diff --git a/README.md b/README.md
index 3d706dc..6313b96 100644
--- a/README.md
+++ b/README.md
@@ -112,11 +112,11 @@ in `bin/state` unless `SWWAF_STATE_DIR` is set, and the default rule file of
   log line (see `request_id` in "Request log" below).
 - Enforces the timeouts and the size limits below. A limit passed before the
   response has started gets `smallwebwaf`'s own answer: `408` for a client too
-  slow to send its request, `413` for a request body that is too large, `504`
-  for an app too slow to answer, and `502` for a response that is too large or
-  an app that cannot be reached. A request that announces a body over the limit
-  is refused before anything reaches the app. While a request body is still on
-  its way, a request timeout that runs out answers `408` if `smallwebwaf` was
+  slow to send its body, `413` for a request body that is too large, `504` for
+  an app too slow to answer, and `502` for a response that is too large or an
+  app that cannot be reached. A request that announces a body over the limit is
+  refused before anything reaches the app. While a request body is still on its
+  way, a request timeout that runs out answers `408` if `smallwebwaf` was
   waiting for the client to send more, and `504` if it was waiting for the app
   to take what it had. Once the response has started, a limit can only cut the
   connection.
@@ -1042,9 +1042,13 @@ less severe than `SWWAF_LOG_LEVEL` are not written.
 Go's HTTP server, on which `smallwebwaf` is built, reads a request's line and
 headers before `smallwebwaf` sees the request, and some requests end there,
 without a line in the log: headers over `SWWAF_CLIENT_REQUEST_HEADER_MAX_BYTES`,
-which it answers `431`, headers slower than `SWWAF_CLIENT_REQUEST_TIMEOUT`,
-whose connection it closes without an answer, and requests it cannot read at
-all, which it answers itself, mostly with `400`.
+which it answers `431`, requests it cannot read at all, which it answers itself,
+mostly with `400`, and a request line and headers slower than
+`SWWAF_CLIENT_REQUEST_TIMEOUT`. When that time runs out, the server takes what
+has arrived of the line it is reading for the whole line, and answers `400` if
+that is not a line it can read, as for a request line cut before the end of its
+HTTP version or a header cut before its colon. Otherwise, as for a client that
+stops at the end of a line, it closes the connection without an answer.
 
 ### Sending the log to a syslog server
 
diff --git a/SPEC.md b/SPEC.md
index c6e8fb3..9f39eef 100644
--- a/SPEC.md
+++ b/SPEC.md
@@ -449,11 +449,15 @@ The settings, by group:
       waiting for the client to send more at that moment, and `504` if it was
       waiting for the app to take what it had.
     - Go's HTTP server, on which `smallwebwaf` is built, reads a request's line
-      and headers before `smallwebwaf` sees the request. A client that takes
-      longer than `SWWAF_CLIENT_REQUEST_TIMEOUT` to send them gets no answer:
-      the server closes its connection. Headers over
+      and headers before `smallwebwaf` sees the request. When
+      `SWWAF_CLIENT_REQUEST_TIMEOUT` runs out before they have all arrived, the
+      server takes what has arrived of the line it is reading for the whole
+      line, and answers `400` if that is not a line it can read, as for a
+      request line cut before the end of its HTTP version or a header cut before
+      its colon. Otherwise, as for a client that stops at the end of a line, it
+      closes the connection without an answer. Headers over
       `SWWAF_CLIENT_REQUEST_HEADER_MAX_BYTES` are answered `431` by the server
-      itself. Neither request gets a line in the request log.
+      itself. None of these requests gets a line in the request log.
     - A WebSocket connection leaves these limits behind once it is upgraded: it
       stays open until either side closes it.
 - Lookup of AS number and country (R7). On by default through GeoJS, which needs