v0.26.0

CHANGELOG.md

@@ -4,6 +4,15 @@
 > test-only changes and packaging implementation notes were moved to
 > [`docs/CHANGELOG_TECHNICAL_ARCHIVE.md`](docs/CHANGELOG_TECHNICAL_ARCHIVE.md).
 
+## 0.26.0
+
+- Add persistent protocol-error traffic records for malformed HTTP, TLS ClientHello/handshake failures and timeouts, HTTP/2/HTTP/3 protocol failures, invalid h2c bootstraps and rejected connection/stream limits. These records use the existing bounded external logging queue and do not enter the Live Logs memory ring.
+- Add a built-in read-only **Logs** explorer at `/logs`, reachable from the top bar and Settings -> Logging, with source, text, event, status-class, client-IP and vhost filters plus bounded pagination and JSON record inspection.
+- Keep the stored-log explorer independent from Live Logs: it reads only configured access/error files, including existing files when file logging is currently disabled.
+- Harden local log-file access with regular-file checks and `O_NOFOLLOW` on Unix; the browser API never accepts an arbitrary filesystem path and enforces bounded bytes, lines, sources, offsets and page sizes.
+- Extend structured access-log fields with `event`, `protocol_error`, `error_detail`, `local_addr` and `tls_sni` so protocol failures can be distinguished from ordinary request records.
+- Keep SQLite schema 8 and the existing saved configuration format; no data migration is required from 0.25.7.
+
 ## 0.25.7
 
 - Add one-click vhost enable/disable actions and make the vhost editor Enabled control clearly stand out with an explicit state indicator.