diff --git a/Directory.Packages.props b/Directory.Packages.props
index 4d80612a67a..fd90caa42d3 100644
--- a/Directory.Packages.props
+++ b/Directory.Packages.props
@@ -6,7 +6,7 @@
   <ItemGroup>
     <PackageVersion Include="HtmlAgilityPack" Version="1.12.4" />
     <PackageVersion Include="ICSharpCode.Decompiler" Version="9.1.0.7988" />
-    <PackageVersion Include="Jint" Version="4.6.1" />
+    <PackageVersion Include="Jint" Version="4.15.3" />
     <PackageVersion Include="JsonSchema.Net" Version="7.4.0" />
     <PackageVersion Include="Markdig" Version="1.1.0" />
     <PackageVersion Include="Microsoft.Playwright" Version="1.58.0" />
diff --git a/src/Docfx.Build/Docfx.Build.csproj b/src/Docfx.Build/Docfx.Build.csproj
index c097f058543..7ea4fddf800 100644
--- a/src/Docfx.Build/Docfx.Build.csproj
+++ b/src/Docfx.Build/Docfx.Build.csproj
@@ -2,6 +2,7 @@
   <ItemGroup>
     <InternalsVisibleTo Include="Docfx.App" />
     <InternalsVisibleTo Include="Docfx.Build.Common.Tests" />
+    <InternalsVisibleTo Include="Docfx.Build.Tests" />
   </ItemGroup>
 
   <ItemGroup>
diff --git a/src/Docfx.Build/TemplateProcessors/Preprocessors/JintProcessorHelper.cs b/src/Docfx.Build/TemplateProcessors/Preprocessors/JintProcessorHelper.cs
index 5ff49f798cb..7a9fd707b4d 100644
--- a/src/Docfx.Build/TemplateProcessors/Preprocessors/JintProcessorHelper.cs
+++ b/src/Docfx.Build/TemplateProcessors/Preprocessors/JintProcessorHelper.cs
@@ -11,12 +11,14 @@ public static JsValue ConvertObjectToJsValue(Jint.Engine engine, object raw)
     {
         if (raw is IDictionary<string, object> dict)
         {
-            var jsObject = new JsObject(engine);
-            foreach (var pair in dict)
-            {
-                jsObject.FastSetDataProperty(pair.Key, ConvertObjectToJsValue(engine, pair.Value));
-            }
-            return jsObject;
+            // Build the object directly in the engine's hidden class ("shape") representation rather than
+            // storing a property descriptor per property. Every document of a given document type is handed
+            // to the template with the same property layout, so the objects built here end up sharing one
+            // interned shape and the property reads in the template script stay monomorphic across documents.
+            //
+            // Layouts the representation cannot express - integer-index-like keys, very wide objects - fall
+            // back to the ordinary property-dictionary representation silently and correctly.
+            return JsObject.CreateFromEntries(engine, ConvertEntries(engine, dict));
         }
 
         if (raw is IList<object> list)
@@ -33,4 +35,17 @@ public static JsValue ConvertObjectToJsValue(Jint.Engine engine, object raw)
 
         return JsValue.FromObject(engine, raw);
     }
+
+    /// <summary>
+    /// Streams the converted entries instead of materializing them into an array first: the entries are
+    /// enumerated exactly once while the object is being built, so a model with many properties does not
+    /// need a temporary buffer of its own size.
+    /// </summary>
+    private static IEnumerable<KeyValuePair<string, JsValue>> ConvertEntries(Jint.Engine engine, IDictionary<string, object> dict)
+    {
+        foreach (var pair in dict)
+        {
+            yield return new KeyValuePair<string, JsValue>(pair.Key, ConvertObjectToJsValue(engine, pair.Value));
+        }
+    }
 }
diff --git a/src/Docfx.Build/TemplateProcessors/Preprocessors/PreprocessorLoader.cs b/src/Docfx.Build/TemplateProcessors/Preprocessors/PreprocessorLoader.cs
index 9e57166cdfd..72dcc4dc980 100644
--- a/src/Docfx.Build/TemplateProcessors/Preprocessors/PreprocessorLoader.cs
+++ b/src/Docfx.Build/TemplateProcessors/Preprocessors/PreprocessorLoader.cs
@@ -1,9 +1,13 @@
 // Licensed to the .NET Foundation under one or more agreements.
 // The .NET Foundation licenses this file to you under the MIT license.
 
+using System.Collections.Concurrent;
 using System.Text.RegularExpressions;
 
+using Acornima.Ast;
+
 using Docfx.Common;
+using Jint;
 
 namespace Docfx.Build.Engine;
 
@@ -58,7 +62,10 @@ public ITemplatePreprocessor Load(ResourceInfo res, string name = null)
             var extension = Path.GetExtension(res.Path);
             if (extension.Equals(TemplateJintPreprocessor.Extension, System.StringComparison.OrdinalIgnoreCase))
             {
-                return new PreprocessorWithResourcePool(() => new TemplateJintPreprocessor(_reader, res, _context, name), _maxParallelism);
+                // Every preprocessor the pool creates for this template runs the same script sources,
+                // so let them share one parsed copy of each.
+                var preparedScripts = new ConcurrentDictionary<string, Prepared<Script>>();
+                return new PreprocessorWithResourcePool(() => new TemplateJintPreprocessor(_reader, res, _context, name, preparedScripts), _maxParallelism);
             }
             else
             {
diff --git a/src/Docfx.Build/TemplateProcessors/Preprocessors/TemplateJintPreprocessor.cs b/src/Docfx.Build/TemplateProcessors/Preprocessors/TemplateJintPreprocessor.cs
index dc69af76437..d66da9022b5 100644
--- a/src/Docfx.Build/TemplateProcessors/Preprocessors/TemplateJintPreprocessor.cs
+++ b/src/Docfx.Build/TemplateProcessors/Preprocessors/TemplateJintPreprocessor.cs
@@ -1,6 +1,10 @@
 // Licensed to the .NET Foundation under one or more agreements.
 // The .NET Foundation licenses this file to you under the MIT license.
 
+using System.Collections.Concurrent;
+
+using Acornima.Ast;
+
 using Docfx.Common;
 using Jint;
 using Jint.Native;
@@ -57,7 +61,42 @@ public class TemplateJintPreprocessor : ITemplatePreprocessor
 
     private const string NullString = "null";
 
+    /// <summary>
+    /// Wall clock budget for a single preprocessor call, that is one <c>getOptions</c> or
+    /// <c>transform</c> for one document. Without it an accidental infinite loop in a template script
+    /// hangs a build thread forever instead of failing the document.
+    /// </summary>
+    private static readonly TimeSpan DefaultExecutionTimeout = TimeSpan.FromSeconds(30);
+
+    /// <summary>
+    /// Statement budget for a single preprocessor call. Deliberately far above what transforming even a
+    /// very large model costs, so it only ever catches a runaway script. A saturated value such as
+    /// <see cref="int.MaxValue"/> would register no limit at all, so this has to be a real number.
+    /// </summary>
+    private const int MaxExecutionStatements = 50_000_000;
+
     private object _utilityObject;
+
+    private readonly CancellationToken _cancellationToken;
+
+    private readonly TimeSpan _executionTimeout;
+
+    /// <summary>
+    /// Every engine this preprocessor owns, keyed by resource path: the template's engine under the
+    /// template's own path, plus one per <c>require</c>d module. A preprocessor instance is rented from
+    /// <c>PreprocessorWithResourcePool</c> for the duration of one call, so this is only ever touched by
+    /// one thread at a time.
+    /// </summary>
+    private readonly Dictionary<string, Jint.Engine> _engineCache = [];
+
+    /// <summary>
+    /// Parsed sources, keyed by resource path, shared by every preprocessor instance created for the same
+    /// template. A <see cref="Prepared{TProgram}"/> is immutable and safe to execute from several engines
+    /// and threads, so the template and everything it <c>require</c>s is parsed once instead of once per
+    /// engine in the preprocessor pool.
+    /// </summary>
+    private readonly ConcurrentDictionary<string, Prepared<Script>> _preparedScripts;
+
     private static readonly object ConsoleObject = new
     {
         log = new Action<object>(s => Logger.Log(s ?? NullString)),
@@ -72,7 +111,22 @@ public class TemplateJintPreprocessor : ITemplatePreprocessor
     private Func<object, object> _getOptionsFunc;
 
     public TemplateJintPreprocessor(ResourceFileReader resourceCollection, ResourceInfo scriptResource, DocumentBuildContext context, string name = null)
+        : this(resourceCollection, scriptResource, context, name, new ConcurrentDictionary<string, Prepared<Script>>())
+    {
+    }
+
+    internal TemplateJintPreprocessor(
+        ResourceFileReader resourceCollection,
+        ResourceInfo scriptResource,
+        DocumentBuildContext context,
+        string name,
+        ConcurrentDictionary<string, Prepared<Script>> preparedScripts,
+        TimeSpan? executionTimeout = null)
     {
+        _preparedScripts = preparedScripts;
+        _cancellationToken = context?.CancellationToken ?? CancellationToken.None;
+        _executionTimeout = executionTimeout ?? DefaultExecutionTimeout;
+
         if (!string.IsNullOrWhiteSpace(scriptResource.Content))
         {
             SetupEngine(resourceCollection, scriptResource, context);
@@ -96,6 +150,7 @@ public object GetOptions(object model)
     {
         if (_getOptionsFunc != null)
         {
+            ResetConstraints();
             return _getOptionsFunc(model);
         }
 
@@ -106,16 +161,38 @@ public object TransformModel(object model)
     {
         if (_transformFunc != null)
         {
+            ResetConstraints();
             return _transformFunc(model);
         }
 
         return model;
     }
 
+    /// <summary>
+    /// Rearms the timeout and clears the statement counter on every engine this preprocessor owns, so all
+    /// three limits bound one document rather than the lifetime of a pooled preprocessor.
+    /// <para>
+    /// Only the template's own engine is entered through a public Jint API - <see cref="Jint.Engine.Invoke"/>,
+    /// which resets that engine's constraints itself. A <c>require</c>d module's exported function belongs to
+    /// the module's engine, so calling it is an ordinary function call that charges the <em>module</em>
+    /// engine's constraint instances without ever going through an entry point that resets them. Since a
+    /// timeout deadline is armed only on reset and a statement counter is only cleared on reset, leaving
+    /// them alone would give a module engine a deadline fixed at preprocessor construction and a statement
+    /// budget spanning the whole build.
+    /// </para>
+    /// </summary>
+    private void ResetConstraints()
+    {
+        foreach (var engine in _engineCache.Values)
+        {
+            engine.Constraints.Reset();
+        }
+    }
+
     private Jint.Engine SetupEngine(ResourceFileReader resourceCollection, ResourceInfo scriptResource, DocumentBuildContext context)
     {
         var rootPath = (RelativePath)scriptResource.Path;
-        var engineCache = new Dictionary<string, Jint.Engine>();
+        var engineCache = _engineCache;
 
         var utility = new TemplateUtility(context);
         _utilityObject = new
@@ -125,37 +202,40 @@ private Jint.Engine SetupEngine(ResourceFileReader resourceCollection, ResourceI
             markup = new Func<string, string, string>(utility.Markup),
         };
 
-        var engine = CreateDefaultEngine();
+        // Each engine registers `require` from this delegate itself. Copying the function object out of one
+        // engine and into another - which is what `CreateEngine(engine, RequireFuncVariableName)` used to do -
+        // hands a JsValue to an engine that did not create it; a JsValue holds a hard reference to the engine
+        // and realm that created it and passing one across is not a supported arrangement.
+        object Require(string s)
+        {
+            if (!s.StartsWith(RequireRelativePathPrefix, StringComparison.Ordinal))
+            {
+                throw new ArgumentException($"Only relative path starting with `{RequireRelativePathPrefix}` is supported in require");
+            }
+            var relativePath = (RelativePath)s.Substring(RequireRelativePathPrefix.Length);
+            s = relativePath.BasedOn(rootPath);
+
+            var script = resourceCollection?.GetResource(s);
+            if (string.IsNullOrWhiteSpace(script))
+            {
+                return null;
+            }
 
-        var requireAction = new Func<string, object>(
-            s =>
+            if (!engineCache.TryGetValue(s, out Jint.Engine cachedEngine))
             {
-                if (!s.StartsWith(RequireRelativePathPrefix, StringComparison.Ordinal))
-                {
-                    throw new ArgumentException($"Only relative path starting with `{RequireRelativePathPrefix}` is supported in require");
-                }
-                var relativePath = (RelativePath)s.Substring(RequireRelativePathPrefix.Length);
-                s = relativePath.BasedOn(rootPath);
-
-                var script = resourceCollection?.GetResource(s);
-                if (string.IsNullOrWhiteSpace(script))
-                {
-                    return null;
-                }
-
-                if (!engineCache.TryGetValue(s, out Jint.Engine cachedEngine))
-                {
-                    cachedEngine = CreateEngine(engine, RequireFuncVariableName);
-                    engineCache[s] = cachedEngine;
-                    cachedEngine.Execute(script, s);
-                }
-
-                return cachedEngine.GetValue(ExportsVariableName);
-            });
-
-        engine.SetValue(RequireFuncVariableName, requireAction);
+                cachedEngine = CreateDefaultEngine();
+                cachedEngine.SetValue(RequireFuncVariableName, (Func<string, object>)Require);
+                engineCache[s] = cachedEngine;
+                cachedEngine.Execute(Prepare(s, script));
+            }
+
+            return cachedEngine.GetValue(ExportsVariableName);
+        }
+
+        var engine = CreateDefaultEngine();
+        engine.SetValue(RequireFuncVariableName, (Func<string, object>)Require);
         engineCache[rootPath] = engine;
-        engine.Execute(scriptResource.Content, scriptResource.Path);
+        engine.Execute(Prepare(scriptResource.Path, scriptResource.Content));
 
         var value = engine.GetValue(ExportsVariableName);
         if (value.IsObject())
@@ -172,27 +252,39 @@ private Jint.Engine SetupEngine(ResourceFileReader resourceCollection, ResourceI
         return engine;
     }
 
-    private Jint.Engine CreateEngine(Jint.Engine engine, params string[] sharedVariables)
+    /// <summary>
+    /// Parses <paramref name="content"/> once per <paramref name="path"/> and reuses the result. The
+    /// preprocessor pool builds one instance - and therefore one engine - per parallelism slot, and they
+    /// all run the same sources, so without this the template and every module it requires would be
+    /// re-parsed for each slot.
+    /// </summary>
+    private Prepared<Script> Prepare(string path, string content)
     {
-        var newEngine = CreateDefaultEngine();
-        if (sharedVariables != null)
-        {
-            foreach (var sharedVariable in sharedVariables)
-            {
-                newEngine.SetValue(sharedVariable, engine.GetValue(sharedVariable));
-            }
-        }
-
-        return newEngine;
+        return _preparedScripts.GetOrAdd(path, static (source, code) => Jint.Engine.PrepareScript(code, source), content);
     }
 
     private Jint.Engine CreateDefaultEngine()
     {
-        var engine = new Jint.Engine();
-
+        var utilityObject = _utilityObject;
+
+        var engine = new Jint.Engine(options => options
+            // Template scripts come from the docset being built, so a faulty one must fail the document
+            // instead of pinning a render thread. Every engine gets its own limits, including the ones
+            // `require` builds, so a runaway loop inside a module function is bounded too; ResetConstraints
+            // is what makes them bound one document rather than the preprocessor's whole lifetime.
+            .TimeoutInterval(_executionTimeout)
+            .MaxStatements(MaxExecutionStatements)
+            .CancellationToken(_cancellationToken)
+            // `console` and `templateUtility` are ambient conveniences that most template scripts never
+            // mention, so build the wrapper only for the engines whose script actually reads the name. That
+            // is worth doing here because engines are not scarce: the preprocessor pool creates one per
+            // parallelism slot, and `require` creates one more per module.
+            .AddLazyGlobal(ConsoleVariableName, static e => JsValue.FromObject(e, ConsoleObject))
+            .AddLazyGlobal(UtilityVariableName, e => JsValue.FromObject(e, utilityObject)));
+
+        // `exports` stays eager: it is read back off the engine after the script has run, whether or not the
+        // script itself ever mentioned the name.
         engine.SetValue(ExportsVariableName, new JsObject(engine));
-        engine.SetValue(ConsoleVariableName, ConsoleObject);
-        engine.SetValue(UtilityVariableName, _utilityObject);
 
         return engine;
     }
diff --git a/src/Docfx.Build/TemplateProcessors/Template.cs b/src/Docfx.Build/TemplateProcessors/Template.cs
index 83315ee2338..028f7848194 100644
--- a/src/Docfx.Build/TemplateProcessors/Template.cs
+++ b/src/Docfx.Build/TemplateProcessors/Template.cs
@@ -1,6 +1,8 @@
 // Licensed to the .NET Foundation under one or more agreements.
 // The .NET Foundation licenses this file to you under the MIT license.
 
+using System.Globalization;
+
 using Docfx.Common;
 using Newtonsoft.Json.Linq;
 
@@ -73,7 +75,62 @@ public TransformModelOptions GetOptions(object model)
             return null;
         }
 
-        return JObject.FromObject(obj).ToObject<TransformModelOptions>();
+        return ReadOptions(obj);
+    }
+
+    /// <summary>
+    /// Reads the two fields <see cref="TransformModelOptions"/> declares straight off the value the
+    /// preprocessor returned. A script preprocessor hands back a property bag, so serializing it to JSON
+    /// and deserializing it into the options type - once per document, per template - is pure overhead.
+    /// </summary>
+    private static TransformModelOptions ReadOptions(object obj)
+    {
+        if (obj is not IDictionary<string, object> properties)
+        {
+            // A preprocessor that is not script based can return anything; keep converting those.
+            return JObject.FromObject(obj).ToObject<TransformModelOptions>();
+        }
+
+        var result = new TransformModelOptions();
+
+        if (TryGetValue(properties, "isShared", out var isShared) && isShared != null)
+        {
+            result.IsShared = isShared as bool? ?? Convert.ToBoolean(isShared, CultureInfo.InvariantCulture);
+        }
+
+        if (TryGetValue(properties, "bookmarks", out var bookmarks) && bookmarks is IDictionary<string, object> bookmarkProperties)
+        {
+            var map = new Dictionary<string, string>(bookmarkProperties.Count);
+            foreach (var pair in bookmarkProperties)
+            {
+                map[pair.Key] = Convert.ToString(pair.Value, CultureInfo.InvariantCulture);
+            }
+
+            result.Bookmarks = map;
+        }
+
+        return result;
+    }
+
+    private static bool TryGetValue(IDictionary<string, object> properties, string name, out object value)
+    {
+        if (properties.TryGetValue(name, out value))
+        {
+            return true;
+        }
+
+        // The JSON conversion this replaced matched property names case-insensitively.
+        foreach (var pair in properties)
+        {
+            if (string.Equals(pair.Key, name, StringComparison.OrdinalIgnoreCase))
+            {
+                value = pair.Value;
+                return true;
+            }
+        }
+
+        value = null;
+        return false;
     }
 
     /// <summary>
diff --git a/test/Docfx.Build.Tests/JintProcessorHelperTest.cs b/test/Docfx.Build.Tests/JintProcessorHelperTest.cs
index ff772e00a34..3e82f7b5014 100644
--- a/test/Docfx.Build.Tests/JintProcessorHelperTest.cs
+++ b/test/Docfx.Build.Tests/JintProcessorHelperTest.cs
@@ -31,6 +31,126 @@ public void TestJObjectConvertWithJToken()
         }
     }
 
+    /// <summary>
+    /// Jint's default for CLR arrays became a live view in 4.14: script writing to such an array writes
+    /// through to the CLR array itself. This bump crosses that change, and it is inert here only because
+    /// <see cref="JintProcessorHelper.ConvertObjectToJsValue"/> builds every array itself and never hands a
+    /// CLR array to Jint's converter. What keeps that true is that model arrays arrive as
+    /// <c>IList&lt;object&gt;</c> - <c>ConvertToObjectHelper</c> produces <c>object[]</c>, which qualifies -
+    /// so a model conversion that ever yielded a typed array such as <c>int[]</c> would silently start
+    /// handing script a live view onto docfx's own model. The counters make that observable.
+    /// </summary>
+    [Trait("Related", "JintProcessor")]
+    [Fact]
+    public void TestObjectConvertCrossesNoClrArrays()
+    {
+        var engine = new Jint.Engine();
+        var model = ConvertToObjectHelper.ConvertStrongTypeToObject(new TestData());
+
+        engine.SetValue("model", JintProcessorHelper.ConvertObjectToJsValue(engine, model));
+
+        // Read the arrays from script, so a conversion deferred to first access would still be counted.
+        Assert.Equal("ValueA,ValueB", engine.Evaluate("model.ValueList.join(',')").AsString());
+
+        var diagnostics = engine.Advanced.GetInteropConversionDiagnostics();
+        Assert.Equal(0, diagnostics.ArrayLiveViewConversions);
+        Assert.Equal(0, diagnostics.ArrayCopyConversions);
+
+        // Control, so the zeros above cannot pass vacuously: a CLR array that does reach Jint's converter is
+        // counted. Summing the two modes keeps this independent of which one is the current default.
+        engine.SetValue("clrArray", new[] { 1, 2, 3 });
+        var control = engine.Advanced.GetInteropConversionDiagnostics();
+        Assert.Equal(1, control.ArrayLiveViewConversions + control.ArrayCopyConversions);
+    }
+
+    [Trait("Related", "JintProcessor")]
+    [Fact]
+    public void TestObjectConvertKeepsDeclarationOrder()
+    {
+        var engine = new Jint.Engine();
+        var model = new Dictionary<string, object>
+        {
+            ["title"] = "Hello",
+            ["nested"] = new Dictionary<string, object> { ["a"] = 1, ["b"] = "two" },
+            ["items"] = new List<object> { "x", "y" },
+        };
+
+        engine.SetValue("model", JintProcessorHelper.ConvertObjectToJsValue(engine, model));
+
+        Assert.Equal("title,nested,items", engine.Evaluate("Object.keys(model).join(',')").AsString());
+        Assert.Equal("Hello", engine.Evaluate("model.title").AsString());
+        Assert.Equal("a,b", engine.Evaluate("Object.keys(model.nested).join(',')").AsString());
+        Assert.Equal("two", engine.Evaluate("model.nested.b").AsString());
+        Assert.Equal("x,y", engine.Evaluate("model.items.join(',')").AsString());
+    }
+
+    /// <summary>
+    /// Documents of one document type share a model layout, which is what the conversion is built around.
+    /// Objects sharing a layout must stay indistinguishable from separately built ones.
+    /// </summary>
+    [Trait("Related", "JintProcessor")]
+    [Fact]
+    public void TestObjectConvertIsStableAcrossModelsOfTheSameShape()
+    {
+        var engine = new Jint.Engine();
+
+        for (var i = 0; i < 3; i++)
+        {
+            var model = new Dictionary<string, object> { ["uid"] = $"uid{i}", ["type"] = "Class" };
+            engine.SetValue($"model{i}", JintProcessorHelper.ConvertObjectToJsValue(engine, model));
+        }
+
+        Assert.Equal("uid,type", engine.Evaluate("Object.keys(model0).join(',')").AsString());
+        Assert.Equal("uid0|uid1|uid2", engine.Evaluate("[model0, model1, model2].map(function (m) { return m.uid; }).join('|')").AsString());
+        Assert.True(engine.Evaluate("[model0, model1, model2].every(function (m) { return m.type === 'Class'; })").AsBoolean());
+
+        // The point of building models this way is that documents of one document type share a hidden class,
+        // and the conversion falls back to a per-object property dictionary silently when it cannot reach one.
+        // HasSharedShape is the predicate Jint documents as stable for exactly this question - "is this
+        // object's own storage a layout shared with its siblings" - and which a host may therefore pin for the
+        // documented success case of the factory it called. If a future change stops these models being
+        // shaped, this is how docfx finds out.
+        for (var i = 0; i < 3; i++)
+        {
+            Assert.True(engine.Advanced.HasSharedShape(engine.Evaluate($"model{i}").AsObject()));
+        }
+    }
+
+    /// <summary>
+    /// Integer-index-like keys cannot be expressed in the layout the conversion targets, so they take a
+    /// fallback path. It has to stay silent and correct.
+    /// </summary>
+    [Trait("Related", "JintProcessor")]
+    [Fact]
+    public void TestObjectConvertWithIntegerLikeKeys()
+    {
+        var engine = new Jint.Engine();
+        var model = new Dictionary<string, object>
+        {
+            ["name"] = "n",
+            ["1"] = "one",
+            ["2"] = "two",
+        };
+
+        engine.SetValue("model", JintProcessorHelper.ConvertObjectToJsValue(engine, model));
+
+        // Integer-like own keys are enumerated first in ascending order, exactly as for an object literal.
+        Assert.Equal("1,2,name", engine.Evaluate("Object.keys(model).join(',')").AsString());
+        Assert.Equal("one", engine.Evaluate("model['1']").AsString());
+        Assert.Equal("n", engine.Evaluate("model.name").AsString());
+
+        // Unlike the HasSharedShape assertion above, this one pins a *limitation* rather than a property, and
+        // deliberately keeps using the finer-grained non-contract diagnostic, because naming the exact
+        // fallback representation is the whole point of the assertion:
+        // integer-index-like keys are something today's Jint cannot express in a hidden class, so the
+        // conversion falls back. If a future Jint learns to shape them - a pure improvement for docfx - this
+        // line will go red on good news, not on a docfx defect. The assertions above it already cover
+        // correctness; delete this one at that point rather than working around it.
+        Assert.Equal(
+            ObjectRepresentation.Dictionary,
+            engine.Advanced.GetObjectRepresentation(engine.Evaluate("model").AsObject()));
+    }
+
     [Trait("Related", "JintProcessor")]
     [Theory]
     [InlineData("string", "string")]
diff --git a/test/Docfx.Build.Tests/TemplatePreprocessorLoaderUnitTest.cs b/test/Docfx.Build.Tests/TemplatePreprocessorLoaderUnitTest.cs
index 85b8c806178..684ce09497d 100644
--- a/test/Docfx.Build.Tests/TemplatePreprocessorLoaderUnitTest.cs
+++ b/test/Docfx.Build.Tests/TemplatePreprocessorLoaderUnitTest.cs
@@ -1,8 +1,15 @@
 // Licensed to the .NET Foundation under one or more agreements.
 // The .NET Foundation licenses this file to you under the MIT license.
 
+using System.Collections.Concurrent;
+
+using Acornima.Ast;
+
 using Docfx.Tests.Common;
 
+using Jint;
+using Jint.Runtime;
+
 using Xunit;
 
 namespace Docfx.Build.Engine.Tests;
@@ -34,9 +41,149 @@ public void TestLoaderWithValidInput()
         Assert.Equal(input.a, ((dynamic)output).a);
     }
 
+    [Fact]
+    public void TestGetOptionsIsReadFromScriptResult()
+    {
+        using var listener = new TestListenerScope();
+        var preprocessor = Load(
+            "a.ext.TMPL.js",
+            "exports.getOptions = function(model) { return { isShared: true, bookmarks: { uid1: 'bookmark1' } }; }");
+
+        Assert.NotNull(preprocessor);
+        Assert.True(preprocessor.ContainsGetOptions);
+
+        var options = new Template(null, preprocessor).GetOptions(new { a = 1 });
+
+        Assert.NotNull(options);
+        Assert.True(options.IsShared);
+        Assert.Equal("bookmark1", options.Bookmarks["uid1"]);
+    }
+
+    /// <summary>
+    /// The shipped templates chain <c>require</c> - a primary script requires a common script which requires
+    /// another - and every module gets its own engine, so this covers the whole chain resolving and the
+    /// exported functions still being callable.
+    /// </summary>
+    [Fact]
+    public void TestRequireResolvesChainedModules()
+    {
+        using var listener = new TestListenerScope();
+        CreateFile("inner.js", "exports.value = function() { return 'inner'; };", _inputFolder);
+        CreateFile("outer.js", "var inner = require('./inner.js'); exports.value = function() { return inner.value() + '+outer'; };", _inputFolder);
+
+        var preprocessor = Load(
+            "a.ext.TMPL.js",
+            "var outer = require('./outer.js'); exports.transform = function(model) { return { value: outer.value() }; }");
+
+        Assert.NotNull(preprocessor);
+        Assert.True(preprocessor.ContainsModelTransformation);
+
+        var output = preprocessor.TransformModel(new { a = 1 });
+        Assert.Equal("inner+outer", ((dynamic)output).value);
+    }
+
+    /// <summary>
+    /// <c>console</c> is registered lazily, so it is only built for engines whose script mentions it. Reading
+    /// the name has to be indistinguishable from an eagerly registered global.
+    /// </summary>
+    [Fact]
+    public void TestConsoleIsAvailableToScripts()
+    {
+        using var listener = new TestListenerScope();
+        var preprocessor = Load("a.ext.TMPL.js", "exports.transform = function(model) { console.warn('from template'); return model; }");
+
+        preprocessor.TransformModel(new { a = 1 });
+
+        Assert.Contains(listener.Items, i => i.Message == "from template");
+    }
+
+    [Fact]
+    public void TestRunawayScriptIsStopped()
+    {
+        using var listener = new TestListenerScope();
+        var preprocessor = Load("a.ext.TMPL.js", "exports.transform = function(model) { var i = 0; while (true) { i = i + 1; } }");
+
+        Assert.NotNull(preprocessor);
+        Assert.Throws<InvalidPreprocessorException>(() => preprocessor.TransformModel(new { a = 1 }));
+    }
+
+    /// <summary>
+    /// A function exported by a <c>require</c>d module belongs to that module's engine, so calling it from
+    /// the template's engine is not a public entry into the module's engine and does not reset the module
+    /// engine's execution constraints. The timeout deadline is armed only on reset, so unless the
+    /// preprocessor resets every engine it owns per call, a pooled preprocessor that has been alive longer
+    /// than the timeout starts every module call against a deadline that has already passed - and fails
+    /// every remaining document of the build.
+    /// </summary>
+    [Fact]
+    public void TestModuleCallIsNotBoundedByAStaleDeadline()
+    {
+        using var listener = new TestListenerScope();
+
+        // Generous enough that a cold CI runner cannot make a single call exceed it - the point of the test
+        // is the deadline going stale between calls, not how long one call takes - while still keeping the
+        // aging sleep below short.
+        var timeout = TimeSpan.FromSeconds(1);
+
+        CreateFile(
+            "mod.js",
+            "exports.value = function() { var s = 0; for (var i = 0; i < 2000; i++) { s = s + i; } return 'module:' + s; };",
+            _inputFolder);
+
+        var preprocessor = LoadWithTimeout(
+            "a.ext.TMPL.js",
+            "var mod = require('./mod.js'); exports.transform = function(model) { return { value: mod.value() }; }",
+            timeout);
+
+        // The first document is inside the window whether or not constraints are reset per call.
+        Assert.Equal("module:1999000", ((dynamic)preprocessor.TransformModel(new { a = 1 })).value);
+
+        // Age the preprocessor past its own timeout, which is what a pooled slot does during a real build.
+        Thread.Sleep(timeout + TimeSpan.FromMilliseconds(500));
+
+        Assert.Equal("module:1999000", ((dynamic)preprocessor.TransformModel(new { a = 1 })).value);
+    }
+
+    /// <summary>
+    /// The other half of the same contract: rearming a module engine's constraints per call must not turn
+    /// into removing them. A runaway loop inside a <c>require</c>d module has to be bounded too, and only
+    /// the module engine's own constraints can bound it - the template engine's are checked only while
+    /// template-engine statements are executing.
+    /// </summary>
+    [Fact]
+    public void TestRunawayScriptInsideModuleIsStopped()
+    {
+        using var listener = new TestListenerScope();
+        CreateFile("mod.js", "exports.value = function() { var i = 0; while (true) { i = i + 1; } };", _inputFolder);
+
+        var preprocessor = LoadWithTimeout(
+            "a.ext.TMPL.js",
+            "var mod = require('./mod.js'); exports.transform = function(model) { return { value: mod.value() }; }",
+            TimeSpan.FromSeconds(1));
+
+        // Which limit fires first is a race decided by machine speed - a fast machine burns the statement
+        // budget inside the timeout window, a slow one runs out of time first - so assert that the runaway
+        // was stopped, not which of the two limits stopped it.
+        var exception = Assert.ThrowsAny<Exception>(() => preprocessor.TransformModel(new { a = 1 }));
+        Assert.True(
+            exception is TimeoutException or StatementsCountOverflowException,
+            $"Expected an execution constraint to stop the module's runaway loop, but got: {exception}");
+    }
+
     private ITemplatePreprocessor Load(string path, string content)
     {
         var loader = new PreprocessorLoader(new LocalFileResourceReader(_inputFolder), null, 64);
         return loader.Load(new ResourceInfo(path, content));
     }
+
+    private ITemplatePreprocessor LoadWithTimeout(string path, string content, TimeSpan executionTimeout)
+    {
+        return new TemplateJintPreprocessor(
+            new LocalFileResourceReader(_inputFolder),
+            new ResourceInfo(path, content),
+            context: null,
+            name: null,
+            preparedScripts: new ConcurrentDictionary<string, Prepared<Script>>(),
+            executionTimeout: executionTimeout);
+    }
 }