diff --git a/docs/user-visible-errors.csv b/docs/user-visible-errors.csv
index b2c0f23e72..f54201af38 100644
--- a/docs/user-visible-errors.csv
+++ b/docs/user-visible-errors.csv
@@ -116,5 +116,5 @@ Then rerun this installer.",implemented,verified by shell branch inspection
 90,install.sh:version mismatch,Installed rea reports a different version,installed version ACTUAL does not match EXPECTED.,Low risk; gives exact integrity mismatch,Keep current copy,unchanged,verified by exact installer test
 90.5,@modelcontextprotocol/server:tool input validation,Caller sends arguments that violate a declared tool schema,"Canonical invalid_request with the SDK diagnostic plus recovery.kind=inspect_input_contract and a bounded instruction to read the advertised schema or call tools/list",Keeps field/type correction while telling the agent how to recover; diagnostics over 4 KiB stay on the existing retained-error path,Normalize ordinary validation failures and retain oversized diagnostics,verified by real in-memory and stdio MCP client/server calls with wrong argument types
 90.6,incur:unknown CLI command,Caller enters an unknown REA command,"'COMMAND' is not a command for 'rea'. Suggested command: rea --help",Low risk; identifies input and exact discovery action,Keep framework-generated copy,unchanged,verified by real packaged dispatcher invocation
-91,src/application/binaryDiagnostics/ByteEntropyService.ts,Invalid file or window,"Expected a regular file.; Selected file could not be found.; Selected byte window extends beyond the end of the file.; File size exceeds exact numeric offset representation.",Invalid selection cannot produce complete entropy Evidence,Choose a readable regular file and a window within its byte size,implemented,entropy service and MCP boundary tests
+91,src/application/binaryDiagnostics/ByteEntropyService.ts,Invalid file or window,"Expected a regular file.; Selected file could not be found.; Selected byte window starts beyond the end of the file.; Selected byte window extends beyond the end of the file.; File size exceeds exact numeric offset representation.",Invalid selection cannot produce complete entropy Evidence,Choose a readable regular file and a window within its byte size,implemented,entropy service and MCP boundary tests
 92,src/domain/analysisView/byteEntropyView.ts,Non-summary entropy view,Byte entropy Evidence supports the summary view; retrieve parent Evidence for the complete block series.,Unsupported view selection,Use the summary view or retrieve complete parent Evidence,implemented,typed input rejection
diff --git a/src/application/binaryDiagnostics/ByteEntropyService.test.ts b/src/application/binaryDiagnostics/ByteEntropyService.test.ts
index 1c07bc3e62..a9ef6f4922 100644
--- a/src/application/binaryDiagnostics/ByteEntropyService.test.ts
+++ b/src/application/binaryDiagnostics/ByteEntropyService.test.ts
@@ -69,6 +69,22 @@ it("rejects missing files, non-files and windows beyond EOF, but accepts empty w
   ).toContainEqual(expect.stringContaining("reports a size of 0"));
 });
 
+it.each([
+  [{ offset: 2048 }, "offset"],
+  [{ offset: 2048, length: 0 }, "offset"],
+  [{ offset: 512, length: 1024 }, "length"],
+])("names the selector that puts %o past EOF", async (window, field) => {
+  const root = await createTestTempDirectory("rea-entropy-window-");
+  const path = join(root, "bytes");
+  await writeFile(path, Buffer.alloc(1024));
+  const result = await new ByteEntropyService().inspect({ path, ...window });
+  if (result.ok) throw new Error("Expected an out-of-file window to fail");
+  expect(projectAnalysisError(result.error)).toMatchObject({
+    code: "invalid_request",
+    details: { issues: [{ path: [field], reason: "invalid_value" }] },
+  });
+});
+
 it.skipIf(process.platform !== "linux")(
   "marks a generated /proc file that reports size 0 as not shown empty",
   async () => {
diff --git a/src/application/binaryDiagnostics/ByteEntropyService.ts b/src/application/binaryDiagnostics/ByteEntropyService.ts
index b3f0311c0c..2974b690eb 100644
--- a/src/application/binaryDiagnostics/ByteEntropyService.ts
+++ b/src/application/binaryDiagnostics/ByteEntropyService.ts
@@ -202,8 +202,13 @@ export class ByteEntropyService {
               "path",
               "File size exceeds exact numeric offset representation.",
             );
+          if (input.offset > size)
+            throw invalid(
+              "offset",
+              "Selected byte window starts beyond the end of the file.",
+            );
           const length = input.length ?? size - input.offset;
-          if (input.offset > size || length > size - input.offset)
+          if (length > size - input.offset)
             throw invalid(
               "length",
               "Selected byte window extends beyond the end of the file.",