Module limits 

Per-guest execution limits: epoch-based deadlines and store resource caps.

Every guest this runtime executes — capsule run, tool/driver run, and each hook lifecycle call — runs against a Store wired with two independent bounds:

• an epoch deadline, set before each invocation and enforced by [EpochTicker], which advances the engine’s epoch on a fixed interval so a guest that never returns traps instead of hanging the session; and
• a resource limiter ([ExecutionLimiter]) capping linear-memory growth, table growth, and instance count.

Both are sourced from the manifest’s capabilities.limits block, falling back to the DEFAULT_* constants below for any field it omits. A silent manifest means defaults, never “unlimited”.

What an epoch deadline does and does not bound

Epoch checks are compiled into wasm loop back-edges and function entries, so the deadline can only fire while guest code is executing. Time spent blocked inside a host call (notably wasi:io/poll) elapses against the same wall-clock budget but cannot be interrupted until control returns to wasm. This bounds runaway guest compute, which is what makes a spin loop killable; it is not a general-purpose I/O timeout.

Structs

ExecutionLimits

Fully-resolved execution limits for one session’s guests: the manifest’s capabilities.limits block with every omitted field replaced by its DEFAULT_*.

Constants

DEFAULT_DEADLINE_SECONDS

Default wall-clock budget for a single guest invocation — 10 minutes.

DEFAULT_INSTANCES

Default cap on instances a single store may create. A component instantiates one core instance per core module, so single digits is typical; this only stops a pathological instantiation loop.

DEFAULT_MEMORY_BYTES

Default cap on guest linear-memory growth — 512 MiB. Chosen to sit far above what any real capsule, tool, or hook needs while still bounding a runaway allocation loop.

DEFAULT_TABLE_ELEMENTS

Default cap on guest table growth, in elements.

HOOK_DEFAULT_DEADLINE_SECONDS

Default wall-clock budget for a single hook lifecycle call — 30 seconds.