Constant MAX_PDF_BYTES 

pub const MAX_PDF_BYTES: usize = _; // 4_194_304usize

Hard cap on the PDF card.pdf will hand back, measured on the RAW document (the base64 text in the response is ~4/3 of it, so this bounds a ~5.6 MiB response body).

Every dope card carries a ~815 KiB floor: the two Liberation Sans faces pdf_dope_card embeds. Rows are cheap on top of that (~0.5 KiB each — a 300-row, 4-page card is ~950 KiB).

This is the BACKSTOP, not the first line: the row set is refused on its own row and page count before any document exists (card_service::MAX_PDF_ROWS / MAX_PDF_PAGES), because measuring bytes means having already built and paginated them. What survives that check and still lands here is a card made huge by its LABELS — the pdf block’s strings are drawn verbatim on every page — and for those a typed refusal the caller can act on beats pushing a multi-megabyte base64 string through an embedded FFI hop.