v0.32.2

docs/SETTINGS.md

@@ -540,3 +540,70 @@ PROMETHEUS.md for immediate revocation, restart rules and scrape configuration.
 ## Stream Dashboard cards (0.32.0)
 
 Under **Settings → Appearance → Dashboard layout**, the existing Show/Hide and Up/Down card controls now include Stream overview, traffic, sessions and backend health. They are opt-in and account-scoped, saved through the existing `/api/preferences` flow. Legacy 12-card orders migrate in memory with all four Stream cards hidden. They use the existing status/SSE stream and stop computing their charts while hidden; no backend monitoring or listener settings are changed when toggled. An explicitly enabled Stream card stays on Overview and shows a neutral no-data state when no Stream is active. Overview details and chart legends stay visible inside the cards (without hover tooltips). Appearance Stream card descriptions use browser-native `title` hints on hover, with the same localized descriptions available to assistive technology through `aria-description` on the visibility buttons; they no longer add floating boxes or horizontal scrolling.
+
+## Full Overview layout and additional metrics (0.32.3)
+
+Open **Overview -> Arrange cards visually** (or **Settings -> Appearance -> Dashboard layout -> Visual layout editor**) to change **all 49** dashboard blocks: 30 previous tiles, 12 new optional charts, three large live charts, three diagnostic panels and the backend table. Drag tiles/sections, use arrow buttons for keyboard access, or hide and re-enable individual blocks. Large sections retain their own original charts, controls and live data after being moved. The responsive six-column desktop view scales to narrower widths. Visibility and order are account-scoped; they never alter backend behavior.
+
+**Default view** loads the factory order and visibility into the editor **without saving**; **Save layout** applies it. **Reset layout** asks for confirmation, then persists the same default order and visibility in one preferences write. **Cancel** preserves the current layout. All 12 added charts are hidden until explicitly enabled and use a maximum of 30 status samples without additional HTTP polling. They cover process CPU/RSS/file descriptors, connections, WebSocket tunnels, TLS handshake failure and request-error rates, cache HIT share and HOT RAM usage, incoming HTTP/2 request share, mean response duration, and unhealthy backends. Unknown and first-delta measurements show `-`; response time is a mean, not a percentile, and HTTP/2 share is **frontend** traffic rather than negotiated upstream ALPN.
+
+## HTTP backend Overview cards (0.32.3)
+
+**Settings -> Appearance -> Dashboard layout** now contains fourteen opt-in
+HTTP origin cards: **Backend health**, **Active backend requests**, **Backend
+errors**, **Health probe RTT**, **Backend traffic**, **Configured backend
+modes**, **Backend request rate**, **Backend capacity**, **HTTP 5xx**, **Backend
+timeouts**, **Upstream connection errors**, **Backend retries**, **Backend
+queue pressure**, and **Backend connection pools**. All are hidden by default on new and migrated administrator profiles;
+card visibility and ordering use existing per-account `/api/preferences` fields.
+They do not affect routing, health checks, upstream keep-alive or listeners.
+
+The cards reuse `backend_pools` already included in the live status payload:
+
+- Health separates up/down/checking and draining/disabled members. Active
+  requests is a sum of in-flight pool member exchanges, not open TCP sockets.
+- Errors show lifetime member error counts and a sampled errors/s graph. Traffic
+  uses the positive differences of per-member in/out byte counters; resets and
+  newly added backend members cannot generate an artificial rate spike.
+- Health probe RTT is the mean last observed healthy probe time, **not** client
+  end-to-end latency. It shows no data when health probes are unavailable.
+- Configured backend modes distinguish saved `http1`, `auto`, compatible `http2`
+  and strict `h2` values, and count H2C cleartext members. This is **not an observed
+  H1/H2 negotiation rate**: TLS ALPN can select H1 for Auto and compatible HTTP/2.
+- Backend request rate uses started-request counter deltas, with per-member
+  baselines after a restart or config change. Backend capacity compares active
+  requests against finite per-member concurrency limits; unlimited members are
+  excluded and a neutral state is shown when no such limit is configured.
+
+The six additional diagnostics use pre-existing `backend_pools.members` counters:
+HTTP 5xx responses, all timeout classes, combined connect/DNS/TLS/I/O failures,
+retry attempts and successes from the existing safe retry policy, queue timeouts
+and capacity rejections, and Hyper client-generation rotations and age. Rotations
+are **not TLS handshake counts**. Rates are based on per-member positive counter
+differences; newly added or reset members cannot create arbitrary spikes.
+
+To arrange the actual Overview cards visually, click **Arrange cards visually**
+on Overview or **Visual layout editor** in Settings -> Appearance -> Dashboard
+layout. The modal displays copies of the existing telemetry cards; drag to
+reorder, or use the move arrows for keyboard-only input. Hide/show tiles in
+the modal and select **Save layout** once to persist order and visibility in
+the existing `dashboard_widgets` and `dashboard_hidden_widgets` preferences.
+Cancel/Escape discards the draft. The existing Appearance visibility and move
+buttons remain available. No extra API endpoint, refresh loop, or database
+migration is needed.
+
+TLS ALPN selects H2 or H1 only when opening a **new TLS connection**, not for
+each request. Hyper already pools reusable connections per compiled backend;
+subsequent requests share the negotiated connection (H2 multiplexing when
+possible). Existing bounded pool recycling (`pool_recycle_requests` and
+`pool_recycle_seconds`), configured idle timeouts, and reopening failed
+connections naturally re-evaluate TLS capabilities. A backend-global protocol
+cache or scheduled H2 probe would be unsafe for origins with multiple DNS/peer
+capabilities and would add network work. No traffic replay/downgrade on
+post-request errors was added; strict H2, H2C, H1 and WebSocket separation
+remain intact.
+
+The sample charts are browser-local, bounded and reset on a changed config
+revision, logout or source unavailability. They are not computed while hidden.
+No additional polling, SQLite schema migration or new administrator endpoint
+is introduced. Existing Stream widgets remain independent.