v4: a profile's lists of dumps can be narrowed to a category — /@name/dumps and /@name/upvoted showed every dump, with no way to see only those filed under one category, as the index can. The title row of each list now has the index's category menu, and the category picked goes in the URL as ?category=<slug>, which the other list keeps and every other tab drops (a path segment would collide with /@name/dumps/<slug>, a dump's own page). GET /api/users/:key/dumps and /upvoted take ?category= as the followed feed does, an unknown slug answering an empty list; resolveCategoryFilter moves to category-service.ts for both. useUserDumpFeed passes everything the socket changes through the category, so a dump edited out of it leaves and an upvote outside it doesn't come in. CategorySwitcher now reports the category picked to its owner (onSelect) instead of navigating to the index's path itself, and the divider after it in the index's tab row is drawn by CSS, so the profile gets none. useTabParam's setter takes the query string to go to, the current one by default.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

api/test/routes/users.test.ts

@@ -5,6 +5,7 @@ import {
   db,
   del,
   get,
+  insertCategory,
   insertDump,
   insertPlaylist,
   PASSWORD,
@@ -241,6 +242,59 @@ test("GET /api/users/:key/dumps and /upvoted respect privacy", async () => {
   assert((await get(`/api/users/@nobody_at_all/dumps`)).status === 404);
 });
 
+test("GET /api/users/:key/dumps and /upvoted filter by category", async () => {
+  const owner = await createUser();
+  const music = insertCategory({ slug: "music" });
+  const tagged = insertDump({
+    userId: owner.id,
+    title: "tagged",
+    createdAt: "2024-01-01T00:00:00Z",
+  });
+  const priv = insertDump({
+    userId: owner.id,
+    title: "priv",
+    isPrivate: true,
+    createdAt: "2024-01-02T00:00:00Z",
+  });
+  insertDump({ userId: owner.id, title: "untagged" });
+  for (const d of [tagged, priv]) {
+    db.prepare(
+      `INSERT INTO dump_categories (dump_id, category_id) VALUES (?, ?);`,
+    ).run(d.id, music);
+  }
+  db.prepare(
+    `INSERT INTO votes (dump_id, user_id, created_at) VALUES (?, ?, ?), (?, ?, ?), (?, ?, ?);`,
+  ).run(
+    tagged.id,
+    owner.id,
+    "2024-01-01T00:00:00Z",
+    priv.id,
+    owner.id,
+    "2024-01-02T00:00:00Z",
+    insertDump({ userId: owner.id, title: "voted" }).id,
+    owner.id,
+    "2024-01-03T00:00:00Z",
+  );
+  for (const sub of ["dumps", "upvoted"]) {
+    const titles = async (
+      query: string,
+      opts?: { auth: { Authorization: string } },
+    ) =>
+      (await get<PaginatedData<Dump>>(
+        `/api/users/@${owner.username}/${sub}${query}`,
+        opts,
+      )).data.items.map((d) => d.title);
+    assertEquals(await titles("?category=music"), ["tagged"], sub);
+    assertEquals(
+      await titles("?category=music", { auth: owner.auth }),
+      ["priv", "tagged"],
+      sub,
+    );
+    // An unknown category filters everything out rather than nothing.
+    assertEquals(await titles("?category=nope"), [], sub);
+  }
+});
+
 // ── Login and register ───────────────────────────────────────────────────────
 
 test("POST /api/sessions: right password logs in, wrong one doesn't say which", async () => {