Summary

• add sandbox limits for result counts, builtin iterations, source size, tokens, AST nodes, and parser depth
• add stdlib checkpoints/allocation guards for long-running or large-output operations
• disable require/package and clear module state when setModuleLoader(null) is used
• sanitize generic host callback exceptions and document host-boundary trust guidance

Validation

• composer qa
  • PHP CS Fixer check passed
  • PHPStan passed
  • PHPUnit passed: 191 tests, 463 assertions