RustProxy/ROADMAP.md

# RustProxy roadmap

## 0.34.0 - Scoped cache correctness and proxy body hot path

- [x] DEV 1 KiB: remove shared HOT store mutex from cache outcome/reason
  accounting; preserve domain cap, exact quiescent totals and reset rules.
- [x] Reserve bounded analytics queue capacity before allocating dropped samples;
  preserve queue-drop accounting and every downstream feature.
- [x] Move per-vhost histogram aggregation to scrape time; retain the same
  cumulative Prometheus and Docker-vhost bucket semantics while one exclusive
  atomic bin is updated per completed exchange.
- [ ] Build/test revised counters source; repeat 1 KiB source A/B and pinned
  nginx benchmark (100k RPS / 80% target still open).

- [x] Share compiled route handles and reuse middleware routing in forwarding;
  avoid exact-host wildcard allocation and full-route cloning.
- [x] Fast-path single-backend LB; share immutable member health settings
  between leases; reduce health locks and fallback/retry header snapshots.
- [x] Convert three exchange metadata locks to atomic tags; avoid unused live
  log clones and add Rust regression fixtures for modified semantics.
- [ ] Compile this hot-path revision, run Rust tests and verify live LB health,
  sticky/session behavior and HTTP/2 graceful shutdown retries.
- [ ] Profile CPU flamegraphs and measure real gains vs 0.33.8/nginx; tune
  idle pool/recycle only as a separately labelled experiment.

- [x] Disconnect keepalive/LB/diagnostic-only vhost saves from cache revisioning.
- [x] Invalidate only a vhost scope when its origin/representation policy changes.
- [x] Persist per-scope COLD fingerprints; old metadata cannot revive after an
  interrupted content update or restart.
- [x] Reduce response-body per-frame backend mutex operations without losing metrics.
- [x] Add Rust regression cases and preserve unchanged LB controls/API.
- [ ] Compile, run the full Rust suites and repeat live HTTP/TLS/H2/H3/WS/LB
  regressions with a compatible Rust toolchain.
- [ ] Run paired 0.33.8 vs 0.34.0 vs nginx benchmarks; record real RPS/p95/p99,
  CPU, RSS, cache retention after saves, and rollback on failed acceptance.
- [x] Implement opt-in Linux HTTP/1.1 `sendfile(2)` and a per-Web-Service
  Delivery toggle, with TLS/H2/H3/range/cache/compression fallback and bounded
  per-connection slots. Implementation is source-only until native tests run.
- [ ] Compile and validate native `sendfile`/fallback functionality and safety
  on the target Linux OS; compare live WWW RPS against nginx.
- [ ] Complete long-running soak, external dependency integration and staged rollout.

## 0.33.8 - Performance with retained functionality

- [x] Reduce cache-disabled request-policy work, header copies, timer allocation
  and request-ID formatting overhead without changing security or telemetry.
- [x] Move live-history cloning and eviction cleanup outside the mutex while
  retaining bounded history, explicit loss counters, live streams and sinks.
- [x] Narrow filesystem job context, borrow pinned root descriptors and bound
  adaptive static-file reads at 64 KiB; preserve range and symlink behavior.
- [x] Correct local HTTP/1 file completion for cache publication and accounting,
  with explicit empty, short-read, cancellation and multipart coverage.
- [x] Reproduce baseline test failures and distinguish real inherited defects
  from obsolete fixtures; correct both without weakening functional contracts.
- [x] Add repeatable live HTTP, verified TLS/H2/H3/WebSocket, nginx comparison,
  resource sampling, syscall profiling and mixed-traffic soak runners. Measured
  outcomes and limits are recorded in `docs/PERFORMANCE_0.33.8.md` and raw evidence.
- [ ] Complete deployment-specific 24-hour soak and remote-network testing with
  actual PHP-FPM, Tinyauth and DNS infrastructure before production rollout.
- [ ] Evaluate further proxy pool/queue costs and a secure static-file sendfile
  path from measured profiles; preserve TLS/H2/H3 and all observability semantics.

## 0.33.7 - named dashboard presets, focused HTML extraction and chart typography

- [x] Apply uniform 12px sentence-case labels to all Overview widgets,
  including Process, RAM cache and backend tiles. Normalize secondary
  captions and small values to monospace without changing other panels.
- [x] Space the two Cache table cards by 10px without altering other sections.
- [x] Reuse the backend quick-view popover for clickable Vhost upstream H1/H2
  protocol details; keep it stable during repeated live status refreshes.
- [x] Keep the clickable Backend and Health fields square, visually matching
  adjacent Vhost tiles under every interface corner style.
- [x] Standardize the full legend text (including every value) at 9px monospace,
  matching Requests per second across desktop, mobile and density modes.
- [x] Add a compact, nonmodal Vhost backend quick-view through both backend
  count and health metric; use existing configuration and status fields, with
  accurate unknown/last HTTP status handling and accessible dismissal.

- [x] Introduce account-scoped, bounded SQLite storage for 16 named Overview
  layout snapshots without changing proxy configuration or existing preferences.
- [x] Replace Arrange Overview modal with save/load/overwrite/rename/delete,
  and factory reset; keep Unlock layout editing intact.
- [x] Extract metrics and charts only into compile-time embedded HTML partials
  without changing existing card DOM order, IDs or polling.
- [x] Standardize chart headings on 12px proportional type (Overview in
  sentence case, all other panels uppercase); use mono for full legends,
  captions and chart data across all chart families.
- [x] Validate SQL migration and run available simulated-browser/JS tests.
- [ ] Build/test Rust and run the new endpoint/UI against a real server with
  representative persisted data. The production acceptance gate remains open.

## 0.33.6 - Stable dashboard chart ranges and plot heights

- [x] Fix all 14 Overview/WWW full-width SVG heights to 125px and align their
  grid lines with the actual drawing range.
- [x] Apply zero-based, unit-specific scale floors to transform/compression,
  rate, connection, latency, memory and WWW series; retain meaningful high
  readings with stepped-up ceilings and no scale collapse on low samples.
- [x] Keep CPU/other percentage sparklines on 0-100% without changing legends.
- [x] Fix full Cache/Transform live charts at 180px and stabilize their rate
  axes, including scope-change resets.
- [x] Test Chromium layout/scaling across 320-1920px and run available UI,
  schema and source tests. Rust runtime acceptance remains pending.

## 0.33.5 - Fixed Overview CPU chart scale

- [x] Set System and process CPU to an absolute 0–100% axis, independent of
  history, while keeping real percentage labels and both plotted series.
- [x] Fix the CPU plot height at 125px regardless of viewport width or
  measured values; leave other chart scales and sizes unchanged.
- [x] Check stable CPU chart geometry, percent mapping, clipping and labels
  in a simulated browser across viewport widths and Dashboard densities.
- [x] Replace the Overview Requests per second LIVE badge with its live maximum
  rate, remove the LIVE TRAFFIC eyebrow and the duplicate peak footer entry.
- [x] Remove Connection Activity's LIVE badge, preserving its metrics.
- [x] Browser-test the two card headings, dynamic peak update and responsive
  placement across viewport widths, dashboard densities and card spans.

## 0.33.4 - Web Server/Vhost live-metric visual parity

- [x] Show per-Web-Service live metrics without expanding a section.
- [x] Reuse Vhost metric tiles and the full-width traffic chart with the same
  desktop/mobile layout, chart styling and theme-aware appearance.
- [x] Preserve counter sampling, PHP fallback, existing translations and the
  existing status feed without new API or persistence state.
- [x] Add simulated Chromium layout, rendering and sampled-status regressions.


## 0.33.3 - Adjustable Overview card widths and cross-type ordering

- [x] Apply Appearance **theme** highlighting and corner radius to sidebar
  navigation, including mobile layout and accessible contrast on light themes;
  keep menu colors independent of the chart palette.
- [x] Test navigation colors in Chromium across 4 themes and 8 chart palettes
  (invariance within each theme), 5 corner settings, hover, mobile and RTL.
- [x] Keep the visual layout editor readable at 320-1920px with stable
  three/two/one-column previews, wrapping controls and no horizontal overflow;
  leave actual dashboard widths and free ordering unchanged.
- [x] Stretch plotted SVG history across the actual card width when resizing,
  including dynamic network-interface plots, without stretching donut charts.
- [x] Allow widths of 2, 3, 4, 6 and 12/12 columns in inline and visual editors;
  keep the smallest text/sparkline cards expandable and add a 4-chart desktop row.
- [x] Allow free card placement across former size groups, including at the
  top of Overview, and reduce unused row gaps with CSS dense packing.
- [x] Preserve legacy grouped layouts until edited, retain saved hidden/order
  preferences, and support cancel, save, modal preview and reset.
- [x] Add browser coverage for real move/size clicks and responsive layouts.

## 0.33.2 - Shared progressbar visual settings

- [x] Apply Appearance corner rounding to native Cache progressbars and
  custom Overview, WWW and traffic bars with matching track/fill shapes.
- [x] Apply the chosen chart color palette to Cache progressbars and other
  progress fills; retain theme-aware tracks, without new API/status work.
- [x] Unify the System Load RAM meter with other Overview progressbars,
  retaining the 5px height and accessible percentage updates.
- [x] Verify live CSS changes with Chromium across corners, chart palettes,
  light/dark themes and mobile/desktop viewport widths.

## 0.33.1 - Factory dashboard preset and inline live preview

- [x] Ship the operator-supplied default ordering, hidden cards and compact density
  in one shared Rust/UI JSON preset; use 600 as the first-use history sample default.
- [x] Keep all existing explicitly saved preferences and restore the factory preset
  only for new accounts or an explicit dashboard reset.
- [x] Honor unsaved inline hide/show changes while backend and Stream status refresh;
  preserve the draft across unrelated preference updates.

## 0.33.0 - Web Server observability (implementation complete; live acceptance pending)

- [x] Add one Overview 60/120/300/600 history selector on the connection-status header row, with temporary changes and explicit browser-persistent choice. Use the same source stream and leave the Cache and Transform selectors independent.
- [x] Match the Web Server metric method visibility to `ResponseKind` (no `private_interfaces` warning).
- [x] Align donut totals beside the ring, preserving the legend and compact tile heights.
- [x] Add opt-in Web Server Overview cards, with all new metrics hidden by default and per-service drilldown.
- [x] Extend Web Server/PHP diagnostics and bounded Prometheus metric families without untrusted labels or additional request-path database calls.
- [x] Extend the packaged Grafana operations dashboard with Web Server/PHP panels and per-service filters.

## 0.32.8 - Overview action alignment (runtime acceptance pending)

- [x] Convert bounded cache RAM/queue/disk, file descriptor, HTTP protocol share and backend capacity cards into meter/progress-bar visuals, with clear unknown-limit behavior.
- [x] Replace cache hit ratio sparklines with compact HIT/MISS donut visualizations and legends.
- [x] Add large transformation/compression four-series live charts and Polish/English labels, preserving existing status sampling and layout/editor preferences.
- [x] Add deterministic UI metric tests and Chromium responsive-layout regression checks.
- [x] Replace mobile three-column Overview actions with natural wrapping: keep the heading at left, actions to the right, without shrinking buttons.
- [x] Remove redundant button-only classes and outdated small-screen overrides while preserving existing common button variants, layout controls and editor handlers.

## 0.32.7 development follow-up: Appearance and H2-close diagnostics

- [x] Use common button sizing for Overview quick actions and Appearance visual editor/show-all; preserve the normal and compact global button styles.
- [x] Strengthen the distinction between Dashboard density levels for tiles, charts and non-table panels without changing grid gutters or preferences.
- [x] Lower only correlated graceful H2 close terminal diagnostics to TRACE; keep 502/access details and uncorrelated cancellations as errors.
- [x] Verify the UI sizes with a simulated Chromium browser at desktop and phone widths.

## 0.32.7 - Mobile Overview and upstream protocol visibility (runtime acceptance pending)

- [x] Share counter-rate pause/resume handling between Cache, Transform,
  Overview, backend, Stream and Vhost plots. Retain historical points after
  backgrounding, skip suspended intervals and restart normal samples after
  one fresh counter baseline, with no new polling.
- [x] Development follow-up: preserve Network diagnostic chart DOM through
  periodic refresh and fix descendant CSS selector minification.
- [x] Feed Process CPU/RSS and per-interface network charts from the cached
  background OS sampler through live status (default 3 s). Leave slow Process
  details on `system_info_seconds` and retain valid 2-s saved preferences; do
  not add per-request probes. Group upstream badges with other Vhost badges
  and match their corner radius while preserving observed protocol colors.
- [x] On phone-size Overview, remove the nested Network interface chart scroll
  region, while retaining chart SVG/text nodes on ordinary live updates.

## 0.32.6

- [x] Reinstate two small Overview cards per row across phone-size widths.
- [x] Apply global corner styles to additional vhost/entity panel surfaces.
- [x] Avoid reparenting already-ordered Overview nodes; retain natural touch
  scroll and stable values/row boundaries during live updates.
- [x] Include last HTTP protocol observed from real proxy upstream responses
  in the authenticated status and each Vhost's per-backend badge. Show unknown
  when no fresh observation exists instead of guessing Auto's ALPN outcome.
- [x] Add simulated mobile Chromium and mocked status UI regressions plus a
  Rust unit regression for protocol-version observation.

## 0.32.5 - Dynamic DNS client ACLs (runtime acceptance pending)

- [x] Preserve CIDR/IP rules and introduce allow-only FQDNs for client ACLs.
- [x] Add bounded A/AAAA periodic resolver, immutable cache, expiration and
  immediate refresh on published configuration changes.
- [x] Add DNS/DDNS editor selector, PL/EN guidance and source/regression tests.

## 0.32.4 - Upstream Host/authority parity and Overview gutters (runtime acceptance pending)

- [x] Remove `preserve_host` H1-only validation and the Auto/H2 UI forced-uncheck.
- [x] Align outgoing H2 authority with selected Host while keeping the origin DNS,
  ACL, TCP destination, TLS SNI and certificate verification independent.
- [x] Update HTTPS-by-IP guidance; preserve opt-in diagnostic H1 preset.
- [x] Make Overview small-to-large row gutter consistent across density modes.
- [x] Add protocol/authority and UI/source contracts; preserve WebSocket isolation.

## 0.32.3 - Backward-compatible upstream modes and Overview Cards registry (runtime acceptance pending)

- [x] Replace ragged custom Overview masonry with symmetric CSS Grid rows grouped by widget footprint. Equal-height peers, traditional gaps, responsive columns and live-content growth are verified in Chromium. Block dragging remains supported inside its size group; group boundaries prevent visually inconsistent mixing. Registry (62), preferences and version stay unchanged.

- [x] Snap manually rearranged Overview columns to common pixel-aligned coordinates and align the bottoms of a tall panel and its stacked short neighbors where bounded distribution allows. Keep factory rows, saved widget IDs/visibility, spacing controls and narrow-screen layout unchanged. Verify with a Chromium fixture, including dynamic height, density and zoom.

- [x] Remove numeric/chart type badges from the Settings → Appearance Overview list, retaining them in the actual visual editor; keep right-aligned controls.
- [x] Open Appearance first unless Settings has a remembered last tab; honor explicit URL tabs and legacy configuration/logging links.
- [x] Decouple roundness from the color palette through a backward-compatible, account-scoped five-preset global `corner_style`. Keep original corners as the default for all four themes; restore coral/green logo marks in Ultra Dark.

- [x] Preserve original symmetric and density-aware Overview rows for the default configuration. When blocks are manually reordered on desktop, keep the same column widths/gutters while allowing multiple natural-height charts to stack next to tall diagnostics; use CSS-layout-pixel row spans for zoom safety and fall back to classic rows on narrow canvases.
- [x] Exclude the RustProxy logo from global corner style overrides. Keep unlocked Overview × Hide and arrow controls consistent under all five presets, without changing color themes or account data.
- [x] Add 6 small and 7 large opt-in time-series views (62 registered blocks total), reusing existing status updates, bounded samples and version 0.32.3. Place block metadata before right-anchored editing controls.

- [x] Preserve legacy `http2`: HTTPS ALPN H2/H1 fallback; HTTP H2C. Add a separate explicit `h2` mode requiring H2 over TLS / H2C over plaintext. Retain H1/Auto and isolate WebSocket clients.
- [x] Retain one safe Auto ALPN negotiation before the first request, without H1 retry after a potentially executed operation.
- [x] Establish a shared JSON registry for Overview IDs/metadata, server validation, ordered visibility settings and compatibility with unknown saved widget IDs.
- [x] Add fourteen opt-in HTTP origin monitoring cards, including request-rate, capacity, 5xx, timeout, network errors, retries, queue pressure and client-pool recycling; reuse existing status counters without extra polling. Retain the original 16 and existing account preferences.
- [x] Add an authenticated Overview modal for draggable visual card ordering, keyboard move, hide/show catalog, draft cancel and a single preferences PUT for Save. Keep existing Appearance controls and defaults.
- [x] Add opt-in AMOLED **Ultra dark** and muted **Warm cream** palettes with translated selectors, login-cache support, server-side preference validation and high-contrast palette checks. Preserve current dark/light themes, default and schema version.
- [x] Let administrators hide/remove visible Overview blocks directly while unlocked, including panels and tables; recover them from a compact hidden-block shelf in the same draft and persist visibility only after Save.
- [x] Add a direct Overview **Unlock layout** mode: drag actual blocks by dedicated grips, move with arrows, cancel without persisting, and save+lock in one request. Classify and label all 49 blocks by display type, including mixed number+chart cards, with a hidden-block type filter.
- [x] Expand to a shared 49-block Overview grid (30 prior widgets, 12 new opt-in charts and seven original full-size sections). Add visual default-layout preview, confirmed reset and account preference compatibility without new metrics probes or API routes.
- [x] Verify ALPN is already negotiated on connection establishment, then reused by Hyper per-backend pooling. Retain age/request-count generation rotation and new-connection negotiation rather than introduce a global H2/H1 cache or unsafe protocol-retry probe.
- [x] Present all four modes with clear HTTPS ALPN versus h2c semantics, keeping persisted `http2` records valid with unchanged meaning.
- [x] Add source/JS checks and Rust tests for strict ALPN, old TLS H1 fallback, H2C, WebSocket isolation and widget preferences.
- [x] Resolve the 0.32.2 HTTPS `http2` compatibility regression with a new serialized strict `h2` mode rather than a silent migration.

## 0.32.2 - Web Server conditional cache revalidation (runtime acceptance pending)

- [x] Reuse local Web Server `ETag` / `Last-Modified` revalidation candidates for forced browser refresh and stale/freshness-constrained requests, keeping hit counts and cache bodies on `304`.
- [x] Preserve client conditional semantics, HEAD, range, response policy and transformed representations; invalidate superseded objects.
- [x] Add Rust regression cases and source-only checks.

## 0.32.1 - Dashboard Overview typography and tile height (runtime acceptance pending)

- Restore content-driven heights for desktop Overview tiles (six columns) seen in 0.31.9, removing 0.32.0's fixed-height whitespace at 90% scale.
- Increase compact Dashboard headings, values and secondary descriptions, including the fixed-size Payload legend. Align tile gaps with the same `--ui-gap` as other dashboard blocks for all dashboard density settings.
- Keep opt-in Streams, all responsive breakpoints and chart legends visible inline. Add layout-regression checks. No proxy or persistence changes. Rust/Cargo and authenticated-UI runtime acceptance are still outstanding.

## 0.32.0 - Stream backend pools and opt-in Dashboard cards (runtime acceptance pending)

- [x] Extend legacy TCP/UDP upstream with an optional validated backend pool, Round Robin/Least Sessions, session pinning, and bounded concurrency.
- [x] Add bounded TCP Connect / verified UDP Probe health monitoring with rise/fall hysteresis.
- [x] Add opt-in, bounded backend metrics and reuse the existing Prometheus stream gate and API status.
- [x] Add four translated opt-in Dashboard cards through existing Appearance preferences and common status refresh.

## 0.31.9 - Certificate API credential management (runtime acceptance pending)

- [x] Inspect individual saved Certificate API credential metadata without reading its bearer secret.
- [x] Edit comment, explicit certificate allowlist and deploy grant independently of token rotation.
- [x] Regenerate only a selected credential's token while keeping Key ID, comment and grants, invalidating the old secret and showing the replacement only once.
- [x] Preserve existing scopes, administrator-only access, audit trail, schema 9 and backwards-compatible creation/revocation endpoints.
- [ ] Compile and execute Rust regression tests with Rust 1.99+; verify end-to-end panel flows on a real server before production acceptance.

## 0.31.8 - Stored Logs sorting, built-in pages and allocation reduction (runtime acceptance pending)

- [x] Consolidate 28 numbered Rust test fragments into seven large `tests.rs` files; exempt test sources from the 500-line production limit and remove obsolete fragment paths.
- [x] Sort Stored Logs across the bounded server-side scan before pagination, including dynamic columns and durable account preferences.
- [x] Complete the built-in status response pages in the existing visual style, including 200 OK.
- [x] Pack GeoIP IPv6 records and remove unused CSV Vec capacity without changing lookup results.
- [x] Add bounded zero-copy transformed-cache fill where exclusive ownership and exact allocation capacity are available.
- [x] Correct Docker VHosts post-restart pending/failed status, first-read synchronization and TLS pin indicator, without changing poll/TLS/SQLite protocols.

## 0.31.7 - UA-specific throttling and managed update housekeeping (runtime acceptance pending)

- [x] Group global UA blocking, headers and response controls in a tabbed Settings page.
- [x] Add per-vhost UA rate-limit overrides with separate bounded counters.
- [x] Show leaf-level revision diffs, with optional full JSON comparison dialog.
- [x] Space apart listener protocol buttons and collapse ACL attachments by default.
- [x] Fix release retention path deletion; preserve two releases; limit Cargo cleanup to expired incremental state.
- [x] Verify update marker and forced HOT→COLD shutdown code path, and add completion logging.
- [ ] Compile and test with Rust/Cargo; run real update/rollback and browser/UI tests on a controlled host.

## 0.31.6 - H3 iOS navigation hardening (runtime acceptance pending)

- Finish live Safari/Chrome iPhone logo-navigation and repeated-refresh acceptance over H3 after Rust compilation.
- Collect matching `http3_*` diagnostic records and navigation/asset response records; verify the new top-level GET is not interrupted when old SSE/API streams cancel.

## 0.31.5 - User-Agent blocking and consolidated log analysis

- [x] Add bounded global and per-vhost User-Agent blocklists and enforce them before upstream contact.
- [x] Add one-click copy for Traffic values used during investigation.
- [x] Add repeated-value aggregation for arbitrary parsed Stored Logs fields.
- [x] Consolidate active and rotated gzip per-vhost logs into one logical source on demand.
- [x] Update OpenAPI, translations, documentation and Rust-independent regression checks.

## 0.31.4 - Administration-only public HTTPS Origin with one-field configuration

- [x] Add explicit HTTPS `administration.public_origin` and restrict its use to trusted reverse-proxy peers for panel requests.
- [x] Derive the pinned DNS hostname for the effective Host allowlist without duplicating it in saved `allowed_hosts`.
- [x] Keep additional allowed DNS hostnames in an advanced panel field and remove redundant legacy duplicates on edit/save.
- [x] Preserve strict Origin, CSRF, trusted proxy, forwarded Host and HTTPS-first header checks and the opt-in self-admin session-cookie boundary.
- [x] Add panel settings UI, translations, API schema, Rust source regressions and Node simulations without changing public proxy forwarding.

## 0.31.3 - Mobile session recovery and Origin diagnostics

- [x] Reproduce the overlapping resume-session checks, reload-loop marker reset and early SSE restart using the 0.31.2 source in a deterministic JavaScript simulation.
- [x] Coalesce page visibility/BFCache session verification, defer background requests until revalidated and offer a visible retry on failure without weakening Origin enforcement.
- [x] Display a safe 403 HTML message for invalid-Origin dashboard navigation and provide credential-redacted rejection diagnostics.

## 0.31.2 - Dependency updates

- [x] Prepare stable dependency-family and code API migrations, preserving existing wire/configuration/SQLite formats.

## 0.31.1 - Mobile panel loading stability

- [x] Load dashboard modules as one ordered JavaScript resource and wait for document/module readiness before session initialization.
- [x] Version dashboard JS/CSS requests; show a recoverable startup error on missing modules.

## 0.31.0 - Panel refresh orchestration

- [x] Centralize authenticated polling with source IDs, view lifecycle, hidden-tab pause, abort, in-flight protection and cleanup.
- [x] Separate compact live telemetry from infrequent cached system diagnostics; allow per-client SSE pacing and reconnect-only fallback.
- [x] Add per-account refresh preferences, reset/manual actions, language packs, endpoint contracts and regression tests.

## 0.30.1 - Protocol legend and system information

- [x] Color the H1/H2/H3 legend dots consistently with their themed chart strokes.
- [x] Remove ACME/Python runtime details from About and provide a read-only System information settings tab.
- [x] Read available ACME Python/pip/Certbot version metadata and OS/hardware/process details with existing libraries, without subprocesses for information gathering or new configuration fields.

## 0.30.0 - Per-backend Health editor and logging resource review

- [x] Provide an intuitive Health-tab backend selector restricted to monitored members, with independently editable TCP/HTTP policies.
- [x] Deduplicate file/Logstash JSONL serialization; cap Stored Logs directory scan retention during enumeration; review long-lived queues and other memory-heavy facilities.
- [x] Preserve vhost wire schema, SQLite schema 9 and Cold Cache format 3.

## 0.29.7 - Backend health scoping, PHP-FPM isolation and HIT-only cache diagnostics

- [x] Support per-backend active/passive health monitoring disablement and independent health-check settings.
- [x] Expose optional global and vhost-level cache HIT-only diagnostic headers.
- [x] Identify unsafe PHP-FPM shared-socket directive differences and document dedicated pool migration for Roundcube/WordPress.
- [x] Preserve existing settings and schema 9/Cold format 3.


## 0.29.6 - FastCGI compression EOF and diagnostic routing

- [x] Fuse FastCGI response streams so compressors may safely probe the end of a PHP-FPM response multiple times.
- [x] Route WARN/ERROR diagnostics and panic-hook events to the configured error file, or stderr when the file is disabled/unavailable.
- [x] Add source tests for repeated EOF polling, gzip output, and live error-log settings changes.
- [x] Retain schema 9, Cold Cache format 3 and 0.29.x saved-configuration compatibility.

## 0.29.5 - Roundcube PHP PATH_INFO routing

- Resolve PHP `PATH_INFO` on an existing script before `try_files` falls back to the front controller, while preserving normal URL and script security checks.
- Verify FastCGI parameters from an actual mock PHP-FPM exchange in Rust integration tests when Cargo is available.
- Retain schema 9, Cold Cache format 3 and all previous PHP-FPM profile UI and vhost-cache behavior.

## 0.29.4 - Shared PHP-FPM profiles and local Web Server processing

Current direction: 0.29.3 -> 0.29.4

- [x] Add reusable PHP-FPM profiles attachable to individual Web Services, keeping their local settings on detach.
- [x] Apply RustProxy cache and response transformations for Web Server files and PHP-FPM responses.
- [x] Supply FastCGI `HTTP_HOST` from request authority for HTTP/2 and HTTP/3 WordPress requests.
- [x] Add source/UI regression coverage for new configuration and response behavior.
- [x] Keep SQLite schema 9 and Cold Cache format 3 unchanged.

## 0.29.3 - HTTP/2 and HTTP/3 internal fallback stabilization

Current direction: 0.29.2 -> 0.29.3

- [x] Allow empty GET/HEAD bodies with unknown length hints to enter the internal error fallback path.
- [x] Preserve the final internal fallback response, including the fallback backend's HTML on HTTP 404.
- [x] Add Rust regression tests for fallback dispatch, request-body safety and error-page precedence.
- [x] Preserve SQLite schema 9 and Cold Cache format 3 without configuration migrations.

## 0.29.2 - PHP-FPM operator controls and observability

- [x] Add bounded, operator-only PHP_ADMIN_VALUE INI overrides per Web Service.
- [x] Show admin overrides in the Web Service UI/API, reusing existing location-to-service routing.
- [x] Track PHP responses by status class, response-header latency and free concurrency slots in Prometheus.

## 0.29.1 - Internal error routing, multipart ranges and PHP PATH_INFO

Current direction: 0.29.0 -> 0.29.1

- [x] Add configurable internal error fallbacks for the main vhost source and Custom locations.
- [x] Preserve original method, URI, query string and request context during internal fallback dispatch.
- [x] Reject fallback cycles at validation time and cap runtime fallback depth.
- [x] Intercept configured errors before final response/cache handling and run the target through normal route processing.
- [x] Add bounded Prometheus counters for triggered, successful and failed error fallbacks.
- [x] Support fixed fallback status codes 403/404/500/502/503/504.
- [x] Add streaming multipart byte-range responses with a bounded range count.
- [x] Add opt-in secure PHP PATH_INFO splitting for PHP-FPM.
- [x] Keep SQLite schema 9 and Cold Cache format 3 unchanged.

## 0.29.0 - Redirect, health-host, forced-cache and rotated-log controls

Current direction: 0.28.2 -> 0.29.0

- [x] Add one-checkbox canonical www/non-www redirects per vhost.
- [x] Add first-class Custom location redirects with capture-based rewrite targets and query preservation.
- [x] Default HTTP health-check Host to the first exact vhost hostname while keeping the manual field as an override.
- [x] Add explicit per-vhost forced-cache targets with response privacy protections retained.
- [x] Read bounded logrotate gzip rotations in Stored Logs.
- [x] Verify local/static HTML pages can intentionally return statuses such as 503.
- [x] Preserve valid nested URL query parameters while retaining ambiguous-backslash rejection.
- [x] Keep SQLite schema 9 and Cold Cache format 3 unchanged.

## 0.28.2 - External certificate hardening and least-privilege reload API

Current direction: 0.28.1 -> 0.28.2

- [x] Accept POSIX ACL-based read access for external certificate keys without requiring one exact chmod value.
- [x] Reject unsafe world-readable private keys, group/world-writable external PEMs and untrusted/writable external-path parent directories.
- [x] Validate both configured Certbot `live/` paths and their resolved `archive/` targets while keeping hot reload behavior.
- [x] Scope Certificate API credentials to explicit certificate IDs, default new tokens to reload-only, block global reload for tokens and make deploy an explicit permission.
- [x] Migrate existing Certificate API credentials to reload-only compatibility grants and move SQLite to schema 9.
- [x] Document read-only systemd access plus POSIX ACL examples for `/etc/letsencrypt` and `/etc/ssl` in English and Polish.
- [x] Keep the saved proxy configuration format and COLD format 3 unchanged.

## 0.28.1 - External certificate paths and certificate-source clarity

Current direction: 0.28.0 -> 0.28.1

- [x] Allow manual certificate entries to reference an absolute external certificate path and absolute external private-key path.
- [x] Resolve Certbot-style `live/` symlinks on every reload while preserving bounded PEM parsing, regular-file checks and private-key permission checks.
- [x] Keep targeted certificate reload revision-stable so renewal wrappers can call `POST /api/certificates/{certificate_id}/reload` after renewing external files.
- [x] Preserve managed `<data-dir>/certs` filenames and reject mixed managed/external pairs.
- [x] Exclude external certificate material from RustProxy backups while retaining the configured absolute paths.
- [x] Clarify certificate-source, storage and path expectations in English/Polish UI text and operator documentation.
- [x] Keep SQLite schema 8 and COLD format 3 unchanged.

## 0.28.0 - GeoIP control, listener clarity and cache policy refinement

Current direction: 0.27.3 -> 0.28.0

- [x] Add on-demand GeoIP refresh through the authenticated administration UI and reuse the automatic updater pipeline.
- [x] Hot-swap validated GeoIP databases so subsequent country ACL/rate-limit/logging lookups use the new data without a process restart.
- [x] Use direct GeoIP file URLs with optional per-file SHA-256 verification and support either separate IPv4/IPv6 CSV ranges or one native MaxMind MMDB database.
- [x] Present active listeners as readable HTTP/HTTPS endpoint cards with explicit H3/UDP state.
- [x] Add configurable `Via: RustProxy` cache response metadata while preserving upstream Via values.
- [x] Preserve cache objects across bypass and response-only diagnostic/Via setting changes.
- [x] Separate vhost Security header-rule Delete controls from the Operation selector.
- [x] Keep SQLite schema 8 and COLD format 3 unchanged.

## 0.27.3 - HTTP/3 cache parity and bounded memory retention

Current direction: 0.27.2 -> 0.27.3

- [x] Make body-less `HEAD` cache eligibility consistent between HTTP/2 and HTTP/3.
- [x] Reduce persistent COLD-index RAM while preserving the existing on-disk cache format and cache behavior.
- [x] Reclaim expired rate-limit client buckets and avoid duplicating the vhost name for every tracked IP.
- [x] Confirm downstream compression remains streaming and does not retain complete response bodies in memory.
- [x] Exclude rebuildable managed Certbot Python environments from backups.
- [x] Document DEB/RPM and OPNsense repositories as the official installation paths; keep Debian source builds optional.
- [x] Separate application-coupled scripts from QA/dev/audit tooling and external platform integrations while preserving all entry points.
- [x] Keep SQLite schema 8 and saved configuration compatibility with 0.27.2.

## 0.27.2 - Managed ACME renewal repair

Current direction: 0.27.1 -> 0.27.2

- Make the managed Certbot runtime independent of pip console-script shebang relocation.
- Reuse existing 0.27.1 `acme-python` environments without operator cleanup.
- Preserve the system Certbot fallback and schema/config compatibility.

## 0.27.1 - Portable certificate runtime and list sorting

Current direction: 0.27.0 -> 0.27.1

- [x] Show complete default and standard-service setup-token commands during first-administrator onboarding.
- [x] Initialize the Certbot Python environment under the RustProxy data directory with app-owned `venv`/`pip` state and a local `virtualenv` bootstrap when stdlib `venv` is unavailable.
- [x] Fall back to distribution Certbot binaries when usable and report missing Python/pip or setup failures in the Certificates panel.
- [x] Add account-scoped column + direction sorting for vhosts, Docker vhosts, redirects, 404 hosts and streams; keep Redirects/404 toolbar placement identical to Vhosts.
- [x] Use the installed production binary in the Certbot hook example and expose official source/package repository links plus Python/pip/Certbot runtime state in application information.
- [x] Keep SQLite schema 8 and additive/defaulted administrator-preference compatibility.

## 0.27.0 - Compression policy and persistent Docker publications

Current direction: 0.26.7 -> 0.27.0

- [x] Enable zstd/Brotli/gzip downstream compression by default, keep deflate opt-in, honor client q-values and use deterministic `zstd -> br -> gzip -> deflate` tie priority.
- [x] Allow authenticated/cookie/private/no-store responses to compress while retaining explicit no-transform/range/SSE/upgrade/existing-encoding exclusions.
- [x] Add inherited dynamic-compression overrides and per-scope codec filters for ordinary vhosts and Web Server services under the global codec ceiling; keep Docker publications intentionally simple with one Compression on/off checkbox using the global codec set.
- [x] Default fresh installations to `Server: RustProxy` without rewriting existing saved policies.
- [x] Remove Debian package-build metadata from this source tree; packaging is maintained separately at `rustproxy.linuxiarz.pl`.
- [x] Keep published Docker hostnames materialized while a service is missing, return 503 until it returns, and reuse last-known inventory during temporary agent communication failures.
- [x] Render cache occupancy progress fill consistently across Chromium/WebKit and Firefox.
- [x] Keep SQLite schema 8 and additive/defaulted saved configuration compatibility with 0.26.x.

## 0.26.7 - Cache occupancy and backend rotation continuity

Current direction: 0.26.6 -> 0.26.7

- [x] Show HOT/COLD cache occupancy progress against configured entry and byte limits on `/cache`.
- [x] Preserve compatible upstream client generations across unrelated runtime snapshot rebuilds so rotation age/counters remain continuous.
- [x] Keep request-count and age-based backend client recycling covered by tests and visible diagnostics.
- [x] Refresh container documentation and include all supported Certbot DNS plugins in the shipped OCI image.
- [x] Review current installation/cache/backend lifecycle documentation for stale behavior statements.
- [x] Keep existing 0.26.6 custom `Age` rules loadable while isolating response-side Age overrides from cache freshness/storage semantics.
- [x] Keep SQLite schema 8 and saved proxy configuration compatibility with 0.26.6.

## 0.26.6 - Access-policy composition and administration fixes

Current direction: 0.26.5 -> 0.26.6

- [x] Keep backend table visible columns, sort key and sort direction synchronized with account-scoped user preferences.
- [x] Clear the certificate-issuance form after the ACME issuance job succeeds while preserving non-secret values after failed jobs.
- [x] Document the sibling Python modules required by `scripts/migration/migrate_npm.py` and fix the container helper example.
- [x] Treat explicit IP allows and allow-only countries as alternative allow sources inside one ACL policy scope, with explicit denies taking precedence and separate scopes remaining cumulative.
- [x] Keep SQLite schema 8 and saved proxy configuration compatibility with 0.26.5.

## 0.26.5 - Scaled controls and listener navigation

Current direction: 0.26.4 -> 0.26.5

- [x] Keep compact toolbar selects and inputs on the same interface-scaled control height.
- [x] Reuse the interface-scale field variables for ordinary form controls so inputs/selects resize consistently with the UI scale setting.
- [x] Route the Streams **Add TCP/UDP listener** shortcut to Settings -> Listeners instead of opening a Stream editor.
- [x] Keep SQLite schema 8 and saved proxy configuration compatibility with 0.26.4.

## 0.26.4 - Administration consistency and backend rotation reliability

Current direction: 0.26.3 -> 0.26.4

- [x] Add 404-host forms to the session-only draft workflow.
- [x] Complete Polish translations for the Button style appearance setting.
- [x] Align toolbar search/filter input height with the active button style.
- [x] Reuse the vhost Enabled control styling in 404 hosts, Redirects and Streams.
- [x] Replace the Overview-card checkbox list with compact visibility/reorder tiles.
- [x] Run age-based backend client recycling independently of request arrival.
- [x] Keep SQLite schema 8 and saved proxy configuration compatibility with 0.26.3.

## 0.26.3 - Administration appearance and draft workflow polish

Current direction: 0.26.2 -> 0.26.3

- [x] Make interface scaling global across navigation, workspace, dialogs, overlays and the draft dock; extend the range to 70-125% and make form-control sizing respond more visibly across that range.
- [x] Make Overview telemetry cards denser without changing responsive breakpoints.
- [x] Expand chart themes to eight full-palette presets affecting colors, surfaces, grid and line treatment.
- [x] Restyle the draft dock as a square-corner RustProxy panel without rounded/glass styling.
- [x] Add a collapse-to-bar state and per-draft age indicator to the session-only draft dock.
- [x] Add Settings search without rebuilding forms, preserving unsaved values while categories are filtered.
- [x] Add chart-style palette previews beside the eight chart presets.
- [x] Add independent Normal/Compact/Ultra table-log density and Overview dashboard density preferences.
- [x] Add per-account Overview card visibility and ordering controls.
- [x] Add per-section Appearance resets plus a full Appearance reset while keeping unrelated account preferences intact.
- [x] Add an account-scoped Normal/Compact button-style selector, with Compact matching the smaller source-style control dimensions independently from global scale, including generated vhost actions and modal tabs.
- [x] Retain sticky Settings category navigation and unsaved-category indicators.
- [x] Keep SQLite schema 8 and saved proxy configuration compatibility with 0.26.2.

## 0.26.2 - Unified logs search and dynamic fields

Completed direction: 0.26.1 -> 0.26.2

- [x] Add independent in-session editor drafts for Web Server, Vhosts, Redirects and Streams, with minimize/restore/discard actions in a bottom-right dock.
- [x] Consolidate theme/language/display controls under **Settings -> Appearance**, replace density modes with an interface-scale slider and persist appearance choices in administrator preferences.
- [x] Add 12/24-hour timestamp formatting, chart presentation presets and a denser expanded Stored Logs record view.

- [x] Merge Stored Logs and Live Logs into one top-bar Logs menu.
- [x] Replace fixed Stored Logs filters with one bounded field-query syntax supporting AND, negation, quotes, wildcards and numeric comparisons.
- [x] Discover selectable Stored Logs columns from parsed record fields and keep arbitrary safe field choices in account preferences.
- [x] Parse the built-in RAW error-log line format into basic structured fields while retaining the raw record.
- [x] Remove the configured-file inventory/source selector from the Logs workspace and keep bounded all-source scanning by default.
- [x] Move Stored Logs column configuration to the table toolbar and use arrow symbols for backend sort direction.

## 0.26.1 - Vhost-aware protocol diagnostics and Logs Explorer UX

Current direction: 0.26.0 -> 0.26.1

- Attribute persistent protocol errors through one shared vhost resolver using routed vhost, authority/Host and SNI in that order.
- Keep unresolved traffic in `_unmatched.jsonl` and keep low-level protocol errors out of Live Logs.
- Add bounded protocol diagnostic identity fields for Stored Logs filtering and inspection.
- Add selectable Stored Logs columns, sticky headers, highlighted selection and inline details.
- Hide configured-file inventory by default and repair mapped client-IP/search behavior.
- Preserve schema 8 and the existing saved proxy configuration format.

## 0.26.0 - Persistent protocol diagnostics and stored-log explorer

Completed direction: 0.25.7 -> 0.26.0

- [x] Persist malformed HTTP, TLS/QUIC handshake failures, HTTP/2/HTTP/3 protocol failures, invalid h2c attempts and connection-limit rejects through the existing bounded logging sink.
- [x] Keep low-level protocol failures out of the Live Logs memory ring so hostile scans cannot displace ordinary live request history.
- [x] Add a local read-only **Logs** explorer with bounded server-side filtering and pagination over configured access/error files.
- [x] Prevent arbitrary-path browsing and symlink following; enumerate only paths derived from active RustProxy logging configuration.
- [x] Add `/logs` dashboard navigation plus a Logging-settings launcher while retaining the existing Live Logs dialog unchanged.
- [x] Keep schema 8 and configuration compatibility with 0.25.7.

## 0.25.7 - Vhost operations and backend observability

Current direction: 0.25.6 -> 0.25.7

- [x] Add a fast vhost enable/disable action to the vhost cards using the existing revisioned save path.
- [x] Add backend-table search, sorting and account-scoped persisted column visibility preferences to the main dashboard.
- [x] Style scrollbars for dark and light dashboard themes.
- [x] Export retry and upstream-client lifecycle metrics for ordinary and Docker backends.
- [x] Add Grafana panels for backend client generation, age, retry activity and rotations.
- [x] Make the vhost editor Enabled control visually distinct from ordinary settings.

## 0.25.6 - Backend memory diagnostics visibility

Current direction: 0.25.5 -> 0.25.6

- [x] Show upstream client generation, current-generation request count, generation age and total rotations in the main Backends diagnostics table.
- [x] Reuse the existing `/api/events` status snapshot refresh path; do not add a second diagnostics polling loop.
- [x] Keep the 0.25.5 client-generation recycling defaults and configuration compatibility unchanged.

## 0.25.5 - Traffic country consistency and Revision History styling

Current direction: 0.25.4 -> 0.25.5

- [x] Use trusted `CF-IPCountry` when verified Cloudflare client-IP mode is active, with local GeoIP fallback for missing/invalid country headers.
- [x] Keep country analytics, retained country logging and country policy evaluation on the same verified country source.
- [x] Align the Revision History dialog with the shared square-corner modal styling and remove duplicated history-only dialog CSS.
- [x] Add Cloudflare-country trust regression coverage and release/source-contract checks.
- [x] Extend Prometheus with a live Traffic analytics collector, fixed-cardinality User-Agent/method/source families, country/top-route views and built-in Web Server inventory/source metrics.
- [x] Extend the bundled Grafana dashboard with a Traffic vhost filter, Web Server request rate, countries, User-Agent families, serving sources, methods, status classes, cache outcomes, capture-state gauges and configured routes.
- [x] Bound backend Hyper client lifetime with configurable request/age recycling and an upstream HTTP/1 buffer ceiling so sustained traffic can release pool/TLS high-water allocations without a vhost save.

## 0.25.4 - Configuration history restore

Current direction: 0.25.3 -> 0.25.4

- [x] Restore an older retained configuration through the normal validation and hot-publish path.
- [x] Save restore as a new revision without deleting or rewinding existing history.
- [x] Require current-revision CAS plus administrator session/CSRF and audit restore source/new revision.
- [x] Add restore action and confirmation to the existing revision-history modal.

## 0.25.3 - Request policy, correlation and configuration history

Current direction: 0.25.2 -> 0.25.3

- [x] Add per-vhost HTTP method allow/block policy.
- [x] Add per-location HTTP method policy, reusable ACL profile, inline IP ACL and country allow/block policy.
- [x] Enforce host and location policies before upstream selection/connection.
- [x] Generate one SHA-256 request ID per exchange and forward it unchanged to the backend as `X-Request-ID`.
- [x] Persist bounded manual-configuration revision history in SQLite schema 8.
- [x] Add a calendar/day revision-history modal with change preview in the existing dashboard style.

## 0.25.2 - Live backup and resumed-session hardening

Current direction: 0.25.1 -> 0.25.2

- [x] Allow encrypted full-backup creation while RustProxy owns the data-directory process lock.
- [x] Snapshot SQLite consistently and stage durable files before archive encryption.
- [x] Preserve only validated relative symlinks that resolve inside the staged data tree, including Certbot `live` -> `archive` links.
- [x] Keep restore offline, validated, staged and atomically activated.
- [x] Recover transient invalid-origin state in restored/resumed admin tabs with a one-shot same-origin reload, without weakening server Host/Origin/CSRF checks.

## 0.25.1 - Traffic UX and source modularization

Current direction: 0.25.0 -> 0.25.1

- [x] Split Traffic into Overview, Clients, Requests and Delivery sub-tabs.
- [x] Chart every bounded Traffic dimension with donut or horizontal bar visualizations suited to the data shape.
- [x] Keep every Rust source file at or below 500 lines and keep unit tests outside implementation files.
- [x] Split oversized dashboard source bundles and the Docker Agent into bounded source modules while preserving behavior and URLs.
- [x] Guard the Web Server split against dangling attributes and missing `htaccess`, `server_protocol` and `anyhow::Context` imports.

## 0.25.0 - Web Server foundation

Current direction: 0.24.10 -> 0.25.0

- [x] Add independent reusable Web Service configuration with name, document root, index list and directory-listing switch.
- [x] Add Web Service CRUD through the dashboard/API and persist it through the existing revisioned configuration store.
- [x] Add `Reverse Proxy` / `Web Server` source selection to vhost fallback and custom locations without storing Web Server filesystem settings in vhosts.
- [x] Allow one Web Service to be referenced by multiple vhosts and one vhost to mix Web Server and Reverse Proxy locations.
- [x] Add `GET`, `HEAD`, MIME, `Content-Length`, streaming, index lookup, directory slash redirect and optional directory listing.
- [x] Add repeatable per-request directory listing, per-directory index-before-listing behavior, Web Service MIME overrides/default MIME and a default static `Cache-Control` policy.
- [x] Organize Web Service editing into General, Routing, MIME, Cache & headers, Delivery, PHP-FPM and Security tabs.
- [x] Add Web Service `try_files`, internal/redirect regex rewrites, ordered per-extension/MIME Cache-Control rules, fixed response headers, precompressed `.br`/`.gz` delivery and forced-download extensions.
- [x] Add bounded FastCGI/PHP-FPM execution over Unix sockets or loopback TCP with `index.php`/front-controller routing and no source fallback on upstream failure; expose advanced bounded limits, Authorization forwarding, custom FastCGI parameters and controlled `PHP_VALUE` overrides with in-panel syntax documentation.
- [x] Add explicit symlink policy: deny by default, with Linux-only inside-root following for static files; PHP-FPM remains restricted to deny.
- [x] Add a bounded `.htaccess` compatibility layer for common Apache migration rules, including rewrite conditions/rules, directory index/listing, MIME, headers, Expires and PHP AddHandler integration, with a dashboard documentation modal and fail-closed security-sensitive directives.
- [x] Add one-shot Web Service presets for Static, SPA, PHP generic, WordPress, Drupal, Laravel, Symfony, Joomla, PrestaShop and Downloads, with optional deterministic hardening for common exploit probes/sensitive paths and fingerprint-header stripping.
- [x] Expose vhost-wide request/active/error/EWMA/traffic metrics for Web Server-only vhosts and fix custom logging mappings for route/cache/transform effective fields.
- [x] Add bounded per-vhost Traffic analytics, User-Agent logging and opt-in country/GeoIP logging with top-dimension views, effective-client-IP rankings and donut charts for the main dimensions.
- [x] Keep Web Service dashboard rendering stable when configuration loads before the deferred Web Server UI module and use the existing generic/custom 403 error-page pipeline when directory listing is disabled.
- [x] Add automatic allocator release and idle HOT-cache waterline trimming so sustained traffic does not require a vhost save/reload to return reclaimable RSS.
- [x] Add metadata-based `ETag`/`Last-Modified`, conditional `304`, single `Range`/`If-Range`, `206` and `416`.
- [x] Enforce decoded-path validation and document-root confinement; Unix traversal uses `openat` + `O_NOFOLLOW` and does not serve symlinks.
- [x] Keep Web Server inside the existing routing, ACL/auth, custom-header/error-page/security and H1/H2/H3 response pipeline; do not create separate routing/error/cache subsystems.
- [x] Add unit/source-contract coverage, OpenAPI/UI language coverage and Web Server documentation.
- [x] Clean README/Docs/CHANGELOG/ROADMAP material, add a canonical docs index, authenticated Markdown Reader, 0.25 specification audit and open-work TODO.
- [ ] Run compiler-enabled `./dev.sh fmt`, `./dev.sh check`, `./dev.sh test` plus live H1/H2/H3/static-file acceptance on the release host.

## Web Server follow-up

Future Web Server work must retain the 0.25 split between reusable **Web Service** configuration and vhost/location source selection.

- Multipart byte ranges if operational demand justifies them.
- Named locations without introducing a second URL router.
- Opt-in PHP `PATH_INFO` script/path splitting with an unambiguous confinement rule.
- Race-resistant filesystem confinement for non-Unix targets before enabling local file serving there.
- Real PHP-FPM release-host acceptance over Unix socket and loopback TCP.

See [`docs/TODO.md`](docs/TODO.md) for unresolved work and release acceptance, and [`docs/ROADMAP_HISTORY.md`](docs/ROADMAP_HISTORY.md) for completed historical milestones.