§5 Standing limitation

This is the project's own corpus, not deployment evidence. Every byte measured above was produced by this project, for this project's own conformance suite and its own published examples — real bytes, honestly measured, never invented, but not a sample of what independent producers in the wild actually emit. A federated standard's size limits earn their numbers from the traffic they will actually govern, and a standards repository's own test fixtures are not that traffic, no matter how many of them there are or how faithfully they are measured.

Concretely: this measurement strengthens the coherence argument §7 already makes — the three MUST NOT quantities do not conflict with each other (§7's own point, restated in §4.1's headroom table), and nothing plausible built from this project's own real bytes gets remotely close to any of the five budgets (§4.2). It does not, and structurally cannot, supply the evidence only independent deployment data can — most pointedly for quantity (b), where §4.3 names the realistic large-(b) case (sizeable embedded ICC profiles, rich C2PA manifests with embedded thumbnails or certificate chains) as exactly the kind of real-world artifact this project's own fixtures were never built to contain, because they are conformance fixtures, not photographs from a phone.

Row 15 is therefore measured, not met. §7's numbers remain proposals: this document is evidence in their favor, not ratification of them. `GOVERNANCE.md` §6, "External review periods" — the mechanism RELEASE.md row 17 names, itself still "Not started — BLOCKING" — is the process through which independent deployment data is meant to reach this standard. This document does not open that period, is not a substitute for it, and does not claim row 15 is fully satisfied without it.