v0.25.0

CHANGELOG.md

@@ -1,86 +1,85 @@
 # Changelog
 
+> User/operator-facing release history. Low-level compiler fixes, internal refactors,
+> test-only changes and packaging implementation notes were moved to
+> [`docs/CHANGELOG_TECHNICAL_ARCHIVE.md`](docs/CHANGELOG_TECHNICAL_ARCHIVE.md).
+
+## 0.25.0
+
+- Add reusable Web Services with document root, ordered index files and optional directory listing in the new **Web Server** dashboard section.
+- Allow vhosts and custom locations to choose **Reverse Proxy** or **Web Server**, reuse one Web Service across multiple vhosts and mix static/proxy routing in one vhost.
+- Add static `GET`/`HEAD`, streaming responses, MIME/length headers, index/redirect/listing behavior, HTTP validators and single-range requests (`206`/`416`).
+- Enforce document-root confinement, reject ambiguous/encoded traversal and prevent symlink escape on Unix by refusing to follow symlinks.
+- Reuse the existing vhost ACL/authentication/header/error/TLS/H1/H2/H3 pipeline without adding a second router, error-page subsystem or object cache.
+- Add an authenticated **Docs Reader** alongside the API/OpenAPI view, with a canonical documentation index, 0.25 audit and separate TODO.
+- Align Web Server directory listings and Web Service cards with the RustProxy panel UI, make index files optional for listing-only services, clarify Web Server vhosts in backend summaries and show a dedicated validation error when Reverse Proxy has no backend.
+- Fix Web Service card rendering and authenticated-panel refresh behavior so a UI startup error cannot be mistaken for an expired login session; also render an already-loaded configuration when the Web Server UI module registers, removing intermittent blank Web Service lists after fast page refreshes.
+- Fix Web Server vhost dashboards so status, request/active/error counters, EWMA latency and traffic are populated from vhost-wide metrics even when no reverse-proxy backend pool exists.
+- Fix repeated directory-listing requests so refreshing a directory does not reuse an exhausted directory offset; keep per-directory index lookup ahead of listing fallback.
+- Add Web Service MIME overrides, a configurable fallback MIME type and an optional default `Cache-Control` policy while retaining vhost/location response-header overrides and the OS page cache instead of a second static object cache.
+- Expand Web Service configuration into General, Routing, MIME, Cache & headers, Delivery, PHP-FPM and Security tabs; add `try_files`, internal/redirect rewrites, ordered extension/MIME cache rules, fixed response headers, precompressed sidecars and forced-download extensions.
+- Add bounded FastCGI/PHP-FPM execution over local Unix sockets or loopback TCP with configurable executable extensions, timeouts and concurrency; support `index.php`/front-controller routing and never expose PHP source when PHP-FPM is unavailable. Extend PHP-FPM configuration with explicit TCP/Unix syntax help, Authorization forwarding control, a streaming request-body limit, bounded response headers/stderr, trusted custom FastCGI parameters and validated `PHP_VALUE` overrides.
+- Add bounded `.htaccess` migration compatibility for common RewriteRule/RewriteCond front controllers, DirectoryIndex/Indexes, AddType, response Header, Expires and PHP AddHandler directives, with recursive compile-time scanning, strict mode, fail-closed handling of unsupported access/handler directives and protected `.ht*` files.
+- Add one-shot Web Service presets for Static, SPA, PHP, WordPress, Drupal, Laravel, Symfony, Joomla, PrestaShop and Downloads plus optional per-service hardening that blocks high-confidence exploit probes/sensitive files and strips common implementation fingerprint headers.
+- Add an explicit Web Service symlink policy: deny by default, with a Linux-only static-files mode that follows links only when the opened target remains inside the configured document root.
+- Split **Settings -> Logging** into Outputs, JSON format and Error log subsections inside the same card/sub-tab layout as Cache, and allow `route`, `cache_effective_enabled` and `transform_effective_enabled` in custom JSON log mappings.
+- Add `user_agent` and optional `country` structured access-log fields. Country capture is disabled by default so GeoIP lookup is not added to the normal request path unless explicitly enabled or already required by country access/rate-limit policy.
+- Add a bounded per-vhost **Traffic** dashboard with top countries, User-Agents, effective client IPs, paths, routes, methods, status classes and cache outcomes plus aggregate request/error/byte/latency counters; add donut charts for countries, User-Agents, client IPs, methods, status classes and cache outcomes.
+- Use the standard generic/customizable `403` error-page pipeline when a Web Server directory has no matching index and directory listing is disabled instead of returning an implementation-specific diagnostic string.
+- Reduce sustained-traffic RSS retention without configuration reloads by periodically releasing already-free glibc pages and automatically trimming only sufficiently idle HOT cache entries above a configurable target waterline.
+- Harden production defaults and FastCGI boundaries: keep the one-line/bootstrap reference admin listener on loopback unless plain remote HTTP is explicitly opted into, never pass client `Proxy` as CGI `HTTP_PROXY`, reject informational FastCGI statuses, discard application-supplied response framing/hop-by-hop headers, reject symlinked `.htaccess` control files, use owner-only Debian service umask defaults, and prevent local `.env` files from entering source release archives.
+- Fix CMS preset selection so choosing a non-Custom Web Service preset immediately fills and saves its generated index, `try_files`, PHP, delivery and cache settings without requiring a separate Apply click.
+
 ## 0.24.10
 
-- Keep Error File inside the existing revisioned `logging` configuration section while retaining its own Settings form; both access-log and error-file forms save atomically through `/api/config/logging`, so enabled/path/format persist without introducing a special endpoint.
-- Preserve backward compatibility for historical `/api/config/logging` clients that send only the access-logging object.
-- Keep the Error File panel free of the redundant ERROR/logrotate help sentence.
-- Remove collapsing from Response time history and add an accessible information control explaining the cumulative mean metric.
-- Update package/source/UI/OpenAPI/release identity to 0.24.10.
+- Persist Error File enabled/path/format through the existing revisioned Logging configuration while retaining compatibility with older logging API payloads.
+- Keep response-time history permanently visible and add an accessible explanation of the cumulative mean metric.
 
 ## 0.24.9
 
-- Added composite Settings > Logging support for `error_log.enabled`, path and format while retaining legacy `/api/config/logging` payload compatibility.
-- Removed the Error Log help sentence from the panel while keeping the existing controls and behavior unchanged.
-
-- Fix Rust type inference for zeroizing ACME/Base64 and AEAD buffers so the new Secret Store and encrypted backup code compile with the pinned dependency set.
-- Fix the secret-redaction KV regex literal so 0.24.9 compiles correctly; the redaction behavior itself is unchanged.
-- Harden the built-in release checker for FreeBSD/OPNsense and other Unix platforms: supplement bundled Mozilla roots with common system CA bundles/`SSL_CERT_FILE`/`CURL_CA_BUNDLE`, follow bounded non-downgrading HTTP(S) redirects, and report failed checks as normal application `ERROR` events without changing dashboard behavior.
-- Add a central AES-256-GCM encrypted Secret Store with private local master-key storage and migration of existing ACME DNS-provider credentials.
-- Add encrypted full backup/restore with Argon2id, authenticated encryption, explicit manifests/checksums, staging validation and rollback-safe activation.
-- Add an optional ERROR-only JSON/RAW file sink with bounded asynchronous writes, central secret redaction and system `logrotate` integration.
-- Extend source/release regressions and update release identity to 0.24.9.
+- Add a central encrypted Secret Store and migrate ACME DNS-provider credentials away from persistent plaintext storage.
+- Add password-encrypted full backup/restore with authenticated encryption, integrity validation, staging and rollback-safe activation.
+- Add an optional ERROR-only JSON/RAW file sink with bounded asynchronous writes, secret redaction and logrotate integration.
+- Harden the built-in release checker on FreeBSD/OPNsense and other Unix platforms with system CA bundle support and bounded redirects.
 
 ## 0.24.8
 
-- Expand the overview Cache RAM diagnostics with HOT usage against limit, transient RAM history for total/fill/COLD queue/COLD I/O, and COLD storage occupancy against its disk budget.
-- Hide the long RSS/cache accounting explanation behind an accessible information control in the Process heading.
-- Keep COLD disk occupancy explicitly separate from transient process RAM accounting.
-- Update release identity to 0.24.8.
+- Expand Cache RAM diagnostics with HOT usage/limit, transient cache RAM breakdown and COLD storage occupancy.
+- Move the long RSS/cache accounting explanation behind an accessible information control while keeping COLD disk usage separate from process RAM.
 
 ## 0.24.7
 
-- Make the transform temporary-memory ceiling configurable from Settings and preserve a 128 MiB default for existing configurations.
-- Add a configurable process-wide transform concurrency ceiling; excess work fails open unchanged rather than waiting behind transformation work.
-- Add persisted RAM saver, Recommended, Performance and Uber performance transform resource presets without changing enabled transform formats or extension allow-lists.
-- Show transform-resource warnings when the selected budget cannot fit the worst-case buffers for one maximum compressed body or exceeds half of detected host/cgroup RAM.
-- Add live dashboard resource accounting: current transform RAM reservation/budget and active slots, HOT/transient cache RAM, non-cache process RSS, plus COLD disk occupancy and object limits.
-- Include global transform representation/eligibility settings in cache compatibility identity while excluding resource-only preset/budget/concurrency controls.
-- Map bounded transform-body collection failures explicitly into `anyhow::Error`, avoiding the `anyhow::Context` trait-bound compile failure for Axum/HTTP body boxed errors.
-- Clean compiler warnings in cache transient leases and CSS minification without suppressing lints: make RAII-only lease ownership explicit, keep COLD read reservations intentionally alive, and remove dead CSS state assignments.
-- Extend SQLite/OpenAPI/offline memory/release regressions and update release identity to 0.24.7.
+- Make transform temporary-memory and concurrency ceilings configurable, preserving safe defaults for existing installations.
+- Add persisted RAM saver, Recommended, Performance and Uber performance transform resource presets without changing transformation semantics.
+- Add safety warnings and live resource accounting for transform RAM/slots, cache RAM and COLD disk occupancy.
+- Include transformation representation/eligibility settings in cache compatibility identity while excluding resource-only capacity settings.
 
 ## 0.24.6
 
-- Persist the selected memory and COLD cache preset identities in the SQLite-backed cache configuration and restore their selected/custom state in Settings.
-- Add a Recommended COLD policy preset with bounded queue sizing and conservative demotion/GC defaults while preserving operator-selected disk path, disk budget and object limit.
-- Add a 128 MiB process-wide transform temporary-memory budget, bounded body aggregation independent of claimed Content-Length, and bounded decompression growth.
-- Validate/compact JSON without a full DOM tree, remove routine HTML raw-tag string allocations and avoid repeated CSS output scans.
-- Cap stale-while-revalidate background work at 8 keys and proactive sleeping refresh tasks at 256; keep COLD cleanup single-flight and candidate memory proportional to the requested deletion limit.
-- Bound COLD delete fallback tasks and deletion metadata, and add Rust-independent regression checks for memory/task bounds across background workers.
-- Update release identity to 0.24.6.
+- Persist selected HOT/COLD cache preset identities and restore them in Settings.
+- Add a Recommended COLD policy preset while preserving operator-selected disk path and capacity.
+- Bound transformation buffers/decompression and background cache work to prevent unbounded memory/task growth.
+- Bound stale revalidation, proactive refresh, COLD cleanup and delete fallback work.
 
 ## 0.24.5
 
-- Normalize actually empty, length-unknown HTTP/3 request bodies before HTTP/1.1 upstream forwarding so Hyper emits a zero-length request instead of chunked framing for methods such as DELETE.
-- Keep non-empty HTTP/3 bodies streaming by replaying the inspected first frame, leave declared `Content-Length` requests untouched, and do not alter HTTP/2 upstream framing.
-- Add focused regression coverage for empty/non-empty H3 DELETE and generic empty H3 methods forwarded to HTTP/1.1.
-- Keep the source package consistent with its existing release contracts by dropping the stale unreferenced `src/system_stats/bsd.rs` file and updating the offline container check to the already-shipped Debian 13/Trixie base images.
-- Harden cache RAM admission without changing the HOT -> COLD storage model: HOT now has a 256 MiB allocation-aware default budget, fills reserve memory before buffer growth, and a small bounded allocator headroom replaces max-object-sized overshoot.
-- Add a separate 64 MiB transient RAM budget plus a 32 MiB byte ceiling for the COLD writer queue; demoted bodies stay charged until persistence drops the `ColdDraft`, while persisted `ColdEntry` values retain only disk paths/metadata.
-- Preserve body backing-allocation accounting across fill, revalidation and COLD promotion, expose HOT logical vs allocated bytes and the HOT/transient/COLD-queue limits, and add memory-pressure/LRU-admission counters.
-- Make global cache disable authoritative over per-vhost enablement, remove the artificial 1 GiB HOT/object configuration ceiling, and hot-apply reduced HOT capacity with bounded LRU demotion/eviction.
-- Add Settings memory sizing based on effective host/cgroup RAM with conservative, recommended and performance presets, a live recommended profile, host/cgroup headroom warnings, and controls for transient RAM, COLD queue RAM and bounded LRU admission. Automatic presets are disabled below 256 MiB effective RAM.
-- Update release identity to 0.24.5.
+- Fix empty, length-unknown HTTP/3 request forwarding to HTTP/1.1 origins while keeping non-empty bodies streaming.
+- Harden HOT/COLD cache memory admission with allocation-aware HOT limits and separate transient/COLD-queue RAM budgets.
+- Expose HOT logical/allocated/transient memory and pressure counters.
+- Make global cache disable authoritative over per-vhost settings and remove the artificial 1 GiB HOT/object ceiling.
+- Add host/cgroup-aware cache memory presets and safety/headroom guidance in Settings.
 
 ## 0.24.4
 
-- Disable Linux Transparent Huge Pages for the RustProxy process with `prctl(PR_SET_THP_DISABLE)` before the Tokio runtime is created, avoiding a host-wide THP policy change while preventing 2 MiB anonymous huge pages from amplifying allocator RSS retention.
-- Treat the process-local THP operation as best-effort: unsupported/rejected kernels emit a startup warning and RustProxy continues to run.
-- Update release identity to 0.24.4.
+- Reduce Linux RSS amplification by disabling Transparent Huge Pages only for the RustProxy process, without changing the host-wide THP policy.
 
 ## 0.24.3
 
-- Add a per-certificate reload operation for manual/file-backed certificate IDs and authorize it through the scoped Certificate API as well as the normal administrator session.
-- Allow multiple Certificate API tokens (bounded to 32), operator comments, individual revocation and revoke-all while continuing to persist token hashes only.
-- Replace the overview Core State block with a live connection/activity chart, move uptime into the Process block below process start, add RX/TX-style upload/download detail under Payload transferred, and persist per-browser hidden network-interface charts.
-
-- Add `MALLOC_ARENA_MAX=2` to managed Linux/systemd service units to reduce glibc arena growth and long-running RSS retention while retaining the environment-file override.
-- Remove an identity-body copy from the transformation pipeline, remove `Vec<char>` plus final output-copy allocations from the JavaScript/CSS minifiers, release successful-transform temporary buffers earlier, and use a throttled `malloc_trim(0)` after large Linux/glibc transforms.
-- Make HTTP/2 lifecycle tuning listener-scoped like HTTP/3: keep H2/H2C and H3 enablement in **Settings -> Listeners**, expose per-listener H2 GOAWAY/lifetime limits under **HTTP connections -> HTTP/2**, retain per-listener QUIC limits under **HTTP/3**, and link listener rows to the matching tuning page. Existing top-level `http2` values remain a compatibility fallback for listeners without explicit H2 settings.
-- Rename **Proxy process** to **Process** and dynamically hide unsupported process diagnostics and history charts instead of showing unknown values.
-- Remove the stale, unreferenced legacy `src/system_stats/bsd.rs` parser file from the source package; shared library collectors remain the only BSD statistics implementation.
-- Update release identity to 0.24.3.
+- Add per-certificate reload for manual/file-backed certificate IDs and scoped Certificate API authorization.
+- Allow multiple Certificate API keys with comments, individual revocation and revoke-all while storing only token hashes.
+- Add Linux allocator tuning and reduce avoidable transformation allocations to improve long-running RSS behavior.
+- Move HTTP/2 lifecycle tuning to listeners, align HTTP/3 tuning, and keep compatibility fallback for older configuration.
+- Improve dashboard process/platform diagnostics and remove stale platform-specific source from release output.
 
 ## 0.24.2
 
@@ -88,16 +87,10 @@
 
 ## 0.24.1
 
-- Restore system network interface discovery and RX/TX counters after the shared-statistics refactor: use the cross-platform `sysinfo::Networks` API as the primary network inventory/counter source, merge `systemstat` as a library-level supplement/fallback for missing or partial inventory, preserve per-interface rate calculation, and stop silently truncating the interface list.
-- Fix the compiler error in portable uptime collection by using the `systemstat` duration API correctly, and remove the now-unused `Future` import in the H2 server module.
-- Remove RustProxy's artificial hostname-count ceilings from certificate SNI bindings, local certificate generation/import validation, ACME domain validation, vhost/redirect/404 hostnames, administration allowed hosts, host ACL policies and Docker aliases. Input validity and bounded control-plane/resource limits remain enforced.
-- Replace per-BSD command/parsing statistics code with shared library collectors: `systemstat` for host metrics, `sysinfo::Networks` for network inventory/counters, and `metrics-process` for process metrics, using the documented dummy process fallback on targets without a native collector.
-- Preserve Linux `/proc` and cgroup-specific details as additive compatibility metrics while using the common library API for portable host/process values.
-- Add portable swap, system uptime, process virtual memory/limit, descriptor limit and process start-time diagnostics where the libraries support them.
-- Add authenticated runtime metadata for platform, statistics source, resolved data directory and exact SQLite database path.
-- Make local CLI data-directory discovery understand both `/var/lib/rustproxy` and the BSD/OPNsense `/var/db/rustproxy` convention.
+- Restore portable network-interface discovery/RX/TX counters and add broader portable system/process diagnostics.
+- Expose authenticated runtime metadata for platform, statistics source and resolved data/database paths.
+- Make local CLI data-directory discovery support Linux and BSD/OPNsense conventions.
 - Move Logging into **Settings -> Logging** while retaining legacy `/logging` navigation compatibility.
-- Update release identity to 0.24.1.
 
 ## 0.24.0
 
@@ -107,9 +100,8 @@
 - Keep H2 Extended CONNECT/WebSocket streams under the same active-stream accounting and graceful drain path.
 - Extract system statistics into platform backends while preserving Linux metric names, units and behavior; add native FreeBSD/OpenBSD/NetBSD sampling where available and explicit nulls otherwise.
 - Add runtime platform to Proxy Process and Prometheus platform info.
-- Add Settings UI/API/OpenAPI/language-pack support plus H2 lifecycle/configuration regressions.
+- Expose H2 lifecycle controls through Settings and the administration API.
 - Reorganize **Settings -> HTTP connections** into HTTP/2 and HTTP/3 sub-tabs; move listener-scoped H3/QUIC enablement and limits out of the Listeners editor while preserving restart semantics and the existing listener configuration model.
-- Update release identity to 0.24.0.
 
 ## 0.23.3
 
@@ -118,15 +110,12 @@
 - Add per-vhost **Enable WebSocket legacy support** for older appliance/embedded WebSocket implementations.
 - Force legacy-mode WebSocket upstream handshakes to HTTP/1.1 and force the WebSocket `Host` to the configured backend authority and align `Origin` to the matching backend scheme + authority.
 - Tolerate legacy `101 Switching Protocols` response framing while keeping `Sec-WebSocket-Accept` and subprotocol validation strict.
-- Add UI/OpenAPI/translations, documentation and regression contracts for the compatibility mode.
-- Update package/source/UI identity and release verification contracts to 0.23.3.
 
 ## 0.23.2
 
 - Add selectable 60/120/300/600-sample history windows to the Cache and Transformation live charts, with bounded per-workspace browser persistence.
 - Fix `rust-proxy --livelogs` on HTTPS administration listeners by detecting the HTTP 308 redirect and reconnecting over TLS instead of looping.
 - Pin local CLI HTTPS to leaf certificates present in the private `data-dir/certs` directory and reuse the HTTP/HTTPS-aware client for config and certificate CLI API calls.
-- Update package/source/UI identity and release verification contracts to 0.23.2.
 
 ## 0.23.1
 
@@ -134,62 +123,49 @@
 - Plot Cache HIT/MISS/BYPASS rates for the selected scope using deltas from the existing cache runtime counters.
 - Plot Transform applied/cache-HIT/skipped/error rates for the selected scope using the existing transform metrics endpoint.
 - Reuse the administration dashboard SVG/grid/legend visual language, keep the existing 3-second live refresh, and add English/Polish language-pack labels.
-- Update package/source/UI identity and release verification contracts to 0.23.1.
 
 ## 0.23.0
 
 - Bound inactive inbound HTTP/2 connections to five minutes so idle TLS/H2 sessions cannot accumulate indefinitely toward the process connection limit; export `rust_proxy_http2_active_connections` for direct diagnosis.
 - Account hot-cache response-body backing allocation capacity rather than only visible body length, preventing `BytesMut` growth slack from bypassing the configured RAM budget and under-reporting resident cache memory.
-- Fix the `--livelogs` stdin reader to send owned `String` values from the match body rather than a pattern guard, resolving Rust `E0507` during binary compilation.
 - Add a scoped external Certificate API credential managed from a new **Settings → Certificate API** tab. RustProxy stores only the token hash plus a non-secret Key ID; the cleartext token is returned only on rotation.
 - Allow the scoped Key ID + Bearer Token only on `POST /api/certificates/deploy` and `POST /api/certificates/reload`, require HTTPS for non-loopback token use, track last use, support immediate revoke, and retain normal administrator-session/CSRF access as an alternative.
 - Keep production certificate operations available directly from the installed binary (`rust-proxy tls deploy` / `rust-proxy tls reload`) without requiring `dev.sh`.
 - Add `rust-proxy --livelogs`: an interactive varnishlog-style all-vhost live access stream with structured filters (`host`, `vhost`, `backend`, `route`, `client`, `method`, `transport`, `cache`, status classes, path prefix, errors and slow requests), pause/resume, per-request JSON inspection and detailed error/WebSocket/H3/cache fields.
 - Back live logs with a bounded non-blocking broadcast stream and authenticated SSE endpoint; slow consumers receive an explicit `gap` event with the dropped-entry count instead of silent loss.
-- Split the large **Settings → Cache** form into **General**, **Resilience**, **Cold cache**, and **Static & diagnostics** sub-tabs while retaining one atomic cache-policy save.
-- Add SQLite schema v5 for the scoped certificate credential, OpenAPI/security schemes, UI translations, audit events and 0.23.0 regression/release documentation.
+- Additional historical details for this release are retained in the technical archive.
 
 ## 0.22.3
 
 - Add downstream HTTP/1.1 `Upgrade: h2c` on listeners that explicitly enable cleartext HTTP/2, preserving the existing prior-knowledge path and rejecting malformed/body-bearing upgrade attempts before protocol switch.
-- Reconstruct the accepted H1 upgrade request as HTTP/2 stream 1 and hand subsequent framing/streams to the existing Hyper H2 server path; include raw-TCP interoperability regression source.
 - Add authenticated `POST /api/certificates/reload` and `tls reload` to re-read configured public certificate/key files and hot-publish a fresh TLS/H2/H3 snapshot without changing the desired configuration revision.
 - Add `tls deploy --id ... --cert ... --key ...` and authenticated `POST /api/certificates/deploy` for externally issued local certificates such as Certbot. The CLI performs bounded local reads while the running service owns pair/SAN validation, immutable generation staging, revision-CAS publication and rollback on failure, avoiding root-owned staged PEMs when Certbot hooks run as root.
 - Keep all vhosts assigned to one manual certificate id synchronized during external rotation; reject RustProxy-managed ACME ids to avoid dual renewal ownership and report the administration-TLS restart caveat explicitly.
-- Add Certificates-panel reload UX, OpenAPI contracts, audit events, translations and 0.22.3 audit/test documentation.
+- Add Certificates-panel reload controls and certificate audit events.
 
 ## 0.22.2
 
-- Fix the 0.22.2 backend diagnostics build failure by replacing the oversized recursive `serde_json::json!` member payload with explicit `serde_json::Map` construction; the administration JSON schema is unchanged.
 - Add bounded replay-safe backend failover retry for body-free GET/HEAD/OPTIONS requests, including retry policy controls, passive-health integration, logs and per-backend retry counters.
-- Correct ordinary explicit-HTTP/2 upstream requests and add a real Hyper h2c prior-knowledge regression path.
+- Correct explicit HTTP/2 upstream requests and h2c prior-knowledge forwarding.
 - Add per-backend request-concurrency limits with bounded capacity waiting, `503` rejection and capacity/queue-timeout metrics. This limits full proxy exchanges, not TCP socket count.
 - Add detailed upstream failure classes, last failure detail/timestamp, and backend health ejection/recovery timestamps to runtime diagnostics and Prometheus.
 - Expand the backend administration table with concurrency capacity, last failure and last recovery columns.
 - Parse public X.509 leaf metadata for issuer, SANs, validity, remaining days and expiry warning state, and surface ACME renewal status/last attempt/error in certificate inventory.
-- Extend OpenAPI, language packs, source regressions, audit/TODO and release documentation for the expanded 0.22.2 scope.
 
 ## 0.22.1
 
 - Vhost UX: replaced separate WebSocket/H2 RFC 8441/H3 RFC 9220 checkboxes with one transport selector; H2/H3 modes keep HTTP/1.1 Upgrade as an explicit fallback and unavailable transports are disabled from listener capabilities.
-
 - UI polish: replaced the overview TLS listener tile with compact HTTP protocol and WebSocket protocol mini charts; Target and Cache key/tags cells remain copyable with full values.
-
 - Keep the overview metrics in one shared stats grid so the WebSocket/H2/H3/TLS row uses exactly the same card geometry as the primary metrics, without a transport-specific dashboard layout. Make Cache **Target** and **Cache key / tags** cells copy their full untruncated value on click/keyboard activation.
 - Polish the 0.22.1 administration UI: move **Active tunnels** into the WebSocket dashboard card, flatten the H1/H2/H3 tunnel breakdown to match the standard transport-card styling, and align Cache modal close actions with the vhost modal header pattern.
-- Fix Rust ownership in tunnel registration by releasing the client-IP mutex guard before moving the shared exchange into the active tunnel, and remove an unnecessary mutable H2 upstream reader binding.
 - Move selective cache PURGE/BAN and the active BAN list into dedicated Cache modals, keep their launch actions beside **Purge selected scope**, and use null-safe inline operation feedback consistent with login errors.
 - Add opt-in RFC 8441 WebSocket Extended CONNECT for HTTP/2, with per-vhost controls beside RFC 9220, listener-scoped SETTINGS advertisement, H2-to-H1 bridging, explicit H2 upstream forwarding, cancellation/idle timeout and transport-specific metrics.
 - Add opt-in cleartext HTTP/2 prior-knowledge (`h2c`) listeners. Legacy HTTP/1.1 `Upgrade: h2c` remains deliberately unsupported because the current Hyper integration cannot safely reconstruct the required HTTP/2 stream 1 bootstrap.
 - Add stable active-tunnel IDs, authenticated tunnel inventory/kill API, operator-supplied close reasons, audit records, RX/TX/duration metadata and an administration modal.
-- Consolidate active WebSocket/tunnel visibility on the main dashboard as total plus H1 / H2 RFC 8441 / H3 RFC 9220 counters while retaining ordinary H2/H3 request statistics separately.
-- Preserve `Accept-Ranges` from origins and synthesize it only for RustProxy-generated cached range responses; transformed/compressed representations continue to remove incompatible range advertising.
-- Update source/package/UI/OpenAPI/Debian/Grafana/tooling identity to 0.22.1.
-
+- Additional historical details for this release are retained in the technical archive.
 
 ## 0.22.0
 
-- Fix a Rust ownership regression in the upstream request path: retain a cloned origin URI for proactive refresh after the request URI is assigned.
 - Add per-cache-key request collapsing for foreground MISS/fill traffic with bounded wait, configurable timeout fallback, cancellation-safe leader release and collapse metrics.
 - Add single `Range: bytes=...` handling from complete cached objects, including `206`, `416`, `Content-Range`, `Accept-Ranges` and `If-Range`; multipart/unsupported ranges remain origin pass-through and are not cached as separate objects.
 - Extend stale-if-error with configurable transport failure classes and an explicit 5xx status allowlist while preserving the previous default behavior.
@@ -197,33 +173,18 @@
 - Add selective cache PURGE by exact URL, prefix, tag, regex or cache key, including query/Vary handling, RAM + Cold Cache invalidation and a publication barrier preventing pre-PURGE fills from republishing stale data.
 - Add lazy BAN rules with lookup-time enforcement, bounded rule count/TTL, incremental garbage collection, rule deletion and metrics.
 - Add authenticated administration API and Cache panel controls for PURGE/BAN, broad-operation confirmation, per-object Purge URL actions, BAN listing/removal and audit entries.
-- Extend cache diagnostics, OpenAPI, translations and regressions for the 0.22 cache behavior.
-- Update package/source/UI/OpenAPI/Debian/Grafana/tooling identity to 0.22.0.
-- Preserve the resolved dependency graph; compiler/live acceptance remains an explicit release-host gate when Cargo/Rust are unavailable in the packaging workspace.
 
 ## 0.21.0
 
-- Fix browser refresh on the dedicated **Transform** route by serving the dashboard document at `/transform` and covering it in the panel-route regression.
-- Align the Cache **Transformed** marker with the dashboard geometry by replacing the capsule outline with the standard badge border and a 3px corner radius.
-- Give the Live traffic **Transformed** series a dedicated violet chart token in dark/light themes so it remains distinct from HTTP/2 green.
+- Fix browser refresh on the dedicated **Transform** route by serving the dashboard document at `/transform`.
 - Add a dedicated Transform administration workspace with global/per-vhost runtime counters for applied/skipped/error transformations, transformed cache HITs, byte savings, reduction, transform time, kind breakdown and bounded skip reasons.
 - Add a transformed-response series to **Live traffic** (fresh transformations plus transformed cache HITs) and render **Core state** uptime in compact human-readable units.
 - Rename the proxy-owned backend timing diagnostic to `X-RustProxy-Backend-Time`; the legacy lookalike `X-Rust-Proxy-Backend-Time` is stripped but is no longer emitted.
-- Fix Docker-vhost Passive Backend Health checkbox sizing so enabling the expanded editor cannot make fields overlap.
-- Remove the unused mutable `origin` binding from the background revalidation path.
-- Replace the monolithic `src/cache.rs` with the responsibility-based `src/cache/` module (`model`, lifecycle, cold storage, dashboard, tickets, lookup, policy, fill and tests) and update source/package gates for the new layout.
-- Fix the cache split so method groups are emitted from module-scope `include!` files wrapped in their own `impl Cache` blocks; this avoids the Rust compiler error caused by `include!` directly in impl-item position.
 - Persist transformed-representation metadata through hot/Cold Cache, mark transformed objects in the Cache dashboard, and append `transformed` to standardized RFC 9211 `Cache-Status` diagnostics; origin `X-Cache-Status` lookalikes are stripped rather than emitted.
-
 - Shard Cold Cache storage and add bounded asynchronous garbage collection plus selective manual cleanup.
 - Add RFC 5861 stale windows, request `max-stale`, age-aware request `max-age=N`, and correct `must-revalidate` / `proxy-revalidate` behavior while preserving `s-maxage` priority.
 - Harden transformed cache fills so transformed Content-Length is authoritative, incomplete streams cannot publish partial objects, and canonical transformed identity representations do not fragment on origin `Vary: Accept-Encoding`.
-- Add the static-response transformation pipeline before cache/client compression, with strict `no-transform`, separate origin/representation validators and JS/CSS plus optional conservative HTML/SVG and parsed JSON transforms.
-- Keep route cache overrides tri-state and add effective route/cache/transform diagnostics.
-- Make Passive Backend Health explicit opt-in (default OFF) for ordinary and Docker vhosts, independent from active TCP/HTTP health, with per-error-class policy, separate counters and persisted Docker assignment settings.
-- Extend administration UI/OpenAPI and regression coverage for Cold Cache cleanup, transform settings, passive health and cache semantics.
-- Keep release/package/UI/OpenAPI/Debian/Grafana/tooling identity at 0.21.0.
-- Close the 0.21.0 feature scope for release packaging. Parser-backed JS/CSS minifiers are deferred; compiler/live acceptance still has to be executed on a Rust-enabled release host.
+- Additional historical details for this release are retained in the technical archive.
 
 ## 0.20.0
 
@@ -232,31 +193,18 @@
 - Add explicit ACME operation state cards and include the exact private Certbot log directory in failed issuance/renewal messages.
 - Expose per-managed-certificate Certbot log directories from the authenticated ACME status endpoint so persisted renewal failures remain actionable after refresh/restart.
 - Rework renewal entries into readable cards with provider/environment, last check, next check, expiry and grouped actions.
-- Update release/package/UI/OpenAPI/Debian/Grafana/tooling identity to 0.20.0.
 
 ## 0.19.4
 
-- Align the Docker-vhost Aliases editor with the standard 38px Docker form controls and remove the inherited `host-chip-field` label margin that created an extra visual line below `Aliases`.
 - Preserve backend traffic display semantics: idle renders as `0.0 KiB/s`, and positive rates below 0.1 KiB/s render as `<0.1 KiB/s` in both backend rows and aggregate vhost traffic.
 - Add a presentation filter to **Cache -> Domains and effectiveness** with All / Cache enabled / Cache disabled choices, using each vhost's resolved cache settings while leaving aggregate statistics unchanged.
-- Update release/package/UI/OpenAPI/Debian/Grafana/tooling identity to 0.19.4.
 
 ## 0.19.3
 
-- Fix the compiler error in the release checker body collector by converting Hyper/http-body-util boxed collection errors explicitly into `anyhow::Error` instead of calling `anyhow::Context` on an unsupported boxed error type.
 - Simplify the dashboard footer to API latency and dropped-log count, and add a fail-soft built-in release checker using embedded `UPDATE_CHECK.toml` defaults. The checker reads the official Cargo manifest immediately and then hourly, exposes a newer-version link in the footer, and never performs automatic upgrades.
 - Allow runtime release-check overrides through `--update-repository-url`, `--update-version-url` and `--update-check-interval-secs` (plus matching `RUST_PROXY_*` environment variables); interval `0` disables checks.
-- Fix the remaining oversized Live Logs column checkboxes by excluding checkbox/radio inputs from both broad `.log-tools input` text-field sizing blocks that were overriding the shared 15px checkbox rules.
 - Add an account-scoped light/dark administration theme stored in the existing SQLite `admin_preferences` document; dark remains the default and the last authenticated choice is cached locally only to avoid login/dashboard first-paint theme flicker.
-- Refactor theme-sensitive UI colors into shared CSS variables and keep checkbox/radio controls out of generic text-input sizing/density rules.
-- Rework the Live Logs column picker into a compact scrollbar-free list with standard-size checkboxes; short viewports use two columns instead of an internal scroll area.
-- Keep expired-session re-authentication on the exact panel and Settings sub-tab, use the minimal public login document without flashing the authenticated shell, and show embedded login errors inline instead of as global toasts.
-- Canonicalize the legacy `/configuration` shortcut to `/settings?tab=manual-config` and keep later Settings tab switches in the URL so F5 restores the exact page.
-- Add one shared saving-state helper for settings/security/certificate forms: disable the active submit button, show `Saving…`, restore its translated label, and prevent duplicate submissions while a save is in flight.
-- Highlight and focus the actual invalid control for local validation failures in Logging JSON, named listeners, Docker-agent listener selection, TLS policy, ACL profiles, manual JSON and certificate forms.
-- Preserve selected certificate/key files after a failed certificate import/save so the administrator can correct the problem without reselecting both files.
-- Mark Settings tabs with a subtle unsaved-change dot, including Manual config, and keep dirty values from being overwritten by live config refreshes.
-- Update release/package/UI/OpenAPI/Debian/Grafana/tooling identity to 0.19.3.
+- Additional historical details for this release are retained in the technical archive.
 
 ## 0.19.2
 
@@ -264,37 +212,20 @@
 - Make **Discard changes** reload the persisted vhost being edited instead of replacing the editor with a new blank/default vhost.
 - Add descriptive HTTP reason phrases to the default-response status selectors and headings.
 - Add a temporary, continuously updated 4096-entry Live-log buffer that resets when the log window closes.
-- Align inline checkbox labels and compact Docker-vhost alias controls.
 - Stop backend traffic EWMA tails on an idle sampling window, show idle consistently as `0.0 KiB/s`, and render positive sub-0.1 KiB/s traffic as `<0.1 KiB/s` instead of a rounded zero.
-- Make the Live Logs column picker substantially smaller with subtle 11px checkboxes; let the menu escape the log-dialog clipping boundary and open upward on short viewports.
-- Default newly created vhosts to the standard HTTP `:80` listener when available; HTTPS listeners are selected explicitly.
-- Left-align the Settings -> Docker agents save action to match the other settings forms.
-- Suppress dashboard/login first-paint flicker and preserve the active Settings sub-tab across F5, including a re-login redirect back to `/settings?tab=...` and `/docker-vhosts`.
-- Replace native browser confirmations with application-styled confirmation dialogs and add panel-area context to API error messages.
-- Present login failures as an inline styled error below the form, including invalid-credential responses.
-- Install a login-shell PATH profile for the managed `current` release directory on first install; updates check and warn about the profile without changing it.
-- Enforce `no-store` and suppress cache diagnostics/validators for local placeholder/static/default pages.
-- Allow vhost-ID renames with duplicate protection, confirmation and an explicit runtime-identity warning.
-- Update source, UI, OpenAPI, regressions and package identity to 0.19.2.
+- Additional historical details for this release are retained in the technical archive.
 
 ## 0.19.1
 
-- Fix Default responses section saves by passing the normal `{expected_revision, value}` payload to `/api/config/pages` and add server-side `pages` section handling/regression coverage.
 - Add frontend scheme to the primary cache hash so otherwise identical HTTP and HTTPS requests cannot reuse one object.
 - Retain 4096 completed access-log entries while keeping the 256-entry live window; add one-shot on-demand history loading and document the API limit.
 - Render backend traffic with KiB/s as the minimum unit, simplify the Live Logs column picker, align generic checkboxes and move Docker-vhost Advanced switches beside Backend protocol on desktop; remove the redundant alias help line.
-- Remove stale simulated dashboard screenshots, retain only two explicitly labelled legacy references and add a documentation index for historical/version-labelled material.
-- Restore the integration-test sources and independent Argon2id fixture required by release/source checks so compiler-enabled test builds no longer reference files missing from the supplied source archive.
-- Update source, UI, OpenAPI, regressions and package identity to 0.19.1.
 
 ## 0.19.0
 
 - Persist per-administrator Live Logs column visibility in SQLite schema v4 without changing the revisioned proxy configuration; JSON export remains complete regardless of visible columns.
-- Keep the Live Logs column selector visually consistent with the existing compact `check vh-check` controls instead of rendering oversized standalone checkbox widgets.
 - Add authenticated `GET/PUT /api/preferences` endpoints for dashboard-only account preferences, protected by the existing session/CSRF control-plane guards.
-- Remove the duplicate version badge from the top-right dashboard toolbar while keeping the footer release identity.
 - Retain the full disabled-verification legacy X.509 fix and expanded upstream connector diagnostics introduced during the 0.18.8 follow-up.
-- Update release/package identity to 0.19.0.
 
 ## 0.18.8
 
@@ -302,36 +233,27 @@
 - Expand upstream connection diagnostics with the full nested Hyper/rustls/io error chain, backend/TLS context, 2 KiB UTF-8-safe detail storage and warning-level journal entries for connect failures.
 - Replace Docker-vhost alias comma input with hostname-style chips for add/remove/paste workflows.
 - Add per-Docker-vhost HTTP-to-HTTPS redirect, WebSocket and cache controls; new compatible assignments default HTTP-to-HTTPS redirect on while legacy assignments retain their prior redirect-off behavior until explicitly saved.
-- Align Docker-vhost boolean controls with the application's standard checkbox classes and keep checkbox inputs from inheriting full-width text-input sizing.
 - Add a Docker-agent default ACL-profile selector. Generated Docker vhosts inherit it unless the application selects its own ACL profile; existing per-app inline ACL configuration is unchanged.
-- Remove the compression-codec negotiation explainer from the Overview dashboard.
-- Update release/package identity to 0.18.8.
+- Additional historical details for this release are retained in the technical archive.
 
 ## 0.18.7
 
 - Collapse **Response time history** by default on the Overview dashboard while keeping live sampling active.
-- Restyle per-interface RX/TX histories to use the same chart geometry and visual treatment as the aggregate RX/TX history, without nested panel backgrounds.
-- Align expanded Docker-vhost routing and ACL controls with uniform field blocks; Preserve Host and per-app ACL switches now occupy the same label/control rhythm as neighboring inputs, and ACL selects no longer stretch to textarea height.
-- Update release/package identity to 0.18.7.
 
 ## 0.18.6
 
 - Add bounded per-interface RX/TX diagnostics from `/proc/net/dev` to the administration status payload and render separate live interface histories without adding per-interface Prometheus labels.
-- Strengthen compression negotiation regressions with explicit `q=` preference cases for gzip, Brotli, Zstd and deflate; clarify that dashboard counters track the codec actually selected per response.
-- Align Docker-agent settings inputs/actions, keep Enabled/status/remove controls on one stable row, and add spacing between listener selection and the Add Docker agent action.
-- Update release/package identity to 0.18.6.
+- Clarify compression negotiation and make dashboard counters track the codec actually selected per response.
 
 ## 0.18.5
 
-- Make compression accounting follow an explicit RustProxy-applied codec marker instead of re-reading `Content-Encoding`; add independent gzip/br/zstd/deflate counter regression coverage.
 - Add an explicit HTTP/1.1 request counter and render total + HTTP/1.1 + HTTP/2 + HTTP/3 request-rate series on the Overview chart.
 - Add an Open app action to published Docker vhosts, using the assigned frontend listener and expanded proxied hostname.
 - Label Docker-generated pools in the Backends view with their primary proxied domain.
 - Remove the global Open proxy shortcut from the page header.
 - Make Compact density materially tighter than Dense across cards, controls, tables, Docker rows and charts.
 - Default vhost/Docker proxy timeout controls to explicit 10/120/60/60-second connect/header/read/send limits instead of blank inherited values.
-- Replace free-form Docker-agent listener-ID entry with the configured named-listener selector; move Enabled left of the centered connection-status badge.
-- Update release/package identity to 0.18.5.
+- Additional historical details for this release are retained in the technical archive.
 
 ## 0.18.4
 
@@ -340,42 +262,21 @@
 - Collapse secondary Docker-agent inventory metadata behind Agent details while keeping host, service count, last observation and base domain immediately visible.
 - Rework Settings -> Security into focused account/session and host-policy cards with on-demand password and policy editors.
 - Move Administration audit into a dedicated modal and stop fetching audit entries merely by opening the Security settings tab.
-- Update release/package identity and EN/PL UI copy to 0.18.4.
 
 ## 0.18.3
 
 - Add Docker-vhost search plus persistent per-browser Hide/Show Hidden view controls, and allow each Docker agent to select a configured frontend certificate inherited by its generated vhosts.
 - Keep Docker inventory polling driven by each agent's configured 5..3600 second interval; the 5-second dashboard refresh reads cached observations only.
 - Move redirect HTTP/2 and HTTP/3 toggles below listener selection and keep Cache `Updated` + `Live` together at the right side of the toolbar.
-- Remove the unused `config::yes` helper warning.
 - Add an Open-in-browser action beside each vhost Enabled state; wildcard-only hosts open the wildcard base domain, while mixed host lists prefer the first non-wildcard name.
 - Restore the documented HTTP/1.1 backend default for newly created ordinary and Docker vhosts: preserve the public `Host`; existing explicit backend settings are not rewritten.
 - Write HTTP/1 upstream header names in conventional title case for compatibility with legacy/custom origins that incorrectly treat header names as case-sensitive; HTTP/2 is unaffected.
-- Add bounded `upstream_error` diagnostics to access logs/live logs so TCP/TLS/HTTP-client failures that previously appeared only as 503 with no upstream status can be distinguished.
-- Restrict local/error response selectors to supported error statuses; application-style 404 hosts offer only bundled 401/403/404/429/503/504 templates, including a new dedicated 404 template.
-- Make Docker Publish/Unpublish an immediate per-service configuration action, add per-service Apply, and replace unconditional UI rerendering with an operator-controlled Live view that reads only RustProxy's in-memory state.
-- Add per-agent Docker inventory polling intervals (5..3600 seconds), while manual refresh still polls immediately.
-- Add reusable ACL-profile plus inline IP/CIDR ACL controls per Docker application, and protect referenced profiles from deletion.
-- Add per-vhost proxy connect/response-header/read/send timeout controls for ordinary and Docker-backed vhosts.
-- Print the Docker-agent bearer token after installation alongside the certificate fingerprint.
-- Improve 404 Hosts response UX with supported error-status selectors, application-style built-in status pages, cache-diagnostic suppression and protocol toggles beside listener selection.
-- Add optional per-vhost JSONL access-log files under a configurable directory while retaining the combined-file mode, Logstash and Loki sinks.
-- Lock HTTP/HTTPS/admin listener addresses that are supplied explicitly by systemd/CLI/environment so the control plane cannot remove, disable or rewrite process-owned binds; listeners not supplied at startup remain editable.
-- Remove the separate remote-admin risk-acknowledgement requirement; plain remote administration now requires only `--allow-remote-admin`, while legacy `--accept-remote-admin-risk` is accepted as a hidden no-op so older systemd units still start.
-- Tighten Compact/Dense dashboard density, rename the Shared RAM cache surface to **Cache**, expose redirect targets directly on cards, and keep 404 Hosts aligned with the application error-code set.
-- Clarify that TLS Policy is inherited globally and show currently effective cipher suites alongside all available rustls suites.
-- Treat ACME-issued certificates as managed/read-only in the custom-file editor, require certificates to be unassigned (including the administration panel/default binding) before deletion, and default new ACME issuance to the production CA environment.
-- Make classic HTTP/1.1 Upgrade the default WebSocket path; RFC 9220 Extended CONNECT over HTTP/3 is now an explicit experimental per-vhost opt-in and is advertised only on QUIC listeners with an opted-in vhost.
-- Split Docker discovery/vhost observability into dedicated `rust_proxy_docker_vhost_*` and `rust_proxy_docker_backend_*` Prometheus metric families; Docker pools no longer appear in ordinary vhost/backend series.
-- Add a separate live **Docker vhosts** Prometheus collector group, enabled by default, with configured agent/assignment/domain gauges plus Docker vhost traffic/status/duration and full backend health/probe/runtime metrics.
-- Extend Prometheus/OpenAPI/UI documentation and regression coverage for the Docker metric boundary.
-- Extend the bundled Grafana operations dashboard with a dedicated Docker-vhost section and per-agent/service filters using only the separate Docker metric families.
-- Fix Docker discovery compilation against the locked HTTP/body stack by mapping limited-body collection errors explicitly and logging `ApiError` via its `Debug` representation.
+- Additional historical details for this release are retained in the technical archive.
 
 ## 0.18.2
 
 - Secure Docker-agent transport by default with a persistent self-signed ECDSA certificate and SHA-256 certificate pinning in RustProxy; public-CA HTTPS remains available without a pin and plain HTTP is compatibility-only.
-- Add certificate lifecycle helpers, hardened systemd state storage, installer fingerprint output and TLS regression tests for the standalone Docker agent.
+- Add certificate lifecycle handling, hardened systemd state storage and installer fingerprint output for the standalone Docker agent.
 - Enable per-Docker-vhost HTTP/TCP backend health checks using the same bounded backend-pool health machinery as ordinary vhosts, with live checking/up/down, latency, probe, request, active and error diagnostics in Docker vhosts.
 - Rework Docker-agent and Docker-vhost UX around connection security, last observation, detected addresses, route controls and collapsible health-check tuning while retaining per-agent domains, aliases and per-service IP selection.
 
@@ -395,7 +296,6 @@
 - Move the cache Live toggle to the action-toolbar edge.
 - Remove configurable `X-Rust-Proxy-Revision` response exposure and always strip the header.
 - Use the installed `rust-proxy admin reset-password` command in production recovery guidance.
-- Update EN/PL strings, documentation, release checks and package identity to 0.18.0.
 
 ## 0.17.0
 
@@ -405,12 +305,10 @@
 - Add dedicated listener/certificate-aware local-response / 404 hosts with built-in placeholder, empty/status-only and custom-HTML modes.
 - Keep the default `RustProxy is running` placeholder uncacheable and intentionally free of optional proxy/cache/backend/diagnostic/security/compression headers.
 - Reuse vhost-style hostname chips for Redirect source domains.
-- Update OpenAPI, EN/PL UI, release checks and package identity to 0.17.0.
 
 ## 0.16.1
 
 - Remove internal configuration revision numbers from successful save feedback in dashboard editors/manual configuration while retaining revision-based CAS and stale-write protection internally.
-- Update source, UI, OpenAPI, release tooling and packaging identity to 0.16.1.
 
 ## 0.16.0
 
@@ -420,15 +318,13 @@
 - Add cache transient-memory gauges and procfs RSS/data/swap breakdowns to the dashboard and Prometheus. Existing allocator trimming/release behavior is unchanged; no new transient-memory throttle is introduced.
 - Reorganize the Vhost editor around clearer backend cards, Authentication subcards and compact protocol controls. New vhosts select standard HTTP :80 plus HTTPS :443 together when available; Redirects reuse the same listener selector; disabled vhost cache hides its subordinate controls and new vhost drafts default cache to off.
 - Show the local-listener risk acceptance only when the entered backend URL directly targets the configured administration listener. Add protected opt-in `X-RustProxy-Backend` and `X-RustProxy-Backend-Time` response diagnostics for selected member identity and origin response-header latency.
-- Bump source, UI, OpenAPI and packaging identity to 0.16.0.
 
 ## 0.15.1
 
-- Fix Custom locations EN/PL translation loading by keeping all UI strings inside the language-pack `translations` map and add a regression check that rejects stray top-level translation keys.
+- Fix Custom locations English/Polish translation loading in the administration UI.
 - Make visual header rules easier to edit with numbered cards, clear field grouping, empty-state guidance and localized help.
 - Add a live per-location behavior preview for matching, action, rewrite, cache, ACL and header rules, and reorganize the inline documentation with common examples.
 - Add one live three-series HIT/MISS/BYPASS activity chart to the RAM cache card and CPU/RSS history charts to the Proxy process card.
-- Extend offline source/release checks for the new location UX and dashboard charts; package identity is 0.15.1.
 
 ## 0.15.0
 
@@ -438,10 +334,7 @@
 - Move per-vhost `Server-Timing` and verified Cloudflare client-IP diagnostics into the main frontend/details configuration.
 - Add compact dashboard history charts for RAM-cache residency, network RX/TX and mean response latency, plus administration API RTT and low-priority queue/drop information in the footer.
 - Add independent cold-cache age policy controls: demote by time since last access, by total hot-tier residency, by LRU pressure and on graceful shutdown.
-- Add verified effective client/source IP to live logs and logging field mappings; early responses still record at least the transport peer.
-- Remove the runtime legacy renewal-observation JSON importer. Stopped source upgrades remove the obsolete sidecar as the final upgrade step without importing it or retaining a second legacy copy; SQLite remains the only live renewal-observation store.
-- Normalize repeated literal path separators for routing/ACL decisions, matching Nginx `merge_slashes` behavior, while preserving the original request target to the backend when no rewrite is configured. URLs such as `/static/js//events.js?v=...` are therefore accepted without weakening encoded-separator/dot-segment protections.
-- Bump source, panel, OpenAPI, upgrade tooling and package identity to 0.15.0 and extend offline regression contracts for the new controls.
+- Additional historical details for this release are retained in the technical archive.
 
 ## 0.14.0
 
@@ -449,8 +342,6 @@
 - Trust forwarded administration host/scheme only from loopback or configured trusted proxy peers, use the external scheme for Origin/CSRF checks, and set/clear Secure session cookies consistently behind HTTPS termination.
 - Implement RFC 9220 WebSocket over HTTP/3 Extended CONNECT, including `SETTINGS_ENABLE_CONNECT_PROTOCOL`, `:protocol=websocket` validation, HTTP/1.1 backend Upgrade translation, downstream 200 bootstrap, bidirectional H3 DATA transport and FIN/reset cancellation handling.
 - Replace the separate `h3`/`h3-quinn` pair with `hpx-h3 2.5.19` and its integrated Quinn feature to expose the RFC 9220 protocol extension through the HTTP/3 stack.
-- Rename dashboard backend, health, security, error-page and recommended-preset labels in English and Polish.
-- Update release/static checks, HTTP/3 documentation and package identity. The source contains no `certificates.json` certificate metadata path.
 
 ## 0.13.2
 
@@ -458,14 +349,12 @@
 - Make managed software updates force a bounded hot-to-cold cache handoff whenever the cold tier is enabled, independent of the ordinary `cold_on_shutdown` preference, and extend the managed systemd stop budget.
 - Persist non-secret automatic-certificate-renewal observations in SQLite schema v3, preload them before administration listeners are exposed, and import the older `certs/renewals.json` sidecar once for upgrade continuity.
 - Move the raw full-document editor from primary navigation into **Settings -> Manual config** while retaining `/configuration` as a compatibility browser route.
-- Update OpenAPI, EN/PL help, cache/renewal/API documentation, migration/backup checks and release identity for 0.13.2.
 
 ## 0.13.1
 
 - Make administrator browser sessions configurable from 7 to 30 days (30 days by default), replacing the previous short browser lifetime/idle behavior while preserving explicit logout/password/revoke invalidation.
 - Refresh authenticated cookies only to the remaining absolute server-side expiry so session persistence cannot become an unbounded sliding session.
 - Add per-backend `accept_local_listener_risk` with a dashboard confirmation and validation path for deliberate local-listener targets such as `127.0.0.1:9090`; `allow_private` and special-address protections remain independent.
-- Update OpenAPI, transport/security/admin-session documentation, EN/PL strings and release regressions for 0.13.1.
 
 ## 0.13.0
 
@@ -473,7 +362,6 @@
 - Resolve redirect traffic locally before proxy routes while preserving listener ownership and global host ACLs.
 - Change omitted backend `tls_verify` to default false and update UI/API/documentation accordingly.
 - Compact TLS certificate cards: show DNS SAN coverage as the same policy-style badges used on vhosts, collapse bindings/files/assigned-vhost details, and inspect older/manual public PEM files when persisted coverage metadata is missing.
-- Extend OpenAPI, English/Polish translations, regressions and release tooling for 0.13.0.
 
 ## 0.12.1
 
@@ -483,7 +371,6 @@
 - Add independent cold-tier policies for idle objects, LRU evictions and graceful shutdown, reduce the cold-write body queue, flush remaining hot objects before process exit, and trim released allocator memory on glibc/Linux.
 - Expose certificate DNS SubjectAltName coverage separately from active SNI bindings for uploaded and ACME-managed certificates.
 - Preserve secure-by-default backend TLS verification when omitted; keep the explicit debug-origin verification bypass and improve corrective validation/help text.
-- Extend regression/OpenAPI/release checks and bump source/package identity to 0.12.1.
 
 ## 0.12.0
 
@@ -493,8 +380,7 @@
 - Add per-stream live RX/TX rate charts in the dashboard while keeping desired stream changes visibly pending until the process restarts and the listener is actually active.
 - Change named HTTP/HTTPS listener bind-address editing from a textarea to chip-style addresses matching the Vhost hostname interaction, preserving existing multi-address validation.
 - Keep stream forwarding as raw Layer 4 with no HTTP vhost, ACL, cache, headers, compression or authentication envelope.
-- Extend authenticated-asset and offline release/source regressions for the new Streams page and telemetry contracts; bump Cargo, panel, OpenAPI and upgrade/package identity to 0.12.0.
-- Extend the Debian 13+ one-line bootstrap with `auto`/`install`/`update` modes; managed updates build the new source as an unprivileged user and delegate to the existing backup/health-check/rollback update path while preserving saved listeners and private data.
+- Additional historical details for this release are retained in the technical archive.
 
 ## 0.11.5
 
@@ -502,12 +388,9 @@
 - Avoid the `h3-quinn 0.0.10` `stop_sending()` panic path when an HTTP/3 request body is dropped while a receive read is pending.
 - Add raw layer-4 TCP/UDP stream hosts on dedicated listeners with bounded TCP connections / UDP client sessions and restart-bound configuration in the admin panel.
 - Add a Debian 13+ source bootstrap that installs build dependencies and Rust, clones/builds the repository and installs the systemd service with the explicitly requested public admin profile.
-
 - Match Varnish built-in request-method behavior for the shared cache: `GET`/`HEAD` participate in lookup while successful POST/PUT/PATCH/DELETE/OPTIONS/TRACE requests no longer trigger an implicit global purge.
 - Replace the conservative per-request-header/backend-member cache identity with a Varnish-style Host + URL primary identity, isolated by RustProxy vhost/config scope, and use response `Vary` as the secondary representation selector.
-- Share cached objects across load-balanced members and across GET/HEAD, reducing avoidable MISSes while retaining Cookie/Authorization pass behavior and response privacy guards.
-- Preserve `X-Cache-Resident-Age` across backend 304 revalidation and hot/cold tier movement. Cold metadata format 2 stores variant identity and resident age explicitly.
-- Add cache regressions for Vary variants/schema changes, Host/URL hashing, explicit ports, HEAD eligibility and resident-age continuity; update release/package/API/UI metadata to 0.11.5.
+- Additional historical details for this release are retained in the technical archive.
 
 ## 0.11.4
 
@@ -515,15 +398,12 @@
 - Add a visual reusable ACL-profile rule editor with add/remove/action/CIDR rows. Keep bulk paste/import as an advanced path, normalize invisible Unicode whitespace and report malformed rules with their source line.
 - When a vhost disables cache, strip and suppress RustProxy `X-Cache`, `X-Cache-Hits`, `Cache-Status`, `X-Cache-Reason` and `X-Cache-Resident-Age` diagnostics for that response.
 - Render backend pools belonging to disabled vhosts as muted `Disabled` rows in the main dashboard instead of classifying them as unavailable.
-- Add source/offline regression coverage and bump release/package/UI/OpenAPI/update metadata to 0.11.4. Rust compilation/runtime acceptance remains open in this packaging environment.
 
 ## 0.11.3
 
 - Add per-vhost control over forwarding the effective client IP to the application. Disabling it removes `Forwarded`, `X-Forwarded-For` and `X-Real-IP` only on the backend request; ACLs, GeoIP, rate limiting and Tinyauth continue to use the real client identity.
 - Add a compact Vhost search/filter for vhost IDs, hostnames/wildcards and backend IDs/URLs.
-- Fix the invalid `quinn = 0.11.22` manifest requirement to the resolved `0.11.12` and stop `dev.sh` from rewriting a valid checked-in `Cargo.lock`.
 - Fix JSONL access logging under the hardened systemd unit by provisioning `/var/log/rustproxy` as a writable service log directory while keeping `ProtectSystem=strict`.
-- Add source/offline regression coverage and bump release/package/UI/OpenAPI/update metadata to 0.11.3. Rust compilation/runtime acceptance remains open in this packaging environment.
 
 ## 0.11.2
 
@@ -531,14 +411,12 @@
 - Preserve strict HTTP/1.x Host handling and reject conflicting HTTP/2 `Host` versus `:authority` values to avoid ambiguous authority validation.
 - Add per-vhost Force SSL beside frontend selection. Cleartext requests receive a non-cacheable HTTP 308 to the same hostname/path/query on the vhost's unique selected TLS port; ambiguous multi-port TLS selections are rejected.
 - Map NPM `ssl_forced` (and migrator `--force-https`) to RustProxy `force_ssl`, retaining HTTP+HTTPS listener bindings when available instead of importing forced hosts as TLS-only.
-- Add unit/integration regression coverage for HTTP/2 administration authority, `/healthz`, Force SSL redirect construction/validation and NPM `ssl_forced`; bump release/package/UI/OpenAPI/update metadata to 0.11.2. Rust compilation/runtime acceptance remains open in this packaging environment.
 
 ## 0.11.1
 
 - Fix release update health checks when the administration panel uses persisted HTTPS or a persisted bind different from the install-time CLI address. The check now resolves the active admin listener/scheme from `config.sqlite3` and honors the admin Host allowlist.
 - Add a standard-library-only Nginx Proxy Manager SQLite migrator. It reads `proxy_host`, creates RustProxy vhosts/backends, preserves wildcard names/WebSocket/enabled/H2 intent, uses the RustProxy default certificate for imported TLS hosts unless a named certificate is selected, and keeps unsupported NPM policy/custom-config items as explicit review warnings.
 - Make NPM migration dry-run by default, emit `npm-migration-plan.json`, detect hostname conflicts, split source records above RustProxy's 16-host limit and use revisioned authenticated API writes only with explicit `--apply`.
-- Add offline regression coverage and bump release/package/UI/OpenAPI/update metadata to 0.11.1. Rust compilation/runtime acceptance remains open in this packaging environment.
 
 ## 0.11.0
 
@@ -548,21 +426,16 @@
 - Add compact browser-session request-rate history charts to vhost cards, with progressive compaction of older samples.
 - Add the built-in HTTP 401 page and classify normal WebSocket tunnel EOF/reset/abort/broken-pipe termination after a successful 101 upgrade as `websocket_closed` rather than a body/proxy error.
 - Redirect plaintext requests received on the HTTPS administration socket to HTTPS while keeping application content unavailable over plaintext. Permit valid DNS Host values when the HTTPS admin hostname allowlist is empty; explicit allowlists remain strict.
-- Extend named listeners to up to 16 explicit local addresses under one protocol policy. Multiple-address configurations reject unspecified `0.0.0.0`/`::` binds.
-- Align the Logging field-builder dialog with the Vhost configuration modal and reposition the Configure fields action next to the format preset.
-- Make source ZIP generation deterministic and verify byte-identical archives in release smoke tests.
-- Bump Cargo, panel, OpenAPI, installer/update metadata and package identity to 0.11.0. Rust compilation/runtime acceptance remains open in this packaging environment.
+- Additional historical details for this release are retained in the technical archive.
 
 ## 0.10.0
 
 - Add an optional persistent cold cache tier under the private data directory. Hot LRU/idle objects demote through a bounded asynchronous queue; fresh cold hits are SHA-256 checked and promoted back into the bounded RAM tier.
 - Add hot/cold object, byte, promotion, demotion, cold-hit, eviction/error and queue-drop observability to the Cache API, panel and Prometheus output.
 - Add cold-tier path, byte/object budgets and idle demotion settings; purge/config publication invalidates both tiers and startup rebuilds the same-revision cold index.
-- Document browser hard-reload revalidation behavior and add translations for the exact `request_no_cache`, `request_max_age`, `request_min_fresh` and `request_pragma_no_cache` reasons.
 - Add structured-log Standard, Nginx-style, ECS-style and Minimal presets plus a visual field picker/renamer with JSON preview; preserve advanced raw JSON mappings.
 - Reuse the shared application card component for Logging sinks and remove release-specific fieldset border styling.
-- Add baseline multi-stage Docker/OCI packaging with an unprivileged runtime user and persistent data volume. Docker discovery remains deferred.
-- Bump Cargo, panel, OpenAPI, installer/update metadata and package identity to 0.10.0. Rust compilation/runtime acceptance remains open in this packaging environment.
+- Additional historical details for this release are retained in the technical archive.
 
 ## 0.9.0
 
@@ -572,9 +445,7 @@
 - Add administration HTTPS with either the application-managed default certificate or a selected inventory certificate. Persisted non-loopback administration binds are accepted when HTTPS is enabled.
 - Keep loopback HTTP as the default and retain the explicit legacy risk gate for plain remote HTTP. Secure session cookies are marked `Secure` on HTTPS administration.
 - Add global TLS 1.2/1.3 and rustls cipher-suite policy plus per-vhost TCP TLS overrides. HTTP/3 vhosts must use the global TLS 1.3 policy.
-- Add dedicated Logging navigation and full-width Settings tabs with new Administration and TLS policy pages.
-- Complete roadmap items for remote HTTPS administration and `X-Cache-Resident-Age`; bump release identity, OpenAPI and packaging metadata to 0.9.0.
-- Rust compilation/runtime acceptance remains unverified in this packaging environment.
+- Additional historical details for this release are retained in the technical archive.
 
 ## 0.8.1
 
@@ -584,98 +455,52 @@
 - Keep request `no-store` as a hard bypass. Allow response `Cache-Control: no-cache` with ETag/Last-Modified to be stored only for mandatory validation; `no-store` and `private` still forbid shared storage.
 - Retain expired validator-bearing objects for a bounded one-hour revalidation keep window without stale delivery.
 - Raise the configurable object ceiling from 8 MiB to 1 GiB, still bounded by the global 1 GiB resident budget.
-- Grow fill buffers incrementally and serialize very large fills through the existing fill semaphore to avoid preallocating the configured object ceiling.
-- Exclude cache-control/Pragma and conditional/precondition headers from representation-key hashing because they govern reuse rather than representation identity.
-- Add cache diagnostics and regressions for conditional HIT, revalidation, no-cache/no-store semantics and the 1 GiB configuration ceiling.
-- Bump Cargo, panel, OpenAPI, installer/update metadata and package identity to 0.8.1.
+- Additional historical details for this release are retained in the technical archive.
 
 ## 0.8.0
 
 - Global static-cache defaults now include common image, stylesheet/script, font, media and download extensions, with request Cookie ignored for matching assets by default. The global and per-vhost controls are visible in the cache UI; `Set-Cookie`, `private`/`no-store` and `Vary: Cookie` still prevent shared caching.
 - HTTP/2 and HTTP/3 are per-vhost frontend opt-outs next to listener selection. Controls are enabled only when a selected named listener supports the protocol; TLS H2 ALPN is narrowed by SNI per vhost.
 - Settings -> Listeners uses normal page scrolling instead of an extra nested scrollbar.
-
 - Add per-vhost request throttling with graphical request/window/burst controls, country-specific limits and country block/allow-only policies. Return built-in HTML 429/403 responses while preserving custom error-page overrides.
 - Download the PDDL `sapics/ip-location-db` user-country IPv4/IPv6 data during first installation over HTTPS and verify publisher SHA-256 checksums; expose load status without exposing client data.
 - Verify the installed GeoIP database against current publisher SHA-256 files on every managed update and download only stale/missing assets before downtime.
-- Make managed updates regenerate the systemd unit and restore it together with code/private data on failure; preserve and report the original failure reason and add a development-only `--reset-config` recovery path for intentionally incompatible saved vhost/settings documents.
-- Add an opt-in per-vhost Cloudflare client-IP mode that accepts `CF-Connecting-IP` only when the direct peer belongs to Cloudflare's published edge CIDRs.
-- Add Server-Timing response diagnostics. Disabled per-vhost H3 removes `Alt-Svc` and rejects HTTP/3 requests for that vhost.
-- Move vhost listener binding exclusively to named listener selection. Listener addresses are configured under Settings; remove the pre-production inline/global listener compatibility importer and reject the old vhost format instead of migrating it.
-- Make health-check mode `off` fully disable active probes and passive health classification instead of quietly learning health from production requests.
-- Add a new-origin debugging preset for HTTPS-by-IP origins: default pool/private-origin/HTTP1/preserve-host enabled and backend TLS verification disabled for newly created panel backends, with explicit warnings about the certificate-verification risk and mismatched settings.
-- Keep per-vhost inherit/override controls for static-cookie cache behavior while the global defaults cover common static extensions. Cookie is ignored only for the cache key/request bypass decision.
-- Fix cache `Age` calculation to retain sub-second response delay and apply RFC 9111 corrected received age before adding response delay.
-- Bump Cargo, panel, OpenAPI, installer/update metadata and package identity to 0.8.0.
-- Rust compilation/runtime acceptance remains unverified in this packaging environment.
+- Additional historical details for this release are retained in the technical archive.
 
 ## 0.7.3
 
-- Generate the one-time administrator setup token from the release CLI even before
-  the first server start; retain the rule that it is invalid after setup completes.
-- Add explicit remote-panel opt-in for `0.0.0.0`/`::`, requiring both
-  `--allow-remote-admin`; keep plain-HTTP risk visible.
-- Make Linux/systemd install defaults listen on HTTP 80 and HTTPS 443; add
-  `--no-https` for explicit HTTP-only installation.
-- Add deployment and admin-host regressions and bump release/package/UI/schema
-  identifiers to 0.7.3.
-- Hotfix backend HTTPS-by-IP with optional `tls_server_name`: TLS SNI and hostname
-  verification may use a DNS name while the validated TCP target stays pinned to
-  the configured backend URL.
-- Add an explicit per-backend `tls_verify` switch, secure by default. Administrators
-  may turn verification off for an HTTPS origin without weakening DNS/address/self-loop
-  policy. Add matching 503/504 HTML gateway pages while preserving custom-page overrides.
-- Rust compilation/runtime acceptance remains unverified in this packaging environment.
+- Generate the one-time administrator setup token from the release CLI even before the first server start; retain the rule that it is invalid after setup completes.
+- Add explicit remote-panel opt-in for `0.0.0.0`/`::`, requiring both `--allow-remote-admin`; keep plain-HTTP risk visible.
+- Make Linux/systemd install defaults listen on HTTP 80 and HTTPS 443; add `--no-https` for explicit HTTP-only installation.
+- Hotfix backend HTTPS-by-IP with optional `tls_server_name`: TLS SNI and hostname verification may use a DNS name while the validated TCP target stays pinned to the configured backend URL.
+- Add an explicit per-backend `tls_verify` switch, secure by default. Administrators may turn verification off for an HTTPS origin without weakening DNS/address/self-loop policy. Add matching 503/504 HTML gateway pages while preserving custom-page overrides.
 
 ## 0.7.2
 
 - Publish a distinct patch release; keep both previous 0.7.1 deliveries historical.
-- Remove the build.rs panic on absent SWAGGER_UI_DOWNLOAD_URL. The asset preparer
-  defaults to pinned Swagger UI 5.32.11 independently of Cargo config discovery.
-- Remove the independently downloading utoipa-swagger-ui adapter and embed the
-  prepared JS/CSS directly, for debug and release. Existing admin guards stay in place.
-- Prepare assets with the existing Python 3.10+ tool requirement, now also needed
-  for direct Cargo builds. Support absolute local tag ZIPs, optional archive SHA-256,
-  bounded exact-member reads, validated download caching and retained license notices.
-- Resolve build input paths from CARGO_MANIFEST_DIR, track local sources and outputs,
-  and report missing tools/assets explicitly instead of silently changing UI versions.
-- Add executable synthetic-archive regression tests and protected license notices.
-- Update release identifiers, packaging/update metadata and migration/build notes.
-- Rust compilation and actual Swagger rendering remain unverified in this environment.
+- Remove the build.rs panic on absent SWAGGER_UI_DOWNLOAD_URL. The asset preparer defaults to pinned Swagger UI 5.32.11 independently of Cargo config discovery.
+- Remove the independently downloading utoipa-swagger-ui adapter and embed the prepared JS/CSS directly, for debug and release. Existing admin guards stay in place.
+- Prepare assets with the existing Python 3.10+ tool requirement, now also needed for direct Cargo builds. Support absolute local tag ZIPs, optional archive SHA-256, bounded exact-member reads, validated download caching and retained license notices.
+- Resolve build input paths from CARGO_MANIFEST_DIR, track local sources and outputs, and report missing tools/assets explicitly instead of silently changing UI versions.
+- Additional historical details for this release are retained in the technical archive.
 
 ## 0.7.1
 
-- Add visual request/response header editing to each custom vhost location, with
-  set/append/remove, validation, isolation and synchronized optional JSON.
-- Split anonymous sign-in from the operational document and module/language bundles.
-  Remove the login tagline; preserve the original brand and compact square style.
-- Reduce public health to `status` and auth discovery to `setup_required` only.
-  Make the public allowlist exact by method and path; private/unknown requests are
-  denied before body/query extraction, including method mismatches and aliases.
-- Keep Origin/Host/CSRF/session guards; reject duplicate CSRF/marker headers and
-  hide login/setup JSON parser details. Clear UI data across tabs and on revocation.
-- Add authenticated `/docs` and OpenAPI with pinned, build-embedded Swagger UI,
-  same-session authorization, read-only execution by default and CSRF-confirmed writes.
+- Add visual request/response header editing to each custom vhost location, with set/append/remove, validation, isolation and synchronized optional JSON.
+- Split anonymous sign-in from the operational document and module/language bundles. Remove the login tagline; preserve the original brand and compact square style.
+- Reduce public health to `status` and auth discovery to `setup_required` only. Make the public allowlist exact by method and path; private/unknown requests are denied before body/query extraction, including method mismatches and aliases.
+- Keep Origin/Host/CSRF/session guards; reject duplicate CSRF/marker headers and hide login/setup JSON parser details. Clear UI data across tabs and on revocation.
+- Add authenticated `/docs` and OpenAPI with pinned, build-embedded Swagger UI, same-session authorization, read-only execution by default and CSRF-confirmed writes.
 - Replace updater reliance on a public version with local MainPID/executable checks.
-- Add source contracts, browser script regressions, actual-router Rust tests and a
-  read-only anonymous-access probe. Rust/build/vendor-renderer acceptance not completed.
+- Additional historical details for this release are retained in the technical archive.
 
 ## 0.7.0
 
-- Renew managed ACME profiles automatically with shared worker bounds, jitter,
-  backoff, private observations and validated CAS hot deployment; expose opt-out,
-  check-now and dry-run controls. Keep previous certificates active on failure.
-- Add install.sh/update.sh for Linux/systemd, root-owned release switching,
-  stopped full-data backups and code/data rollback on failed startup/version checks.
-- Add per-vhost Basic Auth with Argon2id-only storage, optional verified upstream
-  credentials and cumulative graphical IP ACLs. Keep protected content out of cache.
-- Add WebSocket toggles and graphical custom path locations, including explicit
-  exclusion of dedicated path origins from normal pool/sticky selections.
-- Replace the sample welcome page with neutral information, make the protocol
-  fixture opt-in, unify square modal and Settings-tab styling, preserve branding.
-- Add renewal/deployment helper tests and Rust/browser regressions. Rust compilation,
-  live CA renewal and real systemd deployment remain unverified in this environment.
-
+- Renew managed ACME profiles automatically with shared worker bounds, jitter, backoff, private observations and validated CAS hot deployment; expose opt-out, check-now and dry-run controls. Keep previous certificates active on failure.
+- Add install.sh/update.sh for Linux/systemd, root-owned release switching, stopped full-data backups and code/data rollback on failed startup/version checks.
+- Add per-vhost Basic Auth with Argon2id-only storage, optional verified upstream credentials and cumulative graphical IP ACLs. Keep protected content out of cache.
+- Add WebSocket toggles and graphical custom path locations, including explicit exclusion of dedicated path origins from normal pool/sticky selections.
+- Replace the sample welcome page with neutral information, make the protocol fixture opt-in, unify square modal and Settings-tab styling, preserve branding.
 
 ## 0.6.0
 
@@ -685,27 +510,16 @@
 - Add an independently configurable Prometheus endpoint with actual-peer CIDRs, optional environment-sourced bearer token, bounded scrapes and collector switches.
 - Export application/admin/listener/vhost/backend/cache/system data and full-exchange vhost histograms with bounded configured labels.
 - Split Settings into functional switching cards; preserve dirty values, keyboard access and translation discovery; remove Security and legacy routing sidebar entries.
-- Add offline provider/browser regression tests and Rust tests for migration, ACME challenge isolation and scrape authorization. Rust compilation/runtime and actual CA/provider integrations remain unverified.
-- Preserve the original brand assets. Automatic certificate renewal, Cloudflare Tunnel and Docker discovery remain deferred.
+- Additional historical details for this release are retained in the technical archive.
 
 ## 0.5.0
 
-- Add a compact dedicated cache panel with vhost/domain counters, object pagination,
-  TTL/Age/hits, memory/fill diagnostics and authenticated selective purge.
-- Fix reserved administrator-cookie ordering and empty terminating DATA frames;
-  emit fixed cache decision reasons without exposing request secrets.
-- Replace special X-Mock-Origin hiding with the explicit global/vhost revision
-  switch; ordinary response rules still handle arbitrary removable headers.
-- Default HTTP/3 on TLS bindings, retain explicit null opt-outs, and explain
-  overlapping sockets with ownership and concrete protocol/limit differences.
-- Return 503 for upstream connection/unavailability, 502 for invalid responses
-  and 504 for header timeouts; generated errors use no-store.
-- Add basic asynchronous Certbot DNS-01/RFC2136 issuance, staging-first consent,
-  private TSIG/account profiles, output validation and explicit library import.
-  No automatic renewal scheduler or real CA validation is claimed.
-- Add offline helper and UI checks plus Rust regression source. Rust/Cargo remain
-  unavailable in the packaging environment; compilation/runtime unverified.
-
+- Add a compact dedicated cache panel with vhost/domain counters, object pagination, TTL/Age/hits, memory/fill diagnostics and authenticated selective purge.
+- Fix reserved administrator-cookie ordering and empty terminating DATA frames; emit fixed cache decision reasons without exposing request secrets.
+- Replace special X-Mock-Origin hiding with the explicit global/vhost revision switch; ordinary response rules still handle arbitrary removable headers.
+- Default HTTP/3 on TLS bindings, retain explicit null opt-outs, and explain overlapping sockets with ownership and concrete protocol/limit differences.
+- Return 503 for upstream connection/unavailability, 502 for invalid responses and 504 for header timeouts; generated errors use no-store.
+- Add basic asynchronous Certbot DNS-01/RFC2136 issuance, staging-first consent, private TSIG/account profiles, output validation and explicit library import. No automatic renewal scheduler or real CA validation is claimed.
 
 ## 0.4.0
 
@@ -715,131 +529,54 @@
 - Add named multiple-IP listeners with descriptive scope, opt-in legacy routes, reusable vhost references and actual/desired plans.
 - Add Quinn/h3-based HTTP/3 UDP transport, TLS 1.3/SNI, Alt-Svc, per-endpoint connection and per-connection stream/idle limits, shared proxy policies and bounded shutdown. Preserve TCP HTTP/2 plus HTTP/1.1.
 - Hide request-ID/revision headers by default; add individual overrides and optional mock-origin stripping. Apply effective Server policy across all response paths, including extra sockets.
-- Partition cache by actual frontend IP/port and safely probe unknown-length empty requests; preserve nonempty body frames instead of discarding them.
-- Raise toast above active dialogs without making it inert under the modal; retain the logo, compact UI and discovered language packs.
-- Add a loopback-only fake-auth development peer and Rust integration sources for forwarding, auth, extra-socket cache, listener ownership and real QUIC/TCP fallback.
-- Execute frontend/helper/static checks documented in TEST_REPORT.md. Rust/Cargo are unavailable: no passing compilation, real proxy run or full RFC-conformance claim.
-
+- Additional historical details for this release are retained in the technical archive.
 
 ## 0.3.0
 
-- Split the large status JSON macro into small objects and an explicit feature map;
-  preserve response fields without increasing Rust's macro recursion limit.
-- Add optional per-vhost certificate inventory selection and PEM file upload.
-  Validate key/certificate pairing and names, write private immutable files, and
-  activate only through the existing revisioned configuration update.
-- Add per-vhost cache overrides and selective invalidation, including stale
-  in-flight fill cancellation while leaving other host entries intact.
-- Add administrator-authored, bounded global/vhost error pages, static vhost and
-  missing-path responses, direct-IP and unknown-host responses. Retain ACL checks,
-  HEAD handling and authentication challenges; never execute HTML in the admin UI.
-- Move access logs into a separate modal/docked viewer with fixed filters,
-  vhost identity, pause, scoped search/status/method/cache controls and JSON export.
-- Add a compact vhost list, tabbed dialog, live health/latency summaries and visual
-  per-host response/request headers; keep the original logo and favicon.
+- Add optional per-vhost certificate inventory selection and PEM file upload. Validate key/certificate pairing and names, write private immutable files, and activate only through the existing revisioned configuration update.
+- Add per-vhost cache overrides and selective invalidation, including stale in-flight fill cancellation while leaving other host entries intact.
+- Add administrator-authored, bounded global/vhost error pages, static vhost and missing-path responses, direct-IP and unknown-host responses. Retain ACL checks, HEAD handling and authentication challenges; never execute HTML in the admin UI.
+- Move access logs into a separate modal/docked viewer with fixed filters, vhost identity, pause, scoped search/status/method/cache controls and JSON export.
+- Add a compact vhost list, tabbed dialog, live health/latency summaries and visual per-host response/request headers; keep the original logo and favicon.
 - Add density preferences and a Settings shortcut to Security.
-- Add a Python-only mock origin with random data, cache/no-store/private/cookie
-  paths, compression-size payloads, controllable delay/health and error statuses.
-- Add Rust regression source for pages, cache scoping, TLS staging and API guards.
-- Rust compilation/runtime acceptance remains unverified: toolchain unavailable.
-  Executed checks and their exact limitations are recorded in TEST_REPORT.md.
-
+- Additional historical details for this release are retained in the technical archive.
 
 ## 0.2.0
 
-- Replace SizeAbove(u16) with a custom u64 predicate; add >64 KiB threshold regressions.
+- Support compression size thresholds above 64 KiB without truncation.
 - Add IP/port/TLS-bound virtual hosts with frontend(s), backend pool and path policies.
 - Enforce real accepted destination matching; isolate legacy routes from extra sockets.
 - Add weighted round-robin, least-connections, least-traffic, adaptive and IP hashing.
 - Add bounded TCP/HTTP health checks, separate passive failures, recovery and slow start.
 - Add connection keepalive controls, backup members, drain and opaque cookie/IP affinity.
-- Preserve compatible observations/tokens across hot edits; recheck changed/re-enabled members.
-- Keep leases through full uploads/responses/tunnels; never replay failed requests.
-- Add per-vhost TLS-only HSTS, nosniff, frame/referrer/CSP/permissions headers.
-- Retain HTTP/1.1 ALPN with HTTP/2 for TLS frontends and HTTPS origins.
-- Separate cache identities by selected member; bypass cookie-affine pools.
-- Add compact vhost editor, atomic legacy migration, backend observations/API/metrics/log IDs.
-- Extend discovered English/Polish translations; preserve original logo and favicon.
-- Add Rust regression source and a real-binary vhost/keepalive/health acceptance suite.
-- Execute 63 simulated-API UI, 24 SQLite, 21 upgrade, 4 language-mirror, 10 protocol-peer
-  and 7 backend-fixture checks. None is a passing Rust build or runtime test.
-- Rust/Cargo remain unavailable in the packaging environment; compilation/runtime
-  acceptance and a resolved Cargo.lock remain mandatory before deployment.
+- Additional historical details for this release are retained in the technical archive.
 
 ## 0.1.0
 
-Development source advancing directly from 0.0.6. Cloudflare is deferred.
-
-### Added
-
 - Persisted public listener addresses/ports, 80/443 presets, startup defaults and restart status.
 - Bounded streaming shared RAM cache, TTL/Age, LRU, privacy/Vary protections, per-route bypass, optional HIT/MISS headers and audited purge.
 - Streaming gzip, Brotli, Zstandard and deflate controls, final Server policy and a global client-response header editor.
 - Compact dashboard with system/process/cache diagnostics, log filters and export.
-- Compile-time language discovery, JSON packs, metadata/RTL/fallback, and preservation of extra packs during upgrade.
-- Example unprivileged low-port service and cache/settings real-binary integration test source.
-
-### Changed
-
 - Allow ordinary remote-origin 80/443 while guarding local proxy/admin listener targets.
-- Keep original logo/favicon; reduce panel spacing and improve data density.
-- Invalidate cache and older fills on config changes, explicit purge and successful unsafe methods.
-- Expand source/SQL/upgrade/language/frontend checks; actual execution scope is in docs/TEST_REPORT.md.
-
-### Verification boundary
-
-Rust/Cargo and real Rust integration were unavailable. This is a source candidate,
-not a successfully compiled or production-certified binary. No lockfile is fabricated.
+- Additional historical details for this release are retained in the technical archive.
 
 ## 0.0.6
 
-Cumulative development source release. The planned 0.0.3, 0.0.4 and 0.0.5 scopes
-are included here, not represented as separately published archives.
-
-### Fixed
-
-- Explicitly select `src/auth/mod.rs` to prevent the reported flat/folder module
-  conflict when obsolete 0.0.1 source remains in an existing checkout.
-- Detect mixed source layouts and preserve the known legacy auth file; refuse to
-  delete unrecognized local changes.
+- Detect mixed source layouts and preserve the known legacy auth file; refuse to delete unrecognized local changes.
 - Support interactive username input for `admin init`.
-- Replace managed source directories with rollback on copy failure rather than
-  encouraging overlay extraction.
-
-### Added
-
-- DNS and HTTPS manual backends with per-backend pools, bounded DNS workers,
-  validated DNS answers, optional CIDR allowlists and additional PEM trust anchors.
-- rustls public TLS listener, persistent development default certificate, exact SNI
-  bindings, local generate/import commands and explicit hot reload.
-- Public HTTP/2 over TLS ALPN and HTTP/2/auto backend protocol options.
-- Validated HTTP/1.1 WebSocket handshakes and bounded bidirectional tunnels,
-  including TLS on either side, connection leases and a separate idle timeout.
-- Transport metrics, WebSocket lifetime logging, TLS editor and advanced backend
-  controls in the English/Polish panel.
-- Backup of configured/default certificate files alongside the SQLite snapshot.
-- Upgrade regression tests, transport configuration tests, real protocol test
-  scripts and CI steps. Test execution limits are recorded in TEST_REPORT.md.
-
-### Changed
-
-- Public TLS is enabled by default by `dev.sh`; direct binary startup keeps it optional.
-- Listener ports are protected across HTTP, HTTPS and administration.
-- All Markdown documentation is maintained in English.
-- The roadmap identifies the combined transport release and upcoming Docker stages.
+- Replace managed source directories with rollback on copy failure rather than encouraging overlay extraction.
+- DNS and HTTPS manual backends with per-backend pools, bounded DNS workers, validated DNS answers, optional CIDR allowlists and additional PEM trust anchors.
+- rustls public TLS listener, persistent development default certificate, exact SNI bindings, local generate/import commands and explicit hot reload.
+- Additional historical details for this release are retained in the technical archive.
 
 ## 0.0.2
 
-- Introduced RustProxy naming, administrator setup, Argon2id passwords, sessions,
-  CSRF checks, login throttling, password recovery and credential revocation.
-- Added host/route ACLs, generic request/response header policies, administration
-  audit, SSE dashboard updates and security controls in the bilingual panel.
+- Introduced RustProxy naming, administrator setup, Argon2id passwords, sessions, CSRF checks, login throttling, password recovery and credential revocation.
+- Added host/route ACLs, generic request/response header policies, administration audit, SSE dashboard updates and security controls in the bilingual panel.
 - Added an additive SQLite migration, offline validation and online database backup.
-- Rust build/runtime verification was unavailable for the source package.
 
 ## 0.0.1
 
 - Initial manual-backend HTTP/1.1 proxy, streaming and keep-alive.
 - SQLite configuration, dynamic host/alias/path routing and local token control plane.
 - English/Polish interface, bounded access log, counters, CLI, demo backend and dev.sh.
-- Rust build/runtime verification was unavailable for the source package.