v0.3.5

• Breaking: named PEM entries, tcp_settings, and DNS server option objects (inline or in DNS groups, including non-system upstreams) now reject unknown fields instead of silently ignoring them. Named PEMs accept only pem and exactly one of path or data; tcp_settings accepts only no_delay. Remove unsupported or misspelled keys before upgrading, or configuration loading will fail.
• Breaking: client groups now use type instead of strategy, with no legacy alias. Replace strategy: selector with type: selector and strategy: round-robin with type: round-robin; configurations containing strategy are rejected.
• Added type: url-test client groups with automatic URL-scoped health/delay selection, tolerance, lazy checks, and supervised probes without a controller listener. See upstream group configuration and the URL-test example.
• Added type: fallback groups that choose the first healthy eligible complete path in configuration order, respect manual selectors, and fail closed once no healthy or never-sampled path remains. Checks require the expected HTTP status (default 204) and use bounded, generation-owned scheduling; existing connections are not switched and application payloads are never replayed. Unlike fallback, URL-test selection is best-effort when no fresh healthy result exists and tests immediate members rather than every surrounding chain. Both automatic group types are CLI-only; TCP probes do not establish UDP reachability. See ordered healthy fallback for supported chain combinations and limits.
• Failed reload activation now restores the previous services instead of terminating, unless rollback also fails. Unchanged fixed-address TCP listeners retain their sockets, with new-generation TCP and Unix connections admitted only after activation completes. Existing TCP flows still obey the reload grace period after rollback; TUN, WireGuard, and QUIC remain stop/start. See hot reloading.
• Breaking: file-backed inbound TLS/QUIC identities, including legacy cert/key paths and file-backed named PEMs, now rotate live and require currently valid, leaf-to-issuer certificate chains. Certificate and private-key files larger than 1 MiB are rejected. Expired or misordered bundles can fail startup after upgrade, and expired sources stop serving new handshakes even to clients using fingerprint pinning or disabled verification. Renew certificates, reduce oversized bundles, remove expired cross-signs and certificates outside that chain, and synchronize the system clock before starting Shoes. Child-to-issuer signatures must use TLS-provider-supported algorithms (no SHA-1; RSA issuer keys of at least 2048 bits); reissue certificates with unsupported signatures. Inline-only pairs retain their previous behavior. See certificate sources.
• Added shared file and ACME certificate sources for TLS/QUIC, including HTTP-01 and TLS-ALPN-01 issuance, renewal, durable account/order state, and live rotation without interrupting existing connections. ACME requires explicit domains, accepted CA terms, persistent storage, and externally reachable challenge ports; DNS-01, wildcard issuance, and external account binding are not supported. On first issuance, listeners can be ready before a certificate exists, so normal handshakes fail until issuance succeeds. CLI and FFI share the certificate manager.
• Full configuration reloads now watch additional referenced PEM dependencies and wait for five seconds of filesystem quiet (previously a fixed three-second delay; continued writes postpone the reload); SIGHUP bypasses the debounce. --no-reload disables automatic full reloads, not live inbound certificate rotation or ACME renewal. Embedded instances require a restart for reload-only PEM changes.
• Added Shadowsocks 2022 AES client identity key chains (server-key:user-key and longer relay chains). Existing single-key and legacy passwords are unchanged. This does not add server-side multi-user support, ChaCha20 identity chains, or native SS2022 UDP; udp_enabled still requires a UDP-over-TCP-capable upstream.
• Shared native DNS cache results across destination ports and coalesced concurrent misses with bounded, cancellation-safe ownership. Added system-only native_cache_secs to configure application memoization: omitted listener DNS retains the 60-second default, while explicit servers: system remains uncached. This is a result-age window, not DNS record TTL compliance; errors and expired results are not cached or served stale. See native DNS freshness.
• Fixed DNS connection-close recovery and healthy-upstream failover through a pinned Hickory fork, including typed HTTP/3 errors, without widening retry limits.
• Moved file logging to bounded background workers so slow storage does not stall relay threads. Overload drops newest records, oversized records are truncated, and shutdown flushing is bounded; applications requiring lossless audit logging should not treat this sink as durable storage.
• Added default-off connection_notes to Clash controllers for bounded setup, routing, and DNS notes on active connections. Notes have no retained history and can expose destination and outbound proxy hostnames/IPs; they contain no payloads or credentials. Enabling notes on any controller exposes them through all controllers and requires a restart.
• Improved configuration errors with input-file, config[N], and rule context while preserving native YAML diagnostics. Released setup-only routing state before TCP relay and expanded retention, reload, parser-property, Linux coverage, and advisory performance checks.

This release is distributed through GitHub Releases and GHCR, not crates.io. Building from source requires Rust 1.95 or newer; cargo install shoes still installs the previously published crates.io version. Six Linux/macOS tarballs include THIRD_PARTY_NOTICES.md and licenses/, which distributors must retain along with the corresponding source information. Container images support linux/amd64 and linux/arm64; native mobile interfaces remain source-built, with no AAR or XCFramework archives.

Full changelog: v0.3.4...v0.3.5