v0.24.8

2026-10-03 10:36:30 +02:00
1 parent 579d9c806b
commit 1297ea2920
@@ -2,7 +2,7 @@
 Read README.md, ROADMAP.md and docs/TEST_REPORT.md before making changes.
 The project name is RustProxy; the Cargo package/binary remains `rust-proxy` for
-compatibility. Current source version: 0.24.7.
+compatibility. Current source version: 0.24.8.
 ## Delivery
@@ -1,5 +1,12 @@
 # Changelog
 ## 0.24.8
 - Expand the overview Cache RAM diagnostics with HOT usage against limit, transient RAM history for total/fill/COLD queue/COLD I/O, and COLD storage occupancy against its disk budget.
 - Hide the long RSS/cache accounting explanation behind an accessible information control in the Process heading.
 - Keep COLD disk occupancy explicitly separate from transient process RAM accounting.
 - Update release identity to 0.24.8.
 ## 0.24.7
 - Make the transform temporary-memory ceiling configurable from Settings and preserve a 128 MiB default for existing configurations.
@@ -1688,7 +1688,7 @@ dependencies = [
 [[package]]
 name = "rust-proxy"
-version = "0.24.7"
+version = "0.24.8"
 dependencies = [
 "anyhow",
 "arc-swap",
@@ -1,6 +1,6 @@
 [package]
 name = "rust-proxy"
-version = "0.24.7"
+version = "0.24.8"
 edition = "2021"
 rust-version = "1.88"
 description = "RustProxy - independent reverse proxy with local administration"
@@ -1,9 +1,9 @@
-# RustProxy 0.24.7
+# RustProxy 0.24.8
 Independent Rust reverse proxy with a dashboard, SQLite configuration,
 streaming HTTP/TLS/WebSocket forwarding, raw TCP/UDP stream hosts, IP-bound vhosts and backend pools.
-**0.24.7 release source.**
+**0.24.8 release source.**
 ## Layer-4 streams
@@ -11,6 +11,13 @@ Raw TCP/UDP forwarding has its own **Streams** page in the primary navigation, a
 Named HTTP/HTTPS listener bind addresses use the same chip-style editor as vhost hostnames, including multi-address listeners.
 ## What changed in 0.24.8
 - Expand the overview **Cache RAM** block with live HOT RAM occupancy against its configured limit, transient cache RAM history split into fill / COLD queue / COLD I/O, and COLD storage occupancy against its disk budget.
 - Move the long process/cache RSS accounting explanation behind an accessible information control in the **Process** heading so the dashboard remains compact while the accounting caveat stays available on demand.
 - Keep COLD disk bytes separate from process RAM: only fill, queue and COLD I/O buffers are shown as transient cache RAM.
 - Update package/source/UI/OpenAPI/release identity to 0.24.8.
 ## What changed in 0.24.7
 - Make the process-wide transformation memory budget configurable in **Settings -> Transform**, with a 1 MiB..2 GiB range. The budget remains a ceiling for estimated temporary buffers and is not pre-allocated.
@@ -1,5 +1,15 @@
 # RustProxy roadmap
 ## 0.24.8
 Current direction: 0.24.7 -> 0.24.8
 - [x] Expand Cache RAM overview history with HOT usage/limit and transient total/fill/COLD queue/COLD I/O series.
 - [x] Add COLD storage occupancy history without mixing disk bytes into process RAM.
 - [x] Move the RSS/cache accounting caveat behind an accessible information control.
 - [x] Extend offline UI/release contracts and update release identity to 0.24.8.
 - [ ] Run compiler-enabled `./dev.sh check` / `./dev.sh test` and browser/live-cache acceptance on the release host.
 ## 0.24.7
 Current direction: 0.24.6 -> 0.24.7
@@ -1,19 +1,19 @@
 61bf40a0572889dc8b0dda9eae4e93e44b0de9364b3c798106c85700ffb37c23  .dockerignore
 4140a2956264b44f259e6a37fc00ba02097bbe68b09296e04d3d243c1287129b  .env.example
 9e6356475bf587091bab72246ec9e325b498f7e48a6220e9a18baa50d0a385a6  .gitignore
-6b594006d8214ed456fc514831a794ebcc1b7ac2b91b7f067da275d457881e96  AGENTS.md
+726a8227e45ed845a25e4cc4294eecd6037038130ecf58be711e8782515ff7b1  AGENTS.md
-a69690a64a25b07f9e4e660cd2db6193e30dacc799a7d83d5481696df169ad6e  CHANGELOG.md
+83d25221547ac491f073aae7a453f87ea072c059f7d87b61e348518ddedb5f84  CHANGELOG.md
-4ffe7181d7c69bc8d7e6373d2e67302f72934256f090d9131a087ce2f8e899b0  Cargo.lock
+14cee4fb07ab7667942ca7672e004a644a9659eb6091c28eb6aaba0c5ea39704  Cargo.lock
-6673250cb6640bfa7ec35e63c66882174ff80c6e62253b8cfd57b1ec7d00f3d2  Cargo.toml
+3c4543cf1006eb775ef4eb24aefef10654bcd51992c42bf8718041b575344870  Cargo.toml
 d6d22ba63f4bc3d16a13012ecaabff8a156be57c824d2f20f66976502fb27d1f  Dockerfile
-f36bf490c8af1e1a685946f841d45476dcebfae4f76fa9aca9b31fe3701a0666  README.md
+ef6f82076a16922120c2d41d934087f167667e8530d162752d87e23d11fa0332  README.md
-f913f1d20ab3178e953c25dbf02e285c5e140095fcf06d95076670df326b21fa  ROADMAP.md
+f36cc5e3438efdf7776365d1341d977c9cabf0de3b705d3fb155992d3199db08  ROADMAP.md
 da8311e3db945290666324a2f24bf4521b365272d7ac3f862ded1be993eea646  UPDATE_CHECK.toml
 a55fafd4c9fc17f8af591407e7f86d222ce06658c64dcffda92acbf420f969f1  build.rs
-9447d94630a65e79000f1dc1658837a200e632141c33f221a706855b5438ff9f  debian/README.md
+5e3988e42e74fc513a734ef43fd7d98c7a496586742f8b328a489987fb467e63  debian/README.md
-867916d7e4256661e310042e202413df06f6ed27d58de23726eef9aadd8c1afe  debian/build-package.sh
+582f2a48e14174073a1c3375fa96242c149c101092fd4217282f417a6a5dd1dc  debian/build-package.sh
 0763a4bd8b429f7922b23a7276ff694f3a751b83fb127f6ad7ec654e5e507ecd  debian/build-repository.sh
-767bb5bec17acc0c51f9c02b8a6bd637a9b0ba980f7a58c66e79744186359398  debian/changelog
+d2a02c72bf26674ea5257e339dc031df8bedbadd314a6c340cf33c12ac1a4dd4  debian/changelog
 c90457b19b1b2f7998d3db59a656d215eb0fab23769197405960457b66d95cf7  debian/control
 dff2ecb9c14623416981f444bc6df1c4e2bf55d330260f36a312d8d42245400f  debian/rules
 c537d54fd92a9b97c5f6e6ec63bc1276cda324513e2946b341b2193f63b62e6a  debian/rustproxy.environment
@@ -24,18 +24,18 @@ d1c483406fb53674ed8db5f30de599b5a91fa1c6b28242eb70a64d6a736430bb  debian/rustpro
 e8e18df40bcd69d6aa404282679186d9b8256ac63a5b4e80d7f081e8a0095a2e  debian/source/format
 57d737d73b828bf763b210c8ddea39d7a63224f8d509a518d0b876ba2e6a805a  deploy/README.md
 50329bd9d6980fb1c90a5cb29966b19a257905791d1d07d185d6bd4e3b0bcb1a  deploy/rustproxy.service
-261d682eac0d688274b5ee8d1e98e751fa2ea5613665d0ecb18524babcd71026  dev.sh
+4888e8e7ca28a799e41e0798e1ff20c5491d284e70209036579ed3077fcb1e15  dev.sh
 5f51efe621f45512a466fa7f2656867c6502a135ca040f4bfeec06a6919b39b6  docker-agent/README.md
 5e4f565c3c9de4dba897af2e801ea646a83395e72eae4717a6d502dff2fcec10  docker-agent/docker-agent.env.example
 9e9f3f17f38f9b0730f598f65988ce8ef562d2182ef6778fc7292b990e9cf22f  docker-agent/go.mod
 9d77c90767fa929ee8338734d72ce83284d3d965673270f62cb2b1613d587a33  docker-agent/install.sh
-b829d52c5f834b1408ef5fac00846cdc61ae835103a5065f0de9c3e3bd161493  docker-agent/main.go
+6b571206aa171bee1ef72e7ac461a3c627b8c91f15bfe02efa940935466167f8  docker-agent/main.go
 3d4051a1f805d145df3877476e4b87773e74be8e123045065955a5133afdc68c  docker-agent/main_test.go
 634790f35ff4627df2a78cec2ed371f6e9ec9df00afb386075595fc7f3ed72eb  docker-agent/rustproxy-docker-agent.service
 0dbacca69143bb1e38d74270e24562a6749e387b26ef869643e876df6e0b1edb  docs/ACME_PROVIDERS.md
 888bbf7812e7283202f303680145c99b3f1a7a52fb3923fc3de1a6cbcfb72d00  docs/ACME_RFC2136.md
 3bfc98b55e7e905250c4ded38d18ca064c6006ae9232acfa5d48517d0da14f5b  docs/API.md
-abd3178126678ed94e4a904a9115c4b0c1246e1e8f77fe318393893a899762a4  docs/API_ACCESS.md
+a1c6fe8761caa655970d8546843237905416f54309009fb809d3c3fcacfaf0a6  docs/API_ACCESS.md
 dde6a6a0b99ac34e65fe80e5eb8aebc2bc852bb97eb5c13a3c1ab538ef37f5a0  docs/ARCHITECTURE.md
 2a1a6b8e5783ef4a25fc7933b4faedfde44557a827782a6a900d448163d81df7  docs/CACHE.md
 0450813e3c875371d75cc41835f6362abb5300cd4bdf545f3011d9df8101170c  docs/CACHE_DIAGNOSTICS.md
@@ -43,7 +43,7 @@ db5534427ff0f004940fd6960906d3eaa75347a110e6322827c51c5d63f20adb  docs/CONTAINER
 c822cd1d6a055d5ddec06d4f6077f0b13837dfb25ede1ec1f4e9a52e182db946  docs/CUSTOM_LOCATIONS.md
 7db65a96f696aff1d7f74e2041cfc6ecdf437b1412ece90cee26da1ceff4cf7e  docs/DOCKER_DISCOVERY.md
 061e1ccee4f3e70126a27ba8bdbac10e895fdb4e6e4607c5c6a6ab1d164baf02  docs/HTTP3.md
-3699457c13958ac7117b333ea69ce1f03cc21259b5f7acee408d9161d6043bd3  docs/INSTALL.md
+4a466a1431db9972f07b3f19e34584484741a61d5350e68b7293f73fe0206863  docs/INSTALL.md
 0a124bd3eafaa9c6b3bc2b811fdc3e6295a6a2978766c37cc0735c27f4cf6d59  docs/INTEGRATIONS_040.md
 2baaa1d34979c33caead9b271a7d235c673acb4e188c94917d975c25c179c242  docs/LIVE_LOGS.md
 4e1504d1a343b94c2252545cbd5248af79f158c4566754dfe11f3c15a19ec0da  docs/MANAGEMENT.md
@@ -53,7 +53,7 @@ c822cd1d6a055d5ddec06d4f6077f0b13837dfb25ede1ec1f4e9a52e182db946  docs/CUSTOM_LO
 e7516646dfb107d6240370f4e7460b1189f2eb21f398740381d5d102847bbfe6  docs/NOT_FOUND_HOSTS.md
 3da047768f32064c5ef0ad7a4c73c4b14930fe7317c54f5650f426af9f484593  docs/NPM_MIGRATION.md
 8538816f6b64780ca4f652d189c5d2c00e40b0c8fcd1ad77ae2e11d39058dce6  docs/PROMETHEUS.md
-184cae8470da4ef918a41e6201a784dbf61e87f43a4212afd046906eac025746  docs/README.md
+31395c2c76bd0dcf78e49aa8e19f3d732b8c9ecee71b3c8af6b697f18729e03f  docs/README.md
 6e46a137b9c88dac8cb9e3fdca877430092392de9913d746278dbff8652460c2  docs/REDIRECTS.md
 0dfd0d431c5aedc67abac1ce5de040ffa790ec9578fd7d6f91a987c333d73358  docs/REFERENCES.md
 ce5afb4f531bb5fb4c453deb49f643f2a563f32f7908c995e5bc8e0d7de995b7  docs/RENEWAL.md
@@ -61,7 +61,7 @@ c6fa646500c0acac18bff6349cbb1d821680a849c8648b4eaa64f2a4305f9b9d  docs/SECURITY.
 620b69e566d27af04f0604f4ca3f88cf95cdfea7fbc6ae9dd92446d2b2b5d9be  docs/SECURITY_AUDIT.md
 fce52cc908fb86cab16072c0297b6cdaf4857e84185783bc96240d9a6bc321fd  docs/SETTINGS.md
 3611defd206cde107e75cac006159856d12cd8f15df7ae2eb9ec3592ed2b4abd  docs/STREAMS.md
-57803c5aefecfc3b97cf096e3457a1a7a33b460272da726b92d5594f31309de2  docs/TEST_REPORT.md
+3f30e5f47f6fc1da02ed803cd5504d715513017568357514b3990caefa765b46  docs/TEST_REPORT.md
 8ee6187a5460ca45643b7fd789e27bffd264449e3a92ff70e9359edee011bbbb  docs/TRANSFORM.md
 b02957b708174c9def830ced3c70c943a47af7a33467ef858255d04ab92c4af0  docs/TRANSPORT.md
 96a6816915d526f00e261846131ee3f942ef332af996cf0f73c79ec1ba9f9c7a  docs/V0.21.0_AUDIT.md
@@ -80,6 +80,7 @@ b891db1453cd7cf6b10f79879f4edaf7c83f14e91e4e95826919d40cb5dca2d4  docs/V0.24.4_A
 8d6519b00e01e5cd41ee6772941fdc7e9a70fe29626df71cefced6eefe6a94d0  docs/V0.24.5_AUDIT.md
 4d2d8b84b38df57f5c6a03995019f8418806fe5867ee34ce192a90ef561986a8  docs/V0.24.6_AUDIT.md
 081f655554c62911b81719343e905f012356bf1df3054bda3ccd1a9bdffa89af  docs/V0.24.7_AUDIT.md
 d0e609febbcd1cfdb8ea0b00b4fa6f081eac01e2d43a81e38a53ae25783152cc  docs/V0.24.8_AUDIT.md
 bd7959e325685085507a20b22254c7024ceb9396b6314257694bd764ec096ba5  docs/VHOSTS.md
 e32472cea5ef3cd25c058e55df8adfcc1d7bf03e0d12dba69d2f2b9b94fe04b7  docs/VHOST_ACCESS.md
 c336f998027330c58d5afbbbb3a3a682fd44ae3997643882fe342633822f8bb3  docs/screenshots/README.md
@@ -94,13 +95,13 @@ b26833cb4251f9390a44192ecc827ff7f052fd19016a5ccf7498c94503ab4ce3  examples/mock-
 17e7971fa9d9b141019fba3135d87cb1aa0cbc55d56b0718f879f880b615da26  examples/vhosts-balanced.json
 e06905b6363103b1bcee1a09b9e02292033f114d88f3edbea22ddab53e9e5071  examples/vhosts-private.json
 529b47c6d4ea44d2a25d1cf9561cb5ee1e05f50a568c6dba5889741bcf936434  grafana/README.md
-dd2fe9a14176c61f1120415e59051e7584657a6057a77daeae10e33c11a97fea  grafana/rustproxy-overview.json
+9fc541805900696d97251b8a6e38ffd4a6553d456862715f3a975eb1ce9fd9f5  grafana/rustproxy-overview.json
 f45e5cc3d0c253534978d4b752b0667e2a7906ccf5a22106400e0f6b70b00d23  install-debian13.sh
 858b39fa6886b71d20690bf369e76580922364b3cc7f0cf6ba9b040df9cd76e3  install.sh
 29cada0936762f26495064d1524a668262ed729b21f20aebddc8b6e5cfea363b  langs/README.md
-dd032822bc14e3017fd6ec21c4bc3e71daee2f0654855829dfcb0aa9a7400bcb  langs/en_US.json
+f735129fe2cf9af251467b06c8d003c717c34d80ce454a53b084a68b9df38056  langs/en_US.json
-dcc9960ff63b1124a62163c8f404dec1dba95b321b168f1151e1122744e848ed  langs/pl_pl.json
+ee433b1e6f54e0b31bbd6e5502a38f36c6fc2f3b826fc8d4bdfe114e4b64770c  langs/pl_pl.json
-561ec0a7405f788a215a620df5760e79fbac50a79db88f2fb4c284627caa3205  make_zip.py
+1f916b213663e8d5c7fb0ba759d8d803aa6bd58eaa1c63c367ee9ea9a154e2d6  make_zip.py
 e830d37dd1f81a4b0aa7d535f5bba69e34e433b0fd99cc8ee0b296786c32379a  migrations/0002_admin.sql
 20112cc82192098b8d602f1c4f7ca08712e9e1366c845fabb92753187c370d35  migrations/0003_certificate_renewals.sql
 5c62da30fa9db594a4d656c77ae676d3c388072b6a85f91170ec7d911d7cde43  migrations/0004_admin_preferences.sql
@@ -117,8 +118,8 @@ ee50f38c037765fab742e888d4b9fc4d874c31c785c6064d4eca3d2c4d24d944  nagios/check_r
 e69813fb1d3a4cdcfb7243964cc323fc21a603087bf2e84188fa42b9d3cee4b5  scripts/acme_rfc2136.py
 ea2c670aa1fc2c145fb3666711642d526c2adb01537fc3b6398664e33136f0e4  scripts/admin_audit.py
 761aadaffbfb08c32afca28af7e5379f933712563b00dddab7261a9505cb7d5b  scripts/backup.py
-1448b4944215564a0bae853249ddbb36c3bb15189416bea1ddfe7a9e515c4e49  scripts/check_source.py
+0e7da27440c873af3007ceff83410f68ec16880217c9218fc1f13a9232e92978  scripts/check_source.py
-e10495bce1d229dc12a9a36a91453352fac77d9c69a26482f8748ad023eefb7f  scripts/deploy.py
+47e01bdc0ebf659b956dda053073767045b12823588b83cb2dd9d49167559f64  scripts/deploy.py
 6facb2d65bfab234f09855097d12da8f72669a38ebceb4b1cbd03ab42b8d2469  scripts/langs_check.py
 9f89ccdcd31da0f203113051a109ada8e51b44f91382ee2c5c75228d1e456540  scripts/memory_contracts.py
 60504dd426195fca88d77e075d607c04540dbe8aae2cd806077b3818e0e0cf08  scripts/migrate_npm.py
@@ -126,26 +127,26 @@ d1418f8e574a7390fd45a2aa879bdf5720b773162d65e295ab0350506aa5220a  scripts/mock_a
 2d3ff92300b09ce9cecbbaaa9309b4d33160fa4b2291c9952b784e8cfb599ab5  scripts/mock_server.py
 2d4c859aae5ba357a6d30024c8487ae8f59f01b192711f13f9c2f8fee0f48b50  scripts/os-acme-client/README.md
 c73b814a42bb4ff703441dbd177ee625055eeb115f9b5bb0c2150aede573a159  scripts/os-acme-client/opnsense-rustproxy-cert-deploy.sh
-65a620b85e9c0011f5f20474a10add19a1a7ab6074112d8a2f6aed4b63b8e943  scripts/preflight.py
+5f8d0a41ea0eb97a063274d0c3ea72af218dc27b94e522e759ab1eaa33130756  scripts/preflight.py
-0041f46f6ab78d4c99bc04928b930b805d9846e820975d6ddb85a5b9f8272191  scripts/release_smoke.py
+38bddd454b6869822180c0134b410f81e0ba509b57992a7fcb43d2fb4105d9de  scripts/release_smoke.py
 c37847ae9663197d306ea55eadbe4a1892d61d031ced923a8eeffc1ae876bb4b  scripts/routeros-oci-build/.env
 45be151cd85fc2ef2f1fdc3003ace63381af262e73af8a685ab48cb697cc0de1  scripts/routeros-oci-build/.env.routeros.example
 3b48cff8506e5a6ae7d3876f47721f5de7d63e2e02264a78cf5b6ddd52d9fbc6  scripts/routeros-oci-build/Dockerfile.routeros
 7c7a3e51f43b43e1c962a4b0bb591f99c1f06977bf77f23719f7f867dfe7eb8e  scripts/routeros-oci-build/Dockerfile.routeros.dockerignore
-d4edbd7c488a2187ec998c121e4298910fe74203f5f10bf3504e1bc5affa7ef5  scripts/routeros-oci-build/README.md
+086148713830fe7c2cf24453d26b07e0ecf28d7bdef16ed1a9379a61ec58c09e  scripts/routeros-oci-build/README.md
 d53b2ae7315ac143bd17d6327611a39e7c23666408bb95e39da2ca8517322ccb  scripts/routeros-oci-build/build-routeros-oci.sh
 3f267cafa16006e5456ade78ee2d5fae02cc7ce747839523068ffd8d7c98798a  scripts/routeros-oci-build/docker-entrypoint.sh
-0546446681cf7cd597302a0297c60b920137ee6e9e6f31fe06c6e5c0b2270058  scripts/swagger_assets.py
+9b8146e4fd56a8b68e6eae076382aa3027510296083c843361d922b88f8926f5  scripts/swagger_assets.py
 102b23de19a88a8e60de392fb83aefd3dfb33e90cc97ed1690d9f3d4a33d8866  scripts/test_compression.py
-bc1181d42e745dd904ff6f10bb698f408422b696873d589d020d1b5fe726c9d4  scripts/upgrade.py
+38f88059efee4e7c495bddf05240e4ebf60978eb8b7b720fdb3130406a3a7eb0  scripts/upgrade.py
 081aad397b2b9485e20b684dc11682d3a16464c5b4f110cd461f8518eb74ad99  src/acl.rs
 2d1ffc1c64e76c647abd3134719fb561b1f27d584c92d867011d8de7dd7f6662  src/acme.rs
 fdba60fa997aa18cb0a7ef50e286a8b6fd877d14fe829d4b0bcb5c7c269a5ae6  src/admin/documentation.rs
 3299668f6792805b648536357f90ddf059ebbb7569440ee766d8d130aaad7552  src/admin/mod.rs
-d1e2f452d4e08510aec4e276f058f5ab55597d6bc9cb8fdb7dbb67386f56c700  src/admin/openapi.json
+0105c0cd9e682928aaabf03cca5c928f5fe3baa759783a3043d412f1800e41d8  src/admin/openapi.json
 b4fa393b780b2676b5d72e0f90cd7290292f424b8062d4b5983e722d6ca72c32  src/admin/public.rs
 23c55f23deeec844a9abc2289440c9e0583aaeb72416fc5f3632a43a864c0efd  src/admin/web/acme.js
-614da2851f76bccca8ff3c57de944bc68407a647af4d4112479bab7a33b0ed4c  src/admin/web/app.js
+ccf01bfe2ca2c8fcc9c67629abf86881c81d1169284be99dfad47d774b3fac2a  src/admin/web/app.js
 d0be71555de13f732fd6ee44438a0110eb08c91e78bbc1aa36a1a84182780210  src/admin/web/cache-panel.js
 50d1ebcbaf4d0b2968da23bb943fc3f67131c5d32df3f61d23ff37aad9da5b81  src/admin/web/demo.html
 3b84a7a08f9f68e2c78fed4523b594c31a251addc5480a69c5f6949908230539  src/admin/web/docker.js
@@ -160,7 +161,7 @@ f7d0955ab18c15e04369204e789f341d2e832f927c1ff20a3b2b9e35e7898f00  src/admin/web/
 e6c4d91d1542d0a5b47bb8736f9539d43a6713df5a473b635519d5b7eac2eb9c  src/admin/web/error_504.html
 0a5fff35555153f59d4346933030a67b6e1a8768cee7a47cfa2fcf1a2c564f63  src/admin/web/favicon.svg
 dee3b113907f77138cdf919efdfb097e45b889cff3893bfc6f02ed998643bbae  src/admin/web/host404.js
-4d749fdb9a4f3ec8095253e1e288a08117d293a8945a9ab0e2395ec69b24c49a  src/admin/web/index.html
+ea084ad0d95ff137d4cc277a810f958b47b7d5d7e426c2066086448d36aad700  src/admin/web/index.html
 24db88842707f764064657712d3660c6ac129fbfb47d188c0903925cf8244ce5  src/admin/web/integrations.js
 cdab0c11a28deebdf401c0453fbc76b675e9e643722106fb20e812bb9648ccde  src/admin/web/login-keys.json
 a253d202dc9a147f2add34c64e0f35c38fdc7f667f9908933ce5f959b1a92a2e  src/admin/web/login.html
@@ -169,9 +170,9 @@ e41619e5cb0ba01a3d287748f28eb38bbe7641f9bedade252d286c18e619c400  src/admin/web/
 22318f39f7bb1ae98e65737d3c2ad9e63065b8e94ad59bed560c0e80d3a46949  src/admin/web/redirects.js
 dafc8b023f334091c7b5a04920038bce46ea3ef4b068e1f88cffe49d44eaeeee  src/admin/web/settings.js
 1a30affd6a717095a1763998a5850a79ae0f86b7b694806f2aba2b880735dd1a  src/admin/web/streams.js
-e5f300b6456a680d1cd80e4adec7127e01e06a4bed09a6ac4df73f614e765c20  src/admin/web/style.css
+aad4a2f55f750c26ab98f125a8f7712b365e6c993cf4ee9a3636d05a6a0b41b6  src/admin/web/style.css
 049be02e0f68c3f6702f3bf29be760c4e5bc1199393ed198107c0a264711300d  src/admin/web/transform-panel.js
-baeb8c6cdf9c365d1be5376d01e66231e1cdc77725741c72eb8c3bc07fe740e7  src/admin/web/vhosts.js
+2b116e3b45a39078f52a0fd4cae3dd06bc61a111c312981716644f24e1314325  src/admin/web/vhosts.js
 1e5c6c6157f8b66d90751a0480cb90c6fdfa229330fc4c3f3504bc0c689c3d60  src/auth/files.rs
 606f5491f94da007881a679051677a4609881d3151ac753de02556e0e76e1ce8  src/auth/mod.rs
 1ceb57d97cbff655f185e126d98b8dc7884c7aac865e1f70e3c6d199685c13a7  src/auth/store.rs
@@ -202,7 +203,7 @@ eff4484fd9630009471f824c57c5c74f3d3c5378f9e46a3bdda03ede37daec82  src/geoip.rs
 2f6dd8c74fe1d22a8fa4ec5a21d0d334a667ede1b11629541f4802252765b21b  src/http3.rs
 a6630962453c7e68a409aac45da51093148b9b3c8d044ab13897a8c9e476ae4d  src/lib.rs
 df14373ce3f9c5740d7501fdd4cb42d8b7b07b23ad86f2b69b5e534f0e0f01eb  src/logging.rs
-f20fde5a4c5029cee8b87cfb5ab70a0d7fecceb2db4c98f8f349343aa293e344  src/main.rs
+942a1bf335c2e0b3e000a4443b1d0ff88851d75d1362a4846420d8bf758a2377  src/main.rs
 7022ec2e991e9906e30b06f5bca58f96b9d7e09cc92a27202b5196d54e341b75  src/metrics.rs
 64494e5746912cfcb10612ea4e0b336004b1f738bd7999be7e58fc96abadb6e1  src/not_found.rs
 e4b1f61c12437cc840c36eb7ab7b69b03f310bca3f89288ade9992d9dd1b7e2c  src/pages.rs
@@ -1,6 +1,6 @@
 # Debian packaging
-This directory builds the `rustproxy` binary package for RustProxy 0.24.7.
+This directory builds the `rustproxy` binary package for RustProxy 0.24.8.
 The package installs:
 - `/usr/bin/rust-proxy`
@@ -21,6 +21,6 @@ cargo fetch --locked
 dpkg-buildpackage -us -uc -b
 mkdir -p dist
-find .. -maxdepth 1 -type f \( -name 'rustproxy_0.24.7_*.deb' -o -name 'rustproxy_0.24.7_*.changes' -o -name 'rustproxy_0.24.7_*.buildinfo' \) \
+find .. -maxdepth 1 -type f \( -name 'rustproxy_0.24.8_*.deb' -o -name 'rustproxy_0.24.8_*.changes' -o -name 'rustproxy_0.24.8_*.buildinfo' \) \
    -exec cp -f {} dist/ \;
 echo "Packages copied to $ROOT/dist"
@@ -1,3 +1,10 @@
 rustproxy (0.24.8) stable; urgency=medium
  * Expand Cache RAM overview occupancy histories for HOT, transient and COLD storage.
  * Move RSS/cache accounting guidance behind an information control.
 -- RustProxy Release <release@localhost>  Sat, 03 Oct 2026 10:30:00 +0200
 rustproxy (0.24.7) stable; urgency=medium
  * Add configurable transform memory and concurrency budgets with persisted resource presets.
@@ -18,7 +18,7 @@ if [[ $# -gt 0 ]]; then shift; fi
 case "$mode" in
    help|-h|--help)
        cat <<'HELP'
-RustProxy 0.24.7
+RustProxy 0.24.8
  ./dev.sh                    Build and start proxy + local panel
  ./dev.sh run [serve flags]   Same, with extra server options
  ./dev.sh admin setup-token   Generate/print a one-time setup capability before first login
@@ -123,7 +123,7 @@ case "$mode" in
    check) exec cargo check --locked --all-targets "$@" ;;
    release) exec cargo build --locked --release "$@" ;;
 esac
-printf 'Building RustProxy 0.24.7...\n' >&2
+printf 'Building RustProxy 0.24.8...\n' >&2
 cargo build --locked
 BIN="$CARGO_TARGET_DIR/debug/rust-proxy"
 case "$mode" in
@@ -32,7 +32,7 @@ import (
 	"time"
 )
-const version = "0.24.7"
+const version = "0.24.8"
 type config struct {
 	Listen      string
@@ -1,4 +1,4 @@
-# Administration API access - 0.24.7
+# Administration API access - 0.24.8
 ## Sign-in boundary
@@ -1,4 +1,4 @@
-# Installing and updating RustProxy 0.24.7
+# Installing and updating RustProxy 0.24.8
 The scripts prepare a Linux/systemd installation. This source archive is **not a
 verified production build**: Rust/Cargo, real CA operations, live systemd startup
@@ -13,6 +13,7 @@ This index separates current operational documentation from historical/version-l
 - [PROMETHEUS.md](PROMETHEUS.md), [HTTP3.md](HTTP3.md), [STREAMS.md](STREAMS.md) - monitoring and transport features.
 - [SECURITY.md](SECURITY.md) - current security model and limitations.
 - [TEST_REPORT.md](TEST_REPORT.md) - release verification status and explicit environment limitations.
 - [0.24.8 dashboard cache-memory audit](V0.24.8_AUDIT.md) - overview HOT/transient/COLD occupancy histories and compact RSS accounting help.
 - [0.24.7 transform resource-control audit](V0.24.7_AUDIT.md) - configurable transformation memory/concurrency budgets and resource presets.
 - [0.24.6 memory/preset audit](V0.24.6_AUDIT.md) - persisted cache presets, transformation memory bounds and background-worker memory/task review.
 - [0.24.5 specification audit](V0.24.5_AUDIT.md) - HTTP/3 empty-request-body normalization for HTTP/1.1 upstreams and DELETE regression matrix.
@@ -1,11 +1,14 @@
-# Verification report - RustProxy 0.24.7
+# Verification report - RustProxy 0.24.8
 ## Scope
-RustProxy 0.24.7 makes transformation memory/concurrency limits configurable and adds persisted RAM saver, Recommended, Performance and Uber performance resource presets. The same version now exposes live transform resource usage, overview process/cache RAM accounting and COLD disk occupancy. It retains the 0.24.6 cache/background-worker memory hardening.
+RustProxy 0.24.8 expands the overview cache diagnostics with HOT RAM occupancy against its limit, transient cache RAM histories for total/fill/COLD queue/COLD I/O, and COLD storage occupancy against its disk budget. The process/cache RSS accounting explanation is now behind an accessible information control. It retains the 0.24.7 transform resource controls and the 0.24.6 cache/background-worker memory hardening.
 ## Source contracts reviewed
 - The overview Cache RAM block keeps separate histories for HOT allocated bytes, transient RAM, fill bytes, COLD queue bytes, COLD I/O bytes and COLD disk bytes; the disk series is never included in process RAM accounting.
 - HOT and transient histories are rendered against their runtime limits, while COLD storage is rendered against the configured COLD byte budget.
 - The long `memoryAccountingHint` remains translated and available on demand through the Process information control instead of consuming permanent dashboard height.
 - Transform `preset`, `memory_budget_bytes` and `max_inflight` are part of the normal revisioned Settings document and therefore persist in SQLite; the reopen test covers them.
 - Existing configurations default to 128 MiB transform temporary memory and 32 concurrent attempts.
 - New transform attempts use atomic runtime byte/concurrency reservations and fail open with fixed `memory_pressure` / `concurrency_pressure` reasons rather than queueing full-body work.
@@ -38,4 +41,4 @@ RustProxy 0.24.7 makes transformation memory/concurrency limits configurable and
 | `./dev.sh test` Rust phase | BLOCKED: Rust/Cargo toolchain unavailable in this workspace |
 | Sustained per-preset transform RSS/heap profiling | release-host acceptance gate |
-See [V0.24.7_AUDIT.md](V0.24.7_AUDIT.md) for the resource-control design and remaining runtime acceptance gate.
+See [V0.24.8_AUDIT.md](V0.24.8_AUDIT.md) for the dashboard change and [V0.24.7_AUDIT.md](V0.24.7_AUDIT.md) for the retained transform resource-control design and runtime acceptance gate.
@@ -0,0 +1,23 @@
 # RustProxy 0.24.8 dashboard cache-memory audit
 ## Scope
 0.24.8 is a dashboard-focused patch. It does not change cache admission, HOT/COLD ownership, persistence, memory limits or cache protocol behavior. It exposes the existing runtime counters more clearly in the overview and reduces permanent explanatory text.
 ## Overview cache charts
 The Cache RAM card now retains the HIT/MISS/BYPASS activity chart and adds/extends resource histories:
 - **HOT RAM usage / limit** uses the cache resident/charged byte history and scales it against `hot_limit_bytes` when a finite limit is available.
 - **Transient RAM usage / limit** tracks total transient bytes and overlays fill bytes, the byte-bounded COLD writer queue and active COLD read/write I/O buffers on one shared scale. These series are diagnostic lines, not additive stacked accounting.
 - **COLD storage usage / limit** tracks persistent COLD bytes against `cold_limit_bytes`. This is disk/storage occupancy and is deliberately not included in process RAM accounting.
 All histories keep the existing bounded 60-sample browser-side window and are populated from the already-authenticated `/api/status` payload. No new endpoint or cache-runtime allocation is introduced.
 ## Memory-accounting explanation
 The translated `memoryAccountingHint` text remains unchanged in meaning but is no longer displayed as a permanent paragraph. It is shown on demand from an accessible information control in the Process heading.
 ## Verification
 Offline source checks assert the new chart IDs/history arrays, the retained accounting hint, the information control, release identity and language keys. JavaScript syntax, language JSON parsing, source-package checks and release smoke checks remain part of the standard release verification. Compiler/browser/live-load acceptance remains a release-host gate where those runtimes are available.
@@ -3672,7 +3672,7 @@
  },
  "timepicker": {},
  "timezone": "browser",
-  "title": "RustProxy 0.24.7 - Operations",
+  "title": "RustProxy 0.24.8 - Operations",
  "uid": "rustproxy-0170",
  "version": 2,
  "weekStart": ""
@@ -1214,6 +1214,9 @@
    "locationDocsExampleStatic": "Static assets: Priority prefix (^~) /static/ keeps regex locations from overriding it; cache can be enabled for this location.",
    "locationDocsExampleRegex": "Versioned API: Regex (~) ^/api/v[0-9]+/ can select a backend and use regex replacement groups such as $1.",
    "cacheOutcomeHistory": "HIT / MISS / BYPASS activity",
    "cacheHotMemoryHistory": "HOT RAM usage / limit",
    "cacheTransientMemoryHistory": "Transient RAM usage / limit",
    "cacheColdStorageHistory": "COLD storage usage / limit",
    "processCpuHistory": "Process CPU history",
    "processRssHistory": "Process RSS history",
    "cacheMemoryBreakdown": "Hot / transient cache RAM",
@@ -1221,6 +1224,7 @@
    "cacheColdStorageUsage": "COLD storage / budget",
    "cacheColdStorageObjects": "objects",
    "cacheTransientMemory": "Transient cache RAM",
    "cacheTransientShort": "TOTAL",
    "cacheFillShort": "fill",
    "cacheQueueShort": "cold queue",
    "cacheIoShort": "cold I/O",
@@ -1237,6 +1241,7 @@
    "processRssFile": "File-backed / shared RSS",
    "processDataSwap": "Data address space / swap",
    "memoryAccountingHint": "RSS is the real process footprint. HOT/transient cache values are RustProxy-accounted allocations; transform memory is a conservative active reservation. Non-cache RSS is RSS minus accounted cache and includes transforms, connections, TLS, logging, Tokio/runtime state, allocator overhead and other buffers, so these rows are not all additive.",
    "memoryAccountingInfo": "Memory accounting information",
    "logTransport": "Transport",
    "logWebSocket": "WebSocket",
    "logUpstreamError": "Upstream error",
@@ -1214,6 +1214,9 @@
    "locationDocsExampleStatic": "Pliki statyczne: Priorytetowy prefiks (^~) /static/ blokuje przejęcie przez regex; dla tej lokalizacji można osobno włączyć cache.",
    "locationDocsExampleRegex": "Wersjonowane API: Regex (~) ^/api/v[0-9]+/ może wybrać backend i używać grup zamiany regex, np. $1.",
    "cacheOutcomeHistory": "Aktywność HIT / MISS / BYPASS",
    "cacheHotMemoryHistory": "Zajętość RAM HOT / limit",
    "cacheTransientMemoryHistory": "Zajętość RAM przejściowego / limit",
    "cacheColdStorageHistory": "Zajętość COLD / limit",
    "processCpuHistory": "Historia CPU procesu",
    "processRssHistory": "Historia RSS procesu",
    "cacheMemoryBreakdown": "Cache hot / pamięć przejściowa",
@@ -1221,6 +1224,7 @@
    "cacheColdStorageUsage": "Zajętość COLD / limit",
    "cacheColdStorageObjects": "obiektów",
    "cacheTransientMemory": "Pamięć przejściowa cache",
    "cacheTransientShort": "RAZEM",
    "cacheFillShort": "fill",
    "cacheQueueShort": "kolejka cold",
    "cacheIoShort": "I/O cold",
@@ -1237,6 +1241,7 @@
    "processRssFile": "RSS plików / współdzielony",
    "processDataSwap": "Obszar danych / swap",
    "memoryAccountingHint": "RSS pokazuje rzeczywisty ślad pamięci procesu. HOT i pamięć przejściowa cache są księgowane przez RustProxy, a pamięć transformacji jest konserwatywną rezerwacją aktywnej pracy. RSS poza cache to RSS pomniejszony o księgowany cache i obejmuje m.in. transformacje, połączenia, TLS, logowanie, Tokio/runtime, narzut alokatora i inne bufory, więc nie wszystkie wiersze należy sumować.",
    "memoryAccountingInfo": "Informacje o rozliczaniu pamięci",
    "logTransport": "Transport",
    "logWebSocket": "WebSocket",
    "logUpstreamError": "Błąd upstreamu",
@@ -83,7 +83,7 @@ def add_file(archive: zipfile.ZipFile, rel: Path, data: bytes, timestamp: tuple[
 def main() -> None:
    parser = argparse.ArgumentParser(description=__doc__)
-    parser.add_argument('output', nargs='?', type=Path, default=ROOT.parent / 'RustProxy-0.24.7.zip')
+    parser.add_argument('output', nargs='?', type=Path, default=ROOT.parent / 'RustProxy-0.24.8.zip')
    output = parser.parse_args().output.resolve()
    paths = files()
    checksum = ROOT / 'SHA256SUMS'
@@ -16,7 +16,7 @@ def read_cache_source() -> str:
 preflight(root)
 manifest = tomllib.loads((root / "Cargo.toml").read_text())
-assert manifest["package"]["version"] == "0.24.7"
+assert manifest["package"]["version"] == "0.24.8"
 assert manifest["dependencies"]["quinn"]["version"] == "0.11.12"
 h3dep = manifest["dependencies"]["h3"]
 assert h3dep["package"] == "hpx-h3" and h3dep["version"] == "=2.5.19" and "quinn" in h3dep["features"]
@@ -24,14 +24,14 @@ assert "h3-quinn" not in manifest["dependencies"]
 lock_path = root / "Cargo.lock"
 if lock_path.exists():
    lock = lock_path.read_text()
-    assert 'name = "rust-proxy"\nversion = "0.24.7"' in lock
+    assert 'name = "rust-proxy"\nversion = "0.24.8"' in lock
    assert 'name = "systemstat"' in lock and 'name = "metrics-process"' in lock and 'name = "sysinfo"' in lock, "Cargo.lock must be resolver-generated after adding cross-platform statistics libraries"
 for release_doc, marker in {
-    "README.md": "# RustProxy 0.24.7",
+    "README.md": "# RustProxy 0.24.8",
-    "CHANGELOG.md": "## 0.24.7",
+    "CHANGELOG.md": "## 0.24.8",
-    "ROADMAP.md": "## 0.24.7",
+    "ROADMAP.md": "## 0.24.8",
-    "AGENTS.md": "Current source version: 0.24.7.",
+    "AGENTS.md": "Current source version: 0.24.8.",
-    "docs/TEST_REPORT.md": "# Verification report - RustProxy 0.24.7",
+    "docs/TEST_REPORT.md": "# Verification report - RustProxy 0.24.8",
 }.items():
    assert marker in (root / release_doc).read_text(), f"stale release identity in {release_doc}"
 assert tomllib.loads((root / "rust-toolchain.toml").read_text())["toolchain"]["channel"] == "stable"
@@ -53,7 +53,7 @@ for marker in [
    assert marker in update_check_source, marker
 assert 'update version document is too large or incomplete: {error}' in update_check_source
 assert '.context("update version document is too large or incomplete")' not in update_check_source
-for name in ["README.md", "ROADMAP.md", "AGENTS.md", "CHANGELOG.md", "UPDATE_CHECK.toml", "Dockerfile", ".dockerignore", "docs/TEST_REPORT.md", "docs/V0.24.7_AUDIT.md", "docs/V0.24.6_AUDIT.md", "docs/V0.24.5_AUDIT.md", "docs/V0.24.1_AUDIT.md", "docs/V0.24.0_AUDIT.md", "docs/V0.23.2_AUDIT.md", "docs/V0.23.1_AUDIT.md", "docs/V0.22.3_AUDIT.md", "docs/LIVE_LOGS.md", "docs/README.md", "docs/API.md", "docs/ARCHITECTURE.md", "docs/VHOSTS.md", "docs/STREAMS.md", "docs/REDIRECTS.md", "docs/CONTAINER.md", "docs/NPM_MIGRATION.md", "docs/DOCKER_DISCOVERY.md", "docker-agent/main.go", "docker-agent/main_test.go", "docker-agent/rustproxy-docker-agent.service", "docker-agent/docker-agent.env.example", "docker-agent/install.sh", "src/docker.rs", "src/admin/web/docker.js", "scripts/migrate_npm.py", "docs/CUSTOM_LOCATIONS.md", "nagios/README.md", "nagios/check_rustproxy.py", "nagios/check_rustproxy_api", "nagios/check_rustproxy_backends", "nagios/check_rustproxy_latency", "nagios/check_rustproxy_queues", "src/admin/web/error_401.html", "src/admin/web/error_404.html", "src/admin/web/streams.js", "src/admin/web/redirects.js", "src/admin/web/host404.js", "docs/NOT_FOUND_HOSTS.md", "debian/control", "debian/rules", "debian/rustproxy.service", "debian/rustproxy.logrotate", "debian/build-package.sh", "debian/build-repository.sh", "grafana/rustproxy-overview.json", "grafana/README.md"]:
+for name in ["README.md", "ROADMAP.md", "AGENTS.md", "CHANGELOG.md", "UPDATE_CHECK.toml", "Dockerfile", ".dockerignore", "docs/TEST_REPORT.md", "docs/V0.24.8_AUDIT.md", "docs/V0.24.7_AUDIT.md", "docs/V0.24.6_AUDIT.md", "docs/V0.24.5_AUDIT.md", "docs/V0.24.1_AUDIT.md", "docs/V0.24.0_AUDIT.md", "docs/V0.23.2_AUDIT.md", "docs/V0.23.1_AUDIT.md", "docs/V0.22.3_AUDIT.md", "docs/LIVE_LOGS.md", "docs/README.md", "docs/API.md", "docs/ARCHITECTURE.md", "docs/VHOSTS.md", "docs/STREAMS.md", "docs/REDIRECTS.md", "docs/CONTAINER.md", "docs/NPM_MIGRATION.md", "docs/DOCKER_DISCOVERY.md", "docker-agent/main.go", "docker-agent/main_test.go", "docker-agent/rustproxy-docker-agent.service", "docker-agent/docker-agent.env.example", "docker-agent/install.sh", "src/docker.rs", "src/admin/web/docker.js", "scripts/migrate_npm.py", "docs/CUSTOM_LOCATIONS.md", "nagios/README.md", "nagios/check_rustproxy.py", "nagios/check_rustproxy_api", "nagios/check_rustproxy_backends", "nagios/check_rustproxy_latency", "nagios/check_rustproxy_queues", "src/admin/web/error_401.html", "src/admin/web/error_404.html", "src/admin/web/streams.js", "src/admin/web/redirects.js", "src/admin/web/host404.js", "docs/NOT_FOUND_HOSTS.md", "debian/control", "debian/rules", "debian/rustproxy.service", "debian/rustproxy.logrotate", "debian/build-package.sh", "debian/build-repository.sh", "grafana/rustproxy-overview.json", "grafana/README.md"]:
    assert (root / name).is_file(), name
 for path in (root / "examples").glob("*.json"):
    data = json.loads(path.read_text())
@@ -200,7 +200,7 @@ assert 'Opt-in health decisions based on ordinary user traffic. Defaults to disa
 assert '"force_ssl"' in openapi and '"forward_client_ip"' in openapi
 assert '"backend_header"' in openapi and '"backend_timing_header"' in openapi
 assert '"StreamMetrics"' in openapi and '"streams"' in openapi
-for marker in ['"version": "0.24.7"', '"/api/config/{section}"', '"ConfigSectionUpdate"', '"cold_on_idle"', '"cold_on_age"', '"cold_max_hot_seconds"', '"cold_on_lru"', '"cold_on_shutdown"', '"cold_gc_interval_seconds"', '"cold_gc_max_delete"', '"collapse_enabled"', '"collapse_wait_timeout_ms"', '"collapse_timeout_fallback"', '"stale_if_error_timeout"', '"stale_if_error_connection"', '"stale_if_error_dns"', '"stale_if_error_tls"', '"stale_if_error_statuses"', '"proactive_refresh_enabled"', '"proactive_refresh_before_expiry_seconds"', '"proactive_refresh_percent"', '"proactive_refresh_max_inflight"', '"TransformSettings"', '"TransformOverrides"', '"/api/cache/cold/cleanup"', '"/api/cache/invalidate"', '"/api/cache/bans"', '"/api/cache/bans/{id}"', '"CacheInvalidationRequest"', '"CacheInvalidationResponse"', '"ColdCleanupJob"', '"match_type"', '"regex_insensitive"', '"rewrite"', '"response"', '"covered_hosts"', '"default": true']:
+for marker in ['"version": "0.24.8"', '"/api/config/{section}"', '"ConfigSectionUpdate"', '"cold_on_idle"', '"cold_on_age"', '"cold_max_hot_seconds"', '"cold_on_lru"', '"cold_on_shutdown"', '"cold_gc_interval_seconds"', '"cold_gc_max_delete"', '"collapse_enabled"', '"collapse_wait_timeout_ms"', '"collapse_timeout_fallback"', '"stale_if_error_timeout"', '"stale_if_error_connection"', '"stale_if_error_dns"', '"stale_if_error_tls"', '"stale_if_error_statuses"', '"proactive_refresh_enabled"', '"proactive_refresh_before_expiry_seconds"', '"proactive_refresh_percent"', '"proactive_refresh_max_inflight"', '"TransformSettings"', '"TransformOverrides"', '"/api/cache/cold/cleanup"', '"/api/cache/invalidate"', '"/api/cache/bans"', '"/api/cache/bans/{id}"', '"CacheInvalidationRequest"', '"CacheInvalidationResponse"', '"ColdCleanupJob"', '"match_type"', '"regex_insensitive"', '"rewrite"', '"response"', '"covered_hosts"', '"default": true']:
    assert marker in openapi, marker
 for marker in ['"NotFoundHost"', '"not_found_hosts"', '"PrometheusSettings"', '"allow_trusted_network_without_token"', '"include_docker_vhosts"', '"include_streams"', '"include_logging"']:
    assert marker in openapi, marker
@@ -590,7 +590,7 @@ assert 'if docker_targets.contains_key(id)' in prometheus_source
 assert 'rust_proxy_docker_vhost_exchange_duration_seconds' in prometheus_source
 settings_source = (root / 'src/admin/web/settings.js').read_text()
 assert 'prom-trusted-no-token' in settings_source and 'include_docker_vhosts' in settings_source and 'include_streams' in settings_source and 'include_logging' in settings_source
-for marker in ['cache-memory-breakdown', 'cache-transient-breakdown', 'cache-cold-storage', 'process-rss-total', 'memory-cache-hot', 'memory-cache-transient', 'memory-transform', 'memory-transform-inflight', 'memory-non-cache-rss', 'process-rss-anon', 'process-rss-file', 'process-data-swap', 'memoryAccountingHint']:
+for marker in ['cache-memory-breakdown', 'cache-transient-breakdown', 'cache-cold-storage', 'cache-transient-sparkline', 'cache-fill-sparkline', 'cache-queue-sparkline', 'cache-io-sparkline', 'cache-cold-sparkline', 'metric-info', 'process-rss-total', 'memory-cache-hot', 'memory-cache-transient', 'memory-transform', 'memory-transform-inflight', 'memory-non-cache-rss', 'process-rss-anon', 'process-rss-file', 'process-data-swap', 'memoryAccountingHint']:
    assert marker in html, marker
 for marker in ['validate_h3', 'H3Tunnel', 'h3_client_to_backend', 'backend_to_h3', 'rfc9220_bootstrap_uses_extended_connect_without_h1_proof_headers']:
    assert marker in ws_source, marker
@@ -605,7 +605,7 @@ for marker in ['location-help-dialog', 'cache-memory-sparkline', 'cache-hit-spar
    assert marker in html, marker
 for marker in ['locationMatchRegex', 'headersVisualBuilder', 'headersAdvancedJson', 'openLocationHelp', 'locationPreviewTitle', 'location-preview-grid', 'vh-header-rule-fields', 'cloudflare-client-ip', 'timing-headers']:
    assert marker in vhosts_js, marker
-for marker in ['lastApiLatencyMs', 'cacheMemorySamples', 'cacheHitSamples', 'processCpuSamples', 'processRssSamples', 'networkRxSamples', 'responseLatencySamples', 'client_ip']:
+for marker in ['lastApiLatencyMs', 'cacheMemorySamples', 'cacheTransientSamples', 'cacheColdStorageSamples', 'cacheHitSamples', 'processCpuSamples', 'processRssSamples', 'networkRxSamples', 'responseLatencySamples', 'client_ip']:
    assert marker in app_js, marker
 logging_source = (root / 'src/logging.rs').read_text()
 assert 'pub client_ip: Option<String>' in logging_source and '"client_ip" => entry.client_ip' in logging_source
@@ -1083,7 +1083,7 @@ assert 'id="process-platform"' in html and 'd.platform' in app_js
 assert 'id="panel-logging"' not in html
 assert 'id="settings-tab-logging"' in html and 'id="settings-page-logging"' in html and 'id="logging-form"' in html
 assert 'location.pathname === "/logging"' in settings_js_0241
-assert '"RuntimeInformation"' in openapi and '"version": "0.24.7"' in openapi
+assert '"RuntimeInformation"' in openapi and '"version": "0.24.8"' in openapi
 # 0.24.1 compiler and hostname-cardinality regressions.
 tls_0241 = (root / "src/tls.rs").read_text()
@@ -1128,5 +1128,5 @@ for schema_name in ["RedirectHost", "NotFoundHost"]:
    node = openapi_0241["components"]["schemas"][schema_name]["properties"]["frontend"]["properties"]["hosts"]
    assert "maxItems" not in node, schema_name
-print("PASS: 0.24.7 manifest/package, shared system-statistics/runtime metadata, Settings logging, retained H2, Debian/Grafana/Prometheus/404-host/custom-location/path/cache/dashboard/Nagios UI/source contracts, stopped legacy-renewal removal, session/admin/transport contracts, deterministic package source and embedded SQLite schema-v6 migrations.")
+print("PASS: 0.24.8 manifest/package, shared system-statistics/runtime metadata, Settings logging, retained H2, Debian/Grafana/Prometheus/404-host/custom-location/path/cache/dashboard/Nagios UI/source contracts, stopped legacy-renewal removal, session/admin/transport contracts, deterministic package source and embedded SQLite schema-v6 migrations.")
 print("NOT VERIFIED: Rust parsing, types, compilation, linking or runtime behavior. Run ./dev.sh test.")
@@ -97,7 +97,7 @@ def digest(path: Path) -> str:
 def fetch_https(url: str, max_bytes: int) -> bytes:
    if urllib.parse.urlparse(url).scheme != 'https':
        raise ValueError('GeoIP downloads require HTTPS.')
-    request = urllib.request.Request(url, headers={'User-Agent': 'RustProxy-installer/0.24.7'})
+    request = urllib.request.Request(url, headers={'User-Agent': 'RustProxy-installer/0.24.8'})
    with urllib.request.urlopen(request, timeout=30) as response:
        if urllib.parse.urlparse(response.geturl()).scheme != 'https':
            raise ValueError('GeoIP download redirected away from HTTPS.')
@@ -33,10 +33,10 @@ def check(root: Path, repair_known: bool = False) -> list[str]:
            raise ValueError(f"Conflicting Rust modules: {flat.relative_to(root)} and {module.relative_to(root)}")
    for path in ["src/auth/mod.rs", "src/auth/store.rs", "src/upstream.rs", "src/tls.rs", "src/proxy/websocket.rs", "src/cache/mod.rs", "src/cache/model.rs", "src/cache/lifecycle.rs", "src/cache/cold.rs", "src/cache/dashboard.rs", "src/cache/tickets.rs", "src/cache/lookup.rs", "src/cache/policy.rs", "src/cache/fill.rs", "src/cache/tests.rs", "src/settings.rs", "src/compression.rs", "src/diagnostics.rs", "src/system_stats/mod.rs", "src/system_stats/linux.rs", "src/vhost.rs", "src/balance.rs", "src/security.rs", "src/admin/web/vhosts.js", "src/admin/web/streams.js", "src/admin/web/host404.js", "src/admin/web/management.js", "src/pages.rs", "scripts/mock_server.py", "scripts/mock_auth.py", "src/forwarding.rs", "src/tinyauth.rs", "src/http3.rs", "src/stream.rs", "src/admin/web/integrations.js", "src/prometheus.rs", "src/admin/web/settings.js", "src/admin/web/docker.js", "src/docker.rs", "docker-agent/main.go", "docker-agent/main_test.go", "docker-agent/rustproxy-docker-agent.service", "docker-agent/install.sh", "docs/DOCKER_DISCOVERY.md", "scripts/acme_provider.py", "src/basic_auth.rs", "scripts/deploy.py", "scripts/migrate_npm.py", "docs/NPM_MIGRATION.md", "docs/STREAMS.md", "install.sh", "install-debian13.sh", "update.sh", "build.rs", "scripts/swagger_assets.py", "src/admin/documentation.rs", "src/admin/openapi.json", "langs/en_US.json", "langs/pl_pl.json", "Dockerfile", ".dockerignore", "docs/CONTAINER.md", "docs/PROMETHEUS.md", "docs/NOT_FOUND_HOSTS.md", "debian/control", "debian/rules", "debian/rustproxy.service", "debian/rustproxy.logrotate", "grafana/rustproxy-overview.json"]:
        if not (root / path).is_file():
-            raise ValueError(f"Incomplete RustProxy 0.24.7 source tree: missing {path}")
+            raise ValueError(f"Incomplete RustProxy 0.24.8 source tree: missing {path}")
    text = (root / "src/lib.rs").read_text(encoding="utf-8")
    if '#[path = "auth/mod.rs"]' not in text:
-        raise ValueError("src/lib.rs is not the 0.24.7 entry point; extract the complete package, not individual files.")
+        raise ValueError("src/lib.rs is not the 0.24.8 entry point; extract the complete package, not individual files.")
    return messages
@@ -113,13 +113,13 @@ def upgrade_smoke(tmp: Path) -> None:
    assert backup.is_dir()
    assert (backup / "src/obsolete.rs").is_file()
    assert not (target / "src/obsolete.rs").exists()
-    assert 'version = "0.24.7"' in (target / "Cargo.toml").read_text(encoding="utf-8")
+    assert 'version = "0.24.8"' in (target / "Cargo.toml").read_text(encoding="utf-8")
    assert (target / "data/keep.txt").read_text(encoding="utf-8") == "preserve\n"
    assert (target / ".env").read_text(encoding="utf-8") == "RUST_PROXY_DEMO=0\n"
    assert (target / "langs/site.json").is_file()
    assert (target / "docker-agent/main.go").is_file()
    manifest = json.loads((backup / "upgrade.json").read_text(encoding="utf-8"))
-    assert manifest["to_version"] == "0.24.7"
+    assert manifest["to_version"] == "0.24.8"
    assert manifest["removed_obsolete_runtime_state"] is True
    assert not legacy.exists()
    assert not (backup / "legacy-data").exists()
@@ -307,7 +307,7 @@ def ui_contract_smoke() -> None:
    assert 'data-panel="configuration"' not in html and 'id="panel-configuration"' not in html
    assert html.index('data-panel="vhosts"') < html.index('data-panel="redirects"') < html.index('data-panel="notfound"') < html.index('data-panel="streams"') < html.index('data-panel="acl-profiles"')
    assert "matching_resident_bytes" in cache and "matching_body_bytes" in cache
-    for marker in ["cache-memory-breakdown", "cache-transient-breakdown", "cache-cold-storage", "process-rss-total", "memory-cache-hot", "memory-cache-transient", "memory-transform", "memory-transform-inflight", "memory-non-cache-rss", "process-rss-anon", "process-rss-file", "process-data-swap", "memoryAccountingHint"]:
+    for marker in ["cache-memory-breakdown", "cache-transient-breakdown", "cache-cold-storage", "cache-transient-sparkline", "cache-fill-sparkline", "cache-queue-sparkline", "cache-io-sparkline", "cache-cold-sparkline", "metric-info", "process-rss-total", "memory-cache-hot", "memory-cache-transient", "memory-transform", "memory-transform-inflight", "memory-non-cache-rss", "process-rss-anon", "process-rss-file", "process-data-swap", "memoryAccountingHint"]:
        assert marker in html, marker
    for marker in ["transient_bytes", "fill_bytes_active", "cold_queue_bytes", "cold_write_bytes_active", "cold_read_bytes_active", "process_rss_anon_bytes", "process_rss_file_bytes"]:
        assert marker in app or marker in cache, marker
@@ -495,7 +495,7 @@ def source_contract_smoke() -> None:
        assert marker in admin, marker
    anonymous_block = admin.split("fn anonymous_allowed", 1)[1].split("const CERTIFICATE_API_KEY_HEADER", 1)[0]
    assert '"/api/status"' not in anonymous_block
-    assert '"RuntimeInformation"' in openapi_0241 and '"version": "0.24.7"' in openapi_0241
+    assert '"RuntimeInformation"' in openapi_0241 and '"version": "0.24.8"' in openapi_0241
    assert 'id="panel-logging"' not in html
    for marker in ['id="settings-tab-logging"', 'id="settings-page-logging"', 'id="logging-form"']:
        assert marker in html, marker
@@ -936,7 +936,7 @@ def source_contract_smoke() -> None:
    assert "removed_obsolete_runtime_state" in upgrade_source and "legacy-data" not in upgrade_source and "certs_dir.is_symlink()" in upgrade_source
    assert '.managed-update' in main and "flush_hot_to_cold_for_update" in main
    openapi = (ROOT / "src/admin/openapi.json").read_text(encoding="utf-8")
-    for marker in ['"version": "0.24.7"', '"memory_preset"', '"cold_preset"', '"memory_budget_bytes"', '"max_inflight"', '"preset"', '"session_days"', '"session_lifetime_seconds"', '"accept_local_listener_risk"', '"backend_header"', '"backend_timing_header"', '"cold_on_age"', '"match_type"', '"regex_insensitive"', '"NotFoundHost"', '"not_found_hosts"', '"PrometheusSettings"', '"allow_trusted_network_without_token"', '"include_docker_vhosts"', '"include_streams"', '"include_logging"']:
+    for marker in ['"version": "0.24.8"', '"memory_preset"', '"cold_preset"', '"memory_budget_bytes"', '"max_inflight"', '"preset"', '"session_days"', '"session_lifetime_seconds"', '"accept_local_listener_risk"', '"backend_header"', '"backend_timing_header"', '"cold_on_age"', '"match_type"', '"regex_insensitive"', '"NotFoundHost"', '"not_found_hosts"', '"PrometheusSettings"', '"allow_trusted_network_without_token"', '"include_docker_vhosts"', '"include_streams"', '"include_logging"']:
        assert marker in openapi, marker
    assert '"software_update"' in openapi and '"update_available"' in openapi
    for marker in ['"/api/certificates/deploy"', '"CertificateDeploy"', '"CertificateDeployResult"', '"/api/certificates/reload"']:
@@ -1084,7 +1084,7 @@ def main() -> None:
    source_contract_smoke()
    container_contract_smoke()
    debian_grafana_contract_smoke()
-    print("PASS: 0.24.7 SQLite/upgrade, local-response 404 hosts, Prometheus/Grafana diagnostics, Debian packaging, cache/dashboard/logging/Nagios, retained admin/H3/stream/TLS contracts and reproducible source archives.")
+    print("PASS: 0.24.8 SQLite/upgrade, local-response 404 hosts, Prometheus/Grafana diagnostics, Debian packaging, cache/dashboard/logging/Nagios, retained admin/H3/stream/TLS contracts and reproducible source archives.")
 if __name__ == "__main__":
@@ -76,10 +76,10 @@ ENV_FILE=scripts/routeros-oci-build/.env \
  bash scripts/routeros-oci-build/build-routeros-oci.sh push
 ```
-With RustProxy version `0.24.7` and the defaults this publishes:
+With RustProxy version `0.24.8` and the defaults this publishes:
 ```text
-zot.example.net/network/rustproxy:0.24.7
+zot.example.net/network/rustproxy:0.24.8
 zot.example.net/network/rustproxy:latest
 zot.example.net/network/rustproxy:routeros
 ```
@@ -85,7 +85,7 @@ def download(destination: Path) -> None:
    """TLS verification uses Python's default trust store; never executes a shell."""
    started = time.monotonic()
    opener = build_opener(HttpsRedirects())
-    request = Request(DOWNLOAD_URL, headers={"User-Agent": "RustProxy-build/0.24.7"})
+    request = Request(DOWNLOAD_URL, headers={"User-Agent": "RustProxy-build/0.24.8"})
    with opener.open(request, timeout=30) as response, destination.open("wb") as output:
        length = response.headers.get("Content-Length")
        if length and int(length) > MAX_ARCHIVE:
@@ -46,7 +46,7 @@ def upgrade(source: Path, target: Path, *, stopped: bool, data_dir: Path | None
        for name in MANAGED:
            if (target / name).is_symlink():
                raise ValueError(f"Managed target {name} is a symlink; refusing to replace it.")
-        backup = target / ".upgrade-backup" / ("before-0.24.7-" + uuid.uuid4().hex[:12])
+        backup = target / ".upgrade-backup" / ("before-0.24.8-" + uuid.uuid4().hex[:12])
        backup.mkdir(parents=True, mode=0o700)
        installed: list[str] = []
        moved: list[str] = []
@@ -84,7 +84,7 @@ def upgrade(source: Path, target: Path, *, stopped: bool, data_dir: Path | None
            remove_legacy = legacy.exists()
            if remove_legacy and (legacy.is_symlink() or not legacy.is_file()):
                raise ValueError("Obsolete renewal observation sidecar must be a regular file.")
-            (backup / "upgrade.json").write_text(json.dumps({"from_directory":str(target), "to_version":"0.24.7", "managed_paths":MANAGED, "removed_obsolete_runtime_state": remove_legacy}, indent=2)+"\n", encoding="utf-8")
+            (backup / "upgrade.json").write_text(json.dumps({"from_directory":str(target), "to_version":"0.24.8", "managed_paths":MANAGED, "removed_obsolete_runtime_state": remove_legacy}, indent=2)+"\n", encoding="utf-8")
            if remove_legacy:
                legacy.unlink()
        except BaseException:
@@ -115,7 +115,7 @@ def main() -> None:
        backup = upgrade(Path(__file__).resolve().parents[1], args.target, stopped=args.stopped, data_dir=data_dir)
    except (OSError, ValueError) as error:
        parser.exit(2, f"Upgrade refused or rolled back: {error}\n")
-    print(f"Installed RustProxy 0.24.7. Previous managed source files: {backup}")
+    print(f"Installed RustProxy 0.24.8. Previous managed source files: {backup}")
    print("Preserved data, .env, .git, target and other unmanaged files. No database migration was run.")
    print(f"Next: cd {args.target}; ./dev.sh test; ./dev.sh")
@@ -2,7 +2,7 @@
  "openapi": "3.0.3",
  "info": {
    "title": "RustProxy Administration API",
-    "version": "0.24.7",
+    "version": "0.24.8",
    "description": "Administration API for the active panel origin. Sign in through the panel; the same-origin HttpOnly cookie authenticates all private operations. Mutations also require the exact Origin, X-RustProxy-Request: 1 and a session-bound X-CSRF-Token. Loopback HTTP is the default; Settings can enable HTTPS before using a non-loopback administration bind. This document contains no live configuration or credentials. Object schemas marked extensible are summaries: full configuration validation is authoritative in Rust."
  },
  "servers": [
@@ -506,7 +506,7 @@ $("reload-certificates").addEventListener("click", async () => {
 $("reset-certificate").addEventListener("click", () => $("certificate-form").reset());
 // Dashboard metrics are actual server samples. Null means unavailable, not zero.
-let systemSamples = [], connectionOpenSamples = [], connectionExchangeSamples = [], cacheMemorySamples = [], cacheHitSamples = [], cacheMissSamples = [], cacheBypassSamples = [], lastCacheCounters = null,
+let systemSamples = [], connectionOpenSamples = [], connectionExchangeSamples = [], cacheMemorySamples = [], cacheTransientSamples = [], cacheFillSamples = [], cacheColdQueueSamples = [], cacheColdIoSamples = [], cacheColdStorageSamples = [], cacheHitSamples = [], cacheMissSamples = [], cacheBypassSamples = [], lastCacheCounters = null,
    processCpuSamples = [], processRssSamples = [], networkRxSamples = [], networkTxSamples = [], responseLatencySamples = [], networkInterfaceSamples = new Map(), settingsDirty = new Set();
 const hiddenNetworkInterfaces = (() => {
    try {
@@ -545,6 +545,12 @@ function knownPair(left, right, format, zeroRight = null) {
    const rightText = right === 0 && zeroRight ? zeroRight : format(right);
    return `${format(left)} / ${rightText}`;
 }
 function occupancyText(used, limit) {
    if (used == null) return "-";
    const usedNumber = Number(used), limitNumber = Number(limit);
    if (!Number.isFinite(limitNumber) || limitNumber <= 0) return fmtBytes(usedNumber);
    return `${fmtBytes(usedNumber)} / ${fmtBytes(limitNumber)} · ${fmt(usedNumber / limitNumber * 100, 1)}%`;
 }
 function sparklinePoints(values, width = 300, height = 60, padding = 5, peakOverride = null) {
    const peak = Math.max(1, peakOverride ?? Math.max(0, ...values));
    return values.map((value, index) => `${index * width / Math.max(1, values.length - 1)},${height - padding - Math.max(0, value) / peak * (height - padding * 2)}`).join(" ");
@@ -642,6 +648,12 @@ function renderDiagnostics(status, appendSample = true) {
    $("cache-evictions").textContent = `${fmt(c.evictions)} / ${fmt(c.expired)}`;
    if (appendSample) {
        if (c.resident_bytes != null) { cacheMemorySamples.push(Number(c.resident_bytes)); cacheMemorySamples = cacheMemorySamples.slice(-60); }
        if (c.transient_bytes != null) { cacheTransientSamples.push(Number(c.transient_bytes)); cacheTransientSamples = cacheTransientSamples.slice(-60); }
        if (c.fill_bytes_active != null) { cacheFillSamples.push(Number(c.fill_bytes_active)); cacheFillSamples = cacheFillSamples.slice(-60); }
        if (c.cold_queue_bytes != null) { cacheColdQueueSamples.push(Number(c.cold_queue_bytes)); cacheColdQueueSamples = cacheColdQueueSamples.slice(-60); }
        const coldIoBytes = (Number(c.cold_write_bytes_active) || 0) + (Number(c.cold_read_bytes_active) || 0);
        if (c.cold_write_bytes_active != null || c.cold_read_bytes_active != null) { cacheColdIoSamples.push(coldIoBytes); cacheColdIoSamples = cacheColdIoSamples.slice(-60); }
        if (c.cold_bytes != null) { cacheColdStorageSamples.push(Number(c.cold_bytes)); cacheColdStorageSamples = cacheColdStorageSamples.slice(-60); }
        const currentCounters = [c.hits, c.misses, c.bypasses].map(Number);
        if (currentCounters.every(Number.isFinite)) {
            const delta = lastCacheCounters ? currentCounters.map((value, index) => value >= lastCacheCounters[index] ? value - lastCacheCounters[index] : 0) : [0, 0, 0];
@@ -658,8 +670,22 @@ function renderDiagnostics(status, appendSample = true) {
    $("cache-bypass-sparkline").setAttribute("points", sparklinePoints(cacheBypassSamples, 300, 60, 5, cacheOutcomePeak));
    const latestCacheDelta = [cacheHitSamples.at(-1), cacheMissSamples.at(-1), cacheBypassSamples.at(-1)];
    $("cache-outcome-chart-value").textContent = latestCacheDelta.every(value => value != null) ? latestCacheDelta.map(value => fmt(value)).join(" / ") : "-";
-    $("cache-memory-sparkline").setAttribute("points", sparklinePoints(cacheMemorySamples));
+    const hotLimit = Number(c.hot_limit_bytes), hotPeak = Number.isFinite(hotLimit) && hotLimit > 0 ? Math.max(hotLimit, ...cacheMemorySamples) : null;
-    $("cache-chart-value").textContent = fmtBytes(c.resident_bytes);
+    $("cache-memory-sparkline").setAttribute("points", sparklinePoints(cacheMemorySamples, 300, 60, 5, hotPeak));
    $("cache-chart-value").textContent = occupancyText(c.resident_bytes, c.hot_limit_bytes);
    const transientLimit = Number(c.transient_limit_bytes);
    const transientPeak = Number.isFinite(transientLimit) && transientLimit > 0
        ? Math.max(transientLimit, ...cacheTransientSamples, ...cacheFillSamples, ...cacheColdQueueSamples, ...cacheColdIoSamples)
        : Math.max(1, ...cacheTransientSamples, ...cacheFillSamples, ...cacheColdQueueSamples, ...cacheColdIoSamples);
    $("cache-transient-sparkline").setAttribute("points", sparklinePoints(cacheTransientSamples, 300, 60, 5, transientPeak));
    $("cache-fill-sparkline").setAttribute("points", sparklinePoints(cacheFillSamples, 300, 60, 5, transientPeak));
    $("cache-queue-sparkline").setAttribute("points", sparklinePoints(cacheColdQueueSamples, 300, 60, 5, transientPeak));
    $("cache-io-sparkline").setAttribute("points", sparklinePoints(cacheColdIoSamples, 300, 60, 5, transientPeak));
    $("cache-transient-chart-value").textContent = occupancyText(c.transient_bytes, c.transient_limit_bytes);
    const coldEnabled = envelope?.config.cache?.cold_enabled === true;
    const coldLimit = Number(c.cold_limit_bytes), coldPeak = Number.isFinite(coldLimit) && coldLimit > 0 ? Math.max(coldLimit, ...cacheColdStorageSamples) : null;
    $("cache-cold-sparkline").setAttribute("points", sparklinePoints(cacheColdStorageSamples, 300, 60, 5, coldPeak));
    $("cache-cold-chart-value").textContent = coldEnabled ? occupancyText(c.cold_bytes, c.cold_limit_bytes) : t("notEnabled");
    setOptionalMetric("process-platform", !!d.platform && d.platform !== "Unsupported", d.platform || "");
    setOptionalMetric("process-cpu", d.process_cpu_percent != null, `${fmt(d.process_cpu_percent, 1)}%`);
    const fds = knownPair(d.open_fds, d.max_fds, value => fmt(value), t("unlimited"));
@@ -752,7 +778,7 @@ function renderSettings() {
    if (!settingsDirty.has("response-form")) {
        const server = config.server_header || {}, compression = config.compression || {}, diagnostics = config.diagnostic_headers || {};
        $("expose-request-id").checked = !!diagnostics.request_id;
-        $("server-mode").value = server.mode || "preserve"; $("server-value").value = server.value || "RustProxy/v0.24.7";
+        $("server-mode").value = server.mode || "preserve"; $("server-value").value = server.value || "RustProxy/v0.24.8";
        for (const name of ["gzip", "br", "zstd", "deflate"]) $(`compress-${name}`).checked = !!compression[name];
        $("compress-min").value = compression.min_bytes ?? 1024; syncServerMode();
    }
@@ -294,12 +294,43 @@
                                            class="cache-bypass-key">BYPASS</span></div>
                                </div>
                                <div class="mini-live-chart">
-                                    <div class="mini-live-chart-head"><span data-i18n="cacheResidentHistory">Resident
+                                    <div class="mini-live-chart-head"><span data-i18n="cacheHotMemoryHistory">HOT RAM
-                                            RAM history</span><b id="cache-chart-value">-</b></div>
+                                            usage / limit</span><b id="cache-chart-value">-</b></div>
-                                    <svg aria-label="RAM cache resident bytes history"
+                                    <svg aria-label="HOT cache RAM usage history"
-                                        data-i18n-aria="cacheResidentHistory" role="img" viewbox="0 0 300 60">
+                                        data-i18n-aria="cacheHotMemoryHistory" role="img" viewbox="0 0 300 60">
                                        <path class="chart-grid" d="M0 15H300 M0 30H300 M0 45H300"></path>
-                                        <polyline class="diagnostic-line" id="cache-memory-sparkline"
+                                        <polyline class="diagnostic-line cache-hot-line" id="cache-memory-sparkline"
                                            points="0,55 300,55"></polyline>
                                    </svg>
                                </div>
                                <div class="mini-live-chart">
                                    <div class="mini-live-chart-head"><span data-i18n="cacheTransientMemoryHistory">Transient
                                            RAM usage / limit</span><b id="cache-transient-chart-value">-</b></div>
                                    <svg aria-label="Transient cache RAM usage history"
                                        data-i18n-aria="cacheTransientMemoryHistory" role="img" viewbox="0 0 300 60">
                                        <path class="chart-grid" d="M0 15H300 M0 30H300 M0 45H300"></path>
                                        <polyline class="diagnostic-line cache-transient-total-line" id="cache-transient-sparkline"
                                            points="0,55 300,55"></polyline>
                                        <polyline class="diagnostic-line cache-fill-line" id="cache-fill-sparkline"
                                            points="0,55 300,55"></polyline>
                                        <polyline class="diagnostic-line cache-queue-line" id="cache-queue-sparkline"
                                            points="0,55 300,55"></polyline>
                                        <polyline class="diagnostic-line cache-io-line" id="cache-io-sparkline"
                                            points="0,55 300,55"></polyline>
                                    </svg>
                                    <div class="mini-chart-legend" aria-hidden="true"><span
                                            class="cache-transient-total-key" data-i18n="cacheTransientShort">TOTAL</span><span
                                            class="cache-fill-key" data-i18n="cacheFillShort">fill</span><span
                                            class="cache-queue-key" data-i18n="cacheQueueShort">cold queue</span><span
                                            class="cache-io-key" data-i18n="cacheIoShort">cold I/O</span></div>
                                </div>
                                <div class="mini-live-chart">
                                    <div class="mini-live-chart-head"><span data-i18n="cacheColdStorageHistory">COLD storage
                                            usage / limit</span><b id="cache-cold-chart-value">-</b></div>
                                    <svg aria-label="COLD storage usage history"
                                        data-i18n-aria="cacheColdStorageHistory" role="img" viewbox="0 0 300 60">
                                        <path class="chart-grid" d="M0 15H300 M0 30H300 M0 45H300"></path>
                                        <polyline class="diagnostic-line cache-cold-line" id="cache-cold-sparkline"
                                            points="0,55 300,55"></polyline>
                                    </svg>
                                </div>
@@ -307,8 +338,16 @@
                        </article>
                        <article class="card">
                            <div class="mini-heading">
-                                <h3 data-i18n="processDiagnostics">Process</h3><span class="meta"
+                                <h3 data-i18n="processDiagnostics">Process</h3>
-                                    id="system-sample-age">-</span>
+                                <div class="mini-heading-actions">
                                    <details class="metric-info">
                                        <summary data-i18n-aria="memoryAccountingInfo" aria-label="Memory accounting information">i</summary>
                                        <div class="metric-info-popover">
                                            <p class="fine" data-i18n="memoryAccountingHint">RSS is the real process footprint. HOT/transient cache values are RustProxy-accounted allocations; transform memory is a conservative active reservation. Non-cache RSS is RSS minus accounted cache and includes transforms, connections, TLS, logging, Tokio/runtime state, allocator overhead and other buffers, so these rows are not all additive.</p>
                                        </div>
                                    </details>
                                    <span class="meta" id="system-sample-age">-</span>
                                </div>
                            </div>
                            <dl class="mini-metrics">
                                <div>
@@ -380,7 +419,6 @@
                                    <dd id="cgroup-memory">-</dd>
                                </div>
                            </dl>
                            <p class="fine" data-i18n="memoryAccountingHint">RSS is the real process footprint. HOT/transient cache values are RustProxy-accounted allocations; transform memory is a conservative active reservation. Non-cache RSS is RSS minus accounted cache and includes transforms, connections, TLS, logging, Tokio/runtime state, allocator overhead and other buffers, so these rows are not all additive.</p>
                            <div class="mini-live-chart-stack">
                                <div class="mini-live-chart">
                                    <div class="mini-live-chart-head"><span data-i18n="processCpuHistory">Process CPU
@@ -1353,7 +1391,7 @@
                                    <option data-i18n="serverCustom" value="custom">Replace / add custom value</option>
                                </select>
                                <label data-i18n="serverValue" for="server-value">Custom Server value</label><input
-                                    id="server-value" maxlength="256" placeholder="RustProxy/v0.24.7"
+                                    id="server-value" maxlength="256" placeholder="RustProxy/v0.24.8"
                                    spellcheck="false" />
                                <h3 class="subheading" data-i18n="diagnosticHeaders">Diagnostic headers</h3>
                                <div class="switch-grid">
@@ -2060,7 +2098,7 @@
                        </section>
                    </div>
                </section>
-                <footer class="page-footer"><span>RustProxy <b>0.24.7</b></span><span id="footer-status">API - /
+                <footer class="page-footer"><span>RustProxy <b>0.24.8</b></span><span id="footer-status">API - /
                        dropped: 0</span></footer>
            </div>
        </main>
@@ -7351,4 +7351,95 @@ body[data-density="compact"] .page-footer {
 #cache-memory-warning {
    color: var(--notice-text);
    font-weight: 600;
-}
+}
 /* 0.24.8 cache occupancy charts and compact memory-accounting help */
 .mini-heading-actions {
    display: inline-flex;
    align-items: center;
    justify-content: flex-end;
    gap: 7px;
    min-width: 0;
 }
 .metric-info {
    position: relative;
 }
 .metric-info>summary {
    width: 18px;
    height: 18px;
    display: inline-grid;
    place-items: center;
    list-style: none;
    cursor: pointer;
    border: 1px solid var(--line);
    border-radius: 50%;
    color: var(--muted);
    background: var(--panel2);
    font: 700 10px var(--mono);
    user-select: none;
 }
 .metric-info>summary::-webkit-details-marker {
    display: none;
 }
 .metric-info>summary:hover,
 .metric-info>summary:focus-visible,
 .metric-info[open]>summary {
    color: var(--text);
    border-color: var(--border-hover);
    outline: none;
 }
 .metric-info-popover {
    position: absolute;
    z-index: 40;
    top: calc(100% + 7px);
    right: 0;
    width: min(360px, calc(100vw - 44px));
    padding: 10px 11px;
    border: 1px solid var(--line);
    border-radius: 6px;
    background: var(--panel2);
    box-shadow: 0 12px 30px var(--shadow-mid);
 }
 .metric-info-popover .fine {
    margin: 0;
    line-height: 1.5;
 }
 .cache-hot-line,
 .cache-transient-total-line {
    stroke: var(--accent);
 }
 .cache-fill-line {
    stroke: var(--green);
 }
 .cache-queue-line,
 .cache-cold-line {
    stroke: var(--blue);
 }
 .cache-io-line {
    stroke: var(--transform-chart);
 }
 .cache-transient-total-key {
    color: var(--accent);
 }
 .cache-fill-key {
    color: var(--green);
 }
 .cache-queue-key {
    color: var(--blue);
 }
 .cache-io-key {
    color: var(--transform-chart);
 }
@@ -600,7 +600,7 @@
    authMode.addEventListener("change", syncAuth); syncAuth();
    g = group("vhResponsePolicy"); const server = value.server_header, diagnostics = value.diagnostic_headers;
    const serverMode = field(g, "server-mode", "serverHeader", server?.mode || "inherit", "select", { values: [["inherit", "vhInherit"], ["preserve", "serverPreserve"], ["hide", "serverHide"], ["custom", "serverCustom"]] });
-    const serverValue = field(g, "server-value", "serverValue", server?.value || "RustProxy/v0.24.7", "text", { maxLength: 256 });
+    const serverValue = field(g, "server-value", "serverValue", server?.value || "RustProxy/v0.24.8", "text", { maxLength: 256 });
    const syncServer = () => { serverValue.disabled = serverMode.value !== "custom"; serverValue.required = !serverValue.disabled; }; serverMode.addEventListener("change", syncServer); syncServer();
    const inheritDiagnostics = field(g, "diag-inherit", "diagInherit", !diagnostics, "checkbox"), diagInputs = [];
    for (const [name, key] of [["request_id", "diagRequestId"]]) diagInputs.push(field(g, `diag-${name}`, key, diagnostics?.[name] ?? envelope?.config.diagnostic_headers?.[name], "checkbox"));
@@ -40,7 +40,7 @@ use zeroize::Zeroizing;
 #[command(
    name = "rust-proxy",
    version,
-    about = "RustProxy - independent Rust reverse proxy 0.24.7"
+    about = "RustProxy - independent Rust reverse proxy 0.24.8"
 )]
 struct Cli {
    #[arg(
@@ -1426,7 +1426,7 @@ async fn live_logs_command(dir: PathBuf, addr: SocketAddr) -> Result<()> {
            }
        });
        let interactive = io::stdin().is_terminal() && io::stdout().is_terminal();
-        println!("RustProxy live logs 0.24.7 - all vhosts. Type 'help' for interactive filters; Ctrl-C or 'quit' exits.");
+        println!("RustProxy live logs 0.24.8 - all vhosts. Type 'help' for interactive filters; Ctrl-C or 'quit' exits.");
        if interactive { print!("> "); io::stdout().flush()?; }
        let mut filters = LiveLogFilters::default();
        let mut history = std::collections::BTreeMap::<u64, serde_json::Value>::new();
`@@ -1,4 +1,4 @@`
	`# Administration API access - 0.24.7`	`# Administration API access - 0.24.8`

	`## Sign-in boundary`	`## Sign-in boundary`