Bound Wasm artifact metadata loading

docs/setup.md

@@ -246,7 +246,13 @@ Important settings:
   output; generated C++, exports, source map, Wasm, metadata, cached-module
   invalidation, and diagnostics are published or rolled back as one guarded
   generation. Proactive and offline precompile work remain independent of
-  request invocation deadlines.
+  request invocation deadlines. Serialized-module metadata scanning checks the
+  absolute deadline between section headers and before and after every bounded
+  4 KiB positional read. Cache-miss full-artifact reads use the same checks
+  around 64 KiB positional chunks. A single in-progress regular-file syscall
+  cannot be cooperatively interrupted; later reads and parsing cannot overrun the budget.
+  Initial/final descriptor identity, unique selected metadata sections, and
+  strict 64-bit LEB high-bit validation reject changed or ambiguous artifacts.
 
 After editing settings, restart UCE:
 

docs/wasm-runtime-architecture.md

@@ -247,9 +247,19 @@ through a bounded 4 KiB positional buffer and retains only `dylink.0`, `uce.abi`
 and the tiny `uce.module` identity. It skips code and data bodies rather than
 issuing byte-at-a-time reads or faulting those bodies into every new worker.
 The request profile reports the physical read-ahead bytes and positional read
-count. Initial and final descriptor identity checks reject an artifact changed
-during the scan. A missing/stale/invalid serialized module
-still reads, validates, compiles, and republishes the complete wasm artifact.
+count. The scanner checks the same non-renewable invocation deadline before
+each section and before and after every buffer refill; expiry is returned as the
+canonical `UCE_INVOCATION_TIMEOUT` error. One in-progress regular-file
+`pread()` remains the irreducible synchronous boundary. Initial descriptor
+validation matches device, inode, mode, nanosecond timestamps, and size from
+the preceding lookup; final validation rejects in-place truncation or mutation.
+Selected metadata sections must be unique and individually remain at most 1 MiB,
+which also bounds aggregate retained metadata. Both streamed and full-artifact
+LEB readers reject nonzero unused bits in the tenth `u64` byte. A
+missing/stale/invalid serialized module
+still reads the complete wasm artifact in deadline-checked 64 KiB positional
+chunks, validates it, compiles it, and republishes the serialization. The full
+read uses the same initial/final descriptor identity guard.
 The proactive compiler also creates that serialization immediately after source
 compilation, keeping first-worker native compilation off the request path.
 Cold module compilation and deserialization are host work, so `load_unit()`
@@ -564,7 +574,7 @@ header free-functions are `inline`. The wasm backend exposes only declarations
   the dependency byte-for-byte, and requires the parent to recover. Failed
   builds persist the input signature that actually failed, so metadata from an
   older successful artifact cannot indefinitely defer that rebuild.
-  also rejects an unreadable unit without publishing a wasm artifact, restores
+  The gate also rejects an unreadable unit without publishing a wasm artifact, restores
   its permissions and proves the next CLI request compiles it, then sends 48
   requests and asserts the observed worker PID set does not exceed
   `WORKER_COUNT`, guarding against accidental reintroduction of request-count
@@ -572,6 +582,11 @@ header free-functions are `inline`. The wasm backend exposes only declarations
   the generated C++ snapshot has been written. The compiler must either retry
   and serve the post-edit source or fail closed; it must never stamp current
   source metadata onto wasm produced from an older snapshot.
+- **Metadata scanner deadline**: an isolated one-worker gate uses a targeted
+  positional-read interposer to prove canonical expiry after one delayed 4 KiB
+  metadata read and after one delayed cache-miss 64 KiB full-artifact read,
+  concurrent truncation and same-size mutation rejection, malformed tenth-byte
+  LEB rejection, duplicate selected-section rejection, and same-worker recovery.
 - **Core compatibility**: the production core owns and exports its growable
   function table, enabling `InstancePre`. A separately built legacy
   `--import-table` core must still pass the demo and 64-request pool-isolation