milestone 17: real deadlines, validator holes, upstream editor, trusted proxies, contract samples, badvers

specs/milestone-8.md

@@ -54,6 +54,14 @@ anything else against /home/mokhtar/app/zig tag 0.16.0.
    re-materializes). Client prefixes: `GET/PUT /api/client-prefixes` as a whole-list
    resource (tiny table, atomic replace). No POST for clients — creation is by DNS activity
    or import (PLAN:540 gives clients no POST deliberately).
+
+   > **Placement deviation (milestone 17 ruling 3).** "The Settings page must
+   > edit them" above names the wrong page. Milestone 9 dropped the obligation
+   > entirely; milestone 17 restored it as a dedicated **Upstreams** page with
+   > its own nav entry (`web/src/features/upstreams/`, route `/upstreams`),
+   > matching the house resource-page pattern that every other collection
+   > follows. The Settings page keeps the scalar settings keys only. The API
+   > contract in this ruling is unchanged.
 10. **Repo layer**: every list row the API serves carries its row id; each mutated resource
     gains `getX(db, id)`, `updateX(db, id, item)`, `deleteX(db, id)` (strict: 0 rows touched
     → error.NotFound), written in the house repo idiom with prepared statements. Existing