Download Weather Station

Fixed

• The privileged helper now admits staged plugin sources from every real Weather Station data directory (packaged, dev, and canary). Helpers shipped between 0.7.x and 0.8.0 required a directory name no build ever used, so every privileged install or update failed and was misreported as "preserved recovery data". A parity gate now fails the build if the app's data-directory names and the helper's admission list ever diverge.
• Helper failures now carry their machine-readable code end to end. Validation refusals and helper version mismatches report actionable guidance instead of the recovery banner, recovery state is only entered for genuine recovery evidence, and staged downloads are cleaned up after non-recovery failures.
• The helper advertises its admitted data-directory roots on every capability probe. An app updated in place that is still paired with an older or mismatched helper shows the repair notice directing to the signed installer instead of failing at the next install.
• Portrait plugin artwork (such as Barometer's) now renders fully visible in catalog cards instead of being cropped to the card's 16:9 frame.

Security

• Plugin installation and removal now use one authenticated, versioned transaction owned by the main process and privileged helper. Requests bind the exact product, artifact, target set, peer, sequence, and durable receipt before filesystem effects can complete.
• Legacy privileged copy, remove, and directory effects are denied. Missing, outdated, malformed, or incompatible helpers fail closed instead of falling back to a weaker installation path.
• The renderer can no longer select download URLs, extraction paths, install destinations, or arbitrary external navigation targets for plugin operations.
• Interrupted installs and removals retain bounded recovery evidence and converge to the verified prior state, the verified requested state, or an explicit repair-required state.
• Paid-plugin activation is now one authenticated, owner-bound operation. Electron main owns machine identity, receipt verification, crash-recoverable publication, and authoritative Activation readback; the renderer receives no License key, receipt, signature, or MachineId authority.
• Renderer-controlled manual key validation, generic receipt writing, and raw receipt scanning are removed. Canonical per-product v3 receipts are verified before publication and legacy receipt files are compatibility projections only.
• Receipt publication now rejects forged, partial, wrong-product, wrong-machine, symlinked, nonregular, escaped, or improperly permissioned inputs before any authority file is replaced. Interrupted multi-file publication recovers to one verified predecessor or successor rather than a mixed receipt set.
• Paid activation and refresh responses are fenced by the originating authenticated session and operation generation. A stale refresh cannot delete a newer activation receipt or republish receipt authority after deactivation.
• Paid-license operation references are bound to the originating renderer, authenticated session generation, product, operation kind, and operation generation. Foreign or stale observers fail before backend, receipt, or filesystem effects.

Changed

• macOS users with an outdated or missing helper now see a proactive repair notice with a bounded link to the signed Weather Station installer. Settings, licenses, and downloads remain in place during repair.
• Weather Station now uses helper protocol v2 and requires the matching 0.8.0 signed package for the one-time macOS helper transition.
• Background paid-license synchronization is refresh-only: it cannot create or reactivate a machine slot. Incomplete receipt refreshes remain retryable and are no longer silently marked complete for the session.
• Paid plugin activation is initiated from the owned License shown in Account. Weather Station performs the owner-bound activation and authoritative readback without exposing or requiring License-key copy and paste.
• Packaged qualification uses a distinct canary URL scheme, user-data directory, and License-data directory. Production builds reject the canary receipt-root override.

Fixed

• Identity-null macOS packages are ad-hoc signed at electron-builder's final afterSign boundary, preventing later bundle finalization from leaving local 0.8.0 and canary artifacts vulnerable to macOS 26 Code Signature Invalid termination.
• The first background paid-license refresh in a process now uses the same default operation epoch at dispatch and completion, so a successful owner-bound refresh publishes its verified receipt instead of being falsely discarded as superseded.
• Per-License operation generations now prevent stale refresh responses from deleting a newer activation receipt or republishing authority after current-machine deactivation.
• Closing and reopening a licensed plugin UI, and reopening a saved DAW session in a fresh host process, now continue to use the protected receipt without repeatedly presenting the License modal.
• Browser sign-in handoff calls now have an explicit deadline, so an unavailable authentication bridge cannot leave Weather Station waiting indefinitely.
• Paid-license operations now have a main-process authority deadline in addition to renderer wait deadlines. A hung operation releases its capacity with a retryable result, and a late completion cannot replace that terminal outcome.
• Update checks now remain single-flight, stop cleanly during shutdown, and ignore completions from a superseded controller generation.