In addition: looks like I was wrong that you can't have a change handler to check this right away.
Form fields are widgets and widgets can have players, therefore you can have a change handler.
See:
https://github.com/apostrophecms/form/blob/main/modules/%40apostrophecms/form-radio-field-widget/ui/src/index.js
For an example.
But if it is too messy to hook it up to error display it could be something we don't do right now.
I was also wrong about server side size enforcement, sorry!
It turns out that the entire upload is handled by the submitForm method in lib/process.js. So it is possible.
Currently though attachment uploads are processed in that method before the sanitization of fields, so it could be a bit tedious and I don't think it's a requirement that it happen in this release.
Originally posted by @boutell in #34 (review)