SourceIdentityBounds

Length ceilings for the strings that arrive from outside DICE and end up inside stored identity: the canonical source key from SourceLocator.key, a provider-defined source revision, a chunk id, and a content hash.

Both get hashed into an evidence key and written to an indexed graph property, so an unbounded value is a real hazard: it inflates every index entry that mentions it, and a graph store has its own hard ceiling on an indexed property that surfaces as an opaque database error deep inside a write. Checking here turns that into an IllegalArgumentException at the moment the value is offered, before anything is hashed and before any store is touched.

The limits are deliberately roomy. Nothing a real connector produces comes close; they exist to stop a runaway or hostile value, and they are stated as constants so a caller can check its own input against the same number DICE will.