v0.25.2

ROADMAP.md

@@ -1,5 +1,16 @@
 # RustProxy roadmap
 
+## 0.25.2 - Live backup and resumed-session hardening
+
+Current direction: 0.25.1 -> 0.25.2
+
+- [x] Allow encrypted full-backup creation while RustProxy owns the data-directory process lock.
+- [x] Snapshot SQLite consistently and stage durable files before archive encryption.
+- [x] Preserve only validated relative symlinks that resolve inside the staged data tree, including Certbot `live` -> `archive` links.
+- [x] Keep restore offline, validated, staged and atomically activated.
+- [x] Recover transient invalid-origin state in restored/resumed admin tabs with a one-shot same-origin reload, without weakening server Host/Origin/CSRF checks.
+- [ ] Run compiler-enabled `cargo fmt --all`, `cargo check --locked --all-targets` and `cargo test --locked --all-targets` on the release host.
+
 ## 0.25.1 - Traffic UX and source modularization
 
 Current direction: 0.25.0 -> 0.25.1
@@ -9,6 +20,7 @@ Current direction: 0.25.0 -> 0.25.1
 - [x] Keep every Rust source file at or below 500 lines and keep unit tests outside implementation files.
 - [x] Split oversized dashboard source bundles and the Docker Agent into bounded source modules while preserving behavior and URLs.
 - [x] Guard the Web Server split against dangling attributes and missing `htaccess`, `server_protocol` and `anyhow::Context` imports.
+- [ ] Run compiler-enabled `cargo fmt --all`, `cargo check --locked --all-targets` and `cargo test --locked --all-targets` on the release host.
 
 ## 0.25.0 - Web Server foundation
 
@@ -35,6 +47,7 @@ Current direction: 0.24.10 -> 0.25.0
 - [x] Keep Web Server inside the existing routing, ACL/auth, custom-header/error-page/security and H1/H2/H3 response pipeline; do not create separate routing/error/cache subsystems.
 - [x] Add unit/source-contract coverage, OpenAPI/UI language coverage and Web Server documentation.
 - [x] Clean README/Docs/CHANGELOG/ROADMAP material, add a canonical docs index, authenticated Markdown Reader, 0.25 specification audit and open-work TODO.
+- [ ] Run compiler-enabled `./dev.sh fmt`, `./dev.sh check`, `./dev.sh test` plus live H1/H2/H3/static-file acceptance on the release host.
 
 ## Web Server follow-up