v0.31.7

tools/checks/check_source.py

@@ -24,7 +24,7 @@ def read_docker_agent_source() -> str:
 
 preflight(root)
 manifest = tomllib.loads((root / "Cargo.toml").read_text())
-assert manifest["package"]["version"] == "0.31.6"
+assert manifest["package"]["version"] == "0.31.7"
 assert manifest["dependencies"]["quinn"]["version"] == "0.11.12"
 h3dep = manifest["dependencies"]["h3"]
 assert h3dep["package"] == "hpx-h3" and h3dep["version"] == "=2.5.20" and "quinn" in h3dep["features"]
@@ -32,14 +32,14 @@ assert "h3-quinn" not in manifest["dependencies"]
 lock_path = root / "Cargo.lock"
 if lock_path.exists():
     lock = lock_path.read_text()
-    assert 'name = "rust-proxy"\nversion = "0.31.6"' in lock
+    assert 'name = "rust-proxy"\nversion = "0.31.7"' in lock
     assert 'name = "systemstat"' in lock and 'name = "metrics-process"' in lock and 'name = "sysinfo"' in lock, "Cargo.lock must be resolver-generated after adding cross-platform statistics libraries"
 for release_doc, marker in {
-    "README.md": "# RustProxy 0.31.6",
-    "CHANGELOG.md": "## 0.31.6",
-    "ROADMAP.md": "## 0.31.6",
-    "AGENTS.md": "Current source version: 0.31.6.",
-    "docs/TEST_REPORT.md": "# Verification report - RustProxy 0.31.6",
+    "README.md": "# RustProxy 0.31.7",
+    "CHANGELOG.md": "## 0.31.7",
+    "ROADMAP.md": "## 0.31.7",
+    "AGENTS.md": "Current source version: 0.31.7.",
+    "docs/TEST_REPORT.md": "# Verification report - RustProxy 0.31.7",
 }.items():
     assert marker in (root / release_doc).read_text(), f"stale release identity in {release_doc}"
 assert tomllib.loads((root / "rust-toolchain.toml").read_text())["toolchain"]["channel"] == "stable"
@@ -150,7 +150,7 @@ for marker in [
 assert "data" in (root / ".dockerignore").read_text().splitlines()
 css = (root / "src/admin/web/style.css").read_text()
 assert ".logging-grid fieldset" not in css, "logging sinks must reuse shared card styling"
-assert "dialog.config-history-dialog {" in css, "Revision History must use the shared dialog appearance rule"
+assert re.search(r"dialog\.config-history-dialog,\s*dialog\.config-history-json-dialog\s*\{", css), "Revision History and JSON comparison must use shared dialog styling"
 assert ".config-history-dialog::backdrop" not in css, "Revision History must not duplicate the shared dialog backdrop"
 history_dialog_css = re.search(r"^\.config-history-dialog\s*\{([^}]*)\}", css, re.M).group(1)
 assert "border-radius:" not in history_dialog_css, "Revision History dialog must stay square-cornered"
@@ -285,7 +285,7 @@ assert 'Opt-in health decisions based on ordinary user traffic. Defaults to disa
 assert '"force_ssl"' in openapi and '"forward_client_ip"' in openapi
 assert '"backend_header"' in openapi and '"backend_timing_header"' in openapi
 assert '"StreamMetrics"' in openapi and '"streams"' in openapi
-for marker in ['"version": "0.31.6"', '"/api/traffic"', '"capture_user_agent"', '"capture_country"', '"hot_auto_trim_enabled"', '"hot_auto_trim_after_seconds"', '"hot_auto_trim_target_percent"', '"/api/config/{section}"', '"ConfigSectionUpdate"', '"cold_on_idle"', '"cold_on_age"', '"cold_max_hot_seconds"', '"cold_on_lru"', '"cold_on_shutdown"', '"cold_gc_interval_seconds"', '"cold_gc_max_delete"', '"collapse_enabled"', '"collapse_wait_timeout_ms"', '"collapse_timeout_fallback"', '"stale_if_error_timeout"', '"stale_if_error_connection"', '"stale_if_error_dns"', '"stale_if_error_tls"', '"stale_if_error_statuses"', '"proactive_refresh_enabled"', '"proactive_refresh_before_expiry_seconds"', '"proactive_refresh_percent"', '"proactive_refresh_max_inflight"', '"TransformSettings"', '"TransformOverrides"', '"/api/cache/cold/cleanup"', '"/api/cache/invalidate"', '"/api/cache/bans"', '"/api/cache/bans/{id}"', '"CacheInvalidationRequest"', '"CacheInvalidationResponse"', '"ColdCleanupJob"', '"match_type"', '"regex_insensitive"', '"rewrite"', '"response"', '"covered_hosts"', '"default": true']:
+for marker in ['"version": "0.31.7"', '"/api/traffic"', '"capture_user_agent"', '"capture_country"', '"hot_auto_trim_enabled"', '"hot_auto_trim_after_seconds"', '"hot_auto_trim_target_percent"', '"/api/config/{section}"', '"ConfigSectionUpdate"', '"cold_on_idle"', '"cold_on_age"', '"cold_max_hot_seconds"', '"cold_on_lru"', '"cold_on_shutdown"', '"cold_gc_interval_seconds"', '"cold_gc_max_delete"', '"collapse_enabled"', '"collapse_wait_timeout_ms"', '"collapse_timeout_fallback"', '"stale_if_error_timeout"', '"stale_if_error_connection"', '"stale_if_error_dns"', '"stale_if_error_tls"', '"stale_if_error_statuses"', '"proactive_refresh_enabled"', '"proactive_refresh_before_expiry_seconds"', '"proactive_refresh_percent"', '"proactive_refresh_max_inflight"', '"TransformSettings"', '"TransformOverrides"', '"/api/cache/cold/cleanup"', '"/api/cache/invalidate"', '"/api/cache/bans"', '"/api/cache/bans/{id}"', '"CacheInvalidationRequest"', '"CacheInvalidationResponse"', '"ColdCleanupJob"', '"match_type"', '"regex_insensitive"', '"rewrite"', '"response"', '"covered_hosts"', '"default": true']:
     assert marker in openapi, marker
 for marker in ['"NotFoundHost"', '"not_found_hosts"', '"PrometheusSettings"', '"allow_trusted_network_without_token"', '"include_docker_vhosts"', '"include_streams"', '"include_logging"']:
     assert marker in openapi, marker
@@ -577,7 +577,7 @@ for marker in ['data-cache-settings-tab="general"', 'data-cache-settings-tab="re
     assert marker in html, marker
 for marker in ['data-settings-tab="connections"', 'data-http-settings-tab="http2"', 'data-http-settings-tab="http3"', 'id="http2-form"', 'id="http2-listener-rows"', 'id="http3-form"', 'id="http3-listener-rows"']:
     assert marker in html, marker
-for marker in ['const tabAliases = { http2: "connections" }', 'data-http-settings-tab', 'selectHttpTab("http2")']:
+for marker in ['const tabAliases = { http2: "connections", headers: "policies", response: "policies" }', 'data-http-settings-tab', 'selectHttpTab("http2")']:
     assert marker in settings_js or marker in html, marker
 for marker in ['renderHttp2Settings', 'collectHttp2Listeners', 'http2SettingsControls', 'preservedHttp2', 'listener-h2', 'h2Configure', 'selectHttpTab?.("http2")', 'renderHttp3Settings', 'collectHttp3Listeners', 'http3SettingsControls', 'preservedHttp3', 'listener-h3', 'h3Configure', 'selectHttpTab?.("http3")']:
     assert marker in integrations_js, marker
@@ -1394,7 +1394,7 @@ assert '"error_log" => {' not in admin_0241 and 'request("/api/config/error_log"
 assert '"error_log"' in openapi and 'logging, error_log, forwarding' not in openapi
 assert 'logging_section_persists_error_log_settings_atomically' in admin_0241 and 'error_log_is_not_a_standalone_configuration_section' in admin_0241
 assert 'location.pathname === "/logging"' in settings_js_0241
-assert '"RuntimeInformation"' in openapi and '"version": "0.31.6"' in openapi
+assert '"RuntimeInformation"' in openapi and '"version": "0.31.7"' in openapi
 
 # 0.24.1 compiler and hostname-cardinality regressions.
 tls_0241 = rust_source(root, "src/tls.rs")
@@ -1633,5 +1633,5 @@ for marker_0282 in [
 assert 'Zewnętrzne ścieżki plików' in (root / 'langs/pl_pl.json').read_text()
 assert 'setfacl -m u:rustproxy:--x /etc/ssl/' in (root / 'docs/V0.28.2_IMPLEMENTATION.md').read_text()
 
-print("PASS: 0.31.6 manifest/package, shared system-statistics/runtime metadata, Settings logging, retained H2, external-packaging/Grafana/Prometheus/404-host/custom-location/path/cache/dashboard/Nagios UI/source contracts, stopped legacy-renewal removal, session/admin/transport contracts, deterministic package source and embedded SQLite schema-v9 migrations.")
+print("PASS: 0.31.7 manifest/package, shared system-statistics/runtime metadata, Settings logging, retained H2, external-packaging/Grafana/Prometheus/404-host/custom-location/path/cache/dashboard/Nagios UI/source contracts, stopped legacy-renewal removal, session/admin/transport contracts, deterministic package source and embedded SQLite schema-v9 migrations.")
 print("NOT VERIFIED: Rust parsing, types, compilation, linking or runtime behavior. Run ./dev.sh test.")

tools/checks/dependency_upgrade_0312.py

@@ -1,5 +1,5 @@
 #!/usr/bin/env python3
-"""Check the 0.31.6 dependency/source migration; optionally require a resolved lock.
+"""Check the 0.31.7 dependency/source migration; optionally require a resolved lock.
 
 This is not a substitute for rustc, cargo metadata or runtime tests.
 """
@@ -14,7 +14,7 @@ parser = argparse.ArgumentParser()
 parser.add_argument('--require-lock', action='store_true', help='Require the post-upgrade Cargo.lock produced by cargo update')
 args = parser.parse_args()
 manifest = tomllib.loads((ROOT / 'Cargo.toml').read_text())
-assert manifest['package']['version'] == '0.31.6'
+assert manifest['package']['version'] == '0.31.7'
 assert manifest['package']['rust-version'] == '1.99'
 deps = manifest['dependencies']
 expected_requirements = {
@@ -78,4 +78,4 @@ if missing:
     print(f'PENDING: lockfile still requires cargo update ({details})')
 else:
     print('PASS: pinned key packages found in post-upgrade lock; cargo --locked verification is still required')
-print('PASS: 0.31.6 source dependency APIs, manifest, TLS features, toolchain images and Swagger pin (static only)')
+print('PASS: 0.31.7 source dependency APIs, manifest, TLS features, toolchain images and Swagger pin (static only)')

tools/checks/docs_check.py

@@ -1,5 +1,5 @@
 #!/usr/bin/env python3
-"""Rust-independent documentation/Reader consistency checks for the 0.31.6 release."""
+"""Rust-independent documentation/Reader consistency checks for the 0.31.7 release."""
 from pathlib import Path
 import re
 from rust_source import rust_source
@@ -30,7 +30,7 @@ required = [
     DOCS / "V0.25.1_AUDIT.md",
     DOCS / "V0.25.0_AUDIT.md",
     DOCS / "IMPLEMENTATION_0.31.5.md",
-    DOCS / "IMPLEMENTATION_0.31.6.md",
+    DOCS / "IMPLEMENTATION_0.31.7.md",
     DOCS / "IMPLEMENTATION_0.31.3.md",
     DOCS / "IMPLEMENTATION_0.31.1.md",
     DOCS / "TEST_REPORT.md",
@@ -68,7 +68,7 @@ assert '"/docs/content.json"' in admin
 readme = (ROOT / "README.md").read_text(encoding="utf-8")
 roadmap = (ROOT / "ROADMAP.md").read_text(encoding="utf-8")
 changelog = (ROOT / "CHANGELOG.md").read_text(encoding="utf-8")
-assert readme.startswith("# RustProxy 0.31.6")
+assert readme.startswith("# RustProxy 0.31.7")
 assert "docs/WEB_SERVER.md" in readme and "docs/README.md" in readme
 assert readme.count("## What changed in ") == 1, "README duplicates historical release notes; use CHANGELOG/archive"
 assert "## Release history" in readme and "docs/ROADMAP_HISTORY.md" in readme

tools/checks/h3_navigation_0316.py

@@ -1,10 +1,10 @@
 #!/usr/bin/env python3
-"""Compiler-independent guard for the 0.31.6 H3 navigation patch."""
+"""Compiler-independent guard for the 0.31.7 H3 navigation patch."""
 from pathlib import Path
 
 ROOT = Path(__file__).resolve().parents[2]
 html = (ROOT / 'src/admin/web/index.html').read_text()
-assert '0.31.6' in (ROOT / "Cargo.toml").read_text()
+assert '0.31.7' in (ROOT / "Cargo.toml").read_text()
 assert '<a class="brand" href="/"' in html, 'logo must remain a true full-page navigation'
 assert 'addEventListener("click"' not in html.split('<a class="brand" href="/"',1)[1].split('</a>',1)[0]
 body = (ROOT / 'src/proxy/cache_helpers.rs').read_text()
@@ -28,4 +28,4 @@ for marker in ('h3_bodyless_get_and_head_are_normalized_for_http1_navigation',
                'h3_stalled_cache_probe_bypasses_without_blocking_navigation',
                'h3_cache_probe_replays_nonempty_get_without_dropping_bytes'):
     assert marker in rust_tests, marker
-print('PASS: RustProxy 0.31.6 original logo, H3 empty-GET receive lifecycle, bounded probe, per-stream diagnostics and drain invariants')
+print('PASS: RustProxy 0.31.7 original logo, H3 empty-GET receive lifecycle, bounded probe, per-stream diagnostics and drain invariants')

tools/checks/preflight.py

@@ -73,12 +73,12 @@ def check(root: Path, repair_known: bool = False) -> list[str]:
         flat = module.parent.with_suffix(".rs")
         if flat.is_file():
             raise ValueError(f"Conflicting Rust modules: {flat.relative_to(root)} and {module.relative_to(root)}")
-    for path in ["src/auth/mod.rs", "src/auth/store.rs", "src/backup/snapshot.rs", "src/upstream.rs", "src/tls.rs", "src/config/internal_routing.rs", "src/proxy/websocket.rs", "src/proxy/error_fallback.rs", "src/cache/mod.rs", "src/cache/model.rs", "src/cache/lifecycle.rs", "src/cache/cold.rs", "src/cache/dashboard.rs", "src/cache/tickets.rs", "src/cache/lookup.rs", "src/cache/policy.rs", "src/cache/fill.rs", "src/cache/tests.rs", "src/settings.rs", "src/compression.rs", "src/diagnostics.rs", "src/traffic.rs", "src/system_stats/mod.rs", "src/system_stats/linux.rs", "src/vhost.rs", "src/vhost/error_fallback.rs", "src/web_server/mod.rs", "src/web_server/config.rs", "src/web_server/filesystem.rs", "src/web_server/security.rs", "src/web_server/response.rs", "src/web_server/request.rs", "src/web_server/routing.rs", "src/web_server/fastcgi.rs", "src/web_server/htaccess.rs", "src/web_server/serve.rs", "src/web_server/tests.rs", "src/balance.rs", "src/security.rs", "src/admin/web/vhosts/core.js", "src/admin/web/vhosts/health.js", "src/admin/web/vhosts/editor.js", "src/admin/web/vhosts/render.js", "src/admin/web/web-server.js", "src/admin/web/streams.js", "src/admin/web/host404.js", "src/admin/web/app/core.js", "src/admin/web/app/session-resume.js", "src/admin/web/app/preferences.js", "src/admin/web/app/config-history.js", "src/admin/web/app/runtime.js", "src/admin/web/app/settings.js", "src/admin/web/management.js", "src/admin/web/drafts.js", "src/pages.rs", "tools/dev/mock_server.py", "tools/dev/mock_auth.py", "src/forwarding.rs", "src/tinyauth.rs", "src/http3.rs", "src/stream.rs", "src/admin/web/integrations.js", "src/admin/web/traffic-panel.js", "src/prometheus.rs", "src/admin/web/settings.js", "src/admin/web/docker.js", "src/docker.rs", "docker-agent/main.go", "docker-agent/model.go", "docker-agent/docker.go", "docker-agent/network.go", "docker-agent/certificate.go", "docker-agent/server.go", "docker-agent/main_test.go", "docker-agent/rustproxy-docker-agent.service", "docker-agent/install.sh", "docs/DOCKER_DISCOVERY.md", "docs/WEB_SERVER.md", "docs/PHP_FPM.md", "docs/README.md", "docs/TODO.md", "docs/V0.25.5_AUDIT.md", "docs/V0.25.4_AUDIT.md", "docs/V0.25.3_AUDIT.md", "docs/V0.25.2_AUDIT.md", "docs/CHANGELOG_TECHNICAL_ARCHIVE.md", "docs/ROADMAP_HISTORY.md", "tools/checks/docs_check.py", "tools/checks/web_server_contracts.py", "tools/checks/rust_source.py", "tools/checks/rust_module_contracts.py", "tools/checks/source_module_contracts.py", "scripts/runtime/acme_provider.py", "src/basic_auth.rs", "scripts/deploy/deploy.py", "scripts/deploy/deploy_core.py", "scripts/deploy/deploy_runtime.py", "scripts/migration/migrate_npm.py", "scripts/migration/migrate_npm_core.py", "scripts/migration/migrate_npm_api.py", "docs/NPM_MIGRATION.md", "docs/STREAMS.md", "install.sh", "install-debian13.sh", "update.sh", "build.rs", "scripts/build/swagger_assets.py", "src/admin/documentation.rs", "src/admin/openapi.json", "langs/en_US.json", "langs/pl_pl.json", "Dockerfile", ".dockerignore", "docs/CONTAINER.md", "docs/PROMETHEUS.md", "docs/NOT_FOUND_HOSTS.md", "grafana/rustproxy-overview.json"]:
+    for path in ["src/auth/mod.rs", "src/auth/store.rs", "src/backup/snapshot.rs", "src/upstream.rs", "src/tls.rs", "src/config/internal_routing.rs", "src/proxy/websocket.rs", "src/proxy/error_fallback.rs", "src/cache/mod.rs", "src/cache/model.rs", "src/cache/lifecycle.rs", "src/cache/cold.rs", "src/cache/dashboard.rs", "src/cache/tickets.rs", "src/cache/lookup.rs", "src/cache/policy.rs", "src/cache/fill.rs", "src/cache/tests.rs", "src/settings.rs", "src/compression.rs", "src/diagnostics.rs", "src/traffic.rs", "src/system_stats/mod.rs", "src/system_stats/linux.rs", "src/vhost.rs", "src/vhost/error_fallback.rs", "src/web_server/mod.rs", "src/web_server/config.rs", "src/web_server/filesystem.rs", "src/web_server/security.rs", "src/web_server/response.rs", "src/web_server/request.rs", "src/web_server/routing.rs", "src/web_server/fastcgi.rs", "src/web_server/htaccess.rs", "src/web_server/serve.rs", "src/web_server/tests.rs", "src/balance.rs", "src/security.rs", "src/admin/web/vhosts/core.js", "src/admin/web/vhosts/rates.js", "src/admin/web/vhosts/health.js", "src/admin/web/vhosts/editor.js", "src/admin/web/vhosts/render.js", "src/admin/web/web-server.js", "src/admin/web/streams.js", "src/admin/web/host404.js", "src/admin/web/app/core.js", "src/admin/web/app/session-resume.js", "src/admin/web/app/preferences.js", "src/admin/web/app/config-history.js", "src/admin/web/app/runtime.js", "src/admin/web/app/settings.js", "src/admin/web/management.js", "src/admin/web/drafts.js", "src/pages.rs", "tools/dev/mock_server.py", "tools/dev/mock_auth.py", "src/forwarding.rs", "src/tinyauth.rs", "src/http3.rs", "src/stream.rs", "src/admin/web/integrations.js", "src/admin/web/traffic-panel.js", "src/prometheus.rs", "src/admin/web/settings.js", "src/admin/web/docker.js", "src/docker.rs", "docker-agent/main.go", "docker-agent/model.go", "docker-agent/docker.go", "docker-agent/network.go", "docker-agent/certificate.go", "docker-agent/server.go", "docker-agent/main_test.go", "docker-agent/rustproxy-docker-agent.service", "docker-agent/install.sh", "docs/DOCKER_DISCOVERY.md", "docs/WEB_SERVER.md", "docs/PHP_FPM.md", "docs/README.md", "docs/TODO.md", "docs/V0.25.5_AUDIT.md", "docs/V0.25.4_AUDIT.md", "docs/V0.25.3_AUDIT.md", "docs/V0.25.2_AUDIT.md", "docs/CHANGELOG_TECHNICAL_ARCHIVE.md", "docs/ROADMAP_HISTORY.md", "tools/checks/docs_check.py", "tools/checks/web_server_contracts.py", "tools/checks/rust_source.py", "tools/checks/rust_module_contracts.py", "tools/checks/source_module_contracts.py", "scripts/runtime/acme_provider.py", "src/basic_auth.rs", "scripts/deploy/deploy.py", "scripts/deploy/deploy_core.py", "scripts/deploy/deploy_runtime.py", "scripts/migration/migrate_npm.py", "scripts/migration/migrate_npm_core.py", "scripts/migration/migrate_npm_api.py", "docs/NPM_MIGRATION.md", "docs/STREAMS.md", "install.sh", "install-debian13.sh", "update.sh", "build.rs", "scripts/build/swagger_assets.py", "src/admin/documentation.rs", "src/admin/openapi.json", "langs/en_US.json", "langs/pl_pl.json", "Dockerfile", ".dockerignore", "docs/CONTAINER.md", "docs/PROMETHEUS.md", "docs/NOT_FOUND_HOSTS.md", "grafana/rustproxy-overview.json"]:
         if not (root / path).is_file():
-            raise ValueError(f"Incomplete RustProxy 0.31.6 source tree: missing {path}")
+            raise ValueError(f"Incomplete RustProxy 0.31.7 source tree: missing {path}")
     text = (root / "src/lib.rs").read_text(encoding="utf-8")
     if '#[path = "auth/mod.rs"]' not in text:
-        raise ValueError("src/lib.rs is not the 0.31.6 entry point; extract the complete package, not individual files.")
+        raise ValueError("src/lib.rs is not the 0.31.7 entry point; extract the complete package, not individual files.")
     return messages
 
 

tools/checks/release_0317.py

@@ -0,0 +1,101 @@
+#!/usr/bin/env python3
+"""0.31.7 offline update-retention regression without systemd or root privileges."""
+from __future__ import annotations
+
+import os
+from pathlib import Path
+import subprocess
+import tempfile
+import time
+
+ROOT = Path(__file__).resolve().parents[2]
+UPDATER = ROOT / "update.sh"
+
+
+def mkdir_age(path: Path, days: int) -> None:
+    path.mkdir(parents=True)
+    stamp = time.time() - days * 86400
+    os.utime(path, (stamp, stamp))
+
+
+def call(update_prefix: Path, cargo_target: Path, mockbin: Path, *, fail: bool = False, plan: bool = False) -> subprocess.CompletedProcess[str]:
+    env = os.environ.copy()
+    env["PATH"] = f"{mockbin}:{env.get('PATH', '')}"
+    env["CARGO_TARGET_DIR"] = str(cargo_target)
+    env["RP_TEST_UPDATE_FAIL"] = "1" if fail else "0"
+    args = ["bash", str(UPDATER), "--prefix", str(update_prefix)]
+    if plan:
+        args.append("--plan")
+    return subprocess.run(args, env=env, capture_output=True, text=True, timeout=15, check=False)
+
+
+def main() -> None:
+    subprocess.run(["bash", "-n", str(UPDATER)], check=True)
+    with tempfile.TemporaryDirectory(prefix="rp-release-0317-") as tmp:
+        root = Path(tmp)
+        prefix = root / "installed rustproxy"
+        releases = prefix / "releases"
+        backups = prefix / "backups"
+        releases.mkdir(parents=True)
+        backups.mkdir()
+        for name, age in [("r-new", 0), ("r-second", 2), ("r-live", 8), ("r-ancient", 30), ("r-older extra", 40)]:
+            mkdir_age(releases / name, age)
+        (prefix / "current").symlink_to(releases / "r-live", target_is_directory=True)
+        for days in range(1, 6):
+            mkdir_age(backups / f"before-{days}", days)
+        target = root / "target"
+        for profile in ["release", "debug"]:
+            (target / profile / "deps").mkdir(parents=True)
+            (target / profile / ".fingerprint").mkdir()
+            (target / profile / "build").mkdir()
+            (target / profile / "rust-proxy").write_text("compiled binary")
+            mkdir_age(target / profile / "incremental" / "old", 50)
+            mkdir_age(target / profile / "incremental" / "new", 1)
+        mockbin = root / "bin"
+        mockbin.mkdir()
+        stub = mockbin / "python3"
+        stub.write_text("#!/bin/sh\n[ \"${RP_TEST_UPDATE_FAIL:-0}\" != 1 ] || exit 17\nexit 0\n")
+        stub.chmod(0o755)
+
+        result = call(prefix, target, mockbin, fail=True)
+        assert result.returncode == 17, result.stderr
+        assert (releases / "r-older extra").exists(), "failed update cleaned releases"
+        assert (target / "release" / "incremental" / "old").exists(), "failed update cleaned target"
+
+        result = call(prefix, target, mockbin, plan=True)
+        assert result.returncode == 0, result.stderr
+        assert (releases / "r-older extra").exists(), "planned update cleaned releases"
+
+        result = call(prefix, target, mockbin)
+        assert result.returncode == 0, (result.stdout, result.stderr)
+        assert sorted(path.name for path in releases.iterdir()) == ["r-live", "r-new"], result.stdout
+        assert sorted(path.name for path in backups.iterdir()) == ["before-1", "before-2", "before-3"], result.stdout
+        assert (prefix / "current").resolve() == releases / "r-live", "current symlink changed"
+        for profile in ["debug", "release"]:
+            assert not (target / profile / "incremental" / "old").exists(), "old incremental retained"
+            assert (target / profile / "incremental" / "new").exists(), "recent incremental removed"
+            for artifact in ["deps", ".fingerprint", "build", "rust-proxy", ".cargo-lock"]:
+                assert (target / profile / artifact).exists(), f"removed Cargo artifact: {profile}/{artifact}"
+
+        # Safety: do not touch target if a parent directory is a symlink.
+        target_symlink_root = root / "symlink"
+        target_symlink_root.symlink_to(target, target_is_directory=True)
+        mkdir_age(target / "release" / "incremental" / "symlink-test", 50)
+        result = call(prefix, target_symlink_root, mockbin)
+        assert result.returncode == 0, result.stderr
+        assert (target / "release" / "incremental" / "symlink-test").exists(), "followed symlinked target"
+
+    # Static source contracts for the managed-update cache handoff.
+    deploy = (ROOT / "scripts/deploy/deploy_runtime.py").read_text()
+    runtime = (ROOT / "src/main/admin_runtime.rs").read_text()
+    demote = (ROOT / "src/cache/cold/demotion.rs").read_text()
+    assert "stop_for_managed_update(data)" in deploy
+    assert "run(['systemctl', 'stop', SERVICE])" in deploy
+    assert "data_dir.join(\".managed-update\").is_file()" in runtime
+    assert "state.cache.flush_hot_to_cold_for_update()" in runtime
+    assert "self.flush_hot_to_cold_inner(true).await" in demote
+    print("PASS: 0.31.7 failed/plan/successful update, two releases + three backups, Cargo safety/symlink guards, managed-update flush wiring.")
+
+
+if __name__ == "__main__":
+    main()

tools/checks/release_0317_ui_test.mjs

@@ -0,0 +1,74 @@
+#!/usr/bin/env node
+// 0.31.7 DOM/source + executable revision-diff tests (no Rust runtime).
+import assert from 'node:assert/strict';
+import fs from 'node:fs';
+import vm from 'node:vm';
+const read = path => fs.readFileSync(path, 'utf8');
+const html = read('src/admin/web/index.html');
+const css = read('src/admin/web/style.css');
+const settings = read('src/admin/web/settings.js');
+const hist = read('src/admin/web/app/config-history.js');
+const management = read('src/admin/web/management.js');
+const listener = read('src/admin/web/integrations.js');
+const router = read('src/admin/router.rs');
+const core = read('src/admin/web/vhosts/core.js');
+const editor = read('src/admin/web/vhosts/editor.js');
+const rates = read('src/admin/web/vhosts/rates.js');
+const model = read('src/rate_limit.rs');
+const api = JSON.parse(read('src/admin/openapi.json'));
+
+assert.match(html, /data-settings-tab="policies"/);
+for (const name of ['user-agent', 'headers', 'response']) {
+  assert.match(html, new RegExp(`data-policy-settings-tab="${name}"`));
+  assert.match(html, new RegExp(`data-policy-settings-page="${name}"`));
+}
+for (const form of ['global-ua-block-form', 'headers-form', 'response-form']) {
+  assert.equal(html.split(`id="${form}"`).length, 2, `${form} must be unique`);
+}
+assert.match(settings, /selectPolicyTab\("user-agent"\)/);
+assert.match(html, /id="config-history-json-dialog"/);
+assert.match(html, /id="config-history-compare-open"/);
+const actionStart = html.indexOf('<div class="config-history-detail-actions">');
+const actionEnd = html.indexOf('</div>', actionStart);
+const restorePos = html.indexOf('id="config-history-restore"', actionStart);
+const comparePos = html.indexOf('id="config-history-compare-open"', actionStart);
+assert.ok(actionStart > -1 && restorePos > actionStart && comparePos > restorePos && comparePos < actionEnd,
+  'JSON compare button must appear directly under restore inside the same action group');
+assert.equal(html.split('id="config-history-compare-open"').length, 2);
+assert.match(html, /id="config-json-compare-title"[\s\S]*?<div class="window-tools">[\s\S]*?id="config-history-json-close"/);
+assert.match(css, /dialog\.config-history-dialog,\s*dialog\.config-history-json-dialog\s*\{/);
+assert.match(css, /\.config-history-dialog\[open\]\s*\{[^}]*grid-template-rows:\s*auto minmax\(0, 1fr\)/);
+assert.match(css, /\.config-history-diff\s*\{[^}]*overflow-y:\s*auto/);
+assert.match(css, /\.config-history-layout\s*\{[^}]*overflow:\s*hidden/);
+assert.match(css, /@media \(max-width:\s*860px\)\s*\{[\s\S]*?\.config-history-layout\s*\{[^}]*overflow-y:\s*auto/);
+assert.match(css, /\.config-history-json-columns pre\s*\{[^}]*border:\s*0/);
+assert.match(hist, /"config-history-json-before"\)\.textContent/);
+assert.match(hist, /"config-history-json-after"\)\.textContent/);
+assert.match(css, /\.listener-protocol-settings-actions\s*\{[^}]*gap:\s*14px/);
+assert.match(listener, /listener-protocol-settings-actions/);
+assert.match(management, /el\("details", undefined, "acl-profile-attached"\)/);
+assert.doesNotMatch(management, /attached\.open\s*=\s*true/);
+assert.match(router, /include_str!\("web\/vhosts\/rates\.js"\)/);
+assert.match(editor, /user_agent_limits: uaRatesReader\(\)/);
+assert.match(editor, /userAgentRateEditor\(g, rate\.user_agent_limits \|\| \[\]\)/);
+assert.match(core, /uaRatesReader/);
+assert.match(rates, /function userAgentRateEditor/);
+assert.match(model, /pub user_agent_limits: Vec<UserAgentLimit>/);
+assert.ok(api.components.schemas.VhostRateLimit.properties.user_agent_limits);
+
+const start = hist.indexOf('function configDiff('), end = hist.indexOf('function renderConfigRevisionDetail(', start);
+assert.ok(start > 0 && end > start, 'executable diff function must exist');
+const context = { before: null, after: null };
+vm.createContext(context);
+vm.runInContext(`${hist.slice(start, end)}\nglobalThis.diffResult = () => configDiff(before, after);`, context);
+const diff = (before, after) => { context.before=before; context.after=after; return JSON.parse(JSON.stringify(context.diffResult())); };
+let result = diff({port:80, x:{a:true, b:2}, vhosts:[{id:'v1', host:'a'},{id:'v2', host:'b'}]},
+                  {port:443, x:{a:true, b:3}, vhosts:[{id:'v2', host:'b'},{id:'v1', host:'a'}]});
+assert.deepEqual(result.map(x => x.path), ['$["port"]','$["x"]["b"]']);
+result = diff({a:1, headers:[]}, {a:1, headers:[{id:'one',value:'ok'}], policy:true});
+assert.deepEqual(result.map(x => x.path), ['$["headers"]["one"]["id"]','$["headers"]["one"]["value"]','$["policy"]']);
+result = diff({items: [{id:'one', active: true}]}, {items: [{id:'one',active:false}]});
+assert.equal(result.length,1);
+assert.equal(result[0].path,'$["items"]["one"]["active"]');
+assert.ok(diff({}, Object.fromEntries(Array.from({length:350},(_,i) => [i, i]))).length <= 200);
+console.log('PASS: 0.31.7 Settings sections, vhost UA rate editor/API, ACL/listener layout, changed-field revision diff, bounded scrolling, conventional full JSON modal.');

tools/checks/release_smoke.py

@@ -135,7 +135,7 @@ def upgrade_smoke(tmp: Path) -> None:
     assert backup.is_dir()
     assert (backup / "src/obsolete.rs").is_file()
     assert not (target / "src/obsolete.rs").exists()
-    assert 'version = "0.31.6"' in (target / "Cargo.toml").read_text(encoding="utf-8")
+    assert 'version = "0.31.7"' in (target / "Cargo.toml").read_text(encoding="utf-8")
     assert (target / "data/keep.txt").read_text(encoding="utf-8") == "preserve\n"
     assert (target / ".env").read_text(encoding="utf-8") == "RUST_PROXY_DEMO=0\n"
     assert (target / "langs/site.json").is_file()
@@ -146,7 +146,7 @@ def upgrade_smoke(tmp: Path) -> None:
     assert (target / "docker-agent/certificate.go").is_file()
     assert (target / "docker-agent/server.go").is_file()
     manifest = json.loads((backup / "upgrade.json").read_text(encoding="utf-8"))
-    assert manifest["to_version"] == "0.31.6"
+    assert manifest["to_version"] == "0.31.7"
     assert manifest["removed_obsolete_runtime_state"] is True
     assert not legacy.exists()
     assert not (backup / "legacy-data").exists()
@@ -617,7 +617,7 @@ def source_contract_smoke() -> None:
         assert marker in admin, marker
     anonymous_block = admin.split("fn anonymous_allowed", 1)[1].split("const CERTIFICATE_API_KEY_HEADER", 1)[0]
     assert '"/api/status"' not in anonymous_block
-    assert '"RuntimeInformation"' in openapi_0241 and '"version": "0.31.6"' in openapi_0241
+    assert '"RuntimeInformation"' in openapi_0241 and '"version": "0.31.7"' in openapi_0241
     assert 'id="panel-logging"' not in html
     for marker in ['id="settings-tab-logging"', 'id="settings-page-logging"', 'id="logging-form"', 'id="error-log-form"']:
         assert marker in html, marker
@@ -1108,7 +1108,7 @@ def source_contract_smoke() -> None:
     assert '.managed-update' in main and "flush_hot_to_cold_for_update" in main
     openapi = (ROOT / "src/admin/openapi.json").read_text(encoding="utf-8")
     assert '"/api/config/history/restore"' in openapi
-    for marker in ['"version": "0.31.6"', '"memory_preset"', '"cold_preset"', '"memory_budget_bytes"', '"max_inflight"', '"preset"', '"session_days"', '"session_lifetime_seconds"', '"accept_local_listener_risk"', '"backend_header"', '"backend_timing_header"', '"cold_on_age"', '"match_type"', '"regex_insensitive"', '"NotFoundHost"', '"not_found_hosts"', '"PrometheusSettings"', '"allow_trusted_network_without_token"', '"include_docker_vhosts"', '"include_streams"', '"include_logging"']:
+    for marker in ['"version": "0.31.7"', '"memory_preset"', '"cold_preset"', '"memory_budget_bytes"', '"max_inflight"', '"preset"', '"session_days"', '"session_lifetime_seconds"', '"accept_local_listener_risk"', '"backend_header"', '"backend_timing_header"', '"cold_on_age"', '"match_type"', '"regex_insensitive"', '"NotFoundHost"', '"not_found_hosts"', '"PrometheusSettings"', '"allow_trusted_network_without_token"', '"include_docker_vhosts"', '"include_streams"', '"include_logging"']:
         assert marker in openapi, marker
     assert '"software_update"' in openapi and '"update_available"' in openapi
     for marker in ['"/api/certificates/deploy"', '"CertificateDeploy"', '"CertificateDeployResult"', '"/api/certificates/reload"']:
@@ -1313,7 +1313,7 @@ def main() -> None:
     source_contract_smoke()
     container_contract_smoke()
     grafana_contract_smoke()
-    print("PASS: 0.31.6 SQLite/schema-9/upgrade, local-response 404 hosts, Prometheus/Grafana diagnostics, external Debian-packaging separation, cache/dashboard/logging/Nagios, retained admin/H3/stream/TLS contracts and reproducible source archives.")
+    print("PASS: 0.31.7 SQLite/schema-9/upgrade, local-response 404 hosts, Prometheus/Grafana diagnostics, external Debian-packaging separation, cache/dashboard/logging/Nagios, retained admin/H3/stream/TLS contracts and reproducible source archives.")
 
 
 if __name__ == "__main__":

tools/checks/security_logs_0315_ui_test.mjs

@@ -21,7 +21,7 @@ const openapi = json('src/admin/openapi.json');
 const en = json('langs/en_US.json').translations;
 const pl = json('langs/pl_pl.json').translations;
 
-assert.match(manifest, /version = "0\.31\.6"/);
+assert.match(manifest, /version = "0\.31\.7"/);
 assert.match(lib, /pub mod user_agent;/);
 assert.match(model, /user_agent_blocking: crate::user_agent::Policy/);
 assert.match(vhost, /user_agent_blocking: crate::user_agent::Policy/);
@@ -52,7 +52,7 @@ assert.match(fileLogs, /localStorage\.setItem\(CONSOLIDATION_STORAGE_KEY/);
 assert.match(fileLogs, /aggregate_min_count/);
 assert.match(fileLogs, /file-log-aggregate-copy/);
 
-assert.equal(openapi.info.version, '0.31.6');
+assert.equal(openapi.info.version, '0.31.7');
 assert.ok(openapi.components.schemas.Config.properties.user_agent_blocking);
 assert.ok(openapi.components.schemas.Vhost.properties.user_agent_blocking);
 assert.ok(openapi.components.schemas.FileLogSource.properties.group_id);
@@ -68,4 +68,4 @@ for (const pack of [en, pl]) {
   }
 }
 
-console.log('PASS: 0.31.6 UA blocking, copy controls, repeated-value parser, vhost log consolidation, OpenAPI and locales.');
+console.log('PASS: 0.31.7 UA blocking, copy controls, repeated-value parser, vhost log consolidation, OpenAPI and locales.');

tools/checks/source_module_contracts.py

@@ -36,7 +36,7 @@ for old in (ROOT / "src/admin/web/app.js", ROOT / "src/admin/web/vhosts.js"):
     assert not old.exists(), f"oversized browser monolith returned: {old.relative_to(ROOT)}"
 for required in (
     "src/admin/web/app/core.js", "src/admin/web/app/session-resume.js", "src/admin/web/app/preferences.js", "src/admin/web/app/config-history.js", "src/admin/web/app/runtime.js", "src/admin/web/app/settings.js",
-    "src/admin/web/vhosts/core.js", "src/admin/web/vhosts/health.js", "src/admin/web/vhosts/editor.js", "src/admin/web/vhosts/render.js",
+    "src/admin/web/vhosts/core.js", "src/admin/web/vhosts/rates.js", "src/admin/web/vhosts/health.js", "src/admin/web/vhosts/editor.js", "src/admin/web/vhosts/render.js",
     "docker-agent/model.go", "docker-agent/docker.go", "docker-agent/network.go",
     "docker-agent/certificate.go", "docker-agent/server.go",
     "scripts/deploy/deploy_core.py", "scripts/deploy/deploy_runtime.py",

tools/checks/system_info_0301_ui_test.mjs

@@ -43,7 +43,7 @@ const code = js.slice(js.indexOf('    const runtime = latestStatus?.runtime || {
 const elements = new Map();
 const dollar = id => { if (!elements.has(id)) elements.set(id, { textContent: '' }); return elements.get(id); };
 const status = {
-  version: '0.31.6', uptime_seconds: 4201,
+  version: '0.31.7', uptime_seconds: 4201,
   runtime: {
     platform: 'Linux', operating_system: 'Debian GNU/Linux 13', kernel_version: '6.12.0', architecture: 'x86_64',
     statistics_source: 'systemstat+sysinfo', data_directory: '/var/lib/rustproxy', database_path: '/var/lib/rustproxy/config.sqlite3',
@@ -63,7 +63,7 @@ const context = {
 vm.runInNewContext(code, context);
 assert.equal(dollar('runtime-operating-system').textContent, 'Debian GNU/Linux 13');
 assert.equal(dollar('runtime-kernel-version').textContent, '6.12.0');
-assert.equal(dollar('runtime-version').textContent, '0.31.6');
+assert.equal(dollar('runtime-version').textContent, '0.31.7');
 assert.equal(dollar('runtime-logical-cpus').textContent, '8');
 assert.equal(dollar('runtime-cpu-usage').textContent, '17.2%');
 assert.equal(dollar('runtime-python').textContent, 'Available · 3.13.5');
@@ -124,4 +124,4 @@ for (const key of ['python_version','pip_version','certbot_version']) {
   assert.ok(runtimeSchema.properties.certificate_runtime.properties[key]);
   assert.equal(runtimeSchema.properties.certificate_runtime.properties[key].nullable, true);
 }
-console.log('PASS: 0.31.6 legend palette, About cleanup, system tab/navigation, read-only API schema and simulated status rendering.');
+console.log('PASS: 0.31.7 legend palette, About cleanup, system tab/navigation, read-only API schema and simulated status rendering.');

tools/checks/web_assets.py

@@ -7,7 +7,7 @@ PANEL_PARTS = (
     "redirects.js", "host404.js", "traffic-panel.js", "cache-panel.js",
     "transform-panel.js", "acme.js", "settings.js", "file-logs.js",
 )
-VHOST_PARTS = ("core.js", "health.js", "editor.js", "render.js")
+VHOST_PARTS = ("core.js", "health.js", "rates.js", "editor.js", "render.js")
 
 def _read(root: Path, folder: str, parts: tuple[str, ...]) -> str:
     return "\n".join((root / "src/admin/web" / folder / part).read_text(encoding="utf-8") for part in parts)