Update peer fill release docs

Author: eldryoth

README.md

@@ -355,8 +355,9 @@ amplification. Local proxy-cache misses can now ask configured peers for that
 safe no-origin response, store valid peer hits locally, and fall back to origin
 only when `fail_open` allows it. `examples/cache-peer-fill.toml` shows the
 current config shape, and `scripts/smoke_peer_fill_cache.sh` verifies the
-two-node `PEER-HIT` path plus local post-fill hits before release. An optional
-`1.2.5` is reserved only if production testing finds one more cache blocker. `1.3` is the
+multi-node `PEER-HIT` path, local post-fill hits, `Vary` variants, peer `Age`,
+and fail-open/fail-closed behavior before release. An optional `1.2.5` is
+reserved only if production testing finds one more cache blocker. `1.3` is the
 load-balancer/proxy parity line. Wasm is planned as a shared `1.4`
 extensibility release, covering nginx-Lua-style hooks and VCL-like cache policy
 hooks through one sandboxed runtime.

docs/cache-backends.md

@@ -258,20 +258,19 @@ internal cache implementation.
 - The `1.2.4` distributed-cache line starts with a safe `[cache.peer_fill]`
   policy contract. Peer fill is disabled by default, requires an enabled cache
   policy, bounds peers/timeouts/object size/concurrency, and validates peer
-  origins before runtime peer retrieval is enabled. As the first runtime
-  primitive, proxy-cache requests with `Cache-Control: only-if-cached` are
-  served only from a fresh local cache object; misses, stale objects, bypassed
+  origins. Proxy-cache requests with `Cache-Control: only-if-cached` are served
+  only from a fresh local cache object; misses, stale objects, bypassed
   policies, or ineligible methods return `504` and do not contact origin. This
   gives outbound peer fill a safe no-origin endpoint. On a local proxy-cache
-  miss, Fluxheim can ask configured peers for that no-origin endpoint before
+  miss, Fluxheim asks configured peers for that no-origin endpoint before
   falling back to origin according to `fail_open`; peer hits are stored locally
   and peer requests forward only host plus safe negotiation headers rather than
   client credentials. The example
   `examples/cache-peer-fill.toml` shows the current config shape for
   cache-cluster planning. `scripts/smoke_peer_fill_cache.sh` runs a local
-  two-node smoke that proves node-to-node `PEER-HIT`, no extra origin fetch,
-  local post-fill `HIT`, fail-closed `504` without origin fetch, fail-open
-  origin fallback, and peer-fill metrics. The configured
+  multi-node smoke that proves node-to-node `PEER-HIT`, no extra origin fetch,
+  local post-fill `HIT`, `Vary` variants, fail-closed `504` without origin
+  fetch, fail-open origin fallback, and peer-fill metrics. The configured
   `peer_fill.max_concurrent_requests` budget is enforced per vhost or route
   cache policy for active outbound peer fetches.
   Peer response `Age` is preserved during admission, so a peer-filled object

docs/release-checklist.md

@@ -363,6 +363,7 @@ cargo build --release --no-default-features --features proxy,metrics
 cargo build --release --no-default-features --features proxy,tls-rustls,acme
 cargo build --release --no-default-features --features profile-load-balancer
 cargo build --release --no-default-features --features profile-observability
+scripts/smoke_peer_fill_cache.sh
 scripts/smoke_observability_local.sh
 ```
 

docs/versioning-plan.md

@@ -823,7 +823,8 @@ Focused cache-only follow-up releases after 1.2:
   another node for a fresh cached object without causing that node to contact
   origin. Outbound peer-fill uses that path on local proxy-cache misses, stores
   valid peer hits locally, applies `fail_open` to decide whether a peer miss
-  falls back to origin, and is covered by a local two-node smoke test.
+  falls back to origin, preserves peer `Age`, stores `Vary` variants correctly,
+  and is covered by a local multi-node smoke test.
 - `1.2.5`: reserved only if production 1.2 testing exposes one more
   cache-specific gap that should close before the 1.3 line starts. Candidate
   work includes proper Pingora-path partial streaming/slice range fill,