A module does not run alone. Something loads it, gives it memory, and decides what it may ask for, and that something is a component with its own limits.
About 1 min of reading
Write the permission list
Write the imports allowed
Before you run it, say out loud what it will print. Then open the answer.
Check the module asks for more
Before you run it, say out loud what it will print. Then open the answer.
Write the limit at load
Before you run it, say out loud what it will print. Then open the answer.
The host decides what the module may do. Writing the module first is writing a module for a host that does not exist.
The contract file. Both sides are written against it, and it is the file that drifts.
A module that imports a clock can ask for time. A module that imports nothing cannot, and the list is the whole permission.
A call that traps stops the module, not the host. The host must decide whether to reload or refuse.
Memory growth and fuel are set when the module is loaded. A limit set after is a limit that was already passed.
Each one is defined here on this site. Open the entry for the full definition and the other words it points at.