diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index d2b044f6..1936c1ed 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -31,13 +31,15 @@ jobs:
           # stack of '!' patterns matches whenever a file fails ANY one of them, which for
           # a docs-only change is always true. Listing what IS code keeps the OR honest.
           # PlanViewer.Ssms and PlanViewer.Ssms.Installer stay out: they are not in the
-          # solution and ci.yml never built them.
+          # solution and ci.yml never built them. server/PlanShare is in: the test project
+          # references it, so this job builds and tests it.
           filters: |
             code:
               - 'src/PlanViewer.App/**'
               - 'src/PlanViewer.Cli/**'
               - 'src/PlanViewer.Core/**'
               - 'src/PlanViewer.Web/**'
+              - 'server/PlanShare/**'
               - 'src/Directory.Build.props'
               - 'tests/**'
               - 'PlanViewer.sln'
diff --git a/server/PlanShare/ClientKey.cs b/server/PlanShare/ClientKey.cs
new file mode 100644
index 00000000..54dfdda7
--- /dev/null
+++ b/server/PlanShare/ClientKey.cs
@@ -0,0 +1,33 @@
+using System.Net;
+using System.Net.Sockets;
+
+namespace PlanShare;
+
+/// <summary>
+/// The one key every per-client limit (share, analytics, read, upload budget) is counted under.
+/// An IPv4 address is its own key. An IPv4-mapped IPv6 address (how a dual-stack socket reports
+/// an IPv4 caller) becomes that IPv4 address, so one caller has one key. Any other IPv6 address
+/// becomes its /64 prefix: a single subscriber is normally given a whole /64, so counting per /64
+/// makes one subscriber one client, however many addresses they use.
+/// </summary>
+internal static class ClientKey
+{
+    public const string Unknown = "unknown";
+
+    public static string From(IPAddress? address)
+    {
+        if (address is null)
+            return Unknown;
+
+        if (address.IsIPv4MappedToIPv6)
+            address = address.MapToIPv4();
+
+        if (address.AddressFamily != AddressFamily.InterNetworkV6)
+            return address.ToString();
+
+        Span<byte> bytes = stackalloc byte[16];
+        address.TryWriteBytes(bytes, out _);
+        bytes[8..].Clear();
+        return $"{new IPAddress(bytes)}/64";
+    }
+}
diff --git a/server/PlanShare/PlanShare.csproj b/server/PlanShare/PlanShare.csproj
index 0d1f7756..92abd428 100644
--- a/server/PlanShare/PlanShare.csproj
+++ b/server/PlanShare/PlanShare.csproj
@@ -18,4 +18,9 @@
     <PackageReference Include="SQLitePCLRaw.bundle_e_sqlite3" Version="3.0.5" />
   </ItemGroup>
 
+  <!-- tests/PlanViewer.Core.Tests references this project so CI builds and tests the server -->
+  <ItemGroup>
+    <InternalsVisibleTo Include="PlanViewer.Core.Tests" />
+  </ItemGroup>
+
 </Project>
diff --git a/server/PlanShare/Program.cs b/server/PlanShare/Program.cs
index a144de34..d70657b4 100644
--- a/server/PlanShare/Program.cs
+++ b/server/PlanShare/Program.cs
@@ -4,6 +4,7 @@
 using System.Text.Json;
 using Microsoft.AspNetCore.HttpOverrides;
 using Microsoft.Data.Sqlite;
+using PlanShare;
 
 var builder = WebApplication.CreateBuilder(args);
 
@@ -14,8 +15,9 @@
         policy.AllowAnyOrigin().AllowAnyMethod().AllowAnyHeader());
 });
 
-// Database path — data/ subdirectory relative to the binary
-var dataDir = Path.Combine(AppContext.BaseDirectory, "data");
+// Database path — data/ subdirectory relative to the binary. PlanShare:DataDir moves it
+// (the endpoint tests and local runs point it at a temp folder).
+var dataDir = builder.Configuration["PlanShare:DataDir"] ?? Path.Combine(AppContext.BaseDirectory, "data");
 Directory.CreateDirectory(dataDir);
 var dbPath = Path.Combine(dataDir, "plans.db");
 var connectionString = $"Data Source={dbPath}";
@@ -71,9 +73,23 @@ created_at TEXT NOT NULL
 // store; 120/min per IP is far above any human's browsing rate.
 var readRateLimiter = new RateLimiter(maxRequests: 120, windowSeconds: 60);
 
+// --- Storage limit and daily upload budget ---
+// The production disk is 40 GB, so shares are refused (507) once the database uses 10 GB of pages.
+// The budget is the most plan data one client key can store per UTC day (429 after that).
+// PlanShare:MaxDatabaseBytes and PlanShare:DailyUploadBytes override the two limits, which lets
+// the endpoint tests use small values.
+const long MaxDatabaseBytes = 10L * 1024 * 1024 * 1024;
+const long DailyUploadBytes = 100L * 1024 * 1024;
+var storageCheck = new StorageCheck(
+    connectionString,
+    builder.Configuration.GetValue<long?>("PlanShare:MaxDatabaseBytes") ?? MaxDatabaseBytes);
+var uploadBudget = new UploadBudget(
+    builder.Configuration.GetValue<long?>("PlanShare:DailyUploadBytes") ?? DailyUploadBytes);
+
 // Register the cleanup background service
 builder.Services.AddSingleton(new PlanDbConfig(connectionString));
 builder.Services.AddSingleton(new RateLimiters(rateLimiter, analyticsRateLimiter, readRateLimiter));
+builder.Services.AddSingleton(uploadBudget);
 builder.Services.AddHostedService<CleanupService>();
 
 // Request size limit (10 MB)
@@ -105,6 +121,9 @@ created_at TEXT NOT NULL
 
 const int MaxTtlDays = 365;
 
+// Longest page path an analytics event may carry. Real paths are a few characters.
+const int MaxEventPathLength = 512;
+
 // Depth ceiling for parsing an uploaded share, mirroring PlanViewer.Core's
 // AnalysisJson.MaxDepth — that class is the source of truth for how deep a serialized
 // AnalysisResult can go (#431: an operator costs two JSON levels, so the JsonDocument
@@ -121,11 +140,11 @@ created_at TEXT NOT NULL
 
 app.MapPost("/api/share", async (HttpContext ctx) =>
 {
-    // Rate limit by IP
-    var ip = ctx.Connection.RemoteIpAddress?.ToString() ?? "unknown";
-    if (!rateLimiter.IsAllowed(ip))
+    // Rate limit by client key (IPv4 address, or the /64 of an IPv6 address)
+    var client = ClientKey.From(ctx.Connection.RemoteIpAddress);
+    if (!rateLimiter.IsAllowed(client))
     {
-        return Results.StatusCode(429);
+        return Error(429, "Too many shares from your network. Please wait a minute and try again.");
     }
 
     // Read raw body
@@ -134,7 +153,7 @@ created_at TEXT NOT NULL
 
     if (string.IsNullOrWhiteSpace(body))
     {
-        return Results.BadRequest("Empty body");
+        return Error(400, "Empty body");
     }
 
     // Parse and extract ttl_days from the JSON. shareDocumentOptions, not defaults: this body
@@ -144,12 +163,31 @@ created_at TEXT NOT NULL
     try
     {
         using var doc = JsonDocument.Parse(body, shareDocumentOptions);
-        if (doc.RootElement.TryGetProperty("ttl_days", out var ttlProp) && ttlProp.TryGetInt32(out var t))
-            ttlDays = Math.Clamp(t, 1, MaxTtlDays);
+        // TryGetProperty and TryGetInt32 throw (a 500) on the wrong kind of element, so check the kind first
+        if (doc.RootElement.ValueKind != JsonValueKind.Object)
+            return Error(400, "The request body must be a JSON object.");
+        if (doc.RootElement.TryGetProperty("ttl_days", out var ttlProp) && ttlProp.ValueKind != JsonValueKind.Null)
+        {
+            if (ttlProp.ValueKind != JsonValueKind.Number)
+                return Error(400, "ttl_days must be a number.");
+            if (ttlProp.TryGetInt32(out var t))
+                ttlDays = Math.Clamp(t, 1, MaxTtlDays);
+        }
     }
     catch (JsonException)
     {
-        return Results.BadRequest("Invalid JSON");
+        return Error(400, "Invalid JSON");
+    }
+
+    if (storageCheck.IsFull())
+    {
+        return Error(507, "Plan sharing is full right now. Please try again later.");
+    }
+
+    // The stored size is the UTF-8 length of the body; ContentLength can be absent
+    if (!uploadBudget.TryCharge(client, Encoding.UTF8.GetByteCount(body)))
+    {
+        return Error(429, "Daily sharing limit reached for your network. Please try again tomorrow.");
     }
 
     var id = GenerateId();
@@ -175,8 +213,8 @@ created_at TEXT NOT NULL
 
 app.MapGet("/api/plans/{id}", (string id, HttpContext ctx) =>
 {
-    var readIp = ctx.Connection.RemoteIpAddress?.ToString() ?? "unknown";
-    if (!readRateLimiter.IsAllowed(readIp))
+    var readClient = ClientKey.From(ctx.Connection.RemoteIpAddress);
+    if (!readRateLimiter.IsAllowed(readClient))
         return Results.StatusCode(429);
 
     using var conn = new SqliteConnection(connectionString);
@@ -199,9 +237,8 @@ created_at TEXT NOT NULL
 
 app.MapPost("/api/event", async (HttpContext ctx) =>
 {
-    // Rate limit: 30 events/min per IP (generous — covers page nav + shares)
-    var ip = ctx.Connection.RemoteIpAddress?.ToString() ?? "unknown";
-    if (!analyticsRateLimiter.IsAllowed(ip))
+    // Rate limit: 30 events/min per client key (generous — covers page nav + shares)
+    if (!analyticsRateLimiter.IsAllowed(ClientKey.From(ctx.Connection.RemoteIpAddress)))
         return Results.StatusCode(429);
 
     using var reader = new StreamReader(ctx.Request.Body);
@@ -212,16 +249,32 @@ created_at TEXT NOT NULL
     try
     {
         using var doc = JsonDocument.Parse(body);
-        if (doc.RootElement.TryGetProperty("path", out var p))
+        // GetString() throws (a 500) on a non-string element, so check the kind first.
+        // JSON null counts as "not sent", like a missing property.
+        if (doc.RootElement.ValueKind != JsonValueKind.Object)
+            return Error(400, "The request body must be a JSON object.");
+        if (doc.RootElement.TryGetProperty("path", out var p) && p.ValueKind != JsonValueKind.Null)
+        {
+            if (p.ValueKind != JsonValueKind.String)
+                return Error(400, "path must be a string.");
             path = p.GetString() ?? "/";
-        if (doc.RootElement.TryGetProperty("referrer", out var r))
+        }
+        if (doc.RootElement.TryGetProperty("referrer", out var r) && r.ValueKind != JsonValueKind.Null)
+        {
+            if (r.ValueKind != JsonValueKind.String)
+                return Error(400, "referrer must be a string.");
             referrer = r.GetString();
+        }
     }
-    catch (JsonException)
+    catch (Exception ex) when (ex is JsonException or InvalidOperationException)
     {
-        return Results.BadRequest("Invalid JSON");
+        // InvalidOperationException: GetString() on a string with a lone surrogate escape
+        return Error(400, "Invalid JSON");
     }
 
+    if (path.Length > MaxEventPathLength)
+        return Error(400, $"path must be {MaxEventPathLength} characters or fewer.");
+
     // Strip referrer to domain only (no full URLs with query params).
     // If it doesn't parse as an absolute URL, drop it — never persist raw
     // client-supplied strings, since the dashboard renders referrers in HTML.
@@ -237,11 +290,18 @@ created_at TEXT NOT NULL
     // space (IPv4 = 2^32, guessable UA, known date) is small enough to brute
     // force straight back to the source IP, so an unsalted digest would still be
     // personal data despite looking like a hash.
+    // The hash takes the full address, not the client key: a /64 would count every host in
+    // it as one visitor.
+    var ip = ctx.Connection.RemoteIpAddress?.ToString() ?? "unknown";
     var ua = ctx.Request.Headers.UserAgent.FirstOrDefault() ?? "";
     var day = DateTime.UtcNow.ToString("yyyy-MM-dd");
     var visitorHash = Convert.ToHexString(
         HMACSHA256.HashData(visitorSalt, Encoding.UTF8.GetBytes($"{ip}|{ua}|{day}"))).ToLower()[..16];
 
+    // A full store drops the event and still answers 200: analytics must never show an error
+    if (storageCheck.IsFull())
+        return Results.Ok();
+
     using var conn = new SqliteConnection(connectionString);
     conn.Open();
     using var cmd = conn.CreateCommand();
@@ -409,10 +469,14 @@ GROUP BY referrer ORDER BY count DESC LIMIT 10
 
 app.MapDelete("/api/plans/{id}", (string id, HttpContext ctx) =>
 {
-    var token = ctx.Request.Query["token"].FirstOrDefault();
+    // Header first: a ?token= query string is written to the nginx access log. The query form
+    // stays for clients built before the header existed.
+    var token = ctx.Request.Headers["X-Delete-Token"].FirstOrDefault();
+    if (string.IsNullOrEmpty(token))
+        token = ctx.Request.Query["token"].FirstOrDefault();
     if (string.IsNullOrEmpty(token))
     {
-        return Results.BadRequest("Missing delete token");
+        return Error(400, "Missing delete token");
     }
 
     using var conn = new SqliteConnection(connectionString);
@@ -443,6 +507,12 @@ static string GenerateDeleteToken()
     return Convert.ToHexString(RandomNumberGenerator.GetBytes(16)).ToLower();
 }
 
+// A refusal the web client can show: it reads the "error" text out of the body.
+static IResult Error(int statusCode, string message)
+{
+    return Results.Json(new { error = message }, statusCode: statusCode);
+}
+
 // --- Supporting types ---
 
 record PlanDbConfig(string ConnectionString);
@@ -453,12 +523,14 @@ sealed class CleanupService : BackgroundService
 {
     private readonly PlanDbConfig _config;
     private readonly RateLimiters _rateLimiters;
+    private readonly UploadBudget _uploadBudget;
     private readonly ILogger<CleanupService> _logger;
 
-    public CleanupService(PlanDbConfig config, RateLimiters rateLimiters, ILogger<CleanupService> logger)
+    public CleanupService(PlanDbConfig config, RateLimiters rateLimiters, UploadBudget uploadBudget, ILogger<CleanupService> logger)
     {
         _config = config;
         _rateLimiters = rateLimiters;
+        _uploadBudget = uploadBudget;
         _logger = logger;
     }
 
@@ -503,14 +575,16 @@ private void Cleanup()
 
             // Evict stale rate-limiter keys so the dictionaries don't grow forever.
             // Every limiter must be swept here: an unswept one keeps a permanent
-            // entry per unique client IP for the lifetime of the process.
+            // entry per unique client IP for the lifetime of the process. The upload
+            // budget is swept the same way (its entries go stale at the UTC day change).
             var shareEvicted = _rateLimiters.Share.Sweep();
             var analyticsEvicted = _rateLimiters.Analytics.Sweep();
             var readEvicted = _rateLimiters.Read.Sweep();
-            if (shareEvicted + analyticsEvicted + readEvicted > 0)
+            var budgetEvicted = _uploadBudget.Sweep();
+            if (shareEvicted + analyticsEvicted + readEvicted + budgetEvicted > 0)
                 _logger.LogInformation(
-                    "Evicted {Share} share + {Analytics} analytics + {Read} read rate-limit keys",
-                    shareEvicted, analyticsEvicted, readEvicted);
+                    "Evicted {Share} share + {Analytics} analytics + {Read} read rate-limit keys and {Budget} upload-budget keys",
+                    shareEvicted, analyticsEvicted, readEvicted, budgetEvicted);
         }
         catch (Exception ex)
         {
diff --git a/server/PlanShare/StorageCheck.cs b/server/PlanShare/StorageCheck.cs
new file mode 100644
index 00000000..7e66cede
--- /dev/null
+++ b/server/PlanShare/StorageCheck.cs
@@ -0,0 +1,41 @@
+using Microsoft.Data.Sqlite;
+
+namespace PlanShare;
+
+/// <summary>
+/// Tells whether the plan database has reached its size limit. Size means the pages in use:
+/// (page_count - freelist_count) * page_size. The freelist is left out on purpose, because
+/// deleting expired plans returns their pages to it and the file itself does not shrink, so
+/// the file length would stay above the limit after cleanup had freed the room.
+/// </summary>
+internal sealed class StorageCheck
+{
+    private readonly string _connectionString;
+    private readonly long _maxBytes;
+
+    public StorageCheck(string connectionString, long maxBytes)
+    {
+        _connectionString = connectionString;
+        _maxBytes = maxBytes;
+    }
+
+    public long UsedBytes()
+    {
+        using var conn = new SqliteConnection(_connectionString);
+        conn.Open();
+        var pageCount = Pragma(conn, "page_count");
+        var freePages = Pragma(conn, "freelist_count");
+        var pageSize = Pragma(conn, "page_size");
+        return (pageCount - freePages) * pageSize;
+    }
+
+    /// <summary>True at or above the limit.</summary>
+    public bool IsFull() => UsedBytes() >= _maxBytes;
+
+    private static long Pragma(SqliteConnection conn, string name)
+    {
+        using var cmd = conn.CreateCommand();
+        cmd.CommandText = $"PRAGMA {name};";
+        return (long)cmd.ExecuteScalar()!;
+    }
+}
diff --git a/server/PlanShare/UploadBudget.cs b/server/PlanShare/UploadBudget.cs
new file mode 100644
index 00000000..10a9f3d4
--- /dev/null
+++ b/server/PlanShare/UploadBudget.cs
@@ -0,0 +1,88 @@
+using System.Collections.Concurrent;
+
+namespace PlanShare;
+
+/// <summary>
+/// Caps how many bytes of plan data one client key can store per UTC day. In memory like
+/// RateLimiter, so a restart forgets it. A charge is made before the insert and is not refunded
+/// if the insert then fails: refunding would need a second code path for a rare error, and the
+/// most a client can lose that way is one upload's worth of its allowance.
+/// </summary>
+internal sealed class UploadBudget
+{
+    private sealed class Usage
+    {
+        public DateOnly Day;
+        public long Bytes;
+        public bool Evicted;
+    }
+
+    private readonly long _dailyLimitBytes;
+    private readonly TimeProvider _clock;
+    private readonly ConcurrentDictionary<string, Usage> _usage = new();
+
+    public UploadBudget(long dailyLimitBytes, TimeProvider? clock = null)
+    {
+        _dailyLimitBytes = dailyLimitBytes;
+        _clock = clock ?? TimeProvider.System;
+    }
+
+    private DateOnly Today() => DateOnly.FromDateTime(_clock.GetUtcNow().UtcDateTime);
+
+    /// <summary>
+    /// Adds <paramref name="bytes"/> to the key's total for today and returns true, or returns
+    /// false and adds nothing when that would take the total over the daily limit.
+    /// </summary>
+    public bool TryCharge(string key, long bytes)
+    {
+        var today = Today();
+
+        while (true)
+        {
+            var usage = _usage.GetOrAdd(key, _ => new Usage { Day = today });
+
+            lock (usage)
+            {
+                // Sweep() removed this entry between GetOrAdd and the lock; charging it now
+                // would be lost, so fetch or create the live one.
+                if (usage.Evicted)
+                    continue;
+
+                if (usage.Day != today)
+                {
+                    usage.Day = today;
+                    usage.Bytes = 0;
+                }
+
+                if (usage.Bytes + bytes > _dailyLimitBytes)
+                    return false;
+
+                usage.Bytes += bytes;
+                return true;
+            }
+        }
+    }
+
+    /// <summary>
+    /// Evicts keys whose last charge was on an earlier UTC day. Call periodically so the
+    /// dictionary doesn't grow forever across unique clients.
+    /// Returns the number of keys evicted.
+    /// </summary>
+    public int Sweep()
+    {
+        var today = Today();
+        var evicted = 0;
+        foreach (var kvp in _usage)
+        {
+            lock (kvp.Value)
+            {
+                if (kvp.Value.Day != today && _usage.TryRemove(kvp))
+                {
+                    kvp.Value.Evicted = true;
+                    evicted++;
+                }
+            }
+        }
+        return evicted;
+    }
+}
diff --git a/server/PlanShare/dashboard.html b/server/PlanShare/dashboard.html
index 3b24ac0a..3b458157 100644
--- a/server/PlanShare/dashboard.html
+++ b/server/PlanShare/dashboard.html
@@ -235,7 +235,9 @@ <h3>Top Referrers (30 days)</h3>
         if (m) {
             var t = decodeURIComponent(m[1]);
             try { localStorage.setItem("planshare_stats_token", t); } catch (e) { /* private mode */ }
-            history.replaceState(null, "", window.location.pathname + window.location.search);
+            // window.history: a bare "history" here is the stats array declared at the top of this
+            // script, which has no replaceState, so the call threw and left #token= in the address bar.
+            window.history.replaceState(null, "", window.location.pathname + window.location.search);
             return t;
         }
         try { return localStorage.getItem("planshare_stats_token") || ""; } catch (e) { return ""; }
diff --git a/src/PlanViewer.Web/Pages/Index.razor b/src/PlanViewer.Web/Pages/Index.razor
index e9b6b09d..eec1ec21 100644
--- a/src/PlanViewer.Web/Pages/Index.razor
+++ b/src/PlanViewer.Web/Pages/Index.razor
@@ -76,7 +76,16 @@ else
         <div class="modal-overlay" @onclick="HideShareDialog">
             <div class="modal" @onclick:stopPropagation="true">
                 <h3>Share Plan Analysis</h3>
-                <p>Your plan analysis will be uploaded and stored on a server. Anyone with the link can view the full analysis, including query text, operator details, and warnings.</p>
+                <p>Your plan analysis will be uploaded and stored on a server. Anyone with the link can read all of it. The upload includes:</p>
+                <ul>
+                    <li>The file name of the plan</li>
+                    <li>The query text</li>
+                    <li>The operator details and the warnings</li>
+                    <li>The compiled and runtime values of the parameters</li>
+                    <li>The missing index suggestions, with database, schema, and table names</li>
+                    <li>The full text report</li>
+                </ul>
+                <p>Query text and parameter values can contain private data. Check the analysis on this page before you share it.</p>
                 <div class="ttl-picker">
                     <label>Expire after:</label>
                     <select @bind="shareTtlDays">
diff --git a/src/PlanViewer.Web/Services/PlanShareService.cs b/src/PlanViewer.Web/Services/PlanShareService.cs
index 5a3794e7..9e5012d3 100644
--- a/src/PlanViewer.Web/Services/PlanShareService.cs
+++ b/src/PlanViewer.Web/Services/PlanShareService.cs
@@ -71,7 +71,7 @@ public async Task<PlanShareResult> ShareAsync(AnalysisResult result, string text
         var response = await _http.PostAsync($"{ApiBase}/api/share", content);
 
         if (!response.IsSuccessStatusCode)
-            throw new PlanShareException($"Share failed: server returned {(int)response.StatusCode}");
+            throw new PlanShareException(await ShareFailureMessageAsync(response));
 
         var json = await response.Content.ReadAsStringAsync();
         using var doc = JsonDocument.Parse(json);
@@ -80,9 +80,37 @@ public async Task<PlanShareResult> ShareAsync(AnalysisResult result, string text
         return new PlanShareResult(id, deleteToken);
     }
 
+    /* The server explains a refusal (store full, daily limit, bad request) as {"error": "..."} in
+       a message meant for the user, so show that text. A reply without it, such as an HTML error
+       page from the proxy in front of the server, gets the generic message with the status code. */
+    private static async Task<string> ShareFailureMessageAsync(HttpResponseMessage response)
+    {
+        try
+        {
+            var json = await response.Content.ReadAsStringAsync();
+            using var doc = JsonDocument.Parse(json);
+            if (doc.RootElement.ValueKind == JsonValueKind.Object
+                && doc.RootElement.TryGetProperty("error", out var error)
+                && error.ValueKind == JsonValueKind.String
+                && !string.IsNullOrWhiteSpace(error.GetString()))
+            {
+                return error.GetString()!;
+            }
+        }
+        catch (JsonException)
+        {
+            // Not JSON, so there is no server text to show
+        }
+        return $"Share failed: server returned {(int)response.StatusCode}";
+    }
+
     public async Task DeleteAsync(string shareId, string deleteToken)
     {
-        var response = await _http.DeleteAsync($"{ApiBase}/api/plans/{Uri.EscapeDataString(shareId)}?token={Uri.EscapeDataString(deleteToken)}");
+        /* The token goes in a header, not the query string: the proxy writes every request URL to
+           its access log, and a ?token= there is a working delete link for anyone who reads the log. */
+        using var request = new HttpRequestMessage(HttpMethod.Delete, $"{ApiBase}/api/plans/{Uri.EscapeDataString(shareId)}");
+        request.Headers.Add("X-Delete-Token", deleteToken);
+        var response = await _http.SendAsync(request);
         if (!response.IsSuccessStatusCode)
             throw new PlanShareException("Failed to delete shared plan.");
     }
diff --git a/src/PlanViewer.Web/wwwroot/css/app.css b/src/PlanViewer.Web/wwwroot/css/app.css
index b44467c5..259a4a4f 100644
--- a/src/PlanViewer.Web/wwwroot/css/app.css
+++ b/src/PlanViewer.Web/wwwroot/css/app.css
@@ -367,6 +367,13 @@ textarea::placeholder {
     line-height: 1.5;
 }
 
+.modal ul {
+    font-size: 0.9rem;
+    color: var(--text-secondary);
+    margin: 0 0 0.5rem 1.25rem;
+    line-height: 1.5;
+}
+
 .modal-actions {
     display: flex;
     gap: 0.75rem;
diff --git a/tests/PlanViewer.Core.Tests/PlanShareApp.cs b/tests/PlanViewer.Core.Tests/PlanShareApp.cs
new file mode 100644
index 00000000..247425ec
--- /dev/null
+++ b/tests/PlanViewer.Core.Tests/PlanShareApp.cs
@@ -0,0 +1,86 @@
+using Microsoft.AspNetCore.Builder;
+using Microsoft.AspNetCore.Hosting;
+using Microsoft.AspNetCore.Mvc.Testing;
+using Microsoft.AspNetCore.TestHost;
+using Microsoft.Data.Sqlite;
+using Microsoft.Extensions.DependencyInjection;
+using PlanShare;
+
+namespace PlanViewer.Core.Tests;
+
+/// <summary>
+/// The share server, started in memory with its database in a temp folder. The limits are passed the
+/// way an operator would set them, as PlanShare:* settings, so a test can use a 1 KB budget instead of
+/// uploading 100 MB. The type argument is only a way to name the server's assembly.
+/// </summary>
+internal sealed class PlanShareApp : WebApplicationFactory<UploadBudget>
+{
+    private readonly string _dataDir = Path.Combine(Path.GetTempPath(), "planshare-app-" + Guid.NewGuid().ToString("N"));
+    private readonly long? _maxDatabaseBytes;
+    private readonly long? _dailyUploadBytes;
+
+    public PlanShareApp(long? maxDatabaseBytes = null, long? dailyUploadBytes = null)
+    {
+        _maxDatabaseBytes = maxDatabaseBytes;
+        _dailyUploadBytes = dailyUploadBytes;
+    }
+
+    public string DbPath => Path.Combine(_dataDir, "plans.db");
+
+    protected override void ConfigureWebHost(IWebHostBuilder builder)
+    {
+        builder.UseSetting("PlanShare:DataDir", _dataDir);
+        if (_maxDatabaseBytes is { } max)
+            builder.UseSetting("PlanShare:MaxDatabaseBytes", max.ToString());
+        if (_dailyUploadBytes is { } budget)
+            builder.UseSetting("PlanShare:DailyUploadBytes", budget.ToString());
+
+        // The in-memory server has no remote address. Production sits behind nginx on loopback, and the
+        // server only believes X-Forwarded-For from loopback, so give every request a loopback peer.
+        // Tests then pick their client address the way nginx does, with X-Forwarded-For.
+        builder.ConfigureTestServices(services => services.AddSingleton<IStartupFilter, LoopbackPeer>());
+    }
+
+    protected override void Dispose(bool disposing)
+    {
+        base.Dispose(disposing);
+        if (!disposing)
+            return;
+        // The server's pooled connections keep plans.db open, which stops the delete on Windows
+        SqliteConnection.ClearAllPools();
+        try { Directory.Delete(_dataDir, recursive: true); }
+        catch (IOException) { }
+    }
+
+    /// <summary>A request as nginx would forward it: from loopback, with the caller in X-Forwarded-For.</summary>
+    public static HttpRequestMessage Request(HttpMethod method, string url, string clientAddress, string? body = null)
+    {
+        var request = new HttpRequestMessage(method, url);
+        request.Headers.Add("X-Forwarded-For", clientAddress);
+        if (body is not null)
+            request.Content = new StringContent(body, System.Text.Encoding.UTF8, "application/json");
+        return request;
+    }
+
+    public long Count(string table)
+    {
+        using var conn = new SqliteConnection($"Data Source={DbPath};Pooling=False");
+        conn.Open();
+        using var cmd = conn.CreateCommand();
+        cmd.CommandText = $"SELECT COUNT(*) FROM {table}";
+        return (long)cmd.ExecuteScalar()!;
+    }
+
+    private sealed class LoopbackPeer : IStartupFilter
+    {
+        public Action<IApplicationBuilder> Configure(Action<IApplicationBuilder> next) => app =>
+        {
+            app.Use((context, nextMiddleware) =>
+            {
+                context.Connection.RemoteIpAddress = System.Net.IPAddress.Loopback;
+                return nextMiddleware(context);
+            });
+            next(app);
+        };
+    }
+}
diff --git a/tests/PlanViewer.Core.Tests/PlanShareClientKeyTests.cs b/tests/PlanViewer.Core.Tests/PlanShareClientKeyTests.cs
new file mode 100644
index 00000000..64466bf2
--- /dev/null
+++ b/tests/PlanViewer.Core.Tests/PlanShareClientKeyTests.cs
@@ -0,0 +1,65 @@
+using System.Net;
+using PlanShare;
+
+namespace PlanViewer.Core.Tests;
+
+/// <summary>
+/// Every per-client limit on the share server counts under one key. An IPv4 address is its own key,
+/// an IPv4-mapped IPv6 address is the IPv4 address it wraps, and any other IPv6 address is its /64.
+/// </summary>
+public class PlanShareClientKeyTests
+{
+    [Fact]
+    public void IPv4Address_IsItsOwnKey()
+    {
+        Assert.Equal("203.0.113.7", ClientKey.From(IPAddress.Parse("203.0.113.7")));
+    }
+
+    [Fact]
+    public void IPv4MappedIPv6Address_HasTheSameKeyAsTheIPv4Address()
+    {
+        var mapped = ClientKey.From(IPAddress.Parse("::ffff:203.0.113.7"));
+
+        Assert.Equal("203.0.113.7", mapped);
+        Assert.Equal(ClientKey.From(IPAddress.Parse("203.0.113.7")), mapped);
+    }
+
+    [Fact]
+    public void IPv6Addresses_InOneSlash64_ShareAKey()
+    {
+        var first = ClientKey.From(IPAddress.Parse("2001:db8:1:2::1"));
+        var second = ClientKey.From(IPAddress.Parse("2001:db8:1:2:ffff:eeee:dddd:cccc"));
+
+        Assert.Equal(first, second);
+        Assert.Equal("2001:db8:1:2::/64", first);
+    }
+
+    [Fact]
+    public void IPv6Addresses_InDifferentSlash64s_HaveDifferentKeys()
+    {
+        // Differ only in the last bit of the 64-bit prefix
+        var first = ClientKey.From(IPAddress.Parse("2001:db8:1:2::1"));
+        var second = ClientKey.From(IPAddress.Parse("2001:db8:1:3::1"));
+
+        Assert.NotEqual(first, second);
+    }
+
+    [Fact]
+    public void IPv6ZoneId_IsNotPartOfTheKey()
+    {
+        Assert.Equal("fe80::/64", ClientKey.From(IPAddress.Parse("fe80::1%3")));
+    }
+
+    [Fact]
+    public void IPv6Key_EndsInSlash64_SoItCannotEqualAnIPv4Key()
+    {
+        Assert.EndsWith("/64", ClientKey.From(IPAddress.Parse("2001:db8::1")));
+        Assert.DoesNotContain('/', ClientKey.From(IPAddress.Parse("203.0.113.7")));
+    }
+
+    [Fact]
+    public void NoAddress_GivesTheUnknownKey()
+    {
+        Assert.Equal("unknown", ClientKey.From(null));
+    }
+}
diff --git a/tests/PlanViewer.Core.Tests/PlanShareEndpointTests.cs b/tests/PlanViewer.Core.Tests/PlanShareEndpointTests.cs
new file mode 100644
index 00000000..aee49c12
--- /dev/null
+++ b/tests/PlanViewer.Core.Tests/PlanShareEndpointTests.cs
@@ -0,0 +1,383 @@
+using System.Net;
+using System.Text;
+using System.Text.Json;
+
+namespace PlanViewer.Core.Tests;
+
+/// <summary>
+/// The share server's endpoints, through the real pipeline (forwarded headers, CORS, the limiters) with
+/// its database in a temp folder. Each test starts its own server, so the in-memory limits start fresh.
+/// A caller is named the way nginx names it, with X-Forwarded-For.
+/// </summary>
+public class PlanShareEndpointTests
+{
+    private const string Caller = "203.0.113.10";
+    private const string SmallShare = """{"result":{},"text":"report","ttl_days":7}""";
+
+    private static readonly HttpMethod Post = HttpMethod.Post;
+
+    private static async Task<(HttpStatusCode Status, string Body)> Send(
+        HttpClient http, HttpMethod method, string url, string caller, string? body = null)
+    {
+        using var request = PlanShareApp.Request(method, url, caller, body);
+        using var response = await http.SendAsync(request, TestContext.Current.CancellationToken);
+        return (response.StatusCode, await response.Content.ReadAsStringAsync(TestContext.Current.CancellationToken));
+    }
+
+    private static string ErrorText(string body)
+    {
+        using var doc = JsonDocument.Parse(body);
+        return doc.RootElement.GetProperty("error").GetString()!;
+    }
+
+    private static async Task<(string Id, string Token)> ShareOne(HttpClient http, string caller = Caller)
+    {
+        var (status, body) = await Send(http, Post, "/api/share", caller, SmallShare);
+        Assert.Equal(HttpStatusCode.OK, status);
+        using var doc = JsonDocument.Parse(body);
+        return (doc.RootElement.GetProperty("id").GetString()!, doc.RootElement.GetProperty("delete_token").GetString()!);
+    }
+
+    // --- /api/share ---
+
+    [Fact]
+    public async Task Share_StoresThePlan_AndReturnsItBack()
+    {
+        using var app = new PlanShareApp();
+        var http = app.CreateClient();
+
+        var (id, token) = await ShareOne(http);
+
+        Assert.Equal(8, id.Length);
+        Assert.Equal(32, token.Length);
+        Assert.Equal(1, app.Count("plans"));
+        var (status, body) = await Send(http, HttpMethod.Get, $"/api/plans/{id}", Caller);
+        Assert.Equal(HttpStatusCode.OK, status);
+        Assert.Equal(SmallShare, body);
+    }
+
+    [Theory]
+    [InlineData("[1,2]")]
+    [InlineData("\"text\"")]
+    [InlineData("5")]
+    [InlineData("null")]
+    [InlineData("true")]
+    public async Task Share_RootThatIsNotAnObject_Returns400(string body)
+    {
+        using var app = new PlanShareApp();
+
+        var (status, reply) = await Send(app.CreateClient(), Post, "/api/share", Caller, body);
+
+        Assert.Equal(HttpStatusCode.BadRequest, status);
+        Assert.Equal("The request body must be a JSON object.", ErrorText(reply));
+        Assert.Equal(0, app.Count("plans"));
+    }
+
+    [Theory]
+    [InlineData("""{"ttl_days":"7"}""")]
+    [InlineData("""{"ttl_days":true}""")]
+    [InlineData("""{"ttl_days":{"days":7}}""")]
+    [InlineData("""{"ttl_days":[7]}""")]
+    public async Task Share_TtlDaysOfTheWrongType_Returns400(string body)
+    {
+        using var app = new PlanShareApp();
+
+        var (status, reply) = await Send(app.CreateClient(), Post, "/api/share", Caller, body);
+
+        Assert.Equal(HttpStatusCode.BadRequest, status);
+        Assert.Equal("ttl_days must be a number.", ErrorText(reply));
+    }
+
+    [Theory]
+    [InlineData("")]
+    [InlineData("{")]
+    [InlineData("not json")]
+    public async Task Share_BodyThatIsNotJson_Returns400(string body)
+    {
+        using var app = new PlanShareApp();
+
+        var (status, reply) = await Send(app.CreateClient(), Post, "/api/share", Caller, body);
+
+        Assert.Equal(HttpStatusCode.BadRequest, status);
+        Assert.False(string.IsNullOrEmpty(ErrorText(reply)));
+    }
+
+    [Theory]
+    [InlineData("""{"ttl_days":null}""")]
+    [InlineData("""{}""")]
+    [InlineData("""{"ttl_days":1.5}""")]
+    public async Task Share_TtlDaysThatIsMissingNullOrNotAWholeNumber_UsesTheDefault(string body)
+    {
+        using var app = new PlanShareApp();
+
+        var (status, _) = await Send(app.CreateClient(), Post, "/api/share", Caller, body);
+
+        Assert.Equal(HttpStatusCode.OK, status);
+    }
+
+    [Fact]
+    public async Task Share_WhenTheStoreIsFull_Returns507_AndStoresNothing()
+    {
+        using var app = new PlanShareApp(maxDatabaseBytes: 1);
+
+        var (status, reply) = await Send(app.CreateClient(), Post, "/api/share", Caller, SmallShare);
+
+        Assert.Equal(HttpStatusCode.InsufficientStorage, status);
+        Assert.Equal("Plan sharing is full right now. Please try again later.", ErrorText(reply));
+        Assert.Equal(0, app.Count("plans"));
+    }
+
+    [Fact]
+    public async Task Share_OverTheDailyBudget_Returns429_ForThatCallerOnly()
+    {
+        var size = Encoding.UTF8.GetByteCount(SmallShare);
+        using var app = new PlanShareApp(dailyUploadBytes: size * 2);
+        var http = app.CreateClient();
+        await ShareOne(http);
+        await ShareOne(http);
+
+        var (status, reply) = await Send(http, Post, "/api/share", Caller, SmallShare);
+
+        Assert.Equal(HttpStatusCode.TooManyRequests, status);
+        Assert.Equal("Daily sharing limit reached for your network. Please try again tomorrow.", ErrorText(reply));
+        Assert.Equal(2, app.Count("plans"));
+        await ShareOne(http, caller: "203.0.113.99");
+        Assert.Equal(3, app.Count("plans"));
+    }
+
+    [Fact]
+    public async Task Share_BudgetIsCountedPerClientKey_SoAnIPv4AndItsMappedFormShareOne()
+    {
+        var size = Encoding.UTF8.GetByteCount(SmallShare);
+        using var app = new PlanShareApp(dailyUploadBytes: size);
+        var http = app.CreateClient();
+        await ShareOne(http, caller: "203.0.113.10");
+
+        var (status, _) = await Send(http, Post, "/api/share", "::ffff:203.0.113.10", SmallShare);
+
+        Assert.Equal(HttpStatusCode.TooManyRequests, status);
+    }
+
+    [Fact]
+    public async Task Share_BudgetIsCountedPerSlash64_SoAddressesInOneShareItAndOtherPrefixesDoNot()
+    {
+        var size = Encoding.UTF8.GetByteCount(SmallShare);
+        using var app = new PlanShareApp(dailyUploadBytes: size);
+        var http = app.CreateClient();
+        await ShareOne(http, caller: "2001:db8:1:2::1");
+
+        var (sameSlash64, _) = await Send(http, Post, "/api/share", "2001:db8:1:2:aaaa:bbbb:cccc:dddd", SmallShare);
+        var (otherSlash64, _) = await Send(http, Post, "/api/share", "2001:db8:1:3::1", SmallShare);
+
+        Assert.Equal(HttpStatusCode.TooManyRequests, sameSlash64);
+        Assert.Equal(HttpStatusCode.OK, otherSlash64);
+    }
+
+    [Fact]
+    public async Task Share_RateLimitIsPerClientKey_AndTheRefusalHasAnErrorText()
+    {
+        using var app = new PlanShareApp();
+        var http = app.CreateClient();
+        for (var i = 0; i < 10; i++)
+            await ShareOne(http, caller: $"2001:db8:5:5::{i + 1}");
+
+        // All ten came from one /64, so an eleventh from that /64 is over the 10 per minute limit
+        var (status, reply) = await Send(http, Post, "/api/share", "2001:db8:5:5:ffff::1", SmallShare);
+
+        Assert.Equal(HttpStatusCode.TooManyRequests, status);
+        Assert.Equal("Too many shares from your network. Please wait a minute and try again.", ErrorText(reply));
+        await ShareOne(http, caller: "2001:db8:5:6::1");
+    }
+
+    // --- /api/event ---
+
+    [Fact]
+    public async Task Event_StoresAPageView()
+    {
+        using var app = new PlanShareApp();
+
+        var (status, _) = await Send(app.CreateClient(), Post, "/api/event", Caller, """{"path":"/","referrer":"https://example.com/page?x=1"}""");
+
+        Assert.Equal(HttpStatusCode.OK, status);
+        Assert.Equal(1, app.Count("page_views"));
+    }
+
+    [Theory]
+    [InlineData("[1]")]
+    [InlineData("\"x\"")]
+    [InlineData("7")]
+    [InlineData("null")]
+    public async Task Event_RootThatIsNotAnObject_Returns400(string body)
+    {
+        using var app = new PlanShareApp();
+
+        var (status, _) = await Send(app.CreateClient(), Post, "/api/event", Caller, body);
+
+        Assert.Equal(HttpStatusCode.BadRequest, status);
+        Assert.Equal(0, app.Count("page_views"));
+    }
+
+    [Theory]
+    [InlineData("""{"path":5}""")]
+    [InlineData("""{"path":["/"]}""")]
+    [InlineData("""{"path":true}""")]
+    [InlineData("""{"path":{}}""")]
+    [InlineData("""{"referrer":5}""")]
+    [InlineData("""{"referrer":{"host":"x"}}""")]
+    public async Task Event_FieldOfTheWrongType_Returns400(string body)
+    {
+        using var app = new PlanShareApp();
+
+        var (status, _) = await Send(app.CreateClient(), Post, "/api/event", Caller, body);
+
+        Assert.Equal(HttpStatusCode.BadRequest, status);
+        Assert.Equal(0, app.Count("page_views"));
+    }
+
+    [Theory]
+    [InlineData("{")]
+    [InlineData("")]
+    [InlineData("""{"path":"\ud800"}""")]
+    public async Task Event_BodyThatIsNotUsableJson_Returns400(string body)
+    {
+        using var app = new PlanShareApp();
+
+        var (status, _) = await Send(app.CreateClient(), Post, "/api/event", Caller, body);
+
+        Assert.Equal(HttpStatusCode.BadRequest, status);
+    }
+
+    [Fact]
+    public async Task Event_NullFields_AreTreatedAsNotSent()
+    {
+        using var app = new PlanShareApp();
+
+        var (status, _) = await Send(app.CreateClient(), Post, "/api/event", Caller, """{"path":null,"referrer":null}""");
+
+        Assert.Equal(HttpStatusCode.OK, status);
+        Assert.Equal(1, app.Count("page_views"));
+    }
+
+    [Fact]
+    public async Task Event_PathOf512Characters_IsAccepted_AndOf513IsRefused()
+    {
+        using var app = new PlanShareApp();
+        var http = app.CreateClient();
+
+        var (accepted, _) = await Send(http, Post, "/api/event", Caller, $$"""{"path":"/{{new string('a', 511)}}"}""");
+        var (refused, reply) = await Send(http, Post, "/api/event", Caller, $$"""{"path":"/{{new string('a', 512)}}"}""");
+
+        Assert.Equal(HttpStatusCode.OK, accepted);
+        Assert.Equal(HttpStatusCode.BadRequest, refused);
+        Assert.Equal("path must be 512 characters or fewer.", ErrorText(reply));
+        Assert.Equal(1, app.Count("page_views"));
+    }
+
+    [Fact]
+    public async Task Event_WhenTheStoreIsFull_StoresNothing_AndStillAnswers200()
+    {
+        using var app = new PlanShareApp(maxDatabaseBytes: 1);
+
+        var (status, _) = await Send(app.CreateClient(), Post, "/api/event", Caller, """{"path":"/"}""");
+
+        Assert.Equal(HttpStatusCode.OK, status);
+        Assert.Equal(0, app.Count("page_views"));
+    }
+
+    // --- DELETE /api/plans/{id} ---
+
+    [Fact]
+    public async Task Delete_WithTheTokenInTheHeader_DeletesThePlan()
+    {
+        using var app = new PlanShareApp();
+        var http = app.CreateClient();
+        var (id, token) = await ShareOne(http);
+
+        using var request = PlanShareApp.Request(HttpMethod.Delete, $"/api/plans/{id}", Caller);
+        request.Headers.Add("X-Delete-Token", token);
+        using var response = await http.SendAsync(request, TestContext.Current.CancellationToken);
+
+        Assert.Equal(HttpStatusCode.OK, response.StatusCode);
+        Assert.Equal(0, app.Count("plans"));
+    }
+
+    [Fact]
+    public async Task Delete_WithTheTokenInTheQueryString_StillDeletesThePlan_ForOlderClients()
+    {
+        using var app = new PlanShareApp();
+        var http = app.CreateClient();
+        var (id, token) = await ShareOne(http);
+
+        var (status, _) = await Send(http, HttpMethod.Delete, $"/api/plans/{id}?token={token}", Caller);
+
+        Assert.Equal(HttpStatusCode.OK, status);
+        Assert.Equal(0, app.Count("plans"));
+    }
+
+    [Fact]
+    public async Task Delete_UsesTheHeaderToken_WhenTheQueryStringHasAnother()
+    {
+        using var app = new PlanShareApp();
+        var http = app.CreateClient();
+        var (id, token) = await ShareOne(http);
+
+        using var request = PlanShareApp.Request(HttpMethod.Delete, $"/api/plans/{id}?token=wrong", Caller);
+        request.Headers.Add("X-Delete-Token", token);
+        using var response = await http.SendAsync(request, TestContext.Current.CancellationToken);
+
+        Assert.Equal(HttpStatusCode.OK, response.StatusCode);
+    }
+
+    [Fact]
+    public async Task Delete_WithoutAToken_Returns400()
+    {
+        using var app = new PlanShareApp();
+        var http = app.CreateClient();
+        var (id, _) = await ShareOne(http);
+
+        var (status, reply) = await Send(http, HttpMethod.Delete, $"/api/plans/{id}", Caller);
+
+        Assert.Equal(HttpStatusCode.BadRequest, status);
+        Assert.Equal("Missing delete token", ErrorText(reply));
+        Assert.Equal(1, app.Count("plans"));
+    }
+
+    [Fact]
+    public async Task Delete_WithAWrongToken_Returns404_AndKeepsThePlan()
+    {
+        using var app = new PlanShareApp();
+        var http = app.CreateClient();
+        var (id, _) = await ShareOne(http);
+
+        using var request = PlanShareApp.Request(HttpMethod.Delete, $"/api/plans/{id}", Caller);
+        request.Headers.Add("X-Delete-Token", "0000");
+        using var response = await http.SendAsync(request, TestContext.Current.CancellationToken);
+
+        Assert.Equal(HttpStatusCode.NotFound, response.StatusCode);
+        Assert.Equal(1, app.Count("plans"));
+    }
+
+    // --- CORS: the web app calls the server from another origin ---
+
+    [Fact]
+    public async Task Cors_PreflightForADeleteWithTheTokenHeader_IsAllowed()
+    {
+        using var app = new PlanShareApp();
+        using var request = PlanShareApp.Request(HttpMethod.Options, "/api/plans/abc12345", Caller);
+        request.Headers.Add("Origin", "https://example.com");
+        request.Headers.Add("Access-Control-Request-Method", "DELETE");
+        request.Headers.Add("Access-Control-Request-Headers", "x-delete-token");
+
+        using var response = await app.CreateClient().SendAsync(request, TestContext.Current.CancellationToken);
+
+        Assert.True(response.IsSuccessStatusCode);
+        var allowedHeaders = string.Join(",", response.Headers.GetValues("Access-Control-Allow-Headers"));
+        Assert.True(
+            allowedHeaders == "*" || allowedHeaders.Contains("x-delete-token", StringComparison.OrdinalIgnoreCase),
+            $"Access-Control-Allow-Headers was '{allowedHeaders}'");
+        var allowedMethods = string.Join(",", response.Headers.GetValues("Access-Control-Allow-Methods"));
+        Assert.True(
+            allowedMethods == "*" || allowedMethods.Contains("DELETE"),
+            $"Access-Control-Allow-Methods was '{allowedMethods}'");
+    }
+}
diff --git a/tests/PlanViewer.Core.Tests/PlanShareServiceTests.cs b/tests/PlanViewer.Core.Tests/PlanShareServiceTests.cs
new file mode 100644
index 00000000..267d7dfe
--- /dev/null
+++ b/tests/PlanViewer.Core.Tests/PlanShareServiceTests.cs
@@ -0,0 +1,112 @@
+using System.Net;
+using System.Text;
+using PlanViewer.Core.Output;
+using PlanViewer.Web.Services;
+
+namespace PlanViewer.Core.Tests;
+
+/// <summary>
+/// The web client's share service, run against a stub HTTP handler, so nothing goes to the real
+/// server. The service source is compiled into this project (see the csproj) because the Blazor
+/// WASM project is not referenced here.
+/// </summary>
+public class PlanShareServiceTests
+{
+    private sealed class StubHandler : HttpMessageHandler
+    {
+        private readonly Func<HttpResponseMessage> _respond;
+
+        public StubHandler(Func<HttpResponseMessage> respond) => _respond = respond;
+
+        public HttpMethod? Method { get; private set; }
+        public Uri? Uri { get; private set; }
+        public Dictionary<string, string> Headers { get; } = new();
+
+        protected override Task<HttpResponseMessage> SendAsync(HttpRequestMessage request, CancellationToken cancellationToken)
+        {
+            // Copied here because the service disposes the request when the call returns
+            Method = request.Method;
+            Uri = request.RequestUri;
+            foreach (var header in request.Headers)
+                Headers[header.Key] = string.Join(",", header.Value);
+            return Task.FromResult(_respond());
+        }
+    }
+
+    private static HttpResponseMessage Reply(HttpStatusCode status, string body = "", string contentType = "application/json")
+    {
+        return new HttpResponseMessage(status) { Content = new StringContent(body, Encoding.UTF8, contentType) };
+    }
+
+    private static Task<PlanShareResult> Share(StubHandler handler)
+    {
+        var service = new PlanShareService(new HttpClient(handler));
+        return service.ShareAsync(new AnalysisResult(), "text report", ttlDays: 7);
+    }
+
+    [Fact]
+    public async Task Share_ReturnsTheIdAndDeleteToken()
+    {
+        var handler = new StubHandler(() => Reply(HttpStatusCode.OK, """{"id":"abc12345","delete_token":"0123abcd","expires_at":"2026-10-05"}"""));
+
+        var result = await Share(handler);
+
+        Assert.Equal("abc12345", result.Id);
+        Assert.Equal("0123abcd", result.DeleteToken);
+        Assert.Equal(HttpMethod.Post, handler.Method);
+        Assert.Equal($"{PlanShareService.ApiBase}/api/share", handler.Uri!.ToString());
+    }
+
+    [Theory]
+    [InlineData(HttpStatusCode.InsufficientStorage, "Plan sharing is full right now. Please try again later.")]
+    [InlineData(HttpStatusCode.TooManyRequests, "Daily sharing limit reached for your network. Please try again tomorrow.")]
+    [InlineData(HttpStatusCode.BadRequest, "The request body must be a JSON object.")]
+    public async Task Share_ShowsTheErrorTextTheServerSent(HttpStatusCode status, string error)
+    {
+        var handler = new StubHandler(() => Reply(status, $$"""{"error":"{{error}}"}"""));
+
+        var ex = await Assert.ThrowsAsync<PlanShareException>(() => Share(handler));
+
+        Assert.Equal(error, ex.Message);
+    }
+
+    [Theory]
+    [InlineData(HttpStatusCode.BadGateway, "<html><body>502 Bad Gateway</body></html>", "text/html")]
+    [InlineData(HttpStatusCode.TooManyRequests, "", "application/json")]
+    [InlineData(HttpStatusCode.InsufficientStorage, """{"message":"no error property"}""", "application/json")]
+    [InlineData(HttpStatusCode.InsufficientStorage, """{"error":5}""", "application/json")]
+    [InlineData(HttpStatusCode.InsufficientStorage, """{"error":"  "}""", "application/json")]
+    [InlineData(HttpStatusCode.BadRequest, """["error"]""", "application/json")]
+    public async Task Share_FallsBackToTheStatusCode_WhenTheReplyHasNoErrorText(HttpStatusCode status, string body, string contentType)
+    {
+        var handler = new StubHandler(() => Reply(status, body, contentType));
+
+        var ex = await Assert.ThrowsAsync<PlanShareException>(() => Share(handler));
+
+        Assert.Equal($"Share failed: server returned {(int)status}", ex.Message);
+    }
+
+    [Fact]
+    public async Task Delete_SendsTheTokenInAHeader_NotInTheUrl()
+    {
+        var handler = new StubHandler(() => Reply(HttpStatusCode.OK));
+        var service = new PlanShareService(new HttpClient(handler));
+
+        await service.DeleteAsync("abc12345", "0123456789abcdef0123456789abcdef");
+
+        Assert.Equal(HttpMethod.Delete, handler.Method);
+        Assert.Equal($"{PlanShareService.ApiBase}/api/plans/abc12345", handler.Uri!.ToString());
+        Assert.Equal("0123456789abcdef0123456789abcdef", handler.Headers["X-Delete-Token"]);
+    }
+
+    [Fact]
+    public async Task Delete_ThrowsTheUserFacingMessage_WhenTheServerRefuses()
+    {
+        var handler = new StubHandler(() => Reply(HttpStatusCode.NotFound));
+        var service = new PlanShareService(new HttpClient(handler));
+
+        var ex = await Assert.ThrowsAsync<PlanShareException>(() => service.DeleteAsync("abc12345", "token"));
+
+        Assert.Equal("Failed to delete shared plan.", ex.Message);
+    }
+}
diff --git a/tests/PlanViewer.Core.Tests/PlanShareStorageCheckTests.cs b/tests/PlanViewer.Core.Tests/PlanShareStorageCheckTests.cs
new file mode 100644
index 00000000..d37b7418
--- /dev/null
+++ b/tests/PlanViewer.Core.Tests/PlanShareStorageCheckTests.cs
@@ -0,0 +1,95 @@
+using Microsoft.Data.Sqlite;
+using PlanShare;
+
+namespace PlanViewer.Core.Tests;
+
+/// <summary>
+/// The share server stops taking uploads when the plan database reaches its size limit. Size is the
+/// pages in use, (page_count - freelist_count) * page_size, so these tests run against a real SQLite
+/// file with a small limit instead of a mock.
+/// </summary>
+public class PlanShareStorageCheckTests : IDisposable
+{
+    private readonly string _directory = Path.Combine(Path.GetTempPath(), "planshare-storage-" + Guid.NewGuid().ToString("N"));
+    private readonly string _dbPath;
+    private readonly string _connectionString;
+
+    public PlanShareStorageCheckTests()
+    {
+        Directory.CreateDirectory(_directory);
+        _dbPath = Path.Combine(_directory, "plans.db");
+        // No pooling, so the file is closed and can be deleted as soon as a command finishes
+        _connectionString = $"Data Source={_dbPath};Pooling=False";
+        Execute("CREATE TABLE plans (id INTEGER PRIMARY KEY, data BLOB NOT NULL);");
+    }
+
+    public void Dispose()
+    {
+        try { Directory.Delete(_directory, recursive: true); }
+        catch (IOException) { }
+    }
+
+    [Fact]
+    public void UsedBytes_IsTheFileLength_WhenNoPagesAreFree()
+    {
+        AddPlans(rows: 30, bytesPerRow: 8000);
+
+        var used = new StorageCheck(_connectionString, long.MaxValue).UsedBytes();
+
+        Assert.True(used > 30 * 8000);
+        Assert.Equal(new FileInfo(_dbPath).Length, used);
+    }
+
+    [Fact]
+    public void UsedBytes_LeavesOutFreePages_AfterRowsAreDeleted()
+    {
+        AddPlans(rows: 30, bytesPerRow: 8000);
+        var length = new FileInfo(_dbPath).Length;
+
+        Execute("DELETE FROM plans;");
+
+        var used = new StorageCheck(_connectionString, long.MaxValue).UsedBytes();
+        Assert.Equal(length, new FileInfo(_dbPath).Length);
+        Assert.True(used < length / 4, $"used {used} of {length}");
+    }
+
+    [Fact]
+    public void IsFull_IsTrueAtTheLimit_AndFalseJustBelowIt()
+    {
+        AddPlans(rows: 30, bytesPerRow: 8000);
+        var used = new StorageCheck(_connectionString, long.MaxValue).UsedBytes();
+
+        Assert.True(new StorageCheck(_connectionString, used).IsFull());
+        Assert.True(new StorageCheck(_connectionString, used - 1).IsFull());
+        Assert.False(new StorageCheck(_connectionString, used + 1).IsFull());
+    }
+
+    [Fact]
+    public void IsFull_GoesBackToFalse_WhenDeletedPlansFreeTheirPagesAndTheFileDoesNotShrink()
+    {
+        AddPlans(rows: 30, bytesPerRow: 8000);
+        var limit = 100 * 1024;
+        var check = new StorageCheck(_connectionString, limit);
+        Assert.True(check.IsFull());
+
+        Execute("DELETE FROM plans;");
+
+        Assert.True(new FileInfo(_dbPath).Length >= limit);
+        Assert.False(check.IsFull());
+    }
+
+    private void AddPlans(int rows, int bytesPerRow)
+    {
+        Execute($"WITH RECURSIVE n(i) AS (SELECT 1 UNION ALL SELECT i + 1 FROM n WHERE i < {rows}) " +
+                $"INSERT INTO plans (data) SELECT zeroblob({bytesPerRow}) FROM n;");
+    }
+
+    private void Execute(string sql)
+    {
+        using var conn = new SqliteConnection(_connectionString);
+        conn.Open();
+        using var cmd = conn.CreateCommand();
+        cmd.CommandText = sql;
+        cmd.ExecuteNonQuery();
+    }
+}
diff --git a/tests/PlanViewer.Core.Tests/PlanShareUploadBudgetTests.cs b/tests/PlanViewer.Core.Tests/PlanShareUploadBudgetTests.cs
new file mode 100644
index 00000000..48bed972
--- /dev/null
+++ b/tests/PlanViewer.Core.Tests/PlanShareUploadBudgetTests.cs
@@ -0,0 +1,127 @@
+using PlanShare;
+
+namespace PlanViewer.Core.Tests;
+
+/// <summary>
+/// The share server lets one client key store a fixed number of bytes per UTC day. The clock is
+/// injected so the day change can be tested without waiting for it.
+/// </summary>
+public class PlanShareUploadBudgetTests
+{
+    private const long Limit = 100;
+
+    private sealed class FakeClock : TimeProvider
+    {
+        public DateTimeOffset Now { get; set; } = new(2026, 9, 28, 12, 0, 0, TimeSpan.Zero);
+
+        public override DateTimeOffset GetUtcNow() => Now;
+    }
+
+    [Fact]
+    public void Charges_UpToTheLimit_AreAllowed()
+    {
+        var budget = new UploadBudget(Limit, new FakeClock());
+
+        Assert.True(budget.TryCharge("client", 60));
+        Assert.True(budget.TryCharge("client", 40));
+    }
+
+    [Fact]
+    public void ChargePastTheLimit_IsRefused()
+    {
+        var budget = new UploadBudget(Limit, new FakeClock());
+        Assert.True(budget.TryCharge("client", 100));
+
+        Assert.False(budget.TryCharge("client", 1));
+    }
+
+    [Fact]
+    public void SingleChargeLargerThanTheLimit_IsRefused()
+    {
+        var budget = new UploadBudget(Limit, new FakeClock());
+
+        Assert.False(budget.TryCharge("client", Limit + 1));
+    }
+
+    [Fact]
+    public void RefusedCharge_AddsNothingToTheTotal()
+    {
+        var budget = new UploadBudget(Limit, new FakeClock());
+        Assert.True(budget.TryCharge("client", 90));
+
+        Assert.False(budget.TryCharge("client", 20));
+        Assert.True(budget.TryCharge("client", 10));
+    }
+
+    [Fact]
+    public void EachClientKey_HasItsOwnBudget()
+    {
+        var budget = new UploadBudget(Limit, new FakeClock());
+        Assert.True(budget.TryCharge("first", 100));
+
+        Assert.False(budget.TryCharge("first", 1));
+        Assert.True(budget.TryCharge("second", 100));
+    }
+
+    [Fact]
+    public void Budget_ResetsAtTheStartOfTheNextUtcDay()
+    {
+        var clock = new FakeClock { Now = new DateTimeOffset(2026, 9, 28, 23, 59, 59, TimeSpan.Zero) };
+        var budget = new UploadBudget(Limit, clock);
+        Assert.True(budget.TryCharge("client", 100));
+        Assert.False(budget.TryCharge("client", 1));
+
+        clock.Now = new DateTimeOffset(2026, 9, 29, 0, 0, 0, TimeSpan.Zero);
+
+        Assert.True(budget.TryCharge("client", 100));
+        Assert.False(budget.TryCharge("client", 1));
+    }
+
+    [Fact]
+    public void Day_IsTheUtcDay_NotTheLocalDay()
+    {
+        // Both times are on 28 September at UTC-5, but 18:30 is 23:30 UTC and 19:30 is 00:30 UTC
+        // on the next day, so the second charge lands in a new budget.
+        var clock = new FakeClock { Now = new DateTimeOffset(2026, 9, 28, 18, 30, 0, TimeSpan.FromHours(-5)) };
+        var budget = new UploadBudget(Limit, clock);
+        Assert.True(budget.TryCharge("client", 100));
+        Assert.False(budget.TryCharge("client", 1));
+
+        clock.Now = new DateTimeOffset(2026, 9, 28, 19, 30, 0, TimeSpan.FromHours(-5));
+
+        Assert.True(budget.TryCharge("client", 100));
+    }
+
+    [Fact]
+    public void Sweep_RemovesKeysFromEarlierDays_AndKeepsTodaysCharges()
+    {
+        var clock = new FakeClock();
+        var budget = new UploadBudget(Limit, clock);
+        Assert.True(budget.TryCharge("old-1", 10));
+        Assert.True(budget.TryCharge("old-2", 10));
+
+        clock.Now = clock.Now.AddDays(1);
+        Assert.True(budget.TryCharge("current", 60));
+
+        Assert.Equal(2, budget.Sweep());
+        Assert.Equal(0, budget.Sweep());
+        Assert.False(budget.TryCharge("current", 50));
+        Assert.True(budget.TryCharge("current", 40));
+    }
+
+    [Fact]
+    public void ConcurrentCharges_NeverPassTheLimit()
+    {
+        const int limit = 1000;
+        var budget = new UploadBudget(limit, new FakeClock());
+        var allowed = 0;
+
+        Parallel.For(0, 4000, _ =>
+        {
+            if (budget.TryCharge("client", 1))
+                Interlocked.Increment(ref allowed);
+        });
+
+        Assert.Equal(limit, allowed);
+    }
+}
diff --git a/tests/PlanViewer.Core.Tests/PlanViewer.Core.Tests.csproj b/tests/PlanViewer.Core.Tests/PlanViewer.Core.Tests.csproj
index ea2973a7..6c81e5c3 100644
--- a/tests/PlanViewer.Core.Tests/PlanViewer.Core.Tests.csproj
+++ b/tests/PlanViewer.Core.Tests/PlanViewer.Core.Tests.csproj
@@ -34,6 +34,7 @@
   <ItemGroup>
     <PackageReference Include="Avalonia.Headless" Version="12.1.2" />
     <PackageReference Include="coverlet.collector" Version="10.0.1" />
+    <PackageReference Include="Microsoft.AspNetCore.Mvc.Testing" Version="10.0.12" />
     <PackageReference Include="Microsoft.NET.Test.Sdk" Version="18.10.1" />
     <PackageReference Include="Microsoft.Testing.Extensions.HangDump" Version="2.4.1" />
     <PackageReference Include="Repl.Testing" Version="0.11.0" />
@@ -44,6 +45,15 @@
     <ProjectReference Include="..\..\src\PlanViewer.Core\PlanViewer.Core.csproj" />
     <ProjectReference Include="..\..\src\PlanViewer.Cli\PlanViewer.Cli.csproj" />
     <ProjectReference Include="..\..\src\PlanViewer.App\PlanViewer.App.csproj" />
+    <!-- server/PlanShare is not in the solution and ci.yml never built it. Referencing it here builds
+         it with the solution and lets the tests reach its internal classes (InternalsVisibleTo). -->
+    <ProjectReference Include="..\..\server\PlanShare\PlanShare.csproj" />
+  </ItemGroup>
+
+  <ItemGroup>
+    <!-- The web client's share service is plain C#. It is compiled here, as PlanViewer.Web itself
+         links Core sources, because the Blazor WASM project is not referenced by the tests. -->
+    <Compile Include="..\..\src\PlanViewer.Web\Services\PlanShareService.cs" Link="Web\PlanShareService.cs" />
   </ItemGroup>
 
   <ItemGroup>