Limits
Values follow the accepted ADRs for the Developer Preview.
Client limits
| Fact | Value | Meaning | Source |
|---|---|---|---|
| Protocol Size Limit | 61,440 bytes (60 KiB) | The largest Sync body send() accepts. | trueseal-sync ADR-0025; code: trueseal-sync docs/shared-facts.json (generated), trueseal-sync src/relay.rs, trueseal-relay internal/config/config.go |
| Maximum Group Size | 32 members | The most devices one Sync Group holds. | trueseal-sync ADR-0027, trueseal-sync ADR-0028; code: trueseal-sync docs/shared-facts.json (generated) |
| Held-Blob cap | 100 Blobs per device | Newer-version Blobs a device leaves unacked; beyond it the oldest is dropped as unreadable(droppedWhileHeld). | trueseal-sync ADR-0022, trueseal-sync ADR-0034; code: trueseal-sync docs/shared-facts.json (generated) |
| Handler attempts | 5 attempts | Times the message handler runs for one message before handlerGaveUp. | trueseal-sync ADR-0026 |
| Push retry backoff | from 1 second to 5 minutes | Exponential backoff for a temporarily refused push while connected. | trueseal-sync ADR-0026 |
| Outbox expiry | 30 days | A Sync entry undelivered this long after send() is removed with sendFailed(messageId, expired). Control entries never expire. | trueseal-sync ADR-0026, trueseal-sync ADR-0034 |
| Replay Window | 60 days | A message whose Sender Timestamp is older than this is dropped as unreadable(expired). | trueseal-sync ADR-0031, trueseal-sync ADR-0034 |
send()refuses aSyncbody over the Protocol Size Limit withpayloadTooLarge{max}, and the body never enters the outbox.- A caller may pass a lower
maxPayloadBytestoTrueSeal.open; a higher value is clamped to the Protocol Size Limit. accept(request)fails withgroupFull{max}when admitting would exceed the Maximum Group Size.
Relay limits
| Fact | Value | Meaning | Source |
|---|---|---|---|
| Relay TTL default | 30 days | How long an undelivered Blob stays in an Inbox. | trueseal-relay ADR-0012; code: trueseal-relay internal/config/config.go |
| Relay TTL ceiling | 30 days | The longest TTL the relay starts with. | trueseal-sync ADR-0034, trueseal-relay ADR-0012 |
| Heartbeat interval | 25 seconds | The client sends a Heartbeat on its Receive Session this often. | trueseal-relay ADR-0012 |
| Receive idle timeout | 75 seconds | The relay closes a Receive Session with no frame for this long. | trueseal-relay ADR-0012 |
| Handshake deadline | 10 seconds | The Noise handshake limit on both listeners. | trueseal-relay ADR-0012 |
| Push Session deadline | 30 seconds | A Push Session's total life, from accept to close. | trueseal-relay ADR-0012 |
| Shutdown drain | 10 seconds | On SIGTERM, how long in-progress pushes get to commit and Ack. | trueseal-relay ADR-0012 |
| Blobs per Inbox | 10,000 Blobs | Over it, a push is refused inbox full (temporary). | trueseal-relay ADR-0012 |
| Bytes per Inbox | 268,435,456 bytes (256 MiB) | Over it, a push is refused inbox full (temporary). | trueseal-relay ADR-0012 |
| Push rate per recipient | 20 pushes per second sustained, bursts of 500 | A token bucket; over it, a push is refused rate limited (temporary). | trueseal-relay ADR-0012 |
| Connections per listener | 1,000 connections | Over it, new connections are closed. | trueseal-relay ADR-0012 |
| Receive Sessions per device | 4 Receive Sessions | Over it, a new session is refused. | trueseal-relay ADR-0012 |
- The Operator can change every relay value, but can only lower the Relay Size Limit and the TTL.
- The relay refuses to start with a Relay Size Limit above the Protocol Size Limit, or a TTL above 30 days.
- Every relay limit is keyed on the recipient Inbox, the device key or a global count, never on an IP address. Per-IP limits belong at the Operator’s firewall or reverse proxy.
- Anyone who knows a device’s public key can fill that device’s Inbox quota and delay its delivery.