From fcec92e2decf2a994e4c6754a59ff7cfb4e25004 Mon Sep 17 00:00:00 2001
From: clover caruso <git@paperclover.net>
Date: Sat, 3 Oct 2026 15:27:52 -0700
Subject: [PATCH] feat: the site keeps the crash reports Snowbound sends to
 POST /crash

Plain text or JSON up to 64 KB, ten an hour from an address and 500 an hour in
all, each a timestamped file in --crashes (crashes beside the root by default),
nothing echoed back. --trust-forwarded counts senders as the relay does, whose
address rule both now share.

Assisted-by: claude-opus-5.5
---
 crates/relay/README.md                     |  14 +-
 crates/relay/deploy/snowbound-site.service |   3 +-
 crates/relay/src/lib.rs                    |  28 +++-
 crates/relay/src/server.rs                 |  39 +----
 crates/relay/src/site.rs                   | 180 +++++++++++++++++++--
 crates/relay/src/site_main.rs              |  22 ++-
 crates/relay/tests/site.rs                 | 100 +++++++++++-
 7 files changed, 325 insertions(+), 61 deletions(-)

diff --git a/crates/relay/README.md b/crates/relay/README.md
index a95a496196a2f6157f5a9aba333cf4c578a48617..a11136cb1754c4b0588104a039bcbd4809d8a2a2 100644
--- a/crates/relay/README.md
+++ b/crates/relay/README.md
@@ -86,8 +86,13 @@ code (`/7KQ-4MZ-9XR`, read as loosely as the app reads one) a page that opens it
 `snowbound://join/<code>`, and in the web build where `--web` names where (once the web build
 joins shares). Anything else under the folder is a file; `/` is its `index.html`. A build's
 module and JavaScript sit in `b/<hash>/` and are cached for good; `index.html` and the
-codes' pages are checked on every load, and the rest (fonts, dictionaries) for a day. It
-holds no state.
+codes' pages are checked on every load, and the rest (fonts, dictionaries) for a day.
+
+`POST /crash` takes a crash report the app sends when its user chooses Send Report: plain
+text or JSON up to 64 KB, ten an hour from one address and 500 an hour in all, each kept as
+a file named for when it came (`2026-10-03T21-04-05Z-1a2b3c4d.txt`) in `--crashes`, by
+default `crashes` beside the root. Nothing else is kept, and nothing sent comes back. Behind
+a proxy, `--trust-forwarded true` counts senders by the address it adds, as the relay does.
 
 `python3 tools/release_web.py --deploy` builds the web app and the site for the VPS's
 architecture, copies the build into `~/snowbound-web/site/` (keeping the last three builds'
@@ -99,7 +104,7 @@ ssh vps
 mkdir -p ~/snowbound-web/site
 # after the first `release_web.py --deploy` has put the binary there:
 pm2 start ~/snowbound-web/snowbound-site --name snowbound-site -- \
-    --listen 127.0.0.1:23593 --root "$HOME/snowbound-web/site"
+    --listen 127.0.0.1:23593 --root "$HOME/snowbound-web/site" --trust-forwarded true
 pm2 save
 ```
 
@@ -112,7 +117,8 @@ snowbound.paperclover.net {
 }
 ```
 
-`snowbound-site.service` runs it under systemd instead (`--root /srv/snowbound/web`).
+`snowbound-site.service` runs it under systemd instead (`--root /srv/snowbound/web`, the
+reports in `/var/lib/snowbound-site`).
 `snowbound-site --help` lists the options, each also `SNOWBOUND_SITE_<OPTION>`.
 
 ## Options
diff --git a/crates/relay/deploy/snowbound-site.service b/crates/relay/deploy/snowbound-site.service
index 9ced4e3fceb5acf3cb8f34fabe42cb085ba71ff8..e18d01e9fcf6a47c5d378939b2b76e234f4bdcf9 100644
--- a/crates/relay/deploy/snowbound-site.service
+++ b/crates/relay/deploy/snowbound-site.service
@@ -7,7 +7,8 @@ After=network-online.target
 Wants=network-online.target
 
 [Service]
-ExecStart=/usr/local/bin/snowbound-site --listen 127.0.0.1:23593 --root /srv/snowbound/web
+ExecStart=/usr/local/bin/snowbound-site --listen 127.0.0.1:23593 --root /srv/snowbound/web --crashes /var/lib/snowbound-site --trust-forwarded true
+StateDirectory=snowbound-site
 Restart=always
 RestartSec=2
 DynamicUser=yes
diff --git a/crates/relay/src/lib.rs b/crates/relay/src/lib.rs
index d777c2f7bdffb148673824b10fad0428e66208da..4e9904e43ec0cabf362c5f3d3e4df7241fee29ab 100644
--- a/crates/relay/src/lib.rs
+++ b/crates/relay/src/lib.rs
@@ -23,7 +23,33 @@ pub mod server;
 pub mod site;
 pub mod ws;
 
-use std::{fmt, str::FromStr};
+use std::{
+    fmt,
+    net::{IpAddr, Ipv4Addr, Ipv6Addr, TcpStream},
+    str::FromStr,
+};
+
+/// Where a request counts against limits: the address it connected from, or with
+/// `trust_forwarded` the one its proxy says, an IPv6 address by its /64.
+pub fn peer(stream: &TcpStream, head: &str, trust_forwarded: bool) -> IpAddr {
+    let forwarded = ws::header(head, "X-Forwarded-For")
+        .filter(|_| trust_forwarded)
+        .and_then(|value| value.rsplit(',').next()?.trim().parse().ok());
+    let ip = forwarded
+        .or_else(|| stream.peer_addr().ok().map(|address| address.ip()))
+        .unwrap_or(IpAddr::V4(Ipv4Addr::UNSPECIFIED));
+    match ip {
+        IpAddr::V6(v6) => match v6.to_ipv4_mapped() {
+            Some(v4) => IpAddr::V4(v4),
+            // One subscriber is usually given a whole /64.
+            None => {
+                let [a, b, c, d, ..] = v6.segments();
+                IpAddr::V6(Ipv6Addr::new(a, b, c, d, 0, 0, 0, 0))
+            }
+        },
+        v4 => v4,
+    }
+}
 
 /// The bytes before a binary message's payload: the slot it goes to or came from.
 pub const SLOT: usize = 4;
diff --git a/crates/relay/src/server.rs b/crates/relay/src/server.rs
index 9b293171b63eef20111d93e61e3346c543eb9f32..2b56d2a7f95866d2ed09181e354376f4c1d2fc43 100644
--- a/crates/relay/src/server.rs
+++ b/crates/relay/src/server.rs
@@ -6,7 +6,7 @@ use crate::{BROADCAST, GROUP, Notice, SLOT, Verdict, ws};
 use std::{
     collections::{BTreeMap, HashMap, VecDeque},
     io::{BufReader, Write},
-    net::{IpAddr, Ipv4Addr, Ipv6Addr, Shutdown, TcpListener, TcpStream},
+    net::{IpAddr, Shutdown, TcpListener, TcpStream},
     ops::RangeInclusive,
     sync::{
         Arc, Condvar, Mutex,
@@ -209,7 +209,7 @@ impl Relay {
 
     /// Answers the request `head`: whether the connection serves another.
     fn request(&self, stream: &TcpStream, reader: &mut BufReader<TcpStream>, head: &str) -> bool {
-        let address = self.address(stream, head);
+        let address = crate::peer(stream, head, self.config.trust_forwarded);
         let target = head.split(' ').nth(1).unwrap_or_default();
         let (path, query) = target.split_once('?').unwrap_or((target, ""));
         if let Some(id) = path.strip_prefix("/v1/poll/") {
@@ -377,27 +377,6 @@ impl Relay {
         }
     }
 
-    /// Where a peer counts: the address it connected from, or its proxy says it did.
-    fn address(&self, stream: &TcpStream, head: &str) -> IpAddr {
-        let forwarded = ws::header(head, "X-Forwarded-For")
-            .filter(|_| self.config.trust_forwarded)
-            .and_then(|value| value.rsplit(',').next()?.trim().parse().ok());
-        let ip = forwarded
-            .or_else(|| stream.peer_addr().ok().map(|address| address.ip()))
-            .unwrap_or(IpAddr::V4(Ipv4Addr::UNSPECIFIED));
-        match ip {
-            IpAddr::V6(v6) => match v6.to_ipv4_mapped() {
-                Some(v4) => IpAddr::V4(v4),
-                // One subscriber is usually given a whole /64.
-                None => {
-                    let [a, b, c, d, ..] = v6.segments();
-                    IpAddr::V6(Ipv6Addr::new(a, b, c, d, 0, 0, 0, 0))
-                }
-            },
-            v4 => v4,
-        }
-    }
-
     fn health(&self) -> String {
         let state = self.state.lock().unwrap();
         let peers: usize = state.rooms.values().map(|room| room.members.len()).sum();
@@ -1082,25 +1061,15 @@ mod tests {
 
     #[test]
     fn ipv6_addresses_count_by_their_64() {
-        let relay = Relay {
-            config: Config {
-                trust_forwarded: true,
-                ..Config::default()
-            },
-            state: Mutex::default(),
-            connections: AtomicUsize::new(0),
-            relayed: Default::default(),
-            started: Instant::now(),
-        };
         let listener = TcpListener::bind("127.0.0.1:0").unwrap();
         let stream = TcpStream::connect(listener.local_addr().unwrap()).unwrap();
         let head = "GET / HTTP/1.1\r\nX-Forwarded-For: 1.2.3.4, 2001:db8:1:2:3:4:5:6\r\n\r\n";
         assert_eq!(
-            relay.address(&stream, head),
+            crate::peer(&stream, head, true),
             "2001:db8:1:2::".parse::<IpAddr>().unwrap()
         );
         assert_eq!(
-            relay.address(&stream, "GET / HTTP/1.1\r\n\r\n"),
+            crate::peer(&stream, head, false),
             "127.0.0.1".parse::<IpAddr>().unwrap()
         );
     }
diff --git a/crates/relay/src/site.rs b/crates/relay/src/site.rs
index 82859137dbf357b74ad34ff130e88c8dfcd71779..f5ee35df29fcc5400350364ae505880d7a36c8b4 100644
--- a/crates/relay/src/site.rs
+++ b/crates/relay/src/site.rs
@@ -2,19 +2,28 @@
 //! and for a path that is a Live Share code (`/7KQ-4MZ-9XR`) a page that opens it in
 //! Snowbound, or in the web build where `Site::web` says it joins. A build's module and
 //! JavaScript sit in `b/<hash>/`, named by their contents, so they are kept for good;
-//! `index.html`, which names them, is checked on every load. GET and HEAD only; a proxy in
+//! `index.html`, which names them, is checked on every load. `POST /crash` keeps a crash
+//! report Snowbound sends as a file of its own; everything else is GET and HEAD. A proxy in
 //! front terminates TLS.
 
 use crate::{code, ws};
 use std::{
-    io::{self, BufReader, Write},
-    net::{TcpListener, TcpStream},
+    collections::{HashMap, VecDeque},
+    io::{self, BufReader, Read, Write},
+    net::{IpAddr, TcpListener, TcpStream},
     path::{Component, Path, PathBuf},
-    sync::Arc,
+    sync::{Arc, Mutex},
     thread,
-    time::Duration,
+    time::{Duration, Instant, SystemTime},
 };
 
+/// The largest crash report kept.
+pub const REPORT: usize = 64 << 10;
+/// Reports kept an hour from one address (an IPv6 /64), and from everyone.
+pub const PER_ADDRESS: usize = 10;
+pub const PER_HOUR: usize = 500;
+const HOUR: Duration = Duration::from_secs(60 * 60);
+
 /// What the site serves.
 #[derive(Clone, Debug)]
 pub struct Site {
@@ -23,32 +32,81 @@ pub struct Site {
     /// Where Open in Web goes, the code appended (`https://snowbound.paperclover.net/?join=`);
     /// none offers only Snowbound.
     pub web: Option<String>,
+    /// Where each crash report is kept, a file apiece.
+    pub crashes: PathBuf,
+    /// Counts senders by the address the proxy in front gives in `X-Forwarded-For`.
+    pub trust_forwarded: bool,
+}
+
+/// When the reports of the last hour came, by sender and in all.
+#[derive(Default)]
+struct Received {
+    by_address: HashMap<IpAddr, VecDeque<Instant>>,
+    all: VecDeque<Instant>,
+}
+
+impl Received {
+    /// Counts a report from `address` at `now`, unless it is one too many.
+    fn admit(&mut self, address: IpAddr, now: Instant) -> bool {
+        let recent = |times: &mut VecDeque<Instant>| {
+            while times.front().is_some_and(|&time| now - time >= HOUR) {
+                times.pop_front();
+            }
+        };
+        recent(&mut self.all);
+        self.by_address.retain(|_, times| {
+            recent(times);
+            !times.is_empty()
+        });
+        let sent = self.by_address.entry(address).or_default();
+        if sent.len() >= PER_ADDRESS || self.all.len() >= PER_HOUR {
+            return false;
+        }
+        sent.push_back(now);
+        self.all.push_back(now);
+        true
+    }
 }
 
 /// Serves `site` on `listener` until it fails.
 pub fn serve(listener: TcpListener, site: Site) -> io::Result<()> {
-    let site = Arc::new(site);
+    let shared = Arc::new((site, Mutex::default()));
     for stream in listener.incoming() {
         let Ok(stream) = stream else { continue };
-        let site = Arc::clone(&site);
+        let shared = Arc::clone(&shared);
         thread::spawn(move || {
-            let _ = answer(&site, stream);
+            let (site, received) = &*shared;
+            let _ = answer(site, received, stream);
         });
     }
     Ok(())
 }
 
-fn answer(site: &Site, stream: TcpStream) -> io::Result<()> {
+fn answer(site: &Site, received: &Mutex<Received>, stream: TcpStream) -> io::Result<()> {
     stream.set_read_timeout(Some(Duration::from_secs(10)))?;
     stream.set_write_timeout(Some(Duration::from_secs(30)))?;
-    let head = ws::head(&mut BufReader::new(&stream))?;
+    let mut reader = BufReader::new(&stream);
+    let head = ws::head(&mut reader)?;
     let mut words = head.split(' ');
     let (method, target) = (
         words.next().unwrap_or_default(),
         words.next().unwrap_or("/"),
     );
     let path = target.split(['?', '#']).next().unwrap_or("/");
-    let (status, kind, body) = if !matches!(method, "GET" | "HEAD") {
+    let (status, kind, body) = if (method, path) == ("POST", "/crash") {
+        let address = crate::peer(&stream, &head, site.trust_forwarded);
+        let admit = || {
+            received
+                .lock()
+                .is_ok_and(|mut received| received.admit(address, Instant::now()))
+        };
+        let status = keep_crash(&site.crashes, &head, &mut reader, admit);
+        (
+            status,
+            "text/plain",
+            format!("{}\n", &status[4..]).into_bytes(),
+        )
+    } else if !matches!(method, "GET" | "HEAD") {
         (
             "405 Method Not Allowed",
             "text/plain",
@@ -70,7 +128,7 @@ fn answer(site: &Site, stream: TcpStream) -> io::Result<()> {
             None => ("404 Not Found", "text/plain", b"Not found\n".to_vec()),
         }
     };
-    let cache = if !status.starts_with("200") || kind.starts_with("text/html") {
+    let cache = if method == "POST" || !status.starts_with("200") || kind.starts_with("text/html") {
         "no-cache"
     } else if path.starts_with("/b/") {
         "public, max-age=31536000, immutable"
@@ -91,6 +149,91 @@ fn answer(site: &Site, stream: TcpStream) -> io::Result<()> {
     Ok(())
 }
 
+/// Keeps the report a `POST /crash` with `head` brings in `reader` in `folder`, where it is
+/// small enough, plain text or JSON, and `admit` lets it in; answers the status.
+fn keep_crash(
+    folder: &Path,
+    head: &str,
+    reader: &mut impl Read,
+    admit: impl FnOnce() -> bool,
+) -> &'static str {
+    let kind = ws::header(head, "Content-Type").unwrap_or_default();
+    let kind = kind.split(';').next().unwrap_or_default().trim();
+    let extension = if kind.eq_ignore_ascii_case("text/plain") {
+        "txt"
+    } else if kind.eq_ignore_ascii_case("application/json") {
+        "json"
+    } else {
+        return "415 Unsupported Media Type";
+    };
+    if ws::header(head, "Transfer-Encoding").is_some() {
+        return "411 Length Required";
+    }
+    let Some(length) = ws::header(head, "Content-Length").and_then(|value| value.parse().ok())
+    else {
+        return "411 Length Required";
+    };
+    if length > REPORT {
+        return "413 Content Too Large";
+    }
+    if !admit() {
+        return "429 Too Many Requests";
+    }
+    let mut report = vec![0; length];
+    if reader.read_exact(&mut report).is_err() || std::str::from_utf8(&report).is_err() {
+        return "400 Bad Request";
+    }
+    let mut tag = [0; 4];
+    let _ = getrandom::fill(&mut tag);
+    let tag: String = tag.iter().map(|byte| format!("{byte:02x}")).collect();
+    let file = folder.join(format!(
+        "{}-{tag}.{extension}",
+        timestamp(SystemTime::now())
+    ));
+    let kept = std::fs::create_dir_all(folder).and_then(|()| {
+        std::fs::OpenOptions::new()
+            .write(true)
+            .create_new(true)
+            .open(&file)?
+            .write_all(&report)
+    });
+    match kept {
+        Ok(()) => "200 OK",
+        Err(error) => {
+            eprintln!("Cannot keep a crash report in {}: {error}", file.display());
+            "500 Internal Server Error"
+        }
+    }
+}
+
+/// `time` in UTC as `2026-10-03T21-04-05Z`, which sorts as it reads and names a file anywhere.
+fn timestamp(time: SystemTime) -> String {
+    let seconds = time
+        .duration_since(SystemTime::UNIX_EPOCH)
+        .map_or(0, |since| since.as_secs());
+    let (days, of_day) = (seconds / 86_400, seconds % 86_400);
+    // Howard Hinnant's civil_from_days, from 1970-01-01.
+    let shifted = days + 719_468;
+    let era = shifted / 146_097;
+    let of_era = shifted % 146_097;
+    let year_of_era = (of_era - of_era / 1_460 + of_era / 36_524 - of_era / 146_096) / 365;
+    let of_year = of_era - (365 * year_of_era + year_of_era / 4 - year_of_era / 100);
+    let month_index = (5 * of_year + 2) / 153;
+    let day = of_year - (153 * month_index + 2) / 5 + 1;
+    let month = if month_index < 10 {
+        month_index + 3
+    } else {
+        month_index - 9
+    };
+    let year = year_of_era + era * 400 + u64::from(month <= 2);
+    format!(
+        "{year:04}-{month:02}-{day:02}T{:02}-{:02}-{:02}Z",
+        of_day / 3_600,
+        of_day / 60 % 60,
+        of_day % 60
+    )
+}
+
 /// The file `path` names in `root`, `index.html` for a folder; none outside it.
 fn file(root: &Path, path: &str) -> Option<PathBuf> {
     let relative = Path::new(path.trim_start_matches('/'));
@@ -159,3 +302,16 @@ fn landing(shown: &str, site: &Site) -> String {
 "#
     )
 }
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    #[test]
+    fn timestamps_are_utc_dates_and_times() {
+        let at = |seconds| timestamp(SystemTime::UNIX_EPOCH + Duration::from_secs(seconds));
+        assert_eq!(at(0), "1970-01-01T00-00-00Z");
+        assert_eq!(at(951_782_400), "2000-02-29T00-00-00Z");
+        assert_eq!(at(1_791_072_245), "2026-10-04T00-04-05Z");
+    }
+}
diff --git a/crates/relay/src/site_main.rs b/crates/relay/src/site_main.rs
index 7d215f6594c74d6e350fef4b09e12c0466f00672..58225573712b41e48d91e8b0a71859a86fb29aea 100644
--- a/crates/relay/src/site_main.rs
+++ b/crates/relay/src/site_main.rs
@@ -6,13 +6,16 @@ use std::{net::TcpListener, path::PathBuf, process::ExitCode};
 const USAGE: &str = "\
 usage: snowbound-site [OPTION VALUE]...
 
-Each option may also come from the environment as SNOWBOUND_SITE_<OPTION>, upper case:
-SNOWBOUND_SITE_ROOT=/srv/snowbound/web. Flags win.
+Each option may also come from the environment as SNOWBOUND_SITE_<OPTION>, upper case with
+underscores: SNOWBOUND_SITE_ROOT=/srv/snowbound/web. Flags win.
 
   --listen ADDRESS    where to listen (127.0.0.1:23593)
   --root FOLDER       the web build's folder (web)
   --web URL           where Open in Web goes, the code appended, as
                       https://snowbound.paperclover.net/?join= (none: no Open in Web)
+  --crashes FOLDER    where crash reports are kept (crashes, beside the root)
+  --trust-forwarded true|false
+                      count senders by X-Forwarded-For, behind a proxy (false)
 ";
 
 fn main() -> ExitCode {
@@ -20,9 +23,13 @@ fn main() -> ExitCode {
     let mut site = Site {
         root: PathBuf::from("web"),
         web: None,
+        crashes: PathBuf::new(),
+        trust_forwarded: false,
     };
+    let mut crashes = None;
     let from_environment = std::env::vars().filter_map(|(key, value)| {
-        Some((key.strip_prefix("SNOWBOUND_SITE_")?.to_lowercase(), value))
+        let option = key.strip_prefix("SNOWBOUND_SITE_")?;
+        Some((option.to_lowercase().replace('_', "-"), value))
     });
     let mut arguments = std::env::args().skip(1);
     let mut from_flags = Vec::new();
@@ -42,12 +49,21 @@ fn main() -> ExitCode {
             "listen" => listen = value,
             "root" => site.root = PathBuf::from(value),
             "web" => site.web = Some(value).filter(|web| !web.is_empty()),
+            "crashes" => crashes = Some(PathBuf::from(value)),
+            "trust-forwarded" => match value.parse() {
+                Ok(trust) => site.trust_forwarded = trust,
+                Err(_) => {
+                    eprintln!("--trust-forwarded {value}: true or false\n\n{USAGE}");
+                    return ExitCode::from(2);
+                }
+            },
             _ => {
                 eprintln!("--{option}: no such option\n\n{USAGE}");
                 return ExitCode::from(2);
             }
         }
     }
+    site.crashes = crashes.unwrap_or_else(|| site.root.with_file_name("crashes"));
     let listener = match TcpListener::bind(&listen) {
         Ok(listener) => listener,
         Err(error) => {
diff --git a/crates/relay/tests/site.rs b/crates/relay/tests/site.rs
index a39f43a4d4b693b63f230d89ec869afc708e0a9a..f272d101467b3522634d4becf4a86e6e82f9064c 100644
--- a/crates/relay/tests/site.rs
+++ b/crates/relay/tests/site.rs
@@ -1,4 +1,5 @@
-//! The site as shipped: a code's page, the web build's files, nothing outside them.
+//! The site as shipped: a code's page, the web build's files, nothing outside them, and crash
+//! reports kept.
 
 use std::{
     io::{BufRead, BufReader, Read, Write},
@@ -36,11 +37,26 @@ impl Site {
     }
 
     fn get(&self, path: &str) -> String {
+        self.send(format!("GET {path} HTTP/1.1\r\nHost: site\r\n\r\n").as_bytes())
+    }
+
+    /// The status line answering a crash report of `body` as `kind`, with `extra` headers.
+    fn report(&self, kind: &str, body: &str, extra: &str) -> String {
+        let request = format!(
+            "POST /crash HTTP/1.1\r\nHost: site\r\nContent-Type: {kind}\r\nContent-Length: {}\r\n{extra}\r\n{body}",
+            body.len()
+        );
+        let response = self.send(request.as_bytes());
+        assert!(!response.contains(body), "{response}");
+        response.lines().next().unwrap().to_owned()
+    }
+
+    fn send(&self, request: &[u8]) -> String {
         let mut stream = TcpStream::connect(self.address).unwrap();
-        write!(stream, "GET {path} HTTP/1.1\r\nHost: site\r\n\r\n").unwrap();
-        let mut response = String::new();
-        stream.read_to_string(&mut response).unwrap();
-        response
+        stream.write_all(request).unwrap();
+        let mut response = Vec::new();
+        let _ = stream.read_to_end(&mut response);
+        String::from_utf8_lossy(&response).into_owned()
     }
 }
 
@@ -105,3 +121,77 @@ fn a_code_gets_its_page_and_the_web_build_its_files() {
         "{page}"
     );
 }
+
+#[test]
+fn crash_reports_are_kept_small_and_few_and_never_echoed() {
+    let folder = tempfile::tempdir().unwrap();
+    let root = folder.path().join("web");
+    std::fs::create_dir_all(&root).unwrap();
+    let site = Site::start(&root, &["--trust-forwarded", "true"]);
+    let report = "Snowbound 2026-10-03-r46\npanicked at crates/canvas/src/view.rs:1:1";
+    assert_eq!(
+        site.report("text/plain; charset=utf-8", report, ""),
+        "HTTP/1.1 200 OK"
+    );
+    // Kept beside the root, as sent, under a name that sorts by when it came.
+    let crashes = folder.path().join("crashes");
+    let kept: Vec<_> = std::fs::read_dir(&crashes)
+        .unwrap()
+        .map(|entry| entry.unwrap().path())
+        .collect();
+    assert_eq!(kept.len(), 1);
+    assert_eq!(std::fs::read_to_string(&kept[0]).unwrap(), report);
+    let name = kept[0].file_name().unwrap().to_str().unwrap();
+    assert!(name.starts_with("20") && name.ends_with(".txt"), "{name}");
+
+    assert_eq!(
+        site.report("application/json", r#"{"panic":"x"}"#, ""),
+        "HTTP/1.1 200 OK"
+    );
+    assert_eq!(
+        site.report("text/html", "<p>no</p>", ""),
+        "HTTP/1.1 415 Unsupported Media Type"
+    );
+    // Refused from its head alone, before any of it is read.
+    let large = site.send(
+        format!(
+            "POST /crash HTTP/1.1\r\nContent-Type: text/plain\r\nContent-Length: {}\r\n\r\n",
+            relay::site::REPORT + 1
+        )
+        .as_bytes(),
+    );
+    assert!(large.starts_with("HTTP/1.1 413"), "{large}");
+    let chunked = site.send(
+        b"POST /crash HTTP/1.1\r\nContent-Type: text/plain\r\nTransfer-Encoding: chunked\r\n\r\n3\r\nabc\r\n0\r\n\r\n",
+    );
+    assert!(chunked.starts_with("HTTP/1.1 411"), "{chunked}");
+    assert_eq!(site.report("text/plain", "\u{fffd}", ""), "HTTP/1.1 200 OK");
+    let invalid = site.send(
+        b"POST /crash HTTP/1.1\r\nContent-Type: text/plain\r\nContent-Length: 2\r\n\r\n\xff\xfe",
+    );
+    assert!(invalid.starts_with("HTTP/1.1 400"), "{invalid}");
+
+    // One sender is held to a few an hour; another, by the proxy's word, still gets in.
+    let sent = (0..relay::site::PER_ADDRESS)
+        .map(|_| site.report("text/plain", "again", ""))
+        .filter(|status| status == "HTTP/1.1 200 OK")
+        .count();
+    assert_eq!(sent, relay::site::PER_ADDRESS - 4);
+    assert_eq!(
+        site.report("text/plain", "again", ""),
+        "HTTP/1.1 429 Too Many Requests"
+    );
+    assert_eq!(
+        site.report(
+            "text/plain",
+            "elsewhere",
+            "X-Forwarded-For: 203.0.113.9\r\n"
+        ),
+        "HTTP/1.1 200 OK"
+    );
+    assert_eq!(
+        std::fs::read_dir(&crashes).unwrap().count(),
+        relay::site::PER_ADDRESS
+    );
+    assert!(site.get("/crash").starts_with("HTTP/1.1 404"));
+}
-- 
2.54.0