[aft-alfonso]

Follow-up to #1340 (issue #1337). The JavaScript/TypeScript dead-code and unused-export readers (the Oxc engine, dead_code.rs, unused_exports.rs) still read every source file whole, so one huge generated bundle could still push AFT's memory far up. This applies Ufuk's ruling for these two checks:

• Generated and minified JS/TS files are never read whole. They are classified with the shared file_kind classifier (name first, then at most an 8 KiB header) and left out of the graph, imports included.
• Other source files are read up to 4 MiB, through the shared 32 MiB in-flight byte budget. A file over the limit is reported with the approved reason "over the 4 MiB size limit". Because an unread importer could reference anything, an oversized file makes every export's verdict uncertain rather than unused, so no false "unused" claims.
• The tier-2 contribution cache version moves 43 → 44 so cached results computed without these limits are not reused.

Real-repository check (AFT's packages, opencode at f7d5a1cb, protobuf-es at 9ef472d8, uncapped scans, classifier on vs off): excluding generated files added no new findings in any of the six repository/category results; it removed the generated-only findings (e.g. protobuf-es dead code 2,301 → 0, unused exports 2,544 → 0). Headline counts are unchanged. Report and data: .cortexkit/internal-docs/investigations/graph-source-admission/.

Tests: fail-first regressions for the 4 MiB limit (a 1.5 MiB handwritten file is read; a 5 MiB file is a named gap with zero full-source reads) and for generated/minified exclusion (zero full reads, header-only classification). Gate on current main: 530 inspect library tests, 377 inspect integration tests, formatting and the Windows check.

---

^{Open in [code]smith · Need help on this PR? Tag @codesmith-bot with what you need.}

---

Summary by cubic

Bounds the JS/TS dead-code and unused-export readers so one huge generated bundle can no longer push AFT memory up.

• Generated and minified JS/TS files are never read whole; they are omitted from the graph entirely, including their imports.
• Other source files are read up to 4 MiB and reported as "over the 4 MiB size limit" when larger; an oversized file makes every export's verdict uncertain instead of unused.
• Cache version bumps 43 → 44 so cached results from unbounded scans are not reused.
• Verified against AFT, opencode, and protobuf-es: excluding generated files added no new findings and removed generated-only ones.

Migration

• None. Cached inspection results invalidate automatically via the cache-version bump.

^{Written for commit 50f819c. Summary will update on new commits.}