rea/experiments/atomic-codemode/function-boundary-study.md

# Native function boundaries as independent facts

The selected cross-function SSH task needs to distinguish recovered formal
prototype entries from raw input varnodes. The existing value is_input flag is
not formal membership: it also includes stack/global inputs. Recovering an
original source signature from either inventory would be unsupported.

A new shared `parameters` query selects native prototype indices, fields and
pages, with a separately projected return descriptor, native model label,
lock/variadic/recovery-error flags and retained Evidence. Defaults omit display
names/type strings. Explicit void, unknown storage/type, known missing native
indices, unavailable store and malformed capture remain distinct. Source arity,
ABI truth, runtime binding, aliases, stack rebasing and split/join mappings stay
unknown. Call-site argument storage is a separate fact. The analyst can compose
it with selected callee prototype/storage/value facts while retaining both
snapshots' identities and the selected machine corroboration.

One native function-prototype owner exports an independent parameters facet.
Its extraction does not depend on full CFG/call enumeration, and optional encoded
output budgeting retains typed omission reasons and readable code. The renderer
restores owned JSON fields by identity rather than a numeric position invalidated
by removing other independent facets. Native address/storage serialization and
JS storage contracts each have one shared owner for call sites and function
prototypes; parameters do not depend on a call-record schema's nested shape.
Shared application admission keeps the same named methods for SDK, CLI and both
MCP adapters. There are seventeen methods, twenty direct tools and four Code
Mode tools. No integration with stock Kuna or other providers is claimed.

The native overlay is pinned to upstream
`fe01d6294eb0d1053ce343c8943646df88e143fc`; the REA experiment was refreshed from
main `f22e8e726` before this change. Forward/reverse patch checks pass against
the pinned base/current source. All generated binaries, captures and caches stay
local. No PR or merge into main is intended.

## Current executed evidence

The first real SSH candidate engine is
`6aae471bef4434eb3acea98b497c6df58e3a9fa71021178c89bbbc3d96109080`.
Actual Code Mode MCP checks both functions, full/selected/empty parameter
queries, paging, exact retained input-location matches, repeated
metadata and complete source fidelity: removing only the added parameters facet
leaves each complete prior native function record unchanged. Banner `0x25cb0`
has four native prototype slots but three retained is_input values; slots 1/2
have no exact retained input match. Caller `0x280c0` has ten prototype slots and
44 raw input values, with all ten native storage tuples matched. Native labels
and flags are observations, not original source arity/ABI proof. Full expected
facts and limits are in the [oracle](function-boundary-oracle.md).

The JS suite passes 94 tests, including projection-only/unavailable/malformed
prototype reads, native identities/order/paging, explicit void versus unknown,
immutable SDK metadata and runtime/JSON Schema agreement. Both actual converted
MCP catalogs pass named schema/admission checks. Two native constructor tests
pass: absent stores stay unavailable, and native slots/void/return storage/locks
remain distinct. Full native workspace/corpus gates are unexecuted.

| Executed stage                        | Family wall s |   CPU s | Kernel peak MiB |
| ------------------------------------- | ------------: | ------: | --------------: |
| Latest-main cached runtime build      |        43.328 |  41.531 |         3,057.8 |
| Initial 94 JS tests                   |        29.271 |   9.085 |            82.1 |
| Initial converted catalog checks      |        10.592 |   2.281 |           136.5 |
| Candidate real Code Mode SSH verifier |         8.676 |   8.439 |           319.9 |
| Candidate opt1 native build           |       447.973 | 414.263 |         2,174.7 |
| Native constructor tests, two passed  |       264.382 | 264.031 |         2,815.2 |

All completed rows have OOM/kill zero and verified payload cleanup, under one
CPU / 4 GiB hard / 3 GiB early-stop bounds. Kernel peaks include charged file
cache, not RSS. JS/schema validation overlapped bounded compilation on the same
CPU and is not an analysis-speed benchmark. The initial native build accidentally
selected default release optimization rather than the original opt1 profile; it
was deliberately interrupted after 135.878 seconds and its unique owned scope
verified inactive. Its final counters are unavailable. The corrected opt1
candidate build above completed; no interrupted build is reported as passing.

The shared storage/renderer changes still need final native JSON-capacity tests,
a final rebuilt/pinned engine, real SDK/MCP checks on that final engine and the
real-model pair. The [question](function-boundary-question.txt) contains only
formats and requirements, no addresses/counts/IDs. Freeze it, the oracle and
runtime before both isolated agents; generate complete manifests from the actual
catalog. Use the same requested model/settings and common guidance, preserve all
attempts and review complete answers/source identities. Report whole-task
cumulative/cached/uncached input, output/reasoning, responses, calls/retries/waits,
wall/CPU/family memory, target/engine/runtime stability and cleanup. Candidate
checks do not establish those pending model outcomes or a cost advantage.