Struct ReassemblyLimits 

pub struct ReassemblyLimits {
    pub max_pending_messages: usize,
    pub max_chunk_data_len: usize,
    pub max_message_bytes: usize,
    pub max_chunks_per_message: usize,
    pub max_total_buffered_cost: usize,
    pub slot_overhead: usize,
    pub max_completed_ids: usize,
}

The limits a super::MessageReassembler enforces on incoming chunks, as an explicit value rather than module globals. This keeps the core admission rule independent of where the numbers come from: the shell supplies them (see ReassemblyLimits::production), the reassembler only enforces what it is given, and tests can use small limits instead of giant synthetic payloads.

Fields

max_pending_messages: usize

Max number of distinct in-flight message ids (a cheap first-line cap; the byte budgets are the real memory guard).

max_chunk_data_len: usize

Max data bytes a single chunk may carry.

max_message_bytes: usize

Max buffered data bytes for one in-flight message.

max_chunks_per_message: usize

Max number of slots (chunks) one in-flight message may have - i.e. the largest total a chunk may claim. Caps the slot/BTreeMap count of a single message so a hostile peer cannot use one id with a huge total and tiny chunks to allocate millions of slots while staying under max_message_bytes (which only counts data bytes).

max_total_buffered_cost: usize

Max buffered cost (data bytes + per-slot overhead) summed across all in-flight messages.

slot_overhead: usize

Bookkeeping charge per slot - a conservative estimate (not an exact measurement) of the BTreeMap node plus Bytes header/refcount a slot costs, so a flood of tiny chunks is bounded by slot count, not only by summed data bytes. Real per-slot heap use may differ; this is deliberately generous so the budget over- rather than under-counts.

max_completed_ids: usize

Max number of recently-completed message ids remembered as tombstones, to suppress a re-delivery if a message is fully retransmitted after it already completed (within its TTL window). The same number separately caps invalid-terminal ids and ids rejected before local capacity could retain state. Invalid ids fail open without peer attribution when their set is full, with a bounded saturation horizon preserving that decision while tombstones drain; capacity-history saturation temporarily rejects all new ids for that peer. Thus terminal bookkeeping retains at most three times this many ids across the independent completed, invalid, and capacity sets, plus two scalar saturation horizons. NOTE: past this many concurrent live completion tombstones the oldest is dropped even if its TTL has not elapsed, so the “no post-completion redelivery” guarantee holds only for the most recent max_completed_ids completions within a TTL window.

Implementations

impl ReassemblyLimits

pub fn production() -> ReassemblyLimits

The limits used in production, derived from the transport / message ceilings. This is the one place that reaches for transport-specific constants; the reassembler itself does not.

pub fn constrained() -> ReassemblyLimits

Lower-concurrency limits for constrained deployments.

The per-message ceiling remains protocol-compatible with production. Constrained nodes instead admit fewer simultaneous messages and only one maximum-size reassembly, including its contiguous output copy.

Trait Implementations

impl Clone for ReassemblyLimits

fn clone(&self) -> ReassemblyLimits

Returns a duplicate of the value.

fn clone_from(&mut self, source: &Self)

Performs copy-assignment from source.

impl Copy for ReassemblyLimits

impl Debug for ReassemblyLimits

fn fmt(&self, f: &mut Formatter<'_>) -> Result<(), Error>

Formats the value using the given formatter.

impl Default for ReassemblyLimits

fn default() -> ReassemblyLimits

Returns the “default value” for a type.