ExtractionRunLimits

Every bound an extraction run obeys, in one place.

One rule covers the whole run model: each bound is a named constant here, the check runs in the init block of the type that owns the value, and anything over the bound is rejected at construction. Truncating an identifier would be worse than rejecting it — a shortened id is a different id, and a store would then key rows on a value the caller never minted.

The rule has no exception, because the model has no free-text field for one to apply to. ExtractionFailure says everything it says in enums and numbers, so the only bounds it needs are the range a provider status can fall in.

Lengths count UTF-16 chars (String.length), so a 256-char identifier can be around 1 KB of UTF-8. The bound is there to keep a run header finite.

sourceKey and sourceRevision are the one pair of strings this rule does not cover, and there is no constant here for either. Their bound already exists where it belongs: on SourceRevisionRef, the type that owns those values, which checks both halves against SourceIdentityBounds at construction — see its KDoc and docs/design/source-revisions.md. ExtractionRun holds a revision to that same contract and adds no cap of its own, so a revision that named a source successfully elsewhere always goes on to be recordable.

One string a run stores is outside the rule and stays outside it: ContextId.value, which ExtractionRun holds as its tenant and validates non-blank only. ContextId is a DICE-wide type owned by the agent framework, so bounding it is not this model's call. It matters because the tenant is half of the store key ExtractionRunKey, so the run store's key length is bounded on one side only; whoever sizes that key's index decides what to do about the other side.