v0.32.2

docs/CACHE.md

@@ -30,11 +30,19 @@ Vhost response rules run before cache fill, and transformed output is what is
 stored. Private/`Set-Cookie`/`no-store` origin responses remain ineligible,
 even if a later response-header rule replaces their visible cache headers.
 
-For Web Server sources, stale entries are refreshed by a new local-source
-request rather than the remote-backend revalidation worker. As with reverse
-proxy origins, range requests and conditional requests can reuse fresh stored
-representations. Do not rely on stale-if-error remote-backend refresh behavior
-for local Web Server routes.
+For Web Server sources (0.32.2), requests with `Cache-Control: no-cache`,
+`max-age=0`, or an expired/inadequately fresh representation check the local
+origin using the stored origin `ETag` / `Last-Modified`. When the Web Server
+returns `304 Not Modified`, RustProxy refreshes the same shared-cache object,
+keeps its body and increments `X-Cache-Hits`. The original browser conditional
+headers determine whether the client receives 304 or the cached 200 body.
+Changed static files cause a new response/cache fill; `no-store`/`private`
+origin policy continues to prevent shared storage. HEAD and single-range
+requests can reuse a successfully revalidated full object. A Web Server
+source does not run the remote-backend background revalidation worker or its
+stale-if-error fallback. A PHP handler that ignores validators may still
+return 200, which must be handled as a real origin response rather than an
+assumed unchanged object.
 
 ## HTTP BAN / PURGE from authorized client IPs
 

docs/TEST_REPORT.md

@@ -0,0 +1,45 @@
+# Verification report - RustProxy 0.32.2
+
+## Scope
+
+Source-based patch on the supplied 0.32.1 archive. The Web Server's cache
+revalidation now mirrors the existing Reverse Proxy's 304 handling for local
+files, while preserving original browser conditionals, cache policy and cached
+transformed representations. No backend, PHP-FPM, API or SQLite schema change.
+
+## Regression cases added (Rust, execution pending)
+
+- F5-style `Cache-Control: max-age=0` and hard-refresh `no-cache` preserve body
+  and advance `X-Cache-Hits` when local origin returns 304.
+- Browser `If-None-Match` produces downstream 304 only when the client's validator
+  matches the public stored representation, not merely the origin's validator.
+- Unrelated client validators cannot incorrectly validate the stored body.
+- `HEAD` and single-range conditional refresh reuse the validated full body.
+- A changed asset (different on-disk ETag) returns 200 rather than a false 304.
+- Newly private origin revalidation metadata cannot remain in shared storage.
+
+## Results and limitations
+
+- Python static/structural checks via `./dev.sh test`: **PASS** (including
+  version, full source preflight, cache regression contracts, HTTP/cache,
+  security, documentation, schema-v9/upgrade and release smoke contracts).
+- All **24 Node.js UI simulations** configured in `./dev.sh test`: **PASS**.
+  Three existing fixture assumptions were aligned with current unindented
+  functions/version (`backend_cache_0297_ui_test.mjs`,
+  `backend_health_0300_ui_test.mjs`, `security_logs_0315_ui_test.mjs`);
+  the production panel logic is unchanged.
+- Python load-tool selftest against a Python peer: **PASS**; not a RustProxy
+  server test or a memory profile of the proxy.
+- `./dev.sh check`: **unavailable (exit 127)**; Rust/Cargo is not installed.
+- `./dev.sh test`: **pre-Cargo checks PASS; entire command exits 127** because
+  Rust/Cargo is not installed, so no Rust tests executed.
+- Rust `cargo check --locked --all-targets`: **not run, Cargo unavailable**.
+- Rust `cargo test --locked --all-targets`: **not run, Cargo unavailable**.
+- Real SQLite schema migration/update on an installed instance: **not run**;
+  only source/upgrade contracts were checked.
+- Actual RustProxy process, HTTP/1.1, HTTP/2, HTTP/3, PHP-FPM/WordPress and
+  browser DevTools reproduction: **not run** in this source-only environment.
+
+**Production acceptance remains open.** Run `./dev.sh check`, `./dev.sh test`
+and repeat browser-refresh/GET comparisons on a Rust 1.99+ build host before
+rolling the release out. The patched source is delivered, not a tested binary.