v0.33.7

docs/API.md

@@ -76,6 +76,37 @@ rejection, 409 for already-completed setup, 422 for password policy and 429 for
 throttling/busy workers. Error objects usually contain an `error` code/string;
 framework extraction failures are not guaranteed to have that JSON shape.
 
+## Administrator Overview layout presets (0.33.7)
+
+The dashboard preset endpoints are private control-plane routes and use the
+existing administrator session cookie. The same Origin, request-marker and
+CSRF rules as other settings writes apply. They do **not** change the proxy
+configuration revision and cannot be called from public vhosts.
+
+| Method / path | Request or result |
+|---|---|
+| `GET /api/dashboard-presets` | Array of named layouts for the authenticated administrator |
+| `PUT /api/dashboard-presets/{name}` | Create/overwrite a named layout; JSON body described below; returns 204 |
+| `PATCH /api/dashboard-presets/{name}` | Rename using `{ "name": "new name" }`; returns 204 |
+| `DELETE /api/dashboard-presets/{name}` | Delete the named layout; returns 204 |
+
+A layout is `{ "dashboard_widgets": ["..."], "dashboard_hidden_widgets": ["..."],
+"dashboard_widget_sizes": null, "dashboard_density": "compact",
+"overview_samples": 600 }`, using registered widget IDs and the same
+width/density validation as administrator view preferences. History accepts
+60, 120, 300 or 600 samples. For sizes, `null` preserves legacy grouped
+placement; an object maps widget IDs to valid 12-column spans. The account
+may store at most 16 named layouts; names are 1-64 UTF-8 bytes with no
+control characters, surrounding whitespace or slash. Invalid values receive
+422; full capacity or a conflicting rename receives 409. Unknown delete
+returns 404. All write endpoints require a session-bound CSRF token.
+
+The data resides in SQLite schema 10 (`dashboard_presets`), separate from
+`admin_preferences`; the factory preset is not stored as a mutable row.
+The browser saves the chosen history sample count using its existing local
+preference when loading a preset. The client does not use JSON configuration
+files to store named presets.
+
 ## Configuration and observations
 
 | Method / path | Result |
@@ -107,7 +138,7 @@ and rechecks session validity. It does not queue an unlimited per-viewer event l
 or guarantee replay. The browser falls back to compact status/log polling only after SSE fails and stops polling after its recovery. Invalid SSE intervals are rejected with 422. An active dashboard renews
 idle activity, not the absolute session deadline.
 
-Configuration history, introduced in SQLite schema 8 and retained in current schema 9, keeps the newest 512 successful manual/configuration revisions. `GET /api/config/history` is session-protected like the rest of the administration API; `limit` is bounded to 512 and `revision` selects one retained revision for diff/inspection. `POST /api/config/history/restore` also requires the normal CSRF/request-marker protections, rejects stale `expected_revision`, and never rewinds the revision counter: restoring revision 85 while current revision is 120 creates revision 121.
+Configuration history, introduced in SQLite schema 8 and retained in current schema 10, keeps the newest 512 successful manual/configuration revisions. `GET /api/config/history` is session-protected like the rest of the administration API; `limit` is bounded to 512 and `revision` selects one retained revision for diff/inspection. `POST /api/config/history/restore` also requires the normal CSRF/request-marker protections, rejects stale `expected_revision`, and never rewinds the revision counter: restoring revision 85 while current revision is 120 creates revision 121.
 
 Configuration updates return 409 for a stale revision, 422 for validation failure
 and 429 when the eight-operation update admission bound is reached. Persistence and

docs/TEST_REPORT.md

@@ -1,44 +0,0 @@
-# RustProxy 0.33.6 - verification report
-
-## Scope (2026-10-15)
-
-Additional 0.33.6 chart/UI changes:
-- All 14 full-width Overview and Web Server plots retain a fixed 125px SVG
-  height, regardless of viewport width and dashboard density.
-- Grid lines are mapped to the actual plotting range rather than approximate
-  horizontal positions.
-- Transform and Compression activity (plus other unbounded unit series) use
-  sane zero-based minimum ranges and monotonic, rounded range expansion, so
-  low values do not look like maximum utilization and spikes remain visible.
-- Full Cache and Transform live charts keep an 180px plot height and the same
-  stable per-second range policy. Compact percent sparklines stay 0-100%.
-
-Previous 0.33.5 regression scope:
-
-Correct the Overview **System and process CPU** widget:
-- Use a fixed 0-100% vertical range, not the measured-history peak.
-- Map 25%, 50% and 75% to the horizontal grid lines.
-- Clip plotted CPU values above 100% at the top without modifying their measured values in the legend or summary.
-- Fix only this plot's CSS height at 125px, independent of viewport width, dashboard density and CPU samples.
-- Leave other chart scales, plot dimensions, status sampling and dashboard preferences unchanged.
-
-## Checks completed
-
-- **PASS:** `python scripts/tests/dashboard_stable_scales_0336_browser_test.py`
-  with real bundled HTML/CSS/JS in simulated Chromium at 320, 375, 768,
-  1440 and 1920px and all three density modes. Covered 14 large plots,
-  125/180px plot heights, quarter-grid alignment, 0-100% CPU mapping,
-  steady low/high traffic plotting, minimum count/rate/latency/memory scales,
-  sticky expanded scales, reset and non-clipped live operation-rate labels.
-
-- **PASS:** `python scripts/tests/dashboard_cpu_fixed_scale_0335_browser_test.py` against the actual bundled HTML/CSS/JS in simulated Chromium, at 320, 375, 768, 1440 and 1920px, in normal/compact/ultra densities. Checked low and high CPU histories, missing samples, new status revisions, clipping above 100%, actual percentage labels, consistent grid positions, fixed plot height and no sample-dependent changes to the CPU/adjacent Connection Activity cards' heights.
-- **PASS:** All 11 prior `scripts/tests/*browser_test.py` simulated-browser regressions (including the 0.33.5 CPU test) and the new 0.33.6 browser regression: chart headers, resized widths, dashboard grid/modal resizing, sidebar, progress bars, System RAM, Web observability and Web Server metrics. No live RustProxy server was used.
-- **PASS:** `node scripts/tests/overview_samples_0330_ui_test.mjs`, `node scripts/tests/dashboard_resume_rate_charts_ui_test.mjs` and `node scripts/tests/dashboard_metric_visuals_ui_test.mjs`.
-- **PASS:** `./dev.sh doctor` and `python scripts/preflight.py` (source layout). 
-- **PASS:** All eight `migrations/*.sql` applied successfully in two successive cycles to a disposable, in-memory SQLite database. This verifies SQL script execution/idempotency in this context, not an upgrade of production data.
-- **PASS:** Parsed `scripts/deploy/upgrade.py --help` and `scripts/migration/migrate_npm.py --help`; did not run a live upgrade or migration against an external database or service.
-
-## Not verified in this environment
-
-- `./dev.sh check` and `./dev.sh test` both exit 127: Cargo/rustc are unavailable. Therefore no Rust compilation, unit/integration suite, actual proxy runtime, real SSE feed, production database upgrade or live load test has been verified.
-- The real-runtime acceptance gate remains open until Rust builds and runs against representative test traffic.

docs/VHOSTS.md

@@ -6,6 +6,17 @@
 This is the source implementation contract. Rust compilation and runtime acceptance
 were not performed in the packaging environment; see TEST_REPORT.md.
 
+## Backend quick-view in Vhosts
+
+Click the **Backends** count or the **Status** tile of a Vhost to open its
+backend list. Each member displays the configured ID, origin host/IP and port,
+HTTP/HTTPS scheme and HTTP mode, current reported health and `last_status`.
+`last_status` is the most recent HTTP code from a proxied request; zero/no
+member means no known HTTP response, not a failed probe. DNS origins show the
+configured hostname, as the status API does not report the resolved IP.
+The panel updates from the existing status feed without initiating requests,
+and supports Escape and click-outside dismissal.
+
 ## One vhost, one backend pool
 
 A `vhosts` entry owns an `id`, `enabled`, `frontend`, `source`, `backends`, `load_balancing`,