Keep overall verification unknown when an unchanged process comparison cannot
prove the absence of divergence. Preserve independently complete dimensions
and known changes. Let the named comparison schema own status consistency.
Validated through stdio MCP comparison and verification, plus domain tests.
Refs #3980, #4160.
Co-authored-by: Rudy Celekli <rudy@gradiahq.com>
* fix(cleanup): preserve owner recovery instructions
Keep cleanup remediation through combined errors and direct or managed one-shot analysis while retaining primary diagnostics.
Refs: #4227
* fix(hopper): recover late startup and retained cleanup
Authenticate initial and cleanup handshakes through the same identity owner. Expose startup and cleanup activity, retain health after target retirement, and expire abandoned unauthenticated listeners without timing out authenticated work.
Refs: #4227
* fix(providers): retain composite lifecycle facts across retries
Preserve observed child health with incomplete peer coverage, retry only unresolved clients, and retain all child cleanup recovery actions.
Refs: #4233
* fix(process): honor cancellation through capture cleanup
Check the request signal after cleanup and before final publication, retaining completed observations under typed cancellation.
Refs: #4005
* fix(native): preserve failed LLDB launch ownership and exit proof
Publish failed-launch process identity and observed exit separately from object validity. Retire only the exact owned process and retain uncertainty when exit cannot be established.
Refs: #4232
* fix(native): honor cancellation after trace finalization
Check cancellation after runtime-root cleanup and retain collected trace observations as partial cancellation evidence.
Refs: #4009
* fix(cli): preserve analysis results when provider cleanup fails
Reuse the existing one-shot finalizer across thirteen command families to retain completed Evidence and primary diagnostics on close failure. Cover success, denied cleanup, and combined primary/cleanup failure through the public CLI.
Refs: #3935
* docs(lifecycle): define completion invariants and regression scenarios
Document distinct ownership/readiness/exit facts, late cancellation and atomic publication boundaries, partial child cleanup, and diagnostic retention. Link representative regressions and route contributor guidance through AGENTS.md.
Refs: #4227
* fix(session): retain run identity through pending cleanup
* fix(cli): preserve original cleanup resource diagnostics
* fix(native): retain completed facts through finalization failure
* fix(providers): report retained cleanup paths at their owners
Keep the observed target path and failed directory in the unreadable-link diagnostic without promoting either to proven graph identity. Verify the retained path through the importer boundary.
Refs: #4013, #4053
Use untranslated checksum status and nonblocking file admission for localized verification failures. Keep ambiguous readable targets unknown and bounded retries intact; retain failed descriptor ownership and cancellation.
Refs: #4146
Co-authored-by: Tomas Galmarini <tomigalmarini@gmail.com>
Continue validating child directories observed before a parent enumeration failure. Reconcile unobserved link targets at the reader using canonical path identity and the nearest failed ancestor, preserving exclusions and cancellation.
Refs: #4013, #4053, #4060
Co-authored-by: XY-code1 <1611761391@qq.com>
Match repeated derived Evidence against the immutable creation revision while retaining analyst updates, conflict rejection and imported history.
Refs: #3925, #4159
Co-authored-by: rudrakshkarpe <rudraksh.karpe@gmail.com>
Select binding facts at reads without mixing whole-binding and temporal values. Share conditional activation rules, preserve partial expression order, and bound immutable ancestry work. Memoize temporal results within each query using initializer identity, capture point, budget and dependency proofs; preserve depth limits and source Evidence.
Fixes#3881
Accept the First/Last labels used by Wireshark 4.0 and 4.2 at the capinfos metadata owner. Preserve producer values and omitted timestamps, and verify real MCP timestamp projection against direct capinfos output.
Refs #4186, #4180
Co-authored-by: KET ⚡ <ket.patil77@gmail.com>
Parse quoted MI fields and container syntax once before interpreting live PIDs. Keep malformed or duplicate inventories unknown, preserve compatible extension fields, and bound parser state rather than treating partial syntax as proof of no inferiors.
Refs #4150
Co-authored-by: Vinícius DS Andrade <95101505+viniciusdsandrade@users.noreply.github.com>
Reject negative bounded reads before allocation while retaining short-read and exact-EOF behavior. Exercise the corrupted central-directory offset through the public CLI.
Refs #4006, #3953
Co-authored-by: jackie_cqz <88996311+jackie-cqz@users.noreply.github.com>
Preserve nullable producer errors in the shared page contract and reject explicit failures before returning matches. Retain both successful and failed replies as partial evidence.
Refs #4151, #3990
Co-authored-by: Vinícius DS Andrade <95101505+viniciusdsandrade@users.noreply.github.com>
Refuse oversized database and WAL inputs before acquisition with exact observed bytes and export guidance. Keep initial path failures separate from file-set changes and retain cleanup and partial observations on late growth.
Refs #4208, #4188, #4141, #4127
Co-authored-by: hima <1ep23ic023@eastpoint.ac.in>
Co-authored-by: Royce <roycelam@umich.edu>
Preserve applicable artifact processing phases and entered/unvisited status after interruption. Centralize JavaScript semantic applicability for full and incremental builders; retain native byte identity, actual JavaScript unknowns and structured-file provenance.
Fixes#3948. Part of #4027.
Validation:78 distinct focused cases across10files, full static/docs, and real Joplin timeout/default public CLI/MCP controls passed. Source pins, every attempt/outlier and compact resource/token projections are retained. No target/native provider execution or speedup claim.
Co-authored-by: Kaoru0822 <208281322+kaoru0822-kitauji@users.noreply.github.com>
Admit all four derived investigation workflows until Evidence recording settles, so close drains earlier work before clearing the ledger. Honor cancellation after awaited terminal progress before publishing a result.
Refs #4002, #4174
Co-authored-by: Swatantra Yadav <maverickswatantra@gmail.com>
Normalize only advertised schema positions while keeping canonical validation. Preserve branch guidance and relax nonmonotone constraints as a unit. Verify full/compact catalogs and canonical examples after SDK conversion.
Refs #4025, #4087
Co-authored-by: HarsH <harshasalkar7@gmail.com>
Bound retries of native close conflicts at the retained runtime owner. Preserve exact failures and later retry authority after exhaustion. Attempt all verifier cleanup while retaining primary failures; extend held-file Windows verification.
Refs #4136, #4185
Co-authored-by: DeryFerd <deryferdikao125@gmail.com>
Validate decimal tokens at the CLI owner before safe-number parsing. Apply the same rule to positional indexes/generations and repeated record selectors, retaining leading-zero decimals and canonical MCP inputs.
Refs #4182
Co-authored-by: Arjun Prabhulal <arjun.prabhulal@gmail.com>
Preserve the CDP detach limitation through successful and retained partial observations at their shared projector. Do not infer or replay unavailable caller user-agent/client-hint state.
This documents the reported Chromium platform reset; it does not prevent it. Source composition tests ran, without a new real-browser reproduction. Issue #4089 remains open.
Map a zero-byte payload at a section endpoint only when no section contains that RVA, preserving adjacent-section ownership and raw backing checks. Extend the real CLI and stdio MCP workflow across PE32/PE32+ empty and nonempty resources.
The portable parser and public adapter regressions ran locally; Windows API loader behavior and GNU-produced images were not independently rerun.
Refs #3970
Co-authored-by: Gabriel Dias <gabrieldiasnevess@outlook.com>
Preserve original member spellings and central-directory identities while omitting actual root directory markers. Derive entry kind once so Unix symlink facts and size metadata agree; retain traversal and non-directory root rejection.
Verify public inspect/extract workflows for prefixed and root-only archives, distinct duplicate occurrences, and malformed/symlink controls.
Refs #4124
Co-authored-by: Adkid-Zephyr <laufs0310@163.com>
Inline reused input schemas at their projection owner and remove the superseded reference-budget fallback. Validate actual SDK input and output schemas while preserving canonical parsing, output references, and projection cache options.
Claude Desktop and affected Windows connector behavior remain unverified; the SDK catalog has no schema-local input references.
Co-authored-by: akushonkamen <akushonkamen@163.com>
Validate the canonical programs directory before resolving its executable, preserving containment failures even when the external child is missing. Retain in-bundle directory and bundle aliases.
Co-authored-by: gongfpp <22683417+gongfpp@users.noreply.github.com>
Consume signed and unsigned LEB operands through their terminators while validating 64-bit payloads and bounded extension. Preserve independent decoded metadata when a malformed stream fails.
Co-authored-by: Arjun Prabhulal <arjun.prabhulal@gmail.com>
Compile the complete packaged Java source cohort against the verified SDK in selected CI. Share release and source ownership with runtime/package consumers, fail closed on drift, and remove compiler scratch on failure.
Co-authored-by: Kaoru0822 <208281322+kaoru0822-kitauji@users.noreply.github.com>
Require the native node owner's content digest instead of borrowing an
observation artifact digest, which can identify the containing ASAR. Keep
unavailable nodes and their path/provenance/partial facts in the trace,
without a false actionable target or native Evidence link. Remove the old
fallback and allocate the query index only for eligible native targets.
Verify real public CLI/stdio MCP workflows, known/missing companion inputs
and shipped Joplin controls. Preserve reproducible scripts, source pins and
compact correctness/resource/token records without archiving applications.
Fixes#3926. Part of #4027.
Co-authored-by: Kaoru0822 <208281322+kaoru0822-kitauji@users.noreply.github.com>
Normalize erased TypeScript wrappers through existing expression/string owners for static paths, call targets, collection/configuration receivers and global aliases. Preserve binding/mutation guards and explicit unknown targets, with CLI and application-boundary regressions.
Original contribution by @ShuaixinHuang.
Co-authored-by: ShuaixinHuang <1836656514@qq.com>
Keep malformed JEB-only timeouts isolated from shared CLI/MCP startup while strict registration and JEB configuration checks remain authoritative. Cover built CLI discovery and the production stdio MCP refusal and peer requests.
Original contribution by @ShuaixinHuang.
Co-authored-by: ShuaixinHuang <1836656514@qq.com>
* fix(kuna): answer a repeated single-function request without re-running Kuna
A session dropped each single-function run once it settled, so a repeat
request for the same procedure re-ran `kuna decompile --addr`, which
analyzes the whole image again. After a failed export every pseudocode
request uses that path for the rest of the session.
Keep each completed text by entry address, within a 16 MiB least recently
used budget, until the export's reader is adopted or the session closes.
Failed and cancelled runs are not kept. The export's text still supersedes
a kept one.
Refs #1957
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* test(kuna): pin that a kept text's hit refreshes its recency
With two 9 MiB texts only one fit the budget, so a repeated lookup could
not change which entry was dropped. Use three 6 MiB texts: re-reading main
leaves parse least recently used, so keeping broken must drop parse.
Refs #1957
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
---------
Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
Source-map original-source parsing reported `import type X = require("m")`
as a require dependency, although TypeScript erases the declaration. The
fetcher re-derived import-equals targets instead of using the existing
value-only rule. That rule now lives with the other type-only module
declaration predicates in javascriptModuleDeclaration, and the fetcher,
static analysis, and semantic analysis all use it.
Fixes#3932
Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
The reference-source resolver probed only JavaScript and TypeScript
extensions, so require("./data") stayed unresolved when the tree held
data.json, which Node's CommonJS loader selects. Resolution now uses
extension slots: a requires edge also tries X.json after X.js and
before any directory index, and X/index.json after X/index.js,
including a package main. ESM and TypeScript imports still need an
explicit .json extension.
Fixes#3915
Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
The ibtool dictionary parser cut the hierarchy array at a fixed 20,000
entries without counting what it discarded, so an identified record past
that position vanished while the document still reported complete
hierarchy coverage. The graph walker already owns the hierarchy limit;
the parser now passes the decoded array through.
The walker applies max_objects per identified record and keeps walking
past the limit to count omitted records, instead of stopping on a
pending structural entry. Coverage now reports the omitted count, and a
hierarchy that exactly reaches the limit is no longer marked partial.
Fixes#3950
Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
Fixes#3933. Part of #4027.
Normalize exact literals and configuration defaults through the shared primitive owner. Preserve tagged limits through member/destructuring projection and record encountered bounds in per-analysis state independently of later selected values. Remove the retained-value rescan and duplicate default reader. Preserve source Evidence, bounded/null values, aggregate wire capacity and complete endpoint lookup identities for query/trace/comparison.
Validated 66 focused and 932 semantic tests on the restored identical runtime; final public selection 7/7 adds an augmented large-endpoint acceptance (67 distinct focused cases across invocations). Full static/docs and fresh real Obsidian controls passed. Compact measurements and rejected attempts remain recorded.
Co-authored-by: Kaoru0822 <208281322+kaoru0822-kitauji@users.noreply.github.com>
Artifact inventory decided source-map edges from the `.map` path suffix,
so an archive directory such as `main.js.map/` received a maps-source
edge whose parent was the sibling `main.js`, although the same
occurrence was classified as a directory container. Edge construction
now uses the occurrence's own artifact_kind, and the duplicate suffix
rule in relationFor is removed; such directories are contained by their
parent, and real source-map files keep maps-source.
Fixes#3909
Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
* fix(apple): keep Interface Builder objects whose archived class is unresolved
Interface Builder keyed-archive projection skipped every object-table
entry without a resolved class name, so an archived object whose $class
reference dangled vanished from the objects, its count and its coverage,
which still reported complete; as a hierarchy root it lost its label.
Entries that carry their own $class are archived objects: they are now
kept with class_name null and the generic kind, their fields and labels
preserved. Scalars and class descriptors remain excluded.
Fixes#3958
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* fix(apple): keep the dangling class reference of an unknown IB object
Review follow-up. An archived object kept with an unresolved class lost
its original `$class` reference, because class resolution replaces it
with a null class name. The object's attributes now retain that raw
reference when the class cannot be resolved. A graph-level test covers
the reported hierarchy-root case: the unresolved root keeps its label,
unknown kind, containment edge, object count and coverage.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
---------
Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
* fix(apple): bound Interface Builder XML plists by shared value depth
The Interface Builder preflight rejected XML archives whose raw element
depth exceeded 128, but the shared plist parser bounds zero-based value
depth at 128; the plist envelope and dictionary keys add elements, not
value depth. Archives whose deepest value sat at depth 127 or 128 were
therefore omitted as over budget although keyed-archive inspection
decodes them. The preflight's duplicate depth rule is removed; the
shared parser's depth limit is mapped to the existing budget omission,
so deeper archives stay explicitly omitted.
Fixes#3949
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* fix(apple): return the decode reservation of a depth-rejected archive
Review follow-up. The removed element-depth preflight rejected an archive
before its plist representation was reserved; the shared depth limit now
rejects it during decoding, after the reservation. A large over-depth
archive therefore kept its share of the aggregate budget and could
starve later valid archives. A document omitted by the budget after
reserving now releases that reservation.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
---------
Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
Kuna capability gaps such as "no code at this address" or "no function node
at this address" were built without a user message, so MCP and the CLI
showed only "This analysis is unavailable for the current target. Choose
another analysis or target." and kept the reason in details. One Kuna
helper now presents the reason as the message for every such gap, and the
unsupported-operation reason names call relationships and xrefs, which Kuna
now answers.
Refs #1957
Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
Advertise internal worker launches and temporary source writes through the
canonical effects owner so MCP hints and session availability agree with
existing analysis behavior. Preserve non-destructive, idempotent semantics.
Verify public metadata boundaries and a real Obsidian CLI/MCP workflow,
retaining compact reproduction and cost records.
Fixes#3867
Co-authored-by: Kaoru0822 <208281322+kaoru0822-kitauji@users.noreply.github.com>
* fix(apple): report __proto__ entries omitted from OpenStep property lists
The pinned OpenStep decoder assigns a `__proto__` dictionary key to the
object's prototype, so the entry vanished before REA could count it and
OpenStep keyed archives reported no omission, unlike the same archive in
XML. The OpenStep pre-scan, which already walks every key for the depth
limit, now counts keys that decode to `__proto__`; quoted keys with
escapes are decoded by the pinned decoder itself. The rebuilt value still
drops any prototype a key replaced.
Fixes#3892
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* fix(apple): count OpenStep compound keys that coerce to __proto__
Review follow-up. A compound dictionary key such as `(__proto__)` is
coerced by the decoder's `obj[key]` assignment to the property name
__proto__, but the scan only checked scalar keys. Containers opened in
key position are now decoded by the pinned decoder on close and counted
when their property-name coercion is __proto__.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
---------
Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
A failed export's capability error appended "restart REA, then reopen the
target" to every resource-constraint remediation. Since output overflows
became fixed `memory` bounds, an export whose own output overflowed REA's
buffer was told both that repeating fails the same way and that a restart
would help. The restart sentence now follows only settings-backed
remediations such as the cache size.
Refs #1957
Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
Artifact comparison subtracted change rows from the left occurrence
count to derive summary.unchanged. A duplicate logical path produces one
unknown row that stands for every occurrence on that path, so the extra
occurrences were reported as affirmatively unchanged. The summary now
counts only left occurrences on paths without a left-side change row.
Fixes#3956
Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
Fixes#3327.
Reuse parsed Ghidra type identities for NativeAOT metadata lookup, preserve
caller spelling and address spaces, and retain supplied engine metadata
without deriving another source snapshot. Verify actual compiled NativeAOT
PEs through real Ghidra and public CLI/MCP workflows.
Co-authored-by: Kaoru0822 <208281322+kaoru0822-kitauji@users.noreply.github.com>
Co-authored-by: gensokyo-dev <342580529+gensokyo-dev@users.noreply.github.com>
Expose filtered canonical module identities, retained source-range counts and mixed support through the existing shared CLI/MCP analysis view. Preserve full-item access, source selection, provenance and partial coverage while allocating only the selected page.
Verify exact facts and CLI/MCP identity on shipped Obsidian, record complete-task BPE/resource measurements and reuse owned-process supervision for optional tokenizer cleanup.
Fixes#4092
Part of #4027; decision #4091.
Co-authored-by: Kaoru0822 <208281322+kaoru0822-kitauji@users.noreply.github.com>
Add cached, reference-free Kuna string inventories through existing CLI/MCP operations. Preserve exact addresses, typed facts, selected Evidence and bounded query lifecycles; validate native fields and caller-specific failures. Verified with real Linux SQLite, zlib, printf and Unicode/empty ELF targets, 194 focused regressions and all 38 CI checks.
Co-authored-by: gensokyo-dev <342580529+gensokyo-dev@users.noreply.github.com>
Co-authored-by: Kaoru0822 <208281322+kaoru0822-kitauji@users.noreply.github.com>
Kuna output that overflowed REA's fixed buffer was a `capacity` constraint,
which projects as `retryable: true` with "wait for an active analysis to
complete, then retry". The same target and executable overflow the same
buffer every time; on a 169 MB Mach-O, each retry of a call query repeated a
113 s whole-program graph walk and failed again. The overflow is now a
`memory` constraint whose remediation says repeating fails the same way, a
session answers later call queries from a graph overflow it already saw, and
the cut-off document's stdout tail is no longer returned.
Refs #1957
Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
inspect-asset-catalog selected every bundle entry whose relative path
ended in Assets.car, so an unrelated NotAssets.car directory was listed
as a skipped catalog and, with no real catalog present, failed the
inspection instead of returning the empty inventory; a regular file such
as OldAssets.car would have been sent to assetutil. The selector now
compares the final path component exactly.
Fixes#3914
Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
An Objective-C category whose nonzero class reference pointed outside
mapped metadata failed as a whole, discarding its readable name, method
selectors and implementations. The category decoder now resolves the
local class name in its own boundary: on failure the category keeps its
facts with class_name null and class_source unresolved, and a
category_class_unresolved issue records the unreadable reference in the
category coverage.
Fixes#4012
Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
categorizeSwiftTypes counted a recognized Swift alias whose category was
not decoded as a null vote, so one undecoded same-address alias erased a
class category established by another alias: the procedure moved to
other, and a classes filter returned nothing. Only decoded categories now
vote; undecoded aliases stay in mangled_names as evidence.
Fixes#3934
Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
