fix(browser): name web-bundle budgets and recover web deadlines (#6036)

* fix(browser): name web-bundle budgets and recover web deadlines

Name the existing heap, per-script, and total web-bundle phases, and reject a per-script deadline above the total. Promote capture, CDP command, source-map decode, and source-map fetch deadlines at today's defaults. Name DevTools timeoutMs, and state that discovery, cleanup grace, byte budgets, and Electron hook retention have no runtime override.

Refs #5910

Co-authored-by: morluto <morluto@users.noreply.github.com>

* fix(browser): apply selected web deadlines to the owning phase

Keep HTTP and browser-socket discovery on the fixed discovery deadline so a
short command_timeout_ms starts at the handshake. Apply scenario
command_timeout_ms to launch startup and the primary connect session, and
keep service-worker restoration on the fixed 5000 ms grace. Omit
command_timeout_ms from recovery text when the operation does not accept it.

Co-authored-by: morluto <morluto@users.noreply.github.com>

* fix(browser): retain scenario commands that finish after their deadline

A timed-out scenario command stays owned so cleanup can close a late
browser or context and restore a mutation that lands after the deadline.
Child storage replies use that deadline, scenario recovery names
command_timeout_ms in the capture JSON, and the session test connection
implements beginCleanupGrace.

Co-authored-by: morluto <morluto@users.noreply.github.com>

* fix(browser): keep child command timeouts as the public failure

A nested command such as Page.enable that is delivered but never answered
was stored as protocol_error, hiding the command name, selected deadline,
and recovery. Store the typed timeout and assert that public error.

Co-authored-by: morluto <morluto@users.noreply.github.com>

* fix(browser): keep runtime cleanup on the fixed grace

Switch runtime restoration to the cleanup grace before the first send so a
short command_timeout_ms cannot fail an otherwise successful observation.
Stop advertising command_timeout_ms on list_browser_targets, which never
bounds a post-discovery command.

Co-authored-by: morluto <morluto@users.noreply.github.com>

* test(browser): prove a short command deadline cannot fail runtime cleanup

Drive restoration through the runtime fixture. A cleanup command that
outlives command_timeout_ms still succeeds, and a stalled restoration
names the fixed 5000 ms grace.

Co-authored-by: morluto <morluto@users.noreply.github.com>

* fix(browser): name the effective source-map decode deadline

codecBudgetLimitation reported a fixed 20-second deadline after a
caller selected decode_timeout_ms. Result and Evidence limitations
now name that effective millisecond deadline.

Co-authored-by: morluto <morluto@users.noreply.github.com>

* fix(browser): separate handshake and target-attach deadlines

A browser-level Target.attachToTarget no longer shares the WebSocket
handshake budget. Blocked service-worker attachment keeps discovery on
its fixed deadline and applies command_timeout_ms to the later handshake
and attach.

Co-authored-by: morluto <morluto@users.noreply.github.com>

* fix(browser): name the web-bundle resource each runtime exhausts

Bun ignores the V8 old-space flag. A Windows Job reports the process
commit limit, and other Bun hosts no longer suggest raising max_heap_mb.

Co-authored-by: morluto <morluto@users.noreply.github.com>

* fix(browser): cite the browser-socket discovery message budget

WebSocket discovery enforces the 64 MiB protocol budget. Timeout
recovery no longer advertises the 8 MiB HTTP document budget.

Co-authored-by: morluto <morluto@users.noreply.github.com>

* fix(browser): bound the blocked service-worker check before discovery

The first registration check has its own fixed 10s deadline. Discovery,
handshake, and Target.attachToTarget stay on their separate deadlines.

Co-authored-by: morluto <morluto@users.noreply.github.com>

* fix(browser): name the operand that stopped web-bundle admission

Host heap pressure no longer claims the fixed result budget is exhausted.
A Windows Bun allocation before the commit limit still names that limit.

Co-authored-by: morluto <morluto@users.noreply.github.com>

---------

Co-authored-by: Cursor Agent <cursoragent@cursor.com>
Co-authored-by: morluto <morluto@users.noreply.github.com>

docs/browser-observation.md

@@ -385,7 +385,8 @@ section explicitly truncated.
 Disallowed-origin entries are filtered before retention.
 
 Selected script-source collection shares a 32 MiB aggregate UTF-8 retention
-budget and a 20-second deadline across the capture. An oversized source is
+budget and the `command_timeout_ms` deadline (default 20000 ms) across the
+capture. The byte budget has no runtime override. An oversized source is
 omitted while later smaller sources may still fit. When the deadline expires,
 remaining source reads are skipped. Script metadata, per-item omission reasons,
 and `script_sources` completeness remain available. A single CDP response can
@@ -393,19 +394,25 @@ still be materialized up to the separate 64 MiB transport limit before source
 admission; the retention budget does not bound that transient allocation.
 
 Bundle parsing and semantic inspection run sequentially in an owned child,
-without executing captured code. `max_heap_mb` defaults to 1024 MiB V8
-old-space; `analysis_timeout_ms` defaults to 30000 per script, including startup
-and transfer. A failed or timed-out script becomes an explicit unknown while
-completed findings and later scripts remain available. `total_analysis_timeout_ms`
-defaults to 300000 across script analysis; expiry returns a typed timeout with
-partial Evidence and identifies unstarted scripts. These controls are also
-available as CLI flags with hyphenated names. Capture and optional source-map
-fetching have separate budgets.
+without executing captured code. These are separate phases. `max_heap_mb`
+defaults to 1024 MiB V8 old-space (range 128..16384). `analysis_timeout_ms`
+defaults to 30000 per script, including startup and transfer.
+`total_analysis_timeout_ms` defaults to 300000 across script analysis. A
+per-script deadline above the effective total is rejected. A failed or
+timed-out script becomes an explicit unknown while completed findings and later
+scripts remain available. Total-deadline expiry returns a typed timeout with
+partial Evidence and identifies unstarted scripts. `source_map_fetch_timeout_ms`
+defaults to 30000 and is an item limitation, not that analysis timeout. These
+controls are also available as CLI flags with hyphenated names. Worker protocol
+and result byte budgets have no runtime override.
 
 One web-bundle capture/analysis is admitted per REA process at a time. Completed
 script results share an 8 MiB serialized transfer budget, with host heap
 reservation checked before decoding and validating another result.
-Exhausted result capacity stops further script launches and returns a typed
+When the host reservation is what reaches zero, the failure names that heap
+headroom and the remaining fixed budget. When the 8 MiB allowance itself is
+exhausted, the failure names that fixed budget and says it has no runtime
+override. Either stop ends further script launches and returns a typed
 resource failure with completed facts and explicit unstarted-script unknowns.
 Worker control frames are limited to 64 KiB. Cleanup must confirm child termination
 before releasing its private files; failed cleanup retains its exact owner and
@@ -415,8 +422,10 @@ facts, including cancellation during final cleanup.
 The worker heap setting is not a process-family RSS limit. Node enforces V8
 old-space flags; Bun ignores them. Windows Bun instead uses an owned process
 commit limit with a 512 MiB runtime reserve; other Bun hosts have no enforced
-memory limit. These bounds do not establish an aggregate host-memory limit
-across other REA operations or external processes.
+memory limit. An allocation failure before that Windows limit is reported as
+reached still names the configured limit and says it was not reached. These
+bounds do not establish an aggregate host-memory limit across other REA
+operations or external processes.
 
 Resource-tree inventories distinguish a valid empty `resources` array from a
 missing or malformed collection. Invalid resource entries are omitted with
@@ -430,12 +439,24 @@ an invalid supplied size remains unknown with incomplete resource coverage while
 the resource's other facts are retained. Zero and nonnegative fractional sizes
 are preserved.
 
-CDP discovery has a 10-second deadline. Each WebSocket handshake and command
-response has its own 20-second deadline, separate from the caller-selected
-observation window. A stalled handshake or command reports `provider_timeout`;
-caller cancellation still reports cancellation. WebSocket messages remain subject
-to the [64 MiB limit](#request-boundary). REA does not impose a message-count or
-pending-command quota. On cancellation, it closes only its own WebSocket,
+CDP discovery has a 10-second response deadline. HTTP discovery documents
+use an 8 MiB budget. Browser-socket discovery (`Browser.getVersion`,
+`Target.getTargets`) uses the 64 MiB protocol message budget. Neither budget
+nor the discovery deadline has a runtime override. `list_browser_targets` accepts no
+`command_timeout_ms`: HTTP discovery and browser-socket discovery
+(`Browser.getVersion`, `Target.getTargets`) stay on that fixed deadline, and
+the socket closes without a later command. Other CDP tools use
+`command_timeout_ms` (default 20000) for each WebSocket handshake and command
+response, separate from the caller-selected observation window, discovery, and
+the 5000 ms cleanup grace. A browser-level socket's handshake and the following
+`Target.attachToTarget` each receive that full deadline; they do not share one
+budget. A stalled handshake or command reports
+`provider_timeout` and names `command_timeout_ms` only when that operation
+accepts it; caller cancellation still reports cancellation. WebSocket messages
+remain subject to the [64 MiB limit](#request-boundary), which has no runtime
+override. REA does
+not impose a message-count or pending-command quota. On cancellation, it closes
+only its own WebSocket,
 waiting up to one second before terminating it. Malformed unsolicited events
 and malformed replies to pending commands poison the connection so later
 commands fail closed. A correlated reply's session ID must match the command's
@@ -444,7 +465,7 @@ rejects it as unknown; other command rejections retain their reported failure.
 
 Network and console coverage starts only after REA attaches and enables the relevant CDP domains. `prior_activity_available` is always `false`; absence from these arrays is not evidence that an event never occurred. Scripts are different: scripts the page parsed before REA attached are still reported under `scripts`. A page that loaded before attach can therefore list its scripts while `network.requests` lacks the requests that fetched them. If CDP reuses a request ID without supplying redirect metadata, REA retains the predecessor observation and marks network coverage incomplete.
 
-Source maps are not fetched by inspection. Bundle analysis fetches them only when `fetch_source_maps` is selected, with exact-origin redirect checks and no credentials, cookies, or referrer. Each fetch operation has a 30-second deadline and a 64 MiB aggregate streamed-response budget across redirects. A deadline or byte-limit failure remains explicitly unavailable and makes bundle completeness partial. Source-map decoding also bounds raw resolved identities to 64 MiB and aggregate inline evidence to 32 MiB. Failed maps preserve their failure context when it fits; if another context cannot fit, collection stops with the full requested count, the returned processed count, and an explicit unknown-results limitation. Retained mappings and original sources are returned inline. See [source-location limits](web-source-location.md) for the structural decoder bounds. Original source artifacts with `.ts`, `.tsx`, `.mts`, or `.cts` suffixes carry `text/typescript`; other source names retain `text/javascript`.
+Source maps are not fetched by inspection. Bundle analysis fetches them only when `fetch_source_maps` is selected, with exact-origin redirect checks and no credentials, cookies, or referrer. Each fetch operation uses `source_map_fetch_timeout_ms` (default 30000) and a 64 MiB aggregate streamed-response budget across redirects. The byte budget has no runtime override. A fetch overrun is an item limitation, not a thrown analysis timeout. A deadline or byte-limit failure remains explicitly unavailable and makes bundle completeness partial. Source-map decoding also bounds raw resolved identities to 64 MiB and aggregate inline evidence to 32 MiB. Failed maps preserve their failure context when it fits; if another context cannot fit, collection stops with the full requested count, the returned processed count, and an explicit unknown-results limitation. Retained mappings and original sources are returned inline. See [source-location limits](web-source-location.md) for the structural decoder bounds. Original source artifacts with `.ts`, `.tsx`, `.mts`, or `.cts` suffixes carry `text/typescript`; other source names retain `text/javascript`.
 
 source-map items retain the script's `declared_url` separately from the observed
 `effective_url`. successful maps use the latter as their source-resolution base.