@giveitsmaller/contracts 0.70.0 → 0.73.0

package/openapi/api.yaml

@@ -89,7 +89,7 @@ info:
     of truth instead of hardcoding magic numbers. A runtime
     `GET /api/uploads/limits` endpoint for dynamic discovery
     (per-tier / per-environment overrides) is a deferred follow-up.
-  version: 2.201.0
+  version: 2.208.0
   contact:
     name: API Support
 
@@ -1044,10 +1044,12 @@ paths:
 
         **Tier scoping.** The probe respects the caller's tier — the
         `processing_class_pre_assignment` reflects the same logic
-        F8.1 upload-side gating uses (per ticket I15-CONS), so a
-        free-tier caller probing a 30-minute video sees
-        `blocked` rather than the long-form pre-assignment a
-        pro-tier caller would see.
+        F8.1 upload-side gating uses (per ticket I15-CONS), which
+        honours a class's `required_tier`. **Since 2026-09-23 no callable
+        video class carries one** (decision 26, `jLuZvlJe`; only the
+        `planned` `audio_watermark` keeps `enterprise`), so for every
+        callable class the pre-assignment depends on the file's duration
+        and size, not on the caller's tier.
 
         **Idempotent.** Probing the same file_id twice returns the
         same `probed_at` timestamp + result (cached server-side per
@@ -1138,22 +1140,6 @@ paths:
                         container: "mov"
                         probed_at: "2026-04-26T13:50:00Z"
                       processing_class_pre_assignment: "blocked"
-                blocked_by_tier:
-                  summary: Free-tier caller probes a long-form clip
-                  value:
-                    success: true
-                    data:
-                      file_id: "019539ab-1111-7000-8000-000000000005"
-                      probe_status: "ok"
-                      media_metadata:
-                        duration_seconds: 5400
-                        width: 1920
-                        height: 1080
-                        codec: "h264"
-                        container: "mp4"
-                        audio_layout: "stereo"
-                        probed_at: "2026-04-26T13:50:00Z"
-                      processing_class_pre_assignment: "blocked"
         '401':
           description: Authentication required.
           content:
@@ -1810,8 +1796,8 @@ paths:
                     required_action: "add_credits"
                     links:
                       top_up: "https://giveitsmaller.com/account/billing/top-up"
-                upgrade_plan_free_long_form:
-                  summary: Free tier; long-form requires pro upgrade
+                upgrade_plan_free_tier:
+                  summary: Free tier; the API judged the tier allowance too small for this workload (a balance outcome, not a capability gate)
                   value:
                     success: false
                     error: "Workflow requires more credits than the free tier provides."
@@ -2080,8 +2066,10 @@ paths:
 
             1. **Long-form concurrency cap** — the caller already holds the
                maximum number of concurrent in-flight long-form (Fargate)
-               workflows their tier permits (Pro 2 / Max 5; Enterprise +
-               Free uncapped). Body is `LongFormConcurrencyLimitResponse`:
+               workflows their tier permits (per-tier values are the API's
+               `UserTier.maxConcurrentLongFormJobs` and are not restated
+               here — the restated copy said Free was uncapped while the
+               API capped it). Body is `LongFormConcurrencyLimitResponse`:
                `error: LONG_FORM_CONCURRENCY_LIMIT_EXCEEDED`, `message_key:
                job.long_form_concurrency_exceeded`, a `links.upgrade` CTA,
                and **no `Retry-After`** — the limit clears when an in-flight
@@ -2889,19 +2877,105 @@ paths:
             went too fast; a caller who has opened nothing and is refused
             because the pool is full has not, and sending them to a slow-down
             remedy is a lie. That case is `503`.
+
+            🔴 **THE LIMIT: 5 OPEN STREAMS PER CALLER** (owner ruling
+            2026-09-23, tickets [`2nZAmfxH`](https://trello.com/c/2nZAmfxH) /
+            [`rLCBjojv`](https://trello.com/c/rLCBjojv)).
+
+            - **Who "the caller" is.** An authenticated user — every stream
+              that user holds counts, across sessions and API keys. An
+              anonymous caller is counted per anonymous session.
+              ⛔ **The anonymous key MUST be server-derived, never from
+              client-supplied state** (a cookie or header the reader can drop
+              or rotate) — otherwise a capability-only reader mints fresh
+              slots per connection and the limit does not exist for anonymous
+              callers.
+              ⚠️ **What that key is TODAY: the verified capability, i.e. per
+              anonymous WORKFLOW.** An anonymous workflow persists only its
+              capability-token hash, not the session that created it, so "per
+              anonymous session" cannot yet be derived server-side. An
+              anonymous caller with several workflows therefore holds up to
+              the limit on EACH; the start-rate limiter and the global `503`
+              still bound the total. The key widens to the anonymous session
+              when the API persists an anonymous principal at create — that is
+              an API change, not a contract one.
+            - **What counts.** A stream occupies a slot from the moment it is
+              accepted (`200`) until it closes, for any reason. Streams are
+              counted, not starts — this is the limit `events_stream`'s start
+              RATE cannot express (see `503`).
+            - **Admission is an ATOMIC check-and-reserve, before the `200`.**
+              Checking the count and incrementing it as separate steps lets a
+              burst of concurrent requests all observe free capacity and open
+              more than the limit. A reservation whose stream then fails to
+              start MUST be released.
+            - **What is refused.** The request that would open the sixth
+              stream. **A held stream is never evicted to make room** — the
+              caller's existing streams are unaffected.
+            - **A crash cannot lock a caller out.** Slots are held in a shared
+              counter whose entries EXPIRE: a slot whose stream died without
+              closing cleanly is released at the latest when its entry
+              expires. The expiry is the server's to choose; it is the
+              longest a caller can be refused for streams that no longer
+              exist.
+            - ⛔ **An entry MUST NOT expire while its stream is still open.**
+              Either the expiry is at least the stream's maximum lifetime (the
+              server's stream deadline), or the holder refreshes the entry
+              while it streams. Otherwise a caller holding streams past the
+              expiry regains slots it is still using, and the limit silently
+              becomes "5 per expiry window" instead of "5 open".
+
+            ⚠️ **Refusal ends the ATTEMPT, never the workflow.** The workflow
+            keeps running and `/status` keeps answering; a caller refused a
+            stream loses only the push channel, not the result.
+
+            📌 **TWO `429`s SHARE THIS STATUS, discriminated by `error`:**
+            `SSE_CONNECTION_LIMIT_EXCEEDED` (the open-stream limit above,
+            carrying `open_streams` / `max_streams`) and the generic
+            `TOO_MANY_REQUESTS` from the `events_stream` start-RATE limiter — a
+            plain `ErrorEnvelope`, which validates against the same schema
+            because the two count fields are required only on the first. Both
+            carry `Retry-After` and the same obligation below.
+
+            🔴 **A BROWSER CANNOT READ `Retry-After` UNLESS IT IS EXPOSED.**
+            It is not a CORS-safelisted response header (Fetch Standard,
+            §CORS-safelisted response-header name), and the stream hosts are
+            cross-origin to the frontend. ⇒ **Every refusal on this endpoint
+            (`429` and `503`), as delivered to a browser, MUST carry the same
+            CORS headers as a `200` from that host AND
+            `Access-Control-Expose-Headers: Retry-After`.** Without the first
+            the browser cannot read the status; without the second it reads
+            the status and not the delay — and the consumer obligation below
+            becomes impossible to meet. The obligation is on whatever layer
+            sets CORS for the stream host, not only on the application.
           headers:
             Retry-After:
-              description: Seconds to wait. Delta-seconds, not an HTTP-date.
+              required: true
+              description: |
+                Seconds to wait. Delta-seconds, not an HTTP-date. **Always
+                sent on this status**, and exposed to browsers (see
+                `Access-Control-Expose-Headers` above).
+
+                **CONSUMER OBLIGATION** ([`rLCBjojv`](https://trello.com/c/rLCBjojv)):
+                a client receiving this status **MUST NOT** request another
+                stream for this caller before `Retry-After` has elapsed, and
+                **MUST NOT** treat it as a transport error to be retried on
+                its own schedule — it is a deliberate refusal. The client
+                **MAY** follow the workflow over `/status` meanwhile; that
+                endpoint's own rate limits govern it, and `Retry-After` here
+                governs only the next stream request.
               schema:
                 type: integer
+                minimum: 0
           content:
             application/json:
               schema:
-                $ref: '#/components/schemas/ErrorEnvelope'
+                $ref: '#/components/schemas/SseConnectionLimitResponse'
               example:
                 success: false
                 error: SSE_CONNECTION_LIMIT_EXCEEDED
                 message: Too many open event streams for this caller.
+                open_streams: 5
+                max_streams: 5
         '503':
           description: |
             **Global stream capacity is exhausted — nothing about this caller.**
@@ -2989,13 +3063,17 @@ paths:
             read "not a storm" out of this section; it says the per-client cost
             is bounded and says nothing about the fleet.**
 
-            📌 **WHAT A REFUSED `fetch` CLIENT SHOULD DO INSTEAD IS NOT YET
-            SPECIFIED** — including whether `Retry-After` governs a fallback
-            poll interval and not only a reconnect. Falling back to polling
-            is also load, merely cheaper. Open on
-            [`rLCBjojv`](https://trello.com/c/rLCBjojv); **this block states the
-            measured behaviour and deliberately does not invent the
-            obligation.**
+            📌 **WHAT A REFUSED CLIENT MUST DO IS NOW SPECIFIED** — on the
+            `Retry-After` header of this status and of `429`
+            ([`rLCBjojv`](https://trello.com/c/rLCBjojv), decided with the
+            owner's stream-cap ruling of 2026-09-23): no further stream request
+            before `Retry-After` elapses, never retried as a transport error,
+            and `/status` polling permitted under that endpoint's own limits.
+            ⚠️ **`Retry-After` governs the next STREAM request, not a poll
+            interval.** Falling back to polling is still load, merely cheaper,
+            and the measured behaviour above is what a client does TODAY; a
+            client that treats refusal as a transport error does not yet meet
+            the obligation.
 
             📌 **THE POPULATIONS SPLIT BY READER KIND, NOT BY
             BROWSER-VERSUS-NOT.** The WHATWG rule covers **native
@@ -3018,11 +3096,19 @@ paths:
             endpoint would not notice.
           headers:
             Retry-After:
+              required: true
               description: |
                 Seconds to wait before retrying. Delta-seconds, not an
-                HTTP-date. **Also unreadable by `EventSource`** — see above.
+                HTTP-date. **Always sent on this status. Also unreadable by a native `EventSource`** — see
+                above; a `fetch`-based reader can read it.
+
+                **CONSUMER OBLIGATION** — the same as on `429`: no further
+                stream request before `Retry-After` has elapsed, never retried
+                as a transport error; `/status` polling permitted under that
+                endpoint's own limits.
               schema:
                 type: integer
+                minimum: 0
           content:
             application/json:
               schema:
@@ -6780,7 +6866,8 @@ components:
               404 response + ADR-0016 Amendment.
             - `LONG_FORM_CONCURRENCY_LIMIT_EXCEEDED` (429) — caller already
               holds the maximum concurrent in-flight long-form workflows
-              their tier permits (Pro 2 / Max 5; Enterprise uncapped).
+              their tier permits (values: the API's
+              `UserTier.maxConcurrentLongFormJobs`, not restated here).
               DISTINCT from an infra rate-limit 429: carries no
               `Retry-After` (it clears on workflow completion) and adds a
               `links.upgrade` CTA. `message_key:
@@ -7221,6 +7308,14 @@ components:
     PerMimeAvailability:
       type: object
       description: |
+        **CLOSED TO NEW DECLARATIONS since 2026-09-18** ([`DquOfy7f`](https://trello.com/c/DquOfy7f)).
+        Retained for compatibility only: no cell declares it, and
+        `scripts/check-per-mime-availability.py` fails on any
+        declaration. The API does not enforce it and the SDKs do not
+        gate on it, so a differentiated MIME MUST use a parallel
+        mime_group instead. The description below records what the
+        field meant when it was open.
+
         Map of MIME-type → `PerValueAvailabilityEntry`. Attached to a
         mime_group's `per_mime_availability` field when individual
         MIMEs within the same `mimes:` list ship at different
@@ -7240,8 +7335,9 @@ components:
         remains the right tool when the differentiated subset has
         materially different option shape (animated GIF
         watermarking, video-base watermarking, etc.). This
-        primitive is for pure availability differentiation within
-        an otherwise-homogeneous mime list.
+        primitive WAS for pure availability differentiation within
+        an otherwise-homogeneous mime list; since the closure above,
+        that case uses a parallel mime_group too.
       additionalProperties:
         $ref: '#/components/schemas/PerValueAvailabilityEntry'
 
@@ -8378,14 +8474,64 @@ components:
                   format: uri
                   description: Top-up deep link.
 
+    SseConnectionLimitResponse:
+      type: object
+      description: |
+        `429` body for `GET /api/workflows/{id}/events` when the caller already
+        holds the maximum number of open event streams
+        (`SSE_CONNECTION_LIMIT_EXCEEDED`). The limit, who counts as the caller,
+        and the consumer obligation are on that response. Carries the two
+        counts the SDK taxonomy's `metadataSchema` names (`openStreams` /
+        `maxStreams` after camelCase lowering), so a client can say "5 of 5
+        streams open" without restating the limit.
+
+        **Both count fields are REQUIRED when `error` is
+        `SSE_CONNECTION_LIMIT_EXCEEDED` and absent otherwise**, enforced by the
+        `if`/`then`/`else` branch below rather than a plain `required` list,
+        because the endpoint's other `429` — `TOO_MANY_REQUESTS` from the
+        start-rate limiter — is the plain `ErrorEnvelope` subset of this shape
+        and must validate against it too.
+      allOf:
+        - $ref: '#/components/schemas/ErrorEnvelope'
+        - type: object
+          properties:
+            open_streams:
+              type: integer
+              minimum: 0
+              description: Streams this caller holds open at the moment of refusal.
+            max_streams:
+              type: integer
+              minimum: 1
+              description: |
+                The caller's open-stream limit. **Read the limit from here,
+                not from prose** — it is the server's value at refusal time.
+        # The two 429 branches, machine-enforced (codex, #515 round 4): the
+        # counts are REQUIRED on the stream-limit refusal and FORBIDDEN on any
+        # other code (the start-rate limiter's plain TOO_MANY_REQUESTS).
+        - if:
+            required: [error]
+            properties:
+              error:
+                const: SSE_CONNECTION_LIMIT_EXCEEDED
+          then:
+            required: [open_streams, max_streams]
+          else:
+            not:
+              anyOf:
+                - required: [open_streams]
+                - required: [max_streams]
+
     LongFormConcurrencyLimitResponse:
       type: object
       description: |
         `429` response body for `POST /api/workflows` when the caller
         already holds the maximum number of concurrent in-flight
         long-form (Fargate) workflows their tier permits
-        (`UserTier.maxConcurrentLongFormJobs`: Pro 2 / Max 5; Enterprise
-        + Free uncapped — Free has no long-form access at all). Carried
+        (`UserTier.maxConcurrentLongFormJobs`, owned by the API and not
+        restated here: an earlier copy said Free was uncapped and had no
+        long-form access, while the API capped Free at a value of its own
+        — and since 2026-09-23 every tier reaches long-form, decision 26,
+        `jLuZvlJe`). Carried
         on a `429` but DISTINCT from an infrastructure rate-limit `429`:
 
         - `error` is the stable code `LONG_FORM_CONCURRENCY_LIMIT_EXCEEDED`
@@ -9714,12 +9860,12 @@ components:
         - merge: Concatenate/combine multiple files into one (images, video, audio). Multi-input. Image inputs merge into animated GIF or slideshow video; image collage/grid and PDF concatenation are not supported by the V1 Lambda.
         - archive: Bundle files into ZIP/tar.gz (all types). Multi-input.
         - convert: Change file format (all types)
-        - custom_luma: Apply a caller-uploaded luma matte to a base video for a custom luma-matte transition effect. Multi-input (`role: base` + `role: transition_mask`). `availability: planned` + `required_tier: pro`; dispatch returns `feature_not_available` (422) until Lambda ships. Distinct from FFmpeg `xfade=custom` (which is an expression, not an operation). Per ticket I29 (Trello EPUE5Vs1).
+        - custom_luma: Apply a caller-uploaded luma matte to a base video for a custom luma-matte transition effect. Multi-input (`role: base` + `role: transition_mask`). `availability: planned` (no tier gate); dispatch returns `feature_not_available` (422) until Lambda ships. Distinct from FFmpeg `xfade=custom` (which is an expression, not an operation). Per ticket I29 (Trello EPUE5Vs1).
         - audio_overlay: Mix a secondary audio asset over a primary audio or video base (DJ tags, podcast intros/outros, station IDs, jingles). Multi-input (`role: base` + `role: overlay`). `availability: planned`; dispatch returns `feature_not_available` (422) until Lambda ships. **NOT** the same as `audio_watermark` — that operation is steganographic (imperceptible identifier embedded for ownership tracking), tracked separately by I20. Per ticket I19 (Trello Xr3Z4GBF).
         - audio_watermark: Embed a steganographic forensic watermark into an audio asset (or a video's audio track) — Cinavia / Resemble PerTh territory. Single-input. `availability: planned` + `required_tier: enterprise`; dispatch returns `feature_not_available` (422) until Lambda ships. Pairs with `POST /api/audio-watermark/decode` for own-watermarks-only extraction. Per ticket I20 (Trello omiCq7Vn).
-        - audio_to_video: Produce a video from an audio input plus an OPTIONAL still image overlay. Multi-input role-based with the first OPTIONAL role on the contract (`role: base` audio required, `role: overlay` image 0..1 — see `per_role_cardinality`). When overlay is omitted, the video uses a solid background colour. `availability: beta` (Wave A — Lambda backend live; opt-in, MUST NOT return `feature_not_available`; may change with notice). Per ticket [`SlluxMBN`](https://trello.com/c/SlluxMBN) + ADR-0015 (introduces `per_role_cardinality` vocab).
-        - video_watermark: Apply an image overlay onto a base video via FFmpeg's `overlay` filter. Multi-input role-based (`role: base` video + `role: overlay` image, exactly one of each per `per_role_cardinality`). Re-encode required; audio stream-copy passthrough. Distinct from `image_watermark` (pure-Rust/image-only). `availability: beta` (Wave A — Lambda backend live; opt-in, MUST NOT 422; `short_form` is beta, `long_form` stays `planned` — no live Fargate worker; `multi_overlay_stack` stays `planned`). Per ticket [`4NrRPCgh`](https://trello.com/c/4NrRPCgh) + ADR-0013.
-        - video_text_watermark: Render a text overlay onto a base video via FFmpeg's `drawtext` filter. Single-input — text and styling in options. Same `watermark_mode` (single/tiled), anchor + margin vocab as `text_watermark`. Re-encode required; audio stream-copy passthrough. `availability: planned`; dispatch returns `feature_not_available` (422) until Lambda ships. Per ticket [`4NrRPCgh`](https://trello.com/c/4NrRPCgh) + ADR-0013.
+        - audio_to_video: Produce a video from an audio input plus an OPTIONAL still image overlay. Multi-input role-based with the first OPTIONAL role on the contract (`role: base` audio required, `role: overlay` image 0..1 — see `per_role_cardinality`). When overlay is omitted, the video uses a solid background colour. `availability: planned` — WITHDRAWN 2026-09-15: measured 0.300 s of encode per second of output PLUS A 7 s FIXED COST, so the advertised PT2H needs 2167 s against a 900 s platform maximum (0.300 x 7200 alone is 2160 — the intercept is what makes the figure 2167, and a consumer dividing 600 by 0.300 gets a 2000 s in-flight boundary where the real one is 1976 s). Returns `feature_not_available` (422) at workflow-create. An already-accepted workflow is not cancelled (availability is checked at create) and fails only when its output duration exceeds ~1976 s ON THE INPUT THE RATE WAS MEASURED WITH (a real photographic 1080p still plus looped real audio), where 0.300 s per second plus a 7 s fixed cost reaches the worker's 600 s cap — the 60 s and 120 s measured cells both COMPLETED. The driver is the STILL'S RESOLUTION, not duration alone: a 4K still is roughly 4x the rate (unmeasured), which would put the boundary near a quarter of that, and this schema places no constraint on the overlay's resolution. Per ticket [`SlluxMBN`](https://trello.com/c/SlluxMBN) + ADR-0015 (introduces `per_role_cardinality` vocab).
+        - video_watermark: Apply an image overlay onto a base video via FFmpeg's `overlay` filter. Multi-input role-based (`role: base` video + `role: overlay` image, exactly one of each per `per_role_cardinality`). Re-encode required; audio stream-copy passthrough. Distinct from `image_watermark` (pure-Rust/image-only). `availability: planned` — WITHDRAWN 2026-09-15, operation AND `short_form`: a real 1080p source at the advertised PT5M / 500 MB was killed at 606 s by the worker's 600 s encode cap, no output. Returns `feature_not_available` (422) at workflow-create; an already-accepted workflow is not cancelled and fails only if it exceeds that cap; the 606 s kill is ONE measured point and nothing measured says where the boundary is. `long_form` and `multi_overlay_stack` were already `planned`. Per ticket [`4NrRPCgh`](https://trello.com/c/4NrRPCgh) + ADR-0013.
+        - video_text_watermark: Render a text overlay onto a base video via FFmpeg's `drawtext` filter. Single-input — text and styling in options. Same `watermark_mode` (single/tiled), anchor + margin vocab as `text_watermark`. Re-encode required; audio stream-copy passthrough. `availability: planned` — WITHDRAWN 2026-09-15, operation AND `short_form`: a real 1080p source at the advertised PT5M was killed at 604 s by the worker's 600 s encode cap. Returns `feature_not_available` (422) at workflow-create. ⚠️ This entry previously read "until Lambda ships", which was wrong in a way that mattered: the worker SHIPPED and runs — it is the CEILING that cannot be served. Per ticket [`4NrRPCgh`](https://trello.com/c/4NrRPCgh) + ADR-0013.
         - split: Fan one input file into N outputs across GIF / PDF / audio / video MIME families. Single-input per-mime-group catalog (mirrors merge/convert): GIF uses `frame_range` (REQUIRED) + `output_format`; PDF uses `page_range` OR `page_groups` (mutually exclusive); audio + video use a `mode` discriminator (interval/count/cut_points) + numeric-seconds wire format + `precision` flag (fast/exact). 200-output hard cap per ADR-0009 §D5 with per-mode preflight math; output naming `output-001..output-200`. Long-form video routes to a separate `split-video-fargate` worker via `processing_class`. `availability: beta` for the `audio` and `video` mime_groups (workers live on staging — shape-stable + opt-in, MUST NOT 422); video activates BOTH classes (`video.processing_class.short_form: beta` AND `long_form: beta` — `split-video-fargate` deployed + wired on staging but NOT yet proven end-to-end per [`rcwvUKhI`](https://trello.com/c/rcwvUKhI); the first customer-path soak has not completed, the 4GB+ speed-up is unmeasured, and the long-form fan-out is flag-gated dark). The `image_gif` and `document_pdf` mime_groups stay `availability: planned` and dispatch returns `feature_not_available` (422) until their workers ship. Per ticket [`vKI0CFDu`](https://trello.com/c/vKI0CFDu) + ADR-0014.
         - passthrough: Inert lossless source operation. A single-input source job whose SOLE operation is `passthrough` emits its source bytes UNCHANGED — no compression, no Lambda. The API self-completes the job at publish (terminal output = the upload `{bucket, key}` unchanged). Its purpose is to feed an uploaded file into a multi-input operation LOSSLESSLY: because `JobInputV2.source` is narrowed to exclude upload-direct, an upload that must enter a `merge` / `archive` / `image_watermark` op enters via a `passthrough` source job referenced downstream by `{type: job_output, from: <id>}` — preserving billing / DAG / lineage. Distinct from `operations: []` (which keeps its implicit-compress meaning on a single-input upload job); `passthrough` is the EXPLICIT lossless path via the "non-empty `operations[]` without `compress` = compression opt-out" rule. Media-agnostic; no options. `availability: beta` — activated (the inputs[]-narrowing + passthrough self-complete mechanism is deployed API-side); workflow-create accepts `passthrough` source jobs and MUST NOT return `feature_not_available`. **Never published to SNS** — deliberately absent from the AsyncAPI routing enums (API self-completes; no `ops-passthrough` queue). Per ticket [`4som89Uh`](https://trello.com/c/4som89Uh) + ADR-0004 (planned→beta flip).
 
@@ -10950,9 +11096,11 @@ components:
               planned` so workflow-create returns 422 until Lambda
               ships), `audio_overlay` (joined via ticket
               [I19](https://trello.com/c/Xr3Z4GBF) — same `planned`
-              gating), and `audio_to_video` + `video_watermark` (joined
-              via Wave A [`c3uthIP4`](https://trello.com/c/c3uthIP4) —
-              `availability: beta`, backends live). The multi-input
+              gating), and `audio_to_video` + `video_watermark`
+              (WITHDRAWN 2026-09-15 — `availability: planned`; the backends
+              are live but cannot serve the advertised ceilings, so
+              workflow-create returns `feature_not_available` 422). The
+              multi-input
               shape is contract-defined for all entries.
         - if:
             properties:
@@ -12016,9 +12164,12 @@ components:
         gating (per ticket I15-CONS) — reflects what the server
         would route this file to under the caller's current tier.
         `blocked` is emitted when no tier-permitted pool exists for
-        the file (e.g. free-tier caller probing a long-form clip,
-        or any caller probing a `corrupt` / `unsupported_codec`
-        file).
+        the file — any caller probing a `corrupt` /
+        `unsupported_codec` file, or a caller below a class's
+        `required_tier`. Since 2026-09-23 (decision 26) the only
+        video classes still carrying one are `audio_watermark`'s
+        (`enterprise`, both `planned`), so the tier branch is
+        unreachable for every callable video class.
       # CLOSED. It GATES AN AFFORDANCE: `blocked` is a hard stop and the others
       # predict routing. An unrecognised class cannot be safely treated as routable —
       # a consumer guessing would offer an upload the server will refuse. A new
@@ -15103,9 +15254,10 @@ components:
             Operation-level minimum subscription tier. Optional — when
             absent, the operation is available to all callers regardless
             of tier. Per ADR-0001 §1.3 (tier and availability are
-            orthogonal axes). First operation-level consumer is
+            orthogonal axes). First operation-level consumer was
             `custom_luma` (`required_tier: pro`) per
-            [I29 `EPUE5Vs1`](https://trello.com/c/EPUE5Vs1). SDK + frontend
+            [I29 `EPUE5Vs1`](https://trello.com/c/EPUE5Vs1); that gate was
+            dropped 2026-09-23 under decision 26 (owner ruling, `jLuZvlJe`). SDK + frontend
             consumers gate UI on this value alongside `availability` to
             hide higher-tier features for lower-tier callers; the
             runtime returns `feature_tier_restricted` (403) on
@@ -15226,18 +15378,31 @@ components:
         per_mime_availability:
           $ref: '#/components/schemas/PerMimeAvailability'
           description: |
-            Optional per-MIME availability map per ticket
-            [`YXYOo6gg`](https://trello.com/c/YXYOo6gg). Keys MUST be
-            a subset of `mimes[]` (CI-checked by
-            `scripts/check-per-mime-availability.py`); absent keys
-            default to `availability: stable`. Use this when
-            individual MIMEs within an otherwise-homogeneous mime
-            list ship at different availability levels (e.g.
-            `image/avif: beta, image/heic: planned` alongside
-            `image/jpeg: stable`). Runtime emission lands with
-            [I3](https://trello.com/c/eCWIpug8); until then the
-            contract advertises the field shape but the endpoint
-            does not yet surface the field.
+            CLOSED TO NEW DECLARATIONS since 2026-09-18, ticket
+            [`DquOfy7f`](https://trello.com/c/DquOfy7f). No mime_group
+            declares this field and none may:
+            `scripts/check-per-mime-availability.py` REFUSES any
+            declaration, anywhere, at any depth. Expect this map to be
+            absent or empty on every group.
+
+            USE A PARALLEL `mime_group` INSTEAD. A group-level
+            `planned` is enforced at create by the API's 422 gate;
+            this map is NOT enforced anywhere. `compression_api`
+            round-trips it raw; the SDK generators parse and publish
+            it but nothing gates on it (`sdk_exposure` composes
+            op/group/option/value and has no per-MIME level); only the
+            frontend UI resolves it. So a declared value would be
+            served by the API, published to SDK consumers as metadata
+            their own gating ignores, and honoured only in one UI.
+
+            The field itself is RETAINED, not removed: the shape is
+            already published and deleting it would break the four
+            consuming repos. Keys, if any were ever present, MUST be a
+            subset of `mimes[]`, and absent keys mean
+            `availability: stable`. Runtime emission was to land with
+            [I3](https://trello.com/c/eCWIpug8); that roadmap is
+            closed. See `schemas/FORMAT.md`
+            §`per_mime_availability`.
         max_input_size_bytes:
           type: integer
           format: int64

package/operation-capabilities/operation-capabilities.json

@@ -51,7 +51,7 @@
       "accepts": [
         "audio"
       ],
-      "availability": "stable",
+      "availability": "planned",
       "input": {
         "max": 2,
         "min": 1,
@@ -638,7 +638,7 @@
       "accepts": [
         "video"
       ],
-      "availability": "stable",
+      "availability": "planned",
       "input": {
         "max": 2,
         "min": 2,
@@ -732,5 +732,5 @@
       "isAnimated": "maybe"
     }
   },
-  "schema_version": "2.201.0"
+  "schema_version": "2.208.0"
 }

package/operations/schemas/audio_overlay.yaml

@@ -96,8 +96,7 @@ operation:
           # Stays planned (CON-1 flips only compress.video.long_form +
           # merge.video.long_form_re_encode). Per-tier caps per ADR-0011.
           availability: planned
-          required_tier: pro
-          constraints:                            # baseline = Pro
+          constraints:                            # baseline = every tier without a per_tier_constraints override
             max_input_duration: "PT12H"
             max_input_size_bytes: 5000000000       # 5 GB (Pro)
             max_output_size_bytes: 5000000000
@@ -282,8 +281,7 @@ operation:
           # Stays planned (CON-1 flips only compress.video.long_form +
           # merge.video.long_form_re_encode). Per-tier caps per ADR-0011.
           availability: planned
-          required_tier: pro
-          constraints:                            # baseline = Pro
+          constraints:                            # baseline = every tier without a per_tier_constraints override
             max_input_duration: "PT12H"
             max_input_size_bytes: 5000000000       # 5 GB (Pro)
             max_output_size_bytes: 5000000000

package/operations/schemas/audio_to_video.yaml

@@ -2,7 +2,7 @@ schema_version: "2.0.0"
 
 operation:
   type: audio_to_video
-  availability: stable
+  availability: planned
   description: |
     Produce a video from an audio input plus an OPTIONAL still image
     overlay. Use cases: podcast → YouTube uploads, audio-only tracks
@@ -26,10 +26,30 @@ operation:
     A lower framerate plus still-image tuning keeps file size tiny
     when the overlay is a still image (the common case).
 
-    Activated to `availability: beta`: the backend is live (API
-    accepts + publishes), so this is shape-stable + opt-in for callers
-    and MUST NOT return `feature_not_available` — it may still change
-    with notice while beta.
+    `availability: planned` — withdrawn 2026-09-15. Measured encode cost is
+    0.300 s per second of output PLUS A 7 s FIXED COST, so the advertised PT2H
+    needs 2167 s against a 900 s platform maximum. ⚠️ The 7 s is not a rounding
+    detail: 0.300 x 7200 alone is 2160, and a consumer dividing 600 by 0.300
+    derives a 2000 s in-flight boundary where the real one is ~1976 s. Workflow-create returns `feature_not_available` (422).
+
+    ⚠️ An already-accepted workflow is NOT cancelled — availability is checked at
+    create — and it is NOT thereby doomed. ⛔ DO NOT READ THIS AS "in-flight work
+    fails": the 60 s and 120 s cells behind this withdrawal both COMPLETED WITH
+    OUTPUT, which is precisely why the evidence is arithmetic rather than a kill.
+    What fails is an accepted workflow whose OUTPUT DURATION exceeds ~1976 s
+    ⚠️ ON THE INPUT THE RATE WAS MEASURED WITH — a real photographic 1080p STILL
+    plus looped real audio — the point at which 0.300 s/s plus the 7 s fixed cost
+    reaches the 600 s cap. ⛔ THE DRIVER IS THE STILL'S RESOLUTION, NOT THE
+    DURATION ALONE: a 4K still is roughly 4x the rate (recorded as UNMEASURED),
+    which would put the boundary near a quarter of that figure, and this schema
+    places NO constraint on the overlay's resolution. Other still resolutions and
+    other output settings are likewise unmeasured, and the contract does not
+    claim which direction they move —
+    and what the caller then sees is NOT SETTLED — see the CHANGELOG entry for
+    2.203.0; this contract does not pin a worker's error classification. Measured figures and the conditions for re-listing are in the
+    CHANGELOG entry for 2.203.0 — the only one of the two records that is
+    PUBLISHED (`schemas/manifest-divergence-register.yaml` is working material
+    for the drift gate and is not in the npm tarball).
 
   default: false
   input_model: multi

package/operations/schemas/compress.yaml

@@ -1041,9 +1041,16 @@ operation:
           # (pure 300s duration + 256MiB size floor), and the eligibility gate
           # treats beta==stable (only `planned` differs) — API-confirmed.
           # Per-tier caps per D3.
+          #
+          # NO `required_tier` (owner ruling 2026-09-23, jLuZvlJe, under
+          # decision 26): capability is limited by quota and credits, never by
+          # hiding it. The `pro` gate this carried was never enforced by the API
+          # and outlived the decision that opened every file type to every tier.
+          # A lower tier's per-account upload cap
+          # (`limits.max_upload_size_bytes`) still refuses first — that is the
+          # quota, and it is a separate, request-level limit.
           availability: stable
-          required_tier: pro
-          constraints:                            # baseline = Pro (lowest permitted tier)
+          constraints:                            # baseline = every tier without a per_tier_constraints override
             max_input_duration: "PT12H"
             max_input_size_bytes: 5000000000       # 5 GB (Pro)
             max_output_size_bytes: 5000000000

package/operations/schemas/convert.yaml

@@ -307,8 +307,7 @@ operation:
           # merge.video.long_form_re_encode). Per-tier caps per ADR-0011 —
           # advertised shape; availability gates execution off (422).
           availability: planned
-          required_tier: pro
-          constraints:                            # baseline = Pro
+          constraints:                            # baseline = every tier without a per_tier_constraints override
             max_input_duration: "PT12H"
             max_input_size_bytes: 5000000000       # 5 GB (Pro)
             max_output_size_bytes: 5000000000

package/operations/schemas/custom_luma.yaml

@@ -3,12 +3,12 @@ schema_version: "2.0.0"
 operation:
   type: custom_luma
   availability: planned
-  required_tier: pro
   description: |
     Apply a caller-uploaded luma matte (transition-mask) over a base
     video to produce a custom luma-matte transition effect. Inspired
     by Cloudinary's deprecated luma-matte custom transitions and
-    intended as a paid-tier (`pro`+) creative feature.
+    intended as a creative feature, metered by credits like every
+    other operation (no tier gate — decision 26, 2026-09-23).
 
     **NOT** related to the `xfade=custom` expression-mode transition
     parameter. The `merge.transition.custom` value is tagged `planned`
@@ -52,13 +52,12 @@ operation:
         - video/webm
       processing_class:
         # F8 long-form video tier (per ticket I15-CONS). custom_luma
-        # is itself `availability: planned` + `required_tier: pro`
-        # at the operation level; the per-class shape lands now to
+        # is itself `availability: planned` at the operation level
+        # (no tier gate — decision 26, owner ruling 2026-09-23); the per-class shape lands now to
         # keep SDK/sidecar shape forward-compatible when the operation
         # ships.
         short_form:
           availability: planned
-          required_tier: pro
           constraints:
             max_input_duration: "PT5M"
             max_input_size_bytes: 524288000
@@ -68,8 +67,7 @@ operation:
           # merge.video.long_form_re_encode). Per-tier caps per ADR-0011 —
           # advertised shape; availability gates execution off (422).
           availability: planned
-          required_tier: pro
-          constraints:                            # baseline = Pro
+          constraints:                            # baseline = every tier without a per_tier_constraints override
             max_input_duration: "PT12H"
             max_input_size_bytes: 5000000000       # 5 GB (Pro)
             max_output_size_bytes: 5000000000

package/operations/schemas/merge.yaml

@@ -190,8 +190,7 @@ operation:
           # max_total_duration (24h single-pass budget, SPIKE-0); size is the
           # per-tier secondary cap.
           availability: stable
-          required_tier: pro
-          constraints:                              # baseline = Pro (lowest permitted)
+          constraints:                              # baseline = every tier without a per_tier_constraints override
             max_total_duration: "PT24H"              # 24h (was PT12H) — binding Enterprise ceiling
             max_total_input_size_bytes: 5000000000   # 5 GB combined (Pro)
           per_tier_constraints: