autumn_web/plugin_sandbox/

host.rs

//! The sandbox host: a `wasmi` interpreter plus a deny-by-default WASI shim.
//!
//! # The sandbox *is* this file's import list
//!
//! A WebAssembly guest can do exactly two things on its own: compute, and call
//! a function the host gave it. It has no syscalls, no ambient file
//! descriptors and no way to name anything outside its own linear memory. So
//! the entire authority a sandboxed plugin holds is the list of host functions
//! `define_wasi_shim` registers — which is why they are all in one function,
//! in one place, readable top to bottom.
//!
//! Every one of them either serves the request dialogue or says no:
//!
//! | Import | Behaviour |
//! | --- | --- |
//! | `fd_read` (fd 0) | the next bytes of the request frame |
//! | `fd_write` (fd 1) | the response frame, one NDJSON line (charged per byte parsed) |
//! | `fd_write` (fd 2) | captured as diagnostics, surfaced in the failure detail |
//! | `random_get` | a fixed-seed PRNG — entropy is not authority, but it is not ambient either |
//! | `clock_time_get` | a fixed instant |
//! | `sched_yield`, `fd_close`, `fd_fdstat_get`, `fd_seek`, `fd_tell` | inert |
//! | `environ_*`, `args_*` | **empty, and each call recorded as a denial** |
//! | every `path_*`, every `fd_*` on an unknown descriptor | **`ENOTCAPABLE`/`EBADF`, recorded** |
//! | every `sock_*`, `poll_oneoff`, `proc_raise` | **`ENOTCAPABLE`, recorded** |
//! | `proc_exit` | ends the guest, never the host |
//!
//! There is no `path_open` that opens, no `fd_prestat_get` that resolves, and
//! no socket that connects. A capability is not "off by default" here — for
//! everything but request handling, there is no implementation to turn on.
//!
//! # The world is closed
//!
//! Anything the module imports that this shim does not define is refused at
//! **load**, before the artifact can run once, and the refusal names the
//! import. That is what makes a bespoke seam — `autumn_db::query`,
//! `env::system` — a non-starter rather than a runtime error a guest could
//! catch and retry.
//!
//! # Everything a guest does wrong is a value, never a process event
//!
//! A trap (what a Rust panic compiles to on wasm), a `proc_exit`, fuel
//! exhaustion, a refused allocation, a malformed frame, a guest that never
//! answers: all of them come back as [`SandboxFailure`] inside an
//! [`SandboxOutcome`]. Nothing in this module can abort, exit or panic the host
//! process.
// autumn-panic-gate: request-path module — production code path must be panic-free.
// See CONTRIBUTING.md "Request-path panic gate". Justify exceptions with
// #[allow(clippy::<lint>, reason = "…")] at the narrowest scope.
#![cfg_attr(
    not(test),
    deny(
        clippy::unwrap_used,
        clippy::expect_used,
        clippy::panic,
        clippy::unreachable,
        clippy::todo,
        clippy::unimplemented,
        clippy::indexing_slicing,
        clippy::string_slice,
        clippy::arithmetic_side_effects,
    )
)]

use std::collections::VecDeque;
use std::fmt;

use tokio::sync::Semaphore;
use wasmi::{Caller, Config, Engine, Linker, Module, Store};

use super::artifact::SandboxArtifact;
use super::manifest::{ResourceLimits, SandboxManifest};
use super::wire::{
    GuestFrame, HostFrame, SandboxRequest, SandboxResponse, from_guest_line, to_exact_line, to_line,
};

/// The WASI module name every import in the shim lives under.
const WASI: &str = "wasi_snapshot_preview1";

/// WASI `errno` values this shim returns.
mod errno {
    pub(super) const SUCCESS: i32 = 0;
    /// Bad file descriptor.
    pub(super) const BADF: i32 = 8;
    /// Invalid argument.
    pub(super) const INVAL: i32 = 28;
    /// Seek on a pipe.
    pub(super) const SPIPE: i32 = 70;
    /// Capability insufficient — the sandbox's universal "no".
    pub(super) const NOTCAPABLE: i32 = 76;
}

/// Bytes in one WebAssembly page.
const WASM_PAGE_BYTES: u64 = 64 * 1024;

/// The size of one WASI `iovec` (two `u32`s: pointer and length).
const IOVEC_SIZE: usize = 8;

/// Size of a WASI `fdstat` struct.
const FDSTAT_SIZE: usize = 24;

/// Scratch-buffer size for host-side copies of guest-supplied ranges (64 KiB).
///
/// An in-bounds iovec can legitimately span the guest's whole linear memory,
/// but the host must never mirror one in a single allocation — a few concurrent
/// requests doing so would exhaust host memory that no guest-side limit
/// accounts for. Copies run through a buffer of this size, and the output
/// budget is applied per chunk, so a runaway write fails long before its full
/// length is copied.
const HOST_IO_CHUNK_BYTES: usize = 64 * 1024;

/// Cap on accumulated guest stderr, in bytes (64 KiB).
const STDERR_BUDGET_BYTES: usize = 64 * 1024;

/// Largest `iovec` array the shim will walk in one call.
///
/// Real WASI callers pass a handful; an array of millions is a guest asking the
/// host to do a million times the work of one call. Bounding the array bounds
/// the per-call amplification factor, which the fuel charge below then prices.
const MAX_IOVECS: i32 = 64;

/// The largest number of table elements one instance may hold, across all of
/// its tables.
///
/// A table holds function references, not bytes, but it is still per-instance
/// host storage: at four tables of 65,536 entries each it would be megabytes an
/// instance, multiplied by `max_concurrency`, that
/// [`ResourceLimits::request_footprint_bytes`](crate::plugin_sandbox::ResourceLimits::request_footprint_bytes)
/// never counted. Bounded here to a number small enough that the footprint can
/// carry it as a constant, and generous enough for any real guest's
/// indirect-call table.
pub const MAX_TABLE_ELEMENTS: u32 = 16_384;

/// The most tables one instance may have.
///
/// The store limiter refuses the fifth at instantiation, which is per request,
/// so the count has to be a load-time verdict too — a module with five empty
/// tables clears the *element* ceiling for free. Defined once and read by both,
/// so the number the limiter enforces and the number the loader admits cannot
/// drift apart.
pub const MAX_TABLES: usize = 4;

/// The most linear memories a module may declare.
///
/// The `MemoryLimiter` reports one, so wasmi refuses to create a second at
/// instantiation — which is per request, as a gateway error, on an artifact
/// `autumn plugin inspect` said was fine. wasmi's own `Config` enables the
/// multi-memory proposal by default, so `Module::new` accepts such a module
/// and only the limiter objects, and the limiter runs too late to tell anyone
/// useful. The one export named `memory` is what the shim reads and writes, so
/// a second is authority the wire could not describe even if it were created.
///
/// Said once at load, like the table ceiling beside it, rather than once per
/// request forever.
pub const MAX_MEMORIES: usize = 1;

/// The most globals a module may declare.
///
/// Every instance allocates and initialises its own copy of each, and an
/// instance is per request — so globals are per-request storage and per-request
/// work in exactly the way tables and segments are. The aggregate declared-entry
/// ceiling is far too generous to bound them on its own: a module can sit well
/// under a million total entries and still carry hundreds of thousands of
/// globals, which no fuel charge priced and no footprint counted.
pub const MAX_GLOBALS: usize = 4096;

/// The most functions a module may define.
///
/// Every instance allocates an entry per defined function, so functions are
/// per-instance storage and per-instance work exactly as globals and tables
/// are. Neither general ceiling bounds them: half a million tiny functions sit
/// under both the aggregate declared-entry cap and the code-section byte cap,
/// because each one is a couple of bytes of body and one byte of type index.
/// Generous against real output — a whole Rust web application compiles to a
/// few tens of thousands of functions.
pub const MAX_FUNCTIONS: usize = 65_536;

/// The most bytes a module's code section may occupy.
///
/// The declaration counts bound how many *things* a module names; they say
/// nothing about how much instruction stream sits inside one of them. A single
/// function whose body fills the file allowance declares exactly one entry and
/// still hands `Module::new` tens of megabytes to translate into wasmi's larger
/// internal representation, which is the allocation amplification the file
/// ceiling was never a bound on. Generous against real output — a whole Rust
/// web application compiles to a few megabytes of code — and far under what a
/// 64 MiB artifact can carry.
pub const MAX_CODE_BYTES: usize = 16 * 1024 * 1024;

/// The largest total data + element section a module may carry (16 MiB).
///
/// Every request instantiates a **fresh** module — that is what makes "no state
/// survives a request" true — and instantiation copies the module's data and
/// element segments before the first guest instruction runs. wasmi does not
/// meter that phase, so the only real bound on it is a bound on the segments
/// themselves, checked once at load. A hello-world Rust guest carries tens of
/// kilobytes here; a large one, a few megabytes.
pub const MAX_INIT_SECTION_BYTES: usize = 16 * 1024 * 1024;

/// The largest number of data + element segments a module may declare.
///
/// Bytes alone do not bound the work: a segment costs a bounds check and a
/// copy set-up regardless of its length, so a module of a million empty
/// segments is small on disk and expensive to instantiate. Both are capped
/// because instantiation cost is a function of both.
pub const MAX_INIT_SEGMENTS: usize = 4096;

/// Bytes of host-side copying one unit of fuel buys.
///
/// wasmi meters the guest's own instructions, and a host call costs a handful
/// of units no matter how much the host then copies on the guest's behalf.
/// Without a charge here, a guest could buy gigabytes of `memcpy` for single
/// digits of fuel — a spin *inside the host* rather than inside the
/// interpreter, which the CPU ceiling would never see and no deadline exists to
/// catch. The rate matches the order of wasmi's own pricing for bulk memory
/// operations, so byte-work and instruction-work share one budget and the
/// ceiling means what the manifest says it means.
const BYTES_PER_FUEL: u64 = 64;

/// Characters of stderr echoed into a failure detail.
const STDERR_EXCERPT: usize = 512;

/// Characters of a guest-influenced string kept for a log line or an error.
///
/// Every `String` a [`SandboxFailure`] carries came, directly or by way of an
/// interpreter message quoting one, from an artifact nobody audited. It is
/// evidence, so it has to survive; it is also attacker-controlled text on its
/// way into a log the operator trusts, so it cannot survive intact.
const DETAIL_EXCERPT: usize = 512;

/// What a bounded excerpt says when it had to leave something out.
///
/// Named because two places append it — [`bounded_guest_text`], which meets the
/// bound while walking, and `stderr_excerpt`, which is handed a string already
/// at it — and an excerpt that says it was cut in two different ways is worse
/// than one that never says so.
pub(super) const TRUNCATION_MARKER: &str = " … (truncated)";

/// Bound and neutralise a string the guest influenced.
///
/// Two hazards, and the fix for one is not the fix for the other. *Length*: a
/// detail can be as large as the stdout budget — megabytes at the maximum
/// response ceiling — and a plugin that fails in a loop writes one per request,
/// which is a log-storage exhaustion with no guest instruction spent on it.
/// *Content*: a newline ends the host's record and starts one the operator did
/// not write, and an ANSI escape repaints records already on screen; either
/// turns "the log says" into something a plugin controls.
///
/// Control characters are escaped rather than dropped, so a detail that was
/// trying to forge a line reads as one that tried. Real text is kept, including
/// non-ASCII: an author debugging a plugin that writes error text in their own
/// language should be able to read it.
///
/// `is_control` alone is not the line between those two, because it covers the
/// C0/C1 codes and stops there. The Unicode formatting characters do the same
/// job by other means — U+202E reverses the run that follows it, so a guest can
/// make a denial record *display* as something other than what was recorded,
/// which is the same forgery a newline attempts and just as available. They are
/// escaped by the same predicate the consent screen refuses them with, so the
/// two surfaces cannot disagree about what counts as display-altering.
///
/// Escaped rather than refused, unlike a route path: a path must mean exactly
/// one thing, but a failure detail is evidence, and evidence that tried
/// something is worth keeping in a legible form.
pub(super) fn guest_text(text: &str) -> String {
    bounded_guest_text(text.chars(), text.len())
}

/// The bound-and-escape rule itself, over characters rather than a `&str`.
///
/// Taking a `&str` means the whole string already exists, which is fine when it
/// does and is the entire problem when it does not: an import's operation is
/// `module::name`, and joining those two before bounding them copies a name an
/// artifact may have spent most of its 64 MiB on, in order to say it is
/// refused. `hint` is only a capacity, and it is capped, so a caller cannot
/// turn it into the allocation this exists to avoid.
fn bounded_guest_text(chars: impl Iterator<Item = char>, hint: usize) -> String {
    let mut out = String::with_capacity(hint.min(DETAIL_EXCERPT));
    for (kept, ch) in chars.enumerate() {
        if kept == DETAIL_EXCERPT {
            out.push_str(TRUNCATION_MARKER);
            break;
        }
        if ch.is_control() || is_line_separator(ch) || super::manifest::is_display_reordering(ch) {
            out.extend(ch.escape_debug());
        } else {
            out.push(ch);
        }
    }
    out
}

/// The two characters Unicode calls line breaks that are not control characters.
///
/// C0/C1 gets escaped by `is_control`, and the invisible and bidi characters by
/// [`is_display_reordering`](super::manifest::is_display_reordering) — and
/// U+2028 LINE SEPARATOR and U+2029 PARAGRAPH SEPARATOR fall between the two.
/// They are general category Zl and Zp: not `Cc`, so `is_control` says no, and
/// neither format nor default-ignorable, so the other predicate says no either.
/// Yet a plain-text log consumer that splits on Unicode line breaks renders
/// them as exactly the newline the escaping exists to deny, which puts a guest
/// back in the business of writing its own operator-facing record — the whole
/// point of escaping C0 in the first place.
///
/// A route path needs nothing here: `validate_route_path` refuses
/// `char::is_whitespace`, and both of these are `White_Space`. The gap is only
/// in a detail, which is escaped rather than refused.
const fn is_line_separator(ch: char) -> bool {
    matches!(ch, '\u{2028}' | '\u{2029}')
}

/// The characters of a lossy UTF-8 decode, without decoding all of it first.
///
/// `String::from_utf8_lossy` answers the same question by building the whole
/// replacement string, which is the one thing a caller keeping a bounded
/// excerpt of guest bytes must not do. `utf8_chunks` yields each maximal
/// invalid subpart separately, which is exactly the grouping `from_utf8_lossy`
/// replaces one-for-one, so this produces the same characters lazily.
fn lossy_chars(bytes: &[u8]) -> impl Iterator<Item = char> + '_ {
    bytes.utf8_chunks().flat_map(|chunk| {
        chunk
            .valid()
            .chars()
            .chain((!chunk.invalid().is_empty()).then_some(char::REPLACEMENT_CHARACTER))
    })
}

/// An import's `module::name`, bounded and escaped without ever being joined.
///
/// Written down here rather than left to the review surface. The surface does
/// excerpt it — but that excerpt runs after this string exists, and the copy is
/// the cost, not the printing. `MAX_IMPORTS` bounds how many names a module may
/// declare and nothing bounded how long one may be, so a single import was
/// enough to make refusing an artifact as expensive as accepting it.
fn import_operation(module: &str, name: &str) -> String {
    bounded_guest_text(
        module.chars().chain("::".chars()).chain(name.chars()),
        module.len().saturating_add(name.len()).saturating_add(2),
    )
}

/// What one recorded denial can hold, at its worst.
///
/// [`guest_text`] bounds a detail at `DETAIL_EXCERPT` *characters*, and
/// escaping is where characters become bytes: `escape_debug` writes an
/// unprintable scalar as `\u{10ffff}`, ten bytes for one character. So the byte
/// bound is ten times the character bound, with room beside it for the
/// truncation marker and the operation and capability names.
const DENIAL_RECORD_BYTES: usize = DETAIL_EXCERPT * 10 + 256;

/// Host buffers a request holds no matter what its manifest declares.
///
/// [`ResourceLimits::request_footprint_bytes`](crate::plugin_sandbox::manifest::ResourceLimits::request_footprint_bytes)
/// scales every other term with a ceiling the manifest names. These do not
/// scale with anything, which is why they were missed: the stderr budget the
/// state holds for the whole request, the scratch buffer an `fd_write` or
/// `fd_read` allocates while that budget is still resident, and the denial
/// ledger beside them. Fixed per request is still per request, and multiplied
/// by a concurrency near the product ceiling it is tens of megabytes the
/// advertised bound did not know about.
pub const FIXED_HOST_BUFFER_BYTES: usize = STDERR_BUDGET_BYTES
    .saturating_add(HOST_IO_CHUNK_BYTES)
    .saturating_add(MAX_DENIALS.saturating_mul(DENIAL_RECORD_BYTES))
    // Capability replies the guest has queued and not yet read, and the ledger
    // of what it asked for. Both are bounded by their own constants below and
    // both are held for the whole request, so they belong in the same term as
    // the stderr budget rather than in the manifest's scaling ones.
    .saturating_add(MAX_QUEUED_REPLY_BYTES)
    .saturating_add(
        crate::plugin_sandbox::capability::MAX_EVENTS.saturating_mul(CAPABILITY_EVENT_BYTES),
    )
    // Slack for the bookkeeping around them — the frame's own scalars, the
    // outcome struct, the excerpt built from the stderr budget when it is read.
    .saturating_add(4096);

/// Host bytes one capability call's reply may hold, unread, in the guest's
/// stdin queue.
///
/// A guest is free to write a call frame and never read the answer — nothing
/// obliges it to, and a buggy one will. Every unread reply stays in the queue,
/// so without a ceiling the `calls` quota (128 by default) multiplied by the
/// largest reply (an outbound response, up to that quota's own byte ceiling)
/// would be tens of megabytes of host memory per in-flight request, at a
/// concurrency the footprint validator approved on other grounds.
///
/// Crossing it ends the request rather than dropping the reply: a guest that is
/// not reading its answers is one that will not notice a dropped one either,
/// and quietly losing a reply is how a plugin comes to believe a write happened.
///
/// It bounds what is **resident**, not what has been sent: `take_stdin` gives
/// the budget back as the guest drains it, so a guest that reads each answer
/// before making the next call never approaches it however many calls it makes.
/// Counting cumulatively instead killed a well-behaved plugin at its 63rd
/// `kv-get` — inside the quotas its own operator had approved — and told it it
/// had a bug it did not have.
///
/// One MiB rather than four: the resident set is one reply at a time for any
/// honest guest, the largest single reply is bounded by the
/// `outbound_response_bytes` quota, and every byte here is charged against
/// [`FIXED_HOST_BUFFER_BYTES`] for *every* plugin — including one granted no
/// capability that can produce a reply. Four MiB moved the largest admissible
/// `max_concurrency` for an otherwise-default manifest from 16 to 15, which is a
/// load-time break for a manifest that used to be fine.
pub const MAX_QUEUED_REPLY_BYTES: usize = 1024 * 1024;

/// Host bytes one capability-ledger entry may hold, for the footprint term.
///
/// An event carries a capability, a `&'static str` operation, its outcome, and a
/// target the guest chose. The target is the term that has to be priced
/// carefully, and at the right rate: it is bounded at
/// [`MAX_TARGET_CHARS`](crate::plugin_sandbox::capability::MAX_TARGET_CHARS)
/// *characters*, and `guest_text` escapes a hostile character to as many as ten
/// bytes — the same `× 10` [`DENIAL_RECORD_BYTES`] already applies for the same
/// reason. Pricing it at the character count understated the ledger eightfold.
const CAPABILITY_EVENT_BYTES: usize =
    crate::plugin_sandbox::capability::MAX_TARGET_CHARS * 10 + 256;

/// Fuel one capability call costs before its reply is priced by the byte.
///
/// A call is host work the guest chose to cause: a lock, a lookup, a frame
/// encoded and queued. Priced like an imported call rather than like a copy,
/// because that is what it is, and priced at all because a plugin with a
/// generous fuel budget would otherwise get its quota's worth of host work for
/// the cost of writing a few hundred bytes to stdout.
const CAPABILITY_CALL_FUEL: u64 = 2_000;

/// Fuel a guest keeps after a call's reply is priced, so it can write its
/// answer.
///
/// The host reserves it before dispatching: a call whose reply the budget could
/// pay for but whose guest could not then finish would commit and then end the
/// request as `FuelExhausted`. A call that commits also keeps
/// [`GUEST_READ_FUEL_PER_BYTE`] to read its reply.
const FINISH_ALLOWANCE_FUEL: u64 = 100_000;

/// Fuel per reply byte that a guest keeps to read the reply of a call that
/// commits (#2523).
///
/// Measured: a Rust guest that reads the line and parses it with `serde_json`
/// spent 6 fuel per byte on plain text, 77 on escaped NULs and 106 on escaped
/// quotes. A JSON body is escape-heavy, so the rate covers the worst case.
///
/// Only for a call that commits. A read that fails changed nothing, so the
/// host does not refuse it for this fuel.
const GUEST_READ_FUEL_PER_BYTE: u64 = 128;

/// Refuse a request whose body is over the manifest's declared ceiling.
///
/// The ceiling is enforced here, not only in the Axum adapter. The adapter
/// applies it while reading, so an oversized body never gets buffered on that
/// path — but [`SandboxHost::run`] is public, and an embedder calling it
/// directly hands over a `SandboxRequest` that has already been built. Without
/// this the body is cloned into the frame and base64-expanded regardless of the
/// ceiling, and the footprint the manifest advertises — which counts the body
/// at `4 × max_request_body_bytes` — stops bounding anything.
///
/// The encoding price charged below it is a real bound, but only against a
/// manifest whose fuel is small relative to its body ceiling; a generous fuel
/// budget buys an arbitrarily large host-side copy. So the ceiling is checked
/// first, before the request is priced or walked at all.
pub const MAX_REQUEST_METADATA_BYTES: usize = 256 * 1024;

/// Every byte of a request that is not its body, summed — or the first running
/// total to cross [`MAX_REQUEST_METADATA_BYTES`], whichever comes first.
///
/// One definition, used by both the ceiling below and [`encoding_fuel`], so the
/// bytes that are refused and the bytes that are charged for cannot drift apart
/// as fields are added to the frame.
///
/// The walk stops at the ceiling rather than finishing and reporting a true
/// total. Charging every entry made an oversized list *fail*; it did not bound
/// the work of discovering that it fails, and that discovery happens before the
/// permit is taken — so an unbounded list still bought an unbounded scan, per
/// concurrent caller, from a ceiling meant to refuse it cheaply. Past the
/// ceiling the answer cannot change, because the total only grows, so the
/// entries after it have nothing left to establish.
///
/// The cost of stopping is that a value over the ceiling is a floor rather than
/// a total. Only the refusal ever sees one: `encoding_fuel` prices requests that
/// were already admitted, and an admitted request finished the walk.
/// What one metadata pair costs, contents plus the structure around them.
///
/// Two 24-byte `String` headers in the vector, and the `["",""],` the serialiser
/// writes around them. Counting only the *contents* would leave a list of a
/// million empty pairs summing to zero — past a byte ceiling for free, then
/// cloned and expanded into real syntax anyway.
///
/// Public to the crate so the adapter can charge a header the same way before
/// deciding to clone it. One definition, so the early refusal and the ceiling
/// cannot disagree about what a pair costs.
pub(crate) const fn metadata_pair_bytes(name: &str, value: &str) -> usize {
    /// Two `String` headers plus the `["",""],` around them.
    const ENTRY: usize = 56;
    name.len().saturating_add(value.len()).saturating_add(ENTRY)
}

/// What a metadata pair the frame will discard still costs.
///
/// Not its contents. Those never cross, and charging them refused requests
/// that cost the guest nothing — a 256 KiB `Cookie` turning a confidentiality
/// promise into an availability one. But the pair sits in a list the host
/// walks three times before the guest starts: once for the ceiling, once to
/// price the encoding, once to filter it back out. That walk is per entry and
/// is not priced by fuel, which the guest has not begun to spend, nor bounded
/// by `max_concurrency`, which limits guests and not the work done to reach
/// one. So the entry is charged even when nothing in it is.
///
/// At 56 bytes an entry this caps a request at a few thousand headers, which
/// is far above what any HTTP client sends and far below what costs anything
/// to walk.
pub(crate) const DROPPED_PAIR_BYTES: usize = metadata_pair_bytes("", "");

fn request_metadata_bytes(request: &SandboxRequest) -> usize {
    let mut total = request
        .method
        .len()
        .saturating_add(request.path.len())
        .saturating_add(request.query.len())
        .saturating_add(request.route.len());
    if total > MAX_REQUEST_METADATA_BYTES {
        return total;
    }
    for (name, value) in &request.headers {
        // Contents only for the headers that will actually cross.
        // `HostFrame::request` filters through the same allowlist, so a
        // `Cookie` or `Authorization` a direct `run` caller happens to be
        // holding is dropped before the frame is built and never reaches the
        // guest — counting its bytes here refused a request that would have
        // cost nothing, and made the public API stricter than the adapter that
        // is merely its politest caller. The entry itself is still charged;
        // see `DROPPED_PAIR_BYTES` for why the two halves separate.
        total = total.saturating_add(if super::wire::request_header_allowed(name) {
            metadata_pair_bytes(name, value)
        } else {
            DROPPED_PAIR_BYTES
        });
        if total > MAX_REQUEST_METADATA_BYTES {
            return total;
        }
    }
    for (name, value) in &request.path_params {
        total = total.saturating_add(metadata_pair_bytes(name, value));
        if total > MAX_REQUEST_METADATA_BYTES {
            return total;
        }
    }
    total
}

fn refuse_oversized_request(
    request: &SandboxRequest,
    limits: ResourceLimits,
) -> Option<SandboxOutcome> {
    if request.body.len() > limits.max_request_body_bytes {
        return Some(SandboxOutcome::refused(
            SandboxFailure::RequestBudget {
                max: limits.max_request_body_bytes,
                len: request.body.len(),
            },
            0,
        ));
    }
    // The body ceiling is the manifest's; this one is the host's, because no
    // manifest declares a query or header budget. `run` is public and the adapter's
    // own limits do not reach it, so an embedder building a `SandboxRequest` by hand
    // could hand over a gigabyte of query string — cloned into the frame and
    // serialised into the NDJSON line before the guest starts, against a footprint
    // that budgets for the body alone. The encoding charge prices those bytes, but
    // pricing is not a bound: at the manifest's maximum fuel it permits more than a
    // terabyte. The ceiling is what keeps `request_footprint_bytes` honest.
    let metadata = request_metadata_bytes(request);
    (metadata > MAX_REQUEST_METADATA_BYTES).then(|| {
        SandboxOutcome::refused(
            SandboxFailure::RequestMetadataBudget {
                max: MAX_REQUEST_METADATA_BYTES,
                len: metadata,
            },
            0,
        )
    })
}

/// Imports listed on a review surface before it stops enumerating them.
///
/// The names themselves are excerpted where they are rendered, but the *count*
/// is a separate amplification: a legal 64 MiB module can carry millions of
/// tiny import entries, and formatting each into its own `String` turns the
/// artifact into hundreds of megabytes in the process that is trying to refuse
/// it. A review surface needs enough to recognise what a module reaches for,
/// not every repetition of it.
/// The most imports a module may declare.
///
/// A structural ceiling, checked before anything walks the import table. Every
/// import is resolved and retained *per instance*, and an instance is per
/// request, so a module repeating one allowlisted import a million times makes
/// every request pay for a million resolutions and hold the results — work no
/// fuel charge priced and storage `request_footprint_bytes` never counted.
/// Refusing the shape at load is what keeps that footprint the real bound.
///
/// It is checked *first* for a second reason: `forbidden_imports` builds one
/// owned denial per offending import, so an unbounded import table amplifies
/// through the refusal path too — including under `autumn plugin inspect`,
/// which runs it on artifacts nobody has audited. This ceiling does not weaken
/// that gate: a module hiding one forbidden import behind a million decoys is
/// still refused at load, now for its shape rather than its contents.
/// The most entries a module's sections may declare between them.
///
/// Checked from the section headers before the module is compiled, because
/// compilation is itself the allocation that needs bounding. Generous against
/// real output — a large Rust module declares tens of thousands of functions
/// and types — and far below what a 64 MiB file of one-byte declarations can
/// claim.
pub const MAX_DECLARED_ENTRIES: usize = 1_000_000;

/// The most sections a module may carry, custom ones included.
///
/// Every other shape ceiling is read from a section's leading count, which is
/// what makes reading them cheap. A custom section has no such count — its body
/// is a name and opaque bytes — so it contributes to nothing, and an empty one
/// encodes in three bytes. A 64 MiB artifact of those is roughly 22 million
/// section headers walked to reach a verdict this loop exists to reach cheaply.
///
/// So the headers are counted too, and the walk stops at the ceiling rather
/// than running to the end and refusing afterwards: here the iteration *is* the
/// cost, unlike the per-entry walks below it, where refusing on the count alone
/// is enough. A real module carries a dozen sections; a toolchain that emits
/// names, producers and debug info carries a few dozen.
pub const MAX_SECTIONS: usize = 1_024;

pub const MAX_IMPORTS: usize = 1024;

const MAX_REPORTED_IMPORTS: usize = 256;

/// Format a module's imports for review, bounded in number and in length.
///
/// The total is still reported honestly — an operator must not read a truncated
/// list as the whole of what an artifact imports — but only the first
/// [`MAX_REPORTED_IMPORTS`] are allocated. Counting the rest costs nothing: the
/// import table is already parsed, and walking it without formatting allocates
/// nothing per entry.
///
/// Each entry is built with [`import_operation`], the same bounded formatter
/// the denial path uses, so the *length* is capped where the string is made
/// rather than where it is rendered. A count-only bound left 256 names each as
/// long as an artifact cared to make them, and the review surface's own excerpt
/// runs afterwards — which is one copy too late to matter.
///
/// This bounds the *review* surface only. The load gate checks every import
/// against the shim's allowlist with no cap, because a module that hides a
/// forbidden import behind a million decoys must still be refused.
fn reported_imports<'a>(imports: impl Iterator<Item = wasmi::ImportType<'a>>) -> Vec<String> {
    let mut names: Vec<String> = Vec::new();
    let mut total: usize = 0;
    for import in imports {
        total = total.saturating_add(1);
        if names.len() < MAX_REPORTED_IMPORTS {
            names.push(import_operation(import.module(), import.name()));
        }
    }
    if let Some(hidden) = total.checked_sub(names.len()).filter(|more| *more > 0) {
        names.push(format!("… and {hidden} more (truncated)"));
    }
    names
}

/// What encoding one request's frame costs, in fuel.
///
/// Priced off the request's own bytes at [`BYTES_PER_FUEL`], the rate every
/// other host-side copy pays, multiplied by the number of times those bytes are
/// walked on the way to the guest's stdin.
///
/// A flat multiplier over the *raw* input was the wrong shape, because the
/// passes are not all over the raw input. The body is base64-encoded, which
/// expands it by 4/3, and every walk after that is over the expansion.
/// Metadata is JSON-escaped, and `serde_json` writes a control character as
/// `\u0000` — six bytes for one — so a direct caller filling a header value
/// with them expands it sixfold. Then [`HostState::seed_from`] reads the
/// finished line end to end, so the largest single walk is over the expanded
/// form, not the raw one. Charging four times the raw bytes let a request buy
/// host work the ceiling never saw.
///
/// So body and metadata are priced separately, each at its own worst-case
/// expansion:
///
/// | | raw passes | expanded passes | charged |
/// |---|---|---|---|
/// | body | clone, encode-read, sizing read | encode-write and escape-scan in both passes, seed scan | `3 + 5 × 4/3 = 9 2/3`, charged as 10 |
/// | metadata | clone, escape-read, sizing read | escape-write, sizing write, seed scan | `3 + 3 × 6 = 21` |
///
/// The sizing walks are `to_line`'s first pass, which counts the line so the
/// second pass can write into an exact buffer.
///
/// Both are upper bounds rather than measurements, because this runs *before*
/// the line exists — that is the point of it. The expansion factors are the
/// same ones [`ResourceLimits::request_footprint_bytes`](crate::plugin_sandbox::manifest::ResourceLimits::request_footprint_bytes)
/// budgets memory at, so the two describe the same request.
fn encoding_fuel(request: &SandboxRequest) -> u64 {
    /// Raw-equivalent walks of the body: three over the raw bytes, five over the
    /// base64 expansion of them, which is 4/3. `3 + 5 × 4/3` is 9 2/3, so 10.
    const BODY_PASSES: u64 = 10;
    /// Raw-equivalent walks of the metadata: three over the raw bytes, three
    /// over a JSON escaping that can reach six bytes per byte.
    const METADATA_PASSES: u64 = 21;

    let charge = |bytes: usize, passes: u64| {
        u64::try_from(bytes)
            .unwrap_or(u64::MAX)
            .saturating_mul(passes)
    };

    charge(request.body.len(), BODY_PASSES)
        .saturating_add(charge(request_metadata_bytes(request), METADATA_PASSES))
        .checked_div(BYTES_PER_FUEL)
        .unwrap_or(u64::MAX)
        .saturating_add(1)
}

/// Largest number of distinct denials recorded for one request.
///
/// The ledger is a diagnostic, and a guest that calls a denied import in a
/// loop must not be able to grow one. Denials are deduplicated by
/// `(capability, operation)` first, so hitting this bound at all means a guest
/// found more distinct refusals than the shim has functions.
const MAX_DENIALS: usize = 64;

// ── Denials ──────────────────────────────────────────────────────────────

/// The class of authority a guest reached for and did not get.
#[derive(Debug, Clone, Copy, PartialEq, Eq, Hash)]
#[non_exhaustive]
pub enum DeniedCapability {
    /// Reading, writing, opening or discovering anything on a filesystem.
    Filesystem,
    /// Any outbound socket operation.
    Network,
    /// Environment variables and process arguments.
    Environment,
    /// Signalling, blocking or otherwise steering the host process.
    ProcessControl,
    /// An allocation over the plugin's declared memory ceiling.
    Memory,
    /// A response header a plugin is not allowed to set.
    ResponseHeader,
    /// An import no host function defines. Refused at load.
    UnknownImport,
}

impl DeniedCapability {
    /// Stable lowercase tag used in logs and reports.
    #[must_use]
    pub const fn as_str(self) -> &'static str {
        match self {
            Self::Filesystem => "filesystem",
            Self::Network => "network",
            Self::Environment => "environment",
            Self::ProcessControl => "process-control",
            Self::Memory => "memory",
            Self::ResponseHeader => "response-header",
            Self::UnknownImport => "unknown-import",
        }
    }
}

impl fmt::Display for DeniedCapability {
    fn fmt(&self, f: &mut fmt::Formatter<'_>) -> fmt::Result {
        f.write_str(self.as_str())
    }
}

/// One thing a guest reached for and was refused.
///
/// Denials are the *observable* half of deny-by-default: without them, a
/// sandbox that silently swallows a `path_open` and one that has a bug look
/// exactly alike from outside.
#[derive(Debug, Clone, PartialEq, Eq)]
#[non_exhaustive]
pub struct CapabilityDenial {
    /// Which class of authority was refused.
    pub capability: DeniedCapability,
    /// The guest-visible operation, e.g. `path_open` or `autumn_db::query`.
    pub operation: String,
    /// What the guest was told, for the log.
    pub detail: String,
}

impl fmt::Display for CapabilityDenial {
    fn fmt(&self, f: &mut fmt::Formatter<'_>) -> fmt::Result {
        write!(
            f,
            "{capability}: {operation} — {detail}",
            capability = self.capability,
            operation = self.operation,
            detail = self.detail
        )
    }
}

// ── Failures ─────────────────────────────────────────────────────────────

/// Why a request produced no answer from the plugin.
///
/// Almost every variant is a *plugin* failure — none of those is a host
/// failure, and none can be anything other than a 5xx on the plugin's own
/// prefix. [`RequestBudget`](Self::RequestBudget) and
/// [`RequestMetadataBudget`](Self::RequestMetadataBudget) are the exceptions:
/// it is the *caller's* request that was refused, before the plugin was asked
/// anything, so they answer 413 the way the ceiling does everywhere else.
#[derive(Debug, Clone, PartialEq, Eq)]
#[non_exhaustive]
pub enum SandboxFailure {
    /// The module could not be instantiated for this request.
    Instantiation(String),
    /// The guest burned its whole fuel budget without answering.
    FuelExhausted {
        /// The budget it was given.
        budget: u64,
    },
    /// The guest trapped.
    Trap(String),
    /// The guest called `proc_exit`.
    Exited(i32),
    /// The guest returned without answering.
    NoAnswer,
    /// The guest wrote what may well be a complete frame but never ended the
    /// line, so the host never saw one.
    PartialFrame,
    /// The guest wrote something that is not a frame this version knows.
    MalformedFrame(String),
    /// The guest reported its own failure.
    GuestError(String),
    /// The guest answered, but with something HTTP or the manifest refuses.
    ResponseRefused(String),
    /// The guest wrote more than its response ceiling without ending a line.
    OutputBudget {
        /// The ceiling it blew through.
        max: usize,
    },
    /// The plugin already has `max_concurrency` requests executing, so this
    /// one was not started.
    AtCapacity {
        /// The ceiling it ran into.
        max: usize,
    },
    /// The request handed to [`SandboxHost::run`] carried a body over the
    /// manifest's declared ceiling. The guest was never started.
    RequestBudget {
        /// The ceiling it blew through.
        max: usize,
        /// What the caller actually handed over.
        len: usize,
    },
    /// The request handed to [`SandboxHost::run`] carried more metadata — path,
    /// query, route, headers, path parameters — than the host's ceiling allows.
    /// The guest was never started.
    RequestMetadataBudget {
        /// The ceiling it blew through.
        max: usize,
        /// How much metadata the caller handed over — at least this much.
        ///
        /// A floor rather than a total: the walk stops as soon as it knows the
        /// answer, so the entries past the ceiling are never counted. Bounding
        /// the work of refusing costs the exact figure, and the exact figure is
        /// not what the refusal turns on.
        len: usize,
    },
}

impl SandboxFailure {
    /// The status this failure serves on the plugin's prefix.
    ///
    /// A budget exhaustion is a 504: the plugin was given a deadline and missed
    /// it. An oversized request is a 413, the same answer the adapter gives
    /// before it ever gets here — one condition must not have two statuses
    /// depending on which door the request came through. Everything else is a
    /// 502: the plugin answered badly or not at all, which is exactly what a
    /// bad gateway is.
    #[must_use]
    pub const fn status(&self) -> http::StatusCode {
        match self {
            Self::FuelExhausted { .. } | Self::OutputBudget { .. } => {
                http::StatusCode::GATEWAY_TIMEOUT
            }
            Self::RequestBudget { .. } | Self::RequestMetadataBudget { .. } => {
                http::StatusCode::PAYLOAD_TOO_LARGE
            }
            Self::AtCapacity { .. } => http::StatusCode::SERVICE_UNAVAILABLE,
            _ => http::StatusCode::BAD_GATEWAY,
        }
    }
}

impl fmt::Display for SandboxFailure {
    fn fmt(&self, f: &mut fmt::Formatter<'_>) -> fmt::Result {
        match self {
            Self::Instantiation(detail) => {
                write!(f, "the plugin could not be instantiated: {detail}")
            }
            Self::FuelExhausted { budget } => write!(
                f,
                "the plugin exhausted its {budget}-unit CPU budget without answering"
            ),
            Self::Trap(detail) => write!(f, "the plugin trapped: {detail}"),
            Self::Exited(code) => write!(f, "the plugin called proc_exit({code})"),
            Self::NoAnswer => write!(f, "the plugin returned without answering"),
            Self::PartialFrame => write!(
                f,
                "the plugin wrote a partial frame with no terminating newline; a frame is one \
                 NDJSON line, so it must end with `\\n` (use `println!`, not `print!`)"
            ),
            Self::MalformedFrame(detail) => {
                write!(f, "the plugin wrote a malformed frame: {detail}")
            }
            Self::GuestError(detail) => write!(f, "the plugin reported a failure: {detail}"),
            Self::ResponseRefused(detail) => {
                write!(f, "the plugin's answer was refused: {detail}")
            }
            Self::OutputBudget { max } => write!(
                f,
                "the plugin wrote more than its {max}-byte response ceiling without ending a frame"
            ),
            Self::AtCapacity { max } => write!(
                f,
                "the plugin already has its {max} permitted requests executing"
            ),
            Self::RequestBudget { max, len } => write!(
                f,
                "the request body is {len} bytes, over the plugin's {max}-byte request ceiling"
            ),
            Self::RequestMetadataBudget { max, len } => write!(
                f,
                "the request's path, query, headers and parameters are {len} bytes, over the \
                 host's {max}-byte ceiling"
            ),
        }
    }
}

impl std::error::Error for SandboxFailure {}

/// Why an artifact could not be loaded at all.
#[derive(Debug, Clone, PartialEq, Eq)]
#[non_exhaustive]
pub enum SandboxLoadError {
    /// The manifest handed to [`SandboxHost::from_module`] does not satisfy the
    /// rules parsing enforces — it was built or mutated rather than parsed.
    InvalidManifest(String),
    /// The bytes are not a WebAssembly module this engine can compile.
    Wasm(String),
    /// The module imports something no host function defines.
    ForbiddenImports(Vec<CapabilityDenial>),
    /// The manifest's fuel budget cannot cover what every request must spend
    /// before the guest runs at all, so no route it declares could ever answer.
    FuelBelowFixedCharges {
        /// The budget the manifest declares.
        fuel: u64,
        /// What instantiating this module costs, every request, before `_start`.
        instantiation: u64,
    },
    /// The module's data or element segments would make every request's
    /// instantiation expensive, in host work no fuel budget prices.
    InstantiationTooExpensive {
        /// What was counted.
        what: &'static str,
        /// How many the module carries.
        found: usize,
        /// The ceiling.
        max: usize,
    },
    /// The module is larger than [`MAX_MODULE_BYTES`](super::MAX_MODULE_BYTES).
    ///
    /// The container reader applies this to a module it unpacks; this applies
    /// it to one handed straight to [`SandboxHost::from_module`] or
    /// [`SandboxHost::imports_of`], which never passed through that reader.
    ModuleTooLarge {
        /// The module's length.
        found: usize,
        /// The ceiling.
        max: usize,
    },
    /// The module exports no `_start` of type `() -> ()`.
    MissingStart,
    /// The module exports no linear memory named `memory`.
    MissingMemory,
    /// The module carries a WebAssembly `start` section.
    ///
    /// Guest code that runs at instantiation, before any request and outside
    /// the `_start` the shim calls. If it traps, every instantiation fails and
    /// the plugin can never answer; and running it at load to find out would
    /// mean executing an unaudited artifact's code just to inspect it.
    StartSectionForbidden,
    /// An active data segment does not fit the module's own initial memory.
    ///
    /// Copied in during instantiation, which is per request — so a segment
    /// past the end compiles clean and then fails every instantiation the
    /// artifact is ever given.
    SegmentOutOfBounds {
        /// Which store the segment writes into, for the message.
        what: &'static str,
        /// One past the segment's furthest write.
        end: u64,
        /// What the module starts that store with.
        capacity: u64,
    },
    /// The module's *initial* linear memory is already over the manifest's
    /// ceiling, so no request could ever instantiate it.
    MemoryTooLarge {
        /// The module's initial memory, in bytes.
        found: u64,
        /// The manifest's ceiling.
        max: usize,
    },
    /// The engine could not be configured.
    Engine(String),
}

impl fmt::Display for SandboxLoadError {
    fn fmt(&self, f: &mut fmt::Formatter<'_>) -> fmt::Result {
        match self {
            Self::InvalidManifest(detail) => {
                write!(f, "the manifest is not one this host will serve: {detail}")
            }
            Self::Wasm(detail) => write!(f, "the plugin module could not be loaded: {detail}"),
            Self::ForbiddenImports(denials) => {
                // Written straight through rather than cloned into a `Vec` and
                // joined. Each operation is already bounded, so the clone was
                // not unbounded — but it was a second full copy of every name
                // on the path that exists to refuse the artifact cheaply, and
                // the joined string was a third.
                write!(
                    f,
                    "the plugin imports {count} host function(s) the sandbox does not provide, \
                     so it is refused before it runs: ",
                    count = denials.len(),
                )?;
                for (written, denial) in denials.iter().enumerate() {
                    if written > 0 {
                        f.write_str(", ")?;
                    }
                    f.write_str(&denial.operation)?;
                }
                Ok(())
            }
            Self::FuelBelowFixedCharges {
                fuel,
                instantiation,
            } => write!(
                f,
                "the plugin's {fuel}-unit fuel budget cannot cover the {instantiation} units \
                 instantiating this module costs before `_start` runs, so every request would \
                 exhaust the budget without the guest executing an instruction"
            ),
            Self::ModuleTooLarge { found, max } => write!(
                f,
                "sandboxed plugin module is {found} bytes, over the {max}-byte ceiling"
            ),
            Self::InstantiationTooExpensive { what, found, max } => write!(
                f,
                "the plugin declares {found} {what}, over the {max} ceiling: every request \
                 re-instantiates the module, and that work happens before the first guest \
                 instruction — so it is bounded here rather than priced per request"
            ),
            Self::MissingStart => write!(
                f,
                "the plugin exports no `_start` of type `() -> ()`; it must be built as a \
                 wasm32-wasip1 *command*"
            ),
            Self::MissingMemory => write!(
                f,
                "the plugin exports no linear memory named `memory`; every host function reads \
                 and writes through it, so a plugin without one can never answer"
            ),
            Self::MemoryTooLarge { found, max } => write!(
                f,
                "the plugin's initial linear memory is {found} bytes, over the manifest's \
                 {max}-byte ceiling; no request could instantiate it"
            ),
            Self::StartSectionForbidden => write!(
                f,
                "the plugin carries a WebAssembly `start` section; a sandboxed plugin answers \
                 through its exported `_start` and runs no code at instantiation"
            ),
            Self::SegmentOutOfBounds {
                what,
                end,
                capacity,
            } => write!(
                f,
                "an active segment writes up to {end} of the plugin's {what}, past the \
                 {capacity} it starts with; every instantiation would fail on it"
            ),
            Self::Engine(detail) => write!(f, "the sandbox engine could not be built: {detail}"),
        }
    }
}

impl std::error::Error for SandboxLoadError {}

// ── The outcome ──────────────────────────────────────────────────────────

/// Everything one request produced: the answer or the failure, plus the
/// evidence.
#[derive(Debug)]
#[non_exhaustive]
pub struct SandboxOutcome {
    /// The plugin's answer, or why there is none.
    pub result: Result<SandboxResponse, SandboxFailure>,
    /// Everything the guest reached for and did not get.
    pub denials: Vec<CapabilityDenial>,
    /// Fuel the guest consumed.
    pub fuel_used: u64,
    /// The high-water mark of the guest's linear memory, in bytes.
    pub peak_memory_bytes: usize,
    /// What the guest wrote to stderr, truncated.
    pub stderr: String,
    /// Every capability call this request made, allowed or refused (#1632).
    ///
    /// The operator audit surface is built from these; see
    /// [`capability::audit`](crate::plugin_sandbox::capability::audit).
    pub activity: Vec<crate::plugin_sandbox::capability::CapabilityEvent>,
    /// Capability calls this request made that the bounded ledger could not
    /// hold, so `activity` is a floor rather than a count.
    ///
    /// Has no times. Ingest [`dropped_calls`](Self::dropped_calls) instead.
    pub dropped_activity: u64,
    /// The same calls, with when they occurred. `None` when none was dropped.
    ///
    /// Give it to
    /// [`PluginActivityLog::ingest_dropped_calls`](crate::plugin_sandbox::PluginActivityLog::ingest_dropped_calls).
    pub dropped_calls: Option<crate::plugin_sandbox::capability::DroppedCalls>,
}

impl SandboxOutcome {
    /// A request refused before the guest produced anything: no denials, no
    /// peak, no stderr, because nothing of the guest's ever ran.
    ///
    /// `fuel_used` is what the *host* had already committed on its behalf — the
    /// whole budget when a charge could not be covered, zero when the request
    /// was turned away before it was priced.
    const fn refused(failure: SandboxFailure, fuel_used: u64) -> Self {
        Self {
            result: Err(failure),
            denials: Vec::new(),
            fuel_used,
            peak_memory_bytes: 0,
            stderr: String::new(),
            activity: Vec::new(),
            dropped_activity: 0,
            dropped_calls: None,
        }
    }
}

/// Everything one render-slot call produced (#1632).
///
/// Separate from [`SandboxOutcome`] rather than a variant of it: the two carry
/// different answers, and a caller filling a slot on a page has a different
/// failure posture — it omits the fragment and serves the page — from one
/// serving a request, which returns a status.
#[derive(Debug)]
#[non_exhaustive]
pub struct SandboxRenderOutcome {
    /// The rendered HTML fragment, or why there is none.
    ///
    /// Every `Err` here means the same thing to a caller: leave the slot empty.
    pub fragment: Result<String, SandboxFailure>,
    /// Everything the guest reached for and did not get.
    pub denials: Vec<CapabilityDenial>,
    /// Fuel the guest consumed.
    pub fuel_used: u64,
    /// What the guest wrote to stderr, truncated.
    pub stderr: String,
    /// The high-water mark of the guest's linear memory, in bytes.
    pub peak_memory_bytes: usize,
    /// Every capability call the hook made.
    pub activity: Vec<crate::plugin_sandbox::capability::CapabilityEvent>,
    /// Calls the bounded ledger could not hold.
    ///
    /// Has no times. Ingest [`dropped_calls`](Self::dropped_calls) instead.
    pub dropped_events: u64,
    /// The same calls, with when they occurred. `None` when none was dropped.
    ///
    /// Give it to
    /// [`PluginActivityLog::ingest_dropped_calls`](crate::plugin_sandbox::PluginActivityLog::ingest_dropped_calls).
    pub dropped_calls: Option<crate::plugin_sandbox::capability::DroppedCalls>,
}

// ── The host ─────────────────────────────────────────────────────────────

/// A compiled sandboxed plugin, ready to serve requests.
///
/// Compilation happens once in [`load`](SandboxHost::load); every call to
/// [`run`](SandboxHost::run) builds a *fresh* store and instance, so no state
/// survives a request and one request's misbehaviour cannot reach the next.
pub struct SandboxHost {
    engine: Engine,
    module: Module,
    /// One permit per concurrently-executing request.
    ///
    /// `SandboxedPlugin::serve` has a semaphore of its own, which it holds
    /// across the body read as well as the run, so the declared footprint
    /// bounds the whole request rather than only the part a guest is running.
    /// This one is narrower and lives here because [`run`](SandboxHost::run)
    /// is public: an embedder calling it directly never passes through
    /// `serve`, and `request_footprint_bytes() × max_concurrency` is the
    /// premise the manifest validator accepts limits on.
    ///
    /// The two never fight. At most `max_concurrency` requests are in `serve`
    /// at once, so they can hold at most that many of these — this semaphore
    /// is only ever the binding constraint on a direct caller, which is the
    /// one it exists for.
    permits: Semaphore,
    /// The sealed digest of the whole artifact, when this host came from one.
    /// Stamped on every job the plugin enqueues.
    artifact_sha256: Option<String>,
    /// The paths this plugin declared, as the router matches them.
    ///
    /// Built once here because a redirect may only name a route the plugin
    /// serves, and rebuilding the matcher per response would be a per-request
    /// allocation for a set fixed at load. See [`OwnedRoutes`].
    owned_routes: super::wire::OwnedRoutes,
    /// What one instantiation of this module costs, in fuel. Bounded at load by
    /// [`MAX_INIT_SEGMENTS`] and [`MAX_INIT_SECTION_BYTES`]; charged per request
    /// so the declared CPU ceiling prices it — see [`SandboxHost::run`].
    instantiation_fuel: u64,
    manifest: SandboxManifest,
}

impl fmt::Debug for SandboxHost {
    fn fmt(&self, f: &mut fmt::Formatter<'_>) -> fmt::Result {
        f.debug_struct("SandboxHost")
            .field("plugin", &self.manifest.name)
            .field("prefix", &self.manifest.prefix)
            .finish_non_exhaustive()
    }
}

/// What one context entry costs beyond its bytes: two `String` headers, a
/// tuple, and the JSON punctuation it becomes on the wire.
///
/// Counted in both the ceiling and the fuel charge, so a thousand empty pairs
/// are neither free to hold nor free to encode.
pub const RENDER_CONTEXT_ENTRY_OVERHEAD: usize = 64;

/// The most context entries one render hook is handed.
///
/// A slot's context is a handful of values a panel needs — an id, a locale, a
/// count. Far above that, and far below anything that could matter.
pub const MAX_RENDER_CONTEXT_ENTRIES: usize = 32;

/// The most bytes one render hook's context may carry across all its entries.
pub const MAX_RENDER_CONTEXT_BYTES: usize = 16 * 1024;

/// Take as much of `context` as the ceilings above allow.
///
/// Applied by [`SandboxHost::render`] itself, not only by the wrapper: the
/// entry point is public, an embedder may call it with context built from a
/// row or a query string, and a ceiling that only one of two callers reaches is
/// a ceiling the other does not have.
///
/// Per-entry overhead is counted, not just the strings: a thousand empty pairs
/// cost real allocation and real serialization, and a budget measured only in
/// string length prices them at nothing.
#[must_use]
pub fn bounded_context(context: &[(String, String)]) -> Vec<(String, String)> {
    let mut out = Vec::with_capacity(context.len().min(MAX_RENDER_CONTEXT_ENTRIES));
    let mut total = 0_usize;
    for (name, value) in context {
        if out.len() >= MAX_RENDER_CONTEXT_ENTRIES {
            break;
        }
        let weight = name
            .len()
            .saturating_add(value.len())
            .saturating_add(RENDER_CONTEXT_ENTRY_OVERHEAD);
        if total.saturating_add(weight) > MAX_RENDER_CONTEXT_BYTES {
            break;
        }
        total = total.saturating_add(weight);
        out.push((name.clone(), value.clone()));
    }
    out
}

impl SandboxHost {
    /// Compile a verified artifact into a runnable host.
    ///
    /// # Errors
    ///
    /// Returns [`SandboxLoadError`] if the module does not compile, imports
    /// something the sandbox does not provide, or exports no `_start`.
    pub fn load(artifact: &SandboxArtifact) -> Result<Self, SandboxLoadError> {
        // The whole container's digest, kept here so a direct `run` stamps jobs
        // with it too, not only a host built through `SandboxedPlugin`.
        let digest = artifact
            .artifact_digest()
            .map_err(|err| SandboxLoadError::InvalidManifest(err.to_string()))?;
        Ok(
            Self::from_module(artifact.manifest().clone(), artifact.module())?
                .with_artifact_sha256(digest),
        )
    }

    /// Compile a module against a manifest.
    ///
    /// Prefer [`load`](Self::load), which also proves the manifest describes
    /// *these* bytes.
    ///
    /// The manifest is re-validated here rather than trusted. Parsing is where
    /// a manifest's rules are enforced, but [`SandboxManifest`]'s fields are
    /// public and this constructor is too, so "it was parsed once" is an
    /// invariant a caller can step around by building or editing one. The
    /// values that matter are the ones something downstream would *panic* on
    /// rather than merely misbehave over — a `max_concurrency` past the
    /// semaphore's ceiling, a route path axum refuses to build — and this crate
    /// does not panic on plugin input.
    ///
    /// # Errors
    ///
    /// See [`load`](Self::load), plus
    /// [`InvalidManifest`](SandboxLoadError::InvalidManifest) if the manifest
    /// does not satisfy the rules parsing enforces.
    pub fn from_module(manifest: SandboxManifest, wasm: &[u8]) -> Result<Self, SandboxLoadError> {
        manifest
            .validate()
            .map_err(|err| SandboxLoadError::InvalidManifest(err.to_string()))?;

        // Before `Module::new`, deliberately: compiling is what allocates a
        // representation of every declaration, so a ceiling checked afterwards
        // is a ceiling checked too late.
        let shape = refuse_unbounded_shape(wasm)?;

        let mut config = Config::default();
        // Fuel metering is what turns "a plugin might loop forever" into "a
        // plugin gets a bounded number of instructions". It must be on before
        // the module is compiled, because the counting is compiled in.
        config.consume_fuel(true);
        let engine = Engine::new(&config);
        let module =
            Module::new(&engine, wasm).map_err(|err| SandboxLoadError::Wasm(err.to_string()))?;

        let import_count = module.imports().count();
        if import_count > MAX_IMPORTS {
            return Err(SandboxLoadError::InstantiationTooExpensive {
                what: "imports",
                found: import_count,
                max: MAX_IMPORTS,
            });
        }

        let forbidden = forbidden_imports(&module);
        if !forbidden.is_empty() {
            return Err(SandboxLoadError::ForbiddenImports(forbidden));
        }

        // Every shim function reads and writes through an export named
        // `memory`; without one they all answer `EINVAL` and the plugin can
        // never serve a request. And a module whose *initial* memory is already
        // over the manifest's ceiling is refused by the limiter at
        // instantiation — per request, as a gateway error, when it could have
        // been said once here.
        let memory = module
            .exports()
            .find(|export| export.name() == "memory")
            .and_then(|export| export.ty().memory().copied());
        let Some(memory) = memory else {
            return Err(SandboxLoadError::MissingMemory);
        };
        let initial_bytes =
            u64::from(u32::from(memory.initial_pages())).saturating_mul(WASM_PAGE_BYTES);
        if initial_bytes > manifest.limits.memory_bytes as u64 {
            return Err(SandboxLoadError::MemoryTooLarge {
                found: initial_bytes,
                max: manifest.limits.memory_bytes,
            });
        }

        // Both ceilings are enforced by `refuse_unbounded_shape` above, before
        // `Module::new` rather than after it.
        let (segments, init_bytes) = (shape.segments, shape.init_bytes);
        // A budget that cannot cover instantiation is a manifest whose every route is
        // already broken: the charge is unavoidable and paid before `_start`, so the
        // guest never executes an instruction. Refusing at load is what makes `autumn
        // plugin inspect` mean something — a passing verdict on an artifact that can
        // only answer 504 is worse than no verdict, because an operator installs on
        // the strength of it. Compared against instantiation alone rather than the
        // whole per-request cost: the frame encoding varies with the request, so there
        // is no single number to check it against, while this charge is fixed by the
        // module and known now.
        let instantiation = instantiation_fuel(
            segments,
            init_bytes,
            import_count,
            shape.global_count,
            initial_bytes,
            shape.table_elements,
        )
        .saturating_add(u64::try_from(shape.function_count).unwrap_or(u64::MAX));
        if manifest.limits.fuel <= instantiation {
            return Err(SandboxLoadError::FuelBelowFixedCharges {
                fuel: manifest.limits.fuel,
                instantiation,
            });
        }

        // Not merely "some function called `_start`": the host looks it up as
        // `() -> ()`, so a `_start` with parameters or results is a module that
        // loads and then fails on every request.
        let start_is_callable = module.exports().any(|export| {
            export.name() == "_start"
                && export
                    .ty()
                    .func()
                    .is_some_and(|ty| ty.params().is_empty() && ty.results().is_empty())
        });
        if !start_is_callable {
            return Err(SandboxLoadError::MissingStart);
        }

        refuse_unrunnable_shape(&shape, initial_bytes)?;

        Ok(Self {
            engine,
            module,
            permits: Semaphore::new(manifest.limits.max_concurrency),
            artifact_sha256: None,
            instantiation_fuel: instantiation,
            owned_routes: super::wire::OwnedRoutes::from_routes(
                manifest
                    .routes
                    .iter()
                    .map(|route| (route.method.as_str(), route.path.as_str())),
            ),
            manifest,
        })
    }

    /// Record the sealed digest of the artifact this host came from.
    #[must_use]
    pub(super) fn with_artifact_sha256(mut self, digest: String) -> Self {
        self.artifact_sha256 = Some(digest);
        self
    }

    /// The manifest this host enforces.
    #[must_use]
    pub const fn manifest(&self) -> &SandboxManifest {
        &self.manifest
    }

    /// Every import a module declares, as `module::name`, without loading it.
    ///
    /// The review surface for an artifact the sandbox *refuses*: what it wanted
    /// is the whole reason it was refused, so a consent screen must be able to
    /// show it.
    ///
    /// # Errors
    ///
    /// Returns [`SandboxLoadError::Wasm`] if the bytes are not a module.
    pub fn imports_of(wasm: &[u8]) -> Result<Vec<String>, SandboxLoadError> {
        // `inspect` calls this on artifacts nobody has audited, and on the ones
        // the sandbox is about to refuse — so the review surface must not be
        // the way an artifact exhausts the process reviewing it.
        refuse_unbounded_shape(wasm)?;
        let engine = Engine::default();
        let module =
            Module::new(&engine, wasm).map_err(|err| SandboxLoadError::Wasm(err.to_string()))?;
        Ok(reported_imports(module.imports()))
    }

    /// What one request pays, in fuel, just to instantiate this module.
    ///
    /// Bounded at load; charged per request. Surfaced so a packaging tool can
    /// show an author what their module costs before it costs anyone else.
    #[must_use]
    pub const fn instantiation_fuel(&self) -> u64 {
        self.instantiation_fuel
    }

    /// Every import the module declares, as `module::name`, for review.
    #[must_use]
    pub fn imports(&self) -> Vec<String> {
        reported_imports(self.module.imports())
    }

    /// Serve one request, with no capability backends wired.
    ///
    /// This is synchronous and CPU-bound by design — it is an interpreter loop.
    /// Callers on an async runtime must dispatch it to a blocking worker; the
    /// [`plugin`](super::plugin) module does exactly that.
    ///
    /// Never panics and never fails: a plugin that misbehaves in any way
    /// produces an [`SandboxOutcome`] whose `result` is `Err`.
    ///
    /// A plugin granted `kv`, `db`, `http-outbound` or `jobs` still *runs* here
    /// — its calls are answered [`unavailable`](crate::plugin_sandbox::DenialReason::Unavailable)
    /// and recorded. Wire the backends with [`run_with`](Self::run_with).
    #[must_use]
    pub fn run(&self, request: &SandboxRequest) -> SandboxOutcome {
        self.run_with(request, crate::plugin_sandbox::CapabilityServices::none())
    }

    /// Serve one request against `services` (issue #1632).
    ///
    /// The services are per-call rather than per-host because the tenant is:
    /// one compiled plugin serves every tenant's requests, and the scoping that
    /// makes that safe comes from `services.tenant` being the *request's*
    /// tenant. A host that held the services would hold one tenant.
    #[must_use]
    pub fn run_with(
        &self,
        request: &SandboxRequest,
        services: crate::plugin_sandbox::CapabilityServices,
    ) -> SandboxOutcome {
        let limits = self.manifest.limits;
        // Bounds where the response may redirect a client; see `sanitize`.
        let rules = ResponseRules {
            prefix: self.manifest.prefix.as_str(),
            owned: &self.owned_routes,
            requested: &request.method,
        };

        if let Some(refusal) = refuse_oversized_request(request, limits) {
            return refusal;
        }

        // Borrowed, not cloned: `HostFrame::request` reads the grants to decide
        // what the guest is told it may do and never keeps them, so copying the
        // vector on every request bought nothing. Validation refuses a repeated
        // grant, so this list is at most one entry per capability this build
        // understands.
        // The frame is *built* inside `execute`, not here. Encoding it clones
        // the body and base64-expands it, which is the host work
        // `encoding_fuel` exists to price and `max_concurrency` exists to
        // bound — so doing it before admission and before the charge undid
        // both: a manifest with a 64 MiB body ceiling and almost no fuel would
        // expand every request in full and only then answer `FuelExhausted`,
        // once per request, for as long as a client cared to ask.
        let capabilities = &self.manifest.capabilities;
        match self.execute(
            || HostFrame::request(request, capabilities),
            encoding_fuel(request),
            Exchange::Request,
            services,
        ) {
            Execution::Refused(failure, fuel_used) => SandboxOutcome::refused(failure, fuel_used),
            Execution::Ran(store, permit, result) => {
                // The permit is still held, and dropped only once `finish` has
                // drained the store: sanitising and size-checking the response
                // clones up to `max_response_bytes`, which is the term
                // `request_footprint_bytes` charges to `max_concurrency`.
                let outcome = finish(store, limits, &rules, result);
                drop(permit);
                outcome
            }
        }
    }

    /// Fill one render slot (issue #1632).
    ///
    /// `context` is whatever the host chose to tell the plugin about the page —
    /// an order id, a locale. It is the host's to decide and the plugin's to
    /// read; nothing about the request, the session or the user crosses unless
    /// the host put it here.
    ///
    /// Every failure produces an `Err` fragment and nothing else: a slow hook, a
    /// trapping one, a fragment carrying a tag this build will not emit, one
    /// over the `render_bytes` quota. A caller omits the fragment and serves the
    /// page — see [`SandboxRenderOutcome`].
    #[must_use]
    pub fn render(
        &self,
        slot: &str,
        context: &[(String, String)],
        services: crate::plugin_sandbox::CapabilityServices,
    ) -> SandboxRenderOutcome {
        let limits = self.manifest.limits;
        let refused = |failure, fuel_used| SandboxRenderOutcome {
            fragment: Err(failure),
            denials: Vec::new(),
            fuel_used,
            peak_memory_bytes: 0,
            stderr: String::new(),
            activity: Vec::new(),
            dropped_events: 0,
            dropped_calls: None,
        };

        // Checked here rather than left to the guest: a plugin that was not
        // granted the slot must not run at all for it, because running is what
        // costs the page its latency.
        if !self
            .manifest
            .is_granted(super::manifest::SandboxCapability::Render)
            || !self
                .manifest
                .grants
                .allows(super::manifest::SandboxCapability::Render, slot)
        {
            return refused(
                SandboxFailure::GuestError(format!(
                    "this plugin was not granted the render slot {slot:?}",
                    slot = super::manifest::rejected(slot)
                )),
                0,
            );
        }

        // Bounded here, at the public entry point, rather than only in
        // `SandboxedPlugin::render_slot`. An embedder may call this directly
        // with context built from a row or a query string, and a ceiling only
        // one of two callers reaches is a ceiling the other does not have.
        let context = &bounded_context(context);

        // The context is the host's own text rather than a client's body, so it
        // is priced by its length the same way an encoded request is. Measured
        // from the parts rather than from the encoded frame, because encoding
        // it is the work being priced. Per-entry overhead is included, so a
        // context of many empty pairs is not charged nothing for allocation and
        // serialization it really costs.
        let encoding = context
            .iter()
            .map(|(name, value)| {
                u64::try_from(
                    name.len()
                        .saturating_add(value.len())
                        .saturating_add(RENDER_CONTEXT_ENTRY_OVERHEAD),
                )
                .unwrap_or(u64::MAX)
            })
            .fold(
                u64::try_from(slot.len()).unwrap_or(u64::MAX),
                u64::saturating_add,
            )
            / BYTES_PER_FUEL;

        let capabilities = &self.manifest.capabilities;
        match self.execute(
            || HostFrame::render(slot, context, capabilities),
            encoding,
            Exchange::Render,
            services,
        ) {
            Execution::Refused(failure, fuel_used) => refused(failure, fuel_used),
            Execution::Ran(store, permit, result) => {
                let fuel_used = store
                    .get_fuel()
                    .map_or(limits.fuel, |left| limits.fuel.saturating_sub(left));
                let mut state = store.into_data();
                // The same drain `finish` performs, and for the same reason: a
                // hook that kept hitting its memory ceiling is the likeliest
                // cause of an omitted fragment, and an operator reading an empty
                // denial list would be reading silence rather than evidence.
                let peak_memory_bytes = record_limiter_refusals(&mut state, limits);
                let activity = state.runtime.take_events();
                let dropped_events = state.runtime.dropped_events();
                let dropped_calls = state.runtime.dropped_calls();
                let max_bytes = state.runtime.quotas().render_bytes as usize;
                let fragment = match result {
                    Ok(GuestAnswer::Fragment(nodes)) => {
                        super::capability::render::render(&nodes, max_bytes).map_err(|err| {
                            SandboxFailure::ResponseRefused(guest_text(&err.to_string()))
                        })
                    }
                    Ok(GuestAnswer::Response(_)) => Err(SandboxFailure::MalformedFrame(
                        "a render slot is answered with a `fragment` frame, not a `response`"
                            .to_owned(),
                    )),
                    Err(failure) => Err(failure),
                };
                let stderr = state.stderr_excerpt();
                drop(permit);
                SandboxRenderOutcome {
                    fragment,
                    denials: state.denials,
                    fuel_used,
                    peak_memory_bytes,
                    stderr,
                    activity,
                    dropped_events,
                    dropped_calls,
                }
            }
        }
    }

    /// Instantiate the module and run it to its first terminal frame.
    ///
    /// The half `run_with` and `render` share: everything from admission to the
    /// `_start` call is identical between them, and a second copy of it would be
    /// a second place for one of these ceilings to go missing.
    fn execute(
        &self,
        frame: impl FnOnce() -> HostFrame,
        encoding: u64,
        exchange: Exchange,
        services: crate::plugin_sandbox::CapabilityServices,
    ) -> Execution<'_> {
        let limits = self.manifest.limits;

        // Admission, before a single buffer is built. `serve` holds a permit of
        // its own across the whole request, so this is never what stops an
        // ordinary HTTP request — it is here for the embedder who calls the
        // public entry points directly and would otherwise start as many
        // instances as it liked, against a footprint the manifest validator
        // accepted on the premise that `max_concurrency` bounds them.
        //
        // Held for the body of the run: dropping the guard on the way out is
        // what makes the permit mean "executing now".
        let Ok(permit) = self.permits.try_acquire() else {
            return Execution::Refused(
                SandboxFailure::AtCapacity {
                    max: limits.max_concurrency,
                },
                0,
            );
        };

        // Building the guest's stdin is host work proportional to the frame:
        // the body is cloned into it and base64-expanded into the NDJSON line,
        // all of it before a single guest instruction runs. Unpriced, that is
        // megabytes of host CPU per request for a manifest that declares a
        // large body ceiling and almost no fuel — and a client can repeat it
        // for as long as it likes.
        //
        // So it is charged at the same rate as every other host-side copy, and
        // charged *before* the copies happen: a budget that cannot cover the
        // encoding refuses without doing it. The guest then starts on what is
        // left, which is the same arrangement instantiation already has.
        let Some(after_encoding) = limits.fuel.checked_sub(encoding) else {
            return Execution::Refused(
                SandboxFailure::FuelExhausted {
                    budget: limits.fuel,
                },
                limits.fuel,
            );
        };

        // Built and encoded here, after admission and after the charge above —
        // see the note in `run_with`. The frame's bytes are then *moved* into
        // the queue rather than copied into it: `VecDeque::from(Vec<u8>)`
        // reuses the allocation, and the `String` is gone afterwards. For a
        // plugin with a large body ceiling that is a whole base64-expanded copy
        // of the request that no longer exists at the same time as the others.
        let frame = frame();
        // Only the request frame is large, and only its encoding is priced for
        // the second pass above. Render frames keep the single pass.
        let line = match if matches!(frame, HostFrame::Request { .. }) {
            to_exact_line(&frame)
        } else {
            to_line(&frame)
        } {
            Ok(line) => line,
            Err(err) => {
                // The host could not encode its own frame. Reported as a
                // plugin-prefix failure rather than propagating: the rest of
                // the application is unaffected either way.
                return Execution::Refused(
                    SandboxFailure::Instantiation(guest_text(&err.to_string())),
                    0,
                );
            }
        };

        let mut state = HostState::new(
            self.manifest.name.clone(),
            limits,
            line.as_bytes(),
            exchange,
            crate::plugin_sandbox::capability::CapabilityRuntime::new(&self.manifest, services)
                .with_artifact_sha256(
                    self.artifact_sha256
                        .clone()
                        .unwrap_or_else(|| self.manifest.sha256.clone()),
                ),
        );
        state.stdin = VecDeque::from(line.into_bytes());

        let mut store = Store::new(&self.engine, state);
        store.limiter(|state| &mut state.limiter);
        // Set before instantiation, so the budget is in place the moment the
        // first guest instruction runs.
        if let Err(err) = store.set_fuel(after_encoding) {
            return Execution::Refused(
                SandboxFailure::Instantiation(guest_text(&err.to_string())),
                0,
            );
        }

        // wasmi does not meter instantiation: every request copies the module's
        // data and element segments before `_start` runs. Two things bound it,
        // and it needs both. The *ceiling* is at load — a module whose segments
        // are structurally expensive is refused outright, because a per-request
        // charge cannot stop work that has already been admitted. The *price* is
        // here, so the work that is admitted still comes out of the budget the
        // manifest declared rather than being free.
        let Some(left) = after_encoding.checked_sub(self.instantiation_fuel) else {
            return Execution::Ran(
                store,
                permit,
                Err(SandboxFailure::FuelExhausted {
                    budget: limits.fuel,
                }),
            );
        };
        if let Err(err) = store.set_fuel(left) {
            return Execution::Refused(
                SandboxFailure::Instantiation(guest_text(&err.to_string())),
                0,
            );
        }

        let mut linker = <Linker<HostState>>::new(&self.engine);
        if let Err(err) = define_wasi_shim(&mut linker) {
            return Execution::Refused(
                SandboxFailure::Instantiation(guest_text(&err.to_string())),
                0,
            );
        }

        let started = linker
            .instantiate(&mut store, &self.module)
            .and_then(|pre| pre.start(&mut store));
        let instance = match started {
            Ok(instance) => instance,
            Err(err) => {
                return Execution::Ran(store, permit, Err(instantiation_failure(&err, limits)));
            }
        };

        let Ok(start) = instance.get_typed_func::<(), ()>(&store, "_start") else {
            // `from_module` already refused a module without `_start`; reaching
            // here would mean the export changed shape, which is still the
            // plugin's problem and not the host's.
            return Execution::Ran(store, permit, Err(SandboxFailure::NoAnswer));
        };

        let trap = start.call(&mut store, ()).err();
        let partial = !store.data().stdout_line.is_empty();
        let result = match (store.data().answer.clone(), trap) {
            // A guest that answered and *then* trapped still answered: the
            // first frame is the answer, and everything after it — including
            // the host's own `AnswerComplete` unwind — is noise after the fact.
            (Some(answer), _) => answer,
            (None, Some(err)) => Err(guest_failure(&err, limits)),
            (None, None) if partial => Err(SandboxFailure::PartialFrame),
            (None, None) => Err(SandboxFailure::NoAnswer),
        };
        Execution::Ran(store, permit, result)
    }
}

/// What one instantiation-and-run produced.
///
/// `Refused` is a request that never reached a guest instruction — at capacity,
/// or a budget that could not cover its own fixed charges — and carries no
/// store, because there is none. `Ran` carries the store so the caller can drain
/// the evidence: fuel, memory peak, denials, stderr and the capability ledger.
#[allow(
    clippy::large_enum_variant,
    reason = "`Ran` carries the wasmi `Store` itself, which is large by construction and is the \
              common path; boxing it would add an allocation per request without shrinking the \
              store, and this value is a return value moved once, never held in a collection"
)]
enum Execution<'a> {
    /// Turned away before a store existed.
    Refused(SandboxFailure, u64),
    /// Ran to a terminal frame, or failed trying.
    ///
    /// The permit comes back out with the store rather than being dropped at
    /// the end of `execute`: draining the store is where the response is
    /// sanitised, size-checked and cloned, which is the `5 ×
    /// max_response_bytes` term `max_concurrency` is validated against. A
    /// permit released before that work happens bounds the interpreter and not
    /// the request.
    Ran(
        Store<HostState>,
        tokio::sync::SemaphorePermit<'a>,
        Result<GuestAnswer, SandboxFailure>,
    ),
}

/// Drain the store into an outcome, applying the response sanitation and the
/// size ceiling that only the host can enforce.
/// What a response may carry, gathered because the three travel together.
///
/// A `Location` is judged against all of them at once: it must stay under the
/// prefix, name a route the plugin actually serves — an application route may
/// sit under the prefix — and land on that route under the method the client
/// will replay, which the status and the request's own method decide between
/// them. Passing them as one argument keeps `run`'s exits readable.
struct ResponseRules<'a> {
    prefix: &'a str,
    owned: &'a super::wire::OwnedRoutes,
    requested: &'a str,
}

fn finish(
    store: Store<HostState>,
    limits: ResourceLimits,
    rules: &ResponseRules<'_>,
    result: Result<GuestAnswer, SandboxFailure>,
) -> SandboxOutcome {
    let fuel_used = store
        .get_fuel()
        .map_or(limits.fuel, |left| limits.fuel.saturating_sub(left));
    let mut state = store.into_data();
    let peak_memory_bytes = record_limiter_refusals(&mut state, limits);

    let activity = state.runtime.take_events();
    let dropped_activity = state.runtime.dropped_events();
    let dropped_calls = state.runtime.dropped_calls();
    let result = match result {
        Ok(GuestAnswer::Fragment(_)) => Err(SandboxFailure::MalformedFrame(
            "a request is answered with a `response` frame, not a `fragment`".to_owned(),
        )),
        Ok(GuestAnswer::Response(response)) => {
            let (response, denied) = response.sanitize(rules.prefix, rules.owned, rules.requested);
            for name in denied {
                // The name is the guest's, so it is as long and as hostile as
                // the guest cares to make it — bounded only by the stdout line
                // ceiling. `deny` clones it into the ledger and logs it, and a
                // name is not validated before it gets here (that it is invalid
                // is often *why* it was denied), so it can carry newlines and
                // terminal escapes too. Same treatment as every other
                // guest-influenced string that reaches a log.
                state.deny(
                    DeniedCapability::ResponseHeader,
                    &guest_text(&name),
                    "a sandboxed plugin may not set this response header",
                );
            }
            response.refused_content_type().map_or_else(
                || {
                    response
                        .validate()
                        .and_then(|()| response.check_size(limits.max_response_bytes))
                        .map_or_else(
                            |err| {
                                Err(SandboxFailure::ResponseRefused(guest_text(
                                    &err.to_string(),
                                )))
                            },
                            |()| Ok(response.clone()),
                        )
                },
                |essence| {
                    // `refused_content_type` returns everything before the
                    // first `;`, so a guest that writes no parameter hands back
                    // its whole header value — bounded only by the stdout
                    // ceiling, which is megabytes. Both strings built here are
                    // logged, the denial by `deny` and the failure by `serve`,
                    // so the guest's text gets the same cap and control-escaping
                    // every other guest-influenced string gets. The branch beside
                    // this one already did; this one did not.
                    let essence = guest_text(&essence);
                    let detail = format!(
                        "a sandboxed plugin may not serve `{essence}`: a document or a script \
                         from the host's own origin would carry the host's authority"
                    );
                    state.deny(DeniedCapability::ResponseHeader, "content-type", &detail);
                    Err(SandboxFailure::ResponseRefused(
                        super::wire::WireError::UnsupportedContentType(essence).to_string(),
                    ))
                },
            )
        }
        Err(failure) => Err(failure),
    };

    let stderr = state.stderr_excerpt();
    SandboxOutcome {
        result,
        denials: state.denials,
        fuel_used,
        peak_memory_bytes,
        stderr,
        activity,
        dropped_activity,
        dropped_calls,
    }
}

/// Turn the memory limiter's refusal counts into denials, and report the peak.
///
/// Shared by `finish` and by the render path. Two exits that both drain a store
/// are two places for one of these to be forgotten — and the render path did
/// forget them, so a hook that died against its memory ceiling reported an empty
/// denial list, which reads as "nothing was refused" rather than as the answer.
fn record_limiter_refusals(state: &mut HostState, limits: ResourceLimits) -> usize {
    let peak_memory_bytes = state.limiter.peak;
    let (memory_refusals, table_refusals) =
        (state.limiter.memory_refusals, state.limiter.table_refusals);
    if memory_refusals > 0 {
        let detail = format!(
            "{memory_refusals} allocation(s) over the plugin's {max}-byte memory ceiling were refused",
            max = limits.memory_bytes,
        );
        state.deny(DeniedCapability::Memory, "memory.grow", &detail);
    }
    // Its own operation and its own ceiling. `deny` deduplicates by
    // `(capability, operation)`, so this is a second entry beside the byte one
    // rather than a collision with it, and a guest that hit both is recorded as
    // having hit both.
    if table_refusals > 0 {
        let detail = format!(
            "{table_refusals} table growth(s) over the sandbox's {MAX_TABLE_ELEMENTS}-element table ceiling were refused",
        );
        state.deny(DeniedCapability::Memory, "table.grow", &detail);
    }
    peak_memory_bytes
}

fn instantiation_failure(err: &wasmi::Error, limits: ResourceLimits) -> SandboxFailure {
    if err.as_trap_code() == Some(wasmi::core::TrapCode::OutOfFuel) {
        SandboxFailure::FuelExhausted {
            budget: limits.fuel,
        }
    } else {
        SandboxFailure::Instantiation(guest_text(&err.to_string()))
    }
}

fn guest_failure(err: &wasmi::Error, limits: ResourceLimits) -> SandboxFailure {
    if let Some(code) = err.i32_exit_status() {
        return SandboxFailure::Exited(code);
    }
    if err.as_trap_code() == Some(wasmi::core::TrapCode::OutOfFuel) {
        return SandboxFailure::FuelExhausted {
            budget: limits.fuel,
        };
    }
    if err.downcast_ref::<OutputBudgetExhausted>().is_some() {
        return SandboxFailure::OutputBudget {
            max: limits.max_response_bytes,
        };
    }
    SandboxFailure::Trap(guest_text(&err.to_string()))
}

/// What a module's section headers declare, without compiling it.
///
/// Walks the top-level sections directly. wasmi's public API does not expose
/// segments, and these are the numbers that have to be bounded at load: the
/// alternative is discovering them per request, in host work no budget prices.
///
/// Returns `None` for bytes that are not a well-formed section stream. This now
/// runs *before* wasmi compiles the module, so malformed bytes reach it — and
/// refusing them is the right answer.
#[derive(Debug, Clone, Copy)]
struct ModuleShape {
    /// How many linear memories the module declares for itself.
    memory_count: usize,
    /// Section headers the module carries, custom ones included.
    ///
    /// Counted because a custom section contributes to no other ceiling and
    /// costs three bytes to encode; see `MAX_SECTIONS`.
    sections: usize,
    /// Data and element segments, which every instantiation copies.
    segments: usize,
    /// Bytes those sections hold.
    init_bytes: usize,
    /// Entries every section *declares*, summed.
    ///
    /// Read from each section's leading count, so this costs one LEB128 per
    /// section rather than a walk over the entries themselves — the point is to
    /// know the shape before anything allocates per entry.
    declared_entries: usize,
    /// The first active element segment that writes past its table, as
    /// (one past its furthest write, what the table starts with).
    element_overflow: Option<(u64, u64)>,
    /// The furthest byte any active data segment writes to.
    ///
    /// Zero when the module has none, or when the offsets are not constants
    /// this walk can evaluate.
    data_end: u64,
    /// How many imports the module declares.
    ///
    /// `MAX_IMPORTS` was enforced from `module.imports().count()`, which is
    /// only available *after* `Module::new` has already built a representation
    /// of every one of them — the ceiling ran after the allocation it exists to
    /// prevent. Read from the section header here, so it can run before.
    import_count: usize,
    /// How many functions the module defines.
    function_count: usize,
    /// Whether the module carries a `start` section.
    has_start: bool,
    /// Bytes of instruction stream in the code section.
    code_bytes: usize,
    /// How many globals the module declares.
    global_count: usize,
    /// Bytes of instruction stream in the global section.
    ///
    /// A global's initializer is a constant expression, and the extended-const
    /// proposal lets that expression run to arbitrary length — one global can
    /// carry most of the module. Those bytes are instruction volume, the same
    /// thing the code-section ceiling measures, so they share it rather than
    /// hiding behind the entry count.
    global_bytes: usize,
    /// How many tables the module declares.
    ///
    /// Sizes and count are separate ceilings: five empty tables cost no
    /// elements at all and still exceed what the store will build.
    table_count: usize,
    /// Elements the module's own tables declare as their *initial* size.
    ///
    /// The limiter enforces `MAX_TABLE_ELEMENTS` at instantiation, which is
    /// per request; knowing the declared total at load is what turns "every
    /// request fails" into "this artifact does not load".
    table_elements: u64,
}

/// What an element section declares, and whether it writes past a table.
struct ElementSectionShape {
    /// The first active segment that writes past its table, as (one past its
    /// furthest write, what the table starts with).
    overflow: Option<(u64, u64)>,
    /// Items the section's segments declare between them.
    ///
    /// Read from each segment's leading count rather than by counting the
    /// items walked, which is what lets the walk stop at the ceiling instead
    /// of reaching it one entry at a time.
    items: usize,
}

/// What the element section declares, and whether any *active* segment writes
/// past the table it targets.
///
/// `None` when the section cannot be read — the same restraint the data walk
/// uses: an offset this cannot evaluate is left to the engine rather than
/// guessed at.
fn element_section_shape(
    wasm: &[u8],
    start: usize,
    section_end: usize,
    table_minimums: &[u64],
) -> Option<ElementSectionShape> {
    let (count, mut at) = leb128(wasm, start)?;
    let mut overflow = None;
    let mut declared = 0usize;
    for _ in 0..count {
        let (flags, next) = leb128(wasm, at)?;
        at = next;
        // Only an active segment is written at instantiation; passive (1, 5)
        // and declarative (3, 7) ones are not.
        let active = matches!(flags, 0 | 2 | 4 | 6);
        let mut table_index = 0usize;
        if flags == 2 || flags == 6 {
            let (index, next) = leb128(wasm, at)?;
            table_index = index;
            at = next;
        }
        let mut offset = None;
        if active {
            let (value, next) = const_i32(wasm, at, section_end)?;
            offset = value;
            at = next;
        }
        // Every form but 0 and 4 carries an elemkind or reftype byte.
        if !matches!(flags, 0 | 4) {
            at = at.checked_add(1)?;
        }
        let (items, next) = leb128(wasm, at)?;
        at = next;
        // The segment's own count, before a single item is read. Nothing else sees it:
        // `declared_entries` sums each section's leading count, so one segment holding
        // millions of indices adds one, and `MAX_TABLE_ELEMENTS` bounds only what a
        // table starts with, which a passive segment never touches. The ceiling that
        // exists to bound declarations before anything allocates per declaration was
        // therefore blind to the one place a declaration is nested. Return here rather
        // than walk on: past the ceiling the module is refused whatever the remaining
        // segments hold, so reading them is work an artifact chose for this process —
        // the same rule the section-count walk follows, one level down.
        declared = declared.saturating_add(items);
        if declared > MAX_DECLARED_ENTRIES {
            return Some(ElementSectionShape {
                overflow,
                items: declared,
            });
        }
        if flags >= 4 {
            // `vec(expr)`: each element is a constant expression.
            for _ in 0..items {
                at = skip_const_expr(wasm, at, section_end)?;
            }
        } else {
            // `vec(funcidx)`: each element is one LEB128.
            for _ in 0..items {
                let (_, next) = leb128(wasm, at)?;
                at = next;
            }
        }
        if at > section_end {
            return None;
        }
        // The same rule the data section walk reaches by way of
        // `DataSectionEnd::ActiveUnevaluable`: an active segment is written at
        // instantiation whether or not this can work out where, so an offset it
        // cannot evaluate is treated as one that cannot fit. Skipping it left
        // the bounds check silently not running — the defect this walk exists
        // to prevent, in the sibling of the walk where it was just fixed.
        if active {
            let capacity = table_minimums.get(table_index).copied().unwrap_or(0);
            let end = match offset {
                Some(offset) => offset.checked_add(items as u64)?,
                None => u64::MAX,
            };
            if end > capacity && overflow.is_none() {
                overflow = Some((end, capacity));
            }
        }
    }
    Some(ElementSectionShape {
        overflow,
        items: declared,
    })
}

/// Skip one constant expression, returning the offset just past its `end`.
///
/// Scanning for the `0x0b` terminator instead of decoding is wrong, and quietly
/// so: `ref.func 11` encodes its immediate as `0x0b`, so a scan stops on the
/// operand and every following byte is read at the wrong offset. That desync
/// made the walk bail and silently drop the bounds check it exists to perform.
/// Only the instructions a constant expression may contain are decoded; an
/// unknown opcode returns `None`, which leaves the module to the engine rather
/// than to a guess.
fn skip_const_expr(wasm: &[u8], mut at: usize, limit: usize) -> Option<usize> {
    loop {
        if at > limit {
            return None;
        }
        let opcode = *wasm.get(at)?;
        at = at.checked_add(1)?;
        match opcode {
            // end
            0x0b => return Some(at),
            // i32.const / i64.const: one signed LEB128. `ref.null` (0xd0)
            // takes the same step: the format writes a heap type as a signed
            // LEB too. Every heap type this engine accepts fits one byte —
            // `funcref` is 0x70, `externref` 0x6f, and wasmi enables neither
            // function-references nor the GC proposal's concrete type
            // references, so a type index cannot appear here — which makes
            // reading the LEB identical to reading the byte today, and keeps
            // this walk in step if that ever stops being true.
            0x41 | 0x42 | 0xd0 => at = sleb128(wasm, at)?.1,
            // f32.const / f64.const: raw little-endian bits
            0x43 => at = at.checked_add(4)?,
            0x44 => at = at.checked_add(8)?,
            // ref.func / global.get: one unsigned LEB128
            0xd2 | 0x23 => at = leb128(wasm, at)?.1,
            // extended-const arithmetic: no immediates. wasmi enables the
            // proposal by default, so these appear in offsets the engine
            // accepts and this walk has to keep step with.
            0x6a..=0x6c | 0x7c..=0x7e => {}
            _ => return None,
        }
    }
}

/// The `i32` value a constant expression evaluates to, if this can tell.
///
/// Returns the offset past the expression either way, so a caller can keep
/// walking past an expression it cannot evaluate.
///
/// Reading only a bare `i32.const` was not enough, and the gap was a fail-open.
/// wasmi enables the extended-const proposal by default, so
/// `i32.const 65535; i32.const 2; i32.add` is a legal active data offset that
/// the engine compiles happily. Against the bare-form reader it was not merely
/// unevaluable: `skip_const_expr` did not know `i32.add` either, so the whole
/// data section's walk returned `None`, the caller dropped it, and `data_end`
/// stayed at zero. The bounds check did not run at all, and packaging approved
/// an artifact whose every request would then fail at instantiation — the one
/// outcome the load-time check exists to prevent.
///
/// So the arithmetic is evaluated. Everything else a constant expression may
/// contain is still stepped over and reported as unevaluable rather than
/// guessed at: `global.get` reads a global this walk has not tracked, and the
/// float and reference forms are not offsets at all.
fn const_i32(wasm: &[u8], at: usize, limit: usize) -> Option<(Option<u64>, usize)> {
    // The proposal's grammar is a fold over constants, so a handful of slots is
    // more than any real offset needs; a deeper expression is reported as
    // unevaluable rather than growing a stack for an untrusted module.
    let mut stack = [0i32; 16];
    let mut depth = 0usize;
    let mut evaluable = true;
    let mut at = at;
    loop {
        if at > limit {
            return None;
        }
        let opcode = *wasm.get(at)?;
        at = at.checked_add(1)?;
        match opcode {
            // end
            0x0b => break,
            // i32.const
            0x41 => {
                let (value, next) = sleb128(wasm, at)?;
                at = next;
                match (i32::try_from(value), stack.get_mut(depth)) {
                    (Ok(narrow), Some(slot)) => {
                        *slot = narrow;
                        depth = depth.saturating_add(1);
                    }
                    _ => evaluable = false,
                }
            }
            // i32.add / i32.sub / i32.mul, which wrap in wasm as they do here.
            0x6a..=0x6c => {
                // Folded through `checked_sub` and `get` rather than indexing:
                // this module is in the request-path panic-gate manifest, and
                // the depth these run against comes out of an untrusted module.
                let folded = depth.checked_sub(2).and_then(|left_at| {
                    let right = *stack.get(depth.checked_sub(1)?)?;
                    let left = *stack.get(left_at)?;
                    let value = match opcode {
                        0x6a => left.wrapping_add(right),
                        0x6b => left.wrapping_sub(right),
                        _ => left.wrapping_mul(right),
                    };
                    Some((left_at, value))
                });
                match folded {
                    Some((left_at, value)) => {
                        if let Some(slot) = stack.get_mut(left_at) {
                            *slot = value;
                        }
                        depth = left_at.saturating_add(1);
                    }
                    None => evaluable = false,
                }
            }
            // i64.const, and the i64 arithmetic: stepped over, not evaluated —
            // a memory or table offset is an `i32`, so an expression built from
            // these is not one this caller is asking about.
            0x42 => {
                at = sleb128(wasm, at)?.1;
                evaluable = false;
            }
            0x7c..=0x7e => evaluable = false,
            // f32.const / f64.const: raw little-endian bits, never an offset.
            0x43 => {
                at = at.checked_add(4)?;
                evaluable = false;
            }
            0x44 => {
                at = at.checked_add(8)?;
                evaluable = false;
            }
            // ref.null: one heap type byte.
            0xd0 => {
                at = at.checked_add(1)?;
                evaluable = false;
            }
            // ref.func / global.get: one unsigned LEB128.
            0xd2 | 0x23 => {
                at = leb128(wasm, at)?.1;
                evaluable = false;
            }
            _ => return None,
        }
    }
    if let (true, 1, Some(&result)) = (evaluable, depth, stack.first()) {
        // A wasm offset is a `u32`, so `i32.const -1` addresses 4294967295 —
        // past the end of any memory or table the sandbox will admit. Dropping
        // a negative as "unevaluable" was a fail-open: the one class of offset
        // that is *certainly* out of bounds was the one recorded as unknown.
        let unsigned = u64::from(u32::from_ne_bytes(result.to_ne_bytes()));
        return Some((Some(unsigned), at));
    }
    Some((None, at))
}

/// Read an unsigned LEB128 at `at`, returning the value and the next offset.
fn leb128(wasm: &[u8], at: usize) -> Option<(usize, usize)> {
    let mut value: usize = 0;
    let mut shift: u32 = 0;
    let mut cursor = at;
    loop {
        let byte = *wasm.get(cursor)?;
        cursor = cursor.checked_add(1)?;
        value = value.checked_add(usize::from(byte & 0x7f).checked_shl(shift)?)?;
        if byte & 0x80 == 0 {
            return Some((value, cursor));
        }
        shift = shift.checked_add(7)?;
        if shift > 63 {
            return None;
        }
    }
}

/// A signed LEB128, for the `i32.const` in a segment's offset expression.
fn sleb128(wasm: &[u8], at: usize) -> Option<(i64, usize)> {
    let mut value: i64 = 0;
    let mut shift: u32 = 0;
    let mut cursor = at;
    loop {
        let byte = *wasm.get(cursor)?;
        cursor = cursor.checked_add(1)?;
        value |= i64::from(byte & 0x7f).checked_shl(shift)?;
        shift = shift.checked_add(7)?;
        if byte & 0x80 == 0 {
            if shift < 64 && byte & 0x40 != 0 {
                value |= -1i64 << shift;
            }
            return Some((value, cursor));
        }
        if shift > 63 {
            return None;
        }
    }
}

/// The furthest byte the data section's *active* segments write to.
///
/// `None` when nothing in the section can be evaluated — a passive-only
/// section. The two `None`s are different answers and the caller treats them
/// differently: the outer one means the walk failed and the bounds check did
/// not happen, so the module is refused; the inner one means the walk
/// succeeded and there was no active write to measure — a passive-only
/// section copies nothing at instantiation — so there is nothing to refuse.
/// What a walk of the data section found.
///
/// Three answers, not two, and collapsing any pair of them has been a bug in
/// this file already: reading "nothing to measure" as "the check did not run"
/// refused a runnable module, and reading "the check did not run" as "nothing
/// to measure" admitted a segment past the end of memory.
enum DataSectionEnd {
    /// The walk failed — a malformed section, or an opcode a later proposal
    /// added that this does not know. The bounds check did not happen.
    Unreadable,
    /// The walk succeeded and found no active write to measure: every segment
    /// is passive, so nothing is copied at instantiation.
    NothingActive,
    /// The walk succeeded, and an active segment's offset could not be
    /// evaluated — an expression past the evaluator's stack, or one reading a
    /// global this walk has not tracked. The segment *is* copied in at
    /// instantiation; this simply cannot say where, which is the one thing the
    /// bounds check needs to know.
    ActiveUnevaluable,
    /// The furthest byte an active segment writes.
    Furthest(u64),
}

impl DataSectionEnd {
    /// What this contributes to the module's `data_end`.
    ///
    /// An unreadable section contributes `u64::MAX`, so an offset that cannot
    /// be read is treated as one that cannot fit — silently contributing
    /// nothing is how a segment past the end of memory got admitted.
    const fn contribution(&self) -> u64 {
        match *self {
            Self::Unreadable | Self::ActiveUnevaluable => u64::MAX,
            Self::NothingActive => 0,
            Self::Furthest(end) => end,
        }
    }
}

fn data_section_end(wasm: &[u8], start: usize, section_end: usize) -> DataSectionEnd {
    walk_data_section(wasm, start, section_end).unwrap_or(DataSectionEnd::Unreadable)
}

/// Walk the section, or `None` if it cannot be walked to the end.
///
/// The `?`s below are all the same answer — the walk did not finish, so the
/// bounds check did not happen — and [`data_section_end`] turns that into
/// [`DataSectionEnd::Unreadable`]. Kept separate so `?` can say it once rather
/// than every early return spelling out the enum.
fn walk_data_section(wasm: &[u8], start: usize, section_end: usize) -> Option<DataSectionEnd> {
    let (count, mut at) = leb128(wasm, start)?;
    let mut furthest: Option<u64> = None;
    // An active segment whose offset this cannot evaluate is not the same as no
    // active segment at all, and reading it as one was a bounds check that
    // silently did not run: the bytes are copied in regardless of whether this
    // could work out where.
    let mut active_unevaluable = false;
    for _ in 0..count {
        let (flags, next) = leb128(wasm, at)?;
        at = next;
        // Flag 1 is a passive segment: nothing is copied at instantiation,
        // so it cannot be out of bounds.
        let active = flags != 1;
        if flags == 2 {
            let (_memory_index, next) = leb128(wasm, at)?;
            at = next;
        }
        let mut offset: Option<u64> = None;
        if active {
            let (value, next) = const_i32(wasm, at, section_end)?;
            offset = value;
            at = next;
        }
        let (len, next) = leb128(wasm, at)?;
        at = next.checked_add(len)?;
        if at > section_end {
            return None;
        }
        match (active, offset) {
            (true, Some(offset)) => {
                let segment_end = offset.checked_add(len as u64)?;
                furthest = Some(furthest.map_or(segment_end, |f: u64| f.max(segment_end)));
            }
            (true, None) => active_unevaluable = true,
            (false, _) => {}
        }
    }
    if active_unevaluable {
        return Some(DataSectionEnd::ActiveUnevaluable);
    }
    Some(furthest.map_or(DataSectionEnd::NothingActive, DataSectionEnd::Furthest))
}

/// Section ids for the element and data sections.
const ELEMENT_SECTION: u8 = 9;
const DATA_SECTION: u8 = 11;
/// The table section, whose entries carry the initial sizes the limiter
/// will be asked to admit.
const TABLE_SECTION: u8 = 4;
/// `vec(memtype)` — every linear memory the module declares for itself.
const MEMORY_SECTION: u8 = 5;
/// The global section, whose entries each become per-instance storage.
const GLOBAL_SECTION: u8 = 6;
/// The import section: entries the compiler builds a representation for.
const IMPORT_SECTION: u8 = 2;
/// The function section: one type index per function the module defines.
const FUNCTION_SECTION: u8 = 3;
/// The start section: a function the engine runs at instantiation.
const START_SECTION: u8 = 8;
/// The code section, whose *size* is the instruction volume the compiler
/// walks — a thing no entry count reveals.
const CODE_SECTION: u8 = 10;
/// The custom section is the one whose payload is not a counted vector.
const CUSTOM_SECTION: u8 = 0;

/// The gates that prove an artifact can actually be instantiated.
///
/// Distinct from the ceilings in `refuse_unbounded_shape`, which bound what
/// loading may *cost*: these say the module can be built at all. Each one
/// stands for a defect where the artifact loaded clean, inspected clean, and
/// then failed every single request it was ever given.
const fn refuse_unrunnable_shape(
    shape: &ModuleShape,
    initial_bytes: u64,
) -> Result<(), SandboxLoadError> {
    // An active segment is copied in during instantiation, which is per
    // request, so one that does not fit the memory the module starts with
    // fails every instantiation the artifact is ever given. Said once here
    // rather than 502 for the life of the plugin.
    if shape.has_start {
        return Err(SandboxLoadError::StartSectionForbidden);
    }
    if shape.data_end > initial_bytes {
        return Err(SandboxLoadError::SegmentOutOfBounds {
            what: "linear memory",
            end: shape.data_end,
            capacity: initial_bytes,
        });
    }

    // And the same for a segment written into a table rather than into
    // memory: fixing one without the other would leave half the defect.
    if let Some((end, capacity)) = shape.element_overflow {
        return Err(SandboxLoadError::SegmentOutOfBounds {
            what: "table elements",
            end,
            capacity,
        });
    }
    Ok(())
}

/// Read a table section's declared count and the elements its tables start with.
///
/// `vec(tabletype)`, and a `tabletype` is a reftype byte then `limits`: a flag,
/// the minimum, and a maximum when the flag says so. Only the minimum matters
/// here — it is what the instance allocates before the guest runs.
///
/// Returns the declared count and the summed minimums, and writes the first
/// `MAX_TABLES` minimums into `minimums`.
fn table_section_shape(
    wasm: &[u8],
    after_size: usize,
    end: usize,
    already_counted: usize,
    minimums: &mut [u64; MAX_TABLES],
    seen: &mut usize,
) -> Option<(usize, u64)> {
    let (count, mut at) = leb128(wasm, after_size)?;
    // The same argument as the segment walk in the caller, and the same shape
    // its own comment describes one step further down: bounding the
    // *allocation* per entry left the *iteration* per entry unbounded, and an
    // artifact buys that at three bytes an entry. `MAX_TABLES` refuses on the
    // count alone, so past it there is nothing left for a walk to establish.
    let walked = if already_counted.saturating_add(count) <= MAX_TABLES {
        count
    } else {
        0
    };
    let mut elements = 0u64;
    for _ in 0..walked {
        at = at.checked_add(1)?; // reftype
        let flag = *wasm.get(at)?;
        at = at.checked_add(1)?;
        let (minimum, next) = leb128(wasm, at)?;
        at = next;
        elements = elements.saturating_add(minimum as u64);
        // Only the first `MAX_TABLES` can ever be admitted, so only those are
        // worth keeping. Pushing every declaration into a growing vector put an
        // unbounded per-entry allocation inside the very walk whose whole
        // purpose is to avoid one: a 64 MiB artifact of empty table
        // declarations would have expanded here, in the code meant to refuse it
        // before anything expanded.
        if let Some(slot) = minimums.get_mut(*seen) {
            *slot = minimum as u64;
            *seen = seen.saturating_add(1);
        }
        if flag == 0x01 {
            let (_, after_max) = leb128(wasm, at)?;
            at = after_max;
        }
        if at > end {
            return None;
        }
    }
    Some((count, elements))
}

fn module_shape(wasm: &[u8]) -> Option<ModuleShape> {
    let mut cursor = 8usize; // magic + version
    let mut sections = 0usize;
    let mut memory_count = 0usize;
    let mut segments = 0usize;
    let mut bytes = 0usize;
    let mut declared_entries = 0usize;
    let mut table_elements = 0u64;
    let mut table_count = 0usize;
    let mut global_count = 0usize;
    let mut global_bytes = 0usize;
    let mut code_bytes = 0usize;
    let mut has_start = false;
    let mut function_count = 0usize;
    let mut import_count = 0usize;
    let mut data_end = 0u64;
    let mut table_minimums = [0u64; MAX_TABLES];
    let mut table_count_seen = 0usize;
    let mut element_overflow: Option<(u64, u64)> = None;
    while cursor < wasm.len() {
        let id = *wasm.get(cursor)?;
        let (size, after_size) = leb128(wasm, cursor.checked_add(1)?)?;
        let end = after_size.checked_add(size)?;
        if end > wasm.len() {
            return None;
        }
        sections = sections.saturating_add(1);
        if sections > MAX_SECTIONS {
            // Stopping here rather than at the end is the whole point: past the
            // ceiling the module is refused whatever the remaining headers say,
            // so reading them is work an artifact chose for this process.
            break;
        }
        if id != CUSTOM_SECTION {
            let (count, _) = leb128(wasm, after_size)?;
            declared_entries = declared_entries.saturating_add(count);
        }
        if id == ELEMENT_SECTION || id == DATA_SECTION {
            let (count, _) = leb128(wasm, after_size)?;
            segments = segments.saturating_add(count);
            bytes = bytes.saturating_add(size);
        }
        // Past the ceiling the module is refused on this count alone, whatever the
        // per-segment walks below would find, so the walking is pure cost — and the
        // cost is the attack: a near-64 MiB module of two-byte passive segments is tens
        // of millions of iterations spent reaching the refusal whose purpose is to
        // bound that work.
        //
        // Skipping is safe because `refuse_unbounded_shape` rejects on `segments` by
        // itself: the refusal is unconditional and the walk's findings cannot matter.
        // It rejects on `init_bytes` by itself too, which is the other half — a single
        // element segment holding tens of millions of function indices keeps `segments`
        // at one and clears the count ceiling, so the count alone let the walk run over
        // every item on the way to a refusal the byte ceiling had already decided. Both
        // counters gate the walk because either one alone refuses the module.
        let within_segment_ceiling =
            segments <= MAX_INIT_SEGMENTS && bytes <= MAX_INIT_SECTION_BYTES;
        if id == ELEMENT_SECTION && within_segment_ceiling {
            // The table section precedes this one in a well-formed module, so
            // the minimums are known by the time the segments are read.
            if let Some(element) = element_section_shape(
                wasm,
                after_size,
                end,
                table_minimums.get(..table_count_seen).unwrap_or_default(),
            ) {
                element_overflow = element.overflow;
                declared_entries = declared_entries.saturating_add(element.items);
            }
        }
        if id == DATA_SECTION && within_segment_ceiling {
            // Active segments carry a constant offset and a length, and both
            // are needed to know whether the copy fits the memory the module
            // starts with. A segment whose offset is not a plain `i32.const`
            // (a `global.get`, say) is left alone: the shim exports no globals
            // for one to read, so such a module fails to link for its own
            // reasons rather than being mis-refused here.
            data_end = data_end.max(data_section_end(wasm, after_size, end).contribution());
        }
        // The sections whose leading count (or size) is the whole answer. The
        // rest need their entries walked and are handled above.
        let leading_count = || leb128(wasm, after_size).map(|(count, _)| count);
        match id {
            IMPORT_SECTION => import_count = import_count.saturating_add(leading_count()?),
            FUNCTION_SECTION => function_count = function_count.saturating_add(leading_count()?),
            GLOBAL_SECTION => {
                global_count = global_count.saturating_add(leading_count()?);
                // The initializers are an instruction stream, not data —
                // extended-const lets one global's expression run to
                // arbitrary length — so their bytes count toward the
                // instruction-volume ceiling the same way the code
                // section's do. Counted from the header: no walk needed.
                global_bytes = global_bytes.saturating_add(size);
            }
            MEMORY_SECTION => memory_count = memory_count.saturating_add(leading_count()?),
            CODE_SECTION => code_bytes = code_bytes.saturating_add(size),
            START_SECTION => has_start = true,
            _ => {}
        }
        if id == TABLE_SECTION {
            let (count, elements) = table_section_shape(
                wasm,
                after_size,
                end,
                table_count,
                &mut table_minimums,
                &mut table_count_seen,
            )?;
            table_count = table_count.saturating_add(count);
            table_elements = table_elements.saturating_add(elements);
        }
        cursor = end;
    }
    Some(ModuleShape {
        sections,
        memory_count,
        segments,
        init_bytes: bytes,
        declared_entries,
        import_count,
        function_count,
        has_start,
        element_overflow,
        data_end,
        code_bytes,
        global_count,
        global_bytes,
        table_count,
        table_elements,
    })
}

/// Refuse a module whose declared shape would cost more to *compile* than the
/// file's own size suggests.
///
/// `Module::new` is the first thing that touches an unaudited artifact's bytes,
/// and it builds an in-memory representation of every type, function, export
/// and global before any ceiling here has run. A legal 64 MiB file of tiny
/// declarations expands many times over in that representation, so the file
/// bound is not a bound on what compiling it costs. The section headers carry
/// the counts, so the shape is knowable *first* — one LEB128 per section, no
/// per-entry work — which is what makes refusing it cheap enough to do before
/// wasmi ever sees the bytes.
fn refuse_unbounded_shape(wasm: &[u8]) -> Result<ModuleShape, SandboxLoadError> {
    // Before the walk, because the walk is the cheap part. `check_module`
    // applies this to a module the container reader unpacked, but
    // `from_module` and `imports_of` are public and take the bytes directly,
    // so on that path nothing had imposed it. The counts below do not cover
    // the gap: one import whose module or field name is enormous is one
    // import, under every count ceiling here, and `Module::new` must
    // materialise that name before the import allowlist can refuse it.
    if wasm.len() > super::MAX_MODULE_BYTES {
        return Err(SandboxLoadError::ModuleTooLarge {
            found: wasm.len(),
            max: super::MAX_MODULE_BYTES,
        });
    }
    let Some(shape) = module_shape(wasm) else {
        return Err(SandboxLoadError::Wasm(
            "the module's section stream could not be walked".to_owned(),
        ));
    };
    // First, because it is the one ceiling the walk stops early for: past it
    // the shape is only partly read, so every count below is a floor rather
    // than a total, and refusing on one of those would name the wrong reason.
    if shape.sections > MAX_SECTIONS {
        return Err(SandboxLoadError::InstantiationTooExpensive {
            what: "sections",
            found: shape.sections,
            max: MAX_SECTIONS,
        });
    }
    // Before `Module::new`, with the rest of them. These two used to be
    // checked in `from_module` *after* compiling — so a module declaring half
    // a million empty segments, under the aggregate entry ceiling and thus
    // never refused for that, had a representation built for every one of them
    // before the ceiling that exists to prevent exactly that work ran. Moving
    // the per-segment walk earlier last round bounded the walking and left the
    // compiling; this is the other half.
    if shape.segments > MAX_INIT_SEGMENTS {
        return Err(SandboxLoadError::InstantiationTooExpensive {
            what: "data and element segments",
            found: shape.segments,
            max: MAX_INIT_SEGMENTS,
        });
    }
    if shape.init_bytes > MAX_INIT_SECTION_BYTES {
        return Err(SandboxLoadError::InstantiationTooExpensive {
            what: "bytes of data and element sections",
            found: shape.init_bytes,
            max: MAX_INIT_SECTION_BYTES,
        });
    }
    if shape.code_bytes > MAX_CODE_BYTES {
        return Err(SandboxLoadError::InstantiationTooExpensive {
            what: "code section bytes",
            found: shape.code_bytes,
            max: MAX_CODE_BYTES,
        });
    }
    // The global section's initializers are an instruction stream too —
    // extended-const lets one global's expression run to arbitrary length —
    // so their bytes share the code section's instruction-volume ceiling.
    // The entry count never saw this: one global sits under `MAX_GLOBALS`
    // however long its initializer is, and `Module::new` would build a
    // representation of every one of those instructions. The sum keeps the
    // two numbers separately recorded on `ModuleShape`, so the refusal can
    // name the sections that pushed the module over rather than
    // misattributing it to the code section alone.
    //
    // Audit of the other instruction-carrying sections, stated explicitly
    // rather than assumed: element and data section offset and item
    // expressions already sit inside `init_bytes`, which has its own
    // `MAX_INIT_SECTION_BYTES` ceiling above. The global section was the
    // only one the scanner counted by entries alone.
    let instruction_bytes = shape.code_bytes.saturating_add(shape.global_bytes);
    if instruction_bytes > MAX_CODE_BYTES {
        return Err(SandboxLoadError::InstantiationTooExpensive {
            what: "code and global section bytes",
            found: instruction_bytes,
            max: MAX_CODE_BYTES,
        });
    }
    if shape.import_count > MAX_IMPORTS {
        return Err(SandboxLoadError::InstantiationTooExpensive {
            what: "imports",
            found: shape.import_count,
            max: MAX_IMPORTS,
        });
    }
    if shape.function_count > MAX_FUNCTIONS {
        return Err(SandboxLoadError::InstantiationTooExpensive {
            what: "functions",
            found: shape.function_count,
            max: MAX_FUNCTIONS,
        });
    }
    if shape.global_count > MAX_GLOBALS {
        return Err(SandboxLoadError::InstantiationTooExpensive {
            what: "globals",
            found: shape.global_count,
            max: MAX_GLOBALS,
        });
    }
    // The per-instance stores the limiter guards. These say the module can be built at
    // all, so they read as runnability rules, but they are also cost ceilings, and that
    // is what decides where they live. A module declaring hundreds of thousands of empty
    // memories or tables sits under `MAX_DECLARED_ENTRIES` and is refused by these
    // anyway, so compiling it first buys a representation of every declaration on the
    // way to a verdict that never depended on one. Checked after that compile, they were
    // the right answer at the wrong time. All three move together: `table_elements` is
    // the same argument as the other two — tables already over the ceiling at rest are
    // refused whatever `Module::new` would say — and leaving it behind would be the
    // half-fix this file warns about elsewhere.
    if shape.memory_count > MAX_MEMORIES {
        return Err(SandboxLoadError::InstantiationTooExpensive {
            what: "linear memories",
            found: shape.memory_count,
            max: MAX_MEMORIES,
        });
    }
    if shape.table_count > MAX_TABLES {
        return Err(SandboxLoadError::InstantiationTooExpensive {
            what: "tables",
            found: shape.table_count,
            max: MAX_TABLES,
        });
    }
    if shape.table_elements > u64::from(MAX_TABLE_ELEMENTS) {
        return Err(SandboxLoadError::InstantiationTooExpensive {
            what: "initial table elements",
            found: usize::try_from(shape.table_elements).unwrap_or(usize::MAX),
            max: MAX_TABLE_ELEMENTS as usize,
        });
    }
    if shape.declared_entries > MAX_DECLARED_ENTRIES {
        return Err(SandboxLoadError::InstantiationTooExpensive {
            what: "declared section entries",
            found: shape.declared_entries,
            max: MAX_DECLARED_ENTRIES,
        });
    }
    Ok(shape)
}

/// Imports the shim will not satisfy — by name **or** by type — as denials.
///
/// Checking the type here rather than letting `Linker::instantiate` discover it
/// is what keeps `autumn plugin package` honest: a module importing an
/// allowlisted name with the wrong signature would otherwise pass packaging and
/// inspection, then fail on every request as a gateway error nobody can explain
/// from the outside.
fn forbidden_imports(module: &Module) -> Vec<CapabilityDenial> {
    module
        .imports()
        .filter_map(|import| {
            let operation = import_operation(import.module(), import.name());
            if import.module() != WASI {
                return Some((operation, "the sandbox defines no such host module"));
            }
            let Some(declared) = import.ty().func() else {
                return Some((
                    operation,
                    "the sandbox provides host functions only, not memories, tables or globals",
                ));
            };
            let Some((params, results)) = shim_signature(import.name()) else {
                return Some((operation, "the sandbox defines no such host function"));
            };
            match signature_type(params, results) {
                Some(expected) if expected == *declared => None,
                _ => Some((
                    operation,
                    "the sandbox defines this host function with a different signature, so it \
                     could never link",
                )),
            }
        })
        .map(|(operation, why)| CapabilityDenial {
            capability: DeniedCapability::UnknownImport,
            operation,
            detail: format!("{why}, so the plugin is refused before it runs"),
        })
        .take(MAX_DENIALS)
        .collect()
}

/// A guest blew its output budget. Carried as a host error so the trap it
/// causes can be told apart from any other trap.
#[derive(Debug)]
struct OutputBudgetExhausted;

/// The guest answered, so there is nothing left for it to do. Carried as a host
/// error to unwind the interpreter at the frame rather than letting a guest
/// hold a permit and a blocking worker for its whole budget after the exchange
/// is over.
#[derive(Debug)]
struct AnswerComplete;

impl fmt::Display for AnswerComplete {
    fn fmt(&self, f: &mut fmt::Formatter<'_>) -> fmt::Result {
        f.write_str("the plugin answered")
    }
}

impl wasmi::core::HostError for AnswerComplete {}

impl fmt::Display for OutputBudgetExhausted {
    fn fmt(&self, f: &mut fmt::Formatter<'_>) -> fmt::Result {
        f.write_str("the plugin exceeded its response ceiling")
    }
}

impl wasmi::core::HostError for OutputBudgetExhausted {}

// ── Host state ───────────────────────────────────────────────────────────

/// Which dialogue a store is running.
///
/// The two differ only in which host frame goes in and which guest frame is a
/// legal answer, which is exactly why they are one enum rather than two code
/// paths: everything else — the shim, the fuel, the capability channel, the
/// ledger — is shared, and a second path would be a second place for a bound to
/// be missing.
#[derive(Debug, Clone, Copy, PartialEq, Eq)]
enum Exchange {
    /// A `request` frame in, a `response` frame out.
    Request,
    /// A `render` frame in, a `fragment` frame out.
    Render,
}

/// The terminal frame a guest produced.
#[derive(Debug, Clone)]
enum GuestAnswer {
    /// The answer to a request.
    Response(SandboxResponse),
    /// The answer to a render slot.
    Fragment(Vec<super::capability::FragmentNode>),
}

/// The guest's memory ceiling, and the evidence that it was applied.
#[derive(Debug)]
struct MemoryLimiter {
    max: usize,
    peak: usize,
    /// Counted apart from `table_refusals`, because the two are refused by
    /// *different ceilings* and an operator reading the ledger is trying to
    /// learn which one the guest hit. One shared counter reported every table
    /// refusal as `memory.grow` over the manifest's byte ceiling — evidence
    /// that is not merely vague but wrong, naming a limit that was never
    /// applied.
    memory_refusals: usize,
    table_refusals: usize,
    /// Elements held across every table of this instance, so the ceiling is on
    /// the instance rather than on each table separately.
    table_elements: u32,
}

impl wasmi::ResourceLimiter for MemoryLimiter {
    fn memory_growing(
        &mut self,
        _current: usize,
        desired: usize,
        _maximum: Option<usize>,
    ) -> Result<bool, wasmi::errors::MemoryError> {
        if desired > self.max {
            self.memory_refusals = self.memory_refusals.saturating_add(1);
            // `Ok(false)` makes the guest's `memory.grow` return -1, which is a
            // legal outcome a well-written allocator handles. Returning `Err`
            // would trap instead — a harsher answer that tells a hostile guest
            // less and an honest one nothing useful.
            return Ok(false);
        }
        self.peak = self.peak.max(desired);
        Ok(true)
    }

    fn table_growing(
        &mut self,
        current: u32,
        desired: u32,
        _maximum: Option<u32>,
    ) -> Result<bool, wasmi::errors::TableError> {
        // Across the instance, not per table: four tables each under a per-table
        // ceiling would still be four times that ceiling of host storage, which
        // is exactly the accounting hole this closes.
        let total = self
            .table_elements
            .saturating_sub(current)
            .saturating_add(desired);
        if total > MAX_TABLE_ELEMENTS {
            self.table_refusals = self.table_refusals.saturating_add(1);
            return Ok(false);
        }
        self.table_elements = total;
        Ok(true)
    }

    fn instances(&self) -> usize {
        1
    }

    fn tables(&self) -> usize {
        MAX_TABLES
    }

    fn memories(&self) -> usize {
        1
    }
}

struct HostState {
    /// The plugin's name, so a denial line names who was refused. Carried here
    /// rather than logged by the caller so the refusal is logged exactly once,
    /// at the point it happens, whoever is driving the host.
    plugin: String,
    /// Bytes of the request frame the guest has not read yet.
    stdin: VecDeque<u8>,
    /// The partial stdout line being accumulated.
    stdout_line: Vec<u8>,
    /// Everything the guest wrote to stderr, bounded.
    stderr: Vec<u8>,
    /// The first terminal frame the guest produced.
    answer: Option<Result<GuestAnswer, SandboxFailure>>,
    /// Which dialogue this store is running: a request, or a render slot.
    ///
    /// Carried in the state rather than inferred from the frame, because it
    /// decides which *answer* is legal. A guest that answers a render with an
    /// HTTP response is not producing a page fragment, and without this the
    /// host would have to decide what it meant.
    exchange: Exchange,
    /// Capabilities, grants, quotas and the ledger for this request.
    runtime: crate::plugin_sandbox::capability::CapabilityRuntime,
    /// Fuel owed for capability work done while the guest was inside a
    /// `fd_write`, where the `Caller` needed to charge it is not in scope.
    pending_charge: u64,
    /// Calls parsed out of a completed stdout line and **not yet dispatched**.
    ///
    /// Queued rather than serviced where they are parsed, so the shim can take
    /// each call's fixed fuel charge *before* it reaches a backend. Charging
    /// afterwards let a budget that could pay for the `fd_write` copy but not
    /// for the call itself perform a KV write, a job enqueue or an outbound
    /// POST and *then* end the request as `FuelExhausted` — an effect that
    /// happened, on a request whose caller was told it did not, which a retry
    /// then does again.
    ///
    /// Bounded by the chunk that produced it: one `fd_write` copies at most
    /// `HOST_IO_CHUNK_BYTES`, and every queued call was parsed out of those
    /// bytes.
    pending_calls: VecDeque<super::capability::CapabilityCall>,
    /// Bytes of capability replies **currently resident** in `stdin`.
    ///
    /// Counted apart from `stdin.len()`, which also holds the unread tail of
    /// the *request* frame. A manifest may declare a 64 MiB body ceiling, so a
    /// guest that makes its first call before reading its request would sit
    /// over any reply ceiling measured against the whole queue — every
    /// capability call refused, for a reason that has nothing to do with
    /// replies. The request frame is budgeted separately, at
    /// `4 × max_request_body_bytes` in `request_footprint_bytes`; this counts
    /// only what the capability channel added, and only while it is still
    /// there: `take_stdin` gives it back as the guest reads.
    queued_replies: usize,
    /// Whether a call that commits has reached its backend.
    committed: bool,
    /// Everything the guest reached for and did not get.
    denials: Vec<CapabilityDenial>,
    /// Request-seeded PRNG state, so `random_get` is deterministic without
    /// being a published constant.
    random_state: u64,
    limiter: MemoryLimiter,
    limits: ResourceLimits,
}

impl HostState {
    /// The starting point the request is mixed into. Arbitrary but fixed.
    const RANDOM_SEED: u64 = 0x2545_F491_4F6C_DD1D;

    /// Derive this request's PRNG seed from the request itself.
    ///
    /// A single fixed seed would make `random_get` a *constant* across every
    /// request to every deployment of an artifact — anyone holding the same
    /// bytes could predict every value a guest ever derived from it. Mixing the
    /// request in keeps the property that actually matters (the same request
    /// twice produces the same bytes, so an author can reproduce a bug from the
    /// request alone) without publishing the stream.
    ///
    /// This is **not** cryptographic entropy, and the sandbox offers none: a
    /// guest holds no capability that would make a secret useful to it.
    fn seed_from(frame: &[u8]) -> u64 {
        let mut seed = Self::RANDOM_SEED;
        for byte in frame {
            seed = seed.rotate_left(7) ^ u64::from(*byte);
            seed = seed.wrapping_mul(0x0000_0100_0000_01B3);
        }
        seed
    }

    fn new(
        plugin: String,
        limits: ResourceLimits,
        frame: &[u8],
        exchange: Exchange,
        runtime: crate::plugin_sandbox::capability::CapabilityRuntime,
    ) -> Self {
        Self {
            plugin,
            stdin: VecDeque::new(),
            stdout_line: Vec::new(),
            stderr: Vec::new(),
            answer: None,
            exchange,
            runtime,
            pending_charge: 0,
            pending_calls: VecDeque::new(),
            queued_replies: 0,
            committed: false,
            denials: Vec::new(),
            random_state: Self::seed_from(frame),
            limiter: MemoryLimiter {
                max: limits.memory_bytes,
                peak: 0,
                memory_refusals: 0,
                table_refusals: 0,
                table_elements: 0,
            },
            limits,
        }
    }

    /// Record one refusal, deduplicated by `(capability, operation)`.
    ///
    /// Deduplication is what keeps a guest that calls `path_open` in a loop
    /// from turning the ledger into its own memory-exhaustion channel, while
    /// still recording the fact that it tried.
    fn deny(&mut self, capability: DeniedCapability, operation: &str, detail: &str) {
        let already = self
            .denials
            .iter()
            .any(|denial| denial.capability == capability && denial.operation == operation);
        if already || self.denials.len() >= MAX_DENIALS {
            return;
        }
        let denial = CapabilityDenial {
            capability,
            operation: operation.to_owned(),
            detail: detail.to_owned(),
        };
        tracing::warn!(
            plugin = self.plugin,
            capability = capability.as_str(),
            operation,
            detail,
            "sandboxed plugin was denied a capability it reached for"
        );
        self.denials.push(denial);
    }

    /// Handle one complete line the guest wrote to stdout.
    ///
    /// Most frames end the exchange. A `call` frame does not: it is serviced
    /// and answered in the guest's stdin, and the guest carries on. That is the
    /// whole of the capability channel — see
    /// [`GuestFrame::Call`](super::wire::GuestFrame::Call).
    fn on_guest_line(&mut self, line: &str) {
        if self.answer.is_some() {
            // Already answered. Anything after is a guest that does not respect
            // the protocol; ignoring it is what stops a second frame from
            // overwriting a good first one.
            return;
        }
        self.answer = Some(match from_guest_line(line) {
            Ok(GuestFrame::Call(call)) => {
                // Queued, not serviced: the fixed charge is the shim's to take
                // first. See `pending_calls`.
                self.pending_calls.push_back(call);
                return;
            }
            Ok(GuestFrame::Response(response)) => match self.exchange {
                Exchange::Request => Ok(GuestAnswer::Response(response)),
                Exchange::Render => Err(SandboxFailure::MalformedFrame(
                    "a render slot is answered with a `fragment` frame, not a `response`"
                        .to_owned(),
                )),
            },
            Ok(GuestFrame::Fragment { nodes }) => match self.exchange {
                Exchange::Render => Ok(GuestAnswer::Fragment(nodes)),
                Exchange::Request => Err(SandboxFailure::MalformedFrame(
                    "a request is answered with a `response` frame, not a `fragment`".to_owned(),
                )),
            },
            Ok(GuestFrame::Error { detail }) => {
                Err(SandboxFailure::GuestError(guest_text(&detail)))
            }
            Err(err) => Err(SandboxFailure::MalformedFrame(guest_text(&err.to_string()))),
        });
    }

    /// Answer one capability call by appending its result to the guest's stdin.
    ///
    /// Never fails the request over the *content* of a call: everything a guest
    /// can get wrong comes back as a denial it can read. The two exits that do
    /// end the request are the host's own encoder failing, and a guest that has
    /// stopped reading its replies — see [`MAX_QUEUED_REPLY_BYTES`].
    fn service(&mut self, call: &super::capability::CapabilityCall, fuel_left: u64) {
        // The room the reply must fit, decided *before* the call runs. A reply
        // cannot be measured until its call has committed, and a request that
        // fails over a committed write is retried by the caller. So a call is
        // dispatched only when the worst-case reply fits the unread-reply queue
        // and the fuel left covers pricing it plus a fixed finishing allowance
        // for the guest. A call that commits also keeps the fuel to read that
        // reply (#2523). A call that does not fit is answered with a denial the
        // guest can read, and nothing runs.
        let queue_room = MAX_QUEUED_REPLY_BYTES.saturating_sub(self.queued_replies);
        // A quarter of the budget at most, so a small budget still serves calls.
        let allowance = FINISH_ALLOWANCE_FUEL.min(self.limits.fuel / 4);
        // After a write has run, any call can still fail the request, so every
        // call keeps the read fuel. The guest must read its unread replies too.
        let keep_read = self.committed || call.commits();
        let unread = u64::try_from(self.queued_replies).unwrap_or(u64::MAX);
        let fuel_covers = |reserve: usize| {
            let reserve = u64::try_from(reserve).unwrap_or(u64::MAX);
            let read = if keep_read {
                reserve
                    .saturating_add(unread)
                    .saturating_mul(GUEST_READ_FUEL_PER_BYTE)
            } else {
                0
            };
            fuel_left
                >= allowance
                    .saturating_add(read)
                    .saturating_add(reserve.div_ceil(BYTES_PER_FUEL))
        };
        let result = self.runtime.dispatch_checked(call, queue_room, fuel_covers);
        if call.commits() && reached_backend(&result) {
            self.committed = true;
        }
        let line = match to_line(&HostFrame::CallResult(result)) {
            Ok(line) => line,
            Err(err) => {
                // The host could not encode its own answer. Reported as a
                // plugin-prefix failure rather than propagating, exactly as
                // `run` treats the same failure on the request frame.
                self.answer = Some(Err(SandboxFailure::Instantiation(guest_text(
                    &err.to_string(),
                ))));
                return;
            }
        };
        if self.queued_replies.saturating_add(line.len()) > MAX_QUEUED_REPLY_BYTES {
            self.answer = Some(Err(SandboxFailure::MalformedFrame(format!(
                "the guest has left over {MAX_QUEUED_REPLY_BYTES} bytes of capability replies \
                 unread; it must read each answer before making the next call"
            ))));
            return;
        }
        // Only the per-byte part. The fixed part — which prices the dispatch: a
        // lock, a lookup, a frame built — is taken by the shim *before* this
        // runs, so a budget that cannot cover it never reaches a backend. What
        // is left is the reply the host has just materialised, priced at the
        // same rate every other host-side copy pays; it cannot be charged
        // earlier because it cannot be measured before the call is answered.
        self.pending_charge = self
            .pending_charge
            .saturating_add(u64::try_from(line.len()).unwrap_or(u64::MAX) / BYTES_PER_FUEL);
        self.queued_replies = self.queued_replies.saturating_add(line.len());
        self.stdin.extend(line.as_bytes());
    }

    /// Dispatch the next queued call, if any.
    ///
    /// Returns `false` when the queue is empty. The caller charges
    /// [`CAPABILITY_CALL_FUEL`] before each `true` step, which is the whole
    /// point of the queue: see [`pending_calls`](Self::pending_calls).
    fn service_next(&mut self, fuel_left: u64) -> bool {
        let Some(call) = self.pending_calls.pop_front() else {
            return false;
        };
        self.service(&call, fuel_left);
        true
    }

    /// Whether a parsed call is waiting for its fixed charge.
    fn has_pending_call(&self) -> bool {
        !self.pending_calls.is_empty()
    }

    /// Take the fuel owed for capability work, leaving nothing owed.
    const fn take_pending_charge(&mut self) -> u64 {
        std::mem::replace(&mut self.pending_charge, 0)
    }

    /// Buffer stdout bytes, consuming each completed NDJSON line.
    ///
    /// Returns `false` — the guest's write must fail — once the pending line
    /// outgrows what a legal response could possibly be.
    #[must_use]
    fn write_stdout(&mut self, bytes: &[u8]) -> bool {
        // Base64 inflates a body by 4/3, and the frame carries headers and JSON
        // punctuation around it, so the pending-line budget is the declared
        // response ceiling doubled plus slack. A frame that cannot fit under
        // this could never pass `check_size` anyway.
        let budget = self
            .limits
            .max_response_bytes
            .saturating_mul(2)
            .saturating_add(4096);
        for byte in bytes {
            if *byte == b'\n' {
                let line = std::mem::take(&mut self.stdout_line);
                // Strictly, not lossily. `from_utf8_lossy` turns each invalid
                // byte into a three-byte replacement character while the
                // original is still alive, so a guest that filled its whole
                // stdout budget with invalid bytes would make the host hold
                // four times that budget — memory no manifest accounted for.
                // A frame is JSON, so it is UTF-8 or it is not a frame.
                match String::from_utf8(line) {
                    Ok(line) => self.on_guest_line(&line),
                    Err(_) => {
                        self.answer = Some(Err(SandboxFailure::MalformedFrame(
                            "the frame is not valid UTF-8".to_owned(),
                        )));
                    }
                }
            } else {
                if self.stdout_line.len() >= budget {
                    return false;
                }
                // Grow geometrically, but never past the budget. Left to
                // itself `Vec::push` doubles, taking a buffer whose length
                // stops at `budget` to a capacity of the next power of two
                // above it — for the default ceiling, 16 MiB of allocation
                // behind an 8 MiB bound. `request_footprint_bytes` reserves
                // `2 × max_response_bytes` for this line and validates the
                // concurrency product against that reservation, so the slack
                // `Vec` takes for its own amortisation is host memory nothing
                // accounted for, at every concurrent request at once. Clamping
                // the reservation keeps the doubling, and the amortised push
                // with it, right up to the point where the next one would
                // overrun the bound. The 64-byte floor is below the smallest
                // budget this can compute (`saturating_add(4096)`), so it
                // covers only the first few pushes.
                if self.stdout_line.len() == self.stdout_line.capacity() {
                    let want = self
                        .stdout_line
                        .capacity()
                        .saturating_mul(2)
                        .clamp(64, budget);
                    self.stdout_line
                        .reserve_exact(want.saturating_sub(self.stdout_line.len()));
                }
                self.stdout_line.push(*byte);
            }
        }
        true
    }

    /// Buffer stderr bytes, silently dropping everything past the budget — a
    /// guest dying loudly should not be punished for being chatty.
    fn write_stderr(&mut self, bytes: &[u8]) {
        let room = STDERR_BUDGET_BYTES.saturating_sub(self.stderr.len());
        if let Some(kept) = bytes.get(..bytes.len().min(room)) {
            self.stderr.extend_from_slice(kept);
        }
    }

    /// Whether every further stderr byte would be discarded.
    const fn stderr_is_full(&self) -> bool {
        self.stderr.len() >= STDERR_BUDGET_BYTES
    }

    fn stderr_excerpt(&self) -> String {
        // Bounded and neutralised: truncation stops a flood, but a forged record fits
        // comfortably inside 512 characters.
        //
        // Decoded a chunk at a time rather than through `String::from_utf8_lossy`, for
        // the same reason the stdout frame is decoded strictly one function up. Lossy
        // decoding writes a three-byte replacement character per invalid subpart, so a
        // guest that fills its 64 KiB stderr budget with invalid bytes materialises
        // 192 KiB beside the still-live buffer, all to keep 512 characters of it. The
        // manifest footprint budgets the buffer, not that expansion, so it was 128 KiB
        // per concurrent request outside the ceiling. Streaming keeps the peak at the
        // excerpt itself.
        let mut chars = lossy_chars(&self.stderr).skip_while(|ch| ch.is_whitespace());
        let mut kept: String = chars.by_ref().take(STDERR_EXCERPT).collect();
        let cut = chars.next().is_some();
        if !cut {
            // The window reached the end of the buffer, so trailing whitespace
            // in it is the buffer's own and `trim` would have taken it. When
            // more bytes follow, it is interior whitespace and `trim` would
            // not have — truncating after the trim is what the two cases
            // distinguish.
            while kept.ends_with(char::is_whitespace) {
                kept.pop();
            }
        }
        // `guest_text` marks its own truncation, but only on meeting a 513th
        // character — and this hands it 512 at most, so the marker could never
        // fire here and a cut excerpt read as though the guest had stopped
        // there. The suffix is usually the interesting part of a failure, so
        // saying it was cut matters more than the characters the marker costs.
        // Appended after escaping: inside `kept` it would be escaped as guest
        // text, and would count against the bound it is reporting.
        let mut excerpt = guest_text(&kept);
        if cut {
            excerpt.push_str(TRUNCATION_MARKER);
        }
        excerpt
    }

    /// `SplitMix64`: tiny, deterministic, and good enough for a shim whose
    /// entire job is to be reproducible.
    const fn next_random_byte(&mut self) -> u8 {
        self.random_state = self.random_state.wrapping_add(0x9E37_79B9_7F4A_7C15);
        let mut z = self.random_state;
        z = (z ^ (z >> 30)).wrapping_mul(0xBF58_476D_1CE4_E5B9);
        z = (z ^ (z >> 27)).wrapping_mul(0x94D0_49BB_1331_11EB);
        #[allow(
            clippy::cast_possible_truncation,
            reason = "taking the low byte of the mixed state is the point"
        )]
        {
            (z ^ (z >> 31)) as u8
        }
    }

    /// Pop up to `len` bytes of the pending request frame.
    /// Hand the guest up to `len` bytes of its request frame.
    ///
    /// Bounded per call at `HOST_IO_CHUNK_BYTES`, the same scratch ceiling
    /// `fd_write` and `random_get` hold themselves to and the one
    /// [`FIXED_HOST_BUFFER_BYTES`] budgets. The length is the guest's to choose
    /// — it is an iovec — and the copy comes out of a queue that keeps its
    /// whole allocation as it drains, so one iovec spanning the frame put a
    /// second copy of it beside the first. A frame is the request's metadata
    /// and a base64 body with JSON escaping over both, which makes that copy
    /// several times the raw request and none of it was in the footprint
    /// `max_concurrency` is validated against.
    ///
    /// Returning less than was asked for is what this call already promises:
    /// the caller breaks on a short chunk and reports the count, and the queue
    /// running dry short-reads today, so a guest that does not loop is already
    /// broken.
    fn take_stdin(&mut self, len: usize) -> Vec<u8> {
        let len = len.min(HOST_IO_CHUNK_BYTES);
        // The queue is the request frame followed by whatever capability
        // replies have been appended, drained front to back — so bytes come out
        // of the request frame until it is exhausted and only then out of the
        // replies. Computing the boundary before the drain is what lets the
        // reply budget be given back exactly as it is consumed.
        let head = self.stdin.len().saturating_sub(self.queued_replies);
        let mut out = Vec::with_capacity(len.min(self.stdin.len()));
        while out.len() < len {
            match self.stdin.pop_front() {
                Some(byte) => out.push(byte),
                None => break,
            }
        }
        let from_replies = out.len().saturating_sub(head);
        self.queued_replies = self.queued_replies.saturating_sub(from_replies);
        out
    }
}

// ── The WASI shim ────────────────────────────────────────────────────────

type Shim = Linker<HostState>;

fn memory_of(caller: &Caller<'_, HostState>) -> Option<wasmi::Memory> {
    caller
        .get_export("memory")
        .and_then(wasmi::Extern::into_memory)
}

fn read_u32(caller: &Caller<'_, HostState>, memory: wasmi::Memory, at: usize) -> Option<u32> {
    let mut buffer = [0u8; 4];
    memory.read(caller, at, &mut buffer).ok()?;
    Some(u32::from_le_bytes(buffer))
}

fn write_u32(
    caller: &mut Caller<'_, HostState>,
    memory: wasmi::Memory,
    at: usize,
    value: u32,
) -> Option<()> {
    memory.write(caller, at, &value.to_le_bytes()).ok()
}

/// Read one `iovec` at `index` of the array starting at `base`.
fn iovec(
    caller: &Caller<'_, HostState>,
    memory: wasmi::Memory,
    base: i32,
    index: i32,
) -> Option<(usize, usize)> {
    let base = usize::try_from(base).ok()?;
    let offset = usize::try_from(index).ok()?.checked_mul(IOVEC_SIZE)?;
    let at = base.checked_add(offset)?;
    let pointer = read_u32(caller, memory, at)?;
    let length = read_u32(caller, memory, at.checked_add(4)?)?;
    Some((
        usize::try_from(pointer).ok()?,
        usize::try_from(length).ok()?,
    ))
}

/// The WASI functions the shim implements itself, rather than refusing.
///
/// Name, parameter signature, and result signature — `i` for `i32`, `l` for
/// `i64`, empty for none. The signatures are here so a module can be
/// **type**-checked at load and not merely name-checked: an import whose type
/// disagrees with the shim links nowhere, and finding that out per request (as
/// a 502 the operator cannot explain) instead of at `autumn plugin package` is
/// exactly the failure this lane exists to move earlier.
const SERVED_IMPORTS: &[(&str, &str, &str)] = &[
    ("args_get", "ii", "i"),
    ("args_sizes_get", "ii", "i"),
    ("clock_res_get", "ii", "i"),
    ("clock_time_get", "ili", "i"),
    ("environ_get", "ii", "i"),
    ("environ_sizes_get", "ii", "i"),
    ("fd_close", "i", "i"),
    ("fd_fdstat_get", "ii", "i"),
    ("fd_read", "iiii", "i"),
    ("fd_seek", "ilii", "i"),
    ("fd_tell", "ii", "i"),
    ("fd_write", "iiii", "i"),
    ("proc_exit", "i", ""),
    ("random_get", "ii", "i"),
    ("sched_yield", "", "i"),
];

/// The WASI functions the shim answers with a refusal: name, the capability
/// class it belongs to, the detail an operator reads, and its signature.
///
/// The signature is `i` for `i32` and `l` for `i64`, in WASI order, and every
/// one of these returns an `errno`. `wasmi` matches host functions by
/// signature, so a wrong descriptor here would make an honest guest fail to
/// instantiate rather than fail to escape — which is why
/// `every_refusal_stub_matches_the_wasi_signature_it_stands_in_for` builds a
/// module importing all of them and proves they link.
const DENIED_IMPORTS: &[(&str, DeniedCapability, &str, &str)] = &[
    // There is no filesystem.
    ("fd_advise", DeniedCapability::Filesystem, FS_DETAIL, "illi"),
    (
        "fd_allocate",
        DeniedCapability::Filesystem,
        FS_DETAIL,
        "ill",
    ),
    ("fd_datasync", DeniedCapability::Filesystem, FS_DETAIL, "i"),
    (
        "fd_fdstat_set_flags",
        DeniedCapability::Filesystem,
        FS_DETAIL,
        "ii",
    ),
    (
        "fd_fdstat_set_rights",
        DeniedCapability::Filesystem,
        FS_DETAIL,
        "ill",
    ),
    (
        "fd_filestat_get",
        DeniedCapability::Filesystem,
        FS_DETAIL,
        "ii",
    ),
    (
        "fd_filestat_set_size",
        DeniedCapability::Filesystem,
        FS_DETAIL,
        "il",
    ),
    (
        "fd_filestat_set_times",
        DeniedCapability::Filesystem,
        FS_DETAIL,
        "illi",
    ),
    ("fd_pread", DeniedCapability::Filesystem, FS_DETAIL, "iiili"),
    (
        "fd_prestat_dir_name",
        DeniedCapability::Filesystem,
        FS_DETAIL,
        "iii",
    ),
    (
        "fd_prestat_get",
        DeniedCapability::Filesystem,
        FS_DETAIL,
        "ii",
    ),
    (
        "fd_pwrite",
        DeniedCapability::Filesystem,
        FS_DETAIL,
        "iiili",
    ),
    (
        "fd_readdir",
        DeniedCapability::Filesystem,
        FS_DETAIL,
        "iiili",
    ),
    ("fd_renumber", DeniedCapability::Filesystem, FS_DETAIL, "ii"),
    ("fd_sync", DeniedCapability::Filesystem, FS_DETAIL, "i"),
    (
        "path_create_directory",
        DeniedCapability::Filesystem,
        FS_DETAIL,
        "iii",
    ),
    (
        "path_filestat_get",
        DeniedCapability::Filesystem,
        FS_DETAIL,
        "iiiii",
    ),
    (
        "path_filestat_set_times",
        DeniedCapability::Filesystem,
        FS_DETAIL,
        "iiiilli",
    ),
    (
        "path_link",
        DeniedCapability::Filesystem,
        FS_DETAIL,
        "iiiiiii",
    ),
    (
        "path_open",
        DeniedCapability::Filesystem,
        FS_DETAIL,
        "iiiiillii",
    ),
    (
        "path_readlink",
        DeniedCapability::Filesystem,
        FS_DETAIL,
        "iiiiii",
    ),
    (
        "path_remove_directory",
        DeniedCapability::Filesystem,
        FS_DETAIL,
        "iii",
    ),
    (
        "path_rename",
        DeniedCapability::Filesystem,
        FS_DETAIL,
        "iiiiii",
    ),
    (
        "path_symlink",
        DeniedCapability::Filesystem,
        FS_DETAIL,
        "iiiii",
    ),
    (
        "path_unlink_file",
        DeniedCapability::Filesystem,
        FS_DETAIL,
        "iii",
    ),
    // There is no network.
    ("sock_accept", DeniedCapability::Network, NET_DETAIL, "iii"),
    ("sock_recv", DeniedCapability::Network, NET_DETAIL, "iiiiii"),
    ("sock_send", DeniedCapability::Network, NET_DETAIL, "iiiii"),
    ("sock_shutdown", DeniedCapability::Network, NET_DETAIL, "ii"),
    // The host process is not the guest's to steer.
    (
        "poll_oneoff",
        DeniedCapability::ProcessControl,
        "a sandboxed plugin may not block the host on external events",
        "iiii",
    ),
    (
        "proc_raise",
        DeniedCapability::ProcessControl,
        "a sandboxed plugin may not signal the host process",
        "i",
    ),
];

const FS_DETAIL: &str = "a sandboxed plugin has no filesystem";
const NET_DETAIL: &str = "a sandboxed plugin has no outbound network";

/// The signature the shim defines for a WASI function of this name, if any.
///
/// The load-time gate and the shim read the same two tables, so an import that
/// links at runtime is exactly one the gate admits — they cannot drift apart.
fn shim_signature(name: &str) -> Option<(&'static str, &'static str)> {
    if let Some((_, params, results)) = SERVED_IMPORTS.iter().find(|(known, ..)| *known == name) {
        return Some((params, results));
    }
    DENIED_IMPORTS
        .iter()
        .find(|(known, ..)| *known == name)
        .map(|(_, _, _, params)| (*params, "i"))
}

/// Whether the shim defines a WASI function of this name.
///
/// Test-only: the load gate needs the *signature*, not just the name, so it
/// calls [`shim_signature`] directly. This stays as the shape the
/// `the_load_gate_admits_exactly_what_the_shim_defines` invariant is written
/// against.
#[cfg(test)]
fn is_shim_function(name: &str) -> bool {
    shim_signature(name).is_some()
}

/// Build a [`wasmi::FuncType`] from a signature descriptor pair.
fn signature_type(params: &str, results: &str) -> Option<wasmi::FuncType> {
    fn types(descriptor: &str) -> Option<Vec<wasmi::core::ValType>> {
        descriptor
            .chars()
            .map(|ch| match ch {
                'i' => Some(wasmi::core::ValType::I32),
                'l' => Some(wasmi::core::ValType::I64),
                _ => None,
            })
            .collect()
    }
    Some(wasmi::FuncType::new(types(params)?, types(results)?))
}

/// What one instantiation costs in fuel: the bytes copied, plus a unit per
/// segment for the bounds check and copy set-up each one needs regardless of
/// its length, plus a unit per import.
///
/// Imports are counted for the same reason segments are: resolving one is
/// per-instance work the guest does not execute but every request pays for, so
/// leaving it unpriced is a way to buy host CPU with no fuel. `MAX_IMPORTS`
/// bounds the count; this makes the admitted ones cost something.
fn instantiation_fuel(
    segments: usize,
    init_bytes: usize,
    imports: usize,
    globals: usize,
    initial_memory_bytes: u64,
    table_elements: u64,
) -> u64 {
    let bytes = u64::try_from(init_bytes).unwrap_or(u64::MAX);
    let segments = u64::try_from(segments).unwrap_or(u64::MAX);
    let imports = u64::try_from(imports).unwrap_or(u64::MAX);
    let globals = u64::try_from(globals).unwrap_or(u64::MAX);
    // The instance's linear memory, at the same rate as every other host-side byte. A
    // module can declare its initial size and no data segments at all, so the
    // init-section terms above price none of it — yet the host allocates and zero-fills
    // the whole thing on every request, before the guest runs an instruction. Near the
    // manifest's ceiling that is hundreds of megabytes of memset a client can ask for
    // repeatedly, for one fuel unit: the same "buy host CPU with no fuel" the copying
    // charge exists to stop. The limiter bounds how much memory; only this bounds how
    // often it can be paid for.
    let memory = initial_memory_bytes
        .checked_div(BYTES_PER_FUEL)
        .unwrap_or(u64::MAX);
    // The table's initial entries, for exactly the reason the memory term
    // above exists — and the sibling that term did not cover. A module can
    // declare a table's minimum with no element segments at all, so `segments`
    // and `init_bytes` price none of it, and wasmi still allocates and
    // initialises every slot on every instantiation before the guest runs.
    // Charged per entry rather than per byte, like `segments`, `imports` and
    // `globals` beside it: what the host pays here is a slot initialised, not a
    // block copied.
    bytes
        .checked_div(BYTES_PER_FUEL)
        .unwrap_or(u64::MAX)
        .saturating_add(memory)
        .saturating_add(table_elements)
        .saturating_add(segments)
        .saturating_add(imports)
        .saturating_add(globals)
        .saturating_add(1)
}

/// Whether `result` comes from a call that reached its backend.
///
/// A denial that comes before dispatch did not. A backend error may have: an
/// outbound request can fail after the upstream got it.
const fn reached_backend(result: &super::capability::CallResult) -> bool {
    !matches!(
        result.denial(),
        Some(
            super::capability::DenialReason::CapabilityNotGranted
                | super::capability::DenialReason::NotInGrant
                | super::capability::DenialReason::QuotaExceeded
                | super::capability::DenialReason::Malformed
                | super::capability::DenialReason::Unavailable
        )
    )
}

/// Charge the guest's fuel budget for `bytes` of host-side work.
///
/// Returns the `OutOfFuel` trap when the budget cannot cover it, so a guest
/// that tries to buy unbounded copying ends exactly as a guest that spins does:
/// [`SandboxFailure::FuelExhausted`], and a 504 on its own prefix.
/// Charge fuel for host work priced per byte *copied*.
///
/// [`BYTES_PER_FUEL`] is a bulk-copy rate: a memcpy moves many bytes for what
/// one instruction costs, so 64 of them to a unit is honest. It is the wrong
/// rate for work that computes each byte — see [`charge_units`].
fn charge_bytes(caller: &mut Caller<'_, HostState>, bytes: usize) -> Result<(), wasmi::Error> {
    let units = u64::try_from(bytes)
        .unwrap_or(u64::MAX)
        .checked_div(BYTES_PER_FUEL)
        .unwrap_or(u64::MAX)
        .saturating_add(1);
    charge_units(caller, units)
}

/// Charge fuel directly, for host work a byte count does not describe.
fn charge_units(caller: &mut Caller<'_, HostState>, units: u64) -> Result<(), wasmi::Error> {
    let left = caller.get_fuel()?;
    let remaining = left
        .checked_sub(units)
        .ok_or_else(|| wasmi::Error::from(wasmi::core::TrapCode::OutOfFuel))?;
    caller.set_fuel(remaining)
}

/// Charge `units`, taking the budget to zero rather than trapping when it does
/// not cover them.
///
/// For the one charge that necessarily *follows* a committed side effect: a
/// reply can only be measured once the call has been answered, and by then a KV
/// write, a job enqueue or an outbound POST has happened. Trapping there ends
/// the request over work already done — and a retry does that work again, which
/// for a POST is the difference between one order and two.
///
/// Taking the budget to zero instead is bounded and terminal in the same
/// breath: the overshoot is one reply's worth, the next dispatch cannot start
/// because [`CAPABILITY_CALL_FUEL`] is charged before it with [`charge_units`],
/// which does trap, and the guest's own instructions run out on the next one.
/// The request still ends here — it ends after the effect is accounted for
/// rather than after it is disowned.
fn charge_units_saturating(
    caller: &mut Caller<'_, HostState>,
    units: u64,
) -> Result<(), wasmi::Error> {
    let left = caller.get_fuel()?;
    caller.set_fuel(left.saturating_sub(units))
}

/// Register the guest-visible WASI surface.
///
/// One registration per import, all in one place, because this list **is** the
/// sandbox. Read it top to bottom and you have read every capability a
/// sandboxed plugin holds.
#[allow(
    clippy::too_many_lines,
    reason = "splitting this up would hide the fact that this list IS the sandbox"
)]
fn define_wasi_shim(linker: &mut Shim) -> Result<(), SandboxLoadError> {
    fn engine_error(err: impl fmt::Display) -> SandboxLoadError {
        SandboxLoadError::Engine(err.to_string())
    }

    // ── the dialogue ─────────────────────────────────────────────────

    linker
        .func_wrap(
            WASI,
            "fd_read",
            |mut caller: Caller<'_, HostState>, fd: i32, iovs: i32, iovs_len: i32, nread: i32| {
                if fd != 0 {
                    // The guest was given one descriptor. Anything else is a
                    // reach for a file it was never handed.
                    caller.data_mut().deny(
                        DeniedCapability::Filesystem,
                        "fd_read",
                        "a sandboxed plugin has no descriptors beyond the request dialogue",
                    );
                    return Ok(errno::BADF);
                }
                let Some(memory) = memory_of(&caller) else {
                    return Ok(errno::INVAL);
                };
                if iovs_len > MAX_IOVECS {
                    return Ok(errno::INVAL);
                }

                let mut total: u32 = 0;
                for index in 0..iovs_len {
                    let Some((pointer, length)) = iovec(&caller, memory, iovs, index) else {
                        return Ok(errno::INVAL);
                    };
                    // Bounds-check BEFORE consuming: `take_stdin` pops the bytes,
                    // and a write that then fails would have destroyed part of
                    // the request frame with no way for the guest to recover it.
                    let in_bounds = pointer
                        .checked_add(length)
                        .is_some_and(|end| end <= memory.data_size(&caller));
                    if !in_bounds {
                        return Ok(errno::INVAL);
                    }
                    // Charged for what is actually copied, not for what was
                    // asked: `take_stdin` bounds the copy at
                    // `HOST_IO_CHUNK_BYTES` and by what is left, so pricing the
                    // whole iovec would bill the guest for bytes it did not get.
                    // The queue's remaining length belongs in the minimum for the
                    // same reason the chunk ceiling does — a guest reading the
                    // tail of its frame through a large buffer would otherwise pay
                    // a full chunk for a few bytes, and a tight but sufficient
                    // budget could fail on it.
                    let take = HOST_IO_CHUNK_BYTES
                        .min(length)
                        .min(caller.data().stdin.len());
                    charge_bytes(&mut caller, take)?;
                    let chunk = caller.data_mut().take_stdin(take);
                    if memory.write(&mut caller, pointer, &chunk).is_err() {
                        return Ok(errno::INVAL);
                    }
                    let Ok(read) = u32::try_from(chunk.len()) else {
                        return Ok(errno::INVAL);
                    };
                    let Some(sum) = total.checked_add(read) else {
                        return Ok(errno::INVAL);
                    };
                    total = sum;
                    if chunk.len() < length {
                        break;
                    }
                }

                let Ok(at) = usize::try_from(nread) else {
                    return Ok(errno::INVAL);
                };
                if write_u32(&mut caller, memory, at, total).is_none() {
                    return Ok(errno::INVAL);
                }
                Ok(errno::SUCCESS)
            },
        )
        .map_err(engine_error)?;

    linker
        .func_wrap(
            WASI,
            "fd_write",
            |mut caller: Caller<'_, HostState>,
             fd: i32,
             iovs: i32,
             iovs_len: i32,
             nwritten: i32|
             -> Result<i32, wasmi::Error> {
                if fd != 1 && fd != 2 {
                    caller.data_mut().deny(
                        DeniedCapability::Filesystem,
                        "fd_write",
                        "a sandboxed plugin may only write its response frame and diagnostics",
                    );
                    return Ok(errno::BADF);
                }
                let Some(memory) = memory_of(&caller) else {
                    return Ok(errno::INVAL);
                };
                if iovs_len > MAX_IOVECS {
                    return Ok(errno::INVAL);
                }

                let mut total: u32 = 0;
                for index in 0..iovs_len {
                    // Per descriptor inspected, not per byte copied. Reading an
                    // iovec out of guest memory and bounds-checking it is host
                    // work whatever the length says, and the only other charge in
                    // this function lives inside `while offset < length`, which a
                    // zero-length iovec skips and which breaks once stderr is past
                    // its budget. Sixty-four free descriptor walks per imported
                    // call, against a budget that limits only how many calls, is
                    // host CPU on a blocking worker no ceiling sees.
                    //
                    // `charge_units` rather than `charge_bytes`, for the reason
                    // `random_get` uses it: this is per-item work, not a bulk move.
                    // `fd_read` needs no such line — its `charge_bytes` sits
                    // unconditionally in the loop body and floors at one unit, so a
                    // drained queue already costs a descriptor's worth of fuel.
                    charge_units(&mut caller, 1)?;
                    let Some((pointer, length)) = iovec(&caller, memory, iovs, index) else {
                        return Ok(errno::INVAL);
                    };
                    // Bounds-check BEFORE any copy: `length` is guest-chosen,
                    // and a `u32::MAX` iovec must fail rather than start a copy
                    // the host then has to abandon.
                    let in_bounds = pointer
                        .checked_add(length)
                        .is_some_and(|end| end <= memory.data_size(&caller));
                    if !in_bounds {
                        return Ok(errno::INVAL);
                    }
                    let Ok(written) = u32::try_from(length) else {
                        return Ok(errno::INVAL);
                    };
                    let Some(sum) = total.checked_add(written) else {
                        return Ok(errno::INVAL);
                    };
                    total = sum;

                    // Copy through a bounded scratch buffer: an in-bounds iovec
                    // can span the guest's whole memory, and the host must never
                    // mirror it in one allocation.
                    let mut offset = 0usize;
                    while offset < length {
                        // Stderr past its budget is discarded, so copying it is
                        // pure host work with no output. Stop rather than
                        // faithfully copying bytes into the bin.
                        if fd == 2 && caller.data().stderr_is_full() {
                            break;
                        }
                        let take = HOST_IO_CHUNK_BYTES.min(length.saturating_sub(offset));
                        charge_bytes(&mut caller, take)?;
                        if fd == 1 {
                            // The line parser inspects each stdout byte, so
                            // add the per-byte rate to the copy rate. The host
                            // may charge for bytes it never parses. This is safe.
                            charge_units(&mut caller, u64::try_from(take).unwrap_or(u64::MAX))?;
                        }
                        let mut scratch = vec![0u8; take];
                        let at = pointer.saturating_add(offset);
                        if memory.read(&caller, at, &mut scratch).is_err() {
                            return Ok(errno::INVAL);
                        }
                        if fd == 1 {
                            let accepted = caller.data_mut().write_stdout(&scratch);
                            // Fixed charge, dispatch, byte charge — in that
                            // order, once per call the chunk completed. The
                            // fixed charge is taken *before* the call reaches a
                            // backend, so a budget too small to pay for it
                            // cannot leave a KV write, a job enqueue or an
                            // outbound POST behind on a request that then ends
                            // as `FuelExhausted`. A trap here leaves the rest of
                            // the queue undispatched, which is the same
                            // property one level up.
                            //
                            // The loop stops on a terminal answer as well as on
                            // an empty queue. One chunk may carry several call
                            // frames, and servicing an early one can end the
                            // request — a reply the guest never read pushing the
                            // queue over `MAX_QUEUED_REPLY_BYTES`, or the host
                            // failing to encode its own answer. Draining the
                            // rest afterwards would perform a job enqueue, a DB
                            // write or an outbound POST on a request that is
                            // already going to fail, which is the property the
                            // charge-before-dispatch order exists to establish.
                            //
                            // And only when the write was accepted. A chunk can
                            // carry a complete call frame followed by a line that
                            // overruns the stdout budget: `write_stdout` parses
                            // and queues the first, then refuses at the second and
                            // answers `false`. Servicing the queue anyway would
                            // commit that call's side effect on a request the
                            // `!accepted` branch below is about to end as
                            // `OutputBudget` — the guest is told the write failed
                            // and may retry it, so the enqueue or the POST happens
                            // twice. It is the same property the
                            // charge-before-dispatch order establishes for fuel,
                            // reached through the output ceiling instead.
                            if accepted {
                                while caller.data().has_pending_call()
                                    && caller.data().answer.is_none()
                                {
                                    charge_units(&mut caller, CAPABILITY_CALL_FUEL)?;
                                    let fuel_left = caller.get_fuel()?;
                                    let _ = caller.data_mut().service_next(fuel_left);
                                    // Saturating, because this charge follows a
                                    // call that has already run: see
                                    // `charge_units_saturating`. The pre-charge
                                    // above is the trapping one, and it is what
                                    // stops the next call.
                                    let owed = caller.data_mut().take_pending_charge();
                                    charge_units_saturating(&mut caller, owed)?;
                                }
                            }
                            // Charged whether the write was accepted or not, and
                            // drained before the branch below, so no exit from
                            // this arm can leave fuel owed.
                            let owed = caller.data_mut().take_pending_charge();
                            charge_units(&mut caller, owed)?;
                            if !accepted {
                                // The response ceiling is a hard stop, not an
                                // errno the guest can ignore and retry: trap so
                                // the request ends here.
                                return Err(wasmi::Error::host(OutputBudgetExhausted));
                            }
                            if caller.data().answer.is_some() {
                                // The exchange is over. A guest that keeps
                                // running would hold a permit and a blocking
                                // worker for its whole budget and then serve the
                                // answer it already had.
                                return Err(wasmi::Error::host(AnswerComplete));
                            }
                        } else {
                            caller.data_mut().write_stderr(&scratch);
                        }
                        offset = offset.saturating_add(take);
                    }
                }

                let Ok(at) = usize::try_from(nwritten) else {
                    return Ok(errno::INVAL);
                };
                if write_u32(&mut caller, memory, at, total).is_none() {
                    return Ok(errno::INVAL);
                }
                Ok(errno::SUCCESS)
            },
        )
        .map_err(engine_error)?;

    // ── inert, because a guest's runtime expects them to exist ────────

    linker
        .func_wrap(WASI, "fd_close", |_: Caller<'_, HostState>, fd: i32| {
            if (0..=2).contains(&fd) {
                errno::SUCCESS
            } else {
                errno::BADF
            }
        })
        .map_err(engine_error)?;
    linker
        .func_wrap(
            WASI,
            "fd_seek",
            |mut caller: Caller<'_, HostState>, fd: i32, _offset: i64, _whence: i32, _out: i32| {
                // Unknown descriptor: refuse and record, like `fd_read`.
                if !(0..=2).contains(&fd) {
                    caller.data_mut().deny(
                        DeniedCapability::Filesystem,
                        "fd_seek",
                        "a sandboxed plugin has no descriptors beyond the request dialogue",
                    );
                    return errno::BADF;
                }
                // stdio is a pipe. Saying so is more useful than saying no.
                errno::SPIPE
            },
        )
        .map_err(engine_error)?;
    linker
        .func_wrap(
            WASI,
            "fd_tell",
            |_: Caller<'_, HostState>, _fd: i32, _out: i32| errno::SPIPE,
        )
        .map_err(engine_error)?;
    linker
        .func_wrap(
            WASI,
            "fd_fdstat_get",
            |mut caller: Caller<'_, HostState>, fd: i32, out: i32| {
                if !(0..=2).contains(&fd) {
                    caller.data_mut().deny(
                        DeniedCapability::Filesystem,
                        "fd_fdstat_get",
                        "a sandboxed plugin has no descriptors beyond the request dialogue",
                    );
                    return errno::BADF;
                }
                let Some(memory) = memory_of(&caller) else {
                    return errno::INVAL;
                };
                let Ok(at) = usize::try_from(out) else {
                    return errno::INVAL;
                };
                // filetype 2 = character device, no rights, no flags.
                let mut stat = [0u8; FDSTAT_SIZE];
                stat[0] = 2;
                if memory.write(&mut caller, at, &stat).is_err() {
                    return errno::INVAL;
                }
                errno::SUCCESS
            },
        )
        .map_err(engine_error)?;
    linker
        .func_wrap(WASI, "sched_yield", |_: Caller<'_, HostState>| {
            errno::SUCCESS
        })
        .map_err(engine_error)?;

    // ── time and entropy: fixed, not ambient ─────────────────────────

    linker
        .func_wrap(
            WASI,
            "clock_time_get",
            |mut caller: Caller<'_, HostState>, _id: i32, _precision: i64, out: i32| {
                let Some(memory) = memory_of(&caller) else {
                    return errno::INVAL;
                };
                let Ok(at) = usize::try_from(out) else {
                    return errno::INVAL;
                };
                // A fixed instant. The host's wall clock is not a capability a
                // plugin was granted, and a plugin that is a function of its
                // request is one an author can reason about.
                if memory.write(&mut caller, at, &0u64.to_le_bytes()).is_err() {
                    return errno::INVAL;
                }
                errno::SUCCESS
            },
        )
        .map_err(engine_error)?;
    linker
        .func_wrap(
            WASI,
            "clock_res_get",
            |mut caller: Caller<'_, HostState>, _id: i32, out: i32| {
                let Some(memory) = memory_of(&caller) else {
                    return errno::INVAL;
                };
                let Ok(at) = usize::try_from(out) else {
                    return errno::INVAL;
                };
                if memory.write(&mut caller, at, &1u64.to_le_bytes()).is_err() {
                    return errno::INVAL;
                }
                errno::SUCCESS
            },
        )
        .map_err(engine_error)?;
    linker
        .func_wrap(
            WASI,
            "random_get",
            |mut caller: Caller<'_, HostState>, buf: i32, len: i32| -> Result<i32, wasmi::Error> {
                let Some(memory) = memory_of(&caller) else {
                    return Ok(errno::INVAL);
                };
                let (Ok(at), Ok(len)) = (usize::try_from(buf), usize::try_from(len)) else {
                    return Ok(errno::INVAL);
                };
                let in_bounds = at
                    .checked_add(len)
                    .is_some_and(|end| end <= memory.data_size(&caller));
                if !in_bounds {
                    return Ok(errno::INVAL);
                }
                let mut written = 0usize;
                while written < len {
                    let take = HOST_IO_CHUNK_BYTES.min(len.saturating_sub(written));
                    // Priced per byte, not at the bulk-copy rate. Every byte
                    // here is a whole `SplitMix64` step — an add, two
                    // multiplies and four shift-XOR pairs — where `fd_write`'s
                    // byte is a memcpy. Charging 64 of these to one unit let a
                    // guest buy the mixer's work at a copy's price and hold a
                    // blocking worker far longer than its declared ceiling
                    // says it may.
                    charge_units(&mut caller, u64::try_from(take).unwrap_or(u64::MAX))?;
                    let mut scratch = vec![0u8; take];
                    for slot in &mut scratch {
                        *slot = caller.data_mut().next_random_byte();
                    }
                    if memory
                        .write(&mut caller, at.saturating_add(written), &scratch)
                        .is_err()
                    {
                        return Ok(errno::INVAL);
                    }
                    written = written.saturating_add(take);
                }
                Ok(errno::SUCCESS)
            },
        )
        .map_err(engine_error)?;

    // ── the process is not the guest's to steer ──────────────────────

    linker
        .func_wrap(
            WASI,
            "proc_exit",
            |_: Caller<'_, HostState>, code: i32| -> Result<(), wasmi::Error> {
                // Ends the *guest*. The host process is not the guest's to end.
                Err(wasmi::Error::i32_exit(code))
            },
        )
        .map_err(engine_error)?;

    // ── the environment is empty, and asking is recorded ─────────────

    linker
        .func_wrap(
            WASI,
            "environ_sizes_get",
            |mut caller: Caller<'_, HostState>, count: i32, size: i32| {
                caller.data_mut().deny(
                    DeniedCapability::Environment,
                    "environ_sizes_get",
                    "a sandboxed plugin sees an empty environment",
                );
                write_two_zeroes(&mut caller, count, size)
            },
        )
        .map_err(engine_error)?;
    linker
        .func_wrap(
            WASI,
            "environ_get",
            |mut caller: Caller<'_, HostState>, _ptrs: i32, _buf: i32| {
                caller.data_mut().deny(
                    DeniedCapability::Environment,
                    "environ_get",
                    "a sandboxed plugin sees an empty environment",
                );
                // Nothing to write: the environment is empty, so success is the
                // truthful answer and needs no bytes.
                errno::SUCCESS
            },
        )
        .map_err(engine_error)?;
    linker
        .func_wrap(
            WASI,
            "args_sizes_get",
            |mut caller: Caller<'_, HostState>, count: i32, size: i32| {
                caller.data_mut().deny(
                    DeniedCapability::Environment,
                    "args_sizes_get",
                    "a sandboxed plugin sees no process arguments",
                );
                write_two_zeroes(&mut caller, count, size)
            },
        )
        .map_err(engine_error)?;
    linker
        .func_wrap(
            WASI,
            "args_get",
            |mut caller: Caller<'_, HostState>, _ptrs: i32, _buf: i32| {
                caller.data_mut().deny(
                    DeniedCapability::Environment,
                    "args_get",
                    "a sandboxed plugin sees no process arguments",
                );
                errno::SUCCESS
            },
        )
        .map_err(engine_error)?;

    // ── everything else is a refusal ─────────────────────────────────

    for (name, capability, detail, signature) in DENIED_IMPORTS {
        deny(linker, name, *capability, detail, signature)?;
    }

    Ok(())
}

/// Write two zero `u32`s — the "empty list" answer `*_sizes_get` needs.
fn write_two_zeroes(caller: &mut Caller<'_, HostState>, first: i32, second: i32) -> i32 {
    let Some(memory) = memory_of(caller) else {
        return errno::INVAL;
    };
    let (Ok(first), Ok(second)) = (usize::try_from(first), usize::try_from(second)) else {
        return errno::INVAL;
    };
    if write_u32(caller, memory, first, 0).is_none()
        || write_u32(caller, memory, second, 0).is_none()
    {
        return errno::INVAL;
    }
    errno::SUCCESS
}

/// Register one refusal stub.
///
/// `wasmi` matches host functions by signature, so a stub must have exactly the
/// shape of the WASI function it stands in for — hence the descriptor rather
/// than a hand-written closure per function. The bodies are identical by
/// design: there is nothing to implement, only a refusal to record.
fn deny(
    linker: &mut Shim,
    name: &'static str,
    capability: DeniedCapability,
    detail: &'static str,
    signature: &str,
) -> Result<(), SandboxLoadError> {
    let mut params = Vec::with_capacity(signature.len());
    for ch in signature.chars() {
        params.push(match ch {
            'i' => wasmi::core::ValType::I32,
            'l' => wasmi::core::ValType::I64,
            other => {
                return Err(SandboxLoadError::Engine(format!(
                    "unknown signature character `{other}` for {name}"
                )));
            }
        });
    }
    let ty = wasmi::FuncType::new(params, [wasmi::core::ValType::I32]);
    linker
        .func_new(
            WASI,
            name,
            ty,
            move |mut caller: Caller<'_, HostState>, _args: &[wasmi::Val], results| {
                caller.data_mut().deny(capability, name, detail);
                if let Some(slot) = results.first_mut() {
                    *slot = wasmi::Val::I32(errno::NOTCAPABLE);
                }
                Ok(())
            },
        )
        .map_err(|err| SandboxLoadError::Engine(err.to_string()))?;
    Ok(())
}

#[cfg(test)]
mod tests {
    use super::*;
    use crate::plugin_sandbox::manifest::{ResourceLimits, SandboxCapability, SandboxManifest};
    use crate::plugin_sandbox::test_guests as guests;

    fn manifest_with(limits: ResourceLimits) -> SandboxManifest {
        let mut manifest = SandboxManifest::parse(&format!(
            r#"
name = "autumn-plugin-hello"
version = "0.1.0"
wire_version = 1
prefix = "/hello"
capabilities = ["http-request"]
sha256 = "{digest}"

[[routes]]
method = "GET"
path = "/hello/greet"
"#,
            digest = "a".repeat(64)
        ))
        .expect("valid manifest");
        manifest.limits = limits;
        manifest
    }

    /// A bare `HostState` for the shim unit tests: an ordinary request
    /// exchange, and a capability runtime with no grants and no backends, which
    /// is what a first-slice plugin has.
    fn bare_state(limits: ResourceLimits, frame: &[u8]) -> HostState {
        HostState::new(
            "hello".to_owned(),
            limits,
            frame,
            Exchange::Request,
            crate::plugin_sandbox::capability::CapabilityRuntime::new(
                &manifest_with(limits),
                crate::plugin_sandbox::CapabilityServices::none(),
            ),
        )
    }

    fn try_host(wat: &str) -> Result<SandboxHost, SandboxLoadError> {
        try_host_with(wat, ResourceLimits::default())
    }

    fn try_host_with(wat: &str, limits: ResourceLimits) -> Result<SandboxHost, SandboxLoadError> {
        let wasm = wat::parse_str(wat).expect("the fixture is valid WAT");
        SandboxHost::from_module(manifest_with(limits), &wasm)
    }

    fn host(wat: &str) -> SandboxHost {
        try_host(wat).expect("the fixture loads")
    }

    fn request(method: &str, path: &str) -> SandboxRequest {
        SandboxRequest {
            method: method.to_owned(),
            // The declared pattern and the concrete path agree here: the
            // fixtures dispatch on the frame's *content*, so a route that
            // never varied would make every test look like a match.
            route: path.to_owned(),
            path: path.to_owned(),
            query: String::new(),
            path_params: vec![],
            headers: vec![("accept".to_owned(), "text/plain".to_owned())],
            body: vec![],
        }
    }

    fn get(path: &str) -> SandboxRequest {
        request("GET", path)
    }

    fn denied(outcome: &SandboxOutcome, capability: DeniedCapability) -> Vec<String> {
        outcome
            .denials
            .iter()
            .filter(|denial| denial.capability == capability)
            .map(|denial| denial.operation.clone())
            .collect()
    }

    // ── the happy path ───────────────────────────────────────────────

    #[test]
    fn a_well_behaved_guest_answers_the_request() {
        let outcome = host(guests::HELLO).run(&get("/hello/greet"));
        let response = outcome.result.expect("answers");
        assert_eq!(response.status, 200);
        assert_eq!(response.body, b"hello from the sandbox");
        assert!(outcome.denials.is_empty(), "{:?}", outcome.denials);
        assert!(outcome.fuel_used > 0);
    }

    #[test]
    fn the_guest_sees_the_request_it_was_sent() {
        let host = host(guests::HELLO);
        assert_eq!(
            host.run(&get("/hello/other"))
                .result
                .expect("answers")
                .status,
            404
        );
        assert_eq!(
            host.run(&request("POST", "/hello/greet"))
                .result
                .expect("answers")
                .status,
            405
        );
    }

    #[test]
    fn each_request_gets_a_fresh_instance() {
        // Nothing a guest does can survive into the next request, which is what
        // makes one request's misbehaviour unable to poison the next.
        let host = host(guests::HELLO);
        let first = host.run(&get("/hello/greet"));
        let second = host.run(&get("/hello/greet"));
        assert_eq!(
            first.result.expect("answers"),
            second.result.expect("answers")
        );
        assert_eq!(first.fuel_used, second.fuel_used);
    }

    // ── resource bounds ──────────────────────────────────────────────

    #[test]
    fn a_guest_that_never_stops_is_stopped() {
        let limits = ResourceLimits {
            fuel: 5_000_000,
            ..ResourceLimits::default()
        };
        let outcome = try_host_with(guests::CPU_SPIN, limits)
            .expect("loads")
            .run(&get("/hello/greet"));
        let failure = outcome.result.expect_err("must not answer");
        assert!(
            matches!(failure, SandboxFailure::FuelExhausted { .. }),
            "{failure}"
        );
        assert!(failure.status().is_server_error(), "{failure}");
    }

    #[test]
    fn a_guest_that_allocates_without_bound_is_capped() {
        let limits = ResourceLimits {
            fuel: 20_000_000,
            memory_bytes: 1024 * 1024,
            ..ResourceLimits::default()
        };
        let outcome = try_host_with(guests::MEMORY_BOMB, limits)
            .expect("loads")
            .run(&get("/hello/greet"));
        assert!(outcome.result.is_err(), "a memory bomb must not answer");
        assert!(
            outcome.peak_memory_bytes <= 1024 * 1024,
            "peak {} exceeded the ceiling",
            outcome.peak_memory_bytes
        );
        assert!(
            !denied(&outcome, DeniedCapability::Memory).is_empty(),
            "the refused growth must be observable: {:?}",
            outcome.denials
        );
    }

    #[test]
    fn a_guest_that_floods_stdout_without_a_newline_is_cut_off() {
        let limits = ResourceLimits {
            max_response_bytes: 4096,
            fuel: 50_000_000,
            ..ResourceLimits::default()
        };
        let outcome = try_host_with(guests::OUTPUT_FLOOD, limits)
            .expect("loads")
            .run(&get("/hello/greet"));
        let failure = outcome.result.expect_err("must not answer");
        assert!(
            matches!(failure, SandboxFailure::OutputBudget { .. }),
            "{failure}"
        );
    }

    // ── fault isolation ──────────────────────────────────────────────

    #[test]
    fn host_side_copying_is_charged_against_the_guest_s_fuel() {
        // wasmi meters the guest's instructions, not what the host does on its
        // behalf. Without a charge, a guest buys gigabytes of memcpy for single
        // digits of fuel — a spin inside the host that the CPU ceiling never
        // sees. This guest asks the host to copy 1 MiB in ~50 instructions.
        const COPIED: u64 = 1024 * 1024;
        let bulk = host(guests::STDOUT_BULK).run(&get("/hello/greet"));
        assert!(
            bulk.fuel_used >= COPIED / 64,
            "1 MiB of host-side copying cost only {} fuel units",
            bulk.fuel_used
        );
        // …and the loop itself is nothing, so the charge is the copy.
        let honest = host(guests::HELLO).run(&get("/hello/greet"));
        assert!(
            honest.fuel_used < COPIED / 64,
            "the baseline is not a baseline: {} units",
            honest.fuel_used
        );
    }

    #[test]
    fn walking_an_iovec_vector_is_charged_even_when_it_moves_no_bytes() {
        // `fd_write`'s only byte charge lives inside `while offset < length`, which a
        // zero-length descriptor skips outright. Reading that descriptor out of guest
        // memory and bounds-checking it is host work all the same, and a guest may
        // present `MAX_IOVECS` of them per imported call: a budget that prices only the
        // calls buys sixty-four times the host CPU it charged for, on a blocking worker
        // no ceiling sees. The control is the same module with one descriptor instead
        // of sixty-four — identical guest instructions, so the whole gap between them is
        // host work priced per descriptor. Only a per-descriptor charge can satisfy this.
        const CALLS: u32 = 8192;
        const WIDE: u32 = MAX_IOVECS as u32;

        let wide = host(&guests::empty_iovecs(WIDE, CALLS)).run(&get("/hello/greet"));
        let narrow = host(&guests::empty_iovecs(1, CALLS)).run(&get("/hello/greet"));
        assert!(wide.result.is_ok(), "{:?}", wide.result);
        assert!(narrow.result.is_ok(), "{:?}", narrow.result);

        let extra = wide.fuel_used.saturating_sub(narrow.fuel_used);
        // The exact figure is `CALLS * (WIDE - 1)`; halved here so the assertion
        // is about the charge existing and scaling, not about wasmi's per
        // instruction accounting staying byte-identical between two modules.
        let expected = u64::from(CALLS) * u64::from(WIDE - 1) / 2;
        assert!(
            extra >= expected,
            "sixty-four empty descriptors per call cost {extra} more fuel than one, \
             short of the {expected} that walking them is worth"
        );
    }

    #[test]
    fn parsing_a_stdout_line_is_charged_per_byte_not_at_the_copy_rate() {
        // The parser inspects every byte of a stdout line, so whitespace padding
        // costs the host one step per byte. The copy charge alone is one unit per
        // 64 bytes. The two modules differ in one `i32.const` (the pad length), so
        // the whole `fuel_used` gap is host work. Copy only: about 1,025 units.
        // Copy plus parse: about 66,561. The bound tells them apart.
        // It does not fix either rate.
        const PAD: u32 = 65_536;

        let padded = host(&guests::padded_frame(PAD)).run(&get("/hello/greet"));
        let plain = host(&guests::padded_frame(0)).run(&get("/hello/greet"));
        // The padded frame was accepted, so the gap is not an early-exit artifact.
        assert!(padded.result.is_ok(), "{:?}", padded.result);
        assert!(plain.result.is_ok(), "{:?}", plain.result);

        let extra = padded.fuel_used.saturating_sub(plain.fuel_used);
        assert!(
            extra > u64::from(PAD) / 2,
            "{PAD} bytes of padding cost {extra} more fuel than none, \
             short of the per-byte price of parsing them"
        );
    }

    #[test]
    fn instantiating_the_module_is_priced_against_the_budget() {
        // wasmi meters guest instructions, not instantiation: every request
        // copies the module's data and element segments before `_start` runs.
        // The ceiling on that is at load (below); this is the price, so the work
        // that IS admitted still comes out of the declared budget.
        let charged = host(guests::HELLO).instantiation_fuel();
        assert!(charged > 1, "the fixture carries data segments");

        // A budget that cannot even cover instantiation is refused at *load*
        // now: the artifact could never answer a request, so it never mounts.
        let err = try_host_with(
            guests::HELLO,
            ResourceLimits {
                fuel: charged / 2,
                ..ResourceLimits::default()
            },
        )
        .expect_err("a budget below the fixed charge must not produce a host");
        assert!(
            matches!(err, SandboxLoadError::FuelBelowFixedCharges { .. }),
            "{err:?}"
        );

        // The per-request refusal still matters, and is still reached: the load
        // floor compares against instantiation alone, but the frame encoding is
        // subtracted *first*, so a budget that clears the floor can still be
        // spent before `_start`. That is the case no load-time check can catch,
        // and it must still refuse before instantiating rather than after.
        let outcome = try_host_with(
            guests::HELLO,
            ResourceLimits {
                fuel: charged + 1,
                ..ResourceLimits::default()
            },
        )
        .expect("a budget above the fixed charge loads")
        .run(&get("/hello/greet"));
        assert!(
            matches!(outcome.result, Err(SandboxFailure::FuelExhausted { .. })),
            "{:?}",
            outcome.result
        );

        // …and an honest request pays for it out of the same budget.
        let outcome = host(guests::HELLO).run(&get("/hello/greet"));
        assert!(outcome.result.is_ok());
        assert!(
            outcome.fuel_used >= charged,
            "instantiation cost {} of a {charged}-unit module",
            outcome.fuel_used
        );
    }

    #[test]
    fn a_frame_that_is_not_utf8_is_refused_rather_than_expanded() {
        // `from_utf8_lossy` turns each invalid byte into a three-byte
        // replacement while the original is still alive, so a guest filling its
        // whole stdout budget with invalid bytes would make the host hold four
        // times that budget — memory no manifest accounted for.
        let outcome = host(guests::INVALID_UTF8).run(&get("/hello/greet"));
        let failure = outcome.result.expect_err("must not answer");
        assert!(
            matches!(failure, SandboxFailure::MalformedFrame(ref detail) if detail.contains("UTF-8")),
            "{failure}"
        );
    }

    #[test]
    fn a_module_without_the_memory_the_shim_needs_is_refused_at_load() {
        // Every host function reads and writes through an export named
        // `memory`. Without one they all answer EINVAL, so the plugin loads and
        // then fails every request — which packaging exists to prevent.
        let wat = r#"(module (func (export "_start") (nop)))"#;
        assert!(matches!(
            try_host(wat),
            Err(SandboxLoadError::MissingMemory)
        ));
    }

    #[test]
    fn a_module_whose_initial_memory_exceeds_the_ceiling_is_refused_at_load() {
        // 32 pages = 2 MiB of *initial* memory against a 1 MiB ceiling: the
        // limiter would refuse it at instantiation, per request, as a gateway
        // error — when it can be said once, here.
        let wat = r#"(module (memory (export "memory") 32) (func (export "_start") (nop)))"#;
        let limits = ResourceLimits {
            memory_bytes: 1024 * 1024,
            ..ResourceLimits::default()
        };
        let err = try_host_with(wat, limits).expect_err("must be refused");
        assert!(
            matches!(err, SandboxLoadError::MemoryTooLarge { found, .. } if found == 2 * 1024 * 1024),
            "{err}"
        );
    }

    #[test]
    fn table_growth_past_the_ceiling_is_refused_while_the_guest_runs() {
        // A module already over the ceiling at rest is now refused at load,
        // summed across its tables. The limiter is still what holds the line
        // here, and this is the case it alone can: a guest that starts *under*
        // the ceiling and reaches for more with `table.grow` while running,
        // which no load-time check can see.
        let wat = format!(
            r#"(module
                 (memory (export "memory") 1)
                 (table 1 funcref)
                 (func (export "_start")
                   (drop (table.grow 0 (ref.null func) (i32.const {MAX_TABLE_ELEMENTS})))))"#
        );
        let outcome = host(&wat).run(&get("/hello/greet"));
        assert!(outcome.result.is_err(), "{:?}", outcome.result);
        // Refused, and recorded: an operator has to be able to see that the
        // plugin reached past its ceiling rather than merely that it 5xx'd.
        let operations = denied(&outcome, DeniedCapability::Memory);
        assert!(
            !operations.is_empty(),
            "the refusal was not recorded: {:?}",
            outcome.denials
        );
        // …and recorded as the ceiling it actually hit. Both hooks used to
        // share one counter, so this arrived as `memory.grow` over the
        // manifest's *byte* ceiling — a limit that was never applied. Vague
        // evidence would be a nuisance; wrong evidence sends an operator to
        // raise the wrong number in the manifest, which cannot help.
        assert!(
            operations.iter().any(|op| op == "table.grow"),
            "a table refusal was not reported as one: {operations:?}"
        );
        assert!(
            !operations.iter().any(|op| op == "memory.grow"),
            "a table refusal was reported against the byte ceiling: {operations:?}"
        );
        let detail = outcome
            .denials
            .iter()
            .find(|denial| denial.operation == "table.grow")
            .map(|denial| denial.detail.clone())
            .expect("the table denial is present");
        assert!(
            detail.contains(&MAX_TABLE_ELEMENTS.to_string()),
            "the detail does not name the ceiling that applied: {detail}"
        );
    }

    #[test]
    fn a_module_that_is_expensive_to_instantiate_is_refused_at_load() {
        // Segment *count* is the sharp edge: each one costs a bounds check and a
        // copy set-up regardless of its length, so a module of many empty
        // segments is small on disk and expensive on every single request. A
        // per-request charge cannot bound work that has already been admitted,
        // so the ceiling is at load.
        use std::fmt::Write as _;

        let mut wat = String::from("(module\n  (memory (export \"memory\") 1)\n");
        for offset in 0..=MAX_INIT_SEGMENTS {
            let _ = writeln!(wat, "  (data (i32.const {offset}) \"x\")");
        }
        wat.push_str("  (func (export \"_start\") (nop))\n)");

        let err = try_host(&wat).expect_err("must be refused");
        assert!(
            matches!(
                err,
                SandboxLoadError::InstantiationTooExpensive { max, .. } if max == MAX_INIT_SEGMENTS
            ),
            "{err}"
        );
        assert!(err.to_string().contains("re-instantiates"), "{err}");
    }

    #[test]
    fn a_guest_that_floods_stderr_runs_out_of_fuel_rather_than_time() {
        let limits = ResourceLimits {
            fuel: 2_000_000,
            ..ResourceLimits::default()
        };
        let outcome = try_host_with(guests::STDERR_FLOOD, limits)
            .expect("loads")
            .run(&get("/hello/greet"));
        let failure = outcome.result.expect_err("must not answer");
        assert!(
            matches!(failure, SandboxFailure::FuelExhausted { .. }),
            "{failure}"
        );
    }

    #[test]
    fn a_guest_that_answers_and_then_spins_does_not_hold_its_whole_budget() {
        // The exchange is over at the frame. A guest that keeps running would
        // otherwise hold a permit and a blocking worker for its whole budget
        // and then serve the answer it already had.
        let limits = ResourceLimits {
            fuel: 500_000_000,
            ..ResourceLimits::default()
        };
        let outcome = try_host_with(guests::ANSWER_THEN_SPIN, limits)
            .expect("loads")
            .run(&get("/hello/greet"));
        assert_eq!(outcome.result.as_ref().expect("answers").status, 200);
        assert!(
            outcome.fuel_used < 1_000_000,
            "the answer cost {} fuel; the guest was allowed to keep spinning",
            outcome.fuel_used
        );
    }

    #[test]
    fn a_frame_without_its_newline_says_what_the_author_did() {
        let outcome = host(guests::PARTIAL_FRAME).run(&get("/hello/greet"));
        let failure = outcome.result.expect_err("must not answer");
        assert!(matches!(failure, SandboxFailure::PartialFrame), "{failure}");
        assert!(failure.to_string().contains("println!"), "{failure}");
    }

    #[test]
    fn a_guest_may_not_forge_the_host_s_own_response_headers() {
        let outcome = host(guests::FORGE_ATTRIBUTION).run(&get("/hello/greet"));
        let denied = denied(&outcome, DeniedCapability::ResponseHeader);
        assert!(
            denied.contains(&"x-autumn-sandboxed".to_owned()),
            "{denied:?}"
        );
        assert!(
            denied.contains(&"x-content-type-options".to_owned()),
            "{denied:?}"
        );
        let response = outcome.result.expect("answers");
        assert!(
            response
                .headers
                .iter()
                .all(|(name, _)| name.starts_with("content-"))
        );
    }

    #[test]
    fn a_document_content_type_is_refused_rather_than_served_from_the_host_s_origin() {
        for essence in [
            "text/html",
            "application/javascript",
            "image/svg+xml",
            "text/css",
        ] {
            let response = SandboxResponse {
                status: 200,
                headers: vec![("content-type".to_owned(), essence.to_owned())],
                body: b"<script>".to_vec(),
            };
            assert_eq!(
                response.refused_content_type().as_deref(),
                Some(essence),
                "{essence} must be refused"
            );
        }
        for essence in ["text/plain; charset=utf-8", "application/json", "image/png"] {
            let response = SandboxResponse {
                status: 200,
                headers: vec![("Content-Type".to_owned(), essence.to_owned())],
                body: vec![],
            };
            assert_eq!(
                response.refused_content_type(),
                None,
                "{essence} must be served"
            );
        }
    }

    #[test]
    fn entropy_is_deterministic_per_request_without_being_a_published_constant() {
        // The guest folds an entropy byte into its status, so this only holds
        // if the host's stream is a function of the request.
        let host = host(guests::ENTROPY);
        let first = host.run(&get("/hello/greet")).result.expect("answers");
        let again = host.run(&get("/hello/greet")).result.expect("answers");
        assert_eq!(first.status, again.status, "the same request must replay");

        let other = host.run(&get("/hello/other")).result.expect("answers");
        assert!(
            (200..=207).contains(&other.status),
            "unexpected status {}",
            other.status
        );
        // Not asserted equal *or* unequal: one byte mod 8 collides one time in
        // eight. What matters is that the seed is not a global constant, which
        // the seed function's own test below pins.
    }

    #[test]
    fn the_entropy_seed_is_a_function_of_the_request() {
        assert_ne!(
            HostState::seed_from(b"one request"),
            HostState::seed_from(b"another request")
        );
        assert_eq!(
            HostState::seed_from(b"one request"),
            HostState::seed_from(b"one request")
        );
    }

    #[test]
    fn a_trap_is_an_error_value_not_a_dead_process() {
        let outcome = host(guests::TRAP).run(&get("/hello/greet"));
        let failure = outcome.result.expect_err("must not answer");
        assert!(matches!(failure, SandboxFailure::Trap(_)), "{failure}");
    }

    #[test]
    fn proc_exit_does_not_exit_the_host() {
        let outcome = host(guests::EXIT).run(&get("/hello/greet"));
        let failure = outcome.result.expect_err("must not answer");
        assert!(matches!(failure, SandboxFailure::Exited(3)), "{failure}");
    }

    #[test]
    fn a_guest_that_never_answers_is_a_failure_not_a_hang() {
        let outcome = host(guests::SILENT).run(&get("/hello/greet"));
        assert!(
            matches!(outcome.result, Err(SandboxFailure::NoAnswer)),
            "{:?}",
            outcome.result
        );
    }

    #[test]
    fn a_module_without_a_start_is_refused_at_load() {
        let err = try_host(guests::NO_START).expect_err("must be refused");
        assert!(matches!(err, SandboxLoadError::MissingStart), "{err}");
    }

    // ── deny-by-default ──────────────────────────────────────────────

    #[test]
    fn a_file_read_is_denied_and_logged() {
        let outcome = host(guests::READ_FILE).run(&get("/hello/greet"));
        assert_eq!(
            denied(&outcome, DeniedCapability::Filesystem),
            vec!["path_open".to_owned()]
        );
        assert_eq!(outcome.result.expect("still answers").status, 200);
    }

    /// A subscriber that records the `capability` / `operation` fields of every
    /// event, so "observable in logs" can be asserted rather than assumed.
    #[derive(Default)]
    struct DenialLog(std::sync::Arc<std::sync::Mutex<Vec<String>>>);

    impl tracing::Subscriber for DenialLog {
        fn enabled(&self, _: &tracing::Metadata<'_>) -> bool {
            true
        }
        fn max_level_hint(&self) -> Option<tracing::level_filters::LevelFilter> {
            Some(tracing::level_filters::LevelFilter::TRACE)
        }
        fn new_span(&self, _: &tracing::span::Attributes<'_>) -> tracing::span::Id {
            tracing::span::Id::from_u64(1)
        }
        fn record(&self, _: &tracing::span::Id, _: &tracing::span::Record<'_>) {}
        fn record_follows_from(&self, _: &tracing::span::Id, _: &tracing::span::Id) {}
        fn event(&self, event: &tracing::Event<'_>) {
            struct Fields<'a>(&'a mut Vec<String>);
            impl tracing::field::Visit for Fields<'_> {
                fn record_debug(&mut self, field: &tracing::field::Field, value: &dyn fmt::Debug) {
                    self.0.push(format!("{}={value:?}", field.name()));
                }
                fn record_str(&mut self, field: &tracing::field::Field, value: &str) {
                    self.0.push(format!("{}={value}", field.name()));
                }
            }
            let mut fields = Vec::new();
            event.record(&mut Fields(&mut fields));
            if let Ok(mut recorded) = self.0.lock() {
                recorded.push(format!(
                    "{} [{}]",
                    event.metadata().level(),
                    fields.join(" ")
                ));
            }
        }
        fn enter(&self, _: &tracing::span::Id) {}
        fn exit(&self, _: &tracing::span::Id) {}
    }

    use rusty_fork::rusty_fork_test;

    rusty_fork_test! {
        #[test]
        fn a_denial_reaches_the_log_and_not_only_the_ledger() {
            // The ledger is what tests read; the log is what an operator reads. If the
            // two could drift, "each denial observable in logs" would be a claim about
            // a field nobody sees. Forked, because `tracing`'s callsite-interest cache
            // and max-level hint are process-global: a sibling test that installs a
            // global subscriber can filter this event out before any thread-local
            // subscriber is consulted, which would make an in-process version of this
            // test pass or fail on test ordering.
            let recorded = std::sync::Arc::new(std::sync::Mutex::new(Vec::new()));
            tracing::subscriber::with_default(
                DenialLog(std::sync::Arc::clone(&recorded)),
                || {
                    let _ = host(guests::READ_FILE).run(&get("/hello/greet"));
                },
            );
            let lines = recorded.lock().expect("not poisoned").clone();
            let denial = lines
                .iter()
                .find(|line| line.contains("operation=path_open"))
                .unwrap_or_else(|| panic!("no denial line in {lines:#?}"));
            assert!(denial.starts_with("WARN"), "{denial}");
            assert!(denial.contains("capability=filesystem"), "{denial}");
            assert!(denial.contains("plugin=autumn-plugin-hello"), "{denial}");
            assert!(denial.contains("no filesystem"), "{denial}");
        }
    }

    #[test]
    fn there_are_no_preopened_directories_to_discover() {
        let outcome = host(guests::DISCOVER_PREOPENS).run(&get("/hello/greet"));
        assert_eq!(
            denied(&outcome, DeniedCapability::Filesystem),
            vec!["fd_prestat_get".to_owned()]
        );
    }

    #[test]
    fn a_stray_descriptor_read_is_denied() {
        let outcome = host(guests::READ_STRAY_FD).run(&get("/hello/greet"));
        assert_eq!(
            denied(&outcome, DeniedCapability::Filesystem),
            vec!["fd_read".to_owned()]
        );
    }

    /// A guest that seeks `fd`, traps unless the answer is `errno`, then
    /// writes a fixed 200 response.
    fn seek_guest(fd: i32, errno: i32) -> String {
        format!(
            r#"(module
  (import "wasi_snapshot_preview1" "fd_seek" (func $seek (param i32 i64 i32 i32) (result i32)))
  (import "wasi_snapshot_preview1" "fd_write" (func $write (param i32 i32 i32 i32) (result i32)))
  (memory (export "memory") 1 1)
  (data (i32.const 128) "{{\"op\":\"response\",\"status\":200,\"headers\":[[\"content-type\",\"text/plain\"]],\"body_b64\":\"b2s=\"}}\0a")
  (func (export "_start")
    (if (i32.ne (call $seek (i32.const {fd}) (i64.const 0) (i32.const 0) (i32.const 0)) (i32.const {errno}))
      (then unreachable))
    (i32.store (i32.const 0) (i32.const 128))
    (i32.store (i32.const 4) (i32.const 91))
    (drop (call $write (i32.const 1) (i32.const 0) (i32.const 1) (i32.const 8)))))"#
        )
    }

    #[test]
    fn seeking_an_unknown_descriptor_is_denied_and_recorded() {
        let outcome = host(&seek_guest(99, 8)).run(&get("/hello/greet"));
        assert_eq!(outcome.result.as_ref().expect("answers").status, 200);
        assert_eq!(
            denied(&outcome, DeniedCapability::Filesystem),
            vec!["fd_seek".to_owned()]
        );
    }

    #[test]
    fn seeking_a_negative_descriptor_is_denied_too() {
        let outcome = host(&seek_guest(-1, 8)).run(&get("/hello/greet"));
        assert_eq!(outcome.result.as_ref().expect("answers").status, 200);
        assert_eq!(
            denied(&outcome, DeniedCapability::Filesystem),
            vec!["fd_seek".to_owned()]
        );
    }

    #[test]
    fn seeking_stdio_is_a_pipe_and_not_a_denial() {
        let outcome = host(&seek_guest(1, 70)).run(&get("/hello/greet"));
        assert_eq!(outcome.result.as_ref().expect("answers").status, 200);
        assert!(outcome.denials.is_empty(), "{:?}", outcome.denials);
    }

    #[test]
    fn outbound_network_is_denied() {
        let outcome = host(guests::NETWORK).run(&get("/hello/greet"));
        assert_eq!(
            denied(&outcome, DeniedCapability::Network),
            vec!["sock_send".to_owned()]
        );
    }

    #[test]
    fn the_environment_is_empty_and_the_attempt_is_logged() {
        let outcome = host(guests::ENVIRONMENT).run(&get("/hello/greet"));
        let ops = denied(&outcome, DeniedCapability::Environment);
        assert_eq!(outcome.result.expect("still answers").status, 200);
        assert!(ops.contains(&"environ_sizes_get".to_owned()), "{ops:?}");
        assert!(ops.contains(&"environ_get".to_owned()), "{ops:?}");
    }

    #[test]
    fn process_arguments_are_empty_and_the_attempt_is_logged() {
        let outcome = host(guests::ARGUMENTS).run(&get("/hello/greet"));
        assert_eq!(
            denied(&outcome, DeniedCapability::Environment),
            vec!["args_sizes_get".to_owned()]
        );
    }

    #[test]
    fn blocking_the_host_on_a_poll_is_denied() {
        let outcome = host(guests::POLL).run(&get("/hello/greet"));
        assert_eq!(
            denied(&outcome, DeniedCapability::ProcessControl),
            vec!["poll_oneoff".to_owned()]
        );
    }

    #[test]
    fn entropy_is_answered_deterministically_rather_than_denied() {
        let host = host(guests::ENTROPY);
        let first = host.run(&get("/hello/greet"));
        let second = host.run(&get("/hello/greet"));
        assert!(first.denials.is_empty(), "{:?}", first.denials);
        assert_eq!(
            first.result.expect("answers"),
            second.result.expect("answers")
        );
    }

    #[test]
    fn a_database_seam_the_host_never_defined_is_refused_at_load() {
        let err = try_host(guests::DATABASE).expect_err("must be refused");
        let SandboxLoadError::ForbiddenImports(denials) = err else {
            panic!("expected a forbidden-import refusal, got {err}");
        };
        assert_eq!(denials.len(), 1);
        assert_eq!(denials[0].capability, DeniedCapability::UnknownImport);
        assert!(denials[0].operation.contains("autumn_db"), "{denials:?}");
    }

    #[test]
    fn a_host_escape_from_an_invented_namespace_is_refused_at_load() {
        let err = try_host(guests::HOST_COMMAND).expect_err("must be refused");
        assert!(
            matches!(err, SandboxLoadError::ForbiddenImports(_)),
            "{err}"
        );
    }

    #[test]
    fn a_wasi_function_this_shim_does_not_implement_is_refused_at_load() {
        let err = try_host(guests::UNDEFINED_WASI).expect_err("must be refused");
        let SandboxLoadError::ForbiddenImports(denials) = err else {
            panic!("expected a forbidden-import refusal, got {err}");
        };
        assert!(denials[0].operation.contains("sock_connect"), "{denials:?}");
    }

    // ── the response is not a trusted channel either ─────────────────

    #[test]
    fn a_forged_session_cookie_is_stripped_and_logged() {
        let outcome = host(guests::FORGE_COOKIE).run(&get("/hello/greet"));
        assert_eq!(
            denied(&outcome, DeniedCapability::ResponseHeader),
            vec!["set-cookie".to_owned()]
        );
        let response = outcome.result.expect("answers");
        assert!(
            !response
                .headers
                .iter()
                .any(|(name, _)| name.eq_ignore_ascii_case("set-cookie")),
            "{:?}",
            response.headers
        );
    }

    #[test]
    fn a_plugin_cannot_borrow_the_reverse_proxy_s_filesystem() {
        let outcome = host(guests::PROXY_REDIRECT).run(&get("/hello/greet"));
        let denied = denied(&outcome, DeniedCapability::ResponseHeader);
        assert!(
            denied.contains(&"x-accel-redirect".to_owned()),
            "{denied:?}"
        );
        assert!(denied.contains(&"x-sendfile".to_owned()), "{denied:?}");
        let response = outcome.result.expect("answers without them");
        assert!(
            response
                .headers
                .iter()
                .all(|(name, _)| name == "content-type"),
            "{:?}",
            response.headers
        );
    }

    #[test]
    fn a_response_splitting_header_never_reaches_a_response() {
        // Two locks on this door: the header allowlist drops the name before
        // anything looks at its value, and `SandboxResponse::validate` refuses a
        // value carrying CRLF for a name that *is* allowed (asserted directly in
        // `wire`). Here the first lock holds, so the guest is served — minus the
        // header, with the attempt on the record.
        let outcome = host(guests::SPLIT_RESPONSE).run(&get("/hello/greet"));
        assert_eq!(
            denied(&outcome, DeniedCapability::ResponseHeader),
            vec!["x-evil".to_owned()]
        );
        let response = outcome.result.expect("answers without the header");
        assert!(
            response
                .headers
                .iter()
                .all(|(name, _)| name == "content-type"),
            "{:?}",
            response.headers
        );
    }

    #[test]
    fn an_impossible_status_is_refused() {
        let outcome = host(guests::IMPOSSIBLE_STATUS).run(&get("/hello/greet"));
        assert!(
            matches!(outcome.result, Err(SandboxFailure::ResponseRefused(_))),
            "{:?}",
            outcome.result
        );
    }

    #[test]
    fn a_guest_error_detail_can_neither_flood_nor_forge_a_log_line() {
        // A guest's `detail` is attacker-controlled text on its way to a log
        // the operator trusts. Two separate hazards: its *length* (a line can
        // be as large as the stdout budget, and a plugin that fails in a loop
        // writes one per request) and its *content* (a newline starts a record
        // the operator did not write; an ANSI escape repaints one they did).
        let outcome = host(guests::FORGE_LOG).run(&get("/hello/greet"));
        let Err(failure) = outcome.result else {
            panic!("the guest reported a failure");
        };
        let rendered = failure.to_string();
        assert!(
            rendered.len() < 4096,
            "a 2 KiB detail reached the log intact: {} bytes",
            rendered.len()
        );
        assert!(
            !rendered.contains('\n') && !rendered.contains('\r'),
            "the detail can start a log record of its own: {rendered:?}"
        );
        assert!(
            !rendered.contains('\u{1b}'),
            "the detail can repaint the operator's terminal: {rendered:?}"
        );
        assert!(
            rendered.contains("forged"),
            "the detail is still legible enough to debug with: {rendered:?}"
        );
    }

    #[test]
    fn a_denied_response_header_name_is_bounded_before_it_is_logged() {
        // The sibling of the content-type cap, on the header *name* rather
        // than its value. A denied name is often denied precisely because it
        // is not a valid header name, so it can carry newlines and escapes as
        // well as megabytes — and `deny` both stores it and logs it.
        let name = "x-".to_owned() + &"y".repeat(20_000);
        let frame = format!(
            r#"{{"op":"response","status":200,"headers":[["content-type","text/plain"],["{name}","v"]],"body_b64":""}}"#
        );
        let len = frame.len() + 1;
        let wat = format!(
            r#"(module
  (import "wasi_snapshot_preview1" "fd_write" (func $fd_write (param i32 i32 i32 i32) (result i32)))
  (memory (export "memory") 2)
  (data (i32.const 1024) "{escaped}\0a")
  (func (export "_start")
    (i32.store (i32.const 0) (i32.const 1024))
    (i32.store (i32.const 4) (i32.const {len}))
    (drop (call $fd_write (i32.const 1) (i32.const 0) (i32.const 1) (i32.const 8)))))"#,
            escaped = frame.replace('"', "\\\""),
        );

        let outcome = host(&wat).run(&get("/hello/greet"));
        let logged = outcome
            .denials
            .iter()
            .find(|denial| denial.capability == DeniedCapability::ResponseHeader)
            .expect("the stripped header is recorded as a denial");
        assert!(
            logged.operation.len() < 1_024,
            "the denial carries the guest's whole header name: {} bytes",
            logged.operation.len()
        );
        assert!(
            logged.operation.contains("truncated"),
            "{:?}",
            logged.operation
        );
    }

    #[test]
    fn a_refused_content_type_is_bounded_before_it_is_logged() {
        // `refused_content_type` takes everything before the first `;`, so a
        // guest that writes no parameter hands back its entire header value —
        // capped only by the stdout ceiling, which is megabytes. That string
        // reached both the denial detail and the `ResponseRefused` text, and
        // both are logged, so a guest could flood an operator's log with a
        // header rather than with output.
        let essence = "x".repeat(20_000);
        let frame = format!(
            r#"{{"op":"response","status":200,"headers":[["content-type","{essence}"]],"body_b64":""}}"#
        );
        // The frame is ASCII, so its byte length is its char length; + 1 for
        // the newline that ends it. The WAT literal needs its quotes escaped,
        // which changes the *source* length but not the decoded bytes.
        let len = frame.len() + 1;
        let wat = format!(
            r#"(module
  (import "wasi_snapshot_preview1" "fd_write" (func $fd_write (param i32 i32 i32 i32) (result i32)))
  (memory (export "memory") 2)
  (data (i32.const 1024) "{escaped}\0a")
  (func (export "_start")
    (i32.store (i32.const 0) (i32.const 1024))
    (i32.store (i32.const 4) (i32.const {len}))
    (drop (call $fd_write (i32.const 1) (i32.const 0) (i32.const 1) (i32.const 8)))))"#,
            escaped = frame.replace('"', "\\\""),
        );

        let outcome = host(&wat).run(&get("/hello/greet"));
        let Err(SandboxFailure::ResponseRefused(detail)) = outcome.result else {
            panic!(
                "an unsupported content type must be refused: {:?}",
                outcome.result
            );
        };
        assert!(
            detail.len() < 1_024,
            "the failure text carries the guest's whole header: {} bytes",
            detail.len()
        );
        assert!(detail.contains("truncated"), "{detail}");

        let logged = outcome
            .denials
            .iter()
            .find(|denial| denial.capability == DeniedCapability::ResponseHeader)
            .expect("the refusal is recorded as a denial");
        assert!(
            logged.detail.len() < 1_024,
            "the denial detail carries the guest's whole header: {} bytes",
            logged.detail.len()
        );
    }

    #[test]
    fn an_element_offset_this_cannot_evaluate_is_refused_like_a_data_offset() {
        // The data walk learned to refuse an active segment whose offset it
        // cannot evaluate; the element walk beside it still skipped one. Same
        // fail-open, same shape, in the sibling — an active element segment is
        // written into its table at instantiation whether or not this can work
        // out where, so skipping the check because the offset is unknown is the
        // check silently not running.
        let mut operands = String::new();
        let mut adds = String::new();
        for _ in 0..24 {
            operands.push_str("i32.const 0 ");
            adds.push_str("i32.add ");
        }
        let wat = format!(
            r#"(module
  (table 1 funcref)
  (memory (export "memory") 1)
  (func $f (export "_start") (nop))
  (elem (offset i32.const 65536 {operands} {adds}) $f)
)"#
        );
        let wasm = wat::parse_str(&wat).expect("the fixture is valid WAT");

        let mut config = wasmi::Config::default();
        config.consume_fuel(true);
        wasmi::Module::new(&wasmi::Engine::new(&config), &wasm[..])
            .expect("wasmi compiles a deep extended-const offset; the finding depends on it");

        let err = SandboxHost::from_module(manifest_with(ResourceLimits::default()), &wasm)
            .expect_err("an active element segment with an unevaluable offset must be refused");
        assert!(
            matches!(
                err,
                SandboxLoadError::SegmentOutOfBounds {
                    what: "table elements",
                    ..
                }
            ),
            "{err:?}",
        );

        // A passive element segment writes nothing at instantiation, so an
        // offset it has no need of cannot make it refusable.
        let passive = wat::parse_str(
            r#"(module
  (table 1 funcref)
  (memory (export "memory") 1)
  (func $f (export "_start") (nop))
  (elem funcref (ref.func $f))
)"#,
        )
        .expect("the fixture is valid WAT");
        SandboxHost::from_module(manifest_with(ResourceLimits::default()), &passive)
            .expect("a passive element segment must still load");
    }

    #[test]
    fn deciding_a_header_does_not_cross_costs_nothing_to_decide() {
        // The value clone was the obvious half. The name is the same trap one step
        // smaller: looking a header up in the allowlist by lower-casing it first
        // allocates a copy of a string the caller chose the length of, only to conclude
        // it is not wanted. And a dropped header is no longer charged against the
        // metadata ceiling — rightly, it never crosses — so nothing bounds how large
        // that name may be. The predicate now compares in place. Asserted by behaviour
        // rather than by allocation here, since `tests/sandbox_header_alloc_gate.rs`
        // does the measuring: a name that cannot be an allowlisted header must be
        // rejected without the length ever mattering.
        let enormous = "x".repeat(4 * 1024 * 1024);
        assert!(!super::super::wire::request_header_allowed(&enormous));

        // Case-insensitive, because HTTP header names are — which is what lets
        // the caller skip the lower-casing rather than merely defer it.
        assert!(super::super::wire::request_header_allowed("Accept"));
        assert!(super::super::wire::request_header_allowed("ACCEPT"));
        assert!(super::super::wire::request_header_allowed("accept"));
        assert!(!super::super::wire::request_header_allowed("Cookie"));

        // And the canonical form is still what reaches the guest, so accepting
        // a mixed-case name does not mean forwarding one.
        let canonical = super::super::wire::canonicalize_headers(&[(
            "AcCePt".to_owned(),
            "text/plain".to_owned(),
        )]);
        assert_eq!(
            canonical,
            vec![("accept".to_owned(), "text/plain".to_owned())],
        );
    }

    #[test]
    fn encoding_fuel_prices_the_sizing_pass_of_the_line() {
        // `to_line` serialises twice: once to count, once to write. The count
        // still encodes and escapes everything, so it is host work the guest's
        // fuel must pay for. Three raw walks and five expanded ones (encode and
        // escape-scan in each pass, plus the seed scan) make 9 2/3 of the body.
        let mut request = get("/hello/greet");
        request.body = vec![b'x'; 60_000];
        let charged_bytes = encoding_fuel(&request).saturating_mul(BYTES_PER_FUEL);
        assert!(
            charged_bytes >= 60_000 * 29 / 3,
            "the charge ({charged_bytes}) leaves the sizing pass free"
        );
    }

    #[test]
    fn encoding_fuel_prices_the_line_that_is_written_not_the_bytes_handed_in() {
        // A flat multiplier over the raw input under-charged, because most of the walks
        // are over the expanded form: base64 grows the body by 4/3 and every pass after
        // the encode is over that, while `serde_json` writes a control character as six
        // bytes and `seed_from` then reads the whole finished line. A request could buy
        // host work the ceiling never saw. Measured against what the serialiser actually
        // writes, so the factors cannot drift from the encoding they claim to cover.
        let granted = [SandboxCapability::HttpRequest];

        let mut request = get("/hello/greet");
        request.body = vec![b'x'; 60_000];
        let line = crate::plugin_sandbox::wire::to_line(
            &crate::plugin_sandbox::wire::HostFrame::request(&request, &granted),
        )
        .expect("serialises")
        .len();

        // The charge has to cover writing that line and reading it back at
        // least once — the seed scan — on top of the copies before it.
        let charged_bytes = encoding_fuel(&request).saturating_mul(BYTES_PER_FUEL);
        assert!(
            charged_bytes >= (line as u64).saturating_mul(2),
            "the charge ({charged_bytes}) is under writing and re-reading a \
             {line}-byte line",
        );

        // The metadata side expands further than the body does, so it must be
        // charged at a higher rate rather than at one flat factor for both.
        let mut escaped = get("/hello/greet");
        escaped.query = "\u{0}".repeat(10_000);
        let mut plain = get("/hello/greet");
        plain.query = "a".repeat(10_000);
        assert!(
            encoding_fuel(&escaped) == encoding_fuel(&plain),
            "the charge is computed from raw sizes, so it must not vary with \
             content — it is an upper bound taken before the line exists",
        );
        let escaped_line = crate::plugin_sandbox::wire::to_line(
            &crate::plugin_sandbox::wire::HostFrame::request(&escaped, &granted),
        )
        .expect("serialises")
        .len();
        let escaped_charge = encoding_fuel(&escaped).saturating_mul(BYTES_PER_FUEL);
        assert!(
            escaped_charge >= (escaped_line as u64).saturating_mul(2),
            "the charge ({escaped_charge}) is under writing and re-reading a \
             JSON-escaped {escaped_line}-byte line",
        );
    }

    #[test]
    fn direct_run_does_not_charge_for_headers_the_frame_will_drop() {
        // `HostFrame::request` filters headers through the allowlist, so a
        // `Cookie` or `Authorization` never reaches the guest. Counting those
        // bytes against the metadata ceiling refused a request that would have
        // cost nothing — and made `SandboxHost::run`, which is public, stricter
        // than the adapter that is merely its politest caller.
        let host = host(guests::HELLO);

        let mut credential_heavy = get("/hello/greet");
        credential_heavy.headers = vec![
            ("cookie".to_owned(), "s=".repeat(MAX_REQUEST_METADATA_BYTES)),
            (
                "authorization".to_owned(),
                "t=".repeat(MAX_REQUEST_METADATA_BYTES),
            ),
        ];
        assert!(
            request_metadata_bytes(&credential_heavy) < MAX_REQUEST_METADATA_BYTES,
            "headers the frame drops are still being charged for",
        );
        assert!(
            host.run(&credential_heavy).result.is_ok(),
            "a request whose only bulk is dropped headers must still be served",
        );

        // And the ceiling still holds for headers that *do* cross, or it would
        // have stopped bounding anything.
        let mut allowed_heavy = get("/hello/greet");
        allowed_heavy.headers = vec![(
            "accept".to_owned(),
            "text/plain, ".repeat(MAX_REQUEST_METADATA_BYTES),
        )];
        let err = host
            .run(&allowed_heavy)
            .result
            .expect_err("oversized allowlisted metadata must still be refused");
        assert!(
            matches!(err, SandboxFailure::RequestMetadataBudget { .. }),
            "{err:?}",
        );
    }

    #[test]
    fn a_module_of_nothing_but_custom_sections_is_refused_without_reading_them_all() {
        // Every other shape ceiling is read from a section's leading count.
        // A custom section has no count — a name and opaque bytes — so it was
        // excluded from `declared_entries` and contributed to nothing, while
        // costing three bytes to encode. The refusal that is supposed to be
        // cheap became the expensive part.
        let mut wasm = Vec::from(b"\0asm\x01\0\0\0".as_slice());
        // Empty custom section: id 0, size 1, a zero-length name.
        for _ in 0..=MAX_SECTIONS {
            wasm.extend_from_slice(&[CUSTOM_SECTION, 0x01, 0x00]);
        }
        let shape = module_shape(&wasm).expect("the header walk must not fail on legal sections");

        // The walk stopped at the ceiling rather than reading every header.
        assert_eq!(
            shape.sections,
            MAX_SECTIONS + 1,
            "the walk read past the ceiling instead of stopping at it",
        );

        let err = refuse_unbounded_shape(&wasm)
            .expect_err("a module past the section ceiling must be refused");
        assert!(
            matches!(
                err,
                SandboxLoadError::InstantiationTooExpensive {
                    what: "sections",
                    ..
                }
            ),
            "{err:?}",
        );

        // And an ordinary module, which carries a handful of sections, is not
        // caught by this — or the ceiling would refuse every real plugin.
        let hello = wat::parse_str(guests::HELLO).expect("the fixture is valid WAT");
        let shape = module_shape(&hello).expect("a real module walks");
        assert!(
            shape.sections <= MAX_SECTIONS,
            "a real module carries {} sections, at or over the ceiling",
            shape.sections,
        );
        refuse_unbounded_shape(&hello).expect("a real module must still load");
    }

    #[test]
    fn a_module_declaring_a_second_memory_is_refused_at_load_not_once_per_request() {
        // wasmi enables the multi-memory proposal by default, so `Module::new`
        // compiles this happily and only the `MemoryLimiter` objects — and it
        // objects at instantiation, which is per request. The artifact would
        // pass `autumn plugin inspect` and then answer every request with a
        // gateway error, which is the shape this file already refuses
        // elsewhere: a passing verdict on an artifact that can only ever 504 is
        // worse than no verdict, because an operator installs on it.
        let wat = r#"(module
  (memory (export "memory") 1)
  (memory 1)
  (func (export "_start") (nop))
)"#;
        let wasm = wat::parse_str(wat).expect("the fixture is valid WAT");

        // First, that the engine really does accept it — a fix for a module the
        // compiler already rejects would be guarding nothing.
        let mut config = wasmi::Config::default();
        config.consume_fuel(true);
        let engine = wasmi::Engine::new(&config);
        wasmi::Module::new(&engine, &wasm[..])
            .expect("wasmi enables multi-memory by default; if this fails the ceiling is moot");

        let err = SandboxHost::from_module(manifest_with(ResourceLimits::default()), &wasm)
            .expect_err("a second memory must be refused at load");
        assert!(
            matches!(
                err,
                SandboxLoadError::InstantiationTooExpensive {
                    what: "linear memories",
                    ..
                }
            ),
            "{err:?}",
        );

        // And refused *before* `Module::new`, not after it. The pre-compilation
        // gate is a separate function precisely so that a shape guaranteed to
        // be rejected does not first get a representation built for every
        // declaration in it — so the ceiling has to live there rather than
        // merely be reached eventually. Asserted by calling that gate directly:
        // it is what runs ahead of the compiler.
        let err = refuse_unbounded_shape(&wasm)
            .expect_err("the pre-compilation gate must refuse it, not a later one");
        assert!(
            matches!(
                err,
                SandboxLoadError::InstantiationTooExpensive {
                    what: "linear memories",
                    ..
                }
            ),
            "{err:?}",
        );

        // One memory is the normal case and still loads.
        let single = wat::parse_str(
            r#"(module (memory (export "memory") 1) (func (export "_start") (nop)))"#,
        )
        .expect("the fixture is valid WAT");
        SandboxHost::from_module(manifest_with(ResourceLimits::default()), &single)
            .expect("a single-memory module must still load");
    }

    #[test]
    fn a_long_import_name_is_not_copied_whole_in_order_to_refuse_it() {
        // `MAX_IMPORTS` bounds how many names a module may declare; nothing on this
        // side bounded how long one may be. wasmparser caps a single name at 100 KB, so
        // this is not module-sized — but `MAX_DENIALS` is 64, and the denial copied the
        // whole name, `Display` cloned it again, and the join built a third copy. That
        // is megabytes of host memory to refuse one artifact, repeatable, in the process
        // of trying to reject it. Observable in what comes out: a bounded operation
        // cannot be longer than the bound, however long the name was.
        let huge = "z".repeat(99_000);
        let wat = format!(
            r#"(module
  (import "not_wasi" "{huge}" (func))
  (memory (export "memory") 1)
  (func (export "_start") (nop))
)"#
        );
        let wasm = wat::parse_str(&wat).expect("the fixture is valid WAT");

        let err = SandboxHost::from_module(manifest_with(ResourceLimits::default()), &wasm)
            .expect_err("an import the sandbox does not provide must be refused");
        let SandboxLoadError::ForbiddenImports(denials) = &err else {
            panic!("{err:?}");
        };
        assert_eq!(denials.len(), 1);
        assert!(
            denials[0].operation.len() <= DENIAL_RECORD_BYTES,
            "the denial carries {} bytes of a {}-byte name — it was copied whole \
             in order to reject it",
            denials[0].operation.len(),
            huge.len(),
        );
        assert!(
            denials[0].operation.starts_with("not_wasi::"),
            "the operation must still say what was imported: {}",
            &denials[0].operation[..denials[0].operation.len().min(64)],
        );

        // And rendering the error does not rebuild it either. `Display` is what
        // `autumn plugin package`/`inspect` call before excerpting, so a copy
        // made here lands in the process trying to refuse the artifact.
        let rendered = err.to_string();
        assert!(
            rendered.len() <= DENIAL_RECORD_BYTES.saturating_mul(2),
            "rendering the refusal produced {} bytes from a {}-byte name",
            rendered.len(),
            huge.len(),
        );
    }

    #[test]
    fn a_table_the_instance_fills_is_charged_like_the_memory_it_fills() {
        // The memory term exists because a module can declare an initial size
        // with no data segments, so the init-section terms price none of it
        // while the host still zero-fills it every instantiation. A table's
        // minimum is the same shape and was not charged: `segments` and
        // `init_bytes` see nothing, and wasmi still allocates and initialises
        // every slot before the guest runs.
        let bare = instantiation_fuel(0, 0, 0, 0, 0, 0);
        let with_table = instantiation_fuel(0, 0, 0, 0, 0, u64::from(MAX_TABLE_ELEMENTS));
        assert!(
            with_table > bare,
            "a full table cost the same as no table at all ({with_table} vs {bare})",
        );
        assert_eq!(
            with_table - bare,
            u64::from(MAX_TABLE_ELEMENTS),
            "the charge should be one unit per slot the instance initialises",
        );

        // End to end: a module whose only weight is its table must be refused
        // when its fuel cannot cover filling it. Zero-page memory and no
        // segments, so every other fixed term is at its floor.
        let wat = format!(
            r#"(module
  (memory (export "memory") 0)
  (table {MAX_TABLE_ELEMENTS} funcref)
  (func (export "_start") (nop))
)"#
        );
        let wasm = wat::parse_str(&wat).expect("the fixture is valid WAT");
        let limits = ResourceLimits {
            fuel: u64::from(MAX_TABLE_ELEMENTS) / 2,
            ..ResourceLimits::default()
        };
        let err = SandboxHost::from_module(manifest_with(limits), &wasm)
            .expect_err("fuel below the cost of filling the table must be refused");
        assert!(
            matches!(err, SandboxLoadError::FuelBelowFixedCharges { .. }),
            "{err:?}",
        );

        // And the same module loads once its budget covers the table, so the
        // charge bounds rather than forbids.
        SandboxHost::from_module(manifest_with(ResourceLimits::default()), &wasm)
            .expect("a table within a normal fuel budget must still load");
    }

    #[test]
    fn the_review_list_bounds_an_import_name_where_it_builds_it() {
        // The sibling of the denial-path fix, and the site it did not reach.
        // `reported_imports` bounded how *many* names it formatted and not how
        // long each one was, so 256 entries could each be as long as an
        // artifact cared to make them. The review surface does excerpt them —
        // afterwards, which is one copy too late to be the bound.
        let huge = "z".repeat(99_000);
        let wat = format!(
            r#"(module
  (import "not_wasi" "{huge}" (func))
  (memory (export "memory") 1)
  (func (export "_start") (nop))
)"#
        );
        let wasm = wat::parse_str(&wat).expect("the fixture is valid WAT");

        let imports = SandboxHost::imports_of(&wasm).expect("the module's shape is readable");
        assert_eq!(imports.len(), 1);
        assert!(
            imports[0].len() <= DENIAL_RECORD_BYTES,
            "the review list carries {} bytes of a {}-byte name",
            imports[0].len(),
            huge.len(),
        );
        assert!(
            imports[0].starts_with("not_wasi::"),
            "the entry must still say what is imported: {}",
            &imports[0][..imports[0].len().min(64)],
        );
    }

    #[test]
    fn one_oversized_element_section_is_not_walked_before_it_is_refused() {
        // The count ceiling and the byte ceiling each refuse a module on their own, so
        // the walk should be skipped when either is exceeded. Only the count gated it,
        // and a single segment keeps the count at one, so the walk ran over the section
        // on the way to a refusal the byte ceiling had already decided. Observable
        // through what the walk reports: the segment here overflows its table, so a walk
        // that runs finds `Some(..)` and a walk that is skipped leaves `None`. The
        // module is refused either way, which is why the verdict cannot be what this
        // test looks at.
        let mut wasm = Vec::from(b"\0asm\x01\0\0\0".as_slice());
        // One table, funcref, minimum 1 — so five elements written at offset 0
        // is an overflow the walk would report.
        wasm.extend_from_slice(&[TABLE_SECTION, 0x04, 0x01, 0x70, 0x00, 0x01]);

        let body_len = MAX_INIT_SECTION_BYTES + 1;
        wasm.push(ELEMENT_SECTION);
        let mut size = body_len;
        while size >= 0x80 {
            let low = u8::try_from(size & 0x7f).expect("masked to seven bits");
            wasm.push(low | 0x80);
            size >>= 7;
        }
        wasm.push(u8::try_from(size).expect("the loop leaves under 0x80"));
        let before_body = wasm.len();
        // count = 1; then an active segment: table 0, offset `i32.const 0`,
        // five function indices. The rest of the section is padding the walk
        // never reads — it is there only to carry the section over the byte
        // ceiling.
        wasm.extend_from_slice(&[0x01, 0x00, 0x41, 0x00, 0x0b, 0x05, 0, 0, 0, 0, 0]);
        wasm.resize(before_body + body_len, 0);

        let shape = module_shape(&wasm).expect("the header walk must not fail");
        assert_eq!(
            shape.segments, 1,
            "the count ceiling is not what refuses it"
        );
        assert!(
            shape.init_bytes > MAX_INIT_SECTION_BYTES,
            "the fixture should be over the byte ceiling",
        );
        assert!(
            shape.element_overflow.is_none(),
            "the segment walk ran on a section the byte ceiling already refuses: {:?}",
            shape.element_overflow,
        );

        let err =
            refuse_unbounded_shape(&wasm).expect_err("an oversized init section must be refused");
        assert!(
            matches!(
                err,
                SandboxLoadError::InstantiationTooExpensive {
                    what: "bytes of data and element sections",
                    ..
                }
            ),
            "{err:?}",
        );
    }

    #[test]
    fn one_segment_cannot_declare_more_entries_than_the_ceiling_allows() {
        // `declared_entries` sums each section's leading count, one LEB128 per section,
        // which is what makes reading the shape cheap. The element section is the one
        // place that undercounts: its leading count is the number of segments, and a
        // segment carries its own count of items. So one passive segment holding
        // millions of function indices added exactly one to the ceiling that exists to
        // bound declarations before anything allocates per declaration.
        //
        // Nothing else caught it. `MAX_TABLE_ELEMENTS` bounds what a table starts with,
        // and a passive segment is never written to a table; `MAX_INIT_SEGMENTS` counts
        // segments, and there is one; and the byte ceiling admits a 16 MiB section,
        // which is millions of one-byte indices. The walk then read every one of them,
        // and `Module::new` expanded the whole initializer list after it.
        fn uleb(mut value: usize, out: &mut Vec<u8>) {
            while value >= 0x80 {
                let low = u8::try_from(value & 0x7f).expect("masked to seven bits");
                out.push(low | 0x80);
                value >>= 7;
            }
            out.push(u8::try_from(value).expect("the loop leaves under 0x80"));
        }

        // One passive segment (flags 1, elemkind 0x00) declaring one item more
        // than the ceiling admits, each a one-byte `funcidx 0`.
        let items = MAX_DECLARED_ENTRIES + 1;
        let mut body = vec![0x01, 0x01, 0x00];
        uleb(items, &mut body);
        body.resize(body.len() + items, 0x00);

        let mut wasm = Vec::from(b"\0asm\x01\0\0\0".as_slice());
        wasm.extend_from_slice(&[0x01, 0x04, 0x01, 0x60, 0x00, 0x00]); // type () -> ()
        wasm.extend_from_slice(&[0x03, 0x02, 0x01, 0x00]); // one function
        wasm.extend_from_slice(&[TABLE_SECTION, 0x04, 0x01, 0x70, 0x00, 0x01]);
        wasm.push(ELEMENT_SECTION);
        uleb(body.len(), &mut wasm);
        wasm.extend_from_slice(&body);

        // The fixture has to clear every *other* ceiling, or it would be
        // refused for a reason that has nothing to do with the nested count.
        let shape = module_shape(&wasm).expect("the header walk must not fail");
        assert!(
            shape.segments <= MAX_INIT_SEGMENTS,
            "the segment count is not what refuses this fixture",
        );
        assert!(
            shape.init_bytes <= MAX_INIT_SECTION_BYTES,
            "the byte ceiling is not what refuses this fixture: {}",
            shape.init_bytes,
        );
        assert!(
            shape.table_elements <= u64::from(MAX_TABLE_ELEMENTS),
            "the table ceiling is not what refuses this fixture",
        );
        assert!(
            shape.declared_entries > MAX_DECLARED_ENTRIES,
            "the segment's own items never reached the ceiling: {}",
            shape.declared_entries,
        );

        let err = refuse_unbounded_shape(&wasm)
            .expect_err("a segment over the entry ceiling must be refused");
        assert!(
            matches!(
                err,
                SandboxLoadError::InstantiationTooExpensive {
                    what: "declared section entries",
                    ..
                }
            ),
            "{err:?}",
        );

        // And the count is read *before* the items are, which is what keeps the
        // refusal from costing what it refuses. Here the section claims far
        // more items than it carries: a walk that reads them runs off the end
        // of the section and reports nothing, leaving the module to be refused
        // for some later reason — or not at all. One that stops at the ceiling
        // still refuses it, from the count alone.
        let mut truncated = Vec::from(b"\0asm\x01\0\0\0".as_slice());
        truncated.extend_from_slice(&[TABLE_SECTION, 0x04, 0x01, 0x70, 0x00, 0x01]);
        let mut claim = vec![0x01, 0x01, 0x00];
        uleb(MAX_DECLARED_ENTRIES * 16, &mut claim);
        claim.extend_from_slice(&[0x00, 0x00, 0x00]);
        truncated.push(ELEMENT_SECTION);
        uleb(claim.len(), &mut truncated);
        truncated.extend_from_slice(&claim);

        let err = refuse_unbounded_shape(&truncated)
            .expect_err("a section claiming more entries than it carries must be refused");
        assert!(
            matches!(
                err,
                SandboxLoadError::InstantiationTooExpensive {
                    what: "declared section entries",
                    ..
                }
            ),
            "the count was not consulted before the items were walked: {err:?}",
        );
    }

    #[test]
    fn the_engine_refuses_a_heap_type_this_walk_would_have_to_guess_at() {
        // `skip_const_expr` reads `ref.null`'s heap type as a signed LEB rather than a
        // byte. Today that is the same one byte for every heap type the engine accepts
        // — this test is what says so, and what would notice if it stopped being true.
        // A non-minimal encoding of `funcref` (0xf0 0x7f decodes to -16, the same value
        // as 0x70) is the case a byte-wide read would desynchronise on. wasmi refuses it
        // outright, so no such module reaches instantiation: the walk cannot be led out
        // of step by it, and the load-time bounds check cannot be skipped through it.
        let mut module = Vec::from(b"\0asm\x01\0\0\0".as_slice());
        module.extend_from_slice(&[0x01, 0x04, 0x01, 0x60, 0x00, 0x00]); // type () -> ()
        module.extend_from_slice(&[0x03, 0x02, 0x01, 0x00]); // one function
        module.extend_from_slice(&[0x04, 0x04, 0x01, 0x70, 0x00, 0x01]); // table funcref, min 1
        module.extend_from_slice(&[0x05, 0x03, 0x01, 0x00, 0x01]); // memory, min 1
        module.extend_from_slice(&[0x07, 0x13, 0x02, 0x06]);
        module.extend_from_slice(b"memory");
        module.extend_from_slice(&[0x02, 0x00, 0x06]);
        module.extend_from_slice(b"_start");
        module.extend_from_slice(&[0x00, 0x00]);
        let code = [0x0a, 0x05, 0x01, 0x03, 0x00, 0x01, 0x0b];

        let mut config = wasmi::Config::default();
        config.consume_fuel(true);
        let engine = wasmi::Engine::new(&config);

        // The minimal form compiles, which is what makes the comparison mean
        // something: the fixture is well formed apart from the heap type.
        let mut minimal = module.clone();
        minimal.extend_from_slice(&[
            0x09, 0x09, 0x01, 0x04, 0x41, 0x00, 0x0b, 0x01, 0xd0, 0x70, 0x0b,
        ]);
        minimal.extend_from_slice(&code);
        wasmi::Module::new(&engine, &minimal[..]).expect("the minimal heap type compiles");

        // The non-minimal form does not.
        let mut non_minimal = module;
        non_minimal.extend_from_slice(&[
            0x09, 0x0a, 0x01, 0x04, 0x41, 0x00, 0x0b, 0x01, 0xd0, 0xf0, 0x7f, 0x0b,
        ]);
        non_minimal.extend_from_slice(&code);
        let err = wasmi::Module::new(&engine, &non_minimal[..])
            .expect_err("a non-minimal heap type must not compile");
        assert!(
            err.to_string().contains("heap type"),
            "expected the engine to name the heap type: {err}",
        );
    }

    #[test]
    fn a_swarm_of_empty_tables_is_refused_before_anything_is_compiled() {
        // The sibling of the memory case, and the reason all three ceilings
        // moved together. A module can declare far more tables than
        // `MAX_TABLES` while staying under `MAX_DECLARED_ENTRIES`, so nothing
        // else refuses it — and while the table ceiling did refuse it, it
        // refused after `Module::new` had already built a representation of
        // every declaration. The right answer at the wrong time.
        let mut wat = String::from("(module\n  (memory (export \"memory\") 1)\n");
        for _ in 0..=MAX_TABLES {
            wat.push_str("  (table 0 funcref)\n");
        }
        wat.push_str("  (func (export \"_start\") (nop))\n)");
        let wasm = wat::parse_str(&wat).expect("the fixture is valid WAT");

        // Under the aggregate ceiling, so `MAX_DECLARED_ENTRIES` is not what
        // catches this — otherwise the test would pass for the wrong reason.
        let shape = module_shape(&wasm).expect("the header walk must not fail");
        assert!(
            shape.declared_entries <= MAX_DECLARED_ENTRIES,
            "the fixture is caught by the aggregate ceiling, not the table one",
        );

        let err = refuse_unbounded_shape(&wasm)
            .expect_err("the pre-compilation gate must refuse too many tables");
        assert!(
            matches!(
                err,
                SandboxLoadError::InstantiationTooExpensive { what: "tables", .. }
            ),
            "{err:?}",
        );

        // And the third of the three: tables that are already over the element
        // ceiling at rest, also refused before compiling.
        let heavy = wat::parse_str(format!(
            "(module (memory (export \"memory\") 1) (table {} funcref) \
             (func (export \"_start\") (nop)))",
            u64::from(MAX_TABLE_ELEMENTS) + 1,
        ))
        .expect("the fixture is valid WAT");
        let err = refuse_unbounded_shape(&heavy)
            .expect_err("the pre-compilation gate must refuse oversized tables");
        assert!(
            matches!(
                err,
                SandboxLoadError::InstantiationTooExpensive {
                    what: "initial table elements",
                    ..
                }
            ),
            "{err:?}",
        );
    }

    #[test]
    fn the_metadata_walk_stops_at_the_ceiling_instead_of_finishing_the_list() {
        // Charging every entry made an oversized list fail. It did not bound the work of
        // discovering that it fails — the fold visited every pair first, before the
        // permit was taken and before the guest spent any fuel — so an unbounded list
        // still bought an unbounded scan per concurrent caller. Fixing the verdict is
        // not fixing the cost. Observable because a stopped walk returns a floor: run to
        // the end and the answer is the whole sum, stop at the ceiling and it is barely
        // past it. Same instrument as the section walk.
        let over = MAX_REQUEST_METADATA_BYTES / DROPPED_PAIR_BYTES * 16;
        let mut swarm = get("/hello/greet");
        swarm.headers = std::iter::repeat_with(|| ("cookie".to_owned(), String::new()))
            .take(over)
            .collect();

        let counted = request_metadata_bytes(&swarm);
        let whole_list = over.saturating_mul(DROPPED_PAIR_BYTES);
        assert!(
            counted <= MAX_REQUEST_METADATA_BYTES + DROPPED_PAIR_BYTES,
            "the walk counted {counted} bytes, past the ceiling plus the entry \
             that crossed it — it finished the list instead of stopping",
        );
        assert!(
            counted < whole_list / 2,
            "the walk counted {counted} of a {whole_list}-byte list, so it did \
             not stop early",
        );

        // Stopping early must not stop it refusing.
        let host = host(guests::HELLO);
        let err = host
            .run(&swarm)
            .result
            .expect_err("a list past the ceiling must still be refused");
        assert!(
            matches!(err, SandboxFailure::RequestMetadataBudget { .. }),
            "{err:?}",
        );

        // And a request under the ceiling is still counted in full, or the
        // charge the ceiling is made of would be wrong for every real request.
        let mut ordinary = get("/hello/greet");
        ordinary.headers = vec![("accept".to_owned(), "text/plain".to_owned())];
        assert_eq!(
            request_metadata_bytes(&ordinary),
            ordinary.method.len()
                + ordinary.path.len()
                + ordinary.query.len()
                + ordinary.route.len()
                + metadata_pair_bytes("accept", "text/plain"),
        );
    }

    #[test]
    fn a_header_the_frame_drops_still_costs_its_place_in_the_list() {
        // Not charging a dropped header's *contents* is right — they never
        // cross. Not charging it at all left the count unbounded, which is a
        // different resource: the list is walked once for the ceiling, once to
        // price the encoding, and once to filter it out, all before a permit is
        // taken and before the guest spends any fuel. So a million empty
        // `Cookie` pairs passed a byte ceiling for free and bought three
        // unbounded scans per request, per concurrent caller.
        let host = host(guests::HELLO);

        // Still admitted: bulk in a dropped header is bulk that costs the guest
        // nothing, and refusing it would make withholding a credential into a
        // reason to fail the request.
        let mut one_huge_cookie = get("/hello/greet");
        one_huge_cookie.headers =
            vec![("cookie".to_owned(), "s=".repeat(MAX_REQUEST_METADATA_BYTES))];
        assert!(
            host.run(&one_huge_cookie).result.is_ok(),
            "one large dropped header must still be served",
        );

        // Refused: the same total, spread across entries instead of into one
        // value. Nothing here reaches the guest either, but the host walks
        // every one of them to establish that.
        let many_empty_cookies: Vec<(String, String)> =
            std::iter::repeat_with(|| ("cookie".to_owned(), String::new()))
                .take(MAX_REQUEST_METADATA_BYTES / DROPPED_PAIR_BYTES + 1)
                .collect();
        let mut swarm = get("/hello/greet");
        swarm.headers = many_empty_cookies;
        let err = host
            .run(&swarm)
            .result
            .expect_err("an unbounded list of dropped headers must be refused");
        assert!(
            matches!(err, SandboxFailure::RequestMetadataBudget { .. }),
            "{err:?}",
        );
    }

    #[test]
    fn an_active_offset_this_cannot_evaluate_is_refused_rather_than_skipped() {
        // The extended-const fix closed the door where the walk failed. This is the
        // other door: the walk succeeds and an active segment's offset cannot be
        // evaluated. The old code reported that as "no active write to measure",
        // indistinguishable from a passive-only section, so the segment was copied in
        // at instantiation with nothing having checked where it lands. The expression
        // below is flat rather than folded: every operand is pushed before any add
        // runs, so it is the stack that is exceeded, not the parser. wasmi compiles it
        // happily.
        let mut operands = String::new();
        for _ in 0..24 {
            operands.push_str("i32.const 0 ");
        }
        let mut adds = String::new();
        for _ in 0..24 {
            adds.push_str("i32.add ");
        }
        let wat = format!(
            r#"(module
  (memory (export "memory") 1)
  (data (offset i32.const 65536 {operands} {adds}) "xx")
  (func (export "_start") (nop))
)"#
        );
        let wasm = wat::parse_str(&wat).expect("the fixture is valid WAT");

        let mut config = wasmi::Config::default();
        config.consume_fuel(true);
        wasmi::Module::new(&wasmi::Engine::new(&config), &wasm[..])
            .expect("wasmi compiles a deep extended-const offset; the finding depends on it");

        let shape = module_shape(&wasm).expect("the section still walks cleanly");
        assert_eq!(
            shape.data_end,
            u64::MAX,
            "an offset that cannot be evaluated must be treated as one that cannot fit",
        );
        let err = SandboxHost::from_module(manifest_with(ResourceLimits::default()), &wasm)
            .expect_err("an active segment with an unevaluable offset must be refused");
        assert!(
            matches!(err, SandboxLoadError::SegmentOutOfBounds { .. }),
            "{err:?}",
        );

        // And the refusal is about *active* segments, not about the evaluator
        // giving up: the same unevaluable expression on a passive segment is
        // copied by nothing at instantiation, so it still loads.
        let passive = wat::parse_str(
            r#"(module
  (memory (export "memory") 1)
  (data "passive, and its offset is not a question")
  (func (export "_start") (nop))
)"#,
        )
        .expect("the fixture is valid WAT");
        SandboxHost::from_module(manifest_with(ResourceLimits::default()), &passive)
            .expect("a passive segment must still load");
    }

    #[test]
    fn a_passive_only_data_section_is_not_a_walk_that_failed() {
        // `data_section_end` has two ways of saying nothing: the walk failed, or the
        // walk succeeded and there was no active write to measure. The fail-closed
        // fallback added for extended-const offsets read both as the first and refused
        // a perfectly runnable module — a passive segment is copied only by an explicit
        // `memory.init`, never at instantiation, so it cannot be out of bounds there.
        // The three outcomes are pinned together here because the bug was exactly their
        // collapse into two.
        let passive_only = wat::parse_str(
            r#"(module
  (memory (export "memory") 1)
  (data "passive bytes")
  (func (export "_start") (nop))
)"#,
        )
        .expect("the fixture is valid WAT");
        let shape = module_shape(&passive_only).expect("the section walks cleanly");
        assert_eq!(
            shape.data_end, 0,
            "a passive segment measures nothing, so it must contribute nothing",
        );
        SandboxHost::from_module(manifest_with(ResourceLimits::default()), &passive_only)
            .expect("a passive-only module must still load");

        // An active segment beside it is still measured, so "nothing to
        // measure" cannot become "measure nothing".
        let mixed = wat::parse_str(
            r#"(module
  (memory (export "memory") 1)
  (data "passive bytes")
  (data (offset (i32.const 16)) "active")
  (func (export "_start") (nop))
)"#,
        )
        .expect("the fixture is valid WAT");
        let shape = module_shape(&mixed).expect("the section walks cleanly");
        assert_eq!(
            shape.data_end, 22,
            "the active segment's end must survive the passive one beside it",
        );

        // And an active segment past the memory is still refused, so the
        // assertions above cannot be satisfied by simply never refusing.
        let out_of_bounds = wat::parse_str(
            r#"(module
  (memory (export "memory") 1)
  (data "passive bytes")
  (data (offset (i32.const 65535)) "spills")
  (func (export "_start") (nop))
)"#,
        )
        .expect("the fixture is valid WAT");
        let err =
            SandboxHost::from_module(manifest_with(ResourceLimits::default()), &out_of_bounds)
                .expect_err("an active segment past the end of memory must be refused");
        assert!(
            matches!(err, SandboxLoadError::SegmentOutOfBounds { .. }),
            "{err:?}",
        );
    }

    #[test]
    fn an_extended_const_segment_offset_is_evaluated_rather_than_waved_through() {
        // wasmi enables the extended-const proposal by default, so an active
        // data offset need not be a bare `i32.const`. Against a reader that
        // knew only the bare form this was not merely unevaluable: the walk did
        // not know `i32.add` either, so it desynced, the whole data section
        // returned nothing, and `data_end` stayed at zero. The bounds check did
        // not run — and packaging and `plugin inspect` then approved an
        // artifact whose every request would fail at instantiation, which is
        // precisely what checking at load is for.
        let out_of_bounds = wat::parse_str(
            r#"(module
  (memory (export "memory") 1)
  (data (offset (i32.add (i32.const 65535) (i32.const 2))) "xx")
  (func (export "_start") (nop))
)"#,
        )
        .expect("the fixture is valid WAT");

        // The engine accepts it, which is what makes the gap reachable: if
        // wasmi refused the module this walk's silence would cost nothing.
        let mut config = wasmi::Config::default();
        config.consume_fuel(true);
        wasmi::Module::new(&wasmi::Engine::new(&config), &out_of_bounds[..])
            .expect("wasmi compiles an extended-const offset; the finding depends on it");

        let err =
            SandboxHost::from_module(manifest_with(ResourceLimits::default()), &out_of_bounds)
                .expect_err("a segment past the end of memory must be refused at load");
        // Refused for the true reason, with the offset the arithmetic actually
        // produces — 65535 + 2, plus the two bytes copied there.
        assert!(
            matches!(
                err,
                SandboxLoadError::SegmentOutOfBounds { end, capacity, .. }
                    if end == 65539 && capacity == WASM_PAGE_BYTES
            ),
            "{err:?}",
        );

        // And the arithmetic is *evaluated*, not merely refused for being
        // unfamiliar: the same shape landing inside the memory still loads.
        // Refusing every extended-const module would pass the assertion above
        // and fail this one.
        let in_bounds = wat::parse_str(
            r#"(module
  (memory (export "memory") 1)
  (data (offset (i32.add (i32.const 16) (i32.const 8))) "xx")
  (func (export "_start") (nop))
)"#,
        )
        .expect("the fixture is valid WAT");
        SandboxHost::from_module(manifest_with(ResourceLimits::default()), &in_bounds)
            .expect("an extended-const offset inside the memory must still load");
    }

    #[test]
    fn a_bidi_override_cannot_reorder_the_record_it_appears_in() {
        // `is_control` covers the C0/C1 codes and stops there, so the Unicode
        // formatting characters went into the log verbatim. They do an ESC's job by
        // other means: U+202E reverses everything after it, so a guest can write a
        // detail that reads as a different record than the one the host wrote —
        // including reading as though the denial were an allow. The operator reads that
        // line to decide what happened. The consent screen already refuses these in a
        // route path; a detail is evidence rather than a mount, so here they are
        // escaped instead, and the attempt survives legibly as an attempt.
        let forged = guest_text("denied \u{202E}dewolla\u{202D} by policy");
        assert!(
            !forged.contains('\u{202E}') && !forged.contains('\u{202D}'),
            "a bidi override reached the log verbatim: {forged:?}",
        );
        assert!(
            forged.contains("\\u{202e}"),
            "the attempt must survive as an escape, not be silently dropped: {forged:?}",
        );
        assert!(
            forged.contains("denied") && forged.contains("by policy"),
            "the host's own words must survive: {forged:?}",
        );

        // The whole family, not just the one character: isolates and the
        // zero-width joiners hide a boundary rather than reversing a run, and
        // the log is just as unreadable either way.
        for ch in [
            '\u{061C}', '\u{200B}', '\u{200E}', '\u{200F}', '\u{2060}', '\u{2066}', '\u{2069}',
            '\u{FEFF}',
        ] {
            let out = guest_text(&format!("before{ch}after"));
            assert!(
                !out.contains(ch),
                "U+{:04X} reached the log verbatim: {out:?}",
                ch as u32,
            );
        }

        // And ordinary non-ASCII is still kept — an author debugging a plugin
        // that reports errors in their own language has to be able to read them.
        let readable = guest_text("le module n'a pas démarré — 起動しませんでした");
        assert!(
            readable.contains("démarré") && readable.contains("起動しませんでした"),
            "real text was escaped along with the formatting characters: {readable:?}",
        );
    }

    #[test]
    fn a_unicode_line_break_cannot_forge_a_second_log_record() {
        // The line breaks that are not control characters. U+2028 and U+2029 are
        // general category Zl and Zp, so `is_control` — which answers for Cc —
        // says no, and they are neither format nor default-ignorable, so the
        // reordering predicate says no as well. A log consumer that splits on
        // Unicode line breaks still renders them as a newline, which hands the
        // guest the forged record that escaping C0 exists to deny.
        for ch in ['\u{2028}', '\u{2029}'] {
            assert!(
                !ch.is_control(),
                "U+{:04X} is a control character after all; this test guards the wrong gap",
                ch as u32,
            );
            let split = guest_text(&format!("denied{ch}allowed by policy"));
            assert!(
                !split.contains(ch),
                "U+{:04X} reached the log verbatim: {split:?}",
                ch as u32,
            );
            assert!(
                split.contains(&format!("\\u{{{:x}}}", ch as u32)),
                "the attempt must survive as an escape, not be dropped: {split:?}",
            );
        }
    }

    #[test]
    fn generating_a_random_byte_costs_more_than_copying_one() {
        // `BYTES_PER_FUEL` is a bulk-copy rate: a memcpy moves 64 bytes for about what
        // one instruction costs, so charging them to a unit is honest. `random_get` does
        // not copy — every byte is a whole SplitMix64 step, an add, two multiplies, and
        // four shift-XOR pairs. Billing that at the copy rate sold the mixer's work at a
        // memcpy's price while the guest held a blocking worker for it. Measured through
        // the fuel the host actually charges, because that is the thing that was wrong:
        // an earlier version of this test compared two constants it computed itself,
        // passed against its own revert, and never ran `random_get` at all.
        fn drawing(bytes: u32) -> u64 {
            let wat = format!(
                r#"(module
  (import "wasi_snapshot_preview1" "random_get" (func $random_get (param i32 i32) (result i32)))
  (memory (export "memory") 2)
  (func (export "_start")
    (drop (call $random_get (i32.const 4096) (i32.const {bytes}))))
)"#
            );
            // The guest never answers, which is fine: the outcome carries the
            // fuel spent either way, and the answer is not what is being
            // measured.
            host(&wat).run(&request("GET", "/hello/greet")).fuel_used
        }

        let none = drawing(0);
        let many = drawing(65536);
        let charged = many.saturating_sub(none);

        // At the copy rate 64 KiB is about 1,024 units; per byte it is 65,536.
        // Halfway between separates them without pinning either rate.
        assert!(
            charged > 32768,
            "drawing 64 KiB of entropy cost {charged} fuel — the bulk-copy rate \
             would charge about 1,024, so the mixer's work is being sold at a \
             memcpy's price",
        );
    }

    #[test]
    fn the_pending_frame_never_allocates_past_the_budget_it_is_bounded_by() {
        // The pending-line ceiling bounds the buffer's *length*. Its
        // *capacity* is what the host actually holds, and `Vec`'s doubling puts
        // that at the next power of two above the ceiling — nearly twice the
        // `2 × max_response_bytes` `request_footprint_bytes` reserves for this
        // line, at every concurrent request at once. A bound the allocation can
        // exceed is not the bound the concurrency product was validated
        // against.
        let limits = ResourceLimits {
            // Small enough to fill in a test, and deliberately not a power of
            // two: an unclamped `Vec` lands on 65,536 for this budget, which a
            // ceiling of exactly 65,536 would have let pass.
            max_response_bytes: 20_000,
            ..ResourceLimits::default()
        };
        let budget = limits.max_response_bytes * 2 + 4096;
        let mut state = bare_state(limits, b"");

        // One byte at a time, because that is the growth pattern that doubles:
        // a guest writing its frame through a byte-at-a-time formatter is
        // ordinary, and `write_stdout` sees the bytes either way.
        for _ in 0..budget {
            assert!(state.write_stdout(b"x"), "the budget refused a legal frame");
        }
        assert_eq!(state.stdout_line.len(), budget, "the buffer did not fill");
        assert!(
            state.stdout_line.capacity() <= budget,
            "a {budget}-byte ceiling holds {} bytes of allocation",
            state.stdout_line.capacity(),
        );

        // …and the ceiling still stops the next byte, so bounding the
        // allocation did not cost the refusal it exists for.
        assert!(
            !state.write_stdout(b"x"),
            "a frame past the ceiling was accepted",
        );
    }

    #[test]
    fn one_read_cannot_copy_the_whole_frame_out_of_the_queue() {
        // `fd_write` and `random_get` both bound their scratch to `HOST_IO_CHUNK_BYTES`,
        // and `FIXED_HOST_BUFFER_BYTES` budgets exactly one such buffer. The read path
        // did not: the iovec length is the guest's to choose, so one iovec spanning the
        // whole frame made a second copy of it, live beside the queue it was copied out
        // of, which keeps its allocation as it drains. A frame is metadata plus a base64
        // body with JSON escaping over both, so that copy is several times the raw
        // request, and none of it was in the footprint the concurrency product is
        // validated against. Returning less than was asked for is what the call already
        // promises: the queue running dry short-reads today, so a guest that does not
        // loop is already broken.
        let mut state = bare_state(ResourceLimits::default(), b"");
        state.stdin = VecDeque::from(vec![b'x'; HOST_IO_CHUNK_BYTES * 4]);

        let chunk = state.take_stdin(HOST_IO_CHUNK_BYTES * 4);
        assert_eq!(
            chunk.len(),
            HOST_IO_CHUNK_BYTES,
            "one read copied more than the scratch the footprint budgets",
        );

        // And the rest is still there to be read, one bounded chunk at a time,
        // so bounding the copy did not lose the frame.
        let mut drained = chunk.len();
        while !state.stdin.is_empty() {
            let next = state.take_stdin(HOST_IO_CHUNK_BYTES * 4);
            assert!(
                !next.is_empty(),
                "the queue stopped yielding with bytes left"
            );
            drained += next.len();
        }
        assert_eq!(
            drained,
            HOST_IO_CHUNK_BYTES * 4,
            "the frame did not survive being read in chunks",
        );

        // A read smaller than the bound is unaffected — the cap is a ceiling,
        // not a quantum.
        let mut small = bare_state(ResourceLimits::default(), b"");
        small.stdin = VecDeque::from(b"{\"op\":\"request\"}".to_vec());
        assert_eq!(small.take_stdin(4).len(), 4, "a short read must stay short");
    }

    #[test]
    fn a_cut_stderr_excerpt_says_that_it_was_cut() {
        // `guest_text` appends " … (truncated)" when it meets a 513th
        // character, and `stderr_excerpt` hands it at most 512 — so on this
        // path the marker could never fire, and a flood that lost its most
        // recent output read as though the guest had simply stopped there. The
        // suffix is usually the interesting part of a failure.
        let mut state = bare_state(ResourceLimits::default(), b"");
        state.write_stderr("a".repeat(STDERR_EXCERPT * 2).as_bytes());
        let excerpt = state.stderr_excerpt();
        assert!(
            excerpt.ends_with(" … (truncated)"),
            "a cut excerpt must say so: {:?}",
            excerpt.get(excerpt.len().saturating_sub(40)..),
        );

        // And an excerpt that fits says nothing of the kind — the marker has to
        // mean something.
        let mut short = bare_state(ResourceLimits::default(), b"");
        short.write_stderr(b"panicked at the disco");
        let whole = short.stderr_excerpt();
        assert_eq!(
            whole, "panicked at the disco",
            "an excerpt that fits is untouched"
        );
    }

    #[test]
    fn the_streamed_lossy_decode_says_what_from_utf8_lossy_says() {
        // The excerpt is now decoded lazily so a 64 KiB stderr of invalid bytes
        // never becomes a 192 KiB replacement string. That is only an
        // improvement if it decodes to the same characters, and the sharp edge
        // is *grouping*: `from_utf8_lossy` emits one U+FFFD per maximal invalid
        // subpart, not per byte, so a truncated three-byte sequence is one
        // replacement and two stray continuation bytes are two.
        for case in [
            b"".as_slice(),
            b"plain ascii",
            b"\xff",
            b"\xff\xff\xff",
            // A truncated 3-byte sequence: one maximal subpart.
            b"\xe2\x82",
            // The same, followed by a valid character.
            b"\xe2\x82x",
            // Stray continuation bytes: one subpart each.
            b"\x80\x80",
            // Valid multi-byte text either side of a bad byte.
            "é日本".as_bytes(),
            b"caf\xe9 latte",
            // An overlong encoding, which is invalid however it looks.
            b"\xc0\xaf",
        ] {
            let streamed: String = lossy_chars(case).collect();
            assert_eq!(
                streamed,
                String::from_utf8_lossy(case),
                "streamed decode diverged on {case:?}",
            );
        }
    }

    #[test]
    fn a_stderr_of_invalid_bytes_is_still_bounded_at_the_excerpt() {
        // The flood the streaming exists for: a full budget of bytes that are
        // each their own invalid subpart, so the lossy form is three times the
        // buffer. What is kept is still one excerpt.
        let mut state = bare_state(ResourceLimits::default(), b"");
        state.write_stderr(&vec![0xff; STDERR_BUDGET_BYTES * 2]);
        assert_eq!(
            state.stderr.len(),
            STDERR_BUDGET_BYTES,
            "the buffer itself must still be capped",
        );
        let excerpt = state.stderr_excerpt();
        assert!(
            excerpt.chars().count() <= DETAIL_EXCERPT + " … (truncated)".len(),
            "the excerpt outgrew its bound: {} characters",
            excerpt.chars().count(),
        );
        // Kept verbatim rather than escaped, and deliberately so: U+FFFD is
        // neither a control nor default-ignorable nor display-reordering — it
        // is a visible glyph that says "there was a byte here that was not
        // text", which is exactly what the operator should see.
        assert!(
            excerpt.contains(char::REPLACEMENT_CHARACTER),
            "the replacement characters did not survive: {excerpt:?}",
        );
    }

    #[test]
    fn stderr_is_escaped_as_well_as_bounded() {
        // Same hazard, same answer: stderr was truncated but not neutralised,
        // so a guest could forge a record inside its 512-character excerpt.
        let mut state = bare_state(ResourceLimits::default(), b"");
        state.write_stderr(b"panicked\n2026-01-01  INFO forged\x1b[2K");
        let excerpt = state.stderr_excerpt();
        assert!(
            !excerpt.contains('\n') && !excerpt.contains('\u{1b}'),
            "{excerpt:?}"
        );
        assert!(excerpt.contains("panicked"), "{excerpt:?}");
    }

    #[test]
    fn a_manifest_mutated_after_validation_is_refused_rather_than_trusted() {
        // `SandboxManifest`'s fields are public and `from_module` is public, so
        // "the manifest was validated when it was parsed" is an invariant a
        // caller can step around without meaning to. The values that matter
        // here are the ones that panic something downstream rather than merely
        // misbehaving: a concurrency past the semaphore's ceiling, and a route
        // path axum refuses to build.
        let wasm = wat::parse_str(guests::HELLO).expect("the fixture is valid WAT");

        let mut manifest = manifest_with(ResourceLimits::default());
        manifest.limits.max_concurrency = usize::MAX;
        let err = SandboxHost::from_module(manifest, &wasm)
            .expect_err("an invalid manifest must not produce a host");
        assert!(matches!(err, SandboxLoadError::InvalidManifest(_)), "{err}");

        let mut manifest = manifest_with(ResourceLimits::default());
        manifest.routes[0].path = "/{".to_owned();
        let err = SandboxHost::from_module(manifest, &wasm)
            .expect_err("an unbuildable route must not produce a host");
        assert!(matches!(err, SandboxLoadError::InvalidManifest(_)), "{err}");
    }

    #[test]
    fn encoding_the_request_frame_is_priced_before_it_is_performed() {
        // The body is cloned into the frame and base64-expanded into the NDJSON
        // line before a single guest instruction runs. With a large body
        // ceiling and a small fuel budget that is megabytes of host CPU outside
        // the declared ceiling, repeatable for as long as a client keeps
        // sending.
        let host = host(guests::HELLO);
        let mut request = get("/hello/greet");
        request.body = vec![b'x'; 200_000];

        // Just above the load-time floor, so the host exists — and far below
        // what encoding this body costs, which is the point.
        let starved = try_host_with(
            guests::HELLO,
            ResourceLimits {
                fuel: host.instantiation_fuel() + 1,
                ..ResourceLimits::default()
            },
        )
        .expect("the fixture loads");
        let outcome = starved.run(&request);
        assert!(
            matches!(outcome.result, Err(SandboxFailure::FuelExhausted { .. })),
            "{:?}",
            outcome.result
        );

        // And an honest request pays for it rather than getting it free.
        let outcome = host.run(&request);
        assert!(
            outcome.fuel_used >= 200_000 / BYTES_PER_FUEL,
            "the encoding was not charged: {} units",
            outcome.fuel_used
        );
    }

    #[test]
    fn a_direct_caller_cannot_start_more_instances_than_the_manifest_allows() {
        // `SandboxedPlugin::serve` has a semaphore of its own, so HTTP traffic
        // is bounded. `run` is public, though, and an embedder calling it
        // directly used to bypass admission entirely — while the manifest
        // validator accepts limits on the premise that
        // `request_footprint_bytes() × max_concurrency` bounds the plugin.
        let host = try_host_with(
            guests::HELLO,
            ResourceLimits {
                max_concurrency: 1,
                ..ResourceLimits::default()
            },
        )
        .expect("the fixture loads");

        // Hold the only permit, exactly as an in-flight request would, rather
        // than racing a real one: the property is the admission, not the race.
        let held = host
            .permits
            .try_acquire()
            .expect("the first permit is free");
        assert_eq!(
            host.run(&get("/hello/greet")).result,
            Err(SandboxFailure::AtCapacity { max: 1 }),
            "a second concurrent run was admitted past max_concurrency = 1"
        );

        // And the permit comes back: the ceiling is on requests executing at
        // once, not a budget the plugin spends down.
        drop(held);
        assert!(
            host.run(&get("/hello/greet")).result.is_ok(),
            "the permit was not returned when the run finished"
        );
    }

    #[test]
    fn a_fuel_budget_that_cannot_reach_start_is_refused_at_load() {
        // `fuel = 1` passes the manifest's own range check, and every request
        // then spends the instantiation charge before `_start` — so every route
        // the manifest declares answers 504, always. `inspect` reporting that
        // artifact as loadable is worse than reporting nothing, because an
        // operator installs on the strength of the verdict.
        let err = try_host_with(
            guests::HELLO,
            ResourceLimits {
                fuel: 1,
                ..ResourceLimits::default()
            },
        )
        .expect_err("a budget below the fixed charges must not produce a host");
        let SandboxLoadError::FuelBelowFixedCharges {
            fuel,
            instantiation,
        } = err
        else {
            panic!("expected the fuel refusal, got {err:?}");
        };
        assert_eq!(fuel, 1);
        assert!(
            instantiation >= 1,
            "the charge must be real to refuse against"
        );

        // And a budget that clears the charge still loads: this is a floor, not
        // a demand for the default.
        assert!(
            try_host_with(
                guests::HELLO,
                ResourceLimits {
                    fuel: instantiation + 1,
                    ..ResourceLimits::default()
                },
            )
            .is_ok(),
            "a budget just above the fixed charge is legal"
        );
    }

    #[test]
    fn the_import_list_a_review_surface_shows_is_bounded() {
        // Each name is excerpted where it is rendered, but the *count* is a
        // separate amplification: a legal module can carry far more imports
        // than a person will read, and formatting each into its own `String`
        // turns the artifact into memory in the process refusing it.
        let imports = (0..MAX_REPORTED_IMPORTS + 50)
            .map(|n| format!(r#"  (import "env" "f{n}" (func))"#))
            .collect::<Vec<_>>()
            .join("\n");
        let wat = format!("(module\n{imports}\n  (func (export \"_start\") (nop)))");
        let wasm = wat::parse_str(&wat).expect("the fixture is valid WAT");

        let listed = SandboxHost::imports_of(&wasm).expect("a module's imports can be read");
        assert!(
            listed.len() <= MAX_REPORTED_IMPORTS + 1,
            "the list is unbounded: {} entries",
            listed.len()
        );
        // The operator must not read a truncated list as the whole of it.
        let last = listed.last().expect("a non-empty list");
        assert!(last.contains("truncated") && last.contains("50"), "{last}");
    }

    #[test]
    fn a_module_declaring_more_imports_than_the_ceiling_is_refused_at_load() {
        // The reporting cap bounds the *review surface*; it does nothing for the
        // runtime path, where every import is resolved and retained per
        // instance — per request. A module repeating one allowlisted import
        // makes every request pay for those resolutions, and neither the fuel
        // charge nor `request_footprint_bytes` knew about them.
        let imports = (0..=MAX_IMPORTS)
            .map(|_| {
                format!(
                    r#"  (import "{WASI}" "fd_write" (func (param i32 i32 i32 i32) (result i32)))"#
                )
            })
            .collect::<Vec<_>>()
            .join("\n");
        let wat = format!(
            "(module\n{imports}\n  (memory (export \"memory\") 1)\n  (func (export \"_start\") (nop)))"
        );
        let wasm = wat::parse_str(&wat).expect("the fixture is valid WAT");

        let err = SandboxHost::from_module(manifest_with(ResourceLimits::default()), &wasm)
            .expect_err("a module past the import ceiling must not load");
        assert!(
            matches!(
                err,
                SandboxLoadError::InstantiationTooExpensive {
                    what: "imports",
                    ..
                }
            ),
            "{err:?}"
        );
        // Every import here is allowlisted, so nothing but the *count* refuses
        // it: the ceiling is structural, not a second spelling of the
        // capability gate.
    }

    #[test]
    fn the_import_ceiling_does_not_weaken_the_forbidden_import_gate() {
        // A module hiding one forbidden import behind a crowd is still refused;
        // the count check running first changes why, never whether.
        let mut lines = (0..=MAX_IMPORTS)
            .map(|_| {
                format!(
                    r#"  (import "{WASI}" "fd_write" (func (param i32 i32 i32 i32) (result i32)))"#
                )
            })
            .collect::<Vec<_>>();
        lines.push(r#"  (import "env" "escape" (func))"#.to_owned());
        let wat = format!(
            "(module\n{}\n  (memory (export \"memory\") 1)\n  (func (export \"_start\") (nop)))",
            lines.join("\n")
        );
        let wasm = wat::parse_str(&wat).expect("the fixture is valid WAT");
        assert!(
            SandboxHost::from_module(manifest_with(ResourceLimits::default()), &wasm).is_err(),
            "a module carrying a forbidden import must never load"
        );
    }

    #[test]
    fn resolving_imports_is_priced_into_the_instantiation_charge() {
        // Per-instance work the guest never executes but every request pays
        // for. Unpriced, it is host CPU bought for free — the same defect the
        // host-side copying charge exists to close.
        let bare = wat::parse_str(
            "(module (memory (export \"memory\") 1) (func (export \"_start\") (nop)))",
        )
        .expect("the fixture is valid WAT");
        let imports = (0..32)
            .map(|_| {
                format!(
                    r#"  (import "{WASI}" "fd_write" (func (param i32 i32 i32 i32) (result i32)))"#
                )
            })
            .collect::<Vec<_>>()
            .join("\n");
        let with_imports = wat::parse_str(format!(
            "(module\n{imports}\n  (memory (export \"memory\") 1)\n  (func (export \"_start\") (nop)))"
        ))
        .expect("the fixture is valid WAT");

        let cheap = SandboxHost::from_module(manifest_with(ResourceLimits::default()), &bare)
            .expect("loads")
            .instantiation_fuel();
        let dear =
            SandboxHost::from_module(manifest_with(ResourceLimits::default()), &with_imports)
                .expect("loads")
                .instantiation_fuel();
        assert_eq!(
            dear,
            cheap + 32,
            "each admitted import must cost a unit: {cheap} then {dear}"
        );
    }

    #[test]
    fn a_module_pays_instantiation_fuel_for_the_memory_it_starts_with() {
        // A module can declare a large initial linear memory and no data segments at
        // all, so every init-section term prices none of it — and the host still
        // allocates and zero-fills the whole thing on each request, before the guest
        // runs an instruction. That is host work proportional to a guest-declared
        // quantity, exactly what the copying charge exists to make cost something. The
        // limiter already bounds how much memory; it cannot bound how often a client
        // asks for it to be zeroed.
        let limits = ResourceLimits {
            memory_bytes: 64 * 1024 * 1024,
            ..ResourceLimits::default()
        };
        let one_page = wat::parse_str(
            r#"(module (memory (export "memory") 1) (func (export "_start") (nop)))"#,
        )
        .expect("the fixture is valid WAT");
        // 512 pages = 32 MiB, under the ceiling above and carrying no segments.
        let many_pages = wat::parse_str(
            r#"(module (memory (export "memory") 512) (func (export "_start") (nop)))"#,
        )
        .expect("the fixture is valid WAT");

        let small = SandboxHost::from_module(manifest_with(limits), &one_page)
            .expect("loads")
            .instantiation_fuel();
        let large = SandboxHost::from_module(manifest_with(limits), &many_pages)
            .expect("loads")
            .instantiation_fuel();

        // 511 extra pages of memory to zero, at the same rate as every other
        // host-side byte.
        let extra = (511 * WASM_PAGE_BYTES) / BYTES_PER_FUEL;
        assert_eq!(
            large,
            small + extra,
            "initial memory is not charged: {small} then {large}"
        );
        assert!(
            extra > 0,
            "the fixture must differ by something the charge can see"
        );
    }

    #[test]
    fn a_metadata_list_of_empty_pairs_is_charged_for_its_structure() {
        // Summing only the contents leaves a million empty pairs weighing
        // nothing: past a byte ceiling for free, then cloned into the frame and
        // expanded into real JSON syntax anyway. The same shape as a response
        // frame full of `["",""]`, and it has to be priced on this side too.
        let host = host(guests::HELLO);
        let mut request = get("/hello/greet");
        request.path_params = vec![(String::new(), String::new()); 100_000];

        let err = host
            .run(&request)
            .result
            .expect_err("a list of empty pairs must not be free");
        assert!(
            matches!(err, SandboxFailure::RequestMetadataBudget { .. }),
            "{err:?}"
        );
    }

    #[test]
    fn a_module_whose_tables_start_over_the_ceiling_is_refused_at_load() {
        // The limiter enforces the table ceiling at instantiation, which is per
        // request — so a module already over it at rest loaded cleanly and then
        // failed every request. Same defect as a fuel budget below the fixed
        // charges: a passing verdict on an artifact that can never answer.
        let over = MAX_TABLE_ELEMENTS + 1;
        let wasm = wat::parse_str(format!(
            "(module (table {over} funcref) (memory (export \"memory\") 1) (func (export \"_start\") (nop)))"
        ))
        .expect("the fixture is valid WAT");

        let err = SandboxHost::from_module(manifest_with(ResourceLimits::default()), &wasm)
            .expect_err("a module over the table ceiling must not load");
        assert!(
            matches!(
                err,
                SandboxLoadError::InstantiationTooExpensive {
                    what: "initial table elements",
                    ..
                }
            ),
            "{err:?}"
        );
    }

    #[test]
    fn an_element_expression_whose_operand_is_the_end_opcode_still_bounds_the_segment() {
        // `ref.func 11` encodes its immediate as 0x0b, the same byte that ends a
        // constant expression. A walk that scans for the terminator instead of
        // decoding stops on that operand, reads every later byte at the wrong
        // offset, bails, and silently drops the bounds check — so a segment past
        // the end of its table sails through. Twelve functions, so index 11
        // exists and the expression form is used.
        use std::fmt::Write as _;

        let mut wat =
            String::from("(module\n  (memory (export \"memory\") 1)\n  (table 1 funcref)\n");
        for i in 0..12 {
            let _ = writeln!(wat, "  (func $f{i} (nop))");
        }
        // Past the end of a one-element table, with a `ref.func 11` item.
        wat.push_str("  (elem (i32.const 1) funcref (ref.func $f11))\n");
        wat.push_str("  (func (export \"_start\") (nop))\n)");
        let wasm = wat::parse_str(&wat).expect("the fixture is valid WAT");

        let err = SandboxHost::from_module(manifest_with(ResourceLimits::default()), &wasm)
            .expect_err("the operand must not be mistaken for the terminator");
        assert!(
            matches!(err, SandboxLoadError::SegmentOutOfBounds { .. }),
            "{err:?}"
        );
    }

    #[test]
    fn an_element_segment_past_the_end_of_its_table_is_refused_at_load() {
        // The exact sibling of the data-segment case: an active element segment
        // is written into its table during instantiation, so one that does not
        // fit compiles clean and fails every request. Fixing segments into
        // memory without fixing segments into tables would have left half the
        // defect in place.
        let wat = r#"(module
             (memory (export "memory") 1)
             (table 1 funcref)
             (func $f (nop))
             (elem (i32.const 1) $f)
             (func (export "_start") (nop)))"#;
        let wasm = wat::parse_str(wat).expect("the fixture is valid WAT");

        let err = SandboxHost::from_module(manifest_with(ResourceLimits::default()), &wasm)
            .expect_err("a segment past the end of its table must not load");
        assert!(
            matches!(err, SandboxLoadError::SegmentOutOfBounds { .. }),
            "{err:?}"
        );
    }

    #[test]
    fn a_module_carrying_a_start_section_is_refused() {
        // The engine runs a `start` function at instantiation, before any
        // request. If it traps the plugin can never answer, and the only way to
        // find out at load would be to execute an unaudited artifact's code
        // while inspecting it. A sandboxed plugin answers through the exported
        // `_start` the shim calls, so the section has no legitimate use here.
        let wat = r#"(module
             (memory (export "memory") 1)
             (func $init (nop))
             (start $init)
             (func (export "_start") (nop)))"#;
        let wasm = wat::parse_str(wat).expect("the fixture is valid WAT");

        let err = SandboxHost::from_module(manifest_with(ResourceLimits::default()), &wasm)
            .expect_err("a start section must not load");
        assert!(
            matches!(err, SandboxLoadError::StartSectionForbidden),
            "{err:?}"
        );
    }

    #[test]
    fn a_negative_segment_offset_is_refused_rather_than_ignored() {
        // A wasm offset is unsigned: `i32.const -1` means 4294967295, which is
        // out of bounds for anything this sandbox admits. Reading it as a
        // *signed* value and dropping it when the conversion failed meant the
        // one offset guaranteed to be invalid was the one the walk called
        // unevaluable — a fail-open in the check meant to catch exactly this.
        let wat = r#"(module
             (memory (export "memory") 1)
             (data (i32.const -1) "x")
             (func (export "_start") (nop)))"#;
        let wasm = wat::parse_str(wat).expect("the fixture is valid WAT");

        let err = SandboxHost::from_module(manifest_with(ResourceLimits::default()), &wasm)
            .expect_err("a negative offset must not load");
        assert!(
            matches!(err, SandboxLoadError::SegmentOutOfBounds { .. }),
            "{err:?}"
        );
    }

    #[test]
    fn a_data_segment_past_the_end_of_memory_is_refused_at_load() {
        // An active segment is copied in during instantiation, which is per
        // request. One that does not fit the module's own initial memory
        // compiles clean and then fails every instantiation, so the artifact
        // inspects green and 502s forever — the same shape as a fuel budget
        // below the fixed charges.
        let wat = r#"(module
             (memory (export "memory") 1)
             (data (i32.const 65536) "x")
             (func (export "_start") (nop)))"#;
        let wasm = wat::parse_str(wat).expect("the fixture is valid WAT");

        let err = SandboxHost::from_module(manifest_with(ResourceLimits::default()), &wasm)
            .expect_err("a segment past the end of memory must not load");
        assert!(
            matches!(err, SandboxLoadError::SegmentOutOfBounds { .. }),
            "{err:?}"
        );
    }

    #[test]
    fn the_segment_ceiling_is_enforced_by_the_pre_compilation_gate() {
        // Not merely "the module is refused" — where it is refused is the point.
        // `from_module` calls `refuse_unbounded_shape` before `Module::new` precisely
        // because compiling is what builds a representation of every declaration, so a
        // ceiling checked after it is checked too late. These two ceilings were checked
        // after it, under a comment saying they must not be. A module can sit over
        // `MAX_INIT_SEGMENTS` (4,096) and still be far under `MAX_DECLARED_ENTRIES`
        // (1,000,000), so nothing else refused it first and wasmi expanded every segment
        // before the answer came back. Asserting through `refuse_unbounded_shape`
        // directly is what makes this about ordering: the gate that runs first has to be
        // the one that says no.
        use std::fmt::Write as _;

        let mut wat = String::from("(module\n  (memory (export \"memory\") 1)\n");
        for offset in 0..=MAX_INIT_SEGMENTS {
            let _ = writeln!(wat, "  (data (i32.const {offset}) \"x\")");
        }
        wat.push_str("  (func (export \"_start\") (nop))\n)");
        let wasm = wat::parse_str(&wat).expect("the fixture is valid WAT");

        let err = refuse_unbounded_shape(&wasm)
            .expect_err("the pre-compilation gate must refuse the segment count");
        assert!(
            matches!(
                err,
                SandboxLoadError::InstantiationTooExpensive {
                    what: "data and element segments",
                    ..
                }
            ),
            "{err:?}"
        );
        // And the fixture really is under the aggregate ceiling, so it is this
        // check refusing it and not the entry one standing in.
        let shape = module_shape(&wasm).expect("the fixture walks");
        assert!(
            shape.declared_entries <= MAX_DECLARED_ENTRIES,
            "the fixture would have been refused for its entry count anyway"
        );
    }

    #[test]
    fn a_module_past_the_segment_ceiling_is_refused_without_walking_its_segments() {
        // The count check runs before the per-segment walks now, because the walk was
        // work an artifact could buy at two bytes a segment purely to reach the refusal
        // that exists to bound it. The risk in skipping a walk is that the walk was also
        // doing a bounds check — the fail-open shape this file has been bitten by twice.
        // So the case that matters is a module over the ceiling that also carries a
        // segment past the end of its memory: it must still be refused. The sibling
        // tests above cover the other side, that a module under the ceiling is still
        // walked and still caught.
        use std::fmt::Write as _;

        let mut wat = String::from("(module\n  (memory (export \"memory\") 1)\n");
        // Past the end of the single page this module declares.
        let _ = writeln!(wat, "  (data (i32.const 65536) \"x\")");
        for offset in 0..=MAX_INIT_SEGMENTS {
            let _ = writeln!(wat, "  (data (i32.const {offset}) \"x\")");
        }
        wat.push_str("  (func (export \"_start\") (nop))\n)");
        let wasm = wat::parse_str(&wat).expect("the fixture is valid WAT");

        let err = SandboxHost::from_module(manifest_with(ResourceLimits::default()), &wasm)
            .expect_err("a module past the segment ceiling must not load");
        assert!(
            matches!(
                err,
                SandboxLoadError::InstantiationTooExpensive {
                    what: "data and element segments",
                    ..
                }
            ),
            "{err:?}"
        );
    }

    #[test]
    fn a_module_declaring_more_tables_than_the_ceiling_is_refused_on_the_count() {
        // The same ordering, on the table walk — which the review named only
        // for elements and data, but which this loop shares. Its own comment
        // already said a 64 MiB artifact of empty table declarations must not
        // expand here; bounding the per-entry *allocation* left the per-entry
        // *iteration* unbounded, at three bytes an entry.
        use std::fmt::Write as _;

        let mut wat = String::from("(module\n  (memory (export \"memory\") 1)\n");
        for _ in 0..=MAX_TABLES {
            let _ = writeln!(wat, "  (table 1 funcref)");
        }
        wat.push_str("  (func (export \"_start\") (nop))\n)");
        let wasm = wat::parse_str(&wat).expect("the fixture is valid WAT");

        let err = SandboxHost::from_module(manifest_with(ResourceLimits::default()), &wasm)
            .expect_err("a module past the table ceiling must not load");
        assert!(
            matches!(
                err,
                SandboxLoadError::InstantiationTooExpensive { what: "tables", .. }
            ),
            "{err:?}"
        );
    }

    #[test]
    fn a_module_whose_code_section_is_too_large_is_refused_before_compilation() {
        // One function declares one entry however long its body is, so the
        // declaration ceilings never saw this: a single body filling the file
        // allowance still hands the compiler tens of megabytes to translate.
        // The section header carries the size, so the refusal costs one LEB128
        // and never touches the instruction stream.
        let mut wasm = wat::parse_str(
            "(module (memory (export \"memory\") 1) (func (export \"_start\") (nop)))",
        )
        .expect("the fixture is valid WAT");

        // Rewrite the code section's declared size to just over the ceiling
        // rather than building a module that large: the check reads the header,
        // and a fixture of real instructions would cost the test minutes.
        let over = u32::try_from(MAX_CODE_BYTES + 1).expect("fits");
        let mut header = vec![10u8]; // the code section id
        let mut size = over;
        loop {
            let mut byte = (size & 0x7f) as u8;
            size >>= 7;
            if size != 0 {
                byte |= 0x80;
            }
            header.push(byte);
            if size == 0 {
                break;
            }
        }
        // The bytes have to actually be there: a header claiming a length the
        // file does not carry is refused as malformed, which is a correct
        // refusal but a different one from the ceiling under test.
        header.extend(std::iter::repeat_n(0u8, over as usize));
        wasm.extend_from_slice(&header);

        let err = SandboxHost::from_module(manifest_with(ResourceLimits::default()), &wasm)
            .expect_err("an oversized code section must not reach the compiler");
        assert!(
            matches!(
                err,
                SandboxLoadError::InstantiationTooExpensive {
                    what: "code section bytes",
                    ..
                }
            ),
            "{err:?}"
        );
    }

    #[test]
    fn a_module_whose_global_section_is_too_large_is_refused_before_compilation() {
        // The global section's initializers are an instruction stream —
        // extended-const lets one global's expression run to arbitrary
        // length — but the scanner only recorded the entry count, so a
        // single global with a ceiling-scale initializer sat under every
        // check while handing the compiler that much code to translate.
        // The section header carries the size, so the refusal costs one
        // LEB128 and never touches the instruction stream: the fixture
        // rewrites the global section's declared size rather than building
        // a module that large, the way the code-section test above does.
        let mut wasm = wat::parse_str(
            "(module (memory (export \"memory\") 1) (func (export \"_start\") (nop)))",
        )
        .expect("the fixture is valid WAT");

        // One global, claiming just over the instruction-volume ceiling.
        let over = u32::try_from(MAX_CODE_BYTES + 1).expect("fits");
        let mut header = vec![6u8]; // the global section id
        let mut size = over;
        loop {
            let mut byte = (size & 0x7f) as u8;
            size >>= 7;
            if size != 0 {
                byte |= 0x80;
            }
            header.push(byte);
            if size == 0 {
                break;
            }
        }
        // A count of one, then padding: the bytes have to actually be there,
        // or the header is refused as malformed — a correct refusal, but a
        // different one from the ceiling under test.
        header.push(1u8);
        header.extend(std::iter::repeat_n(0u8, over as usize - 1));
        wasm.extend_from_slice(&header);

        // First the gate itself: this is about ordering, and the gate that
        // runs before `Module::new` has to be the one that says no.
        let err = refuse_unbounded_shape(&wasm)
            .expect_err("an oversized global section must not reach the compiler");
        assert!(
            matches!(
                err,
                SandboxLoadError::InstantiationTooExpensive {
                    what: "code and global section bytes",
                    ..
                }
            ),
            "{err:?}"
        );

        // Then both public doors onto the same bytes.
        let err = SandboxHost::from_module(manifest_with(ResourceLimits::default()), &wasm)
            .expect_err("an oversized global section must not load");
        assert!(
            matches!(
                err,
                SandboxLoadError::InstantiationTooExpensive {
                    what: "code and global section bytes",
                    ..
                }
            ),
            "{err:?}"
        );
        let err =
            SandboxHost::imports_of(&wasm).expect_err("imports_of must apply the same ceiling");
        assert!(
            matches!(
                err,
                SandboxLoadError::InstantiationTooExpensive {
                    what: "code and global section bytes",
                    ..
                }
            ),
            "expected the ceiling on imports_of, got: {err:?}"
        );
    }

    #[test]
    fn a_global_section_at_exactly_the_instruction_ceiling_still_passes_the_gate() {
        // The ceiling is a strict greater-than, so exactly at it must pass.
        // Asserted through the gate directly: `from_module` would then hand
        // the padding to `Module::new`, which refuses the malformed bytes
        // for its own reasons — a correct refusal, but a different one from
        // the ceiling under test.
        let mut wasm = wat::parse_str(
            "(module (memory (export \"memory\") 1) (func (export \"_start\") (nop)))",
        )
        .expect("the fixture is valid WAT");

        // The fixture's own code section counts toward the same ceiling, so
        // the global section fills exactly what it leaves.
        let code_bytes = refuse_unbounded_shape(&wasm)
            .expect("the fixture passes the gate")
            .code_bytes;
        let global_len = MAX_CODE_BYTES - code_bytes;
        let at = u32::try_from(global_len).expect("fits");
        let mut header = vec![6u8]; // the global section id
        let mut size = at;
        loop {
            let mut byte = (size & 0x7f) as u8;
            size >>= 7;
            if size != 0 {
                byte |= 0x80;
            }
            header.push(byte);
            if size == 0 {
                break;
            }
        }
        header.push(1u8);
        header.extend(std::iter::repeat_n(0u8, at as usize - 1));
        wasm.extend_from_slice(&header);

        let shape = refuse_unbounded_shape(&wasm)
            .expect("a global section at exactly the ceiling must pass the gate");
        assert_eq!(
            shape.global_bytes, global_len,
            "the gate must see the section's full size"
        );
        assert_eq!(
            shape.code_bytes.saturating_add(shape.global_bytes),
            MAX_CODE_BYTES,
            "the combined instruction volume sits exactly on the ceiling"
        );
    }

    #[test]
    fn a_module_past_the_byte_ceiling_is_refused_on_the_direct_path_too() {
        // `check_module` applies MAX_MODULE_BYTES to a module the container
        // reader unpacked, but `from_module` and `imports_of` are public and
        // take the bytes directly, so on that path nothing had imposed it. The
        // count ceilings do not close the gap — a module can sit under every
        // one of them and still be enormous, and `Module::new` touches the
        // bytes before any of this build's import checks can refuse them.
        //
        // Padded with a well-formed custom section rather than junk, so the
        // module stays parseable and it is provably the byte ceiling doing the
        // refusing rather than the wasm decoder.
        let base = wat::parse_str(
            "(module (memory (export \"memory\") 1) (func (export \"_start\") (nop)))",
        )
        .expect("the fixture is valid WAT");

        let padding = super::super::MAX_MODULE_BYTES + 1 - base.len();
        let mut section = vec![0x00u8]; // custom section id
        let mut payload = vec![0x04u8]; // name length
        payload.extend_from_slice(b"pad\0");
        payload.resize(payload.len() + padding, 0);
        let mut len = payload.len();
        loop {
            // LEB128 of the payload length.
            let mut byte = u8::try_from(len & 0x7f).expect("masked to 7 bits");
            len >>= 7;
            if len != 0 {
                byte |= 0x80;
            }
            section.push(byte);
            if len == 0 {
                break;
            }
        }
        section.extend_from_slice(&payload);

        let mut wasm = base;
        wasm.extend_from_slice(&section);
        assert!(
            wasm.len() > super::super::MAX_MODULE_BYTES,
            "the fixture must exceed the ceiling: {} bytes",
            wasm.len(),
        );

        let err = SandboxHost::from_module(manifest_with(ResourceLimits::default()), &wasm)
            .expect_err("a module past the byte ceiling must not load");
        assert!(
            matches!(err, SandboxLoadError::ModuleTooLarge { .. }),
            "expected the byte ceiling to refuse it, got: {err}",
        );

        // The review surface is the other public door onto the same bytes, and
        // is exactly where an unaudited artifact would be pointed first.
        let err =
            SandboxHost::imports_of(&wasm).expect_err("imports_of must apply the same ceiling");
        assert!(
            matches!(err, SandboxLoadError::ModuleTooLarge { .. }),
            "expected the byte ceiling on imports_of, got: {err}",
        );
    }

    #[test]
    fn a_module_defining_more_functions_than_the_ceiling_is_refused_at_load() {
        // Neither general ceiling bounds these: a flood of tiny functions sits
        // under both the aggregate declared-entry cap and the code-section byte
        // cap, because each is a couple of bytes of body and one byte of type
        // index — while every instance still allocates an entry per function.
        // The section header carries the count, so the refusal reads one LEB128.
        use std::fmt::Write as _;

        let mut wat = String::from("(module\n  (memory (export \"memory\") 1)\n");
        for i in 0..=MAX_FUNCTIONS {
            let _ = writeln!(wat, "  (func $f{i} (nop))");
        }
        wat.push_str("  (func (export \"_start\") (nop))\n)");
        let wasm = wat::parse_str(&wat).expect("the fixture is valid WAT");

        let err = SandboxHost::from_module(manifest_with(ResourceLimits::default()), &wasm)
            .expect_err("a module past the function ceiling must not load");
        assert!(
            matches!(
                err,
                SandboxLoadError::InstantiationTooExpensive {
                    what: "functions",
                    ..
                }
            ),
            "{err:?}"
        );
    }

    #[test]
    fn a_module_declaring_more_globals_than_the_ceiling_is_refused_at_load() {
        // Every instance allocates and initialises its own copy of each global,
        // and an instance is per request. The aggregate declared-entry ceiling
        // is far too generous to bound them: a module can sit well under a
        // million total entries and still carry hundreds of thousands of
        // globals, which no fuel charge priced and no footprint counted.
        use std::fmt::Write as _;

        let mut wat = String::from("(module\n  (memory (export \"memory\") 1)\n");
        for _ in 0..=MAX_GLOBALS {
            let _ = writeln!(wat, "  (global i32 (i32.const 0))");
        }
        wat.push_str("  (func (export \"_start\") (nop))\n)");
        let wasm = wat::parse_str(&wat).expect("the fixture is valid WAT");

        let err = SandboxHost::from_module(manifest_with(ResourceLimits::default()), &wasm)
            .expect_err("a module past the globals ceiling must not load");
        assert!(
            matches!(
                err,
                SandboxLoadError::InstantiationTooExpensive {
                    what: "globals",
                    ..
                }
            ),
            "{err:?}"
        );
    }

    #[test]
    fn globals_are_priced_into_the_instantiation_charge() {
        // Per-instance work the guest never executes but every request pays
        // for — the same reason segments and imports are charged.
        use std::fmt::Write as _;

        let bare = wat::parse_str(
            "(module (memory (export \"memory\") 1) (func (export \"_start\") (nop)))",
        )
        .expect("the fixture is valid WAT");
        let mut wat = String::from("(module\n  (memory (export \"memory\") 1)\n");
        for _ in 0..64 {
            let _ = writeln!(wat, "  (global i32 (i32.const 0))");
        }
        wat.push_str("  (func (export \"_start\") (nop))\n)");
        let with_globals = wat::parse_str(&wat).expect("the fixture is valid WAT");

        let cheap = SandboxHost::from_module(manifest_with(ResourceLimits::default()), &bare)
            .expect("loads")
            .instantiation_fuel();
        let dear =
            SandboxHost::from_module(manifest_with(ResourceLimits::default()), &with_globals)
                .expect("loads")
                .instantiation_fuel();
        assert_eq!(
            dear,
            cheap + 64,
            "each admitted global must cost a unit: {cheap} then {dear}"
        );
    }

    #[test]
    fn a_flood_of_table_declarations_is_refused_without_collecting_them() {
        // The walk collects each table's initial size so element segments can be
        // bounded against the right table. Collecting them into a growing vector
        // put an unbounded per-entry allocation inside the code whose entire job
        // is to refuse before anything allocates per entry — so a module of
        // empty table declarations expanded the process trying to reject it.
        // Only the first `MAX_TABLES` can ever be admitted, so only those are
        // kept, and the refusal names the count.
        use std::fmt::Write as _;

        let mut wat = String::from("(module\n  (memory (export \"memory\") 1)\n");
        for _ in 0..50_000 {
            let _ = writeln!(wat, "  (table 0 funcref)");
        }
        wat.push_str("  (func (export \"_start\") (nop))\n)");
        let wasm = wat::parse_str(&wat).expect("the fixture is valid WAT");

        // Refused — by wasmi's own hundred-table limit here, since `module_shape`
        // runs before `Module::new` and hands off to it. That the walk no longer
        // grows a vector per declaration on the way is what this change is for,
        // and it is not observable from a test: the allocation was never visible
        // in the result, only in the memory used to produce it.
        assert!(
            SandboxHost::from_module(manifest_with(ResourceLimits::default()), &wasm).is_err(),
            "a flood of table declarations must not load"
        );
    }

    #[test]
    fn a_module_with_more_tables_than_the_store_will_build_is_refused_at_load() {
        // Sizes and count are separate ceilings, and the element sum says
        // nothing about the second: five *empty* tables cost no elements at all
        // and still exceed what the limiter will build, so the artifact loaded,
        // inspected clean, and failed every request at instantiation.
        use std::fmt::Write as _;

        let mut wat = String::from("(module\n  (memory (export \"memory\") 1)\n");
        for _ in 0..=MAX_TABLES {
            let _ = writeln!(wat, "  (table 0 funcref)");
        }
        wat.push_str("  (func (export \"_start\") (nop))\n)");
        let wasm = wat::parse_str(&wat).expect("the fixture is valid WAT");

        let err = SandboxHost::from_module(manifest_with(ResourceLimits::default()), &wasm)
            .expect_err("a module past the table-count ceiling must not load");
        assert!(
            matches!(
                err,
                SandboxLoadError::InstantiationTooExpensive { what: "tables", .. }
            ),
            "{err:?}"
        );
    }

    #[test]
    fn tables_within_the_ceiling_still_load() {
        // The ceiling is a ceiling, not a ban: a module with real tables must
        // still mount, and the sum is across the module rather than per table.
        let half = MAX_TABLE_ELEMENTS / 4;
        let wasm = wat::parse_str(format!(
            "(module (table {half} funcref) (table {half} funcref) (memory (export \"memory\") 1) (func (export \"_start\") (nop)))"
        ))
        .expect("the fixture is valid WAT");
        assert!(
            SandboxHost::from_module(manifest_with(ResourceLimits::default()), &wasm).is_ok(),
            "tables under the ceiling must load"
        );
    }

    #[test]
    fn a_module_declaring_more_entries_than_the_ceiling_never_reaches_the_compiler() {
        // `Module::new` builds a representation of every declaration before any
        // later ceiling runs, so the file's size is not a bound on what
        // compiling it costs. The section headers carry the counts, so the
        // shape is knowable first.
        //
        // A header claiming far more entries than the section holds is refused
        // either way — by this ceiling if the claim is large, by wasmi if the
        // bytes do not back it. Both are a refusal before anything allocates
        // per entry.
        let mut wasm = wat::parse_str("(module (func (export \"_start\") (nop)))")
            .expect("the fixture is valid WAT");
        // Rewrite the type section's declared count to something no 64 MiB file
        // could honestly carry.
        let forged = {
            let mut bytes = vec![0x01u8, 0x05]; // type section, 5 bytes
            bytes.extend_from_slice(&[0xFF, 0xFF, 0xFF, 0xFF, 0x07]); // count: ~2^31
            bytes
        };
        wasm.splice(8..8, forged);

        let err = SandboxHost::from_module(manifest_with(ResourceLimits::default()), &wasm)
            .expect_err("a module past the declared-entry ceiling must not load");
        assert!(
            matches!(
                err,
                SandboxLoadError::InstantiationTooExpensive {
                    what: "declared section entries",
                    ..
                }
            ),
            "{err:?}"
        );

        // And the review surface refuses it too: `inspect` runs this on
        // artifacts nobody has audited, so it must not be the way one exhausts
        // the process reviewing it.
        assert!(
            SandboxHost::imports_of(&wasm).is_err(),
            "the import listing compiled a module the loader would not"
        );
    }

    #[test]
    fn the_metadata_footprint_covers_what_json_escaping_expands_it_to() {
        // The footprint charged metadata at `4 ×`: the caller's strings, the
        // frame's clone of them, and the serialised line priced at the raw byte
        // count. But JSON is an *escaping* encoding — `serde_json` writes a
        // control character as `\u0000`, six bytes for one — and every byte of
        // a metadata field can be one. An HTTP request cannot carry them, but
        // `SandboxHost::run` is public and an embedder builds the request by
        // hand, so the bound has to hold for the API rather than for the
        // adapter that is merely its politest caller.
        //
        // Measured, not asserted from arithmetic: the constant has to track
        // what the serialiser actually writes, so if that ever changes this
        // fails rather than quietly understating the product again.
        let granted = [SandboxCapability::HttpRequest];
        let filler = "\u{0}".repeat(4096);

        let mut request = get("/hello/greet");
        request.query = filler.clone();
        let with = crate::plugin_sandbox::wire::to_line(
            &crate::plugin_sandbox::wire::HostFrame::request(&request, &granted),
        )
        .expect("serialises")
        .len();

        request.query = String::new();
        let without = crate::plugin_sandbox::wire::to_line(
            &crate::plugin_sandbox::wire::HostFrame::request(&request, &granted),
        )
        .expect("serialises")
        .len();

        // What one raw metadata byte becomes in the line.
        let expansion = with.saturating_sub(without) / filler.len();
        assert!(
            expansion > 4,
            "the fixture does not exceed the old factor, so it proves nothing: {expansion}"
        );
        assert!(
            expansion <= 6,
            "escaping expands further than the footprint charges: {expansion}"
        );

        // …so the term must cover the caller's copy, the frame's clone, and the
        // expanded line — all three live while the line is built.
        //
        // Isolated by subtraction rather than compared against the whole
        // footprint: at the default limits the other terms come to ~58 MiB, so
        // `footprint >= 2 MiB` would hold at *any* metadata factor and prove
        // nothing. Zeroing the three manifest-driven terms leaves only the
        // fixed ones, which are subtracted here by name.
        let bare = ResourceLimits {
            memory_bytes: 0,
            max_request_body_bytes: 0,
            max_response_bytes: 0,
            ..ResourceLimits::default()
        };
        let fixed = u128::from(MAX_TABLE_ELEMENTS) * 16
            + MAX_GLOBALS as u128 * 16
            + MAX_FUNCTIONS as u128 * 32
            + FIXED_HOST_BUFFER_BYTES as u128;
        let charged_for_metadata = bare.request_footprint_bytes().saturating_sub(fixed);
        assert_eq!(
            charged_for_metadata,
            MAX_REQUEST_METADATA_BYTES as u128 * (2 + expansion as u128),
            "the metadata term does not match what the serialiser was measured to write"
        );
    }

    #[test]
    fn request_metadata_over_the_ceiling_is_refused_before_the_frame_is_built() {
        // The body ceiling was the manifest's and only ever covered the body.
        // Everything else on a `SandboxRequest` — query, headers, path params —
        // is cloned into the frame and serialised into the NDJSON line just the
        // same, and `request_footprint_bytes` budgets for none of it. The
        // encoding charge prices those bytes, but a manifest may declare fuel
        // enough to buy more than a terabyte of them, so pricing is not a bound.
        let host = host(guests::HELLO);
        let mut request = get("/hello/greet");
        request.query = "x=".repeat(MAX_REQUEST_METADATA_BYTES);

        let outcome = host.run(&request);
        let err = outcome
            .result
            .expect_err("oversized metadata must be refused");
        assert!(
            matches!(err, SandboxFailure::RequestMetadataBudget { .. }),
            "{err:?}"
        );
        // The caller's request was refused, not the plugin's answer: 413, the
        // same door the body ceiling answers through.
        assert_eq!(err.status(), http::StatusCode::PAYLOAD_TOO_LARGE);
        assert_eq!(
            outcome.fuel_used, 0,
            "nothing was built, so nothing was spent"
        );
    }

    #[test]
    fn the_metadata_ceiling_leaves_an_ordinary_request_alone() {
        // A ceiling that a real request could reach would be a bug of its own:
        // every HTTP server in front of this caps a URI and a header block far
        // below it.
        let host = host(guests::HELLO);
        let mut request = get("/hello/greet");
        request.query = "x=1&".repeat(64);
        request
            .headers
            .push(("x-trace".to_owned(), "a".repeat(1024)));
        assert!(
            host.run(&request).result.is_ok(),
            "an ordinary request must not be caught by the metadata ceiling"
        );
    }

    #[test]
    fn a_body_over_the_ceiling_is_refused_by_run_itself() {
        // The Axum adapter applies the ceiling while reading, so nothing
        // oversized reaches `run` on that path. But `run` is public: an
        // embedder builds the `SandboxRequest` itself, and a manifest with
        // generous fuel would otherwise buy an arbitrarily large host-side
        // copy — cloned into the frame and base64-expanded — of a body the
        // manifest said it would never accept.
        let host = try_host_with(
            guests::HELLO,
            ResourceLimits {
                max_request_body_bytes: 1_024,
                // Deliberately generous — the largest a manifest may declare.
                // The encoding price must not be what saves us here, or the
                // ceiling is decorative on this path.
                fuel: 100_000_000_000,
                ..ResourceLimits::default()
            },
        )
        .expect("the fixture loads");

        let mut request = get("/hello/greet");
        request.body = vec![b'x'; 1_025];
        let outcome = host.run(&request);
        assert_eq!(
            outcome.result,
            Err(SandboxFailure::RequestBudget {
                max: 1_024,
                len: 1_025,
            }),
            "a body over the ceiling must be refused, not encoded"
        );
        // Refused before the request was priced or walked at all.
        assert_eq!(outcome.fuel_used, 0);
        assert_eq!(outcome.peak_memory_bytes, 0);
        // The same answer the adapter gives for the same condition.
        assert_eq!(
            outcome.result.unwrap_err().status(),
            http::StatusCode::PAYLOAD_TOO_LARGE
        );

        // And a body exactly at the ceiling is still served: the check is a
        // ceiling, not an off-by-one that costs the last byte.
        request.body = vec![b'x'; 1_024];
        let outcome = host.run(&request);
        assert!(outcome.result.is_ok(), "{:?}", outcome.result);
    }

    #[test]
    fn a_malformed_frame_is_refused() {
        let outcome = host(guests::MALFORMED_FRAME).run(&get("/hello/greet"));
        assert!(
            matches!(outcome.result, Err(SandboxFailure::MalformedFrame(_))),
            "{:?}",
            outcome.result
        );
    }

    #[test]
    fn an_op_the_wire_does_not_define_is_refused() {
        let outcome = host(guests::UNKNOWN_OP).run(&get("/hello/greet"));
        assert!(
            matches!(outcome.result, Err(SandboxFailure::MalformedFrame(_))),
            "{:?}",
            outcome.result
        );
    }

    #[test]
    fn the_first_answer_is_the_answer() {
        let outcome = host(guests::DOUBLE_ANSWER).run(&get("/hello/greet"));
        assert_eq!(
            outcome.result.expect("answers").body,
            b"hello from the sandbox"
        );
    }

    #[test]
    fn every_refusal_stub_matches_the_wasi_signature_it_stands_in_for() {
        // A wrong signature would not weaken the sandbox — it would stop an
        // honest guest from linking at all. This builds a module importing
        // every refusal with the shape the table declares and proves it
        // instantiates and runs.
        use std::fmt::Write as _;

        let mut wat = String::from("(module\n");
        for (name, _, _, signature) in DENIED_IMPORTS {
            let params: Vec<&str> = signature
                .chars()
                .map(|ch| if ch == 'l' { "i64" } else { "i32" })
                .collect();
            let _ = writeln!(
                wat,
                "  (import \"wasi_snapshot_preview1\" \"{name}\" (func (param {params}) (result i32)))",
                params = params.join(" ")
            );
        }
        wat.push_str("  (memory (export \"memory\") 1)\n  (func (export \"_start\") (nop))\n)");
        let outcome = host(&wat).run(&get("/hello/greet"));
        assert!(
            matches!(outcome.result, Err(SandboxFailure::NoAnswer)),
            "every stub must link: {:?}",
            outcome.result
        );
    }

    #[test]
    fn an_import_with_the_wrong_signature_is_refused_at_load() {
        // Name-checking alone lets a module through packaging and inspection
        // and then fails it on every request, as a gateway error nobody can
        // explain from outside.
        let wat = r#"(module
             (import "wasi_snapshot_preview1" "fd_write"
               (func (param i32 i32) (result i32)))
             (memory (export "memory") 1)
             (func (export "_start") (nop)))"#;
        let err = try_host(wat).expect_err("must be refused");
        let SandboxLoadError::ForbiddenImports(denials) = err else {
            panic!("expected a forbidden-import refusal, got {err}");
        };
        assert!(denials[0].operation.contains("fd_write"), "{denials:?}");
        assert!(denials[0].detail.contains("signature"), "{denials:?}");
    }

    #[test]
    fn a_non_function_import_is_refused_at_load() {
        let wat = r#"(module
             (import "wasi_snapshot_preview1" "fd_write" (memory 1))
             (memory (export "memory") 1)
             (func (export "_start") (nop)))"#;
        assert!(matches!(
            try_host(wat),
            Err(SandboxLoadError::ForbiddenImports(_))
        ));
    }

    #[test]
    fn a_start_that_takes_arguments_is_not_a_start() {
        // The host looks `_start` up as `() -> ()`, so anything else loads and
        // then fails on every request.
        let wat = r#"(module
             (memory (export "memory") 1)
             (func (export "_start") (param i32) (nop)))"#;
        assert!(matches!(try_host(wat), Err(SandboxLoadError::MissingStart)));

        let wat = r#"(module
             (memory (export "memory") 1)
             (func (export "_start") (result i32) (i32.const 0)))"#;
        assert!(matches!(try_host(wat), Err(SandboxLoadError::MissingStart)));
    }

    #[test]
    fn the_load_gate_admits_exactly_what_the_shim_defines() {
        for (name, ..) in SERVED_IMPORTS {
            assert!(is_shim_function(name), "{name} is served but not admitted");
        }
        for (name, ..) in DENIED_IMPORTS {
            assert!(is_shim_function(name), "{name} is refused but not admitted");
        }
        for name in ["sock_connect", "path_open_v2", "fd_write2"] {
            assert!(!is_shim_function(name), "{name} must not be admitted");
        }
    }

    #[test]
    fn the_import_list_is_readable_for_review() {
        let imports = host(guests::HELLO).imports();
        assert!(
            imports.contains(&"wasi_snapshot_preview1::fd_read".to_owned()),
            "{imports:?}"
        );
    }

    // ── Reply room is reserved before a call commits (issue #2523) ───

    fn outbound_state(
        queued: usize,
    ) -> (
        HostState,
        std::sync::Arc<crate::plugin_sandbox::RecordingHttp>,
    ) {
        let limits = ResourceLimits::default();
        let manifest = crate::plugin_sandbox::manifest::SandboxManifest::parse(&format!(
            r#"
name = "hello"
version = "0.1.0"
wire_version = 1
prefix = "/hello"
capabilities = ["http-request", "http-outbound", "kv"]
sha256 = "{digest}"

[[routes]]
method = "GET"
path = "/hello/greet"

[grants]
hosts = ["api.example.com"]
"#,
            digest = "a".repeat(64)
        ))
        .expect("valid manifest");
        let http = crate::plugin_sandbox::RecordingHttp::new();
        let services = crate::plugin_sandbox::CapabilityServices {
            http: Some(std::sync::Arc::clone(&http)
                as std::sync::Arc<dyn crate::plugin_sandbox::OutboundHttp>),
            kv: Some(crate::plugin_sandbox::MemoryKvStore::new()
                as std::sync::Arc<dyn crate::plugin_sandbox::KvStore>),
            ..crate::plugin_sandbox::CapabilityServices::none()
        };
        let mut state = HostState::new(
            "hello".to_owned(),
            limits,
            b"",
            Exchange::Request,
            crate::plugin_sandbox::capability::CapabilityRuntime::new(&manifest, services),
        );
        state.queued_replies = queued;
        (state, http)
    }

    fn post() -> crate::plugin_sandbox::CapabilityCall {
        crate::plugin_sandbox::CapabilityCall::HttpFetch {
            id: 1,
            method: "POST".to_owned(),
            url: "https://api.example.com/orders".to_owned(),
            headers: Vec::new(),
            body: String::new(),
        }
    }

    #[test]
    fn a_call_is_not_committed_when_its_reply_could_not_be_queued() {
        // One MiB queue, nearly full of unread replies: a POST could commit and
        // then fail the request on its own reply.
        let (mut state, http) = outbound_state(MAX_QUEUED_REPLY_BYTES - 1024);
        state.service(&post(), u64::MAX);
        assert!(http.seen().is_empty(), "the POST left the host");
        assert!(state.answer.is_none(), "the request must go on");
        let queued =
            String::from_utf8_lossy(&state.stdin.iter().copied().collect::<Vec<_>>()).into_owned();
        assert!(queued.contains("quota-exceeded"), "{queued}");
    }

    #[test]
    fn a_call_is_not_committed_when_the_fuel_could_not_pay_for_its_reply() {
        let (mut state, http) = outbound_state(0);
        state.service(&post(), 1_000);
        assert!(http.seen().is_empty(), "the POST left the host");
        assert!(state.answer.is_none(), "the request must go on");
    }

    #[test]
    fn a_call_with_room_and_fuel_is_dispatched() {
        let (mut state, http) = outbound_state(0);
        state.service(&post(), u64::MAX);
        assert_eq!(http.seen().len(), 1);
    }
    /// Fuel to price `call`'s worst-case reply and write the answer.
    fn priced(call: &crate::plugin_sandbox::CapabilityCall) -> u64 {
        let allowance = FINISH_ALLOWANCE_FUEL.min(ResourceLimits::default().fuel / 4);
        allowance + (call.reply_reserve() as u64).div_ceil(BYTES_PER_FUEL)
    }

    fn get_call() -> crate::plugin_sandbox::CapabilityCall {
        crate::plugin_sandbox::CapabilityCall::HttpFetch {
            id: 1,
            method: "GET".to_owned(),
            url: "https://api.example.com/".to_owned(),
            headers: Vec::new(),
            body: String::new(),
        }
    }

    #[test]
    fn the_fuel_edge_for_a_write_includes_the_guest_s_read() {
        // #2523 finding 7. Fuel to price the reply is not fuel to read it. A
        // POST that commits and then runs out of fuel in the guest fails, and a
        // retry sends it again.
        let need = priced(&post()) + post().reply_reserve() as u64 * GUEST_READ_FUEL_PER_BYTE;
        let (mut state, http) = outbound_state(0);
        state.service(&post(), priced(&post()));
        assert!(http.seen().is_empty(), "the guest could not read the reply");
        let (mut state, http) = outbound_state(0);
        state.service(&post(), need - 1);
        assert!(http.seen().is_empty(), "one unit short must not dispatch");
        let (mut state, http) = outbound_state(0);
        state.service(&post(), need);
        assert_eq!(http.seen().len(), 1);
    }

    #[test]
    fn the_fuel_edge_for_a_read_is_its_price() {
        // A read that fails commits nothing, so it keeps no fuel to be read.
        let (mut state, http) = outbound_state(0);
        state.service(&get_call(), priced(&get_call()) - 1);
        assert!(http.seen().is_empty(), "one unit short must not dispatch");
        let (mut state, http) = outbound_state(0);
        state.service(&get_call(), priced(&get_call()));
        assert_eq!(http.seen().len(), 1);
    }

    /// What the host queued for the guest, as text.
    fn queued_text(state: &HostState) -> String {
        String::from_utf8_lossy(&state.stdin.iter().copied().collect::<Vec<_>>()).into_owned()
    }

    /// Fuel to price `call`, write the answer, and read `unread` bytes plus the
    /// reply.
    fn with_read(call: &crate::plugin_sandbox::CapabilityCall, unread: usize) -> u64 {
        priced(call) + (call.reply_reserve() + unread) as u64 * GUEST_READ_FUEL_PER_BYTE
    }

    #[test]
    fn a_fuel_refusal_and_a_queue_refusal_say_different_things() {
        let (mut state, http) = outbound_state(0);
        state.service(&post(), priced(&post()));
        assert!(http.seen().is_empty());
        assert!(state.answer.is_none(), "the request must go on");
        let text = queued_text(&state);
        assert!(text.contains("quota-exceeded"), "{text}");
        assert!(text.contains("increase `fuel`"), "{text}");
        assert!(!text.contains("pending replies"), "{text}");

        let (mut state, _) = outbound_state(MAX_QUEUED_REPLY_BYTES - 1024);
        state.service(&post(), u64::MAX);
        let text = queued_text(&state);
        assert!(text.contains("pending replies"), "{text}");
        assert!(!text.contains("fuel"), "{text}");
    }

    #[test]
    fn a_write_keeps_fuel_to_read_the_replies_not_yet_read() {
        let unread = 10_000;
        let (mut state, http) = outbound_state(unread);
        state.service(&post(), with_read(&post(), unread) - 1);
        assert!(http.seen().is_empty(), "one unit short must not dispatch");
        let (mut state, http) = outbound_state(unread);
        state.service(&post(), with_read(&post(), unread));
        assert_eq!(http.seen().len(), 1);
    }

    #[test]
    fn a_read_after_a_write_keeps_fuel_to_read_its_reply() {
        // The write has run. A read that then fails the request makes a retry
        // do the write again.
        let (mut state, http) = outbound_state(0);
        state.service(&post(), u64::MAX);
        assert_eq!(http.seen().len(), 1);
        state.service(
            &get_call(),
            with_read(&get_call(), state.queued_replies) - 1,
        );
        assert_eq!(http.seen().len(), 1, "one unit short must not dispatch");
        state.service(&get_call(), with_read(&get_call(), state.queued_replies));
        assert_eq!(http.seen().len(), 2);
    }

    #[test]
    fn a_write_refused_before_it_runs_does_not_make_reads_keep_fuel() {
        let (mut state, http) = outbound_state(0);
        state.service(&post(), priced(&post()));
        assert!(http.seen().is_empty());
        state.service(&get_call(), priced(&get_call()));
        assert_eq!(http.seen().len(), 1);
    }

    #[test]
    fn the_fuel_edge_for_a_kv_write_is_about_0_6_million() {
        let set = crate::plugin_sandbox::CapabilityCall::KvSet {
            id: 1,
            key: "cart".to_owned(),
            value: crate::plugin_sandbox::PluginValue::Text("one".to_owned()),
        };
        // The guide quotes this number.
        assert_eq!(with_read(&set, 0), 624_352);
        let (mut state, _) = outbound_state(0);
        state.service(&set, with_read(&set, 0) - 1);
        assert!(queued_text(&state).contains("increase `fuel`"));
        let (mut state, _) = outbound_state(0);
        state.service(&set, with_read(&set, 0));
        let text = queued_text(&state);
        assert!(text.contains(r#""status":"ok""#), "{text}");
    }

    #[test]
    fn a_get_is_denied_not_failed_when_the_fuel_cannot_price_its_reply() {
        let read = || crate::plugin_sandbox::CapabilityCall::HttpFetch {
            id: 1,
            method: "GET".to_owned(),
            url: "https://api.example.com/".to_owned(),
            headers: Vec::new(),
            body: String::new(),
        };
        let queued = |state: &HostState| {
            String::from_utf8_lossy(&state.stdin.iter().copied().collect::<Vec<_>>()).into_owned()
        };
        let (mut state, _) = outbound_state(0);
        state.service(&read(), 10);
        assert!(state.answer.is_none(), "the request must go on");
        assert!(
            queued(&state).contains("quota-exceeded"),
            "{}",
            queued(&state)
        );
        let (mut state, _) = outbound_state(0);
        state.service(&read(), 1_000_000);
        assert!(
            !queued(&state).contains("quota-exceeded"),
            "{}",
            queued(&state)
        );
    }
}