[theduke]

Enabling V8 WebAssembly in a tenant would otherwise leave its memory reservations, committed pages, compiled code and compilation work outside the instance budget.

Add the metered policy with per-lane memory reservation/count limits, committed-memory and compiled-code accounting, process code budgets and bounded compilation admission. Carry accounting through VM contexts, Wasm compilation and teardown, and disable shared code caching where it would make attribution ambiguous. Install process-wide module/function/table limits before V8 starts. Include the regression distinguishing an unknown policy from the valid metered policy.

This depends on the earlier heap-exhaustion mitigation and page allocator accounting. V8 code commits cannot safely be refused like data-buffer growth: the guard may stop a tenant after a commit, and native metadata-allocation failures intentionally fail open. Concurrent compilation can overshoot a sampled/postcommit threshold. The controls reduce exposure and provide accounting; they are not a proven hard process-memory cap under host OOM or arbitrary concurrent compilation. Allocation conventions remain tied to the tested V8 archive.

Stack and provenance

#93 → #94 → #95 → #96 → #97 → #98 → #99 → #100 → #101

Part 8 of the audited split of #84, reconstructed on current main eac0a13fa65a4d6103864d875ed76ab7efb1816e. Review against split/napi-07-page-accounting; predecessor branches are required. Original PR #84 remains unchanged. The stack preserves newer main host-JS behavior and deliberately excludes the unused frozen 0.0.1 ABI adapter.

Validation

v8_wasm_guest, v8_wasm_metering, v8_wasm_process_budget, v8_wasm_tiering, and native invalid/metered-policy environment-creation regression.

The final Rust Wasm metering/process-budget/tiering suites were not reached before the user requested local tests stop. The new native Rust CI job explicitly selects these suites. The CLI guest suite additionally requires the intended wrapper-preserving SDK and guest C toolchain and is outside that standalone CI job; keep that coverage distinction visible. Final branch execution is pending.

Latest-main rebase

Rebased the dependency stack onto eac0a13fa65a4d6103864d875ed76ab7efb1816e after main merged PR #92. This preserves unsigned guest IDs, pointers and lengths, bounded result/argv writes, host-JS buffer failure cleanup and the high-pointer/high-ID regressions. Conflicts received independent native and host-JS source review. All historical local results above predate this rebase; no local tests or builds were run for it, as requested. Updated-head validation belongs to CI and may be pending. This PR keeps its prerequisite branch as its base to preserve the focused diff.