rea/experiments/analysis-efficiency/coverage-review-20261021.md

Workflow coverage reconciliation, 2026-10-21

The checked snapshot is main 264862bf2, with 46 first-level src/ directories and 212 production stdio MCP tools. Directory counts and tool counts are different inventories: one application workflow can cross several directories, and one provider can expose many independently costly operations. This is a source/history review, not a new runtime qualification of all tools.

The search includes this experiment directory, owning contracts and source history, original feature PRs and related open/closed issues. Missing experiment files do not establish missing audits. In particular, the model and IL2CPP feature PRs contain substantial real-task evidence absent from this directory. Historical measurements retain their original revisions, platforms and limits.

Directories / workflow	Evidence already present	Remaining coverage boundary
kuna, ghidra	Earlier native entry work and Ghidra projection	Selected questions only; database reuse is a separate research issue #3136.
ida	Windows native correctness and completed-task costs, including real whoami.exe	Warm selected-task gains do not establish cold analysis, all string formats, all operations or other IDA platforms.
hopper, jeb	Hopper string records, Linux runtime, real JEB CE	Preserve negative whole-task results; other editions, platforms and workflows are separate scopes.
rizin, cutter	Existing command/session adapters and lifecycle fixes	No comparable dedicated real completed-task performance record located in the searched records. Actual engine/GUI availability must be established before selecting a task.
gdb, objdump	Real Bash command observations	Selected read-only disassembly is measured; other commands, large outputs and running-target observation are separate tasks.
adb, frida, inspector	Frida native status/history experiment	Frida status does not qualify arbitrary scripts, ADB/device transfers, browser Inspector events or live target freshness.
go, rust	Go build/dependency selection on real binaries; Rust cargo-auditable support #2456	Go is already measured. No comparable dedicated Rust dependency-investigation cost record located in this review.
javascript, browser, electron	Agent fact workflow, lifecycle experiments and #4415	Real Joplin preparation remains exploratory. Individual JS features and browser/runtime workflows need their own evidence.
android, apktool	Package summary, three-APK shared resource decoding	These do not qualify all JADX class/method/reference operations or physical-device workflows. #4777 is already fixed.
dotnet, il2cpp	Managed summaries/pages, IL2CPP metadata #3807 and native links/seeds #5327	IL2CPP already has real Windows/Android row comparisons, task costs and Ghidra import. Unsupported versions/generics/platforms remain separate correctness and coverage work.
model	GGUF/safetensors #5603: real models, independent readers and complete-task costs	Existing delivery is already audited. #5774 isolates omitted-string validation cost within that producer.
native, artifacts	Native inventory, entry views; real NIB output reductions #1460, #1477	Inventory does not qualify Apple UI/resource, signatures, dyld or runtime traces. NIB byte reductions alone do not establish token, time, CPU or memory savings for a completed question.
firmware	Region pilot plus real full OpenWrt extraction/publication #4602	Extraction is already measured; noisy timings establish no general speedup. Other image layouts, extraction trees and publication filesystems remain unqualified.
flutter, sqlite, wasm, evm, pcap, signals	Dart AOT, SQLite controls, WAT framing, EVM, PCAP, signals	Extend a specific question. Preserve cases where existing controls suffice and small tasks regress; these records do not qualify each format or tool exhaustively.
application, domain, server, cli, contracts	Mixed retained investigations, immutable parent validation, capture validation	Shared selected-query paths are already optimized. Reconstruction/environment composition and new fact families require their own end-to-end questions.
browser / recorded captures	SAZ selection and real qlog producer/retained reads	#3133 still includes actual model/task questions; producer measurements do not close those requirements.
filesystem, process, reference, providers, captures, windows, main, composition, config, evaluation	Cross-workflow resource/cleanup checks, process traces, MCP profile and Windows lifecycle checkpoints	Infrastructure coverage follows the exercised workflow. No blanket startup/resource claim; reference imports and compare_source_to_bundle need a dedicated completed source-tree question.

Every one of the 46 directories appears above; repeated browser highlights a distinct workflow, not another directory. The table records located evidence, not proof that every historical PR was inspected. Open issue state by itself does not prove missing implementation or absent measurements.

Three bounded follow-up questions

1. Rust dependency identity: inspect a public cargo-auditable binary, find exact dependency/version edges and retain complete source Evidence. Compare existing delivery first; independently decode its auditable section. Include a small binary and account for all discovery, queries and serialization.
2. Apple UI graph lookup: on macOS, locate a specific control/outlet in a real Transmission/XLD NIB graph using existing summary/document pages. Compare equivalent complete questions and independently check archive records. Historical byte reductions alone are not the completion criterion.
3. Reference/source comparison: import a pinned public source tree and answer one source-to-bundle identity question through existing workflows. Independently check file manifests, symlink/unknown semantics and selected matches; measure repeated traversal and retained representation before proposing an index or cache.

Each lane stops with a measured benefit, an evidenced no-change decision, or an explicit unavailable prerequisite. Rizin/Cutter and device/live workflows stay visible as additional gaps; no new execution, injection or mutation authority is implied by this review. No all-provider run or new API is justified by counts.