fix(artifacts): name the ASAR header admission budget (#6172)

Keep the 16 MiB ASAR header/index ceiling fixed and report that budget,
the lack of a runtime override, and that source selection does not bypass
header admission.

Refs #5910

Co-authored-by: Cursor Agent <cursoragent@cursor.com>
Co-authored-by: morluto <morluto@users.noreply.github.com>

docs/electron-observation.md

@@ -245,4 +245,10 @@ application path and capture outcome to the static graph, while frames, scripts,
 workers, and execution claims remain unavailable until a separate passive runtime
 capture provides them.
 
-ASAR observation reads the header through one open file handle, validates its declared lengths against the archive size, and limits encoded JSON headers to 16 MiB before parsing. The header cache also retains at most 16 MiB of encoded headers across eight archives. Oversized headers produce a scope refusal.
+ASAR observation reads the header through one open file handle and validates its
+declared lengths against the archive size. Header/index admission is the same
+fixed 16 MiB / 16777216 byte budget used by static ASAR reads. This release has
+no runtime override. An oversized header is not parsed; selecting a member path
+does not bypass admission, and the page stays unauthorized. The header cache
+separately retains at most 16 MiB of already-admitted encoded headers across
+eight archives. Evicting that cache does not raise admission.

docs/javascript-artifact-reconstruction.md

@@ -106,6 +106,15 @@ only reduces delivery; source selection reduces text acquisition and analysis.
 Explicit native provider or snapshot routing rejects `--source-path` rather
 than ignoring it.
 
+ASAR header/index admission is a fixed 16 MiB / 16777216 bytes for this
+release. There is no runtime override. The archive index is read before any
+member can be selected, so `source_paths`, `--source-path`, `detail:
+"summary"`, `max_heap_mb`, and available host memory do not bypass or raise
+it. When the header exceeds that allowance, the failure names this budget.
+Analyze an extracted application directory, which does not admit an ASAR
+header, or supply an archive whose header fits. Repeating the unchanged
+request fails the same way.
+
 ## Read the analysis
 
 `analyze_javascript_application` returns the complete analysis Evidence by
@@ -172,7 +181,8 @@ for the tool-result contract.
 
 Use MCP `detail: "summary"` for a large application, then read selected views of
 the retained analysis. Summary changes delivery only. To reduce source parsing,
-select exact [source paths](#select-sources-before-analysis).
+select exact [source paths](#select-sources-before-analysis). Source selection
+does not bypass ASAR header/index admission.
 
 If a complete response exceeds the transport budget, use its retained Evidence
 ID for a summary, module page, or item, or export the bundle. See