v0.31.5

CHANGELOG.md

@@ -3,8 +3,20 @@
 > Operator-facing release history. Historical engineering notes are kept in
 > [`docs/CHANGELOG_TECHNICAL_ARCHIVE.md`](docs/CHANGELOG_TECHNICAL_ARCHIVE.md).
 
+## 0.31.6
+
+- Preserve logo click as the original `href="/"` full-page navigation. For H3 to HTTP/1.1 backend forwarding, complete empty GET/HEAD receive streams through a bounded first-frame probe before forwarding. Hyper already special-cases GET/HEAD H1 encoding; this change targets H3 receive-half lifecycle, not assumed chunked GET framing. Also bound H3 GET/HEAD cache and 404 preflight so a missing FIN cannot indefinitely prevent navigation; rewind/replay any nonempty body unchanged.
+- Do not abort all in-flight H3 responses when the H3 accept loop fails; stop accepting and drain the active request tasks within the normal grace bound.
+- Persist H3 pre-header peer cancels as status-0 diagnostic events rather than HTTP 400. For interrupted responses record phase, QUIC stream ID, method, query-free path, response status, sent byte count and redacted failure reason; preserve non-cancellation per-stream error reset behavior. Log start/completion/interruption of root-document `GET /` with a stream ID and response status in service INFO/WARN logs.
+- Add H3 navigation regression tests and iPhone reproduction checklist. Retain the 0.31.5 Stored Logs mobile layout, HOT/COLD cache preservation and administrator Origin protections. Rust build and real iOS testing are still required.
+
 ## 0.31.5
 
+- Make the Stored Logs explorer responsive: compact, keyboard-expandable record cards and readable parsed fields on narrow screens; keep user-selected columns accessible without widening the whole page. Desktop table behavior remains available.
+- Do not persist a synthetic HTTP 400 for a QUIC peer cancelling an incomplete H3 request with `H3_REQUEST_CANCELLED`/`H3_NO_ERROR` on refresh. Preserve real HTTP/3 protocol-error logging and avoid a second internal reset after identified peer cancellation. The related white-page symptom still needs live browser/QUIC validation.
+- Preserve HOT/COLD cache compatibility identity when per-vhost HTTP/2 or HTTP/3 enablement changes; these are frontend protocol switches, not cached-response representation changes. No cache schema migration.
+- Clarify that the optional public panel HTTPS origin pins the external scheme/authority for Origin/CSRF validation with a trusted reverse proxy, while additional allowed DNS hostnames only expand the strict Host allowlist. Add source/Rust regression cases and a browser-width layout smoke test; compiler and live wire acceptance are still required.
+
 - Give repeated-value analysis its own Stored Logs tab and move the rotation-consolidation option to a compact top-right control. Preserve the browser-local consolidation choice.
 
 - Fingerprint panel, login and documentation JS/CSS asset filenames with a random 16-hex build identifier independent of the application version. Reject legacy JS/CSS URLs (404), retaining unversioned JSON/SVG; enforce exact fingerprints and preserve the existing HTML cache-header behavior. No SQLite/API changes.