diff --git a/AGENTS.md b/AGENTS.md
index 5869bd68..c4b030df 100644
--- a/AGENTS.md
+++ b/AGENTS.md
@@ -39,7 +39,10 @@ primary evidence.
 3. Export raw decompilation artifacts (pseudocode, listings) into `decomp/`
    using per-binary subdirectories, e.g. `decomp/GameServer_Release_USA_x64/`.
    Keep filenames stable and function-address-based so results are reproducible.
-4. Close the REA session (`close_binary`) when the investigation is complete.
+4. Track targets, artifact SHA-256 identities, and per-binary status in
+   `decomp/INVENTORY.md`; keep a per-binary finding ledger in
+   `decomp/<name>/evidence.md`.
+5. Close the REA session (`close_binary`) when the investigation is complete.
 
 ## Evidence and claims
 
@@ -59,6 +62,13 @@ primary evidence.
 - Do not install Ghidra, Java, Node, or REA prerequisites ad hoc — they are
   provisioned via `mise.toml` and `/opt/ghidra`; repair configuration instead.
 - Version-pin REA at `rea-agents@6.5.0` as declared in `opencode.json`.
+- Do not add npm `devEngines`/`packageManager` constraints to `package.json` —
+  they make `npx` exit `EBADDEVENGINES` in this directory and break the REA MCP
+  launch (this happened once; `devEngines` was removed).
+- Keep the REA registration **project-local**: `opencode.json` in this repo is
+  the source of truth. Do not write global client config
+  (`~/.config/opencode/…`) or run `rea setup` against global paths —
+  `rea doctor` may report global registration drift; that is accepted here.
 - When tooling is missing or an MCP call is blocked, diagnose the specific
   blocker (registration vs. restart vs. provider) rather than re-running setup
   wholesale — see the REA skill's connection-and-recovery reference.
diff --git a/decomp/INVENTORY.md b/decomp/INVENTORY.md
new file mode 100644
index 00000000..256021b9
--- /dev/null
+++ b/decomp/INVENTORY.md
@@ -0,0 +1,99 @@
+# Decomp inventory — Rusty Hearts server binaries
+
+Generated 2026-10-14 from `binaries/` (read-only source). SHA-256 values are the
+artifact identities used to correlate future REA Evidence (REA reports target
+SHA-256; cite these values when reconciling).
+
+Toolchain baseline: Ghidra 12.1.2 (`/opt/ghidra`, headless + native decompiler,
+Java 21.0.2, linux/x64) · REA `rea-agents@6.5.0` (expected skill v42).
+
+**Status legend:** `pending` = no REA session run yet · `open` = session analyzed,
+decomp export incomplete · `done` = pseudocode + overview exported to
+`decomp/<name>/`.
+
+**Roles below are inferred from filenames/sizes alone and are NOT yet
+corroborated by decompilation** (AGENTS.md ground rules). Treat them as
+hypotheses to confirm or revise during analysis.
+
+## Server executables (PE32+ x86-64, console subsystem unless noted)
+
+| File | Bytes | KiB | SHA-256 | Role (inferred) | Status |
+|------|------:|----:|---------|-----------------|--------|
+| `GameServer_Release_USA_x64.exe` | 10564096 | 10316.5 | 5bc012107758a9bd23b1e20324f9e6664cd21f314382f5e8eabff0a55ed24277 | core gameplay server | pending |
+| `DungeonServer_Release_USA_x64.exe` | 8931840 | 8722.5 | 8634e22dee65899addfa10c9bc7f9dfeac963135f9223b70d1ededa2ed97e8bc | dungeon/instance logic | pending |
+| `PVPServer_Release_USA_x64.exe` | 8578048 | 8377.0 | 1605efdd60c4ecb2c21d96af63e063a39f0c4a6ca3159c0dfcadb3d6d33bb3c3 | PvP logic | pending |
+| `GuildServer_Release_USA_x64.exe` | 6996480 | 6832.5 | 5265bbe9070f9a1f35793331ee0e3c2dac6f5ac064212916a9423c9d465b3cfb | guild logic | pending |
+| `ManagerServer_Release_USA_x64.exe` | 6666752 | 6510.5 | c239477294c199f8df4ef70138cc1583c87838dd5e8cebed2ff0fae2bc6c5be2 | management/admin | pending |
+| `AuctionServer_Release_USA_x64.exe` | 6477824 | 6326.0 | ebca9cc047aeca125ac0621e3652339096c74862746157adc6c72057422f6dcf | auction house | pending |
+| `MatchServer_Release_USA_x64.exe` | 6134784 | 5991.0 | 341dd4a38c9e1abb590f60325ef52bf24b60a48a70e36e2f1651bbf00591fcf2 | matchmaking | pending |
+| `DBCServer_Release_x64.exe` | 3542016 | 3459.0 | d9e4fccdf3482e50247686d4452c0b13c75a53efc4bd7320668eece8d1ce828c | DB/cache access | pending |
+| `DBCServer_LOG_Release_x64.exe` | 3394560 | 3315.0 | 2636d51679abb7703a6386a398f2afb985704aa0ce00d53e75d0ff3b093f5836 | logging DB variant | pending |
+| `GameGatewayServer_Release_x64.exe` | 3330560 | 3252.5 | 4cbec55dc3dfe5a0eeba3170722e6f1d33e55d6a0d007774266fe9db96f25d1a | gateway/proxy | pending |
+| `GMServer_Release_x64.exe` | 2004480 | 1957.5 | 8fba9dbb8809419d6e2edaee31d9ad60501341d97dca0fc82a1c1e7cc32199d1 | game-master tools | pending |
+| `MessageServer_Release_x64.exe` | 1850368 | 1807.0 | 7911b15c4379625eaa12ff227708aa3a033bc6ac2cf6b34283136e3a62df25f1 | messaging/pub-sub | pending |
+| `AgentManager_Release_x64.exe` | 1584128 | 1547.0 | 8fd8ca91725858651a7839d34257b10c2970ac16c97e60c523b8b0c983fcb186 | agent orchestration | pending |
+| `Agent_Release_x64.exe` | 1472512 | 1438.0 | 6f2be7b8eb799ba51b359d1958720aac5baee5b7ee0d1d36684d3cbd72d45469 | agent worker | pending |
+| `SMMonitoring_Release_x64 1.exe` | 1294848 | 1264.5 | bc5197e350ab2054132cdad5c28a809fe2e64a55d4250ff8a53088d4de94515a | monitoring (GUI) | pending |
+| `SMMonitoring_Release_x64 2.exe` | 1221120 | 1192.5 | 2d81a2fd547401826ad79c8d6e4db950641d6e59b5cb26a8158607aee0f0616f | monitoring (GUI), differs from #1 | pending |
+
+## Support DLLs
+
+Third-party/support libraries loaded by the servers. Decomp scope is
+case-by-case (imports/behavior corroboration first; most are stock libraries).
+
+| File | Bytes | SHA-256 | Note (inferred) |
+|------|------:|---------|-----------------|
+| `20100731_521_XTrap4Server.dll` | 22528 | 2c16b0930a1cc39b6dca2c800de0c111a1df32bd2bad66597a497d1a1716b042 | XTrap anti-cheat; byte-identical to `XTrap4Server.dll` (observed: equal SHA-256) |
+| `XTrap4Server.dll` | 22528 | 2c16b0930a1cc39b6dca2c800de0c111a1df32bd2bad66597a497d1a1716b042 | duplicate of above |
+| `ApexProxy.dll` | 150016 | a686e0667e398600d169f2cb089103fff1450b5489f6f1a749b0b70fccba712d | proxy/guard |
+| `ApexProxyMain.dll` | 165888 | d4f9414ef80bda6094ec3b6d4ef931741722805009d5a0e0f62afc3ec64f6bbe | proxy/guard |
+| `BugTrapU-x64.dll` | 354304 | 7f6b42dd796e23b4fcdc20612b2d5948cf6991e8216bf6e64e5e3edcd48d5a3c | crash reporting |
+| `dbghelp.dll` | 1213200 | c06430b8cb025be506be50a756488e1bcc3827c4f45158d93e4e3eeb98ce1e4f | debug helpers |
+| `hasp_windows_x64_95595.dll` | 4675584 | 97c7441ef2b363200c8e6d3487a99ac91d77587219dcdb095845ee722894a64d | Aladdin HASP licensing |
+| `libcurld_Win32.dll` | 346112 | ba645055b84ff64287a2cc8e1e6a35497184e28511fd8e246bd955c8a170dba7 | libcurl (Win32, debug) |
+| `libcurld_x64.dll` | 482816 | e969aac1ed3a46770ba90984ed9dcc2306d61b83d95a88994a01e6e5a34dac6b | libcurl (x64, debug) |
+| `libcurl_Win32.dll` | 216064 | dfdd740ae25d7fae21a0467c19534fb99cc43d66d66f29b562247b1cdb729344 | libcurl (Win32) |
+| `libcurl_x64.dll` | 270848 | f5a58bb70fb04945d35f944d8461a0bad6c98ef5a4637d4da2cda8821a5806a8 | libcurl (x64) |
+| `libeay32.dll` | 1495040 | 964c1806cb532f9f03264181aada6e722e1ac2ff20f63ea0705802d061cc6b25 | OpenSSL crypto |
+| `ssleay32.dll` | 301568 | 160eb58f7ea1370d5e1ead408d74bd343f860046ee2b8dc1cd39fe90202f8388 | OpenSSL SSL |
+| `XLSLogin.dll` | 56360 | 2e7dbfa9c08becb467f54cfec9a85759cdb04d3195a2a94ddc4b254b0e30e5a5 | login helper |
+
+Win32 (not x64) DLLs are present alongside x64 builds — likely shipped for
+32-bit tools; x64 servers use the `_x64` variants (inference).
+
+## Non-PE evidence (not decomp targets)
+
+- `binaries/Lua/` — readable game scripts; cite directly as evidence.
+- `binaries/table/`, `Map/`, `Item/`, `Character/`, `Object/`, `Effect/`, … —
+  game data assets; corroborating evidence for decomp findings, not binaries.
+- `schema/` — SQL Server `.mdf`/`.ldf` for RustyHearts DBs; corroboration for
+  DB-related code paths (DBCServer, GameServer).
+
+## Output layout convention (per AGENTS.md)
+
+```
+decomp/
+  INVENTORY.md                  <- this file
+  <binary_stem>/                <- one dir per analyzed binary, e.g. GameServer_Release_USA_x64/
+    binary_overview.json        <- REA binary_overview / session metadata
+    <addr>.pseudo.c             <- decompiled pseudocode, function-address-named
+    <addr>.asm                  <- listings where needed
+    evidence.md                 <- per-binary finding ledger (Evidence IDs, inferences, gaps)
+```
+
+Filenames must be stable and address-based so re-runs overwrite rather than
+accumulate. Keep Evidence IDs from REA sessions in `evidence.md`.
+
+## Pipeline status
+
+- Ghidra provider: healthy (doctor 2026-10-14 — version, headless, decompiler,
+  Java all OK).
+- REA MCP launch: **blocker resolved** (2026-10-14) — project `package.json`
+  declared `devEngines.packageManager: pnpm`, which made `npx` exit with
+  `EBADDEVENGINES` in this directory, so opencode could not start the server
+  (`server unavailable key=rea status=failed`). `devEngines` removed; local
+  `npx -y rea-agents@6.5.0 mcp` verified starting. Registration is
+  project-local only (`opencode.json`); the global `~/.config/opencode` drift
+  reported by `rea doctor` is accepted by design. **Requires an opencode
+  session restart for REA tools to connect.**
+- No decomp exports yet; all targets `pending`.
diff --git a/package.json b/package.json
index 00ad7a04..f246f1e1 100644
--- a/package.json
+++ b/package.json
@@ -9,12 +9,5 @@
   "keywords": [],
   "author": "",
   "license": "ISC",
-  "devEngines": {
-    "packageManager": {
-      "name": "pnpm",
-      "version": "^11.10.0",
-      "onFail": "download"
-    }
-  },
   "type": "module"
 }