Stub-archive rule: 100 MB cap on every leg, ROT13 volume names are volumes

The first five hours in production (LOG.md (128)) dropped 522 passworded
videos of one a.b.erotica poster: ROT13-named volumes (".cnegN.rar" is
".partN.rar") of 1-270 MB in 258 kB articles to two groups, which the
article-size leg took for stubs. The cap that X and W already had now
applies to A as well (the catalog sample has 6 A-leg hits over 100 MB,
4 of them exe-only), and a ROT13 volume name is no single archive.

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>

lib/rules/rule_set.ts

@@ -31,10 +31,10 @@ export interface Rules {
    */
   droppedPosters: string[]
   /**
-   * Drop settled releases of one unsplit archive without a par2, posted to 2+ groups, whose articles are at most
-   * STUB_ARTICLE_BYTES with the release at least STUB_MIN_BYTES, or posted to 4+ groups, or by a webmail poster, the
-   * last two under STUB_MAX_BYTES: the exe-stub and recycled-installer floods under film and software names (55%
-   * of the catalog on 2026-10-30; 99.3% of the known fakes, 0 known content; LOG.md (123)-(126)).
+   * Drop settled releases of one unsplit archive without a par2, posted to 2+ groups, under STUB_MAX_BYTES, whose
+   * articles are at most STUB_ARTICLE_BYTES with the release at least STUB_MIN_BYTES, or posted to 4+ groups, or by
+   * a webmail poster: the exe-stub and recycled-installer floods under film and software names (55% of the catalog
+   * on 2026-10-30; 99.3% of the known fakes, 0 known content; LOG.md (123)-(126), (128)).
    */
   dropStubArchives: boolean
   /**
@@ -87,7 +87,8 @@ const SIDECAR = /\.(par2|nfo|sfv|txt|jpe?g|png|nzb)$/i
 const EXECUTABLE = /\.(exe|scr|com|pif|bat|cmd|vbs|lnk)\s*$/i
 /** One zip, rar or 7z that is not a volume of a set. */
 const ARCHIVE = /\.(zip|rar|7z)$/i
-const VOLUME = /\.(part\d+\.rar|r\d\d|z\d\d|7z\.\d\d\d|\d\d\d)$/i
+/** "cneg" is "part" in ROT13: the a.b.erotica posts named that way are volumes of passworded videos (LOG.md (128)). */
+const VOLUME = /\.((part|cneg)\d+\.rar|r\d\d|z\d\d|7z\.\d\d\d|\d\d\d)$/i
 /** A poster at a free mail provider: the stub floods' throwaway accounts. */
 const WEBMAIL = /@(gmail|googlemail|yahoo|hotmail|outlook|live|msn|aol|gmx|web|t-online|freenet|mail|yandex|icloud|me|hushmail|protonmail|libero|orange|free|arcor|wanadoo|ymail|rocketmail|inbox|mail\.ru|bk|list)\./i
 /** A name that reads as a release: a year, a scene tag, a group suffix or dotted words. */
@@ -106,17 +107,17 @@ function singleArchive(files: JudgedFile[]): JudgedFile | null {
 }
 
 /**
- * The legs of the stub-archive rule a settled single archive trips: "A" (articles <= STUB_ARTICLE_BYTES, release >=
- * STUB_MIN_BYTES: a one-article release always has small articles, so e-books and sidecars are exempt), "X" (4+
- * groups) and "W" (webmail poster), the last two under STUB_MAX_BYTES (the fakes stop at ~90 MB; hash-named uploads
- * and real albums above it don't). Empty when none.
+ * The legs of the stub-archive rule a settled single archive under STUB_MAX_BYTES (the fakes stop at ~90 MB;
+ * hash-named uploads, real albums and passworded videos above it don't) trips: "A" (articles <= STUB_ARTICLE_BYTES,
+ * release >= STUB_MIN_BYTES: a one-article release always has small articles, so e-books and sidecars are exempt),
+ * "X" (4+ groups) and "W" (webmail poster). Empty when none.
  */
 export function stubArchiveLegs(f: JudgedFile): string {
-  if (f.groups.length < 2 || f.groups.some((g) => STUB_EXEMPT_GROUPS.test(g))) return ''
+  if (f.groups.length < 2 || f.bytes >= STUB_MAX_BYTES || f.groups.some((g) => STUB_EXEMPT_GROUPS.test(g))) return ''
   let legs = ''
   if (f.bytes / Math.max(f.segments, 1) <= STUB_ARTICLE_BYTES && f.bytes >= STUB_MIN_BYTES) legs += 'A'
-  if (f.groups.length >= STUB_WIDE_GROUPS && f.bytes < STUB_MAX_BYTES) legs += 'X'
-  if (f.bytes < STUB_MAX_BYTES && WEBMAIL.test(f.poster)) legs += 'W'
+  if (f.groups.length >= STUB_WIDE_GROUPS) legs += 'X'
+  if (WEBMAIL.test(f.poster)) legs += 'W'
   return legs
 }