Signature verified; JSON result returned.

Invalid key, JWS, or algorithm. PQC session transport is also refused here: an X-PQC-Transport: true or X-PQC-Session header on this route yields .../errors/pqc-transport-not-available-for-streaming, refused before any body byte is read.

Unauthorized – missing or invalid JWT token.

Forbidden: the calling Application or Cryptographic Actor is SUSPENDED or DISABLED. PRD §221 applies the effective-status containment chain to this route, so the refusal stands even for an already-issued, still-valid JWT — the token is not re-issued on a suspend and the check is per-request. detail names the subject leg that denied (application-suspended / actor-suspended); the tenant's own lifecycle state is NOT consulted on this route.

Request Timeout: the request body was not fully received within the deployment's configured total-duration budget for one streaming upload (crypto.stream.max-read-duration-ms). The detail names that budget in milliseconds. Emittable only while the small part is still being read: once the response is committed no status is representable at all and the stream is truncated instead, per the PRD §141 fail-closed contract. The connection is closed (Connection: close) on this response, so a refused upload cannot keep streaming its body into a drain (RFC 9110 §15.5.9).

Payload Too Large: the metadata part exceeded the 2 MiB small-part cap. file has NO size limit — PRD §130 deleted the 5 MiB ceiling this response used to describe, and the only remaining producer on this path is the seam's small-part cap (.../errors/multipart-part-too-large).

Too Many Requests: the streaming concurrency bound is full, either globally or for this tenant. Retry-After carries the suggested delay in seconds. This bound replaced the edge client_max_body_size ceiling PRD §130 removed, so it is emittable on every streaming endpoint.

Internal Server Error – unexpected verification failure.

Service Unavailable: the Application/Actor effective status could not be verified. PRD §221 fails CLOSED — a request is refused rather than admitted while the status source (Redis projection, and admin-api behind it) is unreachable. This route is otherwise pure compute; the containment gate is the reason it now has an availability dependency at all.