diff --git a/Cargo.lock b/Cargo.lock
index 07d4361b..79f4a723 100644
--- a/Cargo.lock
+++ b/Cargo.lock
@@ -130,7 +130,7 @@ version = "1.1.5"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "40c48f72fd53cd289104fc64099abca73db4166ad86ea0b4341abe65af83dadc"
 dependencies = [
- "windows-sys 0.60.2",
+ "windows-sys 0.61.2",
 ]
 
 [[package]]
@@ -141,7 +141,7 @@ checksum = "291e6a250ff86cd4a820112fb8898808a366d8f9f58ce16d1f538353ad55747d"
 dependencies = [
  "anstyle",
  "once_cell_polyfill",
- "windows-sys 0.60.2",
+ "windows-sys 0.61.2",
 ]
 
 [[package]]
@@ -1090,7 +1090,7 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "39cab71617ae0d63f51a36d69f866391735b51691dbda63cf6f96d042b63efeb"
 dependencies = [
  "libc",
- "windows-sys 0.52.0",
+ "windows-sys 0.61.2",
 ]
 
 [[package]]
@@ -2153,7 +2153,7 @@ version = "0.50.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "7957b9740744892f114936ab4a57b3f487491bbeafaf8083688b16841a4240e5"
 dependencies = [
- "windows-sys 0.60.2",
+ "windows-sys 0.61.2",
 ]
 
 [[package]]
@@ -2463,7 +2463,7 @@ dependencies = [
  "once_cell",
  "socket2",
  "tracing",
- "windows-sys 0.52.0",
+ "windows-sys 0.61.2",
 ]
 
 [[package]]
@@ -2798,7 +2798,7 @@ dependencies = [
  "errno",
  "libc",
  "linux-raw-sys",
- "windows-sys 0.52.0",
+ "windows-sys 0.61.2",
 ]
 
 [[package]]
@@ -2856,7 +2856,7 @@ dependencies = [
  "security-framework",
  "security-framework-sys",
  "webpki-root-certs",
- "windows-sys 0.52.0",
+ "windows-sys 0.61.2",
 ]
 
 [[package]]
@@ -3195,7 +3195,7 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "c3d1e2c7f27f8d4cb10542a02c49005dbd6e93095799d6f3be745fae9f8fedd4"
 dependencies = [
  "libc",
- "windows-sys 0.60.2",
+ "windows-sys 0.61.2",
 ]
 
 [[package]]
@@ -3283,10 +3283,10 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "32497e9a4c7b38532efcdebeef879707aa9f794296a4f0244f6f69e9bc8574bd"
 dependencies = [
  "fastrand",
- "getrandom 0.3.4",
+ "getrandom 0.4.3",
  "once_cell",
  "rustix",
- "windows-sys 0.52.0",
+ "windows-sys 0.61.2",
 ]
 
 [[package]]
@@ -3670,7 +3670,7 @@ dependencies = [
 
 [[package]]
 name = "tw-api"
-version = "0.83.2"
+version = "0.84.0"
 dependencies = [
  "serde",
  "serde_json",
@@ -3681,7 +3681,7 @@ dependencies = [
 
 [[package]]
 name = "tw-bedrock"
-version = "0.83.2"
+version = "0.84.0"
 dependencies = [
  "aws-credential-types",
  "aws-sigv4",
@@ -3702,7 +3702,7 @@ dependencies = [
 
 [[package]]
 name = "tw-breaker"
-version = "0.83.2"
+version = "0.84.0"
 dependencies = [
  "serde",
  "serde_json",
@@ -3710,7 +3710,7 @@ dependencies = [
 
 [[package]]
 name = "tw-config"
-version = "0.83.2"
+version = "0.84.0"
 dependencies = [
  "blake3",
  "libc",
@@ -3736,7 +3736,7 @@ dependencies = [
 
 [[package]]
 name = "tw-control"
-version = "0.83.2"
+version = "0.84.0"
 dependencies = [
  "axum",
  "base64 0.22.1",
@@ -3782,7 +3782,7 @@ dependencies = [
 
 [[package]]
 name = "tw-dialect"
-version = "0.83.2"
+version = "0.84.0"
 dependencies = [
  "memchr",
  "serde",
@@ -3791,7 +3791,7 @@ dependencies = [
 
 [[package]]
 name = "tw-engine"
-version = "0.83.2"
+version = "0.84.0"
 dependencies = [
  "chrono",
  "serde",
@@ -3805,7 +3805,7 @@ dependencies = [
 
 [[package]]
 name = "tw-gateway"
-version = "0.83.2"
+version = "0.84.0"
 dependencies = [
  "arc-swap",
  "async-stream",
@@ -3856,7 +3856,7 @@ dependencies = [
 
 [[package]]
 name = "tw-guard"
-version = "0.83.2"
+version = "0.84.0"
 dependencies = [
  "aho-corasick",
  "base64 0.22.1",
@@ -3874,7 +3874,7 @@ dependencies = [
 
 [[package]]
 name = "tw-handover"
-version = "0.83.2"
+version = "0.84.0"
 dependencies = [
  "libc",
  "serde",
@@ -3887,7 +3887,7 @@ dependencies = [
 
 [[package]]
 name = "tw-link"
-version = "0.83.2"
+version = "0.84.0"
 dependencies = [
  "serde",
  "serde_json",
@@ -3901,7 +3901,7 @@ dependencies = [
 
 [[package]]
 name = "tw-observe"
-version = "0.83.2"
+version = "0.84.0"
 dependencies = [
  "tokio",
  "tracing",
@@ -3910,7 +3910,7 @@ dependencies = [
 
 [[package]]
 name = "tw-pack"
-version = "0.83.2"
+version = "0.84.0"
 dependencies = [
  "age",
  "blake3",
@@ -3934,7 +3934,7 @@ dependencies = [
 
 [[package]]
 name = "tw-plugin"
-version = "0.83.2"
+version = "0.84.0"
 dependencies = [
  "libc",
  "rand 0.10.2",
@@ -3950,7 +3950,7 @@ dependencies = [
 
 [[package]]
 name = "tw-pricing"
-version = "0.83.2"
+version = "0.84.0"
 dependencies = [
  "arc-swap",
  "flate2",
@@ -3963,14 +3963,14 @@ dependencies = [
 
 [[package]]
 name = "tw-secret"
-version = "0.83.2"
+version = "0.84.0"
 dependencies = [
  "thiserror 2.0.20",
 ]
 
 [[package]]
 name = "tw-store"
-version = "0.83.2"
+version = "0.84.0"
 dependencies = [
  "blake3",
  "bytes",
@@ -3990,7 +3990,7 @@ dependencies = [
 
 [[package]]
 name = "tw-sync"
-version = "0.83.2"
+version = "0.84.0"
 dependencies = [
  "age",
  "axum",
@@ -4018,7 +4018,7 @@ dependencies = [
 
 [[package]]
 name = "tw-types"
-version = "0.83.2"
+version = "0.84.0"
 dependencies = [
  "serde",
  "serde_json",
@@ -4027,7 +4027,7 @@ dependencies = [
 
 [[package]]
 name = "tw-watch"
-version = "0.83.2"
+version = "0.84.0"
 dependencies = [
  "libc",
  "notify",
@@ -4038,7 +4038,7 @@ dependencies = [
 
 [[package]]
 name = "tw-yaml"
-version = "0.83.2"
+version = "0.84.0"
 dependencies = [
  "saphyr-parser",
  "serde_yaml_ng",
@@ -4048,7 +4048,7 @@ dependencies = [
 
 [[package]]
 name = "twcore"
-version = "0.83.2"
+version = "0.84.0"
 dependencies = [
  "anyhow",
  "axum",
@@ -4583,7 +4583,7 @@ version = "0.1.11"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "c2a7b1c03c876122aa43f3020e6c3c3ee5c05081c9a00739faf7503aeba10d22"
 dependencies = [
- "windows-sys 0.52.0",
+ "windows-sys 0.61.2",
 ]
 
 [[package]]
@@ -4990,27 +4990,27 @@ checksum = "29666d0abbfad1e3dc4dcf6144730dd3a3ab225bbbdac83319345b1b44ccfc1b"
 
 [[package]]
 name = "zstd"
-version = "0.13.3"
+version = "0.14.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "e91ee311a569c327171651566e07972200e76fcfe2242a4fa446149a3881c08a"
+checksum = "db3ae9bf90af6e40197bef767eeefc46ad6397420fe873830bd85e5fbbfb3c70"
 dependencies = [
  "zstd-safe",
 ]
 
 [[package]]
 name = "zstd-safe"
-version = "7.3.0"
+version = "8.2.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "64d80649ab6db9d9f6f9c80a40becd948eda4714a0a5ac8c4d157a32231c7882"
+checksum = "ded520f16b29e1a9b771c722221b2b0a0398c2316d9bb3c42b458a5414d7434b"
 dependencies = [
  "zstd-sys",
 ]
 
 [[package]]
 name = "zstd-sys"
-version = "2.1.0+zstd.1.5.7"
+version = "2.1.2+zstd.1.5.7"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "0ef0a8027ec3ee71300ab3bcbcd0393f434aa72b91ca6d635a39941deae8eea0"
+checksum = "481ada9c543b2323cbb7bbdbb5249177fbf0188ed959ed2c15e4b22421c84ed3"
 dependencies = [
  "cc",
  "pkg-config",
diff --git a/Cargo.toml b/Cargo.toml
index 25f0aaa0..4b4dd235 100644
--- a/Cargo.toml
+++ b/Cargo.toml
@@ -61,7 +61,7 @@ categories = ["network-programming", "web-programming::http-server"]
 
 # 二进制走 CalVer，crate 走 SemVer —— 两者是两回事，卖给不同的人。
 # 这里是 crate 的版本。
-version = "0.83.2"
+version = "0.84.0"
 
 [workspace.dependencies]
 # ── 内部 crate ───────────────────────────────────────────
@@ -172,7 +172,7 @@ uuid = { version = "1", features = ["v4", "serde"] }
 rand = "0.10"
 # 发给 Codex 后端的请求体用 zstd 压缩（Codex 直连它时就这么发）。只要流式编码，
 # 不开旧格式和字典训练
-zstd = { version = "0.13", default-features = false }
+zstd = { version = "0.14", default-features = false }
 
 clap = { version = "4", features = ["derive"] }
 # 配置包的口令加密（scrypt）与同步版本的密钥加密（X25519）。默认特性是空的：不要
diff --git a/release-notes/0.84.0.md b/release-notes/0.84.0.md
new file mode 100644
index 00000000..273bafe3
--- /dev/null
+++ b/release-notes/0.84.0.md
@@ -0,0 +1,16 @@
+This release keeps a usage history that outlives the request records, for the past-year view in ThinkWatch Lite's overview.
+
+**Upgrade notes**
+
+- The control-plane protocol version goes from 54 to 55.
+- The request store's schema and the configuration are unchanged; nothing is cleared.
+- A new file, `usage.db`, appears in the data directory next to `data.db` (permissions 0600). On first start it is filled from the request records already kept.
+- No new message codes.
+
+**Usage history.** Every finished request is added to an hourly total (UTC hours): requests, failures, input, output, cache read and cache write tokens, exact and estimated cost, requests without a price or without usage, and bytes sent and received. Locally answered requests and token counts estimated by the gateway are not included, the same as in the summaries.
+
+- The totals live in their own file and keep their own schema version, so they are not deleted when request records pass the retention period, and not cleared when the request store is rebuilt after a schema change.
+- `GET /summary/history` (`UsageHistory`) takes the same `from_ms`, `to_ms` and `bucket_ms` as `/summary/buckets` and returns the buckets plus two times: `since_ms`, from when the history has data (days before it are not recorded, not unused), and `detail_since_ms`, the oldest request record still kept (views computed from request records are empty before it).
+- `/summary/buckets` and the history now share one definition of the totals.
+
+**zstd updated.** The zstd crates move to zstd 0.14.3, zstd-safe 8.2.0 and zstd-sys 2.1.2, which fix RUSTSEC-2026-0391, RUSTSEC-2026-0398, RUSTSEC-2026-0403 and RUSTSEC-2026-0410. Compressed request bodies and Codex-bound bodies are handled as before.