ProtonBridge v1.2.0

1.2.0 — audited stable release

• Publish the audited ProtonBridge source as 1.2.0, a full stable release with
  the same application ID and signing certificate as the recent prereleases.
  Base version code is 200; ARM64 is 207. All split/universal codes exceed 1.1.9.
• Include the necessity-audit change from 4674c396:
  Android foreground-service refusal immediately reports user action, preserves
  the bisync baseline and suppresses failure follow-ups. Remove automatic retries
  of that permission/setup rejection. Ordinary network/charging/contention waits
  remain; no permissions, battery exemptions or platform bypasses are added.
• Retain the verified checksum snapshot, filter/editor, privacy, configuration-write,
  restore, timestamp and preview-cleanup fixes described in 1.1.8. Keep rclone pinned
  to f1d1627e2e91867b5fed5eb6bb4d4e8d094924c8 and the same baseline fingerprint policy.
  A healthy 1.1.8/1.1.9 baseline remains valid; upgrading from 1.1.7 or changing
  filters/settings may require a new preview and reviewed initialisation.
• Extend signed publication to accept stable vX.Y.Z tags as well as -rc.N tags.
  Stable releases are published without the prerelease marker and become GitHub's
  latest release. Preserve immutable tags, exact version/notes matching,
  monotonically increasing ABI codes, draft asset staging, signing checks and
  checksum/source provenance. Earlier candidates stay immutable.
• Validation before the release commit: independent review; 205 Android tests
  with no failures or skips; 14 release-script tests; lint; debug APK build
  and native engine provenance verification. The signed workflow repeats checks
  and verifies the distribution before publication.
• The stable channel is a publishing designation. The recorded fixture, host and
  build verification does not establish every live account/device scenario.
  Android permissions and background limits still require appropriate user setup.

Necessity audit included in 1.2.0

Reviewed every functional change in 1.1.9 and 1.1.8 against its source, regression
coverage and the earlier complete fork/companion audit. Coverage includes the
32 application fork commits through 8a052dab and 26 engine fork commits through
f1d1627e, plus the companions compared with their exact imported versions. Independent Android and
engine reviews checked the stricter requirement: correct demonstrated defects,
report setup errors clearly and do not add workarounds for platform permissions.

Removed: automatic retries after Android rejects foreground-service startup.
The reported scheduled-start rejection does not establish a transient condition;
backoff cannot grant permission or change battery settings. Repeated attempts add
wakeups without a demonstrated benefit. The audited source immediately reports
needs user action, starts no native transfer, preserves the saved baseline and
suppresses failure follow-ups. Manual retries remain the user's choice.

Change reviewed	Decision and evidence
Android rejection classification	Keep exact exception/cause classification and actionable status. An OS/setup refusal is not an rclone transfer failure. SDK 33 worker tests preserve ready-state bytes and reject unrelated permission errors separately.
Baseline readiness diagnostics	Keep clearer reasons; the approval guards are unchanged. Changed filters/flags/configuration/engine, missing initialisation or an interrupted run legitimately require review. No forced recovery or approval bypass.
Proton checksum snapshot consistency	Keep. Signed HTTP fixtures and actual bisync reproduce a hash captured before copying and changed on download open. Resolve consistent authenticated metadata before capture and reject changed snapshots. The user's live checksum cause is still unproven; a successful exclusion is not proof of that cause.
Filter/editor changes	Keep reproduced recycled-row, saved-rule parsing, dropdown-identity and draft-loss repairs, plus shared tested argument composition. Flags were already appended during all three bisync stages in 1.1.7; no imaginary blanket missing-flags defect required a special initialisation workaround.
Include selection and deletion review	Keep restrictive GUI include semantics and explicit review for older include/delete-excluded tasks. The migration prevents silently widening destination deletion. Expert filter order and literal pattern whitespace remain available.
.nomedia handling	Keep documented native semantics only: /.nomedia is root-only, **/.nomedia is nested-only, .nomedia matches at every depth. No automatic exclusion, deletion, marker rewriting or checksum bypass.
Secret redaction	Keep. Old long/unterminated JSON fixtures expose truncation leakage or Java regex stack overflow; repaired redaction tests pass.
Configuration/password writes and restore	Keep readback/durability verification and recovery admission. Failure-injection tests show suppressed failed writes and uncertain marker retirement. The app stops/reports uncertainty rather than concealing storage failures.
Newer/older conflict timestamps	Keep the scoped local override: downloads must preserve source times for the existing chronological conflict mode to compare them meaningfully. Other operations retain their policy.
Disposable preview cleanup	Keep bounded cleanup only after confirmed native exit. Tests preserve baselines/live previews and reject traversal/symlink escapes.
Removed DNS/API/service/duplicate scheduling code	Keep those removals: unused paths had no caller/operational role; Android's system DNS and the actual WorkManager scheduling path remain.
Other previously audited fork changes	Keep evidence-backed authentication, listing, integrity, process ownership, scheduling constraints, privacy and signed-build provenance protections. Rechecks found no additional justified rollback candidate.

Existing waits for a missing network, charging, quiet hours or another live native
operation remain: those are observable conditions that can change. They are
separate from retrying a rejected Android service permission. No exemption,
expedited-job conversion, exact-alarm permission or setup-dependent bypass is added.

Validation after removal: independent review, 205 Android tests with no failures
or skips, lint, debug APK build/engine verification and release-script tests all
passed. The engine source/pin did not change, so its already-passing backend,
bisync, companion, race and vet checks did not need repeating.

This audit is included in 1.2.0. The published 1.1.9 APK/tag remains immutable;
historical release entries below describe what those releases actually shipped.