[PR #4238] [MERGED] fix(lifecycle): preserve ownership, cancellation, and cleanup outcomes #6141

New issue

Closed

opened 2026-10-31 01:12:11 +00:00 by bsakaguchi · 0 comments

bsakaguchi commented

2026-10-31 01:12:11 +00:00

Owner

📋 Pull Request Information

Original PR: https://github.com/morluto/rea/pull/4238
Author: @morluto
Created: 10/15/2026
Status: ✅ Merged
Merged: 10/15/2026
Merged by: @morluto

Base: main ← Head: fix/provider-lifecycle-outcomes

📝 Commits (10+)

5a05837 fix(cleanup): preserve owner recovery instructions
3f612c6 fix(hopper): recover late startup and retained cleanup
ad3c351 fix(providers): retain composite lifecycle facts across retries
663a72a fix(process): honor cancellation through capture cleanup
1f5cf57 fix(native): preserve failed LLDB launch ownership and exit proof
c6fe430 fix(native): honor cancellation after trace finalization
a1bc540 fix(cli): preserve analysis results when provider cleanup fails
6e64a09 docs(lifecycle): define completion invariants and regression scenarios
328e650 fix(session): retain run identity through pending cleanup
3bd6c99 fix(cli): preserve original cleanup resource diagnostics

📊 Changes

60 files changed (+2037 additions, -459 deletions)

View changed files

📝 AGENTS.md (+2 -0)
📝 bridge/hopper_bridge.py (+9 -1)
📝 bridge/native/rea_lldb_tracer.py (+48 -4)
📝 bridge/native/test_rea_lldb_tracer.py (+132 -0)
📝 docs/cli.md (+6 -0)
📝 docs/installation.md (+22 -6)
📝 docs/mcp-contracts.md (+17 -3)
📝 docs/native-investigation.md (+10 -0)
📝 docs/testing.md (+38 -0)
📝 docs/tool-design.md (+39 -0)
📝 src/application/DirectAnalysisCleanup.ts (+5 -1)
📝 src/application/binary/BinarySession.ts (+37 -62)
📝 src/application/binary/BinarySessionStatus.ts (+3 -0)
📝 src/application/binary/CompositeProvider.test.ts (+111 -4)
📝 src/application/binary/CompositeProvider.ts (+35 -16)
📝 src/application/closeOwnedWebResources.ts (+54 -2)
➕ src/browser/WebArtifactCleanup.ts (+75 -0)
📝 src/browser/assets/WebSourceLocationArtifacts.ts (+17 -7)
📝 src/browser/modules/WebModuleArtifacts.ts (+16 -4)
📝 src/cli/adbCommands.ts (+9 -13)

...and 40 more files

📄 Description

Summary

Preserve lifecycle facts from provider startup through cancellation and cleanup. A late handshake, cancelled finalization, failed launch, or partially successful close now retains the observations and ownership needed to explain the outcome and recover.

Fixes #4232, #4233, #4005, #4009, #3935, #4240. Related audit: #4227.

Problem and expected behavior

Trigger	Previous behavior	Result after repair
Hopper authenticates only during cleanup, or its first listener is abandoned	Missing application identity, misleading idle/closed status, or a pinned native Python thread	Shared handshake identity capture, visible startup/retained cleanup, bounded unauthenticated listener lifetime
SIGINT/abort arrives after workload exit while finalization is pending	Successful complete Evidence despite cancellation	Typed cancellation with collected observations retained and cleanup reported separately
LLDB denies launch but returns a valid, already-exited process	Unknown retained target ownership and `cleanup_incomplete`	Historical creation/PID and positive exit proof remain distinct; capability denial survives confirmed cleanup
Composite children have mixed health/close outcomes	Known failure disappears; retry closes an already released child	Observed non-idle health survives missing peer coverage; only unresolved cleanup is retried
One-shot provider cleanup fails	Completed Evidence or primary diagnostics are replaced by the close failure	Canonical cleanup error retains observations, primary diagnostics, resources and owner recovery instructions

Change and scope

The initial eight semantic commits repair the producing boundaries and their consumers. Four review follow-ups keep client, route and run ID together through retirement, failed startup and restoration; preserve original cleanup-resource diagnostics alongside the later close assessment; reuse the canonical native result projection to retain completed facts on finalization failure; and emit typed Flutter/web cleanup errors at their resource owners, preserving paths, causes and recovery actions through service composition. Thirteen CLI command families reuse the existing finishAnalysisCommand; shared error composition preserves cleanup recovery actions. Design/testing docs define the lifecycle invariants, synchronized failure scenarios and atomic-publication exception, with an AGENTS.md pointer.

The initial eight-commit series was replayed on main e2db76801; git range-diff confirms patch equivalence to the audited series. Static checks and focused regressions are revalidated on that base below.

Ordinary fixes within existing provider authorities. A new-provider/protection-recovery scope decision is not applicable. The cross-provider audit remains open for unavailable platforms and engines.

Contract and boundary impact

Semantic owner and earliest changed stage: Hopper handshake/listener and cleanup; LLDB bridge/tracer launch and finalization; process-capture finalization; composite ownership; one-shot CLI close/error composition.
Contribution scope: existing lifecycle/diagnostic repairs; no new tool, provider, target selection or execution authority.
CLI/MCP contract: additive binary_session.cleanup_pending; retained client health/activity/lineage remains visible under its original analysis_run.run_id after target retirement. Confirmed cleanup clears that run; replacements receive a fresh ID. Cancelled finalization returns typed failure; cleanup failure preserves partial observations. Existing named tools and inputs remain unchanged.
Compatibility: the LLDB bridge's added exit-proof field is optional at the TypeScript parser; provider-specific readiness/ownership facts remain distinct. Positive owned exit proof resolves target lifetime; other resources still require cleanup and missing proof remains unresolved.
Evidence: primary diagnostics, collected observations and cleanup actions survive composition. Existing session-ledger clearing and atomic publication receipts remain unchanged.
Authority/cleanup: exact authenticated application identity or owned debugger handle establishes cleanup authority. Attached/unrelated targets are preserved; authenticated idle/native work does not inherit the unauthenticated listener grace period.
Generated/package impact: canonical status schema updated and SDK-converted schemas validated. Ignored generated catalogs/build outputs are excluded; no install, release or global server replacement.

Effects below describe the existing workflows touched, not expanded authority.

Read existing files or captured data.
Launch or attach to a process.
Inject instrumentation or run scripts/code.
Change process memory, registers, files, or configuration.
Contact network services.
Recover protected code or work around protections.
Documentation or usability only; no target interaction.
Not sure yet; investigation or maintainer guidance needed.

Evidence and regression coverage

Executed reproductions at bde139c5d:

Public process CLI delivered SIGINT during real temporary-root removal: exit status 130 still carried successful Evidence. Repaired output is cancelled, with observed target exit 0 retained as partial data and root removal confirmed. Non-aborted control succeeds.
Controlled WABT executables plus a real filesystem denial made the public CLI return generic UNKNOWN, losing its completed result. The repaired fault/control regression retains valid completed observations or combined primary/cleanup diagnostics. This is not real WABT verification.
Real hardened-runtime LLDB launch returned an error with a valid, nonzero-PID, eStateExited process. The native-call verifier failed before repair and passes afterward.
Production composite/session regressions failed on missing-peer health and repeated successful child close. Controls cover mixed-mode retries, idle/unknown coverage and recovery actions.
Hopper producer regression failed on an abandoned first listener. Controlled late-handshake/foreign-identity cases and real native fixture cancellation/reopen checks passed after repair.

Detailed executed audit evidence and limits: audit record.

Observed, derived, and inferred claims remain distinguishable.
Artifact identity, source provenance, and failed attempts remain preserved.
Unsupported, incomplete, unavailable, or uncertain outcomes remain visible.

Validation performed

Host: macOS 26.3 arm64, Node 24.18.0; matching local toolchain used throughout.

npm run test:focused with 25 exact lifecycle/schema/CLI/acceptance paths: 169 passed, one existing skip on the PR branch. Includes whole-catalog SDK-converted schema validation, process CLI/MCP cancellation, Hopper recovery, composite ownership, LLDB failures, SQLite parity and controlled public CLI cleanup denial.
Review follow-ups at 3bd6c99ce: 89 focused tests passed across seven files, including public MCP close/retry/status, failed startup/restoration ownership, direct cleanup-diagnostic controls, public CLI cleanup denial and schema validation. npm run check, npm run docs:check (five README tests) and npm run check:fast passed. The new assertions first failed on the old implementation. Provider outcomes are controlled seams; no additional real-engine run is claimed.
Additional review follow-ups at b3f328f9d: 158 focused tests passed across 15 files, covering native finalization, Flutter/web retained cleanup and final CLI projection, mixed-owner resources/recovery actions, CLI/MCP workflows and the whole-catalog schema gate. Full static checks, docs checks (five README tests) and final pre-push checks passed. Native finalization uses the completed result schema's optional facts; journal-only failures continue to omit unreported facts.
Real native verifier rerun during these review fixes: node scripts/verify-native-calls.mjs passed on Apple LLDB 2100.0.17.108 through CLI and stdio MCP (six events; exited/event-limit/duration-elapsed; hardened-runtime denial and get-task-allow success). Late-cancellation and cleanup fault timing remain controlled regressions, distinct from this real-engine control lane.
python3 -m unittest discover -s bridge/native -p test_rea_lldb_tracer.py: 13 passed, including failed termination without inferred exit.
npm run check: passed; npm run check:fast: passed again before each push.
npm run docs:check: passed, including five README tests; npm run docs:build: passed after the documentation update; git diff --check: passed.

Real-provider results below were executed during the audit of the patch-equivalent series; they were not rerun after replay onto main:

npm run verify:native-calls: passed, Apple LLDB 2100.0.17.108, real CLI/stdio MCP, exit/event/duration limits and hardened-runtime denial/get-task-allow controls.
Real scoped audit lanes: verify:ghidra passed on Ghidra 12.1.4/JDK21 (373 successful, 52 rejected calls); verify:browser passed on Chrome 155/Playwright 1.58.2; verify:inspector passed on disposable Node targets. verify:native-ui initially had a window-geometry mismatch, then passed on rerun.
Real owned Hopper fixture startup/close, MCP cancellation/reopen and abandoned-listener cleanup passed; this lane was exercised with native Hopper 6.6.0-demo.

Compatibility, safety, and release

Breaking changes/migration: no intended breaking change. Status gains an additive field; callers should handle typed cancellation/cleanup failure rather than previously misleading success.
Remaining audit follow-ups: Android late cancellation (#3927), firmware late cancellation (#3923), and concurrent Ghidra startup cancellation ownership (#3983) remain open and are not claimed fixed here.
Coverage gaps: no real IDA/JEB/Kuna/Cutter/Electron, Android device, JADX, sigrok, TShark, 7-Zip, Binwalk or Unblob lane. GDB/Rizin reported their Linux /proc requirement on Darwin. Frida CLI binding was missing and disposable MCP spawn denied attach. Windows/Linux real-provider coverage remains unknown.
Release: pushed source branch only; no published package or globally installed server update. No cold/warm, CPU, peak process-family memory or token benchmark was measured.
Containment: unknown identity remains retained; no blanket PID/name termination or attached-target shutdown is introduced. Tests use disposable owned fixtures and restore denied permissions during teardown.

Author readiness

Human owner: @morluto (PR author; declarations left for human completion).

I reviewed the final diff and relevant existing code, understand the change and its edge cases, and take responsibility for the complete PR, including AI-assisted work.
I checked the evidence above, confirmed it supports the current change, and recorded meaningful validation gaps.
I declare this PR ready for initial maintainer review.

Before merge

This PR addresses a concrete problem or an agreed enhancement.
Material scope and authority questions are resolved, and any required maintainer scope decision covers the final diff.
The PR has one focused outcome and the title follows type(scope): outcome.
Related issue is linked, or the reason for not linking one is stated above.
Tests cover changed observable behavior and meaningful failure paths.
Owning docs, contracts, and generated metadata are updated where needed.
User-visible CLI/MCP changes include representative output.
I checked the final diff for secrets, unrelated cleanup, and unsupported claims.

_{🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.}

## 📋 Pull Request Information **Original PR:** https://github.com/morluto/rea/pull/4238 **Author:** [@morluto](https://github.com/morluto) **Created:** 10/15/2026 **Status:** ✅ Merged **Merged:** 10/15/2026 **Merged by:** [@morluto](https://github.com/morluto) **Base:** `main` ← **Head:** `fix/provider-lifecycle-outcomes` --- ### 📝 Commits (10+) - [`5a05837`](https://github.com/morluto/rea/commit/5a05837cd38c99b1ff24cffad0eb365ee41433ff) fix(cleanup): preserve owner recovery instructions - [`3f612c6`](https://github.com/morluto/rea/commit/3f612c67f2bafe86ae281dfd8764a7d35643f182) fix(hopper): recover late startup and retained cleanup - [`ad3c351`](https://github.com/morluto/rea/commit/ad3c3516cbb90a7415a75eed3d9a7d0ff0a5b965) fix(providers): retain composite lifecycle facts across retries - [`663a72a`](https://github.com/morluto/rea/commit/663a72a2ce95a7ea1078470877696b57e2bd020a) fix(process): honor cancellation through capture cleanup - [`1f5cf57`](https://github.com/morluto/rea/commit/1f5cf57bf3f03e31faa6df35383ae452cc9d05f3) fix(native): preserve failed LLDB launch ownership and exit proof - [`c6fe430`](https://github.com/morluto/rea/commit/c6fe430657727316cc21fd37511bab6d229355ed) fix(native): honor cancellation after trace finalization - [`a1bc540`](https://github.com/morluto/rea/commit/a1bc540538f8460ba45de7add3c3d05d79179623) fix(cli): preserve analysis results when provider cleanup fails - [`6e64a09`](https://github.com/morluto/rea/commit/6e64a09a3fd17d8d6d0ed8e564d4dc9ca2a9ae67) docs(lifecycle): define completion invariants and regression scenarios - [`328e650`](https://github.com/morluto/rea/commit/328e6500b4ea57292938dc9345ae42181e76bc4f) fix(session): retain run identity through pending cleanup - [`3bd6c99`](https://github.com/morluto/rea/commit/3bd6c99ce86aab101ae296d1e37a1930fb5abe16) fix(cli): preserve original cleanup resource diagnostics ### 📊 Changes **60 files changed** (+2037 additions, -459 deletions) <details> <summary>View changed files</summary> 📝 `AGENTS.md` (+2 -0) 📝 `bridge/hopper_bridge.py` (+9 -1) 📝 `bridge/native/rea_lldb_tracer.py` (+48 -4) 📝 `bridge/native/test_rea_lldb_tracer.py` (+132 -0) 📝 `docs/cli.md` (+6 -0) 📝 `docs/installation.md` (+22 -6) 📝 `docs/mcp-contracts.md` (+17 -3) 📝 `docs/native-investigation.md` (+10 -0) 📝 `docs/testing.md` (+38 -0) 📝 `docs/tool-design.md` (+39 -0) 📝 `src/application/DirectAnalysisCleanup.ts` (+5 -1) 📝 `src/application/binary/BinarySession.ts` (+37 -62) 📝 `src/application/binary/BinarySessionStatus.ts` (+3 -0) 📝 `src/application/binary/CompositeProvider.test.ts` (+111 -4) 📝 `src/application/binary/CompositeProvider.ts` (+35 -16) 📝 `src/application/closeOwnedWebResources.ts` (+54 -2) ➕ `src/browser/WebArtifactCleanup.ts` (+75 -0) 📝 `src/browser/assets/WebSourceLocationArtifacts.ts` (+17 -7) 📝 `src/browser/modules/WebModuleArtifacts.ts` (+16 -4) 📝 `src/cli/adbCommands.ts` (+9 -13) _...and 40 more files_ </details> ### 📄 Description ## Summary Preserve lifecycle facts from provider startup through cancellation and cleanup. A late handshake, cancelled finalization, failed launch, or partially successful close now retains the observations and ownership needed to explain the outcome and recover. Fixes #4232, #4233, #4005, #4009, #3935, #4240. Related audit: #4227. ## Problem and expected behavior | Trigger | Previous behavior | Result after repair | | --- | --- | --- | | Hopper authenticates only during cleanup, or its first listener is abandoned | Missing application identity, misleading idle/closed status, or a pinned native Python thread | Shared handshake identity capture, visible startup/retained cleanup, bounded unauthenticated listener lifetime | | SIGINT/abort arrives after workload exit while finalization is pending | Successful complete Evidence despite cancellation | Typed cancellation with collected observations retained and cleanup reported separately | | LLDB denies launch but returns a valid, already-exited process | Unknown retained target ownership and `cleanup_incomplete` | Historical creation/PID and positive exit proof remain distinct; capability denial survives confirmed cleanup | | Composite children have mixed health/close outcomes | Known failure disappears; retry closes an already released child | Observed non-idle health survives missing peer coverage; only unresolved cleanup is retried | | One-shot provider cleanup fails | Completed Evidence or primary diagnostics are replaced by the close failure | Canonical cleanup error retains observations, primary diagnostics, resources and owner recovery instructions | ## Change and scope The initial eight semantic commits repair the producing boundaries and their consumers. Four review follow-ups keep client, route and run ID together through retirement, failed startup and restoration; preserve original cleanup-resource diagnostics alongside the later close assessment; reuse the canonical native result projection to retain completed facts on finalization failure; and emit typed Flutter/web cleanup errors at their resource owners, preserving paths, causes and recovery actions through service composition. Thirteen CLI command families reuse the existing `finishAnalysisCommand`; shared error composition preserves cleanup recovery actions. Design/testing docs define the lifecycle invariants, synchronized failure scenarios and atomic-publication exception, with an `AGENTS.md` pointer. The initial eight-commit series was replayed on main `e2db76801`; `git range-diff` confirms patch equivalence to the audited series. Static checks and focused regressions are revalidated on that base below. Ordinary fixes within existing provider authorities. A new-provider/protection-recovery scope decision is not applicable. The cross-provider audit remains open for unavailable platforms and engines. ## Contract and boundary impact - **Semantic owner and earliest changed stage:** Hopper handshake/listener and cleanup; LLDB bridge/tracer launch and finalization; process-capture finalization; composite ownership; one-shot CLI close/error composition. - **Contribution scope:** existing lifecycle/diagnostic repairs; no new tool, provider, target selection or execution authority. - **CLI/MCP contract:** additive `binary_session.cleanup_pending`; retained client health/activity/lineage remains visible under its original `analysis_run.run_id` after target retirement. Confirmed cleanup clears that run; replacements receive a fresh ID. Cancelled finalization returns typed failure; cleanup failure preserves partial observations. Existing named tools and inputs remain unchanged. - **Compatibility:** the LLDB bridge's added exit-proof field is optional at the TypeScript parser; provider-specific readiness/ownership facts remain distinct. Positive owned exit proof resolves target lifetime; other resources still require cleanup and missing proof remains unresolved. - **Evidence:** primary diagnostics, collected observations and cleanup actions survive composition. Existing session-ledger clearing and atomic publication receipts remain unchanged. - **Authority/cleanup:** exact authenticated application identity or owned debugger handle establishes cleanup authority. Attached/unrelated targets are preserved; authenticated idle/native work does not inherit the unauthenticated listener grace period. - **Generated/package impact:** canonical status schema updated and SDK-converted schemas validated. Ignored generated catalogs/build outputs are excluded; no install, release or global server replacement. Effects below describe the existing workflows touched, not expanded authority. - [x] Read existing files or captured data. - [x] Launch or attach to a process. - [x] Inject instrumentation or run scripts/code. - [x] Change process memory, registers, files, or configuration. - [x] Contact network services. - [ ] Recover protected code or work around protections. - [ ] Documentation or usability only; no target interaction. - [ ] Not sure yet; investigation or maintainer guidance needed. ## Evidence and regression coverage Executed reproductions at `bde139c5d`: - Public process CLI delivered SIGINT during real temporary-root removal: exit status 130 still carried successful Evidence. Repaired output is `cancelled`, with observed target exit 0 retained as partial data and root removal confirmed. Non-aborted control succeeds. - Controlled WABT executables plus a real filesystem denial made the public CLI return generic `UNKNOWN`, losing its completed result. The repaired fault/control regression retains valid completed observations or combined primary/cleanup diagnostics. This is not real WABT verification. - Real hardened-runtime LLDB launch returned an error with a valid, nonzero-PID, `eStateExited` process. The native-call verifier failed before repair and passes afterward. - Production composite/session regressions failed on missing-peer health and repeated successful child close. Controls cover mixed-mode retries, idle/unknown coverage and recovery actions. - Hopper producer regression failed on an abandoned first listener. Controlled late-handshake/foreign-identity cases and real native fixture cancellation/reopen checks passed after repair. Detailed executed audit evidence and limits: [audit record](https://github.com/morluto/rea/issues/4227#issuecomment-6201499376). - [x] Observed, derived, and inferred claims remain distinguishable. - [x] Artifact identity, source provenance, and failed attempts remain preserved. - [x] Unsupported, incomplete, unavailable, or uncertain outcomes remain visible. ## Validation performed Host: macOS 26.3 arm64, Node 24.18.0; matching local toolchain used throughout. - `npm run test:focused` with 25 exact lifecycle/schema/CLI/acceptance paths: **169 passed, one existing skip** on the PR branch. Includes whole-catalog SDK-converted schema validation, process CLI/MCP cancellation, Hopper recovery, composite ownership, LLDB failures, SQLite parity and controlled public CLI cleanup denial. - Review follow-ups at `3bd6c99ce`: 89 focused tests passed across seven files, including public MCP close/retry/status, failed startup/restoration ownership, direct cleanup-diagnostic controls, public CLI cleanup denial and schema validation. `npm run check`, `npm run docs:check` (five README tests) and `npm run check:fast` passed. The new assertions first failed on the old implementation. Provider outcomes are controlled seams; no additional real-engine run is claimed. - Additional review follow-ups at `b3f328f9d`: **158 focused tests passed across 15 files**, covering native finalization, Flutter/web retained cleanup and final CLI projection, mixed-owner resources/recovery actions, CLI/MCP workflows and the whole-catalog schema gate. Full static checks, docs checks (five README tests) and final pre-push checks passed. Native finalization uses the completed result schema's optional facts; journal-only failures continue to omit unreported facts. - Real native verifier rerun during these review fixes: `node scripts/verify-native-calls.mjs` passed on Apple LLDB 2100.0.17.108 through CLI and stdio MCP (six events; exited/event-limit/duration-elapsed; hardened-runtime denial and get-task-allow success). Late-cancellation and cleanup fault timing remain controlled regressions, distinct from this real-engine control lane. - `python3 -m unittest discover -s bridge/native -p test_rea_lldb_tracer.py`: 13 passed, including failed termination without inferred exit. - `npm run check`: passed; `npm run check:fast`: passed again before each push. - `npm run docs:check`: passed, including five README tests; `npm run docs:build`: passed after the documentation update; `git diff --check`: passed. Real-provider results below were executed during the audit of the patch-equivalent series; they were not rerun after replay onto main: - `npm run verify:native-calls`: passed, Apple LLDB 2100.0.17.108, real CLI/stdio MCP, exit/event/duration limits and hardened-runtime denial/get-task-allow controls. - Real scoped audit lanes: `verify:ghidra` passed on Ghidra 12.1.4/JDK21 (373 successful, 52 rejected calls); `verify:browser` passed on Chrome 155/Playwright 1.58.2; `verify:inspector` passed on disposable Node targets. `verify:native-ui` initially had a window-geometry mismatch, then passed on rerun. - Real owned Hopper fixture startup/close, MCP cancellation/reopen and abandoned-listener cleanup passed; this lane was exercised with native Hopper 6.6.0-demo. ## Compatibility, safety, and release - **Breaking changes/migration:** no intended breaking change. Status gains an additive field; callers should handle typed cancellation/cleanup failure rather than previously misleading success. - **Remaining audit follow-ups:** Android late cancellation (#3927), firmware late cancellation (#3923), and concurrent Ghidra startup cancellation ownership (#3983) remain open and are not claimed fixed here. - **Coverage gaps:** no real IDA/JEB/Kuna/Cutter/Electron, Android device, JADX, sigrok, TShark, 7-Zip, Binwalk or Unblob lane. GDB/Rizin reported their Linux `/proc` requirement on Darwin. Frida CLI binding was missing and disposable MCP spawn denied attach. Windows/Linux real-provider coverage remains unknown. - **Release:** pushed source branch only; no published package or globally installed server update. No cold/warm, CPU, peak process-family memory or token benchmark was measured. - **Containment:** unknown identity remains retained; no blanket PID/name termination or attached-target shutdown is introduced. Tests use disposable owned fixtures and restore denied permissions during teardown. ## Author readiness Human owner: @morluto (PR author; declarations left for human completion). - [ ] I reviewed the final diff and relevant existing code, understand the change and its edge cases, and take responsibility for the complete PR, including AI-assisted work. - [ ] I checked the evidence above, confirmed it supports the current change, and recorded meaningful validation gaps. - [ ] I declare this PR ready for initial maintainer review. ## Before merge - [ ] This PR addresses a concrete problem or an agreed enhancement. - [ ] Material scope and authority questions are resolved, and any required maintainer scope decision covers the final diff. - [ ] The PR has one focused outcome and the title follows `type(scope): outcome`. - [ ] Related issue is linked, or the reason for not linking one is stated above. - [ ] Tests cover changed observable behavior and meaningful failure paths. - [ ] Owning docs, contracts, and generated metadata are updated where needed. - [ ] User-visible CLI/MCP changes include representative output. - [ ] I checked the final diff for secrets, unrelated cleanup, and unsupported claims. --- <sub>🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.</sub>

bsakaguchi

2026-10-31 01:12:11 +00:00