Add a read-only app resource session shared by CLI and MCP. Preserve resource-root provenance without inventing executable identity, reject binary-only snapshots and operations, and retain failed cleanup owners across switches and retries.
Keep filesystem admission failures typed and preserve cancellation ordering from observed cleanup facts. Document resource routing in the packaged investigation skill.
BREAKING CHANGE: resource-only observations may have a null Evidence subject and null executable target digests. Clients must use resource_root and reported per-resource provenance instead.
Refs #5589
* fix(observation): keep incomplete cancellation observations
Service projection treated a retained observation that failed the completed
schema as a malformed completed result. Cancellation became unreadable_output
and the partial was dropped. Incomplete observations now stay on the owner
error, including the exact abort reason.
* fix(observation): drop non-JSON incomplete observations
Keep a retained partial only when projectAnalysisError can serialize it.
Clear a non-JSON partial and record an AnalysisOutputError as a secondary
failure so cancellation and timeout stay the owner error.
Co-authored-by: morluto <morluto@users.noreply.github.com>
* fix(observation): validate incomplete partials without copying
jsonValueSchema.safeParse cloned a JSON-safe partial that projection
copies again. Use jsonValueValidationIssue so the gate only checks.
Co-authored-by: morluto <morluto@users.noreply.github.com>
* test(ida): expect non-retryable unresolved procedure lookups
Main stops treating invalid_request as retryable. An unchanged missing
procedure stays invalid_request and is not marked retryable.
Co-authored-by: morluto <morluto@users.noreply.github.com>
* test(observation): share incomplete-observation assertions
The new non-JSON cases repeated the same owner-error checks and pushed
duplication over the 3.5% limit. One expectation helper keeps those
checks without a second copy.
Co-authored-by: morluto <morluto@users.noreply.github.com>
* test(observation): keep the assertion helper out of the package
The helper imports Vitest. Rename it to a fixture so the production
build excludes it and dist does not import a dev dependency.
Co-authored-by: morluto <morluto@users.noreply.github.com>
* fix(observation): clear non-JSON partials on cleanup primaries
Projection can return the cleanup primary after retry. Clearing only
the wrapper left that primary's partial in place, so projectAnalysisError
threw. The gate now clears every non-JSON partial in the chain.
Co-authored-by: morluto <morluto@users.noreply.github.com>
* fix(observation): freeze retained incomplete observations
A JSON partial stayed a live provider object, so a later mutation could
make projection throw. The gate now keeps one frozen snapshot and still
drops a non-JSON partial without copying it.
Co-authored-by: morluto <morluto@users.noreply.github.com>
* refactor(observation): share web runtime partial retention
Observe and inspect used the same promote-or-keep path. One helper
owns that sequence so the two operations cannot drift.
Co-authored-by: morluto <morluto@users.noreply.github.com>
* fix(observation): snapshot a shared partial once
A cleanup wrapper and its primary can hold the same partial object.
The gate now reuses the first frozen snapshot for that object.
Co-authored-by: morluto <morluto@users.noreply.github.com>
* fix(observation): parse a kept partial once
jsonValueSchema.safeParse validates and copies only a JSON partial.
The gate freezes that copy and no longer walks the same value first.
Co-authored-by: morluto <morluto@users.noreply.github.com>
* test(observation): share repeated observation fixtures
The incomplete-observation tests repeated the same provider setup and
an empty Electron coverage tail, which pushed duplication over 3.5%.
One coverage fixture and shared assertions bring the tree back under
the threshold.
Co-authored-by: morluto <morluto@users.noreply.github.com>
---------
Co-authored-by: Cursor Agent <cursoragent@cursor.com>
Co-authored-by: morluto <morluto@users.noreply.github.com>
* fix(errors): preserve caller abort reasons at admission
Keep the opaque caller reason on reverse, pcap, and SQLite cancellation,
and leave a recognized physical digest or command failure in place when a
late abort is also observed.
Fixes#5670
Co-authored-by: morluto <morluto@users.noreply.github.com>
* fix(reverse): keep a foreign digest ABORT_ERR as an adapter failure
Treat ABORT_ERR as cancellation on the command boundary, where that code
already meant an aborted provider process. A digest or stat rejection with
the same code stays a physical adapter failure unless the caller signal
is aborted. Cover aborted command EACCES, ETIMEDOUT, and ABORT_ERR with
and without captured output.
Co-authored-by: morluto <morluto@users.noreply.github.com>
---------
Co-authored-by: Cursor Agent <cursoragent@cursor.com>
Co-authored-by: morluto <morluto@users.noreply.github.com>
Reuse the shared object-member owner for literal spreads, retain known property names under unresolved membership, and distinguish complete, partial, unknown, and absent projections. Keep historical coverage omission unchanged and preserve own keys across prototype setters.
Refs #5075
Keep POSIX symlink-parent traversal at the shared JSON input boundary and forward the selected browser executable without a second lexical normalization. Verify Electron, browser, and Evidence-file consumers through registered commands and the built CLI.
Refs #5103
* fix(errors): name fixed allowances in resource-constraint recovery
Fixed parser, count, report, input, and capture refusals inherited
host-memory, wait-and-retry, or retained-Evidence advice. Producers now
attach allowance-specific recovery, and deterministic capacity caps are
not retryable. IL2CPP reader occupancy stays retryable capacity.
Refs #5556, #5405, #5456, #5459, #5460, #5504, #5505, #5506, #5537, #5628, #5630, #5631, #5632
* fix(il2cpp): keep a closing metadata reader non-retryable
close() stops admission before the active inspection finishes. A second
inspect in that window was projected as retryable capacity. Closing and
closed readers now report capability_unavailable. Occupied readers that
remain open stay retryable.
* fix(errors): align fixed-cap recovery with retained facts
IL2CPP report refusals keep observed source facts instead of denying Evidence. Command-output caps use the capture allowance. Ghidra seed recovery names the limit that was exceeded.
* fix(errors): call byte caps a byte allowance
WASM representation limits and the IL2CPP Ghidra seed-file cap are byte budgets. Their recovery no longer says the exceeded allowance is a fixed count.
* test(ida): keep unresolved procedure lookups non-retryable
Main now treats an unchanged invalid request as non-retryable. The IDA lookup tests follow that projection.
* fix(errors): qualify capture recovery for live output
A fixed capture allowance still rejects the same output. Live captures such as adb logcat can change between requests, so recovery no longer says every unchanged request fails again.
* fix(adb): keep a truncated live capture retryable
Device output can shrink between calls, so an adb capture that exceeds the allowance stays retryable. Deterministic capture and version-output limits stay non-retryable.
* fix(adb): keep truncated mutations non-retryable
Only live observations opt into retrying a capture that exceeded the allowance. Push, install, uninstall, and other mutations stay non-retryable.
* fix(errors): keep live capture recovery off deterministic limits
Artifact-derived capture allowances again say the unchanged request fails. Only volatile adb observations use the live-output sentence.
---------
Co-authored-by: Cursor Agent <cursoragent@cursor.com>
* fix(javascript): preserve selected path host resolution reasons
Classify ELOOP and ENAMETOOLONG while resolving the caller-selected input so the path and host code stay on the invalid-request issue.
Refs #5623
Co-authored-by: morluto <morluto@users.noreply.github.com>
* fix(javascript): count summary coverage in module units
Use the module population for both examined and total counts. Non-module graph nodes remain in the application coverage section.
Refs #5464
Co-authored-by: morluto <morluto@users.noreply.github.com>
* fix(javascript): connect direct property reads to return and argument flow
Record the unwrapped value expression and alias the object projection's read occurrence so a direct member read stays in backward provenance.
Refs #5585, #5648
Co-authored-by: morluto <morluto@users.noreply.github.com>
* fix(javascript): count return wrappers against expression depth
Evaluate the original return expression so erased TypeScript and Flow wrappers stay inside the expression-depth budget. Keep the unwrapped node for identity and value ranges.
Co-authored-by: morluto <morluto@users.noreply.github.com>
* fix(javascript): describe ELOOP as unresolved symlink traversal
A host can return ELOOP for a cycle or for a chain past its traversal limit. Keep the selected path and code without asserting that a cycle exists.
Co-authored-by: morluto <morluto@users.noreply.github.com>
* test(javascript): skip symlink traversal fixtures on Windows
Keep the overlong-name case portable. Windows does not produce ELOOP for these fixtures, matching the other path-failure tests.
Co-authored-by: morluto <morluto@users.noreply.github.com>
* fix(javascript): describe ENAMETOOLONG as a path or component limit
realpath reports that code for a long component and for a long full path. Keep the selected path and host code without claiming only a filename was too long.
Co-authored-by: morluto <morluto@users.noreply.github.com>
* style(javascript): format return-depth and object-read changes
oxfmt rejected the return-depth test and the object-read index. No behavior change.
Co-authored-by: morluto <morluto@users.noreply.github.com>
* test(ida): expect unchanged invalid requests to be nonretryable
The shared projector no longer marks invalid_request retryable. This lookup assertion was not updated with that contract.
Co-authored-by: morluto <morluto@users.noreply.github.com>
---------
Co-authored-by: Cursor Agent <cursoragent@cursor.com>
Co-authored-by: morluto <morluto@users.noreply.github.com>
* fix(kuna): reject dangling cache roots in doctor
Treat a cache path as creatable only when no directory entry occupies it.
A dangling symbolic link, including one hidden by a trailing separator,
fails the cache check and clears provider availability while the installation
check and caller-selected registration settings remain.
Fixes#5554Fixes#5105
Co-authored-by: morluto <morluto@users.noreply.github.com>
* fix(doctor): admit the same settings native analysis rejects
Project parseConfig failures into scoped engine readiness. Invalid provider
preferences, startup timeouts, and other shared settings now fail the
selected provider and the full audit, while a JEB-only timeout stays outside
that admission.
Fixes#5454
Co-authored-by: morluto <morluto@users.noreply.github.com>
* fix(doctor): report an invalid log level from doctor
The dispatcher rejected REA_LOG_LEVEL before every command, so doctor never
emitted its readiness check. Doctor now runs and names that setting; other
commands still stop before execution.
Co-authored-by: morluto <morluto@users.noreply.github.com>
* fix(doctor): require log-level failures in every scope
An invalid REA_LOG_LEVEL stops the executable and MCP server before a client
or skill can run, so those scopes now fail readiness too. Other native
admission failures stay limited to a selected provider.
Co-authored-by: morluto <morluto@users.noreply.github.com>
* fix(kuna): strip only the platform cache separator
On Darwin and Linux a trailing backslash is a filename character. Doctor now
removes only the selected platform separator before inspecting the cache path.
Co-authored-by: morluto <morluto@users.noreply.github.com>
* fix(doctor): fail every provider on an invalid Hopper timeout
REA_HOPPER_STARTUP_TIMEOUT_MS is rejected before any native engine starts.
A selected non-Hopper provider now includes the existing timeout check.
Co-authored-by: morluto <morluto@users.noreply.github.com>
* style(doctor): format the Hopper timeout regression
Co-authored-by: morluto <morluto@users.noreply.github.com>
* fix(doctor): fail client scopes on MCP startup errors
A registered client starts the MCP server, and parseConfig rejects every
native admission failure before that server starts. Client readiness now
includes those failures, not only REA_LOG_LEVEL.
Co-authored-by: morluto <morluto@users.noreply.github.com>
---------
Co-authored-by: Cursor Agent <cursoragent@cursor.com>
Co-authored-by: morluto <morluto@users.noreply.github.com>
Retain absent or invalid Runtime timestamps as null and mark console event coverage incomplete. Preserve observed finite timestamps, including zero, and document the epoch-millisecond clock.
BREAKING CHANGE: console event timestamps may now be null when the protocol does not provide a finite number.
Refs #5656
* fix(apple): read LC_LAZY_LOAD_DYLIB_INFO dependency payloads
Parse the linkedit install name for lazy-load info commands, resolve those
edges without traversing them, and stop inspect-macho from treating an otool
dependency list as exhaustive when that payload is omitted.
Fixes#5551Fixes#5649
Co-authored-by: morluto <morluto@users.noreply.github.com>
* fix(apple): bound lazy-load payload reads and image offsets
Reuse identical LC_LAZY_LOAD_DYLIB_INFO ranges, cap their combined size,
and reject flag or chain-start offsets outside the slice VM range.
Co-authored-by: morluto <morluto@users.noreply.github.com>
* fix(apple): bound lazy-load string scans and contained reads
Reject payload strings that start in the 24-byte header, validate each
file-offset string once, and reuse payload bytes already read for a
containing range.
Co-authored-by: morluto <morluto@users.noreply.github.com>
* fix(apple): reject cached lazy-load strings outside a payload
Remember each cached string's terminating offset and require that NUL to
fall inside the payload being decoded.
Co-authored-by: morluto <morluto@users.noreply.github.com>
* fix(apple): bound lazy-load payload range lookups
Count containment checks across earlier payload reads and stop at the
existing 16 MiB work limit.
Co-authored-by: morluto <morluto@users.noreply.github.com>
* fix(apple): count every lazy-info string reference
Charge repeated and overlapping LC_LAZY_LOAD_DYLIB_INFO scans against the
16 MiB validation budget, and stop a scan once that budget is exhausted.
Co-authored-by: morluto <morluto@users.noreply.github.com>
* fix(apple): cap retained lazy-info dependency results
Stop after 1024 LC_LAZY_LOAD_DYLIB_INFO commands so a load-command region
full of identical commands cannot become a million traced edges.
Co-authored-by: morluto <morluto@users.noreply.github.com>
* fix(apple): reject a lazy-load path NUL in the final byte
dyld stops the load-path scan before the payload's last byte, so a
terminator in that byte leaves the image malformed.
Co-authored-by: morluto <morluto@users.noreply.github.com>
* fix(apple): keep may-be-missing lazy loads optional
A missing LC_LAZY_LOAD_DYLIB_INFO with the may-be-missing bit is weak, so the lazy finding says dyld continues on first use instead of failing.
Co-authored-by: morluto <morluto@users.noreply.github.com>
* fix(apple): cap lazy-info symbol string references
A payload of distinct one-byte symbol strings stayed under the byte budgets while caching one entry per offset. A slice now stops at 65536 symbol references.
Co-authored-by: morluto <morluto@users.noreply.github.com>
---------
Co-authored-by: Cursor Agent <cursoragent@cursor.com>
Co-authored-by: morluto <morluto@users.noreply.github.com>
* ci: split fast and deep static checks
Fast PRs run typecheck, lint, and format before provider admission.
Knip, duplication, architecture guards, and Python stay on the full tier.
Shared-boundary fallbacks keep the Linux x64 baseline, and Turbo jobs
export remote-cache credentials when they are configured.
Co-authored-by: morluto <morluto@users.noreply.github.com>
* ci: keep pull requests from writing the remote cache
Trusted default-branch runs still receive TURBO_TOKEN. Pull requests get an
empty token and remote read-only mode. Knip saves a per-commit cache key so
the next trusted full run can refresh the restored snapshot.
Co-authored-by: morluto <morluto@users.noreply.github.com>
* ci: forward the release cache token and upload deep static reports
Release qualification now passes TURBO_TOKEN into the called workflow.
Labeled pull requests still do not. The deep static job records its task
context and uploads duplication reports after a failed gate.
Co-authored-by: morluto <morluto@users.noreply.github.com>
* style: format the turbo cache policy test
Co-authored-by: morluto <morluto@users.noreply.github.com>
* ci: keep fast checks exclusive and trusted cache writes explicit
Declare the static artifact name and context script so typecheck matches the
implementations. Lock check:ci:fast around dist, and publish the remote cache
only for release qualification or default-branch push, schedule, and dispatch.
Co-authored-by: morluto <morluto@users.noreply.github.com>
* ci: record static task graphs without nesting the artifacts lock
Keep check:ci:fast locked, and point graph recording at the unlocked
check:ci:fast:tasks script so check:pr and check:test can record hashes
while they already hold that lock.
Co-authored-by: morluto <morluto@users.noreply.github.com>
* ci: keep unauthenticated Turbo runs on the local cache
Open pull requests do not receive TURBO_TOKEN, so a remote read mode cannot
authenticate. Those runs now use the local cache. Trusted runs still publish.
Co-authored-by: morluto <morluto@users.noreply.github.com>
* test(ida): treat unchanged invalid requests as nonretryable
Main already stopped marking invalid_request retryable. The pull request
merge runs that projector, while the IDA lookup tests still expected
retryable true. Match the merged behavior.
Co-authored-by: morluto <morluto@users.noreply.github.com>
---------
Co-authored-by: Cursor Agent <cursoragent@cursor.com>
Co-authored-by: morluto <morluto@users.noreply.github.com>
Sample the browser monotonic clock with observation already subscribed, filter historical lifecycle and network facts, and preserve scope and termination handling when event time is unknown.
Bound pre-arm retention using transport-owned wire bytes. Fail closed when the relevant-event buffer fills, and keep unrelated protocol payloads outside that budget.
BREAKING CHANGE: observe_web_session timeline timestamps can be null when the producer supplies no comparable timestamp. Consumers must handle unknown time explicitly.
Refs #5609
Add opt-in Frida session status summaries linked to complete retained Evidence. Share canonical session facts across contracts and preserve observed state, source identity and capture truncation.
Validated with native SDK/client workflows, default delivery compatibility, lifecycle and provenance tests. The completed large-history task uses 50.9% fewer estimated request tokens; no general CPU or latency improvement is claimed.
Fixes#5640
Retain process input and unexpected failure diagnostics through the shared error projector. Preserve filesystem causes and firmware validation issues, and mark unchanged invalid requests nonretryable.
Use typed stat settlement and parse unknown command failures without losing null or undefined rejection causes.
Refs #5397, #5401, #5402, #5642
Bind and recheck the digest-verified snapshot used by codesign, retaining cleanup ownership when its identity changes. Classify unsigned only from the exact operand-framed diagnostic so echoed caller paths cannot turn unrelated failures into signature facts.
Closes#5636
Keep parser-owned completed metadata and tensor declarations as typed partial Evidence on cancellation or physical read failure. Preserve unknown final identity and digests, exact caller inputs, primary failures, and retained cleanup owners; support inline and retained MCP error delivery.
Closes#5625
Add opt-in retained GDB and objdump summaries using the shared analysis-view layer. Preserve default complete Evidence, ordered records, provenance and completion facts.
Validate real Bash disassembly, whole-client context costs, CLI publication and cleanup; retain the original measured cohorts and explicit coverage limitations.
Closes#5584.
Admit only the corroborated missing-UUID validation diagnostic from header-stripped dyld stdout. Preserve readable load commands and nm exports with unknown dyld coverage, and keep unrelated process and tool failures typed.
Closes#5606
Classify legacy class-object names at the Hopper boundary and carry the typed fact into class discovery. Preserve exact labels, literal filtering, unrelated row metadata, and raw replies; derive classification from source text rather than incoming tags.
Closes#5617
Read bounded regular registrations asynchronously with retained descriptor cleanup. Carry the selected parsed configuration through provider factories and restoration, preserve exact cancellation reasons, and share workspace-parent resolution with doctor checks.
Closes#5561Closes#5559Closes#5604
Compare executable fingerprints before and after the owned version probe, and capture the script prefix from the final hash stream. Preserve partial facts and failed-close ownership without claiming process interruption from a snapshot.
Closes#5611
Recognize AppKit binding connectors as explicit unknown connection facts and
report partial semantic coverage rather than silently omitting them. Share
format-aware connector admission across keyed archives and NIBArchive.
Make the keyed archive table own parsed class and superclass facts for names,
array hierarchy traversal, inherited connectors, and class-table projection.
Preserve malformed class evidence and exclude unrelated custom class names.
Validation: 84 focused tests passed, including compiled CLI, filesystem,
MCP summary, and retained views; check:fast and test discovery passed.
Independent source review found no blocker. Production CLI and stdio MCP
replayed a read-only copy of Terminal 2.15's picker NIB: 13 connections with
partial unsupported-type coverage, versus baseline 9 with complete coverage.
Advertised schemas and retained coverage results validated with the SDK/Ajv.
No app, analysis target, or optional deep provider was executed.
Fixes#5590
Teach client deadline recovery before REA results can be discarded, distinguish
producer-owned server budgets, and preserve Evidence/cleanup uncertainty.
Include actual Codex CLI recovery probes and CLI/MCP regression coverage.
Fixes#5598
Assisted-by: Kogasa (gensokyo-skills:kogasa-surprise-testing)
Keep directly observed renderer listeners singular when bridge traversal
reaches them, while retaining separate paths for every exposed bridge member.
Preserve separate physical callsites and on/once operation identities.
Validation: 190 focused tests passed, including public CLI and stdio MCP
analysis and incoming feature tracing. Typecheck/lint and discovery passed.
The inert fixture was analyzed statically; no Electron target was executed.
Three alternating synthetic CLI tasks showed overlapping wall times (median
1.825s baseline, 1.808s current). Corrected bridge provenance increases serialized
task payload; no speed or context reduction is claimed. Actual model tokens
and full process-family CPU/peak memory were not measured.
Fixes#5586
Use the shared command supervisor for installation probes and retain exact
process cleanup owners through doctor, profile resolution, and session health.
Preserve exit status, bounded captured output, cancellation reasons, and live
cleanup facts. Block subsequent inspection until retained cleanup is retried.
Generalize the existing inspection resource scope and migrate its consumers,
including verifier scripts; remove the verifier's duplicate raw version probe.
Validation: 116 distinct focused tests passed, including built CLI doctor with
inherited output, cancellation/finalization, cleanup retry, and fake-provider
verifier workflows. Build, check:fast, and test discovery passed. No real Kuna
distribution or analysis target was executed.
Synthetic Darwin inspection timing: first-call median 707ms versus 5.79ms;
same-process repeat 37.9ms versus 3.08ms. First use includes ownership-helper
preparation. Family CPU and actual peak family memory remain unmeasured.
Fixes#5557
Reuse the cancellable segmented wait and settle observation termination through one cleanup owner. Preserve caller cancellation and release timers/listeners across early target end.
Fixes#3929.
Stop inheriting an outer nominal category when a zero-prefixed identifier cannot be decoded. Preserve exact manglings in unresolved results under class and enum filters while retaining ASCII nominal controls.
Validated 39 source and in-memory MCP tests, typecheck/lint, and 22 compiler-produced code symbols from an inert Swift 6.3.2 object. No real Hopper inventory or target execution. Fixes#5553.
Retain native-only dispatch workflows without requiring a deep provider profile. Validate exact target, operation, and current reader bindings during open, import, recording, and export; preserve selected deep bindings and caller limits.
Validated public CLI and stdio MCP save/reopen, exact CLI replay, changed-limit cache partitioning, baseline failure and candidate success on an Apple-clang fixture, snapshot lifecycle regressions, typecheck and lint. No target or deep engine execution. Fixes#5529.
Have method, property, ivar, and adopted-protocol list owners flag real budget omissions on returned class, protocol, and category records. Preserve known empty lists and existing decode reasons.
Validated 59 source tests, two built CLI controls, five static inspections of an Apple-clang fixture, and typecheck/lint. The target was never executed. Fixes#5543.
Classify wholly unknown or unavailable node observations at the version-item owner and retain their limitations across matched and unmatched comparisons. Preserve positive mixed observations and genuine additions/removals.
Validated source regressions and public CLI/stdout MCP workflows in the 103-test focused gate; typecheck and lint pass. Fixes#5534.
Add opt-in Go build summaries and selected retained metadata pages while preserving complete Evidence and source identity.
Validated with 258 focused tests, full static/docs checks, real CLI/SDK workflows and native metadata oracles. CI baseline remediation assertions reproduce on unmodified main; fail-fast cancels two other shards. Owner authorized bypass with those coverage limits recorded in PR #5524.
Fixes#5499.
Normalize non-finite timer literals to the existing unknown value at the semantic fact producer. Keep timers, source provenance, binding resolution and unrelated functions; preserve all finite delay values.
Qualify shared CLI/MCP behavior with precise regression oracles, 111 tests, actual source fixtures, real-package summary/fact/Evidence workflows and current-main integration.
Fixes#3400.
Keep installation availability and full doctor inspection facts separate from the setup ready-provider list. A blocked Kuna cache no longer advertises deep analysis; passing unverified-version notes remain usable.
Refs #5105. All 16 focused setup and public CLI dry-run controls passed; typecheck and lint passed. Tests use a scripted Kuna version fixture and do not establish real-engine behavior. The pre-existing doctor cancellation startup-poll failure is tracked separately.
Use the public rename API for an explicit empty existing name, retain omitted names and raw listing values, and verify fresh unnamed creation and explicit mutations by readback. Preserve independent verifier restorations and their primary failures.
Refs #5475. Focused bridge regressions and the complete real-Hopper suite passed on macOS arm64 with Hopper 6.6.0-demo 42.6316032. The verifier used a temporary unavailable Ghidra override to meet its sole-candidate prerequisite; reporter Hopper 6.1 remains unverified.
Give partial thin-header facts one domain owner and reuse them for standalone target admission and Mach-O load-command inspection. Preserve each consumer endianness policy and header/command checks; remove the FAT-only parser names.
Refs #5542. All 246 focused checks and six public CLI archive/image controls passed; typecheck and lint passed.
Reject browser scenario waits and action deadlines beyond the underlying signed 32-bit timer interval in the shared input contract. Preserve maximum legal values and omitted deadlines; prevent unsupported input from opening a browser.
Strengthen the rejection oracle and verify public CLI/MCP canonical validation in both schema profiles, actual Chromium timing/cancellation/cleanup, Evidence export and compatibility with current main.
Fixes#3392.
morluto