[Feature] Resource Controls (cgroup v2): plan CPU, memory, IO, IOPS, and process limits now apply as one account budget covering web (PHP/CGI), SSH, cron, mail, FTP, and rootless Podman. Limits sit on the user systemd slice so containers and user services stay healthy without fighting the session manager.

[Feature] Limit faults — stats daemon records CPU, MEM, IO, IOPS, NPROC, and EP fault counters (limit hits) into history and live pressure data. Admin Statistics includes a Faults view; enduser dashboards can show when an account is hitting plan limits.

[Feature] Dual-interval stats service: fast pressure sampling for admission decisions, plus configurable history interval and retention (admin Settings). Host iowait sampling and smarter IO accounting improve chart and fault accuracy.

[Feature] Podman admission controls in admin Settings: max containers per user, max concurrent deploys per user, and optional block on resource pressure when the account is already throttled.

[Feature] Reworked container port management with reliable allocate / bind / free / save flows, deploy rebind to container IDs, and clean free on project delete — no more fragile port claiming or leftover proxies.

[Improvement] Setuid and login paths attach workloads into the account resource envelope; rootless container UIDs (subuids) map to the owning account budget and are not counted as entry processes. Orphaned helper processes stay under the owner’s limits.

[Improvement] EL8 hidepid + cgroup v2 fix via simuzo-fix-host-proc.sh: keeps host hidepid=2 security while allowing systemd --user to start where needed. Newer systems (e.g. Alma 9/10) keep plain hidepid without extra setup.

[Improvement] Podman / Compose stability: stack actions use the correct cgroup manager and session bus; fix compose start flags; recover from cgroup parent errors on start; reverse proxy backends use a trailing slash to avoid Apache ProxyPass join bugs; orphan port/proxy cleanup for deleted containers.

[Improvement] Podman storage prefers kernel overlay when available to reduce fuse-overlayfs load under tight IO plans. Control remains account-level Resource Controls — not per-container CPU/memory injection.

[Improvement] MySQL Governor production polish: live query time for active statements; slow-query kill limited to SELECT-like queries; more reliable plugin feed setup; plugin rebuilds across MySQL 8.0/8.4/9.7 and MariaDB 10.6–11.8; setup and admin UI refinements.

[Improvement] Expanded automated tests: resource control, resource stress, MySQL Governor, and audit trail suites; rebuilt core binaries (PAM, preload libs, procmon).

[Improvement] Enduser containers, list-compose, and manage-ports UI updates for the new port and project action flows.