NewzDeck v3.7.4

NewzDeck v3.7.4 - Release Hygiene & Publisher Reliability Maintenance

v3.7.4 is a narrow maintenance release built on the proven v3.7.3 runtime. It cleans up stale release-facing version text and corrects the guarded publisher checks that falsely reported failures after otherwise successful v3.7.3 publication.

Fixed

• Runtime-facing version fallbacks are coherent. The browser shell cache-buster/sidebar fallback, Automation engine default-version fallback, and tray helper's no-argument version fallback now identify v3.7.4 instead of retaining v3.7.0 text.
• SABCTools decoder wording is version-neutral. Current yEnc adapter/server documentation no longer describes the active SABCTools 9.6.3 integration as specifically belonging to v3.7.1.
• Publisher Pages monitoring follows the content/source commit. The guarded publisher now watches GitHub Pages for the actual source/content commit instead of incorrectly requiring a Pages deployment on the later trigger-only commit.
• Superseded Pages runs are tolerated correctly. An older cancelled Pages run no longer marks publication failed when a newer run for the same source commit succeeds.
• Release topology verification uses the immutable annotated tag. Final publication verification peels refs/tags/v3.7.4 to the source commit rather than treating GitHub Release target_commitish (which may legitimately be main) as the immutable source identity.
• Publisher diagnostics are current. Stale v3.7.2/v3.7.3 publisher labels and failure messages are replaced with v3.7.4/current-release wording.

Preserved

• The v3.7.3 managed About & Updates lifecycle and verified Setup handoff remain unchanged.
• In-process SABCTools 9.6.3 remains pinned to upstream commit 54d7663b9e8f527b5ab196d43f0d5c561a87c1ac.
• Private SABnzbd 5.1.2, Direct Unpack, PAR2/repair, article cache, async disk, queue behavior, Automation, Smart Import, Newsgroup Browser, Backup & Restore, and all twelve themes are unchanged.
• The retired standalone NewzDeckYenc.exe remains absent from new payloads.
• Existing settings, providers, queues, libraries, history, backups, and user data remain under the version-independent NewzDeck user-data directory.

Metadata Server remains v0.3.3 and Diagnostic Collector remains v1.0.31.

NewzDeck v3.7.3

NewzDeck v3.7.3 - Managed In-App Update Handoff Hotfix

v3.7.3 restores the seamless About & Updates installation lifecycle while preserving the v3.7.2 SABCTools/download architecture and Defender-compatible helper design.

Fixed

• One-click managed updates are restored. About & Updates launches the already SHA-256-verified Setup package using Inno Setup's /SILENT managed update path instead of opening the normal interactive installer wizard.
• NewzDeck closes before file overlay. During the managed in-app path, Setup asks the installed NewzDeck.exe --close-app-windows maintenance mode to close the browser-hosted NewzDeck UI before installation starts.
• Tray and service lifecycle remains Setup-owned. Setup captures the existing tray/service state, closes and waits for the tray process, stops and waits for the Windows service, overlays the new files, repairs/restarts the service, and restores the tray state.
• Silent managed updates reopen NewzDeck. The installer distinguishes About & Updates /SILENT /update from CI's /VERYSILENT /update smoke path, allowing the managed update to relaunch NewzDeck without causing CI smoke installs to launch the desktop application.
• No copied update coordinator returns. The Defender-sensitive v3.6.91 NewzDeckUpdateHandoff-*.exe architecture remains retired. The verified Setup executable itself owns the update transaction.
• Publisher Pages monitoring is corrected. The guarded publisher watches the Pages deployment for the final trigger commit, so a source-commit Pages run cancelled as superseded cannot falsely mark an otherwise successful release as failed.

Preserved

• In-process SABCTools 9.6.3 built from upstream commit 54d7663b9e8f527b5ab196d43f0d5c561a87c1ac.
• Private SABnzbd 5.1.2, Direct Unpack, PAR2/repair, article cache, async disk, queue behavior, Automation, Smart Import, Newsgroup Browser, Backup & Restore, and all twelve themes.
• The retired standalone NewzDeckYenc.exe remains absent from new payloads.
• Existing settings, providers, queues, libraries, history, and user data remain under the version-independent NewzDeck user-data directory.

Metadata Server remains v0.3.3 and Diagnostic Collector remains v1.0.31.

NewzDeck v3.7.2

NewzDeck v3.7.2 - Runtime Identity & Release Metadata Hotfix

v3.7.2 is a focused hotfix for the v3.7.1 native-decoder release. It preserves the proven SABCTools 9.6.3 decoder architecture and corrects release/runtime identity that was inconsistent in v3.7.1.

Fixed

• Download-engine version coherence: server.py, sab_engine.py, app.js, version.txt, and build-manifest.json now all identify the same v3.7.2 runtime. This removes the false background runtime is from a different version warning caused by v3.7.1 shipping ADAPTER_VERSION = "3.7.0" in the otherwise-v3.7.1 payload.
• Direct source identity: the public server.py and app.js now contain the actual shipped runtime source instead of retaining v3.7.0 blobs and transforming them only during packaging. The current builder no longer invokes the v3.7.1 runtime transformer.
• Release surfaces: the GitHub README, website fallback release labels, update notes, Windows build documentation, and source/release history now advance with the current release.
• Pages publication path: the guarded publisher uses ordinary single-ref main pushes again, so GitHub's managed pages build and deployment workflow receives the same branch-push signal used by prior releases.
• SABCTools notices: bundled SABCTools 9.6.3 is documented explicitly as GPL-2.0-or-later and the GPL-2.0 license text is carried in licenses/SABCTOOLS-LICENSE.md.

Preserved

• In-process SABCTools 9.6.3 built from upstream commit 54d7663b9e8f527b5ab196d43f0d5c561a87c1ac for NewzDeck's CPython 3.12.10 runtime.
• The split NNTP fetch/decode pipeline and bulk-Python emergency yEnc fallback.
• Private SABnzbd 5.1.2, Direct Unpack, PAR2/repair, article cache, async disk pipeline, queue behavior, Background Service, tray companion, Automation, Smart Import, Newsgroup Browser, Backup & Restore, and all twelve themes.
• Removal of NewzDeckYenc.exe from new payloads plus upgrade cleanup of stale copies from older installations.

Metadata Server remains v0.3.3 and Diagnostic Collector remains v1.0.31; neither component changes in this hotfix.

NewzDeck v3.7.1

NewzDeck v3.7.1 — Native Decoder Integration & Defender Compatibility

NewzDeck v3.7.1 replaces the standalone NewzDeckYenc.exe subprocess used by queued Usenet downloads with an in-process SABCTools decoder while preserving the proven v3.7.0 network, queue, cache, disk, SABnzbd, Direct Unpack, Automation, Backup & Restore, and UI architecture.

Highlights

• No shipped NewzDeckYenc.exe: the Defender-sensitive standalone Go yEnc helper is no longer built into the Portable ZIP or Setup payload.
• In-process SABCTools 9.6.3: the production workflow builds the exact upstream SABCTools 9.6.3 source at commit 54d7663b9e8f527b5ab196d43f0d5c561a87c1ac for NewzDeck's pinned CPython 3.12.10 runtime and vendors that native package directly with NewzDeck.
• Preserved high-speed split pipeline: NNTP socket reads remain separate from decode work, so provider connections can refill while native yEnc decoding occurs on the existing decode executor.
• Emergency compatibility fallback: if the vendored native decoder cannot load or rejects an article, NewzDeck falls back to the existing bulk-Python yEnc implementation instead of failing the download outright.
• Upgrade cleanup: Setup still terminates a legacy NewzDeckYenc.exe process if an older install left one running, then explicitly deletes the retired binary before overlaying v3.7.1.

Validation

The release workflow refuses publication unless all of the following pass on Windows Server 2022:

• Python 3.12.10 is active.
• SABCTools source resolves to exact version 9.6.3 at the pinned upstream commit.
• A cp312-win_amd64 SABCTools wheel builds successfully.
• The wheel imports from an isolated target and reports version 9.6.3.
• Synthetic yEnc articles covering escaped bytes and a ~700 KiB article decode correctly with CRC validation.
• Concurrent native decode succeeds with eight worker threads.
• The Portable ZIP contains the vendored SABCTools package and does not contain NewzDeckYenc.exe.
• The final Setup and Portable checksums validate before publication.
• A clean Setup smoke installation contains the SABCTools native extension and no retired yEnc helper.

Performance basis

Before the production integration, the same NewzDeck decoder adapter was benchmarked on the target Windows machine under NewzDeck's exact CPython 3.12.10 runtime using the last official CPython 3.12 SABCTools Windows wheel. It sustained roughly 250–303 MiB/s across 1–12 workers with zero decode failures, providing substantial headroom over NewzDeck's established ~90–100 MB/s real-world Usenet target. v3.7.1 does not rely on that older wheel: the release pipeline builds and validates exact SABCTools 9.6.3.

Preserved behavior

This release intentionally leaves the following systems on their v3.7.0 behavior:

• provider connection management and 40–55+ connection workloads;
• queue refill/backpressure logic;
• article cache and asynchronous disk writes;
• Direct Unpack and post-processing;
• private SABnzbd 5.1.2 engine ownership;
• Newsgroup Browser and preview/recovery paths;
• Automation, Smart Import, Calendar and Wanted behavior;
• Backup & Restore and library sorting;
• tray, launcher, service, picker and thumbnail helper architecture;
• all twelve UI themes.

Defender note

The original problem was a Microsoft Defender machine-learning detection against the small standalone NewzDeckYenc.exe helper. v3.7.1 removes that executable from newly published artifacts and from upgraded installations rather than attempting another fingerprint-only rebuild of the same helper architecture.

NewzDeck v3.7.0

NewzDeck v3.7.0 — Production Milestone & Repository Hygiene

NewzDeck v3.7.0 promotes the proven v3.6.99 application to the 3.7 production milestone.

This release is intentionally conservative: the installed application's feature set and runtime behavior are preserved from v3.6.99 while the public repository, release workflow, and source/build documentation are cleaned up so 3.7 starts from one clear production baseline.

Production milestone

• Backup & Restore remains intact: v3.6.99 Configuration Backup, password-encrypted Complete Backup, transactional restore, pre-restore safety snapshots, legacy compatibility, and cross-PC path safety are unchanged.
• Automation sorting remains intact: v3.6.96 A/An/The-aware TV and Movie library sorting is unchanged and displayed titles are never renamed.
• Themes remain intact: all twelve themes and the Light/Arctic/Sandstone readability corrections are unchanged.
• Runtime behavior remains intact: Newsgroup Browser, Downloads, Smart Import, Automation search/grab/import behavior, private SABnzbd 5.1.2, Metadata Server v0.3.3, and Diagnostic Collector v1.0.31 are unchanged.
• Defender-clean native/update architecture remains intact: folder-only Picker, accepted yEnc build profile, checksum-verified Setup updater, launcher-owned browser close, and installer-owned runtime restoration are unchanged.

Repository hygiene

• Single authoritative production workflow: the obsolete duplicate .github/workflows/windows-release.yml manual workflow is removed. .github/workflows/publish-release-trigger.yml is the only production Windows publication workflow and continues to run the complete protected regression/build/smoke-test gate.
• Current Windows build documentation: release/windows/README.md now documents the trigger/source topology, pinned toolchain, protected yEnc build, and canonical production release process instead of directing contributors to the retired manual workflow.
• Current source-tree documentation: src/README.md is version-independent, no longer describes the current tree as “For v3.5.33,” and no longer links to the nonexistent docs/RELEASE_COMPLIANCE.md.
• Version-neutral third-party notices: THIRD_PARTY_NOTICES.md keeps the same current component versions and license references while removing stale v3.6.93-specific wording.
• Historical provenance retained: historical release notes, .release-trigger records, regression guards, source-releases/, licensing records, and source-release history remain in the repository because they are active provenance or release-safety records rather than redundant files.

Release gate

The v3.7.0 regression guard verifies that the installed-app behavior remains on the v3.6.99 baseline except for required version/cache identity, that styles/themes and protected native/update sources are unchanged, that the obsolete duplicate workflow is absent, that source/build/licensing documentation has been cleaned up, and that the canonical workflow runs the full historical chain plus the v3.7.0 guard.

NewzDeck v3.6.99

NewzDeck v3.6.99 — Final UX & Backup/Restore

NewzDeck v3.6.99 is the final pre-v3.7 product-polish release built on the proven v3.6.96 production baseline. Its substantive addition is a portable Settings and Automation backup/restore workflow designed for recovery and moving NewzDeck to another Windows PC without copying transient runtime state.

Backup & Restore

• Configuration Backup: one-click portable backup of NewzDeck settings, provider definitions, bookmarks/browser state, saved searches, Automation TV/Movie library, monitoring, root folders, quality profiles, indexer definitions, and Automation configuration. Passwords and API keys are omitted.
• Complete Backup: includes provider passwords, indexer API keys, and a configured user TMDB key inside a password-encrypted .newzdeck-backup file.
• Client-side encryption: Complete Backup uses AES-256-GCM with PBKDF2-SHA-256 and 600,000 iterations. The backup password is used only in the NewzDeck browser UI and is never posted to the backend.
• Validated restore: encrypted backups are authenticated/decrypted before restore; the backend validates backup schema and required sections before changing configuration.
• Transactional safety: NewzDeck automatically writes a local pre-restore snapshot, pauses Automation mutation with existing locks, and rolls configuration back if restore fails.
• Cross-PC path safety: an unavailable backed-up Download or NZB Watch Folder does not replace the working path on the destination PC. Automation media-root paths are retained so disconnected drives can later return online.
• Secret handling: Configuration Backup preserves matching credentials already present on the restore PC; Complete Backup re-protects imported credentials with Windows DPAPI. NewzDeck metadata-service installation identity is never exported or imported.
• Runtime state excluded: active downloads, SAB queue/runtime ownership, download payloads, caches, thumbnails, logs, diagnostics, Automation runtime locks/reservations, and metadata caches are not part of a portable backup.
• Legacy restore: earlier NewzDeckConfigBackup JSON files remain accepted as configuration-only restores.

Final UX consistency

• Backup & Restore is now a first-class Settings category instead of being buried in Advanced.
• Backup types clearly explain what is and is not included.
• Restore presents backup type/content before confirmation and reports cross-PC path warnings after completion.
• Existing application styling and all twelve themes remain unchanged.

Preserved production baseline

• v3.6.96 article-aware A/An/The sorting for Automation TV and Movie libraries is unchanged.
• All v3.6.95 light-theme readability fixes and all twelve themes are unchanged.
• Newsgroup Browser, Downloads, Smart Import, Automation searching/grabbing/import behavior, private SABnzbd 5.1.2, Metadata Server v0.3.3, and Diagnostic Collector v1.0.31 are unchanged.
• The Defender-clean folder-only Picker, accepted yEnc helper, direct checksum-verified Setup updater, and installer-owned runtime restoration architecture are unchanged.

Release gate

The v3.6.99 regression guard verifies secret-free configuration export, client-side authenticated encryption markers, transactional restore/rollback, legacy-backup compatibility, runtime-state exclusions, v3.6.96 sorting preservation, immutable theme payloads, and the protected Defender-sensitive native/update architecture.

NewzDeck v3.6.96

NewzDeck v3.6.96 - Library Article-Aware Sorting

NewzDeck v3.6.96 is a narrow presentation-order update built on the proven v3.6.95 production baseline. It changes only how TV Shows and Movies are alphabetized in the Automation library.

Changed

• Leading articles no longer control library placement. A title beginning with A, An, or The is sorted using the next word.
• A Knight of the Seven Kingdoms sorts under K (Knight).
• The Legend of Vox Machina sorts under L (Legend).
• An American... sorts under A (American).
• Article matching is case-insensitive and requires a complete leading word followed by whitespace, so titles such as Theodore and Annihilation are unaffected.
• The title shown on cards and throughout NewzDeck remains exactly the original title; this does not rename media, folders, or metadata.

Preserved

• TV and Movie libraries continue to use the same deterministic comparator, with the full title, year, and media id retained as tie-breakers.
• All twelve themes and the v3.6.95 light-theme readability fixes are unchanged.
• No Automation monitoring, Wanted, Smart Import, Discover, Newsgroup Browser, Downloads, post-processing, SABnzbd, metadata, or library naming behavior is changed.
• The Defender-clean folder-only Picker, accepted yEnc helper, direct checksum-verified Setup updater, and installer-owned runtime handoff are unchanged.
• Metadata Server remains v0.3.3 and Diagnostic Collector remains v1.0.31.

Release-gate additions

• The release gate verifies article-aware sorting examples and confirms visible titles are unchanged.
• The v3.6.95 stylesheet/theme payload and protected native/update architecture are frozen.

NewzDeck v3.6.95

NewzDeck v3.6.95 - Light Theme Readability Hotfix

NewzDeck v3.6.95 is a presentation-only follow-up to v3.6.94. It fixes the three light palettes without changing application layout, behavior, backend settings, Automation, downloading, updater ownership, or native helper behavior.

Fixed

• Light, Arctic, and Sandstone controls are readable throughout the app. Search fields, selectors, toolbars, tabs, cards, panels, and other UI surfaces that inherited the old Night-style overlay role now derive from each light theme's coordinated light surfaces.
• True overlays stay intentionally dark. Modal backdrops, the fullscreen media viewer, image/poster badges, media action buttons, play overlays, and poster gradients use a separate dark scrim role with high-contrast foreground colors.
• Placeholder text in the three light themes now follows the readable muted-text role.

Preserved

• Night, Midnight, Ocean, Emerald, Amethyst, Rosewood, Sunset, Graphite, and Aurora palettes are unchanged from v3.6.94.
• Night still reconstructs the exact v3.6.93 production stylesheet colors.
• The 12-theme Settings selector, immediate preview, Save/Cancel behavior, local-only persistence, and pre-paint restore remain unchanged.
• No layout, font, sizing, spacing, Automation, Wanted, Smart Import, Discover, Newsgroup Browser, Downloads, post-processing, or SABnzbd behavior changes are included.
• The Defender-clean folder-only Picker, accepted yEnc helper, direct checksum-verified Setup updater, installer-owned runtime handoff, Metadata Server v0.3.3, and Diagnostic Collector v1.0.31 are preserved.

Release-gate additions

• The nine dark theme palette blocks are frozen to their v3.6.94 identities.
• Light, Arctic, and Sandstone must use light surface semantics for generic overlay-derived UI and separate scrim semantics for true overlays.
• Light-theme text/control and scrim contrast is validated before publication.

NewzDeck v3.6.94

NewzDeck v3.6.94 - Themes & Color Schemes

NewzDeck v3.6.94 adds a presentation-only theme system built on the Defender-clean v3.6.93 production baseline. No application layout, sizing, spacing, download behavior, Automation logic, updater architecture, or native-helper behavior is intentionally changed.

Added

• Adds twelve selectable color themes: Night, Light, Midnight, Ocean, Emerald, Amethyst, Rosewood, Sunset, Arctic, Graphite, Sandstone, and Aurora.
• Adds Settings > General > Theme with immediate preview.
• Theme choice is persisted locally only after Settings is saved. Closing or cancelling Settings restores the previously saved theme.
• Restores the saved theme in the document head before render-blocking stylesheets load so light themes do not flash the Night palette at startup.
• Light, Arctic, and Sandstone use native light color-scheme; the remaining themes use dark color-scheme.

Color-system safeguards

• Night is the exact v3.6.93 appearance. Existing v3.6.93 stylesheet colors are wrapped in semantic theme variables with the original literal as the fallback. The v3.6.94 regression guard reconstructs the prior stylesheet from those fallbacks and requires an exact SHA-256 match.
• Hard-coded stylesheet colors are routed through semantic background, surface, border, text, accent, status, overlay, and shadow roles so alternate themes recolor the whole application rather than only buttons or highlights.
• Alternate palettes are release-gated for readable contrast. Primary and secondary text, muted text, accent contrast, and success/warning/danger colors must meet the defined contrast floors before publication.
• The theme preference is intentionally presentation-only localStorage state and is not added to /api/settings or backend configuration.

Preserved

• v3.6.93 Defender-clean NewzDeckPicker.exe folder-only scope and normal-Go-metadata build profile.
• The accepted yEnc helper source/build pipeline and pinned binary identity.
• Direct checksum-verified Setup updates and installer-owned runtime shutdown/restore.
• The corrected inert Picker-lock installed-upgrade smoke test from v3.6.93.
• Automation, Wanted, Smart Import, Discover, Newsgroup Browser, Downloads, post-processing, SABnzbd 5.1.2, Metadata Server v0.3.3, and Diagnostic Collector v1.0.31.

NewzDeck v3.6.93

NewzDeck v3.6.93 - Defender Handoff Release Gate Recovery

NewzDeck v3.6.93 is a release-pipeline recovery roll-forward built on the reviewed v3.6.92 source state. The v3.6.92 source/tag was published immutably, but its canonical GitHub Actions run stopped at the installed-upgrade smoke test before GitHub Release assets were published.

Fixed

• Repairs the installed-upgrade smoke test so it no longer invokes NewzDeckPicker.exe --taskbar-fix, a mode intentionally removed when v3.6.92 reduced Picker to folder selection only.
• The smoke test now replaces the clean-install Picker with a purpose-built inert legacy-lock stand-in, starts that process, and proves Setup terminates/replaces a locked NewzDeckPicker.exe during upgrade.
• Adds a v3.6.93 regression guard that rejects any return of the retired Picker taskbar/update modes and requires the corrected legacy-lock smoke strategy.

Preserved

• v3.6.92 application behavior is unchanged apart from version identity.
• NewzDeckPicker.exe remains folder-picker-only and keeps normal Go metadata (-H windowsgui).
• About & Updates launches the checksum-verified Setup directly; no NewzDeckUpdateHandoff-*.exe copy is created.
• Setup continues to own service/tray shutdown and restore, while NewzDeck.exe --close-app-windows handles the bounded browser-window close after overlay.
• Automation, Wanted, Smart Import, Discover, Newsgroup Browser, downloads, SABnzbd 5.1.2, Metadata Server v0.3.3, Diagnostic Collector v1.0.31, and the Defender-accepted yEnc pipeline are unchanged.

Release history note

v3.6.92 remains an immutable source tag with a failed canonical release run and no GitHub Release assets. v3.6.93 is the clean roll-forward rather than moving or rewriting that tag.