• Add bounded per-secret JA4 distributions alongside the global ClientHello
  counter. Each worker keeps the top four HMAC-matched fingerprints per secret
  and exposes them as secret_<label>_ja4_seen<TAB><hash><TAB><N> in /stats
  and teleproxy_secret_ja4_seen{secret="...",hash="..."} in /metrics.
  Unmatched ClientHellos remain visible in the existing global top-32 counter.

• Fix high idle CPU usage with worker processes (#129). The master now enters
  the normal epoll sleep path when there are no active special connections
  instead of waking every 1-2 ms merely because workers are configured.
• Replace legacy __sync compare-and-swap operations with portable
  __atomic_compare_exchange_n calls and link libatomic on Linux (#131).
  This fixes ARM64 builds where 16-byte compare-and-swap is not lock-free.
• Accept TLS 1.3 camouflage backends that omit the optional compatibility
  ChangeCipherSpec record (#105). Startup probing and teleproxy check now
  handle both valid ServerHello layouts.
• Add a complete native TOML configuration reference with defaults, examples,
  reload behavior, fake-TLS backends, secret limits, ACLs, and DC overrides
  (#108).
• Clarify that /stats and /link deliberately return 404 outside their
  allowlist, publish Docker's stats port on loopback by default, and document
  SSH-tunnel access (#127).
• Correct SOCKS5 documentation and examples: upstream SOCKS5 routing requires
  direct-to-DC mode (#123).

• Expose ClientHello JA4 fingerprint distribution on /stats and /metrics
  (#102, follow-up to #39 / #101). Every well-formed ClientHello reaching
  the proxy — including HMAC failures from TSPU probes — is hashed per the
  foxio JA4 spec and rolled into a top-32 counter per worker, surfaced as
  ja4_seen<TAB><hash><TAB><N> lines in /stats and as
  teleproxy_ja4_seen{hash="..."} samples in /metrics. Always on, zero
  configuration. Optional [stats] ja4_log = true (--ja4-log /
  JA4_LOG=true) prints ja4=<hash> sni=<name> per connection at verbose
  level 2 for one-off investigations. Lets operators see which JA4 a new
  TSPU signature is targeting instead of inferring from user reports.

• Fix macOS backend-forward path. Backend forwarding (the camouflage fallback
  for invalid handshakes — wrong secret, stale timestamp, unknown SNI,
  duplicate client_random, plain HTTPS probes) silently dropped every
  request on macOS native builds: writev() to a freshly opened outbound
  socket whose connect() was still in EINPROGRESS returns ENOTCONN
  on BSD/Darwin where Linux returns EAGAIN. The proxy treated anything
  other than EAGAIN/EINTR as fatal and tore down the connection
  before the SYN-ACK arrived. Now treats ENOTCONN as a retry condition
  too. Five fake-TLS E2E tests (test_wrong_secret_rejected,
  test_stale_timestamp_rejected, test_unknown_sni_falls_back,
  test_duplicate_client_random_rejected, test_browser_tls_sees_real_backend)
  now pass on the macOS dev build alongside Linux.
• New mss_clamp TOML key + --no-mss-clamp CLI flag + MSS_CLAMP=false
  env var to disable the automatic ClientHello fragmentation shipped in
  v4.14.0. Default stays on. Useful escape hatch for bandwidth-bound
  operators willing to take the JA4 detection risk in exchange for ~5×
  lower packet count on the proxy listener.

• Automatic ClientHello fragmentation against TSPU JA4 fingerprinting (#39).
  The MTProxy listening socket now announces a 256-byte TCP MSS in the SYN-ACK,
  forcing the client kernel to chop its outgoing ClientHello across 2-3 TCP
  segments. ALPN and signature_algorithms — required inputs to JA4 — land in
  segments 2/3, so a single-packet JA4 extractor computes the wrong hash and
  the connection slips past the signature. No configuration; no client change
  required. The HTTP /stats and /metrics listener keeps the system default
  MSS. Trade-off: Linux caps server→client segments at the same MSS, raising
  packet count ~5× and TCP/IP header overhead from ~3% to ~15% on the proxy
  listener — measurable on bandwidth-saturated deployments but well within
  the timeout of the existing 20MB MTProto E2E test.

• Wildcard certificate support in fake-TLS mode (#44). -D '*.example.com:backend:443'
  matches any single-label subdomain of example.com against the configured
  SNI pattern (RFC 6125), fixing the failure mode where operators with a
  *.example.com cert saw fake-TLS traffic land on nginx's default vhost.
  Fingerprinting probes the backend host, not the literal *.example.com.
  Same bug filed against mtg as 9seconds/mtg#394; teleproxy is now the first
  MTProxy implementation to handle wildcards.
• New CONFIG_DOWNLOAD_PROXY env var routes the proxy-multi.conf download
  through an outbound HTTP/SOCKS proxy (#61). Useful when core.telegram.org
  is unreachable directly from the host. Defaults to SOCKS5_PROXY when
  unset, so a single knob can cover both DC routing and config refresh.
• New EE_BACKEND env var splits the fake-TLS SNI domain (EE_DOMAIN) from
  the actual camouflage backend (#62). Avoids the /etc/hosts workaround for
  local backends, and supports unix sockets (EE_BACKEND=unix:/run/nginx.sock)
  for nginx fronts. Configurable in TOML as
  domain = [{ name = "...", backend = "..." }].
• Fix pre-handshake sockets accumulating as total_connections until OS-level
  TCP keepalive killed them ~2 hours later (#63). The 10-second handshake
  alarm in tcp_rpcs_ext_alarm / tcp_rpcs_ext_drs_alarm now drops the
  socket instead of no-opping when fake-TLS isn't configured. Visible on
  busy public proxies as a high total_connections gauge that didn't track
  authenticated user count, especially under random-padding (dd) mode where
  scanners and probes get accepted but never complete obfs2.
• New make test-handshake-timeout regression test asserts
  total_connections returns to baseline within 15 seconds of opening junk
  sockets.
• Document direct-mode limitations (#79). The --direct page now spells out
  what skipping Telegram's middle-end trades away: media on non-Premium
  accounts may not load, sponsored channels aren't delivered, and voice/video
  calls aren't carried by any MTProto proxy regardless of mode. Answers the
  recurring symptom reported in #60.
• Memory-handling robustness in src/common/common-stats.c and assorted free
  paths (#84, #85, #82). cppcheck --check-level=exhaustive findings are now
  gated in CI (#78) so future OOM-path regressions surface before merge.

Build hygiene. No runtime changes.

• Compile cleanly with make CC=clang on x86_64 (#68). Adds _mm_*
  intrinsic shims for the GCC-only __builtin_ia32_* names used in
  src/common/crc32.c, gated to x86 so Apple Silicon clang isn't
  affected.
• New build-clang job in the CI matrix exercises the clang x86_64
  build path so future regressions surface in CI rather than only in
  third-party packaging (#72).

Hotfix for log spam introduced in 4.12.0.

• Fix WARNING: IP tracking table full for secret 0 flooding docker logs
  on busy plain secrets (#71). The 4.12.0 fix for #70 made every secret
  populate a fixed-size 256-entry per-IP table, which overflows on any
  proxy serving more than ~256 distinct source IPs since startup. Plain
  secrets (no max_ips, no rate_limit) now bypass the precise tracking
  table entirely and feed the cumulative teleproxy_secret_unique_ips
  counter from a per-secret Bloom filter — bounded memory, no overflow.
• For limit-bearing secrets where the table can still legitimately fill
  if max_ips exceeds 256, throttle the warning to once per minute per
  slot and include the secret label and a remediation hint.

Bug fixes for Docker deployments and per-secret metrics.

• Fix teleproxy_secret_unique_ips always reporting 0 (#70). The counter was
  only incremented when a secret had max_ips or rate_limit configured;
  plain secrets are now tracked too.
• Clarify teleproxy_secret_bytes_received_total / _sent_total HELP text:
  "received" is uploads (proxy from clients), "sent" is downloads (proxy to
  clients). The counters are direct-mode only; relay-mode aggregation is a
  separate gap, tracked for a follow-up.
• Change teleproxy_secret_unique_ips TYPE from gauge to counter to
  match its actual cumulative behaviour.
• Fix Docker SECRET=hex:label,hex:label writing the entire string as the
  TOML key instead of splitting label off (#67). The numbered-secret path
  (SECRET_LABEL_N) was already correct.
• Add EXTERNAL_PORT env var for advertising a different port in the
  connection link than the internal listen port (#66) — needed when Docker
  maps -p 4443:443. Also added a matching external_port TOML option,
  consumed by the /link HTML page and teleproxy link URL builder.

SOCKS5 upstream support in check command (#57), Cloudflare Spectrum docs (#55).

• teleproxy check now routes DC probes through the configured SOCKS5 proxy.
  New --socks5 URL CLI flag; also reads from TOML config.
• Handle buffer allocation failures gracefully instead of crashing (#58).
• Fix PROXY protocol metrics always reporting 0 in multi-worker mode (#53).
• New deployment guide: Cloudflare Spectrum.