Enforce absolute Wasm invocation deadlines

docs/setup.md

@@ -199,6 +199,7 @@ WASM_CORE_PATH=<UCE_REPO_ROOT>/bin/wasm/core.wasm
 WASM_MEMORY_LIMIT_BYTES=536870912
 WASM_EPOCH_DEADLINE_TICKS=200
 WASM_EPOCH_PERIOD_MS=50
+WASM_INVOCATION_TIMEOUT_MS=30000
 MYSQL_PERSISTENT_POOL_SIZE=8
 
 WORKER_COUNT=4
@@ -227,6 +228,16 @@ Important settings:
 - `WASM_COMPILE_SCRIPT` must point to `scripts/compile_wasm_unit` unless you provide an equivalent compiler. Relative paths are resolved from the runtime root/`COMPILER_SYS_PATH`. That script calls `scripts/check_unit_wasm.py` after linking each unit and uses the pinned WASI SDK on every deployment host.
 - `PROACTIVE_COMPILE_JOBS` selects 1–16 low-priority full-site scanner processes (default `2`). Each canonical unit path has one scanner owner. The separate higher-priority demand compiler remains reserved for stale units requested over HTTP, so total background compile concurrency can reach this value plus one.
 - `WASM_CORE_PATH` must point at the built `core.wasm` file.
+- `WASM_EPOCH_DEADLINE_TICKS` and `WASM_EPOCH_PERIOD_MS` bound one
+  uninterrupted guest CPU segment. `WASM_INVOCATION_TIMEOUT_MS` is the
+  separate absolute wall-clock bound for app-owned unit loading,
+  initialization, the selected handler, and all nested component/unit calls.
+  The three values must be positive integers; the ticker period is capped at
+  `1000` ms and the invocation timeout at `86400000` ms. Invalid values prevent
+  the Wasm backend from starting. The invocation timeout defaults to `30000` and is
+  enforced to the epoch ticker's period resolution. Blocking host helpers
+  retain their own shorter limits and are capped to the remaining invocation
+  budget where the underlying operation is cancellable.
 
 After editing settings, restart UCE: