ProtonBridge v1.1.8-rc.1

1.1.8-rc.1 — consistent Proton checksums, working filters and fork cleanup

Proton revision consistency

• Pin rclone to f1d1627e.
  Resolve authenticated detailed metadata before bisync captures its listing and
  pre-copy result records. Revision history can identify the correct revision
  while supplying attributes that disagree with the subsequent detailed download
  response. Previously, opening that download could change the object checksum
  after bisync had recorded it, causing successful transfers to end with a
  checksum-listing abort, including .nomedia.
• Legacy listings select fresh canonical history identity, then use the existing
  query-free detailed revision route. Explicit advertised signed metadata must
  authenticate too; invalid metadata remains an error. Cached detailed metadata
  is bounded, keyed to the canonical revision and reverified against current keys.
  History metadata cannot seed the authoritative cache.
• Downloads verify canonical identity and known size, SHA1 and modification time
  before consuming content or changing the listed object. A changed or inconsistent
  snapshot closes the response and fails safely. Unknown fields remain unknown.
  Checksums, signatures and recovery requirements stay enabled.
• Regressions reproduce the history/detail disagreement with signed fixtures
  whose hashes are computed from actual content. A real bisync fixture reproduces
  the pre-copy/post-open mismatch and verifies corrected Path2 initialisation and
  subsequent sync with a 29-byte marker, an empty marker and unchanged companions.
  This reproduces a mechanism consistent with the reported failure; there is no
  live Proton account trace proving it is the only cause of that particular file.

Filters, flags and initialisation

• Saved GUI patterns accept conventional signed lines and CRLF, remove accidental
  surrounding spaces/quotes and reject blank, malformed or control-character
  patterns. Task flags accept --exclude /.nomedia, quoted values and --exclude=….
  All flags and saved filters are composed through the same builder for Save and
  preview, Review and initialise, and normal runs. Non-filter tuning flags
  remain present in all three stages.
• Basic exclusions take priority over basic includes; includes now restrict the
  selection with an implicit final exclusion. Pure expert --filter rules retain
  their order and pattern whitespace. Mixing a filter reset with saved/basic
  restrictions is rejected. One-way tasks using the old unrestricted include
  behavior with Delete excluded files must review and save that setting before
  running, preventing a silently wider deletion scope.
• Recycled filter rows detach old callbacks so editing one row cannot change another.
  Preserve unfinished filter edits across recreation; use one dropdown snapshot
  for displayed names and saved IDs, and reset empty filter lists correctly.
• Editor help explains root /.nomedia versus all-depth .nomedia patterns.
  Excluding a marker leaves it untouched and does not omit adjacent deck/media
  files; do not exclude entire Anki media folders. Native-engine tests check both
  pattern depths, nested included files, all three stages and retained source markers.
• Bump the baseline fingerprint policy: repeat preview and review initialisation
  for existing tasks. Initialisation is a real --resync; review what may be
  overwritten, especially when preferring Proton/Path2. No automatic exclusion,
  deletion, checksum bypass or resync is introduced.

Audit repairs and removed code

• Redact diagnostic secrets before bounding lines; handle long or unterminated
  JSON secret values without recursive regex stack overflow or truncated leaks.
• Verify installed configuration and wrapped-password bytes after atomic writes,
  synchronize files and directory entries, and retain rollback state on uncertain
  restore-marker retirement. A double failure also blocks native preparation in
  the current process until forced recovery. A committed restore remains successful
  if only obsolete-journal cleanup fails. These barriers cannot guarantee recovery
  after every physical storage failure or a process restart with no writable marker.
• Preserve downloaded timestamps for newer/older conflict policies with a narrowly
  scoped local-backend override; other operations retain existing timestamp behavior.
• Retire disposable preview files only after confirmed native exit, with exact UUID
  paths, flat-file bounds and symlink checks. Persistent baselines are never removed.
• Remove unused revision API shim, obsolete global pure-Go DNS override and app DNS
  formatter, unused Android scheduling service lifecycle/manifest registration, and
  redundant post-restore scheduling reconciliation. Retain the actual scheduling
  adapter, WorkManager dispatcher and useful Internxt authentication/retry changes.

Scope of the complete fork review

• Reviewed all 30 prior application fork commits against direct upstream
  ece92754:
  374 rename-aware file entries covering production Java/Kotlin, resources, host and
  device tests, workflows, build scripts, branding and documentation. Rename-only
  changes were separated from functional changes; all added production classes
  have actual callers. The existing chronological commit ledger below remains the
  detailed history.
• Reviewed all 25 prior rclone fork commits against
  4f19e9cd:
  259 file entries including core listing guards, bisync/backend changes, Internxt
  authentication, native builds and test/workflow changes. Compared every local
  runtime delta of the Proton companions against their exact imported revisions:
  bridge 6f7fc6530d4a77d33d08e36464e018600ae4b93d and API
  9dcca00ba1dc779a8958c9d4988b79ce2f9f3233.
• Retained useful bisync approval/recovery, battery-aware scheduling, process
  exclusion, encrypted credentials/configuration, backup recovery, private RC
  access, Proton concurrency/cache limits, signed-release provenance and attribution.
  No speculative cryptographic-format rewrite or broad removal of useful safety
  mechanisms resulted from the review. Disposable fixtures validate local behavior;
  device battery drain and live-account behavior still need installed-app testing.
• Validation completed before the application commit: independent code review;
  engine/companion regressions, race checks and vet; 201 Android host/unit tests
  with no failures or skips, including real local-engine filter/config tests;
  lint; all four native ABI builds and APK engine/provenance checks. The signed
  publication workflow additionally verifies package, increasing version codes
  and the existing signing certificate before publishing.