Should max_instance_memory limit each memory or the whole instance?

Question

Should max_instance_memory limit the total linear memory used by one instance, or should it apply separately to each linear memory?

I expected it to limit the total. The current behavior matches Wasmtime's normal per-memory limit, so this may be a difference in interpretation rather than a bug.

Spin's help describes the limit as being "for an instance." The original PR chose this name to distinguish it from a whole-server limit. SKIP 006 also calls it a per-invocation limit. Neither discusses instances that contain several memories.

Current behavior

I tested a real component with two 65,536-byte memories. With max_instance_memory set to 65,536 bytes, Spin accepts both memories and reports 131,072 bytes used by the instance.

That is surprising for users who treat this setting as a firm limit on one instance.

Compatibility

A total limit would be stricter for components with several memories. Components with one memory would behave the same.

The low-level StoreBuilder::max_memory_size method has historically applied its limit to each memory. It could keep that behavior while max_instance_memory uses a separate total limit.

Which behavior does the project want for max_instance_memory, and should StoreBuilder::max_memory_size keep its current behavior? I am happy to submit the implementation and the real two-memory regression test once that choice is clear.

Start by reading the original PR #3135 and SKIP 006, then inspect StoreBuilder::max_memory_size and reproduce the two-memory component behavior described here. The project must first decide whether max_instance_memory is a total or per-memory limit; done means the chosen semantics are implemented and covered by the proposed real two-memory regression test.