v0.31.3

tools/checks/check_source.py

@@ -24,7 +24,7 @@ def read_docker_agent_source() -> str:
 
 preflight(root)
 manifest = tomllib.loads((root / "Cargo.toml").read_text())
-assert manifest["package"]["version"] == "0.31.2"
+assert manifest["package"]["version"] == "0.31.3"
 assert manifest["dependencies"]["quinn"]["version"] == "0.11.12"
 h3dep = manifest["dependencies"]["h3"]
 assert h3dep["package"] == "hpx-h3" and h3dep["version"] == "=2.5.20" and "quinn" in h3dep["features"]
@@ -32,14 +32,14 @@ assert "h3-quinn" not in manifest["dependencies"]
 lock_path = root / "Cargo.lock"
 if lock_path.exists():
     lock = lock_path.read_text()
-    assert 'name = "rust-proxy"\nversion = "0.31.2"' in lock
+    assert 'name = "rust-proxy"\nversion = "0.31.3"' in lock
     assert 'name = "systemstat"' in lock and 'name = "metrics-process"' in lock and 'name = "sysinfo"' in lock, "Cargo.lock must be resolver-generated after adding cross-platform statistics libraries"
 for release_doc, marker in {
-    "README.md": "# RustProxy 0.31.2",
-    "CHANGELOG.md": "## 0.31.2",
-    "ROADMAP.md": "## 0.31.2",
-    "AGENTS.md": "Current source version: 0.31.2.",
-    "docs/TEST_REPORT.md": "# Verification report - RustProxy 0.31.2",
+    "README.md": "# RustProxy 0.31.3",
+    "CHANGELOG.md": "## 0.31.3",
+    "ROADMAP.md": "## 0.31.3",
+    "AGENTS.md": "Current source version: 0.31.3.",
+    "docs/TEST_REPORT.md": "# Verification report - RustProxy 0.31.3",
 }.items():
     assert marker in (root / release_doc).read_text(), f"stale release identity in {release_doc}"
 assert tomllib.loads((root / "rust-toolchain.toml").read_text())["toolchain"]["channel"] == "stable"
@@ -285,7 +285,7 @@ assert 'Opt-in health decisions based on ordinary user traffic. Defaults to disa
 assert '"force_ssl"' in openapi and '"forward_client_ip"' in openapi
 assert '"backend_header"' in openapi and '"backend_timing_header"' in openapi
 assert '"StreamMetrics"' in openapi and '"streams"' in openapi
-for marker in ['"version": "0.31.2"', '"/api/traffic"', '"capture_user_agent"', '"capture_country"', '"hot_auto_trim_enabled"', '"hot_auto_trim_after_seconds"', '"hot_auto_trim_target_percent"', '"/api/config/{section}"', '"ConfigSectionUpdate"', '"cold_on_idle"', '"cold_on_age"', '"cold_max_hot_seconds"', '"cold_on_lru"', '"cold_on_shutdown"', '"cold_gc_interval_seconds"', '"cold_gc_max_delete"', '"collapse_enabled"', '"collapse_wait_timeout_ms"', '"collapse_timeout_fallback"', '"stale_if_error_timeout"', '"stale_if_error_connection"', '"stale_if_error_dns"', '"stale_if_error_tls"', '"stale_if_error_statuses"', '"proactive_refresh_enabled"', '"proactive_refresh_before_expiry_seconds"', '"proactive_refresh_percent"', '"proactive_refresh_max_inflight"', '"TransformSettings"', '"TransformOverrides"', '"/api/cache/cold/cleanup"', '"/api/cache/invalidate"', '"/api/cache/bans"', '"/api/cache/bans/{id}"', '"CacheInvalidationRequest"', '"CacheInvalidationResponse"', '"ColdCleanupJob"', '"match_type"', '"regex_insensitive"', '"rewrite"', '"response"', '"covered_hosts"', '"default": true']:
+for marker in ['"version": "0.31.3"', '"/api/traffic"', '"capture_user_agent"', '"capture_country"', '"hot_auto_trim_enabled"', '"hot_auto_trim_after_seconds"', '"hot_auto_trim_target_percent"', '"/api/config/{section}"', '"ConfigSectionUpdate"', '"cold_on_idle"', '"cold_on_age"', '"cold_max_hot_seconds"', '"cold_on_lru"', '"cold_on_shutdown"', '"cold_gc_interval_seconds"', '"cold_gc_max_delete"', '"collapse_enabled"', '"collapse_wait_timeout_ms"', '"collapse_timeout_fallback"', '"stale_if_error_timeout"', '"stale_if_error_connection"', '"stale_if_error_dns"', '"stale_if_error_tls"', '"stale_if_error_statuses"', '"proactive_refresh_enabled"', '"proactive_refresh_before_expiry_seconds"', '"proactive_refresh_percent"', '"proactive_refresh_max_inflight"', '"TransformSettings"', '"TransformOverrides"', '"/api/cache/cold/cleanup"', '"/api/cache/invalidate"', '"/api/cache/bans"', '"/api/cache/bans/{id}"', '"CacheInvalidationRequest"', '"CacheInvalidationResponse"', '"ColdCleanupJob"', '"match_type"', '"regex_insensitive"', '"rewrite"', '"response"', '"covered_hosts"', '"default": true']:
     assert marker in openapi, marker
 for marker in ['"NotFoundHost"', '"not_found_hosts"', '"PrometheusSettings"', '"allow_trusted_network_without_token"', '"include_docker_vhosts"', '"include_streams"', '"include_logging"']:
     assert marker in openapi, marker
@@ -542,7 +542,7 @@ for marker in ['"/api/config/{section}"', 'async fn update_section', 'section_up
 for route in ['/overview', '/vhosts', '/redirects', '/404-hosts', '/streams', '/acl-profiles', '/configuration', '/tls', '/cache', '/transform', '/logging', '/settings']:
     assert f'.route("{route}", get(public::index))' in admin, route
 app_js = read_app_js(root)
-for marker in ['const PANEL_PATHS', 'history.pushState', 'window.addEventListener("popstate"', 'async function saveSection', 'async function revalidateSession', 'Object.values(PANEL_PATHS), "/configuration"', 'certificateCovers', 'covered_hosts', 'refreshCertificateInventory', 'certificateDetails', 'certificate-domain-pills', 'certificateIssuerName', 'certificateDaysRemaining', 'certificateRenewalStatus', 'recoverInvalidOrigin', 'auth.invalid_origin', 'ORIGIN_RECOVERY_KEY']:
+for marker in ['const PANEL_PATHS', 'history.pushState', 'window.addEventListener("popstate"', 'async function saveSection', 'function revalidateSession', 'Object.values(PANEL_PATHS), "/configuration"', 'certificateCovers', 'covered_hosts', 'refreshCertificateInventory', 'certificateDetails', 'certificate-domain-pills', 'certificateIssuerName', 'certificateDaysRemaining', 'certificateRenewalStatus', 'recoverInvalidOrigin', 'auth.invalid_origin', 'ORIGIN_RECOVERY_KEY']:
     assert marker in app_js, marker
 for marker in ['.certificate-details', '.certificate-domain-pills', '.certificate-card .pill', '.certificate-operation-card', '.renewal-meta', '#panel-tls .certificate-tabs']:
     assert marker in css, marker
@@ -862,12 +862,10 @@ for marker in [
 for forbidden in ["pub struct AllowCookie", "private_or_no_transform"]:
     assert forbidden not in compression_source, forbidden
 compression_finalize_source = rust_source(root, "src/proxy/upstream_helpers.rs")
-for marker in [
-    "let global_compression = &snapshot.envelope.config.compression",
-    "frontend.compression.resolve(global_compression, &compression)",
-    "service.compression.resolve(global_compression, &compression)",
-]:
-    assert marker in compression_finalize_source, marker
+assert "let global_compression = &snapshot.envelope.config.compression" in compression_finalize_source
+for selector in ("frontend", "service"):
+    # rustfmt splits member chains across lines; check the expression, not its layout.
+    assert re.search(rf"\b{selector}\s*\.\s*compression\s*\.\s*resolve\(global_compression, &compression\)", compression_finalize_source), selector
 assert "AllowCookie" not in compression_finalize_source
 openapi_0270 = json.loads((root / "src/admin/openapi.json").read_text())
 compression_override_properties = openapi_0270["components"]["schemas"]["CompressionOverrides"]["properties"]
@@ -1396,7 +1394,7 @@ assert '"error_log" => {' not in admin_0241 and 'request("/api/config/error_log"
 assert '"error_log"' in openapi and 'logging, error_log, forwarding' not in openapi
 assert 'logging_section_persists_error_log_settings_atomically' in admin_0241 and 'error_log_is_not_a_standalone_configuration_section' in admin_0241
 assert 'location.pathname === "/logging"' in settings_js_0241
-assert '"RuntimeInformation"' in openapi and '"version": "0.31.2"' in openapi
+assert '"RuntimeInformation"' in openapi and '"version": "0.31.3"' in openapi
 
 # 0.24.1 compiler and hostname-cardinality regressions.
 tls_0241 = rust_source(root, "src/tls.rs")
@@ -1635,5 +1633,5 @@ for marker_0282 in [
 assert 'Zewnętrzne ścieżki plików' in (root / 'langs/pl_pl.json').read_text()
 assert 'setfacl -m u:rustproxy:--x /etc/ssl/' in (root / 'docs/V0.28.2_IMPLEMENTATION.md').read_text()
 
-print("PASS: 0.31.2 manifest/package, shared system-statistics/runtime metadata, Settings logging, retained H2, external-packaging/Grafana/Prometheus/404-host/custom-location/path/cache/dashboard/Nagios UI/source contracts, stopped legacy-renewal removal, session/admin/transport contracts, deterministic package source and embedded SQLite schema-v9 migrations.")
+print("PASS: 0.31.3 manifest/package, shared system-statistics/runtime metadata, Settings logging, retained H2, external-packaging/Grafana/Prometheus/404-host/custom-location/path/cache/dashboard/Nagios UI/source contracts, stopped legacy-renewal removal, session/admin/transport contracts, deterministic package source and embedded SQLite schema-v9 migrations.")
 print("NOT VERIFIED: Rust parsing, types, compilation, linking or runtime behavior. Run ./dev.sh test.")

tools/checks/dashboard_startup_0310_ui_test.mjs

@@ -12,13 +12,14 @@ const html = read('src/admin/web/index.html');
 const css = read('src/admin/web/style.css');
 const core = read('src/admin/web/app/core.js');
 const runtime = read('src/admin/web/app/runtime.js');
+const resume = read('src/admin/web/app/session-resume.js');
 
 assert.match(html, /<html class="app-loading"/);
 assert.match(html, /id="app-startup"[^>]*role="status"/);
 assert.match(html, /id="app-startup-title"/);
 assert.match(html, /class="app-startup-spinner"/);
 assert.match(html, /class="app-startup-recovery"/);
-assert.match(html, /class="outline" href="" data-i18n="startupRetry"/);
+assert.match(html, /class="outline" id="app-startup-reload" href="" data-i18n="startupRetry"/);
 assert.match(html, /<noscript>/);
 assert.doesNotMatch(css, /html\.app-loading\s+body\s*\{\s*visibility:\s*hidden/);
 assert.match(css, /html\.app-loading \.shell/);
@@ -37,13 +38,13 @@ assert.match(css, /\.page-intro-title-row \.overview-refresh/);
 
 // Exercise the real activate() and failure handler against a small DOM fake.
 const activateSource = core.slice(core.indexOf('async function activate(info) {'), core.indexOf('async function loadAudit()'));
-const failureSource = core.slice(core.indexOf('function showStartupFailure(error)'));
+const failureSource = resume.slice(resume.indexOf('function displayStartupError(error, sessionResume = false)'));
 assert(activateSource.startsWith('async function activate(info)'));
-assert(failureSource.startsWith('function showStartupFailure(error)'));
+assert(failureSource.startsWith('function displayStartupError(error, sessionResume = false)'));
 
 const nodes = new Map();
 const node = key => {
-  if (!nodes.has(key)) nodes.set(key, { hidden: true, value: 'x', textContent: '' });
+  if (!nodes.has(key)) nodes.set(key, { hidden: true, value: 'x', textContent: '', addEventListener() {} });
   return nodes.get(key);
 };
 const classes = new Set(['app-loading']);
@@ -55,6 +56,8 @@ const context = {
   document: { documentElement: { classList: {
     add(...keys) { for (const key of keys) classes.add(key); },
     remove(...keys) { for (const key of keys) classes.delete(key); },
+    toggle(key, force) { if (force) classes.add(key); else classes.delete(key); },
+    contains(key) { return classes.has(key); },
   } } },
   pendingAuthDestination: null,
   authMessage() {},
@@ -65,7 +68,7 @@ const context = {
   loadConfig: () => { configCount++; return configPromise; },
   refresh: async () => { statusCount++; },
   toast() { throw new Error('Unexpected toast'); },
-  window: {}, languagePacks: new Map(), t: key => key,
+  window: { rustProxyRefresh: { stop() {} } }, languagePacks: new Map(), t: key => key,
 };
 runInNewContext(`${activateSource}\n${failureSource}`, context);
 const activating = context.activate({ username: 'admin', csrf_token: 'CSRF' });

tools/checks/dependency_upgrade_0312.py

@@ -1,5 +1,5 @@
 #!/usr/bin/env python3
-"""Check the 0.31.2 dependency/source migration; optionally require a resolved lock.
+"""Check the 0.31.3 dependency/source migration; optionally require a resolved lock.
 
 This is not a substitute for rustc, cargo metadata or runtime tests.
 """
@@ -14,7 +14,7 @@ parser = argparse.ArgumentParser()
 parser.add_argument('--require-lock', action='store_true', help='Require the post-upgrade Cargo.lock produced by cargo update')
 args = parser.parse_args()
 manifest = tomllib.loads((ROOT / 'Cargo.toml').read_text())
-assert manifest['package']['version'] == '0.31.2'
+assert manifest['package']['version'] == '0.31.3'
 assert manifest['package']['rust-version'] == '1.99'
 deps = manifest['dependencies']
 expected_requirements = {
@@ -78,4 +78,4 @@ if missing:
     print(f'PENDING: lockfile still requires cargo update ({details})')
 else:
     print('PASS: pinned key packages found in post-upgrade lock; cargo --locked verification is still required')
-print('PASS: 0.31.2 source dependency APIs, manifest, TLS features, toolchain images and Swagger pin (static only)')
+print('PASS: 0.31.3 source dependency APIs, manifest, TLS features, toolchain images and Swagger pin (static only)')

tools/checks/docs_check.py

@@ -1,5 +1,5 @@
 #!/usr/bin/env python3
-"""Rust-independent documentation/Reader consistency checks for the 0.31.2 release."""
+"""Rust-independent documentation/Reader consistency checks for the 0.31.3 release."""
 from pathlib import Path
 import re
 from rust_source import rust_source
@@ -65,7 +65,7 @@ assert '"/docs/content.json"' in admin
 readme = (ROOT / "README.md").read_text(encoding="utf-8")
 roadmap = (ROOT / "ROADMAP.md").read_text(encoding="utf-8")
 changelog = (ROOT / "CHANGELOG.md").read_text(encoding="utf-8")
-assert readme.startswith("# RustProxy 0.31.2")
+assert readme.startswith("# RustProxy 0.31.3")
 assert "docs/WEB_SERVER.md" in readme and "docs/README.md" in readme
 assert readme.count("## What changed in ") == 1, "README duplicates historical release notes; use CHANGELOG/archive"
 assert "## Release history" in readme and "docs/ROADMAP_HISTORY.md" in readme

tools/checks/origin_resume_0313_ui_test.mjs

@@ -0,0 +1,207 @@
+#!/usr/bin/env node
+// Real-source simulation of mobile tab restore, BFCache, Origin 403 and retry.
+// This does not replace a real Safari/Chrome session or a compiled Rust backend.
+import assert from 'node:assert/strict';
+import { readFileSync } from 'node:fs';
+import { runInNewContext } from 'node:vm';
+import { dirname, resolve } from 'node:path';
+import { fileURLToPath } from 'node:url';
+
+const root = resolve(dirname(fileURLToPath(import.meta.url)), '../..');
+const read = path => readFileSync(resolve(root, path), 'utf8');
+const core = read('src/admin/web/app/core.js');
+const refresh = read('src/admin/web/app/refresh.js');
+const resume = read('src/admin/web/app/session-resume.js');
+const runtime = read('src/admin/web/app/runtime.js');
+const html = read('src/admin/web/index.html');
+const server = read('src/admin/session.rs');
+assert.match(html, /id="app-session-retry"[^>]*data-i18n="sessionRetry"/);
+assert.match(server, /origin_mismatch/);
+assert.match(server, /cross_site_fetch/);
+assert.match(server, /administration origin rejected/);
+
+function sourceBetween(source, start, end) {
+  const a = source.indexOf(start), b = source.indexOf(end, a);
+  assert(a >= 0 && b > a, `Missing source slice: ${start}`);
+  return source.slice(a, b);
+}
+const actualApi = sourceBetween(core, 'function apiArea(path)', 'function setPanel(name');
+const actualLive = sourceBetween(core, 'function renderLiveStatus(value)', 'async function refreshCertificateInventory()');
+const actualResume = resume;
+const recovery = sourceBetween(core, 'const ORIGIN_RECOVERY_KEY', 'const PANEL_PATHS');
+const startup = sourceBetween(runtime, 'function verifyAdminModules()', 'function certificateUsesExternalFiles');
+
+function fixture() {
+  const events = new Map(), windows = new Map(), pending = [], streams = [], nodes = new Map(), timers = new Map();
+  const classes = new Set(), originMarker = new Map();
+  let timerId = 0, reloads = 0, lockCount = 0, renderSessionCalls = 0;
+  const node = id => {
+    if (!nodes.has(id)) {
+      const handlers = new Map();
+      nodes.set(id, { hidden: id !== 'workspace', disabled: false, textContent: '',
+        addEventListener(type, fn) { handlers.set(type, fn); },
+        click() { handlers.get('click')?.(); },
+      });
+    }
+    return nodes.get(id);
+  };
+  class FakeEventSource {
+    constructor(url) { this.url = url; this.closed = false; streams.push(this); }
+    addEventListener() {}
+    close() { this.closed = true; }
+  }
+  const classList = {
+    contains(k) { return classes.has(k); },
+    add(...keys) { keys.forEach(k => classes.add(k)); },
+    remove(...keys) { keys.forEach(k => classes.delete(k)); },
+    toggle(k, forced) { if (forced) classes.add(k); else classes.delete(k); },
+  };
+  const document = {
+    hidden: false, body: {}, documentElement: { classList },
+    addEventListener(name, handler) { assert(!events.has(name)); events.set(name, handler); },
+    removeEventListener(name, handler) { assert.equal(events.get(name), handler); events.delete(name); },
+  };
+  const window = {
+    rustProxySettings: { current: () => 'listeners', render() {} },
+    addEventListener(name, handler) { assert(!windows.has(name)); windows.set(name, handler); },
+    removeEventListener(name, handler) { assert.equal(windows.get(name), handler); windows.delete(name); },
+  };
+  const ctx = {
+    document, window, $: node, AbortController, EventSource: FakeEventSource,
+    MutationObserver: class { observe() {} },
+    location: { origin: 'https://panel.example', pathname: '/overview', search: '',
+      reload() { reloads++; }, replace() { throw new Error('Unexpected replace'); } },
+    sessionStorage: { getItem: key => originMarker.get(key), setItem: (key, value) => originMarker.set(key, value), removeItem: key => originMarker.delete(key) },
+    performance: { now: () => 1 },
+    fetch: (path, options) => new Promise((resolve, reject) => pending.push({ path, options, resolve, reject })),
+    setTimeout(fn, ms) { const id = ++timerId; timers.set(id, { fn, ms }); return id; },
+    clearTimeout(id) { timers.delete(id); },
+    console: { warn() {} },
+    csrf: 'old', authenticated: true, authEpoch: 1, sessionInfo: null, sessionCheckPromise: null,
+    languagePacks: new Map([['en_US', {}]]), latestStatus: null,
+    currentPanel: 'overview', liveEvents: null, liveInterval: null, liveConnected: false, liveFallback: false,
+    t: key => key === 'sessionValidationFailed' ? 'Could not verify your session' : key,
+    renderSession() { renderSessionCalls++; },
+    renderFooter() {}, renderStatus() {}, renderLogs() {}, renderDiagnostics() {},
+    toast() { throw new Error('Resume errors must not be transient toasts'); },
+    loadTunnels: async () => {},
+    lock() { lockCount++; ctx.authEpoch++; ctx.authenticated = false; ctx.window.rustProxyRefresh.stop(); },
+  };
+  runInNewContext(`${recovery}\n${actualApi}\n${actualLive}\n${actualResume}\n${refresh}`, ctx,
+    { filename: 'actual-rustproxy-admin-source.js' });
+  const tick = async () => { for (let i = 0; i < 25; i++) await Promise.resolve(); };
+  const answer = (status, value) => {
+    const request = pending.shift();
+    assert(request && request.path === '/api/auth/session', `Unexpected request: ${request?.path}`);
+    request.resolve({ ok: status >= 200 && status < 300, status, text: async () => JSON.stringify(value) });
+    return request;
+  };
+  const visibility = hidden => { document.hidden = hidden; events.get('visibilitychange')?.(); };
+  const pagehide = () => windows.get('pagehide')?.({});
+  const pageshow = persisted => windows.get('pageshow')?.({ persisted });
+  const activeStreams = () => streams.filter(stream => !stream.closed);
+  return { ctx, events, windows, pending, streams, timers, originMarker, nodes, classes, tick, answer,
+    visibility, pagehide, pageshow, activeStreams, node, get reloads() { return reloads; },
+    get lockCount() { return lockCount; }, get renderSessionCalls() { return renderSessionCalls; } };
+}
+
+const normal = fixture();
+normal.ctx.window.rustProxyRefresh.start();
+assert.equal(normal.activeStreams().length, 1, 'authenticated shell starts one SSE stream');
+normal.visibility(true);
+assert.equal(normal.activeStreams().length, 0, 'hidden document pauses SSE');
+normal.visibility(false);
+normal.pageshow(true);
+assert.equal(normal.pending.length, 1, 'pageshow and visibilitychange share one session GET');
+assert.equal(normal.activeStreams().length, 0, 'SSE cannot resume before session verification');
+assert.equal(normal.ctx.window.rustProxyRefresh.diagnostics().filter(task => task.scheduled).length, 0);
+normal.answer(403, { error: 'auth.invalid_origin' }); await normal.tick();
+assert.equal(normal.reloads, 0, '403 during resume must not reload');
+assert.equal(normal.originMarker.size, 0, 'resume must not update startup reload limit');
+assert(normal.classes.has('app-loading') && normal.classes.has('app-startup-failed'));
+assert(normal.classes.has('app-session-failed'), 'show an actionable resume failure');
+assert.equal(normal.node('workspace').hidden, true);
+assert.equal(normal.node('app-session-retry').hidden, false);
+assert.equal(normal.node('app-startup-reload').hidden, true);
+assert.equal(normal.node('app-startup-title').textContent, 'Could not verify your session');
+assert.equal(normal.activeStreams().length, 0);
+assert.equal(normal.ctx.window.rustProxyRefresh.diagnostics().filter(task => task.scheduled).length, 0);
+normal.pageshow(true);
+assert.equal(normal.pending.length, 0, 'no automatic error-loop retries on duplicate resume events');
+normal.node('app-session-retry').click();
+assert.equal(normal.pending.length, 1, 'user may explicitly retry without a reload');
+assert.equal(normal.node('app-session-retry').disabled, true);
+normal.answer(200, { username: 'admin', csrf_token: 'fresh' }); await normal.tick();
+assert.equal(normal.ctx.csrf, 'fresh');
+assert.equal(normal.node('workspace').hidden, false);
+assert.equal(normal.classes.has('app-loading'), false);
+assert.equal(normal.node('app-session-retry').hidden, true);
+assert.equal(normal.node('app-session-retry').disabled, false);
+assert.equal(normal.activeStreams().length, 1, 'SSE resumes only after verified session');
+assert.equal(normal.reloads, 0);
+
+// A real 401 follows the existing lock/redirect flow, never displaying stale data.
+normal.visibility(true);
+normal.visibility(false);
+assert.equal(normal.pending.length, 1);
+normal.answer(401, { error: 'auth.required' }); await normal.tick();
+assert.equal(normal.lockCount, 1);
+assert.equal(normal.activeStreams().length, 0);
+assert.equal(normal.classes.has('app-session-failed'), false);
+
+const restored = fixture();
+restored.ctx.window.rustProxyRefresh.start();
+restored.pagehide();
+assert.equal(restored.activeStreams().length, 0);
+restored.pageshow(true);
+restored.visibility(false);
+assert.equal(restored.pending.length, 1, 'BFCache pagehide/pageshow + visibility triggers one session check');
+restored.answer(200, { username: 'admin', csrf_token: 'bfcache' }); await restored.tick();
+assert.equal(restored.activeStreams().length, 1);
+// Ten tab cycles must not add listeners or duplicate SSE sessions.
+for (let i = 0; i < 10; i++) {
+  restored.visibility(true); restored.visibility(false); restored.pageshow(true);
+  assert.equal(restored.pending.length, 1);
+  assert.equal(restored.activeStreams().length, 0);
+  restored.answer(200, { username: 'admin', csrf_token: `cycle-${i}` }); await restored.tick();
+  assert.equal(restored.activeStreams().length, 1);
+  assert.equal(restored.windows.size, 2);
+  assert.equal(restored.events.size, 1);
+}
+// A response from a prior auth epoch may not restore the dashboard.
+restored.visibility(true); restored.visibility(false);
+assert.equal(restored.pending.length, 1);
+restored.ctx.authEpoch++;
+restored.ctx.authenticated = false;
+restored.ctx.window.rustProxyRefresh.stop();
+restored.answer(200, { username: 'stale', csrf_token: 'stale' }); await restored.tick();
+assert.equal(restored.activeStreams().length, 0);
+assert.equal(restored.ctx.csrf, 'cycle-9');
+assert.equal(restored.windows.size, 0);
+assert.equal(restored.events.size, 0);
+
+// Startup reload-marker is released only after the complete panel activation,
+// never merely when /api/auth/session happened to return successfully.
+async function checkStartup(activationResult, failLanguage) {
+  let bootstrap, clears = 0, failures = 0;
+  const modules = Object.fromEntries([
+    ['rustProxyIntegrations', 'bindings'], ['rustProxyVhosts', 'render'], ['rustProxySettings', 'render'],
+    ['rustProxyCachePanel', 'refresh'], ['rustProxyTrafficPanel', 'refresh'],
+    ['rustProxyPreferences', 'load'], ['rustProxyRefresh', 'start'],
+  ].map(([name, method]) => [name, { [method]() {} }]));
+  const ctx = {
+    window: modules, document: { readyState: 'loading', addEventListener(_name, cb) { bootstrap = cb; } },
+    api: async () => ({ csrf_token: 'valid' }), loadLanguages: async () => { if (failLanguage) throw new Error('Language assets missing'); },
+    translate() {}, setupRequired: false, syncAuthForm() {}, activate: async () => activationResult,
+    clearInvalidOriginRecovery() { clears++; }, recoverInvalidOrigin: () => false,
+    showStartupFailure() { failures++; },
+    location: { pathname: '/overview', search: '', replace() { throw new Error('unexpected redirect'); } },
+  };
+  runInNewContext(startup, ctx);
+  bootstrap(); for (let i = 0; i < 12; i++) await Promise.resolve();
+  return { clears, failures };
+}
+assert.deepEqual(await checkStartup(true, false), { clears: 1, failures: 0 });
+assert.deepEqual(await checkStartup(false, false), { clears: 0, failures: 0 });
+assert.deepEqual(await checkStartup(true, true), { clears: 0, failures: 1 });
+console.log('PASS: 0.31.3 real-source resume race, 403 retry, BFCache, 401 lock, SSE pause, stale epochs, startup recovery limit and repeated cycles');

tools/checks/preflight.py

@@ -73,12 +73,12 @@ def check(root: Path, repair_known: bool = False) -> list[str]:
         flat = module.parent.with_suffix(".rs")
         if flat.is_file():
             raise ValueError(f"Conflicting Rust modules: {flat.relative_to(root)} and {module.relative_to(root)}")
-    for path in ["src/auth/mod.rs", "src/auth/store.rs", "src/backup/snapshot.rs", "src/upstream.rs", "src/tls.rs", "src/config/internal_routing.rs", "src/proxy/websocket.rs", "src/proxy/error_fallback.rs", "src/cache/mod.rs", "src/cache/model.rs", "src/cache/lifecycle.rs", "src/cache/cold.rs", "src/cache/dashboard.rs", "src/cache/tickets.rs", "src/cache/lookup.rs", "src/cache/policy.rs", "src/cache/fill.rs", "src/cache/tests.rs", "src/settings.rs", "src/compression.rs", "src/diagnostics.rs", "src/traffic.rs", "src/system_stats/mod.rs", "src/system_stats/linux.rs", "src/vhost.rs", "src/vhost/error_fallback.rs", "src/web_server/mod.rs", "src/web_server/config.rs", "src/web_server/filesystem.rs", "src/web_server/security.rs", "src/web_server/response.rs", "src/web_server/request.rs", "src/web_server/routing.rs", "src/web_server/fastcgi.rs", "src/web_server/htaccess.rs", "src/web_server/serve.rs", "src/web_server/tests.rs", "src/balance.rs", "src/security.rs", "src/admin/web/vhosts/core.js", "src/admin/web/vhosts/health.js", "src/admin/web/vhosts/editor.js", "src/admin/web/vhosts/render.js", "src/admin/web/web-server.js", "src/admin/web/streams.js", "src/admin/web/host404.js", "src/admin/web/app/core.js", "src/admin/web/app/preferences.js", "src/admin/web/app/config-history.js", "src/admin/web/app/runtime.js", "src/admin/web/app/settings.js", "src/admin/web/management.js", "src/admin/web/drafts.js", "src/pages.rs", "tools/dev/mock_server.py", "tools/dev/mock_auth.py", "src/forwarding.rs", "src/tinyauth.rs", "src/http3.rs", "src/stream.rs", "src/admin/web/integrations.js", "src/admin/web/traffic-panel.js", "src/prometheus.rs", "src/admin/web/settings.js", "src/admin/web/docker.js", "src/docker.rs", "docker-agent/main.go", "docker-agent/model.go", "docker-agent/docker.go", "docker-agent/network.go", "docker-agent/certificate.go", "docker-agent/server.go", "docker-agent/main_test.go", "docker-agent/rustproxy-docker-agent.service", "docker-agent/install.sh", "docs/DOCKER_DISCOVERY.md", "docs/WEB_SERVER.md", "docs/PHP_FPM.md", "docs/README.md", "docs/TODO.md", "docs/V0.25.5_AUDIT.md", "docs/V0.25.4_AUDIT.md", "docs/V0.25.3_AUDIT.md", "docs/V0.25.2_AUDIT.md", "docs/CHANGELOG_TECHNICAL_ARCHIVE.md", "docs/ROADMAP_HISTORY.md", "tools/checks/docs_check.py", "tools/checks/web_server_contracts.py", "tools/checks/rust_source.py", "tools/checks/rust_module_contracts.py", "tools/checks/source_module_contracts.py", "scripts/runtime/acme_provider.py", "src/basic_auth.rs", "scripts/deploy/deploy.py", "scripts/deploy/deploy_core.py", "scripts/deploy/deploy_runtime.py", "scripts/migration/migrate_npm.py", "scripts/migration/migrate_npm_core.py", "scripts/migration/migrate_npm_api.py", "docs/NPM_MIGRATION.md", "docs/STREAMS.md", "install.sh", "install-debian13.sh", "update.sh", "build.rs", "scripts/build/swagger_assets.py", "src/admin/documentation.rs", "src/admin/openapi.json", "langs/en_US.json", "langs/pl_pl.json", "Dockerfile", ".dockerignore", "docs/CONTAINER.md", "docs/PROMETHEUS.md", "docs/NOT_FOUND_HOSTS.md", "grafana/rustproxy-overview.json"]:
+    for path in ["src/auth/mod.rs", "src/auth/store.rs", "src/backup/snapshot.rs", "src/upstream.rs", "src/tls.rs", "src/config/internal_routing.rs", "src/proxy/websocket.rs", "src/proxy/error_fallback.rs", "src/cache/mod.rs", "src/cache/model.rs", "src/cache/lifecycle.rs", "src/cache/cold.rs", "src/cache/dashboard.rs", "src/cache/tickets.rs", "src/cache/lookup.rs", "src/cache/policy.rs", "src/cache/fill.rs", "src/cache/tests.rs", "src/settings.rs", "src/compression.rs", "src/diagnostics.rs", "src/traffic.rs", "src/system_stats/mod.rs", "src/system_stats/linux.rs", "src/vhost.rs", "src/vhost/error_fallback.rs", "src/web_server/mod.rs", "src/web_server/config.rs", "src/web_server/filesystem.rs", "src/web_server/security.rs", "src/web_server/response.rs", "src/web_server/request.rs", "src/web_server/routing.rs", "src/web_server/fastcgi.rs", "src/web_server/htaccess.rs", "src/web_server/serve.rs", "src/web_server/tests.rs", "src/balance.rs", "src/security.rs", "src/admin/web/vhosts/core.js", "src/admin/web/vhosts/health.js", "src/admin/web/vhosts/editor.js", "src/admin/web/vhosts/render.js", "src/admin/web/web-server.js", "src/admin/web/streams.js", "src/admin/web/host404.js", "src/admin/web/app/core.js", "src/admin/web/app/session-resume.js", "src/admin/web/app/preferences.js", "src/admin/web/app/config-history.js", "src/admin/web/app/runtime.js", "src/admin/web/app/settings.js", "src/admin/web/management.js", "src/admin/web/drafts.js", "src/pages.rs", "tools/dev/mock_server.py", "tools/dev/mock_auth.py", "src/forwarding.rs", "src/tinyauth.rs", "src/http3.rs", "src/stream.rs", "src/admin/web/integrations.js", "src/admin/web/traffic-panel.js", "src/prometheus.rs", "src/admin/web/settings.js", "src/admin/web/docker.js", "src/docker.rs", "docker-agent/main.go", "docker-agent/model.go", "docker-agent/docker.go", "docker-agent/network.go", "docker-agent/certificate.go", "docker-agent/server.go", "docker-agent/main_test.go", "docker-agent/rustproxy-docker-agent.service", "docker-agent/install.sh", "docs/DOCKER_DISCOVERY.md", "docs/WEB_SERVER.md", "docs/PHP_FPM.md", "docs/README.md", "docs/TODO.md", "docs/V0.25.5_AUDIT.md", "docs/V0.25.4_AUDIT.md", "docs/V0.25.3_AUDIT.md", "docs/V0.25.2_AUDIT.md", "docs/CHANGELOG_TECHNICAL_ARCHIVE.md", "docs/ROADMAP_HISTORY.md", "tools/checks/docs_check.py", "tools/checks/web_server_contracts.py", "tools/checks/rust_source.py", "tools/checks/rust_module_contracts.py", "tools/checks/source_module_contracts.py", "scripts/runtime/acme_provider.py", "src/basic_auth.rs", "scripts/deploy/deploy.py", "scripts/deploy/deploy_core.py", "scripts/deploy/deploy_runtime.py", "scripts/migration/migrate_npm.py", "scripts/migration/migrate_npm_core.py", "scripts/migration/migrate_npm_api.py", "docs/NPM_MIGRATION.md", "docs/STREAMS.md", "install.sh", "install-debian13.sh", "update.sh", "build.rs", "scripts/build/swagger_assets.py", "src/admin/documentation.rs", "src/admin/openapi.json", "langs/en_US.json", "langs/pl_pl.json", "Dockerfile", ".dockerignore", "docs/CONTAINER.md", "docs/PROMETHEUS.md", "docs/NOT_FOUND_HOSTS.md", "grafana/rustproxy-overview.json"]:
         if not (root / path).is_file():
-            raise ValueError(f"Incomplete RustProxy 0.31.2 source tree: missing {path}")
+            raise ValueError(f"Incomplete RustProxy 0.31.3 source tree: missing {path}")
     text = (root / "src/lib.rs").read_text(encoding="utf-8")
     if '#[path = "auth/mod.rs"]' not in text:
-        raise ValueError("src/lib.rs is not the 0.31.2 entry point; extract the complete package, not individual files.")
+        raise ValueError("src/lib.rs is not the 0.31.3 entry point; extract the complete package, not individual files.")
     return messages
 
 

tools/checks/refresh_0310_ui_test.mjs

@@ -14,7 +14,7 @@ assert.match(bridge, /function startLive\(/);
 
 function fixture({ withoutSse = false } = {}) {
   let time = 0, nextId = 1, renderCount = 0, logCount = 0, diagCount = 0;
-  const timers = new Map(), listeners = new Map(), streams = [], requests = [], rendered = [], failures = [];
+  const timers = new Map(), listeners = new Map(), windowListeners = new Map(), streams = [], requests = [], rendered = [], failures = [];
   let response = async () => ({});
   class FakeEventSource {
     constructor(url) { this.url = url; this.closed = false; this.handlers = new Map(); streams.push(this); }
@@ -37,7 +37,11 @@ function fixture({ withoutSse = false } = {}) {
     console: { warn(...args) { failures.push(args); } },
     authenticated: true, authEpoch: 1, currentPanel: "overview", liveConnected: false, liveFallback: false,
     liveEvents: null, liveInterval: null, latestStatus: null,
-    window: { rustProxySettings: { current: () => "listeners", render: () => undefined } },
+    window: {
+      rustProxySettings: { current: () => "listeners", render: () => undefined },
+      addEventListener(type, callback) { assert(!windowListeners.has(type)); windowListeners.set(type, callback); },
+      removeEventListener(type, callback) { assert.equal(windowListeners.get(type), callback); windowListeners.delete(type); },
+    },
     $: name => nodes[name] || null,
     t: name => name,
     api: (url, args = {}) => { requests.push({ url, args, time }); return response(url, args); },
@@ -45,7 +49,11 @@ function fixture({ withoutSse = false } = {}) {
     renderLogs() { logCount++; },
     renderDiagnostics() { diagCount++; },
     renderLiveStatus() { throw new Error("bridge not loaded"); },
-    revalidateSession: async () => undefined,
+    revalidateSession: async () => {
+      ctx.window.rustProxyRefresh.suspendForSessionValidation();
+      await Promise.resolve();
+      ctx.window.rustProxyRefresh.completeSessionValidation(true);
+    },
     loadTunnels: async () => undefined
   };
   runInNewContext(bridge + "\n" + scheduler, ctx, { filename: "coordinator-browser-bundle.js" });
@@ -76,7 +84,7 @@ function fixture({ withoutSse = false } = {}) {
     }
   }
   return {
-    ctx, refresh, requests, rendered, streams, listeners, timers, failures, advance, switchPanel, count,
+    ctx, refresh, requests, rendered, streams, listeners, windowListeners, timers, failures, advance, switchPanel, count,
     registerViews, changeVisibility,
     setResponse(fn) { response = fn; },
     get renderCount() { return renderCount; },
@@ -152,7 +160,7 @@ assert(h.streams.at(-1).closed, "SSE closes when hidden");
 assert.equal(h.refresh.diagnostics().filter(row => row.scheduled).length, 0);
 await h.advance(120_000);
 assert.equal(h.count("/api/traffic"), beforeHidden);
-h.changeVisibility(false); await h.advance();
+h.changeVisibility(false); await h.advance(); await h.advance();
 assert.equal(h.count("/api/traffic"), beforeHidden + 1);
 assert.equal(h.streams.filter(stream => !stream.closed).length, 1);
 
@@ -206,6 +214,7 @@ assert.throws(() => h.refresh.register("traffic", { interval: () => 5, run: asyn
 // Logout clears timers, active SSE streams, observer and pending fetches.
 h.refresh.stop();
 assert.equal(h.listeners.has("visibilitychange"), false);
+assert.equal(h.windowListeners.size, 0, "pagehide/pageshow listeners are removed on logout");
 assert.equal(h.streams.filter(stream => !stream.closed).length, 0);
 assert.equal(h.refresh.diagnostics().filter(row => row.scheduled).length, 0);
 const afterLogout = h.requests.length;

tools/checks/release_smoke.py

@@ -135,7 +135,7 @@ def upgrade_smoke(tmp: Path) -> None:
     assert backup.is_dir()
     assert (backup / "src/obsolete.rs").is_file()
     assert not (target / "src/obsolete.rs").exists()
-    assert 'version = "0.31.2"' in (target / "Cargo.toml").read_text(encoding="utf-8")
+    assert 'version = "0.31.3"' in (target / "Cargo.toml").read_text(encoding="utf-8")
     assert (target / "data/keep.txt").read_text(encoding="utf-8") == "preserve\n"
     assert (target / ".env").read_text(encoding="utf-8") == "RUST_PROXY_DEMO=0\n"
     assert (target / "langs/site.json").is_file()
@@ -146,7 +146,7 @@ def upgrade_smoke(tmp: Path) -> None:
     assert (target / "docker-agent/certificate.go").is_file()
     assert (target / "docker-agent/server.go").is_file()
     manifest = json.loads((backup / "upgrade.json").read_text(encoding="utf-8"))
-    assert manifest["to_version"] == "0.31.2"
+    assert manifest["to_version"] == "0.31.3"
     assert manifest["removed_obsolete_runtime_state"] is True
     assert not legacy.exists()
     assert not (backup / "legacy-data").exists()
@@ -463,7 +463,7 @@ def ui_contract_smoke() -> None:
     assert 'viewBox: "0 0 300 60"' in app and 'M0 15H300 M0 30H300 M0 45H300' in app
     assert '.network-interface-row {' in css and 'background: transparent' in css
     assert "hostTagEditor" in vhosts and "vhost-chart-line" in vhosts and "vhLifetimeChart" in vhosts
-    for marker in ["refreshCertificateInventory", "certificateDetails", "certificate-domain-pills", "certificateCoverageUnknown", "async function revalidateSession", 'Object.values(PANEL_PATHS), "/configuration"', "recoverInvalidOrigin", "auth.invalid_origin", "ORIGIN_RECOVERY_KEY"]:
+    for marker in ["refreshCertificateInventory", "certificateDetails", "certificate-domain-pills", "certificateCoverageUnknown", "function revalidateSession", 'Object.values(PANEL_PATHS), "/configuration"', "recoverInvalidOrigin", "auth.invalid_origin", "ORIGIN_RECOVERY_KEY"]:
         assert marker in app, marker
     for marker in ['data-certificate-tab="installed"', 'data-certificate-tab="renewal"', 'data-certificate-tab="generate"', 'id="certificate-page-installed"', 'id="certificate-page-renewal"', 'id="certificate-page-generate"']:
         assert marker in html, marker
@@ -617,7 +617,7 @@ def source_contract_smoke() -> None:
         assert marker in admin, marker
     anonymous_block = admin.split("fn anonymous_allowed", 1)[1].split("const CERTIFICATE_API_KEY_HEADER", 1)[0]
     assert '"/api/status"' not in anonymous_block
-    assert '"RuntimeInformation"' in openapi_0241 and '"version": "0.31.2"' in openapi_0241
+    assert '"RuntimeInformation"' in openapi_0241 and '"version": "0.31.3"' in openapi_0241
     assert 'id="panel-logging"' not in html
     for marker in ['id="settings-tab-logging"', 'id="settings-page-logging"', 'id="logging-form"', 'id="error-log-form"']:
         assert marker in html, marker
@@ -1108,7 +1108,7 @@ def source_contract_smoke() -> None:
     assert '.managed-update' in main and "flush_hot_to_cold_for_update" in main
     openapi = (ROOT / "src/admin/openapi.json").read_text(encoding="utf-8")
     assert '"/api/config/history/restore"' in openapi
-    for marker in ['"version": "0.31.2"', '"memory_preset"', '"cold_preset"', '"memory_budget_bytes"', '"max_inflight"', '"preset"', '"session_days"', '"session_lifetime_seconds"', '"accept_local_listener_risk"', '"backend_header"', '"backend_timing_header"', '"cold_on_age"', '"match_type"', '"regex_insensitive"', '"NotFoundHost"', '"not_found_hosts"', '"PrometheusSettings"', '"allow_trusted_network_without_token"', '"include_docker_vhosts"', '"include_streams"', '"include_logging"']:
+    for marker in ['"version": "0.31.3"', '"memory_preset"', '"cold_preset"', '"memory_budget_bytes"', '"max_inflight"', '"preset"', '"session_days"', '"session_lifetime_seconds"', '"accept_local_listener_risk"', '"backend_header"', '"backend_timing_header"', '"cold_on_age"', '"match_type"', '"regex_insensitive"', '"NotFoundHost"', '"not_found_hosts"', '"PrometheusSettings"', '"allow_trusted_network_without_token"', '"include_docker_vhosts"', '"include_streams"', '"include_logging"']:
         assert marker in openapi, marker
     assert '"software_update"' in openapi and '"update_available"' in openapi
     for marker in ['"/api/certificates/deploy"', '"CertificateDeploy"', '"CertificateDeployResult"', '"/api/certificates/reload"']:
@@ -1313,7 +1313,7 @@ def main() -> None:
     source_contract_smoke()
     container_contract_smoke()
     grafana_contract_smoke()
-    print("PASS: 0.31.2 SQLite/schema-9/upgrade, local-response 404 hosts, Prometheus/Grafana diagnostics, external Debian-packaging separation, cache/dashboard/logging/Nagios, retained admin/H3/stream/TLS contracts and reproducible source archives.")
+    print("PASS: 0.31.3 SQLite/schema-9/upgrade, local-response 404 hosts, Prometheus/Grafana diagnostics, external Debian-packaging separation, cache/dashboard/logging/Nagios, retained admin/H3/stream/TLS contracts and reproducible source archives.")
 
 
 if __name__ == "__main__":

tools/checks/source_module_contracts.py

@@ -35,7 +35,7 @@ for directory in ("scripts/runtime", "scripts/build", "scripts/deploy", "scripts
 for old in (ROOT / "src/admin/web/app.js", ROOT / "src/admin/web/vhosts.js"):
     assert not old.exists(), f"oversized browser monolith returned: {old.relative_to(ROOT)}"
 for required in (
-    "src/admin/web/app/core.js", "src/admin/web/app/preferences.js", "src/admin/web/app/config-history.js", "src/admin/web/app/runtime.js", "src/admin/web/app/settings.js",
+    "src/admin/web/app/core.js", "src/admin/web/app/session-resume.js", "src/admin/web/app/preferences.js", "src/admin/web/app/config-history.js", "src/admin/web/app/runtime.js", "src/admin/web/app/settings.js",
     "src/admin/web/vhosts/core.js", "src/admin/web/vhosts/health.js", "src/admin/web/vhosts/editor.js", "src/admin/web/vhosts/render.js",
     "docker-agent/model.go", "docker-agent/docker.go", "docker-agent/network.go",
     "docker-agent/certificate.go", "docker-agent/server.go",

tools/checks/system_info_0301_ui_test.mjs

@@ -13,7 +13,7 @@ const has = (haystack, needle) => assert.ok(haystack.includes(needle), `Missing
 
 // The two mini charts share the exact H1/H2/H3 palette as their SVG lines.
 for (const version of ['h1', 'h2', 'h3']) {
-  has(css, `.stat-chart .stat-chart-legend .legend-${version} i { background: var(--traffic-${version}); }`);
+  assert.match(css, new RegExp(`\\.stat-chart\\s+\\.stat-chart-legend\\s+\\.legend-${version}\\s+i\\s*\\{\\s*background:\\s*var\\(--traffic-${version}\\);`));
   assert.match(css, new RegExp(`\\.proto-${version}-line\\s*\\{[^}]*stroke:\\s*var\\(--traffic-${version}\\);`));
   has(html, `id="http-protocol-${version}"`);
   has(html, `id="ws-protocol-${version}"`);
@@ -43,7 +43,7 @@ const code = js.slice(js.indexOf('    const runtime = latestStatus?.runtime || {
 const elements = new Map();
 const dollar = id => { if (!elements.has(id)) elements.set(id, { textContent: '' }); return elements.get(id); };
 const status = {
-  version: '0.31.2', uptime_seconds: 4201,
+  version: '0.31.3', uptime_seconds: 4201,
   runtime: {
     platform: 'Linux', operating_system: 'Debian GNU/Linux 13', kernel_version: '6.12.0', architecture: 'x86_64',
     statistics_source: 'systemstat+sysinfo', data_directory: '/var/lib/rustproxy', database_path: '/var/lib/rustproxy/config.sqlite3',
@@ -63,7 +63,7 @@ const context = {
 vm.runInNewContext(code, context);
 assert.equal(dollar('runtime-operating-system').textContent, 'Debian GNU/Linux 13');
 assert.equal(dollar('runtime-kernel-version').textContent, '6.12.0');
-assert.equal(dollar('runtime-version').textContent, '0.31.2');
+assert.equal(dollar('runtime-version').textContent, '0.31.3');
 assert.equal(dollar('runtime-logical-cpus').textContent, '8');
 assert.equal(dollar('runtime-cpu-usage').textContent, '17.2%');
 assert.equal(dollar('runtime-python').textContent, 'Available · 3.13.5');
@@ -124,4 +124,4 @@ for (const key of ['python_version','pip_version','certbot_version']) {
   assert.ok(runtimeSchema.properties.certificate_runtime.properties[key]);
   assert.equal(runtimeSchema.properties.certificate_runtime.properties[key].nullable, true);
 }
-console.log('PASS: 0.31.2 legend palette, About cleanup, system tab/navigation, read-only API schema and simulated status rendering.');
+console.log('PASS: 0.31.3 legend palette, About cleanup, system tab/navigation, read-only API schema and simulated status rendering.');

tools/checks/vhost_origin_errors_0297_ui_test.mjs

@@ -75,7 +75,7 @@ check(prepared.includes('response = intercept_route_origin_error(response, route
 const marker = fs.readFileSync('src/proxy/error_fallback.rs','utf8');
 check(marker.includes('response.extensions_mut().insert(crate::pages::OriginProvidedResponse)'), 'Origin responses must be marked for the outer observer');
 const observer = fs.readFileSync('src/proxy/upstream_helpers.rs','utf8');
-check(observer.includes('response.extensions().get::<crate::pages::OriginProvidedResponse>().is_none()'), 'Outer response observer must not unconditionally replace origin 404/5xx');
+check(/fn should_replace_error_page\(/.test(observer) && /get::<crate::pages::OriginProvidedResponse>\(\)\s*\.is_none\(\)/.test(observer) && /if should_replace_error_page\(&response, minimal_welcome\)/.test(observer), 'Outer response observer must not unconditionally replace origin 404/5xx');
 const pages = fs.readFileSync('src/pages.rs','utf8');
 check(pages.includes('body_only.status = None;'), 'Application error interception must preserve the upstream HTTP code even when page overrides status');
 const interceptPosition = prepared.indexOf('response = intercept_route_origin_error(response, route, &snapshot);');

tools/checks/web_assets.py

@@ -1,6 +1,6 @@
 from pathlib import Path
 
-APP_PARTS = ("core.js", "refresh.js", "preferences.js", "config-history.js", "runtime.js", "settings.js")
+APP_PARTS = ("core.js", "session-resume.js", "refresh.js", "preferences.js", "config-history.js", "runtime.js", "settings.js")
 PANEL_PARTS = (
     "management.js", "drafts.js", "integrations.js", "vhosts.js",
     "web-server-profiles.js", "web-server.js", "docker.js", "streams.js",

tools/dev/memory_load.py

@@ -54,7 +54,7 @@ def run_load(
     port = parsed.port or (443 if parsed.scheme == "https" else 80)
     tls = ssl._create_unverified_context() if insecure else ssl.create_default_context()
     connection_type = http.client.HTTPSConnection if parsed.scheme == "https" else http.client.HTTPConnection
-    headers = {"user-agent": "RustProxy-Memory-Stress/0.31.2", "accept": "*/*"}
+    headers = {"user-agent": "RustProxy-Memory-Stress/0.31.3", "accept": "*/*"}
     if host_header:
         headers["host"] = host_header