---
title: "Limits, placement and recovery"
url: /runtime/envelope
---

# Limits, placement and recovery

> The managed envelope every product runs in: Function languages and limits, where each part runs, caching, the record store, and recovery with its promise.

The envelope is what managed infrastructure gives every product: what code may be written in, its limits, where each part runs, and how it recovers.

**One call, placed and kept.** A call at the edge.

1. Edge: nearest point. Or cached: a fresh read.
2. Region (keyed calls): the Namespace's.
3. Run (the gate): inside its limits. Or failed: at the limit.
4. Commit (done): one transaction.
5. Kept (replicated): backed up. Or restore: any point.

Records, runs and their logs stay in the Namespace's region.

## What runs, and inside which limits
The limits below hold for every product; the plan meters on [the price list](/pricing.md) cap concurrency, request rates and schedules on top of them.

| Family | What it gives every product |
| --- | --- |
| Languages for code | A `code` [Function](/patterns/function-api.md) is TypeScript in the file or in a module beside it, or a Python or WebAssembly module by path, shipped with the [Version](/reference/platform.md#version) and pinned by its [Digest](/reference/platform.md#digest) |
| What code may touch | Its input, its Thing, the secrets it names and the tools it is given; anything outside goes through a [Source](/patterns/dataset-api.md#how-a-field-is-filled) or an effect, never a raw network call |
| Compute classes | `standard` for most work, and `large` for heavy model and agent work, with more memory and time, metered on its own allowance |
| Long work | A run that waits does not count against its time: an agentic run or a [Workflow](/workflow.md) waits for weeks, and only its working time is limited |
| Placement | Edge for cached reads, the site, the docs and the offer card; the [Namespace](/reference/platform.md#namespace)'s region for records, runs, effects, model calls and logs |
| Caching | Public reads cached at the edge, keyed reads per Customer, each read cleared by the next deploy and by every write to a record it read |
| The record store | One transaction per write inside one Namespace: the fact, its Event, its meter line and its audit entry together; reads after a write see it |
| Scale | Records, files and Events grow with each Namespace; a Customer that outgrows shared infrastructure moves to its own with no change to any [Interface](/every-product.md) |
| Recovery | Continuous backups per Namespace, restore to any point in the last 35 days, a single record restored to any version, and region failover inside the residency |

| Bound | `standard` | `large` |
| --- | --- | --- |
| One run's working time | 30 seconds by default, `timeout` up to 15 minutes | Up to 60 minutes |
| Memory | 256 MB | 4 GB |
| A request or reply body | 10 MB | 10 MB |
| A file upload | 5 GB, resumable | 5 GB, resumable |
| A record | 1 MB, files apart | 1 MB, files apart |
| A [Batch](/reference/platform.md#batch) | 100 calls | 100 calls |
| A bulk job | 10 million inputs | 10 million inputs |

### Example
A score in code, a long research run on the large class, reads cached for an hour, and a recovery promise the offer card prints.

```ts title="definition.ts"
import { define, code, agentic } from 'apis.dev'

/** Answers about any company by its domain, from a score in milliseconds to a person's check in hours. */
export default define({
  name: 'summaries', domain: 'summaries.apis.dev',
  Company: {
    domain:   'url!#',
    score:    code('./score.py', { timeout: '10s' }),              // a Python module
    research: agentic('Find the head of sales at {domain}',
      { returns: { headOfSales: 'string' }, compute: 'large', timeout: '30m' }),
  },
  offer: { 'Company.score': 0.001, 'Company.research': 0.5 },
  operate: {
    cache:    { 'Company.score': '1h' },          // cleared by each deploy
    recovery: { rpo: '5m', rto: '1h' },           // printed on the offer card
    regions:  ['us', 'eu'],
  },
})
```

## Where each part runs
Each Namespace has one region, and every part that touches its records runs there.

| Part | Where it runs for an `eu` Namespace |
| --- | --- |
| Records, files, Events and backups | In the EU, in two places at least |
| Calls, runs and Workflow steps | In the EU, after the edge passes them on |
| The model router | Only providers that process in the EU and keep nothing; a call no such provider serves is refused, never routed out |
| Effects and Sources | Sent from the EU; a Source outside it is named on the security page with what crosses |
| Logs, traces and the [Call record](/reference/platform.md#call-record) | Kept in the EU; a sink sends them only where the Customer's admin points it |
| Cached reads | At the edge, only for reads with no personal or sensitive field |

## Backups, restores and failover, state by state
The recovery promise per isolation tier is data on the offer card, measured by drills and kept in the [proof record](/trust.md#families).

| Isolation | Most data a failure loses | Service back within |
| --- | --- | --- |
| Shared | 5 minutes | 1 hour |
| Its own | 1 minute | 15 minutes |

| Thing | States | What moves it |
| --- | --- | --- |
| A run at its limit | `Running`, then `failed` with a [Problem](/reference.md#errors) at its `timeout`, at no charge | Its working time; a wait does not count |
| A cached read | `fresh`, `stale`, `cleared` | Its time in `operate.cache`, a deploy, a write to a record it read |
| A restore | `requested`, `restoring`, then `done` or `halted` | `Restore.create` by the Customer's admin or your operator; it writes the old state as a new change, so nothing is lost |
| A region | `serving`, `failing_over`, `failed_over`, `failing_back` | A failed region moves its Namespaces to the paired one inside the same residency, and back |
| A drill | `scheduled`, `running`, then `passed` or `failed` | Each quarter per tier; its measured loss and time replace the proof on the offer card |

## What engineers, admins and agents meet
- **An engineer.** Bounds stated before the first call, a `timeout` it can set, and a failed run that costs nothing.
- **A Customer's admin.** Its region on every part, the recovery promise on the security page, and a restore it runs itself.
- **A security reviewer.** Where each part runs, what crosses a border, and the last drill's measured numbers.
- **An agent.** The same limits on every Interface, a Problem at a limit, and `Age` on a cached reply.

---

Every product runs inside one stated envelope, so its limits, its region and its recovery are facts a buyer reads before it calls.