There are a few places where the API accepts a list of values. We should:

1. Ensure that each has a validation step that checks against an implementation-defined maximum.
2. Set a minimum value for that maximum, so that sites using the API can provide a list without needing to understand which browser is running and the value that browser picked.

For instance, when saving an impression, there is a list of conversion sites. At our 2025-05 meeting, it was suggested that a minimum maximum of 10 would be better than the 3 in ARA, which can be too small for some sites.

For conversion sites, an alternative is to omit the list entirely if there is any risk that it might exceed a limit. That makes the impression available on any site, but that has some other unwanted effects, like making the impression invisible to Clear-Site-Data.

There is also a list of match values in the measureConversion() arguments. That might need a more generous allowance.