[Tracker] AeroFTP 4.2.0 - Known issues, patches & updates

[axpnet]

AeroFTP 4.2.0, Rolling Tracker

Umbrella issue for the next AeroFTP release (v4.2.0): known issues reported against v4.1.9 and the patches/updates landing on main after the v4.1.9 tag.

Status note: the current release line is v4.1.9 (release notes, its tracker is #1417, now closed); this tracker collects what lands on main for v4.2.0.

Before opening a new issue, please check the lists below. If your problem is already tracked here, just add a thumbs-up reaction or a comment with your environment (OS, version, provider) instead of filing a duplicate. We update this issue as bugs are found and fixed.

Found something that is not listed? Open a new issue and we will link it here.

What shipped in 4.1.9

See the v4.1.9 tracker (#628) and the release notes for the full change set, 65 tracked changes over 55 commits. The theme was not a feature: three CI lanes in this repository could report success having executed no tests at all, and one had been doing exactly that since 2026-05-16, when the test it selects by name was renamed and the workflow line was not. A pull request claimed two review findings were closed by two tests, and one of those tests had never run in any run. Six error classifications had never fired on the shape the providers actually produce while firing on byte counters instead, in the function that decides whether a failed transfer is retried or discarded. All 14 points that select tests now assert how many actually ran. Alongside that: FTP stops waiting 1800 seconds for a refusal already sitting in the client's buffer, WebDAV stops panicking on a 425 plus a rotated Digest nonce, a Swift recursive delete stops resolving dot segments inside opaque object keys, AeroSync preserves POSIX.1e access ACLs on Linux, and contribution origin is certified with a DCO. A pre-release audit with three independent auditors ran over the cycle and every confirmed finding was fixed before the tag, none deferred.

Patches & updates queued for 4.2.0

Landed on main after the v4.1.9 tag; shipping in v4.2.0.

#	Type	Change	Status	Commit	Ref
1		A password that reveals as empty was never an empty password, and the ambiguity is only resolvable per field. Details.	🟢 done	6bcb11fa	#700
2		SFTP could resume an interrupted upload from the GUI and not from the CLI, because the capability was implemented behind one name and asked for under another. Details.	🟢 done	35ce3737	#702
3		Restoring a folder from the Jottacloud trash is composed from the primitives that work, because no JFS verb restores a directory. Details.	🟢 done	9ed68282	#703
4		A Jottacloud profile could report "Login token expired or already used" on a station that could still connect, and a profile export could carry a dead refresh chain. Details.	🟢 done	b3c3da2e	#712
5		postcss-selector-parser 6.1.2 to 6.1.4 for Dependabot alert 69. Details.	🟢 done	95cc7b06	#710
6		An exported AeroSync template said "size and mtime" whatever the Plan tab chose. Details.	🟢 done	93df7925	#707
7		--immutable was ignored by cp and mv, so a copy onto an existing target overwrote it and exited 0. Details.	🟢 done	aef82285	#705
8		A kDrive API token minted with the drive scope alone connects and lists, and only Fetch is refused with a 403 naming user_info; v4.1.9 made that message readable, and nothing told the user before the token was created. Details.	🟢 done	14a00d6d	#709
9		The SourceForge prune trusted the exit code of a delete, and the listing was the only thing telling the truth. Details.	🟢 done	3ddcace2	#706
10		docs/TESTING.md still promised the single pre-release smoke entrypoint as future work, while npm run smoke has been the pre-tag step of docs/RELEASE.md since v4.1.4. Details.	🟢 done	8e543b2c	#713
11		OneDrive Personal: the recycle bin is not exposed by Microsoft Graph, and the app said "400 Bad Request" with raw JSON instead. Details.	🟢 done	c5bf3db0	#708
12		A trashed Jottacloud folder can be purged, and the trash can be emptied: item 9 as first written was wrong. Details.	🟢 done	f8333a24	#711
13		The --tui menu of profiles, groups and users offers every verb the -i prompt has, and both open on an empty vault. Details.	🟢 done	961d41c8	#714
14		A routing rule could name a fallback model that never answered, and Ollama could not be named at all. Details.	🟢 done	7bf46ef2	#704
15		The native rsync engine now owns its delta core, and its real-rsync oracle tests actually run in every checkout: first tranche of the standalone crate track. Details.	🟢	4bbbab84	#715
16		The native rsync engine now owns its progress callback and the user-facing event texts, and the unused event bridge is gone: second tranche of the standalone crate track. Details.	🟢	653dcb98	#716
17		The native rsync engine now reports its own errors and results, and the application-facing translation lives in a new adapter: third tranche of the standalone crate track. Details.	🟢	50bcd412	#717
18		The CI could go red on a Microsoft apt repository this project does not install from. Details.	🟢 done	39ddc99c7	#718
19		The native rsync engine now imports nothing from the application, which closes the first phase of the standalone crate track. Details.	🟢 done	76291429f	#719
20		The claim that the rsync engine does not depend on the application is now proved by the compiler, on three operating systems, both build profiles, both macOS architectures and under the rustflags the product ships with. Details.	🟢 done	5888a418f	#720
21		The rsync engine's public surface now has a measured number at both ends, and the number that was being used was the wrong kind of measurement. Details.	🟢 done	72d7c51a8	#721
22		The Backblaze B2 suite proved the bytes survive a round trip and never that the server still publishes a digest for the object, which is a different claim and the one sync, dedupe and verify rely on instead of downloading. Details.	🟢 done	3b7265dd3	#722
23		A Cloudflare R2 bucket created in a jurisdiction answers only on its own host, and the preset had no way to say so: the EU one was missing too, not just the us announced on 2026-08-17. Details.	🟢 done	3b7265dd3	#722
24		The S3 delta upload starts with the one piece where a mistake costs a whole upload rather than a failed request. Details.	🟢 done	e502f5b3e	#723
25		A superseded PR SHA kept burning a 4-leg Tauri matrix because build.yml had no cancel-in-progress, unlike checks.yml. Details.	🟢 done	e24cace5f	#727
26		AeroAgent records verified model capabilities and can send compatible OpenAI models through the native Responses transport, with unknown models kept conservative. Details.	🟢 done	f1d9496cf	#724
27		The gate that proves the rsync engine builds on its own did not run when only the lockfile changed, which is exactly what a dependency bump produces. Details.	🟢 done	20f841dd5	#725
28		GitHub Actions cache quota (10 GB) was filled by PR rust-cache writes, which evicted the main Linux/Windows caches and made the Linux packaging leg rebuild from cold. Details.	🟢 done	591f2453d	#728
29		Root AGENTS.md is the public CLI integration guide (how to drive AeroFTP without credentials), not the development-gate file. Details.	🟢 done	236e78d2f	#731
30		The crate the rsync engine is being extracted into declared no licence at all, and nothing complained, because a crate without a licence header compiles exactly like one with it. Details.	🟢 done	501e3ed9e	#726
31		Linux clippy and cargo test no longer sit on the packaging critical path, and a v* tag cannot publish while they are red. Details.	🟢 done	64f4f15b2	#730
32		An S3 endpoint that is plain HTTP and not on this machine now needs the profile's explicit consent, and a connection to one is refused until it is given. Details.	🟢 done	3de4f6456	#729
33		The consent gate for a cleartext endpoint was on connect(), and three signing paths do not go through connect(). Details.	🟢 done	f20fb8f31	#733
34		A test merged an hour earlier was flaky, and flaky on main. Details.	🟢 done	3417fcb46	#734
35		The S3 delta grid is sized for the planner's worst case, not for its average one. Details.	🟢 done	7b3817c87	#732
36		The speed limit holds on every provider, one-way sync converges on S3, and multi-file SFTP reuses its connection: the nine gaps a live DAG engine review found against rclone, each measured before and after. Also multi-thread download by default, --partial over a finished file, rclone export host keys and start folders, --skip-restricted. Details.	🟢	bffa68256	#735
37		cargo audit on main went red on two crates yanked upstream after the last lock update (der 0.8.0, libssh2-sys 0.3.2), unrelated to any push; the lock now resolves 0.8.2 and 0.3.3. Details.	🟢	38d5c0b96	#739
38		S3 uploads carry the source mtime as x-amz-meta-mtime in rclone's format, stat reads it back, and a server-side copy keeps it: objects written by either tool now read the same mtime from the other. Listings still show the upload time (no metadata there), so the one-way sync rule from #735 keeps applying to the scan. Details.	🟢	6222c5b02	#740
39		Six retest findings from the reporter, and seven more found reviewing the branch, of which six were one shape: an answer that said "not yet" or "not now" read as a final one. Details.	🟢 done	12c7c314c	#738
40		SFTP single-stream downloads read ahead by default (window 32): 300 MiB over 53 ms went from 118 to 129 s serial to 32 to 35 s, rclone 30 s; AEROFTP_SFTP_READAHEAD=off restores the serial read, a bandwidth cap still uses the serial loop. Details.	🟢	a90f613d6	#742
41		--limit-rate and --bwlimit now also pace the HTTP cloud providers that stream through their own loops (10 download loops, 12 upload bodies: Cloudinary, Filen, GitHub, ImageKit, Immich, Koofr, MEGA, Uploadcare, Dropbox, FileLu, 4shared, kDrive, OneDrive, pCloud, Yandex, Zoho), progress reported after pacing, Yandex chunked path included. Details.	🟢	15dda3477	#741
42		SFTP directory scans fan out over up to four connections and scan workers stay warm across directories (GUI sync scan today; the CLI sync scan is the next half); a clone worker also keeps the primary's working directory across its lazy dial. Details.	🟢	cc70af785	#743
43		The S3 delta upload can now assemble an object: the executor, with the guard that makes it safe. Details.	🟢 done	bf15c887c	#755
44		A delta upload would have silently dropped the mtime, and no green check could have shown it. Details.	🟢 done	12747c586	#756
45		Multi-file downloads no longer pay one server round trip per file on S3, B2, WebDAV and Koofr: with the multi-stream default of 4 those providers probed every file's size before deciding whether to split it (5000 x 4 KiB S3 get 68 s to 127 s, rclone flat at 60 s); the callers now pass the size they already hold and the probe only runs when it is unknown. Details.	🟢	7336fa6b5	#757
46		The CLI remote scan of sync, check and cryptcheck runs on the provider's list pool, up to --checkers directories at once (a 5000-file SFTP no-op sync spent 10.8 s in a serial scan against rclone's 4.2 s), and the shared walker no longer follows a symlink to a directory. Details.	🟢	53ed27ce8	#758
47		Every Dependabot pull request was red on a sign-off check no GitHub App could pass: the app authors with the address GitHub issues it and signs with its own contact address, and neither is settable per repository. Details.	🟢 done	cd0f09fd3	#759
48		Ten dependency bumps merged as one branch rather than ten, since nine of them touch nothing but a lockfile and merging in sequence meant nine rebases and several hundred check runs; quick-xml 0.42 stayed out as an API break, not a bump. Details.	🟢 done	7a313625c	#760
49		Multi-file SFTP transfers honour --parallel up to 16 connections (the pool ceiling was a literal 4: from p4 to p16 rclone gained 47% and 75% on the lab, AeroFTP 4% and 3%), and put -r / get -r say when a provider ceiling is lower than the requested --parallel. Details.	🟢	4b25a288b	#761
50		The CLI Smoke lane no longer runs the whole test suite a second time (instrumented, 41 min, queued behind smoke jobs it never used) nor a third CLI release build on every pull request: coverage and cargo-install-smoke run on main and on demand, superseded runs are cancelled; per PR the lane goes from 77 to 110 minutes to 25 to 35, every test still run once. Details.	🟢	6f52561bf	#763
51		A recursive delete on S3 removed both folder/ and the same-named file folder, which are two distinct objects, so deleting a folder erased an unrelated file that shared its name (reproduced live on Cloudflare R2); the slashless key now goes only when a HEAD confirms a zero-byte directory marker, a denied HEAD no longer blocks deletion inside the prefix, a refused individual DELETE no longer reports success, and exported rclone profiles finally recognize AeroFTP's empty folders. Details.	🟢	3675acc5e	#764
52		The sync command's remote scan really runs on the list pool now (the #758 entry named it, but sync walked with its own loop and the library sync core used the serial branch), and every caller of the shared walker inherits the pool, --checkers and the traversal guard; on 5000 SFTP files the scan goes from 1 session / 14.2 s to 5 sessions / 6.1 s. Details.	🟢	cd894ae4a	#762
53		The crate's own tests derive keys with the cheapest Argon2id profile the formats accept (8 MiB, t=1) while production and the audited profile stay pinned by a full-cost known answer: the hundred KDF-bound tests that were 92% of the suite's execution go from 1867 s to 287 s on the touched families. Details.	🟢	0f11fb0ba	#765
54		A change that touches only documentation no longer runs the four-platform Tauri build (about 80 minutes for bundles that cannot differ): build.yml ignores docs, Markdown, licence and issue-template paths on push and pull request, applied only when every changed file matches. Details.	🟢	5dca9847e	#767
55		GUI downloads use multiple streams by default, per protocol, on the measured numbers (SFTP, WebDAV, FTP and FTPS 8, S3 4, unmeasured providers 1): Auto now resolves to the provider's default and both GUI download paths arm every provider's multi-stream download, which until now reached SFTP only; on the lab a 300 MiB SFTP download went from 144.75 s to 25.46 s. Details.	🟢	7f978d7af	#768
56		Four wishlist items on Quick Connect and AeroSync, plus a dialog that outlived its session: the rclone crypt salt field is called password2 in Quick Connect too, the AeroCrypt block leads with default salt and folds the keyfile into a disclosure, the AeroSync template name and description have visible headings, and a canary dry run no longer throws away the Compare scan. The half of one wish that asked to hide the header toggle under default salt is deliberately not implemented, because no code path reopens a default-salt vault from the password alone. Details.	🟢 fixed	f5a8f4a25	#347 (@EhudKirsh)
57		S3 delta upload steps T4 and T5: the client keeps a local memory of the bytes it uploaded and matches a delta against it with no remote read, and closing the lane closed a defect older than it, since cancelling a large S3 upload from the GUI abandoned the multipart session and left its parts on the backend (the classic path had done this since #332). Details.	🟢	a63961331	#766
58		FTP over TLS no longer sleeps up to two seconds at the end of every upload: the timed drain before close_notify (a fixed 2 s from 8 MiB up, read by the review as a constant 3 s overshoot of the rate cap) is replaced by waiting for the server's own close of the data connection; a 20 MiB upload went from 4.81 s to 2.61 s uncapped and lands on target under a cap. Details.	🟢	a0d19d381	#769
59		CI no longer reddens on a preinstalled apt repo it does not use: the cleanup line strips google-chrome* alongside the Microsoft ones at all 22 sites, and the comment above each one now spells the three globs the command spells instead of naming Microsoft alone. The remedy was already written down as trap 16 of the recurring-CI-red checklist but had never landed. Details.	🟢 fixed	a63961331, 43a37db1c	#771
60		The dependency-audit tool is cached instead of recompiled on every run of the workflow that runs more often than any other here: cargo install cargo-audit cost 169 seconds on all 42 runs on main last week, for an audit that takes five. Restore and save are split, because the combined cache action saves only from a successful job and on main a real advisory would otherwise discard the binary just built. Measured: job compute falls from about four minutes to 1.1. Details.	🟢 fixed	dccb7bd7f	#772
61		Every Cargo and npm dependency takes the newest release its own requirement admits (207 crates in the lock, the tauri pin and its JS lockstep kept), and rust-version states the real floor, 1.93, instead of a 1.85.0 no toolchain could build. Details.	🟢 done	7076d53f9	#773
62		About > Dependencies lists every direct dependency at the version AeroFTP builds with (17 were missing, 13 showed another version) and classifies updates with Cargo's semver rules against the crates.io sparse index, pins included. Details.	🟢 done	7dce288ec	#774
63		API keys sent in non-standard headers (Immich, GitLab, InfiniCLOUD, the AI clients) no longer follow a redirect to another origin or to plain http; same-origin redirects still work, with reqwest's ten-redirect ceiling. Details.	🟢 done	84c466e1d	#775
64		CI moves from Node 20 (end of life) to Node 24 LTS and the frontend tests to vitest 5; lockfiles are now generated with npm 11.19.0, the npm CI installs with. The Flatpak manifest stays on node20 until its packaging is finished. Details.	🟢 done	cc8effdc2	#781
65		argon2 0.6, sevenz-rust2 0.22 and zstd 0.14 land together with no source change: the argon2 known-answer test still derives the same key, and the older argon2 and zstd stay only where aerovault and zip still need them. Details.	🟢 done	a90f912f3	#780
66		The Dropbox trash fix from #738 is now proven against a live account: an opt-in test reproduces the folder-as-file listing and the 409 on the pre-fix build, passes on main, and cleans up even when a step fails. Details.	🟢 done	065604b6d	#783
67		pCloud's refused trash now reads as a pCloud limit on all four entry points instead of a broken login, with one classifier for its result codes and a live test guarding both vendors' wording. Details.	🟢 done	11b2f708b	#784
68		Small SFTP downloads send STAT and OPEN together when the listing already knows the size, a failed speculative open no longer fails the download, and the file handle is closed on every early exit. Details.	🟢 done	64f15bc4f	#782
69		Agent-facing profile JSON (profiles --json, agent-bootstrap, agent-info, server_list_saved) now shows whether a profile is bound to a crypt overlay and of which kind, so a lost Crypt binding is visible through the interface agents are told to use. Details.	🟢 done	6680cb9f6	#785
70		sync --files-from now bounds both sides of the run on every scan path, so --direction upload --delete no longer deletes the remote files outside the list, and download, bisync, --watch, --from-reconcile and sync-doctor respect the list too. Details.	🟢 done	d7483d51d	#787
71		A GUI sync that ends with failed files keeps its journal, so Resume is still offered, and Resume after Cancel transfers the files the run had not reached. Details.	🟢 done	f6bc25bb7	#788
72		FTP and FTPS transfers no longer send a redundant TYPE command before every file, and put no longer waits half a second after each upload on providers other than SFTP. Details.	🟢 done	42f95c34a	#790
73		Missing-path errors on Box, FileLu, Filen, 4shared, Jottacloud and MEGA say "Path not found" once instead of twice. Details.	🟢 done	99545d180	#791
74		The CI setup steps of the SFTP rsync and FTP MLSD lanes retry for real after a timeout, instead of dying on the first stalled mirror. Details.	🟢 done	b7d7327f1	#793
75		sync --watch and reconcile refuse to delete when part of the local tree could not be read, and a reconcile plan no longer requests the same delete twice. Details.	🟢 done	af857a4f3	#795
76		S3 no longer reports an MD5 checksum read out of an SSE-KMS, SSE-C or multipart ETag, where the ETag is not the content MD5. Details.	🟢 done	e07e00c53	#792
77		The FTP put regression test times the gap before QUIT on the server instead of the whole CLI process, so a slow CI runner no longer fails it. Details.	🟢 done	fb0a8a297	#797
78		SFTP file handles are closed and awaited on every exit after the open, not only on success, so a busy worker cannot outrun a server's per-session handle limit. Details.	🟢 done	c9895c262	#789
79		Comments that no longer described the code are corrected, six rewritten and two verified accurate and left as they were. Details.	🟢 done	bda56dfb9	#794
80		hashsum --download is honored instead of being quietly ignored: the flag now skips the server digest and hashes the bytes that were really transferred, streaming them to a temporary file instead of holding the whole file in memory. Details.	🟢 done	3318a89ab	#799
81		The plausible findings from the v4.1.9 audits are closed: the sign-off check and the yanked-crate check both reported success without having run, and a CR/LF path refusal on delete and rmdir read as a retryable connection error. Details.	🟢 done	ecba1fc4a	#798
82		A sync no longer deletes, downloads or uploads anything at or under a path its scan could not see: a symbolic link it did not follow, a directory that failed to list, a directory at the depth limit, or a flat listing the provider cut short. A gap the scan cannot even name now refuses the run instead of planning half of it. Details.	🟢 done	efcc31235	#796
83		An FTP resume can no longer wait forever on a server that takes the APPE and never answers, and a refusal followed by a goodbye no longer makes the next command read that goodbye as its own reply. Details.	🟢 done	ba8c7414b	#800
84		SFTP no longer answers "that path does not exist" when it could not tell: a permission or I/O failure on the existence check stays an error, so a root under a parent the account cannot traverse is an incomplete scan instead of a missing source. Details.	🟢 done	1cf3a3026	#802
85		--conflict-mode newer no longer decides in opposite directions when no timestamp can decide: without a usable modification time it picks the larger file on both legs, and the skip says the timestamp was missing instead of implying a preference for one side. Details.	🟢 done	4ad9c04a9	#803
86		check and cryptcheck no longer give a verdict on a tree they did not read: a gap the scan can name makes the result partial with the paths listed, and a gap it cannot name is refused instead of reported. Details.	🟢 done	30a2afeab	#804
87		A compare under a crypt overlay that is not open no longer plans the delete a boundary exists to prevent: the bound now runs after the remote names are decrypted, a boundary whose name cannot be read refuses the run, and the used-bytes scan counts directories against its cap and honours a cancel. Details.	🟢 done	fac9b8144	#801
88		The six local tools the AI agent uses to look at files now say what they could not read, instead of presenting an unreadable entry as an empty file and a locked directory as an empty one. Details.	🟢 done	bf1f4097b	#806
89		sync-doctor no longer previews a sync on a tree it could not read: a failed listing counts, and the entry cap is now read where the walk grows instead of only when it opens a directory, so one listing could no longer push past the ceiling and still report a complete scan. Details.	🟢 done	5695dfd69	#805
90		The surface check no longer refuses app_info and hash_file to the command-line agent. Corrected after publication: removing that refusal is necessary and not sufficient, and running the two from the command line is still open. Details.	🟢 done	8eda8ff10	#807
91		The agent tool that compares a local tree against a remote one now says how much of each tree it actually compared: a directory it could not read, or one behind a link no walk follows, no longer comes back indistinguishable from a directory that is genuinely absent. Details.	🟢 done	11570d40b	#810
92		On MEGA, a folder you are not allowed to read is no longer reported as a folder that is not there: a permission refusal, a dropped session and a server error now reach the caller as errors instead of as "absent". Details.	🟢 done	cb84484dd	#812
93		check and cryptcheck no longer answer ok over a tree they left a path out of: the same report was listing the skipped path while the verdict said nothing was missing, because a link the walk does not follow is a gap without being a failure. Details.	🟢 done	36214214b	#808
94		The application identifier is now app.aeroftp.AeroFTP, the reverse DNS of a domain that is actually ours, and nothing of yours moves: the saved vault passphrase keeps its old keyring name on purpose, so no existing installation is orphaned. Details.	🟢	fecd347a8	-
95		The command-line agent no longer offers thirty-seven tools it could not run, and the two that exist only there are kept: what it lists is now what it can do. Details.	🟢	7b264e458	-
96		A depth you ask for is no longer confused with the walk's own safety net: the used-space scan reports what it actually covered, a cancelled run is not reported as a truncated one, and a quota it could not read in full is refused instead of understated. Details.	🟢	8a5fe6925	-
97		The application metadata now states that the new identifier replaces the old one, so a catalogue that has seen both does not list AeroFTP twice or lose the record that you have it installed. Details.	🟢	1e10616e0	-
98		The privacy notice now names the one thing that deleting the data directories leaves behind: if your vault is opened by the system keyring, that key lives in the operating system's credential store, and the document says how to remove it and when the case does not apply. Details.	🟢	17dccff85	-
99		A symbolic link the scan skips no longer has its type asserted: it is read from what the link points at, and recorded as unknown when that cannot be resolved, so a protective boundary is never anchored to a path that does not exist. Details.	🟢	1420589fd	-
100		A used-space scan you cancelled is no longer labelled as one the program cut short: the window now uses the cancelled word, and the choice moved into a helper with its own tests that mirror the rule the backend already states. Details.	🟢	c8ad1628c	-
101		A transfer that fails partway no longer leaves an FTP session owing a reply: the next command cannot read the previous one's answer, and a refused data connection always ends that session instead of only when a reply happened to be buffered. Details.	🟢	6e7ca3369	-
102		The command line now leaves out of a sync what a scan could not see: sync and reconcile bound their plans by every path a scan did not reach, refuse the run outright when the gap cannot even be named, and keep the snapshot entries under a path they deliberately left alone. Details.	🟢	76b68236b	-
103		The crypt decode now runs before the compare bound, and a test holds that order so a refactor cannot invert it and stay green. Details.	🟢	259754bfe	-
104		The scan refusal sentence now has one source: the command line composes the library phrase instead of keeping its own copy, and the text users read is unchanged. Details.	🟢	ef66fc560	-
105		The fast-path scan reducer states why it has no symlink guard and who must add one: the reported divergence could not be reproduced, so the claim was withdrawn rather than repaired. Details.	🟢	824ed793b	-
106		Sync and reconcile now report what their scans could not see, and a recursive listing cut at the provider cap refuses the run instead of planning from half a tree. Details.	🟢	febc964c1	-
107		The preflight now states that its counts describe scan completeness and never certify a compared subset, with the comparison commands named as the place that reports per-path boundaries. Details.	🟢	0c7c21f60	-
108		On Windows a key-authenticated native delta never ran: it was refused at handshake and the whole file was re-uploaded, while the command still exited 0. Details.	🟢	b798a4a5b	#786
109		A bucket's default encryption now reaches the card, and says "we do not know" when the key cannot read it instead of guessing a yes or a no. Details.	🟢	cee3725d5	#825
110		Every release was tagged with a lockfile one version behind, and nothing was red: the list of version sites existed twice and the narrower copy was the only one that ran by itself. Details.	🟢	d7eb9cd39	#826
111		Error messages no longer say the same thing twice, and on one path the second half was a different kind of error. Details.	🟢	6308466d9	-
112		The guard that was supposed to stop repeated error prefixes only looked at the first two words, and four payloads still read twice. Details.	🟢	26dc99f60	-
113		A failed directory listing was reported as an empty folder on five paths, so a restricted folder looked empty and a recursive delete walked past it. Details.	🟢	c3e41f1ce	-
114		Transfers with no speed limit set still paid the bandwidth governor on every 4 KiB chunk, measured as +17% on a mixed-size S3 upload. Details.	🟢	48ad36aa3	-
115		The AppStream metainfo that Ubuntu App Center and GNOME Software read had no gate at all, and now every pull request validates it. Details.	🟢	d8a903fb9	-
116		A B2 token failure is classified by type, not by the words in the message. Details.	🟢	3c577d3df	#832
117		CI now asks for rustc 1.97.1, not whatever stable is that day. Details.	🟢	522c088e5	#833
118		The command-line agent can now run the two tools it was already offering. Details.	🟢	7f179291e	#834
119		The five providers the MCP resources surface announces (Immich, ImageKit, Uploadcare, Cloudinary, native B2) were announced and unbuildable, and a hand-typed protocol like image-kit now resolves too. Details.	🟢	6fed23722	#843
120		Restricted characters are refused on the MCP and agent write path before the wire, with the bypasses closed: a retried authentication, an unresolved provider type, a missing restricted parent before mkdir, and the staging leaf edit writes. Details.	🟢	3c2fcc9da	#842
121		aeroftp_reconcile honors checksum, so two files of the same size and different content are no longer reported as equal, and aeroftp_hashsum now asks for the same memory cap instead of the general 500 MB download. Details.	🟢	2b32a5914	#844
122		An FTP command never starts on a session still holding an unread reply, a late 421 is no longer read as the next command’s answer, and a redial returns to the directory the caller had changed into. Details.	🟢	71cbdb57e	#845
123		rustls moves to 0.23.45 for RUSTSEC-2026-0285, published while these merges were running and red on main on a head whose own audit had passed minutes earlier; toml and autoprefixer bumped in the same window. Details.	🟢	b33b49944, 4a3c8f3cf, db858e35c	#846
124		Filebase joins the provider roster as a full S3 preset: three-field Quick Connect worded like the Filebase console, catalog card and grid tile, i18n in all 47 locales, and guards where Filebase deviates from AWS (no UploadPartCopy, read-only versioning, no object tagging); endpoint classification hardened to a domain boundary in Rust and both frontend classifiers, and rclone import now refines provider = Other remotes via the endpoint host. Details.	🟢	fb9a4a998	#847
125		sync --delta now moves only the changed bytes when downloading, and two commands stop contradicting themselves about what happened. A recursive delta download used to transfer whole files, size exited 0 on a scan the user had cancelled, and GitHub errors wrote their label twice. Details.	🟢	032d1cad	#848
126		Three ACL tests that were red on every Windows run, answered one by one instead of with a single rule stretched over three shapes. Details.	🟢 done	cfafa08d3	#849
127		An MCP client can now tell an encrypted remote from a plain one: aeroftp_list_servers reports the crypt-overlay binding, which was the last surface #785 left out. Details.	🟢 done	f5157a58e	#850
128		Three surfaces that told the user something that was not true: the server panel claimed drags it then discarded, a GitHub 404 could not say whether the repository or the file was missing, and the keystore backup row opened a panel off screen. Details.	🟢 done	b1c85cbc4	#851
129		v4.1.9 shipped with package-lock.json still declaring 4.1.8: the bump touched five version sites and the project carries seven, and the check that verified it listed the same five. Details.	🟢 done	0c0657973	-
130		vite 8.2.2 to 8.3.0, a Dependabot minor bump on a development dependency. Details.	🟢 done	23630e76f	#836
131		Four CLI surfaces that gave the same answer whether the work had been done or not: a reached transfer budget invisible in the result, get -r exiting 0 on a path it could not list, --password-stdin serving only the first connection, and exit 8 meaning two things. Details.	🟢 done	3188c8c72	#852
132		"Remove application data" was ticked and the uninstaller could not take that branch in any state, so the user got the same three prompts as someone who ticked nothing. Details.	🟢 done	ec6f48671	#853
133		On Windows a file inside a subfolder was compared as two different files, because the local scanner keyed it with the platform separator while every remote scanner uses /. Details.	🟢 done	0c94b01f4	#854
134		An S3 upload test failed on Windows one run in four and drew green on CI, and the difference was the rate of one race rather than the platform: the test mock answered without reading the body it was sent. Details.	🟢 done	1e239b007	#855
135		Nine obstacles found by using AeroFTP to develop AeroFTP, from a 186-line subcommand help down to 21, a pwd that answers without connecting, and an AeroCloud that could not create a remote folder below a missing parent. Details.	🟢 done	71b8a257a	#856
136		A one-way mirror deleted, on its second cycle, a file it had never synced, and in send-only the file removed was on the SERVER. Plus a folder that reported a transfer every cycle without moving anything. Both pre-existing. Details.	🟢 done	860fb1bfc	#857
137		Three live FTP stall-and-retry tests are back in the repository, and executing them corrected the draft twice: a retry count that read a level which emits nothing, and a runbook that could not pass by construction. Details.	🟢 done	9238da1be	#858
138		The Rust suite had never run on Windows: every cargo test in this repository executes on a Linux runner, so "green on three platforms" meant "compiles and packages" on two of them. The lane now builds and runs the library suite under MSVC, and the first execution found seven things. Details.	🟢 done	cf1e4082	#861
139		Exit 8 said "Timeout" and also answered for a reached transfer budget. It now says one thing, stopped at a limit with nothing failed, across five surfaces including the machine-readable agent metadata. Details.	🟢 done	46ee916e	#860
140		Replacing a remote file in place had never worked on SFTP, on any server: edit, the AeroCrypt marker publish and the crypt configuration writes all failed, because plain SFTP rename is specified to refuse a destination that already exists. Replacing is now its own verb using posix-rename@openssh.com, asked before anything is staged, while rename keeps refusing so an ordinary mv cannot destroy a file nobody named. WebDAV had the same hole through a hardcoded Overwrite: F. Details.	🟢 done	ed07b6347	#862
141		A code comment in providers/sftp.rs still described an ssh2/libssh2 SCP upload backend, and a russh write race, as things the code worked around. That leg existed only between 20 March and 1 April. Details.	🟢 done	f182d989	#863
142		The native rsync settings tests stop reading and writing the machine's real settings file on Windows and macOS, which made the Windows lane fail by test order. Details.	🟢 done	51aa291f8	#865
143		The public docs in the repository describe v4.2.0: counts, the transfer engine, S3 delta uploads, exit codes, and release quick references that no longer push main and the tag in one command. Details.	🟢 done	224aee889	#870
144		The Flatpak manifest builds the frontend on Node 24, like CI, instead of the Node 20 SDK extension. Details.	🟢 done	536804ed2	#868
145		Three CLI texts corrected (a GUI default, the exit-code table, a hand-written provider count) and put --delta to Filebase declines before any request instead of wasting a multipart upload. Details.	🟢 done	080692267	#869
146		The dispatcher tests stop deleting each other's binaries: two tests could share a directory name, and a stub written while another test forked stayed busy. Details.	🟢 done	ae224340d	#867
147		The identifier rename keeps every preference an upgrade would have reset: web view storage, the speech model, logs and window state stay where earlier releases put them. Details.	🟢 done	c7f9d78d3	#866
148		Immich 3.x albums show their photos again, and "All assets" and "Favorites" list every item instead of stopping at 1000, where a download sync with delete could treat the rest as orphans. Details.	🟢 done	e46503ff1	#871
149		Secrets and the shell answer the main window only, and the agents' path denylist fails closed and applies on Windows. Details.	🟢 done	9e875694b	#873
150		On Linux the UI server proves it is the app's own before any window loads it, and every agent tool that writes locally needs the backend grant. Details.	🟢 done	ad3ad7b6e	#877
151		The updater refuses an update whose signature does not verify, and the RPM package ships the update helper. Details.	🟢 done	9f0af23d7	#874
152		The AeroRsync test harness generates its SSH key at each run instead of keeping one in the repository. Details.	🟢 done	edef74fc5	#876
153		S3 is drawn as a bucket, the OAuth edit form saves wrapper and overlay changes, saved Crypt secrets can be revealed, the All tab tier is right, and AeroCrypt v4 sizes are mapped everywhere. Details.	🟢 done	bb548e314	#875 (@EhudKirsh)
154		Archives stay inside the destination, AeroCloud keeps local files a partial listing omits, the legacy import runs once, and Immich URLs are parsed. Details.	🟢 done	e750d7f88	#878
155		The team is published in TEAM.md and in a Team block of the About window, in all 47 locales. Details.	🟢 done	43fb9a5e5	#879 (@EhudKirsh)
156		Profiles exported to other tools point at the server and the TLS mode the connection uses: wrong or malformed addresses in eight formats, and FTP profiles with explicit TLS exported as cleartext. Details.	🟢 done	93275a5f9	#880
157		Every S3 download ran on a single stream, including the ones the command line announced as four, and each range is now pinned to the version the probe saw. Details.	🟢 done	f0f19d0b5	#881
158		A 1 GiB upload peaks at about half the memory: freed part buffers go back to the kernel instead of staying in per-thread pools. Details.	🟢 done	3c140f5db	#882
159		--s3-upload-concurrency was accepted and ignored by the current upload engine; it now sets the parts in flight, with the same default as before. Details.	🟢 done	5d3d50a0d	#883
160		How many streams a download gets is now a stated policy instead of an absent value: the count travels with the reason it was chosen into logs and JSON, and a previous multi-stream provider setting can no longer leak into a request that asked for one. Details.	🟢 done	4378297e4	#884
161		A download running on several streams can no longer hand back a file made of two versions of the object: it is read before the windows start and again before publishing, and the windows carry the version they were planned for where the protocol allows it. Details.	🟢 done	92c4dc305	#885
162		The application carried two copies of the same AEAD because the crate holding it back is ours: aerovault 0.6.6 releases the pin, with no change to the vault format, and a nonce of the wrong length now answers instead of panicking. Details.	🟢 done	558370659	#886
163		A machine review over row 161 returned seven findings and all are closed: Backblaze now falls back where it failed, a ninth path that reads a file on parallel handles got the same check as the others, and a refusal is a type instead of a sentence an unrelated error could quote. Details.	🟢 done	49aaafd2f	#887
164		The final review found three ways a skipped symbolic link or a missing header could delete a remote file or publish a corrupt one: AeroCloud and the GUI compare read a link the scan had skipped as a deletion, and a download with no validator was never checked against the one number the server always gives. Details.	🟢 done	f1ef58ba8	#888
165		AeroSync Compare divided by the rows it lists, and it never lists identical files, so any two folders with one difference read as 100% out of sync: the compare commands now ship what the scan examined next to the differences, and a file/folder mismatch counts as the difference it is. Details.	🟢 done	3ea371f7e	#889

Requested / under consideration

Community requests and internal follow-ups being evaluated for this or a later release.

#		Type	Item	Status	Ref
1	🟧		Eager-evaluation preview and a single-vs-multi-target placeholder for the -i selectors (prioritised by the reporter ahead of Edit(E) and the 2-letter semantics; exact behaviour to be pinned)	🔵 idea	#311 (@EhudKirsh)
2	🟥		Lossless .jpg to .jxl transcode in AeroFile: JXL re-encodes an existing JPEG losslessly and reversibly (the original JPEG bytes reconstruct exactly), for a real size win with no quality loss. Candidate framing: AeroFile as a GUI for libjxl	🔵 idea	aerovault#2 (@EhudKirsh)
3	🟥		macOS shell integration for the OS extract feature (Deliverable G macOS, deferred): Finder Sync "Extract Here / Extract to Folder" menu items mirroring the Linux Nautilus and Windows verbs, plus macOS custom document-type icons (CFBundleDocumentTypes) for the five aero formats and the generic fallback, and rebuilding the mimetype .icns multi-size (the v4.1.0 ones are single-resolution drafts). Needs a Mac to build and live-test	🔵 planned	#1408 (Deliverable G)
4	🟥		Filen Encrypted Notes: exit Beta: take Filen Notes out of Beta. Fix the participants/add contactUUID format (currently a best-effort workaround), investigate the Filen free-plan 10-note limit ghost-note cleanup, and add a rich text editor for the rich note type	🔵 planned	-
5	🟥		PRIORITY: Linux tray/GTK heap corruption, still-uncovered off-main-thread corruptor. A GDBus worker aborts with malloc(): unaligned fastbin chunk detected, the classic GLib heap-corruption signature, and it is the victim rather than the corruptor. Two marshalling fixes shipped in v4.0.5 and the SIGABRT still recurs with an identical signature, so the marshalling is incomplete and the remaining suspects are the event and plugin callbacks whose thread context is unconfirmed. Details.	🔵 planned	-
6	🟥		Recommended-protocol highlight on the Add Service / Quick Connect pages, after real benchmarks land (#368)	🔵 idea	#274 (@EhudKirsh)
7	🟧		File association opt-out (deferred, design parked): two switches, AeroFTP's own five formats against the eight general archive formats, persisted in HKCU and re-read by the NSIS post-install hook so an in-app update cannot silently restore the association, plus a /NOASSOC setup switch. Parked rather than half built, because a visible components-page checkbox needs forking the Tauri NSIS template. Details.	🔵 planned	#454
8	🟥		Application identifier rename, com.aeroftp.AeroFTP to app.aeroftp.AeroFTP. Done in #814, #815 and #866, queued rows 94, 97 and 147: the old identifier stays only where it has to, the keyring entry, the legacy data folders read on upgrade and the metainfo <replaces>.	✅ released	-
9	🟥		quick-xml 0.41 to 0.42 is a migration, not a bump: the reader's text and attribute types move from bytes to str, giving 163 compile errors across all seven files that parse XML here (WebDAV, S3, Azure Blob, the AWS STS credential plane, Jottacloud and the FileZilla importer). Dependabot's #754 was closed rather than left red; it will be raised again on the next quick-xml release, which is when to pick this up. Details.	🔵 planned	#754
10	🟧		S3 recursive delete pays one extra HEAD per directory, because it lists with the trailing-slash prefix, which by construction cannot see the same-named key, so a separate probe is unavoidable given that listing. Listing with the slashless prefix would skip the probe entirely in the common case, where no same-named object exists, at the cost of a filter that must keep exactly path and path/.... The trap is the one #764 just closed, moved by one character: a sibling like reportsX also matches the shorter prefix. Whoever takes this must write both doors before the change, not after: reportsX survives a delete of reports, and reports survives when it is a real non-empty file. Worth doing when someone measures a slow recursive delete on a tree with many folders, not before.	🔵 idea	#764
11	🟥		The AeroCrypt default-salt toggle promises more than the format offers: defaultSaltToggle says "no kit or keystore needed after create" and defaultSaltTierMeaning says "nothing else has to be carried", and neither holds, because the wrapped master key lives in the config rather than in the password, so a headerless vault needs the keystore whatever its salt mode. Two ways out, and the choice is a product call: implement the reconstruction and make the promise true, or correct the wording across 47 locales. Found while working #347; the copy was left untouched there on purpose. Details.	🔵 planned	#347
12	🟨		syncPanel.templateImportPathPairs is ambiguous in English, not in its translations: "AeroFTP applies exactly one, so nothing was imported" compresses an argument (the product can only ever apply one pair, this template offers several, so it imported nothing), and read as a report of what just happened it contradicts itself. CodeRabbit raised it on PR #770 as a Croatian wording error; it was rejected there because changing one locale would make it diverge from the source and from the other 46, which all say "applies". The fix belongs on the English string and then propagates to all 47. Details.	🔵 planned	#770
13	🟧		A hard task drop on the DAG runner path is not covered by the abort guard. Cooperative cancellation is: transfer_dag_batch.rs keeps a copy of the handle and aborts on the Err arm, which is how a cancelled token arrives. But if the task is dropped outright rather than cancelled through the token, the await inside multipart_abort dies with it and nothing on the runner path resends it, so the parts wait for the bucket lifecycle rule. Predates #766, which introduced the guard on the two provider paths only.	🔵 idea	#766
14	🟧		The unified MCP tool aeroftp_list_servers did not show a profile's crypt-overlay binding, so an MCP client could not tell a Crypt profile from a plain one. Done in #850, queued row 127, details.	✅ released	#785
15	🟨		Cyber Tools: Argon2id, plus the BLAKE3 keyed-hash and key-derivation modes (--keyed, --derive-key). Requested for local, history-free verification and key derivation, for example from the .deb and .AppImage builds on Tails. Argon2id is already a dependency through AeroCrypt, and the BLAKE3 library exposes keyed hashing and key derivation natively. To decide: which Argon2id parameters the tool exposes and how salt, context and output length are entered; CLI parity for hashsum to be weighed.	🔵 idea	#347
16	🟧		The server panel's reorder drop targets claim external drags as well as their own. The dragenter, dragover and drop handlers on the cards and the top and bottom sentinels call preventDefault() and set dropEffect unconditionally, so a file or text dragged in from outside is captured as a move (the drop itself is already a safe no-op). A first attempt claimed the drag only while the panel's own reorder was in progress, which also removed the unconditional preventDefault(): with the native drag handler disabled, that lets WebView2 navigate away from the app when a file is dropped on the list, so it was withdrawn. The shape that landed keeps cancelling external drags in the capture phase and claims only the internal reorder. Fixed in #851, details.	✅ released	#851
17	🟧		A backend that refuses If-Match cannot be told from an object that really changed. A gateway answering 412 to every pinned range would send every download back to a single stream while the output announces four, and nothing distinguishes that from a replacement today. Raised during the review of #885 and deferred with the reason written down.	🔵 planned	#885
18	🟧		A replacement that is slow and still in progress can pass the reading that decides whether to publish. That reading retries once; if the server is still writing the new version, the second reading can see an intermediate state. Neither the unit test nor the live reproduction covers it, because both replace in one write.	🔵 planned	#885
19	🟨		Nothing tells the user on the terminal when a download restarts on a single stream. The refusal is a warning in the log, and the progress callback went with the parallel attempt, so a command-line user sees a large download start again with no bar and no reason. Half closed by #887 (queued row 163): the fallback now keeps the progress bar; the reason is still only in the log, carried to #1419.	🔵 planned	#885
20	🟨		Declare atomic rename as a capability read from the server rather than assumed from the protocol. TransferCapabilities.atomic_rename is Unsupported for every provider and nothing reads it, while SFTP servers that announce posix-rename do support it: the capability should carry the measured answer so a plan can show where it came from.	🔵 planned	-
21	🟨		The same question has not been asked of parallel uploads. Azure, Box, Drime and Dropbox assemble parts read from the local file concurrently; whether a local file changing under them produces the mixture the download path had is an open question, not a finding.	🔵 planned	-
22	🟨		A resumed .aerotmp is not tied to the version it was started from. Resuming a partial download against an object replaced in the meantime joins two versions by a route #885 did not close.	🔵 planned	-
23	🟨		The recursive get ignores the stream flags and always uses the measured default. --multi-thread-streams, the cutoff and the SFTP presets are read on a single file and not on the shared batch path, so the command announces one policy and runs another. Identical in v4.1.9, so not a regression of this release: found by the final review and parked with its red tests as the first patch after the tag.	🔵 planned	-

Known issues found after release

Reported against v4.1.9. Empty at the time of opening: every entry in the previous tracker's block was marked Resolved before it closed, so nothing carried over as pending.

#	Area	Description	Status	Ref

_{Status legend: 🔴 confirmed · 🟡 investigating · 🔵 planned / idea · 🟢 done / fixed (pending release) · ✅ released}

[axpnet]

SourceForge file area pruned for the v4.1.9 cycle, and one thing it taught us

Release-channel housekeeping, not a code change on main. Recorded here because the retention step is part of finishing a release, and because SourceForge asks for it: 93 releases mirrored whole had grown the project to 44.5 GiB and earned a storage warning in July, which is why the mirroring webhook was removed and the upload became a curated subset.

The retention rule is unchanged: the newest two release folders keep their full asset set, every older folder keeps only its README.md and its sigstore attestations. The binaries themselves stay available on GitHub Releases, so nothing is lost, only unmirrored.

Area	Description	Status	Ref
Prune	22 binaries removed from v4.1.3, v4.1.4 and v4.1.5, freeing 1.78 GB. Every one of the 22 was checked by name against its GitHub Release before deletion and is still published there	🟢 done	-
Retention	v4.1.8 and v4.1.9 kept complete, 17 files each	🟢 done	-
Preserved	Each pruned folder now holds exactly its 8 .sigstore.json attestations plus README.md, so the release notes and the signature chain survive	🟢 done	-
Default downloads	Confirmed rather than set: best_release.json already pointed at v4.1.9 for mac, windows and linux	🟢 verified	-
Script	The closing message told the operator to set the default download button by hand, which was verified false back on v4.1.3. Corrected to a verify step, and the prune loop now carries a comment recording the exit-code trap below	🟢 fixed	-

Verified by re-reading the server state through the project's RSS listing, not by trusting the tool's exit status, for the reason that follows.

The exit code lied, and the listing told the truth

One delete reported failure: aeroftp-cli rm returned exit 10, "server or parse error", for AeroFTP_4.1.5_x64_en-US.msi. The file was gone. The folder listing afterwards showed only its .sigstore.json, so SourceForge had performed the delete and then answered as if it had not.

The cause is deliberately not attributed. SourceForge may simply be replying badly after doing the work, in which case the client is reporting faithfully what it received, so this is logged as measured behaviour and not as a defect in aeroftp-cli.

What matters is the consequence, and it is the mirror image of a trap this same script already guards against. The script refuses to read an empty listing as a clean folder, because a failed read and an empty folder produce the same reassuring number. This is the same failure with the sign flipped: a successful delete and a failed one produce the same alarming exit code. A prune loop under set -e that trusts rm stops halfway convinced it failed, and whoever re-runs it then re-deletes files that were already gone.

The rule for this channel: the exit status is a hint, the folder listing is the verdict. Recorded as item 10 in "Requested / under consideration" so the fix, confirming each delete by re-listing, is not rediscovered from scratch by whoever prunes next.

[axpnet]

Jottacloud refresh chains: two per station, a refusal that only half-cleared, and an export that shipped the dead one (#712)

Area	Description	Status	Ref
Cause 1	The CLI never bound the profile id for a saved Jottacloud profile, so it rotated the legacy singleton jottacloud_refresh while the GUI rotated jottacloud_refresh_<id>. Two live chains for one profile, each able to die alone, and the provider tried only the first key it found	🟢 fixed	b3c3da2e
Cause 2	On a refused chain the provider deleted the raw vault key only; resolve_active_credential reads the user partition mirror first, so the same dead chain was found again on the next read. The log signature is Credential deleted: jottacloud_refresh_srv_... followed by Found persisted refresh token on the next run	🟢 fixed	b3c3da2e
Consequence	profile_export prefers the per-profile key through that resolver, so three exports in a row carried a chain Jotta refused with invalid_grant: Session doesn't have required client, and the other station saw "Login token expired or already used", which is only the fallthrough text	🟢 fixed	b3c3da2e
Fix	Both chains tried most specific first; a refused chain deleted from vault and partition; a rotation written to both keys; CLI binds the profile id on --profile. Unit tests on candidate order and persisted keys, a source pin that every caller of mirror_active_credential also unmirrors	🟢 done	#712
Measured	Export taken as the last touch on L2 (22:22:55Z), imported and connected on L1 (22:23:43Z, which rotates), L2 still connecting (22:24:07Z): one chain serves two stations. profile-import skips an existing id, so a copy is refreshed by deleting it first	🟢 verified	-

Not the class elsewhere: MEGA's session key and the 4shared token are stored with store.store and deleted raw, never mirrored, so their raw deletes are symmetric. The residual "audit the same pattern on the other OAuth providers" from the earlier Jotta refresh fix closes with: shared OAuth path already paired with unmirror, Jotta fixed here, MEGA and 4shared outside the property.

[axpnet]

postcss-selector-parser 6.1.4 for Dependabot alert 69 (#710)

Area	Description	Status	Ref
Dependency	Transitive dev dependency of tailwindcss 3.4.19 (via postcss-nested) with an uncontrolled AST recursion, fixed upstream in 6.1.3; bumped to 6.1.4 in the lock, no manifest change	🟢 done	95cc7b06
Verification	Lock regenerated with npm 10.8.2 (the version CI runs), then npm ci, tsc --noEmit and vite build in a clean worktree, all clean; CodeRabbit path-filters lockfiles, so the three-line diff was read by hand	🟢 verified	#710

[axpnet]

AeroSync template export: the compare fields now follow the verify policy (#707, #514)

Area	Description	Status	Ref
Cause	The export serialised the named preset, so compare_size / compare_timestamp / compare_checksum were true / true / false whatever the Plan tab said; import already preferred verify_policy, so only the file on disk contradicted the choice	🟢 fixed	93df7925
Fix	The verify policy drives all four fields on export: full sets the checksum, size_and_mtime and size_only clear checksum then timestamp, none leaves the preset alone. Two tests red on the old code	🟢 done	#707
Review	CodeRabbit never read this head: eight hours of triggers refused by the OSS quota while the other seven PRs of the batch were read. Declared on the PR, diff read by hand (66 lines, two files)	🟡 declared	-

[axpnet]

--immutable honoured by cp and mv, and fail-closed when the destination cannot be checked (#705)

Area	Description	Status	Ref
Cause	cp and mv never read the flag: --immutable cp onto an existing target overwrote it and exited 0, on the server-side copy and the download-to-upload fallback alike; measured live on the NAS profile before the change	🟢 fixed	aef82285
Fix	One helper for put, cp and mv: stat before the write, skip with exit 9 in the shape put always used; under --immutable a stat that fails for any reason other than not-found refuses the write with the provider exit code (review finding), --no-clobber keeps its fail-open reading	🟢 done	#705
Declared	Stat-then-write is not atomic: two writers racing for one target can both pass; closing the window needs a provider-side precondition (S3 If-None-Match, SFTP O_EXCL), unmeasured per provider. Recorded in the flag help and the CLI guide	🟡 declared	-
Verified	Unit tests on the helper (existing target, missing target, stat that fails in both flag modes); live on SFTP with the release build, scratch folder removed afterwards	🟢 verified	-

[axpnet]

kDrive: the token scopes are named where the token is created (#709, #650)

Area	Description	Status	Ref
Cause	A drive-only token connects and lists; only Fetch is refused (403 naming user_info). v4.1.9 made the refusal readable, but the only help text for the token field was never rendered, so nothing said it before the token existed	🟢 fixed	14a00d6d
Fix	Hint under the token field in all 47 locales: needs drive and user_info, with drive alone it connects and lists, Fetch is refused because it reads the account profile for the Drive ID; each locale uses its own Fetch label	🟢 done	#709
Review	A first wording said the token was refused, wider than the truth; corrected across all locales together with four language points (hi, is, ro, sv)	🟢 fixed	-

[axpnet]

SourceForge prune: the listing decides a delete, not the exit code (#706, closes item 10)

Area	Description	Status	Ref
Cause	rm returned exit 10 for a file that was gone; under set -e one false failure aborted the prune halfway and the next operator re-deleted files already gone	🟢 fixed	3ddcace2
Fix	Nonzero rm followed by a re-listing: absent counts as deleted with a note, present stops the script, an unreadable listing is a verification failure; sfls requires entries to be an array; every CLI call runs with AEROFTP_STRICT=1	🟢 done	#706
Closing message	"Set the default download button by hand" was false since v4.1.3; replaced by a best_release.json check that matches the release folder /v/ and validates the rows before looping	🟢 fixed	-
Verified	Stand-in CLI in four modes (clean, delete-then-lie, real failure, null listing after a lying delete); the live SourceForge file area was not touched, that profile lives on the release station	🟢 verified	-

[axpnet]

docs/TESTING.md: the smoke entrypoint exists, say so (#713)

Area	Description	Status	Ref
Docs	The testing page promised a single pre-release smoke entrypoint as future work while npm run smoke has been the pre-tag step since v4.1.4; the running section now leads with it and explains the pass/skip matrix, and the frontend command is corrected to npm run test:unit	🟢 done	8e543b2c
Review	CodeRabbit had no quota for this head; claims checked against main by hand (package.json scripts, scripts/smoke.mjs, docs/RELEASE.md)	🟡 declared	#713

[axpnet]

The Auto-Routing fallback model now answers, and Ollama can be a routing target

Post-4.1.9 follow-up, on main in 7bf46ef2, shipping in v4.2.0 (#704).

AutoRoutingRule.fallbackModelId had been declared in the settings type and read by nothing, so a rule could name a fallback that never did anything. Wiring it turned out to need a fix in the streaming path first, and review found three defects in the wiring itself, which is the more useful half of this entry.

Area	Description	Status	Ref
Fallback	A rule's fallback answers when the preferred model fails with an error belonging to the endpoint. Never on a budget the user set, never on a cancelled request, never once a token has streamed	🟢 done	f221fe06
Streaming	ai_chat_stream reported provider failures through its own catch and resolved the stream, so the failure never rejected and no caller could react. It now rethrows when nothing reached the user	🟢 done	f221fe06
Ollama	The routing dropdowns filtered providers on isEnabled && apiKey, excluding by construction the one provider that runs locally, free and offline. Every other check in that panel already read apiKey || type === 'ollama'	🟢 fixed	979b405e
i18n	5 keys across 47 locales, plus the Auto-Routing tip corrected: it claimed "Auto (Default)" uses the chat header model, when routing only runs if no model is pinned there	🟢 done	f221fe06

What review caught, and why each one mattered

Defect	Why it was not visible from the code alone	Ref
The classifier matched bare substrings	It read the "500" inside max_tokens must be <= 5000 as a server error and spent a second request on a malformed one, while missing a bare HTTP 404 because only the phrase "model not found" was listed. A status now decides when the message carries one	991a6e06
The timeout path never cancelled the stream	A leak the failover itself created: before it, the turn ended at the timeout, so nothing kept billing. With a fallback starting beside the abandoned stream, both could bill in parallel	991a6e06
The stop guard never fired on AbortError	/\babort(?:ed)?\b/ needs a boundary after the word, and aborterror continues with a letter. The test passed by falling through to the end rather than by being refused at the guard, so it could not have failed even with the guard deleted. AbortError: network timeout would have retried a request the user stopped	d49f9934, 9ae9e64b

The last one is worth keeping: the assertion looked like a regression test and proved nothing. The replacements each carry a marker that would otherwise fail over, so only the guard can produce false.

Verified green: tsc --noEmit clean, 98 test files and 863 tests passing including 13 new ones, i18n:validate at 46 locales and 100 percent with 0 placeholders and 0 orphans, production build ok, and all 12 CI checks on the merged head with CodeRabbit's final pass on that same sha.

[axpnet]

OneDrive Personal recycle bin: a Graph limit reported as such (#708, #397)

Area	Description	Status	Ref
Cause	Graph has no endpoint for the recycle bin of a OneDrive Personal drive; the business-drive listing answers 400 invalidRequest there, and the app forwarded the raw JSON as a failed request	🟢 fixed	c5bf3db0
Fix	driveType recorded at connect; that exact 400 becomes a NotSupported limit naming the account kind and pointing at the OneDrive website (auto-emptied after 30 days); other 400s unchanged; the button stays for business drives	🟢 done	#708
Help	Help > Providers keeps the OneDrive trash tick with the caveat as a focusable, labelled tooltip through a per-feature details map; source test next to the pCloud one	🟢 done	-
Verified	Unit test with the reported body; live read-only on the saved OneDrive profile (driveType personal, limit returned); review findings (colon in the generic message, case-insensitive test profile, accessible tooltip) closed	🟢 verified	-

[axpnet]

Jottacloud: purge a trashed folder and empty the trash (#711, closes item 9 as corrected)

Area	Description	Status	Ref
Measured	rmDir=true on the ORIGINAL path of a trashed folder answers 200 and the folder leaves the trash (twice, test account); rm=true on a folder is 404; files/v1/purge_trash answers 200 with the counts and the trash re-lists empty. Item 9 had measured the Trash view only	🟢 verified	-
Fix	Folder purge through the original-path form, guarded on a tombstone read-back so a live folder is refused; the one-round-trip window is declared (JFS has no conditional delete). Empty trash via purge_trash with strictly parsed counts: provider, command, button with confirmation	🟢 done	f8333a24
Review	Six findings closed: strict counts, declared race, opt-in for the whole-bin live step, backdrop and Escape kept inside the confirmation dialogs, double-click guard; the inventory finding refuted with the generator numbers (480 matched + 371 = 851)	🟢 fixed	#711
Tests	Unit (URL, decision, counts), live purge/guard/empty, #703 e2e now purges its fixture	🟢 verified	-

[axpnet]

--tui parity with -i, and both usable on an empty vault (#714, #347)

Area	Description	Status	Ref
Cause	The --tui menu was a hand-kept list behind the -i action bar (Help, refresh, New, Groups, Users, Add, remove missing); on an empty vault two guards exited before any menu could show	🟢 fixed	961d41c8
Fix	Menu derived from the verb table (same order, cells and keys, aliases included), lowercase labels for verbs not invoked by their first letter, menus take no rows, profiles -i help names the verb table	🟢 done	#714
Evidence	Four pty scenarios with a throwaway vault on the merged head: empty vault menu with New/Help/refresh, 48-column wrap, groups remove via prompt, users New via bare verb; three pins over the verb tables	🟢 verified	-

[axpnet]

AeroRsync standalone crate, tranche A1: the module owns its delta engine, and its oracle tests now run (#715)

Post-4.1.9 follow-up, done on main, shipping in v4.2.0 (#715).

First tranche of Phase A of the standalone-crate track: the aerorsync module stops importing the application where it can, and a test keeps it that way. A small A0 rides in the same PR because the byte-level oracle it protects was not being read at all.

Area	Description	Status	Ref
Engine	src/delta_sync.rs becomes aerorsync/delta_engine.rs (git mv, its 18 tests follow); the only application consumer, the delta_sync_analyze command, is gated on the aerorsync feature, so the default build registers the same commands and the feature-off build stays green	🟢 done	4bbbab84
Coupling	Fixture number parsers copied verbatim with a parity pin in number_parsing; atomic write helpers move into streaming_writer.rs with temp name formats and map_write_atomic_error unchanged; production unsafe count unchanged at 19	🟢 done	4bbbab84
Budget	app_import_budget_matches_the_documented_inventory pins the module's application imports at 29 occurrences over 3 modules (from 42 lines over 5) and may only shrink; grouped imports, super::super::, cfg_attr path redirects, include macros and subdirectories are refused; seen red on four forms before landing	🟢 done	4bbbab84
Oracle (A0)	capture/artifacts_real/frozen/ (19 files, 92 KB, rsync 3.2.7) is versioned with a gitignore carve-out, and the one oracle test that read a second gitignored file now derives its basis block from the seed formula: 40 tests that returned early in CI and fresh worktrees, visible only with --nocapture, now read the transcript	🟢 fixed	4bbbab84
Evidence	AeroRsync suite from 677/0/15 to 697/0/15 with zero skipped oracle pins; frozen transcript sha256 manifest identical before and after the suite; adversarial review in a separate tab, one hardening commit (cfg_attr with a path key refused)	🟢 verified	-

Verified green: cargo fmt --all -- --check, cargo check --no-default-features --lib, cargo clippy --lib --features aerorsync --all-targets -- -D warnings, AeroRsync suite 697/0/15 with --nocapture, number_parsing 16/0, full pre-push gate (lib 3700/0/23, i18n 47 locales), PR CI on every lane (Docker lane 3 with real rsync 3.2.7, deflate 3.1.3 oracle, both live SFTP lanes, Windows cross-OS build and native unit tests, macOS/Linux/Windows builds, sign-off), and the Windows check workflow run on the branch.

[axpnet]

AeroRsync standalone crate, tranche A2: progress sink and event notices owned by the module, event bridge removed (#716)

Post-4.1.9 follow-up, done on main, shipping in v4.2.0 (#716, on top of #715).

Second tranche of Phase A of the standalone-crate track: two more application couplings leave the aerorsync module, and a component with no production caller goes with them.

Area	Description	Status	Ref
Progress	aerorsync::progress::ProgressSink is the crate-owned callback type; the application alias DeltaProgressSink stays untouched and a compile-time pin on the application side asserts the two are the same type	🟢 done	653dcb98
Notices	The user-facing texts for Error, ErrorXfer, ErrorSocket, ErrorExitNonZero, Warning, ErrorUtf8, IoError, IoTimeout and Deleted live in the crate as AerorsyncEvent::notice(), byte-identical to the retired bridge (diff of the format literals empty), one assert_eq! test per table row plus exhaustive sweeps; a WarningCollector sink feeds RsyncStats.warnings through the same funnel as before	🟢 done	653dcb98
Bridge	rsync_event_bridge.rs (540 lines, 27 tests) removed: the only caller was the warning funnel replaced in the first commit; the counters and terminal latch it exposed were never read by product code; revertible on its own	🟢 done	653dcb98
Budget	app_import_budget_matches_the_documented_inventory goes from 3 application modules to 2 (5 keys, 17 occurrences); seen red on a plain import, a grouped import and the aerorsync_adapter form, which proves the whole-identifier match	🟢 done	653dcb98
Evidence	AeroRsync suite 697 to 712 (notice tests and identity pin) to 685 (bridge tests removed), 8 above the CI floor of 677; zero skipped oracle pins under --nocapture; adversarial review on the git objects with no code change; the pre-existing Deleted severity mismatch is conserved and pinned by name for the Phase D decision	🟢 verified	-

Verified green: cargo fmt --all -- --check, cargo check --no-default-features --lib, cargo check --bin aeroftp-cli --features aerorsync, cargo clippy --lib --features aerorsync --all-targets -- -D warnings, AeroRsync suite 685/0/15 with --nocapture, full pre-push gate (lib 3690/0/24, CLI 520, frontend 866, i18n 47 locales, audit clean), PR CI on every lane (Docker lane 3 with real rsync 3.2.7, deflate 3.1.3 oracle, both live SFTP lanes, Windows cross-OS build and native unit tests, macOS/Linux/Windows builds, sign-off), and the Windows check workflow run on the branch.

[axpnet]

AeroRsync standalone crate, tranche A3: crate-owned errors and reports, adapter at the boundary (#717)

Post-4.1.9 follow-up, done on main, shipping in v4.2.0 (#717, on top of #716).

Third tranche of Phase A: the module stops speaking the application's error and statistics vocabulary, and the translation moves to a new application adapter. Eight commits: three for the tranche, two from the adversarial review, three from the first CI run.

Area	Description	Status	Ref
Errors and reports	TransferError (Soft, Hard, TooSmall, Native with kind and commit state) and TransferReport are the module's return types; to_rsync_error and report_to_rsync_stats in the adapter produce the same RsyncError envelopes and the same RsyncStats fields as before, verbatim	🟢 done	50bcd412
Retry	The reconnect retry decides on is_transient_channel_drop() with three crate-owned lists (transient kinds, the 11 deny substrings, the 7 classic transport substrings applied to soft failures only); parity with the retired application classifier proved on 190 cases, including the four real module errors that embed an OS error text and would otherwise have lost their retry	🟢 done	50bcd412
Adapter	src/aerorsync_adapter/ holds impl DeltaTransport and impl DeltaBatch as verbatim wrappers, the error and stats maps and the probe rule; consumers (providers/sftp.rs, local_sync.rs, the CLI, the integration tests) unchanged; a guard test pins that the adapter reaches only the module's public surface	🟢 done	50bcd412
Retired code	rsync_over_ssh::is_transient_for_reconnect and its 29 tests are gone; the envelope predicate derives its needles from the crate lists (feature off: not transient); the Delta Sync Integration unit floor is lowered from 94 to 70 in the same change	🟢 done	50bcd412
CI lesson	The Docker lane 3 tests compile only under --cfg ci_lane3; the first run caught the trait no longer in scope, fixed by importing it in the test module and adding the --no-run gate under that cfg to the checklist; lane 3 also run locally against stock rsync 3.2.7, 15 of 15	🟢 verified	-
Evidence	AeroRsync suite 685 to 689 with zero skipped oracle pins; rsync_over_ssh tests 50 to 25; import budget 5 keys over 12 lines; adversarial review on the git objects with one test-only finding and the log lines restored as they were	🟢 verified	-

Verified green: cargo fmt --all -- --check, cargo check --no-default-features --lib, cargo check --bin aeroftp-cli --features aerorsync, cargo clippy --lib --features aerorsync --all-targets -- -D warnings with and without --cfg ci_lane3, RUSTFLAGS='--cfg ci_lane3' cargo test --features aerorsync --lib --no-run, AeroRsync suite 689/0/15 with --nocapture, full pre-push gate three times (lib 3669/0/24, i18n 47 locales, audit clean), local Docker lane 3 15/15, PR CI on every lane, and the Windows check workflow run on the branch.

[axpnet]

The AeroRsync test harness generates its SSH key instead of keeping one in the repository

Post-4.1.9 follow-up, fixed on main, shipping in v4.2.0 (#876).

The fixture key authorised only a user inside the throwaway test container and no real host (checked on the test station, the NAS and the account keys), but a private key with a development machine's name in a public repository has to be explained to everyone who finds it. The three capture scripts and the CI lane generate it at each run through one shared helper, with a neutral comment.

Verified green: the Docker capture lanes in GitHub Actions ran with a key generated during the job, and bash -n plus an idempotence check on the shared helper.

[axpnet]

S3 drawn as a bucket, and five review findings from the tester lane

Post-4.1.9 follow-up, fixed on main, shipping in v4.2.0 (#875, raised by @EhudKirsh in #347, #369, #274 and #215).

Area	Description	Status	Ref
Icons	S3 is drawn as a bucket on the eight surfaces that show connection methods, from one shared icon map	🟢 done	bb548e314
Edit form	Save on an OAuth profile sees changes to wrappers and overlays and applies the overlay safeguards; Save on the 2FA pages stays enabled with a typed code	🟢 fixed	bb548e314
Crypt	Saved Crypt password and salt get reveal and copy, read from the vault on demand	🟢 done	bb548e314
Catalog	The All tab's tier is the union of the per-tab tiers (MEGA, pCloud and Yandex were wrong)	🟢 fixed	bb548e314
AeroCrypt	Decrypted sizes of AeroCrypt v4 (keyslots) are mapped in the GUI Compare, the CLI check and reconcile, and the MCP check_tree, through one function	🟢 fixed	bb548e314

Verified green: typecheck, 942 unit tests, Rust fmt and clippy, the new tests (three fail if the size mapping is narrowed to v3, the catalog test fails on the previous code), and the full GitHub Actions run on the pull request.

[axpnet]

Archives stay inside the destination, AeroCloud keeps files a partial listing omits, and Immich URLs are parsed

Post-4.1.9 follow-up, fixed on main, shipping in v4.2.0 (#878).

Validated findings of the pre-release security audit, all older than v4.1.9.

Area	Description	Status	Ref
Archives	An entry mixing / and \\ could carry a parent component past the check on Windows; a subfolder named after ...zip, ../name or a drive-prefixed name left the chosen folder. Entry names are split on both separators at once, and every extract folder name is reduced to one safe component	🟢 fixed	e750d7f88
AeroCloud	A listing the provider marks as not authoritative was treated as complete, also through the crypt and compress overlays, so an omitted object read as deleted and its local file was removed	🟢 fixed	e750d7f88
Migration	The legacy configuration merge ran at every start and brought back files the user had deleted; it runs once per data root	🟢 fixed	e750d7f88
Immich	The server URL is parsed; only http and https are accepted, and a malformed explicit URL is an error	🟢 fixed	e750d7f88
Tests	The updater test that wrote {"mediaType":"x"} reached the network trust root; it now uses a document the bundle parser refuses. The command inventory is regenerated after shell_execute stopped being a command	🟢 fixed	e750d7f88

Verified green: the new tests seen red on the previous code, clippy with -D warnings, and the full GitHub Actions run on the pull request.

[axpnet]

The team is published in TEAM.md and in the About window

Post-4.1.9 follow-up, on main, shipping in v4.2.0 (#879).

Area	Description	Status	Ref
Team	TEAM.md lists who does what, and the About window gains a Team block, translated into all 47 locales	🟢 done	43fb9a5e5
i18n	The Slovenian "write a review" label regains its caron; the Estonian and Romanian team titles are accepted by the diacritics gate as correct	🟢 fixed	43fb9a5e5

Verified green: i18n:validate, i18n:diacritics --strict, typecheck, and the full GitHub Actions run on the pull request.

[axpnet]

Exported profiles point at the server and the TLS mode the connection uses

Post-4.1.9 follow-up, fixed on main, shipping in v4.2.0 (#880). Found while preparing the comparative tests against Cyberduck.

The exporters rebuilt each address from the profile's host field instead of asking the connection, so a bookmark could name the wrong server or an unusable URL, and the FTP TLS mode was read from a key no connection reads.

Area	Description	Status	Ref
Addresses	Cyberduck carried a full URL as the hostname, or none for MinIO so the bookmark pointed at AWS, and no path-style where the server answers only path-style; mc wrote https://https://, duplicacy s3://https://, lftp https://user@https://, s3cmd and kopia put the scheme inside the host, the aws config lost the MinIO endpoint, restic mapped WebDAV to its REST server	🟢 fixed	93275a5f9
FTP TLS	An FTP profile that connects with explicit TLS was exported as cleartext to rclone, WinSCP, Cyberduck and Dreamweaver, and as plain FTP to MobaXterm; the importers now store the mode the connection reads, with the old key kept as a fallback, and rclone remotes also carry the TLS 1.2 pin the server needs for session reuse	🟢 fixed	93275a5f9
Refusals	Single-target formats (kopia, restic, s3cmd) wrote the first profile and dropped the rest without a word; they now report the ones they could not include, and an export that refused every profile exits 4	🟢 fixed	93275a5f9

Verified: the exported bookmarks read back with Cyberduck's command-line client against R2, FTPS, MinIO, Nextcloud and WebDAV; rclone listing the lab FTP over TLS from the new remote; 20 new tests plus four existing ones that pinned the defect, and the full GitHub Actions run on the pull request.

[axpnet]

Every S3 download ran on one stream, including the ones announced as four

Post-4.1.9 follow-up, fixed on main, shipping in v4.2.0 (#881). Finding A1 of the comparative battery.

Area	Description	Status	Ref
The probe	The size that decides whether a file is split was read from the body length of a HEAD response, which is always zero, so no S3 file ever met the cutoff and the command line printed four streams while sending one request. The header is the size	🟢 fixed	f0f19d0b5
Version pinning	The workers send independent range requests, so an object replaced between them by one of the same size passed every byte count and the rename committed a mixture. Each range now carries the ETag the probe saw; an object that changed fails the download and leaves no file; without an ETag the download stays on one stream	🟢 fixed	f0f19d0b5

The desktop is not affected: it plans its own ranges and was already splitting. Verified: one request before and four ranged requests after against a local server, with matching SHA-256; three tests, one of which fails if the pinning header stops going out.

[axpnet]

A large upload keeps about half the memory it used to

Post-4.1.9 follow-up, on main, shipping in v4.2.0 (#882). Finding A2 of the comparative battery, answered without touching any transfer path.

The engine holds a bounded set of part buffers (four times 16 MiB over a 65 MB baseline), but on a many-core machine the C library kept the freed buffers in per-thread pools, so the process looked like it was holding 300 MB. The allocator is now asked, at startup of both binaries, to take buffers of that size from the kernel and return them on free.

Area	Description	Status	Ref
Peak memory	1 GiB S3 upload, three runs: 295 to 312 MB before, 139 to 141 MB after, same wall time. 139 MB is the engine's own figure	🟢 fixed	3c140f5db
Scope	Four lines plus a module; no transfer path changes, and it does nothing where that allocator is not in use	🟢 done	3c140f5db

The test pins that the setting is accepted; the memory figures are a measurement and the pull request says so rather than claiming a unit test can see them.

[axpnet]

--s3-upload-concurrency reaches the engine that does the uploading

Post-4.1.9 follow-up, fixed on main, shipping in v4.2.0 (#883). Second half of finding A2, measured rather than asserted.

The number of parts in flight came from a constant the S3 and Azure providers published in their transfer hints, so the setting only ever changed the older upload path: on the current engine it was accepted and ignored, and nobody using it could tell.

Area	Description	Status	Ref
The hint	S3 publishes the effective setting, Azure publishes an explicit one; both keep 4 as the default, so an upload that sets nothing behaves exactly as before	🟢 fixed	5d3d50a0d
Measured	300 MB over a 100 ms link. Before: the engine took 2.19 s at 1 part and 2.18 s at 8, no difference, while the older path went 5.92 s to 1.84 s. After: 6.03 s at 1, 2.20 s at 4, 1.99 s at 8	🟢 measured	5d3d50a0d

Azure folds in only an explicit setting, because its own default is 1 and inheriting it would have cut the engine's default fan-out from 4 to 1 for everyone; a test pins that too. Both tests fail on the previous code.

[axpnet]

The download stream count carries its own reason

Post-4.1.9 follow-up, fixed on main, shipping in v4.2.0 (#884).

A download request used to say download_segments: None, which meant both "decide for me" and "one stream is on purpose", and the two were told apart further down the stack or not at all. The request now states which of the three it is (automatic, an explicit count, or one stream with a reason), the resolved number travels with where it came from, and the values themselves do not change: 8 for SFTP, WebDAV, FTP and FTPS, 4 for S3, 1 elsewhere.

Area	Description	Status	Ref
The request	Auto, explicit count and intentional single stream are three separate things; Auto resolves from the live provider's measured preference, carried beside the other preferences in TransferCapabilities	🟢 fixed	4378297e4
Visible	The count and its origin reach the transfer log, the MCP sync JSON and the shared CLI batch JSON, so a report says four streams and also why it was four	🟢 fixed	4378297e4
Carry-over	Stream state is armed explicitly on every request, so a provider left on multi-stream by an earlier transfer no longer answers a later single-stream one with the old setting	🟢 fixed	4378297e4
A comment that lied	The shared CLI executor was documented as single-stream while it resolved to the measured provider default	🟢 fixed	4378297e4
FTP, stated honestly	Of the four sites in question two are uploads and two feed the legacy FTP download executor, which never reads the field; they now declare one stream with a reason instead of reporting an eight nothing executes, while the measured default of eight stays on the provider path that does segment	🟢 fixed	4378297e4
Upload concurrency	--s3-upload-concurrency is pinned against the planned multipart topology and slots for one versus eight, not only against a provider hint	🟢 pinned	4378297e4

Verified green: the full GitHub Actions matrix on the head that was merged, 19 checks across Linux, Windows and macOS.

[axpnet]

A multi-stream download can no longer publish a file made of two versions

Post-4.1.9 follow-up, fixed on main, shipping in v4.2.0 (#885).

A download that runs on several streams reads a different window of the object on each one. Nothing checked that all the windows came from the same object, so an object replaced while they were in flight was assembled out of two versions: each window had the length it asked for, the total was exactly right, and the file was published. Row 157 closed this for the S3 provider's own multi-thread download; the shared segmented executor is a different path, and it is the one the transfer queue, sync, cross-profile copy and the GUI take. b2, sftp, ftp and the CLI pget assembled their windows the same way.

Area	Description	Status	Ref
The check	The object is read before the windows start and again before the file is published; the two readings are compared on the validator the provider publishes, then on size, then on modification time, and the refusal names what changed	🟢 fixed	92c4dc305
Pinned where possible	A new provider capability puts If-Match on every range where the protocol has a validator, so the server refuses a window from a newer version instead of serving it; S3 implements it, a weak tag is dropped rather than sent	🟢 fixed	92c4dc305
The plan	The window plan comes from a size probed earlier, so a reading that does not match it means the plan belongs to another object: the parallel path then refuses before spending a byte, rather than publishing a file cut to the old length	🟢 fixed	92c4dc305
No idle session	Each reading opens and closes its own session: one parked for the length of a transfer would hold a connection slot the windows may need and would be the first thing a server idle timeout drops	🟢 fixed	92c4dc305
Refusal, not failure	A refusal takes the single-stream path that reads one consistent view, on every surface that has one, so a file that grows while it is read still downloads	🟢 fixed	92c4dc305
Every surface	Wired at the five places that assemble a file out of parallel windows: the shared executor, b2, sftp, ftp and the CLI pget	🟢 fixed	92c4dc305

Reproduced live on SFTP, on the build before the fix: a 300 MiB object replaced in place at the same size during the download produced a local file whose checksum matched neither the version before nor the version after, with exit code 0 and no warning. The file that arrived never existed on the server. The verdict was taken three ways rather than two, because delivering the new version whole would be unpleasant but coherent, and only "neither one nor the other" proves two versions were mixed.

One scenario deliberately does not reproduce it, measured in the same run: a file that only grows while it is read has an immutable prefix, so parallel windows read coherent bytes with no protection at all. That case was correct before and stays correct, which is why a refusal falls back to a single stream instead of failing.

Stated limits: on providers that publish no validator, a replacement with the same size and the same timestamp at second granularity is not detected; and a file being appended to while it downloads now takes one stream instead of several, because a size that moved cannot be told from a rewrite by reading the object alone.

Four tests, each seen failing on the code before the fix. The first one did not merely fail: it showed the download succeeding and the mixed file published.

Verified green: the full GitHub Actions matrix on the head that was merged, 22 checks across Linux, Windows and macOS, and CodeRabbit closing with no actionable comments after seven passes.

[axpnet]

One copy of the AEAD, because the crate holding it back is ours

Post-4.1.9 follow-up, fixed on main, shipping in v4.2.0 (#886).

aerovault 0.6.4 depended on chacha20poly1305 0.10, so this application pinned =0.10.1 for its own use and carried two copies of the same AEAD in the tree, with a note in the manifest naming the release that would let it go. That release exists now.

Area	Description	Status	Ref
The dependency	aerovault 0.6.6 and chacha20poly1305 0.11; the lock file holds one copy where it held two	🟢 fixed	558370659
The container	aerovault 0.6.6 moves the cascade's outer layer to 0.11 with no change to the on-disk format, asserted by its own cross-implementation goldens: one opens a fixture written in June and extracts it, the other writes it again and compares byte for byte	🟢 verified upstream	558370659
A panic on the way out	CryptoLab is the only place here that uses the AEAD directly. The 0.11 API drops GenericArray::from_slice, which asserted on a wrong length: a nonce that was not twelve bytes killed the call. It is a fallible conversion now, so the same input returns an error	🟢 fixed	558370659

The crate side of this was published today as well: aerovault 0.6.5 and 0.6.6 on crates.io, aerovault-cli back in step at 0.6.6, and the tags and releases that the repository was missing for 0.6.4 and 0.6.5.

Verified green: the full GitHub Actions matrix on the head that was merged, 23 checks, and CodeRabbit with no actionable comments. Tests: cargo test --lib cyber_tools aerovault crypto, 69 passed, plus the crate's own 132 unit tests and its cross-implementation suites upstream.

[axpnet]

The seven findings a machine review returned on the segmented download, closed

Post-4.1.9 follow-up, fixed on main, shipping in v4.2.0 (#887, following #885).

An automated multi-agent review was run over the merged work of row 161 and returned seven findings. None was a wrong result, and two were real gaps: one path refused where it should have fallen back, and one path that assembles a file out of parallel handles had been left without the check the rest of them got.

Area	Description	Status	Ref
Backblaze refused instead of falling back	read_range learned to refuse a window that is not the one it asked for, and B2 propagated that refusal to the caller, so a download failed where S3 recovers on a single stream. It now takes the single stream too	🟢 fixed	49aaafd2f
A ninth path that assembles from parallel handles	The SFTP pipelined read, behind AEROFTP_SFTP_READ_PIPELINE, opens several handles on disjoint windows of one file, exactly the shape row 161 closed elsewhere, and had no check. It reads the object before the handles open and again before publishing, like its read-ahead sibling	🟢 fixed	49aaafd2f
A refusal is a type, not a phrase	Five call sites recognised a refusal by looking for a sentence inside the error text, so an unrelated failure that quoted that sentence would have been treated as a refusal and quietly sent to the fallback. There is a ProviderError::ParallelRefused now, emitted by 23 producers and matched by the five. The test is a server answering 403 with the marker quoted in its body: it used to fall back and succeed, and now fails without publishing	🟢 fixed	49aaafd2f
The progress bar froze on the fallback	The callback was consumed by the parallel attempt, so a refused download restarted with no progress for what can be several hundred megabytes. The callback is shared between the attempt and the fallback now	🟢 fixed	49aaafd2f
The command line did not pin its windows	pget read the object before and after but never pinned the workers to the version it saw, so the early refusal that If-Match gives was never armed there	🟢 fixed	49aaafd2f
A transient failure threw away a finished download	pget's reading after the transfer opened a new connection and gave up if that one attempt failed, unlike every other path, which retries	🟢 fixed	49aaafd2f
Needless intermediate bindings	Three let result = match ...; result where the match is the last expression	🟢 fixed	49aaafd2f

The finding worth keeping is the one nobody had named: the Backblaze window worker wrapped the error from read_range in a format! to add the offset, which turns a typed refusal into a plain message. That is how a type is lost without anyone noticing, and it is now added without discarding the variant.

Declared and not closed, in the pull request rather than in silence: the validator pin in pget has no test of its own, because there is no harness on that command's path, and the FTP and SFTP fallbacks share the progress wiring without a progress test, because that needs a live multi-connection fixture.

Verified green: the full GitHub Actions matrix on the head that was merged, 22 checks, and CodeRabbit confirming the typed refusal after raising it.

[axpnet]

Three ways a skipped link or a missing header could delete or corrupt, found by the final review

Post-4.1.9 follow-up, fixed on main, shipping in v4.2.0 (#888).

The pre-release review found three blocking defects. Two are data loss on paths this release touched but did not introduce, and one is an integrity hole in work added during this cycle. All three are the same shape as the ones the cycle spent itself closing, in places the earlier sweeps did not reach.

Area	Description	Status	Ref
A download without a validator was never re-read	The shared HTTP range path, used by WebDAV and Koofr, returned early when the object published neither an entity tag nor a modification time, and skipped the one comparison that was always available: the total from the Content-Range. The windows check their own offset and length, not the whole, so a replacement that finished before the transfer did passed unseen and the file was published at the old length with bytes from two versions	🟢 fixed	f1ef58ba8
AeroCloud deleted the remote twin of a local link	A local symbolic link is skipped by the scan without recording that the scan did not cover it, so on the next bidirectional cycle its absence read as a deletion and the remote file was removed. The same held for everything under a directory replaced by a link. The fix applies the shared scan boundary, the one sync already uses, to both sides before comparing	🟢 fixed	f1ef58ba8
The GUI compare did the same thing	compare_directories, the compare for FTP and FTPS sessions, and compare_local_directories, the one between two local folders, both walked a tree that skips links without bounding it, while the provider path had been bounded. A file or a folder replaced by a link showed as present on one side only, and a Mirror preset deleted its twin. The window shows the plan before it runs, which is a mitigation for a person watching; the scheduler and the watcher have no such step	🟢 fixed	f1ef58ba8

Both deletion defects predate this release. They are here because the review asked the right question, which was not "which commands delete" but "what compares two trees and acts on the difference": the first question returns six places, all of them already correct, and the second returns nine.

Verified green: the full GitHub Actions matrix on the head that was merged, and CodeRabbit with one comment, declined on the pull request with the reason recorded: anchoring every local write to a descriptor is a sound direction and a cross-cutting rewrite, whose failure mode is not the one being fixed here.

[axpnet]

The comparison panel divided by the rows it displays

Post-4.1.9 follow-up, fixed on main, shipping in v4.2.0. Reported against 4.1.9 while this release was being prepared, with a repro small enough to become the test: two local folders, two files in the first and one of the two in the second.

The honest reading of that pair is one difference out of two entries. The panel answered that everything was out of sync, and it answered the same on every remote backend, including the encrypted overlays. The one case that did not show it was comparing a path with itself, where there are no differences at all, and that exception is what named the cause: the comparison deliberately sends no row for an identical file, because a large tree would ship tens of thousands of rows nobody reads, and the panel derived its percentage from exactly those rows. The identical share was therefore always zero, numerator and denominator were the same number, and 100% was not a measurement but the shape of the arithmetic.

Area	Description	Status	Ref
Compare commands	compare_directories, compare_local_directories and provider_compare_directories answer with the differences plus a summary of what the scan examined, in entries and in bytes, accumulated in the same loop that emits the rows so the two reconcile by construction. No identical row crosses the wire and the filter that omits them is unchanged.	🟢 fixed	3ea371f7e
Sync engine	build_comparison_results_with_index stays as a thin wrapper returning the rows alone, so the engine that decides on rows receives exactly the input it did before.	🟢 unchanged by design	3ea371f7e
Scan boundary	The summary counts only classified paths. In all three commands the scan bound withdraws excluded, filtered, traversal-rejected and unreadable paths from both maps before classification, and an unbounded verdict still refuses with SCAN_INCOMPLETE before any report is built, so nothing unobserved can be counted as identical.	🟢 verified	3ea371f7e
File/folder mismatch	A path that is a file on one side and a folder on the other carries is_dir: true, because that flag means "either side is a directory". The panel adapter discarded the row as both-sides directory noise, and since the totals rebuild the identical share by subtraction, the mismatch returned as an identical entry: a real conflict could read as 0% out of sync. The drop now tests the two side records instead of the row flag.	🟢 fixed	3ea371f7e
Bucket counts	Each section's count came from the rows it carries rather than from what the scan counted, so the identical section would have shown zero next to a size that was not zero. Counts now come from the statistics, and a section states how many entries are counted but not listed.	🟢 fixed	3ea371f7e
Status mapping	The identical share is rebuilt by subtracting the rows that reached a bucket, which makes the status mapping load bearing: a row dropped there does not vanish, it is counted as identical. The mapping now fails to compile when a status variant is added without a bucket.	🟢 guarded	3ea371f7e

Each new property was seen failing first: the adapter repro with expected +0 to be 3, the file/folder mismatch with expected 1 to be +0 over both directory sides and both panel orientations, and the mapping guard with Type '"tombstoned"' is not assignable to type 'never'.

Declared and not covered: no test renders a component in this repository, since the frontend test runner uses the node environment with no DOM, so the rendering was read and not executed. No manual pass over the panel, and no integration test against a live remote backend.

Verified green: cargo fmt --all --check, cargo clippy --lib --bins --tests -- -D warnings, the targeted Rust suites over sync, provider_commands and the scan completeness gate (283 passed), tsc --noEmit, and the full frontend suite (107 files, 951 tests), plus the full CI on the merged head.

[axpnet]

v4.2.0 is out

Released today: v4.2.0, 165 tracked changes over 169 commits in three weeks, the longest cycle since the project started. Every row in the table above shipped.

The theme was measurement rather than features. The transfer engine went through a live review battery against rclone on the same links, payloads and servers, and every gap it found was closed and measured again: a speed limit most providers ignored, one-way sync re-uploading unchanged trees, a new SSH handshake for every SFTP file, serial scans and serial reads.

The last work of the cycle went into the download path. A file assembled from several streams could be handed back built out of two versions of the same object, with the right length and nothing to signal it. It was reproduced on a live server before it was fixed, and the check now covers every path that assembles a file out of parallel windows, named rather than counted because counting them is the part that went wrong twice.

Three independent review passes ran over the cycle. The final one returned three blockers, two of them older than this release and both able to delete a remote file after a symbolic link had been skipped by a scan. A fourth arrived on the last day from a user report, and it shipped in the same release: the comparison panel divided by the rows it displays and never displays identical files, so every comparison read as fully out of sync.

Looking back at the 165 rows, the shape that recurs is one: an answer that looked complete while part of the work had not been seen. That is why so many entries are about scans, deletes, exit codes and percentages that now state what they did not cover.

Thank you to everyone who reported, tested and reviewed during this cycle.

The next tracker is #1419. The 22 open rows of "Requested / under consideration" have been carried over to it; nothing was dropped except one row that shipped.