[Tracker] AeroFTP 4.1.9 - Known issues, patches & updates

[axpnet]

AeroFTP 4.1.9, Rolling Tracker

Umbrella issue for the next AeroFTP point release (v4.1.9): known issues reported against v4.1.8 and the patches/updates landing on main after the v4.1.8 tag.

Status note: the current release line is v4.1.8 (release notes, its tracker is #1416, now closed); this tracker collects what lands on main for v4.1.9.

Before opening a new issue, please check the lists below. If your problem is already tracked here, just add a thumbs-up reaction or a comment with your environment (OS, version, provider) instead of filing a duplicate. We update this issue as bugs are found and fixed.

Found something that is not listed? Open a new issue and we will link it here.

What shipped in 4.1.8

See the v4.1.8 tracker (#575) and the release notes for the full change set, 21 tracked changes over 126 commits. It was meant to be an ordinary point release. Four independent adversarial audits ran over the 111 commits behind it, two independent merges of those reports were reconciled against each other, and what came back changed the shape of the release: ticking read-only on a symbolic link applied the LINK's mode to the file it pointed at, so a convenience link to a private key handed that key to every other account on the machine; a guard that refused a cleartext object store after an encrypted login had been removed for every OpenStack account while the provider it was meant for shipped as stable; kDrive discovery had never once reached the network; and the AUR preflight executed the package file it documents itself as only inspecting. The pre-tag pass then audited those fixes and found three more defects introduced by them, including a panic. On the feature side: Quick Connect discovers buckets and drives, rclone export covers Zoho WorkDrive and encrypted overlays, folder downloads over WebDAV honour the concurrency setting, and the multipart resume store stops growing forever and gains a command to clear a decommissioned server. 47 languages, with 47 strings this release had shipped with their diacritics stripped put back, 28 corrupted Icelandic strings retranslated, and 187 banned dash characters removed with the validator now rejecting them.

Patches & updates queued for 4.1.9

Landed on main after the v4.1.8 tag; shipping in v4.1.9.

#	Type	Change	Status	Commit	Ref
1		The AUR preflight no longer claims it sourced the PKGBUILD. Two of the three success messages were corrected when the parser was rewritten to read the file as data; the third interpolates the source count and did not match the search. Not sourcing the file is the point of that rewrite, so the message must not say otherwise. Found while bumping the AUR package to 4.1.8, where the preflight ran green and printed the wrong reason for it.	🟢 done	3b831d4a	-
2		Five documentation statements that the v4.1.4 to v4.1.8 changes had made false. On the docs site rather than in this repo, so it is already live and not waiting on v4.1.9. The AeroCrypt page still described the 128-bit and 256-bit radios and the attestation checkbox that were removed for never reaching the backend (@EhudKirsh); the tiers and the attestation are real on the CLI, so they were reattributed there rather than deleted. kDrive was documented as taking an optional Drive ID that defaults to the primary drive, while the field is required, the Connect button stays disabled without it, and the backend refuses; the page also predated discovery, and the button is labelled Fetch, not Discover. Blomp's troubleshooting table still called the 403 on the account listing an upstream bug pending a fix, contradicting the same page three sections earlier, where it is by design and handled by the username-container fallback. The Swift line promised any Swift-compatible endpoint, which stopped being true when v4.1.8 began refusing a cleartext object store after an HTTPS login. The Google Drive setup page said to register http://127.0.0.1 with the port handled automatically, which is incomplete now that the app displays the exact callback URI. Deliberately NOT touched: the "22 protocols" claim repeated on eight pages, and the tool and command counts, both of which are decisions rather than corrections and are queued separately.	🟢 done	docs#5	#369 (@EhudKirsh)
3		Blomp and every Swift account list their files again. The remote panel opened empty even when the account held files, and an upload succeeded without ever appearing. The GUI opens a session on the path ., which the Swift normalizer treated as a literal directory name rather than the container root, so every request asked the server for a directory called "." that does not exist. The normalizer resolves . and .. now instead of only trimming slashes, so the fix covers all nine call sites that pass through it, not just the listing: upload, mkdir, rmdir, delete and the two renames. A repeated slash inside a name is preserved, since a Swift object name is an opaque key and a//b is a different object from a/b (raised by CodeRabbit on the pull request). Present since v3.1.6, surfaced now because v4.1.8 put Blomp back in front of people. Reported by axpnet against v4.1.8.	🟢 done	fa0325d3	-
4		The provider logo is back on the session tab for Swift and for the recently added providers. The tab showed the generic icon instead of the Blomp logo, although the PNG, the PROVIDER_LOGOS entry and the drawing code were all correct: they were unreachable behind a hand-written allowlist of 28 names that nobody had extended. The rule is inverted now, declaring the two protocols that have no logo (ftp, ftps) and treating everything else as a provider, so adding a provider no longer depends on remembering this list. A test reads the ProviderType union from source and fails when the two drift apart. Besides Swift, googlephotos, aerocloud and peer were latent.	🟢 done	fa0325d3	-
5		One alias table for option keys, shared by the CLI, MCP, agent and AI tools. profile_loader::normalize_profile_option_key was the canonical table, while agent_session::camel_to_snake and ai_tools::load_provider_extra_options each carried their own and knew none of its aliases. Harmless while the protocols those paths reach read no aliased key, but it was where the next connection option would have died silently. Closes item 16 of "Requested / under consideration". Harmless at the time because the protocols those paths connect read no aliased key, but it is where the next connection option would have died silently.	🟢 done	fa0325d3	-
6		WebDAV survives a Digest nonce rotation instead of reporting the session expired. Accepted debt declared in v4.1.8 and recorded at clone_for_transfer with its trigger. Only PROPFIND re-negotiated on stale=true; every data path mapped a 401 to "Session expired", so an Apache mod_auth_digest server rotating its nonce at the default 300s lifetime failed a transfer that was perfectly authorised. The blocker was not the missing retry but that the retry could not be decided: DigestChallenge had no stale field at all, and renegotiate accepted any parseable challenge while documenting itself as adopting only a rotated one. A revoked password answers with a challenge that parses, so wiring a retry onto that gate would have been the retry storm the debt was deferred to avoid. stale is now parsed (bare, quoted, any case) and a challenge is adopted only when it says stale=true and offers a nonce that differs from the one held, which also bounds a server that echoes a dead nonce. On that gate stat, checksum, keep_alive, the Nextcloud chunked MKCOL and the chunked part PUT replay exactly once, and the repair is pool-wide because the challenge is shared. list is deliberately excluded: it goes through send_propfind, which already re-negotiates. Live validation against a Digest server that rotates its nonce is still outstanding and is not claimed.	🟢 done	35a420d9	#636
7		The strings that shipped as raw English inside translated locales are gone, and a gate keeps them out. About 55 keys read as English in 43 to 46 locales at once, first estimated at roughly 2,200 locale/key pairs plus 37 per-locale misses, measured at 1966 pairs across 69 keys once the detector existed. i18n:validate never caught them because the values are present and are not placeholders: it checks that a value exists, not that it is not English. The naive test is useless here, "identical to English" fires on 15992 pairs across 1093 keys and almost all are correct (FTP, AeroCloud, us-east-1, ARNs). The detector keeps identity as the trigger but takes its evidence from the shape of the English source, so it narrows to 1966 pairs across 69 keys, a list a human can read. 1899 values were then translated across 46 locales and the gate ships at --strict, not as a ratchet: the backlog is zero and cannot come back.	🟢 done	078574cf	#637
8		The diacritics gate no longer truncates its own JSON report. The --json branch called process.exit() immediately after console.log, which abandons whatever stdout is still queued, and stdout to a pipe is queued, so past the 64KB buffer the report is cut mid-string and the caller receives unparseable JSON. Latent rather than theoretical: today that gate reports 0 new hits so its output never reaches the buffer, and it was found only by hitting the same wall in a sibling gate whose report is 317KB. Both the --json and the human branch now set process.exitCode and let node drain, so the shape that causes it is gone rather than the symptom.	🟢 done	5a309134	#638
9		Every WebDAV request path re-negotiates a rotated Digest nonce, not five of them. The follow-up to row 6, which closed the gate but wired it into five call sites: that map was built by grepping for UNAUTHORIZED, so it found only the sites naming the status and missed every site letting a 401 fall into a catch-all status => arm, which is most of the provider. Measured against Apache mod_auth_digest, a recursive download of 60 files lost 52: each GET meeting an expired nonce failed as "Authentication failed during transfer" and was never replayed. Upload, ranged reads, resume, DELETE, MOVE, COPY, MKCOL and UNLOCK shared the gap. A shared helper now takes a closure that rebuilds the request, so a replay recomputes its own Authorization header and never re-presents the dead nonce; the single PUT rebuilds its body by reopening the file rather than buffering it, which also guarantees the replay starts at offset zero. Replaying on 401 is safe for callers that are not idempotent because a 401 means the server rejected the request before applying it, which is what separates it from replaying a timeout. A second defect surfaced only under parallel transfers and no unit test could have shown it: the "adopt only a nonce we are not already holding" rule is what prevents a revoked password becoming a storm, but a sibling worker often adopts the rotation first, so the server offers back a nonce the shared challenge already has, renegotiate correctly declines, and the request that lost the race dies holding a dead nonce. A replay is now also granted when the held nonce differs from the one the failed request carried. The anti-storm property is unchanged: when nothing rotated both arms are false and a bad credential still costs exactly one request. The live validation row 6 left outstanding is done and reported below.	🟢 done	27cb17e6	#639
10		Every published "how many providers / protocols / presets" figure is now derived from the code and gated. Three different numbers for the same noun were published at once and none of them errored, because prose does not fail a build: the README claimed 25+ native integrations and 45+ presets, the feature matrix claimed 45+ over a table listing 33, and the docs site claimed 22 storage protocols, a figure no source produces. scripts/gen-provider-inventory.ts derives them into docs/PROVIDER-INVENTORY.json from the catalog and the registry, and a --check gate in the fast checks lane fails when the committed file stops matching the code and prints which count moved. Nine stale counts corrected along the way, including the two nobody opens: the AppStream metainfo that GNOME Software and KDE Discover render, and the Snap Store listing.	🟢	1aacdd10	docs#7
11		The resume store has a screen, so the multipart cap has an escape in the GUI. aeroftp checkpoints could already clear it per endpoint, but nothing in the app could: a Tauri command for forget_endpoint had been added during the v4.1.8 audit and removed again in the pre-tag pass because nothing called it. The screen brings the listing too, since the four identity values are matched exactly.	🟢	38abc2c5	-
12		A private OpenStack that legitimately serves cleartext can now say so. v4.1.8 fails closed on an HTTP object store after an HTTPS login and Blomp worked only because its preset declares the exception; the per-profile flag existed in the config and nothing in the connection form set it. Those deployments were refused in v4.1.7 too, so this is new capability rather than a regression.	🟢	44a4c1a0	-
13		179 locale strings had their diacritics stripped, and a CI gate now stops the class growing. Drifting in since January over eight separate commits, so not one bad import: Turkish 48, Polish 39, Icelandic 17, French 16. Corrected by hand per locale, because the automated pass attempted previously changed meanings and was reverted the same day. The detector needs no dictionary: it infers from spelling frequency inside each file.	🟢	7d517b03	#512
14		The checkpoint cap is an ordering now, not a refused open. Two concurrent enforce_cap calls sharing a saturated store of same-second timestamps could pick each other's just-persisted opening record, because the sort was terminal-first then oldest and equal timestamps fell through to readdir order. A grace window makes a fresh record sort last; a lock file would have serialized every multipart open.	🟢	b5db68e7	-
15		S3Drive is marked stable on evidence, and DigitalOcean Spaces says why it stays hidden. Both presets carried stable: false with no recorded reason, which is indistinguishable from a known defect and is how both stayed hidden. S3Drive was verified live (connect, list, put, byte-identical get, delete); DigitalOcean was never tested because the trial account expired, and that is now written down instead of implied.	🟢	c1586d1a	-
16		pCloud's trash button is gone, because pCloud will never honour it. A live test against a real account settled an item three trackers old. In one connected session with one token, listfolder returns result: 0 while trash_list returns result: 1000 "Log in required.", identically as a Bearer header and as an access_token query parameter, with and without recursive, and with an explicit folderid=0. A control listfolder fired between two failing trash calls proves the token valid at that instant, and userinfo?getauth=1 mints no session token for an OAuth caller, so there is no fallback. pCloud OAuth exposes one optional permission, manageshares, so no scope and no re-authorization can lift it, and rclone does not implement CleanUp for pCloud either. The affordance is removed, mirroring the internxt entry already disabled in the same map	🟢	adbf0393	#397
17		DigitalOcean Spaces is no longer hidden behind an unstable flag. This supersedes the DigitalOcean half of row 15: rather than document why the preset stayed gated, the gate is lifted. It carried stable: false not for a known defect but because the trial account used to verify it live had expired, and an ordinary S3 endpoint dispatching through the same stack as the other forty-eight presets, with no provider-specific code path of its own, does not warrant gating on that. The explanatory comment goes with the flag, since a note about a deferral that no longer exists misleads the next reader. Set to true explicitly rather than deleted: every consumer tests stable as falsy, so deleting the field would have left the preset filtered out and dimmed exactly as before, minus the warning badge. All forty-nine presets now carry the field	🟢	e65f0603	-
18		A user can restyle the app chrome, through published CSS tokens rather than arbitrary CSS. The request was Obsidian-style snippets, and that was declined on purpose: Obsidian can offer them because its DOM is a public contract, while AeroFTP's class names are Tailwind utilities generated per build, so a snippet would break silently the first time a component was restyled. Fifteen tokens are published and overridable from <data root>/ui-tokens.json, with docs/UI-TOKENS.md as the contract; validation rejects rather than sanitises and reports every dropped entry with its reason. The status colours are deliberately not overridable, because a user who recolours them can make a destructive-action warning indistinguishable from a confirmation.	🟢	64439be8	#347
19		main went red on a yanked crate, and the lock moved by four lines rather than by a resolver pass. crates.io yanked chacha20 0.10.1 and the audit step denies yanked crates, so this was never a vulnerability. Worth recording why the pull request merged just before it was green while main went red, because it looks like an escape and is not: cargo audit runs with continue-on-error on pull requests and authoritative on push to main, deliberately, so an advisory published against a transitive dependency cannot red-wall an unrelated PR. The yank landed between that PR's run and its merge, which is the mechanism working rather than failing. The lock carries two chacha20 majors and only one moved: 0.9.1 comes from chacha20poly1305, which requires ^0.9 and is untouched; the yanked 0.10.1 comes from rand and ssh-cipher. cargo update --precise was rejected because it also re-resolved two unrelated dependencies, downgrading syn inside data-encoding-macro-internal and getrandom inside tempfile: both resolutions are valid, neither belongs to this fix, and a dependency change should be the change it claims to be. Verified by cargo metadata --locked, cargo check --locked and a clean cargo audit, not by the absence of an error.	🟢	b5dea635	-
20		Two labels that described the wrong thing, and a translation pass that refused two of its own findings. uiTokensTitle was translated in three locales and left English in the other 44: "UI tokens" is the name of a documented contract in docs/UI-TOKENS.md, so a reader who sees it translated in the panel and searches the docs for it does not find the link; ja, ko and zh go back to the English term and all 47 now agree. "Reset to defaults" cleared the overrides from the running document and left ui-tokens.json untouched, so the reset lasted until the next start: the label changed rather than the behaviour, because that file is written by hand and a button labelled reset that silently deletes fifteen tuned overrides is worse than the ambiguity it removes. It reads Clear overrides now. The CodeRabbit pass on the same change was verified finding by finding rather than accepted or dismissed in bulk, and it split four ways: two applied that looked like nitpicks and were real, Croatian and Icelandic each using two different words for one thing inside a single screen, with the Icelandic panel offering to clear titles because yfirskrift is a heading and yfirskrifun an override; one rejected on measurement, the Portuguese finding citing two words that do not appear in the string it names; and two left unapplied, Welsh and Swahili, because the correct term could not be verified and inventing one is the error the pass exists to prevent. Those, plus Icelandic, are queued for a native reader.	🟢	e8768e44	#347
21		The gate that checks the command inventory was pointed at the wrong thing, and said OK for it. inventory --check compared only the counts block of the snapshot against the live counts, so an artifact that had drifted inside its own lists passed with "OK (counts match)": counts is exactly the part that still matched. The invariants that would have caught it already existed as a test, but they ran on the document built in memory and never on the artifact on disk. They are now a shared non-panicking function called on the deserialised snapshot, reading every figure by explicit path, with a missing or wrongly typed field treated as a declared violation rather than a silent zero, because a figure that disappears is exactly the drift the gate exists to see. Proved by differential, not asserted: on a snapshot with one command removed from tauri.commands and counts left byte-identical, a binary built from the parent commit reports "OK (counts match)" and exits 0, this one names both broken invariants with their numbers and exits 12. Two review findings were verified and applied, and one of them was the change auditing itself: a magnitude tripwire (tauri > 500) inherited from the in-memory test had been promoted, unnoticed, into an invariant of an artifact, so a legitimate surface of 450 commands would have been declared inconsistent by the very change written to stop wrong diagnoses. It is back in the build test where it belongs. Six tests ship with it, one of which reads the published artifact from disk so cargo test verifies it and not only CI	🟢	d42879b4	-
22		The B2 provider was told the bucket's encryption and lock settings at every connect and threw them away. b2_list_buckets, already called when a session opens, returns defaultServerSideEncryption and fileLockConfiguration; neither was deserialised, so HEADER_BUDGET_STD stayed hardcoded at 7000 while B2 lowers the cap to 2048 on a bucket with server-side encryption or Object Lock, and the _STD suffix showed the smaller budget had been known and never implemented. From 2026-09-14 Backblaze turns SSE-B2 on by default for new buckets, so the smaller budget stops being the exception. The two triggers are read independently and are not symmetric: encryption from value.mode, Object Lock from value.isFileLockEnabled and only from there, because B2 documents a state where the lock is on while its default retention is off and deciding from defaultRetention would call exactly that bucket unlocked. Each setting has three explicit states and "not read" is a real one, since B2 gates both behind isClientAuthorizedToRead and a bucket-restricted key is told nothing; an unread setting keeps the larger budget deliberately, because B2 is the authority on what it accepts and refusing a path it would have taken breaks a working setup with no way for the user to override. The fields are parsed as raw JSON rather than typed, because Backblaze's own documentation contradicts itself about their shapes and a parse error would fail the bucket listing, that is the connect: trading a wrong budget for a broken connection is a far worse deal than the defect being fixed. Two limits are declared rather than hidden: the documented measure for the standard budget is the fully encoded header line including the CRLF, which this check does not count, and since file names are separately capped at 1024 bytes a legal name reaches at most 3166 bytes even encoded, so the refusal path cannot currently fire at all and what shipped today is the diagnosis, not the refusal. Four review findings were verified and applied, one of them found by writing the test rather than by the review that prompted it	🟢	765ef41c	-
23		The two FTP listing parsers became one, and the copy nobody had read stopped inventing files. The provider and the legacy FtpManager each carried their own parser and they had drifted apart. Both now consume providers/ftp_listing. The legacy copy had no failure mode: any line it could not parse became an entry, and any such entry without a dot in its name became a directory, so total 12 was listed as a folder. An unrecognised row is now an error the caller skips instead of an invention. The five parser defects were moved into one place, not fixed, and are the subject of the next row's sibling work	🟢 done	81fd3d9f	#649
24		FTP now answers with what the server actually said, and says which operation it was doing. A path that does not exist returned an empty listing, indistinguishable from an empty directory, which is the precondition of a mirror deleting a local tree against a misspelled remote. mkdir on an existing directory collapsed into a generic failure, transient 421 and 450 were reported as InvalidPath so a session problem read as a wrong path, and messages named neither the operation nor the path. Verified live on a vsftpd 3.0.5 server over explicit FTPS: a missing path now errors while a genuinely empty directory still lists clean, on both the CLI and MCP, and mkdir reports Path already exists with the path	🟢 done	f71fc5dd	#651
25		A listing nobody could read is no longer reported as an empty directory. With the parsers shared, a LIST whose every row failed to parse still returned Ok with zero entries, which downstream reads exactly like a wiped remote. It now fails, so the scan counts a listing error and the delete guard refuses through the arm that names the real reason rather than reporting "source side is empty" and sending the reader to look for a deletion that never happened. A partially unreadable listing is not covered and is recorded as such	🟢 done	d521dc55	#653
26		Three Jottacloud trash operations that failed for a reporter, each for a different reason. Renaming a folder returned 404 because the request went to the live mountpoint; restoring returned 500 because the tombstone was read as an ordinary file; permanent delete lost the original parent because the trash listing accumulated <abspath> text without decoding it, and Deleted dates were being clipped by a revision mtime read after the attribute that carried them. Separately, an imported refresh token is now bound to the record it belongs to, and profile_id is stamped from the saved record with options-borne values dropped at one choke point so the CLI, MCP, agent and AI tool paths agree instead of one file enforcing a policy the next one reverses. rename no longer reads a 404 on the live path as evidence that the object exists only in the trash, which could rename an unrelated object of the same name inside the trash and report success. Filen quota errors keep their REST cause instead of collapsing into "No user info data", so an expired token no longer presents itself as a missing quota. Two limits are recorded rather than hidden: two added tests pin their helper and not the call site, which needs a vault and a live connection unless the config assembly is extracted into a pure function; and this closes part of the report, not all of it	🟢 done	4099cc2f	#397
27		Every recursive descent now uses the same walkable-directory test, so a grep can check the contract instead of a reader. A descent gated on a raw is_dir walks into a symlink wherever the two flags derive from different facts, and across the provider tree that happens on exactly one provider, SFTP, where is_dir comes from the link's target while is_symlink stays true. The other sites cannot diverge today and are converted anyway, because a single site that still requires reading costs that property for all the others, including one that is already correct through a guard a grep cannot see. The count is stated rather than implied and was measured twice, with the command in the pull request so anyone can redo it, and the boundary declared: the same pattern exists outside providers/ and this change does not touch it. The first version of the change claimed the grep already returned zero and it did not, which is why the four remaining sites each carry their own reason	🟢 done	f6089243	#654
28		Uploading a very large file through AeroSync no longer holds the whole file in memory. Delta generation, compression, encoding and the multiplexed writes now stream in bounded 4 MiB slabs, and the diagnostic buffers that grew with the file are gone from the streaming path. The pre-transfer rsync -c full checksum read is replaced with -I, keeping whole-file integrity through the delta trailer without reading the source twice, and a source that grows past its declared length now fails immediately instead of waiting for an EOF that never comes.	🟢	9d1700bb	#661
29		A configurable FTP server that fails on purpose, so the provider's hard-to-reach branches can be tested. It can stall a listing, announce a passive port and then never accept the data connection in three distinct ways the client tells apart, refuse a transfer while holding the socket open, or answer late. Every timing default is either off or chosen to LOSE the race against the deadline under test: two of them previously matched or undercut the cap they raced, so a test believing it measured the client measured the fixture instead and passed either way without saying which had won.	🟢	b41dfc2c	#662
30		A segmented download no longer holds the whole file in memory. The 64 MiB cap bounded ONE sub-read and read as though it bounded the download, but the workers run concurrently and the peak was their product: below a gigabyte the sub-read IS the window, so a 500 MB download planned 500 MB and the cap only began to bite where the ratio stopped being surprising. The aggregate is now capped too, with the round-trip cost of a smaller sub-read stated as a starting point to measure rather than a tuned value.	🟢	47c2e707	#664
31		Four recovery guards that were wider than they looked. In two of them the exact test already sat one condition away from a loose one that decided every outcome: any S3 error containing the letters time took the clock-skew retry, and " 500" matched " 5000" and " 500 MB". A failed MEGAcmd command containing the word already was reported as success, which lost errors rather than spending retries. And a refused TLS port was recognised by an English string, so the skip never fired on a localised system; it now reads the typed ConnectionRefused.	🟢	588ffa7e	#665
32		Asking for a file that does not exist can no longer hang for ever, and a listing that times out no longer poisons the session. The wait was inside the data channel's TLS handshake, one step before the read loop that was already guarded, so every data-channel opening now has a deadline and listings have their own. When either expires the session is dropped rather than reused: a connection whose reply is still owed hands the NEXT command somebody else's answer, measured on a lab server as a CWD on a missing directory reporting success.	🟢	fbbe288d	#663
33		A transfer the server closed was abandoned without a single retry, and reported as a disk error. broken pipe was filed under "Disk full or I/O error", which is non-retryable, and the four executor sites break on that, so the most ordinary way a server drops a transfer (an idle timeout, a NAT eviction) was the one failure never retried. i/o error was in the same list and is not a symptom at all but the label a parser prints in front of the real error, so a connection dying mid-response became a permanent disk failure on WebDAV, S3, Azure and Jottacloud, and therefore on every service configured over those transports: Nextcloud, ownCloud, MinIO, Wasabi, Storj and the Discover presets.	🟢	18d4a9a1	#667
34		Three questions were answered in eleven places with vocabularies that had drifted apart, so the answer depended on which caller asked. cannot find, the phrase Windows itself uses for a missing file, was known to one reader out of five; a bare FTP 550 was read as absence when it also means a refusal; a cancellation phrased without "by user" was a cancellation to two layers and a failure to two others; and a revoked Yandex token never triggered the credential reload because the guard matched invalid token while the provider emits invalid_token. Each question now has one predicate, and the auth one normalises underscores so neither spelling of any term can be the one nobody thought of.	🟢	80f470a8	#666
35		The v4.1.8 retests that did not hold, closed by driving the GUI against the real accounts rather than by reading the code again. Jottacloud trash restore works through ?cphash=true, because ?mv= and ?mvDir= return 404: the Trash path is not an object, the listing being a virtual view. Sync templates now carry verification, compression and canary, so importing one stops resetting them to defaults. The servers table clears its selection on drag start and gives cells stable ids. Rclone-obscured passwords are revealed before use and an empty password2 is treated as the default salt, checked against rclone 1.74.3 in both directions. Folder restore is classified correctly and has NO working JFS command, which is declared rather than glossed. Reader-facing issues this row closes, named here because the row did not name them and a tracker nobody can search by issue number is a tracker with a hole in it: #514 sync templates resetting verification, compression and canary on import, #600 rclone-obscured passwords and the empty password2 salt, and PART of #397 Jottacloud trash. The gap was found while re-labelling those issues: the fix was in the release and the tracker recorded the commit, but not which reports it answered, so nobody reading either one could get to the other.	🟢	4099cc2f	#652
36		Four review findings on the vocabulary consolidation, three of them introduced by it. The needle for a missing path had been widened by one word, and that word was the whole margin: a server reply quotes the user's path back, so 550 /no such/keep.txt: Permission denied matched on the PATH and a refusal read as an absence, in the guard the speed tool uses as permission to overwrite and then delete. The caller's path is now removed before matching, which the FTP provider had done since the 404 tightening while the other four callers never received it. A negated cancellation (could not be cancelled, and the contracted forms with either apostrophe) is no longer a cancellation. The retry loop and the failure it builds now ask the same question. And a missing OAuth scope on Yandex stops telling users to regenerate a token that works.	🟢	9c38bf38	#668
37		The tauri pin stays and its documented reason was wrong, which is what sent readers looking for the remedy where it cannot be. 2.11.1 introduced no check classifying http://127.0.0.1:* as remote: the Linux branch of is_local_url is identical between the two versions, and what changed is one line that starts APPLYING a verdict that was already false. The obvious remedy dismantles its own precondition, because declaring frontendDist as a URL empties the embedded assets that tauri-plugin-localhost exists to serve. It is all or nothing because the invoke_handler registers 1013 commands and one permission file makes the ACL govern every one of them. The auditors' file also carried a false absolute, corrected and scoped to the platform it holds on. Comments only, zero code lines.	🟢	9ed325fb	#669
38		A download of a file that is not there could wait for ever, with the server's refusal already inside the client. Captured on the wire twice against a real server: the control socket held 55 unread bytes with nothing arriving for 22 seconds, the data socket was open and silent, and neither had a timer armed (verified by checking that 40 other sockets on the same machine did print one, so the emptiness is a fact and not a limit of the tool). No kernel event could ever have ended that wait. The 550 had been sent and was sitting in the client's own receive buffer, because reading the data channel means not reading the control one. The read now watches both. The first digit of a waiting reply is read with peek, which does not consume: 4 and 5 end the wait, anything else stops the watch and leaves the reply in place, because the completion reply arrives on that same channel and treating any reply as a refusal would abort a working transfer and truncate the file. The loopback fixture cannot reproduce this, since there the data socket closes first and the wait ends by itself; that is written next to the tests as well, because the tests are where somebody would read a green and draw the wrong conclusion	🟢 done	999ba7fb	#655
39		Four data-channel call sites each carried their own copy of the same forty lines, and unifying them exposed two divergences that were named rather than smoothed over. The control watch, the deadline, the meaning of an expiry, reading a refusal that is already waiting and releasing the channel now live in one primitive; the read loop stays with the caller, because the four do not agree on what a chunk is and a primitive that owned the buffer would have fitted three and broken read_range. That site was converted first precisely because it is the only one that could have falsified the shape, and it went from 45 lines to 8. The two divergences, counted by listing every ? the callers have between opening the channel and releasing it: a failure while collecting a queued refusal, and a local disk failure in the caller's own body. Both used to leave the session alive in a state nobody had established, so the next command could read the previous answer as its own; both now discard it. A session thrown away costs a reconnect, a session in an unknown state costs a wrong answer delivered as a right one	🟢 done	576b8abc	#660
40		A path holding CR or LF let the caller append a second FTP command, and the refusal was then filed as a network error and retried. Reproduced rather than argued: with the old dependency, a hashsum on /pippo.txt\r\nDELE /vittima.txt made the fixture log a DELE nobody requested. The reachable vector is a path supplied by the caller (CLI, saved profile, API) and NOT a filename from a hostile server's listing, which was checked rather than claimed, because a listing is line-based and a CR inside a name splits the line before the parser sees it. Pinning suppaftp to 10.0.2 refuses the write, but the bump alone would have swapped one defect for another: the library reports the refusal as a connection error, so the sentence blamed the link for the name and the substring matcher in classify_sync_error marked it retryable, meaning a refusal that can never succeed would have been retried to the limit. The decision now reads the io kind in the one place that already types these failures, so the sentence and the retry decision are fixed by the same change	🟢 done	456d7b83	#671
41		The FTP fixture now counts every command verb it receives, so a test can assert what was never asked. A test driving our client cannot see an injected command: it leaves the client and never comes back, so the client is exactly the end that does not know. Counted per verb rather than as a total, because the assertion is that DELE was never sent and a total cannot say which verb is missing. Validated against the fault it exists to report, on both binaries: with the injection still possible DELE is 1 and the assertion fails, with the refusal in place it is 0 and it passes. The USER count in the same reading is the control, without which a DELE of zero could equally mean the client never reached the server at all and the assertion would pass for the wrong reason	🟢 done	2bd1d2f0	#672
42		An exit code is an API, and this one was chosen by searching the error message for English words. Cron jobs and CI branch on it, while its input was prose nobody had promised to keep stable, so rewording a message silently changed a contract and no test could catch it because a test would use the same strings the code does. The sharpest case is now pinned: the product name is rewritten on the way out, and that rewriting ran BEFORE the words were inspected, so renaming the product in a user-facing string was one edit away from moving an exit code. The class now travels with the error, decided where the failure happens, over exactly the three outcomes the contract has and with a total match so a fourth cannot arrive without somebody choosing its meaning. I/O cases take their class from ErrorKind rather than from how the operating system phrased it. The strongest guarantee is an absence: there is no hand-written constructor for the not-found variant, so it can only be born from a kind and never from a call site's opinion. Review also found the one place the new invariant does not hold, three usage-error exits that override the class on purpose, now carrying a line saying so and why	🟢 done	2fb4bbb4	#674
43		Asking whether a parent exists is not asking whether it is a directory, and the obvious correction reintroduced a bug that had already been fixed once. The pre-check for remote parent creation used to accept any successful stat, so a file sitting where a directory was needed produced a failure one level below the real obstacle, with a message naming the wrong path. Reading the entry's own answer fixes that and immediately breaks something else: is_dir == false is not proof of a non-directory, because both FTP parsers report a symlink to a directory that way (LIST matches d and a symlink row starts with l; MLSD accepts type=dir, cdir or pdir while a symlink arrives as OS.unix=slink). A symlinked /var/www/html, ordinary on shared hosting, would have been refused outright where it previously worked. The remedy is a type rather than a corrected branch: the function exits early only on positive proof that the parent is a directory, and anything else falls through to the walk, which is what happened before the check existed. The mock had no symlink dimension at all, so the entity that breaks could not be seeded and the tests were silent about it rather than wrong; it now can be, and a test pins it	🟢 done	9dd0040f	#670
44		Three advisories affecting russh as a client, which our own security gate is structurally unable to see. The headline one lets a hostile or compromised SSH server trigger channel-scoped handler callbacks for channel IDs the client never opened, producing panics, forged exit statuses and desynchronised channel state (GHSA-47hw-gvq5-r2gm, High, CVSS 7.5). The other two are a missing zero-point validation for X25519 in the hybrid ML-KEM768 exchange, and a panic with mac=none and a block cipher. cargo audit is green here and cannot be otherwise: russh has no RustSec entry, so its advisories live only on GHSA and the tool has nothing to look at, which means a gate blind to a whole class reports the same green as a gate that looked and found nothing. That limitation was already written into Cargo.toml at the previous bump rather than discovered here. The absence of a fix on the 0.62 line was settled with dates instead of a changelog: 0.62.7 predates the advisories it would have to fix, so cargo update could not have reached a patched version on that line whatever it was asked	🟢 done	bac8cbe8	#673
45		The language chip sat inside the Aero family and read as one more app button. It is a readout, not an action: it says which language the app is in, and clicking it opens the list. Sitting between the AeroAgent button and DevTools it split that group in two and invited being read as a third app. It now sits last in the right-hand cluster behind its own divider, which is where a status readout belongs and what the divider is for. Found by a person looking at the running app, not by a test, which is also the reason the two new tests pin the ORDER and the divider rather than the styling: a button added later must go before the chip, not after it. Both were run against the previous layout, where they fail	🟢 done	7c25f517	#677
46		A lost login was reported as a bad path, and the wrong noun was carrying the right answer. classify_data_failure turned any remaining 5xx into InvalidPath, so [530] Not logged in (while reading /srv/data/report.csv) sent the reader to check a path that was never wrong. Only 550 and 553 are replies about the name itself, so only those stay InvalidPath. The half deliberately left out is recorded rather than forgotten: narrowing the noun also changes retryability for ten codes, because the label was the only thing holding them non-retryable, so removing it alone would make a full storage quota and a lost login retryable and they would be retried to the limit. That half belongs with teaching the classifier to read the type, not with widening needles to include the bracket, which would be curing the disease with the disease. Split out of #671 so the security fix could land while main was red	🟢 done	90657df3	#676
47		Six classification rules had never fired once, and the reason is a square bracket. classify_sync_error looked for 552 , 403 , 550 , 404 , 401 , 530 , a status followed by a space, while every failure the FTP provider renders puts a ] there: [552] Exceeded storage allocation. Quota, permission, not-found and authentication were decided by rules that could not see the shape the system produces, so on production-shaped strings they classified as Unknown and retryable, and a permanent 5xx was attempted three times. They were not uniformly dead, which is worse than dead: a server that echoes its own code inside the text made the old needle match by accident, so the rule held against one server and silently stopped against another, and the true observation supported a false conclusion. mentions_ftp_status now also knows the bracketed shape, anchored rather than searched, so a file named [404] note.txt cannot be read as a status. Stated up front because "revive a dead rule" reads like a no-op: this moves behaviour for the majority of servers, in the direction where a second attempt could not have succeeded	🟢 done	3f5b6166	#679
48		The second surface of the class row 42 opened: an exit code chosen from the words of an error message, this time in the keystore. classify_keystore_error searched e.to_string() for phrases while its own doc comment promised pipelines could branch on the code without parsing text, so three sites that interpolate a caller-chosen string made the exit code a parameter: --merge decrypt returned 6, an authentication failure, and --merge "io error" returned 11, a disk fault, for the same invalid strategy. A crafted compression marker inside a backup file could steer it too. The first version of this pull request declared two changed codes and changed six, because it rested on a count of nineteen construction sites read as eight from a grep | head -8, with the truncation added by the same hand that then trusted the number; running the old chain over all nineteen exposed four regressions. The remedy is one floor up: Encryption(String) was swallowing failures that already had a type, so the store sites map to Io and the codec gets its own variant. Both halves are pinned by breaking them. Nothing in this repository branches on these codes, checked with a control since 23 numeric exit-code comparisons do exist elsewhere	🟢 done	a2f9af40	#675
49		Six dependency bumps reviewed as one, plus two @types packages whose upstreams now ship their own declarations. Removing a types package is the change that breaks at a call site nobody was watching, so it was verified rather than assumed: dompurify@3.4.14 carries dist/purify.es.d.mts, react-window@2.3.0 carries dist/react-window.d.ts, nothing under src/ names either @types/ package, and after removal tsc --noEmit resolves both from the upstream declarations, read out of --listFiles rather than inferred from an exit code. Declared limit: both lockfiles are excluded from bot review by path filter, so the largest part of this diff by line count carries a human reading only	🟢 done	4eca11ec	#687
50		A source file carrying raw NUL bytes is skipped in silence by every search tool, so it was invisible to three counts taken that day. thumbnailCache.ts held literal NUL characters inside a cache-key separator; they are now written as an escape, with a comment recording why it must stay so a later cleanup does not turn it back into a literal. The diff is zero lines added and zero removed, and the reason is sharper than it looks: with the NULs inside the first 8000 bytes git classifies the file as binary, so this change renders as Bin 4189 -> 4441 bytes with Binary files ... differ, and every earlier change to this file reached review as an opaque blob instead of as lines. It is also why the review bot reported "no reviewable changes" and never read it. After this lands the file is text again and the next change to it is reviewable. What stands in its place: the seven existing tests pass unchanged, which is what shows the key format did not move, and no other file under src/ or src-tauri/src/ has the same problem	🟢 done	1af67666	#690
51		aerovault 0.6.4, the first release under MPL-2.0, and the licence reading that no build performs. The lockfile moves by two lines, the version and its checksum, and nothing else resolves differently; cargo check -p aerovault passes against this application's own feature resolution. MPL and GPL combine here only because aerovault carries no Exhibit B "Incompatible With Secondary Licenses" notice, verified absent in this release. If that notice ever appears upstream the combination stops being permitted and NO BUILD WILL FAIL, so this is a reading to repeat by hand at every aerovault bump rather than something a gate can hold	🟢 done	5525b5a6	#691
52		The hypothesis was wrong and the undocumented comment was right, which is why the measurements now sit in the source. The Drive ID Fetch button printed Infomaniak's raw JSON at the user, with the one fact they needed inside it and unreadable. Dropping the profile call looked like the fix; measured live with a drive-only token instead: /2/profile 403 requiring user_info, /2/drive without the parameter 422 "The account id field is required", /2/accounts 403, /2/drive/init 200 returning an ips.uuid and not an account id. So account_id really is required and the remedy is a differently scoped token, not a different endpoint, and that 200 is recorded next to the code precisely because it would send the next reader down a road that does not exist. The message now names the missing scope, read from error.context.scopes and not from the prose description, with a fallback for a refusal that names none, because a defect that returns for a subset is harder to see than one that returns for all. Raised in #650	🟢 done	203157f1	#686
53		A licence identifier is the one field no test can be wrong about, which is why the wrong one survived. The deprecated GPL-3.0 SPDX id is replaced by GPL-3.0-or-later in the README, Cargo.toml, tauri.conf.json, snapcraft.yaml and two source headers. It began as an uncommitted edit sitting on a UI-tokens branch, where a licence field would have reached main inside a pull request about button labels and nobody reviewing that diff would have been looking for it. The last two declarations were found by enumerating the files that declare a licence, not by grepping the old string, which is the search that had already missed them once. No gate covers this in either direction: the suite asserts nothing about SPDX values, so a wrong identifier is invisible to CI and only a reading finds it	🟢 done	52988245	#688
54		Contribution origin is certified with a DCO rather than a CLA, which asks a contributor to state where their code came from instead of asking them to sign rights over. The check is thirty lines of shell using no third-party action beyond the official checkout, deliberately: verifying the provenance of contributions is the wrong place to introduce a supply chain dependency. It requires the sign-off to match the commit author exactly, exempts merge commits whose content is signed off on the branch, and on failure prints the offending commits with the two commands that fix them. Nothing is retroactive, since no commit before it carries a sign-off, and it applies to my own pull requests too; the commit that introduces it is signed off, so it satisfies the check it adds. Declared: the review bot was rate limited here and never read it, and an unread pull request looks identical to a clean one from outside	🟢 done	5ea980f1	#689
55		AeroSync preserves POSIX.1e access ACLs on Linux, and the integrated protocol and metadata gaps are closed. Opt-in, Linux only, with acl_fs.rs and a packaging assertion that the shipped profile carries -A. Owner, group and device files stay out of scope and are still listed as not implemented. Logged after the fact on 2026-09-01: this row did not exist while the release was being prepared, and the omission had a visible cost. The README went on saying ACL was not implemented for the whole cycle, because nothing in the tracker recorded that it had shipped, so no reader had anything to check the sentence against. Found by diffing the 55 cycle commits against the tracker's own SHAs rather than by reading either list on its own	🟢 done	15401f02	#643
56		The status bar language chip became a way in, not only a readout. It opens Settings on the Interface sub-tab, where the language list actually lives, so the shortest path from noticing the language to changing it stops crossing two panels. Landing on Appearance was not enough, since the selector sits inside a sub-tab, and both states clear on close so a second click re-runs the effect instead of finding it already satisfied. The accessible name is "Language: Italiano" rather than "Italiano", so a screen reader is told what the button does and not only what it currently reads. The test that guarded this was rewritten and the reason is the point: it pinned the LETTER of a decision, that no t('...') may appear in the chip, which would have blocked this change while permitting a worse one, a key invented rather than reused. It now pins the property that decision protected. Logged after the fact on 2026-09-01	🟢 done	89830ea3	#657
57		FTP probes MLST before listing instead of assuming the server answers it, with a fixture server in CI that behaves the way the awkward servers do, so the branch is proved rather than reasoned about. Logged after the fact on 2026-09-01	🟢 done	10563308	#656
58		A CI lane that executes no tests now fails instead of reporting success. The AeroRsync live lane was the first point fixed. It is logged here after the fact on 2026-09-01 because it turned out to be the PRECEDENT for the largest finding of the pre-release audit: the same guard was missing on ten further selection points, and one of them, the SFTP password-only lane, had been reporting success while executing zero tests since 2026-05-16, when the test it names was renamed and the workflow line was not. A fix applied to the instance in front of you leaves no trace of its own incompleteness	🟢 done	fd80153d	#659
59		The two defects the pre-release audit found were introduced by this cycle, and both are about a comment that got the principle right one line above the code that broke it. Swift: an object name is an opaque key, so foo/../bar and bar are two different objects, and the path normalizer resolved the dot segments anyway on the path of nine call sites including rmdir_recursive, rename and server_side_copy. A recursive delete of the literal prefix foo/../bar/ was sent as bar/ and removed objects the caller never named. The function's own comment already explained that collapsing a//b into a/b would point rename, copy and delete at the wrong one; the reasoning was applied to half the cases. Resolution moved to cd, where a relative segment means what the user means by it. WebDAV: the 425 retry loop had three attempts and one return inside it, and a rotated Digest nonce arriving on the FINAL attempt issued a continue that skipped it, exhausted the range and reached unreachable!, panicking the task; both single-stream GET paths route through that helper. Its comment likewise said the replay is tracked by a flag "rather than by attempt number: the 425 loop may already have burned attempts". The replay now gets an attempt of its own, bounded at four. Both regression tests were observed FAILING first, which is the only thing that makes them regression tests: left: "bar", right: "bar", the collapse itself, and entered unreachable code, the panic reaching the caller	🟢 done	5f2d57bf	#695
60		Four published figures and one published claim that the tree contradicted, and none of them could have been caught by a gate. The README said "73 MCP tools" where the generated inventory says 77, "6 media services" where it says 5, "11 live tests in CI lane 3" where the lane selects 15, and "605 unit tests" where it runs 677; ROADMAP said "the 4 shipped" media services while listing five. The serious one is the Known limits section, which still declared ACL not implemented after the ACL support shipped IN THIS CYCLE with #643: the release would have gone to tag denying a feature it ships. Corrected with the precision the implementation has, POSIX.1e access ACLs, Linux only, opt-in, with owner, group and device files still correctly listed as not implemented. The structural point, left open on purpose: the two inventories ARE gated against the code, but the prose that cites them is NOT gated against the inventories, which is exactly how every one of these numbers drifted with all checks green. The gate is deferred rather than written on release night, with the plan in BATON-prose-vs-inventory-gate.md, because the same figures also live inside shields.io badge URLs and a gate written tonight would have read the prose and stayed green on three numbers encoded in a link	🟢 done	b269a4a0	#693
61		A ticked cleartext opt-in was revoked on every keystroke, a test that claimed to cover 35 protocols covered 34, and 66 Swedish strings the diacritics gate cannot see by construction. The first is the one that reaches users: the Swift auth-URL field recomputed the decision on every character typed, so ticking consent for a private OpenStack and then correcting one character of the URL lost the consent silently, with the tick still drawn. The decision now moves out of the JSX and touches the flag only when an edit CROSSES the preset boundary, which is what the comment above it already said. The second is the shape worth remembering: the test reads the ProviderType union with a regex matching a SEQUENCE of | "member", and a sequence stops at the first piece that is not one, so a doc comment above mtp ended the match at peer. It read 34 of 35 while asserting only length > 20, so the loose threshold hid the short read; the reader now refuses to return a short list. The third: the gate needs an accented twin in the same file, at least 4 letters and 3 times as frequent, so aterstallningsfil(2) against återställningsfil(3) scores 1.5 and stays silent. Found by folding every ASCII word and looking for the accented form of a SEGMENT elsewhere, then read one by one against the English. Restorations only, never rewordings: where the ASCII form is a real Swedish word it was left alone, which is most of what such a search proposes	🟢 done	73b312ce	#694
62		Three CI lanes could report success having executed no tests, and one of them had been doing exactly that since May. cargo test with a filter that matches nothing prints "running 0 tests", then "test result: ok." and exits 0, so a lane that proved nothing is indistinguishable from a lane that proved everything. The dead one is the SFTP password-only fallback lane: the test it names by --exact was renamed on 2026-05-16 in bb20f6a6c and the workflow line was never updated, so for three and a half months it stood up a Docker fixture, waited for SSH, ran zero tests and reported green. Read from the run log on main, not deduced: the step prints running 0 tests and test result: ok. The class was closed rather than the instances: of fourteen points that select tests, two were already protected and twelve were not; all fourteen now call one scripts/assert-tests-ran.sh, with =N for a step that names a single test and "at least N" for a suite meant to grow, because an exact match on a growing suite goes red the day someone adds a legitimate test, which usually gets answered by deleting the check. Thresholds are what a named green run actually executed, not estimates. Both gates were watched going RED with the condition made true, including the realistic way it breaks: removing the two #[ignore] attributes, which looks like an improvement	🟢 done	5532e49c	#692
63		Six error classifications were blind to the shape providers actually produce and sensitive to byte counters, in the function that decides whether a transfer is retried or discarded. The rule looked for a status code followed by a SPACE. Transfer failed: connection reset after 550 of 1024 bytes therefore classified as permission denied and NOT retryable, and both executors stop on !retryable, so the file was discarded. The half the audit did not predict is the opposite direction: Upload failed (403): the account cannot write here classified as Unknown, because the rendering ... failed ({}): {} puts a bracket and a colon there and never a space. That form is produced by kdrive, drime, internxt, fourshared, zoho, pcloud, koofr, jottacloud, box and s3, and HTTP {}: {} and ... failed with status: {} miss for the same reason. So the rule was blind to the most common rendering AND firing on quantities. The criterion moves from "the number appears somewhere" to "the number sits where a provider renders a status", with the accepted positions read one by one from the real format! calls, and the non-status numbers all sitting after a quantity word. The comment in the code had said this was waiting on a missing measurement rather than on a judgement: the measurement was taken. A test we already had caught an error in the fix: [ was briefly among the accepted prefixes, and a_path_that_looks_like_a_status_does_not_decide_the_classification went red, because a file a user names [404] note.txt would have gone back to deciding the classification	🟢 done	503b5638	#696
64		An FTP transfer could wait 1800 seconds for a refusal the client had already received and could not see. When a server sends the preliminary 150 and the final 4xx/5xx in ONE segment, the read that collects the first pulls both into the reader's buffer, and the bare socket underneath shows nothing. The watcher was peeking that socket with MSG_PEEK, so it was structurally blind to a refusal already sitting one layer up, and the transfer fell through to the data idle timeout. The observation point was wrong, not the case, which is why the remedy exposes the buffer rather than widening a heuristic or raising the timeout. Work by Kimi K3, and the object of value is the red: a test that fails on the pinned base for the predicted reason, asserting that the refusal is in the buffer AND that the socket is empty, with the data channel held open and silent. The vehicle matters too: a Docker fixture on loopback could have shown nothing, because the file itself records that there the data socket closes at once and the wait ends by itself, so the silence would have read as "does not reproduce". This ships a one-method fork of suppaftp, pinned by rev, because the crate keeps its reader private and get_ref() returns the socket UNDER the buffer; the exit condition in Cargo.toml names who must file the upstream pull request and states that it is not open yet. Under TLS the buffer holds plaintext, so the reply class stays readable where the socket bytes are not	🟢 done	f9cb0689	#698
65		A record another opener evicted is not a slot this one freed, and the two attempts to go further both got the same question wrong from the other side. enforce_cap counted a NotFound from unlink as a successful removal, so two concurrent opens planning one eviction each could both select the same oldest file: one deleted it, the other counted the failure as its own success, and both persisted, leaving the store one over its cap. That is fixed: a vanished candidate is counted separately and the loop moves to the next one, so the cap holds. What is NOT in this change, and why, is the useful part. Two further remedies were written and then reverted, each having introduced a defect worse than the one it closed: reserving the slot on disk before the cap made the rollback delete a record a concurrent opener had already adopted, and narrowing that rollback to "only if the on-disk bytes are still mine" still could not tell MINE from ANOTHER IDENTICAL, because the record carries a second-granularity timestamp and no nonce, so two openers of the same transfer in the same second serialize to the same bytes. The residual gap ships knowingly: it already exists on main, it is bounded to one record, and it is reabsorbed by the next cap that succeeds, while both remedies could lose a checkpoint an opener had been told was durable, in silence. The concurrency test was removed rather than weakened: it could not distinguish the correct case from the broken one, since both overshoot by one, and an assertion that passes in every case reads as coverage without being it	🟢 done	fa4facda	#697

Requested / under consideration

Community requests and internal follow-ups being evaluated for this or a later release.

Effort: 🟩 quick win · 🟧 medium · 🟥 large / epic. Ordered by effort (quick wins first).

#	Effort	Type	Request	Status	Source
1	🟧		Eager-evaluation preview and a single-vs-multi-target placeholder for the -i selectors (prioritised by the reporter ahead of Edit(E) and the 2-letter semantics; exact behaviour to be pinned)	🔵 idea	#311 (@EhudKirsh)
2	🟥		Lossless .jpg to .jxl transcode in AeroFile: JXL re-encodes an existing JPEG losslessly and reversibly (the original JPEG bytes reconstruct exactly), for a real size win with no quality loss. Candidate framing: AeroFile as a GUI for libjxl	🔵 idea	aerovault#2 (@EhudKirsh)
3	🟥		macOS shell integration for the OS extract feature (Deliverable G macOS, deferred): Finder Sync "Extract Here / Extract to Folder" menu items mirroring the Linux Nautilus and Windows verbs, plus macOS custom document-type icons (CFBundleDocumentTypes) for the five aero formats and the generic fallback, and rebuilding the mimetype .icns multi-size (the v4.1.0 ones are single-resolution drafts). Needs a Mac to build and live-test	🔵 planned	#1408 (Deliverable G)
4	🟥		Filen Encrypted Notes: exit Beta: take Filen Notes out of Beta. Fix the participants/add contactUUID format (currently a best-effort workaround), investigate the Filen free-plan 10-note limit ghost-note cleanup, and add a rich text editor for the rich note type	🔵 planned	-
5	🟥		PRIORITY: Linux tray/GTK heap corruption, still-uncovered off-main-thread corruptor. A GDBus worker thread aborts with malloc(): unaligned fastbin chunk detected while deserializing a D-Bus message, the classic GLib heap-corruption signature (that worker is the victim tripping over an already-poisoned fastbin, not the corruptor). Two marshalling fixes already shipped and are safe: tray badge (31db84f8b) and app_ready + splash-timeout (cae95ee91), present since v4.0.5. But the SIGABRT STILL recurs (v4.0.9 on 2026-06-25, and the v4.1.2-era build on 2026-07-05, identical signature): the marshalling is INCOMPLETE, a still-uncovered off-main-thread GTK path remains. Sync Tauri commands are provably main-thread (safe), so the suspects are the event/plugin callbacks whose thread context is unconfirmed: tray on_menu_event / on_tray_icon_event, the single-instance plugin callback, and on_window_event CloseRequested. Pre-existing across versions, intermittent, triggered by D-Bus storms on suspend/resume or monitor standby; it can corrupt the whole app until restart. Definitive path (owner-approved): adopt self-hosted crash reporting with native minidumps to capture the real corruptor, plus an ASan/valgrind repro, then finish the marshalling on the remaining callbacks	🔵 planned	-
6	🟥		Recommended-protocol highlight on the Add Service / Quick Connect pages, after real benchmarks land (#368)	🔵 idea	#274 (@EhudKirsh)
7	🟧		File association opt-out (deferred, design parked): two switches, AeroFTP's own five formats vs the eight general archive formats, with the choice persisted in HKCU\Software\AeroFTP\Settings and re-read by NSIS_HOOK_POSTINSTALL so an in-app update cannot silently restore it (POSTINSTALL runs on every install, and an update is an install), plus a /NOASSOC setup switch. A visible components-page checkbox is out of reach without forking the Tauri NSIS template, which is why it is parked rather than half built. Raised in #454; deferred because AeroFTP never claims the default handler for the general formats, it only adds itself to "Open with" plus its own context-menu entries, so with the uninstall residue fixed (queued #59) what remains is menu visibility	🔵 planned	#454
8	🟨		Sort the bridge tools you actually have to the top of the Export/Import picker. The four-commit branch is now proposed. Live Tauri/WebKitGTK verification on Wayland called all 15 backend probes without error, detected AWS, OpenSSH, MinIO Client, rclone and FileZilla on this machine, and showed those five first with their paths while the other ten remained below. Closing and reopening the picker preserved the same result with zero spinner, directly covering the StrictMode/remount failure that the green unit suite could not expose. Reviewer gates remain 16 of 16 focused tests, 832 frontend tests and clean tsc	🔵 PR open	#678
9	🟥		Application identifier rename, com.aeroftp.AeroFTP to app.aeroftp.AeroFTP: DEFERRED behind other priorities, kept here so it is not rediscovered. Not a cosmetic rename: the identifier is the Flatpak id, the desktop file's identity, the autostart entry, the installed package's identity, and the key under which existing users' saved credentials live, so shipping it needs a migration path for everyone already installed. The existing work is less than half of it: the branch touches 9 files, while main names com.aeroftp in 68, of which 47 are locale files and 21 are not (including credential_store.rs, file_associations.rs, lib.rs, portable.rs, the CLI, snapcraft.yaml, the NSIS hooks, the updater policy and the two deb scripts). app.aeroftp appears nowhere on main. Merging the branch as it stands would leave the app half renamed, which for an identifier is worse than either end state: the keyring would look for one service, the desktop file declare another, the updater a third. The work exists as a single unpushed commit 696a3d02 dated 2026-07-12 on the L2 workstation, branch chore/app-id-rename-app-domain, worktree aeroftp-appid-rename, and nowhere else. It survived the branch cleanup of 2026-08-31 only because it had never been pushed, so no audit of origin could see it and it was not on the deletion list either. Found by cross-checking the deleted branches against L2's local work, asking the question that no list suggested	🔵 planned	-

Known issues found after release

Reported against v4.1.7. Carried over from the #1415 tracker where still open.

#	Area	Description	Status	Linked issue
1	OAuth / pCloud	Resolved, and the cause recorded here was wrong. pCloud trash returned "⚠ Authentication failed: Log in required" because pCloud refuses its trash endpoints to OAuth access tokens, not because of a stale token and not because the endpoint rejects Bearer header auth. Verified live against a real account: listfolder returns result: 0 while trash_list returns result: 1000 for the same token on both transports, with and without recursive and with an explicit folderid=0, and userinfo?getauth=1 returns no session token for an OAuth caller. pCloud OAuth has no trash permission to request (manageshares is the only one), so re-authorizing changes nothing, and rclone does not implement CleanUp for pCloud either. The View Trash affordance is removed for pCloud rather than left as a control that cannot work. Carried over from #1414 known issue #4, then #1415 known issue #1	🟢 fixed	#397
2	FTP	Resolved, and re-measured live rather than closed on the merge. The wait was inside the data channel's TLS handshake, one step before the read loop that was already guarded, so a request the server accepted and then ignored had no deadline at all. Every data-channel opening now has one, listings have their own, and an expiry drops the session instead of handing the next command a reply that is still owed. Re-run on 80f470a8 against a real server: the CLI and the MCP surface both now refuse with Invalid path: [550] 550 Failed to open file. naming the file, in 33.1s and 30.2s, ended by the client and not by a harness cap. The wait is bounded, not short: those 33 seconds are the opening budget being spent. The listing issued straight afterwards on the same profile, which previously never returned because the stuck download held the pooled connection, comes back in 0.4s. Full table in the results comment.	✅	#663
3	Branch reconciliation / IntroHub	Resolved: fix/introhub-347 has no functional hunk left behind. Catalog badges, generic-server order and per-method glyphs, and form-tab drag reorder all reached main through focused commits bb5a53c8, fea55779, b5218d29 and 6a78daa2, with shared ordering/helpers and regression tests. The branch-only discoverData.ts export is an unused duplicate. Its remaining icon remap is a rejected alternative, not missing work: main deliberately preserves the shipped #567 OAuth/S3/FTP/SFTP assignments and documents why S3 stays Database and Blob uses Container. The parked branch is superseded and safe to retire after this audit; it was not deleted here	✅	-

_{Status legend: 🔴 confirmed · 🟡 investigating · 🔵 planned / idea · 🟢 done / fixed (pending release) · ✅ released}

[axpnet]

The remote panel was empty on Blomp, and the tab had lost its logo

Post-4.1.8 follow-up, fixed on main, shipping in v4.1.9.

Two defects reported against v4.1.8, one raised by CodeRabbit on the fix for the first, and one internal cleanup that rode with them.

Area	Description	Status	Ref
Swift / Blomp	The GUI opens a session on the path ., and the Swift normalizer only trimmed slashes, so . survived as a literal directory name and every request asked the container for a directory that does not exist. The panel came back empty while uploads landed correctly, which is why the account looked broken only in the app. normalize_path resolves . and .. now, so all nine call sites are covered rather than the listing alone.	🟢 fixed	fa0325d3
Swift / object names	The first cut of that fix dropped every empty segment, which silently turned a//b into a/b. A Swift object name is an opaque key rather than a filesystem path, so those are two different objects: the listing kept the name the server returned while rename, copy and delete went through the normalizer and addressed the other one. Only . and .. are resolved now, and repeated slashes inside a name survive.	🟢 fixed	fa0325d3
Session tabs	The Blomp logo, its PNG and its PROVIDER_LOGOS entry were all correct and all unreachable, gated behind a hand-written allowlist of 28 provider names that nobody had extended. The rule is inverted: ftp and ftps are declared as the protocols without a logo, everything else is a provider. A test reads the ProviderType union from source and fails when the two drift apart.	🟢 fixed	fa0325d3
Profiles	The three option-key normalizers are one table now, so the CLI, MCP, agent and AI tools resolve the same aliases. No behavior change today, since none of those paths connected to a protocol reading an aliased key, which is exactly why it would have failed silently later. Closes item 16 of the pending list.	🟢 fixed	fa0325d3

The listing defect predates v4.1.8. It has been there since v3.1.6 and surfaced now because v4.1.8 put Blomp back in front of people. The v4.1.8 notes were accurate about what they claimed, the cleartext guard was restored and the connection does succeed, but a user who read them and opened the app saw an empty panel, so the correction belongs in the next patch rather than a later release.

Worth recording, because it is the second time in this cycle: the session tab drew the generic icon while the logo, the asset and the mapping were all present and correct. Nothing was missing. One includes() decided which of them were reachable, and it had not been updated in four provider additions. The same shape as forget_endpoint in the v4.1.8 audit, and as the inventory drift check that no workflow ran.

Verified green: cargo fmt, clippy at --all-features --tests on the lib and on the aeroftp-cli bin and at --all-targets on default features, the full Rust suite, tsc, vitest at 93 files and 801 tests, i18n:validate with 0 missing and 0 placeholders across 47 locales.

[axpnet]

WebDAV survives a Digest nonce rotation instead of reporting the session expired

Post-4.1.8 follow-up, fixed on main, shipping in v4.1.9 (row 11 of "Requested / under consideration", accepted debt declared in v4.1.8).

An Apache mod_auth_digest server rotates its nonce on AuthDigestNonceLifetime, 300 seconds by default, and answers 401 ... stale=true. Only PROPFIND re-negotiated on that; every data path mapped the 401 to "Session expired", so a perfectly authorised transfer failed five minutes in.

The blocker was not the missing retry. It was that the retry could not be decided: DigestChallenge had no stale field at all, and DigestState::renegotiate accepted any parseable Digest challenge and returned true, while its own doc comment claimed it adopted a challenge "from a 401 ... stale=true response". A revoked password answers with a challenge that parses perfectly, so the code could not tell a nonce rotation from a credential failure, and wiring a retry onto that gate would not have risked the retry storm, it would have been it. That is why the debt was deferred rather than closed in v4.1.8.

Area	Description	Status	Ref
Digest challenge	stale is parsed from the challenge, bare, quoted, and case-insensitively, since RFC 2617 writes it bare but servers quote and case it freely	🟢 fixed	35a420d9
The gate	renegotiate adopts only when the challenge says stale=true AND offers a nonce different from the one held. Both conditions are load-bearing: the first separates a rotation from a revoked password, the second stops a server that answers stale=true while echoing the dead nonce from being retried once per request forever	🟢 fixed	35a420d9
Data paths	stat, checksum, keep_alive, the Nextcloud chunked MKCOL and the chunked part PUT replay exactly once on that gate, with no loop	🟢 fixed	35a420d9
Deliberately excluded	list goes through send_propfind, which already re-negotiates, so a retry there would be a second attempt on an already retried request	🟢 by design	35a420d9
Chunked part replay	The PUT clones the DiskSlicePart descriptor before the body is consumed and re-opens the same disk window, copying no bytes. Buffering the part instead would put resident bytes in flight that the governor never leased, since this provider reports multipart_streams_part_body and the shaping profile therefore reserves only one streaming window per part (DAG-P2-05)	🟢 fixed	35a420d9
Accepted debt	The comment in clone_for_transfer now records the debt as closed and how, rather than claiming a deferral that no longer exists	🟢 fixed	35a420d9

The repair is pool-wide, which is what makes it worth doing at all: the challenge lives behind a shared Arc, so one worker adopting the rotation fixes every clone_for_transfer sibling still presenting the dead nonce. That is the batch case that motivated the deferral.

Tests. Seven new, two existing corrected. The data-path tests run against a real socket: there is no HTTP mock in [dev-dependencies] and none was needed, since the project already tests wire behaviour with hand-rolled tokio::net::TcpListener stubs. The stub serves one canned response per connection and closes, so the accept count is the request count.

Case	Expectation	Status
Genuine rotation	exactly 2 requests, and the replay carries the rotated nonce	🟢 passing
401 re-offering the nonce already held	exactly 1 request, still fails. This is the revoked-password guard	🟢 passing
Server rotating on every response	still stops at 2, so the replay is never itself retried	🟢 passing
stale forms	stale=true, stale="true", stale=TRUE, stale="True" all true; absent and stale=false both false	🟢 passing
Pool-wide repair under the tighter gate	a sibling clone no longer presents the dead nonce	🟢 passing

Two existing tests passed challenges without stale and expected true. They use renegotiate only as a vehicle for swapping the nonce, so they were given stale=true rather than retargeted, which preserves what they actually cover.

Not verified, and stated rather than assumed: live validation against a Digest server that rotates its nonce has not been performed, and the chunked-PUT disk replay is not exercised end to end, since that needs both a Digest server and a real multipart upload.

Verified green: cargo fmt --all --check clean, cargo clippy --all-features --tests, --bin aeroftp-cli and --all-targets all rc=0 with 0 errors, cargo test 4052 passed / 0 failed / 67 ignored across 22 test-result blocks, and 14 CI checks green on Linux, Windows and macOS.

[axpnet]

The strings that shipped as raw English inside translated locales are gone, and a gate keeps them out

Post-4.1.8 follow-up, fixed on main, shipping in v4.1.9 (item 13).

About 55 keys read as English in 43 to 46 locales at once. i18n:validate never caught them because it checks that a value exists and is not a placeholder, not that the value is not English. Those are two different questions, and only the first was being asked.

The obvious test for the second is useless. "Value identical to English" fires on 15992 pairs across 1093 keys, and almost all of them are correct: FTP, AeroCloud, RAG, us-east-1, ARNs. Any gate built on it prints sixteen thousand lines that nobody reads, which is exactly why the class survived.

Area	Description	Status	Ref
Detector	Keeps identity as the trigger but takes its evidence from the shape of the English source: translatable prose only if, with {...} tokens removed, at least two words remain and at least one is a closed-class English function word. Nouns and verbs are excluded on purpose, because "Server", "Import" and "Status" are exactly what a European locale keeps by choice. 15992 pairs become 1966 across 69 keys	🟢 fixed	078574cf
Backlog	1899 values translated across 46 locales in two waves	🟢 fixed	078574cf
Gate	Ships at --strict, not as a ratchet. It shipped as a ratchet only while the backlog existed, because with 1966 outstanding the only way to make --strict pass on day one is to bulk-accept everything, and an acceptance nobody read is a silencing rather than an acceptance. The backlog is zero, so the ratchet is gone	🟢 fixed	078574cf
Baseline correction	The twelve keys that are English in all 46 on purpose are the client-id and client-secret placeholder masks for box, dropbox, 4shared, google, onedrive and pcloud. This row previously said six. The gate verifies they stay identical everywhere and complains if one drifts	🟢 fixed	078574cf
Italian in en.json	protocol.endpointPlaceholder read es. s3.example.com. es. is Italian, English is e.g.. The defect was in the reference file, which is why it had propagated to all 46 rather than being an ordinary typo in one. Note the Italian string was not wrong: es. is correct Italian, and it.json is the only one of the 46 unchanged by the fix. What was wrong was the file it had been written into	🟢 fixed	078574cf
Diacritics report	The --json branch of the diacritics gate called process.exit() immediately after console.log, which abandons queued stdout, so past the 64KB pipe buffer the report was cut mid-string and unparseable. Both that branch and the human one now set process.exitCode, removing the shape rather than the symptom	🟢 fixed	5a309134

The baseline is evidence, not opinion. Several entries were decided by experiment rather than by reading the string.

connection.internxtEmailPlaceholder (your.email@example.com) looked like prose to the detector. Handed to 46 translators with instructions to translate it, all 46 returned it unchanged.

protocol.discoverFileLuFtp and aeroShare.send.menu were initially excluded from the baseline on the argument that, since 40 of 46 locales had translated the first and 44 of 46 the second, the identical ones had to be misses. The second pass refuted that: given to a translator, they came back identical in Danish, Dutch, Norwegian, French, Portuguese and Swedish, because via and over are real words in those languages and the rest is a brand. The original argument was about the population, not about the language.

A near miss worth recording, because it is reproducible and it is a property of the batch-translation method rather than of this change. Each translator agent receives the union of the locales in its group, so it translates every key for every locale in that union, including pairs that were already correct. Forty-one good translations were nearly overwritten, twenty of them in it.json, which is hand-translated. The canary does not cover this class: it checks token drift, unknown keys and residual placeholders, but has no notion of "this pair was already fine". The only signal was a count that did not match, 28 changes on it where the gate reported 13. The defence is to filter each batch to the pairs the gate actually flagged. The inverse case exists too and was caught the same way: nl/github.commitMessagePlaceholder had a good Dutch value that an agent replaced with English, so an echo means "already correct in this language" only when the locale file really contains the English.

Diacritics surfaced by translation, not introduced by it. Three stripped-diacritic strings appeared during the work (is and tr vault.strippingParity, ro preview.text.refresh) and were corrected by hand against the English, never by an automated pass (#512). They are pre-existing: the diacritics detector reasons about frequency within a single file and flags an ASCII word only when the accented twin exists in the same file and is more frequent, so while the accented forms were absent the evidence did not exist. Every wave of translations can surface more, and that is not a regression. Two others were judged correct as written and recorded with the reason: Welsh Client inside Client ID is the literal field name in GitHub's OAuth settings, and Latvian laika in Laika logs is the genitive that "window of time" requires, where the accented form the detector prefers is the locative and means something else.

Tests: 8 behavioural, over a fixture copy of the locales. A gate that has never been seen to fail is not a gate. Clean tree passing, a new untranslated string breaking the build, a deliberate key drifting, a deliberate key vanishing from en.json, a new leak failing, a known leak alone passing while marked scheduled, --strict behaviour, and --json integrity over a pipe. The last exists because the first implementation had the same process.exit() truncation bug, on a 317KB report where it was immediate and total.

Verified green: i18n:untranslated --strict exit 0, i18n:validate 0/0/0 PASSED, i18n:diacritics 0 new with 38 accepted, tsc --noEmit clean, vitest 93 files and 801 tests, and CI green on both pull requests.

[axpnet]

Every WebDAV request path re-negotiates a rotated Digest nonce, and the live validation is done

Post-4.1.8 follow-up, fixed on main, shipping in v4.1.9 (#639, commit 27cb17e6). Closes what queued item 6 left open, including the live validation it explicitly did not claim.

Item 6 built its map by grepping for UNAUTHORIZED. That found only the call sites naming the status, and missed every site that lets a 401 fall into a catch-all status => arm, which is most of the provider. Against a real Apache mod_auth_digest server rotating its nonce, a recursive download of 60 files lost 52 of them: each GET that met an expired nonce failed as "Authentication failed during transfer" and was never replayed.

Area	Description	Status	Ref
Request paths	A shared helper takes a closure that rebuilds the request, so a replay recomputes its own Authorization header and never re-presents the dead nonce. Wired into download, download_to_bytes, read_range, resume_download, DELETE, MOVE, COPY, MKCOL and UNLOCK.	🟢 fixed	27cb17e6
Single PUT	Rebuilds its body by reopening the local file rather than buffering it, which would defeat the streaming that path exists for. The fresh handle also guarantees the replay starts at offset zero rather than wherever the first attempt stopped reading.	🟢 fixed	27cb17e6
Idempotence	Replaying on 401 is safe for callers that are not idempotent, because a 401 means the server rejected the request before applying it. That is what separates it from replaying a timeout or a 5xx, where the server may already have acted.	🟢 fixed	27cb17e6
Concurrency defect	Found only under parallel transfers, and no unit test could have shown it. The "adopt only a nonce we are not already holding" rule is what stops a revoked password becoming a storm, but a sibling worker often adopts the rotation first, so the server offers back a nonce the shared challenge already holds, renegotiate correctly declines, and the request that lost the race dies holding a dead nonce. A replay is now also granted when the held nonce differs from the one the failed request carried.	🟢 fixed	27cb17e6
Anti-storm property	Unchanged. When nothing rotated, the held nonce still equals the one just used and adoption refuses, so both arms are false and a bad credential still costs exactly one request.	🟢 unchanged	27cb17e6

Live validation

Apache 2.4.58 with AuthType Digest, AuthDigestNonceLifetime tuned so a single request completes inside the window while the session crosses it repeatedly. tc netem, scoped to the lab port alone, shaped the link for the upload leg: Apache's RATE_LIMIT cannot, being an output filter.

Measurement	Before	After
Recursive download, 60 files	8 downloaded, 52 failed	60/60, three consecutive runs
Nonce rotations observed	53	12 to 17 per run
Recursive upload, 24 files	not reachable from a vanilla server	24/24, four rotations on PUT
Integrity	not reached	every MD5 matches, both directions
401s on any single path	1, never replayed	never more than 1, always replayed

Where the boundary is

Sweeping the nonce lifetime against injected one-way delay produced a rule rather than a set of cases:

The replay succeeds while RTT < AuthDigestNonceLifetime, and fails exactly when RTT >= L.

The nonce is minted when the server emits the 401 and must still be alive when the replay arrives, which is one round trip later. There is no margin to recover: the credential expires in flight.

one-way delay	lifetime	network RTT	RTT/L	result
0 ms	1 s	0 ms	0.00	60/60
300 ms	1 s	600 ms	0.60	60/60
400 ms	1 s	800 ms	0.80	60/60
500 ms	1 s	1000 ms	1.00	0/60
700 ms	1 s	1400 ms	1.40	0/60
700 ms	2 s	1400 ms	0.70	60/60
800 ms	2 s	1600 ms	0.80	60/60
1000 ms	2 s	2000 ms	1.00	0/60

The threshold moves with L and keeps the ratio: it breaks between 400 and 500 ms at L=1, and between 800 and 1000 ms at L=2. The second pair was predicted from the first before being measured. Three regimes follow: broken when RTT >= L, usable when RTT < L < session duration, and inert when L >= session duration, where a 60/60 with zero rotations proves nothing. Optimal is L around three to five times the RTT and below a third of the session.

The maximum number of 401s on any single path separates the regimes with no ambiguity: 1 means healthy, 2 means the configuration is unsatisfiable because the replay went out and died too.

The broken regime needs RTT >= L. Against Apache's default lifetime of 300 s that would take a five-minute round trip, so it does not occur outside a lab with a deliberately short lifetime. It is also not a client-side limit: no client can do better, because the server is handing out a credential that expires before it can be used, and chasing the rotation further is the storm the stale gate exists to prevent.

Known limit, recorded rather than hidden

The nonce snapshot is read just before the request is built, while authorization takes a single guard to compute the header. A sibling rotating in that window makes the snapshot disagree with what the request carried, and the sibling-repair arm then grants a replay that was not needed. It costs one extra request and cannot storm, since the replay stays capped at one. Closing it means having authorization report the nonce it used, which changes a signature shared across some forty call sites.

Verified green: cargo fmt --all --check clean, three clippy runs (--all-features --tests, --bin aeroftp-cli, --all-targets) at rc=0 with 0 errors, read without a pipe between cargo and the exit code, and the full suite at 4052 passed 0 failed across 22 blocks.

[axpnet]

Every published figure now comes from the code, and a gate fails when it drifts

Post-4.1.8 follow-up, fixed on main, shipping in v4.1.9 (item 12, and the docs half is docs#7).

Three different numbers for the same noun were published at once and none of them errored. The README said 25+ native integrations and 45+ presets. docs/PROTOCOL-FEATURES.md said 45+ over a table listing 33. The docs site said "22 storage protocols", a figure no source in the project produces. Prose does not fail a build, so all three were correct in the code and wrong everywhere they were quoted.

Area	Description	Status	Ref
Inventory	scripts/gen-provider-inventory.ts derives every figure into docs/PROVIDER-INVENTORY.json. Nothing new was invented: PROVIDER_CATALOG already knew the companies and their connection methods, the registry and getTotalServiceCount() already knew the catalog, and the two already agreed. What was missing was a place where both are written down	🟢 fixed	1aacdd10
Gate	--check fails when the committed file stops matching the code and prints which count moved, so the sentence quoting it is updated in the same commit. Runs in the fast checks lane, next to the command-inventory gate that already did this for the CLI, MCP and agent surfaces	🟢 fixed	1aacdd10
Vocabulary	Most of the drift came from one word standing for four things, so the counts are named after what they count and the wrong noun is now a wrong key rather than a plausible sentence	🟢 fixed	1aacdd10
Manifests	Nine stale counts corrected, including the two nobody opens: the AppStream metainfo that GNOME Software and KDE Discover render (25+ providers, 45+ presets, AeroAgent with 68 tools, a CLI with 77 commands) and the Snap Store listing (19 AI providers against 24 everywhere else)	🟢 fixed	1aacdd10
Docs site	The "22 storage protocols" opening is replaced with the real figures and their provenance, and the page now says out loud that it is a selection rather than the catalogue, which is what made the old count misleading even when it was written	🟢 fixed	docs#7
Repeatability	A provider-figures skill carries the full list of declaration sites, file by file, so the check is repeatable without rebuilding the reasoning	🟢 fixed	n/a

The figures, and which noun each one answers

the sentence says	figure
transport protocols	7
native integrations	24
presets	44
connection forms	49
providers	51
connection methods	65
services in the Add Services catalog	72
AeroAgent tools	39
CLI commands	94
MCP tools	77

A preset is a form that arrives already filled in. That is the split the project has always drawn, specific against generic, and it is now derived from the data rather than from an id prefix: the two generic forms carry an empty defaults AND an empty endpoints, while every real preset carries at least one. So a new blank form is classified correctly even if nobody remembers to name it custom-. Three named services also come out blank, because 4shared, FileLu and native Backblaze authenticate by OAuth or an API key and have no host to preset; they are neither presets nor generic and are reported under their own key.

MCP is 77, the 39 primary tools plus the 38 aliases, which is what an agent connecting to the server actually sees. Not to be confused with the 39 AeroAgent tools, which are a different surface inside the app: pages saying "AI assistant with 39 tools" are about that and are correct as they stand.

Release notes were left alone. The <release> blocks in the metainfo and the version log in the CLI guide quote what was true at the time. Two of their figures look like hits and are not: "25+ runtime knobs" and "45+ security findings" are neither providers nor presets.

Verified green: provider inventory current, i18n:validate 0 missing 0 extra 0 placeholders, i18n:diacritics 0 new, i18n:untranslated strict and clean, tsc --noEmit clean, vitest 93 files and 801 tests, the metainfo still parses as XML and the snapcraft file as YAML. The gate itself was seen to fail: exit 1 on a mutated count, exit 1 on a missing file, exit 0 when clean.

[axpnet]

pCloud's trash button is removed, because pCloud will never honour it

Post-4.1.8 follow-up, fixed on main, shipping in v4.1.9 (#397, reported by @EhudKirsh).

This is the last "Known issues found after release" row, carried on three trackers (#1414 known issue #4, then #1415 known issue #1, then here). It survived twice because someone read the code, found the trash path correct, and left the row open pending a live test. The code was correct. That is exactly why reading it again was never going to close it, so this time it was run against a real pCloud account.

pCloud refuses its trash endpoints to OAuth access tokens. The error message was telling the truth all along, and the previously recorded cause on this tracker (a stale token, plus an endpoint that supposedly rejects Bearer header auth) was wrong on both counts.

Area	Description	Status	Ref
pCloud trash	trash_list returns result: 1000 "Log in required." for a valid OAuth access token, identically as a Bearer header and as an access_token query parameter, with and without recursive, and with an explicit folderid=0	🟢 root-caused	adbf0393
pCloud trash	Not a stale token. The profile had been idle eight weeks and a plain listing worked first try with no re-authentication, so the refresh path is healthy	🟢 disproved	adbf0393
pCloud trash	No session-token fallback. userinfo?getauth=1 returns no auth field to an OAuth caller, so an OAuth connection cannot upgrade itself	🟢 confirmed	adbf0393
pCloud trash	No configuration fixes it. pCloud OAuth exposes one optional permission, manageshares, with nothing covering trash, so re-authorizing or re-registering the app changes nothing	🟢 confirmed	adbf0393
GUI	The View Trash affordance is removed for pCloud, mirroring the internxt entry already disabled in the same map for the same class of reason. No new user-facing strings, so no locale work	🟢 fixed	adbf0393
Code comment	pcloud.rs:396 states that pCloud trash and revisions reject Bearer header auth, which is why those calls use a query parameter. Disproved for trash. Revisions still ride the same helper on that unverified premise and were not tested	🟡 follow-up	-

Wire evidence, one connected session, one token, seconds apart:

Call	Result
listfolder (control, fired between two failing trash calls)	result: 0
userinfo	result: 0
trash_list with Bearer header	result: 1000
trash_list with access_token query param	result: 1000
trash_list?recursive=1 and trash_list?folderid=0	result: 1000
userinfo?getauth=1	no auth field returned

For corroboration outside AeroFTP: rclone does not implement CleanUp for pCloud at all, while it does implement it for Google Drive. The pCloud web and desktop clients reach the trash because they authenticate with a session login rather than a third-party OAuth token.

Verified green: typecheck clean, i18n validation clean (46 locales, 0 placeholders), vitest 801 passed across 93 files, and CI green on all four platforms (Linux, Windows, macOS aarch64, macOS x64) before merge. No Rust changed.

[axpnet]

DigitalOcean Spaces is no longer hidden behind an unstable flag

Post-4.1.8 follow-up, fixed on main, shipping in v4.1.9.

This supersedes the DigitalOcean half of queued row 15. That row recorded why the preset stayed gated; the owner's call is that the reason never justified the gate in the first place, so the gate is lifted instead.

Area	Description	Status	Ref
Providers	DigitalOcean Spaces carried stable: false for a missing live verification, not for a known defect: the trial account used for testing had expired and no other Spaces key was available	🟢 fixed	e65f0603
Providers	It is an ordinary S3 endpoint dispatching through the same stack as the other forty-eight presets, with no provider-specific code path of its own, so there is nothing about it that could behave differently	🟢 rationale	e65f0603
Providers	The explanatory comment goes with the flag. A note describing a deferral that no longer exists is worse than no note, because it tells the next reader to expect a caveat that is not there	🟢 fixed	e65f0603
Providers	Set to true explicitly rather than deleted. Every consumer tests stable as falsy (if (stableOnly && !p.stable) in the selector, filter(p => p.stable) in the registry), so deleting the field would have left the preset filtered out and dimmed exactly as before, while UnstableProviderNotice (which tests stable !== false) stopped showing its badge: the same hidden state, minus the warning. All forty-nine presets now carry the field	🟢 fixed	e65f0603
Figures	stable is not a counted field, so no published provider figure moves	🟢 confirmed	e65f0603

Verified green: provider inventory current, typecheck clean, i18n validation clean, vitest 801 passed across 93 files, and CI green on all four platforms (Linux, Windows, macOS aarch64, macOS x64) before merge.

[axpnet]

A user can restyle the app chrome, and the request as written was declined on purpose

Post-4.1.8 follow-up, fixed on main, shipping in v4.1.9 (previously row 6 of "Requested", from #347, raised by @EhudKirsh).

The request was Obsidian-style CSS snippets, raised when the preview scrollbar was widened in v4.1.1. What shipped is narrower, and the reason is the substance rather than an excuse.

Obsidian can offer a snippets folder because its DOM is a public contract: .workspace-leaf and .nav-file-title are names its authors commit to keeping. AeroFTP's class names are Tailwind utilities generated per build, so a snippet targeting .bg-gray-800 works until someone restyles that component and then breaks silently: the user sees a broken app, we see an unreproducible bug report, and nobody connects it to a change three releases earlier. So "let users write CSS" is really "commit every future UI change to a DOM contract that does not exist yet". Injecting a <style> element is forty lines and the CSP already permits it; maintaining the contract is the epic.

Area	Description	Status	Ref
Tokens	Fifteen published CSS custom properties, overridable from <data root>/ui-tokens.json: five scrollbar metrics, which cover the request that started the thread, and ten of the existing colour properties	🟢 fixed	64439be8
Contract	docs/UI-TOKENS.md is the promise, and says so: a token is public from the moment it appears on that page, not from the moment it appears in the CSS, and anything unlisted is private and may change in any release	🟢 fixed	64439be8
Safety	The status colours are deliberately not overridable. A user who sets error and success to the same value has made a destructive-action warning indistinguishable from a confirmation, and that is not worth the cosmetic freedom	🟢 fixed	64439be8
Validation	Reject, not sanitise. Unknown keys, out-of-range lengths, malformed colours and anything containing url(, expression, ; or } are dropped, each reported in the activity log with its reason	🟢 fixed	64439be8
Locales	Nine defects repaired across six locales that every i18n gate passes, because the value is present, is in the right script and is not English	🟢 fixed	64439be8

What the live test found, which is why it is not optional

Every gate was green and the feature did nothing.

The fs plugin cannot reach the data root. tauri::scope::fs sets require_literal_leading_dot = true on unix ("dotfiles are not supposed to be exposed by default"), so $HOME/** does not match ~/.config/aeroftp, and $APPCONFIG resolves to the legacy identifier-scoped directory. The plan asserted the scope covered it and the assertion survived a code review, because nothing executes a capability file.

Widening the scope was considered and rejected rather than skipped: $HOME/.config/aeroftp/** gives the webview read access to vault.db in that same directory, and still misses portable mode and a relocated XDG_CONFIG_HOME. Two backend commands resolve the root through portable::aeroftp_data_root() instead, so no capability changed at all.

One conflation is fixed because it is what hid that bug. The loader caught every failure and returned null, so "forbidden" and "absent" produced the same silent result: a file that was never read looked exactly like a user who had not written one.

The startup load ran twice, so four bad values produced eight rejections. React StrictMode double-mounts precisely to surface effects that are not idempotent, so the fix was to make the effect idempotent rather than to silence the signal.

reload() was additive where it had to be authoritative. A key deleted from the file stayed applied while the panel counted it gone, and deleting the file left every override applied until restart with the counters reading zero.

ensure_ui_tokens_file took its content from the frontend, so the webview could write an arbitrary string into the directory this change is at pains to protect. It is a Rust constant now and the command takes no arguments.

Nine locale defects no gate can see

The Greek string carried the English ;, which in Greek is the question mark, so "changes apply on reload" read as a question; the file already uses ano teleia 39 times for exactly this. Galician was missing an accent that two other verbs in the same sentence carry, which is the stripped-diacritics class that has its own CI gate, and that gate reported zero new hits: a reminder that its recall is a floor rather than a total, as its own docstring says. Georgian had a malformed hapax, Serbian a word that is not Serbian, Chinese ASCII punctuation where the values use fullwidth 162 times against 40, and Swahili a class 5 noun taking class 10 concord.

Six further findings are recorded rather than guessed at. They need a native reader, and guessing would repeat the mistake they are meant to fix.

Live test: 10 of 10

Driven through the WebKit inspector against the dev build. Baseline, override applied, survives five theme switches, 9999px rejected, red; position: fixed rejected, --color-error rejected, url() rejected, one valid entry applied alongside four invalid ones, every rejection reported with key and reason, file removed and defaults restored. Settings verified end to end: Reload takes the scrollbar from 6px to 18px reporting "Applied 1 / Rejected 0", Reset returns it to 6px and removes only the published properties.

Verified green: cargo fmt clean; cargo clippy clean on --all-features --tests, on --all-targets with default features and on --bin aeroftp-cli, all with -D warnings; cargo test 4052 passed and 0 failed across 22 blocks; tsc --noEmit clean; vitest 94 files and 816 tests; i18n:validate 0/0/0, i18n:diacritics 0 new, i18n:untranslated strict and clean; provider inventory current. Re-run after rebasing onto current main, and CI green on all platforms before the merge.

Two labels are left as owner decisions rather than oversights: "Reset to defaults" clears the document but leaves the file, so the reset lasts until the next start, and uiTokensTitle is translated in ja, ko and zh while the other 44 locales keep "UI tokens". Changing either is another pass over 47 locale files.

[axpnet]

A yanked crate turned main red, and the lock moved by four lines

Post-4.1.8 follow-up, fixed on main, shipping in v4.1.9 (PR #645).

Not a vulnerability. crates.io yanked chacha20 0.10.1 and the audit step denies yanked crates, so the red was a supply-chain hygiene signal rather than an advisory against the code.

Worth recording why the pull request merged just before it was green while main went red, because it looks like an escape and is not. cargo audit runs with continue-on-error on pull requests and authoritative on push to main, deliberately, so an advisory published against a transitive dependency cannot red-wall an unrelated PR. The yank landed between that PR's run and its merge. That is the mechanism working, not failing.

Area	Description	Status	Ref
Lock	chacha20 0.10.1 replaced by 0.10.2. The lock carries two majors and only one moved: 0.9.1 comes from chacha20poly1305, which requires ^0.9 and is untouched; the yanked 0.10.1 came in through rand and ssh-cipher	🟢 fixed	b5dea635
Method	Edited by hand rather than resolved. cargo update -p chacha20@0.10.1 --precise 0.10.2 also re-resolved two unrelated dependencies, downgrading syn inside data-encoding-macro-internal and getrandom inside tempfile. Both resolutions are valid, neither belongs to this fix, and a dependency change should be the change it claims to be	🟢 done	b5dea635

The resulting diff is four lines: the version, the checksum, and the two references.

One caveat stated rather than glossed over: this landed minutes before the next change, so the Checks run for b5dea635 alone was cancelled by the concurrency group and the green belongs to e8768e44, which contains both commits. The second commit touches only locale JSON and no Rust, so a passing cargo audit is attributable to this one, but the isolated proof does not exist.

Verified green: cargo metadata --locked exits 0, so the hand-edited lock is coherent and cargo would not rewrite it; cargo check --locked compiles the workspace clean; cargo audit reports no yanked crate where it reported one before. On main, the Rust dependency audit (cargo audit) step is success in run 33172943128, the exact step that was failing.

[axpnet]

Two labels that described the wrong thing, and a review pass that refused two of its own findings

Post-4.1.8 follow-up, fixed on main, shipping in v4.1.9 (PR #646, following the UI tokens work in discussion #347).

Two decisions were left open when the UI tokens panel shipped. Both are closed here, and neither changed behaviour: in each case the label was wrong, not the code.

Area	Description	Status	Ref
Contract name	uiTokensTitle was translated in three locales and left English in the other 44. "UI tokens" is the name of a documented contract in docs/UI-TOKENS.md, so a reader who sees it translated in the panel and then searches the docs for it does not find the link. ja, ko and zh go back to the English term, and all 47 now agree	🟢 fixed	e8768e44
Reset label	"Reset to defaults" cleared the overrides from the running document and left ui-tokens.json untouched, so the reset lasted until the next start. The label changed rather than the behaviour: that file is written by hand, and a button labelled reset that silently deletes fifteen tuned overrides is worse than the ambiguity it removes. It reads Clear overrides now, and the description says what that means	🟢 fixed	e8768e44

The automated review pass on the same change was verified finding by finding rather than accepted or dismissed in bulk, and it split four ways.

Finding	Outcome	Why
Croatian, Icelandic	🟢 applied	Each used two different words for one thing inside a single screen. The Icelandic panel offered to clear titles, because yfirskrift is a heading and yfirskrifun an override
Portuguese	🔴 rejected	The premise did not hold on measurement: it cited two words that do not appear in the string it names. pt.json does mix dialects, but from before this work and not in the way described
Welsh, Swahili	🟡 not applied	The correct term could not be verified, and inventing one is the error this pass exists to prevent. Queued for a native reader, together with Icelandic

One defect was caught by hand rather than by any check: the batch rendered Korean without the space after the full stop, following the convention of ja and zh. Those two close with the ideographic period and do not space, while Korean uses the ASCII period and spaces like English. Checked against the file before touching it: 282 sentence boundaries with the space, none without.

A green that does not prove what it looks like, recorded because it will be cited again. i18n:untranslated passes strict, but it is not approving "UI tokens" left in English: its prose test requires at least one function word before it examines a string, and "UI tokens" has none, so that key is never looked at. The green is correct and silent on this point. The decision rests on the project rule and the docs contract, not on a check.

Verified green: i18n:validate 46/46 with 0 missing, 0 extra and 0 placeholders; i18n:diacritics 0 new; i18n:untranslated strict clean; tsc --noEmit clean; vitest 94 files and 816 tests. No Rust involved. All 47 locales carry the previous description as a byte-exact prefix, so the six locale repairs that shipped with the panel are intact.

[axpnet]

The inventory gate was pointed at the wrong thing, and reported OK for it

Post-4.1.8 follow-up, fixed on main, shipping in v4.1.9 (PR #647).

inventory --check compared only snap["counts"] against the live counts. A snapshot that had drifted inside its own lists passed with OK (counts match), because counts is exactly the part that still matched. The invariants that would catch it already existed, as inventory_counts_are_internally_consistent, but they ran on the document built in memory and never on the artifact on disk. The right check was pointed at the wrong thing.

Area	Description	Status	Ref
The check	The invariants are now inventory_doc_inconsistencies, a non-panicking function returning one message per violation naming the invariant and both numbers, called on the deserialised snapshot before the counts comparison. The existing test calls that same function instead of restating the assertions, so the invariants live in one place rather than two	🟢 fixed	d42879b4
Reading	Every figure is read by explicit path, and a missing or wrongly typed field is a declared violation rather than a silent zero: a figure that disappears from the artifact is exactly the drift this gate exists to see, and reading it as zero would let it pass the way the counts comparison did. schema_version is checked first and comes from a single constant shared with the builder	🟢 fixed	d42879b4
Exit code	An inconsistent snapshot exits 12, distinct from 1 (drift), 10 (invalid JSON) and 11 (unreadable file). No consumer distinguishes the codes: the only caller is the cli-smoke workflow, which tests zero against non-zero	🟢 done	d42879b4

The proof, by differential rather than assertion

A snapshot with one command removed from tauri.commands and counts left untouched. The counts block of the tampered file is byte-identical to the good one, which is why the old comparison could not see it and why it cannot have failed for any other reason.

Binary	Output on the same tampered file	Exit
Built from the parent commit	inventory --check: OK (counts match ...)	0
Built from this commit	is internally inconsistent (2 violations), each naming the invariant and both numbers	12

Both exit codes read without a pipe. The committed docs/COMMAND-INVENTORY.json has zero violations under the new invariants, measured before the check was written rather than assumed, so this did not turn main red.

Two review findings, both verified and both applied

Finding	Outcome	Why
Unchecked addition on figures read off disk	🟢 applied, not as suggested	A value near u64::MAX panicked the function in a debug build and wrapped it in a release one, where a wrapped sum can equal the total and hide the violation it exists to report. Demonstrated by writing the test before the fix and watching the old code panic. The suggested checked_add would have returned None and silently suppressed the comparison, so an overflow is now its own named violation instead
A small Tauri surface treated as an inconsistency	🟢 applied	This one is the change auditing itself. assert!(tauri_total > 500) came from the in-memory test, where a magnitude tripwire on a fresh build belongs; moving it into the shared function promoted it, unnoticed, into an invariant of an artifact, so a legitimate surface of 450 commands would have been declared inconsistent by the very change written to stop wrong diagnoses. The shared invariant now names only the case no other check can see, a count and a list that are both zero, and the tripwire is back in the build test

Tests

Six. One reads docs/COMMAND-INVENTORY.json from disk, which moves verification of the published artifact from a CI step someone has to remember to look at into cargo test, the gate everyone runs anyway; if the file is missing it fails naming the absolute path it looked in rather than skipping in silence. The others cover a truncated list whose counts still match, a removed figure, an unexpected schema version, a figure at the integer limit, and an empty generated surface.

Verified green: cargo fmt --check 0; cargo clippy --all-features --tests -D warnings 0; cargo clippy --bin aeroftp-cli 0; cargo test 4115 passed, 0 failed, 65 ignored across 21 blocks; npm run check:provider-inventory 0. On main after the merge, all three workflows are green on d42879b4, and the Command inventory is not stale step of CLI Smoke Test passed on Ubuntu, Windows and macOS, so the new gate has run in service against the committed artifact and not only in tests.

[axpnet]

B2 was told the bucket's settings at every connect, and threw them away

Post-4.1.8 follow-up, fixed on main, shipping in v4.1.9 (PR #648).

B2 caps fileName plus fileInfo at 7000 bytes and lowers that to 2048 on a bucket with server-side encryption or Object Lock. HEADER_BUDGET_STD was hardcoded at 7000 and knew about neither trigger, and its _STD suffix showed the smaller budget had been known when the constant was written and never implemented. From 2026-09-14 Backblaze turns SSE-B2 on by default for new buckets and rolls it out to existing ones, so the smaller budget stops being the exception.

Both settings were already arriving. b2_list_buckets runs when a session opens and returns defaultServerSideEncryption and fileLockConfiguration; neither was deserialised. Reading them costs no extra API call.

Area	Description	Status	Ref
Budget	Sized from the two settings instead of a constant. The triggers are read independently and are not symmetric: encryption from value.mode, Object Lock from value.isFileLockEnabled and only from there, because B2 documents a state where the lock is on while its default retention is off, so deciding from defaultRetention would call exactly that bucket unlocked	🟢 fixed	765ef41c
Unread settings	Each setting is three explicit states and "not read" is a real one: B2 gates both behind isClientAuthorizedToRead, and a key restricted to one bucket, the ordinary shape, is told nothing. An unread setting keeps the larger budget on purpose, because B2 is the authority on what it accepts and refusing a path it would have taken breaks a working setup with no way to override; a rejection there carries a hint naming what could not be read, and never claims the bucket is encrypted or locked	🟢 fixed	765ef41c
Parsing	Both fields are parsed as raw JSON and interpreted in one place rather than typed, because Backblaze's documentation contradicts itself about their shapes. A parse error would not stop at the budget: it would fail the bucket listing, that is the connect. Trading a wrong budget for a broken connection is a far worse deal than the defect being fixed. A test drives seven hostile payload shapes through it and asserts the bucket still deserialises	🟢 fixed	765ef41c

Two limits declared rather than hidden

The documented measure for the 7000 byte budget is the fully encoded HTTP header line including the header names and CRLFs. This check measures the raw name and counts neither, so it is under-strict by construction rather than by oversight.

And because file names are separately capped at 1024 bytes, a legal name charges at most 1062 bytes raw, 3110 encoded, and 3166 once the header overhead the documentation counts is added. None of those reaches 7000. The defensible claim is therefore not that B2 counts the raw form or the encoded one, but that no legal B2 name can reach the standard limit even encoded: refusing against 7000 is safe under either reading of the documentation, the reduced case stays undetermined and is reported rather than blocked, and what shipped today is the diagnosis, not the refusal.

Revising the model against the three Backblaze pages that disagree with each other is queued as its own change, rather than rewritten into this one after review.

Four review findings, all verified, none applied in the form proposed

Finding	Outcome
The budget was charged 38 bytes of fileInfo before the file size was known, while uploads over 200 MB take a path that sends no fileInfo at all	Applied as a pure function returning the charge per branch, so both paths stay validated with what each actually sends. Moving the validation after the branch, as suggested, would have left the large path unvalidated: a check too strict traded for no check
Setting::Unknown had four causes and the message asserted one of them as fact	Applied, and the test found a fifth: the same conflation one level down in the wrapper reader, where "denied" and "authorised but unusable" were also a single value. Correcting only the reported site would have left the message lying from a lower point
The budget-reduced hint was attached to every ServerError, which map_b2_status also produces for 403, 503 and the catch-all	Applied by annotating only on status 400, from the status already in scope. Where no status is available the hint is omitted rather than guessed
Both hints measured different forms, so in the one case of an unreadable bucket with a name over the reduced budget only once encoded, neither said anything	Applied. It was labelled Trivial and was not: the others were about saying something wrong, this one about saying nothing, in the exact gap the change exists to fill

A fifth was declined with its reason recorded: measuring the encoded form against the reduced budget would make us stricter than B2 under the reading its own documentation supports on another page.

Verified green: cargo fmt --check 0; the three clippy lanes 0; cargo test 4135 passed, 0 failed across 21 blocks; 20 new tests, b2.rs from 38 to 58. One state was checked against a live account read-only: a key without readBucketRetentions returns "fileLockConfiguration": {"isClientAuthorizedToRead": false, "value": null}, settling one documentation contradiction in favour of the prose, with the same account's capability list confirming from a second independent place that the capability is absent.

[axpnet]

FTP: one parser, errors that quote the server, and an empty listing that no longer means two things

Post-4.1.8 follow-up, fixed on main, shipping in v4.1.9. Three changes that belong together: they close the defects found by a live sweep against a real vsftpd server, where "the directory is empty" and "the directory is not there" had been arriving as the same answer.

The campaign started from a measurement, not from reading code: a probe of a path that does not exist, compared against a genuinely empty directory created in the same session for the purpose, returned identical responses byte for byte.

Area	Description	Status	Ref
Listing parser	The provider and the legacy FtpManager each carried their own parser and had drifted apart. Both now consume one shared module. The legacy copy could not fail: any unparsable line became an entry, and any entry without a dot in its name became a directory, so total 12 was listed as a folder	🟢 fixed	81fd3d9f
Missing vs empty	A path that does not exist returned a successful empty listing. A mirror reads that as "the source is gone", which is how a misspelled remote path becomes a deleted local tree	🟢 fixed	f71fc5dd
Error classification	mkdir on an existing directory collapsed into a generic failure; transient 421 and 450 were reported as InvalidPath, so a session problem read to the caller as a wrong path and invited the wrong fix	🟢 fixed	f71fc5dd
Error text	Messages named neither the operation nor the path: Server error: 550 Failed to change directory. did not say which directory, or why we were there	🟢 fixed	f71fc5dd
Unreadable listing	With the parsers shared, a LIST whose every row failed to parse still returned Ok with zero entries, which downstream is indistinguishable from a wiped remote. It now fails, so the scan counts a listing error and the delete guard refuses naming the real reason	🟢 fixed	d521dc55

Verified live against a vsftpd 3.0.5 server over explicit FTPS, on both the CLI and the MCP surface, with a genuinely empty directory measured beside each missing path so the pair is readable rather than a single result that could be read either way:

Check	Result
List a path that does not exist, CLI and MCP	error naming the path and the operation
List a directory that is genuinely empty, CLI and MCP	clean empty listing, no error
mkdir on a directory that already exists	Path already exists, with the path
stat on a real file	size reported correctly, not zero

Known and declared: this laboratory cannot exercise the MLSD path, since no server used in the campaign advertises MLSD or MLST, so the listing path measured here is LIST. A fully unreadable listing is covered by a unit test rather than live, because vsftpd produces rows this parser reads.

[axpnet]

Two FTP and provider corrections landed on main

Post-4.1.8 follow-up, fixed on main, shipping in v4.1.9 (#397, reported by @EhudKirsh, and internal review).

Both came out of a campaign that re-tested what v4.1.8 claimed to fix. Neither was found by reading a changelog: the first by a reporter retesting on his own account, the second by an adversarial review of a change that had declared itself complete.

Area	Description	Status	Ref
Jottacloud trash	Rename, restore and permanent delete each failed for a different reason: the rename went to the live mountpoint, the restore read a tombstone as an ordinary file, and the listing accumulated <abspath> text without decoding it, so a folder named with an entity lost the spaces around it and the restore targeted a parent that does not exist	🟢 fixed	4099cc2f
Profile identity	An imported refresh token is bound to the record it belongs to, and profile_id is stamped from the saved record with options-borne values dropped at one choke point, so the CLI, MCP, agent and AI tool paths enforce the same policy instead of one file reversing another	🟢 fixed	4099cc2f
Error causes	Filen quota errors keep their REST cause instead of collapsing into "No user info data", so an expired token no longer presents itself as a missing quota	🟢 fixed	4099cc2f
Recursive descent	Every descent in providers/ now uses the same walkable-directory test. It changes behaviour on one provider and is cosmetic on the rest, and the cosmetic sites are converted anyway so the contract can be checked by a grep rather than by a reader	🟢 fixed	f6089243

What is not covered is stated in each pull request rather than left to be discovered: the Jottacloud change closes part of #397 and not all of it, two of its tests pin their helper and not the call site, and the rclone-obscure collision is declared rather than narrowed, since any 22-character password drawn from [A-Za-z0-9_-] reveals as empty and password-manager alphabets fall inside it.

Verified green: fmt, clippy with warnings denied, 3637 tests passed with 0 failed on the first and 874 on the second, and every check green on both merged heads with the two publishing lanes skipped as they always are on a pull request. Both were reviewed on the head that merged, not on an earlier one.

[axpnet]

FTP data channel: what #655 closed, and what it did not

#655 is on main (999ba7fb). It bounds and watches the five RETR loops the FTP provider drives itself: a reply arriving on the control channel while a read waits on the data channel now ends that wait instead of outliving the process, an inactivity deadline covers a server that says nothing at all, and every early exit puts the session back in a state the next command can trust.

It does not close the reported hang, and the live battery on main still reproduces it. Measured three times against the lab over FTPS with --retries 0:

550 Could not get file size   ->  TYPE  ->  PASV  ->  227  ->  RETR  ->  nothing further
control socket: Recv-Q = 55      data socket: Recv-Q = 0, 388 bytes sent, 0 received

What this costs is not one stalled download. A list on the same profile, issued afterwards and unrelated to the transfer, returned nothing within 90 seconds: the stalled download holds the pooled connection and everything else queues behind it. So the visible effect is that the profile stops answering at all, and the attempt to fetch a file that is not there is only the trigger. That is the difference between an annoyance and a report filed as "the server is down", which is where nobody will look for a client-side cause. The same behaviour appears through the MCP server as through the CLI, with no response inside 180 seconds, so it belongs to the provider and not to one surface.

Those three cases were each stopped at a cap. The measurement is therefore "no response within that time", not "never", and the caps are given so anyone repeating it knows what was actually observed.

The wait is one step earlier than the guard. Opening a data channel in passive mode sends PASV, reads 227, sends RETR, connects the data socket and performs the TLS handshake on it, and only then reads the reply. The 388 bytes sent with nothing received are a TLS ClientHello nobody answers, so the process is stuck inside that handshake and never reaches the read loop the guard protects. The fix holds exactly where it was put, on a path one step away from the one the title suggests.

The 55 unread bytes on the control channel are consistent with the server having already refused. A TLS 1.2 AES-GCM record costs 5 bytes of header, 8 of nonce, the payload, and 16 of tag, and a 26-byte payload gives 55: 550 Failed to open file. plus CRLF is 26. Consistent, not proof, since any 26-byte reply gives the same number. What it explains, and no other reading does as simply, is why the control channel has bytes, the data channel has none, and nothing ever answers the handshake: a server that has refused the transfer has no reason to service the data port.

If that reading is right, bounding the opening step does more than fail fast. The server's own reason is already sitting there to be read, so the user can be told 550 Failed to open file. instead of a timeout generated on the client side.

The remedy belongs to the shared data-loop primitive and is recorded there: a deadline on the opening step as well as on the loop, and on expiry a look at the control channel before deciding, reusing the non-consuming peek and the bounded reply read that #655 added. Interrupting mid-open is safe today only because suppaftp sets its private connection flag after the await that blocks, which is an assumption about someone else's code that would fail silently on a version bump, so it will be pinned by its consequence rather than by a comment: after an expired opening, the next data command must not be refused with Data connection is already open.

The binary under test was checked for the fix before any of this was concluded, so the measurement is not of an older build.

[axpnet]

Five fixes from one seam: a guard that answers a question next to the one asked

Post-4.1.8 follow-up, all five on main, shipping in 4.1.9 (47c2e707, 588ffa7e, fbbe288d, 18d4a9a1, 80f470a8).

These landed together because they are one shape rather than five bugs. A guard reads an error message, or a count, or a status, and answers a question ADJACENT to the one it was asked: is anything on the socket, rather than is anything queued; does this error mention time, rather than is the clock wrong; how many files import this crate, rather than how many users are affected. The answer looks like the right kind of thing, so nothing downstream notices.

Area	What was wrong	Status	Ref
Transfers	A segmented download planned a peak equal to the file below a gigabyte, because the per-request cap could not bind where the sub-read IS the window	🟢 fixed	47c2e707
Providers	Four recovery guards decided on a substring while the exact test sat beside them unused; one turned a failed command into a success	🟢 fixed	588ffa7e
FTP	A download of a missing file waited with no limit, inside the data channel's TLS handshake rather than the read loop that was already guarded	🟢 fixed	fbbe288d
Sync	A connection the server closed was filed as a permanent disk failure and never retried, on every service over WebDAV and S3	🟢 fixed	18d4a9a1
Errors	Three questions answered in eleven places with vocabularies that had drifted apart	🟢 fixed	80f470a8

The one to read if you only read one is 18d4a9a1. A broken pipe is how a server ordinarily drops a transfer, through an idle timeout or a NAT eviction. It was classified under "Disk full or I/O error", which is non-retryable, and the four executor sites break on exactly that, so it was the single failure the client refused to retry even once, and the message sent the user to look at their disk. The same branch matched i/o error, which is not a symptom but the label a parser prints in front of the real error, so "I/O error: Connection reset by peer" was a permanent disk fault on every XML-based provider.

What the tests do differently, because it is the part that stays. Each fix carries a test that was RED first and states the defect in its own numbers rather than asserting the new behaviour: "the peak follows the input: 200 MB of file plans 200 MB", "1 of 18 closed-session messages are classified as permanent", "2 of 5 socket error kinds print something no needle matches". Two of them derive their corpus from the source that produces the strings, a shared const and std::io::ErrorKind itself, rather than from a list someone typed: the wrong strings in those lists were invisible to a reader and would have been copied into any hand-written test, which is how the tree came to hold four disagreeing opinions about a dead connection in the first place.

A live re-measurement of the FTP cases against this tree follows in a separate comment, with the results table.

Verified green: cargo fmt, clippy --all-features --tests at zero, the Rust library suite at 3651, the CLI suite, the frontend suite, typecheck, i18n 46/46 with zero placeholders, and four platform builds per pull request.

[axpnet]

Live re-measurement on 80f470a8: the three red rows are green

Follow-up to the campaign comment above. Re-run against a real FTP server after the five fixes landed, replacing the 576b8abc table, which has been deleted rather than left alongside so nobody reads the older numbers as current.

#	Scenario	Surface	Result	Identified by	Time	Ended by	Tree
T1	List a path that does not exist	CLI	Fixed	Invalid path: [550] naming the path	2.4s	client	80f470a8
T2	List a directory that is genuinely empty	CLI	Fixed	0 items, which the defect could not produce beside T1	2.4s	client	80f470a8
T3	List a path that does not exist	MCP	Fixed	Invalid path: [550] naming the path	1.4s	client	80f470a8
T4	List a directory that is genuinely empty	MCP	Fixed	count: 0, entries: [], beside T3	0.5s	client	80f470a8
T5	Download a file that does not exist	CLI	Fixed	Invalid path: [550] 550 Failed to open file. naming the file	33.1s	client	80f470a8
T6	Download a file that does not exist	MCP	Fixed	same refusal, same wording	30.2s	client	80f470a8
T6b	A listing issued straight after T6, same profile	MCP	Fixed	count: 2 with the real entries	0.4s	client	80f470a8
T7	mkdir on a directory that already exists	CLI	Fixed	Path already exists	2.2s	client	80f470a8
T8	stat on a real file, size hydrated	CLI	Fixed	40961, a size nothing else here shares	2.2s	client	80f470a8

The wait is BOUNDED, not short, and the table says so in the rows themselves. The 33 seconds on T5 are the opening budget being spent, not latency: a user asking for a file that is not there still waits half a minute before being told. "Fixed" on that row must not be read as "immediate". What changed is that the answer arrives at all, and that it names the file and carries the server's own 550.

T6b is the row that changes the severity. Before, a listing issued straight after the stuck download never returned either, because the download held the pooled connection: the whole profile stopped answering, not just the transfer. It now returns in 0.4 seconds with the real entries. The defect was never only "a download that does not finish".

No row ended on a ceiling. The battery's caps were raised above the code's own (120s against the 30s opening budget, 600s against the 300s listing budget) precisely so that a number produced by the harness could not be mistaken for a measurement of the client. The "Ended by" column reads client on all nine.

One risk was measured rather than reasoned about. 18d4a9a1 made a server-closed connection retryable, which could have inflated these times. T5 was run twice, with retries disabled and with the default policy: 33.1 seconds both times and no retries at all. The reason is specific and is recorded in the table rather than left to be inferred: this path ends on a REFUSAL, which is permanent and correctly not retried, while 18d4a9a1 changed the classification of connections the server closes.

Provenance, because a live result is worth nothing if the binary under test is not the tree claimed. The discriminator is a symbol #663 introduced, checked against the previous tree before being trusted: open_with_cap appears 46 times in the binary under test and 0 in the one built from the previous main. The counter-proof is read_watching_control at 69 in both, so a zero on the discriminator would be distinguishable from a method that is not reading symbols at all. An independent count on the source gave 0 against 7 across the same pair: two different instruments, same direction.

Verified green: the five pull requests each passed four platform builds, clippy --all-features --tests at zero, and the Rust library suite at 3651.

[axpnet]

Three more of the v4.1.8 retests, from the same pass

Post-4.1.8 follow-up, fixed on main, shipping in v4.1.9 (4099cc2f, #652). The comment above covers the Jottacloud trash half of that change; these three landed with it and were not named there.

Area	Description	Status	Ref
AeroSync templates	Exporting a template dropped verification policy, compression mode and canary, so importing one reset them to defaults while the direction survived, which made the feature look like it worked. The template schema now carries all three, on both sides	🟢 fixed	#514
Servers table	Dragging a profile in the table view cleared no selection and had no stable identity on the cells, so a reorder often took several attempts. The selection is dropped on drag start, cells carry a stable id, and the drop sentinels are always mounted	🟢 fixed	#453
Rclone crypt	An obscured password was used as typed instead of revealed first, and an omitted password2 was not treated as rclone's default salt, so names encrypted by AeroFTP did not decrypt in rclone. Checked live against rclone 1.74.3 in both directions	🟢 fixed	#600

Two limits, declared rather than left to be met.

The table reorder was verified as far as an automated driver can reach: the table is the live view, 113 stable ids are present, the grips are there and a synthetic dragstart fires. A real WebKitGTK drag with a mouse was not exercised, because the inspector cannot perform an HTML5 drag. That half needs a hand on a mouse and has not had one.

Rclone's obscuring is AES-256-CTR with no MAC, so nothing in the value distinguishes an obscured empty string from a 22-character URL-safe Base64 password that happens to look like an IV alone. Password-manager alphabets fall inside that set. Refusing empty reveals reopens this issue; treating every IV-shaped decode as empty turns those passwords into an empty key silently. The collision is accepted and named rather than narrowed, and the remedy is a control beside the field saying the value is rclone-obscured, which is a product decision and not in this change.

[axpnet]

Two corrections to things that had already been written down

Post-4.1.8 follow-up, both on main, shipping in 4.1.9 (9c38bf38, 9ed325fb).

Neither of these is a new defect found in the code. Both are records that were wrong: a review nobody opened, and a rationale nobody rechecked. They are grouped because the failure is the same one, trusting a written thing without reading it.

Area	Description	Status	Ref
Missing-path vocabulary	The needle had been widened by one word, and that word was the entire safety margin: a server reply quotes the user's path back, so a refusal on a path containing the needle read as an absence. The site that makes it serious treats absence as permission to overwrite and then delete	🟢 fixed	9c38bf38
Cancellation	could not be cancelled and its contracted forms read as cancellations, suppressing retries and reporting an ordinary failure as something the user asked for	🟢 fixed	9c38bf38
Retry symmetry	The retry loop consulted only the local cancel flag while the failure built at the end consulted the message too, so a cancellation the provider reported was retried to the policy limit and only then labelled cancelled	🟢 fixed	9c38bf38
Yandex auth	A missing OAuth scope was reported as "token revoked or expired: regenerate the OAuth token", sending the owner of a valid token to repair the one thing that was not broken	🟢 fixed	9c38bf38
tauri pin	The pin stays; its documented reason was wrong, and the wrong reason is what sent an outside reader looking for the remedy where it cannot be	🟢 corrected	9ed325fb

The first four were found in a review that had already been posted on the merged head and was never opened. Three of the four were introduced by the change it reviewed. The one that matters guarded the speed tool's overwrite check, whose own comment says it fails closed on a caller-named path because it treats "not there" as permission to write and then delete: a permission refusal read as an absence would have destroyed a real file.

The fifth is a rationale that was checked and did not hold. 2.11.1 introduced no check classifying http://127.0.0.1:* as remote. The Linux branch of is_local_url is identical between the two versions, character for character, and neither names an address; what changed is a single line that starts APPLYING a verdict that was already false before. The remedy that follows from the wrong reason is also self-defeating: declaring frontendDist as a URL empties the embedded assets that tauri-plugin-localhost exists to serve, so the application would start and answer 404.

It is all or nothing because the invoke_handler registers 1013 commands, and adding one permission file makes the ACL govern every one of them. The pin's conclusion was right the whole time while its stated cause was wrong, which is an unusual pair and the reason nobody had caught it.

The file external reviewers read also carried a false absolute, unrelated to the pin. It is corrected and scoped to the platform on which it holds, and stating the scope makes the ignore stronger: outside Linux the application never loads an external URL in production at all, so the entry point the advisory describes is absent there.

Verified green: clippy --all-features --tests at zero, the library suite, and four platform builds on each pull request. Both reviews were read before merging, which is the correction to what happened on the change that produced the first four.

[axpnet]

Five more from the FTP quality campaign, and two of them are a gap in this tracker

Post-4.1.8 follow-up, all five on main, shipping in v4.1.9.

Rows 38 to 42 above. Two of them are backfill rather than news: #655 and #660 landed on 30 August and were never logged here, which is worth saying plainly, because this table is supposed to be the running record of every push and for two days it was not. They are entered now in main's order rather than at the end of the campaign, so the sequence still reads correctly.

#	Area	What it changes	Status	Commit
38	FTP	A download of a missing file could wait for ever with the server's refusal already sitting unread in the client's own socket. The read now watches both channels, and peeks the first digit rather than consuming it, so a completion reply is not mistaken for a refusal and a working transfer is not truncated	🟢 fixed	999ba7fb
39	FTP	Four call sites carrying the same forty lines became one primitive, and the two places where behaviour genuinely changed were named instead of being described as a no-op	🟢 fixed	576b8abc
40	FTP, security	A path holding CR or LF let the caller append a second FTP command, and the refusal was then classified as a network error and retried to the limit	🟢 fixed	456d7b83
41	Test fixture	The fixture counts every command verb it receives, so a test can assert what was never asked. The client is the one end that cannot answer that question	🟢 fixed	2bd1d2f0
42	CLI	An exit code is an API and it was being chosen by searching an English error message for words. The class now travels with the error	🟢 fixed	2fb4bbb4

Three things found by the work rather than by the plan

A remedy that would have been worse than the defect. The obvious fix for row 38 is to end the wait as soon as the server speaks. The completion reply arrives on that same channel, so that version aborts transfers that are working and truncates files. Reading the first digit without consuming it is what separates the two.

A green that proved nothing, twice, in different shapes. The loopback fixture cannot reproduce row 38 at all: there the data socket closes first and the wait ends by itself, same server software, opposite outcome. And in row 42 cargo build --lib exited 0 with zero errors on thirteen changed signatures that had not been adapted, because the file lives in the binary and --lib compiled none of it. Neither green was wrong. Both answered a question next to the one being asked.

An invariant a diff cannot show. In row 42 the strongest guarantee is that no hand-written constructor exists for the not-found variant, so it can only come from an ErrorKind and never from a call site's opinion. That guarantee is removed by ADDING a constructor: no existing line changes, so no diff displays a loss. It is written down at the point where the addition would be made, which is the only place a reader would see it.

Verification

Each of the five merged with its own CI green: Build AeroFTP, Checks, CLI Smoke Test, Security audit, CodeQL and the Snyk and Socket checks. #671 additionally carries a live reproduction on the fixture, before and after, with the injected DELE counted at 1 and then at 0 and a USER count of 1 in both readings as the control. main's own run on 2fb4bbb4 was still queued when this was written and is not being claimed here as green.

[axpnet]

v4.1.9 is released, and this tracker is closed

The Release That Stopped Believing Its Own Gates, published 2026-09-01 with 9 binaries and 9 Sigstore bundles, one per artifact. 65 rows in the queued table, from 55 commits in the cycle plus the release itself.

Area	What closed here	Status
The theme	Three CI lanes could report success having executed no tests, and one had been doing so since 2026-05-16, when the test it names was renamed and the workflow line was not. All 14 points that select tests now assert how many actually ran	🟢 fixed
Pre-release audit	Three independent auditors, one lane each, over the 55 commits. Every confirmed finding fixed BEFORE the tag, none deferred. Two defects were introduced by this cycle, the rest predated it	🟢 fixed
Protocols	FTP stops waiting 1800 seconds for a refusal already in the client's buffer, WebDAV stops panicking on a 425 plus a rotated Digest nonce, Swift stops resolving dot segments inside opaque object keys, and six error classifications stop being blind to the shape providers produce	🟢 fixed
Reporter-facing	Jottacloud trash, sync template settings, rclone crypt passwords, kDrive scope, all answered on their issues with the commit and the tracker row	🟢 fixed

Two things this cycle got wrong and corrected in the open, because they are the useful part. Four commits shipped with no tracker row at all, two of them features, so the changelog built from the tracker alone would have released the AeroSync ACL support and the language chip without mentioning either; the rows were backfilled and the check now reports 55 commits and zero uncovered. And the declared scope of the rclone reveal collision was WIDER than the truth, caught by the regression test written to confirm it: it is one in sixteen of such passwords, not all of them.

Verified before the tag, on the exact commit and not on the branch: zero orphaned check runs, zero incomplete, zero failed across Linux, Windows and macOS on both architectures, and Format, audit & unit tests green on the head of all 16 pull requests merged into this release.

Continues in the 4.1.10 tracker, with the still-open "Requested / under consideration" rows carried over.