Bounded read (cap+1 byte tells 'at the limit' from 'over'); a file that fails validation creates no row; a prober fault is our error, not the user's bad file; a row whose job cannot be submitted is failed, never left queued. Mutation-checked: cap off-by-one, missing cleanup and deleting the handed-over file each turn a test red. Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>