Scripting limits - Revision history

QCherry: Document upcoming 0.1.7 game audio: 11 client APIs, result event, limits and complete dialogue catalog; not a release

2026-10-01T10:21:19Z

Document upcoming 0.1.7 game audio: 11 client APIs, result event, limits and complete dialogue catalog; not a release

← Older revision		Revision as of 10:21, 1 October 2026
Line 323:		Line 323:
	The server/client safety bounds above are separate from the existing nameplate range and do not increase it.		The server/client safety bounds above are separate from the existing nameplate range and do not increase it.
	<!-- mount016:end -->		<!-- mount016:end -->

			<!-- game-audio017:start -->
			== Game audio (upcoming 0.1.7) ==
			'''Planned for update 0.1.7; not included in public 0.1.6.''' These limits apply to [[Game audio]], not existing resource-file audio or voice chat.

			{\| class="wikitable"
			! Item !! Limit / behavior
			\|-
			\| Sound key \|\| Exact entry in the built-in catalog. No arbitrary files, URLs or native audio paths.
			\|-
			\| Volume \|\| Finite number 0..1; default 1.
			\|-
			\| Coordinates \|\| Each axis -200000..200000 metres; finite numbers only.
			\|-
			\| Attenuation \|\| minDistance >= 0; maxDistance >= 0.01; minDistance < maxDistance <= 200000 metres. Defaults 1 and 30.
			\|-
			\| Options \|\| Only volume, minDistance and maxDistance. Unknown keys are rejected.
			\|-
			\| Catalog search \|\| Query at most 160 bytes; categories empty, sfx, music or dialogue.
			\|-
			\| Catalog pagination \|\| Zero-based nonnegative integer offset; integer limit 1..200, default 50.
			\|-
			\| Active sounds \|\| 128 per client, shared across resources, including pending/starting playbacks.
			\|-
			\| Audio resource owners \|\| 16 per client. Resource/lifecycle cleanup releases ownership; stopping the last sound alone does not release the owner or its cache.
			\|-
			\| Prepared native cache \|\| 64 entries per owner. Dialogue 2D and 3D variants use separate entries. Cache is released by resource/lifecycle cleanup, not by stopping one sound.
			\|-
			\| Pending requests / native work queue \|\| 256 each per client. Rejected work must not be retried in a tight loop.
			\|-
			\| Retained sound records \|\| Up to 512 across resources; older terminal records are evicted as new handles are created.
			\|-
			\| Loading timeout \|\| 12 seconds for queued native preparation; 15 seconds for runtime request completion. A timed-out play request is cancelled.
			\|-
			\| Owner heartbeat \|\| Once per second, with a 5-second native lease. Expiry cleans up owned audio.
			\|-
			\| Playback-state observation \|\| Approximately every 50 ms while the game is ticking; not a real-time timing guarantee.
			\|}

			Handles/request IDs are positive runtime-assigned numbers, not engine pointers or persistent IDs. Playback and controls are asynchronous. [[onClientGameSoundResult]] supplies results; [[getGameSoundState]] supplies the latest accumulated state, not a guaranteed full property snapshot.

			Voice preload is reported as requested, with <code>voicePreloadConfirmed=false</code>; loaded event samples and a resolved recording do not independently confirm voice PCM loading. There is no automatic broadcast, late-join replay or precise cross-client audio clock. Cold loading is paced but is not guaranteed hitch-free.
			<!-- game-audio017:end -->

QCherry: Release G1R:MP 0.1.6 BUILD174 / Protocol 38; availability and upgrade guidance

2026-09-30T21:56:06Z

Release G1R:MP 0.1.6 BUILD174 / Protocol 38; availability and upgrade guidance

← Older revision		Revision as of 21:56, 30 September 2026
Line 2:		Line 2:
	<div style="border-left:4px solid #c33;padding:0.7em 1em;background:#fff5f5">'''BASELINE: UPDATE 0.1.3 — expanded-budget BUILD81 (2026-09-12).''' Earlier 0.1.3 binaries have smaller capacities. Update the server and the complete client/launcher package before relying on the expanded limits.</div>		<div style="border-left:4px solid #c33;padding:0.7em 1em;background:#fff5f5">'''BASELINE: UPDATE 0.1.3 — expanded-budget BUILD81 (2026-09-12).''' Earlier 0.1.3 binaries have smaller capacities. Update the server and the complete client/launcher package before relying on the expanded limits.</div>

	'''0.1.4 additions are explicitly marked below:''' [[os.time]] and resource-file/GUI security in BUILD126; static [[RmlUi images\|WebP images]] in BUILD125; map-editor capacities in BUILD124. The current public release is 0.1.4 / Protocol 36.		'''0.1.4 additions are explicitly marked below:''' [[os.time]] and resource-file/GUI security in BUILD126; static [[RmlUi images\|WebP images]] in BUILD125; map-editor capacities in BUILD124. The current public release is 0.1.6 / Protocol 38. Historical baseline values and version-specific additions are distinguished below.

	This reference lists the current developer-facing Lua, resource, API, queue and configuration limits audited in source. It distinguishes '''fixed capacities''', '''compiled defaults''' and '''operator-configurable bounds'''. It does not treat every internal rendering/physics constant as a scripting limit or guarantee that the maximum workload will run smoothly on every machine.		This reference lists the current developer-facing Lua, resource, API, queue and configuration limits audited in source. It distinguishes '''fixed capacities''', '''compiled defaults''' and '''operator-configurable bounds'''. It does not treat every internal rendering/physics constant as a scripting limit or guarantee that the maximum workload will run smoothly on every machine.
Line 300:		Line 300:

	<!-- area016:start -->		<!-- area016:start -->
	== Area notifications (~~upcoming~~ 0.1.6) ==		== Area notifications (since 0.1.6) ==
	Server-side [[ShowAreaNotification]] / [[HideAreaNotification]] and lower-camel aliases. ~~Not included in public~~ 0.1.5.		Server-side [[ShowAreaNotification]] / [[HideAreaNotification]] and lower-camel aliases. Available since 0.1.6.
	* Connected numeric player ID: finite integer 1..4294967295.		* Connected numeric player ID: finite integer 1..4294967295.
	* Heading: 0..256 UTF-8 bytes; title: 1..512 UTF-8 bytes. Literal text only; malformed UTF-8, NUL, controls and line breaks are rejected.		* Heading: 0..256 UTF-8 bytes; title: 1..512 UTF-8 bytes. Literal text only; malformed UTF-8, NUL, controls and line breaks are rejected.
Line 311:		Line 311:

	<!-- mount016:start -->		<!-- mount016:start -->
	== Mounts (~~upcoming~~ 0.1.6) ==		== Mounts (since 0.1.6) ==
	Server-side [[createPlayerMount]] and [[destroyPlayerMount]]; ~~not included in public~~ 0.1.5. See [[Mounts]] for ownership, native eligibility and verification status.		Server-side [[createPlayerMount]] and [[destroyPlayerMount]]; available since 0.1.6. See [[Mounts]] for ownership, native eligibility and verification status.
	* One active mount per player. No separate global mount-count cap in this subsystem; ordinary player/resource limits still apply.		* One active mount per player. No separate global mount-count cap in this subsystem; ordinary player/resource limits still apply.
	* No fixed ride lifetime or two-minute age-based despawn. Disconnect, resource stop, ineligibility and explicit removal still clean up the session.		* No fixed ride lifetime or two-minute age-based despawn. Disconnect, resource stop, ineligibility and explicit removal still clean up the session.

QCherry: Remove internal source file references from public documentation; retain API limits

2026-09-30T21:40:29Z

Remove internal source file references from public documentation; retain API limits

← Older revision		Revision as of 21:40, 30 September 2026
Line 271:		Line 271:
	'''Voice range values use centimetres''', including <code>setPlayerVoiceRange</code>/<code>getPlayerVoiceRange</code>. A positive finite custom range is normalized to 50 cm..configured <code>voice.maxRange</code>; defaults are whisper 500 cm (5 m), normal 1800 cm (18 m), shout 3500 cm (35 m), maximum 10000 cm (100 m). Voice volume is 0..2; channel ID 0..4294967295. Increasing Lua capacity does not alter voice gain, codec timing or anti-abuse limits.		'''Voice range values use centimetres''', including <code>setPlayerVoiceRange</code>/<code>getPlayerVoiceRange</code>. A positive finite custom range is normalized to 50 cm..configured <code>voice.maxRange</code>; defaults are whisper 500 cm (5 m), normal 1800 cm (18 m), shout 3500 cm (35 m), maximum 10000 cm (100 m). Voice volume is 0..2; channel ID 0..4294967295. Increasing Lua capacity does not alter voice gain, codec timing or anti-abuse limits.

	== ~~Source audit~~ and practical use ==		== Validation and practical use ==
	Focused follow-up: '''2026-09-20''', development '''0.1.4 BUILD125/126''', protocol '''35''': WebP, restricted [[os.time]], resource file policy and GUI loading. This is not a new audit of every historical numeric limit below. Earlier audit baseline follows.		Focused follow-up: '''2026-09-20''', development '''0.1.4 BUILD125/126''', protocol '''35''': WebP, restricted [[os.time]], resource file policy and GUI loading. This is not a new audit of every historical numeric limit below. Earlier audit baseline follows.

	Audit date: '''2026-09-12'''; expanded-budget '''0.1.3 BUILD81''', protocol '''34'''. Changes increase capacities, not packet layouts~~. Main sources:~~		Audit date: '''2026-09-12'''; expanded-budget '''0.1.3 BUILD81''', protocol '''34'''. Changes increase capacities, not packet layouts.

	* <code>shared/resource_limits.hpp</code>, <code>resource_event_protocol.hpp</code>, <code>client_ipc_protocol.hpp</code>, <code>scripting/LuaJson.hpp</code>/<code>.cpp</code>, <code>CameraProtocol.hpp</code>, <code>PlayerProgressionCatalog.hpp</code>, <code>PlayerAnimationCatalog.hpp</code>, <code>NameplateValidation.hpp</code>.
	* <code>server/src/config/ServerConfig.cpp</code>/<code>.hpp</code>, <code>server/src/scripting/ScriptRuntime.cpp</code>, <code>server/src/resources/ResourceManager.cpp</code>, resource catalog/manifest, database, HTTP, voice and world implementations, <code>server/enet_server.cpp</code>.
	* <code>client-runtime/src/scripting/ClientScriptRuntime.cpp</code>/<code>.hpp</code>, <code>app/ClientRuntimeMain.cpp</code>, catalog, audio and UI implementations.

	The test suite executes the real Lua runtimes with 8192 client timers / 8193 server timers, expanded handler/remote-event/key-binding capacities, JSON boundary and overflow cases, client timer fairness and restart/cleanup. Capacity boundaries are not a full in-game performance benchmark. Use staged loading, staggered timers, asynchronous DB/HTTP, pagination and explicit cleanup even on fast computers. Always check API results and the runtime logs.		The test suite executes the real Lua runtimes with 8192 client timers / 8193 server timers, expanded handler/remote-event/key-binding capacities, JSON boundary and overflow cases, client timer fairness and restart/cleanup. Capacity boundaries are not a full in-game performance benchmark. Use staged loading, staggered timers, asynchronous DB/HTTP, pagination and explicit cleanup even on fast computers. Always check API results and the runtime logs.

QCherry: Expand upcoming 0.1.6: mount Lua API, ownership, synchronization, limits and verification status; not a release

2026-09-30T21:33:51Z

Expand upcoming 0.1.6: mount Lua API, ownership, synchronization, limits and verification status; not a release

← Older revision		Revision as of 21:33, 30 September 2026
Line 313:		Line 313:
	See [[Area notifications]] for cleanup, per-resource ownership, Unicode and the separate automatic discovery-banner suppression. Other limits are unchanged by this addition.		See [[Area notifications]] for cleanup, per-resource ownership, Unicode and the separate automatic discovery-banner suppression. Other limits are unchanged by this addition.
	<!-- area016:end -->		<!-- area016:end -->

			<!-- mount016:start -->
			== Mounts (upcoming 0.1.6) ==
			Server-side [[createPlayerMount]] and [[destroyPlayerMount]]; not included in public 0.1.5. See [[Mounts]] for ownership, native eligibility and verification status.
			* One active mount per player. No separate global mount-count cap in this subsystem; ordinary player/resource limits still apply.
			* No fixed ride lifetime or two-minute age-based despawn. Disconnect, resource stop, ineligibility and explicit removal still clean up the session.
			* Initial server observation readiness: 15 seconds; an established session is revoked after more than 20 seconds without accepted observations. These are health timeouts, not maximum riding duration.
			* Native spawn requests have a 10-second cooldown and bounded readiness checks. Avoid repeated creation/removal loops; return values acknowledge requests, not native completion.
			* Initial boarding/incomplete native transitions use a 6000 ms recovery grace. A lost previously confirmed seat outside a native transition uses a 500 ms debounce. A transition grace is latched for its continuous unhealthy episode; repeated phase reports do not renew it. Healthy riding has no recovery timer running.
			* Snapshot observation is approximately 10 Hz. Server ownership/sequence/finite-value, movement and collision-registry validation remain enforced. This is not full native-world collision replication.
			* Petting observations are bounded to 4 metres, idle gait and at most 8 seconds of montage position; native eligibility still applies. Petting availability needs final in-game confirmation.
			* Ownership is tied to the creating resource and current connection player ID; no database persistence or ownership-transfer API.
			The server/client safety bounds above are separate from the existing nameplate range and do not increase it.
			<!-- mount016:end -->

QCherry: Document upcoming 0.1.6: area notification Lua API, door and pickup improvements; not a release

2026-09-26T22:22:27Z

Document upcoming 0.1.6: area notification Lua API, door and pickup improvements; not a release

← Older revision		Revision as of 22:22, 26 September 2026
Line 302:		Line 302:
	RGB: integer sRGB channels 0..255. Identity/tattoo keys: at most 48 bytes, ASCII case-insensitive closed catalogs; no arbitrary asset paths. IDs must identify a live server NPC record and mutation requires its owning resource. See [[NPC scripting#NPC appearance since 0.1.5]].		RGB: integer sRGB channels 0..255. Identity/tattoo keys: at most 48 bytes, ASCII case-insensitive closed catalogs; no arbitrary asset paths. IDs must identify a live server NPC record and mutation requires its owning resource. See [[NPC scripting#NPC appearance since 0.1.5]].
	<!-- npc-appearance015:end -->		<!-- npc-appearance015:end -->

			<!-- area016:start -->
			== Area notifications (upcoming 0.1.6) ==
			Server-side [[ShowAreaNotification]] / [[HideAreaNotification]] and lower-camel aliases. Not included in public 0.1.5.
			* Connected numeric player ID: finite integer 1..4294967295.
			* Heading: 0..256 UTF-8 bytes; title: 1..512 UTF-8 bytes. Literal text only; malformed UTF-8, NUL, controls and line breaks are rejected.
			* Duration: finite integer 1000..30000 ms, default 5000 ms; includes fades. Omit the optional argument rather than passing nil.
			* One custom banner per player; latest show replaces the previous owner/timer. At most 8192 distinct tracked player IDs per resource; explicit hide/resource cleanup releases tracking.
			* Native pending queue: 32 commands; excess commands may be discarded. Three bounded creation attempts, 500 ms apart. Server acceptance is not a visual acknowledgement.
			See [[Area notifications]] for cleanup, per-resource ownership, Unicode and the separate automatic discovery-banner suppression. Other limits are unchanged by this addition.
			<!-- area016:end -->

QCherry: Document new NPC/player-mode API and events available from 0.1.5

2026-09-25T17:37:28Z

Document new NPC/player-mode API and events available from 0.1.5

← Older revision		Revision as of 17:37, 25 September 2026
Line 297:		Line 297:
	See [[NPC scripting]] for the new functions. Health/damage/mana: 0..100000 (maxHP at least 1); ammo: integer 0..65535; perception: distance >0..1000 metres, FOV >0..360 degrees; projectile range 1..40 m; aim 150..30000 ms; cooldown 360..60000 ms; skillTier 0..2; animation blend-out 0..2 s. Combat walk 0.1..2.5 m/s, run 2.6..8 m/s; chase is independently configurable. These validations do not replace earlier server resource/capacity limits. Defaults and lifecycle caveats are documented on the linked function pages.		See [[NPC scripting]] for the new functions. Health/damage/mana: 0..100000 (maxHP at least 1); ammo: integer 0..65535; perception: distance >0..1000 metres, FOV >0..360 degrees; projectile range 1..40 m; aim 150..30000 ms; cooldown 360..60000 ms; skillTier 0..2; animation blend-out 0..2 s. Combat walk 0.1..2.5 m/s, run 2.6..8 m/s; chase is independently configurable. These validations do not replace earlier server resource/capacity limits. Defaults and lifecycle caveats are documented on the linked function pages.
	<!-- npc015:end -->		<!-- npc015:end -->

			<!-- npc-appearance015:start -->
			== NPC appearance validation since 0.1.5 ==
			RGB: integer sRGB channels 0..255. Identity/tattoo keys: at most 48 bytes, ASCII case-insensitive closed catalogs; no arbitrary asset paths. IDs must identify a live server NPC record and mutation requires its owning resource. See [[NPC scripting#NPC appearance since 0.1.5]].
			<!-- npc-appearance015:end -->

QCherry: Document new NPC/player-mode API and events available from 0.1.5

2026-09-25T17:14:31Z

Document new NPC/player-mode API and events available from 0.1.5

← Older revision		Revision as of 17:14, 25 September 2026
Line 292:		Line 292:
	See [[Map editor]], [[World objects]], [[Resource data storage]]. Other limits documented on this page remain unchanged unless explicitly marked otherwise.		See [[Map editor]], [[World objects]], [[Resource data storage]]. Other limits documented on this page remain unchanged unless explicitly marked otherwise.
	<!-- map-editor014:end -->		<!-- map-editor014:end -->

			<!-- npc015:start -->
			== NPC control API since 0.1.5 ==
			See [[NPC scripting]] for the new functions. Health/damage/mana: 0..100000 (maxHP at least 1); ammo: integer 0..65535; perception: distance >0..1000 metres, FOV >0..360 degrees; projectile range 1..40 m; aim 150..30000 ms; cooldown 360..60000 ms; skillTier 0..2; animation blend-out 0..2 s. Combat walk 0.1..2.5 m/s, run 2.6..8 m/s; chase is independently configurable. These validations do not replace earlier server resource/capacity limits. Defaults and lifecycle caveats are documented on the linked function pages.
			<!-- npc015:end -->

QCherry: Release 0.1.4 BUILD133 / Protocol 36 and document authenticated event origin

2026-09-21T20:41:03Z

Release 0.1.4 BUILD133 / Protocol 36 and document authenticated event origin

QCherry: Document 0.1.4 safe os.time, resource security and PNG/WebP support

2026-09-20T20:01:08Z

Document 0.1.4 safe os.time, resource security and PNG/WebP support

← Older revision		Revision as of 20:01, 20 September 2026
Line 1:		Line 1:
	{{DISPLAYTITLE:Scripting limits}}		{{DISPLAYTITLE:Scripting limits}}
	<div style="border-left:4px solid #c33;padding:0.7em 1em;background:#fff5f5">'''~~CURRENT IN~~ UPDATE 0.1.3 — expanded-budget BUILD81 (2026-09-12).''' Earlier 0.1.3 binaries have smaller capacities. Update the server and the complete client/launcher package before relying on the expanded limits.</div>		<div style="border-left:4px solid #c33;padding:0.7em 1em;background:#fff5f5">'''BASELINE: UPDATE 0.1.3 — expanded-budget BUILD81 (2026-09-12).''' Earlier 0.1.3 binaries have smaller capacities. Update the server and the complete client/launcher package before relying on the expanded limits.</div>

			'''0.1.4 development additions are explicitly marked below:''' [[os.time]] and resource-file/GUI security in BUILD126; static [[RmlUi images\|WebP images]] in BUILD125; map-editor capacities in BUILD124. The public release remains 0.1.3.

	This reference lists the current developer-facing Lua, resource, API, queue and configuration limits audited in source. It distinguishes '''fixed capacities''', '''compiled defaults''' and '''operator-configurable bounds'''. It does not treat every internal rendering/physics constant as a scripting limit or guarantee that the maximum workload will run smoothly on every machine.		This reference lists the current developer-facing Lua, resource, API, queue and configuration limits audited in source. It distinguishes '''fixed capacities''', '''compiled defaults''' and '''operator-configurable bounds'''. It does not treat every internal rendering/physics constant as a scripting limit or guarantee that the maximum workload will run smoothly on every machine.
Line 25:		Line 27:
	Server settings are <code>lua.memoryLimitMB</code>, <code>lua.instructionLimit</code>, <code>lua.timeoutMs</code>, <code>lua.hookInstructionInterval</code>. They '''do not propagate to the client'''. An existing configuration retaining older values overrides the new server defaults. The production and bundled GothicRP-test configuration templates now use the expanded Lua/DB defaults.		Server settings are <code>lua.memoryLimitMB</code>, <code>lua.instructionLimit</code>, <code>lua.timeoutMs</code>, <code>lua.hookInstructionInterval</code>. They '''do not propagate to the client'''. An existing configuration retaining older values overrides the new server defaults. The production and bundled GothicRP-test configuration templates now use the expanded Lua/DB defaults.

	Lua is the sandboxed LuaJIT/Lua 5.1 environment with JIT disabled. Base, table, string and math libraries are exposed; general filesystem/OS/module-loading access is not. <code>dofile</code>, <code>load</code>, <code>loadfile</code>, <code>loadstring</code>, <code>getfenv</code>, <code>setfenv</code>, <code>collectgarbage</code>, <code>newproxy</code>, <code>coroutine</code>, <code>io~~</code>, <code>os~~</code>, <code>package</code>, <code>debug</code>, <code>jit</code>, <code>ffi</code> and <code>string.dump</code> are unavailable. Lua bytecode is rejected. Increasing capacity does not weaken sandbox, hash, ownership, path or network validation.		Lua is the sandboxed LuaJIT/Lua 5.1 environment with JIT disabled. Base, table, string and math libraries are exposed; general filesystem/OS/module-loading access is not. <code>dofile</code>, <code>load</code>, <code>loadfile</code>, <code>loadstring</code>, <code>getfenv</code>, <code>setfenv</code>, <code>collectgarbage</code>, <code>newproxy</code>, <code>coroutine</code>, <code>io</code>, <code>package</code>, <code>debug</code>, <code>jit</code>, <code>ffi</code> and <code>string.dump</code> are unavailable. Lua bytecode is rejected. Increasing capacity does not weaken sandbox, hash, ownership, path or network validation.

			=== Safe wall-clock time (since 0.1.4 BUILD126) ===
			The <code>os</code> table remains unavailable in 0.1.3. Since '''0.1.4 BUILD126 (in development)''', client and server resources receive a restricted table containing only [[os.time\|os.time()]]. It returns Unix seconds from the local host clock and accepts no arguments (not even a date table or explicit nil). The full OS library is never opened: <code>os.execute</code>, <code>os.exit</code>, filesystem operations, environment access and all other OS-library members remain unavailable.
			<syntaxhighlight lang="lua">
			-- Seed once at resource startup, not before every draw.
			math.randomseed(os.time())
			local roll = math.random(1, 100)
			</syntaxhighlight>
			This is ordinary, non-cryptographic randomness. Use [[getTickCount]] for elapsed time; wall-clock time can change and client clocks are not authoritative. See [[os.time]] for the complete contract.

	== Timers, handlers and commands ==		== Timers, handlers and commands ==
Line 91:		Line 102:

	Client catalog relative paths are at most '''512 bytes''', with at most '''128 bytes per segment'''; file URLs are at most '''2048 bytes'''. Resource names used across the whole scripting/network stack should fit the stricter '''96-byte event-name envelope field''' even though filesystem-side validators allow longer names. Paths must stay inside the resource, use the accepted relative-path syntax and refer to declared files; absolute paths and traversal are not enabled by larger file budgets.		Client catalog relative paths are at most '''512 bytes''', with at most '''128 bytes per segment'''; file URLs are at most '''2048 bytes'''. Resource names used across the whole scripting/network stack should fit the stricter '''96-byte event-name envelope field''' even though filesystem-side validators allow longer names. Paths must stay inside the resource, use the accepted relative-path syntax and refer to declared files; absolute paths and traversal are not enabled by larger file budgets.

			=== Download and GUI security (since 0.1.4 BUILD126) ===
			These development changes enforce a shared file policy in the server manifest/catalog and client catalog/download path. They do not increase the size budgets above.
			* Allowed extensions (case-insensitive): <code>.lua .json .xml .txt .csv .rml .html .rcss .css .png .webp .tga .jpg .jpeg .bmp .svg .ttf .otf .woff .woff2 .ogg .wav .mp3 .flac</code>.
			* This is a '''transport allowlist, not a decoder capability list'''. It does not enable JavaScript, arbitrary HTML-browser features, additional audio codecs or every listed image format. Existing Lua audio remains declared join-time Ogg; supported GUI image behaviour is documented in [[RmlUi images]].
			* Executables and native modules such as <code>.exe .dll .asi .com .scr</code>, installers, shell scripts and shortcuts are not allowed. Recognized native executable headers (MZ/PE, ELF and Mach-O) are rejected even when renamed to an allowed suffix; cached files are checked too. This is defence in depth, '''not an antivirus or a guarantee that arbitrary content is harmless'''. Historical cache files are not automatically erased.
			* Relative path segments use ASCII letters/digits, spaces, <code>_</code>, <code>-</code> and <code>.</code>; empty/dot/traversal segments, absolute paths, backslashes, alternate data streams, Windows reserved device names and trailing dots/spaces are rejected. Case-insensitive catalog collisions are rejected. The 512-byte path and 128-byte segment limits remain.
			* The catalog's canonical SHA-256 must match the revision obtained from the official HTTPS server listing. Launcher/supervisor and client runtime enforce this pin before accepting resource payloads. An absent or stale listing is rejected, not replaced with an untrusted HTTP fallback. After changing resources, allow the official listing to refresh before rejoining. HTTP asset transfer remains unencrypted: integrity verification is not confidentiality.
			* RmlUi reads verified, declared GUI assets owned by the requesting resource. Arbitrary local files, other resources, scripts and undeclared files are not available through GUI references. Resource file size/hash and final resolved paths are checked, including rejection of reparse/junction redirection. The host's explicitly approved system-font fallback is separate from resource access.
			See [[Update 0.1.4]]; use the updated server and complete client/launcher package for these protections. Protocol 35 is unchanged by this hardening.

	== JSON ==		== JSON ==
Line 118:		Line 139:
	All configurable ranges are listed in [[Server configuration limits]]. Result overflow is reported as a database error (client result-limit error '''90001'''), not a successful partial result. Free/poll results and avoid unbounded result retention; use SQL pagination. MariaDB/MySQL can impose additional server-side limits, including its packet and connection settings, which this application does not automatically change.		All configurable ranges are listed in [[Server configuration limits]]. Result overflow is reported as a database error (client result-limit error '''90001'''), not a successful partial result. Free/poll results and avoid unbounded result retention; use SQL pagination. MariaDB/MySQL can impose additional server-side limits, including its packet and connection settings, which this application does not automatically change.

	Passwords for hash/verify are at most '''256 bytes'''; encoded hashes at most '''512 bytes'''. Default Argon2id parameters remain '''65536 KiB memory, 3 iterations, parallelism 1'''; larger queue capacity does not weaken hash security. DB multi-statements, multi-queries, local infile and automatic reconnect are not enabled as a side effect of ~~this~~ update.		Passwords for hash/verify are at most '''256 bytes'''; encoded hashes at most '''512 bytes'''. Default Argon2id parameters remain '''65536 KiB memory, 3 iterations, parallelism 1'''; larger queue capacity does not weaken hash security. DB multi-statements, multi-queries, local infile and automatic reconnect are not enabled as a side effect of the 0.1.3 capacity update. Separately, 0.1.4 adds explicit opt-in recovery; see [[MySQL connection recovery]].

	== requestRemote ==		== requestRemote ==
Line 240:		Line 261:
	* Sound volume 0..1; finite 3D coordinates +/-1000000 m; minimum distance >=0.01 m, maximum distance greater than minimum and <=10000 m. Audio paths must also satisfy the catalog's stricter relative-path bounds.		* Sound volume 0..1; finite 3D coordinates +/-1000000 m; minimum distance >=0.01 m, maximum distance greater than minimum and <=10000 m. Audio paths must also satisfy the catalog's stricter relative-path bounds.
	* UI texture files: at most '''256 MiB''' encoded (previously 64 MiB); decoded width and height remain at most '''8192 pixels each'''. This is not a VRAM allocation guarantee.		* UI texture files: at most '''256 MiB''' encoded (previously 64 MiB); decoded width and height remain at most '''8192 pixels each'''. This is not a VRAM allocation guarantee.
			* '''Since 0.1.4 BUILD125 (in development):''' static lossy/lossless WebP with alpha works in RML images and RCSS image decorators; PNG support is retained. Animated WebP is rejected. No new Lua image function is required. See [[RmlUi images]] for manifest/RML examples and format restrictions. BUILD126 also hardens uncompressed 24/32-bit TGA validation and resource GUI reads.
	* UI attribute name: 1..64 bytes with safe-name validation; attribute value at most '''16384 bytes''' (previously 4096). Event-handler attribute injection remains prohibited.		* UI attribute name: 1..64 bytes with safe-name validation; attribute value at most '''16384 bytes''' (previously 4096). Event-handler attribute injection remains prohibited.
	* GUI append-text retains at most '''1000 child lines''' per target element (previously 200), removing older children. This is not a cap on all elements in an RML document.		* GUI append-text retains at most '''1000 child lines''' per target element (previously 200), removing older children. This is not a cap on all elements in an RML document.
Line 250:		Line 272:

	== Source audit and practical use ==		== Source audit and practical use ==
			Focused follow-up: '''2026-09-20''', development '''0.1.4 BUILD125/126''', protocol '''35''': WebP, restricted [[os.time]], resource file policy and GUI loading. This is not a new audit of every historical numeric limit below. Earlier audit baseline follows.

	Audit date: '''2026-09-12'''; expanded-budget '''0.1.3 BUILD81''', protocol '''34'''. Changes increase capacities, not packet layouts. Main sources:		Audit date: '''2026-09-12'''; expanded-budget '''0.1.3 BUILD81''', protocol '''34'''. Changes increase capacities, not packet layouts. Main sources:

QCherry: 0.1.4 BUILD124: remove fixed world-object count and request caps; document remaining data/transport bounds

2026-09-20T18:37:34Z

0.1.4 BUILD124: remove fixed world-object count and request caps; document remaining data/transport bounds

← Older revision		Revision as of 18:37, 20 September 2026
Line 262:		Line 262:
	<!-- map-editor014:start -->		<!-- map-editor014:start -->
	== Map editor and world objects (since 0.1.4, in development) ==		== Map editor and world objects (since 0.1.4, in development) ==
	* ~~Editor~~: ~~500 document objects~~, 200 undo commands~~, 1000000-byte JSON transfers~~; map names up to 48 ASCII letters/digits/_/-.		* BUILD124 and updated scripts remove the fixed editor/legacy/map_scene object-count caps. Remaining document bounds: 1000000-byte transfers, shared JSON codec 1 MiB and 65536 entries (including nested fields); 200 undo commands; map names up to 48 ASCII letters/digits/_/-.
	* ~~Native client world objects~~: 512 ~~total instances and~~ 16 owning resources; command JSON up to 4096 bytes~~, 32 pending requests, 80 requests per one-second host rate window across resources;~~ 10-second result timeout.		* WorldObjects since BUILD124: no fixed instance-count, pending-request-count or requests/second cap (former 512/32/80 removed). Still 16 owning resources, command JSON up to 4096 bytes and a 10-second result timeout. Shared IPC queues remain bounded at 256 frames each: check rejection and pace submissions. Memory/CPU/GPU limits still apply; the scene loader remains sequential.
	* Coordinates +/-100000 metres; rotations +/-36000 degrees; scale 0.01-100 per axis; ray length up to 1000 m; object IDs up to 64 characters and asset paths up to 512.		* Coordinates +/-100000 metres; rotations +/-36000 degrees; scale 0.01-100 per axis; ray length up to 1000 m; object IDs up to 64 characters and asset paths up to 512.
	* Resource storage: 1 MiB/file and 64-character keys. Pre-write admission rejects an existing directory over 64 MiB or over 512 regular files (including backups); these are not post-write hard quotas.		* Resource storage: 1 MiB/file and 64-character keys. Pre-write admission rejects an existing directory over 64 MiB or over 512 regular files (including backups); these are not post-write hard quotas.
	See [[Map editor]], [[World objects]], [[Resource data storage]]. These additions do not change the public 0.1.3 limits documented elsewhere on this page.		See [[Map editor]], [[World objects]], [[Resource data storage]]. These additions do not change the public 0.1.3 limits documented elsewhere on this page.
	<!-- map-editor014:end -->		<!-- map-editor014:end -->

← Older revision		Revision as of 20:41, 21 September 2026
Line 2:		Line 2:
	<div style="border-left:4px solid #c33;padding:0.7em 1em;background:#fff5f5">'''BASELINE: UPDATE 0.1.3 — expanded-budget BUILD81 (2026-09-12).''' Earlier 0.1.3 binaries have smaller capacities. Update the server and the complete client/launcher package before relying on the expanded limits.</div>		<div style="border-left:4px solid #c33;padding:0.7em 1em;background:#fff5f5">'''BASELINE: UPDATE 0.1.3 — expanded-budget BUILD81 (2026-09-12).''' Earlier 0.1.3 binaries have smaller capacities. Update the server and the complete client/launcher package before relying on the expanded limits.</div>

	'''0.1.4 ~~development~~ additions are explicitly marked below:''' [[os.time]] and resource-file/GUI security in BUILD126; static [[RmlUi images\|WebP images]] in BUILD125; map-editor capacities in BUILD124. The public release ~~remains~~ 0.1.3.		'''0.1.4 additions are explicitly marked below:''' [[os.time]] and resource-file/GUI security in BUILD126; static [[RmlUi images\|WebP images]] in BUILD125; map-editor capacities in BUILD124. The current public release is 0.1.4 / Protocol 36.

	This reference lists the current developer-facing Lua, resource, API, queue and configuration limits audited in source. It distinguishes '''fixed capacities''', '''compiled defaults''' and '''operator-configurable bounds'''. It does not treat every internal rendering/physics constant as a scripting limit or guarantee that the maximum workload will run smoothly on every machine.		This reference lists the current developer-facing Lua, resource, API, queue and configuration limits audited in source. It distinguishes '''fixed capacities''', '''compiled defaults''' and '''operator-configurable bounds'''. It does not treat every internal rendering/physics constant as a scripting limit or guarantee that the maximum workload will run smoothly on every machine.
Line 30:		Line 30:

	=== Safe wall-clock time (since 0.1.4 BUILD126) ===		=== Safe wall-clock time (since 0.1.4 BUILD126) ===
	The <code>os</code> table remains unavailable in 0.1.3. Since '''0.1.4 BUILD126 ~~(in development)~~''', client and server resources receive a restricted table containing only [[os.time\|os.time()]]. It returns Unix seconds from the local host clock and accepts no arguments (not even a date table or explicit nil). The full OS library is never opened: <code>os.execute</code>, <code>os.exit</code>, filesystem operations, environment access and all other OS-library members remain unavailable.		The <code>os</code> table remains unavailable in 0.1.3. Since '''0.1.4 BUILD126''', client and server resources receive a restricted table containing only [[os.time\|os.time()]]. It returns Unix seconds from the local host clock and accepts no arguments (not even a date table or explicit nil). The full OS library is never opened: <code>os.execute</code>, <code>os.exit</code>, filesystem operations, environment access and all other OS-library members remain unavailable.
	<syntaxhighlight lang="lua">		<syntaxhighlight lang="lua">
	-- Seed once at resource startup, not before every draw.		-- Seed once at resource startup, not before every draw.
Line 104:		Line 104:

	=== Download and GUI security (since 0.1.4 BUILD126) ===		=== Download and GUI security (since 0.1.4 BUILD126) ===
	These ~~development~~ changes enforce a shared file policy in the server manifest/catalog and client catalog/download path. They do not increase the size budgets above.		These 0.1.4 changes enforce a shared file policy in the server manifest/catalog and client catalog/download path. They do not increase the size budgets above.
	* Allowed extensions (case-insensitive): <code>.lua .json .xml .txt .csv .rml .html .rcss .css .png .webp .tga .jpg .jpeg .bmp .svg .ttf .otf .woff .woff2 .ogg .wav .mp3 .flac</code>.		* Allowed extensions (case-insensitive): <code>.lua .json .xml .txt .csv .rml .html .rcss .css .png .webp .tga .jpg .jpeg .bmp .svg .ttf .otf .woff .woff2 .ogg .wav .mp3 .flac</code>.
	* This is a '''transport allowlist, not a decoder capability list'''. It does not enable JavaScript, arbitrary HTML-browser features, additional audio codecs or every listed image format. Existing Lua audio remains declared join-time Ogg; supported GUI image behaviour is documented in [[RmlUi images]].		* This is a '''transport allowlist, not a decoder capability list'''. It does not enable JavaScript, arbitrary HTML-browser features, additional audio codecs or every listed image format. Existing Lua audio remains declared join-time Ogg; supported GUI image behaviour is documented in [[RmlUi images]].
Line 111:		Line 111:
	* The catalog's canonical SHA-256 must match the revision obtained from the official HTTPS server listing. Launcher/supervisor and client runtime enforce this pin before accepting resource payloads. An absent or stale listing is rejected, not replaced with an untrusted HTTP fallback. After changing resources, allow the official listing to refresh before rejoining. HTTP asset transfer remains unencrypted: integrity verification is not confidentiality.		* The catalog's canonical SHA-256 must match the revision obtained from the official HTTPS server listing. Launcher/supervisor and client runtime enforce this pin before accepting resource payloads. An absent or stale listing is rejected, not replaced with an untrusted HTTP fallback. After changing resources, allow the official listing to refresh before rejoining. HTTP asset transfer remains unencrypted: integrity verification is not confidentiality.
	* RmlUi reads verified, declared GUI assets owned by the requesting resource. Arbitrary local files, other resources, scripts and undeclared files are not available through GUI references. Resource file size/hash and final resolved paths are checked, including rejection of reparse/junction redirection. The host's explicitly approved system-font fallback is separate from resource access.		* RmlUi reads verified, declared GUI assets owned by the requesting resource. Arbitrary local files, other resources, scripts and undeclared files are not available through GUI references. Resource file size/hash and final resolved paths are checked, including rejection of reparse/junction redirection. The host's explicitly approved system-font fallback is separate from resource access.
	See [[Update 0.1.4]]; use the updated server and complete client/launcher package for these protections. Protocol ~~35 is unchanged by this hardening~~.		See [[Update 0.1.4]]; use the updated server and complete client/launcher package for these protections. The complete public 0.1.4 release uses Protocol 36; update both client and server.

	== JSON ==		== JSON ==
Line 261:		Line 261:
	* Sound volume 0..1; finite 3D coordinates +/-1000000 m; minimum distance >=0.01 m, maximum distance greater than minimum and <=10000 m. Audio paths must also satisfy the catalog's stricter relative-path bounds.		* Sound volume 0..1; finite 3D coordinates +/-1000000 m; minimum distance >=0.01 m, maximum distance greater than minimum and <=10000 m. Audio paths must also satisfy the catalog's stricter relative-path bounds.
	* UI texture files: at most '''256 MiB''' encoded (previously 64 MiB); decoded width and height remain at most '''8192 pixels each'''. This is not a VRAM allocation guarantee.		* UI texture files: at most '''256 MiB''' encoded (previously 64 MiB); decoded width and height remain at most '''8192 pixels each'''. This is not a VRAM allocation guarantee.
	* '''Since 0.1.4 BUILD125 ~~(in development)~~:''' static lossy/lossless WebP with alpha works in RML images and RCSS image decorators; PNG support is retained. Animated WebP is rejected. No new Lua image function is required. See [[RmlUi images]] for manifest/RML examples and format restrictions. BUILD126 also hardens uncompressed 24/32-bit TGA validation and resource GUI reads.		* '''Since 0.1.4 BUILD125:''' static lossy/lossless WebP with alpha works in RML images and RCSS image decorators; PNG support is retained. Animated WebP is rejected. No new Lua image function is required. See [[RmlUi images]] for manifest/RML examples and format restrictions. BUILD126 also hardens uncompressed 24/32-bit TGA validation and resource GUI reads.
	* UI attribute name: 1..64 bytes with safe-name validation; attribute value at most '''16384 bytes''' (previously 4096). Event-handler attribute injection remains prohibited.		* UI attribute name: 1..64 bytes with safe-name validation; attribute value at most '''16384 bytes''' (previously 4096). Event-handler attribute injection remains prohibited.
	* GUI append-text retains at most '''1000 child lines''' per target element (previously 200), removing older children. This is not a cap on all elements in an RML document.		* GUI append-text retains at most '''1000 child lines''' per target element (previously 200), removing older children. This is not a cap on all elements in an RML document.
Line 285:		Line 285:

	<!-- map-editor014:start -->		<!-- map-editor014:start -->
	== Map editor and world objects (since 0.1.4~~, in development~~) ==		== Map editor and world objects (since 0.1.4) ==
	* BUILD124 and updated scripts remove the fixed editor/legacy/map_scene object-count caps. Remaining document bounds: 1000000-byte transfers, shared JSON codec 1 MiB and 65536 entries (including nested fields); 200 undo commands; map names up to 48 ASCII letters/digits/_/-.		* BUILD124 and updated scripts remove the fixed editor/legacy/map_scene object-count caps. Remaining document bounds: 1000000-byte transfers, shared JSON codec 1 MiB and 65536 entries (including nested fields); 200 undo commands; map names up to 48 ASCII letters/digits/_/-.
	* WorldObjects since BUILD124: no fixed instance-count, pending-request-count or requests/second cap (former 512/32/80 removed). Still 16 owning resources, command JSON up to 4096 bytes and a 10-second result timeout. Shared IPC queues remain bounded at 256 frames each: check rejection and pace submissions. Memory/CPU/GPU limits still apply; the scene loader remains sequential.		* WorldObjects since BUILD124: no fixed instance-count, pending-request-count or requests/second cap (former 512/32/80 removed). Still 16 owning resources, command JSON up to 4096 bytes and a 10-second result timeout. Shared IPC queues remain bounded at 256 frames each: check rejection and pace submissions. Memory/CPU/GPU limits still apply; the scene loader remains sequential.
	* Coordinates +/-100000 metres; rotations +/-36000 degrees; scale 0.01-100 per axis; ray length up to 1000 m; object IDs up to 64 characters and asset paths up to 512.		* Coordinates +/-100000 metres; rotations +/-36000 degrees; scale 0.01-100 per axis; ray length up to 1000 m; object IDs up to 64 characters and asset paths up to 512.
	* Resource storage: 1 MiB/file and 64-character keys. Pre-write admission rejects an existing directory over 64 MiB or over 512 regular files (including backups); these are not post-write hard quotas.		* Resource storage: 1 MiB/file and 64-character keys. Pre-write admission rejects an existing directory over 64 MiB or over 512 regular files (including backups); these are not post-write hard quotas.
	See [[Map editor]], [[World objects]], [[Resource data storage]]. ~~These additions do not change the public 0.1.3~~ limits documented ~~elsewhere~~ on this page.		See [[Map editor]], [[World objects]], [[Resource data storage]]. Other limits documented on this page remain unchanged unless explicitly marked otherwise.
	<!-- map-editor014:end -->		<!-- map-editor014:end -->