Problem
Only the empty case is rejected; a single POST can bulk-insert unbounded rows with one insert(rows) call.
Where
app/api/runs/route.ts (no MAX_RESULTS guard before insert).
Acceptance
Add a failing test first POSTing e.g. 5,001 results asserting 400/413 before any database access. Then fix.
Problem
Only the empty case is rejected; a single POST can bulk-insert unbounded rows with one
insert(rows)call.Where
app/api/runs/route.ts(noMAX_RESULTSguard before insert).Acceptance
Add a failing test first POSTing e.g. 5,001 results asserting 400/413 before any database access. Then fix.