Index of figures

Every figure of this manual, in order, by the one claim its caption makes.

Each row links to its figure, and the claim is the bold sentence that opens the caption. Every number in a figure comes from our captured runs, and the source of each figure is linked from its section. The colours follow the palette of the front matter:

blue is rea, its CLI, its MCP server, and its domain layer
violet is the Ghidra provider
green is the fixture files and their bytes
plum is the agent and its model calls
olive is scripted and managed code
indigo is MCP messages and sessions
amber is a lifecycle state, such as a claim status
teal is a durable record, such as an Evidence bundle
rose is a failure or a refused claim
grey is the host, the compiler, and the reader

Fig.	The claim it makes
0.1	Each of the eight arrow styles marks one kind of exchange, and every label except the model call is a real name or message from the recorded session.
1.1	rea owns the adapters, the session, and the Evidence record, and Ghidra owns import, analysis, and decompilation, with one JSON line per question between them.
1.2	One command opens the file, binds Ghidra, launches a headless JVM on a private copy, asks one question on a socket, and returns one Evidence record.
1.3	Every field of the record is either identity, provenance, the answer, or a limit on the answer, and the id covers all of them except the display names.
2.1	Five questions from 17 USC 1201(f), Directive 2009/24/EC, Sega, and Connectix stand before the first command, and the fixtures of this manual answer all five by construction.
2.2	rea doctor runs nine checks for the Ghidra scope in a fixed order, and on the capture Mac every one passed with the path or version it found.
2.3	A capability group answers four questions before any call: is the operation available, what does it start, what does it write, and what does it change.
2.4	Every Ghidra operation declares launches_process and may_write_filesystem, three also declare mutates_artifact, and no operation in the capture declares changes_permissions or requires_root.
3.1	One cheap read gives a hashed subject, a one-node inventory, and an explicit branch that names open_binary as the next probe.
3.2	The same host refuses one layout reader on platform and answers the other with 17 load commands, because each reader names its own prerequisites.
3.3	Four segments map 33872 file bytes into three address ranges, and every other load command points into the last one by file offset.
3.4	The segment rule, the section rule, and Ghidra's source mapping give the same byte, 1304, and that byte starts the first instruction of _grade.
3.5	The same four functions give 13 procedures in a linked executable and 4 in a relocatable object, because stubs, externals, and an entry point exist only after linking.
4.1	The open call returns after the readiness checks with no import, the first question waits seconds for the headless import, and the next takes under 100 ms.
4.2	One session owns one directory with the project, the hashed target copy, the descriptor, the socket, and the logs, and close_binary deletes it.
4.3	Five internal functions fill the 576 bytes of __text without a gap, four thunks fill __stubs, and four externals live in a block Ghidra made.
4.4	Ghidra's basic_blocks split the fifteen instructions at the one conditional branch, and both leaf blocks end in ret with no successor.
4.5	entry calls three of the four functions, the function starts table refers to all four, and nothing calls _grade because its body was inlined.
4.6	At -O0 an indirect jump through five relocated entries reaches five case blocks, and at -O1 one load from five values replaces all of them.
4.7	Ten of the 39 strings are the program's text, and the other 29 are names and paths that the loader and the linker keep in the file.
4.8	One record holds the identity, the text, the edges, the blocks, the signature facts, and the value flow of one function, each with its own limits.
4.9	Four source lines became fourteen lines of pseudocode, and the three marked lines describe only the registers.
5.1	The id hashes every field of the record except subject.name and subject.local_path, so the same observation of the same bytes gets the same id anywhere.
5.2	An empty callees array with complete coverage, a zero unknown count, and a one-sided bundle record each prove that nothing was observed, never that nothing exists.
5.3	An unknown keeps its id across revisions, each revision names the digest of the one before, and each change writes its own Evidence record.
5.4	A cacheable call becomes a query id over target, binding, operation, and parameters, and a mutating call turns the cache off before it reaches Ghidra.
5.5	One canonical file leaves the session, and the CLI summary, the CLI export, the CLI import, and a second MCP session all read it without Ghidra.
5.6	The compiler left _percent_change the same on seven dimensions with references unknown, changed _total on five, and rea reports counts without saying why.
6.1	The graph links the package entry point to three IPC handlers and one network endpoint, and each edge names whether it was observed or inferred.
6.2	rea copies the module, runs three WABT programs with checked versions, and returns one observed record that the CLI and MCP share.
7.1	Each claim takes its status from one dimension of one comparison record, and the total claims also carry the unknown that compare_functions recorded.
7.2	Leg one runs the original and the candidate over 92 cells, and leg two compares 46 masked bytes, one relocation record, and five table entries.
7.3	Three candidates stop at the size check, one passes every byte check and fails on the table it points at, and four reach pass.
8.1	open_binary returns in 1,632 ms without a Ghidra import, and list_procedures pays 6,349 ms for the import before the session answers in milliseconds.
8.2	The 60 s client default covers the 6.3 s first call on this Mac, the 64 s Linux call fails it, and rea waits up to 330 s.
8.3	Four tool calls produced four Evidence records, and the ledger built from them answers the question only up to the two tables nobody read.
8.4	Five claims rest on recorded Evidence ids, and four stay unknown until read_bytes or analyze_function runs on the addresses the dossiers already name.

rea (rea-agents) with the Ghidra provider rea-agents 6.7.0, Ghidra 12.1.4 · 27dc42d · 2026-10-18 · Edition 2026.10