feat: compatibility-first analysis efficiency and domain-module pilot #2016

Outcome

Improve end-to-end REA investigation efficiency while preserving the working CLI/MCP workflows of existing users. Implement three increments in this order:

1. Measure the actual costs and improve known nested result types and caller-selected Evidence views.
2. Evaluate explicit, task-verified Ghidra analysis presets using the existing analyzer controls.
3. Pilot a small, statically composed domain-module descriptor for WASM or EVM, without introducing a general plugin ecosystem.

This is a concrete implementation and real-artifact verification follow-up to #740 and #1065. Those issues remain the owners of their broader architecture and performance roadmaps. Evidence lifetime design remains associated with #721; real demonstration coverage is related to #778.

The study starts from frozen main 42b0ed126df7d5b908ac369715378d5e519051b7 (2026-10-12 UTC). Each experiment records its own immutable runtime/corpus/provider pins; later integrations do not relabel the original measurements. Version publication and deployment remain outside this work.

Completion review — 2026-10-14

The original three increments are complete within their recorded scope: measured costs and typed opt-in result delivery; task-scoped Ghidra profile evaluation/lifecycle verification with unchanged defaults; and static WASM/EVM descriptor pilots with exact contracts and retained cleanup ownership. All 34 listed acceptance items have recorded evidence, and all 15 related implementation/experiment PRs are merged and present in main f3534749e564421036ac445f536fc766b038208f.

Measured decisions remain task-specific. Flutter/LocalSend's two actual model pairs reduce total input by 42.38–48.75% and task time by 23.95–30.30%. QGIS SQLite's existing column selection reduces total input by 36.44–57.63%, with mixed task time and no new API. Compact HTTP PCAP summary/page increases total input by 50.54–50.92%, so complete defaults remain the appropriate choice for that question. Descriptor wiring itself is not a token/speed improvement, and reduced Ghidra analysis lost callee facts, so no general fast preset is recommended. CPU/memory safeguards and phase measurements do not establish universal resource savings or verified unavailable terminal counters.

Additional protocols/artifacts/hosts, general plugin SDK/ABI admission, and persistent cross-session engine caches are optional follow-up work rather than unfinished requirements of the original scope. Existing-user and old-Evidence compatibility are supported by the pinned invocations and migration checks; every historical client/platform is not claimed verified. This review reconciles implementation and preserved evidence; it does not rerun the full real-model/provider matrix. The original scope is closed as completed; further measured opportunities are owned by the separate issues listed below.

Follow-up handoff — 2026-10-14

Closed as completed: all 34 recorded acceptance items for #2016 have scoped evidence, and its 15 related implementation/experiment PRs are merged. The original design, immutable measurement pins, positive/negative findings and compatibility qualifications remain here as the completed record. Creating the independent follow-ups does not reopen the original scope or claim new performance results.

All eight follow-ups carry exactly the same labels as #2016 (enhancement, P1: high, area: domain, roadmap, performance, design) and are assigned to N0zoM1z0. Each contains its own analyst question, bounded work, evidence/acceptance contract and compatibility/resource constraints. Broader roadmaps remain with #740/#1065; existing feature owners are linked rather than duplicated. Start with #3130 for the next measured capture round; #3136/#3137 are demand-gated research, not an instruction to implement caches or a plugin ecosystem.

Relevant experimental decisions belong in their new owning issue. PR-specific CI/review/rebase progress belongs in the corresponding PR; unrelated product defects remain in the local team handoff. Existing controls may be sufficient, and a well-supported no-change or unavailable conclusion completes the relevant research task.

Optimization priorities and progressive migration

The two primary objectives are agent token consumption and end-to-end task time. Memory and CPU consumption are also optimization objectives and remain bounded throughout experimentation. Correctness, meaningful Evidence/coverage, caller choices, and compatibility for existing users are acceptance conditions: a smaller or faster incomplete answer is not an improvement for the same question.

Prefer explicit, focused result delivery and reuse of retained Evidence where these preserve the requested facts. Keep existing complete requests available and unchanged. Do not silently reduce engine analysis, truncate Evidence, change source selection, or change a caller's provider to improve a metric.

Verification and migration are progressive. Extend the domain matrix one bounded step at a time, with real shipped artifacts for the changed domain and relevant shared-contract regression checks. Completing every advertised domain in one pass is not required. Native Windows PE and original UPX-compressed DOS MZ have been statically verified through Linux Ghidra in #2216. Native Windows runtime behavior, unpacked DOS editor logic and DOS COM remain unverified; managed PE/CLI does not substitute for native PE. Firmware region inspection, selected JavaScript AST analysis, and browser capture each retain their stated narrower coverage. Preserve unavailable and incomplete outcomes rather than treating them as global successes.

Compatibility directions are explicit:

• Existing clients / new REA: existing names, accepted arguments, complete defaults, provider choices and session semantics must continue to work. The current pilot is additive and opt-in; existing users need no new pack or request rewrite to retain shipped capabilities.
• Existing Evidence / new REA: preserve authenticated original records and IDs during import, inline use, new views and export. Actual baseline SQLite/Obsidian migration is recorded in the linked checkpoint.
• New capabilities / older REA: clients must discover the actual advertised schema and use supported existing equivalents where available. Older servers do not automatically understand the newly added selectors. A universal automatic fallback is not implemented or claimed by this study.

The current evidence is pinned to the recorded baseline, clients and real workflows; it is not an unconditional guarantee for every historical release, OS or third-party integration. The earlier 259e99dd9 runtime grows the complete catalog about 2.6% in compact JSON; the later main-integrated runtime records about 1.4% growth versus the original baseline, including intervening main changes. Keep this discovery cost visible alongside selected-delivery savings. Existing complete requests do not automatically receive the new token-saving delivery path. Newly found REA bugs remain documented locally for later team repair, as requested.

Evidence motivating the sequence

The previous optional Code Mode experiment is pinned at e65a13f54, using the earlier frozen production baseline fb94d9dde0ccda83ae520ac6fb22b1d283562cf3.

• Decision and migration boundaries
• Measured cohort and fingerprints
• Results, failed attempts, and verification limits
• Real artifact provenance and digests

Sixteen serial real Codex CLI trials, configured with gpt-5.6-terra high, covered Android, managed PE/CLI, Electron inventory, firmware, and Ghidra native analysis. Twelve passed the requested fact/reference assertions. Two bridge managed answers omitted a classification field; two direct managed JSONL transcripts truncated a producer envelope and prevented complete-envelope reference verification. These are different failure classes, and the stronger complete-classification assertion exceeded the question's general wording.

The bridge did not establish a stable overall speedup:

• Android bridge repetitions took 48.231 and 134.555 seconds, compared with 67.329 and 71.624 seconds directly. The model did not consistently select one composed execution.
• Guided Electron inventory reduced total input from 263,484 to 101,994 tokens, but uncached input only from 41,532 to 40,554; bridge wall time was 85.909 versus 67.540 seconds. Context compression is not equivalent to cost or latency reduction.
• Ghidra took 334.642 versus 327.150 seconds with unchanged analysis settings. Provider CPU remained the dominant measured work.
• SQLite WASM exposed a frozen WABT row-parser failure. Obsidian full AST analysis timed out with a retained partial reference. Neither is a successful Code Mode result; successful inventory answers do not replace AST analysis.

The existing bridge receives complete upstream results before projecting them. It can reduce model-visible data while retaining upstream analysis, serialization, transport, parsing, Evidence, and guest-transfer costs. REA already has typed domain ports, canonical named contracts, provider factories, owned-process primitives, snapshot replay, and retained Evidence views; reuse these rather than rebuilding them.

Compatibility contract

Compatibility is an acceptance condition for each increment, not a final documentation exercise.

• Keep the normal distribution usable with its existing capabilities. Existing users must not have to discover and install new packs merely to regain previously shipped tools.
• Preserve existing CLI command names, MCP tool names, argument meanings, caller-selected targets/providers/paths, defaults, result fields, structured/text delivery, and tagged failure semantics.
• Do not silently narrow the set of supported old inputs while improving producer output typing.
• Preserve the default complete-result path. New focused views, module selection, and analysis presets must be explicitly selected; no silent truncation or automatic switch to reduced analysis.
• Preserve the default complete and stable tool catalog. Any experimental pack-selection profile is explicit and fixed for that connection; opening a target must not remove tools.
• Configuration changes are additive and idempotent, with backups when files are written. Retain existing environment/configuration names and meanings. Do not install or upgrade unrelated host software.
• Preserve existing Evidence identity, raw/normalized distinctions, uncertainty, coverage, authority, session retention, and export/import behavior. In particular, do not silently change the default close_binary record lifetime.
• A derived view receives its own identity and links to its parent Evidence. A caller projection must not masquerade as the original canonical record under the parent's ID.
• New clients using new capabilities against older servers must discover actual support and use supported existing operations where an equivalent workflow exists; report unavailable capabilities honestly. Never change a caller's provider choice to create an apparent success.
• Use pinned pre-change invocations, configuration fixtures, and actual CLI/MCP clients as compatibility evidence. Pure composition changes should preserve catalog schemas/digests and public behavior; intentional additive schema/view changes require their own consumer checks.

Target architecture and ownership

The diagram below translates and tightens the architecture proposal. Solid arrows describe interface dependencies or provider execution; dashed arrows describe explicit production composition. Domain and application contracts do not import engine protocols. This is a target boundary map, not a proposal to move every file or ship three new package systems at once.

flowchart TB
    subgraph Entry["Existing entry points"]
        CLI["CLI"]
        MCP["MCP"]
        CM["Optional Code Mode client / bridge"]
    end
    subgraph Shared["Shared application and domain semantics"]
        WF["Typed operations and composed workflows"]
        PORTS["Domain capability ports and canonical contracts"]
        MODEL["Pure domain models, identity, coverage and error semantics"]
        EV["Investigation records and Evidence views"]
    end
    HOST["Production composition: static module descriptors\nnamed registration, typed factories and cleanup ownership"]
    AD["Engine adapters: Ghidra, IDA, JADX, WABT and others"]
    PROC["Owned process, session and resource supervision"]
    ENGINE["Local engines and artifact readers"]
    CLI --> WF
    MCP --> WF
    CM --> MCP
    WF --> PORTS
    WF --> EV
    PORTS --> MODEL
    EV --> MODEL
    AD -->|implements| PORTS
    AD --> PROC
    PROC --> ENGINE
    HOST -. injects .-> WF
    HOST -. constructs .-> AD
    HOST -. binds named contracts .-> MCP
    HOST -. binds existing commands .-> CLI

The extension roles remain separate:

Existing entry points retain their public behavior. The first descriptor pilot is an internal wiring change. A native and a firmware workflow can share an adapter implementation while still requiring separate Program instances for distinct targets. Reuse of a live instance requires matching target/profile/revision and a single clear owner.

Engine sessions and investigation Evidence have different responsibilities, but the first increments preserve the existing record lifetime. They do not silently retain records after close_binary; portable export/import is the initial cross-session continuation.

Increment 1: cost measurement and precise result delivery

Establish a comparable baseline

Record artifact and provider digests, exact revision, operation arguments, analysis settings, CPU/memory limits, client/model configuration, and cold/warm state. Separate:

• Engine launch, import, auto-analysis, readiness, and first/warm query where those stages are observable.
• Queue wait and provider operation time.
• Result assembly, validation, retained Evidence/cache work, serialization, transport bytes, and client parsing/validation where measurable.
• Tool discovery, model turns, repeated operations, failures/retries, API token usage, complete task time, and useful answer quality.

Add instrumentation at the boundary that owns each measurement. Diagnostic timing must not change canonical Evidence identity or retain an unbounded history. Report unavailable stage measurements explicitly rather than inventing a decomposition from total wall time.

Improve known nested payloads and selected views

Start with inspect_artifact's nested inventory Evidence and the existing inspect_analysis_view machinery. Where an operation guarantees a known payload, advertise and validate its concrete nested structure instead of generic JSON. Reuse canonical schemas to derive authoring types and examples.

For repeated questions such as manifest, entry-kind counts, and selected root occurrence records, offer the smallest justified caller-selected view, with the selection scope, original identities, coverage, unknowns, limitations, and contributing Evidence links. Retain the complete source record under its existing lifecycle. Repeated views must not re-run the producer.

Measure the changed SDK-converted catalog as well as runtime results: a more precise schema can increase discovery size. Validate the declared JSON Schema dialect and actual client calls. View projection after analysis and producer-side query pushdown are separate experiments; do not claim saved engine work from a smaller response alone.

Acceptance:

• A pinned, reproducible baseline distinguishes measured costs and unknown stages.
• Known nested output is validated and discoverable through the actual SDK/client boundary.
• Existing full output/defaults and old inputs remain usable.
• Focused results preserve meaningful source, selection, uncertainty, and coverage.
• Retained follow-up does not re-run the producer and survives relevant partial failures.
• Real large-artifact runs show the measured benefits and any regressions, including parsing/serialization and peak memory.

Increment 2: explicit, task-verified analysis presets

Use the existing REA_GHIDRA_DISABLED_ANALYZERS support and committed analysis profile. First measure default behavior; then evaluate one narrowly scoped alternative against exactly defined analyst questions.

• Keep the default profile unchanged.
• Specify engine version, applicable target formats/languages, selected settings, task scope, evidence available, and explicit unknowns.
• Measure cold startup/import/analysis and warm query separately; use matching CPU/JVM limits.
• Verify the task's necessary facts, not just shorter wall time. Missing xrefs under reduced analysis do not establish their absence.
• Keep effective settings in profile/cache identity. Old cached results must not be replayed under a different preset.
• If later work introduces incremental analysis, it needs an explicit readiness/analysis revision and coverage commitment. That lifecycle change is not required for this first preset experiment.

Acceptance:

• Existing default invocations produce compatible behavior.
• The selected alternative is verified on real shipped binaries with pinned questions and producer evidence.
• Profile differences and limitations are visible; cancellation, failure, cleanup, and snapshot compatibility are covered. Verified in test(analysis): verify real preset snapshot and cleanup boundaries #2349 with actual Linux Ghidra 12.1.4 default/disabled profiles, GNU true and jq snapshot workflows, startup cancellation, invalid-analyzer failure, and permission-induced cleanup retry; this does not imply other OS/provider coverage.
• Any performance recommendation is restricted to the tested task/format/provider scope.

Increment 3: one small domain-module descriptor pilot

Choose WASM or EVM based on the refreshed source and provider results. Keep one local distribution and explicit static composition. The descriptor should bind existing exact contracts, typed service/provider factories, adapter registration, availability/effects, and owned cleanup. Preserve compiler checks inside each module and validate unknown values at actual dynamic boundaries.

Maintain these ownership rules:

• Pure domain data/semantics and typed application ports remain independent of specific provider protocols and CLI/MCP implementations.
• Composition constructs implementations and injects them. A module descriptor must not become a provider-specific dependency in core domain code.
• Domain, engine, and workflow extensions remain distinct. Complementary Android bytecode/resource/runtime capabilities must not be forced into one interchangeable universal provider interface.
• Sharing an engine adapter is not sharing one global Program/session. Reuse requires the correct target, profile, revision, and owner; different targets retain separate mutable analysis state.
• Resource registration happens when the module acquires resources. Failed cleanup retains ownership and permits meaningful recovery; unloading must not discard an owned resource merely because close failed.
• Optional module failure must preserve healthy peers and disclose the failure.

Acceptance:

• One domain is wired through its descriptor with fewer independently maintained core registration/cleanup points.
• Default catalog, old CLI/MCP inputs/results, provider choices, and lifecycle behavior remain compatible.
• Duplicate names and incompatible contracts fail clearly before use. Scoped to the static pilot: test(evm): verify static descriptor bindings before use #2427 verifies exact operation/CLI/factory/input/output assignability in the complete compiler gate and actual SDK duplicate registration before any provider call. Dynamic third-party ABI/version admission is not introduced; validating unknown provider replies after execution remains a distinct boundary.
• Actual CLI/MCP workflows cover unavailable providers, malformed inputs, cancellation, capacity, partial failures, and cleanup retry. Linux x64 real EVMole/prlimit verification from refactor(evm): bind offline analysis through a static descriptor #2261 and test(evm): verify real worker cancellation and cleanup recovery #2404, including actual worker replies, late SDK cancellation, permission-induced retained cleanup recovery and a healthy real WABT peer; mid-WASM interruption and other hosts are not claimed.
• Packaging and generated projections remain derived from owning source.
• The changed architecture is followed by cross-domain real-artifact regression, not only recording-port tests.

Real-artifact and real-model verification

Reuse the previously digest-verified public corpus where suitable, and add public shipped artifacts for uncovered available domains. Keep binaries, provider projects, raw target output, temporary credentials, and local profiles outside Git. Record acquisition URL/version/digest and preserve exact target bytes.

Extend this matrix to other advertised domains affected by the composition change. Distinguish an unavailable OS/engine/input lane from a passed real-provider test. Linux results do not prove Windows/macOS, Hopper, IDA GUI, ADB-device, or other unavailable provider behavior. Real application and real-provider success must never be inferred from simulated ports.

Run comparable fixed replays first to isolate implementation cost, then use real Codex CLI with temporary isolated configuration pointing to the modified REA MCP. Keep the requested model/configuration explicit; initially reuse gpt-5.6-terra high for comparability. Grade requested facts, explicit unknowns, cleanup, and source references against actual producer evidence. Verify per-claim support where feasible, beyond merely seeing a valid ID in a transcript. Save failures, retries, transcript truncation, and timeouts in the results.

Separate cold/warm sessions and cache states, interleave pair order, and repeat representative pairs. Record total/cached/uncached input and output separately without treating token totals as currency cost. Claims remain descriptive until the sample supports stronger conclusions.

Host resource controls

• Heavy builds/tests/provider/model trials run serially in owned resource scopes.
• Initial aggregate trial limits: one CPU, 4 GiB hard memory ceiling, 3 GiB early-stop threshold, no swap growth, and bounded tasks; refuse starts when host available memory is low.
• JVM/Node/worker limits fit within the aggregate budget. Account for object copies, serialization expansion, retained Evidence/cache, and temporary disk before increasing concurrency.
• Record sampled family memory/tasks, CPU usage, resource-limit events, timeout/abort reasons, and owned cleanup. A limit event invalidates a purported successful performance run.
• Delete disposable model profiles and copied authentication material on success, failure, cancellation, and timeout. Do not capture the ambient environment.
• Do not kill processes using a PID alone or touch user-owned GUI databases. Preserve owned resources whose cleanup is unverified.

Deferred decisions

General third-party plugin SDK/distribution, automatic plugin discovery/hot reload, cross-session Ghidra database persistence, and broad shared-query concurrency are deferred until actual demand or measured repeated work justifies their compatibility and lifecycle costs. Code Mode remains optional; this issue does not switch existing users to the external bridge.

Completion evidence

• Commit the implementation, relevant compatibility/boundary tests, source-authored documentation, and curated measurements.
• Run appropriate source, focused artifact, typecheck/lint, schema, generated-doc, packaging, and real-provider checks for the touched boundaries.
• Repeat the available real-domain matrix against the modified runtime after the descriptor integration.
• Publish a final issue update linking commits and describing what changed, measured outcomes, compatibility evidence, failed attempts, and unverified lanes.
• Push progress to the implementation branch and create the explicitly requested review PR (feat(analysis): add opt-in retained inventory and WASM views #2122); the maintainer subsequently authorized a verified merge and continued work; version publication and deployment remain unauthorized.

Experiment record ownership (2026-10-12)

Detailed generated result JSON is archived byte-for-byte outside the checkout and excluded from the final PR tree. Source-owned corpus inputs, reproduction scripts, measured findings, frozen revision/digest references, compatibility qualifications remain in the experiment notes. Historical checkpoint commits remain intact.

Latest-main continuation: newer capability efficiency audit (2026-10-13)

The refreshed main pin is f254f5ac2b804b353a711264bb178f43fdf07867, unchanged since the preceding Android merge. This continuation audits features added during the earlier implementation cycle that were not all included in its final performance matrix; it does not claim new commits after that merge. Work is isolated on perf/latest-main-efficiency-20261013 in a fresh worktree. Original completed acceptance evidence remains intact.

First bounded experiment: official LocalSend 1.18.2 arm64 Android APK, release asset SHA-256 82ec3568fba2aa5295b9aae8b76f701d7a4703d86b9f8bad749472038fbaeab3, 46,558,706 bytes, from the official release. Analyze bytes only; do not execute the APK. The existing frozen runtime 28c84e78cf2fbfde4aceed345b773c59eb889f68 has byte-identical production source to this main pin, so baseline receipts retain that actual runtime revision and digest rather than being relabeled.

Proceed from measurement to one justified change, then repeat equivalent real SDK and Codex tasks. A smaller response alone does not establish lower model tokens, latency, CPU or memory. Do not duplicate SQLite/packet/signal selectors that already exist, introduce generic plugin/cache infrastructure, silently change full defaults, or fix unrelated REA defects. New unrelated findings remain in the separate /tmp handoff.

Continuation acceptance:

• Record bounded real-artifact baseline, source/runtime/provider identity, requested facts and costs for the selected new lane.
• Justify the smallest implementation from observed cost; preserve old requests/full defaults, caller choices, partial facts, Evidence identity and owned cleanup.
• Verify retained/portable reads and affected schema/CLI/MCP boundaries, distinguishing fixtures from real application evidence.
• Repeat actual model/task comparisons with total/cached/uncached input, output, time, errors and quality; retain regressions and failed attempts.
• Commit/push source and curated evidence, review exact-head CI and merge only after verification. Anonymous author email and requested co-author trailer remain mandatory; no release/deployment.

All heavy local work stays serial under one CPU, unchanged 3 GiB early-stop / 4 GiB hard memory / no swap and owned task scopes. Kernel payload-phase observations remain distinct from unavailable whole-scope final counters. Downloaded binaries, raw replies/models and configuration stay private outside Git.

The selected Flutter lane verifies real LocalSend SDK pairs, previous-runtime complete defaults/portable Evidence and four factually correct Codex answers. Detailed paired results retain failed/repeated attempts and unknown final counters. Total input falls 48.75% / 42.38%, uncached input 33.63% / 42.52%, and task time 23.95% / 30.30%; SDK bytes fall 92.05% while SDK workflow time is approximately unchanged. These are one app/question/configuration results, not all-domain completion.

Latest-main Flutter continuation completed (2026-10-13)

Flutter delivery implemented in #2455, commit 23de4f77c74dd299d45cab880c36321d802b21fe.

The five continuation acceptance items above are complete for the selected Flutter lane. Curated LocalSend SDK/model/migration measurements preserve exact frozen pins, all attempts, cached/uncached usage and unknown final resource counters. Reply bytes fall 92.05%; both actual Codex pairs pass selected factual checks with 42.38–48.75% less total input, 33.63–42.52% less uncached input, and 23.95–30.30% less task time. SDK workflow time stays approximately unchanged. These are one app/question/configuration results including actual model retries/repeated calls, not universal or engine-speed claims.

Real Flutter compatibility checks preserve complete/summary SDK facts, all 2,716 original strings through 15 old-Evidence continuation calls with the APK absent, and unchanged CLI complete facts/subject/parameters/ID. The integration runtime file-table digest is 614e687629c8b92424fa33e655848bde92922c40c7dd6953bff6af2d10c61961. These migration checks remain separate from the frozen model measurements and unknown terminal resource counters.

SQLite/QGIS and compact-PCAP continuations are complete, with recorded no-new-API decisions. Larger/non-HTTP TShark, sigrok, SAZ, qlog, retained investigation paging and remaining coverage planning are tracked in the follow-up issues below. Plugin SDK and cross-session engine reuse remain demand-gated research. Original acceptance evidence and the gradual compatibility-first migration plan remain intact.

Next real-data round: verify existing controls before adding code (2026-10-13)

Explore carefully: if measurements do not establish a useful improvement, do not implement another optimization. This SQLite round is pinned to main 172407787f1842dedbcd27b5385177595f786ce4 and makes no real-Windows performance claim.

Re-check existing SQLite, packet/signal and SAZ/qlog selectors. SQLite already defaults to compact inventory and exposes exact table/column and schema-scope choices; unselected cells are not evaluated/projected. Packet/signal tools already expose fields/annotations and output windows. SAZ/qlog already have retained summary/page ownership. Do not duplicate these controls or introduce a cache merely because it could exist.

First real target: QGIS's shipped world-map GeoPackage, from immutable official source commit e1223b8e9e71fc50ee995ed556f711c54ccc101b, 12,914,688 bytes, Git blob c9ff80228dff0de93c9acdef16a97545ba360244, SHA-256 01d293159d1b77bd9212b5252587853f61aa9e25b2387135f34afaba8d057190. Official asset and upstream provenance. Downloaded bytes match the upstream Git blob. This is actual application data, not a generated REA fixture; QGIS is not installed or executed.

Compare the same requested SQLite row facts through public REA CLI/MCP: table default/all-visible columns versus existing exact columns, then compact inventory scope when it still answers the question. Keep the same row limit and preserve typed 64-bit integers, exact text bytes, SQL NULL, database/WAL identity, engine identity, original limitations and explicit unspecified/truncated row order. Preserve both original schemas; scope differences are not silently erased. Fresh process state is distinguished from host page caching. If source projection changes observed row order, record it rather than claiming equivalent samples.

If SDK results justify a treatment, repeat actual Codex CLI tasks with the same question and tool set, requested gpt-5.6-terra high, isolated temporary configuration and measured REA runtime. Report total/cached/uncached input, output, whole-task time, failed/repeated calls and factual quality. Fewer reply bytes alone are not a model-token or speed result. Keep negative/no-benefit findings and avoid production/API edits if existing controls suffice.

Round acceptance:

• Record actual current-main/corpus/runtime identities, existing controls and real-artifact baseline.
• Compare equivalent selected facts and preserve original scope, precision, provenance, source bytes and relevant CLI/MCP contracts.
• Repeat justified real-model comparisons with all attempts and honest token/time/resource scope; explicitly record no-benefit results.
• Record the evidence-led decision (including no production change), commit/push useful reproduction/curated findings, and verify any resulting PR before normal merge; no release.

Unchanged safeguards: heavy work serial, one CPU, 3 GiB early stop / 4 GiB hard memory, no swap, owned task scopes and host-availability checks. Payload observations do not certify missing final whole-scope counters. Raw binaries/replies/model traces/configuration remain private outside Git. Unrelated REA defects are handed off in /tmp/rea-analysis-efficiency-bugs-20261012.md, not fixed in this round. Other domains remain incremental, not claimed complete.

SQLite round result: existing controls suffice

No production/API, default, provider annotation, SDK or cache change is justified. The current shipped tool already preserves full selected-table schema while columns: ["fid", "NAME", "ISO_A3"] avoids unrelated geometry values. QGIS SDK replies fall from 485,277 to 18,509 bytes (about 96.2%). Both paired selected-fact comparisons pass; full SQL/schema/null/tagged sample facts and database/WAL/engine identity remain intact. SDK time and CPU do not improve: selected workflows are slower in these observations, and timings vary substantially. Keep those results rather than crediting bytes as speed.

Four corrected actual Codex trials (requested gpt-5.6-terra high, one exact enabled tool, same frozen main runtime) pass every selected fact and cleanup check. Total input falls 57.63% / 36.44%, uncached 54.14% / 44.08%. Time is mixed: 4.17% slower / 14.39% faster; output 10.77% lower / 6.94% higher. Actual repeated calls stay counted (all=2/2, columns=1/2). This supports scoped existing-selector token savings, not a stable speedup or a new mechanism.

The initial four model calls were blocked by the isolated client's approval policy and have no SQLite result; all factual grades fail. The experiment driver now uses its existing exact per-tool approval entry for SQLite while exposing only that selected tool. Corrected cohorts are separate; original failures and costs remain retained. No global Codex configuration or REA authority/annotation is changed.

Actual CLI inventory/all/columns results, subjects, caller parameters and IDs equal corresponding complete MCP records; original bytes remain unchanged. Independent read-only SQLite 3.40.1 binding agrees with exact table SQL, eight declared columns and tagged sample. Six existing context/driver tests, Python compilation and JS syntax checks pass. Missing terminal whole-scope counters remain unknown; narrower payload observations verify cleanup and phase events.

Existing SQLite documentation and skill guidance already recommend column selection; the measured result does not justify a redundant product change. Other domain lanes remain incremental.

SQLite round completed — PR #2489

SQLite experiment #2489 merged as 45984a4319c8b6dcf2b03e969fbd4330c8432394. The change is confined to seven experiment files; production implementations, APIs and complete defaults are unchanged.

SQLite measurements remain pinned to main 172407787f1842dedbcd27b5385177595f786ce4. Real CLI/MCP parity and independent read-only SQLite access agree on the requested schema/cells. Subsequent SDK compatibility checks preserve selected facts and source bytes without extending the model-performance scope.

The SQLite factual grader distinguishes missing from explicit null and preserves exact JSON scalar types. All four stored model answers pass; omitted wal and boolean row_limit mutations fail. Original blocked trials, transcripts and usage remain private and intact; review fixes do not rerun models.

Decision remains use existing controls; no new production optimization. SDK reply bytes fall about 96.2%; actual total model input falls 57.63% / 36.44%, uncached input 54.14% / 44.08%. SDK time/CPU show no improvement and model time remains mixed (4.17% slower / 14.39% faster). These are QGIS/schema-and-sample observations, not universal speed or memory claims. Resource controls remain one CPU, 3 GiB early stop / 4 GiB hard memory and no swap; unavailable final whole-scope counters remain unknown.

All four acceptance items for this round are complete. Other packet/signal, SAZ/qlog and application/platform questions remain incremental evidence-led follow-ups; continuations are tracked in separate issues below. No unrelated REA product bug was identified in this round.

Packet-capture real-data round (2026-10-13)

Main is pinned to 3ae826ceba6f25b08bce50bcb51001209bc16b57, with 23 post-SQLite commits, including bounded PCAP summaries/retained pages, authenticated artifact subjects, unknown-snapshot reuse and shared transcript grading. The new PCAP family already exposes complete defaults plus opt-in summary/pages; do not duplicate it. Existing selected-field TShark inspection remains a separate analyst boundary, not an interchangeable complete-inventory claim. Work is isolated in perf/2016-packet-real-data-20261013.

First targets are the unmodified HTTP request/response and HTTP redirects recordings published on the official Wireshark sample-capture page. Pin downloaded sizes/digests and original URLs; do not claim an independently published upstream digest where none is supplied. These are saved captures, not newly acquired traffic or executions of recorded targets.

Fix one question: complete capture identity/metadata, all observed and retained inventory counts, source coverage/limitations, and the first two retained HTTP URIs in original order. Compare existing complete inline delivery with summary plus an exact retained URI page on the same frozen runtime. Extra RPC/schema/retry costs remain counted; an exhausted URI page does not prove network completeness. Start with small real captures, where extra paging may be a net loss. Use actual CLI/MCP and independent raw capture facts; actual repeated model tasks determine token/time effects when the comparison remains justified. Negative results are useful and do not justify changing defaults or adding production mechanisms.

• Pin runtime/corpora and inspect actual live contracts before measurements.
• Compare equivalent selected facts through real complete and summary/page workflows; preserve original replies and independent validation.
• Record completed-task token/time/CPU/memory evidence, failed/repeated calls, and justified unverified scope.
• Make the evidence-led decision, save useful reproduction/results, and verify any PR before normal merge; no release.

Resource controls remain unchanged: serial heavy work, one CPU, 3 GiB early stop / 4 GiB hard memory, no swap and owned scopes. New providers or target execution/mutation are outside this round. Raw captures, replies, model traces and temporary profiles remain private. Unrelated REA defects go to /tmp/rea-analysis-efficiency-bugs-20261012.md for team follow-up, not fixes here.

Small-PCAP result: complete delivery wins on total input

Two unchanged official Wireshark recordings are pinned: HTTP http.cap, 25,803 bytes / SHA-256 25a72bdf10339f2c29916920c8b9501d294923108de8f29b19aba7cc001ab60d; redirects http_redirects.pcapng, 47,804 bytes / SHA-256 ff432a6b71d06cd20720f7763e584014edd0a43c3b55981c682d1b7640207abc. Local hashes pin downloaded bytes; upstream independently published digests remain unknown. Frozen main runtime file-table SHA-256 is db050545e94dc305a48042e06df96ac6c64b21ee6c5c4707c787d5e46df79e47, Linux/Node 24.18.0, SDK 2.3.1, actual Wireshark 4.0.17.

Eight real SDK trials (complete/summary/summary/complete per recording) match selected metadata/counts/URI facts, settings and source bytes. Original delivery limitations/IDs/source-versus-page coverage remain retained separately. Complete replies are 7,601 / 7,535 bytes; summary plus a URI page totals 17,540 / 17,240 bytes. All four SDK pairs are slower and consume more payload CPU; memory is mixed. Fewer bytes are not inferred as tokens.

Four actual Codex CLI 0.161.0 tasks (requested gpt-5.6-terra high, same question/runtime/providers/two enabled tools) all pass selected facts. Complete input is 38,947 / 38,917; summary/page input 58,779 / 58,584: total input increases 50.92% / 50.54%. Output increases 52.95% / 51.48%. Uncached input is mixed, 28.75% lower / 28.74% higher; time is mixed, 103.41% slower / 52.37% faster. Cached input stays included in totals; actual reasoning/output and all calls are retained. No extra/repeated/failed MCP call occurs. Original bytes and all temporary-profile cleanup checks pass. No caching/time cause is inferred.

The initial summary grade rejected equivalent explicit labels and a URI object carrying correct page/source coverage; this was an experiment-grader representation issue, not incorrect model facts or a REA defect. The grading boundary now accepts those known forms while rejecting omissions, wrong types, contradictory duplicates, false page exhaustion and unsupported claims. Original reviews/source/answers remain intact; no model is rerun. Nine context/grading regressions and four mutations of a real stored answer pass their intended positive/negative checks.

Independent stdlib raw PCAP/PCAPNG/Ethernet/IP/TCP/HTTP-header parsing agrees on 43/271 packets, endpoint counts, URI prefixes and 2/23 distinct HTTP URIs, without invoking Wireshark. DNS associations, protocol-stack dissection and nullable timestamps are not independently validated. Both actual CLI complete results match full MCP result/subject/parameters/ID/limitations; portable CLI summary/page normalized facts and subjects match MCP retained views, preserving distinct caller/source forms.

Decision: no production optimization. Keep complete defaults and existing explicit choices. These compact captures and this question do not justify a new API, automatic summary switch, plugin layer or cache. Larger captures, other protocols/platforms and model workloads remain incremental/unverified.

Heavy work remains serial under one CPU, 3 GiB early stop / 4 GiB hard memory and no swap. Build peak is 2,575,732,736 bytes; payload cleanup/zero phase limit events are verified. Missing terminal whole-scope counters remain unknown and strict resource grades false. Raw captures/results/traces/config remain private. No unrelated product defect is identified or fixed; no release is performed.

PCAP experiment acceptance and completed decision

PR #2640, commit c7105d9723c835b5e0122f5fc6cfbea86265c349, preserves the negative compact-PCAP result. Curated corpus, source/runtime pins, measurements and reproduction. Final scope is nine experiment files and one discovered evaluation test; production APIs/defaults/cache are unchanged.

SDK acceptance authenticates complete/summary/page Evidence through the pinned runtime's existing parser. It preserves subject/path/digest, exact requested facet/range/coverage and JSON scalar values, producer/tool/operation ownership, unique reply IDs and linked retained-parent ID/digest. Present normalized limitations/unknowns must be string arrays; absence and valid empty arrays remain distinct. Legitimate summary delegation is preserved.

Factual and exact-workflow grading are separate. Workflow acceptance requires the planned ordered calls/arguments, successful readable replies and exact citation cardinality. Failed or malformed replies retain diagnostics and supported partial facts. Synthetic fixtures and consumer fault injections establish acceptance guards, not real-provider malformed behavior.

All 18 original SDK/model receipts authenticate. Thirty-four context/grading regressions, six discovered comparator scenarios and all four stored model answers pass their recorded checks without model reruns. The comparator uses the existing evaluation project; the duplicate manual suite is removed. Original bytes/tokens/timers and runtime 3ae826ceba6f25b08bce50bcb51001209bc16b57 remain unchanged.

Decision: for these two compact HTTP captures and the fixed metadata/URI question, summary/page total input worsens about 51% in both pairs; keep existing complete defaults. Other question/domain results are not inferred from this corpus.

Future bounded comparisons may use existing protocol/field discovery to select exact fields on real non-HTTP captures, counting discovery/schema/RPC/retry costs and preserving provider-specific field identity. Larger captures, signal, SAZ/qlog and application questions remain unmeasured lanes. Plugin SDK and cross-session engine caching remain deferred. Further opportunities are tracked in the separate issues listed below.