Release 0.15.1 - #93

append, GroupSetCategory and GroupApplyCategory keep routing by the
configured category, but the facade now records the label the client
sent and reports it back in listgroups, history and listfiles while the
job still sits in that category. Clients that filter by an exact
category match no longer lose their jobs when the label differs in case
or is an alias.

…story(true)

…rom a kept failure kind

…in-path

…ensitively

…ters and retry to editqueue

…lient set

…kens on the facade

…and XML-RPC wide integers

…iles in use

A major upgrade ran the new package's InstallValidate while the old tray and
the server it supervises were still running, so Windows Installer raised the
"applications should be closed" prompt from a hidden msiexec window. In-app
and MSI upgrades looked frozen, and silent upgrades left the old binaries
running until reboot. The old product's StopTrayBeforeRemoval runs only after
that check. Locate the installed tray with AppSearch and ask it to shut down
before InstallValidate on upgrades; the shutdown command succeeds when no tray
is running and the existing removal actions stay as the fallback.

Same defect and fix as Scryer, where the upgrade with a running tray was
reproduced and the fixed package verified on a Windows 11 box.

RemoveTrayStartupBeforeRemoval ran whenever the product was removed, and a
major upgrade removes the old product as part of installing the new one, so
every upgrade silently dropped the user's HKCU Run entry. The tray only
registers that entry from its own menu toggle, so the preference was lost
until the user noticed and re-enabled it. Guard the action with
NOT UPGRADINGPRODUCTCODE, as the profile cleanup already is; the entry points
at the install path, which the upgrade keeps.

ST01 Usenet run over a laddered route against the proxy fixture, the same
run with the rung downed, and the run booked against a job on the same
route; ST02 the queue gate around a run; ST03 cancel. Registered as the
speed-test release phase after the four advanced-networking partitions.

…est posting

A fixturegen recipe reproducing the reference set from the generator's own
bytes under its file names: a 100,000,000-byte member and a one-line text
member in four 25 MiB RAR5 volumes (-m3, 32 MiB dictionary, quick-open
records) with a 200-block PAR2 set at a 50124-byte slice. Ledgered with
generated digests, added to the release-gate profile, and seeded by the
speed-test release phase at the reference's 716800-byte article size.

… root with Podman

Fixture seeding ran after the staged-flow dispatch, so a staged flow such as
speed-test never posted its SeedFixtures. Seed first, and leave the services
the seed brought up out of the host-port wait: their ports belong to this
stack, not a previous one, and the wait never ended.

The gate root was the literal /tmp, which a Podman machine does not share
with the host, so a file bind-mounted out of the run directory failed with
Not a directory. Resolve the root's symlinks so /tmp becomes /private/tmp.

The proxy fixture takes PROXY_FIXTURE_PUBLIC_TARGETS beside its fixture
destinations: hosts it answers for and forwards to. The relay keeps its
exclusive allowlist with publicOnly. The speed-test flow resolves
speed.cloudflare.com on the host and hands the fixture the addresses, so
Weaver resolves the name through the fixture and the rung carries the TLS
session out.

ST04 runs one stream of the largest size Cloudflare serves, checks the run
moved exactly those bytes through the proxy rung, that nothing went direct,
that the row and detail show it, and that no byte was booked as downloaded.

…umer

The direct store's -hp and -mhe header gates were offered the spec and NZB
candidates only, while finalize, probe, topology and nested extraction also
tried the global Settings list and the password file. A header-encrypted set
keyed only by a global password demoted and redownloaded to be opened by
finalize.

Pipeline::archive_password_candidates_for_job is now the single helper. It
returns the list (Explicit, NzbMeta, FilenameConvention, Settings,
PasswordFile, de-duplicated by value) with a completeness flag; the second
NZB-only helper is gone. The direct store keeps its per-job memo, so the
per-article path stays a map lookup, and caps what reaches a set's header
gate at MAX_DIRECT_HEADER_PASSWORD_CANDIDATES to bound KDF work.

ST05 two-leg split, leg down, all-down refusal, compare; ST06 seeded 100 MB
posting over a plaintext direct leg; ST07 failed NZB fetch; ST08 maximum
duration; ST09 server quota booking and refusal; ST03 also checks the
already-running refusal and the disabled Run button.

Edit buttons carry a pencil and paper, Remove and Delete the bin, and
Speed test the lightning bolt it has elsewhere; stored backups,
archive password clearing and key copying take the icons their actions
use elsewhere. The action columns widen to hold the icons on one line.

An egress is the way out to the internet, which a globe says better than
an ethernet port.

The routes actions were wider than their column, so the table scrolled
at every width. Stored backups take the compact buttons the other
settings tables use, and its actions column narrows to hold them.

The runs table holds the chosen route's runs, with no all-routes switch
or note. Compare appears once there are two runs to compare.

The Scripts menu reads Configuration, Secrets, Jobs, Runs.

The buttons on proxy and pool lines say Test, as the one that runs it
does, and keep their icon.

…ional chase

The positional chase looked for the password-required marker in the
header parse error's message, which carries no marker, so it never
retried an encrypted header with the job's password. The chase failed
and the set was extracted conventionally. The retry now reads the
error's class.

Enabled is its own column, keeping its switch. Speed test is a button,
and an Edit provider button opens the provider as a click on its row
does.

…er toggle

Provider, proxy, pool, egress and route rows each said what they edit; the row already says that, so the button reads Edit from one shared string. The action tracks shrink to the shorter buttons. Settings tables take a list of centred columns, and the Providers Enabled header and toggle use it.

…at copying requires

Every Weaver-authored source file now opens with an SPDX identifier and a copyright line pointing at the repository, as the GPL's own instructions recommend. SQL migrations, configuration, fixtures and vendored code are left as they were. AGENTS.md gains a section for agents reading Weaver from another project: what the license requires of code copied out of it, and the authors' request for credit.

…-rs 0.7.1

Sevenz comes from crates.io again, so the git pin to its pre-release
revision goes. 0.28 makes Error non-exhaustive and adds WriterPoisoned;
every match on it already ends in a wildcard, and its renderings of block
and checksum errors are unchanged, so the text adapters move to the 0.28
pin as they are.

…mber

The settings and password-file cases still expected the EncryptedContent
refusal, which the direct store stopped raising for AES over COPY when it
learned to route those members. They now assert what the NZB-meta case
does: the set is not demoted, and the member reaches the output.

cap-fs-ext's MetadataExt only offers dev/ino/nlink on Windows, so the
identity check did not compile there. The by-handle accessors come from
cap-primitives' _WindowsByHandle, now a Windows-only dependency.

…'s origin

An absolute dlURL or pingURL in the list replaced the HTTPS base the
entry was checked against. Both now must resolve to the base's origin;
an entry whose download does not is left out, and a ping that does not
is never sent.

…ned connection

A server whose connection count was lowered while the run prepared was
lent the smaller count, but its legs still opened the planned number,
outside the pool's budget. The run now fails with the lease refused.

Weaver shortens names past 240 bytes, replaces characters a filesystem
refuses and makes clashing names unique. The name the poster gave each
such file is now recorded in job metadata when the job is first built,
kept across restore, and exposed as HistoryItem.postedFileNames.

…ivery renames

The record now follows a file through every rename. PAR2 rebinds, the
settle before cleanup, finalize rename suggestions and post-repair
verification all update it, as does the delivery rename pass. Each entry
pairs the file's name in the output directory with the full name it was
given: SRRDB's or the job's for a delivery rename, PAR2's described name
otherwise, the posted name before either. Never the shortened or
sanitized form.

The field is fullFileNames { name fullName }. Every job build names its
files with the one submission parser, the 64 KiB cap counts the stored
JSON, History parses a row's metadata once and builds the field only
when asked for it, and only a redownload starts the record fresh.