Module limits 

Per-guest execution limits: epoch-based deadlines and store resource caps.

Every guest this runtime executes — capsule run, tool/driver run, and each hook lifecycle call — runs against a Store wired with two independent bounds:

• an epoch deadline, set before each invocation and enforced by [EpochTicker], which advances the engine’s epoch on a fixed interval so a guest that never returns traps instead of hanging the session; and
• a resource limiter ([ExecutionLimiter]) capping linear-memory growth, table growth, and instance count.

Both are sourced from the manifest’s capabilities.limits block, falling back to the DEFAULT_* constants below for any field it omits. A silent manifest means defaults, never “unlimited”.

Two mechanisms for one deadline

Epoch checks are compiled into wasm loop back-edges and function entries, so the epoch deadline can only fire while guest code is executing. A call blocked inside a host call — a wasi:clocks sleep, a wasi:io/poll on an HTTP response that never comes — is out of its reach until control returns to wasm.

Every component call is therefore also wrapped in a wall-clock bound, [bound_call], of deadline_seconds plus [WALL_DEADLINE_GRACE], measured per phase (instantiation, then the call) from the moment that phase’s future starts. A guest computing past its deadline is trapped by the epoch first, with the epoch’s message; the wall bound fires only where the epoch cannot, and stops the call by dropping its future, which disposes the guest fiber and any outbound request pending under it. Each firing is pushed into the session’s [CallDeadlines] latch, which the trace drains into call_deadline lines.

Structs

ExecutionLimits

Fully-resolved execution limits for one session’s guests: the manifest’s capabilities.limits block with every omitted field replaced by its DEFAULT_*.

Constants

DEFAULT_DEADLINE_SECONDS

Default wall-clock budget for a single guest invocation — 10 minutes.

DEFAULT_INSTANCES

Default cap on instances a single store may create. A component instantiates one core instance per core module, so single digits is typical; this only stops a pathological instantiation loop.

DEFAULT_MEMORY_BYTES

Default cap on guest linear-memory growth — 512 MiB. Chosen to sit far above what any real capsule, tool, or hook needs while still bounding a runaway allocation loop.

DEFAULT_TABLE_ELEMENTS

Default cap on guest table growth, in elements.

HOOK_DEFAULT_DEADLINE_SECONDS

Default wall-clock budget for a single hook lifecycle call — 30 seconds.