Constant MAX_COMMANDS 

pub const MAX_COMMANDS: usize = 64;

Bounds (validated on BOTH build and parse — a foreign manifest is untrusted input and must never cost unbounded memory or render work).