[kayurachann]

Stacked on #1 (feature/auto-update-and-audit-fixes). Merge #1 first; this PR's diff is only the commit on top.

Summary

Step 1 of the roadmap in the new MV3 limits research: make the MV3 compilers honest about what they drop, and fix filters that compiled into the wrong rule.

Stock lists (build time)

• Unsupported filters are reported instead of dropped silently. The build log said Unsupported: 0 for all 55 lists. With the current snapshot, 1,213 filters in 32 lists are reported, per list and per reason, in log.txt and ruleset-details.json:
  • about 1,155 are valid filters that DNR cannot express (for example $redirect-rule 530, entity or regex hostnames 337);
  • 58 are invalid filters that uBlock Origin rejects too.
• validate-mv3 rejects a package whose reported counts do not match its rulesets.
• ##^responseheader() now removes headers from the responses of the named hostnames, with exceptions, as in uBlock Origin. It used to key on the initiator (verified on Chrome 153).
• removeparam=~name is reported instead of becoming a rule that never matches.
• Every redirect resource the compilers can emit is packaged. click2load.html cannot work through DNR and is reported as unavailable.

Imported lists and My filters (runtime)

• $requestheader is rejected. It used to become an unconditional block, or an unconditional allow for @@.
• @@…$uritransform=… is rejected. It compiled into a real redirect and skipped the trusted-source check, so an untrusted imported list could redirect a site's URLs.
• $empty/$mp4 redirect like stock lists instead of blocking every request type.
• A bare $removeparam clears the query; it used to do nothing.
• Also fixed: $permissions joining, a dropped important, $to replacing the hostname pattern, and $removeparam page-load rules widening to every page of domain= sites (both compilers).
• The compiled-cache revision goes to 4, so imported lists recompile once with the fixed rules.

Dashboard

Each stock list's tooltip now counts the filters actually converted (uBlock filters: 7,847, not 10,498) and adds a line with the number that could not be converted, in the 10 maintained languages.

Docs

• New docs/MV3-LIMITS-RESEARCH-2026-09-24.md (Vietnamese). It covers:
  • what cannot be done in Google Chrome at all;
  • the Standard / Experimental / Firefox tiers;
  • measurements on Chrome 153 (classic engine readiness, memory, per-request cost);
  • an 11-step roadmap.
• Stale statements corrected in FEATURE-MATRIX, MV3-PARITY-IMPLEMENTATION, EXPERIMENTAL-WEBREQUEST and ROADMAP. CHANGELOG.md has an Unreleased section.

Not yet done (documented)

• Negated entity or regex hostnames in stock filters (187 filters) are still dropped silently, which widens those rules.
• There is no per-reason view of rejected filters in the dashboard.

Testing

• New test-stock-compiler-honesty and test-runtime-filter-options. Both were shown to fail on the previous code, file by file, and pass now.
• npm test: 66/66 test programs pass. npm run lint and npm run lint:all are clean.
• Standard and Experimental builds pass validate-mv3 --release (55 rulesets, 70,310 DNR rules).
• Compared with the previous build, the emitted rules change only where intended: 2 negated removeparam rules removed, the responseheader rules re-keyed, and 3 over-broad removeparam page-load rules dropped.
• The responseheader and redirect-resource fixes were checked in Chrome 153 with temporary profiles. The real-Chrome auto-update end-to-end test still passes.

🤖 Generated with Claude Code