Found during automated review of PR #401 (confirmed pre-existing on main — unchanged by that PR).
The dispatcher's sync/3 (and the pre-#401 equivalent) stamps call_stack/call_depth back into %State{} before crossing a bridge into Executor, but not the in-flight instruction_count tally. Metamethod work performed behind a bridge is charged against a stale seed and then discarded when the dispatch loop stamps its own tally — so :max_instructions under-counts metamethod-heavy code.
Given the sandboxing focus of the instruction budget, a script that funnels its work through __index/__newindex/__add chains can exceed the intended budget.
Fix direction: thread the tick tally through bridge crossings (stamp it in sync/3 and re-seed from the returned state), or account bridge-side metamethod execution against the same counter.
🤖 Filed from an automated review pass.
Found during automated review of PR #401 (confirmed pre-existing on main — unchanged by that PR).
The dispatcher's
sync/3(and the pre-#401 equivalent) stampscall_stack/call_depthback into%State{}before crossing a bridge intoExecutor, but not the in-flightinstruction_counttally. Metamethod work performed behind a bridge is charged against a stale seed and then discarded when the dispatch loop stamps its own tally — so:max_instructionsunder-counts metamethod-heavy code.Given the sandboxing focus of the instruction budget, a script that funnels its work through
__index/__newindex/__addchains can exceed the intended budget.Fix direction: thread the tick tally through bridge crossings (stamp it in
sync/3and re-seed from the returned state), or account bridge-side metamethod execution against the same counter.🤖 Filed from an automated review pass.