feat(analysis): make resource budgets recoverable across CLI and MCP (#9706)

* refactor(analysis): centralize resource budgets and recovery facts

* feat(analysis): expose ASAR and Ghidra runtime admission controls

* feat(artifacts): expose reader admission and preserve limited recognition

* feat(javascript): expose recoverable semantic precision budgets

* feat(web): add recoverable source-map budgets and compact retained views

* feat(web): make historical capture decoding budgets recoverable

* fix(desktop): enforce selected view policies across capture and export

* feat(runtime): make Frida and LLDB retention budgets selectable

* feat(native): expose diagnostic budgets and preserve exhaustion causes

* feat(managed): expose recoverable snapshot and representation budgets

* feat(metadata): make Go and Rust inspection budgets recoverable

* feat(wasm): expose representation and producer admissions

* feat(evm): expose per-call worker resource budgets

* feat(android): make resource and string-pool omissions recoverable

* feat(producers): expose command and recorded-capture budgets

* docs(analysis): record recovery contracts and integrated validation

* fix(docs): link calibration oracle from published verification pages

* fix(docs): restore desktop task anchors and receipt links

* test(analysis): align fixtures with selectable budget contracts

* fix(analysis): remove source-location projector dependency cycle

* test(analysis): refresh budget recovery and verifier regressions

* test(analysis): preserve format and publication recovery expectations

* test(windows): align conformance with owned runtime admission

* fix(desktop): preserve selected alias kinds in exported state

* test(analysis): align provider fixtures with recoverable budgets

* test(desktop): validate emitted alias metadata structurally

* fix(ghidra): classify bounded Windows endpoint refusals

* test(cli): assert selectable artifact admission recovery

* fix(cli): preserve capture provenance in environment builds

src/domain/javascript/javascriptSemanticResourceLimits.ts

@@ -3,28 +3,53 @@ import type {
   JavaScriptSemanticValue,
 } from "./javascriptSemanticValueTypes.js";
 
-/** Maximum distinct alternatives retained in one normalized primitive value. */
-export const SEMANTIC_PRIMITIVE_CANDIDATE_LIMIT = 256;
-/** Maximum active expression nesting during inert semantic evaluation. */
-export const SEMANTIC_EXPRESSION_DEPTH_LIMIT = 256;
-/** Getter jobs and local result work retained in one precise query. */
-export const SEMANTIC_GETTER_EXPANSION_LIMIT = 512;
-/** Additional selector states retained by one precise alias query. */
-export const SEMANTIC_ALIAS_SELECTION_LIMIT = 512;
-/** Bound normalized strings and transient keys independently of transport limits. */
-export const SEMANTIC_PRIMITIVE_JSON_BYTES_LIMIT = 1_048_576;
+import {
+  JAVASCRIPT_SEMANTIC_PRECISION_DEFAULTS,
+  type JavaScriptSemanticPrecision,
+} from "./javascriptSemanticPrecision.js";
 
-const RESOURCE_LIMIT_REASON: Record<JavaScriptSemanticResourceLimit, string> = {
-  "primitive-candidates":
-    "Primitive candidate budget exceeded (maximum 256 alternatives).",
-  "primitive-bytes":
-    "Primitive string-byte budget exceeded (maximum 1048576 estimated JSON bytes).",
-  "expression-depth":
-    "Semantic expression depth budget exceeded (maximum 256 nested expressions).",
-  "getter-expansion":
-    "Getter expansion was conservatively bounded (maximum 512 scheduled states or a growing receiver cycle).",
-  "alias-selections":
-    "Alias selection expansion was conservatively bounded (maximum 512 additional selector states); selected paths remain unknown.",
+const resourceControls = {
+  "primitive-candidates": ["primitive_candidates", "items", "alternatives"],
+  "primitive-bytes": ["primitive_bytes", "bytes", "estimated JSON bytes"],
+  "expression-depth": ["expression_depth", "depth", "nested expressions"],
+  "getter-expansion": ["getter_expansions", "items", "scheduled states"],
+  "alias-selections": [
+    "alias_selections",
+    "items",
+    "additional selector states",
+  ],
+} as const;
+
+/** One owner maps exhaustion classes to controls and effective coverage facts. */
+export const semanticResourceLimitFacts = (
+  resourceLimit: JavaScriptSemanticResourceLimit,
+  precision: JavaScriptSemanticPrecision = JAVASCRIPT_SEMANTIC_PRECISION_DEFAULTS,
+) => {
+  const [control, unit, displayUnit] = resourceControls[resourceLimit];
+  return {
+    control,
+    unit,
+    displayUnit,
+    value: precision[control],
+    defaultValue: JAVASCRIPT_SEMANTIC_PRECISION_DEFAULTS[control],
+  };
+};
+
+/** Exact caller control and effective value at the evaluator boundary. */
+export const semanticResourceLimitReason = (
+  resourceLimit: JavaScriptSemanticResourceLimit,
+  precision: JavaScriptSemanticPrecision = JAVASCRIPT_SEMANTIC_PRECISION_DEFAULTS,
+): string => {
+  const { control, displayUnit, value, defaultValue } =
+    semanticResourceLimitFacts(resourceLimit, precision);
+  const prefixes = {
+    "primitive-candidates": `Primitive candidate budget exceeded (maximum ${String(precision.primitive_candidates)} alternatives).`,
+    "primitive-bytes": `Primitive string-byte budget exceeded (maximum ${String(precision.primitive_bytes)} estimated JSON bytes).`,
+    "expression-depth": `Semantic expression depth budget exceeded (maximum ${String(precision.expression_depth)} nested expressions).`,
+    "getter-expansion": `Getter expansion was conservatively bounded (maximum ${String(precision.getter_expansions)} scheduled states or a growing receiver cycle).`,
+    "alias-selections": `Alias selection expansion was conservatively bounded (maximum ${String(precision.alias_selections)} additional selector states); selected paths remain unknown.`,
+  };
+  return `${prefixes[resourceLimit]} Semantic ${resourceLimit} budget reached: semantic_precision.${control}=${String(value)} ${displayUnit} (default ${String(defaultValue)}). Increase semantic_precision.${control} on the next analysis call (analyze_javascript_application or analyze_web_bundle), or pass --semantic-precision JSON on the CLI; no REA restart is required. Worker memory, transfer and graph-retention limits remain independent. Cyclic or unsupported evaluations remain unknown regardless of budget.`;
 };
 
 /** Check UTF-16 length against worst-case JSON escaping without flattening. */
@@ -34,11 +59,12 @@ const jsonStringBytesFromLength = (codeUnits: number): number =>
 /** Bound string payload before JSON key serialization or candidate creation. */
 export const exceedsSemanticPrimitiveStringByteBudget = (
   strings: Iterable<string>,
+  precision: JavaScriptSemanticPrecision = JAVASCRIPT_SEMANTIC_PRECISION_DEFAULTS,
 ): boolean => {
   let total = 0;
   for (const value of strings) {
     total += jsonStringBytesFromLength(value.length);
-    if (total > SEMANTIC_PRIMITIVE_JSON_BYTES_LIMIT) return true;
+    if (total > precision.primitive_bytes) return true;
   }
   return false;
 };
@@ -47,6 +73,7 @@ export const exceedsSemanticPrimitiveStringByteBudget = (
 export const exceedsSemanticPrimitiveAdditionByteBudget = (
   left: readonly (string | number | boolean | null)[],
   right: readonly (string | number | boolean | null)[],
+  precision: JavaScriptSemanticPrecision = JAVASCRIPT_SEMANTIC_PRECISION_DEFAULTS,
 ): boolean => {
   let total = 0;
   for (const leftValue of left) {
@@ -55,7 +82,7 @@ export const exceedsSemanticPrimitiveAdditionByteBudget = (
         continue;
       const length = String(leftValue).length + String(rightValue).length;
       total += jsonStringBytesFromLength(length);
-      if (total > SEMANTIC_PRIMITIVE_JSON_BYTES_LIMIT) return true;
+      if (total > precision.primitive_bytes) return true;
     }
   }
   return false;
@@ -65,27 +92,24 @@ export const exceedsSemanticPrimitiveAdditionByteBudget = (
 export const exceedsSemanticTemplateByteBudget = (
   prefixes: readonly string[],
   suffixes: readonly string[],
+  precision: JavaScriptSemanticPrecision = JAVASCRIPT_SEMANTIC_PRECISION_DEFAULTS,
 ): boolean => {
   let total = 0;
   for (const prefix of prefixes) {
     for (const suffix of suffixes) {
       total += jsonStringBytesFromLength(prefix.length + suffix.length);
-      if (total > SEMANTIC_PRIMITIVE_JSON_BYTES_LIMIT) return true;
+      if (total > precision.primitive_bytes) return true;
     }
   }
   return false;
 };
 
-/** Make an explicit unknown value tagged with the semantic resource bound. */
+/** Make an explicit unknown value tagged with its effective semantic bound. */
 export const semanticResourceLimitUnknown = (
   resourceLimit: JavaScriptSemanticResourceLimit,
+  precision: JavaScriptSemanticPrecision = JAVASCRIPT_SEMANTIC_PRECISION_DEFAULTS,
 ): JavaScriptSemanticValue => ({
   status: "unknown",
-  reason: RESOURCE_LIMIT_REASON[resourceLimit],
+  reason: semanticResourceLimitReason(resourceLimit, precision),
   resourceLimit,
 });
-
-/** Display label for one stable resource classification. */
-export const semanticResourceLimitReason = (
-  resourceLimit: JavaScriptSemanticResourceLimit,
-): string => RESOURCE_LIMIT_REASON[resourceLimit];