rea/experiments/atomic-codemode/function-boundary-study.md

Native function boundaries as independent facts

The selected cross-function SSH task needs to distinguish recovered formal prototype entries from raw input varnodes. The existing value is_input flag is not formal membership: it also includes stack/global inputs. Recovering an original source signature from either inventory would be unsupported.

A new shared parameters query selects native prototype indices, fields and pages, with a separately projected return descriptor, native model label, lock/variadic/recovery-error flags and retained Evidence. Defaults omit display names/type strings. Explicit void, unknown storage/type, known missing native indices, unavailable store and malformed capture remain distinct. Source arity, ABI truth, runtime binding, aliases, stack rebasing and split/join mappings stay unknown. Call-site argument storage is a separate fact. The analyst can compose it with selected callee prototype/storage/value facts while retaining both snapshots' identities and the selected machine corroboration.

One native function-prototype owner exports an independent parameters facet. Its extraction does not depend on full CFG/call enumeration, and optional encoded output budgeting retains typed omission reasons and readable code. The renderer restores owned JSON fields by identity rather than a numeric position invalidated by removing other independent facets. Native address/storage serialization and JS storage contracts each have one shared owner for call sites and function prototypes; parameters do not depend on a call-record schema's nested shape. Shared application admission keeps the same named methods for SDK, CLI and both MCP adapters. There are seventeen methods, twenty direct tools and four Code Mode tools. No integration with stock Kuna or other providers is claimed.

The native overlay is pinned to upstream fe01d6294eb0d1053ce343c8943646df88e143fc; the REA experiment was refreshed from main f22e8e726 before this change. Forward/reverse patch checks pass against the pinned base/current source. All generated binaries, captures and caches stay local. No PR or merge into main is intended.

Current executed evidence

The first real SSH candidate engine is 6aae471bef4434eb3acea98b497c6df58e3a9fa71021178c89bbbc3d96109080. Actual Code Mode MCP checks both functions, full/selected/empty parameter queries, paging, exact retained input-location matches, repeated metadata and complete source fidelity: removing only the added parameters facet leaves each complete prior native function record unchanged. Banner 0x25cb0 has four native prototype slots but three retained is_input values; slots 1/2 have no exact retained input match. Caller 0x280c0 has ten prototype slots and 44 raw input values, with all ten native storage tuples matched. Native labels and flags are observations, not original source arity/ABI proof. Full expected facts and limits are in the oracle.

The JS suite passes 94 tests, including projection-only/unavailable/malformed prototype reads, native identities/order/paging, explicit void versus unknown, immutable SDK metadata and runtime/JSON Schema agreement. Both actual converted MCP catalogs pass named schema/admission checks. Two native constructor tests pass: absent stores stay unavailable, and native slots/void/return storage/locks remain distinct. Full native workspace/corpus gates are unexecuted.

Executed stage	Family wall s	CPU s	Kernel peak MiB
Latest-main cached runtime build	43.328	41.531	3,057.8
Initial 94 JS tests	29.271	9.085	82.1
Initial converted catalog checks	10.592	2.281	136.5
Candidate real Code Mode SSH verifier	8.676	8.439	319.9
Candidate opt1 native build	447.973	414.263	2,174.7
Native constructor tests, two passed	264.382	264.031	2,815.2

All completed rows have OOM/kill zero and verified payload cleanup, under one CPU / 4 GiB hard / 3 GiB early-stop bounds. Kernel peaks include charged file cache, not RSS. JS/schema validation overlapped bounded compilation on the same CPU and is not an analysis-speed benchmark. The initial native build accidentally selected default release optimization rather than the original opt1 profile; it was deliberately interrupted after 135.878 seconds and its unique owned scope verified inactive. Its final counters are unavailable. The corrected opt1 candidate build above completed; no interrupted build is reported as passing.

The shared storage/renderer changes still need final native JSON-capacity tests, a final rebuilt/pinned engine, real SDK/MCP checks on that final engine and the real-model pair. The question contains only formats and requirements, no addresses/counts/IDs. Freeze it, the oracle and runtime before both isolated agents; generate complete manifests from the actual catalog. Use the same requested model/settings and common guidance, preserve all attempts and review complete answers/source identities. Report whole-task cumulative/cached/uncached input, output/reasoning, responses, calls/retries/waits, wall/CPU/family memory, target/engine/runtime stability and cleanup. Candidate checks do not establish those pending model outcomes or a cost advantage.