30 concrete improvement proposals with source references and acceptance checks

[Afloat16]

I would like to contribute a small, reviewable improvement. This discussion collects 30 scoped candidates for maintainer triage, with the current fact, a proposed route and an acceptance check. It is a proposal inventory, not a request to accept all 30 or a claim that each is a confirmed runtime bug.

Reviewed baseline: f09f454f45d667a95b38be61ba6fde193bd08774. A refresh against 788964d52c62aa5b29b342e31b37fe63a27d69d1 found all 47 cited source-file blobs unchanged. Links remain pinned to the reviewed baseline.

Evidence and duplicate-check scope: reviewed the 3,778-entry cross-state issue/PR index, the latest listing and focused related issue/PR searches. Related work is noted below; matching screenshot-bound and broad summary-paging proposals (#2988, #2701) were excluded. Helper/boundary probes ran on Node v24.19.0 and are labeled individually. Native SQLite/Node oracles establish their underlying behavior only. No complete REA CLI/MCP/provider workflow, full test suite or performance benchmark is claimed. Proposed checks have not been reported as passing; uncertain format compatibility remains explicit. These proposals reuse existing inspection, evidence and lifecycle owners; public-contract and scope decisions remain for maintainer triage.

Could you indicate which candidates fit current priorities? 1 ($ref siblings), 17 (qualified WebSocket constructors), or 20 (duplicate client IDs) look like possible first focused PRs, subject to maintainer triage. Acceptance below means a proposed verification condition, not maintainer approval.

Contracts, Evidence and output windows

1. Count valid $ref siblings in the input-presentation budget

Evidence: executed exported-helper probe (Node v24.19.0), not a Pi/client run. The counter returns after following a resolved $ref, skipping its schema-valued siblings. A fixture with 33 resolvable occurrences reports 17 and retains the shared form at budget 32. Traverse both target and schema-valued siblings using path-scoped cycle handling; exclude literal annotation/const/enum data. Acceptance: sibling, cycle and 32/33-boundary fixtures select the intended presentation; validate the converted SDK catalog separately. Related original budget work: #1749, #1632.

Sources: inputSchemaPresentation.ts:275-295; inputSchemaPresentation.ts:316-321.

Compact exported-helper fixture (run from the pinned checkout)

node --experimental-strip-types --input-type=module <<'NODE'
import {
  countLocalReferenceExpansions,
  inputSchemaWithinReferenceExpansionBudget,
} from './src/contracts/inputSchemaPresentation.ts';
const ref = () => ({ $ref: '#/$defs/leaf' });
const shared = {
  $defs: { leaf: { type: 'string' } },
  type: 'object',
  properties: Object.fromEntries([
    ...Array.from({ length: 16 }, (_, i) =>
      [`p${i}`, { ...ref(), allOf: [ref()] }]),
    ['extra', ref()],
  ]),
};
const inline = { type: 'object', title: 'inline-control' };
console.log(countLocalReferenceExpansions(shared)); // observed: 17; 33 occurrences
console.log(inputSchemaWithinReferenceExpansionBudget(shared, () => inline, 32) === inline);
// observed: false; proposed corrected result: true
NODE

This probes the exported selection helper; it does not test a real client, gateway or complete catalog.

2. Keep partial-Evidence retention errors beside the original failure

Evidence: source-derived error path; not runtime reproduced. When recording a partial observation fails, toRecordedPartialErrorToolResult returns only the original analysis error and discards the recording failure. Preserve the original code and partial facts, adding explicit retention status and the tagged retention error; reuse the existing oversized-error projection pattern. Acceptance: an injected recording failure at the public MCP boundary preserves both reasons, target provenance and wire limits without inventing a retained reference; successful recording remains unchanged. #2398 concerns provenance accounting, rather than this failure diagnostic.

Sources: toolResult.ts:105-126; EvidenceMcpServer.ts:434-449.

3. Validate file-offset interval ordering at the owning parser

Evidence: source-derived validation proposal; no import reproduction. file-offset-range validates nonnegative start and end independently, allowing the shown shape to describe a reversed interval. Define the interval convention once and validate ordering at its owner, preserving permitted empty ranges and exact accepted offsets. Acceptance: parser and public bundle-import regressions reject reversed ranges with a typed issue and accept documented valid/empty controls. Keep advertised per-field constraints accurate; ordinary JSON Schema must not promise unsupported cross-field enforcement. #1973 concerns container/slice coordinates, a different question.

Sources: evidence.ts:87-105.

4. Offer opt-in revision-bound unknown-head pagination

Evidence: source-derived consistency proposal; no concurrent runtime reproduction. Each listUnknownsPage call filters and sorts live heads before offset slicing. Membership can change between pages, so per-response ordering does not establish a complete cross-page snapshot. Keep live defaults; consider an expected ledger revision, snapshot continuation, or a documented frozen-bundle route. Acceptance: insert a lower-sorted head and change a filtered status between pages; an opted-in read returns the original membership exactly once or a typed stale-revision result. #2701 already distinguishes live summary paging from snapshots; this concerns list_unknowns consistency.

Sources: EvidenceLedger.ts:329-357; sessionToolSchemas.ts:49-71.

5. Validate discrete token-window numbers before command execution

Evidence: executed argument-helper probe (Node v24.19.0); full CLI not run. Negative token limits, fractional offsets and unsafe integer offsets currently pass parsing and validation; downstream code uses offsets for token slicing and continuation arithmetic. Define nonnegative safe-integer semantics, retaining any intentional zero-limit behavior and both flag spellings. Acceptance: helper and executable regressions cover negative/fractional/overflow/NaN/infinity inputs, valid boundaries and structured-output combinations; rejected input produces one complete error document, nonzero exit and no command execution. #3811/#1371/#777 cover adjacent output handling, not these numeric constraints.

Sources: cliOutput.ts:105-113; cliResultOutput.ts:266-277.

Artifact readers and embedded metadata

6. Retain Rust snapshot ownership when close fails

Evidence: deterministic injected filesystem boundary probe, not a real Rust executable. Rust uses the unscoped stable reader. An identity mismatch followed by synthetic close EIO surfaced only the close error, with no retained cleanup owner. Reuse the scoped resource lifecycle already present in the Go adapter and preserve primary plus cleanup diagnostics. Acceptance: inject identity-change/close-failure and successful-read/close-failure combinations; retain the handle and original reason until a later provider close succeeds. #2541/#2542 concern process cleanup rather than this file-handle owner.

Sources: RustBinaryProvider.ts:40-53; readStableArtifact.ts:136-148; GoBinaryProvider.ts:146-176.

7. Interrupt an outstanding snapshot read on cancellation

Evidence: injected idle-stream boundary probe; real slow filesystems not tested. Cancellation is checked after the iterator yields, while createReadStream receives no signal. An idle synthetic stream remained unsettled, with no close, 25 ms after abort; destroying that stream was needed to finish. Connect cancellation to the active stream and remove listeners on settlement, preserving typed cancellation and retained cleanup ownership. Acceptance: a no-chunk fixture settles without a producer event; close runs and failed cleanup remains retryable. #3197 concerns admission cancellation, rather than this post-open wait.

Sources: readStableArtifact.ts:88-109.

8. Fill valid ZIP short reads before treating metadata as truncated

Evidence: exact extracted-method probe with a fake handle, not a real ZIP/OS short read. readUint8Array performs one read and returns its prefix. An eight-byte in-bounds request returned three bytes after one call. Fill the requested admitted extent until complete, confirmed EOF, cancellation or typed failure; retain allocation and identity checks. Acceptance: a 3+3+2 seam delivers eight bytes; premature zero-byte reads yield a typed integrity/truncation reason, including a valid ZIP fixture through that seam. #3659 addresses central-directory admission rather than short-read completion.

Sources: ZipArtifactReader.ts:123-140.

9. Clarify mixed ASAR node metadata at its parser owner

Evidence: source-derived compatibility proposal; accepted Electron variants are NOT_ENOUGH_INFO. The loose node shape admits combinations of files, link and file metadata; consumption chooses a directory before a link/file. Establish which mixed variants Electron intentionally accepts before adding stricter rejection. Own classification once, preserving original declarations and limitations or rejecting established invalid variants with a typed reason. Acceptance: mixed files/link/size fixtures follow that documented rule; normal serializer-produced directory, link, packed and unpacked entries remain compatible. Existing ASAR whitespace work concerns framing, not mixed-kind interpretation.

Sources: AsarListing.ts:7-24; AsarListing.ts:91-105; AsarArtifactReader.ts:85-112.

10. Measure and control aggregate WASM glue-reference growth

Evidence: source-derived resource proposal; peak memory, CPU and workload frequency unmeasured. Each matching .wasm literal retains a reference object and a copied array of candidate references; serialized path values also repeat. Array copies do not establish duplicated string-byte allocation. Measure aggregate producer/output growth first, then share candidate identities and introduce only justified admission rules with explicit resource/coverage outcomes. Acceptance: representative repeated-literal and normal fixtures retain source coordinates and complete/default semantics; compare whole-task tokens, time, CPU and peak process-family memory. #2694 bounds WABT subprocess output, a different producer.

Sources: WasmGlueAdapter.ts:16-23; WasmGlueAdapter.ts:25-67; WabtArtifactProvider.ts:263-284; wasmArtifact.ts:19-20; wasmArtifact.ts:64-81.

11. Attach exact source spans to parsed Go module records

Evidence: source-derived provenance enhancement; existing behavior is not claimed broken. Go already retains whole-artifact and module-body provenance, but individual dependencies, replacements and build settings lose their line byte coordinates. Have the module parser retain exact spans once and pass them to consumers, coordinating with #3604's parse-owner refactor. Acceptance: repeated lines, replacements, multibyte UTF-8 and non-UTF-8 content map to the original bytes without downstream searching; preserve the complete raw body, explicit unknowns and additive CLI/MCP compatibility.

Sources: GoModuleText.ts:115-143; GoModuleText.ts:178-215; goBinary.ts:21-31; goBinary.ts:42-51.

12. Query dependency paths in retained Rust metadata

Evidence: source-derived feature proposal, building on #2456. The embedded graph already exposes package indices, root, edges and cycles, but answering why a package is present requires consuming and traversing the graph manually. Consider an evidence-linked root-to-package query/view keyed by exact indices, with explicit ambiguous-name, no-root, no-path and cycle outcomes. Graph reachability must not imply runtime use. Acceptance: duplicate names/versions, disconnected nodes, cycles and multiple paths preserve artifact identity and source indices; measure equivalent question-answer costs against full-graph consumption.

Sources: rustBinary.ts:26-39; rustBinary.ts:54-59; RustAuditableReader.ts:98-118.

JavaScript and Electron semantic ownership

13. Share loader identity with native-addon binding analysis

Evidence: source-derived candidate; REA analysis not executed. The native-addon path recognizes require, suffix .require and a webpack-name substring separately from the ordinary reference owner's lexical loader facts. A local require parameter or local object's method can therefore be interpreted differently by the two inventories. Reuse the existing semantic loader/binding owner rather than another spelling heuristic. Acceptance: local/hoisted/catch/optional and object-method controls produce no certain native binding; genuine CommonJS/createRequire/renamed bundler-loader controls remain consistent across inventories. #2890 addresses ordinary shadowed-require references, not this separate consumer.

Sources: electronStaticAnalysisNative.ts:134-155; electronStaticAnalysisNative.ts:201-239; javascriptStaticAnalysisCalls.ts:233-280.

14. Preserve native-addon extension case in loader inference

Evidence: independent Node v24.19.0 oracle; REA analysis not executed. A self-authored addon.NODE containing JavaScript loaded as JavaScript and returned {value:42} on this Linux host. The native binding classifier lowercases suffixes before testing .node. Keep broad artifact inventory hints separate from Node loader semantics; preserve the exact filename and unknown target policies. Acceptance: exact .node, uppercase .NODE and mixed-case controls distinguish native-loading facts from filename hints, using only self-authored fixtures. Related #2766 concerns type-only imports rather than extension dispatch.

Sources: electronStaticAnalysisNative.ts:278-284; JavaScriptArtifactFiles.ts:607-615.

15. Carry external HTML script kinds into load edges

Evidence: source-derived graph enhancement; no browser or REA run. External src collection lacks the script-kind classification used for inline bodies. A test intentionally retains application/json source attributes, while the graph converts those references into renderer loads edges. Preserve declaration Evidence but distinguish inert data blocks from classic/module script loading at the HTML parser owner. Acceptance: JSON, importmap, speculationrules, default/classic MIME, module and invalid-type controls retain exact declarations and add load edges only under the selected script semantics. #1042/#2940 address extraction/inline handling, not this external-kind boundary.

Sources: htmlArtifactReferences.ts:112-130; htmlArtifactReferences.test.ts:33-34; JavaScriptArtifactGraphDocuments.ts:49-108.

16. Keep contextBridge member identity as path segments

Evidence: source-derived representation collision; REA output not executed. Joining member segments with dots collapses literal key a.b and nested a → b before deduplication; the graph copies that inventory. Existing call paths already retain structured entry_path, so preserve those stronger semantics. Add canonical segment arrays, collision-free keys and derived display labels at the producer. Acceptance: dotted/empty keys and both colliding forms remain distinct in inventory, counts and graph consumers, with ordinary nested traces unchanged. #3212 concerns spread omissions; #2669/#2745 concern nested function paths.

Sources: electronStaticAnalysisValues.ts:124-129; electronStaticAnalysisValues.ts:163-167; ElectronBoundaryGraphWindows.ts:194-202; electronWrappedCallPaths.ts:515-526.

17. Recognize proven qualified WebSocket constructors

Evidence: source-derived missing case; no socket or REA runtime run. endpointArgument handles bare WebSocket but not qualified members, unlike its adjacent EventSource handling. new window.WebSocket('wss://example.invalid/socket') and globalThis.WebSocket with exact literals need consistent treatment. Reuse ambient binding/write facts to recognize standard globals without accepting arbitrary *.WebSocket lookalikes. Acceptance: bare/window/globalThis/self controls preserve literal provenance in both application and web-bundle consumers; shadowed/reassigned globals and dynamic arguments remain appropriately uncertain. #3044 handles qualified EventSource/beacon; #3451/#3534 concern nonliteral targets.

Sources: javascriptStaticAnalysisHelpers.ts:610-617.

Setup, update and uninstall lifecycle

18. Supervise updater children through the process owner

Evidence: source-derived reliability proposal; no package-manager stall executed. runUpdateCommand has no deadline, cancellation signal or retained cleanup owner; npm registry fetch flags do not bound discovery, Bun installation or verification children. Reuse src/process/ supervision with stage-appropriate/configurable policies while preserving selected manager, destination and environment. Acceptance: a local child/descendant fixture cancels or times out with explicit cleanup outcomes and no unrelated PID termination; successful npm/Bun updates and structured output remain intact. #3557 adds a bounded Frida probe rather than supervising this runner.

Sources: UpdateRuntime.ts:37-84; UpdateRuntime.ts:315-375.

19. Bound updater diagnostics separately from machine output

Evidence: source-derived resource proposal; memory/time unmeasured. Updater stdout/stderr are concatenated in full even when progress is streamed to a terminal, and failure remediation returns retained output. Define byte-aware capture at the owning process boundary; keep human progress streaming with explicit diagnostic-tail truncation, while treating machine-readable version/maintenance JSON as complete-or-error. Acceptance: oversized fixture output stays within the justified policy; truncated machine output cannot masquerade as complete metadata. Measure equivalent completed noisy-child tasks, including peak process-family memory. #2764/#3557 bound other diagnostics, not this common runner.

Sources: UpdateRuntime.ts:58-81.

20. Normalize repeated client IDs once before setup planning

Evidence: source-derived production path; command not executed. Repeated --client codex values are mapped directly into selected clients, allowing duplicate configure_client:codex actions and repeated application into the same result slot. Normalize identity once at the setup owner, preserving first-selection order across planning, readiness and execution. Acceptance: rea setup --client codex --client codex --skill=false --dry-run --json matches the unique single-client plan; apply configures once and reports the actual operation. Distinct clients and skill destinations remain unchanged. #1839 concerns repeated invocations rather than duplicate arguments within one call.

Sources: setupCommands.ts:58-67; SetupPlan.ts:148-163; SetupPlan.ts:179-201; SetupPlan.ts:314-330; SetupClients.ts:37-65.

21. Add a strictly read-only uninstall preview

Evidence: source-derived workflow proposal; no deletion failure alleged. Uninstall exposes purgeData and proceeds from preflight to removal without a preview. Reuse its canonical ownership/path inspections for uninstall --dry-run --json, showing remove/retain/skip/block decisions and exact paths while performing no writes, including backups. Acceptance: an isolated multi-client fixture with foreign entries, managed skills and symlinked data remains byte-for-byte unchanged; subsequent apply matches the preview and preserves unrelated data. Malformed configuration blocks consistently. #1163/#1839 discuss setup dry runs or separate uninstall lifecycle work.

Sources: setupCommands.ts:143-165; Uninstall.ts:115-142; installation.md:349-366.

22. Add a read-only update availability/ownership check

Evidence: source-derived workflow proposal. Update currently calls installation once a newer release and owning installation are established. An explicit --check or --dry-run could resolve release metadata, show the owning manager/destination and exact planned argv without installation or integration maintenance. Acceptance: a mocked newer release reports the existing manager's argv while installVersion is never called; current, unknown-install-method and unavailable-registry outcomes stay distinct. It must not upgrade Node/npm/Bun/providers. #577 plans integration maintenance after package update; #3556 concerns subsequent readiness.

Sources: setupCommands.ts:170-186; Update.ts:163-208.

Browser discovery and retained capture views

23. Reject malformed UTF-8 at HTTP CDP discovery

Evidence: executed byte-decoding primitive (Node v24.19.0), not a full REA/CDP run. Buffer.toString('utf8') replaces malformed bytes before JSON parsing; a malformed string and valid literal U+FFFD can become identical. Use fatal UTF-8 decoding at this byte-to-text owner with the existing invalid_endpoint_response projection and explicit BOM policy. Acceptance: real loopback fixtures reject malformed title/URL bytes while valid U+FFFD, split emoji, byte-limit, abort and timeout controls preserve expected results and cleanup. #3396/#3507 concern Frida file decoding, not HTTP discovery.

Sources: CdpEndpoint.ts:466-481; cdpEndpointResponseBounds.test.ts:21-38.

24. Make PNG comparison cancellable without blocking control traffic

Evidence: source-derived compute/cancellation enhancement; runtime costs unmeasured. PNG comparison performs synchronous inflate, unfilter and channel loops without an abort signal. Existing memory admission does not make compute interruptible. Explore a bounded owned worker or interruptible stages, accounting for transfer/copy cost and preserving exact metrics/errors. Acceptance: compare equivalent small/large tasks for elapsed/CPU/peak family memory and control-loop responsiveness; abort during each stage must stop actual work, prevent late success, clean resources and allow a subsequent MCP call. Link this concrete work to broader cancellation roadmap #1065; #3529 does not change the comparator.

Sources: PngVisualDiff.ts:36-98; PngVisualDiff.ts:330-347; PngVisualDiff.ts:384-416.

25. Page API-group members and exclusions independently

Evidence: source-derived response-scope enhancement; no transport failure reproduced. API-surface offsets slice groups, but every page copies all exclusions and each group retains all ordinals/template values. A one-group page therefore need not be a small answer. Consider opt-in summary/member/exclusion facets with independent continuation, totals and coverage; keep existing complete defaults and provenance. Acceptance: a frequent endpoint plus many exclusions yields bounded selected facets with exact original ordinals, stable continuation and unchanged retained parent identity after source deletion. Measure complete-task costs. Compose with #1891 and #3425 rather than duplicating their contracts.

Sources: WebNetworkApiSurfaceAccumulator.ts:381-445; webNetworkApiSurfaceView.ts:14-78.

26. Project retained HAR phase timings as a paged view

Evidence: source-derived analyst-workflow enhancement; no bottleneck measurement. Capture preview already retains top-level time and startedDateTime; detailed HAR phase timings still require complete producer records. Add an offline phase-timing/waterfall facet over retained Evidence, citing source ordinals/JSON pointers and preserving -1/unknown versus zero. Acceptance: independent numeric controls cover TLS included in connect, concurrent/redirect entries, offset timestamps and absent values; retained/portable views work after source deletion without network traffic. Avoid causal claims or mixed-clock subtraction. Build on HAR producer #2045 and API grouping #1891.

Sources: HarCapture.ts:59-100; webNetworkCaptureView.ts:338-369; webNetworkApiSurfaceView.ts:26-51.

27. Expose observed status frequencies and source ordinals

Evidence: source-derived analyst-workflow enhancement, not a reliability estimate. API groups keep distinct statuses in a Set and undifferentiated record ordinals; [200,500] cannot answer how many retained failures occurred or identify them without full records. Consider an opt-in distribution with exact per-status counts and independently paged original ordinals. Acceptance: repeated 200/500/304, absent status and nonconsecutive selections reconcile with retained group totals without double counting; parent scope, defaults and unknowns remain explicit. Compose with #3425's unavailable-status coverage. Counts describe observations, not server failure probabilities.

Sources: WebNetworkApiSurfaceAccumulator.ts:32-45; WebNetworkApiSurfaceAccumulator.ts:367-376; WebNetworkApiSurfaceAccumulator.ts:399-429.

SQLite schema and format metadata

28. Expose declared SQLite foreign-key relationships

Evidence: native node:sqlite metadata oracle (v24.19.0); REA extension not implemented. Table contracts expose columns and primary-key positions but no structured foreign keys, requiring reparsing CREATE SQL. Retain foreign_key_list facts once at the schema owner, including composite ordering and actions, distinguishing declaration from enforcement/integrity. Acceptance: composite CASCADE/SET NULL, self-reference, omitted target-column and unresolved-target fixtures preserve exact names/sequence and selected-table scope. Continue using the owned read-only snapshot; do not execute caller SQL, views or triggers. The native oracle observed both composite records, not an REA failure.

Sources: sqliteDatabase.ts:125-159; SqliteDatabaseInspection.ts:186-218.

29. Expose SQLite index keys, uniqueness and collations

Evidence: native node:sqlite metadata oracle, not REA extension verification. Index output contains name/table/SQL/root page; null-SQL autoindexes and expression/collation/ordering details cannot all be reconstructed from that SQL. Retain index_list/index_xinfo facts at the schema owner, preserving expression/rowid sentinels rather than inventing names. Acceptance: primary-key autoindex, UNIQUE, expression, NOCASE/DESC partial-index and WITHOUT ROWID controls retain definitions, selected scope and read-only limits. The oracle observed expression cid=-2, auxiliary rowid cid=-1, DESC/NOCASE, partial=1 and null autoindex SQL. Check additive public-contract compatibility.

Sources: sqliteDatabase.ts:161-168; SqliteDatabaseInspection.ts:374-382.

30. Retain SQLite application_id and user_version

Evidence: native node:sqlite oracle on a self-authored database; no REA workflow run. The report includes engine version and encoding but omits application-controlled format/migration integers. Read these from the existing owned read-only snapshot and retain exact values; do not infer a vendor or migration compatibility from integers alone. Acceptance: nonzero and observed-zero values, WAL/snapshot consistency and additive CLI/MCP contracts preserve input identity and limits. The native oracle observed user_version=42 and application_id=5391681; these demonstrate available underlying facts rather than a current REA failure.

Sources: sqliteDatabase.ts:109-124; SqliteDatabaseInspection.ts:535-547.

[CassieFox23]

TL;DR: I checked all 30 proposals against the code on main. All 30 still hold, none is fixed yet, and none repeats an open or closed issue or PR. Nine look like small, clean first fixes.

Thanks, Afloat16, for the line refs and the checks on each one. They made this fast to verify.

I call your proposals P1 to P30 here, so GitHub doesn't link them to issues #1 to #30.

What I found

• Still true on main: 30 of 30. I read the code each one cites. Two need some work before a fix: P9 needs Electron's rules, and P10 needs a real measurement.
• Already fixed: 0. Your base was f09f454. Main is now 1b036ec, and none of the newer commits touch the files cited.
• Duplicates: 0. I searched issue and PR titles, open and closed, and matched the files of every open PR. The nearest ones are listed below the table. None does the same thing.
• Scope: none of the 30 needs a scope call. CONTRIBUTING.md wants one for work that runs or changes a target. It also wants one for injection and protection recovery. Twelve add a public field or flag, so they may want a note on the contract.

Small first fixes

These are small, need no scope call, and no open PR covers them. Best first:

1. P20: dedupe repeated --client ids.
2. P1: count $ref siblings in the schema budget.
3. P17: catch window.WebSocket and globalThis.WebSocket.
4. P3: check start <= end for file-offset-range.
5. P5: check the numbers given to --token-limit and --token-offset.
6. P8: loop the ZIP read until the range is full.
7. P23: strict UTF-8 for CDP discovery.
8. P2: keep both errors when a partial result fails to save.
9. P14: keep .NODE case. Small, but it needs a call on hint versus loader rules.

Not run

• None of your probes, and no tests. I read code only.
• The Node and SQLite behavior claims (P14, P23, P28 to P30). Those are yours, and I did not check them.
• Whether Incur checks the token flags (P5), or merges repeated --client flags (P20), before REA sees them.
• Which of the other 26 readStableArtifact callers pass a resource scope (P6).

All 30, one row each

Area labels are my best fit. "Contract" means it adds a public field or flag.

	What	Kind	Area	Where on main	Nearest issue or PR	Size
P1	$ref siblings in the schema budget	bug	mcp	inputSchemaPresentation.ts:283-292 returns right after a $ref	builds on #1749	small
P2	both errors on a failed partial save	bug	server	toolResult.ts:109	#2398 is different	small
P3	start <= end for file-offset-range	bug	evidence	evidence.ts:101-105. javascriptApplicationEvidenceSchemas.ts:116-129 has the check to copy	none	small
P4	paged list_unknowns	feature	evidence	EvidenceLedger.ts:329-357	#2701 is different	medium, contract
P5	token-window numbers	bug	cli	only Number.isFinite (cliOutput.ts:105-113)	none	small
P6	Rust: a failed close hides the real error	bug	providers	RustBinaryProvider.ts:49 passes no scope. GoBinaryProvider.ts:144 does	none	medium
P7	idle snapshot read on cancel	bug	runtime	readStableArtifact.ts:88-109	#3586 edits the file	medium
P8	ZIP short reads	bug	native	one read (ZipArtifactReader.ts:123-140)	#3659 and #2717 edit the file	small
P9	mixed ASAR node metadata	bug	native	AsarListing.ts:7-24, AsarArtifactReader.ts:85-112	none	medium, research first
P10	growth of WASM glue refs	feature	providers	WasmGlueAdapter.ts:16-67, no total cap	#3455 edits the file	medium, measure first
P11	source spans for Go module records	feature	providers	GoModuleText.ts:115-215	#3604, as you said	medium, contract
P12	Rust crate path query	feature	evidence	rustBinary.ts:26-59	builds on #2456	large, contract
P13	shared require identity for native addons	bug	domain	electronStaticAnalysisNative.ts:201-239	none	medium
P14	.NODE case	bug	domain	electronStaticAnalysisNative.ts:284	none	small
P15	script kind on external HTML scripts	bug	domain	htmlArtifactReferences.ts:112-130. A test pins today's behavior on purpose	#2940 edits the files	medium
P16	contextBridge path keys	bug	domain	electronStaticAnalysisValues.ts:124-129, 163-167	none	medium, contract
P17	window.WebSocket	bug	domain	javascriptStaticAnalysisHelpers.ts:610-617	#3534 edits the same function	small to medium
P18	updater children through the process owner	bug	setup	UpdateRuntime.ts:37-84	#3557 edits the file	medium
P19	bound updater output	feature	setup	UpdateRuntime.ts:58-81	#3557 edits the file	medium
P20	repeated --client ids	bug	setup	setupCommands.ts:264, SetupPlan.ts:160	none	small
P21	uninstall --dry-run	feature	setup	setupCommands.ts:143-165	#3308 is different	medium, contract
P22	update --check	feature	setup	Update.ts:163-208	#3557 edits the file	medium, contract
P23	strict UTF-8 for CDP discovery	bug	native	CdpEndpoint.ts:466-481	none	small
P24	cancellable PNG compare	feature	runtime	PngVisualDiff.ts:36-98	#2988 edits the file	large
P25	page API-group members	feature	mcp	WebNetworkApiSurfaceAccumulator.ts:381-445	builds on #1891	large, contract
P26	HAR phase timings	feature	evidence	no timings code yet	builds on #1891	large, contract
P27	status-code counts in API groups	feature	mcp	WebNetworkApiSurfaceAccumulator.ts:32-45	#3425 same area	medium, contract
P28	SQLite foreign keys	feature	evidence	no foreign_key_list in src	#2701 edits the files	medium, contract
P29	SQLite index keys	feature	evidence	sqliteDatabase.ts:161-168	#2701 edits the files	medium, contract
P30	SQLite application_id, user_version	feature	evidence	sqliteDatabase.ts:109-124	#2701 edits the files	small to medium, contract

Open PRs that edit the same files

These are not duplicates. A fix may need a rebase after them.

• P13 to P16: feat(javascript): fold constant values and recover Electron boundaries through wrappers #2094, fix(javascript): preserve TypeScript resolution modes and native type erasure #2060, fix(javascript): report present non-JavaScript require targets as unavailable #2642, fix(javascript): report missing ASAR companions as unavailable instead of not-found #3278
• P4, P28 to P30: docs(skills): add source attribution and evidence handoff guidance #2701
• P18, P19, P22: fix(update): report optional native module readiness #3557
• P11: refactor(go): parse module records once at the build-info owner #3604
• P8: fix(security): harden archive and Hopper probes #3659, feat(java): inspect archives and decompile selected classes #2717
• P24: feat(browser): add screenshot bounds and region comparisons #2988
• P25, P27: feat(analysis-view): locate unavailable response facts by record #3425, feat(analysis-view): report value-free request header facets in API surfaces #3622, feat(browser): derive API surfaces from retained SAZ captures #2884
• P10: fix(wasm): preserve local matches for dotted selected paths #3455
• P3: six open artifact-format PRs edit evidence.ts (feat(ghidra): add bounded PS-X EXE static analysis #1948, feat(artifacts): inventory and extract PyInstaller archives #2433, feat(artifacts): inspect classic iNES container regions #2816, feat(artifacts): recognize CFB containers with explicit coverage limits #3404, feat(artifacts): inspect and extract Godot PCK with retained facts #3634, feat(artifacts): inspect and extract .NET single-file bundles #3787)

A Linux test plan for your first three picks

Each runs in process, with no network and no real setup.

• P1: add cases to src/contracts/toolInputReferences.test.ts. Build the schema from your example, with 33 references. Check the count is 33, and that a budget of 32 returns the inline form. Add a cycle case and a 32 versus 33 case.
• P17: model it on javascriptStaticAnalysis.event_source.test.ts. Feed new window.WebSocket('wss://example.invalid/socket') and check for one endpoint finding. Add negative cases: a local window object, foo.WebSocket(...), and a dynamic argument.
• P20: use the fake host in src/application/Setup.fixture.ts with a temp home. Plan with clientIds: ["codex","codex"]. Check that configure_client:codex shows up once and that the plan equals the one-client plan. For the CLI form, point HOME at a temp folder and use --dry-run.

How I checked

• I read each cited range on main with git show and git grep.
• git log from your base to main showed no change to any cited file.
• For overlap, I pulled 3,791 issue and PR titles, open and closed. I also ran a search per proposal, and matched the file lists of all 356 open PRs.
• I read trackers [Tracker] Audit and subsystem index of active bug reports (October 2026) #3537, [Tracker] Open documentation issues and pull requests #3795 and [Tracker] Open feature requests by area #3796 in full.

🤖 Generated with Claude Code (Sonnet 5.5, verified by Opus 5.5) 🦊

[Afloat16]

Implementation index

Existing upstream PRs

Candidate	PR	Scope
P1	#3920	Conservative schema-position reference budget; actual published Pi renderer results and inline cost are documented in the PR
P17	#3940	Qualified WebSocket endpoints; follow-up review repair is being validated
P20	#3919	Setup client identity normalization; isolated compiled preview/apply/rerun

These three PRs remain open. Current-head repository CI requires maintainer approval. GitHub limits external contributors to three open PRs in this repository, so the additional independently validated commits below are published on separate branches in Afloat16/rea and queued for upstream PRs.

Additional independent commits

Candidate	Change	Commit	Executed regression scope
P2	Partial Evidence recording diagnostics	419303e	25 MCP/delivery tests
P3	File-offset ordering	c25e06a	41 source + 4 compiled CLI + 3 MCP
P5	Discrete token-window arguments	5ba436c	3 focused tests including 2 compiled CLI
P6	Rust snapshot cleanup ownership	78c4de4	23 provider/service/MCP lifecycle tests
P7	Idle snapshot cancellation	bc87c68	13 stream/descriptor controls
P8	ZIP positional short reads	efa33fa	11 real ZIP/seam tests
P14	Native-loader extension case	e56c56f	12 source/Node-oracle/graph tests
P15	HTML script-kind load edges	4da5a54	62 parser + 1 filesystem graph
P22	Update availability without installation	2a7699c	60 source/logging/release/compiled CLI
P23	HTTP CDP UTF-8 validation	f68ed38	19 real loopback/provider boundary tests
P30	SQLite application format metadata	9eeae6d	53 native/service + 1 compiled discovery; 1 expected skip

Each commit has its own branch and failing-base regression. All eleven passed official JavaScript fallback compilation, the locked TypeScript 6 JavaScript typecheck at 3 GiB, lint, knip, metadata, architecture guards, test discovery and changed-file formatting. Documentation checks also passed where contracts or the CLI changed.

Verification boundaries: the native TypeScript 7 gate cannot start on this host because /proc/self/exe is absent. P5's complete CLI file retains two failures reproduced on the untouched base (temporary-directory/I/O paths); its focused regressions pass. P30's complete database-worker CLI inspection is blocked by the host's unavailable /proc process ownership, while real native DB/WAL and compiled discovery checks pass. P7 waits actual native I/O quiescence and claims no fixed deadline for a stalled kernel read. Source, SDK, isolated CLI, native engine and actual browser/provider coverage are distinguished in each change's validation notes; a full CI/provider-suite pass is not claimed.

Remaining candidates

P13 overlaps the independently reported native-loader issues #3884 and #3885 and is excluded from new fixes. P4, P9, P10, P11, P12, P16, P18, P19, P21, P24, P25, P26, P27, P28 and P29 remain proposals requiring separate compatibility, contract, lifecycle-policy or measured-workflow work. In particular, updater process limits have not been imposed on a mutating installation, and no unmeasured resource optimization is reported as complete.

[Afloat16]

Final PR follow-up: #3940 now includes commit 1d4f80a, preserving proven constructor captures and runtime ws imports while sharing current main’s exact template-key interpretation. Both review threads have been answered; 110 focused tests, JavaScript fallback compilation, the locked TypeScript 6 check, lint, knip and pre-commit checks pass.

#3920 now includes actual published Pi 1.1.0/1.2.0 renderer results after SDK conversion and explicitly records the conservative sibling policy and earlier-inline cost.

The eleven independent commits above are verified on their fork branches. All three upstream PRs remain open and mergeable. The current #3940 CI run is action_required and awaits maintainer approval.