Format output rejects an uploaded file's URL: generated media only

If a Format run's custom output carries the URL of a file the run only uploaded, the whole output is rejected. Sume checks every URL in your structured output against the set of media the run generated, by exact string equality, and an upload is not in that set. The run reports output_schema_unsatisfied, output is null, and the files it did generate stay on artifacts[]. Keep uploads out of your schema.

What does the URL gate compare against?

Before a custom output reaches you, every URL in it is checked against the media this run produced. Two passes do it. The first collects every http(s):// string anywhere in the object, at any depth, whether or not you declared the field as media. The second collects the url of every SumeMediaFile-shaped value whatever it contains, so a placeholder like "none" or an empty string cannot slip through by not looking like a URL.

The result is binary. A completed run either returns output matching your schema with real media URLs, or returns output: null and says why. It never returns a schema-shaped guess.

What does the failure look like?

The receipt ends failed with error.code and output_error.code of output_schema_unsatisfied. output_error.details carries rejected_urls[] (the first 10 only) and a harvested count by media type. Compare harvested with what your schema requires; it tells you whether the run made the media at all.

primary_output_url is null on a failure, so if (run.primary_output_url) stays a safe test for whether a deliverable exists. The artifacts are populated either way, so a UI can still show the media it has.

How do I fix a schema that echoes an upload?

Remove the field. The gate admits only generated media, so a schema slot for an upload's URL cannot be satisfied no matter what the instruction says.

Identifiers have a related rule. input does not reach the structured output: output is produced from what the run made and said, so a value you sent cannot be echoed back unless the run repeats it. Keep your own ids, SKUs and source URLs on your side, keyed by data.id or by your Idempotency-Key, and join them to the receipt after the run.

What the gate does not check

Beyond URLs, durations and shape, the other values in output (ids, labels, captions, counts) are read from the run's media metadata and closing text. They are grounded in what the run reported, not verified against it, so treat them as the run's own account of its work. For a deliverable you can trust, use the media URL and its checked duration_ms.