README and SPEC say a client too slow to send its request line and headers may get 400 (closes #138)

A client too slow to send its request line and headers within
SWWAF_CLIENT_REQUEST_TIMEOUT gets either no answer or, depending on how
much of them had arrived, 400 Bad Request from Go's server; either way
its connection is closed, nothing reaches the app, and no request log
line is written. The README's "Request log" and SPEC's size and time
limits said such a client always gets no answer. Both documents'
summaries of smallwebwaf's own answers now cover only limits passed
after the request line and headers have been read, and give 408 only
for a slow body; SPEC names Go's server as the one answering 431.

Model: opus-5-5

README.md

@@ -110,16 +110,16 @@ in `bin/state` unless `SWWAF_STATE_DIR` is set, and the default rule file of
   `X-Forwarded-Proto`, and `X-Forwarded-For` with the peer added at the end. It
   also gets the request's id in `X-Request-ID`, the same id as in the request's
   log line (see `request_id` in "Request log" below).
-- Enforces the timeouts and the size limits below. A limit passed before the
+- Enforces the timeouts and the size limits below. Once a request's line and
-  response has started gets `smallwebwaf`'s own answer: `408` for a client too
+  headers have been read, a limit passed before the response has started gets
-  slow to send its body, `413` for a request body that is too large, `504` for
+  `smallwebwaf`'s own answer: `408` for a client too slow to send its body,
-  an app too slow to answer, and `502` for a response that is too large or an
+  `413` for a request body that is too large, `504` for an app too slow to
-  app that cannot be reached. A request that announces a body over the limit is
+  answer, and `502` for a response that is too large or an app that cannot be
-  refused before anything reaches the app. While a request body is still on its
+  reached. A request that announces a body over the limit is refused before
-  way, a request timeout that runs out answers `408` if `smallwebwaf` was
+  anything reaches the app. While a request body is still on its way, a request
-  waiting for the client to send more, and `504` if it was waiting for the app
+  timeout that runs out answers `408` if `smallwebwaf` was waiting for the
-  to take what it had. Once the response has started, a limit can only cut the
+  client to send more, and `504` if it was waiting for the app to take what it
-  connection.
+  had. Once the response has started, a limit can only cut the connection.
 - Counts each client's requests over a minute, an hour and a day. A request that
   takes the client over one of the rate limits below is refused with
   `SWWAF_BAN_RESPONSE`, `403` by default, before anything reaches the app, and

SPEC.md

@@ -414,10 +414,10 @@ The settings, by group:
       to send its request line and headers, and then, from the end of the
       headers, its body.
     - `SWWAF_CLIENT_REQUEST_HEADER_MAX_BYTES` (default `32K`): the largest
-      request line and headers a client may send. Over it, `smallwebwaf` answers
+      request line and headers a client may send. Over it, Go's HTTP server
-      `431` and closes the connection, and nothing reaches the app. It must be
+      answers `431` and closes the connection, and nothing reaches the app. It
-      more than `4K`, and cannot be `off`: Go's HTTP server always has such a
+      must be more than `4K`, and cannot be `off`: Go's HTTP server always has
-      limit, and reads 4 KiB past the one it is given before it refuses.
+      such a limit, and reads 4 KiB past the one it is given before it refuses.
     - `SWWAF_CLIENT_IDLE_TIMEOUT` (default `120s`): how long a kept-open
       connection may wait for its next request before `smallwebwaf` closes it.
       It is longer than the 90 seconds after which traefik, by default, closes a
@@ -435,12 +435,13 @@ The settings, by group:
       the client sends it and the app receives it.
     - `SWWAF_RESPONSE_MAX_BYTES` (default `5G`): the largest response body, as
       the app sends it and the client receives it.
-    - When a limit is passed before the response has started, `smallwebwaf`
+    - When a limit is passed after a request's line and headers have been read,
-      answers itself: `413` for a request body that is too large, `408` for a
+      but before the response has started, `smallwebwaf` answers itself: `413`
-      client too slow to send its body, `502` for a response that is too large,
+      for a request body that is too large, `408` for a client too slow to send
-      `504` for an app that is too slow. A request that announces a body larger
+      its body, `502` for a response that is too large, `504` for an app that is
-      than its limit is refused before anything reaches the app. Once the
+      too slow. A request that announces a body larger than its limit is refused
-      response has started it can only be cut off, and the connection is closed.
+      before anything reaches the app. Once the response has started it can only
+      be cut off, and the connection is closed.
     - Since a request body streams through, each side can hold up the other: a
       slow client slows the send to the app, and an app slow to take the body
       slows the client's send. So while a request body is still on its way, a