pmtiles-swarm 0.4.4 → 0.4.6

package/CHANGELOG.md

@@ -7,6 +7,46 @@
 ### 🐞 Bug fixes
 - _...Add new stuff here..._
 
+## 0.4.6
+### ✨ Features and improvements
+- **A feed's categories are a list, and are called categories.** The console offered a single
+  "Tag as" string while the configuration has always accepted `categories` as a list — one
+  concept under two names across two editors. It is now the same Categories column a watched
+  folder has. An existing `"category": "openmaptiles"` still works and needs no migration.
+  Everything user-facing now says category rather than tag, including the `%G` placeholder's
+  description and the API table.
+
+### 🐞 Bug fixes
+- **Saving in the console no longer deletes settings it does not show.** Each record was rebuilt
+  from the rendered columns alone, so every field without a column was dropped the first time
+  anyone pressed Save — a watched folder's `pieceLength`, `stabilitySeconds`, `trackers` and
+  `sparse`, a subscription's `savePath`. Nothing warned, because from the console's side the
+  save succeeded. Each row now remembers the entry it was rendered from and a save starts from
+  that, overlaying the columns; an emptied box still removes its field, since that is an
+  instruction rather than a gap.
+
+## 0.4.5
+### 🐞 Bug fixes
+- **A hook whose command could not be started is tried again.** Completion is recorded before
+  the command runs, so that a six-hour build is not started six times over — but a command that
+  never launched has not started anything, and keeping the record meant fixing the path and
+  still never seeing it run. The archive was permanently, silently done. A failure to spawn now
+  hands the record back; a command that ran and failed keeps it, because retrying that every
+  minute is how a broken build becomes a broken loop. A spawn failure also raised two accounts
+  of itself on some platforms — the real error, then a nonsense exit code — and only the first
+  stands now.
+
+### 📚 Documentation
+- **The service guide is organised around the thing that actually costs an afternoon.**
+  Permissions were spread across three sections and `ReadWritePaths` was explained twice, in
+  neither place completely. There is now one **Where it writes** section built on the fact that
+  three separate things decide whether a write succeeds — the filesystem bits, the group the
+  process actually holds, and `ReadWritePaths` — that each refuse on their own and all fail
+  identically. It also covers creating the archive directory, which was never mentioned even
+  though `savePath` is the entry most often missing from `ReadWritePaths`; why `chmod -R` is
+  the wrong tool, since on a directory the execute bit is the search bit; `SupplementaryGroups=`
+  for when a group will not appear; and that `PrivateTmp=true` hides a hook's lock and log.
+
 ## 0.4.4
 ### 🐞 Bug fixes
 - **The console no longer claims an `.incomplete` file that is not there.** The marker was a

package/README.md

@@ -587,7 +587,7 @@ matters there is `maxConnections`, since every peer holds a NAT table entry. See
 | `GET` | `/api/torrents/:infoHash/peers`, `/trackers`, `/content` | Per-peer, per-tracker and per-file detail |
 | `GET` | `/api/torrents/:infoHash/pieces` | Which pieces are held, how rare each is, and what peers hold |
 | `PATCH` | `/api/torrents/:infoHash/mode` | Switch between mirror and cache |
-| `PATCH` | `/api/torrents/:infoHash/categories` | Set, add or remove tags |
+| `PATCH` | `/api/torrents/:infoHash/categories` | Set, add or remove categories |
 | `PATCH` | `/api/torrents/:infoHash/seeding` | Per-archive seeding limit, or "use the global one" |
 | `PATCH` `GET` | `/api/torrents/:infoHash/location` | Move the data; poll the move |
 | `POST` | `/api/torrents/:infoHash/pause`, `/resume` | Stop offering it, without forgetting it |
@@ -599,7 +599,7 @@ matters there is `maxConnections`, since every peer holds a NAT table entry. See
 | `POST` | `/api/check-origins` | Check every archive with a watchable source |
 | `GET` `DELETE` | `/api/adds` | Downloads still in flight, and cancelling one by URL |
 | `GET` `POST` | `/api/speed` | Which speed limits are in force, and the manual switch between the two sets |
-| `GET` | `/api/categories` | Every tag, with the endpoints resolving to its newest build |
+| `GET` | `/api/categories` | Every category, with the endpoints resolving to its newest build |
 | `POST` | `/api/adopt`, `/api/adopt/candidates` | Take over what an engine or another node holds |
 | `POST` | `/api/sources/preview` | What a watched web location would take, without taking it |
 | `POST` | `/api/subscriptions/preview` | Whether a peer is reachable and what it offers |

package/docs/running-as-a-service.md

@@ -1,8 +1,14 @@
 # Running as a systemd service
 
-Setting up the account, then the unit. Two lines in that unit are not optional,
-and one line most people copy from elsewhere should be deleted — the rest is
-ordinary.
+Setting up the account, then the unit, then the directories it writes to.
+
+Two lines in that unit are not optional and one line most people copy from
+elsewhere should be deleted, but neither is what costs the afternoon. That is
+**permission to write**, which here means three separate things that all have to
+agree: the filesystem bits, the group the process actually holds, and
+`ReadWritePaths`. Any one of them says no on its own, and the failure looks the
+same each time — so [Where it writes](#where-it-writes) is worth reading before
+the first archive rather than after.
 
 ## An account of its own
 
@@ -46,6 +52,24 @@ Generate the key rather than inventing one:
 node -e "console.log(require('crypto').randomBytes(32).toString('base64url'))"
 ```
 
+### Where the archives go
+
+Wherever `savePath` points, and it is rarely under `/var/lib` — archives are
+measured in hundreds of gigabytes and usually live on their own mount. Make it
+before the first download, owned by the service:
+
+```sh
+sudo install -d -o pmtiles-swarm -g pmtiles-swarm -m 0755 /mnt/store/torrent-data
+```
+
+`0755` rather than `0750` because it leaves the option of serving those files
+over HTTP later; `0750` if you would rather they stay private. Nothing in
+pmtiles-swarm depends on which you choose.
+
+A directory this account owns outright needs nothing further. One that another
+service also writes to is a different job — see
+[a folder shared with another service](#a-folder-shared-with-another-service).
+
 ## Node, and the package
 
 Node from your distribution or NodeSource — the package needs `^22.13.0 || 24`:
@@ -160,18 +184,27 @@ TimeoutStopSec=45
 # descriptors of its own.
 LimitNOFILE=65535
 
-# The archives and the sidecar are the only things it needs to touch.
+# Everything else is read-only inside this unit's namespace.
 ProtectSystem=strict
 ProtectHome=read-only
 PrivateTmp=true
 NoNewPrivileges=true
-# Both, since the console rewrites the configuration when a token is minted.
+
+# The starting pair: /var/lib for the data directory, /etc because the console
+# rewrites the configuration when a token is minted. Anywhere else the
+# configuration points — savePath above all — has to be added here or the write
+# is refused whatever its permissions say. See "Where it writes".
 ReadWritePaths=/var/lib/pmtiles-swarm /etc/pmtiles-swarm
 
 [Install]
 WantedBy=multi-user.target
 ```
 
+`PrivateTmp=true` is worth one more note, because it surprises people writing
+hooks: the service gets its own `/tmp`, so a script that keeps a lock or a log
+there is invisible from a normal shell, and a run started by hand cannot see the
+lock a hook run holds. Have hooks log somewhere real.
+
 ## The two lines that matter
 
 **`Restart=always`, not `on-failure`.** The console's *Save & Restart* applies
@@ -189,61 +222,95 @@ while the Python sidecar kept running and kept the data directory locked.
 
 Leave `KillMode` at its default, so the sidecar goes with its parent.
 
-## Paths
+## Where it writes
 
-Every path in the configuration resolves **relative to the configuration
-file**, not to the working directory:
+Three separate things decide whether the service can write to a directory, and
+**each can refuse on its own**. A permission problem, a group problem and a
+namespace problem all produce the same symptom — an operation that silently does
+nothing, or a hook that exits 1 with no output — so it is worth confirming all
+three rather than guessing between them.
+
+### 1. The paths in the configuration
+
+Every path resolves **relative to the configuration file**, not to the working
+directory:
 
 ```
 /etc/pmtiles-swarm/swarm.config.json     with "dataDir": "./data"
   -> /etc/pmtiles-swarm/data
 ```
 
-That is usually not what you want for a service. Use absolute paths for
-anything that holds data:
+That is rarely what you want for a service. Use absolute paths for anything
+holding data:
 
 ```json
 {
   "dataDir": "/var/lib/pmtiles-swarm",
-  "savePath": "/var/lib/pmtiles-swarm/archives",
+  "savePath": "/mnt/store/torrent-data",
   "libtorrent": { "resumeDir": "/var/lib/pmtiles-swarm/resume" }
 }
 ```
 
-`ProtectSystem=strict` makes the whole filesystem read-only apart from what
-`ReadWritePaths` names, so every one of those has to be listed. An archive
-directory on another mount needs its own entry.
+### 2. Every one of them in `ReadWritePaths`
+
+`ProtectSystem=strict` presents the whole filesystem as read-only inside the
+unit's namespace. The refusal happens **there, before any permission bit is
+consulted** — so a directory whose ownership and mode are perfect still fails if
+it is not named here.
+
+List every directory the configuration points at, plus anywhere a hook writes:
+
+```ini
+ReadWritePaths=/var/lib/pmtiles-swarm /etc/pmtiles-swarm   /mnt/store /mnt/work/planetiler
+```
+
+`ReadWritePaths=` is a list: repeated assignments **merge** rather than replace,
+whether in the unit itself or in a drop-in from `systemctl edit pmtiles-swarm`.
+So a drop-in adds to what the unit already names. An empty assignment on its own
+line is the only thing that resets it.
+
+The one to forget is `savePath`, because it is usually on another mount and
+nothing complains until a download starts — at which point a torrent that cannot
+write fails in a way that reads like a network problem.
+
+### 3. Permission on the directory itself
 
-## Sharing a folder with another service
+A directory this account owns needs nothing beyond
+[the setup above](#where-the-archives-go). A shared one does.
+
+### A folder shared with another service
 
 A folder produced by something else — a generation script, or a directory a
-torrent client already owns — needs three things, and group membership is only
-the first of them.
+torrent client already owns — takes three steps, and group membership is only
+the first:
 
 ```sh
 # 1. Put the service account in the owning group.
 sudo usermod -aG qbittorrent-nox pmtiles-swarm
 
 # 2. Give that group write, and setgid so new entries inherit it.
-sudo find /mnt/hd-16TB/store/generated -type d -exec chmod 2775 {} +
-sudo find /mnt/hd-16TB/store/generated -type f -exec chmod 664 {} +
+sudo find /mnt/store/generated -type d -exec chmod 2775 {} +
+sudo find /mnt/store/generated -type f -exec chmod 664 {} +
 
-# 3. Make what the service creates group-writable too.
-sudo systemctl edit pmtiles-swarm
-sudo systemctl restart pmtiles-swarm
+# 3. Make what this service creates group-writable too, then restart.
+sudo systemctl edit pmtiles-swarm     # [Service] / UMask=0002
+sudo systemctl daemon-reload && sudo systemctl restart pmtiles-swarm
 ```
 
-Step 3 opens an override; the two lines to put in it are:
+**A folder at 0755 gives the group `r-x`.** Membership alone buys read access and
+nothing else — enough to hash and seed an archive, not enough for anything that
+writes. So this looks like it worked right up until the first thing that does.
 
-```ini
-[Service]
-UMask=0002
-```
+The `2` in `2775` is setgid, and it is what stops this drifting: without it a
+file the service creates belongs to group `pmtiles-swarm`, the other service
+cannot touch it, and you are back here in a month. `UMask=0002` is the same
+thought for the mode — without it a new file is `0644` and the other account can
+delete it but not modify it.
 
-**A folder at 0755 gives the group `r-x`.** Membership alone buys read access
-and nothing else, which is enough to hash and seed an archive and not enough to
-do anything else with the folder — so this looks like it worked until the first
-thing that writes.
+Split by type rather than using `chmod -R`. On a **directory** the execute bit
+is the search bit: it permits resolving a path *through* the directory, so
+removing it leaves a folder whose contents you can list and not one of which you
+can open. Files should lose it; directories must not.
 
 Three features want write, and it is worth knowing which, because a read-only
 folder is a perfectly reasonable way to run:
@@ -254,33 +321,38 @@ folder is a perfectly reasonable way to run:
 | `keep`, `keepDays` | Deletes retired builds |
 | `onComplete` | Whatever the script does, since it runs as this account |
 
-Renaming and deleting need write on the **directory**, not on the file, which is
-why the directory bits are the ones that matter. `UMask=0002` matters for the
-other direction: without it a file the service creates is `0644`, and the other
-service can delete it but not modify it.
+Renaming and deleting need write on the **directory**, not on the file — which is
+why the directory bits are the ones that matter, and why a build written under a
+temporary name and renamed into place works with directory write alone.
+
+### Two checks that lie
+
+**`id pmtiles-swarm`** reads `/etc/group` and shows the new group the instant
+`usermod` returns, whether or not the running process has it. Supplementary
+groups are read when a process starts, so the restart is not optional — and this
+is what proves it:
+
+```sh
+grep -E '^(Uid|Gid|Groups)'   /proc/$(systemctl show -p MainPID --value pmtiles-swarm)/status
+getent group qbittorrent-nox      # is that GID in the Groups line above?
+```
 
-**Group membership is read when a process starts**, so the restart is not
-optional. Neither is `ReadWritePaths`: `ProtectSystem=strict` presents the rest
-of the filesystem as read-only inside the unit's namespace, and the write is
-refused there before the permission bits are consulted. Every folder outside
-`/var/lib/pmtiles-swarm` has to be named, in a drop-in from
-`systemctl edit pmtiles-swarm`:
+If it is missing even after a restart, name it outright rather than relying on
+how systemd resolves groups when `User=` and `Group=` are both set:
 
 ```ini
-[Service]
-ReadWritePaths=/mnt/store/generated /mnt/work/planetiler
-UMask=0002
+SupplementaryGroups=qbittorrent-nox
 ```
 
-`ReadWritePaths=` accumulates, so a drop-in adds to what the unit already lists
-rather than replacing it.
+**`sudo -u pmtiles-swarm touch …`** runs outside the unit's namespace, so it
+succeeds on permission bits alone while the service is still being refused by
+`ProtectSystem`. It can prove a permission problem; it cannot clear one.
 
-Two things that look like checks and are not. `id pmtiles-swarm` reads
-`/etc/group` and shows the new group the instant `usermod` returns, whether or
-not the running process has it — read `/proc/$(systemctl show -p MainPID --value
-pmtiles-swarm)/status` instead. And `sudo -u pmtiles-swarm touch …` runs outside
-the unit's namespace, so it succeeds on permissions alone while the service is
-still being refused.
+What the running service actually has:
+
+```sh
+systemctl show -p ReadWritePaths -p UMask -p SupplementaryGroups pmtiles-swarm
+```
 
 ## The sidecar
 
@@ -371,3 +443,21 @@ Then check it is actually serving:
 curl -fsS localhost:8090/feed.xml >/dev/null && echo "public surface ok"
 curl -fsS localhost:8091/api/status | head -c 200
 ```
+
+And that it can write where it is supposed to, which nothing above proves:
+
+```sh
+systemctl show -p ReadWritePaths -p UMask -p SupplementaryGroups pmtiles-swarm
+grep -E '^Groups' /proc/$(systemctl show -p MainPID --value pmtiles-swarm)/status
+```
+
+Two things that go wrong quietly rather than loudly, and are worth confirming
+once rather than diagnosing later:
+
+* An archive that re-hashes its whole store on every start means resume data is
+  not being written. There should be one file per torrent in `resumeDir` within
+  `resumeSaveIntervalSeconds` of a start.
+* A hook that never seems to run. It logs what it launched and why it stopped —
+  `journalctl -u pmtiles-swarm | grep -i onComplete` — and a hook redirecting its
+  own output to a file will have nothing for the journal to show, which is not
+  the same as not having run.

package/docs/subscribing.md

@@ -156,7 +156,7 @@ the peer's to retract:
 Provenance is what makes this possible: an archive records which subscription
 sent it, and only that subscription can ever propose removing it.
 
-## Sharing only what you tag
+## Sharing only what you categorise
 
 Category feeds let a *subscriber* narrow what it takes. They do not narrow what
 you publish: `/feed.xml` carries the whole catalogue, so a peer who could follow

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "pmtiles-swarm",
-  "version": "0.4.4",
+  "version": "0.4.6",
   "description": "BitTorrent distribution for PMTiles map archives: create torrents, watch folders, publish and subscribe to RSS feeds, and seed through qBittorrent or an embedded client",
   "type": "module",
   "main": "src/index.js",

package/src/api.js

@@ -843,7 +843,7 @@ export function createApp({
   // Tags, after the fact. They could only be set when an archive was added,
   // which is the wrong moment to have to know: a build becomes "weekly" when
   // there is a second one, and an archive is marked for sharing long after it
-  // arrives. Accepts a whole list, or add/remove for one tag at a time.
+  // arrives. Accepts a whole list, or add/remove for one category at a time.
   app.patch(
     '/api/torrents/:infoHash/categories',
     route(async (req, res) => {
@@ -1426,7 +1426,7 @@ export function createApp({
   /**
    * Whether an archive may leave this node, for this caller.
    *
-   * Any tag matching is enough. A tag names one thing an archive is, not the
+   * Any category matching is enough. A category names one thing an archive is, not the
    * whole of what it is, so a planet build tagged both "basemaps" and "weekly"
    * belongs in a basemaps feed whether or not weekly is also published.
    * @param {object} entry - Catalog entry.

package/src/catalog.js

@@ -34,7 +34,7 @@ import path from 'node:path';
  * them. Accepts the older single `category` string so catalogues written before
  * tagging keep working — they are read as a list of one.
  * @param {object} source - Anything with `categories` and/or `category`.
- * @returns {string[]} - Sorted, de-duplicated, non-empty tags.
+ * @returns {string[]} - Sorted, de-duplicated, non-empty categories.
  */
 export function normalizeCategories(source) {
   const raw = [
@@ -117,7 +117,7 @@ export class Catalog {
    * @returns {CatalogEntry[]} - Matching entries.
    */
   byCategory(category) {
-    // Any match, not all: a tag names one thing an archive is, and asking for
+    // Any match, not all: a category names one thing an archive is, and asking for
     // "terrain" should find everything tagged terrain whatever else it is.
     return this.list().filter((entry) =>
       normalizeCategories(entry).includes(category),

package/src/config.js

@@ -643,7 +643,7 @@ const DEFAULTS = {
    *   }
    *
    * Placeholders match a torrent client's, so an existing script keeps working:
-   * %N name, %L first category, %G all tags, %F content path, %D save path,
+   * %N name, %L first category, %G all categories, %F content path, %D save path,
    * %Z size, %C file count, %I infohash.
    *
    * Command and arguments are separate rather than one string a shell pulls

package/src/hooks.js

@@ -31,7 +31,7 @@ const TAIL_LINES = 20;
  * The set mirrors a torrent client's, so an existing script keeps working:
  *
  *   %N name          %I infohash      %F content path
- *   %L category      %G tags          %D save path
+ *   %L category      %G categories    %D save path
  *   %Z size          %C file count
  *
  * @param {string} argument - An argument possibly containing placeholders.
@@ -169,9 +169,25 @@ export class ProgramHooks {
 
       this.#running.add(entry.infoHash);
       fired.push(entry);
-      this.#fire('onComplete', entry).finally(() =>
-        this.#running.delete(entry.infoHash),
-      );
+      this.#fire('onComplete', entry)
+        .then(async (result) => {
+          // Recorded before running so a six-hour build is not started six
+          // times over — but a command that never launched has not started
+          // anything, and keeping the stamp would mean fixing the path and
+          // still never seeing it run. That one case is given back.
+          if (result?.started === false) {
+            await this.#library.catalog.put({
+              infoHash: entry.infoHash,
+              completedAt: null,
+            });
+            console.warn(
+              `[hook] ${entry.name}: the command never started, so this will ` +
+                'be tried again on the next sweep',
+            );
+          }
+        })
+        .catch(() => {})
+        .finally(() => this.#running.delete(entry.infoHash));
     }
 
     return fired;
@@ -237,7 +253,13 @@ export class ProgramHooks {
         stream?.on('data', collect);
       }
 
-      const report = (problem) => {
+      // A failure to spawn raises 'error' and then, on some platforms, 'close'
+      // with a nonsense exit code — so the first account of what happened is
+      // the true one and the second is noise.
+      let reported = false;
+      const report = (problem, started = true) => {
+        if (reported) return;
+        reported = true;
         if (problem) {
           console.error(`[${label}] ${entry.name}: ${problem}`);
         } else {
@@ -248,12 +270,14 @@ export class ProgramHooks {
         for (const line of tail) {
           if (line.trim()) console.log(`[${label}]   ${line}`);
         }
-        resolve();
+        resolve({ started });
       };
 
       // A command that could not be started at all — no such file, not
-      // executable — never reaches 'close'.
-      child.on('error', (error) => report(error.message));
+      // executable, a working directory that is not there — never reaches
+      // 'close'. Reported as not started, which is what lets the caller try
+      // again: this is a configuration to fix, not a job that ran and failed.
+      child.on('error', (error) => report(error.message, false));
       child.on('close', (code, signal) => {
         if (signal) return report(`killed by ${signal}`);
         report(code === 0 ? undefined : `exited with code ${code}`);

package/src/subscriptions.js

@@ -346,7 +346,7 @@ export class SubscriptionManager {
    */
   async #add(item, subscription) {
     const options = {
-      // A subscriber may file a peer's archives under its own tags; failing
+      // A subscriber may file a peer's archives under its own categories; failing
       // that, whatever the peer tagged them with comes across.
       categories:
         subscription.categories ??

package/src/web/index.html

@@ -357,7 +357,7 @@
           addressed by its infohash — which is what makes a tile immutable and
           cacheable for a year — so a style pointed at one is pinned to that
           build forever. These endpoints always resolve to the newest archive
-          carrying the tag.
+          carrying the category.
         </div>
         <div id="category-list"></div>
         <div class="empty" id="categories-empty" hidden>
@@ -543,8 +543,8 @@
             <button type="button" id="add-category">Add</button>
           </div>
           <div class="sub">
-            An archive can carry several. Feeds include anything tagged with
-            the category asked for.
+            An archive can carry several. Feeds include every archive
+            carrying the category asked for.
           </div>
         </div>
 
@@ -2327,6 +2327,11 @@
         const { into, key, title, blurb, columns, rows, restart, preview, peerPreview, footnote } =
           spec;
         rowEditorColumns[key] = columns;
+        // Kept so a save can put back what this editor never showed. An entry
+        // holds more than there are columns for it — a watch folder's
+        // pieceLength, a subscription's savePath — and a save that rebuilt each
+        // record from the columns alone deleted every one of them.
+        rowEditorRows[key] = rows;
         const panel = document.createElement('div');
         panel.className = 'panel';
         panel.style.marginBottom = '1rem';
@@ -2368,8 +2373,8 @@
             }
           </td>`;
 
-        const rowHtml = (row = {}) => `
-          <tr>
+        const rowHtml = (row = {}, index) => `
+          <tr${index === undefined ? '' : ` data-origin="${index}"`}>
             ${columns.map((column) => cell(column, row[column.field])).join('')}
             <td>
               ${preview ? '<button type="button" data-act="preview">Preview</button>' : ''}
@@ -2392,7 +2397,9 @@
                   <th></th>
                 </tr>
               </thead>
-              <tbody>${[...rows, {}].map((row) => rowHtml(row)).join('')}</tbody>
+              <tbody>${[...rows, {}]
+                .map((row, index) => rowHtml(row, index < rows.length ? index : undefined))
+                .join('')}</tbody>
             </table>
           </div>
           <div style="margin-top:0.5rem">
@@ -2492,11 +2499,19 @@
        * @param {object[]} columns - Column definitions.
        * @returns {object} - The record.
        */
-      function readRow(row, columns) {
-        const record = {};
+      function readRow(row, columns, original = {}) {
+        // Starts from what was there. The editor shows the fields worth
+        // offering, not every field an entry may hold, and rebuilding from the
+        // columns alone silently dropped the rest.
+        const record = { ...original };
         for (const column of columns) {
           const raw = row.querySelector(`[data-field="${column.field}"]`)?.value.trim() ?? '';
-          if (!raw) continue;
+          // Emptied on purpose is still an instruction, so the field goes
+          // rather than the original value surviving underneath it.
+          if (!raw) {
+            delete record[column.field];
+            continue;
+          }
           if (column.list) {
             record[column.field] = raw
               .split(',')
@@ -2527,8 +2542,19 @@
         for (const [key, columns] of Object.entries(specs)) {
           const panel = document.querySelector(`[data-row-editor="${key}"]`);
           if (!panel) continue;
+          const originals = rowEditorRows[key] ?? [];
           const records = [...panel.querySelectorAll('tbody tr')]
-            .map((row) => readRow(row, columns))
+            .map((row) => {
+              // A row added in the console has no original; one rendered from
+              // the configuration is matched back to it, so a removed row takes
+              // its own hidden fields with it and the others keep theirs.
+              const origin = row.dataset.origin;
+              return readRow(
+                row,
+                columns,
+                origin === undefined ? {} : (originals[Number(origin)] ?? {}),
+              );
+            })
             .filter((record) => record[columns[0].field]);
           updates[key] = records;
         }
@@ -3022,6 +3048,9 @@
       // ── Settings ──────────────────────────────────────────────────────────
       let restartKeys = new Set();
       let rowEditorColumns = {};
+      // What each editor was rendered from, so a save can put back the fields
+      // it never showed.
+      let rowEditorRows = {};
 
       async function loadSettings() {
         const { config, restartRequired, configPath } = await api('/api/config');
@@ -3080,6 +3109,7 @@
         // are lists of small records, which is exactly what a torrent client
         // gives a grid for, and what a textarea full of braces is worst at.
         rowEditorColumns = {};
+        rowEditorRows = {};
         await renderTokenEditor(body);
         renderHookEditor(body, config, restartKeys);
 
@@ -3352,7 +3382,12 @@
               placeholder: '1',
               number: true,
             },
-            { field: 'category', label: 'Tag as', placeholder: 'from-peer' },
+            {
+              field: 'categories',
+              label: 'Categories',
+              placeholder: 'from-peer, planet',
+              list: true,
+            },
             { field: 'filter', label: 'Name filter', placeholder: 'terrain' },
             { field: 'token', label: 'Token', placeholder: 'if issued one', secret: true },
             {