ci(limits): inventory numeric REA_ limits and check them

docs/.vitepress/documentation.ts

@@ -358,6 +358,11 @@ export const documentationSections = [
         source: "design/limits-and-recovery.md",
         route: "/design/limits-and-recovery",
       },
+      {
+        text: "REA limit inventory",
+        source: "design/rea-limit-inventory.md",
+        route: "/design/rea-limit-inventory",
+      },
       {
         text: "MCP tool design",
         source: "development/tool-design.md",

docs/README.md

@@ -111,6 +111,7 @@ product pages. The VitePress documentation source is this `docs/` tree.
 ## Development and verification
 
 - [Settings and recovery](design/limits-and-recovery.md)
+- [REA limit inventory](design/rea-limit-inventory.md)
 - [Flutter budget calibration](verification/flutter-budget-calibration.md)
 - [Source-map budget calibration](verification/source-map-budget-calibration.md)
 - [Source-location delivery qualification](verification/source-location-delivery.md)

docs/design/limits-and-recovery.md

@@ -5,7 +5,9 @@ who owns each value, when an update takes effect, how providers enforce it, and
 how to extend the system. The public tool contract is in
 [MCP contracts](../reference/mcp-contracts.md#editable-analysis-settings); recorded runtime
 checks and their limitations are in the
-[verification report](../verification/runtime-analysis-settings.md).
+[verification report](../verification/runtime-analysis-settings.md). The
+[limit inventory](rea-limit-inventory.md) lists every numeric `REA_` limit, which
+of them are runtime settings, and which stay restart-only.
 
 ## Problem and design boundary
 

package.json

@@ -148,7 +148,7 @@
     "build:termux:run": "npm run compile:termux && npm run artifacts:skills",
     "format": "oxfmt .",
     "format:check": "oxfmt --check .",
-    "lint": "node scripts/ci/static-check-report.mjs lint && npm run verify:module-boundaries",
+    "lint": "node scripts/ci/static-check-report.mjs lint && npm run verify:module-boundaries && node scripts/verify/rea-numeric-limits.mjs",
     "lint:details": "oxlint && npm run verify:module-boundaries",
     "lint:fix": "oxlint --fix && npm run verify:module-boundaries",
     "knip": "knip --cache",

scripts/verify/architecture-guards.mjs

@@ -1,3 +1,5 @@
+import { spawnSync } from "node:child_process";
+import { existsSync } from "node:fs";
 import { readFile, readdir } from "node:fs/promises";
 import { join, relative, sep } from "node:path";
 import { fileURLToPath } from "node:url";
@@ -193,4 +195,23 @@ if (failures.length > 0) {
   console.error(`Architecture guards failed:\n\n${failures.join("\n\n")}\n`);
   process.exit(1);
 }
+// CI runs this file before `npm ci`. The numeric-limit parser needs
+// typescript6, so that check waits until dependencies exist. `npm run lint`
+// runs it after install.
+const typescript6 = new URL(
+  "../../node_modules/typescript6/package.json",
+  import.meta.url,
+);
+if (!existsSync(typescript6)) {
+  console.log(
+    "Numeric REA_ limit check waits until dependencies are installed.",
+  );
+} else {
+  const numericLimits = spawnSync(
+    process.execPath,
+    [fileURLToPath(new URL("./rea-numeric-limits.mjs", import.meta.url))],
+    { stdio: "inherit" },
+  );
+  if (numericLimits.status !== 0) process.exit(numericLimits.status ?? 1);
+}
 console.log(`Architecture guards passed across ${files.length} source files.`);

scripts/verify/rea-numeric-limits.d.mts

@@ -0,0 +1,23 @@
+/** Relative path of the registry. Its text is a declaration, not a producer. */
+export const NUMERIC_LIMIT_DECLARATION: "src/domain/numericLimitRegistry.ts";
+
+/** Limits that must become analysis settings and cannot be registry exceptions. */
+export const REQUIRED_RUNTIME_LIMITS: readonly [
+  "REA_NTFS_MFT_MAX_FILE_BYTES",
+  "REA_REGF_HIVE_MAX_FILE_BYTES",
+  "REA_WEB_BUNDLE_ENDPOINT_LITERAL_CANDIDATES",
+];
+
+/** True for a numeric `REA_` limit, including the documented endpoint-candidate count. */
+export function isNumericLimit(name: string): boolean;
+
+/** Producer paths for numeric limits. Registry text, comments, and allowlists are omitted. */
+export function discoverNumericLimitUses(
+  files: readonly { readonly path: string; readonly source: string }[],
+): Map<string, string>;
+
+/** Why a tracked limit is not an analysis setting, when it is present. */
+export function requiredRuntimeLimitFailure(
+  name: string,
+  presence: { readonly inRuntime: boolean; readonly inRegistry: boolean },
+): string | undefined;