docs: state the Comfy Router request-body cap on the limits page

development/comfy-router/limitations.mdx

@@ -13,9 +13,10 @@
 | Generate with one request | `POST /v2/models/{provider}/{model}` returns the finished result. | Start with the [Quickstart](/development/comfy-router/quickstart). |
 | Submit a request and collect it later | Supported through `POST /v2/models/{provider}/{model}/requests` and rolling out by workspace. | See [Queued delivery](/development/comfy-router/queue). |
 | Show progress or stream output | Queued delivery reports queue state and can include queue position, but no percentage progress, streaming output, or preview frames. | Poll the returned `status_url`, or use a supported proxy operation for provider-specific progress. |
 | Recover after a lost connection | After receiving a queued request handle, use its returned URLs. If submission is interrupted before that, retry with the same idempotency key. Synchronous calls can sometimes be collected the same way. | Preserve the idempotency key and follow [retry guidance](/development/comfy-router/api#retry-outcomes). |
 | Reconcile Comfy charges | No universal Comfy cost or credit-balance field on the response. | Use [workspace billing](https://platform.comfy.org). |
 | Store results permanently | Asset URLs can expire, including rehosted and replayed URLs. | Download the assets; see [result assets](/development/comfy-router/reference#result-assets). |
+| Send large media inline | The request body is capped, and base64-encoded media counts against that cap. | Keep bodies under the cap; see [request body size](#request-bodies-are-capped). |
 
 ## Queued delivery availability
 
@@ -25,16 +26,28 @@
 
 Router's default deadline is **10 minutes**, configurable by the deployment. Set your client timeout above it so Router can return its error and request ID first.
 
 `504` / `deadline_exceeded` means Router stopped waiting; `504` / `provider_timeout` means the provider timed out. A timeout or lost connection does not prove that a generation was unbilled, and it does not cancel accepted provider work. Read [timeouts and collection](/development/comfy-router/api#timeouts-and-collection) before retrying.
 
 <span id="no-way-to-resume-a-call-you-lost" />
 
 ## Recovery depends on the provider
 
 Router can retain a provider handle for an accepted submit-and-poll generation. Reuse the same `Idempotency-Key` to collect it later; completed replayable responses can also come from the key record.
 
 Not every disconnected call is recoverable. Preserve the request and key before sending, then use the [retry outcome table](/development/comfy-router/api#retry-outcomes). A new key creates a new call and may incur another charge.
 
+## Request bodies are capped
+
+Router refuses a request whose body is larger than **10 MiB (10,485,760 bytes)**. The bound is on the raw bytes you send, measured before Router parses anything, so it applies to every route and to both synchronous and queued delivery.
+
+Inline media is where callers meet it. Base64 encoding inflates binary data by about 4/3, so a body carrying encoded media clears the cap at roughly **7.5 MB of actual image, audio, or video bytes**. Size the encoded string, not the file on disk, and count every input in one call: a request carrying two reference images spends the allowance on both, and the prompt, parameters, and JSON structure count too.
+
+**What the refusal looks like.** `413`, with `invalid_input` on `X-Comfy-Error-Type` and `X-Comfy-Request-Id` set as on any other response. The body is a [`RouterErrorResponse`](/development/comfy-router/reference#routererrorresponse) whose `detail` describes the bound that was exceeded. Branch on `error_type` rather than parsing `detail`, and treat what the API returns as authoritative if it and this page ever disagree about the figure. Router raises the refusal before dispatching anything, so no generation ran and nothing was charged.
+
+The cap applies to every request, whether or not it carries an `Idempotency-Key`. It is not an idempotency limit, and re-sending the same key does not change the outcome: a body that is too large is too large on every attempt.
+
+**A provider can impose a lower limit of its own.** Providers publish their own bounds on inline media, and the binding constraint is whichever is smaller. Google's models, for example, accept up to 20 MB (decimal, 20,000,000 bytes) of inline payload, and the `Size limit: 20MB` line on the Google model pages is that per-field Google bound quoted from Google's own specification, not Router's bound on the whole request body. A body that clears Router's cap but exceeds a provider's own limit is refused by the provider rather than by Router, and it comes back as a provider error rather than a `413`.
+
 ## Requests are rate limited per caller
 
 | Response | Cause | Action |
@@ -68,7 +81,7 @@
 
 Input and output fields vary by model. Moving from a provider SDK or proxy can change both the route and how you read the result.
 
 Some assets are rehosted on Comfy storage; others are provider URLs or inline bytes. See [Result assets](/development/comfy-router/reference#result-assets) for lifetimes and replay behavior.
 
 ## Next
 

snippets/comfy-router/model-code-footer.mdx

@@ -1,12 +1,14 @@
 ## Before you ship
 
 The SDKs create an `Idempotency-Key` and reuse it for automatic retries. For manual retries, reuse the original key. Router can hold the connection for up to 10 minutes.
 
-When a request fails, Router sends an `X-Comfy-Error-Type` response header explaining why. A `422` means Router rejected the input before calling the provider. Download generated assets promptly because [result URLs can expire](/development/comfy-router/reference#result-assets).
+When a request fails, Router sends an `X-Comfy-Error-Type` response header explaining why. A `422` means Router rejected the input before calling the provider, and a `413` means the request body was larger than Router accepts. Download generated assets promptly because [result URLs can expire](/development/comfy-router/reference#result-assets).
+
+Any size limit named in a field description above is the provider's own bound on that field, quoted from the provider's specification. Router applies a separate cap to the whole request body, which base64-encoded media counts against: see [request body size](/development/comfy-router/limitations#request-bodies-are-capped).
 
 <CardGroup cols={3}>
   <Card title="Headers" icon="list" href="/development/comfy-router/headers">
     Authentication, idempotency, request IDs, error buckets, retry pacing, spend limits.
   </Card>
   <Card title="Using the Router API" icon="code" href="/development/comfy-router/api">
     Model discovery, validation errors, retries, and billing.