TautWeekly for Plex v0.18.3

v0.18.3 makes Manager preview and delivery failures actionable without
retaining private renderer output. Windows, NAS/Docker, macOS, native Linux,
and FreeBSD packages now return one fixed, allowlisted stage category alongside
the existing sanitized support code. The Manager can distinguish package-lock,
configuration, Tautulli, Direct Plex, media-asset, HTML-render, preview-output,
SMTP, and generic renderer failures and shows a bounded recovery step for each.

The result contract still excludes configuration values, credentials, private
addresses, user identities, media titles, command lines, exception messages,
and stdout/stderr. Successful and partial operations retain no failure category.
Older category-free failure results remain readable during upgrade recovery.

Service-package lock behavior

GUI-triggered operations on NAS/Docker, macOS, native Linux, and FreeBSD now
make one non-blocking attempt at the shared renderer lock. If a scheduled
delivery, update, or terminal operation owns the package, Manager reports
Operation busy immediately instead of waiting 30 seconds and returning an
opaque renderer failure. The host CLI, scheduler, updater, shutdown grace, and
package ownership boundaries keep their existing bounded waits.

Windows already used an operating-system-held nonblocking renderer lock. The
same categorized result contract now identifies the fixed stage of a Windows
renderer failure. Operators should never delete a lock file; ownership is
determined by the live file handle.

Browser console clarification

The preview iframe remains script-disabled and sandboxed. Browser messages that
scripts were blocked in that frame are expected and do not indicate a renderer
failure. content-script.js, ObjectMultiplex, and listener-limit warnings are
extension/tooling messages rather than package-renderer evidence. The preview
sandbox was not weakened.

Update existing installations

Back up private data, then use the documented update path for the installed
package. No configuration migration is required. Existing credentials,
schedules, custom text cards, generated previews, backups, history, Tailscale
settings, Manager access settings, package ownership, and recovery behavior
remain unchanged.

Validation

The release is covered by Manager contract and operation tests for allowlisted
failure categories, rejection of unknown/private result fields, service lock
exit mapping, immediate GUI lock contention, and legacy result compatibility.
Renderer integration, package routing, shell and PowerShell validation,
cross-builds, all maintained package archives, reproducibility, checksums,
privacy, accessibility, production and synthetic GUI JavaScript, and release
publication are validated by the release workflow.