chore: refresh HTTP follow-up with latest main

docs/client-verification.md

@@ -457,7 +457,9 @@ disposable HOME and CODEX_HOME under `~/.cache/rea-agent-evaluations/`. Set
 `REA_AGENT_EVAL_ROOT` to choose another parent directory outside the OS temporary
 directory: current Codex refuses helper aliases under `/tmp`, preventing shell
 commands and skill reads even if MCP works. Each owned run directory is removed
-after verification unless fixture retention is requested. The lane
+after verification unless fixture retention is requested. Cleanup attempts the
+remaining run tree even if auth removal fails, and reports unresolved cleanup
+together with the original verification failure. The lane
 installs the packaged skill and MCP registration through public `rea setup`,
 rather than copying a skill into a project that also inherits the caller's
 skills and configuration. Only authentication is copied, when present, and it

docs/process-capture.md

@@ -459,6 +459,14 @@ Each filesystem checkpoint starts with a fresh `file_bytes` budget across all
 selected roots; it is not a per-file allowance. File contents are read in
 64 KiB chunks for hashing and are not embedded in capture Evidence.
 
+Ownership inspections bind run-token reads to native start identities and retain
+related generations through reparenting, group changes, omitted rows, and cleanup
+retries. The captured run keeps one evidence owner through settlement and cleanup.
+An absent or changed token leaves a previously related generation unresolved;
+current token proof is still required before signaling. Swept cleanup verifies the
+remaining family after its group signals. Coverage is bounded by the native
+snapshots and generations inspected; sampled group IDs select candidates.
+
 When the host withholds an unrelated process’s ownership token, REA leaves that
 process untouched and records its PID and reason in `cleanup.unverified_processes`
 and process residual unknowns. Successful cleanup verifies the owned group;

docs/reverse-engineering-tools.md

@@ -18,8 +18,11 @@ can run.
 
 For DWARF, REA does not follow local debug links by default. Set `follow_debug_links` to `true` to pass `-WK`; external debug-file identities are not bound to Evidence when following links is enabled. The CLI flag is `--follow-debug-links`; `--no-follow-debug-links` or `--follow-debug-links=false` keeps the default. A separate `true` or `false` word after the flag is not its value. REA clears `DEBUGINFOD_URLS` in the objdump child environment to disable debuginfod network access on GNU binutils versions that do not support `-WE`. The complete raw output is authoritative; REA does not normalize it into a version-independent disassembly schema.
 
+For a known native symbol, use `operation: "disassemble", symbol: "my_function"` in MCP or `--symbol my_function` in CLI. REA passes `--disassemble=my_function` to objdump before collecting output, rather than producing the whole disassembly and filtering it afterward. Omit `symbol` to keep full code-section disassembly. Other operations reject this selector. Use a nonempty, NUL-free name with well-formed Unicode; unsupported values are rejected before reading the artifact or starting objdump. Symbol names are passed unchanged; matching, versioned symbols, aliases and the end of the disassembly follow the installed GNU objdump's semantics. Evidence records the selector and actual arguments. An empty match does not establish artifact-wide absence, and the selected observation does not contain the omitted disassembly; request the complete operation when needed.
+
 ```sh
 rea inspect-with-objdump ./program disassemble
+rea inspect-with-objdump ./program disassemble --symbol my_function
 rea inspect-with-objdump ./program dwarf
 rea inspect-with-objdump ./program dwarf --follow-debug-links
 ```

docs/testing.md

@@ -251,6 +251,15 @@ lineage followed by a confirmed passive family census. Windows controls require
 a fresh lineage observation and do not signal cached descendant PIDs after root
 termination. Simulated Windows controls do not establish native Windows behavior.
 
+Native process-ownership controls distinguish start identity, zombie lifecycle,
+current parent/group relation, and token-read evidence. Retain generation-bound
+candidates through smaller lineage observations, table omissions, reparenting,
+group changes, and failed cleanup retries. A readable token with unavailable
+identity stays unresolved. Native UID facts, rather than an earlier process-table
+row, determine whether a token denial concerns another user. Darwin tests compile
+the helper and exercise snapshot growth, absence, lifecycle, and UID observations;
+controlled Linux procfs tests do not establish real Linux exit or PID-reuse behavior.
+
 For atomic writes, exercise cancellation on both sides of the documented commit
 point and preserve any publication receipt. A late interruption does not prove
 that no output was published.