v0.30.1

tools/checks/check_source.py

@@ -24,7 +24,7 @@ def read_docker_agent_source() -> str:
 
 preflight(root)
 manifest = tomllib.loads((root / "Cargo.toml").read_text())
-assert manifest["package"]["version"] == "0.30.0"
+assert manifest["package"]["version"] == "0.30.1"
 assert manifest["dependencies"]["quinn"]["version"] == "0.11.12"
 h3dep = manifest["dependencies"]["h3"]
 assert h3dep["package"] == "hpx-h3" and h3dep["version"] == "=2.5.19" and "quinn" in h3dep["features"]
@@ -32,14 +32,14 @@ assert "h3-quinn" not in manifest["dependencies"]
 lock_path = root / "Cargo.lock"
 if lock_path.exists():
     lock = lock_path.read_text()
-    assert 'name = "rust-proxy"\nversion = "0.30.0"' in lock
+    assert 'name = "rust-proxy"\nversion = "0.30.1"' in lock
     assert 'name = "systemstat"' in lock and 'name = "metrics-process"' in lock and 'name = "sysinfo"' in lock, "Cargo.lock must be resolver-generated after adding cross-platform statistics libraries"
 for release_doc, marker in {
-    "README.md": "# RustProxy 0.30.0",
-    "CHANGELOG.md": "## 0.30.0",
-    "ROADMAP.md": "## 0.30.0",
-    "AGENTS.md": "Current source version: 0.30.0.",
-    "docs/TEST_REPORT.md": "# Verification report - RustProxy 0.30.0",
+    "README.md": "# RustProxy 0.30.1",
+    "CHANGELOG.md": "## 0.30.1",
+    "ROADMAP.md": "## 0.30.1",
+    "AGENTS.md": "Current source version: 0.30.1.",
+    "docs/TEST_REPORT.md": "# Verification report - RustProxy 0.30.1",
 }.items():
     assert marker in (root / release_doc).read_text(), f"stale release identity in {release_doc}"
 assert tomllib.loads((root / "rust-toolchain.toml").read_text())["toolchain"]["channel"] == "stable"
@@ -285,7 +285,7 @@ assert 'Opt-in health decisions based on ordinary user traffic. Defaults to disa
 assert '"force_ssl"' in openapi and '"forward_client_ip"' in openapi
 assert '"backend_header"' in openapi and '"backend_timing_header"' in openapi
 assert '"StreamMetrics"' in openapi and '"streams"' in openapi
-for marker in ['"version": "0.30.0"', '"/api/traffic"', '"capture_user_agent"', '"capture_country"', '"hot_auto_trim_enabled"', '"hot_auto_trim_after_seconds"', '"hot_auto_trim_target_percent"', '"/api/config/{section}"', '"ConfigSectionUpdate"', '"cold_on_idle"', '"cold_on_age"', '"cold_max_hot_seconds"', '"cold_on_lru"', '"cold_on_shutdown"', '"cold_gc_interval_seconds"', '"cold_gc_max_delete"', '"collapse_enabled"', '"collapse_wait_timeout_ms"', '"collapse_timeout_fallback"', '"stale_if_error_timeout"', '"stale_if_error_connection"', '"stale_if_error_dns"', '"stale_if_error_tls"', '"stale_if_error_statuses"', '"proactive_refresh_enabled"', '"proactive_refresh_before_expiry_seconds"', '"proactive_refresh_percent"', '"proactive_refresh_max_inflight"', '"TransformSettings"', '"TransformOverrides"', '"/api/cache/cold/cleanup"', '"/api/cache/invalidate"', '"/api/cache/bans"', '"/api/cache/bans/{id}"', '"CacheInvalidationRequest"', '"CacheInvalidationResponse"', '"ColdCleanupJob"', '"match_type"', '"regex_insensitive"', '"rewrite"', '"response"', '"covered_hosts"', '"default": true']:
+for marker in ['"version": "0.30.1"', '"/api/traffic"', '"capture_user_agent"', '"capture_country"', '"hot_auto_trim_enabled"', '"hot_auto_trim_after_seconds"', '"hot_auto_trim_target_percent"', '"/api/config/{section}"', '"ConfigSectionUpdate"', '"cold_on_idle"', '"cold_on_age"', '"cold_max_hot_seconds"', '"cold_on_lru"', '"cold_on_shutdown"', '"cold_gc_interval_seconds"', '"cold_gc_max_delete"', '"collapse_enabled"', '"collapse_wait_timeout_ms"', '"collapse_timeout_fallback"', '"stale_if_error_timeout"', '"stale_if_error_connection"', '"stale_if_error_dns"', '"stale_if_error_tls"', '"stale_if_error_statuses"', '"proactive_refresh_enabled"', '"proactive_refresh_before_expiry_seconds"', '"proactive_refresh_percent"', '"proactive_refresh_max_inflight"', '"TransformSettings"', '"TransformOverrides"', '"/api/cache/cold/cleanup"', '"/api/cache/invalidate"', '"/api/cache/bans"', '"/api/cache/bans/{id}"', '"CacheInvalidationRequest"', '"CacheInvalidationResponse"', '"ColdCleanupJob"', '"match_type"', '"regex_insensitive"', '"rewrite"', '"response"', '"covered_hosts"', '"default": true']:
     assert marker in openapi, marker
 for marker in ['"NotFoundHost"', '"not_found_hosts"', '"PrometheusSettings"', '"allow_trusted_network_without_token"', '"include_docker_vhosts"', '"include_streams"', '"include_logging"']:
     assert marker in openapi, marker
@@ -585,7 +585,7 @@ h2_settings_controls = integrations_js.split('function http2SettingsControls', 1
 assert 'listener-h2' not in h2_settings_controls, 'HTTP/2 enablement belongs to the listener editor, not the tuning page'
 h3_settings_controls = integrations_js.split('function http3SettingsControls', 1)[1].split('function addRow', 1)[0]
 assert 'h3Enable' not in h3_settings_controls, 'HTTP/3 enablement belongs to the listener editor, not the tuning page'
-for marker in ['https://git.linuxiarz.pl/gru/RustProxy', 'https://rustproxy.linuxiarz.pl/', 'id="about-python-runtime"', 'id="runtime-python"', 'id="acme-runtime-components"']:
+for marker in ['https://git.linuxiarz.pl/gru/RustProxy', 'https://rustproxy.linuxiarz.pl/', 'data-settings-tab="system-info"', 'id="runtime-python"', 'id="acme-runtime-components"']:
     assert marker in html, marker
 for language in ['langs/en_US.json', 'langs/pl_pl.json']:
     language_text = (root / language).read_text(encoding='utf-8')
@@ -1363,7 +1363,7 @@ assert metrics_dep["version"] == "=2.4.3" and metrics_dep["default-features"] is
 assert metrics_dep["features"] == ["dummy"]
 sysinfo_dep = manifest["dependencies"]["sysinfo"]
 assert sysinfo_dep["version"] == "=0.38.4" and sysinfo_dep["default-features"] is False
-assert sysinfo_dep["features"] == ["network"]
+assert set(sysinfo_dep["features"]) == {"network", "system"}
 for marker_0241 in [
     "systemstat::{Platform, System}", "metrics_process::collector::collect",
     "sysinfo::Networks::new_with_refreshed_list", "collect_network_systemstat", "merge_network_interfaces",
@@ -1396,7 +1396,7 @@ assert '"error_log" => {' not in admin_0241 and 'request("/api/config/error_log"
 assert '"error_log"' in openapi and 'logging, error_log, forwarding' not in openapi
 assert 'logging_section_persists_error_log_settings_atomically' in admin_0241 and 'error_log_is_not_a_standalone_configuration_section' in admin_0241
 assert 'location.pathname === "/logging"' in settings_js_0241
-assert '"RuntimeInformation"' in openapi and '"version": "0.30.0"' in openapi
+assert '"RuntimeInformation"' in openapi and '"version": "0.30.1"' in openapi
 
 # 0.24.1 compiler and hostname-cardinality regressions.
 tls_0241 = rust_source(root, "src/tls.rs")
@@ -1635,5 +1635,5 @@ for marker_0282 in [
 assert 'Zewnętrzne ścieżki plików' in (root / 'langs/pl_pl.json').read_text()
 assert 'setfacl -m u:rustproxy:--x /etc/ssl/' in (root / 'docs/V0.28.2_IMPLEMENTATION.md').read_text()
 
-print("PASS: 0.30.0 manifest/package, shared system-statistics/runtime metadata, Settings logging, retained H2, external-packaging/Grafana/Prometheus/404-host/custom-location/path/cache/dashboard/Nagios UI/source contracts, stopped legacy-renewal removal, session/admin/transport contracts, deterministic package source and embedded SQLite schema-v9 migrations.")
+print("PASS: 0.30.1 manifest/package, shared system-statistics/runtime metadata, Settings logging, retained H2, external-packaging/Grafana/Prometheus/404-host/custom-location/path/cache/dashboard/Nagios UI/source contracts, stopped legacy-renewal removal, session/admin/transport contracts, deterministic package source and embedded SQLite schema-v9 migrations.")
 print("NOT VERIFIED: Rust parsing, types, compilation, linking or runtime behavior. Run ./dev.sh test.")

tools/checks/docs_check.py

@@ -1,5 +1,5 @@
 #!/usr/bin/env python3
-"""Rust-independent documentation/Reader consistency checks for the 0.30.0 release."""
+"""Rust-independent documentation/Reader consistency checks for the 0.30.1 release."""
 from pathlib import Path
 import re
 from rust_source import rust_source
@@ -64,7 +64,7 @@ assert '"/docs/content.json"' in admin
 readme = (ROOT / "README.md").read_text(encoding="utf-8")
 roadmap = (ROOT / "ROADMAP.md").read_text(encoding="utf-8")
 changelog = (ROOT / "CHANGELOG.md").read_text(encoding="utf-8")
-assert readme.startswith("# RustProxy 0.30.0")
+assert readme.startswith("# RustProxy 0.30.1")
 assert "docs/WEB_SERVER.md" in readme and "docs/README.md" in readme
 assert readme.count("## What changed in ") == 1, "README duplicates historical release notes; use CHANGELOG/archive"
 assert "## Release history" in readme and "docs/ROADMAP_HISTORY.md" in readme

tools/checks/preflight.py

@@ -75,10 +75,10 @@ def check(root: Path, repair_known: bool = False) -> list[str]:
             raise ValueError(f"Conflicting Rust modules: {flat.relative_to(root)} and {module.relative_to(root)}")
     for path in ["src/auth/mod.rs", "src/auth/store.rs", "src/backup/snapshot.rs", "src/upstream.rs", "src/tls.rs", "src/config/internal_routing.rs", "src/proxy/websocket.rs", "src/proxy/error_fallback.rs", "src/cache/mod.rs", "src/cache/model.rs", "src/cache/lifecycle.rs", "src/cache/cold.rs", "src/cache/dashboard.rs", "src/cache/tickets.rs", "src/cache/lookup.rs", "src/cache/policy.rs", "src/cache/fill.rs", "src/cache/tests.rs", "src/settings.rs", "src/compression.rs", "src/diagnostics.rs", "src/traffic.rs", "src/system_stats/mod.rs", "src/system_stats/linux.rs", "src/vhost.rs", "src/vhost/error_fallback.rs", "src/web_server/mod.rs", "src/web_server/config.rs", "src/web_server/filesystem.rs", "src/web_server/security.rs", "src/web_server/response.rs", "src/web_server/request.rs", "src/web_server/routing.rs", "src/web_server/fastcgi.rs", "src/web_server/htaccess.rs", "src/web_server/serve.rs", "src/web_server/tests.rs", "src/balance.rs", "src/security.rs", "src/admin/web/vhosts/core.js", "src/admin/web/vhosts/health.js", "src/admin/web/vhosts/editor.js", "src/admin/web/vhosts/render.js", "src/admin/web/web-server.js", "src/admin/web/streams.js", "src/admin/web/host404.js", "src/admin/web/app/core.js", "src/admin/web/app/preferences.js", "src/admin/web/app/config-history.js", "src/admin/web/app/runtime.js", "src/admin/web/app/settings.js", "src/admin/web/management.js", "src/admin/web/drafts.js", "src/pages.rs", "tools/dev/mock_server.py", "tools/dev/mock_auth.py", "src/forwarding.rs", "src/tinyauth.rs", "src/http3.rs", "src/stream.rs", "src/admin/web/integrations.js", "src/admin/web/traffic-panel.js", "src/prometheus.rs", "src/admin/web/settings.js", "src/admin/web/docker.js", "src/docker.rs", "docker-agent/main.go", "docker-agent/model.go", "docker-agent/docker.go", "docker-agent/network.go", "docker-agent/certificate.go", "docker-agent/server.go", "docker-agent/main_test.go", "docker-agent/rustproxy-docker-agent.service", "docker-agent/install.sh", "docs/DOCKER_DISCOVERY.md", "docs/WEB_SERVER.md", "docs/PHP_FPM.md", "docs/README.md", "docs/TODO.md", "docs/V0.25.5_AUDIT.md", "docs/V0.25.4_AUDIT.md", "docs/V0.25.3_AUDIT.md", "docs/V0.25.2_AUDIT.md", "docs/CHANGELOG_TECHNICAL_ARCHIVE.md", "docs/ROADMAP_HISTORY.md", "tools/checks/docs_check.py", "tools/checks/web_server_contracts.py", "tools/checks/rust_source.py", "tools/checks/rust_module_contracts.py", "tools/checks/source_module_contracts.py", "scripts/runtime/acme_provider.py", "src/basic_auth.rs", "scripts/deploy/deploy.py", "scripts/deploy/deploy_core.py", "scripts/deploy/deploy_runtime.py", "scripts/migration/migrate_npm.py", "scripts/migration/migrate_npm_core.py", "scripts/migration/migrate_npm_api.py", "docs/NPM_MIGRATION.md", "docs/STREAMS.md", "install.sh", "install-debian13.sh", "update.sh", "build.rs", "scripts/build/swagger_assets.py", "src/admin/documentation.rs", "src/admin/openapi.json", "langs/en_US.json", "langs/pl_pl.json", "Dockerfile", ".dockerignore", "docs/CONTAINER.md", "docs/PROMETHEUS.md", "docs/NOT_FOUND_HOSTS.md", "grafana/rustproxy-overview.json"]:
         if not (root / path).is_file():
-            raise ValueError(f"Incomplete RustProxy 0.30.0 source tree: missing {path}")
+            raise ValueError(f"Incomplete RustProxy 0.30.1 source tree: missing {path}")
     text = (root / "src/lib.rs").read_text(encoding="utf-8")
     if '#[path = "auth/mod.rs"]' not in text:
-        raise ValueError("src/lib.rs is not the 0.30.0 entry point; extract the complete package, not individual files.")
+        raise ValueError("src/lib.rs is not the 0.30.1 entry point; extract the complete package, not individual files.")
     return messages
 
 

tools/checks/release_smoke.py

@@ -135,7 +135,7 @@ def upgrade_smoke(tmp: Path) -> None:
     assert backup.is_dir()
     assert (backup / "src/obsolete.rs").is_file()
     assert not (target / "src/obsolete.rs").exists()
-    assert 'version = "0.30.0"' in (target / "Cargo.toml").read_text(encoding="utf-8")
+    assert 'version = "0.30.1"' in (target / "Cargo.toml").read_text(encoding="utf-8")
     assert (target / "data/keep.txt").read_text(encoding="utf-8") == "preserve\n"
     assert (target / ".env").read_text(encoding="utf-8") == "RUST_PROXY_DEMO=0\n"
     assert (target / "langs/site.json").is_file()
@@ -146,7 +146,7 @@ def upgrade_smoke(tmp: Path) -> None:
     assert (target / "docker-agent/certificate.go").is_file()
     assert (target / "docker-agent/server.go").is_file()
     manifest = json.loads((backup / "upgrade.json").read_text(encoding="utf-8"))
-    assert manifest["to_version"] == "0.30.0"
+    assert manifest["to_version"] == "0.30.1"
     assert manifest["removed_obsolete_runtime_state"] is True
     assert not legacy.exists()
     assert not (backup / "legacy-data").exists()
@@ -434,7 +434,7 @@ def ui_contract_smoke() -> None:
     assert 'stream_list_sort' in list_sort_sources['streams']
     for marker in ['id="pool-search"', 'id="pool-sort"', 'data-pool-column-toggle="vhost"']:
         assert marker in html, marker
-    for marker in ['https://git.linuxiarz.pl/gru/RustProxy', 'https://rustproxy.linuxiarz.pl/', 'id="about-python-runtime"', 'id="runtime-python"', 'id="acme-runtime-components"']:
+    for marker in ['https://git.linuxiarz.pl/gru/RustProxy', 'https://rustproxy.linuxiarz.pl/', 'data-settings-tab="system-info"', 'id="runtime-python"', 'id="acme-runtime-components"']:
         assert marker in html, marker
     for language in ['langs/en_US.json', 'langs/pl_pl.json']:
         text = (ROOT / language).read_text(encoding='utf-8')
@@ -586,7 +586,7 @@ def source_contract_smoke() -> None:
     sysinfo_network = manifest["dependencies"]["sysinfo"]
     assert sysinfo_network["version"] == "=0.38.4"
     assert sysinfo_network["default-features"] is False
-    assert sysinfo_network["features"] == ["network"]
+    assert set(sysinfo_network["features"]) == {"network", "system"}
     target_key = 'cfg(any(target_os = "linux", target_os = "freebsd", target_os = "openbsd", target_os = "netbsd", target_os = "dragonfly", target_os = "macos", target_os = "windows"))'
     assert manifest["target"][target_key]["dependencies"]["systemstat"] == "=0.2.7"
     for marker in [
@@ -619,7 +619,7 @@ def source_contract_smoke() -> None:
         assert marker in admin, marker
     anonymous_block = admin.split("fn anonymous_allowed", 1)[1].split("const CERTIFICATE_API_KEY_HEADER", 1)[0]
     assert '"/api/status"' not in anonymous_block
-    assert '"RuntimeInformation"' in openapi_0241 and '"version": "0.30.0"' in openapi_0241
+    assert '"RuntimeInformation"' in openapi_0241 and '"version": "0.30.1"' in openapi_0241
     assert 'id="panel-logging"' not in html
     for marker in ['id="settings-tab-logging"', 'id="settings-page-logging"', 'id="logging-form"', 'id="error-log-form"']:
         assert marker in html, marker
@@ -1109,7 +1109,7 @@ def source_contract_smoke() -> None:
     assert '.managed-update' in main and "flush_hot_to_cold_for_update" in main
     openapi = (ROOT / "src/admin/openapi.json").read_text(encoding="utf-8")
     assert '"/api/config/history/restore"' in openapi
-    for marker in ['"version": "0.30.0"', '"memory_preset"', '"cold_preset"', '"memory_budget_bytes"', '"max_inflight"', '"preset"', '"session_days"', '"session_lifetime_seconds"', '"accept_local_listener_risk"', '"backend_header"', '"backend_timing_header"', '"cold_on_age"', '"match_type"', '"regex_insensitive"', '"NotFoundHost"', '"not_found_hosts"', '"PrometheusSettings"', '"allow_trusted_network_without_token"', '"include_docker_vhosts"', '"include_streams"', '"include_logging"']:
+    for marker in ['"version": "0.30.1"', '"memory_preset"', '"cold_preset"', '"memory_budget_bytes"', '"max_inflight"', '"preset"', '"session_days"', '"session_lifetime_seconds"', '"accept_local_listener_risk"', '"backend_header"', '"backend_timing_header"', '"cold_on_age"', '"match_type"', '"regex_insensitive"', '"NotFoundHost"', '"not_found_hosts"', '"PrometheusSettings"', '"allow_trusted_network_without_token"', '"include_docker_vhosts"', '"include_streams"', '"include_logging"']:
         assert marker in openapi, marker
     assert '"software_update"' in openapi and '"update_available"' in openapi
     for marker in ['"/api/certificates/deploy"', '"CertificateDeploy"', '"CertificateDeployResult"', '"/api/certificates/reload"']:
@@ -1314,7 +1314,7 @@ def main() -> None:
     source_contract_smoke()
     container_contract_smoke()
     grafana_contract_smoke()
-    print("PASS: 0.30.0 SQLite/schema-9/upgrade, local-response 404 hosts, Prometheus/Grafana diagnostics, external Debian-packaging separation, cache/dashboard/logging/Nagios, retained admin/H3/stream/TLS contracts and reproducible source archives.")
+    print("PASS: 0.30.1 SQLite/schema-9/upgrade, local-response 404 hosts, Prometheus/Grafana diagnostics, external Debian-packaging separation, cache/dashboard/logging/Nagios, retained admin/H3/stream/TLS contracts and reproducible source archives.")
 
 
 if __name__ == "__main__":

tools/checks/system_info_0301_ui_test.mjs

@@ -0,0 +1,127 @@
+#!/usr/bin/env node
+// Simulated status and tab DOM. No Rust process or visual browser is run here.
+import assert from 'node:assert/strict';
+import fs from 'node:fs';
+import vm from 'node:vm';
+
+const html = fs.readFileSync('src/admin/web/index.html', 'utf8');
+const css = fs.readFileSync('src/admin/web/style.css', 'utf8');
+const js = fs.readFileSync('src/admin/web/settings.js', 'utf8');
+const core = fs.readFileSync('src/admin/web/app/core.js', 'utf8');
+const api = JSON.parse(fs.readFileSync('src/admin/openapi.json', 'utf8'));
+const has = (haystack, needle) => assert.ok(haystack.includes(needle), `Missing ${needle}`);
+
+// The two mini charts share the exact H1/H2/H3 palette as their SVG lines.
+for (const version of ['h1', 'h2', 'h3']) {
+  has(css, `.stat-chart .stat-chart-legend .legend-${version} i { background: var(--traffic-${version}); }`);
+  assert.match(css, new RegExp(`\\.proto-${version}-line\\s*\\{[^}]*stroke:\\s*var\\(--traffic-${version}\\);`));
+  has(html, `id="http-protocol-${version}"`);
+  has(html, `id="ws-protocol-${version}"`);
+}
+assert.equal((html.match(/class="stat-chart-legend"/g) || []).length, 2);
+
+const about = html.split('<dialog aria-labelledby="about-title"')[1].split('</dialog>')[0];
+for (const forbidden of ['about-acme-mode', 'about-python-runtime', 'about-python-details', 'runtimeAcmeMode']) {
+  assert.ok(!about.includes(forbidden), `ACME details left in About: ${forbidden}`);
+}
+assert.ok(!core.includes('renderAboutRuntime('), 'Obsolete About runtime renderer must be removed');
+for (const marker of ['aboutAuthor', 'aboutLicense', 'aboutRepository', 'aboutPackagesRepository']) has(about, marker);
+
+has(html, 'data-settings-tab="system-info"');
+has(html, 'id="settings-page-system-info"');
+const tab = html.split('id="settings-page-system-info"')[1].split('id="settings-page-certificate-api"')[0];
+for (const field of ['runtime-operating-system', 'runtime-kernel-version', 'runtime-architecture',
+                    'runtime-logical-cpus', 'runtime-system-memory', 'runtime-process-memory',
+                    'runtime-acme-mode', 'runtime-python', 'runtime-pip', 'runtime-certbot',
+                    'runtime-acme-directory', 'runtime-data-directory', 'runtime-database-path']) has(tab, `id="${field}"`);
+assert.ok(!tab.includes('<form'), 'The System information page must be read-only');
+const admin = html.split('id="settings-page-administration"')[1].split('id="settings-page-system-info"')[0];
+assert.ok(!admin.includes('runtime-information-card'), 'Runtime data must be relocated, not duplicated');
+
+// Execute the real status-to-settings rendering code against a synthetic status payload.
+const code = js.slice(js.indexOf('    const runtime = latestStatus?.runtime || {};'), js.indexOf('    const policy = envelope.config.tls?', js.indexOf('    const runtime = latestStatus?.runtime || {};')));
+const elements = new Map();
+const dollar = id => { if (!elements.has(id)) elements.set(id, { textContent: '' }); return elements.get(id); };
+const status = {
+  version: '0.30.1', uptime_seconds: 4201,
+  runtime: {
+    platform: 'Linux', operating_system: 'Debian GNU/Linux 13', kernel_version: '6.12.0', architecture: 'x86_64',
+    statistics_source: 'systemstat+sysinfo', data_directory: '/var/lib/rustproxy', database_path: '/var/lib/rustproxy/config.sqlite3',
+    certificate_runtime: { status: 'ready', mode: 'managed', message: 'acme.runtime_ready',
+      python: true, pip: true, certbot: true, python_version: '3.13.5', pip_version: '25.2',
+      certbot_version: '5.8.0', managed_directory: '/var/lib/rustproxy/acme-python' }
+  },
+  system: { logical_cpus: 8, cpu_percent: 17.2, memory_total_bytes: 16_384, memory_used_bytes: 8_192,
+    process_rss_bytes: 2_048, system_uptime_seconds: 100, process_threads: 9, open_fds: 67 }
+};
+const context = {
+  latestStatus: status, $: dollar, locale: () => 'en-US',
+  t: key => ({ runtimeAvailable: 'Available', runtimeUnavailable: 'Unavailable',
+    certificateRuntimeManaged: 'App-managed Python', 'acme.runtime_ready': 'Ready', unavailable: 'N/A' })[key] || key,
+  bytes: value => `${value} B`, uptime: value => `${value}s`,
+};
+vm.runInNewContext(code, context);
+assert.equal(dollar('runtime-operating-system').textContent, 'Debian GNU/Linux 13');
+assert.equal(dollar('runtime-kernel-version').textContent, '6.12.0');
+assert.equal(dollar('runtime-version').textContent, '0.30.1');
+assert.equal(dollar('runtime-logical-cpus').textContent, '8');
+assert.equal(dollar('runtime-cpu-usage').textContent, '17.2%');
+assert.equal(dollar('runtime-python').textContent, 'Available · 3.13.5');
+assert.equal(dollar('runtime-pip').textContent, 'Available · 25.2');
+assert.equal(dollar('runtime-certbot').textContent, 'Available · 5.8.0');
+assert.equal(dollar('runtime-acme-directory').textContent, '/var/lib/rustproxy/acme-python');
+
+// A working ACME runtime can have no trustworthy version metadata on some OSes.
+elements.clear();
+vm.runInNewContext(code, { ...context,
+  latestStatus: { ...status, runtime: { ...status.runtime, certificate_runtime: {
+    ...status.runtime.certificate_runtime, python_version: null, pip_version: null, certbot_version: null
+  } } }
+});
+for (const field of ['runtime-python', 'runtime-pip', 'runtime-certbot']) {
+  assert.equal(dollar(field).textContent, 'Available');
+}
+
+// Status fields remain safely unavailable rather than displaying fake zeros.
+elements.clear();
+vm.runInNewContext(code, { ...context,
+  latestStatus: { runtime: { certificate_runtime: { status: 'unavailable', mode: 'none',
+    message: 'acme.runtime_python_missing', python: false, pip: false, certbot: false } }, system: {} }
+});
+for (const field of ['runtime-cpu-usage', 'runtime-logical-cpus', 'runtime-system-memory', 'runtime-python']) {
+  assert.ok(!/NaN|0 B/.test(dollar(field).textContent));
+}
+
+// Exercise real tab switching, deep-linking and search code without a browser.
+const entry = js.slice(js.indexOf('  const buttons ='), js.indexOf('  const cacheTabs ='));
+const buttons = ['administration', 'system-info', 'certificate-api'].map(name => ({
+  dataset: {settingsTab:name}, textContent:name, hidden:false, tabIndex:-1,
+  listeners:{}, setAttribute(name,value){this[name]=value;}, addEventListener(name,fn){this.listeners[name]=fn;}, focus(){} }));
+const pages = buttons.map(b => ({dataset:{settingsPage:b.dataset.settingsTab}, hidden:true,textContent:b.dataset.settingsTab}));
+const search={value:'',listeners:{},addEventListener(name,fn){this.listeners[name]=fn;}};
+const searchStatus={textContent:''};
+const loc = new URL('https://localhost/settings?tab=system-info');
+let lastUrl='';
+vm.runInNewContext(`(() => { ${entry} return true; })()`, {
+  document: {querySelectorAll: sel => sel === '[data-settings-tab]' ? buttons : pages,
+    querySelector: sel => pages.find(p => sel.includes(p.dataset.settingsPage))},
+  $: id => id === 'settings-search' ? search : searchStatus,
+  location: loc, history: {state:null,replaceState:(_state,_unused,url) => {lastUrl=url;}},
+  CSS:{escape:x=>x}, URL, URLSearchParams, t:x=>x,
+});
+buttons[1].listeners.click();
+assert.equal(pages[1].hidden,false);
+assert.equal(pages[0].hidden,true);
+assert.equal(buttons[1]['aria-selected'],'true');
+assert.equal(lastUrl,''); // Already at canonical deep link; no unnecessary history rewrite.
+buttons[0].listeners.click();
+assert.equal(pages[1].hidden,true);
+assert.equal(lastUrl,'/settings?tab=administration');
+
+const runtimeSchema = api.components.schemas.RuntimeInformation;
+for (const key of ['operating_system','kernel_version','architecture']) assert.ok(runtimeSchema.properties[key]);
+for (const key of ['python_version','pip_version','certbot_version']) {
+  assert.ok(runtimeSchema.properties.certificate_runtime.properties[key]);
+  assert.equal(runtimeSchema.properties.certificate_runtime.properties[key].nullable, true);
+}
+console.log('PASS: 0.30.1 legend palette, About cleanup, system tab/navigation, read-only API schema and simulated status rendering.');

tools/checks/system_info_no_subprocess_contracts.py

@@ -0,0 +1,40 @@
+#!/usr/bin/env python3
+"""Offline source guard for subprocess-free system information; not a Rust runtime test."""
+from pathlib import Path
+import tomllib
+
+ROOT = Path(__file__).resolve().parents[2]
+manifest = tomllib.loads((ROOT / 'Cargo.toml').read_text())
+for dependency in ('sysinfo', 'metrics-process'):
+    assert dependency in manifest['dependencies'], dependency
+sysinfo_features = manifest['dependencies']['sysinfo']['features']
+assert {'network', 'system'} <= set(sysinfo_features), (
+    'sysinfo::System and sysinfo::Networks require both system and network features'
+)
+assert any('systemstat' in target.get('dependencies', {}) for target in manifest.get('target', {}).values())
+
+status = (ROOT / 'src/admin/status.rs').read_text()
+assert 'sysinfo::System::long_os_version()' in status
+assert 'sysinfo::System::kernel_version()' in status
+assert 'std::sync::OnceLock' in status
+for forbidden in ('Command::', 'std::process::Command', '/etc/os-release', '/proc/sys/kernel/osrelease'):
+    assert forbidden not in status, f'Status OS identification cannot use {forbidden}'
+
+metadata = (ROOT / 'src/acme/runtime_versions.rs').read_text()
+for marker in ('pyvenv.cfg', '.dist-info', 'METADATA', 'MAX_VERSION_METADATA_BYTES', 'MAX_PACKAGES_PER_SITE', 'fn runtime_versions('):
+    assert marker in metadata, marker
+for forbidden in ('Command::', '.spawn(', 'version_token(', '"--version"', "'-c'", '.await'):
+    assert forbidden not in metadata, f'Diagnostic versions must not execute: {forbidden}'
+
+runtime = (ROOT / 'src/acme/runtime_env.rs').read_text()
+assert 'include!("runtime_versions.rs")' in runtime
+assert 'runtime_versions(&venv_python(&managed), true, Some(&venv_certbot(&managed)))' in runtime
+assert 'python_version: versions.python' in runtime and 'certbot_version: versions.certbot' in runtime
+assert 'path.with_extension("exe")' in runtime, 'Windows executable discovery must include .exe'
+
+regressions = (ROOT / 'src/acme/tests.rs').read_text()
+for marker in ('managed_python_pip_and_certbot_versions_use_metadata_only',
+               'absent_or_unverified_versions_are_not_invented',
+               'conflicting_site_distributions_do_not_return_stale_versions'):
+    assert marker in regressions, marker
+print('PASS: shared Rust libraries, portable OS detection, no diagnostic subprocesses, bounded metadata and source regressions.')