Exclude cold module loads from guest deadlines

src/wasm/worker.cpp

@@ -1190,6 +1190,10 @@ private:
 		auto mod = worker.unit_module(source_path, error);
 		if(!mod)
 			return(error);
+		// Compiling/deserializing a cold module is host work. Refresh the guest
+		// watchdog before the first core call so that wall time cannot make the
+		// otherwise harmless malloc/reloc sequence trap immediately.
+		ctx().set_epoch_deadline(worker.cfg.epoch_deadline_ticks);
 		if(mod->abi.version != abi_version)
 			return(mod->wasm_path + ": uce.abi version " + std::to_string(mod->abi.version)
 				+ " does not match core ABI " + std::to_string(abi_version));
@@ -1347,12 +1351,8 @@ private:
 		if(worker.cfg.verbose)
 			fprintf(stderr, "[wasm] loaded %s (mem_base=%u table_base=%u)\n",
 				source_path.c_str(), memory_base, table_base);
-		// The epoch budget is a guest-CPU watchdog, but the ticker is wall-clock
-		// and host-side module compilation here (lazy, mid-render, possibly many
-		// units) burns it without the guest running. Reset the deadline after a
-		// load so the budget measures guest execution between membrane crossings,
-		// not our compile time. A genuine runaway loop makes no loads, so it
-		// still trips the deadline.
+		// Exclude the rest of host-side loading as well. A genuine runaway loop
+		// makes no loads, so it still trips the deadline.
 		ctx().set_epoch_deadline(worker.cfg.epoch_deadline_ticks);
 		return("");
 	}