diff --git a/src/Titanium.Cli/Titanium.Cli.csproj b/src/Titanium.Cli/Titanium.Cli.csproj
index f84701d7d..ffe9499b7 100644
--- a/src/Titanium.Cli/Titanium.Cli.csproj
+++ b/src/Titanium.Cli/Titanium.Cli.csproj
@@ -7,7 +7,7 @@
     <LangVersion>latest</LangVersion>
     <ImplicitUsings>enable</ImplicitUsings>
     <SignAssembly>false</SignAssembly>
-    <VersionPrefix>7.0.7</VersionPrefix>
+    <VersionPrefix>7.0.8</VersionPrefix>
     <Authors>Jehonathan Thomas</Authors>
     <Description>Titanium Web Proxy CLI (titanium / twp).</Description>
     <PackageLicenseExpression>MIT</PackageLicenseExpression>
diff --git a/src/Titanium.Inspector/Titanium.Inspector.csproj b/src/Titanium.Inspector/Titanium.Inspector.csproj
index 46684494e..86e0c1500 100644
--- a/src/Titanium.Inspector/Titanium.Inspector.csproj
+++ b/src/Titanium.Inspector/Titanium.Inspector.csproj
@@ -8,7 +8,7 @@
     <ImplicitUsings>enable</ImplicitUsings>
     <AllowUnsafeBlocks>true</AllowUnsafeBlocks>
     <SignAssembly>false</SignAssembly>
-    <VersionPrefix>7.0.7</VersionPrefix>
+    <VersionPrefix>7.0.8</VersionPrefix>
     <Authors>Jehonathan Thomas</Authors>
     <Description>Titanium Inspector desktop traffic debugger (PolyForm Noncommercial).</Description>
     <PackageLicenseFile>LICENSE</PackageLicenseFile>
diff --git a/src/Titanium.Inspector/ViewModels/MainWindowViewModel.cs b/src/Titanium.Inspector/ViewModels/MainWindowViewModel.cs
index ce4d0bce7..0e250287f 100644
--- a/src/Titanium.Inspector/ViewModels/MainWindowViewModel.cs
+++ b/src/Titanium.Inspector/ViewModels/MainWindowViewModel.cs
@@ -977,7 +977,7 @@ private async Task ExcludeHostAsync()
             return;
         }
 
-        var (saved, kind, _) = await AwaitCancellableAsync(ExcludeHostDialog.ShowAsync(owner, _settings, selected.Host));
+        var (saved, _) = await AwaitCancellableAsync(ExcludeHostDialog.ShowAsync(owner, _settings, selected.Host));
         if (!saved)
         {
             StatusText = "Exclude host cancelled";
@@ -985,15 +985,8 @@ private async Task ExcludeHostAsync()
         }
 
         ApplyExclusionSettingsFromSettings();
-        if (kind == ExcludeHostKind.BypassProxy && SystemProxy)
-        {
-            _interception.ReapplySystemProxyIfEnabled();
-        }
-
         UpdateExclusionSummary();
-        StatusText = kind == ExcludeHostKind.BypassProxy
-            ? $"Added {selected.Host} to OS bypass exclusions (new connections)"
-            : $"Added {selected.Host} to tunnel-only exclusions (new connections)";
+        StatusText = $"Excluded {selected.Host} — still listed, HTTPS not read";
     }
 
     private async Task ResetSettingsAsync()
@@ -1461,13 +1454,13 @@ public bool ProxyLoopback
 
             if (SystemProxy && !_interception.ReapplySystemProxyIfEnabled())
             {
-                StatusText = "Proxy localhost saved; re-toggle System proxy to apply";
+                StatusText = "Capture local traffic saved; re-toggle System proxy to apply";
                 return;
             }
 
             StatusText = value
-                ? "Proxy localhost on — loopback uses the system proxy"
-                : "Proxy localhost off — loopback skips the system proxy";
+                ? "Capture local traffic on — localhost uses the system proxy"
+                : "Capture local traffic off — localhost skips the system proxy";
         }
     }
 
diff --git a/src/Titanium.Inspector/Views/ExcludeHostDialog.axaml b/src/Titanium.Inspector/Views/ExcludeHostDialog.axaml
index e9b616786..96762c13d 100644
--- a/src/Titanium.Inspector/Views/ExcludeHostDialog.axaml
+++ b/src/Titanium.Inspector/Views/ExcludeHostDialog.axaml
@@ -3,26 +3,19 @@
         x:Class="Titanium.Inspector.Views.ExcludeHostDialog"
         AutomationProperties.AutomationId="ExcludeHostDialog"
         Title="Exclude host"
-        Width="440" Height="280"
+        Width="440" Height="220"
         WindowStartupLocation="CenterOwner"
         CanResize="False">
   <DockPanel Margin="16">
     <StackPanel DockPanel.Dock="Bottom" Orientation="Horizontal" HorizontalAlignment="Right" Spacing="8" Margin="0,16,0,0">
-      <Button x:Name="SaveButton" Content="Add" MinWidth="88" AutomationProperties.AutomationId="ExcludeHostAdd" />
+      <Button x:Name="SaveButton" Content="Exclude" MinWidth="88" AutomationProperties.AutomationId="ExcludeHostAdd" />
       <Button x:Name="CancelButton" Content="Cancel" MinWidth="88" IsCancel="True" AutomationProperties.AutomationId="ExcludeHostCancel" />
     </StackPanel>
     <StackPanel Spacing="10">
       <TextBlock x:Name="HostLabel" FontWeight="SemiBold" />
-      <RadioButton x:Name="TunnelOnlyRadio" GroupName="ExcludeKind" IsChecked="True"
-                   Content="Tunnel only (recommended) — stays visible, no decrypt"
-                   AutomationProperties.AutomationId="ExcludeHostTunnelOnly" />
-      <RadioButton x:Name="BypassProxyRadio" GroupName="ExcludeKind"
-                   Content="Bypass proxy (System proxy) — hidden from session list"
-                   AutomationProperties.AutomationId="ExcludeHostBypassProxy" />
-      <TextBlock x:Name="BypassWarning" TextWrapping="Wrap" Foreground="OrangeRed" FontSize="12"
-                 IsVisible="False"
-                 Text="Traffic will not appear in Inspector. Requires System proxy to be on." />
-      <CheckBox x:Name="WildcardParentCheck" Content="Also add *.parent-domain.com"
+      <TextBlock TextWrapping="Wrap" Opacity="0.9"
+                 Text="This host will still appear in the session list. Inspector will not try to read its HTTPS." />
+      <CheckBox x:Name="WildcardParentCheck"
                 AutomationProperties.AutomationId="ExcludeHostWildcardParent" />
     </StackPanel>
   </DockPanel>
diff --git a/src/Titanium.Inspector/Views/ExcludeHostDialog.axaml.cs b/src/Titanium.Inspector/Views/ExcludeHostDialog.axaml.cs
index 3a0c74105..4afc81539 100644
--- a/src/Titanium.Inspector/Views/ExcludeHostDialog.axaml.cs
+++ b/src/Titanium.Inspector/Views/ExcludeHostDialog.axaml.cs
@@ -4,15 +4,10 @@
 
 namespace Titanium.Inspector.Views;
 
-public enum ExcludeHostKind
-{
-    TunnelOnly,
-    BypassProxy,
-}
-
 public partial class ExcludeHostDialog : Window
 {
     private readonly SettingsService _settings;
+    private readonly string _hostname;
     private bool _saved;
 
     public ExcludeHostDialog() : this(SettingsService.Load(), "")
@@ -22,44 +17,47 @@ public ExcludeHostDialog() : this(SettingsService.Load(), "")
     public ExcludeHostDialog(SettingsService settings, string hostname)
     {
         _settings = settings;
+        _hostname = hostname.Trim();
         InitializeComponent();
-        HostLabel.Text = $"Exclude: {hostname}";
+        HostLabel.Text = _hostname;
+        var parent = ExtractParentDomain(_hostname);
+        if (string.IsNullOrEmpty(parent))
+        {
+            WildcardParentCheck.IsVisible = false;
+        }
+        else
+        {
+            WildcardParentCheck.Content = "Also exclude other hosts on " + parent;
+        }
+
         SaveButton.Click += OnSave;
         CancelButton.Click += (_, _) => Close();
-        BypassProxyRadio.IsCheckedChanged += (_, _) => UpdateWarning();
-        TunnelOnlyRadio.IsCheckedChanged += (_, _) => UpdateWarning();
     }
 
     public bool Saved => _saved;
-    public ExcludeHostKind SelectedKind =>
-        BypassProxyRadio.IsChecked == true ? ExcludeHostKind.BypassProxy : ExcludeHostKind.TunnelOnly;
 
-    public static async Task<(bool Saved, ExcludeHostKind Kind, bool WildcardParent)> ShowAsync(
+    public static async Task<(bool Saved, bool WildcardParent)> ShowAsync(
         Window owner,
         SettingsService settings,
         string hostname)
     {
         var w = new ExcludeHostDialog(settings, hostname);
         await w.ShowDialog(owner);
-        return (w.Saved, w.SelectedKind, w.WildcardParentCheck.IsChecked == true);
+        return (w.Saved, w.WildcardParentCheck.IsChecked == true);
     }
 
-    private void UpdateWarning() =>
-        BypassWarning.IsVisible = BypassProxyRadio.IsChecked == true;
-
-    private void OnSave(object? sender, RoutedEventArgs e) // NOSONAR S3776 -- Dialog save writes bypass and decrypt-skip lists together.
+    private void OnSave(object? sender, RoutedEventArgs e)
     {
-        var host = HostLabel.Text?["Exclude: ".Length..].Trim();
-        if (string.IsNullOrWhiteSpace(host))
+        if (string.IsNullOrWhiteSpace(_hostname))
         {
             Close();
             return;
         }
 
-        var patterns = new List<string> { host };
-        if (WildcardParentCheck.IsChecked == true)
+        var patterns = new List<string> { _hostname };
+        if (WildcardParentCheck.IsVisible && WildcardParentCheck.IsChecked == true)
         {
-            var parent = ExtractParentDomain(host);
+            var parent = ExtractParentDomain(_hostname);
             if (!string.IsNullOrEmpty(parent))
             {
                 patterns.Add("*." + parent);
@@ -67,19 +65,9 @@ private void OnSave(object? sender, RoutedEventArgs e) // NOSONAR S3776 -- Dialo
         }
 
         var s = _settings.Current;
-        if (SelectedKind == ExcludeHostKind.BypassProxy)
-        {
-            foreach (var p in patterns.Where(p => !s.SystemProxyBypassHosts.Contains(p, StringComparer.OrdinalIgnoreCase)))
-            {
-                s.SystemProxyBypassHosts.Add(p);
-            }
-        }
-        else
+        foreach (var p in patterns.Where(p => !s.DecryptSkipHosts.Contains(p, StringComparer.OrdinalIgnoreCase)))
         {
-            foreach (var p in patterns.Where(p => !s.DecryptSkipHosts.Contains(p, StringComparer.OrdinalIgnoreCase)))
-            {
-                s.DecryptSkipHosts.Add(p);
-            }
+            s.DecryptSkipHosts.Add(p);
         }
 
         _settings.Save();
diff --git a/src/Titanium.Inspector/Views/ExcludedHostsWindow.axaml b/src/Titanium.Inspector/Views/ExcludedHostsWindow.axaml
index 3715bf2c4..0e7f6e4b8 100644
--- a/src/Titanium.Inspector/Views/ExcludedHostsWindow.axaml
+++ b/src/Titanium.Inspector/Views/ExcludedHostsWindow.axaml
@@ -28,7 +28,7 @@
                  FontFamily="Consolas,Courier New,monospace"
                  AutomationProperties.AutomationId="ExcludedBypassHosts" />
 
-        <TextBlock FontWeight="SemiBold" Text="Tunnel only (no decrypt)" />
+        <TextBlock FontWeight="SemiBold" Text="Not decrypted hosts" />
         <TextBlock Opacity="0.75" TextWrapping="Wrap"
                    Text="CONNECT stays visible; TLS stays opaque when Decrypt HTTPS is on. Seeded with certificate-pinning hosts (Dropbox, Webex)." />
         <TextBox x:Name="SkipHostsBox" AcceptsReturn="True" TextWrapping="Wrap" MinHeight="72"
@@ -36,18 +36,18 @@
                  FontFamily="Consolas,Courier New,monospace"
                  AutomationProperties.AutomationId="ExcludedSkipHosts" />
 
-        <TextBlock FontWeight="SemiBold" Text="Auto-tunnel on decrypt failure" />
-        <CheckBox x:Name="LearningEnabledCheck" Content="Learn hosts that fail origin TLS under decrypt (session only)"
+        <TextBlock FontWeight="SemiBold" Text="Automatically not decrypt on decrypt failure" />
+        <CheckBox x:Name="LearningEnabledCheck" Content="Learn hosts that fail origin TLS under decrypt"
                   AutomationProperties.AutomationId="ExcludedLearningEnabled" />
         <TextBlock Opacity="0.75" TextWrapping="Wrap"
-                   Text="When origin TLS fails repeatedly under decrypt, or MITM HTTPS returns 403/429 (document pages auto-retry onto a tunnel; APIs need repeated blocks), Inspector stops decrypting that host for later connections in this session. Prefetch is skipped once a host is learned. List is capped and forgotten on restart unless you promote. Certificate-pinning apps still belong on Tunnel only." />
+                   Text="When origin TLS fails repeatedly under decrypt, or the origin server returns 403/429, Inspector stops decrypting that host for later connections in this session. List is capped and forgotten on restart unless you promote." />
         <TextBlock x:Name="LearningPausedBanner" IsVisible="False" Opacity="0.85" TextWrapping="Wrap"
                    Text="Learning paused — existing entries kept until forgotten." />
         <ListBox x:Name="LearnedList" MinHeight="96" MaxHeight="180"
                  AutomationProperties.AutomationId="ExcludedLearnedList" />
         <TextBlock x:Name="LearnedEmptyText" Opacity="0.6" Text="No hosts learned yet." />
         <StackPanel Orientation="Horizontal" Spacing="8">
-          <Button x:Name="PromoteLearnedButton" Content="Promote to tunnel-only" MinWidth="140"
+          <Button x:Name="PromoteLearnedButton" Content="Add to not decrypted hosts" MinWidth="160"
                   AutomationProperties.AutomationId="ExcludedLearnedPromote" />
           <Button x:Name="ForgetLearnedButton" Content="Forget" MinWidth="88"
                   AutomationProperties.AutomationId="ExcludedLearnedForget" />
diff --git a/src/Titanium.Inspector/Views/MainWindow.axaml b/src/Titanium.Inspector/Views/MainWindow.axaml
index 8f39e5873..5c801d603 100644
--- a/src/Titanium.Inspector/Views/MainWindow.axaml
+++ b/src/Titanium.Inspector/Views/MainWindow.axaml
@@ -47,7 +47,7 @@
                   IsChecked="{Binding SystemProxy, Mode=OneWay}"
                   Command="{Binding ToggleSystemProxyCommand}"
                   AutomationProperties.AutomationId="MenuToggleSystemProxy" />
-        <MenuItem Header="Proxy localhost" ToggleType="CheckBox"
+        <MenuItem Header="Capture local traffic" ToggleType="CheckBox"
                   IsChecked="{Binding ProxyLoopback, Mode=OneWay}"
                   Command="{Binding ToggleProxyLocalhostCommand}"
                   ToolTip.Tip="{Binding ProxyLocalhostTip}"
diff --git a/src/Titanium.Plus/Titanium.Plus.csproj b/src/Titanium.Plus/Titanium.Plus.csproj
index fc6a5d2b8..1d83c2657 100644
--- a/src/Titanium.Plus/Titanium.Plus.csproj
+++ b/src/Titanium.Plus/Titanium.Plus.csproj
@@ -7,7 +7,7 @@
     <ImplicitUsings>enable</ImplicitUsings>
     <SignAssembly>True</SignAssembly>
     <AssemblyOriginatorKeyFile>StrongNameKey.snk</AssemblyOriginatorKeyFile>
-    <VersionPrefix>7.0.7</VersionPrefix>
+    <VersionPrefix>7.0.8</VersionPrefix>
     <Authors>Jehonathan Thomas</Authors>
     <Description>Titanium Web Proxy Plus advanced features plugin (PolyForm Noncommercial).</Description>
     <PackageLicenseFile>LICENSE</PackageLicenseFile>
diff --git a/src/Titanium.Web.Proxy.Abstractions/Titanium.Web.Proxy.Abstractions.csproj b/src/Titanium.Web.Proxy.Abstractions/Titanium.Web.Proxy.Abstractions.csproj
index 207c98180..2cc9c3bfe 100644
--- a/src/Titanium.Web.Proxy.Abstractions/Titanium.Web.Proxy.Abstractions.csproj
+++ b/src/Titanium.Web.Proxy.Abstractions/Titanium.Web.Proxy.Abstractions.csproj
@@ -7,7 +7,7 @@
     <ImplicitUsings>enable</ImplicitUsings>
     <SignAssembly>True</SignAssembly>
     <AssemblyOriginatorKeyFile>StrongNameKey.snk</AssemblyOriginatorKeyFile>
-    <VersionPrefix>7.0.7</VersionPrefix>
+    <VersionPrefix>7.0.8</VersionPrefix>
     <Authors>Jehonathan Thomas</Authors>
     <Description>Shared contracts for Titanium Web Proxy routing, clusters, middleware, and plugins.</Description>
     <PackageLicenseExpression>MIT</PackageLicenseExpression>
diff --git a/src/Titanium.Web.Proxy.Configuration/Titanium.Web.Proxy.Configuration.csproj b/src/Titanium.Web.Proxy.Configuration/Titanium.Web.Proxy.Configuration.csproj
index f528b62c4..a76395b70 100644
--- a/src/Titanium.Web.Proxy.Configuration/Titanium.Web.Proxy.Configuration.csproj
+++ b/src/Titanium.Web.Proxy.Configuration/Titanium.Web.Proxy.Configuration.csproj
@@ -7,7 +7,7 @@
     <ImplicitUsings>enable</ImplicitUsings>
     <SignAssembly>True</SignAssembly>
     <AssemblyOriginatorKeyFile>StrongNameKey.snk</AssemblyOriginatorKeyFile>
-    <VersionPrefix>7.0.7</VersionPrefix>
+    <VersionPrefix>7.0.8</VersionPrefix>
     <Authors>Jehonathan Thomas</Authors>
     <Description>YAML/JSON configuration binding for Titanium Web Proxy CLI and reverse-proxy documents.</Description>
     <PackageLicenseExpression>MIT</PackageLicenseExpression>
diff --git a/src/Titanium.Web.Proxy/Properties/AssemblyInfo.cs b/src/Titanium.Web.Proxy/Properties/AssemblyInfo.cs
index 12fb34aa7..49a5abeca 100644
--- a/src/Titanium.Web.Proxy/Properties/AssemblyInfo.cs
+++ b/src/Titanium.Web.Proxy/Properties/AssemblyInfo.cs
@@ -77,5 +77,5 @@
 // file-properties version disagreed with the package it was published in. Keep both of the values
 // below equal to <VersionPrefix> (as Major.Minor.Build.0) whenever that property changes.
 
-[assembly: AssemblyVersion("7.0.7.0")]
-[assembly: AssemblyFileVersion("7.0.7.0")]
+[assembly: AssemblyVersion("7.0.8.0")]
+[assembly: AssemblyFileVersion("7.0.8.0")]
diff --git a/src/Titanium.Web.Proxy/Titanium.Web.Proxy.csproj b/src/Titanium.Web.Proxy/Titanium.Web.Proxy.csproj
index aea4a232f..b94a9005a 100644
--- a/src/Titanium.Web.Proxy/Titanium.Web.Proxy.csproj
+++ b/src/Titanium.Web.Proxy/Titanium.Web.Proxy.csproj
@@ -13,7 +13,7 @@
     <!-- Keep in sync with the AssemblyVersion/AssemblyFileVersion attributes in
          Properties/AssemblyInfo.cs on every bump - GenerateAssemblyInfo is false below, so the SDK
          does not derive those attributes from this property automatically. -->
-    <VersionPrefix>7.0.7</VersionPrefix>
+    <VersionPrefix>7.0.8</VersionPrefix>
     <!-- The library itself is the canonical implementation of the TWP001 experimental HTTP/3 APIs.
          Suppress the diagnostic internally; consumers will still see it. -->
     <!--
diff --git a/tests/Titanium.E2E.Tests/CliCommandE2ETests.cs b/tests/Titanium.E2E.Tests/CliCommandE2ETests.cs
index 3085fceb3..6d8df0a9b 100644
--- a/tests/Titanium.E2E.Tests/CliCommandE2ETests.cs
+++ b/tests/Titanium.E2E.Tests/CliCommandE2ETests.cs
@@ -126,7 +126,7 @@ public async Task Version_Prints70()
         using var harness = new CliProcessHarness();
         var (code, stdout, _) = await harness.RunOnceAsync(["version"]);
         Assert.AreEqual(0, code);
-        StringAssert.Contains(stdout, "7.0.7");
+        StringAssert.Contains(stdout, "7.0.8");
     }
 
     [TestMethod]
@@ -492,7 +492,7 @@ public async Task Version_Check_SoftNetwork()
         var combined = stdout + stderr;
         // 0 = up to date, 2 = update available, 1 = feed unreachable (transient CI / network).
         Assert.IsTrue(code is 0 or 1 or 2, $"Unexpected exit {code}. Output: {combined}");
-        StringAssert.Contains(combined, "7.0.7");
+        StringAssert.Contains(combined, "7.0.8");
         if (code == 1)
         {
             StringAssert.Contains(combined, "Unable to query update feed");
diff --git a/tests/Titanium.E2E.Tests/UiHeadless/AutomationIdCoverageHeadlessTests.cs b/tests/Titanium.E2E.Tests/UiHeadless/AutomationIdCoverageHeadlessTests.cs
index 4f66b2988..12b8154da 100644
--- a/tests/Titanium.E2E.Tests/UiHeadless/AutomationIdCoverageHeadlessTests.cs
+++ b/tests/Titanium.E2E.Tests/UiHeadless/AutomationIdCoverageHeadlessTests.cs
@@ -476,6 +476,14 @@ await fx.DispatchAsync(() =>
                 string.Equals(AutomationProperties.GetAutomationId(c), "ExcludedOnlyHosts", StringComparison.Ordinal)
                 || string.Equals(AutomationProperties.GetAutomationId(c), "ExcludedBuiltInList", StringComparison.Ordinal)
                 || string.Equals(AutomationProperties.GetAutomationId(c), "ExcludedProxyLoopback", StringComparison.Ordinal)));
+
+            var excludeHost = new ExcludeHostDialog(settings, "api.example.com");
+            AssertHasAutomationId(excludeHost, "ExcludeHostDialog");
+            AssertHasAutomationId(excludeHost, "ExcludeHostAdd");
+            AssertHasAutomationId(excludeHost, "ExcludeHostWildcardParent");
+            Assert.IsFalse(excludeHost.GetLogicalDescendants().OfType<Control>().Any(c =>
+                string.Equals(AutomationProperties.GetAutomationId(c), "ExcludeHostTunnelOnly", StringComparison.Ordinal)
+                || string.Equals(AutomationProperties.GetAutomationId(c), "ExcludeHostBypassProxy", StringComparison.Ordinal)));
         });
     }
 
diff --git a/tools/InspectorDesktopProbe/Scenarios/ChromeScenario.cs b/tools/InspectorDesktopProbe/Scenarios/ChromeScenario.cs
index 49b3c555a..a0a3c2a86 100644
--- a/tools/InspectorDesktopProbe/Scenarios/ChromeScenario.cs
+++ b/tools/InspectorDesktopProbe/Scenarios/ChromeScenario.cs
@@ -596,7 +596,6 @@ await harness.WaitUntilAsync(
                     {
                         if (!ProbeUiRobot.HasOtherWindows(harness.Window))
                             return true;
-                        ProbeUiRobot.TryClickInOtherWindows(harness.Window, "ExcludeHostTunnelOnly");
                         ProbeUiRobot.TryClickInOtherWindows(harness.Window, "ExcludeHostAdd");
                         return !ProbeUiRobot.HasOtherWindows(harness.Window);
                     },
diff --git a/tools/packaging/CHOCOLATEY_FOLLOWUP.md b/tools/packaging/CHOCOLATEY_FOLLOWUP.md
index b3bf18dec..3de15e09b 100644
--- a/tools/packaging/CHOCOLATEY_FOLLOWUP.md
+++ b/tools/packaging/CHOCOLATEY_FOLLOWUP.md
@@ -57,4 +57,8 @@ choco push returned **403 Forbidden** for both packages after 7.0.6-beta / 7.0.6
 
 ## 2026-09-11: hold Chocolatey for 7.0.7-beta
 
-`v7.0.7-beta` GitHub/NuGet cut intentionally **did not** push Chocolatey. Repo secret `CHOCOLATEY_API_KEY` was removed so `release.yml` `publish-chocolatey` skips. Do not dispatch `chocolatey-publish.yml` until earlier packages clear chocolatey.org moderator review; then restore the secret and push withheld versions in order (7.0.6* before 7.0.7-beta).
\ No newline at end of file
+`v7.0.7-beta` GitHub/NuGet cut intentionally **did not** push Chocolatey. Repo secret `CHOCOLATEY_API_KEY` was removed so `release.yml` `publish-chocolatey` skips. Do not dispatch `chocolatey-publish.yml` until earlier packages clear chocolatey.org moderator review; then restore the secret and push withheld versions in order (7.0.6* before 7.0.7-beta).
+
+## 2026-09-11: hold Chocolatey for 7.0.8-beta
+
+Same hold as 7.0.7-beta: `CHOCOLATEY_API_KEY` remains unset; `v7.0.8-beta` GitHub/NuGet cut intentionally **does not** push Chocolatey. Do not dispatch `chocolatey-publish.yml` until earlier packages clear moderator review.
\ No newline at end of file
diff --git a/tools/packaging/chocolatey/titanium-cli/titanium-cli.nuspec b/tools/packaging/chocolatey/titanium-cli/titanium-cli.nuspec
index 12daf7648..8b067e61f 100644
--- a/tools/packaging/chocolatey/titanium-cli/titanium-cli.nuspec
+++ b/tools/packaging/chocolatey/titanium-cli/titanium-cli.nuspec
@@ -2,7 +2,7 @@
 <package xmlns="http://schemas.microsoft.com/packaging/2015/06/nuspec.xsd">
   <metadata>
     <id>titanium-cli</id>
-    <version>7.0.7</version>
+    <version>7.0.8</version>
     <title>Titanium CLI</title>
     <authors>justcoding121</authors>
     <owners>justcoding121</owners>
@@ -18,7 +18,7 @@
     <tags>titanium proxy cli http https mitm</tags>
     <summary>Titanium Web Proxy command-line daemon (titanium / twp).</summary>
     <description>Titanium Web Proxy CLI. Self-contained win-x64 zip from GitHub Releases (titanium / twp).</description>
-    <releaseNotes>https://github.com/justcoding121/titanium-web-proxy/releases/tag/v7.0.7</releaseNotes>
+    <releaseNotes>https://github.com/justcoding121/titanium-web-proxy/releases/tag/v7.0.8</releaseNotes>
   </metadata>
   <files>
     <file src="tools\**" target="tools" />
diff --git a/tools/packaging/chocolatey/titanium-cli/tools/chocolateyInstall.ps1 b/tools/packaging/chocolatey/titanium-cli/tools/chocolateyInstall.ps1
index 51bb4a9c2..5e2a51f55 100644
--- a/tools/packaging/chocolatey/titanium-cli/tools/chocolateyInstall.ps1
+++ b/tools/packaging/chocolatey/titanium-cli/tools/chocolateyInstall.ps1
@@ -5,7 +5,7 @@ $toolsDir = "$(Split-Path -Parent $MyInvocation.MyCommand.Definition)"
 $packageArgs = @{
   packageName    = $env:ChocolateyPackageName
   unzipLocation  = $toolsDir
-  url64bit       = 'https://github.com/justcoding121/titanium-web-proxy/releases/download/v7.0.7/Titanium.Cli-win-x64.zip'
+  url64bit       = 'https://github.com/justcoding121/titanium-web-proxy/releases/download/v7.0.8/Titanium.Cli-win-x64.zip'
   checksum64     = 'EF79522355392ABB805C27F98426DB22DDB73BFE759500FFF4B41320F9B48DAB'
   checksumType64 = 'sha256'
 }
diff --git a/tools/packaging/chocolatey/titanium-inspector/titanium-inspector.nuspec b/tools/packaging/chocolatey/titanium-inspector/titanium-inspector.nuspec
index dd30fe2ce..d54f450ae 100644
--- a/tools/packaging/chocolatey/titanium-inspector/titanium-inspector.nuspec
+++ b/tools/packaging/chocolatey/titanium-inspector/titanium-inspector.nuspec
@@ -2,7 +2,7 @@
 <package xmlns="http://schemas.microsoft.com/packaging/2015/06/nuspec.xsd">
   <metadata>
     <id>titanium-inspector</id>
-    <version>7.0.7</version>
+    <version>7.0.8</version>
     <title>Titanium Inspector</title>
     <authors>justcoding121</authors>
     <owners>justcoding121</owners>
@@ -18,7 +18,7 @@
     <tags>titanium proxy inspector mitm http https debugger</tags>
     <summary>Desktop HTTP(S) traffic debugger for Titanium Web Proxy.</summary>
     <description>Titanium Inspector MITM debugger. Installs the signed win-x64 MSI from GitHub Releases. PolyForm Noncommercial 1.0.0.</description>
-    <releaseNotes>https://github.com/justcoding121/titanium-web-proxy/releases/tag/v7.0.7</releaseNotes>
+    <releaseNotes>https://github.com/justcoding121/titanium-web-proxy/releases/tag/v7.0.8</releaseNotes>
   </metadata>
   <files>
     <file src="tools\**" target="tools" />
diff --git a/tools/packaging/chocolatey/titanium-inspector/tools/chocolateyInstall.ps1 b/tools/packaging/chocolatey/titanium-inspector/tools/chocolateyInstall.ps1
index 1df9a7dac..de6c63425 100644
--- a/tools/packaging/chocolatey/titanium-inspector/tools/chocolateyInstall.ps1
+++ b/tools/packaging/chocolatey/titanium-inspector/tools/chocolateyInstall.ps1
@@ -3,7 +3,7 @@ $ErrorActionPreference = 'Stop'
 $packageArgs = @{
   packageName    = $env:ChocolateyPackageName
   fileType       = 'msi'
-  url64bit       = 'https://github.com/justcoding121/titanium-web-proxy/releases/download/v7.0.7/TitaniumInspector-win-x64.msi'
+  url64bit       = 'https://github.com/justcoding121/titanium-web-proxy/releases/download/v7.0.8/TitaniumInspector-win-x64.msi'
   checksum64     = '71A1A4CE095540EC5AF2765D6663EFC8540AC04A9B02B98F25CF3775FE18B5B7'
   checksumType64 = 'sha256'
   silentArgs     = '/qn /norestart'
diff --git a/tools/packaging/homebrew/titanium.rb b/tools/packaging/homebrew/titanium.rb
index e48be3165..843de8fed 100644
--- a/tools/packaging/homebrew/titanium.rb
+++ b/tools/packaging/homebrew/titanium.rb
@@ -10,7 +10,7 @@
 class Titanium < Formula
   desc "Titanium Web Proxy CLI (MITM / reverse proxy)"
   homepage "https://github.com/justcoding121/titanium-web-proxy"
-  version "7.0.7"
+  version "7.0.8"
   license "MIT"
 
   on_macos do
diff --git a/tools/packaging/winget/TitaniumCli.yaml b/tools/packaging/winget/TitaniumCli.yaml
index 0c275354c..8bd878cb1 100644
--- a/tools/packaging/winget/TitaniumCli.yaml
+++ b/tools/packaging/winget/TitaniumCli.yaml
@@ -2,7 +2,7 @@
 # Submit a PR to microsoft/winget-pkgs after a *signed* stable GitHub Release.
 # Authenticode publisher: Jehonathan Thomas.
 PackageIdentifier: justcoding121.TitaniumCli
-PackageVersion: 7.0.7
+PackageVersion: 7.0.8
 PackageLocale: en-US
 Publisher: justcoding121
 PackageName: Titanium CLI
@@ -17,7 +17,7 @@ Installers:
         PortableCommandAlias: titanium
       - RelativeFilePath: twp.exe
         PortableCommandAlias: twp
-    InstallerUrl: https://github.com/justcoding121/titanium-web-proxy/releases/download/v7.0.7/Titanium.Cli-win-x64.zip
+    InstallerUrl: https://github.com/justcoding121/titanium-web-proxy/releases/download/v7.0.8/Titanium.Cli-win-x64.zip
     InstallerSha256: EF79522355392ABB805C27F98426DB22DDB73BFE759500FFF4B41320F9B48DAB
 ManifestType: singleton
 ManifestVersion: 1.6.0
diff --git a/tools/packaging/winget/TitaniumInspector.yaml b/tools/packaging/winget/TitaniumInspector.yaml
index cd7b7e6a4..ef8b66839 100644
--- a/tools/packaging/winget/TitaniumInspector.yaml
+++ b/tools/packaging/winget/TitaniumInspector.yaml
@@ -3,7 +3,7 @@
 # Authenticode publisher: Jehonathan Thomas.
 
 PackageIdentifier: justcoding121.TitaniumInspector
-PackageVersion: 7.0.7
+PackageVersion: 7.0.8
 PackageLocale: en-US
 Publisher: justcoding121
 PublisherUrl: https://github.com/justcoding121/titanium-web-proxy
@@ -14,11 +14,11 @@ ShortDescription: Desktop HTTP(S) traffic debugger for Titanium Web Proxy.
 Installers:
   - Architecture: x64
     InstallerType: wix
-    InstallerUrl: https://github.com/justcoding121/titanium-web-proxy/releases/download/v7.0.7/TitaniumInspector-win-x64.msi
+    InstallerUrl: https://github.com/justcoding121/titanium-web-proxy/releases/download/v7.0.8/TitaniumInspector-win-x64.msi
     InstallerSha256: 71A1A4CE095540EC5AF2765D6663EFC8540AC04A9B02B98F25CF3775FE18B5B7
   - Architecture: x64
     InstallerType: portable
-    InstallerUrl: https://github.com/justcoding121/titanium-web-proxy/releases/download/v7.0.7/TitaniumInspector-win-x64.zip
+    InstallerUrl: https://github.com/justcoding121/titanium-web-proxy/releases/download/v7.0.8/TitaniumInspector-win-x64.zip
     InstallerSha256: 8E2FBDF669A9E9F98C494B629D0E23F5B7FB508311FAB57D5B658C4E70224B10
 ManifestType: singleton
 ManifestVersion: 1.6.0
diff --git a/website/docs/inspector.md b/website/docs/inspector.md
index c2593f323..be6a7af8e 100644
--- a/website/docs/inspector.md
+++ b/website/docs/inspector.md
@@ -13,7 +13,7 @@ Desktop debugger for HTTP and HTTPS traffic. Decrypt HTTPS (man-in-the-middle /
 
 HTTPS stays encrypted (opaque tunnels) until **Decrypt HTTPS** is on.
 
-Capture menu options (**Capturing**, **Decrypt HTTPS**, **System proxy**, **Proxy localhost**, auto-start prefs) show a check when on. **Allow Store apps…** (Windows) sits with System proxy. Preferences such as **Session retention…**, **Excluded hosts…**, **Ignore insecure server certificates**, and **Logging…** live under **Options**.
+Capture menu options (**Capturing**, **Decrypt HTTPS**, **System proxy**, **Capture local traffic**, auto-start prefs) show a check when on. **Allow Store apps…** (Windows) sits with System proxy. Preferences such as **Session retention…**, **Excluded hosts…**, **Ignore insecure server certificates**, and **Logging…** live under **Options**.
 
 ## Install
 
@@ -114,17 +114,17 @@ Applies to every captured request/response. On request, `abort` or `set-status`
 
 ### Excluded hosts
 
-**Options → Excluded hosts…** edits OS bypass, tunnel-only, and auto-tunnel learning. **Capture → Proxy localhost** controls whether loopback uses the system proxy (not a host list).
+**Options → Excluded hosts…** edits OS bypass, tunnel-only, and auto-tunnel learning. **Capture → Capture local traffic** controls whether loopback uses the system proxy (not a host list).
 
 | Layer | Effect |
 |-------|--------|
 | **OS bypass** | Traffic never reaches Inspector (when **System proxy** is on) |
-| **Tunnel only** | Session stays visible but HTTPS stays opaque |
-| **Auto-tunnel on decrypt failure** | Session-only list of hosts learned after origin TLS fails under decrypt, or after MITM HTTPS **403/429**. Document navigations auto-retry via meta-refresh onto an opaque CONNECT. **On by default.** Cap + TTL; cleared on restart unless you **Promote to tunnel-only**. Prefetch is skipped for learned hosts. |
+| **Not decrypted hosts** | Session stays visible but HTTPS stays opaque |
+| **Automatically not decrypt on decrypt failure** | Session-only list of hosts learned after origin TLS fails under decrypt, or after the origin server returns **403/429**. Document navigations auto-retry via meta-refresh onto an opaque CONNECT. **On by default.** Cap + TTL; cleared on restart unless you **Add to not decrypted hosts**. |
 
-Factory seeds keep common identity / SSO hosts on OS bypass so sign-in keeps working. Right-click a session → **Exclude host…**. Opaque sessions show why they stayed encrypted (including **auto-tunneled after decrypt failure**). Search: `is:opaque`, `opaque-reason:learned`. **Chrome QUIC** may bypass the proxy entirely — not fixable via host lists.
+Factory seeds keep common identity / SSO hosts on OS bypass so sign-in keeps working. Right-click a session → **Exclude host…** to stop reading that host's HTTPS (it still appears in the list). Opaque sessions show why they stayed encrypted (including **auto-tunneled after decrypt failure**). Search: `is:opaque`, `opaque-reason:learned`. **Chrome QUIC** may bypass the proxy entirely — not fixable via host lists.
 
-Hostile hosts that return 403/429 under MITM on a **document** navigation are recovered automatically (brief meta-refresh; no manual reload). Non-document 403/429 need repeated strikes before later CONNECTs tunnel. Certificate-pinning apps still belong on **Tunnel only**. Automation browsers may still see site captchas after tunneling.
+Hostile hosts that return 403/429 under MITM on a **document** navigation are recovered automatically (brief meta-refresh; no manual reload). Non-document 403/429 need repeated strikes before later CONNECTs tunnel. Automation browsers may still see site captchas after tunneling.
 
 ### Root certificate (Decrypt HTTPS)
 
@@ -160,7 +160,7 @@ Notes:
 - **Copy as curl / fetch:** with one session selected, generate a shell `curl` command or a JavaScript `fetch(...)` call from the request URL, method, headers, and body (CONNECT tunnels are skipped). The snippet is copied to the clipboard.
 - **Session Diff:** with exactly two sessions selected, compare method/URL/status/headers/bodies offline. The result opens on the Inspect **Diff** tab and is copied to the clipboard.
 - HAR / archive: Export all writes every captured session; Export selected writes the grid multi-selection. Import appends sessions from the file. Replay selected session.
-- System proxy, **Proxy localhost**, and root CA install / untrust / export; Device CA setup dialog for external devices; **Allow Store apps…** on Windows
+- System proxy, **Capture local traffic**, and root CA install / untrust / export; Device CA setup dialog for external devices; **Allow Store apps…** on Windows
 - Search (`method:GET status:2xx host:example process:chrome is:ws hide:tunnel`); quick filters: Hide CONNECT, Hide images, Errors only
 - Optional Plus panels when `Titanium.Plus.dll` is present
 
diff --git a/wiki/Home.md b/wiki/Home.md
index c8ee74e73..8eef07dc7 100644
--- a/wiki/Home.md
+++ b/wiki/Home.md
@@ -158,7 +158,7 @@ socksEndPoint.BeforeSslAuthenticate += (sender, e) =>
 proxyServer.AddEndPoint(socksEndPoint);
 ```
 
-See also website docs **library** → *Decrypt failure bypass (learned tunnel)* (`ProxyServer.EnableDecryptFailureBypass`) and Inspector **Excluded hosts → Auto-tunnel on decrypt failure**.
+See also website docs **library** → *Decrypt failure bypass (learned tunnel)* (`ProxyServer.EnableDecryptFailureBypass`) and Inspector **Excluded hosts → Automatically not decrypt on decrypt failure**.
 
 ## Decrypting HTTPS