fix(javascript): isolate source analysis and retain bounded partial evidence (#1651)

* refactor(javascript): validate transferable file projections

* test(javascript): consume decoded module and static facts

* fix(javascript): isolate source analysis and retain bounded partial evidence

* test(javascript): verify cleanup retention and repeated source paths

src/application/javascript/JavaScriptArtifactGraphBuilder.ts

@@ -107,19 +107,33 @@ function* buildJavaScriptArtifactGraphInputSteps(
   yield;
   addJavaScriptArtifactFiles(context);
   yield;
-  const packageRoots = addJavaScriptPackageNodes(context);
+  // Raw observations remain on the file nodes. Only admitted expansions feed
+  // the relationship builders, including their Electron and bundler callers.
+  const projectionContext = {
+    ...context,
+    analysis: {
+      ...analysis,
+      files: analysis.files.map((file) =>
+        file.application_projection_failure === undefined
+          ? file
+          : { ...file, javascript: null, semantic: null },
+      ),
+    },
+  };
+  const packageRoots = addJavaScriptPackageNodes(projectionContext);
   yield;
-  addJavaScriptSourceModules(context);
+  addJavaScriptSourceModules(projectionContext);
   yield;
-  const bundlerLimitations = addJavaScriptBundlerNodes(context);
+  const bundlerLimitations = addJavaScriptBundlerNodes(projectionContext);
   const relationshipOmissions =
-    yield* addJavaScriptModuleRelationshipsSteps(context);
-  const findingLimitations = yield* addJavaScriptStaticFindingsSteps(context);
-  addElectronBoundaries(context);
+    yield* addJavaScriptModuleRelationshipsSteps(projectionContext);
+  const findingLimitations =
+    yield* addJavaScriptStaticFindingsSteps(projectionContext);
+  addElectronBoundaries(projectionContext);
   yield;
-  addJavaScriptHtmlRoles(context);
+  addJavaScriptHtmlRoles(projectionContext);
   yield;
-  addJavaScriptSourceMapOriginals(context);
+  addJavaScriptSourceMapOriginals(projectionContext);
   yield;
   const coverage = graphCoverage(context);
   return {
@@ -153,14 +167,34 @@ const graphCoverage = (context: JavaScriptArtifactGraphContext) => {
       javascript !== null && javascript.parse_status === "partial",
   );
   const unknownGap =
+    context.analysis.files.some(
+      ({ analysis_failure, application_projection_failure }) =>
+        analysis_failure !== undefined ||
+        application_projection_failure !== undefined,
+    ) ||
     context.analysis.parse_failures > 0 ||
     context.fileSet.invalid_utf8_files > 0 ||
     sourceMapPolicyGap ||
     malformedStructuredData ||
     partialJavaScript;
-  if (resourceLimits.length > 0)
+  const executionLimits = context.analysis.files.flatMap(
+    ({ analysis_failure, application_projection_failure }) =>
+      [analysis_failure, application_projection_failure].flatMap((failure) =>
+        failure === undefined
+          ? []
+          : javaScriptAnalysisCoverageLimits(failure.limits),
+      ),
+  );
+  if (resourceLimits.length > 0 || executionLimits.length > 0)
     return partialApplicationCoverage(
-      semanticResourceLimitCoverage(resourceLimits),
+      [
+        ...new Map(
+          [
+            ...semanticResourceLimitCoverage(resourceLimits),
+            ...executionLimits,
+          ].map((limit) => [JSON.stringify(limit), limit]),
+        ).values(),
+      ],
       null,
     );
   if (unknownGap) return partialApplicationCoverage([], null);
@@ -260,3 +294,4 @@ const graphLimitations = (
         ]),
   ];
 };
+import { javaScriptAnalysisCoverageLimits } from "../../domain/javascript/javascriptAnalysisResourceControls.js";