What an uploaded file is, told by its content (spec §9: png/jpg/webp/heic, pdf, xlsx/csv, txt/md).

The first bytes decide for everything that has a signature — a picture, a PDF, a workbook (a zip with xl/workbook.xml); the name and the type the browser claimed are never believed against them. Only a file without any signature may be text, and then it must really be text (no NUL byte, valid UTF-8 at the start) and its extension picks .csv, .txt or .md. A file whose bytes are another known format (a GIF, an SVG, a Word document, an executable) or a binary named .txt is {:error, :unsupported_type}.

A file named like a text file that is text in another encoding — what Excel writes as "CSV" or "Unicode text" in many locales (Windows-1251, Windows-1252, UTF-16) — is {:error, :unsupported_encoding}, so that the user is told to save it as UTF-8 and not that the file is of a kind that is not accepted.