# REA through Ghidra: what a session costs, what a snapshot keeps and how labels interact

## What to know

REA 6.7.0 with its Ghidra provider (Ghidra 12.1.4) on Banished's `Application-steam-x64.exe`, a
2 MB x64 program, on an Apple M3 (*measured*):

| Step | Time |
|---|---|
| `open_binary` | 1 to 2 s; Ghidra has not run yet |
| First `analyze_function` of a session | 45 to 50 s: Ghidra imports and analyses the whole binary |
| The same question again in the session | 0.1 s |
| `close_binary` with `snapshot_path` | 1 s |
| Reopen with `snapshot_path`, a question in the snapshot | 0.1 s; the whole run took 3 s |
| Reopen with `snapshot_path`, a new question | 45 s: Ghidra runs again |
| `set_addresses_names` with 1,167 labels in chunks of 400 | runs Ghidra first if it has not run; 1,165 applied |

A snapshot holds REA's answers keyed by question (operation and parameters). It is not a
Ghidra database. It saves time only for questions asked before. One `analyze_function`
dossier added 2 to 3 MB to it. The dossier itself was 0.5 to 1 MB, mostly `native_value_flow`
(the P-Code operations, def-use chains and memory effects). That is too large to read whole,
so read it with `jq`.

Labels and snapshots work against each other (*observed* in REA's limitations and *measured*).
A session that renamed anything cannot save a snapshot: "metadata edits invalidate immutable
analysis snapshots". After a rename, `analyze_function` answers from Ghidra again with the new
names in its pseudocode, even for a question in the snapshot. Names are discarded on close.

`set_addresses_names` takes an object of address to name and answers, in `normalized_result`,
an object of address to whether the name stuck. It refuses an address inside a function that
already has a primary symbol. Ghidra reads `::` in a name as a namespace path. Every name must
be unique.

The `mcpServers.rea` entry that `./gameframe mcp --enable rea` writes starts
`npx -y rea-agents@VERSION mcp`. In an agent's environment `npx` prints one NDJSON notice on
stdout before the server's first answer. A client of its own must skip lines that are not the
JSON-RPC answer. Claude Code copes with it.

## What to do

Use `tools/rea/rea_session.py` (`./gameframe run rea_session ...`). `snapshot BINARY ADDR...`
saves the answers you will come back to. Run it without renames, adding to the old snapshot.
`fn BINARY ADDR...` applies the project's labels, then asks; each run pays the Ghidra cost once.
`fn --snapshot-only` skips the renames and answers warmed functions in 0.1 s, with the labels
only in its summary. `labels BINARY` writes `set_addresses_names` input for an agent's own REA
session. Keep the snapshot and the dossiers in an ignored folder (`analysis/rea/`), because they
hold decompiled code. Keep the text export for whole-program searches.