v0.32.7

docs/ERROR_LOGGING.md

@@ -2,6 +2,8 @@
 
 RustProxy routes diagnostics according to the **Error file** switch under Settings > Logging. When the file is enabled, `ERROR` and `WARN` events, including PHP-FPM stderr and Rust worker panics, go to the configured error file rather than also being printed to the systemd journal. When the file is disabled (the default), those events go to the console/stderr (journald under systemd). `INFO` and lower-severity messages continue to use the console and any independently configured access sinks are unaffected.
 
+A graceful upstream HTTP/2 `GOAWAY(NO_ERROR)` may coincide with a Hyper `Canceled -> connection closed` error. RustProxy treats the cancel as expected H2 churn **only when** it is correlated with a recently observed graceful GOAWAY on that backend client (one-second window). Safe empty methods may retry once. An unrecovered request remains an HTTP 502 and retains its detailed access/error context; its redundant upstream diagnostic uses `TRACE`, not `DEBUG`. Uncorrelated cancellations still follow normal error processing and may influence Passive Health. The text `connection closed` alone is not evidence of a graceful GOAWAY. This is not a global error-log suppression rule.
+
 ## Configuration
 
 The settings document contains:

docs/SETTINGS.md

@@ -48,6 +48,10 @@ existing visual layout editor for drag-and-drop arrangement. Reordering and
 visibility still save through `/api/preferences` per account; this UI-only
 change does not alter server polling, proxy routing or backend metrics.
 
+### Overview controls and density (0.32.7 development follow-up)
+
+**Refresh now**, **Arrange Overview**, **Unlock layout**, **Visual Overview editor** and **Show all cards** inherit the same Normal/Compact button size rules as other buttons. Responsive placement still adapts to narrow screens, but no independent font-size, padding or height override applies. Dashboard density more clearly adjusts numeric tile sizing, inline chart height and the padding/title size of non-table Overview panels; the common tile gutters are unchanged. Button style and dashboard density remain independent per-account preferences.
+
 ## Refresh preferences (0.31.0)
 
 **Settings -> Appearance -> Data refresh** saves an additional `refresh` object in the existing `admin_preferences` document for the signed-in account. It does not modify proxy configuration or create any migration. Older documents, including partially populated `refresh` objects, use defaults. Browser and server enforce exact allowed values:

docs/TEST_REPORT.md

@@ -1,278 +0,0 @@
-# Verification report - RustProxy 0.32.7
-
-## 0.32.7 graceful upstream H2 close and backend health (pending runtime acceptance)
-
-- Source changes: restrict GOAWAY(NO_ERROR) classification to Hyper's peer-
-  initiated debug variant. Recycle exactly the observed upstream pool generation
-  and replay only one empty GET/HEAD/OPTIONS request. No unsafe/body replay.
-- Correlate immediate cancelled `connection closed` events with a recent
-  graceful GOAWAY within one second; all other I/O errors retain Passive
-  Health counting. De-duplicate I/O failure observations within 250 ms.
-- Passive-ejected backends are readmitted after consecutive healthy active
-  probes (minimum two) or, with active monitoring disabled, after a cooldown
-  and a half-open request. Active failures still block routing.
-- On an actual healthy-to-unhealthy transition write WARN with the first
-  counted error in the streak and the threshold-triggering error. The existing
-  Error log must be enabled for these events to be persisted in `error.log`;
-  otherwise WARN remains visible in stderr/journal. File-sink writes are
-  best-effort and may fall back to stderr on backpressure or I/O failure.
-- Checks executed for this archive: `tools/checks/passive_h2_0327.py`
-  **PASS** (source assertions), `tools/checks/docs_check.py` **PASS**,
-  `tools/checks/release_0318.py` **PASS**, ZIP CRC and SHA256SUMS
-  verification **PASS** (579 checksummed source files). These do **not**
-  compile or execute RustProxy.
-- `./dev.sh check` returned 127 (Cargo unavailable). `./dev.sh test`
-  stopped on a stale `preserve_host_0324.py` CSS-gap assertion; the
-  unchanged 0.32.6 source fails that same test. `check_source.py` also
-  stops on a pre-existing Revision History dialog CSS selector assertion
-  in **both** unmodified 0.32.6 and patched 0.32.7 trees. Neither is
-  evidence of a regression in this patch, but the complete test gate
-  remains **open**.
-- **Not yet production-accepted:** no Rust compiler exists in this authoring
-  environment. `cargo check`, `cargo test`, `cargo fmt` and live Nginx H2
-  GOAWAY/HTTP1.1 ALPN behavior must be verified on a Rust-enabled host.
-
-## 0.32.6 development follow-up — compact Appearance Dashboard layout
-
-- The previous right-half, wrapping Overview card list left most of the screen
-  empty and grew excessively tall with the 62-card registry. Moved Dashboard
-  density to a compact full-width row and made the selector a full-width,
-  single-line horizontal ribbon. Added previous/next browsing, a **Show all**
-  expanded grid, horizontal earlier/later order buttons and Polish/English
-  strings. Every existing toggle, order save, visual editor and account-scoped
-  `/api/preferences` path remains intact.
-- Chromium fixture with real CSS, real 62-card renderer and mocked preferences:
-  at 1500px, the default ribbon is 47px high and the Appearance dashboard
-  section about 274px high; at 393px, the ribbon is 47px, the section about
-  419px, and there is no page-level horizontal overflow. Programmatic browse,
-  visibility-toggle, retained scroll position and expand/collapse all passed.
-  `tools/checks/dashboard_appearance_ribbon_0326_browser.py` reproduces this
-  test. This is a simulated interface test, not a compiled Rust or iOS Safari test.
-- Source/Node checks additionally verify translations, all card IDs and the
-  unchanged preference persistence calls. Full Rust build and physical iOS
-  acceptance remain pending.
-
-
-## 0.32.6 development follow-up — logo right-edge spacing
-
-- Corrected the previous logo-spacing adjustment: the desired clearance is
-  between the final `p` glyph and the **right border of the logo frame**,
-  not between `/` and `p`. Removed extra slash margins and added a 2px
-  right-side flex-box inset without changing the frame size or color.
-- Browser regression checks the text glyph's bounding rectangle against the
-  frame at desktop and mobile widths; Chromium measures approximately 5px
-  clearance compared with approximately 2px before correction. This does not
-  require Rust compilation or imply a physical iOS Safari verification.
-
-## 0.32.6 development follow-up — live diagnostic charts / mobile scroll
-
-- The existing server diagnostics collector samples OS and process metrics in
-  the background, with a 2-second idle delay between collection passes
-  (sampling work can add time). Compact live status / SSE now
-  exposes its **cached** `live_system` (sample timestamp, host/process CPU,
-  process RSS, aggregate RX/TX rates and interface rates), without invoking a
-  new OS measurement or fetching `/api/system-info` on each live event.
-- Live Overview charts use the administrator's `overview_seconds` (default **3**,
-  accepted 1/2/3/5/10, including existing persisted 2-second preferences).
-  Process/System *detail text* still updates only with the configured
-  `system_info_seconds` (default **60**). Network chart RX/TX now reflects
-  recently sampled interface rates rather than 60-second-old repeated values.
-- Disabled the nested `overflow:auto` network-interface list on narrow
-  Overview containers. Stable SVG/text DOM remains in place, to reduce
-  unexpected WebKit touch/momentum scroll anchoring. This is a mitigation;
-  the exact source of the iOS 27 jump remains unverified on physical Safari.
-- Protocol badge Origin uses the same control radius as the adjacent policy
-  pills for custom presets, and the same 0px baseline for the default preset;
-  observed green/unknown neutral colors are unchanged.
-- `live_diagnostics_0326_browser.py`: real diagnostic renderer with 35 live
-  updates verifies fast chart data and slow Process details, no chart DOM
-  replacement or scroll movement, no extra sample from a slow-system-only
-  refresh, touch-sized network list and both custom/default badge radii.
-  `mobile_protocol_0326_browser.py` covers all custom radii at six widths.
-- Prior source/UI tests: all pre-Cargo checks passed; compilation and Rust
-  integration tests not run (Cargo absent). The Chromium fixture does **not**
-  establish Safari/iOS 27 acceptance.
-
-## 0.32.6 development follow-up — suspended rate charts
-
-- Added `src/admin/web/app/rate-sampling.js` to the authenticated Rust
-  administration bundle. The shared policy records tab background/pagehide
-  epochs and ignores intervals longer than three configured refresh periods
-  (at least 10 seconds). It validates counter monotonicity and declines
-  counter-derived rates across the gap, preserving existing history.
-- Updated Cache HIT/MISS/BYPASS, Transform metrics, Overview HTTP/protocol/
-  cache-outcome deltas, optional small/wide rate and share charts, HTTP
-  backend monitor, Stream traffic and Vhost/Stream detailed charts. Fresh
-  absolute CPU/RAM/system observations and independent system-info reads
-  retain their previous behavior. Visible missing rates show `-`, not `0/s`.
-- Added `tools/checks/rate_pause_0326_ui_test.mjs`: real Cache/Transform
-  chart functions with a simulated DOM and clock. Tests normal idle 0/s,
-  long gaps, short hide/show, pagehide/BFCache, counter resets, sample
-  continuity and 30-second refresh support. This is not a live Safari test.
-- **Pending:** Cargo checks/compilation, real server/SSE data, mobile Safari
-  tab suspension and BFCache tests.
-
-## 0.32.6 development follow-up — badge grouping and chart cadence
-
-- Moved each observed upstream HTTP protocol badge into its Vhost's existing
-  `vhost-policy-pills` row; preserved the badge class, observed flag, green
-  and neutral CSS styling. No backend or preference changes.
-- Kept network-interface rows and SVGs stable (no replacement on ordinary
-  refresh), but restored **frequent** history progression: each Overview live
-  status appends the latest cached interface rates, exactly as the aggregate
-  network chart does. A system-info-only refresh updates visible rates but does
-  not append a history point. System measurements are fetched only on the
-  configured `system_info_seconds` cadence; no extra API call was added.
-- Chromium tests: `ios_scroll_0326_browser.py` (45 live renders, unchanged
-  DOM/scroll/Process height, latest-value reuse and a system-info-only redraw);
-  `vhost_protocol_badge_group_0326_browser.py` (real Vhost render at 393/1024px,
-  observed green and unknown neutral colors); static source and Node.js protocol
-  status checks. `mobile_protocol_0326_browser.py` also passed at six
-  mobile widths (320-550px). `./dev.sh test` passed all pre-Cargo checks,
-  including its source/SQL/upgrade/release-smoke and Node.js UI stages, then
-  exited **127** at the missing-Cargo guard; Rust compilation/tests were not run.
-  These results do **not** establish iOS 27 Safari acceptance or a compiled
-  RustProxy binary.
-
-## 0.32.6 development follow-up — iOS 27 scroll / CSS transform
-
-- User video shows repeated returns toward Process during mobile scrolling;
-  it does not include finger touch input, so exact root cause cannot be proven
-  by visual inspection alone. The Network diagnostics renderer removed and
-  recreated all interface rows/SVGs on every live sample, potentially
-  invalidating WebKit's scroll anchor directly beneath Process.
-- Initially changed to update chart contents, text nodes and SVG points in place
-  without replacing interface rows. An interim build appended interface RX/TX
-  history only on new system measurements; this sampling decision was superseded
-  by the later development follow-up above, which restores live-rate chart
-  progression independently of slow system-data acquisition. Retest physical
-  iOS 27 before declaring the scroll problem fixed.
-- CSS transformer preserves descendant pseudo-class combinators; admin pages
-  carry `Cache-Control: no-transform`. Rust/Cargo check still pending.
-
-## 0.32.6 mobile presentation and upstream protocol visibility
-
-- `./dev.sh test` passed all pre-Cargo source, regression, simulated API,
-  upgrade/release-smoke, SQL/schema, documentation, localization and Node.js UI
-  checks. It then stopped at the expected missing-Cargo guard (`exit 127`).
-  `./dev.sh check` also stopped there (`exit 127`). A production Rust build
-  and execution of Rust unit tests **have not been performed**.
-- `tools/checks/mobile_protocol_0326_browser.py`,
-  `appearance_ux_0323_browser.py` and `overview_grid_spacing_0323_browser.py`
-  passed separately with headless Chromium. These optional browser tests
-  require Playwright and are not a dependency of `./dev.sh test`.
-- Shipped static CSS and real 62-card grid tested under Chromium mobile touch
-  emulation at 320, 375, 393, 402, 430 and 550px: two metric columns, no
-  horizontal overflow, stable viewport scroll positions after metric updates
-  and repeated no-op preference application. **This does not test Safari on
-  a physical iPhone 17 Pro.**
-- Global Appearance radius presets in Chromium tested on vhost, backend badge,
-  entity and metric surfaces; square draft dock remains excluded.
-- JavaScript Vhost badge test checks fresh H1/H2 response observations, Auto
-  no-observation and stale states, response counters and isolation across
-  vhosts with identical member IDs.
-- Rust test added to assert response-version observation and counters. **The
-  Rust compiler and a running HTTP peer are absent; this is source coverage,
-  not a completed Rust unit/integration test.**
-- Tests do not establish real backend HTTP/2 ALPN operation; staging validation
-  and full Rust acceptance remain required before production use.
-
-## Previous 0.32.5 verification history
-
-- **0.32.5 administration UI startup fix:** the DNS ACL translation helper in
-  `src/admin/web/management.js` is now initialized before the DDNS hint uses
-  it. `tools/checks/dynamic_acl_startup_0325_ui_test.mjs` executes the real ACL
-  editor initializer with a simulated DOM and verifies that it completes and
-  renders the translatable DNS hint. The test reproduced the user-reported
-  `ReferenceError` against the unmodified 0.32.5 source before the fix.
-  **36/36 JavaScript checks passed** after adding this test to `dev.sh`.
-  The assembled JavaScript bundle passed `node --check`. The source/version,
-  admin surface, security, docs and language checks passed. `release_smoke.py`
-  exceeded the available execution timeout; the Rust compiler and live server
-  remain unavailable, so full release/runtime acceptance is not claimed.
-- **0.32.5 build correction:** fix reported Rust `E0505` in `src/acl/dynamic.rs` by cloning the hostname into `lookup_name` for `lookup_host`. The original `name` is returned as the cache key. Added a source-contract regression check; Rust compilation is still required to confirm the correction.
-- `tools/checks/dynamic_acl_0325.py`: **15/15 static source contracts passed**.
-- JavaScript dashboard/settings regression scripts: **36/36 passed** (35 existing and one new startup regression).
-- `tools/checks/check_source.py`, `rust_module_contracts.py`,
-  `docs_check.py`, `langs_check.py`, `security_contracts.py`, and
-  `admin_surface_audit_0310.py`: passed.
-- The full `./dev.sh test` was interrupted by the environment time limit while
-  running expensive pre-Cargo release simulations. It was **not** a full pass.
-- Cargo/rustc are unavailable here. Dynamic DNS Rust unit tests, integration
-  tests, real resolver timeouts/rotation and production acceptance **not run**.
-
-## 0.32.5 dynamic DNS ACL changes
-
-This build extends existing ACL `Rule.network` entries with allow-only DNS/DDNS
-hostname support. Resolution is background-only and bounded (60s cadence,
-4s timeout, max 8 concurrent lookups, max 128 unique names / 32 IPs per name).
-Initial, expired and failed resolution states deny dynamic host authorization.
-Existing numeric IP/CIDR and explicit-deny precedence remain unchanged.
-
-A Rust compiler and real DNS peer were not available in this environment.
-The Rust tests in `src/acl/tests.rs` and `src/acl/dynamic.rs` **have not been
-executed** here. Before rollout, run `cargo fmt --all -- --check`,
-`cargo check --locked --all-targets` and `cargo test --locked`, then confirm
-live DDNS rotation and fail-closed DNS outages on staging.
-
-## Previous 0.32.4 scope
-
-Review of the supplied RustProxy 0.32.3 source and patch to 0.32.4:
-HTTP Host / HTTP/2 authority parity, explicit TCP/DNS destination and TLS/SNI
-isolation, relaxed HTTPS-by-IP troubleshooting hint, and uniform Overview gutters.
-Follow-up patch to the first 0.32.4 archive:
-- Fix reported `E0382` in `src/proxy/types.rs`: `Request::builder().uri(uri)`
-  moved `uri` before `upstream_request_target(&uri, ...)` could borrow it.
-  `.uri(uri.clone())` preserves the original URI for authority selection.
-- Make normal Overview gutters uniformly 4px (dense 3px, comfortable 12px).
-  Resolve the higher-specificity `html[data-dashboard-density] .stats-grid`
-  rule which otherwise overrode the aligned grid and kept the larger gaps.
-Existing database/configuration schemas and retry/transport policies are
-unchanged. Only compiling Rust and live protocol tests prove runtime behavior.
-
-## Available checks
-
-- `./dev.sh test`: **all pre-Cargo checks passed**, including source/security,
-  SQLite migration/upgrade/backup simulations, memory-model scripts and **35
-  Node.js UI/behavior test scripts**. The command then exited **127** because
-  Rust/Cargo is not installed; this is **not** a passing Rust test run.
-- New `preserve_host_0324.py` and `preserve_host_0324_ui_test.mjs` passed:
-  authority/destination split source contracts, four protocol selectors,
-  verified/unencrypted origin warnings, explicit diagnostics preset.
-- Expanded Chromium CSS fixture `tools/checks/overview_gutters_0324_browser.py`:
-  **27 checks passed** (3 container widths x 3 UI density modes x 3 Dashboard
-  densities), checking horizontal/vertical gutters, equally high rows and
-  numeric-to-large-card transition. Normal/dense/comfortable gaps measured
-  **4/3/12px** and the outer grid bottom margin remained `0px`.
-  The older `overview_grid_spacing_0323_browser.py` also passed with all
-  62 blocks, responsive breakpoints and browser zoom 90%-130%.
-  These are simulated layout tests, not a live administrator session.
-- `preserve_host_0324.py` now guards against moving `uri` before its final
-  authority adjustment, in addition to the backend/transport source contracts.
-  The existing Rust unit test for retry authority remains in the source.
-- Version consistency: Cargo manifest, package root in existing lockfile,
-  OpenAPI, README, release notes and static assertion fixtures updated to 0.32.4.
-  External Cargo dependency resolutions have **not** been regenerated.
-
-## Rust validation not performed (blocking for production)
-
-The user's Rust compiler reported `error[E0382]: borrow of moved value: uri`
-from the first 0.32.4 archive. This has been corrected in source, but **the
-corrected code has not been compiled here**: no Cargo or Rust compiler is
-available in the source-editing environment.
-Do not treat static tests or the simulated TLS-peer tests added to Rust source
-as evidence that RustProxy builds or that an actual Angie backend accepts the
-corrected requests. Run, on a Rust 1.99+ host:
-
-```sh
-cargo fmt --all -- --check
-cargo check --locked --all-targets
-cargo test --locked
-```
-
-Then validate on staging with HTTPS-by-IP and `preserve_host: true` for
-HTTP/1.1, Auto (H2 and H1 ALPN), compatible HTTP/2 and strict H2; check
-`:authority` vs `Host`, SNI, certificate verification, WebSockets, H2C and
-HTTP health probe `host` overrides. Inspect Angie response/error logs for
-400 responses and verify backend connectivity through pool rotation/retry.
-No claim of universal backend compatibility or measured throughput is made.