v0.29.0

docs/CACHE.md

@@ -128,6 +128,14 @@ safety behavior. RustProxy's static-cookie optimization can ignore Cookie only f
 configured static file extensions; response `Set-Cookie`, `private`, `no-store` and
 `Vary: Cookie` still prevent unsafe shared reuse.
 
+### Per-vhost forced-cache targets
+
+A vhost can opt into an explicitly unsafe `cache.unsafe_force` list for narrowly selected public request targets. It is intentionally not available as a global cache setting. Each configured target starts with `/`; a target without `?` matches by normalized path prefix, while a target containing `?` matches the original path+query prefix.
+
+For matching GET/HEAD requests, forced mode may ignore request-side bypasses caused by a query string, Cookie, Authorization, `Cache-Control: no-cache`/`no-store`/`max-age=0`, and `Pragma: no-cache`. Protocol-safety exclusions such as Upgrade, unsupported Range/preconditions and request bodies remain in force. Cookie and Authorization values are added to the cached representation's `Vary` identity in forced mode so different credentials/cookies cannot reuse each other's object.
+
+Forced mode does **not** override response-side privacy policy. `Set-Cookie`, `Cache-Control: private`, `no-store`, `Vary: *`, partial/trailer/SSE/gRPC responses and the normal size/lifetime validation still prevent storage. Use this only for URLs whose origin semantics are understood; ordinary cache defaults remain safer.
+
 ## Request methods and invalidation
 
 GET and HEAD participate in lookup. They share one representation identity. On a