RustProxy 0.31.7 implementation and acceptance gate

Settings and vhost throttling

Settings → Rules & headers includes the Global User-Agent blocklist, Global custom headers, and Client response sections. Forms and request endpoints are unchanged, so there is no data migration. Settings → Security retains password, session and host-policy controls.
vhosts[].rate_limit.user_agent_limits is an optional list (default []) of {pattern, requests, window_seconds, burst}. At most 64 rules. Patterns use case-insensitive substring matching when no * is present, otherwise wildcard matching. Values are normalized and validated before persistence. The first matching rule has priority over the country override and base limiter for that request. No matching UA uses existing country/base behavior; missing UA does not select a UA override. Every vhost/UA rule/client IP has an independent fixed-window bucket within the shared 65,536-bucket cap. Cache, ACL, and global/vhost UA deny policies run with unchanged precedence.
Important: UA is client-supplied. These rules provide traffic shaping, not trustworthy identity or bot protection. An absent/changed/oversized UA may avoid matching. Use ACL and base limits for security enforcement.

Revision-history UI polish: comparison control sits under Restore without extra dividers; long change lists scroll within the bounded desktop detail pane, while the stacked narrow-screen layout scrolls as one modal. Full JSON comparison uses the shared dialog border and borderless code blocks.
Diff preview displays only changed leaf paths, sorted by object key. Array entries with stable id or name keys are compared by identity, avoiding spurious changes on reorder. Output is limited to 200 changes; large scalar previews truncate after 320 characters. The separate full JSON modal is opened explicitly and uses textContent, never HTML injection. Restore remains CAS-protected.
Listener protocol buttons have a gap and may wrap; ACL profile attachments are in a closed-by-default native <details> element.

update.sh executes installer/update first, then prunes under the existing .deploy.lock. It retains current and one other latest release; three private pre-update backups remain (separate retention). Old updater incorrectly passed find sort keys into rm paths, so it printed removals but removed nothing; fixed by splitting the mtime key before path validation/removal.
Cargo target is not cleared. Only directories under target/{debug,release}/incremental older than 30 days are eligible, and only if the corresponding Cargo profile lock is available and no symlinked target path is used. deps, .fingerprint, build, .cargo-lock, binaries and Cargo.lock are preserved. This cleanup does not promise meaningful disk recovery for release builds (incremental compilation is usually disabled for release mode).
Managed updates create .managed-update before systemctl stop, and the service checks it during graceful shutdown. With an enabled cold tier, it forces a best-effort hot-to-cold direct persistence independent of the ordinary cold_on_shutdown checkbox. systemd grants 120 seconds, and runtime allows up to 90 seconds for the transfer after draining. The reported moved count reflects successful COLD insertions rather than merely attempted writes. Entries may still fail to persist (I/O/disk limits/timeouts); verify logs and COLD objects in an actual update. Disabling COLD does not allow automatic persistence to disk.

Compile and run ./dev.sh check, ./dev.sh test and ./dev.sh release on Rust 1.99+ and verify the lockfile resolves. Do not call this release production-tested without those results.
Test Config revision CAS, UA matching and rate 429/Retry-After across two vhosts, clients, country policies and ordinary rate limits. Check /settings?tab=policies in EN/PL, including unsaved forms and the new full JSON modal.
On a staging installation with HOT+COLD enabled and cold_on_shutdown=false, cache a cacheable GET, run bash update.sh, confirm managed-update stop log and cold recovery after restart. Repeat rollback on a failed staged binary; backup retention must not remove the rollback candidate.
Verify releases/ retains current and one predecessor, backups still retain three; verify target/release/deps, .fingerprint, build and the compiled binary remain intact and next bash dev.sh release is incremental.
Re-test H3 logo navigation on iPhone and log regressions; prior H3/iOS acceptance is still open.

SQLite schema 9 and COLD format 3 unchanged. No persisted setting is removed; old JSON without the new user_agent_limits field still deserializes.