fix(settings): classify caller-selected limits as parameter updates

analysis_timeout_ms, max_heap_mb, and command_timeout_ms keep the source chosen by the caller, the runtime override, or the built-in default. A request value reports update_mode parameter because update_analysis_settings cannot change that call.

src/application/javascript/JavaScriptArtifactReconstruction.ts

@@ -1,6 +1,7 @@
 import { discoverJavaScriptPreloadPaths } from "./JavaScriptPreloadDiscovery.js";
 import { artifactNameForClassification } from "../../domain/artifactNameSelection.js";
 import type { AnalysisSettingValues } from "../../domain/analysisSettings.js";
+import { selectedAnalysisSetting } from "../../domain/analysisSettingDefinitions.js";
 import { absoluteCallerPath } from "../../filesystem/callerPath.js";
 import {
   DEFAULT_ASAR_HEADER_ADMISSION,
@@ -181,18 +182,24 @@ export const reconstructJavaScriptArtifact = async (
           ? {}
           : { fileNodes: input.max_semantic_nodes_per_file }),
       });
+      const heap = selectedAnalysisSetting(
+        input.max_heap_mb,
+        overrides?.["javascript.max_heap_mb"],
+        JAVASCRIPT_ANALYSIS_RESOURCE_DEFAULTS.heapMb,
+      );
+      const timeout = selectedAnalysisSetting(
+        input.analysis_timeout_ms,
+        overrides?.["javascript.analysis_timeout_ms"],
+        JAVASCRIPT_ANALYSIS_RESOURCE_DEFAULTS.timeoutMs,
+      );
       const sourceLimits = {
         ...(input.semantic_precision === undefined
           ? {}
           : { semanticPrecision: input.semantic_precision }),
-        heapMb:
-          input.max_heap_mb ??
-          overrides?.["javascript.max_heap_mb"] ??
-          JAVASCRIPT_ANALYSIS_RESOURCE_DEFAULTS.heapMb,
-        timeoutMs:
-          input.analysis_timeout_ms ??
-          overrides?.["javascript.analysis_timeout_ms"] ??
-          JAVASCRIPT_ANALYSIS_RESOURCE_DEFAULTS.timeoutMs,
+        heapMb: heap.value,
+        heapSource: heap.source,
+        timeoutMs: timeout.value,
+        timeoutSource: timeout.source,
       };
       const preloads = await discoverJavaScriptPreloadPaths(
         files,

src/application/wasm/WasmArtifactPort.ts

@@ -15,6 +15,8 @@ export type WasmArtifactExecution = Omit<AnalysisExecution, "subject"> & {
 /** Effective operation budget, separate from caller-authored Evidence parameters. */
 export interface WasmArtifactExecutionOptions extends ExecutionOptions {
   readonly commandTimeoutMs?: number;
+  /** Selection owner for `commandTimeoutMs`. Absent when the caller did not record it. */
+  readonly commandTimeoutSource?: "default" | "runtime" | "request" | undefined;
 }
 
 /** Replaceable offline WASM inspection engine, independent of target execution and network clients. */

src/application/wasm/WasmArtifactService.test.ts

@@ -240,6 +240,7 @@ it("gives cancellation precedence over malformed raw input", async () => {
 it("uses runtime defaults only for omitted budgets, preserving explicit input and reset", async () => {
   const settings = new AnalysisSettings({});
   const accepted: number[] = [];
+  const sources: (string | undefined)[] = [];
   const authored: (number | undefined)[] = [];
   const service = new WasmArtifactService(
     {
@@ -248,6 +249,7 @@ it("uses runtime defaults only for omitted budgets, preserving explicit input an
         const value = wasmArtifactFixture();
         value.tool_profile.timeout_ms = options!.commandTimeoutMs!;
         accepted.push(options!.commandTimeoutMs!);
+        sources.push(options!.commandTimeoutSource);
         authored.push(input.command_timeout_ms);
         return ok(wasmArtifactExecution(value));
       },
@@ -275,6 +277,7 @@ it("uses runtime defaults only for omitted budgets, preserving explicit input an
   });
   expect((await settings.run(() => service.inspect({ path }))).ok).toBe(true);
   expect(accepted).toEqual([123000, 42000, 30000]);
+  expect(sources).toEqual(["runtime", "request", "default"]);
   expect(authored).toEqual([undefined, 42000, undefined]);
 });
 

src/application/wasm/WasmArtifactService.ts

@@ -1,4 +1,5 @@
 import type { AnalysisSettingsReader } from "../../domain/analysisSettings.js";
+import { selectedAnalysisSetting } from "../../domain/analysisSettingDefinitions.js";
 import { constants as bufferConstants } from "node:buffer";
 import type { ExecutionOptions } from "../AnalysisProvider.js";
 import {
@@ -78,13 +79,15 @@ export class WasmArtifactService {
           ),
         );
     }
-    const timeout =
-      input.value.command_timeout_ms ??
-      this.settings?.().overrides["wasm.command_timeout_ms"] ??
-      DEFAULT_WASM_COMMAND_TIMEOUT_MS;
+    const timeout = selectedAnalysisSetting(
+      input.value.command_timeout_ms,
+      this.settings?.().overrides["wasm.command_timeout_ms"],
+      DEFAULT_WASM_COMMAND_TIMEOUT_MS,
+    );
     const inspected = await this.provider.inspect(input.value, {
       ...options,
-      commandTimeoutMs: timeout,
+      commandTimeoutMs: timeout.value,
+      commandTimeoutSource: timeout.source,
     });
     if (!inspected.ok) return inspected;
     const execution = inspected.value;
@@ -108,7 +111,7 @@ export class WasmArtifactService {
       !report.success ||
       report.data.artifact.path !== input.value.path ||
       execution.subject.path !== input.value.path ||
-      report.data.tool_profile.timeout_ms !== timeout ||
+      report.data.tool_profile.timeout_ms !== timeout.value ||
       report.data.tool_profile.output_budget_bytes !==
         wasmResourceLimits(input.value).outputBytes ||
       !wasmArtifactMatchesSubject(report.data.artifact, execution.subject) ||