Bound request-time Wasm compilation

docs/setup.md

@@ -237,7 +237,16 @@ Important settings:
   the Wasm backend from starting. The invocation timeout defaults to `30000` and is
   enforced to the epoch ticker's period resolution. Blocking host helpers
   retain their own shorter limits and are capped to the remaining invocation
-  budget where the underlying operation is cancellable.
+  budget where the underlying operation is cancellable. Cold entry compilation,
+  explicit `unit_compile()`, dynamic component JIT, transitive `#load` work,
+  compiler and registry lock waits, and the configured runtime-error page all
+  consume the same request budget. A timed-out compiler process group is killed
+  without replacing the prior artifact set or persisting a compile-failure
+  backoff. Request compiles require a zero child exit status and complete staged
+  output; generated C++, exports, source map, Wasm, metadata, cached-module
+  invalidation, and diagnostics are published or rolled back as one guarded
+  generation. Proactive and offline precompile work remain independent of
+  request invocation deadlines.
 
 After editing settings, restart UCE:
 

docs/wasm-runtime-architecture.md

@@ -202,14 +202,23 @@ The graceful signal handler belongs to the parent and render workers. Generic
 
 Epoch interruption measures uninterrupted guest CPU segments. A separate
 absolute workspace invocation deadline starts before app-owned entry-unit
-loading and initialization and remains unchanged through the selected handler,
-ONCE, and every nested component/unit call. The common hostcall membrane checks
+readiness and cold compilation, loading, and initialization. It remains
+unchanged through the selected handler, ONCE, every nested component/unit call,
+and configured runtime-error rendering. The common hostcall membrane checks
 that deadline before and after every native call and re-arms the store with the
 smaller of the remaining absolute budget and the CPU-segment budget. A cheap
 hostcall loop therefore cannot renew an invocation indefinitely. Blocking host
 helpers retain operation-specific limits and cap them to the remaining
 invocation budget where the underlying operation is cancellable. Forked task
 callbacks receive a fresh invocation deadline capped by the task lifetime.
+Synchronous compiler locks, transitive `#load` compilation, and compiler child
+processes consume that same deadline. Compiler children run in a dedicated
+process group; timeout kills the group, retains the previous generation, and
+never records a caller-budget timeout as a persisted source failure. Bounded
+compiles require a valid zero child exit, cap captured output, and stage
+generated C++, exports, source maps, Wasm, and metadata. Publication removes
+the prior serialized module and diagnostics inside the same rollback-protected
+generation while repeatedly checking the live request deadline.
 
 `request_perf()` reports worker module-cache hits and misses and divides a miss
 into artifact lookup, wasm read, custom-section parse, serialized-module
@@ -556,6 +565,13 @@ header free-functions are `inline`. The wasm backend exposes only declarations
   function table, enabling `InstancePre`. A separately built legacy
   `--import-table` core must still pass the demo and 64-request pool-isolation
   groups before the compatibility fallback changes.
+  `scripts/test_wasm_compile_timeout.sh` runs an isolated one-worker runtime
+  with a two-second request budget. It covers cold entry JIT, guest
+  `unit_compile()`, dynamic component and transitive `#load` compilation,
+  held unit and registry locks, silent nonzero and missing-output compiler
+  results, compiler descendants, staged-output timeout, prior-generation
+  hashes, same-worker recovery, configured-error-page boundedness, residue,
+  and deadline-independent offline precompile.
   `scripts/test_cold_component_deadline.sh` separately compiles a deliberately
   cold component that exceeds the development epoch window and proves the
   parent request still renders it. The focused shell gates create temporary