >= 100
  )
    return null;
-  const matches = page.artifacts.filter(
-    (artifact) => artifact.name === "static-check-reports",
-  );
+  const matches = page.artifacts.filter((artifact) => artifact.name === name);
  if (matches.length !== 1) return null;
  const [artifact] = matches;
  if (
@@ -0,0 +1,61 @@
+export interface RetainedCacheEntry {
+  readonly id: number;
+  readonly key: string;
+  readonly createdAt: number;
+  readonly accessedAt: number;
+  readonly size: number;
+}
+
+export interface CacheListRecord {
+  readonly id: number;
+  readonly key: string;
+  readonly version: string;
+  readonly ref: string;
+  readonly created_at: string;
+  readonly last_accessed_at?: string;
+  readonly size_in_bytes: number;
+}
+
+export interface RetentionFamily {
+  readonly prefix: string;
+  readonly keepKey?: string;
+}
+
+export type CacheRequest = (
+  method: string,
+  endpoint: string,
+) => Promise<unknown>;
+
+export function assertRetentionPrefix(prefix: string): void;
+
+export function selectPrefixDeletions(
+  caches: readonly unknown[],
+  family?: RetentionFamily,
+  keepGenerations?: number,
+): RetainedCacheEntry[];
+
+export function selectNpmDownloadDuplicateDeletions(
+  caches: readonly unknown[],
+): RetainedCacheEntry[];
+
+export function listAllCaches(
+  request: CacheRequest,
+  repository: string,
+  prefix: string,
+): Promise<readonly CacheListRecord[]>;
+
+export function retainCaches(options: {
+  repository: string;
+  request: CacheRequest;
+  deleteCache: (id: number) => Promise<void>;
+  families?: readonly RetentionFamily[];
+  dedupeNpmDownloads?: boolean;
+  dryRun?: boolean;
+}): Promise<{
+  dryRun: boolean;
+  plan: readonly {
+    prefix: string;
+    deletions: readonly RetainedCacheEntry[];
+  }[];
+  npmDeletions: readonly RetainedCacheEntry[];
+}>;
@@ -0,0 +1,358 @@
+import { execFile } from "node:child_process";
+import { realpathSync } from "node:fs";
+import { pathToFileURL } from "node:url";
+import { promisify } from "node:util";
+
+const execFileAsync = promisify(execFile);
+const MAX_BUFFER = 8 * 1024 * 1024;
+const REQUEST_TIMEOUT_MS = 20_000;
+const MAX_PAGES = 10;
+const PAGE_SIZE = 100;
+
+// Keep the newest snapshots, not only the key just saved. A concurrent job may
+// still be restoring the previous generation; deleting that id fails its restore.
+// The following trusted run drops anything older than those two.
+const RETAINED_CACHE_GENERATIONS = 2;
+
+const PREFIX_PATTERNS = [
+  /^rea-static-v1-[A-Za-z0-9]+-[A-Za-z0-9]+-$/u,
+  /^rea-static-deep-v1-[A-Za-z0-9]+-[A-Za-z0-9]+-$/u,
+  /^rea-portable-build-v2-[A-Za-z0-9]+-[A-Za-z0-9]+-$/u,
+  /^knip-meta-v1-[A-Za-z0-9]+-$/u,
+];
+
+/** Reject prefixes that could match npm downloads or another platform. */
+export function assertRetentionPrefix(prefix) {
+  if (
+    typeof prefix !== "string" ||
+    !PREFIX_PATTERNS.some((pattern) => pattern.test(prefix))
+  )
+    throw new Error(
+      "Cache retention prefix must be one Turbo family for one OS and architecture, or one Knip metadata family for one OS",
+    );
+}
+
+function normalizeCache(cache, index) {
+  if (typeof cache !== "object" || cache === null || Array.isArray(cache))
+    throw new Error(`Cache entry ${String(index + 1)} is malformed`);
+  const { id, key, size_in_bytes: size } = cache;
+  if (!Number.isSafeInteger(id) || id <= 0)
+    throw new Error(`Cache entry ${String(index + 1)} has an invalid id`);
+  if (typeof key !== "string" || key.length === 0 || /[\r\n]/u.test(key))
+    throw new Error(`Cache entry ${String(index + 1)} has an invalid key`);
+  const createdAt = Date.parse(cache.created_at);
+  const accessedAt = Date.parse(cache.last_accessed_at ?? cache.created_at);
+  if (!Number.isFinite(createdAt) || !Number.isFinite(accessedAt))
+    throw new Error(
+      `Cache entry ${String(index + 1)} has an invalid timestamp`,
+    );
+  if (!Number.isSafeInteger(size) || size < 0)
+    throw new Error(`Cache entry ${String(index + 1)} has an invalid size`);
+  // actions/cache restores a key only when this metadata hash matches.
+  const version = cache.version;
+  if (typeof version !== "string" || !/^[a-f0-9]{64}$/u.test(version))
+    throw new Error(`Cache entry ${String(index + 1)} has an invalid version`);
+  // The git ref is the cache's access scope. Another branch cannot use it.
+  const ref = cache.ref;
+  if (typeof ref !== "string" || !/^refs\/[^\s]+$/u.test(ref))
+    throw new Error(`Cache entry ${String(index + 1)} has an invalid ref`);
+  return { id, key, version, ref, createdAt, accessedAt, size };
+}
+
+function sameStableIdentity(left, right) {
+  return (
+    left.key === right.key &&
+    left.version === right.version &&
+    left.ref === right.ref &&
+    left.size === right.size &&
+    left.createdAt === right.createdAt
+  );
+}
+
+// The list API orders by last access. A restore between pages can place one
+// id on two pages. That is still one cache: collapse it, or abort when the
+// pages disagree, before any id can be both kept and deleted.
+function uniqueById(entries) {
+  const byId = new Map();
+  for (const entry of entries) {
+    const existing = byId.get(entry.id);
+    if (existing === undefined) {
+      byId.set(entry.id, entry);
+      continue;
+    }
+    if (!sameStableIdentity(existing, entry))
+      throw new Error(
+        `Cache id ${String(entry.id)} was listed with inconsistent fields`,
+      );
+    if (entry.accessedAt > existing.accessedAt) byId.set(entry.id, entry);
+  }
+  return [...byId.values()];
+}
+
+function byNewest(left, right) {
+  if (left.createdAt !== right.createdAt)
+    return right.createdAt - left.createdAt;
+  return right.id - left.id;
+}
+
+/**
+ * Choose Turbo snapshot ids to delete. `keepKey` is protected even when it is
+ * older than the retained generations. Keys outside the prefix abort retention.
+ */
+export function selectPrefixDeletions(
+  caches,
+  { prefix, keepKey } = {},
+  keepGenerations = RETAINED_CACHE_GENERATIONS,
+) {
+  assertRetentionPrefix(prefix);
+  if (!Number.isSafeInteger(keepGenerations) || keepGenerations < 1)
+    throw new Error("Cache retention must keep at least one generation");
+  if (keepKey !== undefined) {
+    if (
+      typeof keepKey !== "string" ||
+      !keepKey.startsWith(prefix) ||
+      keepKey === prefix
+    )
+      throw new Error("Cache retention keep key must extend its prefix");
+  }
+  const entries = uniqueById(caches.map(normalizeCache));
+  for (const entry of entries)
+    if (!entry.key.startsWith(prefix))
+      throw new Error(
+        `Refusing to evaluate a cache outside ${prefix}: ${entry.key}`,
+      );
+  const protectedIds = new Set(
+    [...entries]
+      .sort(byNewest)
+      .slice(0, keepGenerations)
+      .map((entry) => entry.id),
+  );
+  if (keepKey !== undefined)
+    for (const entry of entries)
+      if (entry.key === keepKey) protectedIds.add(entry.id);
+  return entries.filter((entry) => !protectedIds.has(entry.id));
+}
+
+/**
+ * Drop extra copies of one npm restore target. Records that share a user key
+ * but differ by cache version or git ref stay, because a workflow can restore
+ * only a matching version inside its visible scope.
+ */
+export function selectNpmDownloadDuplicateDeletions(caches) {
+  const entries = uniqueById(caches.map(normalizeCache));
+  for (const entry of entries)
+    if (!entry.key.startsWith("npm-download-"))
+      throw new Error(
+        `Refusing to evaluate a non-download cache: ${entry.key}`,
+      );
+  const groups = new Map();
+  for (const entry of entries) {
+    const identity = `${entry.version}\n${entry.ref}\n${entry.key}`;
+    const group = groups.get(identity) ?? [];
+    group.push(entry);
+    groups.set(identity, group);
+  }
+  const deletions = [];
+  for (const group of groups.values()) {
+    if (group.length < 2) continue;
+    const ranked = [...group].sort((left, right) => {
+      if (left.accessedAt !== right.accessedAt)
+        return right.accessedAt - left.accessedAt;
+      if (left.createdAt !== right.createdAt)
+        return right.createdAt - left.createdAt;
+      return right.id - left.id;
+    });
+    deletions.push(...ranked.slice(1));
+  }
+  return deletions;
+}
+
+export async function listAllCaches(request, repository, prefix) {
+  const caches = [];
+  for (let page = 1; page <= MAX_PAGES; page += 1) {
+    const body = await request(
+      "GET",
+      `repos/${repository}/actions/caches?per_page=${String(PAGE_SIZE)}&page=${String(page)}&key=${encodeURIComponent(prefix)}`,
+    );
+    if (
+      typeof body !== "object" ||
+      body === null ||
+      Array.isArray(body) ||
+      !Array.isArray(body.actions_caches)
+    )
+      throw new Error("GitHub cache list is malformed");
+    caches.push(...body.actions_caches);
+    if (body.actions_caches.length < PAGE_SIZE) return caches;
+  }
+  throw new Error(
+    `Cache list for ${prefix} exceeded ${String(MAX_PAGES)} pages; deleted nothing`,
+  );
+}
+
+/**
+ * List every requested family before deleting. A malformed list or an unsafe
+ * prefix leaves the repository caches unchanged.
+ */
+export async function retainCaches({
+  repository,
+  request,
+  deleteCache,
+  families = [],
+  dedupeNpmDownloads = false,
+  dryRun = false,
+}) {
+  if (
+    typeof repository !== "string" ||
+    !/^[A-Za-z0-9_.-]+\/[A-Za-z0-9_.-]+$/u.test(repository)
+  )
+    throw new Error(
+      "CI_REPOSITORY must be an owner/name repository identifier",
+    );
+  for (const family of families) {
+    assertRetentionPrefix(family.prefix);
+    if (
+      family.keepKey !== undefined &&
+      (typeof family.keepKey !== "string" ||
+        !family.keepKey.startsWith(family.prefix) ||
+        family.keepKey === family.prefix)
+    )
+      throw new Error("Cache retention keep key must extend its prefix");
+  }
+  const plan = [];
+  for (const family of families) {
+    const caches = await listAllCaches(request, repository, family.prefix);
+    plan.push({
+      prefix: family.prefix,
+      deletions: selectPrefixDeletions(caches, family),
+    });
+  }
+  const npmDeletions = dedupeNpmDownloads
+    ? selectNpmDownloadDuplicateDeletions(
+        await listAllCaches(request, repository, "npm-download-"),
+      )
+    : [];
+  if (!dryRun)
+    for (const entry of [
+      ...plan.flatMap((family) => family.deletions),
+      ...npmDeletions,
+    ])
+      await deleteCache(entry.id);
+  return { dryRun, plan, npmDeletions };
+}
+
+function repositoryFromEnv(env) {
+  const repository = env.CI_REPOSITORY;
+  if (
+    typeof repository !== "string" ||
+    !/^[A-Za-z0-9_.-]+\/[A-Za-z0-9_.-]+$/u.test(repository)
+  )
+    throw new Error(
+      "CI_REPOSITORY must be an owner/name repository identifier",
+    );
+  return repository;
+}
+
+function familyWithKeepKey(env, prefixName, keepName) {
+  const prefix = env[prefixName];
+  const keepKey = env[keepName];
+  const hasPrefix = typeof prefix === "string" && prefix.length > 0;
+  const hasKeepKey = typeof keepKey === "string" && keepKey.length > 0;
+  if (!hasPrefix && !hasKeepKey) return undefined;
+  if (!hasPrefix || !hasKeepKey)
+    throw new Error(`${keepName} is required with ${prefixName}`);
+  return { prefix, keepKey };
+}
+
+function familiesFromEnv(env) {
+  const families = [
+    familyWithKeepKey(env, "CACHE_PREFIX", "CACHE_KEEP_KEY"),
+    familyWithKeepKey(env, "CACHE_DEEP_PREFIX", "CACHE_DEEP_KEEP_KEY"),
+    familyWithKeepKey(env, "CACHE_KNIP_PREFIX", "CACHE_KNIP_KEEP_KEY"),
+    typeof env.CACHE_PORTABLE_PREFIX === "string" &&
+    env.CACHE_PORTABLE_PREFIX.length > 0
+      ? { prefix: env.CACHE_PORTABLE_PREFIX }
+      : undefined,
+  ].filter((family) => family !== undefined);
+  if (families.length === 0 && env.DEDUPE_NPM_DOWNLOADS !== "true")
+    throw new Error(
+      "Cache retention requires CACHE_PREFIX or CACHE_PORTABLE_PREFIX or npm dedupe",
+    );
+  return families;
+}
+
+function failureText(error) {
+  if (typeof error !== "object" || error === null) return String(error);
+  const stderr =
+    "stderr" in error && error.stderr !== undefined ? String(error.stderr) : "";
+  const message = error instanceof Error ? error.message : "";
+  return `${message}\n${stderr}`;
+}
+
+async function githubRequest(method, endpoint, env) {
+  const { stdout } = await execFileAsync(
+    "gh",
+    ["api", "--method", method, endpoint],
+    {
+      env,
+      encoding: "utf8",
+      maxBuffer: MAX_BUFFER,
+      timeout: REQUEST_TIMEOUT_MS,
+    },
+  );
+  if (method === "DELETE") return undefined;
+  try {
+    return JSON.parse(stdout);
+  } catch (cause) {
+    throw new Error("GitHub cache API returned malformed JSON", { cause });
+  }
+}
+
+async function main() {
+  const env = process.env;
+  const dryRun = env.CACHE_RETENTION_DRY_RUN === "true";
+  const report = await retainCaches({
+    repository: repositoryFromEnv(env),
+    request: (method, endpoint) => githubRequest(method, endpoint, env),
+    deleteCache: async (id) => {
+      try {
+        await githubRequest(
+          "DELETE",
+          `repos/${repositoryFromEnv(env)}/actions/caches/${String(id)}`,
+          env,
+        );
+      } catch (error) {
+        if (/404|not found/iu.test(failureText(error))) return;
+        throw error;
+      }
+    },
+    families: familiesFromEnv(env),
+    dedupeNpmDownloads: env.DEDUPE_NPM_DOWNLOADS === "true",
+    dryRun,
+  });
+  const summary = {
+    dryRun: report.dryRun,
+    families: report.plan.map((family) => ({
+      prefix: family.prefix,
+      deleteCount: family.deletions.length,
+      deleteBytes: family.deletions.reduce((sum, entry) => sum + entry.size, 0),
+    })),
+    npmDuplicateDeleteCount: report.npmDeletions.length,
+    npmDuplicateDeleteBytes: report.npmDeletions.reduce(
+      (sum, entry) => sum + entry.size,
+      0,
+    ),
+  };
+  process.stdout.write(`${JSON.stringify(summary)}\n`);
+}
+
+function isDirectRun() {
+  const entry = process.argv[1];
+  if (!entry) return false;
+  try {
+    return import.meta.url === pathToFileURL(realpathSync(entry)).href;
+  } catch {
+    return false;
+  }
+}
+
+if (isDirectRun()) await main();
@@ -11,6 +11,7 @@ import {
  readStaticCheckArtifact,
  safeSha,
  selectStaticCheckArtifact,
+  STATIC_EVIDENCE_ARTIFACTS,
  validRepoPath,
 } from "./artifacts.mjs";
 import { createGhApiRequest } from "./github-api.mjs";
@@ -366,12 +367,18 @@ export function createGitHubApi({
      return page.jobs;
    },
    async getStaticEvidence(repository, run, job) {
-      if (job.name !== "Static checks") return null;
+      const artifactName = STATIC_EVIDENCE_ARTIFACTS[job.name];
+      if (!artifactName) return null;
      if (run.run_attempt !== 1) return null;
      const page = await request(
        `repos/${repository}/actions/runs/${positiveId(run.id)}/artifacts?per_page=100&page=1`,
      );
-      const artifact = selectStaticCheckArtifact(page, run, run.run_attempt);
+      const artifact = selectStaticCheckArtifact(
+        page,
+        run,
+        run.run_attempt,
+        artifactName,
+      );
      if (!artifact) return null;
      return await readStaticCheckArtifact({
        repository,
@@ -42,8 +42,18 @@ const matchesAny = (file, patterns) =>
  patterns.some((pattern) => matchesGlob(file, pattern));
 const selected = Object.fromEntries(flags.map((flag) => [flag, false]));
 const reasons = [];
+// Shared process, contract, CLI, and CI-script edits are not a specific provider.
+// Fast qualification keeps the portable suite and the Linux x64 runtime
+// baseline. Full qualification still selects every lane.
+const SHARED_BOUNDARY =
+  /^(src\/process\/|src\/filesystem\/|src\/contracts\/tool|src\/server\/createServer|src\/cli\.ts|scripts\/ci\/)/;
 const full = (reason) => {
-  for (const flag of flags) selected[flag] = true;
+  if (tier === "full") {
+    for (const flag of flags) selected[flag] = true;
+  } else {
+    selected.code = true;
+    selected.runtime = true;
+  }
  reasons.push(reason);
 };
 const git = (...args) =>
@@ -196,6 +206,28 @@ if (tier === "reused") {
        selected.code = true;
        continue;
      }
+      // Timing and report helpers stay on the portable suite. They are not a
+      // runtime or provider change.
+      if (PORTABLE_CI_REPORTERS.has(file)) {
+        selected.code = true;
+        continue;
+      }
+      // A shared boundary is not evidence that every provider or host changed.
+      // One matching owner is path evidence. Several owners means the same
+      // registration file is listed by many lanes; fast qualification does not
+      // fan those out or start the multi-host package matrix.
+      if (tier !== "full" && SHARED_BOUNDARY.test(file)) {
+        selected.code = true;
+        selected.runtime = true;
+        const owners = Object.entries(SCOPES)
+          .filter(([, patterns]) =>
+            patterns.some((pattern) => matchesGlob(file, pattern)),
+          )
+          .map(([owner]) => owner);
+        if (owners.length === 1) selected[owners[0]] = true;
+        reasons.push(`Shared boundary on fast tier: ${file}`);
+        continue;
+      }
      const owners = Object.entries(SCOPES)
        .filter(([, patterns]) =>
          patterns.some((pattern) => matchesGlob(file, pattern)),
@@ -226,7 +258,6 @@ if (tier === "reused") {
      }
      if (matchesAny(file, READINESS_SOURCES)) selected.readiness = true;
      if (file.startsWith("tests/")) continue;
-      if (PORTABLE_CI_REPORTERS.has(file)) continue;
      if (
        /^(src\/process\/|src\/filesystem\/|src\/contracts\/tool|src\/server\/createServer|src\/cli\.ts|scripts\/ci\/)/.test(
          file,
@@ -29,6 +29,7 @@ if (
 if (outputs.tier === "full" && selectedScopes.length !== CI_FLAGS.length)
  throw new Error("Full qualification requires every canonical CI scope");
 const required = reused ? ["changes"] : ["changes", "static", "test"];
+if (outputs.tier === "full") required.push("static-deep");
 const lanes = {
  code: [
    "build",
@@ -15,4 +15,5 @@ export function recordStaticTaskContext(options?: {
  root?: string;
  npmCli?: string;
  outputDirectory?: string;
+  script?: string;
 }): Promise<StaticTaskContext>;
@@ -6,6 +6,10 @@ import { promisify } from "node:util";
 import { z } from "zod";

 const execute = promisify(execFile);
+const STATIC_CONTEXT_SCRIPTS = new Set([
+  "check:ci:fast:tasks",
+  "check:ci:deep:tasks",
+]);
 const contextSchema = z.object({
  version: z.literal(1),
  sourceSha: z.string().regex(/^[a-f0-9]{40}$/u),
@@ -30,7 +34,10 @@ export async function recordStaticTaskContext({
  root = process.cwd(),
  npmCli = process.env.npm_execpath,
  outputDirectory = join(root, ".cache/static-checks"),
+  script = process.env.CI_STATIC_CONTEXT_SCRIPT ?? "check:ci:fast:tasks",
 } = {}) {
+  if (!STATIC_CONTEXT_SCRIPTS.has(script))
+    throw new Error("Static context script is not a known check");
  if (typeof npmCli !== "string" || !npmCli)
    throw new Error(
      "Run static context recording through npm run ci:static-context",
@@ -44,7 +51,7 @@ export async function recordStaticTaskContext({
  const [graph, source, status, npmVersion, turbo] = await Promise.all([
    execute(
      process.execPath,
-      [npmCli, "run", "--silent", "check:ci:tasks", "--", "--dry=json"],
+      [npmCli, "run", "--silent", script, "--", "--dry=json"],
      options,
    ),
    execute("git", ["rev-parse", "HEAD"], options),
@@ -0,0 +1,191 @@
+import { randomUUID } from "node:crypto";
+import { createInterface } from "node:readline";
+import { PassThrough, Writable } from "node:stream";
+
+import {
+  OwnedCommandFailure,
+  prepareOwnedCommand,
+  runOwnedCommand,
+} from "../../dist/process/OwnedCommand.js";
+import { ArtifactResourceScope } from "../../dist/artifacts/ArtifactResourceScope.js";
+import { AnalysisCleanupLease } from "../../dist/artifacts/AnalysisCleanupLease.js";
+import { retainOwnedCommandCleanup } from "../../dist/providers/OwnedCommandCleanup.js";
+
+/** Keep command ownership through failure and join cleanup before removing a run. */
+export function createAgentEvaluationCommands({
+  codex,
+  evaluationRoot,
+  evaluationEnvironment,
+  optionalModel,
+  timeoutMs,
+  repositoryRoot,
+}) {
+  const resources = new ArtifactResourceScope();
+  const resourceOwner = {
+    retain(owner, resource) {
+      resources.retain({
+        kind: "lease",
+        resource,
+        lease: AnalysisCleanupLease.forCloseOwner(owner, resource),
+      });
+    },
+    run: (work) => resources.run(work),
+  };
+  const diagnosticBytes = 32_768;
+
+  async function execute(
+    command,
+    arguments_,
+    cwd,
+    env,
+    limits,
+    timeoutMessage,
+  ) {
+    return resourceOwner.run(async () => {
+      try {
+        // Fresh Darwin helper compilation has its own bounded deadline.
+        await prepareOwnedCommand();
+        return await runOwnedCommand(
+          {
+            command,
+            arguments: arguments_,
+            // CLI shims may execute through a shebang interpreter. Ownership
+            // still uses the launch generation and token, not an argv prefix.
+            expectedCommand: null,
+            cwd,
+            hostEnvironment: env,
+            runId: randomUUID(),
+            sweepTokenOwnedProcesses: true,
+          },
+          { diagnosticBytes, acceptNonZeroExit: true, ...limits },
+        );
+      } catch (cause) {
+        retainOwnedCommandCleanup(
+          cause,
+          resourceOwner,
+          "agent-evaluation",
+          command,
+        );
+        if (cause instanceof OwnedCommandFailure && cause.reason === "timeout")
+          throw new Error(timeoutMessage, { cause });
+        throw cause;
+      }
+    });
+  }
+
+  return {
+    async runCodex(prompt, approvedTools) {
+      const arguments_ = [
+        "--no-daemon",
+        "exec",
+        "--ephemeral",
+        "--skip-git-repo-check",
+        "--sandbox",
+        "read-only",
+        "--json",
+        "--color",
+        "never",
+        "-C",
+        evaluationRoot,
+        "-c",
+        'approval_policy="never"',
+        ...approvedTools.flatMap((name) => [
+          "-c",
+          `mcp_servers.rea.tools.${name}.approval_mode="approve"`,
+        ]),
+        ...(optionalModel === undefined ? [] : ["--model", optionalModel]),
+        prompt,
+      ];
+      const events = [];
+      const nonJson = [];
+      let nonJsonBytes = 0;
+      const stdout = new PassThrough();
+      const lines = createInterface({ input: stdout });
+      const linesClosed = new Promise((resolve) =>
+        lines.once("close", resolve),
+      );
+      let lineError;
+      lines.on("error", (cause) => {
+        // The owned pipeline reports stream failure or cancellation. Join this
+        // consumer too, without turning its forwarded error into a process crash.
+        lineError = cause;
+        lines.close();
+      });
+      lines.on("line", (line) => {
+        try {
+          events.push(JSON.parse(line));
+        } catch {
+          if (nonJsonBytes >= diagnosticBytes) return;
+          const bytes = Buffer.from(
+            `non-json stdout: ${line.slice(0, diagnosticBytes - nonJsonBytes)}`,
+          );
+          const retained = bytes.subarray(0, diagnosticBytes - nonJsonBytes);
+          if (retained.length > 0) nonJson.push(retained);
+          nonJsonBytes += retained.length;
+        }
+      });
+      try {
+        const result = await execute(
+          codex,
+          arguments_,
+          evaluationRoot,
+          evaluationEnvironment,
+          { timeoutMs, stdout },
+          `Codex evaluation timed out after ${String(timeoutMs)}ms`,
+        );
+        await linesClosed;
+        if (lineError !== undefined) throw lineError;
+        return {
+          events,
+          exitCode: result.exitCode ?? 1,
+          stderr: Buffer.concat([...nonJson, Buffer.from(result.stderr.text)])
+            .subarray(0, diagnosticBytes)
+            .toString("utf8"),
+        };
+      } finally {
+        stdout.destroy();
+        lines.close();
+        await linesClosed;
+      }
+    },
+
+    async runProcess(command, arguments_, cwd, timeout, env = process.env) {
+      const result = await execute(
+        command,
+        arguments_,
+        cwd,
+        env,
+        {
+          timeoutMs: timeout,
+          stdout: new Writable({ write: (_chunk, _encoding, done) => done() }),
+        },
+        `${command} timed out`,
+      );
+      if (result.exitCode !== 0)
+        throw new Error(
+          `${command} failed with ${String(result.exitCode)}: ${result.stderr.text}`,
+        );
+    },
+
+    async readCommandVersion(command) {
+      const result = await execute(
+        command,
+        ["--version"],
+        repositoryRoot,
+        process.env,
+        { timeoutMs: 10_000, diagnosticBytes: 8192 },
+        `${command} --version timed out`,
+      );
+      if (result.exitCode !== 0)
+        throw new Error(
+          `${command} --version failed with ${String(result.exitCode)}: ${result.stderr.text}`,
+        );
+      const version = result.stdout.text.trim();
+      if (version.length === 0)
+        throw new Error(`${command} --version returned empty output`);
+      return version;
+    },
+
+    close: () => resources.close(),
+  };
+}
@@ -58,8 +58,7 @@ export async function artifactCliEvidence(
  return evidence;
 }

-/** Run a real stdio MCP subprocess, owning and closing its transport. */
-export async function withArtifactMcp(target, verify) {
+const withOpenedArtifactMcp = async (target, openTool, verify) => {
  const transport = new StdioClientTransport({
    command: process.execPath,
    args: [fileURLToPath(new URL("../rea.mjs", import.meta.url)), "mcp"],
@@ -70,15 +69,27 @@ export async function withArtifactMcp(target, verify) {
  try {
    await client.connect(transport);
    const opened = await client.callTool({
-      name: "open_binary",
+      name: openTool,
      arguments: { path: target },
    });
    assert.notEqual(opened.isError, true, JSON.stringify(opened));
+    if (openTool === "open_bundle_resources")
+      assert.equal(opened.structuredContent?.result?.caller_path, target);
    await verify(client);
  } finally {
    await client.close();
    await transport.close();
  }
+};
+
+/** Run a real stdio MCP subprocess with an explicitly opened binary target. */
+export async function withArtifactMcp(target, verify) {
+  return withOpenedArtifactMcp(target, "open_binary", verify);
+}
+
+/** Run a real stdio MCP subprocess with an explicitly opened bundle resource root. */
+export async function withBundleResourcesMcp(target, verify) {
+  return withOpenedArtifactMcp(target, "open_bundle_resources", verify);
 }

 /** Require a successful structured MCP tool result rather than its text rendering. */
@@ -35,6 +35,7 @@ export const toolFamilyCatalog = (sources) => {
        ...sources.evmContracts.EVM_TOOL_CONTRACTS,
        ...sources.goContracts.GO_TOOL_CONTRACTS,
        ...sources.il2cppContracts.IL2CPP_TOOL_CONTRACTS,
+        ...sources.modelContracts.MODEL_TOOL_CONTRACTS,
        ...sources.rustContracts.RUST_TOOL_CONTRACTS,
        ...sources.wasmContracts.WASM_TOOL_CONTRACTS,
        ...sources.sqliteContracts.SQLITE_TOOL_CONTRACTS,
@@ -271,6 +272,10 @@ export const providerCatalog = (sources) => {
      identity: sources.il2cppProvider.IL2CPP_METADATA_PROVIDER_IDENTITY,
      contracts: sources.il2cppContracts.IL2CPP_TOOL_CONTRACTS,
    },
+    {
+      identity: sources.modelProvider.MODEL_ARTIFACT_PROVIDER_IDENTITY,
+      contracts: sources.modelContracts.MODEL_TOOL_CONTRACTS,
+    },
    {
      identity: sources.rustProvider.RUST_BINARY_PROVIDER_IDENTITY,
      contracts: sources.rustContracts.RUST_TOOL_CONTRACTS,
@@ -69,6 +69,8 @@ const SOURCE_PATHS = {
  evmProvider: "dist/evm/EvmoleRelease.js",
  goContracts: "dist/contracts/go/goToolContracts.js",
  goProvider: "dist/go/GoBinaryProvider.js",
+  modelContracts: "dist/contracts/model/modelToolContracts.js",
+  modelProvider: "dist/model/ModelArtifactProvider.js",
  il2cppContracts: "dist/contracts/il2cpp/il2cppToolContracts.js",
  il2cppProvider: "dist/il2cpp/Il2cppMetadataProvider.js",
  rustContracts: "dist/contracts/rust/rustToolContracts.js",