Bound Wasm artifact metadata loading

docs/setup.md

@@ -246,7 +246,13 @@ Important settings:
   output; generated C++, exports, source map, Wasm, metadata, cached-module
   invalidation, and diagnostics are published or rolled back as one guarded
   generation. Proactive and offline precompile work remain independent of
-  request invocation deadlines.
+  request invocation deadlines. Serialized-module metadata scanning checks the
+  absolute deadline between section headers and before and after every bounded
+  4 KiB positional read. Cache-miss full-artifact reads use the same checks
+  around 64 KiB positional chunks. A single in-progress regular-file syscall
+  cannot be cooperatively interrupted; later reads and parsing cannot overrun the budget.
+  Initial/final descriptor identity, unique selected metadata sections, and
+  strict 64-bit LEB high-bit validation reject changed or ambiguous artifacts.
 
 After editing settings, restart UCE: