@giveitsmaller/contracts 0.80.0 → 0.82.0

package/openapi/api.yaml

@@ -103,7 +103,7 @@ info:
     of truth instead of hardcoding magic numbers. A runtime
     `GET /api/uploads/limits` endpoint for dynamic discovery
     (per-tier / per-environment overrides) is a deferred follow-up.
-  version: 2.215.0
+  version: 2.217.0
   contact:
     name: API Support
 
@@ -255,13 +255,34 @@ paths:
                     required_tier: "enterprise"
         '413':
           description: |
-            The upload is too large. Two rejection cases, discriminated by the
-            `ErrorEnvelope.error` code:
-
-            - **Byte size** — the file exceeds the absolute maximum upload size
-              (across all tiers). For tier-specific size caps below this
-              absolute limit, the server returns 403 with `error_type:
-              tier_restriction, restriction_kind: file_size` instead.
+            The upload is too large. Two rejection cases from the API,
+            discriminated by the `ErrorEnvelope.error` code, plus one from the
+            edge:
+
+            - **Edge (no envelope)** — a request whose whole `multipart/form-data`
+              BODY exceeds the API gateway's payload limit is refused by the
+              gateway before the API runs, as a 413 with no `ErrorEnvelope`.
+              Near the single-shot maximum the form encoding can push the body
+              past that limit, so a client MUST treat ANY 413 on this endpoint
+              as "too large", with or without an envelope. An authenticated
+              client SHOULD send files near `single_shot_max_bytes` through
+              multipart; a guest cannot (multipart requires an account, see
+              `schemas/anonymous-policy.yaml`) and is limited to the single-shot
+              maximum. Only the two API-generated cases below carry an
+              `ErrorEnvelope`.
+
+            - **Byte size** (`error: FILE_TOO_LARGE`, `error_type:
+              file_too_large`, `message_params.max_bytes` = the limit that was
+              exceeded) — the file exceeds this endpoint's maximum byte size
+              (the single-shot maximum; larger files use the multipart
+              endpoints). For tier-specific size caps below it, the server
+              returns 403 with `error_type: tier_restriction,
+              restriction_kind: file_size` instead. ⚠️ The API currently
+              answers this case with `400 BAD_REQUEST`, which also covers a
+              missing file or an invalid filename (api card `E8xFECmG` moves
+              the size case here). Until that ships, only a client that
+              already knows its file exceeds `single_shot_max_bytes` should
+              read that 400 as "too large".
             - **Pixel dimensions** (`error: IMAGE_DIMENSIONS_TOO_LARGE`) — a
               decodable raster image whose `width × height` exceeds the
               SINGLE-SHOT pixel ceiling (`UPLOAD_MAX_IMAGE_PIXELS`, default
@@ -285,10 +306,14 @@ paths:
                 $ref: '#/components/schemas/ErrorEnvelope'
               examples:
                 file_too_large:
-                  summary: File exceeds the absolute maximum byte size
+                  summary: File exceeds this endpoint's maximum byte size
                   value:
                     success: false
-                    error: "File size exceeds maximum allowed (100 GiB)"
+                    error: "FILE_TOO_LARGE"
+                    error_type: "file_too_large"
+                    message: "The file is larger than the maximum for this upload method."
+                    message_params:
+                      max_bytes: 10000000
                 image_dimensions_too_large:
                   summary: Decodable raster exceeds the pixel-dimension ceiling
                   value:
@@ -418,7 +443,7 @@ paths:
 
         After all parts are uploaded to S3, call the complete endpoint to finalise.
       operationId: multipartInitiate
-      security: [{}, {bearerAuth: []}, {sessionAuth: []}]  # optional (anon-tolerant; manifest.userId pinned to caller if authed)
+      security: [{bearerAuth: []}, {sessionAuth: []}]  # REQUIRED: api security.yaml puts multipart behind IS_AUTHENTICATED_FULLY and initiate() 401s a guest (measured 2026-09-26; anonymous-policy.yaml multipart_allowed: false)
       tags:
         - Upload
       requestBody:
@@ -497,9 +522,11 @@ paths:
               and multipart carries ordinary camera photos — **a 24 MP photo
               must pass**. API setting `UPLOAD_MAX_MULTIPART_IMAGE_PIXELS`,
               enforced at multipart initiate. Default 50 MP (hub ruling 2026-09-24, on lambdas'
-              recommendation: the image workers declare a 100 MP source cap,
-              but none has run a job that large, so it stays at half that
-              until a staging proof). It is an API setting, so authenticated
+              recommendation, then made with the workers' per-format decode
+              ceilings unmeasured). Those ceilings are now declared per group
+              as `max_input_pixels` (2026-09-26: PNG 100 MP, JPEG 90 MP,
+              WebP 75 MP), all above this default; see that field for which
+              ceiling binds when. It is an API setting, so authenticated
               clients read the effective value from
               `limits.max_multipart_upload_image_pixels`
               (`GET /api/v2/account/limits`) once the API emits it.
@@ -582,7 +609,7 @@ paths:
         rule and additionally refuse anonymous-initiated sessions
         outright (returning 403 `MULTIPART_SESSION_AUTH_REQUIRED`).
       operationId: multipartComplete
-      security: [{}, {bearerAuth: []}, {sessionAuth: []}]  # optional (anon-tolerant; ownership-scoped per HxUmVr3Y when manifest.userId set)
+      security: [{bearerAuth: []}, {sessionAuth: []}]  # REQUIRED in practice: a session can only be initiated authenticated (see initiate), and completion is ownership-scoped (HxUmVr3Y)
       x-identity-scoped: true  # session/ownership-scoped per ADR-0016 D3
       tags:
         - Upload
@@ -3934,7 +3961,7 @@ paths:
         The original failed operation is marked as `retried` and a new operation with
         a new ID is created in `pending` state.
       operationId: retryOperation
-      security: [{}, {bearerAuth: []}, {sessionAuth: []}]  # optional (anon-OK; identity-scoped to operation owner)
+      security: [{bearerAuth: []}, {sessionAuth: []}]  # REQUIRED: api security.yaml:103 requires IS_AUTHENTICATED_FULLY for retry (sdks, measured 2026-09-26)
       x-identity-scoped: true  # operation-ownership-scoped per ADR-0016 D3
       tags:
         - Operations
@@ -8452,9 +8479,10 @@ components:
               # ceiling (width x height from the header) — the 413
               # IMAGE_DIMENSIONS_TOO_LARGE threshold on the multipart path. A
               # SEPARATE, HIGHER API setting than max_upload_image_pixels:
-              # default 50 MP (hub, 2026-09-24), about half the workers'
-              # declared 100 MP source cap, which is unproven end to end; it
-              # rises only after a 100 MP staging proof. It MUST admit a 24 MP
+              # default 50 MP (hub, 2026-09-24). The workers' decode ceilings
+              # were measured 2026-09-26 and are declared per group as
+              # `max_input_pixels` (PNG 100 MP, JPEG 90 MP, WebP 75 MP), all
+              # above this default. It MUST admit a 24 MP
               # photo. The server serves the number. Not tier-varying today.
               $ref: '#/components/schemas/AccountLimitEntry'
 
@@ -9708,7 +9736,9 @@ components:
       description: |
         403 from `POST /api/workflows` when an ANONYMOUS caller (no
         credential) requests an operation outside the anonymous
-        allow-list. A register-wall: the frontend renders a sign-up
+        allow-list, declared in `schemas/anonymous-policy.yaml`
+        (`operations_allowed`; the file also declares the guest upload and
+        quota limits). A register-wall: the frontend renders a sign-up
         prompt, since no tier upgrade applies to a caller without an
         account.
 
@@ -9716,10 +9746,10 @@ components:
         (`JobsErrorCode::AnonymousOperationNotAllowed`), which checks
         every operation in the body and names the FIRST disallowed one.
 
-        ⚠️ **The allow-list itself is NOT yet declared in this contract**
-        (ticket [`UQ7zROTr`](https://trello.com/c/UQ7zROTr)), so a client
-        can parse this refusal but cannot yet predict it. Do not hard-code
-        the list from this description: it deliberately names none.
+        **Predict it from `schemas/anonymous-policy.yaml`**
+        (`operations_allowed`; ticket [`UQ7zROTr`](https://trello.com/c/UQ7zROTr)),
+        the one declaration of the allow-list. Do not hard-code the list
+        from this description: it deliberately names none.
       allOf:
         - $ref: '#/components/schemas/ErrorEnvelope'
         - type: object
@@ -16146,6 +16176,44 @@ components:
             [I3](https://trello.com/c/eCWIpug8); that roadmap is
             closed. See `schemas/FORMAT.md`
             §`per_mime_availability`.
+        ceiling_basis:
+          $ref: '#/components/schemas/CeilingBasis'
+        max_input_pixels:
+          type: integer
+          format: int64
+          minimum: 1
+          description: |
+            The largest INPUT image, in decoded pixels (width x height), that
+            this group's worker is declared to process (owner decision
+            607(d), 2026-09-26: decode memory, not bytes, binds for raster
+            images). Present only where it was measured.
+
+            WHICH PIXEL CEILING BINDS WHEN. There are three, at three stages:
+            1. UPLOAD, single-shot: `limits.max_upload_image_pixels`
+               (default 16 MP; API setting `UPLOAD_MAX_IMAGE_PIXELS`), 413
+               `IMAGE_DIMENSIONS_TOO_LARGE`.
+            2. UPLOAD, multipart: `limits.max_multipart_upload_image_pixels`
+               (default 50 MP; admits a 24 MP phone photo), same 413.
+            3. OPERATION: this field, the worker's declared decode ceiling. The
+               worker refuses above it (`input_too_large`, header-only, before
+               decoding); the API is to check it at workflow create too (api
+               card, co-land), after which it refuses before any job runs.
+            An uploaded image passes its upload gate first, so it meets
+            `min(upload ceiling, this field)`. Every value declared here is at
+            least 75 MP, above both upload defaults, so today the UPLOAD
+            ceiling binds for uploads, and this field binds for inputs that
+            did not come through an upload gate (another job's output, an
+            import), or if an upload ceiling is raised past it. A 24 MP photo
+            passes all three.
+
+            THE VALUE IS AN UPPER BOUND, NOT A GUARANTEE FOR EVERY IMAGE. Where
+            the worker's real limit is a decode-memory budget, images with more
+            bytes per pixel (alpha, 16-bit channels) hit it at fewer pixels,
+            and the worker refuses them with `input_too_large` (typed, not
+            retryable, before any billed work) below this field. PNG is the
+            measured case: 100 MP is the 8-bit RGBA value; 16-bit RGB reaches
+            the budget near 67 MP and 16-bit RGBA near 50 MP. A pre-flight
+            check against this field therefore cannot promise acceptance.
         max_input_size_bytes:
           type: integer
           format: int64
@@ -16564,6 +16632,8 @@ components:
                 must share until the heterogeneous re-encode ships; plus
                 `field_presence`: a video/audio stream field present on one
                 input and absent on another.
+        ceiling_basis:
+          $ref: '#/components/schemas/CeilingBasis'
         resolution_bands:
           type: object
           description: |
@@ -16613,6 +16683,33 @@ components:
           additionalProperties:
             $ref: '#/components/schemas/ProcessingClassConstraints'
 
+    CeilingBasis:
+      type: object
+      description: |
+        Whether each declared INPUT ceiling beside it is PROVEN (owner
+        decision 607(d), 2026-09-26: advertise only limits we have proven).
+        Keys name the ceilings declared on the same object:
+        `max_input_size_bytes`, `max_input_duration`,
+        `max_total_input_size_bytes`, `max_total_duration`, and for a
+        processing class also `per_tier.<tier>.<key>` for each
+        `per_tier_constraints` override. CI requires an entry for EVERY
+        declared ceiling (`scripts/check-ceiling-basis.py`).
+
+        - `proven`: a recorded run passed at 95% or more of the declared value
+          on every axis the object declares (FORMAT.md §`ceiling_basis`).
+        - `unproven`: not yet. The value is still what the API enforces, but
+          no run at it has been recorded; a consumer SHOULD present it as
+          "up to X (not yet verified)". Each becomes `proven`, or is
+          lowered to the largest passing value, after its staging corner run.
+      additionalProperties:
+        type: string
+        # CLOSED: a consumer decides how to present the limit from it.
+        x-enum-openness: closed
+        enum: [proven, unproven]
+      example:
+        max_input_size_bytes: unproven
+        max_input_duration: unproven
+
     ResolutionBand:
       type: string
       description: |
@@ -16671,12 +16768,22 @@ components:
           else:
             not:
               required: [derivation]
+        - if:
+            properties: {basis: {const: proven}}
+          then:
+            required: [source]
+          else:
+            not:
+              required: [source]
       properties:
         basis:
           type: string
           description: |
             - `measured`: the ceiling is derived from measured encode time;
               `derivation` carries the line it was solved from.
+            - `proven`: the LONGEST MEASURED SUCCESS at this resolution, with
+              no fitted line; `source` names the record. Owner decision
+              607(d): advertise only limits that have been proven.
             - `ruled`: a policy value, not a measurement (today: the
               `unknown` band, which takes the `le_720p` ceiling).
             - `not_served`: this class does not serve inputs in this band.
@@ -16685,7 +16792,7 @@ components:
               where `long_form` is not available).
           # CLOSED: each value changes what a consumer enforces.
           x-enum-openness: closed
-          enum: [measured, ruled, not_served]
+          enum: [measured, proven, ruled, not_served]
         constraints:
           type: object
           additionalProperties: false
@@ -16696,6 +16803,13 @@ components:
               type: string
               description: ISO-8601 duration; the band's input duration ceiling.
               example: "PT4M35S"
+        source:
+          type: string
+          pattern: '\S'
+          description: |
+            Present only when `basis` is `proven`: the `id` of the run in this
+            repository's `availability/staging-corner-measurements.yaml` that
+            passed at this band's value.
         derivation:
           type: object
           additionalProperties: false

package/operation-capabilities/operation-capabilities.json

@@ -860,5 +860,5 @@
       "isAnimated": "maybe"
     }
   },
-  "schema_version": "2.215.0"
+  "schema_version": "2.217.0"
 }

package/operations/schemas/audio_overlay.yaml

@@ -88,6 +88,9 @@ operation:
         # Lambda activation.
         short_form:
           availability: planned
+          ceiling_basis:   # 607(d): proven at the declared value, or not yet (FORMAT.md §ceiling_basis)
+            max_input_size_bytes: unproven
+            max_input_duration: unproven
           constraints:
             max_input_duration: "PT5M"
             max_input_size_bytes: 524288000
@@ -96,6 +99,11 @@ operation:
           # Stays planned (CON-1 flips only compress.video.long_form +
           # merge.video.long_form_re_encode). Per-tier caps per ADR-0011.
           availability: planned
+          ceiling_basis:   # 607(d): proven at the declared value, or not yet (FORMAT.md §ceiling_basis)
+            max_input_size_bytes: unproven
+            max_input_duration: unproven
+            per_tier.max.max_input_size_bytes: unproven
+            per_tier.enterprise.max_input_size_bytes: unproven
           constraints:                            # baseline = every tier without a per_tier_constraints override
             max_input_duration: "PT12H"
             max_input_size_bytes: 5000000000       # 5 GB (Pro)
@@ -273,6 +281,9 @@ operation:
         # at the group level.
         short_form:
           availability: planned
+          ceiling_basis:   # 607(d): proven at the declared value, or not yet (FORMAT.md §ceiling_basis)
+            max_input_size_bytes: unproven
+            max_input_duration: unproven
           constraints:
             max_input_duration: "PT5M"
             max_input_size_bytes: 524288000
@@ -281,6 +292,11 @@ operation:
           # Stays planned (CON-1 flips only compress.video.long_form +
           # merge.video.long_form_re_encode). Per-tier caps per ADR-0011.
           availability: planned
+          ceiling_basis:   # 607(d): proven at the declared value, or not yet (FORMAT.md §ceiling_basis)
+            max_input_size_bytes: unproven
+            max_input_duration: unproven
+            per_tier.max.max_input_size_bytes: unproven
+            per_tier.enterprise.max_input_size_bytes: unproven
           constraints:                            # baseline = every tier without a per_tier_constraints override
             max_input_duration: "PT12H"
             max_input_size_bytes: 5000000000       # 5 GB (Pro)

package/operations/schemas/audio_to_video.yaml

@@ -85,6 +85,8 @@ operation:
         - audio/opus
         - audio/mp4
         - audio/x-m4a
+      ceiling_basis:   # 607(d): proven at the declared value, or not yet (FORMAT.md §ceiling_basis)
+        max_input_duration: unproven
       max_input_duration: "PT2H"   # 2h input ceiling (KzrquIX7; mirrors worker MAX_AUDIO_DURATION_SECS 7200, strict >)
       options:
         output_resolution:

package/operations/schemas/audio_watermark.yaml

@@ -52,6 +52,9 @@ operation:
         # for max / enterprise (ADR-0011).
         short_form:
           availability: planned
+          ceiling_basis:   # 607(d): proven at the declared value, or not yet (FORMAT.md §ceiling_basis)
+            max_input_size_bytes: unproven
+            max_input_duration: unproven
           constraints:
             max_input_duration: "PT5M"
             max_input_size_bytes: 524288000
@@ -61,6 +64,11 @@ operation:
           # merge.video.long_form_re_encode). Caps mirror compress.video.long_form
           # now that no tier gate makes the Enterprise cap the baseline.
           availability: planned
+          ceiling_basis:   # 607(d): proven at the declared value, or not yet (FORMAT.md §ceiling_basis)
+            max_input_size_bytes: unproven
+            max_input_duration: unproven
+            per_tier.max.max_input_size_bytes: unproven
+            per_tier.enterprise.max_input_size_bytes: unproven
           constraints:                            # baseline = every tier without a per_tier_constraints override
             max_input_duration: "PT12H"
             max_input_size_bytes: 5000000000       # 5 GB
@@ -150,6 +158,9 @@ operation:
         # F8 long-form tier (per ticket I15-CONS).
         short_form:
           availability: planned
+          ceiling_basis:   # 607(d): proven at the declared value, or not yet (FORMAT.md §ceiling_basis)
+            max_input_size_bytes: unproven
+            max_input_duration: unproven
           constraints:
             max_input_duration: "PT5M"
             max_input_size_bytes: 524288000
@@ -159,6 +170,11 @@ operation:
           # merge.video.long_form_re_encode). Caps mirror compress.video.long_form
           # now that no tier gate makes the Enterprise cap the baseline.
           availability: planned
+          ceiling_basis:   # 607(d): proven at the declared value, or not yet (FORMAT.md §ceiling_basis)
+            max_input_size_bytes: unproven
+            max_input_duration: unproven
+            per_tier.max.max_input_size_bytes: unproven
+            per_tier.enterprise.max_input_size_bytes: unproven
           constraints:                            # baseline = every tier without a per_tier_constraints override
             max_input_duration: "PT12H"
             max_input_size_bytes: 5000000000       # 5 GB

package/operations/schemas/compress.yaml

@@ -97,7 +97,15 @@ operation:
       # Resize-inside-Output shares the convert resize engine's 16MP output-area
       # wall — the per-axis 16384 cap can't express it (FORMAT.md §max_output_pixels).
       max_output_pixels: 16000000
-      max_input_size_bytes: 524288000   # 500 MiB compress input ceiling (uKsFzORi)
+      # 607(d) image-decode corner run (lambdas, staging compression-image v144, git-2166848,
+      # 2026-09-26; vm_shared 10_Now/lambdas-corner-img-results-2026-09-26.md).
+      # Largest passing 370 MB / 90 MP. 493 MB / 120 MP failed: the input plus its
+      # intermediate exceed the worker's 512 MB /tmp.
+      ceiling_basis:   # 607(d): proven at the declared value, or not yet (FORMAT.md §ceiling_basis)
+        max_input_size_bytes: proven
+        max_input_pixels: proven
+      max_input_size_bytes: 370000000   # was 500 MiB
+      max_input_pixels: 90000000
       options:
         quality:
           type: integer
@@ -277,7 +285,20 @@ operation:
       mimes:
         - image/png
       max_output_pixels: 16000000
-      max_input_size_bytes: 524288000   # 500 MiB compress input ceiling (uKsFzORi)
+      # 607(d) image-decode corner run (lambdas, staging compression-image v144, git-2166848,
+      # 2026-09-26; vm_shared 10_Now/lambdas-corner-img-results-2026-09-26.md).
+      # The binding limit is DECODED PIXELS: the shared decoder's 400 MB allocation
+      # budget, so the pixel ceiling depends on colour type (~133 MP RGB8, 100 MP
+      # RGBA8, ~67 MP RGB16, 50 MP RGBA16). 100 MP is the RGBA8 value; RGB8 passed
+      # at 120 MP / 360 MB, and RGBA8 at 100 MP is not yet run, so it stays
+      # unproven. Beyond the budget the worker refuses with input_too_large: a
+      # 16-bit RGBA PNG reaches it at ~50 MP, below this value, and is refused
+      # there (typed, before billing work), not served.
+      ceiling_basis:   # 607(d): proven at the declared value, or not yet (FORMAT.md §ceiling_basis)
+        max_input_size_bytes: proven
+        max_input_pixels: unproven
+      max_input_size_bytes: 360000000   # largest passing (120 MP RGB8); was 500 MiB, unreachable within the decode budget
+      max_input_pixels: 100000000
       options:
         # PROVENANCE (author-side, NOT user-facing — kept out of the description per
         # 7KkNSvdv / FE BhVwdlhQ: no implementation detail or licence copy in user text):
@@ -432,6 +453,9 @@ operation:
       mimes:
         - image/avif
       max_output_pixels: 16000000
+      # 607(d): PROVEN, 19.57 MiB passed (staging v144); above 20 MB the worker refuses.
+      ceiling_basis:   # 607(d): proven at the declared value, or not yet (FORMAT.md §ceiling_basis)
+        max_input_size_bytes: proven
       max_input_size_bytes: 20971520   # 20 MiB compress input ceiling (uKsFzORi; AVIF decode OOM guard, worker AVIF_MAX_MB)
       options:
         quality:
@@ -600,7 +624,16 @@ operation:
       mimes:
         - image/webp
       max_output_pixels: 16000000
-      max_input_size_bytes: 524288000   # 500 MiB compress input ceiling (uKsFzORi)
+      # 607(d) image-decode corner run (lambdas, staging compression-image v144, git-2166848,
+      # 2026-09-26; vm_shared 10_Now/lambdas-corner-img-results-2026-09-26.md).
+      # Passed at 270 MB / 90 MP but at 98% of the function's memory; 120 MP was
+      # OOM-killed (no terminal result). lambdas' header pre-flight (AmYqFGaI)
+      # refuses above 75 MP before any decode, so 75 MP is the declared value.
+      ceiling_basis:   # 607(d): proven at the declared value, or not yet (FORMAT.md §ceiling_basis)
+        max_input_size_bytes: proven
+        max_input_pixels: proven
+      max_input_size_bytes: 270000000   # was 500 MiB
+      max_input_pixels: 75000000
       options:
         quality:
           type: integer
@@ -806,25 +839,25 @@ operation:
       # claiming it.)
       mimes:
         - image/svg+xml
-      # KNOWN OVER-ADVERTISEMENT, DELIBERATELY LEFT AS-IS — do NOT lower this
-      # unilaterally. compress_svg holds the markup in memory and caps SVGO
-      # output at 100 MiB (image_compressor.rs:1243), so the 500 MiB image/*
-      # default over-states what the SVG route can actually serve: a valid input
-      # inside the advertised limit can fail on the worker cap. Codex flagged it
-      # on the flip PR and it is a real gap.
-      #
-      # It stays 500 MiB here because this value is an API-ENFORCED constant, not
-      # documentation — tests/test_group_input_caps.py pins these to the api
-      # enforcer, so changing the contract alone would create contract-vs-enforcer
-      # DRIFT rather than fix anything. Lowering it needs an api co-land, and a
-      # figure lambdas has actually measured (the only SVG datapoint today is a
-      # 43 KB fixture). Ticket filed; lambdas already flagged a per-format cap as
-      # their follow-up.
-      #
-      # PRE-EXISTING, not introduced by the 2026-07-21 restore: the same 500 MiB
-      # applied while this route was stable before 2026-07-17. Recorded rather
-      # than silently carried.
-      max_input_size_bytes: 524288000   # 500 MiB compress input ceiling (uKsFzORi; image/* default)
+      # RESOLVED 2026-09-26 (607(d)): this group used to carry the 500 MiB image/*
+      # default, a known over-advertisement left in place until lambdas measured a
+      # figure (see the note below). The api enforcer reads this value from the
+      # vendored schema, so lowering it here lowers enforcement at api's next
+      # vendoring.
+      # 607(d) corner run (lambdas, staging v144, 2026-09-26): WHY ~1 MB. compress SVG runs
+      # the external SVGO binary under a FIXED 30 s tool timeout
+      # (image_compressor.rs svg_compression_timeout). No rasterising and memory is not
+      # the limit: 1 MB (9.6k elements) passed in 4.4 s; 4 MB, 20 MB and 100 MB all
+      # failed at ~30.2 s (processing_limit_exceeded). Cost scales with ELEMENT COUNT,
+      # not bytes, so bytes are a proxy. The 30 s is a code constant (a TODO sits at its
+      # call site), not the Lambda budget: raising it is a lambdas choice, after which
+      # this ceiling can be re-measured upward.
+      # UNPROVEN as a guarantee: bytes are only a PROXY for element count. The 1 MB
+      # run had 9.6k rects; a denser SVG under 1 MB can still hit the 30 s cap
+      # (codex #622). Proven only once lambdas bounds element count or the cap moves.
+      ceiling_basis:   # 607(d): proven at the declared value, or not yet (FORMAT.md §ceiling_basis)
+        max_input_size_bytes: unproven
+      max_input_size_bytes: 1000000   # was 500 MiB
       options:
         # No `quality`: compress SVG is SVG->SVG via SVGO (VISUALLY PRESERVING
         # vector optimise — not lossless; see the group note above on convertPathData);
@@ -885,6 +918,13 @@ operation:
         - image/gif
         - image/tiff
       max_output_pixels: 16000000
+      # 607(d): ONE ceiling for TWO formats that measured differently. GIF passed at
+      # 515 MB (30 x 12.5 MP frames; the worker caps a frame at 12.5 MP); TIFF passed
+      # only to 150 MB / 50 MP (100 MP refused by libcaesium). A single group value
+      # cannot state both, so it stays unproven until the group splits into
+      # image_gif + image_tiff (IJofpQLI's pending split).
+      ceiling_basis:   # 607(d): proven at the declared value, or not yet (FORMAT.md §ceiling_basis)
+        max_input_size_bytes: unproven
       max_input_size_bytes: 524288000   # 500 MiB compress input ceiling (uKsFzORi)
       options:
         quality:
@@ -1095,6 +1135,12 @@ operation:
         # server-decided per plan v5 §F8 round 7.
         short_form:
           availability: stable
+          # PROVEN 2026-09-26 (lambdas staging corner run, git-2166848; vm_shared 10_Now/lambdas-corner-video-results-2026-09-26.md):
+          # 300 s / ~480 MB passed at 360p, 720p, 1080p and 4K; at 4K one step past BOTH axes (360 s / 575,743,715 B) passed.
+          # Caveat: 4K ran 446-529 s against the worker's 600 s encode cap on synthetic content; thin margin.
+          ceiling_basis:   # 607(d): proven at the declared value, or not yet (FORMAT.md §ceiling_basis)
+            max_input_size_bytes: proven
+            max_input_duration: proven
           constraints:
             max_input_duration: "PT5M"
             max_input_size_bytes: 524288000        # 500 MiB
@@ -1119,6 +1165,11 @@ operation:
           # (`limits.max_upload_size_bytes`) still refuses first — that is the
           # quota, and it is a separate, request-level limit.
           availability: stable
+          ceiling_basis:   # 607(d): proven at the declared value, or not yet (FORMAT.md §ceiling_basis)
+            max_input_size_bytes: unproven
+            max_input_duration: unproven
+            per_tier.max.max_input_size_bytes: unproven
+            per_tier.enterprise.max_input_size_bytes: unproven
           constraints:                            # baseline = every tier without a per_tier_constraints override
             max_input_duration: "PT12H"
             max_input_size_bytes: 5000000000       # 5 GB (Pro)
@@ -1468,6 +1519,10 @@ operation:
       # MAX_IMAGE_ENTRY_SIZE 50 MB, MAX_ZIP_ENTRIES 10,000,
       # MAX_CUMULATIVE_IMAGE_BYTES 500 MB bound what a document expands INTO;
       # this bounds what we ACCEPT.
+      # PROVEN 2026-09-26: lambdas staging corner run (git-2166848), within 1-2% of the ceiling;
+      # one step past is refused by the worker. vm_shared 10_Now/lambdas-corner-doc-results-2026-09-26.md
+      ceiling_basis:   # 607(d): proven at the declared value, or not yet (FORMAT.md §ceiling_basis)
+        max_input_size_bytes: proven
       max_input_size_bytes: 209715200
       # See the document_pdf honesty note: the worker reads ONLY `quality` today;
       # the per-format options are `planned` (advertised-ahead, FE-hidden).
@@ -1519,6 +1574,10 @@ operation:
       # MAX_IMAGE_ENTRY_SIZE 50 MB, MAX_ZIP_ENTRIES 10,000,
       # MAX_CUMULATIVE_IMAGE_BYTES 500 MB bound what a document expands INTO;
       # this bounds what we ACCEPT.
+      # PROVEN 2026-09-26: lambdas staging corner run (git-2166848), within 1-2% of the ceiling;
+      # one step past is refused by the worker. vm_shared 10_Now/lambdas-corner-doc-results-2026-09-26.md
+      ceiling_basis:   # 607(d): proven at the declared value, or not yet (FORMAT.md §ceiling_basis)
+        max_input_size_bytes: proven
       max_input_size_bytes: 209715200
       # See the document_pdf honesty note: worker reads ONLY `quality`; the rest `planned`.
       options:
@@ -1563,6 +1622,10 @@ operation:
       # MAX_IMAGE_ENTRY_SIZE 50 MB, MAX_ZIP_ENTRIES 10,000,
       # MAX_CUMULATIVE_IMAGE_BYTES 500 MB bound what a document expands INTO;
       # this bounds what we ACCEPT.
+      # PROVEN 2026-09-26: lambdas staging corner run (git-2166848), within 1-2% of the ceiling;
+      # one step past is refused by the worker. vm_shared 10_Now/lambdas-corner-doc-results-2026-09-26.md
+      ceiling_basis:   # 607(d): proven at the declared value, or not yet (FORMAT.md §ceiling_basis)
+        max_input_size_bytes: proven
       max_input_size_bytes: 209715200
       # See the document_pdf honesty note: worker reads ONLY `quality`; the rest `planned`.
       options:

package/operations/schemas/convert.yaml

@@ -298,15 +298,51 @@ operation:
         # F8 long-form video tier (per ticket I15-CONS).
         short_form:
           availability: stable
+          ceiling_basis:   # 607(d): proven at the declared value, or not yet (FORMAT.md §ceiling_basis)
+            max_input_size_bytes: unproven
+            max_input_duration: unproven
           constraints:
             max_input_duration: "PT5M"
             max_input_size_bytes: 524288000
             max_output_size_bytes: 524288000
+          # PROVEN resolution bands (owner decision 607(d), 2026-09-26: advertise
+          # only limits we have proven). Each ceiling is the LONGEST SUCCESSFUL run
+          # lambdas measured at that resolution (9c5mOnq1, staging `$LATEST`,
+          # 2026-09-18, mp4 -> webm real VP9 re-encode, billed seconds from each
+          # invocation's REPORT line). No fitted model: lambdas' two-parameter fit
+          # failed its own prediction, so none is shipped. The class PT5M above is
+          # NOT proven at 720p or 1080p; the bands are what binds. le_720p is sized
+          # for 720p (a 360p run of 295 s also succeeded; a finer band would need
+          # a new band in schemas/resolution-bands.yaml). Every 4K attempt
+          # exceeded the cap, so gt_1080p is not served. `unknown` is ruled =
+          # le_720p (decision 343 precedent).
+          resolution_bands:
+            le_720p:
+              basis: proven
+              source: 9c5mOnq1-720p-145s   # availability/staging-corner-measurements.yaml
+              constraints:
+                max_input_duration: "PT2M25S"
+            p1080:
+              basis: proven
+              source: 9c5mOnq1-1080p-80s   # availability/staging-corner-measurements.yaml
+              constraints:
+                max_input_duration: "PT1M20S"
+            gt_1080p:
+              basis: not_served
+            unknown:
+              basis: ruled
+              constraints:
+                max_input_duration: "PT2M25S"
         long_form:
           # Stays planned (CON-1 flips only compress.video.long_form +
           # merge.video.long_form_re_encode). Per-tier caps per ADR-0011 —
           # advertised shape; availability gates execution off (422).
           availability: planned
+          ceiling_basis:   # 607(d): proven at the declared value, or not yet (FORMAT.md §ceiling_basis)
+            max_input_size_bytes: unproven
+            max_input_duration: unproven
+            per_tier.max.max_input_size_bytes: unproven
+            per_tier.enterprise.max_input_size_bytes: unproven
           constraints:                            # baseline = every tier without a per_tier_constraints override
             max_input_duration: "PT12H"
             max_input_size_bytes: 5000000000       # 5 GB (Pro)

package/operations/schemas/custom_luma.yaml

@@ -58,6 +58,9 @@ operation:
         # ships.
         short_form:
           availability: planned
+          ceiling_basis:   # 607(d): proven at the declared value, or not yet (FORMAT.md §ceiling_basis)
+            max_input_size_bytes: unproven
+            max_input_duration: unproven
           constraints:
             max_input_duration: "PT5M"
             max_input_size_bytes: 524288000
@@ -67,6 +70,11 @@ operation:
           # merge.video.long_form_re_encode). Per-tier caps per ADR-0011 —
           # advertised shape; availability gates execution off (422).
           availability: planned
+          ceiling_basis:   # 607(d): proven at the declared value, or not yet (FORMAT.md §ceiling_basis)
+            max_input_size_bytes: unproven
+            max_input_duration: unproven
+            per_tier.max.max_input_size_bytes: unproven
+            per_tier.enterprise.max_input_size_bytes: unproven
           constraints:                            # baseline = every tier without a per_tier_constraints override
             max_input_duration: "PT12H"
             max_input_size_bytes: 5000000000       # 5 GB (Pro)