feat(analysis): make resource budgets recoverable across CLI and MCP (#9706)

* refactor(analysis): centralize resource budgets and recovery facts

* feat(analysis): expose ASAR and Ghidra runtime admission controls

* feat(artifacts): expose reader admission and preserve limited recognition

* feat(javascript): expose recoverable semantic precision budgets

* feat(web): add recoverable source-map budgets and compact retained views

* feat(web): make historical capture decoding budgets recoverable

* fix(desktop): enforce selected view policies across capture and export

* feat(runtime): make Frida and LLDB retention budgets selectable

* feat(native): expose diagnostic budgets and preserve exhaustion causes

* feat(managed): expose recoverable snapshot and representation budgets

* feat(metadata): make Go and Rust inspection budgets recoverable

* feat(wasm): expose representation and producer admissions

* feat(evm): expose per-call worker resource budgets

* feat(android): make resource and string-pool omissions recoverable

* feat(producers): expose command and recorded-capture budgets

* docs(analysis): record recovery contracts and integrated validation

* fix(docs): link calibration oracle from published verification pages

* fix(docs): restore desktop task anchors and receipt links

* test(analysis): align fixtures with selectable budget contracts

* fix(analysis): remove source-location projector dependency cycle

* test(analysis): refresh budget recovery and verifier regressions

* test(analysis): preserve format and publication recovery expectations

* test(windows): align conformance with owned runtime admission

* fix(desktop): preserve selected alias kinds in exported state

* test(analysis): align provider fixtures with recoverable budgets

* test(desktop): validate emitted alias metadata structurally

* fix(ghidra): classify bounded Windows endpoint refusals

* test(cli): assert selectable artifact admission recovery

* fix(cli): preserve capture provenance in environment builds

src/cli/artifactCommands.ts

@@ -16,6 +16,8 @@ import { keyedArchiveInputSchema } from "../domain/apple/keyedArchive.js";
 import { localPathStringSchema } from "../domain/localPath.js";
 import { z } from "incur";
 import { cliDecimalField } from "./options.js";
+import { producerLimitsOption } from "./producerLimitsOption.js";
+import { artifactReaderLimitsInputSchema } from "../domain/artifactReaderLimits.js";
 
 import { artifactExtractionInputSchema } from "../contracts/artifactToolContracts.js";
 
@@ -32,6 +34,13 @@ const keyedArchiveInputBinding = {
   fields: { path: "archive" },
 } as const;
 
+const artifactLimitsOption = producerLimitsOption(
+  artifactReaderLimitsInputSchema,
+  "artifact-limits",
+).describe(
+  "JSON artifact producer admissions: bun, dotnet_bundle, node_sea, godot, and expanded_bytes. Omitted fields keep defaults; changes apply on the next call without restart. Independent of summary/paging and client delivery limits.",
+);
+
 export const registerArtifactCommands = (
   cli: CliInstance,
   logger: Logger,
@@ -254,6 +263,7 @@ const registerExtractionCommand = (
     }),
     options: z.object({
       // Incur needs an ordinary optional; keep the owning contract's metadata.
+      artifactLimits: artifactLimitsOption,
       outputRoot: artifactExtractionInputSchema.shape.output_root
         .unwrap()
         .optional()
@@ -277,6 +287,9 @@ const registerExtractionCommand = (
           "extract_artifact",
           {
             integrity_policy: options.integrityPolicy,
+            ...(options.artifactLimits === undefined
+              ? {}
+              : { artifact_limits: options.artifactLimits }),
             output_root: createArtifactExtractionDestination(
               options.outputRoot,
             ),
@@ -306,6 +319,7 @@ const registerInspectionCommand = (
     }),
     options: z.object({
       ...analysisEvidenceDeliveryOptions,
+      artifactLimits: artifactLimitsOption,
       integrityPolicy: z
         .enum(["fail", "record-and-continue"])
         .default("fail")
@@ -327,7 +341,12 @@ const registerInspectionCommand = (
           const complete = await runProviderAnalysis(
             args.path,
             "inspect_artifact",
-            { integrity_policy: options.integrityPolicy },
+            {
+              integrity_policy: options.integrityPolicy,
+              ...(options.artifactLimits === undefined
+                ? {}
+                : { artifact_limits: options.artifactLimits }),
+            },
             logger,
             signal,
             undefined,