Format reader foundation
========================

PipeWhy keeps source access, format decoding and snapshot publication separate.
The local source boundary verifies an exact file digest and closes its handle;
the reader interprets explicitly configured schema and limits; the capture
coordinator publishes only after all batches have been consumed and verified.
Read failures cannot turn provisional records into a complete snapshot.

Each format must define how it represents fields, scalar types, null and missing
values, record order, limits, malformed input and source identity. Its schema
and normalization profile are part of the fingerprint context. Strict typed
representation is the default; logical normalization is an explicit option.
Neither profile claims to preserve every detail of a file's syntax.

Selection is explicit. File extensions do not establish format, source version
or provenance. The initial implementation supports the local CSV subset described
in :doc:`format-sources`; other formats, compression and remote storage require
their own implementations and qualification. A file does not itself establish
upstream lineage, so captures without supporting evidence report it as unknown.

Changes to readers require independent expected-value tests, error and limit
tests, offline capture checks, the project quality gates, and package installation
checks. The raw reader contract is available in the repository blueprint.