docs: explain provider infrastructure request blocking

Author: riderx

apps/docs/src/content/docs/docs/plugins/updater/commonProblems.mdx

@@ -15,6 +15,20 @@ When an update check fails, Capgo usually returns an `error` code and a `message
 
 ## Common failure codes
 
+### `provider_infrastructure_request_blocked`
+
+**Cause**
+
+The app has **Block provider infrastructure requests** enabled and the request originated from a known Google or Apple datacenter IP range. Capgo blocks these requests on `/updates`, `/stats`, and `/channel_self` to prevent provider-originated traffic from being treated as device traffic.
+
+**Fix**
+
+- Reproduce the update from a physical device on a normal user network.
+- Do not use cloud-hosted probes or provider datacenter runners for updater, stats, or channel-self checks while this protection is enabled.
+- If that traffic is intentional, open your app's **Information** tab and turn off **Block provider infrastructure requests**. Re-enable it when the test is complete.
+
+New apps have this protection enabled by default. Apps created before the setting was introduced keep it disabled until you enable it.
+
 ### `disable_auto_update_to_major`
 
 **Cause**

apps/docs/src/content/docs/docs/plugins/updater/debugging.mdx

@@ -29,6 +29,16 @@ Capgo detected traffic that looks like it comes from Google or cloud infrastruct
 
 Ignore this on real users. Retry from normal networks and real devices, or wait and check again later.
 
+### `provider_infrastructure_request_blocked`
+
+**What it means**
+
+Your app is configured to block requests from known Google and Apple datacenter IP ranges. The protection applies to update checks, stats, and channel-self requests, so cloud-hosted probes and provider runners can receive this response even when the app configuration is otherwise valid.
+
+**What to do**
+
+Retry from a physical device on a normal user network. If the provider-originated traffic is intentional, temporarily disable **Block provider infrastructure requests** in the app's **Information** tab, then enable it again after the test. New apps enable this setting by default; existing apps retain their previous disabled setting until changed.
+
 ### `needPlanUpgrade`
 
 **What it means**

apps/docs/src/content/docs/docs/webapp/logs.mdx

@@ -165,6 +165,7 @@ These codes come from the `stats_action` enum used by the dashboard API (`capgo/
 | Code | Why this happens | What to do next |
 |------|------------------|-------------|
 | `invalidIp` | Capgo detected traffic that looks like bot traffic (Google/cloud infrastructure IP). | Ignore on real users; retry from real devices and normal networks, or check after some time. |
+| `provider_infrastructure_request_blocked` | The app blocks requests from known Google or Apple datacenter IP ranges. | Retry from a physical device on a normal user network. If provider-originated traffic is intentional, temporarily disable **Block provider infrastructure requests** in the app's Information tab. |
 | `needPlanUpgrade` | Organization reached plan/device limit. | Upgrade plan in dashboard or wait for next billing cycle. |
 | `semver_error` | Native app version in config is missing or not valid semver (`x.y.z`). | Set `plugins.CapacitorUpdater.version` to valid semver, then verify it in the [SemVer tester](https://capgo.app/semver_tester/) and rebuild the app. |
 | `disablePlatformIos` | iOS is disabled in channel policy. | If this was accidental, enable iOS in that channel and republish routing. If you intentionally block iOS in this track, keep it off and move iOS builds to a separate channel. |
@@ -202,8 +203,7 @@ These codes come from the `stats_action` enum used by the dashboard API (`capgo/
 | `cannotUpdateViaPrivateChannel`, `NoChannelOrOverride`, `channelMisconfigured` | Channel selection or override failed |
 | `missingBundle`, `cannotGetBundle` | Manifest refers to a bundle Capgo cannot serve |
 | `needPlanUpgrade` | Org hit its plan/device limit |
-| `rateLimited` | Too many requests; SDK throttles until restart |
-| `blocked_by_server_url`, `backend_refusal`, `invalidIp` | Server-side rule blocked the request |
+| `blocked_by_server_url`, `backend_refusal`, `invalidIp`, `provider_infrastructure_request_blocked` | Server-side rule blocked the request |
 
 **Download / integrity / install failures**
 

apps/docs/src/content/docs/docs/webapp/main-app-page.mdx

@@ -56,6 +56,7 @@ Here's a breakdown of the available fields and actions:
 *   **Default Download Channel (6):** Specifies the default channel from which devices will download updates. You can click the edit icon to select a different default channel. See the [Default Channel Configuration](#default-channel-configuration) section below for detailed information.
 *   **Auto Delete Bundles Not Used (after x seconds) (7):** This setting allows you to automatically delete old bundles that haven't been used for a specified duration (in seconds). Set to `0` to disable auto-deletion. This helps manage storage and keep your bundle list clean.
 *   **Expose Bundle Metadata to Plugin (8):** When enabled, bundle link and comment fields will be sent to the Capacitor Updater plugin. This feature requires plugin version 7.35.0 or higher.
+*   **Block Provider Infrastructure Requests:** When enabled, Capgo rejects update, stats, and channel-self requests from known Google and Apple datacenter IP ranges. Leave it enabled for normal production traffic. Disable it temporarily only when you intentionally test from provider infrastructure. New apps enable this protection by default; existing apps retain their previous disabled setting until you change it.
 *   **Transfer App Ownership (9):** This section provides an option to initiate the transfer of your application to a different organization you are a part of.
 *   **Delete App Button:** Permanently deletes your application from Capgo. This action is irreversible and will remove all associated data, bundles, channels, and devices.
 *   **Update Button:** Saves any changes you've made to the editable fields on this page (e.g., App Name, Default Upload Channel, Auto Delete Bundles setting).