build_reconstruction_obligation_ledger reported a bundle with duplicate
record IDs, or a reviewed obligation citing Evidence absent from the
bundle, as unreadable_output and pointed callers at rea doctor. Both are
caller input mistakes.
Throw dedicated TypeError subclasses at those checks and map them to
workflow input errors, following the NonCanonicalEvidenceBundleError
approach from #3219 so unrelated TypeErrors stay protocol failures.
Fixes#4444
* fix(domain): classify TypeScript parameter properties as declarations rather than identifier reads
Recognize TSParameterProperty in isPatternOwnerDeclaration, isDeclarationIdentifier, and patternContains so parameter property definitions are not emitted as identifier reads, while retaining valid initializer reads. Fixes#4371
* test(domain): assert constructor body parameter property reads survive
* fix(native): reject empty Swift class vtable owner before slot insertion
Throw an explicit RangeError within the descriptor recovery block when a Swift class vtable descriptor class name is empty. This prevents emitting malformed slots that fail final schema validation, allowing partial coverage and valid sibling descriptors to be preserved. Fixes#4369
* test(native): verify decoding continues for valid Swift vtable siblings after a malformed descriptor
Preserve caller-selected max_capture_age_ms in compare_process_captures Evidence parameters so returned and session-retained records distinguish freshness-constrained comparisons and derive distinct semantic Evidence identities.
Add boundary MCP regression coverage asserting that max_capture_age_ms is omitted when unconstrained, retained in parameters and session evidence when specified, and differentiates comparison Evidence IDs.
Closes#4000
Older Android builds print `wm density` as a bare number. The parser's
documentation named that form, but only the labeled `Physical density:`
and `Override density:` lines were matched, so a bare `420` left
`physical_density` null in successful display Evidence with no limitation
saying the declaration was unread (#3942).
The parser now reads the first bare numeric line as the physical density
when no labeled physical declaration is present; a labeled declaration
still wins so a mixed dump cannot downgrade the value. Override density
and physical size are unchanged.
Validation: parser unit tests for the labeled, bare, CRLF, mixed and
unrecognized forms, plus a provider-level regression through the
inspect_adb_display operation; two of them fail on main and pass here.
The issue's three CLI controls through `rea inspect-adb-display` against
a stub adb return physical density 420 for the bare form and keep the
labeled and override controls. Typecheck, lint and module boundaries pass.
Closes#3942
* fix(ghidra): consume inspected configuration directory identity
Carry the parsed release coordinate through installation inspection and provider prerequisites into the launcher. Remove duplicate property reads and basename guesses, preserve unresolved identity, and canonicalize directory versions without changing observed provider versions.
Keep verifier callers, lifecycle regressions, and installation guidance aligned. Extract the Ghidra-only follow-up from #2293 without changing CLI output or unrelated documentation.
* docs(ghidra): clarify startup failure side-effect boundary
Distinguish the launcher's directory and Java startup guard from the client's earlier private runtime allocation and target snapshot. Keep existing failure cleanup and runtime behavior unchanged.
---------
Co-authored-by: Kaoru0822 <208281322+kaoru0822-kitauji@users.noreply.github.com>
Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
Windows ships two tar implementations. `C:\Windows\System32\tar.exe` (bsdtar)
terminates every listed member with CRLF, so `verify-package-pack.mjs`
splitting the listing on a bare "\n" left a trailing "\r" on each non-final
member. `verifyPackedBridge` compares member identities exactly, so it reported
`package omitted package/bridge/hopper_bridge.py` although the tarball ships
that member (#4128).
`parseTarListing` normalizes line endings once, at the listing owner, and
preserves every member string beyond its line ending. `verifyPackagePack` is
the only tar listing producer in the package verifiers, so its consumers now
compare bare member names; the prefix checks in the same file keep their
behavior because they never matched a line ending.
Covered by `tests/conformance/package/packedTarListing.test.ts`: CRLF and LF
listings both yield exact bridge identities, the trailing line ending no longer
produces an empty member, member strings keep embedded spaces, and a regression
guard pins the previous parse's failure.
Real Windows 11 evidence (`package/bridge/hopper_bridge.py` in the listing):
| tar | listing | split("\n") | parseTarListing |
| ---------------------------------- | ------- | ----------- | --------------- |
| Git for Windows GNU tar | LF | true | true |
| C:\Windows\System32\tar.exe | CRLF | false | true |
Fixes#4128
Co-authored-by: Chow Kim <catch@126.com>
Co-authored-by: Kaoru0822 <208281322+kaoru0822-kitauji@users.noreply.github.com>
Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
* feat(android): make the JADX operation deadline configurable
JADX operations used a fixed 120 s provider deadline and a separate fixed
120 s per-call bound in the session, so an APK whose cold load exceeds
120 s could not complete, and raising only the MCP client timeout could
not extend either. Add REA_JADX_OPERATION_TIMEOUT_MS, parsed once by the
JADX configuration owner (decimal milliseconds from 1 to 2147483647,
default 120000). The provider resolves it before acquiring anything and
uses it for the operation deadline and its timeout errors, and the session
uses it for every upstream call. Doctor reports the effective value, and
setup forwards an explicit value like the other JADX settings.
Fixes#3918
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* test(android): isolate JADX fixtures from inherited shell settings
The shared JADX protocol fixture spread the developer's process.env, so an
exported REA_JADX_OPERATION_TIMEOUT_MS (or REA_JADX_HEAP_MIB) changed every
provider test that never selected one. Keep inheriting the host environment
for process launch, but take REA_JADX_* settings only from the fixture.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
---------
Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
* fix(website): correct mistranslated zh-CN catalog entries
The zh-CN gettext catalog had not been reviewed. Terminology was taken from
unrelated dictionary senses and several file names, version numbers and
observed byte values were translated as if they were prose, so rendered pages
showed content that did not match the English source or the recorded target
identity.
Rewrites 236 msgstr values across the catalog:
- Terminology now uses one term per concept: mask -> 掩码, assembly -> 汇编,
helper -> 辅助函数, source -> 源码, native -> 原生, oracle -> 校验基准,
authenticator -> 身份验证器, agent -> 编程助手, and flag stays untranslated.
- Literal values are preserved: MAIN.EXE, main/, Ghidra 12.1.x, 0x5b?,
export.js, preload.js and npx rea-agents@latest setup are no longer
translated.
- Word-salad sentences are rewritten in natural Chinese, including
"剂将它们转化为方程" -> "编程助手把它们转化为方程".
- Step-marker separators damaged from "·" to "*" are restored.
No msgid or msgctxt changes, so translations extract is not required and no
entry becomes fuzzy or empty.
* Update website/locales/zh-CN/messages.po
Co-authored-by: greptile-apps[bot] <165735046+greptile-apps[bot]@users.noreply.github.com>
* Update website/locales/zh-CN/messages.po
Co-authored-by: greptile-apps[bot] <165735046+greptile-apps[bot]@users.noreply.github.com>
---------
Co-authored-by: greptile-apps[bot] <165735046+greptile-apps[bot]@users.noreply.github.com>
Normalize client identities once in the shared workflow while preserving first-selected order. Keep planning, readiness, default skill selection and configuration application on the same unique list.
Cover duplicate selections in direct workflow tests and an isolated compiled CLI preview/apply/rerun journey. Refs morluto/rea#3847.
* feat(ghidra): support raw big-endian m68k analysis
Admit `m68k` for headerless raw-binary targets. Admission requires a
2-byte aligned entry and a mapping within 0x0..0xffffffff, and Ghidra
imports with BinaryLoader using 68000:BE:32:default, the default compiler
specification, and the `ram` default address space.
`6502` and `m68k` now share one RAW_ONLY_ARCHITECTURES owner, so detected
targets, Evidence subjects, snapshots, and lifecycle output contracts
exclude both instead of repeating a 6502 literal.
Ghidra's default 68000 language decodes the 68040 superset; separate
68020/68030/CPU32/ColdFire variants, Amiga/Atari containers, and reset
vector discovery remain unsupported. Windows Ghidra P0 still admits raw
6502 only.
Verified with Ghidra 12.1.4 on macOS against an 8-byte self-built fixture
(nop; nop; moveq #1,d0; rts at 0x1000): load image verified in `ram`,
entry decompiles to `return 1`.
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
* test(ghidra): verify raw m68k analysis with real Ghidra
Add npm run verify:ghidra:m68k. The verifier loads a source-owned 22-byte
68000 fixture (annotated hex, no assembler) at 0x1000 and checks, through
the compiled CLI and stdio MCP server: the 68000:BE:32:default BinaryLoader
import, load-image parity, exact mapped bytes, both functions, the bsr.b
call reference, decompilation by address and file offset, rejection of a
misaligned entry and of a mapping past 0xffffffff without replacing the
active session, unchanged source bytes, and runtime cleanup.
Run with Ghidra 12.1.4 and JDK 21 on macOS arm64. Linux has not been
exercised; Windows Ghidra P0 does not admit m68k.
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
---------
Co-authored-by: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
Identify the Cutter host through Qt applicationVersion rather than the embedded Rizin module-version report. Preserve unknown host metadata without backend fallback and reuse the existing per-plugin lifetime observation.
Validated 13 Python protocol tests, 66 related CLI/MCP/provider tests, full static/docs gates, and official Linux Cutter 2.5.0 Qt5 public workflows. Native discovery and both Evidence version fields match the independently observed host version; source paths and cleanup remain preserved. The named-tool workflow serialization proxy drops from 8767 to 6912 o200k tokens; this is not model billing.
Fixes#4498.
Read file.path through CutterCore's scalar configuration API instead of invoking the debug-only currentlyOpenFile backup field. Preserve exact string paths and unknowns so existing discovery, generation admission and Evidence consumers receive the owning facts.
Validated 11 Python protocol tests, 66 relevant CLI/MCP/provider tests, full static/docs gates, and official Linux Cutter 2.5.0 Qt5 workflows with a Unicode/#? ELF path. Same-path reload identity remains partial and native document switching is unverified.
Fixes#4497.
Both resource-interval overlap predicates in PeResourceLayout used strict
endpoint inequalities without an extent or point ownership rule, so a
section with VirtualSize=0 and SizeOfRawData=0 inside a resource interval
was rejected as overlapping virtual sections, and the same empty section
inside a header-backed payload was rejected as ambiguous header mapping.
An empty payload at an RVA that starts a positive-extent section below
SizeOfHeaders silently resolved to the header offset even though that
section owns the point.
Normalize intersection once at the owning mapper: a section without
virtual extent owns no byte and never conflicts; an empty resource owns
exactly its start point, so a positive-extent section starting there
conflicts with header-backed ownership and keeps the existing
ambiguous-mapping failure. Positive-extent overlap rejection is
unchanged.
Fixes#4455Fixes#4373
Co-authored-by: maxazure <maxazure@gmail.com>
Propagate CLI/MCP cancellation through shared Cutter discovery, stop queued probes, and drain admitted workers. Deliver terminal bridge results only after socket closure. Preserve confirmed command Evidence and caller reasons when cancellation arrives during finalization.
Validated 66 focused tests, full CI static/docs gates, actual CLI SIGINT, compiled stdio cancellation/recovery, and official Linux Cutter 2.5.0 Qt5 CLI/MCP ELF workflows. Native UI cancellation and descriptor filesystem cancellation remain unverified.
Fixes#3946.
Fixes#4388. Refs #4027.
Observe cancellation during first-window waits and state reads; preserve cancellation and caller reasons before cleanup and retain partial observations when cleanup fails. Keep late cancellation and cleanup failure precedence.
Validation: 49 focused cases, static/docs checks, six controlled verifier-oracle cases and 39 current-head CI checks passed. Codex and Greptile found no remaining blocking issues. Real Joplin cancellation phases verified; complete Linux cleanup/first-signal CLI exit and packaged-runtime startup remain explicitly unverified/failed. Both verifiers now fail incomplete cleanup, including after main-process exit.
Co-authored-by: gensokyo-dev <342580529+gensokyo-dev@users.noreply.github.com>
Co-authored-by: Kaoru0822 <208281322+kaoru0822-kitauji@users.noreply.github.com>
Co-authored-by: Adolanium <94890352+Adolanium@users.noreply.github.com>
Retain received complete and unfinished Rizin command bytes with bounded UTF-8 capture, truthful completion uncertainty and exact launch provenance. Keep captures independent of cancellation, protocol and cleanup precedence; wait for bounded output settlement on exit and preserve active bytes across stdin failures.
Validated353 focused tests (one existing skip), full CI static/docs checks, real official Linux Rizin0.9.1 interruption probes, paired completed public CLI/stdio MCP tasks, and focused mutation checks. Required CI passed; exact-head Codex review reported no findings and Greptile5/5. Fault cleanup uncertainty and partial-marker ambiguity remain explicit.
Fixes#4015. Follow-up to #4227.
Fixes#4381. Follow-up to the Linux lifecycle audit in #4227.
Keep managed source hashing on bounded reads through its existing FileHandle owner. Preserve exact opaque cancellation reasons before filesystem or cleanup interpretation, retain genuine failed closes, block unsafe admission, and recover the same provider after verified cleanup.
Validated with 484 related tests, source/docs checks, seven real Linux provider cancellation/recovery scenarios using an unchanged official Microsoft .NET assembly, and paired actual CLI/stdio MCP Evidence workflows. Normal completed-task timing, CPU, memory and token proxies remained comparable.
Adopts xu91102/rea commit ebeec580c839f2f72144282a44f4e11ea5759843 with independent Linux verification and cancellation-reason hardening.
Co-authored-by: hhang <169027046+xu91102@users.noreply.github.com>
Fixes#4379.
Observe cancellation after file metadata, verified descriptor closure and recovered scope cleanup. Retain completed physical read outcomes and acquired-file digests under cancellation; preserve original failures and exact cleanup owners when close fails.
Bind cancellation markers to their verified owner so raw readers preserve nested callback outcomes and exact caller reasons. Reuse one ADB partial-result mapper for file, package and bugreport acquisition.
Validated with 570 related tests, source/docs checks, real Linux filesystem cancellation/cleanup/nesting probes and actual public CLI/MCP Evidence workflows.
* fix(browser): report cancellation after cleanup and source-map abort
An interrupt during CDP cleanup could still publish the captured page, and a source-map download abort was wrapped as a provider failure. Both now return AnalysisCancelledError for the requested operation.
* fix(setup): keep Devin configuration JSON-formatted
The empty DSH_HOME fix also changed Devin's declared format to "devin", which is not a configuration format and stops the typecheck. Devin still writes mcp_config.json.
* test(browser): keep cleanup cancellation coverage in its own suite
The added interrupt cases made the existing lifecycle suite exceed the function-length lint limit.
* test(ghidra): drop the duplicated path join import
The inventory MCP test imported join twice, which fails lint on current main.
* test(cli): type the retained skill directory pairs
noUncheckedIndexedAccess treats the unlabeled pair list as an open array, so the directory passed to join was string or undefined.
* fix(browser): preserve source-map cancellation results
* style(test): format the partial Frida load cancellation fixture
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
---------
Co-authored-by: Cursor Agent <cursoragent@cursor.com>
Co-authored-by: REA Maintenance <rea-maintenance@users.noreply.github.com>
Co-authored-by: Kaoru0822 <208281322+kaoru0822-kitauji@users.noreply.github.com>
Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
Fixes#4011.
Normalize exec-aware worker ownership at the shared pwntools decoder boundary. Preserve parent, process-group and run-token checks, explicit command pins, partial observations, and retryable cleanup.
Validated with real Linux pwntools/GDB/pwndbg CLI/MCP workflows, native-exec cancellation and foreign-token controls.
Resolve stable local constant BrowserWindow options with retained provenance and shared early-exit mutation queries. Preserve source ordering and unknown results for relevant mutations or escapes.
Includes real Joplin correctness/cost receipts and regression coverage.
Co-authored-by: Kaoru0822 <208281322+kaoru0822-kitauji@users.noreply.github.com>
Preserve Electron cleanup observer reasons and typed primary failures through the shared error projection. Keep ownership and partial Evidence semantics intact.
Fixes#4403. Refs #4227, #4282.
* fix(kuna): stream string scans instead of capping them at 16 MiB
`list_strings` and `search_strings` buffered Kuna's whole string JSON and
refused anything above 16 MiB. Kuna writes about 290 bytes per row, so
every app above roughly 10 MB failed with a non-retryable memory error:
a 20 MB Ghostty binary produces 31 MB, Raycast 30 MB and an arm64
Firefox XUL 179 MB.
Parse the scan as Kuna writes it. `runOwnedCommand` accepts a stdout
sink, and `KunaStringInventoryReader` owns the interpretation: it
tokenizes synchronously with stream-json, keeps exact u64 address
tokens, validates each row before retaining it, skips members it does
not interpret, and admits retained rows against live heap headroom
rather than a fixed scan size. The first contradiction stops Kuna
instead of waiting for the rest; an incomplete document is judged only
after Kuna's own exit status. Diagnostics keep the 8 MiB Kuna budget,
now shared with the project export.
Refs #1957
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* fix(kuna): admit string scan text as it streams and drop sinks with their command
Review found that packed string tokens were assembled whole before the
reader could discard them or check heap headroom, and that a stdout sink
could outlive a cancelled or timed-out command.
Move the token mechanics into `KunaJsonDocumentReader`: keys and numbers
(Kuna's own fields) stay packed, while strings, which carry target-derived
text, arrive in chunks. Ignored strings are dropped unassembled and kept
ones are admitted against live heap headroom as they grow. Kept text is
copied out of the decoded chunk it was sliced from, so retained rows no
longer pin whole chunks (XUL: 278 MB retained before, 156 MB after).
`KunaStringInventoryReader` keeps only the string-scan semantics.
`runOwnedCommand` now ties the stdout pipeline to the command's deadline
signal and aborts it when collection fails, destroying the sink.
Refs #1957
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* fix(kuna): type the stream-json tokenizer where it is imported
The Reverse tools quality lane type-checks a partial project that reaches
KunaJsonStream without the separate streamJsonParser.d.ts augmentation,
so jsonParser had no declaration there. Declare the tokenizer's shape at
its only import site and remove the augmentation file, so every
compilation of the reader is self-contained. Split two helpers out of
the token dispatcher and simplify the stdout sink wait in
runOwnedCommand, which keeps the added complexity minimal.
Refs #1957
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* fix(kuna): bound key and number assembly in streamed Kuna JSON
Review found that packed keys (and packed numbers) were assembled whole
by the tokenizer before the reader could discard or constrain them, so a
malformed scan with one enormous key could still exhaust the heap.
Stream every scalar. Keys are assembled only up to 64 code units, past
every field name the reader keeps, so a longer key is skipped unmatched;
kept numbers longer than that are rejected, and ignored numbers are
dropped unassembled. XUL's 611k-row scan parses in the same time.
Refs #1957
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* fix(kuna): stream the call graph instead of capping it at 32 MiB (#4329)
* fix(kuna): stream the call graph instead of capping it at 32 MiB
Call relationships buffered `kuna decompile-graph` and refused output
above 32 MiB. A 53 MB Raycast binary produces a 157 MB graph (180k
functions, 773k edges), so every call query failed with a non-retryable
memory error after Kuna's minute-long whole-program walk.
`KunaCallGraphReader` validates the graph through the shared streaming
document reader. It retains only the facts queries use (126 MB for
Raycast) and checks edges against the complete node set once Kuna
exits. Unrequested bodies are refused before any of their text is
assembled, through new must-be-null row fields; address fields may be
null, as `forwardsTo` is. Malformed graphs are now `AnalysisOutputError`
like the string scan.
`KunaQueryWork.scan` owns the run-and-validate sequence both producers
shared: diagnostics budget, early rejection and retention of
deterministic overflow.
Refs #1957
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* fix(kuna): index call-graph edges as they stream
Review found that the reader kept every parsed edge and built the edge
indexes only after streaming, outside any heap admission, so a large
graph could exhaust the heap instead of returning a memory constraint.
Index each edge when it arrives: duplicate pairs and callee orders are
checked per caller, call edges go straight into the caller/callee
indexes, and no edge array is kept, so the whole working set grows under
the per-row admission. Endpoints and order completeness are checked once
all nodes are known, and the validation-only indexes are released then.
Raycast's graph now peaks at 346 MB instead of 503 MB and retains 93 MB
instead of 126 MB, in the same time.
Also drop imports the shared scan made unused.
Refs #1957
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* docs(kuna): state the graph's retained size after incremental indexing
Refs #1957
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
---------
Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
---------
Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
Expose exact-path, selected-property, paged reads of retained JavaScript application facts through the shared CLI/MCP analysis view. Preserve original identities, complete row Evidence and partial coverage; retain reproducible real-Joplin and actual-agent measurements, including negative cost results.
Fixes#4190. Part of #4027. Code mode remains deferred by #4091.
Integrate main after #4274. Validation: 114 distinct focused cases across documented invocations, 106 Python cases, full static/docs checks and 18 version-labelled real-application workflows with 9 complete CLI/MCP view parity controls. Preserve two local fixture deadline failures and the unchanged test passing on an available single CPU. Final-head CI passed all 36 jobs after one Windows timeout retry without source changes; both exact-head automated reviews are clear and all review threads resolved. Downloadable apps and raw large Evidence/transcripts are excluded.
Co-authored-by: Kaoru0822 <208281322+kaoru0822-kitauji@users.noreply.github.com>
* fix(application): retain completed evidence through cancellation
Validate completed provider reports before classifying cancellation and preserve Evidence and captured diagnostics. Share MCP recording and delivery across custom observation handlers. Add source-owned completion and public SDK recording controls. Refs #3923, #3927, #4261.
* fix(wasm): retain final observations through cancellation
Keep completed Evidence after finalization and through CLI/MCP delivery. Preserve output and cleanup failure precedence. Refs #4254.
* fix(browser): retain final observations and forward cancellation
Classify final CDP detach and completed scenario cleanup at the provider boundary. Translate completed partials into canonical Evidence for MCP recording, and forward CLI cancellation to passive Electron tools. Refs #4255, #4256, #4257.
* fix(ghidra): isolate cancellation of shared startup waiters
Keep startup group-owned while each caller has an independent abortable wait. Await final-owner cleanup and preserve cleanup facts before retrying. Reuse the shared abortable promise helper. Refs #3983.
* fix(mcp): keep shutdown registrations until cleanup succeeds
Retain repeated event requests while unresolved owners need cleanup, and unregister only after success. Verify coalescing and failed-owner retry. Refs #4253.
* fix(adb): own transfer snapshots and stage screen publication
Bind transfer digests to the exact private input bytes and preserve caller APK names. Retain failed descriptors and private-root owners with typed cleanup evidence; publish captures exclusively after the cancellation cutoff. Refs #4251, #4252.
* fix(verification): report ADB cleanup failures
Always close after attempted verification and keep unexpected primary failures and cleanup details visible. Exercise the production script with controlled imports, including null and undefined throws. Refs #4260.
* fix(runner): stop owned Windows commands on cancellation
Use the retained ChildProcess handle for IPC cancellation and parent disconnection. Keep the SQLite lock until observed child close, and include native Windows regressions in the curated CI lane. Native Windows results remain pending. Refs #4258.
* fix(website): canonicalize link containment boundaries
Compare resolved targets with resolved repository and site roots. Accept directory aliases while preserving escape checks and keep fixtures within their temporary owner. Refs #4264.
* docs(testing): cover completion races and cleanup retry
Clarify validation-before-cancellation, independent startup waiter controls, producer and adapter coverage, and repeated shutdown events.
* fix(filesystem): retain file owners and completed reads after close failure
* fix(session): report retained snapshot staging in cleanup status
Fixes#4277. Include both snapshot and profile file-resource scopes in the owning status fact, preserving publication receipts and cleanup retry.
* docs(mcp): clarify recovery of raw partial observations
Document the observed SDK cancellation boundary and the open design decision in #4276 without promoting raw errors to Evidence.
* fix(kuna): own the complete installation inspection lifetime
* test(kuna): cover session cleanup of shared cache resources
* fix(hopper): isolate publisher operation resource admission
* fix(hopper): preserve launcher cleanup failure classification
* fix(adb): retain ordered cleanup and screen publication outcomes
* fix(runner): retain Windows job ownership through cleanup retries
* docs: clarify inspection admission and ordered cleanup regressions
* fix(ghidra): preserve startup cleanup and request deadlines
* fix(runner): supervise stdin errors and bootstrap native controls
* docs: require queued lifecycle controls to survive admission
* fix(cli): leave cleanup resolution with resource owners
* test(adb): verify owned install snapshots through CLI
* fix(errors): exclude resolved primary cleanup resources
* fix(adb): resolve publication cleanup after its handle closes
* fix(android): resolve JADX hash cleanup after owned close
* refactor(android): share hash failure cause options
* fix(kuna): gate commands on retained descriptor cleanup
* docs: cover cleanup admission and owner-confirmed recovery
* refactor(artifacts): bind cleanup errors to confirmed release
* fix(adb): resolve recovered cleanup at retained owners
* fix(kuna): resolve installation cleanup after owned close
* fix(kuna): gate cache reads on retained hash cleanup
* fix(setup): preserve publisher cleanup admission failures
* fix(android): resolve the reported retirement cleanup error
* test(runner): scope post-spawn fault control to POSIX
* test(adb): cover persistent snapshot owner retirement
* fix(kuna): preserve file outcomes with explicit cleanup ownership
* fix(artifacts): resolve errors through retained cleanup owners
* docs(lifecycle): carry cleanup ownership in typed outcomes
* fix(adb): bind staged screen errors to their cleanup lease
* fix(kuna): bind profile cleanup through a close capability
* fix(artifacts): retain descriptor resources in cleanup errors
* fix(pcap): bind existing errors to snapshot retirement
* fix(windows): load source owner through its file URL
* test(build): copy the command runner helper into fixtures
* fix(mcp): own shared observation providers in the transport
* fix(jadx): resolve every retained cleanup retry error
* fix(kuna): bind retry errors to every retained cleanup owner
* fix(adb): bind admission and shutdown errors to exact cleanup leases
* fix(windows): resolve command paths before native ownership
* test(publisher): assert exact descriptor recovery without release metadata
* docs(lifecycle): require every retry error to follow its owners
* fix(kuna): keep hash cleanup state stable across concurrent retries
* test(windows): exercise surviving descendants with scoped shutdown deadlines
* fix(uninstall): preserve primary read errors through cleanup failure
* test(publisher): assert cleanup Result and exact owner recovery
* test(windows): observe supervisor resources through IPC disconnect
* fix(browser): retain typed cancellation after interrupted actions
* test(publisher): assert ownership phases without retry-count coupling
* fix(lifecycle): preserve abort reasons through shared provider execution
* fix(jadx): preserve execution and late hash cancellation causes
* fix(adb): compose late cancellation with exact cleanup failures
* test(mcp): use the shared budget for session workflows
Preserve incoming callback uncertainty and resolve proven preceding writes.
Share read-position and initializer identity facts with returned-reference
analysis; cache completed projected work with actual cycle dependencies.
Fixes#3880
Keep exact returned hash and directory failures linked to their cleanup owners. Retain input staging while its descriptor remains unresolved, and resolve the linked errors only after successful release. Preserve typed cleanup and partial acquisition facts through file, package, and bugreport consumers instead of wrapping or flattening them away.
Validated 189 affected tests across 13 files, build, typecheck, lint, and docs. Three larger integration cases were excluded to respect the CPU limit. New real-file fault controls reproduce on the old source and verify persistent failure, owner identity, cancellation, retained output, and recovery. No physical ADB device or real JADX engine verification. Refs #4266, #4274.
Bind the typed hash failure to its retained descriptor and resolve cleanup uncertainty only when that exact owner closes. Preserve the original failure through immediate retirement and later shutdown recovery. Controlled real-file regressions cover immediate and persistent close faults; no real JADX engine was launched. Refs #4266, #4274.
Compose only unresolved primary resources into a later cleanup failure, retaining both original causes and diagnostics. Document exact-owner recovery and cover resolved and unresolved composition controls. Refs #4266, #4274.
Give concurrent Ghidra and Hopper callers independent waits over one owned startup. Join final-caller cleanup, preserve failed cleanup owners, and derive readiness from the current startup result and live transport. Distinguish provider closure from caller cancellation and clean up interrupted final lineage observation.
Reuse the Ghidra socket fixture, replace stale cancellation health assertions with cold and warm reuse controls, and cover public MCP peer cancellation. Validation: 315 affected tests, build, typecheck, lint, docs, and 25 relocated startup controls passed. Controlled child bridges only; real Ghidra JVM and Hopper GUI verification remains unperformed. Refs #3983, #4227, #4274.
Recognize known undecoded producer spellings without treating them as successful demangles. Preserve actual producer output and derive symbol types from the domain contract instead of duplicating its validation schema.
Compare retained output with the real demangler through MCP, while preserving CLI malformed-input and line-ending coverage.
Refs: #4215, #4287
Co-authored-by: Vinícius DS Andrade <95101505+viniciusdsandrade@users.noreply.github.com>
Carry the selected slice name and the existing tool owner's dwarfdump spelling separately. Compare observed row labels exactly, preserving explicit ABI versions and uncertainty for missing rows.
Correct the production-boundary fixture and retain wrong-version and mixed-row controls. Real Apple multi-version selection behavior remains unverified.
Refs: #4195, #4288
Co-authored-by: Henglie <ebhenglie@gmail.com>
Preserve the full request options through the FIFO and settle interrupted or rejected final lineage observation through owned startup cleanup. Keep the startup diagnostic checkpoint until finalization succeeds.
Validate typed expired ping, cancellation, child exit, runtime removal, retry, and MCP recovery without running a native Ghidra instance.
Refs: #4289, #4274
Resolve stable lexical and URL targets using shared effects, and preserve unresolved request expressions as partial facts. Carry their uncertainty through workers, artifact graphs, and the CLI. Scope partial endpoint identity to the source site.
Refs: #3451, #3534
Co-authored-by: Hemang Varshney <218273197+hemv-857@users.noreply.github.com>
Model the CommonJS wrapper binding and query shared lexical identity, mutation, and evaluation timing at each call. Remove duplicate importer interpretation and preserve uncertainty for with scopes, prototypes, repeated writes, and opaque object escapes.
Validate generated fixtures against bounded Node oracles; no analyzed target execution is added.
Refs: #3982, #4072
Co-authored-by: Geronimo <varungore1@gmail.com>
Use the shared expression owner for BrowserWindow options and webPreferences. Retain overwrite and spread uncertainty through CLI and MCP evidence.
Refs: #4250, #4281
Co-authored-by: Geekwolf <geekwolf@163.com>
Inspect AST property segments instead of flattened suffixes. Reject dotted-key and suffix collisions while retaining page-declared trust and source evidence through the CLI.
Refs: #4205, #4279
Co-authored-by: Geekwolf <geekwolf@163.com>
