v0.24.7

docs/TEST_REPORT.md

@@ -1,23 +1,21 @@
-# Verification report - RustProxy 0.24.5
+# Verification report - RustProxy 0.24.7
 
 ## Scope
 
-RustProxy 0.24.5 is a protocol-framing and cache-memory maintenance release over 0.24.4. It keeps the 0.24.4 process-local THP mitigation, fixes the H3 -> H1 boundary for actually empty request bodies whose length is initially unknown, and hardens the existing HOT RAM -> COLD disk cache lifecycle without changing the COLD storage format.
+RustProxy 0.24.7 makes transformation memory/concurrency limits configurable and adds persisted RAM saver, Recommended, Performance and Uber performance resource presets. The same version now exposes live transform resource usage, overview process/cache RAM accounting and COLD disk occupancy. It retains the 0.24.6 cache/background-worker memory hardening.
 
 ## Source contracts reviewed
 
-- `ReceiveBody` in `src/http3.rs` reports end-of-stream only after the H3 DATA side reaches EOF and trailers are resolved; absence of `Content-Length` alone is not treated as proof of an empty body.
-- `normalize_h3_h1_unknown_body()` runs only for HTTP/3 requests selected for an HTTP/1.1 upstream and only when no declared/exact body length is already available.
-- EOF replaces the request body with `Body::empty()`. Non-empty first frames are replayed through `ReplayBody` and the remaining request body stays streaming.
-- HTTP/2 upstreams, non-H3 downstreams and declared `Content-Length` requests are not pre-read by this normalization.
-- The change is generic to body-capable methods; there is no Proxmox-specific or DELETE-to-H2 fallback.
-- Published HOT objects are bounded by `max_bytes` using body backing capacity plus directly owned metadata and a conservative HOT-index charge; logical payload bytes are reported separately.
-- Fill buffers reserve a bounded transient budget before growth, enforce `max_object_bytes` per chunk, and make HOT LRU room before further cache-buffer allocation. Failure leaves the response streaming uncached.
-- HOT -> COLD demotion moves the `Entry` rather than cloning the payload. The `Bytes` allocation remains charged to transient RAM while queued/writing and disappears from the persisted `ColdEntry` after the write completes.
-- The COLD writer queue is bounded by both object count and bytes; full COLD reads/promotions/revalidation reads reserve transient RAM before loading a body.
-- Global `cache.enabled=false` is authoritative over vhost overrides. HOT/object values no longer have the old artificial 1 GiB configuration ceiling.
-- Settings exposes conservative/recommended/performance presets derived from effective host/cgroup memory, plus non-blocking high-budget/headroom and inconsistent transient/object/queue warnings. A 2 GiB effective-memory VM gets approximately 400 MiB HOT / 96 MiB transient / 16 MiB max object / 48 MiB COLD queue under the recommended profile.
-- Release identity is 0.24.5 across Cargo/package/UI/OpenAPI/release helpers. The existing dependency graph is unchanged; only the root `rust-proxy` package version changes.
+- Transform `preset`, `memory_budget_bytes` and `max_inflight` are part of the normal revisioned Settings document and therefore persist in SQLite; the reopen test covers them.
+- Existing configurations default to 128 MiB transform temporary memory and 32 concurrent attempts.
+- New transform attempts use atomic runtime byte/concurrency reservations and fail open with fixed `memory_pressure` / `concurrency_pressure` reasons rather than queueing full-body work.
+- Presets modify only resource limits; transform type switches and extension allow-lists remain independent.
+- Global transform representation/eligibility settings participate in cache compatibility identity. Resource-only preset/budget/concurrency fields do not.
+- OpenAPI and both language packs expose the new controls and preset states.
+- `GET /api/status` exposes `transform_resources` and `memory_accounting`; the latter keeps process RSS separate from HOT/transient cache accounting and treats transform bytes as an overlapping conservative reservation.
+- Cache runtime telemetry exposes COLD byte/object limits so the overview can show disk occupancy against configured capacity without mixing disk and RAM.
+- `GET /api/transform` exposes current process-wide reserved transform bytes and active slots alongside the existing counters.
+- 0.24.6 aggregate/decode bounds, allocation reductions and bounded cache/background workers remain in place.
 
 ## Verification status in this workspace
 
@@ -25,28 +23,17 @@ RustProxy 0.24.5 is a protocol-framing and cache-memory maintenance release over
 |---|---|
 | `python3 scripts/preflight.py` | PASS |
 | `python3 scripts/langs_check.py` | PASS |
-| Browser JavaScript `node --check` | PASS |
+| `python3 scripts/memory_contracts.py` | PASS |
+| Browser JavaScript `node --check` | PASS for all administration JS bundles |
+| OpenAPI/language JSON parse | PASS |
 | Shell `bash -n` | PASS |
 | Python syntax / bytecode compile | PASS |
 | Docker agent `go test ./...` / `go vet ./...` / `go build ./...` | PASS |
-| Existing `Cargo.lock` dependency graph | PRESERVED; root package version updated to 0.24.5 |
 | `python3 scripts/check_source.py` | PASS |
 | `python3 scripts/release_smoke.py` | PASS |
 | `./dev.sh fmt` / `cargo fmt --all` | BLOCKED: Rust/Cargo toolchain unavailable in this workspace |
 | `./dev.sh check` / `cargo check --locked --all-targets` | BLOCKED: Rust/Cargo toolchain unavailable in this workspace |
 | `./dev.sh test` Rust phase | BLOCKED: Rust/Cargo toolchain unavailable in this workspace |
-| H1/H2/H3 live method matrix | test-host acceptance gate |
-| Proxmox DELETE H3 access-log verification | test-host acceptance gate |
-| HOT 8 MiB sustained-load/RSS acceptance | test-host acceptance gate |
-| HOT 2 GiB bounded-admission acceptance | test-host acceptance gate |
-| 5 s HOT -> COLD demotion/RSS/transient drain | test-host acceptance gate |
-| Oversized-object streaming without full cache buffering | source regression added; runtime acceptance gate remains |
-| Concurrent COLD read/write under small transient budget | test-host acceptance gate |
+| Sustained per-preset transform RSS/heap profiling | release-host acceptance gate |
 
-## Protocol acceptance target
-
-Run GET/POST/PUT/PATCH/DELETE over H1, H2 and H3. For DELETE, test both an empty body and a body-bearing request (use a mock upstream if the chosen Proxmox endpoint does not accept a DELETE body). The original H3 empty DELETE must no longer produce `501`; H1/H2 behavior must remain unchanged; Proxmox must receive `DELETE` and the same URI; and a raw HTTP/1.1 upstream must show non-chunked zero-length framing for the empty H3 case.
-
-For cache acceptance, test a small 8 MiB HOT tier under sustained traffic, a deliberately large 2 GiB HOT tier, `cold_after_seconds=5`, a response above `max_object_bytes`, and concurrent COLD promotion/demotion under a small transient limit. Published `hot_allocated_bytes` must remain within the HOT limit; transient/queue usage must drain after COLD persistence; large responses must keep streaming after their cache candidate is rejected; and RSS must plateau rather than track total traffic volume.
-
-See [V0.24.5_AUDIT.md](V0.24.5_AUDIT.md) for the source/spec matrix and remaining runtime gates.
+See [V0.24.7_AUDIT.md](V0.24.7_AUDIT.md) for the resource-control design and remaining runtime acceptance gate.