All mutations (setPolicy, setRateLimit, addMatcher) return a new FirewallConfig;
the original is never modified. Mirrors AclState's immutable-container shape.
Param: napplets
Per-napplet rule map keyed by dTag.
Param: matchers
Ordered list of content matchers (first-match wins).
Param: burstGuard
Global init-burst guard applied to all napplets.
Param: defaultRate
Global default token-bucket rate applied when no
napplet-specific rule matches.
Param: unfocusedMultiplier
Fractional multiplier (e.g. 0.25) that tightens
rate budgets for unfocused napplets (FOCUS-02).
Focus alone NEVER hard-blocks; it only scales tokens.
Complete firewall configuration — immutable container.
All mutations (setPolicy, setRateLimit, addMatcher) return a new FirewallConfig; the original is never modified. Mirrors AclState's immutable-container shape.
Param: napplets
Per-napplet rule map keyed by dTag.
Param: matchers
Ordered list of content matchers (first-match wins).
Param: burstGuard
Global init-burst guard applied to all napplets.
Param: defaultRate
Global default token-bucket rate applied when no napplet-specific rule matches.
Param: unfocusedMultiplier
Fractional multiplier (e.g. 0.25) that tightens rate budgets for unfocused napplets (FOCUS-02). Focus alone NEVER hard-blocks; it only scales tokens.