v0.31.7

README.md

@@ -1,11 +1,11 @@
-# RustProxy 0.31.6
+# RustProxy 0.31.7
 
 **0.31.0 panel/cache additions:** browser-negotiated Zstd/Brotli/gzip for HTML, JS and CSS (Settings → Administration); optional HTTP BAN/PURGE restricted to explicit IP/CIDR allowlist (Settings → Cache, disabled by default); System information Refresh button beside the API badge. See [Settings](docs/SETTINGS.md) and [Cache](docs/CACHE.md).
 
 Independent Rust reverse proxy and static Web Server with a dashboard, SQLite configuration,
 streaming HTTP/TLS/WebSocket forwarding, raw TCP/UDP stream hosts, IP-bound vhosts and backend pools.
 
-**0.31.6 HTTP/3 mobile full-navigation stability and diagnostics (Cargo/live verification required).**
+**0.31.7 per-vhost User-Agent limits, Settings grouping, revision diff, and safe update retention (Rust/Cargo and live testing required).**
 
 ## Layer-4 streams
 
@@ -13,13 +13,19 @@ Raw TCP/UDP forwarding has its own **Streams** page in the primary navigation, a
 
 Named HTTP/HTTPS listener bind addresses use the same chip-style editor as vhost hostnames, including multi-address listeners.
 
-## What changed in 0.31.6
+## What changed in 0.31.7
 
-- Make HTTP/3 `GET`/`HEAD` forwarding to HTTP/1.1 origins explicitly recognize a finished, empty H3 receive stream before upstream forwarding. Bounded probes at the cache/404 preflight and H1 forwarding stages preserve nonempty bodies and let slow peers continue streaming without blocking the document navigation. Hyper already special-cases H1 GET/HEAD framing; this is a receive-stream lifecycle fix, not a claim that GET was always chunked. It targets full reload via the original logo `<a href="/">` without changing its action or other panel navigation.
-- Keep in-flight H3 response tasks draining after an H3 accept-loop failure rather than immediately resetting every active stream.
-- Record peer cancellations with HTTP status **0** (not a synthetic HTTP 400) and emit diagnostic phases, H3 stream ID, method, sanitized path without query, selected response status and bytes already sent on interrupted H3 responses. These error events are in per-vhost file logs when logging is enabled; an H3 `GET /` also produces INFO/WARN navigation breadcrumbs in the service log to identify the *new* request. Do not confuse old-stream cancellations with failed new navigations.
-- Retain the 0.31.5 mobile `/logs` layout, cache protocol toggle fix and trusted panel-Origin behavior. SQLite schema 9 and Cold Cache format 3 are unchanged.
-- Rust/Cargo and actual iPhone+QUIC acceptance remain mandatory. See [0.31.6 implementation](docs/IMPLEMENTATION_0.31.6.md) and [test report](docs/TEST_REPORT.md).
+- **Settings → Rules & headers:** the global User-Agent blocklist, global custom header editor and client response settings now share a Cache-style tabbed page (three persistent sub-tabs). Settings → Security keeps sessions/password and host access policies.
+- **Vhosts → Traffic policy:** optional User-Agent-specific per-client-IP request limits. First matching case-insensitive substring or `*` wildcard rule overrides the default/country rate for that request, even when ordinary throttling is disabled. Each vhost, UA rule and IP has independent bounded fixed-window accounting. Up to 64 rules per vhost; patterns are validated and the feature is opt-in.
+- **Revision history:** show changed leaf fields rather than object-sized JSON previews, including stable IDs for array members. Full before/after JSON is available through a separate comparison dialog. Restore behavior unchanged.
+- **Listeners:** space apart HTTP/2 and HTTP/3 tuning shortcuts. **ACL profiles:** “Attached to” is initially collapsed but expandable.
+- **`update.sh`:** retain exactly two installed binary release directories (including `current`) and three private pre-update backups. Correct the previous mtime-sort path deletion bug; old releases were only printed, not actually deleted. After a successful update, optionally purge only incremental Cargo state unused for 30+ days, never fingerprint, dependency, build-script or compiled executable artifacts. A source-tree upgrade retains its own backups and target directory.
+- **Graceful managed update:** trace marker → systemd stop → forced best-effort HOT→COLD handoff when COLD is enabled; record completion, even when zero items were demoted. Existing update flush works regardless of `cold_on_shutdown`; no persisted schema or cold format change.
+- **Compatibility:** retains all 0.31.6 H3/iPhone diagnostic fixes, 0.31.5 mobile Logs and protocol-independent cache behavior. SQLite schema 9 unchanged. Rust/Cargo and live reload/update verification remain mandatory. See [0.31.7 implementation](docs/IMPLEMENTATION_0.31.7.md) and [test report](docs/TEST_REPORT.md).
+
+## Previously in 0.31.6
+
+- HTTP/3 full-navigation GET/HEAD receive-stream handling, client cancellation classification and diagnostic events. Keep logo behavior unchanged. See [0.31.6 implementation](docs/IMPLEMENTATION_0.31.6.md).
 
 ## Previously in 0.31.5