@@ -88,6 +88,22 @@ because it turns other people's test suites red.
 
 ### Changed
 
+- **The minimum `tfg formats` prints is a size it will take.** For pdf, wav
+  and zip it was not: the number came from the registry, which holds the
+  structural floor of a format with no label, and the label is on unless you
+  turn it off. Asking for exactly what was printed was refused. The column now
+  shows what an ordinary run accepts, and `--json` carries both - `min_bytes`
+  unchanged, `smallest_accepted` beside it.
+- **Whether a PDF size is accepted no longer depends on the seed.** The text on
+  a page is drawn, so the smallest document one seed could produce was not the
+  smallest another could: `--size 3300` was accepted for six seeds out of ten,
+  and across two hundred seeds the floor moved between 3090 and 3499 bytes. An
+  error that comes and goes when you change the seed is the one thing a tool
+  built on repeatability cannot have. The floor is now worked out from the
+  longest text a page can ever hold, so it is the same for everybody. Every
+  document at an accepted size is unchanged, byte for byte - the boundary
+  moved, not the content. The cost is that the floor is the worst case, so
+  sizes some seeds could have produced are now refused.
 - **The smallest SVG this tool makes now draws something.** At exactly its old
   minimum of 193 bytes the document held one empty text element and no shapes:
   valid SVG, exactly the size ordered, repeatable, and a blank canvas when
 
@@ -12,17 +12,24 @@ import (
 )
 
 type formatEntry struct {
-	ID          string          `json:"id"`
-	Extension   string          `json:"extension"`
-	Fidelity    string          `json:"fidelity"`
-	Determinism string          `json:"determinism"`
-	MinBytes    int64           `json:"min_bytes"`
-	Padding     string          `json:"padding_channel"`
-	PaddingCap  int64           `json:"padding_capacity,omitempty"`
-	Label       string          `json:"label_carrier"`
-	Properties  []propertyEntry `json:"properties,omitempty"`
-	Oracle      string          `json:"oracle"`
-	Version     string          `json:"generator_version"`
+	ID          string `json:"id"`
+	Extension   string `json:"extension"`
+	Fidelity    string `json:"fidelity"`
+	Determinism string `json:"determinism"`
+	// MinBytes is the structural floor of the format: its skeleton, with no
+	// label and every setting at its default. Kept under the name it has
+	// always had, because a key in machine output is a public name.
+	MinBytes int64 `json:"min_bytes"`
+	// SmallestAccepted is the smallest --size this build will actually take
+	// for an ordinary run, with the label on. For three formats out of twelve
+	// that is not MinBytes, and asking for MinBytes was refused.
+	SmallestAccepted int64           `json:"smallest_accepted"`
+	Padding          string          `json:"padding_channel"`
+	PaddingCap       int64           `json:"padding_capacity,omitempty"`
+	Label            string          `json:"label_carrier"`
+	Properties       []propertyEntry `json:"properties,omitempty"`
+	Oracle           string          `json:"oracle"`
+	Version          string          `json:"generator_version"`
 }
 
 // propertyEntry is one setting as a script sees it. Everything a window would
@@ -39,6 +46,17 @@ type propertyEntry struct {
 	Detail  string   `json:"detail,omitempty"`
 }
 
+// smallestAccepted is the number this command prints as the minimum.
+//
+// It is what an ordinary run will take, so the label is on and every property
+// is at its default - which is what somebody reading that column is about to
+// type. The registry's own MinBytes is the structural floor with no label, and
+// for pdf, wav and zip the two are not the same number: asking for the floor
+// was refused, measured on 2026-08-03.
+func smallestAccepted(d format.Descriptor) int64 {
+	return d.SmallestAccepted(format.Request{Label: true})
+}
+
 func entryFor(d format.Descriptor) formatEntry {
 	props := make([]propertyEntry, 0, len(d.Properties))
 	for _, p := range d.Properties {
@@ -50,7 +68,8 @@ func entryFor(d format.Descriptor) formatEntry {
 	return formatEntry{
 		ID: d.ID, Extension: d.Extension,
 		Fidelity: string(d.Fidelity), Determinism: string(d.Determinism),
-		MinBytes: d.MinBytes, Padding: d.Padding.Name, PaddingCap: d.Padding.Capacity,
+		MinBytes: d.MinBytes, SmallestAccepted: smallestAccepted(d),
+		Padding: d.Padding.Name, PaddingCap: d.Padding.Capacity,
 		Label: string(d.Label), Properties: props,
 		Oracle: d.Oracle, Version: d.GeneratorVersion,
 	}
@@ -63,7 +82,7 @@ func entryFor(d format.Descriptor) formatEntry {
 // a format accepts, and the silence looked like an answer.
 func describeOne(d format.Descriptor, out io.Writer) {
 	fmt.Fprintf(out, "%s - %s fidelity, %s deterministic, minimum %d B\n",
-		d.ID, d.Fidelity, d.Determinism, d.MinBytes)
+		d.ID, d.Fidelity, d.Determinism, smallestAccepted(d))
 	fmt.Fprintf(out, "  extension  %s\n", d.Extension)
 	fmt.Fprintf(out, "  padding    %s\n", d.Padding.Name)
 	fmt.Fprintf(out, "  label      %s\n", d.Label)
@@ -171,7 +190,7 @@ Flags:
 	fmt.Fprintf(out, "%-8s %-10s %-12s %-10s %s\n", "FORMAT", "FIDELITY", "DETERMINISM", "MINIMUM", "PADDING CHANNEL")
 	for _, d := range format.All() {
 		fmt.Fprintf(out, "%-8s %-10s %-12s %-10d %s\n",
-			d.ID, d.Fidelity, d.Determinism, d.MinBytes, d.Padding.Name)
+			d.ID, d.Fidelity, d.Determinism, smallestAccepted(d), d.Padding.Name)
 	}
 	fmt.Fprint(out, "\nRun \"tfg formats <id>\" for what one format accepts.\n")
 	return ExitOK
 
@@ -7,6 +7,7 @@ package format
 
 import (
 	"context"
+	"errors"
 	"fmt"
 	"io"
 	"sort"
@@ -328,6 +329,71 @@ func (p Property) unitSuffix() string {
 	return " of " + p.Unit
 }
 
+// SmallestAccepted is the smallest size this format will actually produce for
+// a request shaped like r.
+//
+// MinBytes beside it is the structural floor: the skeleton of the format with
+// no label and nothing else. That is a real thing to know and it is not what a
+// person reading a column headed MINIMUM takes it to mean, because the label is
+// on unless it is turned off and some formats size themselves from their
+// settings. Measured on 2026-08-03, asking for exactly what the tool printed:
+//
+//	pdf   printed 3265   refused it, said 3286
+//	wav   printed 44     refused it, said 98
+//	zip   printed 156    refused it, said 4285
+//
+// The generator is asked rather than a second number being declared beside the
+// first. A declaration would be one more thing to keep in step, and the
+// generator already works this out - it has to, in order to refuse - and
+// carries it in the refusal. So the answer here and the answer somebody gets
+// when they ask for one byte less cannot disagree.
+// It asks repeatedly rather than once, and that is not caution - it is
+// arithmetic. The minimum a format reports depends on the size being asked
+// for, because the self describing label states the byte count and a longer
+// number is a longer label. So the answer is a fixed point: keep asking until
+// a size is accepted, moving to whatever the refusal names next.
+//
+// Measured on 2026-08-03, which is how this was found rather than reasoned
+// about. Asking once at nought gave pdf 3334 while 3286 was accepted, and wav
+// 96 while 96 was refused and 98 was not. One question gives a number that is
+// wrong in either direction.
+//
+// A format may also refuse a band above a size it accepts - PNG takes 73 and
+// refuses 74 through 84, because the smallest chunk that could make up the
+// difference costs twelve on its own - so this steps by one when a refusal
+// names nothing higher, rather than assuming the answer only ever grows.
+func (d Descriptor) SmallestAccepted(r Request) int64 {
+	r.SizeFromContents = false
+
+	// Sixty four rounds is far more than any format needs: each round either
+	// settles or jumps to a number the format itself named. It is here so that
+	// a generator whose refusals ever cycle costs a wrong number rather than a
+	// run that never ends.
+	size := int64(0)
+	for round := 0; round < 64; round++ {
+		r.Bytes = size
+		if _, err := d.Generator.Plan(r); err == nil {
+			return size
+		} else {
+			var below *BelowMinimumError
+			if !errors.As(err, &below) {
+				// Refused for a reason that is not about size - a property this
+				// request cannot have, say. The structural floor is the honest
+				// answer left.
+				return d.MinBytes
+			}
+			if below.Minimum > size {
+				size = below.Minimum
+				continue
+			}
+			// The refusal names nothing above where we already are, so this is
+			// a size inside a band the format cannot reach. Step past it.
+			size++
+		}
+	}
+	return d.MinBytes
+}
+
 // PropertyNames is the declared keys, in the order the format listed them.
 func (d Descriptor) PropertyNames() []string {
 	out := make([]string, 0, len(d.Properties))
 
@@ -102,6 +102,10 @@ type memo struct {
 	// cross reference table, which sits before the padding.
 	suffix []byte
 	padLen int64
+	// widestContent asks document() to lay out the longest content this format
+	// can ever draw, so that the smallest size it accepts is the same number for
+	// every seed. It is only ever set while measuring.
+	widestContent bool
 }
 
 type pageSize struct {
@@ -135,8 +139,18 @@ func (generator) Plan(r format.Request) (format.Plan, error) {
 	m := memo{pages: pages, pageSize: size, seed: r.Seed, label: label}
 	m.prefix, m.suffix = document(m)
 
+	// What this seed happens to come to, which decides how much padding the
+	// file needs.
 	bare := int64(len(m.prefix) + len(m.suffix))
 
+	// What any seed could come to, which decides what is refused. The two are
+	// different numbers and using the first for both is what made the same
+	// --size succeed on one seed and fail on another - see longestSentence.
+	widestM := m
+	widestM.widestContent = true
+	wp, ws := document(widestM)
+	floor := int64(len(wp) + len(ws))
+
 	p := format.Plan{
 		Bytes:       r.Bytes,
 		Exact:       true,
@@ -155,14 +169,14 @@ func (generator) Plan(r format.Request) (format.Plan, error) {
 	switch {
 	case r.Bytes == bare:
 		m.padLen = 0
-	case r.Bytes < bare:
+	case r.Bytes < floor:
 		return format.Plan{}, &format.BelowMinimumError{
 			Format:    "PDF",
 			Requested: r.Bytes,
-			Minimum:   bare,
+			Minimum:   floor,
 			Reason: fmt.Sprintf("a %d page %s document%s already needs that much before any padding",
 				pages, size.name, labelCost(r.Label)),
-			Hint: fmt.Sprintf("Ask for %d B or more%s.", bare, cleanHint(r.Label)),
+			Hint: fmt.Sprintf("Ask for %d B or more%s.", floor, cleanHint(r.Label)),
 		}
 	case r.Bytes < bare+minComment:
 		// A comment is a per cent sign and a newline at the very least, so
@@ -361,7 +375,13 @@ func pageContent(m memo, index int) string {
 	rng := core.NewRand(core.FileSeed(m.seed, index))
 	y := top - 36
 	for line := 0; line < 24 && y > 108; line++ {
-		fmt.Fprintf(&b, "1 0 0 1 72 %d Tm\n(%s) Tj\n", y, escapeString(sentence(rng)))
+		text := sentence(rng)
+		if m.widestContent {
+			// Measuring the worst case rather than producing a file. See
+			// longestSentence for why the floor may not depend on the seed.
+			text = longestSentence
+		}
+		fmt.Fprintf(&b, "1 0 0 1 72 %d Tm\n(%s) Tj\n", y, escapeString(text))
 		y -= 16
 	}
 	b.WriteString("ET\n")
@@ -385,6 +405,44 @@ func sentence(rng interface{ IntN(int) int }) string {
 	return strings.Join(parts, " ")
 }
 
+// longestSentence is the most a line of this page can ever come to.
+//
+// It exists so that the size this format refuses below does not depend on the
+// seed. The content of a page is drawn - eight to thirteen words, each from a
+// vocabulary of different lengths - so the smallest document a given seed can
+// produce is not the smallest document some other seed can produce.
+//
+// Measured on 2026-08-03, asking every seed for the bare minimum: across two
+// hundred seeds the answer ranged from 3090 B to 3499 B. The visible cost was
+// worse than the number suggests - "tfg generate --format pdf --size 3300"
+// was accepted for six seeds out of ten and refused for four. An error that
+// appears and disappears depending on the seed is the one thing a tool built
+// on "the same seed gives the same run" cannot have, and the engine already
+// says so in as many words about a size drawn from a range.
+//
+// So the floor is the worst case rather than this seed's case, and it is the
+// same number for everybody. Sizes at or above it are produced exactly as
+// before, byte for byte - only the boundary moved.
+var longestSentence = func() string {
+	longest := ""
+	for _, w := range words {
+		if len(w) > len(longest) {
+			longest = w
+		}
+	}
+	const most = 8 + 5 // the largest n that sentence can draw
+	parts := make([]string, most)
+	for i := range parts {
+		parts[i] = longest
+	}
+	return strings.Join(parts, " ")
+}()
+
+// widest is a stand in for a draw, handing back the longest of everything.
+type widest struct{}
+
+func (widest) IntN(int) int { return 0 }
+
 // escapeString protects the three characters that end or nest a PDF string.
 // Without this a label containing a bracket would produce a file no reader
 // can parse.
@@ -439,7 +497,7 @@ func sorted(in []string) []string {
 // minimumBytes is the smallest document this generator can produce: one A4
 // page with no label. Measured at start up rather than guessed.
 func minimumBytes() int64 {
-	m := memo{pages: 1, pageSize: pageSizes["a4"]}
+	m := memo{pages: 1, pageSize: pageSizes["a4"], widestContent: true}
 	prefix, suffix := document(m)
 	return int64(len(prefix) + len(suffix))
 }