diff --git a/.github/workflows/build.yml b/.github/workflows/build.yml
index b4088fe8..97fece42 100644
--- a/.github/workflows/build.yml
+++ b/.github/workflows/build.yml
@@ -41,11 +41,13 @@ jobs:
       - uses: actions/checkout@v4
 
       # The keyframe and variants tests decode with ffmpeg, as the service does
-      # in its image. They fail rather than skip when CI is set and it is missing.
-      - name: Install ffmpeg
+      # in its image; the crash symbolizer's unwind with gdb-multiarch and
+      # unpack firmware with unsquashfs. They fail rather than skip when CI is
+      # set and one is missing.
+      - name: Install ffmpeg, gdb-multiarch and squashfs-tools
         run: |
           sudo apt-get update -qq
-          sudo apt-get install -y --no-install-recommends ffmpeg
+          sudo apt-get install -y --no-install-recommends ffmpeg gdb-multiarch squashfs-tools
 
       # --- the Go service (#287) ---------------------------------------------
       - uses: actions/setup-go@v5
diff --git a/CLAUDE.md b/CLAUDE.md
index f328b0ec..b3f34e8f 100644
--- a/CLAUDE.md
+++ b/CLAUDE.md
@@ -234,6 +234,21 @@ restores the image but never the schema, so keep migrations additive.
   merges: `bogus` takes back what a bug and the signatures merged into it
   paid, and undoing it lets the settlement pay again. A crash with a MAC is
   the camera's linked owner's, whoever sent it.
+  **majestic's own crashes** come the same way, as `/etc/crash/majestic.dump`
+  (class `user`, kind `signal`, migration 032), and are the maintainers'
+  only: never on `/crashes`, and a member is shown the signal, not where.
+  One arrives filed under a provisional signature (module and offset of the
+  faulting instruction) with its dump in `crash_dumps`; the firmware role's
+  `internal/crashes/symbolize` (woken by `NOTIFY crash_symbolize`) builds an
+  ELF core from it and unwinds it with `gdb-multiarch` against the
+  executable and debuginfo majestic's CI publishes by build-id
+  (`MAJESTIC_SYMBOLS_BASE`), naming library frames from the firmware build's
+  own rootfs (`unsquashfs` of its release tarball), and scanning the stack
+  for probable callers where gdb stops. Then the event is refiled under its
+  backtrace's signature (the crashes package's one change to an event) and
+  the dump -- majestic's memory -- is deleted. Retried for days when the
+  debuginfo is not there, then given up on. Cache under
+  `RELEASE_CACHE_ROOT/symbols`, swept after 30 days unused.
 - `internal/tools`, `internal/nfsro` — **ipctool for stock firmware**, which
   has no curl and no TLS. ipctool's release job pushes each build to
   `PUT /api/v1/tools/{name}` (OIDC, `internal/tools/PUSH.md`); nginx serves
diff --git a/data/locales/boards.en.yml b/data/locales/boards.en.yml
index 8ac9ea28..5ec6c8f5 100644
--- a/data/locales/boards.en.yml
+++ b/data/locales/boards.en.yml
@@ -49,7 +49,7 @@ en:
     club_crashes:
       eyebrow: 'OpenIPC Club'
       title: 'Crash triage'
-      lede: 'Kernel crashes cameras sent, worst first, with what it takes to reproduce each one.'
+      lede: 'Crashes cameras sent, the kernel''s and majestic''s, worst first, with what it takes to reproduce each one.'
     crashes:
       eyebrow: 'OpenIPC firmware'
       title: 'Kernel crashes from the field'
@@ -632,6 +632,7 @@ en:
       kind_oops: 'Oops'
       kind_bug: 'BUG'
       kind_warning: 'Warning'
+      kind_signal: 'majestic crashed'
       in_irq: 'in an interrupt'
       status_open: 'Not yet looked at'
       status_confirmed: 'Confirmed'
@@ -691,3 +692,7 @@ en:
       d_cmdline: 'Command line'
       d_anomalies: 'Before it'
       d_before: 'Warnings'
+      d_backtrace: 'Backtrace'
+      sym_pending: 'Waiting for its backtrace (tried {n} times)'
+      sym_failed: 'No backtrace'
+      probable: 'probable'
diff --git a/data/locales/boards.ru.yml b/data/locales/boards.ru.yml
index e9d6fc33..c1b4fc0a 100644
--- a/data/locales/boards.ru.yml
+++ b/data/locales/boards.ru.yml
@@ -49,7 +49,7 @@ ru:
     club_crashes:
       eyebrow: 'Клуб OpenIPC'
       title: 'Разбор падений'
-      lede: 'Падения ядра, присланные камерами, — сначала самые тяжёлые, с тем, что нужно, чтобы воспроизвести каждое.'
+      lede: 'Падения ядра и majestic, присланные камерами, — сначала самые тяжёлые, с тем, что нужно, чтобы воспроизвести каждое.'
     crashes:
       eyebrow: 'Прошивка OpenIPC'
       title: 'Падения ядра с реальных камер'
@@ -673,6 +673,7 @@ ru:
       kind_oops: 'Oops'
       kind_bug: 'BUG'
       kind_warning: 'Предупреждение'
+      kind_signal: 'Сбой majestic'
       in_irq: 'в прерывании'
       status_open: 'Ещё не разобрано'
       status_confirmed: 'Подтверждено'
@@ -736,3 +737,7 @@ ru:
       d_cmdline: 'Командная строка'
       d_anomalies: 'Перед этим'
       d_before: 'Предупреждения'
+      d_backtrace: 'Стек вызовов'
+      sym_pending: 'Ждёт стека вызовов (попыток: {n})'
+      sym_failed: 'Стека вызовов нет'
+      probable: 'вероятно'
diff --git a/frontend/apps/site/src/components/club/CrashTriage.tsx b/frontend/apps/site/src/components/club/CrashTriage.tsx
index aa444a75..6eb9ed3e 100644
--- a/frontend/apps/site/src/components/club/CrashTriage.tsx
+++ b/frontend/apps/site/src/components/club/CrashTriage.tsx
@@ -1,8 +1,9 @@
 /**
- * /club/crashes: the maintainers' triage of kernel crashes. Every signature,
- * worst first; one opens to what it takes to reproduce it -- the chips,
- * sensors and builds it was seen on, the firmware builds whose time matches
- * its kernel, and each crash's redacted log, warnings and lead-up.
+ * /club/crashes: the maintainers' triage of kernel crashes and majestic's.
+ * Every signature, worst first; one opens to what it takes to reproduce it --
+ * the chips, sensors and builds it was seen on, the firmware builds whose time
+ * matches its kernel, and each crash's redacted log, warnings and lead-up, or
+ * for majestic's, its backtrace from the debuginfo of its build.
  *
  * Confirming a bug pays its first reporter, fixing it pays them again;
  * bogus takes back every star it paid. The same is `openipc crashes status`.
@@ -12,7 +13,8 @@ import { useBoardsTranslations, type BoardsT } from '../../lib/boards-i18n';
 import { pathFor, type Locale } from '../../lib/i18n';
 import { ClubError, fetchMe } from '../../lib/club';
 import {
-  decideCrash, fetchCrashDetail, fetchTriage, frame, KIND_TONE, STATUS_TONE, type Combo, type Detail, type Signature, type Status,
+  decideCrash, fetchCrashDetail, fetchTriage, frame, frameAt, KIND_TONE, STATUS_TONE, type Combo, type Detail, type Frame, type Signature,
+  type Status,
 } from '../../lib/crashes';
 
 type Load = { state: 'loading' } | { state: 'ok'; list: Signature[] } | { state: 'forbidden' } | { state: 'error' };
@@ -81,9 +83,7 @@ function Open({ g, t, onDone }: { g: Signature; t: BoardsT; onDone: () => void }
   const field = 'min-w-0 rounded-md border border-hairline px-2 py-1 text-sm';
   return (
     <div class="grid gap-3 border-t border-hairline pt-3 text-[13px]">
-      <pre class="m-0 overflow-x-auto rounded-md bg-surface-alt p-2.5 font-mono text-[12px] leading-relaxed">
-        {g.frames.slice(0, 10).map((f, i) => `${i === 0 ? '' : '← '}${frame(f)}`).join('\n')}
-      </pre>
+      <Backtrace frames={g.frames.slice(0, 10)} t={t} />
       <form class="grid gap-2 sm:grid-cols-2" onSubmit={save}>
         <label class="grid gap-1">{t('crashes.f_status')}
           <select class={field} value={status} onChange={(e) => setStatus((e.target as HTMLSelectElement).value as Status)}>
@@ -125,6 +125,15 @@ function Open({ g, t, onDone }: { g: Signature; t: BoardsT; onDone: () => void }
   );
 }
 
+/** A backtrace, innermost first; the scan's probable callers marked so. */
+function Backtrace({ frames, t }: { frames: Frame[]; t: BoardsT }) {
+  return (
+    <pre class="m-0 overflow-x-auto rounded-md bg-surface-alt p-2.5 font-mono text-[12px] leading-relaxed">
+      {frames.map((f, i) => `${i === 0 ? '' : '← '}${frameAt(f)}${f.probable ? `  (${t('crashes.probable')})` : ''}`).join('\n')}
+    </pre>
+  );
+}
+
 function Crash({ d, t }: { d: Detail; t: BoardsT }) {
   const anomalies = Object.entries(d.anomalies ?? {});
   return (
@@ -136,19 +145,35 @@ function Crash({ d, t }: { d: Detail; t: BoardsT }) {
       <dl class="m-0 mt-2 grid gap-x-3 gap-y-0.5 sm:grid-cols-[max-content_1fr]">
         <dt class="text-body-secondary">{t('crashes.d_hardware')}</dt><dd class="m-0 font-mono">{[d.soc, d.sensor, d.board, d.machine].filter(Boolean).join(' · ')}</dd>
         <dt class="text-body-secondary">{t('crashes.d_firmware')}</dt><dd class="m-0 font-mono">{[d.firmware, d.majestic && `majestic ${d.majestic}`].filter(Boolean).join(' · ') || '?'}</dd>
-        <dt class="text-body-secondary">{t('crashes.d_kernel')}</dt><dd class="m-0 font-mono">{d.kernel} {d.kernel_build}</dd>
+        {d.kernel && <><dt class="text-body-secondary">{t('crashes.d_kernel')}</dt><dd class="m-0 font-mono">{d.kernel} {d.kernel_build}</dd></>}
         {d.builds && d.builds.length > 0 && (
           <><dt class="text-body-secondary">{t('crashes.d_builds')}</dt><dd class="m-0 font-mono">{d.builds.map((b) => `${b.release} (${b.sha.slice(0, 7)})`).join(', ')}</dd></>
         )}
         <dt class="text-body-secondary">{t('crashes.d_task')}</dt><dd class="m-0 font-mono">{d.fatal.comm ?? '?'}{d.fatal.interrupted?.length ? ` · ${t('crashes.d_interrupted')} ${d.fatal.interrupted.map(frame).join(' ← ')}` : ''}</dd>
         {d.uptime != null && <><dt class="text-body-secondary">{t('crashes.d_uptime')}</dt><dd class="m-0 tabular-nums">{Math.round(d.uptime)} s</dd></>}
-        <dt class="text-body-secondary">{t('crashes.d_cmdline')}</dt><dd class="m-0 font-mono break-all">{d.cmdline}</dd>
+        {d.cmdline && <><dt class="text-body-secondary">{t('crashes.d_cmdline')}</dt><dd class="m-0 font-mono break-all">{d.cmdline}</dd></>}
         {anomalies.length > 0 && <><dt class="text-body-secondary">{t('crashes.d_anomalies')}</dt><dd class="m-0 font-mono">{anomalies.map(([k, v]) => `${k} ×${v}`).join(', ')}</dd></>}
         {d.before.length > 0 && <><dt class="text-body-secondary">{t('crashes.d_before')}</dt><dd class="m-0 font-mono">{d.before.map((b) => `${b.reason} (${b.comm ?? '?'}) ${b.frames.slice(0, 3).map(frame).join(' ← ')}`).join('; ')}</dd></>}
       </dl>
+      {d.symbolization && <Symbolized s={d.symbolization} t={t} />}
       {d.leadup.length > 0 && <pre class="mt-2 mb-0 overflow-x-auto rounded bg-surface-alt p-2 font-mono text-[11.5px]">{d.leadup.join('\n')}</pre>}
       {d.meta != null && <pre class="mt-2 mb-0 max-h-60 overflow-auto rounded bg-surface-alt p-2 font-mono text-[11.5px]">{JSON.stringify(d.meta, null, 2)}</pre>}
       {d.log && <pre class="mt-2 mb-0 max-h-96 overflow-auto rounded bg-ink p-2 font-mono text-[11.5px] text-white">{d.log}</pre>}
     </details>
   );
 }
+
+/** How a majestic crash's dump was unwound: its backtrace, or why not yet. */
+function Symbolized({ s, t }: { s: NonNullable<Detail['symbolization']>; t: BoardsT }) {
+  return (
+    <div class="mt-2 grid gap-1">
+      <span class="text-body-secondary">
+        {t('crashes.d_backtrace')}
+        {s.status === 'pending' && ` · ${t('crashes.sym_pending', { n: s.attempts })}`}
+        {s.status === 'failed' && ` · ${t('crashes.sym_failed')}`}
+        {s.error && <span class="font-mono"> · {s.error}</span>}
+      </span>
+      {s.frames.length > 0 && <Backtrace frames={s.frames} t={t} />}
+    </div>
+  );
+}
diff --git a/frontend/apps/site/src/components/club/Crashes.test.tsx b/frontend/apps/site/src/components/club/Crashes.test.tsx
index cfeabea6..53578d03 100644
--- a/frontend/apps/site/src/components/club/Crashes.test.tsx
+++ b/frontend/apps/site/src/components/club/Crashes.test.tsx
@@ -42,3 +42,18 @@ test('a crash log is sent and filed under its bug', async () => {
   // The list reloads: the crash is there too, under its bug.
   await waitFor(() => expect(getAllByText(/RGN_PutRegion/).length).toBe(2));
 });
+
+test("a crash of majestic's is named by its signal, and not linked to the public list", async () => {
+  vi.stubGlobal('fetch', vi.fn(async (url: string) => {
+    if (url === '/api/v1/club/crashes') {
+      return new Response(JSON.stringify({ crashes: [{ id: 'c-majestic2', signature: '0123456789ac', title: 'SIGSEGV (NULL pointer)',
+        kind: 'signal', status: 'open', soc: 'gk7205v300', sensor: 'imx335', received_at: '2026-10-09T01:00:00Z', self_inflicted: false,
+        camera: true }], stars: 0, rules: { report: 1, first: 3, fixed: 5, month_cap: 10 } }));
+    }
+    return new Response('{}', { status: 404 });
+  }));
+  const { findByText } = render(<Harness />);
+  const title = await findByText('SIGSEGV (NULL pointer)');
+  expect(title.closest('a')).toBeNull();
+  expect(await findByText('majestic crashed')).toBeTruthy();
+});
diff --git a/frontend/apps/site/src/components/club/Crashes.tsx b/frontend/apps/site/src/components/club/Crashes.tsx
index 5ec29760..1a8dba32 100644
--- a/frontend/apps/site/src/components/club/Crashes.tsx
+++ b/frontend/apps/site/src/components/club/Crashes.tsx
@@ -70,7 +70,9 @@ export default function Crashes({ locale, t, onChange }: { locale: Locale; t: Bo
         {state.s === 'sent' && (
           <p class="m-0 rounded-md bg-[#e7f5ee] px-3 py-2 text-sm text-[#1f7a4d]" role="status">
             {t(state.r.self_inflicted ? 'crashes.sent_self' : state.r.duplicate ? 'crashes.sent_again' : 'crashes.sent')}{' '}
-            <a href={`${pathFor(locale, '/crashes')}#${state.r.signature}`} class="font-mono">{state.r.title}</a>
+            {state.r.kind === 'signal'
+              ? <span class="font-mono">{state.r.title}</span>
+              : <a href={`${pathFor(locale, '/crashes')}#${state.r.signature}`} class="font-mono">{state.r.title}</a>}
           </p>
         )}
         {state.s === 'error' && <p class="m-0 text-sm text-[#a3262e]" role="alert">{state.error}</p>}
@@ -87,7 +89,10 @@ export default function Crashes({ locale, t, onChange }: { locale: Locale; t: Bo
                 {c.self_inflicted && <span class="text-[12px] text-body-secondary">{t('crashes.self_inflicted')}</span>}
                 <span class="text-[12px] text-body-secondary">{c.received_at.slice(0, 10)} · {[c.soc, c.sensor].filter(Boolean).join(' · ').toUpperCase()}</span>
               </span>
-              <a class="font-mono break-words" href={`${pathFor(locale, '/crashes')}#${c.signature}`}>{c.title}</a>
+              {/* majestic's crashes are not on the public list. */}
+              {c.kind === 'signal'
+                ? <span class="font-mono break-words">{c.title}</span>
+                : <a class="font-mono break-words" href={`${pathFor(locale, '/crashes')}#${c.signature}`}>{c.title}</a>}
             </li>
           ))}
         </ul>
diff --git a/frontend/apps/site/src/i18n/boards.en.json b/frontend/apps/site/src/i18n/boards.en.json
index 98c6845e..3a923779 100644
--- a/frontend/apps/site/src/i18n/boards.en.json
+++ b/frontend/apps/site/src/i18n/boards.en.json
@@ -251,6 +251,7 @@
       "col_soc": "SoC",
       "current": "In current firmware",
       "d_anomalies": "Before it",
+      "d_backtrace": "Backtrace",
       "d_before": "Warnings",
       "d_builds": "Matching builds",
       "d_cmdline": "Command line",
@@ -285,6 +286,7 @@
       "kind_bug": "BUG",
       "kind_oops": "Oops",
       "kind_panic": "Kernel panic",
+      "kind_signal": "majestic crashed",
       "kind_warning": "Warning",
       "last_seen": "last {date}",
       "list_label": "Kernel crashes, worst first",
@@ -293,6 +295,7 @@
       "mine_empty": "No crash sent yet, from you or your linked cameras.",
       "mine_lede": "Each bug a camera of yours hits earns {report} ★ once settled; if you were the first to send it, {first} ★ more when a maintainer confirms it and {fixed} ★ when it is fixed. At most {cap} ★ a month from crashes; a crash you caused on purpose earns nothing.",
       "mine_title": "My crash reports",
+      "probable": "probable",
       "saved": "Saved.",
       "self_inflicted": "caused on purpose",
       "send": "Send the crash log",
@@ -305,6 +308,8 @@
       "status_fixed": "Fixed",
       "status_open": "Not yet looked at",
       "status_wontfix": "Will not be fixed",
+      "sym_failed": "No backtrace",
+      "sym_pending": "Waiting for its backtrace (tried {n} times)",
       "taken_back": "Saved; {n} ★ taken back.",
       "triage_forbidden": "Only OpenIPC's maintainers triage crashes.",
       "triage_link": "Crash triage"
diff --git a/frontend/apps/site/src/i18n/boards.ru.json b/frontend/apps/site/src/i18n/boards.ru.json
index 6d45fe60..febe4efa 100644
--- a/frontend/apps/site/src/i18n/boards.ru.json
+++ b/frontend/apps/site/src/i18n/boards.ru.json
@@ -255,6 +255,7 @@
       "col_soc": "SoC",
       "current": "В текущей прошивке",
       "d_anomalies": "Перед этим",
+      "d_backtrace": "Стек вызовов",
       "d_before": "Предупреждения",
       "d_builds": "Подходящие сборки",
       "d_cmdline": "Командная строка",
@@ -291,6 +292,7 @@
       "kind_bug": "BUG",
       "kind_oops": "Oops",
       "kind_panic": "Kernel panic",
+      "kind_signal": "Сбой majestic",
       "kind_warning": "Предупреждение",
       "last_seen": "последнее {date}",
       "list_label": "Падения ядра, сначала самые тяжёлые",
@@ -299,6 +301,7 @@
       "mine_empty": "Пока ни одного падения — ни от вас, ни от привязанных камер.",
       "mine_lede": "Каждая ошибка, на которую попала ваша камера, приносит {report} ★ после расчёта; если вы прислали её первым — ещё {first} ★, когда мейнтейнер подтвердит, и {fixed} ★, когда её исправят. Не больше {cap} ★ в месяц за падения; падение, вызванное нарочно, ничего не приносит.",
       "mine_title": "Мои отчёты о падениях",
+      "probable": "вероятно",
       "saved": "Сохранено.",
       "self_inflicted": "вызвано нарочно",
       "send": "Отправить лог падения",
@@ -311,6 +314,8 @@
       "status_fixed": "Исправлено",
       "status_open": "Ещё не разобрано",
       "status_wontfix": "Исправлено не будет",
+      "sym_failed": "Стека вызовов нет",
+      "sym_pending": "Ждёт стека вызовов (попыток: {n})",
       "taken_back": "Сохранено; списано {n} ★.",
       "triage_forbidden": "Разбирать падения могут только мейнтейнеры OpenIPC.",
       "triage_link": "Разбор падений"
diff --git a/frontend/apps/site/src/i18n/en.json b/frontend/apps/site/src/i18n/en.json
index e7e4c5bb..536e80d8 100644
--- a/frontend/apps/site/src/i18n/en.json
+++ b/frontend/apps/site/src/i18n/en.json
@@ -164,7 +164,7 @@
     },
     "club_crashes": {
       "eyebrow": "OpenIPC Club",
-      "lede": "Kernel crashes cameras sent, worst first, with what it takes to reproduce each one.",
+      "lede": "Crashes cameras sent, the kernel's and majestic's, worst first, with what it takes to reproduce each one.",
       "title": "Crash triage"
     },
     "club_leaderboard": {
diff --git a/frontend/apps/site/src/i18n/ru.json b/frontend/apps/site/src/i18n/ru.json
index dd14b61c..ac75d0f8 100644
--- a/frontend/apps/site/src/i18n/ru.json
+++ b/frontend/apps/site/src/i18n/ru.json
@@ -164,7 +164,7 @@
     },
     "club_crashes": {
       "eyebrow": "Клуб OpenIPC",
-      "lede": "Падения ядра, присланные камерами, — сначала самые тяжёлые, с тем, что нужно, чтобы воспроизвести каждое.",
+      "lede": "Падения ядра и majestic, присланные камерами, — сначала самые тяжёлые, с тем, что нужно, чтобы воспроизвести каждое.",
       "title": "Разбор падений"
     },
     "club_leaderboard": {
diff --git a/frontend/apps/site/src/lib/crashes.ts b/frontend/apps/site/src/lib/crashes.ts
index 250e8fdd..90b6d223 100644
--- a/frontend/apps/site/src/lib/crashes.ts
+++ b/frontend/apps/site/src/lib/crashes.ts
@@ -3,18 +3,24 @@
  * (service/internal/crashes): the public list of signatures at
  * /api/v1/crashes, and under /api/v1/club the member's own crashes and the
  * maintainers' triage. A signature is the top of a crash's backtrace: one bug,
- * however many cameras sent it.
+ * however many cameras sent it. majestic's own crashes (kind signal, class
+ * user) are the maintainers' only: the public list never has them.
  */
 import { ClubError } from './club';
 
-export type Kind = 'bootloop' | 'panic' | 'oops' | 'bug' | 'warning';
+export type Kind = 'bootloop' | 'panic' | 'oops' | 'bug' | 'signal' | 'warning';
 export type Status = 'open' | 'confirmed' | 'fixed' | 'wontfix' | 'bogus';
 
-export interface Frame { fn: string; module?: string }
+/**
+ * A function in a backtrace. A frame of majestic's says where in its source;
+ * a probable one was found by scanning the stack past where the unwinder
+ * stopped.
+ */
+export interface Frame { fn: string; module?: string; file?: string; line?: number; probable?: boolean }
 
 export interface Signature {
   id: string;
-  class: 'fatal' | 'warning';
+  class: 'fatal' | 'warning' | 'user';
   kind: Kind;
   title: string;
   frames: Frame[];
@@ -84,6 +90,17 @@ export interface Detail {
   meta?: unknown;
   log?: string;
   builds?: { id: string; release: string; sha: string; built_at: string }[];
+  /** A majestic crash's backtrace, or why it has none yet. */
+  symbolization?: Symbolization;
+}
+
+export interface Symbolization {
+  status: 'pending' | 'done' | 'failed';
+  attempts: number;
+  frames: Frame[];
+  sources?: Record<string, unknown>;
+  error?: string;
+  at: string;
 }
 
 export interface Mine {
@@ -145,11 +162,15 @@ export const decideCrash = (id: string, t: Triage) =>
 /** A frame as a backtrace prints it: fn [module]. */
 export const frame = (f: Frame) => (f.module ? `${f.fn} [${f.module}]` : f.fn);
 
+/** A frame with where in the source it is, when that is known. */
+export const frameAt = (f: Frame) => (f.file ? `${frame(f)}  ${f.file}:${f.line ?? 0}` : frame(f));
+
 export const KIND_TONE: Record<Kind, string> = {
   bootloop: 'bg-[#fbe9ea] text-[#a3262e]',
   panic: 'bg-[#fbe9ea] text-[#a3262e]',
   oops: 'bg-[#fff4e2] text-[#8a4b00]',
   bug: 'bg-[#fff4e2] text-[#8a4b00]',
+  signal: 'bg-[#fff4e2] text-[#8a4b00]',
   warning: 'bg-surface-alt text-body-secondary',
 };
 
diff --git a/service/Dockerfile b/service/Dockerfile
index 163945b2..38c2c618 100644
--- a/service/Dockerfile
+++ b/service/Dockerfile
@@ -6,7 +6,10 @@
 # The runtime is Debian bookworm. The wall publishes what cameras send without
 # re-encoding it, and ffmpeg is here only to decode each uploaded keyframe once
 # before it is published (internal/keyframe.Check): those bytes go to visitors'
-# decoders untouched. The binary itself is static (CGO_ENABLED=0).
+# decoders untouched. gdb-multiarch and squashfs-tools are the crash
+# symbolizer's (internal/crashes/symbolize): it unwinds majestic's crash dumps
+# with gdb, and takes the libraries the camera ran out of its firmware's
+# rootfs. The binary itself is static (CGO_ENABLED=0).
 
 FROM golang:1.27.1 AS build
 WORKDIR /src/service
@@ -18,7 +21,7 @@ RUN CGO_ENABLED=0 go build -trimpath -ldflags "-s -w -X main.version=${REVISION}
 
 FROM debian:bookworm-slim
 RUN apt-get update -qq \
- && apt-get install -y --no-install-recommends ca-certificates curl git ffmpeg \
+ && apt-get install -y --no-install-recommends ca-certificates curl git ffmpeg gdb-multiarch squashfs-tools \
  && rm -rf /var/lib/apt/lists/* \
  && groupadd --gid 1000 openipc \
  && useradd --uid 1000 --gid 1000 --no-create-home --shell /usr/sbin/nologin openipc
diff --git a/service/cmd/openipc/main.go b/service/cmd/openipc/main.go
index 12bc4fd4..c4a4f5fd 100644
--- a/service/cmd/openipc/main.go
+++ b/service/cmd/openipc/main.go
@@ -29,6 +29,7 @@ import (
 	"net/http"
 	"os"
 	"os/signal"
+	"path/filepath"
 	"strings"
 	"syscall"
 	"time"
@@ -41,6 +42,7 @@ import (
 	"github.com/OpenIPC/website/service/internal/club"
 	"github.com/OpenIPC/website/service/internal/config"
 	"github.com/OpenIPC/website/service/internal/crashes"
+	"github.com/OpenIPC/website/service/internal/crashes/symbolize"
 	"github.com/OpenIPC/website/service/internal/db"
 	"github.com/OpenIPC/website/service/internal/downloads"
 	"github.com/OpenIPC/website/service/internal/drift"
@@ -625,8 +627,16 @@ func firmwareRole(ctx context.Context, cfg *config.Config, log *slog.Logger, poo
 		}
 	}
 
+	// majestic's crash dumps, unwound here because the release tarballs
+	// their libraries come from are (internal/crashes/symbolize).
+	sym := &symbolize.Worker{Pool: pool, Log: log, KeepFor: 30 * 24 * time.Hour, Symbolizer: &symbolize.Symbolizer{
+		Symbols: &symbolize.Symbols{Root: filepath.Join(cfg.ReleaseCacheRoot, "symbols"), Base: cfg.SymbolsBase},
+		Rootfs:  &symbolize.Rootfs{Root: filepath.Join(cfg.ReleaseCacheRoot, "symbols"), DB: pool, Releases: releases},
+	}}
+
 	bg, cancel := context.WithCancel(context.WithoutCancel(ctx))
 	go index.Run(bg)
+	go sym.Run(bg)
 	return cancel, nil
 }
 
diff --git a/service/internal/config/config.go b/service/internal/config/config.go
index 65dc850e..563803eb 100644
--- a/service/internal/config/config.go
+++ b/service/internal/config/config.go
@@ -68,6 +68,9 @@ type Config struct {
 	BuildsPerMinute     int
 	DownloadBase        string
 	BuilderBase         string
+	// SymbolsBase is where majestic's CI publishes each build's executable
+	// and debuginfo by build-id, for symbolizing its crashes.
+	SymbolsBase string
 
 	// Share role.
 	ShareOrigins    []string // SHARE_ORIGINS: host patterns a page's WebSocket may come from
@@ -116,6 +119,7 @@ func Load() (*Config, error) {
 		BuildsPerMinute:     num("FIRMWARE_BUILDS_PER_MINUTE", 6),
 		DownloadBase:        str("RELEASE_DOWNLOAD_BASE", "https://github.com/OpenIPC/firmware/releases/download"),
 		BuilderBase:         str("BUILDER_DOWNLOAD_BASE", "https://github.com/OpenIPC/builder/releases/download"),
+		SymbolsBase:         str("MAJESTIC_SYMBOLS_BASE", "https://openipc.s3.eu-west-1.amazonaws.com/buildid"),
 		ShareOrigins:        listOr("SHARE_ORIGINS", []string{"*.share.openipc.cloud"}),
 		ShareSTUN:           listOr("SHARE_STUN_URLS", []string{"stun:stun.cloudflare.com:3478"}),
 		ShareTURN:           list("SHARE_TURN_URLS"),
diff --git a/service/internal/crashes/CRASH.md b/service/internal/crashes/CRASH.md
index d8d94271..027ca23c 100644
--- a/service/internal/crashes/CRASH.md
+++ b/service/internal/crashes/CRASH.md
@@ -62,6 +62,27 @@ Public: the signature, the chips and sensors it was seen on, and its status.
 A crash asked for -- `echo c > /proc/sysrq-trigger` -- is kept but never
 listed and never pays: send real ones.
 
+## majestic's own crashes
+
+When majestic itself dies of SIGSEGV, SIGBUS, SIGILL, SIGFPE or SIGABRT it
+leaves `/etc/crash/majestic.dump` (the previous one as `majestic.dump.1`):
+the registers at the fault, a slice of the faulting thread's stack, its
+memory map, and the build-id of every module it had loaded. Send each dump
+as its own bundle -- a tar.gz holding `majestic.dump`, and `meta.json` when
+the firmware wrote one, or the dump alone as the body -- to the same
+address, with the same fields. The answer is the same, with `kind`
+`signal`, a title that names only the signal, and a `url` to `/club/crashes`.
+
+These are the maintainers' only. The stack slice is majestic's memory at
+the crash and can hold what it was handling (a request, its environment):
+it is kept only until the dump is symbolized -- unwound with gdb against
+the executable and debuginfo majestic's CI publishes for the build-id, and
+the libraries of the firmware build `meta.json` names -- and then deleted,
+leaving the backtrace. Never served, never public: no signature of
+majestic's appears on `/crashes`. A signal another process sent (a `kill`)
+is kept as caused on purpose and pays nothing; majestic aborting itself is
+a bug like a fault.
+
 ## Sending automatically
 
 Only with the owner's consent: a setting the owner turns on, after which
diff --git a/service/internal/crashes/api.go b/service/internal/crashes/api.go
index 3eef1957..86a2081a 100644
--- a/service/internal/crashes/api.go
+++ b/service/internal/crashes/api.go
@@ -122,12 +122,23 @@ func (a *API) Submit(w http.ResponseWriter, r *http.Request, member, channel str
 		return
 	}
 	redactCrash(c, mac, key)
-	sum := sha256.Sum256(in.bundle)
+	// majestic's dump is kept as sent only until it is symbolized
+	// (crash_dumps); what is kept for good is the dump without its stack.
+	kept := in.bundle
+	if c.Dump != nil {
+		d, err := ReadDump(c.Dump)
+		if err != nil {
+			a.refuse(w, http.StatusUnprocessableEntity, err.Error())
+			return
+		}
+		kept = d.stripped(c.Dump)
+	}
+	sum := sha256.Sum256(kept)
 	e := &Event{
 		ID: NewID(), Channel: channel, MACKey: macKey, Member: member, ClientKey: client,
-		Firmware: in.fields["firmware"], Majestic: in.fields["majestic"],
+		Firmware: in.fields["firmware"], Majestic: orDefault(in.fields["majestic"], c.Majestic),
 		SoC: orDefault(soc, c.SoC), Sensor: orDefault(sensor, c.Sensor),
-		Crash: c, Bundle: in.bundle, BundleSHA256: hex.EncodeToString(sum[:]),
+		Crash: c, Bundle: kept, BundleSHA256: hex.EncodeToString(sum[:]),
 		SignatureID: c.Fatal.Signature(),
 		Redacted:    Redact(c.Text, mac, key),
 	}
@@ -176,10 +187,18 @@ func (a *API) Submit(w http.ResponseWriter, r *http.Request, member, channel str
 	if dup {
 		code = http.StatusOK
 	}
+	// majestic's crashes are the maintainers': the public list never has
+	// them, and the sender is told the signal, not where in majestic.
+	link := strings.TrimRight(a.SiteURL, "/") + "/crashes/#" + sig
+	title := c.Fatal.Title()
+	if Class(c.Kind) == "user" {
+		link = strings.TrimRight(a.SiteURL, "/") + "/club/crashes/"
+		title = c.Fatal.Reason
+	}
 	writeJSON(w, code, map[string]any{
-		"id": id, "signature": sig, "title": c.Fatal.Title(), "kind": c.Kind, "duplicate": dup,
+		"id": id, "signature": sig, "title": title, "kind": c.Kind, "duplicate": dup,
 		"self_inflicted": c.SelfInflicted,
-		"url":            strings.TrimRight(a.SiteURL, "/") + "/crashes/#" + sig,
+		"url":            link,
 	})
 }
 
@@ -344,8 +363,9 @@ func isHex(c byte) bool {
 
 var (
 	// ipv4 is a dotted quad; replace refuses one inside a longer dotted
-	// number (a version, 4.9.37.1.2).
-	ipv4 = regexp.MustCompile(`(?:25[0-5]|2[0-4]\d|1?\d?\d)(?:\.(?:25[0-5]|2[0-4]\d|1?\d?\d)){3}`)
+	// number (a version, 4.9.37.1.2). An octet is never written with a
+	// leading zero, and a version often is: OpenIPC's own are 2.6.10.05.
+	ipv4 = regexp.MustCompile(`(?:25[0-5]|2[0-4]\d|1\d\d|[1-9]?\d)(?:\.(?:25[0-5]|2[0-4]\d|1\d\d|[1-9]?\d)){3}`)
 	// ipv6: eight groups, or fewer with "::". Never a time (17:57:19) or a
 	// register dump (9dc0:), which have neither.
 	ipv6 = regexp.MustCompile(`(?i)(?:[0-9a-f]{1,4}:){7}[0-9a-f]{1,4}|(?:[0-9a-f]{1,4}:){1,7}:(?:[0-9a-f]{1,4}(?::[0-9a-f]{1,4}){0,6})?|::(?:[0-9a-f]{1,4}(?::[0-9a-f]{1,4}){0,6})?`)
diff --git a/service/internal/crashes/dump.go b/service/internal/crashes/dump.go
new file mode 100644
index 00000000..e2d6e7d6
--- /dev/null
+++ b/service/internal/crashes/dump.go
@@ -0,0 +1,442 @@
+package crashes
+
+import (
+	"bytes"
+	"crypto/sha256"
+	"encoding/binary"
+	"encoding/hex"
+	"errors"
+	"fmt"
+	"path"
+	"sort"
+	"strconv"
+	"strings"
+)
+
+// majestic's crash dump, /etc/crash/majestic.dump: what majestic writes from
+// its fatal-signal handler, because a release build carries no unwind tables
+// and cannot say where it crashed itself. The symbolizer (the symbolize
+// package, in the firmware role) unwinds it against the debuginfo majestic's
+// CI publishes for the build-id.
+//
+//	"MJCD"  u8 version (1)  u8 0  u8 arch  u8 0
+//	then sections until END: 4-byte tag, u32 length (little-endian), bytes
+//
+//	HDR   text, key=value lines: signal, code (si_code), sender (the sender's
+//	      pid, for a signal sent), addr, pid, tid, thread, wall, uptime,
+//	      version
+//	REGS  the faulting thread's uc_mcontext, raw, in the target's byte order
+//	STAK  u64 (little-endian) address, then the stack's bytes from it up
+//	MAPS  /proc/self/maps
+//	AUXV  /proc/self/auxv
+//	MODS  text, per loaded object: build-id in hex or -, start, load bias, path
+//	THRD  text, "tid name" per thread
+//	END   empty
+//
+// Unknown sections are skipped, so the format grows by adding them.
+
+// Architectures, as the header's arch byte says.
+const (
+	ArchARM     = 1
+	ArchMIPSLE  = 2
+	ArchMIPSBE  = 3
+	ArchX86_64  = 4
+	ArchAArch64 = 5
+)
+
+// Dump is a majestic crash dump, read.
+type Dump struct {
+	Version int
+	Arch    int
+	Header  map[string]string
+	Regs    []byte
+	// StackAt is where Stack begins: the stack pointer at the fault.
+	StackAt uint64
+	Stack   []byte
+	Maps    []Mapping
+	Auxv    []byte
+	Modules []Module
+	Threads string
+	// Sections: every section's bytes by tag, the ones read above too.
+	Sections map[string][]byte
+}
+
+// Mapping is one line of /proc/self/maps.
+type Mapping struct {
+	Start, End uint64
+	Perms      string
+	Offset     uint64
+	Path       string
+}
+
+// Exec says whether the mapping holds code.
+func (m Mapping) Exec() bool { return strings.Contains(m.Perms, "x") }
+
+// Module is a loaded object: where it is and which build it is.
+type Module struct {
+	BuildID string // hex, "" when it has none
+	Start   uint64
+	Bias    uint64
+	Path    string
+}
+
+// Name is the module's file name.
+func (m Module) Name() string { return path.Base(m.Path) }
+
+// ErrNotADump is bytes that are not majestic's dump.
+var ErrNotADump = errors.New("majestic.dump is not a crash dump majestic wrote (no MJCD header)")
+
+// ReadDump reads a dump.
+func ReadDump(b []byte) (*Dump, error) {
+	if len(b) < 8 || string(b[:4]) != "MJCD" {
+		return nil, ErrNotADump
+	}
+	d := &Dump{Version: int(b[4]), Arch: int(b[6]), Header: map[string]string{}, Sections: map[string][]byte{}}
+	if d.Version != 1 {
+		return nil, fmt.Errorf("majestic.dump is version %d; this site reads version 1", d.Version)
+	}
+	switch d.Arch {
+	case ArchARM, ArchMIPSLE, ArchMIPSBE, ArchX86_64, ArchAArch64:
+	default:
+		return nil, fmt.Errorf("majestic.dump is for an unknown architecture (%d)", d.Arch)
+	}
+	ended := false
+	for off := 8; off+8 <= len(b); {
+		tag := string(b[off : off+4])
+		n := int(binary.LittleEndian.Uint32(b[off+4:]))
+		if n < 0 || off+8+n > len(b) {
+			return nil, fmt.Errorf("majestic.dump is cut short in section %q", tag)
+		}
+		d.Sections[tag] = b[off+8 : off+8+n]
+		off += 8 + n
+		if tag == "END " {
+			ended = true
+			break
+		}
+	}
+	if !ended {
+		return nil, errors.New("majestic.dump is cut short: it has no END section")
+	}
+	for _, l := range strings.Split(string(d.Sections["HDR "]), "\n") {
+		if k, v, ok := strings.Cut(l, "="); ok {
+			d.Header[k] = v
+		}
+	}
+	d.Regs = d.Sections["REGS"]
+	if s := d.Sections["STAK"]; len(s) >= 8 {
+		d.StackAt = binary.LittleEndian.Uint64(s)
+		d.Stack = s[8:]
+	}
+	d.Maps = parseMaps(string(d.Sections["MAPS"]))
+	d.Auxv = d.Sections["AUXV"]
+	d.Modules = parseModules(string(d.Sections["MODS"]))
+	d.Threads = string(d.Sections["THRD"])
+	if d.Header["signal"] == "" || len(d.Regs) == 0 {
+		return nil, errors.New("majestic.dump has no signal or no registers")
+	}
+	if _, err := d.PC(); err != nil {
+		return nil, err
+	}
+	return d, nil
+}
+
+func parseMaps(s string) []Mapping {
+	var out []Mapping
+	for _, l := range strings.Split(s, "\n") {
+		f := strings.Fields(l)
+		if len(f) < 5 {
+			continue
+		}
+		lo, hi, ok := strings.Cut(f[0], "-")
+		if !ok {
+			continue
+		}
+		a, err1 := strconv.ParseUint(lo, 16, 64)
+		z, err2 := strconv.ParseUint(hi, 16, 64)
+		off, err3 := strconv.ParseUint(f[2], 16, 64)
+		if err1 != nil || err2 != nil || err3 != nil {
+			continue
+		}
+		m := Mapping{Start: a, End: z, Perms: f[1], Offset: off}
+		if len(f) >= 6 {
+			m.Path = strings.Join(f[5:], " ")
+		}
+		out = append(out, m)
+	}
+	return out
+}
+
+func parseModules(s string) []Module {
+	var out []Module
+	seen := map[string]bool{}
+	for _, l := range strings.Split(s, "\n") {
+		f := strings.SplitN(l, " ", 4)
+		if len(f) != 4 {
+			continue
+		}
+		start, err1 := strconv.ParseUint(strings.TrimPrefix(f[1], "0x"), 16, 64)
+		bias, err2 := strconv.ParseUint(strings.TrimPrefix(f[2], "0x"), 16, 64)
+		if err1 != nil || err2 != nil || f[3] == "" {
+			continue
+		}
+		// A library mapped twice (opened again by a dlopen) is one module.
+		if seen[f[3]] {
+			continue
+		}
+		seen[f[3]] = true
+		id := f[0]
+		if id == "-" || !hexRe(id) {
+			id = ""
+		}
+		out = append(out, Module{BuildID: id, Start: start, Bias: bias, Path: f[3]})
+	}
+	return out
+}
+
+func hexRe(s string) bool {
+	if len(s) == 0 || len(s) > 64 {
+		return false
+	}
+	_, err := hex.DecodeString(s)
+	return err == nil
+}
+
+// Order is the target's byte order.
+func (d *Dump) Order() binary.ByteOrder {
+	if d.Arch == ArchMIPSBE {
+		return binary.BigEndian
+	}
+	return binary.LittleEndian
+}
+
+// Is64 says whether the target's words are 64 bits.
+func (d *Dump) Is64() bool { return d.Arch == ArchX86_64 || d.Arch == ArchAArch64 }
+
+// Where each architecture's uc_mcontext keeps the program counter, the stack
+// pointer and the return address (the kernel's struct sigcontext, which the
+// C libraries' mcontext_t mirror):
+//
+//	ARM      u32 trap_no, error_code, oldmask, r0..r10, fp, ip, sp, lr, pc, cpsr, fault_address
+//	MIPS     u32 regmask, status; u64 pc; u64 regs[32] (sp is 29, ra 31)
+//	x86_64   u64 gregs[23]: r8..r15, rdi, rsi, rbp, rbx, rdx, rax, rcx, rsp, rip, ...
+//	AArch64  u64 fault_address, regs[31] (x30 is the link register), sp, pc, pstate
+func (d *Dump) reg(i, size int) (uint64, error) {
+	if i+size > len(d.Regs) {
+		return 0, fmt.Errorf("majestic.dump's registers are cut short (%d bytes)", len(d.Regs))
+	}
+	if size == 4 {
+		return uint64(d.Order().Uint32(d.Regs[i:])), nil
+	}
+	v := d.Order().Uint64(d.Regs[i:])
+	if d.Arch == ArchMIPSLE || d.Arch == ArchMIPSBE {
+		v &= 0xffffffff // o32: 32-bit registers, kept in 64-bit slots
+	}
+	return v, nil
+}
+
+// PC is the program counter at the fault.
+func (d *Dump) PC() (uint64, error) {
+	switch d.Arch {
+	case ArchARM:
+		return d.reg(18*4, 4)
+	case ArchMIPSLE, ArchMIPSBE:
+		return d.reg(8, 8)
+	case ArchX86_64:
+		return d.reg(16*8, 8)
+	default:
+		return d.reg(33*8, 8)
+	}
+}
+
+// SP is the stack pointer at the fault.
+func (d *Dump) SP() (uint64, error) {
+	switch d.Arch {
+	case ArchARM:
+		return d.reg(16*4, 4)
+	case ArchMIPSLE, ArchMIPSBE:
+		return d.reg(16+29*8, 8)
+	case ArchX86_64:
+		return d.reg(15*8, 8)
+	default:
+		return d.reg(32*8, 8)
+	}
+}
+
+// LR is the return address register at the fault (none on x86_64, whose
+// return address is on the stack).
+func (d *Dump) LR() (uint64, bool) {
+	var v uint64
+	var err error
+	switch d.Arch {
+	case ArchARM:
+		v, err = d.reg(17*4, 4)
+	case ArchMIPSLE, ArchMIPSBE:
+		v, err = d.reg(16+31*8, 8)
+	case ArchAArch64:
+		v, err = d.reg(31*8, 8)
+	default:
+		return 0, false
+	}
+	return v, err == nil
+}
+
+// ModuleAt is the module whose code holds addr, and addr's offset from its
+// load bias: what the debuginfo calls the address.
+func (d *Dump) ModuleAt(addr uint64) (Module, uint64, bool) {
+	for _, m := range d.Maps {
+		if addr < m.Start || addr >= m.End || !m.Exec() {
+			continue
+		}
+		for _, mod := range d.Modules {
+			if mod.Path == m.Path {
+				return mod, addr - mod.Bias, true
+			}
+		}
+		// Mapped but not in the module table: a library the table was read
+		// before (it is read again after each dlopen, but not after one a
+		// library makes itself). Its first mapping is its bias, for a
+		// library built at 0.
+		first := m
+		for _, o := range d.Maps {
+			if o.Path == m.Path && o.Start < first.Start {
+				first = o
+			}
+		}
+		return Module{Path: m.Path, Start: first.Start, Bias: first.Start - first.Offset}, addr - (first.Start - first.Offset), true
+	}
+	return Module{}, 0, false
+}
+
+// Main is the majestic executable's module: the first in the table.
+func (d *Dump) Main() (Module, bool) {
+	if len(d.Modules) == 0 {
+		return Module{}, false
+	}
+	return d.Modules[0], true
+}
+
+// Signals' names, for the titles. The numbers are Linux's, the same on every
+// architecture majestic runs on but MIPS, whose SIGBUS is 10.
+func (d *Dump) SignalName() string {
+	n, _ := strconv.Atoi(d.Header["signal"])
+	mips := d.Arch == ArchMIPSLE || d.Arch == ArchMIPSBE
+	switch {
+	case n == 11:
+		return "SIGSEGV"
+	case n == 6:
+		return "SIGABRT"
+	case n == 4:
+		return "SIGILL"
+	case n == 8:
+		return "SIGFPE"
+	case n == 7 && !mips, n == 10 && mips:
+		return "SIGBUS"
+	}
+	return "signal " + strconv.Itoa(n)
+}
+
+// Sent says whether something sent the signal (si_code zero or negative)
+// rather than the CPU raising it at a fault.
+func (d *Dump) Sent() bool {
+	code, err := strconv.Atoi(d.Header["code"])
+	return err == nil && code <= 0
+}
+
+// SelfInflicted is a signal another process sent: a kill -SEGV, not a bug.
+// majestic sending itself one is a bug -- abort() is how an assert ends --
+// so a SIGABRT whose sender is not known is taken for majestic's own.
+func (d *Dump) SelfInflicted() bool {
+	if !d.Sent() {
+		return false
+	}
+	sender, ok := d.Header["sender"]
+	if !ok {
+		return d.SignalName() != "SIGABRT"
+	}
+	return sender != d.Header["pid"]
+}
+
+// stripped is the dump without its stack: what is kept of it once it is
+// symbolized.
+func (d *Dump) stripped(raw []byte) []byte {
+	var out bytes.Buffer
+	out.Write(raw[:8])
+	for off := 8; off+8 <= len(raw); {
+		tag := string(raw[off : off+4])
+		n := int(binary.LittleEndian.Uint32(raw[off+4:]))
+		if tag != "STAK" {
+			out.Write(raw[off : off+8+n])
+		}
+		off += 8 + n
+		if tag == "END " {
+			break
+		}
+	}
+	return out.Bytes()
+}
+
+// ModuleName is a library's name without its version, so a frame in it
+// names the same thing on the next firmware: libevent_core-2.2.so.1.0.1 is
+// libevent_core-2.2.so.
+func ModuleName(p string) string {
+	n := path.Base(p)
+	if i := strings.Index(n, ".so"); i > 0 {
+		return n[:i+3]
+	}
+	return n
+}
+
+// parseUserCrash reads a bundle with majestic's dump: a crash of the
+// streamer, filed provisionally under the module and offset of the faulting
+// instruction until the symbolizer files it under its backtrace.
+func parseUserCrash(raw []byte) (*Crash, *Dump, error) {
+	if len(raw) > MaxBundle {
+		return nil, nil, fmt.Errorf("majestic.dump is larger than %d bytes", MaxBundle)
+	}
+	d, err := ReadDump(raw)
+	if err != nil {
+		return nil, nil, err
+	}
+	pc, _ := d.PC()
+	where := fmt.Sprintf("0x%x", pc)
+	frame := Frame{Fn: where}
+	build := ""
+	if mod, off, ok := d.ModuleAt(pc); ok {
+		frame = Frame{Fn: fmt.Sprintf("%s+0x%x", ModuleName(mod.Path), off)}
+		if main, ok := d.Main(); ok && main.Path == mod.Path {
+			build = main.BuildID
+		} else if mod.BuildID != "" {
+			build = mod.BuildID
+		}
+	}
+	reason := d.SignalName()
+	if addr, err := strconv.ParseUint(strings.TrimPrefix(d.Header["addr"], "0x"), 16, 64); err == nil &&
+		!d.Sent() && reason == "SIGSEGV" && addr < 4096 {
+		reason += " (NULL pointer)"
+	}
+	if d.Sent() {
+		reason += " (sent)"
+	}
+	t := &Trace{Kind: KindSignal, Reason: reason, Comm: d.Header["thread"], PC: frame.Fn,
+		Frames: []Frame{frame}, Provisional: true, Build: build}
+	c := &Crash{Kind: KindSignal, Fatal: t, Records: 1, SelfInflicted: d.SelfInflicted(),
+		Anomalies: map[string]int{}, Majestic: d.Header["version"]}
+	if up, err := strconv.ParseFloat(d.Header["uptime"], 64); err == nil {
+		c.Uptime = up
+	}
+	var mods []string
+	for _, m := range d.Modules {
+		mods = append(mods, ModuleName(m.Path))
+	}
+	sort.Strings(mods)
+	c.Modules = mods
+	// What maintainers read, as the log is for a kernel crash: the header,
+	// the threads and the memory map. Never the stack.
+	c.Text = "==> majestic.dump <==\n" + string(d.Sections["HDR "]) +
+		"\n==> threads <==\n" + d.Threads +
+		"\n==> modules <==\n" + string(d.Sections["MODS"]) +
+		"\n==> maps <==\n" + string(d.Sections["MAPS"])
+	sum := sha256.Sum256(raw)
+	c.ContentSum = hex.EncodeToString(sum[:])
+	return c, d, nil
+}
diff --git a/service/internal/crashes/dump_test.go b/service/internal/crashes/dump_test.go
new file mode 100644
index 00000000..d31a1869
--- /dev/null
+++ b/service/internal/crashes/dump_test.go
@@ -0,0 +1,507 @@
+package crashes
+
+import (
+	"bytes"
+	"context"
+	"encoding/json"
+	"errors"
+	"fmt"
+	"net/http/httptest"
+	"os"
+	"path/filepath"
+	"strings"
+	"sync"
+	"testing"
+	"time"
+)
+
+// The dumps in testdata/dump are of a stand-in for majestic (toy.c) that
+// faulted on a gk7205v300 (arm-*) and on a PC (x86_64-*).
+func dumpFixture(t *testing.T, name string) []byte {
+	t.Helper()
+	b, err := os.ReadFile(filepath.Join("testdata", "dump", name))
+	if err != nil {
+		t.Fatal(err)
+	}
+	return b
+}
+
+func TestReadDump(t *testing.T) {
+	for _, tc := range []struct {
+		name      string
+		arch      int
+		reason    string
+		sent      bool
+		module    string
+		selfInfl  bool
+		frameHead string
+	}{
+		{"arm-own.dump", ArchARM, "SIGSEGV (NULL pointer)", false, "toy", false, "toy+0x"},
+		{"arm-lib.dump", ArchARM, "SIGSEGV (NULL pointer)", false, "libtoy.so", false, "libtoy.so+0x"},
+		{"arm-libc.dump", ArchARM, "SIGSEGV (NULL pointer)", false, "libc.so", false, "libc.so+0x"},
+		// raise() from inside: sent, by itself -- a bug, as abort() is.
+		{"arm-sent.dump", ArchARM, "SIGSEGV (sent)", true, "", false, ""},
+		{"x86_64-own.dump", ArchX86_64, "SIGSEGV (NULL pointer)", false, "toy", false, "toy+0x"},
+		{"x86_64-sent.dump", ArchX86_64, "SIGSEGV (sent)", true, "", false, ""},
+	} {
+		t.Run(tc.name, func(t *testing.T) {
+			raw := dumpFixture(t, tc.name)
+			d, err := ReadDump(raw)
+			if err != nil {
+				t.Fatal(err)
+			}
+			if d.Arch != tc.arch || d.Sent() != tc.sent || d.SelfInflicted() != tc.selfInfl {
+				t.Fatalf("arch %d sent %v self-inflicted %v", d.Arch, d.Sent(), d.SelfInflicted())
+			}
+			main, ok := d.Main()
+			if !ok || len(main.BuildID) != 40 || !strings.HasSuffix(main.Path, "/toy") {
+				t.Fatalf("main module %+v", main)
+			}
+			sp, _ := d.SP()
+			if sp != d.StackAt || len(d.Stack) < 256 {
+				t.Fatalf("stack at %#x (sp %#x), %d bytes", d.StackAt, sp, len(d.Stack))
+			}
+			pc, _ := d.PC()
+			if tc.module != "" {
+				mod, _, ok := d.ModuleAt(pc)
+				if !ok || ModuleName(mod.Path) != tc.module {
+					t.Fatalf("pc %#x is in %+v", pc, mod)
+				}
+			}
+			c, _, err := parseUserCrash(raw)
+			if err != nil {
+				t.Fatal(err)
+			}
+			if c.Kind != KindSignal || c.Fatal.Reason != tc.reason || !c.Fatal.Provisional {
+				t.Fatalf("%+v", c.Fatal)
+			}
+			if tc.frameHead != "" && !strings.HasPrefix(c.Fatal.Frames[0].Fn, tc.frameHead) {
+				t.Fatalf("provisional frame %q", c.Fatal.Frames[0].Fn)
+			}
+			// What maintainers read is never the stack.
+			if strings.Contains(c.Text, "LD_LIBRARY_PATH") || !strings.Contains(c.Text, "signal=11") {
+				t.Fatalf("text:\n%s", c.Text)
+			}
+		})
+	}
+}
+
+func TestADumpSentByAnotherProcessIsSelfInflicted(t *testing.T) {
+	raw := dumpFixture(t, "arm-sent.dump")
+	d, _ := ReadDump(raw)
+	// The same signal, from a kill: another sender.
+	hdr := strings.Replace(string(d.Sections["HDR "]), "sender="+d.Header["pid"], "sender=1", 1)
+	other := rebuild(t, raw, "HDR ", []byte(hdr))
+	o, err := ReadDump(other)
+	if err != nil {
+		t.Fatal(err)
+	}
+	if !o.SelfInflicted() {
+		t.Fatalf("header:\n%s", hdr)
+	}
+	// An old dump without the sender: a sent SIGSEGV is someone's kill; a
+	// SIGABRT is abort()'s.
+	noSender := strings.Replace(hdr, "sender=1\n", "", 1)
+	if o, _ := ReadDump(rebuild(t, raw, "HDR ", []byte(noSender))); !o.SelfInflicted() {
+		t.Fatal("a sent SIGSEGV without a sender is not self-inflicted")
+	}
+	abrt := strings.Replace(noSender, "signal=11", "signal=6", 1)
+	if o, _ := ReadDump(rebuild(t, raw, "HDR ", []byte(abrt))); o.SelfInflicted() {
+		t.Fatal("abort() without a sender is self-inflicted")
+	}
+}
+
+// rebuild replaces one section of a dump.
+func rebuild(t *testing.T, raw []byte, tag string, with []byte) []byte {
+	t.Helper()
+	var out bytes.Buffer
+	out.Write(raw[:8])
+	for off := 8; off+8 <= len(raw); {
+		n := int(uint32(raw[off+4]) | uint32(raw[off+5])<<8 | uint32(raw[off+6])<<16 | uint32(raw[off+7])<<24)
+		cur := string(raw[off : off+4])
+		body := raw[off+8 : off+8+n]
+		if cur == tag {
+			body = with
+		}
+		out.WriteString(cur)
+		l := len(body)
+		out.Write([]byte{byte(l), byte(l >> 8), byte(l >> 16), byte(l >> 24)})
+		out.Write(body)
+		off += 8 + n
+		if cur == "END " {
+			break
+		}
+	}
+	return out.Bytes()
+}
+
+func TestReadDumpRefusesWhatIsNotOne(t *testing.T) {
+	raw := dumpFixture(t, "arm-own.dump")
+	for name, b := range map[string][]byte{
+		"empty":     nil,
+		"text":      []byte("hello"),
+		"cut":       raw[:len(raw)/2],
+		"no end":    raw[:len(raw)-8],
+		"version 9": append([]byte("MJCD\x09\x00\x01\x00"), raw[8:]...),
+		"arch 77":   append([]byte("MJCD\x01\x00\x4d\x00"), raw[8:]...),
+	} {
+		if _, err := ReadDump(b); err == nil {
+			t.Errorf("%s: read as a dump", name)
+		}
+	}
+}
+
+func TestUnpackKeepsMajesticsDump(t *testing.T) {
+	raw := dumpFixture(t, "arm-own.dump")
+	for name, b := range map[string][]byte{
+		"tar.gz": tgz(t, map[string]string{"majestic.dump": string(raw), "meta.json": `{"soc":"gk7205v300"}`}),
+		"bare":   raw,
+	} {
+		files, err := Unpack(b)
+		if err != nil {
+			t.Fatalf("%s: %v", name, err)
+		}
+		c, err := Parse(files)
+		if err != nil {
+			t.Fatalf("%s: %v", name, err)
+		}
+		if c.Kind != KindSignal || !bytes.Equal(c.Dump, raw) {
+			t.Fatalf("%s: kind %s, dump %d bytes", name, c.Kind, len(c.Dump))
+		}
+	}
+}
+
+func TestAMajesticCrashIsTheMaintainersOnly(t *testing.T) {
+	e := newEnv(t)
+	ctx := context.Background()
+	raw := dumpFixture(t, "arm-own.dump")
+	meta := `{"firmware":{"build_id":"nightly-20261009-0000000","platform":"gk7205v300_lite"},"soc":"gk7205v300"}`
+	code, out := e.send(tgz(t, map[string]string{"majestic.dump": string(raw), "meta.json": meta}),
+		map[string]string{"mac": labMAC}, "10.0.0.5")
+	if code != 201 || out["kind"] != KindSignal || out["self_inflicted"] != false {
+		t.Fatalf("%d %v", code, out)
+	}
+	// The sender is told the signal; where in majestic is the maintainers'.
+	if !strings.HasSuffix(out["url"].(string), "/club/crashes/") || out["title"] != "SIGSEGV (NULL pointer)" {
+		t.Fatalf("url %v, title %v", out["url"], out["title"])
+	}
+	provisional := out["signature"].(string)
+	id := out["id"].(string)
+
+	// Not on the public list, not by its address.
+	if list := e.get("/api/v1/crashes")["signatures"].([]any); len(list) != 0 {
+		t.Fatalf("public list: %v", list)
+	}
+	rec := e.status("/api/v1/crashes/" + provisional)
+	if rec != 404 {
+		t.Fatalf("public signature: %d", rec)
+	}
+	// The maintainers see it.
+	st := e.api.Store()
+	all, err := st.Ranked(ctx, true, e.now)
+	if err != nil || len(all) != 1 || all[0].Class != "user" || all[0].Kind != KindSignal {
+		t.Fatalf("%v %+v", err, all)
+	}
+
+	// Kept: the dump until it is symbolized, and for good only the dump
+	// without its stack.
+	var dump, kept []byte
+	if err := e.pool.QueryRow(ctx, `SELECT d.bytes, b.bytes FROM crash_dumps d JOIN crash_events e ON e.id = d.event_id
+		JOIN crash_bundles b ON b.sha256 = e.bundle_sha256`).Scan(&dump, &kept); err != nil {
+		t.Fatal(err)
+	}
+	if !bytes.Equal(dump, raw) {
+		t.Fatal("the dump is not the one sent")
+	}
+	k, err := ReadDump(kept)
+	if err != nil || len(k.Stack) != 0 || k.Sections["MAPS"] == nil || bytes.Contains(kept, []byte("LD_LIBRARY_PATH")) {
+		t.Fatalf("kept bundle: %v, stack %d bytes", err, len(k.Stack))
+	}
+
+	// Due, with what meta.json says the camera ran.
+	due, err := st.DueDumps(ctx, e.now, 10)
+	if err != nil || len(due) != 1 || due[0].EventID != id || !strings.Contains(string(due[0].Meta), "nightly-20261009") {
+		t.Fatalf("%v %+v", err, due)
+	}
+
+	// Symbolized: refiled under its backtrace; the provisional signature
+	// goes, and the dump with it.
+	frames := []Frame{{Fn: "store", File: "toy.c", Line: 175}, {Fn: "parse_level", File: "toy.c", Line: 179},
+		{Fn: "main", File: "toy.c", Line: 207}}
+	sig, err := st.Symbolized(ctx, id, frames, map[string]any{"build_id": "x"}, e.now.Add(time.Minute))
+	if err != nil {
+		t.Fatal(err)
+	}
+	if sig == provisional {
+		t.Fatal("the signature did not change")
+	}
+	var n int
+	e.pool.QueryRow(ctx, `SELECT count(*) FROM crash_dumps`).Scan(&n)
+	if n != 0 {
+		t.Fatal("the dump outlived its symbolization")
+	}
+	e.pool.QueryRow(ctx, `SELECT count(*) FROM crash_signatures WHERE id = $1`, provisional).Scan(&n)
+	if n != 0 {
+		t.Fatal("the provisional signature is still there")
+	}
+	g, err := st.Get(ctx, sig, true, e.now)
+	if err != nil || g.Title != "SIGSEGV (NULL pointer) in store" || g.Events != 1 {
+		t.Fatalf("%v %+v", err, g)
+	}
+	details, err := st.Details(ctx, sig)
+	if err != nil || len(details) != 1 || details[0].Symbolization == nil || details[0].Symbolization.Status != "done" ||
+		details[0].Symbolization.Frames[0].Line != 175 {
+		t.Fatalf("%v %+v", err, details)
+	}
+	if _, err := st.Symbolized(ctx, id, frames, nil, e.now); err == nil {
+		t.Fatal("symbolized twice")
+	}
+
+	// The same bug from another camera: filed under the same backtrace.
+	other := rebuild(t, raw, "THRD", []byte("1 toy\n2 other\n"))
+	code, out = e.send(other, map[string]string{"mac": "02:00:00:00:00:02"}, "10.0.0.6")
+	if code != 201 {
+		t.Fatalf("%d %v", code, out)
+	}
+	if again, err := st.Symbolized(ctx, out["id"].(string), frames, nil, e.now); err != nil || again != sig {
+		t.Fatalf("%v: %s, want %s", err, again, sig)
+	}
+	if g, _ := st.Get(ctx, sig, true, e.now); g.Cameras != 2 {
+		t.Fatalf("%+v", g)
+	}
+}
+
+func (e *env) status(path string) int {
+	e.t.Helper()
+	rec := httptest.NewRecorder()
+	e.mux.ServeHTTP(rec, httptest.NewRequest("GET", path, nil))
+	return rec.Code
+}
+
+func TestASymbolizationThatKeepsFailingIsGivenUp(t *testing.T) {
+	e := newEnv(t)
+	ctx := context.Background()
+	code, out := e.send(dumpFixture(t, "x86_64-own.dump"), nil, "10.0.0.7")
+	if code != 201 {
+		t.Fatalf("%d %v", code, out)
+	}
+	id := out["id"].(string)
+	st := e.api.Store()
+	now := e.now
+	for i := 0; ; i++ {
+		due, err := st.DueDumps(ctx, now, 10)
+		if err != nil {
+			t.Fatal(err)
+		}
+		if len(due) != 1 {
+			t.Fatalf("try %d: %d due", i, len(due))
+		}
+		gaveUp, err := st.SymbolizeFailed(ctx, id, "no executable and debuginfo are published", now)
+		if err != nil {
+			t.Fatal(err)
+		}
+		// Not due again until its wait is over.
+		if due, _ := st.DueDumps(ctx, now, 10); len(due) != 0 {
+			t.Fatalf("try %d: due again at once", i)
+		}
+		if gaveUp {
+			if i != len(retryAfter) {
+				t.Fatalf("gave up after %d tries", i+1)
+			}
+			break
+		}
+		now = now.Add(retryAfter[i])
+	}
+	var dumps int
+	var status string
+	e.pool.QueryRow(ctx, `SELECT (SELECT count(*) FROM crash_dumps)::int, status FROM crash_symbolizations`).Scan(&dumps, &status)
+	if dumps != 0 || status != "failed" {
+		t.Fatalf("dumps %d, status %s", dumps, status)
+	}
+	// Still a crash, under its provisional signature, for the maintainers.
+	if list, _ := st.Ranked(ctx, true, e.now); len(list) != 1 || !strings.Contains(list[0].Title, "toy+0x") {
+		t.Fatalf("%+v", list)
+	}
+}
+
+func TestStarsBookedUnderAProvisionalSignatureFollowTheBug(t *testing.T) {
+	e := newEnv(t)
+	ctx := context.Background()
+	e.member("m-owner00000", "Owner")
+	e.link(labMAC, "m-owner00000")
+	code, out := e.send(dumpFixture(t, "arm-own.dump"), map[string]string{"mac": labMAC}, "10.0.0.8")
+	if code != 201 {
+		t.Fatalf("%d %v", code, out)
+	}
+	// The settlement ran before the symbolizer did: the report is paid
+	// under the provisional signature.
+	e.settle()
+	if e.stars("m-owner00000") != ReportStars {
+		t.Fatalf("stars %d", e.stars("m-owner00000"))
+	}
+	provisional := out["signature"].(string)
+	sig, err := e.api.Store().Symbolized(ctx, out["id"].(string), []Frame{{Fn: "store"}, {Fn: "parse_level"}}, nil, e.now)
+	if err != nil {
+		t.Fatal(err)
+	}
+	var merged string
+	if err := e.pool.QueryRow(ctx, `SELECT coalesce(merged_into, '') FROM crash_signatures WHERE id = $1`, provisional).Scan(&merged); err != nil {
+		t.Fatal(err)
+	}
+	if merged != sig {
+		t.Fatalf("provisional merged into %q, want %q", merged, sig)
+	}
+	// Held under the bug: nothing is paid twice.
+	e.settle()
+	if e.stars("m-owner00000") != ReportStars {
+		t.Fatalf("stars %d after symbolizing", e.stars("m-owner00000"))
+	}
+	// The owner sees the crash, named by its signal, never by majestic's
+	// functions.
+	mine, err := e.api.Store().Mine(ctx, "m-owner00000")
+	if err != nil || len(mine) != 1 || mine[0].Title != "SIGSEGV (NULL pointer)" || mine[0].Signature != sig {
+		t.Fatalf("%v %+v", err, mine)
+	}
+}
+
+func TestUserSignatureFrames(t *testing.T) {
+	// abort's frames, unnamed library frames and probable ones are not the
+	// bug; two named frames of its own are enough.
+	frames := []Frame{{Fn: "raise", Module: "libc.so"}, {Fn: "abort", Module: "libc.so"}, {Fn: "?", Module: "libevent_core-2.2.so"},
+		{Fn: "toy_handler"}, {Fn: "toy_dispatch"}, {Fn: "main", Probable: true}}
+	got, _ := json.Marshal(userSigFrames(frames))
+	if string(got) != `[{"fn":"toy_handler"},{"fn":"toy_dispatch"}]` {
+		t.Fatalf("%s", got)
+	}
+	// One of its own: the probable callers fill in.
+	frames = []Frame{{Fn: "memcpy", Module: "libc.so"}, {Fn: "?", Module: "libx.so"}, {Fn: "a", Probable: true}, {Fn: "b", Probable: true}}
+	got, _ = json.Marshal(userSigFrames(frames))
+	if string(got) != `[{"fn":"memcpy","module":"libc.so"},{"fn":"a","probable":true},{"fn":"b","probable":true}]` {
+		t.Fatalf("%s", got)
+	}
+	if title := userTitle("SIGSEGV", userSigFrames(frames)); title != "SIGSEGV in memcpy [libc.so] ← a" {
+		t.Fatalf("%q", title)
+	}
+}
+
+func TestMajesticsCrashesNeverCountOnThePublicList(t *testing.T) {
+	e := newEnv(t)
+	ctx := context.Background()
+	st := e.api.Store()
+	code, kernel := e.send(oops(1), map[string]string{"mac": "02:00:00:00:00:31"}, "10.0.1.1")
+	if code != 201 {
+		t.Fatalf("%d %v", code, kernel)
+	}
+	code, user := e.send(dumpFixture(t, "arm-own.dump"), map[string]string{"mac": "02:00:00:00:00:32", "soc": "gk7205v300"}, "10.0.1.2")
+	if code != 201 {
+		t.Fatalf("%d %v", code, user)
+	}
+	// A maintainer cannot make them one bug, either way.
+	for _, pair := range [][2]string{{user["signature"].(string), kernel["signature"].(string)}, {kernel["signature"].(string), user["signature"].(string)}} {
+		if _, err := st.Decide(ctx, pair[0], "m-maint00000", Triage{Status: "open", MergeInto: ptr(pair[1])}); !errors.Is(err, ErrInvalid) {
+			t.Fatalf("merging %s into %s: %v", pair[0], pair[1], err)
+		}
+	}
+	// And were they one row, the public list still counts the kernel's alone.
+	e.exec(`UPDATE crash_signatures SET merged_into = $2 WHERE id = $1`, user["signature"], kernel["signature"])
+	list := e.get("/api/v1/crashes")["signatures"].([]any)
+	if len(list) != 1 || list[0].(map[string]any)["cameras"].(float64) != 1 {
+		t.Fatalf("%v", list)
+	}
+	raw, _ := json.Marshal(e.get("/api/v1/crashes/" + kernel["signature"].(string)))
+	if bytes.Contains(raw, []byte("gk7205v300")) {
+		t.Fatalf("the public signature shows the majestic crash's chip: %s", raw)
+	}
+}
+
+func TestATriageGoesWithTheCrashToItsBacktrace(t *testing.T) {
+	e := newEnv(t)
+	ctx := context.Background()
+	st := e.api.Store()
+	frames := []Frame{{Fn: "store"}, {Fn: "parse_level"}}
+
+	// Confirmed while it waited: the bug it is refiled under is confirmed.
+	_, out := e.send(dumpFixture(t, "arm-own.dump"), nil, "10.0.2.1")
+	if _, err := st.Decide(ctx, out["signature"].(string), "m-maint00000", Triage{Status: "confirmed", IssueURL: ptr("https://github.com/OpenIPC/majestic/issues/1")}); err != nil {
+		t.Fatal(err)
+	}
+	sig, err := st.Symbolized(ctx, out["id"].(string), frames, nil, e.now)
+	if err != nil {
+		t.Fatal(err)
+	}
+	g, _ := st.Get(ctx, sig, true, e.now)
+	if sig == out["signature"] || g.Status != "confirmed" || g.IssueURL == "" {
+		t.Fatalf("%s: %+v", sig, g)
+	}
+
+	// Found bogus while it waited: it stays where the maintainer put it.
+	_, out = e.send(dumpFixture(t, "x86_64-own.dump"), nil, "10.0.2.2")
+	if _, err := st.Decide(ctx, out["signature"].(string), "m-maint00000", Triage{Status: "bogus"}); err != nil {
+		t.Fatal(err)
+	}
+	if sig, err := st.Symbolized(ctx, out["id"].(string), frames, nil, e.now); err != nil || sig != out["signature"] {
+		t.Fatalf("%v: refiled a bogus crash under %s", err, sig)
+	}
+}
+
+func TestABacktraceWithoutMajesticsFramesKeepsTheProvisionalSignature(t *testing.T) {
+	e := newEnv(t)
+	ctx := context.Background()
+	_, out := e.send(dumpFixture(t, "arm-libc.dump"), nil, "10.0.3.1")
+	// strlen, and nothing of majestic's: every caller of strlen would be
+	// this one bug.
+	frames := []Frame{{Fn: "strlen", Module: "libc.so"}, {Fn: "?", Module: "libevent_core-2.2.so"}}
+	sig, err := e.api.Store().Symbolized(ctx, out["id"].(string), frames, nil, e.now)
+	if err != nil || sig != out["signature"] {
+		t.Fatalf("%v: filed under %s, want %s", err, sig, out["signature"])
+	}
+	var status string
+	e.pool.QueryRow(ctx, `SELECT status FROM crash_symbolizations`).Scan(&status)
+	if status != "done" {
+		t.Fatalf("status %s", status)
+	}
+}
+
+func TestWhatGDBSaysIsStoredWhateverBytesItHolds(t *testing.T) {
+	e := newEnv(t)
+	ctx := context.Background()
+	st := e.api.Store()
+	_, out := e.send(dumpFixture(t, "arm-own.dump"), nil, "10.0.4.1")
+	if _, err := st.SymbolizeFailed(ctx, out["id"].(string), "unsquashfs: \x00bad \xff", e.now); err != nil {
+		t.Fatal(err)
+	}
+	frames := []Frame{{Fn: "sto\x00re", File: "toy\xff.c"}, {Fn: "parse_level"}}
+	if _, err := st.Symbolized(ctx, out["id"].(string), frames, map[string]any{"gdb_stopped": "x\x00y", "libraries": []string{"a\x00"}}, e.now); err != nil {
+		t.Fatal(err)
+	}
+}
+
+func TestEventsLeavingOneProvisionalSignatureTogetherTidyIt(t *testing.T) {
+	e := newEnv(t)
+	ctx := context.Background()
+	st := e.api.Store()
+	raw := dumpFixture(t, "arm-own.dump")
+	var ids []string
+	var provisional string
+	for i, thrd := range []string{"1 a\n", "1 b\n", "1 c\n", "1 d\n"} {
+		_, out := e.send(rebuild(t, raw, "THRD", []byte(thrd)), nil, fmt.Sprintf("10.0.5.%d", i+1))
+		ids = append(ids, out["id"].(string))
+		provisional = out["signature"].(string)
+	}
+	var wg sync.WaitGroup
+	for _, id := range ids {
+		wg.Add(1)
+		go func(id string) {
+			defer wg.Done()
+			if _, err := st.Symbolized(ctx, id, []Frame{{Fn: "store"}, {Fn: "parse_level"}}, nil, e.now); err != nil {
+				t.Error(err)
+			}
+		}(id)
+	}
+	wg.Wait()
+	var n int
+	e.pool.QueryRow(ctx, `SELECT count(*) FROM crash_signatures WHERE id = $1`, provisional).Scan(&n)
+	if n != 0 {
+		t.Fatal("the provisional signature outlived its last event")
+	}
+}
diff --git a/service/internal/crashes/parse.go b/service/internal/crashes/parse.go
index 3cd1fbd2..7b8af97f 100644
--- a/service/internal/crashes/parse.go
+++ b/service/internal/crashes/parse.go
@@ -40,17 +40,37 @@ const (
 	KindOops     = "oops"
 	KindBug      = "bug"
 	KindWarning  = "warning"
+	// KindSignal is majestic's own crash, from its dump (dump.go): the
+	// streamer died, the camera did not.
+	KindSignal = "signal"
 )
 
-var kindRank = map[string]int{KindBootloop: 5, KindPanic: 4, KindOops: 3, KindBug: 2, KindWarning: 1}
+var kindRank = map[string]int{KindBootloop: 6, KindPanic: 5, KindOops: 4, KindBug: 3, KindSignal: 2, KindWarning: 1}
+
+// Class is the signatures' class a kind is filed under: the kernel's fatal
+// crashes and its warnings, and majestic's (user), which only maintainers see.
+func Class(kind string) string {
+	switch kind {
+	case KindWarning:
+		return "warning"
+	case KindSignal:
+		return "user"
+	}
+	return "fatal"
+}
 
 // Worse says whether kind a is worse than b.
 func Worse(a, b string) bool { return kindRank[a] > kindRank[b] }
 
-// Frame is one function in a backtrace.
+// Frame is one function in a backtrace. A frame of majestic's also says
+// where in its source; Probable is one found by scanning the stack past where
+// the unwinder stopped, likely but not certain.
 type Frame struct {
-	Fn     string `json:"fn"`
-	Module string `json:"module,omitempty"`
+	Fn       string `json:"fn"`
+	Module   string `json:"module,omitempty"`
+	File     string `json:"file,omitempty"`
+	Line     int    `json:"line,omitempty"`
+	Probable bool   `json:"probable,omitempty"`
 }
 
 func (f Frame) String() string {
@@ -72,24 +92,32 @@ type Trace struct {
 	Frames []Frame `json:"frames"`
 	// Interrupted: what the CPU was doing when the interrupt that crashed came.
 	Interrupted []Frame `json:"interrupted,omitempty"`
-	end         string  // the "end trace" id, to tell the same trace in two records
+	// Provisional: a majestic crash not yet symbolized, whose one frame is
+	// the faulting instruction's module and offset in Build (the build-id).
+	Provisional bool   `json:"provisional,omitempty"`
+	Build       string `json:"build,omitempty"`
+	end         string // the "end trace" id, to tell the same trace in two records
 }
 
 // Signature is the trace's identity: the same bug on any build gives the same.
 func (t *Trace) Signature() string {
-	class := "fatal"
-	if t.Kind == KindWarning {
-		class = "warning"
-	}
 	var b strings.Builder
-	b.WriteString(class)
-	for i, f := range t.Frames {
+	b.WriteString(Class(t.Kind))
+	// An offset means something only in its build.
+	if t.Provisional {
+		b.WriteString("\nbuild " + t.Build)
+	}
+	frames := t.Frames
+	if t.Kind == KindSignal && !t.Provisional {
+		frames = userSigFrames(frames)
+	}
+	for i, f := range frames {
 		if i == sigFrames {
 			break
 		}
 		b.WriteString("\n" + f.String())
 	}
-	if len(t.Frames) == 0 {
+	if len(frames) == 0 {
 		b.WriteString("\n" + t.Reason)
 	}
 	sum := sha256.Sum256([]byte(b.String()))
@@ -101,6 +129,12 @@ func (t *Trace) Title() string {
 	if len(t.Frames) == 0 {
 		return t.Reason
 	}
+	if t.Kind == KindSignal {
+		if t.Provisional {
+			return t.Reason + " in " + t.Frames[0].String()
+		}
+		return userTitle(t.Reason, userSigFrames(t.Frames))
+	}
 	where := t.Frames[0].Fn
 	// The first frame in a vendor module says more than a kernel helper,
 	// unless it is the module everything calls through.
@@ -115,6 +149,24 @@ func (t *Trace) Title() string {
 	return t.Reason + " in " + where
 }
 
+// userTitle names where majestic crashed: the function, and when that is in
+// a library, the first of majestic's own that called it.
+func userTitle(reason string, frames []Frame) string {
+	if len(frames) == 0 {
+		return reason
+	}
+	where := frames[0].String()
+	if frames[0].Module != "" {
+		for _, f := range frames[1:] {
+			if f.Module == "" {
+				where += " ← " + f.Fn
+				break
+			}
+		}
+	}
+	return reason + " in " + where
+}
+
 func wrapperModule(m string) bool {
 	return strings.HasSuffix(m, "osal") || strings.HasSuffix(m, "_base")
 }
@@ -148,6 +200,10 @@ type Crash struct {
 	// firmware's note that the bootlimit ran out.
 	Records  int  `json:"records"`
 	Failsafe bool `json:"failsafe,omitempty"`
+	// Majestic: the version majestic's own dump says it was.
+	Majestic string `json:"majestic,omitempty"`
+	// Dump: majestic's dump, for a crash of majestic.
+	Dump []byte `json:"-"`
 
 	// Text is every record, as sent; ContentSum identifies the crash
 	// whatever tar or gzip carried it.
@@ -156,7 +212,7 @@ type Crash struct {
 }
 
 // ErrNotACrash is a bundle with nothing a crash leaves.
-var ErrNotACrash = errors.New("the bundle has no pstore record (dmesg-*) and no failsafe note: nothing crashed")
+var ErrNotACrash = errors.New("the bundle has no pstore record (dmesg-*), no failsafe note and no majestic.dump: nothing crashed")
 
 // Unpack reads a crash bundle -- a tar.gz, a plain tar, or a single record
 // as text -- into its records by name.
@@ -195,7 +251,8 @@ func Unpack(data []byte) (map[string]string, error) {
 				continue
 			}
 			name := h.Name[strings.LastIndex(h.Name, "/")+1:]
-			if !strings.HasPrefix(name, "dmesg-") && name != "failsafe" && name != "pending" && name != "meta.json" {
+			if !strings.HasPrefix(name, "dmesg-") && name != "failsafe" && name != "pending" && name != "meta.json" &&
+				name != "majestic.dump" {
 				continue
 			}
 			// The limit is on records; failsafe, pending and meta.json are one
@@ -212,6 +269,8 @@ func Unpack(data []byte) (map[string]string, error) {
 			}
 			out[name] = string(b)
 		}
+	} else if bytes.HasPrefix(raw, []byte("MJCD")) {
+		out["majestic.dump"] = string(raw)
 	} else if printable(raw) {
 		out["dmesg-0"] = string(raw)
 	} else {
@@ -233,8 +292,17 @@ func printable(b []byte) bool {
 	return bad*100 < len(b)
 }
 
-// Parse reads the records a bundle unpacked to.
+// Parse reads the records a bundle unpacked to. A bundle with majestic's dump
+// is a crash of majestic, whatever else it carries.
 func Parse(files map[string]string) (*Crash, error) {
+	if raw, ok := files["majestic.dump"]; ok {
+		c, _, err := parseUserCrash([]byte(raw))
+		if err != nil {
+			return nil, err
+		}
+		c.Dump = []byte(raw)
+		return c, nil
+	}
 	var names []string
 	for n := range files {
 		if strings.HasPrefix(n, "dmesg-") {
diff --git a/service/internal/crashes/store.go b/service/internal/crashes/store.go
index 6a9bf5a0..59a565ee 100644
--- a/service/internal/crashes/store.go
+++ b/service/internal/crashes/store.go
@@ -50,7 +50,7 @@ func NewID() string {
 }
 
 // kindOrder is the kinds, mildest first, for SQL's array_position.
-const kindOrder = `ARRAY['warning','bug','oops','panic','bootloop']`
+const kindOrder = `ARRAY['warning','signal','bug','oops','panic','bootloop']`
 
 // ErrQuota is a client address or a camera past its daily limit.
 var ErrQuota = errors.New("the daily limit is reached")
@@ -70,10 +70,7 @@ func (s *Store) Insert(ctx context.Context, e *Event, at time.Time) (id, signatu
 	anomalies, _ := json.Marshal(c.Anomalies)
 	leadup, _ := json.Marshal(orEmpty(c.Leadup))
 	frames, _ := json.Marshal(orEmpty(c.Fatal.Frames))
-	class := "fatal"
-	if c.Fatal.Kind == KindWarning {
-		class = "warning"
-	}
+	class := Class(c.Fatal.Kind)
 	var built *time.Time
 	if !c.KernelBuilt.IsZero() {
 		built = &c.KernelBuilt
@@ -135,6 +132,19 @@ func (s *Store) Insert(ctx context.Context, e *Event, at time.Time) (id, signatu
 			c.SelfInflicted, c.Fatal.Title(), e.Firmware, e.Majestic, e.SoC, e.Sensor, c.Board, c.Machine, c.Kernel,
 			c.KernelBuild, built, c.Cmdline, uptime, c.Records, orEmpty(c.Modules), fatal, before, anomalies, leadup,
 			meta, e.Redacted, e.BundleSHA256, at)
+		if err != nil || c.Dump == nil {
+			return err
+		}
+		// majestic's dump waits for the symbolizer, which the notice wakes.
+		if _, err := tx.Exec(ctx, `INSERT INTO crash_dumps (event_id, bytes, received_at) VALUES ($1, $2, $3)`,
+			e.ID, c.Dump, at); err != nil {
+			return err
+		}
+		if _, err := tx.Exec(ctx, `INSERT INTO crash_symbolizations (event_id, status, next_try, provisional, at)
+			VALUES ($1, 'pending', $2, $3, $2)`, e.ID, at, e.SignatureID); err != nil {
+			return err
+		}
+		_, err = tx.Exec(ctx, `SELECT pg_notify('crash_symbolize', $1)`, e.ID)
 		return err
 	})
 	return id, signature, dup, err
@@ -201,6 +211,10 @@ func base(kind string, irq bool) float64 {
 		return 25
 	case KindBug:
 		return 20
+	case KindSignal:
+		// No video until majestic is back: the firmware restarts it, and
+		// stops trying when it keeps crashing.
+		return 15
 	}
 	return 3
 }
@@ -210,7 +224,8 @@ func base(kind string, irq bool) float64 {
 const CurrentWindow = 14 * 24 * time.Hour
 
 // Ranked is the signatures, worst first. maintainers also see the bogus,
-// the merged and the self-inflicted (which public lists leave out).
+// the merged, the self-inflicted and majestic's crashes (which public lists
+// leave out).
 func (s *Store) Ranked(ctx context.Context, maintainers bool, now time.Time) ([]*Signature, error) {
 	return s.ranked(ctx, maintainers, "", now)
 }
@@ -220,7 +235,9 @@ func (s *Store) ranked(ctx context.Context, maintainers bool, only string, now t
 		WITH ev AS (
 			SELECT coalesce(sig.merged_into, sig.id) AS root, e.*
 			FROM crash_events e JOIN crash_signatures sig ON sig.id = e.signature_id
-			WHERE $1 OR NOT e.self_inflicted
+			-- majestic's crashes count only for maintainers, whatever they
+			-- are merged into
+			WHERE $1 OR (NOT e.self_inflicted AND e.kind <> 'signal')
 		)
 		SELECT r.id, r.class,
 		       coalesce((`+kindOrder+`)[max(array_position(`+kindOrder+`, ev.kind))], r.kind), r.title, r.frames, r.status, r.fixed_in, r.issue_url, r.first_seen,
@@ -232,7 +249,7 @@ func (s *Store) ranked(ctx context.Context, maintainers bool, only string, now t
 		       coalesce(array_agg(DISTINCT ev.firmware) FILTER (WHERE ev.firmware <> ''), '{}'),
 		       max(ev.kernel_built)
 		FROM crash_signatures r LEFT JOIN ev ON ev.root = r.id
-		WHERE ($1 OR (r.merged_into IS NULL AND r.status <> 'bogus')) AND ($2 = '' OR r.id = $2)
+		WHERE ($1 OR (r.merged_into IS NULL AND r.status <> 'bogus' AND r.class <> 'user')) AND ($2 = '' OR r.id = $2)
 		GROUP BY r.id
 		HAVING $1 OR count(ev.id) > 0`, maintainers, only)
 	if err != nil {
@@ -342,8 +359,8 @@ func (s *Store) Combos(ctx context.Context, id string, detailed bool) ([]Combo,
 	rows, err := s.DB.Query(ctx, `
 		SELECT `+cols+`, count(*)::int, count(DISTINCT `+fmt.Sprintf(camera, "e.")+`)::int
 		FROM crash_events e JOIN crash_signatures sig ON sig.id = e.signature_id
-		WHERE coalesce(sig.merged_into, sig.id) = $1 AND NOT e.self_inflicted
-		GROUP BY 1, 2, 3, 4, 5, 6 ORDER BY 8 DESC, 7 DESC, 1, 2`, id)
+		WHERE coalesce(sig.merged_into, sig.id) = $1 AND NOT e.self_inflicted AND ($2 OR e.kind <> 'signal')
+		GROUP BY 1, 2, 3, 4, 5, 6 ORDER BY 8 DESC, 7 DESC, 1, 2`, id, detailed)
 	if err != nil {
 		return nil, err
 	}
@@ -383,6 +400,8 @@ type Detail struct {
 	// Builds: the firmware builds whose time matches the kernel's, newest
 	// guess first -- the build to flash to reproduce it.
 	Builds []Build `json:"builds,omitempty"`
+	// Symbolization: a majestic crash's backtrace, or why there is none yet.
+	Symbolization *Symbolization `json:"symbolization,omitempty"`
 }
 
 // Build is a pushed firmware build.
@@ -401,8 +420,10 @@ func (s *Store) Details(ctx context.Context, id string) ([]Detail, error) {
 	rows, err := s.DB.Query(ctx, `
 		SELECT e.id, e.signature_id, e.received_at, e.channel, e.kind, e.self_inflicted, e.firmware, e.majestic,
 		       e.soc, e.sensor, e.board, e.machine, e.kernel, e.kernel_build, e.kernel_built, e.cmdline, e.uptime,
-		       e.modules, e.fatal, e.before, e.anomalies, e.leadup, e.meta, e.redacted
+		       e.modules, e.fatal, e.before, e.anomalies, e.leadup, e.meta, e.redacted,
+		       y.status, y.attempts, y.frames, y.sources, y.error, y.at
 		FROM crash_events e JOIN crash_signatures sig ON sig.id = e.signature_id
+		LEFT JOIN crash_symbolizations y ON y.event_id = e.id
 		WHERE coalesce(sig.merged_into, sig.id) = $1
 		ORDER BY e.received_at DESC LIMIT $2`, id, MaxDetails)
 	if err != nil {
@@ -410,13 +431,22 @@ func (s *Store) Details(ctx context.Context, id string) ([]Detail, error) {
 	}
 	out, err := pgx.CollectRows(rows, func(r pgx.CollectableRow) (Detail, error) {
 		var d Detail
-		var meta []byte
+		var meta, frames, sources []byte
+		var status, symErr *string
+		var attempts *int
+		var at *time.Time
 		err := r.Scan(&d.ID, &d.Signature, &d.ReceivedAt, &d.Channel, &d.Kind, &d.SelfInflicted, &d.Firmware, &d.Majestic,
 			&d.SoC, &d.Sensor, &d.Board, &d.Machine, &d.Kernel, &d.KernelBuild, &d.KernelBuilt, &d.Cmdline, &d.Uptime,
-			&d.Modules, &d.Fatal, &d.Before, &d.Anomalies, &d.Leadup, &meta, &d.Log)
+			&d.Modules, &d.Fatal, &d.Before, &d.Anomalies, &d.Leadup, &meta, &d.Log,
+			&status, &attempts, &frames, &sources, &symErr, &at)
 		if len(meta) > 0 {
 			d.Meta = meta
 		}
+		if status != nil {
+			y := &Symbolization{Status: *status, Attempts: *attempts, Sources: sources, Error: *symErr, At: *at}
+			_ = json.Unmarshal(frames, &y.Frames)
+			d.Symbolization = y
+		}
 		return d, err
 	})
 	if err != nil {
@@ -462,10 +492,13 @@ type Mine struct {
 	Camera        bool `json:"camera"`
 }
 
-// Mine is the crashes the member sent or their linked cameras did.
+// Mine is the crashes the member sent or their linked cameras did. A crash
+// of majestic's is named by its signal alone: where in majestic's source it
+// happened is for the maintainers.
 func (s *Store) Mine(ctx context.Context, member string) ([]Mine, error) {
 	rows, err := s.DB.Query(ctx, `
-		SELECT e.id, coalesce(sig.merged_into, sig.id), e.title, e.kind, root.status, e.soc, e.sensor, e.received_at,
+		SELECT e.id, coalesce(sig.merged_into, sig.id), CASE WHEN e.kind = 'signal' THEN e.fatal->>'reason' ELSE e.title END,
+		       e.kind, root.status, e.soc, e.sensor, e.received_at,
 		       e.self_inflicted, l.member_id IS NOT NULL
 		FROM crash_events e
 		JOIN crash_signatures sig ON sig.id = e.signature_id
@@ -540,7 +573,9 @@ func (s *Store) Decide(ctx context.Context, id, by string, t Triage) (taken int,
 			merged = nil
 			if *t.MergeInto != "" {
 				var target string
-				err := tx.QueryRow(ctx, `SELECT coalesce(merged_into, id) FROM crash_signatures WHERE id = $1`, *t.MergeInto).Scan(&target)
+				var sameClass bool
+				err := tx.QueryRow(ctx, `SELECT coalesce(t.merged_into, t.id), t.class = s.class FROM crash_signatures t, crash_signatures s
+					WHERE t.id = $1 AND s.id = $2`, *t.MergeInto, id).Scan(&target, &sameClass)
 				if errors.Is(err, pgx.ErrNoRows) {
 					return fmt.Errorf("merge_into: %w", ErrNoSignature)
 				}
@@ -550,6 +585,11 @@ func (s *Store) Decide(ctx context.Context, id, by string, t Triage) (taken int,
 				if target == id {
 					return fmt.Errorf("%w: %s is already merged into this one", ErrInvalid, *t.MergeInto)
 				}
+				// A kernel crash and majestic's are never one bug, and
+				// majestic's must not be counted on the public list.
+				if !sameClass {
+					return fmt.Errorf("%w: %s is a crash of another kind (kernel or majestic)", ErrInvalid, *t.MergeInto)
+				}
 				merged = &target
 				if _, err := tx.Exec(ctx, `UPDATE crash_signatures SET merged_into = $2, updated_at = now() WHERE merged_into = $1`, id, target); err != nil {
 					return err
diff --git a/service/internal/crashes/store_test.go b/service/internal/crashes/store_test.go
index 81aebbf8..04b06842 100644
--- a/service/internal/crashes/store_test.go
+++ b/service/internal/crashes/store_test.go
@@ -358,14 +358,15 @@ func TestRankingAndMerge(t *testing.T) {
 // separator apart are both found.
 func TestRedact(t *testing.T) {
 	in := "ip=10.0.0.2:10.0.0.1:10.0.0.254:255.255.255.0 then 1.2.3.4 5.6.7.8, v6 fe80::1ff:fe23:4567:890a and 2001:db8:0:0:0:0:2:1, " +
-		"cisco 0012.3456.789a, colon aa:bb:cc:dd:ee:ff, kept: Linux version 4.9.37.1.2, 17:57:19, 9dc0: bf12bef8, ::1, 127.0.0.1"
+		"cisco 0012.3456.789a, colon aa:bb:cc:dd:ee:ff, kept: Linux version 4.9.37.1.2, 17:57:19, 9dc0: bf12bef8, ::1, 127.0.0.1, " +
+		"\"version\": \"2.6.10.05\""
 	out := Redact(in, "", "k")
 	for _, leak := range []string{"10.0.0.2", "10.0.0.1", "10.0.0.254", "1.2.3.4", "5.6.7.8", "fe80::", "2001:db8", "0012.3456", "aa:bb:cc"} {
 		if strings.Contains(out, leak) {
 			t.Errorf("%q survived: %s", leak, out)
 		}
 	}
-	for _, kept := range []string{"255.255.255.0", "4.9.37.1.2", "17:57:19", "9dc0: bf12bef8", "::1", "127.0.0.1"} {
+	for _, kept := range []string{"255.255.255.0", "4.9.37.1.2", "17:57:19", "9dc0: bf12bef8", "::1", "127.0.0.1", "2.6.10.05"} {
 		if !strings.Contains(out, kept) {
 			t.Errorf("%q was redacted: %s", kept, out)
 		}
diff --git a/service/internal/crashes/symbolize/core.go b/service/internal/crashes/symbolize/core.go
new file mode 100644
index 00000000..5a87451b
--- /dev/null
+++ b/service/internal/crashes/symbolize/core.go
@@ -0,0 +1,239 @@
+// Package symbolize turns majestic's crash dumps into backtraces, in the
+// firmware role: the dump (crashes.Dump) becomes a small ELF core, which
+// gdb-multiarch unwinds against the executable and debuginfo majestic's CI
+// publishes for the build-id, with the firmware build's own libraries for the
+// frames outside majestic. Where gdb stops -- a library with no unwind
+// tables, which is most of them on a camera -- a scan of the stack for return
+// addresses that follow a call finds the probable callers.
+package symbolize
+
+import (
+	"bytes"
+	"debug/elf"
+	"encoding/binary"
+	"fmt"
+	"os"
+
+	"github.com/OpenIPC/website/service/internal/crashes"
+)
+
+// Segment is memory to put in the core: the stack, or a module's code read
+// from its file, so gdb and the scan can read the instructions.
+type Segment struct {
+	Addr  uint64
+	Data  []byte
+	Flags elf.ProgFlag
+}
+
+// The ELF core is the least gdb unwinds from: NT_PRSTATUS with the
+// registers in the kernel's elf_gregset_t order, NT_AUXV (AT_PHDR and
+// AT_ENTRY place a PIE), and a PT_LOAD per segment.
+func machine(arch int) (elf.Machine, uint32, error) {
+	switch arch {
+	case crashes.ArchARM:
+		return elf.EM_ARM, 0x05000000, nil // EABI5
+	case crashes.ArchMIPSLE, crashes.ArchMIPSBE:
+		return elf.EM_MIPS, 0, nil
+	case crashes.ArchX86_64:
+		return elf.EM_X86_64, 0, nil
+	case crashes.ArchAArch64:
+		return elf.EM_AARCH64, 0, nil
+	}
+	return 0, 0, fmt.Errorf("no core for architecture %d", arch)
+}
+
+// prstatus is the struct elf_prstatus for the architecture: what the kernel
+// writes in a core, only pr_reg filled in.
+func prstatus(d *crashes.Dump) ([]byte, error) {
+	o := d.Order()
+	r := d.Regs
+	need := func(n int) error {
+		if len(r) < n {
+			return fmt.Errorf("the dump's registers are %d bytes, not the %d its architecture has", len(r), n)
+		}
+		return nil
+	}
+	switch d.Arch {
+	case crashes.ArchARM:
+		// pr_reg at 72: r0..r15, cpsr, orig_r0; from the sigcontext's
+		// trap_no, error_code, oldmask, r0..r15, cpsr.
+		if err := need(20 * 4); err != nil {
+			return nil, err
+		}
+		pr := make([]byte, 148)
+		for i := 0; i < 17; i++ {
+			o.PutUint32(pr[72+4*i:], o.Uint32(r[(3+i)*4:]))
+		}
+		o.PutUint32(pr[72+17*4:], o.Uint32(r[3*4:]))
+		return pr, nil
+	case crashes.ArchMIPSLE, crashes.ArchMIPSBE:
+		// pr_reg at 72: 45 words, r0..r31 from the sixth, then lo, hi, epc,
+		// badvaddr, status, cause; from the sigcontext's regmask, status,
+		// u64 pc, u64 regs[32], u64 fpregs[32], five words, u64 hi, u64 lo.
+		if err := need(568); err != nil {
+			return nil, err
+		}
+		pr := make([]byte, 256)
+		w := func(i int, v uint64) { o.PutUint32(pr[72+4*i:], uint32(v)) }
+		for i := 0; i < 32; i++ {
+			w(6+i, o.Uint64(r[16+8*i:]))
+		}
+		w(38, o.Uint64(r[560:]))
+		w(39, o.Uint64(r[552:]))
+		w(40, o.Uint64(r[8:]))
+		w(42, uint64(o.Uint32(r[4:])))
+		return pr, nil
+	case crashes.ArchX86_64:
+		// pr_reg at 112, user_regs_struct: r15 r14 r13 r12 rbp rbx r11 r10
+		// r9 r8 rax rcx rdx rsi rdi orig_rax rip cs eflags rsp ss fs_base
+		// gs_base ds es fs gs; from gregs: r8..r15, rdi, rsi, rbp, rbx, rdx,
+		// rax, rcx, rsp, rip, eflags, csgsfs.
+		if err := need(19 * 8); err != nil {
+			return nil, err
+		}
+		g := func(i int) uint64 { return o.Uint64(r[8*i:]) }
+		user := []uint64{g(7), g(6), g(5), g(4), g(10), g(11), g(3), g(2), g(1), g(0), g(13), g(14), g(12),
+			g(9), g(8), 0, g(16), g(18) & 0xffff, g(17), g(15), 0x2b, 0, 0, 0, 0, 0, 0}
+		pr := make([]byte, 336)
+		for i, v := range user {
+			o.PutUint64(pr[112+8*i:], v)
+		}
+		return pr, nil
+	case crashes.ArchAArch64:
+		// pr_reg at 112: x0..x30, sp, pc, pstate; from the sigcontext's
+		// fault_address, regs[31], sp, pc, pstate.
+		if err := need(35 * 8); err != nil {
+			return nil, err
+		}
+		pr := make([]byte, 392)
+		copy(pr[112:112+34*8], r[8:8+34*8])
+		return pr, nil
+	}
+	return nil, fmt.Errorf("no core for architecture %d", d.Arch)
+}
+
+func note(o binary.ByteOrder, typ uint32, desc []byte) []byte {
+	var b bytes.Buffer
+	name := []byte("CORE\x00\x00\x00\x00") // "CORE\0", padded to 4
+	hdr := make([]byte, 12)
+	o.PutUint32(hdr, 5)
+	o.PutUint32(hdr[4:], uint32(len(desc)))
+	o.PutUint32(hdr[8:], typ)
+	b.Write(hdr)
+	b.Write(name)
+	b.Write(desc)
+	for b.Len()%4 != 0 {
+		b.WriteByte(0)
+	}
+	return b.Bytes()
+}
+
+// Core is the dump as an ELF core: its registers and its stack, and segs
+// beside them.
+func Core(d *crashes.Dump, segs []Segment) ([]byte, error) {
+	mach, flags, err := machine(d.Arch)
+	if err != nil {
+		return nil, err
+	}
+	pr, err := prstatus(d)
+	if err != nil {
+		return nil, err
+	}
+	o := d.Order()
+	notes := append(note(o, uint32(elf.NT_PRSTATUS), pr), note(o, 6 /* NT_AUXV */, d.Auxv)...)
+	all := append([]Segment{{Addr: d.StackAt, Data: d.Stack, Flags: elf.PF_R | elf.PF_W}}, segs...)
+
+	is64 := d.Is64()
+	ehsize, phsize := 52, 32
+	if is64 {
+		ehsize, phsize = 64, 56
+	}
+	phnum := 1 + len(all)
+	off := uint64(ehsize + phsize*phnum)
+	var hdr, ph, body bytes.Buffer
+
+	ident := [16]byte{0x7f, 'E', 'L', 'F'}
+	ident[elf.EI_CLASS] = byte(elf.ELFCLASS32)
+	if is64 {
+		ident[elf.EI_CLASS] = byte(elf.ELFCLASS64)
+	}
+	ident[elf.EI_DATA] = byte(elf.ELFDATA2LSB)
+	if o == binary.BigEndian {
+		ident[elf.EI_DATA] = byte(elf.ELFDATA2MSB)
+	}
+	ident[elf.EI_VERSION] = byte(elf.EV_CURRENT)
+	hdr.Write(ident[:])
+	put := func(b *bytes.Buffer, size int, v uint64) {
+		switch size {
+		case 2:
+			_ = binary.Write(b, o, uint16(v))
+		case 4:
+			_ = binary.Write(b, o, uint32(v))
+		default:
+			_ = binary.Write(b, o, v)
+		}
+	}
+	word := 4
+	if is64 {
+		word = 8
+	}
+	put(&hdr, 2, uint64(elf.ET_CORE))
+	put(&hdr, 2, uint64(mach))
+	put(&hdr, 4, 1)
+	put(&hdr, word, 0)              // entry
+	put(&hdr, word, uint64(ehsize)) // phoff
+	put(&hdr, word, 0)              // shoff
+	put(&hdr, 4, uint64(flags))
+	put(&hdr, 2, uint64(ehsize))
+	put(&hdr, 2, uint64(phsize))
+	put(&hdr, 2, uint64(phnum))
+	put(&hdr, 2, 0)
+	put(&hdr, 2, 0)
+	put(&hdr, 2, 0)
+
+	phdr := func(typ elf.ProgType, fl elf.ProgFlag, offset, addr, size, align uint64) {
+		put(&ph, 4, uint64(typ))
+		if is64 {
+			put(&ph, 4, uint64(fl))
+		}
+		put(&ph, word, offset)
+		put(&ph, word, addr)
+		put(&ph, word, 0)
+		put(&ph, word, size)
+		put(&ph, word, size)
+		if !is64 {
+			put(&ph, 4, uint64(fl))
+		}
+		put(&ph, word, align)
+	}
+	phdr(elf.PT_NOTE, 0, off, 0, uint64(len(notes)), 4)
+	body.Write(notes)
+	for _, s := range all {
+		phdr(elf.PT_LOAD, s.Flags, off+uint64(body.Len()), s.Addr, uint64(len(s.Data)), 1)
+		body.Write(s.Data)
+	}
+	return append(append(hdr.Bytes(), ph.Bytes()...), body.Bytes()...), nil
+}
+
+// CodeOf is a module's code, read from its file and placed at its load
+// bias: the executable segments only, which are what gdb's and the scan's
+// reading of instructions needs.
+func CodeOf(path string, bias uint64) ([]Segment, error) {
+	f, err := elf.Open(path)
+	if err != nil {
+		return nil, err
+	}
+	defer f.Close()
+	raw, err := os.ReadFile(path)
+	if err != nil {
+		return nil, err
+	}
+	var out []Segment
+	for _, p := range f.Progs {
+		if p.Type != elf.PT_LOAD || p.Flags&elf.PF_X == 0 || p.Off+p.Filesz > uint64(len(raw)) {
+			continue
+		}
+		out = append(out, Segment{Addr: bias + p.Vaddr, Data: raw[p.Off : p.Off+p.Filesz], Flags: p.Flags})
+	}
+	return out, nil
+}
diff --git a/service/internal/crashes/symbolize/frames.py b/service/internal/crashes/symbolize/frames.py
new file mode 100644
index 00000000..b3a997d2
--- /dev/null
+++ b/service/internal/crashes/symbolize/frames.py
@@ -0,0 +1,56 @@
+# Run inside gdb by the symbolize package: the backtrace of the core loaded,
+# and what a list of addresses are, as one JSON line each. gdb's own `bt` is
+# for people; this is for a parser. Frame arguments are never read: they are
+# majestic's memory, and the stack slice is enough to unwind.
+import gdb
+import json
+
+
+def _where(pc, frame=None):
+    out = {"pc": int(pc), "fn": "", "file": "", "line": 0}
+    try:
+        block = frame.block() if frame is not None else gdb.block_for_pc(int(pc))
+        while block is not None and block.function is None:
+            block = block.superblock
+        if block is not None and block.function is not None:
+            out["fn"] = block.function.name
+    except RuntimeError:
+        pass
+    if not out["fn"] and frame is not None and frame.name():
+        out["fn"] = frame.name()
+    if not out["fn"]:
+        sym = gdb.execute("info symbol 0x%x" % int(pc), to_string=True).strip()
+        if sym and not sym.startswith("No symbol"):
+            out["fn"] = sym.split(" ")[0]
+    sal = frame.find_sal() if frame is not None else gdb.find_pc_line(int(pc))
+    if sal is not None and sal.symtab is not None:
+        out["file"] = sal.symtab.filename
+        out["line"] = sal.line
+    return out
+
+
+def unwind(limit=64):
+    frames = []
+    stop = ""
+    f = gdb.newest_frame()
+    while f is not None and len(frames) < limit:
+        w = _where(f.pc(), f)
+        try:
+            w["sp"] = int(f.read_register("sp"))
+        except (gdb.error, ValueError):
+            w["sp"] = 0
+        w["inline"] = f.type() == gdb.INLINE_FRAME
+        frames.append(w)
+        try:
+            older = f.older()
+        except gdb.error as e:
+            stop = str(e)
+            break
+        if older is None:
+            stop = gdb.frame_stop_reason_string(f.unwind_stop_reason())
+        f = older
+    print("@@FRAMES " + json.dumps({"frames": frames, "stop": stop}))
+
+
+def resolve(addrs):
+    print("@@RESOLVED " + json.dumps([_where(a) for a in addrs]))
diff --git a/service/internal/crashes/symbolize/gdb.go b/service/internal/crashes/symbolize/gdb.go
new file mode 100644
index 00000000..35e9c911
--- /dev/null
+++ b/service/internal/crashes/symbolize/gdb.go
@@ -0,0 +1,165 @@
+package symbolize
+
+import (
+	"bufio"
+	"bytes"
+	"context"
+	_ "embed"
+	"encoding/json"
+	"errors"
+	"fmt"
+	"os"
+	"os/exec"
+	"path/filepath"
+	"strings"
+	"time"
+)
+
+//go:embed frames.py
+var framesPy []byte
+
+// GDB is the gdb-multiarch that unwinds: its path, and how long one run may
+// take.
+type GDB struct {
+	Path    string
+	Timeout time.Duration
+}
+
+// ErrNoGDB is a host without gdb-multiarch.
+var ErrNoGDB = errors.New("gdb-multiarch is not installed")
+
+// RawFrame is a frame as gdb unwound it.
+type RawFrame struct {
+	PC     uint64 `json:"pc"`
+	SP     uint64 `json:"sp"`
+	Fn     string `json:"fn"`
+	File   string `json:"file"`
+	Line   int    `json:"line"`
+	Inline bool   `json:"inline"`
+}
+
+// Where is what an address is, as gdb resolves it.
+type Where struct {
+	PC   uint64 `json:"pc"`
+	Fn   string `json:"fn"`
+	File string `json:"file"`
+	Line int    `json:"line"`
+}
+
+// Session is what one gdb run loads: majestic's executable, the directory
+// its debuginfo is found in by build-id, and the core.
+type Session struct {
+	Executable string
+	DebugDir   string
+	Core       string
+}
+
+func (g *GDB) path() (string, error) {
+	p := g.Path
+	if p == "" {
+		p = "gdb-multiarch"
+	}
+	found, err := exec.LookPath(p)
+	if err != nil {
+		return "", ErrNoGDB
+	}
+	return found, nil
+}
+
+// run loads the session and runs the python call, and returns the JSON the
+// line marked with tag carries.
+func (g *GDB) run(ctx context.Context, s Session, call, tag string) ([]byte, error) {
+	bin, err := g.path()
+	if err != nil {
+		return nil, err
+	}
+	dir, err := os.MkdirTemp("", "symbolize-")
+	if err != nil {
+		return nil, err
+	}
+	defer os.RemoveAll(dir)
+	script := filepath.Join(dir, "frames.py")
+	if err := os.WriteFile(script, framesPy, 0o600); err != nil {
+		return nil, err
+	}
+	timeout := g.Timeout
+	if timeout == 0 {
+		timeout = time.Minute
+	}
+	ctx, cancel := context.WithTimeout(ctx, timeout)
+	defer cancel()
+	// Nothing from the host: no init files, no debuginfod, no auto-loaded
+	// scripts, no libraries from the host's own root.
+	args := []string{"-batch", "-nx", "-nh", "-q",
+		"-iex", "set debuginfod enabled off",
+		"-iex", "set auto-load off",
+		"-iex", "set sysroot /nonexistent",
+		"-iex", "set pagination off",
+		"-iex", "set print frame-arguments none",
+		"-ex", "set debug-file-directory " + s.DebugDir,
+		"-ex", "file " + s.Executable,
+		"-ex", "core-file " + s.Core,
+		"-ex", "source " + script,
+		"-ex", "python " + call,
+	}
+	cmd := exec.CommandContext(ctx, bin, args...)
+	cmd.Env = []string{"HOME=" + dir, "PATH=/usr/bin:/bin", "LC_ALL=C"}
+	var out, stderr bytes.Buffer
+	cmd.Stdout, cmd.Stderr = &out, &stderr
+	err = cmd.Run()
+	sc := bufio.NewScanner(&out)
+	sc.Buffer(make([]byte, 1<<20), 8<<20)
+	for sc.Scan() {
+		if v, ok := strings.CutPrefix(sc.Text(), tag+" "); ok {
+			return []byte(v), nil
+		}
+	}
+	if err == nil {
+		err = errors.New("no result")
+	}
+	return nil, fmt.Errorf("gdb: %w: %s", err, lastLines(stderr.String()+out.String(), 6))
+}
+
+func lastLines(s string, n int) string {
+	lines := strings.Split(strings.TrimSpace(s), "\n")
+	if len(lines) > n {
+		lines = lines[len(lines)-n:]
+	}
+	return strings.Join(lines, " | ")
+}
+
+// Unwind is the backtrace gdb makes of the core, and why it stopped.
+func (g *GDB) Unwind(ctx context.Context, s Session) ([]RawFrame, string, error) {
+	b, err := g.run(ctx, s, "unwind()", "@@FRAMES")
+	if err != nil {
+		return nil, "", err
+	}
+	var v struct {
+		Frames []RawFrame `json:"frames"`
+		Stop   string     `json:"stop"`
+	}
+	if err := json.Unmarshal(b, &v); err != nil {
+		return nil, "", fmt.Errorf("gdb's frames: %w", err)
+	}
+	return v.Frames, v.Stop, nil
+}
+
+// Resolve names addresses in majestic: function, file and line.
+func (g *GDB) Resolve(ctx context.Context, s Session, addrs []uint64) ([]Where, error) {
+	if len(addrs) == 0 {
+		return nil, nil
+	}
+	list := make([]string, len(addrs))
+	for i, a := range addrs {
+		list[i] = fmt.Sprintf("%d", a)
+	}
+	b, err := g.run(ctx, s, "resolve(["+strings.Join(list, ",")+"])", "@@RESOLVED")
+	if err != nil {
+		return nil, err
+	}
+	var out []Where
+	if err := json.Unmarshal(b, &out); err != nil {
+		return nil, fmt.Errorf("gdb's addresses: %w", err)
+	}
+	return out, nil
+}
diff --git a/service/internal/crashes/symbolize/rootfs_test.go b/service/internal/crashes/symbolize/rootfs_test.go
new file mode 100644
index 00000000..bd31be23
--- /dev/null
+++ b/service/internal/crashes/symbolize/rootfs_test.go
@@ -0,0 +1,114 @@
+package symbolize
+
+import (
+	"archive/tar"
+	"bytes"
+	"compress/gzip"
+	"context"
+	"crypto/sha256"
+	"encoding/hex"
+	"os"
+	"os/exec"
+	"path/filepath"
+	"testing"
+	"time"
+
+	"github.com/OpenIPC/website/service/internal/db/dbtest"
+	"github.com/OpenIPC/website/service/internal/firmware"
+)
+
+// A firmware build's tarball, as the release cache already holds it: the
+// rootfs is found by the build and platform meta.json names, unpacked, and a
+// library the camera mapped is read from it -- musl's libc.so through its
+// absolute link, as the image has it.
+func TestRootfsUnpacksTheBuildsLibraries(t *testing.T) {
+	mksquashfs, err := exec.LookPath("mksquashfs")
+	if err != nil {
+		if os.Getenv("CI") != "" {
+			t.Fatal("squashfs-tools is not installed, and CI is set")
+		}
+		t.Skip("squashfs-tools is not installed")
+	}
+	pool := dbtest.New(t)
+	ctx := context.Background()
+
+	img := t.TempDir()
+	lib := filepath.Join(img, "lib")
+	if err := os.MkdirAll(lib, 0o755); err != nil {
+		t.Fatal(err)
+	}
+	libtoy, _ := os.ReadFile(filepath.Join(fixtures, "arm", "libtoy.so"))
+	if err := os.WriteFile(filepath.Join(lib, "ld-musl-arm.so.1"), libtoy, 0o755); err != nil {
+		t.Fatal(err)
+	}
+	if err := os.Symlink("/lib/ld-musl-arm.so.1", filepath.Join(lib, "libc.so")); err != nil {
+		t.Fatal(err)
+	}
+	if err := os.MkdirAll(filepath.Join(img, "etc"), 0o755); err != nil {
+		t.Fatal(err)
+	}
+	if err := os.WriteFile(filepath.Join(img, "etc", "shadow"), []byte("root:x"), 0o600); err != nil {
+		t.Fatal(err)
+	}
+	squash := filepath.Join(t.TempDir(), "rootfs.squashfs")
+	if out, err := exec.Command(mksquashfs, img, squash, "-noappend", "-quiet", "-all-root").CombinedOutput(); err != nil {
+		t.Fatalf("mksquashfs: %v %s", err, out)
+	}
+	sq, _ := os.ReadFile(squash)
+	var tgz bytes.Buffer
+	zw := gzip.NewWriter(&tgz)
+	tw := tar.NewWriter(zw)
+	for name, body := range map[string][]byte{"uImage.toy": []byte("kernel"), "rootfs.squashfs.toy": sq} {
+		tw.WriteHeader(&tar.Header{Name: name, Mode: 0o644, Size: int64(len(body)), Typeflag: tar.TypeReg})
+		tw.Write(body)
+	}
+	tw.Close()
+	zw.Close()
+	sum := sha256.Sum256(tgz.Bytes())
+	digest := hex.EncodeToString(sum[:])
+
+	now := time.Date(2026, 10, 9, 0, 0, 0, 0, time.UTC)
+	if _, err := pool.Exec(ctx, `INSERT INTO builds (id, source, release, sha, built_at, published_at, pushed_by)
+		VALUES ('nightly-20261009-0000000', 'firmware', 'nightly-20261009-0000000', $1, $2, $2, 'test')`,
+		"0000000000000000000000000000000000000000", now); err != nil {
+		t.Fatal(err)
+	}
+	if _, err := pool.Exec(ctx, `INSERT INTO build_assets (build_id, name, size, sha256, board, storage, edition)
+		VALUES ('nightly-20261009-0000000', 'openipc.toy-nor-lite.tgz', $1, $2, 'toy', 'nor', 'lite')`,
+		tgz.Len(), digest); err != nil {
+		t.Fatal(err)
+	}
+	cache := t.TempDir()
+	rel := &firmware.Releases{Root: cache, Base: "http://127.0.0.1:1/never"}
+	blob := rel.Path(firmware.Asset{Name: "openipc.toy-nor-lite.tgz", Size: int64(tgz.Len()), Digest: "sha256:" + digest})
+	if err := os.MkdirAll(filepath.Dir(blob), 0o755); err != nil {
+		t.Fatal(err)
+	}
+	if err := os.WriteFile(blob, tgz.Bytes(), 0o644); err != nil {
+		t.Fatal(err)
+	}
+
+	r := &Rootfs{Root: filepath.Join(cache, "symbols"), DB: pool, Releases: rel}
+	dir, err := r.Dir(ctx, "nightly-20261009-0000000", "toy_lite")
+	if err != nil {
+		t.Fatal(err)
+	}
+	got := Library(dir, "/lib/libc.so")
+	if b, _ := os.ReadFile(got); !bytes.Equal(b, libtoy) {
+		t.Fatalf("libc.so is %q", got)
+	}
+	// Only the libraries are unpacked.
+	if _, err := os.Stat(filepath.Join(dir, "etc", "shadow")); err == nil {
+		t.Fatal("unpacked /etc")
+	}
+	// Unpacked once: the second ask is the directory already there.
+	if again, err := r.Dir(ctx, "nightly-20261009-0000000", "toy_lite"); err != nil || again != dir {
+		t.Fatalf("%v %s", err, again)
+	}
+	if _, err := r.Dir(ctx, "nightly-20990101-0000000", "toy_lite"); err == nil {
+		t.Fatal("a build the site does not have was unpacked")
+	}
+	if _, err := r.Dir(ctx, "../../etc", "toy_lite"); err == nil {
+		t.Fatal("a build named as a path was looked up")
+	}
+}
diff --git a/service/internal/crashes/symbolize/scan.go b/service/internal/crashes/symbolize/scan.go
new file mode 100644
index 00000000..52b560d2
--- /dev/null
+++ b/service/internal/crashes/symbolize/scan.go
@@ -0,0 +1,137 @@
+package symbolize
+
+import (
+	"encoding/binary"
+
+	"github.com/OpenIPC/website/service/internal/crashes"
+)
+
+// Memory is the code the scan may read: the modules' executable segments.
+type Memory []Segment
+
+// read is n bytes at addr, or nil where no segment holds them all.
+func (m Memory) read(addr uint64, n int) []byte {
+	for _, s := range m {
+		// addr-4 of a small word wraps around: compared by offset, never by
+		// a sum that can overflow.
+		if addr >= s.Addr && n <= len(s.Data) && addr-s.Addr <= uint64(len(s.Data)-n) {
+			return s.Data[addr-s.Addr : addr-s.Addr+uint64(n)]
+		}
+	}
+	return nil
+}
+
+// Candidate is a return address found on the stack.
+type Candidate struct {
+	Slot uint64 // where on the stack it was
+	Call uint64 // an address inside the call instruction before it
+}
+
+// maxCandidates is how many callers a scan reports.
+const maxCandidates = 24
+
+// Scan reads the stack from `from` up for words that are return addresses:
+// they point into code, and the instruction before each is a call. A stack
+// holds more than live frames -- locals, saved registers, the leftovers of
+// calls that returned -- so this is what was probably calling, not a
+// certainty: dead frames below the live ones are why the scan starts where
+// the unwinder stopped, not at the fault.
+func Scan(d *crashes.Dump, from uint64, code Memory) []Candidate {
+	if from < d.StackAt {
+		from = d.StackAt
+	}
+	// An address gdb read off a crafted or broken stack can be anything.
+	if from-d.StackAt >= uint64(len(d.Stack)) {
+		return nil
+	}
+	size := 4
+	if d.Is64() {
+		size = 8
+	}
+	o := d.Order()
+	var out []Candidate
+	start := int(from - d.StackAt)
+	start += (size - start%size) % size
+	for i := start; i+size <= len(d.Stack) && len(out) < maxCandidates; i += size {
+		var w uint64
+		if size == 4 {
+			w = uint64(o.Uint32(d.Stack[i:]))
+		} else {
+			w = o.Uint64(d.Stack[i:])
+		}
+		call, ok := callBefore(d.Arch, o, w, code)
+		if !ok {
+			continue
+		}
+		if n := len(out); n > 0 && out[n-1].Call == call {
+			continue
+		}
+		out = append(out, Candidate{Slot: d.StackAt + uint64(i), Call: call})
+	}
+	return out
+}
+
+// callBefore says whether the instruction before return address ra is a
+// call, and gives an address inside it: the call site, which is the line a
+// caller's frame names.
+func callBefore(arch int, o binary.ByteOrder, ra uint64, code Memory) (uint64, bool) {
+	switch arch {
+	case crashes.ArchARM:
+		if ra&1 == 1 {
+			// Thumb: BL or BLX (immediate), 32 bits; BLX (register), 16.
+			ra &^= 1
+			if b := code.read(ra-4, 4); b != nil {
+				h1, h2 := o.Uint16(b), o.Uint16(b[2:])
+				if h1&0xf800 == 0xf000 && (h2&0xd000 == 0xd000 || h2&0xd001 == 0xc000) {
+					return ra - 2, true
+				}
+			}
+			if b := code.read(ra-2, 2); b != nil && o.Uint16(b)&0xff87 == 0x4780 {
+				return ra - 2, true
+			}
+			return 0, false
+		}
+		// ARM: BL, BLX (immediate), BLX (register).
+		if b := code.read(ra-4, 4); b != nil {
+			i := o.Uint32(b)
+			if (i&0x0f000000 == 0x0b000000 && i>>28 != 0xf) || i&0xfe000000 == 0xfa000000 || i&0x0ffffff0 == 0x012fff30 {
+				return ra - 4, true
+			}
+		}
+	case crashes.ArchMIPSLE, crashes.ArchMIPSBE:
+		// The return address is past the call and its delay slot: JAL, JALX,
+		// JALR, BAL/BGEZAL/BLTZAL.
+		if ra&3 != 0 {
+			return 0, false
+		}
+		if b := code.read(ra-8, 4); b != nil {
+			i := o.Uint32(b)
+			op := i >> 26
+			rt := (i >> 16) & 0x1f
+			if op == 3 || op == 29 || (op == 0 && i&0x3f == 9) || (op == 1 && (rt == 0x11 || rt == 0x10)) {
+				return ra - 8, true
+			}
+		}
+	case crashes.ArchX86_64:
+		// CALL rel32, or CALL r/m (FF /2) in its register, memory and
+		// displacement forms, with or without a REX prefix.
+		if b := code.read(ra-5, 5); b != nil && b[0] == 0xe8 {
+			return ra - 1, true
+		}
+		for _, n := range []int{2, 3, 4, 6, 7} {
+			b := code.read(ra-uint64(n), 2)
+			if b != nil && b[0] == 0xff && (b[1]>>3)&7 == 2 {
+				return ra - 1, true
+			}
+		}
+	case crashes.ArchAArch64:
+		// BL, BLR.
+		if b := code.read(ra-4, 4); b != nil {
+			i := o.Uint32(b)
+			if i&0xfc000000 == 0x94000000 || i&0xfffffc1f == 0xd63f0000 {
+				return ra - 4, true
+			}
+		}
+	}
+	return 0, false
+}
diff --git a/service/internal/crashes/symbolize/sources.go b/service/internal/crashes/symbolize/sources.go
new file mode 100644
index 00000000..b618b66b
--- /dev/null
+++ b/service/internal/crashes/symbolize/sources.go
@@ -0,0 +1,342 @@
+package symbolize
+
+import (
+	"archive/tar"
+	"compress/gzip"
+	"context"
+	"crypto/rand"
+	"encoding/hex"
+	"errors"
+	"fmt"
+	"io"
+	"net/http"
+	"os"
+	"os/exec"
+	"path/filepath"
+	"regexp"
+	"strings"
+	"time"
+
+	"github.com/jackc/pgx/v5"
+	"github.com/jackc/pgx/v5/pgxpool"
+	"golang.org/x/sync/singleflight"
+
+	"github.com/OpenIPC/website/service/internal/firmware"
+)
+
+// Symbols is majestic's executable and debuginfo by build-id, from where
+// majestic's CI publishes them (<Base>/<build-id>/executable and
+// /debuginfo), kept under Root:
+//
+//	Root/buildid/<id>/executable
+//	Root/debug/.build-id/<id[:2]>/<id[2:]>.debug   (where gdb looks)
+type Symbols struct {
+	Root string
+	Base string // https://openipc.s3.eu-west-1.amazonaws.com/buildid
+	HTTP *http.Client
+
+	flight singleflight.Group
+}
+
+// ErrNotPublished is a build-id CI has not published: a build of someone's
+// own, or one whose upload has not landed yet.
+var ErrNotPublished = errors.New("no executable and debuginfo are published for this build-id")
+
+var buildIDRe = regexp.MustCompile(`^[0-9a-f]{16,64}$`)
+
+// maxSymbolFile bounds what one file of them may be.
+const maxSymbolFile = 128 << 20
+
+// DebugDir is the directory gdb finds debuginfo in by build-id.
+func (s *Symbols) DebugDir() string { return filepath.Join(s.Root, "debug") }
+
+// Get is the executable's path, its debuginfo in DebugDir, fetched once.
+func (s *Symbols) Get(ctx context.Context, id string) (string, error) {
+	if !buildIDRe.MatchString(id) {
+		return "", fmt.Errorf("%q is not a build-id", id)
+	}
+	exe := filepath.Join(s.Root, "buildid", id, "executable")
+	dbg := filepath.Join(s.DebugDir(), ".build-id", id[:2], id[2:]+".debug")
+	if have(exe) && have(dbg) {
+		touch(exe, dbg)
+		return exe, nil
+	}
+	_, err, _ := s.flight.Do(id, func() (any, error) {
+		if err := s.fetch(ctx, id+"/executable", exe); err != nil {
+			return nil, err
+		}
+		return nil, s.fetch(ctx, id+"/debuginfo", dbg)
+	})
+	if err != nil {
+		return "", err
+	}
+	return exe, nil
+}
+
+func have(p string) bool {
+	st, err := os.Stat(p)
+	return err == nil && st.Mode().IsRegular() && st.Size() > 0
+}
+
+// touch marks files used, for Sweep.
+func touch(paths ...string) {
+	now := time.Now()
+	for _, p := range paths {
+		_ = os.Chtimes(p, now, now)
+	}
+}
+
+func (s *Symbols) fetch(ctx context.Context, name, dest string) error {
+	if have(dest) {
+		return nil
+	}
+	req, err := http.NewRequestWithContext(ctx, http.MethodGet, strings.TrimRight(s.Base, "/")+"/"+name, nil)
+	if err != nil {
+		return err
+	}
+	client := s.HTTP
+	if client == nil {
+		client = &http.Client{Timeout: 5 * time.Minute}
+	}
+	resp, err := client.Do(req)
+	if err != nil {
+		return err
+	}
+	defer resp.Body.Close()
+	// S3 answers a key it does not have 403 to an anonymous reader.
+	if resp.StatusCode == http.StatusNotFound || resp.StatusCode == http.StatusForbidden {
+		return ErrNotPublished
+	}
+	if resp.StatusCode != http.StatusOK {
+		return fmt.Errorf("%s answered %d", name, resp.StatusCode)
+	}
+	return writeAtomic(dest, io.LimitReader(resp.Body, maxSymbolFile+1), maxSymbolFile)
+}
+
+func writeAtomic(dest string, r io.Reader, limit int64) error {
+	if err := os.MkdirAll(filepath.Dir(dest), 0o755); err != nil {
+		return err
+	}
+	var b [4]byte
+	_, _ = rand.Read(b[:])
+	tmp := dest + ".tmp-" + hex.EncodeToString(b[:])
+	defer os.Remove(tmp)
+	f, err := os.OpenFile(tmp, os.O_WRONLY|os.O_CREATE|os.O_EXCL, 0o644)
+	if err != nil {
+		return err
+	}
+	n, err := io.Copy(f, r)
+	if err == nil && n > limit {
+		err = fmt.Errorf("%s is larger than %d bytes", filepath.Base(dest), limit)
+	}
+	if err == nil {
+		err = f.Sync()
+	}
+	if cerr := f.Close(); err == nil {
+		err = cerr
+	}
+	if err != nil {
+		return err
+	}
+	return os.Rename(tmp, dest)
+}
+
+// Rootfs is the libraries of the firmware build a camera ran, from that
+// build's release tarball: its rootfs's /lib and /usr/lib, unpacked once
+// under Root/rootfs/<build>/<platform>.
+type Rootfs struct {
+	Root     string
+	DB       *pgxpool.Pool
+	Releases *firmware.Releases
+	// Unsquashfs is the path to unsquashfs; "" looks it up.
+	Unsquashfs string
+
+	flight singleflight.Group
+}
+
+// ErrNoBuild is a firmware build the site does not know or no longer keeps.
+var ErrNoBuild = errors.New("the firmware build is not among the pushed builds")
+
+var safeName = regexp.MustCompile(`^[A-Za-z0-9._-]{1,128}$`)
+
+// rootfsName is the image, never its rootfs.squashfs.<soc>.md5sum beside it.
+var rootfsName = regexp.MustCompile(`^rootfs\.squashfs(\.[A-Za-z0-9_-]+)?$`)
+
+// Dir is the unpacked rootfs of the build (meta.json's firmware.build_id)
+// for the platform (its firmware.platform, as gk7205v300_lite).
+func (r *Rootfs) Dir(ctx context.Context, build, platform string) (string, error) {
+	if !safeName.MatchString(build) || !safeName.MatchString(platform) {
+		return "", ErrNoBuild
+	}
+	dir := filepath.Join(r.Root, "rootfs", build, platform)
+	if have(filepath.Join(dir, ".done")) {
+		touch(filepath.Join(dir, ".done"))
+		return dir, nil
+	}
+	_, err, _ := r.flight.Do(build+"/"+platform, func() (any, error) {
+		return nil, r.unpack(ctx, build, platform, dir)
+	})
+	if err != nil {
+		return "", err
+	}
+	return dir, nil
+}
+
+func (r *Rootfs) unpack(ctx context.Context, build, platform, dir string) error {
+	board, edition := platform, ""
+	if i := strings.LastIndex(platform, "_"); i > 0 {
+		board, edition = platform[:i], platform[i+1:]
+	}
+	var a firmware.Asset
+	var sha string
+	// The NOR image's rootfs: the NAND one's holds the same files.
+	err := r.DB.QueryRow(ctx, `
+		SELECT a.name, a.size, a.sha256, b.release FROM build_assets a JOIN builds b ON b.id = a.build_id
+		WHERE b.source = 'firmware' AND b.id = $1 AND a.board = $2 AND coalesce(a.edition, '') = $3
+		ORDER BY a.storage = 'nor' DESC, a.name LIMIT 1`, build, board, edition).Scan(&a.Name, &a.Size, &sha, &a.Release)
+	if errors.Is(err, pgx.ErrNoRows) {
+		return ErrNoBuild
+	}
+	if err != nil {
+		return err
+	}
+	a.Digest = "sha256:" + sha
+	tgz, err := r.Releases.Get(ctx, a)
+	if err != nil {
+		return err
+	}
+	tmp := dir + ".tmp"
+	_ = os.RemoveAll(tmp)
+	defer os.RemoveAll(tmp)
+	if err := os.MkdirAll(tmp, 0o755); err != nil {
+		return err
+	}
+	squash := filepath.Join(tmp, "rootfs.squashfs")
+	if err := rootfsOf(tgz, squash); err != nil {
+		return err
+	}
+	bin := r.Unsquashfs
+	if bin == "" {
+		if bin, err = exec.LookPath("unsquashfs"); err != nil {
+			return errors.New("unsquashfs is not installed")
+		}
+	}
+	cctx, cancel := context.WithTimeout(ctx, 2*time.Minute)
+	defer cancel()
+	out, err := exec.CommandContext(cctx, bin, "-no-xattrs", "-no-progress", "-d", filepath.Join(tmp, "root"),
+		squash, "lib", "usr/lib").CombinedOutput()
+	if err != nil {
+		return fmt.Errorf("unsquashfs: %w: %s", err, lastLines(string(out), 3))
+	}
+	_ = os.Remove(squash)
+	if err := os.WriteFile(filepath.Join(tmp, "root", ".done"), nil, 0o644); err != nil {
+		return err
+	}
+	_ = os.RemoveAll(dir)
+	if err := os.MkdirAll(filepath.Dir(dir), 0o755); err != nil {
+		return err
+	}
+	return os.Rename(filepath.Join(tmp, "root"), dir)
+}
+
+// rootfsOf copies the rootfs image out of a firmware tarball:
+// rootfs.squashfs.<soc> beside uImage.<soc>.
+func rootfsOf(tgz, dest string) error {
+	f, err := os.Open(tgz)
+	if err != nil {
+		return err
+	}
+	defer f.Close()
+	z, err := gzip.NewReader(f)
+	if err != nil {
+		return err
+	}
+	tr := tar.NewReader(z)
+	for {
+		h, err := tr.Next()
+		if errors.Is(err, io.EOF) {
+			return errors.New("the firmware tarball has no rootfs.squashfs")
+		}
+		if err != nil {
+			return err
+		}
+		if h.Typeflag == tar.TypeReg && rootfsName.MatchString(filepath.Base(h.Name)) {
+			return writeAtomic(dest, tr, 256<<20)
+		}
+	}
+}
+
+// Library is the file in the unpacked rootfs that a path on the camera
+// names, its symlinks followed as the camera would follow them -- inside the
+// image, never into the host's own /lib; "" when there is none. The path
+// comes from the camera's memory map, so it is not trusted to stay inside.
+func Library(root, camPath string) string {
+	return library(root, camPath, 0)
+}
+
+func library(root, camPath string, depth int) string {
+	if root == "" || depth > 8 || !strings.HasPrefix(camPath, "/") {
+		return ""
+	}
+	rel := filepath.Clean(camPath)
+	// Every directory on the way is the image's own, not a link out of it.
+	dir := root
+	parts := strings.Split(strings.TrimPrefix(rel, "/"), "/")
+	for i, part := range parts {
+		p := filepath.Join(dir, part)
+		st, err := os.Lstat(p)
+		if err != nil {
+			return ""
+		}
+		if st.Mode()&os.ModeSymlink != 0 {
+			target, err := os.Readlink(p)
+			if err != nil {
+				return ""
+			}
+			if !strings.HasPrefix(target, "/") {
+				target = filepath.Join("/", strings.Join(parts[:i], "/"), target)
+			}
+			return library(root, filepath.Join(target, strings.Join(parts[i+1:], "/")), depth+1)
+		}
+		if i < len(parts)-1 && !st.IsDir() {
+			return ""
+		}
+		dir = p
+	}
+	if !have(dir) {
+		return ""
+	}
+	return dir
+}
+
+// Sweep removes what nothing has used for maxAge: builds of majestic and
+// rootfs images of firmware no camera has crashed on lately.
+func Sweep(root string, maxAge time.Duration) (removed int) {
+	cut := time.Now().Add(-maxAge)
+	old := func(p string) bool {
+		st, err := os.Stat(p)
+		return err == nil && st.ModTime().Before(cut)
+	}
+	ids, _ := filepath.Glob(filepath.Join(root, "buildid", "*"))
+	for _, d := range ids {
+		exe := filepath.Join(d, "executable")
+		if old(exe) || !have(exe) {
+			id := filepath.Base(d)
+			if len(id) > 2 {
+				_ = os.Remove(filepath.Join(root, "debug", ".build-id", id[:2], id[2:]+".debug"))
+			}
+			if os.RemoveAll(d) == nil {
+				removed++
+			}
+		}
+	}
+	builds, _ := filepath.Glob(filepath.Join(root, "rootfs", "*", "*"))
+	for _, d := range builds {
+		if strings.HasSuffix(d, ".tmp") && old(d) || !strings.HasSuffix(d, ".tmp") && old(filepath.Join(d, ".done")) {
+			if os.RemoveAll(d) == nil {
+				removed++
+			}
+		}
+	}
+	return removed
+}
diff --git a/service/internal/crashes/symbolize/symbolize.go b/service/internal/crashes/symbolize/symbolize.go
new file mode 100644
index 00000000..affba528
--- /dev/null
+++ b/service/internal/crashes/symbolize/symbolize.go
@@ -0,0 +1,318 @@
+package symbolize
+
+import (
+	"context"
+	"debug/elf"
+	"errors"
+	"fmt"
+	"os"
+	"path/filepath"
+	"sort"
+	"strings"
+
+	"github.com/OpenIPC/website/service/internal/crashes"
+)
+
+// Symbolizer makes backtraces of majestic's dumps.
+type Symbolizer struct {
+	Symbols *Symbols
+	// Rootfs is the firmware builds' libraries; nil names library frames
+	// by nothing but their module.
+	Rootfs Libraries
+	GDB    GDB
+}
+
+// Libraries is where a firmware build's root filesystem is unpacked.
+type Libraries interface {
+	Dir(ctx context.Context, build, platform string) (string, error)
+}
+
+// Firmware is what meta.json says the camera ran: the build and its platform.
+type Firmware struct {
+	Build    string
+	Platform string
+}
+
+// Result is a dump's backtrace, innermost first, and what made it.
+type Result struct {
+	Frames  []crashes.Frame
+	Sources map[string]any
+}
+
+// maxProbable is how many callers the scan adds past where gdb stopped.
+const maxProbable = 12
+
+// outermost are the frames a thread's stack ends in: past them there is
+// nothing to look for.
+var outermost = map[string]bool{
+	"main": true, "_start": true, "_start_c": true, "__libc_start_main": true, "libc_start_main_stage2": true,
+	"start_thread": true, "__clone": true, "clone": true, "thread_start": true,
+}
+
+// Symbolize unwinds a dump. ErrNotPublished means majestic's build is not
+// one CI published (yet); anything else may be worth trying again. A
+// firmware build that cannot be had right now is worth waiting for, unless
+// lastTry says this is the last try: then the backtrace is made without its
+// libraries rather than not at all.
+func (s *Symbolizer) Symbolize(ctx context.Context, raw []byte, fw Firmware, lastTry bool) (*Result, error) {
+	d, err := crashes.ReadDump(raw)
+	if err != nil {
+		return nil, err
+	}
+	main, ok := d.Main()
+	if !ok || main.BuildID == "" {
+		return nil, fmt.Errorf("%w: the dump names no build-id for majestic", ErrNotPublished)
+	}
+	sources := map[string]any{"build_id": main.BuildID}
+	exe, err := s.Symbols.Get(ctx, main.BuildID)
+	if err != nil {
+		return nil, err
+	}
+
+	// The libraries the camera ran, from its firmware build's rootfs.
+	libs := map[string]string{}
+	if s.Rootfs != nil && fw.Build != "" {
+		root, err := s.Rootfs.Dir(ctx, fw.Build, fw.Platform)
+		switch {
+		case err != nil && !errors.Is(err, ErrNoBuild) && !lastTry:
+			return nil, fmt.Errorf("the firmware's libraries: %w", err)
+		case err != nil:
+			sources["libraries_error"] = err.Error()
+		default:
+			sources["firmware"] = fw.Build + "/" + fw.Platform
+			var found []string
+			for _, m := range d.Modules[1:] {
+				if p := Library(root, m.Path); p != "" && sameBuild(p, m.BuildID) {
+					libs[m.Path] = p
+					found = append(found, crashes.ModuleName(m.Path))
+				}
+			}
+			sort.Strings(found)
+			sources["libraries"] = found
+		}
+	}
+
+	code, err := CodeOf(exe, main.Bias)
+	if err != nil {
+		return nil, fmt.Errorf("majestic's executable: %w", err)
+	}
+	for _, m := range d.Modules[1:] {
+		if p := libs[m.Path]; p != "" {
+			if segs, err := CodeOf(p, m.Bias); err == nil {
+				code = append(code, segs...)
+			}
+		}
+	}
+	core, err := Core(d, code)
+	if err != nil {
+		return nil, err
+	}
+	dir, err := os.MkdirTemp("", "crash-core-")
+	if err != nil {
+		return nil, err
+	}
+	defer os.RemoveAll(dir)
+	corePath := filepath.Join(dir, "core")
+	if err := os.WriteFile(corePath, core, 0o600); err != nil {
+		return nil, err
+	}
+	sess := Session{Executable: exe, DebugDir: s.Symbols.DebugDir(), Core: corePath}
+
+	raws, stop, err := s.GDB.Unwind(ctx, sess)
+	if err != nil {
+		return nil, err
+	}
+	raws = clean(d, raws)
+	if len(raws) == 0 {
+		return nil, errors.New("gdb unwound no frame")
+	}
+	if stop != "" {
+		sources["gdb_stopped"] = stop
+	}
+	names := &namer{d: d, main: main, libs: libs}
+	var frames []crashes.Frame
+	for i, r := range raws {
+		// A caller's address is where its call returns to, which for a call
+		// that ends a function is the next one's first instruction.
+		at := r.PC
+		if i > 0 && !r.Inline {
+			at--
+		}
+		frames = append(frames, names.frame(at, r.Fn, r.File, r.Line, false))
+	}
+
+	// Past where gdb stopped, the probable callers.
+	last := raws[len(raws)-1]
+	if !outermost[last.Fn] {
+		from := last.SP
+		if from == 0 {
+			from = d.StackAt
+		}
+		cands := Scan(d, from, Memory(code))
+		var inMain []uint64
+		for _, c := range cands {
+			if mod, _, ok := d.ModuleAt(c.Call); ok && mod.Path == main.Path {
+				inMain = append(inMain, c.Call)
+			}
+		}
+		resolved := map[uint64]Where{}
+		if ws, err := s.GDB.Resolve(ctx, sess, inMain); err == nil {
+			for _, w := range ws {
+				resolved[w.PC] = w
+			}
+		} else {
+			sources["resolve_error"] = err.Error()
+		}
+		n := 0
+		for _, c := range cands {
+			if n == maxProbable {
+				break
+			}
+			w := resolved[c.Call]
+			f := names.frame(c.Call, w.Fn, w.File, w.Line, true)
+			frames = append(frames, f)
+			n++
+			if outermost[f.Fn] {
+				break
+			}
+		}
+		sources["scanned"] = n
+	}
+	return &Result{Frames: frames, Sources: sources}, nil
+}
+
+// clean drops what gdb reports that is not a frame: an address outside any
+// code (the x86_64 unwinder's guess past a frame without unwind tables), and
+// a frame repeated (ARM's unwinder reports the caller once from the link
+// register, then again from the unwind tables).
+func clean(d *crashes.Dump, in []RawFrame) []RawFrame {
+	var out []RawFrame
+	for i, r := range in {
+		if i > 0 {
+			if _, _, ok := d.ModuleAt(r.PC); !ok {
+				continue
+			}
+		}
+		if n := len(out); n > 0 && out[n-1].PC == r.PC && out[n-1].Fn == r.Fn && !r.Inline {
+			continue
+		}
+		out = append(out, r)
+	}
+	return out
+}
+
+// sameBuild says whether a library in the rootfs is the one the camera
+// loaded, when the camera's has a build-id to say so.
+func sameBuild(path, id string) bool {
+	if id == "" {
+		return true
+	}
+	f, err := elf.Open(path)
+	if err != nil {
+		return false
+	}
+	defer f.Close()
+	return buildID(f) == id
+}
+
+func buildID(f *elf.File) string {
+	for _, p := range f.Progs {
+		if p.Type != elf.PT_NOTE {
+			continue
+		}
+		b := make([]byte, p.Filesz)
+		if _, err := p.ReadAt(b, 0); err != nil {
+			continue
+		}
+		o := f.ByteOrder
+		for len(b) >= 12 {
+			nsz, dsz, typ := o.Uint32(b), o.Uint32(b[4:]), o.Uint32(b[8:])
+			name := 12 + (nsz+3)&^3
+			end := name + (dsz+3)&^3
+			if uint32(len(b)) < end {
+				break
+			}
+			if typ == 3 && nsz == 4 && string(b[12:15]) == "GNU" {
+				return fmt.Sprintf("%x", b[name:name+dsz])
+			}
+			b = b[end:]
+		}
+	}
+	return ""
+}
+
+// namer names frames: majestic's from its debuginfo, a library's from its
+// symbols (the dynamic ones, on a camera), anything else by its module.
+type namer struct {
+	d    *crashes.Dump
+	main crashes.Module
+	libs map[string]string
+	syms map[string][]elf.Symbol
+}
+
+func (n *namer) frame(pc uint64, fn, file string, line int, probable bool) crashes.Frame {
+	mod, off, ok := n.d.ModuleAt(pc)
+	if !ok {
+		return crashes.Frame{Fn: "?", Probable: probable}
+	}
+	if mod.Path == n.main.Path {
+		if fn == "" {
+			fn = "?"
+		}
+		return crashes.Frame{Fn: fn, File: sourcePath(file), Line: line, Probable: probable}
+	}
+	f := crashes.Frame{Fn: "?", Module: crashes.ModuleName(mod.Path), Probable: probable}
+	if p := n.libs[mod.Path]; p != "" {
+		if name := n.symbol(p, off); name != "" {
+			f.Fn = name
+		}
+	}
+	return f
+}
+
+// symbol is the function of a library that holds off, by its size: a static
+// function has no dynamic symbol, and the export before it is not its name.
+func (n *namer) symbol(path string, off uint64) string {
+	if n.syms == nil {
+		n.syms = map[string][]elf.Symbol{}
+	}
+	list, ok := n.syms[path]
+	if !ok {
+		if f, err := elf.Open(path); err == nil {
+			list, _ = f.Symbols()
+			dyn, _ := f.DynamicSymbols()
+			list = append(list, dyn...)
+			f.Close()
+		}
+		n.syms[path] = list
+	}
+	for _, s := range list {
+		if elf.ST_TYPE(s.Info) != elf.STT_FUNC || s.Size == 0 {
+			continue
+		}
+		start := s.Value &^ 1 // a Thumb function's address has bit 0 set
+		if off >= start && off < start+s.Size {
+			return s.Name
+		}
+	}
+	return ""
+}
+
+// sourcePath is a source file as majestic's tree names it: the build
+// machine's directories dropped.
+func sourcePath(p string) string {
+	if p == "" {
+		return ""
+	}
+	p = filepath.ToSlash(filepath.Clean(p))
+	cut := -1
+	for _, root := range []string{"/src/", "/include/", "/thirdparty/"} {
+		if i := strings.Index(p, root); i >= 0 && (cut < 0 || i < cut) {
+			cut = i
+		}
+	}
+	if cut >= 0 {
+		return p[cut+1:]
+	}
+	return strings.TrimPrefix(p, "./")
+}
diff --git a/service/internal/crashes/symbolize/symbolize_test.go b/service/internal/crashes/symbolize/symbolize_test.go
new file mode 100644
index 00000000..bc116bf3
--- /dev/null
+++ b/service/internal/crashes/symbolize/symbolize_test.go
@@ -0,0 +1,411 @@
+package symbolize
+
+import (
+	"context"
+	"debug/elf"
+	"fmt"
+	"os"
+	"os/exec"
+	"path/filepath"
+	"strings"
+	"testing"
+
+	"github.com/OpenIPC/website/service/internal/crashes"
+)
+
+// The fixtures are a stand-in for majestic (../testdata/dump/toy.c) that
+// faulted on real hardware -- a gk7205v300 for arm, a PC for x86_64 -- and
+// wrote the dump majestic writes: in its own code (own), inside a library
+// with no unwind tables (lib), inside the C library (libc).
+const fixtures = "../testdata/dump"
+
+func fixture(t *testing.T, name string) []byte {
+	t.Helper()
+	b, err := os.ReadFile(filepath.Join(fixtures, name))
+	if err != nil {
+		t.Fatal(err)
+	}
+	return b
+}
+
+// needGDB skips without gdb-multiarch, as the keyframe tests do without
+// ffmpeg -- but fails in CI, where a symbolizer test that skipped would prove
+// nothing.
+func needGDB(t *testing.T) {
+	t.Helper()
+	if _, err := exec.LookPath("gdb-multiarch"); err != nil {
+		if os.Getenv("CI") != "" {
+			t.Fatal("gdb-multiarch is not installed, and CI is set")
+		}
+		t.Skip("gdb-multiarch is not installed")
+	}
+}
+
+// published lays the toy's executable and debuginfo out as Symbols keeps
+// what CI publishes, under the build-id the dump names.
+func published(t *testing.T, arch string, raw []byte) *Symbols {
+	t.Helper()
+	d, err := crashes.ReadDump(raw)
+	if err != nil {
+		t.Fatal(err)
+	}
+	main, _ := d.Main()
+	root := t.TempDir()
+	s := &Symbols{Root: root, Base: "http://127.0.0.1:1/never"}
+	copyFile(t, filepath.Join(fixtures, arch, "toy"), filepath.Join(root, "buildid", main.BuildID, "executable"))
+	copyFile(t, filepath.Join(fixtures, arch, "toy.debug"),
+		filepath.Join(s.DebugDir(), ".build-id", main.BuildID[:2], main.BuildID[2:]+".debug"))
+	return s
+}
+
+func copyFile(t *testing.T, from, to string) {
+	t.Helper()
+	b, err := os.ReadFile(from)
+	if err != nil {
+		t.Fatal(err)
+	}
+	if err := os.MkdirAll(filepath.Dir(to), 0o755); err != nil {
+		t.Fatal(err)
+	}
+	if err := os.WriteFile(to, b, 0o644); err != nil {
+		t.Fatal(err)
+	}
+}
+
+// rootfs is a firmware image holding the toy's library where the camera had
+// it, as Rootfs unpacks one.
+type rootfs string
+
+func (r rootfs) Dir(context.Context, string, string) (string, error) { return string(r), nil }
+
+func withLibrary(t *testing.T, arch string) rootfs {
+	t.Helper()
+	root := t.TempDir()
+	copyFile(t, filepath.Join(fixtures, arch, "libtoy.so"), filepath.Join(root, "tmp", "toy", "libtoy.so"))
+	return rootfs(root)
+}
+
+// at is "toy.c:<n>" for the line of toy.c that holds text: the fixtures'
+// lines, found by what they say.
+func at(t *testing.T, text string) string {
+	t.Helper()
+	b, err := os.ReadFile(filepath.Join(fixtures, "toy.c"))
+	if err != nil {
+		t.Fatal(err)
+	}
+	for i, l := range strings.Split(string(b), "\n") {
+		if strings.Contains(l, text) {
+			return fmt.Sprintf("toy.c:%d", i+1)
+		}
+	}
+	t.Fatalf("toy.c has no line with %q", text)
+	return ""
+}
+
+func describe(frames []crashes.Frame) string {
+	var b strings.Builder
+	for _, f := range frames {
+		s := f.String()
+		if f.File != "" {
+			s += fmt.Sprintf(" %s:%d", f.File, f.Line)
+		}
+		if f.Probable {
+			s += " (probable)"
+		}
+		b.WriteString(s + "\n")
+	}
+	return b.String()
+}
+
+func TestSymbolizeUnwindsTheFaultThroughMajesticsOwnFrames(t *testing.T) {
+	needGDB(t)
+	for _, arch := range []string{"arm", "x86_64"} {
+		t.Run(arch, func(t *testing.T) {
+			raw := fixture(t, arch+"-own.dump")
+			s := &Symbolizer{Symbols: published(t, arch, raw)}
+			res, err := s.Symbolize(context.Background(), raw, Firmware{}, false)
+			if err != nil {
+				t.Fatal(err)
+			}
+			got := describe(res.Frames)
+			// The faulting store, at its line; then its callers, each at the
+			// line of its call -- unwound from .debug_frame, nothing guessed.
+			want := []string{"store " + at(t, "{ *p = v; }"), "parse_level " + at(t, "store(slot,"),
+				"main " + at(t, "return parse_level(mode)")}
+			lines := strings.Split(strings.TrimSpace(got), "\n")
+			if len(lines) < len(want) {
+				t.Fatalf("frames:\n%s", got)
+			}
+			for i, w := range want {
+				if lines[i] != w {
+					t.Fatalf("frame %d is %q, want %q; frames:\n%s", i, lines[i], w, got)
+				}
+			}
+			// main is where a thread's stack ends: nothing is scanned past it.
+			if strings.Contains(got, "probable") {
+				t.Fatalf("scanned past main:\n%s", got)
+			}
+		})
+	}
+}
+
+func TestSymbolizeNamesALibraryFrameFromTheFirmwaresOwnLibrary(t *testing.T) {
+	needGDB(t)
+	for _, arch := range []string{"arm", "x86_64"} {
+		t.Run(arch, func(t *testing.T) {
+			raw := fixture(t, arch+"-lib.dump")
+			s := &Symbolizer{Symbols: published(t, arch, raw), Rootfs: withLibrary(t, arch)}
+			res, err := s.Symbolize(context.Background(), raw, Firmware{Build: "nightly-20261009-0000000", Platform: "toy_lite"}, false)
+			if err != nil {
+				t.Fatal(err)
+			}
+			got := describe(res.Frames)
+			// libtoy.so is stripped and has no unwind tables: its frame is
+			// named by its dynamic symbol, and majestic's caller is still
+			// found under it.
+			if !strings.HasPrefix(got, "toy_lib_fault [libtoy.so]\nthrough_library "+at(t, "return toy_lib_fault(")+"\n") {
+				t.Fatalf("frames:\n%s", got)
+			}
+			if libs, _ := res.Sources["libraries"].([]string); len(libs) != 1 || libs[0] != "libtoy.so" {
+				t.Fatalf("libraries used: %v", res.Sources["libraries"])
+			}
+		})
+	}
+}
+
+func TestSymbolizeWithoutTheLibraryNamesItsModule(t *testing.T) {
+	needGDB(t)
+	raw := fixture(t, "arm-libc.dump")
+	s := &Symbolizer{Symbols: published(t, "arm", raw)}
+	res, err := s.Symbolize(context.Background(), raw, Firmware{}, false)
+	if err != nil {
+		t.Fatal(err)
+	}
+	got := describe(res.Frames)
+	// strlen(NULL) inside the C library, which the test does not have: the
+	// camera maps musl's loader as /lib/libc.so.
+	if !strings.HasPrefix(got, "? [libc.so]\nname_length "+at(t, "return (int)strlen(name)")+"\n") {
+		t.Fatalf("frames:\n%s", got)
+	}
+}
+
+func TestSymbolizeWithoutPublishedSymbolsWaits(t *testing.T) {
+	raw := fixture(t, "arm-own.dump")
+	s := &Symbolizer{Symbols: &Symbols{Root: t.TempDir(), Base: "http://127.0.0.1:1"}}
+	if _, err := s.Symbolize(context.Background(), raw, Firmware{}, false); err == nil {
+		t.Fatal("symbolized without the executable")
+	}
+}
+
+func TestScanFindsTheCallersOnTheStack(t *testing.T) {
+	// From the fault's stack pointer, before any unwinding: the return
+	// addresses into parse_level and main are on the stack, each after a
+	// call instruction in the toy's own code.
+	for _, arch := range []string{"arm", "x86_64"} {
+		t.Run(arch, func(t *testing.T) {
+			d, err := crashes.ReadDump(fixture(t, arch+"-own.dump"))
+			if err != nil {
+				t.Fatal(err)
+			}
+			main, _ := d.Main()
+			code, err := CodeOf(filepath.Join(fixtures, arch, "toy"), main.Bias)
+			if err != nil {
+				t.Fatal(err)
+			}
+			cands := Scan(d, d.StackAt, code)
+			syms := symbolsOf(t, filepath.Join(fixtures, arch, "toy.debug"))
+			var names []string
+			for _, c := range cands {
+				names = append(names, syms(c.Call-main.Bias))
+			}
+			joined := strings.Join(names, " ")
+			if !strings.Contains(joined, "parse_level") || !strings.Contains(joined, "main") {
+				t.Fatalf("scan found %v", names)
+			}
+		})
+	}
+}
+
+func symbolsOf(t *testing.T, path string) func(uint64) string {
+	t.Helper()
+	f, err := elf.Open(path)
+	if err != nil {
+		t.Fatal(err)
+	}
+	defer f.Close()
+	list, _ := f.Symbols()
+	return func(off uint64) string {
+		for _, s := range list {
+			start := s.Value &^ 1
+			if elf.ST_TYPE(s.Info) == elf.STT_FUNC && off >= start && off < start+s.Size {
+				return s.Name
+			}
+		}
+		return "?"
+	}
+}
+
+func TestScanSkipsWordsThatFollowNoCall(t *testing.T) {
+	d, err := crashes.ReadDump(fixture(t, "arm-own.dump"))
+	if err != nil {
+		t.Fatal(err)
+	}
+	main, _ := d.Main()
+	code, err := CodeOf(filepath.Join(fixtures, "arm", "toy"), main.Bias)
+	if err != nil {
+		t.Fatal(err)
+	}
+	real := Scan(d, d.StackAt, code)
+	if len(real) == 0 {
+		t.Fatal("no return address on the fixture's stack")
+	}
+	// A pointer to a function -- its first instruction, Thumb bit set, as a
+	// callback on the stack is -- looks like code and follows no call; the
+	// return address beside it does.
+	f, err := elf.Open(filepath.Join(fixtures, "arm", "toy.debug"))
+	if err != nil {
+		t.Fatal(err)
+	}
+	defer f.Close()
+	syms, _ := f.Symbols()
+	var fn uint64
+	for _, s := range syms {
+		if s.Name == "parse_level" {
+			fn = main.Bias + s.Value
+		}
+	}
+	ret := real[0].Call + 2 + 1
+	stack := make([]byte, 8)
+	d.Order().PutUint32(stack, uint32(fn|1))
+	d.Order().PutUint32(stack[4:], uint32(ret))
+	d.Stack = stack
+	got := Scan(d, d.StackAt, code)
+	if len(got) != 1 || got[0].Call != real[0].Call || got[0].Slot != d.StackAt+4 {
+		t.Fatalf("scan of [function pointer, return address] found %+v", got)
+	}
+}
+
+func TestCoreCarriesTheRegistersAndTheStack(t *testing.T) {
+	for _, arch := range []string{"arm", "x86_64"} {
+		t.Run(arch, func(t *testing.T) {
+			d, err := crashes.ReadDump(fixture(t, arch+"-own.dump"))
+			if err != nil {
+				t.Fatal(err)
+			}
+			b, err := Core(d, nil)
+			if err != nil {
+				t.Fatal(err)
+			}
+			path := filepath.Join(t.TempDir(), "core")
+			if err := os.WriteFile(path, b, 0o600); err != nil {
+				t.Fatal(err)
+			}
+			f, err := elf.Open(path)
+			if err != nil {
+				t.Fatal(err)
+			}
+			defer f.Close()
+			if f.Type != elf.ET_CORE {
+				t.Fatalf("type %v", f.Type)
+			}
+			var stack *elf.Prog
+			for _, p := range f.Progs {
+				if p.Type == elf.PT_LOAD && p.Vaddr == d.StackAt {
+					stack = p
+				}
+			}
+			if stack == nil || stack.Filesz != uint64(len(d.Stack)) {
+				t.Fatalf("no stack segment at %#x", d.StackAt)
+			}
+		})
+	}
+}
+
+func TestLibraryStaysInsideTheImage(t *testing.T) {
+	root := t.TempDir()
+	copyFile(t, filepath.Join(fixtures, "arm", "libtoy.so"), filepath.Join(root, "lib", "ld-musl-arm.so.1"))
+	// musl's libc.so is an absolute link to the loader: inside the image.
+	if err := os.Symlink("/lib/ld-musl-arm.so.1", filepath.Join(root, "lib", "libc.so")); err != nil {
+		t.Fatal(err)
+	}
+	if err := os.MkdirAll(filepath.Join(root, "usr"), 0o755); err != nil {
+		t.Fatal(err)
+	}
+	// A link that would leave it, by an absolute path or by climbing.
+	if err := os.Symlink("/etc", filepath.Join(root, "usr", "etc")); err != nil {
+		t.Fatal(err)
+	}
+	if err := os.Symlink("../../../../../../etc/hostname", filepath.Join(root, "lib", "up.so")); err != nil {
+		t.Fatal(err)
+	}
+	want := filepath.Join(root, "lib", "ld-musl-arm.so.1")
+	if got := Library(root, "/lib/libc.so"); got != want {
+		t.Fatalf("libc.so is %q, want %q", got, want)
+	}
+	for _, p := range []string{"/usr/etc/hostname", "/lib/up.so", "/../../etc/hostname", "lib/libc.so", "/lib/none.so"} {
+		if got := Library(root, p); got != "" {
+			t.Fatalf("%s resolved to %q", p, got)
+		}
+	}
+}
+
+func TestSourcePathDropsTheBuildMachinesDirectories(t *testing.T) {
+	for in, want := range map[string]string{
+		"/home/runner/work/toy/toy/src/a/x.c":  "src/a/x.c",
+		"/build/toy/thirdparty/lib/src/y.c":    "thirdparty/lib/src/y.c",
+		"./toy.c":                              "toy.c",
+		"toy.c":                                "toy.c",
+		"/opt/r/_work/toy/toy/include/toy/z.h": "include/toy/z.h",
+	} {
+		if got := sourcePath(in); got != want {
+			t.Errorf("sourcePath(%q) = %q, want %q", in, got, want)
+		}
+	}
+}
+
+func TestScanIgnoresAStartOffTheStack(t *testing.T) {
+	d, err := crashes.ReadDump(fixture(t, "x86_64-own.dump"))
+	if err != nil {
+		t.Fatal(err)
+	}
+	for _, from := range []uint64{d.StackAt + uint64(len(d.Stack)), d.StackAt + 1<<63 + 8, ^uint64(0)} {
+		if got := Scan(d, from, nil); got != nil {
+			t.Fatalf("from %#x: %v", from, got)
+		}
+	}
+}
+
+// failing is a firmware build that cannot be had right now.
+type failing struct{}
+
+func (failing) Dir(context.Context, string, string) (string, error) {
+	return "", fmt.Errorf("release asset unavailable: github.com answered 502")
+}
+
+func TestAFirmwareBuildThatCannotBeHadIsWaitedFor(t *testing.T) {
+	needGDB(t)
+	raw := fixture(t, "arm-lib.dump")
+	s := &Symbolizer{Symbols: published(t, "arm", raw), Rootfs: failing{}}
+	fw := Firmware{Build: "nightly-20261009-0000000", Platform: "toy_lite"}
+	if _, err := s.Symbolize(context.Background(), raw, fw, false); err == nil {
+		t.Fatal("symbolized without the libraries it could have later")
+	}
+	// The last try keeps what it can make.
+	res, err := s.Symbolize(context.Background(), raw, fw, true)
+	if err != nil || res.Sources["libraries_error"] == nil {
+		t.Fatalf("%v %v", err, res)
+	}
+}
+
+func TestRootfsNameIsTheImage(t *testing.T) {
+	for name, want := range map[string]bool{
+		"rootfs.squashfs":                   true,
+		"rootfs.squashfs.gk7205v300":        true,
+		"rootfs.squashfs.gk7205v300.md5sum": false,
+		"rootfs.ubi.gk7205v300":             false,
+	} {
+		if rootfsName.MatchString(name) != want {
+			t.Errorf("%s: %v", name, !want)
+		}
+	}
+}
diff --git a/service/internal/crashes/symbolize/worker.go b/service/internal/crashes/symbolize/worker.go
new file mode 100644
index 00000000..f725f601
--- /dev/null
+++ b/service/internal/crashes/symbolize/worker.go
@@ -0,0 +1,180 @@
+package symbolize
+
+import (
+	"context"
+	"encoding/json"
+	"errors"
+	"fmt"
+	"log/slog"
+	"time"
+
+	"github.com/jackc/pgx/v5/pgxpool"
+
+	"github.com/OpenIPC/website/service/internal/crashes"
+)
+
+// Worker symbolizes the dumps that wait, one at a time: woken by an upload's
+// NOTIFY, and every few minutes for the ones waiting to be tried again.
+type Worker struct {
+	Pool       *pgxpool.Pool
+	Log        *slog.Logger
+	Symbolizer *Symbolizer
+	Now        func() time.Time
+	// Every is how often it looks without being woken.
+	Every time.Duration
+	// KeepFor is how long symbols and rootfs images nothing has used stay.
+	KeepFor time.Duration
+}
+
+func (w *Worker) now() time.Time {
+	if w.Now != nil {
+		return w.Now()
+	}
+	return time.Now()
+}
+
+// Run works until ctx ends.
+func (w *Worker) Run(ctx context.Context) {
+	every := w.Every
+	if every == 0 {
+		every = 10 * time.Minute
+	}
+	wake := make(chan struct{}, 1)
+	go w.listen(ctx, wake)
+	t := time.NewTicker(every)
+	defer t.Stop()
+	swept := time.Time{}
+	for {
+		w.Drain(ctx)
+		if keep := w.KeepFor; keep > 0 && time.Since(swept) > 24*time.Hour {
+			if n := Sweep(w.Symbolizer.Symbols.Root, keep); n > 0 {
+				w.Log.Info("crashes: swept unused symbols", "removed", n)
+			}
+			swept = time.Now()
+		}
+		select {
+		case <-ctx.Done():
+			return
+		case <-wake:
+		case <-t.C:
+		}
+	}
+}
+
+func (w *Worker) listen(ctx context.Context, wake chan<- struct{}) {
+	backoff := time.Second
+	for ctx.Err() == nil {
+		err := func() error {
+			conn, err := w.Pool.Acquire(ctx)
+			if err != nil {
+				return err
+			}
+			defer conn.Release()
+			if _, err := conn.Exec(ctx, "LISTEN "+crashes.SymbolizeChannel); err != nil {
+				return err
+			}
+			backoff = time.Second
+			for {
+				if _, err := conn.Conn().WaitForNotification(ctx); err != nil {
+					return err
+				}
+				select {
+				case wake <- struct{}{}:
+				default:
+				}
+			}
+		}()
+		if ctx.Err() != nil {
+			return
+		}
+		w.Log.Warn("crashes: symbolize notifications lost, reconnecting", "err", err, "in", backoff)
+		select {
+		case <-ctx.Done():
+			return
+		case <-time.After(backoff):
+		}
+		backoff = min(backoff*2, time.Minute)
+		// What arrived while it was down is found by the next drain.
+		select {
+		case wake <- struct{}{}:
+		default:
+		}
+	}
+}
+
+// Drain symbolizes every dump whose turn it is.
+func (w *Worker) Drain(ctx context.Context) {
+	st := &crashes.Store{DB: w.Pool}
+	for ctx.Err() == nil {
+		due, err := st.DueDumps(ctx, w.now(), 8)
+		if err != nil {
+			w.Log.Error("crashes: dumps to symbolize", "err", err)
+			return
+		}
+		if len(due) == 0 {
+			return
+		}
+		for _, d := range due {
+			// What cannot be stored is left for the next tick, not tried
+			// again at once: the same dump would only fail the same way.
+			if !w.one(ctx, st, d) {
+				return
+			}
+		}
+	}
+}
+
+// symbolize runs the symbolizer, a panic in it -- the dumps come from
+// anyone -- being one more failure of that dump's.
+func (w *Worker) symbolize(ctx context.Context, d crashes.Due) (res *Result, err error) {
+	defer func() {
+		if p := recover(); p != nil {
+			res, err = nil, fmt.Errorf("symbolizer panicked: %v", p)
+		}
+	}()
+	return w.Symbolizer.Symbolize(ctx, d.Dump, firmwareOf(d.Meta), crashes.LastTry(d.Attempts))
+}
+
+// one symbolizes a dump, and says whether what came of it was stored.
+func (w *Worker) one(ctx context.Context, st *crashes.Store, d crashes.Due) bool {
+	res, err := w.symbolize(ctx, d)
+	if err == nil {
+		sig, serr := st.Symbolized(ctx, d.EventID, res.Frames, res.Sources, w.now())
+		if serr == nil {
+			w.Log.Info("crashes: symbolized", "id", d.EventID, "signature", sig, "frames", len(res.Frames))
+			return true
+		}
+		w.Log.Error("crashes: symbolized, not stored", "id", d.EventID, "err", serr)
+		// Counted as a failed try, so a backtrace that cannot be stored is
+		// given up on like any other.
+		err = serr
+	}
+	if ctx.Err() != nil {
+		return false
+	}
+	gaveUp, ferr := st.SymbolizeFailed(ctx, d.EventID, err.Error(), w.now())
+	if ferr != nil {
+		w.Log.Error("crashes: symbolize failure not stored", "id", d.EventID, "err", ferr)
+		return false
+	}
+	level := slog.LevelWarn
+	if errors.Is(err, ErrNotPublished) {
+		level = slog.LevelInfo
+	}
+	w.Log.Log(ctx, level, "crashes: not symbolized", "id", d.EventID, "attempt", d.Attempts+1, "gave_up", gaveUp, "err", err)
+	return true
+}
+
+// firmwareOf is the build meta.json names.
+func firmwareOf(meta json.RawMessage) Firmware {
+	var m struct {
+		Firmware struct {
+			BuildID  string `json:"build_id"`
+			Platform string `json:"platform"`
+		} `json:"firmware"`
+	}
+	if len(meta) == 0 || json.Unmarshal(meta, &m) != nil {
+		return Firmware{}
+	}
+	return Firmware{Build: m.Firmware.BuildID, Platform: m.Firmware.Platform}
+}
diff --git a/service/internal/crashes/symbolized.go b/service/internal/crashes/symbolized.go
new file mode 100644
index 00000000..0f5e9f1f
--- /dev/null
+++ b/service/internal/crashes/symbolized.go
@@ -0,0 +1,314 @@
+package crashes
+
+import (
+	"context"
+	"encoding/json"
+	"errors"
+	"fmt"
+	"strings"
+	"time"
+
+	"github.com/jackc/pgx/v5"
+)
+
+// majestic's crashes wait for the symbolizer (the symbolize package, in the
+// firmware role): a crash arrives filed under the module and offset of the
+// faulting instruction, and once its dump is unwound it is filed under its
+// backtrace, and the dump -- a slice of majestic's memory -- is deleted.
+
+// SymbolizeChannel is what an upload NOTIFYs to wake the symbolizer.
+const SymbolizeChannel = "crash_symbolize"
+
+// Due is a dump waiting to be symbolized.
+type Due struct {
+	EventID  string
+	Dump     []byte
+	Meta     json.RawMessage
+	Attempts int
+	Received time.Time
+}
+
+// DueDumps is the dumps whose turn it is, oldest first.
+func (s *Store) DueDumps(ctx context.Context, now time.Time, limit int) ([]Due, error) {
+	rows, err := s.DB.Query(ctx, `
+		SELECT d.event_id, d.bytes, e.meta, y.attempts, d.received_at
+		FROM crash_symbolizations y
+		JOIN crash_dumps d ON d.event_id = y.event_id
+		JOIN crash_events e ON e.id = y.event_id
+		WHERE y.status = 'pending' AND (y.next_try IS NULL OR y.next_try <= $1)
+		ORDER BY y.next_try NULLS FIRST, d.received_at LIMIT $2`, now, limit)
+	if err != nil {
+		return nil, err
+	}
+	return pgx.CollectRows(rows, func(r pgx.CollectableRow) (Due, error) {
+		var d Due
+		var meta []byte
+		err := r.Scan(&d.EventID, &d.Dump, &meta, &d.Attempts, &d.Received)
+		if len(meta) > 0 {
+			d.Meta = meta
+		}
+		return d, err
+	})
+}
+
+// Glue in a majestic crash: the C library's frames every abort and every
+// thread has, which say how it ended, never what went wrong.
+var userGlue = map[string]bool{
+	"raise": true, "abort": true, "__assert_fail": true, "__assert_fail_base": true, "a_crash": true,
+	"pthread_kill": true, "__pthread_kill_implementation": true, "__pthread_kill_internal": true,
+	"gsignal": true, "__restore_rt": true, "__restore": true, "__libc_start_main": true,
+	"libc_start_main_stage2": true, "__libc_start_call_main": true, "start_thread": true,
+	"__clone": true, "clone": true, "_start": true, "_start_c": true,
+}
+
+// userSigFrames are the frames a symbolized majestic crash's signature is
+// made of: the unwound ones with a name, glue left out; and when that leaves
+// fewer than two, the scan's probable callers after them.
+func userSigFrames(frames []Frame) []Frame {
+	var out []Frame
+	for _, f := range frames {
+		if f.Probable || f.Fn == "?" || userGlue[f.Fn] {
+			continue
+		}
+		out = append(out, f)
+	}
+	if len(out) < 2 {
+		for _, f := range frames {
+			if !f.Probable || f.Fn == "?" || userGlue[f.Fn] {
+				continue
+			}
+			out = append(out, f)
+			if len(out) == 3 {
+				break
+			}
+		}
+	}
+	if len(out) > sigFrames {
+		out = out[:sigFrames]
+	}
+	return out
+}
+
+// ownFrame says whether a signature's frames hold one of majestic's own:
+// without one -- a crash in a library function that every caller reaches,
+// or in nothing anyone could name -- the backtrace would file unrelated
+// crashes as one bug, and the module and offset it arrived under say more.
+func ownFrame(frames []Frame) bool {
+	for _, f := range frames {
+		if f.Module == "" {
+			return true
+		}
+	}
+	return false
+}
+
+// maxFrames is how many frames of a backtrace are kept.
+const maxFrames = 48
+
+// storable makes what came from gdb, a library's symbols or an error storable:
+// PostgreSQL takes neither a NUL nor invalid UTF-8, in text or in jsonb.
+func storable(s string) string {
+	return strings.ReplaceAll(strings.ToValidUTF8(s, "?"), "\x00", "")
+}
+
+func cleanAny(v any) any {
+	switch x := v.(type) {
+	case string:
+		return storable(x)
+	case []string:
+		out := make([]string, len(x))
+		for i, s := range x {
+			out[i] = storable(s)
+		}
+		return out
+	case map[string]any:
+		out := make(map[string]any, len(x))
+		for k, e := range x {
+			out[storable(k)] = cleanAny(e)
+		}
+		return out
+	}
+	return v
+}
+
+// Symbolized keeps the backtrace, deletes the dump, and files the event
+// under the signature its backtrace makes -- unless that would say less than
+// the provisional one (no frame of majestic's own), or a maintainer has found
+// the crash bogus already. The provisional signature it leaves is deleted
+// when nothing else is filed under it, or merged into the new one, with its
+// triage, when a decision or stars were booked under it meanwhile.
+func (s *Store) Symbolized(ctx context.Context, eventID string, frames []Frame, sources map[string]any, now time.Time) (string, error) {
+	if len(frames) > maxFrames {
+		frames = frames[:maxFrames]
+	}
+	for i := range frames {
+		frames[i].Fn, frames[i].Module, frames[i].File = storable(frames[i].Fn), storable(frames[i].Module), storable(frames[i].File)
+	}
+	src, _ := json.Marshal(cleanAny(map[string]any(sources)))
+	all, _ := json.Marshal(orEmpty(frames))
+	var sig string
+	err := pgx.BeginFunc(ctx, s.DB, func(tx pgx.Tx) error {
+		// The only change an event ever has: the crashes package refiling it.
+		if _, err := tx.Exec(ctx, `SET LOCAL openipc.crashes_guard = 'off'`); err != nil {
+			return err
+		}
+		var provisional string
+		var fatal []byte
+		err := tx.QueryRow(ctx, `SELECT e.signature_id, e.fatal FROM crash_events e
+			JOIN crash_symbolizations y ON y.event_id = e.id
+			WHERE e.id = $1 AND y.status = 'pending' FOR UPDATE OF e, y`, eventID).Scan(&provisional, &fatal)
+		if errors.Is(err, pgx.ErrNoRows) {
+			return fmt.Errorf("crash %s is not waiting to be symbolized", eventID)
+		}
+		if err != nil {
+			return err
+		}
+		// Events leaving one provisional signature, one at a time: the last
+		// to leave is the one that tidies it.
+		var status string
+		if err := tx.QueryRow(ctx, `SELECT root.status FROM crash_signatures p
+			JOIN crash_signatures root ON root.id = coalesce(p.merged_into, p.id)
+			WHERE p.id = $1 FOR UPDATE OF p`, provisional).Scan(&status); err != nil {
+			return err
+		}
+		var t Trace
+		if err := json.Unmarshal(fatal, &t); err != nil {
+			return err
+		}
+		t.Frames, t.Provisional, t.Build = frames, false, ""
+		sig = provisional
+		if status != "bogus" && ownFrame(userSigFrames(frames)) {
+			sig = t.Signature()
+		}
+		if sig != provisional {
+			title := t.Title()
+			trace, _ := json.Marshal(&t)
+			if _, err := tx.Exec(ctx, `
+				INSERT INTO crash_signatures (id, class, kind, title, frames, first_seen)
+				SELECT $1, 'user', $2, $3, $4, received_at FROM crash_events WHERE id = $5
+				ON CONFLICT (id) DO UPDATE SET first_seen = least(crash_signatures.first_seen, EXCLUDED.first_seen)`,
+				sig, KindSignal, title, all, eventID); err != nil {
+				return err
+			}
+			if _, err := tx.Exec(ctx, `UPDATE crash_events SET signature_id = $2, title = $3, fatal = $4 WHERE id = $1`,
+				eventID, sig, title, trace); err != nil {
+				return err
+			}
+			if err := leave(ctx, tx, provisional, sig); err != nil {
+				return err
+			}
+		}
+		if _, err := tx.Exec(ctx, `UPDATE crash_symbolizations SET status = 'done', frames = $2, sources = $3,
+			error = '', attempts = attempts + 1, next_try = NULL, at = $4 WHERE event_id = $1`,
+			eventID, all, src, now); err != nil {
+			return err
+		}
+		_, err = tx.Exec(ctx, `DELETE FROM crash_dumps WHERE event_id = $1`, eventID)
+		return err
+	})
+	return sig, err
+}
+
+// leave tidies the provisional signature an event was refiled from.
+func leave(ctx context.Context, tx pgx.Tx, provisional, sig string) error {
+	var events int
+	var booked bool
+	if err := tx.QueryRow(ctx, `SELECT
+			(SELECT count(*) FROM crash_events WHERE signature_id = $1)::int,
+			EXISTS (SELECT 1 FROM crash_triage WHERE signature_id = $1)
+			OR EXISTS (SELECT 1 FROM crash_stars WHERE signature_id = $1)
+			OR EXISTS (SELECT 1 FROM crash_signatures WHERE merged_into = $1)`, provisional).Scan(&events, &booked); err != nil {
+		return err
+	}
+	if events > 0 {
+		return nil
+	}
+	if !booked {
+		_, err := tx.Exec(ctx, `DELETE FROM crash_signatures WHERE id = $1`, provisional)
+		return err
+	}
+	// Stars paid under it stay held under the bug they were for, and what a
+	// maintainer decided about it goes with it to a bug nobody has decided
+	// about yet.
+	var root, rootStatus string
+	if err := tx.QueryRow(ctx, `SELECT r.id, r.status FROM crash_signatures s JOIN crash_signatures r ON r.id = coalesce(s.merged_into, s.id)
+		WHERE s.id = $1 FOR UPDATE OF r`, sig).Scan(&root, &rootStatus); err != nil {
+		return err
+	}
+	if root == provisional {
+		return nil
+	}
+	if rootStatus == "open" {
+		tag, err := tx.Exec(ctx, `UPDATE crash_signatures r SET status = p.status, fixed_in = p.fixed_in, issue_url = p.issue_url,
+				note = p.note, updated_at = now()
+			FROM crash_signatures p WHERE r.id = $2 AND p.id = $1 AND p.status <> 'open'`, provisional, root)
+		if err != nil {
+			return err
+		}
+		if tag.RowsAffected() > 0 {
+			if _, err := tx.Exec(ctx, `INSERT INTO crash_triage (signature_id, by_member, status, fixed_in, issue_url, merged_into, note)
+				SELECT id, 'symbolizer', status, fixed_in, issue_url, NULL, note FROM crash_signatures WHERE id = $1`, root); err != nil {
+				return err
+			}
+		}
+	}
+	if _, err := tx.Exec(ctx, `UPDATE crash_signatures SET merged_into = $2, updated_at = now() WHERE merged_into = $1`,
+		provisional, root); err != nil {
+		return err
+	}
+	_, err := tx.Exec(ctx, `UPDATE crash_signatures SET merged_into = $2, updated_at = now() WHERE id = $1`, provisional, root)
+	return err
+}
+
+// LastTry says whether a dump that has been tried attempts times is on its
+// last try: what can be made of it then is kept, whatever is missing.
+func LastTry(attempts int) bool { return attempts >= len(retryAfter) }
+
+// Tries: how often a dump is tried, and how long after each failure.
+var retryAfter = []time.Duration{
+	5 * time.Minute, 30 * time.Minute, 2 * time.Hour, 6 * time.Hour, 24 * time.Hour, 24 * time.Hour, 48 * time.Hour,
+}
+
+// SymbolizeFailed records a try that did not work. A dump is tried again
+// later, until the tries run out; then it is given up on and deleted, and
+// the crash stays under its provisional signature.
+func (s *Store) SymbolizeFailed(ctx context.Context, eventID, reason string, now time.Time) (gaveUp bool, err error) {
+	if len(reason) > 2000 {
+		reason = reason[:2000]
+	}
+	reason = storable(reason)
+	err = pgx.BeginFunc(ctx, s.DB, func(tx pgx.Tx) error {
+		var attempts int
+		err := tx.QueryRow(ctx, `SELECT attempts FROM crash_symbolizations WHERE event_id = $1 AND status = 'pending' FOR UPDATE`,
+			eventID).Scan(&attempts)
+		if errors.Is(err, pgx.ErrNoRows) {
+			return nil
+		}
+		if err != nil {
+			return err
+		}
+		if attempts >= len(retryAfter) {
+			gaveUp = true
+			if _, err := tx.Exec(ctx, `UPDATE crash_symbolizations SET status = 'failed', attempts = attempts + 1,
+				error = $2, next_try = NULL, at = $3 WHERE event_id = $1`, eventID, reason, now); err != nil {
+				return err
+			}
+			_, err := tx.Exec(ctx, `DELETE FROM crash_dumps WHERE event_id = $1`, eventID)
+			return err
+		}
+		_, err = tx.Exec(ctx, `UPDATE crash_symbolizations SET attempts = attempts + 1, error = $2, next_try = $3, at = $4
+			WHERE event_id = $1`, eventID, reason, now.Add(retryAfter[attempts]), now)
+		return err
+	})
+	return gaveUp, err
+}
+
+// Symbolization is how a majestic crash was symbolized, for the maintainers.
+type Symbolization struct {
+	Status   string          `json:"status"`
+	Attempts int             `json:"attempts"`
+	Frames   []Frame         `json:"frames"`
+	Sources  json.RawMessage `json:"sources"`
+	Error    string          `json:"error,omitempty"`
+	At       time.Time       `json:"at"`
+}
diff --git a/service/internal/crashes/testdata/dump/arm-lib.dump b/service/internal/crashes/testdata/dump/arm-lib.dump
new file mode 100644
index 00000000..e964a093
Binary files /dev/null and b/service/internal/crashes/testdata/dump/arm-lib.dump differ
diff --git a/service/internal/crashes/testdata/dump/arm-libc.dump b/service/internal/crashes/testdata/dump/arm-libc.dump
new file mode 100644
index 00000000..653dbdc8
Binary files /dev/null and b/service/internal/crashes/testdata/dump/arm-libc.dump differ
diff --git a/service/internal/crashes/testdata/dump/arm-own.dump b/service/internal/crashes/testdata/dump/arm-own.dump
new file mode 100644
index 00000000..b8a10b8c
Binary files /dev/null and b/service/internal/crashes/testdata/dump/arm-own.dump differ
diff --git a/service/internal/crashes/testdata/dump/arm-sent.dump b/service/internal/crashes/testdata/dump/arm-sent.dump
new file mode 100644
index 00000000..1cad5df6
Binary files /dev/null and b/service/internal/crashes/testdata/dump/arm-sent.dump differ
diff --git a/service/internal/crashes/testdata/dump/arm/libtoy.so b/service/internal/crashes/testdata/dump/arm/libtoy.so
new file mode 100755
index 00000000..b6ef1ca8
Binary files /dev/null and b/service/internal/crashes/testdata/dump/arm/libtoy.so differ
diff --git a/service/internal/crashes/testdata/dump/arm/toy b/service/internal/crashes/testdata/dump/arm/toy
new file mode 100755
index 00000000..4b51c7bc
Binary files /dev/null and b/service/internal/crashes/testdata/dump/arm/toy differ
diff --git a/service/internal/crashes/testdata/dump/arm/toy.debug b/service/internal/crashes/testdata/dump/arm/toy.debug
new file mode 100755
index 00000000..f972a5c4
Binary files /dev/null and b/service/internal/crashes/testdata/dump/arm/toy.debug differ
diff --git a/service/internal/crashes/testdata/dump/gen.sh b/service/internal/crashes/testdata/dump/gen.sh
new file mode 100755
index 00000000..efd0c4c9
--- /dev/null
+++ b/service/internal/crashes/testdata/dump/gen.sh
@@ -0,0 +1,38 @@
+#!/bin/sh
+# How the fixtures in this directory were made. Not run by the tests: the
+# dumps are of real faults on real hardware, so they are committed.
+#
+#   gen.sh arm <toolchain prefix>   e.g. .../bin/arm-openipc-linux-musleabi-
+#   gen.sh x86_64
+#
+# Then, on the target, in an empty environment -- the stack slice reaches
+# the top of the stack, where the environment and argv are:
+#   cd /tmp/toy && env -i LD_LIBRARY_PATH=/tmp/toy ./toy <mode> /tmp/toy/<mode>
+# for each mode (own, lib, libc, sent), and keep each majestic.dump as
+# <arch>-<mode>.dump.
+set -eu
+arch=$1
+cc=${2:-}gcc
+objcopy=${2:-}objcopy
+strip=${2:-}strip
+# Paths in the debuginfo say nothing about where it was built.
+map="-fdebug-prefix-map=$(pwd)=."
+sysroot=$($cc -print-sysroot)
+[ -n "$sysroot" ] && map="$map -fdebug-prefix-map=$sysroot=/sysroot"
+case $arch in
+  arm) flags="-mthumb -Os $map" ;;
+  *) flags="-Os $map" ;;
+esac
+out=$arch
+mkdir -p "$out"
+# libtoy.so: no unwind tables, stripped -- a vendor library.
+$cc $flags -fPIC -shared -fno-asynchronous-unwind-tables -fno-unwind-tables \
+  -Wl,--build-id=none -o "$out/libtoy.so" libtoy.c
+$strip "$out/libtoy.so"
+# toy: a PIE with .debug_frame and DWARF lines in its debuginfo, none in the
+# executable -- majestic's release build.
+$cc $flags -g -fPIE -pie -fno-asynchronous-unwind-tables -fno-unwind-tables \
+  -Wl,--build-id=sha1 -o "$out/toy.full" toy.c -L"$out" -ltoy
+$objcopy --only-keep-debug "$out/toy.full" "$out/toy.debug"
+$strip -o "$out/toy" "$out/toy.full"
+rm "$out/toy.full"
diff --git a/service/internal/crashes/testdata/dump/libtoy.c b/service/internal/crashes/testdata/dump/libtoy.c
new file mode 100644
index 00000000..bb0b127a
--- /dev/null
+++ b/service/internal/crashes/testdata/dump/libtoy.c
@@ -0,0 +1,9 @@
+/* A vendor library's stand-in: built without unwind tables and stripped, so
+ * nothing but its dynamic symbols names a frame in it. */
+#include <string.h>
+
+int toy_lib_fault(const char *s) {
+    volatile const char *p = s;
+    int first = p[0];
+    return first + (int)strlen(s);
+}
diff --git a/service/internal/crashes/testdata/dump/toy.c b/service/internal/crashes/testdata/dump/toy.c
new file mode 100644
index 00000000..15e3e637
--- /dev/null
+++ b/service/internal/crashes/testdata/dump/toy.c
@@ -0,0 +1,208 @@
+/* A stand-in for majestic in the crashes package's tests: a PIE that dies of
+ * SIGSEGV and writes the dump majestic writes (MJCD, docs in ../../dump.go),
+ * so the symbolizer is tested against a real fault on a real camera without
+ * majestic's own binary. gen.sh builds it and says how the fixtures were made.
+ *
+ *   toy own     -- a NULL store in this program: frames gdb can unwind
+ *   toy lib     -- a NULL load inside libtoy.so, which has no unwind tables,
+ *                  like the vendor libraries a camera's majestic loads
+ *   toy libc    -- strlen(NULL): a fault inside the C library
+ *   toy sent    -- raise(SIGSEGV): a signal sent, not a fault */
+#define _GNU_SOURCE
+#include <elf.h>
+#include <fcntl.h>
+#include <link.h>
+#include <signal.h>
+#include <stdint.h>
+#include <stdio.h>
+#include <string.h>
+#include <sys/syscall.h>
+#include <ucontext.h>
+#include <unistd.h>
+
+int toy_lib_fault(const char *s); /* libtoy.so */
+
+#if defined(__arm__)
+#define ARCH 1
+#define SP(m) ((m)->arm_sp)
+#elif defined(__mips__) && defined(__MIPSEL__)
+#define ARCH 2
+#define SP(m) ((m)->gregs[29])
+#elif defined(__mips__)
+#define ARCH 3
+#define SP(m) ((m)->gregs[29])
+#elif defined(__x86_64__)
+#define ARCH 4
+#define SP(m) ((m)->gregs[REG_RSP])
+#elif defined(__aarch64__)
+#define ARCH 5
+#define SP(m) ((m)->sp)
+#endif
+
+static char dir[256] = ".";
+static char mods[4096];
+static size_t modslen;
+
+static int out = -1;
+
+static void put(const void *p, size_t n) {
+    if (write(out, p, n) < 0) {
+    }
+}
+
+static void section(const char *tag, const void *p, uint32_t n) {
+    put(tag, 4);
+    put(&n, 4);
+    put(p, n);
+}
+
+/* A file copied into a section: its length is patched in afterwards. */
+static void file_section(const char *tag, const char *path) {
+    char buf[1024];
+    uint32_t n = 0;
+    put(tag, 4);
+    off_t at = lseek(out, 0, SEEK_CUR);
+    put(&n, 4);
+    int fd = open(path, O_RDONLY);
+    ssize_t r;
+    while (fd >= 0 && (r = read(fd, buf, sizeof buf)) > 0) {
+        put(buf, r);
+        n += r;
+    }
+    if (fd >= 0)
+        close(fd);
+    off_t end = lseek(out, 0, SEEK_CUR);
+    lseek(out, at, SEEK_SET);
+    put(&n, 4);
+    lseek(out, end, SEEK_SET);
+}
+
+static int module(struct dl_phdr_info *info, size_t size, void *arg) {
+    (void)size;
+    (void)arg;
+    char id[41] = "-";
+    for (int i = 0; i < info->dlpi_phnum; i++) {
+        const ElfW(Phdr) *ph = &info->dlpi_phdr[i];
+        if (ph->p_type != PT_NOTE)
+            continue;
+        const uint8_t *p = (const uint8_t *)(info->dlpi_addr + ph->p_vaddr);
+        const uint8_t *end = p + ph->p_memsz;
+        while (p + 12 <= end) {
+            uint32_t nsz, dsz, type;
+            memcpy(&nsz, p, 4);
+            memcpy(&dsz, p + 4, 4);
+            memcpy(&type, p + 8, 4);
+            const uint8_t *desc = p + 12 + ((nsz + 3) & ~3u);
+            if (type == NT_GNU_BUILD_ID && nsz == 4 && !memcmp(p + 12, "GNU", 4) && dsz <= 20) {
+                for (uint32_t j = 0; j < dsz; j++)
+                    sprintf(id + 2 * j, "%02x", desc[j]);
+            }
+            p = desc + ((dsz + 3) & ~3u);
+        }
+    }
+    uintptr_t start = 0;
+    for (int i = 0; i < info->dlpi_phnum; i++)
+        if (info->dlpi_phdr[i].p_type == PT_LOAD) {
+            start = info->dlpi_addr + info->dlpi_phdr[i].p_vaddr;
+            break;
+        }
+    /* The first is the program (named "" by glibc, argv[0] by musl); a later
+     * one without a name is the vdso. */
+    static int seen;
+    const char *name = info->dlpi_name;
+    char self[256];
+    if (!seen++) {
+        ssize_t n = readlink("/proc/self/exe", self, sizeof self - 1);
+        self[n > 0 ? n : 0] = '\0';
+        name = self;
+    } else if (!name || !*name) {
+        name = "[vdso]";
+    }
+    modslen += snprintf(mods + modslen, sizeof mods - modslen, "%s 0x%lx 0x%lx %s\n", id,
+                        (unsigned long)start, (unsigned long)info->dlpi_addr, name);
+    return 0;
+}
+
+static void on_fault(int sig, siginfo_t *si, void *ctx) {
+    ucontext_t *uc = ctx;
+    char path[300];
+    snprintf(path, sizeof path, "%s/majestic.dump", dir);
+    out = open(path, O_WRONLY | O_CREAT | O_TRUNC, 0644);
+    const uint8_t head[8] = {'M', 'J', 'C', 'D', 1, 0, ARCH, 0};
+    put(head, 8);
+
+    char hdr[512];
+    int n = snprintf(hdr, sizeof hdr,
+                     "signal=%d\ncode=%d\naddr=0x%lx\npid=%d\ntid=%ld\nthread=toy\nwall=1791500000\n"
+                     "uptime=100\nversion=toy+0000000, 2026-10-09 00:00\n",
+                     sig, si->si_code, (unsigned long)si->si_addr, (int)getpid(), (long)syscall(SYS_gettid));
+    if (si->si_code <= 0)
+        n += snprintf(hdr + n, sizeof hdr - n, "sender=%d\n", (int)si->si_pid);
+    section("HDR ", hdr, n);
+    section("REGS", &uc->uc_mcontext, sizeof uc->uc_mcontext);
+
+    /* The stack from sp to its mapping's end, at most 32 KiB: write() says
+     * EFAULT where it stops. */
+    uint64_t sp = (uintptr_t)SP(&uc->uc_mcontext);
+    put("STAK", 4);
+    off_t at = lseek(out, 0, SEEK_CUR);
+    uint32_t len = 8;
+    put(&len, 4);
+    put(&sp, 8);
+    for (uintptr_t p = sp; p < sp + 32768;) {
+        uintptr_t next = (p | 4095) + 1;
+        ssize_t w = write(out, (const void *)p, next - p);
+        if (w <= 0)
+            break;
+        len += w;
+        p += w;
+    }
+    off_t end = lseek(out, 0, SEEK_CUR);
+    lseek(out, at, SEEK_SET);
+    put(&len, 4);
+    lseek(out, end, SEEK_SET);
+
+    file_section("MAPS", "/proc/self/maps");
+    file_section("AUXV", "/proc/self/auxv");
+    section("MODS", mods, modslen);
+    section("THRD", "1 toy\n", 6);
+    section("END ", "", 0);
+    close(out);
+    signal(sig, SIG_DFL);
+    raise(sig);
+}
+
+__attribute__((noinline)) static void store(volatile int *p, int v) { *p = v; }
+
+__attribute__((noinline)) static int parse_level(const char *arg) {
+    volatile int *slot = NULL;
+    store(slot, (int)strlen(arg));
+    return 0;
+}
+
+__attribute__((noinline)) static int name_length(const char *name) {
+    return (int)strlen(name) + 1;
+}
+
+__attribute__((noinline)) static int through_library(const char *arg) {
+    return toy_lib_fault(arg[0] == 'l' ? NULL : arg) + 1;
+}
+
+int main(int argc, char **argv) {
+    if (argc > 2)
+        snprintf(dir, sizeof dir, "%s", argv[2]);
+    dl_iterate_phdr(module, NULL);
+    static char alt[65536];
+    stack_t ss = {.ss_sp = alt, .ss_size = sizeof alt};
+    sigaltstack(&ss, NULL);
+    struct sigaction sa = {.sa_sigaction = on_fault, .sa_flags = SA_SIGINFO | SA_ONSTACK};
+    sigaction(SIGSEGV, &sa, NULL);
+    const char *mode = argc > 1 ? argv[1] : "own";
+    if (!strcmp(mode, "sent"))
+        raise(SIGSEGV);
+    if (!strcmp(mode, "libc"))
+        return name_length(argc > 3 ? argv[3] : NULL);
+    if (!strcmp(mode, "lib"))
+        return through_library(mode);
+    return parse_level(mode);
+}
diff --git a/service/internal/crashes/testdata/dump/x86_64-lib.dump b/service/internal/crashes/testdata/dump/x86_64-lib.dump
new file mode 100644
index 00000000..1672f594
Binary files /dev/null and b/service/internal/crashes/testdata/dump/x86_64-lib.dump differ
diff --git a/service/internal/crashes/testdata/dump/x86_64-libc.dump b/service/internal/crashes/testdata/dump/x86_64-libc.dump
new file mode 100644
index 00000000..923c90a2
Binary files /dev/null and b/service/internal/crashes/testdata/dump/x86_64-libc.dump differ
diff --git a/service/internal/crashes/testdata/dump/x86_64-own.dump b/service/internal/crashes/testdata/dump/x86_64-own.dump
new file mode 100644
index 00000000..9e00307e
Binary files /dev/null and b/service/internal/crashes/testdata/dump/x86_64-own.dump differ
diff --git a/service/internal/crashes/testdata/dump/x86_64-sent.dump b/service/internal/crashes/testdata/dump/x86_64-sent.dump
new file mode 100644
index 00000000..5db60568
Binary files /dev/null and b/service/internal/crashes/testdata/dump/x86_64-sent.dump differ
diff --git a/service/internal/crashes/testdata/dump/x86_64/libtoy.so b/service/internal/crashes/testdata/dump/x86_64/libtoy.so
new file mode 100755
index 00000000..5ad91d90
Binary files /dev/null and b/service/internal/crashes/testdata/dump/x86_64/libtoy.so differ
diff --git a/service/internal/crashes/testdata/dump/x86_64/toy b/service/internal/crashes/testdata/dump/x86_64/toy
new file mode 100755
index 00000000..f2d66522
Binary files /dev/null and b/service/internal/crashes/testdata/dump/x86_64/toy differ
diff --git a/service/internal/crashes/testdata/dump/x86_64/toy.debug b/service/internal/crashes/testdata/dump/x86_64/toy.debug
new file mode 100755
index 00000000..a9c7c646
Binary files /dev/null and b/service/internal/crashes/testdata/dump/x86_64/toy.debug differ
diff --git a/service/internal/db/migrations/032_crash_symbolizations.sql b/service/internal/db/migrations/032_crash_symbolizations.sql
new file mode 100644
index 00000000..6a22bad0
--- /dev/null
+++ b/service/internal/db/migrations/032_crash_symbolizations.sql
@@ -0,0 +1,47 @@
+-- majestic's own crashes beside the kernel's (internal/crashes): the dump
+-- majestic writes when it dies of a fatal signal (/etc/crash/majestic.dump),
+-- sent the way the kernel's records are. They are class 'user', kind
+-- 'signal', and only maintainers see them: a frame of majestic names a
+-- function and a line of its source, which the public lists never show.
+ALTER TABLE crash_signatures DROP CONSTRAINT crash_signatures_class_check;
+ALTER TABLE crash_signatures ADD CONSTRAINT crash_signatures_class_check
+    CHECK (class IN ('fatal', 'warning', 'user'));
+ALTER TABLE crash_signatures DROP CONSTRAINT crash_signatures_kind_check;
+ALTER TABLE crash_signatures ADD CONSTRAINT crash_signatures_kind_check
+    CHECK (kind IN ('bootloop', 'panic', 'oops', 'bug', 'warning', 'signal'));
+
+-- A dump as the camera wrote it, until it is symbolized. Its stack slice is
+-- majestic's memory at the crash and can hold what it was handling -- a
+-- request, the environment -- so it is never served, and it is deleted once
+-- the backtrace is made (or given up on). The bundle kept in crash_bundles
+-- for a majestic crash is the dump without its stack.
+CREATE TABLE crash_dumps (
+    event_id    text PRIMARY KEY REFERENCES crash_events ON DELETE CASCADE,
+    bytes       bytea NOT NULL CHECK (length(bytes) <= 262144),
+    received_at timestamptz NOT NULL DEFAULT now()
+);
+
+-- What the symbolizer (the firmware role) made of a dump: the backtrace from
+-- the debuginfo majestic's CI publishes for the build-id, and the callers a
+-- scan of the stack found past where it stopped. One row per event, updated
+-- by the symbolizer only: pending while it retries (debuginfo not published
+-- yet, a firmware build not fetched), then done or failed.
+--
+-- A symbolized crash is filed under the signature its backtrace makes;
+-- provisional is the one it was filed under when it arrived, made of the
+-- module and offset of the faulting instruction.
+CREATE TABLE crash_symbolizations (
+    event_id     text PRIMARY KEY REFERENCES crash_events ON DELETE CASCADE,
+    status       text NOT NULL CHECK (status IN ('pending', 'done', 'failed')),
+    attempts     int NOT NULL DEFAULT 0,
+    next_try     timestamptz,
+    provisional  text NOT NULL,
+    -- [{fn, module, file, line, offset, probable}], innermost first
+    frames       jsonb NOT NULL DEFAULT '[]',
+    -- what was used: the majestic build-id, the firmware build, the
+    -- libraries found
+    sources      jsonb NOT NULL DEFAULT '{}',
+    error        text NOT NULL DEFAULT '' CHECK (length(error) <= 2000),
+    at           timestamptz NOT NULL DEFAULT now()
+);
+CREATE INDEX crash_symbolizations_pending ON crash_symbolizations (next_try) WHERE status = 'pending';