Bound telemetry player identities (Refs #74)

docs/guides/beta-test-plans.md

@@ -51,7 +51,8 @@ Send JSON to `POST /api/telemetry` with `Content-Type: application/json` and eit
 `X-EC-Telemetry-Token: <EC_TELEMETRY_TOKEN>`. If both headers are present, they must
 contain the same secret. Keep the secret out of URLs, payloads and browser code,
 and use a different secret from host-agent credentials or account passwords.
-The JSON event format is unchanged.
+Request bodies are limited to 1 MiB (1,048,576 bytes), including requests without
+`Content-Length`. The limit applies to the UTF-8 JSON body before parsing.
 There are four events. Send them whether or not a beta is active.
 
 ### Event fields
@@ -65,8 +66,11 @@ There are four events. Send them whether or not a beta is active.
 
 `server` is the exact registered Electric Cherry server name. `map` is the
 current map. `players` is the full player array, including an empty array when
-there are no players. Names and GUIDs are strings; keep GUIDs as strings to
-preserve their precision. Round and stat values are nonnegative JSON integers.
+there are no players. `server`, `map`, and each player's `name` and `guid` must be
+nonempty strings of at most 255 UTF-16 code units (JavaScript string length).
+Values over the limit reject the entire report; accepted values are preserved
+without trimming or truncation. Keep GUIDs as strings to preserve their precision
+and leading zeros. Round and stat values are nonnegative JSON integers.
 Each GUID must appear only once within a report's player array.
 
 Every event also accepts an optional per-player `ping`: the game server's current
@@ -171,8 +175,9 @@ Success returns HTTP 200 with `{ "ok": true, "telemetry": { ... } }`.
 The returned telemetry contains the event and an Electric Cherry `receivedAt`
 timestamp. A missing/invalid machine token returns 401; an unset or invalid
 controller `EC_TELEMETRY_TOKEN` returns 503. Authentication happens before payload
-validation. Authenticated invalid JSON or fields return 400, an unknown/destroyed
-server 404, and a non-JSON content type 415.
+validation. Authenticated bodies over 1 MiB return 413 before JSON parsing.
+Invalid JSON or fields return 400, an unknown/destroyed server 404, and a non-JSON
+content type 415.
 
 The script sends each event once, in gameplay order, directly to Electric Cherry.
 There is no discovery request, beta token, boot/session ID, sequence number,
@@ -207,7 +212,8 @@ name. Each entry includes the Electric Cherry receipt time, HTTP result, error
 reason, event, map, round, player count, content type, and submitted JSON. Rejected
 reports are included, even when the content type is wrong but the body is readable
 JSON after authentication. Unauthorized requests are rejected before their bodies
-are read and are not retained in per-server diagnostics. Authentication headers
+are read and are not retained in per-server diagnostics. Oversized bodies are
+rejected before parsing and are not retained either. Authentication headers
 and their secrets are never stored. Processing failures return 500 and record the internal error when diagnostic
 storage is available; failed database transactions do not update the scoreboard.
 
@@ -224,8 +230,9 @@ newest first, with caching disabled.
   Check the reporter's destination and server field. Calls that never reach
   Electric Cherry, malformed JSON, and bodies without a usable server name
   cannot appear in this server's log. Earlier requests are not backfilled.
-  Missing/invalid telemetry credentials also produce no retained request; inspect
-  the reporter's HTTP result for 401 or an unconfigured-controller 503.
+  Missing/invalid telemetry credentials and oversized bodies also produce no
+  retained request; inspect the reporter's HTTP result for 401, 413, or an
+  unconfigured-controller 503.
 - **400 / 415:** inspect the error and payload. One invalid player's stats or a
   duplicate GUID rejects the entire report. These requests do not update the
   scoreboard.