v0.29.6

docs/API.md

@@ -171,7 +171,7 @@ Access entries are emitted at exchange completion or tunnel closure, not only wh
 headers arrive. WebSocket exchanges retain status 101 and a `websocket_closed`
 outcome when cleanly released. Errors/cancellation affect the outcome. No query
 values, request bodies, cookies, password material or WebSocket payloads are logged
-by the access logger. Error diagnostics use stderr tracing. The in-memory access ring retains up to 4096
+by the access logger. Warnings and errors use the configured error file, or stderr when that file is disabled/unavailable. The in-memory access ring retains up to 4096
 completed entries; live SSE/UI snapshots use the newest 256 by default. The dashboard can
 temporarily expand an open Live Logs window to the retained 4096-entry buffer and keep
 merging new live snapshots until that window closes. This is not a durable lossless log archive.

docs/ERROR_LOGGING.md

@@ -1,6 +1,6 @@
-# Optional error-file logging
+# Error and warning logging
 
-RustProxy can write an additional local file containing only `ERROR` events. This is an optional sink layered on the existing tracing/logging pipeline; journald/systemd and other configured sinks remain independent.
+RustProxy routes diagnostics according to the **Error file** switch under Settings > Logging. When the file is enabled, `ERROR` and `WARN` events, including PHP-FPM stderr and Rust worker panics, go to the configured error file rather than also being printed to the systemd journal. When the file is disabled (the default), those events go to the console/stderr (journald under systemd). `INFO` and lower-severity messages continue to use the console and any independently configured access sinks are unaffected.
 
 ## Configuration
 
@@ -16,15 +16,17 @@ The settings document contains:
 }
 ```
 
-`format` is `JSON` or `RAW`. The feature is disabled by default. The administration Settings UI exposes the same enable/path/format controls and applies changes at runtime.
+`format` is `JSON` or `RAW`. The feature is disabled by default. The administration Settings UI exposes the same enable/path/format controls and applies changes at runtime, without restarting RustProxy.
 
-The sink accepts only `ERROR` events. JSON is one object per line; RAW is one human-readable line per event.
+The sink accepts `WARN` and `ERROR` events. JSON is one object per line (including its actual `level`); RAW is one human-readable line per event.
 
 ## Runtime behavior
 
-Events are handed to a bounded queue and written by one asynchronous worker. The request path does not perform the file write. When the queue is full, new error-file events are dropped and counted instead of allowing unbounded memory growth.
+Events are handed to a bounded queue and written by one asynchronous worker. The normal request path does not perform file I/O. When the queue is full or closed, the event is counted as dropped by the file sink but immediately written to the console as a redacted emergency fallback; memory usage stays bounded.
 
-Filesystem errors do not stop RustProxy. The worker reports failures through the existing logger, rate-limits repeated diagnostics and retries opening the file. Changing the path or disabling the sink closes the current file; a format change takes effect without an application restart.
+Filesystem errors do not stop RustProxy. The worker writes the affected diagnostics to stderr, rate-limits sink-failure messages, and retries opening the file. If the switch is disabled while events remain queued, they are sent to stderr rather than silently discarded. Changing the path or disabling the sink closes the current file; a format change takes effect without a restart.
+
+RustProxy installs a panic hook after initializing tracing so worker panics are recorded as `ERROR` events including thread, source location and panic payload. It intentionally does not install the default Rust hook in parallel, which would duplicate the message on stderr. It cannot capture forced termination (`SIGKILL`, `abort`) or messages written directly to stderr by external processes.
 
 Created log files use mode `0600` on POSIX. Symlink/non-regular targets are refused.
 

docs/PHP_FPM.md

@@ -225,7 +225,7 @@ The FastCGI stdout parser understands standard CGI response headers, including `
 
 For `HEAD`, PHP-FPM can still execute normally but the client response body is empty. GET/POST/PUT and other methods can reach a PHP script once routing resolves to a configured executable extension.
 
-PHP stderr is bounded by `stderr_log_bytes` and written to the RustProxy diagnostic log; it is not sent to the client as page content. CGI response headers are separately bounded by `max_response_header_bytes`.
+PHP stderr is bounded by `stderr_log_bytes` and recorded as a RustProxy `WARN` diagnostic. It goes to the configured error file when enabled, or the console/systemd journal otherwise; it is not sent to the client as page content. CGI response headers are separately bounded by `max_response_header_bytes`.
 
 ## Caching
 

docs/TEST_REPORT.md

@@ -1,4 +1,14 @@
-# Verification report - RustProxy 0.29.5
+# Verification report - RustProxy 0.29.6
+
+## 0.29.6 FastCGI EOF and error-log routing (2026-10-09)
+
+- Operator reproduced: uncompressed `/static.php/...` returned HTTP 200 and 29,309 bytes with cache BYPASS; gzip returned HTTP 200 then TLS unexpected EOF and zero bytes. Repeated panics in `futures-util 0.3.34` `stream/unfold.rs:108` correlate with these failures. This is operator evidence, not a reproduced in-house integration test.
+- Cause identified in source: native Web Server FastCGI response bodies used an unfused `stream::unfold` over a Tokio MPSC receiver. The compression wrapper may poll the stream after it returns `None`; the unfused `Unfold` then panics. The Reverse Proxy source uses an HTTP client body rather than this FastCGI stream.
+- Change: wrap the FastCGI response stream in `.fuse()`. Add repeated-post-EOF polling test and mocked FastCGI-to-gzip completion/decode test. No changes to PHP-FPM parameters, vhost configuration or migrations.
+- Logging change: the existing error-file controller receives WARN and ERROR (including PHP-FPM stderr); the console tracing layer suppresses these only when the file is enabled, with fallback to stderr on file/queue failure. A Rust panic hook emits structured ERROR diagnostics instead of bypassing the sink via the default stderr hook.
+- Add asynchronous file routing and live enabled/disabled toggle tests. Actual Rust compilation, FastCGI compressor tests, panic runtime acceptance and live Roundcube regression require a Cargo-equipped environment and remain unverified here.
+- Release: Cargo package/lock root/OpenAPI and release checks moved to 0.29.6; retained SQLite schema 9 and Cold Cache format 3.
+- Static checks passed: `version_contracts.py`, `docs_check.py`, `langs_check.py`, `rust_module_contracts.py`, `web_server_contracts.py`, `check_source.py`, `release_smoke.py`, `web_service_ui_test.mjs`, and Node syntax/OpenAPI JSON parsing. The `./dev.sh test` run passed its source, browser UI, security, memory and upgrade checks before reaching the missing Rust toolchain; `./dev.sh check` exited 127 for the same reason.
 
 ## 0.29.5 Roundcube PHP PATH_INFO dispatch (2026-10-09)
 
@@ -102,9 +112,9 @@ This source package is not certified for production deployment.
 
 Installer/update now installs /etc/logrotate.d/rustproxy using the recorded service user/group. Updates repair /etc/profile.d/rustproxy-path.sh rather than warning. logrotate uses copytruncate because RustProxy holds open log descriptors; some log records may be lost during truncate. Rust build and live Debian/systemd acceptance remain unverified in this environment.
 
-## Version identity (0.29.5 source release)
+## Version identity (0.29.6 source release)
 
-`Cargo.toml` package version is the canonical release identity (now 0.29.5). Rust uses `CARGO_PKG_VERSION` at build time; `build.rs` substitutes the admin HTML placeholder. Packaging, upgrade and dev scripts read the manifest with `scripts/version.py`. Run `python3 tools/checks/version_contracts.py` to check that executable paths do not hardcode a version. Historical documentation and external dashboards may retain manually managed versions. Rust compilation/runtime verification is still pending.
+`Cargo.toml` package version is the canonical release identity (now 0.29.6). Rust uses `CARGO_PKG_VERSION` at build time; `build.rs` substitutes the admin HTML placeholder. Packaging, upgrade and dev scripts read the manifest with `scripts/version.py`. Run `python3 tools/checks/version_contracts.py` to check that executable paths do not hardcode a version. Historical documentation and external dashboards may retain manually managed versions. Rust compilation/runtime verification is still pending.
 
 ## Shared PHP-FPM profiles and Web Server cache/transform/Host patch (0.29.4)