Harden the crash reporter: keep every dump, and say what crashed

Three weaknesses, all visible in ChuckNr11's report on #898 -- "the report
appeared only once despite there being 10 or more crashes".

One dump per run instead of one per install
-------------------------------------------
crashDumpPath() was a single fixed crash_dump.log, and the handler opens it
O_TRUNC, so each crash destroyed the evidence from the one before. Ten
crashes left one dump. Dumps now go to a crashes/ directory named
crash_<timestamp>_<pid>.log, and every pending one is offered together,
newest first, with a banner saying how many there are. A crash that repeats
is exactly the case where the earlier dumps matter, because the difference
between them is the evidence.

The name is built in normal context and handed to CrashHandler::install(),
which copies it into a preallocated buffer as before -- the handler still
writes to one fixed path, so its no-allocation invariant is untouched.

The dump now says which signal fired
------------------------------------
The header is built once at install(), so every dump looked identical no
matter what killed the process -- and SIGSEGV and SIGABRT point at very
different bugs. Written with an async-signal-safe integer formatter into a
stack buffer, since snprintf is not on the POSIX safe list.

...and where it was
-------------------
The ring said what the program was doing; nothing said where it died. The
dump now carries a backtrace. backtrace() is warmed once in install() so
its first-call lazy resolution cannot allocate inside the handler, and
backtrace_symbols_fd() writes straight to the fd -- unlike
backtrace_symbols(), which mallocs and must never be used here. Guarded on
__has_include(<execinfo.h>) so platforms without it are unaffected.

QET's own frames currently resolve as offsets rather than names, since the
binary does not export its dynamic symbols. They are still resolvable
offline: the header records the exact git SHA. Building with -rdynamic
would give names directly, but that is a build-flag decision for its own
change.

Deliberately unchanged: the four invariants in crashhandler.h. Nothing
added here allocates, blocks, takes a lock, or swallows the crash.

Verified: three consecutive SIGSEGVs now leave three separate dumps, each
carrying "Signal: 11" and a backtrace with resolved Qt frames; launching
afterwards offers all three in one dialog, newest first, and clears them
once shown. ctest 8/8.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

sources/logging/crashhandler.cpp

@@ -36,6 +36,10 @@
 #include <csignal>
 #include <fcntl.h>
 #include <unistd.h>
+#if __has_include(<execinfo.h>)
+#include <execinfo.h>
+#define QET_CRASH_BACKTRACE 1
+#endif
 #endif
 
 namespace {
@@ -64,6 +68,39 @@ char g_altstack[65536];
 
 const int kHandledSignals[] = {SIGSEGV, SIGABRT, SIGBUS, SIGFPE, SIGILL};
 
+#ifdef QET_CRASH_BACKTRACE
+// Preallocated here for the same reason as everything else in this block:
+// backtrace() fills a caller-supplied array, so it needs no heap of its
+// own, and backtrace_symbols_fd() writes straight to the fd (unlike
+// backtrace_symbols(), which mallocs and is therefore unusable here).
+void *g_backtrace_frames[64];
+#endif
+
+// Async-signal-safe decimal formatting: write() takes a buffer, and there
+// is no snprintf on the POSIX async-signal-safe list. Writes into a
+// caller-owned buffer (stack, not heap) and returns the length used.
+int formatInt(char *buffer, int size, int value)
+{
+	if (size <= 0) return 0;
+	if (value == 0) {
+		buffer[0] = '0';
+		return 1;
+	}
+	char scratch[16];
+	int n = 0;
+	bool negative = value < 0;
+	unsigned int v = negative ? static_cast<unsigned int>(-(value + 1)) + 1u
+				  : static_cast<unsigned int>(value);
+	while (v > 0 && n < static_cast<int>(sizeof(scratch))) {
+		scratch[n++] = static_cast<char>('0' + (v % 10));
+		v /= 10;
+	}
+	int len = 0;
+	if (negative && len < size) buffer[len++] = '-';
+	while (n > 0 && len < size) buffer[len++] = scratch[--n];
+	return len;
+}
+
 void restoreDefaultAndReraise(int sig)
 {
 	struct sigaction sa {};
@@ -85,13 +122,46 @@ void signalHandler(int sig)
 		return;
 	}
 
-	// open/write/close are all on the POSIX async-signal-safe function
-	// list; nothing else is called here.
+	// open/write/close, and backtrace_symbols_fd, are all on the POSIX
+	// async-signal-safe function list; nothing else is called here.
 	const int fd = ::open(g_dump_path, O_WRONLY | O_CREAT | O_TRUNC, 0600);
 	if (fd >= 0) {
 		if (g_header_len > 0) {
 			::write(fd, g_header, static_cast<size_t>(g_header_len));
 		}
+
+		// Which signal killed it. The header is built once at install()
+		// and is therefore identical for every crash, so without this the
+		// dump never said what actually happened -- SIGSEGV and SIGABRT
+		// point at very different bugs.
+		char line[64];
+		int len = 0;
+		const char kSignalLabel[] = "Signal: ";
+		for (unsigned i = 0 ; i < sizeof(kSignalLabel) - 1 ; ++i) {
+			line[len++] = kSignalLabel[i];
+		}
+		len += formatInt(line + len, static_cast<int>(sizeof(line)) - len - 1, sig);
+		line[len++] = '\n';
+		::write(fd, line, static_cast<size_t>(len));
+
+#ifdef QET_CRASH_BACKTRACE
+		// The log ring says what the program was doing; this says where it
+		// was when it died. backtrace() is warmed in install() so its
+		// first-call lazy resolution cannot allocate here, and
+		// backtrace_symbols_fd() writes to the fd without allocating --
+		// unlike backtrace_symbols(), which mallocs and must not be used.
+		const char kBacktraceLabel[] = "--- backtrace ---\n";
+		::write(fd, kBacktraceLabel, sizeof(kBacktraceLabel) - 1);
+		const int frames = ::backtrace(g_backtrace_frames,
+					       static_cast<int>(sizeof(g_backtrace_frames)
+								/ sizeof(g_backtrace_frames[0])));
+		if (frames > 0) {
+			::backtrace_symbols_fd(g_backtrace_frames, frames, fd);
+		}
+		const char kRingLabel[] = "--- log ---\n";
+		::write(fd, kRingLabel, sizeof(kRingLabel) - 1);
+#endif
+
 		if (g_ring) {
 			g_ring->dumpToFd(fd);
 		}
@@ -159,6 +229,15 @@ void CrashHandler::install(const LogRing *ring, const QString &dump_path)
 	ss.ss_flags = 0;
 	sigaltstack(&ss, nullptr);
 
+#ifdef QET_CRASH_BACKTRACE
+	// Warm the unwinder. backtrace()'s *first* call resolves dynamic
+	// linker state and may allocate; every call after that does not. Doing
+	// it here, in normal context, is what lets the handler call it without
+	// breaking invariant 2. The result is deliberately discarded.
+	void *warmup[4];
+	(void) ::backtrace(warmup, 4);
+#endif
+
 	struct sigaction sa {};
 	sa.sa_handler = signalHandler;
 	sigemptyset(&sa.sa_mask);