@giveitsmaller/contracts 0.79.0 → 0.81.0

package/openapi/api.yaml

@@ -103,7 +103,7 @@ info:
     of truth instead of hardcoding magic numbers. A runtime
     `GET /api/uploads/limits` endpoint for dynamic discovery
     (per-tier / per-environment overrides) is a deferred follow-up.
-  version: 2.214.0
+  version: 2.216.0
   contact:
     name: API Support
 
@@ -6543,11 +6543,9 @@ paths:
         **How to observe the grant:** poll `GET /api/v2/credits/usage`
         for a transaction whose `reference_id` equals the `session_id`
         returned here, and whose `reference_type` is
-        `stripe_checkout_session`. **Today that is the only
-        client-observable correlation** between a checkout and its credits.
-        `GET /api/billing/checkout/{sessionId}/status` is declared as the
-        second one, but it is `planned` (a `422 feature_not_available`)
-        until the API implements it.
+        `stripe_checkout_session`. The other, simpler
+        correlation is `GET /api/billing/checkout/{sessionId}/status`
+        (`beta` since 2026-09-25): poll it until `paid`.
 
         🔴 **MATCH ON `reference_type` + `reference_id`, AND DO NOT
         FILTER ON `type`.** The pack grant is written as an
@@ -6784,6 +6782,15 @@ paths:
         BEFORE the API builds it (hub ruling, Option A, 2026-08-29); the API
         half is [`JHrV4MUg`](https://trello.com/c/JHrV4MUg).
 
+        **`beta` since 2026-09-25**: api v1.14.0 (which ships it) is live on
+        PROD, verified by api from the running service (ECS
+        `gisl-prod-euw1-api:27`, image = ECR v1.14.0, the
+        `checkout_sessions` migration applied) and confirmed by the hub.
+        Production has exercised only the `unknown` path. **It becomes
+        `stable` after the first real PAID checkout on prod** (the owner's or
+        a customer's, evidenced from api logs or the ledger; never a
+        synthetic live session) shows `pending` then `paid` for its session.
+
         **Why it exists:** between "checkout created" and "the provider's
         callback lands" nothing used to record that the session existed or
         whose it was — so a post-checkout page, asked about the NORMAL
@@ -6823,7 +6830,7 @@ paths:
       operationId: getCheckoutSessionStatus
       security: [{bearerAuth: []}, {sessionAuth: []}]  # required; answers only about the caller's own sessions
       x-identity-scoped: true  # a session belongs to the caller who created it
-      x-availability: planned
+      x-availability: beta
       tags:
         - Billing
       parameters:
@@ -6843,8 +6850,7 @@ paths:
             caller's (see the collapse rationale above). An id the router
             cannot route (for example invalid UTF-8 such as `cs_%FF`) is a
             `404` before this endpoint runs; that answer is the same for
-            every caller and every session, so it reveals nothing. While the endpoint is `planned` it
-            answers `422 feature_not_available` instead.
+            every caller and every session, so it reveals nothing.
           content:
             application/json:
               schema:
@@ -6887,13 +6893,6 @@ paths:
             application/json:
               schema:
                 $ref: '#/components/schemas/ErrorEnvelope'
-        '422':
-          description: |
-            `feature_not_available` while this endpoint is `planned`.
-          content:
-            application/json:
-              schema:
-                $ref: '#/components/schemas/FeatureNotAvailableResponse'
         '429':
           description: |
             Rate limit exceeded. This endpoint is limited as a STATUS POLL
@@ -10426,9 +10425,9 @@ components:
         - custom_luma: Apply a caller-uploaded luma matte to a base video for a custom luma-matte transition effect. Multi-input (`role: base` + `role: transition_mask`). `availability: planned` (no tier gate); dispatch returns `feature_not_available` (422) until Lambda ships. Distinct from FFmpeg `xfade=custom` (which is an expression, not an operation). Per ticket I29 (Trello EPUE5Vs1).
         - audio_overlay: Mix a secondary audio asset over a primary audio or video base (DJ tags, podcast intros/outros, station IDs, jingles). Multi-input (`role: base` + `role: overlay`). `availability: planned`; dispatch returns `feature_not_available` (422) until Lambda ships. **NOT** the same as `audio_watermark` — that operation is steganographic (imperceptible identifier embedded for ownership tracking), tracked separately by I20. Per ticket I19 (Trello Xr3Z4GBF).
         - audio_watermark: Embed a steganographic forensic watermark into an audio asset (or a video's audio track) — Cinavia / Resemble PerTh territory. Single-input. `availability: planned` (no tier gate since 2026-09-23); dispatch returns `feature_not_available` (422) until Lambda ships. Pairs with `POST /api/audio-watermark/decode` for own-watermarks-only extraction. Per ticket I20 (Trello omiCq7Vn).
-        - audio_to_video: Produce a video from an audio input plus an OPTIONAL still image overlay. Multi-input role-based with the first OPTIONAL role on the contract (`role: base` audio required, `role: overlay` image 0..1 — see `per_role_cardinality`). When overlay is omitted, the video uses a solid background colour. `availability: planned` — WITHDRAWN 2026-09-15: measured 0.300 s of encode per second of output PLUS A 7 s FIXED COST, so the advertised PT2H needs 2167 s against a 900 s platform maximum (0.300 x 7200 alone is 2160 — the intercept is what makes the figure 2167, and a consumer dividing 600 by 0.300 gets a 2000 s in-flight boundary where the real one is 1976 s). Returns `feature_not_available` (422) at workflow-create. An already-accepted workflow is not cancelled (availability is checked at create) and fails only when its output duration exceeds ~1976 s ON THE INPUT THE RATE WAS MEASURED WITH (a real photographic 1080p still plus looped real audio), where 0.300 s per second plus a 7 s fixed cost reaches the worker's 600 s cap — the 60 s and 120 s measured cells both COMPLETED. The driver is the STILL'S RESOLUTION, not duration alone: a 4K still is roughly 4x the rate (unmeasured), which would put the boundary near a quarter of that, and this schema places no constraint on the overlay's resolution. Per ticket [`SlluxMBN`](https://trello.com/c/SlluxMBN) + ADR-0015 (introduces `per_role_cardinality` vocab).
-        - video_watermark: Apply an image overlay onto a base video via FFmpeg's `overlay` filter. Multi-input role-based (`role: base` video + `role: overlay` image, exactly one of each per `per_role_cardinality`). Re-encode required; audio stream-copy passthrough. Distinct from `image_watermark` (pure-Rust/image-only). `availability: planned` — WITHDRAWN 2026-09-15, operation AND `short_form`: a real 1080p source at the advertised PT5M / 500 MB was killed at 606 s by the worker's 600 s encode cap, no output. Returns `feature_not_available` (422) at workflow-create; an already-accepted workflow is not cancelled and fails only if it exceeds that cap; the 606 s kill is ONE measured point and nothing measured says where the boundary is. `long_form` and `multi_overlay_stack` were already `planned`. Per ticket [`4NrRPCgh`](https://trello.com/c/4NrRPCgh) + ADR-0013.
-        - video_text_watermark: Render a text overlay onto a base video via FFmpeg's `drawtext` filter. Single-input — text and styling in options. Same `watermark_mode` (single/tiled), anchor + margin vocab as `text_watermark`. Re-encode required; audio stream-copy passthrough. `availability: planned` — WITHDRAWN 2026-09-15, operation AND `short_form`: a real 1080p source at the advertised PT5M was killed at 604 s by the worker's 600 s encode cap. Returns `feature_not_available` (422) at workflow-create. ⚠️ This entry previously read "until Lambda ships", which was wrong in a way that mattered: the worker SHIPPED and runs — it is the CEILING that cannot be served. Per ticket [`4NrRPCgh`](https://trello.com/c/4NrRPCgh) + ADR-0013.
+        - audio_to_video: Produce a video from an audio input plus an OPTIONAL still image overlay. Multi-input role-based with the first OPTIONAL role on the contract (`role: base` audio required, `role: overlay` image 0..1 — see `per_role_cardinality`). When overlay is omitted, the video uses a solid background colour. `availability: planned` — WITHDRAWN 2026-09-15: the measured encode cost (a per-second rate PLUS A FIXED COST) puts the advertised PT2H at more than twice the 900 s platform maximum (dropping the fixed cost moves the in-flight boundary by tens of seconds; figures in the CHANGELOG entry for 2.203.0, derived and tested from the divergence register). Returns `feature_not_available` (422) at workflow-create. An already-accepted workflow is not cancelled (availability is checked at create) and fails only when its output duration exceeds the derived ceiling (divergence register `evidence.derived.ceiling_s`) ON THE INPUT THE RATE WAS MEASURED WITH (a real photographic 1080p still plus looped real audio), where the measured rate plus the fixed cost reaches the worker's 600 s cap — the 60 s and 120 s measured cells both COMPLETED. The driver is the STILL'S RESOLUTION, not duration alone: a 4K still is roughly 4x the rate (unmeasured), which would put the boundary near a quarter of that, and this schema places no constraint on the overlay's resolution. Per ticket [`SlluxMBN`](https://trello.com/c/SlluxMBN) + ADR-0015 (introduces `per_role_cardinality` vocab).
+        - video_watermark: Apply an image overlay onto a base video via FFmpeg's `overlay` filter. Multi-input role-based (`role: base` video + `role: overlay` image, exactly one of each per `per_role_cardinality`). Re-encode required; audio stream-copy passthrough. Distinct from `image_watermark` (pure-Rust/image-only). `availability: planned` — WITHDRAWN 2026-09-15, operation AND `short_form`: a real 1080p source at the advertised PT5M / 500 MB was killed just past the worker's 600 s encode cap, no output. Returns `feature_not_available` (422) at workflow-create; an already-accepted workflow is not cancelled and fails only if it exceeds that cap; the kill is ONE measured point and nothing measured says where the boundary is. `long_form` and `multi_overlay_stack` were already `planned`. Per ticket [`4NrRPCgh`](https://trello.com/c/4NrRPCgh) + ADR-0013.
+        - video_text_watermark: Render a text overlay onto a base video via FFmpeg's `drawtext` filter. Single-input — text and styling in options. Same `watermark_mode` (single/tiled), anchor + margin vocab as `text_watermark`. Re-encode required; audio stream-copy passthrough. `availability: planned` — WITHDRAWN 2026-09-15, operation AND `short_form`: a real 1080p source at the advertised PT5M was killed just past the worker's 600 s encode cap. Returns `feature_not_available` (422) at workflow-create. ⚠️ This entry previously read "until Lambda ships", which was wrong in a way that mattered: the worker SHIPPED and runs — it is the CEILING that cannot be served. Per ticket [`4NrRPCgh`](https://trello.com/c/4NrRPCgh) + ADR-0013.
         - split: Fan one input file into N outputs across GIF / PDF / audio / video MIME families. Single-input per-mime-group catalog (mirrors merge/convert): GIF uses `frame_range` (REQUIRED) + `output_format`; PDF uses `page_range` OR `page_groups` (mutually exclusive); audio + video use a `mode` discriminator (interval/count/cut_points) + numeric-seconds wire format + `precision` flag (fast/exact). 200-output hard cap per ADR-0009 §D5 with per-mode preflight math; output naming `output-001..output-200`. Long-form video routes to a separate `split-video-fargate` worker via `processing_class`. `availability: beta` for the `audio` and `video` mime_groups (workers live on staging — shape-stable + opt-in, MUST NOT 422); video activates BOTH classes (`video.processing_class.short_form: beta` AND `long_form: beta` — `split-video-fargate` deployed + wired on staging; it stays `beta` until a PRODUCTION `customer_path` run is recorded in `availability/prod-verification-log.yaml` per [`rcwvUKhI`](https://trello.com/c/rcwvUKhI)). The `image_gif` and `document_pdf` mime_groups stay `availability: planned` and dispatch returns `feature_not_available` (422) until their workers ship. Per ticket [`vKI0CFDu`](https://trello.com/c/vKI0CFDu) + ADR-0014.
         - passthrough: Inert lossless source operation. A single-input source job whose SOLE operation is `passthrough` emits its source bytes UNCHANGED — no compression, no Lambda. The API self-completes the job at publish (terminal output = the upload `{bucket, key}` unchanged). Its purpose is to feed an uploaded file into a multi-input operation LOSSLESSLY: because `JobInputV2.source` is narrowed to exclude upload-direct, an upload that must enter a `merge` / `archive` / `image_watermark` op enters via a `passthrough` source job referenced downstream by `{type: job_output, from: <id>}` — preserving billing / DAG / lineage. Distinct from `operations: []` (which keeps its implicit-compress meaning on a single-input upload job); `passthrough` is the EXPLICIT lossless path via the "non-empty `operations[]` without `compress` = compression opt-out" rule. Media-agnostic; no options. `availability: beta` — activated (the inputs[]-narrowing + passthrough self-complete mechanism is deployed API-side); workflow-create accepts `passthrough` source jobs and MUST NOT return `feature_not_available`. **Never published to SNS** — deliberately absent from the AsyncAPI routing enums (API self-completes; no `ops-passthrough` queue). Per ticket [`4som89Uh`](https://trello.com/c/4som89Uh) + ADR-0004 (planned→beta flip).
 
@@ -16147,6 +16146,8 @@ components:
             [I3](https://trello.com/c/eCWIpug8); that roadmap is
             closed. See `schemas/FORMAT.md`
             §`per_mime_availability`.
+        ceiling_basis:
+          $ref: '#/components/schemas/CeilingBasis'
         max_input_size_bytes:
           type: integer
           format: int64
@@ -16565,6 +16566,8 @@ components:
                 must share until the heterogeneous re-encode ships; plus
                 `field_presence`: a video/audio stream field present on one
                 input and absent on another.
+        ceiling_basis:
+          $ref: '#/components/schemas/CeilingBasis'
         resolution_bands:
           type: object
           description: |
@@ -16614,6 +16617,33 @@ components:
           additionalProperties:
             $ref: '#/components/schemas/ProcessingClassConstraints'
 
+    CeilingBasis:
+      type: object
+      description: |
+        Whether each declared INPUT ceiling beside it is PROVEN (owner
+        decision 607(d), 2026-09-26: advertise only limits we have proven).
+        Keys name the ceilings declared on the same object:
+        `max_input_size_bytes`, `max_input_duration`,
+        `max_total_input_size_bytes`, `max_total_duration`, and for a
+        processing class also `per_tier.<tier>.<key>` for each
+        `per_tier_constraints` override. CI requires an entry for EVERY
+        declared ceiling (`scripts/check-ceiling-basis.py`).
+
+        - `proven`: a recorded run passed at 95% or more of the declared value
+          on every axis the object declares (FORMAT.md §`ceiling_basis`).
+        - `unproven`: not yet. The value is still what the API enforces, but
+          no run at it has been recorded; a consumer SHOULD present it as
+          "up to X (not yet verified)". Each becomes `proven`, or is
+          lowered to the largest passing value, after its staging corner run.
+      additionalProperties:
+        type: string
+        # CLOSED: a consumer decides how to present the limit from it.
+        x-enum-openness: closed
+        enum: [proven, unproven]
+      example:
+        max_input_size_bytes: unproven
+        max_input_duration: unproven
+
     ResolutionBand:
       type: string
       description: |
@@ -16672,12 +16702,22 @@ components:
           else:
             not:
               required: [derivation]
+        - if:
+            properties: {basis: {const: proven}}
+          then:
+            required: [source]
+          else:
+            not:
+              required: [source]
       properties:
         basis:
           type: string
           description: |
             - `measured`: the ceiling is derived from measured encode time;
               `derivation` carries the line it was solved from.
+            - `proven`: the LONGEST MEASURED SUCCESS at this resolution, with
+              no fitted line; `source` names the record. Owner decision
+              607(d): advertise only limits that have been proven.
             - `ruled`: a policy value, not a measurement (today: the
               `unknown` band, which takes the `le_720p` ceiling).
             - `not_served`: this class does not serve inputs in this band.
@@ -16686,7 +16726,7 @@ components:
               where `long_form` is not available).
           # CLOSED: each value changes what a consumer enforces.
           x-enum-openness: closed
-          enum: [measured, ruled, not_served]
+          enum: [measured, proven, ruled, not_served]
         constraints:
           type: object
           additionalProperties: false
@@ -16697,6 +16737,13 @@ components:
               type: string
               description: ISO-8601 duration; the band's input duration ceiling.
               example: "PT4M35S"
+        source:
+          type: string
+          pattern: '\S'
+          description: |
+            Present only when `basis` is `proven`: the `id` of the run in this
+            repository's `availability/staging-corner-measurements.yaml` that
+            passed at this band's value.
         derivation:
           type: object
           additionalProperties: false

package/operation-capabilities/operation-capabilities.json

@@ -860,5 +860,5 @@
       "isAnimated": "maybe"
     }
   },
-  "schema_version": "2.214.0"
+  "schema_version": "2.216.0"
 }

package/operations/schemas/audio_overlay.yaml

@@ -88,6 +88,9 @@ operation:
         # Lambda activation.
         short_form:
           availability: planned
+          ceiling_basis:   # 607(d): proven at the declared value, or not yet (FORMAT.md §ceiling_basis)
+            max_input_size_bytes: unproven
+            max_input_duration: unproven
           constraints:
             max_input_duration: "PT5M"
             max_input_size_bytes: 524288000
@@ -96,6 +99,11 @@ operation:
           # Stays planned (CON-1 flips only compress.video.long_form +
           # merge.video.long_form_re_encode). Per-tier caps per ADR-0011.
           availability: planned
+          ceiling_basis:   # 607(d): proven at the declared value, or not yet (FORMAT.md §ceiling_basis)
+            max_input_size_bytes: unproven
+            max_input_duration: unproven
+            per_tier.max.max_input_size_bytes: unproven
+            per_tier.enterprise.max_input_size_bytes: unproven
           constraints:                            # baseline = every tier without a per_tier_constraints override
             max_input_duration: "PT12H"
             max_input_size_bytes: 5000000000       # 5 GB (Pro)
@@ -273,6 +281,9 @@ operation:
         # at the group level.
         short_form:
           availability: planned
+          ceiling_basis:   # 607(d): proven at the declared value, or not yet (FORMAT.md §ceiling_basis)
+            max_input_size_bytes: unproven
+            max_input_duration: unproven
           constraints:
             max_input_duration: "PT5M"
             max_input_size_bytes: 524288000
@@ -281,6 +292,11 @@ operation:
           # Stays planned (CON-1 flips only compress.video.long_form +
           # merge.video.long_form_re_encode). Per-tier caps per ADR-0011.
           availability: planned
+          ceiling_basis:   # 607(d): proven at the declared value, or not yet (FORMAT.md §ceiling_basis)
+            max_input_size_bytes: unproven
+            max_input_duration: unproven
+            per_tier.max.max_input_size_bytes: unproven
+            per_tier.enterprise.max_input_size_bytes: unproven
           constraints:                            # baseline = every tier without a per_tier_constraints override
             max_input_duration: "PT12H"
             max_input_size_bytes: 5000000000       # 5 GB (Pro)

package/operations/schemas/audio_to_video.yaml

@@ -26,20 +26,21 @@ operation:
     A lower framerate plus still-image tuning keeps file size tiny
     when the overlay is a still image (the common case).
 
-    `availability: planned` — withdrawn 2026-09-15. Measured encode cost is
-    0.300 s per second of output PLUS A 7 s FIXED COST, so the advertised PT2H
-    needs 2167 s against a 900 s platform maximum. ⚠️ The 7 s is not a rounding
-    detail: 0.300 x 7200 alone is 2160, and a consumer dividing 600 by 0.300
-    derives a 2000 s in-flight boundary where the real one is ~1976 s. Workflow-create returns `feature_not_available` (422).
+    `availability: planned` — withdrawn 2026-09-15. The measured encode cost
+    (a per-second rate PLUS A FIXED COST) puts the advertised PT2H at more than
+    twice the 900 s Lambda platform maximum. ⚠️ The fixed cost is not a rounding
+    detail: dropping it moves the in-flight boundary by tens of seconds. The
+    figures are in the CHANGELOG entry for 2.203.0, derived and tested from the
+    divergence register (6gdvD3yZ). Workflow-create returns `feature_not_available` (422).
 
     ⚠️ An already-accepted workflow is NOT cancelled — availability is checked at
     create — and it is NOT thereby doomed. ⛔ DO NOT READ THIS AS "in-flight work
     fails": the 60 s and 120 s cells behind this withdrawal both COMPLETED WITH
     OUTPUT, which is precisely why the evidence is arithmetic rather than a kill.
-    What fails is an accepted workflow whose OUTPUT DURATION exceeds ~1976 s
+    What fails is an accepted workflow whose OUTPUT DURATION exceeds the derived ceiling (`evidence.derived.ceiling_s` in the register)
     ⚠️ ON THE INPUT THE RATE WAS MEASURED WITH — a real photographic 1080p STILL
-    plus looped real audio — the point at which 0.300 s/s plus the 7 s fixed cost
-    reaches the 600 s cap. ⛔ THE DRIVER IS THE STILL'S RESOLUTION, NOT THE
+    plus looped real audio — the point at which the measured rate plus the fixed
+    cost reaches the 600 s cap. ⛔ THE DRIVER IS THE STILL'S RESOLUTION, NOT THE
     DURATION ALONE: a 4K still is roughly 4x the rate (recorded as UNMEASURED),
     which would put the boundary near a quarter of that figure, and this schema
     places NO constraint on the overlay's resolution. Other still resolutions and
@@ -84,6 +85,8 @@ operation:
         - audio/opus
         - audio/mp4
         - audio/x-m4a
+      ceiling_basis:   # 607(d): proven at the declared value, or not yet (FORMAT.md §ceiling_basis)
+        max_input_duration: unproven
       max_input_duration: "PT2H"   # 2h input ceiling (KzrquIX7; mirrors worker MAX_AUDIO_DURATION_SECS 7200, strict >)
       options:
         output_resolution:

package/operations/schemas/audio_watermark.yaml

@@ -52,6 +52,9 @@ operation:
         # for max / enterprise (ADR-0011).
         short_form:
           availability: planned
+          ceiling_basis:   # 607(d): proven at the declared value, or not yet (FORMAT.md §ceiling_basis)
+            max_input_size_bytes: unproven
+            max_input_duration: unproven
           constraints:
             max_input_duration: "PT5M"
             max_input_size_bytes: 524288000
@@ -61,6 +64,11 @@ operation:
           # merge.video.long_form_re_encode). Caps mirror compress.video.long_form
           # now that no tier gate makes the Enterprise cap the baseline.
           availability: planned
+          ceiling_basis:   # 607(d): proven at the declared value, or not yet (FORMAT.md §ceiling_basis)
+            max_input_size_bytes: unproven
+            max_input_duration: unproven
+            per_tier.max.max_input_size_bytes: unproven
+            per_tier.enterprise.max_input_size_bytes: unproven
           constraints:                            # baseline = every tier without a per_tier_constraints override
             max_input_duration: "PT12H"
             max_input_size_bytes: 5000000000       # 5 GB
@@ -150,6 +158,9 @@ operation:
         # F8 long-form tier (per ticket I15-CONS).
         short_form:
           availability: planned
+          ceiling_basis:   # 607(d): proven at the declared value, or not yet (FORMAT.md §ceiling_basis)
+            max_input_size_bytes: unproven
+            max_input_duration: unproven
           constraints:
             max_input_duration: "PT5M"
             max_input_size_bytes: 524288000
@@ -159,6 +170,11 @@ operation:
           # merge.video.long_form_re_encode). Caps mirror compress.video.long_form
           # now that no tier gate makes the Enterprise cap the baseline.
           availability: planned
+          ceiling_basis:   # 607(d): proven at the declared value, or not yet (FORMAT.md §ceiling_basis)
+            max_input_size_bytes: unproven
+            max_input_duration: unproven
+            per_tier.max.max_input_size_bytes: unproven
+            per_tier.enterprise.max_input_size_bytes: unproven
           constraints:                            # baseline = every tier without a per_tier_constraints override
             max_input_duration: "PT12H"
             max_input_size_bytes: 5000000000       # 5 GB

package/operations/schemas/compress.yaml

@@ -97,6 +97,8 @@ operation:
       # Resize-inside-Output shares the convert resize engine's 16MP output-area
       # wall — the per-axis 16384 cap can't express it (FORMAT.md §max_output_pixels).
       max_output_pixels: 16000000
+      ceiling_basis:   # 607(d): proven at the declared value, or not yet (FORMAT.md §ceiling_basis)
+        max_input_size_bytes: unproven
       max_input_size_bytes: 524288000   # 500 MiB compress input ceiling (uKsFzORi)
       options:
         quality:
@@ -277,6 +279,8 @@ operation:
       mimes:
         - image/png
       max_output_pixels: 16000000
+      ceiling_basis:   # 607(d): proven at the declared value, or not yet (FORMAT.md §ceiling_basis)
+        max_input_size_bytes: unproven
       max_input_size_bytes: 524288000   # 500 MiB compress input ceiling (uKsFzORi)
       options:
         # PROVENANCE (author-side, NOT user-facing — kept out of the description per
@@ -432,6 +436,8 @@ operation:
       mimes:
         - image/avif
       max_output_pixels: 16000000
+      ceiling_basis:   # 607(d): proven at the declared value, or not yet (FORMAT.md §ceiling_basis)
+        max_input_size_bytes: unproven
       max_input_size_bytes: 20971520   # 20 MiB compress input ceiling (uKsFzORi; AVIF decode OOM guard, worker AVIF_MAX_MB)
       options:
         quality:
@@ -600,6 +606,8 @@ operation:
       mimes:
         - image/webp
       max_output_pixels: 16000000
+      ceiling_basis:   # 607(d): proven at the declared value, or not yet (FORMAT.md §ceiling_basis)
+        max_input_size_bytes: unproven
       max_input_size_bytes: 524288000   # 500 MiB compress input ceiling (uKsFzORi)
       options:
         quality:
@@ -824,6 +832,8 @@ operation:
       # PRE-EXISTING, not introduced by the 2026-07-21 restore: the same 500 MiB
       # applied while this route was stable before 2026-07-17. Recorded rather
       # than silently carried.
+      ceiling_basis:   # 607(d): proven at the declared value, or not yet (FORMAT.md §ceiling_basis)
+        max_input_size_bytes: unproven
       max_input_size_bytes: 524288000   # 500 MiB compress input ceiling (uKsFzORi; image/* default)
       options:
         # No `quality`: compress SVG is SVG->SVG via SVGO (VISUALLY PRESERVING
@@ -885,6 +895,8 @@ operation:
         - image/gif
         - image/tiff
       max_output_pixels: 16000000
+      ceiling_basis:   # 607(d): proven at the declared value, or not yet (FORMAT.md §ceiling_basis)
+        max_input_size_bytes: unproven
       max_input_size_bytes: 524288000   # 500 MiB compress input ceiling (uKsFzORi)
       options:
         quality:
@@ -1095,6 +1107,12 @@ operation:
         # server-decided per plan v5 §F8 round 7.
         short_form:
           availability: stable
+          # PROVEN 2026-09-26 (lambdas staging corner run, git-2166848; vm_shared 10_Now/lambdas-corner-video-results-2026-09-26.md):
+          # 300 s / ~480 MB passed at 360p, 720p, 1080p and 4K; at 4K one step past BOTH axes (360 s / 575,743,715 B) passed.
+          # Caveat: 4K ran 446-529 s against the worker's 600 s encode cap on synthetic content; thin margin.
+          ceiling_basis:   # 607(d): proven at the declared value, or not yet (FORMAT.md §ceiling_basis)
+            max_input_size_bytes: proven
+            max_input_duration: proven
           constraints:
             max_input_duration: "PT5M"
             max_input_size_bytes: 524288000        # 500 MiB
@@ -1119,6 +1137,11 @@ operation:
           # (`limits.max_upload_size_bytes`) still refuses first — that is the
           # quota, and it is a separate, request-level limit.
           availability: stable
+          ceiling_basis:   # 607(d): proven at the declared value, or not yet (FORMAT.md §ceiling_basis)
+            max_input_size_bytes: unproven
+            max_input_duration: unproven
+            per_tier.max.max_input_size_bytes: unproven
+            per_tier.enterprise.max_input_size_bytes: unproven
           constraints:                            # baseline = every tier without a per_tier_constraints override
             max_input_duration: "PT12H"
             max_input_size_bytes: 5000000000       # 5 GB (Pro)
@@ -1468,6 +1491,10 @@ operation:
       # MAX_IMAGE_ENTRY_SIZE 50 MB, MAX_ZIP_ENTRIES 10,000,
       # MAX_CUMULATIVE_IMAGE_BYTES 500 MB bound what a document expands INTO;
       # this bounds what we ACCEPT.
+      # PROVEN 2026-09-26: lambdas staging corner run (git-2166848), within 1-2% of the ceiling;
+      # one step past is refused by the worker. vm_shared 10_Now/lambdas-corner-doc-results-2026-09-26.md
+      ceiling_basis:   # 607(d): proven at the declared value, or not yet (FORMAT.md §ceiling_basis)
+        max_input_size_bytes: proven
       max_input_size_bytes: 209715200
       # See the document_pdf honesty note: the worker reads ONLY `quality` today;
       # the per-format options are `planned` (advertised-ahead, FE-hidden).
@@ -1519,6 +1546,10 @@ operation:
       # MAX_IMAGE_ENTRY_SIZE 50 MB, MAX_ZIP_ENTRIES 10,000,
       # MAX_CUMULATIVE_IMAGE_BYTES 500 MB bound what a document expands INTO;
       # this bounds what we ACCEPT.
+      # PROVEN 2026-09-26: lambdas staging corner run (git-2166848), within 1-2% of the ceiling;
+      # one step past is refused by the worker. vm_shared 10_Now/lambdas-corner-doc-results-2026-09-26.md
+      ceiling_basis:   # 607(d): proven at the declared value, or not yet (FORMAT.md §ceiling_basis)
+        max_input_size_bytes: proven
       max_input_size_bytes: 209715200
       # See the document_pdf honesty note: worker reads ONLY `quality`; the rest `planned`.
       options:
@@ -1563,6 +1594,10 @@ operation:
       # MAX_IMAGE_ENTRY_SIZE 50 MB, MAX_ZIP_ENTRIES 10,000,
       # MAX_CUMULATIVE_IMAGE_BYTES 500 MB bound what a document expands INTO;
       # this bounds what we ACCEPT.
+      # PROVEN 2026-09-26: lambdas staging corner run (git-2166848), within 1-2% of the ceiling;
+      # one step past is refused by the worker. vm_shared 10_Now/lambdas-corner-doc-results-2026-09-26.md
+      ceiling_basis:   # 607(d): proven at the declared value, or not yet (FORMAT.md §ceiling_basis)
+        max_input_size_bytes: proven
       max_input_size_bytes: 209715200
       # See the document_pdf honesty note: worker reads ONLY `quality`; the rest `planned`.
       options:

package/operations/schemas/convert.yaml

@@ -298,15 +298,51 @@ operation:
         # F8 long-form video tier (per ticket I15-CONS).
         short_form:
           availability: stable
+          ceiling_basis:   # 607(d): proven at the declared value, or not yet (FORMAT.md §ceiling_basis)
+            max_input_size_bytes: unproven
+            max_input_duration: unproven
           constraints:
             max_input_duration: "PT5M"
             max_input_size_bytes: 524288000
             max_output_size_bytes: 524288000
+          # PROVEN resolution bands (owner decision 607(d), 2026-09-26: advertise
+          # only limits we have proven). Each ceiling is the LONGEST SUCCESSFUL run
+          # lambdas measured at that resolution (9c5mOnq1, staging `$LATEST`,
+          # 2026-09-18, mp4 -> webm real VP9 re-encode, billed seconds from each
+          # invocation's REPORT line). No fitted model: lambdas' two-parameter fit
+          # failed its own prediction, so none is shipped. The class PT5M above is
+          # NOT proven at 720p or 1080p; the bands are what binds. le_720p is sized
+          # for 720p (a 360p run of 295 s also succeeded; a finer band would need
+          # a new band in schemas/resolution-bands.yaml). Every 4K attempt
+          # exceeded the cap, so gt_1080p is not served. `unknown` is ruled =
+          # le_720p (decision 343 precedent).
+          resolution_bands:
+            le_720p:
+              basis: proven
+              source: 9c5mOnq1-720p-145s   # availability/staging-corner-measurements.yaml
+              constraints:
+                max_input_duration: "PT2M25S"
+            p1080:
+              basis: proven
+              source: 9c5mOnq1-1080p-80s   # availability/staging-corner-measurements.yaml
+              constraints:
+                max_input_duration: "PT1M20S"
+            gt_1080p:
+              basis: not_served
+            unknown:
+              basis: ruled
+              constraints:
+                max_input_duration: "PT2M25S"
         long_form:
           # Stays planned (CON-1 flips only compress.video.long_form +
           # merge.video.long_form_re_encode). Per-tier caps per ADR-0011 —
           # advertised shape; availability gates execution off (422).
           availability: planned
+          ceiling_basis:   # 607(d): proven at the declared value, or not yet (FORMAT.md §ceiling_basis)
+            max_input_size_bytes: unproven
+            max_input_duration: unproven
+            per_tier.max.max_input_size_bytes: unproven
+            per_tier.enterprise.max_input_size_bytes: unproven
           constraints:                            # baseline = every tier without a per_tier_constraints override
             max_input_duration: "PT12H"
             max_input_size_bytes: 5000000000       # 5 GB (Pro)

package/operations/schemas/custom_luma.yaml

@@ -58,6 +58,9 @@ operation:
         # ships.
         short_form:
           availability: planned
+          ceiling_basis:   # 607(d): proven at the declared value, or not yet (FORMAT.md §ceiling_basis)
+            max_input_size_bytes: unproven
+            max_input_duration: unproven
           constraints:
             max_input_duration: "PT5M"
             max_input_size_bytes: 524288000
@@ -67,6 +70,11 @@ operation:
           # merge.video.long_form_re_encode). Per-tier caps per ADR-0011 —
           # advertised shape; availability gates execution off (422).
           availability: planned
+          ceiling_basis:   # 607(d): proven at the declared value, or not yet (FORMAT.md §ceiling_basis)
+            max_input_size_bytes: unproven
+            max_input_duration: unproven
+            per_tier.max.max_input_size_bytes: unproven
+            per_tier.enterprise.max_input_size_bytes: unproven
           constraints:                            # baseline = every tier without a per_tier_constraints override
             max_input_duration: "PT12H"
             max_input_size_bytes: 5000000000       # 5 GB (Pro)

package/operations/schemas/merge.yaml

@@ -184,9 +184,24 @@ operation:
         # two-trigger state — corrected here.
         short_form_concat:
           availability: stable
+          # 607(d), owner decision 2026-09-26 ('yes to both'): the served ceiling is
+          # the STREAM-COPY one, 500 MiB / PT5M total, PROVEN by lambdas' corner run
+          # (300 s / 480,884,812 B in 12 s, normalize_audio: false, 720p, git-2166848).
+          # PROVEN on BOTH axes at the exact corner: 2 x 262,144,000 B = 524,288,000 B /
+          # 300.000 s, normalize_audio false, stream copy, 14.0 s billed (lambdas,
+          # staging git-2166848, 2026-09-26). The boundary is safe by code: stream
+          # copy is refused only when the SUM is strictly greater than 500 MiB.
+          # It was 1 GiB, which is NOT servable: above 500 MiB total the worker
+          # re-encodes, and a 300 s 720p re-encode exceeds merge's 720 s cap
+          # (processing_limit_exceeded). So `normalize_audio` now defaults to FALSE
+          # (below), and turning it on lowers the limit (120 s / 193,711,902 B at 720p
+          # measured with it on). lambdas card: make the re-encode path fit the cap.
+          ceiling_basis:   # 607(d): proven at the declared value, or not yet (FORMAT.md §ceiling_basis)
+            max_total_input_size_bytes: proven
+            max_total_duration: proven
           constraints:
             max_total_duration: "PT5M"
-            max_total_input_size_bytes: 1073741824   # 1 GiB combined
+            max_total_input_size_bytes: 524288000    # 500 MiB combined (the stream-copy ceiling; was 1 GiB)
         long_form_re_encode:
           # planned -> beta (CON-1, ADR-0011) -> stable (CON-2b, HWNXo1kk):
           # staging-proven 2026-07-07 via long-form-merge.spec.ts Phase 2
@@ -224,6 +239,11 @@ operation:
               # Not a stream kind: a video/audio stream FIELD present on one
               # input and absent on another (lambdas' input_metadata_inconsistent).
               field_presence: [input_metadata_inconsistent]
+          ceiling_basis:   # 607(d): proven at the declared value, or not yet (FORMAT.md §ceiling_basis)
+            max_total_input_size_bytes: unproven
+            max_total_duration: unproven
+            per_tier.max.max_total_input_size_bytes: unproven
+            per_tier.enterprise.max_total_input_size_bytes: unproven
           constraints:                              # baseline = every tier without a per_tier_constraints override
             max_total_duration: "PT24H"              # 24h (was PT12H) — binding Enterprise ceiling
             max_total_input_size_bytes: 5000000000   # 5 GB combined (Pro)
@@ -298,7 +318,13 @@ operation:
           description: "Crossfade duration in seconds"
         normalize_audio:
           type: boolean
-          default: true
+          # DEFAULT FALSE since 2026-09-26 (owner decision, 607(d)): with it on,
+          # every video merge re-encodes, and the re-encode does not fit the
+          # short_form ceiling. THE API APPLIES THIS DEFAULT: when a request omits
+          # the option, api writes `normalize_audio: false` into the worker
+          # message (ruled for api, 2026-09-26), so the outcome never depends on
+          # the worker's own absent-default (which lambdas also flip, UceDvESv).
+          default: false
           # 🔴 UNAVAILABLE ON LONG-FORM — and this one needed a RULING, not a
           # mechanical marking. Long-form FORCES loudnorm off, so:
           #   accepting the default `true` is a SILENT NO-OP — the caller asked
@@ -316,9 +342,12 @@ operation:
           per_class_availability:
             long_form_re_encode: { availability: planned }
           description: >-
-            Normalize audio levels across all clips. NOT available on the
-            long-form path, which forces loudness normalisation off — a defaulted
-            value is dropped and reported there rather than silently ignored.
+            Normalize audio levels across all clips. Off by default (the server
+            applies the default when the option is omitted). Turning it
+            on re-encodes every clip, which lowers the limit: about 120 seconds
+            of combined 720p video was measured to fit, instead of 5 minutes.
+            NOT available on the long-form path, which forces loudness
+            normalisation off.
 
         re_encode_mode:
           type: enum

package/operations/schemas/split.yaml

@@ -502,6 +502,9 @@ operation:
       processing_class:
         short_form:
           availability: beta
+          ceiling_basis:   # 607(d): proven at the declared value, or not yet (FORMAT.md §ceiling_basis)
+            max_input_size_bytes: unproven
+            max_input_duration: unproven
           constraints:
             max_input_duration: "PT5M"
             max_input_size_bytes: 524288000
@@ -516,6 +519,11 @@ operation:
           # Routes per ADR-0014 §D10 — same split OperationType, dedicated
           # stream-copy segmenter binary (NOT the long-form compress worker).
           availability: beta
+          ceiling_basis:   # 607(d): proven at the declared value, or not yet (FORMAT.md §ceiling_basis)
+            max_input_size_bytes: unproven
+            max_input_duration: unproven
+            per_tier.max.max_input_size_bytes: unproven
+            per_tier.enterprise.max_input_size_bytes: unproven
           constraints:                            # baseline = every tier without a per_tier_constraints override
             max_input_duration: "PT12H"
             max_input_size_bytes: 5000000000       # 5 GB (Pro)