v0.25.3

docs/API.md

@@ -65,6 +65,7 @@ framework extraction failures are not guaranteed to have that JSON shape.
 |---|---|
 | `GET /healthz` | Public process health/version; not a backend health probe |
 | `GET /api/config` | `{revision, config}` |
+| `GET /api/config/history` | Retained revision metadata; `?revision=N` returns that document plus the previous retained document |
 | `PUT /api/config` | Input `{expected_revision, config}`; returns the applied envelope; retained for atomic multi-section changes |
 | `PUT /api/config/{section}` | Input `{expected_revision, value}`; replaces one validated section and returns the applied envelope |
 | `GET /api/backends` | Authenticated per-vhost backend observations and active/desired frontend plans |
@@ -86,6 +87,8 @@ and rechecks session validity. It does not queue an unlimited per-viewer event l
 or guarantee replay. The browser falls back to polling. An active dashboard renews
 idle activity, not the absolute session deadline.
 
+Configuration history retains the newest 512 successful manual/configuration revisions in SQLite schema 8. `GET /api/config/history` is session-protected like the rest of the administration API; `limit` is bounded to 512 and `revision` selects one retained revision for diff/inspection.
+
 Configuration updates return 409 for a stale revision, 422 for validation failure
 and 429 when the eight-operation update admission bound is reached. Persistence and
 snapshot publication finish before a successful response. Disconnecting the caller
@@ -475,7 +478,7 @@ when enabled. Transformed cached representations add the `transformed` Cache-Sta
 extension parameter. `X-Cache-Status` is stripped if supplied by an origin but is not
 emitted by RustProxy.
 `diagnostic_headers.hide_mock_origin` is removed and old documents containing it are rejected on
-export; `request_id` is the only diagnostic-header switch. No revision response-header behavior remains. TLS listener
+export; `request_id` is the only diagnostic-header switch. The generated request ID is a 64-hex-character SHA-256 value and the same protected value is forwarded to the origin as `X-Request-ID`. No revision response-header behavior remains. TLS listener
 http3 omission is default-on; explicit null is persisted off. Legacy listeners use
 https_http3 with identical default/null behavior.