0.2.6-dev: the maintainer's decisions of 2026-10-12 — the 玩法说明 pages' WebP copies are lossy at quality 90 (25.6 MB of PNG → 4.2 MB; lossless stays a GUIDE_WEBP_MODE away) and /healthz?traffic=1 answers the counters to a loopback or private-network client only (a public visitor, also one a local tunnel or proxy forwards, gets the plain report; TRUST_PROXY applies as for the WebSocket limits); golden: unchanged

docs/history/0.2.6.md

@@ -24,14 +24,17 @@ committed data.
   line: design/network.md §8 Transport.
 - **玩法说明 pages as WebP.** `tools/local-extract/extract.py` writes a WebP copy beside each of the 19 local pages and
   the manifest lists it (`GUIDE_WEBP_MODE`); the guide preloads only the next page instead of both neighbours. The
-  copies are lossless (25.6 MB → 17.4 MB on the CN client's pages). Lossy quality 90 would make them 4.2 MB; per the
-  decision that tutorial pages may go lossy only after a side-by-side comparison, that switch (one constant, then
-  `extract.py --webp`) is left to the maintainer. Normative lines: design/client.md §13, ASSETS.md Post-processing.
+  copies are lossy at quality 90: 25.6 MB → 4.2 MB on the CN client's pages (lossless would be 17.4 MB). Tutorial pages
+  could go lossy only after a side-by-side comparison; the maintainer looked at 2× crops of four pages on 2026-10-12 and
+  chose quality 90 (`GUIDE_WEBP_MODE`; `extract.py --webp` rewrites existing copies). Normative lines: design/client.md
+  §13, ASSETS.md Post-processing.
 - **Traffic counters.** `GET /healthz?traffic=1` adds `traffic` (HTTP body bytes and requests by category — assets,
   audio, code, data, other — and 304s; WebSocket wire bytes after compression and payload bytes before it) and
   `assetHashes` (the index state). The 问题反馈 diagnostics gain a `traffic:` line: the page's Resource Timing
   `transferSize` by the same categories (`shared/assetPaths.js trafficCategory`), other sites apart. Nothing is stored
-  or uploaded.
+  or uploaded. The maintainer's decision of 2026-10-12: only a loopback or private-network client gets the counters
+  (`server/http/routes.js`, the address from `net.js clientAddress`, so TRUST_PROXY applies as for the WebSocket
+  limits); any other client — also a visitor that a tunnel or proxy on this machine forwards — gets the plain report.
 - **DEPLOY.md**: a stable address keeps every player's cache, settings and reconnect token (a quick tunnel's new domain
   is a new site to the browser); HTTP/2 through the proxy saves round trips, not bytes; browsers offer brotli on HTTPS
   pages and localhost only; a Cloudflare cache rule for `/assets/`, `/fonts/`, `/media/` (with the risk note).
@@ -82,7 +85,7 @@ changed, while a hashed URL is never asked for again until its bytes change.
 ### 31.4 Open items and tests
 
 Open: `/fonts/fonts.css` (linked by index.html) and the woff2 files it names keep plain URLs (content ETags only); the
-optional versioned vendor URLs (layer 1.5) are not done; lossy tutorial pages wait for the comparison.
+optional versioned vendor URLs (layer 1.5) are not done.
 
 Tests: `test/ui/audio.test.js` (BGM gating; hashed audio through `/media/~hash/`), `test/ws-compression.test.js`,
 `test/local-extract.test.js` (guide WebP), `test/ui/localArt.test.js` (next-page preload), `test/traffic.test.js`,