# Historical roadmap archive

> Archived during the RustProxy 0.25 documentation cleanup. This file preserves completed historical roadmap entries. The active roadmap is [`../ROADMAP.md`](../ROADMAP.md); unresolved work is tracked in [`TODO.md`](TODO.md).

# RustProxy roadmap

## 0.25.0

Current direction: 0.24.10 -> 0.25.0

- [x] Add independent reusable Web Service configuration with name, document root, index list and directory-listing switch.
- [x] Add Web Service CRUD through the dashboard/API and persist it through the existing revisioned configuration store.
- [x] Add `Reverse Proxy` / `Web Server` source selection to vhost fallback and custom locations without storing Web Server filesystem settings in vhosts.
- [x] Allow one Web Service to be referenced by multiple vhosts and one vhost to mix Web Server and Reverse Proxy locations.
- [x] Add `GET`, `HEAD`, MIME, `Content-Length`, streaming, index lookup, directory slash redirect and optional directory listing.
- [x] Add metadata-based `ETag`/`Last-Modified`, conditional `304`, single `Range`/`If-Range`, `206` and `416`.
- [x] Enforce decoded-path validation and document-root confinement; Unix traversal uses `openat` + `O_NOFOLLOW` and does not serve symlinks.
- [x] Keep Web Server inside the existing routing, ACL/auth, custom-header/error-page/security and H1/H2/H3 response pipeline; do not create separate routing/error/cache subsystems.
- [x] Add unit/source-contract coverage, OpenAPI/UI language coverage and Web Server documentation.
- [x] Clean 0.25 README/Docs/CHANGELOG release material so current user-facing changes are separated from historical audits.
- [x] Add an authenticated `/docs` Markdown Reader with a separate API/OpenAPI tab, canonical docs index, 0.25 specification audit and open-work TODO.

## 0.24.10

Current direction: 0.24.9 -> 0.24.10

- [x] Make Error File a first-class revisioned configuration section and persist enabled/path/format across database reopen.
- [x] Remove the redundant Error File help sentence while retaining JSON/RAW controls and live apply.
- [x] Keep response-time history permanently expanded and add an accessible information popover matching Process.
- [x] Extend UI/API/source regressions and update release identity to 0.24.10.

## 0.24.9

Current direction: 0.24.8 -> 0.24.9

- [x] Add the encrypted Secret Store and migrate ACME Cloudflare/OVH/RFC2136 credentials away from persistent plaintext files.
- [x] Add password-encrypted full backup/restore with manifest validation, integrity checks, staging and rollback-safe activation.
- [x] Add the optional bounded asynchronous ERROR file sink with JSON/RAW formats, shared secret redaction and external logrotate integration.
- [x] Extend offline source/release contracts and update release identity to 0.24.9.

## 0.24.8

Current direction: 0.24.7 -> 0.24.8

- [x] Expand Cache RAM overview history with HOT usage/limit and transient total/fill/COLD queue/COLD I/O series.
- [x] Add COLD storage occupancy history without mixing disk bytes into process RAM.
- [x] Move the RSS/cache accounting caveat behind an accessible information control.
- [x] Extend offline UI/release contracts and update release identity to 0.24.8.
- [ ] Run compiler-enabled `./dev.sh check` / `./dev.sh test` and browser/live-cache acceptance on the release host.

## 0.24.7

Current direction: 0.24.6 -> 0.24.7

- [x] Make the transform temporary-memory budget configurable and persisted with the normal SQLite-backed transform settings.
- [x] Add a process-wide maximum concurrent transformation limit with fail-open pressure behavior.
- [x] Add persisted RAM saver / Recommended / Performance / Uber performance resource presets while keeping transform types/extensions independent.
- [x] Add UI budget safety warnings and manual-edit -> Custom preset behavior.
- [x] Expose live transform RAM/concurrency, process/cache RAM accounting and COLD disk occupancy in the dashboard.
- [x] Clean externally reported cache/CSS compiler warnings without lint suppression.
- [x] Rotate cache compatibility identity for global transform representation/eligibility changes but not resource-only capacity metadata.
- [x] Extend OpenAPI, SQLite persistence, memory-contract and release/source regressions and update release identity to 0.24.7.

## 0.24.6

Current direction: 0.24.5 -> 0.24.6

- [x] Persist selected HOT/COLD cache preset intent in the SQLite-backed configuration and restore it in Settings.
- [x] Add a Recommended COLD policy preset without overriding disk capacity/path choices.
- [x] Bound transform aggregation/decompression/concurrency memory and remove avoidable JSON/HTML/CSS allocation churn.
- [x] Bound stale revalidation, proactive refresh scheduling, COLD cleanup selection/concurrency and delete fallback tasks.
- [x] Audit the remaining long-lived/background workers for queue/task cardinality and cancellation ownership.
- [x] Add Rust-independent memory contract regression checks and update release identity to 0.24.6.

## 0.24.5

Current direction: 0.24.4 -> 0.24.5

- [x] Resolve unknown-length, actually empty HTTP/3 bodies before HTTP/1.1 upstream framing.
- [x] Preserve streaming for non-empty H3 bodies and declared `Content-Length` requests.
- [x] Add source-level regression coverage for DELETE and other body-capable methods.
- [x] Bound HOT by allocation-aware admission, enforce `max_object_bytes` during fill, and add a separately bounded transient/COLD-queue memory model.
- [x] Preserve HOT -> COLD ownership semantics while charging demoted payloads until persistence drops them; expose logical/allocated/transient telemetry.
- [x] Make global cache disable authoritative over vhost overrides and remove the artificial 1 GiB HOT/object ceiling.
- [x] Add host/cgroup-aware conservative/recommended/performance cache presets and non-blocking memory/headroom warnings in Settings.
- [x] Update source/package/UI/OpenAPI identity and offline release checks to 0.24.5.

## 0.24.4

Current direction: 0.24.3 -> 0.24.4

- [x] Make the Linux THP mitigation process-local with `PR_SET_THP_DISABLE` before Tokio worker creation.
- [x] Preserve the existing glibc arena limit and allocator-trim behavior.
- [x] Add source/release regression coverage for THP opt-out ordering and release identity.

## 0.24.3

Current direction: 0.24.2 -> 0.24.3

- [x] Reduce Linux/glibc arena retention by adding `MALLOC_ARENA_MAX=2` to managed systemd units.
- [x] Remove redundant identity-body and JavaScript/CSS transformation allocations; release successful-transform temporaries earlier and trim large glibc transform churn at a bounded cadence.
- [x] Move HTTP/3 enablement to listener editing while keeping HTTP/3 tuning under HTTP connections.
- [x] Rename Proxy Process to Process and hide unsupported platform diagnostics dynamically.
- [x] Remove the stale unreferenced per-BSD parser source from the release archive.
- [x] Update source/package/UI/OpenAPI identity and Rust-independent release gates to 0.24.3.

## 0.24.2

Current direction: 0.24.1 -> 0.24.2

- [x] Bump package/source/UI/OpenAPI release identity to 0.24.2 without functional changes.

## 0.24.1

Current direction: 0.24.0 -> 0.24.1

- [x] Replace the duplicated BSD statistics implementation with shared cross-platform library APIs.
- [x] Preserve Linux-specific `/proc`/cgroup diagnostics as additive compatibility fields.
- [x] Populate additional portable system/process metrics exposed by the selected libraries where available.
- [x] Expose low-risk runtime metadata through the authenticated status API, including the resolved data/database path.
- [x] Make CLI installed-data discovery use Linux and BSD/OPNsense conventions without hardcoding the path in the browser.
- [x] Move Logging into Settings and retain legacy `/logging` navigation compatibility.
- [x] Fix the release-host compiler error in portable uptime sampling and remove the stale H2 import warning.
- [x] Remove artificial hostname-count ceilings from certificate bindings/issuance and hostname-list configuration while retaining syntax, payload and resource-safety bounds.
- [x] Update source/package/UI/OpenAPI identity and source-side regression contracts to 0.24.1.
- [ ] Generate and commit a resolver-produced `Cargo.lock`, then run compiler-enabled `cargo fmt --all`, `cargo check --locked --all-targets` and `cargo test --locked --all-targets` on the release host.

The 0.24.1-era notes are summarized in the retained [technical changelog archive](CHANGELOG_TECHNICAL_ARCHIVE.md).

## 0.24.0

Current direction: 0.23.3 -> 0.24.0

- [x] Graceful H2 idle retirement with activity/stream recheck, GOAWAY and bounded drain.
- [x] Independent H2 maximum connection lifetime and drain timeout settings.
- [x] Settings API/UI/OpenAPI contracts for all three H2 lifecycle limits.
- [x] Extract system statistics into platform backends without changing Linux metric semantics.
- [x] Add FreeBSD/OpenBSD/NetBSD native best-effort sampling and explicit unsupported/null metrics.
- [x] Surface platform in Proxy Process and Prometheus metadata.
- [x] Update source/package/UI identity and source-side regression contracts to 0.24.0.

The 0.24.0-era notes are summarized in the retained [technical changelog archive](CHANGELOG_TECHNICAL_ARCHIVE.md).

## 0.23.3

Current direction: 0.23.2 -> 0.23.3

- [x] Add opt-in per-vhost legacy WebSocket compatibility without changing ordinary HTTP behavior.
- [x] Force legacy-mode upstream WebSocket handshakes to HTTP/1.1 and force legacy WebSocket `Host` to the configured backend authority and align `Origin` with it.
- [x] Tolerate old `101` response framing while keeping the WebSocket accept proof and subprotocol validation strict.
- [x] Add dashboard/OpenAPI/language-pack controls and source regressions.
- [x] Update package/source identity and Rust-independent release gates to 0.23.3.

The 0.23.3-era notes are summarized in the retained [technical changelog archive](CHANGELOG_TECHNICAL_ARCHIVE.md).

## 0.23.2

Current direction: 0.23.1 -> 0.23.2

- [x] Let Cache and Transformation live charts retain 60, 120, 300 or 600 samples without changing the 3-second polling cadence.
- [x] Persist each chart history-window choice locally in the browser and keep history memory bounded.
- [x] Fix local CLI administration transport detection so HTTPS administration no longer traps `--livelogs` in a 308 reconnect loop.
- [x] Pin local CLI HTTPS to certificates from the private RustProxy certificate directory and reuse the transport for config/TLS CLI calls.
- [x] Update package/source identity and Rust-independent release gates to 0.23.2.

The 0.23.2-era notes are summarized in the retained [technical changelog archive](CHANGELOG_TECHNICAL_ARCHIVE.md).

## 0.23.1

Current direction: 0.23.0 -> 0.23.1

- [x] Add default-collapsed, full-width live activity charts to the Cache and Transform workspaces.
- [x] Plot selected-scope Cache HIT/MISS/BYPASS rates from runtime counters without adding proxy-path work.
- [x] Plot selected-scope Transform applied/cache-HIT/skipped/error rates from the existing runtime metrics endpoint.
- [x] Reuse the dashboard SVG/chart styling, live 3-second refresh and language-pack model.
- [x] Update package/source identity and Rust-independent release gates to 0.23.1.

The 0.23.1-era notes are summarized in the retained [technical changelog archive](CHANGELOG_TECHNICAL_ARCHIVE.md).

## 0.23.0

Current direction: 0.22.3 -> 0.23.0

- [x] Add scoped external certificate API authentication with Key ID + Bearer Token, hash-only storage, rotation/revoke/status and last-used metadata.
- [x] Restrict the external credential to certificate deploy/reload and require HTTPS outside loopback.
- [x] Add Settings → Certificate API UX and preserve direct production binary commands for local deploy/reload.
- [x] Add `rust-proxy --livelogs` with a bounded live stream, interactive structured filters, detailed request inspection and explicit lag reporting.
- [x] Split Settings → Cache into General, Resilience, Cold cache and Static & diagnostics sub-tabs without changing the atomic cache settings document.

The 0.23.0-era notes are summarized in the retained [technical changelog archive](CHANGELOG_TECHNICAL_ARCHIVE.md).

## 0.22.3

Current direction: 0.22.2 -> 0.22.3

- [x] Add HTTP/1.1 `Upgrade: h2c` on opt-in cleartext H2 listeners while preserving prior-knowledge h2c.
- [x] Validate Upgrade/HTTP2-Settings and reject malformed or body-bearing bootstrap requests before `101`.
- [x] Reconstruct the initiating H1 request as HTTP/2 stream 1 and retain the normal Hyper H2 path for later streams.
- [x] Add dedicated certificate hot reload without mutating desired configuration or revision.
- [x] Add external certificate deployment for Certbot/manual issuers with immutable generation staging and atomic multi-vhost switch by certificate id.
- [x] Add API/CLI/panel support plus audit/OpenAPI/documentation for certificate reload/deploy.

The 0.22.3-era notes are summarized in the retained [technical changelog archive](CHANGELOG_TECHNICAL_ARCHIVE.md).

## 0.22.2

Current direction: 0.22.1 -> 0.22.2

- [x] Add replay-safe failover retry with bounded policy and observability.
- [x] Correct explicit HTTP/2 upstream request versioning and retain h2c prior-knowledge regression coverage.
- [x] Add per-backend maximum concurrent proxy exchanges with bounded queue timeout / 503 behavior and metrics.
- [x] Add detailed upstream failure classification plus last failure and health ejection/recovery timestamps.
- [x] Consolidate backend operations data in the existing dashboard table: health, active/limit, requests/errors, latency, traffic, last failure and last recovery.
- [x] Parse and expose public-certificate issuer/SAN/validity/remaining-days/expiry status plus renewal status/last attempt/error.

The 0.22.2-era notes are summarized in the retained [technical changelog archive](CHANGELOG_TECHNICAL_ARCHIVE.md).

## 0.22.1

Current direction: 0.22.0 -> 0.22.1

- [x] Move selective PURGE/BAN and active BAN management into dedicated Cache modals with inline operation feedback.
- [x] Add per-vhost RFC 8441 HTTP/2 WebSocket Extended CONNECT beside RFC 9220.
- [x] Bridge H2 RFC 8441 WebSockets to H1 upstreams and preserve Extended CONNECT to explicit H2 upstreams.
- [x] Add opt-in cleartext HTTP/2 prior-knowledge (`h2c`) listeners.
- [x] Add stable active-tunnel inventory, per-tunnel kill, operator reason and audit logging.
- [x] Split WebSocket tunnel statistics by H1 / H2 RFC 8441 / H3 RFC 9220 on the main dashboard and Prometheus.
- [x] Preserve the 0.22.0 cache feature set and `Accept-Ranges` policy.
- [x] Update 0.22.1 source/package identity and Rust-independent release gates.

The 0.22.1-era notes are summarized in the retained [technical changelog archive](CHANGELOG_TECHNICAL_ARCHIVE.md).

## 0.21.0

Current direction: 0.20.0 -> 0.21.0

- [x] Shard Cold Cache storage and add bounded asynchronous GC plus selective cleanup.
- [x] Add RFC 5861 stale windows, request `max-stale`, correct request `max-age=N`, and correct revalidation-directive semantics.
- [x] Add the extensible decode -> transform -> canonical cache -> encode stage with transformed lengths/validators, strict `no-transform`, HEAD/fill safety and canonical `Vary: Accept-Encoding` handling.
- [x] Add global, per-vhost and Docker-discovery transformation controls and administration UI/API coverage.
- [x] Make Passive Backend Health explicit opt-in for ordinary and Docker vhosts while preserving independent active health checks and unconditional observability.
- [x] Keep route cache override tri-state and expose effective route/cache/transform diagnostics.
- [x] Close 0.21.0 with the current conservative JS/CSS transformers; defer parser-backed replacements to a later development cycle.
- [x] Finish release polish: backend timing header rename, human-readable uptime, transformed Live traffic series, Docker Passive Backend Health layout fix, warning cleanup and cache module split.
- [x] Keep package/source identity and OpenAPI at 0.21.0 and package the completed feature scope as the 0.21.0 release source.

The 0.21.0-era notes are summarized in the retained [technical changelog archive](CHANGELOG_TECHNICAL_ARCHIVE.md).

## 0.20.0

Current direction: 0.19.4 -> 0.20.0

- [x] Split Certificates into Installed / Renewal / Generate tabs.
- [x] Move generation/import into the tabbed workspace and keep existing certificate actions compatible.
- [x] Improve ACME/renewal status readability and display exact Certbot log locations on failures.
- [x] Update package/source identity, OpenAPI and release checks to 0.20.0.

## 0.19.4

Current direction: 0.19.3 -> 0.19.4

- [x] Normalize Docker-vhost Aliases field geometry with neighboring inputs and remove the extra inherited label spacing.
- [x] Retain `0.0 KiB/s` idle and `<0.1 KiB/s` positive low-rate backend traffic formatting with release regression coverage.
- [x] Add Cache domain-table filtering by resolved cache-enabled state without changing aggregate cache statistics.
- [x] Update package/source identity, OpenAPI and release checks to 0.19.4.

## 0.19.3

Current direction: 0.19.2 -> 0.19.3

- [x] Preserve the exact panel and Settings tab through session expiry/re-login without shell flicker.
- [x] Canonicalize `/configuration` into persistent Settings tab routing.
- [x] Add shared save-button busy state and field-focused validation feedback.
- [x] Preserve certificate import file selections after failed saves.
- [x] Add per-Settings-tab unsaved-change indicators, including Manual config.
- [x] Add persisted dark/light administrator theme selection and consolidate theme-sensitive CSS tokens.
- [x] Keep Live Logs column selection compact with standard checkboxes and no internal scrollbars.
- [x] Add a fail-soft embedded-config release checker with hourly default cadence and CLI/environment overrides.
- [x] Keep the release checker compiler-compatible by mapping boxed HTTP body collection failures explicitly into `anyhow::Error`.
- [x] Reduce the footer to API latency/dropped logs and fix the last broad Live Logs checkbox sizing override.
- [x] Update package/source identity, OpenAPI and release checks to 0.19.3.

## 0.19.2

Current direction: 0.19.1 -> 0.19.2

- [x] Restore administration-backend local-listener risk detection for startup-locked listeners and loopback aliases; make vhost discard restore the persisted draft baseline.
- [x] Use descriptive status names for default responses.
- [x] Add an on-demand 4096-entry live log buffer that lasts until the log window closes.
- [x] Align inline checkboxes and reduce Docker-vhost alias editor height.
- [x] Render idle backend traffic as `0.0 KiB/s` and positive sub-0.1 KiB/s traffic as `<0.1 KiB/s`.
- [x] Remove cache diagnostics/validators from locally generated placeholder/default pages and enforce `no-store`.
- [x] Allow safe vhost-ID rename with collision protection and operator warning.
- [x] Update package/source identity, OpenAPI and release checks to 0.19.2.

## 0.19.1

Current direction: 0.19.0 -> 0.19.1

- [x] Repair Default responses section serialization/server routing.
- [x] Isolate cache objects by frontend scheme.
- [x] Keep a 256-entry live log window with 4096 retained entries available on demand.
- [x] Polish backend traffic units, checkbox/column UI and Docker-vhost Advanced layout/alias spacing.
- [x] Remove stale screenshots and index historical/version-labelled documentation.
- [x] Restore source-package test files/fixtures required by the release gates.
- [x] Update package/source identity, OpenAPI and release checks to 0.19.1.

## 0.19.0

Current direction: 0.18.8 -> 0.19.0

- [x] Persist per-admin Live Logs column visibility in SQLite without affecting JSON export or proxy configuration revisions.
- [x] Remove the duplicate top-right version badge.
- [x] Carry the legacy X.509 `tls_verify=false` compatibility fix and expanded upstream diagnostics into the release.
- [x] Add schema-v4 migration, administration API coverage and update package/source identity to 0.19.0.

## 0.18.8

Current direction: 0.18.7 -> 0.18.8

- [x] Use hostname-style chips for Docker-vhost aliases.
- [x] Add per-app HTTP-to-HTTPS redirect, WebSocket and cache switches for Docker vhosts.
- [x] Add an agent-level default ACL-profile selector without removing per-app ACL overrides/inline rules.
- [x] Remove the compression-codec explainer from Overview.
- [x] Update package/source identity, API schema and release checks to 0.18.8.

## 0.18.7

Current direction: 0.18.6 -> 0.18.7

- [x] Keep Response time history collapsed by default without stopping its live samples.
- [x] Make per-interface RX/TX charts visually consistent with the aggregate network history.
- [x] Fix expanded Docker-vhost route/ACL field alignment from the 0.18.6 UI.
- [x] Update package/source identity and release checks to 0.18.7.

## 0.18.6

Current direction: 0.18.5 -> 0.18.6

- [x] Add network-throughput diagnostics split by non-loopback host interface.
- [x] Re-audit compression counters and add q-weighted negotiation coverage for all four supported codecs.
- [x] Polish Docker-agent settings alignment and spacing around listener selection / Add agent.
- [x] Update package/source identity and release checks to 0.18.6.

## 0.18.5

Current direction: 0.18.4 -> 0.18.5

- [x] Make compression counters track the codec actually applied by RustProxy and add independent per-codec regression coverage.
- [x] Split the Overview request-rate chart into total, HTTP/1.1, HTTP/2 and HTTP/3 series.
- [x] Add a proxied-app launcher to Docker vhosts and show their domains beside generated backend-pool IDs.
- [x] Remove the global Open proxy shortcut.
- [x] Make Compact density clearly tighter than Dense.
- [x] Give proxy timeout controls explicit safe defaults instead of blank inherited values.
- [x] Replace Docker-agent listener CSV entry with the named-listener picker and tighten the agent status-row UX.
- [x] Update package/source identity and release checks to 0.18.5.

## 0.18.4

Current direction: 0.18.3 -> 0.18.4

- [x] Make TCP the default backend health-check mode without rewriting existing explicit HTTP/off configuration.
- [x] Make Docker vhosts summary-first so large container inventories do not render every routing/ACL/timeout/health control at once.
- [x] Simplify Settings -> Security with progressive disclosure for credential and host-policy editing.
- [x] Move Administration audit to a dedicated on-demand modal.
- [x] Update package/source identity and release checks to 0.18.4.

## 0.18.3

Current direction: 0.18.2 -> 0.18.3

- [x] Export Docker vhosts/backends under dedicated Prometheus metric families rather than ordinary vhost/backend families.
- [x] Add a separate live Docker-vhosts metric-group switch in Prometheus settings.
- [x] Cover Docker vhost traffic/duration and backend health/latency/probe/runtime observations with bounded labels.
- [x] Add regression checks for ordinary-vs-Docker metric isolation.
- [x] Add configurable separate access-log files per vhost and preserve bounded asynchronous sink behavior.
- [x] Lock startup-owned HTTP/HTTPS/admin binds while keeping non-startup listeners editable.
- [x] Polish compact UI, 404 response statuses, redirect summaries, global TLS cipher visibility and managed-certificate lifecycle UX.
- [x] Default WebSocket proxying to HTTP/1.1 Upgrade and make RFC 9220 HTTP/3 Extended CONNECT an explicit experimental vhost opt-in.

## 0.18.2

Current direction: 0.18.1 -> 0.18.2

- [x] Serve the standalone Docker agent over HTTPS by default using a persistent self-signed ECDSA certificate.
- [x] Add SHA-256 certificate pinning for self-signed Docker agents while retaining normal public-CA validation when no pin is configured.
- [x] Add per-service Docker backend health-check settings backed by the normal bounded backend health machinery.
- [x] Show Docker backend health/runtime diagnostics and agent TLS/observation state in the Docker vhosts UX.

## 0.18.1

Current direction: 0.18.0 -> 0.18.1

- [x] Add a standalone, token-authenticated Docker discovery agent that reports only running containers with non-loopback published TCP ports.
- [x] Add multi-agent endpoint/token/base-domain/listener/default-IP settings and keep observed Docker inventory separate from desired persisted assignments.
- [x] Detect multiple usable Docker-host addresses and preserve every public Docker bind for each discovered service.
- [x] Add a Docker vhosts panel with short names, arbitrary FQDNs, aliases and per-service backend-IP selection; reconcile assignments into dynamic ephemeral vhosts without revision writes.
- [x] Move the cache Live toggle to the right edge of the cache action toolbar.
- [x] Remove all dedicated `X-Rust-Proxy-Revision` handling; it is no longer generated, stripped, protected or migrated.
- [x] Replace production password recovery help with the installed `rust-proxy admin reset-password` command.

## 0.17.0

Current direction: 0.16.1 -> 0.17.0

- [x] Add Debian/systemd/logrotate packaging and local APT-repository generation.
- [x] Export all currently implemented bounded process/OS diagnostics and extend safe Prometheus coverage for backend, GeoIP, certificate renewal, stream and logging state.
- [x] Add explicit trusted-CIDR Prometheus scraping without a token and preserve actual-peer-only ACL evaluation.
- [x] Ship a Grafana operations dashboard.
- [x] Add dedicated certificate/listener-aware local-response / 404 hosts and a dashboard editor.
- [x] Keep the built-in welcome placeholder `no-store` and strip optional response metadata.
- [x] Match Redirect source-domain editing UX to Vhost hostname chips.

## 0.16.1

Current direction: 0.16.0 -> 0.16.1

- [x] Keep revision CAS as an internal concurrency mechanism but stop showing revision numbers in successful configuration-save feedback.
- [x] Preserve all 0.16.0 proxy/cache/H3/admin/UX behavior and bump release identity to 0.16.1.

## 0.16.0

- [x] Keep the main vhost backend as an internal fallback separate from Custom locations, with legacy synthetic-root normalization.
- [x] Preserve the reserved administration session cookie only for an explicitly allowed, TLS-protected self-admin reverse-proxy route; ordinary upstreams remain isolated.
- [x] Complete backend WebSocket takeover before HTTP/3 Extended CONNECT success and add phase/error/reset/upstream diagnostics to access logs.
- [x] Split process-memory and cache-memory reporting into RSS categories plus hot/transient fill/cold-queue/cold-I/O gauges while retaining the existing allocator-release paths.

## 0.15.1

Current direction: 0.15.0 -> 0.15.1

- [x] Repair EN/PL Custom locations/help translations and reject misplaced language-pack keys in release checks.
- [x] Rework visual header-rule editing and add a live effective-behavior preview to each location.
- [x] Expand in-panel location documentation with structured sections and common examples.
- [x] Add combined HIT/MISS/BYPASS activity and Proxy process CPU/RSS charts.

## 0.15.0

Current direction: 0.14.0 -> 0.15.0

- [x] Add Nginx-style Custom location matching, rewrite and local-response controls with inline documentation and a visual header-rule builder.
- [x] Add reusable Nagios/Icinga API checks for control-plane latency, backend availability/latency and dropped-work counters.
- [x] Move per-vhost timing/Cloudflare diagnostics to the main frontend configuration and add source IP to live logs.
- [x] Add dashboard history charts for RAM cache, network throughput and response latency plus compact API/footer diagnostics.
- [x] Add separate idle-age and total-hot-residency cold-cache policies.
- [x] Remove the runtime renewal-observation JSON importer and quarantine obsolete state only during a stopped source upgrade.
- [x] Accept repeated literal path separators by normalizing them for routing/ACL decisions while preserving the original backend target.

## 0.14.0

Current direction: 0.13.2 -> 0.14.0

- [x] Accept explicitly allowlisted browser-facing administration DNS authorities behind a trusted reverse proxy without requiring the internal admin port.
- [x] Keep direct IP/localhost administration access on the configured admin port and derive same-origin/cookie security from trusted external proxy metadata.
- [x] Implement RFC 9220 WebSocket Extended CONNECT over HTTP/3 without a side-channel transport or HTTP/1.1 bootstrap fields on the client-facing H3 request.
- [x] Move the H3 stack to `hpx-h3 2.5.19` with integrated Quinn transport and advertise Extended CONNECT support.
- [x] Rename the requested dashboard sections/actions in EN/PL and update release contracts/documentation.

## 0.13.2

Current direction: 0.13.1 -> 0.13.2

- [x] Honor a valid administrator session on direct panel refresh and revalidate stale browser-history login documents.
- [x] Force hot-cache handoff to enabled cold storage during managed updates and provide a longer controlled-stop budget.
- [x] Store automatic-renewal observations in SQLite schema v3 and restore them before the administration listener starts, with one-time legacy JSON import.
- [x] Move the raw configuration document editor under **Settings -> Manual config** while preserving `/configuration` as a compatibility alias.
- [x] Update documentation, OpenAPI, language help, offline regressions and release identity.

## 0.13.1

Current direction: 0.13.0 -> 0.13.1

- [x] Extend administrator browser sessions to a configurable absolute 7–30 day lifetime, default 30 days.
- [x] Keep password change, logout and revoke-all as immediate session invalidation boundaries.
- [x] Allow deliberate local-listener backends, including port 9090, only behind explicit per-backend risk acceptance while retaining private/special-address policy.
- [x] Add panel confirmation, OpenAPI fields, EN/PL strings, documentation and regressions.

## 0.13.0

Current direction: 0.12.1 -> 0.13.0

- [x] Add first-class redirect hosts and dashboard navigation.
- [x] Support scheme/path matching, URL/host/path targets, 301/302/303/307/308, path/query and redirect-cache controls.
- [x] Share named listeners and certificate inventory with redirects while rejecting conflicting frontend ownership.
- [x] Default backend HTTPS `tls_verify` to false when omitted; keep explicit opt-in verification.
- [x] Compact certificate inventory cards, render DNS SANs as vhost-style badges and inspect legacy/manual public PEM files when stored coverage metadata is absent.
- [x] Update OpenAPI, docs, translations, regressions and release identity.

## 0.12.1

Current direction: 0.12.0 -> 0.12.1

- [x] Split ordinary configuration writes into revisioned section endpoints and retain atomic full-document publication for intentional multi-section changes.
- [x] Stop unrelated control-plane saves from rotating cache compatibility identity.
- [x] Preserve dashboard subpage routing across browser refresh/back-forward navigation.
- [x] Add independently selectable cold-cache idle/LRU/shutdown persistence policies.
- [x] Flush hot cache objects to cold storage during graceful shutdown and release RAM after bulk demotion where the allocator supports it.
- [x] Expose certificate DNS SubjectAltName coverage separately from configured SNI bindings.
- [x] Improve HTTPS backend TLS validation guidance while preserving secure-by-default omitted configuration and the explicit debug preset.
- [x] Update OpenAPI, regression checks and release identity to 0.12.1.
- [ ] Compile and execute the Rust test suite on a Rust 1.88+ staging host.

## 0.12.0

Current direction: 0.11.5 -> 0.12.0

- [x] Move Layer-4 TCP/UDP stream management out of Settings into a dedicated main-navigation page directly below Vhosts.
- [x] Give Streams the vhost-style searchable card + modal workflow with explicit active-versus-desired restart state.
- [x] Add fixed-cardinality per-stream connection/session, reject, error, byte and UDP packet telemetry without database work on the data path.
- [x] Add browser-session RX/TX rate charts derived from monotonic backend stream counters.
- [x] Restyle named listener bind addresses with the same chip interaction used for vhost hostnames.
- [x] Extend offline source/release regression gates for Streams navigation, authenticated assets, UI contracts and L4 metrics source invariants.

- [x] Stop successful unsafe methods from globally purging otherwise unrelated cached GET objects.
- [x] Use Host + URL as the logical primary cache identity and response `Vary` for representation variants instead of hashing unrelated request headers/backend members.
- [x] Share cache objects across backend-pool members and GET/HEAD requests.
- [x] Preserve resident age through 304 revalidation and hot/cold movement; persist the additional cold metadata in format 2.
- [x] Add variant-schema safety and cache regression coverage for the new behavior.
- [x] Make Force SSL require a real HTTP ingress and choose port 443 deterministically when several TLS ports are selected.
- [x] Add a graphical ACL-profile rule editor and resilient bulk-rule import with exact line errors.
- [x] Hide RustProxy cache diagnostics when a vhost explicitly disables cache.
- [x] Distinguish disabled vhost pools from unhealthy backends in the dashboard.
- [x] Add per-vhost client-IP forwarding control without weakening RustProxy ACL/GeoIP/rate-limit/Tinyauth identity.
- [x] Add a compact vhost search/filter for large installations.
- [x] Keep the checked-in Cargo lockfile stable and correct the Quinn manifest version to the resolved release.
- [x] Make the standard JSONL log directory writable under the hardened systemd service.
- [x] Accept HTTP/2/H3 `:authority` on the HTTPS administration panel without requiring a duplicate legacy Host header.
- [x] Reject ambiguous requests where legacy Host conflicts with protocol-native authority, while preserving strict HTTP/1.x origin-server semantics.
- [x] Add administration H2 authority and `/healthz` regression tests.
- [x] Add per-vhost Force SSL with an HTTP 308 redirect to the configured TLS frontend while preserving path/query.
- [x] Preserve NPM `ssl_forced` in the SQLite migrator as RustProxy Force SSL with usable HTTP+HTTPS listener bindings.
- [x] Fix managed update/rollback health checks for persisted administration HTTPS and changed admin bind/Host policy.
- [x] Add a dry-run-first SQLite migration tool for Nginx Proxy Manager proxy-host names and backends, with generic RustProxy TLS certificate fallback and manual-review warnings for unsupported NPM features.
- [x] Add offline migration-planner and HTTPS health-target regression coverage.
- [x] Add reusable ACL Profiles with country allow/block and IP/CIDR policy, attachable per vhost while retaining cumulative inline vhost and route ACL controls.
- [x] Add chip-style hostname editing and leading `*.` wildcard domains with exact-host and longest-wildcard precedence.
- [x] Add compact browser-session request-rate charts to vhost cards with progressive lifetime compaction.
- [x] Add the built-in HTTP 401 error page and treat benign post-upgrade WebSocket closes as normal tunnel completion.
- [x] Redirect plaintext requests arriving on the HTTPS administration socket and accept valid DNS Host values when no explicit admin hostname allowlist is configured.
- [x] Allow one named frontend listener policy to bind up to 16 explicit local addresses while forbidding wildcard binds in multi-address mode.
- [x] Align the Logging format builder with the Vhost configuration modal and reposition its field-configuration action.
- [x] Make source ZIP generation deterministic and verify reproducibility in release smoke tests.
- [x] Add bounded hot RAM and optional persistent cold disk cache tiers with asynchronous demotion/promotion, restart recovery, integrity metadata and separate hot/cold statistics.
- [x] Add cold-tier settings for path, disk/object budgets and idle demotion time while preserving global hot RAM limits.
- [x] Add structured-log format presets plus a visual field selector/renamer with JSON preview and advanced raw mapping fallback.
- [x] Normalize Logging sink cards to the shared application card styling instead of release-specific fieldset CSS.
- [x] Add baseline multi-stage Docker/OCI packaging with an unprivileged runtime user and persistent data volume.
- [x] Document browser hard-reload cache revalidation semantics and expose the exact request revalidation reasons in the cache inspector.
- [x] Redesign vhost cards around listener/protocol/certificate/cache identity plus live pool health, requests, active exchanges, errors, latency and traffic rate.
- [x] Add bounded structured JSON access-log sinks for JSONL files, Logstash TCP and Loki HTTP(S), with configurable field mapping/static fields and sink counters.
- [x] Expand cache object inspection with body bytes, resident bytes, overhead and aggregate stored-object memory counters.
- [x] Add optional `X-Cache-Resident-Age` and expose resident age for stored HITs.
- [x] Add administration HTTPS using the application-managed default certificate or a selected certificate, with restart-aware persisted bind address and hostname allow list.
- [x] Permit non-loopback administration binding when HTTPS is enabled; keep plain remote HTTP behind the legacy explicit risk gate.
- [x] Add global TLS protocol/cipher policy plus per-vhost TLS 1.2/1.3 and cipher overrides for TCP TLS. HTTP/3 vhosts inherit the global TLS 1.3 policy.
- [x] Make Settings tabs fill the available width and add dedicated Administration/TLS policy pages plus a separate Logging navigation page.
- [x] Enable shared cache by default while keeping explicit vhost/route disable controls.
- [x] Implement fresh conditional HIT for `If-None-Match` / `If-Modified-Since`.
- [x] Implement backend validator revalidation and cached-body reuse on backend 304.
- [x] Treat request/response `no-cache` as validation semantics rather than no-store; preserve `no-store` as hard exclusion.
- [x] Retain stale validators for bounded revalidation without stale serving.
- [x] Raise maximum object configuration to 1 GiB and remove eager object-sized fill allocation.
- [x] Add diagnostics, real-binary smoke scenarios, unit regressions and 0.8.1 release documentation.
- [x] Per-vhost H2/H3 frontend opt-outs next to named-listener selection, capability-gated by Settings listeners.
- [x] Global static-cookie cache defaults for common assets, visible global/per-vhost controls and response-side privacy guards.
- [x] Listener editor uses page scrolling without a nested scrollbar.
- [x] Per-vhost fixed-window request rate limiting with burst allowance.
- [x] Per-country rate overrides and block/allow-only country access rules backed by verified install-time GeoIP data.
- [x] Cloudflare client IP mode gated by direct-peer Cloudflare CIDRs.
- [x] Per-vhost H2/H3 frontend opt-outs and Server-Timing diagnostics.
- [x] Named listener selection in vhosts; listening IP/ports managed in Settings.
- [x] Health-check `off` disables active and passive classification.
- [x] HTTPS-by-IP backend debugging defaults and warnings.
- [x] Global static-cookie cache defaults plus per-vhost inheritance/overrides with response privacy guards.
- [x] Corrected cache Age calculation.
- [x] Updated deployment regressions, docs and 0.8.0 release identity.
- [x] Release CLI can generate the one-time setup token before first server start.
- [x] Explicit two-flag risk gate for wildcard remote administration binding.
- [x] Numeric Host validation for the wildcard panel; DNS hostnames remain rejected.
- [x] Linux/systemd install defaults enable 80/443; explicit `--no-https` opt-out.
- [x] Updated deployment regressions, docs and 0.7.3 release identity.
- [ ] Build/check/test the Rust binary and exercise remote-panel/systemd behavior live.
- [x] Explicit release identity, without overwriting the 0.7.1 artifact.
- [x] Swagger asset default independent of environment presence/Cargo config lookup.
- [x] Embedded assets prepared by our build, without an adapter's old-version fallback.
- [x] Offline local ZIP, bounded member validation, optional SHA-256 and safe caching.
- [x] Executable build-helper regressions and updated build/migration instructions.
- [ ] Build/check/test real Rust and render the actual upstream Swagger distribution.
- [x] Per-location visual proxy-request and client-response header rules.
- [x] Minimal anonymous login document and filtered extensible language bundle.
- [x] Exact default-deny admin route/method policy including private assets and docs.
- [x] Protected OpenAPI/Swagger, cookie session and CSRF-confirmed mutations.
- [x] Generic public discovery/errors and cross-tab UI revocation cleanup.
- [x] Source audit, access probe and regression tests with explicit execution limits.
- [ ] Compile and run router/proxy tests, inspect real Swagger rendering, and run the
  anonymous probe against the built release before production acceptance.
- [x] Scheduled renewal for HTTP-01, Cloudflare, OVH and RFC2136 managed profiles.
- [x] Validated revisioned hot certificate publication with unchanged/failure safety.
- [x] Per-certificate opt-out, manual check, dry run, next/last/expiry observations.
- [x] Separate install/update scripts; isolated service, full data backup and rollback.
- [x] Vhost Basic Auth with bounded Argon2id checks and optional credential forwarding.
- [x] Per-vhost WebSocket toggle and graphical cumulative CIDR ACL editing.
- [x] Visual prefix locations with pool exclusion for dedicated origins.
- [x] Neutral welcome page, opt-in protocol fixture, shared square modal/Settings style.
- [x] Independent proxy and local administrator control plane; no Docker dependency.
- [x] SQLite documents, revision CAS, immutable snapshots, audit and private backups.
- [x] Accounts, bounded sessions, setup capability, origin/CSRF protections.
- [x] Host/path routes, aliases, explicit private-origin permission and CIDR ACLs.
- [x] Streaming bodies and full-exchange limits; bounded logs, SSE and Prometheus.
- [x] Public TLS/SNI, verified HTTPS upstreams, guarded DNS, HTTP/2 and WebSocket source.
- [x] Whole-source upgrade, legacy auth-module repair and rollback on copy failure.
- [x] Persist public HTTP/HTTPS bind addresses and ports, including 80/443 presets.
- [x] Distinguish active listeners, desired listeners and startup defaults; show restart pending.
- [x] Allow remote origins on ordinary 80/443 without allowing local listener loops.
- [x] RAM cache with TTL/Age, entry/object/byte limits, LRU eviction and route bypass.
- [x] Bounded streaming fills; do not publish partial, failed, oversized or trailer bodies.
- [x] Privacy exclusions, conservative Vary identity and ACL-before-cache ordering.
- [x] Optional X-Cache, X-Cache-Hits and Cache-Status; counters and authenticated purge.
- [x] Invalidate old fill generations on purge, config publication and successful unsafe methods.
- [x] Streaming gzip, Brotli, Zstandard and deflate negotiation with privacy/no-transform safeguards.
- [x] Preserve/hide/custom Server policy; client-response and upstream-request header editors.
- [x] Denser responsive dashboard; original logo retained.
- [x] OS/process CPU, RAM/RSS, load, descriptors, threads, network, cgroup and cache diagnostics.
- [x] Compile-time language discovery from langs/*.json; metadata, fallback and RTL.
- [x] Extra language files survive managed source updates.
- [x] Log filtering by host/path/cache outcome and bounded JSON export.
- [x] Unit and real-binary integration test source; 49 simulated-API frontend checks.
- [x] Example unprivileged systemd service with low-port capability.
- [x] Remove reported compression threshold type mismatch without narrowing or panic conversion.
- [x] Explicit frontend IP/port/TLS ownership inside a vhost; actual-destination isolation.
- [x] Multiple backend members, weights, backup and drain modes.
- [x] Weighted round-robin, least active exchanges, least traffic, adaptive and IP hash.
- [x] Connection keepalive/reuse limits and timers, not a Keepalived/VRRP integration.
- [x] Bounded TCP/HTTP health checks, slow-response exclusion, fall/rise and recovery.
- [x] Opaque cookie/IP affinity; compatible edit continuity, safe cache bypass.
- [x] Full-exchange backend leases; no automatic replay of failed writes.
- [x] Per-vhost response/security headers, TLS-only HSTS and explicit preload policy.
- [x] HTTP/2 TLS preference retains HTTP/1.1 for clients and HTTPS origins.
- [x] Vhost editor, atomic legacy migration, health/traffic/latency dashboard and API metrics.
- [x] All new user-facing text in discovered language packs; logo unchanged.
- [x] Rust regression and real-binary acceptance test source; 63 simulated-API UI checks.
- [x] Complete source update, examples, migration documentation and evidence report.
- [x] Split oversized status JSON expansion instead of masking it with a larger recursion limit.
- [x] Optional per-vhost certificate upload/selection with bounded private staging and validated SNI mappings.
- [x] Independent vhost cache behavior, inherited defaults and shared resident/object ceilings.
- [x] **Selective cache invalidation by vhost**, promoted from Cache evolution; invalidate pending fills too.
- [x] Compact manager list and tabbed vhost dialog, visual header rules and live health/latency.
- [x] Dashboard density presets and top alignment, without redesigning the logo.
- [x] Separate modal/docked live logs with persistent controls, vhost filters, pause and scoped export.
- [x] Global/vhost error pages, maintenance/static response and direct-IP/unknown-host behavior.
- [x] Security shortcut within Settings; new labels remain in discoverable language packs.
- [x] Python-only random-data mock origin for cache, health, delay, compression and error-page development.
- [x] Regression test source for new runtime policies; executed frontend/helper checks in TEST_REPORT.md.
- [x] Canonical Forwarded/X-Forwarded-For/X-Real-IP with explicit bounded proxy trust; keep destination-IP routing independent.
- [x] Per-vhost Tinyauth auth subrequest, sanitized identity headers, restricted login redirects and fail-closed handling before cache/static/upgrades.
- [x] Separate certificate inventory tab with upload, per-vhost selection and metadata-only read API; leave ACME as future work.
- [x] Named multiple-IP listeners, descriptive scope, reusable vhost references and explicit legacy-route permission.
- [x] HTTP/3 UDP adapter using Quinn/h3 with TLS 1.3, same SNI/policy pipeline, Alt-Svc, requested limits and bounded drain; retain TCP H2/H1.
- [x] Request ID/revision off by default, independent per-vhost controls, optional mock-origin removal and effective per-vhost Server policy.
- [x] Actual frontend socket in cache identity; streaming-safe empty request detection for H2/H3.
- [x] Toast above active modal backdrop, including browser top-layer/inertness handling.
- [x] Python fake-auth peer plus Rust regression sources for auth, headers, extra-frontend cache, listeners and real QUIC/TCP.
- [x] Dedicated bounded cache panel: resident objects/bytes, per-domain effectiveness, TTL/Age/hits, reasons and vhost filters.
- [x] Remove the reserved administrator cookie before cache eligibility; preserve application-cookie privacy.
- [x] Handle empty terminating DATA frames and expose fixed X-Cache-Reason / Cache-Status detail diagnostics.
- [x] Replace special mock-origin hiding with explicit revision controls; keep general header rules.
- [x] Default HTTP/3 for TLS while persisting explicit opt-out and TCP fallbacks.
- [x] Diagnose overlapping sockets with addresses, ownership, protocol/limit differences and remedies.
- [x] Classify unavailable/invalid/timed-out upstreams as 503/502/504 respectively.
- [x] Basic Let's Encrypt DNS-01/RFC2136 job and library-import workflow through Certbot; private TSIG/account state and staging-first consent.
- [x] Offline adapter tests, browser fixtures and Rust regression sources; unchanged brand assets.
- [x] Vhosts-only runtime/UI and one-way legacy import preserving path/backend and IP ownership.
- [x] HTTP-01 active-job/domain-scoped challenge serving with private webroot storage.
- [x] Certbot Cloudflare and OVH API DNS-01 adapters alongside RFC2136.
- [x] Unified provider/import dialog, masked credentials, explicit consent and issuer metadata.
- [x] Dedicated opt-in Prometheus endpoint, scrape CIDRs and environment-token authentication.
- [x] Application/admin/listener/vhost/backend/cache/system collectors and exchange histograms.
- [x] Functional Settings tabs with preserved dirty fields, keyboard navigation and no Security sidebar.
- [x] Offline provider regressions, simulated-API UI checks and unexecuted Rust acceptance tests.
- [ ] Validate real HTTP-01, Cloudflare/OVH/RFC2136 DNS updates, CA issuance, cancellation cleanup and certificate hot-deployment.
- [x] Add the managed renewal scheduler and audited validated deployment source.
- [ ] Verify real renewal/publication and add external expiry alerts, revocation/account lifecycle.
- [ ] Resolve and retain Cargo.lock; run check, test and all real-binary suites.
- [ ] Verify real Tinyauth integration, revocation, trusted forwarding and independent HTTP/3 client interoperability.
- [ ] Run an independent RFC 9114/QUIC conformance suite, malformed-stream/load tests and actual TLS/UDP production deployment checks.
- [ ] Execute vhost isolation/weighted balancing/health/recovery/keepalive/affinity acceptance against a real Rust binary.
- [ ] Verify compression output with independent Brotli/Zstandard decoders.
- [ ] Run real TLS/HTTP2/WebSocket/cache concurrency, cancellation and graceful-drain tests.
- [ ] Benchmark HIT/MISS/streaming RSS and CPU under slow clients and origin failures.
- [ ] Fuzz malformed HTTP/cache directives and language-pack validation.
- [ ] Exercise real non-root 80/443 bindings and systemd service confinement.
- [ ] Verify native browser HTTP/CSP/cookie enforcement (navigation blocked in this environment).
- [ ] Validate the dedicated scrape endpoint/token with a real Prometheus server and production network policy.
- [x] X-Cache-Resident-Age - implemented in 0.9.0

## Optional module follow-ups

### Docker discovery

Implemented in 0.18.1 through the standalone `docker-agent/` provider boundary.
Future work can add provider-side filters, mTLS and DNS-provider automation; the core remains useful without Docker and never opens the Docker socket itself.

### Cache evolution

Conditional revalidation is implemented. Stale-while-revalidate/stale-if-error, request collapsing,
tag-based invalidation and richer per-route policy remain open. Persistent hot/cold storage is implemented in 0.10.0.
Selective invalidation by vhost is implemented in 0.3.0; the domain/object inspector in 0.5.0; tags are not. No VCL engine,
distributed cache, ESI or Varnish-protocol compatibility is implemented.

### Operations

Container/OCI packaging is implemented in 0.10.0. Certificate alerting/revocation and account lifecycle, reproducible releases,
performance baselines and cross-platform diagnostics remain open. Remote HTTPS administration is implemented in 0.9.0;
loopback remains the default and plain remote HTTP remains explicitly risk-gated.