feat(analysis): make resource budgets recoverable across CLI and MCP (#9706)

* refactor(analysis): centralize resource budgets and recovery facts

* feat(analysis): expose ASAR and Ghidra runtime admission controls

* feat(artifacts): expose reader admission and preserve limited recognition

* feat(javascript): expose recoverable semantic precision budgets

* feat(web): add recoverable source-map budgets and compact retained views

* feat(web): make historical capture decoding budgets recoverable

* fix(desktop): enforce selected view policies across capture and export

* feat(runtime): make Frida and LLDB retention budgets selectable

* feat(native): expose diagnostic budgets and preserve exhaustion causes

* feat(managed): expose recoverable snapshot and representation budgets

* feat(metadata): make Go and Rust inspection budgets recoverable

* feat(wasm): expose representation and producer admissions

* feat(evm): expose per-call worker resource budgets

* feat(android): make resource and string-pool omissions recoverable

* feat(producers): expose command and recorded-capture budgets

* docs(analysis): record recovery contracts and integrated validation

* fix(docs): link calibration oracle from published verification pages

* fix(docs): restore desktop task anchors and receipt links

* test(analysis): align fixtures with selectable budget contracts

* fix(analysis): remove source-location projector dependency cycle

* test(analysis): refresh budget recovery and verifier regressions

* test(analysis): preserve format and publication recovery expectations

* test(windows): align conformance with owned runtime admission

* fix(desktop): preserve selected alias kinds in exported state

* test(analysis): align provider fixtures with recoverable budgets

* test(desktop): validate emitted alias metadata structurally

* fix(ghidra): classify bounded Windows endpoint refusals

* test(cli): assert selectable artifact admission recovery

* fix(cli): preserve capture provenance in environment builds

src/artifacts/ArtifactEmbeddedFormatProbes.test.ts

@@ -11,6 +11,79 @@ import { dotnetBundleFixture } from "./dotnet/DotnetBundle.fixture.js";
 import { denoMachO } from "./deno/DenoStandalone.fixture.js";
 import * as denoLocation from "./deno/DenoStandaloneLocation.js";
 import * as pckLocation from "./GodotPckLocation.js";
+import { resolveArtifactReaderLimits } from "../domain/artifactReaderLimits.js";
+import { nodeSeaElf } from "./nodeSea/NodeSea.fixture.js";
+
+it("readmits cached SEA recognition when the accepted policy changes", async () => {
+  const path = join(
+    await createTestTempDirectory("rea-probe-policy-"),
+    "carrier",
+  );
+  await writeFile(path, nodeSeaElf({ fuse: "set", ownership: "section" }));
+  await withOwnedRegularFile(path, {}, async (source) => {
+    const original = new ArtifactEmbeddedFormatProbes(path, source);
+    const location = await original.nodeSea();
+    expect(location).toBeDefined();
+    const lower = new ArtifactEmbeddedFormatProbes(
+      path,
+      source,
+      undefined,
+      original.completedFacts(),
+      resolveArtifactReaderLimits({ node_sea: { blob_bytes: 1 } }),
+    );
+    await expect(lower.nodeSea()).rejects.toMatchObject({
+      reason: "limit",
+      readerLimit: {
+        parameter: "artifact_limits.node_sea.blob_bytes",
+        effective_value: 1,
+      },
+    });
+    expect(Object.hasOwn(lower.completedFacts(), "nodeSea")).toBe(false);
+    const restored = new ArtifactEmbeddedFormatProbes(
+      path,
+      source,
+      undefined,
+      lower.completedFacts(),
+      resolveArtifactReaderLimits(),
+    );
+    expect(await restored.nodeSea()).toEqual(location);
+    const recognitionLimited = new ArtifactEmbeddedFormatProbes(
+      path,
+      source,
+      undefined,
+      restored.completedFacts(),
+      resolveArtifactReaderLimits({
+        node_sea: { recognition_header_count: 1 },
+      }),
+    );
+    await expect(recognitionLimited.nodeSea()).resolves.toBeUndefined();
+    expect(Object.hasOwn(recognitionLimited.completedFacts(), "nodeSea")).toBe(
+      false,
+    );
+    expect(
+      recognitionLimited.completedFacts().nodeSeaRecognitionFailure,
+    ).toMatchObject({
+      readerLimit: {
+        parameter: "artifact_limits.node_sea.recognition_header_count",
+        effective_value: 1,
+        required_value: 3,
+      },
+    });
+    const recognitionRestored = new ArtifactEmbeddedFormatProbes(
+      path,
+      source,
+      undefined,
+      recognitionLimited.completedFacts(),
+      resolveArtifactReaderLimits({
+        node_sea: { recognition_header_count: 3 },
+      }),
+    );
+    expect(await recognitionRestored.nodeSea()).toEqual(location);
+    expect(
+      recognitionRestored.completedFacts().nodeSeaRecognitionFailure,
+    ).toBeUndefined();
+  });
+});
 
 it("distinguishes examined absence from unexamined formats and honors cancellation on a cached result", async () => {
   const root = await createTestTempDirectory("rea-embedded-probe-facts-");