moxzi-web limitsalpha
What actors in a browser tab can't do, or do differently from moxzid and the Internet Computer.
Execution#
| Limit | Details | What to do |
|---|
| A page can't interrupt a running message | In page mode, an infinite loop freezes the tab | Use meter: true, which traps a message after instructionLimit instructions, or worker mode with deadlineMs |
| Instruction counting is off by default | It makes modules larger and slower | Turn on meter for actors whose code you don't control and set a positive instructionLimit |
| Fuel exhaustion is a typed trap | ExecutionLimitError rolls back the overrunning message and leaves the worker live | Catch it as ExecutionLimitError or its base ActorError |
| A missed deadline restarts the worker | The runtime restores its last committed whole-runtime generation, including spawned actors and timer policy | Set a finite deadlineMs as a fallback for instrumentation or engine failures |
| Timers run only when driven | The runtime has no clock loop | Pass timerMs to Moxzi.start, or call tick() |
| Randomness is reproducible | raw_rand is derived from a fixed seed, so two new pages produce the same bytes | Don't rely on raw_rand for secrets in the browser |
| Actor memory is admitted by the host | Defaults are 24 actors, 320 pages per instance, 4,000 aggregate pages for reserved linear capacity plus live stable memory, and 128 MiB per imported image | Set maxActors, maxInstancePages, maxTotalPages, or maxImportBytes to a smaller trusted ceiling. Quota failures are recoverable errors |
The runtime lowers an unbounded or excessive module maximum before browser compilation and then accounts that maximum for each actor. stable64_grow uses the same aggregate ledger and returns the IC-compatible failure value when the remaining budget is insufficient. restore and loadAll reject an oversized or over-budget image before replacing committed state.
Network and identity#
| Limit | Details | What to do |
|---|
| No certificates | There's no subnet to sign them | Use a real canister for certified data |
| Not reachable from outside | Only the page can call its actors | Use moxzid or the IC for actors others must call |
| HTTPS outcalls need a worker and cross-origin isolation | The page must send Cross-Origin-Opener-Policy: same-origin and Cross-Origin-Embedder-Policy: require-corp | See Getting started |
| Outcall responses are limited to 4 MiB | They pass through a fixed-size shared buffer | Request less data |
Storage#
| Limit | Details | What to do |
|---|
| Two tabs can overwrite each other's saved state | indexedDbStore doesn't lock | Use a different store name per tab, or save from one tab |
| Browser storage quotas apply | IndexedDB space is limited per site | Keep large data elsewhere |
Compiling in the page#
| Limit | Details | What to do |
|---|
| The compiler must run on the main thread | A worker's stack is too small for it | Compile in page mode |
| Deeply nested expressions fail to compile | The browser's stack is smaller than the native one. Hand-written code is not affected; generated code with hundreds of nested operators can be | Compile generated code with moxzi build, or split long expressions |
Cycles#
Message and creation fees are charged, so code that checks its cycle balance sees them change. Nothing is charged while an actor is idle.