diff --git a/docs/cli.md b/docs/cli.md
index fd917d6a72..1ffe293390 100644
--- a/docs/cli.md
+++ b/docs/cli.md
@@ -748,7 +748,9 @@ browser, web and Electron commands (including `analyze-web-bundle`,
 for Android/ADB, Apktool/JEB/Flutter, firmware, PCAP and signal analysis,
 WASM/EVM, Go/Rust and binary diagnostics, Frida instrumentation, the Cutter
 command, objdump, Rizin and GDB, and the agent environment server
-(`environment-serve`). In these paths, a returned structured
+(`environment-serve`). The handler also wraps `doctor`,
+`inspect-sqlite-database`, `recover-javascript-sources`,
+`inspect-il2cpp-metadata`, and `inspect-desktop-application`. In these paths, a returned structured
 `cancelled` result can be printed before the wrapper assigns the
 signal-derived status. This describes the current source routing; it is not a
 claim that every command or provider runtime has been independently exercised.
@@ -766,9 +768,9 @@ CLI stops writing, prints no error and exits `141` (`128 + 13`, the status of a
 SIGPIPE-terminated writer). The operation itself may have completed; only its
 output was declined.
 
-`inspect-artifact` also returns a structured cancelled result, but its direct
-analysis cancellation path does not set a signal-derived exit status, so it
-exits `1`. Setup has its own contract: cancellation exits `0`. Treat the
+`inspect-artifact` also returns a structured cancelled result. Its logging
+wrapper sits outside the cancellation handler and replaces the signal-derived
+status with the analysis failure status, so it exits `1`. Setup has its own contract: cancellation exits `0`. Treat the
 structured result and process status as separate signals when scripting
 cancellation.
 
diff --git a/docs/client-configuration.md b/docs/client-configuration.md
index 92d298606b..f1045988e1 100644
--- a/docs/client-configuration.md
+++ b/docs/client-configuration.md
@@ -313,9 +313,12 @@ workload needs more time. Devin honors `XDG_CONFIG_HOME` for its
 ## OMP
 
 For OMP, setup writes a `type: "stdio"` entry to the user-level
-`~/.omp/agent/mcp.json`. It follows `PI_CONFIG_DIR` and
-`PI_CODING_AGENT_DIR` (relative to the setup working directory), and the profile selected by `OMP_PROFILE` or
-`PI_PROFILE` (`~/.omp/profiles/<name>/agent/mcp.json`). Setup also removes
+`~/.omp/agent/mcp.json`. A relative `PI_CONFIG_DIR` selects a configuration root
+under the home directory. For the default profile, `PI_CODING_AGENT_DIR`
+overrides the agent directory; a relative value uses the setup working
+directory. A named profile selected by `OMP_PROFILE` or `PI_PROFILE` instead
+uses `<configuration-root>/profiles/<name>/agent/mcp.json` and ignores
+`PI_CODING_AGENT_DIR`. Setup also removes
 `rea` from that file's `disabledServers` list, which would otherwise hide the
 registration. Doctor treats an `enabled: false` entry as active when
 `enabledServers` lists `rea`, as OMP does, unless `disabledServers` also lists
diff --git a/docs/flutter-analysis.md b/docs/flutter-analysis.md
index cc4e8a48c1..fde983584e 100644
--- a/docs/flutter-analysis.md
+++ b/docs/flutter-analysis.md
@@ -136,8 +136,9 @@ server; older servers keep the complete request after schema discovery.
 - **Bounded reads.** APK snapshots are bounded at 2 GiB, including while
   copying. Identification permits 768 MiB of cumulative library extraction;
   declared sizes are checked before extraction. Library reads are bounded at 256 MiB each and ZIP
-  metadata at 8 MiB; the AOT image buffer is allocated at exactly the
-  declared size before reading. Exceeded budgets report
+  metadata at 8 MiB. Before reading, the AOT image buffer reserves the
+  admitted declared size plus one byte; the reported byte count is the number
+  actually read. Exceeded budgets report
   `resource_constraint`.
 - **Engine notes.** Engine libraries are spooled into the owned root. ELF
   headers, note tables and note payloads share an 8 MiB metadata budget;
diff --git a/docs/installation.md b/docs/installation.md
index 52d63a8e14..cb4fea01d4 100644
--- a/docs/installation.md
+++ b/docs/installation.md
@@ -763,8 +763,8 @@ Automatic discovery accepts executable regular files, including file symlinks,
 and skips directories.
 On Linux, it prefers executable `/opt/hopper/bin/Hopper`, then executable
 `~/.local/share/rea/hopper/bin/Hopper`, followed by `/opt/hopper-v4/bin/hopper`
-and `/usr/bin/hopper`; if none exists, the former remains the diagnostic
-fallback. `rea doctor` checks only the current platform's candidates, in the
+and `/usr/bin/hopper`; if none exists, `/opt/hopper/bin/Hopper` remains the
+diagnostic fallback. `rea doctor` checks only the current platform's candidates, in the
 same order; other platforms have no automatic candidates.
 `HOPPER_LAUNCHER_PATH` overrides those choices:
 
@@ -1453,4 +1453,22 @@ curl -fsSL https://raw.githubusercontent.com/morluto/rea/main/install.sh |
   bash -s -- --dry-run
 ```
 
+To review a version-pinned installer before running it, select the release
+version, download its tagged script, and inspect the downloaded file:
+
+```bash
+rea_version=6.7.0
+curl -fsSL "https://raw.githubusercontent.com/morluto/rea/rea-agents-${rea_version}/install.sh" -o rea-install.sh
+less rea-install.sh
+```
+
+After reviewing it, install the same package version:
+
+```bash
+bash rea-install.sh --version "$rea_version"
+```
+
+The tag pins the selected script revision; `--version` selects the npm package
+version. Neither command verifies a signature on the downloaded script.
+
 Supported options are `--version <semver>`, `--dry-run`, `--no-setup`, `--no-prompt`, and `--verbose`. Neither `--no-prompt` nor a non-interactive shell grants permission to install external dependencies.
diff --git a/docs/user-visible-errors.csv b/docs/user-visible-errors.csv
index b06b4844b5..517277124a 100644
--- a/docs/user-visible-errors.csv
+++ b/docs/user-visible-errors.csv
@@ -25,7 +25,7 @@ harm_rank,location,trigger,current_copy,user_risk,proposed_replacement,implement
 22,src/domain/errors.ts:HopperCancelledError,Caller cancels provider request,Hopper operation was cancelled,Exposes provider name,"Analysis was cancelled. Start it again when ready.",implemented,focused assertions passed; full `npm run check` passed
 23,src/domain/errors.ts:NoBinaryOpenError,Analysis requested without target,"No app is open. Ask the user which app to investigate, then call open_binary with its local path.",Low risk; already supplies agent recovery,Keep current copy,implemented,focused assertions passed; full `npm run check` passed
 24,src/server/toolResult.ts:successResult,Successful value violates public output schema,AnalysisOutputError: Analysis output does not match the tool contract,Exposes internal error tag and contract implementation,"Analysis returned an unreadable result. Run `rea doctor` and review the reported details; repeating the unchanged request is not expected to succeed.",implemented,focused assertions passed; full `npm run check` passed
-24.5,src/server/registerOfficialTools.ts:capability unknown,Approved unknown tracking records an unavailable analysis,"TOOL_NAME is unavailable: PROVIDER_REASON",Exposes an internal tool identifier and provider diagnostic in persistent user-visible evidence,"The requested analysis is unavailable for the current target.",implemented,verified by focused MCP integration test
+24.5,src/server/registerEvidenceTools.ts:unavailable analysis,Analysis is unavailable without supporting Evidence,Unavailable error without a session unknown,Do not infer a persistent unknown without supporting Evidence,Return the unavailable error; session unknowns require supporting Evidence,approval-based tracking removed,Source and assertions inspected: tests/boundary/mcp/serverUnknownsMcp.test.ts; unavailable error leaves list_unknowns empty; test not rerun for this documentation change
 24.6,src/application/ReferenceSourceImportEntries.ts:failed entry,A partial reference import contains an unreadable entry,Low-level reader diagnostic stored in entry limitations,Can persist filesystem or reader implementation details,"Code- and entry-specific safe guidance with a retry, limit, exclusion, or platform recovery step.",implemented,verified by exhaustive focused projection test
 24.7,src/server/registerSessionTools.ts:process residual,Capture records a residual unknown linked to capture Evidence,SCOPE: RAW_REASON,Persists adapter diagnostic and implementation wording,"Was SCOPE behavior fully observed during capture?",implemented,verified by focused session MCP test
 24.8,src/server/registerInvestigationTools.ts:changed behavior unknown,Changed-behavior workflow remains incomplete,"Changed behavior result EVIDENCE_ID remains STATUS",Persists internal evidence identifier,"Did both versions behave the same under a complete controlled replay?",implemented,verified by focused investigation MCP test
diff --git a/docs/web-network-captures.md b/docs/web-network-captures.md
index 04696b4086..e5625237aa 100644
--- a/docs/web-network-captures.md
+++ b/docs/web-network-captures.md
@@ -279,8 +279,10 @@ not register or wrap the Fiddler MCP server.
 - `numeric_literals` preserve HAR number lexemes and native integer/float
   representations, including unsafe integers and non-finite native floats.
   Values that cannot be safely represented as JSON numbers are `null` in the
-  reported view, including otherwise valid standard HAR numeric fields;
-  their exact source values remain available through the numeric sidecars.
+  reported view. Schema-valid HAR numbers are admitted even when they cannot
+  be published safely as JSON numbers; their exact lexemes remain in
+  `numeric_literals`. Standard numeric fields must still satisfy the pinned
+  schema, including integer requirements judged from the numeric lexeme.
 - `binary_fields` retain exposed bytes, base64 and SHA-256 independently of
   declared sizes. Valid HAR `content.encoding: "base64"` is decoded exactly;
   producer-decoded Unicode text, missing text and unknown encodings do not
diff --git a/docs/website-script-export.md b/docs/website-script-export.md
index 1af4ad2951..c12cae17bc 100644
--- a/docs/website-script-export.md
+++ b/docs/website-script-export.md
@@ -59,10 +59,15 @@ its own descriptor. It does not duplicate script bytes.
 - Ordinary query-free `.js`, `.mjs`, and `.cjs` URL paths are arranged under a
   directory for each origin, preserving their relative module layout when it
   is unambiguous.
-- Competing versions, query/fragment variants, case and file/directory prefix
+- Competing versions, query/fragment variants, and file/directory prefix
   collisions, inline sources, and unrepresentable paths use unique isolated
   names with a stated reason. Missing competing sources also prevent selection
   of an apparently canonical version.
+- Case-distinct URL spellings keep their relative paths when the destination
+  filesystem can store both. If a later spelling collides at publication, that
+  record is isolated while an earlier canonical spelling can remain. Read each
+  record's `layout`, `relative_path`, and `layout_reason`; case isolation depends
+  on the destination, unlike preplanned exact-path/version isolation.
 
 ## Interpretation and limits