Retain the original stack merge resolutions for runtime update modes, migrated guard exceptions, deadline ownership and boundary expectations on the merged settings base.
Co-authored-by: gensokyo-dev <342580529+gensokyo-dev@users.noreply.github.com>
A malformed migrated launch seed stays on the config and the operation view reports configuration_invalid unless a snapshot override is active. Kuna, regex, GDB, and Rizin keep the deadline or heap accepted when the work started, and reattributed resource errors copy the structured limit.
Startup no longer rejects a runtime-owned REA_ seed, so update_analysis_settings can replace it. Debugger construction keeps only the restart-only caps, Kuna stores the launch baseline rather than a cached override, and the advertised operations include GDB close, Rizin close, Kuna list_procedures, and the stable-file ChangeTime callers.
The bridge ceiling lists every Hopper and Ghidra bridge operation plus the Cutter calls, and a test fails when a registry entry is missing. ChangeTime observation and the other launch-seed parsers read an accepted override before rejecting an invalid value.
Startup timeout wrapping keeps the debugger setting limit. Pwntools and Kuna failures report the selected source. Cutter session and command operations can inspect the bridge ceiling.
GDB reads the accepted command-output cap when it admits a command. Cutter uses that same accepted bridge ceiling for mismatch and request checks. Kuna project-timeout metadata includes the operations that wait on the shared export.
Part of #9881. Move the limits checked on each call into update_analysis_settings, keep their REA_ seeds and bounds, and reject updates outside the allowed range.
analysis_timeout_ms, max_heap_mb, and command_timeout_ms keep the source chosen by the caller, the runtime override, or the built-in default. A request value reports update_mode parameter because update_analysis_settings cannot change that call.
artifact_limits and web-network budgets report update_mode parameter because update_analysis_settings cannot change them. The legacy-name scan no longer reads docs, and the 2026-11-09 Ghidra receipts are restored to the fields they recorded.
Invalid ChangeTime settings now carry update_mode and pending_restart through the configuration error and its projection, including startup parsing. Runtime recoveries name update_analysis_settings instead of telling the caller to restart REA.
Callers read update_mode to see whether update_analysis_settings can change a limit, and pending_restart only when a configured value is not active in this process.
New per-call registry entries are rejected. Inventory checks require a table row, and the Electron argv handoff is process protocol rather than a caller setting.
A constructor copy is not a per-call read. Numeric limits also come from a number schema or a numeric parse, and the inventory no longer lists path and provider constants.
Part of #9881. Record every numeric REA_ limit and fail static checks when one is neither a runtime analysis setting nor a documented exception with a reason.
Group exact input indices with caller Evidence after complete parameter examination; preserve budget uncertainty and advance the trace workflow profile.
Co-authored-by: gensokyo-dev <342580529+gensokyo-dev@users.noreply.github.com>
* fix(native)!: enforce paired Swift literal coverage in shared dossiers
BREAKING CHANGE: Retained function dossiers containing only one Swift inventory are rejected. Regenerate observations through a canonical provider; both-absent unsupported observations remain valid.
* fix(contracts): advertise paired Swift literal coverage
* fix(reference): retain proven loader calls and unresolved targets
* refactor(reference): remove unused ancestor lookup
* fix(reference): drop loader calls that return a reassigned member
An immediate call could still use a member's original require initializer
because mutation facts were not built for a call-valued callee. A definite
assignment that precedes the call now replaces that initializer.
* fix(reference): select returned loaders from indexed read facts
* fix(reference): refresh loader facts for wrapped returned members
A sequence such as (0, box.load) still used the original require
initializer. Follow sequence, conditional, and logical returns to the
member before deciding whether a prior assignment replaced it.
* test(reference): record unresolved CommonJS targets in source evidence
unknown.cjs calls require with a non-literal target. The inventory now
keeps that coverage limitation on the file entry, and the boundary
fixture asserts it beside the resolved member relationships.
* fix(reference): cover opaque apply lists and assigned returned members
require.apply(null, args) has no normalized argument list, so the
inventory now records an unresolved target instead of complete coverage.
An assignment return such as f = box.load is followed to the member
before a prior replacement is trusted.
* fix(reference): keep self-defaulted module delegates loadable
Timing a member read at a later call made `box.load = box.load || null` observe its own write and drop the native delegate. Reads that already fed an earlier assignment stay at the member.
---------
Co-authored-by: Cursor Agent <cursoragent@cursor.com>
* fix(artifacts): keep an all-zero MD5 note as metadata
A Godot member with an all-zero MD5 records a limitation instead of a
digest. That note is the metadata difference from a member that claims
an MD5. A caveat without a one-sided integrity claim stays unchanged.
* fix(artifacts): compare declared digests without limitation text
A one-sided declared_integrity claim is already a metadata difference.
The limitation-array helper could not change that result and treated
unrelated observation caveats as source metadata. Remove it.
* test(artifacts): describe the one-sided MD5 claim as the metadata fact
The Godot acceptance case still expects metadata when one member has a
declared MD5 and the other has an all-zero MD5. That difference is the
missing claim, not the reader's limitation note.
---------
Co-authored-by: Cursor Agent <cursoragent@cursor.com>
* fix(pe): 保留证书名称的 RDN 分组
* fix(pe): distinguish multi-valued RDNs in certificate name text
Join attributes that share an RDN with "+" and keep ", " between RDNs,
in encoded order. RFC 4514's RDN reversal is not applied, so names made
only of single-valued RDNs keep their existing spelling.
OID 2.5.4.10 is organizationName, so one RDN renders as
commonName=A+organizationName=B and two RDNs as
commonName=A, organizationName=B.
---------
Co-authored-by: AixSxT <245164663+AixSxT@users.noreply.github.com>
Co-authored-by: Cursor Agent <cursoragent@cursor.com>
* fix(desktop): retain capture identity and cleanup ownership
* fix(desktop): validate destinations and finish inputs before export
* fix(desktop): preserve package ownership and apt trust boundaries
* fix(sqlite): preserve observed facts and distinguish special real values
* fix(desktop): bind computer files to data-object metadata
* test(desktop): count the tagged negative-zero cell spelling
SQLite view cells encode negative zero as a real object so it stays
distinct from the text "-0". The byte budget follows that spelling.
* fix(desktop): keep unresolved discovered state directories
Canonicalizing an unreadable path or dangling symlink aborted capture
before the inventory could record that the path was unknown. Those
discovered directories now keep their absolute spelling in the scope.
* test(desktop): keep the capture scope suite within its line limit
The unresolved state-directory case lives beside the suite so the
existing callback stays within the lint limit.
* fix(desktop): retain cancellation through capture input cleanup
* fix(desktop): avoid reserved Pydantic settings properties
---------
Co-authored-by: Cursor Agent <cursoragent@cursor.com>
* fix(javascript): preserve semantic facts across writes and implicit effects
* fix(javascript): preserve bundler identities and helper bindings
* fix(javascript): retain semantic graph evidence and coverage
* test(javascript): include the request link in endpoint traces
Response consumers now also link the originating request to the response, so an endpoint trace reports both that association and the response's json consumer.
* fix(javascript): keep source accessors known after a copied value escapes
An unknown computed getter makes accessor lookup consider every property.
A spread copy already records a value escape, and that escape was treated
as an unknown getter on the source, so the next read escaped the whole
object. Accessor lookup still fails closed for unknown writes and calls.
* fix(javascript): keep Object.defineProperty identified at its own call
The call that escapes Object was treated as a prior replacement of
defineProperty, so a descriptor value never replaced the exported sender
and bundled IPC paths were dropped.
* fix(javascript): keep Vite preload calls that precede reassignment
Helper identity used every write to the binding, so a later assignment
erased a call that had already read the canonical helper. Use the binding
value at the call when that order is known.
* fix(javascript): apply Vite cache mutations before a later reassignment
A later helper write made the whole-binding initializer check ignore an earlier cache mutation. Identity at that mutation uses the same ordered read as the call.
---------
Co-authored-by: Cursor Agent <cursoragent@cursor.com>
* fix(api-contract): retain partial OpenAPI evidence
* docs(api-contract): describe partial OpenAPI Evidence on interruption
Early failures still keep the file snapshot hash. Cancellation or the
retained-facts limit after a row now returns authenticated Evidence, and
the guide explains how to reuse that partial inventory.
* fix(api-contract): count finished paths and keep earlier diagnostics
A path counts only after its item is read, so a path refused before
traversal does not increase path_entries_examined. A paths diagnostic
that exhausts the retained-facts allowance still keeps diagnostics
already stored, including invalid info.
* test(api-contract): keep invalid info when paths exhaust the allowance
The paths diagnostic can fail after invalid info is already stored. The
partial report must still carry that diagnostic and count no path entries.
* docs(api-contract): name every retained row and the view source
The hash remains only when no operation, reference, or diagnostic row was
kept. Partial Evidence is reread through inspect_analysis_view's source
and view, not as separate Evidence fields.
* test(api-contract): verify interrupted inventory evidence
---------
Co-authored-by: Cursor Agent <cursoragent@cursor.com>
* fix(adb): reject unrepresentable activity arguments
* test(adb): lock complete activity component boundaries
The CLI and advertised schema still admitted a slash-free 512-character
component after admission required a nonempty package and class. Keep
that length sample rejected, admit a pattern-valid 512-character
component, and assert the typed field error.
* style(docs): format NTFS verification tables
oxfmt rejects the tables merged from main. The alignment is formatting
only, so static checks can run on this branch.
* test(adb): use a well-formed component for the length constraint
An over-long run of letters also fails the package/activity pattern, so the selector check reported both issues. The length fixture now has a valid component shape.
---------
Co-authored-by: Cursor Agent <cursoragent@cursor.com>
* fix(elf): keep compressed storage out of decoded metadata facts
* fix(elf): admit compressed string tables the profile does not read
SHF_COMPRESSED string tables are rejected only when they name sections
or symbols. An unreferenced string table is not decoded, so it no longer
makes an otherwise analyzable ELF unsupported.
* fix(elf): keep requirement names when verdef declares no entries
A compressed GNU version-definition section with sh_info 0 has no
definitions to decode. Skipping it leaves requirement names in place
instead of clearing them as an unread compressed table.
* fix(elf): skip empty version requirements before storage reads
* fix(elf): skip empty compressed version-requirement tables
A GNU verneed section with sh_info 0 has no requirement records. Reading
its compressed bytes was a version failure and partial coverage; the
declared count now skips that read.
* fix(mips): distinguish compressed metadata storage (#9959)
* fix(elf): note a missing symbol table only when a relocation needs it
A sectionless image with direct DT_INIT and DT_FINI no longer becomes incomplete solely because DT_SYMTAB does not match a decoded table. The same note remains when a dynamic relocation asks for a symbol.
---------
Co-authored-by: Cursor Agent <cursoragent@cursor.com>
* fix(cli): retain cancellation observed during final cleanup
* fix(cli): cancel reference source imports through cleanup
* fix(cli): preserve signal status through command logging
* fix(views)!: distinguish unavailable artifact collections
Keep missing BEAM tables and unavailable Go and Rust build metadata
separate from decoded empty collections. Retain producer limitations
on model metadata, tensor, and type pages.
BREAKING CHANGE: BEAM, Go, and Rust analysis view pages for unavailable
collections now report coverage.status "unavailable", coverage.total
null, and coverage.exhausted false. Refresh saved result schemas and
handle unknown totals before using coverage to infer absence.
* test(views): expect unavailable Go dependency pages
Missing Go build metadata is unavailable coverage, so the MCP page reports a null total instead of an empty collection.
* test(fixtures): ignore a torn build-computer note line
The cancellation test reads the helper's note file while the append is
still in progress. An empty file or an unfinished last line is not a
record yet. A completed line still has to parse.
* fix(fixtures): reject terminated malformed build-computer notes
Trim removed the final newline, so a completed corrupt record looked like
a torn append and the preceding notes were returned. Keep the terminator
and parse every finished line.
---------
Co-authored-by: Cursor Agent <cursoragent@cursor.com>
* fix(firmware): distinguish empty ESP flash partitions from missing bytes
* fix(firmware): keep empty ESP partitions that start before the dump
A zero-byte partition below the selected flash origin was reported as
unread and omitted from the inventory. It declares no bytes to read, so
the plan keeps the empty region and the zero-byte diagnostic.
* fix(firmware): clamp an empty partition before the flash origin
A zero-byte partition below the selected origin has no file bytes. Its
inventory offset is the start of the carrier, which stays nonnegative.
* fix(firmware): clamp empty ESP entries that start before the dump
A zero-byte partition below the caller origin kept a negative file
offset, which the inventory published as a negative source location.
The empty entry now sits at the start of the carrier.
---------
Co-authored-by: Cursor Agent <cursoragent@cursor.com>
