v0.27.0-hotfix

docs/DOCKER_DISCOVERY.md

@@ -90,7 +90,7 @@ For each discovered service you can change the mapping directly in **Docker vhos
 - **Redirect HTTP to HTTPS**: per-app Force SSL switch. New assignments default on when the agent has a usable plain-HTTP + TLS listener pair; assignments saved before 0.18.8 retain their previous redirect-off behavior until explicitly saved with the new switch;
 - **WebSockets**: enable or disable classic HTTP/1.1 Upgrade forwarding for this application;
 - **Cache**: enable or disable normal RustProxy caching for this generated vhost;
-- **Compression**: inherit/enable/disable dynamic compression for this published vhost and optionally filter zstd, Brotli, gzip and deflate; selecting Disabled hides/disables the codec selectors without clearing their saved values, and globally disabled codecs stay unavailable;
+- **Compression**: one on/off checkbox for this published vhost. When enabled, Docker vhosts use the codecs and priority configured globally under **Settings -> Response**; there are no per-Docker-vhost codec selectors;
 - **Transform**: opt this generated vhost into the global static-response transform engine; it is off by default and still requires global transformation to be enabled;
 - **Backend health check**: HTTP/TCP/off active-probe mode, path/Host override, interval, timeout, slow threshold, rise/fall counters and accepted HTTP status range.
 - **Passive Backend Health**: independent opt-in policy, OFF by default, with separate connect/timeout/I/O/HTTP-5xx/slow-response switches and optional passive rise/fall overrides.

docs/SETTINGS.md

@@ -242,12 +242,11 @@ response can disable compression at the vhost or Web Service scope when their th
 requires BREACH-style mitigation.
 
 The global Response panel selects available codecs and the minimum size. Each ordinary
-vhost may inherit, enable or disable dynamic compression and independently inherit/enable/disable
-zstd, Brotli, gzip and deflate. Generated Docker vhosts and Web Server services expose the same
-per-scope codec filters. When a scope is explicitly Disabled, the dashboard hides and disables
-those codec controls without clearing their saved values. Global codec switches remain the hard
-ceiling: a local `true` override cannot enable a codec disabled in the global Response panel.
-`min_bytes` remains global.
+vhost and Web Server service may inherit, enable or disable dynamic compression and independently
+inherit/enable/disable zstd, Brotli, gzip and deflate. Docker vhosts intentionally expose only one
+Compression checkbox: when enabled they use the globally enabled codec set and priority, with no
+per-Docker-vhost codec selectors. Global codec switches remain the hard ceiling: a local `true`
+override cannot enable a codec disabled in the global Response panel. `min_bytes` remains global.
 
 `Vary: Accept-Encoding` is added when compression is negotiated; content length is removed
 for the transformed body. Strong ETags are weakened, and identity-body content digests and

docs/TEST_REPORT.md

@@ -6,7 +6,7 @@ RustProxy 0.27.0 changes downstream compression policy, Docker-vhost publication
 
 Dynamic response compression defaults to zstd, Brotli and gzip enabled, with deflate opt-in. Client `Accept-Encoding` quality values are authoritative; equal quality uses deterministic `zstd -> br -> gzip -> deflate` server preference. Existing `Content-Encoding`, `no-transform`, range responses/requests, SSE and upgrades remain excluded. Cookie, authorization, `Set-Cookie`, `private` and `no-store` no longer disable compression as blanket rules.
 
-Ordinary vhosts, generated Docker vhosts and Web Server services can inherit, enable or disable dynamic compression and can independently inherit/enable/disable zstd, Brotli, gzip and deflate. Global **Settings -> Response** codec switches remain the hard availability ceiling and `min_bytes` remains global. A scoped codec cannot activate a codec disabled globally. When scoped compression is explicitly Disabled, the dashboard hides and disables its codec selectors while preserving the stored override values.
+Ordinary vhosts and Web Server services can inherit, enable or disable dynamic compression and independently inherit/enable/disable zstd, Brotli, gzip and deflate. Docker vhosts expose one Compression checkbox only and use the codec set/priorities from global **Settings -> Response**. Global codec switches remain the hard availability ceiling and `min_bytes` remains global.
 
 An explicitly published Docker assignment keeps its generated hostname even when its service disappears. A successful inventory without the assigned service materializes an unavailable route that returns HTTP 503 instead of removing the hostname. Agent polling errors retain the previous successful inventory when one exists, and a returning service is reconciled automatically. The cache overview progress elements have explicit WebKit/Chromium and Firefox progress-value styling so their visual fill follows the numeric meter value.
 
@@ -14,7 +14,7 @@ Fresh installations now default the response `Server` policy to `custom` with th
 
 ## Regression coverage
 
-Compression unit coverage checks defaults, q-value negotiation, equal-quality priority, each supported codec, existing-encoding passthrough, scoped per-codec resolution and the revised cookie/auth/cache-privacy policy. Docker unit coverage checks missing published service -> retained 503, failed agent observation -> retained last-known backend and persistence of Docker codec overrides. Settings coverage checks the fresh-install `Server: RustProxy` default and legacy missing-field compatibility. Static/UI contracts require ordinary-vhost, Docker-vhost and Web-Service codec controls to hide/disable when their scope is explicitly OFF without clearing saved values, plus the 503 path, visible cache progress styling, external Debian-packaging separation and reproducible archives without a `debian/` tree.
+Compression unit coverage checks defaults, q-value negotiation, equal-quality priority, each supported codec, existing-encoding passthrough, scoped per-codec resolution and the revised cookie/auth/cache-privacy policy. Docker unit coverage checks missing published service -> retained 503, failed agent observation -> retained last-known backend, the single compression switch and ignoring legacy Docker per-codec values. Settings coverage checks the fresh-install `Server: RustProxy` default and legacy missing-field compatibility. Static/UI contracts require ordinary-vhost and Web-Service codec controls to hide/disable when their scope is explicitly OFF, require Docker vhosts to expose only the single Compression checkbox, and retain the 503 path, visible cache progress styling, external Debian-packaging separation and reproducible archives without a `debian/` tree.
 
 ## Verification status in this workspace
 

docs/V0.27.0_IMPLEMENTATION.md

@@ -2,7 +2,7 @@
 
 ## Scope
 
-0.27.0 changes downstream compression defaults/negotiation, makes Docker publications persistent across transient service loss, adds scoped compression overrides, and fixes cache occupancy meter rendering. SQLite remains schema 8. Saved configuration changes are additive/defaulted: vhosts and Web Services gain scoped compression/codec overrides and Docker assignments gain nullable compression/codec fields. Fresh installations also default the `Server` header policy to `custom: RustProxy`, while a missing legacy field still deserializes with the previous preserve behavior.
+0.27.0 changes downstream compression defaults/negotiation, makes Docker publications persistent across transient service loss, adds scoped compression overrides, and fixes cache occupancy meter rendering. SQLite remains schema 8. Saved configuration changes are additive/defaulted: vhosts and Web Services gain scoped compression/codec overrides, while Docker assignments use one nullable compression switch. Legacy pre-release Docker codec fields remain accepted for configuration compatibility but are ignored. Fresh installations also default the `Server` header policy to `custom: RustProxy`, while a missing legacy field still deserializes with the previous preserve behavior.
 
 ## Compression
 
@@ -10,7 +10,7 @@ Global compression defaults to zstd, Brotli and gzip enabled, with deflate disab
 
 Responses carrying `Cookie`, `Authorization`, `Set-Cookie`, `Cache-Control: private` or `no-store` are no longer rejected merely because of those headers. Compression remains disabled for existing `Content-Encoding`, `no-transform`, request ranges/`Content-Range`, SSE, upgrades, HEAD and non-body statuses. Existing encoded bodies are never recompressed.
 
-Ordinary vhosts, generated Docker vhosts and Web Server services expose inherit/enable/disable dynamic-compression policy plus individual zstd/Brotli/gzip/deflate overrides. Global Response codec switches remain the hard availability ceiling and the minimum size remains global. A child scope may re-enable a codec disabled by an enclosing scope only when that codec is still enabled globally. In the dashboard, explicitly selecting **Disabled** hides and disables the child codec selectors; their stored values are preserved so changing the scope back to Inherit/Enabled restores the previous choices.
+Ordinary vhosts and Web Server services expose inherit/enable/disable dynamic-compression policy plus individual zstd/Brotli/gzip/deflate overrides. Global Response codec switches remain the hard availability ceiling and the minimum size remains global. Docker vhosts intentionally expose one Compression checkbox only; when enabled, the generated vhost uses the globally enabled codec set and deterministic global priority. Legacy Docker per-codec values are ignored and the dashboard clears them to null when an assignment is saved.
 
 ## Persistent Docker publications
 
@@ -24,4 +24,4 @@ The `/cache` JavaScript already calculates occupancy percentages from configured
 
 ## Compatibility and verification
 
-No SQLite migration is required. Older vhost, Docker assignment and Web Service documents load with inherited compression behavior because all new fields are defaulted. Existing stored `server_header` settings are preserved; documents predating that field keep the historical preserve behavior. Rust compiler/runtime verification remains mandatory on the release host; Rust-independent checks in `docs/TEST_REPORT.md` do not substitute for `cargo fmt`, `cargo check`, Clippy, tests or live protocol acceptance.
+No SQLite migration is required. Older vhost, Docker assignment and Web Service documents load because all new fields are defaulted; legacy Docker codec fields are tolerated but no longer affect generated vhosts. Existing stored `server_header` settings are preserved; documents predating that field keep the historical preserve behavior. Rust compiler/runtime verification remains mandatory on the release host; Rust-independent checks in `docs/TEST_REPORT.md` do not substitute for `cargo fmt`, `cargo check`, Clippy, tests or live protocol acceptance.