@@ -213,6 +213,51 @@ jobs:
             || { echo "coverage ${actual}% is below the threshold ${threshold}%"; exit 1; }
         shell: bash
 
+  fidelity:
+    name: reference tools actually installed
+    # The oracle guards skip when the tool they need is missing, loudly, and a
+    # skip is not a check. The matrix runners have python and node and nothing
+    # else, so on an ordinary push most of those guards report a skip and the
+    # run is green having verified almost nothing about the files themselves.
+    #
+    # This job installs Inkscape, 7z, ffmpeg and poppler so the same guards run
+    # for real. It is separate from the matrix because installing a graphics
+    # stack takes minutes and a push should not wait for it.
+    #
+    # What it does NOT do, said plainly: it does not walk many sizes. The
+    # guards it runs check the realistic size and the smallest ones, which is
+    # where the one defect this ever found was hiding - an SVG that rendered to
+    # a blank canvas at exactly its minimum, 2026-08-03. The wider sweep across
+    # sizes, seeds and label settings lives in tools/probes/fidelity-sweep.py
+    # and is run by hand, because tools/ is outside the repository. See O51.
+    runs-on: ubuntu-latest
+    timeout-minutes: 30
+    env:
+      CGO_ENABLED: "0"
+    steps:
+      - uses: actions/checkout@v7
+
+      - uses: actions/setup-go@v7
+        with:
+          go-version: ${{ env.GO_VERSION }}
+          check-latest: false
+          cache: true
+
+      - name: the reference tools
+        run: |
+          set -euo pipefail
+          sudo apt-get update
+          sudo apt-get install -y --no-install-recommends \
+            p7zip-full ffmpeg poppler-utils inkscape python3-pil
+        shell: bash
+
+      - name: every format past its reference tool
+        # -v so that a skip is visible in the log. A tool that failed to install
+        # would otherwise turn this job back into the green nothing it exists
+        # to replace.
+        run: go test ./internal/guard/ -count=1 -run 'ReferenceTool' -v
+        shell: bash
+
   fuzz:
     name: fuzzing with a time budget
     # Weekly and by hand, never on a push. Fuzzing searches without end, so a
 
@@ -86,8 +86,30 @@ because it turns other people's test suites red.
   the same one the recipe uses, and a value that is not on it is refused with
   the list to pick from.
 
+### Breaking
+
+- **PDF bytes have changed.** The text on a page is laid out to a fixed line
+  width now. It used to be eight to thirteen drawn words of four to nine
+  characters, which meant the smallest document one seed could produce was not
+  the smallest another could - so `--size 3300` was accepted for six seeds out
+  of ten, and the floor moved between 3090 and 3499 bytes depending on the
+  seed. The words still come from the seed, so two seeds still read
+  differently. Only the length is settled. Anything holding a hash of a PDF
+  this tool made will need to take it again.
+
 ### Changed
 
+- **A rule binding two settings is declared rather than described.** PNG allows
+  each side of a picture up to 20000 pixels and the two multiplied up to 40
+  megapixels, and that second rule lived in the generator and in a sentence -
+  so `tfg formats png` offered a pair it then refused, and nothing but a person
+  could read the limit. It is in the registry now, printed on its own line and
+  carried in `--json`, so a script or a window sees it.
+- **A second run into the same directory refuses before it writes anything.**
+  It used to write its whole set of files and only then find it had nowhere to
+  record them: two runs started together left sixteen files on the disk with
+  eight of them in nobody's manifest. The manifest name is taken before the
+  first file now, and given back if the run ends without writing one.
 - **The minimum `tfg formats` prints is a size it will take.** For pdf, wav
   and zip it was not: the number came from the registry, which holds the
   structural floor of a format with no label, and the label is on unless you
 
@@ -28,8 +28,20 @@ type formatEntry struct {
 	PaddingCap       int64           `json:"padding_capacity,omitempty"`
 	Label            string          `json:"label_carrier"`
 	Properties       []propertyEntry `json:"properties,omitempty"`
-	Oracle           string          `json:"oracle"`
-	Version          string          `json:"generator_version"`
+	// JointLimits are the rules binding two settings that neither can state on
+	// its own, so a script or a window sees them without reading prose.
+	JointLimits []jointLimitEntry `json:"joint_limits,omitempty"`
+	Oracle      string            `json:"oracle"`
+	Version     string            `json:"generator_version"`
+}
+
+// jointLimitEntry is a rule binding two settings, as a script sees it.
+type jointLimitEntry struct {
+	Of     string `json:"of"`
+	By     string `json:"by"`
+	Max    int64  `json:"max"`
+	Unit   string `json:"unit,omitempty"`
+	Detail string `json:"detail"`
 }
 
 // propertyEntry is one setting as a script sees it. Everything a window would
@@ -57,6 +69,19 @@ func smallestAccepted(d format.Descriptor) int64 {
 	return d.SmallestAccepted(format.Request{Label: true})
 }
 
+func jointsOf(d format.Descriptor) []jointLimitEntry {
+	if len(d.JointLimits) == 0 {
+		return nil
+	}
+	out := make([]jointLimitEntry, 0, len(d.JointLimits))
+	for _, j := range d.JointLimits {
+		out = append(out, jointLimitEntry{
+			Of: j.Of, By: j.By, Max: j.Max, Unit: j.Unit, Detail: j.Describe(),
+		})
+	}
+	return out
+}
+
 func entryFor(d format.Descriptor) formatEntry {
 	props := make([]propertyEntry, 0, len(d.Properties))
 	for _, p := range d.Properties {
@@ -70,7 +95,7 @@ func entryFor(d format.Descriptor) formatEntry {
 		Fidelity: string(d.Fidelity), Determinism: string(d.Determinism),
 		MinBytes: d.MinBytes, SmallestAccepted: smallestAccepted(d),
 		Padding: d.Padding.Name, PaddingCap: d.Padding.Capacity,
-		Label: string(d.Label), Properties: props,
+		Label: string(d.Label), Properties: props, JointLimits: jointsOf(d),
 		Oracle: d.Oracle, Version: d.GeneratorVersion,
 	}
 }
@@ -99,6 +124,14 @@ func describeOne(d format.Descriptor, out io.Writer) {
 			fmt.Fprintf(out, "  %-14s %s\n", "", p.Detail)
 		}
 	}
+
+	// A rule binding two settings gets its own line. Folded into the
+	// description of each one it reads as decoration, and it was invisible
+	// altogether before the registry could carry it - so this command offered
+	// twenty thousand by twenty thousand and the run refused the pair.
+	for _, j := range d.JointLimits {
+		fmt.Fprintf(out, "\n  and together:  %s\n", j.Describe())
+	}
 }
 
 // allowedText says what a property accepts, in the same words the refusal uses.
 
@@ -414,11 +414,7 @@ func preflight(files []PlannedFile, opt Options) error {
 	// files could never be cleaned up by this tool again. It happened on a
 	// successful run as readily as on a refused one, and on the successful one
 	// it happened in silence.
-	name := opt.ManifestName
-	if name == "" {
-		name = DefaultManifestName
-	}
-	if path := filepath.Join(opt.OutDir, name); exists(path) {
+	if path := filepath.Join(opt.OutDir, manifestNameOf(opt)); exists(path) {
 		return &CollisionError{Path: path, Manifest: true}
 	}
 
@@ -456,6 +452,15 @@ func exists(path string) bool {
 	return err == nil
 }
 
+// manifestNameOf is where this run's record lands. One definition, because the
+// preflight check, the claim and the save all have to mean the same file.
+func manifestNameOf(opt Options) string {
+	if opt.ManifestName == "" {
+		return DefaultManifestName
+	}
+	return opt.ManifestName
+}
+
 func Run(ctx context.Context, files []PlannedFile, opt Options) (*Result, error) {
 	m := manifest.New(
 		"testing-files-generator", version.Version,
@@ -490,6 +495,26 @@ func Run(ctx context.Context, files []PlannedFile, opt Options) (*Result, error)
 		return res, fmt.Errorf("cannot create the output directory %s: %w", opt.OutDir, err)
 	}
 
+	// The manifest name is taken before the first file, not after the last one.
+	//
+	// Claiming it at save time already stopped two runs from both writing a
+	// manifest, but it happened at the end - so a second run wrote its whole set
+	// of files and only then found out it had nowhere to record them. Measured
+	// on 2026-08-03: two runs started together under different ids ended 0 and
+	// 5, with sixteen files on the disk and eight of them in nobody's manifest.
+	// Taking the name here turns that into a refusal before anything is written.
+	manifestPath := filepath.Join(opt.OutDir, manifestNameOf(opt))
+	if err := manifest.Claim(manifestPath); err != nil {
+		return res, &CollisionError{Path: manifestPath, Manifest: true}
+	}
+	// Given back if this run ends without writing one, or the name would stay
+	// taken by a run that never happened.
+	defer func() {
+		if !res.Manifest.Run.Complete && res.Failures == 0 && len(res.Manifest.Files) == 0 {
+			_ = manifest.Release(manifestPath)
+		}
+	}()
+
 	totalBytes := TotalBytes(files)
 	var bytesDone int64
 
 
@@ -156,6 +156,64 @@ type Property struct {
 	Detail string
 }
 
+// JointLimit is a rule binding two settings that neither of them can state
+// alone.
+//
+// A Property bounds one value. PNG needs more than that: each side of a picture
+// may go up to twenty thousand pixels and the two multiplied may not pass forty
+// megapixels, because the picture is held in memory while it is encoded. That
+// rule had nowhere to live, so it lived in the generator and in a sentence of
+// prose - and "tfg formats png" offered a pair it then refused.
+//
+// A sentence is enough for a person and not for anything else. AR9 has the
+// registry as the one place a consumer asks what a format accepts, and a window
+// drawing two number fields from Min and Max would offer twenty thousand in
+// both and produce a request the run rejects. Declaring it is what lets the
+// refusal, the printed description and a future field all come from one place.
+//
+// Kept to a product of two because that is the shape every case in Tier 1 has -
+// pixels, samples times channels, pages times page size. A general expression
+// would be a language to learn, and this is a line to read.
+type JointLimit struct {
+	// Of and By are the two settings multiplied together.
+	Of, By string
+	// Max is the largest their product may be, counted in the same units the
+	// settings themselves use.
+	Max int64
+	// Unit is what the product is reported in, and Per is how many of the
+	// settings' own units make one of it. Pixels are counted in millions when
+	// spoken about, so Unit is "megapixels" and Per is a million - "400
+	// megapixels and the limit is 40" is a sentence somebody can act on and
+	// "400000000 and the limit is 40000000" is not. Per of nought means one.
+	Unit string
+	Per  int64
+	// Why is the reason, in the words the refusal uses.
+	Why string
+}
+
+// Allows reports whether a pair of values satisfies the limit, and says what is
+// wrong when it does not.
+func (j JointLimit) Allows(of, by int64) (bad string) {
+	if of*by <= j.Max {
+		return ""
+	}
+	return fmt.Sprintf("together they come to %d %s and the limit is %d, because %s",
+		of*by/j.per(), j.Unit, j.Max/j.per(), j.Why)
+}
+
+// Describe is the rule as one sentence, for the format list and for a window.
+func (j JointLimit) Describe() string {
+	return fmt.Sprintf("%s times %s cannot pass %d %s, because %s",
+		j.Of, j.By, j.Max/j.per(), j.Unit, j.Why)
+}
+
+func (j JointLimit) per() int64 {
+	if j.Per == 0 {
+		return 1
+	}
+	return j.Per
+}
+
 // Descriptor is everything a format announces about itself. A format missing
 // any of it fails the registry test rather than shipping half implemented.
 type Descriptor struct {
@@ -176,6 +234,10 @@ type Descriptor struct {
 	// it should not. An empty list means the format takes no properties.
 	Properties []Property
 
+	// JointLimits are the rules binding two settings that neither can state on
+	// its own. Empty for every format that has none.
+	JointLimits []JointLimit
+
 	// Container says this format holds other files, so a recipe may declare
 	// contains for it.
 	//