README and SPEC say a client too slow to send its request line and headers may get 400 (closes #138)

A client too slow to send its request line and headers within
SWWAF_CLIENT_REQUEST_TIMEOUT gets either no answer or, depending on how
much of them had arrived, 400 Bad Request from Go's server; either way
its connection is closed, nothing reaches the app, and no request log
line is written. The README's "Request log" and SPEC's size and time
limits said such a client always gets no answer. Both documents'
summaries of answers gave 408 for any slow client, when it is only for
a slow body.

Model: opus-5-5

README.md

@@ -112,11 +112,11 @@ in `bin/state` unless `SWWAF_STATE_DIR` is set, and the default rule file of
   log line (see `request_id` in "Request log" below).
 - Enforces the timeouts and the size limits below. A limit passed before the
   response has started gets `smallwebwaf`'s own answer: `408` for a client too
-  slow to send its request, `413` for a request body that is too large, `504`
+  slow to send its body, `413` for a request body that is too large, `504` for
-  for an app too slow to answer, and `502` for a response that is too large or
+  an app too slow to answer, and `502` for a response that is too large or an
-  an app that cannot be reached. A request that announces a body over the limit
+  app that cannot be reached. A request that announces a body over the limit is
-  is refused before anything reaches the app. While a request body is still on
+  refused before anything reaches the app. While a request body is still on its
-  its way, a request timeout that runs out answers `408` if `smallwebwaf` was
+  way, a request timeout that runs out answers `408` if `smallwebwaf` was
   waiting for the client to send more, and `504` if it was waiting for the app
   to take what it had. Once the response has started, a limit can only cut the
   connection.
@@ -1042,9 +1042,12 @@ less severe than `SWWAF_LOG_LEVEL` are not written.
 Go's HTTP server, on which `smallwebwaf` is built, reads a request's line and
 headers before `smallwebwaf` sees the request, and some requests end there,
 without a line in the log: headers over `SWWAF_CLIENT_REQUEST_HEADER_MAX_BYTES`,
-which it answers `431`, headers slower than `SWWAF_CLIENT_REQUEST_TIMEOUT`,
+which it answers `431`, and requests it cannot read at all, which it answers
-whose connection it closes without an answer, and requests it cannot read at
+itself, mostly with `400`. A client too slow to send its request line and
-all, which it answers itself, mostly with `400`.
+headers within `SWWAF_CLIENT_REQUEST_TIMEOUT` gets either no answer or,
+depending on how much of them had arrived, `400 Bad Request` from the server;
+either way the server closes its connection, nothing reaches the app, and no
+line is written in the log.
 
 ### Sending the log to a syslog server
 

SPEC.md

@@ -437,10 +437,10 @@ The settings, by group:
       the app sends it and the client receives it.
     - When a limit is passed before the response has started, `smallwebwaf`
       answers itself: `413` for a request body that is too large, `408` for a
-      client that is too slow, `502` for a response that is too large, `504` for
+      client too slow to send its body, `502` for a response that is too large,
-      an app that is too slow. A request that announces a body larger than its
+      `504` for an app that is too slow. A request that announces a body larger
-      limit is refused before anything reaches the app. Once the response has
+      than its limit is refused before anything reaches the app. Once the
-      started it can only be cut off, and the connection is closed.
+      response has started it can only be cut off, and the connection is closed.
     - Since a request body streams through, each side can hold up the other: a
       slow client slows the send to the app, and an app slow to take the body
       slows the client's send. So while a request body is still on its way, a
@@ -450,10 +450,12 @@ The settings, by group:
       waiting for the app to take what it had.
     - Go's HTTP server, on which `smallwebwaf` is built, reads a request's line
       and headers before `smallwebwaf` sees the request. A client that takes
-      longer than `SWWAF_CLIENT_REQUEST_TIMEOUT` to send them gets no answer:
+      longer than `SWWAF_CLIENT_REQUEST_TIMEOUT` to send them gets either no
-      the server closes its connection. Headers over
+      answer or, depending on how much of them had arrived, `400 Bad Request`
-      `SWWAF_CLIENT_REQUEST_HEADER_MAX_BYTES` are answered `431` by the server
+      from the server; either way the server closes its connection and nothing
-      itself. Neither request gets a line in the request log.
+      reaches the app. Headers over `SWWAF_CLIENT_REQUEST_HEADER_MAX_BYTES` are
+      answered `431` by the server itself. Neither request gets a line in the
+      request log.
     - A WebSocket connection leaves these limits behind once it is upgraded: it
       stays open until either side closes it.
 - Lookup of AS number and country (R7). On by default through GeoJS, which needs