[GH-ISSUE #4330] [Tracker] Audit and consolidation index of duplicate issues and reports (October 2026) #1722

New issue

Open

opened 2026-10-16 21:09:27 +00:00 by bsakaguchi · 2 comments

bsakaguchi commented 2026-10-16 21:09:27 +00:00

Owner

Copy link

Originally created by @matbrgz on GitHub (Oct 16, 2026).
Original GitHub issue: https://github.com/morluto/rea/issues/4330

Problem Statement & Context

With over 750+ active open issues and 1,000+ total lifetime submissions in morluto/rea, rapid community reporting and independent testing across environments (macOS, Windows, Linux, Claude Desktop, VS Code, Gemini, MCP clients) have produced multiple duplicate issues, overlapping bug reports, and redundant feature requests.

Unconsolidated duplicate issues split maintainer triage bandwidth, fragment reproduction fixtures across threads, and dilute tracking of root fixes.

This tracker establishes a structured index of identified duplicates and tightly coupled sibling clusters as of October 2026, keeping the earliest report as the canonical reference (min(created_at)) and recommending consolidation actions for maintainers (@morluto).

---

1. Direct Duplicates (Actionable: Close Newer in Favor of Canonical)

Status	Newer Duplicate (To Close)	Canonical Older Issue	Root Cause & Description
[x] Marked	#4058: [Bug] compare_web_screenshots fails in Claude Desktop: $ref params passed as strings (by @anupamsahoo)	#3408: Array and object tool parameters rejected when REA runs as a local MCP server in Claude Desktop (Windows) (by @rarekolesar-cyber)	Claude Desktop's MCP client serializes complex arguments (nested objects, $ref schemas, arrays) as raw JSON strings, causing Zod validation failure: expected object, received string.
[x] Marked	#3861: [Bug] Overflowing configuration defaults abort JavaScript application analysis (by @Zhong-fan)	#3400: [Bug] Overflowing JavaScript timer delays abort application analysis (by @coygeek)	In analyze_javascript_application, numeric literals exceeding IEEE 754 float limits (1e400 vs 1e999) parse to Infinity, which fails JSON serialization and aborts the AST analysis with unreadable_output.
[x] Marked	#3633: [Feature] Godot PCK inspection and extraction as an artifact reader (by @0xthearchitect)	#3631: [Feature] Godot reverse engineering: PCK unpacking, scene/resource deserialization, GDScript bytecode decompilation, and signal graph reconstruction (by @matbrgz)	Both request Godot PCK container inspection, embedded executable trailers (GDPC), and asset extraction. #3631 was opened first and encompasses the full engine deconstruction pipeline.
[x] Marked	#4867: [Feature] Add support llama.cpp (by @maksmanus)	#3668: [Feature] Local LLM runtime reverse engineering: llama.cpp, Ollama, MLX, ONNX Runtime, ExecuTorch and OpenVINO inference reconstruction (by @matbrgz)	Both propose first-class integration and execution support for local LLM inference models and runtimes via llama.cpp. #3668 opened the parent canonical specification.
[x] Marked	#5242: [Bug] Rizin recent-output retains up to 3x its UTF-8 byte budget for CJK frames (by @Faisal-Fayaz)	#5091: [Bug] Rizin recent output retains three times its UTF-8 byte budget for CJK frames (by @coygeek)	Identical defect: recent output truncation in Rizin counts code-point length rather than UTF-8 byte budget, causing CJK multi-byte frames (e.g. 3 bytes per character) to overrun the memory budget by 3x.
[x] Marked	#5185: Feature Request: Support Analysis of MQL5 .ex5 Expert Advisors Loaded by terminal64.exe (by @hadiabounader)	#3569: Feature Request: Support for MQL5 (.ex5) bytecode static analysis or provider integration (by @c2461630)	Both propose static analysis and runtime observation for compiled MetaTrader MQL5 (.ex5) Expert Advisor artifacts. #3569 is the earlier canonical proposal.

---

1.1 Concurrent Duplicate Pull Requests (Targeting Same Issue)

Newer PR	Earlier Canonical PR	Target Issue / Cluster	Author (Newer / Earlier)	Recommendation
#5578: fix(cli): reject negative and fractional token window values	#5544: fix(cli): reject invalid token-window bounds	#5532 (Cluster AQ)	@Som0111 / @chqcjq	Coordinate review; close #5578 in favor of earlier PR #5544.
#5644: fix(observation): keep incomplete cancellation observations	#5643: fix(analysis): preserve cancellation with partial observations	#5641 (Cluster BO)	@morluto / @charan-143	Coordinate review between maintainer PR #5644 and community PR #5643.
#5650: fix(apple): read LC_LAZY_LOAD_DYLIB_INFO dependency payloads	#5582: fix(apple): trace LC_LAZY_LOAD_DYLIB_INFO lazy dylib dependencies	#5551, #5649 (Cluster BC)	@morluto / @kaoru0822-kitauji	Coordinate review between maintainer PR #5650 and community PR #5582.

---

2. High-Overlap Sibling Clusters (Same Root Defect Across Subsystems)

These clusters reflect the same architectural defect manifesting across different providers, clients, or analysis modes. Rather than treating them as isolated bugs, they should be resolved via shared subsystem fixes.

Cluster A: MCP Client Schema Complexity & Registration (Claude Desktop, VS Code, Gemini)

• Canonical: #3408 (Array and object tool parameters rejected in Claude Desktop)
• #4058 (compare_web_screenshots fails: $ref params passed as strings)
• #4081 (compare_web_captures tool fails to register in Claude Desktop Windows - problem with that connector)
• #2813 (inputSchema nesting depth exceeds 10 on 24 tools - max 19: compare_web_captures)
• #4736 (VS Code rejects REA tool schema: mcp_rea_build_call_path)
• #5201 (Gemini-backed clients still reject the whole tool catalog: advertised empty-string const in trace_application_feature.seed.value serializes as an empty enum member)
• Action: Flatten complex MCP tool schemas, emit explicit items on array/tuple nodes for strict validators (VS Code), map empty-string consts to plain type: "string", and implement transparent pre-parsing of stringified JSON objects when requests originate from Claude Desktop.

Cluster B: JVM Provider Heap Exhaustion & Misleading rea doctor Guidance

• Canonical: #3517 (JADX "Java heap space" load failure points to rea doctor, which reports healthy)
• #4241 (Ghidra "Java heap space" during import is reported as execution_failure ("run rea doctor"), not a memory resource constraint)
• #4682 (Ghidra: an OutOfMemoryError is not recognized once the session's 8 MiB output budget is used up)
• Action: Normalize OutOfMemoryError / Java heap space across all JVM-backed providers (JADX, Ghidra) into a typed resource_constraint error, and inspect chunks for OOM markers before applying head-only diagnostic budget limits.

Cluster C: Post-Cancellation Success Classification During Cleanup

• #4227 (Audit lifecycle contracts across REA tools: readiness, cancellation, ownership, cleanup, and recovery)
• #3977 (DOS load-image verification reports success after cancellation during snapshot cleanup)
• #4009 (Native call observation returns successful Evidence after cancellation during finalization)
• #4251 (ADB screen capture publishes after cancellation before output commit)
• #4254 (WASM artifact inspection returns success after cancellation during final cleanup)
• #4255 (Electron page inspection returns success after cancellation during detach)
• #4256 (Browser scenario returns success after cancellation during final session close)
• #4483 (Artifact readback can replace IO failures and report success after cancellation)
• #4735 (Signature inspection returns success after cancellation during final cleanup)
• Action: Consolidate provider-level post-cleanup signal checks into the canonical provider-evidence finalization helper defined in #4227.

Cluster D: Reconstruction Coverage Boundary Evaluator Anomalies

• #3354 (Reconstruction coverage reports ready with a missing transitive dependency)
• #3889 (Reconstruction coverage reports ready when a passing proof conflicts with a failed one)
• Canonical: #3890 (Reconstruction coverage ignores authority routing on surfaces named only by a required claim)
• #3937 (Reconstruction coverage ignores contradictions on required claim surfaces)
• Action: Ensure the boundary evaluator in evaluate-reconstruction-coverage verifies authority routing, transitively required dependencies, and active proof contradictions uniformly before reporting ready.

Cluster E: Codex Per-Tool Approval Settings Conflicts & Loss

• Canonical: #3862 (rea doctor marks a Codex registration invalid when it has per-tool approval settings)
• #3863 (rea setup deletes Codex per-tool approval settings when refreshing the registration)
• Action: Retain [mcp_servers.rea.tools.*] table configurations across rea setup registration flushes and update rea doctor schema validators to accept valid per-tool approval blocks.

Cluster F: Electron Active Hook Host Filesystem Mutation Bypass

• Canonical: #3452 (capture_electron_scenario does not block app.moveToApplicationsFolder)
• #3474 (capture_electron_scenario active hook does not block or record shell.trashItem)
• #4393 (capture_electron_scenario active hook does not block or record shell.showItemInFolder and shell.writeShortcutLink)
• Action: Patch scripts/electron-active-hook-boundaries.cjs to intercept, block, and record all native host-mutating IPC/Electron APIs (app.moveToApplicationsFolder, shell.trashItem, shell.showItemInFolder, shell.writeShortcutLink) under active observation.

Cluster G: Apple Universal FAT Mach-O arm64e.x1 ABI-Variant Slice Incompatibility

• Canonical: #3072 (Hopper provider on macOS: FAT Mach-O slice selection loads arm64e.x1, collapsing analysis of system binaries)
• #4280 (inspect_artifact: stock macOS universal binaries report integrity_mismatch (arm64e.x1 slice defeats lipoNameMatches; integrity_policy inert on this path))
• Action: Update universal binary slice extraction (lipoNameMatches / MachOSliceSelection) to recognize Apple's arm64e.x1 slice (cpusubtype 12) and prefer standard arm64e (cpusubtype 2) or gracefully handle ABI-variant entry points.

Cluster H: Firmware Tooling Environment, Dependencies & Health Checks

• #3756 (extract_firmware reports coverage "complete" when nothing was extracted)
• #3757 (Firmware tools need procps ps, which their requirements do not list)
• #3758 (rea doctor has no checks for the firmware integrations)
• #4475 (Firmware read-handle close failures discard outcomes and lose cleanup ownership)
• Action: Unify firmware tool requirements in rea doctor, require procps ps, and fail closed when unpack utilities yield 0 extracted artifacts.

Cluster I: Web Inspector Silent Drop of Malformed CDP Inventories & Workers

• #3376 (Missing or malformed accessibility inventories are reported as complete empty trees)
• #3378 (Malformed worker inventories are reported as empty)
• #4425 (inspect-web-page: requests from dedicated workers are not recorded (worker listed as attached, 0 requests))
• Action: Replace empty fallback representations in inspect-web-page with explicit omission / malformed markers when CDP queries return unexpected payloads, and multiplex dedicated worker sessions with Target.setAutoAttach.

Cluster J: Claude Setup & Configuration Discovery Edge Cases

• #4262 (Empty CLAUDE_CONFIG_DIR makes setup register Claude MCP in the working directory)
• #4278 (setup can't register Claude Desktop when the MSIX build has no package-private config)
• #4432 (Claude Desktop resolution misses AnthropicPBC.Claude_* and -3p builds, so setup writes a config the app never reads)
• Action: Validate configuration directory non-emptiness before resolving relative paths in rea setup, and add MSIX package-private virtual store search paths (%LOCALAPPDATA%\Packages\AnthropicPBC.Claude_*\LocalCache\Roaming\Claude) for Windows Claude Desktop.

Cluster K: XML Keyed-Archive Deserialization & CDATA Handling / Plist Decoder

• Canonical: #3371 (CDATA in XML keyed-archive keys truncates root and field names)
• #3373 (Keyed archive inspection returns hexadecimal XML integers as zero)
• #4042 (XML plist real values lose CDATA content during keyed-archive inspection)
• #4714 (Keyed archive inspection reports recovered malformed XML as observed values)
• #4849 (inspect_plist drops plutil's decode diagnostic on macOS and reports an empty parenthesis)
• #4852 (XML plist decoder reports Apple-rejected integer, real, date and boolean text as observed values)
• #5701 (inspect-plist rejects a valid binary plist containing a control character and data)
• #5702 (inspect-plist rewrites Unicode separators as LF when XML fallback is used)
• #5703 (inspect-plist silently drops fractional seconds from binary plist dates)
• #5705 (inspect-plist still loses negative-zero sign through XML fallback after #4839)
• Action: Harden XML/plist parser in inspect-keyed-archive and inspect_plist to preserve CDATA blocks uniformly, capture plutil stderr diagnostics, and align with Apple Foundation decoder constraints.

Cluster L: CommonJS & Reference-Source Import Path Resolution

• Canonical: #3895 (Reference-source import resolves require("./dep") to dep/index.ts instead of dep.js)
• #3982 (Reference-source import reports dependencies after CommonJS require is replaced)
• #4189 (Trailing-slash CommonJS require ignores package main in reference import)
• Action: Standardize CommonJS module path normalization and AST binding resolution in import-reference-source to respect exact Node.js resolution order (package.json#main, directory index fallback, and local shadowing).

Cluster M: Native Addon Binding Extraction from JS AST

• Canonical: #3884 (Local require method creates a resolved native-addon binding)
• #3885 (Optional require call loses its native-addon binding record)
• #4490 (Destructuring Electron from a Webpack module-table external drops BrowserWindow and IPC)
• Action: Disambiguate global require from member/method calls (obj.require()), preserve bindings detected in conditional or optional require branches, and recognize Webpack external module destructuring in analyze_javascript_application.

Cluster N: Provider CLI Cleanup Diagnostics Preservation

• Canonical: #3935 (Provider CLI cleanup failures discard completed results and primary diagnostics)
• #4240 (Direct CLI cleanup composition drops primary cleanup resource diagnostics)
• #4458 (Stable artifact reads lose descriptor ownership and operation outcomes when close rejects)
• Action: Ensure pipeline error propagation in CLI composition chains retains primary result payloads and diagnostic resource context even if deferred resource close triggers warnings.

Cluster O: Universal Mach-O Direct Slice Selection Across Providers

• Canonical Request: #3282 (Ghidra provider: support universal (FAT) Mach-O by importing the selected slice)
• #4102 (Let inspect_go_binary / inspect_rust_binary select a slice of a universal Mach-O without lipo)
• Action: Provide a shared slice selection parameter (--slice / macho_slice) across all binary inspection tools and providers without requiring invocation of external lipo.

Cluster P: Android Method Boundary Analysis & Body Extraction

• Canonical: #3443 (inspect_android_method reports an inlined Java method as "native/abstract" with no body)
• #3488 (inspect_android_method returns neighbouring members as the "complete" body of a native method)
• Action: Fix JADX-backed method AST slicing in inspect_android_method so that inlined methods retain their de-inlined representation and native methods do not erroneously grab sibling instruction spans.

Cluster Q: Unsupported Platform Hopper Installation Remediation

• Canonical Defect: #3419 (Setup offers automated Hopper installation on Linux arm64, but every pinned Hopper package is x86_64)
• #3944 (Windows setup recovery recommends an unsupported Hopper installation)
• Action: Make rea setup platform gates aware of Hopper's architecture limitations (macOS and Linux x86_64 only) and prevent remediation prompts from advising --install-hopper on unsupported targets (Windows, Linux arm64).

Cluster R: Hermes Client Setup & MCP Configuration Anchors

• Canonical: #3320 (Hermes setup fails to register REA through an aliased MCP server table)
• #3325 (Hermes setup cannot refresh a REA anchor referenced by another server)
• #3939 (Nested HERMES_HOME roots use another root's active profile during setup)
• #4841 (Hermes named-user home overrides plan registration in a different relative directory)
• Action: Support YAML anchors and aliased server tables in Hermes configuration readers/writers without destroying cross-server references on write, and isolate nested HERMES_HOME discovery.

Cluster S: JavaScript Timer Delay & Window Duration 32-bit Integer Overflow

• Canonical: #3400 (Overflowing JavaScript timer delays abort application analysis)
• #3861 (Overflowing configuration defaults abort JavaScript application analysis)
• #4392 (observe_web_session ends a window above 2^31-1 ms almost immediately but reports it as elapsed)
• Action: Validate and cap duration parameters in schema (observation_ms, timers) to 2^31 - 1 ms (2,147,483,647 ms) to avoid V8 setTimeout truncation down to 1 ms, and handle Infinity literals gracefully during AST analysis.

Cluster T: WASM Glue JavaScript Inspection & Parsing

• Canonical: #4001 (WASM glue inspection omits string literals in JavaScript directive prologues)
• #4474 (WASM glue still uses unnamed TypeScript parser for valid JavaScript)
• Action: Disambiguate JavaScript from TypeScript parser modes in inspect_wasm_artifact and retain directive prologues and string literals across WASM runtime glue analysis.

Cluster U: PE Resource Parsing, Section Mapping & Lifecycle

• Canonical: #4455 (PE resource mapping treats zero-extent sections as overlapping byte ranges)
• #4457 (PE resource provider closes while admitted parsing is still active)
• Action: Harden section boundary arithmetic in src/native/pe/PeResourcesProvider.ts to ignore zero-extent sections and keep the resource provider context active until all admitted parsing promises settle.

Cluster V: Reconstruction Obligation Ledgers & Ledger Integrity

• Canonical: #3370 (Reconstruction obligation ledgers lose semantic unknowns and report complete coverage)
• #4444 (build_reconstruction_obligation_ledger reports a missing review record or duplicate record IDs as unreadable_output ("run rea doctor"))
• Action: Project typed ledger validation diagnostics in build_reconstruction_obligation_ledger instead of generic unreadable_output, and preserve semantic unknowns during ledger compilation.

Cluster W: Cutter / Named-Pipe Blocking & Probing

• Canonical: #3887 (Named-pipe firmware input blocks cancellation and the operation deadline)
• #3946 (Cutter session discovery keeps probing after MCP cancellation)
• #4471 (Cutter discovery can block indefinitely opening a named-pipe descriptor)
• Action: Open POSIX FIFO and named pipes with non-blocking flags (O_NONBLOCK) during session discovery and integrate cooperative cancellation checks in Cutter/firmware boundaries.

Cluster X: Application Target Path Symlink Resolution & Caller-Selected Path Loss

• Canonical: #5103 (Electron scenario CLI rejects an existing application path after symlink/..)
• #5258 (JavaScript application Evidence loses the caller-selected path after symlink resolution)
• #5479 (inspect-artifact loses the caller-selected symlink path from complete Evidence)
• #5492 (inspect-plist --relative-path reads the wrong file when .. follows a directory symlink)
• #5521 (Artifact commands describe a stable symlink loop as a target change)
• #5623 (JavaScript application analysis drops the selected path and host resolution reason)
• Action: Route CLI input paths through absoluteCallerPath preserving .. for POSIX symlink resolution, retain caller-selected entrypoints in produced Evidence, report host resolution failure reasons, and distinguish stable symlink loops (ELOOP) from concurrent target mutations.

Cluster Y: Windows Native Handle Authority, Private DACL & AppContainer Admission Failures

• Canonical: #289 (Use handle-based reparse-safe filesystem authority on Windows)
• #1701 (Windows native authority self-test fails on real Windows: "Delete owned object by handle failed" (Win32 5), and leaves probe directories behind)
• #5225 ([Windows x64] rea inspect --provider ghidra fails snapshot admission with Win32 5 (EACCES) in an AppContainer process)
• #5237 ([Windows native] Private DACL contains unexpected trustees (Win32 5) blocks Android inspection before JADX)
• #4505 (Windows native handle finalization discards failed close ownership)
• Action: Generalize Security() in native/windows/src/filesystem.cc to admit sandboxed AppContainer tokens and non-standard local trustees without failing closed on harmless ambient DACL entries, and clean probe artifacts.

Cluster Z: Kuna Provider Lifecycle, Cancellation & Workspace Ownership

• Canonical Discovery: #4698 (Kuna session installation acquisition ignores cancellation)
• #4700 (Kuna shared query waits discard caller cancellation reasons)
• #4702 (Kuna command cleanup retry leaves original ownership unresolved)
• #4704 (Kuna workspace rollback hides retained cleanup)
• #5105 (Setup advertises Kuna for deep analysis after its cache check fails)
• #5106 (Cancelling doctor does not interrupt its Kuna version probe)
• Action: Wire cooperative cancellation tokens through Kuna provider session acquisition, doctor probes, and enforce idempotent workspace rollback and cleanup retry accounting.

Cluster AA: HTTP & Proxy Capture API Surface Reconstruction (Fiddler SAZ & mitmproxy)

• Canonical: #2857 (Derive API surfaces from retained Fiddler SAZ captures)
• #2915 (Derive API surfaces from retained native mitmproxy flows)
• Action: Implement a unified network session ingester in src/network/ capable of parsing session archives (.saz, mitmproxy flows) to recover endpoints, headers, schema definitions, and RPC interfaces.

Cluster AB: Hopper Linux Virtual X11 Display & Stale Lock Cleanup Failures

• Canonical: #4226 (Hopper pre-handshake startup failure causes repeated cleanup errors while session reports idle)
• #4921 (Hopper (Linux): session teardown leaves a stale /tmp/.X-lock; accumulated locks can make startup fail with address_collision)
• #5189 (fix(hopper): preserve an explicit display number zero in the X11 helper)
• Action: Ensure Linux Hopper teardown verifies and unlinks display lock files (/tmp/.X<n>-lock) matching the allocated Xvfb PID, and prune stale locks on startup.

Cluster AC: Linux Process Exit Races, Descendant Reparenting & Token Mismatches

• Canonical: #4322 (Linux exit race reports an exited owned process as a token mismatch)
• #5206 (Process exit refresh can discard reparented descendants and report cleanup complete)
• Action: Synchronize process polling in src/process/ProcessOwnership.ts against /proc updates, verifying dead parent exit states before reporting token mismatches and capturing reparented child PID groups.

Cluster AD: Linux Electron Owned Lineage & X11 Authorization

• Canonical: #3414 (Owned Electron capture drops the selected X11 authorization path)
• #4282 (Linux Electron capture cannot verify owned lineage: Chromium processes do not expose REA_PROCESS_RUN_ID in /proc//environ)
• Action: Provide alternative IPC or command-line token verification for Chromium-based runtimes that sanitize environment variables on Linux, and preserve user-provided XAUTHORITY paths.

Cluster AE: Partial Evidence Omission of Known Analysis Profile on Cancellation / Failure

• Canonical: #3992 (Failed IDA decompilation drops the known profile from partial Evidence)
• #5109 (Late-cancelled document selection drops the known analysis profile from Evidence)
• Action: Ensure the Evidence builder retains the caller-selected or resolved analysis_profile metadata field even when operations abort mid-stream or encounter late cancellation.

Cluster AF: .NET Managed Member Metadata & CIL Instruction Slicing

• Canonical: #3877 (Wrong-kind managed member signatures are reported decoded with complete coverage)
• #4370 (A method ending in volatile. receives a complete decoded-CIL fingerprint)
• #5102 (Managed member inspection labels truncated compressed parameter counts as reserved)
• #5146 (inspect-managed-members returns unavailable on a 2042-type .NET app and offers no way to list its types)
• #5147 (inspect-managed-members anchors omit operand-free instructions such as ldc.i4.N)
• Action: Fix CIL disassembler slicing in inspect_managed_members to preserve operand-free instructions (ldc.i4.N, dup, pop), avoid truncated parameter counts, and correctly handle type listing across large assemblies.

Cluster AG: GDB Persistent Debug Session & CLI Command Boundary

• Canonical: #5098 (debug-with-gdb rejects built-in p, s and d aliases before starting GDB)
• #5099 (Inspecting inferior-tty permanently revokes persistent GDB session TTY verification)
• Action: Exempt read-only GDB introspection commands from inferior output dirty checks in commandMayChangeInferiorOutput and allow standard single-letter GDB aliases (p, s, c, d).

Cluster AH: Android ADB Automation & Activity Execution Boundaries

• Canonical: #3369 (ADB push reports checksum capture overflow as device unavailability)
• #5093 (start-adb-activity rejects valid empty-string intent extras before provider admission)
• #5190 (fix(scripts): ADB verifier leaves its pushed probe file on the device)
• #5689 (inspect-adb-client hides execution failures behind a version diagnostic)
• #5690 (Apktool version-output overflow is reported as an unusable launcher)
• Action: Permit empty-string intent extra string parameters in start_adb_activity schema, handle large push checksum buffers, and unlink temporary verifier probe artifacts.

Cluster AI: JavaScript Application Source Map Handling & Coverage Anomalies

• Canonical: #5466 (JavaScript application analysis misreports external source-map sections as version mismatches)
• #5469 (JavaScript application analysis reports complete coverage for source maps missing mappings)
• Action: Harden index-map parser in src/javascript/ to handle external URL sections without misclassifying them as version discrepancies, and emit partial coverage warnings when source maps lack mappings.

Cluster AJ: Misleading Recovery Remediation on Capacity & Budget Refusals

• Canonical: #5504 (Rust compiler-hash capacity refusals incorrectly tell callers to retry)
• #5505 (Rust report-budget refusals recommend recovering Evidence that was never produced)
• #5506 (WASM comparison budget refusals incorrectly tell callers to retry)
• #5456 (SQLite reply-budget refusals recommend recovering Evidence that was never produced)
• #5459 (Analysis-view projection budget refusals recommend increasing worker memory)
• #5460 (IL2CPP report-budget refusals recommend worker and host memory changes)
• #5537 (Electron fuse limit refusals return misleading retry and recovery advice)
• #5556 (Fixed inspection-budget refusals recommend worker and host memory changes)
• #5628 (Typed WASM interface decoding tells callers to retry a fixed representation budget)
• #5630 (IL2CPP reader occupancy is reported as a non-retryable memory failure)
• #5631 (Fixed capture budgets recommend changing worker or host memory)
• #5632 (Flutter file budgets and Go report refusals give recovery that cannot admit the same input)
• Action: Harmonize resource_constraint and capacity_refusal diagnostics (addressed in maintainer PR #5633) to name fixed allowances explicitly, eliminate false retry advice, and avoid recommending memory tweaks for fixed reader bounds.

Cluster AK: Managed/Native P/Invoke Boundary Verification Anomalies

• Canonical: #3351 (Managed/native verification contradicts Windows module paths on macOS)
• #5467 (Managed/native verification treats an empty normalized module identity as known)
• #5468 (Managed/native verification rejects inspection Evidence with an empty P/Invoke import name)
• Action: Correct module normalization in src/verification/ to avoid accepting empty module names as valid known identities and support valid empty import names in P/Invoke inspection contracts.

Cluster AL: Environment CLI Command Error Projection & Remediation

• Canonical: #5455 (environment-serve suggests changing ports for host lookup failures)
• #5457 (environment-export reports an identity change when its destination is an existing file)
• #5458 (environment-export reports read access denied for an unwritable output directory)
• #5513 (Desktop inspection classifies invalid and unreadable targets as execution failures)
• #5515 (decode_signal_recording: a misspelled decoder or annotation class returns execution_failure with "Run rea doctor", which has no sigrok check)
• Action: Differentiate write/create errors from read denials in environment-export, classify target input errors accurately rather than projecting generic execution_failure, and decouple input/network errors from unrelated rea doctor or port remediation hints.

Cluster AM: Trace Feature Contract & Crash Diagnostic Inconsistencies

• Canonical: #5449 (trace-application-feature reports changed Evidence as a retryable input error)
• #5474 (trace_crash advertises its provider document selector as Hopper-specific)
• #5503 (trace_feature drops Hopper string encoding and termination qualifications)
• #5507 (trace_feature promises an operation count absent from successful results)
• Action: Align schema guarantees in trace_feature with returned payloads, preserve string encoding qualifications across provider boundaries, and generalize crash trace provider selection.

Cluster AN: Ghidra Header-Driven Architecture Lane Admission (ET_DYN, MIPS, RISC-V, SPARC)

• Canonical: #2338 (Ghidra MIPS: admit plain MIPS32 PIC shared libraries (ET_DYN) at their link base)
• #2734 (Ghidra MIPS lane rejects mips1/mips32 — the dominant ISA mix in embedded firmware)
• #4487 (Ghidra RISC-V lane: admit position-independent executables (ET_DYN); distro riscv64 binaries are almost all PIE)
• #4842 (Admit SPARC V9 ELF objects (EM_SPARCV9, 43) through the header-driven Ghidra lane)
• #5243 (Windows Ghidra P0: no path for ELF/arm64 targets (e.g. Android libapp.so))
• Action: Unify ELF ET_DYN position-independent binary admission across all architecture lanes (MIPS, RISC-V, SPARC, arm64) in the header-driven Ghidra loader.

Cluster AO: Application Version Diffing & Endpoint Comparison Anomalies

• Canonical: #4681 (Application version comparison treats unresolved relationship targets as aligned)
• #5195 (compare-application-versions reports unchanged module exports as removed and added)
• #5406 (compare-application-versions pairs unresolved endpoints by equal expression text)
• #5534 (compare-application-versions reports unselected source scopes as added or removed)
• #5535 (compare_functions reports false call and reference changes for Hopper's generated EntryPoint label)
• Action: Exclude unselected parse-scope placeholders and synthetic provider labels (EntryPoint) from diff sets, and match module exports and endpoints by content digest rather than lexical text equivalence.

Cluster AP: Web Page Inspection HTTP Header Parsing (Link, COOP, COEP)

• Canonical: #4677 (Page inspection loses COOP and COEP policy tokens with valid report-to parameters)
• #4679 (Page inspection drops repeated Link fields from Document responses)
• Action: Parse newline-delimited headers in CDP response objects and preserve structured security tokens (report-to, COOP, COEP, Link) during web page inspection.

Cluster AQ: CLI Output Filtering, Token Windowing & Formatting

• Canonical: #5110 (Exhausted CLI failure token windows display a reversed range)
• #5448 (CLI --filter-output removes failure diagnostics and prints an empty object)
• #5530 (CLI token windows duplicate digest characters and corrupt emoji)
• #5532 (Negative and fractional token-window values produce inconsistent pages)
• #5531 (Invalid output-flag values emit TOON despite selecting JSON or JSONL)
• #5525 (CLI --format md replaces nested inventory facts with [object Object])
• Action: Ensure --filter-output preserves typed error envelopes, validate token window parameters as non-negative integers with codepoint/byte-boundary slicing, preserve JSON/JSONL format stability on argument errors, and properly serialize nested objects in markdown output.

Cluster AR: EVM Artifact & Interface Lifecycle, Cleanup & Cancellation

• Canonical: #4683 (EVM contract interface extraction produces empty ABI for multiple valid contracts)
• #4686 (evm_disassemble can leak temporary output file if worker throws before finalization)
• #5295 (Cancelling evm_inspect_contract leaves abandoned worker child process on Linux)
• #5332 (Unhandled rejections during EVM contract artifact load bypass structured error envelope)
• Action: Ensure EVM inspection and disassembly workers handle cleanup in finally blocks, register cancellation handlers that terminate worker child processes, and preserve the structured error envelope.

Cluster AS: SQLite Provider Cleanup, Worker Failure & Diagnostic Attribution

• Canonical: #4184 (SQLite provider leaves lock file on aborted schema inspection)
• #5284 (SQLite inspect worker crash reports success when query had partial result)
• #5286 (SQLite schema extraction reports cancelled analysis as successful partial result)
• #5294 (Uncaught exception in SQLite thread pool suppresses error diagnosis)
• #5520 (SQLite malformed-database errors omit the selected file path)
• #5719 (SQLite generated-column evaluation failures blame the database path)
• Action: Ensure SQLite inspection workers reliably clean lock files, distinguish cancellation/crashes from partial success, surface thread pool diagnostics, and include target path context in malformed database errors.

Cluster AT: Export Pipeline Path Length Bounds & Staging Residue

• Canonical: #5480 (Evidence export fails for valid long output paths and can leave empty staging directories)
• #5502 (Cancelled JavaScript analysis can still leave the macOS helper's temporary folder after #1194)
• #5522 (environment-export reports a later nested-file path-length failure as invalid input)
• Action: Handle operating system pathname limits in export bundle operations (evidence-export, environment-export), clean up .rea-staging-* and helper temporary directories on error or cancellation, and attribute nested path length errors to the exact path rather than misclassifying as invalid input.

Cluster AU: Hopper Provider Lifecycle, Authenticated Build Admission & Bookmark Mutation

• Canonical: #5245 (6.7.0 flags previously working extracted Hopper demo as unsupported_hopper_build)
• #5454 (Scoped Hopper doctor reports healthy when configuration blocks native analysis)
• #5475 (Clearing a Hopper bookmark name reports success but retains the previous name)
• Action: Support verified extracted Hopper demo installations in doctor/setup, align scoped doctor checks with configuration prerequisites, and properly persist bookmark name deletions in set_bookmark.

Cluster AV: Headless CLI Automation, Structured Input & Output Streaming Suite

• Canonical: #5481 (Add shell completion for the REA CLI)
• #5482 (Add CSV and TSV output for tabular analysis views)
• #5483 (Provide machine-readable version and runtime information)
• #5484 (Add optional command timing summaries to CLI runs)
• #5485 (Generate a redacted diagnostic report for support requests)
• #5486 (Accept stdin for structured CLI request documents)
• #5487 (Add JSON Lines output for large row-oriented results)
• #5488 (Add a validation-only command for browser scenario files)
• #5489 (Add a dry-run plan for artifact extraction)
• #5490 (Add manifest-driven batch mode for independent offline artifact inspections)
• Action: Implement a unified headless CLI automation suite with structured streaming (CSV/TSV, JSON Lines), declarative manifest batch processing, and offline validation.

Cluster AW: CLI Shell Completion Generation & Option Routing

• Canonical: #5481 (Add shell completion for the REA CLI)
• #5526 (Bash completion omits documented global options)
• #5527 (Bash completion fails to register in macOS system Bash)
• #5528 (\rea mcp` shell completion suggests unrelated root commands`)
• Action: Emit Bash 3.2-compatible completion scripts, include documented global flags (--help, --format, --token-limit), and constrain sub-command completion context for nested command paths.

Cluster AX: Compiled Interface Builder / NIB Decoding & Object Limit Anomalies

• Canonical: #5540 (decode-interface-builder misattributes object-limit omissions to the connection budget)
• #5541 (decode-interface-builder reverses boolean values in compiled AppKit nibs)
• #5590 (decode-interface-builder reports complete connection coverage while omitting bindings)
• #5692 (decode-interface-builder labels an archived outlet-collection destination missing or external)
• #5693 (Compiled AppKit nib hierarchies omit top-level custom objects while reporting complete coverage)
• #5695 (Compiled storyboard segues lack connections while connection coverage reports complete)
• #5720 (decode-interface-builder reports keyed AppKit action connectors as UI controls)
• #5721 (Keyed nib decoding reports placeholder classes instead of authored classes)
• Action: Attribute omitted NIB elements accurately to object limits rather than connection budgets, fix boolean deserialization in compiled AppKit nib archives, and adjust coverage status when connection bindings are omitted.

Cluster AY: Code Signature Inspection Metadata, Temporary Filesystem State & Limitation Tracking

• Canonical: #4293 (Universal Mach-O signatures report one slice as the whole file)
• #5423 (Signature inspection omits its temporary filesystem-write effect from discovery)
• #5538 (inspect-signature lists completed signing captures as an outstanding limitation)
• #5697 (inspect-signature still fails on mixed ad hoc signed universal Mach-O after #701)
• Action: Report all signed slices in universal Mach-O binaries, declare temporary filesystem effects during signature extraction, and clear outstanding limitations once signing requirements are fully parsed.

Cluster AZ: Native Dispatch Metadata Inspection & Provider Fallbacks

• Canonical: #4368 (Empty Swift conformance names escape entry recovery and invalidate dispatch metadata)
• #5424 (Dispatch-metadata symbol fallback turns Ghidra pointer/string labels into fake Objective-C classes and misses every class the binary defines)
• #5529 (Native dispatch metadata --snapshot rejects a successful decode without a deep provider)
• #5543 (Dispatch metadata marks method lists decoded when the record budget omits their methods)
• #5681 (Swift vtable coverage mixes examined type entries with decoded slots)
• #5682 (Swift dispatch metadata loses enclosing type and module names)
• #5683 (Swift dispatch metadata labels imported descriptors as unsupported kinds)
• #5685 (Swift class vtable inspection reports null implementations as decoded at 0x0)
• #5706 (Objective-C class coverage counts one examined class as two decoded records)
• #5707 (Protocol properties are silently omitted from dispatch metadata)
• Action: Validate Swift conformance names and nested type contexts, ensure correct vtable slot decode metrics and null displacement handling, allow --snapshot verification without deep providers, and mark truncated method lists incomplete.

Cluster BA: Swift Type Classification & Demangling Anomalies

• Canonical: #4296 (analyze_swift_types puts constrained-extension members under structs)
• #5553 (analyze_swift_types misclassifies nested Unicode types and hides class results)
• #5552 (demangle-swift reports an omitted record as demangled and fails mixed batches)
• Action: Categorize Swift members by their true conforming type rather than enclosing structs, support nested Unicode type paths, and prevent empty record omission from poisoning mixed batch demangling results.

Cluster BB: Apple DMG Artifact Inspection, Mount Handling & Integrity Policy

• Canonical: #5546 (inspect-artifact discards root observations when a DMG is already mounted)
• #5547 (DMG inspection guidance directs callers to unsupported extraction)
• #5549 (inspect-artifact recommends an ineffective integrity-policy retry for checksum-invalid DMGs)
• #5687 (inspect-artifact rejects mountable raw UDRW DMGs as unsupported binaries)
• Action: Support inspection of already-mounted DMG volumes, recognize raw UDRW disk images, correct tool discovery guidance regarding DMG extraction capabilities, and validate checksums before suggesting integrity policy overrides.

Cluster BC: Mach-O Dylib Resolution & Dependency Tracing

• Canonical: #5362 (Dylib path expansion rejects line terminators in dependency names and rpaths)
• #5551 (trace-dylib-resolution omits lazy dylib dependencies while reporting complete coverage)
• #5637 (trace-dylib-resolution treats absolute paths inside the analyzed bundle as outside-target)
• #5649 (inspect-macho treats dependencies as exhaustive when LC_LAZY_LOAD_DYLIB_INFO is present)
• #5696 (trace-dylib-resolution skips a loadable platform-less dylib and its required dependencies)
• Action: Preserve sanitized dependency names and rpaths containing valid line terminators, include LC_LAZY_LOAD_DYLIB and LC_LAZY_LOAD_DYLIB_INFO entries in dependency tracing, correctly classify in-bundle absolute paths, and avoid marking dependencies exhaustive when lazy dylibs are present (addressed in PRs #5582 and #5650).

Cluster BD: Kuna Provider Cache Discovery & Readiness Validation

• Canonical: #5105 (Setup advertises Kuna for deep analysis after its cache check fails)
• #4624 (CLI guide excludes Kuna from supported doctor providers on main)
• #5554 (Doctor reports Kuna ready when its cache root is a dangling symlink)
• #5568 (Kuna doctor cancellation test times out during preceding provider startup)
• #5611 (Kuna readiness can pair a reported version with different executable bytes)
• Action: Harmonize Kuna documentation in CLI guides, prevent setup advertising Kuna when cache verification fails, check filesystem existence beyond symlink resolution, and ensure provider executable hashes accurately reflect active binaries.

Cluster BE: Universal (FAT) Mach-O Header Validation & Slice Architecture Admission

• Canonical: #5462 (Native inspection admits universal static archives as Mach-O images)
• #5542 (FAT target admission trusts CPU declarations that contradict thin Mach-O headers)
• Action: Inspect thin Mach-O slice headers directly instead of trusting top-level FAT header declarations, and reject non-Mach-O universal static archive containers early.

Cluster BF: IDA Provider Readiness, Registration Verification & Descriptor Ownership

• Canonical: #5559 (Doctor reports IDA ready with an unusable headless workspace root)
• #5561 (IDA doctor stops responding when its registration path is a FIFO)
• #5604 (IDA reader in #5591 loses descriptor ownership after close failure)
• Action: Validate workspace root writability during IDA doctor checks, verify registration paths are regular files before opening, and ensure file descriptor handles are properly reclaimed in failure cleanups.

Cluster BG: macOS Application Bundle Detection, Workflow Routing & Resource Extraction

• Canonical: #5589 (Resource inspection rejects app bundles without CFBundleExecutable)
• #5595 (analyze selects the wrong workflow for bundle aliases and JavaScript directories named .app)
• Action: Inspect .app bundles that lack CFBundleExecutable (e.g. data or web resource packages) and prevent lexical .app directory name suffixes or symlink aliases from misrouting non-native workflows.

Cluster BH: Objective-C & Swift Metadata Symbol Filtering & GOT Aliasing

• Canonical: #5576 (analyze_swift_types counts Objective-C labels containing _Tt as Swift observations)
• #5580 (get_objc_protocols counts Objective-C method labels containing _TtP as protocols)
• #5607 (get_objc_classes counts imported Objective-C classes twice through GOT aliases)
• #5617 (get_objc_classes omits Hopper class labels from a stripped Objective-C binary)
• Action: Use precise mangling prefix and boundary parsers instead of substring matching for _Tt / _TtP, deduplicate imported classes resolving to identical GOT references, and ensure Hopper provider recovers stripped Objective-C class labels.

Cluster BI: Browser Session Observation Lifecycle & Screenshot Viewport Coverage

• Canonical: #5609 (observe-web-session returns pre-window lifecycle milestones as observed activity)
• #5610 (capture-web-screenshot reports complete coverage for an image cropped below the visual viewport)
• Action: Filter out lifecycle milestones preceding the active observation window in observe-web-session, and reflect viewport truncation in coverage metadata during capture-web-screenshot.

Cluster BJ: Reference-Source Import, Git Case-Sensitivity & Root Errors

• Canonical: #5399 (Reference-source import root errors omit required machine-readable fields)
• #5619 (Reference-source import excludes files that Git leaves unignored with core.ignorecase=false)
• #5620 (Reference-source manifests change after relocation when a file is unreadable)
• Action: Respect Git repository configuration (core.ignorecase) when evaluating .gitignore patterns during import-reference-source, preserve required machine-readable diagnostic fields in root error envelopes, and ensure manifests remain stable across relocations when unreadable files are present.

Cluster BK: Web Capture Comparison Normalization & Event-Family Selection Defaults

• Canonical: #5322 (compare_web_captures: advertised normalization default is rejected for passive before/after comparisons)
• #5414 (compare-web-captures rejects legacy scenarios without event-family selections)
• Action: Align default normalization parameters and event-family selectors between command declarations and schema validators in compare-web-captures.

Cluster BL: Browser Scenario Storage Seed Initialization & Context Origin Handling

• Canonical: #5420 (Browser scenarios silently skip storage seeds with an empty Chromium execution-context origin)
• #5421 (Popup startup misses declared storage seeds while capture reports complete)
• Action: Handle empty execution-context origins during early browser popup startup and ensure declared storage seeds are reliably applied before marking captures complete.

Cluster BM: JavaScript Hoisted Variable Initialization Timing & Premature Resolution

• Canonical: #5302 (Export return shapes give a var read before its initializer the initializer's value)
• #5377 (JavaScript call graph resolves a callback before its var initializer executes)
• Action: Model temporal ordering in JavaScript variable declarations to preserve undefined/uninitialized state when hoisted var identifiers are accessed prior to statement execution.

Cluster BN: macOS Keyed Archive & Asset Catalog Reference Extraction

• Canonical: #5635 (inspect-asset-catalog omits AppKit NSCustomResource image references)
• #5638 (inspect-keyed-archive reports ordinary UID dictionaries as resolved references)
• #5698 (inspect-asset-catalog reports a malformed catalog as an I/O failure and drops its diagnostic)
• Action: Accurately distinguish true resolved UID references from ordinary dictionary keys in keyed archives, and include AppKit NSCustomResource image references during asset catalog inspection.

Cluster BO: Cancellation Error Projection & Diagnostic Erasure

• Canonical: #5364 (Cancelling browser scenario startup becomes unreadable_output and drops partial capture)
• #5388 (Source-map cancellation loses observed codec failures and the caller abort reason)
• #5393 (JavaScript analysis worker replaces an observed failing exit with later cancellation)
• #5641 (Cancellation projection replaces incomplete retained observations with unreadable_output)
• #5714 (Hopper cancellation errors discard the caller abort reason)
• Action: Preserve exact abort reasons, observed failing exit codes, and retained partial observations during service-level cancellation projections instead of replacing them with generic unreadable_output errors.

Cluster BP: Reverse Engineering Service Boundary Failure Classification & Objdump Error Handling

• Canonical: #5401 (inspect-with-objdump loses missing-file and directory failure reasons)
• #5642 (Reverse command error classification can throw or replace non-Error failures)
• #5691 (Objdump launch failures recommend changing the target or fixing read access)
• Action: Validate runtime rejection causes (including non-Error/null/undefined rejections) in ReverseEngineeringService.inspectWithObjdump, replace (cause, value) settlement conventions with explicit Result<Stats, unknown>, and retain specific filesystem error paths and failure codes in diagnostic envelopes.

Cluster BQ: Export Shape Comparison Branch Analysis & Reason Attribution

• Canonical: #4168 (Export shape comparison reports "changed" for a branch that a known constant never takes)
• #5465 (Export shape comparison gives a selected export an unexplained unknown reason)
• Action: Prune unreachable constant branches from export shape AST diffs and ensure fallback nodes provide explicit semantic reasons rather than opaque unknown labels.

Cluster BR: Reconstruction Coverage Readiness, Proof Conflict & Claim Contradiction Resolution

• Canonical: #3354 (Reconstruction coverage reports ready with a missing transitive dependency)
• #3889 (Reconstruction coverage reports ready when a passing proof conflicts with a failed one)
• #3890 (Reconstruction coverage ignores authority routing on surfaces named only by a required claim)
• #3937 (Reconstruction coverage ignores contradictions on required claim surfaces)
• Action: Enforce fail-closed verification in reconstruction coverage ledgers: do not mask failing proofs with concurrent passing proofs for the same digest, route authority consistently across claim surfaces, and reject ready status when required claims contain unresolved contradictions.

Cluster BS: Retained Network Capture API Surface Reconstruction (SAZ & mitmproxy)

• Canonical: #2857 (Derive API surfaces from retained Fiddler SAZ captures)
• #2915 (Derive API surfaces from retained native mitmproxy flows)
• Action: Implement unified traffic-derived schema extraction supporting both Fiddler SAZ sessions and native mitmproxy flow captures to generate OpenAPI/JSON schema surface definitions.

Cluster BT: Backward JavaScript Provenance & Call/Return Property Value Tracking

• Canonical: #5585 (Backward JavaScript provenance loses the value of a directly returned property)
• #5648 (Backward JavaScript provenance loses a property passed directly as a call argument)
• Action: Track returned property literals to call return sites and preserve property bindings passed directly as call arguments in backward semantic provenance analysis (addressed in maintainer PR #5651).

Cluster BU: Firmware Extraction Publication Lifecycle, Timeout & Cleanup Failures

• Canonical: #4558 (firmwareIntegration publication cleanup-retry tests fail deterministically since 2d163c12)
• #5659 (Firmware publication timeout can crash the CLI before returning its timeout result)
• Action: Ensure publication timeouts cleanly destroy active unblob/reader streams and return structured publication timeout results instead of crashing on unhandled Readable errors.

Cluster BV: Console Event Timestamp Normalization & Argument Fidelity

• Canonical: #3377 (Selected console text drops null primitive arguments)
• #5656 (Missing console API timestamps are reported as epoch zero)
• Action: Preserve data fidelity for absent console event metadata: leave missing upstream timestamps as undefined/null rather than synthetic 1970 epoch zeros, and retain null primitive arguments during console line formatting.

Cluster BW: Provider Inline Reply Size Capping & Retained Summary Delivery

• Canonical: #5499 (Query retained Go build metadata without full raw replies)
• #5584 (Compact command replies with retained complete GDB/objdump Evidence)
• Ghidra Function Dossier Retained Summary: PR #5660 (feat(ghidra)!: default analyze_function to a retained summary)
• Frida Session Status Retained Summary: PR #5661 (perf(frida): add retained summaries for session status)
• Action: Standardize provider responses on the established detail: summary | complete delivery pattern with retained Evidence handles to protect calling agents from transport/stdio budget exhaustion.

Cluster BX: Ghidra Per-Function Decompile Deadlines, Analyzer Scoping & Log Suppression

• Canonical: #5340 (Optional per-function Ghidra decompile deadline that fails one request instead of closing the session)
• #5342 (Server-wide REA_GHIDRA_DISABLED_ANALYZERS naming a format-specific analyzer stops other formats from opening)
• #5400 (Avoid repeated Ghidra startup logs in input-error replies)
• Action: Scope disabled analyzer validation per admitted target format rather than process-globally, enforce granular decompile timeouts (addressed in PR #5662) returning degraded dossiers without terminating sessions, and suppress redundant startup logs on early input rejections.

Cluster BY: Classic Console ROM Loading & Architecture Routing (NES, SNES, GameCube, Ghidra Loaders)

• Canonical: #1741 (Add PowerPC (32-bit big-endian) native analysis through Ghidra, with a GameCube/Wii DOL follow-up)
• #2072 (Feature request: NES / iNES container routing (6502 ROMs))
• #4794 (Add basic SNES ROM support via Ghidra raw binary loading (65C816))
• #5657 (Classic console ROM targets on Windows (raw image with an installed Ghidra language, or a named Ghidra loader))
• Action: Support raw binary image loading with user-specified Ghidra language IDs and loaders for classic console architectures (NES 6502, SNES 65C816, GameCube PPC) across Windows and POSIX hosts.

Cluster BZ: Game Engine Binary & Bytecode Reverse Engineering (GameMaker, Godot, Flash)

• Canonical: #3614 (Adobe Flash & SWF Reverse Engineering: ActionScript 2/3 bytecode decompilation...)
• #3631 (Godot reverse engineering: PCK unpacking, scene/resource deserialization...)
• #3632 (GameMaker reverse engineering: data.win, GML bytecode...)
• Action: Build unified asset deserialization and bytecode decompilation pipelines for game engines (Flash ActionScript, Godot GDScript, GameMaker GML).

Cluster CA: MCP Tool Input Schemas & Host-Absolute Path Constraints

• Canonical: #3924 (MCP JavaScript application analysis accepts a relative input_path)
• #5450 (MCP bundle comparison accepts relative paths and reads from the server working directory)
• #5493 (MCP input schemas omit host-absolute local path constraints)
• Action: Enforce host-absolute path validation and schema constraints across all MCP tools to prevent reading or analyzing unintended files relative to the server working directory.

Cluster CB: Mach-O Inspection Parser Fidelity & Identifier Normalization (Whitespace, Escapes, Section Names)

• Canonical: #3384 (Mach-O dependency inspection removes install-name whitespace, PR #4979)
• #3390 (Mach-O export inspection merges names ending in carriage return)
• #5680 (inspect-macho rejects valid section and segment names equal to version)
• Action: Retain exact whitespace, escapes, and section/segment tokens in Mach-O parsers (parseField) rather than aggressively consuming tokens as version identifiers.

---

Cluster CC: ELF Binary Layout Inspection & Section Allocation Bounds

• Canonical: #5715 (inspect-binary-layout fails on a valid ELF containing IKCFG_ST)
• #5716 (inspect-binary-layout classifies an overflowing ELF program-header offset as execution_failure)
• #5717 (inspect-binary-layout rejects a valid relocatable object referencing linux_banner)
• #5718 (inspect-binary-layout allocates the declared BSS and fails on a small valid ELF)
• Action: Bound section and BSS virtual allocations in inspect-binary-layout, handle kernel image strings (IKCFG_ST, linux_banner), and preserve diagnostic details when program header offsets overflow.

3. Recommended Maintainer Actions (@morluto)

1. Close Direct Duplicates: Review and close #4058, #3861, #3633, #4867, #5242, and #5185 as duplicates pointing to their canonical counterparts.
2. Apply Sibling Links: Cross-reference Clusters A through CC to avoid redundant PRs solving individual symptoms.
3. Preserve Reproduction Evidence: All valid minimal reproduction fixtures and traces from newer issues have been cataloged for integration into provider test suites.

Originally created by @matbrgz on GitHub (Oct 16, 2026). Original GitHub issue: https://github.com/morluto/rea/issues/4330 [](https://github.com/morluto/rea) [](https://github.com/morluto/rea) [](https://github.com/morluto/rea) ### Problem Statement & Context With over 750+ active open issues and 1,000+ total lifetime submissions in `morluto/rea`, rapid community reporting and independent testing across environments (macOS, Windows, Linux, Claude Desktop, VS Code, Gemini, MCP clients) have produced multiple duplicate issues, overlapping bug reports, and redundant feature requests. Unconsolidated duplicate issues split maintainer triage bandwidth, fragment reproduction fixtures across threads, and dilute tracking of root fixes. This tracker establishes a structured index of identified duplicates and tightly coupled sibling clusters as of October 2026, keeping the earliest report as the canonical reference (`min(created_at)`) and recommending consolidation actions for maintainers (@morluto). --- ## 1. Direct Duplicates (Actionable: Close Newer in Favor of Canonical) | Status | Newer Duplicate (To Close) | Canonical Older Issue | Root Cause & Description | |---|---|---|---| | [x] Marked | **#4058**: `[Bug] compare_web_screenshots fails in Claude Desktop: $ref params passed as strings` (by @anupamsahoo) | **#3408**: `Array and object tool parameters rejected when REA runs as a local MCP server in Claude Desktop (Windows)` (by @rarekolesar-cyber) | Claude Desktop's MCP client serializes complex arguments (nested objects, `$ref` schemas, arrays) as raw JSON strings, causing Zod validation failure: `expected object, received string`. | | [x] Marked | **#3861**: `[Bug] Overflowing configuration defaults abort JavaScript application analysis` (by @Zhong-fan) | **#3400**: `[Bug] Overflowing JavaScript timer delays abort application analysis` (by @coygeek) | In `analyze_javascript_application`, numeric literals exceeding IEEE 754 float limits (`1e400` vs `1e999`) parse to `Infinity`, which fails JSON serialization and aborts the AST analysis with `unreadable_output`. | | [x] Marked | **#3633**: `[Feature] Godot PCK inspection and extraction as an artifact reader` (by @0xthearchitect) | **#3631**: `[Feature] Godot reverse engineering: PCK unpacking, scene/resource deserialization, GDScript bytecode decompilation, and signal graph reconstruction` (by @matbrgz) | Both request Godot PCK container inspection, embedded executable trailers (`GDPC`), and asset extraction. #3631 was opened first and encompasses the full engine deconstruction pipeline. | | [x] Marked | **#4867**: `[Feature] Add support llama.cpp` (by @maksmanus) | **#3668**: `[Feature] Local LLM runtime reverse engineering: llama.cpp, Ollama, MLX, ONNX Runtime, ExecuTorch and OpenVINO inference reconstruction` (by @matbrgz) | Both propose first-class integration and execution support for local LLM inference models and runtimes via `llama.cpp`. #3668 opened the parent canonical specification. | | [x] Marked | **#5242**: `[Bug] Rizin recent-output retains up to 3x its UTF-8 byte budget for CJK frames` (by @Faisal-Fayaz) | **#5091**: `[Bug] Rizin recent output retains three times its UTF-8 byte budget for CJK frames` (by @coygeek) | Identical defect: recent output truncation in Rizin counts code-point length rather than UTF-8 byte budget, causing CJK multi-byte frames (e.g. 3 bytes per character) to overrun the memory budget by 3x. | | [x] Marked | **#5185**: `Feature Request: Support Analysis of MQL5 .ex5 Expert Advisors Loaded by terminal64.exe` (by @hadiabounader) | **#3569**: `Feature Request: Support for MQL5 (.ex5) bytecode static analysis or provider integration` (by @c2461630) | Both propose static analysis and runtime observation for compiled MetaTrader MQL5 (`.ex5`) Expert Advisor artifacts. #3569 is the earlier canonical proposal. | --- ### 1.1 Concurrent Duplicate Pull Requests (Targeting Same Issue) | Newer PR | Earlier Canonical PR | Target Issue / Cluster | Author (Newer / Earlier) | Recommendation | |---|---|---|---|---| | **#5578**: `fix(cli): reject negative and fractional token window values` | **#5544**: `fix(cli): reject invalid token-window bounds` | #5532 (Cluster AQ) | @Som0111 / @chqcjq | Coordinate review; close #5578 in favor of earlier PR #5544. | | **#5644**: `fix(observation): keep incomplete cancellation observations` | **#5643**: `fix(analysis): preserve cancellation with partial observations` | #5641 (Cluster BO) | @morluto / @charan-143 | Coordinate review between maintainer PR #5644 and community PR #5643. | | **#5650**: `fix(apple): read LC_LAZY_LOAD_DYLIB_INFO dependency payloads` | **#5582**: `fix(apple): trace LC_LAZY_LOAD_DYLIB_INFO lazy dylib dependencies` | #5551, #5649 (Cluster BC) | @morluto / @kaoru0822-kitauji | Coordinate review between maintainer PR #5650 and community PR #5582. | --- ## 2. High-Overlap Sibling Clusters (Same Root Defect Across Subsystems) These clusters reflect the same architectural defect manifesting across different providers, clients, or analysis modes. Rather than treating them as isolated bugs, they should be resolved via shared subsystem fixes. ### Cluster A: MCP Client Schema Complexity & Registration (Claude Desktop, VS Code, Gemini) - **Canonical:** #3408 (Array and object tool parameters rejected in Claude Desktop) - #4058 (compare_web_screenshots fails: $ref params passed as strings) - #4081 (compare_web_captures tool fails to register in Claude Desktop Windows - problem with that connector) - #2813 (inputSchema nesting depth exceeds 10 on 24 tools - max 19: compare_web_captures) - #4736 (VS Code rejects REA tool schema: mcp_rea_build_call_path) - #5201 (Gemini-backed clients still reject the whole tool catalog: advertised empty-string const in trace_application_feature.seed.value serializes as an empty enum member) - **Action:** Flatten complex MCP tool schemas, emit explicit `items` on array/tuple nodes for strict validators (VS Code), map empty-string consts to plain `type: "string"`, and implement transparent pre-parsing of stringified JSON objects when requests originate from Claude Desktop. ### Cluster B: JVM Provider Heap Exhaustion & Misleading `rea doctor` Guidance - **Canonical:** #3517 (JADX "Java heap space" load failure points to rea doctor, which reports healthy) - #4241 (Ghidra "Java heap space" during import is reported as execution_failure ("run rea doctor"), not a memory resource constraint) - #4682 (Ghidra: an OutOfMemoryError is not recognized once the session's 8 MiB output budget is used up) - **Action:** Normalize `OutOfMemoryError` / `Java heap space` across all JVM-backed providers (JADX, Ghidra) into a typed `resource_constraint` error, and inspect chunks for OOM markers before applying head-only diagnostic budget limits. ### Cluster C: Post-Cancellation Success Classification During Cleanup - #4227 (Audit lifecycle contracts across REA tools: readiness, cancellation, ownership, cleanup, and recovery) - #3977 (DOS load-image verification reports success after cancellation during snapshot cleanup) - #4009 (Native call observation returns successful Evidence after cancellation during finalization) - #4251 (ADB screen capture publishes after cancellation before output commit) - #4254 (WASM artifact inspection returns success after cancellation during final cleanup) - #4255 (Electron page inspection returns success after cancellation during detach) - #4256 (Browser scenario returns success after cancellation during final session close) - #4483 (Artifact readback can replace IO failures and report success after cancellation) - #4735 (Signature inspection returns success after cancellation during final cleanup) - **Action:** Consolidate provider-level post-cleanup signal checks into the canonical provider-evidence finalization helper defined in #4227. ### Cluster D: Reconstruction Coverage Boundary Evaluator Anomalies - #3354 (Reconstruction coverage reports ready with a missing transitive dependency) - #3889 (Reconstruction coverage reports ready when a passing proof conflicts with a failed one) - **Canonical:** #3890 (Reconstruction coverage ignores authority routing on surfaces named only by a required claim) - #3937 (Reconstruction coverage ignores contradictions on required claim surfaces) - **Action:** Ensure the boundary evaluator in `evaluate-reconstruction-coverage` verifies authority routing, transitively required dependencies, and active proof contradictions uniformly before reporting `ready`. ### Cluster E: Codex Per-Tool Approval Settings Conflicts & Loss - **Canonical:** #3862 (rea doctor marks a Codex registration invalid when it has per-tool approval settings) - #3863 (rea setup deletes Codex per-tool approval settings when refreshing the registration) - **Action:** Retain `[mcp_servers.rea.tools.*]` table configurations across `rea setup` registration flushes and update `rea doctor` schema validators to accept valid per-tool approval blocks. ### Cluster F: Electron Active Hook Host Filesystem Mutation Bypass - **Canonical:** #3452 (capture_electron_scenario does not block app.moveToApplicationsFolder) - #3474 (capture_electron_scenario active hook does not block or record shell.trashItem) - #4393 (capture_electron_scenario active hook does not block or record shell.showItemInFolder and shell.writeShortcutLink) - **Action:** Patch `scripts/electron-active-hook-boundaries.cjs` to intercept, block, and record all native host-mutating IPC/Electron APIs (`app.moveToApplicationsFolder`, `shell.trashItem`, `shell.showItemInFolder`, `shell.writeShortcutLink`) under active observation. ### Cluster G: Apple Universal FAT Mach-O `arm64e.x1` ABI-Variant Slice Incompatibility - **Canonical:** #3072 (Hopper provider on macOS: FAT Mach-O slice selection loads arm64e.x1, collapsing analysis of system binaries) - #4280 (inspect_artifact: stock macOS universal binaries report integrity_mismatch (arm64e.x1 slice defeats lipoNameMatches; integrity_policy inert on this path)) - **Action:** Update universal binary slice extraction (`lipoNameMatches` / `MachOSliceSelection`) to recognize Apple's `arm64e.x1` slice (cpusubtype 12) and prefer standard `arm64e` (cpusubtype 2) or gracefully handle ABI-variant entry points. ### Cluster H: Firmware Tooling Environment, Dependencies & Health Checks - #3756 (extract_firmware reports coverage "complete" when nothing was extracted) - #3757 (Firmware tools need procps ps, which their requirements do not list) - #3758 (rea doctor has no checks for the firmware integrations) - #4475 (Firmware read-handle close failures discard outcomes and lose cleanup ownership) - **Action:** Unify firmware tool requirements in `rea doctor`, require `procps ps`, and fail closed when unpack utilities yield 0 extracted artifacts. ### Cluster I: Web Inspector Silent Drop of Malformed CDP Inventories & Workers - #3376 (Missing or malformed accessibility inventories are reported as complete empty trees) - #3378 (Malformed worker inventories are reported as empty) - #4425 (inspect-web-page: requests from dedicated workers are not recorded (worker listed as attached, 0 requests)) - **Action:** Replace empty fallback representations in `inspect-web-page` with explicit omission / malformed markers when CDP queries return unexpected payloads, and multiplex dedicated worker sessions with `Target.setAutoAttach`. ### Cluster J: Claude Setup & Configuration Discovery Edge Cases - #4262 (Empty CLAUDE_CONFIG_DIR makes setup register Claude MCP in the working directory) - #4278 (setup can't register Claude Desktop when the MSIX build has no package-private config) - #4432 (Claude Desktop resolution misses AnthropicPBC.Claude_* and -3p builds, so setup writes a config the app never reads) - **Action:** Validate configuration directory non-emptiness before resolving relative paths in `rea setup`, and add MSIX package-private virtual store search paths (`%LOCALAPPDATA%\Packages\AnthropicPBC.Claude_*\LocalCache\Roaming\Claude`) for Windows Claude Desktop. ### Cluster K: XML Keyed-Archive Deserialization & CDATA Handling / Plist Decoder - **Canonical:** #3371 (CDATA in XML keyed-archive keys truncates root and field names) - #3373 (Keyed archive inspection returns hexadecimal XML integers as zero) - #4042 (XML plist real values lose CDATA content during keyed-archive inspection) - #4714 (Keyed archive inspection reports recovered malformed XML as observed values) - #4849 (inspect_plist drops plutil's decode diagnostic on macOS and reports an empty parenthesis) - #4852 (XML plist decoder reports Apple-rejected integer, real, date and boolean text as observed values) - #5701 (inspect-plist rejects a valid binary plist containing a control character and data) - #5702 (inspect-plist rewrites Unicode separators as LF when XML fallback is used) - #5703 (inspect-plist silently drops fractional seconds from binary plist dates) - #5705 (inspect-plist still loses negative-zero sign through XML fallback after #4839) - **Action:** Harden XML/plist parser in `inspect-keyed-archive` and `inspect_plist` to preserve CDATA blocks uniformly, capture `plutil` stderr diagnostics, and align with Apple Foundation decoder constraints. ### Cluster L: CommonJS & Reference-Source Import Path Resolution - **Canonical:** #3895 (Reference-source import resolves require("./dep") to dep/index.ts instead of dep.js) - #3982 (Reference-source import reports dependencies after CommonJS require is replaced) - #4189 (Trailing-slash CommonJS require ignores package main in reference import) - **Action:** Standardize CommonJS module path normalization and AST binding resolution in `import-reference-source` to respect exact Node.js resolution order (`package.json#main`, directory index fallback, and local shadowing). ### Cluster M: Native Addon Binding Extraction from JS AST - **Canonical:** #3884 (Local require method creates a resolved native-addon binding) - #3885 (Optional require call loses its native-addon binding record) - #4490 (Destructuring Electron from a Webpack module-table external drops BrowserWindow and IPC) - **Action:** Disambiguate global `require` from member/method calls (`obj.require()`), preserve bindings detected in conditional or optional require branches, and recognize Webpack external module destructuring in `analyze_javascript_application`. ### Cluster N: Provider CLI Cleanup Diagnostics Preservation - **Canonical:** #3935 (Provider CLI cleanup failures discard completed results and primary diagnostics) - #4240 (Direct CLI cleanup composition drops primary cleanup resource diagnostics) - #4458 (Stable artifact reads lose descriptor ownership and operation outcomes when close rejects) - **Action:** Ensure pipeline error propagation in CLI composition chains retains primary result payloads and diagnostic resource context even if deferred resource close triggers warnings. ### Cluster O: Universal Mach-O Direct Slice Selection Across Providers - **Canonical Request:** #3282 (Ghidra provider: support universal (FAT) Mach-O by importing the selected slice) - #4102 (Let inspect_go_binary / inspect_rust_binary select a slice of a universal Mach-O without lipo) - **Action:** Provide a shared slice selection parameter (`--slice` / `macho_slice`) across all binary inspection tools and providers without requiring invocation of external `lipo`. ### Cluster P: Android Method Boundary Analysis & Body Extraction - **Canonical:** #3443 (inspect_android_method reports an inlined Java method as "native/abstract" with no body) - #3488 (inspect_android_method returns neighbouring members as the "complete" body of a native method) - **Action:** Fix JADX-backed method AST slicing in `inspect_android_method` so that inlined methods retain their de-inlined representation and native methods do not erroneously grab sibling instruction spans. ### Cluster Q: Unsupported Platform Hopper Installation Remediation - **Canonical Defect:** #3419 (Setup offers automated Hopper installation on Linux arm64, but every pinned Hopper package is x86_64) - #3944 (Windows setup recovery recommends an unsupported Hopper installation) - **Action:** Make `rea setup` platform gates aware of Hopper's architecture limitations (macOS and Linux x86_64 only) and prevent remediation prompts from advising `--install-hopper` on unsupported targets (Windows, Linux arm64). ### Cluster R: Hermes Client Setup & MCP Configuration Anchors - **Canonical:** #3320 (Hermes setup fails to register REA through an aliased MCP server table) - #3325 (Hermes setup cannot refresh a REA anchor referenced by another server) - #3939 (Nested HERMES_HOME roots use another root's active profile during setup) - #4841 (Hermes named-user home overrides plan registration in a different relative directory) - **Action:** Support YAML anchors and aliased server tables in Hermes configuration readers/writers without destroying cross-server references on write, and isolate nested `HERMES_HOME` discovery. ### Cluster S: JavaScript Timer Delay & Window Duration 32-bit Integer Overflow - **Canonical:** #3400 (Overflowing JavaScript timer delays abort application analysis) - #3861 (Overflowing configuration defaults abort JavaScript application analysis) - #4392 (observe_web_session ends a window above 2^31-1 ms almost immediately but reports it as elapsed) - **Action:** Validate and cap duration parameters in schema (`observation_ms`, timers) to `2^31 - 1` ms (2,147,483,647 ms) to avoid V8 `setTimeout` truncation down to 1 ms, and handle `Infinity` literals gracefully during AST analysis. ### Cluster T: WASM Glue JavaScript Inspection & Parsing - **Canonical:** #4001 (WASM glue inspection omits string literals in JavaScript directive prologues) - #4474 (WASM glue still uses unnamed TypeScript parser for valid JavaScript) - **Action:** Disambiguate JavaScript from TypeScript parser modes in `inspect_wasm_artifact` and retain directive prologues and string literals across WASM runtime glue analysis. ### Cluster U: PE Resource Parsing, Section Mapping & Lifecycle - **Canonical:** #4455 (PE resource mapping treats zero-extent sections as overlapping byte ranges) - #4457 (PE resource provider closes while admitted parsing is still active) - **Action:** Harden section boundary arithmetic in `src/native/pe/PeResourcesProvider.ts` to ignore zero-extent sections and keep the resource provider context active until all admitted parsing promises settle. ### Cluster V: Reconstruction Obligation Ledgers & Ledger Integrity - **Canonical:** #3370 (Reconstruction obligation ledgers lose semantic unknowns and report complete coverage) - #4444 (build_reconstruction_obligation_ledger reports a missing review record or duplicate record IDs as unreadable_output ("run rea doctor")) - **Action:** Project typed ledger validation diagnostics in `build_reconstruction_obligation_ledger` instead of generic `unreadable_output`, and preserve semantic unknowns during ledger compilation. ### Cluster W: Cutter / Named-Pipe Blocking & Probing - **Canonical:** #3887 (Named-pipe firmware input blocks cancellation and the operation deadline) - #3946 (Cutter session discovery keeps probing after MCP cancellation) - #4471 (Cutter discovery can block indefinitely opening a named-pipe descriptor) - **Action:** Open POSIX FIFO and named pipes with non-blocking flags (`O_NONBLOCK`) during session discovery and integrate cooperative cancellation checks in Cutter/firmware boundaries. ### Cluster X: Application Target Path Symlink Resolution & Caller-Selected Path Loss - **Canonical:** #5103 (Electron scenario CLI rejects an existing application path after symlink/..) - #5258 (JavaScript application Evidence loses the caller-selected path after symlink resolution) - #5479 (inspect-artifact loses the caller-selected symlink path from complete Evidence) - #5492 (inspect-plist --relative-path reads the wrong file when .. follows a directory symlink) - #5521 (Artifact commands describe a stable symlink loop as a target change) - #5623 (JavaScript application analysis drops the selected path and host resolution reason) - **Action:** Route CLI input paths through `absoluteCallerPath` preserving `..` for POSIX symlink resolution, retain caller-selected entrypoints in produced Evidence, report host resolution failure reasons, and distinguish stable symlink loops (ELOOP) from concurrent target mutations. ### Cluster Y: Windows Native Handle Authority, Private DACL & AppContainer Admission Failures - **Canonical:** #289 (Use handle-based reparse-safe filesystem authority on Windows) - #1701 (Windows native authority self-test fails on real Windows: "Delete owned object by handle failed" (Win32 5), and leaves probe directories behind) - #5225 ([Windows x64] rea inspect --provider ghidra fails snapshot admission with Win32 5 (EACCES) in an AppContainer process) - #5237 ([Windows native] Private DACL contains unexpected trustees (Win32 5) blocks Android inspection before JADX) - #4505 (Windows native handle finalization discards failed close ownership) - **Action:** Generalize `Security()` in `native/windows/src/filesystem.cc` to admit sandboxed AppContainer tokens and non-standard local trustees without failing closed on harmless ambient DACL entries, and clean probe artifacts. ### Cluster Z: Kuna Provider Lifecycle, Cancellation & Workspace Ownership - **Canonical Discovery:** #4698 (Kuna session installation acquisition ignores cancellation) - #4700 (Kuna shared query waits discard caller cancellation reasons) - #4702 (Kuna command cleanup retry leaves original ownership unresolved) - #4704 (Kuna workspace rollback hides retained cleanup) - #5105 (Setup advertises Kuna for deep analysis after its cache check fails) - #5106 (Cancelling doctor does not interrupt its Kuna version probe) - **Action:** Wire cooperative cancellation tokens through Kuna provider session acquisition, doctor probes, and enforce idempotent workspace rollback and cleanup retry accounting. ### Cluster AA: HTTP & Proxy Capture API Surface Reconstruction (Fiddler SAZ & mitmproxy) - **Canonical:** #2857 (Derive API surfaces from retained Fiddler SAZ captures) - #2915 (Derive API surfaces from retained native mitmproxy flows) - **Action:** Implement a unified network session ingester in `src/network/` capable of parsing session archives (.saz, mitmproxy flows) to recover endpoints, headers, schema definitions, and RPC interfaces. ### Cluster AB: Hopper Linux Virtual X11 Display & Stale Lock Cleanup Failures - **Canonical:** #4226 (Hopper pre-handshake startup failure causes repeated cleanup errors while session reports idle) - #4921 (Hopper (Linux): session teardown leaves a stale /tmp/.X<n>-lock; accumulated locks can make startup fail with address_collision) - #5189 (fix(hopper): preserve an explicit display number zero in the X11 helper) - **Action:** Ensure Linux Hopper teardown verifies and unlinks display lock files (`/tmp/.X<n>-lock`) matching the allocated Xvfb PID, and prune stale locks on startup. ### Cluster AC: Linux Process Exit Races, Descendant Reparenting & Token Mismatches - **Canonical:** #4322 (Linux exit race reports an exited owned process as a token mismatch) - #5206 (Process exit refresh can discard reparented descendants and report cleanup complete) - **Action:** Synchronize process polling in `src/process/ProcessOwnership.ts` against `/proc` updates, verifying dead parent exit states before reporting token mismatches and capturing reparented child PID groups. ### Cluster AD: Linux Electron Owned Lineage & X11 Authorization - **Canonical:** #3414 (Owned Electron capture drops the selected X11 authorization path) - #4282 (Linux Electron capture cannot verify owned lineage: Chromium processes do not expose REA_PROCESS_RUN_ID in /proc/<pid>/environ) - **Action:** Provide alternative IPC or command-line token verification for Chromium-based runtimes that sanitize environment variables on Linux, and preserve user-provided `XAUTHORITY` paths. ### Cluster AE: Partial Evidence Omission of Known Analysis Profile on Cancellation / Failure - **Canonical:** #3992 (Failed IDA decompilation drops the known profile from partial Evidence) - #5109 (Late-cancelled document selection drops the known analysis profile from Evidence) - **Action:** Ensure the Evidence builder retains the caller-selected or resolved `analysis_profile` metadata field even when operations abort mid-stream or encounter late cancellation. ### Cluster AF: .NET Managed Member Metadata & CIL Instruction Slicing - **Canonical:** #3877 (Wrong-kind managed member signatures are reported decoded with complete coverage) - #4370 (A method ending in volatile. receives a complete decoded-CIL fingerprint) - #5102 (Managed member inspection labels truncated compressed parameter counts as reserved) - #5146 (inspect-managed-members returns unavailable on a 2042-type .NET app and offers no way to list its types) - #5147 (inspect-managed-members anchors omit operand-free instructions such as ldc.i4.N) - **Action:** Fix CIL disassembler slicing in `inspect_managed_members` to preserve operand-free instructions (`ldc.i4.N`, `dup`, `pop`), avoid truncated parameter counts, and correctly handle type listing across large assemblies. ### Cluster AG: GDB Persistent Debug Session & CLI Command Boundary - **Canonical:** #5098 (debug-with-gdb rejects built-in p, s and d aliases before starting GDB) - #5099 (Inspecting inferior-tty permanently revokes persistent GDB session TTY verification) - **Action:** Exempt read-only GDB introspection commands from inferior output dirty checks in `commandMayChangeInferiorOutput` and allow standard single-letter GDB aliases (`p`, `s`, `c`, `d`). ### Cluster AH: Android ADB Automation & Activity Execution Boundaries - **Canonical:** #3369 (ADB push reports checksum capture overflow as device unavailability) - #5093 (start-adb-activity rejects valid empty-string intent extras before provider admission) - #5190 (fix(scripts): ADB verifier leaves its pushed probe file on the device) - #5689 (inspect-adb-client hides execution failures behind a version diagnostic) - #5690 (Apktool version-output overflow is reported as an unusable launcher) - **Action:** Permit empty-string intent extra string parameters in `start_adb_activity` schema, handle large push checksum buffers, and unlink temporary verifier probe artifacts. ### Cluster AI: JavaScript Application Source Map Handling & Coverage Anomalies - **Canonical:** #5466 (JavaScript application analysis misreports external source-map sections as version mismatches) - #5469 (JavaScript application analysis reports complete coverage for source maps missing mappings) - **Action:** Harden index-map parser in `src/javascript/` to handle external URL sections without misclassifying them as version discrepancies, and emit partial coverage warnings when source maps lack `mappings`. ### Cluster AJ: Misleading Recovery Remediation on Capacity & Budget Refusals - **Canonical:** #5504 (Rust compiler-hash capacity refusals incorrectly tell callers to retry) - #5505 (Rust report-budget refusals recommend recovering Evidence that was never produced) - #5506 (WASM comparison budget refusals incorrectly tell callers to retry) - #5456 (SQLite reply-budget refusals recommend recovering Evidence that was never produced) - #5459 (Analysis-view projection budget refusals recommend increasing worker memory) - #5460 (IL2CPP report-budget refusals recommend worker and host memory changes) - #5537 (Electron fuse limit refusals return misleading retry and recovery advice) - #5556 (Fixed inspection-budget refusals recommend worker and host memory changes) - #5628 (Typed WASM interface decoding tells callers to retry a fixed representation budget) - #5630 (IL2CPP reader occupancy is reported as a non-retryable memory failure) - #5631 (Fixed capture budgets recommend changing worker or host memory) - #5632 (Flutter file budgets and Go report refusals give recovery that cannot admit the same input) - **Action:** Harmonize `resource_constraint` and `capacity_refusal` diagnostics (addressed in maintainer PR #5633) to name fixed allowances explicitly, eliminate false retry advice, and avoid recommending memory tweaks for fixed reader bounds. ### Cluster AK: Managed/Native P/Invoke Boundary Verification Anomalies - **Canonical:** #3351 (Managed/native verification contradicts Windows module paths on macOS) - #5467 (Managed/native verification treats an empty normalized module identity as known) - #5468 (Managed/native verification rejects inspection Evidence with an empty P/Invoke import name) - **Action:** Correct module normalization in `src/verification/` to avoid accepting empty module names as valid known identities and support valid empty import names in P/Invoke inspection contracts. ### Cluster AL: Environment CLI Command Error Projection & Remediation - **Canonical:** #5455 (environment-serve suggests changing ports for host lookup failures) - #5457 (environment-export reports an identity change when its destination is an existing file) - #5458 (environment-export reports read access denied for an unwritable output directory) - #5513 (Desktop inspection classifies invalid and unreadable targets as execution failures) - #5515 (decode_signal_recording: a misspelled decoder or annotation class returns execution_failure with "Run rea doctor", which has no sigrok check) - **Action:** Differentiate write/create errors from read denials in `environment-export`, classify target input errors accurately rather than projecting generic `execution_failure`, and decouple input/network errors from unrelated `rea doctor` or port remediation hints. ### Cluster AM: Trace Feature Contract & Crash Diagnostic Inconsistencies - **Canonical:** #5449 (trace-application-feature reports changed Evidence as a retryable input error) - #5474 (trace_crash advertises its provider document selector as Hopper-specific) - #5503 (trace_feature drops Hopper string encoding and termination qualifications) - #5507 (trace_feature promises an operation count absent from successful results) - **Action:** Align schema guarantees in `trace_feature` with returned payloads, preserve string encoding qualifications across provider boundaries, and generalize crash trace provider selection. ### Cluster AN: Ghidra Header-Driven Architecture Lane Admission (ET_DYN, MIPS, RISC-V, SPARC) - **Canonical:** #2338 (Ghidra MIPS: admit plain MIPS32 PIC shared libraries (ET_DYN) at their link base) - #2734 (Ghidra MIPS lane rejects mips1/mips32 — the dominant ISA mix in embedded firmware) - #4487 (Ghidra RISC-V lane: admit position-independent executables (ET_DYN); distro riscv64 binaries are almost all PIE) - #4842 (Admit SPARC V9 ELF objects (EM_SPARCV9, 43) through the header-driven Ghidra lane) - #5243 (Windows Ghidra P0: no path for ELF/arm64 targets (e.g. Android libapp.so)) - **Action:** Unify ELF `ET_DYN` position-independent binary admission across all architecture lanes (MIPS, RISC-V, SPARC, arm64) in the header-driven Ghidra loader. ### Cluster AO: Application Version Diffing & Endpoint Comparison Anomalies - **Canonical:** #4681 (Application version comparison treats unresolved relationship targets as aligned) - #5195 (compare-application-versions reports unchanged module exports as removed and added) - #5406 (compare-application-versions pairs unresolved endpoints by equal expression text) - #5534 (compare-application-versions reports unselected source scopes as added or removed) - #5535 (compare_functions reports false call and reference changes for Hopper's generated EntryPoint label) - **Action:** Exclude unselected parse-scope placeholders and synthetic provider labels (`EntryPoint`) from diff sets, and match module exports and endpoints by content digest rather than lexical text equivalence. ### Cluster AP: Web Page Inspection HTTP Header Parsing (Link, COOP, COEP) - **Canonical:** #4677 (Page inspection loses COOP and COEP policy tokens with valid report-to parameters) - #4679 (Page inspection drops repeated Link fields from Document responses) - **Action:** Parse newline-delimited headers in CDP response objects and preserve structured security tokens (`report-to`, COOP, COEP, Link) during web page inspection. ### Cluster AQ: CLI Output Filtering, Token Windowing & Formatting - **Canonical:** #5110 (Exhausted CLI failure token windows display a reversed range) - #5448 (CLI --filter-output removes failure diagnostics and prints an empty object) - #5530 (CLI token windows duplicate digest characters and corrupt emoji) - #5532 (Negative and fractional token-window values produce inconsistent pages) - #5531 (Invalid output-flag values emit TOON despite selecting JSON or JSONL) - #5525 (CLI --format md replaces nested inventory facts with [object Object]) - **Action:** Ensure `--filter-output` preserves typed error envelopes, validate token window parameters as non-negative integers with codepoint/byte-boundary slicing, preserve JSON/JSONL format stability on argument errors, and properly serialize nested objects in markdown output. ### Cluster AR: EVM Artifact & Interface Lifecycle, Cleanup & Cancellation - **Canonical:** #4683 (EVM contract interface extraction produces empty ABI for multiple valid contracts) - #4686 (evm_disassemble can leak temporary output file if worker throws before finalization) - #5295 (Cancelling evm_inspect_contract leaves abandoned worker child process on Linux) - #5332 (Unhandled rejections during EVM contract artifact load bypass structured error envelope) - **Action:** Ensure EVM inspection and disassembly workers handle cleanup in finally blocks, register cancellation handlers that terminate worker child processes, and preserve the structured error envelope. ### Cluster AS: SQLite Provider Cleanup, Worker Failure & Diagnostic Attribution - **Canonical:** #4184 (SQLite provider leaves lock file on aborted schema inspection) - #5284 (SQLite inspect worker crash reports success when query had partial result) - #5286 (SQLite schema extraction reports cancelled analysis as successful partial result) - #5294 (Uncaught exception in SQLite thread pool suppresses error diagnosis) - #5520 (SQLite malformed-database errors omit the selected file path) - #5719 (SQLite generated-column evaluation failures blame the database path) - **Action:** Ensure SQLite inspection workers reliably clean lock files, distinguish cancellation/crashes from partial success, surface thread pool diagnostics, and include target path context in malformed database errors. ### Cluster AT: Export Pipeline Path Length Bounds & Staging Residue - **Canonical:** #5480 (Evidence export fails for valid long output paths and can leave empty staging directories) - #5502 (Cancelled JavaScript analysis can still leave the macOS helper's temporary folder after #1194) - #5522 (environment-export reports a later nested-file path-length failure as invalid input) - **Action:** Handle operating system pathname limits in export bundle operations (`evidence-export`, `environment-export`), clean up `.rea-staging-*` and helper temporary directories on error or cancellation, and attribute nested path length errors to the exact path rather than misclassifying as invalid input. ### Cluster AU: Hopper Provider Lifecycle, Authenticated Build Admission & Bookmark Mutation - **Canonical:** #5245 (6.7.0 flags previously working extracted Hopper demo as unsupported_hopper_build) - #5454 (Scoped Hopper doctor reports healthy when configuration blocks native analysis) - #5475 (Clearing a Hopper bookmark name reports success but retains the previous name) - **Action:** Support verified extracted Hopper demo installations in doctor/setup, align scoped doctor checks with configuration prerequisites, and properly persist bookmark name deletions in `set_bookmark`. ### Cluster AV: Headless CLI Automation, Structured Input & Output Streaming Suite - **Canonical:** #5481 (Add shell completion for the REA CLI) - #5482 (Add CSV and TSV output for tabular analysis views) - #5483 (Provide machine-readable version and runtime information) - #5484 (Add optional command timing summaries to CLI runs) - #5485 (Generate a redacted diagnostic report for support requests) - #5486 (Accept stdin for structured CLI request documents) - #5487 (Add JSON Lines output for large row-oriented results) - #5488 (Add a validation-only command for browser scenario files) - #5489 (Add a dry-run plan for artifact extraction) - #5490 (Add manifest-driven batch mode for independent offline artifact inspections) - **Action:** Implement a unified headless CLI automation suite with structured streaming (CSV/TSV, JSON Lines), declarative manifest batch processing, and offline validation. ### Cluster AW: CLI Shell Completion Generation & Option Routing - **Canonical:** #5481 (Add shell completion for the REA CLI) - #5526 (Bash completion omits documented global options) - #5527 (Bash completion fails to register in macOS system Bash) - #5528 (`\`rea mcp\` shell completion suggests unrelated root commands`) - **Action:** Emit Bash 3.2-compatible completion scripts, include documented global flags (`--help`, `--format`, `--token-limit`), and constrain sub-command completion context for nested command paths. ### Cluster AX: Compiled Interface Builder / NIB Decoding & Object Limit Anomalies - **Canonical:** #5540 (decode-interface-builder misattributes object-limit omissions to the connection budget) - #5541 (decode-interface-builder reverses boolean values in compiled AppKit nibs) - #5590 (decode-interface-builder reports complete connection coverage while omitting bindings) - #5692 (decode-interface-builder labels an archived outlet-collection destination missing or external) - #5693 (Compiled AppKit nib hierarchies omit top-level custom objects while reporting complete coverage) - #5695 (Compiled storyboard segues lack connections while connection coverage reports complete) - #5720 (decode-interface-builder reports keyed AppKit action connectors as UI controls) - #5721 (Keyed nib decoding reports placeholder classes instead of authored classes) - **Action:** Attribute omitted NIB elements accurately to object limits rather than connection budgets, fix boolean deserialization in compiled AppKit nib archives, and adjust coverage status when connection bindings are omitted. ### Cluster AY: Code Signature Inspection Metadata, Temporary Filesystem State & Limitation Tracking - **Canonical:** #4293 (Universal Mach-O signatures report one slice as the whole file) - #5423 (Signature inspection omits its temporary filesystem-write effect from discovery) - #5538 (inspect-signature lists completed signing captures as an outstanding limitation) - #5697 (inspect-signature still fails on mixed ad hoc signed universal Mach-O after #701) - **Action:** Report all signed slices in universal Mach-O binaries, declare temporary filesystem effects during signature extraction, and clear outstanding limitations once signing requirements are fully parsed. ### Cluster AZ: Native Dispatch Metadata Inspection & Provider Fallbacks - **Canonical:** #4368 (Empty Swift conformance names escape entry recovery and invalidate dispatch metadata) - #5424 (Dispatch-metadata symbol fallback turns Ghidra pointer/string labels into fake Objective-C classes and misses every class the binary defines) - #5529 (Native dispatch metadata --snapshot rejects a successful decode without a deep provider) - #5543 (Dispatch metadata marks method lists decoded when the record budget omits their methods) - #5681 (Swift vtable coverage mixes examined type entries with decoded slots) - #5682 (Swift dispatch metadata loses enclosing type and module names) - #5683 (Swift dispatch metadata labels imported descriptors as unsupported kinds) - #5685 (Swift class vtable inspection reports null implementations as decoded at 0x0) - #5706 (Objective-C class coverage counts one examined class as two decoded records) - #5707 (Protocol properties are silently omitted from dispatch metadata) - **Action:** Validate Swift conformance names and nested type contexts, ensure correct vtable slot decode metrics and null displacement handling, allow `--snapshot` verification without deep providers, and mark truncated method lists incomplete. ### Cluster BA: Swift Type Classification & Demangling Anomalies - **Canonical:** #4296 (analyze_swift_types puts constrained-extension members under structs) - #5553 (analyze_swift_types misclassifies nested Unicode types and hides class results) - #5552 (demangle-swift reports an omitted record as demangled and fails mixed batches) - **Action:** Categorize Swift members by their true conforming type rather than enclosing structs, support nested Unicode type paths, and prevent empty record omission from poisoning mixed batch demangling results. ### Cluster BB: Apple DMG Artifact Inspection, Mount Handling & Integrity Policy - **Canonical:** #5546 (inspect-artifact discards root observations when a DMG is already mounted) - #5547 (DMG inspection guidance directs callers to unsupported extraction) - #5549 (inspect-artifact recommends an ineffective integrity-policy retry for checksum-invalid DMGs) - #5687 (inspect-artifact rejects mountable raw UDRW DMGs as unsupported binaries) - **Action:** Support inspection of already-mounted DMG volumes, recognize raw UDRW disk images, correct tool discovery guidance regarding DMG extraction capabilities, and validate checksums before suggesting integrity policy overrides. ### Cluster BC: Mach-O Dylib Resolution & Dependency Tracing - **Canonical:** #5362 (Dylib path expansion rejects line terminators in dependency names and rpaths) - #5551 (trace-dylib-resolution omits lazy dylib dependencies while reporting complete coverage) - #5637 (trace-dylib-resolution treats absolute paths inside the analyzed bundle as outside-target) - #5649 (inspect-macho treats dependencies as exhaustive when LC_LAZY_LOAD_DYLIB_INFO is present) - #5696 (trace-dylib-resolution skips a loadable platform-less dylib and its required dependencies) - **Action:** Preserve sanitized dependency names and rpaths containing valid line terminators, include `LC_LAZY_LOAD_DYLIB` and `LC_LAZY_LOAD_DYLIB_INFO` entries in dependency tracing, correctly classify in-bundle absolute paths, and avoid marking dependencies exhaustive when lazy dylibs are present (addressed in PRs #5582 and #5650). ### Cluster BD: Kuna Provider Cache Discovery & Readiness Validation - **Canonical:** #5105 (Setup advertises Kuna for deep analysis after its cache check fails) - #4624 (CLI guide excludes Kuna from supported doctor providers on main) - #5554 (Doctor reports Kuna ready when its cache root is a dangling symlink) - #5568 (Kuna doctor cancellation test times out during preceding provider startup) - #5611 (Kuna readiness can pair a reported version with different executable bytes) - **Action:** Harmonize Kuna documentation in CLI guides, prevent setup advertising Kuna when cache verification fails, check filesystem existence beyond symlink resolution, and ensure provider executable hashes accurately reflect active binaries. ### Cluster BE: Universal (FAT) Mach-O Header Validation & Slice Architecture Admission - **Canonical:** #5462 (Native inspection admits universal static archives as Mach-O images) - #5542 (FAT target admission trusts CPU declarations that contradict thin Mach-O headers) - **Action:** Inspect thin Mach-O slice headers directly instead of trusting top-level FAT header declarations, and reject non-Mach-O universal static archive containers early. ### Cluster BF: IDA Provider Readiness, Registration Verification & Descriptor Ownership - **Canonical:** #5559 (Doctor reports IDA ready with an unusable headless workspace root) - #5561 (IDA doctor stops responding when its registration path is a FIFO) - #5604 (IDA reader in #5591 loses descriptor ownership after close failure) - **Action:** Validate workspace root writability during IDA doctor checks, verify registration paths are regular files before opening, and ensure file descriptor handles are properly reclaimed in failure cleanups. ### Cluster BG: macOS Application Bundle Detection, Workflow Routing & Resource Extraction - **Canonical:** #5589 (Resource inspection rejects app bundles without CFBundleExecutable) - #5595 (analyze selects the wrong workflow for bundle aliases and JavaScript directories named .app) - **Action:** Inspect `.app` bundles that lack `CFBundleExecutable` (e.g. data or web resource packages) and prevent lexical `.app` directory name suffixes or symlink aliases from misrouting non-native workflows. ### Cluster BH: Objective-C & Swift Metadata Symbol Filtering & GOT Aliasing - **Canonical:** #5576 (analyze_swift_types counts Objective-C labels containing _Tt as Swift observations) - #5580 (get_objc_protocols counts Objective-C method labels containing _TtP as protocols) - #5607 (get_objc_classes counts imported Objective-C classes twice through GOT aliases) - #5617 (get_objc_classes omits Hopper class labels from a stripped Objective-C binary) - **Action:** Use precise mangling prefix and boundary parsers instead of substring matching for `_Tt` / `_TtP`, deduplicate imported classes resolving to identical GOT references, and ensure Hopper provider recovers stripped Objective-C class labels. ### Cluster BI: Browser Session Observation Lifecycle & Screenshot Viewport Coverage - **Canonical:** #5609 (observe-web-session returns pre-window lifecycle milestones as observed activity) - #5610 (capture-web-screenshot reports complete coverage for an image cropped below the visual viewport) - **Action:** Filter out lifecycle milestones preceding the active observation window in `observe-web-session`, and reflect viewport truncation in coverage metadata during `capture-web-screenshot`. ### Cluster BJ: Reference-Source Import, Git Case-Sensitivity & Root Errors - **Canonical:** #5399 (Reference-source import root errors omit required machine-readable fields) - #5619 (Reference-source import excludes files that Git leaves unignored with core.ignorecase=false) - #5620 (Reference-source manifests change after relocation when a file is unreadable) - **Action:** Respect Git repository configuration (`core.ignorecase`) when evaluating `.gitignore` patterns during `import-reference-source`, preserve required machine-readable diagnostic fields in root error envelopes, and ensure manifests remain stable across relocations when unreadable files are present. ### Cluster BK: Web Capture Comparison Normalization & Event-Family Selection Defaults - **Canonical:** #5322 (compare_web_captures: advertised normalization default is rejected for passive before/after comparisons) - #5414 (compare-web-captures rejects legacy scenarios without event-family selections) - **Action:** Align default normalization parameters and event-family selectors between command declarations and schema validators in `compare-web-captures`. ### Cluster BL: Browser Scenario Storage Seed Initialization & Context Origin Handling - **Canonical:** #5420 (Browser scenarios silently skip storage seeds with an empty Chromium execution-context origin) - #5421 (Popup startup misses declared storage seeds while capture reports complete) - **Action:** Handle empty execution-context origins during early browser popup startup and ensure declared storage seeds are reliably applied before marking captures complete. ### Cluster BM: JavaScript Hoisted Variable Initialization Timing & Premature Resolution - **Canonical:** #5302 (Export return shapes give a var read before its initializer the initializer's value) - #5377 (JavaScript call graph resolves a callback before its var initializer executes) - **Action:** Model temporal ordering in JavaScript variable declarations to preserve undefined/uninitialized state when hoisted `var` identifiers are accessed prior to statement execution. ### Cluster BN: macOS Keyed Archive & Asset Catalog Reference Extraction - **Canonical:** #5635 (inspect-asset-catalog omits AppKit NSCustomResource image references) - #5638 (inspect-keyed-archive reports ordinary UID dictionaries as resolved references) - #5698 (inspect-asset-catalog reports a malformed catalog as an I/O failure and drops its diagnostic) - **Action:** Accurately distinguish true resolved UID references from ordinary dictionary keys in keyed archives, and include AppKit `NSCustomResource` image references during asset catalog inspection. ### Cluster BO: Cancellation Error Projection & Diagnostic Erasure - **Canonical:** #5364 (Cancelling browser scenario startup becomes unreadable_output and drops partial capture) - #5388 (Source-map cancellation loses observed codec failures and the caller abort reason) - #5393 (JavaScript analysis worker replaces an observed failing exit with later cancellation) - #5641 (Cancellation projection replaces incomplete retained observations with unreadable_output) - #5714 (Hopper cancellation errors discard the caller abort reason) - **Action:** Preserve exact abort reasons, observed failing exit codes, and retained partial observations during service-level cancellation projections instead of replacing them with generic `unreadable_output` errors. ### Cluster BP: Reverse Engineering Service Boundary Failure Classification & Objdump Error Handling - **Canonical:** #5401 (inspect-with-objdump loses missing-file and directory failure reasons) - #5642 (Reverse command error classification can throw or replace non-Error failures) - #5691 (Objdump launch failures recommend changing the target or fixing read access) - **Action:** Validate runtime rejection causes (including non-Error/null/undefined rejections) in `ReverseEngineeringService.inspectWithObjdump`, replace `(cause, value)` settlement conventions with explicit `Result<Stats, unknown>`, and retain specific filesystem error paths and failure codes in diagnostic envelopes. ### Cluster BQ: Export Shape Comparison Branch Analysis & Reason Attribution - **Canonical:** #4168 (Export shape comparison reports "changed" for a branch that a known constant never takes) - #5465 (Export shape comparison gives a selected export an unexplained unknown reason) - **Action:** Prune unreachable constant branches from export shape AST diffs and ensure fallback nodes provide explicit semantic reasons rather than opaque unknown labels. ### Cluster BR: Reconstruction Coverage Readiness, Proof Conflict & Claim Contradiction Resolution - **Canonical:** #3354 (Reconstruction coverage reports ready with a missing transitive dependency) - #3889 (Reconstruction coverage reports ready when a passing proof conflicts with a failed one) - #3890 (Reconstruction coverage ignores authority routing on surfaces named only by a required claim) - #3937 (Reconstruction coverage ignores contradictions on required claim surfaces) - **Action:** Enforce fail-closed verification in reconstruction coverage ledgers: do not mask failing proofs with concurrent passing proofs for the same digest, route authority consistently across claim surfaces, and reject ready status when required claims contain unresolved contradictions. ### Cluster BS: Retained Network Capture API Surface Reconstruction (SAZ & mitmproxy) - **Canonical:** #2857 (Derive API surfaces from retained Fiddler SAZ captures) - #2915 (Derive API surfaces from retained native mitmproxy flows) - **Action:** Implement unified traffic-derived schema extraction supporting both Fiddler SAZ sessions and native mitmproxy flow captures to generate OpenAPI/JSON schema surface definitions. ### Cluster BT: Backward JavaScript Provenance & Call/Return Property Value Tracking - **Canonical:** #5585 (Backward JavaScript provenance loses the value of a directly returned property) - #5648 (Backward JavaScript provenance loses a property passed directly as a call argument) - **Action:** Track returned property literals to call return sites and preserve property bindings passed directly as call arguments in backward semantic provenance analysis (addressed in maintainer PR #5651). ### Cluster BU: Firmware Extraction Publication Lifecycle, Timeout & Cleanup Failures - **Canonical:** #4558 (firmwareIntegration publication cleanup-retry tests fail deterministically since 2d163c12) - #5659 (Firmware publication timeout can crash the CLI before returning its timeout result) - **Action:** Ensure publication timeouts cleanly destroy active unblob/reader streams and return structured publication timeout results instead of crashing on unhandled Readable errors. ### Cluster BV: Console Event Timestamp Normalization & Argument Fidelity - **Canonical:** #3377 (Selected console text drops null primitive arguments) - #5656 (Missing console API timestamps are reported as epoch zero) - **Action:** Preserve data fidelity for absent console event metadata: leave missing upstream timestamps as undefined/null rather than synthetic 1970 epoch zeros, and retain null primitive arguments during console line formatting. ### Cluster BW: Provider Inline Reply Size Capping & Retained Summary Delivery - **Canonical:** #5499 (Query retained Go build metadata without full raw replies) - #5584 (Compact command replies with retained complete GDB/objdump Evidence) - **Ghidra Function Dossier Retained Summary:** PR #5660 (feat(ghidra)!: default analyze_function to a retained summary) - **Frida Session Status Retained Summary:** PR #5661 (perf(frida): add retained summaries for session status) - **Action:** Standardize provider responses on the established `detail: summary | complete` delivery pattern with retained Evidence handles to protect calling agents from transport/stdio budget exhaustion. ### Cluster BX: Ghidra Per-Function Decompile Deadlines, Analyzer Scoping & Log Suppression - **Canonical:** #5340 (Optional per-function Ghidra decompile deadline that fails one request instead of closing the session) - #5342 (Server-wide REA_GHIDRA_DISABLED_ANALYZERS naming a format-specific analyzer stops other formats from opening) - #5400 (Avoid repeated Ghidra startup logs in input-error replies) - **Action:** Scope disabled analyzer validation per admitted target format rather than process-globally, enforce granular decompile timeouts (addressed in PR #5662) returning degraded dossiers without terminating sessions, and suppress redundant startup logs on early input rejections. ### Cluster BY: Classic Console ROM Loading & Architecture Routing (NES, SNES, GameCube, Ghidra Loaders) - **Canonical:** #1741 (Add PowerPC (32-bit big-endian) native analysis through Ghidra, with a GameCube/Wii DOL follow-up) - #2072 (Feature request: NES / iNES container routing (6502 ROMs)) - #4794 (Add basic SNES ROM support via Ghidra raw binary loading (65C816)) - #5657 (Classic console ROM targets on Windows (raw image with an installed Ghidra language, or a named Ghidra loader)) - **Action:** Support raw binary image loading with user-specified Ghidra language IDs and loaders for classic console architectures (NES 6502, SNES 65C816, GameCube PPC) across Windows and POSIX hosts. ### Cluster BZ: Game Engine Binary & Bytecode Reverse Engineering (GameMaker, Godot, Flash) - **Canonical:** #3614 (Adobe Flash & SWF Reverse Engineering: ActionScript 2/3 bytecode decompilation...) - #3631 (Godot reverse engineering: PCK unpacking, scene/resource deserialization...) - #3632 (GameMaker reverse engineering: data.win, GML bytecode...) - **Action:** Build unified asset deserialization and bytecode decompilation pipelines for game engines (Flash ActionScript, Godot GDScript, GameMaker GML). ### Cluster CA: MCP Tool Input Schemas & Host-Absolute Path Constraints - **Canonical:** #3924 (MCP JavaScript application analysis accepts a relative input_path) - #5450 (MCP bundle comparison accepts relative paths and reads from the server working directory) - #5493 (MCP input schemas omit host-absolute local path constraints) - **Action:** Enforce host-absolute path validation and schema constraints across all MCP tools to prevent reading or analyzing unintended files relative to the server working directory. ### Cluster CB: Mach-O Inspection Parser Fidelity & Identifier Normalization (Whitespace, Escapes, Section Names) - **Canonical:** #3384 (`Mach-O dependency inspection removes install-name whitespace`, PR #4979) - #3390 (Mach-O export inspection merges names ending in carriage return) - #5680 (inspect-macho rejects valid section and segment names equal to version) - **Action:** Retain exact whitespace, escapes, and section/segment tokens in Mach-O parsers (`parseField`) rather than aggressively consuming tokens as version identifiers. --- ### Cluster CC: ELF Binary Layout Inspection & Section Allocation Bounds - **Canonical:** #5715 (inspect-binary-layout fails on a valid ELF containing IKCFG_ST) - #5716 (inspect-binary-layout classifies an overflowing ELF program-header offset as execution_failure) - #5717 (inspect-binary-layout rejects a valid relocatable object referencing linux_banner) - #5718 (inspect-binary-layout allocates the declared BSS and fails on a small valid ELF) - **Action:** Bound section and BSS virtual allocations in `inspect-binary-layout`, handle kernel image strings (`IKCFG_ST`, `linux_banner`), and preserve diagnostic details when program header offsets overflow. ## 3. Recommended Maintainer Actions (@morluto) 1. **Close Direct Duplicates:** Review and close #4058, #3861, #3633, #4867, #5242, and #5185 as duplicates pointing to their canonical counterparts. 2. **Apply Sibling Links:** Cross-reference Clusters A through CC to avoid redundant PRs solving individual symptoms. 3. **Preserve Reproduction Evidence:** All valid minimal reproduction fixtures and traces from newer issues have been cataloged for integration into provider test suites.

bsakaguchi commented 2026-10-17 21:03:10 +00:00

Author

Owner

Copy link

@ogutdgn commented on GitHub (Oct 16, 2026):

For Cluster M, PR #4259 addresses #3885’s missing native-addon bindings for optional require calls. It is ready for review and unmerged; its scope does not cover the other issues in the cluster.

<!-- gh-comment-id:6222318141 --> @ogutdgn commented on GitHub (Oct 16, 2026): For Cluster M, PR #4259 addresses #3885’s missing native-addon bindings for optional `require` calls. It is ready for review and unmerged; its scope does not cover the other issues in the cluster.

bsakaguchi commented 2026-10-31 00:32:20 +00:00

Author

Owner

Copy link

@CassieFox23 commented on GitHub (Oct 18, 2026):

TL;DR: Here's every open tracker in the repo, so people can hop between them.

Edit (25 Oct): 3 items here have closed or merged. They're ticked or struck below. The #4259 row also notes #3885, which closed 24 Oct.

Thanks, matbrgz, for keeping this one.

Linux checks (2026-10-18)

• #4483 (cluster C): fixed on main by 542fa8495. Checked on Linux, Node 22/24/26. Results are on the issue. (closed 18 Oct)
• #4471 (cluster W): fixed on main by 2b7b698db. Checked on Linux, Node 22/24/26. Results are on the issue. (closed 18 Oct)
• #4259 (cluster M): this PR fixes #3885 (#3885 closed 24 Oct). Checked on Linux, Node 22/24/26. The review is on the PR. (closed 25 Oct)

Related trackers

Every open tracker in the repo, so you can get to any of them from here.

Bugs and duplicates

• #3537: Open bugs, by subsystem (matbrgz)
• #4330: Duplicate issues, in clusters (matbrgz)
• #5653: New issues by area, pointing at #4330 for duplicates (CassieFox23)

Features and roadmap

• #3796: Feature requests, by area (CassieFox23)
• #2383: Support for the top 100 languages (matbrgz)
• #2357: Static file and crash report work (matbrgz)
• #3714 to #3719: six RFC epics on formats and bytecode (matbrgz)
• #4027: Browser, Electron and JS work (N0zoM1z0)
• #32: The main roadmap (morluto)
• #48: The Evidence v2 epic (morluto)
• #2039: The roadmap in plain words, a discussion (CassieFox23)

Docs

• #3795: Open docs issues and PRs (CassieFox23)

Pull requests

• #3582: Open PRs whose fix is already on main (CassieFox23)
• #5654: Open PRs with conflicts or red CI (CassieFox23)

Show and tell

• #1435: Linux setup notes and test queue, a discussion (CassieFox23)

🤖 Generated with Claude Code (Sonnet 5.5, verified by Opus 5.5) 🦊

<!-- gh-comment-id:6245949848 --> @CassieFox23 commented on GitHub (Oct 18, 2026): **TL;DR:** Here's every open tracker in the repo, so people can hop between them. **Edit (25 Oct):** 3 items here have closed or merged. They're ticked or struck below. The #4259 row also notes #3885, which closed 24 Oct. Thanks, matbrgz, for keeping this one. ### Linux checks (2026-10-18) - ~~#4483 (cluster C): fixed on main by 542fa8495. Checked on Linux, Node 22/24/26. Results are on the issue.~~ (closed 18 Oct) - ~~#4471 (cluster W): fixed on main by 2b7b698db. Checked on Linux, Node 22/24/26. Results are on the issue.~~ (closed 18 Oct) - ~~#4259 (cluster M): this PR fixes #3885 (#3885 closed 24 Oct). Checked on Linux, Node 22/24/26. The review is on the PR.~~ (closed 25 Oct) ### Related trackers Every open tracker in the repo, so you can get to any of them from here. **Bugs and duplicates** - #3537: Open bugs, by subsystem (matbrgz) - #4330: Duplicate issues, in clusters (matbrgz) - #5653: New issues by area, pointing at #4330 for duplicates (CassieFox23) **Features and roadmap** - #3796: Feature requests, by area (CassieFox23) - #2383: Support for the top 100 languages (matbrgz) - #2357: Static file and crash report work (matbrgz) - #3714 to #3719: six RFC epics on formats and bytecode (matbrgz) - #4027: Browser, Electron and JS work (N0zoM1z0) - #32: The main roadmap (morluto) - #48: The Evidence v2 epic (morluto) - #2039: The roadmap in plain words, a discussion (CassieFox23) **Docs** - #3795: Open docs issues and PRs (CassieFox23) **Pull requests** - #3582: Open PRs whose fix is already on main (CassieFox23) - #5654: Open PRs with conflicts or red CI (CassieFox23) **Show and tell** - #1435: Linux setup notes and test queue, a discussion (CassieFox23) 🤖 Generated with Claude Code (Sonnet 5.5, verified by Opus 5.5) 🦊

bsakaguchi referenced this issue 2026-10-31 00:54:57 +00:00

[PR #1722] [CLOSED] fix(mcp): advertise collection-scoped selectors for analysis views #4777

Sign in to join this conversation.

No Branch/Tag specified

Branches Tags

main

codex/procedure-reference-stacked

release-please--branches--main--components--rea-agents

release-please--branches--main--components--rea-agents--release-notes

codex/kuna-independent-retry

codex/byte-search-overlay-coverage

codex/open-failure-target-receipt

codex/kuna-xref-evidence

codex/ghidra-ambiguous-procedure-recovery

codex/function-source-bundle

codex/trace-function-integration-prototype

codex/snapshot-source-closure

codex/recorded-evidence-array-pages

codex/evidence-recovery-redesign

codex/trace-feature-address-scope

codex/call-discovery-scope

codex/ghidra-literal-candidate-evidence

codex/decompile-directory-independent-retry

codex/retry-provenance-base

codex/value-flow-capability-experiment

codex/ghidra-containing-instruction

cursor/readme-discord-button-ef9f

dependabot/github_actions/actions/setup-node-7.1.0

dependabot/github_actions/actions/upload-artifact-7.0.2

dependabot/npm_and_yarn/npm-minor-and-patch-d8d97ce6df

codex/kuna-1989

fix/8559-native-ui-fixture-ownership

fix/8555-go-verifier-mcp-ownership

codex/provider-capability-recovery

fix/8642-rizin-target-stdin

codex/ghidra-memory-effect-scope

codex/ghidra-annotation-entry-selector

codex/ghidra-readonly-recovery

codex/ghidra-regex-verifier-recovery

codex/evidence-discovery-view-guidance

fix/8545-bulk-append-overflow

fix/8428-navigation-refusal-alternatives

codex/address-context-recovery

codex/matching-member-limitations

codex/unknown-scope-contract

codex/evidence-view-guidance

feat/8373-native-trace-views

codex/ghidra-snapshot-verifier-binding

codex/elf-export-visibility

codex/evidence-view-recovery

codex/native-reference-cli-help

codex/provider-candidate-observation-scope

codex/kuna-session-verification

codex/ghidra-switch-lifetime-guidance

codex/pseudocode-paging-discovery

codex/clarify-evidence-view-support

codex/kuna-xrefs-selector-recovery

codex/context-capacity-recovery

codex/evidence-closure-large-links

codex/same-function-evidence-identity

codex/ghidra-verifier-inspected-jdk

codex/audit-guided-workflows

codex/crash-prompt-retained-dossiers

codex/analysis-view-error-recovery

codex/kuna-verifier-target-selection

codex/ghidra-selected-project-call-coverage

codex/docs-native-analysis-scope

codex/ghidra-java-socket-boundary

codex/ghidra-retained-snapshot-verifier

codex/ghidra-search-inventory-facts

fix/8284-zero-argument-parameter-bindings

fix/8198-ui-action-handler-offset

fix/8257-elf-entry-label-identity

fix/8304-deferred-output-schema-projection

fix/8277-call-path-computed-target-uncertainty

fix/pr-8089-conflicts

fix/ci-static-duplicate-export

dependabot/npm_and_yarn/lint-staged-17.6.0

dependabot/github_actions/actions/download-artifact-8.0.2

dependabot/npm_and_yarn/write-file-atomic-8.0.0

dependabot/npm_and_yarn/canonicalize-5.1.0

dependabot/github_actions/actions/cache/restore-6.1.0

dependabot/npm_and_yarn/toon-format/toon-4.4.0

dependabot/github_actions/actions/deploy-pages-5.0.1

codex/review-fixes-pr-2403

codex/review-fixes-pr-2400

codex/process-terminal-width

codex/test-brittleness-cleanup

verify/7167-browser-connect-macos

fix/7167-browser-connect

feat/native-matching-allowance-setting

feat/browser-scenario-dry-run

test/managed-caller-parameters-20261024

codex/parser-fortythird-boundaries

fix/6926-pinvoke-platform-decorations-20261023

fix/6889-har-body-encoding-20261023

fix/6888-sqlite-schema-budget-20261023

fix/dependency-security-gates-6708

cursor/evidence-overwrite-rebase-b4ac

feat/4057-verify-native-exports

fix/windows-acl-observer-overhead-20261022

cursor/erlang-beam-restack-4476

cursor/pe-certificate-review-bf32

fix/6116-javascript-application-fs-errors

fix/6061-unmapped-runtime-script-unknown

feat/browser-scenario-summary

fix/pe-certificates

codex/verify-3407

cursor/rebase-5699

cursor/rebase-5352

cursor/rebase-5600

cursor/fix-cli-schema-omission-10a8

codex/audit-hopper-shutdown-reasons-20261021

fix/demangle-swift-omitted-record

fix/nib-boolean-value-types

cursor/cancellation-partial-observation-a5ac

fix/ib-object-limit-reasons

fix/electron-fuse-limit-advice

fix/kuna-doctor-dangling-cache

fix/fixed-budget-refusal-advice

fix/js-ipc-listener-dedup

fix/js-return-member-provenance

fix/dmg-integrity-retry-advice

fix/ida-doctor-readiness

fix/kuna-version-probe-output-drain

fix/legacy-swift-runtime-name-matching

fix/dylib-lazy-load-commands

fix/browser-scenario-startup-cancel

fix/swift-nested-punycode-classification

fix/compare-unselected-scopes

fix/objc-method-budget-coverage

fix/dmg-mounted-root-observations

audit/ci-tests-20261019-round2

release/6.7.0

fix/wabt-cleanup-retry-resolution

fix/electron-fuse-elf-pe-architecture

fix/native-plist-descriptor-ownership

fix/kuna-caller-cleanup-ownership

experiment/atomic-codemode-20261016

review/first-contributor-3776

fix/call-resolution-full-read-cycles

fix/member-mutation-selection-repeat

experiment/atomic-re-tools-20261015

perf/member-mutation-lazy-origins

perf/static-network-mutation-index

fix/hopper-startup-lifecycle

audit/3050-windows-proof-20261015

feat/windows-window-capture-2183

audit/3049-windows-proof-20261015

audit/3735-macos-fixtures-20261015

fix/batch-decompile-null-pseudocode

fix/kuna-inventory-honors-jobs

experiment/browser-codemode-tool-design-20261015

fix/hopper-clean-runtime-argv

codex/review-2049-27f1b367

review-fixes/pr-2787-routing

fix/3360-scoped-this-emitters

fix/3367-replaced-global-effects

fix/3838-compact-any-value-items

test/hopper-download-probe-20261015

codex/windows-runtime-creation-red-green-20261015

codex/windows-readonly-root-red-green-20261015

codex/windows-root-share-red-green-20261015

codex/exp-1685-win-mcp-startup

codex/bug-sweep-20261015

investigate/2190-windows-package-phases

investigate/3543-macos-cli-deadline

perf/3281-reverse-tools-feedback-quality

fix/3406-hopper-doctor-fixture

fix/3341-wrapper-require-test-context

fix/3301-owned-uninstall-fixtures

fix/3164-compiler-input-ownership

fix/pcap-cleanup-stdout-newline-20261014

perf/interface-builder-summary

codex/review-fixes-pr-1977

fix/ghidra-effective-jvm-platform

fix/docs-turkish-rust-link-20261013

fix/main-maintenance-ci-20261010

fix/recover-binary-session-process-effects

codex/review-fixes-pr-2457

codex/ci-required-cancellation-gate

fix/main-format-baseline-20261013

fix/setup-preserve-entry-fields

cursor/restore-main-checks-1ffc

fix/ghidra-bridge-hashmap-import

codex/shared-ci-jadx-json-default-20261013

codex/shared-ci-ghidra-test-groups-20261013

codex/shared-ci-java-fixture-format-20261013

codex/fix-intrinsic-invocation-boundaries

test/release-preflight-reusable-jobs

test/js-parameter-provenance-expectation

fix/linux-hopper-verification-current

test/2419-ghidra-elf-probe-size

followup/pr-1544-native-ida

codex/fold-pr-2230-contribution

docs/readme-responsible-use

fix/issue-2064

fix/issue-2050

fix/issue-2053

fix/issue-1968

fix/issue-1945

experiment/codemode-bridge-20261011

fix/tool-effects-negative-wording-1904-20261012

fix/1842-electron-interop-provenance

feat/recover-javascript-multi-input

refactor/website-i18n-prep

fix/nativeaot-pe-virtual-extent

fix/browser-verifier-ci-hang

fix/pe-resources-input-selection

docs/beginner-friendly-guides

docs/beginner-setup-guide

fix/javascript-analysis-worker-1563

fix/1649-ghidra-duplicate-names

fix/javascript-export-keys-integration-1369

test/maintenance-boundary-contracts-20261011

review/javascript-export-keys-1369

review/process-live-progress-1483

test/javascript-1495-growth-ratio

fix/ci-escape-timing

docs/normalized-terminal-geometry-1450

release/6.3.0

archive/release-6.3.0-pr1381

release/6.2.0

fix/electron-preload-dynamic-override

fix/javascript-self-referential-bundler-edges

release/6.1.0

cursor/grok-client-cherry-pick-0b56

feat/signature-posture

feat/dyld-shared-cache

feat/artifact-integrity-policy

feat/pkg-inventory

release/6.0.0

chore/sync-release-5.0.0

release/5.0.0

cursor/cloud-agent-node-787e

fix/javascript-xhr-open-endpoints

review/pr-711-realpath-fallback-wording

cleanup/replay-confinement

codex/test-suite-performance

codex/issue-foundations

codex/address-open-issues-2026-07-20

agent/javascript-vite-rollup-esbuild-adapters

agent/process-cleanup

agent/triage-integration

agent/unknown-commands-registry

feat/mcp-identity-metadata

morlvps/issue_cleanup

codex/installer-redesign

morl/roadmap-investigation-core

morl/roadmap-investigation-docs

release-please--branches--main--components--rea

rea-agents-6.8.0

rea-agents-6.7.0

rea-agents-6.6.0

experiment/atomic-codemode-wait-runtime-20261016

rea-agents-6.5.0

rea-agents-6.4.0

rea-agents-6.3.0

rea-agents-6.2.0

rea-agents-6.1.0

rea-agents-6.0.0

rea-agents-5.0.0

rea-agents-4.1.0

rea-agents-4.0.1

rea-agents-4.0.0

rea-agents-3.2.1

rea-agents-3.2.0

rea-agents-3.1.0

rea-agents-3.0.0

rea-agents-2.7.0

rea-agents-2.6.0

rea-agents-2.5.1

rea-agents-2.5.0

rea-agents-2.4.0

rea-agents-2.3.0

rea-agents-2.2.0

rea-agents-2.1.0

rea-agents-2.0.0

rea-agents-1.7.0

rea-agents-1.6.0

rea-agents-1.5.0

rea-agents-1.4.0

rea-agents-1.3.0

rea-agents-1.2.0

rea-agents-1.1.0

rea-agents-1.0.0

rea-agents-0.5.0

rea-agents-0.4.0

rea-agents-0.3.0

rea-0.2.1

rea-0.2.0

Labels

Clear labels   

area: bridge

  

area: bridge

  

area: build

  

area: build

  

area: build

  

area: cli

  

area: domain

  

area: evidence

  

area: mcp

  

area: native

  

area: providers

  

area: runtime

  

area: server

  

area: setup

  

area: tests

  

bug

  

design

  

documentation

  

enhancement

  

enhancement

  

enhancement

  

experiment

  

help wanted

  

i18n

  

invalid

  

P0: critical

  

P1: high

  

P2: medium

  

P2: medium

  

P2: medium

  

P3: low

  

performance

  

provider-request

  

pull-request

Mirrored from GitHub Pull Request

  

question

  

roadmap

  

triage

No labels

area: bridge

area: bridge

area: build

area: build

area: build

area: cli

area: domain

area: evidence

area: mcp

area: native

area: providers

area: runtime

area: server

area: setup

area: tests

bug

design

documentation

enhancement

enhancement

enhancement

experiment

help wanted

i18n

invalid

P0: critical

P1: high

P2: medium

P2: medium

P2: medium

P3: low

performance

provider-request

pull-request

question

roadmap

triage

Milestone

Clear milestone

No items

No milestone

Projects

Clear projects

No items

No project

Assignees

Clear assignees

No assignees

1 participant

Notifications

Subscribe

Due date

The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set.

Reference

morluto/rea#1722

No description provided.