Limits

The engine’s operational caps and defaults: what each protects, and where to tune the ones you can.

The engine ships with a small set of hard caps and a few defaults you can tune. The caps protect instances from runaway definitions. The defaults are createEngine options.

• Cascade cap: 100 hops per cascade. A hop runs the current stage’s triggers until nothing more fires, commits at most one transition, then repeats from the destination until nothing moves. Each trigger fires at most once per stage visit, so triggers are bounded, but the hops they unblock are not. An instance that never settles stops with an error instead of spinning. The cap is not configurable, and a workflow that hits it almost always has a transition loop that never settles.
• Subworkflow depth: 6. A spawn is rejected when the child would sit more than six ancestors deep. It is the backstop against recursion that only appears at run time, such as a spawn that fires depending on subject state, which no up-front cycle check can catch.
• Effect claim lease: 300,000 milliseconds (five minutes) by default. Set effects.leaseMs longer than your slowest handler. After expiry, another drainer can take over the effect, so delivery is at-least-once. Effects and runtimes covers the contract.
• Effect reports: at most 32 reports may wait in a dispatch queue, and at most 200 report entries may be accepted per dispatch. commitOps reports are never merged. Pending setProgress updates to the same field keep only the newest value. Await your reports, so the queue pushes back and failures surface quickly.
• Idempotency window: 24 hours (idempotencyTtlMs on createEngine). A commit verb retried with the same idempotencyKey replays instead of double-applying while the key is inside the window; ledger rows expire after it and later keyed commits prune them.
• Definitions are immutable. Deploy only ever creates, and the version comes from the content: any change creates the next version, an identical redeploy does nothing, and an instance pins and snapshots the version it started on.
• The data model is pre-1.0. Workflow documents carry a model-version stamp and reader floor. An engine older than a document’s floor refuses it. See Reader-model acknowledgement for the contract and How early access works for rollout policy.

These numbers can change before 1.0. A change ships in the package changelog like any other.

• How early access works: the versioning and breaking-change policy these limits live under.
• Effects and runtimes: the delivery contract behind the claim lease.
• Reference: every construct spelled out exactly, each field, type, default, and option.