[Tracker] AeroFTP 4.2.3 - Known issues, patches & updates

[axpnet]

AeroFTP 4.2.3, Rolling Tracker

Umbrella issue for the next AeroFTP release (v4.2.3): known issues reported against v4.2.2 and the patches/updates landing on main after the v4.2.2 tag.

Status note: the current release line is v4.2.2 (release notes, its tracker is #1420, now closed); this tracker collects what lands on main for v4.2.3.

Before opening a new issue, please check the lists below. If your problem is already tracked here, just add a thumbs-up reaction or a comment with your environment (OS, version, provider) instead of filing a duplicate. We update this issue as bugs are found and fixed.

Found something that is not listed? Open a new issue and we will link it here.

What shipped in 4.2.2

See the v4.2.2 tracker (#998) and the release notes for the full change set, 142 tracked changes. AeroAgent reached 1.6: it uses the tools of MCP servers, local ones in a sandbox and remote ones over HTTP, with every call approved in its own window, it can hand read-only work to scoped workers, and Amazon Bedrock joined its providers. SFTP got much faster: uploads send whole write requests, downloads read each chunk in one request with Nagle's algorithm turned off, and a segmented download shares one memory budget across its connections. Selecting several files transfers them in parallel on every protocol. Around those, providers gained the actions their services offer in the context menu, folder renames work on B2 and ImageKit, AeroSync compares only when asked, the used-storage figure updates live and is computed several folders at a time, and a long sweep removed more than a hundred backend commands nothing called, among them one that handed a decrypted credential to the interface.

Patches & updates queued for 4.2.3

Done on main, shipping in the next release.

#	Type	Change	Status	Commit	Ref
1		Used-storage walks count bytes without retaining every file, reducing peak memory on large trees, and SFTP listing workers open their first connection without false transport-retry warnings.	🟢	a22a9c138	#1082
2		Benchmarks measure Koofr downloads again (payloads named .dat), and MEGAcmd no longer leaves every run in the rubbish bin. Details.	🟢	bebd95d28	#1083
3		CLI and GUI share profile column and protocol-breakdown choices, with a GUI checkbox and reload after unlock or focus; the CLI reads the correct vault key and Saved % id, while confirmed GUI saves preserve concurrent choices and the default JSON array stays compatible.	🟢	cec62721f	#1084
4		Filen Desktop S3 no longer writes a directory marker, so a benchmark run folder is a real folder instead of a zero-byte file followed by a 500. Details.	🟢	1ac52cceb	#1096
5		AppImage delta updates verified on a real release: zsync rebuilds 4.2.2 from the 4.2.1 AppImage with a matching sha256. Details.	🟢	-	#1000
6		Linux AppImage builds pin and verify all five Tauri linuxdeploy helpers, refusing corrupt or unverified cache entries; compatible non-yanked iroh-blobs lockfiles restore strict dependency auditing.	🟢	b84a8e76b	#1104
7		AeroAgent can control the visible GUI through stable selectors and bounded state, with native session-bound approvals, redacted snapshots and a visible Stop control.	🟢	a98720433	#1097
8		GUI agent selection, navigation and refresh use the same handlers as the interface, reject stale listings and return the committed canonical path.	🟢	59750981f	#1098
9		GUI agents connect saved profiles by opaque identity without reading stored credentials, and cancellation prevents late connections or encrypted-overlay actions after Stop.	🟢	bdd30e592	#1099
10		GUI agents can change supported general and AI settings through account-bound approved commits that preserve saved API keys and concurrent human drafts.	🟢	a2e0dcaac	#1107
11		GUI agents can open, inspect bounded metadata and close the AeroTools workspace or its editor, terminal and agent panels; an isolated DEV driver supports autonomous fixture testing.	🟢	49edd4b65	#1108
12		Compatible CSS tooling and P2P dependency updates keep Tailwind 3, pin the patched selector parser, and align DNS/TLS plus standalone peer security fixes without changing application features.	🟢	ae501d414	#1114
13		Appearance settings offer manual, system and scheduled day/night modes, with configurable local times and palettes, overnight schedules and translated controls.	🟢	53a9f8603	#1116
14		Lock Now confirms successful account/vault locks, interrupts GUI agent control and keeps persistent failure feedback; stale-context confirmation and dialog focus restoration are covered.	🟢	6c7e0e385	#1117
15		Connected Local/Remote panels are resizable through a draggable, keyboard-operable divider, and the split ratio is persisted across restarts; proposed by the community in discussion #1105. Details.	🟢	89d2d1ac9	#1118
16		QuickConnect saves icon/path removals, preserves tab drafts and loads imported OAuth credentials consistently; 4shared and Blomp share the profile layout, with field-copy controls and a protected optional Blomp endpoint.	🟢	d8fa5df2b	#1100, #1115
17		Filen Desktop benchmarks keep the write-back wait out of the download time and say they measure the local bridge, not Filen. Details.	🟢	ee9ee145e	#1119, #368 (@EhudKirsh)
18		Upload progress moves while the file is being sent on S3, Azure, Dropbox, Box, Google Drive, B2, Swift, Jottacloud, Internxt and OpenDrive, also for uploads sent in parts, and reaches 100 only after the server accepts the upload. Details.	🟢	fce8f68b5	#368 (@EhudKirsh), #1122
19		Files uploaded through serve sftp are stored: writes were acknowledged and thrown away on every backend (4.2.2 included), and the OpenSSH client no longer hangs at the end of a session. Details.	🟢	843e89a96	#1125
20		The community benchmark runs from the library the CLI and AeroAgent share, its JSON report is anonymized on every exit, and reconcile and sync_doctor refuse a local_dir under ~/.ssh. Details.	🟢	c3d9e702f	#1128
21		AeroAgent works with Anthropic (every request carried an API version Anthropic rejects), runs the current Claude models on the request shape they require, and shows costs as estimates with the date of their price list, withheld after 90 days, with a setting to hide them. Details.	🟢	57985d4d2	#1129
22		A folder of this machine works wherever the CLI takes a URL (serve webdav /srv/share, ls file:///srv/share), behind a path jail; sync /a ./b /sub no longer drops its third argument. Details.	🟢	fd6abcc92	#1123
23		The Filen Desktop S3 preset lets you pick the top-level Filen folder to open as its bucket, and the status bar says where the account total lives on the Filen Desktop presets. Details.	🟢	dd0c8b7cd	#1121, #958 (@EhudKirsh)
24		An AeroCrypt default-salt vault reopens from its password alone when both its marker and its keystore copy are gone, and the rebuild is refused unless names in the folder decrypt and nothing could be overwritten. Details.	🟢	51de2bdd7	#1120, #276 (@EhudKirsh), #347
25		MEGAcmd uploads show progress while sending, MEGAcmd uploads and downloads over a minute no longer fail with Timeout, and Proton uploads no longer open at the "done" state. Details.	🟢	47fd3bca6	#368 (@EhudKirsh), #1124
26		AeroAgent runs the community benchmark in the app (progress, Stop, report) and gains 18 MCP remote tools, with tests that keep every MCP tool reachable from AeroAgent or declined with a reason. Details.	🟢	610cc96f5	#1130
27		A local folder used as a remote computes md5/sha1/sha256/sha512/blake3 in place, reports df, copies inside itself with cp and resumes interrupted transfers. Details.	🟢	88b6aba22	#1126
28		An SFTP folder that cannot be read is reported as unreadable instead of missing, so rm -r --force no longer reports it deleted and ls exits 3 instead of 2. Details.	🟢	54fad9352	#1131
29		AeroAgent runs the benchmark and the speed test alone instead of beside a transfer that skewed them, and the scheduler no longer runs a plan step before the step it explicitly waits for. Details.	🟢	cbca2d7f0	#1132
30		Windows unit tests run on every Rust change (they ran only on rsync/SFTP changes, so a Windows-only test failure reached main), and the space-name test that failed on Windows is portable. Details.	🟢	3af850096	#1136
31		A Box upload sent as an upload session is reported done only once Box has created the file: a commit answered 202 Accepted is sent again after Retry-After instead of being taken as success. Details.	🟢	fbc452484	#1127
32		The AppImage starts on systems without WebKitGTK (the AppImageHub test system among them) by using its bundled libraries only there; where WebKitGTK is installed nothing changes, and Arch without WebKitGTK renders without the #90 EGL error. Details.	🟢	6e2c9472a	#1135
33		serve prints a generated login even under --quiet (it printed none, so nobody could log in), and the CLI guide matches the CLI: hashsum -a, and serve refuses a non-loopback address without --allow-remote-bind. Details.	🟢	d877f4d08	#1133
34		An SFTP path behind a folder that cannot be traversed is reported as unreadable instead of missing, so --immutable, rm --force previews and the speed test refuse it instead of acting on it, and stat/get exit 3 instead of 2. Details.	🟢	3db99c9e4	#1138
35		Editing a saved profile and opening Edit again right after Save shows the saved values instead of the previous ones, Cancel Editing closes its tab, and a profile save stays in the account it was read from when the account is switched meanwhile. Details.	🟢	43aef2a6f	#1134
36		GUI control follows the calling session instead of the display name, so two agents with the same name cannot act in each other's lease, and the Linux development driver runs from any checkout with explicit sessions. Details.	🟢	9c8311056	#1139
37		AeroAgent shows token counts only: no cost estimate from built-in prices and no cost budgets, the conversation count now includes every request, and the CLI agent's --cost-limit becomes an exact --token-limit. Details.	🟢	74cabdc93	#1140
38		aeroftp-cli -vv (or RUST_LOG=trace) no longer prints the FTP login password: the FTP library's wire trace is held at INFO in the CLI log. Details.	🟢	11bebd7c3	#1142
39		When an agent drives the GUI, a visible cursor shows each action on its target, and the badge lets the person watching change the speed, pause, resume or stop it; Settings holds the default speed and presets. Details.	🟢	eb932f95f	#1141
40		FTP and FTPS sessions send SITE commands through the open connection from a new Connection menu, aeroftp-cli site and the TUI, with the whole reply, no resend after an unknown outcome and no arguments in logs. Details.	🟢	e54ea69b9	#1143, #1109 (@jnewing)
41		aeroftp-cli profiles shows the number --profile opens even with a sort or a --group filter (a number read from a sorted table could open another server), and an interactive reorder no longer overwrites one made by another session. Details.	🟢	8dbfa4ceb	#1145
42		The protocol feature matrix lists SITE commands for FTP and FTPS, with where to find them and what they guarantee. Details.	🟢	890cf1876	#1146, #1109 (@jnewing)
43		The Permissions dialog changes a file's mode again on FTP, FTPS and SFTP (every Apply failed with "Not connected to server" since v3.1.5), and only on the connection it was opened on. Details.	🟢	3f371b938	#1144
44		Six dependency updates in one reviewed batch: tauri-build 2.7.1, libunftp 0.23.1, tokio-rustls 0.26.6, xxhash-rust 0.8.19, vitest 5.0.3 and react-virtuoso 4.18.16, with tauri kept at 2.11.0 and every Rust bump inside the requirement already in Cargo.toml.	🟢	ad777fa9f	#1095
45		Interface and design proposals start in the Design Threads discussions: maintainers implement the agreed design across every theme and language, the proposer is credited as co-author, and a UI pull request needs an explicit invitation in the thread.	🟢	6ee8cd44f	#1106
46		AeroImage crops the picture as shown after a turn or a mirror, applies the crop at once with undo and redo, and no longer fails with "Crop area exceeds image bounds"; the preview gallery pages from any entry point, goes round, and follows touchpad swipe and pinch. Details.	🟢	1c39c031f	#1147
47		An Overlays Path whose own folder name is ciphertext keeps the Crypt toggle and opens its subfolders (the name was decrypted on the way back, so the path never matched and subfolders answered Path not found or 400). Details.	🟢	0cf441566	#1148
48		MEGAcmd downloads follow mega-get's own progress from zero of the listed size, and MEGA and Proton downloads no longer open with (0, 0), which read as a transfer already done even when it then failed. Details.	🟢	4f5db82ae	#1149, #368 (@EhudKirsh)
49		The transfer speed is the speed of the last 3 seconds instead of the average since the start, so the number, the speed graph and the time remaining follow a slowdown or a recovery; a resumed download no longer opens at several GB/s, and fast archive operations show a speed. Details.	🟢	ec1b25e07	#1150
50		Transfer capabilities report atomic rename from what each provider established: SFTP from the server's posix-rename@openssh.com (after asking), Google Drive from its revision upload, WebDAV not claimed (its MOVE deletes the destination first), overlays from the provider under them; agents were told SFTP had none. Details.	🟢	5ca7599b5	#1151
51		Hash Forge Argon2id starts from the AeroVault and AeroCrypt profile (128 MiB, 4 iterations, 4 lanes, 32-byte output) instead of the smaller RFC 9106 option (64 MiB, 3 iterations); the salt stays a fresh 16-byte value, and the credential store stays at 64 MiB. Details.	🟢	8a7548ee9	#1153, #347 (@EhudKirsh)
52		Progress keeps moving on slow transfers: a delta upload updates the toast every 150 ms or 1 % and reports inside each block it sends, instead of once per percent after each 2 MiB block; AeroVault add, the AeroShare send dialog and AeroAgent's tree copy no longer wait a whole percent or 5 files. Details.	🟢	82016a99b	#658
53		B2 renames over 5 GB and large uploads renew an expired token at each step and cancel the large file a failure leaves, instead of retrying the whole copy and leaving an unfinished large file billed on the bucket; the docs now state where segmented downloads lock their temporary and what a used-storage scan measures. Details.	🟢	2d6eed6a3	#1155, docs#23
54		Snap gate G4 executes snapcraft's GPU, library and metadata linters inside core22 through the runner's existing LXD provider; a missing lint or loader failure cannot pass as green. Details.	🟢	f0a2b4862	#1152, #1070
55		The canary trial (Canary Mode on the AeroSync Plan tab) is registered in builds without aerorsync too, where a cfg left over from a removed command had dropped it, and CI now fails on any warning in the feature-off build. Details.	🟢	9e7b1348b	#1159
56		On WebDAV a replace sets the old file aside, moves the new one in and only then deletes the old one, instead of one overwriting MOVE that Apache, rclone serve and Nextcloud start by deleting; edit and remote_edit there need --allow-non-atomic, and a missing AeroCrypt marker can now be rebuilt on seven more backends. Details.	🟢	5fe5bdffc	#1154
57		The progress card's speed graph covers the whole transfer by bytes, like the Windows copy dialog, and keeps a stall as a dip; every live speed falls while no progress arrives instead of holding the last value; the percentage sits left of the title, and the lock and maximize buttons that did nothing are gone (maximize is now a queue toggle). Details.	🟢	a12cd45c4	#1161, #658
58		Windows builds compile without warnings and the Windows checks now fail on any: items used only on Linux or unix carry that cfg, and the MTP storage list passes its two out-parameters as &mut, since the WPD bindings declare them read-only. Details.	🟢	497f92a11	#1160
59		aeroftp-cli serve webdav answers 404 to a PROPFIND on a missing path instead of describing it as an empty folder, so clients of the server (including aeroftp-cli stat and crypt init --with-header) no longer see every missing file as an existing directory. Details.	🟢	37fa83707	#1158
60		CI: the Windows unit-test step runs the test binary instead of compiling aeroftp a second time (6 to 8 minutes per run, about 4 more in three other jobs), because the Tauri context is now generated by build.rs; tauri-build and tauri-codegen are held on the tauri 2.11 line. Details.	🟢	124779fe3	#1163
61		crypt init writes nothing until the Emergency Kit has been handed over: a run without --emergency-kit, with a kit path it cannot write or with a "no" at the prompt no longer leaves a marker, a keystore config or a keyfile behind, so the corrected command no longer exits 9 "re-run with --force". Details.	🟢	d602d055a	#1156
62		The AeroCrypt and rclone crypt unlock dialogs open the overlay at the folder they were opened on instead of the server root, so ad-hoc Open and Create work outside the root again, and an ad-hoc Open of a default-salt vault reopens it from its password alone, in memory, without writing to the remote; a saved profile with a header can rebuild its marker (#1120). Details.	🟢	7c6f7b3d9	#1162
63		Nine dependency updates in one batch (russh 0.64.1 with its client-side rekey and auth fixes, tokio, hyper, libc, toml, vite, jsdom, upload-artifact, winget-releaser), and the tauri 2.12 plugin releases held with the tauri 2.11.0 pin instead of reopening every week. Details.	🟢	5ac1d8c16	#1177
64		The tauri runtime layer is held on the 2.11 line under the tauri =2.11.0 pin (tauri-runtime and runtime-wry ~2.11, tauri-utils back to the 2.9.3 every release shipped), because a plain cargo update moved it to 2.12, on which tauri 2.11.0 does not compile. Details.	🟢	d4341c7c2	#1178
65		An HTTP server that accepts the connection and never answers is now reported as a timeout on every HTTP provider: the CLI exits 8 instead of 1 or 4, transfers retry it as a network error, the connect hint no longer names a --timeout flag that ls, get and stat refuse, and "Connection failed" is printed once. Details.	🟢	75ffb6ac6	#1164
66		Internal cleanup after row 62, no user-visible change: the AeroCrypt key map that #1162 left without a writer is removed with its aerocrypt_lock command and four app lock calls that could only fail, so the GUI registers one Tauri command less and a crypt Compare resolves AeroCrypt keys only through the overlay it opened. Details.	🟢	67e46c61f	#1179
67		AeroCrypt slot changes (migrate-v4, add-slot, remove-slot, rotate-slot) run again on WebDAV, MEGA, Filen, FileLu, Dropbox, Koofr, Drime and kDrive, only with explicit consent (--allow-non-atomic in the CLI, a consent box in the slots dialog); a revocation deletes every leftover copy of the old marker or fails naming it, and the remove-factor note now says what a revocation does not protect. Details.	🟢	5c98b5a42	#1180
68		Three dependency updates in one batch: zeroize 1.9.1 (the Debug of a wrapped secret no longer prints it), uuid 1.28.0 and the dev-only @vitejs/plugin-react 6.1.2, on a lock with no package added and no edge changed. Details.	🟢	b8216b2e4	#1189
69		MEGA S4 profiles on the new megas4.com domain are recognized as S4, the preset lists its 14 published regions, and saved profiles on s4.mega.io keep working unchanged. Details.	🟢	0f296eff3	#1191
70		An Internxt login refused because the account setup is not finished now says so and points to the emailed setup link, instead of a generic refusal; every other login error is unchanged. Details.	🟢	c02682520	#1184
71		Azure accounts with a hierarchical namespace now list directories as directories, instead of showing an empty folder as a zero-byte file or a full one twice; files sharing a folder's name stay separate. Details.	🟢	04ad3106e	#1188
72		B2 uploads now retry a busy or refused storage pod on a fresh upload URL, honoring Retry-After, without ever posting a small file twice. Details.	🟢	e5a4d59f8	#1181
73		Nextcloud uploads retry a refused chunk in place instead of failing the whole file, and a batch with one session and one chunk credit no longer stalls. Details.	🟢	b0836a0a3	#1182
74		On ownCloud a path that does not exist is now reported as missing, instead of appearing as an empty file or folder when the server answers with a malformed listing. Details.	🟢	25b8e6d72	#1183
75		A long segmented download no longer restarts from zero when one read stalls or a connection drops: the failed range resumes from where it stopped, on SFTP, FTP, S3 and every HTTP provider with ranged reads. Details.	🟢	1baf71689	#1190
76		Operations that check before writing (crypt init, AeroCrypt unlock, touch, no-clobber and immutable uploads, folder upload with skip) now write only when the check said the item is not there; a failed check stops instead of overwriting. Details.	🟢	654537b85	#1192
77		165 translated strings in eleven languages no longer contain letters from other alphabets, and a new CI check stops them from coming back. Details.	🟢	0947d05be	#1193
78		892 translated strings in Armenian, Khmer, Georgian and Macedonian that were not real words, meant something else or were out of date are retranslated; the privacy note no longer says data is collected. Details.	🟢	cb8297a0b	#1194
79		hashsum on a file without a usable server digest no longer downloads the whole object into the temporary folder: it hashes the bytes as they arrive, from 8 MiB windows read in order with a stalled window resumed from where it stopped (a 25.2 GB file filled a 27 GB tmpfs on the #658 re-test), and dedupe keeps a first-window timeout a timeout instead of turning it into a 500 MB size error. Details.	🟢	e04386355	#1195
80		Translations that still showed the previous English now follow the current wording in 46 languages, and CI fails if a translation matches an old English sentence. Details.	🟢	dc8ca9aec	#1196
81		A segmented download finishes when its own file, copy, or sync already holds the only free transfer slot. With several large files at the maximum parallel setting of 8 and the default 8 disk slots, or with either cap set to 1, that download asked for a second slot and waited forever. A download also counts the device of its segmented temporary when that file is on another device. Details.	🟢	42eb5bc7c	#1200
82		A whole-file transfer and a multipart transfer now take the session lease and then the governor job in one order, so one session slot and one endpoint slot cannot deadlock against each other. Multipart still takes both leases, and begins, before any chunk is scheduled. Details.	🟢	19db067ec	#1198
83		Seven production sites that staged a transfer of arbitrary size in the temporary folder (crypt overlay up/download and versioned download, compress overlay wire and download, Proton upload staging, remote vault download, rcat stdin) now stage on disk in the util::scratch folder with a space check first: on a tmpfs backed by RAM a large transfer no longer eats RAM. The Proton staging hardlink now often succeeds instead of always degrading to a full copy. Details.	🟢	738e15da4	#1199
84		Sync respects the disk cap of mounted subfolders and shares one Windows disk identity per volume; Proton uploads can hardlink a file without requiring free space for a second copy. The quinn-proto update closes three dependency security advisories.	🟢	e42857c66	#1201
85		On Windows, a client of aeroftp-cli serve on a local folder can no longer delete or create files outside that folder through ..\, a drive or a UNC prefix inside one path segment; every segment must be exactly one file name on the host. Found by the pre-release review, never in a released version.	🟢	d48094197	#1197
86		Release commit: version 4.2.3 on all eight version sites, AeroAgent 1.7, CHANGELOG and metainfo, and seven Greek sentences that used a semicolon (read as a question mark in Greek) now use the ano teleia.	🟢	bd37e1fd6	release

Requested / under consideration

Community requests and internal follow-ups being evaluated for this or a later release. Rows carried over from #1419 (renumbered) and from the 4.2.1 release follow-ups.

#		Type	Item	Status	Ref
1	🟧		Eager-evaluation preview and a single-vs-multi-target placeholder for the -i selectors (prioritised by the reporter ahead of Edit(E) and the 2-letter semantics; exact behaviour to be pinned)	🔵 idea	#311 (@EhudKirsh)
2	🟥		Lossless .jpg to .jxl transcode in AeroFile: JXL re-encodes an existing JPEG losslessly and reversibly (the original JPEG bytes reconstruct exactly), for a real size win with no quality loss. Candidate framing: AeroFile as a GUI for libjxl	🔵 idea	aerovault#2 (@EhudKirsh)
3	🟥		macOS shell integration for the OS extract feature (Deliverable G macOS, deferred): Finder Sync "Extract Here / Extract to Folder" menu items mirroring the Linux Nautilus and Windows verbs, plus macOS custom document-type icons (CFBundleDocumentTypes) for the five aero formats and the generic fallback, and rebuilding the mimetype .icns multi-size (the v4.1.0 ones are single-resolution drafts). Needs a Mac to build and live-test	🔵 planned	#1408 (Deliverable G)
4	🟥		Filen Encrypted Notes: exit Beta: take Filen Notes out of Beta. Fix the participants/add contactUUID format (currently a best-effort workaround), investigate the Filen free-plan 10-note limit ghost-note cleanup, and add a rich text editor for the rich note type	🔵 planned	-
5	🟥		PRIORITY: Linux tray/GTK heap corruption, still-uncovered off-main-thread corruptor. A GDBus worker aborts with malloc(): unaligned fastbin chunk detected, the classic GLib heap-corruption signature, and it is the victim rather than the corruptor. Two marshalling fixes shipped in v4.0.5 and the SIGABRT still recurs with an identical signature, so the marshalling is incomplete and the remaining suspects are the event and plugin callbacks whose thread context is unconfirmed. Details.	🔵 planned	-
6	🟥		Recommended-protocol highlight on the Add Service / Quick Connect pages, after real benchmarks land (#368)	🔵 idea	#274 (@EhudKirsh)
7	🟧		File association opt-out (deferred, design parked): two switches, AeroFTP's own five formats against the eight general archive formats, persisted in HKCU and re-read by the NSIS post-install hook so an in-app update cannot silently restore the association, plus a /NOASSOC setup switch. Parked rather than half built, because a visible components-page checkbox needs forking the Tauri NSIS template. Details.	🔵 planned	#454
8	🟧		S3 recursive delete pays one extra HEAD per directory, because it lists with the trailing-slash prefix, which by construction cannot see the same-named key, so a separate probe is unavoidable given that listing. Listing with the slashless prefix would skip the probe entirely in the common case, where no same-named object exists, at the cost of a filter that must keep exactly path and path/.... The trap is the one #764 just closed, moved by one character: a sibling like reportsX also matches the shorter prefix. Whoever takes this must write both doors before the change, not after: reportsX survives a delete of reports, and reports survives when it is a real non-empty file. Worth doing when someone measures a slow recursive delete on a tree with many folders, not before. 4.2.1 context: #979 changed folder-removal semantics (a folder is removed only once empty, sync --delete removes the directories it emptied on every backend) but did not touch this listing or its probe; still open.	🔵 idea	#764
10	🟧		A hard task drop on the DAG runner path is not covered by the abort guard. Cooperative cancellation is: transfer_dag_batch.rs keeps a copy of the handle and aborts on the Err arm, which is how a cancelled token arrives. But if the task is dropped outright rather than cancelled through the token, the await inside multipart_abort dies with it and nothing on the runner path resends it, so the parts wait for the bucket lifecycle rule. Predates #766, which introduced the guard on the two provider paths only.	🔵 idea	#766
11	🟧		A backend that refuses If-Match cannot be told from an object that really changed. A gateway answering 412 to every pinned range would send every download back to a single stream while the output announces four, and nothing distinguishes that from a replacement today. Raised during the review of #885 and deferred with the reason written down.	🔵 planned	#885
12	🟧		A replacement that is slow and still in progress can pass the reading that decides whether to publish. That reading retries once; if the server is still writing the new version, the second reading can see an intermediate state. Neither the unit test nor the live reproduction covers it, because both replace in one write.	🔵 planned	#885
13	🟨		Nothing tells the user on the terminal why a download restarted on a single stream. Since #887 the fallback keeps its progress bar, but the refusal itself is still only a warning in the log, so a command-line user sees the stream count drop with no reason given. 4.2.1 context: #905 and #920 made recursive, glob and sync downloads print the effective multi-thread policy and one planner decide the stream count, but the server refusal itself is still log-only; still open.	🔵 planned	#885
15	🟨		The same question has not been asked of parallel uploads. Azure, Box, Drime and Dropbox assemble parts read from the local file concurrently; whether a local file changing under them produces the mixture the download path had is an open question, not a finding.	🔵 planned	-
16	🟨		A resumed .aerotmp is not tied to the version it was started from. Resuming a partial download against an object replaced in the meantime joins two versions by a route #885 did not close.	🔵 planned	-
18	🟧		Flatpak vault migration after the GUI has initialized its sandbox vault: the current import deliberately skips a sandbox that already has any vault file, so that migration still needs its scope defined. Import into a vault-free sandbox, atomic copying of all three vault files, rollback, and JSON vault.db handling already shipped in #987, with a passing JSON-import regression test rechecked during the 4.2.3 triage.	🔵 planned	#961, #987
19	🟨		RAR5 hardlinks are resolved relative to the current working directory instead of the extraction root; pinned by review, fix deferred.	🔵 planned	#966
20	🟨		aerovault crate: zstd length handling. Deferred edge found while shipping the AeroCompress already-compressed skip.	🔵 planned	#925
21	🟨		Azure hierarchical-namespace folders: live test the directory-blob removal and HNS reporting against a real HNS account.	🔵 planned	#964
22	🟨		Swift: a listing page shorter than the marker (short page) needs a live confirmation that pagination stops correctly.	🔵 planned	#964
23	🟨		GUI Mirror live test of the kept-folder behavior shipped in 4.2.1: a Mirror that could not complete or was told to leave files alone keeps their folders, with the reason listed.	🔵 planned	#979
24	🟨		Live tests deferred from 4.2.1: FTPS 552 after the data (sent once, refusal reported), OneDrive delete behind a stale id, Box and kDrive trash purge refusing an ambiguous name, Twake upload progress across retries, Proton share password starting with a dash.	🔵 planned	#981
25	🟨		Line-ending follow-ups after the .gitattributes: drop the hand CRLF normalisations in the tray badge and checksum matrix tests once existing Windows development clones are refreshed, and move LICENSE to the LF rule only if the NSIS license page is shown to render LF text correctly on Windows.	🔵 planned	#1051
26	🟨		MCP client presets v1.1: Fetch and Git servers fetched at install time (the remote DeepWiki preset shipped in #1038): download pinned release artifacts when the user installs the preset, checked by SHA-256, gated by target OS and architecture and by the Python ABI, instead of embedding third-party archives in the app. Parked until after v4.2.2 for a design review of the supply-chain path.	🔵 planned	#1038
27	🟧		AppImage runtime with 0700 extraction folders: rechecked 2026-10-10: no dated type2-runtime release contains upstream 8f39b89e2 (only continuous does). Keep runtime 20251108 and its digest until a qualifying dated release exists; extracted runs still create folders 0755.	🔵 planned / upstream blocked	#1072, #1104
34	🟨		One speed and benchmark engine for GUI, CLI and MCP: today there are four (GUI speed test, CLI speed, speed-compare and benchmark; MCP runs the CLI). The GUI speed test covers only FTP, FTPS, SFTP, S3 and WebDAV, integrity check and score exist only in the GUI, and labels and defaults differ between them.	🔵 idea	#368
36	🟨		Live checks still owed on 4.2.2 changes: rounded window corners under the snap's X11 session, KWin, the NVIDIA driver, Flatpak and AppImage (fallback AEROFTP_SQUARE_CORNERS); Compare against a Digest WebDAV server; Stop, F4 and a disconnect during a Compare scan in the GUI; the tables whose columns moved left; ImageKit renameFolder on the real API.	🔵 planned	#1076, #1080, #1074, #1073, #1064
37	🟨		SFTP download follow-ups from the 4.2.2 investigation: allocate reply buffers on arrival (memory at no time cost, GUI too), one read-ahead budget across files downloaded in parallel, the single-connection gap to rclone on a fast path (russh WINDOW_ADJUST cadence first), and the GUI presets under the shared budget.	🔵 idea	#1066
41	🟧		Tailwind CSS 4 migration: adopt its dedicated Vite or PostCSS plugin, migrate configuration and utilities, verify the main/extract/approval windows and define supported WebView versions. Separate task requested by the owner; v4 needs Safari 16.4+, while the macOS manifest currently declares 10.13.	🔵 planned	-

Known issues found after release

Reported against v4.2.2, and carried from 4.2.1 while still open. #1075, reported against 4.2.1 the night before the release, shipped fixed in 4.2.2 by #1078.

#	Area	Description	Status	Ref
1	Crypt overlay	The Crypt toggle disappears when the Overlays Path differs from the remote path, and opening a subfolder answers 400 (reported against 4.2.1). Reproduced with an Overlays Path whose own folder name is ciphertext: the overlay decrypted that name on the way back. Fixed by #1148, queued row 47, details.	🟢 fixed	#1077 (@EhudKirsh)

Legend: 🔴 confirmed · 🟡 investigating · 🔵 planned / idea · 🟢 done / fixed (pending release) · ✅ released

[axpnet]

Used-storage scan memory and SFTP listing workers

Post-4.2.2 follow-up, fixed on main, shipping in v4.2.3 (#1082).

Used-storage scans now report totals without keeping every file from their walk. SFTP list clones connect through their captured, host-key-pinned specification before the first listing, avoiding a false transport failure per worker.

Area	Description	Status	Ref
Used storage	Release CLI on 60,800 files: peak RSS fell from 100-102 MiB to 85-87 MiB in two runs, with identical bytes and counts; normal sync scans still keep their rows.	🟢 fixed	a22a9c138
SFTP listing	Same NAS depth-limited scan, eight cold-worker reconnect warnings before and zero after.	🟢 fixed	a22a9c138
GUI	Progress advances to the exact total, the profile retains it, Cancel restores it, and a subsequent listing succeeds; bounded SFTP GUI IPC scan matches CLI.	🟢 verified	a22a9c138

Verified green: complete PR CI on Linux, macOS and Windows, CodeRabbit, Socket and Snyk. All local gate components passed: fmt, security regression, version consistency, 1,644 frontend tests, typecheck, 47-locale validation, Clippy with -D warnings, 6,280 Rust library/binary/integration tests, doc-tests (both documented examples ignored), and cargo audit --deny warnings. The 15 local MCP fixture failures caused by the NVM wrapper were recovered in a 146-test run using the real Node 24 runtime in a temporary mount namespace; no product code changes were needed. Existing ignored live tests remain ignored. The merged tree matches the verified PR tree.

[axpnet]

Benchmark payloads named .dat, MEGAcmd purge by node handle, AppImage delta update verified

Post-4.2.2 follow-up, fixed on main, shipping in v4.2.3 (#1083, reported in #368 by @EhudKirsh).

A live benchmark on 4.2.2 against Koofr, pCloud and MEGA found two silent failures. No download was ever measured on Koofr, because Koofr refuses any file named .bin and every payload was .bin. On MEGAcmd, every run was left in the rubbish bin. Both are fixed. This post also records the live check of the AppImage delta update (row 17 of the requested table).

Area	Description	Status	Ref
Payload names	Speed-test and benchmark payloads (GUI, CLI benchmark, speed, speed-compare, AeroAgent) are named .dat, from one place. Koofr answers 403 FileBlocked on the API and an empty 200 body on WebDAV for any .bin, the user's own files included; docs/PROVIDERS.md says so, with the way out (rename).	🟢 fixed	bebd95d28
WebDAV	A download cut short says how many of the announced bytes arrived and gives the cause (the download stopped after 0 of 100 bytes (...)), instead of error decoding response body.	🟢 fixed	bebd95d28
MEGAcmd purge	The node handle is read before the move to the bin, and the purge removes that node and nothing else: not a path this session did not trash, not a node restored meanwhile, not older items of the same name. An unknown handle is reported with its reason. If the bin listing or mega-rm fails, the record is kept, so a retry still purges. Folders that earlier runs left in a MEGA bin are not touched: emptying the bin once removes them.	🟢 fixed	bebd95d28
Benchmark	A refused or failed purge of the run folder or of the shared base folder is reported, without claiming where the item is.	🟢 fixed	bebd95d28
MCP	aeroftp_benchmark no longer says sizes, runs and operations apply only at level=custom; they apply at every level, as in the CLI.	🟢 fixed	bebd95d28

Live tests:

#	Scenario	Where	Result
1	benchmark --compare over Koofr API and WebDAV	live Koofr account	download measured (20.06 and 23.55 Mbps), refused on 4.2.2
2	Benchmark run on MEGAcmd	MEGAcmd 2.6.0	run purged, mega-ls //bin identical before and after (26 entries)
3	speed with an older same.dat already in the bin	MEGAcmd 2.6.0	own file purged, the older one still in the bin under the same handle
4	Koofr .bin renamed to .dat	live Koofr account	403 as .bin, byte-for-byte download as .dat
5	AppImage delta update: zsync -i the 4.2.1 AppImage with the 4.2.2 .zsync from the release	L1, zsync 0.6.2	rebuilt 4.2.2, checksum matches OK, sha256 3dfa694d...9ada5b equal to the release asset. Only 7.2% of the old file is reused (7.2 MB of 100 MB): the squashfs is compressed, so most blocks change between versions. zsync 0.6.2 has no HTTPS, so the remaining blocks came from the same asset served locally; AppImageUpdate fetches over HTTPS itself

Not yet tested live: the Filen S3 zero-byte aeroftp-bench file (row 35). The probe needs Filen Desktop's S3 server, which is off on the test station.

Verified green: complete PR CI on Linux, macOS and Windows (19 passed, 6 skipped), CodeRabbit on the final head (all four threads addressed), Socket and Snyk. Locally: cargo fmt, the 64 MEGA provider tests, including a_failed_purge_keeps_the_node_for_a_retry, which was seen failing without its fix, the WebDAV cut-short test, and the CLI purge test.

[axpnet]

Shared profile-view preferences in CLI and GUI

Post-4.2.2 follow-up, fixed on main, shipping in v4.2.3 (PR #1084, requested by @EhudKirsh in discussion #347).

Choose profile columns or protocol breakdown once and later CLI and GUI sessions remember them. Live testing also found that the CLI previously read a different vault key from the GUI, so its advertised GUI visibility and sort integration did not work.

Area	Description	Status	Ref
Shared columns	--hide / --show persist to the same encrypted settings as My Servers; GUI table layout and unrelated settings survive updates.	🟢 fixed	cec62721f
Protocol breakdown	GUI checkbox and CLI --breakdown / --breakdown=false share one preference; bare JSON keeps its existing array schema.	🟢 fixed	cec62721f
Settings reader and startup	CLI reads the canonical vault key and Saved % id; GUI reloads after unlock and on focus.	🟢 fixed	cec62721f
Confirmed saves	The two GUI hooks serialize their preference updates, discard stale load results and update fallback only after vault acknowledgement.	🟢 fixed	cec62721f

Live proof	Result	Status
GUI to fresh CLI and CLI to running GUI	Columns, saved GUI sort and protocol choice reflected in both surfaces, with layout preserved.	🟢 passed
Locked cold start after a CLI change	Correct columns and checkbox loaded after unlock without a manual focus event.	🟢 passed
Rapid GUI changes	Breakdown and Host clicked back-to-back both remain saved and are read by a fresh CLI.	🟢 passed
JSON and invalid flags	Default profile array preserved; explicit breakdown wrapper correct; invalid hide returns 5 without writing settings.	🟢 passed

Verified green: complete PR CI on Linux, macOS and Windows, CodeRabbit (all three review threads resolved with inline replies), Socket and Snyk. Local gate components verified on the combined tree: fmt, five security regression checks, version consistency, 1,654 frontend tests, typecheck, 47-locale validation, Clippy with -D warnings, 5,391 native Rust library tests, 886 binary/integration tests, doc-tests (both documented examples ignored), and cargo audit --deny warnings. The 15 MCP fixture failures from the station Node environment were checked in a 146-test group using real Node 24 in a temporary mount namespace. Namespace-dependent sandbox integration reported unavailable inside that namespace and is covered by the green PR CI. Existing ignored live tests remain ignored. The merged tree matches the locally verified combined tree. Live GUI used an isolated development vault under GLib/glibc heap hardening.

[axpnet]

Filen Desktop S3 no longer writes a directory marker

Post-4.2.2 follow-up, fixed on main, shipping in v4.2.3 (#1096, reported in #368 by @EhudKirsh).

Filen Desktop 3.x serves its S3 bucket with rclone serve s3 (rclone 1.74.3 in Filen Desktop 3.0.53), no longer with @filen/s3. That server stored AeroFTP's empty PUT <name>/ folder marker as a zero-byte file, and the next folder created inside it answered 500 (mkdir marker PUT failed with status: 500, the error in the report). The filen-desktop-s3 preset no longer writes the marker: a file uploaded under the name creates the folders.

Area	Description	Status	Ref
Filen S3 mkdir	filen-desktop-s3 skips the key/ marker. s3_dir_markers=false skips it on any S3 profile, and s3_dir_markers=true writes it even on the Filen preset. A blank provider_id no longer hides the preset.	🟢 fixed	1ac52cceb
Empty folder	Declared limit: on this preset an empty folder is not kept until a file is uploaded into it, so a listing made right after mkdir does not show it.	🟢 documented	1ac52cceb
Name already a file	mkdir says the name is a file and deletes nothing. A stale zero-byte aeroftp-bench left by 4.2.2 or earlier needs one manual delete, also from Filen Desktop's local cache (rclone-cache/s3), before a retest.	🟢 fixed	1ac52cceb
Read after upload	A GET of a file this session just uploaded waits up to 30 s for rclone's write-back (about 5 s plus the send to Filen) instead of failing with 404.	🟢 fixed	1ac52cceb

Live tests:

#	Scenario	Where	Result
1	mkdir of a new folder, then a folder inside it	Profile Filen Desktop S3 on 4.2.2, checked on the native Filen API	reproduced the report: a zero-byte FILE, then 500
2	put under a new prefix, no marker	Same	real folders on the native API
3	Quick benchmark, prefix /aeroftp-demo-368-probe	Release CLI of #1096	exit 0, upload and download completed, no zero-byte file left, probe removed
4	mkdir of an empty child, then put and get of 10 MB	Same, checked on the native API	no zero-byte file; the folder is a real directory; cmp matched

The benchmark figures through this preset are not Filen's speed. Filen Desktop answers an upload from its local cache and sends it to Filen afterwards, and it serves the download from the same cache. The download time in run 3 (5.05 Mbps) was mostly the wait for that write-back, not transfer. On a later run, 10 MB went up in 1.8 s (the cache), took 16.5 s more to reach Filen (about 5 Mbps), and came back from the cache in 14 ms. Keeping the wait out of the download time, and saying what the figures measure, is row 39 of the requested table.

Verified green: PR CI on Linux, macOS and Windows (Ubuntu smoke not acquired by a hosted runner, did not run), main CI on 1ac52cceb, CodeRabbit with no actionable comment on the final head; 7 new unit tests red then green, providers::s3 201 passed.

[axpnet]

Verified Linux AppImage helpers

Post-4.2.2 follow-up, fixed on main, shipping in v4.2.3 (#1104).

Linux AppImage builds pin and verify all five Tauri linuxdeploy helpers, refusing corrupt or unverified cache entries; compatible non-yanked iroh-blobs lockfiles restore strict dependency auditing.

Area	Description	Status	Ref
Helper integrity and compatible dependency locks	Linux AppImage builds pin and verify all five Tauri linuxdeploy helpers, refusing corrupt or unverified cache entries; compatible non-yanked iroh-blobs lockfiles restore strict dependency auditing.	🟢 done	b84a8e76b

Verified green: complete local integration gate PASS on the combined six-PR tree 2228e0bee: 205 frontend files / 1,799 tests, typecheck, all 47 locales (5,604 keys, zero placeholders), formatting, five security regression checks, version consistency, Clippy with -D warnings, and cargo test (6,316 passed, zero failed, 93 intentionally ignored across 34 targets). Strict cargo audit passed for 1,211 locked dependencies. The gate resumed only Rust tests/audit after a disk-full linker interruption; source stayed unchanged. Per-PR full cross-platform Actions are recorded in the linked PR.

Exact-head cross-platform build: Build 37620288466, source f8f503c12. New post-merge main CI is a separate run.

Legend: 🔴 confirmed · 🟡 investigating · 🔵 planned / idea · 🟢 done / fixed (pending release) · ✅ released

[axpnet]

Visible in-app GUI control

Post-4.2.2 follow-up, fixed on main, shipping in v4.2.3 (#1097).

AeroAgent can control the visible GUI through stable selectors and bounded state, with native session-bound approvals, redacted snapshots and a visible Stop control.

Area	Description	Status	Ref
Stable selectors, bounded state and native approval authority	AeroAgent can control the visible GUI through stable selectors and bounded state, with native session-bound approvals, redacted snapshots and a visible Stop control.	🟢 done	a98720433

Verified green: complete local integration gate PASS on the combined six-PR tree 2228e0bee: 205 frontend files / 1,799 tests, typecheck, all 47 locales (5,604 keys, zero placeholders), formatting, five security regression checks, version consistency, Clippy with -D warnings, and cargo test (6,316 passed, zero failed, 93 intentionally ignored across 34 targets). Strict cargo audit passed for 1,211 locked dependencies. The gate resumed only Rust tests/audit after a disk-full linker interruption; source stayed unchanged. Per-PR full cross-platform Actions are recorded in the linked PR.

Exact-head cross-platform build: Build 37622052805, source 7b086878a. New post-merge main CI is a separate run.

Legend: 🔴 confirmed · 🟡 investigating · 🔵 planned / idea · 🟢 done / fixed (pending release) · ✅ released

[axpnet]

Shared GUI navigation and selection

Post-4.2.2 follow-up, fixed on main, shipping in v4.2.3 (#1098).

GUI agent selection, navigation and refresh use the same handlers as the interface, reject stale listings and return the committed canonical path.

Area	Description	Status	Ref
Shared handlers and latest-listing guards	GUI agent selection, navigation and refresh use the same handlers as the interface, reject stale listings and return the committed canonical path.	🟢 done	59750981f

Verified green: complete local integration gate PASS on the combined six-PR tree 2228e0bee: 205 frontend files / 1,799 tests, typecheck, all 47 locales (5,604 keys, zero placeholders), formatting, five security regression checks, version consistency, Clippy with -D warnings, and cargo test (6,316 passed, zero failed, 93 intentionally ignored across 34 targets). Strict cargo audit passed for 1,211 locked dependencies. The gate resumed only Rust tests/audit after a disk-full linker interruption; source stayed unchanged. Per-PR full cross-platform Actions are recorded in the linked PR.

Exact-head cross-platform build: Build 37622044248, source 0bc8f05c3. New post-merge main CI is a separate run.

Legend: 🔴 confirmed · 🟡 investigating · 🔵 planned / idea · 🟢 done / fixed (pending release) · ✅ released

[axpnet]

Guarded saved-profile connection

Post-4.2.2 follow-up, fixed on main, shipping in v4.2.3 (#1099).

GUI agents connect saved profiles by opaque identity without reading stored credentials, and cancellation prevents late connections or encrypted-overlay actions after Stop.

Area	Description	Status	Ref
Saved-profile identity, cancellation and encrypted-overlay boundaries	GUI agents connect saved profiles by opaque identity without reading stored credentials, and cancellation prevents late connections or encrypted-overlay actions after Stop.	🟢 done	bdd30e592

Verified green: complete local integration gate PASS on the combined six-PR tree 2228e0bee: 205 frontend files / 1,799 tests, typecheck, all 47 locales (5,604 keys, zero placeholders), formatting, five security regression checks, version consistency, Clippy with -D warnings, and cargo test (6,316 passed, zero failed, 93 intentionally ignored across 34 targets). Strict cargo audit passed for 1,211 locked dependencies. The gate resumed only Rust tests/audit after a disk-full linker interruption; source stayed unchanged. Per-PR full cross-platform Actions are recorded in the linked PR.

Exact-head cross-platform build: Build 37622048338, source ddb5bddb9. New post-merge main CI is a separate run.

Legend: 🔴 confirmed · 🟡 investigating · 🔵 planned / idea · 🟢 done / fixed (pending release) · ✅ released

[axpnet]

General and AI Settings control

Post-4.2.2 follow-up, fixed on main, shipping in v4.2.3 (#1107).

GUI agents can change supported general and AI settings through account-bound approved commits that preserve saved API keys and concurrent human drafts.

Area	Description	Status	Ref
Account-bound commits, secret preservation and human drafts	GUI agents can change supported general and AI settings through account-bound approved commits that preserve saved API keys and concurrent human drafts.	🟢 done	a2e0dcaac

Verified green: complete local integration gate PASS on the combined six-PR tree 2228e0bee: 205 frontend files / 1,799 tests, typecheck, all 47 locales (5,604 keys, zero placeholders), formatting, five security regression checks, version consistency, Clippy with -D warnings, and cargo test (6,316 passed, zero failed, 93 intentionally ignored across 34 targets). Strict cargo audit passed for 1,211 locked dependencies. The gate resumed only Rust tests/audit after a disk-full linker interruption; source stayed unchanged. Per-PR full cross-platform Actions are recorded in the linked PR.

Exact-head cross-platform build: Build 37622052878, source e59036081. New post-merge main CI is a separate run.

Legend: 🔴 confirmed · 🟡 investigating · 🔵 planned / idea · 🟢 done / fixed (pending release) · ✅ released

[axpnet]

AeroTools workspace and DEV automation

Post-4.2.2 follow-up, fixed on main, shipping in v4.2.3 (#1108).

GUI agents can open, inspect bounded metadata and close the AeroTools workspace or its editor, terminal and agent panels; an isolated DEV driver supports autonomous fixture testing.

Area	Description	Status	Ref
Workspace panels, bounded metadata and isolated fixture driver	GUI agents can open, inspect bounded metadata and close the AeroTools workspace or its editor, terminal and agent panels; an isolated DEV driver supports autonomous fixture testing.	🟢 done	49edd4b65

Verified green: complete local integration gate PASS on the combined six-PR tree 2228e0bee: 205 frontend files / 1,799 tests, typecheck, all 47 locales (5,604 keys, zero placeholders), formatting, five security regression checks, version consistency, Clippy with -D warnings, and cargo test (6,316 passed, zero failed, 93 intentionally ignored across 34 targets). Strict cargo audit passed for 1,211 locked dependencies. The gate resumed only Rust tests/audit after a disk-full linker interruption; source stayed unchanged. Per-PR full cross-platform Actions are recorded in the linked PR.

Exact-head cross-platform build: Build 37622057047, source 52eea6207. New post-merge main CI is a separate run.

Legend: 🔴 confirmed · 🟡 investigating · 🔵 planned / idea · 🟢 done / fixed (pending release) · ✅ released

[axpnet]

Compatible CSS tooling and P2P security updates

Post-4.2.2 follow-up, fixed on main, shipping in v4.2.3 (#1114).

The dependency bundle keeps Tailwind 3 while updating its selector parser and source-map tooling, and aligns the standalone P2P peer with compatible DNS, TLS and dependency security fixes.

Area	Description	Status	Ref
CSS tooling	Pin postcss-selector-parser 7.1.6 and source-map-js 1.2.2; retain Tailwind 3.	🟢 fixed	ae501d414
DNS and TLS	Hickory 0.26.3 in both applicable lockfiles; standalone peer rustls 0.23.45 and webpki 0.103.15.	🟢 fixed	ae501d414
Peer dependency graph	Update compatible crossbeam-epoch, anyhow, event-listener, lru, plist/quick-xml and replace yanked chacha20, der and spin versions.	🟢 fixed	ae501d414
Remaining scope	Tailwind 4 stays Requested item 41. The existing npm braces advisory graph remains outside this compatible bundle; this does not claim a clean npm audit.	🔵 planned	#1421

Verified green: complete PR CI on 0faa1db, including Linux, Windows, macOS Intel/ARM64 packaging, rsync protocol/standalone/integration workflows, Checks and DCO. Local integration gate with current main: fmt, security regression checks, version consistency, 1,799 frontend tests, typecheck and all 46 locale validations passed in this session. The complete pre-PR local gate was confirmed green by the owner.

🔴 confirmed · 🟡 investigating · 🔵 planned / idea · 🟢 done / fixed (pending release) · ✅ released

[axpnet]

Scheduled appearance and confirmed Lock Now

Post-4.2.2 follow-up, fixed on main, shipping in v4.2.3, from the interface suggestions by @Omkar-Wagholikar (#1116, #1117).

Appearance settings now offer manual, system and scheduled day/night modes. Lock Now confirms each successful account or vault lock before showing its lock screen, and keeps persistent feedback for unavailable or failed operations.

Area	Description	Status	Ref
Scheduled appearance	Configurable local start/end times and day/night palettes, overnight schedules, secondary-window resolution, keystore backup/restore and explicit-theme override.	🟢 done	53a9f8603
Lock Now	Ctrl/Cmd + Alt/Option + Shift + K, controller interruption through its production API, ordered account/vault confirmation and persistent feedback inside lock screens.	🟢 done	6c7e0e385
Review fixes	Confirmed layers remain visible after stale context changes; error dialogs restore connected prior focus. CodeRabbit explicitly verified both corrections and resolved the threads.	🟢 fixed	768e83f26
Translations	All new appearance and locking strings translated into all 47 locales, with no missing keys or placeholders.	🟢 done	#1116, #1117

Verified green: full exact-head PR CI on Linux, Windows and macOS Intel/ARM; one complete local integration gate on 06533253 with fmt, Clippy -D warnings, 1,846 frontend tests, 6,316 Rust tests (zero failed, 93 expected ignored), typecheck, security regression/version checks, all 47 locale files and cargo audit --deny warnings. The combined frontend production build also verified seven bundles contain no development harness. Native GUI checks: Linux WebKit main-window day/night/manual transitions, persistent unavailable feedback and focus restoration, real vault locking and native broker gui_state passed using an isolated fixture and the gate binary with software rendering. Backend-failure injection was unavailable because Tauri IPC is immutable; failures/stale/partial successes have focused regression coverage. Protected-account, secondary-window and other-platform live GUI paths were not claimed validated.

🔴 confirmed · 🟡 investigating · 🔵 planned / idea · 🟢 done / fixed (pending release) · ✅ released

[axpnet]

Connected Local/Remote divider: the two panels are now resizable, and the split survives restarts.

Proposed by community member @Omkar-Wagholikar and designed together in discussion #1105 (the earlier PRs #1101-#1103 were closed to agree on the design first; this is the maintainer-led implementation of the accepted design, with Omkar credited as co-author on the commits).

What you get in connected mode:

• A vertical separator between the Local and Remote panels: drag it with the mouse, or focus it and use Arrow Left/Right (5% steps), Home/End for the extremes, Enter/Space or double-click to reset to 50/50.
• The chosen ratio is an app-wide preference, kept across restarts, independent from the AeroFile dual-local split (which keeps its own saved ratio, unchanged).
• The panels keep a usable minimum width: shrinking the window or opening the sidebar temporarily clamps the split, and widening restores your saved ratio instead of forgetting it. Very narrow windows fall back to an even 50/50 rather than breaking the layout.
• Swapped panels (Remote on the right) keep the divider between the panels and the ratio consistent.
• Accessibility: the separator reports real percentages to screen readers (the dual-local one previously reported an internal value that did not match the actual range).

Shipped in PR #1118, merge commit 89d2d1ac9. Full CI green across Linux, Windows and macOS builds; reviewed with one finding fixed before merge. Also landed from the same discussion: scheduled day/night appearance (#1116) and Lock Now (#1117).

[axpnet]

QuickConnect profile edits and imported OAuth credentials

Post-4.2.2 follow-up, fixed on main, shipping in v4.2.3 (PR #1115, issue #1100, reported by @EhudKirsh).

Removing a custom icon now enables Save, and clearing an icon or Remote Path remains saved after reopening or reconnecting. While testing this fix, I also found related form and credential-loading issues addressed in the same PR. The issue remains open pending the reporter's confirmation.

Area	Description	Status	Ref
Saved edits	Explicit icon and path removals survive save, reconnect and mode conversion.	🟢 fixed	d8fa5df2b
Tab drafts	Switching QuickConnect tabs preserves unfinished add/edit forms, including names, paths, icons and Crypt settings.	🟢 fixed	d8fa5df2b
Copy controls	Populated edit fields offer Copy on hover/focus; masked secrets can be copied after revealing them.	🟢 fixed	d8fa5df2b
4shared	Shared two-column layout, actual saved profile name, metadata saves without reauthentication, and existing token status retained after a credential-read failure.	🟢 fixed	d8fa5df2b
Blomp	Shared two-column layout and a collapsed, labeled authentication endpoint protected by Edit and confirmation.	🟢 fixed	d8fa5df2b
OAuth credentials	Forms, settings, saved connections, session switching and transfer resume resolve modern/legacy vault records, retry temporary failures and preserve manual edits. Google Photos shares Google Drive app keys.	🟢 fixed	d8fa5df2b
Keystore verification	Encrypted 4shared export/import round trips preserve app keys and OAuth 1.0 tokens. The inspected backup audit found no OAuth/S3 export/import data loss.	🟢 verified	d8fa5df2b

Verified green: complete cross-platform PR CI on bcdcd258d, including Rust validation and Linux, Windows and both macOS architectures. Locally, all 2,098 unit tests, TypeScript, i18n, formatting and security regression checks passed. The full local gate stopped at missing native GTK/Cairo development dependencies; CI completed those checks. I tested the original QuickConnect fixes in the Linux dev GUI. Windows GUI and a live Google Photos login remain to be verified separately.

[axpnet]

Filen Desktop benchmarks: write-back wait apart, local bridge note

Post-4.2.2 follow-up, fixed on main, shipping in v4.2.3 (#368, reported by @EhudKirsh).

Filen Desktop 3.x serves S3 and WebDAV with rclone serve and a local cache. An upload returns from the cache, the bridge sends it on to Filen afterwards, and a download comes back from the cache. The benchmark used to count the S3 write-back wait as download time (10 MB "at 5 Mbps" was about 15 s of waiting). The wait is now taken before the download clock starts and printed apart, and on both Filen Desktop presets the CLI benchmark and speed test say once per run that the figures measure the local bridge, not the Filen servers.

Area	Description	Status	Ref
Write-back wait	StorageProvider::wait_until_readable: on a markerless S3 preset, HEAD the key this session just uploaded until it answers. CLI benchmark (single and many files), CLI speed and GUI speed test call it before the download clock; the CLI prints the wait apart.	🟢 fixed	ee9ee145e
Bridge note	StorageProvider::measurement_note on filen-desktop-s3 and filen-desktop-webdav. Printed under the benchmark summary and in the speed result; additive notes field in both JSON outputs (also benchmark compare), absent when empty.	🟢 fixed	ee9ee145e
Overlays	Crypt and compress overlays forward both methods, so a crypt profile over the Filen preset keeps the wait and the note.	🟢 fixed	ee9ee145e

#	Scenario	Where	Result
1	benchmark quick	"Filen S3" preset, Filen Desktop 3.0.53 on 127.0.0.1:1800, release CLI built from the PR branch (1d3ad09e0)	Exit 0. Upload 10.0 MB p50 862.8 ms (97.22 Mbps), download 58.1 ms (1443.30 Mbps). "waited 16.4 s ... (not counted as download time)" printed apart. Note printed once under the summary.
2	speed -s 4M (text, then --json)	Same	Waited 9.8 s apart, integrity verified, cleanup removed, note printed. JSON carries notes with the same text.
3	speed -s 4M	"Filen local Dav" preset (filen-desktop-webdav)	Integrity verified, note printed, no write-back wait (expected on that bridge).
4	--json speed -s 1M (control)	Koofr WebDAV	Status ok, no notes field.

Row 1 also warned "scratch folder 'aeroftp-bench' left in place": correct, that folder holds three files from older manual tests the benchmark did not create.

Unit tests: wait_until_readable_waits_out_the_write_back_before_the_download and measurement_note_names_the_filen_desktop_bridge_only (S3 and WebDAV), red with the default trait implementation; only_the_filen_desktop_preset_is_the_filen_bridge; benchmark_report_serializes_to_schema_v1 checks an ordinary run has no notes. cargo test --lib (providers::s3, webdav note, providers::types): 246 passed. cargo test --bin aeroftp-cli benchmark speed: 40 passed. Verified green: cargo clippy --all-targets --features test-seed -D warnings, full PR CI on Linux, Windows and macOS. Two reds on the way: four integration tests that build S3Config by hand missed the new field (E0063, fixed in the PR), and an artifact-upload DNS failure on the macOS aarch64 runner that passed on rerun, CodeRabbit on the final head with no actionable comments. Tier 1: cargo fmt --all, typecheck, i18n validate (5618 keys, 0 placeholders), diacritics, untranslated, provider inventory, vitest 209 files / 1846 tests.

[axpnet]

Azure lists HNS directories as directories

Post-4.2.2 follow-up, fixed on main, shipping in v4.2.3 (#1188).

On an Azure account with a hierarchical namespace (HNS), an empty directory was listed as a zero-byte file, and a non-empty one could appear twice: once as a directory and once as a file with the same name.

Area	Description	Status	Ref
Listing	The list request now asks for blob metadata. A blob is a directory only when Azure marks its resource type as directory, or, when that is absent, when its hdi_isfolder flag is true. Directory duplicates collapse across pages, and the parent object HNS returns under a child prefix is dropped.	🟢 fixed	04ad3106e
Unchanged	A real file sharing its name with a directory stays a separate entry, a zero-byte file is never promoted to a directory, the API version stays 2024-11-04, and listing still does not send a request per blob.	🟢 fixed	04ad3106e
Robustness	A user metadata key named Metadata no longer ends the metadata block early, and directory collapse uses an index instead of rescanning the whole listing, which keeps very large listings linear.	🟢 fixed	04ad3106e

Verified green: a parser test red before the change, 54 Azure provider tests on the head (including regressions for the metadata key and for collapse across pages, and a list/stat agreement test on the same fixtures), a live round trip on a flat Azure account (empty and nested directories, a zero-byte file, a 1,280-byte payload with matching SHA-256, exact cleanup), and GitHub Actions on the head 5e87a3470. Reviewed on the head. A live HNS account was not available, so HNS behavior is covered by recorded fixtures.

[axpnet]

B2 uploads retry a busy or refused pod on a fresh upload URL

Post-4.2.2 follow-up, fixed on main, shipping in v4.2.3 (#1181).

A B2 upload stopped on a transient refusal from the storage pod (HTTP 408, or a 429/5xx with a Retry-After), although B2's own guidance is to take a fresh upload URL and try again.

Area	Description	Status	Ref
Retry	Small uploads and multipart parts retry HTTP 408/429/500/502/503/504 with a fresh upload URL and token, the same bytes and a finite budget, honoring Retry-After (seconds or an HTTP date, capped at 300 s). A part keeps its file ID and number; an acknowledged part is never resent.	🟢 fixed	e5a4d59f8
Safety	A small file whose response was lost is never posted again, because B2 may already have stored a new version. A pod that refused the connection received nothing, so that upload moves to a fresh pod. B2 owns its retry budget, so the batch executor no longer multiplies whole-file attempts, including through encryption or compression overlays.	🟢 fixed	e5a4d59f8
Retry-After	A Retry-After date already reached reads as no explicit wait, so the configured backoff applies instead of an immediate retry.	🟢 fixed	e5a4d59f8

Verified green: deterministic fault fixtures for every retried status, exact bytes, SHA-1 and length, fresh pod and token, part identity, Retry-After timing, the finite budget, permanent refusals, cancellation during the wait, disconnect, refused connection and ambiguous success, each fix failing before it; real native B2 runs (CLI legacy and DAG at 300,000 B and 210 MiB, GUI at 300,000 B and 210 MiB) with matching SHA-256 and exactly one stored version; and GitHub Actions on the head 430c7129b. Reviewed by CodeRabbit on the head. The live runs did not observe a real 408 or 503.

[axpnet]

Nextcloud retries a refused chunk in place, and a two-file batch no longer deadlocks

Post-4.2.2 follow-up, fixed on main, shipping in v4.2.3 (#1182).

A Nextcloud chunked upload failed the whole file when a single chunk met a transient refusal, and a batch running with one session and one chunk credit could stall.

Area	Description	Status	Ref
Chunk retry	The same chunk is retried in place on HTTP 408/429/500/502/503/504 and recoverable send failures, within a bounded budget that honors Retry-After, cancellation, and one Digest nonce repair. Chunks already accepted keep their receipts; local read failures and permanent refusals are not retried.	🟢 fixed	b0836a0a3
Batch	File-lifetime leases and the multipart start are acquired before chunk scheduling, so a batch with one session and one chunk credit no longer waits on itself. The configured budgets and the commit/abort release are unchanged.	🟢 fixed	b0836a0a3
Engine fault	A batch file whose subgraph stops on an engine fault (a panicked task) no longer leaves an open multipart upload on the server or a stuck "active" count: the upload is aborted, its leases are released and the file is counted failed once.	🟢 fixed	b0836a0a3

Verified green: deterministic wire fixtures for every fault status and cancellation, the batch deadlock reproduced before its fix, the two engine-fault tests failing before theirs, live Nextcloud 33.0.3 runs (270 MiB single file, 270 MiB plus a 300,000 B UTF-8 file in one batch, GUI upload and download) with matching SHA-256, and GitHub Actions on the head 2127dc953. Reviewed by CodeRabbit on the head.

[axpnet]

ownCloud missing paths are reported as missing, not as empty files

Post-4.2.2 follow-up, fixed on main, shipping in v4.2.3 (#1183).

ownCloud 10.16 can answer a request for a path that does not exist with HTTP 207 and a malformed body: an unfinished listing followed by a "not found" error document. AeroFTP read that answer as a zero-byte file or an empty folder.

Area	Description	Status	Ref
Detection	The whole WebDAV response is validated before its metadata is used. This ownCloud shape is read as "not found" only when the error document is a WebDAV error with the exact Sabre NotFound exception in the right namespace. Covers listing, recursive listing, file info, folder navigation, checksums and quota.	🟢 fixed	25b8e6d72
Unchanged	Any other malformed response stays a parse error. File names, properties, CDATA and unknown entities cannot trigger the "not found" reading.	🟢 fixed	25b8e6d72

Verified green: the 207 fixture returned a zero-byte entry for a missing path before the fix, 103 WebDAV tests including wire-level file info, listing, navigation and recursive cases plus negative cases, CLI exit codes 2 for a missing path and 10 for an unrelated truncated response, real WebDAV and Nextcloud 33.0.3 round trips as regression coverage, and GitHub Actions on the head e47b5ceec. Reviewed by CodeRabbit on the head. No ownCloud 10.16 server was available, so the defect is reproduced with a recorded response.

[axpnet]

A segmented download resumes a failed range from where it stopped

Post-4.2.2 follow-up, fixed on main, shipping in v4.2.3 (#1190).

A 25.2 GB SFTP download from a NAS failed twice, after 26 and 16 minutes, and restarted from zero each time: one read got no answer within the request timeout, and that single range failed the whole download. The server was alive and answered late.

Area	Description	Status	Ref
Engine	Each range keeps a mark, the first byte not known to be written. A timeout or a dropped connection runs the range again from its mark on a fresh connection, with a short backoff; three failures in a row without progress fail it, progress resets the count, and a hard error is not retried. Writes are settled before a retry, so no hole is left.	🟢 fixed	1baf71689
Protocols	Native SFTP, FTP, S3 and every HTTP ranged read (B2, Koofr, Cloudinary, ImageKit, Uploadcare, WebDAV, Azure and the HTTP range helper) report a timeout or a dropped connection as resumable, including a body cut halfway.	🟢 fixed	1baf71689
Workers	The GUI executor, CLI pget and B2 keep the error's class and put a working connection back in the pool; a provider that cannot clone is reconnected before the retry.	🟢 fixed	1baf71689

Verified green: engine tests red without the retry, a real 11 s read with no answer against the SFTP test server, a local server that drops or cuts a window for B2, Koofr, WebDAV, S3 and Azure (red on all five before), a source scan that checks every ranged read keeps a dropped connection resumable, reconnect tests for workers that cannot clone, 1862 provider and executor tests on the head, and GitHub Actions on the head b140afad6. Reviewed on the head.

[axpnet]

A write that checks first now writes only when the check said "not there"

Post-4.2.2 follow-up, fixed on main, shipping in v4.2.3 (#1192).

Several operations ask "is something already there?" before writing, and read any failed answer as "no". A timeout, a dropped connection, a permission error or a server error became "missing", and the write went ahead over what the check was meant to protect.

Area	Description	Status	Ref
Encryption	crypt init (app and CLI) could upload a new configuration with a new salt over an existing one when its probe failed, orphaning every file encrypted under it; AeroCrypt unlock could publish the local keystore over a remote marker that was still there. Both now stop and say the target could not be verified.	🟢 fixed	654537b85
Overwrite guards	touch (CLI, TUI, MCP and AeroAgent), MCP upload_file with no_clobber, --immutable on crypt put and rclone-crypt put, sync --no-traverse --immutable, and a GUI folder upload with a skip action no longer write over an existing item when the check fails.	🟢 fixed	654537b85
Absence	A missing path reads as "not found" where it can be proven: FTP under a missing folder and for a dotfile, MEGAcmd under a missing parent, SFTP servers that answer a generic failure. A refused listing of a folder that exists still says nothing.	🟢 fixed	654537b85

One rule now applies everywhere: a write follows an existence check only when the check answered "not found"; any other error stops the operation. Provider probes that report an error as "not found", one layer below, are audited with file and line and get their own change.

Verified green: the site and probe tests listed in the pull request, a mutant check on the FTP dotfile probe, 148 FTP and AeroCrypt tests, clippy on all targets, GitHub Actions on the head 03a719a9d, and, after the merge of #1190 touched the same files, 2,243 library tests, 54 CLI tests and clippy on the exact tree that landed on main. Reviewed on the head.

[axpnet]

Translations no longer mix letters from other alphabets, and CI checks for it

Post-4.2.2 follow-up, fixed on main, shipping in v4.2.3 (#1193).

Translations in eleven languages contained letters from other writing systems. Some were visibly broken; others looked right and broke a text search for the real word.

Area	Description	Status	Ref
Translations	165 strings corrected in Armenian, Khmer, Georgian, Thai, Bulgarian, Macedonian, Serbian, Ukrainian, Croatian, Basque and Estonian: Georgian and Japanese letters inside Khmer, Hebrew, Arabic, Telugu and Chinese characters inside Armenian, a Latin i inside Ukrainian words, a Latin è in the Macedonian сè, Cyrillic letters inside Croatian words, a zero-width space inside an Estonian word, and Armenian and Khmer help texts that made no sense.	🟢 fixed	0947d05be
CI gate	npm run i18n:contamination runs with the other translation checks. Each of the 47 languages declares its alphabets, and the check fails on a letter from another one, a word mixing Latin with native letters, a lone Latin letter between native words, or an invisible or broken character. Shared marks (the Bengali full stop, emoji sequences, the Ukrainian apostrophe) are accepted.	🟢 fixed	0947d05be

Verified green: on the translations before the fix the check reports 142 contaminated strings in 11 languages, and the Checks workflow failed at that step on a demo branch; after it, 0. The check's own tests cover every rule, including review findings that failed before their fix. GitHub Actions on the head ffc0387ad. Reviewed on the head. Not caught by any character check: a text transliterated wholly into Latin, or wrong wording in the right alphabet; native-script wording still needs a reader of the language.

[axpnet]

892 broken strings corrected in Armenian, Khmer, Georgian and Macedonian

Post-4.2.2 follow-up, fixed on main, shipping in v4.2.3 (#1194).

Follow-up to #1193. Some translations were written entirely in the right alphabet but were not the language: invented words, misspellings, wrong meanings, text left behind after the English changed. No character check can see them, so each string was read against the English by a fluent reader.

Locale	Corrected	Description	Status	Ref
Armenian	553	Every string that differs from English and that #1193 did not fix was read; examples include the words for Name, Settings and Active Sessions.	🟢 fixed	cb8297a0b
Khmer	226	The connection, protocol, Cryptomator, settings and common families in full, plus the 500 most anomalous other strings.	🟢 fixed	cb8297a0b
Georgian	103	Audit candidates, a word check against Georgian dictionaries, and the three batches the errors came from; a double negative said a provider was "not unavailable".	🟢 fixed	cb8297a0b
Macedonian	10	The speed test batch, where middle dots stood in for "...", "." and ":".	🟢 fixed	cb8297a0b

In Georgian and Khmer the privacy note still said AeroFTP collects minimal data; it now says, as the English does, that no data is collected. The translation check also fails on a middle dot used as punctuation. Not covered yet: 3,842 Khmer strings outside the families read, and the other languages' text left behind when 35 English strings changed meaning.

Verified green: all four translation checks pass, the middle-dot rule finds exactly the 26 cases it fixes on the previous translations and none after, and GitHub Actions on the head 6cc7fd158. Reviewed by CodeRabbit on the head.

[axpnet]

hashsum hashes a remote file as its bytes arrive, with no copy in the temporary folder

Post-4.2.2 follow-up, fixed on main, shipping in v4.2.3 (#1195, from the #658 re-test).

hashsum on a file without a usable server digest downloaded the whole object into the temporary folder and hashed it afterwards. On the #658 re-test machine the temporary folder is a 27 GB tmpfs sized from RAM, and a 25.2 GB file over SFTP filled it after 21 minutes: no hash, and up to that point the file sat in RAM. Any file larger than the free space of the temporary folder could not be hashed.

Area	Description	Status	Ref
Hash as the bytes arrive	A backend that reads parts of a file is hashed from 8 MiB windows read in order with nothing on disk: memory is one window per worker whatever the size. A window whose read stalls or loses its connection is read again from where it stopped on a fresh connection, up to 3 failures in a row with no progress.	🟢 fixed	e04386355
Object pinned while hashing	hashsum opens up to 4 connections of its own, each pinned to the version the first reading saw, and reads the object once more at the end: an object replaced in the middle would otherwise hash as a mix of two versions.	🟢 fixed	e04386355
Every other backend	The file still downloads first, now into the AeroFTP cache folder with the free space checked before the transfer starts (file size plus 256 MiB), never the temporary folder.	🟢 fixed	e04386355
dedupe	A timeout on the first window stays a timeout instead of falling back to a 500 MiB-capped in-memory download, which turned a stall on a large file into a size error.	🟢 fixed	e04386355

Live on the SFTP fixture, a 3 GiB file, hashsum -a sha256 --download, temporary folder sampled every 0.2 s:

Run	Result	Time	Peak temporary folder
main	rc 0, right hash	64.4 s	3,221,225,472 bytes (the whole file)
this change	rc 0, right hash	61.1 s	0
this change, server paused 15 s	rc 0, right hash, 4 windows resumed from where they stopped	74.7 s	0

Verified green: cargo fmt, clippy --lib --bins --tests -D warnings, 111 lib tests (multi_thread, provider_transfer_executor, util::scratch), 15 bin tests (hashsum, dedupe), check --lib --no-default-features; the 5 new tests red before by mutation; CI on Linux, Windows and macOS, CodeRabbit clean.

[axpnet]

Stale translations refreshed, and a gate for former English

Post-4.2.2 follow-up, fixed on main, shipping in v4.2.3 (#1196).

Some translations still said what the English used to say after the English changed meaning. The untranslated check compares with the current English, and it skips a string that has no English function word, so both cases stayed green. 2103 strings in 46 languages were retranslated from the current English: 35 keys whose meaning changed, the password length message that still said "Minimum 8 characters", and 19 short prose keys that were still the English sentence.

Area	Description	Status	Ref
Stale wording	Provider lines, settings and the privacy note now match the current English. In Welsh, Basque, Galician, Icelandic and Macedonian the privacy note no longer says data is collected.	🟢 fixed	dc8ca9aec
Short password message	Locales that still said "Minimum 8 characters" now say the password must be at least 8 characters. Italian already had its own short wording and was left as it was.	🟢 fixed	dc8ca9aec
Prose left in English	Activity lines, the MEGA S4 tooltip, the batch health check and the GitHub token label are translated. Brand names, acronyms and placeholders stay in English.	🟢 fixed	dc8ca9aec
Former-English gate	npm run i18n:stale-english fails when a translation equals an older English value of the same key. The ledger is committed because the checks job checks out at fetch-depth 1. Italian protocol.endpointPlaceholder stays es. s3.example.com (Italian for e.g.) and is the one recorded acceptance.	🟢 fixed	dc8ca9aec

Squashed onto e04386355 (#1195). The two changes do not share a file, and a test merge of the PR head onto that main kept the gate and the locale edits.

Not in this change: the remaining Khmer reading (about 3842 strings), and the short "Legacy AeroCrypt marker" label outside Danish. CodeRabbit's one note, marked as not blocking, is the Greek rsync hint: its semicolons are the Greek question mark, so the three clauses can read as questions.

Verified green: on ac74836df, i18n:validate, i18n:contamination, i18n:diacritics, i18n:untranslated, i18n:stale-english and both self-tests exited 0. GitHub Actions on that head was green for linux-validate, Format/audit, sign-off, Linux, Windows and both macOS builds. Socket and Snyk reported no issues. CodeRabbit reviewed that head (low merge risk).

[axpnet]

A segmented download finishes when its own file already holds the only free slot

Post-4.2.2 follow-up, fixed on main, shipping in v4.2.3 (#1200).

A file, a copy, or a sync already held one endpoint slot and one disk slot. The segmented download inside it asked for a second pair and waited forever once those holders filled the cap. That happened with several large files at the maximum parallel setting of 8 and the default 8 disk slots, and when either cap was set to 1. The holding task now reenters the same job. Spawned nodes and sync workers join it. A scope publishes the job for a block_on root that has no Tokio task id, which covers the CLI. A segmented download with no outer job still takes one slot, so a WebDAV legacy download keeps a single lease. A download also counts the device of its .aerosegtmp temporary when that file sits on another device than the final path.

Area	Description	Status	Ref
Same task	A second acquire_job on the task that already holds the job shares the permits	🟢 fixed	42eb5bc7c
Spawned node	A single-file node, a copy node, and a sync worker join the caller's job	🟢 fixed	42eb5bc7c
block_on	GovernorJobLease::scope publishes the job when the caller has no task id	🟢 fixed	42eb5bc7c
Temporary device	A download job requests the final path and the .aerosegtmp sibling, so a cross-device symlink counts both devices	🟢 fixed	42eb5bc7c

Verified green: cargo fmt --manifest-path src-tauri/Cargo.toml -- --check. cargo test --manifest-path src-tauri/Cargo.toml --lib transfer_dag::governor::tests:: on 04118aaea (the head squash-merged as 42eb5bc7c): 19 passed, 0 failed, 0 ignored, finished in 0.10s, no compiler warnings. Named proofs: nested_acquire_on_the_holding_task_does_not_take_a_second_slot, a_scoped_job_reenters_and_a_spawned_worker_joins_it, job_leases_hold_one_shared_endpoint_and_device_cap, download_job_disk_requests_names_the_segmented_sibling, two_device_write_requests_hold_both_disk_caps (/tmp and /dev/shm on this machine are different devices; both write caps went to 0 while held and back to 1 after drop). CI on #1200 was green for Linux, Windows, macOS aarch64 and macOS x64, plus DCO, Socket, Snyk and CodeRabbit. No GUI.

[axpnet]

Whole-file and multipart take the session lease, then the governor job

Post-4.2.2 follow-up, fixed on main, shipping in v4.2.3 (#1198).

A whole-file node took the session lease and then the governor job. A multipart file took the governor job and then the session. With one slot on each gate, each file could hold the lease the other was waiting for. Both paths now use acquire_session_then_job: session first, governor second.

Area	Description	Status	Ref
Order	Whole-file and multipart take the session lease, then the governor job, through one function	🟢 fixed	19db067ec
Chunks	Multipart still holds both leases, and has begun, before any chunk node is scheduled (#1182)	🟢 fixed	19db067ec

Verified green on the head squash-merged as 19db067ec: cargo fmt --manifest-path src-tauri/Cargo.toml -- --check on transfer_dag_batch.rs and session_pool.rs. cargo test --manifest-path src-tauri/Cargo.toml --lib transfer_dag_batch: 54 passed, including whole_file_and_multipart_finish_on_one_session_and_one_governor_slot. That test admits neither file until both are inside the session acquire, checks that a one-slot governor is still free, then both finish. No timeout. No GUI.

[axpnet]

Transfers of any size stage on disk, never in the temporary folder

Post-4.2.2 follow-up, fixed on main, shipping in v4.2.3 (#1199, from the #658 re-test findings).

Seven production sites passed a transfer of arbitrary size through a file in the temporary folder, which on many Linux systems is a tmpfs sized from RAM: a large transfer through one of them ate RAM and could fail, the same class as the 25.2 GB hashsum download of the #658 re-test. Every site now stages in the on-disk scratch folder of util::scratch, with the free space checked before the transfer starts (file size plus 256 MiB headroom, a best-effort remote size() for downloads, 0 where the size is unknown). Sites before: 7. Sites after: 0.

Area	Description	Status	Ref
crypt overlay	Upload staging, download and download_version stage on disk; download_version checks room against the requested version's size when the backend lists versions	🟢 fixed	738e15da4
compress overlay	Both upload temporaries and the download wire stage on disk, the space check sized for the path the name selects (twice the source when zstd runs, the source alone when skipped)	🟢 fixed	738e15da4
Proton upload staging	Stages on disk: the hardlink now often succeeds, while toward a tmpfs it always failed and became a full copy	🟢 fixed	738e15da4
remote vault download	Stages on disk; the managed-path confinement shared by upload-back and cleanup accepts both roots, resolved with no room check	🟢 fixed	738e15da4
CLI rcat	stdin of unknown size buffers to the scratch folder	🟢 fixed	738e15da4

Out of scope on purpose: the crypt overlay still reads the whole ciphertext into RAM to decrypt it (streaming decryption is a design change of its own), and the capped or small staging paths (download_to_bytes of Proton/Internxt, edit, serve webdav PUT, similarity dedupe, AeroCrypt markers, sync EC sidecars, speed tests) stay on the temporary folder.

Verified green: cargo fmt, clippy --lib --bins --tests -D warnings, 151 lib tests (crypt_overlay, compress_overlay, proton, vault_remote, util::scratch), 16 bin tests (rcat, hashsum, dedupe), check --lib --no-default-features; one test per site, each verified red with its site mutated back to the temporary folder; 5 CodeRabbit findings addressed and re-reviewed clean; CI on Linux, Windows and macOS.

[axpnet]

Sync counts every disk, and Proton checks copy space only when copying

Post-4.2.2 follow-up, fixed on main, shipping in v4.2.3 (#1201).

A sync held the disk slot for its root but could transfer through a mounted subfolder on another disk without taking that disk's slot. It now acquires all planned upload, download and segmented-temporary devices before starting the parent job. Proton upload staging attempted its hardlink only after requiring room for a full copy, rejecting an upload that needed no second payload. The hardlink now runs first; only the copy fallback checks free space and cleans up failed staging.

Area	Description	Status	Ref
Sync disk caps	Every planned file device and segmented sibling participates in the parent job, with requests coalesced by device and direction in the existing acquisition order	🟢 fixed	e42857c66
Windows volumes	Files on one volume share its GUID identity, keeping the disk cap shared and the registry bounded instead of growing per file	🟢 fixed	e42857c66
Proton staging	A real hardlink succeeds without room for a second payload; cross-device copy checks space before writing and removes failed staging	🟢 fixed	e42857c66
Dependency audit	quinn-proto 0.11.18 closes RUSTSEC-2026-0338, RUSTSEC-2026-0340 and RUSTSEC-2026-0343 without advisory suppressions	🟢 fixed	e42857c66

Verified green on 0f4d43482, squash-merged as e42857c66 with an identical tree: complete GitHub Actions on Linux, Windows and both macOS architectures, including native Windows unit tests; CodeRabbit review; full local npm run ci:pre-push (exit 0), including fmt, security regressions, version consistency, 2,270 frontend tests, typecheck, all 46 non-English locales, clippy with -D warnings, 5,769 library tests, 814 CLI unit tests, integration tests and cargo audit --deny warnings. Local MCP fixtures run with an actual Node executable in a temporary overlay while other Rust tests run natively so ACL UID tests retain the host user mapping; all test partitions execute, with no tests omitted. Mutation checks fail when the root-only sync requests or pre-hardlink space gate are restored.

Legend: 🔴 confirmed · 🟡 investigating · 🔵 planned / idea · 🟢 done / fixed (pending release) · ✅ released

[axpnet]

v4.2.3 is out: release notes, 86 tracked changes and 122 commits. The thread running through it is data you could lose when something goes wrong half way: operations that check before writing now write only on a confirmed absence, a WebDAV replace keeps the old file until the new one is in place, crypt init writes nothing before the Emergency Kit is handed over, and a large download resumes the range it was reading. Around that: SITE commands for FTP and FTPS, a local folder wherever the CLI takes a URL, a current transfer speed, and AeroAgent 1.7.

Before the tag, a pre-release review in two passes read how the cycle's changes fit together on main. It found three blockers, none of them in a released version, all fixed before the tag (#1197, #1201). Its non-blocking findings are carried to the 4.2.4 tracker as rows 42 to 44, together with the open requests.

Available on GitHub Releases (every asset with its Sigstore bundle), Snap, AUR (aeroftp-bin), winget, FlatPark and SourceForge. Closing this tracker: follow-ups continue in #1422.