v0.26.7

docs/CACHE.md

@@ -284,8 +284,10 @@ Cache-Status: RustProxy; hit; ttl=556488; detail="cache_hit"; transformed
 
 Origin lookalike values (`Cache-Status`, `X-Cache-Status` and the other RustProxy
 cache diagnostics) are removed before RustProxy emits its own diagnostics. HTTP `Age`
-remains present on reused cached responses because it is protocol freshness metadata,
-not a debug header. The Cache dashboard also marks transformed objects explicitly.
+is generated from cache freshness metadata on reused responses. For 0.26.6 configuration
+compatibility an explicit response-header rule may set/append/remove `Age`, but that rule
+runs only after cache lookup/revalidation/storage decisions and therefore cannot alter the
+internal freshness clock. The Cache dashboard also marks transformed objects explicitly.
 
 ## Pool behavior
 

docs/SECURITY.md

@@ -121,8 +121,10 @@ update and purge paths. Purge is authenticated, CSRF-protected and audited, not
 public PURGE/BAN capability.
 
 Compression is opt-in, with authenticated/private/no-transform exclusions. Response
-rules cannot overwrite protected framing/identity fields or the cache-controlled `Age`
-header. Required Age remains on cache hits even when debug headers are disabled. Server hiding is cosmetic and
+rules cannot overwrite protected framing/identity fields. For compatibility with 0.26.6,
+custom `Age` rules remain accepted. Response-side `Age` is deferred to the final wire stage,
+after RustProxy's cache freshness/revalidation logic, so it cannot alter stored age, TTL or
+cache eligibility. Server hiding is cosmetic and
 must not be considered an access-control or vulnerability mitigation substitute.
 
 Standard public 80/443 ports are supported without globally forbidding remote

docs/TEST_REPORT.md

@@ -12,7 +12,7 @@ Static source contracts require all four `/cache` occupancy meters (HOT objects,
 
 The existing upstream-client unit coverage retains age-triggered rotation without user traffic. A new pool regression, `compatible_pool_rebuild_reuses_upstream_clients`, verifies that a compatible rebuild reuses the previous compiled backend/client object so rotation state remains continuous. Source contracts also require the `reusable_with` compatibility check, maintenance calls for normal/WebSocket clients and backend reuse path. These Rust tests require a compiler-enabled release host.
 
-Cache regressions now require a stored HIT/dashboard object to advance `Age`, while compression regressions require `Age` to survive encoding and require cookie-bearing compression to stay blocked unless the internal cache/static safety marker is present. Source contracts protect the `Age` header from custom response rules and require the bounded HIT/static cookie-compression exception. The bundled compression tester no longer forces `Cache-Control: no-cache` unless `--revalidate` is requested.
+Cache regressions now require a stored HIT/dashboard object to advance `Age`, while compression regressions require `Age` to survive encoding and require cookie-bearing compression to stay blocked unless the internal cache/static safety marker is present. Existing 0.26.6 `Age` rules stay loadable; response-side Age is tagged as a late wire-only override so the generic response-rule pass cannot influence cache freshness/storage. The bundled compression tester no longer forces `Cache-Control: no-cache` unless `--revalidate` is requested.
 
 Documentation checks cover the 0.26.7 release note, Reader index, local Markdown links, cache diagnostics and container/ACME provider guidance. Packaging smoke tests verify the 0.26.7 release identity and deterministic source archive contract.
 

docs/V0.26.7_IMPLEMENTATION.md

@@ -36,9 +36,12 @@ Current cache, vhost/backend and installation documentation was reviewed alongsi
 The cache freshness clock remains RFC-oriented: ordinary stored HITs advance `Age` from
 `initial_age + resident elapsed time`, while a successful validator revalidation starts a
 new freshness calculation. `X-Cache-Resident-Age` remains the monotonic residency clock
-across revalidation and tier movement. `Age` is now protected from generic response-header
-rules, and regression coverage explicitly checks that both the wire HIT header and `/cache`
-object age advance from the stored clock.
+across revalidation and tier movement. Existing 0.26.6 custom `Age` rules remain accepted
+for configuration compatibility. Response-side Age rules are isolated to the final wire
+stage, so set/append/remove cannot feed back into stored freshness, TTL calculation or
+validator revalidation. Regression coverage explicitly checks that both the wire HIT header
+and `/cache` object age advance from the stored clock before any optional presentation
+override.
 
 Compression still refuses Authorization, private/no-store/no-transform, Set-Cookie, ranges,
 SSE, upgrades and already encoded responses. Cookie-bearing requests now have one bounded