v0.27.3

docs/CACHE.md

@@ -77,10 +77,10 @@ When cold storage is enabled,
 `cold_after_seconds` measures time since the last access. `cold_max_hot_seconds` measures total
 hot-tier residency, so it can move a frequently accessed object to disk after a configured age.
 The administration UI exposes these as separate policies to avoid conflating "old" with "unused".
-Demotions use an asynchronous queue bounded by both object count and `cold_queue_max_bytes`. A demoted `Entry` is removed from HOT accounting and moved, not copied, into a `ColdDraft`; its `Bytes` payload remains charged to `transient_max_bytes` until persistence completes and the draft is dropped. The persisted `ColdEntry` contains paths/metadata rather than the body allocation. This prevents the COLD writer queue from becoming a second unbounded RAM cache. If an HTTP response is already using a clone of the same `Bytes`, that last transport-owned reference can keep the backing allocation alive until the response finishes; the cache-owned HOT/COLD reference itself is released after persistence. Process RSS is therefore monitored separately from cache accounting. Supported
+Demotions use an asynchronous queue bounded by both object count and `cold_queue_max_bytes`. A demoted `Entry` is removed from HOT accounting and moved, not copied, into a `ColdDraft`; its `Bytes` payload remains charged to `transient_max_bytes` until persistence completes and the draft is dropped. The persisted `ColdEntry` contains compact lookup/invalidation/LRU metadata rather than the body allocation. Since 0.27.3 it also does not retain the full response `HeaderMap` or origin validator values per COLD object; those are validated and loaded from the existing metadata JSON only for an actual COLD read. The in-memory body digest is 32 raw bytes and the map-owned cache key is not duplicated inside the entry. This reduces long-lived COLD index RAM without changing Cold format 3 on disk. This prevents the COLD writer queue from becoming a second unbounded RAM cache. If an HTTP response is already using a clone of the same `Bytes`, that last transport-owned reference can keep the backing allocation alive until the response finishes; the cache-owned HOT/COLD reference itself is released after persistence. Process RSS is therefore monitored separately from cache accounting. Supported
 glibc/Linux builds ask the allocator to release unused pages after bulk demotion. During
 ordinary graceful shutdown, `cold_on_shutdown` performs a best-effort direct flush of remaining hot
-objects before the store is closed. A **managed software update** (`update.sh` / `scripts/deploy.py`)
+objects before the store is closed. A **managed software update** (`update.sh` / `scripts/deploy/deploy.py`)
 uses a private one-shot marker and, on RustProxy 0.13.2+, forces this hot-to-cold handoff whenever
 the cold tier is enabled even if `cold_on_shutdown=false`. The updater gives the process a larger
 stop budget and removes the marker before backing up state. If the cold tier is disabled there is