Module pool 

Per-plugin instance cache with a concurrency cap.

One InstancePool per loaded plugin. It does not reuse live instances. Every InstancePool::acquire constructs a fresh instance via the loader-supplied factory; the factory is expected to be cheap because the heavy artifacts (a compiled wasmtime Component plus its InstancePre, or extism’s prepared Manifest) are cached by the loader and the factory only spins up a fresh Store+instance.

Freshness per acquire is a security property, not just hygiene:

• A reused Store<HostState> would leak guest linear memory, globals, and WASI context across unrelated invocations — a Pure function could carry state between two unrelated queries (bug #2).
• A trapped store recycled back into a warm pool would re-trap or read poisoned memory on its next use (bug #3).

Re-instantiating per acquire closes both: fresh state every call, and a trapped instance is simply dropped (its Drop decrements the live counter) and never handed out again.

What remains of the old pool is the concurrency cap: PoolConfig::max_instances bounds how many instances may be live at once (so a flood of concurrent UDF calls can’t exhaust wasmtime memory), enforced via the same CAS-guarded live counter the old capacity check used. PoolMetrics keeps a sane meaning — misses counts fresh constructions (every acquire), hits is now always zero (no warm reuse), exhausted counts cap rejections, live is the current in-flight count.

Generic over both:

• T — the per-invoke instance type (extism::Plugin, a wasmtime component instance wrapper, or a dummy in tests).
• E — the loader-specific error type. The factory returns Result<T, E>; acquire constructs E from a resource-exhaustion message via PoolResourceLimit.

Structs

InstancePool

A per-plugin instance cache with a concurrency cap.

PoolConfig

Per-pool configuration.

PoolMetrics

Pool metrics surface — read by host.metric_counter host imports.

PooledInstance

RAII handle to an instance acquired from an InstancePool.

Traits

PoolResourceLimit

Loader-error trait used by InstancePool::acquire to construct the “pool at capacity” error.