Bound request-time Wasm compilation

docs/wasm-runtime-architecture.md

@@ -202,14 +202,23 @@ The graceful signal handler belongs to the parent and render workers. Generic
 
 Epoch interruption measures uninterrupted guest CPU segments. A separate
 absolute workspace invocation deadline starts before app-owned entry-unit
-loading and initialization and remains unchanged through the selected handler,
-ONCE, and every nested component/unit call. The common hostcall membrane checks
+readiness and cold compilation, loading, and initialization. It remains
+unchanged through the selected handler, ONCE, every nested component/unit call,
+and configured runtime-error rendering. The common hostcall membrane checks
 that deadline before and after every native call and re-arms the store with the
 smaller of the remaining absolute budget and the CPU-segment budget. A cheap
 hostcall loop therefore cannot renew an invocation indefinitely. Blocking host
 helpers retain operation-specific limits and cap them to the remaining
 invocation budget where the underlying operation is cancellable. Forked task
 callbacks receive a fresh invocation deadline capped by the task lifetime.
+Synchronous compiler locks, transitive `#load` compilation, and compiler child
+processes consume that same deadline. Compiler children run in a dedicated
+process group; timeout kills the group, retains the previous generation, and
+never records a caller-budget timeout as a persisted source failure. Bounded
+compiles require a valid zero child exit, cap captured output, and stage
+generated C++, exports, source maps, Wasm, and metadata. Publication removes
+the prior serialized module and diagnostics inside the same rollback-protected
+generation while repeatedly checking the live request deadline.
 
 `request_perf()` reports worker module-cache hits and misses and divides a miss
 into artifact lookup, wasm read, custom-section parse, serialized-module
@@ -556,6 +565,13 @@ header free-functions are `inline`. The wasm backend exposes only declarations
   function table, enabling `InstancePre`. A separately built legacy
   `--import-table` core must still pass the demo and 64-request pool-isolation
   groups before the compatibility fallback changes.
+  `scripts/test_wasm_compile_timeout.sh` runs an isolated one-worker runtime
+  with a two-second request budget. It covers cold entry JIT, guest
+  `unit_compile()`, dynamic component and transitive `#load` compilation,
+  held unit and registry locks, silent nonzero and missing-output compiler
+  results, compiler descendants, staged-output timeout, prior-generation
+  hashes, same-worker recovery, configured-error-page boundedness, residue,
+  and deadline-independent offline precompile.
   `scripts/test_cold_component_deadline.sh` separately compiles a deliberately
   cold component that exceeds the development epoch window and proves the
   parent request still renders it. The focused shell gates create temporary