chore: merge environment serve (5e242c13) into environment export

docs/agent-environments.md

@@ -72,6 +72,9 @@ where the answer came from:
 
 `exact_match` is true when every supplied path parameter and query value
 equals the recorded one; it says nothing about parameters the caller omitted.
+A path value matches a recorded segment as written or after percent-decoding;
+when both kinds of match are available, the record whose segment equals the
+value as written is chosen.
 When no record matches, the tool still answers from the tool's first cited
 record and reports `exact_match: false`. `body` is parsed JSON when the
 recorded content type is JSON-like (`application/json`, `application/*+json`,
@@ -131,8 +134,10 @@ can see that the method, not the transport, is unsupported. Its request body is
 read within the same 4 MiB bound the MCP endpoint applies: a larger body is
 answered `413` with a JSON-RPC `-32000` error before any of it is parsed, and a
 body that is not JSON is answered `400` with `-32700`. A notification (no `id`)
-gets `202` and no body, a batch gets one reply per request in it, an empty batch
-or a message that is not a JSON-RPC request gets `-32600 invalid request`.
+gets `202` and no body, a batch gets one reply per request in it, and an empty
+batch, a batch of more than 100 messages, or a message that is not a JSON-RPC
+request (including an `id` that is not a string, number or null, or `params`
+that are not an object or array) gets `-32600 invalid request`.
 
 ## The environment card
 

docs/binary-diagnostics.md

@@ -160,7 +160,12 @@ launch builder. It is a configuration fact, not measured memory use or proof of
 the effective JVM limit; JVM environment options may affect that limit.
 When a Windows script wrapper selects the JVM, this value remains unknown.
 Historical stdout and stderr remain available, but classification uses only the
-failing operation's `failure_output`. Output draining waits at most one second,
+failing operation's `failure_output`. Retained stdout and stderr share an 8 MiB
+budget, but every drained byte is scanned for `java.lang.OutOfMemoryError`:
+`failure_output.observed_oome` records the latest confirmed token's bounded line per stream from
+the failing operation, with its byte offset, even after the budget is spent. These observations own OOME detection; retained text that ends at a class-name prefix cannot confirm a complete token. `line_complete` distinguishes a known line end from an incomplete trailing context; `invalid_utf8` marks replacement-decoded context.
+Incomplete operation output without an observed OOME keeps the original failure code and explains that a memory cause cannot be ruled out. Incompleteness alone does not confirm a memory constraint or justify heap-specific advice. Token context stays within the failing operation's checkpoint; a class-name prefix in a different identifier is not OOME evidence. A trailing bare token requires an observed stream EOF to establish its boundary.
+Output draining waits at most one second,
 subject to earlier cancellation or the startup deadline. `output_incomplete`
 marks a snapshot taken before stream closure; cleanup ownership remains with
 the session until release succeeds.

docs/browser-observation.md

@@ -350,6 +350,40 @@ validation and resource bounds. Omitted script metadata makes its affected
 section explicitly truncated.
 Disallowed-origin entries are filtered before retention.
 
+Selected script-source collection shares a 32 MiB aggregate UTF-8 retention
+budget and a 20-second deadline across the capture. An oversized source is
+omitted while later smaller sources may still fit. When the deadline expires,
+remaining source reads are skipped. Script metadata, per-item omission reasons,
+and `script_sources` completeness remain available. A single CDP response can
+still be materialized up to the separate 64 MiB transport limit before source
+admission; the retention budget does not bound that transient allocation.
+
+Bundle parsing and semantic inspection run sequentially in an owned child,
+without executing captured code. `max_heap_mb` defaults to 1024 MiB V8
+old-space; `analysis_timeout_ms` defaults to 30000 per script, including startup
+and transfer. A failed or timed-out script becomes an explicit unknown while
+completed findings and later scripts remain available. `total_analysis_timeout_ms`
+defaults to 300000 across script analysis; expiry returns a typed timeout with
+partial Evidence and identifies unstarted scripts. These controls are also
+available as CLI flags with hyphenated names. Capture and optional source-map
+fetching have separate budgets.
+
+One web-bundle capture/analysis is admitted per REA process at a time. Completed
+script results share an 8 MiB serialized transfer budget, with host heap
+reservation checked before decoding and validating another result.
+Exhausted result capacity stops further script launches and returns a typed
+resource failure with completed facts and explicit unstarted-script unknowns.
+Worker control frames are limited to 64 KiB. Cleanup must confirm child termination
+before releasing its private files; failed cleanup retains its exact owner and
+blocks replacement until retry succeeds. Cancellation retains completed bundle
+facts, including cancellation during final cleanup.
+
+The worker heap setting is not a process-family RSS limit. Node enforces V8
+old-space flags; Bun ignores them. Windows Bun instead uses an owned process
+commit limit with a 512 MiB runtime reserve; other Bun hosts have no enforced
+memory limit. These bounds do not establish an aggregate host-memory limit
+across other REA operations or external processes.
+
 Resource-tree inventories distinguish a valid empty `resources` array from a
 missing or malformed collection. Invalid resource entries are omitted with
 incomplete coverage, while valid resources from that frame and other frames

docs/cli.md

@@ -286,6 +286,12 @@ reported separately as configured-secret exclusions.
 Re-import saved graphs whose pattern-based exclusions lack `pattern` before
 using them in source-to-bundle comparisons.
 
+Entries that change during an import retain an unavailable-entry diagnostic
+alongside readable siblings. If enumeration of an already admitted root fails,
+the graph keeps its observed children and records the root failure as a
+top-level limitation. That partial inventory does not establish absence among
+unexamined children.
+
 JavaScript and TypeScript import parsing requires valid UTF-8. Malformed source
 bytes retain their original hashes and sizes with a decoding diagnostic; REA
 does not infer module targets from replacement characters.

docs/client-verification.md

@@ -457,7 +457,9 @@ disposable HOME and CODEX_HOME under `~/.cache/rea-agent-evaluations/`. Set
 `REA_AGENT_EVAL_ROOT` to choose another parent directory outside the OS temporary
 directory: current Codex refuses helper aliases under `/tmp`, preventing shell
 commands and skill reads even if MCP works. Each owned run directory is removed
-after verification unless fixture retention is requested. The lane
+after verification unless fixture retention is requested. Cleanup attempts the
+remaining run tree even if auth removal fails, and reports unresolved cleanup
+together with the original verification failure. The lane
 installs the packaged skill and MCP registration through public `rea setup`,
 rather than copying a skill into a project that also inherits the caller's
 skills and configuration. Only authentication is copied, when present, and it

docs/electron-observation.md

@@ -33,6 +33,12 @@ encoded path separators, ASAR directories or links, and nonexistent paths are
 rejected. The endpoint exposes every eligible target and its local path
 metadata.
 
+Cancellation stops further file authorization after an already-started filesystem
+operation settles. ASAR descriptor-close failures remain typed incomplete cleanup
+with an exact retryable owner; they are not treated as a missing or unauthorized
+page. A later authorization and provider shutdown retry retained descriptors
+before reporting their release.
+
 ## Workflow
 
 `list_electron_targets` returns every eligible target served by the supplied endpoint in one inline array.
@@ -68,7 +74,12 @@ Script metadata retains its execution-context frame ID when CDP supplies one. Th
 inventories worker, service-worker, and shared-worker targets with
 validated opener-target and parent-frame IDs. Worker discovery uses passive
 target metadata; REA does not attach to or execute code in those targets.
-Collection counts and aggregate script-source bytes are not capped. Like every
+Script-source collection retains at most 32 MiB of UTF-8 text across scripts
+and shares a 20-second collection deadline. Omitted sources retain their script
+metadata and an explicit reason; later smaller sources may still fit after an
+oversized source is omitted. The separate 64 MiB CDP response limit bounds one
+wire message before retention admission, rather than total transient memory.
+The source budget adds no script-count cap. Like every
 target, frame, script, and resource, a worker URL must resolve to a local
 file before it is retained. Relationship IDs improve
 attribution but do not prove which static module started a worker or that its
@@ -193,8 +204,25 @@ Caller-defined `.listener` properties can change the identity exposed by
 wrapper recognition. Re-registering a raw recording wrapper on another channel
 retains the original registration's channel attribution.
 Mutating `.listener` on a raw recording wrapper can also prevent removal through
-application decorators; the reproduced identity conflict is tracked in
-[#4513](https://github.com/morluto/rea/issues/4513).
+application decorators that bypass the hook's removal methods. When a removal
+request reaches the hook's methods and its registration order is known, private
+callback ownership preserves removal by the original function and the newest
+matching registration when public metadata is changed or deleted. Native removal
+still determines getter execution, exceptions and removal meta-events.
+
+If registration or removal methods differ from the Node methods captured at hook
+initialization, the hook leaves listener callbacks unwrapped and records a
+`listener-registration` observation gap. The application keeps its original
+callback and receiver; callback execution remains unobserved. This comparison
+assumes Node's EventEmitter prototype has not itself been globally decorated
+before hook initialization. The provider loads the hook before the application
+and excludes `NODE_OPTIONS` from the child environment.
+
+An opaque later listener or unsupported emitter state can prevent proof of
+removal order. The hook then delegates removal
+to the native method and records a `listener-removal` gap rather than claiming
+which registration was removed. These gaps are distinct from dropped records
+and do not establish IPC delivery or successful removal.
 
 ### Target fuse prerequisites
 

docs/flutter-analysis.md

@@ -23,7 +23,9 @@ rea inspect-dart-aot /targets/Example.apk --abi armeabi-v7a
 The equivalent MCP methods are `identify_flutter_build` (with `path`) and
 `inspect_dart_aot` (with `path` and an optional `abi`; the default prefers
 arm64-v8a, then x86_64, then x86, then armeabi-v7a, then the remaining
-ABIs alphabetically).
+ABIs alphabetically). An explicit `abi` is the directory label exactly as
+`identify_flutter_build` reports it, so a payload under a nonstandard label
+stays selectable and keeps that label in the result.
 
 ## Optional retained AOT delivery
 

docs/frida-instrumentation.md

@@ -8,6 +8,6 @@ MCP exposes `list_frida_devices`, `list_frida_processes`, `start_frida_session`,
 
 Failed startup cleanup retains acquired Frida handles, including a paused spawn that has not attached, for later cleanup retries. Its remote connection stays leased until session detach and target resume complete. CLI commands await provider cleanup before returning; MCP retains these resources for cleanup when its server closes. Server shutdown stops admitting new Frida operations and waits for admitted startup, discovery, and queued work before releasing their resources. A failed cleanup remains reported and can be retried by closing the server again, rather than treating an unregistered session as fully released.
 
-Frida scripts execute inside the selected target with that process's memory, filesystem, and network authority. Message capture is bounded to 16 MiB and reports truncation. Script source is not stored in Evidence; its selected path and SHA-256 digest are. Evidence retains non-authentication target selection such as device or endpoint, mode, program or PID, and spawn arguments. Authentication values remain excluded. Results report the observed session and messages, while unsupported platform metadata remains unknown. A request cancelled before a Frida operation starts has no provider effects. If cancellation arrives during a native Frida call, REA waits for that call to return, then closes any session it created and returns the observed session as a partial observation. A cancelled script load on an existing session releases only its new script before queued operations can run; the session and previously loaded scripts remain available. Once the provider commits a successful load, later request cancellation does not unload that script; use `unload_frida_script` to release it. If script cleanup fails, the script remains owned and a paused target cannot resume until the pending instrumentation is released. Queued script loads, resumes, and unloads check cancellation before dispatching native effects. Cancellation Evidence separately reports whether a target resume was observed, whether instrumentation cleanup completed, and that final target liveness remains unknown. REA does not kill the target. Remote discovery retains its observations and reports a separate cleanup error if the temporary connection cannot be removed.
+Frida scripts execute inside the selected target with that process's memory, filesystem, and network authority. Message capture is bounded to 16 MiB and reports truncation. Script source is not stored in Evidence; its selected path and SHA-256 digest are. For a file, `source_sha256` identifies the original selected bytes. Invalid UTF-8 continues to use replacement decoding; Evidence then records that limitation and `raw_result.source_representation` with the encoding, decoding mode, and `loaded_source_sha256` of the UTF-8 string passed to Frida. Valid UTF-8 files and inline scripts do not need this additional representation fact. Evidence retains non-authentication target selection such as device or endpoint, mode, program or PID, and spawn arguments. Authentication values remain excluded. Results report the observed session and messages, while unsupported platform metadata remains unknown. A request cancelled before a Frida operation starts has no provider effects. If cancellation arrives during a native Frida call, REA waits for that call to return, then closes any session it created and returns the observed session as a partial observation. A cancelled script load on an existing session releases only its new script before queued operations can run; the session and previously loaded scripts remain available. If cancellation is observed when the native call returns, partial Evidence retains the source identity and captured messages even if that call rejects, including messages emitted during awaited cleanup. The caller's cancellation reason remains primary and a native rejection is retained as a sanitized diagnostic. A failure already observed before cleanup stays primary if cancellation arrives during cleanup. The cancellation cutoff is REA's observation of native completion, rather than a claim about unobservable native event order. `script_id` is REA's load-attempt identity. When creation rejects without returning a handle, `script_cleanup: "no_handle"` means REA acquired no handle to unload; it does not prove that the engine performed no work. Once the provider commits a successful load, later request cancellation does not unload that script; use `unload_frida_script` to release it. If script cleanup fails, the script remains owned and a paused target cannot resume until the pending instrumentation is released. Queued script loads, resumes, and unloads check cancellation before dispatching native effects. Cancellation Evidence separately reports whether a target resume was observed, whether instrumentation cleanup completed, and that final target liveness remains unknown. REA does not kill the target. Remote discovery retains its observations and reports a separate cleanup error if the temporary connection cannot be removed.
 
 The [Frida Core API](https://frida.re/docs/frida-core-api/) documents device management, sessions, and script loading; the [JavaScript API](https://frida.re/docs/javascript-api/) documents target-side instrumentation. [Luma](https://luma.frida.re/) is Frida's standalone GUI; REA does not automate or control it. `npm run verify:frida` requires a Linux host with the optional Frida binding and uses a short-lived local Node.js fixture created by the verifier. Add `-- --address HOST:PORT --pid PID` to run the separate remote attach lane against a caller-selected target. Mock tests do not establish real device/server compatibility.

docs/installation.md

@@ -376,10 +376,15 @@ Uninstall preserves Hopper, Node.js, Evidence files, captures, unrelated skills
 and other MCP servers. Purging removes only REA's cache and state under
 `~/.rea`. A client configuration that is malformed, unreadable, or at an unsafe
 path stops the operation before anything is removed, and a client that fails
-while being updated stops the remaining removals. For JSON clients, uninstall
-removes every repeated `rea` member in the effective server table only when
-each registration is REA-owned. An unowned earlier member, or an unowned
-OpenCode V1 entry that removing V2 would expose, stops preflight before any
+while being updated stops the remaining removals. Uninstall reports each
+candidate `configuration_path` with its outcome. A client with multiple files
+keeps their individual `actions` alongside its aggregate status and detail,
+including earlier removals when a later file fails. The paths name
+the discovered configuration candidates, not resolved physical file identities.
+For JSON clients, uninstall removes every repeated `rea` member in the effective
+server table only when each registration is REA-owned. An unowned earlier
+member, or an unowned OpenCode V1 entry that removing V2 would expose, stops
+preflight before any
 removal. Repeats inside an inactive earlier copy of the server table stay
 unchanged. A purge path that is a
 symbolic link is retained and reported rather than followed. Uninstall checks

docs/javascript-application-workflows.md

@@ -195,6 +195,17 @@ earlier read or captured alias. Unproved ordering across branches or function
 activations remains conservative. Returned-reference effects use the same
 read-position facts as call resolution.
 
+Returned-reference effects share one property-projection state per source read.
+When several paths reach that read, differing keys at the same depth become
+wildcards; differing depths become an unknown-depth selection. This retains a
+conservative superset of the represented local targets rather than enumerating
+every alias history or dropping paths at a query cap. It can add possible effects,
+including for finite projection cycles. Static limitations disclose this loss of
+precision; semantic graphs retain `dynamic-property` unknowns at the affected
+callee coordinates, and captured web bundles identify the affected script keys.
+These candidates do not prove runtime calls or mutations. Existing source-worker
+and result-admission limits still apply.
+
 Mutation tracking covers explicit member assignments, updates, deletion, and
 loop assignment targets, including the supported local aliases and shared
 nested references. Calls conservatively invalidate exposed mutable references;

docs/javascript-runtime-observation.md

@@ -152,6 +152,15 @@ and uncollected scripts, but scripts collected before attachment may be
 missing. Absence from the observation window never proves that a script or
 behavior does not occur.
 
+Cancellation stops new target-file authorization after the current filesystem
+operation settles. Cancellation diagnostics retain the examined target prefix;
+unexamined targets remain unknown. Observation cancellation keeps its original
+reason and any completed Evidence. Finalization waits for REA's bounded socket
+close (up to two seconds for graceful and forced confirmation). A failed close
+retains its exact transport owner and blocks replacement connections until
+cleanup succeeds; CLI finalization and MCP shutdown also retry retained cleanup.
+Closing REA's connection does not stop the caller-owned runtime.
+
 ## Static correlation
 
 Pass the resulting observation Evidence and an

docs/mcp-contracts.md

@@ -133,6 +133,12 @@ is null. `total` counts all matching heads; each page preserves complete records
 in stable unknown ID order. Filters apply before paging. Pages reflect current
 session state, so keep the unknown ledger unchanged while traversing it.
 
+Automatically retained workflow questions include their immutable result
+Evidence ID. Distinct results retain independent questions and source links;
+repeating the same result does not create another unknown. Workflow Evidence
+keeps the original residual question text. Explicit `record_unknown` requests
+keep caller-selected identity and reject duplicate creation.
+
 For a portable exported bundle, the CLI shares this projection:
 `rea inspect-evidence-bundle '{"path":"/tmp/evidence.json","detail":"summary","filters":{"operation":"analyze_function"}}' --format json`.
 The CLI validates and materializes that local bundle under its existing memory
@@ -450,13 +456,57 @@ as one JSON log line on stderr (`"msg":"MCP transport listening"` with `url`)
 at every `REA_LOG_LEVEL`, because an ephemeral port is otherwise unreachable;
 stdout stays unused.
 
+This endpoint uses plain HTTP without TLS or client authentication. Use it only
+within a trusted local or isolated environment; an explicit non-loopback bind
+makes the same tools and active analysis state reachable at that address. It
+does not provide separate users or independent target sessions. Standard client
+registrations continue to use a dedicated stdio process.
+
 The HTTP server is stateful and serves one client at a time on one server
 instance. `initialize` returns an `Mcp-Session-Id`; `notifications/initialized`
 is acknowledged with `202`; responses arrive as JSON or SSE frames; `DELETE
 /mcp` with the session id ends the session with `200`. Ending a session is not
 a server shutdown: the process keeps listening, the instance keeps its providers
 and the shared active target, and the next client opens a fresh session against
-them. The newest client replaces an open session: an `initialize` that arrives
+them. A client ending or replacing a session cancels its running tool calls and
+prompt completions, stops request-body reads and fences further message dispatch,
+then waits up to ten seconds for request dispatch, handlers and cleanup to finish before reusing the
+server. A timeout returns `503`; the old calls remain owned, and later requests
+retry the drain rather than starting another session against those resources.
+Requests that finish parsing or SDK dispatch after their session closed are
+refused, and their response streams are cancelled. Tool callbacks whose
+validation finishes after cancellation never start.
+Body forwarding stops when SDK request processing ends, including early header
+and size refusals, rather than remaining active until the session closes.
+HTTP input/route dispatch is limited to eight concurrent requests by default,
+shared by MCP and plain routes. Excess requests receive `503` with a closing
+connection before their bodies are converted, read or cloned. An embedder can
+select `maxConcurrentDispatches`; the SDK's per-body size limit still applies.
+MCP responses with fully read or bodyless requests do not hold admission slots,
+so an idle MCP SSE stream does not prevent later calls. Plain routes retain their
+slots through response delivery and response-source cancellation cleanup. An
+unread upload retains its slot until input finishes or either side closes,
+even with a long response. Sequential keep-alive is supported; a peer pipelining
+behind an unfinished response is disconnected before queued requests dispatch.
+Concurrent MCP requests use separate connections.
+This bounds concurrent input work, not total provider or process memory.
+Provider-backed prompt completions use the same request owner and drain, so a
+cancelled completion cannot keep using providers after handover or shutdown.
+HTTP factories enable `RequestTrackingMcpServer` tracking so completion is tracked
+even when cancellation suppresses the SDK's reply; stdio retains the SDK's
+original callback behavior. Full server shutdown stops the listener and waits
+for MCP work, plain-route handlers and response-source cancellation to settle
+before running provider shutdown hooks or closing providers. Response producers
+must finish provider work before closing their stream and expose asynchronous
+disconnect cleanup through the stream's `cancel()` result. Cancellation does not
+delay delivery of a HEAD reply; a caller retaining a sibling of a teed response
+must consume or cancel that sibling before shutdown can finish. Failed response
+cleanup remains owned, blocks further admission and prevents provider teardown.
+The server continues cleanup
+automatically when they finish, including after a client handover timed out.
+All routes return `503` until the server factory succeeds; startup failure closes
+the listener and joins its pending replies before rejecting the factory.
+The newest client replaces an open session: an `initialize` that arrives
 while a session is open ends that session instead of being refused, because a
 client that exits without `DELETE` must not wedge the listener; the replaced
 client's open streams are closed and its later requests are refused. Only an
@@ -467,12 +517,13 @@ session; any other sessionless POST goes to the live transport, which refuses
 it without disturbing the session. Requests that carry no valid session id are
 refused with `400` or `404` as the SDK transport defines. A bind is loopback by
 address class, not spelling, and is classified from the address the listener
-actually bound: any `127.0.0.0/8` address, `::1`, an IPv4-mapped loopback and
-`localhost` names, including a host alias that resolves to one of them. On such
-a bind, requests whose `Host` header is outside the SDK loopback allowlist plus
+actually bound: any `127.0.0.0/8` address, `::1`, or an IPv4-mapped loopback.
+Configured names, including `localhost` and its aliases, do not establish that
+the bound address is local; names are added only after classifying the actual IP.
+On such a bind, requests whose `Host` header is outside the SDK loopback allowlist plus
 the configured name and the bound address are refused with `403`, and a browser
 `Origin` outside that allowlist is refused the same way (a missing `Origin`
-passes); a non-loopback bind relaxes both checks and logs the relaxation. A reply sent before a request body was read (a refused `Host` or `Origin`, an unknown route, the startup `503`) closes the connection after the reply, so an unread upload cannot keep a socket open. Request targets are taken verbatim as origin-form paths (`//host/path` is a path, not another origin); an absolute-form target, or one whose path URL parsing would rewrite (dot segments such as `/public/../mcp`), is refused with `400`, and a method Fetch does not support with `405`. Only a lone `initialize` can replace an open session; a batch that carries one is left to the transport's refusal. Scoped
+passes); a non-loopback bind relaxes both checks and logs the relaxation. A reply sent before a request body was read (a refused `Host` or `Origin`, an unknown route, the startup `503`) closes the connection after the reply, so an unread upload cannot keep a socket open. Request targets are taken verbatim as origin-form paths (`//host/path` is a path, not another origin); an absolute-form target, a target containing a raw fragment delimiter (`#`), or one whose path URL parsing would rewrite (dot segments such as `/public/../mcp`), is refused with `400`, and a method Fetch does not support with `405`. Percent-encoded `%23` remains valid query data. Only a lone `initialize` can replace an open session; a batch that carries one is left to the transport's refusal. Scoped
 IPv6 literals (`fe80::1%eth0`) are refused before binding, because no URL can
 name them. Listener errors reach the runtime's connection-loss handler only
 after a successful bind; a bind failure prints the listen-failure message alone. Request bodies are bounded by the SDK's
@@ -922,6 +973,21 @@ includes all dimension limitations. Equal CFGs establish only equal observed
 block sizes and successor relationships. Text from different provider
 identities remains unknown.
 
+The `references` dimension preserves each edge's direction, endpoint identity
+and available kind facts. Within one artifact it compares exact raw endpoint
+coordinates, including the address space; hexadecimal case and zero padding
+do not change identity. Resolving an endpoint to a containing procedure does
+not replace the raw coordinate. Unparseable coordinates stay unknown.
+
+Across artifacts, reference endpoints use stable procedure names. Missing or
+address-generated names remain unknown. A name observed at multiple procedure
+entries retains its label constraint but cannot establish equal endpoints.
+Pairing preserves duplicate counts and considers alternative compatible
+pairings; array order never identifies an edge. Compatible records with
+unknown endpoint identity or kind facts remain `unknown`. Independent known
+facts that contradict every possible pairing still establish `changed`.
+Source Evidence retains the original addresses, names and unavailable facts.
+
 ### Comparison input shapes
 
 `compare_web_captures` accepts exactly one of two input shapes:

docs/mcp-prompts.md

@@ -108,11 +108,13 @@ list does not establish that the target has no procedures.
 | Artifact occurrence | Occurrence IDs present in schema-valid retained artifact inventory pages.                                                                            |
 | Residual unknown    | Current non-resolved unknown heads only.                                                                                                             |
 
-Suggestions are Unicode-normalized, case-insensitive prefix matches. The server
-deduplicates them and sorts by code point for deterministic results. Procedure
-completion derives candidates from the complete inventory, so a name is offered
-only when it identifies one address in that inventory. A completion reply
-carries at most 100 values, the MCP limit. `total` counts every match and
+Prefix matching is Unicode-normalized and case-insensitive; suggestions retain
+their original spelling. The server deduplicates them and sorts by code point
+for deterministic results. Procedure completion derives candidates from the
+complete inventory, so a name is offered only when it identifies one address in
+that inventory. Every name at a shared address participates in this check,
+including later rows that establish ambiguity. A completion reply carries at
+most 100 values, the MCP limit. `total` counts every match and
 `hasMore` is `true` when values were omitted. Completion has no paging
 controls. A longer prefix reaches an omitted value only when it excludes other
 matches; matching uses normalized, case-insensitive forms, so a value can stay

docs/process-capture.md

@@ -38,6 +38,10 @@ supervision on macOS. REA removes that directory when it exits. REA does not
 install Xcode, Command Line Tools, or other software. Capability checks prepare
 this helper before reporting macOS capture as available.
 
+Stopping process sampling or cancelling an ownership query waits for its issued
+inspection command to exit. Closing a macOS ownership reader rejects new queries
+and waits for admitted helper commands before removing their executable directory.
+
 ## Capture a command
 
 For a small first capture, save this as `scenario.json`:
@@ -241,6 +245,15 @@ follow also remain unknown. Partial enumeration of one root does not erase
 known effects in another, and unavailable content hashes do not by themselves
 make path absence unknown.
 
+When a follow-up read fails after an entry's metadata was observed, the
+snapshot keeps unaffected observations and records an `entry_unavailable`
+enumeration omission with the root-aliased path and system error code.
+Successfully observed identity replacements use `identity_changed` with a null
+system code. Unstable symlink targets are omitted; already observed directory
+metadata remains available. The affected root stays incomplete, so omitted
+entries do not prove deletion. A path missing at its initial lookup remains an
+observed absence. Cancellation and unexpected I/O failures still stop capture.
+
 Terminal frame `data` is the comparison text after the selected normalization.
 New captures also preserve `raw_data` when normalization changes a PTY chunk;
 otherwise `data` is already the original text. Older captures may lack the
@@ -419,6 +432,17 @@ Every capture requires `truncation_details`, with separate accounting for:
   imply incomplete path enumeration.
 - `process`: sampling limit and whether sampling ended partially. Coverage
   remains `sampled`, including when that limit was not exhausted.
+  `sampling_failures` counts failed read observations plus at most one
+  unfinished pass interrupted by sampler shutdown. `first_sampling_failure`
+  retains the first attributed read diagnostic, with shutdown context appended
+  when applicable; interruption alone has an explicit shutdown diagnostic.
+  Denied or failed procfs reads mark
+  sampling partial while preserving readable process rows and thread children;
+  a process with unreadable identity is not attributed. Expected process-exit
+  races are separate from failed observations. Shutdown counts only when it
+  interrupts a read or leaves traversal unfinished; a completed pass does not
+  become partial merely because the sampler stops. Completed rows
+  remain available and issued reads settle before final coverage is returned.
 
 The aggregate `truncated` flag summarizes these observations. Comparisons retain
 results for unaffected dimensions and mark affected dimensions unknown; an
@@ -435,12 +459,36 @@ Each filesystem checkpoint starts with a fresh `file_bytes` budget across all
 selected roots; it is not a per-file allowance. File contents are read in
 64 KiB chunks for hashing and are not embedded in capture Evidence.
 
+Ownership inspections bind run-token reads to native start identities and retain
+related generations through reparenting, group changes, omitted rows, and cleanup
+retries. The captured run keeps one evidence owner through settlement and cleanup.
+An absent or changed token leaves a previously related generation unresolved;
+current token proof is still required before signaling. Swept cleanup verifies the
+remaining family after its group signals. Coverage is bounded by the native
+snapshots and generations inspected; sampled group IDs select candidates.
+
 When the host withholds an unrelated process’s ownership token, REA leaves that
 process untouched and records its PID and reason in `cleanup.unverified_processes`
 and process residual unknowns. Successful cleanup verifies the owned group;
 it does not attribute those unrelated processes. Related or otherwise unexplained
 unreadable processes still prevent successful cleanup.
 
+Failed cleanup retains its exact resources for the owning session to retry.
+The CLI retries before projecting its error; MCP retries pending cleanup before
+admitting another capture and during session cleanup. Once every attributed
+owner confirms release, the live error status clears `cleanup_incomplete`.
+The original failure, observations and `cleanup_report` retain the facts from
+the earlier attempt, including any cleanup failure recorded then.
+
+Snapshot file handles, directory handles, and the selected executable reader
+follow the same ownership rule. A failed close preserves completed observations
+and any primary read failure; it cannot turn a completed digest into a successful
+capture with unresolved cleanup. Interrupted snapshots retain examined entries
+with incomplete coverage in `partial_observation`, alongside the failure.
+File-handle retry uses the exact retained owner. After a directory close rejects,
+Node does not expose enough handle validity to authorize another native close;
+REA retains that unresolved owner and blocks further captures in the session.
+
 On macOS, changing a Node process's `process.title` can make its run token
 unreadable. Node documents that [setting the title overwrites argv memory](https://nodejs.org/download/release/v24.18.0/docs/api/process.html#processtitle).
 With the pinned toolchain, a live child retained a readable start identity

docs/reverse-engineering-tools.md

@@ -18,8 +18,11 @@ can run.
 
 For DWARF, REA does not follow local debug links by default. Set `follow_debug_links` to `true` to pass `-WK`; external debug-file identities are not bound to Evidence when following links is enabled. The CLI flag is `--follow-debug-links`; `--no-follow-debug-links` or `--follow-debug-links=false` keeps the default. A separate `true` or `false` word after the flag is not its value. REA clears `DEBUGINFOD_URLS` in the objdump child environment to disable debuginfod network access on GNU binutils versions that do not support `-WE`. The complete raw output is authoritative; REA does not normalize it into a version-independent disassembly schema.
 
+For a known native symbol, use `operation: "disassemble", symbol: "my_function"` in MCP or `--symbol my_function` in CLI. REA passes `--disassemble=my_function` to objdump before collecting output, rather than producing the whole disassembly and filtering it afterward. Omit `symbol` to keep full code-section disassembly. Other operations reject this selector. Use a nonempty, NUL-free name with well-formed Unicode; unsupported values are rejected before reading the artifact or starting objdump. Symbol names are passed unchanged; matching, versioned symbols, aliases and the end of the disassembly follow the installed GNU objdump's semantics. Evidence records the selector and actual arguments. An empty match does not establish artifact-wide absence, and the selected observation does not contain the omitted disassembly; request the complete operation when needed.
+
 ```sh
 rea inspect-with-objdump ./program disassemble
+rea inspect-with-objdump ./program disassemble --symbol my_function
 rea inspect-with-objdump ./program dwarf
 rea inspect-with-objdump ./program dwarf --follow-debug-links
 ```

docs/specs/agent-environments/environment-serve/spec.md

@@ -36,7 +36,9 @@ later increment.
   contracts and digests.
 - Replay by selecting, among the tool's cited records, the one whose path
   segments at the parameter indexes match the most supplied values, then the
-  most supplied query values, keeping manifest order on ties; return `status`,
+  most of those segments equal to the value as written rather than only after
+  percent-decoding, then the most supplied query values, keeping manifest order
+  on ties; return `status`,
   `content_type`, `body` (parsed JSON for JSON-like content types that parse,
   else text; bodies over 256 KiB cut at a UTF-8 boundary with
   `truncated: true`) and `replay` with `record_ordinal`, `evidence_id`,

docs/specs/agent-environments/http-transport/spec.md

@@ -29,8 +29,8 @@ client registration keep stdio.
 - Bridge node:http to web Request/Response in `src/server/http/`, streaming
   response chunks as they are produced and turning a client disconnect into a
   request abort and body cancellation.
-- Classify a loopback bind by address class (`127.0.0.0/8`, `::1`, IPv4-mapped
-  loopback, `localhost` names) from the address the listener bound, validate
+- Classify a loopback bind by the actual bound IP (`127.0.0.0/8`, `::1`, or
+  IPv4-mapped loopback), without using the configured DNS name as evidence; validate
   the `Host` and `Origin` headers with the SDK loopback allowlist plus the
   configured name and the bound address on such binds, and relax both for
   other binds and log that relaxation. Refuse scoped IPv6 literals before

docs/testing.md

@@ -92,7 +92,7 @@ without serial scheduling. Pure domain/service, composition, conformance,
 evaluation, CLI boundary, and MCP boundary projects share module graphs. Their
 tests avoid process-global state and keep resource cleanup test-scoped. Each
 MCP session still owns its resources, and CLI cases retain fresh command
-instances or subprocesses. CLI module mocks belong in `tests/process-global/`
+instances or subprocesses. CLI and MCP module mocks belong in `tests/process-global/`
 so they keep per-file isolation. Product catalog verification stays with the
 isolated filesystem boundary tests because it loads both source and compiled
 module graphs. Adapter, other boundary, acceptance, and process-global projects
@@ -251,6 +251,15 @@ lineage followed by a confirmed passive family census. Windows controls require
 a fresh lineage observation and do not signal cached descendant PIDs after root
 termination. Simulated Windows controls do not establish native Windows behavior.
 
+Native process-ownership controls distinguish start identity, zombie lifecycle,
+current parent/group relation, and token-read evidence. Retain generation-bound
+candidates through smaller lineage observations, table omissions, reparenting,
+group changes, and failed cleanup retries. A readable token with unavailable
+identity stays unresolved. Native UID facts, rather than an earlier process-table
+row, determine whether a token denial concerns another user. Darwin tests compile
+the helper and exercise snapshot growth, absence, lifecycle, and UID observations;
+controlled Linux procfs tests do not establish real Linux exit or PID-reuse behavior.
+
 For atomic writes, exercise cancellation on both sides of the documented commit
 point and preserve any publication receipt. A late interruption does not prove
 that no output was published.

docs/web-network-captures.md

@@ -55,6 +55,12 @@ it as inline Evidence to `inspect-analysis-view`; the same summary and capture
 page contracts apply. Large complete records can still exceed MCP's response
 budget; export the retained Evidence when a single record cannot fit.
 
+If decoding completes before cancellation or private-root cleanup fails, the
+failure retains the completed capture as Evidence with the requested record
+selection and explicit sensitivity exclusions. Earlier decode failures remain
+primary. Failed cleanup stays linked to its exact owner, including through
+redaction, and its live status clears only after a confirmed retry.
+
 ## Formats and upstream profiles
 
 HAR uses unchanged `har-schema@2.0.0` draft-06 schemas, `ajv@8.20.0`,