v0.26.7

docs/SETTINGS.md

@@ -232,11 +232,13 @@ can be streamed without pre-buffering merely to discover their size.
 
 Accept-Encoding quality negotiation is delegated to tower-http. Text, JSON,
 JavaScript, XML, SVG and wasm are eligible; already encoded, SSE, range, upgrade,
-HEAD/204/304 and privacy-sensitive responses are excluded. Cookies/authorization
-bypass even when an origin marks a response public. Origin no-transform/privacy
-exclusions cannot be defeated by deleting a response header in the editor. Cached
-identity bodies can be streamed through compression on HIT; origin encodings are
-passed through without recompression.
+HEAD/204/304 and privacy-sensitive responses are excluded. Authorization and arbitrary
+cookie-bearing dynamic responses remain excluded. A cookie-bearing request may be
+compressed only when RustProxy is already serving a shared-cache HIT accepted by cache
+policy (including the configured static-cookie exception) or a local static Web Server
+response. Origin `private`, `no-store`, `no-transform` and `Set-Cookie` exclusions still
+win. Cached identity bodies can be streamed through compression on HIT; origin encodings
+are passed through without recompression.
 
 Vary: Accept-Encoding is added by compression; content length is removed for the
 transformed body. Strong ETags are weakened, and identity-body content digests and