Runs work in a monitored BEAM process with a deadline and bounded transfers.

:timeout is in milliseconds (default 5,000). :max_memory is the process heap allowance in bytes (default 134,217,728, or 128 MiB), including shared binaries at garbage collection. :max_input_bytes and :max_result_bytes bound conservative copy estimates and default to :max_memory. These are not a total VM memory limit.

The deadline includes input selection, transfer admission, result checking and sending. Caller-side admission checks it cooperatively. Caller death terminates the worker. Nested calls reuse the worker when its existing policy is at least as restrictive; tighter optional work gets an owned child with the earlier deadline. Host callbacks remain trusted capabilities; this cannot undo their side effects, contain arbitrary child processes they spawn, or interrupt non-yielding native code. Keep callback exit reasons bounded: the controller receives raw VM exit signals outside the worker heap policy, then bounds their details before forwarding them.