diff --git a/.github/workflows/main.yml b/.github/workflows/main.yml
index 8bf471a..bf50baa 100644
--- a/.github/workflows/main.yml
+++ b/.github/workflows/main.yml
@@ -56,6 +56,14 @@ jobs:
       - name: "PHP CS Fixer (dry-run)"
         run: composer cs-fixer
 
+      - name: "Setup Node.js"
+        uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
+        with:
+          node-version: '24.8.0'
+
+      - name: "JavaScript tests"
+        run: node --test tests/JavaScript/debugbar.test.js
+
   tests:
     name: "Tests (PHP ${{ matrix.php }}, Phalcon ${{ matrix.variant }})"
     permissions:
diff --git a/CHANGELOG.md b/CHANGELOG.md
index d9c5b2d..357c267 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -6,7 +6,30 @@ All notable changes to `phalcon/debugbar` are documented here. The format is bas
 
 ### Added
 
+- A memory collector reports current and peak PHP request usage. Time and Memory
+  are enabled by default and open from compact indicators on the right instead of
+  duplicate tabs; the indicators remain available when History is disabled.
 - Optional, extensible collector summaries rendered as headline metrics above a panel. The database collector uses them to report total queries, duplicate runs (executions after the first), and accumulated SQL time, and marks repeated statements with their execution count.
+- Optional browser-isolated request history with filesystem retention and an
+  internal `GET/DELETE /_debugbar/open` endpoint. A dedicated HttpOnly, SameSite=Lax
+  browser-session cookie keeps History independent from the application's PHP
+  session, is marked Secure on HTTPS, and is appended without replacing application
+  cookies; clients that do not return it create no storage. The endpoint resolves
+  the final base URI at request time, leaves application routes and shared responses
+  untouched, and is excluded from debug-bar collection and injection. Stored
+  payloads are versioned, bounded, expired automatically, and listed through
+  metadata sidecars. History requires an explicit absolute writable path and is
+  disabled by default. Storage creation is serialized and capped across browser
+  identities, with least-recently-updated eviction.
+
+### Fixed
+
+- History now validates storage writability during boot, removes browser
+  directories emptied by reads, uses portable glob paths on Windows, and adds
+  `X-Content-Type-Options: nosniff` to its JSON responses.
+- The browser asset exports its test helpers only outside a DOM environment and
+  discovers request method and URI through collector widget metadata instead of a
+  hard-coded collector name.
 
 ## [0.4.0](https://github.com/phalcon/debugbar/releases/tag/v0.4.0) (2026-07-14)
 
@@ -34,7 +57,7 @@ All notable changes to `phalcon/debugbar` are documented here. The format is bas
 
 ### Added
 
-- A `logger` collector and `Phalcon\DebugBar\Logger\Adapter`. Attach the adapter to the application logger and every item logged through `Phalcon\Logger` is captured in the bar's "Logs" tab, separate from the manual `messages` collector. Each entry keeps the log level, message, and PSR-3 context; the context renders as a collapsible, pretty-printed JSON detail. Forwarding runs through the new `DebugBar::addLog()` and no-ops when the collector is disabled. [#6](https://github.com/phalcon/debugbar/issues/6)
+- A `logger` collector and `Phalcon\DebugBar\Logger\Adapter`. Attach the adapter to the application logger and every item logged through `Phalcon\Logger` is captured in the `Logs` panel, separate from the manual `messages` collector. Each entry keeps the log level, message, and PSR-3 context; the context renders as a collapsible, pretty-printed JSON detail. Forwarding runs through the new `DebugBar::addLog()` and no-ops when the collector is disabled. [#6](https://github.com/phalcon/debugbar/issues/6)
 
 ### Fixed
 
diff --git a/docs/index.md b/docs/index.md
index 9905402..fccb968 100644
--- a/docs/index.md
+++ b/docs/index.md
@@ -35,7 +35,7 @@ The remainder of this document covers the debug bar.
 
 ## Registering the Debug Bar
 
-The bar is booted by `Phalcon\DebugBar\Provider`. It takes the MVC application and an optional configuration array. Its only coupling to the application is the application's events manager, so the application must have one set before the bar boots.
+The bar is booted by `Phalcon\DebugBar\Provider`. It takes the MVC application and an optional configuration array. The application must have an events manager set before the bar boots. The provider does not add or modify application routes.
 
 ```php
 <?php
@@ -67,12 +67,18 @@ The second argument to `Provider` is a nested array. Every key is optional.
 | `access.allow_ips` | `list<string>`            | `[]` (any client)        | Client IP allowlist. Empty allows any address.                   |
 | `access.callback`  | `(Closure(): bool)\|null` | `null`                   | Extra gate. When present, it must also return `true`.            |
 | `assets.nonce`     | `string\|null`            | `null`                   | CSP nonce stamped on the injected `<style>` and `<script>` tags. |
-| `collectors`       | `array<string, bool>`     | all enabled              | Per-collector switch, keyed by collector name.                   |
+| `collectors`       | `array<string, bool>`     | all applicable enabled   | Per-collector switch, keyed by collector name.                   |
 | `enabled`          | `bool`                    | `true`                   | Master switch. When `false`, `boot()` returns after the gate.    |
 | `env.blocked`      | `list<string>`            | `['production', 'prod']` | Environment values that block the bar (case-insensitive).        |
 | `env.strict`       | `bool`                    | `false`                  | When `true`, `boot()` throws in a blocked/undefined environment instead of returning silently. |
 | `env.var`          | `string`                  | `APP_ENV`                | Environment variable inspected by the gate.                      |
 | `headers`          | `bool`                    | `true`                   | Emit the `X-Debug-Bar` diagnostic header.                        |
+| `history.enabled`  | `bool`                    | `false`                  | Store and browse recent requests for the active browser.         |
+| `history.url`      | `string`                  | `/_debugbar/open`        | Internal GET/DELETE endpoint path, relative to the application's base URI. |
+| `history.path`     | `string`                  | required when enabled    | Absolute writable storage directory; keep it outside the document root. |
+| `history.max_requests` | `int`                 | `100`                    | Maximum stored requests per browser.                             |
+| `history.max_browsers` | `int`                 | `10`                     | Maximum browser directories; the least recently updated is evicted first. |
+| `history.ttl_seconds` | `int`                  | `86400`                  | Lifetime in seconds; active-browser entries are checked immediately. |
 | `redact.hidden`    | `list<string>`            | `[]`                     | Keys dropped from the output entirely.                           |
 | `redact.mask`      | `list<string>`            | `[]`                     | Extra keys whose values are masked (added to the defaults).      |
 
@@ -85,13 +91,100 @@ use Phalcon\DebugBar\Provider;
     'env'        => ['var' => 'APP_ENV', 'blocked' => ['production', 'staging']],
     'access'     => ['allow_ips' => ['127.0.0.1', '10.0.0.5']],
     'collectors' => ['cache' => false, 'view' => false],
+    'history'    => [
+        'enabled'      => true,
+        'path'         => dirname(__DIR__) . '/runtime/debugbar',
+        'max_requests' => 100,
+        'max_browsers' => 10,
+        'ttl_seconds'  => 86400,
+    ],
     'redact'     => ['mask' => ['api_key'], 'hidden' => ['secret_question']],
 ]))->boot();
 ```
 
+When history is enabled, the provider registers its internal history controller
+in the DI container and selects it on `application:beforeHandleRequest` for
+`GET /_debugbar/open` and `DELETE /_debugbar/open`. The controller receives its
+storage and access gate directly; no separate history services or routes are
+registered. The `url` service is read only when a request is handled, after app
+providers and module services have registered their final definitions. If its
+base URI is `/app1/` or `https://example.test/app1/`, the endpoint path is
+`/app1/_debugbar/open`. The internal controller creates its own response instead
+of resolving the application's shared `response` during boot. `history.url` must
+start with `/` and cannot contain a scheme, host, query, or fragment.
+The endpoint uses the application's normal MVC lifecycle, so
+module initialization and application event listeners still run. A GET
+without an `id` returns the recent request metadata; `?id=<request-id>` returns
+a stored payload. DELETE clears the active browser's stored requests.
+Only an actual HTTP `DELETE` is accepted for clearing; request method overrides
+such as `_method=DELETE` are rejected.
+
+Dispatcher ACL plugins also see the internal controller. Allow its namespace
+before applying application controller rules:
+
+```php
+<?php
+
+use Phalcon\DebugBar\History\HistoryEndpoint;
+
+if (HistoryEndpoint::CONTROLLER_NAMESPACE === $dispatcher->getNamespaceName()) {
+    return true;
+}
+```
+
+History endpoint responses include `X-Content-Type-Options: nosniff` and are
+excluded from collection, diagnostic headers, HTML injection, and persistence.
+
+The request indicator on the right (search icon, HTTP method, and URI) replaces a
+dedicated History tab. It initially identifies the current request. Clicking it
+closes any open collector panel and opens the history browser; clicking it again
+closes the browser. Opening a collector panel also closes history, so only one
+panel is visible at a time. The browser provides refresh and clear controls.
+Selecting a stored request closes history, replaces the complete collector payload,
+and updates the controls, request time, current memory usage, method, and URI
+without navigating away from the page. The collector panel that was open before
+History is reopened with the selected request's data. If request metadata is unavailable, the
+history control uses `History` as its fallback label. An empty history displays
+`No stored requests` and leaves the clear control disabled.
+
+Request history is disabled by default. When enabled, it can still be switched
+off through `collectors => ['history' => false]`; in that case no endpoint or storage is
+registered. `history.path` must be an absolute path, configured explicitly, and
+writable by the web-server user. The provider creates the directory when needed
+and verifies its writability during boot, after the environment and collector
+gates allow History to start. Storage is isolated by a SHA-256 hash
+of a random, HttpOnly, SameSite=Lax debug bar cookie. The cookie is also marked
+Secure on HTTPS and lasts for the browser session. It is sent through PHP's native
+cookie mechanism so it does not replace cookies queued by the application. The bar
+never reads, starts, or changes the application's PHP session, so session ID
+regeneration does not hide earlier requests. The first allowed response for a
+browser sets the cookie but is not stored; storage begins with the next request
+carrying that cookie. Closing the browser discards the identity while its files
+remain eligible for cleanup until `history.ttl_seconds` expires. Clients that do
+not retain cookies never create storage directories. The number of browser
+directories is capped by `history.max_browsers`; creation is serialized and evicts
+the least recently updated browser directory before admitting another identity.
+This bounds forged or repeatedly rotated cookie identities even when the access
+allowlist is empty. Each stored
+entry distinguishes the request start time (`requested_at`) from the time it was
+persisted (`stored_at`). If the server does not expose `REQUEST_TIME_FLOAT`, the
+persistence time is used for both values. Each payload has a small metadata sidecar,
+so listing requests does not read the full collector payload. If a sidecar is
+missing, the versioned payload is used as a fallback; incompatible stored payloads
+are rejected. Reads clean expired entries only from the active browser so opening the browser remains
+fast on network filesystems. A rate-limited collection during request storage
+removes expired entries, abandoned temporary files, and empty directories from all
+browsers at most once per hour (or once per configured TTL when it is shorter).
+For a debug host reachable by other users, restrict History with
+`access.allow_ips` and/or `access.callback`.
+
 ## Collectors
 
-Each collector contributes one tab. A collector reads its data in one of four ways:
+Collectors contribute data to the bar. Most renderable collectors appear as tabs.
+Time and Memory are enabled by default and appear once as compact indicators on
+the right; clicking an indicator opens or closes its collector panel. Their
+placement does not depend on request history.
+A collector reads its data in one of four ways:
 
 - **Snapshot** - reads state when the response is assembled.
 - **Streamed** - subscribes to framework events and accumulates as they fire.
@@ -105,6 +198,7 @@ Each collector contributes one tab. A collector reads its data in one of four wa
 | `database`   | SQL statements, bindings, timings, and query summary     | streamed          |
 | `exceptions` | Throwables, with stack traces                            | manual + streamed |
 | `logger`     | Log entries captured from a `Phalcon\Logger` adapter     | adapter           |
+| `memory`     | Current and peak memory used by the PHP request            | snapshot          |
 | `messages`   | Messages recorded through the facade                     | manual            |
 | `request`    | Request method, URI, query, post, and headers (redacted) | snapshot          |
 | `route`      | Matched module, controller, action, and parameters       | streamed          |
@@ -175,7 +269,7 @@ The `exceptions` collector also captures throwables automatically. It subscribes
 
 ## Capturing Logs
 
-`Phalcon\DebugBar\Logger\Adapter` is a `Phalcon\Logger` adapter. Attach it to the application logger and every logged item is captured in the bar's `logger` collector, shown in the "Logs" tab. This is separate from the `messages` collector: `logger` is the automatic application log, while `messages` is what the code records by hand through the `Debug` facade.
+`Phalcon\DebugBar\Logger\Adapter` is a `Phalcon\Logger` adapter. Attach it to the application logger and every logged item is captured in the bar's `logger` collector, shown in the `Logs` panel. This is separate from the `messages` collector: `logger` is the automatic application log, while `messages` is what the code records by hand through the `Debug` facade.
 
 - Phalcon 5 (the C extension) exposes the `Phalcon\Logger` adapter contract the adapter builds on.
 - Phalcon 6 (`phalcon/phalcon`) exposes the same contract. The adapter attaches the same way on either runtime.
@@ -240,13 +334,27 @@ use Phalcon\DebugBar\Provider;
 
 The bar's CSS and JavaScript are minified and injected inline; the bar has no external asset to host or serve. On CSP-restricted pages, set `assets.nonce` so the inline tags carry a nonce.
 
-The bar sits at the bottom of the page. Each collector is a tab; a tab shows a badge when the collector reports a count or a summary value. Clicking a tab opens its panel:
-
-Collectors may expose a summary above their panel. The database collector reports the total query count, duplicate runs, and accumulated SQL time. A duplicate run is each execution of a normalized statement after its first execution: running the same statement three times contributes two duplicate runs. These metrics remain visible with zero values when no queries are executed. Duplicate detection deliberately ignores binding values; repeated statements are highlighted and show their total execution count.
-
-- **grid** panels (version, request, config, session, route) render a key and value table.
+The bar sits at the bottom of the page. Interactive collectors appear as tabs on
+the left; a tab shows a badge when the collector reports a count or summary value.
+Time and Memory appear as compact indicators on the right instead of duplicate tabs.
+Their indicators remain available whether History is enabled or disabled.
+Each participating collector declares its own indicator and semantic value path;
+the History collector does not depend on the Time or Memory payload shape.
+The rightmost control combines
+a search icon with the current HTTP method and URI; it opens or closes request
+history instead of using a dedicated History tab. The history browser and collector
+panels are mutually exclusive, so opening either closes the other. Selecting a
+stored request closes history and updates the entire bar with that request's data.
+
+Interactive tabs use the following panel types:
+
+- **grid** panels (version, request, config, session, route, memory) render a key and value table.
 - **list** panels (time, messages, database, view, cache) render labelled rows.
 - **exceptions** panels render one collapsible entry per throwable; the summary line stays visible and expands to the stack trace.
 - **logs** panels (logger) render one entry per logged item; an entry with context is collapsible - the level and message stay visible and expand to the context.
 
+Time and Memory open their panels from the indicators on the right.
+
+Collectors may expose a summary above their panel. The database collector reports the total query count, duplicate runs, and accumulated SQL time. A duplicate run is each execution of a normalized statement after its first execution: running the same statement three times contributes two duplicate runs. These metrics remain visible with zero values when no queries are executed. Duplicate detection deliberately ignores binding values; repeated statements are highlighted and show their total execution count.
+
 A handle at the right of the tab row collapses the whole bar to a corner button, so it never covers the host page's own controls. The collapsed state is remembered across page loads.
diff --git a/resources/assets/debugbar.css b/resources/assets/debugbar.css
index 66b2f47..085229c 100644
--- a/resources/assets/debugbar.css
+++ b/resources/assets/debugbar.css
@@ -28,7 +28,9 @@
 }
 
 #phalcon-debugbar.is-collapsed .phalcon-debugbar-body,
-#phalcon-debugbar.is-collapsed .phalcon-debugbar-tabs {
+#phalcon-debugbar.is-collapsed .phalcon-debugbar-history-browser,
+#phalcon-debugbar.is-collapsed .phalcon-debugbar-tabs,
+#phalcon-debugbar.is-collapsed .phalcon-debugbar-indicators {
     display: none;
 }
 
@@ -93,6 +95,77 @@
     background: rgba(0, 0, 0, 0.25);
 }
 
+#phalcon-debugbar .phalcon-debugbar-indicators {
+    display: flex;
+    flex: 0 1 auto;
+    min-width: 0;
+    align-items: stretch;
+}
+
+#phalcon-debugbar .phalcon-debugbar-indicator {
+    display: inline-flex;
+    min-width: 0;
+    align-items: center;
+    gap: 6px;
+    padding: 7px 10px;
+    border-left: 1px solid #2b2b40;
+    color: #b9b9d4;
+    white-space: nowrap;
+}
+
+#phalcon-debugbar .phalcon-debugbar-indicator-icon {
+    width: 15px;
+    height: 15px;
+    flex: 0 0 auto;
+    fill: none;
+    stroke: #a78bfa;
+    stroke-width: 1.5;
+    stroke-linecap: round;
+    stroke-linejoin: round;
+}
+
+#phalcon-debugbar .phalcon-debugbar-indicator-value {
+    color: #ffffff;
+    font-weight: 700;
+}
+
+#phalcon-debugbar .phalcon-debugbar-request-control {
+    max-width: 25vw;
+}
+
+#phalcon-debugbar button.phalcon-debugbar-request-control,
+#phalcon-debugbar button.phalcon-debugbar-metric {
+    background: transparent;
+    border: 0;
+    border-left: 1px solid #2b2b40;
+    font: inherit;
+    cursor: pointer;
+}
+
+#phalcon-debugbar button.phalcon-debugbar-request-control:hover,
+#phalcon-debugbar button.phalcon-debugbar-request-control.is-active,
+#phalcon-debugbar button.phalcon-debugbar-metric:hover {
+    background: #26263a;
+}
+
+#phalcon-debugbar button.phalcon-debugbar-metric.is-active {
+    background: #7c3aed;
+}
+
+#phalcon-debugbar button.phalcon-debugbar-metric.is-active .phalcon-debugbar-indicator-icon {
+    stroke: #ffffff;
+}
+
+#phalcon-debugbar .phalcon-debugbar-request-method {
+    color: #a78bfa;
+    font-weight: 700;
+}
+
+#phalcon-debugbar .phalcon-debugbar-request-uri {
+    overflow: hidden;
+    text-overflow: ellipsis;
+}
+
 #phalcon-debugbar .phalcon-debugbar-toggle {
     flex: 0 0 auto;
     padding: 7px 12px;
@@ -145,6 +218,143 @@
     font-size: 13px;
 }
 
+#phalcon-debugbar .phalcon-debugbar-history-browser {
+    display: none;
+    max-height: 210px;
+    overflow: auto;
+    background: #101018;
+    border-bottom: 1px solid #2b2b40;
+}
+
+#phalcon-debugbar .phalcon-debugbar-history-toolbar {
+    position: sticky;
+    top: 0;
+    z-index: 1;
+    display: flex;
+    align-items: center;
+    justify-content: space-between;
+    gap: 12px;
+    padding: 7px 14px;
+    background: #181824;
+    border-bottom: 1px solid #2b2b40;
+}
+
+#phalcon-debugbar .phalcon-debugbar-history-title {
+    color: #d5d5e8;
+    font-size: 12px;
+}
+
+#phalcon-debugbar .phalcon-debugbar-history-actions {
+    display: flex;
+    gap: 6px;
+}
+
+#phalcon-debugbar .phalcon-debugbar-history-action {
+    padding: 3px 9px;
+    border: 1px solid #454563;
+    border-radius: 3px;
+    background: #29293d;
+    color: #d5d5e8;
+    font: inherit;
+    cursor: pointer;
+}
+
+#phalcon-debugbar .phalcon-debugbar-history-action:hover {
+    background: #353550;
+    color: #ffffff;
+}
+
+#phalcon-debugbar .phalcon-debugbar-history-action.is-danger {
+    border-color: #7f3445;
+    color: #ff9aac;
+}
+
+#phalcon-debugbar .phalcon-debugbar-history-action.is-danger:hover {
+    background: #542532;
+}
+
+#phalcon-debugbar .phalcon-debugbar-history-action:disabled {
+    opacity: 0.5;
+    cursor: default;
+}
+
+#phalcon-debugbar .phalcon-debugbar-history-list {
+    display: flex;
+    flex-direction: column;
+}
+
+#phalcon-debugbar .phalcon-debugbar-history-request {
+    display: grid;
+    grid-template-columns: 58px minmax(180px, 1fr) 48px 210px;
+    gap: 10px;
+    align-items: center;
+    padding: 5px 14px;
+    background: transparent;
+    border: 0;
+    border-bottom: 1px solid #232334;
+    color: #b9b9d4;
+    font: inherit;
+    text-align: left;
+    cursor: pointer;
+}
+
+#phalcon-debugbar .phalcon-debugbar-history-request:hover {
+    background: #26263a;
+    color: #ffffff;
+}
+
+#phalcon-debugbar .phalcon-debugbar-history-request.is-selected {
+    background: #26263a;
+    color: #ffffff;
+    box-shadow: inset 3px 0 #7c3aed;
+}
+
+#phalcon-debugbar .phalcon-debugbar-history-method {
+    color: #a78bfa;
+    font-weight: 700;
+}
+
+#phalcon-debugbar .phalcon-debugbar-history-uri {
+    overflow: hidden;
+    text-overflow: ellipsis;
+    white-space: nowrap;
+}
+
+#phalcon-debugbar .phalcon-debugbar-history-status,
+#phalcon-debugbar .phalcon-debugbar-history-time {
+    color: #8f8faa;
+}
+
+#phalcon-debugbar .phalcon-debugbar-history-loading,
+#phalcon-debugbar .phalcon-debugbar-history-empty {
+    padding: 8px 14px;
+    color: #8f8faa;
+}
+
+#phalcon-debugbar .phalcon-debugbar-history-error {
+    padding: 8px 14px;
+    color: #ff6b81;
+}
+
+@media (max-width: 760px) {
+    #phalcon-debugbar .phalcon-debugbar-indicator {
+        padding-right: 7px;
+        padding-left: 7px;
+    }
+
+    #phalcon-debugbar .phalcon-debugbar-request-control {
+        max-width: 32vw;
+    }
+
+    #phalcon-debugbar .phalcon-debugbar-history-request {
+        grid-template-columns: 52px minmax(120px, 1fr) 42px;
+    }
+
+    #phalcon-debugbar .phalcon-debugbar-history-time {
+        display: none;
+    }
+}
+
 #phalcon-debugbar table {
     width: 100%;
     border-collapse: collapse;
diff --git a/resources/assets/debugbar.js b/resources/assets/debugbar.js
index 437327d..85a0edf 100644
--- a/resources/assets/debugbar.js
+++ b/resources/assets/debugbar.js
@@ -7,15 +7,17 @@
  * file that was distributed with this source code.
  *
  * Phalcon DebugBar client. Reads the JSON payload injected by the PHP renderer
- * and builds the bottom bar: one tab per collector, a panel per tab. It is
- * self-describing where possible (meta.widgets) and infers the panel type from
- * the data shape otherwise. The bar collapses to a bottom-right handle so it
- * never permanently covers the host page's own controls.
+ * and builds the bottom bar: interactive collector tabs on the left and compact
+ * request metrics on the right. It is self-describing where possible
+ * (meta.widgets) and infers the panel type from the data shape otherwise. The
+ * bar collapses to a bottom-right handle so it never permanently covers the
+ * host page's own controls.
  */
 (function () {
     'use strict';
 
     var STORAGE_KEY = 'phalcon-debugbar-collapsed';
+    var HISTORY_VERSION = 1;
 
     function ready(fn) {
         if (document.readyState !== 'loading') {
@@ -36,6 +38,133 @@
         return node;
     }
 
+    function svgElement(tag, attributes) {
+        var node = document.createElementNS('http://www.w3.org/2000/svg', tag);
+        Object.keys(attributes).forEach(function (name) {
+            node.setAttribute(name, attributes[name]);
+        });
+        return node;
+    }
+
+    function indicatorIcon(name) {
+        var svg = svgElement('svg', {
+            'aria-hidden': 'true',
+            'class': 'phalcon-debugbar-indicator-icon',
+            'viewBox': '0 0 18 18'
+        });
+
+        if (name === 'clock') {
+            svg.appendChild(svgElement('circle', {cx: '9', cy: '9', r: '6.5'}));
+            svg.appendChild(svgElement('path', {d: 'M9 5.2V9l2.8 1.7'}));
+            return svg;
+        }
+
+        if (name === 'search') {
+            svg.appendChild(svgElement('circle', {cx: '7.5', cy: '7.5', r: '4.5'}));
+            svg.appendChild(svgElement('path', {d: 'M10.8 10.8l4 4'}));
+            return svg;
+        }
+
+        function gear(cx, cy, radius) {
+            var group = svgElement('g', {});
+            group.appendChild(svgElement('circle', {cx: cx, cy: cy, r: radius}));
+            group.appendChild(svgElement('circle', {cx: cx, cy: cy, r: radius / 3}));
+            for (var index = 0; index < 8; index++) {
+                var angle = index * Math.PI / 4;
+                group.appendChild(svgElement('line', {
+                    x1: cx + Math.cos(angle) * radius,
+                    y1: cy + Math.sin(angle) * radius,
+                    x2: cx + Math.cos(angle) * (radius + 1.5),
+                    y2: cy + Math.sin(angle) * (radius + 1.5)
+                }));
+            }
+            svg.appendChild(group);
+        }
+
+        gear(6.2, 10.5, 3.1);
+        gear(12.2, 6.2, 2.4);
+        return svg;
+    }
+
+    function metricIndicator(icon, label, value) {
+        var indicator = el('button', 'phalcon-debugbar-indicator phalcon-debugbar-metric');
+        indicator.type = 'button';
+        indicator.title = label;
+        indicator.appendChild(indicatorIcon(icon));
+        indicator.appendChild(el('span', 'phalcon-debugbar-indicator-value', scalar(value)));
+        return indicator;
+    }
+
+    function valueAtPath(value, path) {
+        if (!Array.isArray(path)) {
+            return undefined;
+        }
+
+        path.forEach(function (key) {
+            value = value && typeof value === 'object' ? value[key] : undefined;
+        });
+
+        return value;
+    }
+
+    function renderIndicators(mount, data, widgets, onHistoryToggle, historyOpen, requestMetadata, bindPanel) {
+        mount.innerHTML = '';
+        var historyTrigger = null;
+
+        Object.keys(widgets).forEach(function (collector) {
+            var definition = (widgets[collector] || {}).indicator;
+            if (!definition || !data[collector]) {
+                return;
+            }
+            var value = valueAtPath(data[collector], definition.path);
+            var indicator = metricIndicator(
+                scalar(definition.icon),
+                scalar(definition.label),
+                value
+            );
+            bindPanel(collector, indicator);
+            mount.appendChild(indicator);
+        });
+
+        var requestName = Object.keys(widgets).find(function (name) {
+            return widgets[name] && widgets[name].request;
+        });
+        var requestDefinition = requestName ? widgets[requestName].request : {};
+        var request = requestName ? (data[requestName] || {}) : {};
+        var method = scalar(valueAtPath(request, requestDefinition.method || []));
+        var uri = scalar(valueAtPath(request, requestDefinition.uri || []));
+        requestMetadata = requestMetadata || {};
+        method = method || scalar(requestMetadata.method);
+        uri = uri || scalar(requestMetadata.uri);
+        if (method || uri || onHistoryToggle) {
+            var requestControl = el(
+                onHistoryToggle ? 'button' : 'span',
+                'phalcon-debugbar-indicator phalcon-debugbar-request-control'
+            );
+            var requestLabel = (method + ' ' + uri).trim() || 'History';
+            requestControl.title = onHistoryToggle
+                ? (historyOpen ? 'Close request history: ' : 'Open request history: ') + requestLabel
+                : requestLabel;
+            if (onHistoryToggle) {
+                requestControl.appendChild(indicatorIcon('search'));
+            }
+            requestControl.appendChild(el('strong', 'phalcon-debugbar-request-method', method));
+            requestControl.appendChild(el('span', 'phalcon-debugbar-request-uri', uri || 'History'));
+            if (onHistoryToggle) {
+                requestControl.type = 'button';
+                requestControl.classList.add('is-history-trigger');
+                requestControl.setAttribute('data-history-label', requestLabel);
+                requestControl.classList.toggle('is-active', Boolean(historyOpen));
+                requestControl.setAttribute('aria-expanded', historyOpen ? 'true' : 'false');
+                requestControl.addEventListener('click', onHistoryToggle);
+                historyTrigger = requestControl;
+            }
+            mount.appendChild(requestControl);
+        }
+
+        return historyTrigger;
+    }
+
     function titleize(name) {
         return String(name)
             .replace(/[-_]+/g, ' ')
@@ -209,6 +338,238 @@
         return badge !== null && badge !== undefined && badge !== '' && badge !== 0;
     }
 
+    function historyUrl(url, id) {
+        if (!id) {
+            return url;
+        }
+
+        return url + (url.indexOf('?') === -1 ? '?' : '&') + 'id=' + encodeURIComponent(id);
+    }
+
+    function requestJson(url, options) {
+        options = options || {};
+        options.credentials = 'same-origin';
+        options.headers = options.headers || {};
+        options.headers.Accept = 'application/json';
+
+        return window.fetch(url, options).then(function (response) {
+            if (!response.ok) {
+                throw new Error('HTTP ' + response.status);
+            }
+
+            return response.json();
+        });
+    }
+
+    function loadJson(url) {
+        return requestJson(url, {});
+    }
+
+    function createHistoryRequestGuard(isCurrent) {
+        var clearInProgress = false;
+        var listGeneration = 0;
+        var detailGeneration = 0;
+
+        return {
+            startList: function () {
+                if (clearInProgress) {
+                    return null;
+                }
+
+                detailGeneration++;
+                return ++listGeneration;
+            },
+            startDetail: function () {
+                if (clearInProgress) {
+                    return null;
+                }
+
+                return ++detailGeneration;
+            },
+            startClear: function () {
+                if (clearInProgress) {
+                    return null;
+                }
+
+                clearInProgress = true;
+                detailGeneration++;
+
+                return ++listGeneration;
+            },
+            finishClear: function (generation) {
+                if (!clearInProgress || !isCurrent() || generation !== listGeneration) {
+                    return false;
+                }
+
+                clearInProgress = false;
+
+                return true;
+            },
+            isListCurrent: function (generation) {
+                return isCurrent() && generation === listGeneration;
+            },
+            isDetailCurrent: function (generation) {
+                return isCurrent() && generation === detailGeneration;
+            }
+        };
+    }
+
+    function renderHistoryBrowser(mount, panel, selectedId, onSelect, onClear, isCurrent) {
+        mount.innerHTML = '';
+
+        var url = panel && typeof panel.url === 'string' ? panel.url : '';
+        if (!url || typeof window.fetch !== 'function') {
+            mount.style.display = 'none';
+            return;
+        }
+
+        mount.style.display = 'block';
+        var toolbar = el('div', 'phalcon-debugbar-history-toolbar');
+        var title = el('strong', 'phalcon-debugbar-history-title', 'Request history');
+        var actions = el('div', 'phalcon-debugbar-history-actions');
+        var refreshButton = el('button', 'phalcon-debugbar-history-action', 'Refresh');
+        var clearButton = el('button', 'phalcon-debugbar-history-action is-danger', 'Clear');
+        var content = el('div', 'phalcon-debugbar-history-content');
+        var requestGuard = createHistoryRequestGuard(isCurrent);
+        refreshButton.type = 'button';
+        clearButton.type = 'button';
+        clearButton.disabled = true;
+        actions.appendChild(refreshButton);
+        actions.appendChild(clearButton);
+        toolbar.appendChild(title);
+        toolbar.appendChild(actions);
+        mount.appendChild(toolbar);
+        mount.appendChild(content);
+
+        function message(className, text) {
+            content.innerHTML = '';
+            content.appendChild(el('div', className, text));
+        }
+
+        function refresh() {
+            var generation = requestGuard.startList();
+            if (generation === null) {
+                return;
+            }
+
+            refreshButton.disabled = true;
+            message('phalcon-debugbar-history-loading', 'Loading request history...');
+
+            loadJson(url).then(function (result) {
+                if (!requestGuard.isListCurrent(generation)) {
+                    return;
+                }
+
+                content.innerHTML = '';
+                var requests = result && Array.isArray(result.requests) ? result.requests : [];
+                clearButton.disabled = !requests.length;
+                if (!requests.length) {
+                    content.appendChild(el('div', 'phalcon-debugbar-history-empty', 'No stored requests'));
+                    return;
+                }
+
+                var list = el('div', 'phalcon-debugbar-history-list');
+                requests.forEach(function (request) {
+                    request = request || {};
+                    var id = scalar(request.id);
+                    var button = el('button', 'phalcon-debugbar-history-request');
+                    button.type = 'button';
+                    if (id === selectedId) {
+                        button.classList.add('is-selected');
+                    }
+
+                    button.appendChild(el(
+                        'span',
+                        'phalcon-debugbar-history-method method-' + scalar(request.method).toLowerCase(),
+                        scalar(request.method)
+                    ));
+                    button.appendChild(el('span', 'phalcon-debugbar-history-uri', scalar(request.uri)));
+                    button.appendChild(el('span', 'phalcon-debugbar-history-status', scalar(request.status)));
+                    button.appendChild(el('time', 'phalcon-debugbar-history-time', scalar(request.requested_at)));
+
+                    button.addEventListener('click', function () {
+                        var selection = requestGuard.startDetail();
+                        if (selection === null) {
+                            return;
+                        }
+
+                        button.disabled = true;
+                        loadJson(historyUrl(url, id)).then(function (detail) {
+                            if (!requestGuard.isDetailCurrent(selection)) {
+                                button.disabled = false;
+                                return;
+                            }
+
+                            if (
+                                detail
+                                && detail.request
+                                && detail.request.version === HISTORY_VERSION
+                                && detail.request.payload
+                            ) {
+                                Array.prototype.forEach.call(
+                                    list.querySelectorAll('.phalcon-debugbar-history-request'),
+                                    function (requestButton) {
+                                        requestButton.classList.remove('is-selected');
+                                    }
+                                );
+                                button.classList.add('is-selected');
+                                onSelect(detail.request.payload, detail.request.meta || {}, id);
+                            }
+                            button.disabled = false;
+                        }).catch(function () {
+                            if (requestGuard.isDetailCurrent(selection)) {
+                                button.disabled = false;
+                            }
+                        });
+                    });
+
+                    list.appendChild(button);
+                });
+                content.appendChild(list);
+            }).catch(function () {
+                if (requestGuard.isListCurrent(generation)) {
+                    message('phalcon-debugbar-history-error', 'Unable to load request history');
+                }
+            }).then(function () {
+                if (requestGuard.isListCurrent(generation)) {
+                    refreshButton.disabled = false;
+                }
+            });
+        }
+
+        refreshButton.addEventListener('click', refresh);
+        clearButton.addEventListener('click', function () {
+            if (!window.confirm('Clear request history?')) {
+                return;
+            }
+
+            var generation = requestGuard.startClear();
+            if (generation === null) {
+                return;
+            }
+
+            refreshButton.disabled = true;
+            clearButton.disabled = true;
+            message('phalcon-debugbar-history-loading', 'Clearing request history...');
+            requestJson(url, {method: 'DELETE'}).then(function () {
+                if (!requestGuard.finishClear(generation)) {
+                    return;
+                }
+
+                onClear();
+                refresh();
+            }).catch(function () {
+                if (requestGuard.finishClear(generation)) {
+                    refreshButton.disabled = false;
+                    clearButton.disabled = false;
+                    message('phalcon-debugbar-history-error', 'Unable to clear request history');
+                }
+            });
+        });
+
+        refresh();
+    }
+
     function readCollapsed() {
         try {
             return window.localStorage.getItem(STORAGE_KEY) === '1';
@@ -225,6 +586,16 @@
         }
     }
 
+    if (typeof document === 'undefined') {
+        if (typeof module !== 'undefined' && module.exports) {
+            module.exports = {
+                createHistoryRequestGuard: createHistoryRequestGuard,
+                renderHistoryBrowser: renderHistoryBrowser
+            };
+        }
+        return;
+    }
+
     ready(function () {
         var dataNode = document.getElementById('phalcon-debugbar-data');
         var mount = document.getElementById('phalcon-debugbar');
@@ -243,27 +614,80 @@
         var widgets = (payload.meta && payload.meta.widgets) || {};
 
         var bar = el('div', 'phalcon-debugbar-bar');
+        var historyBrowser = el('div', 'phalcon-debugbar-history-browser');
         var body = el('div', 'phalcon-debugbar-body');
         var row = el('div', 'phalcon-debugbar-row');
         var tabs = el('div', 'phalcon-debugbar-tabs');
+        var indicators = el('div', 'phalcon-debugbar-indicators');
         var toggle = el('button', 'phalcon-debugbar-toggle', '⚡');
         toggle.type = 'button';
         toggle.title = 'Toggle Phalcon DebugBar';
         body.style.display = 'none';
 
         var active = null;
+        var selectedHistoryId = '';
+        var historyOpen = false;
+        var historyPanel = null;
+        var historyRenderGeneration = 0;
+        var historyTrigger = null;
+        var activeBeforeHistory = null;
 
         function closePanel() {
             body.style.display = 'none';
             active = null;
-            Array.prototype.forEach.call(tabs.children, function (child) {
+            Array.prototype.forEach.call(row.querySelectorAll('[data-panel-tab]'), function (child) {
                 child.classList.remove('is-active');
             });
         }
 
+        function renderOpenHistory() {
+            if (!historyOpen || !historyPanel) {
+                historyBrowser.style.display = 'none';
+                return;
+            }
+
+            var generation = ++historyRenderGeneration;
+            renderHistoryBrowser(
+                historyBrowser,
+                historyPanel,
+                selectedHistoryId,
+                function (storedPayload, storedMetadata, id) {
+                    var preferredActive = activeBeforeHistory;
+                    selectedHistoryId = id;
+                    setHistoryOpen(false);
+                    activeBeforeHistory = null;
+                    renderData(storedPayload, preferredActive, storedMetadata);
+                },
+                function () {
+                    selectedHistoryId = '';
+                },
+                function () {
+                    return historyOpen && generation === historyRenderGeneration;
+                }
+            );
+        }
+
+        function setHistoryOpen(open) {
+            historyOpen = Boolean(open && historyPanel);
+            if (historyTrigger) {
+                historyTrigger.classList.toggle('is-active', historyOpen);
+                historyTrigger.setAttribute('aria-expanded', historyOpen ? 'true' : 'false');
+                historyTrigger.title = (historyOpen ? 'Close request history: ' : 'Open request history: ')
+                    + historyTrigger.getAttribute('data-history-label');
+            }
+
+            if (!historyOpen) {
+                historyRenderGeneration++;
+                historyBrowser.style.display = 'none';
+            } else {
+                renderOpenHistory();
+            }
+        }
+
         function setCollapsed(collapsed) {
             if (collapsed) {
                 closePanel();
+                setHistoryOpen(false);
                 mount.classList.add('is-collapsed');
             } else {
                 mount.classList.remove('is-collapsed');
@@ -276,45 +700,113 @@
             writeCollapsed(collapsed);
         });
 
-        Object.keys(data).forEach(function (name) {
-            var entry = data[name] || {};
-            var widget = widgets[name] || {};
-            var label = widget.label || titleize(name);
-            var type = widget.panel || inferType(entry.panel);
-
-            var tab = el('button', 'phalcon-debugbar-tab');
-            tab.type = 'button';
-            tab.appendChild(el('span', 'phalcon-debugbar-tab-label', label));
-            if (hasBadge(entry.badge)) {
-                tab.appendChild(el('span', 'phalcon-debugbar-badge', scalar(entry.badge)));
+        function activate(name, tab, entry, type) {
+            closePanel();
+            setHistoryOpen(false);
+            tab.classList.add('is-active');
+            body.innerHTML = '';
+            var summary = renderSummary(entry.summary);
+            if (summary) {
+                body.appendChild(summary);
+            }
+            body.appendChild(renderPanel(type, entry.panel));
+            body.style.display = 'block';
+            active = name;
+        }
+
+        function renderData(nextPayload, preferredActive, requestMetadata) {
+            payload = nextPayload || {};
+            data = payload.data || {};
+            widgets = (payload.meta && payload.meta.widgets) || {};
+            tabs.innerHTML = '';
+            body.innerHTML = '';
+            body.style.display = 'none';
+            active = null;
+
+            var historyName = Object.keys(widgets).find(function (name) {
+                return widgets[name] && widgets[name].panel === 'history';
+            });
+            var historyEntry = historyName ? (data[historyName] || {}) : {};
+            historyPanel = null;
+            if (
+                historyEntry.panel
+                && typeof historyEntry.panel.url === 'string'
+            ) {
+                historyPanel = historyEntry.panel;
+            } else {
+                historyOpen = false;
+            }
+
+            var preferred = null;
+            function bindPanel(name, node) {
+                var entry = data[name] || {};
+                var widget = widgets[name] || {};
+                var type = widget.panel || inferType(entry.panel);
+
+                node.setAttribute('data-panel-tab', name);
+                node.addEventListener('click', function () {
+                    setHistoryOpen(false);
+                    if (active === name) {
+                        closePanel();
+                        return;
+                    }
+                    activate(name, node, entry, type);
+                });
+                if (name === preferredActive) {
+                    preferred = [name, node, entry, type];
+                }
             }
 
-            tab.addEventListener('click', function () {
-                if (active === name) {
-                    closePanel();
+            Object.keys(data).forEach(function (name) {
+                var entry = data[name] || {};
+                var widget = widgets[name] || {};
+                if (widget.panel === 'history' || widget.indicator) {
                     return;
                 }
-                closePanel();
-                tab.classList.add('is-active');
-                body.innerHTML = '';
-                var summary = renderSummary(entry.summary);
-                if (summary) {
-                    body.appendChild(summary);
+                var label = widget.label || titleize(name);
+
+                var tab = el('button', 'phalcon-debugbar-tab');
+                tab.type = 'button';
+                tab.appendChild(el('span', 'phalcon-debugbar-tab-label', label));
+                if (hasBadge(entry.badge)) {
+                    tab.appendChild(el('span', 'phalcon-debugbar-badge', scalar(entry.badge)));
                 }
-                body.appendChild(renderPanel(type, entry.panel));
-                body.style.display = 'block';
-                active = name;
+
+                bindPanel(name, tab);
+                tabs.appendChild(tab);
             });
 
-            tabs.appendChild(tab);
-        });
+            historyTrigger = renderIndicators(
+                indicators,
+                data,
+                widgets,
+                historyPanel ? function () {
+                    if (!historyOpen) {
+                        activeBeforeHistory = active;
+                        closePanel();
+                    }
+                    setHistoryOpen(!historyOpen);
+                } : null,
+                historyOpen,
+                requestMetadata,
+                bindPanel
+            );
+
+            if (preferred) {
+                activate(preferred[0], preferred[1], preferred[2], preferred[3]);
+            }
+            setHistoryOpen(historyOpen);
+        }
 
         row.appendChild(tabs);
+        row.appendChild(indicators);
         row.appendChild(toggle);
+        bar.appendChild(historyBrowser);
         bar.appendChild(body);
         bar.appendChild(row);
         mount.appendChild(bar);
 
+        renderData(payload, null, null);
         setCollapsed(readCollapsed());
     });
 })();
diff --git a/src/DebugBar/Collector/AbstractCollector.php b/src/DebugBar/Collector/AbstractCollector.php
index 1fac45b..2c2aba0 100644
--- a/src/DebugBar/Collector/AbstractCollector.php
+++ b/src/DebugBar/Collector/AbstractCollector.php
@@ -22,6 +22,7 @@
  * label, panel type, and `collect()`.
  *
  * @phpstan-import-type widget from DebugBarTypes
+ * @phpstan-import-type indicator from DebugBarTypes
  */
 abstract class AbstractCollector implements Renderable
 {
@@ -29,6 +30,11 @@ abstract class AbstractCollector implements Renderable
 
     protected string $icon = '';
 
+    /**
+     * @var indicator|null
+     */
+    protected ?array $indicator = null;
+
     protected string $label = '';
 
     protected string $panel = 'grid';
@@ -46,10 +52,16 @@ public function getName(): string
      */
     public function getWidget(): array
     {
-        return [
+        $widget = [
             'label' => ('' !== $this->label) ? $this->label : $this->getName(),
             'icon'  => $this->icon,
             'panel' => $this->panel,
         ];
+
+        if (null !== $this->indicator) {
+            $widget['indicator'] = $this->indicator;
+        }
+
+        return $widget;
     }
 }
diff --git a/src/DebugBar/Collector/HistoryCollector.php b/src/DebugBar/Collector/HistoryCollector.php
new file mode 100644
index 0000000..736ecd2
--- /dev/null
+++ b/src/DebugBar/Collector/HistoryCollector.php
@@ -0,0 +1,46 @@
+<?php
+
+/**
+ * This file is part of the Phalcon Framework.
+ *
+ * (c) Phalcon Team <team@phalcon.io>
+ *
+ * For the full copyright and license information, please view the LICENSE.txt
+ * file that was distributed with this source code.
+ */
+
+declare(strict_types=1);
+
+namespace Phalcon\DebugBar\Collector;
+
+use Phalcon\DebugBar\History\HistoryEndpoint;
+
+/**
+ * Enables the inline request-history browser. The browser itself is rendered
+ * by the JavaScript client; this collector only carries its internal endpoint.
+ */
+final class HistoryCollector extends AbstractCollector
+{
+    public const NAME = 'history';
+
+    protected string $icon = 'icon-history';
+
+    protected string $label = 'History';
+
+    protected string $panel = 'history';
+
+    public function __construct(private readonly HistoryEndpoint $endpoint)
+    {
+    }
+
+    /**
+     * @return array{panel: array{url: string}, badge: null}
+     */
+    public function collect(): array
+    {
+        return [
+            'panel' => ['url' => $this->endpoint->url()],
+            'badge' => null,
+        ];
+    }
+}
diff --git a/src/DebugBar/Collector/MemoryCollector.php b/src/DebugBar/Collector/MemoryCollector.php
new file mode 100644
index 0000000..953dcb9
--- /dev/null
+++ b/src/DebugBar/Collector/MemoryCollector.php
@@ -0,0 +1,75 @@
+<?php
+
+/**
+ * This file is part of the Phalcon Framework.
+ *
+ * (c) Phalcon Team <team@phalcon.io>
+ *
+ * For the full copyright and license information, please view the LICENSE.txt
+ * file that was distributed with this source code.
+ */
+
+declare(strict_types=1);
+
+namespace Phalcon\DebugBar\Collector;
+
+use Phalcon\DebugBar\DebugBarTypes;
+
+use function count;
+use function memory_get_peak_usage;
+use function memory_get_usage;
+use function round;
+
+/**
+ * Reports the memory currently used by the PHP request and its peak.
+ *
+ * @phpstan-import-type grid_envelope from DebugBarTypes
+ */
+final class MemoryCollector extends AbstractCollector
+{
+    public const METRIC_CURRENT_USAGE = 'current_usage';
+
+    public const NAME = 'memory';
+
+    protected string $icon = 'icon-memory';
+
+    protected ?array $indicator = [
+        'icon'  => 'cogs',
+        'label' => 'Current memory usage',
+        'path'  => ['metrics', self::METRIC_CURRENT_USAGE],
+    ];
+
+    protected string $label = 'Memory';
+
+    /**
+     * @return grid_envelope
+     */
+    public function collect(): array
+    {
+        $current = $this->formatBytes(memory_get_usage(false));
+        $peak    = $this->formatBytes(memory_get_peak_usage(false));
+
+        return [
+            'panel' => [
+                'Current usage' => $current,
+                'Peak usage'    => $peak,
+            ],
+            'badge'   => $peak,
+            'metrics' => [self::METRIC_CURRENT_USAGE => $current],
+        ];
+    }
+
+    private function formatBytes(int $bytes): string
+    {
+        $units = ['B', 'KB', 'MB', 'GB', 'TB'];
+        $value = (float) $bytes;
+        $unit  = 0;
+
+        while ($value >= 1024 && $unit < count($units) - 1) {
+            $value /= 1024;
+            $unit++;
+        }
+
+        return round($value, 2) . $units[$unit];
+    }
+}
diff --git a/src/DebugBar/Collector/RequestCollector.php b/src/DebugBar/Collector/RequestCollector.php
index ab48358..eacf9bd 100644
--- a/src/DebugBar/Collector/RequestCollector.php
+++ b/src/DebugBar/Collector/RequestCollector.php
@@ -31,6 +31,10 @@ final class RequestCollector extends AbstractCollector
 {
     use FlattensToGrid;
 
+    public const METRIC_METHOD = 'method';
+
+    public const METRIC_URI = 'uri';
+
     public const NAME = 'request';
 
     protected string $icon = 'icon-request';
@@ -57,9 +61,11 @@ public function collect(): array
             ];
         }
 
-        $grid = [
-            'Method' => $this->request->getMethod(),
-            'URI'    => $this->request->getURI(),
+        $method = $this->request->getMethod();
+        $uri    = $this->request->getURI();
+        $grid   = [
+            'Method' => $method,
+            'URI'    => $uri,
         ];
 
         $sections = [
@@ -75,11 +81,29 @@ public function collect(): array
         }
 
         return [
-            'panel' => $grid,
-            'badge' => null,
+            'panel'   => $grid,
+            'badge'   => null,
+            'metrics' => [
+                self::METRIC_METHOD => $method,
+                self::METRIC_URI    => $uri,
+            ],
         ];
     }
 
+    /**
+     * @return array<string, mixed>
+     */
+    public function getWidget(): array
+    {
+        $widget            = parent::getWidget();
+        $widget['request'] = [
+            'method' => ['metrics', self::METRIC_METHOD],
+            'uri'    => ['metrics', self::METRIC_URI],
+        ];
+
+        return $widget;
+    }
+
     /**
      * @return array<array-key, mixed>
      */
diff --git a/src/DebugBar/Collector/TimeCollector.php b/src/DebugBar/Collector/TimeCollector.php
index ad49c94..5e976ed 100644
--- a/src/DebugBar/Collector/TimeCollector.php
+++ b/src/DebugBar/Collector/TimeCollector.php
@@ -36,6 +36,12 @@ final class TimeCollector extends AbstractCollector implements TimeAware
 
     protected string $icon = 'icon-time';
 
+    protected ?array $indicator = [
+        'icon'  => 'clock',
+        'label' => 'Request time',
+        'path'  => ['badge'],
+    ];
+
     protected string $label = 'Time';
 
     protected string $panel = 'list';
diff --git a/src/DebugBar/Contracts/Collector.php b/src/DebugBar/Contracts/Collector.php
index 3407b8e..d4f1844 100644
--- a/src/DebugBar/Contracts/Collector.php
+++ b/src/DebugBar/Contracts/Collector.php
@@ -19,7 +19,8 @@
  * The data contract every collector implements. `collect()` returns an
  * envelope: `panel` holds the data shaped for the declared panel renderer,
  * `badge` is the optional scalar tab count, and `summary` is an optional list
- * of label/value metrics rendered above the panel.
+ * of label/value metrics rendered above the panel. `metrics` optionally exposes
+ * stable semantic values for widgets without coupling them to display labels.
  *
  * @phpstan-import-type envelope from DebugBarTypes
  */
diff --git a/src/DebugBar/Contracts/History.php b/src/DebugBar/Contracts/History.php
new file mode 100644
index 0000000..3b8b6b9
--- /dev/null
+++ b/src/DebugBar/Contracts/History.php
@@ -0,0 +1,53 @@
+<?php
+
+/**
+ * This file is part of the Phalcon Framework.
+ *
+ * (c) Phalcon Team <team@phalcon.io>
+ *
+ * For the full copyright and license information, please view the LICENSE.txt
+ * file that was distributed with this source code.
+ */
+
+declare(strict_types=1);
+
+namespace Phalcon\DebugBar\Contracts;
+
+use Phalcon\DebugBar\DebugBarTypes;
+use Phalcon\DebugBar\History\RequestMetadata;
+
+/**
+ * Request storage isolated by the debug bar's browser cookie. Without a valid
+ * cookie, reads return empty results and writes do nothing. Unavailable storage
+ * and missing or expired entries are represented by empty results, not exceptions.
+ *
+ * @phpstan-import-type payload from DebugBarTypes
+ */
+interface History
+{
+    /**
+     * Removes the current browser's entries and returns the number removed.
+     */
+    public function clear(): int;
+
+    /**
+     * Returns unexpired request metadata, newest first.
+     *
+     * @return list<array<string, mixed>>
+     */
+    public function find(): array;
+
+    /**
+     * Returns a stored entry, or null for an invalid, missing or expired ID.
+     *
+     * @return array<string, mixed>|null
+     */
+    public function get(string $id): ?array;
+
+    /**
+     * @param payload $payload
+     *
+     * @return string|null The stored ID, or null when persistence is unavailable.
+     */
+    public function save(array $payload, RequestMetadata $request): ?string;
+}
diff --git a/src/DebugBar/Controllers/HistoryController.php b/src/DebugBar/Controllers/HistoryController.php
new file mode 100644
index 0000000..b598e97
--- /dev/null
+++ b/src/DebugBar/Controllers/HistoryController.php
@@ -0,0 +1,119 @@
+<?php
+
+/**
+ * This file is part of the Phalcon Framework.
+ *
+ * (c) Phalcon Team <team@phalcon.io>
+ *
+ * For the full copyright and license information, please view the LICENSE.txt
+ * file that was distributed with this source code.
+ */
+
+declare(strict_types=1);
+
+namespace Phalcon\DebugBar\Controllers;
+
+use Phalcon\DebugBar\Contracts\History;
+use Phalcon\DebugBar\Security\AccessGate;
+use Phalcon\Http\RequestInterface;
+use Phalcon\Http\ResponseInterface;
+use Phalcon\Mvc\ControllerInterface;
+
+use function is_string;
+use function json_encode;
+use function strtoupper;
+
+use const JSON_UNESCAPED_SLASHES;
+use const JSON_UNESCAPED_UNICODE;
+
+/**
+ * Internal MVC adapter for /_debugbar/open. GET returns the current browser's
+ * request list or one stored entry; DELETE clears that browser's history.
+ */
+final class HistoryController implements ControllerInterface
+{
+    public function __construct(
+        private readonly History $history,
+        private readonly AccessGate $accessGate,
+        private readonly RequestInterface $historyRequest,
+        private readonly ResponseInterface $historyResponse
+    ) {
+    }
+
+    public function clearAction(): ResponseInterface
+    {
+        return $this->handle(
+            'DELETE',
+            fn (): ResponseInterface => $this->json(
+                $this->historyResponse,
+                ['cleared' => $this->history->clear()]
+            )
+        );
+    }
+
+    public function indexAction(): ResponseInterface
+    {
+        return $this->handle(
+            'GET',
+            function (): ResponseInterface {
+                $id = $this->historyRequest->getQuery('id');
+                if (null === $id) {
+                    return $this->json($this->historyResponse, ['requests' => $this->history->find()]);
+                }
+                if (!is_string($id)) {
+                    return $this->json($this->historyResponse, ['error' => 'Request not found.'], 404);
+                }
+
+                $entry = $this->history->get($id);
+                if (null === $entry) {
+                    return $this->json($this->historyResponse, ['error' => 'Request not found.'], 404);
+                }
+
+                return $this->json($this->historyResponse, ['request' => $entry]);
+            }
+        );
+    }
+
+    public function openAction(): ResponseInterface
+    {
+        return 'DELETE' === $this->transportMethod() ? $this->clearAction() : $this->indexAction();
+    }
+
+    /**
+     * @param callable(): ResponseInterface $action
+     */
+    private function handle(string $expectedMethod, callable $action): ResponseInterface
+    {
+        $clientIp = $this->historyRequest->getClientAddress();
+        if (!$this->accessGate->allows(is_string($clientIp) ? $clientIp : null)) {
+            return $this->json($this->historyResponse, ['error' => 'Not found.'], 404);
+        }
+
+        if ($expectedMethod !== $this->transportMethod()) {
+            return $this->json($this->historyResponse, ['error' => 'Method not allowed.'], 405);
+        }
+
+        return $action();
+    }
+
+    /**
+     * @param array<string, mixed> $body
+     */
+    private function json(ResponseInterface $response, array $body, int $status = 200): ResponseInterface
+    {
+        $json = json_encode($body, JSON_UNESCAPED_SLASHES | JSON_UNESCAPED_UNICODE);
+
+        $response->setStatusCode($status);
+        $response->setContentType('application/json', 'UTF-8');
+        $response->setHeader('Cache-Control', 'no-store, private');
+        $response->setHeader('X-Content-Type-Options', 'nosniff');
+        $response->setContent(false === $json ? '{}' : $json);
+
+        return $response;
+    }
+
+    private function transportMethod(): string
+    {
+        return strtoupper($this->historyRequest->getServer('REQUEST_METHOD') ?? '');
+    }
+}
diff --git a/src/DebugBar/DebugBar.php b/src/DebugBar/DebugBar.php
index 6e60485..b993210 100644
--- a/src/DebugBar/DebugBar.php
+++ b/src/DebugBar/DebugBar.php
@@ -17,6 +17,7 @@
 use Phalcon\DebugBar\Contracts\ExceptionAware;
 use Phalcon\DebugBar\Contracts\LoggerAware;
 use Phalcon\DebugBar\Contracts\MessageAware;
+use Phalcon\DebugBar\Contracts\Renderable;
 use Phalcon\DebugBar\Contracts\TimeAware;
 use Phalcon\DebugBar\Exceptions\Exception;
 use Throwable;
@@ -89,15 +90,20 @@ public function addLog(string $message, string $level, array $context = []): sta
      */
     public function collect(): array
     {
-        $data = [];
+        $data    = [];
+        $widgets = [];
         foreach ($this->collectors as $name => $collector) {
             $data[$name] = $collector->collect();
+            if ($collector instanceof Renderable) {
+                $widgets[$name] = $collector->getWidget();
+            }
         }
 
         $this->data = [
             'data' => $data,
             'meta' => [
                 'collectors' => count($data),
+                'widgets'    => $widgets,
             ],
         ];
 
diff --git a/src/DebugBar/DebugBarTypes.php b/src/DebugBar/DebugBarTypes.php
index 4b50fe4..8d7a3b3 100644
--- a/src/DebugBar/DebugBarTypes.php
+++ b/src/DebugBar/DebugBarTypes.php
@@ -24,12 +24,31 @@
  * @phpstan-type exception_panel list<exception_row>
  * @phpstan-type log_row array{label: string, message: string, context: string}
  * @phpstan-type log_panel list<log_row>
- * @phpstan-type widget array{label: string, icon: string, panel: string}
+ * @phpstan-type indicator array{icon: string, label: string, path: list<string>}
+ * @phpstan-type request_widget array{method: list<string>, uri: list<string>}
+ * @phpstan-type widget array{
+ *     label: string,
+ *     icon: string,
+ *     panel: string,
+ *     indicator?: indicator,
+ *     request?: request_widget
+ * }
  * @phpstan-type summary_row array{label: string, value: scalar}
  * @phpstan-type collector_summary list<summary_row>
- * @phpstan-type envelope array{panel: mixed, badge: scalar|null, summary?: collector_summary}
+ * @phpstan-type collector_metrics array<string, scalar>
+ * @phpstan-type envelope array{
+ *     panel: mixed,
+ *     badge: scalar|null,
+ *     summary?: collector_summary,
+ *     metrics?: collector_metrics
+ * }
  * @phpstan-type list_envelope array{panel: list_panel, badge: scalar|null, summary?: collector_summary}
- * @phpstan-type grid_envelope array{panel: grid_panel, badge: scalar|null, summary?: collector_summary}
+ * @phpstan-type grid_envelope array{
+ *     panel: grid_panel,
+ *     badge: scalar|null,
+ *     summary?: collector_summary,
+ *     metrics?: collector_metrics
+ * }
  * @phpstan-type exception_envelope array{panel: exception_panel, badge: scalar|null, summary?: collector_summary}
  * @phpstan-type log_envelope array{panel: log_panel, badge: scalar|null, summary?: collector_summary}
  * @phpstan-type payload array{data: array<string, envelope>, meta: array<string, mixed>}
@@ -48,6 +67,14 @@
  *     access?: array{allow_ips?: list<string>, callback?: (\Closure(): bool)|null},
  *     collectors?: array<string, bool>,
  *     headers?: bool,
+ *     history?: array{
+ *         enabled?: bool,
+ *         url?: string,
+ *         path?: string,
+ *         max_requests?: int,
+ *         ttl_seconds?: int,
+ *         max_browsers?: int
+ *     },
  *     redact?: array{mask?: list<string>, hidden?: list<string>}
  * }
  */
diff --git a/src/DebugBar/History/FilesystemHistory.php b/src/DebugBar/History/FilesystemHistory.php
new file mode 100644
index 0000000..bcf1a25
--- /dev/null
+++ b/src/DebugBar/History/FilesystemHistory.php
@@ -0,0 +1,539 @@
+<?php
+
+/**
+ * This file is part of the Phalcon Framework.
+ *
+ * (c) Phalcon Team <team@phalcon.io>
+ *
+ * For the full copyright and license information, please view the LICENSE.txt
+ * file that was distributed with this source code.
+ */
+
+declare(strict_types=1);
+
+namespace Phalcon\DebugBar\History;
+
+use DateTimeImmutable;
+use DateTimeZone;
+use Phalcon\DebugBar\Contracts\History;
+use RuntimeException;
+
+use function array_shift;
+use function array_slice;
+use function basename;
+use function bin2hex;
+use function count;
+use function hash;
+use function is_array;
+use function json_decode;
+use function json_encode;
+use function min;
+use function preg_match;
+use function preg_replace;
+use function random_bytes;
+use function rsort;
+use function str_ends_with;
+use function str_replace;
+use function strcmp;
+use function time;
+use function usort;
+
+use const GLOB_ONLYDIR;
+use const JSON_UNESCAPED_SLASHES;
+use const JSON_UNESCAPED_UNICODE;
+use const SORT_STRING;
+
+/**
+ * Persists request payloads in a browser-scoped directory. Callers only learn
+ * save/find/get/clear; atomic writes, pruning, path validation, and JSON failures stay
+ * inside the module.
+ *
+ * @phpstan-import-type payload from \Phalcon\DebugBar\DebugBarTypes
+ * @phpstan-import-type history_meta from HistoryEntry
+ * @phpstan-import-type stored_entry from HistoryEntry
+ */
+final class FilesystemHistory implements History
+{
+    private const GARBAGE_COLLECTION_MARKER               = '.gc';
+
+    private const GARBAGE_COLLECTION_MAX_INTERVAL_SECONDS = 3600;
+
+    private const LOCK_FILE                               = '.lock';
+
+    private const METADATA_SUFFIX                         = '.meta';
+
+    private readonly HistoryCookie $cookie;
+
+    private readonly HistoryFileOperations $fileOperations;
+
+    private bool $garbageCollectionAttempted = false;
+
+    public function __construct(
+        private readonly HistoryOptions $options,
+        ?HistoryFileOperations $fileOperations = null,
+        ?HistoryCookie $cookie = null
+    ) {
+        $this->fileOperations = $fileOperations ?? new NativeHistoryFileOperations();
+        $this->cookie         = $cookie ?? HistoryCookie::fromGlobals();
+    }
+
+    /**
+     * Removes every stored request belonging to the active debug bar browser.
+     *
+     * @return int Number of files successfully removed.
+     */
+    public function clear(): int
+    {
+        $directory = $this->browserDirectory(false);
+        if (null === $directory) {
+            return 0;
+        }
+
+        $removed = 0;
+        foreach ($this->files($directory) as $file) {
+            if ($this->fileOperations->remove($file)) {
+                $removed++;
+            }
+        }
+        foreach ($this->metadataFiles($directory) as $file) {
+            $this->fileOperations->remove($file);
+        }
+        foreach ($this->temporaryFiles($directory) as $file) {
+            $this->fileOperations->remove($file);
+        }
+        $this->removeDirectoryIfEmpty($directory);
+
+        return $removed;
+    }
+
+    /**
+     * @return list<array<string, mixed>>
+     */
+    public function find(): array
+    {
+        $directory = $this->browserDirectory(false);
+        if (null === $directory) {
+            return [];
+        }
+        $files = $this->removeExpired($this->files($directory));
+        rsort($files, SORT_STRING);
+
+        $requests = [];
+        foreach ($files as $file) {
+            $metadata = $this->readMetadata($file);
+            if (null !== $metadata) {
+                $requests[] = $metadata;
+            }
+            if (count($requests) >= $this->options->maxRequests) {
+                break;
+            }
+        }
+
+        $this->removeDirectoryIfEmpty($directory);
+
+        return $requests;
+    }
+
+    /**
+     * @return array<string, mixed>|null
+     */
+    public function get(string $id): ?array
+    {
+        if (1 !== preg_match('/^[0-9]{14}-[0-9]{6}-[a-f0-9]{8}$/D', $id)) {
+            return null;
+        }
+
+        $directory = $this->browserDirectory(false);
+        if (null === $directory) {
+            return null;
+        }
+        $file = $directory . '/' . basename($id) . '.json';
+        if ($this->isExpired($file)) {
+            $this->removeEntry($file);
+            $this->removeDirectoryIfEmpty($directory);
+
+            return null;
+        }
+
+        return $this->read($file);
+    }
+
+    /**
+     * @param payload $payload
+     */
+    public function save(array $payload, RequestMetadata $request): ?string
+    {
+        $directory = $this->browserDirectory(true);
+        if (null === $directory) {
+            return null;
+        }
+
+        $storedAt    = new DateTimeImmutable('now', new DateTimeZone('UTC'));
+        $id          = $storedAt->format('YmdHis-u-') . bin2hex(random_bytes(4));
+        $entry       = HistoryEntry::create($payload, $request, $id, $storedAt);
+        $storedEntry = $entry->toArray();
+
+        $flags        = JSON_UNESCAPED_SLASHES | JSON_UNESCAPED_UNICODE;
+        $json         = json_encode($storedEntry, $flags);
+        $metadataJson = json_encode([
+            'version' => HistoryEntry::VERSION,
+            'meta'    => $entry->metadata(),
+        ], $flags);
+        if (false === $json || false === $metadataJson) {
+            $this->removeDirectoryIfEmpty($directory);
+
+            return null;
+        }
+
+        $target = $directory . '/' . $id . '.json';
+        if (!$this->saveFiles($target, $json, $metadataJson)) {
+            $this->removeDirectoryIfEmpty($directory);
+
+            return null;
+        }
+
+        $this->prune($directory);
+        $this->garbageCollect();
+
+        return $id;
+    }
+
+    public function validateStorage(): void
+    {
+        if (!$this->ensureStorageRoot()) {
+            throw new RuntimeException('history.path must be writable by the web-server user.');
+        }
+    }
+
+    /**
+     * @return list<string>
+     */
+    private function browserDirectories(): array
+    {
+        $directories        = $this->matching($this->options->path, '*', GLOB_ONLYDIR);
+        $browserDirectories = [];
+        foreach ($directories as $directory) {
+            if (1 === preg_match('/^[a-f0-9]{64}$/D', basename($directory))) {
+                $browserDirectories[] = $directory;
+            }
+        }
+
+        return $browserDirectories;
+    }
+
+    private function browserDirectory(bool $create): ?string
+    {
+        $browserId = $this->cookie->id();
+        if (null === $browserId) {
+            return null;
+        }
+
+        $directory = $this->options->path . '/' . hash('sha256', $browserId);
+        if ($this->fileOperations->directoryExists($directory)) {
+            return $this->fileOperations->isWritable($directory) ? $directory : null;
+        }
+
+        if (!$create || !$this->ensureStorageRoot()) {
+            return null;
+        }
+
+        $created = $this->fileOperations->withExclusiveLock(
+            $this->options->path . '/' . self::LOCK_FILE,
+            function () use ($directory): bool {
+                if ($this->fileOperations->directoryExists($directory)) {
+                    return $this->fileOperations->isWritable($directory);
+                }
+
+                if (!$this->makeRoomForBrowser()) {
+                    return false;
+                }
+
+                return (
+                    $this->fileOperations->createDirectory($directory, 0700, true)
+                    || $this->fileOperations->directoryExists($directory)
+                ) && $this->fileOperations->isWritable($directory);
+            }
+        );
+
+        return $created ? $directory : null;
+    }
+
+    private function ensureStorageRoot(): bool
+    {
+        if (!$this->fileOperations->directoryExists($this->options->path)) {
+            if (
+                !$this->fileOperations->createDirectory($this->options->path, 0700, true)
+                && !$this->fileOperations->directoryExists($this->options->path)
+            ) {
+                return false;
+            }
+        }
+
+        return $this->fileOperations->isWritable($this->options->path);
+    }
+
+    /**
+     * @return list<string>
+     */
+    private function files(string $directory): array
+    {
+        return $this->matching($directory, '*.json');
+    }
+
+    private function garbageCollect(): void
+    {
+        if ($this->garbageCollectionAttempted) {
+            return;
+        }
+
+        $this->garbageCollectionAttempted = true;
+        $marker                           = $this->options->path . '/' . self::GARBAGE_COLLECTION_MARKER;
+        $modified                         = $this->fileOperations->modifiedAt($marker);
+        $interval                         = min(
+            $this->options->ttlSeconds,
+            self::GARBAGE_COLLECTION_MAX_INTERVAL_SECONDS
+        );
+        if (false !== $modified && $modified >= time() - $interval) {
+            return;
+        }
+
+        if (!$this->fileOperations->write($marker, (string) time())) {
+            return;
+        }
+
+        foreach ($this->browserDirectories() as $directory) {
+            $storedFiles = [
+                ...$this->files($directory),
+                ...$this->metadataFiles($directory),
+                ...$this->temporaryFiles($directory),
+            ];
+            foreach ($storedFiles as $file) {
+                if ($this->isExpired($file)) {
+                    if (str_ends_with($file, '.json')) {
+                        $this->removeEntry($file);
+                    } else {
+                        $this->fileOperations->remove($file);
+                    }
+                }
+            }
+
+            $this->removeDirectoryIfEmpty($directory);
+        }
+    }
+
+    private function isExpired(string $file): bool
+    {
+        $modified = $this->fileOperations->modifiedAt($file);
+
+        return false !== $modified && $modified < time() - $this->options->ttlSeconds;
+    }
+
+    private function makeRoomForBrowser(): bool
+    {
+        $directories = $this->browserDirectories();
+        usort(
+            $directories,
+            function (string $left, string $right): int {
+                $leftModified  = $this->fileOperations->modifiedAt($left);
+                $rightModified = $this->fileOperations->modifiedAt($right);
+                $comparison    = (false === $leftModified ? 0 : $leftModified)
+                    <=> (false === $rightModified ? 0 : $rightModified);
+
+                return 0 !== $comparison ? $comparison : strcmp($left, $right);
+            }
+        );
+
+        while (count($directories) >= $this->options->maxBrowsers) {
+            /** @var string $directory */
+            $directory = array_shift($directories);
+            $this->removeBrowserDirectory($directory);
+            if ($this->fileOperations->directoryExists($directory)) {
+                return false;
+            }
+        }
+
+        return true;
+    }
+
+    /**
+     * @return list<string>
+     */
+    private function matching(string $directory, string $pattern, int $flags = 0): array
+    {
+        if (1 === preg_match('/^(?:[a-zA-Z]:[\\\\\/]|\\\\\\\\)/D', $directory)) {
+            $directory = str_replace('\\', '/', $directory);
+        }
+        $escapedDirectory = (string) preg_replace('/([*?\[\]\\\\])/', '\\\\$1', $directory);
+
+        return $this->fileOperations->matching($escapedDirectory . '/' . $pattern, $flags);
+    }
+
+    private function metadataFile(string $file): string
+    {
+        return $file . self::METADATA_SUFFIX;
+    }
+
+    /**
+     * @return list<string>
+     */
+    private function metadataFiles(string $directory): array
+    {
+        return $this->matching($directory, '*.json' . self::METADATA_SUFFIX);
+    }
+
+    /**
+     * @param history_meta $metadata
+     */
+    private function metadataMatchesFile(array $metadata, string $file): bool
+    {
+        return basename($file, '.json') === $metadata['id'];
+    }
+
+    private function prune(string $directory): void
+    {
+        $files = $this->removeExpired($this->files($directory));
+        rsort($files, SORT_STRING);
+        foreach (array_slice($files, $this->options->maxRequests) as $file) {
+            $this->removeEntry($file);
+        }
+    }
+
+    /**
+     * @return stored_entry|null
+     */
+    private function read(string $file): ?array
+    {
+        if (!$this->fileOperations->fileExists($file)) {
+            return null;
+        }
+
+        $json = $this->fileOperations->read($file);
+        if (false === $json) {
+            return null;
+        }
+
+        $decoded = json_decode($json, true);
+        if (!is_array($decoded)) {
+            return null;
+        }
+
+        /** @var array<string, mixed> $decoded */
+        $entry = HistoryEntry::fromArray($decoded);
+
+        return $entry?->toArray();
+    }
+
+    /**
+     * @return history_meta|null
+     */
+    private function readMetadata(string $file): ?array
+    {
+        $metadataFile = $this->metadataFile($file);
+        if ($this->fileOperations->fileExists($metadataFile)) {
+            $json = $this->fileOperations->read($metadataFile);
+            if (false !== $json) {
+                $metadataEntry = json_decode($json, true);
+                if (
+                    is_array($metadataEntry)
+                    && HistoryEntry::VERSION === ($metadataEntry['version'] ?? null)
+                    && is_array($metadataEntry['meta'] ?? null)
+                ) {
+                    /** @var array<string, mixed> $metadataEntryData */
+                    $metadataEntryData = $metadataEntry['meta'];
+                    $metadata          = HistoryEntry::metadataFromArray($metadataEntryData);
+                    if (null !== $metadata && $this->metadataMatchesFile($metadata, $file)) {
+                        return $metadata;
+                    }
+                }
+            }
+        }
+
+        $entry = $this->read($file);
+        if (null === $entry || !$this->metadataMatchesFile($entry['meta'], $file)) {
+            return null;
+        }
+
+        return $entry['meta'];
+    }
+
+    private function removeBrowserDirectory(string $directory): void
+    {
+        foreach ($this->matching($directory, '*') as $file) {
+            $this->fileOperations->remove($file);
+        }
+        $this->fileOperations->removeDirectory($directory);
+    }
+
+    private function removeDirectoryIfEmpty(string $directory): void
+    {
+        if ([] === $this->matching($directory, '*')) {
+            $this->fileOperations->removeDirectory($directory);
+        }
+    }
+
+    private function removeEntry(string $file): void
+    {
+        $this->fileOperations->remove($file);
+        $this->fileOperations->remove($this->metadataFile($file));
+    }
+
+    /**
+     * @param list<string> $files
+     *
+     * @return list<string>
+     */
+    private function removeExpired(array $files): array
+    {
+        $remaining = [];
+        foreach ($files as $file) {
+            if ($this->isExpired($file)) {
+                $this->removeEntry($file);
+                continue;
+            }
+
+            $remaining[] = $file;
+        }
+
+        return $remaining;
+    }
+
+    private function saveFiles(string $target, string $json, string $metadataJson): bool
+    {
+        $metadataTarget    = $this->metadataFile($target);
+        $metadataTemporary = $metadataTarget . '.tmp-' . bin2hex(random_bytes(4));
+        $temporary         = $target . '.tmp-' . bin2hex(random_bytes(4));
+        if (!$this->fileOperations->write($temporary, $json)) {
+            $this->fileOperations->remove($temporary);
+
+            return false;
+        }
+        if (!$this->fileOperations->write($metadataTemporary, $metadataJson)) {
+            $this->fileOperations->remove($metadataTemporary);
+            $this->fileOperations->remove($temporary);
+
+            return false;
+        }
+        if (!$this->fileOperations->move($temporary, $target)) {
+            $this->fileOperations->remove($temporary);
+            $this->fileOperations->remove($metadataTemporary);
+
+            return false;
+        }
+        if (!$this->fileOperations->move($metadataTemporary, $metadataTarget)) {
+            $this->fileOperations->remove($metadataTemporary);
+            $this->fileOperations->remove($target);
+
+            return false;
+        }
+
+        return true;
+    }
+
+    /**
+     * @return list<string>
+     */
+    private function temporaryFiles(string $directory): array
+    {
+        return $this->matching($directory, '*.tmp-*');
+    }
+}
diff --git a/src/DebugBar/History/HistoryCookie.php b/src/DebugBar/History/HistoryCookie.php
new file mode 100644
index 0000000..c88db78
--- /dev/null
+++ b/src/DebugBar/History/HistoryCookie.php
@@ -0,0 +1,72 @@
+<?php
+
+/**
+ * This file is part of the Phalcon Framework.
+ *
+ * (c) Phalcon Team <team@phalcon.io>
+ *
+ * For the full copyright and license information, please view the LICENSE.txt
+ * file that was distributed with this source code.
+ */
+
+declare(strict_types=1);
+
+namespace Phalcon\DebugBar\History;
+
+use Closure;
+
+use function bin2hex;
+use function is_string;
+use function preg_match;
+use function random_bytes;
+use function setcookie;
+
+/**
+ * Browser identity used only by request history. It never reads, starts, or
+ * changes the host application's PHP session.
+ */
+final class HistoryCookie
+{
+    public const NAME = 'phalcon-debugbar-history';
+
+    private const ID_PATTERN = '/^[a-f0-9]{64}$/D';
+
+    private readonly Closure $setCookie;
+
+    public function __construct(private readonly ?string $value, ?callable $setCookie = null)
+    {
+        $this->setCookie = null === $setCookie
+            ? setcookie(...)
+            : Closure::fromCallable($setCookie);
+    }
+
+    public static function fromGlobals(): self
+    {
+        $value = $_COOKIE[self::NAME] ?? null;
+
+        return new self(is_string($value) ? $value : null);
+    }
+
+    public function id(): ?string
+    {
+        return 1 === preg_match(self::ID_PATTERN, $this->value ?? '') ? $this->value : null;
+    }
+
+    public function queue(string $path, bool $secure): void
+    {
+        if (null !== $this->id()) {
+            return;
+        }
+
+        ($this->setCookie)(
+            self::NAME,
+            bin2hex(random_bytes(32)),
+            [
+                'path'     => $path,
+                'secure'   => $secure,
+                'httponly' => true,
+                'samesite' => 'Lax',
+            ]
+        );
+    }
+}
diff --git a/src/DebugBar/History/HistoryEndpoint.php b/src/DebugBar/History/HistoryEndpoint.php
new file mode 100644
index 0000000..16ac261
--- /dev/null
+++ b/src/DebugBar/History/HistoryEndpoint.php
@@ -0,0 +1,95 @@
+<?php
+
+/**
+ * This file is part of the Phalcon Framework.
+ *
+ * (c) Phalcon Team <team@phalcon.io>
+ *
+ * For the full copyright and license information, please view the LICENSE.txt
+ * file that was distributed with this source code.
+ */
+
+declare(strict_types=1);
+
+namespace Phalcon\DebugBar\History;
+
+use Phalcon\Di\DiInterface;
+use Phalcon\Events\EventInterface;
+use Phalcon\Http\RequestInterface;
+use Phalcon\Mvc\DispatcherInterface;
+use Phalcon\Mvc\Url\UrlInterface;
+
+use function is_string;
+use function ltrim;
+use function parse_url;
+use function rtrim;
+
+use const PHP_URL_PATH;
+
+/**
+ * Selects the package controller without adding or changing application routes.
+ * The public URL includes the application's base URI.
+ */
+final class HistoryEndpoint
+{
+    public const CONTROLLER_NAMESPACE = 'Phalcon\\DebugBar\\Controllers';
+
+    public function __construct(
+        private readonly HistoryOptions $options,
+        private readonly DiInterface $container
+    ) {
+    }
+
+    public function __invoke(EventInterface $event, mixed $source, mixed $dispatcher): void
+    {
+        if (!$dispatcher instanceof DispatcherInterface || !$this->matches()) {
+            return;
+        }
+
+        $dispatcher->setNamespaceName(self::CONTROLLER_NAMESPACE);
+        $dispatcher->setControllerName('history');
+        $dispatcher->setControllerSuffix('Controller');
+        $dispatcher->setActionSuffix('Action');
+        $dispatcher->setActionName('open');
+        $dispatcher->setParams([]);
+    }
+
+    public function cookiePath(): string
+    {
+        $baseUri = '/';
+        if ($this->container->has('url')) {
+            $url = $this->container->getShared('url');
+            if ($url instanceof UrlInterface) {
+                $path = parse_url($url->getBaseUri(), PHP_URL_PATH);
+                if (is_string($path) && '' !== $path) {
+                    $baseUri = $path;
+                }
+            }
+        }
+
+        return '/' . ltrim(rtrim($baseUri, '/') . '/', '/');
+    }
+
+    public function matches(): bool
+    {
+        $request = $this->request();
+
+        return null !== $request && parse_url($request->getURI(), PHP_URL_PATH) === $this->url();
+    }
+
+    public function url(): string
+    {
+        return rtrim($this->cookiePath(), '/') . '/' . ltrim($this->options->url, '/');
+    }
+
+    private function request(): ?RequestInterface
+    {
+        if (!$this->container->has('request')) {
+            return null;
+        }
+
+        $request = $this->container->getShared('request');
+
+        return $request instanceof RequestInterface ? $request : null;
+    }
+}
diff --git a/src/DebugBar/History/HistoryEntry.php b/src/DebugBar/History/HistoryEntry.php
new file mode 100644
index 0000000..5f5d81d
--- /dev/null
+++ b/src/DebugBar/History/HistoryEntry.php
@@ -0,0 +1,153 @@
+<?php
+
+/**
+ * This file is part of the Phalcon Framework.
+ *
+ * (c) Phalcon Team <team@phalcon.io>
+ *
+ * For the full copyright and license information, please view the LICENSE.txt
+ * file that was distributed with this source code.
+ */
+
+declare(strict_types=1);
+
+namespace Phalcon\DebugBar\History;
+
+use DateTimeImmutable;
+use Phalcon\DebugBar\DebugBarTypes;
+
+use function is_array;
+use function is_bool;
+use function is_int;
+use function is_string;
+
+use const DATE_ATOM;
+
+/**
+ * Versioned storage boundary for request-history payloads.
+ *
+ * @phpstan-import-type payload from DebugBarTypes
+ * @phpstan-type history_meta array{
+ *     requested_at: string,
+ *     method: string,
+ *     uri: string,
+ *     status: int,
+ *     ajax: bool,
+ *     id: string,
+ *     stored_at: string
+ * }
+ * @phpstan-type stored_entry array{version: int, meta: history_meta, payload: payload}
+ */
+final class HistoryEntry
+{
+    public const VERSION = 1;
+
+    /**
+     * @param history_meta $metadata
+     * @param payload      $payload
+     */
+    private function __construct(
+        private readonly array $metadata,
+        private readonly array $payload
+    ) {
+    }
+
+    /**
+     * @param payload $payload
+     */
+    public static function create(
+        array $payload,
+        RequestMetadata $request,
+        string $id,
+        DateTimeImmutable $storedAt
+    ): self {
+        $requestedAt = $request->requestedAt ?? $storedAt;
+
+        return new self(
+            [
+                'requested_at' => $requestedAt->format(DATE_ATOM),
+                'method'       => $request->method,
+                'uri'          => $request->uri,
+                'status'       => $request->status,
+                'ajax'         => $request->ajax,
+                'id'           => $id,
+                'stored_at'    => $storedAt->format(DATE_ATOM),
+            ],
+            $payload
+        );
+    }
+
+    /**
+     * @param array<string, mixed> $entry
+     */
+    public static function fromArray(array $entry): ?self
+    {
+        $metadataEntry = $entry['meta'] ?? null;
+        $payload       = $entry['payload'] ?? null;
+        if (
+            self::VERSION !== ($entry['version'] ?? null)
+            || !is_array($metadataEntry)
+            || !is_array($payload)
+        ) {
+            return null;
+        }
+
+        /** @var array<string, mixed> $metadataEntry */
+        /** @var array<string, mixed> $payload */
+        $metadata = self::metadataFromArray($metadataEntry);
+        if (
+            null === $metadata
+            || !is_array($payload['data'] ?? null)
+            || !is_array($payload['meta'] ?? null)
+        ) {
+            return null;
+        }
+
+        /** @var history_meta $metadata */
+        /** @var payload $payload */
+        return new self($metadata, $payload);
+    }
+
+    /**
+     * @param array<string, mixed> $metadata
+     *
+     * @return history_meta|null
+     */
+    public static function metadataFromArray(array $metadata): ?array
+    {
+        if (
+            !is_string($metadata['requested_at'] ?? null)
+            || !is_string($metadata['method'] ?? null)
+            || !is_string($metadata['uri'] ?? null)
+            || !is_int($metadata['status'] ?? null)
+            || !is_bool($metadata['ajax'] ?? null)
+            || !is_string($metadata['id'] ?? null)
+            || !is_string($metadata['stored_at'] ?? null)
+        ) {
+            return null;
+        }
+
+        /** @var history_meta $metadata */
+        return $metadata;
+    }
+
+    /**
+     * @return history_meta
+     */
+    public function metadata(): array
+    {
+        return $this->metadata;
+    }
+
+    /**
+     * @return stored_entry
+     */
+    public function toArray(): array
+    {
+        return [
+            'version' => self::VERSION,
+            'meta'    => $this->metadata,
+            'payload' => $this->payload,
+        ];
+    }
+}
diff --git a/src/DebugBar/History/HistoryFileOperations.php b/src/DebugBar/History/HistoryFileOperations.php
new file mode 100644
index 0000000..857bd5b
--- /dev/null
+++ b/src/DebugBar/History/HistoryFileOperations.php
@@ -0,0 +1,57 @@
+<?php
+
+/**
+ * This file is part of the Phalcon Framework.
+ *
+ * (c) Phalcon Team <team@phalcon.io>
+ *
+ * For the full copyright and license information, please view the LICENSE.txt
+ * file that was distributed with this source code.
+ */
+
+declare(strict_types=1);
+
+namespace Phalcon\DebugBar\History;
+
+use Closure;
+
+/**
+ * Internal filesystem access seam used by request-history storage.
+ *
+ * @internal
+ */
+interface HistoryFileOperations
+{
+    public function createDirectory(string $directory, int $permissions, bool $recursive): bool;
+
+    /**
+     * @phpstan-impure
+     */
+    public function directoryExists(string $directory): bool;
+
+    public function fileExists(string $file): bool;
+
+    public function isWritable(string $path): bool;
+
+    /**
+     * @return list<string>
+     */
+    public function matching(string $pattern, int $flags = 0): array;
+
+    public function modifiedAt(string $file): false | int;
+
+    public function move(string $source, string $target): bool;
+
+    public function read(string $file): false | string;
+
+    public function remove(string $file): bool;
+
+    public function removeDirectory(string $directory): bool;
+
+    /**
+     * @param Closure(): bool $operation
+     */
+    public function withExclusiveLock(string $file, Closure $operation): bool;
+
+    public function write(string $file, string $contents): bool;
+}
diff --git a/src/DebugBar/History/HistoryOptions.php b/src/DebugBar/History/HistoryOptions.php
new file mode 100644
index 0000000..e4953fe
--- /dev/null
+++ b/src/DebugBar/History/HistoryOptions.php
@@ -0,0 +1,105 @@
+<?php
+
+/**
+ * This file is part of the Phalcon Framework.
+ *
+ * (c) Phalcon Team <team@phalcon.io>
+ *
+ * For the full copyright and license information, please view the LICENSE.txt
+ * file that was distributed with this source code.
+ */
+
+declare(strict_types=1);
+
+namespace Phalcon\DebugBar\History;
+
+use InvalidArgumentException;
+
+use function max;
+use function parse_url;
+use function preg_match;
+use function rtrim;
+use function str_starts_with;
+use function trim;
+
+use const PHP_URL_FRAGMENT;
+use const PHP_URL_HOST;
+use const PHP_URL_PATH;
+use const PHP_URL_QUERY;
+use const PHP_URL_SCHEME;
+
+/**
+ * Immutable request-history configuration shared by the provider and storage.
+ */
+final class HistoryOptions
+{
+    public readonly int $maxBrowsers;
+
+    public readonly int $maxRequests;
+
+    public readonly string $path;
+
+    public readonly int $ttlSeconds;
+
+    public function __construct(
+        public readonly bool $enabled = false,
+        public readonly string $url = '/_debugbar/open',
+        string $path = '',
+        int $maxRequests = 100,
+        int $ttlSeconds = 86400,
+        int $maxBrowsers = 10
+    ) {
+        $path              = trim($path);
+        $this->path        = $this->trimTrailingSeparators($path);
+        $this->maxRequests = max(1, $maxRequests);
+        $this->ttlSeconds  = max(1, $ttlSeconds);
+        $this->maxBrowsers = max(1, $maxBrowsers);
+    }
+
+    public function validate(): void
+    {
+        if (!$this->enabled) {
+            return;
+        }
+
+        if ('' === $this->path) {
+            throw new InvalidArgumentException('history.path is required when request history is enabled.');
+        }
+
+        if (!$this->isAbsolutePath($this->path)) {
+            throw new InvalidArgumentException('history.path must be an absolute path.');
+        }
+
+        if (!$this->isInternalUrl($this->url)) {
+            throw new InvalidArgumentException(
+                'history.url must be an absolute path without a scheme, host, query, or fragment.'
+            );
+        }
+    }
+
+    private function isAbsolutePath(string $path): bool
+    {
+        return str_starts_with($path, '/')
+            || str_starts_with($path, '\\\\')
+            || 1 === preg_match('/^[a-zA-Z]:[\\\\\/]/D', $path);
+    }
+
+    private function isInternalUrl(string $url): bool
+    {
+        return str_starts_with($url, '/')
+            && $url === parse_url($url, PHP_URL_PATH)
+            && null === parse_url($url, PHP_URL_SCHEME)
+            && null === parse_url($url, PHP_URL_HOST)
+            && null === parse_url($url, PHP_URL_QUERY)
+            && null === parse_url($url, PHP_URL_FRAGMENT);
+    }
+
+    private function trimTrailingSeparators(string $path): string
+    {
+        if ('/' === $path || 1 === preg_match('/^[a-zA-Z]:[\\\\\/]$/D', $path)) {
+            return $path;
+        }
+
+        return rtrim($path, '/\\');
+    }
+}
diff --git a/src/DebugBar/History/NativeHistoryFileOperations.php b/src/DebugBar/History/NativeHistoryFileOperations.php
new file mode 100644
index 0000000..f4fe5c4
--- /dev/null
+++ b/src/DebugBar/History/NativeHistoryFileOperations.php
@@ -0,0 +1,149 @@
+<?php
+
+/**
+ * This file is part of the Phalcon Framework.
+ *
+ * (c) Phalcon Team <team@phalcon.io>
+ *
+ * For the full copyright and license information, please view the LICENSE.txt
+ * file that was distributed with this source code.
+ */
+
+declare(strict_types=1);
+
+namespace Phalcon\DebugBar\History;
+
+use Closure;
+use ErrorException;
+
+use function fclose;
+use function file_get_contents;
+use function file_put_contents;
+use function filemtime;
+use function flock;
+use function fopen;
+use function glob;
+use function is_dir;
+use function is_file;
+use function is_writable;
+use function mkdir;
+use function rename;
+use function restore_error_handler;
+use function rmdir;
+use function set_error_handler;
+use function unlink;
+
+use const LOCK_EX;
+use const LOCK_UN;
+
+final class NativeHistoryFileOperations implements HistoryFileOperations
+{
+    public function createDirectory(string $directory, int $permissions, bool $recursive): bool
+    {
+        return $this->attempt(
+            static fn (): bool => mkdir($directory, $permissions, $recursive),
+            false
+        );
+    }
+
+    public function directoryExists(string $directory): bool
+    {
+        return is_dir($directory);
+    }
+
+    public function fileExists(string $file): bool
+    {
+        return is_file($file);
+    }
+
+    public function isWritable(string $path): bool
+    {
+        return is_writable($path);
+    }
+
+    public function matching(string $pattern, int $flags = 0): array
+    {
+        return $this->attempt(static fn (): array | false => glob($pattern, $flags), false) ?: [];
+    }
+
+    public function modifiedAt(string $file): false | int
+    {
+        return $this->attempt(static fn (): false | int => filemtime($file), false);
+    }
+
+    public function move(string $source, string $target): bool
+    {
+        return $this->attempt(static fn (): bool => rename($source, $target), false);
+    }
+
+    public function read(string $file): false | string
+    {
+        return $this->attempt(static fn (): false | string => file_get_contents($file), false);
+    }
+
+    public function remove(string $file): bool
+    {
+        return $this->attempt(static fn (): bool => unlink($file), false);
+    }
+
+    public function removeDirectory(string $directory): bool
+    {
+        return $this->attempt(static fn (): bool => rmdir($directory), false);
+    }
+
+    public function withExclusiveLock(string $file, Closure $operation): bool
+    {
+        $handle = $this->attempt(static fn () => fopen($file, 'c+'), false);
+        if (false === $handle) {
+            return false;
+        }
+
+        if (!$this->attempt(static fn (): bool => flock($handle, LOCK_EX), false)) {
+            fclose($handle);
+
+            return false;
+        }
+
+        try {
+            return $operation();
+        } finally {
+            flock($handle, LOCK_UN);
+            fclose($handle);
+        }
+    }
+
+    public function write(string $file, string $contents): bool
+    {
+        return false !== $this->attempt(
+            static fn (): false | int => file_put_contents($file, $contents, LOCK_EX),
+            false
+        );
+    }
+
+    /**
+     * Converts a native filesystem warning into the method's documented failure value.
+     *
+     * @template T
+     *
+     * @param Closure(): T $operation
+     * @param T            $fallback
+     *
+     * @return T
+     */
+    private function attempt(Closure $operation, mixed $fallback): mixed
+    {
+        set_error_handler(
+            static function (int $severity, string $message): never {
+                throw new ErrorException($message, 0, $severity);
+            }
+        );
+
+        try {
+            return $operation();
+        } catch (ErrorException) {
+            return $fallback;
+        } finally {
+            restore_error_handler();
+        }
+    }
+}
diff --git a/src/DebugBar/History/RequestMetadata.php b/src/DebugBar/History/RequestMetadata.php
new file mode 100644
index 0000000..a0c6fce
--- /dev/null
+++ b/src/DebugBar/History/RequestMetadata.php
@@ -0,0 +1,31 @@
+<?php
+
+/**
+ * This file is part of the Phalcon Framework.
+ *
+ * (c) Phalcon Team <team@phalcon.io>
+ *
+ * For the full copyright and license information, please view the LICENSE.txt
+ * file that was distributed with this source code.
+ */
+
+declare(strict_types=1);
+
+namespace Phalcon\DebugBar\History;
+
+use DateTimeImmutable;
+
+/**
+ * The small request snapshot stored next to a collected debug-bar payload.
+ */
+final class RequestMetadata
+{
+    public function __construct(
+        public readonly string $method,
+        public readonly string $uri,
+        public readonly int $status,
+        public readonly bool $ajax,
+        public readonly ?DateTimeImmutable $requestedAt = null
+    ) {
+    }
+}
diff --git a/src/DebugBar/Provider.php b/src/DebugBar/Provider.php
index 5e59ecb..74ec0fa 100644
--- a/src/DebugBar/Provider.php
+++ b/src/DebugBar/Provider.php
@@ -19,7 +19,9 @@
 use Phalcon\DebugBar\Collector\ConfigCollector;
 use Phalcon\DebugBar\Collector\DatabaseCollector;
 use Phalcon\DebugBar\Collector\ExceptionsCollector;
+use Phalcon\DebugBar\Collector\HistoryCollector;
 use Phalcon\DebugBar\Collector\LoggerCollector;
+use Phalcon\DebugBar\Collector\MemoryCollector;
 use Phalcon\DebugBar\Collector\MessagesCollector;
 use Phalcon\DebugBar\Collector\RequestCollector;
 use Phalcon\DebugBar\Collector\RouteCollector;
@@ -28,12 +30,20 @@
 use Phalcon\DebugBar\Collector\VersionCollector;
 use Phalcon\DebugBar\Collector\ViewCollector;
 use Phalcon\DebugBar\Contracts\Collector;
+use Phalcon\DebugBar\Contracts\History;
 use Phalcon\DebugBar\Contracts\Subscriber;
+use Phalcon\DebugBar\Controllers\HistoryController;
 use Phalcon\DebugBar\Exceptions\CannotUseInProduction;
+use Phalcon\DebugBar\History\FilesystemHistory;
+use Phalcon\DebugBar\History\HistoryCookie;
+use Phalcon\DebugBar\History\HistoryEndpoint;
+use Phalcon\DebugBar\History\HistoryOptions;
 use Phalcon\DebugBar\Security\AccessGate;
 use Phalcon\DebugBar\Security\Redactor;
 use Phalcon\Di\DiInterface;
+use Phalcon\Http\Request;
 use Phalcon\Http\RequestInterface;
+use Phalcon\Http\Response;
 use Phalcon\Mvc\Application;
 
 use function getenv;
@@ -44,8 +54,8 @@
 /**
  * Boots the debug bar against an MVC application. Its whole coupling to the app
  * is: hold the `Application`, reach its EventsManager, and attach listeners.
- * There is no DI service to register and no container-specific wiring - the
- * app hands over its container and event bus.
+ * When request history is enabled it registers its controller in the DI and
+ * selects it through an application listener, leaving the router unchanged.
  *
  * @phpstan-import-type provider_config from DebugBarTypes
  */
@@ -77,6 +87,12 @@ class Provider
 
     private bool $headers;
 
+    private ?HistoryCookie $historyCookie = null;
+
+    private ?HistoryEndpoint $historyEndpoint = null;
+
+    private HistoryOptions $historyOptions;
+
     private ?string $nonce;
 
     private Redactor $redactor;
@@ -88,10 +104,11 @@ class Provider
      */
     public function __construct(private readonly Application $app, array $config = [])
     {
-        $env    = $config['env'] ?? [];
-        $assets = $config['assets'] ?? [];
-        $access = $config['access'] ?? [];
-        $redact = $config['redact'] ?? [];
+        $env     = $config['env'] ?? [];
+        $assets  = $config['assets'] ?? [];
+        $access  = $config['access'] ?? [];
+        $redact  = $config['redact'] ?? [];
+        $history = $config['history'] ?? [];
 
         $this->envVar           = $env['var'] ?? 'APP_ENV';
         $this->blocked          = $env['blocked'] ?? ['production', 'prod'];
@@ -102,6 +119,14 @@ public function __construct(private readonly Application $app, array $config = [
         $this->accessCallback   = $access['callback'] ?? null;
         $this->collectorsConfig = $config['collectors'] ?? [];
         $this->headers          = $config['headers'] ?? true;
+        $this->historyOptions   = new HistoryOptions(
+            $history['enabled'] ?? false,
+            $history['url'] ?? '/_debugbar/open',
+            $history['path'] ?? '',
+            $history['max_requests'] ?? 100,
+            $history['ttl_seconds'] ?? 86400,
+            $history['max_browsers'] ?? 10
+        );
         $this->redactor         = new Redactor(
             [...Redactor::DEFAULT_KEYS, ...($redact['mask'] ?? [])],
             $redact['hidden'] ?? []
@@ -132,18 +157,24 @@ public function boot(): void
             return;
         }
 
-        $container = $this->app->getDI();
-        $request   = $this->resolveRequest($container);
+        /** @var DiInterface $container */
+        $container  = $this->app->getDI();
+        $request    = $this->resolveRequest($container);
+        $accessGate = new AccessGate($this->allowedIps, $this->accessCallback);
+        $history    = $this->registerHistory($container, $accessGate);
 
         $bar = new DebugBar();
         foreach ($this->buildCollectors($container, $request) as $collector) {
             $bar->addCollector($collector);
         }
+        if (null !== $history && null !== $this->historyEndpoint) {
+            $bar->addCollector(new HistoryCollector($this->historyEndpoint));
+        }
 
         Debug::setBar($bar);
 
         $eventsManager = $this->app->getEventsManager();
-        if (null === $eventsManager || null === $container) {
+        if (null === $eventsManager) {
             return;
         }
 
@@ -159,9 +190,12 @@ public function boot(): void
                 $bar,
                 new Renderer(),
                 new Injector(),
-                new AccessGate($this->allowedIps, $this->accessCallback),
+                $accessGate,
                 $request,
-                new BarOptions($this->headers, $this->nonce)
+                new BarOptions($this->headers, $this->nonce),
+                $history,
+                $this->historyEndpoint,
+                $this->historyCookie
             )
         );
     }
@@ -208,6 +242,10 @@ private function buildCollectors(?DiInterface $container, ?RequestInterface $req
             $collectors[] = new TimeCollector();
         }
 
+        if ($this->isCollectorEnabled(MemoryCollector::NAME)) {
+            $collectors[] = new MemoryCollector();
+        }
+
         if ($this->isCollectorEnabled(DatabaseCollector::NAME)) {
             $collectors[] = new DatabaseCollector();
         }
@@ -244,6 +282,52 @@ private function isCollectorEnabled(string $name): bool
         return $this->collectorsConfig[$name] ?? true;
     }
 
+    /**
+     * Wires the internal endpoint without reading or mutating the app router.
+     */
+    private function registerHistory(
+        ?DiInterface $container,
+        AccessGate $accessGate
+    ): ?History {
+        if (
+            !$this->historyOptions->enabled
+            || !$this->isCollectorEnabled(HistoryCollector::NAME)
+        ) {
+            return null;
+        }
+
+        $this->historyOptions->validate();
+
+        $eventsManager = $this->app->getEventsManager();
+        if (
+            null === $container
+            || null === $eventsManager
+        ) {
+            return null;
+        }
+
+        $this->historyCookie = HistoryCookie::fromGlobals();
+        $history             = new FilesystemHistory($this->historyOptions, null, $this->historyCookie);
+        $history->validateStorage();
+        $this->historyEndpoint = new HistoryEndpoint($this->historyOptions, $container);
+        $container->setShared(
+            HistoryController::class,
+            function () use ($accessGate, $container, $history): HistoryController {
+                $request = $container->has('request') ? $container->getShared('request') : null;
+
+                return new HistoryController(
+                    $history,
+                    $accessGate,
+                    $request instanceof RequestInterface ? $request : new Request(),
+                    new Response()
+                );
+            }
+        );
+        $eventsManager->attach('application:beforeHandleRequest', $this->historyEndpoint);
+
+        return $history;
+    }
+
     private function resolveConfig(DiInterface $container): ?ConfigInterface
     {
         if (!$container->has('config')) {
diff --git a/src/DebugBar/ResponseListener.php b/src/DebugBar/ResponseListener.php
index 36c3d14..bc11acf 100644
--- a/src/DebugBar/ResponseListener.php
+++ b/src/DebugBar/ResponseListener.php
@@ -13,13 +13,21 @@
 
 namespace Phalcon\DebugBar;
 
+use DateTimeImmutable;
+use DateTimeZone;
+use Phalcon\DebugBar\Contracts\History;
+use Phalcon\DebugBar\History\HistoryCookie;
+use Phalcon\DebugBar\History\HistoryEndpoint;
+use Phalcon\DebugBar\History\RequestMetadata;
 use Phalcon\DebugBar\Security\AccessGate;
 use Phalcon\Events\EventInterface;
 use Phalcon\Http\RequestInterface;
 use Phalcon\Http\ResponseInterface;
 
 use function count;
+use function is_float;
 use function is_string;
+use function sprintf;
 
 /**
  * The `application:beforeSendResponse` listener. On the event it runs the access
@@ -27,6 +35,7 @@
  * HTML response - renders and splices the bar in.
  *
  * @phpstan-import-type request_context from DebugBarTypes
+ * @phpstan-import-type payload from DebugBarTypes
  */
 final class ResponseListener
 {
@@ -36,7 +45,10 @@ public function __construct(
         private readonly Injector $injector,
         private readonly AccessGate $accessGate,
         private readonly ?RequestInterface $request,
-        private readonly BarOptions $options
+        private readonly BarOptions $options,
+        private readonly ?History $history = null,
+        private readonly ?HistoryEndpoint $historyEndpoint = null,
+        private readonly ?HistoryCookie $historyCookie = null
     ) {
     }
 
@@ -46,6 +58,10 @@ public function __invoke(EventInterface $event, mixed $source, mixed $response):
             return;
         }
 
+        if ($this->historyEndpoint?->matches()) {
+            return;
+        }
+
         [$clientIp, $isAjax] = $this->requestContext();
         if (true !== $this->accessGate->allows($clientIp)) {
             return;
@@ -53,6 +69,14 @@ public function __invoke(EventInterface $event, mixed $source, mixed $response):
 
         $collected = $this->bar->collect();
 
+        $this->record($collected, $response, $isAjax);
+        if (null !== $this->history) {
+            $this->historyCookie?->queue(
+                $this->historyEndpoint?->cookiePath() ?? '/',
+                $this->request?->isSecure() ?? false
+            );
+        }
+
         if (true === $this->options->headers) {
             $response->setHeader('X-Debug-Bar', (string) count($collected['data']));
         }
@@ -66,6 +90,28 @@ public function __invoke(EventInterface $event, mixed $source, mixed $response):
         }
     }
 
+    /**
+     * @param payload $collected
+     */
+    private function record(array $collected, ResponseInterface $response, bool $isAjax): void
+    {
+        if (null === $this->history || null === $this->request) {
+            return;
+        }
+
+        $uri = $this->request->getURI();
+        $this->history->save(
+            $collected,
+            new RequestMetadata(
+                $this->request->getMethod(),
+                $uri,
+                $response->getStatusCode() ?? 200,
+                $isAjax,
+                $this->requestedAt()
+            )
+        );
+    }
+
     /**
      * @return request_context
      */
@@ -79,4 +125,20 @@ private function requestContext(): array
 
         return [is_string($clientIp) ? $clientIp : null, $this->request->isAjax()];
     }
+
+    private function requestedAt(): ?DateTimeImmutable
+    {
+        $timestamp = $_SERVER['REQUEST_TIME_FLOAT'] ?? null;
+        if (!is_float($timestamp)) {
+            return null;
+        }
+
+        $requestedAt = DateTimeImmutable::createFromFormat(
+            'U.u',
+            sprintf('%.6F', $timestamp),
+            new DateTimeZone('UTC')
+        );
+
+        return false === $requestedAt ? null : $requestedAt;
+    }
 }
diff --git a/tests/JavaScript/debugbar.test.js b/tests/JavaScript/debugbar.test.js
new file mode 100644
index 0000000..35f218c
--- /dev/null
+++ b/tests/JavaScript/debugbar.test.js
@@ -0,0 +1,788 @@
+/**
+ * This file is part of the Phalcon Framework.
+ *
+ * (c) Phalcon Team <team@phalcon.io>
+ *
+ * For the full copyright and license information, please view the LICENSE.txt
+ * file that was distributed with this source code.
+ */
+
+'use strict';
+
+var test = require('node:test');
+var assert = require('node:assert/strict');
+var fs = require('node:fs');
+var vm = require('node:vm');
+var debugbarPath = require.resolve('../../resources/assets/debugbar.js');
+var debugbar = require(debugbarPath);
+var dom = require('./support/dom.js');
+var createHistoryRequestGuard = debugbar.createHistoryRequestGuard;
+var renderHistoryBrowser = debugbar.renderHistoryBrowser;
+
+test.afterEach(function () {
+    delete require.cache[debugbarPath];
+    delete global.document;
+    delete global.window;
+});
+
+function response(body) {
+    return {
+        ok: true,
+        json: function () {
+            return Promise.resolve(body);
+        }
+    };
+}
+
+function errorResponse(status) {
+    return {ok: false, status: status};
+}
+
+function deferred() {
+    var reject;
+    var resolve;
+    var promise = new Promise(function (promiseResolve, promiseReject) {
+        reject = promiseReject;
+        resolve = promiseResolve;
+    });
+
+    return {promise: promise, reject: reject, resolve: resolve};
+}
+
+test('browser execution does not replace a host CommonJS export', function () {
+    var hostExports = {host: true};
+    var context = {
+        document: {
+            addEventListener: function () {},
+            getElementById: function () {
+                return null;
+            }
+        },
+        module: {exports: hostExports}
+    };
+
+    vm.runInNewContext(fs.readFileSync(debugbarPath, 'utf8'), context);
+
+    assert.equal(context.module.exports, hostExports);
+});
+
+test('history request guard keeps only the latest list request', function () {
+    var guard = createHistoryRequestGuard(function () {
+        return true;
+    });
+    var first = guard.startList();
+    var second = guard.startList();
+
+    assert.equal(guard.isListCurrent(first), false);
+    assert.equal(guard.isListCurrent(second), true);
+});
+
+test('history request guard keeps only the latest detail request', function () {
+    var guard = createHistoryRequestGuard(function () {
+        return true;
+    });
+    var first = guard.startDetail();
+    var second = guard.startDetail();
+
+    assert.equal(guard.isDetailCurrent(first), false);
+    assert.equal(guard.isDetailCurrent(second), true);
+});
+
+test('refresh invalidates a pending detail request', function () {
+    var guard = createHistoryRequestGuard(function () {
+        return true;
+    });
+    var detail = guard.startDetail();
+
+    guard.startList();
+
+    assert.equal(guard.isDetailCurrent(detail), false);
+});
+
+test('closing history invalidates every pending request', function () {
+    var open = true;
+    var guard = createHistoryRequestGuard(function () {
+        return open;
+    });
+    var list = guard.startList();
+    var detail = guard.startDetail();
+
+    open = false;
+
+    assert.equal(guard.isListCurrent(list), false);
+    assert.equal(guard.isDetailCurrent(detail), false);
+});
+
+test('clear blocks list requests until it completes', function () {
+    var guard = createHistoryRequestGuard(function () {
+        return true;
+    });
+    var list = guard.startList();
+    var detail = guard.startDetail();
+    var clear = guard.startClear();
+
+    assert.equal(guard.isListCurrent(list), false);
+    assert.equal(guard.isDetailCurrent(detail), false);
+    assert.equal(guard.startList(), null);
+    assert.equal(guard.startDetail(), null);
+    assert.equal(guard.startClear(), null);
+    assert.equal(guard.finishClear(clear), true);
+    assert.equal(guard.finishClear(clear), false);
+    assert.equal(typeof guard.startList(), 'number');
+});
+
+test('empty request history renders its empty state', async function () {
+    global.document = dom.createDocument();
+    global.window = {
+        fetch: function () {
+            return Promise.resolve(response({requests: []}));
+        }
+    };
+    var mount = new dom.TestElement('div');
+
+    renderHistoryBrowser(mount, {url: '/_debugbar/open'}, '', function () {}, function () {}, function () {
+        return true;
+    });
+    await dom.flushPromises();
+
+    assert.equal(dom.findByClass(mount, 'phalcon-debugbar-history-empty').textContent, 'No stored requests');
+    assert.equal(dom.findByClass(mount, 'phalcon-debugbar-history-action').disabled, false);
+    assert.equal(dom.findByClass(mount, 'is-danger').disabled, true);
+});
+
+test('request history renders request metadata and selection', async function () {
+    global.document = dom.createDocument();
+    global.window = {
+        fetch: function () {
+            return Promise.resolve(response({
+                requests: [{
+                    id: 'request-one',
+                    method: 'POST',
+                    uri: '/orders',
+                    status: 201,
+                    requested_at: '2026-09-08T08:30:00+00:00'
+                }]
+            }));
+        }
+    };
+    var mount = new dom.TestElement('div');
+
+    renderHistoryBrowser(
+        mount,
+        {url: '/_debugbar/open'},
+        'request-one',
+        function () {},
+        function () {},
+        function () {
+            return true;
+        }
+    );
+    await dom.flushPromises();
+
+    assert.equal(dom.findByClass(mount, 'phalcon-debugbar-history-method').textContent, 'POST');
+    assert.equal(dom.findByClass(mount, 'phalcon-debugbar-history-uri').textContent, '/orders');
+    assert.equal(dom.findByClass(mount, 'phalcon-debugbar-history-status').textContent, '201');
+    assert.equal(
+        dom.findByClass(mount, 'phalcon-debugbar-history-time').textContent,
+        '2026-09-08T08:30:00+00:00'
+    );
+    assert.equal(dom.findByClass(mount, 'phalcon-debugbar-history-request').classList.contains('is-selected'), true);
+    assert.equal(dom.findByClass(mount, 'is-danger').disabled, false);
+});
+
+test('selecting a request loads and exposes its stored payload', async function () {
+    var calls = [];
+    var selected = null;
+    global.document = dom.createDocument();
+    global.window = {
+        fetch: function (url) {
+            calls.push(url);
+            if (calls.length === 1) {
+                return Promise.resolve(response({
+                    requests: [{id: 'request/one', method: 'GET', uri: '/orders', status: 200}]
+                }));
+            }
+
+            return Promise.resolve(response({
+                request: {version: 1, payload: {data: {route: {panel: '/orders/42'}}}}
+            }));
+        }
+    };
+    var mount = new dom.TestElement('div');
+
+    renderHistoryBrowser(mount, {url: '/_debugbar/open'}, '', function (payload, metadata, id) {
+        selected = {payload: payload, id: id};
+    }, function () {}, function () {
+        return true;
+    });
+    await dom.flushPromises();
+
+    var request = dom.findByClass(mount, 'phalcon-debugbar-history-request');
+    request.click();
+    await dom.flushPromises();
+
+    assert.equal(calls[1], '/_debugbar/open?id=request%2Fone');
+    assert.deepEqual(selected, {
+        payload: {data: {route: {panel: '/orders/42'}}},
+        id: 'request/one'
+    });
+    assert.equal(request.classList.contains('is-selected'), true);
+    assert.equal(request.disabled, false);
+});
+
+test('selecting a request rejects an incompatible stored payload version', async function () {
+    var selected = false;
+    global.document = dom.createDocument();
+    global.window = {
+        fetch: function (url) {
+            if (url.includes('?id=')) {
+                return Promise.resolve(response({
+                    request: {version: 2, payload: {data: {}, meta: {}}}
+                }));
+            }
+
+            return Promise.resolve(response({
+                requests: [{id: 'stale', method: 'GET', uri: '/stale', status: 200}]
+            }));
+        }
+    };
+    var mount = new dom.TestElement('div');
+
+    renderHistoryBrowser(mount, {url: '/_debugbar/open'}, '', function () {
+        selected = true;
+    }, function () {}, function () {
+        return true;
+    });
+    await dom.flushPromises();
+
+    var request = dom.findByClass(mount, 'phalcon-debugbar-history-request');
+    request.click();
+    await dom.flushPromises();
+
+    assert.equal(selected, false);
+    assert.equal(request.classList.contains('is-selected'), false);
+    assert.equal(request.disabled, false);
+});
+
+test('refresh replaces the rendered request list', async function () {
+    var responses = [
+        {requests: [{id: 'first', method: 'GET', uri: '/first', status: 200}]},
+        {requests: [{id: 'second', method: 'GET', uri: '/second', status: 200}]}
+    ];
+    var calls = 0;
+    global.document = dom.createDocument();
+    global.window = {
+        fetch: function () {
+            return Promise.resolve(response(responses[calls++]));
+        }
+    };
+    var mount = new dom.TestElement('div');
+
+    renderHistoryBrowser(mount, {url: '/_debugbar/open'}, '', function () {}, function () {}, function () {
+        return true;
+    });
+    await dom.flushPromises();
+
+    dom.findByClass(mount, 'phalcon-debugbar-history-action').click();
+    await dom.flushPromises();
+
+    assert.equal(calls, 2);
+    assert.equal(dom.findByClass(mount, 'phalcon-debugbar-history-uri').textContent, '/second');
+});
+
+test('clear blocks interaction and refreshes after deletion', async function () {
+    var deletion = deferred();
+    var calls = [];
+    var cleared = 0;
+    global.document = dom.createDocument();
+    global.window = {
+        confirm: function () {
+            return true;
+        },
+        fetch: function (url, options) {
+            calls.push({url: url, options: options});
+            if (calls.length === 1) {
+                return Promise.resolve(response({
+                    requests: [{id: 'first', method: 'GET', uri: '/first', status: 200}]
+                }));
+            }
+            if (calls.length === 2) {
+                return deletion.promise;
+            }
+
+            return Promise.resolve(response({requests: []}));
+        }
+    };
+    var mount = new dom.TestElement('div');
+
+    renderHistoryBrowser(mount, {url: '/_debugbar/open'}, '', function () {}, function () {
+        cleared++;
+    }, function () {
+        return true;
+    });
+    await dom.flushPromises();
+
+    var refresh = dom.findByClass(mount, 'phalcon-debugbar-history-action');
+    var clear = dom.findByClass(mount, 'is-danger');
+    clear.click();
+
+    assert.equal(calls.length, 2);
+    assert.equal(calls[1].options.method, 'DELETE');
+    assert.equal(refresh.disabled, true);
+    assert.equal(clear.disabled, true);
+    assert.equal(dom.findByClass(mount, 'phalcon-debugbar-history-loading').textContent, 'Clearing request history...');
+    refresh.click();
+    assert.equal(calls.length, 2);
+
+    deletion.resolve(response({cleared: 1}));
+    await dom.flushPromises();
+
+    assert.equal(calls.length, 3);
+    assert.equal(cleared, 1);
+    assert.equal(dom.findByClass(mount, 'phalcon-debugbar-history-empty').textContent, 'No stored requests');
+});
+
+test('request history reports list failures and restores refresh', async function () {
+    global.document = dom.createDocument();
+    global.window = {
+        fetch: function () {
+            return Promise.resolve(errorResponse(503));
+        }
+    };
+    var mount = new dom.TestElement('div');
+
+    renderHistoryBrowser(mount, {url: '/_debugbar/open'}, '', function () {}, function () {}, function () {
+        return true;
+    });
+    await dom.flushPromises();
+
+    assert.equal(
+        dom.findByClass(mount, 'phalcon-debugbar-history-error').textContent,
+        'Unable to load request history'
+    );
+    assert.equal(dom.findByClass(mount, 'phalcon-debugbar-history-action').disabled, false);
+});
+
+test('request history restores a row after a detail failure', async function () {
+    var calls = 0;
+    var selected = false;
+    global.document = dom.createDocument();
+    global.window = {
+        fetch: function () {
+            calls++;
+            if (calls === 1) {
+                return Promise.resolve(response({
+                    requests: [{id: 'first', method: 'GET', uri: '/first', status: 200}]
+                }));
+            }
+
+            return Promise.resolve(errorResponse(404));
+        }
+    };
+    var mount = new dom.TestElement('div');
+
+    renderHistoryBrowser(mount, {url: '/_debugbar/open'}, '', function () {
+        selected = true;
+    }, function () {}, function () {
+        return true;
+    });
+    await dom.flushPromises();
+
+    var request = dom.findByClass(mount, 'phalcon-debugbar-history-request');
+    request.click();
+    await dom.flushPromises();
+
+    assert.equal(selected, false);
+    assert.equal(request.disabled, false);
+    assert.equal(request.classList.contains('is-selected'), false);
+});
+
+test('request history reports clear failures and restores controls', async function () {
+    var calls = 0;
+    var cleared = false;
+    global.document = dom.createDocument();
+    global.window = {
+        confirm: function () {
+            return true;
+        },
+        fetch: function () {
+            calls++;
+            if (calls === 1) {
+                return Promise.resolve(response({
+                    requests: [{id: 'first', method: 'GET', uri: '/first', status: 200}]
+                }));
+            }
+
+            return Promise.resolve(errorResponse(500));
+        }
+    };
+    var mount = new dom.TestElement('div');
+
+    renderHistoryBrowser(mount, {url: '/_debugbar/open'}, '', function () {}, function () {
+        cleared = true;
+    }, function () {
+        return true;
+    });
+    await dom.flushPromises();
+
+    var refresh = dom.findByClass(mount, 'phalcon-debugbar-history-action');
+    var clear = dom.findByClass(mount, 'is-danger');
+    clear.click();
+    await dom.flushPromises();
+
+    assert.equal(cleared, false);
+    assert.equal(refresh.disabled, false);
+    assert.equal(clear.disabled, false);
+    assert.equal(
+        dom.findByClass(mount, 'phalcon-debugbar-history-error').textContent,
+        'Unable to clear request history'
+    );
+});
+
+test('indicator collectors render once on the right and open their panels', function () {
+    var dataNode = new dom.TestElement('script');
+    var mount = new dom.TestElement('div');
+    dataNode.textContent = JSON.stringify({
+        data: {
+            messages: {panel: []},
+            time: {panel: [], badge: '12.34ms'},
+            memory: {
+                panel: {'Translated current usage': 'panel-value', 'Peak usage': '8MB'},
+                badge: '8MB',
+                metrics: {current_usage: '7.5MB'}
+            },
+            request: {
+                panel: {Method: 'GET', URI: '/orders'},
+                metrics: {method: 'GET', uri: '/orders'}
+            },
+            history: {panel: {url: '/_debugbar/open'}}
+        },
+        meta: {
+            widgets: {
+                messages: {label: 'Messages', panel: 'list'},
+                time: {
+                    label: 'Time',
+                    panel: 'list',
+                    indicator: {icon: 'clock', label: 'Request time', path: ['badge']}
+                },
+                memory: {
+                    label: 'Memory',
+                    panel: 'grid',
+                    indicator: {
+                        icon: 'cogs',
+                        label: 'Current memory usage',
+                        path: ['metrics', 'current_usage']
+                    }
+                },
+                request: {
+                    label: 'Request',
+                    panel: 'grid',
+                    request: {method: ['metrics', 'method'], uri: ['metrics', 'uri']}
+                },
+                history: {label: 'History', panel: 'history'}
+            }
+        }
+    });
+    global.document = dom.createDocument({
+        'phalcon-debugbar': mount,
+        'phalcon-debugbar-data': dataNode
+    });
+    global.window = {
+        localStorage: {
+            getItem: function () {
+                return null;
+            },
+            setItem: function () {}
+        }
+    };
+
+    require(debugbarPath);
+
+    var labels = mount.querySelectorAll('.phalcon-debugbar-tab-label').map(function (label) {
+        return label.textContent;
+    });
+    var indicators = dom.findByClass(mount, 'phalcon-debugbar-indicators');
+    assert.deepEqual(labels, ['Messages', 'Request']);
+    assert.ok(indicators);
+    assert.equal(indicators.textContent, '12.34ms7.5MBGET/orders');
+    var metrics = indicators.querySelectorAll('.phalcon-debugbar-metric');
+    assert.equal(metrics.length, 2);
+    assert.equal(metrics[0].tagName, 'BUTTON');
+    metrics[0].click();
+    assert.equal(metrics[0].classList.contains('is-active'), true);
+    assert.equal(dom.findByClass(mount, 'phalcon-debugbar-body').style.display, 'block');
+    metrics[0].click();
+    assert.equal(metrics[0].classList.contains('is-active'), false);
+    assert.equal(dom.findByClass(mount, 'phalcon-debugbar-body').style.display, 'none');
+});
+
+test('request metrics use widget metadata when the collector has a different name', function () {
+    var dataNode = new dom.TestElement('script');
+    var mount = new dom.TestElement('div');
+    dataNode.textContent = JSON.stringify({
+        data: {
+            time: {panel: [], badge: '12.34ms'},
+            http: {
+                panel: {Method: 'GET', URI: '/orders'},
+                metrics: {method: 'GET', uri: '/orders'}
+            }
+        },
+        meta: {
+            widgets: {
+                time: {
+                    label: 'Time',
+                    panel: 'list',
+                    indicator: {icon: 'clock', label: 'Request time', path: ['badge']}
+                },
+                http: {
+                    label: 'Request',
+                    panel: 'grid',
+                    request: {method: ['metrics', 'method'], uri: ['metrics', 'uri']}
+                }
+            }
+        }
+    });
+    global.document = dom.createDocument({
+        'phalcon-debugbar': mount,
+        'phalcon-debugbar-data': dataNode
+    });
+    global.window = {
+        localStorage: {
+            getItem: function () {
+                return null;
+            },
+            setItem: function () {}
+        }
+    };
+
+    require(debugbarPath);
+
+    var labels = mount.querySelectorAll('.phalcon-debugbar-tab-label').map(function (label) {
+        return label.textContent;
+    });
+    var indicators = dom.findByClass(mount, 'phalcon-debugbar-indicators');
+    assert.deepEqual(labels, ['Request']);
+    assert.equal(indicators.textContent, '12.34msGET/orders');
+    assert.equal(dom.findByClass(indicators, 'phalcon-debugbar-metric').tagName, 'BUTTON');
+    assert.equal(dom.findByClass(indicators, 'phalcon-debugbar-request-control').tagName, 'SPAN');
+});
+
+test('request control replaces the History tab and opens request history', async function () {
+    var dataNode = new dom.TestElement('script');
+    var mount = new dom.TestElement('div');
+    dataNode.textContent = JSON.stringify({
+        data: {
+            messages: {panel: []},
+            request: {
+                panel: {Method: 'GET', URI: '/orders'},
+                metrics: {method: 'GET', uri: '/orders'}
+            },
+            history: {panel: {url: '/_debugbar/open'}}
+        },
+        meta: {
+            widgets: {
+                messages: {label: 'Messages', panel: 'list'},
+                request: {
+                    label: 'Request',
+                    panel: 'grid',
+                    request: {method: ['metrics', 'method'], uri: ['metrics', 'uri']}
+                },
+                history: {label: 'History', panel: 'history'}
+            }
+        }
+    });
+    global.document = dom.createDocument({
+        'phalcon-debugbar': mount,
+        'phalcon-debugbar-data': dataNode
+    });
+    global.window = {
+        fetch: function () {
+            return Promise.resolve(response({requests: []}));
+        }
+    };
+
+    delete require.cache[debugbarPath];
+    require(debugbarPath);
+
+    var tabs = dom.findByClass(mount, 'phalcon-debugbar-tabs');
+    var requestControl = dom.findByClass(mount, 'phalcon-debugbar-request-control');
+    assert.equal(requestControl.tagName, 'BUTTON');
+    assert.equal(requestControl.textContent, 'GET/orders');
+    assert.equal(requestControl.querySelectorAll('.phalcon-debugbar-indicator-icon').length, 1);
+    assert.equal(requestControl.attributes['aria-expanded'], 'false');
+    assert.equal(requestControl.title, 'Open request history: GET /orders');
+    assert.equal(tabs.querySelectorAll('.phalcon-debugbar-tab-label').map(function (label) {
+        return label.textContent;
+    }).includes('History'), false);
+    var requestTab = tabs.querySelectorAll('.phalcon-debugbar-tab').filter(function (tab) {
+        return tab.textContent === 'Request';
+    })[0];
+    requestTab.click();
+    requestControl.click();
+    await dom.flushPromises();
+    requestControl = dom.findByClass(mount, 'phalcon-debugbar-request-control');
+    assert.equal(requestControl.attributes['aria-expanded'], 'true');
+    assert.equal(requestControl.title, 'Close request history: GET /orders');
+    assert.equal(dom.findByClass(mount, 'phalcon-debugbar-history-browser').style.display, 'block');
+    assert.equal(dom.findByClass(mount, 'phalcon-debugbar-body').style.display, 'none');
+    assert.equal(requestTab.classList.contains('is-active'), false);
+
+    requestTab.click();
+    requestControl = dom.findByClass(mount, 'phalcon-debugbar-request-control');
+    assert.equal(requestControl.attributes['aria-expanded'], 'false');
+    assert.equal(requestControl.title, 'Open request history: GET /orders');
+    assert.equal(dom.findByClass(mount, 'phalcon-debugbar-history-browser').style.display, 'none');
+    assert.equal(dom.findByClass(mount, 'phalcon-debugbar-body').style.display, 'block');
+    assert.equal(requestTab.classList.contains('is-active'), true);
+});
+
+test('selecting stored data closes history and uses metadata without a request collector', async function () {
+    var dataNode = new dom.TestElement('script');
+    var mount = new dom.TestElement('div');
+    var historyPanel = {url: '/_debugbar/open'};
+    var widgets = {
+        history: {label: 'History', panel: 'history'},
+        time: {
+            label: 'Time',
+            panel: 'list',
+            indicator: {icon: 'clock', label: 'Request time', path: ['badge']}
+        },
+        request: {
+            label: 'Request',
+            panel: 'grid',
+            request: {method: ['metrics', 'method'], uri: ['metrics', 'uri']}
+        }
+    };
+    dataNode.textContent = JSON.stringify({
+        data: {
+            history: {panel: historyPanel},
+            time: {panel: [{label: 'Request', message: '10ms'}], badge: '10ms'},
+            request: {
+                panel: {Method: 'GET', URI: '/current'},
+                metrics: {method: 'GET', uri: '/current'}
+            }
+        },
+        meta: {widgets: widgets}
+    });
+    global.document = dom.createDocument({
+        'phalcon-debugbar': mount,
+        'phalcon-debugbar-data': dataNode
+    });
+    var calls = 0;
+    global.window = {
+        fetch: function () {
+            calls++;
+            if (calls === 1) {
+                return Promise.resolve(response({
+                    requests: [{id: 'stored', method: 'GET', uri: '/stored', status: 200}]
+                }));
+            }
+
+            return Promise.resolve(response({
+                request: {
+                    version: 1,
+                    meta: {method: 'POST', uri: '/stored'},
+                    payload: {
+                        data: {
+                            history: {panel: historyPanel},
+                            time: {panel: [{label: 'Request', message: '20ms'}], badge: '20ms'}
+                        },
+                        meta: {widgets: widgets}
+                    }
+                }
+            }));
+        }
+    };
+
+    require(debugbarPath);
+    var timeIndicator = dom.findByClass(mount, 'phalcon-debugbar-metric');
+    timeIndicator.click();
+    assert.equal(timeIndicator.classList.contains('is-active'), true);
+    var requestControl = dom.findByClass(mount, 'phalcon-debugbar-request-control');
+    requestControl.click();
+    await dom.flushPromises();
+
+    var historyBrowser = dom.findByClass(mount, 'phalcon-debugbar-history-browser');
+    var request = dom.findByClass(historyBrowser, 'phalcon-debugbar-history-request');
+    request.click();
+    await dom.flushPromises();
+
+    assert.equal(calls, 2);
+    assert.equal(dom.findByClass(mount, 'phalcon-debugbar-history-browser'), historyBrowser);
+    assert.equal(historyBrowser.style.display, 'none');
+    assert.equal(request.classList.contains('is-selected'), true);
+    assert.equal(dom.findByClass(mount, 'phalcon-debugbar-request-control').textContent, 'POST/stored');
+    var storedTimeIndicator = dom.findByClass(mount, 'phalcon-debugbar-metric');
+    assert.equal(storedTimeIndicator.textContent, '20ms');
+    assert.equal(storedTimeIndicator.classList.contains('is-active'), true);
+    assert.equal(dom.findByClass(mount, 'phalcon-debugbar-body').style.display, 'block');
+});
+
+test('selecting stored data reopens the collector tab active before history', async function () {
+    var dataNode = new dom.TestElement('script');
+    var mount = new dom.TestElement('div');
+    var historyPanel = {url: '/_debugbar/open'};
+    var widgets = {
+        database: {label: 'Database', panel: 'list'},
+        history: {label: 'History', panel: 'history'},
+        request: {
+            label: 'Request',
+            panel: 'grid',
+            request: {method: ['metrics', 'method'], uri: ['metrics', 'uri']}
+        }
+    };
+    dataNode.textContent = JSON.stringify({
+        data: {
+            database: {panel: [{label: 'Current', message: 'SELECT 1'}]},
+            history: {panel: historyPanel},
+            request: {metrics: {method: 'GET', uri: '/current'}, panel: {}}
+        },
+        meta: {widgets: widgets}
+    });
+    global.document = dom.createDocument({
+        'phalcon-debugbar': mount,
+        'phalcon-debugbar-data': dataNode
+    });
+    var calls = 0;
+    global.window = {
+        fetch: function () {
+            calls++;
+            if (calls === 1) {
+                return Promise.resolve(response({
+                    requests: [{id: 'stored', method: 'GET', uri: '/stored', status: 200}]
+                }));
+            }
+
+            return Promise.resolve(response({
+                request: {
+                    version: 1,
+                    meta: {method: 'GET', uri: '/stored'},
+                    payload: {
+                        data: {
+                            database: {panel: [{label: 'Stored', message: 'SELECT 2'}]},
+                            history: {panel: historyPanel},
+                            request: {metrics: {method: 'GET', uri: '/stored'}, panel: {}}
+                        },
+                        meta: {widgets: widgets}
+                    }
+                }
+            }));
+        }
+    };
+
+    require(debugbarPath);
+    var databaseTab = mount.querySelectorAll('.phalcon-debugbar-tab').filter(function (tab) {
+        return tab.textContent === 'Database';
+    })[0];
+    databaseTab.click();
+    dom.findByClass(mount, 'phalcon-debugbar-request-control').click();
+    await dom.flushPromises();
+    dom.findByClass(mount, 'phalcon-debugbar-history-request').click();
+    await dom.flushPromises();
+
+    var storedDatabaseTab = mount.querySelectorAll('.phalcon-debugbar-tab').filter(function (tab) {
+        return tab.textContent === 'Database';
+    })[0];
+    assert.equal(storedDatabaseTab.classList.contains('is-active'), true);
+    assert.equal(dom.findByClass(mount, 'phalcon-debugbar-body').textContent, 'StoredSELECT 2');
+});
diff --git a/tests/JavaScript/support/dom.js b/tests/JavaScript/support/dom.js
new file mode 100644
index 0000000..b94272d
--- /dev/null
+++ b/tests/JavaScript/support/dom.js
@@ -0,0 +1,175 @@
+/**
+ * This file is part of the Phalcon Framework.
+ *
+ * (c) Phalcon Team <team@phalcon.io>
+ *
+ * For the full copyright and license information, please view the LICENSE.txt
+ * file that was distributed with this source code.
+ */
+
+'use strict';
+
+function TestElement(tagName) {
+    this.tagName = String(tagName).toUpperCase();
+    this.children = [];
+    this.parentNode = null;
+    this.style = {};
+    this.disabled = false;
+    this.type = '';
+    this.attributes = {};
+    this._className = '';
+    this._listeners = {};
+    this._textContent = '';
+}
+
+Object.defineProperty(TestElement.prototype, 'className', {
+    get: function () {
+        return this._className;
+    },
+    set: function (value) {
+        this._className = String(value || '');
+    }
+});
+
+Object.defineProperty(TestElement.prototype, 'classList', {
+    get: function () {
+        var element = this;
+
+        return {
+            add: function (name) {
+                var classes = element._classes();
+                if (classes.indexOf(name) === -1) {
+                    classes.push(name);
+                    element.className = classes.join(' ');
+                }
+            },
+            contains: function (name) {
+                return element._classes().indexOf(name) !== -1;
+            },
+            remove: function (name) {
+                element.className = element._classes().filter(function (current) {
+                    return current !== name;
+                }).join(' ');
+            },
+            toggle: function (name, force) {
+                var enabled = force === undefined ? !this.contains(name) : Boolean(force);
+                if (enabled) {
+                    this.add(name);
+                } else {
+                    this.remove(name);
+                }
+
+                return enabled;
+            }
+        };
+    }
+});
+
+Object.defineProperty(TestElement.prototype, 'innerHTML', {
+    get: function () {
+        return '';
+    },
+    set: function () {
+        this.children = [];
+        this._textContent = '';
+    }
+});
+
+// Keep textContent as plain text: production rendering relies on it to avoid interpreting history data as HTML.
+Object.defineProperty(TestElement.prototype, 'textContent', {
+    get: function () {
+        return this._textContent + this.children.map(function (child) {
+            return child.textContent;
+        }).join('');
+    },
+    set: function (value) {
+        this.children = [];
+        this._textContent = String(value || '');
+    }
+});
+
+TestElement.prototype._classes = function () {
+    return this.className.split(/\s+/).filter(Boolean);
+};
+
+TestElement.prototype.addEventListener = function (name, listener) {
+    this._listeners[name] = listener;
+};
+
+TestElement.prototype.appendChild = function (child) {
+    child.parentNode = this;
+    this.children.push(child);
+
+    return child;
+};
+
+TestElement.prototype.click = function () {
+    if (!this.disabled && this._listeners.click) {
+        this._listeners.click();
+    }
+};
+
+TestElement.prototype.querySelectorAll = function (selector) {
+    var className = selector.charAt(0) === '.' ? selector.slice(1) : '';
+    var attribute = /^\[([^\]]+)\]$/.exec(selector);
+    var matches = [];
+
+    this.children.forEach(function (child) {
+        if (
+            (className && child.classList.contains(className))
+            || (attribute && Object.prototype.hasOwnProperty.call(child.attributes, attribute[1]))
+        ) {
+            matches.push(child);
+        }
+        matches = matches.concat(child.querySelectorAll(selector));
+    });
+
+    return matches;
+};
+
+TestElement.prototype.setAttribute = function (name, value) {
+    this.attributes[name] = String(value);
+    if (name === 'class') {
+        this.className = value;
+    }
+};
+
+TestElement.prototype.getAttribute = function (name) {
+    return Object.prototype.hasOwnProperty.call(this.attributes, name)
+        ? this.attributes[name]
+        : null;
+};
+
+function createDocument(elements) {
+    elements = elements || {};
+
+    return {
+        readyState: 'complete',
+        createElement: function (tagName) {
+            return new TestElement(tagName);
+        },
+        createElementNS: function (namespace, tagName) {
+            return new TestElement(tagName);
+        },
+        getElementById: function (id) {
+            return elements[id] || null;
+        }
+    };
+}
+
+function findByClass(root, className) {
+    return root.querySelectorAll('.' + className)[0] || null;
+}
+
+function flushPromises() {
+    return new Promise(function (resolve) {
+        setImmediate(resolve);
+    });
+}
+
+module.exports = {
+    TestElement: TestElement,
+    createDocument: createDocument,
+    findByClass: findByClass,
+    flushPromises: flushPromises
+};
diff --git a/tests/Unit/DebugBar/Collector/HistoryCollectorTest.php b/tests/Unit/DebugBar/Collector/HistoryCollectorTest.php
new file mode 100644
index 0000000..5f53731
--- /dev/null
+++ b/tests/Unit/DebugBar/Collector/HistoryCollectorTest.php
@@ -0,0 +1,60 @@
+<?php
+
+/**
+ * This file is part of the Phalcon Framework.
+ *
+ * (c) Phalcon Team <team@phalcon.io>
+ *
+ * For the full copyright and license information, please view the LICENSE.txt
+ * file that was distributed with this source code.
+ */
+
+declare(strict_types=1);
+
+namespace Phalcon\Tests\Unit\DebugBar\Collector;
+
+use Phalcon\DebugBar\Collector\HistoryCollector;
+use Phalcon\DebugBar\History\HistoryEndpoint;
+use Phalcon\DebugBar\History\HistoryOptions;
+use Phalcon\Di\FactoryDefault;
+use Phalcon\Http\Request;
+use Phalcon\Mvc\Url;
+use Phalcon\Talon\PHPUnit\AbstractUnitTestCase;
+use Phalcon\Tests\Support\DebugBar\PanelContractTrait;
+
+final class HistoryCollectorTest extends AbstractUnitTestCase
+{
+    use PanelContractTrait;
+
+    public function testCollectCarriesTheInternalEndpoint(): void
+    {
+        $collector = $this->collector();
+
+        $this->assertSame('history', $collector->getName());
+        $this->assertSame('history', $collector->getWidget()['panel']);
+        $this->assertSame(
+            ['panel' => ['url' => '/_debugbar/open'], 'badge' => null],
+            $collector->collect()
+        );
+        $this->assertPanelContract($collector);
+    }
+
+    public function testWidgetDoesNotDefineOtherCollectors(): void
+    {
+        $widget = $this->collector()->getWidget();
+
+        $this->assertArrayNotHasKey('indicator', $widget);
+        $this->assertArrayNotHasKey('indicators', $widget);
+    }
+
+    private function collector(): HistoryCollector
+    {
+        $container = new FactoryDefault();
+        $url       = new Url();
+        $url->setBaseUri('/');
+        $container->setShared('request', new Request());
+        $container->setShared('url', $url);
+
+        return new HistoryCollector(new HistoryEndpoint(new HistoryOptions(true), $container));
+    }
+}
diff --git a/tests/Unit/DebugBar/Collector/MemoryCollectorTest.php b/tests/Unit/DebugBar/Collector/MemoryCollectorTest.php
new file mode 100644
index 0000000..dc48ea4
--- /dev/null
+++ b/tests/Unit/DebugBar/Collector/MemoryCollectorTest.php
@@ -0,0 +1,92 @@
+<?php
+
+/**
+ * This file is part of the Phalcon Framework.
+ *
+ * (c) Phalcon Team <team@phalcon.io>
+ *
+ * For the full copyright and license information, please view the LICENSE.txt
+ * file that was distributed with this source code.
+ */
+
+declare(strict_types=1);
+
+namespace Phalcon\Tests\Unit\DebugBar\Collector;
+
+use Phalcon\DebugBar\Collector\MemoryCollector;
+use Phalcon\Talon\PHPUnit\AbstractUnitTestCase;
+use Phalcon\Tests\Support\DebugBar\PanelContractTrait;
+
+use function array_keys;
+use function memory_get_usage;
+use function str_repeat;
+
+final class MemoryCollectorTest extends AbstractUnitTestCase
+{
+    use PanelContractTrait;
+
+    public function testCollectReportsCurrentAndPeakMemory(): void
+    {
+        $collected = (new MemoryCollector())->collect();
+
+        $this->assertSame(['Current usage', 'Peak usage'], array_keys($collected['panel']));
+        $current = $collected['panel']['Current usage'];
+        $peak    = $collected['panel']['Peak usage'];
+        $this->assertIsString($current);
+        $this->assertIsString($peak);
+        $this->assertMatchesRegularExpression(
+            '/^\d+(\.\d+)?(B|KB|MB|GB|TB)$/',
+            $current
+        );
+        $this->assertMatchesRegularExpression(
+            '/^\d+(\.\d+)?(B|KB|MB|GB|TB)$/',
+            $peak
+        );
+        $this->assertSame($peak, $collected['badge']);
+        if (!isset($collected['metrics'])) {
+            $this->fail('Expected stable collector metrics.');
+        }
+        $this->assertSame(
+            $current,
+            $collected['metrics'][MemoryCollector::METRIC_CURRENT_USAGE]
+        );
+    }
+
+    public function testCurrentUsageTracksMemoryUsedInsideReservedAllocation(): void
+    {
+        $reservations = [];
+        while (memory_get_usage(true) - memory_get_usage(false) < 262144) {
+            $reservations[] = str_repeat('x', 524288);
+        }
+
+        $collector = new MemoryCollector();
+        $before    = $collector->collect()['panel']['Current usage'];
+        $probe     = str_repeat('x', 65536);
+        $after     = $collector->collect()['panel']['Current usage'];
+
+        $this->assertNotSame('', $probe);
+        $this->assertNotSame($before, $after);
+    }
+
+    public function testNameAndPanelContract(): void
+    {
+        $collector = new MemoryCollector();
+
+        $this->assertSame('memory', $collector->getName());
+        $widget = $collector->getWidget();
+        $this->assertSame('Memory', $widget['label']);
+        $this->assertSame('grid', $widget['panel']);
+        if (!isset($widget['indicator'])) {
+            $this->fail('Expected the memory indicator definition.');
+        }
+        $this->assertSame(
+            [
+                'icon'  => 'cogs',
+                'label' => 'Current memory usage',
+                'path'  => ['metrics', MemoryCollector::METRIC_CURRENT_USAGE],
+            ],
+            $widget['indicator']
+        );
+        $this->assertPanelContract($collector);
+    }
+}
diff --git a/tests/Unit/DebugBar/Collector/RequestCollectorTest.php b/tests/Unit/DebugBar/Collector/RequestCollectorTest.php
index 0135cc7..1e99730 100644
--- a/tests/Unit/DebugBar/Collector/RequestCollectorTest.php
+++ b/tests/Unit/DebugBar/Collector/RequestCollectorTest.php
@@ -28,6 +28,13 @@ public function testEmptyPanelWhenNoRequest(): void
         $collector = new RequestCollector(null, new Redactor());
 
         $this->assertSame('request', $collector->getName());
+        $this->assertSame(
+            [
+                'method' => ['metrics', RequestCollector::METRIC_METHOD],
+                'uri'    => ['metrics', RequestCollector::METRIC_URI],
+            ],
+            $collector->getWidget()['request']
+        );
         $this->assertSame([], $collector->collect()['panel']);
         $this->assertPanelContract($collector);
     }
@@ -59,10 +66,16 @@ public function testRequestDataIsFlattenedAndRedacted(): void
             'Authorization' => 'Bearer token-value',
         ]);
 
-        $panel = (new RequestCollector($request, new Redactor()))->collect()['panel'];
+        $collected = (new RequestCollector($request, new Redactor()))->collect();
+        $panel     = $collected['panel'];
 
         $this->assertSame('POST', $panel['Method']);
         $this->assertSame('/login', $panel['URI']);
+        if (!isset($collected['metrics'])) {
+            $this->fail('Expected stable request metrics.');
+        }
+        $this->assertSame('POST', $collected['metrics'][RequestCollector::METRIC_METHOD]);
+        $this->assertSame('/login', $collected['metrics'][RequestCollector::METRIC_URI]);
         $this->assertSame('phalcon', $panel['Query.q']);
         $this->assertSame('', $panel['Query.n']);
         $this->assertSame('sarah-connor', $panel['Post.username']);
diff --git a/tests/Unit/DebugBar/Collector/TimeCollectorTest.php b/tests/Unit/DebugBar/Collector/TimeCollectorTest.php
index 805afe7..a4ec532 100644
--- a/tests/Unit/DebugBar/Collector/TimeCollectorTest.php
+++ b/tests/Unit/DebugBar/Collector/TimeCollectorTest.php
@@ -124,6 +124,14 @@ public function testNameAndPanelContract(): void
         $collector->startMeasure('x');
 
         $this->assertSame('time', $collector->getName());
+        $widget = $collector->getWidget();
+        if (!isset($widget['indicator'])) {
+            $this->fail('Expected the time indicator definition.');
+        }
+        $this->assertSame(
+            ['icon' => 'clock', 'label' => 'Request time', 'path' => ['badge']],
+            $widget['indicator']
+        );
         $this->assertPanelContract($collector);
     }
 }
diff --git a/tests/Unit/DebugBar/Controllers/HistoryControllerTest.php b/tests/Unit/DebugBar/Controllers/HistoryControllerTest.php
new file mode 100644
index 0000000..314cf93
--- /dev/null
+++ b/tests/Unit/DebugBar/Controllers/HistoryControllerTest.php
@@ -0,0 +1,270 @@
+<?php
+
+/**
+ * This file is part of the Phalcon Framework.
+ *
+ * (c) Phalcon Team <team@phalcon.io>
+ *
+ * For the full copyright and license information, please view the LICENSE.txt
+ * file that was distributed with this source code.
+ */
+
+declare(strict_types=1);
+
+namespace Phalcon\Tests\Unit\DebugBar\Controllers;
+
+use Phalcon\DebugBar\Contracts\History;
+use Phalcon\DebugBar\Controllers\HistoryController;
+use Phalcon\DebugBar\History\FilesystemHistory;
+use Phalcon\DebugBar\History\HistoryCookie;
+use Phalcon\DebugBar\History\HistoryOptions;
+use Phalcon\DebugBar\History\RequestMetadata;
+use Phalcon\DebugBar\Security\AccessGate;
+use Phalcon\Http\Request;
+use Phalcon\Http\RequestInterface;
+use Phalcon\Http\Response;
+use Phalcon\Http\ResponseInterface;
+use Phalcon\Talon\PHPUnit\AbstractUnitTestCase;
+use PHPUnit\Framework\Attributes\RunInSeparateProcess;
+
+use function bin2hex;
+use function file_exists;
+use function glob;
+use function hash;
+use function is_dir;
+use function json_decode;
+use function random_bytes;
+use function rmdir;
+use function session_id;
+use function session_start;
+use function session_write_close;
+use function sys_get_temp_dir;
+use function unlink;
+
+final class HistoryControllerTest extends AbstractUnitTestCase
+{
+    public function testActionsHideHistoryWhenAccessIsDenied(): void
+    {
+        $_SERVER['REMOTE_ADDR'] = '203.0.113.10';
+        $history                = new FilesystemHistory(new HistoryOptions());
+
+        foreach (['indexAction', 'clearAction'] as $action) {
+            $response = $this->executeWithServices(
+                $action,
+                new Request(),
+                new Response(),
+                $history,
+                new AccessGate(['127.0.0.1'], null)
+            );
+
+            $this->assertJsonResponse($response, 404, ['error' => 'Not found.']);
+        }
+    }
+
+    public function testActionsRejectUnsupportedMethods(): void
+    {
+        $history = new FilesystemHistory(new HistoryOptions());
+
+        foreach ([['indexAction', 'POST'], ['clearAction', 'GET']] as [$action, $method]) {
+            $_SERVER['REQUEST_METHOD'] = $method;
+            $response                  = $this->executeWithServices(
+                $action,
+                new Request(),
+                new Response(),
+                $history,
+                new AccessGate([], null)
+            );
+
+            $this->assertJsonResponse($response, 405, ['error' => 'Method not allowed.']);
+        }
+    }
+
+    public function testControllerUsesTheStorageContract(): void
+    {
+        $history = $this->createMock(History::class);
+        $history->expects($this->once())->method('find')->willReturn([['id' => 'stored-request']]);
+        $history->expects($this->once())->method('get')->with('stored-request')->willReturn(['payload' => []]);
+        $history->expects($this->once())->method('clear')->willReturn(3);
+        $request = $this->createMock(RequestInterface::class);
+        $request->method('getServer')->with('REQUEST_METHOD')->willReturnOnConsecutiveCalls(
+            'GET',
+            'GET',
+            'GET',
+            'GET',
+            'DELETE',
+            'DELETE'
+        );
+        $request->method('getQuery')->with('id')->willReturnOnConsecutiveCalls(null, 'stored-request');
+        $controller = new HistoryController($history, new AccessGate([], null), $request, new Response());
+
+        $this->assertJsonResponse($controller->openAction(), 200, ['requests' => [['id' => 'stored-request']]]);
+        $this->assertJsonResponse($controller->openAction(), 200, ['request' => ['payload' => []]]);
+        $this->assertJsonResponse($controller->openAction(), 200, ['cleared' => 3]);
+    }
+
+    public function testInvalidStoredRequestIdentifierReturnsNotFound(): void
+    {
+        $_SERVER['REQUEST_METHOD'] = 'GET';
+
+        foreach (['', ['invalid']] as $id) {
+            $_GET     = ['id' => $id];
+            $response = $this->executeWithServices(
+                'indexAction',
+                new Request(),
+                new Response(),
+                new FilesystemHistory(new HistoryOptions()),
+                new AccessGate([], null)
+            );
+
+            $this->assertJsonResponse($response, 404, ['error' => 'Request not found.']);
+        }
+    }
+
+    #[RunInSeparateProcess]
+    public function testListsAndLoadsRequestsFromTheCurrentBrowser(): void
+    {
+        $sessionId                    = 'debugbar-' . bin2hex(random_bytes(8));
+        $browserId                    = bin2hex(random_bytes(32));
+        $_COOKIE[HistoryCookie::NAME] = $browserId;
+        $path                         = sys_get_temp_dir() . '/phalcon-debugbar-controller-' . bin2hex(random_bytes(8));
+        session_id($sessionId);
+        session_start();
+
+        try {
+            $_SERVER['REQUEST_METHOD'] = 'GET';
+            $history                   = new FilesystemHistory(new HistoryOptions(true, '/_debugbar/open', $path));
+            $id                        = $history->save(
+                ['data' => [], 'meta' => ['collectors' => 0]],
+                new RequestMetadata('GET', '/orders', 200, false)
+            );
+            $this->assertIsString($id);
+
+            $_GET = [];
+            $list = $this->execute($history);
+            $this->assertSame(200, $list->getStatusCode());
+            $listBody = json_decode($list->getContent(), true);
+            $this->assertIsArray($listBody);
+            $requests = $listBody['requests'];
+            $this->assertIsArray($requests);
+            $this->assertCount(1, $requests);
+
+            $_GET   = ['id' => $id];
+            $detail = $this->execute($history);
+            $this->assertSame(200, $detail->getStatusCode());
+            $detailBody = json_decode($detail->getContent(), true);
+            $this->assertIsArray($detailBody);
+            $request = $detailBody['request'];
+            $this->assertIsArray($request);
+            $meta = $request['meta'];
+            $this->assertIsArray($meta);
+            $this->assertSame($id, $meta['id']);
+            $this->assertSame('no-store, private', $detail->getHeaders()->get('Cache-Control'));
+
+            $_SERVER['REQUEST_METHOD'] = 'DELETE';
+            $_GET                      = [];
+            $clear                     = $this->execute($history, 'clear');
+            $this->assertSame(200, $clear->getStatusCode());
+            $clearBody = json_decode($clear->getContent(), true);
+            $this->assertIsArray($clearBody);
+            $this->assertSame(1, $clearBody['cleared']);
+            $this->assertSame([], $history->find());
+        } finally {
+            session_write_close();
+            $directory = $path . '/' . hash('sha256', $browserId);
+            $files     = glob($directory . '/*');
+            if (false !== $files) {
+                foreach ($files as $file) {
+                    unlink($file);
+                }
+            }
+
+            if (is_dir($directory)) {
+                rmdir($directory);
+            }
+            if (file_exists($path . '/.gc')) {
+                unlink($path . '/.gc');
+            }
+            if (file_exists($path . '/.lock')) {
+                unlink($path . '/.lock');
+            }
+            if (is_dir($path)) {
+                rmdir($path);
+            }
+        }
+    }
+
+    public function testMethodOverrideCannotClearHistory(): void
+    {
+        $history = $this->createMock(History::class);
+        $history->expects($this->never())->method('clear');
+        $request = $this->createMock(RequestInterface::class);
+        $request->method('getMethod')->willReturn('DELETE');
+        $request->method('getServer')->with('REQUEST_METHOD')->willReturn('POST');
+        $controller = new HistoryController(
+            $history,
+            new AccessGate([], null),
+            $request,
+            new Response()
+        );
+
+        $this->assertJsonResponse(
+            $controller->openAction(),
+            405,
+            ['error' => 'Method not allowed.']
+        );
+    }
+
+    public function testMissingStoredRequestReturnsNotFound(): void
+    {
+        $_SERVER['REQUEST_METHOD'] = 'GET';
+        $_GET                      = ['id' => '20260903120000-123456-deadbeef'];
+
+        $response = $this->executeWithServices(
+            'indexAction',
+            new Request(),
+            new Response(),
+            new FilesystemHistory(new HistoryOptions()),
+            new AccessGate([], null)
+        );
+
+        $this->assertJsonResponse($response, 404, ['error' => 'Request not found.']);
+    }
+
+    /**
+     * @param array<string, mixed> $expectedBody
+     */
+    private function assertJsonResponse(ResponseInterface $response, int $status, array $expectedBody): void
+    {
+        $this->assertSame($status, $response->getStatusCode());
+        $this->assertSame('nosniff', $response->getHeaders()->get('X-Content-Type-Options'));
+        $this->assertSame($expectedBody, json_decode($response->getContent(), true));
+    }
+
+    private function execute(History $history, string $action = 'index'): Response
+    {
+        $response  = new Response();
+
+        return $this->executeWithServices(
+            'clear' === $action ? 'clearAction' : 'indexAction',
+            new Request(),
+            $response,
+            $history,
+            new AccessGate([], null)
+        );
+    }
+
+    private function executeWithServices(
+        string $action,
+        RequestInterface $request,
+        Response $response,
+        History $history,
+        AccessGate $access
+    ): Response {
+        $controller = new HistoryController($history, $access, $request, $response);
+        $result     = $controller->{$action}();
+
+        $this->assertInstanceOf(Response::class, $result);
+
+        return $result;
+    }
+}
diff --git a/tests/Unit/DebugBar/DebugBarTest.php b/tests/Unit/DebugBar/DebugBarTest.php
index 3935389..4d55bf0 100644
--- a/tests/Unit/DebugBar/DebugBarTest.php
+++ b/tests/Unit/DebugBar/DebugBarTest.php
@@ -56,6 +56,12 @@ public function testCollectAggregatesEveryCollectorAndCaches(): void
         $this->assertArrayHasKey('grid_fixture', $result['data']);
         $this->assertArrayHasKey('list_fixture', $result['data']);
         $this->assertSame(2, $result['meta']['collectors']);
+        $widgets = $result['meta']['widgets'];
+        $this->assertIsArray($widgets);
+        $this->assertSame(
+            ['grid_fixture', 'list_fixture'],
+            array_keys($widgets)
+        );
         $this->assertSame($result, $bar->getData());
     }
 
diff --git a/tests/Unit/DebugBar/History/FilesystemHistoryTest.php b/tests/Unit/DebugBar/History/FilesystemHistoryTest.php
new file mode 100644
index 0000000..a248735
--- /dev/null
+++ b/tests/Unit/DebugBar/History/FilesystemHistoryTest.php
@@ -0,0 +1,957 @@
+<?php
+
+/**
+ * This file is part of the Phalcon Framework.
+ *
+ * (c) Phalcon Team <team@phalcon.io>
+ *
+ * For the full copyright and license information, please view the LICENSE.txt
+ * file that was distributed with this source code.
+ */
+
+declare(strict_types=1);
+
+namespace Phalcon\Tests\Unit\DebugBar\History;
+
+use DateTimeImmutable;
+use Phalcon\DebugBar\History\FilesystemHistory;
+use Phalcon\DebugBar\History\HistoryCookie;
+use Phalcon\DebugBar\History\HistoryEntry;
+use Phalcon\DebugBar\History\HistoryOptions;
+use Phalcon\DebugBar\History\NativeHistoryFileOperations;
+use Phalcon\DebugBar\History\RequestMetadata;
+use Phalcon\Talon\PHPUnit\AbstractUnitTestCase;
+use Phalcon\Tests\Support\DebugBar\History\DelegatingHistoryFileOperations;
+use Phalcon\Tests\Support\DebugBar\History\FailingStreamWrapper;
+use Phalcon\Tests\Support\DebugBar\History\GarbageCollectionMarkerFailingFileOperations;
+use Phalcon\Tests\Support\DebugBar\History\MetadataMoveFailingHistoryFileOperations;
+use Phalcon\Tests\Support\DebugBar\History\MetadataWriteFailingHistoryFileOperations;
+use Phalcon\Tests\Support\DebugBar\History\PayloadMoveFailingHistoryFileOperations;
+use Phalcon\Tests\Support\DebugBar\History\PayloadReadTrackingHistoryFileOperations;
+use Phalcon\Tests\Support\DebugBar\History\RecordingMatchingHistoryFileOperations;
+use Phalcon\Tests\Support\DebugBar\History\RenameFailingHistoryFileOperations;
+use Phalcon\Tests\Support\DebugBar\History\UnwritableHistoryFileOperations;
+use PHPUnit\Framework\Attributes\RunInSeparateProcess;
+use RuntimeException;
+
+use function bin2hex;
+use function file_exists;
+use function file_put_contents;
+use function glob;
+use function hash;
+use function is_dir;
+use function is_file;
+use function json_encode;
+use function mkdir;
+use function preg_replace;
+use function random_bytes;
+use function rmdir;
+use function session_id;
+use function session_regenerate_id;
+use function session_start;
+use function session_write_close;
+use function str_repeat;
+use function stream_wrapper_register;
+use function stream_wrapper_unregister;
+use function sys_get_temp_dir;
+use function touch;
+use function unlink;
+use function usleep;
+
+final class FilesystemHistoryTest extends AbstractUnitTestCase
+{
+    #[RunInSeparateProcess]
+    public function testActiveBrowserWithoutStorageHasNoRequests(): void
+    {
+        [$path, $sessionId] = $this->startSession();
+
+        try {
+            $history = new FilesystemHistory(new HistoryOptions(true, '/_debugbar/open', $path));
+
+            $this->assertSame([], $history->find());
+            $this->assertNull($history->get('20260903120000-123456-deadbeef'));
+        } finally {
+            session_write_close();
+            $this->removeHistory($path, $sessionId);
+        }
+    }
+
+    #[RunInSeparateProcess]
+    public function testChangingTheApplicationSessionIdKeepsBrowserHistory(): void
+    {
+        [$path, $browserId] = $this->startSession();
+
+        try {
+            $history = new FilesystemHistory(new HistoryOptions(true, '/_debugbar/open', $path));
+            $id      = $history->save(
+                ['data' => [], 'meta' => []],
+                new RequestMetadata('GET', '/before-login', 200, false)
+            );
+            $this->assertIsString($id);
+            $this->assertTrue(session_regenerate_id());
+
+            $afterLogin = new FilesystemHistory(new HistoryOptions(true, '/_debugbar/open', $path));
+            $this->assertCount(1, $afterLogin->find());
+            $this->assertIsArray($afterLogin->get($id));
+        } finally {
+            session_write_close();
+            $this->removeHistory($path, $browserId);
+        }
+    }
+
+    #[RunInSeparateProcess]
+    public function testClearRemovesTheCurrentBrowsersRequests(): void
+    {
+        [$path, $sessionId] = $this->startSession();
+        $directory          = $path . '/' . hash('sha256', $sessionId);
+
+        try {
+            $history = new FilesystemHistory(new HistoryOptions(true, '/_debugbar/open', $path, 10, 60));
+            for ($index = 0; $index < 2; $index++) {
+                $history->save(
+                    ['data' => [], 'meta' => ['index' => $index]],
+                    new RequestMetadata('GET', '/' . $index, 200, false)
+                );
+            }
+            $temporary = $directory . '/orphan.json.tmp-deadbeef';
+            $metadata  = $directory . '/orphan.json.meta';
+            $this->assertIsInt(file_put_contents($temporary, '{}'));
+            $this->assertIsInt(file_put_contents($metadata, '{}'));
+
+            $this->assertSame(2, $history->clear());
+            $this->assertFalse(file_exists($temporary));
+            $this->assertFalse(file_exists($metadata));
+            $this->assertFalse(is_dir($directory));
+            $this->assertSame([], $history->find());
+            $this->assertSame(0, $history->clear());
+        } finally {
+            session_write_close();
+            $this->removeHistory($path, $sessionId);
+        }
+    }
+
+    public function testConcurrentDirectoryCreationIsRecheckedInsideTheLock(): void
+    {
+        $path       = $this->temporaryPath();
+        $browserId  = str_repeat('1', 64);
+        $directory  = $path . '/' . hash('sha256', $browserId);
+        $operations = new class ($directory) extends DelegatingHistoryFileOperations {
+            public function __construct(private readonly string $directory)
+            {
+                parent::__construct();
+            }
+
+            public function withExclusiveLock(string $file, \Closure $operation): bool
+            {
+                if (!$this->directoryExists($this->directory)) {
+                    $this->createDirectory($this->directory, 0700, true);
+                }
+
+                return $operation();
+            }
+        };
+        $history = new FilesystemHistory(
+            new HistoryOptions(true, '/_debugbar/open', $path),
+            $operations,
+            new HistoryCookie($browserId)
+        );
+
+        try {
+            $this->assertIsString($history->save(
+                ['data' => [], 'meta' => []],
+                new RequestMetadata('GET', '/', 200, false)
+            ));
+        } finally {
+            $this->removeHistory($path, $browserId);
+        }
+    }
+
+    public function testEvictionFailureRefusesANewBrowserDirectory(): void
+    {
+        $path       = $this->temporaryPath();
+        $firstId    = str_repeat('2', 64);
+        $secondId   = str_repeat('3', 64);
+        $firstPath  = $path . '/' . hash('sha256', $firstId);
+        $operations = new class () extends DelegatingHistoryFileOperations {
+            public string $blockedDirectory = '';
+
+            public function removeDirectory(string $directory): bool
+            {
+                return $directory === $this->blockedDirectory
+                    ? false
+                    : parent::removeDirectory($directory);
+            }
+        };
+        $options = new HistoryOptions(true, '/_debugbar/open', $path, 10, 60, 1);
+
+        try {
+            $first = new FilesystemHistory($options, $operations, new HistoryCookie($firstId));
+            $this->assertIsString($first->save(
+                ['data' => [], 'meta' => []],
+                new RequestMetadata('GET', '/first', 200, false)
+            ));
+            $operations->blockedDirectory = $firstPath;
+
+            $second = new FilesystemHistory($options, $operations, new HistoryCookie($secondId));
+            $this->assertNull($second->save(
+                ['data' => [], 'meta' => []],
+                new RequestMetadata('GET', '/second', 200, false)
+            ));
+            $this->assertTrue(is_dir($firstPath));
+            $this->assertFalse(is_dir($path . '/' . hash('sha256', $secondId)));
+        } finally {
+            $operations->blockedDirectory = '';
+            $this->removeHistory($path, $firstId);
+            $this->removeHistory($path, $secondId);
+        }
+    }
+
+    #[RunInSeparateProcess]
+    public function testExistingBrowserDirectoryMustRemainWritable(): void
+    {
+        [$path, $sessionId] = $this->startSession();
+        $fileOperations     = new UnwritableHistoryFileOperations();
+        $history            = new FilesystemHistory(
+            new HistoryOptions(true, '/_debugbar/open', $path),
+            $fileOperations
+        );
+
+        try {
+            $this->assertIsString($history->save(
+                ['data' => [], 'meta' => []],
+                new RequestMetadata('GET', '/', 200, false)
+            ));
+
+            $fileOperations->writable = false;
+
+            $this->assertNull($history->save(
+                ['data' => [], 'meta' => []],
+                new RequestMetadata('GET', '/blocked', 200, false)
+            ));
+            $this->assertSame([], $history->find());
+            $this->assertSame(0, $history->clear());
+        } finally {
+            session_write_close();
+            $this->removeHistory($path, $sessionId);
+        }
+    }
+
+    #[RunInSeparateProcess]
+    public function testFindingRequestsDoesNotReadStoredPayloads(): void
+    {
+        [$path, $sessionId] = $this->startSession();
+        $fileOperations     = new PayloadReadTrackingHistoryFileOperations();
+        $history            = new FilesystemHistory(
+            new HistoryOptions(true, '/_debugbar/open', $path),
+            $fileOperations
+        );
+
+        try {
+            $id = $history->save(
+                [
+                    'data' => ['database' => ['panel' => str_repeat('x', 512 * 1024), 'badge' => null]],
+                    'meta' => [],
+                ],
+                new RequestMetadata('GET', '/large', 200, false)
+            );
+            $this->assertIsString($id);
+
+            $requests = $history->find();
+            $this->assertCount(1, $requests);
+            $this->assertSame('/large', $requests[0]['uri']);
+            $this->assertSame(0, $fileOperations->payloadReads);
+
+            $this->assertIsArray($history->get($id));
+            $this->assertSame(1, $fileOperations->payloadReads);
+        } finally {
+            session_write_close();
+            $this->removeHistory($path, $sessionId);
+        }
+    }
+
+    public function testFindRemovesAnEmptyExpiredBrowserDirectory(): void
+    {
+        $path      = $this->temporaryPath();
+        $browserId = str_repeat('d', 64);
+        $directory = $path . '/' . hash('sha256', $browserId);
+        $history   = new FilesystemHistory(
+            new HistoryOptions(true, '/_debugbar/open', $path, 10, 1),
+            null,
+            new HistoryCookie($browserId)
+        );
+
+        try {
+            $id = $history->save(
+                ['data' => [], 'meta' => []],
+                new RequestMetadata('GET', '/', 200, false)
+            );
+            $this->assertIsString($id);
+            $this->assertTrue(touch($directory . '/' . $id . '.json', time() - 10));
+
+            $this->assertSame([], $history->find());
+            $this->assertFalse(is_dir($directory));
+        } finally {
+            $this->removeHistory($path, $browserId);
+        }
+    }
+
+    #[RunInSeparateProcess]
+    public function testIncompatibleStoredEntryIsRejected(): void
+    {
+        [$path, $sessionId] = $this->startSession();
+        $directory          = $path . '/' . hash('sha256', $sessionId);
+        $id                 = '20260903120000-123456-deadbeef';
+        $metadata           = [
+            'requested_at' => '2026-09-03T12:00:00+00:00',
+            'method'       => 'GET',
+            'uri'          => '/stale',
+            'status'       => 200,
+            'ajax'         => false,
+            'id'           => $id,
+            'stored_at'    => '2026-09-03T12:00:00+00:00',
+        ];
+
+        try {
+            $this->assertTrue(mkdir($directory, 0777, true));
+            $payload = json_encode([
+                'version' => 2,
+                'meta'    => $metadata,
+                'payload' => ['data' => [], 'meta' => []],
+            ]);
+            $sidecar = json_encode($metadata);
+            $this->assertIsString($payload);
+            $this->assertIsString($sidecar);
+            $this->assertIsInt(file_put_contents($directory . '/' . $id . '.json', $payload));
+            $this->assertIsInt(file_put_contents($directory . '/' . $id . '.json.meta', $sidecar));
+
+            $history = new FilesystemHistory(new HistoryOptions(true, '/_debugbar/open', $path));
+
+            $this->assertNull($history->get($id));
+            $this->assertSame([], $history->find());
+        } finally {
+            session_write_close();
+            $this->removeHistory($path, $sessionId);
+        }
+    }
+
+    #[RunInSeparateProcess]
+    public function testInvalidPayloadCannotBeEncoded(): void
+    {
+        [$path, $sessionId] = $this->startSession();
+
+        try {
+            $history = new FilesystemHistory(new HistoryOptions(true, '/_debugbar/open', $path));
+
+            $this->assertNull($history->save(
+                ['data' => ['invalid' => ['panel' => NAN, 'badge' => null]], 'meta' => []],
+                new RequestMetadata('GET', '/', 200, false)
+            ));
+            $this->assertFalse(is_dir($path . '/' . hash('sha256', $sessionId)));
+        } finally {
+            session_write_close();
+            $this->removeHistory($path, $sessionId);
+        }
+    }
+
+    #[RunInSeparateProcess]
+    public function testListingOnlyCollectsTheActiveBrowser(): void
+    {
+        [$path, $firstSessionId] = $this->startSession();
+        $firstDirectory          = $path . '/' . hash('sha256', $firstSessionId);
+        $secondSessionId         = bin2hex(random_bytes(32));
+        $unrelatedDirectory      = $path . '/application-cache';
+        $unrelatedFile           = $unrelatedDirectory . '/response.json';
+
+        try {
+            $history = new FilesystemHistory(new HistoryOptions(true, '/_debugbar/open', $path, 10, 1));
+            $id      = $history->save(
+                ['data' => [], 'meta' => []],
+                new RequestMetadata('GET', '/expired', 200, false)
+            );
+            $this->assertIsString($id);
+            $this->assertTrue(touch($firstDirectory . '/' . $id . '.json', time() - 10));
+            $temporary = $firstDirectory . '/' . $id . '.json.tmp-deadbeef';
+            $this->assertIsInt(file_put_contents($temporary, '{}'));
+            $this->assertTrue(touch($temporary, time() - 10));
+            $this->assertTrue(mkdir($unrelatedDirectory));
+            $this->assertIsInt(file_put_contents($unrelatedFile, '{}'));
+            $this->assertTrue(touch($unrelatedFile, time() - 10));
+
+            session_write_close();
+            session_id($secondSessionId);
+            session_start();
+            $_COOKIE[HistoryCookie::NAME] = $secondSessionId;
+
+            $nextRequestHistory = new FilesystemHistory(
+                new HistoryOptions(true, '/_debugbar/open', $path, 10, 1)
+            );
+            $this->assertSame([], $nextRequestHistory->find());
+            $this->assertTrue(file_exists($firstDirectory . '/' . $id . '.json'));
+            $this->assertTrue(file_exists($temporary));
+            $this->assertTrue(is_dir($firstDirectory));
+
+            $marker = $path . '/.gc';
+            $this->assertIsString($nextRequestHistory->save(
+                ['data' => [], 'meta' => []],
+                new RequestMetadata('GET', '/rate-limited', 200, false)
+            ));
+            $this->assertTrue(file_exists($firstDirectory . '/' . $id . '.json'));
+            $this->assertTrue(file_exists($temporary));
+
+            $this->assertTrue(touch($marker, time() - 3601));
+            $collectingHistory = new FilesystemHistory(
+                new HistoryOptions(true, '/_debugbar/open', $path, 10, 1)
+            );
+            $this->assertIsString($collectingHistory->save(
+                ['data' => [], 'meta' => []],
+                new RequestMetadata('GET', '/collect', 200, false)
+            ));
+            $this->assertFalse(file_exists($firstDirectory . '/' . $id . '.json'));
+            $this->assertFalse(file_exists($temporary));
+            $this->assertFalse(is_dir($firstDirectory));
+            $this->assertTrue(file_exists($unrelatedFile));
+        } finally {
+            session_write_close();
+            $this->removeHistory($path, $firstSessionId);
+            $this->removeHistory($path, $secondSessionId);
+            if (file_exists($unrelatedFile)) {
+                unlink($unrelatedFile);
+            }
+            if (is_dir($unrelatedDirectory)) {
+                rmdir($unrelatedDirectory);
+            }
+            if (is_dir($path)) {
+                rmdir($path);
+            }
+        }
+    }
+
+    public function testMalformedAndExpiredEntriesAreIgnored(): void
+    {
+        [$path, $sessionId] = $this->startSession();
+        $directory          = $path . '/' . hash('sha256', $sessionId);
+        $id                 = '20260903120000-123456-deadbeef';
+
+        try {
+            $history = new FilesystemHistory(new HistoryOptions(true, '/_debugbar/open', $path, 10, 1));
+            $savedId = $history->save(
+                ['data' => [], 'meta' => []],
+                new RequestMetadata('GET', '/', 200, false)
+            );
+            $this->assertIsString($savedId);
+            $this->assertTrue(touch($directory . '/' . $savedId . '.json', time() - 10));
+            $this->assertNull($history->get($savedId));
+            $this->assertFalse(file_exists($directory . '/' . $savedId . '.json'));
+
+            $savedId = $history->save(
+                ['data' => [], 'meta' => []],
+                new RequestMetadata('GET', '/', 200, false)
+            );
+            $this->assertIsString($savedId);
+            $this->assertTrue(touch($directory . '/' . $savedId . '.json', time() - 10));
+            $this->assertSame([], $history->find());
+            $this->assertFalse(file_exists($directory . '/' . $savedId . '.json'));
+
+            $this->assertTrue(mkdir($directory, 0700, true));
+            $this->assertIsInt(file_put_contents($directory . '/' . $id . '.json', '{invalid'));
+            $this->assertNull($history->get($id));
+            $this->assertNull($history->get('20260903120000-123456-cafebabe'));
+        } finally {
+            session_write_close();
+            $this->removeHistory($path, $sessionId);
+        }
+    }
+
+    #[RunInSeparateProcess]
+    public function testMalformedEntriesDoNotConsumeTheRequestLimit(): void
+    {
+        [$path, $sessionId] = $this->startSession();
+        $directory          = $path . '/' . hash('sha256', $sessionId);
+
+        try {
+            $writer = new FilesystemHistory(new HistoryOptions(true, '/_debugbar/open', $path, 10, 60));
+            $ids    = [];
+            for ($index = 0; $index < 3; $index++) {
+                $id = $writer->save(
+                    ['data' => [], 'meta' => ['index' => $index]],
+                    new RequestMetadata('GET', '/' . $index, 200, false)
+                );
+                $this->assertIsString($id);
+                $ids[] = $id;
+                usleep(1000);
+            }
+
+            $newest = $directory . '/' . $ids[2] . '.json';
+            $this->assertIsInt(file_put_contents($newest . '.meta', '{"id":123}'));
+
+            $history  = new FilesystemHistory(new HistoryOptions(true, '/_debugbar/open', $path, 2, 60));
+            $requests = $history->find();
+            $this->assertCount(2, $requests);
+            $this->assertSame($ids[2], $requests[0]['id']);
+            $this->assertSame($ids[1], $requests[1]['id']);
+
+            $this->assertIsInt(file_put_contents($newest, '{invalid'));
+            $requests = $history->find();
+            $this->assertCount(2, $requests);
+            $this->assertSame($ids[1], $requests[0]['id']);
+            $this->assertSame($ids[0], $requests[1]['id']);
+        } finally {
+            session_write_close();
+            $this->removeHistory($path, $sessionId);
+        }
+    }
+
+    public function testMaximumBrowserCountEvictsTheOldestDirectory(): void
+    {
+        $path      = $this->temporaryPath();
+        $browserId = [str_repeat('a', 64), str_repeat('b', 64), str_repeat('c', 64)];
+        $options   = new HistoryOptions(true, '/_debugbar/open', $path, 10, 60, 2);
+
+        try {
+            foreach ($browserId as $index => $id) {
+                $history = new FilesystemHistory($options, null, new HistoryCookie($id));
+                $this->assertIsString($history->save(
+                    ['data' => [], 'meta' => []],
+                    new RequestMetadata('GET', '/' . $index, 200, false)
+                ));
+                $this->assertTrue(touch($path . '/' . hash('sha256', $id), time() - (10 - $index)));
+            }
+
+            $this->assertFalse(is_dir($path . '/' . hash('sha256', $browserId[0])));
+            $this->assertTrue(is_dir($path . '/' . hash('sha256', $browserId[1])));
+            $this->assertTrue(is_dir($path . '/' . hash('sha256', $browserId[2])));
+        } finally {
+            foreach ($browserId as $id) {
+                $this->removeHistory($path, $id);
+            }
+        }
+    }
+
+    #[RunInSeparateProcess]
+    public function testMaximumRequestCountIsPruned(): void
+    {
+        [$path, $sessionId] = $this->startSession();
+
+        try {
+            $history = new FilesystemHistory(new HistoryOptions(true, '/_debugbar/open', $path, 2, 60));
+            for ($index = 0; $index < 3; $index++) {
+                $history->save(
+                    ['data' => [], 'meta' => ['index' => $index]],
+                    new RequestMetadata('GET', '/' . $index, 200, false)
+                );
+            }
+
+            $this->assertCount(2, $history->find());
+        } finally {
+            session_write_close();
+            $this->removeHistory($path, $sessionId);
+        }
+    }
+
+    #[RunInSeparateProcess]
+    public function testMetadataMoveFailureRollsBackPublishedPayload(): void
+    {
+        [$path, $sessionId] = $this->startSession();
+        $history            = new FilesystemHistory(
+            new HistoryOptions(true, '/_debugbar/open', $path),
+            new MetadataMoveFailingHistoryFileOperations()
+        );
+
+        try {
+            $this->assertNull($history->save(
+                ['data' => [], 'meta' => []],
+                new RequestMetadata('GET', '/', 200, false)
+            ));
+            $this->assertFalse(is_dir($path . '/' . hash('sha256', $sessionId)));
+        } finally {
+            session_write_close();
+            $this->removeHistory($path, $sessionId);
+        }
+    }
+
+    #[RunInSeparateProcess]
+    public function testMetadataWriteFailureRemovesTemporaryFilesAndReturnsNull(): void
+    {
+        [$path, $sessionId] = $this->startSession();
+        $history            = new FilesystemHistory(
+            new HistoryOptions(true, '/_debugbar/open', $path),
+            new MetadataWriteFailingHistoryFileOperations()
+        );
+
+        try {
+            $this->assertNull($history->save(
+                ['data' => [], 'meta' => []],
+                new RequestMetadata('GET', '/', 200, false)
+            ));
+            $this->assertFalse(is_dir($path . '/' . hash('sha256', $sessionId)));
+        } finally {
+            session_write_close();
+            $this->removeHistory($path, $sessionId);
+        }
+    }
+
+    #[RunInSeparateProcess]
+    public function testMissingBrowserCookieStoresNothing(): void
+    {
+        unset($_COOKIE[HistoryCookie::NAME]);
+        $path    = $this->temporaryPath();
+        $history = new FilesystemHistory(new HistoryOptions(true, '/_debugbar/open', $path));
+
+        $this->assertNull($history->save(
+            ['data' => [], 'meta' => []],
+            new RequestMetadata('GET', '/', 200, false)
+        ));
+        $this->assertSame([], $history->find());
+        $this->assertNull($history->get('20260903120000-123456-deadbeef'));
+        $this->assertSame(0, $history->clear());
+    }
+
+    public function testNativeLockReturnsFalseWhenFileCannotBeOpened(): void
+    {
+        $operations = new NativeHistoryFileOperations();
+
+        $this->assertFalse($operations->withExclusiveLock(
+            $this->temporaryPath() . '/missing/lock',
+            static fn (): bool => true
+        ));
+    }
+
+    public function testNativeLockReturnsFalseWhenStreamCannotBeLocked(): void
+    {
+        $operations = new NativeHistoryFileOperations();
+
+        $this->assertFalse($operations->withExclusiveLock(
+            'php://memory',
+            static fn (): bool => true
+        ));
+    }
+
+    #[RunInSeparateProcess]
+    public function testPayloadMoveFailureRemovesStagedFiles(): void
+    {
+        [$path, $sessionId] = $this->startSession();
+        $history            = new FilesystemHistory(
+            new HistoryOptions(true, '/_debugbar/open', $path),
+            new PayloadMoveFailingHistoryFileOperations()
+        );
+
+        try {
+            $this->assertNull($history->save(
+                ['data' => [], 'meta' => []],
+                new RequestMetadata('GET', '/', 200, false)
+            ));
+            $this->assertFalse(is_dir($path . '/' . hash('sha256', $sessionId)));
+        } finally {
+            session_write_close();
+            $this->removeHistory($path, $sessionId);
+        }
+    }
+
+    #[RunInSeparateProcess]
+    public function testRenameFailureRemovesTemporaryFileAndReturnsNull(): void
+    {
+        [$path, $sessionId] = $this->startSession();
+        $fileOperations     = new RenameFailingHistoryFileOperations();
+        $history            = new FilesystemHistory(
+            new HistoryOptions(true, '/_debugbar/open', $path),
+            $fileOperations
+        );
+
+        try {
+            $this->assertNull($history->save(
+                ['data' => [], 'meta' => []],
+                new RequestMetadata('GET', '/', 200, false)
+            ));
+            $this->assertSame(2, $fileOperations->removeCalls);
+            $this->assertFalse(is_dir($path . '/' . hash('sha256', $sessionId)));
+        } finally {
+            session_write_close();
+            if (file_exists($path . '/.lock')) {
+                unlink($path . '/.lock');
+            }
+            if (is_dir($path)) {
+                rmdir($path);
+            }
+        }
+    }
+
+    #[RunInSeparateProcess]
+    public function testSaveFindAndGetAreBrowserScoped(): void
+    {
+        [$path, $firstSessionId] = $this->startSession();
+        $secondSessionId         = bin2hex(random_bytes(32));
+
+        try {
+            $history     = new FilesystemHistory(new HistoryOptions(true, '/_debugbar/open', $path, 10, 60));
+            $requestedAt = new DateTimeImmutable('2000-01-02T03:04:05+00:00');
+            $id          = $history->save(
+                ['data' => [], 'meta' => ['collectors' => 0]],
+                new RequestMetadata('POST', '/orders', 201, true, $requestedAt)
+            );
+
+            $this->assertIsString($id);
+
+            $requests = $history->find();
+            $this->assertCount(1, $requests);
+            $this->assertSame($id, $requests[0]['id']);
+            $this->assertSame('POST', $requests[0]['method']);
+            $this->assertSame('/orders', $requests[0]['uri']);
+            $this->assertSame(201, $requests[0]['status']);
+            $this->assertTrue($requests[0]['ajax']);
+            $this->assertSame('2000-01-02T03:04:05+00:00', $requests[0]['requested_at']);
+            $this->assertNotSame($requests[0]['requested_at'], $requests[0]['stored_at']);
+
+            $entry = $history->get($id);
+            $this->assertIsArray($entry);
+            $this->assertSame(HistoryEntry::VERSION, $entry['version']);
+            $payload = $entry['payload'];
+            $this->assertIsArray($payload);
+            $meta = $payload['meta'];
+            $this->assertIsArray($meta);
+            $this->assertSame(0, $meta['collectors']);
+            $this->assertNull($history->get('../outside'));
+
+            session_write_close();
+            session_id($secondSessionId);
+            session_start();
+            $_COOKIE[HistoryCookie::NAME] = $secondSessionId;
+
+            $secondBrowserHistory = new FilesystemHistory(
+                new HistoryOptions(true, '/_debugbar/open', $path, 10, 60)
+            );
+            $this->assertSame([], $secondBrowserHistory->find());
+            $this->assertNull($secondBrowserHistory->get($id));
+
+            $secondId = $secondBrowserHistory->save(
+                ['data' => [], 'meta' => ['collectors' => 1]],
+                new RequestMetadata('GET', '/customers', 200, false)
+            );
+            $this->assertIsString($secondId);
+
+            session_write_close();
+            session_id($firstSessionId);
+            session_start();
+            $_COOKIE[HistoryCookie::NAME] = $firstSessionId;
+
+            $firstSessionHistory = new FilesystemHistory(
+                new HistoryOptions(true, '/_debugbar/open', $path, 10, 60)
+            );
+            $firstRequests = $firstSessionHistory->find();
+            $this->assertCount(1, $firstRequests);
+            $this->assertSame($id, $firstRequests[0]['id']);
+            $this->assertNull($firstSessionHistory->get($secondId));
+        } finally {
+            session_write_close();
+            $this->removeHistory($path, $firstSessionId);
+            $this->removeHistory($path, $secondSessionId);
+        }
+    }
+
+    #[RunInSeparateProcess]
+    public function testSaveSucceedsWhenGarbageCollectionMarkerCannotBeWritten(): void
+    {
+        [$path, $sessionId] = $this->startSession();
+
+        try {
+            $history = new FilesystemHistory(
+                new HistoryOptions(true, '/_debugbar/open', $path),
+                new GarbageCollectionMarkerFailingFileOperations()
+            );
+
+            $this->assertIsString($history->save(
+                ['data' => [], 'meta' => []],
+                new RequestMetadata('GET', '/', 200, false)
+            ));
+            $this->assertCount(1, $history->find());
+            $this->assertFalse(file_exists($path . '/.gc'));
+        } finally {
+            session_write_close();
+            $this->removeHistory($path, $sessionId);
+        }
+    }
+
+    #[RunInSeparateProcess]
+    public function testStorageDirectoryCreationFailureStoresNothing(): void
+    {
+        [$path, $sessionId] = $this->startSession();
+        $blockedPath        = $path . '/not-a-directory';
+
+        try {
+            $this->assertTrue(mkdir($path, 0700, true));
+            $this->assertIsInt(file_put_contents($blockedPath, 'blocked'));
+            $history = new FilesystemHistory(
+                new HistoryOptions(true, '/_debugbar/open', $blockedPath)
+            );
+
+            $this->assertNull($history->save(
+                ['data' => [], 'meta' => []],
+                new RequestMetadata('GET', '/', 200, false)
+            ));
+        } finally {
+            session_write_close();
+            if (file_exists($blockedPath)) {
+                unlink($blockedPath);
+            }
+            $this->removeHistory($path, $sessionId);
+        }
+    }
+
+    public function testStorageFailuresReturnSafeEmptyResults(): void
+    {
+        $scheme = 'debugbar-failure';
+        $this->assertTrue(stream_wrapper_register($scheme, FailingStreamWrapper::class));
+        [, $sessionId] = $this->startSession();
+        $history       = new FilesystemHistory(new HistoryOptions(true, '/_debugbar/open', $scheme . '://history'));
+        try {
+            $directory = $scheme . '://history/' . hash('sha256', $sessionId);
+            $this->assertTrue(is_dir($directory));
+            $this->assertTrue(is_file($directory . '/20260903120000-123456-deadbeef.json'));
+            $this->assertSame([], $history->find());
+
+            $this->assertNull($history->get('20260903120000-123456-deadbeef'));
+            $this->assertNull($history->save(
+                ['data' => [], 'meta' => []],
+                new RequestMetadata('GET', '/', 200, false)
+            ));
+        } finally {
+            session_write_close();
+            stream_wrapper_unregister($scheme);
+        }
+    }
+
+    #[RunInSeparateProcess]
+    public function testStoragePathWithGlobCharactersStillListsAndPrunes(): void
+    {
+        $path               = $this->temporaryPath() . '[history]';
+        [$path, $sessionId] = $this->startSession($path);
+
+        try {
+            $history = new FilesystemHistory(new HistoryOptions(true, '/_debugbar/open', $path, 2, 60));
+            for ($index = 0; $index < 3; $index++) {
+                $history->save(
+                    ['data' => [], 'meta' => ['index' => $index]],
+                    new RequestMetadata('GET', '/' . $index, 200, false)
+                );
+            }
+
+            $this->assertCount(2, $history->find());
+            $this->assertSame(2, $history->clear());
+        } finally {
+            session_write_close();
+            $this->removeHistory($path, $sessionId);
+        }
+    }
+
+    public function testStorageValidationRejectsAnUnwritableRoot(): void
+    {
+        $path                     = $this->temporaryPath();
+        $fileOperations           = new UnwritableHistoryFileOperations();
+        $fileOperations->writable = false;
+        $history                  = new FilesystemHistory(
+            new HistoryOptions(true, '/_debugbar/open', $path),
+            $fileOperations,
+            new HistoryCookie(str_repeat('f', 64))
+        );
+
+        try {
+            $this->expectException(RuntimeException::class);
+            $this->expectExceptionMessage('history.path must be writable');
+            $history->validateStorage();
+        } finally {
+            if (is_dir($path)) {
+                rmdir($path);
+            }
+        }
+    }
+
+    #[RunInSeparateProcess]
+    public function testVersionedEntriesWithoutMetadataSidecarRemainReadable(): void
+    {
+        [$path, $sessionId] = $this->startSession();
+        $directory          = $path . '/' . hash('sha256', $sessionId);
+        $fileOperations     = new PayloadReadTrackingHistoryFileOperations();
+        $history            = new FilesystemHistory(
+            new HistoryOptions(true, '/_debugbar/open', $path),
+            $fileOperations
+        );
+
+        try {
+            $id = $history->save(
+                ['data' => [], 'meta' => []],
+                new RequestMetadata('GET', '/without-sidecar', 200, false)
+            );
+            $this->assertIsString($id);
+            $this->assertTrue(unlink($directory . '/' . $id . '.json.meta'));
+
+            $requests = $history->find();
+            $this->assertCount(1, $requests);
+            $this->assertSame('/without-sidecar', $requests[0]['uri']);
+            $this->assertSame(1, $fileOperations->payloadReads);
+        } finally {
+            session_write_close();
+            $this->removeHistory($path, $sessionId);
+        }
+    }
+
+    public function testWindowsStoragePathsUsePortableGlobSeparators(): void
+    {
+        $browserId      = str_repeat('e', 64);
+        $fileOperations = new RecordingMatchingHistoryFileOperations();
+        $history        = new FilesystemHistory(
+            new HistoryOptions(true, '/_debugbar/open', 'C:\\debug[bar]\\history'),
+            $fileOperations,
+            new HistoryCookie($browserId)
+        );
+
+        $this->assertSame([], $history->find());
+        $this->assertSame(
+            'C:/debug\\[bar\\]/history/' . hash('sha256', $browserId) . '/*.json',
+            $fileOperations->patterns[0]
+        );
+    }
+
+    private function removeHistory(string $path, string $sessionId): void
+    {
+        $directory = $path . '/' . hash('sha256', $sessionId);
+        $pattern   = preg_replace('/([*?\[\]\\\\])/', '\\\\$1', $directory);
+        $files     = null === $pattern ? false : glob($pattern . '/*');
+        if (false !== $files) {
+            foreach ($files as $file) {
+                unlink($file);
+            }
+        }
+
+        if (is_dir($directory)) {
+            rmdir($directory);
+        }
+        if (file_exists($path . '/.gc')) {
+            unlink($path . '/.gc');
+        }
+        if (file_exists($path . '/.lock')) {
+            unlink($path . '/.lock');
+        }
+        $pathPattern = preg_replace('/([*?\[\]\\\\])/', '\\\\$1', $path);
+        $remaining   = null === $pathPattern ? false : glob($pathPattern . '/*');
+        if ([] === $remaining && is_dir($path)) {
+            rmdir($path);
+        }
+    }
+
+    /**
+     * @return array{0: string, 1: string}
+     */
+    private function startSession(?string $path = null): array
+    {
+        $sessionId                    = bin2hex(random_bytes(32));
+        $_COOKIE[HistoryCookie::NAME] = $sessionId;
+        session_id($sessionId);
+        session_start();
+
+        return [$path ?? $this->temporaryPath(), $sessionId];
+    }
+
+    private function temporaryPath(): string
+    {
+        return sys_get_temp_dir() . '/phalcon-debugbar-test-' . bin2hex(random_bytes(8));
+    }
+}
diff --git a/tests/Unit/DebugBar/History/HistoryCookieTest.php b/tests/Unit/DebugBar/History/HistoryCookieTest.php
new file mode 100644
index 0000000..50a8e58
--- /dev/null
+++ b/tests/Unit/DebugBar/History/HistoryCookieTest.php
@@ -0,0 +1,69 @@
+<?php
+
+/**
+ * This file is part of the Phalcon Framework.
+ *
+ * (c) Phalcon Team <team@phalcon.io>
+ *
+ * For the full copyright and license information, please view the LICENSE.txt
+ * file that was distributed with this source code.
+ */
+
+declare(strict_types=1);
+
+namespace Phalcon\Tests\Unit\DebugBar\History;
+
+use Phalcon\DebugBar\History\HistoryCookie;
+use Phalcon\Talon\PHPUnit\AbstractUnitTestCase;
+
+use function str_repeat;
+
+final class HistoryCookieTest extends AbstractUnitTestCase
+{
+    public function testInvalidOrMissingCookieQueuesASecureBrowserIdentity(): void
+    {
+        $call   = [];
+        $cookie = new HistoryCookie(
+            'invalid',
+            function (string $name, string $value, array $options) use (&$call): bool {
+                $call = [$name, $value, $options];
+
+                return true;
+            }
+        );
+
+        $cookie->queue('/app/', true);
+
+        $this->assertSame(HistoryCookie::NAME, $call[0]);
+        $this->assertIsString($call[1]);
+        $this->assertMatchesRegularExpression('/^[a-f0-9]{64}$/D', $call[1]);
+        $this->assertSame(
+            [
+                'path'     => '/app/',
+                'secure'   => true,
+                'httponly' => true,
+                'samesite' => 'Lax',
+            ],
+            $call[2]
+        );
+    }
+
+    public function testValidCookieIsReusedWithoutCallingTheCookieWriter(): void
+    {
+        $id     = str_repeat('a', 64);
+        $called = false;
+        $cookie = new HistoryCookie(
+            $id,
+            function () use (&$called): bool {
+                $called = true;
+
+                return true;
+            }
+        );
+
+        $cookie->queue('/', false);
+
+        $this->assertSame($id, $cookie->id());
+        $this->assertFalse($called);
+    }
+}
diff --git a/tests/Unit/DebugBar/History/HistoryEndpointTest.php b/tests/Unit/DebugBar/History/HistoryEndpointTest.php
new file mode 100644
index 0000000..2a19e31
--- /dev/null
+++ b/tests/Unit/DebugBar/History/HistoryEndpointTest.php
@@ -0,0 +1,96 @@
+<?php
+
+/**
+ * This file is part of the Phalcon Framework.
+ *
+ * (c) Phalcon Team <team@phalcon.io>
+ *
+ * For the full copyright and license information, please view the LICENSE.txt
+ * file that was distributed with this source code.
+ */
+
+declare(strict_types=1);
+
+namespace Phalcon\Tests\Unit\DebugBar\History;
+
+use Phalcon\DebugBar\History\HistoryEndpoint;
+use Phalcon\DebugBar\History\HistoryOptions;
+use Phalcon\Di\Di;
+use Phalcon\Di\FactoryDefault;
+use Phalcon\Events\Event;
+use Phalcon\Http\RequestInterface;
+use Phalcon\Mvc\Dispatcher;
+use Phalcon\Mvc\Url;
+use Phalcon\Talon\PHPUnit\AbstractUnitTestCase;
+
+final class HistoryEndpointTest extends AbstractUnitTestCase
+{
+    public function testInternalRequestsUseThePackageControllerAndDiscardRouteParameters(): void
+    {
+        $request = $this->createMock(RequestInterface::class);
+        $request->method('getURI')->willReturn('/app1/_debugbar/open?id=entry');
+        $endpoint   = $this->endpoint($request, '/app1/');
+        $dispatcher = new Dispatcher();
+        $dispatcher->setControllerSuffix('Handler');
+        $dispatcher->setActionSuffix('Execute');
+        $dispatcher->setParams(['unrelated']);
+
+        $endpoint(new Event('beforeHandleRequest', $this), null, $dispatcher);
+
+        $this->assertTrue($endpoint->matches());
+        $this->assertSame(HistoryEndpoint::CONTROLLER_NAMESPACE, $dispatcher->getNamespaceName());
+        $this->assertSame('Phalcon\\DebugBar\\Controllers\\HistoryController', $dispatcher->getControllerClass());
+        $this->assertSame('open', $dispatcher->getActionName());
+        $this->assertSame('Action', $dispatcher->getActionSuffix());
+        $this->assertSame([], $dispatcher->getParams());
+    }
+
+    public function testMissingOptionalServicesUseTheRootPathAndDoNotMatch(): void
+    {
+        $endpoint = new HistoryEndpoint(new HistoryOptions(true), new Di());
+
+        $this->assertSame('/', $endpoint->cookiePath());
+        $this->assertSame('/_debugbar/open', $endpoint->url());
+        $this->assertFalse($endpoint->matches());
+    }
+
+    public function testOrdinaryRequestsKeepTheirDispatcherConfiguration(): void
+    {
+        $request = $this->createMock(RequestInterface::class);
+        $request->method('getURI')->willReturn('/app1/orders/open?next=/_debugbar/open');
+        $endpoint   = $this->endpoint($request, 'http://localhost:8080/app1/');
+        $dispatcher = new Dispatcher();
+        $dispatcher->setNamespaceName('App');
+        $dispatcher->setControllerName('orders');
+        $dispatcher->setActionName('open');
+        $dispatcher->setParams(['42']);
+
+        $endpoint(new Event('beforeHandleRequest', $this), null, $dispatcher);
+
+        $this->assertFalse($endpoint->matches());
+        $this->assertSame('App', $dispatcher->getNamespaceName());
+        $this->assertSame('orders', $dispatcher->getControllerName());
+        $this->assertSame('open', $dispatcher->getActionName());
+        $this->assertSame(['42'], $dispatcher->getParams());
+    }
+
+    public function testUnrelatedEventPayloadIsIgnored(): void
+    {
+        $request = $this->createMock(RequestInterface::class);
+        $request->expects($this->never())->method('getURI');
+        $endpoint = $this->endpoint($request);
+
+        $endpoint(new Event('beforeHandleRequest', $this), null, null);
+    }
+
+    private function endpoint(RequestInterface $request, string $baseUri = '/'): HistoryEndpoint
+    {
+        $container = new FactoryDefault();
+        $url       = new Url();
+        $url->setBaseUri($baseUri);
+        $container->setShared('request', $request);
+        $container->setShared('url', $url);
+
+        return new HistoryEndpoint(new HistoryOptions(true), $container);
+    }
+}
diff --git a/tests/Unit/DebugBar/History/HistoryEntryTest.php b/tests/Unit/DebugBar/History/HistoryEntryTest.php
new file mode 100644
index 0000000..03b3095
--- /dev/null
+++ b/tests/Unit/DebugBar/History/HistoryEntryTest.php
@@ -0,0 +1,74 @@
+<?php
+
+/**
+ * This file is part of the Phalcon Framework.
+ *
+ * (c) Phalcon Team <team@phalcon.io>
+ *
+ * For the full copyright and license information, please view the LICENSE.txt
+ * file that was distributed with this source code.
+ */
+
+declare(strict_types=1);
+
+namespace Phalcon\Tests\Unit\DebugBar\History;
+
+use Phalcon\DebugBar\History\HistoryEntry;
+use Phalcon\Talon\PHPUnit\AbstractUnitTestCase;
+
+final class HistoryEntryTest extends AbstractUnitTestCase
+{
+    public function testMetadataBoundaryValidatesEveryDocumentedField(): void
+    {
+        $metadata = [
+            'requested_at' => '2026-09-14T10:00:00+00:00',
+            'method'       => 'GET',
+            'uri'          => '/',
+            'status'       => 200,
+            'ajax'         => false,
+            'id'           => '20260914100000-000000-deadbeef',
+            'stored_at'    => '2026-09-14T10:00:00+00:00',
+        ];
+
+        $this->assertSame($metadata, HistoryEntry::metadataFromArray($metadata));
+
+        $invalidValues = [
+            'requested_at' => false,
+            'method'       => false,
+            'uri'          => false,
+            'status'       => '200',
+            'ajax'         => 0,
+            'id'           => false,
+            'stored_at'    => false,
+        ];
+
+        foreach ($invalidValues as $field => $invalidValue) {
+            $invalidMetadata         = $metadata;
+            $invalidMetadata[$field] = $invalidValue;
+
+            $this->assertNull(
+                HistoryEntry::metadataFromArray($invalidMetadata),
+                'Expected invalid metadata field: ' . $field,
+            );
+        }
+    }
+
+    public function testRejectsAnInvalidPayloadShape(): void
+    {
+        $entry = [
+            'version' => HistoryEntry::VERSION,
+            'meta'    => [
+                'requested_at' => '2026-09-14T10:00:00+00:00',
+                'method'       => 'GET',
+                'uri'          => '/',
+                'status'       => 200,
+                'ajax'         => false,
+                'id'           => '20260914100000-000000-deadbeef',
+                'stored_at'    => '2026-09-14T10:00:00+00:00',
+            ],
+            'payload' => ['data' => null, 'meta' => []],
+        ];
+
+        $this->assertNull(HistoryEntry::fromArray($entry));
+    }
+}
diff --git a/tests/Unit/DebugBar/History/HistoryOptionsTest.php b/tests/Unit/DebugBar/History/HistoryOptionsTest.php
new file mode 100644
index 0000000..61fbea6
--- /dev/null
+++ b/tests/Unit/DebugBar/History/HistoryOptionsTest.php
@@ -0,0 +1,98 @@
+<?php
+
+/**
+ * This file is part of the Phalcon Framework.
+ *
+ * (c) Phalcon Team <team@phalcon.io>
+ *
+ * For the full copyright and license information, please view the LICENSE.txt
+ * file that was distributed with this source code.
+ */
+
+declare(strict_types=1);
+
+namespace Phalcon\Tests\Unit\DebugBar\History;
+
+use InvalidArgumentException;
+use Phalcon\DebugBar\History\HistoryOptions;
+use Phalcon\Talon\PHPUnit\AbstractUnitTestCase;
+use PHPUnit\Framework\Attributes\DataProvider;
+
+final class HistoryOptionsTest extends AbstractUnitTestCase
+{
+    /**
+     * @return array<string, array{string}>
+     */
+    public static function invalidHistoryUrls(): array
+    {
+        return [
+            'relative' => ['_debugbar/open'],
+            'scheme'   => ['https://example.com/_debugbar/open'],
+            'host'     => ['//example.com/_debugbar/open'],
+            'query'    => ['/_debugbar/open?request=1'],
+            'fragment' => ['/_debugbar/open#history'],
+        ];
+    }
+
+    public function testDisabledHistoryAllowsAnEmptyStoragePath(): void
+    {
+        $options = new HistoryOptions();
+        $options->validate();
+
+        $this->assertSame('', $options->path);
+        $this->assertSame(10, $options->maxBrowsers);
+    }
+
+    public function testEnabledHistoryAcceptsAbsoluteStoragePaths(): void
+    {
+        $unix = new HistoryOptions(true, '/_debugbar/open', '/var/debugbar/');
+        $unix->validate();
+        $this->assertSame('/var/debugbar', $unix->path);
+
+        $windows = new HistoryOptions(true, '/_debugbar/open', 'C:\\var\\debugbar\\');
+        $windows->validate();
+        $this->assertSame('C:\\var\\debugbar', $windows->path);
+
+        $unc = new HistoryOptions(true, '/_debugbar/open', '\\\\server\\debugbar\\');
+        $unc->validate();
+        $this->assertSame('\\\\server\\debugbar', $unc->path);
+
+        $root = new HistoryOptions(true, '/_debugbar/open', '/');
+        $root->validate();
+        $this->assertSame('/', $root->path);
+    }
+
+    public function testEnabledHistoryRequiresAnAbsoluteStoragePath(): void
+    {
+        $this->expectException(InvalidArgumentException::class);
+        $this->expectExceptionMessage('history.path must be an absolute path');
+
+        (new HistoryOptions(true, '/_debugbar/open', 'var/debugbar'))->validate();
+    }
+
+    public function testEnabledHistoryRequiresAnExplicitStoragePath(): void
+    {
+        $this->expectException(InvalidArgumentException::class);
+        $this->expectExceptionMessage('history.path is required');
+
+        (new HistoryOptions(true))->validate();
+    }
+
+    #[DataProvider('invalidHistoryUrls')]
+    public function testEnabledHistoryRequiresAnInternalPathUrl(string $url): void
+    {
+        $this->expectException(InvalidArgumentException::class);
+        $this->expectExceptionMessage('history.url must be an absolute path');
+
+        (new HistoryOptions(true, $url, '/var/debugbar'))->validate();
+    }
+
+    public function testHistoryLimitsAreAtLeastOne(): void
+    {
+        $options = new HistoryOptions(true, '/_debugbar/open', '/var/debugbar', 0, 0, 0);
+
+        $this->assertSame(1, $options->maxRequests);
+        $this->assertSame(1, $options->ttlSeconds);
+        $this->assertSame(1, $options->maxBrowsers);
+    }
+}
diff --git a/tests/Unit/DebugBar/ProviderTest.php b/tests/Unit/DebugBar/ProviderTest.php
index 8b26b67..483e169 100644
--- a/tests/Unit/DebugBar/ProviderTest.php
+++ b/tests/Unit/DebugBar/ProviderTest.php
@@ -13,23 +13,37 @@
 
 namespace Phalcon\Tests\Unit\DebugBar;
 
+use InvalidArgumentException;
 use Phalcon\Config\Config;
+use Phalcon\DebugBar\Controllers\HistoryController;
 use Phalcon\DebugBar\Debug;
 use Phalcon\DebugBar\DebugBar;
 use Phalcon\DebugBar\Exceptions\CannotUseInProduction;
 use Phalcon\DebugBar\Provider;
 use Phalcon\Di\Di;
+use Phalcon\Di\DiInterface;
+use Phalcon\Di\FactoryDefault;
 use Phalcon\Events\Manager;
 use Phalcon\Http\Request;
 use Phalcon\Http\Response;
+use Phalcon\Http\ResponseInterface;
 use Phalcon\Mvc\Application;
+use Phalcon\Mvc\Router;
+use Phalcon\Mvc\Url;
 use Phalcon\Talon\PHPUnit\AbstractUnitTestCase;
 use PHPUnit\Framework\Attributes\BackupGlobals;
+use PHPUnit\Framework\Attributes\DataProvider;
+use PHPUnit\Framework\Attributes\RunInSeparateProcess;
 use stdClass;
 
 use function array_keys;
 use function is_array;
+use function json_decode;
+use function parse_url;
 use function putenv;
+use function sys_get_temp_dir;
+
+use const PHP_URL_PATH;
 
 #[BackupGlobals(true)]
 final class ProviderTest extends AbstractUnitTestCase
@@ -52,6 +66,20 @@ protected function tearDown(): void
         parent::tearDown();
     }
 
+    /**
+     * @return array<string, array{string, string, int, string}>
+     */
+    public static function historyEndpointRequests(): array
+    {
+        return [
+            'root GET'         => ['/', 'GET', 200, '{"requests":[]}'],
+            'absolute base'    => ['http://localhost:8080/', 'GET', 200, '{"requests":[]}'],
+            'subfolder GET'    => ['/app1/', 'GET', 200, '{"requests":[]}'],
+            'subfolder DELETE' => ['/app1/', 'DELETE', 200, '{"cleared":0}'],
+            'subfolder POST'   => ['/app1/', 'POST', 405, '{"error":"Method not allowed."}'],
+        ];
+    }
+
     public function testAccessAllowListBlocksNonMatchingClient(): void
     {
         $_ENV[self::ENV_VAR] = 'dev';
@@ -70,6 +98,31 @@ public function testAccessAllowListBlocksNonMatchingClient(): void
         $this->assertStringNotContainsString('phalcon-debugbar-data', $response->getContent());
     }
 
+    public function testAllowedEnvironmentValidatesHistoryStorage(): void
+    {
+        $_ENV[self::ENV_VAR] = 'dev';
+
+        $this->expectException(InvalidArgumentException::class);
+        $this->expectExceptionMessage('history.path is required');
+
+        (new Provider($this->application(new Manager()), [
+            'env'     => ['var' => self::ENV_VAR],
+            'history' => ['enabled' => true],
+        ]))->boot();
+    }
+
+    public function testBlockedEnvironmentDoesNotValidateHistoryStorage(): void
+    {
+        $_ENV[self::ENV_VAR] = 'production';
+
+        (new Provider($this->application(new Manager()), [
+            'env'     => ['var' => self::ENV_VAR],
+            'history' => ['enabled' => true],
+        ]))->boot();
+
+        $this->assertNull(Debug::getBar());
+    }
+
     public function testBlockedEnvironmentIsSilentByDefault(): void
     {
         $_ENV[self::ENV_VAR] = 'production';
@@ -165,6 +218,7 @@ public function testDefaultBootRegistersEveryCollector(): void
                 'logger',
                 'exceptions',
                 'time',
+                'memory',
                 'database',
                 'view',
                 'route',
@@ -202,6 +256,26 @@ public function testDisabledBootsNothing(): void
         $this->assertNull(Debug::getBar());
     }
 
+    public function testDisabledHistoryCollectorDoesNotValidateOrRegisterStorage(): void
+    {
+        $_ENV[self::ENV_VAR] = 'dev';
+        $app                 = $this->applicationWithServices(new Manager(), [
+            'request'  => new Request(),
+            'response' => new Response(),
+        ]);
+
+        (new Provider($app, [
+            'env'        => ['var' => self::ENV_VAR],
+            'collectors' => ['history' => false],
+            'history'    => ['enabled' => true],
+        ]))->boot();
+
+        /** @var DiInterface $container */
+        $container = $app->getDI();
+        $this->assertFalse($container->has(HistoryController::class));
+        $this->assertFalse($this->bootedBar()->hasCollector('history'));
+    }
+
     public function testDisablingCollectorsRemovesThem(): void
     {
         $_ENV[self::ENV_VAR] = 'dev';
@@ -249,6 +323,173 @@ public function testHeadersDisabledSuppressesDiagnosticHeader(): void
         $this->assertFalse($response->getHeaders()->has('X-Debug-Bar'));
     }
 
+    public function testHistoryDoesNotResolveResponseServicesAtBoot(): void
+    {
+        $_ENV[self::ENV_VAR] = 'dev';
+
+        $serviceSets = [
+            ['request' => new stdClass(), 'response' => new Response(), 'router' => new Router(false)],
+            ['request' => new Request(), 'response' => new stdClass(), 'router' => new Router(false)],
+            ['request' => new Request(), 'router' => new Router(false)],
+        ];
+
+        foreach ($serviceSets as $services) {
+            $app = $this->applicationWithServices(new Manager(), $services);
+
+            (new Provider($app, [
+                'env'     => ['var' => self::ENV_VAR],
+                'history' => ['enabled' => true, 'path' => sys_get_temp_dir() . '/debugbar'],
+            ]))->boot();
+
+            /** @var DiInterface $container */
+            $container = $app->getDI();
+            $this->assertTrue($container->has(HistoryController::class));
+            $this->assertTrue($this->bootedBar()->hasCollector('history'));
+        }
+    }
+
+    public function testHistoryDoesNotResolveTheRouterService(): void
+    {
+        $_ENV[self::ENV_VAR] = 'dev';
+        $app                 = $this->applicationWithServices(
+            new Manager(),
+            [
+                'router'   => new stdClass(),
+                'request'  => new Request(),
+                'response' => new Response(),
+                'url'      => new stdClass(),
+            ]
+        );
+
+        (new Provider($app, [
+            'env'     => ['var' => self::ENV_VAR],
+            'history' => ['enabled' => true, 'path' => sys_get_temp_dir() . '/debugbar'],
+        ]))->boot();
+
+        /** @var DiInterface $container */
+        $container = $app->getDI();
+        $this->assertTrue($container->has(HistoryController::class));
+        $this->assertTrue($this->bootedBar()->hasCollector('history'));
+    }
+
+    #[RunInSeparateProcess]
+    #[DataProvider('historyEndpointRequests')]
+    public function testHistoryEndpointDispatchesWithAGenericRoute(
+        string $baseUri,
+        string $method,
+        int $status,
+        string $expectedBody
+    ): void {
+        $_ENV[self::ENV_VAR]          = 'dev';
+        $_SERVER['REQUEST_METHOD']    = $method;
+        $_SERVER['REQUEST_URI']       = $baseUri . '_debugbar/open';
+        $_SERVER['REMOTE_ADDR']       = '127.0.0.1';
+
+        $container = new FactoryDefault();
+        $url       = new Url();
+        $url->setBaseUri($baseUri);
+        $container->setShared('url', $url);
+        $router = new Router(false);
+        $router->add('/:controller/:action', ['controller' => 1, 'action' => 2]);
+        $container->setShared('router', $router);
+        $routes    = $router->getRoutes();
+        $app       = new Application($container);
+        $app->useImplicitView(false);
+        $app->setEventsManager(new Manager());
+        $applicationResponse = $container->getShared('response');
+
+        (new Provider($app, [
+            'env'     => ['var' => self::ENV_VAR],
+            'history' => [
+                'enabled' => true,
+                'path'    => sys_get_temp_dir() . '/phalcon-debugbar-routing',
+            ],
+        ]))->boot();
+
+        $this->assertSame($routes, $router->getRoutes());
+        $panel = $this->bootedBar()->collect()['data']['history']['panel'];
+        $this->assertIsArray($panel);
+        $basePath = parse_url($baseUri, PHP_URL_PATH);
+        $this->assertIsString($basePath);
+        $this->assertSame($basePath . '_debugbar/open', $panel['url']);
+        $response = $app->handle('/_debugbar/open');
+        if (!$response instanceof ResponseInterface) {
+            $this->fail('Expected the history route to return a response.');
+        }
+
+        $body = json_decode($response->getContent(), true);
+
+        $this->assertSame($status, $response->getStatusCode());
+        $this->assertNotSame($applicationResponse, $response);
+        $this->assertSame(json_decode($expectedBody, true), $body);
+        $this->assertSame('application/json; charset=UTF-8', $response->getHeaders()->get('Content-Type'));
+    }
+
+    public function testHistoryRegistersOnlyItsControllerAndLeavesRoutesUnchanged(): void
+    {
+        $_ENV[self::ENV_VAR] = 'dev';
+        $em                  = new Manager();
+        $router              = new Router(false);
+        $app                 = $this->applicationWithServices($em, [
+            'request'  => new Request(),
+            'response' => new Response(),
+            'router'   => $router,
+        ]);
+
+        (new Provider($app, [
+            'env'     => ['var' => self::ENV_VAR],
+            'history' => ['enabled' => true, 'path' => sys_get_temp_dir() . '/debugbar'],
+        ]))->boot();
+
+        /** @var DiInterface $container */
+        $container = $app->getDI();
+        $this->assertTrue($container->has(HistoryController::class));
+        $this->assertTrue($this->bootedBar()->hasCollector('history'));
+        $this->assertTrue($this->bootedBar()->hasCollector('memory'));
+        $this->assertSame([], $router->getRoutes());
+        $this->assertFalse($container->has('debugbar.history'));
+        $this->assertFalse($container->has('debugbar.access_gate'));
+    }
+
+    public function testHistoryUsesTheFinalUrlServiceRegisteredAfterBoot(): void
+    {
+        $_ENV[self::ENV_VAR] = 'dev';
+        $container           = new FactoryDefault();
+        $initialUrl          = new Url();
+        $initialUrl->setBaseUri('/initial/');
+        $container->setShared('url', $initialUrl);
+        $app = new Application($container);
+        $app->setEventsManager(new Manager());
+
+        (new Provider($app, [
+            'env'     => ['var' => self::ENV_VAR],
+            'history' => ['enabled' => true, 'path' => sys_get_temp_dir() . '/debugbar'],
+        ]))->boot();
+
+        $finalUrl = new Url();
+        $finalUrl->setBaseUri('http://localhost:8080/final/');
+        $container->setShared('url', $finalUrl);
+        $panel = $this->bootedBar()->collect()['data']['history']['panel'];
+
+        $this->assertIsArray($panel);
+        $this->assertSame('/final/_debugbar/open', $panel['url']);
+    }
+
+    public function testHistoryWithoutEventsManagerDoesNotRegisterAnUnreachableEndpoint(): void
+    {
+        $_ENV[self::ENV_VAR] = 'dev';
+        $container           = new FactoryDefault();
+        $app                 = new Application($container);
+
+        (new Provider($app, [
+            'env'     => ['var' => self::ENV_VAR],
+            'history' => ['enabled' => true, 'path' => sys_get_temp_dir() . '/debugbar'],
+        ]))->boot();
+
+        $this->assertFalse($container->has(HistoryController::class));
+        $this->assertFalse($this->bootedBar()->hasCollector('history'));
+    }
+
     public function testIsAllowedTracksTheEnvironment(): void
     {
         $provider = $this->provider($this->application(new Manager()));
diff --git a/tests/Unit/DebugBar/ResponseListenerTest.php b/tests/Unit/DebugBar/ResponseListenerTest.php
index 6b76d45..de22ca2 100644
--- a/tests/Unit/DebugBar/ResponseListenerTest.php
+++ b/tests/Unit/DebugBar/ResponseListenerTest.php
@@ -15,15 +15,37 @@
 
 use Phalcon\DebugBar\BarOptions;
 use Phalcon\DebugBar\DebugBar;
+use Phalcon\DebugBar\History\FilesystemHistory;
+use Phalcon\DebugBar\History\HistoryCookie;
+use Phalcon\DebugBar\History\HistoryEndpoint;
+use Phalcon\DebugBar\History\HistoryOptions;
 use Phalcon\DebugBar\Injector;
 use Phalcon\DebugBar\Renderer;
 use Phalcon\DebugBar\ResponseListener;
 use Phalcon\DebugBar\Security\AccessGate;
+use Phalcon\Di\FactoryDefault;
 use Phalcon\Events\Event;
+use Phalcon\Http\Request;
+use Phalcon\Http\RequestInterface;
 use Phalcon\Http\Response;
+use Phalcon\Mvc\Url;
 use Phalcon\Talon\PHPUnit\AbstractUnitTestCase;
 use Phalcon\Tests\Support\DebugBar\Fixtures\GridCollector;
 use Phalcon\Tests\Support\DebugBar\Fixtures\ListCollector;
+use PHPUnit\Framework\Attributes\RunInSeparateProcess;
+
+use function bin2hex;
+use function file_exists;
+use function glob;
+use function hash;
+use function is_dir;
+use function random_bytes;
+use function rmdir;
+use function session_id;
+use function session_start;
+use function session_write_close;
+use function sys_get_temp_dir;
+use function unlink;
 
 final class ResponseListenerTest extends AbstractUnitTestCase
 {
@@ -39,6 +61,92 @@ public function testDeniedByAccessGateIsNotInjected(): void
         $this->assertStringNotContainsString('phalcon-debugbar-data', $response->getContent());
     }
 
+    public function testDeniedResponseDoesNotQueueHistoryCookie(): void
+    {
+        unset($_COOKIE[HistoryCookie::NAME]);
+        $request = $this->createMock(RequestInterface::class);
+        $request->method('getClientAddress')->willReturn('203.0.113.10');
+        $options  = new HistoryOptions(true, '/_debugbar/open', sys_get_temp_dir() . '/unused');
+        $called   = false;
+        $cookie   = new HistoryCookie(
+            null,
+            function () use (&$called): bool {
+                $called = true;
+
+                return true;
+            }
+        );
+        $listener = new ResponseListener(
+            new DebugBar(),
+            new Renderer(),
+            new Injector(),
+            new AccessGate(['127.0.0.1'], null),
+            $request,
+            new BarOptions(false, null),
+            new FilesystemHistory($options, null, $cookie),
+            $this->endpoint($options, $request),
+            $cookie
+        );
+        $response = new Response();
+
+        $listener($this->event(), null, $response);
+
+        $this->assertFalse($called);
+    }
+
+    public function testFirstAllowedResponseQueuesCookieWithoutCreatingHistory(): void
+    {
+        unset($_COOKIE[HistoryCookie::NAME]);
+        $path    = sys_get_temp_dir() . '/phalcon-debugbar-first-cookie-' . bin2hex(random_bytes(8));
+        $request = $this->createMock(RequestInterface::class);
+        $request->method('getClientAddress')->willReturn('127.0.0.1');
+        $request->method('isAjax')->willReturn(false);
+        $request->method('getURI')->willReturn('/orders');
+        $request->method('getMethod')->willReturn('GET');
+        $request->method('isSecure')->willReturn(true);
+        $options  = new HistoryOptions(true, '/_debugbar/open', $path);
+        $call     = [];
+        $cookie   = new HistoryCookie(
+            null,
+            function (string $name, string $value, array $options) use (&$call): bool {
+                $call = [$name, $value, $options];
+
+                return true;
+            }
+        );
+        $history  = new FilesystemHistory($options, null, $cookie);
+        $listener = new ResponseListener(
+            new DebugBar(),
+            new Renderer(),
+            new Injector(),
+            new AccessGate([], null),
+            $request,
+            new BarOptions(false, null),
+            $history,
+            $this->endpoint($options, $request, '/app1/'),
+            $cookie
+        );
+        $response = new Response();
+        $response->setContent('accepted');
+
+        $listener($this->event(), null, $response);
+
+        $this->assertSame([], $history->find());
+        $this->assertSame(HistoryCookie::NAME, $call[0]);
+        $this->assertIsString($call[1]);
+        $this->assertMatchesRegularExpression('/^[a-f0-9]{64}$/D', $call[1]);
+        $this->assertSame(
+            [
+                'path'     => '/app1/',
+                'secure'   => true,
+                'httponly' => true,
+                'samesite' => 'Lax',
+            ],
+            $call[2]
+        );
+        $this->assertFalse(is_dir($path));
+    }
+
     public function testIgnoresNonResponsePayloads(): void
     {
         $listener = $this->listener(true);
@@ -62,6 +170,209 @@ public function testInjectsWithoutRequestAndWithHeadersOff(): void
         $this->assertFalse($response->getHeaders()->get('X-Debug-Bar'));
     }
 
+    #[RunInSeparateProcess]
+    public function testInternalHistoryRequestsAreNotRecorded(): void
+    {
+        $sessionId                    = 'debugbar-' . bin2hex(random_bytes(8));
+        $browserId                    = bin2hex(random_bytes(32));
+        $_COOKIE[HistoryCookie::NAME] = $browserId;
+        $path                         = sys_get_temp_dir()
+            . '/phalcon-debugbar-internal-listener-'
+            . bin2hex(random_bytes(8));
+        session_id($sessionId);
+        session_start();
+
+        try {
+            $request = $this->createMock(RequestInterface::class);
+            $request->method('getClientAddress')->willReturn('127.0.0.1');
+            $request->method('isAjax')->willReturn(true);
+            $request->method('getURI')->willReturn('/app1/_debugbar/open?id=20260909000000-000000-deadbeef');
+            $request->method('getMethod')->willReturn('GET');
+
+            $options  = new HistoryOptions(true, '/_debugbar/open', $path);
+            $history  = new FilesystemHistory($options);
+            $listener = new ResponseListener(
+                new DebugBar(),
+                new Renderer(),
+                new Injector(),
+                new AccessGate([], null),
+                $request,
+                new BarOptions(true, null),
+                $history,
+                $this->endpoint($options, $request, '/app1/'),
+                HistoryCookie::fromGlobals()
+            );
+            $response = new Response();
+            $response->setContent('<html><body>endpoint error</body></html>');
+
+            $listener($this->event(), null, $response);
+
+            $this->assertSame([], $history->find());
+            $this->assertSame('<html><body>endpoint error</body></html>', $response->getContent());
+            $this->assertFalse($response->getHeaders()->get('X-Debug-Bar'));
+        } finally {
+            session_write_close();
+            $directory = $path . '/' . hash('sha256', $browserId);
+            $files     = glob($directory . '/*');
+            if (false !== $files) {
+                foreach ($files as $file) {
+                    unlink($file);
+                }
+            }
+
+            if (is_dir($directory)) {
+                rmdir($directory);
+            }
+            if (file_exists($path . '/.gc')) {
+                unlink($path . '/.gc');
+            }
+            if (file_exists($path . '/.lock')) {
+                unlink($path . '/.lock');
+            }
+            if (is_dir($path)) {
+                rmdir($path);
+            }
+        }
+    }
+
+    #[RunInSeparateProcess]
+    public function testRecordsRequestStartTimeFromNativeRequest(): void
+    {
+        $sessionId                    = 'debugbar-' . bin2hex(random_bytes(8));
+        $browserId                    = bin2hex(random_bytes(32));
+        $_COOKIE[HistoryCookie::NAME] = $browserId;
+        $path                         = sys_get_temp_dir()
+            . '/phalcon-debugbar-native-request-'
+            . bin2hex(random_bytes(8));
+        session_id($sessionId);
+        session_start();
+
+        $_SERVER['REMOTE_ADDR']        = '127.0.0.1';
+        $_SERVER['REQUEST_METHOD']     = 'PATCH';
+        $_SERVER['REQUEST_TIME_FLOAT'] = 946782245.123456;
+        $_SERVER['REQUEST_URI']        = '/orders/42?full=1';
+
+        try {
+            $options  = new HistoryOptions(true, '/_debugbar/open', $path);
+            $history  = new FilesystemHistory($options);
+            $listener = new ResponseListener(
+                new DebugBar(),
+                new Renderer(),
+                new Injector(),
+                new AccessGate([], null),
+                new Request(),
+                new BarOptions(false, null),
+                $history,
+                $this->endpoint($options, new Request()),
+                HistoryCookie::fromGlobals()
+            );
+            $response = new Response();
+            $response->setStatusCode(202);
+            $response->setContent('accepted');
+
+            $listener($this->event(), null, $response);
+
+            $requests = $history->find();
+            $this->assertCount(1, $requests);
+            $this->assertSame('2000-01-02T03:04:05+00:00', $requests[0]['requested_at']);
+        } finally {
+            session_write_close();
+            $directory = $path . '/' . hash('sha256', $browserId);
+            $files     = glob($directory . '/*');
+            if (false !== $files) {
+                foreach ($files as $file) {
+                    unlink($file);
+                }
+            }
+
+            if (is_dir($directory)) {
+                rmdir($directory);
+            }
+            if (file_exists($path . '/.gc')) {
+                unlink($path . '/.gc');
+            }
+            if (file_exists($path . '/.lock')) {
+                unlink($path . '/.lock');
+            }
+            if (is_dir($path)) {
+                rmdir($path);
+            }
+        }
+    }
+
+    #[RunInSeparateProcess]
+    public function testRecordsTheCollectedResponseInRequestHistory(): void
+    {
+        $sessionId                    = 'debugbar-' . bin2hex(random_bytes(8));
+        $browserId                    = bin2hex(random_bytes(32));
+        $_COOKIE[HistoryCookie::NAME] = $browserId;
+        $path                         = sys_get_temp_dir() . '/phalcon-debugbar-listener-' . bin2hex(random_bytes(8));
+        session_id($sessionId);
+        session_start();
+
+        try {
+            $request = $this->createMock(RequestInterface::class);
+            $request->method('getClientAddress')->willReturn('127.0.0.1');
+            $request->method('isAjax')->willReturn(true);
+            $request->method('getURI')->willReturn('/orders/42?full=1');
+            $request->method('getMethod')->willReturn('PATCH');
+            $_SERVER['REQUEST_TIME_FLOAT'] = 946782245.123456;
+
+            $options  = new HistoryOptions(true, '/_debugbar/open', $path);
+            $history  = new FilesystemHistory($options);
+            $listener = new ResponseListener(
+                new DebugBar(),
+                new Renderer(),
+                new Injector(),
+                new AccessGate([], null),
+                $request,
+                new BarOptions(false, null),
+                $history,
+                $this->endpoint($options, $request, '/app1/'),
+                HistoryCookie::fromGlobals()
+            );
+            $response = new Response();
+            $response->setStatusCode(202);
+            $response->setContent('accepted');
+
+            $listener($this->event(), null, $response);
+            unset($_SERVER['REQUEST_TIME_FLOAT']);
+            $listener($this->event(), null, $response);
+
+            $requests = $history->find();
+            $this->assertCount(2, $requests);
+            $this->assertSame('PATCH', $requests[0]['method']);
+            $this->assertSame('/orders/42?full=1', $requests[0]['uri']);
+            $this->assertSame(202, $requests[0]['status']);
+            $this->assertTrue($requests[0]['ajax']);
+            $this->assertSame($requests[0]['stored_at'], $requests[0]['requested_at']);
+            $this->assertSame('2000-01-02T03:04:05+00:00', $requests[1]['requested_at']);
+            $this->assertNotSame($requests[1]['requested_at'], $requests[1]['stored_at']);
+        } finally {
+            session_write_close();
+            $directory = $path . '/' . hash('sha256', $browserId);
+            $files     = glob($directory . '/*');
+            if (false !== $files) {
+                foreach ($files as $file) {
+                    unlink($file);
+                }
+            }
+
+            if (is_dir($directory)) {
+                rmdir($directory);
+            }
+            if (file_exists($path . '/.gc')) {
+                unlink($path . '/.gc');
+            }
+            if (file_exists($path . '/.lock')) {
+                unlink($path . '/.lock');
+            }
+            if (is_dir($path)) {
+                rmdir($path);
+            }
+        }
+    }
+
     public function testSetsDiagnosticHeaderWhenEnabled(): void
     {
         $bar = new DebugBar();
@@ -85,6 +396,20 @@ public function testSetsDiagnosticHeaderWhenEnabled(): void
         $this->assertSame('2', $response->getHeaders()->get('X-Debug-Bar'));
     }
 
+    private function endpoint(
+        HistoryOptions $options,
+        RequestInterface $request,
+        string $baseUri = '/'
+    ): HistoryEndpoint {
+        $container = new FactoryDefault();
+        $url       = new Url();
+        $url->setBaseUri($baseUri);
+        $container->setShared('request', $request);
+        $container->setShared('url', $url);
+
+        return new HistoryEndpoint($options, $container);
+    }
+
     private function event(): Event
     {
         return new Event('application:beforeSendResponse', $this);
diff --git a/tests/support/DebugBar/History/DelegatingHistoryFileOperations.php b/tests/support/DebugBar/History/DelegatingHistoryFileOperations.php
new file mode 100644
index 0000000..c6464f2
--- /dev/null
+++ b/tests/support/DebugBar/History/DelegatingHistoryFileOperations.php
@@ -0,0 +1,88 @@
+<?php
+
+/**
+ * This file is part of the Phalcon Framework.
+ *
+ * (c) Phalcon Team <team@phalcon.io>
+ *
+ * For the full copyright and license information, please view the LICENSE.txt
+ * file that was distributed with this source code.
+ */
+
+declare(strict_types=1);
+
+namespace Phalcon\Tests\Support\DebugBar\History;
+
+use Closure;
+use Phalcon\DebugBar\History\HistoryFileOperations;
+use Phalcon\DebugBar\History\NativeHistoryFileOperations;
+
+abstract class DelegatingHistoryFileOperations implements HistoryFileOperations
+{
+    protected readonly HistoryFileOperations $delegate;
+
+    public function __construct(?HistoryFileOperations $delegate = null)
+    {
+        $this->delegate = $delegate ?? new NativeHistoryFileOperations();
+    }
+
+    public function createDirectory(string $directory, int $permissions, bool $recursive): bool
+    {
+        return $this->delegate->createDirectory($directory, $permissions, $recursive);
+    }
+
+    public function directoryExists(string $directory): bool
+    {
+        return $this->delegate->directoryExists($directory);
+    }
+
+    public function fileExists(string $file): bool
+    {
+        return $this->delegate->fileExists($file);
+    }
+
+    public function isWritable(string $path): bool
+    {
+        return $this->delegate->isWritable($path);
+    }
+
+    public function matching(string $pattern, int $flags = 0): array
+    {
+        return $this->delegate->matching($pattern, $flags);
+    }
+
+    public function modifiedAt(string $file): false | int
+    {
+        return $this->delegate->modifiedAt($file);
+    }
+
+    public function move(string $source, string $target): bool
+    {
+        return $this->delegate->move($source, $target);
+    }
+
+    public function read(string $file): false | string
+    {
+        return $this->delegate->read($file);
+    }
+
+    public function remove(string $file): bool
+    {
+        return $this->delegate->remove($file);
+    }
+
+    public function removeDirectory(string $directory): bool
+    {
+        return $this->delegate->removeDirectory($directory);
+    }
+
+    public function withExclusiveLock(string $file, Closure $operation): bool
+    {
+        return $this->delegate->withExclusiveLock($file, $operation);
+    }
+
+    public function write(string $file, string $contents): bool
+    {
+        return $this->delegate->write($file, $contents);
+    }
+}
diff --git a/tests/support/DebugBar/History/FailingStreamWrapper.php b/tests/support/DebugBar/History/FailingStreamWrapper.php
new file mode 100644
index 0000000..38f054c
--- /dev/null
+++ b/tests/support/DebugBar/History/FailingStreamWrapper.php
@@ -0,0 +1,69 @@
+<?php
+
+/**
+ * This file is part of the Phalcon Framework.
+ *
+ * (c) Phalcon Team <team@phalcon.io>
+ *
+ * For the full copyright and license information, please view the LICENSE.txt
+ * file that was distributed with this source code.
+ */
+
+declare(strict_types=1);
+
+namespace Phalcon\Tests\Support\DebugBar\History;
+
+use function str_ends_with;
+use function time;
+
+/**
+ * Test-only stream wrapper for exercising storage failures through the public
+ * FilesystemHistory API.
+ */
+final class FailingStreamWrapper
+{
+    /**
+     * @var resource|null
+     */
+    public $context;
+
+    // phpcs:ignore PSR1.Methods.CamelCapsMethodName.NotCamelCaps
+    public function stream_open(string $path, string $mode, int $options, ?string &$openedPath): bool
+    {
+        return false;
+    }
+
+    /**
+     * @return array<int|string, int>
+     */
+    // phpcs:ignore PSR1.Methods.CamelCapsMethodName.NotCamelCaps
+    public function url_stat(string $path, int $flags): array
+    {
+        return $this->stat(str_ends_with($path, '.json') ? 0100666 : 0040777);
+    }
+
+    /**
+     * @return array<int|string, int>
+     */
+    private function stat(int $mode): array
+    {
+        $now = time();
+
+        return [
+            0, 0, $mode, 1, 0, 0, 0, 0, $now, $now, $now, -1, -1,
+            'dev'     => 0,
+            'ino'     => 0,
+            'mode'    => $mode,
+            'nlink'   => 1,
+            'uid'     => 0,
+            'gid'     => 0,
+            'rdev'    => 0,
+            'size'    => 0,
+            'atime'   => $now,
+            'mtime'   => $now,
+            'ctime'   => $now,
+            'blksize' => -1,
+            'blocks'  => -1,
+        ];
+    }
+}
diff --git a/tests/support/DebugBar/History/GarbageCollectionMarkerFailingFileOperations.php b/tests/support/DebugBar/History/GarbageCollectionMarkerFailingFileOperations.php
new file mode 100644
index 0000000..66a535e
--- /dev/null
+++ b/tests/support/DebugBar/History/GarbageCollectionMarkerFailingFileOperations.php
@@ -0,0 +1,25 @@
+<?php
+
+/**
+ * This file is part of the Phalcon Framework.
+ *
+ * (c) Phalcon Team <team@phalcon.io>
+ *
+ * For the full copyright and license information, please view the LICENSE.txt
+ * file that was distributed with this source code.
+ */
+
+declare(strict_types=1);
+
+namespace Phalcon\Tests\Support\DebugBar\History;
+
+use function str_ends_with;
+
+final class GarbageCollectionMarkerFailingFileOperations extends DelegatingHistoryFileOperations
+{
+    public function write(string $file, string $contents): bool
+    {
+        return !str_ends_with($file, '/.gc')
+            && $this->delegate->write($file, $contents);
+    }
+}
diff --git a/tests/support/DebugBar/History/MetadataMoveFailingHistoryFileOperations.php b/tests/support/DebugBar/History/MetadataMoveFailingHistoryFileOperations.php
new file mode 100644
index 0000000..be4505a
--- /dev/null
+++ b/tests/support/DebugBar/History/MetadataMoveFailingHistoryFileOperations.php
@@ -0,0 +1,24 @@
+<?php
+
+/**
+ * This file is part of the Phalcon Framework.
+ *
+ * (c) Phalcon Team <team@phalcon.io>
+ *
+ * For the full copyright and license information, please view the LICENSE.txt
+ * file that was distributed with this source code.
+ */
+
+declare(strict_types=1);
+
+namespace Phalcon\Tests\Support\DebugBar\History;
+
+use function str_ends_with;
+
+final class MetadataMoveFailingHistoryFileOperations extends DelegatingHistoryFileOperations
+{
+    public function move(string $source, string $target): bool
+    {
+        return !str_ends_with($target, '.json.meta') && $this->delegate->move($source, $target);
+    }
+}
diff --git a/tests/support/DebugBar/History/MetadataWriteFailingHistoryFileOperations.php b/tests/support/DebugBar/History/MetadataWriteFailingHistoryFileOperations.php
new file mode 100644
index 0000000..4947842
--- /dev/null
+++ b/tests/support/DebugBar/History/MetadataWriteFailingHistoryFileOperations.php
@@ -0,0 +1,30 @@
+<?php
+
+/**
+ * This file is part of the Phalcon Framework.
+ *
+ * (c) Phalcon Team <team@phalcon.io>
+ *
+ * For the full copyright and license information, please view the LICENSE.txt
+ * file that was distributed with this source code.
+ */
+
+declare(strict_types=1);
+
+namespace Phalcon\Tests\Support\DebugBar\History;
+
+use function str_contains;
+
+final class MetadataWriteFailingHistoryFileOperations extends DelegatingHistoryFileOperations
+{
+    public function write(string $file, string $contents): bool
+    {
+        if (str_contains($file, '.json.meta.tmp-')) {
+            $this->delegate->write($file, $contents);
+
+            return false;
+        }
+
+        return $this->delegate->write($file, $contents);
+    }
+}
diff --git a/tests/support/DebugBar/History/PayloadMoveFailingHistoryFileOperations.php b/tests/support/DebugBar/History/PayloadMoveFailingHistoryFileOperations.php
new file mode 100644
index 0000000..3e75ea1
--- /dev/null
+++ b/tests/support/DebugBar/History/PayloadMoveFailingHistoryFileOperations.php
@@ -0,0 +1,24 @@
+<?php
+
+/**
+ * This file is part of the Phalcon Framework.
+ *
+ * (c) Phalcon Team <team@phalcon.io>
+ *
+ * For the full copyright and license information, please view the LICENSE.txt
+ * file that was distributed with this source code.
+ */
+
+declare(strict_types=1);
+
+namespace Phalcon\Tests\Support\DebugBar\History;
+
+use function str_ends_with;
+
+final class PayloadMoveFailingHistoryFileOperations extends DelegatingHistoryFileOperations
+{
+    public function move(string $source, string $target): bool
+    {
+        return !str_ends_with($target, '.json') && $this->delegate->move($source, $target);
+    }
+}
diff --git a/tests/support/DebugBar/History/PayloadReadTrackingHistoryFileOperations.php b/tests/support/DebugBar/History/PayloadReadTrackingHistoryFileOperations.php
new file mode 100644
index 0000000..ad80474
--- /dev/null
+++ b/tests/support/DebugBar/History/PayloadReadTrackingHistoryFileOperations.php
@@ -0,0 +1,30 @@
+<?php
+
+/**
+ * This file is part of the Phalcon Framework.
+ *
+ * (c) Phalcon Team <team@phalcon.io>
+ *
+ * For the full copyright and license information, please view the LICENSE.txt
+ * file that was distributed with this source code.
+ */
+
+declare(strict_types=1);
+
+namespace Phalcon\Tests\Support\DebugBar\History;
+
+use function str_ends_with;
+
+final class PayloadReadTrackingHistoryFileOperations extends DelegatingHistoryFileOperations
+{
+    public int $payloadReads = 0;
+
+    public function read(string $file): false | string
+    {
+        if (str_ends_with($file, '.json')) {
+            $this->payloadReads++;
+        }
+
+        return $this->delegate->read($file);
+    }
+}
diff --git a/tests/support/DebugBar/History/RecordingMatchingHistoryFileOperations.php b/tests/support/DebugBar/History/RecordingMatchingHistoryFileOperations.php
new file mode 100644
index 0000000..e7d53bd
--- /dev/null
+++ b/tests/support/DebugBar/History/RecordingMatchingHistoryFileOperations.php
@@ -0,0 +1,46 @@
+<?php
+
+/**
+ * This file is part of the Phalcon Framework.
+ *
+ * (c) Phalcon Team <team@phalcon.io>
+ *
+ * For the full copyright and license information, please view the LICENSE.txt
+ * file that was distributed with this source code.
+ */
+
+declare(strict_types=1);
+
+namespace Phalcon\Tests\Support\DebugBar\History;
+
+final class RecordingMatchingHistoryFileOperations extends DelegatingHistoryFileOperations
+{
+    /**
+     * @var list<string>
+     */
+    public array $directoryChecks = [];
+
+    /**
+     * @var list<string>
+     */
+    public array $patterns = [];
+
+    public function directoryExists(string $directory): bool
+    {
+        $this->directoryChecks[] = $directory;
+
+        return true;
+    }
+
+    public function isWritable(string $path): bool
+    {
+        return true;
+    }
+
+    public function matching(string $pattern, int $flags = 0): array
+    {
+        $this->patterns[] = $pattern;
+
+        return [];
+    }
+}
diff --git a/tests/support/DebugBar/History/RenameFailingHistoryFileOperations.php b/tests/support/DebugBar/History/RenameFailingHistoryFileOperations.php
new file mode 100644
index 0000000..dfbdcc8
--- /dev/null
+++ b/tests/support/DebugBar/History/RenameFailingHistoryFileOperations.php
@@ -0,0 +1,41 @@
+<?php
+
+/**
+ * This file is part of the Phalcon Framework.
+ *
+ * (c) Phalcon Team <team@phalcon.io>
+ *
+ * For the full copyright and license information, please view the LICENSE.txt
+ * file that was distributed with this source code.
+ */
+
+declare(strict_types=1);
+
+namespace Phalcon\Tests\Support\DebugBar\History;
+
+final class RenameFailingHistoryFileOperations extends DelegatingHistoryFileOperations
+{
+    public int $removeCalls = 0;
+
+    public function move(string $source, string $target): bool
+    {
+        return false;
+    }
+
+    public function read(string $file): false | string
+    {
+        return false;
+    }
+
+    public function remove(string $file): bool
+    {
+        $this->removeCalls++;
+
+        return true;
+    }
+
+    public function write(string $file, string $contents): bool
+    {
+        return true;
+    }
+}
diff --git a/tests/support/DebugBar/History/UnwritableHistoryFileOperations.php b/tests/support/DebugBar/History/UnwritableHistoryFileOperations.php
new file mode 100644
index 0000000..512c112
--- /dev/null
+++ b/tests/support/DebugBar/History/UnwritableHistoryFileOperations.php
@@ -0,0 +1,24 @@
+<?php
+
+/**
+ * This file is part of the Phalcon Framework.
+ *
+ * (c) Phalcon Team <team@phalcon.io>
+ *
+ * For the full copyright and license information, please view the LICENSE.txt
+ * file that was distributed with this source code.
+ */
+
+declare(strict_types=1);
+
+namespace Phalcon\Tests\Support\DebugBar\History;
+
+final class UnwritableHistoryFileOperations extends DelegatingHistoryFileOperations
+{
+    public bool $writable = true;
+
+    public function isWritable(string $path): bool
+    {
+        return $this->writable && parent::isWritable($path);
+    }
+}
diff --git a/tests/support/DebugBar/PanelContractTrait.php b/tests/support/DebugBar/PanelContractTrait.php
index 0396d7d..65ae5dc 100644
--- a/tests/support/DebugBar/PanelContractTrait.php
+++ b/tests/support/DebugBar/PanelContractTrait.php
@@ -39,6 +39,13 @@ protected function assertPanelContract(Renderable $collector): void
                 Assert::assertIsScalar($metric['value']);
             }
         }
+        if (isset($collected['metrics'])) {
+            Assert::assertIsArray($collected['metrics']);
+            foreach ($collected['metrics'] as $key => $value) {
+                Assert::assertIsString($key);
+                Assert::assertIsScalar($value);
+            }
+        }
         switch ($panel) {
             case 'grid':
                 Assert::assertIsArray($data);
@@ -81,6 +88,12 @@ protected function assertPanelContract(Renderable $collector): void
             case 'html':
                 Assert::assertIsString($data);
 
+                break;
+            case 'history':
+                Assert::assertIsArray($data);
+                Assert::assertArrayHasKey('url', $data);
+                Assert::assertIsString($data['url']);
+
                 break;
             default:
                 Assert::fail('Unknown panel type: ' . $panel);