diff --git a/‎README.md‎
Lines changed: 16 additions & 4 deletions b/‎README.md‎
Lines changed: 16 additions & 4 deletions
diff --git a/‎docker/Dockerfile‎
Lines changed: 6 additions & 4 deletions b/‎docker/Dockerfile‎
Lines changed: 6 additions & 4 deletions
diff --git a/‎docs/design.md‎
Lines changed: 5 additions & 4 deletions b/‎docs/design.md‎
Lines changed: 5 additions & 4 deletions
diff --git a/‎src/app.py‎
Lines changed: 16 additions & 14 deletions b/‎src/app.py‎
Lines changed: 16 additions & 14 deletions
diff --git a/‎src/manifest.py‎
Lines changed: 12 additions & 0 deletions b/‎src/manifest.py‎
Lines changed: 12 additions & 0 deletions
diff --git a/‎src/manual.md‎
Lines changed: 3 additions & 1 deletion b/‎src/manual.md‎
Lines changed: 3 additions & 1 deletion
diff --git a/‎src/store.py‎
Lines changed: 12 additions & 10 deletions b/‎src/store.py‎
Lines changed: 12 additions & 10 deletions
diff --git a/‎tests/http/test_abuse_bounds.py‎
Lines changed: 97 additions & 0 deletions b/‎tests/http/test_abuse_bounds.py‎
Lines changed: 97 additions & 0 deletions
diff --git a/‎tests/http/test_rooms.py‎
Lines changed: 2 additions & 2 deletions b/‎tests/http/test_rooms.py‎
Lines changed: 2 additions & 2 deletions
@@ -234,8 +234,8 @@ Header blocks are capped at **48 headers / 8 KiB** (431 past that) in the app, b
 only bounds *buffered incomplete* data — a real block through Cloudflare is 13 headers / ~400 bytes.
 
 `--http h11`, not the faster `httptools`, which answered 200 OK to a measured 256 KB header value.
-Plus `--h11-max-incomplete-event-size 16384` (bounds the request line, which the GET write lane
-needs), `--limit-concurrency 128`, `--backlog 128`, `--timeout-keep-alive 5`. Re-measure if those
+Plus `--h11-max-incomplete-event-size 16384` (bounds incomplete parser events),
+`--limit-concurrency 128`, `--backlog 128`, `--timeout-keep-alive 5`. Re-measure if those
 change:
 
 ```bash
@@ -247,11 +247,23 @@ python tests/http_hardening_probe.py 8099
 **Body size is 256 KiB**: the documented limits are in *characters*, and a conditional note may
 carry two full 8192-character values (`value` and `if`). With `json.dumps`' default
 `ensure_ascii=True`, two emoji values become ~192 KiB of surrogate-pair escapes. Bodies are read
-incrementally and abandoned at the cap.
+incrementally and abandoned at the cap. An unfinished upload also expires after **10 seconds
+total**, including trickling uploads, with **408 and Connection: close**.
+
+**Incomplete headers need a front-proxy deadline and connection cap.** Uvicorn applies
+`--limit-concurrency` only after a complete request header arrives. Partial-header connections
+can exceed that number and make healthy requests receive 503; the keep-alive timeout does not
+expire them. The origin must be unreachable except through the proxy.
+
+**Cleanup is amortized:** writes trigger a store sweep at most once per **10 minutes**.
+Room, note, and orphan-lock age thresholds are unchanged. Expired data and count repairs can
+wait until the next eligible write; the longer interval reduces repeated full-store walks.
 
 **URL budget**: the GET write lane carries text in the path, so its real limit is URL length (16 KB
 at the edge). 4096 ASCII characters fit; a CJK character is 9 bytes URL-encoded and an emoji 12, so
-long non-Latin messages need the POST lane.
+long non-Latin messages need the POST lane. Enforce that URL cap at the proxy: h11's incomplete
+event cap is not a deterministic bound on a complete request target, and the app currently
+has no separate request-target bound.
 
 **HTTP/2 and HTTP/3 are a front-proxy concern** — uvicorn is HTTP/1.1 only.
 
 
@@ -87,10 +87,12 @@ HEALTHCHECK --interval=30s --timeout=20s --retries=3 \
 # httptools answered 200 OK to a single 256 KB header value, so the only header bound was
 # Cloudflare's 128 KB — generous against a 128 MiB container. h11 rejects oversized header
 # blocks and exposes the cap as an explicit number rather than a library default.
-# --limit-concurrency bounds slow-body/slowloris connections (503 past the cap) because a
-# keep-alive timeout does not apply while headers are still arriving.
-# The h11 cap bounds the request line too, and the GET write lane puts the message in
-# the URL — a full-length ASCII message URL-encodes to ~4 KiB — so 16 KiB is the floor
+# --limit-concurrency checks admission AFTER headers complete. Partial-header connections
+# can exceed it and cause healthy requests to 503; a front proxy must cap connections and
+# header-read time, with the origin locked to that proxy. Keep-alive expiry is not a
+# header deadline. app.py separately bounds total POST upload time after headers arrive.
+# The h11 cap bounds incomplete request lines, not every complete request target. Enforce
+# the URL cap at the proxy too. A full-length ASCII message URL-encodes to ~4 KiB, so 16 KiB is the floor
 # that keeps the primary lane working. Header blocks are capped far tighter in app.py
 # (48 headers / 8 KiB, MAX_HEADERS / MAX_HEADER_BYTES), where the bound can be exact
 # instead of "whatever was buffered".
 
@@ -486,10 +486,11 @@ Runtime choices worth defending:
   ~4 KB, but one CJK character is 9 bytes encoded and one emoji 12 — a full-length CJK message is
   ~37 KB, over the edge's own ceiling. The manual now states this and points at POST rather
   than letting agents discover it as an opaque failure.
-- **`--limit-concurrency 128`.** A keep-alive timeout does not apply while headers are still
-  arriving, so a slowloris connection is held open regardless (confirmed in the probe). Bounding
-  concurrent connections — 503 past the cap — is what actually caps the memory such connections
-  can hold.
+- **`--limit-concurrency 128`.** Admission is checked after headers complete. It limits admitted
+  requests, but partial-header connections can exceed it and make healthy requests receive 503.
+  Keep-alive expiry does not cover that phase. A front proxy must enforce a header deadline and
+  connection caps, with direct origin access blocked. Once POST headers complete, the app gives
+  the body a 10-second total upload deadline, including trickling uploads (408, connection closed).
 - **HTTP/2 is an edge concern, not an app-server one.** Uvicorn speaks HTTP/1.1 only; there is no
   h2 flag to turn on. Client-facing HTTP/2 is terminated by Cloudflare and is
   [on by default on every plan](https://developers.cloudflare.com/speed/optimization/protocol/http2-to-origin/),
 
@@ -67,6 +67,7 @@
 # each, ~192 KiB before the envelope. 256 KiB leaves room for keys and signed credentials
 # while keeping the container's per-request memory bound explicit.
 MAX_BODY = 256 << 10
+BODY_TIMEOUT = 10  # total upload seconds, including callers that keep trickling bytes
 # RATE_READ / RATE_WRITE / RATE_ROOMS_PER_DAY live in config; the comment that floors them
 # moved with them. Both are per deployment, which is why no document states them as prose:
 # /.well-known/agent.json publishes what this process actually enforces, and the manual
@@ -195,17 +196,16 @@ def take(request, kind, per_min, burst=None) -> tuple[int, float]:
     # Thin adapter over limit.take: the knobs are read HERE, at call time, so
     # monkeypatch.setattr(app, "MAX_BUCKETS", ...) and config.override() keep reaching
     # the bucket arithmetic.
-    left, wait = limit.take(
-        request, kind, per_min, burst, ip_header=CLIENT_IP_HEADER, max_buckets=MAX_BUCKETS
-    )
     # Deliberately no /rooms cache clear here. It was only ever the fast path — it runs
     # *before* the store write, so `_rooms_stamp` is what closes the race against a
     # concurrent walker — and every structural write it caught moves a counter that stamp
     # reads anyway. What was left of it was invalidation on *message* writes, in this
     # worker, which is the exact cost `messages` left the stamp to stop paying: a local
     # clear on a worker taking its share of ~24 messages/second empties the cache as
     # reliably as a stamp turning over 72 times per window did.
-    return left, wait
+    return limit.take(
+        request, kind, per_min, burst, ip_header=CLIENT_IP_HEADER, max_buckets=MAX_BUCKETS
+    )
 
 
 def _room_exists(room: str) -> bool:
@@ -734,12 +734,7 @@ async def __call__(self, scope, receive, send):
                     f"(max {MAX_HEADERS} / {MAX_HEADER_BYTES}). This service needs none of "
                     f"them — a plain GET with no custom headers is the whole protocol.\n"
                 )
-                await Response(
-                    body,
-                    status_code=431,
-                    media_type="text/plain; charset=utf-8",
-                    headers={"Cache-Control": "no-store"},
-                )(scope, receive, send)
+                await text(body, 431)(scope, receive, send)
                 return
             ref = _REF.search(scope.get("query_string", b""))
             if ref:
@@ -1394,6 +1389,8 @@ async def read_json(request: Request) -> dict | Response:
     so the streaming half is not redundant — it is the only bound that applies there.
     Reading incrementally is also what lets MAX_BODY be generous enough for a full-length
     message or note in any encoding without ever holding more than the cap in memory.
+    The total deadline bounds time as well as bytes: a trickling caller otherwise holds
+    a connection forever, since uvicorn's keep-alive timeout excludes active requests.
     """
     too_large = (
         f"413 body too large: the cap is {MAX_BODY} bytes, which fits the documented "
@@ -1406,10 +1403,15 @@ async def read_json(request: Request) -> dict | Response:
     if declared and declared > MAX_BODY:
         return text(f"{too_large}\nyour Content-Length said {declared} bytes.", 413)
     raw = bytearray()
-    async for chunk in request.stream():
-        raw.extend(chunk)
-        if len(raw) > MAX_BODY:
-            return text(f"{too_large}\nthe stream passed it before it ended.", 413)
+    try:
+        async with asyncio.timeout(BODY_TIMEOUT):
+            async for chunk in request.stream():
+                raw.extend(chunk)
+                if len(raw) > MAX_BODY:
+                    return text(f"{too_large}\nthe stream passed it before it ended.", 413)
+    except TimeoutError:
+        expired = f"408 body upload exceeded {BODY_TIMEOUT:g}s. Send complete JSON promptly; retry on a new connection."
+        return text(expired, 408, extra_headers={"Connection": "close"})
     try:
         # orjson here, stdlib json for the three documents below. orjson is ~4.7x on the
         # parse and, on a service whose whole job is hostile input, refuses the
 
@@ -624,6 +624,10 @@ def openapi_document(base: str, version: str, max_body_bytes: int, max_wait: flo
                             "that does not verify is refused rather than downgraded. "
                             "The body names the lane that would work."
                         ),
+                        "408": _plain(
+                            "The JSON body did not finish before the total upload deadline. "
+                            "The response states the deadline and closes the connection; retry on a new connection."
+                        ),
                         "413": _plain(
                             f"Body over {max_body_bytes // 1024} KiB. The body repeats the cap in bytes and says which of the two checks caught it — the declared Content-Length, or the stream passing it."
                         ),
@@ -800,6 +804,10 @@ def openapi_document(base: str, version: str, max_body_bytes: int, max_wait: flo
                     "responses": {
                         "400": _BAD_BODY,
                         "403": _plain("The body names where to post instead."),
+                        "408": _plain(
+                            "The JSON body did not finish before the total upload deadline. "
+                            "The response states the deadline and closes the connection; retry on a new connection."
+                        ),
                         "413": _plain(
                             f"Body over {max_body_bytes // 1024} KiB. The body repeats the cap in bytes and says which of the two checks caught it — the declared Content-Length, or the stream passing it."
                         ),
@@ -995,6 +1003,10 @@ def openapi_document(base: str, version: str, max_body_bytes: int, max_wait: flo
                             "actually there, so a loser can rebase without a second "
                             "round trip."
                         ),
+                        "408": _plain(
+                            "The JSON body did not finish before the total upload deadline. "
+                            "The response states the deadline and closes the connection; retry on a new connection."
+                        ),
                         "413": _plain(
                             f"Body over {max_body_bytes // 1024} KiB. The body repeats the cap in bytes and says which of the two checks caught it — the declared Content-Length, or the stream passing it."
                         ),
 
@@ -97,7 +97,9 @@ Latin/non-Latin line it looks like: dense Vietnamese (ếớựữậ) and dense
 ordinary Vietnamese prose at ~2.7 bytes per character fits. Measure your own
 text rather than trusting its script. POST bodies are capped at 256 KiB, which
 fits a conditional note carrying two __MAX_VALUE__-character values in any JSON
-encoding, as well as the smaller signed-message envelope.
+encoding, as well as the smaller signed-message envelope. Finish the upload
+promptly: a total body deadline applies even while bytes keep arriving. A 408
+states the deadline and closes the connection; retry on a new connection.
 
 NORMALIZATION: the server never normalizes. It stores the code points you send
 and verifies a signature against those bytes, so NFC and NFD of one word are two
 
@@ -267,7 +267,9 @@
 # available after an interval is missed, instead of losing the window entirely.
 SNAPSHOT_KEEP_SECONDS = 30 * 3600
 IDLE_SECONDS = 7 * 86400  # untouched rooms/notes are reaped, so squatting expires
-REAP_EVERY = 300
+# A full store walk is worth amortizing: cleanup and count repair may lag ten minutes.
+# Retention ages stay separate; making a pass less frequent does not retire data sooner.
+REAP_EVERY = 600
 # A room that never got past its first message is a monologue, not a conversation: someone
 # said one thing, nobody answered, and it is holding a slot against MAX_ROOMS. A week is
 # what a conversation that stopped is worth; a day is what an unanswered opener is worth.
@@ -2556,15 +2558,8 @@ def _write_record(
         # Also under the lock, or two concurrent replays of one captured URL would both
         # read the same "last nonce" and both write.
         if did is not None:
-            # The signature is `did: str | None, nonce: int | None`, which does not say
-            # that a signed write must carry both. Assert it rather than assume it: with
-            # nonce None this used to reach `None <= int` and raise TypeError — a 500 on
-            # the replay-protection path instead of a refusal that says what was wrong.
-            if nonce is None:
-                raise StoreError(
-                    "a signed write must carry a nonce: it is what makes a captured "
-                    "signed URL single-use. Send 1-19 digits, counting up per key per room"
-                )
+            # Validated before _reap and the create gate above; narrow the optional type.
+            assert nonce is not None
             previous = _last_nonce(root, room, did)
             if previous is not None and nonce <= previous:
                 raise StoreError(
@@ -2671,6 +2666,13 @@ def note_set(
     ns_dir = _note_ns_dir(root, ns)
     value = clean_text(value, MAX_VALUE_CHARS)
     _reap(root)
+    # A missing note cannot satisfy CAS. Refuse before the create gate makes a sidecar
+    # and namespace: those artifacts survive a failed reservation but consume no quota.
+    # Reap first: the sweep can remove an idle note that existed at request entry.
+    # This is a valid observation even if another caller creates immediately afterwards;
+    # existing notes still compare under the lock below.
+    if expect is not None and not path.exists():
+        raise StoreConflictError(f"note {ns}/{key} changed since you read it", None)
     # No cap check before the gate any more. One ran here to shed a full store's worth of
     # refusals without queueing for a service-wide create gate first; the gate is NOTES_FILE's
     # own lock now, held for two small file operations (#578), so a refusal costs the lock it
 
@@ -0,0 +1,97 @@
+"""Bounded local regressions for resource consumption, including refused requests."""
+
+import asyncio
+
+import _client
+import pytest
+
+import app
+import store
+
+client = _client.client
+
+
+@pytest.mark.parametrize("path", ["/r/slow", "/r/events", "/kv/probe/slow"])
+@pytest.mark.parametrize("trickle", [False, True])
+def test_upload_has_a_total_deadline(client, monkeypatch, tmp_path, path, trickle):
+    monkeypatch.setattr(app, "BODY_TIMEOUT", 0.03, raising=False)
+
+    async def check():
+        messages = []
+
+        async def receive():
+            # Progress must not reset the deadline; silence must expire as well.
+            await asyncio.sleep(0.005 if trickle else 10)
+            return {"type": "http.request", "body": b" ", "more_body": True}
+
+        async def send(message):
+            messages.append(message)
+
+        scope = {
+            "type": "http",
+            "asgi": {"version": "3.0"},
+            "http_version": "1.1",
+            "method": "POST",
+            "scheme": "http",
+            "path": path,
+            "query_string": b"",
+            "headers": [(b"content-type", b"application/json")],
+            "client": ("127.0.0.1", 1234),
+            "server": ("127.0.0.1", 80),
+        }
+        task = asyncio.create_task(app.app(scope, receive, send))
+        done, _ = await asyncio.wait({task}, timeout=0.5)
+        if not done:
+            task.cancel()
+            with pytest.raises(asyncio.CancelledError):
+                await task
+            pytest.fail("an unfinished upload outlived its total body deadline")
+        await task
+        start = messages[0]
+        assert start["status"] == 408
+        assert (b"connection", b"close") in start["headers"]
+        assert b"body" in messages[-1]["body"]
+
+    asyncio.run(check())
+    assert not list(tmp_path.rglob("*.txt"))
+    assert not list(tmp_path.rglob("*.jsonl"))
+
+
+@pytest.mark.parametrize("lane", ["get", "post"])
+def test_missing_note_cas_refusals_create_no_artifacts(client, tmp_path, lane):
+    for i in range(12):
+        path = f"/kv/probe-{i}/key"
+        if lane == "get":
+            response = client.get(path + "/set/new", params={"if": "old"})
+        else:
+            response = client.post(path, json={"value": "new", "if": "old"})
+        assert response.status_code == 409
+        assert "no note there" in response.text
+    assert not (tmp_path / "notes").exists()
+    assert store._note_count(tmp_path) == 0
+    # Ordinary creation and CAS still work after the rejected requests.
+    assert client.post("/kv/probe/key", json={"value": "old"}).status_code == 200
+    assert client.post("/kv/probe/key", json={"value": "new", "if": "old"}).status_code == 200
+
+
+@pytest.mark.parametrize("lane", ["get", "post"])
+def test_reaped_note_cas_refusal_recreates_no_artifacts(client, tmp_path, lane):
+    endpoint = "/kv/probe/key"
+    assert client.post(endpoint, json={"value": "old"}).status_code == 200
+    path = store.note_path(tmp_path, "probe", "key")
+    lock = path.with_suffix(path.suffix + ".lock")
+    _client._age(path, store.IDLE_SECONDS + 60)
+    _client._age(lock, store.IDLE_SECONDS + 60)
+    _client._age(tmp_path / ".reaped", store.REAP_EVERY + 60)
+    # This note exists at request entry but the request's due sweep removes it.
+    assert path.exists()
+    if lane == "get":
+        response = client.get(endpoint + "/set/new", params={"if": "old"})
+    else:
+        response = client.post(endpoint, json={"value": "new", "if": "old"})
+    assert response.status_code == 409
+    assert "no note there" in response.text
+    assert not path.exists()
+    assert not lock.exists()
+    assert not store._note_ns_dir(tmp_path, "probe").exists()
+    assert store._note_count(tmp_path) == 0
@@ -51,12 +51,12 @@ def test_posting_to_the_events_room_documents_what_it_really_answers(client):
     """`/r/events` is the ordinary room POST handler with one room that always says no, so
     the body is read and parsed *before* the refusal — a malformed or oversized body never
     reaches the 403. Documenting only the 403 promised a client one outcome and delivered
-    three. Review catch on #40.
+    several. Review catch on #40; slow bodies can now time out before the refusal too.
     """
     import app as app_module
 
     documented = client.get("/openapi.json").json()["paths"]["/r/events"]["post"]
-    assert set(documented["responses"]) == {"400", "403", "413", "429"}
+    assert set(documented["responses"]) == {"400", "403", "408", "413", "429"}
     # It parses a body, so it declares one.
     assert (
         "text" in (documented["requestBody"]["content"]["application/json"]["schema"]["properties"])