release: develop → beta for 7.0.4-beta

.github/workflows/deploy-website.yml

@@ -58,6 +58,10 @@ jobs:
           mkdir -p website/.vitepress/dist/api
           if [ -d docs/api ]; then
             cp -a docs/api/. website/.vitepress/dist/api/
+            # DocFX has toc.html but no index; /api/ 404s without this.
+            if [ -f website/.vitepress/dist/api/toc.html ] && [ ! -f website/.vitepress/dist/api/index.html ]; then
+              cp -f website/.vitepress/dist/api/toc.html website/.vitepress/dist/api/index.html
+            fi
             # DocFX HTML references ../styles and ../fonts from /api/*.html
             if [ -d docs/styles ]; then
               cp -a docs/styles website/.vitepress/dist/styles
@@ -76,13 +80,18 @@ jobs:
             echo "Warning: docs/api missing; API pages will not be published"
           fi
 
-      # GitHub Pages + VitePress cleanUrls: /download sometimes keeps a stale
-      # object while /download.html updates. Publish both shapes so the nav link works.
+      # GitHub Pages cleanUrls: keep BOTH `page.html` and `page/index.html`.
+      # Deleting the sibling `.html` forces `/page` (no slash) through a Pages 301
+      # that rewrites the host to `*.github.io` when the custom-domain CNAME is not
+      # fully active on the edge (CloudFront → GitHub). That is what made
+      # titaniumproxy.com/download bounce to github.io.
       - name: Mirror cleanUrls HTML as index.html
         shell: bash
         run: |
           set -euo pipefail
           dist=website/.vitepress/dist
+          # Do NOT write a Pages CNAME: titaniumproxy.com DNS points at CloudFront,
+          # not GitHub. A Pages custom domain causes http↔https redirect loops.
           for f in "$dist"/*.html; do
             base="$(basename "$f" .html)"
             [[ "$base" == "index" || "$base" == "404" ]] && continue
@@ -106,13 +115,13 @@ jobs:
           path: website/.vitepress/dist
 
   deploy:
+    # Push deploys only from develop (Pages env protection). Manual workflow_dispatch
+    # may publish from a fix branch to clear a bad artifact urgently.
     if: >
       github.event_name != 'pull_request' && (
         github.ref == 'refs/heads/develop' ||
-        github.ref == 'refs/heads/beta' ||
-        github.ref == 'refs/heads/stable' ||
-        github.event_name == 'release' ||
-        github.event_name == 'workflow_dispatch'
+        github.event_name == 'workflow_dispatch' ||
+        (github.event_name == 'release' && startsWith(github.event.release.tag_name, 'v'))
       )
     needs: build
     runs-on: ubuntu-latest

.github/workflows/dotnetcore.yml

@@ -152,7 +152,7 @@ jobs:
         pull: '--rebase --autostash'
 
   # Cross-OS Inspector + Plus dashboard UI gates (Headless / Visual / Playwright).
-  # Inspector unit suite stays on Windows `build` only - do not re-run it here.
+  # Inspector unit suite stays on Windows `build` only except Inspector-Stress (below).
   ui-portable:
     runs-on: ${{ matrix.os }}
     timeout-minutes: 35
@@ -169,6 +169,90 @@ jobs:
       with:
         dotnet-version: |
           10.0.x
+    - name: Assert in-box MsQuic (Windows)
+      if: runner.os == 'Windows'
+      shell: pwsh
+      run: |
+        if (-not [System.Net.Quic.QuicListener]::IsSupported) {
+          throw 'QuicListener.IsSupported is false on windows-latest (expected in-box MsQuic)'
+        }
+        Write-Host "QuicListener.IsSupported=$([System.Net.Quic.QuicListener]::IsSupported)"
+    - name: Install libmsquic (Linux HTTP/3)
+      if: runner.os == 'Linux'
+      run: |
+        set -euo pipefail
+        . /etc/os-release
+        curl --fail --silent --show-error --location --proto '=https' --tlsv1.2 \
+          "https://packages.microsoft.com/config/${ID}/${VERSION_ID}/packages-microsoft-prod.deb" \
+          -o packages-microsoft-prod.deb
+        sudo dpkg -i packages-microsoft-prod.deb
+        rm -f packages-microsoft-prod.deb
+        sudo apt-get update
+        sudo apt-get install -y libmsquic
+        pwsh -NoProfile -Command 'if (-not [System.Net.Quic.QuicListener]::IsSupported) { throw "QuicListener.IsSupported is false after libmsquic install" }; Write-Host "QuicListener.IsSupported=$([System.Net.Quic.QuicListener]::IsSupported)"'
+    - name: Install MsQuic (macOS HTTP/3)
+      if: runner.os == 'macOS'
+      shell: pwsh
+      run: |
+        $ErrorActionPreference = 'Stop'
+        # Intel macOS bottles are sparse; do not force-upgrade openssl (no bottle → job fail).
+        $env:HOMEBREW_NO_AUTO_UPDATE = '1'
+        $env:HOMEBREW_NO_INSTALL_UPGRADE = '1'
+        brew install openssl@3 libmsquic
+        $prefix = (& brew --prefix).Trim()
+        $msquicLib = Join-Path $prefix 'opt/libmsquic/lib'
+        $sslLib = Join-Path $prefix 'opt/openssl@3/lib'
+        $libDirs = @($msquicLib, $sslLib, (Join-Path $prefix 'lib')) |
+          Where-Object { Test-Path $_ } |
+          Select-Object -Unique
+        $dyld = ($libDirs -join ':')
+        Add-Content -Path $env:GITHUB_ENV -Value "DYLD_LIBRARY_PATH=$dyld"
+        Add-Content -Path $env:GITHUB_ENV -Value "DYLD_FALLBACK_LIBRARY_PATH=$dyld"
+        $env:DYLD_LIBRARY_PATH = $dyld
+        $env:DYLD_FALLBACK_LIBRARY_PATH = $dyld
+        Write-Host "DYLD_LIBRARY_PATH=$dyld"
+
+        function Test-QuicSupported {
+          $out = & pwsh -NoProfile -Command {
+            if (-not [System.Net.Quic.QuicListener]::IsSupported) { '0' } else { '1' }
+          }
+          return ($out.Trim() -eq '1')
+        }
+
+        if (-not (Test-QuicSupported)) {
+          Write-Host 'QuicListener.IsSupported still false after brew; trying Microsoft libmsquic drop…'
+          $arch = (& uname -m).Trim()
+          $rid = if ($arch -eq 'arm64') { 'osx-arm64' } else { 'osx-x64' }
+          $dest = Join-Path $env:RUNNER_TEMP 'msquic-osx'
+          New-Item -ItemType Directory -Path $dest -Force | Out-Null
+          $tag = 'v2.4.7'
+          $url = "https://github.com/microsoft/msquic/releases/download/$tag/msquic_${rid}_$tag.zip"
+          $zip = Join-Path $env:RUNNER_TEMP 'msquic-osx.zip'
+          try {
+            & curl --fail --silent --show-error --location --proto '=https' --tlsv1.2 $url -o $zip
+            if ($LASTEXITCODE -ne 0) { throw "curl exit $LASTEXITCODE" }
+            Expand-Archive -Path $zip -DestinationPath $dest -Force
+          } catch {
+            Write-Warning "Microsoft release download failed ($url): $_"
+          }
+          $found = Get-ChildItem -Path $dest -Recurse -Filter 'libmsquic*.dylib' -ErrorAction SilentlyContinue |
+            Select-Object -First 1
+          if ($found) {
+            $extra = $found.Directory.FullName
+            # ${extra} — bare $extra: is parsed as a PowerShell drive-qualified variable.
+            $dyld2 = "${extra}:${dyld}"
+            Add-Content -Path $env:GITHUB_ENV -Value "DYLD_LIBRARY_PATH=$dyld2"
+            Add-Content -Path $env:GITHUB_ENV -Value "DYLD_FALLBACK_LIBRARY_PATH=$dyld2"
+            $env:DYLD_LIBRARY_PATH = $dyld2
+            $env:DYLD_FALLBACK_LIBRARY_PATH = $dyld2
+            Write-Host "Added Microsoft dylib dir: $extra"
+          }
+        }
+
+        if (-not (Test-QuicSupported)) {
+          throw 'QuicListener.IsSupported is false after macOS MsQuic install (brew + optional Microsoft drop)'
+        }
+        Write-Host 'QuicListener.IsSupported=True'
     - name: Linux UI fonts + Playwright OS deps
       if: runner.os == 'Linux'
       run: |
@@ -194,6 +278,9 @@ jobs:
     - name: Inspector Headless + Visual + Plus Playwright
       run: |
         dotnet test tests/Titanium.E2E.Tests/Titanium.E2E.Tests.csproj --configuration Release --no-build --no-restore --filter "TestCategory=E2E-UI-Headless|TestCategory=E2E-UI-Visual|TestCategory=E2E-UI-Plus-Dashboard"
+    - name: Inspector retention stress (spill + H3)
+      run: |
+        dotnet test tests/Titanium.Inspector.Tests/Titanium.Inspector.Tests.csproj --configuration Release --no-restore --filter "TestCategory=Inspector-Stress"
     - name: OS proxy-backend filters
       run: |
         dotnet test tests/Titanium.Web.Proxy.UnitTests/Titanium.Web.Proxy.UnitTests.csproj --configuration Release --no-build --no-restore --filter "FullyQualifiedName~UnixProxyBypassMapperTests|FullyQualifiedName~MacOsSystemProxyBackendTests|FullyQualifiedName~LinuxSystemProxyBackendTests|FullyQualifiedName~ElevationPromptCancelTests|FullyQualifiedName~SystemProxyBackendFactoryPlatformTests"
@@ -220,7 +307,9 @@ jobs:
           **/playwright-report/**
         if-no-files-found: ignore
 
-  # Tiered RPS gate for beta/stable publish (editions). Spot runs on PRs via rps-saturation.yml.
+  # Tiered RPS gates for beta/stable publish (parallel — wall clock ~max of the two).
+  # Editions: CLI/Plus tax vs Core. Peer: Core reverse vs YARP (+ MITM÷Reverse) so a
+  # uniform Core slowdown cannot hide behind green edition ratios.
   rps-publish-gate:
     if: github.event_name == 'push' && (github.ref == 'refs/heads/beta' || github.ref == 'refs/heads/stable')
     runs-on: ubuntu-latest
@@ -251,9 +340,42 @@ jobs:
         if (-not $csv) { throw 'No CSV found for edition gate validation' }
         pwsh tools/RpsLoadProbe/validate-edition-gates.ps1 -CsvPath $csv.FullName
 
+  # Parallel with rps-publish-gate: Core vs YARP on the release SHA (c=64 spot).
+  # Same validator as PR compare-spot / run-spot-matrix.ps1; does not extend wall clock
+  # past editions (~60m).
+  rps-peer-gate:
+    if: github.event_name == 'push' && (github.ref == 'refs/heads/beta' || github.ref == 'refs/heads/stable')
+    runs-on: ubuntu-latest
+    timeout-minutes: 45
+    permissions:
+      contents: read
+    steps:
+    - uses: actions/checkout@v6
+    - name: Setup .NET
+      uses: actions/setup-dotnet@v5
+      with:
+        dotnet-version: |
+          10.0.x
+    - name: Install libmsquic (HTTP/3)
+      run: |
+        set -euo pipefail
+        . /etc/os-release
+        curl --fail --silent --show-error --location --proto '=https' --tlsv1.2 \
+          "https://packages.microsoft.com/config/${ID}/${VERSION_ID}/packages-microsoft-prod.deb" \
+          -o packages-microsoft-prod.deb
+        sudo dpkg -i packages-microsoft-prod.deb
+        rm -f packages-microsoft-prod.deb
+        sudo apt-get update
+        sudo apt-get install -y libmsquic
+        pwsh -NoProfile -Command 'if (-not [System.Net.Quic.QuicListener]::IsSupported) { throw "QuicListener.IsSupported is false after libmsquic install" }; Write-Host "QuicListener.IsSupported=$([System.Net.Quic.QuicListener]::IsSupported)"'
+    - name: compare-spot (Core÷YARP + MITM÷Reverse)
+      shell: pwsh
+      run: |
+        pwsh tools/RpsLoadProbe/run-spot-matrix.ps1
+
   publish:
     if: github.event_name == 'push' && (github.ref == 'refs/heads/beta' || github.ref == 'refs/heads/stable')
-    needs: [build, ui-portable, rps-publish-gate]
+    needs: [build, ui-portable, rps-publish-gate, rps-peer-gate]
     runs-on: windows-latest
     environment: nuget-publish
     permissions:
@@ -306,7 +428,7 @@ jobs:
   # version tag and dispatch release.yml (GITHUB_TOKEN tag pushes do not re-trigger workflows).
   cut-product-tag:
     if: github.event_name == 'push' && (github.ref == 'refs/heads/beta' || github.ref == 'refs/heads/stable')
-    needs: [build, ui-portable, rps-publish-gate]
+    needs: [build, ui-portable, rps-publish-gate, rps-peer-gate]
     runs-on: ubuntu-latest
     permissions:
       contents: write

.github/workflows/release.yml

@@ -461,10 +461,7 @@ jobs:
           set -euo pipefail
           # GITHUB_TOKEN `gh release create` does not fire `release: published` for
           # other workflows. Rebuild Pages so download.data.ts sees new zip/MSI assets.
-          REF=develop
-          case "$RELEASE_CHANNEL" in
-            beta) REF=beta ;;
-            stable) REF=stable ;;
-          esac
-          echo "Dispatching deploy-website.yml --ref $REF (channel=$RELEASE_CHANNEL)"
-          gh workflow run deploy-website.yml --ref "$REF"
+          # github-pages environment only allows deploy from develop (beta/stable are
+          # blocked by environment protection rules).
+          echo "Dispatching deploy-website.yml --ref develop (channel=$RELEASE_CHANNEL)"
+          gh workflow run deploy-website.yml --ref develop