docs(experiment): map verified primitive coverage

Separate task sufficiency, patched-engine requirements and remaining unknowns. Explain identity and relation grain without claiming universal RE completeness or provider parity.

Co-authored-by: gensokyo-dev <342580529+gensokyo-dev@users.noreply.github.com>
Co-authored-by: Kaoru0822 <208281322+kaoru0822-kitauji@users.noreply.github.com>

experiments/atomic-codemode/README.md

@@ -10,6 +10,10 @@ The goal is a real model completing reverse-engineering questions through
 composable facts, with Code Mode as the calling adapter. A configured feature flag,
 a scripted verifier or a small response does not prove that goal.
 
+The [capability map](capability-map.md) distinguishes verified task coverage,
+experimental exporter requirements and remaining unknowns before interpreting
+adapter comparisons.
+
 The reference is [Hex-Rays IDA MCP](https://github.com/HexRaysSA/ida-mcp/blob/df6de7985b534a964c125d5a86e41b26b17b14f6/ida_mcp/mcp.py):
 an on-demand `reference` lookup and an execution entrypoint over a richer analysis
 API. This experiment uses JavaScript and a QuickJS WASM environment rather than

experiments/atomic-codemode/capability-map.md

@@ -0,0 +1,42 @@
+# Capability and comparison scope
+
+The experiment has fifteen fact methods behind a shared SDK/CLI owner, exposed
+as eighteen direct MCP tools or four Code Mode tools. The structured IR/call/
+projection/switch facts require the explicitly pinned experimental Kuna patch;
+they are not capabilities added to stock Kuna or integrated REA by registration
+alone. Other providers are not wired to this experimental service.
+
+A fair completed-task comparison first needs sufficient facts on both paths,
+with a common correctness oracle. A complete universal RE interface is not
+established here. The selected-case question requires native row/edge identities,
+so it compares the two atomic adapters; no traditional-provider result for that
+question is invented. Earlier traditional comparisons retain their own questions,
+engine profiles and limitations in [the trial record](trials.md).
+
+| Analyst question                                        | Composable facts/relations                                                                                                          | Executed evidence and limits                                                                                                                                                                                                                         |
+| ------------------------------------------------------- | ----------------------------------------------------------------------------------------------------------------------------------- | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
+| Which implementation owns an observed message?          | Callable entries/aliases, encoded strings, exact-address xrefs with occurrence identity and function attribution                    | Both recent SQLite tasks select the owner before capture. Name equality alone is insufficient; discovery/unattributed coverage remains explicit.                                                                                                     |
+| Which local condition controls a selected value/call?   | Snapshot-local operations, SSA values, indexed operands, definitions/uses with PHI predecessor edges, recovered CFG edges           | [Four real control-task runs](savepoint-control-study.md) verify the selected guards and machine instructions. [Full graph transport checks](native-graph-transport-study.md) establish producer fidelity, not global machine equivalence.           |
+| What crosses a call boundary?                           | Native call specifications, argument values and separate passing storage; selected callee inputs and bounded definition projections | Earlier pinned [call/boundary trials](trials.md) exercise these relations. Storage matches are candidates, not proof of runtime binding or complete ABI/memory effects; a new exporter hash alone is not a repeated cross-function model trial.      |
+| Which cases map to a recovered edge?                    | Original case identity/label/address, independent native default, flattened case/out-edge relations                                 | [All 182 SQLite original targets](switch-study.md) match independent ELF table bytes. Four real models answer selected cases and distinguish the native default from the machine range guard. No complete case inventory is needed in model context. |
+| What machine bytes support the interpretation?          | Batched loaded-image bytes and selected linear instruction windows, each with source/coverage                                       | The case models independently derive signed relative targets. These windows do not establish runtime execution/alignment, a complete machine CFG, live memory or arbitrary file-offset mappings.                                                     |
+| Can the answer be audited without returning the report? | Snapshot/source identity, selected fields, batch reads, paging and retained raw/decoded Evidence                                    | Real CLI/MCP checks verify source access and capacity fallbacks. Scope/partial/unknown survive composition; a guest-derived answer keeps its own authority.                                                                                          |
+
+The useful grain so far is an identified object plus a relation with its exact
+qualifiers: an operand needs its slot and PHI binding; a case/out-edge pair needs
+both identities; an address needs its artifact/address space; an optimized
+operation needs its snapshot and representation. One small JSON row is not
+automatically one independently meaningful fact. Machine instructions and
+normalized operations also cannot substitute for each other.
+
+Selection, projection, batching, paging and bounded traversal compose those
+facts. The analysis owner derives/validates relations; Code Mode selects and
+combines them. A query can be fine-grained even when its fresh native capture
+still computes a whole function. Same-lease reuse is measured separately from
+that work and does not establish a cross-session cache or native acceleration.
+
+Memory alias dependencies, full machine-flow recovery, indirect runtime binding,
+feasible paths and nontermination remain unknown. The current evidence does
+not establish provider parity, broad complex-software superiority or a stable
+Code Mode cost advantage. The [wait repeat](client-wait-study.md) shows why fewer
+MCP requests or polls cannot replace correct answers and whole-task costs.

experiments/atomic-codemode/native-engine.md

@@ -6,6 +6,11 @@ against [Kuna v1.833](https://github.com/Noelo-Lab/kuna/tree/fe01d6294eb0d1053ce
 It is not an upstream release or an integrated REA capability. No upstream commit,
 PR or merge is being made.
 
+The sections below record successive pinned prototypes and their historical
+limits. For current comparison scope use the [capability map](capability-map.md),
+[full-graph transport study](native-graph-transport-study.md) and
+[independent switch study](switch-study.md), together with the live contracts.
+
 `decompile --json --atomic-facts` captures the live function that produced C.
 The default path does not collect the facet. Graph records include ordered CFG
 edges, native value identities, indexed operands, outputs and phi input bindings