0002: Bounded networking and runtime behavior

Status: Implemented in 0.2.0-dev.

Decision

Networking APIs accept IPv4. CIDRs normalize host bits to the network address. Equal normalized CIDRs compare equal.
subnet.split(prefix) requires exactly one integer with parent.mask < prefix <= 32. Splitting a /32 is an error; requesting the parent’s prefix is also an error.
Split output is generated by a known count, not address wraparound. /0 split into /1 returns two blocks and terminates; the last IPv4 address is handled correctly.
Materialized ranges, splits, list/map literals, and list/map growth are limited to 65,536 entries per collection. Oversized range/split requests fail before allocating their results.
range() computes its count and progression without signed overflow. Its stop remains exclusive and zero steps fail.
net.allocate(parent, prefixes) plans largest blocks first, then returns results in request order. Prefixes may equal the parent’s mask. It either fits every request without overlap or fails before returning a partial plan.
Lists/maps/functions/agents compare by identity. IPs/CIDRs compare by normalized value. Collection copies produced by slice, sort, and reverse are shallow; append/pop/index assignment mutate the original value and its aliases.
Sorting accepts all numbers or all strings, preventing inconsistent ordering of heterogeneous lists.
Slice bounds are integers, normalize negative indices, and clamp to collection bounds. Reversed bounds return an empty list.
Parser and function-call depth are limited to 256; expression evaluation depth is limited to 512 and may stop recursion earlier. JSON nesting and display traversal are limited to 128. Cyclic/deep display uses placeholders; JSON encoding rejects cycles.
CLI scripts and input files are limited to 1 MiB. JSON encoding has a 65,536-value traversal budget and a 1 MiB output limit.
Runtime options support injected input/output, script arguments, and a cancellation context. CLI deadlines are cooperative; host I/O is not forcibly interrupted. These limits are not an isolation sandbox or a total process-memory guarantee.

Alternatives and consequences

Lazy ranges/splits would support larger inputs but require iterator semantics. Configurable limits need an embedding/resource policy; fixed documented limits are easier to review for this first release. IPv6, structural collection equality, and deterministic instruction budgets remain separate decisions.

These choices bound common allocation paths and fix termination defects while keeping the current AST and language syntax. Tests cover address-space boundaries, excessive requests, exhaustion, identity/mutation, recursion, parser nesting, and cancellation.