Module limits 

Resource limits (T17.1b) — generous hard caps on input-driven dimensions.

Reference zic caps none of these, so every cap here is a bucket-3 intentional safer divergence (see docs/differences-from-reference-zic.md): a reliability boundary that stops a malformed or adversarial source set from exhausting memory before compile ever runs. The defaults sit far above any real tzdb (2026b: ~350 zones, ~600 links, tens of rules per set, 27 leap seconds, link chains 1–3 deep, ~15 eras per zone), so no legitimate input is ever rejected — they exist only to bound the pathological tail.

A breach is a plain Error::config (exit 1), not a ZIC### diagnostic: a cap is an operational safety limit, not a zic-grammar violation, so the diagnostic contract’s code space stays reserved for source-grammar conditions. This pairs with the tzif::validate::parse bounds-guard (T17.1a) and the panic policy (docs/panic-policy.md).

Structs

ResourceLimits

Generous reliability caps on input-driven resource dimensions. Default is the production set; tests construct tiny instances to exercise enforcement without giant fixtures, and a future CLI (T17.2) can expose overrides.

Constants

DEFAULT_LEAP_COUNT_MAX

Default cap on leap-second-table entries (real: 27).

DEFAULT_LINK_CHAIN_DEPTH_MAX

Default cap on link-chain resolution depth (real chains are 1–3 hops; also bounds the visited.contains cost in resolve_link_target).

DEFAULT_LINK_COUNT_MAX

Default cap on the number of Link records (real: ~600).

DEFAULT_RULE_COUNT_MAX

Default cap on the number of Rule rows in any one named rule set (real: tens–hundreds).

DEFAULT_SOURCE_BYTES_MAX

Default per-file source-byte ceiling (512 MiB; a real tzdata.zi is a few hundred KB).

DEFAULT_ZONE_COUNT_MAX

Default cap on the number of Zone records (real tzdb: ~350).

DEFAULT_ZONE_ERA_COUNT_MAX

Default cap on continuation eras within a single Zone (real: ~15).