[Tracker] AeroVault follow-ups, patches & roadmap

[axpnet]

AeroVault rolling tracker

Umbrella thread for AeroVault: what shipped, the follow-ups committed to the community, and known issues. This starts from the points raised by @EhudKirsh in the V3 Beta report (#2) and the design conversation (axpdev-lab/aeroftp#276 / #272 / #162).

Before opening a new discussion or issue, please check the lists below. If your point is already tracked here, add a 👍 or a comment with your environment (OS, version) instead of filing a duplicate. We keep this thread updated as items land.

Design home for format-level questions: #4.

Open follow-ups committed to Ehud

Promised in #2 and axpdev-lab/aeroftp#276, not yet shipped.

#	Type	Item	Status	Source
1	Fix	Temp + lock cleanup on abort: .aerovault.lock and .aerovault-v3-XXXX are left behind when a run is killed (should be cleaned on the error path too, not only on success)	🟢 done, fixed by audit M1 (error-path temp scrub) + M9 (stale-lock auto-reclaim); published in aerovault 0.6.2, in AeroFTP 4.0.7. See #1	#2
2	Feature	Drag & drop from File Explorer onto the create screen (and AeroFile)	🔵 planned	#2, aeroftp#276
3	Feature	Change-mode button on the import view (next to Change Password), and surface Export .txt / .json there too	🟢 done, shipped in AeroFTP 4.0.8 (1d073e7c6): v2 to/from v3, cascade, compression profile and Error Correction re-pack, same password. See the comment below	#2
4	Perf	True streaming vault I/O so peak memory is bounded by a window, not the file	🟢 done, shipping in aerovault 0.6.3 (with AeroFTP 4.0.8): the vault content path is now windowed like the .aerocorrect path, so peak memory is bounded by the window, not the file size	#2, aeroftp#276
5	Feature	Progress bar + percentage during long operations, in both GUI and CLI (compress / extract / correct)	🟡 in progress: a live compression and encryption progress bar now shows during AeroVault create and add in the GUI, with real bytes (4.0.8, 9482e6c94 + cedcf5920); the extract and correct operations and the CLI bars are still pending	#2
6	Docs	Receipt field rename ms_total -> time_elapsed, measured in seconds with a decimal, to match the visible "Time elapsed" label	🟢 done, fixed in AeroFTP 4.0.8 (508754638): the receipt headline field is now time_elapsed (seconds, one decimal), with ms_total kept alongside for millisecond precision	#2
7	Design	.aerozip: an unencrypted lane (compression + error correction, no encryption) for archive-only use	🟡 the lane now exists in aerovault 0.6.3 (shipping with AeroFTP 4.0.8): the encryption / error-correction ordering is untangled at the crate level; the user-facing .aerozip surfacing in the app is the remaining piece	#2
8	Feature	Mixed multi-select: pick files and folders together in one dialog (regular zipping experience)	🟡 maybe	#2
9	Feature	Surface the per-shard / per-copy failure counts as a health readout on verify	🟡 the aerovault 0.6.3 crate now exposes the per-shard / per-copy health (ShardHealth, shipping with AeroFTP 4.0.8); wiring it into the verify surfaces (CLI, MCP, GUI) is queued	aeroftp#276
10	Enhancement	Re-evaluate the default codec presets (Archive / Balanced) given the corpus reality (zstd barely moves already-compressed media; it pays on prose / structured data / databases)	🟡 tracked	#2, aeroftp#272

Security audit 2026-06-18 (dual blind audit + controaudit)

An independent dual blind audit (Claude Opus 4.8 + Codex GPT-5) followed by full remediation and a two-round adversarial controaudit. 1 High, 1 Medium, 3 Low, 4 Info, 0 Critical, all fixed and verified on both the crate and the app; controaudit grade A (0 open findings). Full report: #1.

ID	Sev	Finding	Status
M1	High	Standalone repair broken on Windows (handle held across persist) + plaintext-temp leak	✅ fixed (crate + app)
M2	Medium	Extract followed a pre-planted intermediate reparse point (junction) out of the destination	✅ fixed (crate)
M3	Low	Standalone repair trusts the sidecar's self-declared hash	✅ fixed, --expect-sha256 anchor (crate + app, CLI + MCP)
M4	Low	v3 extension directory bytes not under the header MAC	✅ hardened (fail-closed at open); full byte-MAC tracked for a v2 header
M5	Low	App reported EC as "stub (Phase 1)"	✅ fixed
M6	Info	Crate save_open_vault concurrency is generation-check only	✅ documented
M8	Info	instant unmaintained (RUSTSEC-2024-0384, transitive via reed-solomon-erasure)	✅ documented ignore; no vuln
M9	Info	Stale .{name}.lock after a hard crash	✅ fixed (PID-liveness auto-reclaim)
doc	n/a	Pipeline-order narrative (compression then chunking)	✅ corrected to chunking then compression repo-wide

Error-correction convergence (M7): done (round 3, 2026-06-18). The app's forked standalone EC engine is converged onto the crate (one audited .aerocorrect implementation; the app keeps a logic-free re-export), published in aerovault 0.6.2 (crates.io). See #1.

Already shipped (from the V3 Beta report)

Done in the recent v4.0.x wave; see axpdev-lab/aeroftp#276.

Item	Status
Extract-all to a chosen folder	✅ released
First-class add-folder picker	✅ released
Technical Receipt save dialog (choose destination + success feedback)	✅ released
"Time elapsed" wording (visible label)	✅ released
Pre-flight memory guard (warns instead of OOM on very large inputs)	✅ released
ZIP stores an entry as-is when deflate would not shrink it	✅ released
.aerocorrect windowed streaming + self-healing v2 sidecar	✅ released

Open design questions

• Error Correction default placement: embedded vs detached vs both (Error Correction default placement: embedded vs detached #3).

_{Status legend: 🔴 confirmed issue · 🟡 investigating / under design · 🔵 planned · 🟢 done (pending release) · ✅ released}

---

Maintained for the AeroVault format. Format-level design lives in #4; the long-form history is in axpdev-lab/aeroftp#276 / #272.

[axpnet]

Compression track: T-C1 probe fix

T-C1 is implemented and gated locally in /home/axpdev/Source/aerovault as commit 827efbc (fix(v3): sample incompressibility probe across chunks) on branch feat/trackers-crate-batch (not pushed).

Changes:

• Fixed the incompressibility probe so it no longer decides raw storage for a large chunk from only the first 64 KiB.
• Added a bounded representative sample cap: chunks up to 1 MiB are probed whole; larger chunks are sampled across the chunk.
• Added regression tests for "noisy prefix + compressible body" and large high-entropy chunks.
• Serialized streaming_stress tests with a test-local mutex because their allocator watermarks are global and default parallel test execution can contaminate peak-memory measurements.

Benchmarks, Silesia 211,938,580 B, EC off:

Run	Before #7	After T-C1
L9	61,831,701 B / 3.428x	61,596,290 B / 3.441x
L19	64,015,170 B / 3.311x	54,491,435 B / 3.889x

Local tar.bz2 -9 reference: 54,521,847 B / 3.887x. T-C1 L19 is 30,412 B smaller on this run.

Control run: temporary probe-disabled L19 produced the exact same output as T-C1 (54,491,435 B), so the representative probe recovers the full ratio available from "always compress then compare" while preserving the raw fast path for high-entropy chunks.

Gates:

cargo fmt --check --manifest-path aerovault/Cargo.toml
cargo clippy --all-targets --manifest-path aerovault/Cargo.toml -- -D warnings
cargo test --manifest-path aerovault/Cargo.toml

All green locally.

Public benchmark follow-up on Discussion #7:

#7 (comment)

Next compression step: move from bugfix to tuning matrix: decouple zstd level from CDC profile, measure level/profile combinations, then test dictionaries and zstd advanced parameters before deciding the final public positioning against tar.bz2, 7z/WinZip-style high-ratio competitors, and optional high-ratio lanes.

[axpnet]

Compression track: T-C2 level/chunk tuning

T-C2 is implemented and gated locally in /home/axpdev/Source/aerovault as commit 144d93d (feat(v3): decouple cdc bounds from zstd level) on branch feat/trackers-crate-batch (not pushed).

Changes:

• Added CreateOptionsV3::with_cdc_bounds(CdcBounds) so zstd level and CDC bounds can be selected independently.
• Preserved historical defaults: when no explicit bounds are provided, level >= 19 still selects the existing archive geometry.
• Added a regression test proving zstd_level=19 can be recorded with default balanced CDC bounds.
• Added/committed bench_ratio.rs as a reproducible benchmark example with auto, balanced, archive, and custom <min>:<avg>:<max> chunk profiles.
• Added bench_dict_proxy.rs as an experimental dictionary proxy. It does not write a container; it estimates per-chunk zstd dictionary behavior before introducing any format-visible codec id.

Gates:

cargo fmt --check --manifest-path aerovault/Cargo.toml
cargo clippy --all-targets --manifest-path aerovault/Cargo.toml -- -D warnings
cargo test --manifest-path aerovault/Cargo.toml

All green locally after T-C2.

Silesia tuning highlights, EC off:

Profile	L19	L22	Interpretation
balanced (256K:1M:4M)	56,421,489 B / 3.756x	56,403,908 B / 3.758x	dedup-first; below bzip2
archive (1M:4M:16M)	54,491,435 B / 3.889x	54,438,261 B / 3.893x	bzip2-parity profile
middle (512K:2M:8M)	55,537,452 B / 3.816x	55,522,335 B / 3.817x	better dedup than archive, still below bzip2
wide (2M:8M:32M)	53,648,083 B / 3.951x	53,479,885 B / 3.963x	stronger ratio, coarser dedup
ratio-lab (4M:16M:64M)	53,354,455 B / 3.972x	53,093,113 B / 3.992x	near solid-zstd territory, too coarse for normal dedup

Local tar.bz2 -9 reference on Silesia: 54,521,847 B / 3.887x.

Dictionary proxy finding:

• On Silesia, zstd dictionaries hurt the proxy result. This is expected enough for a corpus of a few large files and means we should not claim dictionary wins from Silesia.
• On source-code corpora, dictionaries helped the proxy by roughly 7-11%, but the proxy does not model AeroVault's small-file batching. T-C3 still needs a real pipeline prototype/new codec id before any public claim.

Local evidence files:

• /home/axpdev/Sviluppo/AeroFTP/aerovault-charts/tc2-tuning-matrix-2026-06-21.csv
• /home/axpdev/Sviluppo/AeroFTP/aerovault-charts/NOTES-2026-06-21-tc2-tuning.md

Working conclusion: keep balanced as the dedup-first/default posture; treat current archive (1M:4M:16M, probably L19) as the bzip2-parity profile; reserve wider profiles for explicit ratio-first modes. Next: real dictionary prototype inside the packed/chunked pipeline, then CPU/time measurements.

[axpnet]

Change Mode on the import view (open follow-up #3): shipped and hardened for AeroFTP 4.0.8

This thread's follow-up #3 (a Change Mode control on the import view, next to Change Password, with Export .txt / .json / Copy surfaced there too) is live. An open vault can now be re-packed across security levels and formats (v2 to/from v3, cascade), compression profile, and Error Correction, keeping the same password.

A full GUI smoke of the v2 to v3 path (a Standard vault converting to Archive v3 with the nested folder tree preserved) confirmed the repack is byte-correct, and hardened the surface around it:

Area	Description	Status	Ref (aeroftp main)
Change Mode	False "Not a valid AeroVault file" after a SUCCESSFUL repack: the post-repack refresh read the now-v3 container with the old v2 reader. The vault was always converted correctly; the Recent Vaults badge and the Activity Log entry now update too	🟢 fixed	1d073e7c6
Add Folder	EISDIR ("is a directory") when a folder was misclassified as a file via full-path matching; now matched by basename, with a create-time re-validation guard	🟢 fixed	1d073e7c6
Double-click	A local .aerovault, archive, or Cryptomator marker now opens its in-app browser, the same as the right-click action	🟢 fixed	1d073e7c6
Debug Logs	Vault create / add / Change Mode now emit backend log lines, so the Debug panel Logs tab is no longer empty for vault operations	🟢 fixed	1d073e7c6

Verified green: cargo test --lib 2261, cli bin 387, clippy --all-targets -D warnings, fmt, tsc, vitest 289, i18n 46 locales. Shipping in AeroFTP 4.0.8.