Report inbox: /api/reports in its own bounded reports.db, dashboard Reports page (list, filter, triage, copy as text)

docs/meta-core-architecture.md

@@ -485,10 +485,46 @@ Watchers
 were removed with the 2026-10 SQLite switch; they had been run once on
 watch.nsl.sh beforehand.)
 
+Report inbox (internal/reports, internal/api/reports.go) — bug reports and
+feedback the client apps' 🐛 buttons file; read on the dashboard's Reports page
+  POST   /api/reports            {app, note?, page?, route?, cid?, title?, uid?,
+                                  build?, filedAt?, log?, <any block>} → 201 {id}
+  GET    /api/reports            ?app=&status=open|triaged|closed&q=&before=<id>&limit=
+                                  → {reports: [summary…], apps, counts, more}
+  GET    /api/reports/{id}       full report incl. body
+  PATCH  /api/reports/{id}       {status?, triage_note?}
+  DELETE /api/reports/{id}
+
 WebDAV
   /webdav/...   (GET, PUT, DELETE, MKCOL, COPY, MOVE, PROPFIND)
 ```
 
+### Report inbox
+
+Client apps (meta-watch, meta-read) build a report in the browser and their
+server forwards it **server-to-server to the box's own core** — the uid is
+stamped by the app from its bearer token, never taken from the body. Apps that
+cannot reach the core spool the report locally and retry
+(`report_outbox.rs` in each app), so `filedAt` (when it was filed) and
+`received` (when meta-core stored it) can differ; the row's `ts` is `filedAt`
+when it is plausible (≤ 30 days old, ≤ 5 min in the future).
+
+- **Own file, `db/reports.db`.** Reports are diagnostics, not metadata: neither
+  the truth DB (signed claims only) nor the cache (thrown away on recovery).
+  `POST /api/metadata/clear` and a cache rebuild never touch it. A failure to
+  open it disables `/api/reports*` (503), never the core.
+- **meta-core does not interpret a report.** `app`, `build`, `uid`, `page`,
+  `route`, `cid`, `title`, `note` are lifted into columns for filtering; every
+  other top-level key is stored verbatim in `body` and rendered generically
+  (app-specific headlines live in `dashboard/src/lib/reportText.ts`). Bounds:
+  512 KiB per POST, note 1000 chars, log tail 200 × 600 chars, any other block
+  over 32 KiB replaced by `{truncated, bytes}`.
+- **Bounded.** `META_CORE_REPORTS_MAX` reports and `META_CORE_REPORTS_MAX_MB`
+  of bodies; on overflow closed reports are evicted first, then the oldest —
+  an open report is the last to go. Enforced on every insert and hourly.
+- **Auth:** perimeter-gated like the rest of `/api`; do not add it to the
+  hash-lock bypass. A report is viewing/reading history (cids, titles, a uid).
+
 No `/metrics` endpoint is exposed. Observability is via container logs +
 the `/health` and `/status` JSON.
 
@@ -738,6 +774,9 @@ via `/health`; metadata I/O and SSE event streams stop.
 | `META_CORE_DB_CACHE_MB` | `64` | Page cache of the writer connection. |
 | `META_CORE_DB_READER_CACHE_MB` | `16` | Page cache per reader connection. |
 | `META_CORE_DB_READERS` | `8` | Reader connection pool size. |
+| `META_CORE_REPORTS_DB_PATH` | `<META_CORE_PATH>/db/reports.db` | Report inbox database (beside truth, so it is backed up with it). |
+| `META_CORE_REPORTS_MAX` | `5000` | Reports kept; closed ones are evicted first, then the oldest. |
+| `META_CORE_REPORTS_MAX_MB` | `256` | Total report body size kept, MiB. |
 | `META_CORE_HTTP_PORT` | `9000` | Go HTTP+SSE+WebDAV port. |
 | `META_CORE_HTTP_HOST` | `0.0.0.0` | HTTP bind address. |
 | `HEALTH_CHECK_INTERVAL_MS` | `5000` | Internal health-loop cadence. |
@@ -758,6 +797,7 @@ via `/health`; metadata I/O and SSE event streams stop.
 | `locks/kv-leader.info` | Leader API URL (plaintext). |
 | `db/meta-core.db` (+ `-wal`, `-shm`) | Truth database (claims, principals, `cid_group`). Backed up. Replaced `db/redis/` in 2026-10; holds the claims schema since v2.0.0. |
 | `db-cache/cache.db` (+ `-wal`, `-shm`) | Cache database (v1-layout `kv` table: merged view, lookup, counters, events, service scratch keys; field index, FTS, `claim_by_pid`, `local_file`). Never backed up. |
+| `db/reports.db` (+ `-wal`, `-shm`) | Report inbox (bug reports / feedback from the client apps). Diagnostics, not metadata; bounded. |
 | `services/*.json` | Service registry. |
 | `mounts/mounts.json` | rclone mount configuration. |
 | `mounts/errors/{id}.error` | Mount error logs. |