v0.25.3

docs/VHOSTS.md

@@ -128,15 +128,16 @@ still validated, but create no pool or additional active listener.
 
 ## Paths, policies and migration
 
-`routes` contains per-vhost paths: `id`, `path_prefix`, `enabled`, `source`, nullable `cache`,
-optional `acl`, `headers` and `backend_id`. `source` selects Reverse Proxy or a reusable Web Service;
+`routes` contains per-vhost paths: `id`, match fields, `enabled`, `source`, nullable `cache`,
+optional `acl_profile_id`, inline `acl`, `country_access`, `method_policy`, `headers` and `backend_id`. `source` selects Reverse Proxy or a reusable Web Service;
 `backend_id` is valid only for Reverse Proxy. An empty array leaves the main vhost source as the fallback. Longest
 segment-boundary prefix wins. Origins receive the original path/query; prefixes
 are not stripped. IDs must use ASCII letters, digits, hyphens and underscores.
-Host-policy, reusable ACL-profile, vhost and route ACLs are ANDed before pool
-selection/DNS/cache. A vhost can attach one reusable `acl_profile_id`; the profile may
-contain an IP ACL plus a country block/allow-only rule. Inline vhost/location controls
-remain independent and cannot be weakened by the profile. Their client identity is the
+Host method policy, reusable ACL profiles, vhost ACL/country policy and route method/profile/inline
+ACL/country policies are cumulative before pool selection/DNS/cache. A vhost and each route can
+attach a reusable `acl_profile_id`; profiles may contain an IP ACL plus a country block/allow-only
+rule. Inline controls remain independent and cannot be weakened by a profile. Method-policy denial
+returns 405; allow-list mode also emits `Allow`. Their client identity is the
 validated effective peer address, not an untrusted forwarding header.
 
 There is no legacy routing UI/runtime or automatic importer in 0.8.0. Development