WIP: document original automatic face-follow mechanism and prepare 1.0.4

docs/analysis/rea-auto-tracking.json

@@ -0,0 +1 @@
+{"artifacts":[{"architecture":"arm64","digest":{"sha256":"f01e8c0b7e2676b2961950b0e48efdd2589af218e4b36de7d39f5d1c76852bfb"},"format":"mach-o"}],"captures":[],"environments":[],"providers":[{"id":"ghidra","name":"Ghidra","version":"12.1.4"},{"id":"rea-workflow","name":"REA composed investigation workflow","version":"1"}],"records":[{"analysis_profile":{"digest":"20565088524a2d0359b9b96f46ac48e679d774c7b0092c56abc06de8fdbec11c","parameters":{"analyzer_preset":"ghidra-default","annotation_policy":"atomic-function-entry-metadata-v1","architecture":"arm64","available_architectures":["arm64"],"compiler_spec_id":"auto-default","decompiler_jump_loads":true,"function_body_evidence":"complete-inclusive-ranges-v1","function_boundary_observations":"ghidra-terminal-call-limitations-v1","function_references":"complete-body-and-entry-reference-manager-v2","import_mode":"ephemeral-source-immutable","instruction_flow_evidence":"decoded-return-pcode-v1","jump_table_evidence":"typed-case-default-blocks-v1","language_id":"auto-from-header","load_image_observations":"source-mappings-entry-context-v2","loader":"auto-from-header","location_resolution":"explicit-address-exact-entry-symbol-first-v3","no_return_repair":"returning-imports-decoded-return-v2","process_launch":"inspected-jvm-launch-support-v1","string_inventory_evidence":"defined-data-coverage-v1","target_format":"mach-o","target_kind":"executable"},"provider":{"id":"ghidra","name":"Ghidra","version":"12.1.4"}},"authority":"shipped-artifact","confidence":"observed","environment":null,"evidence_id":"ev_0719399b08d56c80e1ac22c44d76b02e1f05d307dcb5a95eac02f8dd0445ccb9","evidence_links":[],"limitations":["The session serves operations only after Ghidra reports default auto-analysis complete; incomplete analysis does not expose partial results.","The imported Program and temporary project are ephemeral and deleted on close. Annotation operations edit session database metadata; original executable bytes are never written.","Cancelling an active Ghidra request terminates its ephemeral database and discards session annotations. The selected target remains open; the next provider query imports the original artifact again.","Default-space addresses use lowercase 0x-prefixed hexadecimal; other address spaces use <percent-encoded-space>:0x<hex>.","Regex mode uses Java Pattern semantics. Matcher or compiler stack exhaustion returns a resource constraint without closing the session; literal mode avoids regex recursion and returns complete matching values.","macOS sessions require a matching executable Ghidra native decompiler; REA checks for it but does not build native components or change Gatekeeper quarantine state."],"locations":[],"normalized_result":[{"address":"0x100008948","value":"MSSSectionCardParameterValue::showFaceTrackBox"},{"address":"0x100008950","value":"MSSSectionCardParameterValue::setShowFaceTrackBox:"},{"address":"0x1000089b8","value":"MSSSectionCardParameterValue::faceTrackEnabled"},{"address":"0x1000089c0","value":"MSSSectionCardParameterValue::setFaceTrackEnabled:"},{"address":"0x1000089c8","value":"MSSSectionCardParameterValue::faceTrackStatus"},{"address":"0x1000089d0","value":"MSSSectionCardParameterValue::setFaceTrackStatus:"},{"address":"0x1000089d8","value":"MSSSectionCardParameterValue::faceTrackRevision"},{"address":"0x1000089e0","value":"MSSSectionCardParameterValue::setFaceTrackRevision:"},{"address":"0x1000089e8","value":"MSSSectionCardParameterValue::faceTrackFrameCount"},{"address":"0x1000089f0","value":"MSSSectionCardParameterValue::setFaceTrackFrameCount:"},{"address":"0x1000089f8","value":"MSSSectionCardParameterValue::faceTrackSeedTimeSeconds"},{"address":"0x100008a00","value":"MSSSectionCardParameterValue::setFaceTrackSeedTimeSeconds:"},{"address":"0x100008a08","value":"MSSSectionCardParameterValue::faceTrackProgress"},{"address":"0x100008a10","value":"MSSSectionCardParameterValue::setFaceTrackProgress:"},{"address":"0x100008a18","value":"MSSSectionCardParameterValue::faceTrackAppendMode"},{"address":"0x100008a20","value":"MSSSectionCardParameterValue::setFaceTrackAppendMode:"},{"address":"0x100008a28","value":"MSSSectionCardParameterValue::faceTrackData"},{"address":"0x100008a30","value":"MSSSectionCardParameterValue::setFaceTrackData:"},{"address":"0x100008a38","value":"MSSSectionCardParameterValue::faceTrackTargetCount"},{"address":"0x100008a40","value":"MSSSectionCardParameterValue::setFaceTrackTargetCount:"},{"address":"0x100008a48","value":"MSSSectionCardParameterValue::faceTrackActiveTargetIndex"},{"address":"0x100008a50","value":"MSSSectionCardParameterValue::setFaceTrackActiveTargetIndex:"},{"address":"0x100008a58","value":"MSSSectionCardParameterValue::faceTrackAnalysisTargetIndex"},{"address":"0x100008a60","value":"MSSSectionCardParameterValue::setFaceTrackAnalysisTargetIndex:"},{"address":"0x100008a68","value":"MSSSectionCardParameterValue::faceTrackTargetPageStartIndex"},{"address":"0x100008a70","value":"MSSSectionCardParameterLine truncated