Merge remote-tracking branch 'origin/main' into HEAD

Exercise the actual JavaScript fixture producer with the reported 2045-byte embedded resource and all 60 AssemblyRef names. Verify declared complete extents and clean production-inspector coverage.

Fixes #2585
Fixes #2583

.agents/skills/reverse-engineer-anything/references/native-and-artifacts.md

@@ -103,11 +103,6 @@ architectures, build_metadata, load_commands, dependencies, imports, exports,
 segments and provenance. `source_exhaustive: false` means unreturned symbols
 may exist.
 
-`decode_interface_builder` graphs are often several megabytes and can exceed the
-MCP response budget. Select `detail: "summary"` for every decoded document and
-node/edge counts, then page `view: {kind: "interface-builder", collection:
-"edges", document: "<documents[].relative_path>", offset: 0, limit: 64}`.
-
 To see which functions or Objective-C methods a Mach-O actually calls in one
 run, use `observe_native_calls` with explicit breakpoints and a bounded
 `duration_ms`/`max_events`. It launches a new process under LLDB, so the target
@@ -174,6 +169,14 @@ repeat parsing. Returned-row exhaustion
 does not prove complete metadata or absence under partial/unavailable coverage;
 preserve build-local tokens and their artifact/MVID scope.
 
+`inspect_managed_members` always returns the assembly-wide `member_refs`, even
+for one selected type. For questions about a selected type, select
+`detail: "summary"` with `type_names`; it returns the selection (with unmatched
+names), coverage and per-collection counts. Page rows with
+`view: {kind: "managed-members", collection: "call_edges", offset: 0, limit: 64}`
+over `types`, `exported_types`, `fields`, `methods`, `member_refs`, `call_edges`,
+`field_accesses` or `user_strings`.
+
 ### .NET NativeAOT
 
 NativeAOT binaries contain native machine code, so ordinary CIL decompilers

README.md

@@ -24,12 +24,16 @@
 
 <code>npx rea-agents setup</code>
 
+</div>
+
 > [!IMPORTANT]
 > Get REA from [morluto/rea](https://github.com/morluto/rea),
 > [rea.tools](https://rea.tools/), or the [rea-agents npm package](https://www.npmjs.com/package/rea-agents).
 > Follow the installation and release links from these official sources. A similar
 > repository name or copied README does not establish that a download is official.
 
+<div align="center">
+
 <br />
 
 <img src="docs/assets/rea-hopper-analysis.png" alt="REA launching its analysis bridge inside Hopper while inspecting a native binary" width="1200" />
@@ -164,7 +168,7 @@ Additional tools and host support depend on the target:
 
 | Target                 | What REA returns                                                                     | Requirements and guide                                                                                                                |
 | ---------------------- | ------------------------------------------------------------------------------------ | ------------------------------------------------------------------------------------------------------------------------------------- |
-| Native binaries        | Pseudocode, assembly, strings, symbols, calls and references                         | Hopper, Ghidra or IDA; [native analysis](https://rea.tools/guides/native/)                                                            |
+| Native binaries        | Pseudocode, assembly, strings, symbols, calls and references                         | Hopper, Ghidra or IDA; [native analysis](docs/native-investigation.md)                                                                |
 | Offline ELF layout     | Sections, segments, original symbols/relocations and static mitigation candidates    | Caller-supplied pwntools on Linux x64; [binary diagnostics](docs/binary-diagnostics.md)                                               |
 | Go binaries            | Embedded compiler version, modules, replacements and build settings                  | Built-in static ELF/PE/thin Mach-O inspection; no Go installation required                                                            |
 | Rust binaries          | Embedded cargo-auditable crate names, versions, sources and dependency edges         | Built-in static ELF/PE/thin Mach-O inspection; [Rust binaries](docs/rust-binaries.md)                                                 |
@@ -172,8 +176,8 @@ Additional tools and host support depend on the target:
 | EVM bytecode           | Dispatch selectors, byte offsets, inferred arguments and mutability                  | Local raw/hex carrier on Linux x64; [offline EVM guide](docs/evm-bytecode.md)                                                         |
 | SQLite databases       | Tables, columns, indexes, views, triggers and selected ordinary-table rows           | Local database/WAL snapshot; Node.js 24.x >=24.15 or 26+ with native SQLite limits                                                    |
 | Recorded Linux crashes | Raw notes, every recorded thread's registers/signals and optional mapping candidates | Caller-supplied pwntools on Linux x64; optional GDB/pwndbg; [recorded crashes](docs/recorded-crashes.md)                              |
-| JavaScript / Electron  | Modules, imports, source maps, routes, IPC and native add-on relationships           | Node.js and npm; Linux: procps-compatible `ps`; [application analysis](https://rea.tools/guides/javascript/)                          |
-| Websites               | Page structure, scripts, network observations and requested screenshots              | A Chrome-family browser; [browser analysis](https://rea.tools/guides/browser/)                                                        |
+| JavaScript / Electron  | Modules, imports, source maps, routes, IPC and native add-on relationships           | Node.js and npm; Linux: procps-compatible `ps`; [application analysis](docs/javascript-application-workflows.md)                      |
+| Websites               | Page structure, scripts, network observations and requested screenshots              | A Chrome-family browser; [browser analysis](docs/browser-observation.md)                                                              |
 | Saved network captures | Requests, responses, exposed payloads and source locations                           | HAR or Fiddler Everywhere SAZ; mitmdump on Linux for native mitmproxy; [capture guide](docs/web-network-captures.md)                  |
 | .NET assemblies        | Metadata, CIL instructions, declared native dependencies and build comparisons       | None (static only); [managed-code guide](docs/managed-code-analysis.md)                                                               |
 | Android APKs           | Manifest declarations, classes, decompiled methods and references                    | Headless JADX and a full JDK on Linux/macOS/Windows x64; [Android guide](docs/android-analysis.md)                                    |
@@ -340,7 +344,7 @@ Report vulnerabilities through [SECURITY.md](SECURITY.md).
 
 ## Star history
 
-🎉 **180,000 GitHub stars — thank you!**
+🎉 **200,000 GitHub stars — thank you!**
 
 Thanks to everyone using REA, reporting bugs, requesting features, testing builds, and contributing fixes.
 

bridge/mitmproxy/capture.py

@@ -6,11 +6,13 @@ The containing mitmdump process and its configuration directory are REA-owned.
 
 import base64
 import hashlib
+import ipaddress
 import json
 import math
 import re
 import resource
 from pathlib import Path
+from urllib.parse import unquote_to_bytes
 
 from mitmproxy import ctx, version
 from mitmproxy.io import tnetstring
@@ -46,6 +48,8 @@ SCHEME_PREFIX = r"^[\x00-\x20]*([a-z][a-z0-9+.-]*):"
 NETWORK_PREFIX = r"^[\x00-\x20]*[/\\]{2}"
 URL_IGNORABLE_CONTROLS = "\t\n\r"
 URL_CONTROL_TRANSLATION = {ord(char): None for char in URL_IGNORABLE_CONTROLS}
+C0_CONTROL_OR_SPACE = "".join(chr(code) for code in range(0x21))
+FORBIDDEN_DOMAIN_CODE_POINTS = set(C0_CONTROL_OR_SPACE) | set("#%/:<>?@[\\]^|\x7f")
 
 
 def authority_start(text, base_scheme=None):
@@ -54,11 +58,14 @@ def authority_start(text, base_scheme=None):
     Follows WHATWG URL parsing as src/domain/recordedTransportUrl.ts does:
     special schemes (and scheme-relative references) skip every leading "/"
     or "\\" before the authority, so `https://\\user:pass@host` still has
-    userinfo. File URLs carry no userinfo and keep their "//" boundary.
+    userinfo. File URLs never carry userinfo: an "@" in a file host makes
+    WHATWG reject the whole URL, so there are no credentials to remove.
     """
     scheme = re.match(SCHEME_PREFIX, text, flags=re.I)
     name = scheme.group(1).lower() if scheme is not None else None
-    if name is not None and name in SPECIAL_SCHEMES and name != "file":
+    if name == "file" or (name is None and base_scheme == "file"):
+        return None
+    if name is not None and name in SPECIAL_SCHEMES:
         # A same-scheme Location without two slash-equivalent separators is
         # relative to the recorded request, so its @ belongs to the path.
         following = text[scheme.end():scheme.end() + 2]
@@ -69,7 +76,7 @@ def authority_start(text, base_scheme=None):
         if scheme is not None:
             if text[scheme.end():scheme.end() + 2] != "//":
                 return None
-            return scheme.end() + 2, name in SPECIAL_SCHEMES
+            return scheme.end() + 2, False
         # A non-special base treats backslashes as authority data and only
         # recognizes two forward slashes as a network reference.
         if base_scheme is not None and base_scheme not in SPECIAL_SCHEMES:
@@ -79,13 +86,87 @@ def authority_start(text, base_scheme=None):
         if prefix is None:
             return None
         start = prefix.end()
-        if base_scheme == "file":
-            return start, True
     while start < len(text) and text[start] in "/\\":
         start += 1
     return start, True
 
 
+IPV4_DIGITS = {8: "01234567", 10: "0123456789", 16: "0123456789abcdefABCDEF"}
+
+
+def ipv4_number(part):
+    """WHATWG IPv4 number parser: decimal, 0x hex or 0-prefixed octal, else None."""
+    if part == "":
+        return None
+    radix, digits = 10, part
+    if part[:2] in ("0x", "0X"):
+        radix, digits = 16, part[2:]
+    elif len(part) > 1 and part[0] == "0":
+        radix, digits = 8, part[1:]
+    if digits == "":
+        return 0
+    if any(char not in IPV4_DIGITS[radix] for char in digits):
+        return None
+    # Bound decimal text before int(): Python limits decimal conversions to
+    # 4300 digits, and anything past 10 significant digits exceeds IPv4.
+    significant = digits.lstrip("0")
+    if radix == 10 and len(significant) > 10:
+        return 2**32
+    return int(digits, radix)
+
+
+def domain_parses(domain):
+    """Apply WHATWG's ends-in-a-number check and IPv4 parser to a domain."""
+    parts = domain.split(".")
+    if parts[-1] == "" and len(parts) > 1:
+        parts.pop()
+    last = parts[-1]
+    if not ((last != "" and last.isascii() and last.isdigit()) or ipv4_number(last) is not None):
+        return True
+    numbers = [ipv4_number(part) for part in parts]
+    if len(parts) > 4 or any(number is None for number in numbers):
+        return False
+    return all(number <= 255 for number in numbers[:-1]) and numbers[-1] < 256 ** (5 - len(numbers))
+
+
+def special_host_parses(host_port):
+    """Whether WHATWG could accept a special authority's host and port.
+
+    A rejected host fails the whole URL, so it has no credentials to remove.
+    This mirrors the forbidden-code-point, empty-host, IPv4, IPv6 and port
+    rules for ASCII hosts. UTS #46 mapping is not modeled: a non-ASCII host
+    may map to an accepted one (fullwidth digits, ideographic full stops,
+    ignored code points), so it is treated as accepted and still redacts.
+    """
+    if host_port.startswith("["):
+        host_end = host_port.find("]") + 1
+        literal = host_port[1 : host_end - 1]
+        if host_end == 0 or "%" in literal:
+            return False
+        try:
+            ipaddress.IPv6Address(literal)
+        except ValueError:
+            return False
+    else:
+        colon = host_port.find(":")
+        host_end = len(host_port) if colon < 0 else colon
+        host = unquote_to_bytes(host_port[:host_end]).decode("utf-8", errors="replace")
+        # Mapping never removes ASCII, so these rejections hold either way.
+        if host == "" or any(char in FORBIDDEN_DOMAIN_CODE_POINTS for char in host):
+            return False
+        if host.isascii() and not domain_parses(host.lower()):
+            return False
+    port = host_port[host_end:]
+    if port == "":
+        return True
+    digits = port[1:]
+    if port[0] != ":" or not (digits == "" or (digits.isascii() and digits.isdigit())):
+        return False
+    # Bound the text first: int() refuses decimal strings over 4300 digits.
+    significant = digits.lstrip("0")
+    return len(significant) <= 5 and int(significant or "0") <= 65535
+
+
 def without_userinfo(value, base_scheme=None):
     """Remove an authority's userinfo using the WHATWG authority boundary.
 
@@ -96,7 +177,8 @@ def without_userinfo(value, base_scheme=None):
     text = value.decode("latin-1") if binary else value
     # WHATWG removes these controls before interpreting scheme/separators.
     # Keep that parse view separate from the exact source spelling and bytes.
-    parsed_text = text.translate(URL_CONTROL_TRANSLATION)
+    # It also drops trailing C0 controls and spaces; offsets are unchanged.
+    parsed_text = text.translate(URL_CONTROL_TRANSLATION).rstrip(C0_CONTROL_OR_SPACE)
     located = authority_start(parsed_text, base_scheme)
     if located is None:
         return value
@@ -106,7 +188,7 @@ def without_userinfo(value, base_scheme=None):
     while end < len(parsed_text) and parsed_text[end] not in terminators:
         end += 1
     at = parsed_text.rfind("@", start, end)
-    if at < start:
+    if at < start or (special and not special_host_parses(parsed_text[at + 1 : end])):
         return value
     parsed_offset = 0
     raw_start = 0

bridge/mitmproxy/test_capture.py

@@ -165,6 +165,97 @@ class TransportUserinfoTests(unittest.TestCase):
     def test_file_urls_keep_path_text(self):
         self.assertEqual(capture.without_userinfo("file:///a@b"), "file:///a@b")
 
+    def test_file_urls_reject_userinfo_and_keep_their_source(self):
+        # WHATWG rejects an "@" in a file host, so nothing parses as credentials.
+        self.assertEqual(
+            capture.without_userinfo("file://user:pass@host/x"), "file://user:pass@host/x"
+        )
+        for value in [b"\\\\user:pass@host/x", b"/\\user:pass@host/x", b"//user:pass@host/x"]:
+            with self.subTest(value=value):
+                text, sidecar, redactions = location(value, b"file")
+                self.assertEqual(text, value.decode("ascii"))
+                self.assertEqual(sidecar["state"], "retained")
+                self.assertEqual(redactions, [])
+
+    def test_rejected_special_hosts_keep_their_source(self):
+        # A rejected host or port fails the whole URL, so it has no userinfo.
+        for value in [
+            "https:user@%",
+            "https://user@",
+            "https://user:pass@h^st/x",
+            "https://user@ho st/x",
+            "https://user@host:99999/x",
+            "https://user@host:12a",
+            "https://user@[::1",
+        ]:
+            with self.subTest(value=value):
+                self.assertEqual(capture.without_userinfo(value), value)
+        text, sidecar, redactions = location(b"https://user:pass@h^st/x", b"https")
+        self.assertEqual(text, "https://user:pass@h^st/x")
+        self.assertEqual(sidecar["state"], "retained")
+        self.assertEqual(redactions, [])
+
+    def test_accepted_special_hosts_still_remove_userinfo(self):
+        for value, expected in [
+            ("https:user@%41", "https:%41"),
+            ("https://user@[::1]:8443/x", "https://[::1]:8443/x"),
+            ("https://user@host:/x", "https://host:/x"),
+            ("wss://user:pass@host:65535", "wss://host:65535"),
+            ("https://user@0x7f.1/", "https://0x7f.1/"),
+            ("https://user@1.2.3.4./", "https://1.2.3.4./"),
+            ("https://user@4294967295/", "https://4294967295/"),
+            ("https://user@1.2.3.08a/", "https://1.2.3.08a/"),
+            ("https://user@[::ffff:1.2.3.4]/", "https://[::ffff:1.2.3.4]/"),
+        ]:
+            with self.subTest(value=value):
+                self.assertEqual(capture.without_userinfo(value), expected)
+
+    def test_unicode_hosts_that_may_map_to_accepted_hosts_remove_userinfo(self):
+        # UTS #46 maps these to 1.2.3.4; mapping is not modeled, so redact.
+        for host in ["%EF%BC%91.2.3.4", "1。2.3.4", "%C2%AD1.2.3.4", "１.2.3.4"]:
+            with self.subTest(host=host):
+                self.assertEqual(
+                    capture.without_userinfo(f"https://user:pw@{host}/"), f"https://{host}/"
+                )
+        text, sidecar, redactions = location(b"https://user:pw@%EF%BC%91.2.3.4/", b"https")
+        self.assertEqual(text, "https://%EF%BC%91.2.3.4/")
+        self.assertEqual(sidecar["state"], "redacted")
+        self.assertEqual(len(redactions), 1)
+        # ASCII rejections still hold for non-ASCII hosts.
+        self.assertEqual(capture.without_userinfo("https://user@１^/"), "https://user@１^/")
+
+    def test_trailing_controls_and_spaces_do_not_hide_userinfo(self):
+        # WHATWG strips trailing C0 controls and spaces before parsing.
+        for suffix in [b" ", b"\x01", b"\x00 \x1f"]:
+            with self.subTest(suffix=suffix):
+                value = b"https://user:pw@example.test" + suffix
+                text, sidecar, redactions = location(value, b"https")
+                self.assertEqual(text, "https://example.test" + suffix.decode("latin-1"))
+                self.assertEqual(sidecar["state"], "redacted")
+                self.assertEqual(len(redactions), 1)
+
+    def test_rejected_ip_literals_keep_their_source(self):
+        for value in [
+            "https://user:pass@256.256.256.256/path",
+            "https://user@1.2.3.4.5/",
+            "https://user@1.2.3.09/",
+            "https://user@4294967296/",
+            "https://user@a.0x/",
+            "https://user@1..2/",
+            "https://user@1." + "9" * 5000 + "/",
+            "https://user@[1::2::3]/",
+            "https://user@[::1%25eth0]/",
+        ]:
+            with self.subTest(value=value[:40]):
+                self.assertEqual(capture.without_userinfo(value), value)
+
+    def test_overlong_ports_are_compared_without_numeric_overflow(self):
+        # Python 3.11+ refuses int() on decimal strings over 4300 digits.
+        accepted = "https://user@host:" + "0" * 5000 + "80/x"
+        self.assertEqual(capture.without_userinfo(accepted), "https://host:" + "0" * 5000 + "80/x")
+        rejected = "https://user@host:" + "9" * 5000 + "/x"
+        self.assertEqual(capture.without_userinfo(rejected), rejected)
+
     def test_non_special_schemes_keep_backslashes_in_the_authority(self):
         self.assertEqual(capture.without_userinfo("foo://a\\b@host/x"), "foo://host/x")
         self.assertEqual(capture.without_userinfo(b"//a\\b@host"), b"//a\\b@host")

docs/cli.md

@@ -301,6 +301,14 @@ user permissions; consult the chosen guide for host requirements and effects.
 
 ## Output and exit status
 
+`rea mcp doctor --json` checks production MCP startup and reports child logs in
+`diagnostics`. It drains stderr while retaining at most its first 64 KiB of raw
+bytes as text, omitting a final UTF-8 code point if it crosses that byte limit.
+`stderr_bytes` counts all observed bytes, including omitted output;
+`stderr_truncated` indicates that output exceeded the retention limit. The same
+diagnostics appear inside the report when `--full-output` is selected. Log
+truncation alone does not change the diagnostic health or exit status.
+
 The default terminal format is TOON. Use `--json` when saving results for a
 JSON consumer. `--json` is indented on a terminal and compact when piped or
 redirected, which keeps large results smaller for agents and scripts; pipe

docs/client-verification.md

@@ -377,6 +377,11 @@ Such a stall leaves the initial page unloaded with empty or placeholder CDP URLs
 it does not establish permission to capture that page. See
 [the keyring diagnosis](https://github.com/morluto/rea/issues/1384#issuecomment-6093781686).
 
+On Windows, browser verifier lanes that launch an owned fixture require a
+standard, non-elevated caller token. They inspect the verifier caller before
+allocating fixture resources and refuse elevated or unobservable tokens; they do
+not change caller authority or claim to inspect the browser process token.
+
 `verify:browser` also captures a source-owned noise canvas as a real PNG above
 8 MiB through the CLI and stdio MCP, with complete byte/digest parity and real PNG
 decoding. Its SDK client explicitly permits the larger inline JSON response;

docs/electron-fuses.md

@@ -20,6 +20,11 @@ requires an absolute filesystem path and preserves that exact selection:
 }
 ```
 
+On POSIX hosts, the CLI preserves path components so symlinks are followed
+before parent (`..`) steps. Bundle selections may end in `.` or parent steps
+through real directories; a terminal parent step through a directory symlink
+is rejected. Windows CLI paths retain native drive and separator resolution.
+
 Check this before `observe_javascript_runtime` with `electron-main`. When
 `EnableNodeCliInspectArguments` is disabled or removed, Electron ignores
 Inspector flags, and a later target listing can simply show no main-process

docs/ghidra-mips.md

@@ -52,9 +52,23 @@ section names or the record being inside the initial 4 KiB header probe.
 Program and section declarations must agree; duplicate, conflicting, truncated
 or out-of-file records are rejected. Stripped section tables and section-only
 records are supported. Extended table numbering is explicitly unsupported.
-GNU `SHT_GNU_ATTRIBUTES` sections are refused by numeric section type until REA
-parses and reconciles their declarations; section names and payload sizes do not
-control detection or allocation. For carved ELFs whose section table extends
+GNU `SHT_GNU_ATTRIBUTES` sections are located by numeric section type; section
+names never control detection. REA reads at most 4096 payload bytes and parses
+format version `A`, the `gnu` vendor's file-scope `Tag_GNU_MIPS_ABI_FP` (4) and
+`Tag_GNU_MIPS_ABI_MSA` (8) only. Unknown vendors, scopes or tags, repeated
+declarations, malformed lengths, and out-of-file or oversized payloads remain
+refusals. A nonzero FP tag must match the separate ABI flags `fp_abi` record;
+value 0 (`ANY`) declares no requirement. The [GNU Object Attributes v1
+format](https://sourceware.org/binutils/docs/as/Object-Attributes-v1.html) and
+[GNU MIPS tag definitions](https://sourceware.org/binutils/docs/as/GNU-Object-Attributes.html)
+are the format references. The MSA tag describes the vector
+argument ABI, while the ABI flags ASE field describes instruction-set
+extensions; REA does not treat those as interchangeable. The 128-bit MSA
+argument ABI and unknown nonzero MSA values remain unsupported. Without a
+separate ABI flags record, FP attribute values are admitted only when absent,
+`ANY` (0), double precision (1), or FPXX (5), the values covered by the
+recordless profile. Parsed values are retained in the MIPS analysis profile.
+For carved ELFs whose section table extends
 beyond the captured file, REA examines every complete captured section header
 and records the unavailable headers as a limitation. The provider refuses an
 incomplete ABI declaration inspection even when a program-header ABI record is

docs/installation.md

@@ -325,7 +325,8 @@ selected engine. See [provider selection](cli.md#choose-a-provider).
 On Linux, REA's shared process supervisor requires a procps-compatible `ps`
 on REA's `PATH` for ownership checks before launching a child. Ghidra, JADX,
 firmware tools and static JavaScript/Electron analysis use these checks.
-Install `procps` or put another procps-compatible `ps` on `PATH` before
+Install your distribution's `procps` or `procps-ng` package, or put another
+procps-compatible `ps` on `PATH` before
 running those workflows. A missing or incompatible command causes a refusal
 before the supervised child starts.
 
@@ -521,10 +522,10 @@ on Linux continues to use its supported demo-launch route.
 
 Hopper lease directories must be readable and owned by the current user.
 REA validates and secures an opened directory before reserving a lease. If
-directory access fails, the error identifies the path and recovery steps;
-REA leaves its permissions unchanged. Check ownership and parent-directory
-access, then restore owner-only read, write, and search permissions (`0700`)
-on a directory you own before retrying.
+opening that directory fails with a permission error, the diagnostic identifies
+the path and recovery steps while leaving its permissions unchanged. Check
+ownership and parent-directory access, then restore owner-only read, write, and
+search permissions (`0700`) on a directory you own before retrying.
 
 On supported Linux distributions, approved setup verifies Hopper's official
 `.deb`, `.rpm`, or Arch package before invoking the native package manager.

docs/jeb-analysis.md

@@ -10,6 +10,12 @@ Start a JEB client that serves MCP and point REA at it:
 - In the JEB GUI client, start the MCP server from the _File_ menu (or via the VIBRE assistant).
 - Headless, use JEB's documented programmatic route (`JebMcpServerInstance` from the JEB API) with the JEB client on your classpath; JEB 5.48's `-c` headless mode does not accept `--mcp` directly.
 
+For setup registration, set `REA_JEB_MCP_URL` in the REA process environment
+before running `rea setup`. The approved setup plan preserves the exact selected
+URL after validating its syntax. That validation does not establish that the
+JEB service is reachable or that a project is open; use the existing
+`inspect-jeb-client` command for a read-only service query.
+
 Verified against JEB 5.48.0 (Linux x64, licensed build) serving `jeb-mcp-server` 1.3.0 over streamable HTTP.
 
 ## Operations

docs/managed-code-analysis.md

@@ -81,6 +81,40 @@ including the existing `inspect-analysis-view` CLI. Session record lifetime and
 export/import semantics remain unchanged. A server without Evidence retention
 rejects selected summary before analysis; complete delivery remains available.
 
+### Member summary and retained member rows
+
+Complete `inspect_managed_members` delivery always includes the assembly-wide
+`member_refs` and `exported_types`, which `type_names` does not narrow, so even
+one selected or unmatched type can return megabytes. Select
+`{"path":"/absolute/path/Assembly.dll","type_names":["Namespace.Type"],"detail":"summary"}`
+to keep the complete source in the session and receive identity, metadata
+status, the selection with its unmatched names, coverage/issues, the separate
+user-string coverage, limitations and per-collection counts. Then page original
+rows with view kind `managed-members`:
+
+```json
+{
+  "source": {
+    "kind": "retained-evidence",
+    "evidence_id": "<parent_evidence_id>"
+  },
+  "view": {
+    "kind": "managed-members",
+    "collection": "call_edges",
+    "offset": 0,
+    "limit": 64
+  }
+}
+```
+
+Collections are `types`, `exported_types`, `fields`, `methods`, `member_refs`,
+`call_edges`, `field_accesses` and `user_strings` (the literals). Each page names
+its collection, retains original rows, order, tokens, signatures and body facts,
+and carries the source selection and coverage; `user_strings` pages carry the
+literal pool's own coverage. Older Evidence that never examined exported types
+or user strings reports a null count and refuses those pages rather than
+returning an empty one.
+
 ## Shipped scope
 
 The canonical parser admits PE/CLI bytes and their metadata/CIL without loading

docs/native-investigation.md

@@ -536,6 +536,12 @@ unresolved runtime/value semantics remain visible in results.
 
 ## Interface Builder hierarchy coverage
 
+A document's `hierarchy_complete` flag follows its own hierarchy coverage.
+If graph limits omit a hierarchy source or destination, or prevent a hierarchy
+edge or traversal from being retained, that document reports partial hierarchy
+coverage. Retained unresolved edges remain in the graph and do not add to the
+omitted-edge count. Coverage is evaluated separately for each document.
+
 A keyed-archive hierarchy UID without an object-table entry marks the hierarchy
 as partial while preserving decoded objects and known links. UID 0 remains
 archived nil and does not count as a missing reference. Archive and evidence

docs/process-capture.md

@@ -159,14 +159,30 @@ line. Stdout stays the final Evidence document:
 `cleanup`. `completed` counts collected terminal frames, process samples, and
 interaction events. `total` stays null; REA does not invent a unit total or a
 percentage. `message` reports elapsed time and those counts. The final line uses
-`phase` `cleanup`, sets `terminal` to true, and adds `disposition` (`exited`,
-`timeout`, `idle_timeout`, `cancelled`, or `failed`) plus the owned-process,
-renderer, and temporary-root cleanup states. Updates use the shared progress
-boundary and are limited to one intermediate line per 100 ms; the terminal line
-is always emitted. If a receiver is slow, intermediate observations are merged
-into the latest status, and stale live observations are discarded before final
-cleanup status. Progress never copies child output. Child output remains in the
-capture Evidence on stdout.
+`phase` `cleanup` and sets `terminal` to true. Its `message` also contains
+`disposition=<value>` (`exited`, `timeout`, `idle_timeout`, `cancelled`, or `failed`)
+and the `owned_process_group`, `terminal_renderer`, and `temporary_root` cleanup
+states as `key=value` text. These values are not separate JSON fields. For
+example, a completed capture can end with:
+
+```json
+{
+  "rea_progress": {
+    "phase": "cleanup",
+    "completed": 0,
+    "total": null,
+    "message": "elapsed_ms=2180 frames=0 samples=0 interactions=0 disposition=exited owned_process_group=cleaned terminal_renderer=cleaned temporary_root=cleaned",
+    "terminal": true,
+    "sequence": 13
+  }
+}
+```
+
+Updates use the shared progress boundary and are limited to one intermediate line
+per 100 ms; the terminal line is always emitted. If a receiver is slow,
+intermediate observations are merged into the latest status, and stale live
+observations are discarded before final cleanup status. Progress never copies
+child output. Child output remains in the capture Evidence on stdout.
 
 ### Scenario with interactions
 

docs/readme/README_ar.md

@@ -24,10 +24,14 @@
 
 <code>npx rea-agents setup</code>
 
+</div>
+
 > [!IMPORTANT]
 > المصادر الرسمية لـ REA: [morluto/rea](https://github.com/morluto/rea), [rea.tools](https://rea.tools/), [rea-agents](https://www.npmjs.com/package/rea-agents) (npm).
 > استخدم روابط التثبيت والإصدارات المنشورة في هذه المصادر الرسمية. تشابه اسم المستودع أو نسخ ملف README لا يثبت أن التنزيل رسمي.
 
+<div align="center">
+
 <br />
 
 <img src="../assets/rea-hopper-analysis.png" alt="REA يشغّل جسر التحليل داخل Hopper لفحص ملف ثنائي للشيفرة الأصلية" width="1200" />
@@ -137,13 +141,13 @@ npx rea-agents@latest setup
 
 | الهدف                           | ما يعيده REA                                                                                               | المتطلبات والدليل                                                                                                             |
 | ------------------------------- | ---------------------------------------------------------------------------------------------------------- | ----------------------------------------------------------------------------------------------------------------------------- |
-| الملفات الثنائية للشيفرة الأصلية | شيفرة شبه برمجية، وتعليمات تجميع، وسلاسل نصية، ورموز، واستدعاءات، ومراجع                                    | Hopper أو Ghidra أو IDA؛ [تحليل الشيفرة الأصلية](https://rea.tools/ar/guides/native/)                                          |
+| الملفات الثنائية للشيفرة الأصلية | شيفرة شبه برمجية، وتعليمات تجميع، وسلاسل نصية، ورموز، واستدعاءات، ومراجع                                    | Hopper أو Ghidra أو IDA؛ [تحليل الشيفرة الأصلية](../native-investigation.md)                                                   |
 | بنية ELF دون تشغيل              | الأقسام والمقاطع والرموز ومعلومات إعادة التموضع الأصلية، وآليات الحماية المحتملة المستدلّ عليها بالفحص الثابت | pwntools يوفّره المستدعي على Linux x64؛ [تشخيص الملفات الثنائية](../binary-diagnostics.md)                                     |
 | شيفرة EVM البايتية              | محددات التوجيه، وإزاحات البايتات، والمعاملات المستنتجة، وقابلية تغيير الحالة                                | مدخل محلي يحمل بايتات خامًا أو تمثيلًا سداسيًا عشريًا على Linux x64؛ [دليل EVM دون تشغيل](../evm-bytecode.md)                      |
 | Rust binaries                   | Embedded cargo-auditable dependency list                                                                   | [Rust binaries](../rust-binaries.md)                                                                                          |
 | أعطال Linux المسجّلة             | سجلات note الخام، ومسجّلات المعالج/الإشارات لكل خيط مسجّل، وترشيحات اختيارية لخرائط الذاكرة                     | pwntools يوفّره المستدعي على Linux x64؛ GDB/pwndbg اختياريان؛ [الأعطال المسجّلة](../recorded-crashes.md)                         |
-| JavaScript / Electron           | الوحدات، وعمليات الاستيراد، وخرائط المصدر، والمسارات، وIPC، وعلاقات إضافات الشيفرة الأصلية                    | Node.js وnpm؛ [تحليل التطبيقات](https://rea.tools/ar/guides/javascript/)                                                      |
-| المواقع                         | بنية الصفحة، والسكربتات، وملاحظات الشبكة، ولقطات الشاشة المطلوبة                                            | متصفح من عائلة Chrome؛ [تحليل المتصفح](https://rea.tools/ar/guides/browser/)                                                  |
+| JavaScript / Electron           | الوحدات، وعمليات الاستيراد، وخرائط المصدر، والمسارات، وIPC، وعلاقات إضافات الشيفرة الأصلية                    | Node.js وnpm؛ [تحليل التطبيقات](../javascript-application-workflows.md)                                                       |
+| المواقع                         | بنية الصفحة، والسكربتات، وملاحظات الشبكة، ولقطات الشاشة المطلوبة                                            | متصفح من عائلة Chrome؛ [تحليل المتصفح](../browser-observation.md)                                                             |
 | تسجيلات الشبكة المحفوظة          | الطلبات، والاستجابات، ومحتويات الحمولة المتاحة، ومواضعها في المصدر                                          | HAR؛ وmitmdump على Linux لتسجيلات mitmproxy بصيغتها الأصلية؛ [دليل تسجيلات الشبكة](../web-network-captures.md)                   |
 | التقاط الحزم                    | نقاط النهاية وDNS وTLS SNI وتوزيع البروتوكولات وطلبات HTTP                                                  | tshark وcapinfos يوفّرهما المُستدعي؛ [دليل pcap](../pcap-analysis.md)                                                           |
 | تجميعات .NET                    | البيانات الوصفية، وتعليمات CIL، واعتماديات الشيفرة الأصلية المعلنة، ومقارنات البناء                         | فحص ثابت؛ [دليل الشيفرة المُدارة](../managed-code-analysis.md)                                                                 |
@@ -270,7 +274,7 @@ npx rea-agents@latest setup
 
 ## سجل النجوم
 
-🎉 **170,000 نجمة على GitHub — شكرًا لكم!**
+🎉 **200,000 نجمة على GitHub — شكرًا لكم!**
 
 شكرًا لكل من يستخدم REA، ويبلّغ عن الأخطاء، ويقترح ميزات، ويختبر إصدارات البناء، ويساهم بالإصلاحات.
 

docs/readme/README_de.md

@@ -24,10 +24,14 @@
 
 <code>npx rea-agents setup</code>
 
+</div>
+
 > [!IMPORTANT]
 > Offizielle Quellen für REA: [morluto/rea](https://github.com/morluto/rea), [rea.tools](https://rea.tools/), [rea-agents](https://www.npmjs.com/package/rea-agents) (npm).
 > Folge den Installations- und Release-Links aus diesen offiziellen Quellen. Ein ähnlicher Repository-Name oder eine kopierte README belegt nicht, dass ein Download offiziell ist.
 
+<div align="center">
+
 <br />
 
 <img src="../assets/rea-hopper-analysis.png" alt="REA startet seine Analysebrücke in Hopper und untersucht eine native Binärdatei" width="1200" />
@@ -137,13 +141,13 @@ REA benötigt Node.js 22.x (>=22.19), 24.x (>=24.11) oder 26+ sowie npm. Zusätz
 
 | Ziel                                | Was REA zurückgibt                                                                                              | Voraussetzungen und Anleitung                                                                                                               |
 | ----------------------------------- | --------------------------------------------------------------------------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------- |
-| Native Binärdateien                 | Pseudocode, Assemblercode, Zeichenketten, Symbole, Aufrufe und Verweise                                         | Hopper, Ghidra oder IDA; [native Analyse](https://rea.tools/de/guides/native/)                                                              |
+| Native Binärdateien                 | Pseudocode, Assemblercode, Zeichenketten, Symbole, Aufrufe und Verweise                                         | Hopper, Ghidra oder IDA; [native Analyse](../native-investigation.md)                                                                       |
 | Offline-ELF-Struktur                | Sektionen, Segmente, ursprüngliche Symbole/Relokationen und mögliche Schutzmaßnahmen aus statischer Analyse     | Vom Aufrufer bereitgestelltes pwntools unter Linux x64; [Binärdiagnostik](../binary-diagnostics.md)                                         |
 | EVM-Bytecode                        | Dispatch-Selektoren, Byte-Offsets, abgeleitete Argumente und Veränderbarkeit des Zustands                       | Lokale Eingabe mit Rohbytes oder Hexdarstellung unter Linux x64; [Offline-EVM-Leitfaden](../evm-bytecode.md)                                |
 | Rust binaries                       | Embedded cargo-auditable dependency list                                                                        | [Rust binaries](../rust-binaries.md)                                                                                                        |
 | Aufgezeichnete Linux-Abstürze       | Unverarbeitete Note-Einträge, Register/Signale aller aufgezeichneten Threads und optionale Zuordnungskandidaten | Vom Aufrufer bereitgestelltes pwntools unter Linux x64; optional GDB/pwndbg; [aufgezeichnete Abstürze](../recorded-crashes.md)              |
-| JavaScript / Electron               | Module, Imports, Source Maps, Routen, IPC und Beziehungen zu nativen Add-ons                                    | Node.js und npm; [Anwendungsanalyse](https://rea.tools/de/guides/javascript/)                                                               |
-| Websites                            | Seitenstruktur, Skripte, Netzwerkbeobachtungen und angeforderte Screenshots                                     | Ein Browser aus der Chrome-Familie; [Browseranalyse](https://rea.tools/de/guides/browser/)                                                  |
+| JavaScript / Electron               | Module, Imports, Source Maps, Routen, IPC und Beziehungen zu nativen Add-ons                                    | Node.js und npm; [Anwendungsanalyse](../javascript-application-workflows.md)                                                                |
+| Websites                            | Seitenstruktur, Skripte, Netzwerkbeobachtungen und angeforderte Screenshots                                     | Ein Browser aus der Chrome-Familie; [Browseranalyse](../browser-observation.md)                                                             |
 | Gespeicherte Netzwerkaufzeichnungen | Anfragen, Antworten, zugängliche Nutzdaten und Quellpositionen                                                  | HAR; mitmdump unter Linux für Aufzeichnungen im nativen mitmproxy-Format; [Leitfaden zu Netzwerkaufzeichnungen](../web-network-captures.md) |
 | Paketerfassungen                    | Endpunkte, DNS, TLS SNI, Protokollverteilung und HTTP-Anfragen                                                  | Vom Aufrufer bereitgestellte tshark- und capinfos-Binaries; [pcap-Leitfaden](../pcap-analysis.md)                                           |
 | .NET-Assemblies                     | Metadaten, CIL-Anweisungen, deklarierte native Abhängigkeiten und Build-Vergleiche                              | Statische Untersuchung; [Leitfaden für verwalteten Code](../managed-code-analysis.md)                                                       |
@@ -268,7 +272,7 @@ Melde Sicherheitslücken gemäß [SECURITY.md](../../SECURITY.md).
 
 ## Sternverlauf
 
-🎉 **170.000 GitHub-Sterne – vielen Dank!**
+🎉 **200.000 GitHub-Sterne – vielen Dank!**
 
 Danke an alle, die REA nutzen, Fehler melden, Funktionswünsche äußern, Builds testen und Fehlerbehebungen beitragen.
 

docs/readme/README_el.md

@@ -23,6 +23,8 @@
 
 <code>npx rea-agents setup</code>
 
+</div>
+
 > [!IMPORTANT]
 > Κατέβασε το REA από το [morluto/rea](https://github.com/morluto/rea),
 > το [rea.tools](https://rea.tools/) ή το [πακέτο rea-agents στο npm](https://www.npmjs.com/package/rea-agents).
@@ -30,6 +32,8 @@
 > Ένα παρόμοιο όνομα αποθετηρίου ή ένα αντιγραμμένο README δεν αποδεικνύει ότι
 > ένα αρχείο προς λήψη προέρχεται από επίσημη πηγή.
 
+<div align="center">
+
 <br />
 
 <img src="../assets/rea-hopper-analysis.png" alt="Το REA ξεκινά τη γέφυρα ανάλυσής του μέσα στο Hopper κατά την εξέταση ενός δυαδικού αρχείου με κώδικα μηχανής" width="1200" />
@@ -141,7 +145,7 @@ npx rea-agents@latest setup
 
 | Στόχος                                 | Τι επιστρέφει το REA                                                                                                        | Απαιτήσεις και οδηγός                                                                                                               |
 | -------------------------------------- | --------------------------------------------------------------------------------------------------------------------------- | ----------------------------------------------------------------------------------------------------------------------------------- |
-| Δυαδικά αρχεία με κώδικα μηχανής       | Ψευδοκώδικα, κώδικα assembly, συμβολοσειρές, σύμβολα, κλήσεις και αναφορές                                                  | Hopper, Ghidra ή IDA· [ανάλυση κώδικα μηχανής](https://rea.tools/guides/native/)                                                    |
+| Δυαδικά αρχεία με κώδικα μηχανής       | Ψευδοκώδικα, κώδικα assembly, συμβολοσειρές, σύμβολα, κλήσεις και αναφορές                                                  | Hopper, Ghidra ή IDA· [ανάλυση κώδικα μηχανής](../native-investigation.md)                                                          |
 | Δομή ELF χωρίς εκτέλεση                | Ενότητες, τμήματα, αρχικά σύμβολα/εγγραφές μετεγκατάστασης και ενδείξεις πιθανών μέτρων προστασίας από στατική ανάλυση      | pwntools που παρέχει ο χρήστης σε Linux x64· [διαγνωστικά δυαδικών αρχείων](../binary-diagnostics.md)                               |
 | Δυαδικά αρχεία Go                      | Ενσωματωμένη έκδοση μεταγλωττιστή, modules, αντικαταστάσεις και ρυθμίσεις μεταγλώττισης                                     | Ενσωματωμένη στατική εξέταση ELF/PE/thin Mach-O· δεν απαιτείται εγκατάσταση του Go                                                  |
 | Δυαδικά αρχεία Rust                    | Ενσωματωμένα ονόματα, εκδόσεις, πηγές και σχέσεις εξάρτησης των crates από το cargo-auditable                               | Ενσωματωμένη στατική εξέταση ELF/PE/thin Mach-O· [δυαδικά αρχεία Rust](../rust-binaries.md)                                         |
@@ -149,8 +153,8 @@ npx rea-agents@latest setup
 | Bytecode EVM                           | Selectors επιλογής συνάρτησης, μετατοπίσεις σε bytes, εκτιμώμενα ορίσματα και δυνατότητα μεταβολής της κατάστασης           | Τοπική είσοδος σε ακατέργαστα bytes ή δεκαεξαδική μορφή σε Linux x64· [οδηγός EVM χωρίς εκτέλεση](../evm-bytecode.md)               |
 | Βάσεις δεδομένων SQLite                | Πίνακες, στήλες, ευρετήρια, όψεις, triggers και επιλεγμένες γραμμές κανονικών πινάκων                                       | Τοπικό στιγμιότυπο βάσης δεδομένων/WAL· Node.js 24.x >=24.15 ή 26+ με εγγενή όρια SQLite                                            |
 | Καταγεγραμμένες καταρρεύσεις στο Linux | Ακατέργαστες εγγραφές notes, καταχωρητές/σήματα κάθε καταγεγραμμένου νήματος και προαιρετικές πιθανές αντιστοιχίσεις μνήμης | pwntools που παρέχει ο χρήστης σε Linux x64· προαιρετικά GDB/pwndbg· [καταγεγραμμένες καταρρεύσεις](../recorded-crashes.md)         |
-| JavaScript / Electron                  | Modules, εισαγωγές, source maps, διαδρομές, IPC και σχέσεις με πρόσθετα κώδικα μηχανής                                      | Node.js και npm· [ανάλυση εφαρμογών](https://rea.tools/guides/javascript/)                                                          |
-| Ιστότοποι                              | Δομή σελίδων, scripts, παρατηρήσεις δικτύου και ζητούμενα στιγμιότυπα οθόνης                                                | Πρόγραμμα περιήγησης της οικογένειας Chrome· [ανάλυση μέσω προγράμματος περιήγησης](https://rea.tools/guides/browser/)              |
+| JavaScript / Electron                  | Modules, εισαγωγές, source maps, διαδρομές, IPC και σχέσεις με πρόσθετα κώδικα μηχανής                                      | Node.js και npm· [ανάλυση εφαρμογών](../javascript-application-workflows.md)                                                        |
+| Ιστότοποι                              | Δομή σελίδων, scripts, παρατηρήσεις δικτύου και ζητούμενα στιγμιότυπα οθόνης                                                | Πρόγραμμα περιήγησης της οικογένειας Chrome· [ανάλυση μέσω προγράμματος περιήγησης](../browser-observation.md)                      |
 | Αποθηκευμένες καταγραφές δικτύου       | Αιτήματα, αποκρίσεις, διαθέσιμα δεδομένα φορτίου και θέσεις στην πηγή                                                       | HAR ή SAZ του Fiddler Everywhere· mitmdump σε Linux για την εγγενή μορφή mitmproxy· [οδηγός καταγραφών](../web-network-captures.md) |
 | Assemblies .NET                        | Μεταδεδομένα, εντολές CIL, δηλωμένες εξαρτήσεις από κώδικα μηχανής και συγκρίσεις builds                                    | Καμία πρόσθετη απαίτηση (μόνο στατική ανάλυση)· [οδηγός διαχειριζόμενου κώδικα](../managed-code-analysis.md)                        |
 | APK Android                            | Δηλώσεις manifest, κλάσεις, απομεταγλωττισμένες μέθοδοι και αναφορές                                                        | JADX χωρίς γραφικό περιβάλλον και πλήρες JDK σε Linux/macOS/Windows x64· [οδηγός Android](../android-analysis.md)                   |
@@ -281,7 +285,7 @@ npx rea-agents@latest setup
 
 ## Ιστορικό αστεριών
 
-🎉 **180.000 αστέρια στο GitHub — σας ευχαριστούμε!**
+🎉 **200.000 αστέρια στο GitHub — σας ευχαριστούμε!**
 
 Ευχαριστούμε όλους όσοι χρησιμοποιούν το REA, αναφέρουν σφάλματα, ζητούν νέες λειτουργίες, δοκιμάζουν builds και συνεισφέρουν διορθώσεις.
 

docs/readme/README_es.md

@@ -24,10 +24,14 @@
 
 <code>npx rea-agents setup</code>
 
+</div>
+
 > [!IMPORTANT]
 > Fuentes oficiales de REA: [morluto/rea](https://github.com/morluto/rea), [rea.tools](https://rea.tools/), [rea-agents](https://www.npmjs.com/package/rea-agents) (npm).
 > Usa los enlaces de instalación y de versiones publicados en estas fuentes oficiales. Un nombre de repositorio parecido o un README copiado no demuestra que una descarga sea oficial.
 
+<div align="center">
+
 <br />
 
 <img src="../assets/rea-hopper-analysis.png" alt="REA inicia su puente de análisis dentro de Hopper mientras inspecciona un binario nativo" width="1200" />
@@ -137,13 +141,13 @@ REA requiere Node.js 22.x (>=22.19), 24.x (>=24.11) o 26+, además de npm. Las h
 
 | Objetivo                    | Qué devuelve REA                                                                                                               | Requisitos y guía                                                                                                                      |
 | --------------------------- | ------------------------------------------------------------------------------------------------------------------------------ | -------------------------------------------------------------------------------------------------------------------------------------- |
-| Binarios nativos            | Pseudocódigo, ensamblador, cadenas, símbolos, llamadas y referencias                                                           | Hopper, Ghidra o IDA; [análisis nativo](https://rea.tools/es/guides/native/)                                                           |
+| Binarios nativos            | Pseudocódigo, ensamblador, cadenas, símbolos, llamadas y referencias                                                           | Hopper, Ghidra o IDA; [análisis nativo](../native-investigation.md)                                                                    |
 | Estructura ELF sin ejecutar | Secciones, segmentos, símbolos/reubicaciones originales y posibles medidas de mitigación detectadas mediante análisis estático | pwntools proporcionado por quien llama, en Linux x64; [diagnóstico de binarios](../binary-diagnostics.md)                              |
 | Bytecode EVM                | Selectores de despacho, desplazamientos en bytes, argumentos inferidos y mutabilidad                                           | Entrada local con bytes sin procesar o representación hexadecimal, en Linux x64; [guía de EVM sin ejecutar](../evm-bytecode.md)        |
 | Rust binaries               | Embedded cargo-auditable dependency list                                                                                       | [Rust binaries](../rust-binaries.md)                                                                                                   |
 | Fallos de Linux registrados | Registros note sin procesar, registros/señales de cada hilo registrado y posibles correspondencias de memoria opcionales       | pwntools proporcionado por quien llama, en Linux x64; GDB/pwndbg opcionales; [fallos registrados](../recorded-crashes.md)              |
-| JavaScript / Electron       | Módulos, importaciones, mapas de código fuente, rutas, IPC y relaciones con complementos nativos                               | Node.js y npm; [análisis de aplicaciones](https://rea.tools/es/guides/javascript/)                                                     |
-| Sitios web                  | Estructura de la página, scripts, observaciones de red y capturas de pantalla solicitadas                                      | Un navegador de la familia Chrome; [análisis del navegador](https://rea.tools/es/guides/browser/)                                      |
+| JavaScript / Electron       | Módulos, importaciones, mapas de código fuente, rutas, IPC y relaciones con complementos nativos                               | Node.js y npm; [análisis de aplicaciones](../javascript-application-workflows.md)                                                      |
+| Sitios web                  | Estructura de la página, scripts, observaciones de red y capturas de pantalla solicitadas                                      | Un navegador de la familia Chrome; [análisis del navegador](../browser-observation.md)                                                 |
 | Capturas de red guardadas   | Solicitudes, respuestas, contenido accesible de las cargas útiles y ubicaciones de origen                                      | HAR; mitmdump en Linux para capturas en formato nativo de mitmproxy; [guía de capturas](../web-network-captures.md)                    |
 | Capturas de paquetes        | Endpoints, DNS, TLS SNI, distribución de protocolos y solicitudes HTTP                                                         | tshark y capinfos suministrados por el autor de la llamada; [guía pcap](../pcap-analysis.md)                                           |
 | Ensamblados .NET            | Metadatos, instrucciones CIL, dependencias nativas declaradas y comparaciones de compilaciones                                 | Inspección estática; [guía de código administrado](../managed-code-analysis.md)                                                        |
@@ -268,7 +272,7 @@ Informa de vulnerabilidades siguiendo [SECURITY.md](../../SECURITY.md).
 
 ## Historial de estrellas
 
-🎉 **170.000 estrellas en GitHub: ¡gracias!**
+🎉 **200.000 estrellas en GitHub: ¡gracias!**
 
 Gracias a quienes usan REA, informan de errores, solicitan funciones, prueban compilaciones y contribuyen con correcciones.
 

docs/readme/README_fa.md

@@ -24,10 +24,14 @@
 
 <code>npx rea-agents setup</code>
 
+</div>
+
 > [!IMPORTANT]
 > منابع رسمی REA: [morluto/rea](https://github.com/morluto/rea), [rea.tools](https://rea.tools/), [rea-agents](https://www.npmjs.com/package/rea-agents) (npm).
 > از پیوندهای نصب و انتشار در این منابع رسمی استفاده کنید. نام مشابه مخزن یا README کپی‌شده ثابت نمی‌کند که فایل دانلودی رسمی است.
 
+<div align="center" dir="rtl">
+
 <br />
 
 <img src="../assets/rea-hopper-analysis.png" alt="اجرای پل تحلیل REA در Hopper هنگام بررسی یک فایل باینری بومی" width="1200" />
@@ -129,13 +133,13 @@ REA به Node.js 22.x (>=22.19)، 24.x (>=24.11) یا 26+، به‌همراه np
 
 | هدف                    | خروجی REA                                                                           | پیش‌نیازها و راهنما                                                                                                                |
 | ---------------------- | ----------------------------------------------------------------------------------- | --------------------------------------------------------------------------------------------------------------------------------- |
-| باینری‌های بومی         | شبه‌کد، اسمبلی، رشته‌ها، نمادها، فراخوانی‌ها و ارجاعات                                 | Hopper، Ghidra یا IDA؛ [تحلیل بومی](https://rea.tools/fa/guides/native/)                                                          |
+| باینری‌های بومی         | شبه‌کد، اسمبلی، رشته‌ها، نمادها، فراخوانی‌ها و ارجاعات                                 | Hopper، Ghidra یا IDA؛ [تحلیل بومی](../native-investigation.md)                                                                   |
 | ساختار ELF آفلاین       | بخش‌ها، سگمنت‌ها، نمادها و relocationهای اصلی و گزینه‌های احتمالی کاهش آسیب‌پذیری ایستا | pwntools تأمین‌شده توسط فراخواننده روی Linux x64؛ [تشخیص باینری](../binary-diagnostics.md)                                         |
 | بایت‌کد EVM             | selectorهای dispatch، offsetهای بایتی، آرگومان‌های استنباط‌شده و قابلیت تغییر وضعیت   | دادهٔ خام/hex محلی روی Linux x64؛ [راهنمای EVM آفلاین](../evm-bytecode.md)                                                          |
 | Rust binaries          | Embedded cargo-auditable dependency list                                            | [Rust binaries](../rust-binaries.md)                                                                                              |
 | کرش‌های ثبت‌شدهٔ لینوکس   | یادداشت‌های خام، رجیسترها/سیگنال‌های تمام threadهای ثبت‌شده و گزینه‌های احتمالی نگاشت   | pwntools تأمین‌شده توسط فراخواننده روی Linux x64؛ GDB/pwndbg اختیاری؛ [کرش‌های ثبت‌شده](../recorded-crashes.md)                      |
-| JavaScript / Electron  | ماژول‌ها، importها، source mapها، مسیرها، IPC و ارتباط افزونه‌های بومی                | Node.js و npm؛ [تحلیل برنامه](https://rea.tools/fa/guides/javascript/)                                                            |
-| وب‌سایت‌ها               | ساختار صفحه، اسکریپت‌ها، مشاهدات شبکه و اسکرین‌شات‌های درخواستی                        | مرورگر مبتنی بر Chrome؛ [تحلیل مرورگر](https://rea.tools/fa/guides/browser/)                                                      |
+| JavaScript / Electron  | ماژول‌ها، importها، source mapها، مسیرها، IPC و ارتباط افزونه‌های بومی                | Node.js و npm؛ [تحلیل برنامه](../javascript-application-workflows.md)                                                             |
+| وب‌سایت‌ها               | ساختار صفحه، اسکریپت‌ها، مشاهدات شبکه و اسکرین‌شات‌های درخواستی                        | مرورگر مبتنی بر Chrome؛ [تحلیل مرورگر](../browser-observation.md)                                                                 |
 | داده‌های ضبط‌شدهٔ شبکه    | درخواست‌ها، پاسخ‌ها، payloadهای آشکارشده و مکان آن‌ها در منبع                          | HAR؛ ابزار mitmdump در لینوکس برای ضبط‌های بومی mitmproxy؛ [راهنمای ضبط شبکه](../web-network-captures.md)                          |
 | اسمبلی‌های .NET         | فراداده، دستورالعمل‌های CIL، وابستگی‌های بومی اعلام‌شده و مقایسهٔ buildها                | بررسی ایستا؛ [راهنمای کد مدیریت‌شده](../managed-code-analysis.md)                                                                  |
 | فایل‌های APK اندروید    | تعاریف Manifest، کلاس‌ها، متدهای دیکامپایل‌شده و ارجاعات                               | JADX بدون رابط گرافیکی و JDK کامل در Linux/macOS/Windows x64؛ [راهنمای اندروید](../android-analysis.md)                           |
@@ -253,7 +257,7 @@ npx rea-agents@latest setup
 
 ## تاریخچهٔ ستاره‌ها
 
-🎉 **۱۷۰٬۰۰۰ ستارهٔ GitHub — سپاسگزاریم!**
+🎉 **۲۰۰٬۰۰۰ ستارهٔ GitHub — سپاسگزاریم!**
 
 از همهٔ کسانی که از REA استفاده می‌کنند، خطاها را گزارش می‌دهند، قابلیت‌های جدید پیشنهاد می‌کنند، buildها را آزمایش می‌کنند و در بهبود پروژه مشارکت دارند سپاسگزاریم.
 

docs/readme/README_fr.md

@@ -24,10 +24,14 @@
 
 <code>npx rea-agents setup</code>
 
+</div>
+
 > [!IMPORTANT]
 > Sources officielles de REA : [morluto/rea](https://github.com/morluto/rea), [rea.tools](https://rea.tools/), [rea-agents](https://www.npmjs.com/package/rea-agents) (npm).
 > Utilisez les liens d’installation et de publication de ces sources officielles. Un nom de dépôt similaire ou un README copié ne prouve pas qu’un téléchargement est officiel.
 
+<div align="center">
+
 <br />
 
 <img src="../assets/rea-hopper-analysis.png" alt="REA lance son pont d'analyse dans Hopper pendant l'inspection d'un binaire natif" width="1200" />
@@ -140,14 +144,14 @@ REA nécessite Node.js 22.x (>=22.19), 24.x (>=24.11) ou 26+, ainsi que npm. Les
 
 | Cible                        | Ce que REA renvoie                                                                                          | Prérequis et guide                                                                                                                |
 | ---------------------------- | ----------------------------------------------------------------------------------------------------------- | --------------------------------------------------------------------------------------------------------------------------------- |
-| Binaires natifs              | Pseudo-code, assembleur, chaînes, symboles, appels et références                                            | Hopper, Ghidra ou IDA ; [analyse native](https://rea.tools/fr/guides/native/)                                                     |
+| Binaires natifs              | Pseudo-code, assembleur, chaînes, symboles, appels et références                                            | Hopper, Ghidra ou IDA ; [analyse native](../native-investigation.md)                                                              |
 | Structure ELF hors ligne     | Sections, segments, symboles et relocations d'origine, et protections statiques candidates                  | pwntools fourni par l'utilisateur sous Linux x64 ; [diagnostics binaires](../binary-diagnostics.md)                               |
 | Artefact WASM                | Validation, sections, formes WAT exactes d'import/export et WAT décodé                                      | WABT 1.0.42 fourni par l'utilisateur ; `inspect_wasm_artifact`                                                                    |
 | Bytecode EVM                 | Sélecteurs de dispatch, offsets en octets, arguments inférés et mutabilité                                  | Fichier local brut ou hexadécimal sous Linux x64 ; [guide EVM hors ligne](../evm-bytecode.md)                                     |
 | Rust binaries                | Embedded cargo-auditable dependency list                                                                    | [Rust binaries](../rust-binaries.md)                                                                                              |
 | Crashs Linux enregistrés     | Notes brutes, registres et signaux de chaque thread enregistré, et correspondances de mappings facultatives | pwntools fourni par l'utilisateur sous Linux x64 ; GDB/pwndbg en option ; [crashs enregistrés](../recorded-crashes.md)            |
-| JavaScript / Electron        | Modules, imports, source maps, routes, IPC et relations avec les modules natifs                             | Node.js et npm ; [analyse d'applications](https://rea.tools/fr/guides/javascript/)                                                |
-| Sites web                    | Structure des pages, scripts, observations réseau et captures d'écran demandées                             | Un navigateur de la famille Chrome ; [analyse du navigateur](https://rea.tools/fr/guides/browser/)                                |
+| JavaScript / Electron        | Modules, imports, source maps, routes, IPC et relations avec les modules natifs                             | Node.js et npm ; [analyse d'applications](../javascript-application-workflows.md)                                                 |
+| Sites web                    | Structure des pages, scripts, observations réseau et captures d'écran demandées                             | Un navigateur de la famille Chrome ; [analyse du navigateur](../browser-observation.md)                                           |
 | Captures réseau enregistrées | Requêtes, réponses, payloads exposés et emplacements dans le code source                                    | HAR ; mitmdump sous Linux pour les captures mitmproxy natives ; [guide des captures](../web-network-captures.md)                  |
 | Captures de paquets          | Points de terminaison, DNS, TLS SNI, distribution des protocoles et requêtes HTTP                           | tshark et capinfos fournis par l'appelant ; [guide pcap](../pcap-analysis.md)                                                     |
 | Assemblys .NET               | Métadonnées, instructions CIL, dépendances natives déclarées et comparaisons de builds                      | Inspection statique ; [guide du code managé](../managed-code-analysis.md)                                                         |
@@ -272,7 +276,7 @@ Signalez les vulnérabilités via [SECURITY.md](../../SECURITY.md).
 
 ## Historique des étoiles
 
-🎉 **170 000 étoiles GitHub — merci !**
+🎉 **200 000 étoiles GitHub — merci !**
 
 Merci à toutes les personnes qui utilisent REA, signalent des bugs, proposent des fonctionnalités, testent les builds et contribuent des correctifs.
 

docs/readme/README_id.md

@@ -24,10 +24,14 @@
 
 <code>npx rea-agents setup</code>
 
+</div>
+
 > [!IMPORTANT]
 > Sumber resmi REA: [morluto/rea](https://github.com/morluto/rea), [rea.tools](https://rea.tools/), [rea-agents](https://www.npmjs.com/package/rea-agents) (npm).
 > Gunakan tautan instalasi dan rilis dari sumber resmi ini. Nama repositori yang mirip atau README yang disalin tidak membuktikan bahwa unduhan tersebut resmi.
 
+<div align="center">
+
 <br />
 
 <img src="../assets/rea-hopper-analysis.png" alt="REA menjalankan jembatan analisisnya di dalam Hopper saat memeriksa biner native" width="1200" />
@@ -143,14 +147,14 @@ Alat tambahan dan dukungan sistem host bergantung pada target yang dianalisis:
 
 | Target                     | Hasil yang diberikan REA                                                                              | Persyaratan dan panduan                                                                                                        |
 | -------------------------- | ----------------------------------------------------------------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------ |
-| Biner native               | Pseudocode, assembly, string, simbol, pemanggilan, dan referensi                                      | Hopper, Ghidra, atau IDA; [analisis native](https://rea.tools/id/guides/native/)                                               |
+| Biner native               | Pseudocode, assembly, string, simbol, pemanggilan, dan referensi                                      | Hopper, Ghidra, atau IDA; [analisis native](../native-investigation.md)                                                        |
 | Tata letak ELF offline     | Bagian, segmen, simbol/relokasi asli, dan kandidat mitigasi statis                                    | pwntools yang disediakan pemanggil pada Linux x64; [diagnostik biner](../binary-diagnostics.md)                                |
 | Artefak WASM               | Validasi, bagian, bentuk WAT import/ekspor yang tepat, dan WAT yang didekode                          | WABT 1.0.42 yang disediakan pemanggil; `inspect_wasm_artifact`                                                                 |
 | Bytecode EVM               | Selector dispatch, offset byte, argumen yang disimpulkan, dan sifat mutabilitas                       | Pembawa data raw/hex lokal; [panduan EVM offline](../evm-bytecode.md)                                                          |
 | Rust binaries              | Embedded cargo-auditable dependency list                                                              | [Rust binaries](../rust-binaries.md)                                                                                           |
 | Crash Linux yang direkam   | Catatan mentah, register/sinyal setiap thread yang direkam, dan kandidat pemetaan opsional            | pwntools yang disediakan pemanggil; GDB/pwndbg opsional; [crash yang direkam](../recorded-crashes.md)                          |
-| JavaScript / Electron      | Modul, impor, source map, rute, IPC, dan hubungan add-on native                                       | Node.js dan npm; [analisis aplikasi](https://rea.tools/id/guides/javascript/)                                                  |
-| Situs web                  | Struktur halaman, skrip, pengamatan jaringan, dan tangkapan layar yang diminta                        | Peramban berbasis Chrome; [analisis peramban](https://rea.tools/id/guides/browser/)                                            |
+| JavaScript / Electron      | Modul, impor, source map, rute, IPC, dan hubungan add-on native                                       | Node.js dan npm; [analisis aplikasi](../javascript-application-workflows.md)                                                   |
+| Situs web                  | Struktur halaman, skrip, pengamatan jaringan, dan tangkapan layar yang diminta                        | Peramban berbasis Chrome; [analisis peramban](../browser-observation.md)                                                       |
 | Rekaman jaringan tersimpan | Permintaan, respons, payload yang terekspos, dan lokasi sumber                                        | HAR; mitmdump di Linux untuk rekaman native mitmproxy; [panduan rekaman](../web-network-captures.md)                           |
 | Capturan paket             | Endpoint, DNS, TLS SNI, distribusi protokol, dan permintaan HTTP                                      | tshark dan capinfos buatan pemanggil; [panduan pcap](../pcap-analysis.md)                                                      |
 | Assembly .NET              | Metadata, instruksi CIL, dependensi native yang dideklarasikan, dan perbandingan build                | Tidak ada (hanya analisis statis); [panduan kode terkelola](../managed-code-analysis.md)                                       |
@@ -293,7 +297,7 @@ Laporkan kerentanan melalui [SECURITY.md](../../SECURITY.md).
 
 ## Riwayat Bintang
 
-🎉 **170.000 bintang GitHub, terima kasih!**
+🎉 **200.000 bintang GitHub, terima kasih!**
 
 Terima kasih kepada semua orang yang menggunakan REA, melaporkan bug, meminta fitur, menguji build, dan berkontribusi dalam perbaikan.
 

docs/readme/README_it.md

@@ -24,10 +24,14 @@
 
 <code>npx rea-agents setup</code>
 
+</div>
+
 > [!IMPORTANT]
 > Fonti ufficiali di REA: [morluto/rea](https://github.com/morluto/rea), [rea.tools](https://rea.tools/), [rea-agents](https://www.npmjs.com/package/rea-agents) (npm).
 > Segui i link di installazione e delle versioni pubblicate da queste fonti ufficiali. Un nome di repository simile o un README copiato non dimostra che un download sia ufficiale.
 
+<div align="center">
+
 <br />
 
 <img src="../assets/rea-hopper-analysis.png" alt="REA che avvia il suo bridge di analisi dentro Hopper mentre ispeziona un binario nativo" width="1200" />
@@ -140,14 +144,14 @@ REA richiede Node.js 22.x (>=22.19), 24.x (>=24.11) o 26+, oltre a npm. Strument
 
 | Obiettivo                    | Cosa restituisce REA                                                                              | Requisiti e guida                                                                                                               |
 | ---------------------------- | ------------------------------------------------------------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------- |
-| Binari nativi                | Pseudocodice, assembly, stringhe, simboli, chiamate e riferimenti                                 | Hopper, Ghidra o IDA; [analisi nativa](https://rea.tools/it/guides/native/)                                                     |
+| Binari nativi                | Pseudocodice, assembly, stringhe, simboli, chiamate e riferimenti                                 | Hopper, Ghidra o IDA; [analisi nativa](../native-investigation.md)                                                              |
 | Layout ELF offline           | Sezioni, segmenti, simboli/relocazioni originali e candidati mitigazioni statiche                 | pwntools fornito dal chiamante su Linux x64; [diagnostica binaria](../binary-diagnostics.md)                                    |
 | Artefatto WASM               | Convalida, sezioni, forme WAT di import/export esatte e WAT decodificato                          | WABT 1.0.42 fornito dal chiamante; `inspect_wasm_artifact`                                                                      |
 | Bytecode EVM                 | Selettori di dispatch, offset dei byte, argomenti inferiti e mutabilità                           | Carrier raw/hex locale; [guida EVM offline](../evm-bytecode.md)                                                                 |
 | Rust binaries                | Embedded cargo-auditable dependency list                                                          | [Rust binaries](../rust-binaries.md)                                                                                            |
 | Crash Linux registrati       | Note grezze, registri/segnai di ogni thread registrato e candidati mapping opzionali              | pwntools fornito dal chiamante; GDB/pwndbg opzionale; [crash registrati](../recorded-crashes.md)                                |
-| JavaScript / Electron        | Moduli, import, source map, route, IPC e relazioni con add-on nativi                              | Node.js e npm; [analisi delle applicazioni](https://rea.tools/it/guides/javascript/)                                            |
-| Siti web                     | Struttura della pagina, script, osservazioni di rete e screenshot richiesti                       | Un browser della famiglia Chrome; [analisi browser](https://rea.tools/it/guides/browser/)                                       |
+| JavaScript / Electron        | Moduli, import, source map, route, IPC e relazioni con add-on nativi                              | Node.js e npm; [analisi delle applicazioni](../javascript-application-workflows.md)                                             |
+| Siti web                     | Struttura della pagina, script, osservazioni di rete e screenshot richiesti                       | Un browser della famiglia Chrome; [analisi browser](../browser-observation.md)                                                  |
 | Acquisizioni di rete salvate | Richieste, risposte, payload esposti e posizioni sorgente                                         | HAR; mitmdump su Linux per acquisizioni mitmproxy native; [guida alle acquisizioni](../web-network-captures.md)                 |
 | Captured di pacchetti        | Endpoint, DNS, TLS SNI, distribuzione dei protocolli e richieste HTTP                             | tshark e capinfos forniti dal chiamante; [guida pcap](../pcap-analysis.md)                                                      |
 | Assembly .NET                | Metadati, istruzioni CIL, dipendenze native dichiarate e confronti di build                       | Nessuno (solo statico); [guida managed-code](../managed-code-analysis.md)                                                       |
@@ -272,7 +276,7 @@ Segnala vulnerabilità tramite [SECURITY.md](../../SECURITY.md).
 
 ## Cronologia delle stelle
 
-🎉 **170.000 stelle su GitHub — grazie!**
+🎉 **200.000 stelle su GitHub — grazie!**
 
 Grazie a tutti coloro che usano REA, segnalano bug, propongono funzionalità, testano le build e contribuiscono con correzioni.
 

docs/readme/README_ja.md

@@ -24,10 +24,14 @@
 
 <code>npx rea-agents setup</code>
 
+</div>
+
 > [!IMPORTANT]
 > REA の公式配布元： [morluto/rea](https://github.com/morluto/rea), [rea.tools](https://rea.tools/), [rea-agents](https://www.npmjs.com/package/rea-agents) (npm).
 > インストールとリリースのリンクは、これらの公式配布元からたどってください。似たリポジトリ名やコピーされた README だけでは、公式の配布物とは確認できません。
 
+<div align="center">
+
 <br />
 
 <img src="../assets/rea-hopper-analysis.png" alt="REA が Hopper 内で分析ブリッジを起動し、ネイティブバイナリを調べる様子" width="1200" />
@@ -137,13 +141,13 @@ REA には Node.js 22.x（>=22.19）、24.x（>=24.11）、または 26+ と npm
 
 | 対象                             | REA が返すもの                                                                              | 要件とガイド                                                                                                                                   |
 | -------------------------------- | ------------------------------------------------------------------------------------------- | ---------------------------------------------------------------------------------------------------------------------------------------------- |
-| ネイティブバイナリ               | 疑似コード、アセンブリ、文字列、シンボル、呼び出し、参照                                    | Hopper、Ghidra、または IDA；[ネイティブ分析](https://rea.tools/ja/guides/native/)                                                              |
+| ネイティブバイナリ               | 疑似コード、アセンブリ、文字列、シンボル、呼び出し、参照                                    | Hopper、Ghidra、または IDA；[ネイティブ分析](../native-investigation.md)                                                                       |
 | オフライン ELF レイアウト        | セクション、セグメント、元のシンボル／再配置情報、静的解析によるセキュリティ対策の候補      | Linux x64 で利用者が用意する pwntools；[バイナリ診断](../binary-diagnostics.md)                                                                |
 | EVM バイトコード                 | ディスパッチセレクター、バイトオフセット、推定された引数と状態変更の可否                    | Linux x64 上のローカルの生バイト／16 進数の入力ファイル；[オフライン EVM ガイド](../evm-bytecode.md)                                           |
 | Rust binaries                    | Embedded cargo-auditable dependency list                                                    | [Rust binaries](../rust-binaries.md)                                                                                                           |
 | 記録済みの Linux クラッシュ      | 生の note レコード、記録された全スレッドのレジスター／シグナル、任意のマッピング候補        | Linux x64 で利用者が用意する pwntools；GDB/pwndbg は任意；[記録済みクラッシュ](../recorded-crashes.md)                                         |
-| JavaScript / Electron            | モジュール、インポート、ソースマップ、ルート、IPC、ネイティブアドオンの関係                 | Node.js と npm；[アプリケーション分析](https://rea.tools/ja/guides/javascript/)                                                                |
-| ウェブサイト                     | ページ構造、スクリプト、ネットワークの観測結果、依頼されたスクリーンショット                | Chrome 系ブラウザー；[ブラウザー分析](https://rea.tools/ja/guides/browser/)                                                                    |
+| JavaScript / Electron            | モジュール、インポート、ソースマップ、ルート、IPC、ネイティブアドオンの関係                 | Node.js と npm；[アプリケーション分析](../javascript-application-workflows.md)                                                                 |
+| ウェブサイト                     | ページ構造、スクリプト、ネットワークの観測結果、依頼されたスクリーンショット                | Chrome 系ブラウザー；[ブラウザー分析](../browser-observation.md)                                                                               |
 | 保存済みのネットワークキャプチャ | リクエスト、レスポンス、取得可能なペイロード、ソース内の位置                                | HAR；mitmproxy ネイティブ形式のキャプチャには Linux 上の mitmdump；[キャプチャガイド](../web-network-captures.md)                              |
 | パケットキャプチャ               | エンドポイント、DNS、TLS SNI、プロトコル分布、HTTPリクエスト                                | 呼び出し側が用意した tshark と capinfos；[pcapガイド](../pcap-analysis.md)                                                                     |
 | .NET アセンブリ                  | メタデータ、CIL 命令、宣言されたネイティブ依存関係、ビルドの比較                            | 静的な検査；[マネージドコードのガイド](../managed-code-analysis.md)                                                                            |
@@ -270,7 +274,7 @@ npx rea-agents@latest setup
 
 ## スター履歴
 
-🎉 **GitHub スター 170,000 件、ありがとうございます！**
+🎉 **GitHub スター 200,000 件、ありがとうございます！**
 
 REA の利用、バグ報告、機能の要望、ビルドのテスト、修正への貢献に感謝します。
 

docs/readme/README_ko.md

@@ -24,10 +24,14 @@
 
 <code>npx rea-agents setup</code>
 
+</div>
+
 > [!IMPORTANT]
 > REA 공식 배포처: [morluto/rea](https://github.com/morluto/rea), [rea.tools](https://rea.tools/), [rea-agents](https://www.npmjs.com/package/rea-agents) (npm).
 > 이 공식 배포처에서 제공하는 설치 및 릴리스 링크를 이용하세요. 비슷한 저장소 이름이나 복사된 README만으로는 공식 배포 파일인지 확인할 수 없습니다.
 
+<div align="center">
+
 <br />
 
 <img src="../assets/rea-hopper-analysis.png" alt="REA가 Hopper 안에서 분석 브리지를 실행해 네이티브 바이너리를 검사하는 모습" width="1200" />
@@ -139,7 +143,7 @@ REA에는 Node.js 22.x(>=22.19), 24.x(>=24.11) 또는 26+와 npm이 필요합니
 
 | 대상                  | REA가 반환하는 내용                                                           | 요구 사항 및 가이드                                                                                                               |
 | --------------------- | ----------------------------------------------------------------------------- | --------------------------------------------------------------------------------------------------------------------------------- |
-| 네이티브 바이너리     | 의사 코드, 어셈블리, 문자열, 심볼, 호출, 참조                                 | Hopper, Ghidra 또는 IDA; [네이티브 분석](https://rea.tools/ko/guides/native/)                                                     |
+| 네이티브 바이너리     | 의사 코드, 어셈블리, 문자열, 심볼, 호출, 참조                                 | Hopper, Ghidra 또는 IDA; [네이티브 분석](../native-investigation.md)                                                              |
 | 오프라인 ELF 레이아웃 | 섹션, 세그먼트, 원본 심볼/재배치 정보, 정적 분석으로 얻은 보안 완화 기법 후보 | Linux x64에서 호출자가 제공하는 pwntools; [바이너리 진단](../binary-diagnostics.md)                                               |
 | Go 바이너리           | 내장된 컴파일러 버전, 모듈, `replace` 지시어, 빌드 설정                       | REA 내장 ELF/PE/thin Mach-O 정적 검사; Go 설치 불필요                                                                             |
 | Rust 바이너리         | cargo-auditable이 내장한 크레이트 이름, 버전, 소스, 의존성 관계               | REA 내장 ELF/PE/thin Mach-O 정적 검사; [Rust 바이너리](../rust-binaries.md)                                                       |
@@ -147,8 +151,8 @@ REA에는 Node.js 22.x(>=22.19), 24.x(>=24.11) 또는 26+와 npm이 필요합니
 | EVM 바이트코드        | 디스패치 선택자, 바이트 오프셋, 추론한 인자와 상태 변경 가능 여부             | Linux x64의 로컬 원시 바이트/16진수 입력 파일; [오프라인 EVM 가이드](../evm-bytecode.md)                                          |
 | SQLite 데이터베이스   | 테이블, 열, 인덱스, 뷰, 트리거, 선택한 일반 테이블의 행                       | 로컬 데이터베이스/WAL 스냅샷; Node.js 24.15 이상의 24.x 또는 26 이상(네이티브 SQLite 한도 적용)                                   |
 | 기록된 Linux 크래시   | 원시 note 레코드, 기록된 모든 스레드의 레지스터/시그널, 선택적 매핑 후보      | Linux x64에서 호출자가 제공하는 pwntools; GDB/pwndbg는 선택 사항; [기록된 크래시](../recorded-crashes.md)                         |
-| JavaScript / Electron | 모듈, 임포트, 소스 맵, 라우트, IPC, 네이티브 애드온 관계                      | Node.js와 npm; [애플리케이션 분석](https://rea.tools/ko/guides/javascript/)                                                       |
-| 웹사이트              | 페이지 구조, 스크립트, 네트워크 관찰 결과, 요청한 스크린샷                    | Chrome 계열 브라우저; [브라우저 분석](https://rea.tools/ko/guides/browser/)                                                       |
+| JavaScript / Electron | 모듈, 임포트, 소스 맵, 라우트, IPC, 네이티브 애드온 관계                      | Node.js와 npm; [애플리케이션 분석](../javascript-application-workflows.md)                                                        |
+| 웹사이트              | 페이지 구조, 스크립트, 네트워크 관찰 결과, 요청한 스크린샷                    | Chrome 계열 브라우저; [브라우저 분석](../browser-observation.md)                                                                  |
 | 저장된 네트워크 캡처  | 요청, 응답, 접근 가능한 페이로드, 소스 위치                                   | HAR 또는 Fiddler Everywhere SAZ; mitmproxy 네이티브 캡처에는 Linux의 mitmdump; [캡처 가이드](../web-network-captures.md)          |
 | .NET 어셈블리         | 메타데이터, CIL 명령, 선언된 네이티브 의존성, 빌드 비교                       | 별도 도구 불필요(정적 검사만); [관리 코드 가이드](../managed-code-analysis.md)                                                    |
 | Android APK           | 매니페스트 선언, 클래스, 디컴파일된 메서드, 참조                              | Linux/macOS/Windows x64의 헤드리스 JADX와 전체 JDK; [Android 가이드](../android-analysis.md)                                      |
@@ -277,7 +281,7 @@ npx rea-agents@latest setup
 
 ## 스타 기록
 
-🎉 **GitHub 스타 170,000개, 감사합니다!**
+🎉 **GitHub 스타 200,000개, 감사합니다!**
 
 REA를 사용하고, 버그를 보고하고, 기능을 요청하고, 빌드를 테스트하고, 수정에 기여해 주신 모든 분께 감사드립니다.
 

docs/readme/README_pl.md

@@ -24,10 +24,14 @@
 
 <code>npx rea-agents setup</code>
 
+</div>
+
 > [!IMPORTANT]
 > Oficjalne źródła REA: [morluto/rea](https://github.com/morluto/rea), [rea.tools](https://rea.tools/), [rea-agents](https://www.npmjs.com/package/rea-agents) (npm).
 > Korzystaj z odnośników do instalacji i wydań w tych oficjalnych źródłach. Podobna nazwa repozytorium lub skopiowany README nie potwierdzają, że pobierany plik jest oficjalny.
 
+<div align="center">
+
 <br />
 
 <img src="../assets/rea-hopper-analysis.png" alt="REA uruchamia most analityczny w Hopperze podczas analizy natywnego pliku binarnego" width="1200" />
@@ -137,13 +141,13 @@ REA wymaga Node.js 22.x (>=22.19), 24.x (>=24.11) lub 26+ oraz npm. Dodatkowe na
 
 | Cel                                     | Co zwraca REA                                                                                                         | Wymagania i przewodnik                                                                                                               |
 | --------------------------------------- | --------------------------------------------------------------------------------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------ |
-| Natywne pliki binarne                   | Pseudokod, kod asemblera, ciągi znaków, symbole, wywołania i odwołania                                                | Hopper, Ghidra lub IDA; [analiza kodu natywnego](https://rea.tools/pl/guides/native/)                                                |
+| Natywne pliki binarne                   | Pseudokod, kod asemblera, ciągi znaków, symbole, wywołania i odwołania                                                | Hopper, Ghidra lub IDA; [analiza kodu natywnego](../native-investigation.md)                                                         |
 | Układ pliku ELF w trybie offline        | Sekcje, segmenty, oryginalne symbole/relokacje i potencjalne mechanizmy zabezpieczeń wskazane przez analizę statyczną | pwntools dostarczone przez użytkownika w systemie Linux x64; [diagnostyka plików binarnych](../binary-diagnostics.md)                |
 | Kod bajtowy EVM                         | Selektory wywołań, przesunięcia bajtowe, wywnioskowane argumenty i mutowalność                                        | Lokalny plik z surowymi bajtami lub zapisem szesnastkowym w systemie Linux x64; [przewodnik EVM offline](../evm-bytecode.md)         |
 | Rust binaries                           | Embedded cargo-auditable dependency list                                                                              | [Rust binaries](../rust-binaries.md)                                                                                                 |
 | Zarejestrowane awarie systemu Linux     | Surowe rekordy note, rejestry/sygnały każdego zarejestrowanego wątku i opcjonalni kandydaci na mapowania              | pwntools dostarczone przez użytkownika w systemie Linux x64; opcjonalnie GDB/pwndbg; [zarejestrowane awarie](../recorded-crashes.md) |
-| JavaScript / Electron                   | Moduły, importy, mapy źródeł, trasy, IPC i powiązania z natywnymi dodatkami                                           | Node.js i npm; [analiza aplikacji](https://rea.tools/pl/guides/javascript/)                                                          |
-| Strony internetowe                      | Struktura strony, skrypty, obserwacje sieciowe i zamówione zrzuty ekranu                                              | Przeglądarka z rodziny Chrome; [analiza w przeglądarce](https://rea.tools/pl/guides/browser/)                                        |
+| JavaScript / Electron                   | Moduły, importy, mapy źródeł, trasy, IPC i powiązania z natywnymi dodatkami                                           | Node.js i npm; [analiza aplikacji](../javascript-application-workflows.md)                                                           |
+| Strony internetowe                      | Struktura strony, skrypty, obserwacje sieciowe i zamówione zrzuty ekranu                                              | Przeglądarka z rodziny Chrome; [analiza w przeglądarce](../browser-observation.md)                                                   |
 | Zapisane przechwycenia ruchu sieciowego | Żądania, odpowiedzi, dostępne dane przesyłane i lokalizacje źródłowe                                                  | HAR; mitmdump w systemie Linux dla natywnych przechwyceń mitmproxy; [przewodnik przechwytywania](../web-network-captures.md)         |
 | Przechwytywanie pakietów                | Punkty końcowe, DNS, TLS SNI, dystrybucja protokołów i żądania HTTP                                                   | Dostarczone przez wywołującego tshark i capinfos; [przewodnik pcap](../pcap-analysis.md)                                             |
 | Zestawy .NET                            | Metadane, instrukcje CIL, zadeklarowane zależności natywne i porównania kompilacji                                    | Analiza statyczna; [przewodnik kodu zarządzanego](../managed-code-analysis.md)                                                       |
@@ -268,7 +272,7 @@ Zgłaszaj podatności zgodnie z [SECURITY.md](../../SECURITY.md).
 
 ## Historia gwiazdek
 
-🎉 **170 000 gwiazdek na GitHubie — dziękujemy!**
+🎉 **200 000 gwiazdek na GitHubie — dziękujemy!**
 
 Dziękujemy wszystkim, którzy używają REA, zgłaszają błędy, proponują nowe funkcje, testują kompilacje i przesyłają poprawki.
 

docs/readme/README_pt-BR.md

@@ -24,10 +24,14 @@
 
 <code>npx rea-agents setup</code>
 
+</div>
+
 > [!IMPORTANT]
 > Fontes oficiais do REA: [morluto/rea](https://github.com/morluto/rea), [rea.tools](https://rea.tools/), [rea-agents](https://www.npmjs.com/package/rea-agents) (npm).
 > Use os links de instalação e de versões dessas fontes oficiais. Um nome de repositório parecido ou um README copiado não comprova que um download seja oficial.
 
+<div align="center">
+
 <br />
 
 <img src="../assets/rea-hopper-analysis.png" alt="REA inicia sua ponte de análise dentro do Hopper enquanto inspeciona um binário nativo" width="1200" />
@@ -137,13 +141,13 @@ O REA requer Node.js 22.x (>=22.19), 24.x (>=24.11) ou 26+, além do npm. As fer
 
 | Alvo                        | O que o REA retorna                                                                                                     | Requisitos e guia                                                                                                                 |
 | --------------------------- | ----------------------------------------------------------------------------------------------------------------------- | --------------------------------------------------------------------------------------------------------------------------------- |
-| Binários nativos            | Pseudocódigo, assembly, strings, símbolos, chamadas e referências                                                       | Hopper, Ghidra ou IDA; [análise nativa](https://rea.tools/pt-BR/guides/native/)                                                   |
+| Binários nativos            | Pseudocódigo, assembly, strings, símbolos, chamadas e referências                                                       | Hopper, Ghidra ou IDA; [análise nativa](../native-investigation.md)                                                               |
 | Estrutura ELF sem execução  | Seções, segmentos, símbolos/relocações originais e possíveis mecanismos de mitigação identificados por análise estática | pwntools fornecido pelo chamador no Linux x64; [diagnóstico de binários](../binary-diagnostics.md)                                |
 | Bytecode EVM                | Seletores de despacho, offsets de bytes, argumentos inferidos e mutabilidade                                            | Entrada local com bytes brutos ou representação hexadecimal no Linux x64; [guia de EVM sem execução](../evm-bytecode.md)          |
 | Rust binaries               | Embedded cargo-auditable dependency list                                                                                | [Rust binaries](../rust-binaries.md)                                                                                              |
 | Falhas do Linux registradas | Registros note brutos, registradores/sinais de cada thread registrada e candidatos opcionais a mapeamentos              | pwntools fornecido pelo chamador no Linux x64; GDB/pwndbg opcionais; [falhas registradas](../recorded-crashes.md)                 |
-| JavaScript / Electron       | Módulos, importações, source maps, rotas, IPC e relações com complementos nativos                                       | Node.js e npm; [análise de aplicativos](https://rea.tools/pt-BR/guides/javascript/)                                               |
-| Sites                       | Estrutura da página, scripts, observações de rede e capturas de tela solicitadas                                        | Um navegador da família Chrome; [análise do navegador](https://rea.tools/pt-BR/guides/browser/)                                   |
+| JavaScript / Electron       | Módulos, importações, source maps, rotas, IPC e relações com complementos nativos                                       | Node.js e npm; [análise de aplicativos](../javascript-application-workflows.md)                                                   |
+| Sites                       | Estrutura da página, scripts, observações de rede e capturas de tela solicitadas                                        | Um navegador da família Chrome; [análise do navegador](../browser-observation.md)                                                 |
 | Capturas de rede salvas     | Requisições, respostas, payloads acessíveis e localizações de origem                                                    | HAR; mitmdump no Linux para capturas no formato nativo do mitmproxy; [guia de capturas](../web-network-captures.md)               |
 | Capturas de pacotes         | Endpoints, DNS, TLS SNI, distribuição de protocolos e requisições HTTP                                                  | tshark e capinfos fornecidos pelo chamador; [guia pcap](../pcap-analysis.md)                                                      |
 | Assemblies .NET             | Metadados, instruções CIL, dependências nativas declaradas e comparações de builds                                      | Inspeção estática; [guia de código gerenciado](../managed-code-analysis.md)                                                       |
@@ -268,7 +272,7 @@ Relate vulnerabilidades conforme [SECURITY.md](../../SECURITY.md).
 
 ## Histórico de estrelas
 
-🎉 **170.000 estrelas no GitHub — muito obrigado!**
+🎉 **200.000 estrelas no GitHub — muito obrigado!**
 
 Obrigado a todos que usam o REA, relatam bugs, sugerem funcionalidades, testam builds e contribuem com correções.
 

docs/readme/README_ru.md

@@ -24,10 +24,14 @@
 
 <code>npx rea-agents setup</code>
 
+</div>
+
 > [!IMPORTANT]
 > Официальные источники REA: [morluto/rea](https://github.com/morluto/rea), [rea.tools](https://rea.tools/), [rea-agents](https://www.npmjs.com/package/rea-agents) (npm).
 > Используйте ссылки на установку и выпуски из этих официальных источников. Похожее название репозитория или скопированный README не подтверждают, что скачиваемый файл является официальным.
 
+<div align="center">
+
 <br />
 
 <img src="../assets/rea-hopper-analysis.png" alt="REA запускает мост анализа внутри Hopper при исследовании нативного бинарного файла" width="1200" />
@@ -137,13 +141,13 @@ REA требует Node.js 22.x (>=22.19), 24.x (>=24.11) или 26+, а так
 
 | Цель                          | Что возвращает REA                                                                                                         | Требования и руководство                                                                                                                 |
 | ----------------------------- | -------------------------------------------------------------------------------------------------------------------------- | ---------------------------------------------------------------------------------------------------------------------------------------- |
-| Нативные бинарные файлы       | Псевдокод, ассемблер, строки, символы, вызовы и ссылки                                                                     | Hopper, Ghidra или IDA; [нативный анализ](https://rea.tools/ru/guides/native/)                                                           |
+| Нативные бинарные файлы       | Псевдокод, ассемблер, строки, символы, вызовы и ссылки                                                                     | Hopper, Ghidra или IDA; [нативный анализ](../native-investigation.md)                                                                    |
 | Структура ELF без запуска     | Секции, сегменты, исходные символы/релокации и возможные механизмы защиты по данным статического анализа                   | pwntools, предоставленный вызывающей стороной, в Linux x64; [диагностика бинарных файлов](../binary-diagnostics.md)                      |
 | Байт-код EVM                  | Селекторы диспетчеризации, смещения байтов, предполагаемые аргументы и изменяемость состояния                              | Локальные необработанные байты или шестнадцатеричное представление в Linux x64; [руководство по EVM без запуска](../evm-bytecode.md)     |
 | Rust binaries                 | Embedded cargo-auditable dependency list                                                                                   | [Rust binaries](../rust-binaries.md)                                                                                                     |
 | Записанные сбои Linux         | Необработанные записи note, регистры/сигналы каждого записанного потока и необязательные кандидаты сопоставления с памятью | pwntools, предоставленный вызывающей стороной, в Linux x64; необязательные GDB/pwndbg; [записанные сбои](../recorded-crashes.md)         |
-| JavaScript / Electron         | Модули, импорты, карты исходного кода, маршруты, IPC и связи с нативными дополнениями                                      | Node.js и npm; [анализ приложений](https://rea.tools/ru/guides/javascript/)                                                              |
-| Сайты                         | Структура страницы, скрипты, наблюдения за сетью и запрошенные снимки экрана                                               | Браузер семейства Chrome; [анализ браузера](https://rea.tools/ru/guides/browser/)                                                        |
+| JavaScript / Electron         | Модули, импорты, карты исходного кода, маршруты, IPC и связи с нативными дополнениями                                      | Node.js и npm; [анализ приложений](../javascript-application-workflows.md)                                                               |
+| Сайты                         | Структура страницы, скрипты, наблюдения за сетью и запрошенные снимки экрана                                               | Браузер семейства Chrome; [анализ браузера](../browser-observation.md)                                                                   |
 | Сохранённые сетевые захваты   | Запросы, ответы, доступные полезные данные и позиции в источнике                                                           | HAR; mitmdump в Linux для захватов в собственном формате mitmproxy; [руководство по сетевым захватам](../web-network-captures.md)        |
 | Сборки .NET                   | Метаданные, инструкции CIL, объявленные нативные зависимости и сравнения сборок                                            | Статическое исследование; [руководство по управляемому коду](../managed-code-analysis.md)                                                |
 | Android APK                   | Объявления манифеста, классы, декомпилированные методы и ссылки                                                            | JADX без графического интерфейса и полный JDK в Linux/macOS/Windows x64; [руководство по Android](../android-analysis.md)                |
@@ -268,7 +272,7 @@ npx rea-agents@latest setup
 
 ## История звёзд
 
-🎉 **170 000 звёзд на GitHub — спасибо!**
+🎉 **200 000 звёзд на GitHub — спасибо!**
 
 Спасибо всем, кто использует REA, сообщает об ошибках, предлагает новые функции, тестирует сборки и помогает с исправлениями.
 

docs/readme/README_th.md

@@ -24,10 +24,14 @@
 
 <code>npx rea-agents setup</code>
 
+</div>
+
 > [!IMPORTANT]
 > แหล่งทางการของ REA: [morluto/rea](https://github.com/morluto/rea), [rea.tools](https://rea.tools/), [rea-agents](https://www.npmjs.com/package/rea-agents) (npm).
 > โปรดใช้ลิงก์ติดตั้งและรุ่นเผยแพร่จากแหล่งทางการเหล่านี้ ชื่อที่เก็บโค้ดที่คล้ายกันหรือ README ที่คัดลอกมาไม่ได้ยืนยันว่าไฟล์ดาวน์โหลดเป็นของทางการ
 
+<div align="center">
+
 <br />
 
 <img src="../assets/rea-hopper-analysis.png" alt="REA เริ่มบริดจ์การวิเคราะห์ภายใน Hopper ขณะตรวจสอบไบนารีเนทีฟ" width="1200" />
@@ -137,13 +141,13 @@ REA ต้องใช้ Node.js 22.x (>=22.19), 24.x (>=24.11) หรือ 26
 
 | เป้าหมาย                      | สิ่งที่ REA ส่งกลับ                                                                   | ข้อกำหนดและคู่มือ                                                                                                              |
 | ---------------------------- | ------------------------------------------------------------------------------- | -------------------------------------------------------------------------------------------------------------------------- |
-| ไบนารีเนทีฟ                    | โค้ดเทียม แอสเซมบลี สตริง สัญลักษณ์ การเรียก และการอ้างอิง                                | Hopper, Ghidra หรือ IDA; [การวิเคราะห์เนทีฟ](https://rea.tools/th/guides/native/)                                              |
+| ไบนารีเนทีฟ                    | โค้ดเทียม แอสเซมบลี สตริง สัญลักษณ์ การเรียก และการอ้างอิง                                | Hopper, Ghidra หรือ IDA; [การวิเคราะห์เนทีฟ](../native-investigation.md)                                                       |
 | โครงสร้าง ELF แบบออฟไลน์       | เซกชัน เซกเมนต์ สัญลักษณ์/รีโลเคชันต้นฉบับ และตัวเลือกกลไกป้องกันที่พบจากการวิเคราะห์แบบสถิต      | pwntools ที่ผู้ใช้จัดเตรียมบน Linux x64; [การวินิจฉัยไบนารี](../binary-diagnostics.md)                                                |
 | ไบต์โค้ด EVM                   | ตัวเลือกฟังก์ชันสำหรับการเรียก ออฟเซ็ตไบต์ อาร์กิวเมนต์และความสามารถในการเปลี่ยนสถานะที่อนุมานได้ | ไฟล์บนเครื่องที่มีไบต์ดิบหรือข้อมูลเลขฐานสิบหกบน Linux x64; [คู่มือ EVM แบบออฟไลน์](../evm-bytecode.md)                                    |
 | Rust binaries                | Embedded cargo-auditable dependency list                                        | [Rust binaries](../rust-binaries.md)                                                                                       |
 | ข้อมูลการแครชของ Linux ที่บันทึกไว้ | ระเบียน note ดิบ รีจิสเตอร์/สัญญาณของทุกเธรดที่บันทึกไว้ และตัวเลือกการแมปเพิ่มเติม              | pwntools ที่ผู้ใช้จัดเตรียมบน Linux x64; เลือกใช้ GDB/pwndbg เพิ่มเติมได้; [การแครชที่บันทึกไว้](../recorded-crashes.md)                     |
-| JavaScript / Electron        | โมดูล การนำเข้า ซอร์สแมป เส้นทาง IPC และความสัมพันธ์กับส่วนเสริมเนทีฟ                      | Node.js และ npm; [การวิเคราะห์แอปพลิเคชัน](https://rea.tools/th/guides/javascript/)                                            |
-| เว็บไซต์                       | โครงสร้างหน้า สคริปต์ ข้อมูลเครือข่ายที่สังเกตได้ และภาพหน้าจอที่ร้องขอ                         | เบราว์เซอร์ในตระกูล Chrome; [การวิเคราะห์ผ่านเบราว์เซอร์](https://rea.tools/th/guides/browser/)                                    |
+| JavaScript / Electron        | โมดูล การนำเข้า ซอร์สแมป เส้นทาง IPC และความสัมพันธ์กับส่วนเสริมเนทีฟ                      | Node.js และ npm; [การวิเคราะห์แอปพลิเคชัน](../javascript-application-workflows.md)                                             |
+| เว็บไซต์                       | โครงสร้างหน้า สคริปต์ ข้อมูลเครือข่ายที่สังเกตได้ และภาพหน้าจอที่ร้องขอ                         | เบราว์เซอร์ในตระกูล Chrome; [การวิเคราะห์ผ่านเบราว์เซอร์](../browser-observation.md)                                               |
 | ข้อมูลเครือข่ายที่บันทึกไว้           | คำขอ คำตอบ เพย์โหลดที่ปรากฏ และตำแหน่งต้นทาง                                         | HAR; mitmdump บน Linux สำหรับข้อมูลที่บันทึกในรูปแบบเนทีฟของ mitmproxy; [คู่มือการบันทึกข้อมูล](../web-network-captures.md)                |
 | การจับแพ็กเก็ต                  | จุดเชื่อมต่อ, DNS, TLS SNI, การกระจายโปรโตคอล และคำขอ HTTP                          | tshark และ capinfos ที่ผู้เรียกจัดเตรียม; [คู่มือ pcap](../pcap-analysis.md)                                                         |
 | แอสเซมบลี .NET                | เมทาดาทา คำสั่ง CIL การพึ่งพาเนทีฟที่ประกาศไว้ และการเปรียบเทียบผลการบิลด์                  | การตรวจสอบแบบสถิต; [คู่มือโค้ดแบบจัดการ](../managed-code-analysis.md)                                                            |
@@ -268,7 +272,7 @@ npx rea-agents@latest setup
 
 ## ประวัติดาว
 
-🎉 **170,000 ดาวบน GitHub — ขอบคุณทุกคน!**
+🎉 **200,000 ดาวบน GitHub — ขอบคุณทุกคน!**
 
 ขอบคุณทุกคนที่ใช้ REA รายงานบั๊ก เสนอฟีเจอร์ ทดสอบบิลด์ และช่วยแก้ไข
 

docs/readme/README_tr.md

@@ -24,10 +24,14 @@
 
 <code>npx rea-agents setup</code>
 
+</div>
+
 > [!IMPORTANT]
 > REA’nın resmî kaynakları: [morluto/rea](https://github.com/morluto/rea), [rea.tools](https://rea.tools/), [rea-agents](https://www.npmjs.com/package/rea-agents) (npm).
 > Kurulum ve sürüm bağlantılarını bu resmî kaynaklardan takip edin. Benzer bir depo adı veya kopyalanmış bir README, indirilen dosyanın resmî olduğunu kanıtlamaz.
 
+<div align="center">
+
 <br />
 
 <img src="../assets/rea-hopper-analysis.png" alt="REA, yerel bir ikili dosyayı incelerken Hopper içinde analiz köprüsünü başlatıyor" width="1200" />
@@ -139,7 +143,7 @@ REA; Node.js 22.x (>=22.19), 24.x (>=24.11) veya 26+ ve npm gerektirir. Ek araç
 
 | Hedef                                   | REA'nın döndürdükleri                                                                                       | Gereksinimler ve rehber                                                                                                            |
 | --------------------------------------- | ----------------------------------------------------------------------------------------------------------- | ---------------------------------------------------------------------------------------------------------------------------------- |
-| Yerel makine kodu içeren ikili dosyalar | Sözde kod, assembly kodu, dizeler, semboller, çağrılar ve referanslar                                       | Hopper, Ghidra veya IDA; [yerel kod analizi](https://rea.tools/tr/guides/native/)                                                  |
+| Yerel makine kodu içeren ikili dosyalar | Sözde kod, assembly kodu, dizeler, semboller, çağrılar ve referanslar                                       | Hopper, Ghidra veya IDA; [yerel kod analizi](../native-investigation.md)                                                           |
 | Çevrimdışı ELF yapısı                   | Bölümler, segmentler, özgün semboller/yeniden konumlandırmalar ve statik analizden olası güvenlik önlemleri | Linux x64 üzerinde çağıranın sağladığı pwntools; [ikili dosya tanılama](../binary-diagnostics.md)                                  |
 | Go ikili dosyaları                      | Gömülü compiler sürümü, modüller, replacement'lar ve build ayarları                                         | Yerleşik statik ELF/PE/thin Mach-O incelemesi; Go kurulumu gerekmez                                                                |
 | Rust ikili dosyaları                    | Gömülü cargo-auditable crate adları, sürümleri, kaynakları ve bağımlılık ilişkileri                         | Yerleşik statik ELF/PE/thin Mach-O incelemesi; [Rust ikili dosyaları](../rust-binaries.md)                                         |
@@ -147,8 +151,8 @@ REA; Node.js 22.x (>=22.19), 24.x (>=24.11) veya 26+ ve npm gerektirir. Ek araç
 | EVM bayt kodu                           | Yönlendirme seçicileri, bayt ofsetleri, çıkarımla belirlenen argümanlar ve durum değiştirilebilirliği       | Linux x64 üzerinde yerel ham bayt/onaltılık girdi; [çevrimdışı EVM rehberi](../evm-bytecode.md)                                    |
 | SQLite veritabanları                    | Tablolar, sütunlar, index'ler, view'lar, trigger'lar ve seçilen sıradan tablo satırları                     | Yerel database/WAL snapshot'ı; native SQLite sınırlarıyla Node.js 24.x >=24.15 veya 26+                                            |
 | Kaydedilmiş Linux çökmeleri             | Ham note kayıtları, kaydedilen her iş parçacığının yazmaçları/sinyalleri ve isteğe bağlı eşleme adayları    | Linux x64 üzerinde çağıranın sağladığı pwntools; isteğe bağlı GDB/pwndbg; [kaydedilmiş çökmeler](../recorded-crashes.md)           |
-| JavaScript / Electron                   | Modüller, içe aktarmalar, kaynak haritaları, rotalar, IPC ve yerel eklenti ilişkileri                       | Node.js ve npm; [uygulama analizi](https://rea.tools/tr/guides/javascript/)                                                        |
-| Web siteleri                            | Sayfa yapısı, betikler, ağ gözlemleri ve istenen ekran görüntüleri                                          | Chrome ailesinden bir tarayıcı; [tarayıcı analizi](https://rea.tools/tr/guides/browser/)                                           |
+| JavaScript / Electron                   | Modüller, içe aktarmalar, kaynak haritaları, rotalar, IPC ve yerel eklenti ilişkileri                       | Node.js ve npm; [uygulama analizi](../javascript-application-workflows.md)                                                         |
+| Web siteleri                            | Sayfa yapısı, betikler, ağ gözlemleri ve istenen ekran görüntüleri                                          | Chrome ailesinden bir tarayıcı; [tarayıcı analizi](../browser-observation.md)                                                      |
 | Kaydedilmiş ağ yakalamaları             | İstekler, yanıtlar, erişilebilir yük içerikleri ve kaynak konumları                                         | HAR veya Fiddler Everywhere SAZ; Linux'ta native mitmproxy için mitmdump; [ağ yakalama rehberi](../web-network-captures.md)        |
 | .NET derlemeleri                        | Meta veriler, CIL talimatları, bildirilmiş yerel bağımlılıklar ve derleme karşılaştırmaları                 | Statik inceleme; [yönetilen kod rehberi](../managed-code-analysis.md)                                                              |
 | Android APK'leri                        | Manifest bildirimleri, sınıflar, tersine derlenmiş metotlar ve referanslar                                  | Linux/macOS/Windows x64 üzerinde arayüzsüz JADX ve tam bir JDK; [Android rehberi](../android-analysis.md)                          |
@@ -273,7 +277,7 @@ Güvenlik açıklarını [SECURITY.md](../../SECURITY.md) üzerinden bildirin.
 
 ## Yıldız geçmişi
 
-🎉 **GitHub'da 170.000 yıldız — teşekkürler!**
+🎉 **GitHub'da 200.000 yıldız — teşekkürler!**
 
 REA'yı kullanan, hata bildiren, özellik talep eden, derlemeleri test eden ve düzeltmelere katkıda bulunan herkese teşekkürler.
 

docs/readme/README_uk.md

@@ -24,10 +24,14 @@
 
 <code>npx rea-agents setup</code>
 
+</div>
+
 > [!IMPORTANT]
 > Офіційні джерела REA: [morluto/rea](https://github.com/morluto/rea), [rea.tools](https://rea.tools/), [rea-agents](https://www.npmjs.com/package/rea-agents) (npm).
 > Користуйтеся посиланнями на встановлення та випуски з цих офіційних джерел. Схожа назва репозиторію або скопійований README не підтверджують, що завантажуваний файл є офіційним.
 
+<div align="center">
+
 <br />
 
 <img src="../assets/rea-hopper-analysis.png" alt="REA запускає міст аналізу всередині Hopper під час дослідження нативного бінарного файла" width="1200" />
@@ -137,13 +141,13 @@ REA потребує Node.js 22.x (>=22.19), 24.x (>=24.11) або 26+, а та
 
 | Ціль                                 | Що повертає REA                                                                                                   | Вимоги й посібник                                                                                                                                 |
 | ------------------------------------ | ----------------------------------------------------------------------------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------- |
-| Нативні бінарні файли                | Псевдокод, асемблерний код, рядки, символи, виклики й посилання                                                   | Hopper, Ghidra або IDA; [нативний аналіз](https://rea.tools/uk/guides/native/)                                                                    |
+| Нативні бінарні файли                | Псевдокод, асемблерний код, рядки, символи, виклики й посилання                                                   | Hopper, Ghidra або IDA; [нативний аналіз](../native-investigation.md)                                                                             |
 | Структура ELF без запуску            | Секції, сегменти, початкові символи/релокації та можливі захисні механізми за даними статичного аналізу           | pwntools, наданий стороною, що викликає інструмент, у Linux x64; [діагностика бінарних файлів](../binary-diagnostics.md)                          |
 | Байт-код EVM                         | Селектори диспетчеризації, зміщення байтів, виведені припущення про аргументи та змінюваність стану               | Локальні необроблені байти або шістнадцяткове представлення у Linux x64; [посібник EVM без запуску](../evm-bytecode.md)                           |
 | Rust binaries                        | Embedded cargo-auditable dependency list                                                                          | [Rust binaries](../rust-binaries.md)                                                                                                              |
 | Записані аварійні завершення в Linux | Необроблені записи note, регістри/сигнали кожного записаного потоку й необов'язкові кандидати зіставлення пам'яті | pwntools, наданий стороною, що викликає інструмент, у Linux x64; необов'язкові GDB/pwndbg; [записані аварійні завершення](../recorded-crashes.md) |
-| JavaScript / Electron                | Модулі, імпорти, карти вихідного коду, маршрути, IPC і зв'язки з нативними доповненнями                           | Node.js і npm; [аналіз застосунків](https://rea.tools/uk/guides/javascript/)                                                                      |
-| Сайти                                | Структура сторінки, скрипти, мережеві спостереження й запитані знімки екрана                                      | Браузер сімейства Chrome; [аналіз браузера](https://rea.tools/uk/guides/browser/)                                                                 |
+| JavaScript / Electron                | Модулі, імпорти, карти вихідного коду, маршрути, IPC і зв'язки з нативними доповненнями                           | Node.js і npm; [аналіз застосунків](../javascript-application-workflows.md)                                                                       |
+| Сайти                                | Структура сторінки, скрипти, мережеві спостереження й запитані знімки екрана                                      | Браузер сімейства Chrome; [аналіз браузера](../browser-observation.md)                                                                            |
 | Збережені мережеві захоплення        | Запити, відповіді, доступні корисні дані та місця в джерелі                                                       | HAR; mitmdump у Linux для захоплень у власному форматі mitmproxy; [посібник мережевих захоплень](../web-network-captures.md)                      |
 | Захоплення пакетів                   | Кінцеві точки, DNS, TLS SNI, розподіл протоколів та HTTP-запити                                                   | Надані викликаючою стороною tshark та capinfos; [підручник pcap](../pcap-analysis.md)                                                             |
 | Збірки .NET                          | Метадані, інструкції CIL, оголошені нативні залежності й порівняння збірок                                        | Статична перевірка; [посібник керованого коду](../managed-code-analysis.md)                                                                       |
@@ -268,7 +272,7 @@ npx rea-agents@latest setup
 
 ## Історія зірок
 
-🎉 **170 000 зірок на GitHub — дякуємо!**
+🎉 **200 000 зірок на GitHub — дякуємо!**
 
 Дякуємо всім, хто використовує REA, повідомляє про помилки, пропонує нові функції, тестує збірки й допомагає з виправленнями.
 

docs/readme/README_vi.md

@@ -24,10 +24,14 @@
 
 <code>npx rea-agents setup</code>
 
+</div>
+
 > [!IMPORTANT]
 > Các nguồn chính thức của REA: [morluto/rea](https://github.com/morluto/rea), [rea.tools](https://rea.tools/), [rea-agents](https://www.npmjs.com/package/rea-agents) (npm).
 > Hãy dùng các liên kết cài đặt và bản phát hành từ những nguồn chính thức này. Tên kho mã tương tự hoặc README được sao chép không chứng minh rằng tệp tải xuống là bản chính thức.
 
+<div align="center">
+
 <br />
 
 <img src="../assets/rea-hopper-analysis.png" alt="REA khởi chạy cầu nối phân tích bên trong Hopper khi kiểm tra tệp nhị phân mã máy" width="1200" />
@@ -137,13 +141,13 @@ REA yêu cầu Node.js 22.x (>=22.19), 24.x (>=24.11) hoặc 26+, cùng với np
 
 | Mục tiêu                      | REA trả về gì                                                                                                   | Yêu cầu và hướng dẫn                                                                                                                      |
 | ----------------------------- | --------------------------------------------------------------------------------------------------------------- | ----------------------------------------------------------------------------------------------------------------------------------------- |
-| Tệp nhị phân mã máy           | Mã giả, hợp ngữ, chuỗi, ký hiệu, lời gọi và tham chiếu                                                          | Hopper, Ghidra hoặc IDA; [phân tích mã máy](https://rea.tools/vi/guides/native/)                                                          |
+| Tệp nhị phân mã máy           | Mã giả, hợp ngữ, chuỗi, ký hiệu, lời gọi và tham chiếu                                                          | Hopper, Ghidra hoặc IDA; [phân tích mã máy](../native-investigation.md)                                                                   |
 | Bố cục ELF ngoại tuyến        | Các section, segment, ký hiệu/thông tin tái định vị gốc và các biện pháp giảm thiểu có thể có từ phân tích tĩnh | pwntools do bên gọi cung cấp trên Linux x64; [chẩn đoán tệp nhị phân](../binary-diagnostics.md)                                           |
 | Bytecode EVM                  | Bộ chọn điều phối, độ lệch byte, tham số suy luận và khả năng thay đổi trạng thái                               | Đầu vào cục bộ chứa byte thô hoặc dạng thập lục phân trên Linux x64; [hướng dẫn EVM ngoại tuyến](../evm-bytecode.md)                      |
 | Rust binaries                 | Embedded cargo-auditable dependency list                                                                        | [Rust binaries](../rust-binaries.md)                                                                                                      |
 | Sự cố Linux đã ghi lại        | Bản ghi note thô, thanh ghi/tín hiệu của mọi luồng được ghi lại và các ứng viên ánh xạ tùy chọn                 | pwntools do bên gọi cung cấp trên Linux x64; GDB/pwndbg tùy chọn; [sự cố đã ghi lại](../recorded-crashes.md)                              |
-| JavaScript / Electron         | Mô-đun, các khai báo import, source map, tuyến, IPC và quan hệ với tiện ích mở rộng mã máy                      | Node.js và npm; [phân tích ứng dụng](https://rea.tools/vi/guides/javascript/)                                                             |
-| Trang web                     | Cấu trúc trang, script, quan sát mạng và ảnh chụp màn hình được yêu cầu                                         | Trình duyệt thuộc họ Chrome; [phân tích trình duyệt](https://rea.tools/vi/guides/browser/)                                                |
+| JavaScript / Electron         | Mô-đun, các khai báo import, source map, tuyến, IPC và quan hệ với tiện ích mở rộng mã máy                      | Node.js và npm; [phân tích ứng dụng](../javascript-application-workflows.md)                                                              |
+| Trang web                     | Cấu trúc trang, script, quan sát mạng và ảnh chụp màn hình được yêu cầu                                         | Trình duyệt thuộc họ Chrome; [phân tích trình duyệt](../browser-observation.md)                                                           |
 | Bản ghi lưu lượng mạng đã lưu | Yêu cầu, phản hồi, payload có thể truy cập và vị trí nguồn                                                      | HAR; mitmdump trên Linux cho bản ghi định dạng gốc của mitmproxy; [hướng dẫn bản ghi mạng](../web-network-captures.md)                    |
 | Bắt gói tin                   | Điểm cuối, DNS, TLS SNI, phân bố giao thức và yêu cầu HTTP                                                      | tshark và capinfos do nơi gọi cung cấp; [hướng dẫn pcap](../pcap-analysis.md)                                                             |
 | Assembly .NET                 | Siêu dữ liệu, lệnh CIL, các phụ thuộc mã máy được khai báo và so sánh bản dựng                                  | Kiểm tra tĩnh; [hướng dẫn mã được quản lý](../managed-code-analysis.md)                                                                   |
@@ -268,7 +272,7 @@ Báo cáo lỗ hổng theo [SECURITY.md](../../SECURITY.md).
 
 ## Lịch sử sao
 
-🎉 **170.000 sao trên GitHub — xin cảm ơn!**
+🎉 **200.000 sao trên GitHub — xin cảm ơn!**
 
 Cảm ơn mọi người đã sử dụng REA, báo lỗi, đề xuất tính năng, kiểm thử bản dựng và đóng góp bản sửa lỗi.
 

docs/readme/README_zh-TW.md

@@ -24,10 +24,14 @@
 
 <code>npx rea-agents setup</code>
 
+</div>
+
 > [!IMPORTANT]
 > REA 官方來源： [morluto/rea](https://github.com/morluto/rea), [rea.tools](https://rea.tools/), [rea-agents](https://www.npmjs.com/package/rea-agents) (npm).
 > 請透過這些官方來源提供的安裝與發布連結取得 REA。相似的儲存庫名稱或複製的 README 不能證明下載內容來自官方。
 
+<div align="center">
+
 <br />
 
 <img src="../assets/rea-hopper-analysis.png" alt="REA 在 Hopper 中啟動分析橋，檢查原生二進位檔案" width="1200" />
@@ -139,15 +143,15 @@ REA 需要 Node.js 22.x（>=22.19）、24.x（>=24.11）或 26+，以及 npm。
 
 | 目標                  | REA 返回的內容                                                  | 要求與指南                                                                                                         |
 | --------------------- | --------------------------------------------------------------- | ------------------------------------------------------------------------------------------------------------------ |
-| 原生二進位檔案        | 偽程式碼、組合語言、字串、符號、呼叫和引用                      | Hopper、Ghidra 或 IDA；[原生分析](https://rea.tools/zh-TW/guides/native/)                                          |
+| 原生二進位檔案        | 偽程式碼、組合語言、字串、符號、呼叫和引用                      | Hopper、Ghidra 或 IDA；[原生分析](../native-investigation.md)                                                      |
 | 離線 ELF 佈局         | 節、段、原始符號/重定位資訊及靜態防護機制候選項                 | Linux x64 上由呼叫方提供的 pwntools；[二進位診斷](../binary-diagnostics.md)                                        |
 | Go 二進位檔案         | 內嵌編譯器版本、模組、替換項和建置設定                          | 內建靜態 ELF/PE/thin Mach-O 檢查；無需安裝 Go                                                                      |
 | WASM 工件             | 驗證、節、精確的匯入/匯出 WAT 形式及解碼後的 WAT                | 呼叫方提供的 WABT 1.0.42；`inspect_wasm_artifact`                                                                  |
 | EVM 位元組碼          | 分派選擇器、位元組偏移、推斷的參數和狀態可變性                  | Linux x64 上的本地原始位元組/十六進位輸入載體；[離線 EVM 指南](../evm-bytecode.md)                                 |
 | Rust binaries         | Embedded cargo-auditable dependency list                        | [Rust binaries](../rust-binaries.md)                                                                               |
 | 已記錄的 Linux 崩潰   | 原始 note 記錄、每個已記錄執行緒的暫存器/訊號及可選的對映候選項 | Linux x64 上由呼叫方提供的 pwntools；可選的 GDB/pwndbg；[已記錄崩潰](../recorded-crashes.md)                       |
-| JavaScript / Electron | 模組、匯入、source map、路由、IPC 和原生附加元件關係            | Node.js 和 npm；[應用分析](https://rea.tools/zh-TW/guides/javascript/)                                             |
-| 網站                  | 頁面結構、腳本、網路觀察結果和按請求獲取的螢幕擷取畫面          | Chrome 系瀏覽器；[瀏覽器分析](https://rea.tools/zh-TW/guides/browser/)                                             |
+| JavaScript / Electron | 模組、匯入、source map、路由、IPC 和原生附加元件關係            | Node.js 和 npm；[應用分析](../javascript-application-workflows.md)                                                 |
+| 網站                  | 頁面結構、腳本、網路觀察結果和按請求獲取的螢幕擷取畫面          | Chrome 系瀏覽器；[瀏覽器分析](../browser-observation.md)                                                           |
 | 已保存的網路擷取      | 請求、回應、可訪問的酬載和來源位置                              | HAR；原生 mitmproxy 擷取需要 Linux 上的 mitmdump；[擷取指南](../web-network-captures.md)                           |
 | 封包擷取              | 端點、DNS、TLS SNI、通訊協定分佈和 HTTP 請求                    | 呼叫端提供的 tshark 和 capinfos；[pcap 指南](../pcap-analysis.md)                                                  |
 | .NET 程式集           | 中繼資料、CIL 指令、聲明的原生依賴和建置對比                    | 靜態檢查；[托管程式碼指南](../managed-code-analysis.md)                                                            |
@@ -274,7 +278,7 @@ npx rea-agents@latest setup
 
 ## Star 歷史
 
-🎉 **GitHub Star 達到 170,000 個，感謝大家！**
+🎉 **GitHub Star 達到 200,000 個，感謝大家！**
 
 感謝每一位使用 REA、報告錯誤、提出功能需求、測試建置和貢獻修復的朋友。
 

docs/readme/README_zh.md

@@ -24,10 +24,14 @@
 
 <code>npx rea-agents setup</code>
 
+</div>
+
 > [!IMPORTANT]
 > REA 官方来源： [morluto/rea](https://github.com/morluto/rea), [rea.tools](https://rea.tools/), [rea-agents](https://www.npmjs.com/package/rea-agents) (npm).
 > 请通过这些官方来源提供的安装和发布链接获取 REA。相似的仓库名称或复制的 README 不能证明下载内容来自官方。
 
+<div align="center">
+
 <br />
 
 <img src="../assets/rea-hopper-analysis.png" alt="REA 在 Hopper 中启动分析桥，检查原生二进制文件" width="1200" />
@@ -139,15 +143,15 @@ REA 需要 Node.js 22.x（>=22.19）、24.x（>=24.11）或 26+，以及 npm。
 
 | 目标                  | REA 返回的内容                                                | 要求与指南                                                                                                         |
 | --------------------- | ------------------------------------------------------------- | ------------------------------------------------------------------------------------------------------------------ |
-| 原生二进制文件        | 伪代码、汇编、字符串、符号、调用和引用                        | Hopper、Ghidra 或 IDA；[原生分析](https://rea.tools/zh-CN/guides/native/)                                          |
+| 原生二进制文件        | 伪代码、汇编、字符串、符号、调用和引用                        | Hopper、Ghidra 或 IDA；[原生分析](../native-investigation.md)                                                      |
 | 离线 ELF 布局         | 节、段、原始符号/重定位信息及静态防护机制候选项               | Linux x64 上由调用方提供的 pwntools；[二进制诊断](../binary-diagnostics.md)                                        |
 | Go 二进制文件         | 内嵌编译器版本、模块、替换项和构建设置                        | 内置静态 ELF/PE/thin Mach-O 检查；无需安装 Go                                                                      |
 | WASM 工件             | 验证、节、精确的导入/导出 WAT 形式及解码后的 WAT              | 调用方提供的 WABT 1.0.42；`inspect_wasm_artifact`                                                                  |
 | EVM 字节码            | 分派选择器、字节偏移、推断的参数和状态可变性                  | Linux x64 上的本地原始字节/十六进制输入载体；[离线 EVM 指南](../evm-bytecode.md)                                   |
 | Rust binaries         | Embedded cargo-auditable dependency list                      | [Rust binaries](../rust-binaries.md)                                                                               |
 | 已记录的 Linux 崩溃   | 原始 note 记录、每个已记录线程的寄存器/信号及可选的映射候选项 | Linux x64 上由调用方提供的 pwntools；可选的 GDB/pwndbg；[已记录崩溃](../recorded-crashes.md)                       |
-| JavaScript / Electron | 模块、导入、source map、路由、IPC 和原生扩展关系              | Node.js 和 npm；[应用分析](https://rea.tools/zh-CN/guides/javascript/)                                             |
-| 网站                  | 页面结构、脚本、网络观察结果和按请求获取的截图                | Chrome 系浏览器；[浏览器分析](https://rea.tools/zh-CN/guides/browser/)                                             |
+| JavaScript / Electron | 模块、导入、source map、路由、IPC 和原生扩展关系              | Node.js 和 npm；[应用分析](../javascript-application-workflows.md)                                                 |
+| 网站                  | 页面结构、脚本、网络观察结果和按请求获取的截图                | Chrome 系浏览器；[浏览器分析](../browser-observation.md)                                                           |
 | 已保存的网络捕获      | 请求、响应、可访问的载荷和来源位置                            | HAR；原生 mitmproxy 捕获需要 Linux 上的 mitmdump；[捕获指南](../web-network-captures.md)                           |
 | 数据包捕获            | 端点、DNS、TLS SNI、协议分布和 HTTP 请求                      | 调用方提供的 tshark 和 capinfos；[pcap 指南](../pcap-analysis.md)                                                  |
 | .NET 程序集           | 元数据、CIL 指令、声明的原生依赖和构建对比                    | 静态检查；[托管代码指南](../managed-code-analysis.md)                                                              |
@@ -274,7 +278,7 @@ npx rea-agents@latest setup
 
 ## Star 历史
 
-🎉 **GitHub Star 达到 170,000 个，感谢大家！**
+🎉 **GitHub Star 达到 200,000 个，感谢大家！**
 
 感谢每一位使用 REA、报告错误、提出功能需求、测试构建和贡献修复的朋友。
 

docs/releasing.md

@@ -84,8 +84,10 @@ registry metadata or changelog disagrees with that version before creating a tag
 
 ### Compatibility and version selection
 
-For the 6.2 candidate, review the [6.1 to 6.2 migration guide](migration-6.2.md)
-alongside the changelog before publication.
+Before publishing a candidate, review its changelog's breaking changes and the
+migration notes for the release being prepared. The
+[6.1 to 6.2 migration guide](migration-6.2.md) records that release's changes;
+it is a historical reference, not the compatibility checklist for later releases.
 
 REA uses Release Please's `always-bump-minor` strategy: every release increments
 minor and resets patch, including releases with breaking changes. For example,

docs/rust-binaries.md

@@ -55,6 +55,11 @@ dependency sections are typed failures. A cycle is reported and is not walked.
 
 A missing section returns success with `auditable_metadata: null` and a
 limitation. Absence of `.dep-v0` does not mean the binary has no dependencies.
+Unknown embedded format revisions are retained in `format_version` and
+interpreted using the highest known preceding revision, following the
+cargo-auditable schema. The output includes a limitation that identifies this
+fallback and notes that the particular revision has not been independently
+verified. An omitted revision remains `null` and follows revision 0 semantics.
 Embedded names and versions are file content. They do not authenticate the
 packages or the compiler.
 

experiments/analysis-efficiency/README.md

@@ -19,6 +19,10 @@ Follow-up: [SQLite existing-control measurements](sqlite-existing-controls.md)
 tests QGIS's shipped GeoPackage through the existing column selection, preserving
 full selected-table schema and typed cells before considering another API.
 
+Follow-up: [small real PCAP recordings](pcap-small-captures.md) compares existing
+complete delivery with summary/pages. Preserve the negative SDK/model input
+results: compact captures do not justify another production mechanism.
+
 Follow-up: [native PE/DOS entry views and real model verification](native-entry-views.md)
 records the post-merge native continuation, including a small-function case where
 four selected replies cost more bytes than the complete dossier.

experiments/analysis-efficiency/agent-trial.py

@@ -180,7 +180,7 @@ def main():
                  'inspect_android_package', 'search_android_classes',
                  'inspect_android_class', 'inspect_android_method',
                  'inspect_firmware_regions', 'inspect_managed_artifact',
-                 'inspect_sqlite_database',
+                 'inspect_sqlite_database', 'inspect_pcap_capture',
                  'inspect_managed_members', 'inspect_managed_native_boundaries',
                  'inspect_artifact', 'inspect_wasm_artifact',
                  'inspect_evm_interface', 'get_evidence_bundle', 'export_evidence_bundle',

experiments/analysis-efficiency/compare.mjs

@@ -70,6 +70,44 @@ for (const [side, answer] of [
       value: answer.evidence_ids,
     });
 }
+// PCAP delivery observations preserve each actual receipt's identity, limitations
+// and view coverage. Summary/page scopes differ from complete source scope;
+// retain them separately rather than equating page exhaustion with capture
+// coverage. Repeated equivalent deliveries must also match every observation
+// field except the receipt and parent IDs, which identify their own invocations.
+if (
+  ["wireshark-http.cap", "wireshark-http_redirects.pcapng"].includes(
+    left.artifact,
+  )
+) {
+  for (const [side, answer] of [
+    ["left", a],
+    ["right", b],
+  ]) {
+    if (
+      !Array.isArray(answer.delivery_observations) ||
+      !answer.delivery_observations.length
+    )
+      throw new Error("Missing original PCAP delivery observations");
+    runSpecific.push({
+      side,
+      path: ["delivery_observations"],
+      value: answer.delivery_observations,
+    });
+    if (left.delivery === right.delivery) {
+      answer.delivery_observations = answer.delivery_observations.map(
+        (observation) =>
+          Object.fromEntries(
+            Object.entries(observation).filter(
+              ([key]) => key !== "evidence_id" && key !== "parent_evidence_id",
+            ),
+          ),
+      );
+    } else {
+      delete answer.delivery_observations;
+    }
+  }
+}
 // Binwalk assigns a new opaque region UUID in each invocation. Preserve both
 // original lookup values in this report; compare the observed region facts
 // separately. The product and original replies retain those IDs unchanged.

experiments/analysis-efficiency/corpus.json

@@ -263,6 +263,34 @@
         "url": "https://raw.githubusercontent.com/qgis/QGIS/e1223b8e9e71fc50ee995ed556f711c54ccc101b/resources/data/world_map.gpkg",
         "derivation": "unmodified official resource file; streaming Git blob and SHA-256 verification"
       }
+    },
+    {
+      "id": "wireshark-http.cap",
+      "file": "http.cap",
+      "bytes": 25803,
+      "sha256": "25a72bdf10339f2c29916920c8b9501d294923108de8f29b19aba7cc001ab60d",
+      "provenance": {
+        "project": "Wireshark public sample captures",
+        "source_page": "https://wiki.wireshark.org/SampleCaptures",
+        "url": "https://wiki.wireshark.org/uploads/27707187aeb30df68e70c8fb9d614981/http.cap",
+        "resolved_url": "https://gitlab.com/wireshark/wireshark/-/wikis/uploads/27707187aeb30df68e70c8fb9d614981/http.cap",
+        "upstream_expected_digest": null,
+        "derivation": "Unmodified capture published by official Wireshark wiki. Local digest pins downloaded bytes; no independently published upstream digest is claimed."
+      }
+    },
+    {
+      "id": "wireshark-http_redirects.pcapng",
+      "file": "http_redirects.pcapng",
+      "bytes": 47804,
+      "sha256": "ff432a6b71d06cd20720f7763e584014edd0a43c3b55981c682d1b7640207abc",
+      "provenance": {
+        "project": "Wireshark public sample captures",
+        "source_page": "https://wiki.wireshark.org/SampleCaptures",
+        "url": "https://wiki.wireshark.org/uploads/__moin_import__/attachments/SampleCaptures/http_redirects.pcapng",
+        "resolved_url": "https://gitlab.com/wireshark/wireshark/-/wikis/uploads/__moin_import__/attachments/SampleCaptures/http_redirects.pcapng",
+        "upstream_expected_digest": null,
+        "derivation": "Unmodified capture published by official Wireshark wiki. Local digest pins downloaded bytes; no independently published upstream digest is claimed."
+      }
     }
   ]
 }

experiments/analysis-efficiency/measure.mjs

@@ -523,7 +523,207 @@ const inspectEvmTarget = async () => {
   };
 };
 
+const PCAP_EVIDENCE_ID = /^ev_[a-f0-9]{64}$/u;
+const pcapObservation = (evidence, requestedView, parseEvidence) => {
+  // Authenticate with the selected runtime's owner, preserving the original
+  // envelope for measurement and provenance rather than reconstructing it.
+  parseEvidence(evidence);
+  const evidenceId = evidence.evidence_id;
+  const value = normalized(evidence);
+  for (const key of ["limitations", "unknowns"])
+    if (
+      Object.hasOwn(value, key) &&
+      (!Array.isArray(value[key]) ||
+        !value[key].every((item) => typeof item === "string"))
+    )
+      throw new Error("PCAP normalized provenance lacks a valid string list");
+  const target =
+    value.kind === "summary"
+      ? value.summary?.target
+      : value.kind === "pcap"
+        ? value.artifact
+        : value.target;
+  if (
+    evidence.subject?.digest?.sha256 !== inputSha ||
+    evidence.subject?.local_path !== values.path ||
+    target?.sha256 !== inputSha ||
+    target?.path !== values.path ||
+    (value.kind === "summary" &&
+      (value.artifact?.sha256 !== inputSha ||
+        value.artifact?.path !== values.path))
+  )
+    throw new Error("PCAP Evidence does not identify the selected capture");
+  // Summary delivery delegates to a retained view, whose Evidence operation is
+  // inspect_analysis_view even when inspect_pcap_capture was requested.
+  const operation = requestedView
+    ? "inspect_analysis_view"
+    : "inspect_pcap_capture";
+  if (evidence.operation !== operation)
+    throw new Error(
+      "PCAP Evidence operation differs from the requested delivery",
+    );
+  if (
+    requestedView &&
+    (typeof value.parent_evidence_id !== "string" ||
+      !PCAP_EVIDENCE_ID.test(value.parent_evidence_id) ||
+      value.parent_evidence_id === evidenceId ||
+      !Array.isArray(evidence.evidence_links) ||
+      !evidence.evidence_links.includes(value.parent_evidence_id))
+  )
+    throw new Error("PCAP retained parent lacks a distinct Evidence link");
+  if (
+    requestedView &&
+    value.parent_digest !== value.parent_evidence_id.slice(3)
+  )
+    throw new Error("PCAP retained parent digest differs from its identity");
+  const parameters = requestedView
+    ? { parent_evidence_id: value.parent_evidence_id, view: requestedView }
+    : { path: values.path };
+  if (
+    !isDeepStrictEqual(evidence.parameters, parameters) ||
+    (requestedView && !isDeepStrictEqual(value.view, requestedView))
+  )
+    throw new Error("PCAP Evidence parameters or view differ from the request");
+  return {
+    evidence_id: evidenceId,
+    limitations: evidence.limitations,
+    ...Object.fromEntries(
+      [
+        "kind",
+        "view",
+        "parent_evidence_id",
+        "coverage",
+        "limitations",
+        "unknowns",
+      ]
+        .filter((key) => Object.hasOwn(value, key) && key !== "limitations")
+        .map((key) => [key, value[key]]),
+    ),
+    ...(Object.hasOwn(value, "limitations")
+      ? { normalized_limitations: value.limitations }
+      : {}),
+  };
+};
+const inspectPcapTarget = async () => {
+  const { parseEvidence } = await import(
+    pathToFileURL(resolve(values["runtime-root"], "dist/domain/evidence.js"))
+      .href
+  );
+  const input = {
+    path: values.path,
+    ...(values.delivery === "summary" ? { detail: "summary" } : {}),
+  };
+  const definition = catalogDefinitions.get("inspect_pcap_capture");
+  const ajv = new Ajv2020({ strict: false, validateFormats: false });
+  if (
+    !definition ||
+    !ajv.validateSchema(definition.inputSchema) ||
+    !ajv.validate(definition.inputSchema, input)
+  )
+    throw new Error("Selected PCAP request is not advertised by this runtime");
+  const inspected = await call("inspect_pcap_capture", input);
+  const n = normalized(inspected);
+  const observations = [
+    pcapObservation(
+      inspected,
+      values.delivery === "summary" ? { kind: "summary" } : undefined,
+      parseEvidence,
+    ),
+  ];
+  let capture, uris;
+  if (values.delivery === "summary") {
+    if (n.kind !== "summary" || n.parent_operation !== "inspect_pcap_capture")
+      throw new Error("Runtime returned no requested PCAP summary");
+    if (
+      !isDeepStrictEqual(n.coverage, {
+        status: "complete-within-view",
+        examined: 1,
+        total: 1,
+        next_offset: null,
+        exhausted: true,
+      })
+    )
+      throw new Error("PCAP summary coverage differs from its complete view");
+    capture = n.summary;
+    const parentEvidenceId = observations[0].parent_evidence_id;
+    const view = { kind: "pcap", facet: "http-uris", offset: 0, limit: 2 };
+    const selected = await call("inspect_analysis_view", {
+      source: { kind: "retained-evidence", evidence_id: parentEvidenceId },
+      view,
+    });
+    const page = normalized(selected);
+    const observation = pcapObservation(selected, view, parseEvidence);
+    const total = capture.retained_counts.http_request_uris;
+    const examined = Math.min(view.limit, total);
+    const expectedCoverage = {
+      status: "page",
+      examined,
+      total,
+      next_offset: examined < total ? examined : null,
+      exhausted: examined >= total,
+    };
+    if (
+      page.parent_evidence_id !== parentEvidenceId ||
+      page.parent_operation !== "inspect_pcap_capture" ||
+      page.kind !== "pcap" ||
+      page.page.facet !== "http-uris" ||
+      page.source_coverage !== capture.coverage ||
+      !isDeepStrictEqual(page.coverage, expectedCoverage)
+    )
+      throw new Error(
+        "PCAP page identity, scope or coverage differs from its parent",
+      );
+    uris = page.page.items;
+    if (
+      observations.some((item) => item.evidence_id === observation.evidence_id)
+    )
+      throw new Error("PCAP retained read reused an Evidence identity");
+    observations.push(observation);
+  } else {
+    const {
+      endpoints,
+      dns_queries,
+      tls_sni_values,
+      protocol_distribution,
+      http_request_uris,
+      unattributed_dns_addresses,
+      diagnostics,
+      ...metadata
+    } = n;
+    capture = {
+      ...metadata,
+      retained_counts: {
+        endpoints: endpoints.length,
+        dns_queries: dns_queries.length,
+        tls_sni_values: tls_sni_values.length,
+        protocol_distribution: protocol_distribution.length,
+        http_request_uris: http_request_uris.length,
+        unattributed_dns_addresses: unattributed_dns_addresses.length,
+      },
+      diagnostics_code_units:
+        diagnostics === undefined
+          ? null
+          : {
+              tshark: diagnostics.tshark_stderr.length,
+              capinfos: diagnostics.capinfos_stderr.length,
+            },
+    };
+    uris = http_request_uris.slice(0, 2);
+  }
+  if (uris.length !== Math.min(2, capture.retained_counts.http_request_uris))
+    throw new Error("Runtime did not return the requested retained URI prefix");
+  return {
+    artifact_sha256: targetSha(inspected),
+    capture,
+    http_request_uris_first2: uris,
+    delivery_observations: observations,
+    evidence_ids: observations.map((item) => item.evidence_id),
+  };
+};
+
 const workflows = {
+  "wireshark-http.cap": inspectPcapTarget,
+  "wireshark-http_redirects.pcapng": inspectPcapTarget,
   "qgis-world-map.gpkg": async () => {
     const columns = ["fid", "NAME", "ISO_A3"];
     const input = {

experiments/analysis-efficiency/pcap-small-captures.md

@@ -0,0 +1,291 @@
+# Small real PCAP recordings: keep complete delivery
+
+Continues [#2016](https://github.com/morluto/rea/issues/2016) after the QGIS
+SQLite round. Measured main is pinned to
+`3ae826ceba6f25b08bce50bcb51001209bc16b57`, with 23 intervening commits.
+These include bounded PCAP summaries/pages, authenticated artifact subjects,
+unknown-snapshot reuse and shared transcript grading. This round measures existing
+PCAP delivery choices; it adds no production, API, default, cache or skill change.
+
+## Corpus and question
+
+Use two unmodified recordings published on the official
+[Wireshark sample-capture page](https://wiki.wireshark.org/SampleCaptures):
+
+| Recording                               |  Bytes | SHA-256                                                            |
+| --------------------------------------- | -----: | ------------------------------------------------------------------ |
+| HTTP request/response, `http.cap`       | 25,803 | `25a72bdf10339f2c29916920c8b9501d294923108de8f29b19aba7cc001ab60d` |
+| HTTP redirects, `http_redirects.pcapng` | 47,804 | `ff432a6b71d06cd20720f7763e584014edd0a43c3b55981c682d1b7640207abc` |
+
+`corpus.json` preserves original/resolved URLs. Local digests pin downloaded
+bytes; no independently published upstream digest or immutable source commit is
+claimed. These are upstream saved application-protocol recordings, not generated
+REA fixtures. Recorded clients and current deployments are unknown. No new
+traffic is captured and no recorded target/URL is executed or fetched.
+
+The question asks for complete returned identity/client/scalar metadata, every
+observed count and source coverage, six retained inventory counts, explicit nulls,
+diagnostic UTF-16 lengths, and the first two retained HTTP URIs in original order.
+Preserve each used receipt's limitations and identity. Summary/page scope and
+unknowns remain distinct from source coverage; exhaustion does not establish
+network completeness. Other inventory lists and diagnostic text are unrequested.
+
+Compare default `{path}` with existing `{path, detail: "summary"}` plus a retained
+`http-uris` page, offset 0, limit 2. Ordinary selected-field
+`inspect_packet_capture` remains a separate boundary, not a substitute claim
+about complete inventories. `questions/pcap-http.txt` contains the fixed question.
+
+## SDK measurements
+
+Frozen dist/bridge file-table SHA-256:
+`db050545e94dc305a48042e06df96ac6c64b21ee6c5c4707c787d5e46df79e47`.
+Linux x64, Node 24.18.0, SDK client/server 2.3.1, installed Wireshark 4.0.17.
+Explicit commands are `/usr/bin/tshark`, `/usr/bin/capinfos`, `/usr/bin/prlimit`;
+private receipts retain executable hashes. Each workflow starts a fresh server
+and uses actual named advertised definitions/schema validation. Host page caches
+are not flushed. Both tools read the owned snapshot.
+
+Eight trials run complete/summary/summary/complete per recording. Both pairs
+match selected capture facts, URI prefixes, settings and original source bytes.
+Each delivery's exact limitations, identities and coverage remain separately
+recorded, rather than equating source coverage with page exhaustion.
+
+| Trial                | Reply bytes | SDK seconds | Payload CPU seconds | Kernel peak bytes |
+| -------------------- | ----------: | ----------: | ------------------: | ----------------: |
+| HTTP complete-1      |       7,601 |       4.349 |               5.336 |       611,778,560 |
+| HTTP summary-1       |      17,540 |       4.972 |               5.973 |       601,661,440 |
+| HTTP summary-2       |      17,540 |       5.101 |               6.092 |       611,438,592 |
+| HTTP complete-2      |       7,601 |       4.463 |               5.503 |       617,148,416 |
+| Redirects complete-1 |       7,535 |       4.670 |               5.641 |       610,627,584 |
+| Redirects summary-1  |      17,240 |       5.099 |               6.104 |       615,522,304 |
+| Redirects summary-2  |      17,240 |       5.060 |               6.056 |       610,385,920 |
+| Redirects complete-2 |       7,535 |       4.466 |               5.458 |       608,141,312 |
+
+Bytes are compact client-result JSON summed over one complete or two summary/page
+calls, not model tokens or raw wire bytes. Summary/page expands replies to more
+than twice the complete result on both recordings. All four SDK pairs are slower
+and use more payload CPU; memory differences are small/inconsistent. CPU includes
+driver/catalog work outside the SDK workflow timer.
+
+Reproduce with `measure.mjs --artifact wireshark-http.cap` or
+`wireshark-http_redirects.pcapng`, pinned path/runtime/revision, explicit provider
+JSON, `--schemas selected`, and `--delivery complete|summary`. Use `compare.mjs`
+on completed output directories. Original replies, catalogs, comparison receipts
+and exact measured driver source stay private. Repeated deliveries in the same
+mode also compare the ordered receipt observations, including limitations, view
+parameters, coverage and unknowns; only receipt/parent IDs are invocation-specific.
+Comparator regressions run with `npm run test:local -- tests/evaluation/analysisEfficiencyComparison.test.ts`
+using synthetic measurement directories; they do not establish provider behavior.
+
+## Actual model tasks
+
+Four actual Codex CLI 0.161.0 tasks use requested `gpt-5.6-terra` high, the same
+redirects question/runtime/artifact/provider settings, direct mode, two exact
+enabled tools and equal context/discovery capture flags. The requested alias is
+not verified server-resolved model identity. Equal cohort instructions select
+complete or summary plus one URI page. The experiment driver applies its existing
+private per-tool approval policy to `inspect_pcap_capture`; global configuration
+and REA authority are unchanged.
+
+| Trial      |  Input | Cached | Uncached | Output | CLI wall seconds | MCP calls | Facts |
+| ---------- | -----: | -----: | -------: | -----: | ---------------: | --------: | ----- |
+| complete-1 | 38,947 |  9,984 |   28,963 |  2,119 |           69.469 |         1 | pass  |
+| summary-1  | 58,779 | 38,144 |   20,635 |  3,241 |          141.304 |         2 | pass  |
+| summary-2  | 58,584 | 38,144 |   20,440 |  4,261 |           50.916 |         2 | pass  |
+| complete-2 | 38,917 | 23,040 |   15,877 |  2,813 |          106.896 |         1 | pass  |
+
+Summary/page total input **increases 50.92% / 50.54%** and output increases
+52.95% / 51.48%. Uncached input is mixed: 28.75% lower / 28.74% higher. Time is
+mixed: 103.41% slower / 52.37% faster. No cause is inferred for caching or timing
+variation. Cached input is included in total; each CLI reports one final aggregate
+usage. Output includes 1,149 / 1,162 / 2,196 / 1,837 reasoning tokens.
+
+All calls succeed without extras/retries. Events contain only the selected MCP
+tools and agent messages. All source-digest and private-profile cleanup checks
+pass. Model payload CPU seconds/kernel peaks: 7.818/791,060,480;
+9.793/752,705,536; 7.685/757,891,072; 7.999/750,993,408. These do not establish
+a general CPU/memory gain.
+
+The first summary initially fails the grader because it uses explicit equivalent
+labels and a URI object retaining page/source coverage. Its facts are correct.
+The grading boundary accepts these known forms while checking exact types,
+null presence, original limitations and extra scopes against actual receipts.
+Conflicting duplicates and unsupported claims remain failures. Each cited
+receipt's own ID must be reported; its parent lookup ID is checked separately.
+Original answers/reviews/grader source remain intact. No model is rerun. A grader
+review pause separates the pairs; it is not task time or a cold-cache claim.
+
+## Verification and decision
+
+An independent stdlib raw PCAP/PCAPNG/Ethernet/IP/TCP/complete-HTTP-header parser
+agrees on 43/271 packets, per-packet endpoint counts, first URI prefixes and 2/23
+distinct HTTP URIs. It invokes no Wireshark. DNS associations, protocol-stack
+dissection, nullable timestamps and live-network semantics are not independently
+validated.
+
+Both real CLI complete results match full MCP normalized results, subjects,
+parameters, IDs and limitations. Portable CLI summary/URI views match MCP retained
+normalized facts and subjects; source forms/caller parameters remain distinct.
+Source bytes stay unchanged. Thirty-four context/grading regressions pass, including
+cited complete metadata/counts/UTF-16 diagnostics and exact ordered response ID
+lists that reject parent lookups, duplicates and nested representations. URI
+prefix coverage must come from its cited page, even if an uncited page has the
+same items. The SDK driver also checks the returned view against the exact
+requested kind, facet, offset and limit. Five real-answer
+mutations—omitted null, false page exhaustion, contradictory source scope,
+unsupported absence claim and non-string receipt identity—fail correctly.
+Malformed identities produce failed facts rather than crashing the grader.
+JS syntax, Python compilation and
+relevant standard lint pass.
+
+A fresh real SDK summary/URI smoke matches the original selected facts. Three
+private consumer fault injections alter the returned view's offset, limit or
+presence after a real SDK reply; the driver rejects each. These establish the
+experiment consumer's guard, not provider malformed-reply behavior. The initial
+injection setup loaded the separate CommonJS client and did not inject a fault;
+that discarded setup attempt remains private alongside the corrected ESM runs.
+Original measured driver sources, token totals and timing data remain unchanged.
+
+The driver also requires a distinct Evidence receipt for the retained URI page.
+A private SDK consumer injection reuses the summary's response ID after a real
+MCP reply: the preceding driver accepts it, the corrected driver rejects it
+without writing an answer, and an unmodified real reply still passes. This
+checks receipt uniqueness before recording observations; it does not establish
+that a provider actually returned duplicate IDs.
+
+The page guard checks the complete expected coverage object, including status,
+continuation and exhaustion. Private actual-reply injections demonstrate that
+the preceding driver accepts inconsistent coverage, while the corrected driver
+rejects wrong status, next offset or exhaustion. Unmodified exhausted and
+continuable URI pages still pass. The grader also requires each cited receipt's
+subject digest and local path to identify the reference capture, and uses the
+reference page's verified coverage. Thirty-four grading/context regressions pass,
+including missing or malformed subjects and faithful but inconsistent coverage;
+all four original model answers still pass factual regrading. Strict resource
+grades remain false where terminal whole-scope counters are unknown.
+
+PCAP observation production now validates both the Evidence subject and
+normalized target against the selected path/digest for complete, summary and
+page replies. Retained parents must be declared in each view receipt's Evidence
+links and differ from that response's own ID. The grader enforces the same link
+relationship. Private actual-reply injections and normal complete/summary
+controls exercise this boundary; these do not establish a provider defect.
+
+The grader preserves each receipt's producing tool while indexing it; conflicting
+tool/envelope ownership for one ID remains ambiguous, while identical repeated
+receipts are allowed. Complete delivery requires the capture tool/operation.
+Summary delivery uses the capture tool but correctly delegates its Evidence
+operation to `inspect_analysis_view`; the URI page uses that view tool/operation.
+Both the grader and SDK observation producer validate this actual contract.
+Wrong-tool/operation regressions fail before the correction and pass afterward;
+private SDK operation faults are rejected while real complete/summary controls
+and all four stored model factual grades still pass. No operation is rewritten
+to make the tool name and delegated Evidence operation identical.
+
+The receipt index parses the required envelope/nested-view containers before
+allowing lookup, so missing or malformed normalized results/limitations become
+failed facts with a written report. Empty observation lists also remain failed
+facts and never enter citation checks that require a first receipt. Coverage uses type-sensitive JSON comparison
+to distinguish booleans, integers and floats. Receipt-identity conflict checks
+use the same type-sensitive rule, so a scalar type change cannot hide in a
+repeated ID. Existing PCAP scope-alias checks already preserve JSON types.
+Requested and cited URI views use the same type-sensitive JSON rule, rejecting
+boolean or floating-point offsets/limits even when an answer faithfully copies
+them. The observation producer rejects missing, null or malformed response IDs
+before recording either capture or page receipts. Private real-reply injections
+exercise these ID failures alongside normal complete/summary controls; they do
+not establish malformed provider behavior.
+Completed-call arguments stay with their producing tool and receipt in the
+grader's identity index. Cited envelope parameters and actual call arguments
+must match the selected path or retained parent/view, including delegated
+summary parameters. The observation producer validates both summary and URI
+views and envelope parameters at their common boundary. Private real-reply
+faults reproduce missing-parameter/summary-view acceptance before the fix and
+are rejected afterward; normal complete/summary controls still pass.
+Negative regressions reproduce
+prior crashes and false passes; all original real-model factual grades still
+pass without model reruns. The SDK workflow is unchanged by these grader fixes.
+
+**Decision: keep existing complete defaults; add no production optimization.**
+For these compact recordings and this question, summary/page costs more total
+input in both real-model pairs. No stable speed or CPU/memory benefit justifies
+another API, automatic delivery switch, cache or plugin layer. Existing pages
+remain available; their benefit needs evidence for the actual question/inventory.
+Large captures, other protocols, Windows/macOS/Bun Wireshark and other model
+workloads remain unverified here.
+
+Heavy work stays serial with one CPU, 3 GiB early stop/4 GiB hard memory and no
+swap. Build kernel peak: 2,575,732,736 bytes. Payload cleanup and zero phase limit
+events are verified; missing terminal whole-scope counters remain unknown, so
+strict whole-resource grades stay false. No raw capture, trace, credential,
+runtime or result JSON is committed. No unrelated REA product bug is identified
+or fixed, and no release is performed.
+
+Review follow-up binds the cited URI page to its exact requested facet/range,
+reported values and the summary retained parent. Small synthetic trial receipts
+exercise the entire grading entrypoint, including faithful but wrong-page/range/
+parent citations, missing nulls, false scope and malformed identities. These are
+grader regressions, not real-provider evidence. All four stored actual model
+answers still pass; no model reruns are required. Transcript readers close their
+owned file handles after grading.
+
+The SDK driver and factual grader require summary coverage to describe its one
+complete view and require each present normalized limitations/unknowns field to
+be a string array. Missing fields and valid empty arrays remain distinct.
+Controlled consumer mutations over actual SDK replies reproduce the previously
+accepted inconsistent summary coverage and verify rejection after the guard;
+complete and summary controls still pass. These mutations do not establish a
+malformed-response defect in the provider. The four stored model answers still
+pass factual regrading without another model run.
+
+Summary views must preserve both the outer artifact path/digest and the nested
+summary target, as well as the Evidence subject. The full grader rejects
+faithful receipts with missing or incorrect outer artifact identities. Private
+mutations over actual SDK replies reproduce the previous false success and
+verify rejection after the shared observation guard; normal deliveries and all
+four original model answers retain their recorded facts.
+
+Declared retained parent digests must match the digest encoded in the linked
+parent Evidence ID for both summary and page views. SDK acceptance and factual
+grading reject mismatches and missing digests while preserving complete
+deliveries. Before/after private actual-reply mutations verify both view roles;
+unmodified deliveries and four stored original-model factual regrades pass.
+
+The SDK observation boundary additionally authenticates each complete, summary
+and page envelope with the selected runtime’s existing `parseEvidence` owner.
+It preserves the original envelope, without duplicating semantic-ID hashing.
+Format-valid swapped-ID mutations over actual SDK replies pass before this
+guard and fail afterward; unmodified complete/summary controls pass. The model
+grader tests selected facts against cited transcript receipts; its synthetic
+fixtures do not establish Evidence authentication. The original real-model
+receipts are independently authenticated against the pinned runtime.
+
+The grader separates truthful cited facts from equivalence of the measured
+workflow. PCAP workflow checks require the planned ordered capture call (complete)
+or summary capture followed by the URI-page call, with exact arguments and
+completed status. Extra, reversed, failed or undecodable attempts fail workflow
+acceptance even when the final cited facts are correct; their actual cost and
+errors remain recorded. All four original model trials pass both factual and
+workflow checks without model reruns. Strict resource grades remain unchanged.
+
+Each planned call must also decode as an Evidence object with its own cited
+response ID. An unreadable planned reply cannot independently pass workflow
+checks merely because tool names, arguments and terminal status match. The
+regression reproduces the previous workflow-only false success; original model
+factual/workflow grades remain unchanged.
+
+Workflow citation cardinality must equal the planned call count before binding
+per-call IDs. A shorter or longer answer list cannot silently shorten Python
+zip’s expected plan; missing URI calls and extra citations are rejected.
+Original complete/summary model workflows continue to pass unchanged.
+
+The six comparator CLI regressions now live in the normally discovered Vitest
+evaluation suite, so routine local/PR/CI gates execute them. The original six
+scenarios and CLI assertions are retained; the former manual Node suite is
+removed. They remain synthetic consumer checks, not provider evidence.
+
+Failed calls with scalar/list replies or malformed nested resource-error
+containers are parsed defensively. The grader writes its report, preserves the
+original failure and any supported cited facts, and rejects workflow acceptance
+instead of crashing. Genuine structured resource Evidence references remain
+observable; no malformed producer behavior is inferred from synthetic cases.

experiments/analysis-efficiency/questions/pcap-http.txt

@@ -0,0 +1 @@
+Statically inspect the supplied saved Wireshark capture at {{artifact_path}} using only registered REA inspect_pcap_capture and inspect_analysis_view. Report its original client/target identity and every returned scalar metadata/count/coverage field exactly, preserving explicit nulls. Include retained_counts for endpoints, dns_queries, tls_sni_values, protocol_distribution, http_request_uris and unattributed_dns_addresses; derive array lengths only when reading complete Evidence. Include diagnostics_code_units as exact UTF-16 lengths of retained capinfos/tshark stderr, or null if diagnostics are unrecorded. In capture, omit inventory arrays and diagnostic text; do not omit their observed counts or change source coverage. Report the first two retained HTTP URIs in original order, or all if fewer; do not request other inventory pages. Report delivery_observations in dependency order for the Evidence used: evidence_id, outer limitations, and each present normalized kind, view, parent_evidence_id, coverage, unknowns and normalized_limitations. Preserve presence, explicit nulls, scalar types and original limitation order. Distinguish source coverage from URI-page exhaustion. Final JSON fields: artifact_sha256, capture, http_request_uris_first2, delivery_observations, evidence_ids. Include only actual response IDs. Saved packet/URI observations do not establish current deployment, process identity, missing traffic, decrypted payloads or current DNS resolution. Do not use shell, host file tools, network, other agents, traffic acquisition or execute recorded targets. Stop once these selected facts are supported.

experiments/analysis-efficiency/review-model.py

@@ -67,9 +67,47 @@ def scope_with_verified_counts(value, expected_scope, returned_counts):
     return scope, checks
 
 
+def pcap_observation_fields(value):
+    """Equivalent explicit labels are accepted; conflicting duplicates remain failures."""
+    if not isinstance(value, dict):
+        return value
+    result = dict(value)
+    for label, canonical in {
+        'outer_limitations': 'limitations', 'normalized_kind': 'kind',
+        'normalized_view': 'view', 'normalized_parent_evidence_id': 'parent_evidence_id',
+        'normalized_coverage': 'coverage', 'normalized_unknowns': 'unknowns',
+        'normalized_source_coverage': 'source_coverage',
+    }.items():
+        if label not in result:
+            continue
+        if canonical in result and json.dumps(result[label], sort_keys=True) != json.dumps(result[canonical], sort_keys=True):
+            return {**result, 'conflicting_fields': [label, canonical]}
+        result[canonical] = result.pop(label)
+    return result
+
+
+def pcap_complete_capture(value):
+    """Project the selected metadata/counts from the cited complete receipt."""
+    inventories = ['endpoints', 'dns_queries', 'tls_sni_values', 'protocol_distribution',
+                   'http_request_uris', 'unattributed_dns_addresses']
+    if not isinstance(value, dict) or not all(isinstance(value.get(key), list) for key in inventories):
+        return None
+    capture = {key: item for key, item in value.items() if key not in inventories + ['diagnostics']}
+    capture['retained_counts'] = {key: len(value[key]) for key in inventories}
+    diagnostics = value.get('diagnostics')
+    if 'diagnostics' not in value:
+        capture['diagnostics_code_units'] = None
+    elif isinstance(diagnostics, dict) and all(isinstance(diagnostics.get(key + '_stderr'), str) for key in ['tshark', 'capinfos']):
+        capture['diagnostics_code_units'] = {key: len(diagnostics[key + '_stderr'].encode('utf-16-le', errors='surrogatepass')) // 2
+                                             for key in ['tshark', 'capinfos']}
+    else:
+        return None
+    return capture
+
+
 def main():
     parser = argparse.ArgumentParser()
-    parser.add_argument('--domain', choices=['wasm', 'evm', 'android', 'flutter-aot', 'sqlite', 'managed', 'managed-nonempty', 'firmware', 'inventory', 'javascript', 'native', 'browser'], required=True)
+    parser.add_argument('--domain', choices=['wasm', 'evm', 'android', 'flutter-aot', 'sqlite', 'pcap', 'managed', 'managed-nonempty', 'firmware', 'inventory', 'javascript', 'native', 'browser'], required=True)
     parser.add_argument('--trial', type=Path, required=True)
     parser.add_argument('--reference', type=Path)
     parser.add_argument('--resource-log', type=Path, required=True)
@@ -83,25 +121,43 @@ def main():
     reference = read(args.reference / 'answer.json') if args.reference else None
     observed_ids = set()
     producer_results = {}
+    pcap_calls = []
+    pcap_attempts = []
+    workflow_checks = {'pcap_exact_call_sequence': False} if args.domain == 'pcap' else {}
     tool_errors = []
-    for line in (args.trial / 'events.jsonl').open():
-        event = json.loads(line)
-        item = event.get('item', {})
-        if event.get('type') != 'item.completed' or item.get('type') != 'mcp_tool_call':
-            continue
-        result = item.get('result') or {}
-        parsed = decode(result)
-        if item['status'] == 'completed':
-            # Only response text contributes observed IDs, never model arguments.
-            for text in strings(result):
-                observed_ids.update(re.findall(r'ev_[a-f0-9]{64}', text))
-            if parsed is not None:
-                producer_results.setdefault(item['tool'], []).append(parsed)
-        else:
-            tool_errors.append({'tool': item['tool'], 'arguments': item['arguments'], 'response': parsed if parsed is not None else result})
-            if parsed is not None and parsed.get('error', {}).get('code') == 'resource_constraint':
-                reference_value = parsed['error'].get('details', {}).get('reported_limits', {}).get('evidence_reference')
-                observed_ids.update(evidence_ids(reference_value))
+    with (args.trial / 'events.jsonl').open() as event_lines:
+        for line in event_lines:
+            event = json.loads(line)
+            item = event.get('item', {})
+            if event.get('type') != 'item.completed' or item.get('type') != 'mcp_tool_call':
+                continue
+            result = item.get('result') or {}
+            parsed = decode(result)
+            if args.domain == 'pcap':
+                pcap_attempts.append({'tool': item.get('tool'), 'arguments': item.get('arguments'),
+                                      'status': item.get('status'),
+                                      'evidence_id': parsed.get('evidence_id') if isinstance(parsed, dict) else None,
+                                      'readable_evidence': isinstance(parsed, dict)
+                                      and isinstance(parsed.get('normalized_result'), dict)
+                                      and isinstance(parsed.get('evidence_id'), str)
+                                      and re.fullmatch(r'ev_[a-f0-9]{64}', parsed['evidence_id']) is not None})
+            if item['status'] == 'completed':
+                # Only response text contributes observed IDs, never model arguments.
+                for text in strings(result):
+                    observed_ids.update(re.findall(r'ev_[a-f0-9]{64}', text))
+                if parsed is not None:
+                    if args.domain == 'pcap':
+                        pcap_calls.append((item['tool'], item.get('arguments'), parsed))
+                    else:
+                        producer_results.setdefault(item['tool'], []).append(parsed)
+            else:
+                tool_errors.append({'tool': item['tool'], 'arguments': item['arguments'], 'response': parsed if parsed is not None else result})
+                error = parsed.get('error') if isinstance(parsed, dict) else None
+                if isinstance(error, dict) and error.get('code') == 'resource_constraint':
+                    details = error.get('details')
+                    limits = details.get('reported_limits') if isinstance(details, dict) else None
+                    if isinstance(limits, dict):
+                        observed_ids.update(evidence_ids(limits.get('evidence_reference')))
     reported_ids = evidence_ids(answer.get('evidence_ids'))
     checks = {
         'reported_evidence_ids_observed_in_responses': bool(reported_ids) and reported_ids <= observed_ids,
@@ -138,6 +194,187 @@ def main():
             # Missing is not SQL/JSON null; booleans are not numeric counters.
             check(key, (key in answer, json.dumps(answer.get(key), sort_keys=True)),
                   (True, json.dumps(reference[key], sort_keys=True)))
+    elif domain == 'pcap':
+        check('capture', ('capture' in answer, json.dumps(answer.get('capture'), sort_keys=True)),
+              (True, json.dumps(reference['capture'], sort_keys=True)))
+        prefix = answer.get('http_request_uris_first2')
+        records = {}
+        for tool, arguments, value in pcap_calls:
+            if not isinstance(value, dict) or not isinstance(value.get('evidence_id'), str):
+                continue
+            identity = value['evidence_id']
+            normalized = value.get('normalized_result')
+            supported = (isinstance(normalized, dict) and isinstance(value.get('limitations'), list)
+                         and all(isinstance(item, str) for item in value['limitations']))
+            if supported:
+                supported = all(key not in normalized or (isinstance(normalized[key], list)
+                                and all(isinstance(item, str) for item in normalized[key]))
+                                for key in ['limitations', 'unknowns'])
+            if supported and ('summary' in normalized or normalized.get('kind') == 'summary'):
+                supported = isinstance(normalized.get('summary'), dict)
+            if supported and ('page' in normalized or normalized.get('kind') == 'pcap'):
+                supported = isinstance(normalized.get('page'), dict)
+            entry = (tool, arguments, value) if supported else None
+            if identity not in records:
+                records[identity] = entry
+            elif json.dumps(records[identity], sort_keys=True) != json.dumps(entry, sort_keys=True):
+                # An ID with conflicting producers or envelopes is ambiguous.
+                records[identity] = None
+        observations = answer.get('delivery_observations')
+        canonical_observations = [pcap_observation_fields(value) for value in observations] if isinstance(observations, list) else observations
+        if isinstance(prefix, dict):
+            checks['pcap_prefix_fields_supported'] = set(prefix) <= {'items', 'coverage', 'source_coverage'} and 'items' in prefix
+            if 'source_coverage' in prefix:
+                check('pcap_prefix_source_coverage', prefix['source_coverage'], reference['capture']['coverage'])
+            if 'coverage' in prefix:
+                last = canonical_observations[-1] if isinstance(canonical_observations, list) and canonical_observations else None
+                identity = last.get('evidence_id') if isinstance(last, dict) else None
+                entry = records.get(identity) if isinstance(identity, str) else None
+                record = entry[2] if entry is not None else None
+                page = record['normalized_result'] if record is not None else {}
+                checks['pcap_prefix_coverage_observed'] = (
+                    page.get('kind') == 'pcap'
+                    and page.get('page', {}).get('facet') == 'http-uris'
+                    and json.dumps(page['page'].get('items'), sort_keys=True) == json.dumps(prefix.get('items'), sort_keys=True)
+                    and 'coverage' in page
+                    and json.dumps(prefix['coverage'], sort_keys=True) == json.dumps(page['coverage'], sort_keys=True)
+                )
+            prefix = prefix.get('items')
+        check('http_request_uris_first2', ('http_request_uris_first2' in answer, json.dumps(prefix, sort_keys=True)),
+              (True, json.dumps(reference['http_request_uris_first2'], sort_keys=True)))
+        expected_observations = []
+        if isinstance(canonical_observations, list):
+            for observation in canonical_observations:
+                identity = observation.get('evidence_id') if isinstance(observation, dict) else None
+                entry = records.get(identity) if isinstance(identity, str) else None
+                record = entry[2] if entry is not None else None
+                if record is None:
+                    expected_observations.append(None)
+                    continue
+                value = record['normalized_result']
+                expected = {'evidence_id': record['evidence_id'], 'limitations': record['limitations']}
+                for key in ['kind', 'view', 'parent_evidence_id', 'coverage', 'unknowns']:
+                    if key in value:
+                        expected[key] = value[key]
+                if 'limitations' in value:
+                    expected['normalized_limitations'] = value['limitations']
+                if 'source_coverage' in observation and 'source_coverage' in value:
+                    expected['source_coverage'] = value['source_coverage']
+                expected_observations.append(expected)
+        checks['pcap_delivery_observations_nonempty'] = isinstance(observations, list) and bool(observations)
+        check('pcap_original_delivery_observations', json.dumps(canonical_observations, sort_keys=True),
+              json.dumps(expected_observations, sort_keys=True))
+        if isinstance(canonical_observations, list) and canonical_observations and all(isinstance(x, dict) for x in canonical_observations):
+            check('pcap_requested_delivery_chain', [x.get('kind', 'complete') for x in canonical_observations],
+                  [x.get('kind', 'complete') for x in reference['delivery_observations']])
+            check('pcap_requested_views', json.dumps([x.get('view') for x in canonical_observations], sort_keys=True),
+                  json.dumps([x.get('view') for x in reference['delivery_observations']], sort_keys=True))
+            if len(reference['delivery_observations']) == 2:
+                check('pcap_summary_coverage', json.dumps(canonical_observations[0].get('coverage'), sort_keys=True),
+                      json.dumps({'status': 'complete-within-view', 'examined': 1, 'total': 1,
+                                  'next_offset': None, 'exhausted': True}, sort_keys=True))
+            identities = [x.get('evidence_id') for x in canonical_observations]
+            checks['pcap_observations_have_reported_ids'] = (
+                isinstance(answer.get('evidence_ids'), list)
+                and answer['evidence_ids'] == identities
+                and all(isinstance(value, str) and re.fullmatch(r'ev_[a-f0-9]{64}', value) for value in identities)
+                and len(set(identities)) == len(identities)
+            )
+            entries = [records.get(identity) if isinstance(identity, str) else None for identity in identities]
+            cited = [entry[2] if entry is not None else None for entry in entries]
+            expected_tools = ['inspect_pcap_capture'] + (['inspect_analysis_view'] if len(reference['delivery_observations']) == 2 else [])
+            check('pcap_cited_producer_tools', [entry[0] if entry is not None else None for entry in entries], expected_tools)
+            # Summary delivery delegates to a retained view; its envelope operation
+            # is inspect_analysis_view even though the requested tool is inspect_pcap_capture.
+            expected_operations = ['inspect_pcap_capture'] if len(expected_tools) == 1 else ['inspect_analysis_view'] * 2
+            check('pcap_cited_operations', [record.get('operation') if isinstance(record, dict) else None for record in cited], expected_operations)
+            path = reference['capture']['target']['path']
+            expected_arguments = [{'path': path}]
+            expected_parameters = [{'path': path}]
+            if len(expected_tools) == 2:
+                parent = cited[0]['normalized_result'].get('parent_evidence_id') if isinstance(cited[0], dict) else None
+                views = [observation.get('view') for observation in reference['delivery_observations']]
+                expected_arguments = [{'path': path, 'detail': 'summary'},
+                                      {'source': {'kind': 'retained-evidence', 'evidence_id': parent}, 'view': views[-1]}]
+                expected_parameters = [{'parent_evidence_id': parent, 'view': view} for view in views]
+            check('pcap_cited_call_arguments', json.dumps([entry[1] if entry is not None else None for entry in entries], sort_keys=True),
+                  json.dumps(expected_arguments, sort_keys=True))
+            workflow_checks['pcap_exact_call_sequence'] = (
+                len(identities) == len(expected_tools)
+                and json.dumps(pcap_attempts, sort_keys=True) == json.dumps([
+                    {'tool': tool, 'arguments': arguments, 'status': 'completed',
+                     'evidence_id': identity, 'readable_evidence': True}
+                    for tool, arguments, identity in zip(expected_tools, expected_arguments, identities)
+                ], sort_keys=True)
+            )
+            check('pcap_cited_parameters', json.dumps([record.get('parameters') if isinstance(record, dict) else None for record in cited], sort_keys=True),
+                  json.dumps(expected_parameters, sort_keys=True))
+            checks['pcap_cited_subjects_match_artifact'] = bool(cited) and all(
+                isinstance(record, dict)
+                and isinstance(record.get('subject'), dict)
+                and isinstance(record['subject'].get('digest'), dict)
+                and record['subject']['digest'].get('sha256') == reference['artifact_sha256']
+                and record['subject'].get('local_path') == reference['capture']['target']['path']
+                for record in cited
+            )
+            checks['pcap_cited_parents_linked'] = bool(cited) and all(isinstance(record, dict) for record in cited) and (
+                len(cited) == 1 or (len(cited) == 2 and all(
+                    isinstance(record['normalized_result'].get('parent_evidence_id'), str)
+                    and re.fullmatch(r'ev_[a-f0-9]{64}', record['normalized_result']['parent_evidence_id'])
+                    and record['normalized_result'].get('parent_digest') == record['normalized_result']['parent_evidence_id'][3:]
+                    and record['normalized_result']['parent_evidence_id'] != record['evidence_id']
+                    and isinstance(record.get('evidence_links'), list)
+                    and record['normalized_result']['parent_evidence_id'] in record['evidence_links']
+                    for record in cited
+                ))
+            )
+            checks['pcap_cited_source_supports_uri_prefix'] = False
+            checks['pcap_cited_capture'] = False
+            if all(isinstance(record, dict) for record in cited):
+                if len(cited) == 1:
+                    source = cited[0]['normalized_result']
+                    check('pcap_cited_capture', json.dumps(answer.get('capture'), sort_keys=True),
+                          json.dumps(pcap_complete_capture(source), sort_keys=True))
+                    checks['pcap_cited_source_supports_uri_prefix'] = (
+                        source.get('target') == reference['capture']['target']
+                        and isinstance(source.get('http_request_uris'), list)
+                        and json.dumps(source['http_request_uris'][:2], sort_keys=True) == json.dumps(prefix, sort_keys=True)
+                    )
+                elif len(cited) == 2:
+                    source, page = [record['normalized_result'] for record in cited]
+                    capture = source.get('summary', {})
+                    check('pcap_cited_capture', json.dumps(answer.get('capture'), sort_keys=True),
+                          json.dumps(capture, sort_keys=True))
+                    selected_page = page.get('page', {})
+                    checks['pcap_cited_source_supports_uri_prefix'] = (
+                        source.get('kind') == 'summary'
+                        and source.get('parent_operation') == 'inspect_pcap_capture'
+                        and capture == reference['capture']
+                        and source.get('artifact') == {key: capture['target'][key] for key in ['path', 'sha256']}
+                        and isinstance(source.get('parent_evidence_id'), str)
+                        and page.get('parent_evidence_id') == source['parent_evidence_id']
+                        and page.get('parent_operation') == 'inspect_pcap_capture'
+                        and json.dumps(page.get('view'), sort_keys=True) == json.dumps({'kind': 'pcap', 'facet': 'http-uris', 'offset': 0, 'limit': 2}, sort_keys=True)
+                        and selected_page.get('facet') == 'http-uris'
+                        and json.dumps(selected_page.get('items'), sort_keys=True) == json.dumps(prefix, sort_keys=True)
+                        and page.get('source_coverage') == capture.get('coverage')
+                        and json.dumps(page.get('coverage'), sort_keys=True) == json.dumps(reference['delivery_observations'][-1].get('coverage'), sort_keys=True)
+                        and page.get('artifact') == {key: capture['target'][key] for key in ['path', 'sha256']}
+                    )
+        else:
+            checks['pcap_requested_delivery_chain'] = False
+            if len(reference['delivery_observations']) == 2:
+                checks['pcap_summary_coverage'] = False
+            checks['pcap_observations_have_reported_ids'] = False
+            checks['pcap_requested_views'] = False
+            checks['pcap_cited_source_supports_uri_prefix'] = False
+            checks['pcap_cited_capture'] = False
+            checks['pcap_cited_subjects_match_artifact'] = False
+            checks['pcap_cited_parents_linked'] = False
+            checks['pcap_cited_producer_tools'] = False
+            checks['pcap_cited_operations'] = False
+            checks['pcap_cited_call_arguments'] = False
+            checks['pcap_cited_parameters'] = False
     elif domain == 'flutter-aot':
         for key in ['target', 'abi', 'libapp', 'string_pool', 'coverage', 'limitations']:
             check(key, answer.get(key), reference[key])
@@ -323,6 +560,7 @@ def main():
                     statuses[status] = statuses.get(status, 0) + 1
             check('network_response_statuses', network['observed_response_statuses'], statuses)
     factual_checks = dict(checks)
+    checks.update(workflow_checks)
     scopes = [json.loads(line) for line in args.resource_log.read_text().splitlines() if line.startswith('{')]
     scope = next(value for value in reversed(scopes) if 'resource_scope' in value)
     checks['no_resource_abort'] = scope['abort'] is None
@@ -342,6 +580,8 @@ def main():
         'review_source_sha256': hashlib.sha256(Path(__file__).read_bytes()).hexdigest(),
         'domain': domain, 'checks': checks, 'all_selected_checks_pass': all(checks.values()),
         'factual_checks': factual_checks, 'all_factual_checks_pass': all(factual_checks.values()),
+        **({'workflow_checks': workflow_checks, 'all_workflow_checks_pass': all(workflow_checks.values())}
+           if domain == 'pcap' else {}),
         'differences': differences, 'tool_errors': tool_errors, 'summary': summary,
         'fingerprints': {key: value for key, value in settings.items() if 'sha256' in key or key in ['runtime_revision', 'enabled_tools', 'authority']},
         'answer_file_sha256': hashlib.sha256((args.trial / 'answer.txt').read_bytes()).hexdigest(),

experiments/analysis-efficiency/test_codex_context.py

@@ -1,6 +1,7 @@
 """Distinct capture/cleanup failures; simulated CLI is not real-model evidence."""
 
 import importlib.util
+import copy
 import io
 import json
 import os
@@ -38,6 +39,546 @@ class ManagedCoverageTests(unittest.TestCase):
         self.assertNotEqual(scope, expected)
 
 
+class PcapCoverageTests(unittest.TestCase):
+    def test_explicit_labels_preserve_original_nulls_and_source_scope(self):
+        canonical = runpy.run_path(str(Path(__file__).with_name('review-model.py')))['pcap_observation_fields']
+        original = {'outer_limitations': [], 'normalized_kind': 'pcap',
+                    'normalized_coverage': {'examined': 2, 'total': 23, 'next_offset': 2, 'exhausted': False},
+                    'normalized_source_coverage': 'partial', 'normalized_parent_evidence_id': None}
+        result = canonical(original)
+        self.assertEqual(result['limitations'], [])
+        self.assertEqual(result['source_coverage'], 'partial')
+        self.assertEqual(result['coverage']['total'], 23)
+        self.assertIsNone(result['parent_evidence_id'])
+        self.assertIn('outer_limitations', original)
+        self.assertNotIn('parent_evidence_id', canonical({}))
+
+    def test_conflicting_duplicates_and_json_type_substitutions_stay_failures(self):
+        canonical = runpy.run_path(str(Path(__file__).with_name('review-model.py')))['pcap_observation_fields']
+        for wrong in ['partial', None]:
+            result = canonical({'normalized_source_coverage': 'complete', 'source_coverage': wrong})
+            self.assertIn('conflicting_fields', result)
+            self.assertEqual(result['normalized_source_coverage'], 'complete')
+            self.assertEqual(result['source_coverage'], wrong)
+        result = canonical({'normalized_coverage': {'examined': 1}, 'coverage': {'examined': True}})
+        self.assertIn('conflicting_fields', result)
+        self.assertEqual(canonical({'outer_limitations': [], 'limitations': []}), {'limitations': []})
+
+    def test_unsupported_claims_are_retained_for_exact_producer_checking(self):
+        canonical = runpy.run_path(str(Path(__file__).with_name('review-model.py')))['pcap_observation_fields']
+        original = {'normalized_kind': 'pcap', 'unrecorded_traffic_absent': True}
+        self.assertIn('unrecorded_traffic_absent', canonical(original))
+        self.assertIsNone(canonical(None))
+
+
+class PcapGraderWorkflowTests(unittest.TestCase):
+    """Synthetic receipts test the grader boundary, not Wireshark or real models."""
+
+    def fixture(self):
+        parent, summary_id, page_id = ['ev_' + value * 64 for value in ['a', 'b', 'c']]
+        capture = {'target': {'path': '/fixture/http.pcapng', 'sha256': 'd' * 64},
+                   'capture_start': None, 'coverage': 'complete',
+                   'retained_counts': {'http_request_uris': 3}}
+        prefix = ['http://example.test/one', 'http://example.test/two']
+        coverage = {'status': 'page', 'examined': 2, 'total': 3, 'next_offset': 2, 'exhausted': False}
+        subject = {'digest': {'sha256': capture['target']['sha256']}, 'local_path': capture['target']['path']}
+        summary = {'evidence_id': summary_id, 'operation': 'inspect_analysis_view',
+                   'subject': copy.deepcopy(subject), 'evidence_links': [parent],
+                   'limitations': ['source', 'view'],
+                   'normalized_result': {'kind': 'summary', 'view': {'kind': 'summary'},
+                       'parent_operation': 'inspect_pcap_capture', 'parent_evidence_id': parent,
+                       'summary': capture, 'artifact': copy.deepcopy(capture['target']),
+                       'coverage': {'status': 'complete-within-view', 'examined': 1, 'total': 1, 'next_offset': None, 'exhausted': True},
+                       'limitations': ['source', 'view'], 'unknowns': ['unrecorded traffic']}}
+        page = {'evidence_id': page_id, 'operation': 'inspect_analysis_view',
+                'subject': copy.deepcopy(subject), 'evidence_links': [parent],
+                'limitations': ['source', 'view'],
+                'normalized_result': {'kind': 'pcap',
+                    'view': {'kind': 'pcap', 'facet': 'http-uris', 'offset': 0, 'limit': 2},
+                    'parent_operation': 'inspect_pcap_capture', 'parent_evidence_id': parent,
+                    'page': {'facet': 'http-uris', 'items': prefix}, 'coverage': coverage,
+                    'source_coverage': 'complete', 'artifact': capture['target'],
+                    'limitations': ['source', 'view'], 'unknowns': ['unrecorded traffic']}}
+        for record in [summary, page]:
+            record['normalized_result']['parent_digest'] = parent[3:]
+            record['parameters'] = {'parent_evidence_id': parent, 'view': copy.deepcopy(record['normalized_result']['view'])}
+        observations = [self.observation(value) for value in [summary, page]]
+        reference = {'artifact_sha256': 'd' * 64, 'capture': capture,
+                     'http_request_uris_first2': prefix, 'delivery_observations': observations}
+        answer = copy.deepcopy({**reference, 'http_request_uris_first2': {
+            'items': prefix, 'coverage': coverage, 'source_coverage': 'complete'},
+            'evidence_ids': [summary_id, page_id]})
+        return answer, [summary, page], copy.deepcopy(reference)
+
+    def observation(self, record):
+        value = record['normalized_result']
+        return {'evidence_id': record['evidence_id'], 'limitations': record['limitations'],
+                'kind': value['kind'], 'view': value['view'],
+                'parent_evidence_id': value['parent_evidence_id'], 'coverage': value['coverage'],
+                'unknowns': value['unknowns'], 'normalized_limitations': value['limitations']}
+
+    def grade(self, answer, records, reference, producer_tools=None, producer_arguments=None, extra_events=None, producer_results=None):
+        review = runpy.run_path(str(Path(__file__).with_name('review-model.py')))
+        with tempfile.TemporaryDirectory() as directory:
+            root = Path(directory);trial = root / 'trial';trial.mkdir()
+            for name, value in [('summary.json', {'completed_mcp_calls': []}),
+                                ('trial-settings.json', {}), ('cleanup.json', {'profile_removed': True})]:
+                (trial / name).write_text(json.dumps(value))
+            (trial / 'answer.txt').write_text(json.dumps(answer))
+            events = []
+            for index, value in enumerate(records):
+                tool = producer_tools[index] if producer_tools is not None else \
+                    ('inspect_analysis_view' if value['normalized_result'].get('kind') == 'pcap' else 'inspect_pcap_capture')
+                arguments = {'path': reference['capture']['target']['path']}
+                if tool == 'inspect_analysis_view':
+                    normalized = value.get('normalized_result')
+                    parent = normalized.get('parent_evidence_id') if isinstance(normalized, dict) else None
+                    arguments = {'source': {'kind': 'retained-evidence', 'evidence_id': parent},
+                                 'view': reference['delivery_observations'][-1].get('view')}
+                elif len(reference['delivery_observations']) == 2:
+                    arguments['detail'] = 'summary'
+                if producer_arguments is not None:
+                    arguments = producer_arguments[index]
+                events.append({'type': 'item.completed', 'item': {'type': 'mcp_tool_call',
+                               'tool': tool, 'arguments': arguments, 'status': 'completed',
+                               'result': {'structuredContent': value} if producer_results is None else producer_results[index]}})
+            events.extend(extra_events or [])
+            (trial / 'events.jsonl').write_text(''.join(json.dumps(value) + '\n' for value in events))
+            source = root / 'reference';source.mkdir();(source / 'answer.json').write_text(json.dumps(reference))
+            resource = root / 'resource.log'
+            resource.write_text(json.dumps({'resource_scope': 'simulated-grader-only', 'abort': None,
+                                           'resource_counters_verified': False, 'resource_events_final': None}) + '\n')
+            output = root / 'review.json'
+            argv = ['review-model.py', '--domain', 'pcap', '--trial', str(trial), '--reference', str(source),
+                    '--resource-log', str(resource), '--output', str(output)]
+            with patch.object(sys, 'argv', argv), patch('sys.stdout', io.StringIO()), self.assertRaises(SystemExit) as stopped:
+                review['main']()
+            self.assertEqual(stopped.exception.code, 1)  # Unknown resource counters stay false.
+            return json.loads(output.read_text())
+
+    def test_complete_grader_accepts_supported_receipts_and_equivalent_labels(self):
+        answer, records, reference = self.fixture()
+        self.assertTrue(self.grade(answer, records, reference)['all_factual_checks_pass'])
+        for observation in answer['delivery_observations']:
+            observation['outer_limitations'] = observation.pop('limitations')
+            observation['normalized_coverage'] = observation.pop('coverage')
+        self.assertTrue(self.grade(answer, records, reference)['all_factual_checks_pass'])
+
+    def test_complete_grader_rejects_missing_nulls_bad_scope_and_malformed_identity(self):
+        mutations = [lambda x: x['capture'].pop('capture_start'),
+                     lambda x: x['http_request_uris_first2']['coverage'].__setitem__('exhausted', True),
+                     lambda x: x['delivery_observations'][-1].__setitem__('evidence_id', {'unexpected': 'value'}),
+                     lambda x: x['delivery_observations'][-1].__setitem__('unrecorded_traffic_absent', True)]
+        for mutate in mutations:
+            with self.subTest(mutation=mutate):
+                answer, records, reference = self.fixture();mutate(answer)
+                self.assertFalse(self.grade(answer, records, reference)['all_factual_checks_pass'])
+
+    def test_faithful_wrong_receipts_do_not_support_the_reported_uri_prefix(self):
+        for wrong in ['facet', 'range', 'parent']:
+            with self.subTest(wrong=wrong):
+                answer, records, reference = self.fixture()
+                page = copy.deepcopy(records[-1]);page['evidence_id'] = 'ev_' + 'e' * 64
+                value = page['normalized_result']
+                if wrong == 'facet':
+                    value['view']['facet'] = 'endpoints'
+                    value['page'] = {'facet': 'endpoints', 'items': [{'address': '127.0.0.1'}]}
+                elif wrong == 'range':
+                    value['view']['offset'] = 1
+                    value['page']['items'] = ['http://example.test/two', 'http://example.test/three']
+                else:
+                    value['parent_evidence_id'] = 'ev_' + 'f' * 64
+                records.append(page)
+                answer['delivery_observations'][-1] = self.observation(page)
+                answer['evidence_ids'][-1] = page['evidence_id']
+                report = self.grade(answer, records, reference)
+                self.assertTrue(report['factual_checks']['pcap_original_delivery_observations'])
+                self.assertFalse(report['factual_checks']['pcap_cited_source_supports_uri_prefix'])
+                self.assertFalse(report['all_factual_checks_pass'])
+
+    def test_complete_receipt_metadata_counts_and_diagnostics_support_reported_capture(self):
+        answer, records, reference = self.fixture()
+        capture = reference['capture']
+        capture.update({'packet_count': 3, 'client': {'name': 'fixture', 'version': '1'},
+                        'retained_counts': {key: 0 for key in ['endpoints', 'dns_queries', 'tls_sni_values',
+                                            'protocol_distribution', 'http_request_uris', 'unattributed_dns_addresses']},
+                        'diagnostics_code_units': {'tshark': 0, 'capinfos': 2}})
+        capture['retained_counts']['http_request_uris'] = 3
+        source = {key: value for key, value in capture.items() if key not in ['retained_counts', 'diagnostics_code_units']}
+        source.update({key: [] for key in capture['retained_counts']})
+        source['http_request_uris'] = reference['http_request_uris_first2'] + ['http://example.test/three']
+        source['diagnostics'] = {'tshark_stderr': '', 'capinfos_stderr': '\U0001f4a5'}
+        receipt = {'evidence_id': 'ev_' + 'a' * 64, 'operation': 'inspect_pcap_capture',
+                   'parameters': {'path': source['target']['path']},
+                   'subject': copy.deepcopy(records[0]['subject']), 'evidence_links': [],
+                   'limitations': ['source'], 'normalized_result': source}
+        reference['delivery_observations'] = [{'evidence_id': receipt['evidence_id'],
+                                              'limitations': receipt['limitations'], 'coverage': source['coverage']}]
+        answer = copy.deepcopy({**reference, 'evidence_ids': [receipt['evidence_id']]})
+        self.assertTrue(self.grade(answer, [receipt], reference)['all_factual_checks_pass'])
+        for parameters in [None, {}, {'path': '/fixture/other.pcapng'}]:
+            changed = copy.deepcopy(receipt);changed['parameters'] = parameters
+            report = self.grade(answer, [changed], reference)
+            self.assertFalse(report['factual_checks']['pcap_cited_parameters'])
+            self.assertFalse(report['all_factual_checks_pass'])
+        self.assertFalse(self.grade(answer, [receipt], reference,
+                                   producer_arguments=[{'path': '/fixture/other.pcapng'}])['all_factual_checks_pass'])
+        self.assertFalse(self.grade(answer, [receipt], reference, ['inspect_analysis_view'])['all_factual_checks_pass'])
+        wrong_operation = copy.deepcopy(receipt);wrong_operation['operation'] = 'inspect_analysis_view'
+        self.assertFalse(self.grade(answer, [wrong_operation], reference)['all_factual_checks_pass'])
+        for subject in [None, {'digest': {'sha256': 'e' * 64}, 'local_path': source['target']['path']}]:
+            changed = copy.deepcopy(receipt);changed['subject'] = subject
+            report = self.grade(answer, [changed], reference)
+            self.assertTrue(report['factual_checks']['pcap_cited_capture'])
+            self.assertFalse(report['factual_checks']['pcap_cited_subjects_match_artifact'])
+            self.assertFalse(report['all_factual_checks_pass'])
+        mutations = [lambda x: x.__setitem__('packet_count', 4),
+                     lambda x: x['client'].__setitem__('version', '2'),
+                     lambda x: x.__setitem__('capture_start', 'changed'),
+                     lambda x: x.__setitem__('coverage', 'partial'),
+                     lambda x: x['endpoints'].append({'address': '127.0.0.1'}),
+                     lambda x: x['diagnostics'].__setitem__('capinfos_stderr', '')]
+        for mutate in mutations:
+            changed = copy.deepcopy(receipt);mutate(changed['normalized_result'])
+            report = self.grade(answer, [changed], reference)
+            self.assertTrue(report['factual_checks']['capture'])
+            self.assertFalse(report['factual_checks']['pcap_cited_capture'])
+            self.assertFalse(report['all_factual_checks_pass'])
+        receipt['normalized_result'].pop('diagnostics')
+        reference['capture']['diagnostics_code_units'] = None
+        answer['capture']['diagnostics_code_units'] = None
+        self.assertTrue(self.grade(answer, [receipt], reference)['all_factual_checks_pass'])
+
+    def test_cited_receipt_subjects_must_identify_the_reference_capture(self):
+        for index in [0, 1]:
+            for subject in [None, [], 'artifact', {}, {'digest': None},
+                            {'digest': {'sha256': 'e' * 64}, 'local_path': '/fixture/http.pcapng'},
+                            {'digest': {'sha256': 'd' * 64}, 'local_path': '/fixture/other.pcapng'}]:
+                with self.subTest(index=index, subject=subject):
+                    answer, records, reference = self.fixture()
+                    records[index]['subject'] = subject
+                    report = self.grade(answer, records, reference)
+                    self.assertTrue(report['factual_checks']['pcap_original_delivery_observations'])
+                    self.assertFalse(report['factual_checks']['pcap_cited_subjects_match_artifact'])
+                    self.assertFalse(report['all_factual_checks_pass'])
+            answer, records, reference = self.fixture();records[index].pop('subject')
+            self.assertFalse(self.grade(answer, records, reference)['all_factual_checks_pass'])
+
+    def test_faithful_inconsistent_page_coverage_does_not_support_the_prefix(self):
+        for field, wrong in [('status', 'complete-within-view'), ('next_offset', None), ('exhausted', True)]:
+            with self.subTest(field=field):
+                answer, records, reference = self.fixture()
+                records[-1]['normalized_result']['coverage'][field] = wrong
+                answer['delivery_observations'][-1] = self.observation(records[-1])
+                answer['http_request_uris_first2']['coverage'][field] = wrong
+                report = self.grade(answer, records, reference)
+                self.assertTrue(report['factual_checks']['pcap_original_delivery_observations'])
+                self.assertTrue(report['factual_checks']['pcap_prefix_coverage_observed'])
+                self.assertFalse(report['factual_checks']['pcap_cited_source_supports_uri_prefix'])
+                self.assertFalse(report['all_factual_checks_pass'])
+
+    def test_cited_coverage_preserves_exact_json_scalar_types(self):
+        for field, wrong in [('exhausted', 0), ('examined', 2.0), ('total', 3.0), ('next_offset', 2.0)]:
+            with self.subTest(field=field):
+                answer, records, reference = self.fixture()
+                records[-1]['normalized_result']['coverage'][field] = wrong
+                answer['delivery_observations'][-1] = self.observation(records[-1])
+                answer['http_request_uris_first2']['coverage'][field] = wrong
+                report = self.grade(answer, records, reference)
+                self.assertTrue(report['factual_checks']['pcap_original_delivery_observations'])
+                self.assertTrue(report['factual_checks']['pcap_prefix_coverage_observed'])
+                self.assertFalse(report['all_factual_checks_pass'])
+
+    def test_cited_views_preserve_exact_json_scalar_types(self):
+        for field, wrong in [('offset', False), ('offset', 0.0), ('limit', 2.0), ('limit', True)]:
+            with self.subTest(field=field, wrong=wrong):
+                answer, records, reference = self.fixture()
+                records[-1]['normalized_result']['view'][field] = wrong
+                answer['delivery_observations'][-1] = self.observation(records[-1])
+                report = self.grade(answer, records, reference)
+                self.assertTrue(report['factual_checks']['pcap_original_delivery_observations'])
+                self.assertFalse(report['factual_checks']['pcap_requested_views'])
+                self.assertFalse(report['factual_checks']['pcap_cited_source_supports_uri_prefix'])
+                self.assertFalse(report['all_factual_checks_pass'])
+
+    def test_empty_delivery_observations_write_failed_facts(self):
+        answer, records, reference = self.fixture()
+        answer['delivery_observations'] = []
+        answer['evidence_ids'] = []
+        report = self.grade(answer, records, reference)
+        self.assertFalse(report['factual_checks']['pcap_delivery_observations_nonempty'])
+        self.assertFalse(report['factual_checks']['pcap_cited_call_arguments'])
+        self.assertFalse(report['factual_checks']['pcap_cited_parameters'])
+        self.assertFalse(report['all_factual_checks_pass'])
+
+    def test_cited_view_parameters_and_call_arguments_bind_actual_requests(self):
+        for index in [0, 1]:
+            for parameters in [None, {}, {'parent_evidence_id': 'ev_' + 'f' * 64,
+                                          'view': {'kind': 'summary'}}]:
+                with self.subTest(index=index, parameters=parameters):
+                    answer, records, reference = self.fixture()
+                    records[index]['parameters'] = parameters
+                    report = self.grade(answer, records, reference)
+                    self.assertTrue(report['factual_checks']['pcap_original_delivery_observations'])
+                    self.assertFalse(report['factual_checks']['pcap_cited_parameters'])
+                    self.assertFalse(report['all_factual_checks_pass'])
+        for wrong in [None, {}, {'source': {'kind': 'retained-evidence', 'evidence_id': 'ev_' + 'f' * 64},
+                                'view': {'kind': 'pcap', 'facet': 'http-uris', 'offset': 0, 'limit': 2}},
+                      {'source': {'kind': 'retained-evidence', 'evidence_id': 'ev_' + 'a' * 64},
+                       'view': {'kind': 'pcap', 'facet': 'http-uris', 'offset': False, 'limit': 2}}]:
+            with self.subTest(arguments=wrong):
+                answer, records, reference = self.fixture()
+                report = self.grade(answer, records, reference,
+                                    producer_arguments=[{'path': reference['capture']['target']['path'], 'detail': 'summary'}, wrong])
+                self.assertFalse(report['factual_checks']['pcap_cited_call_arguments'])
+                self.assertFalse(report['all_factual_checks_pass'])
+
+    def test_malformed_receipt_envelopes_write_failed_facts_instead_of_crashing(self):
+        tools = ['inspect_pcap_capture', 'inspect_analysis_view']
+        for index in [0, 1]:
+            for field, wrong in [('normalized_result', None), ('normalized_result', []),
+                                 ('normalized_result', 'capture'), ('limitations', None),
+                                 ('limitations', {}), ('limitations', [None]),
+                                 ('limitations', ['source', 1])]:
+                with self.subTest(index=index, field=field, wrong=wrong):
+                    answer, records, reference = self.fixture();records[index][field] = wrong
+                    if field == 'limitations':
+                        answer['delivery_observations'][index]['limitations'] = copy.deepcopy(wrong)
+                    report = self.grade(answer, records, reference, tools)
+                    self.assertTrue(report['factual_checks']['capture'])
+                    self.assertFalse(report['all_factual_checks_pass'])
+            for field in ['normalized_result', 'limitations']:
+                with self.subTest(index=index, missing=field):
+                    answer, records, reference = self.fixture();records[index].pop(field)
+                    self.assertFalse(self.grade(answer, records, reference, tools)['all_factual_checks_pass'])
+        for index, field in [(0, 'summary'), (1, 'page')]:
+            for wrong in [None, [], 'view']:
+                with self.subTest(index=index, nested=field, wrong=wrong):
+                    answer, records, reference = self.fixture();records[index]['normalized_result'][field] = wrong
+                    self.assertFalse(self.grade(answer, records, reference, tools)['all_factual_checks_pass'])
+
+    def test_retained_parent_digest_must_match_its_declared_identity(self):
+        for index in [0, 1]:
+            for digest in [None, {}, [], True, 'digest', 'e' * 64]:
+                with self.subTest(index=index, digest=digest):
+                    answer, records, reference = self.fixture()
+                    records[index]['normalized_result']['parent_digest'] = digest
+                    report = self.grade(answer, records, reference)
+                    self.assertTrue(report['factual_checks']['pcap_original_delivery_observations'])
+                    self.assertFalse(report['all_factual_checks_pass'])
+            answer, records, reference = self.fixture()
+            records[index]['normalized_result'].pop('parent_digest')
+            self.assertFalse(self.grade(answer, records, reference)['all_factual_checks_pass'])
+
+    def test_summary_outer_artifact_must_identify_the_selected_capture(self):
+        for wrong in [None, {}, [], 'artifact',
+                      {'path': '/fixture/other.pcapng', 'sha256': 'd' * 64},
+                      {'path': '/fixture/http.pcapng', 'sha256': 'e' * 64}]:
+            with self.subTest(artifact=wrong):
+                answer, records, reference = self.fixture()
+                records[0]['normalized_result']['artifact'] = wrong
+                report = self.grade(answer, records, reference)
+                self.assertTrue(report['factual_checks']['pcap_original_delivery_observations'])
+                self.assertFalse(report['all_factual_checks_pass'])
+        answer, records, reference = self.fixture()
+        records[0]['normalized_result'].pop('artifact')
+        self.assertFalse(self.grade(answer, records, reference)['all_factual_checks_pass'])
+
+    def test_faithful_summary_coverage_must_describe_the_single_complete_view(self):
+        for field, wrong in [('status', 'page'), ('examined', 0), ('total', 2),
+                             ('next_offset', 0), ('exhausted', False), ('examined', 1.0)]:
+            with self.subTest(field=field, wrong=wrong):
+                answer, records, reference = self.fixture()
+                records[0]['normalized_result']['coverage'][field] = wrong
+                answer['delivery_observations'][0] = self.observation(records[0])
+                report = self.grade(answer, records, reference)
+                self.assertTrue(report['factual_checks']['pcap_original_delivery_observations'])
+                self.assertFalse(report['all_factual_checks_pass'])
+
+    def test_present_normalized_provenance_requires_string_arrays(self):
+        for index in [0, 1]:
+            for field in ['limitations', 'unknowns']:
+                for wrong in [None, {}, 'scope', [None], [1]]:
+                    with self.subTest(index=index, field=field, wrong=wrong):
+                        answer, records, reference = self.fixture()
+                        records[index]['normalized_result'][field] = wrong
+                        answer['delivery_observations'][index] = self.observation(records[index])
+                        self.assertFalse(self.grade(answer, records, reference)['all_factual_checks_pass'])
+                for empty in [True, False]:
+                    answer, records, reference = self.fixture()
+                    key = 'normalized_limitations' if field == 'limitations' else field
+                    if empty:
+                        records[index]['normalized_result'][field] = []
+                        answer['delivery_observations'][index][key] = []
+                    else:
+                        records[index]['normalized_result'].pop(field)
+                        answer['delivery_observations'][index].pop(key)
+                    self.assertTrue(self.grade(answer, records, reference)['all_factual_checks_pass'])
+
+    def test_missing_or_wrong_kind_does_not_hide_malformed_view_containers(self):
+        for index, container in [(0, 'summary'), (1, 'page')]:
+            for kind in [None, 'unexpected']:
+                for wrong in [None, [], 'view']:
+                    with self.subTest(index=index, kind=kind, container=container):
+                        answer, records, reference = self.fixture()
+                        if kind is None:
+                            records[index]['normalized_result'].pop('kind')
+                        else:
+                            records[index]['normalized_result']['kind'] = kind
+                        records[index]['normalized_result'][container] = wrong
+                        report = self.grade(answer, records, reference,
+                                            producer_tools=['inspect_pcap_capture', 'inspect_analysis_view'])
+                        self.assertFalse(report['all_factual_checks_pass'])
+
+    def test_retained_parents_require_declared_distinct_evidence_links(self):
+        for index in [0, 1]:
+            for links in [None, [], ['ev_' + 'f' * 64], {'parent': 'ev_' + 'a' * 64}]:
+                with self.subTest(index=index, links=links):
+                    answer, records, reference = self.fixture();records[index]['evidence_links'] = links
+                    report = self.grade(answer, records, reference)
+                    self.assertTrue(report['factual_checks']['pcap_original_delivery_observations'])
+                    self.assertFalse(report['factual_checks']['pcap_cited_parents_linked'])
+                    self.assertFalse(report['all_factual_checks_pass'])
+            answer, records, reference = self.fixture();records[index].pop('evidence_links')
+            self.assertFalse(self.grade(answer, records, reference)['all_factual_checks_pass'])
+            answer, records, reference = self.fixture()
+            parent = records[index]['evidence_id']
+            for record in records:
+                record['normalized_result']['parent_evidence_id'] = parent;record['evidence_links'] = [parent]
+            answer['delivery_observations'] = [self.observation(record) for record in records]
+            report = self.grade(answer, records, reference)
+            self.assertFalse(report['factual_checks']['pcap_cited_parents_linked'])
+            self.assertFalse(report['all_factual_checks_pass'])
+
+    def test_cited_receipts_preserve_tool_and_delegated_operation_provenance(self):
+        for tools in [['inspect_analysis_view', 'inspect_analysis_view'],
+                      ['inspect_pcap_capture', 'inspect_pcap_capture'],
+                      ['unrelated_tool', 'inspect_analysis_view']]:
+            with self.subTest(tools=tools):
+                answer, records, reference = self.fixture()
+                report = self.grade(answer, records, reference, tools)
+                self.assertTrue(report['factual_checks']['pcap_original_delivery_observations'])
+                self.assertFalse(report['all_factual_checks_pass'])
+        for index in [0, 1]:
+            answer, records, reference = self.fixture();records[index]['operation'] = 'inspect_pcap_capture'
+            self.assertFalse(self.grade(answer, records, reference)['all_factual_checks_pass'])
+
+    def test_failed_reply_shapes_preserve_a_written_report_and_partial_facts(self):
+        payloads = ['malformed', [1], None, False, 7, {'error': 'malformed'},
+                    {'error': []}, {'error': None}]
+        payloads += [{'error': {'code': 'resource_constraint', 'details': value}}
+                     for value in [None, [], 'details']]
+        payloads += [{'error': {'code': 'resource_constraint', 'details': {'reported_limits': value}}}
+                     for value in [None, [], 'limits']]
+        for payload in payloads:
+            with self.subTest(payload=payload):
+                answer, records, reference = self.fixture()
+                result = {'structuredContent': payload}
+                event = {'type': 'item.completed', 'item': {
+                    'type': 'mcp_tool_call', 'tool': 'inspect_analysis_view', 'status': 'failed',
+                    'arguments': {'view': {'kind': 'pcap', 'facet': 'endpoints'}}, 'result': result}}
+                report = self.grade(answer, records, reference, extra_events=[event])
+                self.assertTrue(report['all_factual_checks_pass'])
+                self.assertFalse(report['all_workflow_checks_pass'])
+                self.assertEqual(report['tool_errors'][-1]['response'], payload if payload is not None else result)
+        answer, records, reference = self.fixture()
+        partial_id = 'ev_' + 'e' * 64
+        payload = {'error': {'code': 'resource_constraint', 'details': {
+            'reported_limits': {'evidence_reference': {'evidence_id': partial_id}}}}}
+        event = {'type': 'item.completed', 'item': {
+            'type': 'mcp_tool_call', 'tool': 'inspect_analysis_view', 'status': 'failed',
+            'arguments': {}, 'result': {'structuredContent': payload}}}
+        answer['evidence_ids'].append(partial_id)
+        report = self.grade(answer, records, reference, extra_events=[event])
+        self.assertTrue(report['factual_checks']['reported_evidence_ids_observed_in_responses'])
+        self.assertFalse(report['all_factual_checks_pass'])
+        self.assertFalse(report['all_workflow_checks_pass'])
+
+    def test_workflow_citation_count_must_match_the_planned_calls(self):
+        for count, made_page_call in [(1, False), (1, True), (3, True)]:
+            with self.subTest(count=count, made_page_call=made_page_call):
+                answer, records, reference = self.fixture()
+                if count == 1:
+                    answer['delivery_observations'] = answer['delivery_observations'][:1]
+                    answer['evidence_ids'] = answer['evidence_ids'][:1]
+                else:
+                    extra = copy.deepcopy(answer['delivery_observations'][-1])
+                    extra['evidence_id'] = 'ev_' + 'e' * 64
+                    answer['delivery_observations'].append(extra)
+                    answer['evidence_ids'].append(extra['evidence_id'])
+                report = self.grade(answer, records if made_page_call else records[:1], reference)
+                self.assertFalse(report['all_factual_checks_pass'])
+                self.assertFalse(report['all_workflow_checks_pass'])
+
+    def test_unreadable_planned_reply_does_not_pass_workflow_acceptance(self):
+        answer, records, reference = self.fixture()
+        report = self.grade(answer, records, reference,
+                            producer_results=[{'structuredContent': records[0]}, {}])
+        self.assertFalse(report['all_factual_checks_pass'])
+        self.assertFalse(report['all_workflow_checks_pass'])
+
+    def test_extra_calls_are_not_an_equivalent_workflow_even_with_correct_facts(self):
+        for status in ['completed', 'failed']:
+            for with_receipt in [True, False]:
+                with self.subTest(status=status, with_receipt=with_receipt):
+                    answer, records, reference = self.fixture()
+                    extra = copy.deepcopy(records[-1]);extra['evidence_id'] = 'ev_' + 'e' * 64
+                    extra['normalized_result']['view']['facet'] = 'endpoints'
+                    event = {'type': 'item.completed', 'item': {
+                        'type': 'mcp_tool_call', 'tool': 'inspect_analysis_view', 'status': status,
+                        'arguments': {'source': {'kind': 'retained-evidence', 'evidence_id': 'ev_' + 'a' * 64},
+                                      'view': extra['normalized_result']['view']},
+                        'result': {'structuredContent': extra} if with_receipt else {}}}
+                    report = self.grade(answer, records, reference, extra_events=[event])
+                    self.assertTrue(report['all_factual_checks_pass'])
+                    self.assertFalse(report.get('all_workflow_checks_pass', True))
+        answer, records, reference = self.fixture()
+        report = self.grade(answer, records[::-1], reference)
+        self.assertTrue(report['all_factual_checks_pass'])
+        self.assertFalse(report.get('all_workflow_checks_pass', True))
+
+    def test_repeated_identical_receipts_pass_but_conflicting_id_ownership_fails(self):
+        answer, records, reference = self.fixture();duplicate = copy.deepcopy(records[0])
+        report = self.grade(answer, [duplicate, *records], reference)
+        self.assertTrue(report['all_factual_checks_pass'])
+        self.assertFalse(report['all_workflow_checks_pass'])
+        for duplicate_first in [True, False]:
+            with self.subTest(duplicate_first=duplicate_first):
+                items = [duplicate, *records] if duplicate_first else [*records, duplicate]
+                tools = ['unrelated_tool', 'inspect_pcap_capture', 'inspect_analysis_view'] if duplicate_first else \
+                        ['inspect_pcap_capture', 'inspect_analysis_view', 'unrelated_tool']
+                self.assertFalse(self.grade(answer, items, reference, tools)['all_factual_checks_pass'])
+        duplicate = copy.deepcopy(records[-1]);duplicate['normalized_result']['coverage']['exhausted'] = 0
+        for items in [[*records, duplicate], [records[0], duplicate, records[-1]]]:
+            self.assertFalse(self.grade(answer, items, reference)['all_factual_checks_pass'])
+
+    def test_reported_ids_are_only_the_ordered_unique_response_receipts(self):
+        answer, records, reference = self.fixture()
+        original = answer['evidence_ids']
+        parent = records[0]['normalized_result']['parent_evidence_id']
+        for ids in [original + [parent], original + [original[-1]], original[::-1],
+                    [parent, *original], [original], {'receipts': original},
+                    [*original, {'extra': parent}], original + ['not-an-id']]:
+            with self.subTest(ids=ids):
+                changed = copy.deepcopy(answer);changed['evidence_ids'] = ids
+                report = self.grade(changed, records, reference)
+                self.assertFalse(report['factual_checks']['pcap_observations_have_reported_ids'])
+                self.assertFalse(report['all_factual_checks_pass'])
+
+    def test_prefix_coverage_must_come_from_the_cited_uri_receipt(self):
+        answer, records, reference = self.fixture()
+        extra = copy.deepcopy(records[-1]);extra['evidence_id'] = 'ev_' + 'e' * 64
+        extra['normalized_result']['coverage']['next_offset'] = None
+        extra['normalized_result']['coverage']['exhausted'] = True
+        records.append(extra)
+        answer['http_request_uris_first2']['coverage'] = extra['normalized_result']['coverage']
+        report = self.grade(answer, records, reference)
+        self.assertTrue(report['factual_checks']['pcap_original_delivery_observations'])
+        self.assertTrue(report['factual_checks']['pcap_cited_source_supports_uri_prefix'])
+        self.assertFalse(report['factual_checks']['pcap_prefix_coverage_observed'])
+        self.assertFalse(report['all_factual_checks_pass'])
+
+
 class ContextCaptureTests(unittest.TestCase):
     def test_filters_ambient_account_and_nested_usage_state(self):
         with tempfile.TemporaryDirectory() as directory:

licenses/npm-dependencies.txt

@@ -2,7 +2,7 @@ REA npm dependency inventory
 Prepared from the root package-lock.json; refresh this inventory when locked dependencies change.
 License identifiers are upstream lockfile declarations, not a legal assessment.
 Runtime includes transitive and optional platform packages; development includes build, test and website tooling.
-Locked package entries: 719; runtime: 175.
+Locked package entries: 721; runtime: 177.
 Full runtime copyright/license/NOTICE texts: npm-runtime-notices.txt.
 
 @algolia/abtesting@1.25.0 | development | MIT
@@ -3000,6 +3000,11 @@ safer-buffer@2.1.2 | development | MIT
   Package: https://www.npmjs.com/package/safer-buffer/v/2.1.2
   Archive: https://registry.npmjs.org/safer-buffer/-/safer-buffer-2.1.2.tgz
   Integrity: sha512-YZo3K82SD7Riyi0E1EQPojLz7kpepnSQI9IyPbHHg1XXXevb5dJI7tpyN2ADxGcQbHG7vcyRHk0cbwqcQriUtg==
+saxes@6.0.0 | runtime | ISC
+  Lockfile path: node_modules/saxes
+  Package: https://www.npmjs.com/package/saxes/v/6.0.0
+  Archive: https://registry.npmjs.org/saxes/-/saxes-6.0.0.tgz
+  Integrity: sha512-xAg7SOnEhrm5zI3puOOKyy1OMcMlIJZYNJY7xLBwSze0UjhPLnWfj2GF2EpT0jmzaJKIWKHLsaSSajf35bcYnA==
 search-insights@2.17.3 | development | MIT
   Lockfile path: node_modules/search-insights
   Package: https://www.npmjs.com/package/search-insights/v/2.17.3
@@ -3580,6 +3585,11 @@ xmlbuilder@15.1.1 | runtime | MIT
   Package: https://www.npmjs.com/package/xmlbuilder/v/15.1.1
   Archive: https://registry.npmjs.org/xmlbuilder/-/xmlbuilder-15.1.1.tgz
   Integrity: sha512-yMqGBqtXyeN1e3TGYvgNgDVZ3j84W4cwkOXQswghol6APgZWaff9lnbvN7MHYJOiXsvGPXtjTYJEiC9J2wv9Eg==
+xmlchars@2.2.0 | runtime | MIT
+  Lockfile path: node_modules/xmlchars
+  Package: https://www.npmjs.com/package/xmlchars/v/2.2.0
+  Archive: https://registry.npmjs.org/xmlchars/-/xmlchars-2.2.0.tgz
+  Integrity: sha512-JZnDKK8B0RCDw84FNdDAIpZK+JuJw+s7Lz8nksI7SIuU3UXJJslUthsi+uWBUYOwPFwW7W7PRLRfUKpxjtjFCw==
 yaml@2.9.0 | runtime | ISC
   Lockfile path: node_modules/yaml
   Package: https://www.npmjs.com/package/yaml/v/2.9.0

licenses/npm-runtime-notices.txt

@@ -1,7 +1,7 @@
 REA third-party npm runtime copyright, license and NOTICE texts
 Collected from integrity-verified locked npm archives. Release-specific supplements and upstream notice gaps are identified in their entries.
 External engines are separately obtained; see THIRD_PARTY_NOTICES.md.
-Runtime dependency fingerprint (SHA-256): b0d0151958456c6e72c5720af80d783893be88a7b4c9a409db8505296fe10bd9
+Runtime dependency fingerprint (SHA-256): 49b181923ab240c68c64d35ecdd8f93cb5cd516c765f2282d0e0eca0bcadd13e
 
 ===== @babel/helper-string-parser@8.0.6 =====
 Declared license: MIT
@@ -8441,3 +8441,108 @@ HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY,
 WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING
 FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR
 OTHER DEALINGS IN THE SOFTWARE.
+
+===== saxes@6.0.0 =====
+Declared license: ISC
+Archive: https://registry.npmjs.org/saxes/-/saxes-6.0.0.tgz
+Integrity: sha512-xAg7SOnEhrm5zI3puOOKyy1OMcMlIJZYNJY7xLBwSze0UjhPLnWfj2GF2EpT0jmzaJKIWKHLsaSSajf35bcYnA==
+Scope: npm runtime dependency, including optional platform packages.
+
+The locked npm archive omits LICENSE; preserved from the matching v6.0.0 upstream tag.
+Source: https://raw.githubusercontent.com/lddubeau/saxes/v6.0.0/LICENSE
+SHA-256: 0fac2374380621b22e6b50451057721a9c52935b02d16d106a9f04897f061d0e
+
+--- upstream LICENSE ---
+
+The ISC License
+
+Copyright (c) Contributors
+
+Permission to use, copy, modify, and/or distribute this software for any
+purpose with or without fee is hereby granted, provided that the above
+copyright notice and this permission notice appear in all copies.
+
+THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
+WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
+MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
+ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
+WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
+ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF OR
+IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
+
+====
+
+The following license is the one that governed sax, from which saxes
+was forked. Isaac Schlueter is not *directly* involved with saxes so
+don't go bugging him for saxes issues.
+
+The ISC License
+
+Copyright (c) Isaac Z. Schlueter and Contributors
+
+Permission to use, copy, modify, and/or distribute this software for any
+purpose with or without fee is hereby granted, provided that the above
+copyright notice and this permission notice appear in all copies.
+
+THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
+WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
+MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
+ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
+WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
+ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF OR
+IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
+
+====
+
+`String.fromCodePoint` by Mathias Bynens is no longer used, but it can
+still be found in old commits. It was once used according to terms of
+MIT License, as follows:
+
+    Copyright Mathias Bynens <https://mathiasbynens.be/>
+
+    Permission is hereby granted, free of charge, to any person obtaining
+    a copy of this software and associated documentation files (the
+    "Software"), to deal in the Software without restriction, including
+    without limitation the rights to use, copy, modify, merge, publish,
+    distribute, sublicense, and/or sell copies of the Software, and to
+    permit persons to whom the Software is furnished to do so, subject to
+    the following conditions:
+
+    The above copyright notice and this permission notice shall be
+    included in all copies or substantial portions of the Software.
+
+    THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,
+    EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF
+    MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND
+    NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE
+    LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION
+    OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION
+    WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
+
+
+===== xmlchars@2.2.0 =====
+Declared license: MIT
+Archive: https://registry.npmjs.org/xmlchars/-/xmlchars-2.2.0.tgz
+Integrity: sha512-JZnDKK8B0RCDw84FNdDAIpZK+JuJw+s7Lz8nksI7SIuU3UXJJslUthsi+uWBUYOwPFwW7W7PRLRfUKpxjtjFCw==
+Scope: npm runtime dependency, including optional platform packages.
+
+--- package/LICENSE ---
+
+Copyright Louis-Dominique Dubeau and contributors to xmlchars
+
+Permission is hereby granted, free of charge, to any person obtaining a copy of
+this software and associated documentation files (the "Software"), to deal in
+the Software without restriction, including without limitation the rights to
+use, copy, modify, merge, publish, distribute, sublicense, and/or sell copies of
+the Software, and to permit persons to whom the Software is furnished to do so,
+subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS
+FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR
+COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER
+IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN
+CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.

package-lock.json

@@ -38,6 +38,7 @@
         "pino": "10.4.0",
         "playwright-core": "1.58.2",
         "plist": "5.0.0",
+        "saxes": "6.0.0",
         "semver": "7.8.5",
         "smol-toml": "1.9.0",
         "stream-chain": "4.2.6",
@@ -8672,6 +8673,18 @@
       "dev": true,
       "license": "MIT"
     },
+    "node_modules/saxes": {
+      "version": "6.0.0",
+      "resolved": "https://registry.npmjs.org/saxes/-/saxes-6.0.0.tgz",
+      "integrity": "sha512-xAg7SOnEhrm5zI3puOOKyy1OMcMlIJZYNJY7xLBwSze0UjhPLnWfj2GF2EpT0jmzaJKIWKHLsaSSajf35bcYnA==",
+      "license": "ISC",
+      "dependencies": {
+        "xmlchars": "^2.2.0"
+      },
+      "engines": {
+        "node": ">=v12.22.7"
+      }
+    },
     "node_modules/search-insights": {
       "version": "2.17.3",
       "resolved": "https://registry.npmjs.org/search-insights/-/search-insights-2.17.3.tgz",
@@ -10585,6 +10598,12 @@
         "node": ">=8.0"
       }
     },
+    "node_modules/xmlchars": {
+      "version": "2.2.0",
+      "resolved": "https://registry.npmjs.org/xmlchars/-/xmlchars-2.2.0.tgz",
+      "integrity": "sha512-JZnDKK8B0RCDw84FNdDAIpZK+JuJw+s7Lz8nksI7SIuU3UXJJslUthsi+uWBUYOwPFwW7W7PRLRfUKpxjtjFCw==",
+      "license": "MIT"
+    },
     "node_modules/yaml": {
       "version": "2.9.0",
       "resolved": "https://registry.npmjs.org/yaml/-/yaml-2.9.0.tgz",

package.json

@@ -341,6 +341,7 @@
     "pino": "10.4.0",
     "playwright-core": "1.58.2",
     "plist": "5.0.0",
+    "saxes": "6.0.0",
     "semver": "7.8.5",
     "smol-toml": "1.9.0",
     "stream-chain": "4.2.6",

scripts/ci/plan.mjs

@@ -175,6 +175,11 @@ if (tier === "reused") {
         file.startsWith(".github/ISSUE_TEMPLATE/")
       ) {
         selected.docs = true;
+        // Authored code and its Node package scopes belong to static checkers.
+        selected.code ||=
+          file.startsWith("docs/") &&
+          (/\.(?:[cm]?[jt]s|[jt]sx)$/u.test(file) ||
+            file.endsWith("/package.json"));
         selected.website ||= matchesAny(file, SCOPES.website);
         continue;
       }

scripts/electron-active-hook.cjs

@@ -91,7 +91,10 @@ const jsonScalarBytes = (value) => {
 };
 
 const eventFamily = (kind, processTypeValue) => {
-  if (kind === "preload" && processTypeValue === "main")
+  if (
+    kind === "preload" &&
+    (processTypeValue === "main" || processTypeValue === "browser")
+  )
     return "preload-configuration";
   if (kind.startsWith("ipc-renderer"))
     return processTypeValue === "renderer" ? "renderer-ipc" : "ipc";

scripts/fixtures/browser-verifier-site.d.mts

@@ -0,0 +1,7 @@
+export interface BrowserVerifierSite {
+  readonly origin: string;
+  triggerSessionNavigation(): void;
+  close(): Promise<void>;
+}
+
+export function startBrowserVerifierSite(): Promise<BrowserVerifierSite>;

scripts/fixtures/browser-verifier-site.mjs

@@ -184,11 +184,13 @@ export async function startBrowserVerifierSite() {
     async close() {
       for (const client of webSockets.clients) client.terminate();
       await new Promise((resolve) => webSockets.close(resolve));
-      await new Promise((resolve, reject) =>
+      const serverClosed = new Promise((resolve, reject) =>
         server.close((error) =>
           error === undefined ? resolve() : reject(error),
         ),
       );
+      server.closeAllConnections();
+      await serverClosed;
     },
   };
 }

scripts/lib/browser-module-e2e.mjs

@@ -14,36 +14,42 @@ import { webModuleTraceResultSchema } from "../../dist/domain/webModuleTrace.js"
 import { NativeModuleResolver } from "../../dist/browser/modules/NativeModuleResolver.js";
 import { startBrowserModuleSite } from "../fixtures/browser-module-site.mjs";
 import { mcpTextValue } from "./mcp-verifier-results.mjs";
+import { closeVerifierResources } from "./verifier-cleanup.mjs";
 
 /** Check native URL resolution against an independently loaded module graph through CLI/MCP. */
 export async function verifyBrowserModules(
   executable,
   entrypoint = fileURLToPath(new URL("../rea.mjs", import.meta.url)),
 ) {
-  const site = await startBrowserModuleSite();
-  const root = await mkdtemp(join(tmpdir(), "rea-browser-modules-"));
-  const env = {
-    ...process.env,
-    REA_LOG_LEVEL: "silent",
-    REA_BROWSER_EXECUTABLE: executable,
-    HOPPER_LAUNCHER_PATH: "/rea-unconfigured-provider/hopper",
-  };
-  const cli = async (...args) => {
-    const { stdout } = await promisify(execFile)(
-      process.execPath,
-      [entrypoint, ...args, "--json"],
-      { env, timeout: 45000, maxBuffer: 16 * 1024 * 1024 },
-    );
-    return parseEvidence(JSON.parse(stdout));
-  };
-  const transport = new StdioClientTransport({
-    command: process.execPath,
-    args: [entrypoint, "mcp"],
-    env,
-    stderr: "pipe",
-  });
-  const client = new Client({ name: "module-real-e2e", version: "1" });
+  let site;
+  let root;
+  let transport;
+  let client;
+  let primaryError;
   try {
+    site = await startBrowserModuleSite();
+    root = await mkdtemp(join(tmpdir(), "rea-browser-modules-"));
+    const env = {
+      ...process.env,
+      REA_LOG_LEVEL: "silent",
+      REA_BROWSER_EXECUTABLE: executable,
+      HOPPER_LAUNCHER_PATH: "/rea-unconfigured-provider/hopper",
+    };
+    const cli = async (...args) => {
+      const { stdout } = await promisify(execFile)(
+        process.execPath,
+        [entrypoint, ...args, "--json"],
+        { env, timeout: 45000, maxBuffer: 16 * 1024 * 1024 },
+      );
+      return parseEvidence(JSON.parse(stdout));
+    };
+    transport = new StdioClientTransport({
+      command: process.execPath,
+      args: [entrypoint, "mcp"],
+      env,
+      stderr: "pipe",
+    });
+    client = new Client({ name: "module-real-e2e", version: "1" });
     const oracle = await loadingOracle(executable, site);
     const scenario = {
       browser: { mode: "launch", executable_path: executable },
@@ -298,11 +304,17 @@ export async function verifyBrowserModules(
       map_identity_verified: true,
       implicit_refetches: 0,
     };
+  } catch (cause) {
+    primaryError = cause;
+    throw cause;
   } finally {
-    await client.close();
-    await transport.close();
-    await site.close();
-    await rm(root, { recursive: true, force: true });
+    const cleanup = [];
+    if (client !== undefined) cleanup.push(() => client.close());
+    if (transport !== undefined) cleanup.push(() => transport.close());
+    if (site !== undefined) cleanup.push(() => site.close());
+    if (root !== undefined)
+      cleanup.push(() => rm(root, { recursive: true, force: true }));
+    await closeVerifierResources(cleanup, primaryError);
   }
 }
 

scripts/lib/browser-nested-source-map-e2e.mjs

@@ -10,10 +10,8 @@ import { CdpConnection } from "../../dist/browser/CdpConnection.js";
 import { parseEvidence } from "../../dist/domain/evidence.js";
 import { traceSourceMap } from "../../dist/javascript/sourceMaps/TraceSourceMap.js";
 import { startBrowserSourceMapSite } from "../fixtures/browser-source-map-site.mjs";
-import {
-  startRuntimeFixtureBrowser,
-  closeRuntimeFixtureResources,
-} from "./browser-runtime-fixture-lifecycle.mjs";
+import { startRuntimeFixtureBrowser } from "./browser-runtime-fixture-lifecycle.mjs";
+import { closeVerifierResources } from "./verifier-cleanup.mjs";
 
 const cases = [
   { name: "same-line nested column control", prefixes: ["\n\n       ", "   "] },
@@ -184,7 +182,7 @@ async function verifyCase(executable, entrypoint, scenario) {
     primaryError = failure;
     throw failure;
   } finally {
-    await closeRuntimeFixtureResources(
+    await closeVerifierResources(
       [() => connection?.close(), () => fixture?.close(), () => site.close()],
       primaryError,
     );

scripts/lib/browser-network-e2e.mjs

@@ -14,6 +14,7 @@ import {
 } from "../fixtures/browser-network-site.mjs";
 import { assertBrowserNetworkEvidence } from "./browser-network-assertions.mjs";
 import { scenarioProfiles } from "./browser-scenario-verifier.mjs";
+import { closeVerifierResources } from "./verifier-cleanup.mjs";
 
 /** Exercise selected network content through real CLI and stdio MCP, one browser at a time. */
 export async function verifyBrowserNetworkEvidence(
@@ -21,9 +22,14 @@ export async function verifyBrowserNetworkEvidence(
   entrypoint = fileURLToPath(new URL("../rea.mjs", import.meta.url)),
   attachment,
 ) {
-  const site = await startBrowserNetworkSite();
-  const profilesBefore = await scenarioProfiles();
+  let site;
+  let profilesBefore;
+  let transport;
+  let client;
+  let primaryError;
   try {
+    site = await startBrowserNetworkSite();
+    profilesBefore = await scenarioProfiles();
     const scenario = browserScenarioSchema.parse({
       browser: { mode: "launch", executable_path: executable },
       start_url: { url: site.origin },
@@ -97,58 +103,50 @@ export async function verifyBrowserNetworkEvidence(
       () => assertBrowserNetworkEvidence(swapped, site.origin),
       /associated with a different same-URL request/,
     );
-    const transport = new StdioClientTransport({
+    transport = new StdioClientTransport({
       command: process.execPath,
       args: [entrypoint, "mcp"],
       env,
       stderr: "pipe",
     });
-    const client = new Client({ name: "network-real-e2e", version: "1" });
+    client = new Client({ name: "network-real-e2e", version: "1" });
     let mcpProof;
-    try {
-      await client.connect(transport);
-      const result = await client.callTool(
-        { name: "capture_browser_scenario", arguments: scenario },
+    await client.connect(transport);
+    const result = await client.callTool(
+      { name: "capture_browser_scenario", arguments: scenario },
+      { timeout: 60_000 },
+    );
+    assert.notEqual(result.isError, true, JSON.stringify(result));
+    const evidence = parseEvidence(result.structuredContent);
+    mcpProof = assertBrowserNetworkEvidence(
+      browserScenarioCaptureSchema.parse(evidence.normalized_result),
+      site.origin,
+    );
+    if (attachment !== undefined) {
+      const connectedScenario = browserScenarioSchema.parse({
+        ...scenario,
+        browser: { mode: "connect", ...attachment },
+      });
+      const connected = await client.callTool(
+        { name: "capture_browser_scenario", arguments: connectedScenario },
         { timeout: 60_000 },
       );
-      assert.notEqual(result.isError, true, JSON.stringify(result));
-      const evidence = parseEvidence(result.structuredContent);
-      mcpProof = assertBrowserNetworkEvidence(
-        browserScenarioCaptureSchema.parse(evidence.normalized_result),
-        site.origin,
-      );
-      if (attachment !== undefined) {
-        const connectedScenario = browserScenarioSchema.parse({
-          ...scenario,
-          browser: { mode: "connect", ...attachment },
-        });
-        const connected = await client.callTool(
-          { name: "capture_browser_scenario", arguments: connectedScenario },
-          { timeout: 60_000 },
-        );
-        assert.notEqual(connected.isError, true, JSON.stringify(connected));
-        const connectedEvidence = parseEvidence(connected.structuredContent);
-        assert.deepEqual(
-          assertBrowserNetworkEvidence(
-            browserScenarioCaptureSchema.parse(
-              connectedEvidence.normalized_result,
-            ),
-            site.origin,
-            "disconnected-external",
+      assert.notEqual(connected.isError, true, JSON.stringify(connected));
+      const connectedEvidence = parseEvidence(connected.structuredContent);
+      assert.deepEqual(
+        assertBrowserNetworkEvidence(
+          browserScenarioCaptureSchema.parse(
+            connectedEvidence.normalized_result,
           ),
-          cliProof,
-        );
-        assert.ok(
-          (await fetch(`${attachment.cdp_endpoint}/json/version`)).ok,
-          "Network capture closed the external browser",
-        );
-      }
-    } finally {
-      try {
-        await client.close();
-      } finally {
-        await transport.close();
-      }
+          site.origin,
+          "disconnected-external",
+        ),
+        cliProof,
+      );
+      assert.ok(
+        (await fetch(`${attachment.cdp_endpoint}/json/version`)).ok,
+        "Network capture closed the external browser",
+      );
     }
     assert.deepEqual(mcpProof, cliProof);
     for (const path of [
@@ -180,7 +178,14 @@ export async function verifyBrowserNetworkEvidence(
       profile_cleanup: true,
       connected_network_verified: attachment !== undefined,
     };
+  } catch (cause) {
+    primaryError = cause;
+    throw cause;
   } finally {
-    await site.close();
+    const cleanup = [];
+    if (client !== undefined) cleanup.push(() => client.close());
+    if (transport !== undefined) cleanup.push(() => transport.close());
+    if (site !== undefined) cleanup.push(() => site.close());
+    await closeVerifierResources(cleanup, primaryError);
   }
 }

scripts/lib/browser-runtime-e2e.mjs

@@ -14,11 +14,10 @@ import { parseEvidence } from "../../dist/domain/evidence.js";
 import { webExecutionSchema } from "../../dist/domain/webExecution.js";
 import { webEventListenersSchema } from "../../dist/domain/webEventListeners.js";
 import { startBrowserRuntimeSite } from "../fixtures/browser-runtime-site.mjs";
+import { requireOrdinaryWindowsVerifierCaller } from "./windows-ordinary-user-verifier.mjs";
 import { mcpTextValue } from "./mcp-verifier-results.mjs";
-import {
-  startRuntimeFixtureBrowser,
-  closeRuntimeFixtureResources,
-} from "./browser-runtime-fixture-lifecycle.mjs";
+import { startRuntimeFixtureBrowser } from "./browser-runtime-fixture-lifecycle.mjs";
+import { closeVerifierResources } from "./verifier-cleanup.mjs";
 import { verifyRuntimeTargetTermination } from "./browser-runtime-termination-e2e.mjs";
 import { verifyRuntimeInvalidSelectors } from "./browser-runtime-selector-e2e.mjs";
 import {
@@ -37,6 +36,7 @@ export async function verifyBrowserRuntime(
   executable,
   entrypoint = fileURLToPath(new URL("../rea.mjs", import.meta.url)),
 ) {
+  await requireOrdinaryWindowsVerifierCaller();
   await access(executable);
   const site = await startBrowserRuntimeSite();
   let fixture;
@@ -180,7 +180,7 @@ export async function verifyBrowserRuntime(
     primaryError = cause;
     throw cause;
   } finally {
-    await closeRuntimeFixtureResources(
+    await closeVerifierResources(
       [
         () => client?.close(),
         () => action?.close(),

scripts/lib/browser-runtime-fixture-lifecycle.mjs

@@ -12,9 +12,11 @@ import {
   BROWSER_DEVTOOLS_STARTUP_TIMEOUT_MS,
   waitForBrowserDevtoolsPort,
 } from "../../dist/browser/BrowserProcessStartup.js";
+import { requireOrdinaryWindowsVerifierCaller } from "./windows-ordinary-user-verifier.mjs";
 
 /** Launch the synthetic fixture browser and await CDP in its own verified process group. */
 export async function startRuntimeFixtureBrowser(executable, origin) {
+  await requireOrdinaryWindowsVerifierCaller();
   const profile = await mkdtemp(join(tmpdir(), "rea-real-web-runtime-"));
   let owned;
   try {
@@ -151,20 +153,3 @@ async function stopOwnedBrowser(owned, profile) {
     await new Promise((resolve) => setTimeout(resolve, 25));
   }
 }
-
-/** Attempt every owned cleanup and retain the original verification failure if cleanup also fails. */
-export async function closeRuntimeFixtureResources(tasks, primaryError) {
-  const failures = [];
-  for (const task of tasks) {
-    try {
-      await task();
-    } catch (cause) {
-      failures.push(cause);
-    }
-  }
-  if (failures.length > 0)
-    throw new AggregateError(
-      primaryError === undefined ? failures : [primaryError, ...failures],
-      "Runtime fixture cleanup failed",
-    );
-}

scripts/lib/browser-runtime-termination-e2e.mjs

@@ -1,7 +1,7 @@
 import assert from "node:assert/strict";
 import { CdpConnection } from "../../dist/browser/CdpConnection.js";
 import { mcpTextValue } from "./mcp-verifier-results.mjs";
-import { closeRuntimeFixtureResources } from "./browser-runtime-fixture-lifecycle.mjs";
+import { closeVerifierResources } from "./verifier-cleanup.mjs";
 
 /** Close a separately owned fixture page after actual MCP arming and inspect native cleanup diagnostics. */
 export async function verifyRuntimeTargetTermination(client, input, origin) {
@@ -76,7 +76,7 @@ export async function verifyRuntimeTargetTermination(client, input, origin) {
     primaryError = cause;
     throw cause;
   } finally {
-    await closeRuntimeFixtureResources(
+    await closeVerifierResources(
       [
         () =>
           targetId === undefined || closed

scripts/lib/browser-script-export-e2e.mjs

@@ -15,6 +15,7 @@ import {
   assertExportedScriptAnalysis,
 } from "./browser-script-export-assertions.mjs";
 import { mcpTextValue } from "./mcp-verifier-results.mjs";
+import { closeVerifierResources } from "./verifier-cleanup.mjs";
 
 /** Verify capture → export → existing analysis through real CLI and stdio MCP. */
 export async function verifyBrowserScriptExport(
@@ -22,24 +23,29 @@ export async function verifyBrowserScriptExport(
   entrypoint = fileURLToPath(new URL("../rea.mjs", import.meta.url)),
   attachment,
 ) {
-  const site = await startBrowserScriptSite();
-  const root = await mkdtemp(join(tmpdir(), "rea-browser-script-export-"));
-  const env = {
-    ...process.env,
-    REA_LOG_LEVEL: "silent",
-    HOPPER_LAUNCHER_PATH: "/rea-unconfigured-provider/hopper",
-  };
-  const cli = exportCli(entrypoint, env);
-  const scenario = scriptCaptureScenario(executable, site.origin);
-  const save = (name, capture) => saveCapture(root, name, capture);
-  const transport = new StdioClientTransport({
-    command: process.execPath,
-    args: [entrypoint, "mcp"],
-    env,
-    stderr: "pipe",
-  });
-  const client = new Client({ name: "web-script-real-e2e", version: "1" });
+  let site;
+  let root;
+  let transport;
+  let client;
+  let primaryError;
   try {
+    site = await startBrowserScriptSite();
+    root = await mkdtemp(join(tmpdir(), "rea-browser-script-export-"));
+    const env = {
+      ...process.env,
+      REA_LOG_LEVEL: "silent",
+      HOPPER_LAUNCHER_PATH: "/rea-unconfigured-provider/hopper",
+    };
+    const cli = exportCli(entrypoint, env);
+    const scenario = scriptCaptureScenario(executable, site.origin);
+    const save = (name, capture) => saveCapture(root, name, capture);
+    transport = new StdioClientTransport({
+      command: process.execPath,
+      args: [entrypoint, "mcp"],
+      env,
+      stderr: "pipe",
+    });
+    client = new Client({ name: "web-script-real-e2e", version: "1" });
     const cliCapture = await cli(
       "capture-browser-scenario",
       JSON.stringify(scenario),
@@ -103,11 +109,17 @@ export async function verifyBrowserScriptExport(
       query_variants_isolated: true,
       implicit_refetches: 0,
     };
+  } catch (cause) {
+    primaryError = cause;
+    throw cause;
   } finally {
-    await client.close();
-    await transport.close();
-    await site.close();
-    await rm(root, { recursive: true, force: true });
+    const cleanup = [];
+    if (client !== undefined) cleanup.push(() => client.close());
+    if (transport !== undefined) cleanup.push(() => transport.close());
+    if (site !== undefined) cleanup.push(() => site.close());
+    if (root !== undefined)
+      cleanup.push(() => rm(root, { recursive: true, force: true }));
+    await closeVerifierResources(cleanup, primaryError);
   }
 }
 

scripts/lib/browser-source-map-e2e.mjs

@@ -12,35 +12,41 @@ import { parseEvidence } from "../../dist/domain/evidence.js";
 import { webSourceLocationResultSchema } from "../../dist/domain/webSourceLocation.js";
 import { startBrowserSourceMapSite } from "../fixtures/browser-source-map-site.mjs";
 import { mcpTextValue } from "./mcp-verifier-results.mjs";
+import { closeVerifierResources } from "./verifier-cleanup.mjs";
 
 /** Verify real Chrome capture → export → original compiler point through packaged CLI/MCP. */
 export async function verifyBrowserSourceMap(
   executable,
   entrypoint = fileURLToPath(new URL("../rea.mjs", import.meta.url)),
 ) {
-  const site = await startBrowserSourceMapSite();
-  const root = await mkdtemp(join(tmpdir(), "rea-browser-source-map-"));
-  const env = {
-    ...process.env,
-    REA_LOG_LEVEL: "silent",
-    HOPPER_LAUNCHER_PATH: "/rea-unconfigured-provider/hopper",
-  };
-  const cli = async (...args) => {
-    const { stdout } = await promisify(execFile)(
-      process.execPath,
-      [entrypoint, ...args, "--json"],
-      { env, timeout: 45000, maxBuffer: 16 * 1024 * 1024 },
-    );
-    return parseEvidence(JSON.parse(stdout));
-  };
-  const transport = new StdioClientTransport({
-    command: process.execPath,
-    args: [entrypoint, "mcp"],
-    env,
-    stderr: "pipe",
-  });
-  const client = new Client({ name: "source-map-real-e2e", version: "1" });
+  let site;
+  let root;
+  let transport;
+  let client;
+  let primaryError;
   try {
+    site = await startBrowserSourceMapSite();
+    root = await mkdtemp(join(tmpdir(), "rea-browser-source-map-"));
+    const env = {
+      ...process.env,
+      REA_LOG_LEVEL: "silent",
+      HOPPER_LAUNCHER_PATH: "/rea-unconfigured-provider/hopper",
+    };
+    const cli = async (...args) => {
+      const { stdout } = await promisify(execFile)(
+        process.execPath,
+        [entrypoint, ...args, "--json"],
+        { env, timeout: 45000, maxBuffer: 16 * 1024 * 1024 },
+      );
+      return parseEvidence(JSON.parse(stdout));
+    };
+    transport = new StdioClientTransport({
+      command: process.execPath,
+      args: [entrypoint, "mcp"],
+      env,
+      stderr: "pipe",
+    });
+    client = new Client({ name: "source-map-real-e2e", version: "1" });
     const capture = await cli(
       "capture-browser-scenario",
       JSON.stringify({
@@ -126,11 +132,17 @@ export async function verifyBrowserSourceMap(
       selected_inert_userinfo_context_preserved: true,
       public_point_cases: 4,
     };
+  } catch (cause) {
+    primaryError = cause;
+    throw cause;
   } finally {
-    await client.close();
-    await transport.close();
-    await site.close();
-    await rm(root, { recursive: true, force: true });
+    const cleanup = [];
+    if (client !== undefined) cleanup.push(() => client.close());
+    if (transport !== undefined) cleanup.push(() => transport.close());
+    if (site !== undefined) cleanup.push(() => site.close());
+    if (root !== undefined)
+      cleanup.push(() => rm(root, { recursive: true, force: true }));
+    await closeVerifierResources(cleanup, primaryError);
   }
 }
 function assertPoint(evidence, { site, input, capture, identity }) {

scripts/lib/development-tests.mjs

@@ -43,6 +43,7 @@ const artifactConsumers = {
     "tests/boundary/mcp/toolSchemaValidity.test.ts",
   ],
   "artifacts:product-catalog": [
+    "tests/boundary/filesystem/documentationFacts.test.ts",
     "tests/boundary/filesystem/productCatalog.test.ts",
   ],
   "artifacts:managed-evidence": [

scripts/lib/real-ghidra-address-boundaries.d.mts

@@ -0,0 +1,8 @@
+import type { Client } from "@modelcontextprotocol/client";
+
+/** Verify segmented aliases and restore the entry's observed public name. */
+export function verifyGhidraAddressBoundaries(
+  client: Pick<Client, "callTool">,
+  entry: string,
+  cli: (command: string, address: string, flags: string[]) => Promise<unknown>,
+): Promise<void>;

scripts/lib/real-hopper-boundaries.mjs

@@ -3,6 +3,7 @@ import { execFile } from "node:child_process";
 import { copyFile, mkdtemp, readFile, realpath, rm } from "node:fs/promises";
 import { tmpdir } from "node:os";
 import { basename, join } from "node:path";
+import { fileURLToPath } from "node:url";
 import { promisify } from "node:util";
 import Ajv from "ajv/dist/2020.js";
 import addFormats from "ajv-formats";
@@ -21,6 +22,8 @@ import {
   verifyHopperRegexIsolation,
 } from "./real-hopper-search.mjs";
 
+const dispatcher = fileURLToPath(new URL("../rea.mjs", import.meta.url));
+
 /** Exercise real Hopper annotation and malformed-input boundaries over MCP. */
 export async function verifyHopperBoundaryContracts(
   client,
@@ -342,7 +345,7 @@ export async function verifyHopperLifecycleAndCli(client, options, targets) {
         ? await verifyLinuxHopperLaunchIsolation({
             call,
             runCli,
-            dispatcher: new URL("../rea.mjs", import.meta.url).pathname,
+            dispatcher,
             primary,
             secondary,
           })
@@ -368,7 +371,6 @@ export async function verifyHopperLifecycleAndCli(client, options, targets) {
     assert.deepEqual(expectedTrace.matches, []);
     await call("close_binary");
 
-    const dispatcher = new URL("../rea.mjs", import.meta.url).pathname;
     const common = [
       "--length",
       "8",

scripts/lib/real-hopper-owner-exit.mjs

@@ -10,6 +10,7 @@ import { verifyNoTokenOwnedProcesses } from "../../dist/process/ProcessOwnership
 import {
   observeProcessStartIdentity,
   signalProcessWithStartIdentity,
+  systemProcessOwnershipHost,
 } from "../../dist/process/ProcessOwnershipObservation.js";
 import { startUnrelatedHopperSentinel } from "./unrelated-hopper-sentinel.mjs";
 import {
@@ -31,6 +32,11 @@ export async function verifyLinuxHopperOwnerExit({
   const outcomes = [];
   try {
     for (const mode of ["graceful", "SIGKILL"]) {
+      const baseline = await systemProcessOwnershipHost.captureBaseline?.();
+      assert.ok(
+        baseline,
+        "Could not capture pre-launch process ownership baseline",
+      );
       const transport = new StdioClientTransport({
         command: serverCommand,
         args: serverArgs,
@@ -47,6 +53,18 @@ export async function verifyLinuxHopperOwnerExit({
         assert.ok(ownerPid !== null);
         const owner = await observeProcessStartIdentity(ownerPid);
         assert.equal(owner?.state, "readable");
+        const ownerProcess = (
+          await systemProcessOwnershipHost.listProcesses()
+        ).find(({ pid }) => pid === ownerPid);
+        assert.ok(
+          ownerProcess,
+          "Could not observe the launched MCP process group",
+        );
+        assert.equal(typeof ownerProcess.processGroupId, "number");
+        const relation = {
+          leaderPid: ownerPid,
+          processGroupId: ownerProcess.processGroupId,
+        };
         requireMcpLifecycleResult(
           await client.callTool(
             {
@@ -75,7 +93,17 @@ export async function verifyLinuxHopperOwnerExit({
         const runId = status.analysis_run?.run_id;
         assert.equal(typeof runId, "string");
         assert.equal(status.analysis_provider_binding?.provider.id, "hopper");
-        assert.equal((await verifyNoTokenOwnedProcesses(runId)).cleaned, false);
+        assert.equal(
+          (
+            await verifyNoTokenOwnedProcesses(
+              runId,
+              systemProcessOwnershipHost,
+              baseline,
+              relation,
+            )
+          ).cleaned,
+          false,
+        );
         if (mode === "graceful") await client.close();
         else {
           assert.equal(
@@ -90,7 +118,12 @@ export async function verifyLinuxHopperOwnerExit({
         const deadline = Date.now() + 10_000;
         let cleanup;
         do {
-          cleanup = await verifyNoTokenOwnedProcesses(runId);
+          cleanup = await verifyNoTokenOwnedProcesses(
+            runId,
+            systemProcessOwnershipHost,
+            baseline,
+            relation,
+          );
           if (cleanup.cleaned) break;
           await delay(100);
         } while (Date.now() < deadline);

scripts/lib/verifier-cleanup.d.mts

@@ -0,0 +1,5 @@
+/** Attempt every owned cleanup and retain the primary verification failure. */
+export function closeVerifierResources(
+  tasks: readonly (() => void | Promise<void>)[],
+  primaryError?: unknown,
+): Promise<void>;

scripts/lib/verifier-cleanup.mjs

@@ -0,0 +1,16 @@
+/** Attempt every owned cleanup and retain the primary verification failure. */
+export async function closeVerifierResources(tasks, primaryError) {
+  const failures = [];
+  for (const task of tasks) {
+    try {
+      await task();
+    } catch (cause) {
+      failures.push(cause);
+    }
+  }
+  if (failures.length > 0)
+    throw new AggregateError(
+      primaryError === undefined ? failures : [primaryError, ...failures],
+      "Verifier cleanup failed",
+    );
+}

scripts/lib/verifier-run.d.mts

@@ -39,3 +39,8 @@ export function createVerifierRun(): VerifierRunStart;
 export function completeVerifierRun(
   run: VerifierRunStart,
 ): Promise<VerifierRun>;
+
+/** Require positive process-lineage evidence before claiming cleanup complete. */
+export function assertVerifierCleanupComplete(
+  processLineage: VerifierProcessLineage,
+): void;

scripts/lib/verifier-run.mjs

@@ -33,6 +33,16 @@ export const completeVerifierRun = async (run) => {
   };
 };
 
+/** Require positive process-lineage evidence before claiming cleanup complete. */
+export const assertVerifierCleanupComplete = (processLineage) => {
+  if (processLineage.status !== "verified")
+    throw new Error(
+      `Verifier cleanup could not be verified: ${processLineage.reason}`,
+    );
+  if (processLineage.descendants.length !== 0)
+    throw new Error("Owned descendants survived verifier cleanup");
+};
+
 const observeVerifierLineage = async (run, observedAt) => {
   if (process.platform === "win32")
     return unavailableLineage(

scripts/lib/windows-ordinary-user-verifier.d.mts

@@ -0,0 +1,4 @@
+export declare const assertOrdinaryWindowsVerifierCaller: (
+  token: unknown,
+) => void;
+export declare const requireOrdinaryWindowsVerifierCaller: () => Promise<void>;

scripts/lib/windows-ordinary-user-verifier.mjs

@@ -0,0 +1,40 @@
+/** Require fixture verifiers on Windows to use the caller's ordinary-user token. */
+export const assertOrdinaryWindowsVerifierCaller = (token) => {
+  if (
+    typeof token !== "object" ||
+    token === null ||
+    !("administrator" in token) ||
+    !("elevated" in token) ||
+    token.administrator !== false ||
+    token.elevated !== false
+  ) {
+    const integrity =
+      typeof token === "object" &&
+      token !== null &&
+      "integrityLevel" in token &&
+      Number.isSafeInteger(token.integrityLevel)
+        ? ` (integrity level ${String(token.integrityLevel)})`
+        : "";
+    throw new Error(
+      "Windows browser verifier requires an ordinary, non-elevated user token" +
+        `${integrity}. Rerun it from a standard-user Windows session; the verifier will not change caller authority.`,
+    );
+  }
+};
+
+/** Observe the native caller token before a Windows browser fixture allocates resources. */
+export const requireOrdinaryWindowsVerifierCaller = async () => {
+  if (process.platform !== "win32") return;
+  let token;
+  try {
+    const { requireWindowsNativeAuthority } =
+      await import("../../dist/windows/WindowsNativeLoader.js");
+    token = requireWindowsNativeAuthority().call("process_caller_token", []);
+  } catch (cause) {
+    throw new Error(
+      "Windows browser verifier could not observe its caller token; use the verified Windows x64 native artifact and rerun from a standard-user session.",
+      { cause },
+    );
+  }
+  assertOrdinaryWindowsVerifierCaller(token);
+};

scripts/run-exact-tests.mjs

@@ -77,7 +77,7 @@ try {
             throw cause;
           }
           if (
-            !(await hasCaseMismatchedSymlinkComponent(absolute, candidate)) &&
+            !(await hasMismatchedSymlinkComponent(absolute, candidate)) &&
             (await realpath(candidate)) === canonical
           )
             matches = [...matches, ...specifications];
@@ -99,13 +99,14 @@ try {
 if (shutdownSignal !== undefined)
   process.exitCode = signalExitCodes[shutdownSignal];
 
-async function hasCaseMismatchedSymlinkComponent(selected, candidate) {
+async function hasMismatchedSymlinkComponent(selected, candidate) {
   const selectedAbsolute = resolve(selected);
   const candidateAbsolute = resolve(candidate);
   const root = parse(selectedAbsolute).root;
   if (root !== parse(candidateAbsolute).root) return true;
   const selectedParts = relative(root, selectedAbsolute).split(sep);
   const candidateParts = relative(root, candidateAbsolute).split(sep);
+  if (selectedParts.length !== candidateParts.length) return true;
   let selectedPath = root;
   let candidatePath = root;
   for (let index = 0; index < selectedParts.length; index += 1) {
@@ -118,14 +119,12 @@ async function hasCaseMismatchedSymlinkComponent(selected, candidate) {
     candidatePath = candidatePath
       ? resolve(candidatePath, candidatePart)
       : candidatePart;
-    if (
-      selectedPart !== candidatePart &&
-      selectedPart.toLowerCase() === candidatePart.toLowerCase()
-    ) {
+    if (selectedPart !== candidatePart) {
       const [selectedEntry, candidateEntry] = await Promise.all([
         lstat(selectedPath),
         lstat(candidatePath),
       ]);
+      // Matching inode/realpath does not make an excluded symlink a discovered path.
       if (selectedEntry.isSymbolicLink() || candidateEntry.isSymbolicLink())
         return true;
     }

scripts/verify-browser-dom-destinations.mjs

@@ -6,15 +6,21 @@ import { join } from "node:path";
 import { chromium } from "playwright-core";
 import { startBrowserVerifierSite } from "./fixtures/browser-verifier-site.mjs";
 import { verifyBrowserDomDestinations } from "./lib/browser-dom-destinations-e2e.mjs";
+import { closeVerifierResources } from "./lib/verifier-cleanup.mjs";
+import { requireOrdinaryWindowsVerifierCaller } from "./lib/windows-ordinary-user-verifier.mjs";
 
 const executable = process.env.REA_BROWSER_EXECUTABLE;
 if (!executable)
   throw new Error("verify:browser:dom requires REA_BROWSER_EXECUTABLE");
-const profile = await mkdtemp(join(tmpdir(), "rea-browser-dom-"));
-const site = await startBrowserVerifierSite();
+await requireOrdinaryWindowsVerifierCaller();
+let profile;
+let site;
 let context;
 let report;
+let primaryError;
 try {
+  profile = await mkdtemp(join(tmpdir(), "rea-browser-dom-"));
+  site = await startBrowserVerifierSite();
   context = await chromium.launchPersistentContext(profile, {
     executablePath: executable,
     headless: true,
@@ -50,9 +56,15 @@ try {
     native_oracle: true,
     verified: true,
   };
+} catch (cause) {
+  primaryError = cause;
+  throw cause;
 } finally {
-  await context?.close();
-  await site.close();
-  await rm(profile, { recursive: true, force: true });
+  const cleanup = [];
+  if (context !== undefined) cleanup.push(() => context.close());
+  if (site !== undefined) cleanup.push(() => site.close());
+  if (profile !== undefined)
+    cleanup.push(() => rm(profile, { recursive: true, force: true }));
+  await closeVerifierResources(cleanup, primaryError);
 }
 process.stdout.write(`${JSON.stringify(report)}\n`);

scripts/verify-browser-modules.mjs

@@ -2,12 +2,14 @@
 import { access } from "node:fs/promises";
 import { verifyBrowserModules } from "./lib/browser-module-e2e.mjs";
 import { createVerifierRun, completeVerifierRun } from "./lib/verifier-run.mjs";
+import { requireOrdinaryWindowsVerifierCaller } from "./lib/windows-ordinary-user-verifier.mjs";
 
 const executable = process.env.REA_BROWSER_EXECUTABLE;
 if (!executable)
   throw new Error(
     "verify:browser:modules requires REA_BROWSER_EXECUTABLE for caller-supplied Chromium",
   );
+await requireOrdinaryWindowsVerifierCaller();
 await access(executable);
 const run = createVerifierRun();
 const proof = await verifyBrowserModules(executable, process.argv[2]);

scripts/verify-browser-network.mjs

@@ -2,12 +2,14 @@
 import { access } from "node:fs/promises";
 import { verifyBrowserNetworkEvidence } from "./lib/browser-network-e2e.mjs";
 import { createVerifierRun, completeVerifierRun } from "./lib/verifier-run.mjs";
+import { requireOrdinaryWindowsVerifierCaller } from "./lib/windows-ordinary-user-verifier.mjs";
 
 const executable = process.env.REA_BROWSER_EXECUTABLE;
 if (executable === undefined || executable === "")
   throw new Error(
     "verify:browser:network requires REA_BROWSER_EXECUTABLE pointing to an installed Chrome-family browser",
   );
+await requireOrdinaryWindowsVerifierCaller();
 await access(executable);
 const run = createVerifierRun();
 const proof = await verifyBrowserNetworkEvidence(executable, process.argv[2]);

scripts/verify-browser-scripts.mjs

@@ -2,12 +2,14 @@
 import { access } from "node:fs/promises";
 import { verifyBrowserScriptExport } from "./lib/browser-script-export-e2e.mjs";
 import { createVerifierRun, completeVerifierRun } from "./lib/verifier-run.mjs";
+import { requireOrdinaryWindowsVerifierCaller } from "./lib/windows-ordinary-user-verifier.mjs";
 
 const executable = process.env.REA_BROWSER_EXECUTABLE;
 if (executable === undefined || executable === "")
   throw new Error(
     "verify:browser:scripts requires REA_BROWSER_EXECUTABLE pointing to an installed Chrome-family browser",
   );
+await requireOrdinaryWindowsVerifierCaller();
 await access(executable);
 const run = createVerifierRun();
 const proof = await verifyBrowserScriptExport(executable, process.argv[2]);

scripts/verify-browser-source-maps.mjs

@@ -4,6 +4,9 @@ import { isAbsolute } from "node:path";
 import { verifyBrowserSourceMap } from "./lib/browser-source-map-e2e.mjs";
 import { verifyBrowserNestedSourceMaps } from "./lib/browser-nested-source-map-e2e.mjs";
 import { createVerifierRun, completeVerifierRun } from "./lib/verifier-run.mjs";
+import { requireOrdinaryWindowsVerifierCaller } from "./lib/windows-ordinary-user-verifier.mjs";
+
+await requireOrdinaryWindowsVerifierCaller();
 const executable = process.env.REA_BROWSER_EXECUTABLE;
 if (!executable || !isAbsolute(executable))
   throw new Error(

scripts/verify-frida.mjs

@@ -3,6 +3,7 @@ import { basename } from "node:path";
 import { FridaInstrumentationService } from "../dist/application/frida/FridaInstrumentationService.js";
 import { FridaInstrumentationManager } from "../dist/frida/FridaInstrumentationManager.js";
 import { isValidFridaRemoteAddress } from "../dist/contracts/fridaRemoteAddress.js";
+import { closeVerifierResources } from "./lib/verifier-cleanup.mjs";
 
 const options = parseArguments(process.argv.slice(2));
 if (options.help) {
@@ -30,6 +31,8 @@ const remote =
           : { keepaliveInterval: options.keepaliveInterval }),
       };
 
+let primaryFailure;
+let report;
 try {
   let targetProcess;
   let input;
@@ -92,7 +95,7 @@ try {
   );
   if (!messageObserved)
     throw new Error("Selected target did not return the Frida marker");
-  const report = {
+  report = {
     ok: result.value.cleanupError === null,
     provider: "frida",
     host_platform: process.platform,
@@ -103,15 +106,28 @@ try {
     script_message_observed: true,
     cleanup_error: result.value.cleanupError,
   };
-  process.stdout.write(`${JSON.stringify(report)}\n`);
-  if (!report.ok) process.exitCode = 1;
 } catch (cause) {
+  primaryFailure = cause;
+}
+
+let cleanupFailure;
+try {
+  await closeVerifierResources([() => manager.closeAll()], primaryFailure);
+} catch (cause) {
+  cleanupFailure = cause;
+}
+if (primaryFailure !== undefined || cleanupFailure !== undefined) {
+  const causes =
+    cleanupFailure instanceof AggregateError
+      ? cleanupFailure.errors
+      : [cleanupFailure ?? primaryFailure];
   process.stderr.write(
-    `Frida real-provider verification failed: ${cause instanceof Error ? cause.message : String(cause)}\n`,
+    `Frida real-provider verification failed: ${causes.map((cause) => (cause instanceof Error ? cause.message : String(cause))).join("; ")}\n`,
   );
   process.exitCode = 1;
-} finally {
-  await manager.closeAll().catch(() => undefined);
+} else {
+  process.stdout.write(`${JSON.stringify(report)}\n`);
+  if (!report.ok) process.exitCode = 1;
 }
 
 function parseArguments(args) {

scripts/verify-jeb.mjs

@@ -6,6 +6,7 @@ import { promisify } from "node:util";
 
 import { JebAnalysisService } from "../dist/application/jeb/JebAnalysisService.js";
 import { createJebAnalysisProvider } from "../dist/composition/jeb.js";
+import { closeVerifierResources } from "./lib/verifier-cleanup.mjs";
 
 const run = promisify(execFile);
 
@@ -25,8 +26,11 @@ if (options.help) {
 
 const provider = createJebAnalysisProvider(process.env);
 const service = new JebAnalysisService(provider);
-const fixtureDirectory = await mkdtemp(join(tmpdir(), "rea-jeb-"));
+let fixtureDirectory;
+let primaryFailure;
+let report;
 try {
+  fixtureDirectory = await mkdtemp(join(tmpdir(), "rea-jeb-"));
   const client = await service.execute("inspect_jeb_client", {});
   if (!client.ok) throw new Error(client.error.message);
   const engine = client.value.normalized_result.engine;
@@ -70,7 +74,7 @@ try {
       "Decompiled pseudo-code did not contain the fixture marker",
     );
 
-  const report = {
+  report = {
     ok: true,
     provider: "jeb",
     host_platform: process.platform,
@@ -82,17 +86,33 @@ try {
     unit_count: units.value.normalized_result.units.length,
     decompiled_marker_observed: true,
   };
-  process.stdout.write(`${JSON.stringify(report)}\n`);
 } catch (cause) {
+  primaryFailure = cause;
+}
+
+const cleanupTasks = [
+  () => provider.close(),
+  ...(fixtureDirectory === undefined
+    ? []
+    : [() => rm(fixtureDirectory, { recursive: true, force: true })]),
+];
+let cleanupFailure;
+try {
+  await closeVerifierResources(cleanupTasks, primaryFailure);
+} catch (cause) {
+  cleanupFailure = cause;
+}
+if (primaryFailure !== undefined || cleanupFailure !== undefined) {
+  const causes =
+    cleanupFailure instanceof AggregateError
+      ? cleanupFailure.errors
+      : [cleanupFailure ?? primaryFailure];
   process.stderr.write(
-    `JEB real-provider verification failed: ${cause instanceof Error ? cause.message : String(cause)}\n`,
+    `JEB real-provider verification failed: ${causes.map((cause) => (cause instanceof Error ? cause.message : String(cause))).join("; ")}\n`,
   );
   process.exitCode = 1;
-} finally {
-  await provider.close().catch(() => undefined);
-  await rm(fixtureDirectory, { recursive: true, force: true }).catch(
-    () => undefined,
-  );
+} else {
+  process.stdout.write(`${JSON.stringify(report)}\n`);
 }
 
 async function resolveTarget(selected, directory) {

scripts/verify-package-setup.d.mts

@@ -4,3 +4,6 @@ export function assertClientConfig(
   configPath: string,
   original: Uint8Array,
 ): Promise<void>;
+
+/** Return true only when stty output positively reports canonical input and echo. */
+export function terminalModesRestored(termios: unknown): boolean;

scripts/verify-package-setup.mjs

@@ -22,6 +22,12 @@ import {
 import { parse as parseJsonc } from "jsonc-parser";
 import { skillReferenceIssues } from "./lib/docs-facts.mjs";
 
+export const terminalModesRestored = (termios) => {
+  if (typeof termios !== "string") return false;
+  const modes = new Set(termios.trim().split(/\s+/u));
+  return modes.has("icanon") && modes.has("echo");
+};
+
 const OPENCODE_ORIGINAL = `{
   // OpenCode preferences must survive setup.
   "model": "provider/model",
@@ -131,8 +137,7 @@ const verifyInteractiveSetup = async ({
         childResult?.status !== 0 ||
         !output.includes("\u001b[?25h") ||
         (process.platform !== "win32" &&
-          (!childResult.termios?.includes("icanon") ||
-            !childResult.termios?.includes("echo"))) ||
+          !terminalModesRestored(childResult.termios)) ||
         !output.includes("No changes were made.")
       ) {
         finish(

scripts/verify-real-browser.mjs

@@ -39,6 +39,8 @@ import {
   verifyScenarioFailureEvidence,
 } from "./lib/browser-scenario-verifier.mjs";
 import { completeVerifierRun, createVerifierRun } from "./lib/verifier-run.mjs";
+import { closeVerifierResources } from "./lib/verifier-cleanup.mjs";
+import { requireOrdinaryWindowsVerifierCaller } from "./lib/windows-ordinary-user-verifier.mjs";
 import { verifyLargeScreenshotE2e } from "./lib/browser-screenshot-e2e.mjs";
 import { verifyPopupEventCoverage } from "./lib/browser-popup-e2e.mjs";
 import { verifyBrowserNetworkEvidence } from "./lib/browser-network-e2e.mjs";
@@ -58,13 +60,17 @@ process.env.REA_BROWSER_VERIFIER_SECRET = SCENARIO_SECRET_VALUE;
 process.env.REA_BROWSER_VERIFIER_URL = SCENARIO_URL_SECRET_VALUE;
 const verifierRun = createVerifierRun();
 
+await requireOrdinaryWindowsVerifierCaller();
 const executable = await browserExecutable();
-const profile = await mkdtemp(join(tmpdir(), "rea-real-browser-"));
-const site = await startBrowserVerifierSite();
+let profile;
+let site;
 let browser;
 let pageProxy;
 let report;
+let verificationError;
 try {
+  profile = await mkdtemp(join(tmpdir(), "rea-real-browser-"));
+  site = await startBrowserVerifierSite();
   browser = spawn(
     executable,
     [
@@ -409,19 +415,39 @@ try {
     scenarioServiceWorkers,
     verified: true,
   };
+} catch (cause) {
+  verificationError = cause;
+  throw cause;
 } finally {
-  process.stderr.write("Browser verifier cleanup: closing page proxy\n");
-  if (pageProxy !== undefined) await pageProxy.close();
-  process.stderr.write("Browser verifier cleanup: stopping owned Chrome\n");
-  if (browser !== undefined) await stopProcess(browser);
-  process.stderr.write("Browser verifier cleanup: closing fixture site\n");
-  await site.close();
-  await rm(profile, {
-    recursive: true,
-    force: true,
-    maxRetries: 10,
-    retryDelay: 100,
-  });
+  const cleanup = [];
+  if (pageProxy !== undefined) {
+    cleanup.push(async () => {
+      process.stderr.write("Browser verifier cleanup: closing page proxy\n");
+      await pageProxy.close();
+    });
+  }
+  if (browser !== undefined) {
+    cleanup.push(async () => {
+      process.stderr.write("Browser verifier cleanup: stopping owned Chrome\n");
+      await stopProcess(browser);
+    });
+  }
+  if (site !== undefined) {
+    cleanup.push(async () => {
+      process.stderr.write("Browser verifier cleanup: closing fixture site\n");
+      await site.close();
+    });
+  }
+  if (profile !== undefined)
+    cleanup.push(() =>
+      rm(profile, {
+        recursive: true,
+        force: true,
+        maxRetries: 10,
+        retryDelay: 100,
+      }),
+    );
+  await closeVerifierResources(cleanup, verificationError);
 }
 process.stdout.write(
   `${JSON.stringify({

scripts/verify-real-ghidra-dos.mjs

@@ -24,7 +24,11 @@ import {
 } from "../dist/domain/hopperValues.js";
 import { inspectGhidraInstallation } from "../dist/ghidra/GhidraInstallation.js";
 import { buildDosMzFixture } from "../tests/conformance/ghidra/dos-mz-fixture.mjs";
-import { createVerifierRun, completeVerifierRun } from "./lib/verifier-run.mjs";
+import {
+  assertVerifierCleanupComplete,
+  createVerifierRun,
+  completeVerifierRun,
+} from "./lib/verifier-run.mjs";
 import { verifyGhidraAddressBoundaries } from "./lib/real-ghidra-address-boundaries.mjs";
 
 // This lane intentionally has no game paths, binary seeds or compiler dependency.
@@ -479,12 +483,7 @@ try {
 }
 assert.ok(report, "No DOS proof report was produced");
 const verifierRun = await completeVerifierRun(run);
-if (verifierRun.process_lineage.status === "verified")
-  assert.deepEqual(
-    verifierRun.process_lineage.descendants,
-    [],
-    "Owned descendants survived verifier cleanup",
-  );
+assertVerifierCleanupComplete(verifierRun.process_lineage);
 process.stdout.write(
   `${JSON.stringify({ verifier_run: verifierRun, ...report, cleanup: "complete" })}\n`,
 );

scripts/verify-wasm-artifact.mjs

@@ -2,8 +2,16 @@
 import assert from "node:assert/strict";
 import { execFile } from "node:child_process";
 import { createHash } from "node:crypto";
-import { mkdir, readFile, writeFile, readdir } from "node:fs/promises";
+import {
+  mkdir,
+  mkdtemp,
+  readFile,
+  readdir,
+  rm,
+  writeFile,
+} from "node:fs/promises";
 import { isAbsolute, join } from "node:path";
+import { tmpdir } from "node:os";
 import { fileURLToPath } from "node:url";
 import { promisify } from "node:util";
 import { Client } from "@modelcontextprotocol/client";
@@ -51,11 +59,32 @@ const tool = (name, args, cwd) =>
 const sha256 = (value) => createHash("sha256").update(value).digest("hex");
 const run = createVerifierRun();
 const root = await PrivateRuntimeRoot.create({ prefix: "rea-wabt-verifier-" });
+// Keep provider scratch outside the leased private input root. On Windows the
+// root's retained DELETE handle blocks child temp creation beneath that root.
+let childTempRoot;
+try {
+  childTempRoot = await mkdtemp(join(tmpdir(), "rea-wabt-child-temp-"));
+} catch (cause) {
+  try {
+    await root.close();
+  } catch (cleanupCause) {
+    throw new AggregateError(
+      [cause, cleanupCause],
+      "Could not allocate verifier temp space or release its private root.",
+    );
+  }
+  throw cause;
+}
 const client = new Client({ name: "wabt-artifact-verifier", version: "1" });
 const transport = new StdioClientTransport({
   command: process.execPath,
   args: [entrypoint, "mcp"],
-  env: { ...environment, TMPDIR: root.path, TMP: root.path, TEMP: root.path },
+  env: {
+    ...environment,
+    TMPDIR: childTempRoot,
+    TMP: childTempRoot,
+    TEMP: childTempRoot,
+  },
   stderr: "pipe",
 });
 let cases = 0;
@@ -95,9 +124,9 @@ try {
             {
               env: {
                 ...environment,
-                TMPDIR: root.path,
-                TMP: root.path,
-                TEMP: root.path,
+                TMPDIR: childTempRoot,
+                TMP: childTempRoot,
+                TEMP: childTempRoot,
               },
               timeout: 120_000,
               maxBuffer: 64 * 1024 * 1024,
@@ -388,13 +417,26 @@ try {
 }
 try {
   assert.ok(
-    !(await readdir(root.path)).some((name) => name.startsWith("rea-wabt-")),
+    !(await readdir(childTempRoot)).some((name) =>
+      name.startsWith("rea-wabt-"),
+    ),
     "Provider workspace leaked",
   );
+} catch (cause) {
+  failures.push(cause);
+}
+// Each directory is an independent owner. Attempt every cleanup even if a
+// residue assertion or another owner's close fails, retaining every error.
+try {
   await root.close();
 } catch (cause) {
   failures.push(cause);
 }
+try {
+  await rm(childTempRoot, { recursive: true, force: true });
+} catch (cause) {
+  failures.push(cause);
+}
 if (failures.length > 0)
   throw new AggregateError(failures, "WABT real-tool verification failed.");
 console.log(

src/application/BinaryTargetResolver.ts

@@ -551,6 +551,7 @@ const readExecutableMetadata = async (
     mips: {
       ...parsed.value.mips,
       abiFlags: declarations.value.abiFlags,
+      gnuAttributes: declarations.value.gnuAttributes,
       ...(declarations.value.sharedLoad === undefined
         ? {}
         : { sharedLoad: declarations.value.sharedLoad }),

src/application/ClientConfigurationDocument.ts

@@ -1,5 +1,4 @@
 import { parse as parseToml, stringify as stringifyToml } from "smol-toml";
-import { stringify as stringifyYaml } from "yaml";
 import { isDeepStrictEqual } from "node:util";
 
 import {
@@ -11,6 +10,7 @@ import {
 import {
   editHermesConfigurationYaml,
   parseHermesConfigurationYaml,
+  stringifyHermesConfigurationYaml,
 } from "./HermesConfigurationYaml.js";
 import {
   applyEdits,
@@ -1419,7 +1419,7 @@ const serializeHermesConfiguration = (
     originalText === undefined ||
     isEmptyClientConfigurationText(originalText)
   )
-    return stringifyYaml(document);
+    return stringifyHermesConfigurationYaml(document);
   const serversKey = clientConfigurationServersKey("hermes");
   const servers = document[serversKey];
   const entry =

src/application/ClientConfigurationFiles.ts

@@ -172,3 +172,47 @@ export const effectiveClientConfiguration = (
   }
   return { ...last, servers, legacyServers: {} };
 };
+
+/** Read the configuration ZCode will load, preserving its same-scope fallback rule. */
+export const readEffectiveClientRegistrationConfiguration = async (
+  client: SetupClient,
+  resources?: ArtifactResourceScope,
+): Promise<
+  Result<
+    {
+      readonly document: ClientConfigurationDocument | undefined;
+      readonly configPath: string;
+    },
+    ClientConfigurationFileError
+  >
+> => {
+  const nativeSources = await readClientConfigurationFiles(client, resources);
+  if (!nativeSources.ok) return nativeSources;
+  const nativeDocument = effectiveClientConfiguration(nativeSources.value);
+  const fallbackPath =
+    client.format === "zcode" ? client.zcodeFallbackPath : undefined;
+  if (
+    fallbackPath === undefined ||
+    (nativeDocument !== undefined &&
+      Object.keys(nativeDocument.servers).length > 0)
+  )
+    return ok({ document: nativeDocument, configPath: client.configPath });
+
+  const fallbackClient: SetupClient = {
+    ...client,
+    configPath: fallbackPath,
+    configPaths: [fallbackPath],
+    format: "zcode_fallback",
+  };
+  const fallbackSources = await readClientConfigurationFiles(
+    fallbackClient,
+    resources,
+  );
+  if (!fallbackSources.ok) return fallbackSources;
+  const fallbackDocument = effectiveClientConfiguration(fallbackSources.value);
+  return ok(
+    fallbackDocument === undefined
+      ? { document: nativeDocument, configPath: client.configPath }
+      : { document: fallbackDocument, configPath: fallbackPath },
+  );
+};

src/application/ClientRegistrationStatus.ts

@@ -1,8 +1,5 @@
 import { readClientPolicyBlock } from "./GeminiClientSettings.js";
-import {
-  effectiveClientConfiguration,
-  readClientConfigurationFiles,
-} from "./ClientConfigurationFiles.js";
+import { readEffectiveClientRegistrationConfiguration } from "./ClientConfigurationFiles.js";
 import {
   clientServerForcedEnabled,
   clientServerListedDisabled,
@@ -144,24 +141,26 @@ export const readClientRegistrationInspections = async (
         });
       continue;
     }
+    let selectedConfigPath = client.configPath;
     try {
-      const files = await readClientConfigurationFiles(
+      const configuration = await readEffectiveClientRegistrationConfiguration(
         client,
         options.resources,
       );
-      if (!files.ok) {
+      if (!configuration.ok) {
         record({
           client: client.name,
-          config_path: client.configPath,
+          config_path: configuration.error.path,
           command: [],
           state: "invalid",
-          remediation: files.error.detail,
+          remediation: configuration.error.detail,
         });
         continue;
       }
-      const parsed = effectiveClientConfiguration(files.value);
+      const { document: parsed, configPath } = configuration.value;
+      selectedConfigPath = configPath;
       if (parsed === undefined) {
-        record(unavailableStatus(client, "missing"));
+        record(unavailableStatus(client, "missing", configPath));
         continue;
       }
       const policy = await readClientPolicyBlock(
@@ -173,7 +172,7 @@ export const readClientRegistrationInspections = async (
       if (!policy.ok) {
         record({
           client: client.name,
-          config_path: client.configPath,
+          config_path: configPath,
           command: [],
           state: "invalid",
           remediation: policy.error.detail,
@@ -190,17 +189,26 @@ export const readClientRegistrationInspections = async (
         if (editabilityError !== undefined) {
           record({
             client: client.name,
-            config_path: client.configPath,
+            config_path: configPath,
             command: [],
             state: "invalid",
             remediation: editabilityError.message,
           });
           continue;
         }
-        record(unavailableStatus(client, "missing"));
+        record(unavailableStatus(client, "missing", configPath));
         continue;
       }
-      const registration = parseRegistration(raw, client);
+      const effectiveClient: SetupClient =
+        parsed.dialect === "zcode_fallback"
+          ? {
+              ...client,
+              configPath,
+              configPaths: [configPath],
+              format: "zcode_fallback",
+            }
+          : client;
+      const registration = parseRegistration(raw, effectiveClient);
       const command: RegistrationCommand = [
         registration.command,
         ...registration.args,
@@ -213,13 +221,13 @@ export const readClientRegistrationInspections = async (
         packageVersion !== PRODUCT_IDENTITY.packageVersion;
       record(
         configuredStatus(
-          client,
+          effectiveClient,
           command,
           activation === "enabled" &&
             !packageVersionDrift &&
             registrationAligned(
               registration,
-              client,
+              effectiveClient,
               currentCommandPath,
               options.platform ?? process.platform,
             ) &&
@@ -237,7 +245,11 @@ export const readClientRegistrationInspections = async (
       );
     } catch (cause: unknown) {
       record(
-        unavailableStatus(client, isMissing(cause) ? "missing" : "invalid"),
+        unavailableStatus(
+          client,
+          isMissing(cause) ? "missing" : "invalid",
+          selectedConfigPath,
+        ),
       );
     }
   }
@@ -254,7 +266,8 @@ const registrationActivation = (
   (client.format !== "grok" && registration.disabled === true) ||
   (registration.enabled === false &&
     !clientServerForcedEnabled(parsed, PRODUCT_IDENTITY.mcpServerKey)) ||
-  (client.format === "zcode" && registration.enable === false) ||
+  ((parsed.dialect === "zcode" || parsed.dialect === "zcode_fallback") &&
+    registration.enable === false) ||
   clientServerListedDisabled(parsed, PRODUCT_IDENTITY.mcpServerKey)
     ? "disabled"
     : "enabled";
@@ -435,9 +448,10 @@ const packageVersionRemediation = (
 const unavailableStatus = (
   client: SetupClient,
   state: "missing" | "invalid",
+  configPath: string = client.configPath,
 ): ClientRegistrationStatus => ({
   client: client.name,
-  config_path: client.configPath,
+  config_path: configPath,
   command: [],
   state,
   remediation: remediation(client),

src/application/DirectAnalysis.ts

@@ -10,7 +10,10 @@ import type { Logger } from "pino";
 import { createEvidence } from "../domain/evidence.js";
 import type { Evidence } from "../domain/evidence.js";
 import type { NativeToolName } from "../contracts/native/nativeToolContracts.js";
-import type { ArtifactAnalysisOperation } from "../contracts/artifactToolContracts.js";
+import {
+  ARTIFACT_ANALYSIS_OPERATIONS,
+  type ArtifactAnalysisOperation,
+} from "../contracts/artifactToolContracts.js";
 import {
   isManagedToolName,
   type ManagedToolName,
@@ -79,6 +82,10 @@ type DirectAnalysisTool =
   | "trace_native_ui_action"
   | "trace_native_values";
 
+const ARTIFACT_ANALYSIS_OPERATION_SET: ReadonlySet<string> = new Set(
+  ARTIFACT_ANALYSIS_OPERATIONS,
+);
+
 /**
  * Open one binary, execute one tool, and always release provider resources.
  * Unlike MCP mode, every CLI invocation is intentionally isolated and does not
@@ -129,16 +136,26 @@ export const runProviderAnalysis = async (
     logger?: Logger,
     signal?: AbortSignal,
   ]
-): Promise<JsonValue> =>
-  isManagedToolName(tool)
-    ? runManagedProviderAnalysis(dependencies, path, tool, arguments_, signal)
-    : withProcessCancellation(signal, (operationSignal) =>
-        runAnalysis(dependencies, path, tool, arguments_, {
-          logger,
-          snapshotPath: undefined,
-          signal: operationSignal,
-        }),
-      );
+): Promise<JsonValue> => {
+  if (isManagedToolName(tool))
+    return runManagedProviderAnalysis(
+      dependencies,
+      path,
+      tool,
+      arguments_,
+      signal,
+    );
+  return withProcessCancellation(signal, (operationSignal) =>
+    runAnalysis(dependencies, path, tool, arguments_, {
+      logger,
+      snapshotPath: undefined,
+      signal: operationSignal,
+      ...(ARTIFACT_ANALYSIS_OPERATION_SET.has(tool)
+        ? { createSession: dependencies.createArtifactBinarySession }
+        : {}),
+    }),
+  );
+};
 
 /** Execute managed metadata inspection in an isolated managed-only session. */
 export const runManagedProviderExecution = async (
@@ -205,6 +222,7 @@ const runAnalysis = async (
     readonly logger: Logger;
     readonly snapshotPath: string | undefined;
     readonly signal: AbortSignal;
+    readonly createSession?: () => BinarySession | Promise<BinarySession>;
     readonly providerId?: AnalysisProviderSelector;
     readonly formatHint?: ExecutableFormatHint;
     readonly architecture?: BinaryArchitecture;
@@ -212,9 +230,14 @@ const runAnalysis = async (
   },
 ): Promise<JsonValue> => {
   const { logger, signal, snapshotPath } = options;
-  const config = dependencies.readConfiguration();
-  if (!config.ok) return cliError(config.error);
-  const session = await dependencies.createBinarySession(config.value, logger);
+  let session: BinarySession;
+  if (options.createSession !== undefined) {
+    session = await options.createSession();
+  } else {
+    const config = dependencies.readConfiguration();
+    if (!config.ok) return cliError(config.error);
+    session = await dependencies.createBinarySession(config.value, logger);
+  }
   return withSessionCleanup(
     session,
     async () => {

src/application/DirectAnalysisDependencies.ts

@@ -11,6 +11,10 @@ export interface DirectAnalysisDependencies {
     config: AppConfig,
     logger: Logger,
   ) => BinarySession | Promise<BinarySession>;
+  /** Create an artifact-only session without selecting native analysis engines. */
+  readonly createArtifactBinarySession: () =>
+    | BinarySession
+    | Promise<BinarySession>;
   readonly createManagedBinarySession: () =>
     | BinarySession
     | Promise<BinarySession>;

src/application/Doctor.ts

@@ -99,6 +99,8 @@ export interface DoctorHost {
   brewHopperPath(): Promise<string | undefined>;
   manualHopperPaths(): Promise<readonly string[]>;
   providerInspections?(): Promise<readonly DoctorProviderInspection[]>;
+  /** Validated provider settings preserved by setup, independent of readiness. */
+  providerRegistrationEnvironment?(): Readonly<Record<string, string>>;
   installationPaths?(): Promise<readonly string[]>;
   installedSkillIdentity?(
     clientIds: readonly string[],
@@ -368,6 +370,9 @@ export interface SystemDoctorHostOptions {
   readonly providerInspections?: () => Promise<
     readonly DoctorProviderInspection[]
   >;
+  readonly providerRegistrationEnvironment?: () => Readonly<
+    Record<string, string>
+  >;
   readonly linuxDemoRuntimeCheck?: () => Promise<DoctorCheck>;
 }
 
@@ -478,6 +483,12 @@ export const systemDoctorHost = (
     ...(options.providerInspections === undefined
       ? {}
       : { providerInspections: options.providerInspections }),
+    ...(options.providerRegistrationEnvironment === undefined
+      ? {}
+      : {
+          providerRegistrationEnvironment:
+            options.providerRegistrationEnvironment,
+        }),
     async ilspyCmdVersion(path) {
       try {
         await access(path, constants.X_OK);

src/application/HermesConfigurationYaml.test.ts

@@ -1,15 +1,17 @@
 import { describe, expect, it } from "vitest";
+import { parse } from "yaml";
 
 import {
   editHermesConfigurationYaml,
   parseHermesConfigurationYaml,
+  stringifyHermesConfigurationYaml,
 } from "./HermesConfigurationYaml.js";
 
 describe("Hermes configuration YAML", () => {
   it("writes an edited number from its new value", () => {
     expect(
-      editHermesConfigurationYaml("mode: 0600\nmask: 0x1F\n", ["mode"], 384),
-    ).toBe("mode: 384\nmask: 0x1F\n");
+      editHermesConfigurationYaml("mode: 0600\nmask: 0x1F\n", ["mode"], 420),
+    ).toBe("mode: 0644\nmask: 0x1F\n");
   });
 
   it("accepts keys Hermes reads as distinct and rejects a repeated key", () => {
@@ -17,5 +19,118 @@ describe("Hermes configuration YAML", () => {
       parseHermesConfigurationYaml("0600: octal\n600: decimal\n"),
     ).not.toThrow();
     expect(() => parseHermesConfigurationYaml('a: 1\n"a": 2\n')).toThrow();
+    expect(() => parseHermesConfigurationYaml("yes: 1\ntrue: 2\n")).toThrow();
+    expect(() => parseHermesConfigurationYaml("no: 1\noff: 2\n")).toThrow();
+  });
+
+  it("matches Hermes numeric key equality without losing large integer precision", () => {
+    for (const text of [
+      "1: first\n01: second\n",
+      "1.0: first\n1.00: second\n",
+      "true: first\n1: second\n",
+      "false: first\n0.0: second\n",
+      ".nan: first\n.NAN: second\n",
+      "9007199254740992: first\n9007199254740992.0: second\n",
+    ])
+      expect(() => parseHermesConfigurationYaml(text)).toThrow();
+
+    expect(() =>
+      parseHermesConfigurationYaml(
+        "9007199254740992: first\n9007199254740993: second\n",
+      ),
+    ).not.toThrow();
+    expect(() =>
+      parseHermesConfigurationYaml(
+        "9007199254740993: first\n9007199254740993.0: second\n",
+      ),
+    ).not.toThrow();
+    expect(() =>
+      parseHermesConfigurationYaml("0600: octal\n600: decimal\n"),
+    ).not.toThrow();
+    expect(parseHermesConfigurationYaml("value: 9007199254740993\n")).toEqual({
+      value: Number("9007199254740993"),
+    });
+  });
+
+  it("matches Hermes timestamp key precision, timezone, and date-type equality", () => {
+    for (const text of [
+      "2026-10-14T00:00:00.123456+08:00: first\n2026-10-13T16:00:00.123456Z: second\n",
+      "2026-10-14T00:00:00.1234565Z: first\n2026-10-14T00:00:00.123457Z: second\n",
+    ])
+      expect(() => parseHermesConfigurationYaml(text)).toThrow();
+
+    expect(() =>
+      parseHermesConfigurationYaml(
+        "2026-10-14T00:00:00.123456Z: first\n2026-10-14T00:00:00.123457Z: second\n",
+      ),
+    ).not.toThrow();
+    expect(() =>
+      parseHermesConfigurationYaml(
+        "2026-10-14: date\n2026-10-14T00:00:00Z: timestamp\n",
+      ),
+    ).not.toThrow();
+    expect(() =>
+      parseHermesConfigurationYaml(
+        "2026-10-14T00:00:00: local\n2026-10-14T00:00:00Z: utc\n",
+      ),
+    ).not.toThrow();
+  });
+
+  it("matches Hermes timestamp resolution and rejects invalid calendar values", () => {
+    expect(parseHermesConfigurationYaml("short: 2026-1-1\n")).toEqual({
+      short: "2026-1-1",
+    });
+    expect(
+      parseHermesConfigurationYaml("short: 2026-1-1 1:02:03.\n"),
+    ).toMatchObject({ short: expect.any(Date) });
+    expect(
+      parseHermesConfigurationYaml("short: 2026-01-01 1:02:03\n"),
+    ).toMatchObject({ short: expect.any(Date) });
+    expect(parseHermesConfigurationYaml("short: 2026-01-01 1:2:03\n")).toEqual({
+      short: "2026-01-01 1:2:03",
+    });
+    expect(parseHermesConfigurationYaml("short: 2026-01-01 1:02:3\n")).toEqual({
+      short: "2026-01-01 1:02:3",
+    });
+    const firstYear = parseHermesConfigurationYaml("date: 0001-01-01\n") as {
+      date: Date;
+    };
+    expect(firstYear.date.getUTCFullYear()).toBe(1);
+    expect(
+      parseHermesConfigurationYaml("date: 1969-12-31T23:59:59.999999Z\n"),
+    ).toEqual({ date: new Date("1969-12-31T23:59:59.999Z") });
+
+    for (const invalid of [
+      "date: 0000-01-01\n",
+      "date: 2026-02-30\n",
+      "date: 2026-01-01 24:00:00\n",
+      "date: 2026-01-01 00:00:00+24\n",
+      "date: 9999-12-31T23:59:59.9999995Z\n",
+    ])
+      expect(() => parseHermesConfigurationYaml(invalid)).toThrow();
+  });
+
+  it("preserves YAML 1.1 strings on fresh files and honors directives on edits", () => {
+    const created = stringifyHermesConfigurationYaml({
+      mcp_servers: { rea: { env: { PROFILE: "off" } } },
+    });
+    expect(parse(created, { version: "1.1" })).toMatchObject({
+      mcp_servers: { rea: { env: { PROFILE: "off" } } },
+    });
+
+    const original =
+      "%YAML 1.2\n---\nnotify: on\ntimestamp: 2026-10-14T00:00:00.123456+08:00\n";
+    const updated = editHermesConfigurationYaml(original, ["environment"], {
+      SETTING: "off",
+      DATE: "2026-10-14",
+    });
+    expect(updated.startsWith(original)).toBe(true);
+    expect(parse(updated)).toMatchObject({
+      notify: "on",
+      environment: { SETTING: "off", DATE: "2026-10-14" },
+    });
+    expect(
+      parseHermesConfigurationYaml("%YAML 1.2\n---\ndate: 2026-10-14\n"),
+    ).toEqual({ date: new Date("2026-10-14") });
   });
 });

src/application/HermesConfigurationYaml.ts

@@ -1,28 +1,195 @@
 import {
   isScalar,
   parseDocument,
-  type Document,
+  Document,
+  Schema,
   type ParsedNode,
   type ScalarTag,
   type Tags,
 } from "yaml";
 
-const NUMBER_TAGS = new Set([
+const SOURCE_SCALAR_TAGS = new Set([
   "tag:yaml.org,2002:int",
   "tag:yaml.org,2002:float",
+  "tag:yaml.org,2002:timestamp",
 ]);
 
+// Hermes's ruamel reader resolves dates even with an explicit YAML 1.2 directive.
+const timestampTag = new Schema({ schema: "yaml-1.1" }).tags.find(
+  (tag): tag is ScalarTag =>
+    tag.tag === "tag:yaml.org,2002:timestamp" && tag.collection === undefined,
+);
+if (timestampTag === undefined)
+  throw new Error("The YAML 1.1 schema must provide its timestamp tag");
+
+type HermesKey =
+  | { readonly kind: "numeric"; readonly value: bigint | number }
+  | { readonly kind: "timestamp"; readonly value: string }
+  | { readonly kind: "other"; readonly value: unknown };
+
+const timestampSource =
+  /^(\d{4})-(\d{1,2})-(\d{1,2})(?:(?:[Tt]|[ \t]+)(\d{1,2}):(\d{2}):(\d{2})(?:\.([0-9]*))?(?:[ \t]*(Z|([-+])(\d{1,2})(?::(\d{2}))?))?)?$/;
+
+const hermesTimestampImplicit =
+  /^(?:\d{4}-\d{2}-\d{2}|\d{4}-\d{1,2}-\d{1,2}(?:[Tt]|[ \t]+)\d{1,2}:\d{2}:\d{2}(?:\.[0-9]*)?(?:[ \t]*(?:Z|[-+]\d{1,2}(?::\d{2})?))?)$/;
+
+interface HermesTimestampFacts {
+  readonly key: string;
+  readonly value: Date;
+}
+
+const floorDivide = (value: number, divisor: number): number =>
+  Math.floor(value / divisor);
+
+/** Days since 1970-01-01 using the proleptic Gregorian calendar. */
+const civilDay = (year: number, month: number, day: number): number => {
+  const adjustedYear = year - (month <= 2 ? 1 : 0);
+  const era = floorDivide(adjustedYear, 400);
+  const yearOfEra = adjustedYear - era * 400;
+  const adjustedMonth = month + (month > 2 ? -3 : 9);
+  const dayOfYear = floorDivide(153 * adjustedMonth + 2, 5) + day - 1;
+  const dayOfEra =
+    yearOfEra * 365 +
+    floorDivide(yearOfEra, 4) -
+    floorDivide(yearOfEra, 100) +
+    dayOfYear;
+  return era * 146097 + dayOfEra - 719468;
+};
+
+/** Parse the exact timestamp forms and values accepted by ruamel's safe loader. */
+const parseHermesTimestamp = (
+  source: string,
+): HermesTimestampFacts | undefined => {
+  const match = timestampSource.exec(source);
+  if (match === null) return undefined;
+  const [
+    ,
+    yearText,
+    monthText,
+    dayText,
+    hourText,
+    minuteText,
+    secondText,
+    fraction,
+    zone,
+    sign,
+    zoneHourText,
+    zoneMinuteText,
+  ] = match;
+  if (
+    yearText === undefined ||
+    monthText === undefined ||
+    dayText === undefined
+  )
+    return undefined;
+  const year = Number(yearText);
+  const month = Number(monthText);
+  const dayOfMonth = Number(dayText);
+  if (year < 1 || year > 9999 || month < 1 || month > 12) return undefined;
+  const leapYear = year % 4 === 0 && (year % 100 !== 0 || year % 400 === 0);
+  const monthDays = [
+    31,
+    leapYear ? 29 : 28,
+    31,
+    30,
+    31,
+    30,
+    31,
+    31,
+    30,
+    31,
+    30,
+    31,
+  ];
+  if (dayOfMonth < 1 || dayOfMonth > (monthDays[month - 1] ?? 0))
+    return undefined;
+  const date = `${yearText}-${monthText.padStart(2, "0")}-${dayText.padStart(2, "0")}`;
+  const day = civilDay(year, month, dayOfMonth);
+  if (hourText === undefined) {
+    const micros = BigInt(day) * 86_400_000_000n;
+    return { key: `date:${date}`, value: new Date(Number(micros / 1000n)) };
+  }
+
+  const hour = Number(hourText);
+  const minute = Number(minuteText);
+  const second = Number(secondText);
+  if (hour > 23 || minute > 59 || second > 59) return undefined;
+  const zoneHour = Number(zoneHourText ?? 0);
+  const zoneMinute = Number(zoneMinuteText ?? 0);
+  if (zoneHour > 23 || zoneMinute > 59) return undefined;
+
+  let microseconds = 0;
+  if (fraction !== undefined && fraction.length > 0) {
+    microseconds = Number((fraction.slice(0, 6) + "000000").slice(0, 6));
+    if (fraction.length > 6 && Number(fraction[6]) > 4) microseconds += 1;
+  }
+  const wholeSeconds = hour * 3600 + minute * 60 + second;
+  if (
+    year === 9999 &&
+    month === 12 &&
+    dayOfMonth === 31 &&
+    wholeSeconds === 86_399 &&
+    microseconds === 1_000_000
+  )
+    return undefined;
+  let micros =
+    BigInt(day) * 86_400_000_000n +
+    BigInt(wholeSeconds) * 1_000_000n +
+    BigInt(microseconds);
+  if (zone !== undefined && zone !== "Z") {
+    const offset = (zoneHour * 60 + zoneMinute) * (sign === "+" ? 1 : -1);
+    micros -= BigInt(offset) * 60_000_000n;
+  }
+  return {
+    key:
+      zone === undefined
+        ? `datetime-local:${micros}`
+        : `datetime-utc:${micros}`,
+    value: new Date(Number(micros / 1000n - (micros % 1000n < 0n ? 1n : 0n))),
+  };
+};
+
+const numericValue = (value: unknown): bigint | number | undefined => {
+  if (typeof value === "boolean") return value ? 1n : 0n;
+  if (typeof value === "bigint" || typeof value === "number") return value;
+  return undefined;
+};
+
+const numericValuesEqual = (
+  left: bigint | number,
+  right: bigint | number,
+): boolean => {
+  if (typeof left === "bigint" && typeof right === "bigint")
+    return left === right;
+  if (typeof left === "number" && typeof right === "number")
+    return left === right || (Number.isNaN(left) && Number.isNaN(right));
+  const integer = typeof left === "bigint" ? left : right;
+  const number = typeof left === "number" ? left : right;
+  return (
+    Number.isFinite(number) &&
+    Number.isInteger(number) &&
+    BigInt(number) === integer
+  );
+};
+
+const sameResolvedScalarValue = (left: unknown, right: unknown): boolean =>
+  Object.is(left, right) ||
+  (left instanceof Date &&
+    right instanceof Date &&
+    left.getTime() === right.getTime());
+
 /**
- * Write a parsed number with its source spelling while that spelling still
+ * Write a parsed scalar with its source spelling while that spelling still
  * reads as the node's value. Hermes reads config.yaml as YAML 1.1 with exact
  * integers, so re-printing a JavaScript number changes what it reads: a
  * Discord channel ID loses its low digits, `0600` (octal) becomes `600`, and
  * `0.0000001` becomes `1e-7`, which YAML 1.1 does not define as a float.
+ * Timestamp source also retains precision and offsets absent from JS Dates.
  */
-const keepNumberSource = (tag: Tags[number]): Tags[number] => {
+const keepScalarSource = (tag: Tags[number]): Tags[number] => {
   if (typeof tag === "string" || tag.collection !== undefined) return tag;
   const { stringify } = tag;
-  if (!NUMBER_TAGS.has(tag.tag) || stringify === undefined) return tag;
+  if (!SOURCE_SCALAR_TAGS.has(tag.tag) || stringify === undefined) return tag;
   return {
     ...tag,
     stringify: (item, context, ...rest) => {
@@ -37,25 +204,96 @@ const keepNumberSource = (tag: Tags[number]): Tags[number] => {
         () => undefined,
         context.doc.options,
       );
-      return Object.is(isScalar(read) ? read.value : read, item.value)
+      return sameResolvedScalarValue(
+        isScalar(read) ? read.value : read,
+        item.value,
+      )
         ? source
         : stringify(item, context, ...rest);
     },
   };
 };
 
-const HERMES_YAML_OPTIONS = {
-  customTags: (tags: Tags) => tags.map(keepNumberSource),
-  // Hermes keeps integers exact, so IDs that round to one double, or `0600`
-  // and `600`, are distinct keys.
-  uniqueKeys: (a: ParsedNode, b: ParsedNode) =>
-    a === b ||
-    (isScalar(a) &&
-      isScalar(b) &&
-      a.value === b.value &&
-      a.source === b.source),
+const createHermesYamlOptions = () => {
+  const timestamps = new Map<string, HermesTimestampFacts | undefined>();
+  const timestampFacts = (source: string): HermesTimestampFacts | undefined => {
+    if (timestamps.has(source)) return timestamps.get(source);
+    const facts = parseHermesTimestamp(source);
+    timestamps.set(source, facts);
+    return facts;
+  };
+  const hermesTimestampTag: ScalarTag = {
+    ...timestampTag,
+    test: hermesTimestampImplicit,
+    resolve: (source) => {
+      const facts = timestampFacts(source);
+      if (facts === undefined)
+        throw new Error(`Invalid Hermes YAML timestamp: ${source}`);
+      return facts.value;
+    },
+  };
+  const keyFacts = new WeakMap<object, HermesKey>();
+  const hermesKey = (node: ParsedNode): HermesKey => {
+    const cached = keyFacts.get(node);
+    if (cached !== undefined) return cached;
+    if (!isScalar(node)) return { kind: "other", value: node };
+    const numeric = numericValue(node.value);
+    const key =
+      numeric !== undefined
+        ? { kind: "numeric" as const, value: numeric }
+        : node.value instanceof Date
+          ? {
+              kind: "timestamp" as const,
+              value:
+                timestampFacts(node.source ?? "")?.key ??
+                `invalid:${node.source ?? ""}`,
+            }
+          : { kind: "other" as const, value: node.value };
+    keyFacts.set(node, key);
+    return key;
+  };
+  /** Python dict key equality is Hermes' duplicate-key behavior (bool is int). */
+  const hermesKeysEqual = (
+    leftNode: ParsedNode,
+    rightNode: ParsedNode,
+  ): boolean => {
+    const left = hermesKey(leftNode);
+    const right = hermesKey(rightNode);
+    if (left.kind !== right.kind) return false;
+    if (left.kind === "numeric" && right.kind === "numeric")
+      return numericValuesEqual(left.value, right.value);
+    return left.value === right.value;
+  };
+  return {
+    // Hermes defaults to YAML 1.1; an explicit document directive still wins.
+    // Use the same schema to interpret existing values and quote new strings.
+    version: "1.1" as const,
+    // Keep integer key identity exact; parseHermesConfigurationYaml's reviver
+    // restores the existing number-valued consumer contract.
+    intAsBigInt: true,
+    customTags: (tags: Tags) => {
+      const hasTimestamp = tags.some(
+        (tag) => typeof tag !== "string" && tag.tag === timestampTag.tag,
+      );
+      const withHermesTimestamp = hasTimestamp
+        ? tags.map((tag) =>
+            typeof tag !== "string" && tag.tag === timestampTag.tag
+              ? hermesTimestampTag
+              : tag,
+          )
+        : [...tags, hermesTimestampTag];
+      return withHermesTimestamp.map(keepScalarSource);
+    },
+    uniqueKeys: hermesKeysEqual,
+  };
 };
 
+/** Create a Hermes config using the same scalar rules as edits and readback. */
+export const stringifyHermesConfigurationYaml = (
+  document: Record<string, unknown>,
+): string =>
+  new Document(document, createHermesYamlOptions()).toString({ lineWidth: 0 });
+
 // A comment-only document has no root; a bare marker has an unwritten null
 // scalar. Explicit null values, tags and anchors remain actual values.
 const isEmptyYamlRoot = (root: Document["contents"]): boolean =>
@@ -67,7 +305,7 @@ const isEmptyYamlRoot = (root: Document["contents"]): boolean =>
     root.anchor === undefined);
 
 const parseHermesDocument = (text: string) => {
-  const document = parseDocument(text, HERMES_YAML_OPTIONS);
+  const document = parseDocument(text, createHermesYamlOptions());
   const error = document.errors[0];
   if (error !== undefined) throw error;
   return document;
@@ -76,7 +314,12 @@ const parseHermesDocument = (text: string) => {
 /** Parse a Hermes `config.yaml`, preserving the distinction between no root and explicit null. */
 export const parseHermesConfigurationYaml = (text: string): unknown => {
   const document = parseHermesDocument(text);
-  return isEmptyYamlRoot(document.contents) ? {} : document.toJS();
+  return isEmptyYamlRoot(document.contents)
+    ? {}
+    : document.toJS({
+        reviver: (_key, value) =>
+          typeof value === "bigint" ? Number(value) : value,
+      });
 };
 
 /** Set or delete one value in a Hermes `config.yaml`, keeping the rest as written. */
@@ -88,15 +331,25 @@ export const editHermesConfigurationYaml = (
   // A plain Document, so a bare `---` root can be replaced by a new map.
   const document: Document = parseHermesDocument(text);
   const root = document.contents;
-  if (isScalar(root) && isEmptyYamlRoot(root)) {
+  if (isEmptyYamlRoot(root)) {
     const map = document.createNode({});
-    map.commentBefore = [root.commentBefore, root.comment]
-      .filter((comment) => comment !== undefined)
-      .join("\n");
+    if (isScalar(root))
+      map.commentBefore = [root.commentBefore, root.comment]
+        .filter((comment) => comment !== undefined)
+        .join("\n");
     document.contents = map;
   }
   if (value === undefined) document.deleteIn(path);
-  else document.setIn(path, value);
+  else {
+    // setIn's implicit JS Map parents serialize as !!omap in YAML 1.1.
+    // Config settings are ordinary mappings, including absent server tables.
+    for (let length = 1; length < path.length; length++) {
+      const parent = path.slice(0, length);
+      if (!document.hasIn(parent))
+        document.setIn(parent, document.createNode({}));
+    }
+    document.setIn(path, value);
+  }
   // Editing REA must not reflow unrelated user prompts or other YAML scalars.
   return document.toString({ lineWidth: 0 });
 };

src/application/MipsElfMetadata.ts

@@ -2,6 +2,7 @@ import type { FileHandle } from "node:fs/promises";
 import type {
   MipsAbiFlags,
   MipsElfMetadata,
+  MipsGnuAttributes,
 } from "../domain/binaryTargetTypes.js";
 import { readElfFixedHeader } from "../domain/elfFixedHeader.js";
 import { err, ok, type Result } from "../domain/result.js";
@@ -9,12 +10,17 @@ import {
   readMipsElfSharedLoad,
   type MipsElfRelocationSection,
 } from "./MipsElfSharedLoad.js";
+import {
+  MIPS_GNU_ATTRIBUTES_MAX_BYTES,
+  parseMipsGnuAttributes,
+} from "./MipsGnuAttributes.js";
 
 const SHT_GNU_ATTRIBUTES = 0x6ffffff5;
 
 /** Observed ABI and load declarations, retaining unavailable source coverage. */
 export interface MipsElfInspection {
   readonly abiFlags: MipsAbiFlags | null;
+  readonly gnuAttributes: MipsGnuAttributes | null;
   readonly limitations: readonly string[];
   readonly sharedLoad?: MipsElfMetadata["sharedLoad"];
 }
@@ -120,6 +126,7 @@ export const readMipsElfMetadata = async (
   let programHeaders: Buffer | undefined;
   const relocationSections: MipsElfRelocationSection[] = [];
   const limitations: string[] = [];
+  let gnuAttributes: MipsGnuAttributes | null = null;
   for (const table of tables) {
     if (table.count === 0) {
       if (table.offset !== 0)
@@ -153,10 +160,25 @@ export const readMipsElfMetadata = async (
       checkCancelled();
       const position = i * table.entrySize;
       const type = u32(contents.value, position + table.typeOffset);
-      if (table.optional && type === SHT_GNU_ATTRIBUTES)
-        return err(
-          "MIPS ELF declares GNU ABI attributes that REA does not inspect; refusing provider selection until the declared ABI is parsed and reconciled",
+      if (table.optional && type === SHT_GNU_ATTRIBUTES) {
+        if (gnuAttributes !== null)
+          return err("duplicate MIPS GNU attribute sections");
+        const size = u32(contents.value, position + 20);
+        if (size === 0 || size > MIPS_GNU_ATTRIBUTES_MAX_BYTES)
+          return err(
+            `MIPS GNU attribute section size ${size} is outside REA's inspected bound of ${MIPS_GNU_ATTRIBUTES_MAX_BYTES} bytes`,
+          );
+        const section = await read(
+          u32(contents.value, position + 16),
+          size,
+          "GNU attribute section",
         );
+        if (!section.ok) return section;
+        const parsed = parseMipsGnuAttributes(section.value, little);
+        if (!parsed.ok) return parsed;
+        gnuAttributes = parsed.value;
+        continue;
+      }
       if (metadata.type === 3 && table.optional && (type === 4 || type === 9))
         relocationSections.push({
           type,
@@ -208,7 +230,7 @@ export const readMipsElfMetadata = async (
         }
       : {};
   if (record === undefined)
-    return ok({ abiFlags: null, limitations, ...shared });
+    return ok({ abiFlags: null, gnuAttributes, limitations, ...shared });
   // Preserve declarations verbatim, including unknown versions/values. Provider
   // admission, not parsing, decides which interpretations have been verified.
   const abiFlags: MipsAbiFlags = {
@@ -224,5 +246,14 @@ export const readMipsElfMetadata = async (
     flags1: u32(record, 16),
     flags2: u32(record, 20),
   };
-  return ok({ abiFlags, limitations, ...shared });
+  if (
+    gnuAttributes !== null &&
+    gnuAttributes.fpAbi !== null &&
+    gnuAttributes.fpAbi !== 0 &&
+    gnuAttributes.fpAbi !== abiFlags.fpAbi
+  )
+    return err(
+      "conflicting MIPS ABI flags and GNU floating-point ABI declarations",
+    );
+  return ok({ abiFlags, gnuAttributes, limitations, ...shared });
 };

src/application/MipsGnuAttributes.test.ts

@@ -0,0 +1,121 @@
+import { describe, expect, it } from "vitest";
+import { parseMipsGnuAttributes } from "./MipsGnuAttributes.js";
+
+const u32 = (value: number, little: boolean): number[] => {
+  const bytes = Buffer.alloc(4);
+  if (little) bytes.writeUInt32LE(value);
+  else bytes.writeUInt32BE(value);
+  return [...bytes];
+};
+
+const section = (
+  attributes: readonly number[],
+  {
+    little = true,
+    vendor = "gnu",
+    scope = 1,
+  }: {
+    readonly little?: boolean;
+    readonly vendor?: string;
+    readonly scope?: number;
+  } = {},
+): Buffer => {
+  const scoped = [
+    scope,
+    ...u32(1 + 4 + attributes.length, little),
+    ...attributes,
+  ];
+  const name = [...Buffer.from(vendor, "latin1"), 0];
+  return Buffer.from([
+    0x41,
+    ...u32(4 + name.length + scoped.length, little),
+    ...name,
+    ...scoped,
+  ]);
+};
+
+describe("MIPS GNU attribute parsing", () => {
+  it.each([true, false])(
+    "reads MIPS FP and MSA ABI attributes in ELF byte order (little=%s)",
+    (little) => {
+      expect(
+        parseMipsGnuAttributes(section([4, 1, 8, 0], { little }), little),
+      ).toEqual({ ok: true, value: { fpAbi: 1, msa: 0 } });
+    },
+  );
+
+  it("retains a multi-byte value and a missing tag separately", () => {
+    expect(parseMipsGnuAttributes(section([4, 0x85, 0x01]), true)).toEqual({
+      ok: true,
+      value: { fpAbi: 133, msa: null },
+    });
+    expect(parseMipsGnuAttributes(section([]), true)).toEqual({
+      ok: true,
+      value: { fpAbi: null, msa: null },
+    });
+  });
+
+  it.each([
+    ["unknown version", Buffer.from([0x42]), /format version/u],
+    ["truncated vendor length", Buffer.from([0x41, 1, 0]), /truncated/u],
+    [
+      "overrunning vendor subsection",
+      Buffer.from([0x41, ...u32(64, true), 0x67, 0x6e, 0x75, 0]),
+      /does not fit the section/u,
+    ],
+    [
+      "unterminated vendor",
+      Buffer.from([0x41, ...u32(7, true), 0x67, 0x6e, 0x75]),
+      /unterminated/u,
+    ],
+    ["non-GNU vendor", section([4, 1], { vendor: "arm" }), /non-GNU vendor/u],
+    ["section scope", section([4, 1], { scope: 2 }), /sections or symbols/u],
+    ["symbol scope", section([4, 1], { scope: 3 }), /sections or symbols/u],
+    ["unknown tag", section([6, 1]), /tag 6/u],
+    [
+      "duplicate FP tag",
+      section([4, 1, 4, 1]),
+      /duplicate MIPS GNU floating-point/u,
+    ],
+    ["duplicate MSA tag", section([8, 0, 8, 0]), /duplicate MIPS GNU MSA/u],
+    [
+      "truncated value",
+      section([4, 0x81]),
+      /malformed MIPS GNU attribute value/u,
+    ],
+    [
+      "value wider than 32 bits",
+      section([4, 0xff, 0xff, 0xff, 0xff, 0x1f]),
+      /malformed MIPS GNU attribute value/u,
+    ],
+  ] as const)("refuses %s", (_label, bytes, reason) => {
+    const result = parseMipsGnuAttributes(bytes, true);
+    expect(result.ok).toBe(false);
+    if (!result.ok) expect(result.error).toMatch(reason);
+  });
+
+  it("requires subsection lengths in the ELF byte order", () => {
+    expect(
+      parseMipsGnuAttributes(section([4, 1], { little: true }), false).ok,
+    ).toBe(false);
+  });
+
+  it("refuses a scope length beyond its vendor subsection", () => {
+    const bytes = section([4, 1]);
+    bytes.writeUInt32LE(64, 1 + 4 + 4 + 1);
+    const result = parseMipsGnuAttributes(bytes, true);
+    expect(result.ok).toBe(false);
+    if (!result.ok) expect(result.error).toMatch(/scope length/u);
+  });
+
+  it("refuses a repeated GNU vendor subsection", () => {
+    const one = section([4, 1]);
+    const result = parseMipsGnuAttributes(
+      Buffer.concat([one, one.subarray(1)]),
+      true,
+    );
+    expect(result.ok).toBe(false);
+    if (!result.ok)
+      expect(result.error).toMatch(/duplicate MIPS GNU attribute vendor/u);
+  });
+});

src/application/MipsGnuAttributes.ts

@@ -0,0 +1,115 @@
+import type { MipsGnuAttributes } from "../domain/binaryTargetTypes.js";
+import { err, ok, type Result } from "../domain/result.js";
+
+/** Bound the section read before its declared size can drive allocation. */
+export const MIPS_GNU_ATTRIBUTES_MAX_BYTES = 4096;
+
+const FORMAT_VERSION = 0x41;
+const TAG_FILE = 1;
+const TAG_GNU_MIPS_ABI_FP = 4;
+const TAG_GNU_MIPS_ABI_MSA = 8;
+
+/**
+ * Read only GNU file-scope MIPS ABI attributes REA understands. Unknown
+ * vendors, scopes and tags fail closed; their declarations are not skipped.
+ */
+export const parseMipsGnuAttributes = (
+  bytes: Buffer,
+  littleEndian: boolean,
+): Result<MipsGnuAttributes, string> => {
+  if (bytes.length === 0 || bytes[0] !== FORMAT_VERSION)
+    return err("unsupported MIPS GNU attribute section format version");
+
+  const readU32 = (offset: number): number =>
+    littleEndian ? bytes.readUInt32LE(offset) : bytes.readUInt32BE(offset);
+  const readUleb = (
+    offset: number,
+    end: number,
+  ): { readonly value: number; readonly next: number } | undefined => {
+    let value = 0;
+    for (let index = 0; index < 5 && offset + index < end; index += 1) {
+      const byte = bytes[offset + index]!;
+      value += (byte & 0x7f) * 2 ** (7 * index);
+      if ((byte & 0x80) === 0)
+        return value <= 0xffffffff
+          ? { value, next: offset + index + 1 }
+          : undefined;
+    }
+    return undefined;
+  };
+
+  let fpAbi: number | null = null;
+  let msa: number | null = null;
+  let vendorSeen = false;
+  let position = 1;
+  while (position < bytes.length) {
+    if (bytes.length - position < 4)
+      return err("truncated MIPS GNU attribute subsection length");
+    const length = readU32(position);
+    if (length < 4 || length > bytes.length - position)
+      return err(
+        "MIPS GNU attribute subsection length does not fit the section",
+      );
+    const end = position + length;
+    const vendorEnd = bytes.indexOf(0, position + 4);
+    if (vendorEnd < 0 || vendorEnd >= end)
+      return err("unterminated MIPS GNU attribute vendor name");
+    if (bytes.toString("latin1", position + 4, vendorEnd) !== "gnu")
+      return err(
+        "MIPS ELF declares non-GNU vendor attributes that REA does not inspect",
+      );
+    if (vendorSeen)
+      return err("duplicate MIPS GNU attribute vendor subsections");
+    vendorSeen = true;
+
+    let cursor = vendorEnd + 1;
+    while (cursor < end) {
+      const scopeStart = cursor;
+      const scope = readUleb(cursor, end);
+      if (scope === undefined)
+        return err("malformed MIPS GNU attribute scope tag");
+      if (scope.value !== TAG_FILE)
+        return err(
+          "MIPS GNU attributes scoped to sections or symbols are not inspected by REA",
+        );
+      if (end - scope.next < 4)
+        return err("truncated MIPS GNU attribute scope length");
+      const scopeLength = readU32(scope.next);
+      if (
+        scopeLength < scope.next + 4 - scopeStart ||
+        scopeLength > end - scopeStart
+      )
+        return err(
+          "MIPS GNU attribute scope length does not fit its subsection",
+        );
+      const scopeEnd = scopeStart + scopeLength;
+      cursor = scope.next + 4;
+      while (cursor < scopeEnd) {
+        const tag = readUleb(cursor, scopeEnd);
+        if (tag === undefined) return err("malformed MIPS GNU attribute tag");
+        if (
+          tag.value !== TAG_GNU_MIPS_ABI_FP &&
+          tag.value !== TAG_GNU_MIPS_ABI_MSA
+        )
+          return err(
+            `MIPS ELF declares GNU attribute tag ${tag.value}, which REA does not inspect`,
+          );
+        const value = readUleb(tag.next, scopeEnd);
+        if (value === undefined)
+          return err("malformed MIPS GNU attribute value");
+        if (tag.value === TAG_GNU_MIPS_ABI_FP) {
+          if (fpAbi !== null)
+            return err("duplicate MIPS GNU floating-point ABI attributes");
+          fpAbi = value.value;
+        } else {
+          if (msa !== null) return err("duplicate MIPS GNU MSA ABI attributes");
+          msa = value.value;
+        }
+        cursor = value.next;
+      }
+      cursor = scopeEnd;
+    }
+    position = end;
+  }
+  return ok({ fpAbi, msa });
+};

src/application/ReferenceSourceImportEntries.test.ts

@@ -0,0 +1,60 @@
+import { createHash } from "node:crypto";
+
+import { expect, it } from "vitest";
+
+import { parseReferenceSourceEntries } from "./ReferenceSourceImportEntries.js";
+import { historicalSourceLanguages } from "../domain/referenceSourceGraph.js";
+import type { ReferenceSourceRead } from "../reference/ReferenceSourceReaderTypes.js";
+
+it("retains Kotlin source identity and language across the inventory projection", () => {
+  const files = [
+    [
+      "MainActivity.kt",
+      "import android.app.Activity\nclass MainActivity : Activity()\n",
+      ["source"],
+      "Kotlin",
+    ],
+    ["task.kts", 'println("hello")\n', ["source"], "Kotlin"],
+    [
+      "build.gradle.kts",
+      'plugins { kotlin("jvm") version "2.3.0" }\n',
+      ["manifest", "source"],
+      "Kotlin",
+    ],
+    ["MainActivity.kt.backup", "backup\n", ["unknown"], null],
+    ["Legacy.java", "class Legacy {}\n", ["source"], "Java"],
+  ] as const;
+  const read: ReferenceSourceRead = {
+    root: "/selected/source",
+    entries: files.map(([path, content]) => ({
+      status: "read",
+      kind: "file",
+      path,
+      bytes: Buffer.from(content),
+      size: Buffer.byteLength(content),
+    })),
+    bytesRead: files.reduce(
+      (sum, [, content]) => sum + Buffer.byteLength(content),
+      0,
+    ),
+    limitations: [],
+  };
+  const parsed = parseReferenceSourceEntries(
+    read,
+    new Set(files.map(([path]) => path)),
+  );
+  for (const [path, content, classifications, language] of files)
+    expect(parsed.entries).toContainEqual({
+      path,
+      kind: "file",
+      language,
+      classifications,
+      size: Buffer.byteLength(content),
+      sha256: createHash("sha256").update(content).digest("hex"),
+      content_state: "hashed",
+      limitations: [],
+    });
+  expect(historicalSourceLanguages(parsed.entries)).toEqual(["Java", "Kotlin"]);
+  expect(parsed.parseFailures).toEqual([]);
+  expect(parsed.relationships).toEqual([]);
+});

src/application/SetupHost.ts

@@ -175,6 +175,7 @@ export const systemSetupHost = (
           ...providerRegistrationEnvironment(
             diagnosis.providerInspections ?? [],
           ),
+          ...doctorHost.providerRegistrationEnvironment?.(),
           ...(diagnosis.hopperPath === undefined
             ? {}
             : { HOPPER_LAUNCHER_PATH: diagnosis.hopperPath }),

src/application/analysisView/AnalysisViewService.test.ts

@@ -24,7 +24,6 @@ import { EvidenceIntegrityError } from "../../domain/evidenceErrors.js";
 import { err, ok } from "../../domain/result.js";
 import { EvidenceLedger } from "../investigation/EvidenceLedger.js";
 import { WEB_NETWORK_CAPTURE_LIMITS } from "../../domain/webNetworkCapture.js";
-import { inspectAnalysisViewInputSchema } from "../../domain/analysisView/analysisView.js";
 
 it.each(["/fixtures/unknown.exe", ""])(
   "preserves recorded empty native identity fields: path=%j",
@@ -433,26 +432,39 @@ it("refuses an object-dense borrowed capture before making a full schema clone",
   expect(ledger.forAnalysis(parent.evidence_id)).toBe(borrowed);
 });
 
-it("borrows inline Evidence until admission without invoking nested accessors", () => {
-  let accessed = false;
-  const evidence = {
-    get normalized_result() {
-      accessed = true;
-      throw new Error("Evidence must be admitted before parsing");
-    },
-  };
-  const input = {
-    source: { kind: "inline", evidence },
-    view: { kind: "api-surface" },
-  };
-  const parsed = inspectAnalysisViewInputSchema.parse(input);
-  if (parsed.source.kind !== "inline") throw new Error("Expected inline input");
-  expect(parsed.source.evidence).toBe(evidence);
-  expect(inspectAnalysisView(input)).toMatchObject({
-    ok: false,
-    error: { _tag: "AnalysisInputError" },
-  });
-  expect(accessed).toBe(false);
+it("rejects accessor-backed inline Evidence before all view projections", () => {
+  const views = [
+    { kind: "summary" },
+    { kind: "capture" },
+    { kind: "api-surface" },
+  ] as const;
+  for (const view of views) {
+    let accessed = false;
+    const evidence = {
+      get normalized_result() {
+        accessed = true;
+        throw new Error("Evidence accessor must not be invoked");
+      },
+    };
+    const result = inspectAnalysisView({
+      source: { kind: "inline", evidence },
+      view,
+    });
+    expect(result).toMatchObject({
+      ok: false,
+      error: { _tag: "AnalysisInputError" },
+    });
+    expect(accessed).toBe(false);
+  }
+
+  const parent = analysisViewCaptureEvidence();
+  for (const view of views)
+    expect(
+      inspectAnalysisView({
+        source: { kind: "inline", evidence: parent },
+        view,
+      }).ok,
+    ).toBe(true);
 });
 
 it("keeps inline-envelope admission live alongside capture validation and grouping", () => {

src/application/analysisView/AnalysisViewService.ts

@@ -1,3 +1,4 @@
+import { INSPECT_ANALYSIS_VIEW_OPERATION } from "../../domain/analysisView/analysisViewErrors.js";
 import { z } from "zod";
 
 import { ANALYSIS_VIEW_PROVIDER } from "../InvestigationProviders.js";
@@ -5,7 +6,10 @@ import type { EvidenceLookup } from "../EvidenceInputResolver.js";
 import { resolveEvidenceInput } from "../EvidenceInputResolver.js";
 import type { EvidenceWriter } from "../investigation/InvestigationRecordPort.js";
 import type { AnalysisError } from "../../domain/analysisErrorBase.js";
-import { AnalysisCapabilityUnavailableError } from "../../domain/analysisErrorCore.js";
+import {
+  AnalysisCapabilityUnavailableError,
+  AnalysisInputError,
+} from "../../domain/analysisErrorCore.js";
 import { analysisInputErrorFromIssues } from "../../domain/inputIssueProjection.js";
 import { EvidenceIntegrityError } from "../../domain/evidenceErrors.js";
 import {
@@ -14,13 +18,13 @@ import {
   type Evidence,
 } from "../../domain/evidence.js";
 import {
-  INSPECT_ANALYSIS_VIEW_OPERATION,
   inspectAnalysisViewInputSchema,
   projectAnalysisView,
   type AnalysisViewResult,
   type InspectAnalysisViewInput,
 } from "../../domain/analysisView/analysisView.js";
 import { jsonValueSchema } from "../../domain/jsonValue.js";
+import { isImmutableJsonSnapshot } from "../../domain/immutableJson.js";
 import { err, ok, type Result } from "../../domain/result.js";
 import { WebNetworkApiSurfaceAccumulator } from "../../domain/analysisView/WebNetworkApiSurfaceAccumulator.js";
 
@@ -66,6 +70,8 @@ export const inspectAnalysisViewValidated = (
       evidenceId: parent.evidence_id,
       operation: parent.operation,
       normalizedResult: parent.normalized_result,
+      // Sealing an Evidence root deep-freezes it; only the root is registered.
+      sealedResult: isImmutableJsonSnapshot(parent),
       subject: parent.subject,
       limitations: parent.limitations,
       parameters: parent.parameters,
@@ -159,6 +165,18 @@ const resolveAnalysisViewSource = (
 ): Result<Evidence, AnalysisError> => {
   if (source.kind === "retained-evidence")
     return resolveEvidenceInput(source, lookup);
+  const invalidDataPath = inlineEvidenceInvalidDataPath(source.evidence);
+  if (invalidDataPath !== undefined)
+    return err(
+      new AnalysisInputError(INSPECT_ANALYSIS_VIEW_OPERATION, undefined, [
+        {
+          path: ["source", "evidence", ...invalidDataPath],
+          reason: "invalid_type",
+          message:
+            "Inline Evidence must contain plain JSON data properties without accessors or cycles.",
+        },
+      ]),
+    );
   try {
     return ok(parseEvidence(source.evidence));
   } catch (cause: unknown) {
@@ -185,6 +203,53 @@ const resolveAnalysisViewSource = (
   }
 };
 
+/** Reject non-JSON object behavior before Zod reads caller-owned Evidence. */
+const inlineEvidenceInvalidDataPath = (
+  root: unknown,
+): readonly (string | number)[] | undefined => {
+  const active = new Set<object>();
+  const pending: {
+    readonly value: unknown;
+    readonly path: readonly (string | number)[];
+    readonly exit?: object;
+  }[] = [{ value: root, path: [] }];
+  while (pending.length > 0) {
+    const current = pending.pop();
+    if (current === undefined) continue;
+    if (current.exit !== undefined) {
+      active.delete(current.exit);
+      continue;
+    }
+    const { value, path } = current;
+    if (typeof value !== "object" || value === null) continue;
+    const isArray = Array.isArray(value);
+    const prototype = Object.getPrototypeOf(value);
+    if (
+      (isArray && prototype !== Array.prototype) ||
+      (!isArray && prototype !== Object.prototype && prototype !== null) ||
+      active.has(value)
+    )
+      return path;
+
+    active.add(value);
+    pending.push({ value, path, exit: value });
+    const keys = Object.getOwnPropertyNames(value);
+    for (let index = keys.length - 1; index >= 0; index -= 1) {
+      const key = keys[index];
+      if (key === undefined) continue;
+      const descriptor = Object.getOwnPropertyDescriptor(value, key);
+      const childPath = [
+        ...path,
+        isArray && /^(0|[1-9]\d*)$/u.test(key) ? Number(key) : key,
+      ];
+      if (descriptor === undefined || !Object.hasOwn(descriptor, "value"))
+        return childPath;
+      pending.push({ value: descriptor.value, path: childPath });
+    }
+  }
+  return undefined;
+};
+
 const createAnalysisViewEvidence = (
   input: InspectAnalysisViewInput,
   parent: Evidence,

src/application/binary/BinarySession.ts

@@ -932,6 +932,7 @@ export class BinarySession
         runId,
         nativeSourceAdmitted: false,
       };
+      this.#clearRuntimeAvailability();
       return ok(null);
     }
     const closed = await this.#retireClient(client, previous.route.identity.id);

src/application/binary/BinarySessionLiveness.test.ts

@@ -15,6 +15,7 @@ import { createAnalysisProfile } from "../../domain/analysisProfile.js";
 import { ProviderAdapterError } from "../../domain/providerAdapterError.js";
 import type { ProviderOperationHealth } from "../../domain/providerOperationHealth.js";
 import { err, ok } from "../../domain/result.js";
+import { buildCapabilityInventory } from "../CapabilityInventory.js";
 import { InvestigationRecords } from "../investigation/InvestigationRecords.js";
 import { AnalysisProviderRegistry } from "./AnalysisProviderRegistry.js";
 import { BinarySession } from "./BinarySession.js";
@@ -116,9 +117,7 @@ describe("BinarySession open liveness", () => {
     expect(deep.created).toHaveLength(2);
   });
 
-  it("falls back to the health probe when the child reports no operation health", async () => {
-    // Without an operation-health hook there is no child-liveness signal,
-    // so the probe keeps the previous `health` admission behavior.
+  it("probes instantiated children through health when snapshots are absent", async () => {
     const { session, deep } = openSession({ operationHealth: false });
     expect((await session.open(process.execPath)).ok).toBe(true);
     expect((await session.execute("address_name", {})).ok).toBe(true);
@@ -126,9 +125,33 @@ describe("BinarySession open liveness", () => {
 
     const second = await session.open(process.execPath);
     expect(second.ok).toBe(true);
-    // The composite's `health` answers ok, so the live client is reused.
+    // The composite probes this already-instantiated child rather than
+    // answering health without contacting it.
     expect(deep.created).toHaveLength(1);
     expect(deep.created[0]?.closeCalled).toBe(false);
+    expect(deep.created[0]?.healthCalls).toBe(1);
+  });
+
+  it("retires a dead no-snapshot child after its health probe fails", async () => {
+    const { session, deep } = openSession({ operationHealth: false });
+    expect((await session.open(process.execPath)).ok).toBe(true);
+    expect((await session.execute("address_name", {})).ok).toBe(true);
+    const dead = deep.created[0];
+    dead?.kill();
+
+    expect((await session.open(process.execPath)).ok).toBe(true);
+    expect(dead?.healthCalls).toBe(1);
+    expect(dead?.closeCalled).toBe(true);
+    expect(deep.created).toHaveLength(1);
+    expect((await session.execute("address_name", {})).ok).toBe(true);
+    expect(deep.created).toHaveLength(2);
+  });
+
+  it("does not instantiate a child to answer health before first use", async () => {
+    const { session, deep } = openSession({ operationHealth: false });
+    expect((await session.open(process.execPath)).ok).toBe(true);
+    expect((await session.open(process.execPath)).ok).toBe(true);
+    expect(deep.created).toEqual([]);
   });
 
   it("reports cancellation without touching the session when aborted mid-probe", async () => {
@@ -164,9 +187,101 @@ describe("BinarySession open liveness", () => {
   });
 });
 
+it("clears retired runtime availability after cancelled-switch restoration", async () => {
+  let closeStarted!: () => void;
+  const closing = new Promise<void>((resolve) => {
+    closeStarted = resolve;
+  });
+  let releaseClose!: () => void;
+  const closeGate = new Promise<void>((resolve) => {
+    releaseClose = resolve;
+  });
+  const { session, deep } = openSession({
+    failOperationInitially: true,
+    beforeFirstClose: async () => {
+      closeStarted();
+      await closeGate;
+    },
+  });
+  expect((await session.open(process.execPath)).ok).toBe(true);
+  expect((await session.execute("address_name", {})).ok).toBe(false);
+  const availability = () =>
+    buildCapabilityInventory(session.status(), {
+      processCaptureEnabled: false,
+    }).find(({ name }) => name === "address_name");
+  const initialAvailability = availability();
+  expect(initialAvailability).toMatchObject({
+    available: false,
+    reason: "provider_unavailable",
+  });
+  const originalTarget = session.activeTarget();
+  const initialRunId = sessionRunId(session.status());
+
+  const controller = new AbortController();
+  const switching = session.open("/bin/ls", { signal: controller.signal });
+  await closing;
+  controller.abort();
+  releaseClose();
+
+  const cancelled = await switching;
+  expect(cancelled).toMatchObject({
+    ok: false,
+    error: { _tag: "AnalysisCancelledError" },
+  });
+  expect(session.activeTarget()).toEqual(originalTarget);
+  expect(deep.created).toHaveLength(1);
+  expect(deep.created[0]?.closeCalled).toBe(true);
+  const restoredStatus = session.status();
+  expect(sessionRunId(restoredStatus)).not.toBe(initialRunId);
+  expect(availability()).toMatchObject({
+    available: true,
+    reason: "available",
+    remediation: null,
+  });
+  // Cancellation remains the caller-visible outcome after cleanup and
+  // restoration, while the new restored client is healthy and usable.
+  expect((await session.execute("address_name", {})).ok).toBe(true);
+  expect(deep.created).toHaveLength(2);
+  expect(availability()).toMatchObject({
+    available: true,
+    reason: "available",
+    remediation: null,
+  });
+  deep.created[1]?.setOperationFailure(true);
+  expect((await session.execute("address_name", {})).ok).toBe(false);
+  expect(availability()).toMatchObject({
+    available: false,
+    reason: "provider_unavailable",
+  });
+  deep.created[1]?.setOperationFailure(false);
+  expect((await session.execute("address_name", {})).ok).toBe(true);
+  expect(availability()).toMatchObject({
+    available: true,
+    reason: "available",
+    remediation: null,
+  });
+  await session.close();
+});
+
+const sessionRunId = (status: ReturnType<BinarySession["status"]>): string => {
+  if (typeof status !== "object" || status === null || Array.isArray(status))
+    throw new Error("Expected a binary session status object");
+  const analysisRun = status.analysis_run;
+  if (
+    typeof analysisRun !== "object" ||
+    analysisRun === null ||
+    Array.isArray(analysisRun) ||
+    typeof analysisRun.run_id !== "string"
+  )
+    throw new Error("Expected an active analysis run");
+  return analysisRun.run_id;
+};
+
 interface KillableChild extends AnalysisClient {
   kill(state?: "exited" | "unreachable" | "unknown" | "not_started"): void;
+  setOperationFailure(value: boolean): void;
   closeCalled: boolean;
+  healthCalls: number;
 }
 
 const deepIdentity: ProviderIdentity = {
@@ -202,7 +317,11 @@ const capability = (
 });
 
 const openSession = (
-  options: { operationHealth?: boolean } = {},
+  options: {
+    operationHealth?: boolean;
+    failOperationInitially?: boolean;
+    beforeFirstClose?: () => Promise<void>;
+  } = {},
 ): {
   session: BinarySession;
   deep: { created: KillableChild[] };
@@ -234,6 +353,8 @@ const openSession = (
 
 const killableDeepProvider = (options: {
   operationHealth?: boolean;
+  failOperationInitially?: boolean;
+  beforeFirstClose?: () => Promise<void>;
 }): {
   provider: AnalysisProviderCandidate;
   created: KillableChild[];
@@ -267,13 +388,18 @@ const killableDeepProvider = (options: {
         }),
       ),
     createClient: (): KillableChild => {
+      const firstClient = created.length === 0;
       let alive = true;
+      let failOperation =
+        firstClient && options.failOperationInitially === true;
       let closeCalled = false;
+      let healthCalls = 0;
       let deadState: "exited" | "unreachable" | "unknown" | "not_started" =
         "exited";
       const client: KillableChild = {
         execute: (operation) => {
-          return alive
+          if (operation === "health") healthCalls += 1;
+          return alive && !(operation !== "health" && failOperation)
             ? Promise.resolve(
                 ok(
                   createAnalysisExecution(
@@ -306,13 +432,18 @@ const killableDeepProvider = (options: {
               },
             }
           : {}),
-        close: () => {
+        close: async () => {
           closeCalled = true;
-          return Promise.resolve(ok(null));
+          if (firstClient && options.beforeFirstClose !== undefined)
+            await options.beforeFirstClose();
+          return ok(null);
         },
         get closeCalled() {
           return closeCalled;
         },
+        get healthCalls() {
+          return healthCalls;
+        },
         kill: (
           state:
             | "exited"
@@ -323,6 +454,9 @@ const killableDeepProvider = (options: {
           alive = false;
           deadState = state;
         },
+        setOperationFailure: (value: boolean) => {
+          failOperation = value;
+        },
       };
       created.push(client);
       return client;